Update .gitea/workflows/renovate.yml

Reviewed-on: #375

.drone.yml

@@ -1,31 +0,0 @@
----
-kind: pipeline
-type: kubernetes
-name: renovate
-
-trigger:
-  event:
-    - cron
-    - custom
-
-environment:
-  LOG_LEVEL: info
-
-steps:
-  - name: renovate - validate config
-    image: renovate/renovate:41.23.2
-    commands:
-      - unset GIT_COMMITTER_NAME GIT_COMMITTER_EMAIL GIT_AUTHOR_NAME GIT_AUTHOR_EMAIL
-      - renovate-config-validator
-
-  - name: renovate
-    image: renovate/renovate:41.23.2
-    commands:
-      - unset GIT_COMMITTER_NAME GIT_COMMITTER_EMAIL GIT_AUTHOR_NAME GIT_AUTHOR_EMAIL
-      - renovate
-
-    environment:
-      RENOVATE_TOKEN:
-        from_secret: RENOVATE_TOKEN
-      GITHUB_COM_TOKEN:
-        from_secret: GITHUB_COM_TOKEN

.gitea/workflows/renovate.yml

@@ -0,0 +1,25 @@
+name: renovate
+
+on:
+  schedule:
+    - cron: "@daily"
+  workflow_dispatch:
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    container:
+      image: renovate/renovate:41.97.7
+      options: |-
+        --network=bridge
+
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Run Renovate
+        env:
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
+          GITHUB_COM_TOKEN: ${{ secrets.PAT_TOKEN }}
+        run: |
+          renovate

cluster/apps/authelia/tmp-pod.yml

@@ -1,20 +0,0 @@
----
-apiVersion: v1
-kind: Pod
-metadata:
-  name: ubuntu
-  namespace: default
-  labels:
-    name: ubuntu
-spec:
-  containers:
-  - name: ubuntu
-    image: ubuntu:latest
-    command: ["/bin/bash", "-c", "while true; do sleep 10; done;"]
-    volumeMounts:
-    - name: data
-      mountPath: /mnt
-  volumes:
-  - name: data
-    persistentVolumeClaim:
-      claimName: longhorn-authelia

cluster/apps/bazarr/bazarr-pvc.yml

@@ -1,34 +1,14 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: bazarr-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 1Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/bazarr
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: bazarr-pvc
+  name: bazarr-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
+    - ReadWriteOnce
-  volumeName: bazarr-pv
+  volumeMode: Filesystem
-  storageClassName: ""
   resources:
     requests:
-      storage: 1Gi
+      storage: 5Gi
+  storageClassName: longhorn

cluster/apps/bazarr/bazarr.yml

@@ -5,6 +5,8 @@ metadata:
   name: bazarr
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -16,7 +18,7 @@ spec:
     spec:
       containers:
       - name: bazarr
-        image: linuxserver/bazarr:1.5.2
+        image: linuxserver/bazarr:1.5.3
         ports:
         - containerPort: 6767
         env:
@@ -36,7 +38,7 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: bazarr-pvc
+          claimName: bazarr-longhorn
       - name: tv
         nfs:
           server: 10.0.0.123

cluster/apps/code-server/code-server-pvc.yml

@@ -1,34 +1,14 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: code-server-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 1Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/code-server
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: code-server-pvc
+  name: code-server-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
+    - ReadWriteOnce
-  storageClassName: ""
+  volumeMode: Filesystem
-  volumeName: code-server-pv
   resources:
     requests:
       storage: 1Gi
+  storageClassName: longhorn

cluster/apps/code-server/code-server-svc.yml

@@ -9,6 +9,6 @@ spec:
     app: code-server
   type: LoadBalancer
   ports:
-  - port: 8443
+  - port: 8448
     targetPort: 8443
     protocol: TCP

cluster/apps/code-server/code-server.yml

@@ -5,6 +5,8 @@ metadata:
   name: code-server
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -16,7 +18,7 @@ spec:
     spec:
       containers:
       - name: code-server
-        image: lscr.io/linuxserver/code-server:4.101.2
+        image: lscr.io/linuxserver/code-server:4.104.3
         ports:
         - containerPort: 8443
         env:
@@ -44,4 +46,4 @@ spec:
       volumes:
       - name: code-server
         persistentVolumeClaim:
-          claimName: code-server-pvc
+          claimName: code-server-longhorn

cluster/apps/drone/drone-pvc.yml

@@ -1,34 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: drone-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 1Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/drone
-    server: 10.0.0.123
-
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: drone-pvc
-  namespace: default
-spec:
-  accessModes:
-    - ReadWriteMany
-  storageClassName: ""
-  volumeName: drone-pv
-  resources:
-    requests:
-      storage: 1Gi

cluster/apps/drone/drone.yml

@@ -1,75 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: drone
-  labels:
-    app.kubernetes.io/name: drone
-  namespace: default
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: drone
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: drone
-    spec:
-      initContainers:
-        - name: wait-for-gitea
-          image: busybox
-          command:
-          - sh
-          - -c
-          - |
-            while ! nc -z gitea-int-service 3000; do
-              echo "Waiting for Gitea to be ready..."
-              sleep 5
-            done
-            echo "Gitea is ready!"
-        - name: drone-server
-          image: drone/drone:2
-          restartPolicy: Always
-          env:
-          - name: DRONE_GITEA_SERVER
-            value: "https://gitea.akshun-lab.uk"
-          - name: DRONE_GITEA_CLIENT_ID
-            valueFrom:
-              secretKeyRef:
-                name: drone-gitea-secrets
-                key: client_id
-          - name: DRONE_GITEA_CLIENT_SECRET
-            valueFrom:
-              secretKeyRef:
-                name: drone-gitea-secrets
-                key: client_secret
-          - name: DRONE_RPC_SECRET
-            valueFrom:
-              secretKeyRef:
-                name: drone-gitea-secrets
-                key: rpc_secret
-          - name: DRONE_SERVER_HOST
-            value: "drone.akshun-lab.uk"
-          - name: DRONE_SERVER_PROTO
-            value: "https"
-          volumeMounts:
-          - name: drone-data
-            mountPath: /data
-      containers:
-      - name: drone-runner
-        image: drone/drone-runner-kube:latest
-        env:
-        - name: DRONE_RPC_SERVER
-          value: "http://localhost:80"
-        - name: DRONE_RPC_SECRET
-          valueFrom:
-            secretKeyRef:
-              name: drone-gitea-secrets
-              key: rpc_secret
-        - name: DRONE_RPC_HOST
-          value: "localhost:80"
-      volumes:
-      - name: drone-data
-        persistentVolumeClaim:
-          claimName: drone-pvc

cluster/apps/ersatztv/ersatztv-pvc.yml

@@ -1,34 +1,14 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: ersatztv-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 1Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/ersatztv
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: ersatztv-pvc
+  name: ersatztv-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
+    - ReadWriteOnce
-  storageClassName: ""
+  volumeMode: Filesystem
-  volumeName: ersatztv-pv
   resources:
     requests:
-      storage: 1Gi
+      storage: 5Gi
+  storageClassName: longhorn

cluster/apps/ersatztv/ersatztv.yml

@@ -5,6 +5,8 @@ metadata:
   name: ersatztv
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -16,7 +18,7 @@ spec:
     spec:
       containers:
       - name: ersatztv
-        image: jasongdove/ersatztv:v25.2.0-vaapi
+        image: jasongdove/ersatztv:v25.7.1
         ports:
         - containerPort: 8409
         volumeMounts:
@@ -38,7 +40,7 @@ spec:
       volumes:
       - name: data
         persistentVolumeClaim:
-          claimName: ersatztv-pvc
+          claimName: ersatztv-longhorn
       - name: i915
         hostPath:
           path: /dev/dri

cluster/apps/ghostfolio/ghostfolio-pvc.yml

@@ -1,34 +1,14 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: ghostfolio-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 1Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/ghostfolio
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: longhorn-ghostfolio
+  name: ghostfolio-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
+    - ReadWriteOnce
-  storageClassName: ""
+  volumeMode: Filesystem
-  volumeName: ghostfolio-pv
   resources:
     requests:
       storage: 1Gi
+  storageClassName: longhorn

cluster/apps/ghostfolio/ghostfolio.yml

@@ -5,6 +5,8 @@ metadata:
   name: ghostfolio
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: ghostfolio
@@ -76,7 +78,7 @@ spec:
               key: postgres-password
       containers:
       - name: ghostfolio
-        image: docker.io/ghostfolio/ghostfolio:2.178.0
+        image: docker.io/ghostfolio/ghostfolio:2.208.0
         securityContext:
           capabilities:
             drop:
@@ -121,4 +123,4 @@ spec:
       volumes:
       - name: ghostfolio-data
         persistentVolumeClaim:
-          claimName: ghostfolio-pvc
+          claimName: ghostfolio-longhorn

cluster/apps/gitea-act/gitea-act-pvc.yml

@@ -0,0 +1,14 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: gitea-act-runner-longhorn
+  namespace: default
+spec:
+  accessModes:
+    - ReadWriteOnce
+  volumeMode: Filesystem
+  resources:
+    requests:
+      storage: 100Mi
+  storageClassName: longhorn

cluster/apps/gitea-act/gitea-act.yml

@@ -11,19 +11,21 @@ spec:
   selector:
     matchLabels:
       app: gitea-act-runner
-  strategy: {}
+  strategy:
+    type: Recreate
   template:
     metadata:
       labels:
         app: gitea-act-runner
     spec:
       restartPolicy: Always
+      hostNetwork: true
       volumes:
       - name: docker-certs
         emptyDir: {}
       - name: runner-data
         persistentVolumeClaim:
-          claimName: longhorn-gitea-dind
+          claimName: gitea-act-runner-longhorn
       initContainers:
       - name: wait-for-gitea
         image: busybox
@@ -31,14 +33,14 @@ spec:
         - sh
         - -c
         - |
-          while ! nc -z gitea-int-service 3000; do
+          while ! nc -z gitea.akshun-lab.cc 443; do
             echo "Waiting for Gitea to be ready..."
             sleep 5
           done
           echo "Gitea is ready!"
       containers:
       - name: runner
-        image: gitea/act_runner:nightly
+        image: gitea/act_runner@sha256:8477d5b61b655caad4449888bae39f1f34bebd27db56cb15a62dccb3dcf3a944
         command: ["sh", "-c", "while ! nc -z localhost 2376 </dev/null; do echo 'waiting for docker daemon...'; sleep 5; done; /sbin/tini -- run.sh"]
         env:
         - name: DOCKER_HOST
@@ -48,19 +50,18 @@ spec:
         - name: DOCKER_TLS_VERIFY
           value: "1"
         - name: GITEA_INSTANCE_URL
-          value: https://gitea-int-service:3000
+          value: "https://gitea.akshun-lab.cc"
         - name: GITEA_RUNNER_REGISTRATION_TOKEN
-          valueFrom:
+          value: "uxvKmGvtraocJMCcfJ101XC9kUoY8OlCEN18CvgZ"
-            secretKeyRef:
+        - name: CONFIG_FILE
-              name: gitea-runner-token
+          value: "/data/config.yaml"
-              key: token
         volumeMounts:
         - name: docker-certs
           mountPath: /certs
         - name: runner-data
           mountPath: /data
       - name: daemon
-        image: docker:28.2.2-dind
+        image: docker:28.5.1-dind
         env:
         - name: DOCKER_TLS_CERTDIR
           value: /certs
@@ -69,4 +70,3 @@ spec:
         volumeMounts:
         - name: docker-certs
           mountPath: /certs
- 

cluster/apps/gitea/gitea-db.yml

@@ -5,6 +5,8 @@ metadata:
   name: gitea-db
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: gitea-db
@@ -22,7 +24,7 @@ spec:
           mountPath: /var/lib/postgresql/data
       containers:
       - name: gitea-db
-        image: postgres:15.10
+        image: postgres:15.14
         ports:
         - containerPort: 5432
         env:
@@ -41,4 +43,4 @@ spec:
       volumes:
       - name: db
         persistentVolumeClaim:
-          claimName: gitea-db-pvc
+          claimName: gitea-db-longhorn

cluster/apps/gitea/gitea-pvc.yml

@@ -1,69 +1,29 @@
 ---
 apiVersion: v1
-kind: PersistentVolume
+kind: PersistentVolumeClaim
 metadata:
-  name: gitea-app-pv
+  name: gitea-app-longhorn
   namespace: default
 spec:
-  capacity:
-    storage: 5Gi
-  volumeMode: Filesystem
   accessModes:
-    - ReadWriteMany
+    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
+  volumeMode: Filesystem
-  mountOptions:
+  resources:
-    - hard
+    requests:
-    - nfsvers=4.1
+      storage: 5Gi
-  nfs:
+  storageClassName: longhorn
-    path: /k3s/volumes/gitea/app/
-    server: 10.0.0.123
 
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: gitea-app-pvc
+  name: gitea-db-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
+    - ReadWriteOnce
-  storageClassName: ""
-  volumeName: gitea-app-pv
-  resources:
-    requests:
-      storage: 5Gi
-
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: gitea-db-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 5Gi
   volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/gitea/db/
-    server: 10.0.0.123
-
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: gitea-db-pvc
-  namespace: default
-spec:
-  accessModes:
-    - ReadWriteMany
-  storageClassName: ""
-  volumeName: gitea-db-pv
   resources:
     requests:
       storage: 5Gi
+  storageClassName: longhorn

cluster/apps/gitea/gitea.yml

@@ -5,6 +5,8 @@ metadata:
   name: gitea-app
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -27,7 +29,7 @@ spec:
           done
       containers:
       - name: gitea
-        image: gitea/gitea:1.24.2
+        image: gitea/gitea:1.24.6
         ports:
         - containerPort: 22
         - containerPort: 3000
@@ -67,4 +69,4 @@ spec:
           type: File
       - name: gitea-data
         persistentVolumeClaim:
-          claimName: gitea-app-pvc
+          claimName: gitea-app-longhorn

cluster/apps/gotenberg/gotenberg-svc.yml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: gotenberg-service
+  namespace: default
+spec:
+  selector:
+    app: gotenberg
+  type: ClusterIP
+  ports:
+  - port: 3000
+    targetPort: 3000

cluster/apps/gotenberg/gotenberg.yml

@@ -0,0 +1,30 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gotenberg
+  namespace: default
+spec:
+  selector:
+    matchLabels:
+      app: gotenberg
+  template:
+    metadata:
+      labels:
+        app: gotenberg
+    spec:
+      securityContext:
+        runAsUser: 1001
+      containers:
+      - name: gotenberg
+        image: gotenberg/gotenberg:8.24
+        command:
+        - sh
+        - -c
+        - |
+          gotenberg --chromium-disable-javascript=true --chromium-allow-list=file:///tmp/.*
+        ports:
+        - containerPort: 3000
+        securityContext:
+          readOnlyRootFilesystem: false
+          allowPrivilegeEscalation: false
+          privileged: false

cluster/apps/homepage/homepage-config.yml

@@ -32,7 +32,7 @@ data:
             Proxmox (NVIDIA GPU):
                 style: row
                 columns: 5
-                tab: Stats       
+                tab: Stats
             Proxmox (AMD GPU):
                 style: row
                 columns: 5
@@ -51,84 +51,154 @@ data:
                 tab: Bookmarks
         useEqualHeights: true
         hideErrors: true
-        background: /images/background.png
+        statusStyle: "dot"
+        background: /images/sur.png
     services.yaml: |
         - Apps:
               - Sonarr:
-                    href: https://sonarr.akshun-lab.uk
+                    href: https://sonarr.akshun-lab.cc
                     description: series
                     icon: sonarr.png
+                    namespace: default
+                    podSelector: app=sonarr
+                    app: sonarr
                     widget:
                         type: sonarr
                         url: http://10.0.0.14:8989
                         key: "${SONARR_API_KEY}"
               - Radarr:
-                    href: https://radarr.akshun-lab.uk
+                    href: https://radarr.akshun-lab.cc
                     description: movies
                     icon: radarr.png
+                    namespace: default
+                    podSelector: app=radarr
+                    app: radarr
                     widget:
                         type: radarr
                         url: http://10.0.0.14:7878
                         key: "${RADARR_API_KEY}"
               - Bazarr:
-                    href: https://bazarr.akshun-lab.uk
+                    href: https://bazarr.akshun-lab.cc
                     description: subtitles
                     icon: bazarr.png
+                    namespace: default
+                    podSelector: app=bazarr
+                    app: bazarr
                     widget:
                         type: bazarr
                         url: http://10.0.0.14:6767
                         key: "${BAZARR_API_KEY}"
               - Jellyfin:
-                    href: https://jellyfin.akshun-lab.uk
+                    href: https://jellyfin.akshun-lab.cc
                     description: streaming
                     icon: jellyfin.png
+                    namespace: default
+                    podSelector: app=jellyfin
+                    app: jellyfin
                     widget:
                         type: jellyfin
                         url: http://10.0.0.14:8096
                         key: "${JELLYFIN_API_KEY}"
               - qBittorrent:
-                    href: https://qbittorrent.akshun-lab.uk
+                    href: https://qbittorrent.akshun-lab.cc
                     description: torrent client
                     icon: qbittorrent.png
+                    namespace: default
+                    podSelector: app=qbittorrent
+                    app: qbittorrent
                     widget:
                         type: qbittorrent
                         username: admin
                         password: "${QBITTORRENT_PASSWORD}"
                         url: http://10.0.0.14:8080
               - Jellyseerr:
-                    href: https://jellyseerr.akshun-lab.uk
+                    href: https://jellyseerr.akshun-lab.cc
                     description: request movies and shows
                     icon: jellyseerr.png
+                    namespace: default
+                    podSelector: app=jellyseerr
+                    app: jellyseerr
                     widget:
                         type: jellyseerr
                         url: http://10.0.0.14:5055
                         key: "${JELLYSEERR_API_KEY}"
               - Prowlarr:
-                    href: https://prowlarr.akshun-lab.uk
+                    href: https://prowlarr.akshun-lab.cc
                     description: indexers
                     icon: prowlarr.png
+                    namespace: default
+                    podSelector: app=prowlarr
+                    app: prowlarr
                     widget:
                         type: prowlarr
                         url: http://10.0.0.14:9696
                         key: "${PROWLARR_API_KEY}"
               - Speedtest:
-                    href: https://speedtest.akshun-lab.uk
+                    href: https://speedtest.akshun-lab.cc
                     description: speedtest
                     icon: si-speedtest.svg
+                    namespace: default
+                    podSelector: app=speedtest
+                    app: speedtest
                     widget:
                         type: speedtest
                         url: http://10.0.0.14:8181
               - Immich:
-                    href: https://immich.akshun-lab.uk
+                    href: https://immich.akshun-lab.cc
                     description: photos
                     icon: immich.png
+                    namespace: default
+                    podSelector: app=immich-app
+                    app: immich-app
                     widget:
                         type: immich
                         url: http://10.0.0.14:2283
                         key: "${IMMICH_API_KEY}"
                         version: 2
+              - Gitea:
+                    href: https://gitea.akshun-lab.cc
+                    description: Git Server
+                    icon: gitea.png
+                    namespace: default
+                    podSelector: app=gitea-app
+                    app: gitea-app
+                    widget:
+                        type: gitea
+                        url: http://10.0.0.14:3011
+                        key: "${GITEA_API_KEY}"
+                        fields: ["repositories", "issues", "pulls"]
+              - Pihole:
+                    href: https://pihole.akshun-lab.cc/admin
+                    description: ad blocker
+                    icon: pi-hole.png
+                    namespace: default
+                    podSelector: app=pihole
+                    app: pihole
+                    widget:
+                        type: pihole
+                        url: http://10.0.0.14:8585
+                        version: 6
+                        key: "${PIHOLE_PASSWORD}"
+              - Nextcloud:
+                    href: https://nextcloud.akshun-lab.cc
+                    description: files
+                    icon: nextcloud.png
+                    namespace: default
+                    podSelector: app=nextcloud
+                    app: nextcloud
+                    widget:
+                        type: nextcloud
+                        url: https://10.0.0.14:9200
+                        key: "${NEXTCLOUD_PASSWORD}"
+              - Crafty:
+                    href: https://crafty.akshun-lab.cc
+                    description: minecraft server manager
+                    icon: crafty-controller.png
+                    widget:
+                        type: minecraft
+                        url: udp://192.168.1.3:25565
               - Proxmox:
-                    href: https://proxmox.akshun-lab.uk
+                    href: https://proxmox.akshun-lab.cc
                     description: VMs
                     icon: proxmox.png
                     widget:
@@ -136,82 +206,77 @@ data:
                         url: https://10.0.0.100:8006
                         username: api@pam!homepage
                         password: "${PROXMOX_PASSWORD}"
-              - Gitea:
+              - Proxmox Backup Server:
-                    href: https://gitea.akshun-lab.uk
+                    href: https://pbs.akshun-lab.cc
-                    description: Git Server
+                    description: backup server
-                    icon: gitea.png
+                    icon: proxmox.png
                     widget:
-                        type: gitea
+                        type: proxmoxbackupserver
-                        url: http://10.0.0.14:3011
+                        url: https://192.168.1.112:8007
-                        key: "${GITEA_API_KEY}"
+                        username: root@pam!homepage
-                        fields: ["repositories", "issues", "pulls"]
+                        password: "${PROXMOX_BACKUP_SERVER_PASSWORD}"
-              - Crafty:
+                        datastore: backups
-                    href: https://minecraft.akshun-lab.uk
+                        fields: ["datastore_usage", "cpu_usage", "memory_usage"]
-                    description: crafty controller
-                    icon: crafty-controller.png
-                    widget:
-                        type: minecraft
-                        url: udp://192.168.1.3:25565
               - Invidious:
-                    href: https://invidious.akshun-lab.uk
+                    href: https://invidious.akshun-lab.cc
                     description: youtube frontend
+                    namespace: default
+                    podSelector: app=invidious
+                    app: invidious
                     icon: invidious.png
-              - Nextcloud:
-                    href: https://nextcloud.akshun-lab.uk
-                    description: files
-                    icon: nextcloud.png
               - VS Code:
-                    href: https://vs.akshun-lab.uk
+                    href: https://vs.akshun-lab.cc
                     description: VS code server
                     icon: vscode.png
+                    namespace: default
+                    podSelector: app=code-server
+                    app: code-server
               - Semaphore:
-                    href: https://semaphore.akshun-lab.uk
+                    href: https://semaphore.akshun-lab.cc
                     description: ansible gui
                     icon: semaphore.png
-              - Open Media Vault:
+                    namespace: default
-                    href: https://omv.akshun-lab.uk
+                    podSelector: app=semaphore
-                    description: NAS
+                    app: semaphore
-                    icon: openmediavault.png
               - Ersatztv:
                     icon: ersatztv.png
                     description: live tv for jellyfin
-                    href: https://ersatztv.akshun-lab.uk
+                    href: https://ersatztv.akshun-lab.cc
+                    namespace: default
+                    podSelector: app=ersatztv
+                    app: ersatztv
               - Jellystat:
                     icon: jellystat.png
                     description: jellyfin stats
-                    href: https://jellystat.akshun-lab.uk
+                    href: https://jellystat.akshun-lab.cc
+                    namespace: default
+                    podSelector: app=jellystat
+                    app: jellystat
               - Paperless NGX:
                     icon: paperless.png
                     description: documents OCR
-                    href: https://ngx.akshun-lab.uk
+                    href: https://ngx.akshun-lab.cc
-              - Longhorn:
+                    namespace: default
-                    icon: longhorn.png
+                    podSelector: app=paperless-ngx
-                    description: kubernetes storage
+                    app: paperless-ngx
-                    href: https://longhorn.akshun-lab.uk
-              - Portainer:
-                    icon: portainer.png
-                    description: container management
-                    href: https://portainer.akshun-lab.uk
-              - Rancher:
-                    icon: rancher.png
-                    description: kubernetes management
-                    href: https://rancher.akshun-lab.uk
-              - Open-WebUI:
-                    icon: ollama.png
-                    description: ollama Frontend
-                    href: https://ollama.akshun-lab.uk
               - Ghostfolio:
                     icon: ghostfolio.png
                     description: portfolio analyzer
-                    href: https://ghost.akshun-lab.uk
+                    href: https://ghost.akshun-lab.cc
-              - AdGuardHome:
+                    namespace: default
-                    icon: adguard-home.png
+                    podSelector: app=ghostfolio
-                    description: ad blocker
+                    app: ghostfolio
-                    href: https://adguard.akshun-lab.uk
+              - Searxng:
-              - Drone:
+                    icon: searxng.png
-                    icon: drone.png
+                    description: search engine
-                    description: CI/CD
+                    href: https://sear.akshun-lab.cc
-                    href: https://drone.akshun-lab.uk
+                    namespace: default
+                    podSelector: app=searxng
+                    app: searxng
+              - Open Media Vault:
+                    href: http://192.168.1.4
+                    description: NAS
+                    icon: openmediavault.png
         - Bookmarks:
               - Disney:
                     href: https://www.hotstar.com
@@ -238,78 +303,93 @@ data:
         - Proxmox (AMD GPU):
               - CPU Usage:
                     widget:
+                        version: 4
                         type: glances
                         url: http://192.168.1.113:61208
                         metric: cpu
               - Memory Usage:
                     widget:
+                        version: 4
                         type: glances
                         url: http://192.168.1.113:61208
                         metric: memory
               - Processes:
                     widget:
+                        version: 4
                         type: glances
                         url: http://192.168.1.113:61208
                         metric: process
               - Sensor:
                     widget:
+                        version: 4
                         type: glances
                         url: http://192.168.1.113:61208
                         metric: sensor:Tctl
               - Disk Usage:
                     widget:
+                        version: 4
                         type: glances
                         url: http://192.168.1.113:61208
                         metric: disk:sdb
         - Proxmox (NVIDIA GPU):
               - CPU Usage:
                     widget:
+                        version: 4
                         type: glances
                         url: http://192.168.1.126:61208 
                         metric: cpu
               - Memory Usage:
                     widget:
+                        version: 4
                         type: glances
                         url: http://192.168.1.126:61208
                         metric: memory
               - Processes:
                     widget:
+                        version: 4
                         type: glances
                         url: http://192.168.1.126:61208
                         metric: process
               - Sensor:
                     widget:
+                        version: 4
                         type: glances
                         url: http://192.168.1.126:61208
                         metric: sensor:Package id 0
               - Disk Usage:
                     widget:
+                        version: 4
                         type: glances
                         url: http://192.168.1.126:61208
                         metric: disk:nvme0n1
         - Proxmox (Asus):
               - CPU Usage:
                     widget:
+                        version: 4
                         type: glances
                         url: http://192.168.1.199:61208
                         metric: cpu
               - Memory Usage:
                     widget:
+                        version: 4
                         type: glances
                         url: http://192.168.1.199:61208
                         metric: memory
               - Processes:
                     widget:
+                        version: 4
                         type: glances
                         url: http://192.168.1.199:61208
                         metric: process
               - Sensor:
                     widget:
+                        version: 4
                         type: glances
                         url: http://192.168.1.199:61208
                         metric: sensor:Sensor 1
               - Disk Usage:
                     widget:
+                        version: 4
                         type: glances
                         url: http://192.168.1.199:61208
                         metric: disk:nvme0n1

cluster/apps/homepage/homepage-pvc.yml

@@ -1,34 +1,14 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: homepage-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 100Mi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/homepage
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: homepage-pvc
+  name: homepage-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
+    - ReadWriteOnce
-  storageClassName: ""
+  volumeMode: Filesystem
-  volumeName: homepage-pv
   resources:
     requests:
       storage: 100Mi
+  storageClassName: longhorn

cluster/apps/homepage/homepage.yml

@@ -10,7 +10,7 @@ spec:
   revisionHistoryLimit: 3
   replicas: 1
   strategy:
-    type: RollingUpdate
+    type: Recreate
   selector:
     matchLabels:
       app.kubernetes.io/name: homepage
@@ -42,11 +42,11 @@ spec:
               subPath: services.yaml
       containers:
         - name: homepage
-          image: "ghcr.io/gethomepage/homepage:v1.3.2"
+          image: "ghcr.io/gethomepage/homepage:v1.5.0"
           imagePullPolicy: IfNotPresent
           env:
             - name: HOMEPAGE_ALLOWED_HOSTS
-              value: home.akshun-lab.uk
+              value: home.akshun-lab.cc
           ports:
             - name: http
               containerPort: 3000
@@ -86,7 +86,7 @@ spec:
             name: homepage
         - name: images
           persistentVolumeClaim:
-            claimName: homepage-pvc
+            claimName: homepage-longhorn
         - name: logs
           emptyDir: {}
         - name: tmp

cluster/apps/immich/immich-db.yml

@@ -15,7 +15,7 @@ spec:
     spec:
       containers:
       - name: redis
-        image: docker.io/valkey/valkey:8-bookworm@sha256:fec42f399876eb6faf9e008570597741c87ff7662a54185593e74b09ce83d177
+        image: docker.io/valkey/valkey:8-bookworm@sha256:fea8b3e67b15729d4bb70589eb03367bab9ad1ee89c876f54327fc7c6e618571
         env:
         - name: REDIS_HOSTNAME
           value: "immich-redis"

cluster/apps/immich/immich-ml.yml

@@ -0,0 +1,42 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: immich-ml
+  namespace: default
+spec:
+  strategy:
+    type: Recreate
+  replicas: 1
+  selector:
+    matchLabels:
+      app: immich-ml
+  template:
+    metadata:
+      labels:
+        app: immich-ml
+    spec:
+      containers:
+      - name: immich-machine-learning
+        image: ghcr.io/immich-app/immich-machine-learning:v2.0.1-openvino
+        ports:
+        - containerPort: 3003
+        env:
+        - name: REDIS_HOSTNAME
+          value: "immich-redis-service"
+        - name: NVIDIA_VISIBLE_DEVICES
+          value: "all"
+        - name: MACHINE_LEARNING_DEVICE_IDS
+          value: "0"
+        volumeMounts:
+        - name: model-cache
+          mountPath: /cache
+        resources:
+          requests:
+            gpu.intel.com/i915: "1"
+          limits:
+            gpu.intel.com/i915: "1"
+      volumes:
+      - name: model-cache
+        persistentVolumeClaim:
+          claimName: immich-cache-longhorn

cluster/apps/immich/immich-pvc.yml

@@ -1,37 +1,17 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: immich-cache-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 10Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/immich/cache/
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: immich-cache-pvc
+  name: immich-cache-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
+    - ReadWriteOnce
-  storageClassName: ""
+  volumeMode: Filesystem
-  volumeName: immich-cache-pv
   resources:
     requests:
       storage: 10Gi
+  storageClassName: longhorn
 
