feat(helm): update chart external-dns to 1.16.1

Reviewed-on: http://192.168.1.68:3001/infra/home-cluster/pulls/20
Reviewed-by: dlord <dlaccount@icloud.com>

.github/workflows/flux-diff.yaml

@@ -35,7 +35,7 @@ jobs:
           path: default
 
       - name: Diff Resources
-        uses: docker://ghcr.io/allenporter/flux-local:v6.0.1
+        uses: docker://ghcr.io/allenporter/flux-local:v6.1.1
         with:
           args: >-
             diff ${{ matrix.resources }}

.github/workflows/renovate.yaml

@@ -10,7 +10,7 @@ on:
 jobs:
   renovate:
     runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:37.440.7
+    container: ghcr.io/renovatebot/renovate:39.238.2
     steps:
       - uses: actions/checkout@v4
       - run: renovate

bootstrap/templates/kubernetes/apps/kube-system/coredns/app/helmrelease.yaml.j2

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: coredns
-      version: 1.36.0
+      version: 1.36.1
       sourceRef:
         kind: HelmRepository
         name: coredns

bootstrap/templates/kubernetes/apps/network/cloudflared/app/helmrelease.yaml.j2

@@ -30,7 +30,7 @@ spec:
           app:
             image:
               repository: docker.io/cloudflare/cloudflared
-              tag: 2024.10.1
+              tag: 2024.11.1
             env:
               NO_AUTOUPDATE: true
               TUNNEL_CRED_FILE: /etc/cloudflared/creds/credentials.json

bootstrap/templates/kubernetes/apps/network/external-dns/app/helmrelease.yaml.j2

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: external-dns
-      version: 1.15.0
+      version: 1.16.1
       sourceRef:
         kind: HelmRepository
         name: external-dns

bootstrap/templates/kubernetes/apps/network/ingress-nginx/external/helmrelease.yaml.j2

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: ingress-nginx
-      version: 4.11.2
+      version: 4.11.3
       sourceRef:
         kind: HelmRepository
         name: ingress-nginx

bootstrap/templates/kubernetes/apps/network/ingress-nginx/internal/helmrelease.yaml.j2

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: ingress-nginx
-      version: 4.11.2
+      version: 4.11.3
       sourceRef:
         kind: HelmRepository
         name: ingress-nginx

bootstrap/templates/kubernetes/bootstrap/helmfile.yaml.j2

@@ -30,7 +30,7 @@ releases:
   - name: coredns
     namespace: kube-system
     chart: coredns/coredns
-    version: 1.36.0
+    version: 1.36.1
     values:
       - ../apps/kube-system/coredns/app/helm-values.yaml
     needs:

bootstrap/templates/kubernetes/bootstrap/talos/talconfig.yaml.j2

@@ -1,7 +1,7 @@
 # yaml-language-server: $schema=https://raw.githubusercontent.com/budimanjojo/talhelper/master/pkg/config/schemas/talconfig.json
 ---
 # renovate: datasource=docker depName=ghcr.io/siderolabs/installer
-talosVersion: v1.8.1
+talosVersion: v1.8.3
 # renovate: datasource=docker depName=ghcr.io/siderolabs/kubelet
 kubernetesVersion: v1.31.2
 

kubernetes/apps/capacitor/capacitor/app/helmrelease.yaml

@@ -0,0 +1,108 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app capacitor
+spec:
+  interval: 15m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    controllers:
+      capacitor:
+        replicas: 1
+        pod:
+          securityContext:
+            fsGroup: 999
+            # runAsGroup: 3000
+            # runAsNonRoot: true
+            # runAsUser: 1000
+            # seccompProfile:
+            #   type: RuntimeDefault
+        containers:
+          app:
+            env:
+              TZ: ${SETTING_TZ}
+
+            image:
+              repository: ghcr.io/gimlet-io/capacitor
+              tag: v0.4.8@sha256:a80207f52c054dba9e04e8b1ea86e297817ecf05ddbfce249c1f5eaf6ce8c7d8
+            securityContext:
+              runAsNonRoot: true
+              runAsUser: 100
+              runAsGroup: 101
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities:
+                drop:
+                  - ALL
+              seccompProfile:
+                type: RuntimeDefault
+
+            probes:
+              startup:
+                enabled: false
+              liveness: &probe
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /
+                    port: &port 9000
+                    scheme: HTTP
+                  initialDelaySeconds: 0
+                  periodSeconds: 10
+                  timeoutSeconds: 1
+                  failureThreshold: 3
+              readiness: *probe
+
+            resources:
+              requests:
+                cpu: 190m
+                memory: 127Mi
+              limits:
+                memory: 127Mi
+
+    serviceAccount:
+      create: false
+      name: capacitor
+
+    service:
+      app:
+        controller: capacitor
+        ports:
+          http:
+            enabled: true
+            port: *port
+            protocol: HTTP
+
+    ingress:
+      app:
+        enabled: true
+        className: internal
+        hosts:
+          - host: &host "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - hosts:
+              - *host
+            secretName: "{{ .Release.Name }}-tls"

kubernetes/apps/capacitor/capacitor/app/kustomization.yaml

@@ -0,0 +1,7 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
+  - ./rbac.yaml

kubernetes/apps/capacitor/capacitor/app/rbac.yaml

@@ -0,0 +1,60 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: capacitor
+  namespace: flux-system
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: capacitor
+rules:
+- apiGroups:
+    - networking.k8s.io
+    - apps
+    - ""
+  resources:
+    - pods
+    - pods/log
+    - ingresses
+    - deployments
+    - services
+    - secrets
+    - events
+    - configmaps
+  verbs:
+    - get
+    - watch
+    - list
+- apiGroups:
+    - source.toolkit.fluxcd.io
+    - kustomize.toolkit.fluxcd.io
+    - helm.toolkit.fluxcd.io
+    - infra.contrib.fluxcd.io
+  resources:
+    - gitrepositories
+    - ocirepositories
+    - buckets
+    - helmrepositories
+    - helmcharts
+    - kustomizations
+    - helmreleases
+    - terraforms
+  verbs:
+    - get
+    - watch
+    - list
+    - patch # to allow force reconciling by adding an annotation
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: capacitor
+subjects:
+  - kind: ServiceAccount
+    name: capacitor
+    namespace: flux-system
+roleRef:
+  kind: ClusterRole
+  name: capacitor
+  apiGroup: rbac.authorization.k8s.io

kubernetes/apps/capacitor/capacitor/ks.yaml

@@ -0,0 +1,19 @@
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app capacitor
+  namespace: flux-system
+spec:
+  targetNamespace: flux-system
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/capacitor/capacitor/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  timeout: 5m

kubernetes/apps/capacitor/kustomization.yaml

@@ -0,0 +1,7 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./namespace.yaml
+  - ./capacitor/ks.yaml

kubernetes/apps/capacitor/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: capacitor
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled

kubernetes/apps/cert-manager/cert-manager/selfsigned/certificate.yaml

@@ -1,39 +0,0 @@
----
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/cert-manager.io/certificate_v1.json
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: &name home-selfsigned-ca
-spec:
-  isCA: true
-  commonName: *name
-  subject:
-    organizations:
-      - ${SECRET_DOMAIN}
-  secretName: root-secret
-  privateKey:
-    algorithm: ECDSA
-    size: 256
-  issuerRef:
-    name: selfsigned-issuer
-    kind: ClusterIssuer
-    group: cert-manager.io
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: &name strong-selfsigned-ca
-spec:
-  isCA: true
-  commonName: *name
-  subject:
-    organizations:
-      - ${SECRET_DOMAIN}
-  secretName: strong-root-secret
-  privateKey:
-    algorithm: ECDSA
-    size: 384
-  issuerRef:
-    name: selfsigned-issuer
-    kind: ClusterIssuer
-    group: cert-manager.io

kubernetes/apps/cert-manager/cert-manager/selfsigned/clusterissuer.yaml

@@ -1,5 +1,28 @@
 ---
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/cert-manager.io/clusterissuer_v1.json
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: selfsigned-issuer
+spec:
+  selfSigned: {}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: home-selfsigned-ca
+  namespace: cert-manager
+spec:
+  isCA: true
+  commonName: home-selfsigned-ca
+  secretName: root-secret
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+  issuerRef:
+    name: selfsigned-issuer
+    kind: ClusterIssuer
+    group: cert-manager.io
+---
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
 metadata:
@@ -7,11 +30,3 @@ metadata:
 spec:
   ca:
     secretName: root-secret
----
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: strong-ca-issuer
-spec:
-  ca:
-    secretName: strong-root-secret

kubernetes/apps/cert-manager/cert-manager/selfsigned/kustomization.yaml

@@ -3,5 +3,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ./certificate.yaml
   - ./clusterissuer.yaml

kubernetes/apps/databases/cloudnative-pg/app/helmrelease.yaml

@@ -0,0 +1,32 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cloudnative-pg
+spec:
+  interval: 30m
+  chart:
+    spec:
+      # renovate: registryUrl=https://cloudnative-pg.github.io/charts
+      chart: cloudnative-pg
+      version: 0.22.1
+      sourceRef:
+        kind: HelmRepository
+        name: cloudnative-pg
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    crds:
+      create: true
+    monitoring:
+      podMonitorEnabled: false
+      grafanaDashboard:
+        create: true

kubernetes/apps/databases/cloudnative-pg/app/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml

