Update renovate/renovate Docker tag to v41.31.1

.gitea/workflows/renovate.yml

@@ -1,25 +0,0 @@
-name: renovate
-
-on:
-  schedule:
-    - cron: "@daily"
-  workflow_dispatch:
-
-jobs:
-  renovate:
-    runs-on: ubuntu-latest
-    container:
-      image: renovate/renovate:41.97.7
-      options: |-
-        --network=bridge
-
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-
-      - name: Run Renovate
-        env:
-          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
-          GITHUB_COM_TOKEN: ${{ secrets.PAT_TOKEN }}
-        run: |
-          renovate

cluster/apps/authelia/authelia-pvc.yml

@@ -0,0 +1,34 @@
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: authelia-pv
+  namespace: default
+spec:
+  capacity:
+    storage: 100Mi
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  mountOptions:
+    - hard
+    - nfsvers=4.1
+  nfs:
+    path: /k3s/volumes/authelia
+    server: 10.0.0.123
+
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: authelia-pvc
+  namespace: default
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: authelia-pv
+  resources:
+    requests:
+      storage: 100Mi

cluster/apps/authelia/authelia.yml

@@ -5,8 +5,6 @@ metadata:
   name: authelia
   namespace: default
 spec:
-  strategy:
-    type: Recreate
   selector:
     matchLabels:
       app: authelia
@@ -26,4 +24,4 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: authelia-ceph
+          claimName: authelia-pvc

cluster/apps/bazarr/bazarr-pvc.yml

@@ -1,14 +1,34 @@
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: bazarr-pv
+  namespace: default
+spec:
+  capacity:
+    storage: 1Gi
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  mountOptions:
+    - hard
+    - nfsvers=4.1
+  nfs:
+    path: /k3s/volumes/bazarr
+    server: 10.0.0.123
+
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: bazarr-longhorn
+  name: bazarr-pvc
   namespace: default
 spec:
   accessModes:
-    - ReadWriteOnce
-  volumeMode: Filesystem
+    - ReadWriteMany
+  volumeName: bazarr-pv
+  storageClassName: ""
   resources:
     requests:
-      storage: 5Gi
-  storageClassName: longhorn
+      storage: 1Gi

cluster/apps/bazarr/bazarr.yml

@@ -5,8 +5,6 @@ metadata:
   name: bazarr
   namespace: default
 spec:
-  strategy:
-    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -18,7 +16,7 @@ spec:
     spec:
       containers:
       - name: bazarr
-        image: linuxserver/bazarr:1.5.3
+        image: linuxserver/bazarr:1.5.2
         ports:
         - containerPort: 6767
         env:
@@ -38,7 +36,7 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: bazarr-longhorn
+          claimName: bazarr-pvc
       - name: tv
         nfs:
           server: 10.0.0.123

cluster/apps/code-server/code-server-pvc.yml

@@ -1,14 +1,34 @@
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: code-server-pv
+  namespace: default
+spec:
+  capacity:
+    storage: 1Gi
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  mountOptions:
+    - hard
+    - nfsvers=4.1
+  nfs:
+    path: /k3s/volumes/code-server
+    server: 10.0.0.123
+
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: code-server-longhorn
+  name: code-server-pvc
   namespace: default
 spec:
   accessModes:
-    - ReadWriteOnce
-  volumeMode: Filesystem
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: code-server-pv
   resources:
     requests:
       storage: 1Gi
-  storageClassName: longhorn

cluster/apps/code-server/code-server-svc.yml

@@ -9,6 +9,6 @@ spec:
     app: code-server
   type: LoadBalancer
   ports:
-  - port: 8448
+  - port: 8443
     targetPort: 8443
     protocol: TCP

cluster/apps/code-server/code-server.yml

@@ -5,8 +5,6 @@ metadata:
   name: code-server
   namespace: default
 spec:
-  strategy:
-    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -18,7 +16,7 @@ spec:
     spec:
       containers:
       - name: code-server
-        image: lscr.io/linuxserver/code-server:4.104.3
+        image: lscr.io/linuxserver/code-server:4.101.2
         ports:
         - containerPort: 8443
         env:
@@ -46,4 +44,4 @@ spec:
       volumes:
       - name: code-server
         persistentVolumeClaim:
-          claimName: code-server-longhorn
+          claimName: code-server-pvc

cluster/apps/drone/drone-pvc.yml

@@ -0,0 +1,34 @@
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: drone-pv
+  namespace: default
+spec:
+  capacity:
+    storage: 1Gi
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  mountOptions:
+    - hard
+    - nfsvers=4.1
+  nfs:
+    path: /k3s/volumes/drone
+    server: 10.0.0.123
+
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: drone-pvc
+  namespace: default
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: drone-pv
+  resources:
+    requests:
+      storage: 1Gi

cluster/apps/drone/drone-svc.yml

@@ -2,14 +2,13 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: pihole-tcp-service
+  name: drone-server-service
   namespace: default
 spec:
-  type: LoadBalancer
   selector:
-    app: pihole
+    app.kubernetes.io/name: drone
+  type: LoadBalancer
   ports:
-  - port: 8585
+  - port: 4338
     targetPort: 80
     protocol: TCP
-    name: web

cluster/apps/drone/drone.yml

@@ -0,0 +1,75 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: drone
+  labels:
+    app.kubernetes.io/name: drone
+  namespace: default
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: drone
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: drone
+    spec:
+      initContainers:
+        - name: wait-for-gitea
+          image: busybox
+          command:
+          - sh
+          - -c
+          - |
+            while ! nc -z gitea-int-service 3000; do
+              echo "Waiting for Gitea to be ready..."
+              sleep 5
+            done
+            echo "Gitea is ready!"
+        - name: drone-server
+          image: drone/drone:2
+          restartPolicy: Always
+          env:
+          - name: DRONE_GITEA_SERVER
+            value: "https://gitea.akshun-lab.uk"
+          - name: DRONE_GITEA_CLIENT_ID
+            valueFrom:
+              secretKeyRef:
+                name: drone-gitea-secrets
+                key: client_id
+          - name: DRONE_GITEA_CLIENT_SECRET
+            valueFrom:
+              secretKeyRef:
+                name: drone-gitea-secrets
+                key: client_secret
+          - name: DRONE_RPC_SECRET
+            valueFrom:
+              secretKeyRef:
+                name: drone-gitea-secrets
+                key: rpc_secret
+          - name: DRONE_SERVER_HOST
+            value: "drone.akshun-lab.uk"
+          - name: DRONE_SERVER_PROTO
+            value: "https"
+          volumeMounts:
+          - name: drone-data
+            mountPath: /data
+      containers:
+      - name: drone-runner
+        image: drone/drone-runner-kube:latest
+        env:
+        - name: DRONE_RPC_SERVER
+          value: "http://localhost:80"
+        - name: DRONE_RPC_SECRET
+          valueFrom:
+            secretKeyRef:
+              name: drone-gitea-secrets
+              key: rpc_secret
+        - name: DRONE_RPC_HOST
+          value: "localhost:80"
+      volumes:
+      - name: drone-data
+        persistentVolumeClaim:
+          claimName: drone-pvc

cluster/apps/ersatztv/ersatztv-pvc.yml

@@ -1,14 +1,34 @@
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: ersatztv-pv
+  namespace: default
+spec:
+  capacity:
+    storage: 1Gi
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  mountOptions:
+    - hard
+    - nfsvers=4.1
+  nfs:
+    path: /k3s/volumes/ersatztv
+    server: 10.0.0.123
+
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: ersatztv-longhorn
+  name: ersatztv-pvc
   namespace: default
 spec:
   accessModes:
-    - ReadWriteOnce
-  volumeMode: Filesystem
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: ersatztv-pv
   resources:
     requests:
-      storage: 5Gi
-  storageClassName: longhorn
+      storage: 1Gi

cluster/apps/ersatztv/ersatztv.yml

@@ -5,8 +5,6 @@ metadata:
   name: ersatztv
   namespace: default
 spec:
-  strategy:
-    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -18,7 +16,7 @@ spec:
     spec:
       containers:
       - name: ersatztv
-        image: jasongdove/ersatztv:v25.7.1
+        image: jasongdove/ersatztv:v25.2.0-vaapi
         ports:
         - containerPort: 8409
         volumeMounts:
@@ -40,7 +38,7 @@ spec:
       volumes:
       - name: data
         persistentVolumeClaim:
-          claimName: ersatztv-longhorn
+          claimName: ersatztv-pvc
       - name: i915
         hostPath:
           path: /dev/dri

cluster/apps/flaresolverr/flaresolverr.yml

@@ -5,8 +5,6 @@ metadata:
   name: flaresolverr
   namespace: default
 spec:
-  strategy:
-    type: Recreate
   replicas: 1
   selector:
     matchLabels:

cluster/apps/ghostfolio/ghostfolio-pvc.yml

@@ -1,14 +1,34 @@
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: ghostfolio-pv
+  namespace: default
+spec:
+  capacity:
+    storage: 1Gi
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  mountOptions:
+    - hard
+    - nfsvers=4.1
+  nfs:
+    path: /k3s/volumes/ghostfolio
+    server: 10.0.0.123
+
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: ghostfolio-longhorn
+  name: ghostfolio-pvc
   namespace: default
 spec:
   accessModes:
-    - ReadWriteOnce
-  volumeMode: Filesystem
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: ghostfolio-pv
   resources:
     requests:
       storage: 1Gi
-  storageClassName: longhorn

cluster/apps/ghostfolio/ghostfolio.yml

@@ -5,8 +5,6 @@ metadata:
   name: ghostfolio
   namespace: default
 spec:
-  strategy:
-    type: Recreate
   selector:
     matchLabels:
       app: ghostfolio
@@ -78,7 +76,7 @@ spec:
               key: postgres-password
       containers:
       - name: ghostfolio
-        image: docker.io/ghostfolio/ghostfolio:2.208.0
+        image: docker.io/ghostfolio/ghostfolio:2.180.0
         securityContext:
           capabilities:
             drop:
@@ -123,4 +121,4 @@ spec:
       volumes:
       - name: ghostfolio-data
         persistentVolumeClaim:
-          claimName: ghostfolio-longhorn
+          claimName: ghostfolio-pvc

cluster/apps/gitea-act/gitea-act-pvc.yml

@@ -1,14 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: gitea-act-runner-longhorn
-  namespace: default
-spec:
-  accessModes:
-    - ReadWriteOnce
-  volumeMode: Filesystem
-  resources:
-    requests:
-      storage: 100Mi
-  storageClassName: longhorn

cluster/apps/gitea/gitea-db.yml

@@ -5,8 +5,6 @@ metadata:
   name: gitea-db
   namespace: default
 spec:
-  strategy:
-    type: Recreate
   selector:
     matchLabels:
       app: gitea-db
@@ -24,7 +22,7 @@ spec:
           mountPath: /var/lib/postgresql/data
       containers:
       - name: gitea-db
-        image: postgres:15.14
+        image: postgres:15.10
         ports:
         - containerPort: 5432
         env:
@@ -43,4 +41,4 @@ spec:
       volumes:
       - name: db
         persistentVolumeClaim:
-          claimName: gitea-db-longhorn
+          claimName: gitea-db-pvc

cluster/apps/gitea/gitea-pvc.yml

@@ -1,29 +1,69 @@
 ---
 apiVersion: v1
-kind: PersistentVolumeClaim
+kind: PersistentVolume
 metadata:
-  name: gitea-app-longhorn
+  name: gitea-app-pv
   namespace: default
 spec:
-  accessModes:
-    - ReadWriteOnce
+  capacity:
+    storage: 5Gi
   volumeMode: Filesystem
-  resources:
-    requests:
-      storage: 5Gi
-  storageClassName: longhorn
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  mountOptions:
+    - hard
+    - nfsvers=4.1
+  nfs:
+    path: /k3s/volumes/gitea/app/
+    server: 10.0.0.123
 
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: gitea-db-longhorn
+  name: gitea-app-pvc
   namespace: default
 spec:
   accessModes:
-    - ReadWriteOnce
-  volumeMode: Filesystem
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: gitea-app-pv
+  resources:
+    requests:
+      storage: 5Gi
+
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: gitea-db-pv
+  namespace: default
+spec:
+  capacity:
+    storage: 5Gi
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  mountOptions:
+    - hard
+    - nfsvers=4.1
+  nfs:
+    path: /k3s/volumes/gitea/db/
+    server: 10.0.0.123
+
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: gitea-db-pvc
+  namespace: default
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: gitea-db-pv
   resources:
     requests:
       storage: 5Gi
-  storageClassName: longhorn

cluster/apps/gitea/gitea.yml

@@ -5,8 +5,6 @@ metadata:
   name: gitea-app
   namespace: default
 spec:
-  strategy:
-    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -29,7 +27,7 @@ spec:
           done
       containers:
       - name: gitea
-        image: gitea/gitea:1.24.6
+        image: gitea/gitea:1.24.2
         ports:
         - containerPort: 22
         - containerPort: 3000
@@ -69,4 +67,4 @@ spec:
           type: File
       - name: gitea-data
         persistentVolumeClaim:
-          claimName: gitea-app-longhorn
+          claimName: gitea-app-pvc

cluster/apps/gotenberg/gotenberg-svc.yml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: gotenberg-service
-  namespace: default
-spec:
-  selector:
-    app: gotenberg
-  type: ClusterIP
-  ports:
-  - port: 3000
-    targetPort: 3000

cluster/apps/gotenberg/gotenberg.yml

@@ -1,30 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: gotenberg
-  namespace: default
-spec:
-  selector:
-    matchLabels:
-      app: gotenberg
-  template:
-    metadata:
-      labels:
-        app: gotenberg
-    spec:
-      securityContext:
-        runAsUser: 1001
-      containers:
-      - name: gotenberg
-        image: gotenberg/gotenberg:8.24
-        command:
-        - sh
-        - -c
-        - |
-          gotenberg --chromium-disable-javascript=true --chromium-allow-list=file:///tmp/.*
-        ports:
-        - containerPort: 3000
-        securityContext:
-          readOnlyRootFilesystem: false
-          allowPrivilegeEscalation: false
-          privileged: false

