Update .gitea/workflows/renovate.yml

Reviewed-on: #375

.gitea/workflows/renovate.yml

@@ -1,22 +1,25 @@
-name: Renovate
+name: renovate
 
 on:
   schedule:
-    - cron: '@daily'
+    - cron: "@daily"
   workflow_dispatch:
 
 jobs:
   renovate:
     runs-on: ubuntu-latest
+    container:
+      image: renovate/renovate:41.97.7
+      options: |-
+        --network=bridge
+
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
 
       - name: Run Renovate
-        uses: docker://renovate/renovate:41.34.1
         env:
-          LOG_LEVEL: info
           RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
           GITHUB_COM_TOKEN: ${{ secrets.PAT_TOKEN }}
-        with:
-          args: ''
+        run: |
+          renovate

cluster/apps/authelia/authelia-pvc.yml

@@ -1,34 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: authelia-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 100Mi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/authelia
-    server: 10.0.0.123
-
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: authelia-pvc
-  namespace: default
-spec:
-  accessModes:
-    - ReadWriteMany
-  storageClassName: ""
-  volumeName: authelia-pv
-  resources:
-    requests:
-      storage: 100Mi

cluster/apps/bazarr/bazarr-pvc.yml

@@ -1,34 +1,14 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: bazarr-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 1Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/bazarr
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: bazarr-pvc
+  name: bazarr-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
-  volumeName: bazarr-pv
-  storageClassName: ""
+    - ReadWriteOnce
+  volumeMode: Filesystem
   resources:
     requests:
-      storage: 1Gi
+      storage: 5Gi
+  storageClassName: longhorn

cluster/apps/bazarr/bazarr.yml

@@ -5,6 +5,8 @@ metadata:
   name: bazarr
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -16,7 +18,7 @@ spec:
     spec:
       containers:
       - name: bazarr
-        image: linuxserver/bazarr:1.5.2
+        image: linuxserver/bazarr:1.5.3
         ports:
         - containerPort: 6767
         env:
@@ -36,7 +38,7 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: bazarr-pvc
+          claimName: bazarr-longhorn
       - name: tv
         nfs:
           server: 10.0.0.123

cluster/apps/code-server/code-server-pvc.yml

@@ -1,34 +1,14 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: code-server-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 1Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/code-server
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: code-server-pvc
+  name: code-server-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
-  storageClassName: ""
-  volumeName: code-server-pv
+    - ReadWriteOnce
+  volumeMode: Filesystem
   resources:
     requests:
       storage: 1Gi
+  storageClassName: longhorn

cluster/apps/code-server/code-server-svc.yml

@@ -9,6 +9,6 @@ spec:
     app: code-server
   type: LoadBalancer
   ports:
-  - port: 8443
+  - port: 8448
     targetPort: 8443
     protocol: TCP

cluster/apps/code-server/code-server.yml

@@ -5,6 +5,8 @@ metadata:
   name: code-server
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -16,7 +18,7 @@ spec:
     spec:
       containers:
       - name: code-server
-        image: lscr.io/linuxserver/code-server:4.101.2
+        image: lscr.io/linuxserver/code-server:4.104.3
         ports:
         - containerPort: 8443
         env:
@@ -44,4 +46,4 @@ spec:
       volumes:
       - name: code-server
         persistentVolumeClaim:
-          claimName: code-server-pvc
+          claimName: code-server-longhorn

cluster/apps/drone/drone-pvc.yml

@@ -1,34 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: drone-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 1Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/drone
-    server: 10.0.0.123
-
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: drone-pvc
-  namespace: default
-spec:
-  accessModes:
-    - ReadWriteMany
-  storageClassName: ""
-  volumeName: drone-pv
-  resources:
-    requests:
-      storage: 1Gi

cluster/apps/drone/drone.yml

@@ -1,77 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: drone
-  labels:
-    app.kubernetes.io/name: drone
-  namespace: default
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: drone
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: drone
-    spec:
-      initContainers:
-        - name: wait-for-gitea
-          image: busybox
-          command:
-          - sh
-          - -c
-          - |
-            while ! nc -z gitea-int-service 3000; do
-              echo "Waiting for Gitea to be ready..."
-              sleep 5
-            done
-            echo "Gitea is ready!"
-        - name: drone-server
-          image: drone/drone:2
-          restartPolicy: Always
-          env:
-          - name: DRONE_USER_CREATE
-            value: "DRONE_USER_CREATE=username:akshun,admin:true"
-          - name: DRONE_GITEA_SERVER
-            value: "https://gitea.akshun-lab.uk"
-          - name: DRONE_GITEA_CLIENT_ID
-            valueFrom:
-              secretKeyRef:
-                name: drone-gitea-secrets
-                key: client_id
-          - name: DRONE_GITEA_CLIENT_SECRET
-            valueFrom:
-              secretKeyRef:
-                name: drone-gitea-secrets
-                key: client_secret
-          - name: DRONE_RPC_SECRET
-            valueFrom:
-              secretKeyRef:
-                name: drone-gitea-secrets
-                key: rpc_secret
-          - name: DRONE_SERVER_HOST
-            value: "drone.akshun-lab.uk"
-          - name: DRONE_SERVER_PROTO
-            value: "https"
-          volumeMounts:
-          - name: drone-data
-            mountPath: /data
-      containers:
-      - name: drone-runner
-        image: drone/drone-runner-kube:latest
-        env:
-        - name: DRONE_RPC_SERVER
-          value: "http://localhost:80"
-        - name: DRONE_RPC_SECRET
-          valueFrom:
-            secretKeyRef:
-              name: drone-gitea-secrets
-              key: rpc_secret
-        - name: DRONE_RPC_HOST
-          value: "localhost:80"
-      volumes:
-      - name: drone-data
-        persistentVolumeClaim:
-          claimName: drone-pvc

cluster/apps/ersatztv/ersatztv-pvc.yml

@@ -1,34 +1,14 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: ersatztv-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 1Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/ersatztv
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: ersatztv-pvc
+  name: ersatztv-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
-  storageClassName: ""
-  volumeName: ersatztv-pv
+    - ReadWriteOnce
+  volumeMode: Filesystem
   resources:
     requests:
-      storage: 1Gi
+      storage: 5Gi
+  storageClassName: longhorn

cluster/apps/ersatztv/ersatztv.yml

@@ -5,6 +5,8 @@ metadata:
   name: ersatztv
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -16,7 +18,7 @@ spec:
     spec:
       containers:
       - name: ersatztv
-        image: jasongdove/ersatztv:v25.2.0
+        image: jasongdove/ersatztv:v25.7.1
         ports:
         - containerPort: 8409
         volumeMounts:
@@ -38,7 +40,7 @@ spec:
       volumes:
       - name: data
         persistentVolumeClaim:
-          claimName: ersatztv-pvc
+          claimName: ersatztv-longhorn
       - name: i915
         hostPath:
           path: /dev/dri

cluster/apps/ghostfolio/ghostfolio-pvc.yml

@@ -1,34 +1,14 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: ghostfolio-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 1Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/ghostfolio
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: ghostfolio-pvc
+  name: ghostfolio-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
-  storageClassName: ""
-  volumeName: ghostfolio-pv
+    - ReadWriteOnce
+  volumeMode: Filesystem
   resources:
     requests:
       storage: 1Gi
+  storageClassName: longhorn

cluster/apps/ghostfolio/ghostfolio.yml

@@ -5,6 +5,8 @@ metadata:
   name: ghostfolio
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: ghostfolio
@@ -76,7 +78,7 @@ spec:
               key: postgres-password
       containers:
       - name: ghostfolio
-        image: docker.io/ghostfolio/ghostfolio:2.181.0
+        image: docker.io/ghostfolio/ghostfolio:2.208.0
         securityContext:
           capabilities:
             drop:
@@ -121,4 +123,4 @@ spec:
       volumes:
       - name: ghostfolio-data
         persistentVolumeClaim:
-          claimName: ghostfolio-pvc
+          claimName: ghostfolio-longhorn

cluster/apps/gitea-act/gitea-act-pvc.yml

@@ -1,34 +1,14 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: gitea-act-runner-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 5Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/gitea-act/
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: gitea-act-runner-pvc
+  name: gitea-act-runner-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
-  storageClassName: ""
-  volumeName: gitea-act-runner-pv
+    - ReadWriteOnce
+  volumeMode: Filesystem
   resources:
     requests:
-      storage: 5Gi
+      storage: 100Mi
+  storageClassName: longhorn

cluster/apps/gitea-act/gitea-act.yml

@@ -11,20 +11,21 @@ spec:
   selector:
     matchLabels:
       app: gitea-act-runner
-  strategy: {}
+  strategy:
+    type: Recreate
   template:
     metadata:
       labels:
         app: gitea-act-runner
     spec:
-      hostNetwork: true
       restartPolicy: Always
+      hostNetwork: true
       volumes:
       - name: docker-certs
         emptyDir: {}
       - name: runner-data
         persistentVolumeClaim:
-          claimName: gitea-act-runner-pvc
+          claimName: gitea-act-runner-longhorn
       initContainers:
       - name: wait-for-gitea
         image: busybox
@@ -32,14 +33,14 @@ spec:
         - sh
         - -c
         - |
-          while ! nc -z gitea.akshun-lab.uk 443; do
+          while ! nc -z gitea.akshun-lab.cc 443; do
             echo "Waiting for Gitea to be ready..."
             sleep 5
           done
           echo "Gitea is ready!"
       containers:
       - name: runner
-        image: gitea/act_runner:nightly
+        image: gitea/act_runner@sha256:8477d5b61b655caad4449888bae39f1f34bebd27db56cb15a62dccb3dcf3a944
         command: ["sh", "-c", "while ! nc -z localhost 2376 </dev/null; do echo 'waiting for docker daemon...'; sleep 5; done; /sbin/tini -- run.sh"]
         env:
         - name: DOCKER_HOST
@@ -49,9 +50,9 @@ spec:
         - name: DOCKER_TLS_VERIFY
           value: "1"
         - name: GITEA_INSTANCE_URL
-          value: "https://gitea.akshun-lab.uk"
+          value: "https://gitea.akshun-lab.cc"
         - name: GITEA_RUNNER_REGISTRATION_TOKEN
-          value: "NvAHP4f1in4Fpe6VFaiwiN98IR0poOQoDv4dDKcN"
+          value: "uxvKmGvtraocJMCcfJ101XC9kUoY8OlCEN18CvgZ"
         - name: CONFIG_FILE
           value: "/data/config.yaml"
         volumeMounts:
@@ -60,7 +61,7 @@ spec:
         - name: runner-data
           mountPath: /data
       - name: daemon
-        image: docker:28.3.2-dind
+        image: docker:28.5.1-dind
         env:
         - name: DOCKER_TLS_CERTDIR
           value: /certs
@@ -69,4 +70,3 @@ spec:
         volumeMounts:
         - name: docker-certs
           mountPath: /certs
- 

cluster/apps/gitea/gitea-db.yml

@@ -5,6 +5,8 @@ metadata:
   name: gitea-db
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: gitea-db
@@ -22,7 +24,7 @@ spec:
           mountPath: /var/lib/postgresql/data
       containers:
       - name: gitea-db
-        image: postgres:15.10
+        image: postgres:15.14
         ports:
         - containerPort: 5432
         env:
@@ -41,4 +43,4 @@ spec:
       volumes:
       - name: db
         persistentVolumeClaim:
-          claimName: gitea-db-pvc
+          claimName: gitea-db-longhorn

cluster/apps/gitea/gitea-pvc.yml

@@ -1,69 +1,29 @@
 ---
 apiVersion: v1
-kind: PersistentVolume
+kind: PersistentVolumeClaim
 metadata:
-  name: gitea-app-pv
+  name: gitea-app-longhorn
   namespace: default
 spec:
-  capacity:
-    storage: 5Gi
-  volumeMode: Filesystem
   accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/gitea/app/
-    server: 10.0.0.123
+    - ReadWriteOnce
+  volumeMode: Filesystem
+  resources:
+    requests:
+      storage: 5Gi
+  storageClassName: longhorn
 
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: gitea-app-pvc
+  name: gitea-db-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
-  storageClassName: ""
-  volumeName: gitea-app-pv
-  resources:
-    requests:
-      storage: 5Gi
-
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: gitea-db-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 5Gi
+    - ReadWriteOnce
   volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/gitea/db/
-    server: 10.0.0.123
-
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: gitea-db-pvc
-  namespace: default
-spec:
-  accessModes:
-    - ReadWriteMany
-  storageClassName: ""
-  volumeName: gitea-db-pv
   resources:
     requests:
       storage: 5Gi
+  storageClassName: longhorn

cluster/apps/gitea/gitea.yml

@@ -5,6 +5,8 @@ metadata:
   name: gitea-app
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -27,7 +29,7 @@ spec:
           done
       containers:
       - name: gitea
-        image: gitea/gitea:1.24.2
+        image: gitea/gitea:1.24.6
         ports:
         - containerPort: 22
         - containerPort: 3000
@@ -67,4 +69,4 @@ spec:
           type: File
       - name: gitea-data
         persistentVolumeClaim:
-          claimName: gitea-app-pvc
+          claimName: gitea-app-longhorn

cluster/apps/gotenberg/gotenberg-svc.yml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: gotenberg-service
+  namespace: default
+spec:
+  selector:
+    app: gotenberg
+  type: ClusterIP
+  ports:
+  - port: 3000
+    targetPort: 3000

cluster/apps/gotenberg/gotenberg.yml

@@ -0,0 +1,30 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gotenberg
+  namespace: default
+spec:
+  selector:
+    matchLabels:
+      app: gotenberg
+  template:
+    metadata:
+      labels:
+        app: gotenberg
+    spec:
+      securityContext:
+        runAsUser: 1001
+      containers:
+      - name: gotenberg
+        image: gotenberg/gotenberg:8.24
+        command:
+        - sh
+        - -c
+        - |
+          gotenberg --chromium-disable-javascript=true --chromium-allow-list=file:///tmp/.*
+        ports:
+        - containerPort: 3000
+        securityContext:
+          readOnlyRootFilesystem: false
+          allowPrivilegeEscalation: false
+          privileged: false