kubernetes/apps/databases/cloudnative-pg/cluster/cluster.yaml

@@ -0,0 +1,89 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/postgresql.cnpg.io/cluster_v1.json
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: postgres
+  namespace: databases
+spec:
+  instances: 3
+  imageName: ghcr.io/cloudnative-pg/postgresql:16.5-1
+  primaryUpdateStrategy: unsupervised
+  storage:
+    size: 20Gi
+    storageClass: nfs-provision-csi-database
+  superuserSecret:
+    name: cloudnative-pg
+  enableSuperuserAccess: true
+  postgresql:
+    parameters:
+      max_connections: "600"
+      max_slot_wal_keep_size: 10GB
+      shared_buffers: 512MB
+  nodeMaintenanceWindow:
+    inProgress: false
+    reusePVC: true
+  resources:
+    requests:
+      cpu: 500m
+      memory: 2Gi
+    limits:
+      cpu: 1
+      memory: 4Gi
+  monitoring:
+    enablePodMonitor: true
+  # backup:
+  #   retentionPolicy: 30d
+  #   barmanObjectStore: &barmanObjectStore
+  #     data:
+  #       compression: bzip2
+  #     wal:
+  #       compression: bzip2
+  #       maxParallel: 8
+  #     destinationPath: "s3://cloudnative-pg-v1"
+  #     endpointURL: "https://${SECRET_QNAP_HOSTNAME}:8010"
+  #     # Note: serverName version needs to be incremented or changed
+  #     # when recovering from an existing cnpg cluster
+  #     serverName: &currentCluster postgres-v2
+  #     s3Credentials:
+  #       accessKeyId:
+  #         name: cloudnative-pg
+  #         key: s3-key-id
+  #       secretAccessKey:
+  #         name: cloudnative-pg
+  #         key: s3-secret-key
+  # # Note: externalClusters is needed when recovering from an existing cnpg cluster
+  # externalClusters:
+  #   # s3 instance recovery
+  #   - name: &previousCluster postgres-v1
+  #     barmanObjectStore:
+  #       <<: *barmanObjectStore
+  #       serverName: *previousCluster
+    # running instance
+    #- name: postgres
+    #  connectionParameters:
+    #    host: 10.1.0.23
+    #    user: postgres
+    #    dbname: postgres
+    #    sslmode: require
+    #  password:
+    #    name: cloudnative-pg
+    #    key: password
+
+  # Note: previousCluster needs to be set to the name of the previous
+  # cluster when recovering from an existing cnpg cluster
+  bootstrap:
+    # # s3 instance recovery
+    # recovery:
+    #   source: *previousCluster
+    # recover from another running instance
+    initdb:
+      database: homeops
+    #  import:
+    #    type: monolith
+    #    databases:
+    #      - "*"
+    #    roles:
+    #      - "*"
+    #    source:
+    #      externalCluster: postgres

kubernetes/apps/databases/cloudnative-pg/cluster/externalsecret.yaml

@@ -0,0 +1,32 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: &name cloudnative-pg
+spec:
+  target:
+    name: *name
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        username: "{{ .username }}"
+        password: "{{ .password }}"
+  data:
+    - secretKey: username
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretKey 88217883-df53-4c96-aad7-f3b2142382de
+        property: username
+    - secretKey: password
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: *secretKey
+        property: password

kubernetes/apps/databases/cloudnative-pg/cluster/kustomization.yaml

@@ -0,0 +1,11 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./externalsecret.yaml
+  - ./cluster.yaml
+  # - ./gatus.yaml
+  - ./prometheusrule.yaml
+  - ./scheduledbackup.yaml
+  - ./service.yaml

kubernetes/apps/databases/cloudnative-pg/cluster/prometheusrule.yaml

@@ -0,0 +1,67 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/monitoring.coreos.com/prometheusrule_v1.json
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: cloudnative-pg-rules
+  labels:
+    prometheus: k8s
+    role: alert-rules
+spec:
+  groups:
+    - name: cloudnative-pg.rules
+      rules:
+        - alert: LongRunningTransaction
+          annotations:
+            description: Pod {{ $labels.pod }} is taking more than 5 minutes (300 seconds) for a query.
+            summary: A query is taking longer than 5 minutes.
+          expr: |-
+            cnpg_backends_max_tx_duration_seconds > 300
+          for: 1m
+          labels:
+            severity: warning
+        - alert: BackendsWaiting
+          annotations:
+            description: Pod {{ $labels.pod }} has been waiting for longer than 5 minutes
+            summary: If a backend is waiting for longer than 5 minutes
+          expr: |-
+            cnpg_backends_waiting_total > 300
+          for: 1m
+          labels:
+            severity: warning
+        - alert: PGDatabase
+          annotations:
+            description: Over 150,000,000 transactions from frozen xid on pod {{ $labels.pod }}
+            summary: Number of transactions from the frozen XID to the current one
+          expr: |-
+            cnpg_pg_database_xid_age > 150000000
+          for: 1m
+          labels:
+            severity: warning
+        - alert: PGReplication
+          annotations:
+            description: Standby is lagging behind by over 300 seconds (5 minutes)
+            summary: The standby is lagging behind the primary
+          expr: |-
+            cnpg_pg_replication_lag > 300
+          for: 1m
+          labels:
+            severity: warning
+        - alert: LastFailedArchiveTime
+          annotations:
+            description: Archiving failed for {{ $labels.pod }}
+            summary: Checks the last time archiving failed. Will be < 0 when it has not failed.
+          expr: |-
+            (cnpg_pg_stat_archiver_last_failed_time - cnpg_pg_stat_archiver_last_archived_time) > 1
+          for: 1m
+          labels:
+            severity: warning
+        - alert: DatabaseDeadlockConflicts
+          annotations:
+            description: There are over 10 deadlock conflicts in {{ $labels.pod }}
+            summary: Checks the number of database conflicts
+          expr: |-
+            cnpg_pg_stat_database_deadlocks > 10
+          for: 1m
+          labels:
+            severity: warning

kubernetes/apps/databases/cloudnative-pg/cluster/scheduledbackup.yaml

@@ -0,0 +1,12 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/postgresql.cnpg.io/scheduledbackup_v1.json
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: postgres
+spec:
+  schedule: "@daily"
+  immediate: true
+  backupOwnerReference: self
+  cluster:
+    name: postgres

kubernetes/apps/databases/cloudnative-pg/cluster/service.yaml

@@ -0,0 +1,19 @@
+---
+# yaml-language-server: $schema=https://kubernetesjsonschema.dev/v1.18.1-standalone-strict/service-v1.json
+apiVersion: v1
+kind: Service
+metadata:
+  name: postgres-lb
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: postgres.${SECRET_INTERNAL_DOMAIN}
+    io.cilium/lb-ipam-ips: "${SVC_POSTGRES_ADDR}"
+spec:
+  type: LoadBalancer
+  ports:
+    - name: postgres
+      port: 5432
+      protocol: TCP
+      targetPort: 5432
+  selector:
+    cnpg.io/cluster: postgres
+    role: primary

kubernetes/apps/databases/cloudnative-pg/ks.yaml

@@ -0,0 +1,47 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app cloudnative-pg
+  namespace: flux-system
+spec:
+  targetNamespace: databases
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: external-secrets
+    - name: openebs
+  path: ./kubernetes/apps/databases/cloudnative-pg/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app cloudnative-pg-cluster
+  namespace: flux-system
+spec:
+  targetNamespace: databases
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: cloudnative-pg
+  path: ./kubernetes/apps/databases/cloudnative-pg/cluster
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m

kubernetes/apps/databases/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./namespace.yaml
+  - ./cloudnative-pg/ks.yaml
+  - ./redis/ks.yaml

kubernetes/apps/databases/namespace.yaml

@@ -0,0 +1,38 @@
+---
+# yaml-language-server: $schema=https://kubernetesjsonschema.dev/v1.18.1-standalone-strict/namespace-v1.json
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: databases
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled
+# ---
+# # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/notification.toolkit.fluxcd.io/provider_v1beta3.json
+# apiVersion: notification.toolkit.fluxcd.io/v1beta3
+# kind: Provider
+# metadata:
+#   name: alert-manager
+#   namespace: databases
+# spec:
+#   type: alertmanager
+#   address: http://alertmanager-operated.observability.svc.cluster.local:9093/api/v2/alerts/
+# ---
+# # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/notification.toolkit.fluxcd.io/alert_v1beta3.json
+# apiVersion: notification.toolkit.fluxcd.io/v1beta3
+# kind: Alert
+# metadata:
+#   name: alert-manager
+#   namespace: databases
+# spec:
+#   providerRef:
+#     name: alert-manager
+#   eventSeverity: error
+#   eventSources:
+#     - kind: HelmRelease
+#       name: "*"
+#   exclusionList:
+#     - "error.*lookup github\\.com"
+#     - "error.*lookup raw\\.githubusercontent\\.com"
+#     - "dial.*tcp.*timeout"
+#     - "waiting.*socket"
+#   suspend: false

kubernetes/apps/databases/redis/app/helmrelease.yaml

@@ -0,0 +1,47 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app redis
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: *app
+      version: 20.4.0
+      sourceRef:
+        kind: HelmRepository
+        name: bitnami
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    auth:
+      enabled: false
+      sentinel: false
+    master:
+      persistence:
+        enabled: false
+    replica:
+      persistence:
+        enabled: false
+    sentinel:
+      enabled: true
+      masterSet: redis-master
+      getMasterTimeout: 10
+      startupProbe:
+        failureThreshold: 2
+      persistence:
+        enabled: false
+    metrics:
+      enabled: true
+      serviceMonitor:
+        enabled: true
+        interval: 1m

