feat(container)!: Update image docker.io/cloudflare/cloudflared to v2025

feat(github-action): update image ghcr.io/renovatebot/renovate to v39.251.0
feat(github-action): update image ghcr.io/renovatebot/renovate to v39.240.1
2025-04-19 00:02:29 +00:00 · 2025-04-19 00:01:12 +00:00 · 2025-04-13 00:01:01 +00:00 · 2025-04-12 00:01:04 +00:00 · 2025-04-06 00:01:17 +00:00 · 2025-04-05 00:01:23 +00:00
257 changed files with 6514 additions and 98 deletions
@@ -0,0 +1,8 @@
+module.exports = {
+  "endpoint": "http://192.168.1.68:3001/api/v1", // replace it with your actual endpoint
+  "gitAuthor": "Renovate Bot <renovate-bot@yourhost.com>",
+  "platform": "gitea",
+  "onboardingConfigFileName": "renovate.json5",
+  "autodiscover": true,
+  "optimizeForDisabled": true,
+};
@@ -16,7 +16,7 @@ bootstrap_node_inventory:
    controller: false
    disk: fake
    mac_addr: fake
-bootstrap_dns_servers: ["1.1.1.1", "1.0.0.1"]
+bootstrap_dns_servers: ["192.168.1.2"]
 bootstrap_ntp_servers: ["time.cloudflare.com"]
 bootstrap_pod_network: 10.69.0.0/16
 bootstrap_service_network: 10.96.0.0/16
@@ -35,7 +35,7 @@ jobs:
          path: default

      - name: Diff Resources
-        uses: docker://ghcr.io/allenporter/flux-local:v6.0.0
+        uses: docker://ghcr.io/allenporter/flux-local:v6.1.1
        with:
          args: >-
            diff ${{ matrix.resources }}
@@ -0,0 +1,20 @@
+name: renovate
+
+on:
+  schedule:
+    - cron: "@daily"
+  push:
+    branches:
+      - main
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    container: ghcr.io/renovatebot/renovate:39.251.0
+    steps:
+      - uses: actions/checkout@v4
+      - run: renovate
+        env:
+          RENOVATE_CONFIG_FILE: "/workspace/infra/home-cluster/.github/renovate_config.js" # replace it with your config.js path
+          LOG_LEVEL: "debug"
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }} # your Revonate bot token
@@ -0,0 +1,12 @@
+---
+creation_rules:
+  - # IMPORTANT: This rule MUST be above the others
+    path_regex: talos/.*\.sops\.ya?ml
+    key_groups:
+      - age:
+          - "age1mhnje42sefcfpvgpeppch84g6vgptmd4gukgvr3gueuxy6ph05xqx45jty"
+  - path_regex: kubernetes/.*\.sops\.ya?ml
+    encrypted_regex: "^(data|stringData)$"
+    key_groups:
+      - age:
+          - "age1mhnje42sefcfpvgpeppch84g6vgptmd4gukgvr3gueuxy6ph05xqx45jty"
@@ -5,6 +5,7 @@ version: '3'
 vars:
  TALHELPER_CLUSTER_DIR: '{{.KUBERNETES_DIR}}/bootstrap/talos/clusterconfig'
  TALHELPER_CONFIG_FILE: '{{.KUBERNETES_DIR}}/bootstrap/talos/talconfig.yaml'
+  TALHELPER_SECRET_FILE: '{{.KUBERNETES_DIR}}/bootstrap/talos/talsecret.sops.yaml'
  TALOSCONFIG: '{{.TALHELPER_CLUSTER_DIR}}/talosconfig'

 env:
@@ -12,11 +13,24 @@ env:

 tasks:

+  generate-config:
+    desc: Generate Talos configuration
+    cmd: talhelper genconfig --config-file {{.TALHELPER_CONFIG_FILE}} --secret-file {{.TALHELPER_SECRET_FILE}} --out-dir {{.TALHELPER_CLUSTER_DIR}}
+    preconditions:
+      - msg: Missing talhelper config file
+        sh: test -f {{.TALHELPER_CONFIG_FILE}}
+      - msg: Missing Sops config file
+        sh: test -f {{.SOPS_CONFIG_FILE}}
+      - msg: Missing Sops Age key file
+        sh: test -f {{.SOPS_AGE_KEY_FILE}}
+
  apply-config:
    desc: Apply Talos configuration to a node
-    cmd: talosctl apply-config --mode={{.MODE}} --nodes {{.HOSTNAME}} --file {{.TALHELPER_CLUSTER_DIR}}/{{.CLUSTER_NAME}}-{{.HOSTNAME}}.yaml
+    cmds:
+      - talosctl --nodes {{.HOSTNAME}} apply-config --mode=staged --file {{.TALHELPER_CLUSTER_DIR}}/{{.CLUSTER_NAME}}-{{.HOSTNAME}}.yaml
+      - talosctl --nodes {{.HOSTNAME}} reboot
+      - talosctl --nodes {{.HOSTNAME}} health --wait-timeout=10m --server=false
    vars:
-      MODE: '{{.MODE | default "no-reboot"}}'
      CLUSTER_NAME:
        sh: yq '.clusterName' {{.TALHELPER_CONFIG_FILE}}
    requires:
@@ -71,8 +85,7 @@ tasks:

  upgrade-k8s:
    desc: Upgrade Kubernetes
-    cmds:
-      - talosctl --nodes {{.KUBERNETES_CONTROLLER}} upgrade-k8s --to {{.KUBERNETES_VERSION}}
+    cmd: talosctl --nodes {{.KUBERNETES_CONTROLLER}} upgrade-k8s --to {{.KUBERNETES_VERSION}}
    vars:
      KUBERNETES_CONTROLLER:
        sh: talosctl config info --output json | jq --raw-output '.endpoints[]' | shuf -n 1
@@ -10,7 +10,7 @@ jq
 kubeconform
 kubectl-bin
 kustomize
-minijinja
+minijinja-cli-bin
 moreutils
 sops
 stern-bin
@@ -70,6 +70,7 @@ tasks:
      - cmd: curl -sSfL https://github.com/mitsuhiko/minijinja/releases/latest/download/minijinja-cli-installer.sh | bash
    env:
      MINIJINJA_CLI_INSTALL_DIR: '.'
+      MINIJINJA_CLI_UNMANAGED_INSTALL: 'true'
      HELM_INSTALL_DIR: '.'
      USE_SUDO: 'false'

@@ -288,6 +288,42 @@ There might be a situation where you want to destroy your Kubernetes cluster. Th
 task talos:reset # --force
 ```

+## 🛠️ Talos and Kubernetes Maintenance
+
+#### ⚙️ Updating Talos node configuration
+
+📍 _Ensure you have updated `talconfig.yaml` and any patches with your updated configuration._
+
+```sh
+# (Re)generate the Talos config
+task talos:generate-config
+# Apply the config to the node
+task talos:apply-config HOSTNAME=? MODE=?
+# e.g. task talos:apply-config HOSTNAME=k8s-0 MODE=reboot
+```
+
+#### ⬆️ Updating Talos and Kubernetes versions
+
+📍 _Ensure the `talosVersion` and `kubernetesVersion` in `talhelper.yaml` are up-to-date with the version you wish to upgrade to._
+
+```sh
+# Upgrade the whole cluster to a newer Talos version
+task talos:upgrade-cluster
+# e.g. task talos:upgrade-cluster
+```
+
+```sh
+# Upgrade node to a newer Talos version
+task talos:upgrade-node HOSTNAME=?
+# e.g. task talos:upgrade HOSTNAME=k8s-0
+```
+
+```sh
+# Upgrade cluster to a newer Kubernetes version
+task talos:upgrade-k8s
+# e.g. task talos:upgrade-k8s
+```
+
 ## 🤖 Renovate

 [Renovate](https://www.mend.io/renovate) is a tool that automates dependency management. It is designed to scan your repository around the clock and open PRs for out-of-date dependencies it finds. Common dependencies it can discover are Helm charts, container images, GitHub Actions, Ansible roles... even Flux itself! Merging a PR will cause Flux to apply the update to your cluster.
@@ -342,28 +378,6 @@ Below is a general guide on trying to debug an issue with an resource or applica

 Resolving problems that you have could take some tweaking of your YAML manifests in order to get things working, other times it could be a external factor like permissions on NFS. If you are unable to figure out your problem see the help section below.

-## ⬆️ Upgrading Talos and Kubernetes
-
-📍 _Ensure the `talosVersion` and `kubernetesVersion` in `talhelper.yaml` are up-to-date with the version you wish to upgrade to._
-
-```sh
-# Upgrade the whole cluster to a newer Talos version
-task talos:upgrade-cluster
-# e.g. task talos:upgrade-cluster
-```
-
-```sh
-# Upgrade node to a newer Talos version
-task talos:upgrade-node HOSTNAME=?
-# e.g. task talos:upgrade HOSTNAME=k8s-0
-```
-
-```sh
-# Upgrade cluster to a newer Kubernetes version
-task talos:upgrade-k8s
-# e.g. task talos:upgrade-k8s
-```
-
 ## 👉 Help

 - Make a post in this repository's Github [Discussions](https://github.com/onedr0p/cluster-template/discussions).
@@ -377,6 +391,10 @@ The cluster is your oyster (or something like that). Below are some optional con

 To browse or get ideas on applications people are running, community member [@whazor](https://github.com/whazor) created [Kubesearch](https://kubesearch.dev) as a creative way to search Flux HelmReleases across Github and Gitlab.

+### DNS
+
+Instead of using [k8s_gateway](https://github.com/ori-edge/k8s_gateway) to provide DNS for your applications you might want to check out [external-dns](https://github.com/kubernetes-sigs/external-dns), it has wide support for many different providers such as [Pi-hole](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/pihole.md), [UniFi](https://github.com/kashalls/external-dns-unifi-webhook), [Adguard Home](https://github.com/muhlba91/external-dns-provider-adguard), [Bind](https://github.com/kubernetes-sigs/external-dns/blob/master/docs/tutorials/rfc2136.md) and more.