cluster/apps/homepage/homepage-config.yml

@@ -32,7 +32,7 @@ data:
             Proxmox (NVIDIA GPU):
                 style: row
                 columns: 5
-                tab: Stats       
+                tab: Stats
             Proxmox (AMD GPU):
                 style: row
                 columns: 5
@@ -51,84 +51,154 @@ data:
                 tab: Bookmarks
         useEqualHeights: true
         hideErrors: true
-        background: /images/background.png
+        statusStyle: "dot"
+        background: /images/sur.png
     services.yaml: |
         - Apps:
               - Sonarr:
-                    href: https://sonarr.akshun-lab.uk
+                    href: https://sonarr.akshun-lab.cc
                     description: series
                     icon: sonarr.png
+                    namespace: default
+                    podSelector: app=sonarr
+                    app: sonarr
                     widget:
                         type: sonarr
                         url: http://10.0.0.14:8989
                         key: "${SONARR_API_KEY}"
               - Radarr:
-                    href: https://radarr.akshun-lab.uk
+                    href: https://radarr.akshun-lab.cc
                     description: movies
                     icon: radarr.png
+                    namespace: default
+                    podSelector: app=radarr
+                    app: radarr
                     widget:
                         type: radarr
                         url: http://10.0.0.14:7878
                         key: "${RADARR_API_KEY}"
               - Bazarr:
-                    href: https://bazarr.akshun-lab.uk
+                    href: https://bazarr.akshun-lab.cc
                     description: subtitles
                     icon: bazarr.png
+                    namespace: default
+                    podSelector: app=bazarr
+                    app: bazarr
                     widget:
                         type: bazarr
                         url: http://10.0.0.14:6767
                         key: "${BAZARR_API_KEY}"
               - Jellyfin:
-                    href: https://jellyfin.akshun-lab.uk
+                    href: https://jellyfin.akshun-lab.cc
                     description: streaming
                     icon: jellyfin.png
+                    namespace: default
+                    podSelector: app=jellyfin
+                    app: jellyfin
                     widget:
                         type: jellyfin
                         url: http://10.0.0.14:8096
                         key: "${JELLYFIN_API_KEY}"
               - qBittorrent:
-                    href: https://qbittorrent.akshun-lab.uk
+                    href: https://qbittorrent.akshun-lab.cc
                     description: torrent client
                     icon: qbittorrent.png
+                    namespace: default
+                    podSelector: app=qbittorrent
+                    app: qbittorrent
                     widget:
                         type: qbittorrent
                         username: admin
                         password: "${QBITTORRENT_PASSWORD}"
                         url: http://10.0.0.14:8080
               - Jellyseerr:
-                    href: https://jellyseerr.akshun-lab.uk
+                    href: https://jellyseerr.akshun-lab.cc
                     description: request movies and shows
                     icon: jellyseerr.png
+                    namespace: default
+                    podSelector: app=jellyseerr
+                    app: jellyseerr
                     widget:
                         type: jellyseerr
                         url: http://10.0.0.14:5055
                         key: "${JELLYSEERR_API_KEY}"
               - Prowlarr:
-                    href: https://prowlarr.akshun-lab.uk
+                    href: https://prowlarr.akshun-lab.cc
                     description: indexers
                     icon: prowlarr.png
+                    namespace: default
+                    podSelector: app=prowlarr
+                    app: prowlarr
                     widget:
                         type: prowlarr
                         url: http://10.0.0.14:9696
                         key: "${PROWLARR_API_KEY}"
               - Speedtest:
-                    href: https://speedtest.akshun-lab.uk
+                    href: https://speedtest.akshun-lab.cc
                     description: speedtest
                     icon: si-speedtest.svg
+                    namespace: default
+                    podSelector: app=speedtest
+                    app: speedtest
                     widget:
                         type: speedtest
                         url: http://10.0.0.14:8181
               - Immich:
-                    href: https://immich.akshun-lab.uk
+                    href: https://immich.akshun-lab.cc
                     description: photos
                     icon: immich.png
+                    namespace: default
+                    podSelector: app=immich-app
+                    app: immich-app
                     widget:
                         type: immich
                         url: http://10.0.0.14:2283
                         key: "${IMMICH_API_KEY}"
                         version: 2
+              - Gitea:
+                    href: https://gitea.akshun-lab.cc
+                    description: Git Server
+                    icon: gitea.png
+                    namespace: default
+                    podSelector: app=gitea-app
+                    app: gitea-app
+                    widget:
+                        type: gitea
+                        url: http://10.0.0.14:3011
+                        key: "${GITEA_API_KEY}"
+                        fields: ["repositories", "issues", "pulls"]
+              - Pihole:
+                    href: https://pihole.akshun-lab.cc/admin
+                    description: ad blocker
+                    icon: pi-hole.png
+                    namespace: default
+                    podSelector: app=pihole
+                    app: pihole
+                    widget:
+                        type: pihole
+                        url: http://10.0.0.14:8585
+                        version: 6
+                        key: "${PIHOLE_PASSWORD}"
+              - Nextcloud:
+                    href: https://nextcloud.akshun-lab.cc
+                    description: files
+                    icon: nextcloud.png
+                    namespace: default
+                    podSelector: app=nextcloud
+                    app: nextcloud
+                    widget:
+                        type: nextcloud
+                        url: https://10.0.0.14:9200
+                        key: "${NEXTCLOUD_PASSWORD}"
+              - Crafty:
+                    href: https://crafty.akshun-lab.cc
+                    description: minecraft server manager
+                    icon: crafty-controller.png
+                    widget:
+                        type: minecraft
+                        url: udp://192.168.1.3:25565
               - Proxmox:
-                    href: https://proxmox.akshun-lab.uk
+                    href: https://proxmox.akshun-lab.cc
                     description: VMs
                     icon: proxmox.png
                     widget:
@@ -136,82 +206,77 @@ data:
                         url: https://10.0.0.100:8006
                         username: api@pam!homepage
                         password: "${PROXMOX_PASSWORD}"
-              - Gitea:
-                    href: https://gitea.akshun-lab.uk
-                    description: Git Server
-                    icon: gitea.png
+              - Proxmox Backup Server:
+                    href: https://pbs.akshun-lab.cc
+                    description: backup server
+                    icon: proxmox.png
                     widget:
-                        type: gitea
-                        url: http://10.0.0.14:3011
-                        key: "${GITEA_API_KEY}"
-                        fields: ["repositories", "issues", "pulls"]
-              - Crafty:
-                    href: https://minecraft.akshun-lab.uk
-                    description: crafty controller
-                    icon: crafty-controller.png
-                    widget:
-                        type: minecraft
-                        url: udp://192.168.1.3:25565
+                        type: proxmoxbackupserver
+                        url: https://192.168.1.112:8007
+                        username: root@pam!homepage
+                        password: "${PROXMOX_BACKUP_SERVER_PASSWORD}"
+                        datastore: backups
+                        fields: ["datastore_usage", "cpu_usage", "memory_usage"]
               - Invidious:
-                    href: https://invidious.akshun-lab.uk
+                    href: https://invidious.akshun-lab.cc
                     description: youtube frontend
+                    namespace: default
+                    podSelector: app=invidious
+                    app: invidious
                     icon: invidious.png
-              - Nextcloud:
-                    href: https://nextcloud.akshun-lab.uk
-                    description: files
-                    icon: nextcloud.png
               - VS Code:
-                    href: https://vs.akshun-lab.uk
+                    href: https://vs.akshun-lab.cc
                     description: VS code server
                     icon: vscode.png
+                    namespace: default
+                    podSelector: app=code-server
+                    app: code-server
               - Semaphore:
-                    href: https://semaphore.akshun-lab.uk
+                    href: https://semaphore.akshun-lab.cc
                     description: ansible gui
                     icon: semaphore.png
-              - Open Media Vault:
-                    href: https://omv.akshun-lab.uk
-                    description: NAS
-                    icon: openmediavault.png
+                    namespace: default
+                    podSelector: app=semaphore
+                    app: semaphore
               - Ersatztv:
                     icon: ersatztv.png
                     description: live tv for jellyfin
-                    href: https://ersatztv.akshun-lab.uk
+                    href: https://ersatztv.akshun-lab.cc
+                    namespace: default
+                    podSelector: app=ersatztv
+                    app: ersatztv
               - Jellystat:
                     icon: jellystat.png
                     description: jellyfin stats
-                    href: https://jellystat.akshun-lab.uk
+                    href: https://jellystat.akshun-lab.cc
+                    namespace: default
+                    podSelector: app=jellystat
+                    app: jellystat
               - Paperless NGX:
                     icon: paperless.png
                     description: documents OCR
-                    href: https://ngx.akshun-lab.uk
-              - Longhorn:
-                    icon: longhorn.png
-                    description: kubernetes storage
-                    href: https://longhorn.akshun-lab.uk
-              - Portainer:
-                    icon: portainer.png
-                    description: container management
-                    href: https://portainer.akshun-lab.uk
-              - Rancher:
-                    icon: rancher.png
-                    description: kubernetes management
-                    href: https://rancher.akshun-lab.uk
-              - Open-WebUI:
-                    icon: ollama.png
-                    description: ollama Frontend
-                    href: https://ollama.akshun-lab.uk
+                    href: https://ngx.akshun-lab.cc
+                    namespace: default
+                    podSelector: app=paperless-ngx
+                    app: paperless-ngx
               - Ghostfolio:
                     icon: ghostfolio.png
                     description: portfolio analyzer
-                    href: https://ghost.akshun-lab.uk
-              - AdGuardHome:
-                    icon: adguard-home.png
-                    description: ad blocker
-                    href: https://adguard.akshun-lab.uk
-              - Drone:
-                    icon: drone.png
-                    description: CI/CD
-                    href: https://drone.akshun-lab.uk
+                    href: https://ghost.akshun-lab.cc
+                    namespace: default
+                    podSelector: app=ghostfolio
+                    app: ghostfolio
+              - Searxng:
+                    icon: searxng.png
+                    description: search engine
+                    href: https://sear.akshun-lab.cc
+                    namespace: default
+                    podSelector: app=searxng
+                    app: searxng
+              - Open Media Vault:
+                    href: http://192.168.1.4
+                    description: NAS
+                    icon: openmediavault.png
         - Bookmarks:
               - Disney:
                     href: https://www.hotstar.com
@@ -238,78 +303,93 @@ data:
         - Proxmox (AMD GPU):
               - CPU Usage:
                     widget:
+                        version: 4
                         type: glances
                         url: http://192.168.1.113:61208
                         metric: cpu
               - Memory Usage:
                     widget:
+                        version: 4
                         type: glances
                         url: http://192.168.1.113:61208
                         metric: memory
               - Processes:
                     widget:
+                        version: 4
                         type: glances
                         url: http://192.168.1.113:61208
                         metric: process
               - Sensor:
                     widget:
+                        version: 4
                         type: glances
                         url: http://192.168.1.113:61208
                         metric: sensor:Tctl
               - Disk Usage:
                     widget:
+                        version: 4
                         type: glances
                         url: http://192.168.1.113:61208
                         metric: disk:sdb
         - Proxmox (NVIDIA GPU):
               - CPU Usage:
                     widget:
+                        version: 4
                         type: glances
                         url: http://192.168.1.126:61208 
                         metric: cpu
               - Memory Usage:
                     widget:
+                        version: 4
                         type: glances
                         url: http://192.168.1.126:61208
                         metric: memory
               - Processes:
                     widget:
+                        version: 4
                         type: glances
                         url: http://192.168.1.126:61208
                         metric: process
               - Sensor:
                     widget:
+                        version: 4
                         type: glances
                         url: http://192.168.1.126:61208
                         metric: sensor:Package id 0
               - Disk Usage:
                     widget:
+                        version: 4
                         type: glances
                         url: http://192.168.1.126:61208
                         metric: disk:nvme0n1
         - Proxmox (Asus):
               - CPU Usage:
                     widget:
+                        version: 4
                         type: glances
                         url: http://192.168.1.199:61208
                         metric: cpu
               - Memory Usage:
                     widget:
+                        version: 4
                         type: glances
                         url: http://192.168.1.199:61208
                         metric: memory
               - Processes:
                     widget:
+                        version: 4
                         type: glances
                         url: http://192.168.1.199:61208
                         metric: process
               - Sensor:
                     widget:
+                        version: 4
                         type: glances
                         url: http://192.168.1.199:61208
                         metric: sensor:Sensor 1
               - Disk Usage:
                     widget:
+                        version: 4
                         type: glances
                         url: http://192.168.1.199:61208
                         metric: disk:nvme0n1

cluster/apps/homepage/homepage-pvc.yml

@@ -1,34 +1,14 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: homepage-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 100Mi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/homepage
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: homepage-pvc
+  name: homepage-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
-  storageClassName: ""
-  volumeName: homepage-pv
+    - ReadWriteOnce
+  volumeMode: Filesystem
   resources:
     requests:
       storage: 100Mi
+  storageClassName: longhorn

cluster/apps/homepage/homepage.yml

@@ -10,7 +10,7 @@ spec:
   revisionHistoryLimit: 3
   replicas: 1
   strategy:
-    type: RollingUpdate
+    type: Recreate
   selector:
     matchLabels:
       app.kubernetes.io/name: homepage
@@ -42,11 +42,11 @@ spec:
               subPath: services.yaml
       containers:
         - name: homepage
-          image: "ghcr.io/gethomepage/homepage:v1.3.2"
+          image: "ghcr.io/gethomepage/homepage:v1.5.0"
           imagePullPolicy: IfNotPresent
           env:
             - name: HOMEPAGE_ALLOWED_HOSTS
-              value: home.akshun-lab.uk
+              value: home.akshun-lab.cc
           ports:
             - name: http
               containerPort: 3000
@@ -86,7 +86,7 @@ spec:
             name: homepage
         - name: images
           persistentVolumeClaim:
-            claimName: homepage-pvc
+            claimName: homepage-longhorn
         - name: logs
           emptyDir: {}
         - name: tmp

cluster/apps/immich/immich-db.yml

@@ -15,7 +15,7 @@ spec:
     spec:
       containers:
       - name: redis
-        image: docker.io/valkey/valkey:8-bookworm@sha256:facc1d2c3462975c34e10fccb167bfa92b0e0dbd992fc282c29a61c3243afb11
+        image: docker.io/valkey/valkey:8-bookworm@sha256:fea8b3e67b15729d4bb70589eb03367bab9ad1ee89c876f54327fc7c6e618571
         env:
         - name: REDIS_HOSTNAME
           value: "immich-redis"

cluster/apps/immich/immich-ml.yml

@@ -0,0 +1,42 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: immich-ml
+  namespace: default
+spec:
+  strategy:
+    type: Recreate
+  replicas: 1
+  selector:
+    matchLabels:
+      app: immich-ml
+  template:
+    metadata:
+      labels:
+        app: immich-ml
+    spec:
+      containers:
+      - name: immich-machine-learning
+        image: ghcr.io/immich-app/immich-machine-learning:v2.0.1-openvino
+        ports:
+        - containerPort: 3003
+        env:
+        - name: REDIS_HOSTNAME
+          value: "immich-redis-service"
+        - name: NVIDIA_VISIBLE_DEVICES
+          value: "all"
+        - name: MACHINE_LEARNING_DEVICE_IDS
+          value: "0"
+        volumeMounts:
+        - name: model-cache
+          mountPath: /cache
+        resources:
+          requests:
+            gpu.intel.com/i915: "1"
+          limits:
+            gpu.intel.com/i915: "1"
+      volumes:
+      - name: model-cache
+        persistentVolumeClaim:
+          claimName: immich-cache-longhorn

cluster/apps/immich/immich-pvc.yml

@@ -1,37 +1,17 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: immich-cache-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 10Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/immich/cache/
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: immich-cache-pvc
+  name: immich-cache-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
-  storageClassName: ""
-  volumeName: immich-cache-pv
+    - ReadWriteOnce
+  volumeMode: Filesystem
   resources:
     requests:
       storage: 10Gi
+  storageClassName: longhorn
 
 ---
 apiVersion: v1
@@ -67,9 +47,9 @@ metadata:
   name: immich-pictures-pvc
   namespace: default
 spec:
-  storageClassName: immich-pictures-pv
   accessModes:
     - ReadWriteMany
+  storageClassName: immich-pictures-pv
   resources:
     requests:
-      storage: 10Gi
+      storage: 100Gi

cluster/apps/immich/immich-svc.yml

@@ -21,7 +21,7 @@ metadata:
 spec:
   type: LoadBalancer
   selector:
-    app: immich-app
+    app: immich-ml
   ports:
   - port: 3333
     targetPort: 3003

cluster/apps/immich/immich.yml

@@ -5,6 +5,8 @@ metadata:
   name: immich-app
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -14,9 +16,6 @@ spec:
       labels:
         app: immich-app
     spec:
-      runtimeClassName: nvidia
-      nodeSelector:
-        type: immich
       initContainers:
       - name: wait-for-redis
         image: busybox
@@ -40,7 +39,7 @@ spec:
           done
       containers:
       - name: immich-server
-        image: ghcr.io/immich-app/immich-server:v1.135.3
+        image: ghcr.io/immich-app/immich-server:v2.0.1
         ports:
         - containerPort: 2283
         env:
@@ -62,24 +61,7 @@ spec:
         volumeMounts:
         - mountPath: /usr/src/app/upload
           name: pictures
-      - name: immich-machine-learning
-        image: ghcr.io/immich-app/immich-machine-learning:v1.135.3-cuda
-        ports:
-        - containerPort: 3003
-        env:
-        - name: REDIS_HOSTNAME
-          value: "immich-redis-service"
-        - name: NVIDIA_VISIBLE_DEVICES
-          value: "all"
-        - name: MACHINE_LEARNING_DEVICE_IDS
-          value: "0"
-        volumeMounts:
-        - name: model-cache
-          mountPath: /cache
       volumes:
       - name: pictures
         persistentVolumeClaim:
           claimName: immich-pictures-pvc
-      - name: model-cache
-        persistentVolumeClaim:
-          claimName: immich-cache-pvc

cluster/apps/invidious/invidious-config.yml

@@ -13,8 +13,7 @@ data:
       host: localhost
       port: 5432
     check_tables: true
-    signature_server: localhost:12999
-    visitor_data: ${VISITOR_DATA}
-    po_token: ${PO_TOKEN}
-    port: 3000
+    invidious_companion:
+    - private_url: "http://localhost:8282/companion"
+    invidious_companion_key: ${INVIDIOUS_COMPANION_KEY}
     hmac_key: ${INVIDIOUS_HMAC_KEY}

cluster/apps/invidious/invidious-pvc.yml

@@ -1,34 +1,14 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: invidious-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 1Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/invidious
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: invidious-pvc
+  name: invidious-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
-  storageClassName: ""
-  volumeName: invidious-pv
+    - ReadWriteOnce
+  volumeMode: Filesystem
   resources:
     requests:
       storage: 1Gi
+  storageClassName: longhorn

cluster/apps/invidious/invidious.yml

@@ -5,6 +5,8 @@ metadata:
   name: invidious
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -42,7 +44,7 @@ spec:
         - name: postgres-data
           mountPath: /var/lib/postgresql/data
       - name: postgres
-        image: postgres:15.13
+        image: postgres:15.14
         restartPolicy: Always
         env:
         - name: POSTGRES_DB
@@ -63,21 +65,22 @@ spec:
         volumeMounts:
         - name: postgres-data
           mountPath: /var/lib/postgresql/data
-      - name: inv-sig-helper
-        image: quay.io/invidious/inv-sig-helper@sha256:b5466c9add729e82e4e3ee5515c30b69df02d78ebb2486dbc9c63e456f29083d
+      - name: inv-companion
+        image: quay.io/invidious/invidious-companion@sha256:a96f7a1eb88bf0d5882d519c9410f8c7b2d391cafc378b72f3bfd37dd5f0e587
         restartPolicy: Always
-        args: ["--tcp", "0.0.0.0:12999"]
         env:
-        - name: RUST_LOG
-          value: "info"
+        - name: SERVER_SECRET_KEY
+          valueFrom:
+            secretKeyRef:
+              name: invidious-secrets
+              key: INVIDIOUS_COMPANION_KEY
         securityContext:
-          readOnlyRootFilesystem: true
           capabilities:
             drop:
             - ALL
       containers:
       - name: invidious
-        image: quay.io/invidious/invidious@sha256:9ffa4f1ea5cf01abe3102777102bd7a13153c79f6ff6ac072b6a29dda6909a8b
+        image: quay.io/invidious/invidious@sha256:2836b5b8226a53a9cc2afdbd5f5fe6bccdd200f2e17cd92a828b4dc8d8b5cc06
         command:
         - sh
         - -c
@@ -105,4 +108,4 @@ spec:
           name: invidious-config
       - name: postgres-data
         persistentVolumeClaim:
-          claimName: invidious-pvc
+          claimName: invidious-longhorn