kubernetes/apps/databases/redis/app/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: databases
+resources:
+  - ./helmrelease.yaml

kubernetes/apps/databases/redis/ks.yaml

@@ -0,0 +1,24 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app redis
+  namespace: flux-system
+spec:
+  targetNamespace: databases
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/databases/redis/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app

kubernetes/apps/downloads/cifs-pvcs/kustomization.yaml

@@ -0,0 +1,13 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../../templates/csi-driver-nfs/claims/cifs-appdata.yaml
+  # - ../../../templates/csi-driver-nfs/claims/cifs-books.yaml
+  - ../../../templates/csi-driver-nfs/claims/cifs-downloads.yaml
+  # - ../../../templates/csi-driver-nfs/claims/cifs-games.yaml
+  # - ../../../templates/csi-driver-nfs/claims/cifs-misc.yaml
+  - ../../../templates/csi-driver-nfs/claims/cifs-movies.yaml
+  # - ../../../templates/csi-driver-nfs/claims/cifs-music.yaml
+  - ../../../templates/csi-driver-nfs/claims/cifs-tv.yaml

kubernetes/apps/downloads/ks.yaml

@@ -0,0 +1,23 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app downloads-cifs-pvcs
+  namespace: flux-system
+spec:
+  targetNamespace: downloads
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: csi-driver-nfs
+  path: ./kubernetes/apps/downloads/cifs-pvcs
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m

kubernetes/apps/downloads/kustomization.yaml

@@ -0,0 +1,21 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./namespace.yaml
+  - ./ks.yaml
+  # - ./flaresolverr/ks.yaml
+  # - ./flood/ks.yaml
+  # - ./lidarr/ks.yaml
+  - ./prowlarr/ks.yaml
+  - ./radarr/ks.yaml
+  - ./sabnzbd/ks.yaml
+  - ./sonarr/ks.yaml
+# configMapGenerator:
+#   - name: authelia-ingress-hv
+#     namespace: downloads
+#     files:
+#       - values.yaml=../security/authelia/app/resources/authelia-ingress-hv.yaml
+generatorOptions:
+  disableNameSuffixHash: true

kubernetes/apps/downloads/namespace.yaml

@@ -0,0 +1,11 @@
+---
+# yaml-language-server: $schema=https://kubernetesjsonschema.dev/v1.18.1-standalone-strict/namespace-v1.json
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: downloads
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled
+    vpn-routed-gateway: "true"
+  annotations:
+    volsync.backube/privileged-movers: "true"

kubernetes/apps/downloads/prowlarr/app/externalsecret.yaml

@@ -0,0 +1,67 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: &name prowlarr
+spec:
+  target:
+    name: *name
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        # App
+        PROWLARR__AUTH__APIKEY: "{{ .PROWLARR_API_KEY }}"
+        PROWLARR__POSTGRES__HOST: &dbHost postgres-rw.databases.svc.cluster.local
+        PROWLARR__POSTGRES__PORT: "5432"
+        PROWLARR__POSTGRES__USER: &dbUser "{{ .PROWLARR_POSTGRES_USER }}"
+        PROWLARR__POSTGRES__PASSWORD: &dbPass "{{ .PROWLARR_POSTGRES_PASSWORD }}"
+        PROWLARR__POSTGRES__MAINDB: &dbName prowlarr_main
+        # Postgres Init
+        INIT_POSTGRES_DBNAME: *dbName
+        INIT_POSTGRES_HOST: *dbHost
+        INIT_POSTGRES_USER: *dbUser
+        INIT_POSTGRES_PASS: *dbPass
+        INIT_POSTGRES_SUPER_PASS: "{{ .POSTGRES_ADMIN_PASS }}"
+  data:
+    - secretKey: PROWLARR_API_KEY
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretApiKey ae9d8486-9279-4790-ac34-64c8922bb414
+        property: password
+    - secretKey: PROWLARR_POSTGRES_USER
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretDatabaseKey bce2ff77-66cd-47bd-a9e7-160c2d3bb616
+        property: username
+    - secretKey: PROWLARR_POSTGRES_PASSWORD
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: *secretDatabaseKey
+        property: password
+    - secretKey: POSTGRES_ADMIN_USER
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretAdminDatabaseKey 88217883-df53-4c96-aad7-f3b2142382de
+        property: username
+    - secretKey: POSTGRES_ADMIN_PASS
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: *secretAdminDatabaseKey
+        property: password

kubernetes/apps/downloads/prowlarr/app/helmrelease.yaml

@@ -0,0 +1,132 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app prowlarr
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  uninstall:
+    keepHistory: false
+  # valuesFrom:
+  #   - kind: ConfigMap
+  #     name: authelia-ingress-hv
+  values:
+    controllers:
+      prowlarr:
+        annotations:
+          reloader.stakater.com/auto: "true"
+        initContainers:
+          init-db:
+            image:
+              repository: ghcr.io/onedr0p/postgres-init
+              tag: 16.6@sha256:35353a77777ee8f634d0f3945f495b4a40065134b8619e0d18bd49b0ee9c855b
+            envFrom: &envFrom
+              - secretRef:
+                  name: *app
+        containers:
+          app:
+            image:
+              repository: ghcr.io/onedr0p/prowlarr-develop
+              tag: rolling@sha256:155e7c757880e6afc5933b3060dfaec1c79712caf68031096fd5866ae4a31d0f
+            env:
+              TZ: "${TIMEZONE}"
+              PROWLARR__APP__INSTANCENAME: Prowlarr
+              PROWLARR__APP__THEME: dark
+              PROWLARR__AUTH__METHOD: External
+              PROWLARR__AUTH__REQUIRED: DisabledForLocalAddresses
+              PROWLARR__LOG__DBENABLED: "False"
+              PROWLARR__LOG__LEVEL: info
+              PROWLARR__SERVER__PORT: &port 80
+              PROWLARR__UPDATE__BRANCH: develop
+            envFrom: *envFrom
+            probes:
+              liveness: &probes
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /ping
+                    port: *port
+                  initialDelaySeconds: 0
+                  periodSeconds: 10
+                  timeoutSeconds: 3
+                  failureThreshold: 5
+              readiness: *probes
+              startup:
+                enabled: false
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: [ "ALL" ] }
+            resources:
+              requests:
+                cpu: 10m
+                memory: 128Mi
+              limits:
+                memory: 512Mi
+    defaultPodOptions:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 568
+        runAsGroup: 568
+        fsGroup: 568
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile: { type: RuntimeDefault }
+    service:
+      app:
+        controller: *app
+        ports:
+          http:
+            port: *port
+    ingress:
+      app:
+        enabled: true
+        className: internal
+        annotations:
+          external-dns.alpha.kubernetes.io/target: internal.${SECRET_DOMAIN}
+          gethomepage.dev/enabled: "true"
+          gethomepage.dev/group: Downloads
+          gethomepage.dev/name: Prowlarr
+          gethomepage.dev/icon: prowlarr.png
+          gethomepage.dev/description: Torrent/NZB Indexer Management
+          gethomepage.dev/widget.type: prowlarr
+          gethomepage.dev/widget.url: http://prowlarr.downloads
+          gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_PROWLARR_TOKEN}}` }}"
+          nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET}
+        hosts:
+          - host: &host "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - hosts:
+              - *host
+            secretName: "{{ .Release.Name }}-tls"
+    persistence:
+      config:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/k3s/config/prowlarr
+      tmp:
+        type: emptyDir

kubernetes/apps/downloads/prowlarr/app/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./externalsecret.yaml
+  - ./helmrelease.yaml
+  # - ../../../../templates/gatus/guarded

kubernetes/apps/downloads/prowlarr/ks.yaml

@@ -0,0 +1,27 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app prowlarr
+  namespace: flux-system
+spec:
+  targetNamespace: downloads
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: cloudnative-pg-cluster
+    - name: downloads-cifs-pvcs
+  path: ./kubernetes/apps/downloads/prowlarr/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app

kubernetes/apps/downloads/radarr/app/externalsecret.yaml

@@ -0,0 +1,67 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: &name radarr
+spec:
+  target:
+    name: *name
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        # App
+        RADARR__AUTH__APIKEY: "{{ .RADARR_API_KEY }}"
+        RADARR__POSTGRES__HOST: &dbHost postgres-rw.databases.svc.cluster.local
+        RADARR__POSTGRES__PORT: "5432"
+        RADARR__POSTGRES__USER: &dbUser "{{ .RADARR_POSTGRES_USER }}"
+        RADARR__POSTGRES__PASSWORD: &dbPass "{{ .RADARR_POSTGRES_PASSWORD }}"
+        RADARR__POSTGRES__MAINDB: &dbName radarr_main
+        # Postgres Init
+        INIT_POSTGRES_DBNAME: *dbName
+        INIT_POSTGRES_HOST: *dbHost
+        INIT_POSTGRES_USER: *dbUser
+        INIT_POSTGRES_PASS: *dbPass
+        INIT_POSTGRES_SUPER_PASS: "{{ .POSTGRES_ADMIN_PASS }}"
+  data:
+    - secretKey: RADARR_API_KEY
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretApiKey 093af32f-2565-4807-9574-6b6a886a4e03
+        property: password
+    - secretKey: RADARR_POSTGRES_USER
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretDatabaseKey b99de2a6-f2b4-42c5-8852-87038e6c48fe
+        property: username
+    - secretKey: RADARR_POSTGRES_PASSWORD
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: *secretDatabaseKey
+        property: password
+    - secretKey: POSTGRES_ADMIN_USER
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretAdminDatabaseKey 88217883-df53-4c96-aad7-f3b2142382de
+        property: username
+    - secretKey: POSTGRES_ADMIN_PASS
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: *secretAdminDatabaseKey
+        property: password