+
 ### Storage

 The included CSI (openebs in local-hostpath mode) is a great start for storage but soon you might find you need more features like replicated block storage, or to connect to a NFS/SMB/iSCSI server. If you need any of those features be sure to check out the projects like [rook-ceph](https://github.com/rook/rook), [longhorn](https://github.com/longhorn/longhorn), [openebs](https://github.com/openebs/openebs), [democratic-csi](https://github.com/democratic-csi/democratic-csi), [csi-driver-nfs](https://github.com/kubernetes-csi/csi-driver-nfs),
@@ -12,7 +12,7 @@ cgroup:
  hostRoot: /sys/fs/cgroup
 cluster:
  id: 1
-  name: "#{ bootstrap_cluster_name|default('home-kubernetes', true) }#"
+  name: "#{ bootstrap_cluster_name | default('home-kubernetes', true) }#"
 cni:
  exclusive: false
 # NOTE: devices might need to be set if you have more than one active NIC on your hosts
@@ -43,7 +43,7 @@ l2announcements:
  #% endif %#
 loadBalancer:
  algorithm: maglev
-  mode: "#{ bootstrap_loadbalancer_mode|default('dsr', true) }#"
+  mode: "#{ bootstrap_loadbalancer_mode | default('dsr', true) }#"
 localRedirectPolicy: true
 operator:
  replicas: 1
@@ -16,7 +16,7 @@ spec:
        #% for item in bootstrap_bgp.peers %#
        - peerAddress: "#{ item }#/32"
          peerASN: #{ bootstrap_bgp.peer_asn }#
-          peerPort: #{ bootstrap_bgp.peer_port | default(179) }#
+          peerPort: #{ bootstrap_bgp.peer_port | default(179, true) }#
        #% endfor %#
        #% else %#
        #% if bootstrap_node_default_gateway %#
@@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: coredns
-      version: 1.36.0
+      version: 1.36.1
      sourceRef:
        kind: HelmRepository
        name: coredns
@@ -30,7 +30,7 @@ spec:
          app:
            image:
              repository: docker.io/cloudflare/cloudflared
-              tag: 2024.10.1
+              tag: 2025.4.0
            env:
              NO_AUTOUPDATE: true
              TUNNEL_CRED_FILE: /etc/cloudflared/creds/credentials.json
@@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: ingress-nginx
-      version: 4.11.2
+      version: 4.11.3
      sourceRef:
        kind: HelmRepository
        name: ingress-nginx
@@ -9,7 +9,7 @@ spec:
  chart:
    spec:
      chart: ingress-nginx
-      version: 4.11.2
+      version: 4.11.3
      sourceRef:
        kind: HelmRepository
        name: ingress-nginx
@@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: prometheus-operator-crds
-      version: 15.0.0
+      version: 16.0.0
      sourceRef:
        kind: HelmRepository
        name: prometheus-community
@@ -14,4 +14,7 @@ stringData:
    github.com ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOMqqnkVzrm0SdG6UOoqKLsabgH5C9okWi0dh2l9GKJl
    github.com ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBEmKSENjQEezOmxkZMy7opKgwFB9nkt5YRrYMjNuG5N87uRgg6CLrbo5wAdT/y6v0mKV0U2w0WZ2YB/++Tpockg=
    github.com ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABgQCj7ndNxQowgcQnjshcLrqPEiiphnt+VTTvDP6mHBL9j1aNUkY4Ue1gvwnGLVlOhGeYrnZaMgRK6+PKCUXaDbC7qtbW8gIkhL7aGCsOr/C56SJMy/BCZfxd1nWzAOxSDPgVsmerOBYfNqltV9/hWCqBywINIR+5dIg6JTJ72pcEpEjcYgXkE2YEFXV1JHnsKgbLWNlhScqb2UmyRkQyytRLtL+38TGxkxCflmO+5Z8CSSNY7GidjMIZ7Q4zMjA2n1nGrlTDkzwDCsw+wqFPGQA179cnfGWOWRVruj16z6XyvxvjJwbz0wQZ75XK5tKSb7FNyeIEs4TT4jk+S4dhPeAUC5y+bDYirYgM4GC7uEnztnZyaVWQ7B381AK4Qdrwt51ZqExKbQpTUNn+EjqoTwvqNj4kqx5QUCI0ThS/YkOxJCXmPUWZbhjpCg56i+2aB6CmK2JGhn57K5mj0MNdBXA4/WnwH6XoPWJzK5Nyu2zB3nAZp+S5hpQs+p1vN1/wsjk=
+    [repo.home.arpa]:222 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIKYHMrcJFqIYYSLNg9RrMrZmpqzyTrr2sD/ti4HMBCh
+    [192.168.1.68]:222 ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIKYHMrcJFqIYYSLNg9RrMrZmpqzyTrr2sD/ti4HMBCh
+
 #% endif %#
@@ -18,7 +18,7 @@ releases:
  - name: prometheus-operator-crds
    namespace: observability
    chart: oci://ghcr.io/prometheus-community/charts/prometheus-operator-crds
-    version: 15.0.0
+    version: 16.0.0
  - name: cilium
    namespace: kube-system
    chart: cilium/cilium
@@ -30,7 +30,7 @@ releases:
  - name: coredns
    namespace: kube-system
    chart: coredns/coredns
-    version: 1.36.0
+    version: 1.36.1
    values:
      - ../apps/kube-system/coredns/app/helm-values.yaml
    needs:
@@ -10,3 +10,16 @@ cluster:
  scheduler:
    extraArgs:
      bind-address: 0.0.0.0
+    config:
+      apiVersion: kubescheduler.config.k8s.io/v1
+      kind: KubeSchedulerConfiguration
+      profiles:
+        - schedulerName: default-scheduler
+          pluginConfig:
+            - name: PodTopologySpread
+              args:
+                defaultingType: List
+                defaultConstraints:
+                  - maxSkew: 1
+                    topologyKey: kubernetes.io/hostname
+                    whenUnsatisfiable: ScheduleAnyway
@@ -0,0 +1,6 @@
+machine:
+  network:
+    nameservers:
+      #% for item in bootstrap_dns_servers | default(["1.1.1.1","1.0.0.1"], true) %#
+      - #{ item }#
+      #% endfor %#
@@ -0,0 +1,7 @@
+machine:
+  time:
+    disabled: false
+    servers:
+      #% for item in bootstrap_ntp_servers | default(["time.cloudflare.com"], true) %#
+      - #{ item }#
+      #% endfor %#
@@ -1,7 +1,6 @@
 machine:
  sysctls:
-    fs.inotify.max_queued_events: "65536"
-    fs.inotify.max_user_watches: "524288"
+    fs.inotify.max_user_watches: "1048576"
    fs.inotify.max_user_instances: "8192"
    net.core.rmem_max: "7500000"
    net.core.wmem_max: "7500000"
@@ -1,7 +1,7 @@
 # yaml-language-server: $schema=https://raw.githubusercontent.com/budimanjojo/talhelper/master/pkg/config/schemas/talconfig.json
 ---
 # renovate: datasource=docker depName=ghcr.io/siderolabs/installer
-talosVersion: v1.8.1
+talosVersion: v1.8.3
 # renovate: datasource=docker depName=ghcr.io/siderolabs/kubelet
 kubernetesVersion: v1.31.2

@@ -36,9 +36,9 @@ nodes:
    #% if bootstrap_secureboot.enabled %#
    machineSpec:
      secureboot: true
-    talosImageURL: factory.talos.dev/installer-secureboot/#{ item.schematic_id | default(bootstrap_schematic_id) }#
+    talosImageURL: factory.talos.dev/installer-secureboot/#{ item.schematic_id | default(bootstrap_schematic_id, true) }#
    #% else %#
-    talosImageURL: factory.talos.dev/installer/#{ item.schematic_id | default(bootstrap_schematic_id) }#
+    talosImageURL: factory.talos.dev/installer/#{ item.schematic_id | default(bootstrap_schematic_id, true) }#
    #% endif %#
    controlPlane: #{ (item.controller) | string | lower }#
    networkInterfaces:
@@ -49,7 +49,7 @@ nodes:
          - vlanId: #{ bootstrap_vlan }#
            addresses:
              - "#{ item.address }#/#{ bootstrap_node_network.split('/') | last }#"
-            mtu: #{ item.mtu | default(1500) }#
+            mtu: #{ item.mtu | default(1500, true) }#
            routes:
              - network: 0.0.0.0/0
                #% if bootstrap_node_default_gateway %#
@@ -62,7 +62,6 @@ nodes:
              ip: "#{ bootstrap_controller_vip }#"
            #% endif %#
        #% else %#
-        #% if item.address %#
        dhcp: false
        addresses:
          - "#{ item.address }#/#{ bootstrap_node_network.split('/') | last }#"
@@ -73,10 +72,7 @@ nodes:
            #% else %#
            gateway: "#{ bootstrap_node_network | nthhost(1) }#"
            #% endif %#
-        #% else %#
-        dhcp: true
-        #% endif %#
-        mtu: #{ item.mtu | default(1500) }#
+        mtu: #{ item.mtu | default(1500, true) }#
        #% if item.controller %#
        vip:
          ip: "#{ bootstrap_controller_vip }#"
@@ -116,27 +112,6 @@ nodes:

 # Global patches
 patches:
-  #% if bootstrap_dns_servers | length %#
-  - # Force nameserver
-    |-
-    machine:
-      network:
-        nameservers:
-          #% for item in bootstrap_dns_servers %#
-          - #{ item }#
-          #% endfor %#
-  #% endif %#
-  #% if bootstrap_ntp_servers | length %#
-  - # Configure NTP
-    |-
-    machine:
-      time:
-        disabled: false
-        servers:
-          #% for item in bootstrap_ntp_servers %#
-          - #{ item }#
-          #% endfor %#
-  #% endif %#
  #% if bootstrap_secureboot.enabled and bootstrap_secureboot.encrypt_disk_with_tpm %#
  - # Encrypt system disk with TPM
    |-
@@ -12,7 +12,7 @@ spec:
    name: github-deploy-key
  #% endif %#
  ref:
-    branch: "#{ bootstrap_github_branch|default('main', true) }#"
+    branch: "#{ bootstrap_github_branch | default('main', true) }#"
  ignore: |
    # exclude all
    /*
@@ -5,7 +5,7 @@
 #

 # (Optional) Cluster name; affects Cilium and Talos
-#   Default is "home-kubernetes"
+#   DEFAULT: "home-kubernetes"
 bootstrap_cluster_name: ""

 # (Required) Generated schematic id from https://factory.talos.dev/
@@ -18,12 +18,12 @@ bootstrap_node_network: ""
 #   Worker nodes are optional
 bootstrap_node_inventory: []
    # - name: ""            # (Required) Name of the node (must match [a-z0-9-\]+)
-    #   address: ""         # (Optional) IP address of the node (Remove if node has a static DHCP reservation)
+    #   address: ""         # (Optional) IP address of the node
    #   controller: true    # (Required) Set to true if this is a controller node
    #   disk: ""            # (Required) Device path or serial number of the disk for this node (talosctl disks -n <ip> --insecure)
    #   mac_addr: ""        # (Required) MAC address of the NIC for this node (talosctl get links -n <ip> --insecure)
    #   schematic_id: ""    # (Optional) Override the 'bootstrap_schematic_id' with a node specific schematic ID from https://factory.talos.dev/
-    #   mtu: ""             # (Optional) MTU for the NIC, default is 1500
+    #   mtu: ""             # (Optional) MTU for the NIC. DEFAULT: 1500
    #   manifests:          # (Optional) Additional manifests to include after MachineConfig
    #     - extra.yaml      #            Ref: https://www.talos.dev/v1.7/reference/configuration/extensions/extensionserviceconfig/
    #   extension_services: # (Optional) Additional talhelper ExtensionServices (supports talenv.sops.yaml envsubst)
@@ -36,18 +36,15 @@ bootstrap_node_inventory: []
    #         - key=value
    # ...

-# (Optional) The DNS servers to use for the cluster nodes.