cluster/apps/jellyfin/jellyfin-pvc.yml

@@ -1,34 +1,14 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: jellyfin-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 20Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/jellyfin/
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: jellyfin-pvc
+  name: jellyfin-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
-  storageClassName: ""
-  volumeName: jellyfin-pv
+    - ReadWriteOnce
+  volumeMode: Filesystem
   resources:
     requests:
       storage: 20Gi
+  storageClassName: longhorn

cluster/apps/jellyfin/jellyfin.yml

@@ -5,6 +5,8 @@ metadata:
   name: jellyfin
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -22,8 +24,6 @@ spec:
         volumeMounts:
         - name: media
           mountPath: /media
-          readOnly: true
-          recursiveReadOnly: Enabled
         - name: config
           mountPath: /config
         - name: cache
@@ -40,7 +40,7 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: jellyfin-pvc
+          claimName: jellyfin-longhorn
       - name: cache
         hostPath:
           path: /tmp/

cluster/apps/jellyseerr/jellyseerr-pvc.yml

@@ -1,34 +1,14 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: jellyseerr-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 1Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/jellyseerr
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: jellyseerr-pvc
+  name: jellyseerr-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
-  storageClassName: ""
-  volumeName: jellyseerr-pv
+    - ReadWriteOnce
+  volumeMode: Filesystem
   resources:
     requests:
       storage: 1Gi
+  storageClassName: longhorn

cluster/apps/jellyseerr/jellyseerr.yml

@@ -5,6 +5,8 @@ metadata:
   name: jellyseerr
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -38,7 +40,7 @@ spec:
               key: OPENVPN_USER
       containers:
       - name: jellyseerr
-        image: fallenbagel/jellyseerr:2.7.0
+        image: fallenbagel/jellyseerr:2.7.3
         ports:
         - containerPort: 5055
         env:
@@ -52,4 +54,4 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: jellyseerr-pvc
+          claimName: jellyseerr-longhorn

cluster/apps/jellystat/jellystat-pvc.yml

@@ -1,34 +1,29 @@
 ---
 apiVersion: v1
-kind: PersistentVolume
+kind: PersistentVolumeClaim
 metadata:
-  name: jellystat-pv
+  name: jellystat-longhorn
   namespace: default
 spec:
-  capacity:
-    storage: 1Gi
-  volumeMode: Filesystem
   accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/jellystat
-    server: 10.0.0.123
+    - ReadWriteOnce
+  volumeMode: Filesystem
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: longhorn
 
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: jellystat-pvc
+  name: jellystat-backups-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
-  storageClassName: ""
-  volumeName: jellystat-pv
+    - ReadWriteOnce
+  volumeMode: Filesystem
   resources:
     requests:
       storage: 1Gi
+  storageClassName: longhorn

cluster/apps/jellystat/jellystat.yml

@@ -5,6 +5,8 @@ metadata:
   name: jellystat
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -30,10 +32,11 @@ spec:
             secretKeyRef:
               name: jellystat-secret
               key: password
+        - name: PGDATA
+          value: /mnt/postgres/data
         volumeMounts:
-        - name: backup
-          mountPath: /var/lib/postgresql/data
-          subPath: db
+        - name: postgres-data
+          mountPath: /mnt/postgres
       containers:
       - name: jellystat
         image: cyfershepard/jellystat:1.1.6
@@ -57,10 +60,12 @@ spec:
               name: jellystat-secret
               key: jwt
         volumeMounts:
-        - name: backup
+        - name: backups
           mountPath: /app/backend/backup-data
-          subPath: backup
       volumes:
-      - name: backup
+      - name: postgres-data
         persistentVolumeClaim:
-          claimName: jellystat-pvc
+          claimName: jellystat-longhorn
+      - name: backups
+        persistentVolumeClaim:
+          claimName: jellystat-backups-longhorn

cluster/apps/nextcloud/collabora.yml

@@ -5,6 +5,8 @@ metadata:
   name: collabora
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: collabora
@@ -15,14 +17,14 @@ spec:
     spec:
       containers:
       - name: collabora
-        image: collabora/code:25.04.3.2.1
+        image: collabora/code:25.04.6.1.1
         ports:
         - containerPort: 9980
         env:
         - name: aliasgroup1
           value: "https://nextcloud.akshun-lab.uk"
         - name: aliasgroup2
-          value: "https://nextcloud-int-service:9980"
+          value: "https://nextcloud.akshun-lab.cc"
         securityContext:
           capabilities:
             add:

cluster/apps/nextcloud/nextcloud-db.yml

@@ -15,7 +15,7 @@ spec:
     spec:
       containers:
       - name: nextcloud-db
-        image: mariadb:11.8.2
+        image: mariadb:11.8.3
         ports:
         - containerPort: 3306
         env:

cluster/apps/nextcloud/nextcloud.yml

@@ -5,6 +5,8 @@ metadata:
   name: nextcloud
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: nextcloud
@@ -26,7 +28,7 @@ spec:
             done
       containers:
       - name: nextcloud
-        image: lscr.io/linuxserver/nextcloud:31.0.7
+        image: lscr.io/linuxserver/nextcloud:32.0.0
         ports:
         - containerPort: 443
         env:

cluster/apps/open-webui/open-webui-pvc.yml

@@ -1,34 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: open-webui-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 5Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/open-webui
-    server: 10.0.0.123
-
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: open-webui-pvc
-  namespace: default
-spec:
-  accessModes:
-    - ReadWriteMany
-  storageClassName: ""
-  volumeName: open-webui-pv
-  resources:
-    requests:
-      storage: 5Gi

cluster/apps/paperless-ngx/paperless-ngx.yml

@@ -5,6 +5,8 @@ metadata:
   name: paperless-ngx
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: paperless-ngx
@@ -15,7 +17,7 @@ spec:
     spec:
       initContainers:
       - name: paperless-ngx-db
-        image: docker.io/library/redis:7
+        image: docker.io/library/redis:8
         restartPolicy: Always
         ports:
         - containerPort: 6379
@@ -25,20 +27,26 @@ spec:
           subPath: redis
       containers:
       - name: paperless-ngx
-        image: ghcr.io/paperless-ngx/paperless-ngx:2.17.1
+        image: ghcr.io/paperless-ngx/paperless-ngx:2.18.4
         ports:
         - containerPort: 8000
         env:
         - name: PAPERLESS_REDIS
           value: "redis://localhost:6379"
         - name: PAPERLESS_URL
-          value: "https://ngx.akshun-lab.uk"
+          value: "https://ngx.akshun-lab.cc"
         - name: PAPERLESS_CSRF_TRUSTED_ORIGINS
-          value: "https://*.akshun-lab.uk"
+          value: "https://*.akshun-lab.cc"
         - name: PAPERLESS_CORS_ALLOWED_HOSTS
-          value: "https://ngx.akshun-lab.uk"
+          value: "https://ngx.akshun-lab.cc"
         - name: PAPERLESS_TIME_ZONE
           value: "Asia/Kolkata"
+        - name: PAPERLESS_TIKA_ENABLED
+          value: "1"
+        - name: PAPERLESS_TIKA_ENDPOINT
+          value: "http://tika-service:9998"
+        - name: PAPERLESS_TIKA_GOTENBERG_ENDPOINT
+          value: "http://gotenberg-service:3000"
         volumeMounts:
         - name: data
           mountPath: /usr/src/paperless/data
@@ -55,4 +63,4 @@ spec:
       volumes:
       - name: data
         persistentVolumeClaim:
-          claimName: paperless-pvc
+          claimName: paperless-longhorn

cluster/apps/paperless-ngx/paperless-pvc.yml

@@ -1,34 +1,14 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: paperless-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 1Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/paperless
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: paperless-pvc
+  name: paperless-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
-  storageClassName: ""
-  volumeName: paperless-pv
+    - ReadWriteOnce
+  volumeMode: Filesystem
   resources:
     requests:
       storage: 1Gi
+  storageClassName: longhorn

cluster/apps/pihole/pihole-pvc.yml

@@ -0,0 +1,14 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: pihole-longhorn
+  namespace: default
+spec:
+  accessModes:
+    - ReadWriteOnce
+  volumeMode: Filesystem
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: longhorn

cluster/apps/pihole/pihole-svc.yml

@@ -2,13 +2,14 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: drone-server-service
+  name: pihole-tcp-service
   namespace: default
 spec:
-  selector:
-    app.kubernetes.io/name: drone
   type: LoadBalancer
+  selector:
+    app: pihole
   ports:
-  - port: 4338
+  - port: 8585
     targetPort: 80
     protocol: TCP
+    name: web

cluster/apps/pihole/pihole.yml

@@ -0,0 +1,54 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pihole
+  namespace: default
+spec:
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: pihole
+  template:
+    metadata:
+      labels:
+        app: pihole
+    spec:
+      hostNetwork: true
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: kubernetes.io/hostname
+                operator: In
+                values:
+                - kube-02
+                - kube-03
+                - kube-04
+                - kube-05
+      containers:
+      - name: pihole
+        image: pihole/pihole@sha256:90a1412b3d3037d1c22131402bde19180d898255b584d685c84d943cf9c14821
+        securityContext:
+          capabilities:
+            add:
+            - NET_ADMIN
+        env:
+        - name: TZ
+          value: "Asia/Kolkata"
+        - name: FTLCONF_dns_listeningMode
+          value: "all"
+        - name: FTLCONF_webserver_api_password
+          valueFrom:
+            secretKeyRef:
+              name: pihole-secrets
+              key: api_password
+        volumeMounts:
+        - name: pihole-data
+          mountPath: /etc/pihole
+      volumes:
+      - name: pihole-data
+        persistentVolumeClaim:
+          claimName: pihole-longhorn

cluster/apps/prowlarr/prowlarr-pvc.yml

@@ -1,34 +1,14 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: prowlarr-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 1Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/prowlarr
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: prowlarr-pvc
+  name: prowlarr-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
-  storageClassName: ""
-  volumeName: prowlarr-pv
+    - ReadWriteOnce
+  volumeMode: Filesystem
   resources:
     requests:
       storage: 1Gi
+  storageClassName: longhorn

cluster/apps/prowlarr/prowlarr.yml

@@ -5,6 +5,8 @@ metadata:
   name: prowlarr
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -38,7 +40,7 @@ spec:
               key: OPENVPN_USER
       containers:
       - name: prowlarr
-        image: lscr.io/linuxserver/prowlarr:1.37.0
+        image: lscr.io/linuxserver/prowlarr:2.0.5
         volumeMounts:
         - name: config
           mountPath: /config
@@ -54,4 +56,4 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: prowlarr-pvc
+          claimName: prowlarr-longhorn

cluster/apps/pulse/pulse-pvc.yml

@@ -0,0 +1,14 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: pulse-longhorn
+  namespace: default
+spec:
+  accessModes:
+    - ReadWriteOnce
+  volumeMode: Filesystem
+  resources:
+    requests:
+      storage: 100Mi
+  storageClassName: longhorn

cluster/apps/pulse/pulse-svc.yml

@@ -0,0 +1,13 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: pulse
+  namespace: default
+spec:
+  type: LoadBalancer
+  selector:
+    app: pulse
+  ports:
+  - port: 7655
+    targetPort: 7655

cluster/apps/pulse/pulse.yml

@@ -0,0 +1,30 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pulse
+  namespace: default
+spec:
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: pulse
+  template:
+    metadata:
+      labels:
+        app: pulse
+    spec:
+      containers:
+      - name: pulse
+        image: rcourtman/pulse:4.23.0
+        volumeMounts:
+        - name: pulse-data
+          mountPath: /data
+        env:
+        - name: ALLOWED_ORIGINS
+          value: "*"
+      volumes:
+      - name: pulse-data
+        persistentVolumeClaim:
+          claimName: pulse-longhorn

cluster/apps/qbittorrent/qbittorrent-pvc.yml

@@ -1,34 +1,14 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: qbittorrent-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 500Mi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/qbittorrent
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: qbittorrent-pvc
+  name: qbittorrent-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
-  storageClassName: ""
-  volumeName: qbittorrent-pv
+    - ReadWriteOnce
+  volumeMode: Filesystem
   resources:
     requests:
-      storage: 500Mi
+      storage: 1Gi
+  storageClassName: longhorn

cluster/apps/qbittorrent/qbittorrent-svc.yml

@@ -11,3 +11,33 @@ spec:
   ports:
   - port: 8080
     targetPort: 8080
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: qbittorrent-tcp-service
+  namespace: default
+spec:
+  type: LoadBalancer
+  selector:
+    app: qbittorrent
+  ports:
+  - port: 6881
+    protocol: TCP
+    targetPort: 6881
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: qbittorrent-udp-service
+  namespace: default
+spec:
+  type: LoadBalancer
+  selector:
+    app: qbittorrent
+  ports:
+  - port: 6881
+    targetPort: 6881
+    protocol: UDP

cluster/apps/qbittorrent/qbittorrent.yml

@@ -5,6 +5,8 @@ metadata:
   name: qbittorrent
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -56,8 +58,8 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: qbittorrent-pvc
+          claimName: qbittorrent-longhorn
       - name: downloads
         nfs:
           server: 10.0.0.123
-          path: /k3s/downloads
+          path: /merge/downloads

cluster/apps/radarr/radarr-pvc.yml

@@ -1,34 +1,14 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: radarr-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 1Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/radarr
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: radarr-pvc
+  name: radarr-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
-  storageClassName: ""
-  volumeName: radarr-pv
+    - ReadWriteOnce
+  volumeMode: Filesystem
   resources:
     requests:
-      storage: 1Gi
+      storage: 2Gi
+  storageClassName: longhorn

cluster/apps/radarr/radarr.yml

@@ -5,6 +5,8 @@ metadata:
   name: radarr
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -16,7 +18,7 @@ spec:
     spec:
       containers:
       - name: radarr
-        image: lscr.io/linuxserver/radarr:5.26.2
+        image: lscr.io/linuxserver/radarr:5.27.5
         ports:
         - containerPort: 7878
         env:
@@ -41,8 +43,7 @@ spec:
       - name: downloads
         nfs:
           server: 10.0.0.123
-          path: /k3s/downloads
+          path: /merge/downloads
       - name: config
         persistentVolumeClaim:
-          claimName: radarr-pvc
-
+          claimName: radarr-longhorn

cluster/apps/searxng/searxng-pvc.yml

@@ -1,34 +1,14 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: searxng-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 100Mi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/searxng
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: searxng-pvc
+  name: searxng-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
-  storageClassName: ""
-  volumeName: searxng-pv
+    - ReadWriteOnce
+  volumeMode: Filesystem
   resources:
     requests:
       storage: 100Mi
+  storageClassName: longhorn

cluster/apps/searxng/searxng.yml

@@ -5,6 +5,8 @@ metadata:
   name: searxng
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -16,18 +18,18 @@ spec:
     spec:
       containers:
       - name: searxng
-        image: searxng/searxng@sha256:54097e8189288082454fc257cf39c51d8059f24efeb07a4abbe0abbc58e38772
+        image: searxng/searxng@sha256:0e0493d1bff9ed55f774709c9113185aa3da0db3aea84bf86b356e97a21d54c6
         ports:
         - containerPort: 8080
         env:
         - name: "INSTANCE_NAME"
           value: "searxng"
         - name: BASE_URL
-          value: "https://sear.akshun-lab.uk"
+          value: "https://sear.akshun-lab.cc"
         volumeMounts:
         - name: searxng
           mountPath: /etc/searxng
       volumes:
       - name: searxng
         persistentVolumeClaim:
-          claimName: searxng-pvc
+          claimName: searxng-longhorn

cluster/apps/semaphore/semaphore-pvc.yml

@@ -1,34 +1,14 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: semaphore-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 2Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/semaphore
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: semaphore-pvc
+  name: semaphore-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
-  storageClassName: ""
-  volumeName: semaphore-pv
+    - ReadWriteOnce
+  volumeMode: Filesystem
   resources:
     requests:
       storage: 2Gi
+  storageClassName: longhorn

cluster/apps/semaphore/semaphore.yml

@@ -5,6 +5,8 @@ metadata:
   name: semaphore
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -38,7 +40,7 @@ spec:
           subPath: db
       containers:
       - name: semaphore
-        image: public.ecr.aws/semaphore/pro/server:v2.15.2
+        image: public.ecr.aws/semaphore/pro/server:v2.16.34
         ports:
         - containerPort: 3000
         envFrom:
@@ -63,4 +65,4 @@ spec:
       volumes:
       - name: db
         persistentVolumeClaim:
-          claimName: semaphore-pvc
+          claimName: semaphore-longhorn

