feat(container): update image ghcr.io/onedr0p/postgres-init to v16.8

feat(github-action): update image ghcr.io/renovatebot/renovate to v39.251.0
feat(github-action): update image ghcr.io/renovatebot/renovate to v39.240.1
2025-04-19 00:02:12 +00:00 · 2025-04-19 00:01:12 +00:00 · 2025-04-13 00:01:01 +00:00 · 2025-04-12 00:01:04 +00:00 · 2025-04-06 00:01:17 +00:00 · 2025-04-05 00:01:23 +00:00
107 changed files with 3174 additions and 127 deletions
@@ -35,7 +35,7 @@ jobs:
          path: default

      - name: Diff Resources
-        uses: docker://ghcr.io/allenporter/flux-local:v6.0.1
+        uses: docker://ghcr.io/allenporter/flux-local:v6.1.1
        with:
          args: >-
            diff ${{ matrix.resources }}
@@ -10,7 +10,7 @@ on:
 jobs:
  renovate:
    runs-on: ubuntu-latest
-    container: ghcr.io/renovatebot/renovate:37.440.7
+    container: ghcr.io/renovatebot/renovate:39.251.0
    steps:
      - uses: actions/checkout@v4
      - run: renovate
@@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: coredns
-      version: 1.36.0
+      version: 1.36.1
      sourceRef:
        kind: HelmRepository
        name: coredns
@@ -30,7 +30,7 @@ spec:
          app:
            image:
              repository: docker.io/cloudflare/cloudflared
-              tag: 2024.10.1
+              tag: 2024.11.1
            env:
              NO_AUTOUPDATE: true
              TUNNEL_CRED_FILE: /etc/cloudflared/creds/credentials.json
@@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: ingress-nginx
-      version: 4.11.2
+      version: 4.11.3
      sourceRef:
        kind: HelmRepository
        name: ingress-nginx
@@ -9,7 +9,7 @@ spec:
  chart:
    spec:
      chart: ingress-nginx
-      version: 4.11.2
+      version: 4.11.3
      sourceRef:
        kind: HelmRepository
        name: ingress-nginx
@@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: prometheus-operator-crds
-      version: 15.0.0
+      version: 16.0.0
      sourceRef:
        kind: HelmRepository
        name: prometheus-community
@@ -18,7 +18,7 @@ releases:
  - name: prometheus-operator-crds
    namespace: observability
    chart: oci://ghcr.io/prometheus-community/charts/prometheus-operator-crds
-    version: 15.0.0
+    version: 16.0.0
  - name: cilium
    namespace: kube-system
    chart: cilium/cilium
@@ -30,7 +30,7 @@ releases:
  - name: coredns
    namespace: kube-system
    chart: coredns/coredns
-    version: 1.36.0
+    version: 1.36.1
    values:
      - ../apps/kube-system/coredns/app/helm-values.yaml
    needs:
@@ -42,11 +42,16 @@ spec:
              repository: ghcr.io/gimlet-io/capacitor
              tag: v0.4.8@sha256:a80207f52c054dba9e04e8b1ea86e297817ecf05ddbfce249c1f5eaf6ce8c7d8
            securityContext:
+              runAsNonRoot: true
+              runAsUser: 100
+              runAsGroup: 101
              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
              capabilities:
                drop:
                  - ALL
-              readOnlyRootFilesystem: true
+              seccompProfile:
+                type: RuntimeDefault

            probes:
              startup:
@@ -90,7 +95,7 @@ spec:
        enabled: true
        className: internal
        hosts:
-          - host: &host "{{ .Release.Name }}.k8s.home.arpa"
+          - host: &host "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
            paths:
              - path: /
                pathType: Prefix
@@ -1,48 +1,50 @@
---
 apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: capacitor
+  namespace: flux-system
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRole
 metadata:
  name: capacitor
 rules:
-  - apiGroups:
-      - networking.k8s.io
-      - apps
-      - ""
-    resources:
-      - pods
-      - pods/log
-      - ingresses
-      - deployments
-      - services
-      - secrets
-      - events
-      - configmaps
-    verbs:
-      - get
-      - watch
-      - list
-  - apiGroups:
-      - source.toolkit.fluxcd.io
-      - kustomize.toolkit.fluxcd.io
-      - helm.toolkit.fluxcd.io
-    resources:
-      - gitrepositories
-      - ocirepositories
-      - buckets
-      - helmrepositories
-      - helmcharts
-      - kustomizations
-      - helmreleases
-    verbs:
-      - get
-      - watch
-      - list
-      - patch # to allow force reconciling by adding an annotation
+- apiGroups:
+    - networking.k8s.io
+    - apps
+    - ""
+  resources:
+    - pods
+    - pods/log
+    - ingresses
+    - deployments
+    - services
+    - secrets
+    - events
+    - configmaps
+  verbs:
+    - get
+    - watch
+    - list
+- apiGroups:
+    - source.toolkit.fluxcd.io
+    - kustomize.toolkit.fluxcd.io
+    - helm.toolkit.fluxcd.io
+    - infra.contrib.fluxcd.io
+  resources:
+    - gitrepositories
+    - ocirepositories
+    - buckets
+    - helmrepositories
+    - helmcharts
+    - kustomizations
+    - helmreleases
+    - terraforms
+  verbs:
+    - get
+    - watch
+    - list
+    - patch # to allow force reconciling by adding an annotation
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -5,7 +5,7 @@ metadata:
  name: &app capacitor
  namespace: flux-system
 spec:
-  targetNamespace: capacitor
+  targetNamespace: flux-system
  commonMetadata:
    labels:
      app.kubernetes.io/name: *app
@@ -1,39 +0,0 @@
---
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/cert-manager.io/certificate_v1.json
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: &name home-selfsigned-ca
-spec:
-  isCA: true
-  commonName: *name
-  subject:
-    organizations:
-      - ${SECRET_DOMAIN}
-  secretName: root-secret
-  privateKey:
-    algorithm: ECDSA
-    size: 256
-  issuerRef:
-    name: selfsigned-issuer
-    kind: ClusterIssuer
-    group: cert-manager.io
---
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: &name strong-selfsigned-ca
-spec:
-  isCA: true
-  commonName: *name
-  subject:
-    organizations:
-      - ${SECRET_DOMAIN}
-  secretName: strong-root-secret
-  privateKey:
-    algorithm: ECDSA
-    size: 384
-  issuerRef:
-    name: selfsigned-issuer
-    kind: ClusterIssuer
-    group: cert-manager.io
@@ -1,5 +1,28 @@
 ---
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/cert-manager.io/clusterissuer_v1.json
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: selfsigned-issuer
+spec:
+  selfSigned: {}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: home-selfsigned-ca
+  namespace: cert-manager
+spec:
+  isCA: true
+  commonName: home-selfsigned-ca
+  secretName: root-secret
+  privateKey:
+    algorithm: ECDSA
+    size: 256
+  issuerRef:
+    name: selfsigned-issuer
+    kind: ClusterIssuer
+    group: cert-manager.io
+---
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
 metadata:
@@ -7,11 +30,3 @@ metadata:
 spec:
  ca:
    secretName: root-secret
---
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: strong-ca-issuer
-spec:
-  ca:
-    secretName: strong-root-secret
@@ -3,5 +3,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ./certificate.yaml
  - ./clusterissuer.yaml
@@ -0,0 +1,32 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cloudnative-pg
+spec:
+  interval: 30m
+  chart:
+    spec:
+      # renovate: registryUrl=https://cloudnative-pg.github.io/charts
+      chart: cloudnative-pg
+      version: 0.22.1
+      sourceRef:
+        kind: HelmRepository
+        name: cloudnative-pg
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    crds:
+      create: true
+    monitoring:
+      podMonitorEnabled: false
+      grafanaDashboard:
+        create: true
@@ -0,0 +1,6 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
@@ -0,0 +1,89 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/postgresql.cnpg.io/cluster_v1.json
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: postgres
+  namespace: databases
+spec:
+  instances: 3
+  imageName: ghcr.io/cloudnative-pg/postgresql:16.5-1
+  primaryUpdateStrategy: unsupervised
+  storage:
+    size: 20Gi
+    storageClass: nfs-provision-csi-database
+  superuserSecret:
+    name: cloudnative-pg
+  enableSuperuserAccess: true
+  postgresql:
+    parameters:
+      max_connections: "600"
+      max_slot_wal_keep_size: 10GB
+      shared_buffers: 512MB
+  nodeMaintenanceWindow:
+    inProgress: false
+    reusePVC: true
+  resources:
+    requests:
+      cpu: 500m
+      memory: 2Gi
+    limits:
+      cpu: 1
+      memory: 4Gi
+  monitoring:
+    enablePodMonitor: true
+  # backup:
+  #   retentionPolicy: 30d
+  #   barmanObjectStore: &barmanObjectStore
+  #     data:
+  #       compression: bzip2
+  #     wal:
+  #       compression: bzip2
+  #       maxParallel: 8
+  #     destinationPath: "s3://cloudnative-pg-v1"
+  #     endpointURL: "https://${SECRET_QNAP_HOSTNAME}:8010"
+  #     # Note: serverName version needs to be incremented or changed
+  #     # when recovering from an existing cnpg cluster
+  #     serverName: &currentCluster postgres-v2
+  #     s3Credentials:
+  #       accessKeyId:
+  #         name: cloudnative-pg
+  #         key: s3-key-id
+  #       secretAccessKey:
+  #         name: cloudnative-pg
+  #         key: s3-secret-key
+  # # Note: externalClusters is needed when recovering from an existing cnpg cluster
+  # externalClusters:
+  #   # s3 instance recovery
+  #   - name: &previousCluster postgres-v1
+  #     barmanObjectStore:
+  #       <<: *barmanObjectStore
+  #       serverName: *previousCluster
+    # running instance
+    #- name: postgres
+    #  connectionParameters:
+    #    host: 10.1.0.23
+    #    user: postgres
+    #    dbname: postgres
+    #    sslmode: require
+    #  password:
+    #    name: cloudnative-pg
+    #    key: password
+
+  # Note: previousCluster needs to be set to the name of the previous
+  # cluster when recovering from an existing cnpg cluster
+  bootstrap:
+    # # s3 instance recovery
+    # recovery:
+    #   source: *previousCluster
+    # recover from another running instance
+    initdb:
+      database: homeops
+    #  import:
+    #    type: monolith
+    #    databases:
+    #      - "*"
+    #    roles:
+    #      - "*"
+    #    source:
+    #      externalCluster: postgres
@@ -0,0 +1,32 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: &name cloudnative-pg
+spec:
+  target:
+    name: *name
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        username: "{{ .username }}"
+        password: "{{ .password }}"
+  data:
+    - secretKey: username
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretKey 88217883-df53-4c96-aad7-f3b2142382de
+        property: username
+    - secretKey: password
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: *secretKey
+        property: password
@@ -0,0 +1,11 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./externalsecret.yaml
+  - ./cluster.yaml
+  # - ./gatus.yaml
+  - ./prometheusrule.yaml
+  - ./scheduledbackup.yaml
+  - ./service.yaml
@@ -0,0 +1,67 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/monitoring.coreos.com/prometheusrule_v1.json
+apiVersion: monitoring.coreos.com/v1
+kind: PrometheusRule
+metadata:
+  name: cloudnative-pg-rules
+  labels:
+    prometheus: k8s
+    role: alert-rules
+spec:
+  groups:
+    - name: cloudnative-pg.rules
+      rules:
+        - alert: LongRunningTransaction
+          annotations:
+            description: Pod {{ $labels.pod }} is taking more than 5 minutes (300 seconds) for a query.