-#   Default is pulled from your DHCP server.
+# The DNS servers to use for the cluster nodes.
+#   DEFAULT: [1.1.1.1, 1.0.0.1]
 # If using a local DNS server make sure it meets the following requirements:
 #   1. your nodes can reach it
 #   2. it is configured to forward requests to a public DNS server
-#   3. you are not force redirecting DNS requests to it - this will break cert generation over DNS01
-# If using multiple DNS servers make sure they are setup the same way, there is no
-#   guarantee that the first DNS server will always be used for every lookup.
 bootstrap_dns_servers: []

-# (Optional) The NTP servers to use for the cluster nodes.
-#   Default is pulled from your DHCP server.
+# The NTP servers to use for the cluster nodes.
+#   DEFAULT: [time.cloudflare.com]
 bootstrap_ntp_servers: []

 # (Required) The pod CIDR for the cluster, this must NOT overlap with any
@@ -71,7 +68,7 @@ bootstrap_controller_vip: ""
 bootstrap_tls_sans: []

 # (Optional) The default gateway for the nodes
-#   Default is derrived from bootstrap_node_network (e.g. 192.168.1.1)
+#   DEFAULT: .1 derrived from bootstrap_node_network (e.g. 192.168.1.1)
 bootstrap_node_default_gateway: ""

 # (Optional) Add vlan tag to network master device, leave blank if you tag ports on your switch instead
@@ -90,13 +87,13 @@ bootstrap_age_pubkey: ""
 bootstrap_bgp:
  enabled: false
  # (Optional) If using multiple BGP peers add them here.
-  #   Default is .1 derrived from host_network: ['x.x.x.1']
+  #   DEFAULT: .1 derrived from host_network: ['x.x.x.1']
  peers: []
  # (Required) Set the BGP Autonomous System Number for the router(s) and nodes.
  #   If these match, iBGP will be used. If not, eBGP will be used.
  peer_asn: ""   # Router(s) AS
  local_asn: ""  # Node(s) AS
-  peer_port: 179 # BGP Port - default is TCP port 179
+  peer_port: 179 # BGP Port. DEFAULT: 179
  # (Required) The advertised CIDR for the cluster, this must NOT overlap with any
  #   existing networks and is usually a /16 (64K IPs).
  # If you want to use IPv6 check the advanced flags below
@@ -112,7 +109,7 @@ bootstrap_secureboot:
  encrypt_disk_with_tpm: false

 # (Optional) Change Cilium load balancer mode
-#  Default is "dsr" (Direct Server Return)
+#  DEFAULT: "dsr"
 #  Ref: https://docs.cilium.io/en/stable/network/kubernetes/kubeproxy-free/
 bootstrap_loadbalancer_mode: ""

@@ -0,0 +1,108 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app capacitor
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    controllers:
+      capacitor:
+        replicas: 1
+        pod:
+          securityContext:
+            fsGroup: 999
+            # runAsGroup: 3000
+            # runAsNonRoot: true
+            # runAsUser: 1000
+            # seccompProfile:
+            #   type: RuntimeDefault
+        containers:
+          app:
+            env:
+              TZ: ${SETTING_TZ}
+
+            image:
+              repository: ghcr.io/gimlet-io/capacitor
+              tag: v0.4.8@sha256:a80207f52c054dba9e04e8b1ea86e297817ecf05ddbfce249c1f5eaf6ce8c7d8
+            securityContext:
+              runAsNonRoot: true
+              runAsUser: 100
+              runAsGroup: 101
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities:
+                drop:
+                  - ALL
+              seccompProfile:
+                type: RuntimeDefault
+
+            probes:
+              startup:
+                enabled: false
+              liveness: &probe
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /
+                    port: &port 9000
+                    scheme: HTTP
+                  initialDelaySeconds: 0
+                  periodSeconds: 10
+                  timeoutSeconds: 1
+                  failureThreshold: 3
+              readiness: *probe
+
+            resources:
+              requests:
+                cpu: 190m
+                memory: 127Mi
+              limits:
+                memory: 127Mi
+
+    serviceAccount:
+      create: false
+      name: capacitor
+
+    service:
+      app:
+        controller: capacitor
+        ports:
+          http:
+            enabled: true
+            port: *port
+            protocol: HTTP
+
+    ingress:
+      app:
+        enabled: true
+        className: internal
+        hosts:
+          - host: &host "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - hosts:
+              - *host
+            secretName: "{{ .Release.Name }}-tls"
@@ -0,0 +1,7 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
+  - ./rbac.yaml
@@ -0,0 +1,60 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: capacitor
+  namespace: flux-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: capacitor
+rules:
+- apiGroups:
+    - networking.k8s.io
+    - apps
+    - ""
+  resources:
+    - pods
+    - pods/log
+    - ingresses
+    - deployments
+    - services
+    - secrets
+    - events
+    - configmaps
+  verbs:
+    - get
+    - watch
+    - list
+- apiGroups:
+    - source.toolkit.fluxcd.io
+    - kustomize.toolkit.fluxcd.io
+    - helm.toolkit.fluxcd.io
+    - infra.contrib.fluxcd.io
+  resources:
+    - gitrepositories
+    - ocirepositories
+    - buckets
+    - helmrepositories
+    - helmcharts
+    - kustomizations
+    - helmreleases
+    - terraforms
+  verbs:
+    - get
+    - watch
+    - list
+    - patch # to allow force reconciling by adding an annotation
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: capacitor
+subjects:
+  - kind: ServiceAccount
+    name: capacitor
+    namespace: flux-system
+roleRef:
+  kind: ClusterRole
+  name: capacitor
+  apiGroup: rbac.authorization.k8s.io
@@ -0,0 +1,19 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app capacitor
+  namespace: flux-system
+spec:
+  targetNamespace: flux-system
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/capacitor/capacitor/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  timeout: 5m
@@ -0,0 +1,7 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./namespace.yaml
+  - ./capacitor/ks.yaml
@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: capacitor
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled
@@ -0,0 +1,31 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cert-manager
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: cert-manager
+      version: v1.16.1
+      sourceRef:
+        kind: HelmRepository
+        name: jetstack
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  values:
+    crds:
+      enabled: true
+    dns01RecursiveNameservers: https://1.1.1.1:443/dns-query,https://1.0.0.1:443/dns-query
+    dns01RecursiveNameserversOnly: true
+    prometheus:
+      enabled: true
+      servicemonitor:
+        enabled: true
@@ -0,0 +1,5 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
@@ -0,0 +1,39 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-production
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    email: "${SECRET_ACME_EMAIL}"
+    privateKeySecretRef:
+      name: letsencrypt-production
+    solvers:
+      - dns01:
+          cloudflare:
+            apiTokenSecretRef:
+              name: cert-manager-secret
+              key: api-token
+        selector:
+          dnsZones:
+            - "${SECRET_DOMAIN}"
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging
+spec:
+  acme:
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    email: "${SECRET_ACME_EMAIL}"
+    privateKeySecretRef:
+      name: letsencrypt-staging
+    solvers:
+      - dns01:
+          cloudflare:
+            apiTokenSecretRef:
+              name: cert-manager-secret
+              key: api-token
+        selector:
+          dnsZones:
+            - "${SECRET_DOMAIN}"
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./secret.sops.yaml
+  - ./issuers.yaml
@@ -0,0 +1,26 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: cert-manager-secret
+stringData:
+    api-token: ENC[AES256_GCM,data:hxn4WpbqH9oZg4ZyW4ZHoCZFfC7pPgh6NizlDz2UTSjDlZF33vmvWw==,iv:5u1KHt6DGnyQgTIpWLFcU0V0o4xXNLatETs/uELfIbU=,tag:1bb8uJsW2Tdmzsk/vnQ74A==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1mhnje42sefcfpvgpeppch84g6vgptmd4gukgvr3gueuxy6ph05xqx45jty
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQZFdoWnFuWDZQZzBwWGM5
+            VWpoUzlwMTF0MDJsNzJHUE12T2NwQ0JqUTJBClFySXcvTERTNVVRWW5qZFFES292
+            OUVkZnJGNW1oeVhRTWtzNk1IT0xoYWcKLS0tIHAxR2lqeEJydGdFR2RaY3Fmd212
+            dURIUWdKbnNEK3N4MDZSVTdJcnQwM1EKZuzgUjc0EUhwLNb9Aq/08Kq2SJZpcy5k
+            +QlOf/OzjQ8fZinQ7YStN1FrouBoD6eOvrQ9LKmd49den+9JQw3uAg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-11-07T06:29:43Z"
+    mac: ENC[AES256_GCM,data:KGoF46Eh22sDxQlLqaU1cNguMWSx71BpmdClVZX/cPMZWsIZHqh32CsfH7hNFMJIUSZiaI+UarKFbmhWd4P9wSMcqzj/zmSJ3DGtd722oToT6kUE3dJhmIk+f8gJd4STXjeQ1NM1UmxwasEJZ0fnSW4+NLwTURLpi8fvNXOlUic=,iv:jO0aMeYCSWthERI181XyS+2VDXxTUKdq2rV6rlTwjXc=,tag:K0J9mTIBayDiLB5QTPa2ig==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.1
@@ -0,0 +1,62 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app cert-manager
+  namespace: flux-system
+spec:
+  targetNamespace: cert-manager
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/cert-manager/cert-manager/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  timeout: 5m
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app cert-manager-issuers
+  namespace: flux-system
+spec:
+  targetNamespace: cert-manager
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: cert-manager
+  path: ./kubernetes/apps/cert-manager/cert-manager/issuers
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  timeout: 5m
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app self-signed-issuers
+  namespace: flux-system
+spec:
+  targetNamespace: cert-manager
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: cert-manager-issuers
+  path: ./kubernetes/apps/cert-manager/cert-manager/selfsigned
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
@@ -0,0 +1,32 @@
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: selfsigned-issuer
+spec:
+  selfSigned: {}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: home-selfsigned-ca
+  namespace: cert-manager
+spec:
+  isCA: true
+  commonName: home-selfsigned-ca
+  secretName: root-secret