cluster/apps/sonarr/sonarr-pvc.yml

@@ -1,34 +1,14 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: sonarr-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 1Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/sonarr
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: sonarr-pvc
+  name: sonarr-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
-  storageClassName: ""
-  volumeName: sonarr-pv
+    - ReadWriteOnce
+  volumeMode: Filesystem
   resources:
     requests:
-      storage: 1Gi
+      storage: 5Gi
+  storageClassName: longhorn

cluster/apps/sonarr/sonarr.yml

@@ -5,6 +5,8 @@ metadata:
   name: sonarr
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -36,11 +38,11 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: sonarr-pvc
+          claimName: sonarr-longhorn
       - name: downloads
         nfs:
           server: 10.0.0.123
-          path: /k3s/downloads
+          path: /merge/downloads
       - name: tv
         nfs:
           server: 10.0.0.123

cluster/apps/speedtest/speedtest-pvc.yml

@@ -1,34 +1,14 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: speedtest-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 100Mi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/speedtest
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: speedtest-pvc
+  name: speedtest-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
-  storageClassName: ""
-  volumeName: speedtest-pv
+    - ReadWriteOnce
+  volumeMode: Filesystem
   resources:
     requests:
       storage: 100Mi
+  storageClassName: longhorn

cluster/apps/speedtest/speedtest.yml

@@ -5,6 +5,8 @@ metadata:
   name: speedtest
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -16,7 +18,7 @@ spec:
     spec:
       containers:
       - name: speedtest
-        image: lscr.io/linuxserver/speedtest-tracker:1.6.4
+        image: lscr.io/linuxserver/speedtest-tracker:1.6.8
         ports:
         - containerPort: 80
         env:
@@ -47,4 +49,4 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: speedtest-pvc
+          claimName: speedtest-longhorn

cluster/apps/tika/tika-service.yml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: tika-service
+  namespace: default
+spec:
+  type: ClusterIP
+  selector:
+    app: tika
+  ports:
+  - port: 9998
+    targetPort: 9998

cluster/apps/tika/tika.yml

@@ -0,0 +1,19 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tika
+  namespace: default
+spec:
+  selector:
+    matchLabels:
+      app: tika
+  template:
+    metadata:
+      labels:
+        app: tika
+    spec:
+      containers:
+      - name: tika
+        image: apache/tika:3.2.3.0
+        ports:
+        - containerPort: 9998

cluster/apps/vaultwarden/vaultwarden-pvc.yml

@@ -1,34 +1,14 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: vaultwarden-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 1Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/vaultwarden
-    server: 10.0.0.123
-
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: vaultwarden-pvc
+  name: vaultwarden-longhorn
   namespace: default
 spec:
   accessModes:
-    - ReadWriteMany
-  storageClassName: ""
-  volumeName: vaultwarden-pv
+    - ReadWriteOnce
+  volumeMode: Filesystem
   resources:
     requests:
       storage: 1Gi
+  storageClassName: longhorn

cluster/apps/vaultwarden/vaultwarden.yml

@@ -5,6 +5,8 @@ metadata:
   name: vaultwarden
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -16,7 +18,7 @@ spec:
     spec:
       containers:
       - name: vaultwarden
-        image: vaultwarden/server:1.34.1
+        image: vaultwarden/server:1.34.3
         ports:
         - containerPort: 80
         env:
@@ -28,4 +30,4 @@ spec:
       volumes:
       - name: data
         persistentVolumeClaim:
-          claimName: vaultwarden-pvc
+          claimName: vaultwarden-longhorn

cluster/config/cluster-upgrade/cluster-upgrade.yml

@@ -5,7 +5,6 @@ metadata:
   name: server-plan
   namespace: system-upgrade
 spec:
-  channel: https://update.k3s.io/v1-release/channels/stable
   concurrency: 1
   cordon: true
   nodeSelector:
@@ -17,6 +16,7 @@ spec:
   serviceAccountName: system-upgrade
   upgrade:
     image: rancher/k3s-upgrade
+  channel: https://update.k3s.io/v1-release/channels/stable
 ---
 # Agent plan
 apiVersion: upgrade.cattle.io/v1
@@ -25,7 +25,6 @@ metadata:
   name: agent-plan
   namespace: system-upgrade
 spec:
-  channel: https://update.k3s.io/v1-release/channels/stable
   concurrency: 1
   cordon: true
   nodeSelector:
@@ -40,3 +39,4 @@ spec:
   serviceAccountName: system-upgrade
   upgrade:
     image: rancher/k3s-upgrade
+  channel: https://update.k3s.io/v1-release/channels/stable

cluster/config/cluster-upgrade/system-upgrade-controller.yaml

@@ -264,7 +264,7 @@ spec:
         envFrom:
         - configMapRef:
             name: default-controller-env
-        image: rancher/system-upgrade-controller:v0.15.2
+        image: rancher/system-upgrade-controller:v0.16.3
         imagePullPolicy: IfNotPresent
         name: system-upgrade-controller
         securityContext:

cluster/config/namespaces/namespaces.yml

@@ -21,3 +21,27 @@ metadata:
   name: monitoring
   labels:
     name: monitoring
+
+---
+kind: Namespace
+apiVersion: v1
+metadata:
+  name: goldilocks
+  labels:
+    name: goldilocks
+
+---
+kind: Namespace
+apiVersion: v1
+metadata:
+  name: newt-ns
+  labels:
+    name: newt-ns
+
+---
+kind: Namespace
+apiVersion: v1
+metadata:
+  name: longhorn-system
+  labels:
+    name: longhorn-system