 ---
 apiVersion: v1
@@ -67,9 +47,9 @@ metadata:
   name: immich-pictures-pvc
   namespace: default
 spec:
-  storageClassName: immich-pictures-pv
   accessModes:
     - ReadWriteMany
+  storageClassName: immich-pictures-pv
   resources:
     requests:
-      storage: 10Gi
+      storage: 100Gi

cluster/apps/immich/immich-svc.yml

@@ -21,7 +21,7 @@ metadata:
 spec:
   type: LoadBalancer
   selector:
-    app: immich-app
+    app: immich-ml
   ports:
   - port: 3333
     targetPort: 3003

cluster/apps/immich/immich.yml

@@ -5,6 +5,8 @@ metadata:
   name: immich-app
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -14,9 +16,6 @@ spec:
       labels:
         app: immich-app
     spec:
-      runtimeClassName: nvidia
-      nodeSelector:
-        type: immich
       initContainers:
       - name: wait-for-redis
         image: busybox
@@ -40,7 +39,7 @@ spec:
           done
       containers:
       - name: immich-server
-        image: ghcr.io/immich-app/immich-server:v1.135.3
+        image: ghcr.io/immich-app/immich-server:v2.0.1
         ports:
         - containerPort: 2283
         env:
@@ -62,24 +61,7 @@ spec:
         volumeMounts:
         - mountPath: /usr/src/app/upload
           name: pictures
-      - name: immich-machine-learning
-        image: ghcr.io/immich-app/immich-machine-learning:v1.135.3-cuda
-        ports:
-        - containerPort: 3003
-        env:
-        - name: REDIS_HOSTNAME
-          value: "immich-redis-service"
-        - name: NVIDIA_VISIBLE_DEVICES
-          value: "all"
-        - name: MACHINE_LEARNING_DEVICE_IDS
-          value: "0"
-        volumeMounts:
-        - name: model-cache
-          mountPath: /cache
       volumes:
       - name: pictures
         persistentVolumeClaim:
           claimName: immich-pictures-pvc
-      - name: model-cache
-        persistentVolumeClaim:
-          claimName: immich-cache-pvc

cluster/apps/invidious/invidious-config.yml

@@ -13,8 +13,7 @@ data:
       host: localhost
       port: 5432
     check_tables: true
-    signature_server: localhost:12999
+    invidious_companion:
-    visitor_data: ${VISITOR_DATA}
+    - private_url: "http://localhost:8282/companion"
-    po_token: ${PO_TOKEN}
+    invidious_companion_key: ${INVIDIOUS_COMPANION_KEY}
-    port: 3000
     hmac_key: ${INVIDIOUS_HMAC_KEY}

cluster/apps/invidious/invidious-pvc.yml

@@ -1,34 +1,14 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: invidious-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 1Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/invidious
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: invidious-pvc
+  name: invidious-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
+    - ReadWriteOnce
-  storageClassName: ""
+  volumeMode: Filesystem
-  volumeName: invidious-pv
   resources:
     requests:
       storage: 1Gi
+  storageClassName: longhorn

cluster/apps/invidious/invidious.yml

@@ -5,6 +5,8 @@ metadata:
   name: invidious
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -42,7 +44,7 @@ spec:
         - name: postgres-data
           mountPath: /var/lib/postgresql/data
       - name: postgres
-        image: postgres:15.13
+        image: postgres:15.14
         restartPolicy: Always
         env:
         - name: POSTGRES_DB
@@ -63,21 +65,22 @@ spec:
         volumeMounts:
         - name: postgres-data
           mountPath: /var/lib/postgresql/data
-      - name: inv-sig-helper
+      - name: inv-companion
-        image: quay.io/invidious/inv-sig-helper@sha256:b5466c9add729e82e4e3ee5515c30b69df02d78ebb2486dbc9c63e456f29083d
+        image: quay.io/invidious/invidious-companion@sha256:a96f7a1eb88bf0d5882d519c9410f8c7b2d391cafc378b72f3bfd37dd5f0e587
         restartPolicy: Always
-        args: ["--tcp", "0.0.0.0:12999"]
         env:
-        - name: RUST_LOG
+        - name: SERVER_SECRET_KEY
-          value: "info"
+          valueFrom:
+            secretKeyRef:
+              name: invidious-secrets
+              key: INVIDIOUS_COMPANION_KEY
         securityContext:
-          readOnlyRootFilesystem: true
           capabilities:
             drop:
             - ALL
       containers:
       - name: invidious
-        image: quay.io/invidious/invidious@sha256:9ffa4f1ea5cf01abe3102777102bd7a13153c79f6ff6ac072b6a29dda6909a8b
+        image: quay.io/invidious/invidious@sha256:2836b5b8226a53a9cc2afdbd5f5fe6bccdd200f2e17cd92a828b4dc8d8b5cc06
         command:
         - sh
         - -c
@@ -105,4 +108,4 @@ spec:
           name: invidious-config
       - name: postgres-data
         persistentVolumeClaim:
-          claimName: invidious-pvc
+          claimName: invidious-longhorn

cluster/apps/jellyfin/jellyfin-pvc.yml

@@ -1,34 +1,14 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: jellyfin-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 20Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/jellyfin/
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: jellyfin-pvc
+  name: jellyfin-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
+    - ReadWriteOnce
-  storageClassName: ""
+  volumeMode: Filesystem
-  volumeName: jellyfin-pv
   resources:
     requests:
       storage: 20Gi
+  storageClassName: longhorn

cluster/apps/jellyfin/jellyfin.yml

@@ -5,6 +5,8 @@ metadata:
   name: jellyfin
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -22,8 +24,6 @@ spec:
         volumeMounts:
         - name: media
           mountPath: /media
-          readOnly: true
-          recursiveReadOnly: Enabled
         - name: config
           mountPath: /config
         - name: cache
@@ -40,7 +40,7 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: jellyfin-pvc
+          claimName: jellyfin-longhorn
       - name: cache
         hostPath:
           path: /tmp/

cluster/apps/jellyseerr/jellyseerr-pvc.yml

@@ -1,34 +1,14 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: jellyseerr-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 1Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/jellyseerr
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: jellyseerr-pvc
+  name: jellyseerr-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
+    - ReadWriteOnce
-  storageClassName: ""
+  volumeMode: Filesystem
-  volumeName: jellyseerr-pv
   resources:
     requests:
       storage: 1Gi
+  storageClassName: longhorn

cluster/apps/jellyseerr/jellyseerr.yml

@@ -5,6 +5,8 @@ metadata:
   name: jellyseerr
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -14,9 +16,31 @@ spec:
       labels:
         app: jellyseerr
     spec:
+      initContainers:
+      - name: gluetun
+        image: qmcgaw/gluetun:v3.40.0
+        restartPolicy: Always
+        securityContext:
+          capabilities:
+            add:
+            - NET_ADMIN
+        envFrom:
+        - configMapRef:
+            name: gluetun-config
+        env:
+        - name: OPENVPN_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: openvpn-secrets
+              key: OPENVPN_PASSWORD
+        - name: OPENVPN_USER
+          valueFrom:
+            secretKeyRef:
+              name: openvpn-secrets
+              key: OPENVPN_USER
       containers:
       - name: jellyseerr
-        image: fallenbagel/jellyseerr:2.7.0
+        image: fallenbagel/jellyseerr:2.7.3
         ports:
         - containerPort: 5055
         env:
@@ -30,4 +54,4 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: jellyseerr-pvc
+          claimName: jellyseerr-longhorn

cluster/apps/jellystat/jellystat-pvc.yml

@@ -1,34 +1,29 @@
 ---
 apiVersion: v1
-kind: PersistentVolume
+kind: PersistentVolumeClaim
 metadata:
-  name: jellystat-pv
+  name: jellystat-longhorn
   namespace: default
 spec:
-  capacity:
-    storage: 1Gi
-  volumeMode: Filesystem
   accessModes:
-    - ReadWriteMany
+    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
+  volumeMode: Filesystem
-  mountOptions:
+  resources:
-    - hard
+    requests:
-    - nfsvers=4.1
+      storage: 1Gi
-  nfs:
+  storageClassName: longhorn
-    path: /k3s/volumes/jellystat
-    server: 10.0.0.123
 
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: jellystat-pvc
+  name: jellystat-backups-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
+    - ReadWriteOnce
-  storageClassName: ""
+  volumeMode: Filesystem
-  volumeName: jellystat-pv
   resources:
     requests:
       storage: 1Gi
+  storageClassName: longhorn

cluster/apps/jellystat/jellystat.yml

@@ -5,6 +5,8 @@ metadata:
   name: jellystat
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -30,10 +32,11 @@ spec:
             secretKeyRef:
               name: jellystat-secret
               key: password
+        - name: PGDATA
+          value: /mnt/postgres/data
         volumeMounts:
-        - name: backup
+        - name: postgres-data
-          mountPath: /var/lib/postgresql/data
+          mountPath: /mnt/postgres
-          subPath: db
       containers:
       - name: jellystat
         image: cyfershepard/jellystat:1.1.6
@@ -57,10 +60,12 @@ spec:
               name: jellystat-secret
               key: jwt
         volumeMounts:
-        - name: backup
+        - name: backups
           mountPath: /app/backend/backup-data
-          subPath: backup
       volumes:
-      - name: backup
+      - name: postgres-data
         persistentVolumeClaim:
-          claimName: jellystat-pvc
+          claimName: jellystat-longhorn
+      - name: backups
+        persistentVolumeClaim:
+          claimName: jellystat-backups-longhorn

cluster/apps/nextcloud/collabora.yml

@@ -5,6 +5,8 @@ metadata:
   name: collabora
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: collabora
@@ -15,14 +17,14 @@ spec:
     spec:
       containers:
       - name: collabora
-        image: collabora/code:25.04.3.2.1
+        image: collabora/code:25.04.6.1.1
         ports:
         - containerPort: 9980
         env:
         - name: aliasgroup1
           value: "https://nextcloud.akshun-lab.uk"
         - name: aliasgroup2
-          value: "https://nextcloud-int-service:9980"
+          value: "https://nextcloud.akshun-lab.cc"
         securityContext:
           capabilities:
             add:

cluster/apps/nextcloud/nextcloud-db.yml

@@ -15,7 +15,7 @@ spec:
     spec:
       containers:
       - name: nextcloud-db
-        image: mariadb:11.8.2
+        image: mariadb:11.8.3
         ports:
         - containerPort: 3306
         env:

cluster/apps/nextcloud/nextcloud.yml

@@ -5,6 +5,8 @@ metadata:
   name: nextcloud
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: nextcloud
@@ -26,7 +28,7 @@ spec:
             done
       containers:
       - name: nextcloud
-        image: lscr.io/linuxserver/nextcloud:31.0.6
+        image: lscr.io/linuxserver/nextcloud:32.0.0
         ports:
         - containerPort: 443
         env:

cluster/apps/open-webui/open-webui-pvc.yml

@@ -1,34 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: open-webui-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 5Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/open-webui
-    server: 10.0.0.123
-
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: open-webui-pvc
-  namespace: default
-spec:
-  accessModes:
-    - ReadWriteMany
-  storageClassName: ""
-  volumeName: open-webui-pv
-  resources:
-    requests:
-      storage: 5Gi

cluster/apps/paperless-ngx/paperless-ngx.yml

@@ -5,6 +5,8 @@ metadata:
   name: paperless-ngx
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: paperless-ngx
@@ -15,7 +17,7 @@ spec:
     spec:
       initContainers:
       - name: paperless-ngx-db
-        image: docker.io/library/redis:7
+        image: docker.io/library/redis:8
         restartPolicy: Always
         ports:
         - containerPort: 6379
@@ -25,20 +27,26 @@ spec:
           subPath: redis
       containers:
       - name: paperless-ngx
-        image: ghcr.io/paperless-ngx/paperless-ngx:2.17.1
+        image: ghcr.io/paperless-ngx/paperless-ngx:2.18.4
         ports:
         - containerPort: 8000
         env:
         - name: PAPERLESS_REDIS
           value: "redis://localhost:6379"
         - name: PAPERLESS_URL
-          value: "https://ngx.akshun-lab.uk"
+          value: "https://ngx.akshun-lab.cc"
         - name: PAPERLESS_CSRF_TRUSTED_ORIGINS
-          value: "https://*.akshun-lab.uk"
+          value: "https://*.akshun-lab.cc"
         - name: PAPERLESS_CORS_ALLOWED_HOSTS
-          value: "https://ngx.akshun-lab.uk"
+          value: "https://ngx.akshun-lab.cc"
         - name: PAPERLESS_TIME_ZONE
           value: "Asia/Kolkata"
+        - name: PAPERLESS_TIKA_ENABLED
+          value: "1"
+        - name: PAPERLESS_TIKA_ENDPOINT
+          value: "http://tika-service:9998"
+        - name: PAPERLESS_TIKA_GOTENBERG_ENDPOINT
+          value: "http://gotenberg-service:3000"
         volumeMounts:
         - name: data
           mountPath: /usr/src/paperless/data
@@ -55,4 +63,4 @@ spec:
       volumes:
       - name: data
         persistentVolumeClaim:
-          claimName: paperless-pvc
+          claimName: paperless-longhorn

cluster/apps/paperless-ngx/paperless-pvc.yml

@@ -1,34 +1,14 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: paperless-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 1Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/paperless
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: paperless-pvc
+  name: paperless-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
+    - ReadWriteOnce
-  storageClassName: ""
+  volumeMode: Filesystem
-  volumeName: paperless-pv
   resources:
     requests:
       storage: 1Gi
+  storageClassName: longhorn

cluster/apps/pihole/pihole-pvc.yml

@@ -0,0 +1,14 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: pihole-longhorn
+  namespace: default
+spec:
+  accessModes:
+    - ReadWriteOnce
+  volumeMode: Filesystem
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: longhorn

cluster/apps/pihole/pihole-svc.yml

@@ -2,13 +2,14 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: drone-server-service
+  name: pihole-tcp-service
   namespace: default
 spec:
-  selector:
-    app.kubernetes.io/name: drone
   type: LoadBalancer
+  selector:
+    app: pihole
   ports:
-  - port: 4338
+  - port: 8585
     targetPort: 80
     protocol: TCP
+    name: web

cluster/apps/pihole/pihole.yml

@@ -0,0 +1,54 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pihole
+  namespace: default
+spec:
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: pihole
+  template:
+    metadata:
+      labels:
+        app: pihole
+    spec:
+      hostNetwork: true
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: kubernetes.io/hostname
+                operator: In
+                values:
+                - kube-02
+                - kube-03
+                - kube-04
+                - kube-05
+      containers:
+      - name: pihole
+        image: pihole/pihole@sha256:90a1412b3d3037d1c22131402bde19180d898255b584d685c84d943cf9c14821
+        securityContext:
+          capabilities:
+            add:
+            - NET_ADMIN
+        env:
+        - name: TZ
+          value: "Asia/Kolkata"
+        - name: FTLCONF_dns_listeningMode
+          value: "all"
+        - name: FTLCONF_webserver_api_password
+          valueFrom:
+            secretKeyRef:
+              name: pihole-secrets
+              key: api_password
+        volumeMounts:
+        - name: pihole-data
+          mountPath: /etc/pihole
+      volumes:
+      - name: pihole-data
+        persistentVolumeClaim:
+          claimName: pihole-longhorn

cluster/apps/prowlarr/prowlarr-pvc.yml

@@ -1,34 +1,14 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: prowlarr-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 1Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/prowlarr
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: prowlarr-pvc
+  name: prowlarr-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
+    - ReadWriteOnce
-  storageClassName: ""
+  volumeMode: Filesystem
-  volumeName: prowlarr-pv
   resources:
     requests:
       storage: 1Gi
+  storageClassName: longhorn

cluster/apps/prowlarr/prowlarr.yml

@@ -5,6 +5,8 @@ metadata:
   name: prowlarr
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -38,7 +40,7 @@ spec:
               key: OPENVPN_USER
       containers:
       - name: prowlarr
-        image: lscr.io/linuxserver/prowlarr:1.37.0
+        image: lscr.io/linuxserver/prowlarr:2.0.5
         volumeMounts:
         - name: config
           mountPath: /config
@@ -54,4 +56,4 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: prowlarr-pvc
+          claimName: prowlarr-longhorn

cluster/apps/pulse/pulse-pvc.yml

@@ -0,0 +1,14 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: pulse-longhorn
+  namespace: default
+spec:
+  accessModes:
+    - ReadWriteOnce
+  volumeMode: Filesystem
+  resources:
+    requests:
+      storage: 100Mi
+  storageClassName: longhorn

cluster/apps/pulse/pulse-svc.yml

@@ -0,0 +1,13 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: pulse
+  namespace: default
+spec:
+  type: LoadBalancer
+  selector:
+    app: pulse
+  ports:
+  - port: 7655
+    targetPort: 7655

cluster/apps/pulse/pulse.yml

@@ -0,0 +1,30 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pulse
+  namespace: default
+spec:
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: pulse
+  template:
+    metadata:
+      labels:
+        app: pulse
+    spec:
+      containers:
+      - name: pulse
+        image: rcourtman/pulse:4.23.0
+        volumeMounts:
+        - name: pulse-data
+          mountPath: /data
+        env:
+        - name: ALLOWED_ORIGINS
+          value: "*"
+      volumes:
+      - name: pulse-data
+        persistentVolumeClaim:
+          claimName: pulse-longhorn

cluster/apps/qbittorrent/qbittorrent-pvc.yml

@@ -1,34 +1,14 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: qbittorrent-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 500Mi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/qbittorrent
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: qbittorrent-pvc
+  name: qbittorrent-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
+    - ReadWriteOnce
-  storageClassName: ""
+  volumeMode: Filesystem
-  volumeName: qbittorrent-pv
   resources:
     requests:
-      storage: 500Mi
+      storage: 1Gi
+  storageClassName: longhorn

cluster/apps/qbittorrent/qbittorrent-svc.yml

@@ -11,3 +11,33 @@ spec:
   ports:
   - port: 8080
     targetPort: 8080
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: qbittorrent-tcp-service
+  namespace: default
+spec:
+  type: LoadBalancer
+  selector:
+    app: qbittorrent
+  ports:
+  - port: 6881
+    protocol: TCP
+    targetPort: 6881
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: qbittorrent-udp-service
+  namespace: default
+spec:
+  type: LoadBalancer
+  selector:
+    app: qbittorrent
+  ports:
+  - port: 6881
+    targetPort: 6881
+    protocol: UDP

cluster/apps/qbittorrent/qbittorrent.yml

@@ -5,6 +5,8 @@ metadata:
   name: qbittorrent
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -56,7 +58,7 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: qbittorrent-pvc
+          claimName: qbittorrent-longhorn
       - name: downloads
         nfs:
           server: 10.0.0.123

cluster/apps/radarr/radarr-pvc.yml

@@ -1,34 +1,14 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: radarr-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 1Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/radarr
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: radarr-pvc
+  name: radarr-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
+    - ReadWriteOnce
-  storageClassName: ""
+  volumeMode: Filesystem
-  volumeName: radarr-pv
   resources:
     requests:
-      storage: 1Gi
+      storage: 2Gi
+  storageClassName: longhorn

cluster/apps/radarr/radarr.yml

@@ -5,6 +5,8 @@ metadata:
   name: radarr
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -16,7 +18,7 @@ spec:
     spec:
       containers:
       - name: radarr
-        image: lscr.io/linuxserver/radarr:5.26.2
+        image: lscr.io/linuxserver/radarr:5.27.5
         ports:
         - containerPort: 7878
         env:
@@ -44,5 +46,4 @@ spec:
           path: /merge/downloads
       - name: config
         persistentVolumeClaim:
-          claimName: radarr-pvc
+          claimName: radarr-longhorn
-

cluster/apps/searxng/searxng-pvc.yml

@@ -1,34 +1,14 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: searxng-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 100Mi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/searxng
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: searxng-pvc
+  name: searxng-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
+    - ReadWriteOnce
-  storageClassName: ""
+  volumeMode: Filesystem
-  volumeName: searxng-pv
   resources:
     requests:
       storage: 100Mi
+  storageClassName: longhorn

cluster/apps/searxng/searxng.yml

@@ -5,6 +5,8 @@ metadata:
   name: searxng
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -16,18 +18,18 @@ spec:
     spec:
       containers:
       - name: searxng
-        image: searxng/searxng@sha256:67ee37bc396f5c7230e58a8e9548b4b6e750cdb9b61eb20932aaa6fcfd5e667b
+        image: searxng/searxng@sha256:0e0493d1bff9ed55f774709c9113185aa3da0db3aea84bf86b356e97a21d54c6
         ports:
         - containerPort: 8080
         env:
         - name: "INSTANCE_NAME"
           value: "searxng"
         - name: BASE_URL
-          value: "https://sear.akshun-lab.uk"
+          value: "https://sear.akshun-lab.cc"
         volumeMounts:
         - name: searxng
           mountPath: /etc/searxng
       volumes:
       - name: searxng
         persistentVolumeClaim:
-          claimName: searxng-pvc
+          claimName: searxng-longhorn

cluster/apps/semaphore/semaphore-configmap.yml

@@ -15,4 +15,3 @@ data:
   SEMAPHORE_ADMIN_EMAIL: "aggarwalakshun@gmail.com"
   SEMAPHORE_ADMIN: "admin"
   SEMAPHORE_LDAP_ACTIVATED: "'no'"
-  SEMAPHORE_SSH_PATH: /home/semaphore/.ssh/config

cluster/apps/semaphore/semaphore-pvc.yml

@@ -1,34 +1,14 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: semaphore-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 2Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/semaphore
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: semaphore-pvc
+  name: semaphore-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
+    - ReadWriteOnce
-  storageClassName: ""
+  volumeMode: Filesystem
-  volumeName: semaphore-pv
   resources:
     requests:
       storage: 2Gi
+  storageClassName: longhorn

cluster/apps/semaphore/semaphore.yml

@@ -5,6 +5,8 @@ metadata:
   name: semaphore
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -38,7 +40,7 @@ spec:
           subPath: db
       containers:
       - name: semaphore
-        image: public.ecr.aws/semaphore/pro/server:v2.15.2
+        image: public.ecr.aws/semaphore/pro/server:v2.16.34
         ports:
         - containerPort: 3000
         envFrom:
@@ -60,11 +62,7 @@ spec:
             secretKeyRef:
               name: semaphore-secrets
               key: key
-        volumeMounts:
-        - name: db
-          mountPath: /home/semaphore/.ssh/
-          subPath: ssh
       volumes:
       - name: db
         persistentVolumeClaim:
-          claimName: semaphore-pvc
+          claimName: semaphore-longhorn

cluster/apps/sonarr/sonarr-pvc.yml

@@ -1,34 +1,14 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: sonarr-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 1Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/sonarr
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: sonarr-pvc
+  name: sonarr-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
+    - ReadWriteOnce
-  storageClassName: ""
+  volumeMode: Filesystem
-  volumeName: sonarr-pv
   resources:
     requests:
-      storage: 1Gi
+      storage: 5Gi
+  storageClassName: longhorn

cluster/apps/sonarr/sonarr.yml

@@ -5,6 +5,8 @@ metadata:
   name: sonarr
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -36,7 +38,7 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: sonarr-pvc
+          claimName: sonarr-longhorn
       - name: downloads
         nfs:
           server: 10.0.0.123

cluster/apps/speedtest/speedtest-pvc.yml

@@ -1,34 +1,14 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: speedtest-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 100Mi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/speedtest
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: speedtest-pvc
+  name: speedtest-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
+    - ReadWriteOnce
-  storageClassName: ""
+  volumeMode: Filesystem
-  volumeName: speedtest-pv
   resources:
     requests:
       storage: 100Mi
+  storageClassName: longhorn

cluster/apps/speedtest/speedtest.yml

@@ -5,6 +5,8 @@ metadata:
   name: speedtest
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -16,7 +18,7 @@ spec:
     spec:
       containers:
       - name: speedtest
-        image: lscr.io/linuxserver/speedtest-tracker:1.6.1
+        image: lscr.io/linuxserver/speedtest-tracker:1.6.8
         ports:
         - containerPort: 80
         env:
@@ -47,4 +49,4 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: speedtest-pvc
+          claimName: speedtest-longhorn

cluster/apps/tika/tika-service.yml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: tika-service
+  namespace: default
+spec:
+  type: ClusterIP
+  selector:
+    app: tika
+  ports:
+  - port: 9998
+    targetPort: 9998

cluster/apps/tika/tika.yml

@@ -0,0 +1,19 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tika
+  namespace: default
+spec:
+  selector:
+    matchLabels:
+      app: tika
+  template:
+    metadata:
+      labels:
+        app: tika
+    spec:
+      containers:
+      - name: tika
+        image: apache/tika:3.2.3.0
+        ports:
+        - containerPort: 9998