cluster/apps/homepage/homepage-config.yml

@@ -32,7 +32,7 @@ data:
             Proxmox (NVIDIA GPU):
                 style: row
                 columns: 5
-                tab: Stats
+                tab: Stats       
             Proxmox (AMD GPU):
                 style: row
                 columns: 5
@@ -51,154 +51,84 @@ data:
                 tab: Bookmarks
         useEqualHeights: true
         hideErrors: true
-        statusStyle: "dot"
-        background: /images/sur.png
+        background: /images/background.png
     services.yaml: |
         - Apps:
               - Sonarr:
-                    href: https://sonarr.akshun-lab.cc
+                    href: https://sonarr.akshun-lab.uk
                     description: series
                     icon: sonarr.png
-                    namespace: default
-                    podSelector: app=sonarr
-                    app: sonarr
                     widget:
                         type: sonarr
                         url: http://10.0.0.14:8989
                         key: "${SONARR_API_KEY}"
               - Radarr:
-                    href: https://radarr.akshun-lab.cc
+                    href: https://radarr.akshun-lab.uk
                     description: movies
                     icon: radarr.png
-                    namespace: default
-                    podSelector: app=radarr
-                    app: radarr
                     widget:
                         type: radarr
                         url: http://10.0.0.14:7878
                         key: "${RADARR_API_KEY}"
               - Bazarr:
-                    href: https://bazarr.akshun-lab.cc
+                    href: https://bazarr.akshun-lab.uk
                     description: subtitles
                     icon: bazarr.png
-                    namespace: default
-                    podSelector: app=bazarr
-                    app: bazarr
                     widget:
                         type: bazarr
                         url: http://10.0.0.14:6767
                         key: "${BAZARR_API_KEY}"
               - Jellyfin:
-                    href: https://jellyfin.akshun-lab.cc
+                    href: https://jellyfin.akshun-lab.uk
                     description: streaming
                     icon: jellyfin.png
-                    namespace: default
-                    podSelector: app=jellyfin
-                    app: jellyfin
                     widget:
                         type: jellyfin
                         url: http://10.0.0.14:8096
                         key: "${JELLYFIN_API_KEY}"
               - qBittorrent:
-                    href: https://qbittorrent.akshun-lab.cc
+                    href: https://qbittorrent.akshun-lab.uk
                     description: torrent client
                     icon: qbittorrent.png
-                    namespace: default
-                    podSelector: app=qbittorrent
-                    app: qbittorrent
                     widget:
                         type: qbittorrent
                         username: admin
                         password: "${QBITTORRENT_PASSWORD}"
                         url: http://10.0.0.14:8080
               - Jellyseerr:
-                    href: https://jellyseerr.akshun-lab.cc
+                    href: https://jellyseerr.akshun-lab.uk
                     description: request movies and shows
                     icon: jellyseerr.png
-                    namespace: default
-                    podSelector: app=jellyseerr
-                    app: jellyseerr
                     widget:
                         type: jellyseerr
                         url: http://10.0.0.14:5055
                         key: "${JELLYSEERR_API_KEY}"
               - Prowlarr:
-                    href: https://prowlarr.akshun-lab.cc
+                    href: https://prowlarr.akshun-lab.uk
                     description: indexers
                     icon: prowlarr.png
-                    namespace: default
-                    podSelector: app=prowlarr
-                    app: prowlarr
                     widget:
                         type: prowlarr
                         url: http://10.0.0.14:9696
                         key: "${PROWLARR_API_KEY}"
               - Speedtest:
-                    href: https://speedtest.akshun-lab.cc
+                    href: https://speedtest.akshun-lab.uk
                     description: speedtest
                     icon: si-speedtest.svg
-                    namespace: default
-                    podSelector: app=speedtest
-                    app: speedtest
                     widget:
                         type: speedtest
                         url: http://10.0.0.14:8181
               - Immich:
-                    href: https://immich.akshun-lab.cc
+                    href: https://immich.akshun-lab.uk
                     description: photos
                     icon: immich.png
-                    namespace: default
-                    podSelector: app=immich-app
-                    app: immich-app
                     widget:
                         type: immich
                         url: http://10.0.0.14:2283
                         key: "${IMMICH_API_KEY}"
                         version: 2
-              - Gitea:
-                    href: https://gitea.akshun-lab.cc
-                    description: Git Server
-                    icon: gitea.png
-                    namespace: default
-                    podSelector: app=gitea-app
-                    app: gitea-app
-                    widget:
-                        type: gitea
-                        url: http://10.0.0.14:3011
-                        key: "${GITEA_API_KEY}"
-                        fields: ["repositories", "issues", "pulls"]
-              - Pihole:
-                    href: https://pihole.akshun-lab.cc/admin
-                    description: ad blocker
-                    icon: pi-hole.png
-                    namespace: default
-                    podSelector: app=pihole
-                    app: pihole
-                    widget:
-                        type: pihole
-                        url: http://10.0.0.14:8585
-                        version: 6
-                        key: "${PIHOLE_PASSWORD}"
-              - Nextcloud:
-                    href: https://nextcloud.akshun-lab.cc
-                    description: files
-                    icon: nextcloud.png
-                    namespace: default
-                    podSelector: app=nextcloud
-                    app: nextcloud
-                    widget:
-                        type: nextcloud
-                        url: https://10.0.0.14:9200
-                        key: "${NEXTCLOUD_PASSWORD}"
-              - Crafty:
-                    href: https://crafty.akshun-lab.cc
-                    description: minecraft server manager
-                    icon: crafty-controller.png
-                    widget:
-                        type: minecraft
-                        url: udp://192.168.1.3:25565
               - Proxmox:
-                    href: https://proxmox.akshun-lab.cc
+                    href: https://proxmox.akshun-lab.uk
                     description: VMs
                     icon: proxmox.png
                     widget:
@@ -206,77 +136,82 @@ data:
                         url: https://10.0.0.100:8006
                         username: api@pam!homepage
                         password: "${PROXMOX_PASSWORD}"
-              - Proxmox Backup Server:
-                    href: https://pbs.akshun-lab.cc
-                    description: backup server
-                    icon: proxmox.png
+              - Gitea:
+                    href: https://gitea.akshun-lab.uk
+                    description: Git Server
+                    icon: gitea.png
                     widget:
-                        type: proxmoxbackupserver
-                        url: https://192.168.1.112:8007
-                        username: root@pam!homepage
-                        password: "${PROXMOX_BACKUP_SERVER_PASSWORD}"
-                        datastore: backups
-                        fields: ["datastore_usage", "cpu_usage", "memory_usage"]
+                        type: gitea
+                        url: http://10.0.0.14:3011
+                        key: "${GITEA_API_KEY}"
+                        fields: ["repositories", "issues", "pulls"]
+              - Crafty:
+                    href: https://minecraft.akshun-lab.uk
+                    description: crafty controller
+                    icon: crafty-controller.png
+                    widget:
+                        type: minecraft
+                        url: udp://192.168.1.3:25565
               - Invidious:
-                    href: https://invidious.akshun-lab.cc
+                    href: https://invidious.akshun-lab.uk
                     description: youtube frontend
-                    namespace: default
-                    podSelector: app=invidious
-                    app: invidious
                     icon: invidious.png
+              - Nextcloud:
+                    href: https://nextcloud.akshun-lab.uk
+                    description: files
+                    icon: nextcloud.png
               - VS Code:
-                    href: https://vs.akshun-lab.cc
+                    href: https://vs.akshun-lab.uk
                     description: VS code server
                     icon: vscode.png
-                    namespace: default
-                    podSelector: app=code-server
-                    app: code-server
               - Semaphore:
-                    href: https://semaphore.akshun-lab.cc
+                    href: https://semaphore.akshun-lab.uk
                     description: ansible gui
                     icon: semaphore.png
-                    namespace: default
-                    podSelector: app=semaphore
-                    app: semaphore
+              - Open Media Vault:
+                    href: https://omv.akshun-lab.uk
+                    description: NAS
+                    icon: openmediavault.png
               - Ersatztv:
                     icon: ersatztv.png
                     description: live tv for jellyfin
-                    href: https://ersatztv.akshun-lab.cc
-                    namespace: default
-                    podSelector: app=ersatztv
-                    app: ersatztv
+                    href: https://ersatztv.akshun-lab.uk
               - Jellystat:
                     icon: jellystat.png
                     description: jellyfin stats
-                    href: https://jellystat.akshun-lab.cc
-                    namespace: default
-                    podSelector: app=jellystat
-                    app: jellystat
+                    href: https://jellystat.akshun-lab.uk
               - Paperless NGX:
                     icon: paperless.png
                     description: documents OCR
-                    href: https://ngx.akshun-lab.cc
-                    namespace: default
-                    podSelector: app=paperless-ngx
-                    app: paperless-ngx
+                    href: https://ngx.akshun-lab.uk
+              - Longhorn:
+                    icon: longhorn.png
+                    description: kubernetes storage
+                    href: https://longhorn.akshun-lab.uk
+              - Portainer:
+                    icon: portainer.png
+                    description: container management
+                    href: https://portainer.akshun-lab.uk
+              - Rancher:
+                    icon: rancher.png
+                    description: kubernetes management
+                    href: https://rancher.akshun-lab.uk
+              - Open-WebUI:
+                    icon: ollama.png
+                    description: ollama Frontend
+                    href: https://ollama.akshun-lab.uk
               - Ghostfolio:
                     icon: ghostfolio.png
                     description: portfolio analyzer
-                    href: https://ghost.akshun-lab.cc
-                    namespace: default
-                    podSelector: app=ghostfolio
-                    app: ghostfolio
-              - Searxng:
-                    icon: searxng.png
-                    description: search engine
-                    href: https://sear.akshun-lab.cc
-                    namespace: default
-                    podSelector: app=searxng
-                    app: searxng
-              - Open Media Vault:
-                    href: http://192.168.1.4
-                    description: NAS
-                    icon: openmediavault.png
+                    href: https://ghost.akshun-lab.uk
+              - AdGuardHome:
+                    icon: adguard-home.png
+                    description: ad blocker
+                    href: https://adguard.akshun-lab.uk
+              - Drone:
+                    icon: drone.png
+                    description: CI/CD
+                    href: https://drone.akshun-lab.uk
         - Bookmarks:
               - Disney:
                     href: https://www.hotstar.com
@@ -303,93 +238,78 @@ data:
         - Proxmox (AMD GPU):
               - CPU Usage:
                     widget:
-                        version: 4
                         type: glances
                         url: http://192.168.1.113:61208
                         metric: cpu
               - Memory Usage:
                     widget:
-                        version: 4
                         type: glances
                         url: http://192.168.1.113:61208
                         metric: memory
               - Processes:
                     widget:
-                        version: 4
                         type: glances
                         url: http://192.168.1.113:61208
                         metric: process
               - Sensor:
                     widget:
-                        version: 4
                         type: glances
                         url: http://192.168.1.113:61208
                         metric: sensor:Tctl
               - Disk Usage:
                     widget:
-                        version: 4
                         type: glances
                         url: http://192.168.1.113:61208
                         metric: disk:sdb
         - Proxmox (NVIDIA GPU):
               - CPU Usage:
                     widget:
-                        version: 4
                         type: glances
                         url: http://192.168.1.126:61208 
                         metric: cpu
               - Memory Usage:
                     widget:
-                        version: 4
                         type: glances
                         url: http://192.168.1.126:61208
                         metric: memory
               - Processes:
                     widget:
-                        version: 4
                         type: glances
                         url: http://192.168.1.126:61208
                         metric: process
               - Sensor:
                     widget:
-                        version: 4
                         type: glances
                         url: http://192.168.1.126:61208
                         metric: sensor:Package id 0
               - Disk Usage:
                     widget:
-                        version: 4
                         type: glances
                         url: http://192.168.1.126:61208
                         metric: disk:nvme0n1
         - Proxmox (Asus):
               - CPU Usage:
                     widget:
-                        version: 4
                         type: glances
                         url: http://192.168.1.199:61208
                         metric: cpu
               - Memory Usage:
                     widget:
-                        version: 4
                         type: glances
                         url: http://192.168.1.199:61208
                         metric: memory
               - Processes:
                     widget:
-                        version: 4
                         type: glances
                         url: http://192.168.1.199:61208
                         metric: process
               - Sensor:
                     widget:
-                        version: 4
                         type: glances
                         url: http://192.168.1.199:61208
                         metric: sensor:Sensor 1
               - Disk Usage:
                     widget:
-                        version: 4
                         type: glances
                         url: http://192.168.1.199:61208
                         metric: disk:nvme0n1

cluster/apps/homepage/homepage-pvc.yml

@@ -1,14 +1,34 @@
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: homepage-pv
+  namespace: default
+spec:
+  capacity:
+    storage: 100Mi
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  mountOptions:
+    - hard
+    - nfsvers=4.1
+  nfs:
+    path: /k3s/volumes/homepage
+    server: 10.0.0.123
+
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: homepage-longhorn
+  name: homepage-pvc
   namespace: default
 spec:
   accessModes:
-    - ReadWriteOnce
-  volumeMode: Filesystem
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: homepage-pv
   resources:
     requests:
       storage: 100Mi
-  storageClassName: longhorn

cluster/apps/homepage/homepage.yml

@@ -10,7 +10,7 @@ spec:
   revisionHistoryLimit: 3
   replicas: 1
   strategy:
-    type: Recreate
+    type: RollingUpdate
   selector:
     matchLabels:
       app.kubernetes.io/name: homepage
@@ -42,11 +42,11 @@ spec:
               subPath: services.yaml
       containers:
         - name: homepage
-          image: "ghcr.io/gethomepage/homepage:v1.5.0"
+          image: "ghcr.io/gethomepage/homepage:v1.3.2"
           imagePullPolicy: IfNotPresent
           env:
             - name: HOMEPAGE_ALLOWED_HOSTS
-              value: home.akshun-lab.cc
+              value: home.akshun-lab.uk
           ports:
             - name: http
               containerPort: 3000
@@ -86,7 +86,7 @@ spec:
             name: homepage
         - name: images
           persistentVolumeClaim:
-            claimName: homepage-longhorn
+            claimName: homepage-pvc
         - name: logs
           emptyDir: {}
         - name: tmp

cluster/apps/immich/immich-db.yml

@@ -15,7 +15,7 @@ spec:
     spec:
       containers:
       - name: redis
-        image: docker.io/valkey/valkey:8-bookworm@sha256:fea8b3e67b15729d4bb70589eb03367bab9ad1ee89c876f54327fc7c6e618571
+        image: docker.io/valkey/valkey:8-bookworm@sha256:facc1d2c3462975c34e10fccb167bfa92b0e0dbd992fc282c29a61c3243afb11
         env:
         - name: REDIS_HOSTNAME
           value: "immich-redis"

cluster/apps/immich/immich-ml.yml

@@ -1,42 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: immich-ml
-  namespace: default
-spec:
-  strategy:
-    type: Recreate
-  replicas: 1
-  selector:
-    matchLabels:
-      app: immich-ml
-  template:
-    metadata:
-      labels:
-        app: immich-ml
-    spec:
-      containers:
-      - name: immich-machine-learning
-        image: ghcr.io/immich-app/immich-machine-learning:v2.0.1-openvino
-        ports:
-        - containerPort: 3003
-        env:
-        - name: REDIS_HOSTNAME
-          value: "immich-redis-service"
-        - name: NVIDIA_VISIBLE_DEVICES
-          value: "all"
-        - name: MACHINE_LEARNING_DEVICE_IDS
-          value: "0"
-        volumeMounts:
-        - name: model-cache
-          mountPath: /cache
-        resources:
-          requests:
-            gpu.intel.com/i915: "1"
-          limits:
-            gpu.intel.com/i915: "1"
-      volumes:
-      - name: model-cache
-        persistentVolumeClaim:
-          claimName: immich-cache-longhorn

cluster/apps/immich/immich-pvc.yml

@@ -1,17 +1,37 @@
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: immich-cache-pv
+  namespace: default
+spec:
+  capacity:
+    storage: 10Gi
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  mountOptions:
+    - hard
+    - nfsvers=4.1
+  nfs:
+    path: /k3s/volumes/immich/cache/
+    server: 10.0.0.123
+
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: immich-cache-longhorn
+  name: immich-cache-pvc
   namespace: default
 spec:
   accessModes:
-    - ReadWriteOnce
-  volumeMode: Filesystem
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: immich-cache-pv
   resources:
     requests:
       storage: 10Gi
-  storageClassName: longhorn
 
 ---
 apiVersion: v1
@@ -47,9 +67,9 @@ metadata:
   name: immich-pictures-pvc
   namespace: default
 spec:
+  storageClassName: immich-pictures-pv
   accessModes:
     - ReadWriteMany
-  storageClassName: immich-pictures-pv
   resources:
     requests:
-      storage: 100Gi
+      storage: 10Gi

cluster/apps/immich/immich-svc.yml

@@ -21,7 +21,7 @@ metadata:
 spec:
   type: LoadBalancer
   selector:
-    app: immich-ml
+    app: immich-app
   ports:
   - port: 3333
     targetPort: 3003

cluster/apps/immich/immich.yml

@@ -5,8 +5,6 @@ metadata:
   name: immich-app
   namespace: default
 spec:
-  strategy:
-    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -16,6 +14,9 @@ spec:
       labels:
         app: immich-app
     spec:
+      runtimeClassName: nvidia
+      nodeSelector:
+        type: immich
       initContainers:
       - name: wait-for-redis
         image: busybox
@@ -39,7 +40,7 @@ spec:
           done
       containers:
       - name: immich-server
-        image: ghcr.io/immich-app/immich-server:v2.0.1
+        image: ghcr.io/immich-app/immich-server:v1.135.3
         ports:
         - containerPort: 2283
         env:
@@ -61,7 +62,24 @@ spec:
         volumeMounts:
         - mountPath: /usr/src/app/upload
           name: pictures
+      - name: immich-machine-learning
+        image: ghcr.io/immich-app/immich-machine-learning:v1.135.3-cuda
+        ports:
+        - containerPort: 3003
+        env:
+        - name: REDIS_HOSTNAME
+          value: "immich-redis-service"
+        - name: NVIDIA_VISIBLE_DEVICES
+          value: "all"
+        - name: MACHINE_LEARNING_DEVICE_IDS
+          value: "0"
+        volumeMounts:
+        - name: model-cache
+          mountPath: /cache
       volumes:
       - name: pictures
         persistentVolumeClaim:
           claimName: immich-pictures-pvc
+      - name: model-cache
+        persistentVolumeClaim:
+          claimName: immich-cache-pvc

cluster/apps/invidious/invidious-config.yml

@@ -13,7 +13,8 @@ data:
       host: localhost
       port: 5432
     check_tables: true
-    invidious_companion:
-    - private_url: "http://localhost:8282/companion"
-    invidious_companion_key: ${INVIDIOUS_COMPANION_KEY}
+    signature_server: localhost:12999
+    visitor_data: ${VISITOR_DATA}
+    po_token: ${PO_TOKEN}
+    port: 3000
     hmac_key: ${INVIDIOUS_HMAC_KEY}