+            summary: A query is taking longer than 5 minutes.
+          expr: |-
+            cnpg_backends_max_tx_duration_seconds > 300
+          for: 1m
+          labels:
+            severity: warning
+        - alert: BackendsWaiting
+          annotations:
+            description: Pod {{ $labels.pod }} has been waiting for longer than 5 minutes
+            summary: If a backend is waiting for longer than 5 minutes
+          expr: |-
+            cnpg_backends_waiting_total > 300
+          for: 1m
+          labels:
+            severity: warning
+        - alert: PGDatabase
+          annotations:
+            description: Over 150,000,000 transactions from frozen xid on pod {{ $labels.pod }}
+            summary: Number of transactions from the frozen XID to the current one
+          expr: |-
+            cnpg_pg_database_xid_age > 150000000
+          for: 1m
+          labels:
+            severity: warning
+        - alert: PGReplication
+          annotations:
+            description: Standby is lagging behind by over 300 seconds (5 minutes)
+            summary: The standby is lagging behind the primary
+          expr: |-
+            cnpg_pg_replication_lag > 300
+          for: 1m
+          labels:
+            severity: warning
+        - alert: LastFailedArchiveTime
+          annotations:
+            description: Archiving failed for {{ $labels.pod }}
+            summary: Checks the last time archiving failed. Will be < 0 when it has not failed.
+          expr: |-
+            (cnpg_pg_stat_archiver_last_failed_time - cnpg_pg_stat_archiver_last_archived_time) > 1
+          for: 1m
+          labels:
+            severity: warning
+        - alert: DatabaseDeadlockConflicts
+          annotations:
+            description: There are over 10 deadlock conflicts in {{ $labels.pod }}
+            summary: Checks the number of database conflicts
+          expr: |-
+            cnpg_pg_stat_database_deadlocks > 10
+          for: 1m
+          labels:
+            severity: warning
@@ -0,0 +1,12 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/postgresql.cnpg.io/scheduledbackup_v1.json
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: postgres
+spec:
+  schedule: "@daily"
+  immediate: true
+  backupOwnerReference: self
+  cluster:
+    name: postgres
@@ -0,0 +1,19 @@
+---
+# yaml-language-server: $schema=https://kubernetesjsonschema.dev/v1.18.1-standalone-strict/service-v1.json
+apiVersion: v1
+kind: Service
+metadata:
+  name: postgres-lb
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: postgres.${SECRET_INTERNAL_DOMAIN}
+    io.cilium/lb-ipam-ips: "${SVC_POSTGRES_ADDR}"
+spec:
+  type: LoadBalancer
+  ports:
+    - name: postgres
+      port: 5432
+      protocol: TCP
+      targetPort: 5432
+  selector:
+    cnpg.io/cluster: postgres
+    role: primary
@@ -0,0 +1,47 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app cloudnative-pg
+  namespace: flux-system
+spec:
+  targetNamespace: databases
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: external-secrets
+    - name: openebs
+  path: ./kubernetes/apps/databases/cloudnative-pg/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app cloudnative-pg-cluster
+  namespace: flux-system
+spec:
+  targetNamespace: databases
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: cloudnative-pg
+  path: ./kubernetes/apps/databases/cloudnative-pg/cluster
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./namespace.yaml
+  - ./cloudnative-pg/ks.yaml
+  - ./redis/ks.yaml
@@ -0,0 +1,38 @@
+---
+# yaml-language-server: $schema=https://kubernetesjsonschema.dev/v1.18.1-standalone-strict/namespace-v1.json
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: databases
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled
+# ---
+# # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/notification.toolkit.fluxcd.io/provider_v1beta3.json
+# apiVersion: notification.toolkit.fluxcd.io/v1beta3
+# kind: Provider
+# metadata:
+#   name: alert-manager
+#   namespace: databases
+# spec:
+#   type: alertmanager
+#   address: http://alertmanager-operated.observability.svc.cluster.local:9093/api/v2/alerts/
+# ---
+# # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/notification.toolkit.fluxcd.io/alert_v1beta3.json
+# apiVersion: notification.toolkit.fluxcd.io/v1beta3
+# kind: Alert
+# metadata:
+#   name: alert-manager
+#   namespace: databases
+# spec:
+#   providerRef:
+#     name: alert-manager
+#   eventSeverity: error
+#   eventSources:
+#     - kind: HelmRelease
+#       name: "*"
+#   exclusionList:
+#     - "error.*lookup github\\.com"
+#     - "error.*lookup raw\\.githubusercontent\\.com"
+#     - "dial.*tcp.*timeout"
+#     - "waiting.*socket"
+#   suspend: false
@@ -0,0 +1,47 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app redis
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: *app
+      version: 20.4.0
+      sourceRef:
+        kind: HelmRepository
+        name: bitnami
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    auth:
+      enabled: false
+      sentinel: false
+    master:
+      persistence:
+        enabled: false
+    replica:
+      persistence:
+        enabled: false
+    sentinel:
+      enabled: true
+      masterSet: redis-master
+      getMasterTimeout: 10
+      startupProbe:
+        failureThreshold: 2
+      persistence:
+        enabled: false
+    metrics:
+      enabled: true
+      serviceMonitor:
+        enabled: true
+        interval: 1m
@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: databases
+resources:
+  - ./helmrelease.yaml
@@ -0,0 +1,24 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app redis
+  namespace: flux-system
+spec:
+  targetNamespace: databases
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/databases/redis/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: true
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app
@@ -0,0 +1,13 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../../templates/csi-driver-nfs/claims/cifs-appdata.yaml
+  # - ../../../templates/csi-driver-nfs/claims/cifs-books.yaml
+  - ../../../templates/csi-driver-nfs/claims/cifs-downloads.yaml
+  # - ../../../templates/csi-driver-nfs/claims/cifs-games.yaml
+  # - ../../../templates/csi-driver-nfs/claims/cifs-misc.yaml
+  - ../../../templates/csi-driver-nfs/claims/cifs-movies.yaml
+  # - ../../../templates/csi-driver-nfs/claims/cifs-music.yaml
+  - ../../../templates/csi-driver-nfs/claims/cifs-tv.yaml
@@ -0,0 +1,23 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app downloads-cifs-pvcs
+  namespace: flux-system
+spec:
+  targetNamespace: downloads
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: csi-driver-nfs
+  path: ./kubernetes/apps/downloads/cifs-pvcs
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
@@ -0,0 +1,21 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./namespace.yaml
+  - ./ks.yaml
+  # - ./flaresolverr/ks.yaml
+  # - ./flood/ks.yaml
+  # - ./lidarr/ks.yaml
+  - ./prowlarr/ks.yaml
+  - ./radarr/ks.yaml
+  - ./sabnzbd/ks.yaml
+  - ./sonarr/ks.yaml
+# configMapGenerator:
+#   - name: authelia-ingress-hv
+#     namespace: downloads
+#     files:
+#       - values.yaml=../security/authelia/app/resources/authelia-ingress-hv.yaml
+generatorOptions:
+  disableNameSuffixHash: true
@@ -0,0 +1,11 @@
+---
+# yaml-language-server: $schema=https://kubernetesjsonschema.dev/v1.18.1-standalone-strict/namespace-v1.json
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: downloads
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled
+    vpn-routed-gateway: "true"
+  annotations:
+    volsync.backube/privileged-movers: "true"
@@ -0,0 +1,67 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: &name prowlarr
+spec:
+  target:
+    name: *name
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        # App
+        PROWLARR__AUTH__APIKEY: "{{ .PROWLARR_API_KEY }}"
+        PROWLARR__POSTGRES__HOST: &dbHost postgres-rw.databases.svc.cluster.local
+        PROWLARR__POSTGRES__PORT: "5432"
+        PROWLARR__POSTGRES__USER: &dbUser "{{ .PROWLARR_POSTGRES_USER }}"
+        PROWLARR__POSTGRES__PASSWORD: &dbPass "{{ .PROWLARR_POSTGRES_PASSWORD }}"
+        PROWLARR__POSTGRES__MAINDB: &dbName prowlarr_main
+        # Postgres Init
+        INIT_POSTGRES_DBNAME: *dbName
+        INIT_POSTGRES_HOST: *dbHost
+        INIT_POSTGRES_USER: *dbUser
+        INIT_POSTGRES_PASS: *dbPass
+        INIT_POSTGRES_SUPER_PASS: "{{ .POSTGRES_ADMIN_PASS }}"
+  data:
+    - secretKey: PROWLARR_API_KEY
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretApiKey ae9d8486-9279-4790-ac34-64c8922bb414
+        property: password
+    - secretKey: PROWLARR_POSTGRES_USER
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretDatabaseKey bce2ff77-66cd-47bd-a9e7-160c2d3bb616
+        property: username
+    - secretKey: PROWLARR_POSTGRES_PASSWORD
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: *secretDatabaseKey
+        property: password
+    - secretKey: POSTGRES_ADMIN_USER
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretAdminDatabaseKey 88217883-df53-4c96-aad7-f3b2142382de
+        property: username
+    - secretKey: POSTGRES_ADMIN_PASS
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: *secretAdminDatabaseKey
+        property: password
@@ -0,0 +1,132 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app prowlarr
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  uninstall:
+    keepHistory: false
+  # valuesFrom:
+  #   - kind: ConfigMap
+  #     name: authelia-ingress-hv
+  values:
+    controllers:
+      prowlarr:
+        annotations:
+          reloader.stakater.com/auto: "true"
+        initContainers:
+          init-db:
+            image:
+              repository: ghcr.io/onedr0p/postgres-init
