feat(container): update image reloader to v1.3.0

Reviewed-on: http://192.168.1.68:3001/infra/home-cluster/pulls/20
Reviewed-by: dlord <dlaccount@icloud.com>

.github/workflows/flux-diff.yaml

@@ -35,7 +35,7 @@ jobs:
           path: default
 
       - name: Diff Resources
-        uses: docker://ghcr.io/allenporter/flux-local:v6.0.2
+        uses: docker://ghcr.io/allenporter/flux-local:v6.1.1
         with:
           args: >-
             diff ${{ matrix.resources }}

.github/workflows/renovate.yaml

@@ -10,7 +10,7 @@ on:
 jobs:
   renovate:
     runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:39.17.1
+    container: ghcr.io/renovatebot/renovate:39.251.0
     steps:
       - uses: actions/checkout@v4
       - run: renovate

bootstrap/templates/kubernetes/apps/kube-system/reloader/app/helmrelease.yaml.j2

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: reloader
-      version: 1.1.0
+      version: 1.3.0
       sourceRef:
         kind: HelmRepository
         name: stakater

bootstrap/templates/kubernetes/apps/network/cloudflared/app/helmrelease.yaml.j2

@@ -30,7 +30,7 @@ spec:
           app:
             image:
               repository: docker.io/cloudflare/cloudflared
-              tag: 2024.11.0
+              tag: 2024.11.1
             env:
               NO_AUTOUPDATE: true
               TUNNEL_CRED_FILE: /etc/cloudflared/creds/credentials.json

kubernetes/apps/capacitor/capacitor/app/helmrelease.yaml

@@ -42,11 +42,16 @@ spec:
               repository: ghcr.io/gimlet-io/capacitor
               tag: v0.4.8@sha256:a80207f52c054dba9e04e8b1ea86e297817ecf05ddbfce249c1f5eaf6ce8c7d8
             securityContext:
+              runAsNonRoot: true
+              runAsUser: 100
+              runAsGroup: 101
               allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
               capabilities:
                 drop:
                   - ALL
-              readOnlyRootFilesystem: true
+              seccompProfile:
+                type: RuntimeDefault
 
             probes:
               startup:
@@ -90,7 +95,7 @@ spec:
         enabled: true
         className: internal
         hosts:
-          - host: &host "{{ .Release.Name }}.k8s.home.arpa"
+          - host: &host "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
             paths:
               - path: /
                 pathType: Prefix

kubernetes/apps/capacitor/capacitor/app/rbac.yaml

@@ -1,48 +1,50 @@
----
 apiVersion: v1
 kind: ServiceAccount
 metadata:
   name: capacitor
+  namespace: flux-system
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
   name: capacitor
 rules:
-  - apiGroups:
+- apiGroups:
-      - networking.k8s.io
+    - networking.k8s.io
-      - apps
+    - apps
-      - ""
+    - ""
-    resources:
+  resources:
-      - pods
+    - pods
-      - pods/log
+    - pods/log
-      - ingresses
+    - ingresses
-      - deployments
+    - deployments
-      - services
+    - services
-      - secrets
+    - secrets
-      - events
+    - events
-      - configmaps
+    - configmaps
-    verbs:
+  verbs:
-      - get
+    - get
-      - watch
+    - watch
-      - list
+    - list
-  - apiGroups:
+- apiGroups:
-      - source.toolkit.fluxcd.io
+    - source.toolkit.fluxcd.io
-      - kustomize.toolkit.fluxcd.io
+    - kustomize.toolkit.fluxcd.io
-      - helm.toolkit.fluxcd.io
+    - helm.toolkit.fluxcd.io
-    resources:
+    - infra.contrib.fluxcd.io
-      - gitrepositories
+  resources:
-      - ocirepositories
+    - gitrepositories
-      - buckets
+    - ocirepositories
-      - helmrepositories
+    - buckets
-      - helmcharts
+    - helmrepositories
-      - kustomizations
+    - helmcharts
-      - helmreleases
+    - kustomizations
-    verbs:
+    - helmreleases
-      - get
+    - terraforms
-      - watch
+  verbs:
-      - list
+    - get
-      - patch # to allow force reconciling by adding an annotation
+    - watch
+    - list
+    - patch # to allow force reconciling by adding an annotation
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding

kubernetes/apps/databases/redis/app/helmrelease.yaml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: *app
-      version: 20.2.1
+      version: 20.4.0
       sourceRef:
         kind: HelmRepository
         name: bitnami

kubernetes/apps/downloads/kustomization.yaml

@@ -8,12 +8,10 @@ resources:
   # - ./flaresolverr/ks.yaml
   # - ./flood/ks.yaml
   # - ./lidarr/ks.yaml
-  # - ./prowlarr/ks.yaml
+  - ./prowlarr/ks.yaml
   - ./radarr/ks.yaml
-  # - ./readarr/ks.yaml
+  - ./sabnzbd/ks.yaml
-  # - ./sabnzbd/ks.yaml
+  - ./sonarr/ks.yaml
-  # - ./sonarr/ks.yaml
-#  - ./unpackerr/ks.yaml
 # configMapGenerator:
 #   - name: authelia-ingress-hv
 #     namespace: downloads