cluster/apps/vaultwarden/vaultwarden-pvc.yml

@@ -1,34 +1,14 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: vaultwarden-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 1Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/vaultwarden
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: vaultwarden-pvc
+  name: vaultwarden-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
+    - ReadWriteOnce
-  storageClassName: ""
+  volumeMode: Filesystem
-  volumeName: vaultwarden-pv
   resources:
     requests:
       storage: 1Gi
+  storageClassName: longhorn

cluster/apps/vaultwarden/vaultwarden.yml

@@ -5,6 +5,8 @@ metadata:
   name: vaultwarden
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -16,7 +18,7 @@ spec:
     spec:
       containers:
       - name: vaultwarden
-        image: vaultwarden/server:1.34.1
+        image: vaultwarden/server:1.34.3
         ports:
         - containerPort: 80
         env:
@@ -28,4 +30,4 @@ spec:
       volumes:
       - name: data
         persistentVolumeClaim:
-          claimName: vaultwarden-pvc
+          claimName: vaultwarden-longhorn

cluster/config/cluster-upgrade/cluster-upgrade.yml

@@ -5,7 +5,6 @@ metadata:
   name: server-plan
   namespace: system-upgrade
 spec:
-  channel: https://update.k3s.io/v1-release/channels/stable
   concurrency: 1
   cordon: true
   nodeSelector:
@@ -17,6 +16,7 @@ spec:
   serviceAccountName: system-upgrade
   upgrade:
     image: rancher/k3s-upgrade
+  channel: https://update.k3s.io/v1-release/channels/stable
 ---
 # Agent plan
 apiVersion: upgrade.cattle.io/v1
@@ -25,7 +25,6 @@ metadata:
   name: agent-plan
   namespace: system-upgrade
 spec:
-  channel: https://update.k3s.io/v1-release/channels/stable
   concurrency: 1
   cordon: true
   nodeSelector:
@@ -40,3 +39,4 @@ spec:
   serviceAccountName: system-upgrade
   upgrade:
     image: rancher/k3s-upgrade
+  channel: https://update.k3s.io/v1-release/channels/stable

cluster/config/cluster-upgrade/system-upgrade-controller.yaml

@@ -264,7 +264,7 @@ spec:
         envFrom:
         - configMapRef:
             name: default-controller-env
-        image: rancher/system-upgrade-controller:v0.15.2
+        image: rancher/system-upgrade-controller:v0.16.3
         imagePullPolicy: IfNotPresent
         name: system-upgrade-controller
         securityContext:

cluster/config/namespaces/namespaces.yml

@@ -6,22 +6,6 @@ metadata:
   labels:
     name: gpu-operator
 
----
-kind: Namespace
-apiVersion: v1
-metadata:
-  name: longhorn-system
-  labels:
-    name: longhorn-system
-
----
-kind: Namespace
-apiVersion: v1
-metadata:
-  name: cattle-system
-  labels:
-    name: cattle-system
-
 ---
 kind: Namespace
 apiVersion: v1
@@ -29,3 +13,35 @@ metadata:
   name: cert-manager
   labels:
     name: cert-manager
+
+---
+kind: Namespace
+apiVersion: v1
+metadata:
+  name: monitoring
+  labels:
+    name: monitoring
+
+---
+kind: Namespace
+apiVersion: v1
+metadata:
+  name: goldilocks
+  labels:
+    name: goldilocks
+
+---
+kind: Namespace
+apiVersion: v1
+metadata:
+  name: newt-ns
+  labels:
+    name: newt-ns
+
+---
+kind: Namespace
+apiVersion: v1
+metadata:
+  name: longhorn-system
+  labels:
+    name: longhorn-system

cluster/config/secrets/code-server-secrets-sealed.yml

@@ -7,8 +7,8 @@ metadata:
   namespace: default
 spec:
   encryptedData:
-    PASSWORD: AgBZWrXQq8FbBvquNEqSV0Lz4idnnRxFhXpJJOKEQ8utWMlv4XgA8bWIl1/o/sn8OsyCEz/l+LWoSWf0ddmpiJSjfzhUv41YRlf3h13h9dDBBHHOFspl7ZAJvarXpiyUbtWiDMaCBCglZNavj+e9nuLcpVLUFfYaSK7XduhpgTQiQdINpj0QrHqPtHsGpaWRNZeDsGKFmrOjJEQLSk9YaLTDU2GpbtaMtd2HCHyeng1+19yUYgp28rJIvt1NFRgCGSCsvlInKzl756Qee564X9srXoOb6es6WRsqQ+vOlNeR3xSW8IuEqcNP5W/pQM0fe3oIXMwzcJJe1PuTYyjdz41lYRlVx1Yuo5jxsMDf7YpZVa5MWFooaG1jKqBSZlxLXrc0qHupAHRKjxPPtXql7UeAlR3CziGXVKrN+IN9uAs9Li6ix93QBeest3UiP08Cadb3j8XS8lxGYYS4mWPWfrkrVTnB6Z3eVKNtlGx/5gJEb8iQ2R7QRElNOC1NIVftWrnx4XXkZZCTXtVtyinB+ap+sURQaJ4ZPtZhXG97OhG/4SqG1RWAr5YdQHJzYc+kCp15rVyyDiuoOZXa3HGryVN3yYkv+RVN+d82PzI85wIVEWuD7ybf2TpFN54YsGtuHpvD7tUl07UbbLwOXy/pAzcZyWERrGq1IclC5hmCw1tb2I0I/j4OVtLddFQTmyFUeuHzwrM6WV0=
+    PASSWORD: AgDXmLyZduQ3j8sJaRBFF6CkNQHUWpk5TyibA69ok2f0XhSdfrjpGRxsjTZ89P2GaAvt3nLGVLx9LVGDbJWEcDdlpvlIamtgRaChSrtRl7wk2ka1BC1kf+GrYO+mkuZEpQpLh2yR+moyAx6ZIUUTI8e60GdaEKL+zKmV1JF+hdAQc749MZQTGS2WwLuo6jqb24eYccg5ujzGtjVMF9uok5pRcrEJjXNUeCkBt7JwEy5epfdNLrPuYN8xxXRWWOaTnByxGj9uFY94vD1VQHoYzD8ybJazXkMsIRxzvyv9ZSKdGhcnfkwMJwJFQEjJ1pIOvDGUSERGNCYNEh7UUJWoswnvrp3q+7l9xVn+StcGGUx486EGa8h7FfTCsTzC5MTsrfYn6v5agE37D5b4++lrpTfb5erOKK52qfbd0n2ieol2AEdRPPe6BfWOde8jV0nCgeFXip3gC8wTQjW0ad8fTjR6P7coLg/lzEawyudHhv/5Rzw6QU3siLK5dmiekuOAdjQTmrXI+0zB8pM5jLHDBgn9Lt7rHfT2uSt8o3KMCQsMot0sEjvDkZ1dpgxdj056t7SYc4SxhJ2WXDVBRbfHn7X/sjggvw7gEIT5LW0WQovAswKe529E3HKcL9n7M388Xp7HBIIBMjz/iYLvOg4YDp8w5KJ5OGnSHJONlfFkyyCTuBZx5t8l+aytfpY1gE/0m1WeglX42pQ=
-    SUDO_PASSWORD: AgCUDtA03A/7o8JkEBV1mqRMnYwvRFw0usKfbmTtQ3y8ds1rAWalwUUiPbPE+XxxGnA39591fp7zZvyRedt32EKPI8wrsz3iXTSiYpvgyk+nIYhxbulg+d/TZ6NXMGwu59SuAFcX5weiX4C1HvHCKRDqmKnd51qpGRnb5MPuevyCCZ2cGE3KtmA8XzaolvppjKm1iW0cPX+7exNaRxOk6vkFK6YQXCZ8bAgalUGjZQioQsGrtSp/K54LwhVvnBqelI/lG89TcaXqPr3epgdwSlgnMR2AMZSyXFUvlRS/1zuyuLkikMkcxCErUJxwGPX1f4zKjuhOHgfnGpPx4g8OtFz+RAGjQBzjQGLDXCSV5LfBGUmW0AyAnSFo9to/Yann3G3q+Kw2XRhPTyk1oHhtiQcRO4ynCUckJF56cMW5Zrc4se0VzsAyDyJylcrlxyT7a/5/YR/b6BMZoQBIaJCqABoxX+UchF+R2I5ZM/SG9z2d7A+mdIzNy1uuX6udrCNJbjXCSLYsc1bF1GTedQC6TW8/7OeFaMx/9g9Ddz8Xoa+HXre7Mae4Fyjhd2pjTFotBx7qpAru5/xGZIsmKsPqagCwNOf+n7vU44Em6IzpgbmrMNSMAKo5T7toNunsYy+TZzZJaWmrR0OlUyB7VrFHZsWGs4d5VPrhxXCw3uHWFVm0mw4exnSlc0l9GurYyfbRDXGlS7n8Q2A=
+    SUDO_PASSWORD: AgAOilG+ie94LVnaJURRhUDcLRcEMRCsV24JXKrQMi+jdyDqItcmwzPMWAvDxqh6e6A74SPDVG4uVgn0+US77Bz+2RFSX/QFR2BdtGEcSMZKsM+GrXqa/zBkE9JvSTD6ICt8FfkDkQWpcfpl7blysWHF6EOugiPk8B7KA2P+2Oj4Fye6PJgHayLJznwMVi/eLslhE86h8uxzcwsQIvYlJtF8iQzLuP/IFjMfEUcbutT+/V34re/tUm++pLsUsP8OEFHIHw3AaSLWoYOi2Q7rUFw+qwMgpWLC2JhyWZ6fdO0jTb/vFA8bj/4XzIwxX51czdx0itqRih8TZxZ7DAeUxBBoet/ATiKj39nOv4WPkzaNUEaOwK9AnpxcqUYCjCwFjLCDUW+pwJu6LVMFeOflpCGLpBHshVoXd6EWmDNDuSS2PXk9kQ1JNzISAuSLsHhb+H0855qSvbk+bvWzvqyVEBHH2y29/uNluRlqTotEag65L+QBn+JMWDkG3Wje4RdiTeBhK3N1jSZ54vlYK40Q/ECdQiZwd/GNWt1EKtqrZ6j61Wn2c4GbeCqGUwfj/+a/A4eiYVIahG5xHIGg13+O3r4SWqGgFFVlAWfhPZez4bl0AD9wTQD0ndGzCwNoYJYDmwljMAFCr/Q3eKSHy43yKE4nFL7jCHKV9KBaPpVSFAiznCbdNZjGyhc2Jus8718PBCgB+V1u9YU=
   template:
     metadata:
       creationTimestamp: null

cluster/config/secrets/companion-secrets-sealed.yml

@@ -1,14 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata: 
-  name: companion-secrets
-  namespace: default
-spec:
-  encryptedData:
-    server-secret-key: AgC62hF+eJG4jUnbxANYPK1Wc+kwpDhdKi8ylCUleDpOEehcazwsV6RK+XBN70t4sbcxDF4uDy1Dy2q4bp3IhrPtAo+3pQ9E8YAg4qfbphORSQWx9cau/uDSsPlWH+my2smwSUx5mmhN+v1Se1RoG+7YjX0h0JpSRcWo+M3OZWl7fRccMX6GtQSVAnp1RYFaJafJ2ZnPPmFZAMHC8BVVb9L8Eo3flu4r1yN0XhiAiJOrSiBhxOAoCDiA7BYEb+5d7wB32M7gN8EpzLYsein0PQoSseDN5+devSkHEAmLpHKXaGi39CQPGKCShkMpmhN2k6QDcPljyFR6kP99pXBBF35PGB7ykjagy8nDvKCXV03j7l5iik0jYiLVhZsMPrKNQkpj6+5aDsNjqL04qOwQdVy3ouL7B2VKUP1wg8bUaWjU7GBHXT3dPrzFOXlznZIWpxYAqfp3MtoDLwXjtHrkOvY8UAXYxUBetnuoaf/jjDbXEverYHtpvntze1pcE5UiRmOxrZHwb/pVnxkmrhR6mJWV7wkNOKZc30YA1uKbh2TT2pDp+t0WKqfbGMUYE8ZNcedpvT3e60GPNnCAeWkI5+J3I3xO42LnovIdlOCRVtwY/JDHi8ENgGdTevfliIwgezIqOqNj7JdgUCeFLiROyAHFs4iyzC69ElWxkHV3eL/eGxa2Wl5XRWhaO3qrXPDH8s96mzQft31BV5dkhs/EZi3k
-  template:
-    metadata:
-      name: companion-secrets
-      namespace: default
-    type: Opaque

cluster/config/secrets/drone-gitea-secrets-sealed.yml

@@ -0,0 +1,18 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: drone-gitea-secrets
+  namespace: default
+spec:
+  encryptedData:
+    client_id: AgCwRuPLYUZdheauI46vU2P2G5xiClZmkXq9OKEorneNQUbZKzoEiGIMr4lhvvhlQKPdN+mP0b/grnsbCfLz2iW70Wfb6AEITz+KjWJgK8yGwa8zc3TTUPEHFrnAVEkKiql/NdY2Cl9oykUbbXQhj6o4f7cAdHiL0sr5X8PKwu0Z4R+OPu572V0HLMGXuR+QlIW0Tog2A+4y/Yw3QRW/L14rnGIWCmxWkZXq//HUku2dmS/uxgVQZI6QbOgh9zSdD2W0OA06jh/Dtvi3IUG98DeSERePJMWcbbNLeNbUMGjBPVR7zd8/WXZp2zy8Jx3a0ge8UOIQmFbJl21P74qkbiz49R189sjPiD9sLuhZEbhmF6ot0V/RyRspq4goZGrlEEiiTJzPf0rZ/ZYHFyzjGJ9yxqt1Mw8w0NLNi/RyeApPDPySkLfqTmxXsyYZrDECTeH2sz6SiB8cVc7y5wAGOkR7XOutqD/BHtbxVfoeDnnUZ4IJo0oBglEIDohyhST1V+Ni3pfmmCRNJlVioiAnko73JoQipfZANiYbgUaX8qoUjJYkfkg+W7fhmCH3JZA5IJG2VGyQjjyJrpZWOeUhps5GE7nzGv8PeVRw+aR+FVCfEsvlBpCAYPMzzmtQL9/FhOHg3QYhSRLpW17YxhJJssG5Q9Hk8DeD7o0vm1KECeulvw5o/mT7Ge51jAbVGQLxbiTU81umvLLy5vuoTmfO8+M+MC8P581rZ4L5A3cEm4qij1KVyo0=
+    client_secret: AgCqRhklpkukbbxuO4OMiBzWlTrbyYnDyQww2PJpARuuhbXJiKDwsoojsAHDU/bjB2qNNq/h8dfPs11NJPkthZb7nmsxgnuzF99qkEjOchgEgrgaq0+f/eJoLH37lpyVMG2x9DR37QDZkrSjhjoIyxYp0sOq2gPhabmEF6guRfGjO3JO0qgHJXD2w0mWENm3fW2EivUyeI8qjVLK/OqF4vSvUMaWpNrBT7aHdPn3dajF01jUv36KczM7vKfUbgmWwE2LL969qmqx5SufoEDafaSQdveBvaZVs6aOdDklW+eIkspWd1Nkf+OM/phNw0dUxB34hwZCQBDEJey+IqyqJcamuXzkxFI5HlJzpWkBKuz7zV+ERzwuw1c2mDcXNJRVOb501MMpWRdG8aQlPC/UgzUDyiA4r5K5mG8dXQBhTJqdsEggcWVRQVvpXY48bViNEI7aExXddNlqBVU3zzRikbIkoesCP6tNse97tuN5nMA+BCRsMEFjsNaxPChUxn6+Gxhgx54wdYXa5n40GY03PBd6O7p6MG2s/4QI1nPHwS79sRliot8uiSfIp+scuAvJHLVec+qZlOx4G7vi4DYjiMLjH6wGwEjSKQ6zd+eodn9UuY4zvW3Ri1kI5O5ovfO2XNDFSdRm8f5kGTNJ2EhinJ0zFgsVvk82nSX7f59ma2Dqu+gUz2RFa6gjxyQJ33PyTQ4cLh6dkfU/lLbAvKOocJ6fKFDjKsFVNyf2qwGFdEq6zRpKWW3aCELBm5XFa1In0SlzuNbdzA9hYg==
+    rpc_secret: AgC1yIA13jpl1WcpbCL/oqidW8NtarCcrPkzZdtDmLGjiJQV/HSaQXc9PeojkTaVKuQ6m2rHt9LJmpXRDXxRr01vMKxeZOfKkfZj32dc7acOgO+iSyYEwm/e7o2jTmv/rQXpRAqpAXZoXimpBycyjhIrJ0Bq1r0BXlVdR5KLw+zLcZ84MTy7N8OzakPsH8blElBeBnHcQlwqI2fzyjW7i0O6P+7935M+wjBS1vSG1PLzN5Mjba/CiFq14KwhgtUQ55O4TOqk681jc+VqBPXzLliqSZhqCk/XAdvYUZMKB8/Q3TsrplmH4xg52qkDNrYn1dOt4VeM6B3xzkM9buAx4c85FpVmAxY8XvJfNhb0BLGRdgLBnTJNHOAxBua5lYQ6n7WJhpFTqt2bAfQf7Xtr82MenK/VMd+Qe/EWjc7ibfph2b6VAAhhfQ64LWgLyCCES4LjSAXOmeJCv4N/9cRWnYQ/Sx1ICzesKgqElpmhSIkNH5dEMF13PaEISpLtaF9x+9Nw+j/LuZQKNaKvJOM6nisTV4JE+9R3Qj5/EX63xmlqkAJWiTmz7dSlcQh0DZbBOKoFSTiZkE7JVGvLXKhSvzBGYTAMyFk4Hn2ej8HKMOhB+su2ENp1oBW1ejgzhAPjH7shd5SyOsgA1pS3wxYaFhm+U3G0v0dZF7hdhe0QlNuPM6DenU+8Au27fHNY7WTrZBwXEcqYRWK+k/1fFXBKR+xQV9C5GsIirgguszCZT75HMw==
+  template:
+    metadata:
+      creationTimestamp: null
+      name: drone-gitea-secrets
+      namespace: default
+    type: Opaque

cluster/config/secrets/drone-secrets-sealed.yml

@@ -1,16 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: drone-gitea-secrets
-  namespace: default
-spec:
-  encryptedData:
-    client_id: AgCRF7Xf7P3yJ+7IRewfSM4cAKdIj/N6j7xMuPO+OluYf7u/DVqzV0SY5d17LmFXGANOqGRbbn01f1MM5PI+Dk0D8ssybB87KcL4I7QALwZ2g2JjuL7JMzP/R9eBOTG7zRCpaFOb8ppoRlzGbUf2VdWu3Q1H625/c+GAHphkMJLR/ihIxqwvr7kadhBSfFSaIqoRez3TY9wpKLa+Ll+lMt3xRG6oJS6ixOIBwdZB+p+/d5NDsKg5Mj2ql4Z/2KC9nbhSlWgEqNBJKthwDfvPG70DZEdWMVWSfreBX7Od/ovPw8fuRQqNbXfh7o2d6WhZOZAK7qOUJJs32BLXxNC4mA1dnaN8zgqhxebCwtXLT8o2GVj0k2LDHGsJWUh8ZWzhuX5VDM0kHBb57BT05ARgFN6l9AxLPx5wtB6op21kIL0AM3T9yv2kTtEhJei3qQ9WCXyRCz62huH2SNTDpHJEPtxD3B4jUsp/T+gxUwrG5Gy3m3SzUxI2qAUb+TI4aHBcrNKwY4DYYVhz6dmrYY7SdaniobOFY9rANpTVuZpY8tiTfaBbMc50T+HPZHjvIq77l/nwSqbz1/LkgTqMzBbDYQswCFa82npl8I0Edb4BtZnPHcuWRZqX5jAQQVJmnhemQmBhUHmfNzThneLeAWVcnNT8KFFzZvgnC78cJkoGy5c8w6CpraBcKGjWX/eSBpHI5CBBeFL8LEy0/Z6GlvMf6CCVEm6yF3ZwWF/2f9hiV3T+CO57U84=
-    client_secret: AgCs2F+QsN9zsAOZhT12DoiyLP/kvHeYQQ0JHUK2OCR7cCLmJCcHnw15ugNjr6TckTRGKXmSUaQ6nE0zw7XMex8MtJHnfTVgmuiTAMgptQ7FyvZTw2H1XzUDKzsEQG7Di3xsp9LcoxfJH9zsASTOxpCtqC3muw8vZt4CMFpnYx/kb983cOP9HZ8j2DGYPtN34JuI8J3PjsIenIN/4EtR/p6tQd2XzI7CRJLv5IXIdhkiP954UTmPxmhLO8+SH9RXcUdwyKwEETRRxDA7YWfIDv73tCHZlctNBhwk+beEhiAiPDhSpJU/0gna6c7Ft6Xo1uQ9xZqFw8JM2YT2gwmnuzlUsHLhfiJSSIhJysYlBcqmXmnA3b7In6GtZqV/89ApOWkfKXptJQk8LPKqidLGn12yqp4CAqDNJK/vd+4AcDJ3faOsL1SVBaC7JAqTzZRFjC1sZ3MPDOWEmr5QPe6b5U0aHtEgnKHsVp5/uB6ST/mJTNfIrLol9bxMWFrU1BcA/bptZ2h+ZFcqCARnMdBe0eXFK3u3pw2/CdLCSig23r7JTvSUrAzQjt/1Qipgd/UZp/oCZjkJ60IbTjvuLSmsHoxN6LdPRIL1mWUr/SiLBrvOYyB4pOg3cXQB0pRxy7qDOeKrE6Sf1tkVJ9Fx8vBCA/MkftTvBm1tNBFz264S00VocoxjD58KbMJrFkdMI2UocT06STqI67R1UOC6IdwdNmZdiYaas9nurd4YDJPx4Rual0q6RpuErJRRqk88C9pyXmv4ZQALVTF6Nw==
-    rpc_secret: AgBYCFpa8qi5KnYrFtqVawSMRt5D3OzbNOJvemFS/3w/IJ1R097yx+rGs+fTiBLRK18Hpx7PBQJP115DcFi5JC+DdZIl6IW6z80QwwqsZWuhEMGuGRwOYdnbu03nckSDnqTAd2qs5P7+9ne07jwYTrEYJ/0zQp4n9BqA6cWxHoWV91dyKiXpOLPmwEQ0Xvvt/FMWvr94SHyazF/Ea3G53wmFWv9yYJuCOGTcMuQAOC27TbxmsE/YjLe0a8ZfYnfzEln8wFnRQ9sauPfB4P++uEqPH6/K+ngvW/1hwUh9faswkEUH/aeqc7eI0IYPZuX73mth1C0gEfwn/ZJt6iyT51tqqY1JqDVotXo6Kh2gxxpaMbSo8RoY61FZ8+guavnEPa3ZpF74nnBTeVP5N3KoJ8LGd1rkw4wxnIhbhgdghG9jWSvwzEig0f/TkGVS4yvo6+lrB4EKyOqKNfAzoZZk8bk029pe+fUfoZAFPkPLuLpyZ+ThI+RzZ6trF9IIyy3zgCoo0MpZBoGtHPSBPJDNq2XT3s83sP30kwYLOIYLB5Tbj6YmXT0GywKDSehK0vkWkt9OVXfHllAU+yLDBVhzlZPkAYmg4oWoRPtUVLwyAJWcb7CqINTyjVPoTBczhYt5eFQMM8LIeHNRjBQu62oksKIG0LkEQd8/IylY8E4g9W3FMDulkOeujhPdocIpPGjkfo+dfJqiQC6j5lPpSMs5UJqhCck4DQjoivdoJmOEyNqUKw==
-  template:
-    metadata:
-      name: drone-gitea-secrets
-      namespace: default
-    type: Opaque