+              tag: 16.8@sha256:217c47c886965474f5c234b5a35ed008f53b39ea90a3088b31c0da98e1f9284d
+            envFrom: &envFrom
+              - secretRef:
+                  name: *app
+        containers:
+          app:
+            image:
+              repository: ghcr.io/onedr0p/prowlarr-develop
+              tag: rolling@sha256:155e7c757880e6afc5933b3060dfaec1c79712caf68031096fd5866ae4a31d0f
+            env:
+              TZ: "${TIMEZONE}"
+              PROWLARR__APP__INSTANCENAME: Prowlarr
+              PROWLARR__APP__THEME: dark
+              PROWLARR__AUTH__METHOD: External
+              PROWLARR__AUTH__REQUIRED: DisabledForLocalAddresses
+              PROWLARR__LOG__DBENABLED: "False"
+              PROWLARR__LOG__LEVEL: info
+              PROWLARR__SERVER__PORT: &port 80
+              PROWLARR__UPDATE__BRANCH: develop
+            envFrom: *envFrom
+            probes:
+              liveness: &probes
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /ping
+                    port: *port
+                  initialDelaySeconds: 0
+                  periodSeconds: 10
+                  timeoutSeconds: 3
+                  failureThreshold: 5
+              readiness: *probes
+              startup:
+                enabled: false
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: [ "ALL" ] }
+            resources:
+              requests:
+                cpu: 10m
+                memory: 128Mi
+              limits:
+                memory: 512Mi
+    defaultPodOptions:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 568
+        runAsGroup: 568
+        fsGroup: 568
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile: { type: RuntimeDefault }
+    service:
+      app:
+        controller: *app
+        ports:
+          http:
+            port: *port
+    ingress:
+      app:
+        enabled: true
+        className: internal
+        annotations:
+          external-dns.alpha.kubernetes.io/target: internal.${SECRET_DOMAIN}
+          gethomepage.dev/enabled: "true"
+          gethomepage.dev/group: Downloads
+          gethomepage.dev/name: Prowlarr
+          gethomepage.dev/icon: prowlarr.png
+          gethomepage.dev/description: Torrent/NZB Indexer Management
+          gethomepage.dev/widget.type: prowlarr
+          gethomepage.dev/widget.url: http://prowlarr.downloads
+          gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_PROWLARR_TOKEN}}` }}"
+          nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET}
+        hosts:
+          - host: &host "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - hosts:
+              - *host
+            secretName: "{{ .Release.Name }}-tls"
+    persistence:
+      config:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/k3s/config/prowlarr
+      tmp:
+        type: emptyDir
@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./externalsecret.yaml
+  - ./helmrelease.yaml
+  # - ../../../../templates/gatus/guarded
@@ -0,0 +1,27 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app prowlarr
+  namespace: flux-system
+spec:
+  targetNamespace: downloads
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: cloudnative-pg-cluster
+    - name: downloads-cifs-pvcs
+  path: ./kubernetes/apps/downloads/prowlarr/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app
@@ -0,0 +1,67 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: &name radarr
+spec:
+  target:
+    name: *name
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        # App
+        RADARR__AUTH__APIKEY: "{{ .RADARR_API_KEY }}"
+        RADARR__POSTGRES__HOST: &dbHost postgres-rw.databases.svc.cluster.local
+        RADARR__POSTGRES__PORT: "5432"
+        RADARR__POSTGRES__USER: &dbUser "{{ .RADARR_POSTGRES_USER }}"
+        RADARR__POSTGRES__PASSWORD: &dbPass "{{ .RADARR_POSTGRES_PASSWORD }}"
+        RADARR__POSTGRES__MAINDB: &dbName radarr_main
+        # Postgres Init
+        INIT_POSTGRES_DBNAME: *dbName
+        INIT_POSTGRES_HOST: *dbHost
+        INIT_POSTGRES_USER: *dbUser
+        INIT_POSTGRES_PASS: *dbPass
+        INIT_POSTGRES_SUPER_PASS: "{{ .POSTGRES_ADMIN_PASS }}"
+  data:
+    - secretKey: RADARR_API_KEY
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretApiKey 093af32f-2565-4807-9574-6b6a886a4e03
+        property: password
+    - secretKey: RADARR_POSTGRES_USER
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretDatabaseKey b99de2a6-f2b4-42c5-8852-87038e6c48fe
+        property: username
+    - secretKey: RADARR_POSTGRES_PASSWORD
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: *secretDatabaseKey
+        property: password
+    - secretKey: POSTGRES_ADMIN_USER
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretAdminDatabaseKey 88217883-df53-4c96-aad7-f3b2142382de
+        property: username
+    - secretKey: POSTGRES_ADMIN_PASS
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: *secretAdminDatabaseKey
+        property: password
@@ -0,0 +1,168 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app radarr
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  # valuesFrom:
+  #   - kind: ConfigMap
+  #     name: authelia-ingress-hv
+  values:
+    controllers:
+      radarr:
+        annotations:
+          reloader.stakater.com/auto: "true"
+        initContainers:
+          init-db:
+            image:
+              repository: ghcr.io/onedr0p/postgres-init
+              tag: 16.8@sha256:217c47c886965474f5c234b5a35ed008f53b39ea90a3088b31c0da98e1f9284d
+            envFrom: &envFrom
+              - secretRef:
+                  name: *app
+        containers:
+          app:
+            image:
+              repository: ghcr.io/onedr0p/radarr-develop
+              tag: rolling@sha256:f21d401a2ce6ebf5401c4dc71e3184ece740fff227a6af0ffa1a51fe4af7627c
+            env:
+              TZ: "${TIMEZONE}"
+              RADARR__APP__INSTANCENAME: Radarr
+              RADARR__APP__THEME: dark
+              RADARR__AUTH__METHOD: External
+              RADARR__AUTH__REQUIRED: DisabledForLocalAddresses
+              RADARR__LOG__DBENABLED: "False"
+              RADARR__LOG__LEVEL: info
+              RADARR__SERVER__PORT: &port 80
+              RADARR__UPDATE__BRANCH: develop
+            envFrom: *envFrom
+            probes:
+              liveness: &probes
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /ping
+                    port: *port
+                  initialDelaySeconds: 0
+                  periodSeconds: 10
+                  timeoutSeconds: 3
+                  failureThreshold: 5
+              readiness: *probes
+              startup:
+                enabled: false
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: ["ALL"] }
+            resources:
+              requests:
+                cpu: 10m
+                memory: 256M
+              limits:
+                memory: 4Gi
+    defaultPodOptions:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 568
+        runAsGroup: 568
+        fsGroup: 568
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile: { type: RuntimeDefault }
+    service:
+      app:
+        controller: *app
+        ports:
+          http:
+            port: *port
+    ingress:
+      app:
+        enabled: true
+        className: internal
+        annotations:
+          external-dns.alpha.kubernetes.io/target: internal.${SECRET_INTERNAL_DOMAIN}
+          gethomepage.dev/enabled: "true"
+          gethomepage.dev/group: Downloads
+          gethomepage.dev/name: Radarr
+          gethomepage.dev/icon: radarr.png
+          gethomepage.dev/description: Movie Downloads
+          gethomepage.dev/widget.type: radarr
+          gethomepage.dev/widget.url: http://radarr.downloads
+          gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_RADARR_TOKEN}}` }}"
+          nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET}
+        hosts:
+          - host: &host "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - hosts:
+              - *host
+            secretName: "{{ .Release.Name }}-tls"
+      # app:
+      #   enabled: true
+      #   className: internal
+      #   annotations:
+      #     external-dns.alpha.kubernetes.io/target: internal.${SECRET_INTERNAL_DOMAIN}
+      #     # gethomepage.dev/enabled: "true"
+      #     # gethomepage.dev/group: Downloads
+      #     # gethomepage.dev/name: Radarr
+      #     # gethomepage.dev/icon: radarr.png
+      #     # gethomepage.dev/description: Movie Downloads
+      #     # gethomepage.dev/widget.type: radarr
+      #   #   gethomepage.dev/widget.url: http://radarr.downloads
+      #   #   gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_RADARR_TOKEN}}` }}"
+      #   #   nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET}
+      #   hosts:
+      #     - host: &host "{{ .Release.Name }}.k8s.home.arpa"
+      #       paths:
+      #         - path: /
+      #           pathType: Prefix
+      #           service:
+      #             identifier: app
+      #             port: http
+    persistence:
+      config:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/k3s/config/radarr
+      tmp:
+        type: emptyDir
+      media:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/movies
+      downloads:
+        existingClaim: cifs-downloads
+        advancedMounts:
+          radarr:
+            app:
+              - path: /downloads/downloaded_movies
+                readOnly: false
+                subPath: sabnzbd/downloaded_movies
+              - path: /downloads/movies-radarr
+                readOnly: false
+                subPath: flood/movies-radarr
@@ -0,0 +1,9 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  # - ../../../../templates/volsync
+  - ./externalsecret.yaml
+  - ./helmrelease.yaml
+  # - ../../../../templates/gatus/guarded