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+  issuerRef:
+    name: selfsigned-issuer
+    kind: ClusterIssuer
+    group: cert-manager.io
+---
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: home-ca-issuer
+spec:
+  ca:
+    secretName: root-secret
@@ -0,0 +1,6 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./clusterissuer.yaml
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./namespace.yaml
+  - ./cert-manager/ks.yaml
@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cert-manager
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled
@@ -0,0 +1,32 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cloudnative-pg
+spec:
+  interval: 30m
+  chart:
+    spec:
+      # renovate: registryUrl=https://cloudnative-pg.github.io/charts
+      chart: cloudnative-pg
+      version: 0.22.1
+      sourceRef:
+        kind: HelmRepository
+        name: cloudnative-pg
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    crds:
+      create: true
+    monitoring:
+      podMonitorEnabled: false
+      grafanaDashboard:
+        create: true
@@ -0,0 +1,6 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
@@ -0,0 +1,89 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/postgresql.cnpg.io/cluster_v1.json
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: postgres
+  namespace: databases
+spec:
+  instances: 3
+  imageName: ghcr.io/cloudnative-pg/postgresql:16.5-1
+  primaryUpdateStrategy: unsupervised
+  storage:
+    size: 20Gi
+    storageClass: nfs-provision-csi-database
+  superuserSecret:
+    name: cloudnative-pg
+  enableSuperuserAccess: true
+  postgresql:
+    parameters:
+      max_connections: "600"
+      max_slot_wal_keep_size: 10GB
+      shared_buffers: 512MB
+  nodeMaintenanceWindow:
+    inProgress: false
+    reusePVC: true
+  resources:
+    requests:
+      cpu: 500m
+      memory: 2Gi
+    limits:
+      cpu: 1
+      memory: 4Gi
+  monitoring:
+    enablePodMonitor: true
+  # backup:
+  #   retentionPolicy: 30d
+  #   barmanObjectStore: &barmanObjectStore
+  #     data:
+  #       compression: bzip2
+  #     wal:
+  #       compression: bzip2
+  #       maxParallel: 8
+  #     destinationPath: "s3://cloudnative-pg-v1"
+  #     endpointURL: "https://${SECRET_QNAP_HOSTNAME}:8010"
+  #     # Note: serverName version needs to be incremented or changed
+  #     # when recovering from an existing cnpg cluster
+  #     serverName: &currentCluster postgres-v2
+  #     s3Credentials:
+  #       accessKeyId:
+  #         name: cloudnative-pg
+  #         key: s3-key-id
+  #       secretAccessKey:
+  #         name: cloudnative-pg
+  #         key: s3-secret-key
+  # # Note: externalClusters is needed when recovering from an existing cnpg cluster
+  # externalClusters:
+  #   # s3 instance recovery
+  #   - name: &previousCluster postgres-v1
+  #     barmanObjectStore:
+  #       <<: *barmanObjectStore
+  #       serverName: *previousCluster
+    # running instance
+    #- name: postgres
+    #  connectionParameters:
+    #    host: 10.1.0.23
+    #    user: postgres
+    #    dbname: postgres
+    #    sslmode: require
+    #  password:
+    #    name: cloudnative-pg
+    #    key: password
+
+  # Note: previousCluster needs to be set to the name of the previous
+  # cluster when recovering from an existing cnpg cluster
+  bootstrap:
+    # # s3 instance recovery
+    # recovery:
+    #   source: *previousCluster
+    # recover from another running instance
+    initdb:
+      database: homeops
+    #  import:
+    #    type: monolith
+    #    databases:
+    #      - "*"
+    #    roles:
+    #      - "*"
+    #    source:
+    #      externalCluster: postgres
@@ -0,0 +1,32 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: &name cloudnative-pg
+spec:
+  target:
+    name: *name
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        username: "{{ .username }}"
+        password: "{{ .password }}"
+  data:
+    - secretKey: username
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretKey 88217883-df53-4c96-aad7-f3b2142382de
+        property: username
+    - secretKey: password
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: *secretKey
+        property: password
@@ -0,0 +1,11 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./externalsecret.yaml
+  - ./cluster.yaml
+  # - ./gatus.yaml
+  - ./prometheusrule.yaml
+  - ./scheduledbackup.yaml
+  - ./service.yaml
@@ -0,0 +1,67 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/monitoring.coreos.com/prometheusrule_v1.json
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: cloudnative-pg-rules
+  labels:
+    prometheus: k8s
+    role: alert-rules
+spec:
+  groups:
+    - name: cloudnative-pg.rules
+      rules:
+        - alert: LongRunningTransaction
+          annotations:
+            description: Pod {{ $labels.pod }} is taking more than 5 minutes (300 seconds) for a query.
+            summary: A query is taking longer than 5 minutes.
+          expr: |-
+            cnpg_backends_max_tx_duration_seconds > 300
+          for: 1m
+          labels:
+            severity: warning
+        - alert: BackendsWaiting
+          annotations:
+            description: Pod {{ $labels.pod }} has been waiting for longer than 5 minutes
+            summary: If a backend is waiting for longer than 5 minutes
+          expr: |-
+            cnpg_backends_waiting_total > 300
+          for: 1m
+          labels:
+            severity: warning
+        - alert: PGDatabase
+          annotations:
+            description: Over 150,000,000 transactions from frozen xid on pod {{ $labels.pod }}
+            summary: Number of transactions from the frozen XID to the current one
+          expr: |-
+            cnpg_pg_database_xid_age > 150000000
+          for: 1m
+          labels:
+            severity: warning
+        - alert: PGReplication
+          annotations:
+            description: Standby is lagging behind by over 300 seconds (5 minutes)
+            summary: The standby is lagging behind the primary
+          expr: |-
+            cnpg_pg_replication_lag > 300
+          for: 1m
+          labels:
+            severity: warning
+        - alert: LastFailedArchiveTime
+          annotations:
+            description: Archiving failed for {{ $labels.pod }}
+            summary: Checks the last time archiving failed. Will be < 0 when it has not failed.
+          expr: |-
+            (cnpg_pg_stat_archiver_last_failed_time - cnpg_pg_stat_archiver_last_archived_time) > 1
+          for: 1m
+          labels:
+            severity: warning
+        - alert: DatabaseDeadlockConflicts
+          annotations:
+            description: There are over 10 deadlock conflicts in {{ $labels.pod }}
+            summary: Checks the number of database conflicts
+          expr: |-
+            cnpg_pg_stat_database_deadlocks > 10
+          for: 1m
+          labels:
+            severity: warning
@@ -0,0 +1,12 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/postgresql.cnpg.io/scheduledbackup_v1.json
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: postgres
+spec:
+  schedule: "@daily"
+  immediate: true
+  backupOwnerReference: self
+  cluster:
+    name: postgres
@@ -0,0 +1,19 @@
+---
+# yaml-language-server: $schema=https://kubernetesjsonschema.dev/v1.18.1-standalone-strict/service-v1.json
+apiVersion: v1
+kind: Service
+metadata:
+  name: postgres-lb
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: postgres.${SECRET_INTERNAL_DOMAIN}
+    io.cilium/lb-ipam-ips: "${SVC_POSTGRES_ADDR}"
+spec:
+  type: LoadBalancer
+  ports:
+    - name: postgres
+      port: 5432
+      protocol: TCP
+      targetPort: 5432
+  selector:
+    cnpg.io/cluster: postgres
+    role: primary
@@ -0,0 +1,47 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app cloudnative-pg
+  namespace: flux-system
+spec:
+  targetNamespace: databases
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: external-secrets
+    - name: openebs
+  path: ./kubernetes/apps/databases/cloudnative-pg/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app cloudnative-pg-cluster
+  namespace: flux-system
+spec:
+  targetNamespace: databases
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: cloudnative-pg
+  path: ./kubernetes/apps/databases/cloudnative-pg/cluster
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./namespace.yaml
+  - ./cloudnative-pg/ks.yaml
+  - ./redis/ks.yaml
@@ -0,0 +1,38 @@
+---
+# yaml-language-server: $schema=https://kubernetesjsonschema.dev/v1.18.1-standalone-strict/namespace-v1.json
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: databases
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled
+# ---
+# # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/notification.toolkit.fluxcd.io/provider_v1beta3.json
+# apiVersion: notification.toolkit.fluxcd.io/v1beta3
+# kind: Provider
+# metadata:
+#   name: alert-manager
+#   namespace: databases
+# spec:
+#   type: alertmanager
+#   address: http://alertmanager-operated.observability.svc.cluster.local:9093/api/v2/alerts/
+# ---
+# # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/notification.toolkit.fluxcd.io/alert_v1beta3.json
+# apiVersion: notification.toolkit.fluxcd.io/v1beta3
+# kind: Alert
+# metadata:
+#   name: alert-manager
+#   namespace: databases
+# spec:
+#   providerRef:
+#     name: alert-manager
+#   eventSeverity: error
+#   eventSources:
+#     - kind: HelmRelease
+#       name: "*"
+#   exclusionList:
+#     - "error.*lookup github\\.com"
+#     - "error.*lookup raw\\.githubusercontent\\.com"
+#     - "dial.*tcp.*timeout"
+#     - "waiting.*socket"
+#   suspend: false
@@ -0,0 +1,47 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app redis
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: *app
+      version: 20.4.0
+      sourceRef:
+        kind: HelmRepository
+        name: bitnami
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    auth:
+      enabled: false
+      sentinel: false
+    master:
+      persistence:
+        enabled: false
+    replica:
+      persistence:
+        enabled: false
+    sentinel:
+      enabled: true
+      masterSet: redis-master
+      getMasterTimeout: 10
+      startupProbe:
+        failureThreshold: 2
+      persistence:
