Add memory to minecraft

Signed-off-by: Nikolai Rodionov <allanger@badhouseplants.net>

.pre-commit-config.yaml

@@ -8,13 +8,14 @@ repos:
     hooks:
       - id: yamlfmt
         exclude: |
-          (?x)^(
-            .*secrets.*yaml
-          )$
-  - repo: https://github.com/codespell-project/codespell
-    rev: v2.2.4
-    hooks:
-      - id: codespell
+          (?x)(
+            ^charts/|
+            ^.*secrets.*yaml|
+          )
+          #  - repo: https://github.com/codespell-project/codespell
+          #    rev: v2.2.4
+          #    hooks:
+          #      - id: codespell
   - repo: local
     hooks:
       - id: check-sops-secrets

.sops.yaml

@@ -8,3 +8,7 @@ creation_rules:
     key_groups:
       - age:
           - age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+  - path_regex: common/values/secrets.*
+    key_groups:
+      - age:
+          - age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8

charts/issuer/templates/issuer.yaml

@@ -1,10 +1,23 @@
+{{- range $name, $issuer := .Values.clusterIssuers }}
 ---
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
 metadata:
   labels:
-    {{- include "issuer.labels" . | nindent 4 }}
-  name: "{{ .Values.name }}"
+    {{- include "issuer.labels" $ | nindent 4 }}
+  name: "{{ $name }}"
 spec:
-  acme:
-{{ .Values.spec | toYaml | indent 2 }}
+{{ $issuer.spec | toYaml | indent 2 }}
+{{- end }}
+{{- range $name, $issuer := .Values.issuers }}
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  labels:
+    {{- include "issuer.labels" $ | nindent 4 }}
+  name: "{{ $name }}"
+  namespace: {{ $issuer.namespace }}
+spec:
+{{ $issuer.spec | toYaml | indent 2 }}
+{{- end }}

charts/metallb-resources/Chart.yaml

@@ -0,0 +1,24 @@
+apiVersion: v2
+name: metallb-resources
+description: A Helm chart for Kubernetes
+
+# A chart can be either an 'application' or a 'library' chart.
+#
+# Application charts are a collection of templates that can be packaged into versioned archives
+# to be deployed.
+#
+# Library charts provide useful utilities or functions for the chart developer. They're included as
+# a dependency of application charts to inject those utilities and functions into the rendering
+# pipeline. Library charts do not define any templates and therefore cannot be deployed.
+type: application
+
+# This is the chart version. This version number should be incremented each time you make changes
+# to the chart and its templates, including the app version.
+# Versions are expected to follow Semantic Versioning (https://semver.org/)
+version: 0.1.0
+
+# This is the version number of the application being deployed. This version number should be
+# incremented each time you make changes to the application. Versions are not expected to
+# follow Semantic Versioning. They should reflect the version the application is using.
+# It is recommended to use it with quotes.
+appVersion: "1.16.0"

charts/metallb-resources/templates/_helpers.tpl

@@ -1,7 +1,7 @@
 {{/*
 Expand the name of the chart.
 */}}
-{{- define "root.name" -}}
+{{- define "metallb-resources.name" -}}
 {{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
@@ -10,7 +10,7 @@ Create a default fully qualified app name.
 We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec).
 If release name contains chart name it will be used as a full name.
 */}}
-{{- define "root.fullname" -}}
+{{- define "metallb-resources.fullname" -}}
 {{- if .Values.fullnameOverride }}
 {{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
 {{- else }}
@@ -26,16 +26,16 @@ If release name contains chart name it will be used as a full name.
 {{/*
 Create chart name and version as used by the chart label.
 */}}
-{{- define "root.chart" -}}
+{{- define "metallb-resources.chart" -}}
 {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
 {{- end }}
 
 {{/*
 Common labels
 */}}
-{{- define "root.labels" -}}
-helm.sh/chart: {{ include "root.chart" . }}
-{{ include "root.selectorLabels" . }}
+{{- define "metallb-resources.labels" -}}
+helm.sh/chart: {{ include "metallb-resources.chart" . }}
+{{ include "metallb-resources.selectorLabels" . }}
 {{- if .Chart.AppVersion }}
 app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
 {{- end }}
@@ -45,17 +45,17 @@ app.kubernetes.io/managed-by: {{ .Release.Service }}
 {{/*
 Selector labels
 */}}
-{{- define "root.selectorLabels" -}}
-app.kubernetes.io/name: {{ include "root.name" . }}
+{{- define "metallb-resources.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "metallb-resources.name" . }}
 app.kubernetes.io/instance: {{ .Release.Name }}
 {{- end }}
 
 {{/*
 Create the name of the service account to use
 */}}
-{{- define "root.serviceAccountName" -}}
+{{- define "metallb-resources.serviceAccountName" -}}
 {{- if .Values.serviceAccount.create }}
-{{- default (include "root.fullname" .) .Values.serviceAccount.name }}
+{{- default (include "metallb-resources.fullname" .) .Values.serviceAccount.name }}
 {{- else }}
 {{- default "default" .Values.serviceAccount.name }}
 {{- end }}

charts/metallb-resources/templates/ip_address_pool.tpl

@@ -0,0 +1,7 @@
+apiVersion: metallb.io/v1beta1
+kind: IPAddressPool
+metadata:
+  name: {{ include "metallb-resources.fullname" . }}
+spec:
+  addresses:
+  - {{ .Values.addresses}}

charts/metallb-resources/values.yaml

@@ -0,0 +1 @@
+addresses: 1.1.1.1-1.1.1.1

charts/namespaces/kustomize/flux-system.yml

@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: flux-system
-  labels:
-    name: flux-system

charts/namespaces/kustomize/giantswarm-flux.yml

@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: giantswarm-flux
-  labels:
-    name: giantswarm-flux

charts/namespaces/kustomize/giantswarm.yml

@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: giantswarm
-  labels:
-    name: giantswarm

charts/namespaces/kustomize/kustomization.yaml

@@ -1,5 +0,0 @@
-resources:
-  - ./giantswarm-flux.yml
-  - ./giantswarm.yml
-  - ./monitoring.yml
-  - ./org-giantswarm.yml

charts/namespaces/kustomize/monitoring.yml

@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: monitoring
-  labels:
-    name: monitoring

charts/namespaces/kustomize/org-giantswarm.yml

@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: org-giantswarm
-  labels:
-    name: org-giantswarm

charts/namespaces/templates/namespaces.yaml

@@ -15,5 +15,24 @@ metadata:
     {{- with $ns.annotations}}
     {{- toYaml . | nindent 4 }}
   {{- end }}
+{{- if $ns.defaultRegcred }}
+---
+apiVersion: v1
+kind: Secret
+type: kubernetes.io/dockerconfigjson
+metadata:
+  name: regcred
+  namespace: {{ $ns.name }}
+data:
+  .dockerconfigjson: {{ $.Values.defaultRegcred }}
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: default
+  namespace: {{ $ns.name }}
+imagePullSecrets:
+  - name: regcred
+{{- end }}
 {{- end }}
 {{- end }}

charts/root/Chart.yaml

@@ -1,6 +0,0 @@
-apiVersion: v2
-name: root
-description: A Helm chart for Kubernetes
-type: application
-version: 0.1.5
-appVersion: "1.16.0"

charts/root/templates/root.yaml

@@ -1,25 +0,0 @@
-{{ if .Capabilities.APIVersions.Has "source.toolkit.fluxcd.io/v1" }}
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: GitRepository
-metadata:
-  name: root
-spec:
-  interval: 30s
-  url: {{ .Values.url }}
-  ref:
-    branch: {{ .Values.branch }}
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: root
-spec:
-  interval: 30s
-  targetNamespace: flux-system
-  sourceRef:
-    kind: GitRepository
-    name: root
-  path: "."
-  prune: false
-  timeout: 1m
-{{- end }}

charts/root/templates/self.yaml

@@ -1,25 +0,0 @@
-{{ if .Capabilities.APIVersions.Has "source.toolkit.fluxcd.io/v1" }}
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: GitRepository
-metadata:
-  name: root-self
-spec:
-  interval: 30s
-  url: {{ .Values.self.url }}
-  ref:
-    branch: {{ .Values.self.branch }}
----
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: root-self
-spec:
-  interval: 30s
-  targetNamespace: flux-system
-  sourceRef:
-    kind: GitRepository
-    name: root-self
-  path: "."
-  prune: false
-  timeout: 1m
-{{- end }}

charts/root/values.yaml

@@ -1,5 +0,0 @@
-url: https://git.badhouseplants.net/giantswarm/cluster-example.git
-branch: main
-self:
-  url: git@git.badhouseplants.net:giantswarm/root-config.git
-  branch: master

charts/tf-ocloud/.helmignore

@@ -1,23 +0,0 @@
-# Patterns to ignore when building packages.
-# This supports shell glob matching, relative path matching, and
-# negation (prefixed with !). Only one pattern per line.
-.DS_Store
-# Common VCS dirs
-.git/
-.gitignore
-.bzr/
-.bzrignore
-.hg/
-.hgignore
-.svn/
-# Common backup files
-*.swp
-*.bak
-*.tmp
-*.orig
-*~
-# Various IDEs
-.project
-.idea/
-*.tmproj
-.vscode/

charts/tf-ocloud/Chart.lock

@@ -1,6 +0,0 @@
-dependencies:
-- name: helm-library
-  repository: oci://ghcr.io/allanger/allangers-helm-library
-  version: 0.1.4
-digest: sha256:6306a6a8d3c51b2b5f37cffa88c3731550da789d1ce2317a83a3f9a657310f8e
-generated: "2024-10-16T20:01:59.337767+02:00"

charts/tf-ocloud/Chart.yaml

@@ -1,15 +0,0 @@
-apiVersion: v2
-name: tf-ocloud
-type: application
-version: 0.1.0
-appVersion: 0.1.5
-maintainers:
-  - name: allanger
-    email: allanger@zohomail.com
-    url: https://badhouseplants.net
-dependencies:
-  - name: helm-library
-    version: 0.1.5
-    repository: oci://ghcr.io/allanger/allangers-helm-library
-annotations:
-  allowed_workload_kinds: "Deployment"

charts/tf-ocloud/templates/install.yaml

@@ -1,3 +0,0 @@
-{{ include "lib.component.workload" . }}
-{{ include "lib.component.files" . }}
-{{ include "lib.component.env" . }}

charts/tf-ocloud/values.yaml

@@ -1,67 +0,0 @@
----
-workload:
-  kind: Deployment
-  strategy:
-    type: RollingUpdate
-  securityContext: {}
-  containers:
-    tf:
-      securityContext: {}
-      image:
-        registry: zot.badhouseplants.net
-        repository: badhouseplants/terraform-ocloud
-        tag: 7eae6ec805bc99618a196abf9d4d2e0fd19f75e6
-        pullPolicy: Always
-      envFrom:
-        - main
-      mounts:
-        files:
-          ocloudkey:
-            path: /src/key.pem
-            subPath: key.pem
-          publickey:
-            path: /src/public_key
-            subPath: public-key
-          privatekey:
-            path: /src/ssh_key
-            subPath: ssh-key
-          tfvars:
-            path: /src/terraform.tfvars
-            subPath: terraform.tfvars
-        extraVolumes:
-          dottf:
-            path: /src/.terraform
-
-extraVolumes:
-  dottf:
-    emptyDir: {}
-
-files:
-  ocloudkey:
-    enabled: true
-    sensitive: false
-    remove: []
-    entries:
-      key.pem:
-        data: dummy
-  publickey:
-    enabled: true
-    sensitive: false
-    remove: []
-    entries:
-      public-key:
-        data: dummy
-  privatekey:
-    enabled: true
-    sensitive: false
-    remove: []
-    entries:
-      ssh-key:
-        data: dummy
-  tfvars:
-    enabled: true
-    sensitive: false
-    remove: []
-    entries:
-      terraform.tfvars:
-        data: dummy

common/environments.yaml

@@ -2,6 +2,7 @@ environments:
   badhouseplants:
     kubeContext: badhouseplants
     values:
+      - ./common/values/values.badhouseplants.yaml
       - base:
           enabled: true
       - velero:
@@ -11,7 +12,7 @@ environments:
       - backups:
           enabled: false
       - localpath:
-          enabled: true
+          enabled: false
       - openebs:
           enabled: true
       - postgres17:
@@ -21,10 +22,11 @@ environments:
       - redis:
           enabled: true
       - istio:
-          enabled: false
+          enabled: true
   etersoft:
     kubeContext: etersoft
     values:
+      - ./common/values/values.etersoft.yaml
       - base:
           enabled: true
       - velero:
@@ -41,52 +43,6 @@ environments:
           enabled: false
       - redis:
           enabled: false
-      - postgres16:
-          enabled: true
-      - istio:
-          enabled: false
-  xray-1:
-    kubeContext: xray-1
-    values:
-      - base:
-          enabled: false
-      - velero:
-          enabled: false
-      - workload:
-          enabled: false
-      - backups:
-          enabled: false
-      - openebs:
-          enabled: false
-      - localpath:
-          enabled: false
-      - postgres17:
-          enabled: false
-      - redis:
-          enabled: false
-      - postgres16:
-          enabled: false
-      - istio:
-          enabled: false
-  xray-2:
-    kubeContext: xray-2
-    values:
-      - base:
-          enabled: false
-      - velero:
-          enabled: false
-      - workload:
-          enabled: false
-      - backups:
-          enabled: false
-      - openebs:
-          enabled: false
-      - localpath:
-          enabled: false
-      - postgres17:
-          enabled: false
-      - redis:
-          enabled: false
       - postgres16:
           enabled: false
       - istio:

common/templates.yaml

@@ -1,3 +1,6 @@
+helmDefaults:
+  kubeContext: {{ .StateValues.kubeContext }}
+
 templates:
   # ---------------------------
   # -- Hooks
@@ -37,6 +40,21 @@ templates:
   default-env-secrets:
     secrets:
       - '{{ requiredEnv "PWD" }}/values/{{ .Environment.Name }}/secrets.{{ `{{ .Release.Name }}` }}.yaml'
+  common-values:
+    values:
+      - '../values/common/{{ `{{ .Release.Namespace }}` }}/{{ `{{ .Release.Name }}` }}/values.yaml'
+  common-values-tpl:
+    values:
+      - '../values/common/{{ `{{ .Release.Namespace }}` }}/{{ `{{ .Release.Name }}` }}/values.gotmpl'
+  env-values:
+    values:
+      - '../values/{{ .Environment.Name }}/{{ `{{ .Release.Namespace }}` }}/{{ `{{ .Release.Name }}` }}/values.yaml'
+  env-values-tpl:
+    values:
+      - '../values/{{ .Environment.Name }}/{{ `{{ .Release.Namespace }}` }}/{{ `{{ .Release.Name }}` }}/values.gotmpl'
+  env-secrets:
+    secrets:
+      - '../values/{{ .Environment.Name }}/{{ `{{ .Release.Namespace }}` }}/{{ `{{ .Release.Name }}` }}/secrets.yaml'
   # ----------------------------
   # -- Extensions
   # ----------------------------
@@ -53,7 +71,7 @@ templates:
         version: 2.0.0
         alias: traefik
     values:
-      - '{{ requiredEnv "PWD" }}/values/common/values.tcp-route.yaml'
+      - '../values/common/values.tcp-route.yaml'
   ext-udp-routes:
     dependencies:
       - chart: bedag/raw
@@ -110,7 +128,7 @@ templates:
         version: 2.0.0
         alias: ext-database
     values:
-      - '{{ requiredEnv "PWD" }}/values/common/values.database.yaml'
+      - '../values/common/values.database.yaml'
   ext-secret:
     dependencies:
       - chart: bedag/raw

common/values/values.badhouseplants.yaml

@@ -1,4 +1,6 @@
-namespaces:
-  kubeSystem: kube-system
-  kubePublic: kube-public
-  
+registry: registry.badhouseplants.net/containers
+registry_url: registry.badhouseplants.net
+main_ip: 195.201.249.91
+tools:
+  openebs:
+    enabled: true

common/values/values.etersoft.yaml

@@ -0,0 +1,6 @@
+registry: registry.ru.badhouseplants.net/containers
+registry_url: registry.ru.badhouseplants.net
+main_ip: 91.232.225.63
+tools:
+  openebs:
+    enabled: false

helmfile.yaml

@@ -1,11 +0,0 @@
-bases:
-  - ./common/environments.yaml
-  - ./common/templates.yaml
-helmfiles:
-  - ./installations/system/
-  - ./installations/databases/
-  - ./installations/platform/
-  - ./installations/pipelines/
-  - ./installations/monitoring/
-  - ./installations/applications/helmfile-{{ .Environment.Name }}.yaml
-  - ./installations/games/

helmfile.yaml.gotmpl

@@ -0,0 +1,25 @@
+---
+bases:
+  - ./common/environments.yaml
+---
+helmfiles:
+  - path: ./helmfiles/base.yaml
+    values:
+      - kubeContext: "{{ .Environment.KubeContext }}"
+      - {{ toYaml .Environment.Values | nindent 8 }}
+  - path: ./helmfiles/system.yaml
+    values:
+      - kubeContext: "{{ .Environment.KubeContext }}"
+      - {{ toYaml .Environment.Values | nindent 8 }}
+  - path: ./helmfiles/platform.yaml
+    values:
+      - kubeContext: "{{ .Environment.KubeContext }}"
+      - {{ toYaml .Environment.Values | nindent 8 }}
+  - path: ./helmfiles/databases.yaml
+    values:
+      - kubeContext: "{{ .Environment.KubeContext }}"
+      - {{ toYaml .Environment.Values | nindent 8 }}
+  - path: ./helmfiles/applications.yaml
+    values:
+      - kubeContext: "{{ .Environment.KubeContext }}"
+      - {{ toYaml .Environment.Values | nindent 8 }}

helmfiles/applications.yaml

@@ -0,0 +1,28 @@
+bases:
+  - ../common/templates.yaml
+
+repositories:
+  - name: gitea
+    url: https://dl.gitea.io/charts/
+  - name: bedag
+    url: https://bedag.github.io/helm-charts/
+  - name: minecraft
+    url: https://itzg.github.io/minecraft-server-charts/
+
+releases:
+  - name: app-gitea
+    chart: gitea/gitea
+    version: 11.0.1
+    namespace: org-badhouseplants
+    inherit:
+      - template: env-values
+      - template: env-secrets
+
+  - name: minecraft
+    chart: minecraft/minecraft
+    namespace: games
+    version: 4.26.1
+    inherit:
+      - template: common-values-tpl
+      - template: env-values
+      - template: env-secrets

helmfiles/base.yaml

@@ -0,0 +1,21 @@
+bases:
+  - ../common/templates.yaml
+
+releases:
+  # -- This one must be executed with --take-ownership at least once
+  - name: namespaces
+    chart: ../charts/namespaces
+    namespace: kube-system
+    createNamespace: false
+    inherit:
+      - template: env-values
+      - template: env-secrets
+
+  - name: roles
+    chart: ../charts/roles
+    namespace: kube-system
+    createNamespace: false
+    needs:
+      - kube-system/namespaces
+    inherit:
+      - template: env-values

helmfiles/databases.yaml

@@ -1,21 +1,25 @@
 bases:
-  - ../../common/environments.yaml
-  - ../../common/templates.yaml
+  - ../common/templates.yaml
+
 repositories:
   - name: bitnami
     url: registry-1.docker.io/bitnamicharts
     oci: true
   - name: bedag
     url: https://bedag.github.io/helm-charts/
+commonLabels:
+  installation: databases
 releases:
   - name: redis
     chart: bitnami/redis
     namespace: databases
     condition: redis.enabled
-    version: 20.4.0
+    version: 20.11.3
     inherit:
-      - template: default-env-values
-      - template: default-env-secrets
+      - template: common-values-tpl
+      - template: env-values
+      - template: env-secrets
+
   - name: postgres16
     labels:
       bundle: postgres
@@ -24,15 +28,18 @@ releases:
     condition: postgres16.enabled
     version: 15.5.38
     inherit:
-      - template: default-env-values
-      - template: default-env-secrets
+      - template: common-values-tpl
+      - template: env-values
+      - template: env-secrets
+
   - name: postgres17
     labels:
       bundle: postgres
     namespace: databases
     chart: bitnami/postgresql
     condition: postgres17.enabled
-    version: 16.0.6
+    version: 16.3.4
     inherit:
-      - template: default-env-values
-      - template: default-env-secrets
+      - template: common-values-tpl
+      - template: env-values
+      - template: env-secrets