@@ -0,0 +1,27 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app radarr
+  namespace: flux-system
+spec:
+  targetNamespace: downloads
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: cloudnative-pg-cluster
+    - name: downloads-cifs-pvcs
+  path: ./kubernetes/apps/downloads/radarr/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app
@@ -0,0 +1,32 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: &name sabnzbd
+spec:
+  target:
+    name: *name
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        SABNZBD__API_KEY: "{{ .SABNZBD_API_KEY }}"
+        SABNZBD__NZB_KEY: "{{ .SABNZBD_NZB_KEY }}"
+  data:
+    - secretKey: SABNZBD_API_KEY
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretDatabaseKey f6eb2b25-18a4-4f3f-af8e-38a6ee61787b
+        property: username
+    - secretKey: SABNZBD_NZB_KEY
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: *secretDatabaseKey
+        property: password
@@ -0,0 +1,141 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app sabnzbd
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  # valuesFrom:
+  #   - kind: ConfigMap
+  #     name: authelia-ingress-hv
+  values:
+    controllers:
+      sabnzbd:
+        annotations:
+          reloader.stakater.com/auto: "true"
+        containers:
+          app:
+            image:
+              repository: ghcr.io/onedr0p/sabnzbd
+              tag: rolling@sha256:86c645db93affcbf01cc2bce2560082bfde791009e1506dba68269b9c50bc341
+            env:
+              TZ: "America/Denver"
+              SABNZBD__PORT: &port 8080
+              SABNZBD__HOST_WHITELIST_ENTRIES: >-
+                sabnzbd,
+                sabnzbd.downloads,
+                sabnzbd.downloads.svc,
+                sabnzbd.downloads.svc.cluster,
+                sabnzbd.downloads.svc.cluster.local,
+                sabnzbd.${SECRET_INTERNAL_DOMAIN}
+            envFrom:
+              - secretRef:
+                  name: *app
+            probes:
+              liveness: &probes
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /api?mode=version
+                    port: *port
+                  initialDelaySeconds: 0
+                  periodSeconds: 10
+                  timeoutSeconds: 1
+                  failureThreshold: 3
+              readiness: *probes
+              startup:
+                enabled: false
+            resources:
+              requests:
+                cpu: 300m
+                memory: 1Gi
+              limits:
+                memory: 4Gi
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: ["ALL"] }
+    defaultPodOptions:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 568
+        runAsGroup: 568
+        fsGroup: 568
+        seccompProfile: { type: RuntimeDefault }
+    service:
+      app:
+        controller: *app
+        ports:
+          http:
+            port: *port
+    ingress:
+      app:
+        enabled: true
+        className: internal
+        annotations:
+          external-dns.alpha.kubernetes.io/target: "internal.${SECRET_DOMAIN}"
+          gethomepage.dev/enabled: "true"
+          gethomepage.dev/group: Downloads
+          gethomepage.dev/name: SABnzbd
+          gethomepage.dev/icon: sabnzbd
+          gethomepage.dev/widget.type: sabnzbd
+          gethomepage.dev/widget.url: http://sabnzbd.downloads:8080
+          gethomepage.dev/widget.key: "{{`{{HOMEPAGE_VAR_SABNZBD_TOKEN}}`}}"
+          nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET}
+        hosts:
+          - host: &host "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - hosts:
+              - *host
+            secretName: "{{ .Release.Name }}-tls"
+    persistence:
+      config:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/k3s/config/sabnzbd
+      tmp:
+        type: emptyDir
+      incomplete:
+        type: emptyDir
+      applications:
+        existingClaim: cifs-appdata
+        globalMounts:
+          - path: /media/applications
+      downloads:
+        existingClaim: cifs-downloads
+        globalMounts:
+          - path: /downloads
+            subPath: sabnzbd
+      # games:
+      #   existingClaim: cifs-games
+      #   globalMounts:
+      #     - path: /media/games
+      # misc:
+      #   existingClaim: cifs-misc
+      #   globalMounts:
+      #     - path: /media/misc
@@ -0,0 +1,9 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  # - ../../../../templates/volsync
+  - ./externalsecret.yaml
+  - ./helmrelease.yaml
+  # - ../../../../templates/gatus/guarded
@@ -0,0 +1,27 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app sabnzbd
+  namespace: flux-system
+spec:
+  targetNamespace: downloads
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: external-secrets
+    - name: downloads-cifs-pvcs
+  path: ./kubernetes/apps/downloads/sabnzbd/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app
@@ -0,0 +1,67 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: &name sonarr
+spec:
+  target:
+    name: *name
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        # App
+        SONARR__AUTH__APIKEY: "{{ .SONARR_API_KEY }}"
+        SONARR__POSTGRES__HOST: &dbHost postgres-rw.databases.svc.cluster.local
+        SONARR__POSTGRES__PORT: "5432"
+        SONARR__POSTGRES__USER: &dbUser "{{ .SONARR_POSTGRES_USER }}"
+        SONARR__POSTGRES__PASSWORD: &dbPass "{{ .SONARR_POSTGRES_PASSWORD }}"
+        SONARR__POSTGRES__MAINDB: &dbName sonarr_main
+        # Postgres Init
+        INIT_POSTGRES_DBNAME: *dbName
+        INIT_POSTGRES_HOST: *dbHost
+        INIT_POSTGRES_USER: *dbUser
+        INIT_POSTGRES_PASS: *dbPass
+        INIT_POSTGRES_SUPER_PASS: "{{ .POSTGRES_ADMIN_PASS }}"
+  data:
+    - secretKey: SONARR_API_KEY
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretApiKey cccf2793-8f91-47da-be0d-63f08cdeda95
+        property: password
+    - secretKey: SONARR_POSTGRES_USER
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretDatabaseKey 6fbd4e66-0750-4dea-94b6-b5eb25c77c44
+        property: username
+    - secretKey: SONARR_POSTGRES_PASSWORD
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: *secretDatabaseKey
+        property: password
+    - secretKey: POSTGRES_ADMIN_USER
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretAdminDatabaseKey 88217883-df53-4c96-aad7-f3b2142382de
+        property: username
+    - secretKey: POSTGRES_ADMIN_PASS
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: *secretAdminDatabaseKey
+        property: password
@@ -0,0 +1,141 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app sonarr
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    controllers:
+      sonarr:
+        annotations:
+          reloader.stakater.com/auto: "true"
+        initContainers:
+          init-db:
+            image:
+              repository: ghcr.io/onedr0p/postgres-init
+              tag: 16.8@sha256:217c47c886965474f5c234b5a35ed008f53b39ea90a3088b31c0da98e1f9284d
+            envFrom: &envFrom
+              - secretRef:
+                  name: *app
+        containers:
+          app:
+            image:
+              repository: ghcr.io/onedr0p/sonarr-develop
+              tag: rolling@sha256:371517bc99a5c755bea0c73e8e9fcd23ae436a593fb4a116368947c9c9182977
+            env:
+              TZ: "${TIMEZONE}"
+              SONARR__APP__INSTANCENAME: Sonarr
+              SONARR__APP__THEME: dark
+              SONARR__AUTH__METHOD: External
+              SONARR__AUTH__REQUIRED: DisabledForLocalAddresses
+              SONARR__LOG__DBENABLED: "False"
+              SONARR__LOG__LEVEL: info
+              SONARR__SERVER__PORT: &port 80
+              SONARR__UPDATE__BRANCH: develop
+            envFrom: *envFrom
+            probes:
+              liveness: &probes
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /ping
+                    port: *port
+                  initialDelaySeconds: 0
+                  periodSeconds: 10
+                  timeoutSeconds: 3
+                  failureThreshold: 5
+              readiness: *probes
+              startup:
+                enabled: false
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: ["ALL"] }
+            resources:
+              requests:
+                cpu: 10m
+                memory: 256Mi
+              limits:
+                memory: 4Gi
+    defaultPodOptions:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 568
+        runAsGroup: 568
+        fsGroup: 568
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile: { type: RuntimeDefault }
+    service:
+      app:
+        controller: *app
+        ports:
+          http:
+            port: *port
+    ingress:
+      app:
+        className: internal
+        annotations:
+          external-dns.alpha.kubernetes.io/target: internal.${SECRET_DOMAIN}
+          gethomepage.dev/enabled: "true"
+          gethomepage.dev/group: Downloads
+          gethomepage.dev/name: Sonarr
+          gethomepage.dev/icon: sonarr.png
+          gethomepage.dev/description: TV Downloads
+          gethomepage.dev/widget.type: sonarr
+          gethomepage.dev/widget.url: http://sonarr.downloads
+          gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_SONARR_TOKEN}}` }}"
+          nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET}
+        hosts:
+          - host: &host "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - hosts:
+              - *host
+            secretName: "{{ .Release.Name }}-tls"
+    persistence:
+      config:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/k3s/config/sonarr
+      tmp:
+        type: emptyDir
+      media:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/shows
+      downloads:
+        existingClaim: cifs-downloads
+        advancedMounts:
+          sonarr:
+            app:
+              - path: /downloads/downloaded_tv
+                readOnly: false
+                subPath: sabnzbd/downloaded_tv
+              - path: /downloads/tv-sonarr
+                readOnly: false
+                subPath: flood/tv-sonarr
@@ -0,0 +1,9 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  # - ../../../../templates/volsync
+  - ./externalsecret.yaml
+  - ./helmrelease.yaml
+  # - ../../../../templates/gatus/guarded
@@ -0,0 +1,27 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app sonarr
+  namespace: flux-system
+spec:
+  targetNamespace: downloads
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: cloudnative-pg-cluster
+    - name: downloads-cifs-pvcs
+  path: ./kubernetes/apps/downloads/sonarr/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app
@@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: external-secrets
-      version: 0.10.5
+      version: 0.11.0
      sourceRef:
        kind: HelmRepository
        name: external-secrets
@@ -6,7 +6,7 @@ metadata:
 spec:
  provider:
    webhook:
-      url: "http://bitwarden-cli.kube-system.svc.cluster.local:8087/object/item/{{ .remoteRef.key }}"
+      url: "http://bitwarden-cli.external-secrets.svc.cluster.local:8087/object/item/{{ .remoteRef.key }}"
      headers:
        Content-Type: application/json
      result:
@@ -20,6 +20,6 @@ metadata:
 spec:
  provider:
    webhook:
-      url: "http://bitwarden-cli.kube-system.svc.cluster.local:8087/object/item/{{ .remoteRef.key }}"
+      url: "http://bitwarden-cli.external-secrets.svc.cluster.local:8087/object/item/{{ .remoteRef.key }}"
      result:
        jsonPath: "$.data.fields[?@.name==\"{{ .remoteRef.property }}\"].value"
@@ -53,17 +53,15 @@ spec:
                spec:
                  exec:
                    command:
-                      - "/bin/bash"
-                      - -c
-                      - curl
-                      - -X POST
-                      - -s http://127.0.0.1:8087/sync
+                      - /usr/bin/curl
+                      - -X
+                      - POST
+                      - -s
+                      - http://127.0.0.1:8087/sync
                  initialDelaySeconds: 20
                  failureThreshold: 3
                  timeoutSeconds: 10
                  periodSeconds: 120
-              readiness:
-                enabled: false
            resources:
              requests:
                memory: 256Mi
@@ -0,0 +1,55 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: &name homepage
+spec:
+  target:
+    name: *name
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        # HOMEPAGE_VAR_LIDARR_TOKEN: "{{ .LIDARR_API_KEY }}"
+        # HOMEPAGE_VAR_OVERSEERR_TOKEN: "{{ .OVERSEERR_API_KEY }}"
+        # HOMEPAGE_VAR_PLEX_TOKEN: "{{ .PLEX_TOKEN }}"
+        HOMEPAGE_VAR_PROWLARR_TOKEN: "{{ .PROWLARR_API_KEY }}"
+        HOMEPAGE_VAR_RADARR_TOKEN: "{{ .RADARR_API_KEY }}"
+        # HOMEPAGE_VAR_READARR_TOKEN: "{{ .READARR_API_KEY }}"
+        HOMEPAGE_VAR_SABNZBD_TOKEN: "{{ .SABNZBD_API_KEY }}"
+        HOMEPAGE_VAR_SONARR_TOKEN: "{{ .SONARR_API_KEY }}"
+        # HOMEPAGE_VAR_TAUTULLI_TOKEN: "{{ .TAUTULLI_API_KEY }}"
+  data:
+    - secretKey: PROWLARR_API_KEY
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: ae9d8486-9279-4790-ac34-64c8922bb414
+        property: password
+    - secretKey: RADARR_API_KEY
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 093af32f-2565-4807-9574-6b6a886a4e03
+        property: password
+    - secretKey: SABNZBD_API_KEY
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: f6eb2b25-18a4-4f3f-af8e-38a6ee61787b
+        property: username
+    - secretKey: SONARR_API_KEY
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: cccf2793-8f91-47da-be0d-63f08cdeda95
+        property: password
@@ -0,0 +1,115 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app homepage
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    controllers:
+      homepage:
+        annotations:
+          configmap.reloader.stakater.com/reload: *app
+          secret.reloader.stakater.com/reload: *app
+        containers:
+          app:
+            image:
+              repository: ghcr.io/gethomepage/homepage
+              tag: v0.9.13@sha256:1504b26bd82523e68adbae8c5a908d1633d02c68c65b62d084d81a6866552db6
+            env:
+              TZ: "${TIMEZONE}"
+            envFrom:
+              - secretRef:
+                  name: *app
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: ["ALL"] }
+            resources:
+              requests:
+                cpu: 10m
+                memory: 128Mi
+              limits:
+                memory: 768Mi
+    defaultPodOptions:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 568
+        runAsGroup: 568
+        fsGroup: 568
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile: { type: RuntimeDefault }
+    service:
+      app:
+        controller: *app
+        ports:
+          http:
+            port: 3000
+    serviceAccount:
+      create: true
+      name: *app
+    ingress:
+      app:
+        className: internal
+        annotations:
+          external-dns.alpha.kubernetes.io/target: internal.${SECRET_INTERNAL_DOMAIN}
+        hosts:
+          - host: "home.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+    persistence:
+      logs:
+        type: emptyDir
+        globalMounts:
+          - path: /app/config/logs
+      config:
+        type: emptyDir
+        globalMounts:
+          - path: /app/config
+      # services:
+      #   type: secret
+      #   name: *app
+      #   globalMounts:
+      #     - subPath: services.yaml
+      #       path: /app/config/services.yaml
+      #       readOnly: true
+      configmap:
+        type: configMap
+        name: *app
+        globalMounts:
+          - subPath: bookmarks.yaml
+            path: /app/config/bookmarks.yaml
+            readOnly: true
+          - subPath: docker.yaml
+            path: /app/config/docker.yaml
+            readOnly: true
+          - subPath: kubernetes.yaml
+            path: /app/config/kubernetes.yaml
+            readOnly: true
+          - subPath: settings.yaml
+            path: /app/config/settings.yaml
+            readOnly: true
+          - subPath: widgets.yaml
+            path: /app/config/widgets.yaml
+            readOnly: true
@@ -0,0 +1,19 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./rbac.yaml
+  - ./externalsecret.yaml
+  - ./helmrelease.yaml
+configMapGenerator:
+  - name: homepage
+    files:
+      - bookmarks.yaml=./resources/bookmarks.yaml
+      - docker.yaml=./resources/docker.yaml
+      - kubernetes.yaml=./resources/kubernetes.yaml
+      # - services.yaml=./resources/services.yaml
+      - settings.yaml=./resources/settings.yaml
+      - widgets.yaml=./resources/widgets.yaml
+generatorOptions:
+  disableNameSuffixHash: true
@@ -0,0 +1,50 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: homepage
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - namespaces
+      - pods
+      - nodes
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - extensions
+      - networking.k8s.io
+    resources:
+      - ingresses
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - metrics.k8s.io
+    resources:
+      - nodes
+      - pods
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - apiextensions.k8s.io
+    resources:
+      - customresourcedefinitions/status
+    verbs:
+      - get
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: &app homepage
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: homepage
+subjects:
+  - kind: ServiceAccount
+    name: *app
+    namespace: default
@@ -0,0 +1,23 @@
+- Communicate:
+    - Discord:
+        - icon: discord.png
+          href: "https://discord.com/app"
+    - Gmail:
+        - icon: gmail.png
+          href: "https://mail.kraven.org"
+    - Google Calendar:
+        - icon: google-calendar.png
+          href: "https://calendar.google.com"
+    - Google Voice:
+        - icon: google-voice.png
+          href: "https://voice.google.com"
+- Git:
+    - kubesearch:
+        - icon: kubernetes-dashboard.png
+          href: "https://kubesearch.dev/"
+    - talos-cluster:
+        - icon: github.png
+          href: "https://github.com/brunnels/talos-cluster"
+    - cluster-template:
+        - icon: github.png
+          href: "https://github.com/onedr0p/cluster-template"
@@ -0,0 +1 @@
+mode: cluster
@@ -0,0 +1,23 @@
+- Infrastructure:
+    - Unraid:
+        icon: unraid
+        href: http://192.168.1.68
+        description: Unraid
+        widget:
+          type: unraid
+          url: https//192.168.1.68
+          username: root
+          password: dlord781
+- Calendar:
+    - Agenda:
+        widget:
+          type: calendar
+          view: agenda
+          maxEvents: 20
+          integrations:
+            - type: sonarr
+              service_group: Downloads
+              service_name: Sonarr
+            - type: radarr
+              service_group: Downloads
+              service_name: Radarr
@@ -0,0 +1,69 @@
+title: Dashboard
+favicon: "https://raw.githubusercontent.com/brunnels/assets/main/homepage/icons/heimdall.svg"
+theme: dark
+background:
+  image: https://images.unsplash.com/photo-1502790671504-542ad42d5189?auto=format&fit=crop&w=2560&q=80
+  blur: sm
+  saturate: 50
+  brightness: 50
+  opacity: 50
+color: slate
+headerStyle: clean
+providers:
+  longhorn:
+    url: http://longhorn-frontend.longhorn-system
+layout:
+#  Automation:
+#    style: column
+#  Infrastructure:
+#    icon: mdi-server
+#    style: column
+#  Git:
+#    icon: mdi-desktop-tower
+#    style: column
+#  Storage:
+#    icon: mdi-desktop-tower
+#    style: column
+#  Tools:
+#    style: column
+#  Observability:
+#    icon: mdi-chart-line