cluster/apps/invidious/invidious-pvc.yml

@@ -1,14 +1,34 @@
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: invidious-pv
+  namespace: default
+spec:
+  capacity:
+    storage: 1Gi
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  mountOptions:
+    - hard
+    - nfsvers=4.1
+  nfs:
+    path: /k3s/volumes/invidious
+    server: 10.0.0.123
+
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: invidious-longhorn
+  name: invidious-pvc
   namespace: default
 spec:
   accessModes:
-    - ReadWriteOnce
-  volumeMode: Filesystem
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: invidious-pv
   resources:
     requests:
       storage: 1Gi
-  storageClassName: longhorn

cluster/apps/invidious/invidious.yml

@@ -5,8 +5,6 @@ metadata:
   name: invidious
   namespace: default
 spec:
-  strategy:
-    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -44,7 +42,7 @@ spec:
         - name: postgres-data
           mountPath: /var/lib/postgresql/data
       - name: postgres
-        image: postgres:15.14
+        image: postgres:15.13
         restartPolicy: Always
         env:
         - name: POSTGRES_DB
@@ -65,22 +63,21 @@ spec:
         volumeMounts:
         - name: postgres-data
           mountPath: /var/lib/postgresql/data
-      - name: inv-companion
-        image: quay.io/invidious/invidious-companion@sha256:a96f7a1eb88bf0d5882d519c9410f8c7b2d391cafc378b72f3bfd37dd5f0e587
+      - name: inv-sig-helper
+        image: quay.io/invidious/inv-sig-helper@sha256:b5466c9add729e82e4e3ee5515c30b69df02d78ebb2486dbc9c63e456f29083d
         restartPolicy: Always
+        args: ["--tcp", "0.0.0.0:12999"]
         env:
-        - name: SERVER_SECRET_KEY
-          valueFrom:
-            secretKeyRef:
-              name: invidious-secrets
-              key: INVIDIOUS_COMPANION_KEY
+        - name: RUST_LOG
+          value: "info"
         securityContext:
+          readOnlyRootFilesystem: true
           capabilities:
             drop:
             - ALL
       containers:
       - name: invidious
-        image: quay.io/invidious/invidious@sha256:2836b5b8226a53a9cc2afdbd5f5fe6bccdd200f2e17cd92a828b4dc8d8b5cc06
+        image: quay.io/invidious/invidious@sha256:9ffa4f1ea5cf01abe3102777102bd7a13153c79f6ff6ac072b6a29dda6909a8b
         command:
         - sh
         - -c
@@ -108,4 +105,4 @@ spec:
           name: invidious-config
       - name: postgres-data
         persistentVolumeClaim:
-          claimName: invidious-longhorn
+          claimName: invidious-pvc

cluster/apps/jellyfin/jellyfin-pvc.yml

@@ -1,14 +1,34 @@
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: jellyfin-pv
+  namespace: default
+spec:
+  capacity:
+    storage: 20Gi
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  mountOptions:
+    - hard
+    - nfsvers=4.1
+  nfs:
+    path: /k3s/volumes/jellyfin/
+    server: 10.0.0.123
+
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: jellyfin-longhorn
+  name: jellyfin-pvc
   namespace: default
 spec:
   accessModes:
-    - ReadWriteOnce
-  volumeMode: Filesystem
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: jellyfin-pv
   resources:
     requests:
       storage: 20Gi
-  storageClassName: longhorn

cluster/apps/jellyfin/jellyfin.yml

@@ -5,8 +5,6 @@ metadata:
   name: jellyfin
   namespace: default
 spec:
-  strategy:
-    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -24,6 +22,8 @@ spec:
         volumeMounts:
         - name: media
           mountPath: /media
+          readOnly: true
+          recursiveReadOnly: Enabled
         - name: config
           mountPath: /config
         - name: cache
@@ -40,7 +40,7 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: jellyfin-longhorn
+          claimName: jellyfin-pvc
       - name: cache
         hostPath:
           path: /tmp/

cluster/apps/jellyseerr/jellyseerr-pvc.yml

@@ -1,14 +1,34 @@
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: jellyseerr-pv
+  namespace: default
+spec:
+  capacity:
+    storage: 1Gi
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  mountOptions:
+    - hard
+    - nfsvers=4.1
+  nfs:
+    path: /k3s/volumes/jellyseerr
+    server: 10.0.0.123
+
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: jellyseerr-longhorn
+  name: jellyseerr-pvc
   namespace: default
 spec:
   accessModes:
-    - ReadWriteOnce
-  volumeMode: Filesystem
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: jellyseerr-pv
   resources:
     requests:
       storage: 1Gi
-  storageClassName: longhorn

cluster/apps/jellyseerr/jellyseerr.yml

@@ -5,8 +5,6 @@ metadata:
   name: jellyseerr
   namespace: default
 spec:
-  strategy:
-    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -16,31 +14,9 @@ spec:
       labels:
         app: jellyseerr
     spec:
-      initContainers:
-      - name: gluetun
-        image: qmcgaw/gluetun:v3.40.0
-        restartPolicy: Always
-        securityContext:
-          capabilities:
-            add:
-            - NET_ADMIN
-        envFrom:
-        - configMapRef:
-            name: gluetun-config
-        env:
-        - name: OPENVPN_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: openvpn-secrets
-              key: OPENVPN_PASSWORD
-        - name: OPENVPN_USER
-          valueFrom:
-            secretKeyRef:
-              name: openvpn-secrets
-              key: OPENVPN_USER
       containers:
       - name: jellyseerr
-        image: fallenbagel/jellyseerr:2.7.3
+        image: fallenbagel/jellyseerr:2.7.0
         ports:
         - containerPort: 5055
         env:
@@ -54,4 +30,4 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: jellyseerr-longhorn
+          claimName: jellyseerr-pvc

cluster/apps/jellystat/jellystat-pvc.yml

@@ -1,29 +1,34 @@
 ---
 apiVersion: v1
-kind: PersistentVolumeClaim
+kind: PersistentVolume
 metadata:
-  name: jellystat-longhorn
+  name: jellystat-pv
   namespace: default
 spec:
-  accessModes:
-    - ReadWriteOnce
+  capacity:
+    storage: 1Gi
   volumeMode: Filesystem
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: longhorn
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  mountOptions:
+    - hard
+    - nfsvers=4.1
+  nfs:
+    path: /k3s/volumes/jellystat
+    server: 10.0.0.123
 
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: jellystat-backups-longhorn
+  name: jellystat-pvc
   namespace: default
 spec:
   accessModes:
-    - ReadWriteOnce
-  volumeMode: Filesystem
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: jellystat-pv
   resources:
     requests:
       storage: 1Gi
-  storageClassName: longhorn

cluster/apps/jellystat/jellystat.yml

@@ -5,8 +5,6 @@ metadata:
   name: jellystat
   namespace: default
 spec:
-  strategy:
-    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -32,11 +30,10 @@ spec:
             secretKeyRef:
               name: jellystat-secret
               key: password
-        - name: PGDATA
-          value: /mnt/postgres/data
         volumeMounts:
-        - name: postgres-data
-          mountPath: /mnt/postgres
+        - name: backup
+          mountPath: /var/lib/postgresql/data
+          subPath: db
       containers:
       - name: jellystat
         image: cyfershepard/jellystat:1.1.6
@@ -60,12 +57,10 @@ spec:
               name: jellystat-secret
               key: jwt
         volumeMounts:
-        - name: backups
+        - name: backup
           mountPath: /app/backend/backup-data
+          subPath: backup
       volumes:
-      - name: postgres-data
+      - name: backup
         persistentVolumeClaim:
-          claimName: jellystat-longhorn
-      - name: backups
-        persistentVolumeClaim:
-          claimName: jellystat-backups-longhorn
+          claimName: jellystat-pvc

cluster/apps/nextcloud/collabora.yml

@@ -5,8 +5,6 @@ metadata:
   name: collabora
   namespace: default
 spec:
-  strategy:
-    type: Recreate
   selector:
     matchLabels:
       app: collabora
@@ -17,14 +15,14 @@ spec:
     spec:
       containers:
       - name: collabora
-        image: collabora/code:25.04.6.1.1
+        image: collabora/code:25.04.3.2.1
         ports:
         - containerPort: 9980
         env:
         - name: aliasgroup1
           value: "https://nextcloud.akshun-lab.uk"
         - name: aliasgroup2
-          value: "https://nextcloud.akshun-lab.cc"
+          value: "https://nextcloud-int-service:9980"
         securityContext:
           capabilities:
             add:

cluster/apps/nextcloud/nextcloud-db.yml

@@ -15,7 +15,7 @@ spec:
     spec:
       containers:
       - name: nextcloud-db
-        image: mariadb:11.8.3
+        image: mariadb:11.8.2
         ports:
         - containerPort: 3306
         env:

cluster/apps/nextcloud/nextcloud.yml

@@ -5,8 +5,6 @@ metadata:
   name: nextcloud
   namespace: default
 spec:
-  strategy:
-    type: Recreate
   selector:
     matchLabels:
       app: nextcloud
@@ -28,7 +26,7 @@ spec:
             done
       containers:
       - name: nextcloud
-        image: lscr.io/linuxserver/nextcloud:32.0.0
+        image: lscr.io/linuxserver/nextcloud:31.0.6
         ports:
         - containerPort: 443
         env:

cluster/apps/open-webui/open-webui-pvc.yml

@@ -0,0 +1,34 @@
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: open-webui-pv
+  namespace: default
+spec:
+  capacity:
+    storage: 5Gi
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  mountOptions:
+    - hard
+    - nfsvers=4.1
+  nfs:
+    path: /k3s/volumes/open-webui
+    server: 10.0.0.123
+
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: open-webui-pvc
+  namespace: default
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: open-webui-pv
+  resources:
+    requests:
+      storage: 5Gi

cluster/apps/open-webui/open-webui.yml

@@ -5,8 +5,6 @@ metadata:
   name: open-webui
   namespace: default
 spec:
-  strategy:
-    type: Recreate
   selector:
     matchLabels:
       app: open-webui
@@ -17,7 +15,7 @@ spec:
     spec:
       containers:
       - name: open-webui
-        image: ghcr.io/open-webui/open-webui:0.6.33
+        image: ghcr.io/open-webui/open-webui:0.6.15
         ports:
         - containerPort: 8080
         env:
@@ -29,4 +27,4 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: open-webui-longhorn
+          claimName: open-webui-pvc

cluster/apps/paperless-ngx/paperless-ngx.yml

@@ -5,8 +5,6 @@ metadata:
   name: paperless-ngx
   namespace: default
 spec:
-  strategy:
-    type: Recreate
   selector:
     matchLabels:
       app: paperless-ngx
@@ -17,7 +15,7 @@ spec:
     spec:
       initContainers:
       - name: paperless-ngx-db
-        image: docker.io/library/redis:8
+        image: docker.io/library/redis:7
         restartPolicy: Always
         ports:
         - containerPort: 6379
@@ -27,26 +25,20 @@ spec:
           subPath: redis
       containers:
       - name: paperless-ngx
-        image: ghcr.io/paperless-ngx/paperless-ngx:2.18.4
+        image: ghcr.io/paperless-ngx/paperless-ngx:2.17.1
         ports:
         - containerPort: 8000
         env:
         - name: PAPERLESS_REDIS
           value: "redis://localhost:6379"
         - name: PAPERLESS_URL
-          value: "https://ngx.akshun-lab.cc"
+          value: "https://ngx.akshun-lab.uk"
         - name: PAPERLESS_CSRF_TRUSTED_ORIGINS
-          value: "https://*.akshun-lab.cc"
+          value: "https://*.akshun-lab.uk"
         - name: PAPERLESS_CORS_ALLOWED_HOSTS
-          value: "https://ngx.akshun-lab.cc"
+          value: "https://ngx.akshun-lab.uk"
         - name: PAPERLESS_TIME_ZONE
           value: "Asia/Kolkata"
-        - name: PAPERLESS_TIKA_ENABLED
-          value: "1"
-        - name: PAPERLESS_TIKA_ENDPOINT
-          value: "http://tika-service:9998"
-        - name: PAPERLESS_TIKA_GOTENBERG_ENDPOINT
-          value: "http://gotenberg-service:3000"
         volumeMounts:
         - name: data
           mountPath: /usr/src/paperless/data
@@ -63,4 +55,4 @@ spec:
       volumes:
       - name: data
         persistentVolumeClaim:
-          claimName: paperless-longhorn
+          claimName: paperless-pvc

cluster/apps/paperless-ngx/paperless-pvc.yml

@@ -1,14 +1,34 @@
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: paperless-pv
+  namespace: default
+spec:
+  capacity:
+    storage: 1Gi
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  mountOptions:
+    - hard
+    - nfsvers=4.1
+  nfs:
+    path: /k3s/volumes/paperless
+    server: 10.0.0.123
+
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: paperless-longhorn
+  name: paperless-pvc
   namespace: default
 spec:
   accessModes:
-    - ReadWriteOnce
-  volumeMode: Filesystem
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: paperless-pv
   resources:
     requests:
       storage: 1Gi
-  storageClassName: longhorn

cluster/apps/pihole/pihole-pvc.yml

@@ -1,14 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: pihole-longhorn
-  namespace: default
-spec:
-  accessModes:
-    - ReadWriteOnce
-  volumeMode: Filesystem
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: longhorn

cluster/apps/pihole/pihole.yml

@@ -1,54 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: pihole
-  namespace: default
-spec:
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: pihole
-  template:
-    metadata:
-      labels:
-        app: pihole
-    spec:
-      hostNetwork: true
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-            - matchExpressions:
-              - key: kubernetes.io/hostname
-                operator: In
-                values:
-                - kube-02
-                - kube-03
-                - kube-04
-                - kube-05
-      containers:
-      - name: pihole
-        image: pihole/pihole@sha256:90a1412b3d3037d1c22131402bde19180d898255b584d685c84d943cf9c14821
-        securityContext:
-          capabilities:
-            add:
-            - NET_ADMIN
-        env:
-        - name: TZ
-          value: "Asia/Kolkata"
-        - name: FTLCONF_dns_listeningMode
-          value: "all"
-        - name: FTLCONF_webserver_api_password
-          valueFrom:
-            secretKeyRef:
-              name: pihole-secrets
-              key: api_password
-        volumeMounts:
-        - name: pihole-data
-          mountPath: /etc/pihole
-      volumes:
-      - name: pihole-data
-        persistentVolumeClaim:
-          claimName: pihole-longhorn

cluster/apps/prowlarr/prowlarr-pvc.yml

@@ -1,14 +1,34 @@
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: prowlarr-pv
+  namespace: default
+spec:
+  capacity:
+    storage: 1Gi
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  mountOptions:
+    - hard
+    - nfsvers=4.1
+  nfs:
+    path: /k3s/volumes/prowlarr
+    server: 10.0.0.123
+
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: prowlarr-longhorn
+  name: prowlarr-pvc
   namespace: default
 spec:
   accessModes:
-    - ReadWriteOnce
-  volumeMode: Filesystem
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: prowlarr-pv
   resources:
     requests:
       storage: 1Gi
-  storageClassName: longhorn

cluster/apps/prowlarr/prowlarr.yml

@@ -5,8 +5,6 @@ metadata:
   name: prowlarr
   namespace: default
 spec:
-  strategy:
-    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -40,7 +38,7 @@ spec:
               key: OPENVPN_USER
       containers:
       - name: prowlarr
-        image: lscr.io/linuxserver/prowlarr:2.0.5
+        image: lscr.io/linuxserver/prowlarr:1.37.0
         volumeMounts:
         - name: config
           mountPath: /config
@@ -56,4 +54,4 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: prowlarr-longhorn
+          claimName: prowlarr-pvc

cluster/apps/pulse/pulse-pvc.yml

@@ -1,14 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: pulse-longhorn
-  namespace: default
-spec:
-  accessModes:
-    - ReadWriteOnce
-  volumeMode: Filesystem
-  resources:
-    requests:
-      storage: 100Mi
-  storageClassName: longhorn

cluster/apps/pulse/pulse-svc.yml

@@ -1,13 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: pulse
-  namespace: default
-spec:
-  type: LoadBalancer
-  selector:
-    app: pulse
-  ports:
-  - port: 7655
-    targetPort: 7655

cluster/apps/pulse/pulse.yml

@@ -1,30 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: pulse
-  namespace: default
-spec:
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: pulse
-  template:
-    metadata:
-      labels:
-        app: pulse
-    spec:
-      containers:
-      - name: pulse
-        image: rcourtman/pulse:4.23.0
-        volumeMounts:
-        - name: pulse-data
-          mountPath: /data
-        env:
-        - name: ALLOWED_ORIGINS
-          value: "*"
-      volumes:
-      - name: pulse-data
-        persistentVolumeClaim:
-          claimName: pulse-longhorn