helmfiles/platform.yaml

@@ -0,0 +1,122 @@
+bases:
+  - ../common/templates.yaml
+
+repositories:
+  - name: keel
+    url: https://keel-hq.github.io/keel/
+  - name: uptime-kuma
+    url: https://helm.irsigler.cloud
+  - name: external-dns
+    url: https://kubernetes-sigs.github.io/external-dns/
+  - name: minio-standalone
+    url: https://charts.min.io/
+  - name: db-operator
+    url: https://db-operator.github.io/charts
+  - name: zot
+    url: https://zotregistry.dev/helm-charts/
+  - name: goauthentik
+    url: https://charts.goauthentik.io/
+  - name: flux-community
+    url: ghcr.io/fluxcd-community/charts
+    oci: true
+  - name: bedag
+    url: https://bedag.github.io/helm-charts/
+  - name: argo
+    url: https://argoproj.github.io/argo-helm
+
+releases:
+  - name: external-dns
+    chart: external-dns/external-dns
+    version: 1.15.2
+    namespace: platform
+    inherit:
+      - template: common-values-tpl
+      - template: env-values
+      - template: env-secrets
+
+  - name: flux2
+    chart: flux-community/flux2
+    installed: false
+    version: 2.15.0
+    namespace: flux-system
+    inherit:
+      - template: common-values-tpl
+
+  - name: argocd
+    chart: argo/argo-cd
+    version: 7.8.23
+    namespace: argocd
+    inherit:
+      - template: env-values
+      - template: env-secrets
+
+  - name: keel
+    chart: keel/keel
+    version: v1.0.5
+    labels:
+      layer: platform
+    namespace: platform
+    inherit:
+      - template: common-values-tpl
+
+  - name: uptime-kuma
+    chart: uptime-kuma/uptime-kuma
+    version: 2.21.2
+    namespace: platform
+    labels:
+      layer: platform
+    inherit:
+      - template: common-values-tpl
+      - template: env-values
+
+  - name: minio
+    chart: minio-standalone/minio
+    version: 5.4.0
+    namespace: platform
+    labels:
+      layer: platform
+    inherit:
+      - template: common-values-tpl
+      - template: env-values
+      - template: env-secrets
+
+  - name: db-operator
+    namespace: platform
+    chart: db-operator/db-operator
+    version: 1.34.0
+    inherit:
+      - template: common-values-tpl
+
+  - name: db-instances
+    chart: db-operator/db-instances
+    namespace: platform
+    needs:
+      - platform/db-operator
+    version: 2.4.0
+    inherit:
+      - template: env-values
+      - template: env-secrets
+
+  - name: zot
+    chart: zot/zot
+    version: 0.1.67
+    namespace: platform
+    condition: workload.enabled
+    inherit:
+      - template: common-values-tpl
+      - template: env-values
+      - template: env-secrets
+
+  - name: authentik
+    chart: goauthentik/authentik
+    version: 2025.2.2
+    namespace: platform
+    createNamespace: false
+    condition: workload.enabled
+    needs:
+      - platform/db-operator
+    inherit:
+      - template: common-values-tpl
+      - template: env-values
+      - template: env-secrets
+      - template: ext-database

helmfiles/system.yaml

@@ -1,10 +1,13 @@
 bases:
-  - ../../common/environments.yaml
-  - ../../common/templates.yaml
+  - ../common/templates.yaml
 
 repositories:
-  - name: bedag
-    url: https://bedag.github.io/helm-charts/
+  - name: coredns
+    url: https://coredns.github.io/helm
+  - name: zot
+    url: https://zotregistry.dev/helm-charts/
+  - name: cilium
+    url: https://helm.cilium.io/
   - name: metrics-server
     url: https://kubernetes-sigs.github.io/metrics-server/
   - name: jetstack
@@ -13,170 +16,166 @@ repositories:
     url: https://metallb.github.io/metallb
   - name: traefik
     url: https://traefik.github.io/charts
-  - name: coredns
-    url: https://coredns.github.io/helm
-  - name: cilium
-    url: https://helm.cilium.io/
+  - name: local-path-provisioner
+    url: git+https://github.com/rancher/local-path-provisioner@deploy/chart?ref=master
+  - name: kyverno
+    url: https://kyverno.github.io/kyverno/
   - name: vmware-tanzu
     url: https://vmware-tanzu.github.io/helm-charts/
   - name: openebs
     url: https://openebs.github.io/openebs
-  - name: local-path-provisioner
-    url: git+https://github.com/rancher/local-path-provisioner@deploy/chart?ref=master
   - name: istio
     url: https://istio-release.storage.googleapis.com/charts
 
 releases:
-  - name: namespaces
-    chart: '{{ requiredEnv "PWD" }}/charts/namespaces/chart'
-    namespace: kube-public
-    createNamespace: false
-    inherit:
-      - template: default-env-values
-
-  - name: roles
-    chart: '{{ requiredEnv "PWD" }}/charts/roles'
-    namespace: kube-public
-    createNamespace: false
-    needs:
-      - kube-public/namespaces
-    inherit:
-      - template: default-env-values
-
   - name: coredns
     chart: coredns/coredns
-    version: 1.37.0
+    version: 1.39.1
     namespace: kube-system
     inherit:
-      - template: default-common-values
+      - template: common-values-tpl
 
   - name: cilium
     chart: cilium/cilium
-    version: 1.16.4
-    condition: base.enabled
+    version: 1.17.2
     namespace: kube-system
     needs:
       - kube-system/coredns
     inherit:
-      - template: default-env-values
+      - template: common-values
+      - template: common-values-tpl
 
   - name: cert-manager
     chart: jetstack/cert-manager
-    version: v1.16.2
+    version: v1.17.1
     namespace: kube-system
-    condition: base.enabled
     missingFileHandler: Warn
     needs:
       - kube-system/cilium
     inherit:
-      - template: default-common-values
-      - template: default-env-values
+      - template: common-values
+      - template: common-values-tpl
 
   - name: issuer
-    chart: '{{ requiredEnv "PWD" }}/charts/issuer'
-    namespace: kube-public
+    chart: ../charts/issuer
+    namespace: kube-system
     missingFileHandler: Warn
-    condition: base.enabled
     needs:
       - kube-system/cert-manager
     inherit:
-      - template: default-common-values
-      - template: default-env-values
+      - template: common-values
 
-  - name: metrics-server
-    chart: metrics-server/metrics-server
-    version: 3.12.2
+  - name: local-path-provisioner
+    chart: local-path-provisioner/local-path-provisioner
     namespace: kube-system
+    inherit:
+      - template: common-values-tpl
+
+  - name: kyverno
+    chart: kyverno/kyverno
+    namespace: kyverno
+    version: 3.3.7
     needs:
       - kube-system/cilium
     inherit:
-      - template: default-common-values
+      - template: common-values-tpl
+
+  - name: kyverno-policies
+    chart: kyverno/kyverno-policies
+    namespace: kyverno
+    version: 3.3.4
+    needs:
+      - kyverno/kyverno
+
+  - name: custom-kyverno-policies
+    chart: ../kustomizations/kyverno/{{ .Environment.Name }}
+    namespace: kyverno
+    needs:
+      - kyverno/kyverno
 
   - name: metallb
     chart: metallb/metallb
     namespace: kube-system
     condition: base.enabled
-    version: 0.14.8
+    version: 0.14.9
     needs:
-      - kube-system/cilium
+      - registry/cluster-mirror
     inherit:
-      - template: default-common-values
+      - template: common-values
+      - template: common-values-tpl
 
   - name: metallb-resources
-    chart: bedag/raw
+    chart: ../charts/metallb-resources
     version: 2.0.0
     condition: base.enabled
     namespace: kube-system
     needs:
       - kube-system/metallb
     inherit:
-      - template: ext-metallb
-      - template: default-env-values
+      - template: common-values-tpl
 
   - name: traefik
     chart: traefik/traefik
-    version: 33.1.0
+    version: 34.4.1
     condition: base.enabled
     namespace: kube-system
+    inherit:
+      - template: common-values-tpl
+      - template: common-values
+      - template: env-values
+
+  - name: cluster-mirror
+    chart: zot/zot
+    version: 0.1.67
+    createNamespace: false
+    installed: true
+    namespace: registry
     needs:
       - kube-system/cilium
     inherit:
-      - template: default-common-values
-      - template: default-env-values
+      - template: common-values-tpl
+      - template: env-secrets
+
+  - name: metrics-server
+    chart: metrics-server/metrics-server
+    version: 3.12.2
+    namespace: kube-system
+    needs:
+      - registry/cluster-mirror
+    inherit:
+      - template: common-values-tpl
+
+  - name: openebs
+    chart: openebs/openebs
+    condition: tools.openebs.enabled
+    namespace: kube-system
+    version: 4.2.0
+    inherit:
+      - template: common-values-tpl
+      - template: env-values
 
   - name: velero
     chart: vmware-tanzu/velero
     namespace: velero
-    version: 8.1.0
+    version: 8.7.0
     condition: velero.enabled
-    needs:
-      - kube-system/cilium
     inherit:
-      - template: default-env-values
-      - template: default-env-secrets
-      - template: crd-management-hook
-
-  - name: openebs
-    chart: openebs/openebs
-    condition: openebs.enabled
-    namespace: kube-system
-    version: 4.1.1
-    needs:
-      - kube-system/cilium
-    inherit:
-      - template: default-env-values
-
-  # -- Not versions since it's idnstalled from git
-  - name: local-path-provisioner
-    chart: local-path-provisioner/local-path-provisioner
-    condition: localpath.enabled
-    namespace: kube-system
-    needs:
-      - kube-system/cilium
-    inherit:
-      - template: default-env-values
+      - template: common-values-tpl
+      - template: env-values
+      - template: env-secrets
 
   - name: istio-base
     chart: istio/base
-    condition: istio.enabled
     namespace: istio-system
+    version: 1.25.1
     inherit:
-      - template: crd-management-hook
-
-  - name: istio-ingressgateway
-    chart: istio/gateway
-    condition: istio.enabled
-    namespace: istio-system
-    needs:
-      - istio-system/istio-base
-    inherit:
-      - template: default-env-values
+      - template: common-values
 
   - name: istiod
     chart: istio/istiod
-    condition: istio.enabled
     namespace: istio-system
+    version: 1.25.1
     inherit:
-      - template: default-env-values
+      - template: common-values-tpl
     needs:
       - istio-system/istio-base

installations/applications/helmfile-badhouseplants.yaml

@@ -1,127 +1,91 @@
 bases:
   - ../../common/environments.yaml
   - ../../common/templates.yaml
+
 repositories:
-  - name: softplayer-oci
-    url: zot.badhouseplants.net/softplayer/helm
-    oci: true
-  - name: allanger-oci
-    url: zot.badhouseplants.net/allanger/helm
-    oci: true
-  - name: requarks
-    url: https://charts.js.wiki
-  - name: ananace-charts
-    url: https://ananace.gitlab.io/charts
   - name: gitea
     url: https://dl.gitea.io/charts/
-  - name: mailu
-    url: https://mailu.github.io/helm-charts/
-  - name: bedag
-    url: https://bedag.github.io/helm-charts/
-  - name: bitnami
-    url: https://charts.bitnami.com/bitnami
   - name: allangers-charts
     url: ghcr.io/allanger/allangers-charts
     oci: true
-  - name: robjuz
-    url: https://robjuz.github.io/helm-charts/
   - name: badhouseplants-helm
     url: git+https://gitea.badhouseplants.net/badhouseplants/badhouseplants-helm@charts?ref=main
+  - name: bedag
+    url: https://bedag.github.io/helm-charts/
+    #- name: open-strike
+    #  url: git+https://gitea.badhouseplants.net/badhouseplants/open-strike-2.git@helm?ref=main
+
 releases:
-  - name: funkwhale
-    chart: ananace-charts/funkwhale
-    namespace: applications
-    installed: false
-    version: 2.0.5
-    inherit:
-      - template: default-env-values
-      - template: default-env-secrets
-      - template: ext-database
-  - name: gitea
-    chart: gitea/gitea
-    version: 10.6.0
-    namespace: applications
-    inherit:
-      - template: default-env-values
-      - template: default-env-secrets
-      - template: ext-database
-      - template: ext-tcp-routes
-  - name: openvpn
-    chart: allangers-charts/openvpn
-    version: 0.0.2
-    namespace: applications
-    inherit:
-      - template: default-env-values
-      - template: ext-tcp-routes
-  - name: vaultwarden
+  - name: app-vaultwarden
     chart: allangers-charts/vaultwarden
-    version: 2.3.0
-    namespace: applications
+    version: 3.1.1
+    namespace: org-badhouseplants
     inherit:
-      - template: default-env-values
-      - template: default-env-secrets
-      - template: ext-database
-  - name: stalwart
+      - template: env-values
+      - template: env-secrets
+
+  - name: app-stalwart
     chart: allangers-charts/stalwart
-    version: 0.4.0
-    namespace: applications
+    version: 1.0.1
+    namespace: org-badhouseplants
     inherit:
-      - template: default-env-values
-      - template: default-env-secrets
-      - template: ext-tcp-routes
-  - name: navidrome
-    chart: allangers-charts/navidrome
-    namespace: applications
+      - template: env-values
+      - template: env-secrets
+
+  - name: app-tandoor-recipes
+    chart: allangers-charts/tandoor-recipes
     version: 0.2.0
+    namespace: org-allanger
     inherit:
-      - template: default-env-values
+      - template: env-values
+      - template: env-secrets
+      - template: ext-database
+
+  - name: app-navidrome
+    chart: allangers-charts/navidrome
+    namespace: org-badhouseplants
+    version: 0.5.0
+    inherit:
+      - template: env-values
       - template: ext-traefik-middleware
-  - name: navidrome-private
+
+  - name: app-navidrome-private
     chart: allangers-charts/navidrome
-    namespace: applications
-    version: 0.2.0
+    namespace: org-badhouseplants
+    version: 0.5.0
     inherit:
-      - template: default-env-values
-      - template: default-env-secrets
+      - template: env-values
+      - template: env-secrets
+
   - name: server-xray-public
     chart: allangers-charts/server-xray
     namespace: public-xray
-    version: 0.4.0
+    version: 0.6.0
     inherit:
       - template: default-env-secrets
       - template: default-env-values
       - template: ext-tcp-routes
       - template: ext-cilium
       - template: ext-certificate
+
   - name: server-xray-public-edge
     chart: allangers-charts/server-xray
-    installed: true
+    installed: false
     namespace: public-xray
-    version: 0.4.0
+    version: 0.6.0
     inherit:
       - template: default-env-secrets
       - template: default-env-values
       - template: ext-tcp-routes
       - template: ext-cilium
       - template: ext-certificate
-  - name: vaultwardentest
-    chart: allangers-charts/vaultwarden
-    version: 2.4.0
-    namespace: applications
-    installed: false
-    inherit:
-      - template: default-env-values
-      - template: default-env-secrets
-      - template: ext-database
 
-  - name: tandoor-recipes
-    chart: allangers-charts/tandoor-recipes
-    installed: false
-    version: 0.1.0
+  - name: memos
+    chart: allangers-charts/memos
+    version: 0.3.0
     namespace: applications
     inherit:
       - template: default-env-values
-      - template: default-env-secrets
       - template: ext-database
 
   - name: badhouseplants-net

installations/applications/helmfile-etersoft.yaml

@@ -8,17 +8,12 @@ repositories:
   - name: gabe565
     url: ghcr.io/gabe565/charts
     oci: true
+  - name: xray-docs
+    url: git+https://gitea.badhouseplants.net/badhouseplants/xray-docs.git@helm?ref=main
 releases:
-  - name: openvpn
-    chart: allangers-charts/openvpn
-    version: 0.0.2
-    namespace: applications
-    inherit:
-      - template: default-env-values
-      - template: ext-tcp-routes
   - name: qbittorrent
     chart: gabe565/qbittorrent
-    version: 0.4.0
+    version: 0.4.1
     namespace: applications
     inherit:
       - template: default-env-values
@@ -26,35 +21,39 @@ releases:
       - template: ext-traefik-middleware
   - name: vaultwardentest
     chart: allangers-charts/vaultwarden
-    version: 2.4.0
+    version: 3.1.1
     namespace: applications
     inherit:
       - template: default-env-values
       - template: default-env-secrets
-      - template: ext-database
-  - name: tf-ocloud
-    chart: ../../charts/tf-ocloud
-    namespace: pipelines
-    installed: false
-    inherit:
-      - template: default-env-secrets
 
-  - name: nrodionov
-    chart: bitnami/wordpress
-    version: 23.1.28
+  - name: memos
+    chart: allangers-charts/memos
+    version: 0.3.0
     namespace: applications
-    installed: true
     inherit:
       - template: default-env-values
-      - template: default-env-secrets
-  - name: server-xray-public-bridge
-    chart: allangers-charts/server-xray
+
+
+  - name: external-service-xray
+    chart: ../../kustomizations/external-service-xray
     installed: true
     namespace: public-xray
-    version: 0.4.0
+
+  - name: server-xray-public
+    chart: allangers-charts/server-xray
+    namespace: public-xray
+    version: 0.6.0
     inherit:
       - template: default-env-secrets
       - template: default-env-values
       - template: ext-tcp-routes
       - template: ext-cilium
       - template: ext-certificate
+
+  - name: xray-docs
+    chart: xray-docs/xray-docs
+    installed: true
+    namespace: public-xray
+    inherit:
+      - template: default-env-values

installations/applications/helmfile-xray-1.yaml

@@ -1,23 +0,0 @@
-bases:
-  - ../../common/environments.yaml
-  - ../../common/templates.yaml
-repositories:
-  - name: allangers-charts
-    url: ghcr.io/allanger/allangers-charts
-    oci: true
-releases:
-  - name: server-xray-public
-    chart: allangers-charts/server-xray
-    namespace: public-xray
-    version: 0.4.0
-    inherit:
-      - template: default-env-secrets
-      - template: default-env-values
-      - template: ext-self-signed-cert
-  - name: promtail
-    chart: grafana/promtail
-    namespace: promtail
-    version: 6.16.6
-    inherit:
-      - template: default-env-values
-      - template: default-env-secrets

installations/applications/helmfile-xray-2.yaml

@@ -1,16 +0,0 @@
-bases:
-  - ../../common/environments.yaml
-  - ../../common/templates.yaml
-repositories:
-  - name: allangers-charts
-    url: ghcr.io/allanger/allangers-charts
-    oci: true
-releases:
-  - name: server-xray-public
-    chart: allangers-charts/server-xray
-    namespace: public-xray
-    version: 0.4.0
-    inherit:
-      - template: default-env-secrets
-      - template: default-env-values
-      - template: ext-self-signed-cert

installations/development/helmfile.yaml

@@ -1,9 +0,0 @@
-bases:
-  - ../../common/environments.yaml
-  - ../../common/templates.yaml
-repositories:
-  - name: argo
-    url: https://argoproj.github.io/argo-helm
-releases:
-  - name: badhouseplants
-    namespace: platform

installations/games/helmfile.yaml

@@ -13,16 +13,7 @@ releases:
   - name: minecraft
     chart: minecraft/minecraft
     namespace: games
-    version: 4.23.6
-    inherit:
-      - template: ext-tcp-routes
-      - template: default-env-values
-      - template: default-env-secrets
-
-  - name: team-fortress-2
-    chart: allangers-charts/team-fortress-2
-    namespace: team-fortress-2
-    version: 0.1.2
+    version: 4.26.1
     inherit:
       - template: ext-tcp-routes
       - template: default-env-values

installations/monitoring/helmfile.yaml

@@ -12,7 +12,7 @@ releases:
   - name: prometheus
     chart: prometheus-community/kube-prometheus-stack
     namespace: observability
-    version: 66.3.1
+    version: 70.1.1
     inherit:
       - template: default-env-values
       - template: default-env-secrets
@@ -20,7 +20,7 @@ releases:
   - name: grafana
     chart: grafana/grafana
     namespace: observability
-    version: 8.6.4
+    version: 8.10.4
     installed: true
     inherit:
       - template: default-env-values
@@ -28,7 +28,7 @@ releases:
   - name: loki
     chart: grafana/loki
     namespace: observability
-    version: 6.23.0
+    version: 6.28.0
     inherit:
       - template: default-env-values
       - template: ext-secret