cluster/config/secrets/homepage-secrets-sealed.yml

@@ -7,16 +7,19 @@ metadata:
   namespace: default
 spec:
   encryptedData:
-    BAZARR_API_KEY: AgDRvN6yb20epOufnDsHjVF/AZAeh8EGUbXoHSOZkbYefDifF0PS8XvIG+xexbV7FqoxLUTBVVyd3uAn2nt89rDVtH3khl6uw2lyLAq2BECIDbDze9ibAi3TlvFxSfnD3Gq3GJYopUeVyL4WS2ICtGdivb6o5O12Ne1OtOiLtVuEXE0X1/Cqbnrhx9KQ2Pxv3EoaJbOwylvbU+sPZPcKHL9EKl+qsjCDRQaUXmCKncmGEdwQZIUdNZxjMUeYY+72uZEMHx/TsAJUEKsCXIttKrPn9in0WB4PoOGdS4f1IkGoBw8/i/SaAUFeVj8Qo+n8V/zqsPR6hu0DhfLthhVhqMJS0ePpzMzmbRbxSivI4/hvKVpyWcnQwIzjdvd8rJEjpzCz+LoerTCgkWXEkZdZWlCg2TUvNMt6D3ovdzhyYf19/gBpdIWGExfs93KN7xNldjhP3WBSApk5gihTDss1lzEiVxYcpZzUjWCRfHsaShC+ipvQc2oNF0+p9sWZCcKY5yqUiwkViDube2rhNqEGH3VrlGuEAwTzhd6CJg/9NUGF7ZyKKZFkQ+W9ikl6eIDjs+Fs5xWDjiVDK+1vqKMxNmbulgIkBVVBZ1Ls/a1yem2L50Ztgqay7mtLC7es0FuAwYfeHq6hsq8kPRuy6xJ9ZaJ4QNsd9SytpgUViiE4U8nvbM0gMCmNAZXZhv6WrOaYV3b31lskjU7vrJu6CtTMdfby7kCvj41bPtdoPUDaq26ssg==
-    GITEA_API_KEY: AgClWk0ZGz+fXOrKitVAaGAjjCPTckR8s/cg8gqHz5uPRRNC+HKDUbqiImTKZUjLwV1lH8nhb/HVIoJmyk4fCyBnwu7pwqw8VJ1KbrGDc0GL4PdzbXjWa3mQBtYfda51gzoDgEBkIr8q+pD6fPXfIX1V30I0iMQdvRU9vbQXXLoiIuz6no8DMcy+7JKg/yljgdFjiD1CqkAu20Y1gJk1vUzXx7iXjhvEqO/nuxROrxThGzCDjTCdPiroQFWsxlc1XeJqpTK7WULf4abiMCkLA0rp28R6Z9pHzwkdjMCbxItj8Z/q/r3q9JU49cVg/FXRbPQ65Iefl8/SLTxvZcAv2tRT1tH2uzmW+EntIIQ1GJ6SSAUuStVTK6IdCh6LM/iL+8rMSGCLeTVcNtm80tIm6pIt9pGDuS3oYlvA0KyfmZ4PIXDmH4PJm8oFk/SCXrukvCrBW5x9ESbbx5PMoAYEVtgt9hQgQ7lYqHdeJ/MnAzPWDBdWqI+i1V2LeLDzqHb3egAi+hS6UXLa8c7b+JBrJpaAxZXrDwOvp5IEmqZLZAXBz/gcpEgKTLewlvJB/TyHAEApoKGWYiJ2qWwl4nkdQuqAJfa6ieiSB1FNcVzBX+bnXzYRkIDWH9gA/+qTcG8uNaZL+xs2SIXZvWiC0QIZhK3Dnqy6y1b2fmVud+BLROhIVOQ4c78QxbTY/KQVoORWj3biqlD8B+YG/ZrZYkXKd2jMOKBOdb4JIDikq12M/5rEP1W+GxmxojCv
-    IMMICH_API_KEY: AgB3BjkjpMimXsmPqlI7F4afsDYmXqT1i5kRhvBPY/fT9yJH1ZjfqF4XCjk5E9WPUywwCSXQJaJvAVihoHUnr6ilE4+hoyqwAjzAw+y0zeJT5a1lpcviEeDEVp+p1VgrXh74Q2DwT/LRe0DQKEILfz5VIYHthSHETlRhkbZ1n1ErwYo7JNoY8dCQzwtAEDTv2ruLJgZd6MIq/MxwDYoaC8K/3znlqTc2Tbzu8vaYQpzz5AUAUYJfrdIJeZ93Nw+Dr7zRaNPtIR28hMf4KnemNgqxGt3P9SJTwOdLNK/H/y5kFVm7iK7WFSn7pjvgOcflgoZtmcgrIaijqVY/JpNC++wXSP6cEAju0UKTOBUn82sxY2pfrLRjuYwRvPZAptArgWpBk38+QmmgbAsndqFAGk4c5Eih+ZgQt9/g4AlHkJHCUQoOhSQe+25Wl8dnqUY8TADr/N9aBWwEH5io6i5xmhpi9Yp2xjlNSzO+0Mo49Nn1cDeRw+CtG5x1s2P2CN9/kFOXljdFtvOv6vXBcTgnuQiVUEP4Lp/oJhUw9v4YkVuCXxVnCyr793dPV7ZPDqu/0jhMU4hsX+MFDcYILJBMhZiLlzaPQE4Iz2wMqWL/z418kOc1qfG9mp575djQkWah9KM2O6nEJB2W+V62gn+jPs9UPXy1jeVOP3Ef6iEEbOukGKUBDYy1KsKaoKqxIUPUuQTZ6mri104r40rQ16ZvHxxaiI3q0yGbrjSxfna7TpTsSRaUtYBl9vWd5hU=
-    JELLYFIN_API_KEY: AgAE5+P9ky5ZjWlOkDvd0BeCwJJ75Ryv6DVQu3aBvUCWlAREBVcvR5wy67cly/C7dd4vHMGW8ui0ZOWip3oWp3eyf5r936REYZVYni/Eqe8el0+GRvZGNyfT7B3cnzFGd6HVif3dZrMU/MLed8x/hUQBDB0r1PYoXxJ6sB9BdWD9Umfh1z8TctUaY+ThMFtfs53iMY0Qyn/OctX3rE6tY6bqqnO6A7XvNGHCKAKU2ZZmXhcjtR642mkPU69SvaJKv4XGgCowN39O7fljqYQUVk+ym5RDoUyiue224c3JyTWl9l7l4sNcViAGij7uBIoV3Stv/bxdGbqYFykF8+DbT/0kJ+OcxXWwHJJ77xyAdAZVg33EL0qAYwaFVzI9TLa6mccCi866OIi3qt25YRpAI9QeVpgkGzceUtv1HZ8aQEMiMsBAK+fgE6i5rGZTZ1R2GLjijc5ZSeRrfqIWI4jAZ2hpRSrhclsolWOdrnUuyQ77GxZrosl30mUmuUXq0rFyB3lKnP9SVw7iiruV3CTWtPD184ZBylwAIe16ntF2uiyZjxi/tXKAsyG859BXletwITAr+oWqR/fMVNJuBqcRf9h9WTrgFlDiAWi1yhCIC1he4RxXBlhVvNCo3+BXL/Tll+5Ry4DyekY8gj9scJY/xNJ3nPDZ7hzsUa4/+1+HXXnQXED7dfgDO6fIiCBqRNWkw8IvXbrB8YTtP5h0fkYCPNDKlzhAjtPK7puz1oRO0f2aPQ==
-    JELLYSEERR_API_KEY: AgBsalewosQsbsE4ylx665cvgiXdGpXqiIKz1iFxo1VLJhZpx8DkL06b+xqg1a+Kzy5w3IJjmlh/lCsFArJ/aCywMikT46A/fWlHCOP3qzKStEdeUDuYgD7y/lJjCBzABRtj9LkGSd75H7nz5rQuuoT5sB+auPbskTMGp69d6f6xiZOas/ljI0RUpuXvZDM4UmKHNsdMfHcYOqHqAhcXRUKN5A9Se8Injd0sooaZnljLd6SPToQ+6J7sde7TQ05TScLBqIbd8tjVIGVX3zGkOqu8v8SgpHhgyVF+rI/AiiQnd3n5gnxZnwqM930sSYOmRUoHcKHGjFZ2c8X3wlNtAB9AUtFaNeSZQC/uya9+vGS6Xrx3j7THB+fPMBkNDVhpO9ZBvlEUgviYI10EaWaaz+WOOvmal670LBCKNHulSkIcOs2W01H6XN6q4aEYWocLr+fCfgHM8s5ELJUEmVRL7kG8cwVQKHpbQ5CNz5RMqbcPsJuV1yU0lbxU57h1AEKh/jEdJf2BRkMYg1OEqbwygLGgyzvKs6mjPGRCXj+QlPVgd5xs7ICFMcl+lemQ5AJN+HY0DpwUp8Ota1hJcP6Bl0NHAn0DUfOcCljxIwYjShHJNRETl3iypXmxXmvygFCF1Ye8tJ+P4hBGQMekFsyNZ4jKcC69kOb11l80uN+s2bgg6oV9XvFVBQX62Mc9OxlaCiKG5+s7O3Th5OLi+31ICyv9z+SKmtdg1h81Qavx5ccN343z5FqRpexFu7td5b8vgpsw8rQ5HiIZrjIvpxmW0eOdcMAyoQ==
-    PROWLARR_API_KEY: AgAJj93yX+8kguxJswRKItw93uroHuhAsZupapg4gvgYuIPtsmLXLNDaaglU6DImR+roSr88XzWPFGStKx43YF479/O07541Jwat0Zjnf8i9L5Hu2Q2R25Qm7iSt6DenMdVjhp6vb7DJsMYNujdul+XD1taMyYhmSPvbDmVq/PWXWMihTx9JiSgiZLbwv3KseUn5xB8fABPCMe1ulv7iWCaXQ3eaGricq2UtVneoCWK2TvebwY0PKjX9jnc/4YiEfT7ahJLT9GaANThMsQPI4cak7JXaRMHq7MOBG9tN0nXsRM8js0jvM2rVhh7tkbQFadLb8ukzxUu72CSq3c9XP4JUGEvz132LuHQ30jLia8N9tFep6Fbz66pdH7ZhIRH50JDhaWwZfIu1qUtJSEChNF+jLSn9KedQLIt1S5ER4KL2eh86Y3DIwzb5awjohL5xL+POGihQPrGucZF76E7ykFMBG3n40+QlSETbQ4j6ipY011iizo+W5dDyo9+FImcF1hInXs0mhYpEye02Ke780Wjn8WP/iZrNbC6ROk32UWylTMFWtfzbwEfJMTIMUrxGzi/zY+31zu5zia+cgPbXY7dEGXAM4BYVOb5Uu9C69o51+XXWqUtckIH3USdp6TP4f1vAomYRt2jupPALuRNFmKZ4qnnxzl3z2zr1a/iknjWkCKT0uOjfk67mva6NR1kqgSfUYJZziMYi/1MgITffuPpMnk1Glz6W0EDg+NxCBvm8SQ==
-    PROXMOX_PASSWORD: AgAAxq+on64xFaSZ8BvF1mqAeMKs68BfyNXvklR/gWDDVHMjK1rPJGHteiIUwnVLcADQaVqTJ/hAZyMq/x5oFkuuRx63CWYDJfqZlsNU0TuogI96l9WxzsX8CLyMFNDo4hU0W9zaQkrAM2qBE+zdtZFh0JXPan2PsVLsjjXCiSdKxMxB6XLC8yKJGc1oroQhVs49NiBjkS7s3RWutQH6nJ7YXd/VmE+oGsOvF+vnXc0lMP2WOXHPVCMIWgVXUmACDDUUh6GBhx5HYPCRpbtFfL1cqmFaySFeDop0wuqfedEuGGVpcU3i0wV1jtCYo0jl8as7+ddXURkVvYyM8E4+N5jEbRBRBABrv8pJhvhTTLReZpsPOfzcfG7benMNkzie//Eg5+dwkPHzPsJyqqsm8U9JnebLEnkZeOsH/6qMTTUjAeXt3MmcRW+7s6b+thBNsj9bYyyuXZSOwJbsfWMTmQFnDa9MFE0SaJXycFDfu/LfR6IWiPs8yj9n2xBON69SBzkUIDN+Z83mo6SlwmgiAuSRN0Acp3cHrSfaI+8isAGhbFDIjF/cdY+2vzmTmiMREJ4uL1y1LqpKC9ZXjTfdeSc127R9uDbLe/Ft99dIIlIT89L01p1qRecleCQaFYiT06snMrQsK2umJktuyEQbo0O1Jky/+S/caBXZpKW+zyUteLy+miojTW1T8L9UCes0i1nWnyNDYwVvsWJWIQLH4yiGUGSuLgU0vOE3e/xHbjxKFLZZHbw=
-    QBITTORRENT_PASSWORD: AgDNRPs6+C+QgBrTTSJxquCd/ZcGQpGlxl3E3bQkPTaHVCG9+OeHuOsZsqj/8vxzQJ1EKVyswya3MrLaf6/L1u/KslvmbfQVVd8thvwEWsqJCTsmhf09kFfR6axxykpLgOI9tWZSklcw+Otf58eGqTpQOW25z8r9OrNOt/dQIM8XDrXDVATcqOKJXVX1f/MNI6PPh/IzixG+bOS8Jj60OF1luKaTfg5eM936BXCC+M8rDVy1q4/FaoPTz26trQ36F5GNxRTwA1im/55NdVw+GHHpxCR0BPRO6/l5sERKhaAdSHWYVwgEtyNclOljeBl9EamRLxedjzSvsq/iu/CgMBg0hFULh1Y8FbX3f5uF5v3cxhJOT7j5D0I+qkcJnc63x7ZluQwnSxYjoJPbw1EKQVvcdff504wIkMrXW83Z6JFZoJcnT0atg1mRbfmEtCbSjZmJe8LPmBH9Dg+zc+1Fg0GfH43i/E742Bdo0rwnYYRHCKili5ModTr5xglEm0RHG0EeF78ovem21/mLjudAYAYHCvmehCVTlo24yyXuRTnxzm0bGxLCVAJiNyqN7v4CPHryQ09xljlRiBXp2Lq8BGqJvqGxX1AZhBFrmi2zexSqLuVHGYAGlDXFfV9u1y2sUpw9WDkeWXa8dgFBtBTiFPXoAu6Pd8hAKcP2G289u3I/73oABGJwSIM9hStoGaosAFdu76+gYEvANFf2
-    RADARR_API_KEY: AgBcbQVgSEnqFQBjKTul1hXeeDTJjBgHFS9vYYEdn2SUyL0j6MfHqyAckteqnbIBlb4rYkGIqh8BdaTfmmuTfLKQA1cBTbrhtlIp8nChXFRUgAXffIyH6HeD6PI5PmC8hHKHFoChrepRPHi3QavFRIF66BcBUI43VhSqCHME3LIc19SjO3qniqNDNH7yL6hvQsMRcUBFqe7kxEX2GnPFd//dAgQM5Q5sV7R2VcUMh/FDT5UbDL5CrX9g3uzXkoWJca6NeD8p05R6nycnS74HlL1ymr4wpL1wDdlnpSvjVkQBnRfLpMdFtt9SoGGiYCRojbnZe7bLTadCIABEMWoRmc1zZnlsQ3mAB8UxZ7+7wfNzwYd+3fGgWlChMYnyKzOw0QleSBzmuLK2XBXP7EtH06JhRkN+0wXoZzb9n1c9KE7RTzXL7Yq6SFul8NZxlttNgT9vk5aDqooGUnrVK2kP2Ir+KzsIrtrLnmGvJhhMh6+6lF7L6AzX5aAzfaQxkSA36Gip6Jzrr0Ritk6yyA9/qU4f/+XYmKz7mBBf7Jc2Irb+S3dgdFtFxU3+hWPVUBnz6Tg6CnJrb7VMuioeyE1RlfEcn5KTUQDjqYhEa5lwc1G12IVacVW8N5uLrCFj/f4xyU36ikMQFiwbOwvaFD6aPQzYzzgDoF6px1KChmOjf7bYkdq1w0b3Q1Y7tGRdau4MePLzYyufFeZVQsHCYoHeua0EKvp8pVs1XBAofjEHXbY9Lg==
-    SONARR_API_KEY: AgBip41wChIagvY3aPTVwexPiiZoLe9sS1qbjlGaE/v6xTqAx0efG0KfCtD44BC/OEwVHp5OaejzYfvPQcJvQW4OMeQxv1aTQSJBhIEB+l5GRNbZks4/SJL+VzLEf3Yvm94JKbYlVdkdvnucUz7ZdEiC9JordXUjrYly34WI76dCLvbbhdaNnTYM0QiLNZqyM8gu9/Hnfkby3nSuIQW5brqHESzr3ljcv6bv2QppGL2yJB9A1DD6DULN9q2W/30OdjaSW/5X3qg3m4KfFlzIOGrhhKNaZHUw3L58pCiD5VXara1vG2dENxXgqzJ8O8iDTkfxtKUEiv7yB2P3pq/n/BO4O8J39OENNheg6JjtzYzNsrFikDXhEzGjj7CdciGdyLZPImSNSUFg4QFxI0n5tXLZMQ70O77SDswMmaGuNTpWwVdY1lQohTqM90oCC3gJUy4aX8QklK+qBStrX/GYWovoLYV7L7MA+jkpoiVUW2fQGQd7lxWprZehPdg7naEOqPxSEytDAhgedwBwIJkzwcopvuOXb7EJeet0RVAskNtBA13efkx5676Xv0cZ3c1rPoNkRyKpRrpWYwQQUoEYl5W4YgwoUESEsmuxU3YMwfySz/DJj6D3gkxK2UoYJWkrM/LtSKaOnpqhrgE2K9mfLoxQziHOIoyXVQ0POJa5qSQC3dQfte+FpxEZGFXI6929qCRkR0nNvwmDCVxxyyabKLGwfoYkV32AnsJ9WU6+U7JbMg==
+    BAZARR_API_KEY: AgDEhlYLcmagIA2aklfa0E5bGnXWgJNXisFA1EHpgVvkdTLvrOUfCS6wPOs2g93+rMgtuEtzjjxuregyXpa4Oo1dsmwwQoDup81XPTtDFvhrEr6eIohQcryMSmhOfOFd2zA2PMMoK7y7ge5cCI3q5Do+xgW8LqJkuLoCsu/9MCm3OBn9TBhzJc8mvqPdnzppddTAJ2XT3J/hod+nFetTleyOlvqWDKlcIzyUAxZJ0u8w+l6d2Ew3kUJI4o1FOJ93KNC/nJaruqPjL1KS4HynQrNPNGdkDP+i9SYRNnv9/h+J6ptp9xPpkvUjTopToBeSh0oUWXG30gy1l5PHf3RTTWIroLyGUvR6O/G/P1+Sa7uA0c9+ekChtMEUhfjXuJsDzUw19OY/wUeuINoz/MfTxVUx30eSI/2bKrq36CKpjv0tXeNr4XYzikaF985WfZqG36GlWEqDY1PZUkS1pnVM42sclEN7UhXARLrTE+xJvE9HL6YVwognP6nJCFqIqi7Q+GT2HC8rRDhn6Fbm2mkGwM1R3ssSr9mH0UBUhu44pkIQmedxhpMx/nxR0rXxlRXFiv05L7fqtY6mtEO12EDtjPY2Yh6TknxJ6+qFaxdqyBeI8X2KlPjadqt9yA8F5fC5kdKnRTfNXoF0zrCtEZXKts4joXki8pNeI41/E3nxL5gn3imOcDoAnaqKdaR2Ot8ohAKqKhZtaIfm3Q/s/z800uj3GEjYol5e54XSwcHfYqQMCA==
+    GITEA_API_KEY: AgCDVeoNFKMpDPaHPn9MpMJ8SgmRxafanWqdpitfsPzRf0UEnVZiNcXMqetr96C0kVJo6H3IZg/qht2nqRJIsH6RXpeqvHc4wGLMzuTvj4Y+TL0qNkN12yCojgw6gYmTZ0u0wzbglN40wt9Vxwgaqr4jX2TLM4McLHfMVCUPcKSppyy4WBEU+XDDLRQcBkWFge4MjGYnWvytWUCpMYh+oiLDfMy6YVRJkkI9cTbChJYyckM8bv1r8rWm+5XqF72E3ISVqytlorq7dHeBL9uL3iBS29dfZjX32Nne1k4/AJN5PsJInn0Y5hmlejHPal/sr5U0iVzfUJ9OP60DwiOAqcwY9hzBUTqm5W3q3uNPvj8zOWyyZ9dIrpmAKwsGifvIFccN05Qe8eZXcOe5/2PEKU8TE9+4Lr0KLqqW2X0EMb6hAMXneWFdzGTqcgrw1DeyPxDG0CPcaDcJqunuSHN6ML0yLW7HngHYKNs1WhLq2YoiUs0T7z+xrxNsT8T8pYPbiGxun78SH8j+rbEisSJo+GRJ6pAhieZVflAfoX9JKiak7Z4XzLaAUUZAYic+vLRCoQOd+5JrSAWHfnMFJlazTgkXlJ6fPclwaeqSsCGDprF73e475PK1FM54RKsTn6RHpDhr2J5+rMBJoWgHUoViDwO0EOcb+vfLOJzApTUr0cs83RYhKqsaWvJ9FlbOgbgo2ScCDfIPLFETEDGKux4r1KRvu7DNOnZYVXc0gqOa+JEP7meq68BQVqZh
+    IMMICH_API_KEY: AgA6zDYvJ+uMlmjQijZbTOYOmJqcLJsmrutKJBd7kB26skvpTVeC2zRx0oR2+g2j14bwwd6SRnEq35Fa/IYNKewrAvaeF+cAgTYA/8G/Nbu9w1gYChFPgK54teyemlOsuFNPjUGxf4LABkzkALXrhj3S+jTm732Ou0DEXhOh6LP615CBrtu+znkuPx6azIcw/52ZElCY1AbLMg5M4Q9Exww3vrsmXbieGpv9LlNzH4NVqKhHyZUf+Fs3uy0hmFhug/7SiVD5M87CBf6JoHV40i3/B3ZuqaqSvZgH+QE04ttzIi9nunAbin2sXGZg4zaj34Rxcq8JrPEAYfr8HGC8YBC+kB8+/J4aPCmfwZJCtEHTlm1ODmAu4mSgpQMiRAB/0UWJGmjCG32l/3Jei/ayjV9LmOVeQ2aYKzwxjzkVp++qXeNGokIgiU609ihRXM1SbnARnNGQwJbC+jiCIxLYuifkFok93454hX/eFiUHxI027fqqrymX+1YPRVdPjXwTjW2DlVs0KLHEvfKrwLxX79RsyP9aMXS5vSyn7/OnVAHNqpVongYZKe+CJK6Lv9irT5Mw+b/EoG2yYN6bLhb4djNcZ6Rer/KZloISsDrccXPt4kXlg7GCL9+JE1Kp9sGMoyFNANWfjAYebB6ntUbAHsjhkhUTV+jEac15YOxK69GXTg2o5zjYNkE2T26JEFAbjxSr8gNmPD68r/tDkyk6C2MmCmZY2Xr8gGHYOxVZfeqAsDHPty4jNOCbt2w=
+    JELLYFIN_API_KEY: AgAl1XoPzIfEzH/GDqTNr+OSOkjkg35+eHio9t1DhSuPwT+SWZJWoMW7Mkb0eqRm6bwQp4VlyE7ZyLa1HhN25OOe8LS6Mo/G4KVgYwLXICpyDswrB117NRS0tRm3IbKsAPE0tvZdgCddkCb3kL/YbF1THssVHzrHsKpVrirGbfkEgf4ihjeJAVjM5aOGGMV69E2t/4n17jGLK9HPiEmxncPjfNpk915WdVP9CiXUzBsGREE8oARPRpe7e6XLtsJRCQKP19A7jo9BMRgz9OEzzeVfabb3P38cEr3tRRXsnr36iPZX45Ubvkh9PynHZ7fvnRxn8gHUU/1yg21f60C89p2YaOmAPlaRcnV/1i0hNgzq0hZHIyeCn5e4ff8R0BZlZ3ERRJEyq+yN7GV9mk3Kz0YmPfklr3HgdndTigCbDc+V+KV/aWB4ZpCSspAbLnoRf7QVU++fak28OhnT2NQhodszZdXcbpztbqHwmVkCPLdFuUXOTjx4qTB9sof307R8q7TO5aF65ZhDuv8MNstedN95kg3hPCPAh2ukv9dDy3qi/KGSeFEyNl9bTlkGLOkogGZOOm2Lls7evFshQWcRz0RbqUUXvX7w8G8vG/UoDIrKRLBn3mapZ1pjSLS40scsVQzwdWXAxycrwEqzqcecfHw5MrJXl/y44SMS/FBZlLgCDB6zebAXRbkWx5AyaPAWXaavfDRAFC/wGIZIBD+YAF3KE61ZZ2gaCGCKb9I3jNMhPA==
+    JELLYSEERR_API_KEY: AgCaJAAMTL+eC3EnKyhUWoHF+lx5rlyf5+FABc76uBCTgHkJybbt9TCeTysUjBKSozJi0fqv/uktc11wURgTCRM7zjPNtIsxCTmRBvFPZlpj9dDH4aTSv6SzD5q41/hl0LfwIE+J3Ssd8NYPGYZcYFLiVu4t9f9CzXy4f4H1j+T6/G7SW3q+eDdViTt3ZvVORwxGy+kSO+gra/G2N6ghsNtzqsNvZokej/1mRwkFfjvi2h81N9IdnGURcx5XaUUv4Zo/67zRFwXuObiL3LJKYwWtEnWVw6cLIoWi1/e9nGYIv0m7tuHuylK496nmAYL1a7rmLxoWJgaKYKqnwS+RlxifOYBOz0zUxGwjbgGEqi4gR1D5ErcRkx7Wc6PQay74leMiG15QkurtZ5vlHAQdqWAM9hFlR22lD9bCJ0zCG9e6P8eH59j+aUz2IQru+pNm9TgmxEzCTC1EXT4obQ2msjaCJCPeuHC74V3ytIz5v6vqtoSVGdRVBYsIIRyTIahBxcljekGb4Ew89L6DauU6BvLT77DeWsR1H/ozoROxD5ws+HIaBdyoBv3CQmwMpH4YDsbFxc8uZtUP1Y2pWNyq8rb4LKqslcFNyoYy6VflTfxxyG/Eyv1pC/60tGYMjKT9svW4xQGm4hQm965dXEn4f38hQckwDP/xSnQj9EpPNtaovn5R2PAe/GjIgFe09G8mCDXiBIvak5nFiUjuwKLnWwmJy8DevfiIZayfRippQz3hZQlvpIf6v60t6hdyll6RuMs6s4vIrJunAzhBYkyBhtCR+SmoFQ==
+    NEXTCLOUD_PASSWORD: AgDOdIYXaYJw/5ZdVf4IutB7h/facNUYfe3is8RU4glzymnC3SZrPzdwAbPsAwf/VvtDdN3B0H26VtCfy5fLXMQiiUmdt0BrXK5r6Q9Ymx8zDjQiOJ0TyP241TJQHBwl+YBq5SnjTI3CkdMs7uD5QMe6EqiuSS9H9EEJinl7TqtXWlet0gVjqpiuNJU9KmGRKi2Z56Qm0eBrrIBGpi6jYU0vmB+492GEZ6sfkmoEzNllRan4IXervclLU/68KohNx3aQT0SrsFsuBreuKpB9dGY6zgCTN2HdabWrWU1h7iC/8+3pJO+02fnOTIrS4drm9biW3bx7yAdSZ/odX19CulQFd/mZs3SMCaiS735YlK6NFwV2Df65dUWD1ocvpDb3xK7MAMcaK/FIYhUYS7SUf03NTZo3RmOYB8zfHM1bG6NEVJyYs/HeQ7BqIsKWygEIbH2c8cJa6ydc1DF/UgtA/HQhPyVIj7zpmK4SgmZ5SJQy7vLe9uNSO0UHXcdmmXWsrMGiXZP1+QPRyKBrsDcwDsyl4QrecdCcfOerHo+tsMEQz7y1Pf/YnIGpNtSoHH479X4mYaw6fvEgJloMnAZPeokDYJ7e3F+Hw1/7O/OeBJECYfkZNlkdmFCQEn/tzUVABVXe0QKhO7XZjZf3dm067i+7gMCeKdnckG1EzHkBIj0RK3ni4ohiepZUq1kySmnKFD+ekYAE55lmbi8fwQ==
+    PIHOLE_PASSWORD: AgCMot9kEIfeytQSgr6/RfmSbWY3UZXsClG6jGSBZHXhvn5+Jv3IGfXckFXD6B5NvnWyvkCwCcGiX8PS2aJUcWbNmb/U+I9g2uiSTsISK3gL+7/pQtZsdNCIHA0XO//WJqfbhlGvKvk0lRqj8V6icTHRqGDjEc1eCEmDXvuWQxKv+JORPQHPm5CwSF90mcqrkoIew/zb62BZCc7e7Au6491G2Owqe9kETtTtEUVNV/k+s7oGRcdOy6htAN0gIVj4hP4IeQMc++CDzjDmcO70e1JaBRW/KPx2IDc45PM1RjZgWa4D3YorNhIBmdtRPCLXjlaWrkT1rEaiRhR/IBCmzGZvXlRs1ueK4yl5RUFwlhaHxyuGEQ6xX4+9q4zllXR0bafGwAkNrlIFTawTSCM8sdjUEySjK9W3xtePM2jfzwi5RC2XL0kQd6JUJFA5N6sYWPLdky8qd/ZnK85e3sXv/Xtd4hkjEiKu3VdREbyydEA7Q6zM8JucE/Rce1HhxVAaKGIewaN45E3LWGTCnyik8WAptnkHwN4Pbs4LeohSrdosTx0pUQUVrLTSp0XEdCT3xIjFGpcrHOOfxndztbGn1Y9ELl2f2ScBAzwFk5pdRYNf2BL4ky01erfyRtz1JUov2hzs2xIRVMfjq+H/LiSZpYhgg5H8YfvMhQTecgV6NPX69z4vHeGDJrW5V3jbDIfJSKrFUlJ0Q90wW8E3Dw==
+    PROWLARR_API_KEY: AgAdUTlxJ84L05IOXofdq5YM+ETuJfHDXJKNbJxwn7OuflpGYYA+O42byUHQKbfwFJoQlXv+UQqpq9L8FCyuYxDX+vwXD9UltnnZEWNncrac+w5vgMZjKjCgStpmNl14K59+J0z/nN7jET6OOag9Z9pM0ZGnQ3taUrwrvrCWZJeCaYcsHBjQdQ/hIR82/oBsQzIsZ8OGDP5dbePOxHxNDb7d4R732VvIsW6wTwWwxzhWDvs6uT6aSiAFJ0Mcn2vGva8+CxvJaFX7fleLkRFRcPr5vEjerpky3xjDY20jmKJ8bKF6qGitTeCJEpyoARmHaeoCW33rY4+WFj7mNgS7dZL2/xmFXNErioBxVxLVG2Wid25OE4mBrnKZ3P+Ly8byiEe8bHe4jMn6JawqRx4FGnQbBfEX4/NZhJnEkTYXQ5ag1klTaXSbblrXH4UOBVsCyvLrSKI3AfiadEcKASz61qlzPgOhm2xENFc81I4BA8QZIFq5IBxudrTzOzZa+nKTq7WKNoBHkUtGYuT1vuTn4/HkkJorLi46MdeqEYlDhhKbmmk8s/qemDyVweZlHvsS/3NxSLIADF95UWRyPTpvrUiM6WGMLX+kpSAqOqpWMFZLU0Tv6mynXhbDqq/hWRPtIIzJubtxuACUEiaCOmCwjfBJfm472/iw6rXJo5KR6DQ7deLbB1xURBIl0NuKQY2dbJSUsiKnlGbn27Qn9/tzSujL9UFVAmALhy9SuFzDBDppHw==
+    PROXMOX_BACKUP_SERVER_PASSWORD: AgAbdisb/Bpo5Nkq4D+wSRvxsWzKfYna+I5zLlEwIV0ZbdXKBQxQtblLIOjuBTTeV39CLVyeir8jbQ8qdaDvfOa1X5/tD09HFFyaR9J4zcDdamRrXvOXG86KuKq+5rfJXVxuha05iA6xH62hwViy3KMcK/Q/4YR9z7JkSWHMKM6qChci8uHFi4KrmOrhH6LwieKTZa2mjTxN0kX/OtcKuUdP2l+dsA+TS4+EB95qPbCUS74CyaZwN425sRceJ6Lw56zQbdzIvNR6KmrtziDqatLkXlpYOqUPvwd3rKlFZIbO/osV/ocr9IF2kB8NdlzS76GCOj3HbLizHwiGnfSIEPfQD+YwH1iRnZRJPdTW7Srp+j5QqxrgxAamf3XcMaRD8dZQLP1xp/QmLMVZTGBAzg7n4HHRUjDhsi17V/AZwr9YwxGv6+tHkMmcZaQX2tkJPb8EONfp83U0gQ1pnIJRWjfXKvgQty7TjejK5wC93f60CegqbfcyzbX1P7rI+Cj97rfTiRLNlVrfrn/DdvcdIKho3ZQLUiY93xU/W8OHFsYDGPPnqdR5BVzU4Eg5AfI6FYgAix8F+YT2MxM4C/2IDRAxM5FWdouAOEzsvkRu/0/GHTJAM2V7qHZV5pW04EW4mJ9TFmk++MInyoWsKDd4/x9e9vzLpHj4BGHYvrX41QZjP3SUxnHeaDwfYNsOBs8T4IW03JUq1QvovW7IncAjHA0zQ7cuEszeUBCt897GHrLkj14ue7o=
+    PROXMOX_PASSWORD: AgCUCHvfbPakjWMnFjxPXnX5TSqWv7tPxvBFEEkDwuZR8CKmUOZZFrtB9ANII8RCYPpwsBc31UINb/FWOf2sQhkSczWff+ETEB5X2ZblltnEXpvrwQjozU6rDuu8weC6mMvVL8oeL1wT5JtaZGYTMM/3R7GJf0oqseN57q4YhMNZ6ygcmepZs3s7WLcEXzeDu1quXFKVFCg2c4t55YM/lUWqn95POI4EZxu9x1s6D6t1EOUzp6LnsccMY2RbXsipm7XMIT3qsJcpYl7+po0XTimmERCRQh1nk4tUdqXLxratvadNxz8QXw5+XqBUAMtQpGBPftO09zv4yLRSywKUDW6YEj/m5UgQLqh0sGJfzof/Uenv/HP5HWXteFnz174UT3mW9vjG2fKnTVdbDYGV63QgnmfVjv1Q5Jfwgmqvi4mO/DB+dFAjuohuwy9nJiQBhirigcCnXF3k9pJyPf6KRoOpjSq+WqTVKY01+3q5lQEb+/W+V5azyO4TdldEKz7zU8vz77mCMx73c5U68mx/DeL1RGZGqK7K+ORilyuMYq8W8yuB8kp8ib1t/f4oYLae6i1C4ROYQt27ZVjppMEDp5iAXSTzZ7MU7PLIqpmgPAcsIsq2t3jHDRDzsvC6EvFbs+R329Ac5reNlL/oN/6Oed3ByCzcdGrQRSvuzY9hjGTUm0yQUQuWaGeK4MBM6gEZuWL0NTMbyPveoTGNxve9nAfeWkzrZRNKxYli/8tJx3X59mQe8D0=
+    QBITTORRENT_PASSWORD: AgAWQzutpD7fs/BUDOVWPcScMSNf1Ch1eJ0eYvu9ldhucokSf86nWEeG9Q+6x5URPrCIe52BagsfJclCoTORyTHf8EoAW23T37E8CL/p6YWJh0f4B+QF9hwtcRrxnwpoPxZo1lcFaIy+II9IRxYWbE74hNPk63ag2vsN2Cc7/FUUmWB858m9LnY5fFAVdE1z8acZK6M6q54gdRG6GiNZutktHW/a2xt12KaGlYcxt86yHKSEyGESlrhN3jlEd0wEK/nZu3OmzErDfhpEBF0jV37tQ9uNbMiXFA7ovi/IcsY2QhQuyQd8IpKaaeWjdRPFMMXwqJaRVmRIahFrLoOM0V2XAAe6fAUGn1XBl7MUS2K5wIgDdvgzpzsNG6Qwx51X8/1xOlOb8y+NJBJTKsFGWpOBf3CBt44RXCJEPyOrtiB2aBa/uKw3nhf/uU5sxJtbj7kDe3x+JongmZEUelX4i/0rub5Y7ANA3yijpQxv3/bVLS9xKiilKh1vTPB8z8ZDgaKzaioeLZmjiA7oMfFbt/7qDajYkO/RnNuGETsN8Lc/jGrylhFo5xC/nRlkYPpg4D0iCQWvKVb63oTlRvzbrjeNbd4IcMS4uXECrwxUWS0r7+VT3u1wHfVJr/zOzWZF2RqjCWuqxLDtBKATET2ce4uDAa10rQE7IVUX5USdQCEt2Gl4Abu24/SRx5aYJlolitmx1GOo+ygQdO8A
+    RADARR_API_KEY: AgCb49oKRpXYm7+Xd13ab/ECe/o3Z6QsFBzximX1KPDr0tGeHBZlBesXgh4YKFT80TY2CE8+NCXNdFLo8WQI8xu/5i7+UxCtS1IrHznV4xvo8YhgkxDg0Do7RQu/z4XsVhYR0NmWRYQnU89odoba7o5Khvi+1OVhwbiOscbR07a7YfkteeiTQRiAIuuMc6b41P+aKVC8sa+g5Wm4TM8TkM7U8/WHLQDFEKtpx8fLB8w/UrzjsJIpNsSut1udFP1oHZBbXkfCVgn8xAQ8KnVwH1fUX/dL/mQmD4Jhvda/WASXePdFw09HKQdh3g6dJnZbmOTC8vkFiTdWXqWun+6VQIy+3CaXtYUgwfBWm8xIVZAyxgP3Kq4UdaVrsKXPH8QVohjeSykamZLUnSwufjJVO4k7XU8eLgdqdylNzFKbc+LI/NDjCfQVWLbQ9SNH0ZI5Hszypo/IEHSHkmtsZpONvXxRmKPAt6OS57AcDSOfA63QQKCR8Vb49i8kJi6sqaznSJJo8EE1dOT5i125rNrEirLoothQc/JEpl5A3JqPvAVxsNsOIbSd6Zxs/ZU2u+n7dp1HR7YMvfh9TVrz08c6ZKv9StZqXde4t6m7JtQL9mUJSyA7JmzHE+OI8wNesmbStj5c8BJ4B137ZU577mVqzFNbmAwLi2aiR7HqvUebkf8vXdfCRqtD+hcCJnRv3T4aZI8Z+DekpHNlLVyx0fYGW0EmSCGa8Us01ccQWm/CdtoZkw==
+    SONARR_API_KEY: AgAz5UuOURhOjja8M1HJWXEKNXe2xM3MTLgXuXMaJNENC9wAC0fp5SflLbg7LnQQPvY/YuMFamGjzg9MAT83zJyOtuYaHuAPF2zjNG2bYrCEZyj6sLlz5xK4nt24Gqr07dJyC+iSRYj2xxQWm9KQZuSV9UbA3iU8PLdNruGLYnRDkznVl+/soBTo9bM0N53jzqsUFEuuaek0e2GhZByScup9vv3nRRvcCKNb5jDTAqFg3R4zWmZmxY/gmrPB9Jm0Dm0E0D2zBAMhAsjFOLvrXz0+Rah5X+C2CpIoiWQlQoN3FNikRExmYQgTSxz+PbApFL4y1as4ZBrbVQT9QWGr46cQixi44TkMgUXSV+rtVSjxhnI0e3/di7nNbjUsEykU2t8BQuzsRo9b/ft4SoWIYkcnT+Ezixy+IWZ0NeAamYmDJjsgKe90/K1fehtnfcC2q2+X3wbsbXa0tnW9EEzw4zMC73w2ucwVTzVrnDXlFNwUTvNz2D+Wt9KeTPmnuokCU8pCn2DVNXcu3NEwOw5+Us8OSc7x1YlIKMwegMsAlOs06qL6WzBvJ0IIvxaO1h75g3VCB7OWEjFv8Nxc0LKbeXx0PTn5tgxHIUEIZtxW1V5sqIcBi5bRq+/k54c2oU92ZV/fWzoCMWxBqXZQFy/X0x2vunJX06N1L0srSWXuZbO+oIY4o3yP5eca/JDNTgLRBuil9AbUjBPntumERIMWTklCVX7I51JjvgjQfL+0+L5Z9g==
   template:
     metadata:
       creationTimestamp: null