cluster/apps/qbittorrent/qbittorrent-pvc.yml

@@ -1,14 +1,34 @@
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: qbittorrent-pv
+  namespace: default
+spec:
+  capacity:
+    storage: 500Mi
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  mountOptions:
+    - hard
+    - nfsvers=4.1
+  nfs:
+    path: /k3s/volumes/qbittorrent
+    server: 10.0.0.123
+
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: qbittorrent-longhorn
+  name: qbittorrent-pvc
   namespace: default
 spec:
   accessModes:
-    - ReadWriteOnce
-  volumeMode: Filesystem
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: qbittorrent-pv
   resources:
     requests:
-      storage: 1Gi
-  storageClassName: longhorn
+      storage: 500Mi

cluster/apps/qbittorrent/qbittorrent-svc.yml

@@ -11,33 +11,3 @@ spec:
   ports:
   - port: 8080
     targetPort: 8080
-
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: qbittorrent-tcp-service
-  namespace: default
-spec:
-  type: LoadBalancer
-  selector:
-    app: qbittorrent
-  ports:
-  - port: 6881
-    protocol: TCP
-    targetPort: 6881
-
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: qbittorrent-udp-service
-  namespace: default
-spec:
-  type: LoadBalancer
-  selector:
-    app: qbittorrent
-  ports:
-  - port: 6881
-    targetPort: 6881
-    protocol: UDP

cluster/apps/qbittorrent/qbittorrent.yml

@@ -5,8 +5,6 @@ metadata:
   name: qbittorrent
   namespace: default
 spec:
-  strategy:
-    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -58,8 +56,8 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: qbittorrent-longhorn
+          claimName: qbittorrent-pvc
       - name: downloads
         nfs:
           server: 10.0.0.123
-          path: /merge/downloads
+          path: /k3s/downloads

cluster/apps/radarr/radarr-pvc.yml

@@ -1,14 +1,34 @@
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: radarr-pv
+  namespace: default
+spec:
+  capacity:
+    storage: 1Gi
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  mountOptions:
+    - hard
+    - nfsvers=4.1
+  nfs:
+    path: /k3s/volumes/radarr
+    server: 10.0.0.123
+
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: radarr-longhorn
+  name: radarr-pvc
   namespace: default
 spec:
   accessModes:
-    - ReadWriteOnce
-  volumeMode: Filesystem
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: radarr-pv
   resources:
     requests:
-      storage: 2Gi
-  storageClassName: longhorn
+      storage: 1Gi

cluster/apps/radarr/radarr.yml

@@ -5,8 +5,6 @@ metadata:
   name: radarr
   namespace: default
 spec:
-  strategy:
-    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -18,7 +16,7 @@ spec:
     spec:
       containers:
       - name: radarr
-        image: lscr.io/linuxserver/radarr:5.27.5
+        image: lscr.io/linuxserver/radarr:5.26.2
         ports:
         - containerPort: 7878
         env:
@@ -43,7 +41,8 @@ spec:
       - name: downloads
         nfs:
           server: 10.0.0.123
-          path: /merge/downloads
+          path: /k3s/downloads
       - name: config
         persistentVolumeClaim:
-          claimName: radarr-longhorn
+          claimName: radarr-pvc
+

cluster/apps/renovate/renovate-job.yml

@@ -15,7 +15,7 @@ spec:
         spec:
           hostNetwork: true
           containers:
-            - image: renovate/renovate:41.27.0
+            - image: renovate/renovate:41.31.1
               name: renovate-bot
               env:
                 - name: RENOVATE_TOKEN

cluster/apps/searxng/searxng-pvc.yml

@@ -1,14 +1,34 @@
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: searxng-pv
+  namespace: default
+spec:
+  capacity:
+    storage: 100Mi
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  mountOptions:
+    - hard
+    - nfsvers=4.1
+  nfs:
+    path: /k3s/volumes/searxng
+    server: 10.0.0.123
+
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: searxng-longhorn
+  name: searxng-pvc
   namespace: default
 spec:
   accessModes:
-    - ReadWriteOnce
-  volumeMode: Filesystem
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: searxng-pv
   resources:
     requests:
       storage: 100Mi
-  storageClassName: longhorn

cluster/apps/searxng/searxng.yml

@@ -5,8 +5,6 @@ metadata:
   name: searxng
   namespace: default
 spec:
-  strategy:
-    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -18,18 +16,18 @@ spec:
     spec:
       containers:
       - name: searxng
-        image: searxng/searxng@sha256:0e0493d1bff9ed55f774709c9113185aa3da0db3aea84bf86b356e97a21d54c6
+        image: searxng/searxng@sha256:a8de13bc467fc7e8d9edf35f71e99dcbb4ead0c965f120f689ab8dffc2999ecc
         ports:
         - containerPort: 8080
         env:
         - name: "INSTANCE_NAME"
           value: "searxng"
         - name: BASE_URL
-          value: "https://sear.akshun-lab.cc"
+          value: "https://sear.akshun-lab.uk"
         volumeMounts:
         - name: searxng
           mountPath: /etc/searxng
       volumes:
       - name: searxng
         persistentVolumeClaim:
-          claimName: searxng-longhorn
+          claimName: searxng-pvc

cluster/apps/semaphore/semaphore-pvc.yml

@@ -1,14 +1,34 @@
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: semaphore-pv
+  namespace: default
+spec:
+  capacity:
+    storage: 2Gi
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  mountOptions:
+    - hard
+    - nfsvers=4.1
+  nfs:
+    path: /k3s/volumes/semaphore
+    server: 10.0.0.123
+
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: semaphore-longhorn
+  name: semaphore-pvc
   namespace: default
 spec:
   accessModes:
-    - ReadWriteOnce
-  volumeMode: Filesystem
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: semaphore-pv
   resources:
     requests:
       storage: 2Gi
-  storageClassName: longhorn

cluster/apps/semaphore/semaphore.yml

@@ -5,8 +5,6 @@ metadata:
   name: semaphore
   namespace: default
 spec:
-  strategy:
-    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -40,7 +38,7 @@ spec:
           subPath: db
       containers:
       - name: semaphore
-        image: public.ecr.aws/semaphore/pro/server:v2.16.34
+        image: public.ecr.aws/semaphore/pro/server:v2.15.2
         ports:
         - containerPort: 3000
         envFrom:
@@ -65,4 +63,4 @@ spec:
       volumes:
       - name: db
         persistentVolumeClaim:
-          claimName: semaphore-longhorn
+          claimName: semaphore-pvc

cluster/apps/sonarr/sonarr-pvc.yml

@@ -1,14 +1,34 @@
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: sonarr-pv
+  namespace: default
+spec:
+  capacity:
+    storage: 1Gi
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  mountOptions:
+    - hard
+    - nfsvers=4.1
+  nfs:
+    path: /k3s/volumes/sonarr
+    server: 10.0.0.123
+
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: sonarr-longhorn
+  name: sonarr-pvc
   namespace: default
 spec:
   accessModes:
-    - ReadWriteOnce
-  volumeMode: Filesystem
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: sonarr-pv
   resources:
     requests:
-      storage: 5Gi
-  storageClassName: longhorn
+      storage: 1Gi

cluster/apps/sonarr/sonarr.yml

@@ -5,8 +5,6 @@ metadata:
   name: sonarr
   namespace: default
 spec:
-  strategy:
-    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -38,11 +36,11 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: sonarr-longhorn
+          claimName: sonarr-pvc
       - name: downloads
         nfs:
           server: 10.0.0.123
-          path: /merge/downloads
+          path: /k3s/downloads
       - name: tv
         nfs:
           server: 10.0.0.123

cluster/apps/speedtest/speedtest-pvc.yml

@@ -1,14 +1,34 @@
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: speedtest-pv
+  namespace: default
+spec:
+  capacity:
+    storage: 100Mi
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  mountOptions:
+    - hard
+    - nfsvers=4.1
+  nfs:
+    path: /k3s/volumes/speedtest
+    server: 10.0.0.123
+
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: speedtest-longhorn
+  name: speedtest-pvc
   namespace: default
 spec:
   accessModes:
-    - ReadWriteOnce
-  volumeMode: Filesystem
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: speedtest-pv
   resources:
     requests:
       storage: 100Mi
-  storageClassName: longhorn

cluster/apps/speedtest/speedtest.yml

@@ -5,8 +5,6 @@ metadata:
   name: speedtest
   namespace: default
 spec:
-  strategy:
-    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -18,7 +16,7 @@ spec:
     spec:
       containers:
       - name: speedtest
-        image: lscr.io/linuxserver/speedtest-tracker:1.6.8
+        image: lscr.io/linuxserver/speedtest-tracker:1.6.3
         ports:
         - containerPort: 80
         env:
@@ -49,4 +47,4 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: speedtest-longhorn
+          claimName: speedtest-pvc

cluster/apps/tika/tika-service.yml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: tika-service
-  namespace: default
-spec:
-  type: ClusterIP
-  selector:
-    app: tika
-  ports:
-  - port: 9998
-    targetPort: 9998

cluster/apps/tika/tika.yml

@@ -1,19 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: tika
-  namespace: default
-spec:
-  selector:
-    matchLabels:
-      app: tika
-  template:
-    metadata:
-      labels:
-        app: tika
-    spec:
-      containers:
-      - name: tika
-        image: apache/tika:3.2.3.0
-        ports:
-        - containerPort: 9998

cluster/apps/vaultwarden/vaultwarden-pvc.yml

@@ -1,14 +1,34 @@
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: vaultwarden-pv
+  namespace: default
+spec:
+  capacity:
+    storage: 1Gi
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  mountOptions:
+    - hard
+    - nfsvers=4.1
+  nfs:
+    path: /k3s/volumes/vaultwarden
+    server: 10.0.0.123
+
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: vaultwarden-longhorn
+  name: vaultwarden-pvc
   namespace: default
 spec:
   accessModes:
-    - ReadWriteOnce
-  volumeMode: Filesystem
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: vaultwarden-pv
   resources:
     requests:
       storage: 1Gi
-  storageClassName: longhorn

cluster/apps/vaultwarden/vaultwarden.yml

@@ -5,8 +5,6 @@ metadata:
   name: vaultwarden
   namespace: default
 spec:
-  strategy:
-    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -18,7 +16,7 @@ spec:
     spec:
       containers:
       - name: vaultwarden
-        image: vaultwarden/server:1.34.3
+        image: vaultwarden/server:1.34.1
         ports:
         - containerPort: 80
         env:
@@ -30,4 +28,4 @@ spec:
       volumes:
       - name: data
         persistentVolumeClaim:
-          claimName: vaultwarden-longhorn
+          claimName: vaultwarden-pvc

cluster/config/cluster-upgrade/cluster-upgrade.yml

@@ -5,6 +5,7 @@ metadata:
   name: server-plan
   namespace: system-upgrade
 spec:
+  channel: https://update.k3s.io/v1-release/channels/stable
   concurrency: 1
   cordon: true
   nodeSelector:
@@ -16,7 +17,6 @@ spec:
   serviceAccountName: system-upgrade
   upgrade:
     image: rancher/k3s-upgrade
-  channel: https://update.k3s.io/v1-release/channels/stable
 ---
 # Agent plan
 apiVersion: upgrade.cattle.io/v1
@@ -25,6 +25,7 @@ metadata:
   name: agent-plan
   namespace: system-upgrade
 spec:
+  channel: https://update.k3s.io/v1-release/channels/stable
   concurrency: 1
   cordon: true
   nodeSelector:
@@ -39,4 +40,3 @@ spec:
   serviceAccountName: system-upgrade
   upgrade:
     image: rancher/k3s-upgrade
-  channel: https://update.k3s.io/v1-release/channels/stable

cluster/config/cluster-upgrade/system-upgrade-controller.yaml

@@ -264,7 +264,7 @@ spec:
         envFrom:
         - configMapRef:
             name: default-controller-env
-        image: rancher/system-upgrade-controller:v0.16.3
+        image: rancher/system-upgrade-controller:v0.15.2
         imagePullPolicy: IfNotPresent
         name: system-upgrade-controller
         securityContext:

cluster/config/namespaces/namespaces.yml

@@ -21,27 +21,3 @@ metadata:
   name: monitoring
   labels:
     name: monitoring
-
----
-kind: Namespace
-apiVersion: v1
-metadata:
-  name: goldilocks
-  labels:
-    name: goldilocks
-
----
-kind: Namespace
-apiVersion: v1
-metadata:
-  name: newt-ns
-  labels:
-    name: newt-ns
-
----
-kind: Namespace
-apiVersion: v1
-metadata:
-  name: longhorn-system
-  labels:
-    name: longhorn-system