kubernetes/apps/downloads/radarr/app/helmrelease.yaml

@@ -0,0 +1,168 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app radarr
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  # valuesFrom:
+  #   - kind: ConfigMap
+  #     name: authelia-ingress-hv
+  values:
+    controllers:
+      radarr:
+        annotations:
+          reloader.stakater.com/auto: "true"
+        initContainers:
+          init-db:
+            image:
+              repository: ghcr.io/onedr0p/postgres-init
+              tag: 16.6@sha256:35353a77777ee8f634d0f3945f495b4a40065134b8619e0d18bd49b0ee9c855b
+            envFrom: &envFrom
+              - secretRef:
+                  name: *app
+        containers:
+          app:
+            image:
+              repository: ghcr.io/onedr0p/radarr-develop
+              tag: rolling@sha256:f21d401a2ce6ebf5401c4dc71e3184ece740fff227a6af0ffa1a51fe4af7627c
+            env:
+              TZ: "${TIMEZONE}"
+              RADARR__APP__INSTANCENAME: Radarr
+              RADARR__APP__THEME: dark
+              RADARR__AUTH__METHOD: External
+              RADARR__AUTH__REQUIRED: DisabledForLocalAddresses
+              RADARR__LOG__DBENABLED: "False"
+              RADARR__LOG__LEVEL: info
+              RADARR__SERVER__PORT: &port 80
+              RADARR__UPDATE__BRANCH: develop
+            envFrom: *envFrom
+            probes:
+              liveness: &probes
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /ping
+                    port: *port
+                  initialDelaySeconds: 0
+                  periodSeconds: 10
+                  timeoutSeconds: 3
+                  failureThreshold: 5
+              readiness: *probes
+              startup:
+                enabled: false
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: ["ALL"] }
+            resources:
+              requests:
+                cpu: 10m
+                memory: 256M
+              limits:
+                memory: 4Gi
+    defaultPodOptions:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 568
+        runAsGroup: 568
+        fsGroup: 568
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile: { type: RuntimeDefault }
+    service:
+      app:
+        controller: *app
+        ports:
+          http:
+            port: *port
+    ingress:
+      app:
+        enabled: true
+        className: internal
+        annotations:
+          external-dns.alpha.kubernetes.io/target: internal.${SECRET_INTERNAL_DOMAIN}
+          gethomepage.dev/enabled: "true"
+          gethomepage.dev/group: Downloads
+          gethomepage.dev/name: Radarr
+          gethomepage.dev/icon: radarr.png
+          gethomepage.dev/description: Movie Downloads
+          gethomepage.dev/widget.type: radarr
+          gethomepage.dev/widget.url: http://radarr.downloads
+          gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_RADARR_TOKEN}}` }}"
+          nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET}
+        hosts:
+          - host: &host "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - hosts:
+              - *host
+            secretName: "{{ .Release.Name }}-tls"
+      # app:
+      #   enabled: true
+      #   className: internal
+      #   annotations:
+      #     external-dns.alpha.kubernetes.io/target: internal.${SECRET_INTERNAL_DOMAIN}
+      #     # gethomepage.dev/enabled: "true"
+      #     # gethomepage.dev/group: Downloads
+      #     # gethomepage.dev/name: Radarr
+      #     # gethomepage.dev/icon: radarr.png
+      #     # gethomepage.dev/description: Movie Downloads
+      #     # gethomepage.dev/widget.type: radarr
+      #   #   gethomepage.dev/widget.url: http://radarr.downloads
+      #   #   gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_RADARR_TOKEN}}` }}"
+      #   #   nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET}
+      #   hosts:
+      #     - host: &host "{{ .Release.Name }}.k8s.home.arpa"
+      #       paths:
+      #         - path: /
+      #           pathType: Prefix
+      #           service:
+      #             identifier: app
+      #             port: http
+    persistence:
+      config:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/k3s/config/radarr
+      tmp:
+        type: emptyDir
+      media:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/movies
+      downloads:
+        existingClaim: cifs-downloads
+        advancedMounts:
+          radarr:
+            app:
+              - path: /downloads/downloaded_movies
+                readOnly: false
+                subPath: sabnzbd/downloaded_movies
+              - path: /downloads/movies-radarr
+                readOnly: false
+                subPath: flood/movies-radarr

kubernetes/apps/downloads/radarr/app/kustomization.yaml

@@ -0,0 +1,9 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  # - ../../../../templates/volsync
+  - ./externalsecret.yaml
+  - ./helmrelease.yaml
+  # - ../../../../templates/gatus/guarded

kubernetes/apps/downloads/radarr/ks.yaml

@@ -0,0 +1,27 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app radarr
+  namespace: flux-system
+spec:
+  targetNamespace: downloads
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: cloudnative-pg-cluster
+    - name: downloads-cifs-pvcs
+  path: ./kubernetes/apps/downloads/radarr/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app

kubernetes/apps/downloads/sabnzbd/app/externalsecret.yaml

@@ -0,0 +1,32 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: &name sabnzbd
+spec:
+  target:
+    name: *name
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        SABNZBD__API_KEY: "{{ .SABNZBD_API_KEY }}"
+        SABNZBD__NZB_KEY: "{{ .SABNZBD_NZB_KEY }}"
+  data:
+    - secretKey: SABNZBD_API_KEY
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretDatabaseKey f6eb2b25-18a4-4f3f-af8e-38a6ee61787b
+        property: username
+    - secretKey: SABNZBD_NZB_KEY
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: *secretDatabaseKey
+        property: password

kubernetes/apps/downloads/sabnzbd/app/helmrelease.yaml

@@ -0,0 +1,141 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app sabnzbd
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  # valuesFrom:
+  #   - kind: ConfigMap
+  #     name: authelia-ingress-hv
+  values:
+    controllers:
+      sabnzbd:
+        annotations:
+          reloader.stakater.com/auto: "true"
+        containers:
+          app:
+            image:
+              repository: ghcr.io/onedr0p/sabnzbd
+              tag: rolling@sha256:86c645db93affcbf01cc2bce2560082bfde791009e1506dba68269b9c50bc341
+            env:
+              TZ: "America/Denver"
+              SABNZBD__PORT: &port 8080
+              SABNZBD__HOST_WHITELIST_ENTRIES: >-
+                sabnzbd,
+                sabnzbd.downloads,
+                sabnzbd.downloads.svc,
+                sabnzbd.downloads.svc.cluster,
+                sabnzbd.downloads.svc.cluster.local,
+                sabnzbd.${SECRET_INTERNAL_DOMAIN}
+            envFrom:
+              - secretRef:
+                  name: *app
+            probes:
+              liveness: &probes
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /api?mode=version
+                    port: *port
+                  initialDelaySeconds: 0
+                  periodSeconds: 10
+                  timeoutSeconds: 1
+                  failureThreshold: 3
+              readiness: *probes
+              startup:
+                enabled: false
+            resources:
+              requests:
+                cpu: 300m
+                memory: 1Gi
+              limits:
+                memory: 4Gi
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: ["ALL"] }
+    defaultPodOptions:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 568
+        runAsGroup: 568
+        fsGroup: 568
+        seccompProfile: { type: RuntimeDefault }
+    service:
+      app:
+        controller: *app
+        ports:
+          http:
+            port: *port
+    ingress:
+      app:
+        enabled: true
+        className: internal
+        annotations:
+          external-dns.alpha.kubernetes.io/target: "internal.${SECRET_DOMAIN}"
+          gethomepage.dev/enabled: "true"
+          gethomepage.dev/group: Downloads
+          gethomepage.dev/name: SABnzbd
+          gethomepage.dev/icon: sabnzbd
+          gethomepage.dev/widget.type: sabnzbd
+          gethomepage.dev/widget.url: http://sabnzbd.downloads:8080
+          gethomepage.dev/widget.key: "{{`{{HOMEPAGE_VAR_SABNZBD_TOKEN}}`}}"
+          nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET}
+        hosts:
+          - host: &host "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - hosts:
+              - *host
+            secretName: "{{ .Release.Name }}-tls"
+    persistence:
+      config:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/k3s/config/sabnzbd
+      tmp:
+        type: emptyDir
+      incomplete:
+        type: emptyDir
+      applications:
+        existingClaim: cifs-appdata
+        globalMounts:
+          - path: /media/applications
+      downloads:
+        existingClaim: cifs-downloads
+        globalMounts:
+          - path: /downloads
+            subPath: sabnzbd
+      # games:
+      #   existingClaim: cifs-games
+      #   globalMounts:
+      #     - path: /media/games
+      # misc:
+      #   existingClaim: cifs-misc
+      #   globalMounts:
+      #     - path: /media/misc