cluster/config/secrets/ghostfolio-secrets-sealed.yml

@@ -7,10 +7,10 @@ metadata:
   namespace: default
 spec:
   encryptedData:
-    access-token-salt: AgBDDwJbTl3ZR1wPkOvtvU6X/TPYbYsJ7J7ps/HJZPjMmYgO8bdZv/+TSE9niMbC0HaPdEGRfMemBdcUPqNa31jw0OP3fidPp1N8JzbjcTGFAvNcMhyKnVF5lhRw+7HecWtuST565jJj1VUw28eAylV6kUuVopiXmotrm4D8k6CTw+9/lrnJkLYYqB7YJbaRDTNYoCUh/hkRxaxpiz4p7HyhHoKqyIFkaA7kZKrFosRycsnO0B6auw3Gyl82lEUixIoI0No2PS3Qi7ZmwNGP2uiX79H1rn974wqi3EhZxDHOfoCuK1+DUl0anld/KxYj28B6LylFhI5U/DnXJ43c6EWYw1pfte8nHe2ygUfHBHDgqVl4Jq8XfpzUpl88TTGcZ4tQzFh9cVo4nSwdjWKXYfbd0arEId3yl7GnKR74qDiZxYR/JEnAUFzY885kQ9jcvKSirFzeUFWTj/kxjIOiwZOEfvGfCmngyHfCkjXshAfZ6UDH45BdK6GzYmUT9eAiYCLqmsdgsMwad1MmCmS5zTZVozntmFPkTMm3gZL41WtCpIL7PM/QkbY4TZM5At3xrJyTNznGLO4FyFHwVYEgWrTLghiU9tcmtnQvusToP1jdbRUx5RoFZ2BhhepryBkRxonZ+DO4K4aS1PojO3p+coUtJWJhJm5o6n4EDCaHaPpopgFEva+vsxgIP9wqpGjrlmbBIPmNSveUB0u3aFq8GPhRPpWRcA==
+    access-token-salt: AgAvbgRnr1HPp4qmejfniTchTsyTCcHyLw7sRKWAPguhrggrny3CzlNW1Rxo4soULuZZuM8OMhx9r5C2VPrHUMDgr4/2GYKz1pqlWk6CuoSn2PzkJVfnH7BjwITF9TbxO9EihqEPxMg/gN/oazfZPFu+GTa4o+GQdJ+UsOLf/N3vLAeYVCiSCxM1qtimatNxeQUR4U0Ah/LBi906Kvs3AxpuyXlX1zXN7waLnMYnXXSxrqBO691RPt4FpML73mv/uQ/AmstcTtaPxwr98nMcC4nTUkrBkvyBfvB3CN9qYFtzO4lVOxb/f5TbYhCIq9M6II+CnBJhvXLdAl08+3s2f3D9Lu+SWZrq89M7UIz6fHxojKBFeAk7WEFTznkoJUbB7uLQ07LaDwwP8WZFioqMGMOs6zmEfHb8uW3ovgwZ+xSqlP5aCSi+Ek48QA2VwARxvcUS9kPWagrZXoZK/VVvV9EyKVAu0Cf3ZQ+SXMiXCleo8HUFjkH4kD8eiOK59CxH/YoOE64pseNOQWtRND8dmkWMhFI4Jl4ruPugC8BGvTU9NqewRwtivE4H6kzaY0zpZhG7THbZF3gYSMyxdUAtu4CSG2NFsu9Y/xyIHuFBCMYVqSIqz0h5jgTvKwcgtzTklwIixXxvK+Zvovs8rptWdm/PzwHMLmARXQPwmj/bkifig5CR6QgPNmfZH5Z0qX3s+uSwPXm8kdzQk/sObYyEPacb1WHJGQ==
-    jwt-secret-key: AgC5Z7MaZ9kqEEvcZMk6n2DoQERFUToVDbeRuXQssp582j2rWmI2kjW8qYimEjNAY33iFwBYqBQ60A4dAVnKEFDjumO2APZLNsFLNzqrm+TP7gs9RFrvEtDwCfy/hXIXMdKTKCXXwfv/t8yUYKGOfF2r8tquI89DtRzS8cjdr+p8CiIG8IXZpGoT/Q0kuVPDI3Grh8yFMygc8OWIR/S+q4LYG4EeYSjkoyUnNmO+GinpEBigT3ZHmjlprJUivq52+F9OPObuZhHQIy8hxCIabsgt6SEfAE4bYaaPVzRhpcGlDOX7XYs+NQDEmwyPMjfYLgRx9iXxblBdvGo3Q1xDQQwFrNJ4G/lP6V/4xhBRyr9exHlKoGQBfgpoKojhMXVKCeTNM8Gj68DibwLHzdBfxHYaQ1Kg0MgMclho69+5otgOuyKhNwGQm5X8BYlvQcfv/KSqeIMMiSjNqiy5ni2vRfnoAtu25rpqFzut4kAleY1iGFgkFs8yMqtfBzR6LTgzLm1fjqO5J1QZu8/aMqgKion4X7NA0PiS4ZZaoiheBql7HwIoi8OWUpSeSPnHe5HhGerF6T+kITKjmlE7mPhfiDL2pi0KjtY2S6zPa7reZ2XVTKtpVdmBPwfDZMkExuYcsOZ5i30SAjq2QYlb0rDxlZ11a6seCmd5NdLBTmE26wk5wlIZF1q3nO7CnjIRJNeIHAq05INMn0JLw1k8gKvaG7dV+5KTHA==
+    jwt-secret-key: AgAuVP+SDgWwy3Q4NfBjnzNedApPa2GFt74mz82Zg/Nm/fZIsfYEGV2KCoM4oMDwyETNT15pGe0wPAaVekK/3qUkZQMbN8YVDFan3eTuLjAFQLFGQcxrvWKFtArt2Pu6AcrbRMoPPqPkcDYqtMwBDra//T8bE39CqLLzYGffRzxEV6mhOBrzBeG/M6rc43lNTTwnodm3+dVwowKQXAHbJpR1jYAyhxrjlCXAdGdet8tD1XvJ+Gr0mdiX5eBY5HQX2P9+POlfc1Vwor3GHxd9lIMSel8tfzGe4Q3IFPhEZu4Mn9sfH0MIAFZTHI0zkTbfUBi19XRL+KL/yBxO2BGMTtSCTVAhxw0d/jzOdllOEG8yM/EvR+XCElEgXEsciEaUYHhLVXsetvBIE8Iqe3SX8eqYvm+JYWc2XniQx/LEeTbNxEdogWPM9g1hM6STF5DnKCKjeA9yEgD0UF9MpDl6NQ+iPTh4e6XDnEPLTSZV+c1s4LRhg86R+ENzJdsRmiKXtgm4LhRg0oVUrTSfaKtbu/BLz89REi7lnVL1u46VZUS4rjIwXFhNqqUQUbCW8pHx1q68O5ItTADyfuV4iujfPphZKXejZzHxBnmdpluy1BSZZPW4amQ8fYGcc1UUOuc5kpeZsgaRtccJgM5N+gv4mz6QTg0g4ihJ40aLRUFAFkv9AzzGfY4P5fjERVLPEV7Xs3yKtAyy3AHawa0zvySrCkKF82Jd7w==
-    postgres-password: AgAyms/qOR9MTPKAhm88HpeoWCJjYlDSrhUYkpZhoRWsU5IPVgmV08GExL2gV32POZEI0tTvzoa2RWuOHcbybSISnf/LhbPMj9Ug3UMslFSxhx9VEYpDtk40pOJFFeiSyMZcRChm8T48vlmorbjw03vpZCqml9rhpeXfp9wv9tw8exQUppbt4mjkjgeE5TLPPqxvT+ZzVn8R4WNztvZwWVvUmGOg8HRC7yvq64LbHhjadKdra+Epi2t5CoZMZ4P4fyIWublNA6FMslkpIozsd5SxozDr+tsZdoKVrSaoDA/yzzbtCvNaGeA9E157ZKiv9mN4MMk4z8Vzf8iX1H+Af6fYNAZu+te5Wj4nFXxFxHZ+1OI9w6dKKKJ/r74i9wizBoFgqT76CJvYfWD4d4+l7uliciOlJ+gJvqaopA2y/zkNA6p/OIz5PkpmAXwC3pKqvzhJCZC2cxcDaYN5XhdXstmQOcO0AnVYGftc1rgDvuzKQuN/4nmeVyFvsn8QTk7JA0b7+N5BYocpC31lNtylzJZ6URKAzpvEOjwWi12bU+CvZuTj0gHCW1qVKvZF49gl5ldkynKNo/ENGrDEm+Vr5j0XMBP4wAjPHb8nPcmTKlfguN/zwIvsz/BA+RNEq/e0ZTjGwHMUjonJ3UJxmluepexYarHj0adI3+jO4HKcsCBHimjy7VMCWRHdg919RKNVUsqvjutUZqKGrFdx
+    postgres-password: AgDXIgpPEV9TFyG3GjhpIQxLrm/lQyq8OAPuertQRw7nSgkORPpwK86Gcc14lFFh+nY18xT21hU7ysaTGHY5Q7DeYSzYqSxN4Th9VcW86hMzE3t1KKWBUNXjG98yDp3DjOH1BbN/dQSB6S9B4A/XMTP1aYY4nYNxy10nYgtpbBT3UJcRRG8MdofcvyNdc8pKEhEzja4JXNxKveh7y/nWulBa0B8V2QBBb5bVMbMmQYKHmgwkk/alUFjN4Z+ECjO3BSAsWzDckjvqkykr0T7OXZB/bJhb8y730KBPdTVK2cZM/T96KwQvqGAJQZVmXR52dpmG8rtJRMrIoxUiXiFXAznk9gFO6+D/QrInmqAW+0n7RL80wgB1MBiBuuqaVTk/0EY1wXnXqs05UcM/EISNu9BoeGUE78Rv3PjGwx7WVu4yiAIfrGJAaEN8CF9oI09kVLUicBZKsGN9OimvKKYagLyxr621ez3resSiE2h9BkajX5W3USXBvSCjAzfhrdZTaaTRuDcBSruthA7EXLku9SrFGinEB92dVhzxo1nRq7wcemG1dYDBeV50Y/Q+jsZp5XM1aadZ36Yd9mqSxcijma24hKWx2AxKO5MudMEutvZG5zfj+1ju32oa5PjvLOJ1qft4j1qdz+L31bWmDabmDDgun1q+4Pd9OyLToYPvFNCuc+jOGMVQEOGzrGiAUT/i0+5YVssap6wUFfNU
-    redis-password: AgBUrsideOc2PYoRyAJ4j5xS/1nI34zfjlP0nDkEmHoL8o3nk1Ks+Tikmg3VoSOa2Ww8Bd2szcHKsZPTLHWbf7xMzE+DQ+/ktHPRBIwI1DtnWRX4rna+vtdjt4I0LayFUgCPXCNRYE892Qxc/WP23e9wvTXL9hGMOEL3cvFYNXDrdiVaLLM+KMEuY8EERkvQiQQtceubJ3fsMt2IbL/navWJOzas0AwhbSVlfl2AwVUCypGufucZ3GndJ2dBa3FXSi+N8I9n/6aEp21picnsMnyxEBL/cR0+Sj8Q/026A5k+hoHhypfAbZJpKOOVXAQS4G1PEciabh7PsypT/fXggLldMiIqL/Avh9ZpbtTD9uu+8b2IZ+fwLW29Mt4HjLtz+MBhXsE6XhIuLGmTY7iztqEy2SHmq5q+KI/nzUx8Nkz1XwNJ4bGPIeLgvvjKW0Lj90mgsII+ijh2I+fv+GL9dwDyXTY/j09OY4Z02xZ5Lw6GANN1O3qIhLKpurjyUWR8EppkV/MpKukvTqcErtXcLtYa63JqCnoKpdoecOLahHdV9B0yGQj3XTKfHJpVERYLSCZZJMkM7iL2u07Q7HIOboQyHGZqAIU0JhW0JSdR0VVsZVrioui28tzNdb/5O3F14wZCs+PdCC+kT7zRF2VC1hDsRwRswjezr4fYZzwLQK9HBbHveyRuopH041YiUtx30XpxY+sfpCZu+O90
+    redis-password: AgCawxlszFovmVo5/U1AEJlMNvPPoDw6+7TCq5oGbMQgWMZzHgFf6iSfBnrue6CFGmHadhU4HFSDEV9+BWDJAyY7zZGZCv83Rh4bwweQwqZGO7LcW0HPIASI29Fiz5Yn5FRHXjYgtMLgYrgouTIl/jhqRWrCBnHU+NuvR++LvjjnVSx8G6zTEfMi5T+OS/8LVyOCd8PFvJA4p252jKgx0eYS20wUyTGVZUour72i9VSKANXoUE9SmNnvaO7dLup4C22zS57rXV0O45i9Wu5fcZPy+g4fzf8v3DM+KmgOIZhy7hXMuontwqppAT8g8Ad6Dp1SS32yKs4b8+yTieC4fiV6X4sa5E9HOLibyM3jBA5feI84MpS8USMMXbAeOD4Ey4PjUJDRKNFzQczWdmlTGqf6cT+jqQr8IIZRcPL7HkQuf8RVrZFdlMt8isskTos8TUHIY6nayGe8FFw9X/30d81KVRphfBs2HGd9QhPA0dYZfQ5dwylBqSv1xxty8UQ5LrNw/tRGEOYUIdL1njsqcR6S80Lq4fhSALDMSXqe+4lnUyON8QUrqscwFTrfeABTSqLn+/fUC1nsAoXuMsRO5uNNllod002FAn5r9D8/OzXIY89Y9DmpdGDlTQ3jRnXWm1FgGGiye2odeI3Zcjm5WET2mq0WF2+Tj9g4JR7dv8V/loImb3TOCWjCKchy0TUdGfH1+zCix8vekMta
   template:
     metadata:
       creationTimestamp: null

cluster/config/secrets/gitea-db-secret-sealed.yml

@@ -2,13 +2,15 @@
 apiVersion: bitnami.com/v1alpha1
 kind: SealedSecret
 metadata:
+  creationTimestamp: null
   name: gitea-db-secret
   namespace: default
 spec:
   encryptedData:
-    password: AgA5JwvSBH7LfjgFFYPgKYgNBtvf1C4Eo1Vq47k0FUNADKlUiUsW0kcrzwV2jKxAFIBkFBQsdgl8zpyr/JEwOJhORpDeYllKhKWqny0U3ZL5JECIdTD//TSRk1KOcrGtEOl1L2se0yfh0CPtd8Xa5PgrodPwuH1dQsnZNbiVpqD6DAzYRclCmQgpzwM7rsh7J41VynK2Dq8qnhrWTrrJglrVletWTFimvj0uUls0RGMA3VuDsOeg0iZx+MWmZEKp2D1sV3dTb+XW2VkkPpYJSScO9LXc+tzaarKLCnHZlk/N7cGMJ/zLUgfgP2LN/jumTx8bYNuoE7TfIaEN7LzPRVhFp5Yg6+A+1yDLvTZSYJYiTSQA8HLTYQG+JXz/UC0zZNFrYJRAz2DIS2YzjgwxunGWVoRIRZ4kncHyzNzSpcYRwcz8fhCyjP0kDcNMbs8TsJaly+zFyiN2uv9AZnKsiw/ii4UUoNqbsJ0OilWj8ZC4hGqHR/0K7VPNsrbfzWMBEDUVxWlBnCJbhz9zHkdysg3a3KyNShTasV0EA+FG5LHjs3VIFAiDynfnNX8mlg7Ezx5xJ9PvSmte79RrHMAKMpme2BC57YbguOtPfsxNpuDJi1wSa6R8AKITzINceHLrmAcopxRRUMp9qn/MFgCoam2LQtis8uKld12+FUl8jrw++7pCD7YVZdEWF1WhOOGsY1rBvHfMyPY37ruN
+    password: AgBW7l7LGZEJkjAyoSB4PmbwKKXAmhn8lzczPd2s0RNneiR3MKy+ONLjkQ1WnjmvBzBIarwupTKe7QOwcNkiZejZP1fBzInHgof72H1vcosLzjagNfzLqyi0NXY4G42c7N/a9glQJokrYRZ4vL6GDsQ6qGUbvmhEadoGMYeZQWY7YKPSslcppl3M2Nv5DkF9664heeMkRovDH60ZNw7R2TkggMf4nNfTu/vjntImCbTcMKrNhQ/QawmeLWEhux0GUjY7WyWOtXrF5Vh8SOZ4gTRq9X/7Tdtow4eAByAxv1fV6J7MpZlT1TP9ir0b3U269pkjmG1gq0oVDUO2dPqRA4a0EtM/MwTYQ7SYpZp3HuectPsNWcuRMUurQ02hMkLN7+Kq0SiIRapga4mbG8Qgpa2xxbG83PagRko5ciwlorwbeBJCjBNeIUpIQkGe757AYfwsZOhdJCFi55sz6QKkBIOsiMI9cL/isZgKQVZ/65Axcc5Y2hW/EcXmhRJbab1CRD3d3ptmtWWne+OWuw5hvZdDK+0/Mb55sxVZde3g4FL2T3HMC4Up33gSYLUquLPVPIQ+iOte5q5NfOjJX8qs8pSYWq1pmycAAB8wSMMx/2tGDLirh4ZMArNEh7GbNF+cYRhDNjXeFfCzq24IDlN3f/nV5rI+sGeduLMtXRuImb2G+l7TJrnz1cUvux6tMSJY4pa92ykspZKdUGY2
   template:
     metadata:
+      creationTimestamp: null
       name: gitea-db-secret
       namespace: default
     type: Opaque

cluster/config/secrets/gitea-server-sealed.yml

@@ -0,0 +1,16 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: gitea-server
+  namespace: default
+spec:
+  encryptedData:
+    base_url: AgBQgalmAbHpukwecpnlJ/Yxaa3HwK7NQ17pn77yab4PQjKzZIDrH7ekmf8s2SU+8QvRnUTfrz0a74fS8h9MMBvQCrKCNoIexZ5/w5pIVp6AjYSTkNdIuZu64gZ4s7vPle6dilvVQ7DWBhybYFnG7QzjB9MV17oSPDwJK/7EVN9KEPYJEyaoBPDoPgIROZ04r1A7ypFMe7sE8LWaDncu2q4BStqa9eUHuSfTp+tGSDUyrnVPcV5Sm9ulVqImQEIBk9UloJdn27fFOvqR4+C2js/wSZzyt+7ctQuftMc5FoQNrrkgB7oYG90rwuvZqq3kl4a+upuchKpITDeANCUnd43yOrpgrE1oMW4KJ+c/R64FA+e2oeOA0eZTbsZm4ztCiFHaOzi4IyTt7K9vqTtomGw4uZNx/4c5T7ReP929avLlV0P2jIA8NFQzIO9uIfq4H8tbyy0ix5mOhwlah77ExUJowb/7lgmuu9uPCL+cBx1SHcbhG96s75HvysRu8bXDxuOwp+l/L6bVYGcp1nBBe/L3jGzF2q3ZV+lehXsGMT4Xu+5/TCT1VDKkIuHzWelMmCQ9RHxfMvKjMUr7/qgUORil47uWfCJ7md9M19BhIVBpWy+Dm0tWkUHAefOiZuLLiyFHfCbvAu/+i+OqyUm4mCL8YMCv/agABmmgXxkjBDhIziFAa9aESGsQVtA+0tImhtgH6hV9aIux/+SsMYtEHJEqSZwUZD1D/wCVr10=
+  template:
+    metadata:
+      creationTimestamp: null
+      name: gitea-server
+      namespace: default
+    type: Opaque