installations/pipelines/helmfile.yaml

@@ -12,7 +12,7 @@ releases:
   - name: woodpecker-ci
     chart: woodpecker/woodpecker
     namespace: pipelines
-    version: 2.0.2
+    version: 3.0.6
     inherit:
       - template: ext-database
       - template: default-env-values
@@ -20,14 +20,15 @@ releases:
   - name: renovate-gitea
     chart: renovate/renovate
     namespace: pipelines
-    version: 39.57.4
+    version: 39.208.1
     inherit:
       - template: default-env-values
       - template: default-env-secrets
   - name: renovate-github
     chart: renovate/renovate
+    installed: true
     namespace: pipelines
-    version: 39.57.4
+    version: 39.208.1
     inherit:
       - template: default-env-values
       - template: default-env-secrets

installations/platform/helmfile.yaml

@@ -1,114 +0,0 @@
-bases:
-  - ../../common/environments.yaml
-  - ../../common/templates.yaml
-
-repositories:
-  - name: argo
-    url: https://argoproj.github.io/argo-helm
-  - name: db-operator
-    url: https://db-operator.github.io/charts
-  - name: zot
-    url: https://zotregistry.dev/helm-charts/
-  - name: bedag
-    url: https://bedag.github.io/helm-charts/
-  - name: crossplane-stable
-    url: https://charts.crossplane.io/stable
-  - name: goauthentik
-    url: https://charts.goauthentik.io/
-  - name: minio-standalone
-    url: https://charts.min.io/
-  - name: kyverno
-    url: https://kyverno.github.io/kyverno/
-  - name: external-dns
-    url: https://kubernetes-sigs.github.io/external-dns/
-  - name: keel
-    url: https://keel-hq.github.io/keel/
-
-releases:
-  - name: db-operator
-    namespace: platform
-    chart: db-operator/db-operator
-    version: 1.30.0
-
-  - name: db-instances
-    chart: db-operator/db-instances
-    namespace: platform
-    needs:
-      - platform/db-operator
-    version: 2.4.0
-    inherit:
-      - template: default-env-values
-      - template: default-env-secrets
-
-  - name: zot
-    chart: zot/zot
-    version: 0.1.65
-    createNamespace: false
-    installed: true
-    namespace: platform
-    condition: workload.enabled
-    inherit:
-      - template: default-env-values
-      - template: default-env-secrets
-
-  - name: authentik
-    chart: goauthentik/authentik
-    version: 2024.10.5
-    namespace: platform
-    createNamespace: false
-    condition: workload.enabled
-    needs:
-      - platform/db-operator
-    inherit:
-      - template: default-env-values
-      - template: default-env-secrets
-      - template: ext-database
-
-  - name: minio
-    chart: minio-standalone/minio
-    version: 5.3.0
-    namespace: platform
-    inherit:
-      - template: default-env-values
-      - template: default-env-secrets
-
-  - name: kyverno
-    chart: kyverno/kyverno
-    namespace: kyverno
-    condition: workload.enabled
-    labels:
-      bootstrap: true
-    version: 3.3.3
-
-  - name: kyverno-policies
-    chart: kyverno/kyverno-policies
-    namespace: kyverno
-    condition: workload.enabled
-    labels:
-      bootstrap: true
-    version: 3.3.2
-    needs:
-      - kyverno/kyverno
-
-  - name: custom-kyverno-policies
-    chart: ../../kustomizations/kyverno/
-    namespace: kyverno
-    condition: workload.enabled
-    labels:
-      bootstrap: true
-    needs:
-      - kyverno/kyverno
-
-  - name: external-dns
-    chart: external-dns/external-dns
-    version: 1.15.0
-    namespace: platform
-    inherit:
-      - template: default-env-values
-      - template: default-env-secrets
-
-  - name: keel
-    chart: keel/keel
-    version: 1.0.4
-    namespace: platform
-    condition: workload.enabled

installations/storage/helmfile.yaml

@@ -1,34 +0,0 @@
-bases:
-  - ../../common/environments.yaml
-  - ../../common/templates.yaml
-repositories:
-  - name: longhorn
-    url: https://charts.longhorn.io
-  - name: rook-release
-    url: https://charts.rook.io/release
-releases:
-  - name: rook-ceph
-    chart: rook-release/rook-ceph
-    installed: true
-    namespace: rook-ceph
-    version: v1.14.6
-    inherit:
-      - template: default-env-values
-  - name: rook-ceph-cluster
-    chart: rook-release/rook-ceph-cluster
-    installed: false
-    namespace: rook-ceph
-    version: v1.14.6
-    needs:
-      - rook-ceph/rook-ceph
-    inherit:
-      - template: default-env-values
-  - name: longhorn
-    chart: longhorn/longhorn
-    namespace: longhorn-system
-    installed: true
-    version: 1.7.2
-    inherit:
-      - template: default-env-values
-      - template: default-env-secrets
-      - template: ext-secret

kustomizations/external-service-xray/service.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: xray-external-proxy
+spec:
+  externalName: xray-public.badhouseplants.net
+  sessionAffinity: None
+  type: ExternalName
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRouteTCP
+metadata:
+  name: xray-external-proxy
+spec:
+  entryPoints:
+    - xray-public
+  routes:
+    - match: HostSNI(`*`)
+      services:
+        - name: xray-external-proxy
+          nativeLB: true
+          port: 27015
+

kustomizations/kyverno/add-applied-by.yaml

@@ -0,0 +1,20 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: add-applied-by
+spec:
+  background: false
+  rules:
+    - name: add-applied-by
+      match:
+        any:
+          - resources:
+              kinds:
+                - '*'
+              namespaces:
+                - org-*
+      mutate:
+        patchStrategicMerge:
+          metadata:
+            annotations:
+              applied-by: "{{ request.userInfo.username }}"

kustomizations/kyverno/badhouseplants/pvc-patch.yaml

@@ -0,0 +1,58 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: replace-storage-class-by-openebs
+spec:
+  rules:
+    - name: local-path-fix
+      match:
+        any:
+          - resources:
+              kinds:
+                - PersistentVolumeClaim
+              namespaces:
+                - registry
+      mutate:
+        patchStrategicMerge:
+          metadata:
+            annotations:
+              volume.kubernetes.io/selected-node: bordeaux
+    - name: replace-storage-class
+      match:
+        any:
+          - resources:
+              kinds:
+                - PersistentVolumeClaim
+              namespaces:
+                - games
+                - application
+                - platform
+                - pipelines
+      mutate:
+        patchStrategicMerge:
+          metadata:
+            annotations:
+              volume.beta.kubernetes.io/storage-class: openebs-hostpath
+          spec:
+            storageClassName: openebs-hostpath
+            accessModes:
+              - ReadWriteOnce
+    #- name: remove-unwanted-annotations
+    #  match:
+    #    any:
+    #      - resources:
+    #          kinds:
+    #            - PersistentVolumeClaim
+    #          namespaces:
+    #            - games
+    #  mutate:
+    #    patchesJson6902: |-
+    #      - path: "/metadata/annotations/volume.beta.kubernetes.io~1storage-class"
+    #        op: replace
+    #        value: openebs-hostpath
+    #      - path: "/metadata/annotations/volume.beta.kubernetes.io~1storage-provisioner"
+    #        op: replace
+    #        value: openebs.io/local
+    #      - path: "/metadata/annotations/volume.kubernetes.io~1storage-provisioner"
+    #        op: replace
+    #        value: openebs.io/local

kustomizations/kyverno/etersoft/pvc-patch.yaml

@@ -0,0 +1,21 @@
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: append-node-name-to-pvc
+spec:
+  rules:
+    - name: replace-storage-class
+      match:
+        any:
+          - resources:
+              kinds:
+                - PersistentVolumeClaim
+              namespaces:
+                - applications
+                - platform
+                - registry
+      mutate:
+        patchStrategicMerge:
+          metadata:
+            annotations:
+              volume.kubernetes.io/selected-node: yekaterinburg

kustomizations/kyverno/pvc-patch.yaml

@@ -1,44 +0,0 @@
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: replace-storage-class-by-openebs
-spec:
-  rules:
-    - name: replace-storage-class
-      match:
-        any:
-          - resources:
-              kinds:
-                - PersistentVolumeClaim
-              namespaces:
-                - games
-                - application
-                - platform
-      mutate:
-        patchStrategicMerge:
-          metadata:
-            annotations:
-              volume.beta.kubernetes.io/storage-class: openebs-hostpath
-          spec:
-            storageClassName: openebs-hostpath
-            accessModes:
-              - ReadWriteOnce
-    - name: remove-unwanted-annotations
-      match:
-        any:
-          - resources:
-              kinds:
-                - PersistentVolumeClaim
-              namespaces:
-                - games
-      mutate:
-        patchesJson6902: |-
-          - path: "/metadata/annotations/volume.beta.kubernetes.io~1storage-class"
-            op: replace
-            value: openebs-hostpath
-          - path: "/metadata/annotations/volume.beta.kubernetes.io~1storage-provisioner"
-            op: replace
-            value: openebs.io/local
-          - path: "/metadata/annotations/volume.kubernetes.io~1storage-provisioner"
-            op: replace
-            value: openebs.io/local

manifests/peerauth.yaml

@@ -0,0 +1,8 @@
+apiVersion: security.istio.io/v1
+kind: PeerAuthentication
+metadata:
+  name: default
+  namespace: public-xray
+spec:
+  mtls:
+    mode: STRICT

values/badhouseplants/argocd/argocd/secrets.yaml

@@ -0,0 +1,21 @@
+configs:
+    cm:
+        dex.config: ENC[AES256_GCM,data:U+BKH82hTX8a08ZVJM8WJ2NuwIJR2Diax4VUxziFhHlZWMJKWCl2BNSquKxaFincmoR3Lqn95wyfsoGKwjPxINqYw0F3zbZttlfpyG84Jg2Y4E3+NDE0YtPv1stE47aW8ZWDycjcvrW9UGANEQWHGoEMVC7sIDmSEKc4zZYVOrDPnIDOl8Fdt+7oQb9XcITvkt28DJymMvm2FLJPEB9Iz/M9V72r8QhA9ASYEWnhjYUnv63A92YH7FBr+5rdlaRSW/jJfnTWViHdi9F0fYyPmjgcyAitSXZNbPs3bd8uV7ZZTWIQGMb1IpB9SFHxMBHLNv510kFmdn0RpThIrSiDrbau4OiXcFj3N3JOStlz/AlWBkAj/zNfCcdZfsSvICARcAuw4Jowh0fGSzi3uJrr9CezWTj5t3SN+KoKGs2vO5DoD8dmjtI3vStICVs9jN8QXiPb4WpUALyM9AT41Eg+oo/58SnxNjovJ2xw/DV4GTQxpzaPCC1yagR4vSR+/qlRYU9SUinw53kzm2tZjabAVbfpTlbq7F7Ld/GuW3IQh/fULBTxYGys9s++72GdG/P0elLjvCV0Xt3vIona//uVKQFXQB8rxAMWLnTHFbM9Y6uWlZkN/W63ceJAYzXNBtC/uzfMV8GRZQpbb/QVO9U/F54yefoB7XJ8BSrHYiCvIeV/SwWINNw9Lo/Cy4nsC6UrqYdanz32HrwawSGikfGjQGXDE1n3DcPXbA6rGR2N7bbxZnIeI7TLP+pNxEg8Apr550Vh1qM9oCDx7cYgFkAEb/X/P4PYqRe1yRn+jzomAPidhGCuHibtihCXU8bht4i3uwT91SJDNEmJI9yBSxAMY9pgjmSuVTO22tI=,iv:D+KOoEOhvNSEbx4h8ltF0Kj8XBp5B6ipCXFtREvqXdw=,tag:jVZjICBTlwEUAeaH7Rgkbg==,type:str]
+    credentialTemplates:
+        ssh-creds:
+            sshPrivateKey: ENC[AES256_GCM,data:NFkcWS4nL0KOtNaXU+InVIoVJhCiasJWN2JTJ2AP9WH9caU5pDw2mpT1mF0zZuRw/hvwJTrkSjA2pV6hiCEVwJegEWqWIKgnakEeF6XZPJK+ryWSLA2jg3Ba8BCMZxMTq9olZEt4ap/irKhvkoDxERdvGp/bsWYwNsy/lo92xNqAeGAWlyS4H5bBPx8RtzJx7MrVmGsOGmtPhaX9AxGtot13FZ07Y0lW0PZ75VgQzNS05Y9obO99hrdJ2sfGdmZtvqtENJGQh9sLzAKKbZFj5bE+A7TA54qVItmePEg6JhWdJ+0QMoyGXUaX1b1XsdwV8TOZEFOj9KI1RwsrOhwlD1sqkKJC1l498mOwP+xeFXJkGOtT2DB+Ds6LU4byXKMkvhwNQho2BBkQ/+W59IIL1+4a6RHMJwO1dhK94AsQDjy0TNyKKTSk8erotlwefR5ny+ZnARe2V5mLObmAZWdbni+AzvfHCrOQcmk3dxwLBCc98/hDzAMlbjsE34GWUEI5rcp+uHhFgnLaTNJE/PJOwP1WlFiyoDIpi2lj,iv:3XAh3cSFA2r1PMlXMo/1ubpIIgyGDDMhpni7hlinSBg=,tag:9po/JY+NFnOz3Xaw5L60PQ==,type:str]
+sops:
+    age:
+        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoZzFUTVVQNit4eTNiYWcw
+            Z2JsNEVGcm9Qa2NkWnQ3Ym1RSmV5ang4dGt3CkJhdSsyeHJlZWdtbkx3alhqemxD
+            NWdHdGV2K1ZOeGpqSS84SHVWMUN3OGMKLS0tIFhNWXBHcFg5VDNVUWVaY3RhY0dz
+            aXNSKzVjZEZRZlBaelk1TTNYcTkxcWMKC1gn1y9T0PsFOE4hKYS7m4OgHGkFcK/p
+            SSFtTltvEs6jEeXitHhGcn1IWy4hxEvUBnVMGwTkweIKefwxkHi9/A==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-04-14T12:08:28Z"
+    mac: ENC[AES256_GCM,data:YzmFndPEnQAs9LDD41xQPGTUvU2zUup7J3dTUPLVmBZVHbV2Ml2xAmxMLXJ0G1VOM6h+TEQasU/ZUadLc41GM4m8aZfvxnQtMxPJEP9L1g4zhE3zzXAGXixcQ9xDY3aDhVwdoipyMo23kQqaHageVIfoBxE5ClI+ci0FepeBO/I=,iv:8hAfCtpoecVU8WgAStfqFArAMqBAiPJQGgKMJhJnDBE=,tag:lbJOH1IAf6Enl8g/Pe2I+Q==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.10.1

values/badhouseplants/argocd/argocd/values.yaml

@@ -42,7 +42,7 @@ redis:
       enabled: false
 
 global:
-  domain: argo.badhouseplants.net
+  domain: argocd.badhouseplants.net
 
 server:
   ingress:
@@ -71,7 +71,7 @@ server:
       kubernetes.io/ingress.global-static-ip-name: ""
       cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
     ingressClassName: traefik
-    hostname: "argogrpc.badhouseplants.net"
+    hostname: "argocdgrpc.badhouseplants.net"
     path: /
     pathType: Prefix
     tls: true
@@ -95,31 +95,42 @@ configs:
       g, allanger@zohomail.com, role:admin
       g, allanger@badhouseplants.net, role:admin
       g, rodion.n.rodionov@gmail.com, role:admin
+      g, jacklull@badhouseplants.net, role:admin
       p, drone, applications, *, badhouseplants/*,allow
   cm:
     exec.enabled: "true"
-    url: https://argo.badhouseplants.net
+    url: https://argocd.badhouseplants.net
     kustomize.buildOptions: "--enable-alpha-plugins"
     accounts.drone: apiKey, login
     accounts.drone.enabled: "true"
   credentialTemplates:
     ssh-creds:
-      url: git@github.com
-
-applicationSet:
-  metrics:
-    enabled: false
-    serviceMonitor:
-      enabled: false
-
+      url: git@gitea.badhouseplants.net
+  ssh:
+    # -- Specifies if the argocd-ssh-known-hosts-cm configmap should be created by Helm.
+    create: true
+    knownHosts: |
+      gitea.badhouseplants.net ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDDpR4dE3oAGModn9GWtwVYrsnFod6pBXU8Z/uRj8l/hHjQaipISwNu8pqteGvssZatXBPkRj3zcf6yqgzufz9dXvt42XBN+H8c9UfeVrysivfTZ2DY3/J+vj0UBZy6kmf/sj83MTDaO2fIpnXOD2o3YYUeRVLL5YzTX1l22ih+LvvynY3gtmncf1SZOee1FTNJ2PdYi38F8Vp1MLAgcOTTsBd0WjCgx5xinzlPXwSxp6l4tp+aB6tsL4j5/6yudJfMkaOGTBCqybXyt6xYnYLTBbgmNlMd/0N9iOw4RYZfIaPDry6lTgNlJUWO5E7psckyjnCs1dvDRrJgL98q7X7+v8WNOqJMOFczLDAVtYq9akSFkJfAoNZ6FY4p//Xbgy3kukRlcSbot5ecBxPw0Cr9HAmO46uiaUHhPnVySyPKTiaDpOc5pjp6vak277jhSOqx0fX38aSVXyGJ5DYDgcg6f2nWjjhiLC3N3HDLtVjDJ6aw/yilldCRLugxXYT+nDtJjz84S8c13HvsREeW0vTncsBiY7y0WWCQyWj2W3Hp9SSNHuwl5xr+gQWSlhzBuDTceDlf4/TjaUIngWV+hVdkJEBFAcb9Oxib6AqF6Qrrw5lJUaboEA5RQs9Lh0lFfuirANzpVy1t279wZ0AEf6oFdeXLeHiV56QzKJLnbkzg8Q==
   repositories:
-    argo-deployment:
-      url: git@github.com:allanger/argo-deployment.git
-      name: argo-deployment
-      insecure: "true"
-      type: git
-    cluster-config:
-      url: git@github.com:allanger/cluster-config.git
-      name: cluster-config
-      insecure: "true"
+    go-test:
+      url: git@gitea.badhouseplants.net:sharing/go-test-project.git
+      name: go-test
       type: git
+      project: default
+#applicationSet:
+#  metrics:
+#    enabled: false
+#    serviceMonitor:
+#      enabled: false
+#
+#  repositories:
+#    argo-deployment:
+#      url: git@github.com:allanger/argo-deployment.git
+#      name: argo-deployment
+#      insecure: "true"
+#      type: git
+#    cluster-config:
+#      url: git@github.com:allanger/cluster-config.git
+#      name: cluster-config
+#      insecure: "true"
+#      type: git

values/badhouseplants/databases/postgres16/values.yaml

@@ -9,7 +9,7 @@ metrics:
 primary:
   persistence:
     size: 2Gi
-  resources: 
+  resources:
     limits:
       ephemeral-storage: 1Gi
       memory: 512Mi

values/badhouseplants/databases/redis/secrets.yaml

@@ -0,0 +1,26 @@
+global:
+    redis:
+        #ENC[AES256_GCM,data:INOZ17f72Qf6D+drbcvmnZRBRIeXLSAV9RmfOLZFp45qt8GWSHMnevqq9ge4Zlydtsd3BDek/JLUNl6YHPPq9qM1EFujY2htbOHyf0Cn,iv:zZDMizNKFllCyNH/bUF+vuB9YOikjo3q5ebzu3LYvCc=,tag:H0XX/D9xh0HS0Xnqgs/aag==,type:comment]
+        #ENC[AES256_GCM,data:JiLOpJanuZnMpN5dMvw2,iv:YEVZSdRHez1lCb61hWLvalLq8F67l7KF0WXmmuj9bck=,tag:KnpfgwUYBQLZsj4Jk13RtQ==,type:comment]
+        #ENC[AES256_GCM,data:mzDGjHlXUunu1yA=,iv:LOOU/QGaHKeDrssbk1haYd0lPclbFak9GygEbbN0gFs=,tag:4cUubeiY6aJj5KVKVkdFUA==,type:comment]
+        password: ENC[AES256_GCM,data:kN93kIMiVTGWbaYgMC1n1MWqdl8s3cbZS5vvYTa2,iv:Qy+GQchC6s2PoarPWtquipF9gAVYZR6mn0GeHABRogE=,tag:V/xbfm9u51UUG+we/3nNLQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrOHRuN1J1ODYvc0Z3OW5H
+            NFhVM0dWWGZETU0vTzVkeUk1NFVWc2FSaGprCm5NalJKUWxtLzA5VTU3YjR5VWtx
+            NExtbTZZZUZteVBTYnNWTVZvbnF5VFUKLS0tIEpBTDhPbkVLVytaY29aUktmZGF2
+            bnVKWmI4RWpLaGU5WTIwblJRcDFDMlUK2BHkUNbpRMo0jm2Sk+Qcf4giufJtaJyM
+            xuoG41AqGs4+KEDS8/rF9HK7z+2Wk9H5b8L+/W0n+J5EPOvwvFePTA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-03-26T12:23:02Z"
+    mac: ENC[AES256_GCM,data:xrA6hCFIH/R/j/V1T60xx5Eix5Z5ETREQP4zYriLkZQ4hEzL2WdJFExK1VXSfX4KmIR8215XHmHnWu70eIoAnFUaozBosIFtJz0YNrNNok6MeDGD5fy5mcBQfCqLw+rwbW/uxY7DQrchgVT9iFAkpRSoVPUzn6ku/xCmTmSlv3E=,iv:lNLR5QHKPUWb1Mz8mIFCHnjpuQVF7ttNTOy9+jEzLyo=,tag:G4iZ/9nWKh97JLGOxbgSQg==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4