kubernetes/apps/downloads/prowlarr/app/helmrelease.yaml

@@ -36,7 +36,7 @@ spec:
           init-db:
             image:
               repository: ghcr.io/onedr0p/postgres-init
-              tag: 16.4@sha256:e41c745b54485341e00efbd27556f0717623a119f0d5107e5ff831aa1322c76f
+              tag: 16.6@sha256:35353a77777ee8f634d0f3945f495b4a40065134b8619e0d18bd49b0ee9c855b
             envFrom: &envFrom
               - secretRef:
                   name: *app
@@ -44,7 +44,7 @@ spec:
           app:
             image:
               repository: ghcr.io/onedr0p/prowlarr-develop
-              tag: 1.26.0@sha256:face4aa669a4eb68b041dcf73ed4848cfe8f673826ef3032398a5e267eb1eac0
+              tag: rolling@sha256:155e7c757880e6afc5933b3060dfaec1c79712caf68031096fd5866ae4a31d0f
             env:
               TZ: "${TIMEZONE}"
               PROWLARR__APP__INSTANCENAME: Prowlarr
@@ -99,8 +99,19 @@ spec:
       app:
         enabled: true
         className: internal
+        annotations:
+          external-dns.alpha.kubernetes.io/target: internal.${SECRET_DOMAIN}
+          gethomepage.dev/enabled: "true"
+          gethomepage.dev/group: Downloads
+          gethomepage.dev/name: Prowlarr
+          gethomepage.dev/icon: prowlarr.png
+          gethomepage.dev/description: Torrent/NZB Indexer Management
+          gethomepage.dev/widget.type: prowlarr
+          gethomepage.dev/widget.url: http://prowlarr.downloads
+          gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_PROWLARR_TOKEN}}` }}"
+          nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET}
         hosts:
-          - host: &host "{{ .Release.Name }}.k8s.home.arpa"
+          - host: &host "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
             paths:
               - path: /
                 pathType: Prefix
@@ -111,28 +122,11 @@ spec:
           - hosts:
               - *host
             secretName: "{{ .Release.Name }}-tls"
-      # app:
-      #   className: internal
-      #   annotations:
-      #     external-dns.alpha.kubernetes.io/target: internal.${SECRET_INTERNAL_DOMAIN}
-      #     # gethomepage.dev/enabled: "true"
-      #     # gethomepage.dev/group: Downloads
-      #     # gethomepage.dev/name: Prowlarr
-      #     # gethomepage.dev/icon: prowlarr.png
-      #     # gethomepage.dev/description: Torrent/NZB Indexer Management
-      #     # gethomepage.dev/widget.type: prowlarr
-      #     # gethomepage.dev/widget.url: http://prowlarr.downloads
-      #     # gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_PROWLARR_TOKEN}}` }}"
-      #     # nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET}
-      #   hosts:
-      #     - host: "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
-      #       paths:
-      #         - path: /
-      #           service:
-      #             identifier: app
-      #             port: http
     persistence:
       config:
-        existingClaim: cifs-appdata
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/k3s/config/prowlarr
       tmp:
         type: emptyDir

kubernetes/apps/downloads/prowlarr/ks.yaml

@@ -12,7 +12,7 @@ spec:
       app.kubernetes.io/name: *app
   dependsOn:
     - name: cloudnative-pg-cluster
-    - name: external-secrets
+    - name: downloads-cifs-pvcs
   path: ./kubernetes/apps/downloads/prowlarr/app
   prune: true
   sourceRef:

kubernetes/apps/downloads/radarr/app/helmrelease.yaml

@@ -34,7 +34,7 @@ spec:
           init-db:
             image:
               repository: ghcr.io/onedr0p/postgres-init
-              tag: 16.4@sha256:e41c745b54485341e00efbd27556f0717623a119f0d5107e5ff831aa1322c76f
+              tag: 16.6@sha256:35353a77777ee8f634d0f3945f495b4a40065134b8619e0d18bd49b0ee9c855b
             envFrom: &envFrom
               - secretRef:
                   name: *app
@@ -42,7 +42,7 @@ spec:
           app:
             image:
               repository: ghcr.io/onedr0p/radarr-develop
-              tag: 5.15.0.9412@sha256:3d922f5f80935c1aadbe49597cb4cd509e2890ca0c01d6778ac54825012fdde4
+              tag: rolling@sha256:f21d401a2ce6ebf5401c4dc71e3184ece740fff227a6af0ffa1a51fe4af7627c
             env:
               TZ: "${TIMEZONE}"
               RADARR__APP__INSTANCENAME: Radarr
@@ -97,8 +97,19 @@ spec:
       app:
         enabled: true
         className: internal
+        annotations:
+          external-dns.alpha.kubernetes.io/target: internal.${SECRET_INTERNAL_DOMAIN}
+          gethomepage.dev/enabled: "true"
+          gethomepage.dev/group: Downloads
+          gethomepage.dev/name: Radarr
+          gethomepage.dev/icon: radarr.png
+          gethomepage.dev/description: Movie Downloads
+          gethomepage.dev/widget.type: radarr
+          gethomepage.dev/widget.url: http://radarr.downloads
+          gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_RADARR_TOKEN}}` }}"
+          nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET}
         hosts:
-          - host: &host "{{ .Release.Name }}.k8s.home.arpa"
+          - host: &host "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
             paths:
               - path: /
                 pathType: Prefix
@@ -133,13 +144,17 @@ spec:
       #             port: http
     persistence:
       config:
-        existingClaim: cifs-appdata
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/k3s/config/radarr
       tmp:
         type: emptyDir
       media:
-        existingClaim: cifs-movies
+        enabled: true
-        globalMounts:
+        type: nfs
-          - path: /media/movies
+        server: 192.168.1.68
+        path: /mnt/user/movies
       downloads:
         existingClaim: cifs-downloads
         advancedMounts:

kubernetes/apps/downloads/sabnzbd/app/externalsecret.yaml

@@ -0,0 +1,32 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: &name sabnzbd
+spec:
+  target:
+    name: *name
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        SABNZBD__API_KEY: "{{ .SABNZBD_API_KEY }}"
+        SABNZBD__NZB_KEY: "{{ .SABNZBD_NZB_KEY }}"
+  data:
+    - secretKey: SABNZBD_API_KEY
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretDatabaseKey f6eb2b25-18a4-4f3f-af8e-38a6ee61787b
+        property: username
+    - secretKey: SABNZBD_NZB_KEY
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: *secretDatabaseKey
+        property: password