+#    style: row
+#    columns: 4
+#  Media:
+#    icon: mdi-play-circle
+#    style: row
+#    columns: 4
+#  Downloads:
+#    icon: mdi-download-circle
+#    style: row
+#    columns: 4
+  Home:
+    style: column
+    icon: mdi-home-analytics
+  Git:
+    style: column
+    icon: mdi-desktop-tower
+  Storage:
+    style: row
+    columns: 2
+    icon: mdi-desktop-tower
+  Calendar:
+    style: column
+    icon: mdi-calendar
+  Media:
+    style: column
+    icon: mdi-play-circle
+  Infrastructure:
+    style: column
+    icon: mdi-server
+  DNS:
+    style: column
+    icon: mdi-server
+  Observability:
+    style: column
+    icon: mdi-chart-line
+  Downloads:
+    style: row
+    columns: 3
+    icon: mdi-download-circle
@@ -0,0 +1,32 @@
+- resources:
+    backend: kubernetes
+    cpu: true
+    expanded: true
+    memory: true
+- kubernetes:
+    cluster:
+      cpu: true
+      label: cluster
+      memory: true
+      show: true
+      showLabel: true
+    nodes:
+      cpu: true
+      memory: true
+      show: false
+      showLabel: true
+- search:
+    provider: [duckduckgo, google]
+    target: _blank
+- openmeteo:
+    latitude: "${SECRET_LATITUDE}"
+    longitude: "${SECRET_LONGITUDE}"
+    timezone: "${TIMEZONE}"
+    units: imperial
+    cache: 15
+- datetime:
+    text_size: l
+    format:
+      dateStyle: long
+      timeStyle: short
+      hourCycle: h23
@@ -0,0 +1,26 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app homepage
+  namespace: flux-system
+spec:
+  targetNamespace: default
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: external-secrets
+  path: ./kubernetes/apps/helpers/homepage/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app
@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./namespace.yaml
+  - ./homepage/ks.yaml
+  - ./theme-park/ks.yaml
@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://kubernetesjsonschema.dev/v1.18.1-standalone-strict/namespace-v1.json
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: default
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled
@@ -0,0 +1,73 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app theme-park
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    controllers:
+      theme-park:
+        replicas: 2
+        strategy: RollingUpdate
+        containers:
+          app:
+            image:
+              repository: ghcr.io/onedr0p/theme-park
+              tag: 1.18.0@sha256:210d8f5d9466df493503184fb076bbf1fb9fbc2b42e273cd4516ac3fd1df7ba2
+            resources:
+              requests:
+                cpu: 10m
+                memory: 32Mi
+              limits:
+                memory: 64Mi
+    defaultPodOptions:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 568
+        runAsGroup: 568
+        fsGroup: 568
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile: { type: RuntimeDefault }
+    service:
+      app:
+        controller: *app
+        ports:
+          http:
+            port: 8080
+    ingress:
+      app:
+        className: internal
+        # annotations:
+        #   external-dns.alpha.kubernetes.io/target: external.${SECRET_DOMAIN}
+        hosts:
+          - host: "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                service:
+                  identifier: app
+                  port: http
+    topologySpreadConstraints:
+      - maxSkew: 1
+        topologyKey: kubernetes.io/hostname
+        whenUnsatisfiable: DoNotSchedule
+        labelSelector:
+          matchLabels:
+            app.kubernetes.io/name: *app
@@ -0,0 +1,6 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
@@ -0,0 +1,24 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app theme-park
+  namespace: flux-system
+spec:
+  targetNamespace: default
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/helpers/theme-park/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app
@@ -0,0 +1,128 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/bjw-s/helm-charts/main/charts/other/app-template/schemas/helmrelease-helm-v2.schema.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app jellyfin
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  maxHistory: 2
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  uninstall:
+    keepHistory: false
+  values:
+    defaultPodOptions:
+      enableServiceLinks: false
+      securityContext:
+        runAsUser: 568
+        runAsGroup: 568
+        fsGroup: 568
+        fsGroupChangePolicy: OnRootMismatch
+    controllers:
+      jellyfin:
+        annotations:
+          reloader.stakater.com/auto: "true"
+        containers:
+          app:
+            image:
+              repository: ghcr.io/jellyfin/jellyfin
+              tag: 10.10.3@sha256:17c3a8d9dddb97789b5f37112840ebf96566442c14d4754193a6c2eb154bc221
+            env:
+              DOTNET_SYSTEM_IO_DISABLEFILELOCKING: "true"
+              JELLYFIN_FFmpeg__probesize: 50000000
+              JELLYFIN_FFmpeg__analyzeduration: 50000000
+              JELLYFIN_PublishedServerUrl: &loadBalancerIP ${CLUSTER_LB_JELLYFIN}
+              TZ: ${TIMEZONE}
+            probes:
+              liveness: &probes
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /health
+                    port: &port 8096
+                  initialDelaySeconds: 0
+                  periodSeconds: 10
+                  timeoutSeconds: 1
+                  failureThreshold: 3
+              readiness: *probes
+              startup:
+                enabled: false
+            resources:
+              requests:
+                # gpu.intel.com/i915: 1
+                cpu: 100m
+                memory: 512Mi
+              limits:
+                # gpu.intel.com/i915: 1
+                memory: 4Gi
+    service:
+      app:
+        controller: *app
+        ports:
+          http:
+            port: *port
+    ingress:
+      app:
+        enabled: true
+        className: internal
+        hosts:
+          - host: &host "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                service:
+                  identifier: app
+                  port: http
+    persistence:
+      config:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/k3s/config/jellyfin
+      music:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/music
+        globalMounts:
+          - path: /var/mnt/vol1/music
+      photo:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/photos/original
+        globalMounts:
+          - path: /var/mnt/vol1/photo
+      video:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/movies
+        globalMounts:
+          - path: /var/mnt/vol1/video
+      transcode:
+        enabled: true
+        type: emptyDir
+        globalMounts:
+          - path: /transcode
+      cache:
+        enabled: true
+        type: emptyDir
+        globalMounts:
+          - path: /cache
@@ -0,0 +1,6 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/SchemaStore/schemastore/master/src/schemas/json/kustomization.json
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
@@ -0,0 +1,26 @@
+---
+# yaml-language-server: $schema=https://raw.githubusercontent.com/fluxcd-community/flux2-schemas/main/kustomization-kustomize-v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app jellyfin
+  namespace: flux-system
+spec:
+  targetNamespace: media
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: external-secrets
+  path: ./kubernetes/apps/media/jellyfin/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app
@@ -0,0 +1,12 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./namespace.yaml
+  - ./jellyfin/ks.yaml
+  - ./overseerr/ks.yaml
+  - ./tautulli/ks.yaml
+  - ./plex/ks.yaml
+generatorOptions:
+  disableNameSuffixHash: true
@@ -0,0 +1,8 @@
+---
+# yaml-language-server: $schema=https://kubernetesjsonschema.dev/v1.18.1-standalone-strict/namespace-v1.json
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: media
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled
@@ -0,0 +1,115 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app overseerr
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    controllers:
+      overseerr:
+        annotations:
+          reloader.stakater.com/auto: "true"
+        containers:
+          app:
+            image:
+              repository: ghcr.io/sct/overseerr
+              tag: rolling@sha256:714ea6db2bc007a2262d112bef7eec74972eb33d9c72bddb9cbd98b8742de950
+            env:
+              TZ: "${TIMEZONE}"
+              LOG_LEVEL: "info"
+              PORT: &port 80
+            probes:
+              liveness: &probes
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /api/v1/status
+                    port: *port
+                  initialDelaySeconds: 0
+                  periodSeconds: 10
+                  timeoutSeconds: 1
+                  failureThreshold: 3
+              readiness: *probes
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: [ "ALL" ] }
+            resources:
+              requests:
+                cpu: 10m
+                memory: 128Mi
+              limits:
+                memory: 4Gi
+    defaultPodOptions:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 568
+        runAsGroup: 568
+        fsGroup: 568
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile: { type: RuntimeDefault }
+    service:
+      app:
+        controller: *app
+        ports:
+          http:
+            port: *port
+    ingress:
+      app:
+        className: internal
+        # annotations:
+        #   external-dns.alpha.kubernetes.io/target: external.${SECRET_DOMAIN}
+        #   gethomepage.dev/enabled: "true"
+        #   gethomepage.dev/group: Media
+        #   gethomepage.dev/name: Overseerr
+        #   gethomepage.dev/icon: overseerr
+        #   gethomepage.dev/description: Media Request Management