values/badhouseplants/games/minecraft/values.yaml

@@ -1,33 +1,15 @@
-service-account:
-  enabled: true
-  resources:
-    - name: minecraft-exporter
-      label:
-        app: minecraft-minecraft-metrics
-      endpoints:
-        port: metrics
-traefik:
-  enabled: true
-  tcpRoutes:
-    - name: minecraft-tcp
-      entrypoint: minecraft
-      gateway: istio-system/badhouseplants-minecraft
-      match: HostSNI(`*`)
-      service: minecraft-minecraft
-      port: 25565
 # --------------------------------------------------
 # -- Main values
 # --------------------------------------------------
 image:
-  #tag: java21-graalvm
-  tag: java21-jdk
+  tag: java23-graalvm
   pullPolicy: Always
 resources:
   requests:
-    memory: 3.5Gi
+    memory: 2.7Gi
     cpu: 2.5
   limits:
-    memory: 3.5Gi
+    memory: 2.7Gi
 lifecycle:
   postStart:
     - bash
@@ -52,32 +34,23 @@ readinessProbe:
   successThreshold: 1
   timeoutSeconds: 20
 minecraftServer:
-  memory: 3000M
+  memory: 2000M
   jvmOpts: |
     -server
   jvmXXOpts: |
-    -Xms3000G -Xmx3500G -XX:+UseG1GC -XX:+UnlockExperimentalVMOptions -XX:G1NewSizePercent=20 -XX:G1ReservePercent=20 -XX:MaxGCPauseMillis=50 -XX:G1HeapRegionSize=32M
+    -Xms2000G -Xmx2500G -XX:+UseG1GC -XX:+UnlockExperimentalVMOptions -XX:G1NewSizePercent=20 -XX:G1ReservePercent=20 -XX:MaxGCPauseMillis=50 -XX:G1HeapRegionSize=32M
   overrideServerProperties: true
   eula: "TRUE"
   onlineMode: false
   difficulty: hard
   hardcore: true
-  version: "1.21.1"
+  version: "1.21.5"
   maxWorldSize: 90000
   type: "FABRIC"
   gameMode: survival
   pvp: true
   modUrls: []
   serviceType: NodePort
-  #- https://github.com/CaffeineMC/lithium-fabric/releases/download/mc1.20.1-0.11.2/lithium-fabric-mc1.20.1-0.11.2-api.jar
-  #- https://github.com/CaffeineMC/sodium-fabric/releases/download/mc1.20.1-0.5.11/sodium-fabric-0.5.11+mc1.20.1.jar
-  #- https://github.com/CaffeineMC/lithium-fabric/releases/download/mc1.20.1-0.11.2/lithium-fabric-mc1.20.1-0.11.2.jar
-  #pluginUrls:
-  #  - https://github.com/dmulloy2/ProtocolLib/releases/download/5.2.0/ProtocolLib.jar
-  #  - https://mediafilez.forgecdn.net/files/3789/833/GravityControl-2.0.0.jar
-  #  - https://mediafilez.forgecdn.net/files/3151/915/CrackShot.jar
-  #  - https://s3.badhouseplants.net/public-download/MechanicsCore-3.4.8.jar
-  #  - https://s3.badhouseplants.net/public-download/WeaponMechanics-3.4.9.jar
   rcon:
     enabled: true
     withGeneratedPassword: false
@@ -85,7 +58,7 @@ minecraftServer:
     serviceType: ClusterIP
   extraPorts:
     - name: metrics
-      containerPort: 9225
+      containerPort: 19565
       protocol: TCP
       service:
         enabled: true
@@ -93,12 +66,11 @@ minecraftServer:
         labels:
           exporter: minecraft
         type: ClusterIP
-        port: 9925
+        port: 19565
       ingress:
         enabled: false
 persistence:
   storageClass: openebs-hostpath
-  #storageClass: local-path
   dataDir:
     enabled: true
     Size: 9Gi
@@ -121,35 +93,6 @@ mcbackup:
   persistence:
     backupDir:
       enabled: false
-# ---------------------------------------------
-# -- Install Plugins
-# ---------------------------------------------
-initContainers:
-  - name: 0-download-mods
-    image: alpine/curl
-    command:
-      - curl
-      - -L
-      - "https://s3.badhouseplants.net/minecraft-mods/server_mods.tar"
-      - -o
-      - /download/server_mods.tar
-    volumeMounts:
-      - name: download
-        mountPath: /download
-        readOnly: false
-  - name: 1-copy-plugins-to-minecraft
-    image: ubuntu
-    command:
-      - sh
-      - -c
-      - cd /mods  && tar -xvf /download/server_mods.tar || true
-    volumeMounts:
-      - name: plugins
-        mountPath: /mods
-        readOnly: false
-      - name: download
-        mountPath: /download
-        readOnly: false
 extraVolumes:
   - volumeMounts:
       - name: plugins
@@ -162,3 +105,36 @@ extraVolumes:
       - name: download
         emptyDir:
           sizeLimit: 500Mi
+extraDeploy:
+  - |-
+      apiVersion: monitoring.coreos.com/v1
+      kind: ServiceMonitor
+      metadata:
+        name: minecraft
+      spec:
+        endpoints:
+        - interval: 30s
+          port: metrics
+          scrapeTimeout: 10s
+          path: '/'
+        namespaceSelector:
+          matchNames:
+          - games
+        selector:
+          matchLabels:
+            app.kubernetes.io/instance: minecraft
+  - |-
+      apiVersion: traefik.io/v1alpha1
+      kind: IngressRouteTCP
+      metadata:
+        name: minecraft-tcp
+      spec:
+        entryPoints:
+        - minecraft
+        routes:
+        - match: HostSNI(`*`)
+          services:
+          - name: minecraft
+            nativeLB: true
+            port: 25565
+

values/badhouseplants/kube-system/namespaces/secrets.yaml

@@ -0,0 +1,21 @@
+defaultRegcred: ENC[AES256_GCM,data:lsqr2fBEosOQqYLBwps1hmgFs90zkzbdHpO8UwJWcMl1/CGkyzroACqHkL8taaOnnvwWwadIL8FU3382jamw0Xk5O51bFSBbCxTs3xd4ibwe39ha5YI6YQDHADDb/u1Yw4TctJ/h9xykXHDOL4foE5Z860e16vtMiVvniLD9OGfR6utb9gvZHE2QqZTlHR9U4PY2vLWWQMN3VRvipT7hulmOUzXMVcuBswmyDF39PvTba6Ea7A83V9h6HpqNeSA1ewKREIDOFqjhl7tIit8aQnuee58bJCTVIdg6gyR6yfu6sF22wdUlsJ7CAHtd41sbhEhWGyzJIqg=,iv:J1CfAJmNpI7lgQalYJlXs+JX5I0e6COGrsenMhvDGLA=,tag:nHkq8VF47I/9FS8uGcEyuw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwWHpPUkZqbC9LaEtJYzhF
+            L0hIZUtOa3E4KzJDOFlwaFRVWDdJRnBtR1ZjCnVLNzhyQkdxS2dtK2lFaWRJUkJq
+            dThURHRTRG5GT1BqaTZRbzlUbXYzWHMKLS0tIFRSa1lkSGQrN1RGdklzYzZNU3BH
+            ZE0wMk1sRGg1M1lrNVFMTityK3cwK00Kbhugumz27RVo1SJjaljEbklHY6CW7xGD
+            UCbN0LGh5PPpN6eCbZW8dB1+/lLR9AnyYr6okrGM2iztaJQdlwRvww==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-03-27T10:24:56Z"
+    mac: ENC[AES256_GCM,data:xGqmh1TPg0OJLSycbnjsF4Ai844ZzlCzawQXmROpORJEiSL/3R1W+2PsBT5KcAfG7y2+Ovyk+l1FeorIPuqnbcezX9zUxMOaFXJylmwvNYXCwoihU6Yx2hg9SuFhnwINAhCLqOaRKIh8xPUaK8nRVqwJJa0jW6eCyZ5lsLtpz90=,iv:pmPfpSv3VfVz/MvTGTWoMxzkF3BvCMhK+HxEeN5pzNI=,tag:WkLcTz/WlLXmq8EojHfdlA==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4

values/badhouseplants/kube-system/namespaces/values.yaml

@@ -0,0 +1,39 @@
+namespaces:
+  - name: registry
+  - name: flux-system
+    defaultRegcred: true
+  - name: argocd
+    defaultRegcred: true
+  - name: kube-system
+    defaultRegcred: true
+  - name: production
+    defaultRegcred: true
+  - name: kyverno
+    defaultRegcred: true
+  - name: velero
+    defaultRegcred: true
+  - name: observability
+    defaultRegcred: true
+  - name: databases
+    defaultRegcred: true
+  - name: istio-system
+    defaultRegcred: true
+  - name: applications
+    defaultRegcred: true
+    labels:
+      istio-injection: enabled
+  - name: platform
+    defaultRegcred: true
+  - name: games
+    defaultRegcred: true
+  - name: pipelines
+    defaultRegcred: true
+  - name: public-xray
+    defaultRegcred: true
+    labels:
+      istio-injection: disabled
+  - name: org-badhouseplants
+    defaultRegcred: true
+  - name: org-allanger
+    labels:
+      istio-injection: enabled

values/badhouseplants/kube-system/openebs/values.yaml

@@ -1,6 +1,7 @@
 localpv-provisioner:
   hostpathClass:
     isDefaultClass: true
+
 zfs-localpv:
   crds:
     zfsLocalPv:

values/badhouseplants/kube-system/roles/values.yaml

@@ -0,0 +1,24 @@
+roles:
+  - name: xray-admin
+    namespace: public-xray
+    kind: Role
+    rules:
+      - apiGroups: ["*"]
+        resources: ["*"]
+        verbs: ["*"]
+        namespace: ["public-xray"]
+bindings:
+  - name: woodpecker-ci
+    namespace: pipelines
+    kind: ClusterRoleBinding
+    subjects:
+      - kind: ServiceAccount
+        namespace: pipelines
+        name: woodpecker-ci
+    roleRef:
+      kind: ClusterRole
+      name: cluster-admin
+      apiGroup: rbac.authorization.k8s.io
+sa:
+  - name: woodpecker-ci
+    namespace: pipelines

values/badhouseplants/kube-system/traefik/values.yaml

@@ -10,13 +10,12 @@ ports:
         readTimeout: 0
         idleTimeout: 0
         writeTimeout: 0
-    forwardedHeaders:
-      trustedIPs:
-        - "192.168.0.0/16"
-    proxyProtocol:
-      trustedIPs:
-        - "192.168.0.0/16"
-      insecure: true
+        forwardedHeaders:
+          trustedIPs:
+            - "192.168.0.0/16"
+        proxyProtocol:
+          trustedIPs:
+            - "192.168.0.0/16"
   ssh:
     port: 22
     expose:
@@ -47,9 +46,9 @@ ports:
     exposedPort: 25
     expose:
       default: true
-    proxyProtocol:
-      trustedIPs:
-        - "192.168.0.0/16"
+      proxyProtocol:
+        trustedIPs:
+          - "192.168.0.0/16"
   smtps:
     port: 465
     protocol: TCP
@@ -101,27 +100,38 @@ ports:
     proxyProtocol:
       trustedIPs:
         - "192.168.0.0/16"
+
   minecraft:
     port: 25565
     protocol: TCP
     exposedPort: 25565
     expose:
       default: true
-  shadowsocks:
-    port: 8388
-    protocol: TCP
-    exposedPort: 8388
-    expose:
-      default: true
-  tf2:
+
+  game-udp:
     port: 37015
     protocol: UDP
     exposedPort: 37015
     expose:
       default: true
-  tf2-rcon:
-    port: 37015
-    protocol: TCP
-    exposedPort: 37015
-    expose:
-      default: true
+
+      #  tf2-rcon:
+      #    port: 37015
+      #    protocol: TCP
+      #    exposedPort: 37015
+      #    expose:
+      #      default: true
+
+      #  ssocks-etcp:
+      #    port: 8444
+      #    protocol: TCP
+      #    exposedPort: 8443
+      #    expose:
+      #      default: true
+      #
+      #  ssocks-eudp:
+      #    port: 8445
+      #    protocol: UDP
+      #    exposedPort: 8443
+      #    expose:
+      #      default: true

values/badhouseplants/org-allanger/app-tandoor-recipes/secrets.yaml

@@ -0,0 +1,25 @@
+env:
+    secrets:
+        data:
+            SECRET_KEY: ENC[AES256_GCM,data:bLecWaJafPbXT2/dvKt3R2KNfuxxgQ6yLxviYbOf,iv:liuexfgYScH+eg/qSO23SQxE7hKpudgkOH3JRDkaa+A=,tag:DEcAbY6rg7mQnhsnukWtFA==,type:str]
+            SOCIALACCOUNT_PROVIDERS: ENC[AES256_GCM,data:kx9ziZhxWcWTu1UG7BPi/sdG1tHhzugq65xxL3IPVx8i1oHXwy+00KaOEsIYP+TJqX5516Zq6JqtXe9dQwI4uVIy538FdXeEQDHKNS0xesSx8jG0tKa71GiqyQGBrBBxiy144za9y1QHB9k1pvuaza8mVEQOoktmMFfiHzEOhYDQxIzTulOMWxN2ImTsYSupHS6HLR13gDCyROVDzj1Io/U1VHxN5RZBPiqthNiB+/Aj+2FuCwAaxgEE6VVNFJlghi2yiZbl/PvZ3MDT+dAx/NijawVt0qdBBmPvB3jKZkgRN2tyystGiu47hnLosuzjrOjAMA6rP7XkT2gQ5e6hoLlJxWD5IiAHI+gQK7REbyJrEmSwwH0aCVsd1H4FOBNk+rfKpTIr7sRZFTVcZLtUdTZW6EW0XWmrBBPr5jodmouoFZY+dGlWP1vQkG+2eymw5aJCan0oq+x+J9dB+CVZc/2M1zBeRa6Crg7w3smCqOr46jkaRxfoDxV2NdRSla5zkwwFSS7MqPYlqre2oW+pgP7lvRa4MW9++5q+Zg==,iv:RZMNm66PhTWvjJG5jtpJW22TFInHw8LT04qui3fMLgA=,tag:ETMqmFO/8Kve/W55WP21dA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKcTM5RTNIakwwZHNrQXE2
+            U2FsK1gwMDhUTDd1MVorbENtQXdnZjYrM1c4CmNQaG5TcU9wK25qQUg5a29UUXBK
+            WlZHK0M0dHEvZWVyZmJzR0RLU1pGWmMKLS0tIGk4TFArQnJyTWJJa3FJRlJhY0do
+            ZE81bENWM3ZUdlR0N2RKMnJkUnJxSG8Ky2ngwj6ZnToGhnAJChU8NXUG+XPPZc2F
+            fOD35BFO5bUNe+V8MkDLae+GQ1hr55r4WnvFpSWywRIjCFYmUJHTgQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-02-22T12:32:43Z"
+    mac: ENC[AES256_GCM,data:khcLV/lPaY6J5QQmX8466jx9bsXn+NwA3TLIUYs9ipKa539OjIWstwyydVxILSBCwEWGEW86c8EzLBwptBBgg6gehfRJAax5TAn0lBd1lAAiAxZhdNpc2tfoaMaUWfWdpwYjdrtnvAlAkN3/16nvx+TIq7WdU/cWsic96PqhU0A=,iv:I81QvtZ7S+mSAzoXhU0YBMN0L4K+SRHW3UtcSLxwK5s=,tag:gAeAIjyJ13A8gfE7ppBeRg==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4

values/badhouseplants/org-allanger/app-tandoor-recipes/values.yaml

@@ -0,0 +1,57 @@
+shortcuts:
+  hostname: tandoor.badhouseplants.net
+ext-database:
+  enabled: true
+  name: tandoor-postgres17
+  instance: postgres17
+  credentials:
+    POSTGRES_HOST: "{{ .Hostname }}"
+    POSTGRES_PORT: "{{ .Port }}"
+workload:
+  kind: Deployment
+  strategy:
+    type: RollingUpdate
+  containers:
+    tandoor:
+      securityContext:
+        runAsUser: 1001
+        runAsGroup: 1001
+        fsGroup: 1001
+      envFrom:
+        - main
+        - secrets
+        - secretRef:
+            name: tandoor-postgres17-creds
+          extraVolumes:
+            common:
+              path: /opt/recipes
+      livenessProbe:
+        httpGet:
+          path: /
+          port: 8080
+        initialDelaySeconds: 10
+        failureThreshold: 30
+        periodSeconds: 10
+ingress:
+  main:
+    class: traefik
+    annotations:
+      kubernetes.io/ingress.class: traefik
+      traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+      kubernetes.io/tls-acme: "true"
+      kubernetes.io/ingress.allow-http: "false"
+      kubernetes.io/ingress.global-static-ip-name: ""
+      cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
+extraVolumes:
+  common:
+    emptyDir: {}
+env:
+  main:
+    enabled: true
+    sensitive: false
+    data:
+      DB_ENGINE: django.db.backends.postgresql
+      SOCIAL_PROVIDERS: allauth.socialaccount.providers.openid_connect
+      REMOTE_USER_AUTH: 1
+      SOCIAL_DEFAULT_ACCESS: 1
+      SOCIAL_DEFAULT_GROUP: guest