kubernetes/apps/downloads/sabnzbd/app/helmrelease.yaml

@@ -0,0 +1,141 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app sabnzbd
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  # valuesFrom:
+  #   - kind: ConfigMap
+  #     name: authelia-ingress-hv
+  values:
+    controllers:
+      sabnzbd:
+        annotations:
+          reloader.stakater.com/auto: "true"
+        containers:
+          app:
+            image:
+              repository: ghcr.io/onedr0p/sabnzbd
+              tag: rolling@sha256:86c645db93affcbf01cc2bce2560082bfde791009e1506dba68269b9c50bc341
+            env:
+              TZ: "America/Denver"
+              SABNZBD__PORT: &port 8080
+              SABNZBD__HOST_WHITELIST_ENTRIES: >-
+                sabnzbd,
+                sabnzbd.downloads,
+                sabnzbd.downloads.svc,
+                sabnzbd.downloads.svc.cluster,
+                sabnzbd.downloads.svc.cluster.local,
+                sabnzbd.${SECRET_INTERNAL_DOMAIN}
+            envFrom:
+              - secretRef:
+                  name: *app
+            probes:
+              liveness: &probes
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /api?mode=version
+                    port: *port
+                  initialDelaySeconds: 0
+                  periodSeconds: 10
+                  timeoutSeconds: 1
+                  failureThreshold: 3
+              readiness: *probes
+              startup:
+                enabled: false
+            resources:
+              requests:
+                cpu: 300m
+                memory: 1Gi
+              limits:
+                memory: 4Gi
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: ["ALL"] }
+    defaultPodOptions:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 568
+        runAsGroup: 568
+        fsGroup: 568
+        seccompProfile: { type: RuntimeDefault }
+    service:
+      app:
+        controller: *app
+        ports:
+          http:
+            port: *port
+    ingress:
+      app:
+        enabled: true
+        className: internal
+        annotations:
+          external-dns.alpha.kubernetes.io/target: "internal.${SECRET_DOMAIN}"
+          gethomepage.dev/enabled: "true"
+          gethomepage.dev/group: Downloads
+          gethomepage.dev/name: SABnzbd
+          gethomepage.dev/icon: sabnzbd
+          gethomepage.dev/widget.type: sabnzbd
+          gethomepage.dev/widget.url: http://sabnzbd.downloads:8080
+          gethomepage.dev/widget.key: "{{`{{HOMEPAGE_VAR_SABNZBD_TOKEN}}`}}"
+          nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET}
+        hosts:
+          - host: &host "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - hosts:
+              - *host
+            secretName: "{{ .Release.Name }}-tls"
+    persistence:
+      config:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/k3s/config/sabnzbd
+      tmp:
+        type: emptyDir
+      incomplete:
+        type: emptyDir
+      applications:
+        existingClaim: cifs-appdata
+        globalMounts:
+          - path: /media/applications
+      downloads:
+        existingClaim: cifs-downloads
+        globalMounts:
+          - path: /downloads
+            subPath: sabnzbd
+      # games:
+      #   existingClaim: cifs-games
+      #   globalMounts:
+      #     - path: /media/games
+      # misc:
+      #   existingClaim: cifs-misc
+      #   globalMounts:
+      #     - path: /media/misc

kubernetes/apps/downloads/sabnzbd/app/kustomization.yaml

@@ -0,0 +1,9 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  # - ../../../../templates/volsync
+  - ./externalsecret.yaml
+  - ./helmrelease.yaml
+  # - ../../../../templates/gatus/guarded

kubernetes/apps/downloads/sabnzbd/ks.yaml

@@ -0,0 +1,27 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app sabnzbd
+  namespace: flux-system
+spec:
+  targetNamespace: downloads
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: external-secrets
+    - name: downloads-cifs-pvcs
+  path: ./kubernetes/apps/downloads/sabnzbd/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app

kubernetes/apps/downloads/sonarr/app/externalsecret.yaml

@@ -0,0 +1,67 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: &name sonarr
+spec:
+  target:
+    name: *name
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        # App
+        SONARR__AUTH__APIKEY: "{{ .SONARR_API_KEY }}"
+        SONARR__POSTGRES__HOST: &dbHost postgres-rw.databases.svc.cluster.local
+        SONARR__POSTGRES__PORT: "5432"
+        SONARR__POSTGRES__USER: &dbUser "{{ .SONARR_POSTGRES_USER }}"
+        SONARR__POSTGRES__PASSWORD: &dbPass "{{ .SONARR_POSTGRES_PASSWORD }}"
+        SONARR__POSTGRES__MAINDB: &dbName sonarr_main
+        # Postgres Init
+        INIT_POSTGRES_DBNAME: *dbName
+        INIT_POSTGRES_HOST: *dbHost
+        INIT_POSTGRES_USER: *dbUser
+        INIT_POSTGRES_PASS: *dbPass
+        INIT_POSTGRES_SUPER_PASS: "{{ .POSTGRES_ADMIN_PASS }}"
+  data:
+    - secretKey: SONARR_API_KEY
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretApiKey cccf2793-8f91-47da-be0d-63f08cdeda95
+        property: password
+    - secretKey: SONARR_POSTGRES_USER
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretDatabaseKey 6fbd4e66-0750-4dea-94b6-b5eb25c77c44
+        property: username
+    - secretKey: SONARR_POSTGRES_PASSWORD
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: *secretDatabaseKey
+        property: password
+    - secretKey: POSTGRES_ADMIN_USER
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretAdminDatabaseKey 88217883-df53-4c96-aad7-f3b2142382de
+        property: username
+    - secretKey: POSTGRES_ADMIN_PASS
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: *secretAdminDatabaseKey
+        property: password

kubernetes/apps/downloads/sonarr/app/helmrelease.yaml

@@ -0,0 +1,141 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app sonarr
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    controllers:
+      sonarr:
+        annotations:
+          reloader.stakater.com/auto: "true"
+        initContainers:
+          init-db:
+            image:
+              repository: ghcr.io/onedr0p/postgres-init
+              tag: 16.6@sha256:35353a77777ee8f634d0f3945f495b4a40065134b8619e0d18bd49b0ee9c855b
+            envFrom: &envFrom
+              - secretRef:
+                  name: *app
+        containers:
+          app:
+            image:
+              repository: ghcr.io/onedr0p/sonarr-develop
+              tag: rolling@sha256:371517bc99a5c755bea0c73e8e9fcd23ae436a593fb4a116368947c9c9182977
+            env:
+              TZ: "${TIMEZONE}"
+              SONARR__APP__INSTANCENAME: Sonarr
+              SONARR__APP__THEME: dark
+              SONARR__AUTH__METHOD: External
+              SONARR__AUTH__REQUIRED: DisabledForLocalAddresses
+              SONARR__LOG__DBENABLED: "False"
+              SONARR__LOG__LEVEL: info
+              SONARR__SERVER__PORT: &port 80
+              SONARR__UPDATE__BRANCH: develop
+            envFrom: *envFrom
+            probes:
+              liveness: &probes
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /ping
+                    port: *port
+                  initialDelaySeconds: 0
+                  periodSeconds: 10
+                  timeoutSeconds: 3
+                  failureThreshold: 5
+              readiness: *probes
+              startup:
+                enabled: false
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: ["ALL"] }
+            resources:
+              requests:
+                cpu: 10m
+                memory: 256Mi
+              limits:
+                memory: 4Gi
+    defaultPodOptions:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 568
+        runAsGroup: 568
+        fsGroup: 568
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile: { type: RuntimeDefault }
+    service:
+      app:
+        controller: *app
+        ports:
+          http:
+            port: *port
+    ingress:
+      app:
+        className: internal
+        annotations:
+          external-dns.alpha.kubernetes.io/target: internal.${SECRET_DOMAIN}
+          gethomepage.dev/enabled: "true"
+          gethomepage.dev/group: Downloads
+          gethomepage.dev/name: Sonarr
+          gethomepage.dev/icon: sonarr.png
+          gethomepage.dev/description: TV Downloads
+          gethomepage.dev/widget.type: sonarr
+          gethomepage.dev/widget.url: http://sonarr.downloads
+          gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_SONARR_TOKEN}}` }}"
+          nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET}
+        hosts:
+          - host: &host "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - hosts:
+              - *host
+            secretName: "{{ .Release.Name }}-tls"
+    persistence:
+      config:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/k3s/config/sonarr
+      tmp:
+        type: emptyDir
+      media:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/shows
+      downloads:
+        existingClaim: cifs-downloads
+        advancedMounts:
+          sonarr:
+            app:
+              - path: /downloads/downloaded_tv
+                readOnly: false
+                subPath: sabnzbd/downloaded_tv
+              - path: /downloads/tv-sonarr
+                readOnly: false
+                subPath: flood/tv-sonarr