+        #   gethomepage.dev/widget.type: overseerr
+        #   gethomepage.dev/widget.url: http://overseerr.media
+        #   gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_OVERSEERR_TOKEN}}` }}"
+        hosts:
+          - host: "requests.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                service:
+                  identifier: app
+                  port: http
+    persistence:
+      config:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/k3s/config/overseerr
+        globalMounts:
+          - path: /app/config
+      cache:
+        storageClass: openebs-hostpath
+        accessMode: ReadWriteOnce
+        size: 15Gi
+        globalMounts:
+          - path: /app/config/cache
+      logs:
+        type: emptyDir
+        globalMounts:
+          - path: /app/config/logs
+      tmp:
+        type: emptyDir
@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
+  # - ../../../../templates/gatus/external
@@ -0,0 +1,24 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app overseerr
+  namespace: flux-system
+spec:
+  targetNamespace: media
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/media/overseerr/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app
@@ -0,0 +1,23 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/external-secrets.io/externalsecret_v1beta1.json
+apiVersion: external-secrets.io/v1beta1
+kind: ExternalSecret
+metadata:
+  name: &name plex
+spec:
+  target:
+    name: *name
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        PLEX_CLAIM: "{{ .PLEX_CLAIM }}"
+  data:
+    - secretKey: PLEX_CLAIM
+      sourceRef:
+        storeRef:
+          name: bitwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: &secretApiKey 8406f7ea-46b0-42ed-bcae-a83984d7b6ae
+        property: password
@@ -0,0 +1,149 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app plex
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    controllers:
+      plex:
+        annotations:
+          reloader.stakater.com/auto: "true"
+        containers:
+          app:
+            image:
+              repository: ghcr.io/onedr0p/plex
+              tag: rolling@sha256:1f28b5e5a964481f80e76db3c986082d2fc3bca2d16d2742704e9adf8349c79c
+            env:
+              TZ: "${TIMEZONE}"
+              ALLOWED_NETWORKS: "${LAN_CIDR},${CLUSTER_CIDR},${SERVICE_CIDR}"
+              PLEX_ADVERTISE_URL: "http://172.16.10.4:32400,https://plex.${SECRET_INTERNAL_DOMAIN}"
+              PLEX_PREFERENCE_1: "AllowMediaDeletion=0"
+              PLEX_PREFERENCE_2: "EnableIPv6=0"
+              PLEX_PREFERENCE_3: "FriendlyName=LordFamilyFlix"
+              PLEX_PREFERENCE_4: "LanNetworksBandwidth=${LAN_CIDR}"
+            envFrom:
+              - secretRef:
+                  name: *app
+            probes:
+              liveness: &probes
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /identity
+                    port: &port 32400
+                  initialDelaySeconds: 0
+                  periodSeconds: 10
+                  timeoutSeconds: 1
+                  failureThreshold: 3
+              readiness: *probes
+            resources:
+              requests:
+                cpu: 50m
+                memory: 512Mi
+              limits:
+                memory: 4Gi
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: ["ALL"] }
+    defaultPodOptions:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile: { type: RuntimeDefault }
+    service:
+      app:
+        controller: *app
+        type: LoadBalancer
+        ports:
+          http:
+            port: *port
+    ingress:
+      app:
+        className: internal
+        # annotations:
+        #   external-dns.alpha.kubernetes.io/target: external.${SECRET_DOMAIN}
+        #   gethomepage.dev/enabled: "true"
+        #   gethomepage.dev/group: Media
+        #   gethomepage.dev/name: Plex
+        #   gethomepage.dev/icon: plex
+        #   gethomepage.dev/description: Media Player
+        #   gethomepage.dev/widget.type: plex
+        #   gethomepage.dev/widget.url: http://plex.media:32400
+        #   gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_PLEX_TOKEN}}` }}"
+        #   nginx.ingress.kubernetes.io/backend-protocol: "HTTPS"
+        #   nginx.ingress.kubernetes.io/configuration-snippet: ${THEME_PARK_SNIPPET}
+        hosts:
+          - host: "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                service:
+                  identifier: app
+                  port: http
+    persistence:
+      config:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/k3s/config/plex
+      cache:
+        storageClass: openebs-hostpath
+        accessMode: ReadWriteOnce
+        size: 10Gi
+        globalMounts:
+          - path: "/config/Library/Application Support/Plex Media Server/Cache"
+      tmp:
+        type: emptyDir
+      transcode:
+        type: emptyDir
+      movies:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/movies
+        globalMounts:
+          - path: /media/movies
+      music:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/music
+        globalMounts:
+          - path: /media/music
+      pictures:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/photos/original
+        globalMounts:
+          - path: /media/photos
+      tv:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/shows
+        globalMounts:
+          - path: /media/tv
@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./externalsecret.yaml
+  - ./helmrelease.yaml
@@ -0,0 +1,24 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app plex
+  namespace: flux-system
+spec:
+  targetNamespace: media
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/media/plex/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app
@@ -0,0 +1,104 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app tautulli
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: app-template
+      version: 3.5.1
+      sourceRef:
+        kind: HelmRepository
+        name: bjw-s
+        namespace: flux-system
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    controllers:
+      tautulli:
+        annotations:
+          reloader.stakater.com/auto: "true"
+        containers:
+          app:
+            image:
+              repository: ghcr.io/onedr0p/tautulli
+              tag: rolling@sha256:96285c7e57dc77b790bb934be25d1d18a7c220b0f9e29748f65b2374bbef24c8
+            env:
+              TZ: America/Denver
+              TAUTULLI__PORT: &port 80
+            probes:
+              liveness: &probes
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /status
+                    port: *port
+                  initialDelaySeconds: 0
+                  periodSeconds: 10
+                  timeoutSeconds: 1
+                  failureThreshold: 3
+              readiness: *probes
+            securityContext:
+              allowPrivilegeEscalation: false
+              readOnlyRootFilesystem: true
+              capabilities: { drop: [ "ALL" ] }
+            resources:
+              requests:
+                cpu: 10m
+                memory: 128Mi
+              limits:
+                memory: 4Gi
+    defaultPodOptions:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 568
+        runAsGroup: 568
+        fsGroup: 568
+        fsGroupChangePolicy: OnRootMismatch
+        seccompProfile: { type: RuntimeDefault }
+    service:
+      app:
+        controller: *app
+        ports:
+          http:
+            port: *port
+    ingress:
+      app:
+        className: internal
+        # annotations:
+        #   external-dns.alpha.kubernetes.io/target: internal.${SECRET_DOMAIN}
+        #   gethomepage.dev/enabled: "true"
+        #   gethomepage.dev/group: Media
+        #   gethomepage.dev/name: Tautulli
+        #   gethomepage.dev/icon: tautulli
+        #   gethomepage.dev/description: Plex Stream Monitoring
+        #   gethomepage.dev/widget.type: tautulli
+        #   gethomepage.dev/widget.url: http://tautulli.media
+        #   gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_TAUTULLI_TOKEN}}` }}"
+        hosts:
+          - host: "{{ .Release.Name }}.${SECRET_INTERNAL_DOMAIN}"
+            paths:
+              - path: /
+                service:
+                  identifier: app
+                  port: http
+    persistence:
+      config:
+        enabled: true
+        type: nfs
+        server: 192.168.1.68
+        path: /mnt/user/k3s/config/tautulli
+      tmp:
+        type: emptyDir
+      add-ons:
+        type: emptyDir
@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./helmrelease.yaml
+  # - ../../../../templates/gatus/guarded
@@ -0,0 +1,24 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app tautulli
+  namespace: flux-system
+spec:
+  targetNamespace: media
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/media/tautulli/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  retryInterval: 1m
+  timeout: 5m
+  postBuild:
+    substitute:
+      APP: *app
@@ -30,7 +30,7 @@ spec:
          app:
            image:
              repository: docker.io/cloudflare/cloudflared
-              tag: 2024.11.0
+              tag: 2024.11.1
            env:
              NO_AUTOUPDATE: true
              TUNNEL_CRED_FILE: /etc/cloudflared/creds/credentials.json
@@ -30,7 +30,7 @@ spec:
      webhook:
        image:
          repository: ghcr.io/kashalls/external-dns-unifi-webhook
-          tag: v0.3.1@sha256:593eeb3594a8418084d3235b2a30ca8aa4c58b949fac3433b86df6c725364e32
+          tag: v0.3.2@sha256:f8cf534970560bc8d1a61cc13f7c9580d91be60f5c6c7a86c3be0ca362208500
        env:
          - name: UNIFI_HOST
            value: https://192.168.10.1
@@ -66,7 +66,7 @@ spec:
    sources: ["crd", "ingress"]
    txtPrefix: k8s.