cluster/config/secrets/drone-gitea-secrets-sealed.yml

@@ -7,9 +7,9 @@ metadata:
   namespace: default
 spec:
   encryptedData:
-    client_id: AgCwRuPLYUZdheauI46vU2P2G5xiClZmkXq9OKEorneNQUbZKzoEiGIMr4lhvvhlQKPdN+mP0b/grnsbCfLz2iW70Wfb6AEITz+KjWJgK8yGwa8zc3TTUPEHFrnAVEkKiql/NdY2Cl9oykUbbXQhj6o4f7cAdHiL0sr5X8PKwu0Z4R+OPu572V0HLMGXuR+QlIW0Tog2A+4y/Yw3QRW/L14rnGIWCmxWkZXq//HUku2dmS/uxgVQZI6QbOgh9zSdD2W0OA06jh/Dtvi3IUG98DeSERePJMWcbbNLeNbUMGjBPVR7zd8/WXZp2zy8Jx3a0ge8UOIQmFbJl21P74qkbiz49R189sjPiD9sLuhZEbhmF6ot0V/RyRspq4goZGrlEEiiTJzPf0rZ/ZYHFyzjGJ9yxqt1Mw8w0NLNi/RyeApPDPySkLfqTmxXsyYZrDECTeH2sz6SiB8cVc7y5wAGOkR7XOutqD/BHtbxVfoeDnnUZ4IJo0oBglEIDohyhST1V+Ni3pfmmCRNJlVioiAnko73JoQipfZANiYbgUaX8qoUjJYkfkg+W7fhmCH3JZA5IJG2VGyQjjyJrpZWOeUhps5GE7nzGv8PeVRw+aR+FVCfEsvlBpCAYPMzzmtQL9/FhOHg3QYhSRLpW17YxhJJssG5Q9Hk8DeD7o0vm1KECeulvw5o/mT7Ge51jAbVGQLxbiTU81umvLLy5vuoTmfO8+M+MC8P581rZ4L5A3cEm4qij1KVyo0=
-    client_secret: AgCqRhklpkukbbxuO4OMiBzWlTrbyYnDyQww2PJpARuuhbXJiKDwsoojsAHDU/bjB2qNNq/h8dfPs11NJPkthZb7nmsxgnuzF99qkEjOchgEgrgaq0+f/eJoLH37lpyVMG2x9DR37QDZkrSjhjoIyxYp0sOq2gPhabmEF6guRfGjO3JO0qgHJXD2w0mWENm3fW2EivUyeI8qjVLK/OqF4vSvUMaWpNrBT7aHdPn3dajF01jUv36KczM7vKfUbgmWwE2LL969qmqx5SufoEDafaSQdveBvaZVs6aOdDklW+eIkspWd1Nkf+OM/phNw0dUxB34hwZCQBDEJey+IqyqJcamuXzkxFI5HlJzpWkBKuz7zV+ERzwuw1c2mDcXNJRVOb501MMpWRdG8aQlPC/UgzUDyiA4r5K5mG8dXQBhTJqdsEggcWVRQVvpXY48bViNEI7aExXddNlqBVU3zzRikbIkoesCP6tNse97tuN5nMA+BCRsMEFjsNaxPChUxn6+Gxhgx54wdYXa5n40GY03PBd6O7p6MG2s/4QI1nPHwS79sRliot8uiSfIp+scuAvJHLVec+qZlOx4G7vi4DYjiMLjH6wGwEjSKQ6zd+eodn9UuY4zvW3Ri1kI5O5ovfO2XNDFSdRm8f5kGTNJ2EhinJ0zFgsVvk82nSX7f59ma2Dqu+gUz2RFa6gjxyQJ33PyTQ4cLh6dkfU/lLbAvKOocJ6fKFDjKsFVNyf2qwGFdEq6zRpKWW3aCELBm5XFa1In0SlzuNbdzA9hYg==
-    rpc_secret: AgC1yIA13jpl1WcpbCL/oqidW8NtarCcrPkzZdtDmLGjiJQV/HSaQXc9PeojkTaVKuQ6m2rHt9LJmpXRDXxRr01vMKxeZOfKkfZj32dc7acOgO+iSyYEwm/e7o2jTmv/rQXpRAqpAXZoXimpBycyjhIrJ0Bq1r0BXlVdR5KLw+zLcZ84MTy7N8OzakPsH8blElBeBnHcQlwqI2fzyjW7i0O6P+7935M+wjBS1vSG1PLzN5Mjba/CiFq14KwhgtUQ55O4TOqk681jc+VqBPXzLliqSZhqCk/XAdvYUZMKB8/Q3TsrplmH4xg52qkDNrYn1dOt4VeM6B3xzkM9buAx4c85FpVmAxY8XvJfNhb0BLGRdgLBnTJNHOAxBua5lYQ6n7WJhpFTqt2bAfQf7Xtr82MenK/VMd+Qe/EWjc7ibfph2b6VAAhhfQ64LWgLyCCES4LjSAXOmeJCv4N/9cRWnYQ/Sx1ICzesKgqElpmhSIkNH5dEMF13PaEISpLtaF9x+9Nw+j/LuZQKNaKvJOM6nisTV4JE+9R3Qj5/EX63xmlqkAJWiTmz7dSlcQh0DZbBOKoFSTiZkE7JVGvLXKhSvzBGYTAMyFk4Hn2ej8HKMOhB+su2ENp1oBW1ejgzhAPjH7shd5SyOsgA1pS3wxYaFhm+U3G0v0dZF7hdhe0QlNuPM6DenU+8Au27fHNY7WTrZBwXEcqYRWK+k/1fFXBKR+xQV9C5GsIirgguszCZT75HMw==
+    client_id: AgBWtz1sHqUlTSb+4OSxeEDcmsIB0eLCYURb49Dt2T72LZQcxfBFqNwSaO+vlthIvTKlZywL5VAz0fTffxDkQ2usEqXlDiI19DV/hsyDp8rIxzE2pdhULHArZQBGBJIVvpX60lTFj3gHTM0YMiMiGshfWeDezeBpf7oy3EU3bMZ95IujnoJN4v2l9YNaQPng7REOU3OK/xWnvSrG1TBsSl9PR8eWSpuuPpC3TrzahPoZUQ9tQLFIyAmWdbm3sHfpf1uCOgUS/9KEs8dsEGDlnjLSmFs6celXWoRaLUADxBecnPepxy1mMml94skGTEeL3USVPbOYz4pKwHGrqfGYt0posI9qcH1Ds1qx6Ir29+AuYq7Y6BdjHYhNhawZJbdVQvigIcQ6qXQ5V+iSHfqaYO79VpNPz2fBq8ULUBHF4I6nFTzx1JmsiiNBndb34K0qaAI4CPahnr1oOXiWEexTS40BH3le2w2Rnqa9NdGUfN4BKSd1F+OX7Z5JmQXBSui+EYN/AtOA68qpugTSRWOIECKLx+FKZamWteUbCFdK7xF9jTt2yRzFLaHfTnaMjhs7bpzH5X6SEibua7rqmbWV1YXyhR7ng9dm8lgdHZJi90dcDrtoyqCUP2zfsKfiACSfNZyK/BJC08QfGZXIJm/5K7+zkazHwPpaipX/Ix/cuHEsSUCUhDm5oGuhfTXRz2CgQGJyaQ5iwTDwVabun+sclHJnFiTQztLJg6Qt67Rp9YtE9xW1NWM=
+    client_secret: AgDJCpKh5Ri/TKNGeFT90VGMSrqNNyRPb1gfiUEk1TxTWv1hNpHL28SxyrS2Nf4jkmi+NPaHS7Jq4ZRa+tdzPHGTE0hLaBRSFclxTE0S3jPu5qEaB9rKSdLjpW9ZYb5RI53O8pkpdwh587RxtQBGSq2VxLqdBOwGrsJaFfgPJqTgP0y2WotZcc39OXfjEgsOzFJ+hEf1O2EszEp7LW8TMyy/hcBqzN55TqQu05uYJ0HuOkalkYlHxUflSCAyffa4IDPHTYfWtddtczJ8ec5RRoqcLw7abusvoOiu+RNNRyCtgJKqg20SfxAdlLlIR2xd1O2rBoQ8mYtu7ojpHA1PihjBPqB46iC6W/Jnw1Y9D8/tu+d/X+2UFWbTvFjQQrC3acatkj3jJ/9ZidkrVL4D/6EZZFVuG5Qgbagx9U8tXBWqOmHRPfpjbAcV13yA+QKq0h4cnbc9kC8pRCTrpX86bmttnxt+Rfm1RcXCBkVOjB3IppW2K+9Va9nvm4qkqepdajeEiDum1xtCexLpeC1HxOWOyguDfhq8/eGMOXqd7BczeBqXZkIeR82ZzhC8uCzXbpaS0NFcQ5XZUPK5Gbl/Jh+MjeDO759BqSuVl4H5DXq+U7khWzcM6dwE9/K9vz1PUV+TQuUD4Hxy4bDuyykgF1GE3CiEv6YPAKS5Z7oqD45N3N6Zugi9SMOksZF8ix3p+Fr7SThfw6X3ENMnbzbRSsytDQ10Z6PvOQWUnGGKvqDhZ2VEdOhqVrzcrhx1TMvNOkIFjXGNCaE5vw==
+    rpc_secret: AgAYFW0Gz+MbXH0PMjGQvkES1Mx9Drc5kb8Zc3ZL8tJLY3gw085hkmmSuC7/mx9FIdBMAp6wzcZn2qS7DnyWf/yGN6d+0vheVrjyUrRX1fbFQKztv6Pj/mJDFomJD869ik3tt+MJQumdlFlei5yyO/8pkASnGT9190yeeKAiiFK+3qpaN1f+UrIY78jGIT0pIQO0zVYUTLMCWalxbdVY97b/GIkqIaYMpOqCE1/ux1CDdsH5H6JPIpv0mbBmv6FyPjKJGFQtqph5aGFNMtYewf0yK4EYxDDjIyaVba/54w0o2+MJP9VMbtK0vL5/dbL0TEm8DsgzsK9iuHbGDf2iAJtrZLEYSPEn/SrxLz+jaCOMgSMLNxRoKaV/mQk3vUEzXo6oahHpExdvtAmuw0PDHVfQB9RMXvFy+EoEaA7bBivs7gNMKs3YklfPrkm/YwLg+nqvARD8uOqdv57Mud/0gBenN07lCOwsDpEK2dFwDFy4pNtt6szZeg2H+URA7NHHlO2VyJ6xMvrusUoSWHnngjA4k1xFLaErOV1w6c0HHPx7hiKjxyzYr28wym80DAPDYvaQ88xhn8ac8DzuA7OipniUAzBz/giodNeTEDZhpkQVrZJrvLup2anQaV9akdQkMvHMc/0aruPyJFD+eDTJQbwc5Nax23A4euaDdDHeu4SMBscaNsPfMRq8+pu+wroRsvVt9VKcgbJSzFUo4evEzPOk0mLahMiunJdv4NfnAg9yZA==
   template:
     metadata:
       creationTimestamp: null