kubernetes/apps/downloads/sonarr/app/kustomization.yaml

@@ -0,0 +1,9 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  # - ../../../../templates/volsync
+  - ./externalsecret.yaml
+  - ./helmrelease.yaml
+  # - ../../../../templates/gatus/guarded

kubernetes/apps/downloads/sonarr/ks.yaml

@@ -0,0 +1,27 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app sonarr
+  namespace: flux-system
+spec:
+  targetNamespace: downloads
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: cloudnative-pg-cluster
+    - name: downloads-cifs-pvcs
+  path: ./kubernetes/apps/downloads/sonarr/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app

kubernetes/apps/external-secrets/app/helmrelease.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: external-secrets
-      version: 0.10.5
+      version: 0.11.0
       sourceRef:
         kind: HelmRepository
         name: external-secrets

kubernetes/apps/helpers/homepage/app/externalsecret.yaml

@@ -0,0 +1,55 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: &name homepage
+spec:
+  target:
+    name: *name
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        # HOMEPAGE_VAR_LIDARR_TOKEN: "{{ .LIDARR_API_KEY }}"
+        # HOMEPAGE_VAR_OVERSEERR_TOKEN: "{{ .OVERSEERR_API_KEY }}"
+        # HOMEPAGE_VAR_PLEX_TOKEN: "{{ .PLEX_TOKEN }}"
+        HOMEPAGE_VAR_PROWLARR_TOKEN: "{{ .PROWLARR_API_KEY }}"
+        HOMEPAGE_VAR_RADARR_TOKEN: "{{ .RADARR_API_KEY }}"
+        # HOMEPAGE_VAR_READARR_TOKEN: "{{ .READARR_API_KEY }}"
+        HOMEPAGE_VAR_SABNZBD_TOKEN: "{{ .SABNZBD_API_KEY }}"
+        HOMEPAGE_VAR_SONARR_TOKEN: "{{ .SONARR_API_KEY }}"
+        # HOMEPAGE_VAR_TAUTULLI_TOKEN: "{{ .TAUTULLI_API_KEY }}"
+  data:
+    - secretKey: PROWLARR_API_KEY
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: ae9d8486-9279-4790-ac34-64c8922bb414
+        property: password
+    - secretKey: RADARR_API_KEY
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 093af32f-2565-4807-9574-6b6a886a4e03
+        property: password
+    - secretKey: SABNZBD_API_KEY
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: f6eb2b25-18a4-4f3f-af8e-38a6ee61787b
+        property: username
+    - secretKey: SONARR_API_KEY
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: cccf2793-8f91-47da-be0d-63f08cdeda95
+        property: password

kubernetes/apps/helpers/homepage/app/helmrelease.yaml

@@ -0,0 +1,115 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app homepage
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    controllers:
+      homepage:
+        annotations:
+          configmap.reloader.stakater.com/reload: *app
+          secret.reloader.stakater.com/reload: *app
+        containers:
+          app:
+            image:
+              repository: ghcr.io/gethomepage/homepage
+              tag: v0.9.13@sha256:1504b26bd82523e68adbae8c5a908d1633d02c68c65b62d084d81a6866552db6
+            env:
+              TZ: "${TIMEZONE}"
+            envFrom:
+              - secretRef:
+                  name: *app
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: ["ALL"] }
+            resources:
+              requests:
+                cpu: 10m
+                memory: 128Mi
+              limits:
+                memory: 768Mi
+    defaultPodOptions:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 568
+        runAsGroup: 568
+        fsGroup: 568
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile: { type: RuntimeDefault }
+    service:
+      app:
+        controller: *app
+        ports:
+          http:
+            port: 3000
+    serviceAccount:
+      create: true
+      name: *app
+    ingress:
+      app:
+        className: internal
+        annotations:
+          external-dns.alpha.kubernetes.io/target: internal.${SECRET_INTERNAL_DOMAIN}
+        hosts:
+          - host: "home.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+    persistence:
+      logs:
+        type: emptyDir
+        globalMounts:
+          - path: /app/config/logs
+      config:
+        type: emptyDir
+        globalMounts:
+          - path: /app/config
+      # services:
+      #   type: secret
+      #   name: *app
+      #   globalMounts:
+      #     - subPath: services.yaml
+      #       path: /app/config/services.yaml
+      #       readOnly: true
+      configmap:
+        type: configMap
+        name: *app
+        globalMounts:
+          - subPath: bookmarks.yaml
+            path: /app/config/bookmarks.yaml
+            readOnly: true
+          - subPath: docker.yaml
+            path: /app/config/docker.yaml
+            readOnly: true
+          - subPath: kubernetes.yaml
+            path: /app/config/kubernetes.yaml
+            readOnly: true
+          - subPath: settings.yaml
+            path: /app/config/settings.yaml
+            readOnly: true
+          - subPath: widgets.yaml
+            path: /app/config/widgets.yaml
+            readOnly: true