kubernetes/apps/downloads/sabnzbd/app/kustomization.yaml

@@ -0,0 +1,9 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  # - ../../../../templates/volsync
+  - ./externalsecret.yaml
+  - ./helmrelease.yaml
+  # - ../../../../templates/gatus/guarded

kubernetes/apps/downloads/sabnzbd/ks.yaml

@@ -0,0 +1,27 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app sabnzbd
+  namespace: flux-system
+spec:
+  targetNamespace: downloads
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: external-secrets
+    - name: downloads-cifs-pvcs
+  path: ./kubernetes/apps/downloads/sabnzbd/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app

kubernetes/apps/downloads/sonarr/app/externalsecret.yaml

@@ -0,0 +1,67 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: &name sonarr
+spec:
+  target:
+    name: *name
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        # App
+        SONARR__AUTH__APIKEY: "{{ .SONARR_API_KEY }}"
+        SONARR__POSTGRES__HOST: &dbHost postgres-rw.databases.svc.cluster.local
+        SONARR__POSTGRES__PORT: "5432"
+        SONARR__POSTGRES__USER: &dbUser "{{ .SONARR_POSTGRES_USER }}"
+        SONARR__POSTGRES__PASSWORD: &dbPass "{{ .SONARR_POSTGRES_PASSWORD }}"
+        SONARR__POSTGRES__MAINDB: &dbName sonarr_main
+        # Postgres Init
+        INIT_POSTGRES_DBNAME: *dbName
+        INIT_POSTGRES_HOST: *dbHost
+        INIT_POSTGRES_USER: *dbUser
+        INIT_POSTGRES_PASS: *dbPass
+        INIT_POSTGRES_SUPER_PASS: "{{ .POSTGRES_ADMIN_PASS }}"
+  data:
+    - secretKey: SONARR_API_KEY
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretApiKey cccf2793-8f91-47da-be0d-63f08cdeda95
+        property: password
+    - secretKey: SONARR_POSTGRES_USER
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretDatabaseKey 6fbd4e66-0750-4dea-94b6-b5eb25c77c44
+        property: username
+    - secretKey: SONARR_POSTGRES_PASSWORD
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: *secretDatabaseKey
+        property: password
+    - secretKey: POSTGRES_ADMIN_USER
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretAdminDatabaseKey 88217883-df53-4c96-aad7-f3b2142382de
+        property: username
+    - secretKey: POSTGRES_ADMIN_PASS
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: *secretAdminDatabaseKey
+        property: password

kubernetes/apps/downloads/sonarr/app/helmrelease.yaml

@@ -0,0 +1,141 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app sonarr
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    controllers:
+      sonarr:
+        annotations:
+          reloader.stakater.com/auto: "true"
+        initContainers:
+          init-db:
+            image:
+              repository: ghcr.io/onedr0p/postgres-init
+              tag: 16.6@sha256:35353a77777ee8f634d0f3945f495b4a40065134b8619e0d18bd49b0ee9c855b
+            envFrom: &envFrom
+              - secretRef:
+                  name: *app
+        containers:
+          app:
+            image:
+              repository: ghcr.io/onedr0p/sonarr-develop
+              tag: rolling@sha256:371517bc99a5c755bea0c73e8e9fcd23ae436a593fb4a116368947c9c9182977
+            env:
+              TZ: "${TIMEZONE}"
+              SONARR__APP__INSTANCENAME: Sonarr
+              SONARR__APP__THEME: dark
+              SONARR__AUTH__METHOD: External
+              SONARR__AUTH__REQUIRED: DisabledForLocalAddresses
+              SONARR__LOG__DBENABLED: "False"
+              SONARR__LOG__LEVEL: info
+              SONARR__SERVER__PORT: &port 80
+              SONARR__UPDATE__BRANCH: develop
+            envFrom: *envFrom
+            probes:
+              liveness: &probes
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /ping
+                    port: *port
+                  initialDelaySeconds: 0
+                  periodSeconds: 10
+                  timeoutSeconds: 3
+                  failureThreshold: 5
+              readiness: *probes
+              startup:
+                enabled: false
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: ["ALL"] }
+            resources:
+              requests:
+                cpu: 10m
+                memory: 256Mi
+              limits:
+                memory: 4Gi
+    defaultPodOptions:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 568
+        runAsGroup: 568
+        fsGroup: 568
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile: { type: RuntimeDefault }
+    service:
+      app:
+        controller: *app
+        ports:
+          http:
+            port: *port
+    ingress:
+      app:
+        className: internal
+        annotations:
+          external-dns.alpha.kubernetes.io/target: internal.${SECRET_DOMAIN}
+          gethomepage.dev/enabled: "true"
+          gethomepage.dev/group: Downloads
+          gethomepage.dev/name: Sonarr
+          gethomepage.dev/icon: sonarr.png
+          gethomepage.dev/description: TV Downloads
+          gethomepage.dev/widget.type: sonarr
+          gethomepage.dev/widget.url: http://sonarr.downloads
+          gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_SONARR_TOKEN}}` }}"
+          nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET}
+        hosts:
+          - host: &host "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - hosts:
+              - *host
+            secretName: "{{ .Release.Name }}-tls"
+    persistence:
+      config:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/k3s/config/sonarr
+      tmp:
+        type: emptyDir
+      media:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/shows
+      downloads:
+        existingClaim: cifs-downloads
+        advancedMounts:
+          sonarr:
+            app:
+              - path: /downloads/downloaded_tv
+                readOnly: false
+                subPath: sabnzbd/downloaded_tv
+              - path: /downloads/tv-sonarr
+                readOnly: false
+                subPath: flood/tv-sonarr

kubernetes/apps/downloads/sonarr/app/kustomization.yaml

@@ -0,0 +1,9 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  # - ../../../../templates/volsync
+  - ./externalsecret.yaml
+  - ./helmrelease.yaml
+  # - ../../../../templates/gatus/guarded

kubernetes/apps/downloads/sonarr/ks.yaml

@@ -0,0 +1,27 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app sonarr
+  namespace: flux-system
+spec:
+  targetNamespace: downloads
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: cloudnative-pg-cluster
+    - name: downloads-cifs-pvcs
+  path: ./kubernetes/apps/downloads/sonarr/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app

kubernetes/apps/external-secrets/app/helmrelease.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: external-secrets
-      version: 0.10.5
+      version: 0.11.0
       sourceRef:
         kind: HelmRepository
         name: external-secrets

kubernetes/apps/external-secrets/bitwarden/clustersecretstore.yaml

@@ -6,7 +6,7 @@ metadata:
 spec:
   provider:
     webhook:
-      url: "http://bitwarden-cli.kube-system.svc.cluster.local:8087/object/item/{{ .remoteRef.key }}"
+      url: "http://bitwarden-cli.external-secrets.svc.cluster.local:8087/object/item/{{ .remoteRef.key }}"
       headers:
         Content-Type: application/json
       result:
@@ -20,6 +20,6 @@ metadata:
 spec:
   provider:
     webhook:
-      url: "http://bitwarden-cli.kube-system.svc.cluster.local:8087/object/item/{{ .remoteRef.key }}"
+      url: "http://bitwarden-cli.external-secrets.svc.cluster.local:8087/object/item/{{ .remoteRef.key }}"
       result:
         jsonPath: "$.data.fields[?@.name==\"{{ .remoteRef.property }}\"].value"

kubernetes/apps/external-secrets/bitwarden/helmrelease.yaml

@@ -53,17 +53,15 @@ spec:
                 spec:
                   exec:
                     command:
-                      - "/bin/bash"
+                      - /usr/bin/curl
-                      - -c
+                      - -X
-                      - curl
+                      - POST
-                      - -X POST
+                      - -s
-                      - -s http://127.0.0.1:8087/sync
+                      - http://127.0.0.1:8087/sync
                   initialDelaySeconds: 20
                   failureThreshold: 3
                   timeoutSeconds: 10
                   periodSeconds: 120
-              readiness:
-                enabled: false
             resources:
               requests:
                 memory: 256Mi

kubernetes/apps/helpers/homepage/app/externalsecret.yaml

@@ -0,0 +1,55 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: &name homepage
+spec:
+  target:
+    name: *name
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        # HOMEPAGE_VAR_LIDARR_TOKEN: "{{ .LIDARR_API_KEY }}"
+        # HOMEPAGE_VAR_OVERSEERR_TOKEN: "{{ .OVERSEERR_API_KEY }}"
+        # HOMEPAGE_VAR_PLEX_TOKEN: "{{ .PLEX_TOKEN }}"
+        HOMEPAGE_VAR_PROWLARR_TOKEN: "{{ .PROWLARR_API_KEY }}"
+        HOMEPAGE_VAR_RADARR_TOKEN: "{{ .RADARR_API_KEY }}"
+        # HOMEPAGE_VAR_READARR_TOKEN: "{{ .READARR_API_KEY }}"
+        HOMEPAGE_VAR_SABNZBD_TOKEN: "{{ .SABNZBD_API_KEY }}"
+        HOMEPAGE_VAR_SONARR_TOKEN: "{{ .SONARR_API_KEY }}"
+        # HOMEPAGE_VAR_TAUTULLI_TOKEN: "{{ .TAUTULLI_API_KEY }}"
+  data:
+    - secretKey: PROWLARR_API_KEY
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: ae9d8486-9279-4790-ac34-64c8922bb414
+        property: password
+    - secretKey: RADARR_API_KEY
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 093af32f-2565-4807-9574-6b6a886a4e03
+        property: password
+    - secretKey: SABNZBD_API_KEY
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: f6eb2b25-18a4-4f3f-af8e-38a6ee61787b
+        property: username
+    - secretKey: SONARR_API_KEY
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: cccf2793-8f91-47da-be0d-63f08cdeda95
+        property: password