cluster/config/secrets/homepage-secrets-sealed.yml

@@ -7,19 +7,16 @@ metadata:
   namespace: default
 spec:
   encryptedData:
-    BAZARR_API_KEY: AgDEhlYLcmagIA2aklfa0E5bGnXWgJNXisFA1EHpgVvkdTLvrOUfCS6wPOs2g93+rMgtuEtzjjxuregyXpa4Oo1dsmwwQoDup81XPTtDFvhrEr6eIohQcryMSmhOfOFd2zA2PMMoK7y7ge5cCI3q5Do+xgW8LqJkuLoCsu/9MCm3OBn9TBhzJc8mvqPdnzppddTAJ2XT3J/hod+nFetTleyOlvqWDKlcIzyUAxZJ0u8w+l6d2Ew3kUJI4o1FOJ93KNC/nJaruqPjL1KS4HynQrNPNGdkDP+i9SYRNnv9/h+J6ptp9xPpkvUjTopToBeSh0oUWXG30gy1l5PHf3RTTWIroLyGUvR6O/G/P1+Sa7uA0c9+ekChtMEUhfjXuJsDzUw19OY/wUeuINoz/MfTxVUx30eSI/2bKrq36CKpjv0tXeNr4XYzikaF985WfZqG36GlWEqDY1PZUkS1pnVM42sclEN7UhXARLrTE+xJvE9HL6YVwognP6nJCFqIqi7Q+GT2HC8rRDhn6Fbm2mkGwM1R3ssSr9mH0UBUhu44pkIQmedxhpMx/nxR0rXxlRXFiv05L7fqtY6mtEO12EDtjPY2Yh6TknxJ6+qFaxdqyBeI8X2KlPjadqt9yA8F5fC5kdKnRTfNXoF0zrCtEZXKts4joXki8pNeI41/E3nxL5gn3imOcDoAnaqKdaR2Ot8ohAKqKhZtaIfm3Q/s/z800uj3GEjYol5e54XSwcHfYqQMCA==
-    GITEA_API_KEY: AgCDVeoNFKMpDPaHPn9MpMJ8SgmRxafanWqdpitfsPzRf0UEnVZiNcXMqetr96C0kVJo6H3IZg/qht2nqRJIsH6RXpeqvHc4wGLMzuTvj4Y+TL0qNkN12yCojgw6gYmTZ0u0wzbglN40wt9Vxwgaqr4jX2TLM4McLHfMVCUPcKSppyy4WBEU+XDDLRQcBkWFge4MjGYnWvytWUCpMYh+oiLDfMy6YVRJkkI9cTbChJYyckM8bv1r8rWm+5XqF72E3ISVqytlorq7dHeBL9uL3iBS29dfZjX32Nne1k4/AJN5PsJInn0Y5hmlejHPal/sr5U0iVzfUJ9OP60DwiOAqcwY9hzBUTqm5W3q3uNPvj8zOWyyZ9dIrpmAKwsGifvIFccN05Qe8eZXcOe5/2PEKU8TE9+4Lr0KLqqW2X0EMb6hAMXneWFdzGTqcgrw1DeyPxDG0CPcaDcJqunuSHN6ML0yLW7HngHYKNs1WhLq2YoiUs0T7z+xrxNsT8T8pYPbiGxun78SH8j+rbEisSJo+GRJ6pAhieZVflAfoX9JKiak7Z4XzLaAUUZAYic+vLRCoQOd+5JrSAWHfnMFJlazTgkXlJ6fPclwaeqSsCGDprF73e475PK1FM54RKsTn6RHpDhr2J5+rMBJoWgHUoViDwO0EOcb+vfLOJzApTUr0cs83RYhKqsaWvJ9FlbOgbgo2ScCDfIPLFETEDGKux4r1KRvu7DNOnZYVXc0gqOa+JEP7meq68BQVqZh
-    IMMICH_API_KEY: AgA6zDYvJ+uMlmjQijZbTOYOmJqcLJsmrutKJBd7kB26skvpTVeC2zRx0oR2+g2j14bwwd6SRnEq35Fa/IYNKewrAvaeF+cAgTYA/8G/Nbu9w1gYChFPgK54teyemlOsuFNPjUGxf4LABkzkALXrhj3S+jTm732Ou0DEXhOh6LP615CBrtu+znkuPx6azIcw/52ZElCY1AbLMg5M4Q9Exww3vrsmXbieGpv9LlNzH4NVqKhHyZUf+Fs3uy0hmFhug/7SiVD5M87CBf6JoHV40i3/B3ZuqaqSvZgH+QE04ttzIi9nunAbin2sXGZg4zaj34Rxcq8JrPEAYfr8HGC8YBC+kB8+/J4aPCmfwZJCtEHTlm1ODmAu4mSgpQMiRAB/0UWJGmjCG32l/3Jei/ayjV9LmOVeQ2aYKzwxjzkVp++qXeNGokIgiU609ihRXM1SbnARnNGQwJbC+jiCIxLYuifkFok93454hX/eFiUHxI027fqqrymX+1YPRVdPjXwTjW2DlVs0KLHEvfKrwLxX79RsyP9aMXS5vSyn7/OnVAHNqpVongYZKe+CJK6Lv9irT5Mw+b/EoG2yYN6bLhb4djNcZ6Rer/KZloISsDrccXPt4kXlg7GCL9+JE1Kp9sGMoyFNANWfjAYebB6ntUbAHsjhkhUTV+jEac15YOxK69GXTg2o5zjYNkE2T26JEFAbjxSr8gNmPD68r/tDkyk6C2MmCmZY2Xr8gGHYOxVZfeqAsDHPty4jNOCbt2w=
-    JELLYFIN_API_KEY: AgAl1XoPzIfEzH/GDqTNr+OSOkjkg35+eHio9t1DhSuPwT+SWZJWoMW7Mkb0eqRm6bwQp4VlyE7ZyLa1HhN25OOe8LS6Mo/G4KVgYwLXICpyDswrB117NRS0tRm3IbKsAPE0tvZdgCddkCb3kL/YbF1THssVHzrHsKpVrirGbfkEgf4ihjeJAVjM5aOGGMV69E2t/4n17jGLK9HPiEmxncPjfNpk915WdVP9CiXUzBsGREE8oARPRpe7e6XLtsJRCQKP19A7jo9BMRgz9OEzzeVfabb3P38cEr3tRRXsnr36iPZX45Ubvkh9PynHZ7fvnRxn8gHUU/1yg21f60C89p2YaOmAPlaRcnV/1i0hNgzq0hZHIyeCn5e4ff8R0BZlZ3ERRJEyq+yN7GV9mk3Kz0YmPfklr3HgdndTigCbDc+V+KV/aWB4ZpCSspAbLnoRf7QVU++fak28OhnT2NQhodszZdXcbpztbqHwmVkCPLdFuUXOTjx4qTB9sof307R8q7TO5aF65ZhDuv8MNstedN95kg3hPCPAh2ukv9dDy3qi/KGSeFEyNl9bTlkGLOkogGZOOm2Lls7evFshQWcRz0RbqUUXvX7w8G8vG/UoDIrKRLBn3mapZ1pjSLS40scsVQzwdWXAxycrwEqzqcecfHw5MrJXl/y44SMS/FBZlLgCDB6zebAXRbkWx5AyaPAWXaavfDRAFC/wGIZIBD+YAF3KE61ZZ2gaCGCKb9I3jNMhPA==
-    JELLYSEERR_API_KEY: AgCaJAAMTL+eC3EnKyhUWoHF+lx5rlyf5+FABc76uBCTgHkJybbt9TCeTysUjBKSozJi0fqv/uktc11wURgTCRM7zjPNtIsxCTmRBvFPZlpj9dDH4aTSv6SzD5q41/hl0LfwIE+J3Ssd8NYPGYZcYFLiVu4t9f9CzXy4f4H1j+T6/G7SW3q+eDdViTt3ZvVORwxGy+kSO+gra/G2N6ghsNtzqsNvZokej/1mRwkFfjvi2h81N9IdnGURcx5XaUUv4Zo/67zRFwXuObiL3LJKYwWtEnWVw6cLIoWi1/e9nGYIv0m7tuHuylK496nmAYL1a7rmLxoWJgaKYKqnwS+RlxifOYBOz0zUxGwjbgGEqi4gR1D5ErcRkx7Wc6PQay74leMiG15QkurtZ5vlHAQdqWAM9hFlR22lD9bCJ0zCG9e6P8eH59j+aUz2IQru+pNm9TgmxEzCTC1EXT4obQ2msjaCJCPeuHC74V3ytIz5v6vqtoSVGdRVBYsIIRyTIahBxcljekGb4Ew89L6DauU6BvLT77DeWsR1H/ozoROxD5ws+HIaBdyoBv3CQmwMpH4YDsbFxc8uZtUP1Y2pWNyq8rb4LKqslcFNyoYy6VflTfxxyG/Eyv1pC/60tGYMjKT9svW4xQGm4hQm965dXEn4f38hQckwDP/xSnQj9EpPNtaovn5R2PAe/GjIgFe09G8mCDXiBIvak5nFiUjuwKLnWwmJy8DevfiIZayfRippQz3hZQlvpIf6v60t6hdyll6RuMs6s4vIrJunAzhBYkyBhtCR+SmoFQ==
-    NEXTCLOUD_PASSWORD: AgDOdIYXaYJw/5ZdVf4IutB7h/facNUYfe3is8RU4glzymnC3SZrPzdwAbPsAwf/VvtDdN3B0H26VtCfy5fLXMQiiUmdt0BrXK5r6Q9Ymx8zDjQiOJ0TyP241TJQHBwl+YBq5SnjTI3CkdMs7uD5QMe6EqiuSS9H9EEJinl7TqtXWlet0gVjqpiuNJU9KmGRKi2Z56Qm0eBrrIBGpi6jYU0vmB+492GEZ6sfkmoEzNllRan4IXervclLU/68KohNx3aQT0SrsFsuBreuKpB9dGY6zgCTN2HdabWrWU1h7iC/8+3pJO+02fnOTIrS4drm9biW3bx7yAdSZ/odX19CulQFd/mZs3SMCaiS735YlK6NFwV2Df65dUWD1ocvpDb3xK7MAMcaK/FIYhUYS7SUf03NTZo3RmOYB8zfHM1bG6NEVJyYs/HeQ7BqIsKWygEIbH2c8cJa6ydc1DF/UgtA/HQhPyVIj7zpmK4SgmZ5SJQy7vLe9uNSO0UHXcdmmXWsrMGiXZP1+QPRyKBrsDcwDsyl4QrecdCcfOerHo+tsMEQz7y1Pf/YnIGpNtSoHH479X4mYaw6fvEgJloMnAZPeokDYJ7e3F+Hw1/7O/OeBJECYfkZNlkdmFCQEn/tzUVABVXe0QKhO7XZjZf3dm067i+7gMCeKdnckG1EzHkBIj0RK3ni4ohiepZUq1kySmnKFD+ekYAE55lmbi8fwQ==
-    PIHOLE_PASSWORD: AgCMot9kEIfeytQSgr6/RfmSbWY3UZXsClG6jGSBZHXhvn5+Jv3IGfXckFXD6B5NvnWyvkCwCcGiX8PS2aJUcWbNmb/U+I9g2uiSTsISK3gL+7/pQtZsdNCIHA0XO//WJqfbhlGvKvk0lRqj8V6icTHRqGDjEc1eCEmDXvuWQxKv+JORPQHPm5CwSF90mcqrkoIew/zb62BZCc7e7Au6491G2Owqe9kETtTtEUVNV/k+s7oGRcdOy6htAN0gIVj4hP4IeQMc++CDzjDmcO70e1JaBRW/KPx2IDc45PM1RjZgWa4D3YorNhIBmdtRPCLXjlaWrkT1rEaiRhR/IBCmzGZvXlRs1ueK4yl5RUFwlhaHxyuGEQ6xX4+9q4zllXR0bafGwAkNrlIFTawTSCM8sdjUEySjK9W3xtePM2jfzwi5RC2XL0kQd6JUJFA5N6sYWPLdky8qd/ZnK85e3sXv/Xtd4hkjEiKu3VdREbyydEA7Q6zM8JucE/Rce1HhxVAaKGIewaN45E3LWGTCnyik8WAptnkHwN4Pbs4LeohSrdosTx0pUQUVrLTSp0XEdCT3xIjFGpcrHOOfxndztbGn1Y9ELl2f2ScBAzwFk5pdRYNf2BL4ky01erfyRtz1JUov2hzs2xIRVMfjq+H/LiSZpYhgg5H8YfvMhQTecgV6NPX69z4vHeGDJrW5V3jbDIfJSKrFUlJ0Q90wW8E3Dw==
-    PROWLARR_API_KEY: AgAdUTlxJ84L05IOXofdq5YM+ETuJfHDXJKNbJxwn7OuflpGYYA+O42byUHQKbfwFJoQlXv+UQqpq9L8FCyuYxDX+vwXD9UltnnZEWNncrac+w5vgMZjKjCgStpmNl14K59+J0z/nN7jET6OOag9Z9pM0ZGnQ3taUrwrvrCWZJeCaYcsHBjQdQ/hIR82/oBsQzIsZ8OGDP5dbePOxHxNDb7d4R732VvIsW6wTwWwxzhWDvs6uT6aSiAFJ0Mcn2vGva8+CxvJaFX7fleLkRFRcPr5vEjerpky3xjDY20jmKJ8bKF6qGitTeCJEpyoARmHaeoCW33rY4+WFj7mNgS7dZL2/xmFXNErioBxVxLVG2Wid25OE4mBrnKZ3P+Ly8byiEe8bHe4jMn6JawqRx4FGnQbBfEX4/NZhJnEkTYXQ5ag1klTaXSbblrXH4UOBVsCyvLrSKI3AfiadEcKASz61qlzPgOhm2xENFc81I4BA8QZIFq5IBxudrTzOzZa+nKTq7WKNoBHkUtGYuT1vuTn4/HkkJorLi46MdeqEYlDhhKbmmk8s/qemDyVweZlHvsS/3NxSLIADF95UWRyPTpvrUiM6WGMLX+kpSAqOqpWMFZLU0Tv6mynXhbDqq/hWRPtIIzJubtxuACUEiaCOmCwjfBJfm472/iw6rXJo5KR6DQ7deLbB1xURBIl0NuKQY2dbJSUsiKnlGbn27Qn9/tzSujL9UFVAmALhy9SuFzDBDppHw==
-    PROXMOX_BACKUP_SERVER_PASSWORD: AgAbdisb/Bpo5Nkq4D+wSRvxsWzKfYna+I5zLlEwIV0ZbdXKBQxQtblLIOjuBTTeV39CLVyeir8jbQ8qdaDvfOa1X5/tD09HFFyaR9J4zcDdamRrXvOXG86KuKq+5rfJXVxuha05iA6xH62hwViy3KMcK/Q/4YR9z7JkSWHMKM6qChci8uHFi4KrmOrhH6LwieKTZa2mjTxN0kX/OtcKuUdP2l+dsA+TS4+EB95qPbCUS74CyaZwN425sRceJ6Lw56zQbdzIvNR6KmrtziDqatLkXlpYOqUPvwd3rKlFZIbO/osV/ocr9IF2kB8NdlzS76GCOj3HbLizHwiGnfSIEPfQD+YwH1iRnZRJPdTW7Srp+j5QqxrgxAamf3XcMaRD8dZQLP1xp/QmLMVZTGBAzg7n4HHRUjDhsi17V/AZwr9YwxGv6+tHkMmcZaQX2tkJPb8EONfp83U0gQ1pnIJRWjfXKvgQty7TjejK5wC93f60CegqbfcyzbX1P7rI+Cj97rfTiRLNlVrfrn/DdvcdIKho3ZQLUiY93xU/W8OHFsYDGPPnqdR5BVzU4Eg5AfI6FYgAix8F+YT2MxM4C/2IDRAxM5FWdouAOEzsvkRu/0/GHTJAM2V7qHZV5pW04EW4mJ9TFmk++MInyoWsKDd4/x9e9vzLpHj4BGHYvrX41QZjP3SUxnHeaDwfYNsOBs8T4IW03JUq1QvovW7IncAjHA0zQ7cuEszeUBCt897GHrLkj14ue7o=
-    PROXMOX_PASSWORD: AgCUCHvfbPakjWMnFjxPXnX5TSqWv7tPxvBFEEkDwuZR8CKmUOZZFrtB9ANII8RCYPpwsBc31UINb/FWOf2sQhkSczWff+ETEB5X2ZblltnEXpvrwQjozU6rDuu8weC6mMvVL8oeL1wT5JtaZGYTMM/3R7GJf0oqseN57q4YhMNZ6ygcmepZs3s7WLcEXzeDu1quXFKVFCg2c4t55YM/lUWqn95POI4EZxu9x1s6D6t1EOUzp6LnsccMY2RbXsipm7XMIT3qsJcpYl7+po0XTimmERCRQh1nk4tUdqXLxratvadNxz8QXw5+XqBUAMtQpGBPftO09zv4yLRSywKUDW6YEj/m5UgQLqh0sGJfzof/Uenv/HP5HWXteFnz174UT3mW9vjG2fKnTVdbDYGV63QgnmfVjv1Q5Jfwgmqvi4mO/DB+dFAjuohuwy9nJiQBhirigcCnXF3k9pJyPf6KRoOpjSq+WqTVKY01+3q5lQEb+/W+V5azyO4TdldEKz7zU8vz77mCMx73c5U68mx/DeL1RGZGqK7K+ORilyuMYq8W8yuB8kp8ib1t/f4oYLae6i1C4ROYQt27ZVjppMEDp5iAXSTzZ7MU7PLIqpmgPAcsIsq2t3jHDRDzsvC6EvFbs+R329Ac5reNlL/oN/6Oed3ByCzcdGrQRSvuzY9hjGTUm0yQUQuWaGeK4MBM6gEZuWL0NTMbyPveoTGNxve9nAfeWkzrZRNKxYli/8tJx3X59mQe8D0=
-    QBITTORRENT_PASSWORD: AgAWQzutpD7fs/BUDOVWPcScMSNf1Ch1eJ0eYvu9ldhucokSf86nWEeG9Q+6x5URPrCIe52BagsfJclCoTORyTHf8EoAW23T37E8CL/p6YWJh0f4B+QF9hwtcRrxnwpoPxZo1lcFaIy+II9IRxYWbE74hNPk63ag2vsN2Cc7/FUUmWB858m9LnY5fFAVdE1z8acZK6M6q54gdRG6GiNZutktHW/a2xt12KaGlYcxt86yHKSEyGESlrhN3jlEd0wEK/nZu3OmzErDfhpEBF0jV37tQ9uNbMiXFA7ovi/IcsY2QhQuyQd8IpKaaeWjdRPFMMXwqJaRVmRIahFrLoOM0V2XAAe6fAUGn1XBl7MUS2K5wIgDdvgzpzsNG6Qwx51X8/1xOlOb8y+NJBJTKsFGWpOBf3CBt44RXCJEPyOrtiB2aBa/uKw3nhf/uU5sxJtbj7kDe3x+JongmZEUelX4i/0rub5Y7ANA3yijpQxv3/bVLS9xKiilKh1vTPB8z8ZDgaKzaioeLZmjiA7oMfFbt/7qDajYkO/RnNuGETsN8Lc/jGrylhFo5xC/nRlkYPpg4D0iCQWvKVb63oTlRvzbrjeNbd4IcMS4uXECrwxUWS0r7+VT3u1wHfVJr/zOzWZF2RqjCWuqxLDtBKATET2ce4uDAa10rQE7IVUX5USdQCEt2Gl4Abu24/SRx5aYJlolitmx1GOo+ygQdO8A
-    RADARR_API_KEY: AgCb49oKRpXYm7+Xd13ab/ECe/o3Z6QsFBzximX1KPDr0tGeHBZlBesXgh4YKFT80TY2CE8+NCXNdFLo8WQI8xu/5i7+UxCtS1IrHznV4xvo8YhgkxDg0Do7RQu/z4XsVhYR0NmWRYQnU89odoba7o5Khvi+1OVhwbiOscbR07a7YfkteeiTQRiAIuuMc6b41P+aKVC8sa+g5Wm4TM8TkM7U8/WHLQDFEKtpx8fLB8w/UrzjsJIpNsSut1udFP1oHZBbXkfCVgn8xAQ8KnVwH1fUX/dL/mQmD4Jhvda/WASXePdFw09HKQdh3g6dJnZbmOTC8vkFiTdWXqWun+6VQIy+3CaXtYUgwfBWm8xIVZAyxgP3Kq4UdaVrsKXPH8QVohjeSykamZLUnSwufjJVO4k7XU8eLgdqdylNzFKbc+LI/NDjCfQVWLbQ9SNH0ZI5Hszypo/IEHSHkmtsZpONvXxRmKPAt6OS57AcDSOfA63QQKCR8Vb49i8kJi6sqaznSJJo8EE1dOT5i125rNrEirLoothQc/JEpl5A3JqPvAVxsNsOIbSd6Zxs/ZU2u+n7dp1HR7YMvfh9TVrz08c6ZKv9StZqXde4t6m7JtQL9mUJSyA7JmzHE+OI8wNesmbStj5c8BJ4B137ZU577mVqzFNbmAwLi2aiR7HqvUebkf8vXdfCRqtD+hcCJnRv3T4aZI8Z+DekpHNlLVyx0fYGW0EmSCGa8Us01ccQWm/CdtoZkw==
-    SONARR_API_KEY: AgAz5UuOURhOjja8M1HJWXEKNXe2xM3MTLgXuXMaJNENC9wAC0fp5SflLbg7LnQQPvY/YuMFamGjzg9MAT83zJyOtuYaHuAPF2zjNG2bYrCEZyj6sLlz5xK4nt24Gqr07dJyC+iSRYj2xxQWm9KQZuSV9UbA3iU8PLdNruGLYnRDkznVl+/soBTo9bM0N53jzqsUFEuuaek0e2GhZByScup9vv3nRRvcCKNb5jDTAqFg3R4zWmZmxY/gmrPB9Jm0Dm0E0D2zBAMhAsjFOLvrXz0+Rah5X+C2CpIoiWQlQoN3FNikRExmYQgTSxz+PbApFL4y1as4ZBrbVQT9QWGr46cQixi44TkMgUXSV+rtVSjxhnI0e3/di7nNbjUsEykU2t8BQuzsRo9b/ft4SoWIYkcnT+Ezixy+IWZ0NeAamYmDJjsgKe90/K1fehtnfcC2q2+X3wbsbXa0tnW9EEzw4zMC73w2ucwVTzVrnDXlFNwUTvNz2D+Wt9KeTPmnuokCU8pCn2DVNXcu3NEwOw5+Us8OSc7x1YlIKMwegMsAlOs06qL6WzBvJ0IIvxaO1h75g3VCB7OWEjFv8Nxc0LKbeXx0PTn5tgxHIUEIZtxW1V5sqIcBi5bRq+/k54c2oU92ZV/fWzoCMWxBqXZQFy/X0x2vunJX06N1L0srSWXuZbO+oIY4o3yP5eca/JDNTgLRBuil9AbUjBPntumERIMWTklCVX7I51JjvgjQfL+0+L5Z9g==
+    BAZARR_API_KEY: AgDRvN6yb20epOufnDsHjVF/AZAeh8EGUbXoHSOZkbYefDifF0PS8XvIG+xexbV7FqoxLUTBVVyd3uAn2nt89rDVtH3khl6uw2lyLAq2BECIDbDze9ibAi3TlvFxSfnD3Gq3GJYopUeVyL4WS2ICtGdivb6o5O12Ne1OtOiLtVuEXE0X1/Cqbnrhx9KQ2Pxv3EoaJbOwylvbU+sPZPcKHL9EKl+qsjCDRQaUXmCKncmGEdwQZIUdNZxjMUeYY+72uZEMHx/TsAJUEKsCXIttKrPn9in0WB4PoOGdS4f1IkGoBw8/i/SaAUFeVj8Qo+n8V/zqsPR6hu0DhfLthhVhqMJS0ePpzMzmbRbxSivI4/hvKVpyWcnQwIzjdvd8rJEjpzCz+LoerTCgkWXEkZdZWlCg2TUvNMt6D3ovdzhyYf19/gBpdIWGExfs93KN7xNldjhP3WBSApk5gihTDss1lzEiVxYcpZzUjWCRfHsaShC+ipvQc2oNF0+p9sWZCcKY5yqUiwkViDube2rhNqEGH3VrlGuEAwTzhd6CJg/9NUGF7ZyKKZFkQ+W9ikl6eIDjs+Fs5xWDjiVDK+1vqKMxNmbulgIkBVVBZ1Ls/a1yem2L50Ztgqay7mtLC7es0FuAwYfeHq6hsq8kPRuy6xJ9ZaJ4QNsd9SytpgUViiE4U8nvbM0gMCmNAZXZhv6WrOaYV3b31lskjU7vrJu6CtTMdfby7kCvj41bPtdoPUDaq26ssg==
+    GITEA_API_KEY: AgClWk0ZGz+fXOrKitVAaGAjjCPTckR8s/cg8gqHz5uPRRNC+HKDUbqiImTKZUjLwV1lH8nhb/HVIoJmyk4fCyBnwu7pwqw8VJ1KbrGDc0GL4PdzbXjWa3mQBtYfda51gzoDgEBkIr8q+pD6fPXfIX1V30I0iMQdvRU9vbQXXLoiIuz6no8DMcy+7JKg/yljgdFjiD1CqkAu20Y1gJk1vUzXx7iXjhvEqO/nuxROrxThGzCDjTCdPiroQFWsxlc1XeJqpTK7WULf4abiMCkLA0rp28R6Z9pHzwkdjMCbxItj8Z/q/r3q9JU49cVg/FXRbPQ65Iefl8/SLTxvZcAv2tRT1tH2uzmW+EntIIQ1GJ6SSAUuStVTK6IdCh6LM/iL+8rMSGCLeTVcNtm80tIm6pIt9pGDuS3oYlvA0KyfmZ4PIXDmH4PJm8oFk/SCXrukvCrBW5x9ESbbx5PMoAYEVtgt9hQgQ7lYqHdeJ/MnAzPWDBdWqI+i1V2LeLDzqHb3egAi+hS6UXLa8c7b+JBrJpaAxZXrDwOvp5IEmqZLZAXBz/gcpEgKTLewlvJB/TyHAEApoKGWYiJ2qWwl4nkdQuqAJfa6ieiSB1FNcVzBX+bnXzYRkIDWH9gA/+qTcG8uNaZL+xs2SIXZvWiC0QIZhK3Dnqy6y1b2fmVud+BLROhIVOQ4c78QxbTY/KQVoORWj3biqlD8B+YG/ZrZYkXKd2jMOKBOdb4JIDikq12M/5rEP1W+GxmxojCv
+    IMMICH_API_KEY: AgB3BjkjpMimXsmPqlI7F4afsDYmXqT1i5kRhvBPY/fT9yJH1ZjfqF4XCjk5E9WPUywwCSXQJaJvAVihoHUnr6ilE4+hoyqwAjzAw+y0zeJT5a1lpcviEeDEVp+p1VgrXh74Q2DwT/LRe0DQKEILfz5VIYHthSHETlRhkbZ1n1ErwYo7JNoY8dCQzwtAEDTv2ruLJgZd6MIq/MxwDYoaC8K/3znlqTc2Tbzu8vaYQpzz5AUAUYJfrdIJeZ93Nw+Dr7zRaNPtIR28hMf4KnemNgqxGt3P9SJTwOdLNK/H/y5kFVm7iK7WFSn7pjvgOcflgoZtmcgrIaijqVY/JpNC++wXSP6cEAju0UKTOBUn82sxY2pfrLRjuYwRvPZAptArgWpBk38+QmmgbAsndqFAGk4c5Eih+ZgQt9/g4AlHkJHCUQoOhSQe+25Wl8dnqUY8TADr/N9aBWwEH5io6i5xmhpi9Yp2xjlNSzO+0Mo49Nn1cDeRw+CtG5x1s2P2CN9/kFOXljdFtvOv6vXBcTgnuQiVUEP4Lp/oJhUw9v4YkVuCXxVnCyr793dPV7ZPDqu/0jhMU4hsX+MFDcYILJBMhZiLlzaPQE4Iz2wMqWL/z418kOc1qfG9mp575djQkWah9KM2O6nEJB2W+V62gn+jPs9UPXy1jeVOP3Ef6iEEbOukGKUBDYy1KsKaoKqxIUPUuQTZ6mri104r40rQ16ZvHxxaiI3q0yGbrjSxfna7TpTsSRaUtYBl9vWd5hU=
+    JELLYFIN_API_KEY: AgAE5+P9ky5ZjWlOkDvd0BeCwJJ75Ryv6DVQu3aBvUCWlAREBVcvR5wy67cly/C7dd4vHMGW8ui0ZOWip3oWp3eyf5r936REYZVYni/Eqe8el0+GRvZGNyfT7B3cnzFGd6HVif3dZrMU/MLed8x/hUQBDB0r1PYoXxJ6sB9BdWD9Umfh1z8TctUaY+ThMFtfs53iMY0Qyn/OctX3rE6tY6bqqnO6A7XvNGHCKAKU2ZZmXhcjtR642mkPU69SvaJKv4XGgCowN39O7fljqYQUVk+ym5RDoUyiue224c3JyTWl9l7l4sNcViAGij7uBIoV3Stv/bxdGbqYFykF8+DbT/0kJ+OcxXWwHJJ77xyAdAZVg33EL0qAYwaFVzI9TLa6mccCi866OIi3qt25YRpAI9QeVpgkGzceUtv1HZ8aQEMiMsBAK+fgE6i5rGZTZ1R2GLjijc5ZSeRrfqIWI4jAZ2hpRSrhclsolWOdrnUuyQ77GxZrosl30mUmuUXq0rFyB3lKnP9SVw7iiruV3CTWtPD184ZBylwAIe16ntF2uiyZjxi/tXKAsyG859BXletwITAr+oWqR/fMVNJuBqcRf9h9WTrgFlDiAWi1yhCIC1he4RxXBlhVvNCo3+BXL/Tll+5Ry4DyekY8gj9scJY/xNJ3nPDZ7hzsUa4/+1+HXXnQXED7dfgDO6fIiCBqRNWkw8IvXbrB8YTtP5h0fkYCPNDKlzhAjtPK7puz1oRO0f2aPQ==
+    JELLYSEERR_API_KEY: AgBsalewosQsbsE4ylx665cvgiXdGpXqiIKz1iFxo1VLJhZpx8DkL06b+xqg1a+Kzy5w3IJjmlh/lCsFArJ/aCywMikT46A/fWlHCOP3qzKStEdeUDuYgD7y/lJjCBzABRtj9LkGSd75H7nz5rQuuoT5sB+auPbskTMGp69d6f6xiZOas/ljI0RUpuXvZDM4UmKHNsdMfHcYOqHqAhcXRUKN5A9Se8Injd0sooaZnljLd6SPToQ+6J7sde7TQ05TScLBqIbd8tjVIGVX3zGkOqu8v8SgpHhgyVF+rI/AiiQnd3n5gnxZnwqM930sSYOmRUoHcKHGjFZ2c8X3wlNtAB9AUtFaNeSZQC/uya9+vGS6Xrx3j7THB+fPMBkNDVhpO9ZBvlEUgviYI10EaWaaz+WOOvmal670LBCKNHulSkIcOs2W01H6XN6q4aEYWocLr+fCfgHM8s5ELJUEmVRL7kG8cwVQKHpbQ5CNz5RMqbcPsJuV1yU0lbxU57h1AEKh/jEdJf2BRkMYg1OEqbwygLGgyzvKs6mjPGRCXj+QlPVgd5xs7ICFMcl+lemQ5AJN+HY0DpwUp8Ota1hJcP6Bl0NHAn0DUfOcCljxIwYjShHJNRETl3iypXmxXmvygFCF1Ye8tJ+P4hBGQMekFsyNZ4jKcC69kOb11l80uN+s2bgg6oV9XvFVBQX62Mc9OxlaCiKG5+s7O3Th5OLi+31ICyv9z+SKmtdg1h81Qavx5ccN343z5FqRpexFu7td5b8vgpsw8rQ5HiIZrjIvpxmW0eOdcMAyoQ==
+    PROWLARR_API_KEY: AgAJj93yX+8kguxJswRKItw93uroHuhAsZupapg4gvgYuIPtsmLXLNDaaglU6DImR+roSr88XzWPFGStKx43YF479/O07541Jwat0Zjnf8i9L5Hu2Q2R25Qm7iSt6DenMdVjhp6vb7DJsMYNujdul+XD1taMyYhmSPvbDmVq/PWXWMihTx9JiSgiZLbwv3KseUn5xB8fABPCMe1ulv7iWCaXQ3eaGricq2UtVneoCWK2TvebwY0PKjX9jnc/4YiEfT7ahJLT9GaANThMsQPI4cak7JXaRMHq7MOBG9tN0nXsRM8js0jvM2rVhh7tkbQFadLb8ukzxUu72CSq3c9XP4JUGEvz132LuHQ30jLia8N9tFep6Fbz66pdH7ZhIRH50JDhaWwZfIu1qUtJSEChNF+jLSn9KedQLIt1S5ER4KL2eh86Y3DIwzb5awjohL5xL+POGihQPrGucZF76E7ykFMBG3n40+QlSETbQ4j6ipY011iizo+W5dDyo9+FImcF1hInXs0mhYpEye02Ke780Wjn8WP/iZrNbC6ROk32UWylTMFWtfzbwEfJMTIMUrxGzi/zY+31zu5zia+cgPbXY7dEGXAM4BYVOb5Uu9C69o51+XXWqUtckIH3USdp6TP4f1vAomYRt2jupPALuRNFmKZ4qnnxzl3z2zr1a/iknjWkCKT0uOjfk67mva6NR1kqgSfUYJZziMYi/1MgITffuPpMnk1Glz6W0EDg+NxCBvm8SQ==
+    PROXMOX_PASSWORD: AgAAxq+on64xFaSZ8BvF1mqAeMKs68BfyNXvklR/gWDDVHMjK1rPJGHteiIUwnVLcADQaVqTJ/hAZyMq/x5oFkuuRx63CWYDJfqZlsNU0TuogI96l9WxzsX8CLyMFNDo4hU0W9zaQkrAM2qBE+zdtZFh0JXPan2PsVLsjjXCiSdKxMxB6XLC8yKJGc1oroQhVs49NiBjkS7s3RWutQH6nJ7YXd/VmE+oGsOvF+vnXc0lMP2WOXHPVCMIWgVXUmACDDUUh6GBhx5HYPCRpbtFfL1cqmFaySFeDop0wuqfedEuGGVpcU3i0wV1jtCYo0jl8as7+ddXURkVvYyM8E4+N5jEbRBRBABrv8pJhvhTTLReZpsPOfzcfG7benMNkzie//Eg5+dwkPHzPsJyqqsm8U9JnebLEnkZeOsH/6qMTTUjAeXt3MmcRW+7s6b+thBNsj9bYyyuXZSOwJbsfWMTmQFnDa9MFE0SaJXycFDfu/LfR6IWiPs8yj9n2xBON69SBzkUIDN+Z83mo6SlwmgiAuSRN0Acp3cHrSfaI+8isAGhbFDIjF/cdY+2vzmTmiMREJ4uL1y1LqpKC9ZXjTfdeSc127R9uDbLe/Ft99dIIlIT89L01p1qRecleCQaFYiT06snMrQsK2umJktuyEQbo0O1Jky/+S/caBXZpKW+zyUteLy+miojTW1T8L9UCes0i1nWnyNDYwVvsWJWIQLH4yiGUGSuLgU0vOE3e/xHbjxKFLZZHbw=
+    QBITTORRENT_PASSWORD: AgDNRPs6+C+QgBrTTSJxquCd/ZcGQpGlxl3E3bQkPTaHVCG9+OeHuOsZsqj/8vxzQJ1EKVyswya3MrLaf6/L1u/KslvmbfQVVd8thvwEWsqJCTsmhf09kFfR6axxykpLgOI9tWZSklcw+Otf58eGqTpQOW25z8r9OrNOt/dQIM8XDrXDVATcqOKJXVX1f/MNI6PPh/IzixG+bOS8Jj60OF1luKaTfg5eM936BXCC+M8rDVy1q4/FaoPTz26trQ36F5GNxRTwA1im/55NdVw+GHHpxCR0BPRO6/l5sERKhaAdSHWYVwgEtyNclOljeBl9EamRLxedjzSvsq/iu/CgMBg0hFULh1Y8FbX3f5uF5v3cxhJOT7j5D0I+qkcJnc63x7ZluQwnSxYjoJPbw1EKQVvcdff504wIkMrXW83Z6JFZoJcnT0atg1mRbfmEtCbSjZmJe8LPmBH9Dg+zc+1Fg0GfH43i/E742Bdo0rwnYYRHCKili5ModTr5xglEm0RHG0EeF78ovem21/mLjudAYAYHCvmehCVTlo24yyXuRTnxzm0bGxLCVAJiNyqN7v4CPHryQ09xljlRiBXp2Lq8BGqJvqGxX1AZhBFrmi2zexSqLuVHGYAGlDXFfV9u1y2sUpw9WDkeWXa8dgFBtBTiFPXoAu6Pd8hAKcP2G289u3I/73oABGJwSIM9hStoGaosAFdu76+gYEvANFf2
+    RADARR_API_KEY: AgBcbQVgSEnqFQBjKTul1hXeeDTJjBgHFS9vYYEdn2SUyL0j6MfHqyAckteqnbIBlb4rYkGIqh8BdaTfmmuTfLKQA1cBTbrhtlIp8nChXFRUgAXffIyH6HeD6PI5PmC8hHKHFoChrepRPHi3QavFRIF66BcBUI43VhSqCHME3LIc19SjO3qniqNDNH7yL6hvQsMRcUBFqe7kxEX2GnPFd//dAgQM5Q5sV7R2VcUMh/FDT5UbDL5CrX9g3uzXkoWJca6NeD8p05R6nycnS74HlL1ymr4wpL1wDdlnpSvjVkQBnRfLpMdFtt9SoGGiYCRojbnZe7bLTadCIABEMWoRmc1zZnlsQ3mAB8UxZ7+7wfNzwYd+3fGgWlChMYnyKzOw0QleSBzmuLK2XBXP7EtH06JhRkN+0wXoZzb9n1c9KE7RTzXL7Yq6SFul8NZxlttNgT9vk5aDqooGUnrVK2kP2Ir+KzsIrtrLnmGvJhhMh6+6lF7L6AzX5aAzfaQxkSA36Gip6Jzrr0Ritk6yyA9/qU4f/+XYmKz7mBBf7Jc2Irb+S3dgdFtFxU3+hWPVUBnz6Tg6CnJrb7VMuioeyE1RlfEcn5KTUQDjqYhEa5lwc1G12IVacVW8N5uLrCFj/f4xyU36ikMQFiwbOwvaFD6aPQzYzzgDoF6px1KChmOjf7bYkdq1w0b3Q1Y7tGRdau4MePLzYyufFeZVQsHCYoHeua0EKvp8pVs1XBAofjEHXbY9Lg==
+    SONARR_API_KEY: AgBip41wChIagvY3aPTVwexPiiZoLe9sS1qbjlGaE/v6xTqAx0efG0KfCtD44BC/OEwVHp5OaejzYfvPQcJvQW4OMeQxv1aTQSJBhIEB+l5GRNbZks4/SJL+VzLEf3Yvm94JKbYlVdkdvnucUz7ZdEiC9JordXUjrYly34WI76dCLvbbhdaNnTYM0QiLNZqyM8gu9/Hnfkby3nSuIQW5brqHESzr3ljcv6bv2QppGL2yJB9A1DD6DULN9q2W/30OdjaSW/5X3qg3m4KfFlzIOGrhhKNaZHUw3L58pCiD5VXara1vG2dENxXgqzJ8O8iDTkfxtKUEiv7yB2P3pq/n/BO4O8J39OENNheg6JjtzYzNsrFikDXhEzGjj7CdciGdyLZPImSNSUFg4QFxI0n5tXLZMQ70O77SDswMmaGuNTpWwVdY1lQohTqM90oCC3gJUy4aX8QklK+qBStrX/GYWovoLYV7L7MA+jkpoiVUW2fQGQd7lxWprZehPdg7naEOqPxSEytDAhgedwBwIJkzwcopvuOXb7EJeet0RVAskNtBA13efkx5676Xv0cZ3c1rPoNkRyKpRrpWYwQQUoEYl5W4YgwoUESEsmuxU3YMwfySz/DJj6D3gkxK2UoYJWkrM/LtSKaOnpqhrgE2K9mfLoxQziHOIoyXVQ0POJa5qSQC3dQfte+FpxEZGFXI6929qCRkR0nNvwmDCVxxyyabKLGwfoYkV32AnsJ9WU6+U7JbMg==
   template:
     metadata:
       creationTimestamp: null