cluster/config/secrets/homepage-secrets-sealed.yml

@@ -2,22 +2,27 @@
 apiVersion: bitnami.com/v1alpha1
 kind: SealedSecret
 metadata:
+  creationTimestamp: null
   name: homepage-secrets
   namespace: default
 spec:
   encryptedData:
-    BAZARR_API_KEY: AgCNpXfA5YFV4osBmgvP7jpZAmfTaMESjMFY9ihkVlosah4IPuplqagVv0MpzKEzReQBDGdAD/+xqtYmGozXEZkgQiYgVo0HZbLAlcXCsSfyiPHYnZISHbiF49QmTfFOR2Nn0fIolY4qWGouZLbQxvJytwPUwSXt2qRV1TE+c9GtBZ5iO1YYT/WNN6pwU3S9MsM68VVwp9oX8zg1tLoLkMWmKw4uA77dTi2DkOFFV29v/bilQ6m0n8WciAVovPbTYl99qj8Lueb9JkbIqHUNtAjnmGlQauc4ZT8jCLOpFGQerhYl3QvUpgijdhU8iIw4M0F/Ys4fq1bpVNEuYD/RwM2A7VGRnv2MXqwXJYgw8rYRWpk1pJDFXeTY6ycRVCyBgrXYgVrNno6bOESKbVkdFkyWMY3GvQB6Hl5RSllSOu2JpGd4Z960megQ1khuPPWHxSCn8SEHVYKFS/rm9ihE3aqOAqmeUIMmK5dVtJ4vPr2Tz2qI0PtjAVX/kYE80m1HsI3WQHyvHuCS9Cv7obkVhPo/zV//5T8C8mIbpb4XNLbTA00H21K4dy3sVBkplroTbmC9FqGHbYcFwXnruAreO+M8VHuae73dGlJVAd+C4r4qJaHN7jssY3P/K2f1gnoVwUuZh8BWAC5XfwnnUAPx5JBkmReyoLoP8azHwjh3qwSkZfnmKO2Lvx99mxEcw49g+qCGusx/P4CksBjcrrYCeLyfD5kmWBKk3d+HMMBKxf87Kg==
+    BAZARR_API_KEY: AgDEhlYLcmagIA2aklfa0E5bGnXWgJNXisFA1EHpgVvkdTLvrOUfCS6wPOs2g93+rMgtuEtzjjxuregyXpa4Oo1dsmwwQoDup81XPTtDFvhrEr6eIohQcryMSmhOfOFd2zA2PMMoK7y7ge5cCI3q5Do+xgW8LqJkuLoCsu/9MCm3OBn9TBhzJc8mvqPdnzppddTAJ2XT3J/hod+nFetTleyOlvqWDKlcIzyUAxZJ0u8w+l6d2Ew3kUJI4o1FOJ93KNC/nJaruqPjL1KS4HynQrNPNGdkDP+i9SYRNnv9/h+J6ptp9xPpkvUjTopToBeSh0oUWXG30gy1l5PHf3RTTWIroLyGUvR6O/G/P1+Sa7uA0c9+ekChtMEUhfjXuJsDzUw19OY/wUeuINoz/MfTxVUx30eSI/2bKrq36CKpjv0tXeNr4XYzikaF985WfZqG36GlWEqDY1PZUkS1pnVM42sclEN7UhXARLrTE+xJvE9HL6YVwognP6nJCFqIqi7Q+GT2HC8rRDhn6Fbm2mkGwM1R3ssSr9mH0UBUhu44pkIQmedxhpMx/nxR0rXxlRXFiv05L7fqtY6mtEO12EDtjPY2Yh6TknxJ6+qFaxdqyBeI8X2KlPjadqt9yA8F5fC5kdKnRTfNXoF0zrCtEZXKts4joXki8pNeI41/E3nxL5gn3imOcDoAnaqKdaR2Ot8ohAKqKhZtaIfm3Q/s/z800uj3GEjYol5e54XSwcHfYqQMCA==
-    GITEA_API_KEY: AgBhI/PD9EoLKBYbcZQedgWLWKLdkLZVU+Cqp7r1LdGm77FeWF8/sYQQ9gPQ+WBbIKDielmO8Z28YdJkg+VmDzWRFit3Ibn0Hsxk3sBGJhCPG55PkKOP8TV4gPPvvJEDcZl8W2kHEMm+qTGQyMikzKUEqaQlvPe9rYY/ClvftNa22I5bigTMS4vljFkcbyrZv+LhP/U0R3q57uKl8XXiYj/DZH1cAqstTT1Vib4yjTkC9cdc9UNHAeHukvsdBeUws2T41V6+447G0mQQek1tDeDR0gGtTTxBMjfWAzaZmErPusD4S0s7onJkjHt0hVgH5CrWYK4lXc6VcfQmIoOY21TN7w71r/bUjhm9SGShcT6PUJnTWKoRv6++ZA/fXa8+he2YNJzB7g0tN+Klu8O/rkYI4skgEAGJIF+PrYjIcjIwROHRt2SHCfsDa7JkT6MZWXq1G2xDHAs6QMr1a6gpoNXqcfYHFKluDm8FqmRyNWN5zlmsofKfiMK1ODoxuOrXWxQlhZMHdIbeBhCD1HPYCWkegaIe3DUZAUR2qY2AQKnM83yXt6SjhcucdYRMApt2SlGQkVTr6N8nIYI9SbIjdYj9QODtyByax1YuM0yR4Qlpev+wAxoO+4vHlqYBGUdYj2hMZ3k0do1PpSB1cdrTc8hO3Sa05rmPdC9L3AZ3opfG0qPHgQyRWevbbPjbfHUaV5NAjOOufCsVtAP4X+tu4c1desOrOYgm8I56B5D+x5tvGGYJ51kDbuhK
+    GITEA_API_KEY: AgCDVeoNFKMpDPaHPn9MpMJ8SgmRxafanWqdpitfsPzRf0UEnVZiNcXMqetr96C0kVJo6H3IZg/qht2nqRJIsH6RXpeqvHc4wGLMzuTvj4Y+TL0qNkN12yCojgw6gYmTZ0u0wzbglN40wt9Vxwgaqr4jX2TLM4McLHfMVCUPcKSppyy4WBEU+XDDLRQcBkWFge4MjGYnWvytWUCpMYh+oiLDfMy6YVRJkkI9cTbChJYyckM8bv1r8rWm+5XqF72E3ISVqytlorq7dHeBL9uL3iBS29dfZjX32Nne1k4/AJN5PsJInn0Y5hmlejHPal/sr5U0iVzfUJ9OP60DwiOAqcwY9hzBUTqm5W3q3uNPvj8zOWyyZ9dIrpmAKwsGifvIFccN05Qe8eZXcOe5/2PEKU8TE9+4Lr0KLqqW2X0EMb6hAMXneWFdzGTqcgrw1DeyPxDG0CPcaDcJqunuSHN6ML0yLW7HngHYKNs1WhLq2YoiUs0T7z+xrxNsT8T8pYPbiGxun78SH8j+rbEisSJo+GRJ6pAhieZVflAfoX9JKiak7Z4XzLaAUUZAYic+vLRCoQOd+5JrSAWHfnMFJlazTgkXlJ6fPclwaeqSsCGDprF73e475PK1FM54RKsTn6RHpDhr2J5+rMBJoWgHUoViDwO0EOcb+vfLOJzApTUr0cs83RYhKqsaWvJ9FlbOgbgo2ScCDfIPLFETEDGKux4r1KRvu7DNOnZYVXc0gqOa+JEP7meq68BQVqZh
-    IMMICH_API_KEY: AgC9YJLniD9Vf7gBEaEmuthiRaZk14NmCj2BcBz692/Oiv/m6iu9spRM4FlLdaGeUEJaXNOcl8mtG4l/ysPKtJj92ZH7zQbUjgwVnldGOfPiGVFrMccrOAVhgbogN3PtOU1pGFR9CTkcJLN8mGsa6AC3VAsFi+vnP8HAvMOQ46ikAlGx/kM2LzaEmJ+dnKbyxMCyDB8iS+YT6LB0I1vd+sYcGGdZZMi9+2xxqh6lMLK4ZiOYyqF9+7NZhokpfP1i7liuqLtwDfea95uBrJ2juB+9axWexzaR/X3MfaKMlns0vHyRUdOPuQU25P9Vqrxl4q5VvvnIXPleSB88j6Du/FiqiwWDKjNrgT45AzaoCTkutR1v80v9vQ4QBB1HDgs6JIvytlxqbNUFEJrWSDfpbKSgKlFoxFhGHm82C24423P89hU7MWdtmUyikjO91uCoJ7PYJCbNZkvYT3Jc9khbij3MfjCgxPZjiHqmtHg4ntvQ0+Ihr/eT0tIETpe1xuN3JyJtV+0cDNTlYvJ0w0R3tw92bU2I+OTNQUfk5lQp+VVR7vR9/mlMzXG8PS7p9RjiDKMVGPYn1+1Y0DLzdQTC1oy7EjJFBnIsofeT3EUbRhsYLP3LS7i133SFJ28NdMEQlE6Llp/lnBNopiILS5H++cRua6DLopl39/X0sDEUDcckEnxsaKd4KKpM+fNMcRFl3fVBhMlPODh96y8SLsa7QnuMJfhhRsGrnM+ru9MtZDKib4fGTvIzGC5J5iU=
+    IMMICH_API_KEY: AgA6zDYvJ+uMlmjQijZbTOYOmJqcLJsmrutKJBd7kB26skvpTVeC2zRx0oR2+g2j14bwwd6SRnEq35Fa/IYNKewrAvaeF+cAgTYA/8G/Nbu9w1gYChFPgK54teyemlOsuFNPjUGxf4LABkzkALXrhj3S+jTm732Ou0DEXhOh6LP615CBrtu+znkuPx6azIcw/52ZElCY1AbLMg5M4Q9Exww3vrsmXbieGpv9LlNzH4NVqKhHyZUf+Fs3uy0hmFhug/7SiVD5M87CBf6JoHV40i3/B3ZuqaqSvZgH+QE04ttzIi9nunAbin2sXGZg4zaj34Rxcq8JrPEAYfr8HGC8YBC+kB8+/J4aPCmfwZJCtEHTlm1ODmAu4mSgpQMiRAB/0UWJGmjCG32l/3Jei/ayjV9LmOVeQ2aYKzwxjzkVp++qXeNGokIgiU609ihRXM1SbnARnNGQwJbC+jiCIxLYuifkFok93454hX/eFiUHxI027fqqrymX+1YPRVdPjXwTjW2DlVs0KLHEvfKrwLxX79RsyP9aMXS5vSyn7/OnVAHNqpVongYZKe+CJK6Lv9irT5Mw+b/EoG2yYN6bLhb4djNcZ6Rer/KZloISsDrccXPt4kXlg7GCL9+JE1Kp9sGMoyFNANWfjAYebB6ntUbAHsjhkhUTV+jEac15YOxK69GXTg2o5zjYNkE2T26JEFAbjxSr8gNmPD68r/tDkyk6C2MmCmZY2Xr8gGHYOxVZfeqAsDHPty4jNOCbt2w=
-    JELLYFIN_API_KEY: AgBcykvKicZtPUZThTBYLrYuBqodlETUEzddsUkqfQ3aAswb8qvYfTjONRVXLj8JpC0l5tAT8UkHAIpiqI/hG/WXIxh3embMs775nQnPof21Ej2Pp2CSck+UMGg4Z29PQmTXSwGMRwH9+xEirtYrr749JmSj6lzyXHp+mGUBvqad1jJDKJ5Stg0l5Ir7ih6Z3qoxzAIZPd+/4MXTPC9tB0UgrZf3fxlFSEOy61SRf8dMY3vSsMKvNFtcM4BSS/hxqTqYxckFNkIfKwF7mZpA9slylWpG91UIVOKjKHmypX9zLPsbpVmsjLSwpIVV5nNKriBv4ANTylSWgtwaBSDcI9ejBdpOvxSg8DqxGD21sZlYitqtygW0lDy1hJEmSnOYFfRGnjYEoT7DawvaPV2ZLqySpCEK0PiK6Rb9Y6J/BWtI/k5H6UozNrkaKmM8x+z0G9+Zeec7DNLlT3bFZIY3LuYkJBsgtrKoajR7wlJ9KDaagvG3X/UmBHdp/TCupkZ0wvZbEwaVyiLCxNXRuUf+30pd2o7R2DM5SUu9q3zrylri24V7y91NB4oIWdhZU6JQjf7W9UW6rFKF4eyR2XNhWjxqQPAXWBykuLmT9HsVjDL64RcslBKrQQaF2IodHOnvqsw9rfEvcPb7frhZFyrlzEzPndZ0kLJy1f2s32CuBn0Zp7R9Lk4AP50C/LiFqTRwNMdzrEnBKbbQ0Z2XeRCB/j1TgXnxCw7IvQZI+Km3vZdsQQ==
+    JELLYFIN_API_KEY: AgAl1XoPzIfEzH/GDqTNr+OSOkjkg35+eHio9t1DhSuPwT+SWZJWoMW7Mkb0eqRm6bwQp4VlyE7ZyLa1HhN25OOe8LS6Mo/G4KVgYwLXICpyDswrB117NRS0tRm3IbKsAPE0tvZdgCddkCb3kL/YbF1THssVHzrHsKpVrirGbfkEgf4ihjeJAVjM5aOGGMV69E2t/4n17jGLK9HPiEmxncPjfNpk915WdVP9CiXUzBsGREE8oARPRpe7e6XLtsJRCQKP19A7jo9BMRgz9OEzzeVfabb3P38cEr3tRRXsnr36iPZX45Ubvkh9PynHZ7fvnRxn8gHUU/1yg21f60C89p2YaOmAPlaRcnV/1i0hNgzq0hZHIyeCn5e4ff8R0BZlZ3ERRJEyq+yN7GV9mk3Kz0YmPfklr3HgdndTigCbDc+V+KV/aWB4ZpCSspAbLnoRf7QVU++fak28OhnT2NQhodszZdXcbpztbqHwmVkCPLdFuUXOTjx4qTB9sof307R8q7TO5aF65ZhDuv8MNstedN95kg3hPCPAh2ukv9dDy3qi/KGSeFEyNl9bTlkGLOkogGZOOm2Lls7evFshQWcRz0RbqUUXvX7w8G8vG/UoDIrKRLBn3mapZ1pjSLS40scsVQzwdWXAxycrwEqzqcecfHw5MrJXl/y44SMS/FBZlLgCDB6zebAXRbkWx5AyaPAWXaavfDRAFC/wGIZIBD+YAF3KE61ZZ2gaCGCKb9I3jNMhPA==
-    JELLYSEERR_API_KEY: AgA8R66Q1at10Rxyp6kfaztfTNPsjFwxvinSVzhmVlvey4/7ZmipA/jJfyE1xFq3Rl8gfoZicg1NhpkwR6QNdRMoTazhRF1/aSTPbFJTSQVEr2+dvYRx19sH6zdlcx0SPBp2ZGdmiT65QJVg5B1NmX3Ne7IXar49/dL7gsVSckR+nUvsVKhjf740mg4+Ov6aIzLs+kg65GanSo72OElQ211RoPWHTtKe1xaG7rPATX1LeevjtWX2nsINyYMKqkPZCoi59SH7dPNj2LUKCsB9PHw5jk48ESI/p5RuLQbSnfPhkYgQIQqPe/eP4fXvtDWSK/wxPQ/XA+kaEoJ1NKw07lyePyxc+F5uOjQ5mcX8sGrL7c+yvpCcsHSHbJpqLpA1mOt2Mw9aQo5wfJ+PKNXTKqW97IP/dqppiFOn6KQu7RREN5cfqmltrq13LMY6sSHIArBxaswh/XaAqZgSCZlY59HT8cVDsX2lQsE9g29MvTg7RChOQ4+Oyfhe+vHeXUHDq8FdXTLpBABi8kCgOzL4TzFivN7rU5C7xPDORRuVbRJN6YFG6/hMRlZK7R1wA18LP4jeRO8Ak+CnzVXSyJxB+tQ22T8JqPsl4m8/aBXidEVpKP+jSAKJ21ismhjY1smlA4pHR6PTIQNRB6trRPSyNFKEr0xJCeAltjONHdteyLqrzQq7lrA2r/GqmTBbMmV29x2Lmd93WGJrUz3Ko6vmaOYCt2UlZF9x/R3FYYT5nT7eJKcnycNrZgWeznTxetRay9Y/18uDAQ6HWSIqd205KImv9sP7YA==
+    JELLYSEERR_API_KEY: AgCaJAAMTL+eC3EnKyhUWoHF+lx5rlyf5+FABc76uBCTgHkJybbt9TCeTysUjBKSozJi0fqv/uktc11wURgTCRM7zjPNtIsxCTmRBvFPZlpj9dDH4aTSv6SzD5q41/hl0LfwIE+J3Ssd8NYPGYZcYFLiVu4t9f9CzXy4f4H1j+T6/G7SW3q+eDdViTt3ZvVORwxGy+kSO+gra/G2N6ghsNtzqsNvZokej/1mRwkFfjvi2h81N9IdnGURcx5XaUUv4Zo/67zRFwXuObiL3LJKYwWtEnWVw6cLIoWi1/e9nGYIv0m7tuHuylK496nmAYL1a7rmLxoWJgaKYKqnwS+RlxifOYBOz0zUxGwjbgGEqi4gR1D5ErcRkx7Wc6PQay74leMiG15QkurtZ5vlHAQdqWAM9hFlR22lD9bCJ0zCG9e6P8eH59j+aUz2IQru+pNm9TgmxEzCTC1EXT4obQ2msjaCJCPeuHC74V3ytIz5v6vqtoSVGdRVBYsIIRyTIahBxcljekGb4Ew89L6DauU6BvLT77DeWsR1H/ozoROxD5ws+HIaBdyoBv3CQmwMpH4YDsbFxc8uZtUP1Y2pWNyq8rb4LKqslcFNyoYy6VflTfxxyG/Eyv1pC/60tGYMjKT9svW4xQGm4hQm965dXEn4f38hQckwDP/xSnQj9EpPNtaovn5R2PAe/GjIgFe09G8mCDXiBIvak5nFiUjuwKLnWwmJy8DevfiIZayfRippQz3hZQlvpIf6v60t6hdyll6RuMs6s4vIrJunAzhBYkyBhtCR+SmoFQ==
-    PROWLARR_API_KEY: AgBSGs3hoQLP76JPjaG8RhmrvaL6wFWKxOuiBDyDTYe7Y8xe43HfjKJ7yH3vuAhx7SlC+qxk8xvM6WUDeT8J4nC3TXZDJCCcaX5NYrI95BJT0+TrlLQf97h3c0G1JlizMw+NY6Nt1j+G1d74hKza6jjlr+zcTPHyagzDN3wwtq8XaBT3cHST5btaC5XwkZmqfq8YNieEi6DR0FAYXnh2Ne/vhJa1ni5jVL3yfpdbfAVW21qgnayvhG1obj5Ar03HmWAZn98YgpL0nfQr8yCBJRq/NodMqKk+2XM7xz3tgE/4A5/3wEaoBr3Q7zDQSXBMcmEs2CjJParOX5FCqzB6cc5g1rVh3EXd6MbGzVeh7NpEDkNVCi5Okoj5j4vZ5XFuxbbC0Kb/tC+V0DaxQQ478rqOPwieHhmfpPmbqud9B61hffr2eNKKH4DguP2w0V6Sr2IRnPuoYtlLPdmQdWMYE9CNlsUzLL7eo2o0tiaGzBdoStbPMMbE8TCKcFRNTxe9S0zi06Qov1ebRi2L2mWEHY1WujMuUOG8p0QATxnJBPd67XgRuDqPgRRdYFYkUKdGffxfD58qx/tRXxY8mDHQgS5FCGrMhjY5KNdRNPJUBDiNqgHB9LVKaeyM2dC2k3vJn4y/f0sxrwXq2zmkJVLKkKTVm7A/eE87mR295bdcTRH/wqqrnYp/JXKgAZUlQUn55CmCJ+36IZfAHErqsQ5tY4r+spo4mVBS5ZT55fH4DGw2xQ==
+    NEXTCLOUD_PASSWORD: AgDOdIYXaYJw/5ZdVf4IutB7h/facNUYfe3is8RU4glzymnC3SZrPzdwAbPsAwf/VvtDdN3B0H26VtCfy5fLXMQiiUmdt0BrXK5r6Q9Ymx8zDjQiOJ0TyP241TJQHBwl+YBq5SnjTI3CkdMs7uD5QMe6EqiuSS9H9EEJinl7TqtXWlet0gVjqpiuNJU9KmGRKi2Z56Qm0eBrrIBGpi6jYU0vmB+492GEZ6sfkmoEzNllRan4IXervclLU/68KohNx3aQT0SrsFsuBreuKpB9dGY6zgCTN2HdabWrWU1h7iC/8+3pJO+02fnOTIrS4drm9biW3bx7yAdSZ/odX19CulQFd/mZs3SMCaiS735YlK6NFwV2Df65dUWD1ocvpDb3xK7MAMcaK/FIYhUYS7SUf03NTZo3RmOYB8zfHM1bG6NEVJyYs/HeQ7BqIsKWygEIbH2c8cJa6ydc1DF/UgtA/HQhPyVIj7zpmK4SgmZ5SJQy7vLe9uNSO0UHXcdmmXWsrMGiXZP1+QPRyKBrsDcwDsyl4QrecdCcfOerHo+tsMEQz7y1Pf/YnIGpNtSoHH479X4mYaw6fvEgJloMnAZPeokDYJ7e3F+Hw1/7O/OeBJECYfkZNlkdmFCQEn/tzUVABVXe0QKhO7XZjZf3dm067i+7gMCeKdnckG1EzHkBIj0RK3ni4ohiepZUq1kySmnKFD+ekYAE55lmbi8fwQ==
-    PROXMOX_PASSWORD: AgBJMx051Ot1MAJD3pmc1ITzta2OuDwhM1RMDkqFjQw+NpCV19HcUQexpLbI7ouaNBX8kZu7ZgkRnVMkiGyhWFicUklo5zJ+f1oyLMaD2e6SWNt3rxrzymKOYnGI/47seKjzEsQp+LnrBWRA1LRGdFGkOtxa8O8JiHnHTXDKLqKQxWqmmuyHIHa+ekgHigLHbyofXEalgHg09+ntgz0wIaXby0pndXxPYRiEr/YBa9GeQY9mXU9fNakwBCOxXVNSeZpz9dznKWm5nN+HUgP9X0tTtnCe1PvHcc9N8+nCQpkojghuVurD/SRApZQZs+XjK6faDrJKHJ0PQFYOLKkMcW1UwjbPs8As853fJdSQ3ChXSOigqXfVZ6XQ6+ODEKLxZOhFqCOgrHrQ4ayXkGjvpMdQLSyA2Ee479usVLiZvBxIGOhLTYwAP6WqNRVg4oTVKCS5yM//oSJIHmkkXc6Sr7/gbysJ86dXlgOTjYnRtvkVp6EcX4BdmAMqNcd5EUg/pstuhEWB5SgDjSMEFz+SGP2M/gsfGpjCeZ2lf2PK4BUMHoqa7MQLsyZ7D5X3yeD0O+GL4mRTm/cutS/fS7XXghh8Jje+uNZrxIAnD80VhmW1Oo08vMcSfo79Bt0gYZaQi7+msWYYrQY1zVnajjN3dI65LWjH78EgjhSLIEMPzpIBbopD4q7nLv9oYALyBPWdPYHJLnLsIacZsTpRXsyI1/c/MoI8SZk8Y2fnqNlV97wtmjqFHkA=
+    PIHOLE_PASSWORD: AgCMot9kEIfeytQSgr6/RfmSbWY3UZXsClG6jGSBZHXhvn5+Jv3IGfXckFXD6B5NvnWyvkCwCcGiX8PS2aJUcWbNmb/U+I9g2uiSTsISK3gL+7/pQtZsdNCIHA0XO//WJqfbhlGvKvk0lRqj8V6icTHRqGDjEc1eCEmDXvuWQxKv+JORPQHPm5CwSF90mcqrkoIew/zb62BZCc7e7Au6491G2Owqe9kETtTtEUVNV/k+s7oGRcdOy6htAN0gIVj4hP4IeQMc++CDzjDmcO70e1JaBRW/KPx2IDc45PM1RjZgWa4D3YorNhIBmdtRPCLXjlaWrkT1rEaiRhR/IBCmzGZvXlRs1ueK4yl5RUFwlhaHxyuGEQ6xX4+9q4zllXR0bafGwAkNrlIFTawTSCM8sdjUEySjK9W3xtePM2jfzwi5RC2XL0kQd6JUJFA5N6sYWPLdky8qd/ZnK85e3sXv/Xtd4hkjEiKu3VdREbyydEA7Q6zM8JucE/Rce1HhxVAaKGIewaN45E3LWGTCnyik8WAptnkHwN4Pbs4LeohSrdosTx0pUQUVrLTSp0XEdCT3xIjFGpcrHOOfxndztbGn1Y9ELl2f2ScBAzwFk5pdRYNf2BL4ky01erfyRtz1JUov2hzs2xIRVMfjq+H/LiSZpYhgg5H8YfvMhQTecgV6NPX69z4vHeGDJrW5V3jbDIfJSKrFUlJ0Q90wW8E3Dw==
-    QBITTORRENT_PASSWORD: AgAcY7p5aqykyN/yf/AB+Ys2l34qJg7VDqHm5yjSCCV52zE81TASubme59NlSMKn16P0xXmsIGX1jesj7CMvWqeCHkIgvSJfM5yZrtTgldVs85QU5hvO8yl3hVjB9n6MeM1F2+MDgFxJbcwx4zO87UcvV5BBwXylStlR9NUQXhs0aRpagkqmeMu0VMAzGCwUdb/J4sAyUEUZjmmMh5GEzBCwzLmXAXhaYfUca2CsFSTxEWmMYH4kX+6VZY/quCkB8+w3nk19wQZrzu97ZVCHQinNLZmyuF4fTFa93vxxNCzPSJLP/BfPdekI99MHqpC6/R7Cbm3UtTalVKSkUqYAOqxqHLFk5YX38wMOyIy2d+Ji4n7uYX9EHGhI3qkzcBF0c3wXkl9qU3eitCatH/DmlU2ydjITZNY1uiRrj8aD9q7EpZ92fdgSu3HiPimpCo6c2eE0wBYBCYrSDktLrcrS+GdzrdE8hTzNgcr3nP2AkEVKWTuHhqxnUzWC7So5Vv6g8bnh6om86yM6W5iihWRrRj7lFTOxfQPXIaysDtsgjlgT2h7gi8WLpIZAq7EA3th67DfrgZlflwf9M5CoeZMTwZbl/vh9y8v1VKQacRXLjF39nA8JPEGRNbfGj3581NBgjaMOV49ERm1FyqUn2rhoJRSxsf6JmV+sGAGF8t4f8+cY05H+JLL+Wb+TqJRJzEMw5dLUjzWhSrGqRbUZ
+    PROWLARR_API_KEY: AgAdUTlxJ84L05IOXofdq5YM+ETuJfHDXJKNbJxwn7OuflpGYYA+O42byUHQKbfwFJoQlXv+UQqpq9L8FCyuYxDX+vwXD9UltnnZEWNncrac+w5vgMZjKjCgStpmNl14K59+J0z/nN7jET6OOag9Z9pM0ZGnQ3taUrwrvrCWZJeCaYcsHBjQdQ/hIR82/oBsQzIsZ8OGDP5dbePOxHxNDb7d4R732VvIsW6wTwWwxzhWDvs6uT6aSiAFJ0Mcn2vGva8+CxvJaFX7fleLkRFRcPr5vEjerpky3xjDY20jmKJ8bKF6qGitTeCJEpyoARmHaeoCW33rY4+WFj7mNgS7dZL2/xmFXNErioBxVxLVG2Wid25OE4mBrnKZ3P+Ly8byiEe8bHe4jMn6JawqRx4FGnQbBfEX4/NZhJnEkTYXQ5ag1klTaXSbblrXH4UOBVsCyvLrSKI3AfiadEcKASz61qlzPgOhm2xENFc81I4BA8QZIFq5IBxudrTzOzZa+nKTq7WKNoBHkUtGYuT1vuTn4/HkkJorLi46MdeqEYlDhhKbmmk8s/qemDyVweZlHvsS/3NxSLIADF95UWRyPTpvrUiM6WGMLX+kpSAqOqpWMFZLU0Tv6mynXhbDqq/hWRPtIIzJubtxuACUEiaCOmCwjfBJfm472/iw6rXJo5KR6DQ7deLbB1xURBIl0NuKQY2dbJSUsiKnlGbn27Qn9/tzSujL9UFVAmALhy9SuFzDBDppHw==
-    RADARR_API_KEY: AgDBzby6IVvJjnNewwn4lWkXplgW0aB//ZHhJIsTxJJPp5nLVJW9mqjZxlHIG85lL3872Quu37nzup25041i7/vizfZ0X8ONywu9OkPI1kVlLTRLlB9f4h6LJ31nQ6csPxMLkYlb+R99uAWW/5EKPn6MqL2AEZ+YbDbJ3HQIxdxdcdEStZ7VLRVW/TN8mkLBPspWe6TTasL4S+DbmQ6cTe2AvONdwHHJQstC0w9UQE2WKBOkb71P5eV8QImIDgYpXdRAcZCebcfGKI/ZYuDOTydCJS3+4ergP5aQQxnFftkGcKO8I5Q9m0rAhj/UzmxaM4Y1ynym5RNaRNjo/Ed7dtHhODuoLEYjcqO+1Plv2uGd0q91Mmv/jRSU5qNvPRRxNZo7y53CbOdLrCRb/QxddwfOwrj9TTpJXuqGEiB4HA2OQIfGWRfwdtmaNx7nIaS8Ztr+eT7czQ3tTBYPrHzrW4jO/wckIyVXn7M4Y818IEI+9ftVN3GAPVarZx5CmzMhDVss3kRRD55pZgtDNq9cCFgXeH3j+P4k2dRWz6deoIBlLm49cjarUFB1JWQ/HjymzRk2+e5Zbw1vLZfrqAyt/ib43qSa148W6vysPj24ECkbeWLtTO+AMFekNdR6+RYijlWcJRJyGsRBRCZ7HW/cMHDz++vyebQer+p22/+x1L8GyrR4Fzrm+9yuZ3BFU/738ZKBs+sa0J/C3y3ApGRxpJ9mp6IcRKuiwUPq8Sh6Ct+INw==
+    PROXMOX_BACKUP_SERVER_PASSWORD: AgAbdisb/Bpo5Nkq4D+wSRvxsWzKfYna+I5zLlEwIV0ZbdXKBQxQtblLIOjuBTTeV39CLVyeir8jbQ8qdaDvfOa1X5/tD09HFFyaR9J4zcDdamRrXvOXG86KuKq+5rfJXVxuha05iA6xH62hwViy3KMcK/Q/4YR9z7JkSWHMKM6qChci8uHFi4KrmOrhH6LwieKTZa2mjTxN0kX/OtcKuUdP2l+dsA+TS4+EB95qPbCUS74CyaZwN425sRceJ6Lw56zQbdzIvNR6KmrtziDqatLkXlpYOqUPvwd3rKlFZIbO/osV/ocr9IF2kB8NdlzS76GCOj3HbLizHwiGnfSIEPfQD+YwH1iRnZRJPdTW7Srp+j5QqxrgxAamf3XcMaRD8dZQLP1xp/QmLMVZTGBAzg7n4HHRUjDhsi17V/AZwr9YwxGv6+tHkMmcZaQX2tkJPb8EONfp83U0gQ1pnIJRWjfXKvgQty7TjejK5wC93f60CegqbfcyzbX1P7rI+Cj97rfTiRLNlVrfrn/DdvcdIKho3ZQLUiY93xU/W8OHFsYDGPPnqdR5BVzU4Eg5AfI6FYgAix8F+YT2MxM4C/2IDRAxM5FWdouAOEzsvkRu/0/GHTJAM2V7qHZV5pW04EW4mJ9TFmk++MInyoWsKDd4/x9e9vzLpHj4BGHYvrX41QZjP3SUxnHeaDwfYNsOBs8T4IW03JUq1QvovW7IncAjHA0zQ7cuEszeUBCt897GHrLkj14ue7o=
-    SONARR_API_KEY: AgAicFynV4IgvqnJ/akW8zOCJKDwyippw7XvXnF3OqZrz1fLEDmHdH3gh7teNE9+F0dGEFjJEVGXDgaArT/R1NbCzFwStLmQ/5horGYsjCajcIqutiAKItn4qkTk+9IHgvS9OasxHTNJOJAuWMkQfoTpvzccVsN9Thzp1WBkax4QFm/fE56vjz6pAVWsy3piYQhA5xkeEVHyHuvNSL2voxgri2r2PgVZMWNyi0G8XTryUHHvqTqflf7NqFmbSC9ZGj2TzemyPLYURdCi1MjraByyBg2yFtkRD2p0nqpyKKIveIj/yJnEwZkCo4ZcCetDNf8HuGRUVrRrnD1a58GDceUtAdcomXA0pvIa+v58XQmtPE9yYOHxQS51cJ8qvC27cLuBl5bK8iqtpi2PRhtxEKqv53UkU4wEFHi83jtOr86SbcDJH7UE0lOQ//1nJfE+YvFXj6QN8ZNW9jRkjDYMjHDCjOXoo6HtiYEwnr7SFuWjd3nyKnhJ7SQfq10SgrnBkW9zJYH051R3nvAmN4XCfBXgLK4C042QSF6g+OzPx+1XUSC1AhYg1So5rEmHgist16Z6Yelx3aZbaz9+Y4Q7ehTdEy11EkxzHS4+YeSgG/hQhnOurBLJP9dQDL4j2WHPHsKh4QgwlV0+8OWp5kDH6YISSwhO2fAaHkVPMqIgJdhr4i41tNu5l1CiGfvqBtbnNUrTht2d0SqRt4N0hgs7Up2nvN2n7Gj79lqSYf+krfhqrA==
+    PROXMOX_PASSWORD: AgCUCHvfbPakjWMnFjxPXnX5TSqWv7tPxvBFEEkDwuZR8CKmUOZZFrtB9ANII8RCYPpwsBc31UINb/FWOf2sQhkSczWff+ETEB5X2ZblltnEXpvrwQjozU6rDuu8weC6mMvVL8oeL1wT5JtaZGYTMM/3R7GJf0oqseN57q4YhMNZ6ygcmepZs3s7WLcEXzeDu1quXFKVFCg2c4t55YM/lUWqn95POI4EZxu9x1s6D6t1EOUzp6LnsccMY2RbXsipm7XMIT3qsJcpYl7+po0XTimmERCRQh1nk4tUdqXLxratvadNxz8QXw5+XqBUAMtQpGBPftO09zv4yLRSywKUDW6YEj/m5UgQLqh0sGJfzof/Uenv/HP5HWXteFnz174UT3mW9vjG2fKnTVdbDYGV63QgnmfVjv1Q5Jfwgmqvi4mO/DB+dFAjuohuwy9nJiQBhirigcCnXF3k9pJyPf6KRoOpjSq+WqTVKY01+3q5lQEb+/W+V5azyO4TdldEKz7zU8vz77mCMx73c5U68mx/DeL1RGZGqK7K+ORilyuMYq8W8yuB8kp8ib1t/f4oYLae6i1C4ROYQt27ZVjppMEDp5iAXSTzZ7MU7PLIqpmgPAcsIsq2t3jHDRDzsvC6EvFbs+R329Ac5reNlL/oN/6Oed3ByCzcdGrQRSvuzY9hjGTUm0yQUQuWaGeK4MBM6gEZuWL0NTMbyPveoTGNxve9nAfeWkzrZRNKxYli/8tJx3X59mQe8D0=
+    QBITTORRENT_PASSWORD: AgAWQzutpD7fs/BUDOVWPcScMSNf1Ch1eJ0eYvu9ldhucokSf86nWEeG9Q+6x5URPrCIe52BagsfJclCoTORyTHf8EoAW23T37E8CL/p6YWJh0f4B+QF9hwtcRrxnwpoPxZo1lcFaIy+II9IRxYWbE74hNPk63ag2vsN2Cc7/FUUmWB858m9LnY5fFAVdE1z8acZK6M6q54gdRG6GiNZutktHW/a2xt12KaGlYcxt86yHKSEyGESlrhN3jlEd0wEK/nZu3OmzErDfhpEBF0jV37tQ9uNbMiXFA7ovi/IcsY2QhQuyQd8IpKaaeWjdRPFMMXwqJaRVmRIahFrLoOM0V2XAAe6fAUGn1XBl7MUS2K5wIgDdvgzpzsNG6Qwx51X8/1xOlOb8y+NJBJTKsFGWpOBf3CBt44RXCJEPyOrtiB2aBa/uKw3nhf/uU5sxJtbj7kDe3x+JongmZEUelX4i/0rub5Y7ANA3yijpQxv3/bVLS9xKiilKh1vTPB8z8ZDgaKzaioeLZmjiA7oMfFbt/7qDajYkO/RnNuGETsN8Lc/jGrylhFo5xC/nRlkYPpg4D0iCQWvKVb63oTlRvzbrjeNbd4IcMS4uXECrwxUWS0r7+VT3u1wHfVJr/zOzWZF2RqjCWuqxLDtBKATET2ce4uDAa10rQE7IVUX5USdQCEt2Gl4Abu24/SRx5aYJlolitmx1GOo+ygQdO8A
+    RADARR_API_KEY: AgCb49oKRpXYm7+Xd13ab/ECe/o3Z6QsFBzximX1KPDr0tGeHBZlBesXgh4YKFT80TY2CE8+NCXNdFLo8WQI8xu/5i7+UxCtS1IrHznV4xvo8YhgkxDg0Do7RQu/z4XsVhYR0NmWRYQnU89odoba7o5Khvi+1OVhwbiOscbR07a7YfkteeiTQRiAIuuMc6b41P+aKVC8sa+g5Wm4TM8TkM7U8/WHLQDFEKtpx8fLB8w/UrzjsJIpNsSut1udFP1oHZBbXkfCVgn8xAQ8KnVwH1fUX/dL/mQmD4Jhvda/WASXePdFw09HKQdh3g6dJnZbmOTC8vkFiTdWXqWun+6VQIy+3CaXtYUgwfBWm8xIVZAyxgP3Kq4UdaVrsKXPH8QVohjeSykamZLUnSwufjJVO4k7XU8eLgdqdylNzFKbc+LI/NDjCfQVWLbQ9SNH0ZI5Hszypo/IEHSHkmtsZpONvXxRmKPAt6OS57AcDSOfA63QQKCR8Vb49i8kJi6sqaznSJJo8EE1dOT5i125rNrEirLoothQc/JEpl5A3JqPvAVxsNsOIbSd6Zxs/ZU2u+n7dp1HR7YMvfh9TVrz08c6ZKv9StZqXde4t6m7JtQL9mUJSyA7JmzHE+OI8wNesmbStj5c8BJ4B137ZU577mVqzFNbmAwLi2aiR7HqvUebkf8vXdfCRqtD+hcCJnRv3T4aZI8Z+DekpHNlLVyx0fYGW0EmSCGa8Us01ccQWm/CdtoZkw==
+    SONARR_API_KEY: AgAz5UuOURhOjja8M1HJWXEKNXe2xM3MTLgXuXMaJNENC9wAC0fp5SflLbg7LnQQPvY/YuMFamGjzg9MAT83zJyOtuYaHuAPF2zjNG2bYrCEZyj6sLlz5xK4nt24Gqr07dJyC+iSRYj2xxQWm9KQZuSV9UbA3iU8PLdNruGLYnRDkznVl+/soBTo9bM0N53jzqsUFEuuaek0e2GhZByScup9vv3nRRvcCKNb5jDTAqFg3R4zWmZmxY/gmrPB9Jm0Dm0E0D2zBAMhAsjFOLvrXz0+Rah5X+C2CpIoiWQlQoN3FNikRExmYQgTSxz+PbApFL4y1as4ZBrbVQT9QWGr46cQixi44TkMgUXSV+rtVSjxhnI0e3/di7nNbjUsEykU2t8BQuzsRo9b/ft4SoWIYkcnT+Ezixy+IWZ0NeAamYmDJjsgKe90/K1fehtnfcC2q2+X3wbsbXa0tnW9EEzw4zMC73w2ucwVTzVrnDXlFNwUTvNz2D+Wt9KeTPmnuokCU8pCn2DVNXcu3NEwOw5+Us8OSc7x1YlIKMwegMsAlOs06qL6WzBvJ0IIvxaO1h75g3VCB7OWEjFv8Nxc0LKbeXx0PTn5tgxHIUEIZtxW1V5sqIcBi5bRq+/k54c2oU92ZV/fWzoCMWxBqXZQFy/X0x2vunJX06N1L0srSWXuZbO+oIY4o3yP5eca/JDNTgLRBuil9AbUjBPntumERIMWTklCVX7I51JjvgjQfL+0+L5Z9g==
   template:
     metadata:
+      creationTimestamp: null
       name: homepage-secrets
       namespace: default
     type: Opaque