kubernetes/apps/helpers/homepage/app/helmrelease.yaml

@@ -0,0 +1,115 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app homepage
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    controllers:
+      homepage:
+        annotations:
+          configmap.reloader.stakater.com/reload: *app
+          secret.reloader.stakater.com/reload: *app
+        containers:
+          app:
+            image:
+              repository: ghcr.io/gethomepage/homepage
+              tag: v0.9.13@sha256:1504b26bd82523e68adbae8c5a908d1633d02c68c65b62d084d81a6866552db6
+            env:
+              TZ: "${TIMEZONE}"
+            envFrom:
+              - secretRef:
+                  name: *app
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: ["ALL"] }
+            resources:
+              requests:
+                cpu: 10m
+                memory: 128Mi
+              limits:
+                memory: 768Mi
+    defaultPodOptions:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 568
+        runAsGroup: 568
+        fsGroup: 568
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile: { type: RuntimeDefault }
+    service:
+      app:
+        controller: *app
+        ports:
+          http:
+            port: 3000
+    serviceAccount:
+      create: true
+      name: *app
+    ingress:
+      app:
+        className: internal
+        annotations:
+          external-dns.alpha.kubernetes.io/target: internal.${SECRET_INTERNAL_DOMAIN}
+        hosts:
+          - host: "home.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+    persistence:
+      logs:
+        type: emptyDir
+        globalMounts:
+          - path: /app/config/logs
+      config:
+        type: emptyDir
+        globalMounts:
+          - path: /app/config
+      # services:
+      #   type: secret
+      #   name: *app
+      #   globalMounts:
+      #     - subPath: services.yaml
+      #       path: /app/config/services.yaml
+      #       readOnly: true
+      configmap:
+        type: configMap
+        name: *app
+        globalMounts:
+          - subPath: bookmarks.yaml
+            path: /app/config/bookmarks.yaml
+            readOnly: true
+          - subPath: docker.yaml
+            path: /app/config/docker.yaml
+            readOnly: true
+          - subPath: kubernetes.yaml
+            path: /app/config/kubernetes.yaml
+            readOnly: true
+          - subPath: settings.yaml
+            path: /app/config/settings.yaml
+            readOnly: true
+          - subPath: widgets.yaml
+            path: /app/config/widgets.yaml
+            readOnly: true

kubernetes/apps/helpers/homepage/app/kustomization.yaml

@@ -0,0 +1,19 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./rbac.yaml
+  - ./externalsecret.yaml
+  - ./helmrelease.yaml
+configMapGenerator:
+  - name: homepage
+    files:
+      - bookmarks.yaml=./resources/bookmarks.yaml
+      - docker.yaml=./resources/docker.yaml
+      - kubernetes.yaml=./resources/kubernetes.yaml
+      # - services.yaml=./resources/services.yaml
+      - settings.yaml=./resources/settings.yaml
+      - widgets.yaml=./resources/widgets.yaml
+generatorOptions:
+  disableNameSuffixHash: true

kubernetes/apps/helpers/homepage/app/rbac.yaml

@@ -0,0 +1,50 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: homepage
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - namespaces
+      - pods
+      - nodes
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - extensions
+      - networking.k8s.io
+    resources:
+      - ingresses
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - metrics.k8s.io
+    resources:
+      - nodes
+      - pods
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions/status
+    verbs:
+      - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: &app homepage
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: homepage
+subjects:
+  - kind: ServiceAccount
+    name: *app
+    namespace: default

kubernetes/apps/helpers/homepage/app/resources/bookmarks.yaml

@@ -0,0 +1,23 @@
+- Communicate:
+    - Discord:
+        - icon: discord.png
+          href: "https://discord.com/app"
+    - Gmail:
+        - icon: gmail.png
+          href: "https://mail.kraven.org"
+    - Google Calendar:
+        - icon: google-calendar.png
+          href: "https://calendar.google.com"
+    - Google Voice:
+        - icon: google-voice.png
+          href: "https://voice.google.com"
+- Git:
+    - kubesearch:
+        - icon: kubernetes-dashboard.png
+          href: "https://kubesearch.dev/"
+    - talos-cluster:
+        - icon: github.png
+          href: "https://github.com/brunnels/talos-cluster"
+    - cluster-template:
+        - icon: github.png
+          href: "https://github.com/onedr0p/cluster-template"

kubernetes/apps/helpers/homepage/app/resources/kubernetes.yaml

@@ -0,0 +1 @@
+mode: cluster

kubernetes/apps/helpers/homepage/app/resources/services.yaml

@@ -0,0 +1,23 @@
+- Infrastructure:
+    - Unraid:
+        icon: unraid
+        href: http://192.168.1.68
+        description: Unraid
+        widget:
+          type: unraid
+          url: https//192.168.1.68
+          username: root
+          password: dlord781
+- Calendar:
+    - Agenda:
+        widget:
+          type: calendar
+          view: agenda
+          maxEvents: 20
+          integrations:
+            - type: sonarr
+              service_group: Downloads
+              service_name: Sonarr
+            - type: radarr
+              service_group: Downloads
+              service_name: Radarr

kubernetes/apps/helpers/homepage/app/resources/settings.yaml

@@ -0,0 +1,69 @@
+title: Dashboard
+favicon: "https://raw.githubusercontent.com/brunnels/assets/main/homepage/icons/heimdall.svg"
+theme: dark
+background:
+  image: https://images.unsplash.com/photo-1502790671504-542ad42d5189?auto=format&fit=crop&w=2560&q=80
+  blur: sm
+  saturate: 50
+  brightness: 50
+  opacity: 50
+color: slate
+headerStyle: clean
+providers:
+  longhorn:
+    url: http://longhorn-frontend.longhorn-system
+layout:
+#  Automation:
+#    style: column
+#  Infrastructure:
+#    icon: mdi-server
+#    style: column
+#  Git:
+#    icon: mdi-desktop-tower
+#    style: column
+#  Storage:
+#    icon: mdi-desktop-tower
+#    style: column
+#  Tools:
+#    style: column
+#  Observability:
+#    icon: mdi-chart-line
+#    style: row
+#    columns: 4
+#  Media:
+#    icon: mdi-play-circle
+#    style: row
+#    columns: 4
+#  Downloads:
+#    icon: mdi-download-circle
+#    style: row
+#    columns: 4
+  Home:
+    style: column
+    icon: mdi-home-analytics
+  Git:
+    style: column
+    icon: mdi-desktop-tower
+  Storage:
+    style: row
+    columns: 2
+    icon: mdi-desktop-tower
+  Calendar:
+    style: column
+    icon: mdi-calendar
+  Media:
+    style: column
+    icon: mdi-play-circle
+  Infrastructure:
+    style: column
+    icon: mdi-server
+  DNS:
+    style: column
+    icon: mdi-server
+  Observability:
+    style: column
+    icon: mdi-chart-line
+  Downloads:
+    style: row
+    columns: 3
+    icon: mdi-download-circle

kubernetes/apps/helpers/homepage/app/resources/widgets.yaml

@@ -0,0 +1,32 @@
+- resources:
+    backend: kubernetes
+    cpu: true
+    expanded: true
+    memory: true
+- kubernetes:
+    cluster:
+      cpu: true
+      label: cluster
+      memory: true
+      show: true
+      showLabel: true
+    nodes:
+      cpu: true
+      memory: true
+      show: false
+      showLabel: true
+- search:
+    provider: [duckduckgo, google]
+    target: _blank
+- openmeteo:
+    latitude: "${SECRET_LATITUDE}"
+    longitude: "${SECRET_LONGITUDE}"
+    timezone: "${TIMEZONE}"
+    units: imperial
+    cache: 15
+- datetime:
+    text_size: l
+    format:
+      dateStyle: long
+      timeStyle: short
+      hourCycle: h23

kubernetes/apps/helpers/homepage/ks.yaml

@@ -0,0 +1,26 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app homepage
+  namespace: flux-system
+spec:
+  targetNamespace: default
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: external-secrets
+  path: ./kubernetes/apps/helpers/homepage/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app

kubernetes/apps/helpers/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./namespace.yaml
+  - ./homepage/ks.yaml
+  - ./theme-park/ks.yaml

kubernetes/apps/helpers/namespace.yaml

@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://kubernetesjsonschema.dev/v1.18.1-standalone-strict/namespace-v1.json
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: default
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled

kubernetes/apps/helpers/theme-park/app/helmrelease.yaml

@@ -0,0 +1,73 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app theme-park
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    controllers:
+      theme-park:
+        replicas: 2
+        strategy: RollingUpdate
+        containers:
+          app:
+            image:
+              repository: ghcr.io/onedr0p/theme-park
+              tag: 1.18.0@sha256:210d8f5d9466df493503184fb076bbf1fb9fbc2b42e273cd4516ac3fd1df7ba2
+            resources:
+              requests:
+                cpu: 10m
+                memory: 32Mi
+              limits:
+                memory: 64Mi
+    defaultPodOptions:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 568
+        runAsGroup: 568
+        fsGroup: 568
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile: { type: RuntimeDefault }
+    service:
+      app:
+        controller: *app
+        ports:
+          http:
+            port: 8080
+    ingress:
+      app:
+        className: internal
+        # annotations:
+        #   external-dns.alpha.kubernetes.io/target: external.${SECRET_DOMAIN}
+        hosts:
+          - host: "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                service:
+                  identifier: app
+                  port: http
+    topologySpreadConstraints:
+      - maxSkew: 1
+        topologyKey: kubernetes.io/hostname
+        whenUnsatisfiable: DoNotSchedule
+        labelSelector:
+          matchLabels:
+            app.kubernetes.io/name: *app