values/badhouseplants/org-badhouseplants/app-gitea/secrets.yaml

@@ -0,0 +1,50 @@
+gitea:
+    admin:
+        username: ENC[AES256_GCM,data:U230S8544mg=,iv:yL45Opnqp5T4h7erEv0pRHWtH1th8uu1Y4wfeY2aJcQ=,tag:a4vsJEOxlmHj1mwqcUGbiw==,type:str]
+        password: ENC[AES256_GCM,data:IpwOetFEvxt0/tGkiJ8bBI+OR/E=,iv:8OA48CiWeMyqZVs2lp+UzfyymUNQfdgmAQV33+AVQ+s=,tag:stgAMSnB5dCzFu4zvZeVRA==,type:str]
+    config:
+        storage:
+            MINIO_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:cn3NsFx0TH0fw6mJt6cArMRyQ6Qng3gIPQ==,iv:Jv+rweQzEXfVWuWycjGSi54jRAm0XEEcNxZ6flbUZWM=,tag:6O9KvcnaVEME5lXl6msZLw==,type:str]
+        mailer:
+            PASSWD: ENC[AES256_GCM,data:3UL0uvz49J3GIOo/eVWKYLrDG+u/lvCr8Q==,iv:HBQKF42R3tHFQxkUoRzsiPCUkFM40qpjM0SYrQSxugE=,tag:iua/nXoogjxnkj9T6UB/Sw==,type:str]
+        database:
+            PASSWD: ENC[AES256_GCM,data:DbL7wryYRQAEzujWNL4I0AwEq6Cr2r78FXQOAw==,iv:Oc2IYwD7iy7AlYVnhvSc61ttOf20qJyuuDnx4yF3/YE=,tag:aLa8+r0kYvzFSuF3hvhL2w==,type:str]
+        session:
+            PROVIDER_CONFIG: ENC[AES256_GCM,data:owsHUHdmzGiFgtD3+nRBmHYKcsNQXblbuCO8V0tLAAMvJBRHSA5YG1TL3Quy2186yoZCPiAdeQwg/o2Iutk2Mlc6/NmeurZbxomV8dWBuqJfn6t44xnDgFnEXpxE5kB5lNCtcjKXmpxC4fkoUVscOyZFmKp9uTgH,iv:evmTZH5NzMB3nhqLhuBmTTF4ztJX9a/ZMTOmYMqSaxs=,tag:dLnk9xt+moGoBhx7tqazig==,type:str]
+        cache:
+            HOST: ENC[AES256_GCM,data:feiTcBqztm76LZgNShj0Go0IRNgG9UwCQP9KrdexosP2XCnSe+giyKoIcADiHQFYVbnnkpw7/UqNxgM0Tx+EQ9eyFKY+PaFyCSFmQwikmAWakDJ+hQNM1VaNaDKdeLiGIeI7nO2MH9hGDMzPWtUgMNBxc9tTS38l,iv:Rcr+uiZMWbG9IPeMm+eiNf3W3yz2L7yqSkJSKUhWHtk=,tag:3cLuUAEU6CZvvUYKF1cCAQ==,type:str]
+        queue:
+            CONN_STR: ENC[AES256_GCM,data:Mw7W72M3HitiAEG1ihWctXyYqHJuSiKBZvQDDRjA4O9Yg9Zsbq+/HVcnh074zbiTjCO/496FLiy88HuAw8lksZ7MXXVvRI7rIcFKFZLpHcjAqkBnB301SGalK/R4bSisECsYIFPjKuh+s4PIuPEIgFtZuiEvYdbT,iv:uYwjzUObav2Hs/JgRIYbGBFNcZm++qS2QqKpz6Ma6EA=,tag:0okDz0yzL4eSat/0roYJ2A==,type:str]
+    oauth:
+        - name: ENC[AES256_GCM,data:sN+DzBKd,iv:0HNSbQEDLsV76DIRHdWnPs9SI/bHRZz6Fw+8B8Hhuns=,tag:mwTWy9VSXapPu3uLk7LgSQ==,type:str]
+          provider: ENC[AES256_GCM,data:m74moJ8h,iv:QfE5F3vpIlEzIftHlX/qpNvsnAab8gTd4CHyECHNcmQ=,tag:JefFm9mfYJSKzBDOb/l6BA==,type:str]
+          key: ENC[AES256_GCM,data:7ScP3oXE0zTnaqL3AigHby39fMk=,iv:sXllPawkQ5BcKmC1iBUJ2WOEPK2lm6W3q+GrprHZhAc=,tag:vSCB9w5x6jjPNu5b5ZEMzw==,type:str]
+          secret: ENC[AES256_GCM,data:XG9D5IUX4MqJzKf+aB7MCeDJAQlIzMxSv3ByAZQAdZCI+5my+cMfeg==,iv:s3e0wFznoX55MeEQj+dK0QrzzatGzDBKfT4xDD00cOA=,tag:vk32YQcPs0kAIOj61YwHww==,type:str]
+        - name: ENC[AES256_GCM,data:eBSL9xrBDN50,iv:TiC3jjpfwS6A9x6PAkMIorwJ9CecxblzEFt5+ZmSW6I=,tag:XA6UrnJbkUyDBgOY9xfIPw==,type:str]
+          provider: ENC[AES256_GCM,data:yh4TBYDI2R0a4f1qSg==,iv:hx8pAuo//U+YY5a2cq/KyoK4qcKbSXWtkrDvACWLU2c=,tag:uJ9JNWdDjb0eTS0ZJXHDaw==,type:str]
+          skip_local_2fa: ENC[AES256_GCM,data:8YwpOw==,iv:2R3Zc4HK/U31SVcXR3xi9J/kJySR3osA8xN3YhvRxBk=,tag:SzBFOwEmczW59SHLGCMb5Q==,type:str]
+          key: ENC[AES256_GCM,data:rLR8ve4=,iv:qOVIBiFjsOrrRg/mca5l7SHc2GdVAdyz0TV3Q7lJlQg=,tag:tYEzx7SoeoAC9/lgWU91uA==,type:str]
+          secret: ENC[AES256_GCM,data:r7sWVeqWTnqbt7ArzpADD5A1fYU6+KSpLohWJuSbEUyPAzOSxfZGxSYNfAwaxACOgmJJnxUeQ9l71nyUDWzGMrFkLr+o+WcQmSTPV3+3iMHDsTdgjEb+tIZFdi0Z5PJ8DCBxjckmbG5cx3O3Kyrjc24SNHCVb62lhduZH1fIlT0=,iv:kvtMCpiOUx10zTKt/ZYQh3leYaY9+v169Sq+sYIScHQ=,tag:t8txjt3xuVKWA7QgBJYuiw==,type:str]
+          autoDiscoverUrl: ENC[AES256_GCM,data:SG2ev/BshOBP0NQnpZRQErZDAEWdReiwp2pb2JJBWZmFvC67//t8WZu1/wilfQjJvJdsDGwk9Rwncoxya5Fb9uKYDAQKzqULJk70Er9pyNaowFbMxiMm+ws=,iv:B9GM9MLIrKTtRfyDxltlFvvm01aRCTQnyiemH4qzjGs=,tag:Wqji+fKliEGJRZ4inTmbXw==,type:str]
+          iconUrl: ENC[AES256_GCM,data:lcW3npgyrc50GIYCyTh5Gpht2CU6hX67j13XNOvGQybU2dsA9BtqpmH0OMQz4b1g/XkuHAp5j3I0wLnGvhXXf4mEugzt8g==,iv:X/kHS77OJLDuNN2lTAWLqPARJ1QZMY1ImuS+xmkUlgM=,tag:0ZRh7eH6dYdZd250Lb/+xA==,type:str]
+          scopes: ENC[AES256_GCM,data:GtTGDrDZwU1r5vEsxg==,iv:/7yMuJpxlML3R1X8onDSFbJVwpYFtnLamaI+X148Tlk=,tag:e8HkvzdpkhDvedVzm7jG3w==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6d2JneUUzM1VkM1lvclA3
+            aC9wMGpKSGU5ZnVaUTNlVDNsMlNaOVRNYVdzCkpzVUJzNHN2TmhHektzOC93Vjlj
+            SVU3cUxVUm4wWjJQRWZRdWlRMEU1eUEKLS0tIHRLOEJERXBMd0NFajNjbHhPVVNl
+            b1cyT0RYa3hzbFJjc254bHJMcDIzeTgK/aX6f60NBz6w1TaOFSZDRE7rPniebb75
+            iwO74fJtl5g9WxAG5yByxJ455Uhc2R/+VBbK5BcYFt9cboIgkUrS2A==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-03-25T19:15:08Z"
+    mac: ENC[AES256_GCM,data:ySAOo8j+p9O0v8xYFcjuD6e/pc9LtLxLWC4TdP7mjhdfwwaaoJW96DLEbSYxYN7Co8zHFqdMp5e76SgvhWwP2LNmHLunJ3LNU6u6NSMEFLCSyjAM8KiqB4bTNq7Kf9H2FZbAN58YKXpZEFECJpxoLg2Q9MdRp+BvgURDa2QLZRc=,iv:Ay5vMdrKbNpFyir/N4+mPuOwKwIVupZbeJFKA+DWFDA=,tag:+YUSXQYMfu59oF+hjg0XMg==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4

values/badhouseplants/org-badhouseplants/app-gitea/values.yaml

@@ -0,0 +1,179 @@
+# ------------------------------------------
+# -- Kubernetes related values
+# ------------------------------------------
+ingress:
+  enabled: true
+  annotations:
+    kubernetes.io/ingress.class: traefik
+    kubernetes.io/tls-acme: "true"
+    kubernetes.io/ingress.allow-http: "false"
+    kubernetes.io/ingress.global-static-ip-name: ""
+    cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+    external-dns.alpha.kubernetes.io/ingress-hostname-source: defined-hosts-only
+  hosts:
+    - host: gitea.badhouseplants.net
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - secretName: gitea.badhouseplants.net
+      hosts:
+        - gitea.badhouseplants.net
+replicaCount: 1
+clusterDomain: cluster.local
+resources:
+  limits:
+    memory: 1.5Gi
+  requests:
+    cpu: 1.5
+    memory: 1.5Gi
+persistence:
+  enabled: true
+  size: 15Gi
+  accessModes:
+    - ReadWriteOnce
+# ------------------------------------------
+# -- Main Gitea settings
+# ------------------------------------------
+gitea:
+  metrics:
+    enabled: false
+    serviceMonitor:
+      enabled: false
+  config:
+    database:
+      DB_TYPE: postgres
+      HOST: postgres17-postgresql.databases.svc.cluster.local
+      NAME: org-badhouseplants-app-gitea
+      USER: org-badhouseplants-app-gitea
+    APP_NAME: Bad Houseplants Gitea
+    ui:
+      meta:
+        AUTHOR: Bad Houseplants
+        DESCRIPTION: '...by allanger'
+    repository:
+      DEFAULT_BRANCH: main
+      MAX_CREATION_LIMIT: 0
+      DISABLED_REPO_UNITS: repo.wiki
+    service:
+      DISABLE_REGISTRATION: true
+    server:
+      DOMAIN: gitea.badhouseplants.net
+      ROOT_URL: https://gitea.badhouseplants.net
+      LFS_START_SERVER: true
+      LANDING_PAGE: explore
+      START_SSH_SERVER: true
+      ENABLE_PPROF: false
+    storage:
+      STORAGE_TYPE: minio
+      MINIO_ENDPOINT: "s3.badhouseplants.net:443"
+      MINIO_ACCESS_KEY_ID: gitea
+      MINIO_BUCKET: gitea
+      MINIO_LOCATION: us-east-1
+      MINIO_USE_SSL: true
+    admin:
+      DISABLE_REGULAR_ORG_CREATION: true
+    packages:
+      ENABLED: true
+    cron:
+      enabled: true
+    attachment:
+      MAX_SIZE: 100
+    actions:
+      ENABLED: true
+    oauth2_client:
+      REGISTER_EMAIL_CONFIRM: false
+      ENABLE_AUTO_REGISTRATION: true
+    session:
+      PROVIDER: redis
+    cache:
+      ENABLED: true
+      ADAPTER: redis
+    queue:
+      TYPE: redis
+    mailer:
+      ENABLED: true
+      FROM: bot@badhouseplants.net
+      PROTOCOL: smtp+startls
+      SMTP_ADDR: stalwart.badhouseplants.net
+      SMTP_PORT: 587
+      USER: bot
+    indexer:
+      REPO_INDEXER_ENABLED: true
+      REPO_INDEXER_PATH: indexers/repos.bleve
+      MAX_FILE_SIZE: 1048576
+      REPO_INDEXER_EXCLUDE: resources/bin/**
+    picture:
+      ENABLE_FEDERATED_AVATAR: false
+service:
+  ssh:
+    type: ClusterIP
+    port: 22
+    clusterIP:
+deployment:
+  env:
+    - name: REQUIRE_SIGNIN_VIEW
+      value: expensive
+extraDeploy:
+  - |-
+    apiVersion: kinda.rocks/v1beta1
+    kind: Database
+    metadata:
+      generation: 1
+      labels:
+        app.kubernetes.io/managed-by: Helm
+      name: {{ include "gitea.fullname" $ }}
+    spec:
+      backup:
+        cron: 0 0 * * *
+        enable: false
+      credentials:
+        templates:
+        - name: CONNECTION_STRING
+          secret: true
+          template: {{` '{{ .Protocol }}://{{ .Username }}:{{ .Password }}@{{ .Hostname }}:{{.Port }}/{{ .Database }}' `}}
+      deletionProtected: true
+      instance: postgres17
+      postgres: {}
+      secretName: {{ include "gitea.fullname" $ }}-db-creds
+  - |-
+    apiVersion: traefik.io/v1alpha1
+    kind: IngressRouteTCP
+    metadata:
+      name: {{ include "gitea.fullname" $ }}-ssh
+    spec:
+      entryPoints:
+      - ssh
+      routes:
+      - match: HostSNI(`*`)
+        services:
+        - name: {{ include "gitea.fullname" $ }}-ssh
+          nativeLB: true
+          port: 22
+
+# ------------------------------------------
+# -- Disabled dependencies
+# ------------------------------------------
+postgresql-ha:
+  enabled: false
+redis-cluster:
+  enabled: false
+
+# extraDeploy:
+#   - |
+#       {{- if $.Capabilities.APIVersions.Has "traefik.io/v1alpha1/IngressRouteTCP" }}
+#       apiVersion: traefik.io/v1alpha1
+#       kind: IngressRouteTCP
+#       metadata:
+#         name: {{ include "gitea.fullname" . }}-ssh
+#       spec:
+#         entryPoints:
+#           - ssh
+#         routes:
+#           - match: HostSNI('*')
+#             services:
+#               - name: "{{ include "gitea.fullname" . }}-ssh"
+#                 port: 22
+#                 nativeLB: true
+#       {{- end }}

values/badhouseplants/org-badhouseplants/app-navidrome-private/secrets.yaml

@@ -0,0 +1,28 @@
+files:
+    rclone-config:
+        enabled: ENC[AES256_GCM,data:3y4DCg==,iv:n+Pfj4j405WR17aY7RbF6lpOQ58ZQmWrH6dgUTQ0jX4=,tag:xbKEnPnASJTl27ch1Hi00g==,type:bool]
+        sensitive: ENC[AES256_GCM,data:DGby8Q==,iv:nibU4CkdcYlT1F7OkgqE1apUuyJA5M9Vj5x40F9zt3w=,tag:oW+jPP7F1vWY5gf0JyrPdw==,type:bool]
+        remove: []
+        entries:
+            rclone.conf:
+                data: ENC[AES256_GCM,data:m4K3yt7no9mnUOzn/iGtaKqBrDXoLCgxEWV8NacXlOvh7c5ngmTmwoxzTaNxbsCQA7dECYb0dFtPvhF33AqgpcbRnqGrK54v8V+NaldQrgT2up4iQfdYA+sh+yNG3QAXU7eOEBvyFctJ+9dEaBII1sF/xFSkcTwrWkQFTQKLDdNIYU9a8ttEysz0cBWWXL3h9Y7C/mBjPdWIhpaf6Z63hy5P0hnYFftZsVM=,iv:qBBk9xMlZl3FriY2oYk4DQB1EKTsl7/qUj4s8naVvts=,tag:tDUKvK8ZuIxVeJjyUUqeXQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxalE3bUtCWmFVejBJMlZq
+            dUg0U0R2VytsZHZ5QlQ4UGdrRmdsWGhWbEI4Clk1WEZ4U1lEdTJoRVBTbEFXaE1O
+            TW1wb0dycS9HeWdQcUx3KzJKb2kwTVUKLS0tIDU1bE9JWnp3Q3U4V0pVOGs4Z3Rq
+            Q1VsM3orOUZmS3lDaFpNN2g0cnllVWMKqZlPfiIFKn8h56gspbbUhpv9RkL5gF73
+            NzqtFJJwQOGaD3lk2ocaLLkvywJ/DKNf7JupTWlmggHijId4hmpytw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-11-20T15:04:15Z"
+    mac: ENC[AES256_GCM,data:XRmw86oJLHXMAY/SPv6ptQLV1Eocbig6CQSG1SdOO9scMpfgD3tMY43z5aB16DkW+6AG1ti+TS4JRgXKLaSsAmORqRN0yTwGEktiLs0GxhtDvMYwnclj/Cx76WbZyMkgVzCHe7ZsAI+9DrejSFYbB/CzA+8yq1KmMf/L5NWcv7o=,iv:AcYK48ywr2pzNw/HEY5hWOcjdnmnG2/eWp+r/o15Lbk=,tag:HLKLFYFV+7SWUaFYiNUS3g==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.1

values/badhouseplants/org-badhouseplants/app-navidrome-private/values.yaml

@@ -0,0 +1,49 @@
+shortcuts:
+  hostname: navidrome.badhouseplants.net
+ingress:
+  main:
+    annotations:
+      kubernetes.io/ingress.class: traefik
+      kubernetes.io/tls-acme: "true"
+      kubernetes.io/ingress.allow-http: "false"
+      kubernetes.io/ingress.global-static-ip-name: ""
+      cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
+
+      traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+env:
+  main:
+    enabled: true
+    sensitive: false
+    remove: []
+    data:
+      ND_MUSICFOLDER: /app/music
+      ND_DATAFOLDER: /app/data
+      ND_LOGLEVEL: info
+      ND_BASEURL: 'https://{{ .Values.shortcuts.hostname }}'
+files:
+  rclone-config:
+    enabled: true
+    sensitive: true
+    remove: []
+    entries:
+      rclone.conf:
+        data: |
+          [music-data]
+          type = s3
+          provider = Minio
+          endpoint = s3.badhouseplants.net
+          location_constraint = us-west-1
+          access_key_id = allanger
+          secret_access_key = fPN3Nv6yDWVnZ7V7eRZ
+  rclone-script:
+    enabled: true
+    sensitive: false
+    remove: []
+    entries:
+      rclone-script:
+        data: |
+          #!/usr/bin/sh
+          while true; do
+            rclone --config /app/rclone.conf sync -P music-data:/music /app/music
+            sleep 10
+          done

values/badhouseplants/org-badhouseplants/app-navidrome/values.yaml

@@ -0,0 +1,54 @@
+middleware:
+  enabled: true
+  middlewares:
+    - name: navidromeauth
+      spec:
+        headers:
+          customRequestHeaders:
+            Remote-User: "guest"
+
+shortcuts:
+  hostname: music.badhouseplants.net
+
+ingress:
+  main:
+    annotations:
+      traefik.ingress.kubernetes.io/router.middlewares: org-badhouseplants-navidromeauth@kubernetescrd
+      kubernetes.io/ingress.class: traefik
+      kubernetes.io/tls-acme: "true"
+      kubernetes.io/ingress.allow-http: "false"
+      kubernetes.io/ingress.global-static-ip-name: ""
+      cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
+      traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+env:
+  main:
+    enabled: true
+    sensitive: false
+    remove: []
+    data:
+      ND_MUSICFOLDER: /app/music
+      ND_DATAFOLDER: /app/data
+      ND_LOGLEVEL: info
+      ND_BASEURL: 'https://{{ .Values.shortcuts.hostname }}'
+      ND_REVERSEPROXYUSERHEADER: "Remote-User"
+      ND_REVERSEPROXYWHITELIST: "0.0.0.0/0"
+      ND_LASTFM_ENABLED: false
+      ND_LISTENBRAINZ_ENABLED: false
+      ND_ENABLEUSEREDITING: false
+      ND_ENABLEFAVOURITES: false
+      ND_ENABLESTARRATING: false
+      ND_ENABLEEXTERNALSERVICES: false
+      ND_ENABLESHARING: true
+files:
+  rclone-config:
+    enabled: true
+    sensitive: false
+    remove: []
+    entries:
+      rclone.conf:
+        data: |
+          [music-data]
+          type = s3
+          provider = Minio
+          endpoint = s3.badhouseplants.net
+          location_constraint = us-west-1

values/badhouseplants/org-badhouseplants/app-open-strike-2/values.yaml

@@ -0,0 +1,20 @@
+deployAnnotations:
+  keel.sh/policy: force
+  keel.sh/trigger: poll
+  keel.sh/initContainers: 'true'
+
+extra:
+  templates:
+    - |-
+      apiVersion: traefik.io/v1alpha1
+      kind: IngressRouteUDP
+      metadata:
+        name: "{{ .Release.Name }}-game"
+      spec:
+        entryPoints:
+        - game-udp
+        routes:
+        - services:
+          - name: app-open-strike-2-main
+            nativeLB: true
+            port: 27015