+        enabled: false
+    metrics:
+      enabled: true
+      serviceMonitor:
+        enabled: true
+        interval: 1m
@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: databases
+resources:
+  - ./helmrelease.yaml
@@ -0,0 +1,24 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app redis
+  namespace: flux-system
+spec:
+  targetNamespace: databases
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/databases/redis/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app
@@ -0,0 +1,13 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../../templates/csi-driver-nfs/claims/cifs-appdata.yaml
+  # - ../../../templates/csi-driver-nfs/claims/cifs-books.yaml
+  - ../../../templates/csi-driver-nfs/claims/cifs-downloads.yaml
+  # - ../../../templates/csi-driver-nfs/claims/cifs-games.yaml
+  # - ../../../templates/csi-driver-nfs/claims/cifs-misc.yaml
+  - ../../../templates/csi-driver-nfs/claims/cifs-movies.yaml
+  # - ../../../templates/csi-driver-nfs/claims/cifs-music.yaml
+  - ../../../templates/csi-driver-nfs/claims/cifs-tv.yaml
@@ -0,0 +1,23 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app downloads-cifs-pvcs
+  namespace: flux-system
+spec:
+  targetNamespace: downloads
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: csi-driver-nfs
+  path: ./kubernetes/apps/downloads/cifs-pvcs
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
@@ -0,0 +1,21 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./namespace.yaml
+  - ./ks.yaml
+  # - ./flaresolverr/ks.yaml
+  # - ./flood/ks.yaml
+  # - ./lidarr/ks.yaml
+  - ./prowlarr/ks.yaml
+  - ./radarr/ks.yaml
+  - ./sabnzbd/ks.yaml
+  - ./sonarr/ks.yaml
+# configMapGenerator:
+#   - name: authelia-ingress-hv
+#     namespace: downloads
+#     files:
+#       - values.yaml=../security/authelia/app/resources/authelia-ingress-hv.yaml
+generatorOptions:
+  disableNameSuffixHash: true
@@ -0,0 +1,11 @@
+---
+# yaml-language-server: $schema=https://kubernetesjsonschema.dev/v1.18.1-standalone-strict/namespace-v1.json
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: downloads
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled
+    vpn-routed-gateway: "true"
+  annotations:
+    volsync.backube/privileged-movers: "true"
@@ -0,0 +1,67 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: &name prowlarr
+spec:
+  target:
+    name: *name
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        # App
+        PROWLARR__AUTH__APIKEY: "{{ .PROWLARR_API_KEY }}"
+        PROWLARR__POSTGRES__HOST: &dbHost postgres-rw.databases.svc.cluster.local
+        PROWLARR__POSTGRES__PORT: "5432"
+        PROWLARR__POSTGRES__USER: &dbUser "{{ .PROWLARR_POSTGRES_USER }}"
+        PROWLARR__POSTGRES__PASSWORD: &dbPass "{{ .PROWLARR_POSTGRES_PASSWORD }}"
+        PROWLARR__POSTGRES__MAINDB: &dbName prowlarr_main
+        # Postgres Init
+        INIT_POSTGRES_DBNAME: *dbName
+        INIT_POSTGRES_HOST: *dbHost
+        INIT_POSTGRES_USER: *dbUser
+        INIT_POSTGRES_PASS: *dbPass
+        INIT_POSTGRES_SUPER_PASS: "{{ .POSTGRES_ADMIN_PASS }}"
+  data:
+    - secretKey: PROWLARR_API_KEY
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretApiKey ae9d8486-9279-4790-ac34-64c8922bb414
+        property: password
+    - secretKey: PROWLARR_POSTGRES_USER
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretDatabaseKey bce2ff77-66cd-47bd-a9e7-160c2d3bb616
+        property: username
+    - secretKey: PROWLARR_POSTGRES_PASSWORD
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: *secretDatabaseKey
+        property: password
+    - secretKey: POSTGRES_ADMIN_USER
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretAdminDatabaseKey 88217883-df53-4c96-aad7-f3b2142382de
+        property: username
+    - secretKey: POSTGRES_ADMIN_PASS
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: *secretAdminDatabaseKey
+        property: password
@@ -0,0 +1,132 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app prowlarr
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  uninstall:
+    keepHistory: false
+  # valuesFrom:
+  #   - kind: ConfigMap
+  #     name: authelia-ingress-hv
+  values:
+    controllers:
+      prowlarr:
+        annotations:
+          reloader.stakater.com/auto: "true"
+        initContainers:
+          init-db:
+            image:
+              repository: ghcr.io/onedr0p/postgres-init
+              tag: 16.6@sha256:35353a77777ee8f634d0f3945f495b4a40065134b8619e0d18bd49b0ee9c855b
+            envFrom: &envFrom
+              - secretRef:
+                  name: *app
+        containers:
+          app:
+            image:
+              repository: ghcr.io/onedr0p/prowlarr-develop
+              tag: rolling@sha256:155e7c757880e6afc5933b3060dfaec1c79712caf68031096fd5866ae4a31d0f
+            env:
+              TZ: "${TIMEZONE}"
+              PROWLARR__APP__INSTANCENAME: Prowlarr
+              PROWLARR__APP__THEME: dark
+              PROWLARR__AUTH__METHOD: External
+              PROWLARR__AUTH__REQUIRED: DisabledForLocalAddresses
+              PROWLARR__LOG__DBENABLED: "False"
+              PROWLARR__LOG__LEVEL: info
+              PROWLARR__SERVER__PORT: &port 80
+              PROWLARR__UPDATE__BRANCH: develop
+            envFrom: *envFrom
+            probes:
+              liveness: &probes
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /ping
+                    port: *port
+                  initialDelaySeconds: 0
+                  periodSeconds: 10
+                  timeoutSeconds: 3
+                  failureThreshold: 5
+              readiness: *probes
+              startup:
+                enabled: false
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: [ "ALL" ] }
+            resources:
+              requests:
+                cpu: 10m
+                memory: 128Mi
+              limits:
+                memory: 512Mi
+    defaultPodOptions:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 568
+        runAsGroup: 568
+        fsGroup: 568
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile: { type: RuntimeDefault }
+    service:
+      app:
+        controller: *app
+        ports:
+          http:
+            port: *port
+    ingress:
+      app:
+        enabled: true
+        className: internal
+        annotations:
+          external-dns.alpha.kubernetes.io/target: internal.${SECRET_DOMAIN}
+          gethomepage.dev/enabled: "true"
+          gethomepage.dev/group: Downloads
+          gethomepage.dev/name: Prowlarr
+          gethomepage.dev/icon: prowlarr.png
+          gethomepage.dev/description: Torrent/NZB Indexer Management
+          gethomepage.dev/widget.type: prowlarr
+          gethomepage.dev/widget.url: http://prowlarr.downloads
+          gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_PROWLARR_TOKEN}}` }}"
+          nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET}
+        hosts:
+          - host: &host "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - hosts:
+              - *host
+            secretName: "{{ .Release.Name }}-tls"
+    persistence:
+      config:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/k3s/config/prowlarr
+      tmp:
+        type: emptyDir
@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./externalsecret.yaml
+  - ./helmrelease.yaml
+  # - ../../../../templates/gatus/guarded
@@ -0,0 +1,27 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app prowlarr
+  namespace: flux-system
+spec:
+  targetNamespace: downloads
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: cloudnative-pg-cluster
+    - name: downloads-cifs-pvcs
+  path: ./kubernetes/apps/downloads/prowlarr/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app
@@ -0,0 +1,67 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: &name radarr
+spec:
+  target:
+    name: *name
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        # App
+        RADARR__AUTH__APIKEY: "{{ .RADARR_API_KEY }}"
+        RADARR__POSTGRES__HOST: &dbHost postgres-rw.databases.svc.cluster.local
+        RADARR__POSTGRES__PORT: "5432"
+        RADARR__POSTGRES__USER: &dbUser "{{ .RADARR_POSTGRES_USER }}"
+        RADARR__POSTGRES__PASSWORD: &dbPass "{{ .RADARR_POSTGRES_PASSWORD }}"
+        RADARR__POSTGRES__MAINDB: &dbName radarr_main
+        # Postgres Init
+        INIT_POSTGRES_DBNAME: *dbName
+        INIT_POSTGRES_HOST: *dbHost
+        INIT_POSTGRES_USER: *dbUser
+        INIT_POSTGRES_PASS: *dbPass
+        INIT_POSTGRES_SUPER_PASS: "{{ .POSTGRES_ADMIN_PASS }}"
+  data:
+    - secretKey: RADARR_API_KEY
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretApiKey 093af32f-2565-4807-9574-6b6a886a4e03
+        property: password
+    - secretKey: RADARR_POSTGRES_USER
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretDatabaseKey b99de2a6-f2b4-42c5-8852-87038e6c48fe
+        property: username
+    - secretKey: RADARR_POSTGRES_PASSWORD
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: *secretDatabaseKey
+        property: password
+    - secretKey: POSTGRES_ADMIN_USER
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretAdminDatabaseKey 88217883-df53-4c96-aad7-f3b2142382de
+        property: username
+    - secretKey: POSTGRES_ADMIN_PASS
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: *secretAdminDatabaseKey
+        property: password
@@ -0,0 +1,168 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app radarr
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  # valuesFrom:
+  #   - kind: ConfigMap
+  #     name: authelia-ingress-hv
+  values:
+    controllers:
+      radarr:
+        annotations:
+          reloader.stakater.com/auto: "true"
+        initContainers:
+          init-db:
+            image:
+              repository: ghcr.io/onedr0p/postgres-init
+              tag: 16.6@sha256:35353a77777ee8f634d0f3945f495b4a40065134b8619e0d18bd49b0ee9c855b
+            envFrom: &envFrom
+              - secretRef:
+                  name: *app
+        containers:
+          app:
+            image:
+              repository: ghcr.io/onedr0p/radarr-develop
+              tag: rolling@sha256:f21d401a2ce6ebf5401c4dc71e3184ece740fff227a6af0ffa1a51fe4af7627c
+            env:
+              TZ: "${TIMEZONE}"
+              RADARR__APP__INSTANCENAME: Radarr