kubernetes/apps/helpers/theme-park/app/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml

kubernetes/apps/helpers/theme-park/ks.yaml

@@ -0,0 +1,24 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app theme-park
+  namespace: flux-system
+spec:
+  targetNamespace: default
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/helpers/theme-park/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app

kubernetes/apps/media/jellyfin/app/helmrelease.yaml

@@ -0,0 +1,128 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app jellyfin
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  maxHistory: 2
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  uninstall:
+    keepHistory: false
+  values:
+    defaultPodOptions:
+      enableServiceLinks: false
+      securityContext:
+        runAsUser: 568
+        runAsGroup: 568
+        fsGroup: 568
+        fsGroupChangePolicy: OnRootMismatch
+    controllers:
+      jellyfin:
+        annotations:
+          reloader.stakater.com/auto: "true"
+        containers:
+          app:
+            image:
+              repository: ghcr.io/jellyfin/jellyfin
+              tag: 10.10.3@sha256:17c3a8d9dddb97789b5f37112840ebf96566442c14d4754193a6c2eb154bc221
+            env:
+              DOTNET_SYSTEM_IO_DISABLEFILELOCKING: "true"
+              JELLYFIN_FFmpeg__probesize: 50000000
+              JELLYFIN_FFmpeg__analyzeduration: 50000000
+              JELLYFIN_PublishedServerUrl: &loadBalancerIP ${CLUSTER_LB_JELLYFIN}
+              TZ: ${TIMEZONE}
+            probes:
+              liveness: &probes
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /health
+                    port: &port 8096
+                  initialDelaySeconds: 0
+                  periodSeconds: 10
+                  timeoutSeconds: 1
+                  failureThreshold: 3
+              readiness: *probes
+              startup:
+                enabled: false
+            resources:
+              requests:
+                # gpu.intel.com/i915: 1
+                cpu: 100m
+                memory: 512Mi
+              limits:
+                # gpu.intel.com/i915: 1
+                memory: 4Gi
+    service:
+      app:
+        controller: *app
+        ports:
+          http:
+            port: *port
+    ingress:
+      app:
+        enabled: true
+        className: internal
+        hosts:
+          - host: &host "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                service:
+                  identifier: app
+                  port: http
+    persistence:
+      config:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/k3s/config/jellyfin
+      music:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/music
+        globalMounts:
+          - path: /var/mnt/vol1/music
+      photo:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/photos/original
+        globalMounts:
+          - path: /var/mnt/vol1/photo
+      video:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/movies
+        globalMounts:
+          - path: /var/mnt/vol1/video
+      transcode:
+        enabled: true
+        type: emptyDir
+        globalMounts:
+          - path: /transcode
+      cache:
+        enabled: true
+        type: emptyDir
+        globalMounts:
+          - path: /cache

kubernetes/apps/media/jellyfin/app/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/SchemaStore/schemastore/master/src/schemas/json/kustomization.json
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml

kubernetes/apps/media/jellyfin/ks.yaml

@@ -0,0 +1,26 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app jellyfin
+  namespace: flux-system
+spec:
+  targetNamespace: media
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: external-secrets
+  path: ./kubernetes/apps/media/jellyfin/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app

kubernetes/apps/media/kustomization.yaml

@@ -0,0 +1,12 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./namespace.yaml
+  - ./jellyfin/ks.yaml
+  - ./overseerr/ks.yaml
+  - ./tautulli/ks.yaml
+  - ./plex/ks.yaml
+generatorOptions:
+  disableNameSuffixHash: true

kubernetes/apps/media/namespace.yaml

@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://kubernetesjsonschema.dev/v1.18.1-standalone-strict/namespace-v1.json
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: media
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled

kubernetes/apps/media/overseerr/app/helmrelease.yaml

@@ -0,0 +1,115 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app overseerr
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    controllers:
+      overseerr:
+        annotations:
+          reloader.stakater.com/auto: "true"
+        containers:
+          app:
+            image:
+              repository: ghcr.io/sct/overseerr
+              tag: rolling@sha256:714ea6db2bc007a2262d112bef7eec74972eb33d9c72bddb9cbd98b8742de950
+            env:
+              TZ: "${TIMEZONE}"
+              LOG_LEVEL: "info"
+              PORT: &port 80
+            probes:
+              liveness: &probes
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /api/v1/status
+                    port: *port
+                  initialDelaySeconds: 0
+                  periodSeconds: 10
+                  timeoutSeconds: 1
+                  failureThreshold: 3
+              readiness: *probes
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: [ "ALL" ] }
+            resources:
+              requests:
+                cpu: 10m
+                memory: 128Mi
+              limits:
+                memory: 4Gi
+    defaultPodOptions:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 568
+        runAsGroup: 568
+        fsGroup: 568
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile: { type: RuntimeDefault }
+    service:
+      app:
+        controller: *app
+        ports:
+          http:
+            port: *port
+    ingress:
+      app:
+        className: internal
+        # annotations:
+        #   external-dns.alpha.kubernetes.io/target: external.${SECRET_DOMAIN}
+        #   gethomepage.dev/enabled: "true"
+        #   gethomepage.dev/group: Media
+        #   gethomepage.dev/name: Overseerr
+        #   gethomepage.dev/icon: overseerr
+        #   gethomepage.dev/description: Media Request Management
+        #   gethomepage.dev/widget.type: overseerr
+        #   gethomepage.dev/widget.url: http://overseerr.media
+        #   gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_OVERSEERR_TOKEN}}` }}"
+        hosts:
+          - host: "requests.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                service:
+                  identifier: app
+                  port: http
+    persistence:
+      config:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/k3s/config/overseerr
+        globalMounts:
+          - path: /app/config
+      cache:
+        storageClass: openebs-hostpath
+        accessMode: ReadWriteOnce
+        size: 15Gi
+        globalMounts:
+          - path: /app/config/cache
+      logs:
+        type: emptyDir
+        globalMounts:
+          - path: /app/config/logs
+      tmp:
+        type: emptyDir

kubernetes/apps/media/overseerr/app/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
+  # - ../../../../templates/gatus/external

kubernetes/apps/media/overseerr/ks.yaml

@@ -0,0 +1,24 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app overseerr
+  namespace: flux-system
+spec:
+  targetNamespace: media
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/media/overseerr/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app

kubernetes/apps/media/plex/app/externalsecret.yaml

@@ -0,0 +1,23 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: &name plex
+spec:
+  target:
+    name: *name
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        PLEX_CLAIM: "{{ .PLEX_CLAIM }}"
+  data:
+    - secretKey: PLEX_CLAIM
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretApiKey 8406f7ea-46b0-42ed-bcae-a83984d7b6ae
+        property: password

kubernetes/apps/media/plex/app/helmrelease.yaml

@@ -0,0 +1,149 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app plex
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    controllers:
+      plex:
+        annotations:
+          reloader.stakater.com/auto: "true"
+        containers:
+          app:
+            image:
+              repository: ghcr.io/onedr0p/plex
+              tag: rolling@sha256:1f28b5e5a964481f80e76db3c986082d2fc3bca2d16d2742704e9adf8349c79c
+            env:
+              TZ: "${TIMEZONE}"
+              ALLOWED_NETWORKS: "${LAN_CIDR},${CLUSTER_CIDR},${SERVICE_CIDR}"
+              PLEX_ADVERTISE_URL: "http://172.16.10.4:32400,https://plex.${SECRET_INTERNAL_DOMAIN}"
+              PLEX_PREFERENCE_1: "AllowMediaDeletion=0"
+              PLEX_PREFERENCE_2: "EnableIPv6=0"
+              PLEX_PREFERENCE_3: "FriendlyName=LordFamilyFlix"
+              PLEX_PREFERENCE_4: "LanNetworksBandwidth=${LAN_CIDR}"
+            envFrom:
+              - secretRef:
+                  name: *app
+            probes:
+              liveness: &probes
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /identity
+                    port: &port 32400
+                  initialDelaySeconds: 0
+                  periodSeconds: 10
+                  timeoutSeconds: 1
+                  failureThreshold: 3
+              readiness: *probes
+            resources:
+              requests:
+                cpu: 50m
+                memory: 512Mi
+              limits:
+                memory: 4Gi
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: ["ALL"] }
+    defaultPodOptions:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile: { type: RuntimeDefault }
+    service:
+      app:
+        controller: *app
+        type: LoadBalancer
+        ports:
+          http:
+            port: *port
+    ingress:
+      app:
+        className: internal
+        # annotations:
+        #   external-dns.alpha.kubernetes.io/target: external.${SECRET_DOMAIN}
+        #   gethomepage.dev/enabled: "true"
+        #   gethomepage.dev/group: Media
+        #   gethomepage.dev/name: Plex
+        #   gethomepage.dev/icon: plex
+        #   gethomepage.dev/description: Media Player
+        #   gethomepage.dev/widget.type: plex
+        #   gethomepage.dev/widget.url: http://plex.media:32400
+        #   gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_PLEX_TOKEN}}` }}"
+        #   nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+        #   nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET}
+        hosts:
+          - host: "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                service:
+                  identifier: app
+                  port: http
+    persistence:
+      config:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/k3s/config/plex
+      cache:
+        storageClass: openebs-hostpath
+        accessMode: ReadWriteOnce
+        size: 10Gi
+        globalMounts:
+          - path: "/config/Library/Application Support/Plex Media Server/Cache"
+      tmp:
+        type: emptyDir
+      transcode:
+        type: emptyDir
+      movies:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/movies
+        globalMounts:
+          - path: /media/movies
+      music:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/music
+        globalMounts:
+          - path: /media/music
+      pictures:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/photos/original
+        globalMounts:
+          - path: /media/photos
+      tv:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/shows
+        globalMounts:
+          - path: /media/tv