    txtOwnerId: default
-    domainFilters: ["${SECRET_DOMAIN_INTERNAL}", "${SECRET_DOMAIN}"]
+    domainFilters: ["${SECRET_INTERNAL_DOMAIN}", "${SECRET_DOMAIN}"]
    serviceMonitor:
      enabled: true
    podAnnotations:
@@ -64,7 +64,7 @@ spec:
          namespaceSelector:
            any: true
      extraArgs:
-        default-ssl-certificate: "network/${SECRET_DOMAIN/./-}-production-tls"
+        default-ssl-certificate: "network/${SECRET_INTERNAL_DOMAIN/./-}-production-tls"
      resources:
        requests:
          cpu: 100m
@@ -8,7 +8,7 @@ spec:
  chart:
    spec:
      chart: prometheus-operator-crds
-      version: 15.0.0
+      version: 16.0.0
      sourceRef:
        kind: HelmRepository
        name: prometheus-community
@@ -0,0 +1,30 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &chart csi-driver-nfs
+  namespace: system
+spec:
+  interval: 5m
+  chart:
+    spec:
+      chart: *chart
+      version: v4.9.0
+      sourceRef:
+        kind: HelmRepository
+        name: csi-driver-nfs
+        namespace: flux-system
+  maxHistory: 2
+  install:
+    createNamespace: true
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      retries: 3
+  values:
+    controller:
+      replicas: 2
+    feature:
+      enableFSGroupPolicy: true
@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./storage-classes
+  - ./helmrelease.yaml
@@ -0,0 +1,6 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./provisions.yaml
@@ -0,0 +1,40 @@
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: nfs-provision-csi
+  labels:
+    kustomize.toolkit.fluxcd.io/substitute: "disabled"
+provisioner: nfs.csi.k8s.io
+parameters:
+  server: 192.168.1.68
+  share: /mnt/user/k3s/
+allowVolumeExpansion: true
+reclaimPolicy: Retain
+volumeBindingMode: Immediate
+mountOptions:
+  - nfsvers=4.1
+  - nconnect=8
+  - hard
+  - noatime
+  - nodiratime
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: nfs-provision-csi-database
+  labels:
+    kustomize.toolkit.fluxcd.io/substitute: "disabled"
+provisioner: nfs.csi.k8s.io
+parameters:
+  server: 192.168.1.68
+  share: /mnt/user/cnpg
+allowVolumeExpansion: true
+reclaimPolicy: Retain
+volumeBindingMode: Immediate
+mountOptions:
+  - nfsvers=4.1
+  - nconnect=8
+  - hard
+  - noatime
+  - nodiratime
@@ -0,0 +1,20 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app csi-driver-nfs
+  namespace: flux-system
+spec:
+  targetNamespace: kube-system
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  path: ./kubernetes/apps/storage/csi-driver-nfs/app
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: home-kubernetes
+  wait: false
+  interval: 30m
+  timeout: 5m
@@ -0,0 +1,7 @@
+---
+# yaml-language-server: $schema=https://json.schemastore.org/kustomization
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./namespace.yaml
+  - ./csi-driver-nfs/ks.yaml
@@ -0,0 +1,9 @@
+---
+# yaml-language-server: $schema=https://kubernetesjsonschema.dev/v1.18.1-standalone-strict/namespace-v1.json
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: storage
+  labels:
+    kustomize.toolkit.fluxcd.io/prune: disabled
+    pod-security.kubernetes.io/enforce: privileged
@@ -18,7 +18,7 @@ releases:
  - name: prometheus-operator-crds
    namespace: observability
    chart: oci://ghcr.io/prometheus-community/charts/prometheus-operator-crds
-    version: 15.0.0
+    version: 16.0.0
  - name: cilium
    namespace: kube-system
    chart: cilium/cilium
@@ -30,7 +30,7 @@ releases:
  - name: coredns
    namespace: kube-system
    chart: coredns/coredns
-    version: 1.36.0
+    version: 1.36.1
    values:
      - ../apps/kube-system/coredns/app/helm-values.yaml
    needs:
@@ -0,0 +1,11 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: bitnami
+  namespace: flux-system
+spec:
+  type: oci
+  interval: 5m
+  url: oci://registry-1.docker.io/bitnamicharts
@@ -0,0 +1,10 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: cloudnative-pg
+  namespace: flux-system
+spec:
+  interval: 1h
+  url: https://cloudnative-pg.github.io/charts
@@ -0,0 +1,10 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: csi-driver-nfs
+  namespace: flux-system
+spec:
+  interval: 30m
+  url: https://raw.githubusercontent.com/kubernetes-csi/csi-driver-nfs/master/charts
+  timeout: 3m
@@ -0,0 +1,10 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: csi-driver-smb
+  namespace: flux-system
+spec:
+  interval: 1h
+  url: https://raw.githubusercontent.com/kubernetes-csi/csi-driver-smb/master/charts
@@ -16,3 +16,6 @@ resources:
  - ./external-secrets.yaml
  - ./ingress-nginx.yaml
  - ./k8s-gateway.yaml
+  - ./csi-driver-nfs.yaml
+  - ./cloudnative-pg.yaml
+  - ./bitnami.yaml
@@ -4,10 +4,11 @@ metadata:
    name: cluster-secrets
    namespace: flux-system
 stringData:
-    SECRET_DOMAIN: ENC[AES256_GCM,data:uqdjPED+mxmdUTx7TJIR9A==,iv:hmVDDwzqBYWA7mSqCp0WEZZjHXY1jPtfj71kcHQuWNk=,tag:s/o0767NO/ERXhOrVogwlw==,type:str]
-    SECRET_INTERNAL_DOMAIN: ENC[AES256_GCM,data:V+a232owGhaq0AbwmA==,iv:Kun8a5FY4hJkYIaQaQabhF68YQmg84WvSf7mN5wXReE=,tag:btvlR9FxIC40pcfjIT1xZQ==,type:str]
-    SECRET_ACME_EMAIL: ENC[AES256_GCM,data:O54SPqcxk9AQPM+/SY3AJf9Q18s=,iv:nz8g9wMv1qvFrcaybD1GaxUMU5/yWKNpfncswCN8MCk=,tag:OzDI/ADGJEmZqzdkBMOV6A==,type:str]
-    SECRET_CLOUDFLARE_TUNNEL_ID: ENC[AES256_GCM,data:v+fc5FKSWZDj1FxKOfFqX8b0IhBUzhWMJv/mnPRzRP6+d5qQ,iv:3Vi4MKuFKnCeqdekTWEJs4az+eKbR7acmAeWdk6aOp4=,tag:FtVoEGs5CgXtKGF28Rrjng==,type:str]
+    SECRET_INTERNAL_DOMAIN: ENC[AES256_GCM,data:AvYATV6LqEmALp/j1w==,iv:DDf17Gf2ta+UuMysaeTtN92ti0wrz+eAmawwJSZxyQY=,tag:hoarzYqJXEfMWSFRzpOlzw==,type:str]
+    SECRET_DOMAIN: ENC[AES256_GCM,data:HjoRmQzaP5jG8m1iMc198Q==,iv:1GNInjU80g3lstoVYUY9/pOSh9QnCCmXN44PhZgvOv8=,tag:62X6LxGg9vt1wiW8kf/CsA==,type:str]
+    SECRET_ACME_EMAIL: ENC[AES256_GCM,data:gG7gLBw7i5xLu1HkOYA8O76WPsc=,iv:d71Ip9lrtZR5FFWvV+NQbP9epP6v9cYM1Ntag6yHWAQ=,tag:ZzljWFeetwVubEuIOljrSA==,type:str]
+    SECRET_CLOUDFLARE_TUNNEL_ID: ENC[AES256_GCM,data:22ZGxjzd/GM9JscAoadi+f2Y6UKL6BJ16LOpxObPrw+geR6A,iv:9M1HGTCzlDI8bLAUFzYPznzBJueRnc+/tGORIlDJS88=,tag:1aGOpgabBTt+OdJI/7xBnw==,type:str]
+    SECRET_UNRAID_HOSTNAME: ENC[AES256_GCM,data:DxjjDKkowZYrE7qK,iv:hifntnMQWrtBEDPucuO/KmblEuWNF7qUz8Mi9s44KaM=,tag:zyEJ92uqKXfu6yh18dqqYw==,type:str]
 sops:
    kms: []
    gcp_kms: []
@@ -17,14 +18,14 @@ sops:
        - recipient: age1mhnje42sefcfpvgpeppch84g6vgptmd4gukgvr3gueuxy6ph05xqx45jty
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRZTZrNUxQeDRHWUhPUk1o
-            UklhUlo0V2ZIOTRmTXd3bWN5bndLT0VUZG1RCnJSd3doWHhrOFdpeUE2Q0JWdWoy
-            OTRnOVZYajdFMVIzQzRKdlF4bTVEb2MKLS0tIHk2OEtTYUlML0YxU2sva2JjUUJQ
-            S1hvdXk5dFdRZE00T2NrNC9GaStIYUUK6NfuJJZDu8O2c+6pacIbah7oI8eKYxqX
-            AWRROo/oWzrHoK7eXZHKeTuTi3lgFIFuRSEMzyipcZfu2HKHyVLShQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQZVo3MWRwMFRzeXA5UXN0
+            cGRkbUl6THpQRzlORENoNDZzbzlQenkvMEh3Ck53NzdEOW4yVjlJcUNLU1M2QVVK
+            Qm9CMVpFeXg3dGRuaVVreUFtdDJ0MVUKLS0tIDVQQUpTVHJDSHhJdS9lMk5NdXhu
+            N1dXTnlOaUNLUjh5SVRCZzlhVUF4Y1EKoLjz8aT2CdHI6URVJheQID4/7DkPfWXB
+            yG/wM3CEOlnXP5Eyj8X5r/LmCoeBD7LNlAwQ0PGythA3v+LQpat9Uw==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2024-11-07T06:32:06Z"
-    mac: ENC[AES256_GCM,data:VgeNG+ZraWxkjsd2PBTCaeulXifmt5KkMEVJCJOmLWuKAFCyrIZ+C1fV1J8+rGkRkuEDx+ZWHtvElv9TfTCFqHAhLG/crkRe/HQFvsxOJoC8qO4ciFMn80jTzDGj6dD5VVGLUnkAWaiWbInS0oJC6/ZEhPuTCo1JFrPycpnr4YA=,iv:dE0czOEMYM82/a9/2HLezQlrs6ITatuZPKw+NuegIHw=,tag:UZw1WhREn5sitTbgf9MBSA==,type:str]
+    lastmodified: "2024-11-23T05:19:00Z"
+    mac: ENC[AES256_GCM,data:Hk6SChJVwvvZVbHi4G8biDLrY4gMOfuczt1BHQXx+LEIhN2KDriCIRRL6RT22D41AQ/5rhVb127ZfQXe+WztGK/+do2ED/q8nLwiqWVc3tkpPgVSB4hMHClCJtHh7bSMHP1rtYQElMPopVYPPkzrsK3cC/hNfHJrD1Gy0AJKQaQ=,iv:ydVoJQ36J2RCLBjSak6AfxyVHO//kLWY3hzYukjEdYA=,tag:ISui4EMJb6IWaWh7Se3pFQ==,type:str]
    pgp: []
    encrypted_regex: ^(data|stringData)$
    version: 3.9.1