kubernetes/apps/helpers/homepage/app/kustomization.yaml

@@ -0,0 +1,19 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./rbac.yaml
+  - ./externalsecret.yaml
+  - ./helmrelease.yaml
+configMapGenerator:
+  - name: homepage
+    files:
+      - bookmarks.yaml=./resources/bookmarks.yaml
+      - docker.yaml=./resources/docker.yaml
+      - kubernetes.yaml=./resources/kubernetes.yaml
+      # - services.yaml=./resources/services.yaml
+      - settings.yaml=./resources/settings.yaml
+      - widgets.yaml=./resources/widgets.yaml
+generatorOptions:
+  disableNameSuffixHash: true

kubernetes/apps/helpers/homepage/app/rbac.yaml

@@ -0,0 +1,50 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: homepage
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - namespaces
+      - pods
+      - nodes
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - extensions
+      - networking.k8s.io
+    resources:
+      - ingresses
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - metrics.k8s.io
+    resources:
+      - nodes
+      - pods
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions/status
+    verbs:
+      - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: &app homepage
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: homepage
+subjects:
+  - kind: ServiceAccount
+    name: *app
+    namespace: default

kubernetes/apps/helpers/homepage/app/resources/bookmarks.yaml

@@ -0,0 +1,23 @@
+- Communicate:
+    - Discord:
+        - icon: discord.png
+          href: "https://discord.com/app"
+    - Gmail:
+        - icon: gmail.png
+          href: "https://mail.kraven.org"
+    - Google Calendar:
+        - icon: google-calendar.png
+          href: "https://calendar.google.com"
+    - Google Voice:
+        - icon: google-voice.png
+          href: "https://voice.google.com"
+- Git:
+    - kubesearch:
+        - icon: kubernetes-dashboard.png
+          href: "https://kubesearch.dev/"
+    - talos-cluster:
+        - icon: github.png
+          href: "https://github.com/brunnels/talos-cluster"
+    - cluster-template:
+        - icon: github.png
+          href: "https://github.com/onedr0p/cluster-template"

kubernetes/apps/helpers/homepage/app/resources/kubernetes.yaml

@@ -0,0 +1 @@
+mode: cluster

kubernetes/apps/helpers/homepage/app/resources/services.yaml

@@ -0,0 +1,23 @@
+- Infrastructure:
+    - Unraid:
+        icon: unraid
+        href: http://192.168.1.68
+        description: Unraid
+        widget:
+          type: unraid
+          url: https//192.168.1.68
+          username: root
+          password: dlord781
+- Calendar:
+    - Agenda:
+        widget:
+          type: calendar
+          view: agenda
+          maxEvents: 20
+          integrations:
+            - type: sonarr
+              service_group: Downloads
+              service_name: Sonarr
+            - type: radarr
+              service_group: Downloads
+              service_name: Radarr

kubernetes/apps/helpers/homepage/app/resources/settings.yaml

@@ -0,0 +1,69 @@
+title: Dashboard
+favicon: "https://raw.githubusercontent.com/brunnels/assets/main/homepage/icons/heimdall.svg"
+theme: dark
+background:
+  image: https://images.unsplash.com/photo-1502790671504-542ad42d5189?auto=format&fit=crop&w=2560&q=80
+  blur: sm
+  saturate: 50
+  brightness: 50
+  opacity: 50
+color: slate
+headerStyle: clean
+providers:
+  longhorn:
+    url: http://longhorn-frontend.longhorn-system
+layout:
+#  Automation:
+#    style: column
+#  Infrastructure:
+#    icon: mdi-server
+#    style: column
+#  Git:
+#    icon: mdi-desktop-tower
+#    style: column
+#  Storage:
+#    icon: mdi-desktop-tower
+#    style: column
+#  Tools:
+#    style: column
+#  Observability:
+#    icon: mdi-chart-line
+#    style: row
+#    columns: 4
+#  Media:
+#    icon: mdi-play-circle
+#    style: row
+#    columns: 4
+#  Downloads:
+#    icon: mdi-download-circle
+#    style: row
+#    columns: 4
+  Home:
+    style: column
+    icon: mdi-home-analytics
+  Git:
+    style: column
+    icon: mdi-desktop-tower
+  Storage:
+    style: row
+    columns: 2
+    icon: mdi-desktop-tower
+  Calendar:
+    style: column
+    icon: mdi-calendar
+  Media:
+    style: column
+    icon: mdi-play-circle
+  Infrastructure:
+    style: column
+    icon: mdi-server
+  DNS:
+    style: column
+    icon: mdi-server
+  Observability:
+    style: column
+    icon: mdi-chart-line
+  Downloads:
+    style: row
+    columns: 3
+    icon: mdi-download-circle

kubernetes/apps/helpers/homepage/app/resources/widgets.yaml

@@ -0,0 +1,32 @@
+- resources:
+    backend: kubernetes
+    cpu: true
+    expanded: true
+    memory: true
+- kubernetes:
+    cluster:
+      cpu: true
+      label: cluster
+      memory: true
+      show: true
+      showLabel: true
+    nodes:
+      cpu: true
+      memory: true
+      show: false
+      showLabel: true
+- search:
+    provider: [duckduckgo, google]
+    target: _blank
+- openmeteo:
+    latitude: "${SECRET_LATITUDE}"
+    longitude: "${SECRET_LONGITUDE}"
+    timezone: "${TIMEZONE}"
+    units: imperial
+    cache: 15
+- datetime:
+    text_size: l
+    format:
+      dateStyle: long
+      timeStyle: short
+      hourCycle: h23

kubernetes/apps/helpers/homepage/ks.yaml

@@ -0,0 +1,26 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app homepage
+  namespace: flux-system
+spec:
+  targetNamespace: default
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: external-secrets
+  path: ./kubernetes/apps/helpers/homepage/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app

kubernetes/apps/helpers/kustomization.yaml

@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./namespace.yaml
+  - ./homepage/ks.yaml
+  - ./theme-park/ks.yaml

kubernetes/apps/helpers/namespace.yaml

@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://kubernetesjsonschema.dev/v1.18.1-standalone-strict/namespace-v1.json
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: default
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled

kubernetes/apps/helpers/theme-park/app/helmrelease.yaml

@@ -0,0 +1,73 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app theme-park
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    controllers:
+      theme-park:
+        replicas: 2
+        strategy: RollingUpdate
+        containers:
+          app:
+            image:
+              repository: ghcr.io/onedr0p/theme-park
+              tag: 1.18.0@sha256:210d8f5d9466df493503184fb076bbf1fb9fbc2b42e273cd4516ac3fd1df7ba2
+            resources:
+              requests:
+                cpu: 10m
+                memory: 32Mi
+              limits:
+                memory: 64Mi
+    defaultPodOptions:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 568
+        runAsGroup: 568
+        fsGroup: 568
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile: { type: RuntimeDefault }
+    service:
+      app:
+        controller: *app
+        ports:
+          http:
+            port: 8080
+    ingress:
+      app:
+        className: internal
+        # annotations:
+        #   external-dns.alpha.kubernetes.io/target: external.${SECRET_DOMAIN}
+        hosts:
+          - host: "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                service:
+                  identifier: app
+                  port: http
+    topologySpreadConstraints:
+      - maxSkew: 1
+        topologyKey: kubernetes.io/hostname
+        whenUnsatisfiable: DoNotSchedule
+        labelSelector:
+          matchLabels:
+            app.kubernetes.io/name: *app

kubernetes/apps/helpers/theme-park/app/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml

kubernetes/apps/helpers/theme-park/ks.yaml

@@ -0,0 +1,24 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app theme-park
+  namespace: flux-system
+spec:
+  targetNamespace: default
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/helpers/theme-park/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app

kubernetes/apps/kube-system/reloader/app/helmrelease.yaml

@@ -8,7 +8,7 @@ spec:
   chart:
     spec:
       chart: reloader
-      version: 1.1.0
+      version: 1.3.0
       sourceRef:
         kind: HelmRepository
         name: stakater

kubernetes/apps/media/jellyfin/app/helmrelease.yaml

@@ -0,0 +1,128 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app jellyfin
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  maxHistory: 2
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  uninstall:
+    keepHistory: false
+  values:
+    defaultPodOptions:
+      enableServiceLinks: false
+      securityContext:
+        runAsUser: 568
+        runAsGroup: 568
+        fsGroup: 568
+        fsGroupChangePolicy: OnRootMismatch
+    controllers:
+      jellyfin:
+        annotations:
+          reloader.stakater.com/auto: "true"
+        containers:
+          app:
+            image:
+              repository: ghcr.io/jellyfin/jellyfin
+              tag: 10.10.3@sha256:17c3a8d9dddb97789b5f37112840ebf96566442c14d4754193a6c2eb154bc221
+            env:
+              DOTNET_SYSTEM_IO_DISABLEFILELOCKING: "true"
+              JELLYFIN_FFmpeg__probesize: 50000000
+              JELLYFIN_FFmpeg__analyzeduration: 50000000
+              JELLYFIN_PublishedServerUrl: &loadBalancerIP ${CLUSTER_LB_JELLYFIN}
+              TZ: ${TIMEZONE}
+            probes:
+              liveness: &probes
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /health
+                    port: &port 8096
+                  initialDelaySeconds: 0
+                  periodSeconds: 10
+                  timeoutSeconds: 1
+                  failureThreshold: 3
+              readiness: *probes
+              startup:
+                enabled: false
+            resources:
+              requests:
+                # gpu.intel.com/i915: 1
+                cpu: 100m
+                memory: 512Mi
+              limits:
+                # gpu.intel.com/i915: 1
+                memory: 4Gi
+    service:
+      app:
+        controller: *app
+        ports:
+          http:
+            port: *port
+    ingress:
+      app:
+        enabled: true
+        className: internal
+        hosts:
+          - host: &host "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                service:
+                  identifier: app
+                  port: http
+    persistence:
+      config:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/k3s/config/jellyfin
+      music:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/music
+        globalMounts:
+          - path: /var/mnt/vol1/music
+      photo:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/photos/original
+        globalMounts:
+          - path: /var/mnt/vol1/photo
+      video:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/movies
+        globalMounts:
+          - path: /var/mnt/vol1/video
+      transcode:
+        enabled: true
+        type: emptyDir
+        globalMounts:
+          - path: /transcode
+      cache:
+        enabled: true
+        type: emptyDir
+        globalMounts:
+          - path: /cache

kubernetes/apps/media/jellyfin/app/kustomization.yaml

@@ -0,0 +1,6 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/SchemaStore/schemastore/master/src/schemas/json/kustomization.json
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml

kubernetes/apps/media/jellyfin/ks.yaml

@@ -0,0 +1,26 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app jellyfin
+  namespace: flux-system
+spec:
+  targetNamespace: media
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: external-secrets
+  path: ./kubernetes/apps/media/jellyfin/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app

kubernetes/apps/media/kustomization.yaml

@@ -0,0 +1,12 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./namespace.yaml
+  - ./jellyfin/ks.yaml
+  - ./overseerr/ks.yaml
+  - ./tautulli/ks.yaml
+  - ./plex/ks.yaml
+generatorOptions:
+  disableNameSuffixHash: true

kubernetes/apps/media/namespace.yaml

@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://kubernetesjsonschema.dev/v1.18.1-standalone-strict/namespace-v1.json
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: media
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled

kubernetes/apps/media/overseerr/app/helmrelease.yaml

@@ -0,0 +1,115 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app overseerr
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    controllers:
+      overseerr:
+        annotations:
+          reloader.stakater.com/auto: "true"
+        containers:
+          app:
+            image:
+              repository: ghcr.io/sct/overseerr
+              tag: rolling@sha256:714ea6db2bc007a2262d112bef7eec74972eb33d9c72bddb9cbd98b8742de950
+            env:
+              TZ: "${TIMEZONE}"
+              LOG_LEVEL: "info"
+              PORT: &port 80
+            probes:
+              liveness: &probes
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /api/v1/status
+                    port: *port
+                  initialDelaySeconds: 0
+                  periodSeconds: 10
+                  timeoutSeconds: 1
+                  failureThreshold: 3
+              readiness: *probes
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: [ "ALL" ] }
+            resources:
+              requests:
+                cpu: 10m
+                memory: 128Mi
+              limits:
+                memory: 4Gi
+    defaultPodOptions:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 568
+        runAsGroup: 568
+        fsGroup: 568
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile: { type: RuntimeDefault }
+    service:
+      app:
+        controller: *app
+        ports:
+          http:
+            port: *port
+    ingress:
+      app:
+        className: internal
+        # annotations:
+        #   external-dns.alpha.kubernetes.io/target: external.${SECRET_DOMAIN}
+        #   gethomepage.dev/enabled: "true"
+        #   gethomepage.dev/group: Media
+        #   gethomepage.dev/name: Overseerr
+        #   gethomepage.dev/icon: overseerr
+        #   gethomepage.dev/description: Media Request Management
+        #   gethomepage.dev/widget.type: overseerr
+        #   gethomepage.dev/widget.url: http://overseerr.media
+        #   gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_OVERSEERR_TOKEN}}` }}"
+        hosts:
+          - host: "requests.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                service:
+                  identifier: app
+                  port: http
+    persistence:
+      config:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/k3s/config/overseerr
+        globalMounts:
+          - path: /app/config
+      cache:
+        storageClass: openebs-hostpath
+        accessMode: ReadWriteOnce
+        size: 15Gi
+        globalMounts:
+          - path: /app/config/cache
+      logs:
+        type: emptyDir
+        globalMounts:
+          - path: /app/config/logs
+      tmp:
+        type: emptyDir