+              RADARR__APP__THEME: dark
+              RADARR__AUTH__METHOD: External
+              RADARR__AUTH__REQUIRED: DisabledForLocalAddresses
+              RADARR__LOG__DBENABLED: "False"
+              RADARR__LOG__LEVEL: info
+              RADARR__SERVER__PORT: &port 80
+              RADARR__UPDATE__BRANCH: develop
+            envFrom: *envFrom
+            probes:
+              liveness: &probes
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /ping
+                    port: *port
+                  initialDelaySeconds: 0
+                  periodSeconds: 10
+                  timeoutSeconds: 3
+                  failureThreshold: 5
+              readiness: *probes
+              startup:
+                enabled: false
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: ["ALL"] }
+            resources:
+              requests:
+                cpu: 10m
+                memory: 256M
+              limits:
+                memory: 4Gi
+    defaultPodOptions:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 568
+        runAsGroup: 568
+        fsGroup: 568
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile: { type: RuntimeDefault }
+    service:
+      app:
+        controller: *app
+        ports:
+          http:
+            port: *port
+    ingress:
+      app:
+        enabled: true
+        className: internal
+        annotations:
+          external-dns.alpha.kubernetes.io/target: internal.${SECRET_INTERNAL_DOMAIN}
+          gethomepage.dev/enabled: "true"
+          gethomepage.dev/group: Downloads
+          gethomepage.dev/name: Radarr
+          gethomepage.dev/icon: radarr.png
+          gethomepage.dev/description: Movie Downloads
+          gethomepage.dev/widget.type: radarr
+          gethomepage.dev/widget.url: http://radarr.downloads
+          gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_RADARR_TOKEN}}` }}"
+          nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET}
+        hosts:
+          - host: &host "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - hosts:
+              - *host
+            secretName: "{{ .Release.Name }}-tls"
+      # app:
+      #   enabled: true
+      #   className: internal
+      #   annotations:
+      #     external-dns.alpha.kubernetes.io/target: internal.${SECRET_INTERNAL_DOMAIN}
+      #     # gethomepage.dev/enabled: "true"
+      #     # gethomepage.dev/group: Downloads
+      #     # gethomepage.dev/name: Radarr
+      #     # gethomepage.dev/icon: radarr.png
+      #     # gethomepage.dev/description: Movie Downloads
+      #     # gethomepage.dev/widget.type: radarr
+      #   #   gethomepage.dev/widget.url: http://radarr.downloads
+      #   #   gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_RADARR_TOKEN}}` }}"
+      #   #   nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET}
+      #   hosts:
+      #     - host: &host "{{ .Release.Name }}.k8s.home.arpa"
+      #       paths:
+      #         - path: /
+      #           pathType: Prefix
+      #           service:
+      #             identifier: app
+      #             port: http
+    persistence:
+      config:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/k3s/config/radarr
+      tmp:
+        type: emptyDir
+      media:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/movies
+      downloads:
+        existingClaim: cifs-downloads
+        advancedMounts:
+          radarr:
+            app:
+              - path: /downloads/downloaded_movies
+                readOnly: false
+                subPath: sabnzbd/downloaded_movies
+              - path: /downloads/movies-radarr
+                readOnly: false
+                subPath: flood/movies-radarr
@@ -0,0 +1,9 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  # - ../../../../templates/volsync
+  - ./externalsecret.yaml
+  - ./helmrelease.yaml
+  # - ../../../../templates/gatus/guarded
@@ -0,0 +1,27 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app radarr
+  namespace: flux-system
+spec:
+  targetNamespace: downloads
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: cloudnative-pg-cluster
+    - name: downloads-cifs-pvcs
+  path: ./kubernetes/apps/downloads/radarr/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app
@@ -0,0 +1,32 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: &name sabnzbd
+spec:
+  target:
+    name: *name
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        SABNZBD__API_KEY: "{{ .SABNZBD_API_KEY }}"
+        SABNZBD__NZB_KEY: "{{ .SABNZBD_NZB_KEY }}"
+  data:
+    - secretKey: SABNZBD_API_KEY
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretDatabaseKey f6eb2b25-18a4-4f3f-af8e-38a6ee61787b
+        property: username
+    - secretKey: SABNZBD_NZB_KEY
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: *secretDatabaseKey
+        property: password
@@ -0,0 +1,141 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app sabnzbd
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  # valuesFrom:
+  #   - kind: ConfigMap
+  #     name: authelia-ingress-hv
+  values:
+    controllers:
+      sabnzbd:
+        annotations:
+          reloader.stakater.com/auto: "true"
+        containers:
+          app:
+            image:
+              repository: ghcr.io/onedr0p/sabnzbd
+              tag: rolling@sha256:86c645db93affcbf01cc2bce2560082bfde791009e1506dba68269b9c50bc341
+            env:
+              TZ: "America/Denver"
+              SABNZBD__PORT: &port 8080
+              SABNZBD__HOST_WHITELIST_ENTRIES: >-
+                sabnzbd,
+                sabnzbd.downloads,
+                sabnzbd.downloads.svc,
+                sabnzbd.downloads.svc.cluster,
+                sabnzbd.downloads.svc.cluster.local,
+                sabnzbd.${SECRET_INTERNAL_DOMAIN}
+            envFrom:
+              - secretRef:
+                  name: *app
+            probes:
+              liveness: &probes
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /api?mode=version
+                    port: *port
+                  initialDelaySeconds: 0
+                  periodSeconds: 10
+                  timeoutSeconds: 1
+                  failureThreshold: 3
+              readiness: *probes
+              startup:
+                enabled: false
+            resources:
+              requests:
+                cpu: 300m
+                memory: 1Gi
+              limits:
+                memory: 4Gi
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: ["ALL"] }
+    defaultPodOptions:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 568
+        runAsGroup: 568
+        fsGroup: 568
+        seccompProfile: { type: RuntimeDefault }
+    service:
+      app:
+        controller: *app
+        ports:
+          http:
+            port: *port
+    ingress:
+      app:
+        enabled: true
+        className: internal
+        annotations:
+          external-dns.alpha.kubernetes.io/target: "internal.${SECRET_DOMAIN}"
+          gethomepage.dev/enabled: "true"
+          gethomepage.dev/group: Downloads
+          gethomepage.dev/name: SABnzbd
+          gethomepage.dev/icon: sabnzbd
+          gethomepage.dev/widget.type: sabnzbd
+          gethomepage.dev/widget.url: http://sabnzbd.downloads:8080
+          gethomepage.dev/widget.key: "{{`{{HOMEPAGE_VAR_SABNZBD_TOKEN}}`}}"
+          nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET}
+        hosts:
+          - host: &host "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - hosts:
+              - *host
+            secretName: "{{ .Release.Name }}-tls"
+    persistence:
+      config:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/k3s/config/sabnzbd
+      tmp:
+        type: emptyDir
+      incomplete:
+        type: emptyDir
+      applications:
+        existingClaim: cifs-appdata
+        globalMounts:
+          - path: /media/applications
+      downloads:
+        existingClaim: cifs-downloads
+        globalMounts:
+          - path: /downloads
+            subPath: sabnzbd
+      # games:
+      #   existingClaim: cifs-games
+      #   globalMounts:
+      #     - path: /media/games
+      # misc:
+      #   existingClaim: cifs-misc
+      #   globalMounts:
+      #     - path: /media/misc
@@ -0,0 +1,9 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  # - ../../../../templates/volsync
+  - ./externalsecret.yaml
+  - ./helmrelease.yaml
+  # - ../../../../templates/gatus/guarded
@@ -0,0 +1,27 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app sabnzbd
+  namespace: flux-system
+spec:
+  targetNamespace: downloads
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: external-secrets
+    - name: downloads-cifs-pvcs
+  path: ./kubernetes/apps/downloads/sabnzbd/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app
@@ -0,0 +1,67 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: &name sonarr
+spec:
+  target:
+    name: *name
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        # App
+        SONARR__AUTH__APIKEY: "{{ .SONARR_API_KEY }}"
+        SONARR__POSTGRES__HOST: &dbHost postgres-rw.databases.svc.cluster.local
+        SONARR__POSTGRES__PORT: "5432"
+        SONARR__POSTGRES__USER: &dbUser "{{ .SONARR_POSTGRES_USER }}"
+        SONARR__POSTGRES__PASSWORD: &dbPass "{{ .SONARR_POSTGRES_PASSWORD }}"
+        SONARR__POSTGRES__MAINDB: &dbName sonarr_main
+        # Postgres Init
+        INIT_POSTGRES_DBNAME: *dbName
+        INIT_POSTGRES_HOST: *dbHost
+        INIT_POSTGRES_USER: *dbUser
+        INIT_POSTGRES_PASS: *dbPass
+        INIT_POSTGRES_SUPER_PASS: "{{ .POSTGRES_ADMIN_PASS }}"
+  data:
+    - secretKey: SONARR_API_KEY
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretApiKey cccf2793-8f91-47da-be0d-63f08cdeda95
+        property: password
+    - secretKey: SONARR_POSTGRES_USER
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretDatabaseKey 6fbd4e66-0750-4dea-94b6-b5eb25c77c44
+        property: username
+    - secretKey: SONARR_POSTGRES_PASSWORD
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: *secretDatabaseKey
+        property: password
+    - secretKey: POSTGRES_ADMIN_USER
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretAdminDatabaseKey 88217883-df53-4c96-aad7-f3b2142382de