cluster/config/secrets/invidious-app-secrets-sealed.yml

@@ -1,17 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  creationTimestamp: null
-  name: invidious-app-secrets
-  namespace: default
-spec:
-  encryptedData:
-    companion-key: AgAaS5Ktylm7uoZfPI6kUn/XrrmSL69EgT2SdJzMJ20Gh0ChbOrMQhyn10XhLpTCCLYdCtASwiZi5MoUnhbF5qFbJDM7/RQsfnzIZh52ej37ATckgRIe7/WoriAr7ZzFAQrKr80mcHp93DWdV20eBWkBLzZBSzYzl897NOxHsSrReAEPzkO/mfidjxhuov06J8cahPswzPrdeEJOUJDYrliZiduxpWIQH3cCFX9AU2u8rpS3Gl4Qf48VAaxWtDkgAibilnzOp+KFfW7h0Nmva6EkFGGcHK6FrLrtGPDwKAidg9G9szuOJwu1NgowSRq8gHhah6KC5lHJ3xPpmA5txfked2T2IWHVStssZw9Gx5utH4wkX0PZW58oaJp1lwsC42M3UpPPanB0gvDD1l8iC8Szzh5FY+GyshfcVstdxa4rJW5RZ2/kaDDotGWL021ogAzJmVDvLm8HisMwTrOsA1M9EpesW5sKGmiJc9Ce/wGrU+8kutkbyt8j6pFNl1RGRLUPEsoXaVTfKLdv1o/IWdmaZ/8HeBMkL7iDBqTJHLVOkhUYN+zgDmh2iAkINkYtEPRPTV64DsCLBdCRLZp2obtU2vxxw4J6sQF3FQOZYAhg4YywT+ENwWtorplHU0798RqJpId5b6ktp/bQ5H2innFkjrt7wihgYT4ZS8sSr+8EFQi9kY/A88i2cZ5PdBN6zj+28qHKuxb6CYr9DTm3Q5ZJ
-    hmac-key: AgAv23AhCeIkVAaPuih0yzUM7LY5GRpTrIccZDKgvKW36XLPLAkYnr7SV+S1ADyShyurVvJYl+nOg7hlRpsPldz4PPTas9ahQIrfJHf7JaPauIM1iqG/8UX4Ud2grWSuYz5XBheOIAxlCSFMzK1XgKdMK5Lm/er8ymb9K2KWN35BcnF8lyC/y02uHWhZFJm5CqB2pcJTct1VmNkRt20PHhKKOC/Ruw51CDOYKsrr9HzSNxCO0/d4zhO8F+Q+f3bKHXcQjZbkgkIEE5F0dYfUxpzga/0CqQT1XibYlgBA72GBe06PeIsD9HJIhe03ROsQEAVfLuqMF3vQRNbXdnW9kPVxEbQuXLiitymUPpLE4dRuv7SA3A6Q+bKRlA4+1cTUKquLKNJAerezZkN0e1NJhXQUAAIQbXMFi0c3nMWAr15YtzLmjhEBMmGZoGcMpHOuk/O8uS7opFVHHNrPNxgIsFzfrayTKRcoZJ1LNK8Qkp/5pqlXWNb263da5YS2gv9L90/mB3y1mazxvbFa+b4FjL9b+4dBB2ueiuM8ZbAiCU5o7as0wMJrhoVNq2n66irkIB7Atmv2fCuXiKk6tOrVfH2yNaLI3sOK397up19XJmmX+XHExHlIrEUqZYIx1YSesbNNCrSxfI9WkuRwTORp3JGHeclfbQNpckGGsOn8D/egcrphiqqHB4Rv/sFoscfgjGubv2mLFkVECZwXnhX4dV461bF9lK2nORxflvyRL5/X9nxTI5RLObCu/Vsid7zWXjiSdsxscWyl5rI8/V+7OFDYAJWs4s4yrHIwLgdVnGRWF81j5Z434EOHi8MiGdYOdLNrnQ6KhvsEhVnSAvwMEvdRgfcCmiNp4MyLrLTLkF8MPA==
-  template:
-    metadata:
-      creationTimestamp: null
-      name: invidious-app-secrets
-      namespace: default
-    type: Opaque