cluster/config/secrets/http-secrets-sealed.yml

@@ -1,15 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: http-secrets
-  namespace: default
-spec:
-  encryptedData:
-    HTTPPROXY_PASSWORD: AgBLP+PTz1+03o3M52NnkoquvQR9WyGwLxZK+lpwsmyO7fTvG8fyzrJHn3LNvEiYBMB9NyhK6PXuLXXPIv/bUVeiMMpo+i5lHmnF3rB+ugwvT//7WkTrjdkheLiIE6bDvxS7DdEyGxV0jF8YcnD1p4BK+H9TTSwkGBi4DbOXDss6MFNKGgDXXE8QKoGjWJ6S/Qt4IaxsNFq3BZ+rgSKSga9KoPe5jHQKnggYEL8iBbljED0oQk4skPu2N42Li+X7KfEWO5afZRtmYt/VHCyQZ95B7jcDrftcVPWq1L4K9lEW2Sk8Km3CNgaYgOToVfcJMNGVd3gCzvqMb8WKzkLFWK7KTkj3VRtTLpobmxGA6yDRD6fpNifAKq4JxHuHEndZgfk9uI+8EunSf/ieUOSq+Kh+cOIrP+RQDqi/qEzBmWK28uja3K6scZQ2OS4AWaYQduO0dgQeSlHO3RSZD+ZSuFSPcgFto+Eo12hzzMkGgVf0GrQULKSHcZIQ18M5oY5dwJRMr/tYpOyXKcKEazu07iuNyAfZYCzcKPXnAsoHvDNkYHdEtc1IqvkbAz++rbO4yK844U5bIx0vJs6csOzk/PGyUMKYJmq+jMviaJXpYo4wM1ENrNkRCUDgCrfM1iC9bsPPpGCyfLlpHMzAKBnLAjSzZ3vXGp95u7QE63AMiiwALJvNEK4OBWDT7yh+5IxRn1J0VDnhekbsrHWC
-    HTTPPROXY_USER: AgDRarSfy/k59PB/hU9bY8DdllKXVF8FK0L2hPFdMZnZc8l9x+CK8gOApRXHrHOCVIoA+q5BafX0NW5hqqES50CMB/tI6bLmht93fGeceis1rrTH4yZsDGEmanA1e2xKL+bkgl3qMxqFwBIbG7Fh9Qvamz0yji07BxTqQAgIhxChKb32joMZSY7lVtDlf4OvvRhla9UKNQeOUuHSqel30ouvuVLf3+Y0d1nWnUvsecgF8lB0FHJuCc7jYdedvMHz9uhFD+UZz9NthULEMN40qmvbvh2jjCCzI9wjXHT+oTCXT7yCfkbt26u9TC6j1X5HS76zTqEuYzhiqwJ8tOb24uDuU6CGIaMmnSRawZ2TEzN1JQOXNIm67NeMndcsPIVUP2N9jK7ZxpW/iKFdXlC4nGacY+ynQMIswzYIL6PYyS7XgkztqnT2DlbrRUGITxDO2Xd+vPMa1qMLy8eAsynGNzjxz//Q5HzI1pYSbAnFNAspmBXcVco/k9zbkBorReG7nPnAL0EU1Z9smc87sFDrvqbVTZSRX1ts4RjmvuWuTYnx+gUGqmF2ZsSOapKCeJfItVmo7F9bAs2wAkj8f2cqqyxRMSu+kphgZVqsOeaHKXdNlcmEovg0+lwQJ3wv6rzB68lyyb1IEF9JuWlKR+nyD1LKQxTRTIy1w7ZKQZkU3+HZ8QLhbn6/zf0G40uJviHcoXHRuAJuxrM=
-  template:
-    metadata:
-      name: http-secrets
-      namespace: default
-    type: Opaque

cluster/config/secrets/immich-postgres-secret-sealed.yml

@@ -2,13 +2,15 @@
 apiVersion: bitnami.com/v1alpha1
 kind: SealedSecret
 metadata:
+  creationTimestamp: null
   name: immich-postgres-secret
   namespace: default
 spec:
   encryptedData:
-    password: AgC3CHNCE4MhqhFr/mL+czN2/K7cvYOZxKAGOVvU8Dw7OH3Ozsz5arkI1vLAGMiXhbYee4/jRSOqQH1U7wLUCN+9kqiiRWJBof3V9dnD0HHqzQ0RapQKa3o21E7c7k1sKrvUarWlzc67oL4o+Er3mGO0cOgY0oYVWhFxyL+U2KJsbBRuvX9OdOGIUvEU39Ta3BrnCUbo6lOCEvFSdGk3+G2+F0h2ndumGR8JhnpbZF9gAZMQB5UYuhOLatM5vb0w1T9yunGWBLrDKEf0c/58JtMKlR6+r0z1vkt7wVVOUJ04OEWQE5/Kfu7LD/2gcMlYg2QeCE1V7d754lbAwaA05wYyFSYsDVP+N19KYQ4Gro4oAa16+HJ9tWHUMbcG6qnzJyOfibphVn6UUXElWjWSu1r3YJtcMlpkBn3f0dQNiGUEntPkES0xFGSPLl1Txh80VX+PoL6/NTV4L85s0AJaO3BjkemiHlZDGD4iG4hN9DFXQrFHZao53f8OyLhoWfCzVj47ygRwXgNrVEmBoe7UI8kKWzF/tp9CypONgR79Nps6xDT0LXNwxkj+Z0CYvfgST5iIBh8QlabTAlLJOrz88FF3a/2wEZfvUxhU987ubBvYJrgxiRpAk7k3LCITaVlvKnIcRjKHg6bvkeS3Tbi9OYRBmCpzjHM1PqK/woXbYXMFNgIU4zwH9NcvdMtyw/UlsIrrAIGb2AM=
+    password: AgBWqFrduYmomuvMMeBJOm71JcL4r9g+5uTqRKB2aor0vQ4AY5IYDlYsSpgx4tThLWP/wuDNv8dtlr8gydGFk2bRVBVzA10pxg1PxSInLcob4mpif80gpWGAUbFj5j3f41xa8d5I/WelWC/TIaNYKiVoZFt5KS4NCm1IppIIgGNCwelJzcdCsBjxdWspGG2484IkZ/tDe3FVVyjCKyB0ZqFNpCCMnCSd681rysFoe9CvgJiJReuLYx9g8nrw3umpfLuS/I0K1L3j5RFhD5nXwHMRfoLiljd5dvUVeijnE9sAVDlzvKiIDfabpz7wChvndQAa7y96HC9cg2uE1uEjqHKEEz2/PqlmnlXf7sklZR8I0FpDMZ6YukZE2ObSnHAT6HYHfa7vt9+/pVRJg/Kml0xyxbzj50TT9I17I00Pwj8f24veUTHuGAc/GOp3KG70q+IR2dmgwshBDYWdChooeyW91MDHlo/TKdpFLnfAoKl1hrMXJ3K0GtzfRhzWQVkCDw4sIVJYWGJsBPuZUhclQ5hwipl6PfadyI1rHQzv9LxboMDYZe8ev3mU9oCxPDar5heFxwalxt2y4aV+jceXeJOF+F8UyHMqjJBGqfhg9VS+wK05ObaHbZtUaQFRh1Lda25biRepPHWcKrelSdupTUUwkmQIYmNAhFFkHltNfcZ+KqiFsgOu5IwtcQeWTDNVT6ptQQPxuek=
   template:
     metadata:
+      creationTimestamp: null
       name: immich-postgres-secret
       namespace: default
     type: Opaque

cluster/config/secrets/invidious-app-secrets-sealed.yml

@@ -1,15 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: invidious-app-secrets
-  namespace: default
-spec:
-  encryptedData:
-    companion-key: AgC2GSVmONXES048lVPkXkOXB6l/3PxYe/ua0vZXxQ/Urp9iedV3hk1XbkUFxwfpQY1R8hOZDPjr7EPAaUUHBLI1VsuLVUJ5o9HTrIeUiDStN2eI4XmiKH2ipBLv0Ii+jTHTRNXWYzvjbStVGORXRXynT8t2AwkAntS+SzO4u1/Y0fdzsoFxTd9uRaC5cGZtLlXYH2JwpE/gLYbnHmBzY+4og4NEM5+vnakGsLnFdDLIVa7fUR8KzHyiM1m+CqerB7PVHVKUsowDZd1WOq95KA/9UL5MEfLVzFhpRdQrZUwsHTBeRV/399JEaKgsfdtxE3pesJalQDzEDh2WNZmuLS4G4eCLZUy1tVeRFgIuyIOdU4zP1IqFNHRbmFg2KCeFRcKSFDUsy04v6ZyJMmjxa/RUepIxjwVb/U53YvduuCefsmvs/P9wvygxtF6J3bM22SJb+8o/7Qqcg64SqhDpUMX7D093bsNL6rhsi4f8CFORp0PKSo09ntrmn8+HlS1GoWokHqyaW5v8mbWZWKfLoAYLCpar6bHH2L5ObFBZ7Oa4sd53jkfPqTXuWxW/GBbiEKBEpIJBPBQ/XGfIZM4d+Hkr3goUJl5J9E+Y9hs9tEnOrs/vNX8iagobybUD7BPK2HKEsMS2OxAHw6y6qUXn039I1nHeV2zvBCjFWLvibYf6MnKAFr0VTBJ5ZxV1apbfiFSwqEXL4wwr/duspiOTolJz
-    hmac-key: AgCo46j21oUooCfIvnOVktXIdl4AJnam+wMFMjh+5HNOOGiXr9pI41wyfXwqIqcNuPzjQo4X7Vj21jLme5UUOHNFh2Cb/zTx3fMEma1ATfRbT/wWb0/hNqiNh1gKIT0eQ/RduV8uTvVaEChVm91bn1ZQsVfv7oc7asRFZUyVkoxBpbaE29lLgnMcJ+34tZRe3OVPpfF+3XvfHsGvQGB8cMydZyW+aYDB+j8y+ZpUpusRE4h5GfQJ3s9tyJ7T30jHr+swv1qQCWdY/eusgNabXjjI2AxtQ3rtX0hrvcOLK4vzKYYxFobg44MsDEJ0mJU2UerpwEc1kLomsm8INTAfQrJFfEcujEdscCFSNZTV2KDQVexGYuQO37elqbJulP7DtnwOpD8XIvKl4sa5YiBu527qf7ToHe5kXqlvyYQ6AjftTtOjTgbVM3zmhAWpnTb3wNp39hT/Rn7Gue2UczhIhBZXQf7g1yNTP4LHMRduQzRUfaAMStaroJq+vcs534aW7Hx0mgNoGz8VQhjpzTORpw99Fr38/Y/e4O2QUZAsirgXrKNKnojkQF8oUBdGmAKmYaVYLJsy+dbQtjDzUhfKWuhOYDoD7KS4bHi3HljPG4VxcwUBvv/5KkH3pbJDlKF8cK/mGOGpr87ATU9Sg9pcXR8mowZTUaIwET0AgW/cgLpL6SPdqX905RoRFW9uweXR+FGJcfiabHf5FcxHRdOAmmi9kS0q1Nrb5+J7rgKTcs5mCWN2XMh2tq6SN7MPnkm5MK+Um+sgvKRqp1rci5195cp1nhQKPaLVP4rzOMSVyQ+6kDtG6a3veqLJHoi+FRljGCM9p38f9R2BFWhXSBiWJyapuN8gG4Cp3SIBXLsAF3ss5Q==
-  template:
-    metadata:
-      name: invidious-app-secrets
-      namespace: default
-    type: Opaque

cluster/config/secrets/invidious-db-secrets-sealed.yml

@@ -2,15 +2,17 @@
 apiVersion: bitnami.com/v1alpha1
 kind: SealedSecret
 metadata:
+  creationTimestamp: null
   name: invidious-db-secrets
   namespace: default
 spec:
   encryptedData:
-    postgres-db: AgBclBnz+2oQ6l/i2A0ApXiAi3icIcQ2KbIT/xixH+mPLWA0R/9H86l8BmnWVBA5GnJhEeDCv0Bf0HGxitp6as8LAAvNRItEeevopRWBYO7qfgoogGsuZYW5ZaewR76HPFatswv9tNnqj88ZkX3Vm8CKrPk8VRaCXjcIM/D7+Fnu97zoiUO+3Zg99QDrd+DK2aODHVVE3/Zm8rNDC/x9qxxjqBF2iliiA/xjtMPQlo8dwEd5QbwQJeFFWsrNFJNvZiSQGkbs+QzU6MRh3hjMDoPoLzEMNbpBvKevPsyU/ASscvKWWAW4cvM/09TladhNQq8WH1u/WVXnlZeLOyUmdKL9MA61/WNWh1uwMp+X8t8WcWPcd0jKLG1FdABMaEvbiMIbxbS/lknR5Q+ka8svvvOY1UEJrxKqLjaj0DPEnKHiPElVLldK8bWaHefEuHIZMf6+4xMRIdC3oM55IP0HXRcypIwX6ij2JyjaHfvz0+zzVFqnyBMEqKcZ7ESEmntXHpRnQ7Covbz/FMAtJF5JcIFI4aQkxZEw8H0NMBweadyKaih2HEmGdmQwIrp8wwjsGGkNaE7bPnvRnjZvkXrIJDbiGv3p+2P+tefisxqzzBZBa3pWZ+Cc3snQq0ivYMm8SYifTRVwxN+AsDgZlyGHnyQhfXOF8owMfMjXdE1xEwKnDyaRNEdKVYgl7h4zASPgSD1R/ysUgBG6n8U=
+    postgres-db: AgCjZsNy3sL8jwn2ruIaZIpXxXZc3LYylVGrLWOMJjUv+LTWUUIWETdh3TYl237XorX+2ueHCJ09vW0BL+V++TebTU/xsWFFL1z4ozImuNJ3mmdU1P6wQx/U324Tc/pgxmLojEBew4MJJOjFPuMrO1rNzeM9zAvo61U1vNjBs+5SD6wH0e8qqyxyguA1Mhm90tMMIycu8zGZoA2cRk7ua9+x+OCeBxg2u02e5t8cbNleW++9yFoabg4q2l6XZR199HXWfM4qtf5LldqK63HXC8LiQY3uHkaIAKHN5kvIFDwVctxoR8Iw91H3aCOOhFjZQ9A6wwm+LuLO+8IGZk9gKlnTohKJPTAE7JoFFUnLEUYdhaYLpkhbnjQ2kppIyy60Eq5uKy/jpTekdxj+DjwyRpMYYPhaNnDCGpoY5/VCfK0P/5Wo/crcotihRJlEfGLiCBzXeV2w+IK3n99KgPX3r8g54kp1jZM3s4K6V0DzbnXCBPjEfvOfOFbmC7K5hTvvdjKWB850Zrxnl4y8zM6waCfKWSD4Fb08iER4NTGTUk37jHi6eC22qsvf4n/c/6CN6feN5mM2h/jBaOlSH05UtpwIyPBe8C0ZOWK1MK+3TjagQoTRSvVrpqzoNrJS3rreQqMlZNef+i9BtfKsDkzxHmV/mt8gzbzNZLzR50aj/KW0kDK1QF8yAiYfnlnegTdFrHkUoH2qCPBXvt0=
-    postgres-password: AgCofaOaLzmMPvwBUSP/B9nI/zC58veNRWkDluHTPv+kLX1kFwiknydeWrtiLrAW2p1azgXRb1xPMsn9lgeKyxtZZNxM7j860F6y910ATFfBoWfLELEtZORChn+LGbSYPxghEpuSexbuTpJR2k+N1ZDJ9g9Z1mNQNUuVUodkLGQleQGK/VK2ex1Q3lUHQv6tl535N5klDeWvd3S6MB/G2udu5RNQpZqrmjDxArJaA64Tddkfl+407Aad3UHwRGw/pxyAE0kOn11G63UlY5rafeFrOZSR/eGKkVDB4SFUwuKdGs4ijXCWrwMVVEQoBcUMrCAF67Timd87FTnotj9VWXj+Zry41Jeh9fXCp95H5sUH0/1Ubr8RDrufW2ltOPP8nda77z+xCN7tVHR4EQo133CPeQkxbFuqjfcDLYJ6arc9Pul3qtG5j6ySi621EgnCBtBk27tQ9mGjZfNRwMc7kjM65pCRYzZR25gssCnyMFZgJV8LFkm/adz3hZgSC+eOvonsPF44sJe64IpGUXEMKWj1xKLS1A+s+EcbXdwCLRhxLzK+Z0XrH6J21uOU10qsS0rtJBBu39SFkideqqbIgVi8zBsq6dregT/T0ykaqXh6UBLcfJPa/SZifxDAvWs6mxh6gnMip03otQNQGXvCAA4XWqZMmu2HddKWLLyzwdiBdOPqYZXGHwDjZ3e+IYuQ7LEm/6duTme3InuMeQ==
+    postgres-password: AgC4WuBhMkf/v+cBt0zxLyFbTPxvioJ8OixuAXG2o2HJl+d9yApOx5E4p4zE06SJ0GkJAC8rYTaedKxZUWNA5usagNdhlOyKTxaPvdpjZAfaIKiwweTn7ac6swiFVJ8bfez6LeFsdUgtHDaovxza/z/POQ2J8Q27VUd1xmeIJ6A7c6UqpFItLsxYxdAnl/rTDi+2wjP/Dnceg41Pw6U1Y9JgSlb/6f9LV0yCxalJth/4r9k+9AzjxxLb7MrclcdHEUEMj6BrJiU21mm0d4tSfmjHxQEb1HgHx1JnU13XFFQjuRqP81iNKdmxMWOGiT7U20ZqK6uoXzGS9BbuO7Dw+wehPLB5b/S429Qk+gdr83dt6xXnsQ5QtZzKwnXZF9G1ou0+G1QyWqy6m4LRCJ0RL3sp69GaUHkA0+tQM+w3+AxPsK6TmdVOugRuPvPKHKV+cOdi1B6pNN4zN3g8ezYcheEmsnKOa1Z+Ml+F3TKbxhtquuTlCHP6pG2TxRrK2MLzg0MaS6EMZUmrdm6qt6iXb5/BO5UILxPNwiKpiYV0p8ksloKfipoJaOhzR/wjxA+xjTRNyGx2lGFuH/fIOzHxfbNA1pcMa/GgBl+B4mjz0/OXxpe+kO6pxXqeTb6ZcsdC6AxJCstyLeXHSfnyRt5oTt03AkkLsHyiqxxdJMUyNrNFkbWYluWt85DddVBLhrdzAoCKrUltF7riOSZUgQ==
-    postgres-user: AgC0QzpLDy0/dequj5jBTYoffOO7QIWYA3PbfMJEtGYSDhE3mOTgBOmIb2mRiSVcBqHTpWJX86LULrUVwpA6Lsajvf8RCJX3jy1I1vlsW/DRnPlbHwtkWsF7Z1AqYWLs15wkc7UQWCFFx9eP9RAgiAvUFAAE25ssuCkjxsRuUsTYTfUHuv9ie3jbpchNdqjjKvDWvXOYVP1PzYu1h2kR2Q4OHLe8El6edgSJBo+1eWlciVe942Nof3sBPnXkRG2+QZKkc6/+HQJULQSVIFaw9/9OcSXteNf1Wymz8WdcZNTA0oVrG5GMDrPjhr3KtymGfrt6eHrJ1KU8H9GXhR26fetO/y6vXF3y4Cym9gynFwOMpXgBhsBgHhqZmKHTwYKGGxXtYzQxt4BXwBaokc6xVwYIywn7kfIdVK7VNIppcYdwv8sFAelLJP6PiBO/XibflTo/PrMDhvFDdQ1+f6QkSIS9KfKDKMvqk0BhSZw/EvL03Iv8xdFdLrCGre8o5F2GVWTfAHcFc2nFJCVZ4xa9UyWwxt9imqCz7nCz+ps3O5GHRPU1xc/GVVpzw32KqgF/lFgnmvdSk91UI0Rxi0ZFVxBKzYcU42g6ZIhsNwjMh3L+OcTEqDJpAGTSugemcLvNW80e1l+vA9gyB+GikwAFZB6C5FNIO5LIDK44pbTDsMvvw3orEzyQ226e1FcsYPoSNsGv6wHZTw==
+    postgres-user: AgAVmVD9AOvpUrsBPzNic8ttyJQYFkYViyl+dz06qM7zm9mR+afs1RlDE5DeTYw4NACueNQa2ITbYxaP9s74p3LL3gELLqllR187RoYN+CtoAkM4AAy/XfME612kGJQFJJ+msiADhMQvdlSG9F7S1MKg2aM8UUvV/8rMc1HsxFBzbdCkkoV1Hm7JRBcYTD4KoFobL+HhnKFkGxHXrRUuqodpokT17tKmbOkE8oj1Xu5BJ/hkNnxpd1mSAEJEQ0tKBREfgJiZr7VGvp+k0f3qlsIZsZEGBHyn8d3RVulVnclHjjzKAnwrpJpV6FznYMHcg4QOcNwq2e+xLGXKqraTpXxpZs1PMsW0LtktUKO1Fdpg7IgqaRoY64Mweh1x/oHR0pan74P8x7mGr6nKxk44Y4MGGhFCk5M28uMjl28u91XeXjVgkVQKgCmMPaQCJgq1IaYi5rmgQN1gAcL29FsDpzkUlaXRZefVNBvsXfW1k9ELQdpplXKbo2e6v0PkqFjeMXvQE9W2bia+M/FYy0+CjAtV3v5dE7XC1fG0jwLt401RzbWueW/+azIoWGefk4DoRkgpqywmPwSKLUikeYu0X7YvlOgJ6TAb1sigp19ULtoP0KcEvSyc2EfETE51f8IaiEN1l9uge7ROSudKZfZgjjRkqALEfH/9/ZeTKmCHYWKIZwKrb7m8aQKHBRzzCVQTYdpf268JCg==
   template:
     metadata:
+      creationTimestamp: null
       name: invidious-db-secrets
       namespace: default
     type: Opaque