cluster/config/secrets/invidious-app-secrets-sealed.yml

@@ -0,0 +1,17 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: invidious-app-secrets
+  namespace: default
+spec:
+  encryptedData:
+    companion-key: AgAaS5Ktylm7uoZfPI6kUn/XrrmSL69EgT2SdJzMJ20Gh0ChbOrMQhyn10XhLpTCCLYdCtASwiZi5MoUnhbF5qFbJDM7/RQsfnzIZh52ej37ATckgRIe7/WoriAr7ZzFAQrKr80mcHp93DWdV20eBWkBLzZBSzYzl897NOxHsSrReAEPzkO/mfidjxhuov06J8cahPswzPrdeEJOUJDYrliZiduxpWIQH3cCFX9AU2u8rpS3Gl4Qf48VAaxWtDkgAibilnzOp+KFfW7h0Nmva6EkFGGcHK6FrLrtGPDwKAidg9G9szuOJwu1NgowSRq8gHhah6KC5lHJ3xPpmA5txfked2T2IWHVStssZw9Gx5utH4wkX0PZW58oaJp1lwsC42M3UpPPanB0gvDD1l8iC8Szzh5FY+GyshfcVstdxa4rJW5RZ2/kaDDotGWL021ogAzJmVDvLm8HisMwTrOsA1M9EpesW5sKGmiJc9Ce/wGrU+8kutkbyt8j6pFNl1RGRLUPEsoXaVTfKLdv1o/IWdmaZ/8HeBMkL7iDBqTJHLVOkhUYN+zgDmh2iAkINkYtEPRPTV64DsCLBdCRLZp2obtU2vxxw4J6sQF3FQOZYAhg4YywT+ENwWtorplHU0798RqJpId5b6ktp/bQ5H2innFkjrt7wihgYT4ZS8sSr+8EFQi9kY/A88i2cZ5PdBN6zj+28qHKuxb6CYr9DTm3Q5ZJ
+    hmac-key: AgAv23AhCeIkVAaPuih0yzUM7LY5GRpTrIccZDKgvKW36XLPLAkYnr7SV+S1ADyShyurVvJYl+nOg7hlRpsPldz4PPTas9ahQIrfJHf7JaPauIM1iqG/8UX4Ud2grWSuYz5XBheOIAxlCSFMzK1XgKdMK5Lm/er8ymb9K2KWN35BcnF8lyC/y02uHWhZFJm5CqB2pcJTct1VmNkRt20PHhKKOC/Ruw51CDOYKsrr9HzSNxCO0/d4zhO8F+Q+f3bKHXcQjZbkgkIEE5F0dYfUxpzga/0CqQT1XibYlgBA72GBe06PeIsD9HJIhe03ROsQEAVfLuqMF3vQRNbXdnW9kPVxEbQuXLiitymUPpLE4dRuv7SA3A6Q+bKRlA4+1cTUKquLKNJAerezZkN0e1NJhXQUAAIQbXMFi0c3nMWAr15YtzLmjhEBMmGZoGcMpHOuk/O8uS7opFVHHNrPNxgIsFzfrayTKRcoZJ1LNK8Qkp/5pqlXWNb263da5YS2gv9L90/mB3y1mazxvbFa+b4FjL9b+4dBB2ueiuM8ZbAiCU5o7as0wMJrhoVNq2n66irkIB7Atmv2fCuXiKk6tOrVfH2yNaLI3sOK397up19XJmmX+XHExHlIrEUqZYIx1YSesbNNCrSxfI9WkuRwTORp3JGHeclfbQNpckGGsOn8D/egcrphiqqHB4Rv/sFoscfgjGubv2mLFkVECZwXnhX4dV461bF9lK2nORxflvyRL5/X9nxTI5RLObCu/Vsid7zWXjiSdsxscWyl5rI8/V+7OFDYAJWs4s4yrHIwLgdVnGRWF81j5Z434EOHi8MiGdYOdLNrnQ6KhvsEhVnSAvwMEvdRgfcCmiNp4MyLrLTLkF8MPA==
+  template:
+    metadata:
+      creationTimestamp: null
+      name: invidious-app-secrets
+      namespace: default
+    type: Opaque