+        property: username
+    - secretKey: POSTGRES_ADMIN_PASS
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: *secretAdminDatabaseKey
+        property: password
@@ -0,0 +1,141 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app sonarr
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    controllers:
+      sonarr:
+        annotations:
+          reloader.stakater.com/auto: "true"
+        initContainers:
+          init-db:
+            image:
+              repository: ghcr.io/onedr0p/postgres-init
+              tag: 16.6@sha256:35353a77777ee8f634d0f3945f495b4a40065134b8619e0d18bd49b0ee9c855b
+            envFrom: &envFrom
+              - secretRef:
+                  name: *app
+        containers:
+          app:
+            image:
+              repository: ghcr.io/onedr0p/sonarr-develop
+              tag: rolling@sha256:371517bc99a5c755bea0c73e8e9fcd23ae436a593fb4a116368947c9c9182977
+            env:
+              TZ: "${TIMEZONE}"
+              SONARR__APP__INSTANCENAME: Sonarr
+              SONARR__APP__THEME: dark
+              SONARR__AUTH__METHOD: External
+              SONARR__AUTH__REQUIRED: DisabledForLocalAddresses
+              SONARR__LOG__DBENABLED: "False"
+              SONARR__LOG__LEVEL: info
+              SONARR__SERVER__PORT: &port 80
+              SONARR__UPDATE__BRANCH: develop
+            envFrom: *envFrom
+            probes:
+              liveness: &probes
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /ping
+                    port: *port
+                  initialDelaySeconds: 0
+                  periodSeconds: 10
+                  timeoutSeconds: 3
+                  failureThreshold: 5
+              readiness: *probes
+              startup:
+                enabled: false
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: ["ALL"] }
+            resources:
+              requests:
+                cpu: 10m
+                memory: 256Mi
+              limits:
+                memory: 4Gi
+    defaultPodOptions:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 568
+        runAsGroup: 568
+        fsGroup: 568
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile: { type: RuntimeDefault }
+    service:
+      app:
+        controller: *app
+        ports:
+          http:
+            port: *port
+    ingress:
+      app:
+        className: internal
+        annotations:
+          external-dns.alpha.kubernetes.io/target: internal.${SECRET_DOMAIN}
+          gethomepage.dev/enabled: "true"
+          gethomepage.dev/group: Downloads
+          gethomepage.dev/name: Sonarr
+          gethomepage.dev/icon: sonarr.png
+          gethomepage.dev/description: TV Downloads
+          gethomepage.dev/widget.type: sonarr
+          gethomepage.dev/widget.url: http://sonarr.downloads
+          gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_SONARR_TOKEN}}` }}"
+          nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET}
+        hosts:
+          - host: &host "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - hosts:
+              - *host
+            secretName: "{{ .Release.Name }}-tls"
+    persistence:
+      config:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/k3s/config/sonarr
+      tmp:
+        type: emptyDir
+      media:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/shows
+      downloads:
+        existingClaim: cifs-downloads
+        advancedMounts:
+          sonarr:
+            app:
+              - path: /downloads/downloaded_tv
+                readOnly: false
+                subPath: sabnzbd/downloaded_tv
+              - path: /downloads/tv-sonarr
+                readOnly: false
+                subPath: flood/tv-sonarr
@@ -0,0 +1,9 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  # - ../../../../templates/volsync
+  - ./externalsecret.yaml
+  - ./helmrelease.yaml
+  # - ../../../../templates/gatus/guarded
@@ -0,0 +1,27 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app sonarr
+  namespace: flux-system
+spec:
+  targetNamespace: downloads
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: cloudnative-pg-cluster
+    - name: downloads-cifs-pvcs
+  path: ./kubernetes/apps/downloads/sonarr/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app
@@ -0,0 +1,46 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: external-secrets
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: external-secrets
+      version: 0.11.0
+      sourceRef:
+        kind: HelmRepository
+        name: external-secrets
+        namespace: flux-system
+
+  driftDetection:
+    mode: enabled
+  maxHistory: 3
+  install:
+    crds: CreateReplace
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    crds: CreateReplace
+    remediation:
+      retries: 3
+
+  # https://github.com/external-secrets/external-secrets/blob/v0.7.2/deploy/charts/external-secrets/values.yaml
+  values:
+    installCRDs: true
+    replicaCount: 2
+    leaderElect: true
+
+    extraArgs:
+      loglevel: debug
+
+    serviceMonitor:
+      enabled: true
+    webhook:
+      serviceMonitor:
+        enabled: true
+    certController:
+      serviceMonitor:
+        enabled: true
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: kube-system
+resources:
+  - helmrelease.yaml
@@ -0,0 +1,25 @@
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: bitwarden-login
+spec:
+  provider:
+    webhook:
+      url: "http://bitwarden-cli.external-secrets.svc.cluster.local:8087/object/item/{{ .remoteRef.key }}"
+      headers:
+        Content-Type: application/json
+      result:
+        jsonPath: "$.data.login.{{ .remoteRef.property }}"
+
+---
+apiVersion: external-secrets.io/v1beta1
+kind: ClusterSecretStore
+metadata:
+  name: bitwarden-fields
+spec:
+  provider:
+    webhook:
+      url: "http://bitwarden-cli.external-secrets.svc.cluster.local:8087/object/item/{{ .remoteRef.key }}"
+      result:
+        jsonPath: "$.data.fields[?@.name==\"{{ .remoteRef.property }}\"].value"
@@ -0,0 +1,81 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: bitwarden-cli
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+
+  driftDetection:
+    mode: enabled
+  maxHistory: 3
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+
+  values:
+    defaultPodOptions:
+      securityContext:
+        seccompProfile: { type: RuntimeDefault }
+
+    controllers:
+      bitwarden-cli:
+        annotations:
+          reloader.stakater.com/auto: "true"
+
+        containers:
+          app:
+            image:
+              repository: ghcr.io/oliverziegert/external-secrets-bitwarden
+              tag: 1.0.6
+
+            envFrom:
+              - secretRef:
+                  name: bitwarden-cli-secret
+            probes:
+              liveness:
+                enabled: true
+                custom: true
+                spec:
+                  exec:
+                    command:
+                      - /usr/bin/curl
+                      - -X
+                      - POST
+                      - -s
+                      - http://127.0.0.1:8087/sync
+                  initialDelaySeconds: 20
+                  failureThreshold: 3
+                  timeoutSeconds: 10
+                  periodSeconds: 120
+            resources:
+              requests:
+                memory: 256Mi
+                cpu: 100m
+              limits:
+                memory: 512Mi
+
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: false
+              capabilities: { drop: [ 'ALL' ] }
+    service:
+      app:
+        controller: bitwarden-cli
+        ports:
+          http:
+            port: 8087
@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- ./secret.sops.yaml
+- ./helmrelease.yaml
+- ./clustersecretstore.yaml
@@ -0,0 +1,30 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: bitwarden-cli-secret
+stringData:
+    BW_HOST: ENC[AES256_GCM,data:wK+Ef3moIG0dFRE3R2sQ4y5jL1iV+RMDfmTKZyPGJCB2/SE/,iv:R0nZ6kN82z4C+rlfGm36wQH9wlMyJlA1j+BFxGYInek=,tag:fe5YwhXqyAlxxYMk2HbL/w==,type:str]
+    BW_CLIENTID: ENC[AES256_GCM,data:k5owh4o61yxZW0EJwb0GxTUQEoMk8c0YRDFmsL/CeRumgZoVVnx/tMI=,iv:gCTPrl6mv0lZh9AxVm5JCSdnzrwLEOVoCgpTlSEgJ3g=,tag:SvSBHyFvIvde0YxYMIF9tA==,type:str]
+    BW_CLIENTSECRET: ENC[AES256_GCM,data:8/m9r17gDBf8fo42nLqSxWSn76lN4CaXEZMhZ6hS,iv:l91GjxP0JijlrGx4jM3ZZ7/4HEpBJLE2tp+ZFm351sw=,tag:n8JmlYTRqz8360bDRXdXhQ==,type:str]
+    BW_USERNAME: ENC[AES256_GCM,data:ztA9l7nEmD5UgTmCRDpxhI1f8aU=,iv:Us/JY2/Oy+ZSRuFaF6dYf2LbG+qsGd5grmD4KOHcmOI=,tag:C13AfUVnHlMQZB1PqwDDEA==,type:str]
+    BW_PASSWORD: ENC[AES256_GCM,data:84MKQ0t0EAFo3tX9GNvQ,iv:9lgEFurqSFiqP/HQkGXFvh3TCXAU0Ci3VjglHGYGgh8=,tag:MU+0XIXzkp1zBfL8hnFqSA==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1mhnje42sefcfpvgpeppch84g6vgptmd4gukgvr3gueuxy6ph05xqx45jty
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWZXdTKys3MHZMb2ZTc3Fm
+            TW9XMVhTUTllOFVYekRod0EyT3AyR0p5MHlBCnI2c3B3Zk1HSUlFd3BMNUhJSDlX
+            VmVGbWdVdFBwMDQ2TmlCeGJHQzQyREkKLS0tIHozMXB3bCtOM0FGZHYzSnZhRzRM
+            dFM3QW92dWdUUkNNQndIa3RVNHNnMkkKCkdzT78tFGWsS+7bbvRdWvm8uXswKi9s
+            NuanHeoK0FV+GiMoPLuwC1e4W2g718PazHGveN5pCM7UFQPlKCctDA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-11-08T16:20:08Z"
+    mac: ENC[AES256_GCM,data:FMXM+wkLPajSIU7dm9q0jo+4Lq+c7G11ErrKF9TC3zB82hsWrBpgZggvqT7xmQmI1c/SLq6mfesfoPWQ4Kf6H6WtPDc3PFvyXARFZZ0zIhSl1WIDd7A6De1qn3DvRJ8sCt+131OS7hYSCgMuLJAkrJg0lRayjINyx3RparL6F4s=,iv:Fy/HjcNjdJKOCdzRF5M+k4CshDgK2CYNVXwezLCfyu0=,tag:KN5xgpOvGijmEk+QeSfFog==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.1
@@ -0,0 +1,47 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/cert-manager.io/certificate_v1.json
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: &name bitwarden-tls-certs
+spec:
+  secretName: *name
+  dnsNames:
+    - bitwarden-sdk-server.external-secrets.svc.cluster.local
+    - external-secrets-bitwarden-sdk-server.external-secrets.svc.cluster.local
+    - localhost
+  ipAddresses:
+    - 127.0.0.1
+    - ::1
+  privateKey:
+    algorithm: RSA
+    encoding: PKCS8
+    size: 2048
+    rotationPolicy: Always
+  duration: 168h # 7d
+  renewBefore: 24h # 1d
+  issuerRef:
+    name: home-ca-issuer
+    kind: ClusterIssuer