cluster/config/secrets/invidious-secrets-sealed.yml

@@ -7,10 +7,9 @@ metadata:
   namespace: default
 spec:
   encryptedData:
-    INVIDIOUS_DB_PASSWORD: AgB3juHjCLwd1wb7sP8YJN0xJAGDytBb96SzWe+zlQQhj8CRi3YzcDo5YXe/q3G3vR6UsNu1XP37HFy8OxBHSzfbF9zg6Nf20tdX5gL4wWUZrl2hLRMRexkFkk67yE5w2rxugLTxotHWdisDuZ+u47pZ0HbhEXZjtkGEDJga6cvWCEfxg/k/dcLwKXA2E1hKXUH6ePDCuii+JsTlEH3dpBiNVvKJzNs75ZVTbgPeY1ITAcCxokkOwHALN1+C6LHeoPhEYw9FKmYP8ZObSQSdWAPVxg5bN3YLWP5PEU3mxdzCXNmK/VvYzjRc9GykbegLa9qqBpoiEUEz+63uWFC9oWMKKZ8hfgRaev3rM1HsU7c/BAtxOuvqXlgc1ZsSl7JkI13+VfeBEnPGtkOgT7O/WGaPise6fqGiDLsLcvv6Hi993fSbnPsA8ldWkBtcq9311dInznEzABFDJ4mb+Q7yA6oK9TdCsIc3B3C+iFnAgRPyhw7+1ai0cLn+dE26Q+851kHo40ZS3m09K7fFhF1+t4atlZ34LZgxqqP4Shw7QOCUp32MCJfqSRVXEj6BfXEyQDF73w6UWwa7dkoGB4a9vcs+uowMRSyI9gCOj7S/MYFqaTQM8sXxKFm6W8YZBeasGq9x3cXQrtWfFSIaF7VUX9RcwrgrxyEZIz0kTCpZSwzl2EpDeWHIeGaaT/ooF1cpuwEb5P86Ys2znnJHeQ==
-    INVIDIOUS_HMAC_KEY: AgCHg2EAuB/KUeH+OEyJQSioVpwhK2ukU9GghsYCZB6NnT6Xsp3a+PCjIaE4BILQRuIIwKIvt0/1D2bWPKq8xtYc2FPbbMukyNBloTbL60R7Ev9gjS5U95+C5/X9y8venC8Rb7eCAWUMDXiO3NJfSZ9z7k4KwkkNhEbZxi6dNZmqLvmTYgMwUX5IwpszAvO/i6ee7q87Uozr/J2A5eHuXK3aJKwzW/Kkrmaj/iBVTfinFExCFpek7DIrh8Gj4DaQb7MgomIHRMesZtiWiu3Az1uxYUMt2LpY9deJVJEEW0pNNyjd9a7TtDNjECE+lP0w2tbQqYaAbXUsPj2IWbdyX8PNxELW4Ah41xuNf6pUryOMLuucMuLKds0Cdpd3nTKXfUDGpfg828wJqJLhVHgVYhH2ySrjU/hpLHgaBS6Kk/b6erP9UKI4YAtTTWzhPP4/Ub2cWmEbMeeCbX3Pcrx5uwd+95HsX1vVzuY/ouvKXNxs67nxhOyt+bKiGz8raGkFShkW9f9qLsIc2z6w35HNwFvhreUUE0yzdTNKJHPJFz4pLzGDTkpi666Vrb2MnOG65TEC79v/3sbRj9BDDjH4wuYcfVtJVEoMCn36YyFfFD6DFSIOzP8Rw477gQseHFapjuuAhrVDDvyruwg/QSz9QtJqkDJLM1ugVJT7PKJB/7MKtXoW5owsgj87VLr8CmXN2/FhmyqF3ym5gtOK47hh/x6z
-    PO_TOKEN: AgCUYCcSZIO1JtakkSD7F032TiMxNjvm0yZk3jhcn6eJ8wkYd+7I9M6n5pwbrfQCGz6asJBscFBl4iGrYFvBGy8fkZVVgDy29R7QDmirDwi35A81ZQ1zKxQJDLvCjb8UnCvmcXqSs7d0mwbVhANo2FwfJLICIv8Z54bUvODyvM9HfQVbUNlEIbeVwl82kH58/V7GhdBDjdU/UWd8hOPq8iwz20dm3jcv/U7gC0zTQUoxHjzt2uWvyYoekjTDo1bRrcew9IMaFll/Csl+U6rLrhDwiJROxp0DW2dKfFC2ledbTTHGVMD8+C6wqldpWS4sMkRZ7BH21SykEmOYCTcRRFTw0QVmi2aItbXvV0eau123a70cmvBTIDGsZDfWrtLj32i+DuJIujh8n0dzzwxjo/I3BVXIXRNU6zZDtF65DyaNSKB7eyFa7N+o3MvQ+xRP8T95Rxj+f0uTKx0UNIG/wi8DqVjZt7Cm43596nz/ShwwGJIKgavK1BwcT+tgzAfaV8bBPOnnSQcnsBE0xl5nW5eYoa4QBbxNMj3cXK/+iYR/p/LqPL9rFOqhjeEIpbGjG8TBayksB/f1QtYsTBlUXQcAcpmJ701h63/nnbNOaz5GCjIkzQ+QgiTGs6q+KH8lpIIXBRwXfzRHSBUWbT1n/N9+UAO+lQwtZuP2+s5M+8N3/9uIkXoE/fb9fXlxnxCddbZgwW6wKulYPjN0+ZXATNuaJsj4FKffYOoZ4K2L6J5IFNC08jrILVzjzIwGd4kTF7GFsgScFsJMnGZTtugzLqFMsVm0Cwa4t3ggOBCq6Y4ZWbTlP3P7qJNdV/tHsOvHxXkBT3FsUeYz7a5SYGT8Dho7hLWvXpjM8lvJ5SMb0/gFB5jnE4mgbWdbVlrbgJdcVWBWipilJ7UAcd71i5UE7Hlj
-    VISITOR_DATA: AgAfAo8J2URwMZjpbzSLTHSGYyej1KVK6lALsExWgEc8L4Ksb9uMfLN+vHkUcm4uCw1+gCKBvaUwZMXzOLOHCdIY7pNtkJ1CcRANlCJj5iMXlQJfa4+dfLCvZR/7MeEPeQsn8rJZ+KXp7R5YV37o3qtLEfC2GKL9gIMAoezYAVaATivN+ClIT0OBC8trLvkCKvtxQx/XwrIZhuAQQMRRsrb+l2+KOL+9Obkc8+6/YS3ScLv7MWXt5QTlLxn8PrLmtjhaQXDpjdNxABvStJhO7xiCzFc+/D87mSc7NWCizpT8BQe5S8Ey19DI9qZm1NAxAEA7dPfebgksgYicESPJqFcT9eD5q8fmJVML1As91T/UW24Aa2jRqqfz8OsqKb6VYTpoR8ihG7VF8n8RSz7JfZxucSZdmAHHc1q2AP7GX8QK6CyUjPEMT+ngQlpdygPhRklxtHnwRa702H6pSYmLS8BwZMkJEDJAZVZNx/5G+u/2/W0SmyVpBn5kXhtmRi+m9l2Kp/tNleScRx2Xo7nXoTlDVPQw/fnwgl+h8II3omcvmdEwlimrAyBLUvlo+dKMmy3+bwBcx82FUPznbBJtk5wr6JvK0hZFRIFkN5uhU+nhF6PPcvIgeAgnZS53ceW+fvk9IK/e+1bzQ5SyE4tPeI6HY8GAnoQVQaVJOPGz8reuaOJ/jgOtSp1Z9yzzEASDoRHmKlakdi5b4K+RhVyQOUxUgiXf5rllOpHupYZyFUjopA74YXPPmBE3PJYzvsW/aGc=
+    INVIDIOUS_COMPANION_KEY: AgCnfbrG/ji25f6RV/avt613WpOpZNlPsuTP/DU9HULXC1aMM3HzEJR3lIEfeqt9y7iHI7Z4WdD4EqYjdWeDkmLnBLkQB3V7RfPm8tNcfRmMad+Q7bm0viSSq2WhxPtVvtI1G5zoIWs4RGw7F+ee7JqDz8rCKWSHJ0XyuBJUsk3bBLXWNhWtxbaWJz/uxNQoO8ZHV+fa00kqijGcebj9IM6wq4Q7CI5n1NcQqJhJPg1ggOavAiOgcrV5z82PUXDx2tdVbXbynNJfzrTYrU4s0f08rYAT5qF3nXZFtRs4sWEEYCTXZ/E7OdOmWFTsA7af2S1DLE8pkNjzKlVQo/wBV6mvCJcQZtgtLiAKDwnYdoExp8gP9SgL89lyZEa56KtEBAbnU/YBpEQndaFDoLb3mKd1YHn5j4wJXvxinuMEHz9HCANEgDB1NvNGTy443nzzlUzbOiFmMudhBV5wzN9wQ7KNRwVSlU5OlmKO3gBw/gvCAZEKmsHMcDKvUpkKrcDvIMkEA6cCg3Wms8+Le/4EyvRr2VOu+rTXX01/rJ97bcsLGXddJuxc2xvKW6QZEWGtRiK90zkUCaY+PJH1djmjCEb8JIrdGhYy3CMrS3SEVxgPQl0rduAg+z3FtWR4GMttWA7lU1/bPtCIhM+OzgFd/Dy79DuNw4+tbjzEINJUgPpmpYL+1GbsjZ+R48B9pppM+rzKrdfxsOdSvEjTQewn0L14
+    INVIDIOUS_DB_PASSWORD: AgA3xb3XXIxHQVbjaZGb6xkWwrr5HSN8B/iF4Kl0EaQyivs7fYqoE3daylu/2x6D0btH/JYWK9+NeyFVNXPCy3holiteD5/9mJFqBCbtkAFxF0lKyLRjtw5BB6Wp5b/HuVJuLQG4sd+TB9XMGDeRyRkXjTRH0NbXYMlcVILAugb3vBNVCcLQqzlHbOngEMOUZxuUcMPL8crOGOmKosTKrWyt2weAFawlXkiz/cwlvdOmgMb8KWI1opEVAKv4OeUQeGRqa9+7fn0CcuM0PLzBvYPa2eoUb4dTFBzZfKpL5/mmZ9NUXEvV1dXN1oBHLHkIS8wBLhHAt8/Mh1rjhd5IGiIWIwlDT2iBuqKLRjwYbVbT7Co8OuTqs7OvxuYVYlmfOZna2o+kF39oeTH/RtYy3atHBsnW6j7GaUJ7nCZfDUZw4xYcHya5v+h2GI76SVnxKhjNpMGjHZMdDUD/cl3rBp+6gHICOYGCi+Wy4EYXCRJkZs0K84AFlLxoDkxARw6eBpFT+QEVnuMDXRrdNqC/Te9p5jzGWvPvXlfCCkQ9hi4hoNmZxw5P/nXdXg1rALiCVZbnM3O/Ud7KwgtYqNSCThPOj/BoExsQE4xSUJzAm35R0/AidOhOTVxztMba5co9Stavj772lRyV5PNbIieXDu6WNdOJNjjiRhuPzQTqbLzRbSa1I+KBDcbkmbOEBuyhXe1EoBp7anoHrKLYyw==
+    INVIDIOUS_HMAC_KEY: AgBqsFM5UcFmJQwCPG/xl6ZZus6u/uIlJtxsQGR1p+kWcI1DOfCqLCURxku7yuEi82HizZYDSrQ1X8rLtuBVJmCvCsgWclC+3N1zpUCBhbzzPSSa/U66D7LdDpYAgfMDpkiRMXFOZBGCZtYL7I5Wgp2vxYpjsWVXdk5GXFWbR8Dw5ndUROd2+LmrtJxaWeLiEY7OKHPZ8csEwGibIvQlyBsqPON0jKG70nes1oMFmy1TgmdYpRuW5ZwBCFu1ChpL+Ital1IR8TbSW6K2nXdpku+J+WE9CT4nFQLH/NhWsRw8MWPBp2IGnAr+/iIJJYqbfUGIzMnMpvKZW6Xna/mEBJ826WoCbs1CsUAtemmsIyDzO3tANvNEOr8UWpKm7a62HN8Y3HOiduOoonrRVCS9c8jjt1M20z8JQD06fY6ymsOXEYaYkWesO2WieJtT/6qbJlkwx9RJrdMz7mlWcN5edilkF8X3TSw4YpHP7LhofliGjBYx/w2cWWCkWN1QJhbXt2CmYKxhHnAJS/S5Lmmxs3nNpF1mVOCjTIDFXmR86wG5gJEYS7PHw1ZlMUaOeU/uG0E4caGWwJfn3/Z3upZkuuu5oFy/nDodHD+V6YKHQTQ3dWdjTXJ1kW8vLRb3Roii7dxhXW0dFhdBjyX3P6+58PAkdiZzF89naVLW8x7niFrqW5fQ5M06W/PTQQKIO37bM7L/oy/9a3XQmM8dQeTt9d9g
   template:
     metadata:
       creationTimestamp: null

cluster/config/secrets/openvpn-secrets-sealed.yml

@@ -7,8 +7,8 @@ metadata:
   namespace: default
 spec:
   encryptedData:
-    OPENVPN_PASSWORD: AgCTUDZ/JAYAPs7rZLIzJ1OS1VAJRb4NoXOZw/iP2MLr1WRqG18+lR5btg4YEDfTnEPiYvXfKmviAe0BpgCyTWeP9L2IG7g4TRMvpV4diZ50VkEPb5Nx9SBxgl2RehefsQDgZyDnwUp+M4KQ3nY+VTKpp/wHcvd/DMVWb8HdvcEAZfpu9MqbSEY4KYbzaR0VRCKIlHSwGgfXV1pfLr2eRwwVmrm6Dq0MdjYTxBs6ghEIRbee56ICwjcSlEcTRySENf1KDWyCBLEYaXz7yUPuwinEmPwTnaDeubKDAQadRjayV8UCk9xRZTqFZH4bUzt1C8nXm4doWLTjh/KIvdrom2fENF8CZcKUJYYRenQGUJy9ry4W1uX4RCl0pp4jPoXqSvWK79J7tcXmQQeNM2eVA2w4xPiGrMJLIpmvojlh9OSpFoCOhN6nFV90hBBAjbQeAtsZkxuS2l2MBkh/4rpj4NHfh/ijwumh3gMpCX3oPGy7dtx0bG7HllWXbobc0X9AU46QJRr69MBDxAAIuu6dnlv7Taz3o33sjV3Kpvu6pkE3pu3Zz4MS1dtGq8YCqBBqQPW0QMDl53i+AXjfA/ZSZAMJrCztgLsKIBvB+oiqPPx9oFoeQkSVYRG6qmb8+cRlhWOC9JUSL+LOwJGQIJAwx1M/tciadI8ZMZH/BTbuKx2rjLedwANlT0TTwPb8sBItK7pPcABBwiak5ypjluM6MNXConTQdcuDYd0=
-    OPENVPN_USER: AgCWTYf4vtUD4Z6HeVzAVXnoD9FVyWPADJCrfCBj+o6iH3K5uViouu58zIc3L8WMESvpB7kSqyx2r+j0CXG9h6JzxtNiZl2K9K0tBD3wD7fdbOOFhcIBSJNHlwQgt/SJsrx1FswgX5AzsV7kD6jzbwfO8MGx8UDlcy+cjxzX7m7uI+yaJHbxniNWcyjOdiVYrbQLnVDnuNMFBN8RF/wQIs1Y0SJwDQEupqKj6BnootTM+/Rz1kXQv3bzCP3eVDzHnbsy/PttPiHcU/mLMfeW1/Uvy9WIuCJqi9r6LpuNWG46HxLkThwoDLJlAoHD3ILJtOumFtHjVKCjjIH4NlqGouz2fhTwdrswU94HfSTYimIjdHcNPi/x7Bd5siv3UdqC4vT+FOR71LoNvR0D5ohbFAE5ym4Fn50lHP2N1SPtMv/NAgniL1J2rZEJkzUD3zRP/DrvF0WpaT9guhjg6fIR2gVzZmeQq7NQMMXqoUcPCAKt3Tql4TqPkAhLfS1L+Zfs53wFnMLswtY3vX224YGZTIuI8kXf00Ur3H4qAXWDQldISJ2sm2SAboGNeWrIAtimrr25XanF62cyUJws7cQN2gEKlxU44+yU/YJa0AAWy77vTwhnqdLD7rcRW2XS6vL5JbeU7edVepAdxO2Y5by89brvGnKyt6o007wwWnXTc44yj+A//2SRMJ3Wf0rBDjC3AfioyUi6sRLBUFA0oqwZt5JrV0y9XyDhwPg=
+    OPENVPN_PASSWORD: AgB3+toB4VftD143lciuA8IeF2bd38Ufow9KzIqQPVaA3QnwWFDHdcRekGT58CGSmDPGqydGFamvFytSku6Tm1Be+aV6EJtDq6h46eCOHTNsl5lnZyvIjrSqZcRQH8jMeLmsuytbR9t2/wCxJh+fvPELESosfnRLSQfJeecBJozs8xdrnYcM3rtYxzJFIVA0eRLdaORS+y/drTyky0e0Qmb1x8XkyrmjKKwqksx97L7iPoRvmXtBnMQwDVFn0Cb97dN03p8+6VW456S3IPijgzhIocrtxuuFUKrdhp7r6yPmXDEqH6OK8+Hl4fore+Cf3C+g3H7oguZmu2JkmMjko38ifKfTOqcd3a/OhS+hR45JQp0WUCps2Fnea+Wnd/C9DyBsPDvkzaWJRe9RDdl/IYL67HdfXxR2i+XZPtO9OkVC1m75v3Ciw+ZExdYGDlivyulF5Mdb46sqmFXnKDpp+ozf9gx8jLg+SehMA2jq6Vcn7kMfdAqo0chbortaswIoSPnpT9kTvHx0MUvv7i61mh41OaWiR5TzZekvaj3w1aHRLMLhmva/tGYNHd78ibDP13NUSARAvUkpwKWIbSHu0ntKOsWmFBIWgz3jnvYmOFfUCILDZ+Ke7Qv8aZ27npuuly/soxcVVQRdpMFk36V4+M74iblM8/WKxLr9THL5zUul2kvDdFG+J3V9ZAmKNy1xsZIkCn2eLN70eAY5G+awnM98UAi0SQPnMXY=
+    OPENVPN_USER: AgCoczTvW89qV1innW6b3tonmQDQD8PpWz9lnV5s5aCYplxOpthsNJDWxM6vwnSPsiTe+yYxJyWdeU7Cm7rnOfWzVluodkCVI9a9aDwxm8s7F1opUWJfeuJS3sj9/tO95g5zLm5bNZPKkb3ZHIFEhg2DLtN3SZ7C6voTGmiTesaY4rYMi1FNbEMoTJ3uWfF6DT8Pu2IZfpoRKrSAbZ181lmg/BtpQNVLWCVciCmrLhmMZPSIcvruFN4Jzw9lNrOgPSdbAcLBePgDCmgMKrHAGgwIRFLKkLgC3351h+JWL1TkvgtN6rHUQJrEVvjBsa92UekbImxXygNWr91aIjgUkPR+dhxn98gRaTPGcNdCMWOp5ctZmK51aQqryJyT1CIMEtZ49tM+0g28yxL+McRVR4Tw7yPqEmdjBexg1QufMcQIdGCQ/Zymu829ZtlRBjkGgKFDdCd2Q89PhkVQuIoLt32OV6LnW9QMphHoy+7go9umk72eU7MqiwI+086GTqb1FcuWsoEognCyb+KaDJSVPSauLVNZ6UJCCF/p4oHaYPP7y8sxPgbfzaP7YIIqaMvjevva9wkFKSHashE2QloOXgTV/9gyoHSQJiteCgbkylNN3cGhofiv2+qZjxCFda/ROzB1c159aKLJlcfbLlYXi3xGpY75WIbAb322gDWEX7w0w0NUr/ijpY6lhWxetwqgBIYLaCLYZNOrHzdkL3wLU0Dsfh/ENVtI0wE=
   template:
     metadata:
       creationTimestamp: null