values/badhouseplants/org-badhouseplants/app-stalwart/secrets.yaml

@@ -0,0 +1,27 @@
+config:
+    env:
+        secrets:
+            data:
+                SW_ADMIN_SECRET: ENC[AES256_GCM,data:dG2zVmvycL7TZM922XADQ/SwWMBrUvXd+BPwpxIvmaDnjejpEaHUfB0xhpkhZqhAB8M=,iv:5hDpUFLLGLf4VLj8h3weOZhiwJKYORg5uKVgXVXKbgM=,tag:9FQru61B5hDPcIoIUDvUtg==,type:str]
+                MINIO_ACCESS_ID: ENC[AES256_GCM,data:HvZa/kOy8ZI=,iv:T2433k3OmZTmPTx2QWEAELlN7zY37LUynapVWpASrJ0=,tag:Kvr4wIgq5dMmXRJDoxqGxA==,type:str]
+                MINIO_SECRET_KEY: ENC[AES256_GCM,data:Tv5VWQprCKtJCghzhZ8YD8/9,iv:hioZ+d0ns+Hr3pBVyfFWgcuRKDrPQmskSnU0XOMwhzA=,tag:nuFn0qV9UMy2ywiFfx5gHg==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGMTZGN2NSYXUzcXNJVUx2
+            YXE3Nk5MbnV1dyttUEtmUExabFYvOGdHcTBRCkM1WE9uNlF1OGh4NnNDL3NabXhi
+            OW1NcDlydUMraTVQV2tjLzVla2tpSnMKLS0tIHN6RXVJTzNvZlkyTmdDb09UTUNy
+            TVJyRVI5U2NmV1VIQTk4cjlYM1htMFkKkxsXzn+7nFiTs3mANqO0+f7/TTGKogFk
+            8ix4OpiA9b33kuqi4Z7bXx4ucyCmlDwtxuHvmOEOyW4yJ9F1cgm+Uw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-02-15T23:05:04Z"
+    mac: ENC[AES256_GCM,data:Kix/IdONJ79Lj1dc/gigpM7BUPyg7EIsPQzkhtu8+nbIQZQsm0CYqlqPx1V7w0r9vef+rCd/8GX8RdKw0o5ZaDZY5l0nXEi9E7dEtcHTYlrr8fqljcsGRAKmOiBRMkPh0jGTEPlFRtb0Inrn85rWUiMJP12hwIIS0t7GpAydKdI=,iv:1pMdzj1x0Hf65nmZ28Lv7yu6Y+suQKxv274nYl8J3HI=,tag:GQL8HOSswz2N56iNAS9l9w==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4

values/badhouseplants/org-badhouseplants/app-stalwart/values.yaml

@@ -0,0 +1,318 @@
+shortcuts:
+  hostname: stalwart.badhouseplants.net
+
+base:
+  workload:
+    initContainers:
+      prepare-config:
+        image:
+          registry: registry.hub.docker.com
+          repository: library/alpine
+          tag: latest
+          pullPolicy: Always
+        volumeMounts:
+          files:
+            config:
+              path: /app/config/config.toml
+              subPath: config.toml
+          extraVolumes:
+            config:
+              path: /app/etc
+        command:
+          - sh
+        args:
+          - -c
+          - cp /app/config/config.toml /app/etc/config.toml && echo "" >> /app/etc/config.toml
+    containers:
+      stalwart:
+        volumeMounts:
+          extraVolumes:
+            certs:
+              path: /app/certs
+            stalwart:
+              path: /opt/stalwart-mail
+            config:
+              path: /opt/stalwart-mail/etc
+
+        envFrom:
+          secrets: {}
+          raw:
+            - secretRef:
+                name: app-stalwart-db-creds-17
+
+extraVolumes:
+  certs:
+    secret:
+      secretName: stalwart.badhouseplants.net
+  stalwart:
+    emptyDir: {}
+  config:
+    emptyDir: {}
+ingress:
+  main:
+    metadata:
+      annotations:
+        cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
+        kubernetes.io/ingress.allow-http: "false"
+        kubernetes.io/ingress.class: traefik
+        kubernetes.io/ingress.global-static-ip-name: ""
+        kubernetes.io/tls-acme: "true"
+        traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+config:
+  files:
+    config:
+      enabled: true
+      sensitive: false
+      remove: []
+      entries:
+        # Ref: https://github.com/stalwartlabs/mail-server/blob/main/resources/config/config.toml
+        config.toml:
+          data: |-
+            [lookup.default]
+            hostname = "{{ .Values.shortcuts.hostname }}"
+
+            [server.listener."smtp"]
+            bind = ["[::]:25"]
+            protocol = "smtp"
+            proxy.override = true
+            proxy.trusted-networks.0 = "192.168.0.0/16"
+
+            [server.listener."smtp-startls"]
+            bind = ["[::]:587"]
+            protocol = "smtp"
+            proxy.override = true
+            proxy.trusted-networks.0 = "192.168.0.0/16"
+
+            [server.listener."smtps"]
+            bind = ["[::]:465"]
+            protocol = "smtp"
+            tls.implicit = true
+            proxy.override = true
+            proxy.trusted-networks.0 = "192.168.0.0/16"
+
+            [server.listener."imap"]
+            bind = ["[::]:143"]
+            protocol = "imap"
+            proxy.override = true
+            proxy.trusted-networks.0 = "192.168.0.0/16"
+
+            [server.listener."imaptls"]
+            bind = ["[::]:993"]
+            protocol = "imap"
+            tls.implicit = true
+            proxy.override = true
+            proxy.trusted-networks.0 = "192.168.0.0/16"
+
+            [server.listener.pop3]
+            bind = "[::]:110"
+            protocol = "pop3"
+            proxy.override = true
+            proxy.trusted-networks.0 = "192.168.0.0/16"
+
+            [server.listener.pop3s]
+            bind = "[::]:995"
+            protocol = "pop3"
+            tls.implicit = true
+            proxy.override = true
+            proxy.trusted-networks.0 = "192.168.0.0/16"
+
+            [server.listener."sieve"]
+            bind = ["[::]:4190"]
+            protocol = "managesieve"
+            proxy.override = true
+            proxy.trusted-networks.0 = "192.168.0.0/16"
+
+            [server.listener."https"]
+            protocol = "https"
+            bind = ["[::]:443"]
+            tls.implicit = false
+
+            [server.listener."http"]
+            bind = "[::]:8080"
+            protocol = "http"
+            hsts = true
+
+            [store."minio"]
+            type = "s3"
+            bucket = "stalwart"
+            region = "eu-central-1"
+            access-key = "%{env:MINIO_ACCESS_ID}%"
+            secret-key = "%{env:MINIO_SECRET_KEY}%"
+            endpoint = "https://s3.badhouseplants.net:443"
+            timeout = "30s"
+            key-prefix = "/"
+
+            [store."postgresql"]
+            type = "postgresql"
+            host = "postgres17-postgresql.databases.svc.cluster.local"
+            port = 5432
+            database = "%{env:POSTGRES_DB}%"
+            user = "%{env:POSTGRES_USER}%"
+            password = "%{env:POSTGRES_PASSWORD}%"
+            timeout = "15s"
+
+            [storage]
+            data = "postgresql"
+            fts = "postgresql"
+            blob = "minio"
+            lookup = "postgresql"
+            directory = "internal"
+
+            [directory."internal"]
+            type = "internal"
+            store = "postgresql"
+
+            [authentication.fallback-admin]
+            user = "overlord"
+            secret = "%{env:SW_ADMIN_SECRET}%"
+
+            [tracer.console]
+            type = "console"
+            level = "info"
+            ansi = true
+            enable = true
+
+            [certificate."default"]
+            cert = "%{file:/app/certs/tls.crt}%"
+            private-key = "%{file:/app/certs/tls.key}%"
+
+  env:
+    secrets:
+      enabled: true
+      sensitive: true
+
+extra:
+  templates:
+    - |
+      apiVersion: traefik.io/v1alpha1
+      kind: IngressRouteTCP
+      metadata:
+        name: "{{ .Release.Name }}-smtp"
+      spec:
+        entryPoints:
+        - smtp
+        routes:
+        - match: HostSNI(`*`)
+          services:
+          - name: app-stalwart-mail
+            nativeLB: true
+            port: 25
+            proxyProtocol:
+              version: 2
+    - |
+      apiVersion: traefik.io/v1alpha1
+      kind: IngressRouteTCP
+      metadata:
+        name: "{{ .Release.Name }}-smtps"
+      spec:
+        entryPoints:
+        - smtps
+        routes:
+        - match: HostSNI(`*`)
+          services:
+          - name: app-stalwart-mail
+            nativeLB: true
+            port: 465
+            proxyProtocol:
+              version: 2
+    - |
+      apiVersion: traefik.io/v1alpha1
+      kind: IngressRouteTCP
+      metadata:
+        name: "{{ .Release.Name }}-smtp-startls"
+      spec:
+        entryPoints:
+        - smtp-startls
+        routes:
+        - match: HostSNI(`*`)
+          services:
+          - name: app-stalwart-mail
+            nativeLB: true
+            port: 587
+            proxyProtocol:
+              version: 2
+    - |
+      apiVersion: traefik.io/v1alpha1
+      kind: IngressRouteTCP
+      metadata:
+        name: "{{ .Release.Name }}-imap"
+      spec:
+        entryPoints:
+        - imap
+        routes:
+        - match: HostSNI(`*`)
+          services:
+          - name: app-stalwart-mail
+            nativeLB: true
+            port: 143
+            proxyProtocol:
+              version: 2
+    - |
+      apiVersion: traefik.io/v1alpha1
+      kind: IngressRouteTCP
+      metadata:
+        name: "{{ .Release.Name }}-imaps"
+      spec:
+        entryPoints:
+        - imaps
+        routes:
+        - match: HostSNI(`*`)
+          services:
+          - name: app-stalwart-mail
+            nativeLB: true
+            port: 993
+            proxyProtocol:
+              version: 2
+    - |
+      apiVersion: traefik.io/v1alpha1
+      kind: IngressRouteTCP
+      metadata:
+        name: "{{ .Release.Name }}-pop3"
+      spec:
+        entryPoints:
+        - pop3
+        routes:
+        - match: HostSNI(`*`)
+          services:
+          - name: app-stalwart-mail
+            nativeLB: true
+            port: 110
+            proxyProtocol:
+              version: 2
+    - |
+      apiVersion: traefik.io/v1alpha1
+      kind: IngressRouteTCP
+      metadata:
+        name: "{{ .Release.Name }}-pop3s"
+      spec:
+        entryPoints:
+        - pop3s
+        routes:
+        - match: HostSNI(`*`)
+          services:
+          - name: app-stalwart-mail
+            nativeLB: true
+            port: 995
+            proxyProtocol:
+              version: 2
+    - |
+      apiVersion: kinda.rocks/v1beta1
+      kind: Database
+      metadata:
+        name: "{{ .Release.Name }}-postgres17"
+      spec:
+        secretName: {{ .Release.Name  }}-db-creds-17
+        backup:
+          cron: 0 0 * * *
+          enable: false
+        credentials:
+          templates:
+            - name: POSTGRES_HOST
+              secret: true
+              template: "{{` {{ .Hostname }} `}}"
+            - name: POSTGRES_PORT
+              secret: true
+              template: "{{` {{ .Port }} `}}"
+        deletionProtected: true
+        instance: postgres17
+        postgres: {}

values/badhouseplants/org-badhouseplants/app-tandoor-recipes/secrets.yaml

@@ -0,0 +1,25 @@
+env:
+    secrets:
+        data:
+            SECRET_KEY: ENC[AES256_GCM,data:bLecWaJafPbXT2/dvKt3R2KNfuxxgQ6yLxviYbOf,iv:liuexfgYScH+eg/qSO23SQxE7hKpudgkOH3JRDkaa+A=,tag:DEcAbY6rg7mQnhsnukWtFA==,type:str]
+            SOCIALACCOUNT_PROVIDERS: ENC[AES256_GCM,data:kx9ziZhxWcWTu1UG7BPi/sdG1tHhzugq65xxL3IPVx8i1oHXwy+00KaOEsIYP+TJqX5516Zq6JqtXe9dQwI4uVIy538FdXeEQDHKNS0xesSx8jG0tKa71GiqyQGBrBBxiy144za9y1QHB9k1pvuaza8mVEQOoktmMFfiHzEOhYDQxIzTulOMWxN2ImTsYSupHS6HLR13gDCyROVDzj1Io/U1VHxN5RZBPiqthNiB+/Aj+2FuCwAaxgEE6VVNFJlghi2yiZbl/PvZ3MDT+dAx/NijawVt0qdBBmPvB3jKZkgRN2tyystGiu47hnLosuzjrOjAMA6rP7XkT2gQ5e6hoLlJxWD5IiAHI+gQK7REbyJrEmSwwH0aCVsd1H4FOBNk+rfKpTIr7sRZFTVcZLtUdTZW6EW0XWmrBBPr5jodmouoFZY+dGlWP1vQkG+2eymw5aJCan0oq+x+J9dB+CVZc/2M1zBeRa6Crg7w3smCqOr46jkaRxfoDxV2NdRSla5zkwwFSS7MqPYlqre2oW+pgP7lvRa4MW9++5q+Zg==,iv:RZMNm66PhTWvjJG5jtpJW22TFInHw8LT04qui3fMLgA=,tag:ETMqmFO/8Kve/W55WP21dA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKcTM5RTNIakwwZHNrQXE2
+            U2FsK1gwMDhUTDd1MVorbENtQXdnZjYrM1c4CmNQaG5TcU9wK25qQUg5a29UUXBK
+            WlZHK0M0dHEvZWVyZmJzR0RLU1pGWmMKLS0tIGk4TFArQnJyTWJJa3FJRlJhY0do
+            ZE81bENWM3ZUdlR0N2RKMnJkUnJxSG8Ky2ngwj6ZnToGhnAJChU8NXUG+XPPZc2F
+            fOD35BFO5bUNe+V8MkDLae+GQ1hr55r4WnvFpSWywRIjCFYmUJHTgQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-02-22T12:32:43Z"
+    mac: ENC[AES256_GCM,data:khcLV/lPaY6J5QQmX8466jx9bsXn+NwA3TLIUYs9ipKa539OjIWstwyydVxILSBCwEWGEW86c8EzLBwptBBgg6gehfRJAax5TAn0lBd1lAAiAxZhdNpc2tfoaMaUWfWdpwYjdrtnvAlAkN3/16nvx+TIq7WdU/cWsic96PqhU0A=,iv:I81QvtZ7S+mSAzoXhU0YBMN0L4K+SRHW3UtcSLxwK5s=,tag:gAeAIjyJ13A8gfE7ppBeRg==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4

values/badhouseplants/org-badhouseplants/app-tandoor-recipes/values.yaml

@@ -2,8 +2,8 @@ shortcuts:
   hostname: tandoor.badhouseplants.net
 ext-database:
   enabled: true
-  name: tandoor-postgres16
-  instance: postgres16
+  name: tandoor-postgres17
+  instance: postgres17
   credentials:
     POSTGRES_HOST: "{{ .Hostname }}"
     POSTGRES_PORT: "{{ .Port }}"
@@ -14,15 +14,24 @@ workload:
   containers:
     tandoor:
       securityContext:
-        runAsUser: 1000
-        runAsGroup: 3000
-        fsGroup: 3000
-        supplementalGroups: [3000]
+        runAsUser: 1001
+        runAsGroup: 1001
+        fsGroup: 1001
       envFrom:
         - main
         - secrets
         - secretRef:
             name: tandoor-postgres16-creds
+          extraVolumes:
+            common:
+              path: /opt/recipes
+      livenessProbe:
+        httpGet:
+          path: /
+          port: 8080
+        initialDelaySeconds: 10
+        failureThreshold: 30
+        periodSeconds: 10
 ingress:
   main:
     class: traefik
@@ -33,7 +42,9 @@ ingress:
       kubernetes.io/ingress.allow-http: "false"
       kubernetes.io/ingress.global-static-ip-name: ""
       cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
-
+extraVolumes:
+  common:
+    emptyDir: {}
 env:
   main:
     enabled: true

values/badhouseplants/org-badhouseplants/app-vaultwarden/secrets.yaml

@@ -0,0 +1,26 @@
+config:
+    env:
+        secrets:
+            enabled: ENC[AES256_GCM,data:bai2CQ==,iv:NG7q1ZsDpCW9Lu00fGsibpTEHGtew+l5TFOLOpljlwU=,tag:Z2/fXmsEEqhDzCdTWS/Qhw==,type:bool]
+            sensitive: ENC[AES256_GCM,data:n+dNXA==,iv:iFM0+5G5Bsw4NI+JH1vMMrty3Zo0El0HE9F6PEDsJrY=,tag:EcbzQHVeOHVLVC7kgaRPXw==,type:bool]
+            data:
+                SMTP_USERNAME: ENC[AES256_GCM,data:eQ4c,iv:4vX/ioHWEA6DzMwZ+23dgUN4PJ7Asz7bbufG5Fy80iI=,tag:1Mq0Hj/23T4fvGEXuNUtxA==,type:str]
+                ADMIN_PASSWORD: ENC[AES256_GCM,data:B08urSqwYgekI6I5LDYGHbPK5n3r+woRZw==,iv:K2O9aSJLRMbK+N2lfX4ojSqhbmb9KbWsuW2DtYZHCOA=,tag:Qz0OJ7aWwC+/9d1oc38ySw==,type:str]
+                ADMIN_TOKEN: ENC[AES256_GCM,data:sKVugfrrR9L5LtozHPibGiPULiwv8pAot925Z/rQ0V/mW+DVvNPEw4odgfX596Ddmd8oV5zo5Mz8WIPUCmrVmfdoz+3YzVywEy8=,iv:npthfz4xcW6fF10RhHCF6uXH/6526l3gjZGRu+Xpylg=,tag:vsPsRZ7EIQ7FMvqJga3hhg==,type:str]
+                DATABASE_URL: null
+                SMTP_PASSWORD: ENC[AES256_GCM,data:quvcZQKauXeW+l8xkYgVBElBQveoRWKDBA==,iv:KpQH+Ef87jl/M9XpBtIKNhn7ATHoV+Jgjpzg2Li28Kg=,tag:jniePrO7UVp/cz/eIh19mg==,type:str]
+sops:
+    age:
+        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGNnFwbWFpTWgxRk45S240
+            cVI5ekJXdVIwaG5NcGRPa2xTN2pFV2tyN1JBClNVMGhNL2FaM2pCK0sxbjgyalJN
+            MnpQeHBxY2RtWkI2c1htV3oyQmNnbVUKLS0tIGg4ZXNwaFRKNTlIRDluT3k0VDRD
+            Y3pIaEdFb1JwMnVrYnJ4UkpWMERmZFUKa45EvUqkvjaL85xh3gyxTeJ02IxPJf9a
+            TGjAvpjBrym9v++OrHn2otw1NOeZwSP1hmSCc+sa6/0yFqcU031xjQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-04-01T10:29:47Z"
+    mac: ENC[AES256_GCM,data:VmYotoR4BJJv2mZ+kt+NNn+oXLKWHed0o/TkJO93/4eLUm8Wg9SPMA1ZYYe9YRfgbIhYxPlQbPPKQBv95XeOS1FFL24VyenTTP3TXWroeXxOWubko/Fp88U3glJXs5jfL5DLYKvGwTXG3tchFDwH9m6QOABX+aRxvNBEP5zXUxs=,iv:HMzuvl8YCPj9ZA5tKfExQfSbvwu4IEHz6sMLAe8g7vo=,tag:lI2fh1b7prHsBS8Snrbdtw==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.10.0

values/badhouseplants/org-badhouseplants/app-vaultwarden/values.yaml

@@ -0,0 +1,63 @@
+shortcuts:
+  hostname: vaultwarden.badhouseplants.net
+
+base:
+  workload:
+    kind: Deployment
+    strategy:
+      type: RollingUpdate
+    containers:
+      vaultwarden:
+        envFrom:
+          raw:
+            - secretRef:
+                name: app-vaultwarden-db-creds-17
+ingress:
+  main:
+    class: traefik
+    metadata:
+      annotations:
+        kubernetes.io/ingress.class: traefik
+        traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+        kubernetes.io/tls-acme: "true"
+        kubernetes.io/ingress.allow-http: "false"
+        kubernetes.io/ingress.global-static-ip-name: ""
+        cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
+
+config:
+  env:
+    main:
+      enabled: true
+      sensitive: false
+      data:
+        SMTP_HOST: stalwart.badhouseplants.net
+        SMTP_SECURITY: "starttls"
+        SMTP_PORT: 587
+        SMTP_FROM: bot@badhouseplants.net
+        SMTP_FROM_NAME: Vault Warden
+        SMTP_AUTH_MECHANISM: "Plain"
+        SMTP_ACCEPT_INVALID_HOSTNAMES: "false"
+        SMTP_ACCEPT_INVALID_CERTS: "false"
+        SMTP_DEBUG: false
+        DOMAIN: "{{ .Values.shortcuts.hostname }}"
+        LOG_FILE: /app/logs/log.txt
+
+extra:
+  templates:
+    - |-
+      apiVersion: kinda.rocks/v1beta1
+      kind: Database
+      metadata:
+        name: "{{ .Release.Name }}-postgres17"
+      spec:
+        secretName: "{{ .Release.Name  }}-db-creds-17"
+        instance: postgres17
+        deletionProtected: true
+        backup:
+          enable: false
+          cron: 0 0 * * *
+        credentials:
+          templates:
+            - name: DATABASE_URL
+              template: "{{ `{{ .Protocol }}://{{ .Username }}:{{ .Password }}@{{ .Hostname }}:{{ .Port }}/{{ .Database }}` }}"
+              secret: true