kubernetes/apps/media/plex/app/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./externalsecret.yaml
+  - ./helmrelease.yaml

kubernetes/apps/media/plex/ks.yaml

@@ -0,0 +1,24 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app plex
+  namespace: flux-system
+spec:
+  targetNamespace: media
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/media/plex/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app

kubernetes/apps/media/tautulli/app/helmrelease.yaml

@@ -0,0 +1,104 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app tautulli
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    controllers:
+      tautulli:
+        annotations:
+          reloader.stakater.com/auto: "true"
+        containers:
+          app:
+            image:
+              repository: ghcr.io/onedr0p/tautulli
+              tag: rolling@sha256:96285c7e57dc77b790bb934be25d1d18a7c220b0f9e29748f65b2374bbef24c8
+            env:
+              TZ: America/Denver
+              TAUTULLI__PORT: &port 80
+            probes:
+              liveness: &probes
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /status
+                    port: *port
+                  initialDelaySeconds: 0
+                  periodSeconds: 10
+                  timeoutSeconds: 1
+                  failureThreshold: 3
+              readiness: *probes
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: [ "ALL" ] }
+            resources:
+              requests:
+                cpu: 10m
+                memory: 128Mi
+              limits:
+                memory: 4Gi
+    defaultPodOptions:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 568
+        runAsGroup: 568
+        fsGroup: 568
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile: { type: RuntimeDefault }
+    service:
+      app:
+        controller: *app
+        ports:
+          http:
+            port: *port
+    ingress:
+      app:
+        className: internal
+        # annotations:
+        #   external-dns.alpha.kubernetes.io/target: internal.${SECRET_DOMAIN}
+        #   gethomepage.dev/enabled: "true"
+        #   gethomepage.dev/group: Media
+        #   gethomepage.dev/name: Tautulli
+        #   gethomepage.dev/icon: tautulli
+        #   gethomepage.dev/description: Plex Stream Monitoring
+        #   gethomepage.dev/widget.type: tautulli
+        #   gethomepage.dev/widget.url: http://tautulli.media
+        #   gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_TAUTULLI_TOKEN}}` }}"
+        hosts:
+          - host: "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                service:
+                  identifier: app
+                  port: http
+    persistence:
+      config:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/k3s/config/tautulli
+      tmp:
+        type: emptyDir
+      add-ons:
+        type: emptyDir

kubernetes/apps/media/tautulli/app/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
+  # - ../../../../templates/gatus/guarded

kubernetes/apps/media/tautulli/ks.yaml

@@ -0,0 +1,24 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app tautulli
+  namespace: flux-system
+spec:
+  targetNamespace: media
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/media/tautulli/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app

kubernetes/apps/network/cloudflared/app/helmrelease.yaml

@@ -30,7 +30,7 @@ spec:
           app:
             image:
               repository: docker.io/cloudflare/cloudflared
-              tag: 2024.11.0
+              tag: 2024.11.1
             env:
               NO_AUTOUPDATE: true
               TUNNEL_CRED_FILE: /etc/cloudflared/creds/credentials.json

kubernetes/apps/network/external-dns/app/cloudflared/helmrelease.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: external-dns
-      version: 1.15.0
+      version: 1.16.1
       sourceRef:
         kind: HelmRepository
         name: external-dns

kubernetes/apps/network/external-dns/app/unifi/helmrelease.yaml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: external-dns
-      version: 1.15.0
+      version: 1.16.1
       sourceRef:
         kind: HelmRepository
         name: external-dns
@@ -30,7 +30,7 @@ spec:
       webhook:
         image:
           repository: ghcr.io/kashalls/external-dns-unifi-webhook
-          tag: v0.3.1@sha256:593eeb3594a8418084d3235b2a30ca8aa4c58b949fac3433b86df6c725364e32
+          tag: v0.3.2@sha256:f8cf534970560bc8d1a61cc13f7c9580d91be60f5c6c7a86c3be0ca362208500
         env:
           - name: UNIFI_HOST
             value: https://192.168.10.1
@@ -66,7 +66,7 @@ spec:
     sources: ["crd", "ingress"]
     txtPrefix: k8s.
     txtOwnerId: default
-    domainFilters: ["${SECRET_DOMAIN_INTERNAL}", "${SECRET_DOMAIN}"]
+    domainFilters: ["${SECRET_INTERNAL_DOMAIN}", "${SECRET_DOMAIN}"]
     serviceMonitor:
       enabled: true
     podAnnotations:

kubernetes/apps/network/ingress-nginx/internal/helmrelease.yaml

@@ -64,7 +64,7 @@ spec:
           namespaceSelector:
             any: true
       extraArgs:
-        default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
+        default-ssl-certificate: "network/${SECRET_INTERNAL_DOMAIN/./-}-production-tls"
       resources:
         requests:
           cpu: 100m

kubernetes/apps/storage/csi-driver-nfs/app/helmrelease.yaml

@@ -0,0 +1,30 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &chart csi-driver-nfs
+  namespace: system
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: *chart
+      version: v4.9.0
+      sourceRef:
+        kind: HelmRepository
+        name: csi-driver-nfs
+        namespace: flux-system
+  maxHistory: 2
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  values:
+    controller:
+      replicas: 2
+    feature:
+      enableFSGroupPolicy: true

kubernetes/apps/storage/csi-driver-nfs/app/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./storage-classes
+  - ./helmrelease.yaml

kubernetes/apps/storage/csi-driver-nfs/app/storage-classes/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./provisions.yaml

kubernetes/apps/storage/csi-driver-nfs/app/storage-classes/provisions.yaml

@@ -0,0 +1,40 @@
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: nfs-provision-csi
+  labels:
+    kustomize.toolkit.fluxcd.io/substitute: "disabled"
+provisioner: nfs.csi.k8s.io
+parameters:
+  server: 192.168.1.68
+  share: /mnt/user/k3s/
+allowVolumeExpansion: true
+reclaimPolicy: Retain
+volumeBindingMode: Immediate
+mountOptions:
+  - nfsvers=4.1
+  - nconnect=8
+  - hard
+  - noatime
+  - nodiratime
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: nfs-provision-csi-database
+  labels:
+    kustomize.toolkit.fluxcd.io/substitute: "disabled"
+provisioner: nfs.csi.k8s.io
+parameters:
+  server: 192.168.1.68
+  share: /mnt/user/cnpg
+allowVolumeExpansion: true
+reclaimPolicy: Retain
+volumeBindingMode: Immediate
+mountOptions:
+  - nfsvers=4.1
+  - nconnect=8
+  - hard
+  - noatime
+  - nodiratime

kubernetes/apps/storage/csi-driver-nfs/ks.yaml

@@ -0,0 +1,20 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app csi-driver-nfs
+  namespace: flux-system
+spec:
+  targetNamespace: kube-system
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/storage/csi-driver-nfs/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  timeout: 5m

kubernetes/apps/storage/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./namespace.yaml
+  - ./csi-driver-nfs/ks.yaml

kubernetes/apps/storage/namespace.yaml

@@ -0,0 +1,9 @@
+---
+# yaml-language-server: $schema=https://kubernetesjsonschema.dev/v1.18.1-standalone-strict/namespace-v1.json
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: storage
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled
+    pod-security.kubernetes.io/enforce: privileged

kubernetes/bootstrap/helmfile.yaml

@@ -30,7 +30,7 @@ releases:
   - name: coredns
     namespace: kube-system
     chart: coredns/coredns
-    version: 1.36.0
+    version: 1.36.1
     values:
       - ../apps/kube-system/coredns/app/helm-values.yaml
     needs:

kubernetes/bootstrap/talos/talconfig.yaml

@@ -1,7 +1,7 @@
 # yaml-language-server: $schema=https://raw.githubusercontent.com/budimanjojo/talhelper/master/pkg/config/schemas/talconfig.json
 ---
 # renovate: datasource=docker depName=ghcr.io/siderolabs/installer
-talosVersion: v1.8.1
+talosVersion: v1.8.3
 # renovate: datasource=docker depName=ghcr.io/siderolabs/kubelet
 kubernetesVersion: v1.31.2
 

kubernetes/flux/repositories/helm/bitnami.yaml

@@ -0,0 +1,11 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: bitnami
+  namespace: flux-system
+spec:
+  type: oci
+  interval: 5m
+  url: oci://registry-1.docker.io/bitnamicharts