+    group: cert-manager.io
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: bitwarden-css-certs
+  namespace: external-secrets
+spec:
+  secretName: bitwarden-css-certs
+  dnsNames:
+    - bitwarden-secrets-manager.external-secrets.svc.cluster.local
+  privateKey:
+    algorithm: RSA
+    encoding: PKCS8
+    size: 2048
+    rotationPolicy: Always
+  usages:
+    - client auth
+  issuerRef:
+    name: home-ca-issuer
+    kind: ClusterIssuer
+    group: cert-manager.io
@@ -0,0 +1,6 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./bitwarden.yaml
@@ -0,0 +1,42 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app external-secrets
+  namespace: flux-system
+spec:
+  targetNamespace: external-secrets
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/external-secrets/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app external-secrets-bw
+  namespace: flux-system
+spec:
+  targetNamespace: external-secrets
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: external-secrets
+  path: ./kubernetes/apps/external-secrets/bitwarden
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./namespace.yaml
+  - ./ks.yaml
@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://kubernetesjsonschema.dev/v1.18.1-standalone-strict/namespace-v1.json
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: external-secrets
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./namespace.yaml
+  - ./webhooks/ks.yaml
@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: flux-system
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled
@@ -0,0 +1,20 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: flux-webhook
+  annotations:
+    external-dns.alpha.kubernetes.io/target: "external.${SECRET_DOMAIN}"
+spec:
+  ingressClassName: external
+  rules:
+    - host: "flux-webhook.${SECRET_DOMAIN}"
+      http:
+        paths:
+          - path: /hook/
+            pathType: Prefix
+            backend:
+              service:
+                name: webhook-receiver
+                port:
+                  number: 80
@@ -0,0 +1,7 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./secret.sops.yaml
+  - ./ingress.yaml
+  - ./receiver.yaml
@@ -0,0 +1,25 @@
+---
+apiVersion: notification.toolkit.fluxcd.io/v1
+kind: Receiver
+metadata:
+  name: github-receiver
+spec:
+  type: github
+  events:
+    - ping
+    - push
+  secretRef:
+    name: github-webhook-token-secret
+  resources:
+    - apiVersion: source.toolkit.fluxcd.io/v1
+      kind: GitRepository
+      name: home-kubernetes
+      namespace: flux-system
+    - apiVersion: kustomize.toolkit.fluxcd.io/v1
+      kind: Kustomization
+      name: cluster
+      namespace: flux-system
+    - apiVersion: kustomize.toolkit.fluxcd.io/v1
+      kind: Kustomization
+      name: cluster-apps
+      namespace: flux-system
@@ -0,0 +1,26 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: github-webhook-token-secret
+stringData:
+    token: ENC[AES256_GCM,data:mq8ZPkayUvV4+EKJaj0EMCweaiC8SPuYz7m4smXlW74=,iv:j6Pr1+1XBvHWeZrrH6eKJ+bPXc2dJlghi6GCJ6lH1rE=,tag:fmo0zJJiaTcDwoVne0CX2A==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1mhnje42sefcfpvgpeppch84g6vgptmd4gukgvr3gueuxy6ph05xqx45jty
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaMTVGMkV5K1lXY3RvZ1dI
+            OWhJV1BkaTdGTXZVY21SMExBMnQ4SThLQ0dvCk1NLzhXY1AvRHhqTGo2akxiZTA3
+            SHBZRWVja0ZZejNqSVVkMEhjSG1SOUUKLS0tIENXR0l6bGdnSit2RkRucW5HYWNW
+            Rk1scEUvOUZISWpyUlJIanZ3ZWVmY00KSD1tXiEZeFVyOX6zeu97Be4Ak1Tp4vLX
+            gqO9Oa0SpvP+YOCbm9t4A8VICYAR+7bmrSqIqfZ7WaLJvRWkl+TBDA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2024-11-07T06:29:43Z"
+    mac: ENC[AES256_GCM,data:GAORHFhuCMZ5su6KNnh0HC2al1ezHe6hLBiYsSrGDID3fGT16ZRxMYEVXo/0n1xcZLjxgAckBXFA6HL9viepVsnX0STvB9mbdd8C8qYW0oGwcnmhLavrdABV0Kp6oaRW9agIODQF0mQbX49x3lirRWJxbmU2XBPUVjngJt/yUKU=,iv:rfCSCO1CmEU17Be85qRoYjsBzEfLv0J2j/pq0AiBTgE=,tag:z0qDturLxU3HwF1XWw6BmA==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.1
@@ -0,0 +1,5 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./github
@@ -0,0 +1,19 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app flux-webhooks
+  namespace: flux-system
+spec:
+  targetNamespace: flux-system
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/flux-system/webhooks/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  timeout: 5m
@@ -0,0 +1,55 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: &name homepage
+spec:
+  target:
+    name: *name
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        # HOMEPAGE_VAR_LIDARR_TOKEN: "{{ .LIDARR_API_KEY }}"
+        # HOMEPAGE_VAR_OVERSEERR_TOKEN: "{{ .OVERSEERR_API_KEY }}"
+        # HOMEPAGE_VAR_PLEX_TOKEN: "{{ .PLEX_TOKEN }}"
+        HOMEPAGE_VAR_PROWLARR_TOKEN: "{{ .PROWLARR_API_KEY }}"
+        HOMEPAGE_VAR_RADARR_TOKEN: "{{ .RADARR_API_KEY }}"
+        # HOMEPAGE_VAR_READARR_TOKEN: "{{ .READARR_API_KEY }}"
+        HOMEPAGE_VAR_SABNZBD_TOKEN: "{{ .SABNZBD_API_KEY }}"
+        HOMEPAGE_VAR_SONARR_TOKEN: "{{ .SONARR_API_KEY }}"
+        # HOMEPAGE_VAR_TAUTULLI_TOKEN: "{{ .TAUTULLI_API_KEY }}"
+  data:
+    - secretKey: PROWLARR_API_KEY
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: ae9d8486-9279-4790-ac34-64c8922bb414
+        property: password
+    - secretKey: RADARR_API_KEY
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 093af32f-2565-4807-9574-6b6a886a4e03
+        property: password
+    - secretKey: SABNZBD_API_KEY
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: f6eb2b25-18a4-4f3f-af8e-38a6ee61787b
+        property: username
+    - secretKey: SONARR_API_KEY
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: cccf2793-8f91-47da-be0d-63f08cdeda95
+        property: password
@@ -0,0 +1,115 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app homepage
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    controllers:
+      homepage:
+        annotations:
+          configmap.reloader.stakater.com/reload: *app
+          secret.reloader.stakater.com/reload: *app
+        containers:
+          app:
+            image:
+              repository: ghcr.io/gethomepage/homepage
+              tag: v0.9.13@sha256:1504b26bd82523e68adbae8c5a908d1633d02c68c65b62d084d81a6866552db6
+            env:
+              TZ: "${TIMEZONE}"
+            envFrom:
+              - secretRef:
+                  name: *app
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: ["ALL"] }
+            resources:
+              requests:
+                cpu: 10m
+                memory: 128Mi
+              limits:
+                memory: 768Mi
+    defaultPodOptions:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 568
+        runAsGroup: 568
+        fsGroup: 568
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile: { type: RuntimeDefault }
+    service:
+      app:
+        controller: *app
+        ports:
+          http:
+            port: 3000
+    serviceAccount:
+      create: true
+      name: *app
+    ingress:
+      app:
+        className: internal
+        annotations:
+          external-dns.alpha.kubernetes.io/target: internal.${SECRET_INTERNAL_DOMAIN}
+        hosts:
+          - host: "home.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+    persistence:
+      logs:
+        type: emptyDir
+        globalMounts:
+          - path: /app/config/logs
+      config:
+        type: emptyDir
+        globalMounts:
+          - path: /app/config
+      # services:
+      #   type: secret
+      #   name: *app
+      #   globalMounts:
+      #     - subPath: services.yaml
+      #       path: /app/config/services.yaml
+      #       readOnly: true
+      configmap:
+        type: configMap
+        name: *app
+        globalMounts:
+          - subPath: bookmarks.yaml
+            path: /app/config/bookmarks.yaml
+            readOnly: true
+          - subPath: docker.yaml
+            path: /app/config/docker.yaml
+            readOnly: true
+          - subPath: kubernetes.yaml
+            path: /app/config/kubernetes.yaml
+            readOnly: true
+          - subPath: settings.yaml
+            path: /app/config/settings.yaml
+            readOnly: true
+          - subPath: widgets.yaml
+            path: /app/config/widgets.yaml
+            readOnly: true
@@ -0,0 +1,19 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./rbac.yaml
+  - ./externalsecret.yaml
+  - ./helmrelease.yaml
+configMapGenerator:
+  - name: homepage
+    files:
+      - bookmarks.yaml=./resources/bookmarks.yaml
+      - docker.yaml=./resources/docker.yaml
+      - kubernetes.yaml=./resources/kubernetes.yaml
+      # - services.yaml=./resources/services.yaml
+      - settings.yaml=./resources/settings.yaml
+      - widgets.yaml=./resources/widgets.yaml
+generatorOptions:
+  disableNameSuffixHash: true
@@ -0,0 +1,50 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: homepage
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - namespaces
+      - pods
+      - nodes
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - extensions
+      - networking.k8s.io
+    resources:
+      - ingresses
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - metrics.k8s.io
+    resources:
+      - nodes
+      - pods
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions/status
+    verbs:
+      - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: &app homepage
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: homepage
+subjects:
+  - kind: ServiceAccount
+    name: *app
+    namespace: default
@@ -0,0 +1,23 @@
+- Communicate:
+    - Discord:
+        - icon: discord.png
+          href: "https://discord.com/app"
+    - Gmail:
+        - icon: gmail.png
+          href: "https://mail.kraven.org"
+    - Google Calendar:
+        - icon: google-calendar.png
+          href: "https://calendar.google.com"
+    - Google Voice:
+        - icon: google-voice.png
+          href: "https://voice.google.com"
+- Git:
+    - kubesearch:
+        - icon: kubernetes-dashboard.png
+          href: "https://kubesearch.dev/"
+    - talos-cluster:
+        - icon: github.png
+          href: "https://github.com/brunnels/talos-cluster"
+    - cluster-template:
+        - icon: github.png
+          href: "https://github.com/onedr0p/cluster-template"