cluster/config/secrets/invidious-secrets-sealed.yml

@@ -2,16 +2,17 @@
 apiVersion: bitnami.com/v1alpha1
 kind: SealedSecret
 metadata:
+  creationTimestamp: null
   name: invidious-secrets
   namespace: default
 spec:
   encryptedData:
-    INVIDIOUS_DB_PASSWORD: AgCDFwDZAoudbkZwCj0IX7ydkpe0MQyrNXx/FpQyckgNKkN+3km2fotUEX+evZ9C7CRYF9AJvEdUXr7bvSVnflKxlHhuhLpqlWBASDmi/+SReVbp1/r5Ndzg8b8GMrGP4ipiiFTB3d/GhklXGqGVsDeLJds2EHDBzZ03jz4yfYMNiFPqwzxNX1xyphZUuM+l27VfHlGgHBQooQyQmTCJVpUtzAZ6cdWpADgLymxgTfuMRR5HE6knG0poHuBspEHpuyYm1pgGa8BiYJ4g8NpgDX1aEDWtPkx7YUrIiLaf0jiSR1UIttmiN2prF3LBfFA8f/A1sHF/KLFc4p55E/MSD0YF6gpiv/JllgEcpEBwlJE5Xp1lk0Q4J4OWlI1vw/fadIAD1jS/RwiW4fd9gRARJ4RAgEGkJ39HPPXAHVgBgdyv+vRC/Dp7/67nYyRvVM/h0kBl/FWN0y7sF6EeKZg5xM1hpOfpoJPhJr9mDCavMkjQvO6NG5O/MrkzFg8+pFsxDpKGXX/pA/O4faLNsDe9B0M7mt/ikwbB7jy6A/9StQ32/Wv0PFkvYTVvhNyK56adOnY70CGRmRDOsHBNnqr9sDfFf6QaWi06AnKaZuZbvTIGZKGDZSkyA1ZpPjcXLnwqt8FGqZX4pS+ur/cMvujB2/vlzPJ8tQjs3Lga/1HewPUlq8XfhmzKOt5DUYq7voiGg/YmfCDLjoZuhWWfkg==
+    INVIDIOUS_COMPANION_KEY: AgCnfbrG/ji25f6RV/avt613WpOpZNlPsuTP/DU9HULXC1aMM3HzEJR3lIEfeqt9y7iHI7Z4WdD4EqYjdWeDkmLnBLkQB3V7RfPm8tNcfRmMad+Q7bm0viSSq2WhxPtVvtI1G5zoIWs4RGw7F+ee7JqDz8rCKWSHJ0XyuBJUsk3bBLXWNhWtxbaWJz/uxNQoO8ZHV+fa00kqijGcebj9IM6wq4Q7CI5n1NcQqJhJPg1ggOavAiOgcrV5z82PUXDx2tdVbXbynNJfzrTYrU4s0f08rYAT5qF3nXZFtRs4sWEEYCTXZ/E7OdOmWFTsA7af2S1DLE8pkNjzKlVQo/wBV6mvCJcQZtgtLiAKDwnYdoExp8gP9SgL89lyZEa56KtEBAbnU/YBpEQndaFDoLb3mKd1YHn5j4wJXvxinuMEHz9HCANEgDB1NvNGTy443nzzlUzbOiFmMudhBV5wzN9wQ7KNRwVSlU5OlmKO3gBw/gvCAZEKmsHMcDKvUpkKrcDvIMkEA6cCg3Wms8+Le/4EyvRr2VOu+rTXX01/rJ97bcsLGXddJuxc2xvKW6QZEWGtRiK90zkUCaY+PJH1djmjCEb8JIrdGhYy3CMrS3SEVxgPQl0rduAg+z3FtWR4GMttWA7lU1/bPtCIhM+OzgFd/Dy79DuNw4+tbjzEINJUgPpmpYL+1GbsjZ+R48B9pppM+rzKrdfxsOdSvEjTQewn0L14
-    INVIDIOUS_HMAC_KEY: AgC9/Oi2iU843ZGFIZb5y4Ickkw6jitB8djc4RTyjFqxZDGrUuv5uM5mlcqmYTsUZP+dLA/BdyTlhOFq5Rx2RGc0knBCzqY0a9P1z24ITdHsRgEO2lg6qN9Li0r6roLutBluFku1GyQIi8qiAXYbcphW59ZCy5x/OEtsamLRsajP/PX9toXokyhI4MTXpduw7w1U+ARg/N7Kt3+gCidXjNzDkuiMDoeMKVkJFTgXkN7ISn2FELzFe0023subXAk5YYKvd3R/wtLvnljWXDqTNywPz92O9pUlRutcygvCVxADSKt125IVHUfz8SkTAwHyC9y06SLsRCLS+fnaT9gTXood08d64EKfhnqWLMesMzI66Extdiv+jpsMupJtBYzsDKJpiVxrsBISLjkcoc996MrUTPadUs1VHZJYkQO2joYacT8LeUyNN5km0D2lca5TuqqWXRe4xJ2cGl7eaoBkKwT5R1U6DeVdGr59Wkw5gPm32NrM0FgXZHJSFfhgTQwSNO1+wljokuFSAX7PrcmqA0OPIvWvPXHlx7Tbh5Ak0miUOzOfDPLfTJi8sw59KWoy/nNIiWf2weAAN8RxiQqL00XhK6kJxOZ8+lkjRl18SejRJjKcTgDgqFmW+D8w3+02m8ftvAXAdgQhg678f9rl0enjWec+xbUH6LiHX57VjnLtEcq/I/ebhPjeofIZfcMJP+JMEY8wE3DvjkvBYvF3iWe4
+    INVIDIOUS_DB_PASSWORD: AgA3xb3XXIxHQVbjaZGb6xkWwrr5HSN8B/iF4Kl0EaQyivs7fYqoE3daylu/2x6D0btH/JYWK9+NeyFVNXPCy3holiteD5/9mJFqBCbtkAFxF0lKyLRjtw5BB6Wp5b/HuVJuLQG4sd+TB9XMGDeRyRkXjTRH0NbXYMlcVILAugb3vBNVCcLQqzlHbOngEMOUZxuUcMPL8crOGOmKosTKrWyt2weAFawlXkiz/cwlvdOmgMb8KWI1opEVAKv4OeUQeGRqa9+7fn0CcuM0PLzBvYPa2eoUb4dTFBzZfKpL5/mmZ9NUXEvV1dXN1oBHLHkIS8wBLhHAt8/Mh1rjhd5IGiIWIwlDT2iBuqKLRjwYbVbT7Co8OuTqs7OvxuYVYlmfOZna2o+kF39oeTH/RtYy3atHBsnW6j7GaUJ7nCZfDUZw4xYcHya5v+h2GI76SVnxKhjNpMGjHZMdDUD/cl3rBp+6gHICOYGCi+Wy4EYXCRJkZs0K84AFlLxoDkxARw6eBpFT+QEVnuMDXRrdNqC/Te9p5jzGWvPvXlfCCkQ9hi4hoNmZxw5P/nXdXg1rALiCVZbnM3O/Ud7KwgtYqNSCThPOj/BoExsQE4xSUJzAm35R0/AidOhOTVxztMba5co9Stavj772lRyV5PNbIieXDu6WNdOJNjjiRhuPzQTqbLzRbSa1I+KBDcbkmbOEBuyhXe1EoBp7anoHrKLYyw==
-    PO_TOKEN: AgA9rJB1ZERNCSa9yoPv1SU6QbLudfghCaEDGxkFLp8RMoibjrhiK7tu79jMk1ItuQo7leJxpf1XMQIFry+8u7v/BU8fDIJ0tS+ozRuLJUMKm3vTJj90wAef4l7KaU3TAQVwPwp25XGFSfZk9UFZq1y0hTVY8TyPMNMSfiSYGt66rH4chC1yG8sSs/7LlFD2vdnHvbKs01mWZa4FlS+YXcteg50EnGNtJ5GQSTC2M+/GFSUrDpa4YA6r4BG4UDvzgPrFTOnBn8XfcsqvsXRnCEsCENMy/e6Fguv8qRz8Z4KbECGkjZBHFX4zJxmc+SI/cESU8J9QD7en3jNCvn9RDL1hgSYAoBJ9eXG1YNFJghnO8oCmx+uQ84iJe9tsDDcifyi8ymZkHWhGd3RWSy/TSNRO155cW9Mrdsb7uVd22zIUYDf2Vjkygq1xX9nMkCSDVltxSGUcQ084vxObuYwAMcGedsQegKzIyq+KuKzRoKFNfS6xBpQeOaeth6+oQj0OlSNFHeuVT1CkB5rnLm3/p2Ex0iJ+W5rMg/F4oGuafUPeKbV2KLwY6UFyr3y8WsUHlkJKhFRRSd5pJpLqNg+olXYUeYcjmnkJ0lx7xHXLXNTuChgu/gjuIOG7oJHU+T45izvvS+s9EhdbSu+J9vXqid9OMJigj3yxhz6Gh4qWfSKdTaazHvPdIAVXGPMoMQdFfE2lKbtoQFCqB6VnP+QgTDcrVYeeg/AOxkSjQIn4Eso6BZtdGHKWuKKXIaVZsv50aeLExxXK/vV1tZGvTtZeIweOK0c7hq+n95jjvcNiOp8GnKFnz0U/WtLgDiYjVEALAY2fOrAdx5Hk0MXB/8xrGISx7xEIZCVo0xT8c2owHdflx9+wUKTQKG8qTtfbFs2GXbdi1VGgrAnqJCSq5xs3P3bI
+    INVIDIOUS_HMAC_KEY: AgBqsFM5UcFmJQwCPG/xl6ZZus6u/uIlJtxsQGR1p+kWcI1DOfCqLCURxku7yuEi82HizZYDSrQ1X8rLtuBVJmCvCsgWclC+3N1zpUCBhbzzPSSa/U66D7LdDpYAgfMDpkiRMXFOZBGCZtYL7I5Wgp2vxYpjsWVXdk5GXFWbR8Dw5ndUROd2+LmrtJxaWeLiEY7OKHPZ8csEwGibIvQlyBsqPON0jKG70nes1oMFmy1TgmdYpRuW5ZwBCFu1ChpL+Ital1IR8TbSW6K2nXdpku+J+WE9CT4nFQLH/NhWsRw8MWPBp2IGnAr+/iIJJYqbfUGIzMnMpvKZW6Xna/mEBJ826WoCbs1CsUAtemmsIyDzO3tANvNEOr8UWpKm7a62HN8Y3HOiduOoonrRVCS9c8jjt1M20z8JQD06fY6ymsOXEYaYkWesO2WieJtT/6qbJlkwx9RJrdMz7mlWcN5edilkF8X3TSw4YpHP7LhofliGjBYx/w2cWWCkWN1QJhbXt2CmYKxhHnAJS/S5Lmmxs3nNpF1mVOCjTIDFXmR86wG5gJEYS7PHw1ZlMUaOeU/uG0E4caGWwJfn3/Z3upZkuuu5oFy/nDodHD+V6YKHQTQ3dWdjTXJ1kW8vLRb3Roii7dxhXW0dFhdBjyX3P6+58PAkdiZzF89naVLW8x7niFrqW5fQ5M06W/PTQQKIO37bM7L/oy/9a3XQmM8dQeTt9d9g
-    VISITOR_DATA: AgA6slGkIXiIUwObx0AgxbAdp8hYVUrhiD5OWNRVxNOqdFNDWDHls47WJTg/9hTV5fG3X6tHQb7EoITda9mobKKkoH8rhe/1J5dfkBIjI8buJAq+5Zi898mPsKW7yc9rRq65nWhH55wmYK/WG9b/xaVvggjgEaFgqu8Qob+dVzDTTJN2fo1ALJQ9ZBE8tG/QgBfJNKCu9dZILIOxXHAhQsEqYqIebkjtNcJRhdIYo4HIokK0z55AU5PQ+jXsaSX3juhMUnPc8YlpBbZv+afyKPRw/vcmcleAzejCrKy572JkbvgudumHApyTvjkpNzg6U5umicmuMN7gRHiJzMGAQB+PsvGeb4G5FLRDAVC0AOMCYvTjimwREz5bSt7VhQBZJpNJDRAqZtSoOPJ42gwaT+1LKvj6IwMf5Iic/Vt1XFxGFGGxrZrJwSOMAi+9socDgjBHZtJGjIUUMKrd8T+fhds5n17Gom0xF91+xunclkttZfsG/X+jzzZMqXX/dOQsWDPxHjDbDct6legOg2Aftumg0QIizIae23kmJFtcEBQQzg5+V8eN5x5egVzBGizf1btLKkmY9ZALfafBxXXZXzbxZcLmOvIzFagSNkP25NLzgaYJnS2NY18PJEXIE7IQyFtDPSOC44XdaTttu7SEuIlLzAx76WtE4HnK+beuPZuHXZGYSyPPsGTuQ39fgzjcACH7SL6E7Zjn27bZA/KrlQoyLFZwEu6qZKeAz7ojUJcR+Zm5F2l9jljnDJyWfzHDc9Y=
   template:
     metadata:
+      creationTimestamp: null
       name: invidious-secrets
       namespace: default
     type: Opaque

cluster/config/secrets/jellystat-secret-sealed.yml

@@ -2,14 +2,16 @@
 apiVersion: bitnami.com/v1alpha1
 kind: SealedSecret
 metadata:
+  creationTimestamp: null
   name: jellystat-secret
   namespace: default
 spec:
   encryptedData:
-    jwt: AgA78JnJFWHAnNW/wskctu2KYWyrnYYOQHtNmDs6yjAjPJS7vR7SopjqJ3t/6iFNtMhIyyeZ1QE8d09n0c484q6kcx8XxemczhxJ7XrILqq+BmLDCUkyTdpCw8hQ6oyObZ9D6ckf7z8JEMyjsb1YfzjLdMXP33KBrOohFCEpsYE7oqddzW6nm5iL+bV+0s1VN7qVWHzY1aK9aipTu75GT/j7EvL4cQ/fipUdXgRu7EQwoHzJlsogEP8F9pM0p1LOTyn6PLD62qVudZ5REa8aumYwZXKs/M9NAhYuh+O2KdVchXY5ajmstznf/TghjELzmAE91aDqU9kpxiD3lQwgUPaIOlsITlvwhonFIjbwFbnmZ6iE85qSc79jOElq3dy6Am5KcfHNL1+axUq6INjAmykUXAOosEw3FYPVMZwYMLS83qepQAGtn8vCgI1ucimG7862UzKOksEt9jqKvP1ZSYfQye3KSOuWcNLNbwa8UxNYpv30VHsmah0qLpUkcX6Nax6mkCOZF+uiDD2HWbCKuMpb1rXy0i0yEuhc7l8aOZ4Ek2ZjIqxzRCPvOBwZCF+lvzYDOyKhC+oDd99vjUlDlfsGgggXExAyGwP9t8tBOm75GJ0xW6Jfe0HqqLTB1Oog2vbvLs8xgN1ZRg2HZA2RTBPr6LqUFyuXW/xGb5SIz0MGUK6HkQE0Hr+cG4glhOR88nyWeoOzmscumc8BuHFOcsJ8h4/1/70Becs=
+    jwt: AgBnBdZtTMiN+B8jRhD5s9psWATs37FeSlAbkm7RSAD7cbw+pXQNrJnb4BUaud1bW0DKSPjqwhrP4cvj46dbLQ/gdnfegR2UduFyBxw4MQBY8zpXsu74wN5rLIjZy5Zti2G45Yyj4syy0WXTzQ5g8tz+eczriZMevvHrkxtCToMM2gxr1ZlPfhEWXUDUobeSHVWxsIsiiPmeKS5L2g3EzqQEVVCy/R5qe185Q7rM9e8tye9erKg2DBHXJBdduqaVbed7rjJPxaj96kpJnSFhPI2omrXUdm+3KjgEu2vuz+0q00ZyFbwC7b5RAICuuCDzv/3shYONG+HSQaRZIZ6+ga+JDR3qKv2OmSHN24Z6ChLdbGxV+4YD+imCE1mkvURMoEt3nla/HXCOiGDGdACuuJzec3bQeA5pOpOzWhCl56JIhhDpO6mNSsRvxyo/4dMk+JqGgB923J7n23byOteAKgspHKTRdHlvtCVK83ODDKsol1P1WaWRWYt+DXp3EEf+F2zotNxlf2Zduskw2qJkp88AphgsEmJZP6TnhDoBiUS2SqGBjvHpalm9Z4T15thonNl9t1S1mBXI6Wu7L2V3eZKGtSFLRErUAxEZ0Aa/PTb1q+k5tV7zQ8U4hs0j8RZCeFouA1OZA1bhG/HvD9m/e3oTdyoD6qMCkSA6OpBjJxTsK4Y73YeudpEcpNBGisSZrWaKc4HclAglEOaDqOUxuIyVvtb53LtMwnw=
-    password: AgBdtAFwK4VixBMZB6J1unjyxv1fsKcdTbvv4QRi8WAJNPvZMCzdG2vx98JevR53JtH1+dyFrVTExtxN6ljmU7i4NHYvEcPgPU6GHrrevP89ISObmlg2peYQ/5CwRVTfyU4EzG6DKkXIoqvnWccA/+YF/jF6rnng/g0nt0NQ9Fa0oB1O3T4tCi1swcinjaf/94g7UV/z0uLhIJFT7FFEiI3B0YFstMS3J+XfV4fVWxArr6UiUHEAmZ/+OavAUb2yW3zQvB0daaU2wqpc2+wGXzNnunjanQW8PHXteJiRchot02tjSRkgWz0bgU6E6CFkL3Su6MYQuuq/pR+1/SFn5+y6bgGPXWRVaGwf+BojfFc/2/cN5NjYOSBlEDuzSCwQP4ApBKQ50y/f5vbDNLBpUmnRVWJNzDfWv7X+P/5JH/idQqN/aLHNNuepe2sEpJsQ9SY2Cx/+S4QK3V5TQy0e5ZSjd4V1CEehU8gcOrX3arrND63E3SbKaualJPVxAvwHVrxFWXwa704y3lwvfFGv7TcUhx6mzs4Rv3LY+QV/+b6cPBmKCm56i3/kJOYlyGvPS0rzQMQqjkQqUsAPQA/rqOaFETGF8piqjw6QWevjNBlHcOqbxwCRD5n2ENhYtcfqEgLUxrKovbIVmere2kk6Uv+U8PLXuepzDnt+wYW8oVjbd9W1WwtFcmiDEvzzZQVdDpX1biXg4mi+VQC/Qg==
+    password: AgB4dNM26bgykCJ/AmL44LePuOuQsZQPHJGNeQEsDJXDb0/JMbIM8sahGQc5JKlQ/QdEIBIBvwANcbxE9Sy/1kqkS3Z7N11mEi/v21vtHgSk71YNPhHBza7JIEeI1SRjSeOXCxK+rEFamxS0YLdEZ70ygR8rvJ2M+buJzd0/0Bwm2GD/ALYQqSQuuHdwLkSfrWhQj1/hKCPzFT5LAtHXVfy70he7yc0mduFiK9OEpiBha6HwXNEcbwoQHiK8LeZzHqEXNQmjifPqC868QtOtkJOA/kNUu1CBWrCKmtcmhogOZSLLC80CXqLM5lDo/+hUED3YsryqtehiDFdzePaNjeAhXXDHwadKe5NAq8oOcJ+6+kQbVGofABh2IWBzTG3l8pfZIB8Xthg9cRYtkNLP/8/fRJuMKJ1auAC7VYuJy3/Tjl+EabA13h+wHizrOnk4aZquMu+synIaz2c8HYA3rzbwXU6FGeQbxr/e2aMH99Ev1oc7s+fK0Ui6YV2tuTSYiZpql6vIGf+1mQ+s06fI9z145nnUrzjdJyvEHpWbA4VUIm9sg5kbfHz+HnFQM9z5QZ/1g3sDyEEPYKj32UY7lLpE165/6AJa47a8mN+7QJc/DHImeHXyEsvZn2P2hVrDf5nsfv4KeJ+UcPapgDkSCN1WG5bgKZeJPHUsJnr26WKl2j2zMnLGSTjuKG4HZuG1EPsNCMvzZ7Ratxp5eQ==
   template:
     metadata:
+      creationTimestamp: null
       name: jellystat-secret
       namespace: default
     type: Opaque

cluster/config/secrets/nextcloud-db-secret-sealed.yml

@@ -0,0 +1,17 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: nextcloud-db-secret
+  namespace: default
+spec:
+  encryptedData:
+    root-password: AgB8VPzOG/JG4TPolvwOl+P6ZVWLt+k3/0xQKFf6RQJVteWFDk05Ps3OyXXkhr+rB2YJ+M8ZPvVWUu/UsSg8Kh2qp7m7q+SQTlyGaHjB+PKAamRMBPjwJJCQ1UiFi8BRWJsVNqVAP3UYU5FXDGrEyn98bBOxaoSxZ85jdc/qVOXuuAm300otoP46p9IhBjE+9cxRwfFMUWLaO+nXM3Ucdnq8Cin/p0XtH9Cn+iw6GM5ag65FUjaN+uMJ8uiTX3k9OQPmxw0Wf2UzVlF4YTEHTH5wjkHI94y1QwcO6v9BwePBKBP21XqWxvEiMh6dZutIo5slL8LwSgR/JCTk6WpEyXzaaJA8SFNXG+sgU3F8fgAI+CM9CE+eSmKBGAS4oPMhkApzH6SZ5ZeNrTmf6CjkLaBmY1e5ZF5JnDoAPYCqpAzfYvUfHTnv69oza9hUvuyhnVBXGCpo4pxwCTDvNc6tNuhsz6nE7MTT52px5BjU/O5HEL+TlXtHg9Z33E4X0xiY2mZsGcKQzUmfN2E43jeJXdOpAUwrVskKu9fw2BjFpeBDnLKfJJ0495zeIqd3NlKrDQomUit8qeZR8lDrWeR4MHVa/E/5h7mgISqx8u5iFwFwTrc6g3rlomIEKmdW9kw2DLhBtWgVI76DsLPOMEQmuFhTmAqLdYNf75renPJXa6nePmdbVRPF3n8nesfjX9La/IEWKQ7octJuOC3JGA==
+    user-password: AgA7JP99Nf3b2/+DzBRt8thE0UDXsUz/ubJmnCo9Q9g5OkIdsgNaNjgfWCVaM/KvcsZkYfUY7OYRXFHc6DilxMXmgs0AI4FOtADA9R0A0Bm+Dzdn68OkAMD0NEvkzDf80D0N7Sh/97qKZBBbWgR7fmsCTgHsM41a6c9WN7XPNc6RFnW4R4arRDjx3Lc7hkQ6KAKM2yWFTryZ1KL/UfR7gGFC+c/GYbEPWerAlsKJUXZ/aWqYkjlOAxDiSZFtl5sBXlRMQYVu8agq+Ch+QaY3sCRZlvWrHTB4DZDwUrIpLSUjeKLpTjuzcC35QHPNk20xTTRzc6q1QuullkNhqkMo/fkLRa+3rDY7u1tzeRCq1IWjCjfyDOxNoJYNehgRKwc3aPjimqiKrn9zMU48JCVyFVrAu8PlyvDCuiL/vFxLIgJIO+9SpDIoGV7COh2xF8O2EHWJePAKmZsYOJ+9ZQJDiUYDYu1tK3y+IgXUU1nZ98miETkv4VSAHtXUvvx1CNXLI1bsyc89L+I73c2F/+z2nk+ZKgI/SvSKTVEkl+0MNG7Dv5i2IjrFngQuNqOwaFzR/V6vkY6Jy7bW8CVQ9xuuAM/ieVlQeULb8tTLNyotDNmijNIj4dINyqLdvFoO7xfeFn+e6SJeK4nvsYUAJxCOlpsf+uW2yc7/bEfnRoiUsJObw9KBOTls8rwGk1WBhxPWzdc1WYGwLkY+MSMlKQ==
+  template:
+    metadata:
+      creationTimestamp: null
+      name: nextcloud-db-secret
+      namespace: default
+    type: Opaque

cluster/config/secrets/nextcloud-db-secrets-sealed.yml

@@ -1,15 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: nextcloud-db-secret
-  namespace: default
-spec:
-  encryptedData:
-    root-password: AgBjZeRIUI3IoDLDwOlRIDBPJqAijkb5FiOvjgzh1YaOhOf6cifwhbrNXC9/Lu2LkP1ifZXXRHTf/ijfppJ+u/NIldjMafYkglXa77K8DaUb9dIzIEIwg4p2aN/qwoGc7IjD5F1kF1WU1MWdzkKTmFNpGEUHYG3Damj1rp2BAav30MvOzZpdvvQFJvcir6Z/vHT4g5upumUpUD6GYYwK6Jm70TfqSK+FD3WiDnIXE1zzRAS35o/0g8w24kHA/xDIJTMrJcFyUDECHGaCXa+ASw8f4vLLK0DXgawbt4Oo4h6nJVifwZwHP5mP6Jz9riyNRULJSfU6pyl1zK8WXzgT/4/H45a34IxbJ4CZkjEJ/wwiNm/Kp9jzpzml7ABsIZFQnIKqvCmi2uPqp8twHccB+urusGv4yFjjJLEReTEs/osWVhebY01MaxYZ2CWSibLFX8g/Pr/CdI8eOElRZpGEpyx6WtuTWXZ+6cl2CZyL5+w2LRggRcWCpl0+C+RLt+5f+Eqf9drAfaOKvMQq/hA13viXEPZYtdHJGfIa1yhHwERr1kjIfs9vUk1vRJE2wCWg55e44Y9wJCxh69CR6c8cspfo/hMQRL3GDDTK17dU1nyprrDw2T4SlWO+p8oFAGbO5oUgvw6Z8mSkFEBcsapM9q2WpH8wVO5dAkesdPtlzY9dGhi/hhlQqdea8nciKoOmKYchbfJzakBkQJ6iKg==
-    user-password: AgC82Uibhwyi+IHIV+ZyJvnZncooaK0ZBP9SSs+2X1vBgjgtLx8golI8Rb90MnhONljNhRypGm074kxYuj6G7TajnWoQ5XRlYyuCKhaK7a8MNOy2lvbK64GVw+BmO9+9oDkzztO1C4nwIFGWYrwisc+CLyjk6b5wxUbIcIfGBpD10r3swM39QTR5qcbPY8asdKsctpDFBDvjqBBV5Uo7L/U0LPAc1bNX9jHjyTPy+SQ0jZs46sg6yuvMJdgTL/25VkKDXKxj+rzJZ2V7m713PiTfT0gl2SVuXnuitWFq7XRe0DtVDOL9gKGUxMEuC531gAvGXDxd7DahusqI2PEHql+HpgO3Fn872hpaGzwU2mYxksloQgmFCo0zGjnP7CSp6tVkaxbiG/Mfh3WIs/0X6/nkYMakcEusMxQP4UDY3BkhZLefIfcNNIiP+13UOyJ/rszt5LE0pQw19H5WBe37nH3rbURhgex+g7DtMMtv4QnvaYuI/Ot1RuyrPEEpAvcDHrt4GA0HyHlrzgro+zv/YvacrdmmsMpUNCjEILt6xmlKElB+5HcFeihl5UCGUCC/TB7srq9tbt2Nh+n+E9wzDf+nx0BOVU7PYqMMSIpB3L2zPiH9O+lZ6mMPqMz8VFccsD85QgxyBTXU50QO07AbfZxHpUa1EQmXWOrzTo2t8neb5JdyZA3OAnz6pMUQZCL5NFP10J7VJb9C784sPA==
-  template:
-    metadata:
-      name: nextcloud-db-secret
-      namespace: default
-    type: Opaque

cluster/config/secrets/openvpn-secrets-sealed.yml

@@ -2,14 +2,16 @@
 apiVersion: bitnami.com/v1alpha1
 kind: SealedSecret
 metadata:
+  creationTimestamp: null
   name: openvpn-secrets
   namespace: default
 spec:
   encryptedData:
-    OPENVPN_PASSWORD: AgCbpbmUDQeen9o3ccxWghiu3UGzGJDbZ51rkvHn4ZkLKIUkW0tb+47vaxdL3pHdQ86EI9jtc2mAgcb44ETJbWsNUHJeFoABmTzgq91IvW2xun3YFRKB8mD8sbI3BQNICWElKXwhbIzxyqXzUQpXe09qzVKjjw3FtMQ+H9pn9+d7DKca0UMH1ZhPLy8246QhJUFEcc2Py/hUrxjL3wRybMGRkMbz5SDER+aO5Wo9b4lEx/Q/yKqenutNeC09VJDCbX4F2W898RNcWJMxRnb9RRUANQBmciLISjXzFnwMCjWgH0WoAJHg6QkirdH2zwfLGOX163RsDPLJ7ofvw+qiWcqWm6MhGeMOAImCGkVrLycm6v9HmyVR2aQsR5MTLR848Q9HDGqm4/UpyHoLfB/+hkkrO3/qkLMN3kyTGdmLVgXiqTAtw29fFoHDPn073Hf72AK6yXFliBlsAh/ReAKcQT9EQveBtcQfOodeq0nre1NaPiSGjTBrieO0S+6O+dhr4EzzOtFeNbeU16InZsnR5ZzZSroYolwZcyA98NG/u++8MJa+AvbTZxiQwpNgt//CNY6x8NzVHNLnpxp+SaKcxsKbZqgtpuGqodbwFhzQKHiwP9l+7kuRfekxJRaK2nhIh1GriXPWvJObqjjf+ORQfWOoLZQmWvcloj5ZvnFlDVTM5CBugVlDdTjMxD6F2N0Fo+EhDFtaMG/MQJnsCeCemBFNwJszhZdToEk=
+    OPENVPN_PASSWORD: AgB3+toB4VftD143lciuA8IeF2bd38Ufow9KzIqQPVaA3QnwWFDHdcRekGT58CGSmDPGqydGFamvFytSku6Tm1Be+aV6EJtDq6h46eCOHTNsl5lnZyvIjrSqZcRQH8jMeLmsuytbR9t2/wCxJh+fvPELESosfnRLSQfJeecBJozs8xdrnYcM3rtYxzJFIVA0eRLdaORS+y/drTyky0e0Qmb1x8XkyrmjKKwqksx97L7iPoRvmXtBnMQwDVFn0Cb97dN03p8+6VW456S3IPijgzhIocrtxuuFUKrdhp7r6yPmXDEqH6OK8+Hl4fore+Cf3C+g3H7oguZmu2JkmMjko38ifKfTOqcd3a/OhS+hR45JQp0WUCps2Fnea+Wnd/C9DyBsPDvkzaWJRe9RDdl/IYL67HdfXxR2i+XZPtO9OkVC1m75v3Ciw+ZExdYGDlivyulF5Mdb46sqmFXnKDpp+ozf9gx8jLg+SehMA2jq6Vcn7kMfdAqo0chbortaswIoSPnpT9kTvHx0MUvv7i61mh41OaWiR5TzZekvaj3w1aHRLMLhmva/tGYNHd78ibDP13NUSARAvUkpwKWIbSHu0ntKOsWmFBIWgz3jnvYmOFfUCILDZ+Ke7Qv8aZ27npuuly/soxcVVQRdpMFk36V4+M74iblM8/WKxLr9THL5zUul2kvDdFG+J3V9ZAmKNy1xsZIkCn2eLN70eAY5G+awnM98UAi0SQPnMXY=
-    OPENVPN_USER: AgA5+F+6xHGM/WhjBNj/BZb0Tpx3Fl/bwicTtmfSchGjbz3L1mHoijJSSLReU2uo7sjfvS+HjR0D1CbAvtWLZ2PILFMHvodiZHyOlV7sqvIxXssTGxNJMeK3guon9KcN7ZG+5PAiqPSD68jCiwdBOQq4kxRhENqpcAlIrYYtFXUyFD05YYec3b5QBHhwvAzmHDnAVFT+xls0gNI/lD08wKTPbitIy1Sc2y8HADGDYPffldoluEqqlEfQc/2uEV5t7EY9MwIgO28vH3+JVf0IKe8q7zEYwOWR5jp5Cj/D80ieA87gUkQ/tKDFUkcq8U3u5Uhr2b0YX1ucdHeH2FzYluEwU2i5LJHLV66YrQGC4JzHabnmBfyctjLalVj4387rMwnuV9ttUb4wugAt94g60+tXrCs6CPmHc9DGZm1rQ6LD9JOUxCgfH9htuJOBJlfoGoYzScJcOcAWbrJTEPks9f78pYfZNvydrkChtMlYIrLEayJcYRku55rEwcxbTEfKd1TCZnbyd46zNNI9LlcFw2UoXTa+orSI9n2AxIHh8lU2HWZJPoYuZdZtLRovtx+XwXd51V7SxB2yfnA1VrM6vbR0s92mvfB8xWSc/ETVe5ne72ZCtsXrFhifOZobJdj3Du3y4OuACxje3SdCB8+MsaJBGxVR8PZvt7degTcTRdpHj4sp7zKOTyspS+X7weS4FgcXFOd+kEYdlgCMOM6u9s3osN3KJDP+Vg0=
+    OPENVPN_USER: AgCoczTvW89qV1innW6b3tonmQDQD8PpWz9lnV5s5aCYplxOpthsNJDWxM6vwnSPsiTe+yYxJyWdeU7Cm7rnOfWzVluodkCVI9a9aDwxm8s7F1opUWJfeuJS3sj9/tO95g5zLm5bNZPKkb3ZHIFEhg2DLtN3SZ7C6voTGmiTesaY4rYMi1FNbEMoTJ3uWfF6DT8Pu2IZfpoRKrSAbZ181lmg/BtpQNVLWCVciCmrLhmMZPSIcvruFN4Jzw9lNrOgPSdbAcLBePgDCmgMKrHAGgwIRFLKkLgC3351h+JWL1TkvgtN6rHUQJrEVvjBsa92UekbImxXygNWr91aIjgUkPR+dhxn98gRaTPGcNdCMWOp5ctZmK51aQqryJyT1CIMEtZ49tM+0g28yxL+McRVR4Tw7yPqEmdjBexg1QufMcQIdGCQ/Zymu829ZtlRBjkGgKFDdCd2Q89PhkVQuIoLt32OV6LnW9QMphHoy+7go9umk72eU7MqiwI+086GTqb1FcuWsoEognCyb+KaDJSVPSauLVNZ6UJCCF/p4oHaYPP7y8sxPgbfzaP7YIIqaMvjevva9wkFKSHashE2QloOXgTV/9gyoHSQJiteCgbkylNN3cGhofiv2+qZjxCFda/ROzB1c159aKLJlcfbLlYXi3xGpY75WIbAb322gDWEX7w0w0NUr/ijpY6lhWxetwqgBIYLaCLYZNOrHzdkL3wLU0Dsfh/ENVtI0wE=
   template:
     metadata:
+      creationTimestamp: null
       name: openvpn-secrets
       namespace: default
     type: Opaque