values/badhouseplants/org-onpier/app-memos/values.yaml

@@ -0,0 +1,43 @@
+shortcuts:
+  hostname: notes-onpier.badhouseplants.net
+
+ext-database:
+  enabled: true
+  name: memos-postgres16
+  instance: postgres16
+  credentials:
+    MEMOS_DRIVER: postgres
+    MEMOS_DSN: "{{ .Protocol }}://{{ .Username }}:{{ .Password }}@{{ .Hostname }}:{{ .Port }}/{{ .Database }}?sslmode=disable"
+
+workload:
+  containers:
+    memos:
+      envFrom:
+        - main
+        - secretRef:
+            name: memos-postgres16-creds
+ingress:
+  main:
+    annotations:
+      kubernetes.io/ingress.class: traefik
+      kubernetes.io/tls-acme: "true"
+      kubernetes.io/ingress.allow-http: "false"
+      kubernetes.io/ingress.global-static-ip-name: ""
+      cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
+      traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+      traefik.ingress.kubernetes.io/router.middlewares: org\-onpier-memosauth@kubernetescrd
+
+ext-secret:
+  enabled: true
+  name: memos-basic-auth
+  data:
+    users: |
+      allanger:$apr1$kNwkQ0S.$9q29sib/xWEp3NDp.tquw/
+
+middleware:
+  enabled: true
+  middlewares:
+    - name: memosauth
+      spec:
+        basicAuth:
+          secret: memos-basic-auth

values/badhouseplants/platform/authentik/secrets.yaml

@@ -0,0 +1,19 @@
+authentik:
+    email:
+        password: ENC[AES256_GCM,data:aP/oiXCzwLsEd0qAp8aAPufQ1Ko=,iv:T5YdegcjWEK4MDdzLhFmsvV56OPl0jkhmtepohujP/s=,tag:EXerXi4m06Ryy7WVD3ZURg==,type:str]
+    secret_key: ENC[AES256_GCM,data:Oh/csFD5+FDfyXUYRVCEPrBE6UXPFZkR5VEep1bkAjs4hltuOaO22Q==,iv:IiBtFjBbsjepC2VmEk6wEe7r14lv48DBX12SpXaUCmc=,tag:ITR6OJiCYMxUoTGnSCPTQQ==,type:str]
+sops:
+    age:
+        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsSUNmTVZ0ZC9LaytCUTZy
+            TTRNR0M0WDVmN0RPVllWTmR0dnMrdzBCOFJnCkMrNGVCc1FnYkZTaE1vUFRCVWI0
+            WERUTWMwanFZUDFnVExZL2NyVTNWTk0KLS0tIEN2K0wzQm8vUkw4azZPaE9LZGsx
+            UW05cHVjemNBeDFGbHhoVXR4ckUxUXMKgfTTlw0Q3J+pFSW+eEyfK1tkrbEd4ZzR
+            x0ONWS1GTx+um+r76NYNRI+W93FD5d4/jiiZGPB6rupMSje9DV41MQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-04-12T15:22:14Z"
+    mac: ENC[AES256_GCM,data:xwt0NRuygT/qAlhnfKHLqgVFfEMKMIgiGvjCl7baIplwl94Kxqhh6JMgCogjjtoI2iGrAY3QPamfTDQIOEItB/yqQ7S9NApWIfsXtA8t85YuWwnP3OTCDmpy6dcP1FOV4lGmSvsqr65+OYKALrPTRkA7pV9kGo3roO6BPJbpb+Y=,iv:5eY4EOBM0ZFSjiyKmOJ07YNStOg0+Db3cM27g8+Y//s=,tag:rT1aCz5M0k9AbxKSWhmJ1A==,type:str]
+    unencrypted_suffix: _unencrypted
+    version: 3.10.1

values/badhouseplants/platform/authentik/values.yaml

@@ -14,10 +14,10 @@ ext-database:
     database: "{{ .Database }}"
 authentik:
   email:
-    host: email.badhouseplants.net
+    host: stalwart.badhouseplants.net
     port: 587
     username: bot@badhouseplants.net
-    use_tls: false
+    use_tls: true
     use_ssl: false
     timeout: 30
     from: bot@badhouseplants.net
@@ -26,7 +26,6 @@ authentik:
     user: file:///postgres-creds/username
     password: file:///postgres-creds/password
     name: file:///postgres-creds/database
-  secret_key: "2Scv6ivCfV6uGRTx9Kg5CYJ2KjBRHpR8GqSBearnBYvBFZBwR7"
   # This sends anonymous usage-data, stack traces on errors and
   # performance data to authentik.error-reporting.a7k.io, and is fully opt-in
   error_reporting:

values/badhouseplants/platform/db-instances/secrets.yaml

@@ -0,0 +1,29 @@
+dbinstances:
+    postgres16:
+        secrets:
+            adminUser: ENC[AES256_GCM,data:uuu/xvwJkHk=,iv:Pk+i8bf7AeeG9wKVh1RDJy7Dt3r5b1UKy4SJijlZfq0=,tag:QO3gwYXAG0sBBuHcKfTNQg==,type:str]
+            adminPassword: ENC[AES256_GCM,data:tjWATjuJT+C97D4TLQgk55BZOwVv,iv:1MWYtksmrEBQtOdGvtc6MZyLP4yBKA88eIpQ4mZCULM=,tag:3hOlT5n2Wd81ebxeEgW5tw==,type:str]
+    postgres17:
+        secrets:
+            adminUser: ENC[AES256_GCM,data:4w2EItIM++Q=,iv:cQLryeBskm2Y9OlbMFgQEWEBi7z/VxucLWbwZXsRtto=,tag:Ir2Q7KZv/sSDdA1MX/Niqw==,type:str]
+            adminPassword: ENC[AES256_GCM,data:wHUL2p8CXYwoEFu3ffCCsQO9xn/GqOZ6JPrcHKzy,iv:khoogPPFHSd+4xyp+jf1w0RfOUgrKzAmFjLnisQ8HXU=,tag:GRnkCQ0uOlUt2AiEAceFRQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuL1lwdVNHMm9nZHRld2lO
+            Rm4xVnVHWG9hNDc1cUVyakxzUU1PcFJhalM4CkNicEdUV2lEYWMwaWNqeGcrQ2p1
+            Qmw1b1FzRllqYW85bjF0cmRGcW1MbjQKLS0tIENUcG1oOXFNV3REaFU0aUEyd2k4
+            RDgzRmlKT1ArblpOV1plcFpyMnJXZTQKgm8Eaw591+EHZWofXAADTXRHPOdOvdOM
+            jYne1szB/V9UJz+pmLa10tNgruga+P5yP/j+DGcYrTj0pVh5IJLjTA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-10-30T19:59:46Z"
+    mac: ENC[AES256_GCM,data:3KrwiArDx/bPAHbFGgb9BdDVHC+uC1IHp4LZXlYRZzWSKtX1t+ODQVzUW97kigGFG1sx6WXddl/w3XeNOoT9JbS5iPXJQe6KAPleNV50S/oab+U53WeloO8uL68Wrk9v/NwMhCKwE9cCqBBhqk7wCb6N9ivt45mLrUf06L8fok0=,iv:bOWhyIm8FhKtZAZH/78bukkeDp5P4XShSD20mgr4Neo=,tag:RZMx9bi+ZEcLwTzk+Gm8RQ==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.1

values/badhouseplants/platform/db-instances/values.yaml

@@ -0,0 +1,21 @@
+dbinstances:
+  postgres16:
+    monitoring:
+      enabled: false
+    adminSecretRef:
+      Name: postgres16-secret
+      Namespace: databases
+    engine: postgres
+    generic:
+      host: postgres16-postgresql.databases.svc.cluster.local
+      port: 5432
+  postgres17:
+    monitoring:
+      enabled: false
+    adminSecretRef:
+      Name: postgres17-secret
+      Namespace: databases
+    engine: postgres
+    generic:
+      host: postgres17-postgresql.databases.svc.cluster.local
+      port: 5432

values/badhouseplants/platform/external-dns/secrets.yaml

@@ -0,0 +1,23 @@
+env:
+    - name: ENC[AES256_GCM,data:iUkU/BNlitD6f6RQ,iv:x5aENGi0aw9gDh2a7h92DfxwQgdbacM3hHtnPVdIKWA=,tag:4vyOlP7XcC1F6pjnUieAuA==,type:str]
+      value: ENC[AES256_GCM,data:cFypu5mF+ktwjNFCBcy0U/1UIt4Fc/CAtH/SngvaaBXY0yinYzaiOQ==,iv:2VQ1Cpmppkz2ylt5NMP84o+0EQkI43jz267HNRjMugg=,tag:co3LJzwxbmxT09km65MVuw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwMXNsQjEwYXdaR0Y3bktt
+            UGFYS09Nc29IR0w0YmpweUtyV2pPbXFPeFJnCjZkclRSVjREanorbk5MKzJybWJI
+            UDlwdlVqWGZockVVeFVrNnZlZGp1NUkKLS0tIDhnUzgxdlFWa1NicVJEUk81cXp5
+            M2xvSjRrNUx5OFRqbUFpSXdyZ04xVzgKMsBwKA8dVSW9BR2jSTBxMPKevual5P8I
+            V+YUcIIUAP1sFjs4jVhTduBSMI/ZSArWYIEX+dQ46oGDLcRzODm9xQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-02-16T14:21:33Z"
+    mac: ENC[AES256_GCM,data:5nE5vx69ESp0HW0/uxYGp8Lq35Cjb5UpSmNkx1H4ux67K3xs3zEBSrupDuUqzrrj/WFFgTf8fIAnfu//bEUvRqtqkIOb7eTqBlQTCzdKWLMvfwhv3WnfXLljJvZZH+e430z7ayw6psfNbwm5sPr+/sPSijg31xv8x9wN8LfZqno=,iv:BKyKMqQ/eLiDspSlvMh0/I7hKb3xn2BUQhuHwrl+Pfc=,tag:is4SHDuAT2c3Ip2O5ifgWw==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4

values/badhouseplants/platform/external-dns/values.yaml

@@ -0,0 +1,15 @@
+provider:
+  name: cloudflare
+domainFilters:
+  - badhouseplants.net
+excludeDomains:
+  - ru.badhouseplants.net
+policy: sync
+txtOwnerId: badhp
+txtPrefix: badhp-ext-dns-
+logFormat: json
+logLevel: info
+sources:
+  - service
+  - ingress
+  - crd

values/badhouseplants/platform/minio/secrets.yaml

@@ -0,0 +1,50 @@
+rootPassword: ENC[AES256_GCM,data:edKknfs0kqBVSTQ4CQUdRdKH22c=,iv:PcSajWchrPOfdPek9OP5s0nfWlFWToHTfLZ89iBZeSs=,tag:5kK4eHmNza1arao76EVHzA==,type:str]
+users:
+    - accessKey: ENC[AES256_GCM,data:mjmjYJCJofI=,iv:4nN3dt4CKACC7C1/Zfn76SixKmTW4NUxDj+WWbp4DSo=,tag:4lNCTXo+isM+/crCNRtEyA==,type:str]
+      secretKey: ENC[AES256_GCM,data:qkQbZVszNgwmjSvtMtNlEjVBKw==,iv:k+xYu3RFJNovJMBrNqO7QICIvkhe0niHnbGSEwaXe9s=,tag:A2j4EgUB4+3ywZMbroydUw==,type:str]
+      policy: ENC[AES256_GCM,data:KOG9rF5sQtA=,iv:g+KBqLtKBmuj8saUomFjewp1/MiTqXNqxOua2rL19yc=,tag:ibsvSJsGbNuqp5Q8azpcog==,type:str]
+    - accessKey: ENC[AES256_GCM,data:JvnF,iv:T2eXmfOvFInwpsHzrV4oY9vTsJkdHKvb4+UEriunGQw=,tag:MEudOOKBDi42DU+w7K8MEQ==,type:str]
+      secretKey: ENC[AES256_GCM,data:NVFcExw9K2Xw5SbtvXLh3OfoGXNe0IhGmA==,iv:lW0gJ/l3v6BWGCKK/W8B/T2cWq9i6akk2gcsxqPAJpU=,tag:4hxkcaOBc8lHwkMQbzXCbg==,type:str]
+      policy: ENC[AES256_GCM,data:TzNg,iv:/5IRuuS/lO0eo9dos0nNjFoar9PPYlDna5G0dezORvg=,tag:5vyT7jsmU561wFh5NXXG7w==,type:str]
+    - accessKey: ENC[AES256_GCM,data:42SdqYzhNp6Q,iv:pzLnTOITSXJQ8mSNEE+H7EMpa/KO3+W2WJndRgs96Ps=,tag:fZBGTCRPvjRny9FcpvUEmg==,type:str]
+      secretKey: ENC[AES256_GCM,data:J7qAgeWCk6ASt5xBqyrlRNbzQWc=,iv:KC2rpT+lZMyWCch32ycvDtCtqtEWPst/xt5KE1kfYuQ=,tag:9K/Aj54OrbC2qeRWE1bXYg==,type:str]
+      policy: ENC[AES256_GCM,data:DOlqPrIkMCai,iv:q6lULKICvr74qPC/hp90E0XBOFNEs9sYZGfMkcfGZx8=,tag:grNwZst6JUXTpirYIz2XAw==,type:str]
+    - accessKey: ENC[AES256_GCM,data:sy6+E6w=,iv:oHZeQp3BwjB94V/sYxqH5d2L60QMI9m4ZrbolKLRBC4=,tag:7huBXPr027Sn3agLTMd28A==,type:str]
+      secretKey: ENC[AES256_GCM,data:BD4AjbQj9EEK9tKuyaD2OQ2Xrdjg0OlYpw==,iv:52AzwMOA97K40T+QbJ+0Pr4yNdNLw+yfWDEXsEWyIpM=,tag:j+CUMCoUykq05i81C8kEiw==,type:str]
+      policy: ENC[AES256_GCM,data:+BUO1Qo=,iv:kH4rHe5wb0xqOfI2vBGXcyMSCzuSEOCYZ1D8P+7KcnY=,tag:l3twpA6C+gvDZv4qeevVsQ==,type:str]
+    - accessKey: ENC[AES256_GCM,data:FAtE8kxRyrLC,iv:M2O1MPh1s0r1gNof/2oUybxQxDIOTR3HNfFOLyi6kPA=,tag:gf5HJZbfmn2XTutqeAo0uw==,type:str]
+      secretKey: ENC[AES256_GCM,data:GV4Hrq5p1mh3chle1XrvlTpPn7EGQFy1tQ==,iv:xYTNNavejVJmtKLPS9OzFbamcZaz+eRtAn68gGddby0=,tag:HkareuwAwA7QWE6mLO4Bug==,type:str]
+      policy: ENC[AES256_GCM,data:iHNhp3SM29lZ,iv:/y927HxGNOVuayMc1hl8DB/l8l5ioMXb0Fkf7RAA2qw=,tag:w0oC4RgAmYKaWq5sredNTQ==,type:str]
+    - accessKey: ENC[AES256_GCM,data:u2jY6VH7W3c=,iv:vR5C1FqK5wxY2QXxKKxaaadoWqPptxtLUGsjmyq0q/E=,tag:enHvPhEd6KahnVq6KjFhQw==,type:str]
+      secretKey: ENC[AES256_GCM,data:BQTRMAKezwRAtLE3jhFK71Cp,iv:M1VmxliYG0+VNuiDr++hJPe2fa/X32ZJCYAD/VDwYNU=,tag:8jIzJHhE5k7QAjm8vnlYrQ==,type:str]
+      policy: ENC[AES256_GCM,data:6qgyKj01Big=,iv:wB3Adf71VPXTu668fq+yLT2gCPru6nDVqqdnh63OfCs=,tag:d5xLh1eLZEXxksg/DxfVHQ==,type:str]
+oidc:
+    enabled: ENC[AES256_GCM,data:IotxfQ==,iv:vi5Fn3a7My9nyOb67zTTEzHLoFS8IsEQMcQ2i8f2Nns=,tag:/DMVcbOb0s5mZH3uuStXXQ==,type:bool]
+    configUrl: ENC[AES256_GCM,data:Y7/Qzdy1RLbFgX3ynK6v8KIP5D5qKmwtRx3VCFWVJoch+q5tqHYnENgTcagkOwkHEhQY8DFcSJRrj7VwSGU6f/Rd4LrPdVboe8IRGFdaaZHXobwVooHGlCs=,iv:urkXua9hA6dVcltwwD2ZAb1ysZjU5eKegM2ifWtO5wc=,tag:zgs9I0aVVyAbuyd80ajlZQ==,type:str]
+    clientId: ENC[AES256_GCM,data:aZraoow=,iv:XhlAZly8Pb4LFzt4K1XWyvdeEQnU9VEpn9jHvwdm+34=,tag:T5CvtIU6SJ/hUM69GUfSHg==,type:str]
+    clientSecret: ENC[AES256_GCM,data:WtIcgBfFGvfswBTRAp8IqUV5o6HAklMs8C6Yu9xNjadqtcvuUARMeVLGddioZJZFDu9e9wrX/O9Z5nAZrPjSNLVjjlC6hZL3OhqkMYhkowD7g0lLlTcBtWrQ0gzzKzgEv3AxldHlpGvsj7xKFzrH9Og0Dpw6ysYSV2pdRT654zE=,iv:JyHrOmIhP8yf/X5cI9kLNrvPPWhtTiSqj7id2/qE9Hc=,tag:MhApKAE5DVjGihxzqQPZBQ==,type:str]
+    claimName: ENC[AES256_GCM,data:Brw0M+jN,iv:V4YgI6J+QD2TnlQwBekS1PBI/Hgc0n/iIttPzNPK3eA=,tag:cDSu70i0QkVDHjoa+wKEvw==,type:str]
+    redirectUri: ENC[AES256_GCM,data:Hrg/3/GLHX2vEQwSuRJi2rtFekVNN0Idtt4IQ5fHxdRzLkKiBGi7kesHfquju8Q=,iv:OMeIhw8DWKJN2RZLxv/14+nI363tLjzKniffjT5t204=,tag:AokFVHtetOF0vLMBFpvuHQ==,type:str]
+    comment: ENC[AES256_GCM,data:ILnDkL8NNhKHkpZABUmpJ3nsxRY=,iv:Q6Ndcr7LzyViOKmtfX6ZSf0O5/6+ehRRn0V9Alrec7w=,tag:dxZxfUIEEMTHTHwQNHOHgg==,type:str]
+    claimPrefix: ""
+    scopes: ENC[AES256_GCM,data:ZP6O/NVbf67rZujeJVpgHsxjN2jtuP6rmjFB,iv:6DSLl24QqUZVD3hbd9Khxah1yEyri0FUTSVEceZTkDw=,tag:/C+y4oP7cOibwalDPzpv6w==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBpbVVjMlVGckdFazhPWVov
+            a2NTQWU5RGlmTGFSeFZqaW04MU1rVXQ3blhBCnNwQ1daNzY3L1JPK3FCVDFETU00
+            SnAxM0dNM0RlaEpJc21WamtJV0ZsNzQKLS0tIFdFK3pvemtJa1FyRnl5TnBZdjdh
+            aVR2T3dIQkFOSWV5S0QzZE51RGNPYmMKGTDousxnJn8mBe4AiYSz+zApYEQVQU0e
+            DQMlPYEQbmeT25G3C8XksSvEslTtPs9jwZv+mPTDXgzihxe8V6VQDQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-03-01T19:07:25Z"
+    mac: ENC[AES256_GCM,data:4PN2B86mG1Vy4BhV3hI0ec7nBowJnz1PDgDz1SGdKIzshxkEl9tAAt4eGnT5dwndO78R+cmmpbKOdSZXecE1PAHmGyp8e4vi/Y0F8EXTTl2rXcST3Lg5ivuIswKxpNhn7ZMZaUiJMFqOJUK5liGR8vzrNhJc6oPi65LJR8XgnII=,iv:XSm8C570MqHELojSxUUHmNppEVvHX0033BOXWxP4Bhk=,tag:hwWJuHYMdZd+OH2HJG3CIw==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4