kubernetes/apps/media/overseerr/app/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
+  # - ../../../../templates/gatus/external

kubernetes/apps/media/overseerr/ks.yaml

@@ -0,0 +1,24 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app overseerr
+  namespace: flux-system
+spec:
+  targetNamespace: media
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/media/overseerr/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app

kubernetes/apps/media/plex/app/externalsecret.yaml

@@ -0,0 +1,23 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: &name plex
+spec:
+  target:
+    name: *name
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        PLEX_CLAIM: "{{ .PLEX_CLAIM }}"
+  data:
+    - secretKey: PLEX_CLAIM
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretApiKey 8406f7ea-46b0-42ed-bcae-a83984d7b6ae
+        property: password

kubernetes/apps/media/plex/app/helmrelease.yaml

@@ -0,0 +1,149 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app plex
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    controllers:
+      plex:
+        annotations:
+          reloader.stakater.com/auto: "true"
+        containers:
+          app:
+            image:
+              repository: ghcr.io/onedr0p/plex
+              tag: rolling@sha256:1f28b5e5a964481f80e76db3c986082d2fc3bca2d16d2742704e9adf8349c79c
+            env:
+              TZ: "${TIMEZONE}"
+              ALLOWED_NETWORKS: "${LAN_CIDR},${CLUSTER_CIDR},${SERVICE_CIDR}"
+              PLEX_ADVERTISE_URL: "http://172.16.10.4:32400,https://plex.${SECRET_INTERNAL_DOMAIN}"
+              PLEX_PREFERENCE_1: "AllowMediaDeletion=0"
+              PLEX_PREFERENCE_2: "EnableIPv6=0"
+              PLEX_PREFERENCE_3: "FriendlyName=LordFamilyFlix"
+              PLEX_PREFERENCE_4: "LanNetworksBandwidth=${LAN_CIDR}"
+            envFrom:
+              - secretRef:
+                  name: *app
+            probes:
+              liveness: &probes
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /identity
+                    port: &port 32400
+                  initialDelaySeconds: 0
+                  periodSeconds: 10
+                  timeoutSeconds: 1
+                  failureThreshold: 3
+              readiness: *probes
+            resources:
+              requests:
+                cpu: 50m
+                memory: 512Mi
+              limits:
+                memory: 4Gi
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: ["ALL"] }
+    defaultPodOptions:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile: { type: RuntimeDefault }
+    service:
+      app:
+        controller: *app
+        type: LoadBalancer
+        ports:
+          http:
+            port: *port
+    ingress:
+      app:
+        className: internal
+        # annotations:
+        #   external-dns.alpha.kubernetes.io/target: external.${SECRET_DOMAIN}
+        #   gethomepage.dev/enabled: "true"
+        #   gethomepage.dev/group: Media
+        #   gethomepage.dev/name: Plex
+        #   gethomepage.dev/icon: plex
+        #   gethomepage.dev/description: Media Player
+        #   gethomepage.dev/widget.type: plex
+        #   gethomepage.dev/widget.url: http://plex.media:32400
+        #   gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_PLEX_TOKEN}}` }}"
+        #   nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+        #   nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET}
+        hosts:
+          - host: "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                service:
+                  identifier: app
+                  port: http
+    persistence:
+      config:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/k3s/config/plex
+      cache:
+        storageClass: openebs-hostpath
+        accessMode: ReadWriteOnce
+        size: 10Gi
+        globalMounts:
+          - path: "/config/Library/Application Support/Plex Media Server/Cache"
+      tmp:
+        type: emptyDir
+      transcode:
+        type: emptyDir
+      movies:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/movies
+        globalMounts:
+          - path: /media/movies
+      music:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/music
+        globalMounts:
+          - path: /media/music
+      pictures:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/photos/original
+        globalMounts:
+          - path: /media/photos
+      tv:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/shows
+        globalMounts:
+          - path: /media/tv

kubernetes/apps/media/plex/app/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./externalsecret.yaml
+  - ./helmrelease.yaml

kubernetes/apps/media/plex/ks.yaml

@@ -0,0 +1,24 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app plex
+  namespace: flux-system
+spec:
+  targetNamespace: media
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/media/plex/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app

kubernetes/apps/media/tautulli/app/helmrelease.yaml

@@ -0,0 +1,104 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app tautulli
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    controllers:
+      tautulli:
+        annotations:
+          reloader.stakater.com/auto: "true"
+        containers:
+          app:
+            image:
+              repository: ghcr.io/onedr0p/tautulli
+              tag: rolling@sha256:96285c7e57dc77b790bb934be25d1d18a7c220b0f9e29748f65b2374bbef24c8
+            env:
+              TZ: America/Denver
+              TAUTULLI__PORT: &port 80
+            probes:
+              liveness: &probes
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /status
+                    port: *port
+                  initialDelaySeconds: 0
+                  periodSeconds: 10
+                  timeoutSeconds: 1
+                  failureThreshold: 3
+              readiness: *probes
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: [ "ALL" ] }
+            resources:
+              requests:
+                cpu: 10m
+                memory: 128Mi
+              limits:
+                memory: 4Gi
+    defaultPodOptions:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 568
+        runAsGroup: 568
+        fsGroup: 568
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile: { type: RuntimeDefault }
+    service:
+      app:
+        controller: *app
+        ports:
+          http:
+            port: *port
+    ingress:
+      app:
+        className: internal
+        # annotations:
+        #   external-dns.alpha.kubernetes.io/target: internal.${SECRET_DOMAIN}
+        #   gethomepage.dev/enabled: "true"
+        #   gethomepage.dev/group: Media
+        #   gethomepage.dev/name: Tautulli
+        #   gethomepage.dev/icon: tautulli
+        #   gethomepage.dev/description: Plex Stream Monitoring
+        #   gethomepage.dev/widget.type: tautulli
+        #   gethomepage.dev/widget.url: http://tautulli.media
+        #   gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_TAUTULLI_TOKEN}}` }}"
+        hosts:
+          - host: "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                service:
+                  identifier: app
+                  port: http
+    persistence:
+      config:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/k3s/config/tautulli
+      tmp:
+        type: emptyDir
+      add-ons:
+        type: emptyDir