cluster/config/secrets/pihole-secrets-sealed.yml

@@ -0,0 +1,15 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: pihole-secrets
+  namespace: default
+spec:
+  encryptedData:
+    api_password: AgBgf97R5491tvpuCK7ZgJ5Qxg697XiuSs2jKM3FMVOStcSXDJv/+0QjJdZbmZ+jww0TeGDiZ2mPOkPsEKBETDDtR4X1zCPKIzxzOY9Gs3cX2N92NWeFQFwNN7LBF5b1CIb1Sh7OAmOtJUMv3woMbH06myfQlMuLhIxoHaRzicUJBven/DLJaYGXXHNMx5uLQv7VoPL0GyQtmo1Bf1yefGCzip+XZQ0zr+NB3pxDSYJDN/lq/VbBSZo/2I3G+RneGbA7W/JrliL/y7kgzjOFvTyxrH8e+d8BE0j5Kqzb92vRJnyOVaznzjI7pOpEO0txBEq93z5kbv7XYTXF0DKb7wjE7WDV1AUukRAhFSw1iqURL4Bew5Ni9imdHre56XfDiT6tlAee8uX7/WJ7mpWfE9YPLLhcV0IxvXanG6NAQdBJpkz6D/qSFjQg0RK5w3m8iqKUwba2enUwD2VZdbImTkAkDNRiVOuY36JJEza49pRU+aH9TC0kLk1w6Uv6DL400sUhRAHX7g+swHTPLy/KMe5lHSwmpQNRjUO7tkNTzf7JjFhKkCD/+NOIwTgY/x4PFMIctkBPkqOwiWgcy2aQ57vCSLxvY9nQkaFRsvOaIwVixfWsFqB12DH5mH+tYU7YzCgUo3ubv7RqDk4Z2WzMzowgkUeVHiCnxeJOuEKxudRXirDORkpGdbYZ5tT8WBTOMWo08u5XGv1MS8pxag==
+  template:
+    metadata:
+      name: pihole-secrets
+      namespace: default
+    type: Opaque

cluster/config/secrets/semaphore-secrets-sealed.yml

@@ -2,15 +2,17 @@
 apiVersion: bitnami.com/v1alpha1
 kind: SealedSecret
 metadata:
+  creationTimestamp: null
   name: semaphore-secrets
   namespace: default
 spec:
   encryptedData:
-    admin_password: AgCYzZ02zzd1LkQAB9Y8TP4zW4ieuViXz0uPjQmpyyl3wLHJDyvPmi01vP9PNgRQovAIuIIxLn1UchgIyGxFaov68kN+FOmVjBZkNCK/Klf8Ou0lx/rLVYG9jwRQMdJLYF+wl9KP/NiSVFgn4jFgEiXTTtIj2WAyRcC8PMwNlcbW60zrRyqiSE8b+erVEyljl0oix+FGX6aG5MgQHwBfAJfYoRCyTyn9c2G8TE5CfsuBQiI+cvdVvITJZvAwreTV0eIYauRv2cITnDRgA3XbTgneGinuGxbLCsrRzC83vvODgR83Rq+Pv1236bLuA+mHcU6BA4/uegTpdfu5ll8lIoIPphL3ZbXdAlYbdafa3oj28sMX3qjeiml9qpvuPmv1MSn0SCAqXK0eq3JNWXVa5RS4w1MrnlPv1KfATDLO/Z3KqGL6hC3LiFiQRsexuRg7ZrLBqdoghhkn8lG6K2BDFA255sqV+YA1rphplg38roXo+cO07/m8OMhAMz/38DeT5BHW2+UQ2EC5UoXeKH4leTNa8Stp6SzCw3IGdTd89oY40MH3EQobps7s4rjNYnl/hxsUNWuIVdvV7LFGI4IeRt8Su0o5Kuqt/XWc17NcUCmvB2GqQIspZ/h5a4/yHLcSCDuKtY3dP8NsxHYKqrsVQHOEbQjofQNWs07ZHe0ykdqRBuOWhakB7dSGDhcI1eaTKepiQQanfLep3kmnzQ==
+    admin_password: AgDVp8qb6XEzroNXNJRlTx+/St7XHx52s6VOaw0w41nBhLP7tpuj4mEwZU+RMu08rkV2QSuX/UWHZq5mJeOwIxKk/OxJvA4lh1LMlwrpvd4fsLl40vDJ5gGFQd2cFQonjgLIQOisjzvzG2zZnh1RevjE74zo5+u+aOTIzJv641lXNnyUB7e7o+Qb7P9HDxzYHB0bydg8xSeCtAepztWFMI2UADoOarsNmE/l5Ec+QQ6S8S8Urv3ivNbGqJa5+v2twyHFLXK2fCHMYiVOciHSiy84SETnzxMDJ6EYz5F0gb9dl1W7ly+NRDTFrbFiDggedP6mjZfdG/u4MEnlqH6MOgNy0xBOU2TjXYeqHiuT9H7rxwHEJFRXvWMEwcHtxQ9SKsj583xqUZsqPwOGzAxyG7gv+wd0txBLdEGL9yPoj9bN/McqasZ7YScGLKh8HII9y7/9omS1HWczOQqDQMnt7JiZk3ZN0OEAbH4YMXgrbfmczigCqhG5UUZc5YyucuACyqygsSOeK+MaR/d52NNJ3N2N/5m/xMo1toStzv39qFT5jqW6uHNjuDVe3i8U/zbZPz0u3KOA2B7ehZjTyoTBZzduxFIi05Z9opOIdt9gYfvdLompzrZfJXwSArpW0/bDe0Q9YSdbedVGOb+wnE+yl+rS5g/wCYcxKlh2zUCd+ByjRHVuhYJx7HW1AX2hPyB0nZspCDUbdrYwpgClkw==
-    key: AgAiJccVNRWboqVNICO3vvjePfW8ATfIRa1GamDJL8yUN1OE9/tTFgPxQUYSbKfU/3ttR+lhjuxeIQP7wt+YKFeNjnua6rVHo3w8uGHJO/hRSyaZ5MqjmIMJfTWddzEBWgfacatnnLCPR6EYsgPMEhjQqZvBTIjz4I0jXzYLQEdBn56r3e6XPFfqa3MMZ6+hvM6Zw2gkqKvVU59fyz+eonobtl7RoTdcVlroSW05b4QTRCtcvIzUchw5aCOvbH9BuRYhdqunhwwLmyDMMjUZDODrySULBU2fiTcP/LVjlBwXQrAd3CGexyzAPFJrJ9Uus0fhZYu1AE6wdxPplcIE5UDveLhfFZ6EjZThacTs3yKkL5RthJU2wsWxKq8fFFaGRlvXrGn+hMdsDRjbnQB7RhZTM78k6eXys1cV7YFAOniTk8Vp0di132DnltlS6nzeodIGHiksI9CKTxXos068bfd8CjDw9QK0QUnt75LHdlBKvirFuK3Qp+KwRdqnW+MoJrrPDxqqb73iMi+y5I6koDYOhBO2bflS8YnjZTxZAVe+Y5mltF7b5yaIKCPh5BGQIBVgQdbkjLYX83YobOkEbw4VEDMzhTDVgaBtu0ODL1nebpYqSAxAYSi+MizZcSOWTsC/n8FXv5ZdOlg18dzJKdaBNebkvzLdBtX6sLJ7xI8g9cy9F0TgOdjkJYiPCspMwWIWgZwvTHkYH0qhlmZcivqXZ8Ncfd+dEUo=
+    key: AgC6lfpr1WYX9alKkUEHk1tdOvulbwNYMt/xya/KgrGQQAOg6BDVvWEPGgsiFy0iRhfCeEQ9U6gftJSUM4Bwf7T4HyO5gPiOQ06oXPXzzf55RvNFhGGoseuwKtqV3wBD5CAgv+hIfHyJercWpXrW0/wma5+EZUv2kfs1n+AEb/rTdvO2IWzkBdtsv7GKXEulQUCcTmtQV5QsNg8kP6euayyZM6xzfq1L/c/L1jiPrgcfOmwA0hnSxR2nqwGa4IHyk0TzvGlTi5pIY1qFKsBh+CXAka9Ib0QNbfc+9vtUT1grD2yRaDoJMKfl/TcG1I+jrc6OJmnOyFwvITtOqFFOBdYGq4D8/YIjkIPtVVZ/7YhwDSRwuxjWA3EMfnpcvI/wxhUMPe9kGq2NfU+sgTTaotnI7KoGVkpSKgWJb61jdXsTZ1n0N8tgIPsN3iFrXuIGvcRfHngR5LXO5D89f6FR7SY2iXgyv2P0EI3c+TTdEuj+180AGR5Bz7SMYCgbBqKKfxvPTi+AyUdOz6gqjzbGQF1m8WD5bSXsa9acAS4tKMifU68tNOwu+iqdSLumZO4321SXniM/aLoG16mrtTR17cnis3zRzmy+djosEy2V9Vjeciy+jIEfq+y7DPAT63Ya6tAf5+sYhM7TiXG6chW12JCYeUXvbR/CCtL03eLlxnE73PMhIdz9r0MNBpVWAgfQafKfgmk8KS6h4rRw4J2zvUOibJCN1n+boUM=
-    mysql_password: AgAq5LskjbEtTo45devuQ/XCXnFgaKOKt5QKJ3AdSxLMWWgaKP8YpcM+9Pf5CPDg3UZX8rLRd2xFbz11q3hHfdUYBEZAyi/ul5BsSaqYT1b84S4oNTpzLLg0xRpggwAGb6HE/2YcziusqlOS412ovLoh03M739OOKXd1dKRfmJxZi7WMyl3En7M5mCFwuTqhtCf4hDxIIwxFhtQI00YRxvrTaD5D9hajvd6dKJ/LYsjeun3kBU8F1zAHZjjl3vi7FG8ouWi/HxcDKsw1Sd39RfZqsA4MXqJ+8PRJub967GQYzV8e2tA81CFLKxUQCWXQpV+MkKfFDYCgOLtHZBgvD2I2ZTVtHTLnveCDe2URnpEZgTT2OCxsfOgNZz+Rp4sQE/3lkaF3fWxRwY/pF0vk9t8xXtraS3e5qMHXkE1MODWn4e+wrFRykrcw3mZax6my7fx5ttR9ZKiWXJSn193c1sAq2W48gfEA4Mf7ZPIgRm2anlndhW/gSqn2B9380475i2g9YQew8BZonMAGfVjLS+LEN4lf83gklNrjnJYaXgWneu4P/cbvm1B5oaXIlv9/uAlLi6O6aI7ODTMkIgfEKyjjuSeOdXx7uVxaLRPniDEOpr6NA6JPFs0FMYh6mwCPMNnkhmdFAp1npSC7jwUjRRIPnEMkA0C819FchMhy5aGUgx/qsuwqUz42yL1/WPeHZIbWJt0ykfcl1YXMTA==
+    mysql_password: AgBqYZ+TMgmIHrt+J5j0yP/yvsyx91NwHWnlGRXj+RLmbbGl5U18mvt2KzZ7FzYVvOIpv53T5oZUNCUXIE92kIFGqBczPrMNquZ64881oNdpnT3EghjfnAkXq2NvKnU40uLC2R0NdUOt81lk7oYS/1OoHKjTvlg3x7Fm20V9J+f946kUaytcixNDRALjrpCd2s8Zw1YaoEjTrW9FqLll1W0xVTghYi+pF1nqRovJGMjxPAELv8vlrZ0pWWM9zbKScFA9Hc/W8EEk5R2VJ4RghEJ6I5/2WhHuQ6c64uB67Uf98L+TNWPweOj2mjNl6DS4hT3NjqRKYn58stJ2T6BoTPmj83FAbpLn5pzca+U5ga1IcxDkFC5wuRsrAAIKFpSciIZHHh6dNkKp4eend7td6clJ0sFXuC1AsTpyztUMxt/274zzw+0x9c86JKnHrcRW9c87DajdxE1tQvrsY5OEuyQ2BUK9DGOwzL3pEp6EQ+nP41l+s293LdiRweQeBjgKF7vxW9iegjm/uOkHO+Nq71Z5QXZrp+eGE+7+1/QOwx7xOC5KnAAkd3n6GiGVm3XIjCRnRe0ISQcsTNgCSaLHvqXbPmvigxo5G0xb2vtKhrSwag8p4y4fcOowluL13mwaoNR1uHruWzEDWtnYFar7ijCNd3qG4RNFZ1475CdYNHGBSOtGlVLMV31YelqtsMl2YyH5ypE8TyGxsP5u5Q==
   template:
     metadata:
+      creationTimestamp: null
       name: semaphore-secrets
       namespace: default
     type: Opaque

cluster/config/secrets/smb-creds-sealed.yml

@@ -2,14 +2,16 @@
 apiVersion: bitnami.com/v1alpha1
 kind: SealedSecret
 metadata:
+  creationTimestamp: null
   name: smb-creds
   namespace: default
 spec:
   encryptedData:
-    password: AgCUYc8alwHu5AK6uf6A2HsTNidUoxsHQeYWNZxMcScEGToZpceGNrCLaip7f1hOX9S+zY0QBsxlI7PG2wB4Av0DTiEeK+Np3GsfaeiCr53SIwsb5ctXtOQKIU48Qpz6KnH3O9EfKjxaKUJfToWvVfeJMT+eb3iJZ5TF6QmPcSgtnW2Tmocp2qpciZicg7intuJ2ab3/Vp4vifTttJQDi2sXgSWcFDcGQif+ACN62N7YFTn/SwE6WRjQs/V4xZzrn47JeDXPpdYhJa8sdEf5w4pua7NY8F4zink/60vzrwOz1auaCk6oQP4Q4BnYgAGK+734JmFVeASmecMX24uZkhWKDCu4cLR5yPdT2G5644Vwhgr2tRI9566IPTbFSmbpcEMIWSh8T6VC7RP7aT/EEaGMkKiqcdise1lxnRD28bVMqwA5FzmoKovN1FGFXsx/FMv1CRrNwO3DPR42/H5ZjFFCBIVFg3BbX1aUPvE/Fuhn8DRkKXC/nw9QIhXaRKFm6Xevz3TcxuMnQiLwvBmlFxe/qoFp0x+ztAXgm2f7Uos/tV4pfyhYycIOo7/suZG4yUZEd+adEltBDSUqG8JnFKoozs7U3bTbQo4oAukggZwdmWNi14BW9Lm8CLFyW2LSaZAm7Ev8mTtFefOgNnbx14uVsKZIWUm4gsmYaEWZkYA42YfkDCI5YzewPWbB0VKMYhLtxMPkpik=
+    password: AgCrruv8t3cE1ZATGxtmVd3MfIYNxyMBEZ043CIPThINoqV7HqEb3oBnagF2H/+9PYwVZFKFOvGcCjc9xH1l7xwxbuINyYMVuoDj70nBaFM8nykwOBwDLhp9spkM/M6Czni9VzHFGaSI7hgEGlVQ2QG3FnAxu9H6qQejytL8SCGBGznZ+M+iIfOvTSdN0IdEsvKMtHJUEDmkcEvahs5ME3QR+jk9BfVWbFUZu9qtQLPOOKl/UCEOssj2nDO6UJ7MhBP2KJxfX6zCxmw7v0vCtdk/KZ5OQgjEBz1DJtMnANdsFCPVAg76PTzjeZx3luDsDl3tIsS05bEdS82WdbXuvlgrr1mpj4c5Q3wLVQSCDwCAPitj3UstK7tezI/u/B22os4XxEgRfdPRb7djmPN53jHrxB5D+NuEaWhlNNOWWHL3lwMAS1Os9dRGm0L9bh/w+w6VQJa2MPY7GxeTzdqi5zCkqlukpl10XD1IDmHZOryW9xIyg5rv6vMmgTMiKP7/dHQRnXt0eXNIss3V1OSINe8krTDzGcYFbzeqonETCrCF60aPEfsrA6gPkxAKdTks69j7k2BitSTja3iGqAVV75jXQAJlRU3lGHh4j6us4qOxY/+PqA7M1nInfWJms8ixo42VmSrsozEt3zncTUH0H/UCffQs6qSc6iWiUqcXWccFgCav3TEAPcEacJzHfR3q3PZhi3vnzcg=
-    username: AgBIKiSZTK6+d/5iIniErgNiCSNcG7AkrtEP5IaVrue57NAKsrwv+0tED1JgsYypV0vPEI5cy8DVF590cS8rfGfQ6dROJGefNtUU6Lpm5qaxTksmpVxyO/xL6+ZSxr0k2c0ja4dVt8sO08XUZbVfDOXa+VYb+Cv7jJ3dEVazu7SvUsGBHQcXiSUVT04opip4kcWqnIGMRHT6KqqFDRoNYW6Y1fyRCaAF7AS9pbSplcXrQ+Xppy2i9QLj6S+KOnmELwsKEd5pBF0XirUyl/I5ZQUrgU6lWLwPKouwhuhais2S2tbuLwvgpVj7TL8ym9UGMY09dMFKlJghvSJH6ZTH6thKYyb/BqVTrWDV/kdfHhpzRFko1Z18mY84f/oQFkM0vwInFUppLfmuWHLHe9YlIQsJyuZ5Y9e9Hx+VNdI2zk+UOJRqeLEBIU75ynv692X5Rq/2WCSjcybtDdLNdcqdnkDWJpSxnngGo2wZIKFg1yuWVt835TzbtZ5yXf0A9M6vJUJxyP676Ej2YPvcmVr+LY0YJ5cHXZdp4ci2IyUnj3gUOR4REDrDRInDI6SPsJUvAaiAkLc1Una1MOk6Wf0K+rwwo8Cen33JcCJ6AOAhgBM71uDR+LT8oFiDsf9zbpit0aJ95F9ysY1Ja46CRRo3hBvHKfDWDrI4loIwI8Jp+ZS40PebQ4eCKEGvKTLrw0YSc12cMmvecOk=
+    username: AgCYiy+T8lZFYZvobTtHBHtXRleBPG1zkwL4dLpjP5BITJ8WfnF7ksqS0KYyznW6iZvNZi7FHLeiM4eNoSTbdg7Zaf/6zsEfa3YN0lawetpgPlKK+wKwWrbLcvy1HHMOPP6X0kTokQ8uEUW5BhkSB/cOkH9Wx2CEEym+ozFYO6wXtLVR5+voPUoPuLRtGVG7IKhqKFvIOz+UT5n6QizZyn/rgcOaObgXeSUmY3PcSUhEmklNwfgFbxXYjHqDQk9XBXkJBPjGftWek56Apt9AtFllDUTky2WkIu6Ar9O+e0pzLsXjknVaB3gse8tLwtqE+JLS+XwDDKXThCaODbdjJrcuhCXiqR0poKznkJfi3CiNsgXoIHQXhaN6GG9rWEXMHZhBpHzcYsyFcXu8sLeeUjC8904PEG9rdZo5YOv4513MEmeOQqovh+zWlDTQEf/P47sXOgLorQAGP8d2ST6kZR0Hcky/I9g91nirABeqmmjeevT8EKV3YDKpMbvSsLnLVkBsYOj1q2YwH757u4tQOJ+3rIOyYbS0PWPu6omhDNYs9ozo6afYb1qQ0CXmOvkKm01NqbblJD4ewlX48Bwwy3xTCni+Gt/mhb3YCujbMz8kUd1fi05iYk7mehjx2jH6cE8E9Ui9Dg+mDdDE9tvE5rdKaMJt217k9DqRBOpC5M1TGUYvHN+jTSkV6FbokWa3p03d9DmD198=
   template:
     metadata:
+      creationTimestamp: null
       name: smb-creds
       namespace: default
     type: Opaque

cluster/config/secrets/speedtest-secret-sealed.yml

@@ -2,13 +2,15 @@
 apiVersion: bitnami.com/v1alpha1
 kind: SealedSecret
 metadata:
+  creationTimestamp: null
   name: speedtest-secret
   namespace: default
 spec:
   encryptedData:
-    app_key: AgDQUlAC4Cpls2+I+6xJdibR4VJId2zWhODXgK95FmTri4uLSlTynxjKAMDnUqfKdqo1QpNtgG5dbwCTJOi3o30MSr1FwM185YLC7lstAjqPpdv0+fliX3+epu1xR9+ijMPh7Jf2EcdJCijxml+Lku9GsonHriELVfkbFPxXx/HHGT5mBQTutPYp6ZnySfUOra0oraP8spcQDRBompziMKsqILZcHxYh9xD+hWKVE8eSMun8AIBUUnkBDdWyrorrk7wtvinWnjBtMRfipl8IR1LMskzlGXO2OmzvwTDwkTxMRMPmA6pK4FJE7hJIZoBbH7twF2TaSi8vbm0r1Z0SlBCxfHTiNBlTDRa834RXTfWQKAIvAeFr0zzpGszLXZG3hLWpI41Hnekeki/0feUqVkn+APUtr0MhB6HA2sc9EYcoNmmnWT2bUrdkWHsfDqIBsmeSaI1+F1g64Fi3NVemDkeduQYKgg5qmGEYHzPUr5ziQEFXDMfxxNTsjREdS59C/F0Fpf4OAiQ8P02Smim179dBd+EViuw1iKx9ViAxo9Ax/osq5gf5NSvKI6eJ/vKowUZrSWLrItQ1FAv+hGY35usqZuehZbu23E0ctu/u0+2GlpzwfPrYmpqdb3degya7LAAAyVbwf3SpYDqpyhpxrwZ6swn7fHuntitZz5q50KUBnSAZlc1N9EnhhiVF6q7smNDFyptGLp4bEFn6FhWGCEwUU9Kceel3/Be7eZuoLeCJJVsN9uK3KyFdIzjt6Jc/LWPVFwg=
+    app_key: AgC/5rEj+sdgvkUxbm+lc2xpyQrKAkBmDEegSJlU/A1oYi5tAQxkLp+TwnX7XvMTZYOEDd3TLoDw+UakAkcoPC9RxKpX/9nC7I2eScoroh8+/7LoEEMAp/SE+c3aXw90VK0zVff9K5CbWUYYQvzBMNagmZpVF//xoyyeowL4voy5wA6plwGsZ9zZ3fUebDop15HzfJh5ZP4Kd0f1LJ0SvhwOPheuTmPe4Lq4DRYGpAq7XcNmGiDZJpjgUGD470HJfUGd8nke98fKHgvwWmYXjc+n0bGkrJU3Xbd7wQfka2YoJSQH74WtUQrlLt3Dk1mfDqled4qmzyynnbNNb2bfEn+VMexIT8slmZzxY2rJvutiMo/281JjUhxxQlYOceOAmUrwCCTGOLOPPs525ROlp0ODIofQQjVDMw+6gzfA8QrrOmHj2qbIl0vIYoRb9UUy3y6u0qXxMxHNBflZPoOS4JkhB70UcqryBI8co1X+UsMNO0rbhx2CAhc0EaP9s/Wm1LtQK3U4DHEDroSqpIrHgv0lVLPtMotwxLglCaKcfQjI+FnlmJEHPO7og4msJbnJn4orqATaFSv56+xnb1lxjtacyEFYb+MzU1juwa4ypoYutD5SpUModYXooQBhjwIOvvVU89qWw9bl1SX1py1vXjktNMBdB1LU051NmubLJjtZJ7qI+1eJWzbastljBrH0ayg6wevdCpvO7Rtx5W86LysPJMjd5ttxZChCuORc+/hytWwWAriTE7khreDSpbmM+eiHZug=
   template:
     metadata:
+      creationTimestamp: null
       name: speedtest-secret
       namespace: default
     type: Opaque

cluster/flux-system/gotk-sync.yaml

@@ -0,0 +1,27 @@
+# This manifest was generated by flux. DO NOT EDIT.
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: flux-system
+  namespace: flux-system
+spec:
+  interval: 1m0s
+  ref:
+    branch: main
+  secretRef:
+    name: flux-system
+  url: ssh://git@gitea.akshun-lab.cc:222/aggarwalakshun/public-k3s.git
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: flux-system
+  namespace: flux-system
+spec:
+  interval: 10m0s
+  path: ./cluster
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system

cluster/flux-system/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+- gotk-components.yaml
+- gotk-sync.yaml

cluster/helm/cert-manager/cert-manager-release.yml

@@ -0,0 +1,27 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  interval: 24h
+  chart:
+    spec:
+      chart: cert-manager
+      version: "v1.19.0"
+      sourceRef:
+        kind: HelmRepository
+        name: jetstack
+        namespace: flux-system
+      interval: 24h
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    crds:
+      enabled: true
+      keep: true