values/badhouseplants/platform/minio/values.yaml

@@ -1,22 +1,3 @@
-# ------------------------------------------
-# -- Istio extenstion. Just because I'm
-# --  not using ingress nginx
-# ------------------------------------------
-istio:
-  enabled: true
-  istio:
-    - name: minio-http
-      gateway: istio-system/badhouseplants-net
-      kind: http
-      hostname: minio.badhouseplants.net
-      service: minio-console
-      port: 9001
-    - name: s3-http
-      gateway: istio-system/badhouseplants-net
-      kind: http
-      hostname: s3.badhouseplants.net
-      service: minio
-      port: 9000
 ingress:
   enabled: true
   ingressClassName: ~
@@ -75,7 +56,7 @@ consoleService:
   port: '9001'
 resources:
   requests:
-    memory: 2Gi
+    memory: 1Gi
 buckets:
   - name: badhouseplants-net
     policy: download
@@ -119,6 +100,10 @@ buckets:
     policy: false
     purge: false
     versioning: false
+  - name: stalwart
+    policy: false
+    purge: false
+    versioning: false
 metrics:
   serviceMonitor:
     enabled: false
@@ -197,3 +182,10 @@ policies:
           - 'arn:aws:s3:::states/*'
         actions:
           - 's3:*'
+  - name: stalwart
+    statements:
+      - resources:
+          - 'arn:aws:s3:::stalwart'
+          - 'arn:aws:s3:::stalwart/*'
+        actions:
+          - 's3:*'

values/badhouseplants/platform/uptime-kuma/values.yaml

@@ -0,0 +1,20 @@
+ingress:
+  enabled: true
+  annotations:
+    kubernetes.io/ingress.class: traefik
+    kubernetes.io/tls-acme: "true"
+    kubernetes.io/ingress.allow-http: "false"
+    kubernetes.io/ingress.global-static-ip-name: ""
+    cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+    external-dns.alpha.kubernetes.io/ingress-hostname-source: defined-hosts-only
+  hosts:
+    - host: uptime.badhouseplants.net
+      paths:
+        - path: /
+          pathType: ImplementationSpecific
+
+  tls:
+    - secretName: uptime.badhouseplants.net
+      hosts:
+        - uptime.badhouseplants.net

values/badhouseplants/platform/zot/values.yaml

@@ -0,0 +1,27 @@
+image:
+  repository: ghcr.io/project-zot/zot
+  tag: v2.1.3-rc4
+ingress:
+  enabled: true
+  className: traefik
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web,websecure
+    kubernetes.io/tls-acme: "true"
+    kubernetes.io/ingress.allow-http: "false"
+    cert-manager.io/cluster-issuer: badhouseplants-issuer-http01
+  pathtype: Prefix
+  hosts:
+    - host: zot.badhouseplants.net
+      paths:
+        - path: /
+  tls:
+    - secretName: zot.badhouseplants.net
+      hosts:
+        - zot.badhouseplants.net
+service:
+  type: ClusterIP
+persistence: false
+pvc:
+  create: false
+mountConfig: true
+mountSecret: true

values/badhouseplants/registry/cluster-mirror/secrets.yaml

@@ -0,0 +1,22 @@
+authHeader: ENC[AES256_GCM,data:BWmu4bpFjlIDStIcWfpsgbm1hfxlvZAK9LabhXuAdArJzflc4VA+Dy5fJRAMu9Mv,iv:+rwtfnjJCZKPmdcUkTfklq19uSgavOKaySK/O/xd2PE=,tag:3yXa+0LbIqMDk6KLWAAN0Q==,type:str]
+_mirror_password: ENC[AES256_GCM,data:0aa6fqR3+0ZY5KhRKJa0SKBcBnF/KizHXTIm2NQB,iv:DUB8ItYbT+K31XLbWzi5909RPVn9DG9HRDU120VxbdY=,tag:DniRwku2rQX44ffMn4mU6Q==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsQ0U5L01iNFo5Y0t5SFo2
+            MXlwVDhQZ2R5QnVlUndmQ0x5L2ppU1h6aEVZCmhaUW1JY0RDMEM0T1JkZkk3TGVD
+            R0JjaEN0MGxVV1RIZUxkbjgzMTlTMmsKLS0tIFdDNW8xaWsxamFvUGRFaVZsVUV4
+            S3ZiYTJGOUFzZlNwSUZvNGtmSFNpczQK/npaHLqHSxMnCXNvDFw0eB9KfMJ7bWfV
+            ZuteeaXG+eZNX4l1ZY1pLNUv9kui4oXI8payp7sTZJI6WYZCQz6Oaw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-03-27T20:50:16Z"
+    mac: ENC[AES256_GCM,data:XtX4NUZ9PCdAFckdlygywFQ8vJRAszOjqPItr0MNRM0ndk/PkYYGzY0phMan7FgxY3Cz5XMJcv/MEogLedM+uH5vMbsOpRY49jpILMORL3Ni1tZFG5Px5NbfExGQmjFyefotRzCHlsUSTZEHlBIp4+FeBI41CgBbLw45rEoneL8=,iv:Ilk7TXqKSSV5WYnptLRaOk/lwwHHLesbSslOCarlVEA=,tag:vWXe+r3tHXoMtWYeJN9T0g==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4

values/badhouseplants/secrets.argocd.yaml

@@ -1,26 +0,0 @@
-configs:
-  cm:
-    dex.config: ENC[AES256_GCM,data:bSlWRFGEJG2minUCqhi822rrOd/oiYtiiH6+qN58W1ZgWED8Fk2v6BfH4oIircNOKi57SDl/LU9L6ZtjN4rE1WApRUrffdvfVEz9n6wSfz3IZAzr0X4QXqqybpsj0M02yJYYmu/BQn2HBI6mCuARZRo9XN14+qamF59fg+/uPYQ0ZYPemgU0xPaCKBt2YAPLZEJdxOi1lBTFSNnJ1bLSC5aaW3/C4RqRIwAlEn0EEoimiBXaVSiCvqEqgvtTFjq8PCu+zmZ9wy1Kw/BvfLDXIRNZzR3uV/8TnUy2+joU5wlYKHNUxehE/tIn9T1hOoFKKmBbVKHs6Wh8Nwo5iIy0x0EatZP/5KrgRZPc7ZF03ZlGjOKk6Ap5AvhWQgO9JFJ94dgCdmk9gzCuuHjiZh9qat7alkFBnEYsOrprEvLkpavxFj9om3pY61Qg/i9fk9gFtxoM7yTaxHTuIUsXpto+/ofviFPTm7dgrIMPbERJYaN7ETcrHglJPp/zizQkaKNspOcBCMkAnFCaVn257/an7iLhm7orcdDt7nVLGlCQyq4GBEdy5+x4JVIF9H27R2d9774TTHrFYWo68pDndrT5OCviZebuVqPj0W9LASkUcIwB2mPj6Gi3OBAuQLX48f5s9uGLfNh4UXdz4Rp6zKJJ0IImly7ut5yglrwFxDpXcLoku8/lyEeQlkOADP3+bBcpB36rBLm9gZ77CjHMNsu2zCNx3pMu6W2GAWJbv7FysAMASHfikhaCDx6oxlJdaGnYk8LJeWhSLERsP2qwkSEDr42A4YRsmsvkKohcZy4Ub3xQWE3dwTrc6vr8wJ8Sqj0cK8y7RaM79SulBJ8WExg6nzvZRfOcp8I=,iv:/xI16L5fvHC2IPAsEpg5QR4vz7Tnjlnl0C7cEDSSnek=,tag:5XLlpaauuQQuy3SrPdYZNw==,type:str]
-  credentialTemplates:
-    ssh-creds:
-      sshPrivateKey: ENC[AES256_GCM,data:iIxxWhxfKhcHoTOfECWhOP+725xbUWIlq+cIoehrxMBP6XfHvxZpN3tQegeH5geYlbYWy5/kvJ5aLWVPEtWy19GjwoGk0ozS5l3AufIroWm3W/zkD+bcCgG+4wKTI6YQq0KVQDYY2ZMyxFnKLPXWdKDJSIS0y0dQB8G9fQeANUvtozXAcMpLfoAPKEUpZQhY5e3vMut3lUDF12u3S0kWJJF8xTjTNjmR0IrLWILc8TH5EKTHrLGfFB8M+T3P8+zatIFE9w+RInp1t0yU+OHFWeu0WSt+tLOc+DBTQhdugKd62nnmRAav/O3DJqCVGe7/JP6ZwGdHw8f/zEf+FnDJq6I8LnHQl35KGYH8FftzA0uG5UCoXPkTz69HRa2gDsuY4YSuAoWkDIFIrf85hfC+pl//1McjIExkY2fW+t4FWWZSoCAGRzQymXetDh6KColRGNMk1LOjUXFTV+AHB8rm7ZQ4+mGw5IVdBLE/TcmmHOyQq9fHQaUZMvj/9/p2DIS39rQbRRplR9JJIA7OrlwZUZLuLxXshUjP3hB8TJHXdo1eJWEWB8XaCwOX8mI4xVa+tVC4GazHvpvhOxWAgBhG/Ba6eXSFY+bQz6tySg3WEESEZ+ihC20AjAn1kFKQz55vxI9/NLcUw++LmwV5f0f0Qk91HLkQR16/P6h8ce71P8knhDP5gDBVuPHM94NJ3TW9klzfhMFwNZXwtEqwiTUBSbYwzYs5AMwLhYjLDHrWodulmVFfhw6qCekDkMup/PPim/Khk/6yZPDW/Re4MNpRWsfM+AT5SomhRBf3VFI0PRyXaPHXNU62OwjCs6+Z0SBjdx357qt8q3G35eF1Ido79U5W7YtPN8V/lgNJxGCZsOgX6+Mgq1JIlrHkU//emgRXVQnAtQDr9SGf9NR4L4qwzGpdbhzYNlQ3756ycdjFZ+itaBP6vaq2Eszj6EzTODunMonFWCAyxlgeAMXpQAhlJVvu02cdipK6mkwC++nPqCknCnLEKJNHKEBlzcmJ7Bg09HiS4IXkXryEQ+BU0YLJWDIDTVFRG8tleATDJ6uFhBoryS52SVbfXPK88SGL1bAFdtvNXF4bsefQC3gI/pBKW4gS5EyCr11joocAsHX+CIe54K+UQdGF3cvIAjwbBRDjzW8+JTnZWdb0z5joWi2pQGpg9aB6XddBww5VJhRoiOOJrc+RKzg4WMwNDm1Th8QaTrAHpO+ILiDFXTviexk+Ggg9m0MpqKX25EHQVmjL68D03lyJ99xlU7Ee9Uvk5DeamPpdvuwWTSm6NUrJ1LeKt1Sw7wIAwbVan45G7yRahIH/+BJPm6byMAyB109jTJdfEqzNgowN4rJXd+1g7K6+jMCbgv0pA3aqHLbWZt0n1ZCA4BztwxuT3zvzXZnLpe0HJeauZls49YEGhvWpcxXDRNoZ5nXKZ94K0hbaLVzpx1mWp0lGxSTlGFyBQVhhAKF0MClVuyGVLRuuYCHcPdx521pK4qeEQo3gr6XTM4H3fkqhKsxsJVx43gjtj8bhEmlScHX839+D8rlVYQZwupSmSCYfnUnk9Izm5hcEGkpzemribmv/pD7Lqu72TbqpI7dj4GKFjfeG8gIwKlqHhBY64YBeYGVRjJrxYIQBkLswA5yrIeu9UZJMF4uc2s90sYye8jrI6FNV4C5EhD2HDUGOvjDwgIlV6RyDJCuPeuR6Qm6OO9NMby9Xi5xQdg/tGtkghTQzgRUGMW+bpurr1IplYpJfY8mQBz38ibvKp6Xjl7bTlc8IUanugG9HKETiXhNDDQVhhfZrsfwIwx6ejCNombMrMlV3k9ZSvKyvg/dpUQPxayKMolE11b2mA71dkNUVt0LjhjIO2PA1Das5PRAqu6QBevXSoBSb2A5VLok2BtqZo4kKhboL8vl2FcJO9lGB3ZuxQaNX7c30H4n57Ri/JgXG22L1IJMfAvw4e1HlLvop0sgoGkz0Ngz+U2VzPRMuUwPjKTUSN/tq4FpXvUCA5g/YmNhCnDH/LGTJsN26zEjqjYvALtTprmFqSN1I+8QM3ZA3ZaE+EcquhD4CNfcN1kvkz/4Yv+9sQym2fqbLGKzSSEXKVtnJnIlttfiDD/4wU3ARDqnzwWq+SJe3aEnnz05i13m5TGdQV1QQ3NwHIpk0leRIu9X9afvR/uInjkSNKhB00JWPhYzp7htnFo0uVvqHGBKRuK2KQOnANjaQweesoIHM+bj/v1ryr/i6Owf8D+Go5ESMPVTUD6xVTvdkE2gn+DN6mYZH3G2vIjbze5PNJ1GA11Mzhekh+1QxyBpbHPlDaaVzF+sEyCPdnvlAYZ4bycae2eIrToxmSv1EBTmBRJEq42RcC16xB9I+uxBFEJFM0A8lVOW/7J4qbMfyYb7+naptsNN3wgPg5E2iQI6kLLAy1cDtkbDLhczm4w9sz+4SRLcAt0jXMx8422BjxuuwEApyyVjTwtzL3p0z1fCNlBBfwOBlUfTR42Z04Q6XnQFmCUMaL9ZZQHHjVYlQTvY/61eLcADFxu77Y1pYh8NP6jJyuAynJmy6IRMMoYw1mhvZWxnqxgyvPZQ6a952yd24GArB8YRTcKM1d6cbVTvyOrHns+rNeviwqb2c1446/mdUvHurYfnxbc/NTzNTaKWnwRMcnPRkpqbH0XkIAooQLKgmTvDs4IdK89Ja5iHu408TMZUgNkXqCjJ7WsZQZ2I3ogZPdMCxpZdcRNhcS98Sf6BlF3zxbBtLSc5Jv5buXPYYOFGrDJa09LG6YEU4Sk1P62Sm1KtR8XgaKWbx+jXQSbgBKavGC8Wh1C0OHVlJzDirskjSs6Unr2lUpyp75IaGDaWin1we3J+kxfpFKZDBh147Bf9XoTXVvi/GtSMYGmv77r7kZHuNTriXlW+lrak6wnATo9+Bi4bT3B6KurTcEROM2RC+fnG8Az9eUOSg/SUtaV3swmN6g/9DfeYCZY06zpXpmDV1Ib3hexidrnu5FvQcUofr/FzwP+Md2KZ3rapDXcFxRGG1Pggf/N3bXpGkHJXkeAghWXn6UWObrssbcCEsTKBI9vnioP0a62tObwrLKJQMvEZDm6WDGcFmZIWmpHAXakpxdGiqqOe/NMJAneGZWTdLYFs5OUKiMVAf4UUCdM/j4W2i/h1uluqJvRlZxOsM1XK0tj3KMveWqVsJeT8MK6QESLVa7o03ZVvv92KBamNy/16N66U4imzo+23FKPJupPnaMuhYCt5nVK+2DerhtismXBrWKyIPpoAW/8L9KXPW/UzMuClDSZ7Uo2e5pZ3PTHH+EBpjbCQj1veIskTXog2KFbv0bgiXzX3oWrmlFh1D9pwg752V9ZSGOP/eZdQ/cxdOURhu+ZWPG7WgxyyX/ZVh1aZRaBRuw5FAsqhZtjhkqiWtUHznaBRgn55poux+GFkN7XxHxO7idum6ecPLF6xPNyqkvPm5lUNdfml6qP6tQfO0uQ==,iv:cswd5iTvERSH5JQUz6IT7U9+agzsS3PheG4Md71hSrY=,tag:QeBr865/eWBrZtcrE3QRYQ==,type:str]
-sops:
-  kms: []
-  gcp_kms: []
-  azure_kv: []
-  hc_vault: []
-  age:
-    - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
-      enc: |
-        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlOVJweE5UeUlhUkNId0w2
-        a1kwM1dsWjJtZUt1QmNTZmlJNHkxRHdwaFhjCnoySGZDYUVJdzNGYUNyRnRKOXIr
-        SktxNlNBbmRDRXdZTDFFRnRnSVpwNXcKLS0tIHJaOUwya0pqRlBRVFZvaERjQk5N
-        aWVQUFo3bDJpK1R6SEJpMVdmWks1dkkK50KPI/hji2aJ1CLYqtxU87oE2tsBcl+I
-        d+Vs4aKRjY/mpdO7NWhmeguH1boGhMaKpZlSV+TZGBtEsl7RQ6mbtQ==
-        -----END AGE ENCRYPTED FILE-----
-  lastmodified: "2024-10-14T08:08:21Z"
-  mac: ENC[AES256_GCM,data:pRtlf2AnmG9ztZyXwbxR2foagCMBX8BwfhLrsoLeEpSyFLbNMKIGKMSZKaJ3r9IU7gErXh4KoUGXcg31LB80B1G+YFlICvxmlXX0MB3MmedzTi6I6N7ydFse11n3WF/XaRUhpZVE9sCyZgNxgyuhf0LTnS0FU7tauVgAERAazYE=,iv:zwojdj+/HIglNNdS/lYokVqiAvH0pTZIk5jK20oiA7c=,tag:rRi0uEIP8ag/45cv8/4FYg==,type:str]
-  pgp: []
-  unencrypted_suffix: _unencrypted
-  version: 3.9.1

values/badhouseplants/secrets.authentik.yaml

@@ -1,24 +0,0 @@
-authentik:
-  email:
-    password: ENC[AES256_GCM,data:OtaK90UmvOkSjHYe/37W5aSlZo0=,iv:WQR0YIz4U5QIxc7YSQ2JZRLnA3ZF0JouZtnggTW674g=,tag:Us163wc95RbiN8XdXogt3g==,type:str]
-  secret_key: ENC[AES256_GCM,data:/6gM3ZUb6mIYaJO2CyCuVxLFOxdogTMbKb4c3HYXpvxZIqoFt0t9fHY+XU/mC0OGue4=,iv:TfGI7jXixrI/YBp++AFHz+rCliuo6zhbgXeMviw7rHY=,tag:G52eT7OlxDub1pL27LWHKw==,type:str]
-sops:
-  kms: []
-  gcp_kms: []
-  azure_kv: []
-  hc_vault: []
-  age:
-    - recipient: age1vzkv97n2p7gfkw8dyx8ctz2kumattz89th2jq47zyjyrarmnssysdkw9v8
-      enc: |
-        -----BEGIN AGE ENCRYPTED FILE-----
-        YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwNG9RVzltVnZraWNnTW1q
-        aUIvWDNWcEovWC9yWU5OdmxjamFyREgwSFhvCjNwM3FLNmZUV0tHK25tNDRsNGpn
-        UTZDUFIrVmQyRUNZa3d4R2NpbFZqM2cKLS0tIFVoMnBtSUNRd1VHVmx2RXVvdDN2
-        UzFDZDRJRzV6cUVpY0NNWmR5aU9qRlkK6dudxILhTOjvNi2Pwo5jg13GqRG52igd
-        3yXhaIzRp+fcgAXMlTTTwe2jBNRYCv84+wLvV2NkfHyPeE0t9Wh/ow==
-        -----END AGE ENCRYPTED FILE-----
-  lastmodified: "2024-10-14T08:08:22Z"
-  mac: ENC[AES256_GCM,data:qHD7CYM7sFBiJtGADcFeBHSFlmvEZaEVRGXTr02Tk+uLGWn9lP5CuOX1sU4x3Gd8nilwZy0fRAL523HDLvYQBPwsi26Vbp6OgZ9shjp5CvrQMUTg1qRCfjWAw66Y5NHHUJrrYc0sOPlTWXxRyU1Xk9aMvtRQi1ooum9wF3vhuoA=,iv:ADzHjgi72Ureve1CxQhkySvLZ07//Q1oBMKpvgXfNy4=,tag:RAIEupIsOviKYlQJO/rgsg==,type:str]
-  pgp: []
-  unencrypted_suffix: _unencrypted
-  version: 3.9.1