kubernetes/apps/media/tautulli/app/kustomization.yaml

@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
+  # - ../../../../templates/gatus/guarded

kubernetes/apps/media/tautulli/ks.yaml

@@ -0,0 +1,24 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app tautulli
+  namespace: flux-system
+spec:
+  targetNamespace: media
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/media/tautulli/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app

kubernetes/apps/network/cloudflared/app/helmrelease.yaml

@@ -30,7 +30,7 @@ spec:
           app:
             image:
               repository: docker.io/cloudflare/cloudflared
-              tag: 2024.11.0
+              tag: 2024.11.1
             env:
               NO_AUTOUPDATE: true
               TUNNEL_CRED_FILE: /etc/cloudflared/creds/credentials.json

kubernetes/flux/vars/cluster-secrets.sops.yaml

@@ -4,6 +4,7 @@ metadata:
     name: cluster-secrets
     namespace: flux-system
 stringData:
+    SECRET_INTERNAL_DOMAIN: ENC[AES256_GCM,data:AvYATV6LqEmALp/j1w==,iv:DDf17Gf2ta+UuMysaeTtN92ti0wrz+eAmawwJSZxyQY=,tag:hoarzYqJXEfMWSFRzpOlzw==,type:str]
     SECRET_DOMAIN: ENC[AES256_GCM,data:HjoRmQzaP5jG8m1iMc198Q==,iv:1GNInjU80g3lstoVYUY9/pOSh9QnCCmXN44PhZgvOv8=,tag:62X6LxGg9vt1wiW8kf/CsA==,type:str]
     SECRET_ACME_EMAIL: ENC[AES256_GCM,data:gG7gLBw7i5xLu1HkOYA8O76WPsc=,iv:d71Ip9lrtZR5FFWvV+NQbP9epP6v9cYM1Ntag6yHWAQ=,tag:ZzljWFeetwVubEuIOljrSA==,type:str]
     SECRET_CLOUDFLARE_TUNNEL_ID: ENC[AES256_GCM,data:22ZGxjzd/GM9JscAoadi+f2Y6UKL6BJ16LOpxObPrw+geR6A,iv:9M1HGTCzlDI8bLAUFzYPznzBJueRnc+/tGORIlDJS88=,tag:1aGOpgabBTt+OdJI/7xBnw==,type:str]
@@ -23,8 +24,8 @@ sops:
             N1dXTnlOaUNLUjh5SVRCZzlhVUF4Y1EKoLjz8aT2CdHI6URVJheQID4/7DkPfWXB
             yG/wM3CEOlnXP5Eyj8X5r/LmCoeBD7LNlAwQ0PGythA3v+LQpat9Uw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-11-18T02:32:55Z"
+    lastmodified: "2024-11-23T05:19:00Z"
-    mac: ENC[AES256_GCM,data:dGBL3bQNdmHZlHpPQUDi5b5kgDWe/dFzS82Xnu1YjwCTMG5ktHzZ7O2NNndAyG670NQD5gFzW1j0HG/pl0CKosD2+9Ly2zew4ROykr7M6/Pk4bcmtMBn/jZbYAF7wJpC+qrXCgJwkLaHMoFN1/Pyy6CeuNhMKc3ykIQ/n35BOWE=,iv:cvlbcWAs+34JOrOwKJa8g7/vwUqXqef/dmt1UEld3LE=,tag:WkHlS08QJfC46cJsUnFsRg==,type:str]
+    mac: ENC[AES256_GCM,data:Hk6SChJVwvvZVbHi4G8biDLrY4gMOfuczt1BHQXx+LEIhN2KDriCIRRL6RT22D41AQ/5rhVb127ZfQXe+WztGK/+do2ED/q8nLwiqWVc3tkpPgVSB4hMHClCJtHh7bSMHP1rtYQElMPopVYPPkzrsK3cC/hNfHJrD1Gy0AJKQaQ=,iv:ydVoJQ36J2RCLBjSak6AfxyVHO//kLWY3hzYukjEdYA=,tag:ISui4EMJb6IWaWh7Se3pFQ==,type:str]
     pgp: []
     encrypted_regex: ^(data|stringData)$
     version: 3.9.1

kubernetes/flux/vars/cluster-settings.yaml

@@ -5,4 +5,14 @@ metadata:
   name: cluster-settings
   namespace: flux-system
 data:
-  SETTING_EXAMPLE: Global settings for your cluster go in this file, this file is NOT encrypted
+  TIMEZONE: "US/Mountain"
+  CLUSTER_CIDR: "10.96.0.0/16"
+  SERVICE_CIDR: "172.16.10.0/24"
+  LAN_CIDR: "10.0.10.0/24"
+  THEME_PARK_SNIPPET: >
+    proxy_set_header Accept-Encoding "";
+    sub_filter '</body>' '<link rel="stylesheet" type="text/css" href="https://theme-park.${SECRET_DOMAIN}/css/base/{{ .Release.Name }}/nord.css"></body>';
+    sub_filter_once on;
+  SVC_POSTGRES_ADDR: "10.50.0.24"
+  SVC_QBITTTORENT_ADDR: "10.50.0.25"
+  SVC_VPN_ADDR: "10.50.0.26"

requirements.txt

@@ -1,4 +1,4 @@
-cloudflare==3.1.0
+cloudflare==3.1.1
 email-validator==2.2.0
-makejinja==2.6.2
+makejinja==2.7.0
 netaddr==1.3.0