cluster/config/secrets/pihole-secrets-sealed.yml

@@ -0,0 +1,15 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: pihole-secrets
+  namespace: default
+spec:
+  encryptedData:
+    api_password: AgBgf97R5491tvpuCK7ZgJ5Qxg697XiuSs2jKM3FMVOStcSXDJv/+0QjJdZbmZ+jww0TeGDiZ2mPOkPsEKBETDDtR4X1zCPKIzxzOY9Gs3cX2N92NWeFQFwNN7LBF5b1CIb1Sh7OAmOtJUMv3woMbH06myfQlMuLhIxoHaRzicUJBven/DLJaYGXXHNMx5uLQv7VoPL0GyQtmo1Bf1yefGCzip+XZQ0zr+NB3pxDSYJDN/lq/VbBSZo/2I3G+RneGbA7W/JrliL/y7kgzjOFvTyxrH8e+d8BE0j5Kqzb92vRJnyOVaznzjI7pOpEO0txBEq93z5kbv7XYTXF0DKb7wjE7WDV1AUukRAhFSw1iqURL4Bew5Ni9imdHre56XfDiT6tlAee8uX7/WJ7mpWfE9YPLLhcV0IxvXanG6NAQdBJpkz6D/qSFjQg0RK5w3m8iqKUwba2enUwD2VZdbImTkAkDNRiVOuY36JJEza49pRU+aH9TC0kLk1w6Uv6DL400sUhRAHX7g+swHTPLy/KMe5lHSwmpQNRjUO7tkNTzf7JjFhKkCD/+NOIwTgY/x4PFMIctkBPkqOwiWgcy2aQ57vCSLxvY9nQkaFRsvOaIwVixfWsFqB12DH5mH+tYU7YzCgUo3ubv7RqDk4Z2WzMzowgkUeVHiCnxeJOuEKxudRXirDORkpGdbYZ5tT8WBTOMWo08u5XGv1MS8pxag==
+  template:
+    metadata:
+      name: pihole-secrets
+      namespace: default
+    type: Opaque

cluster/flux-system/gotk-sync.yaml

@@ -11,7 +11,7 @@ spec:
     branch: main
   secretRef:
     name: flux-system
-  url: ssh://git@gitea.akshun-lab.uk:222/akshun/public-k3s
+  url: ssh://git@gitea.akshun-lab.cc:222/aggarwalakshun/public-k3s.git
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization

cluster/helm/cert-manager/cert-manager-release.yml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: cert-manager
-      version: "v1.18.2"
+      version: "v1.19.0"
       sourceRef:
         kind: HelmRepository
         name: jetstack

cluster/helm/csi-driver-smb/csi-driver-smb-release.yml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: csi-driver-smb
-      version: "1.18.0"
+      version: "1.19.1"
       sourceRef:
         kind: HelmRepository
         name: csi-driver-smb
@@ -20,3 +20,6 @@ spec:
   upgrade:
     remediation:
       remediateLastFailure: true
+  values:
+    linux:
+      kubelet: /var/lib/kubelet

cluster/helm/fairwinds/goldilocks-release.yml

@@ -0,0 +1,29 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: goldilocks
+  namespace: goldilocks
+spec:
+  interval: 24h
+  chart:
+    spec:
+      chart: goldilocks
+      version: "10.1.0"
+      sourceRef:
+        kind: HelmRepository
+        name: fairwinds-stable
+        namespace: flux-system
+      interval: 24h
+  install:
+    createNamespace: true
+  upgrade:
+    remediation:
+      remediateLastFailure: true
+  values:
+    vpa:
+      enabled: true
+    dashboard:
+      service:
+        type: LoadBalancer
+        port: 9999

cluster/helm/fairwinds/goldilocks-repo.yml

@@ -0,0 +1,9 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: fairwinds-stable
+  namespace: flux-system
+spec:
+  interval: 24h
+  url: https://charts.fairwinds.com/stable

cluster/helm/intel-gpu/intel-device-operator.yml

@@ -0,0 +1,23 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: device-plugin-operator
+  namespace: gpu-operator
+spec:
+  interval: 24h
+  chart:
+    spec:
+      chart: intel-device-plugins-operator
+      version: "0.34.0"
+      sourceRef:
+        kind: HelmRepository
+        name: intel
+        namespace: flux-system
+      interval: 24h
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3

cluster/helm/intel-gpu/intel-plugin-operator.yml

@@ -0,0 +1,27 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: gpu-device-plugin
+  namespace: gpu-operator
+spec:
+  interval: 24h
+  chart:
+    spec:
+      chart: intel-device-plugins-gpu
+      version: "0.34.0"
+      sourceRef:
+        kind: HelmRepository
+        name: intel
+        namespace: flux-system
+      interval: 24h
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    sharedDevNum: 4
+    nodeSelector:
+      intel.feature.node.kubernetes.io/gpu: 'true'

cluster/helm/intel-gpu/intel-repo.yml

@@ -0,0 +1,9 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: intel
+  namespace: flux-system
+spec:
+  interval: 24h
+  url: https://intel.github.io/helm-charts

cluster/helm/longhorn/longhorn-release.yml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: longhorn
-      version: "1.9.0"
+      version: "1.10.0"
       sourceRef:
         kind: HelmRepository
         name: longhorn
@@ -22,11 +22,10 @@ spec:
       remediateLastFailure: true
   values:
     persistence:
-      defaultClass: true
+      defaultClass: false
       reclaimPolicy: Retain
     ingress:
       enabled: false
     service:
       ui:
-        type: LoadBalancer
-        port: 85
+        type: ClusterIP

cluster/helm/newt/newt-cred-sealed.yml

@@ -0,0 +1,16 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  name: newt-cred
+  namespace: newt-ns
+spec:
+  encryptedData:
+    NEWT_ID: AgANlHH+ezjEX2Vlu5VgJF0XVqQopfthSt1J1lRSIrB6gHooRKa/Nx55ZZwwJiOzgLz5Rm1XLL2AO9lP+r9gxkPp0QO6gBOciIT5JjF7KPYGd8Mz7JM3YvQmrmQVe5gwltoLcpNgNkOcqf2i4BvLKrsEfLzfYci6nH3paWaopi5pWdzSKmyfJfSL1LtftBBbWMZ4GYq54KiQM8+vrxH8QqnhKrASnd+zQ1Yb1NA0RiraSom8OZiStyvNo4F82bRyZWIBgp7O23gUXH4+Zf5ZbiH1hMiZZOwQfc+sRp3E9b3x5AZAMeWv6RSuRbfX/yODY2mwptAM5sAAaKAwnf53pUA9pqYN0/taAUrEQLd6TNw1nRAuxdZwsKCt/FnWkEo0WtVkiUeciNQMVrlCvQ6YvKU3+1fYYYSMuwpP4gBbjgLmeY+gQVcBwKi8eRHAxaRuhqBP22wdVozlKcA9UysRNu0VcnB5sAsxxpHwWMQgwJ7DvayMgX10tdnXDtBCYGNOeKuDnJWbkAEHAOLguYW8VsZSXB1a+1SQe/MVnTAPKTgqKwbD8Tf2pDOg11z/WwpRXLgRyahmxJt+li2vEE7PVjyVFF1ZN81TYlnlOiGkMSYB5bHT2zcQZ2hxa4J1QBzl3J1kAydyrCQZNvkzQ0vrtKSt6k8cAlsr61b4zPhX7IrSGjQw3zRjnAMAJc2zvDu2FB53641hZknoO2HsAZbqDXw=
+    NEWT_SECRET: AgAffzmD9CZCn4P3GNC0sT3h86iPpzvMvmELZpqUOfWsMgPq6cY/HSfd927ShxPEDZXrd1FLDu+tH9Ealk2duhkq0YEanaMu5j5x8/GiSctRdhtD6H8t4uONRXQjKWG2HaySz7oR+GcO8/EM6rEcki17HhI7px+dzLm7HowcBMvw2ne+RqthmdOlVvxeIzLejnWIrzY2wcuieK7r3zq+d3unZi9T7GbevmzCA5V3wQrWqvsNezHHj0BIJlIYn3Vzx5ZZN6pgUT8x0y8TteC+FtHDKgODHgtT2ZYkK+LR3wtCXgO1Y6NILr2Ijg96aeL8/TYY3e5T8q4cKr1HabYjfenCjigzuqS27m9u2wCI8Zv6ffWjEYUED4GQ8oXqMyE44pYrzzb+Do3V3Ezj6PMDEvtQaWJ78JvQaOdHnszXMXpAsIsKhgeo7WdiIJWBnFW9lYhC3OdxuW2yNi5lv9z/oJEB+13pmVHkTzYHqhollz1AAY5nna5+JHNNFbRfbj8pj7I07qjOj291e2jZ+p9LBkip5xNfVOeSoX8YOwn8aZTaZPKvPgSZFvFS54JlcO8KWIeqGOc2CKO0r+6GaysO+6LxHH8WGdxxh9JLlNZdcnunQ9Cxlh1vPTuxG7zhEu4KiWwL/5KAQf9Ksyd33WdgR4qNQGnfXccomGRD4fxral6K8jDJjDJlCUQcbYAl2n+eMu377YWkhW0ecMLgYiLzkyNdZO5HnuoNqHr+HsUD+4g7UNtb8cwFhj6uaX+6RXlBS/U=
+    PANGOLIN_ENDPOINT: AgCkSy8lFTJZJT0luEKhfSOMO9aeSsUvmxaLXc9+nDHmlDoWBv15q7uEsutXDr8OPuM9sl7g6KLfYFTlaPO502Wrw/FV6ncX6es/KfguEydAebdl3uZ096FcwaTGtcpd/mdo4W8z2348EnttoxeJ23tZWabZcYfyVu/UA4Sor05hpnYdTxK3mYra89dhb/u4Pz5BdQUKlseCIWiLqk7HON0nI775ANq8OJ6MZeMSZoAdjOdy24hw3SSwwpX1Y1p6Ior5UV9tiCXpbL5UVj6Wo4LIGkqBRomPQ3V6Furim5bhfLDNDYTFVqWo0UEa6eYwP6NgPZ+oxfI1pFdio1g39+iY9AHlJoYRDkYF0wJLjfGdnju4L+KXsdWiyQVXS7lX+GAohna3p3xSaOrFzYt3SxEQ9lGvUFrXIXB5UrBrN1iODpbRyJb6KdXNZM9SklKKycZ9WCfLzhWV1ppwReQrICR4JljngSMWuBGxjr90BlkvMSQVOFGrHSs9AeY/ymf6P1TQ8WwecivTZ3oK8x+NIqdJSXRr2HEZkNOfJH4hDcD9NLO/7Wt/bkp4sX8Bvs2MrZ466hHovm2ENC9Cz/LHZLpHHtidmBn4hgrT39Cjgbq6bPR2SBSQnoXB/FVA9zuqJ6E+Z69O3pdXtxTEIZAvtJ4BaEiOkzQzonScowNwklnkEaru/TSx50rNjfW2k2CNx/Tz7XZf4vEudRbxc1nzXxzkMnQyldheczPjnWvcTgI=
+  template:
+    metadata:
+      name: newt-cred
+      namespace: newt-ns
+    type: Opaque

cluster/helm/newt/newt-release.yml

@@ -0,0 +1,29 @@
+---
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: newt
+  namespace: newt-ns
+spec:
+  interval: 24h
+  chart:
+    spec:
+      chart: newt
+      version: "1.1.0"
+      sourceRef:
+        kind: HelmRepository
+        name: newt
+        namespace: flux-system
+      interval: 24h
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    newtInstances:
+      - name: main
+        enabled: true
+        auth:
+          existingSecretName: newt-cred

cluster/helm/newt/newt-repo.yml

@@ -0,0 +1,9 @@
+---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: newt
+  namespace: flux-system
+spec:
+  interval: 24h
+  url: https://charts.fossorial.io

cluster/helm/ollama/ollama-pvc.yml

@@ -1,34 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: ollama-pv
-  namespace: default
-spec:
-  capacity:
-    storage: 10Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  mountOptions:
-    - hard
-    - nfsvers=4.1
-  nfs:
-    path: /k3s/volumes/ollama
-    server: 10.0.0.123
-
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: ollama-pvc
-  namespace: default
-spec:
-  accessModes:
-    - ReadWriteMany
-  storageClassName: ""
-  volumeName: ollama-pv
-  resources:
-    requests:
-      storage: 10Gi

cluster/helm/prometheus/prometheus-release.yml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: prometheus
-      version: "27.24.0"
+      version: "27.40.1"
       sourceRef:
         kind: HelmRepository
         name: prometheus-community

config.js

@@ -1,7 +1,7 @@
 module.exports = {
   platform: 'gitea',
-  endpoint: 'https://gitea.akshun-lab.uk/api/v1',
-  gitAuthor: 'Renovate Bot <renovate@akshun-lab.uk>',
+  endpoint: 'https://gitea.akshun-lab.cc/api/v1',
+  gitAuthor: 'Renovate Bot <renovate@akshun-lab.cc>',
   username: 'renovate',
   autodiscover: false,
   onboardingConfig: {
@@ -10,5 +10,5 @@ module.exports = {
   },
   optimizeForDisabled: true,
   persistRepoData: true,
-  repositories: ["akshun/public-k3s"],
+  repositories: ["aggarwalakshun/public-k3s"],
 }

disabled/apps/authelia/authelia-pvc.yml

@@ -0,0 +1,14 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: authelia-ceph
+  namespace: default
+spec:
+  accessModes:
+    - ReadWriteOnce
+  volumeMode: Filesystem
+  resources:
+    requests:
+      storage: 100Mi
+  storageClassName: csi-rbd-sc

disabled/apps/authelia/authelia.yml

@@ -5,6 +5,8 @@ metadata:
   name: authelia
   namespace: default
 spec:
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: authelia
@@ -24,4 +26,4 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: authelia-pvc
+          claimName: authelia-ceph

disabled/apps/drone/drone-pvc.yml

@@ -0,0 +1,14 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: drone-longhorn
+  namespace: default
+spec:
+  accessModes:
+    - ReadWriteOnce
+  volumeMode: Filesystem
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: longhorn