cluster/config/secrets/invidious-secrets-sealed.yml

@@ -7,9 +7,10 @@ metadata:
   namespace: default
 spec:
   encryptedData:
-    INVIDIOUS_COMPANION_KEY: AgCnfbrG/ji25f6RV/avt613WpOpZNlPsuTP/DU9HULXC1aMM3HzEJR3lIEfeqt9y7iHI7Z4WdD4EqYjdWeDkmLnBLkQB3V7RfPm8tNcfRmMad+Q7bm0viSSq2WhxPtVvtI1G5zoIWs4RGw7F+ee7JqDz8rCKWSHJ0XyuBJUsk3bBLXWNhWtxbaWJz/uxNQoO8ZHV+fa00kqijGcebj9IM6wq4Q7CI5n1NcQqJhJPg1ggOavAiOgcrV5z82PUXDx2tdVbXbynNJfzrTYrU4s0f08rYAT5qF3nXZFtRs4sWEEYCTXZ/E7OdOmWFTsA7af2S1DLE8pkNjzKlVQo/wBV6mvCJcQZtgtLiAKDwnYdoExp8gP9SgL89lyZEa56KtEBAbnU/YBpEQndaFDoLb3mKd1YHn5j4wJXvxinuMEHz9HCANEgDB1NvNGTy443nzzlUzbOiFmMudhBV5wzN9wQ7KNRwVSlU5OlmKO3gBw/gvCAZEKmsHMcDKvUpkKrcDvIMkEA6cCg3Wms8+Le/4EyvRr2VOu+rTXX01/rJ97bcsLGXddJuxc2xvKW6QZEWGtRiK90zkUCaY+PJH1djmjCEb8JIrdGhYy3CMrS3SEVxgPQl0rduAg+z3FtWR4GMttWA7lU1/bPtCIhM+OzgFd/Dy79DuNw4+tbjzEINJUgPpmpYL+1GbsjZ+R48B9pppM+rzKrdfxsOdSvEjTQewn0L14
-    INVIDIOUS_DB_PASSWORD: AgA3xb3XXIxHQVbjaZGb6xkWwrr5HSN8B/iF4Kl0EaQyivs7fYqoE3daylu/2x6D0btH/JYWK9+NeyFVNXPCy3holiteD5/9mJFqBCbtkAFxF0lKyLRjtw5BB6Wp5b/HuVJuLQG4sd+TB9XMGDeRyRkXjTRH0NbXYMlcVILAugb3vBNVCcLQqzlHbOngEMOUZxuUcMPL8crOGOmKosTKrWyt2weAFawlXkiz/cwlvdOmgMb8KWI1opEVAKv4OeUQeGRqa9+7fn0CcuM0PLzBvYPa2eoUb4dTFBzZfKpL5/mmZ9NUXEvV1dXN1oBHLHkIS8wBLhHAt8/Mh1rjhd5IGiIWIwlDT2iBuqKLRjwYbVbT7Co8OuTqs7OvxuYVYlmfOZna2o+kF39oeTH/RtYy3atHBsnW6j7GaUJ7nCZfDUZw4xYcHya5v+h2GI76SVnxKhjNpMGjHZMdDUD/cl3rBp+6gHICOYGCi+Wy4EYXCRJkZs0K84AFlLxoDkxARw6eBpFT+QEVnuMDXRrdNqC/Te9p5jzGWvPvXlfCCkQ9hi4hoNmZxw5P/nXdXg1rALiCVZbnM3O/Ud7KwgtYqNSCThPOj/BoExsQE4xSUJzAm35R0/AidOhOTVxztMba5co9Stavj772lRyV5PNbIieXDu6WNdOJNjjiRhuPzQTqbLzRbSa1I+KBDcbkmbOEBuyhXe1EoBp7anoHrKLYyw==
-    INVIDIOUS_HMAC_KEY: AgBqsFM5UcFmJQwCPG/xl6ZZus6u/uIlJtxsQGR1p+kWcI1DOfCqLCURxku7yuEi82HizZYDSrQ1X8rLtuBVJmCvCsgWclC+3N1zpUCBhbzzPSSa/U66D7LdDpYAgfMDpkiRMXFOZBGCZtYL7I5Wgp2vxYpjsWVXdk5GXFWbR8Dw5ndUROd2+LmrtJxaWeLiEY7OKHPZ8csEwGibIvQlyBsqPON0jKG70nes1oMFmy1TgmdYpRuW5ZwBCFu1ChpL+Ital1IR8TbSW6K2nXdpku+J+WE9CT4nFQLH/NhWsRw8MWPBp2IGnAr+/iIJJYqbfUGIzMnMpvKZW6Xna/mEBJ826WoCbs1CsUAtemmsIyDzO3tANvNEOr8UWpKm7a62HN8Y3HOiduOoonrRVCS9c8jjt1M20z8JQD06fY6ymsOXEYaYkWesO2WieJtT/6qbJlkwx9RJrdMz7mlWcN5edilkF8X3TSw4YpHP7LhofliGjBYx/w2cWWCkWN1QJhbXt2CmYKxhHnAJS/S5Lmmxs3nNpF1mVOCjTIDFXmR86wG5gJEYS7PHw1ZlMUaOeU/uG0E4caGWwJfn3/Z3upZkuuu5oFy/nDodHD+V6YKHQTQ3dWdjTXJ1kW8vLRb3Roii7dxhXW0dFhdBjyX3P6+58PAkdiZzF89naVLW8x7niFrqW5fQ5M06W/PTQQKIO37bM7L/oy/9a3XQmM8dQeTt9d9g
+    INVIDIOUS_DB_PASSWORD: AgB3juHjCLwd1wb7sP8YJN0xJAGDytBb96SzWe+zlQQhj8CRi3YzcDo5YXe/q3G3vR6UsNu1XP37HFy8OxBHSzfbF9zg6Nf20tdX5gL4wWUZrl2hLRMRexkFkk67yE5w2rxugLTxotHWdisDuZ+u47pZ0HbhEXZjtkGEDJga6cvWCEfxg/k/dcLwKXA2E1hKXUH6ePDCuii+JsTlEH3dpBiNVvKJzNs75ZVTbgPeY1ITAcCxokkOwHALN1+C6LHeoPhEYw9FKmYP8ZObSQSdWAPVxg5bN3YLWP5PEU3mxdzCXNmK/VvYzjRc9GykbegLa9qqBpoiEUEz+63uWFC9oWMKKZ8hfgRaev3rM1HsU7c/BAtxOuvqXlgc1ZsSl7JkI13+VfeBEnPGtkOgT7O/WGaPise6fqGiDLsLcvv6Hi993fSbnPsA8ldWkBtcq9311dInznEzABFDJ4mb+Q7yA6oK9TdCsIc3B3C+iFnAgRPyhw7+1ai0cLn+dE26Q+851kHo40ZS3m09K7fFhF1+t4atlZ34LZgxqqP4Shw7QOCUp32MCJfqSRVXEj6BfXEyQDF73w6UWwa7dkoGB4a9vcs+uowMRSyI9gCOj7S/MYFqaTQM8sXxKFm6W8YZBeasGq9x3cXQrtWfFSIaF7VUX9RcwrgrxyEZIz0kTCpZSwzl2EpDeWHIeGaaT/ooF1cpuwEb5P86Ys2znnJHeQ==
+    INVIDIOUS_HMAC_KEY: AgCHg2EAuB/KUeH+OEyJQSioVpwhK2ukU9GghsYCZB6NnT6Xsp3a+PCjIaE4BILQRuIIwKIvt0/1D2bWPKq8xtYc2FPbbMukyNBloTbL60R7Ev9gjS5U95+C5/X9y8venC8Rb7eCAWUMDXiO3NJfSZ9z7k4KwkkNhEbZxi6dNZmqLvmTYgMwUX5IwpszAvO/i6ee7q87Uozr/J2A5eHuXK3aJKwzW/Kkrmaj/iBVTfinFExCFpek7DIrh8Gj4DaQb7MgomIHRMesZtiWiu3Az1uxYUMt2LpY9deJVJEEW0pNNyjd9a7TtDNjECE+lP0w2tbQqYaAbXUsPj2IWbdyX8PNxELW4Ah41xuNf6pUryOMLuucMuLKds0Cdpd3nTKXfUDGpfg828wJqJLhVHgVYhH2ySrjU/hpLHgaBS6Kk/b6erP9UKI4YAtTTWzhPP4/Ub2cWmEbMeeCbX3Pcrx5uwd+95HsX1vVzuY/ouvKXNxs67nxhOyt+bKiGz8raGkFShkW9f9qLsIc2z6w35HNwFvhreUUE0yzdTNKJHPJFz4pLzGDTkpi666Vrb2MnOG65TEC79v/3sbRj9BDDjH4wuYcfVtJVEoMCn36YyFfFD6DFSIOzP8Rw477gQseHFapjuuAhrVDDvyruwg/QSz9QtJqkDJLM1ugVJT7PKJB/7MKtXoW5owsgj87VLr8CmXN2/FhmyqF3ym5gtOK47hh/x6z
+    PO_TOKEN: AgCUYCcSZIO1JtakkSD7F032TiMxNjvm0yZk3jhcn6eJ8wkYd+7I9M6n5pwbrfQCGz6asJBscFBl4iGrYFvBGy8fkZVVgDy29R7QDmirDwi35A81ZQ1zKxQJDLvCjb8UnCvmcXqSs7d0mwbVhANo2FwfJLICIv8Z54bUvODyvM9HfQVbUNlEIbeVwl82kH58/V7GhdBDjdU/UWd8hOPq8iwz20dm3jcv/U7gC0zTQUoxHjzt2uWvyYoekjTDo1bRrcew9IMaFll/Csl+U6rLrhDwiJROxp0DW2dKfFC2ledbTTHGVMD8+C6wqldpWS4sMkRZ7BH21SykEmOYCTcRRFTw0QVmi2aItbXvV0eau123a70cmvBTIDGsZDfWrtLj32i+DuJIujh8n0dzzwxjo/I3BVXIXRNU6zZDtF65DyaNSKB7eyFa7N+o3MvQ+xRP8T95Rxj+f0uTKx0UNIG/wi8DqVjZt7Cm43596nz/ShwwGJIKgavK1BwcT+tgzAfaV8bBPOnnSQcnsBE0xl5nW5eYoa4QBbxNMj3cXK/+iYR/p/LqPL9rFOqhjeEIpbGjG8TBayksB/f1QtYsTBlUXQcAcpmJ701h63/nnbNOaz5GCjIkzQ+QgiTGs6q+KH8lpIIXBRwXfzRHSBUWbT1n/N9+UAO+lQwtZuP2+s5M+8N3/9uIkXoE/fb9fXlxnxCddbZgwW6wKulYPjN0+ZXATNuaJsj4FKffYOoZ4K2L6J5IFNC08jrILVzjzIwGd4kTF7GFsgScFsJMnGZTtugzLqFMsVm0Cwa4t3ggOBCq6Y4ZWbTlP3P7qJNdV/tHsOvHxXkBT3FsUeYz7a5SYGT8Dho7hLWvXpjM8lvJ5SMb0/gFB5jnE4mgbWdbVlrbgJdcVWBWipilJ7UAcd71i5UE7Hlj
+    VISITOR_DATA: AgAfAo8J2URwMZjpbzSLTHSGYyej1KVK6lALsExWgEc8L4Ksb9uMfLN+vHkUcm4uCw1+gCKBvaUwZMXzOLOHCdIY7pNtkJ1CcRANlCJj5iMXlQJfa4+dfLCvZR/7MeEPeQsn8rJZ+KXp7R5YV37o3qtLEfC2GKL9gIMAoezYAVaATivN+ClIT0OBC8trLvkCKvtxQx/XwrIZhuAQQMRRsrb+l2+KOL+9Obkc8+6/YS3ScLv7MWXt5QTlLxn8PrLmtjhaQXDpjdNxABvStJhO7xiCzFc+/D87mSc7NWCizpT8BQe5S8Ey19DI9qZm1NAxAEA7dPfebgksgYicESPJqFcT9eD5q8fmJVML1As91T/UW24Aa2jRqqfz8OsqKb6VYTpoR8ihG7VF8n8RSz7JfZxucSZdmAHHc1q2AP7GX8QK6CyUjPEMT+ngQlpdygPhRklxtHnwRa702H6pSYmLS8BwZMkJEDJAZVZNx/5G+u/2/W0SmyVpBn5kXhtmRi+m9l2Kp/tNleScRx2Xo7nXoTlDVPQw/fnwgl+h8II3omcvmdEwlimrAyBLUvlo+dKMmy3+bwBcx82FUPznbBJtk5wr6JvK0hZFRIFkN5uhU+nhF6PPcvIgeAgnZS53ceW+fvk9IK/e+1bzQ5SyE4tPeI6HY8GAnoQVQaVJOPGz8reuaOJ/jgOtSp1Z9yzzEASDoRHmKlakdi5b4K+RhVyQOUxUgiXf5rllOpHupYZyFUjopA74YXPPmBE3PJYzvsW/aGc=
   template:
     metadata:
       creationTimestamp: null

cluster/config/secrets/openvpn-secrets-sealed.yml

@@ -7,8 +7,8 @@ metadata:
   namespace: default
 spec:
   encryptedData:
-    OPENVPN_PASSWORD: AgB3+toB4VftD143lciuA8IeF2bd38Ufow9KzIqQPVaA3QnwWFDHdcRekGT58CGSmDPGqydGFamvFytSku6Tm1Be+aV6EJtDq6h46eCOHTNsl5lnZyvIjrSqZcRQH8jMeLmsuytbR9t2/wCxJh+fvPELESosfnRLSQfJeecBJozs8xdrnYcM3rtYxzJFIVA0eRLdaORS+y/drTyky0e0Qmb1x8XkyrmjKKwqksx97L7iPoRvmXtBnMQwDVFn0Cb97dN03p8+6VW456S3IPijgzhIocrtxuuFUKrdhp7r6yPmXDEqH6OK8+Hl4fore+Cf3C+g3H7oguZmu2JkmMjko38ifKfTOqcd3a/OhS+hR45JQp0WUCps2Fnea+Wnd/C9DyBsPDvkzaWJRe9RDdl/IYL67HdfXxR2i+XZPtO9OkVC1m75v3Ciw+ZExdYGDlivyulF5Mdb46sqmFXnKDpp+ozf9gx8jLg+SehMA2jq6Vcn7kMfdAqo0chbortaswIoSPnpT9kTvHx0MUvv7i61mh41OaWiR5TzZekvaj3w1aHRLMLhmva/tGYNHd78ibDP13NUSARAvUkpwKWIbSHu0ntKOsWmFBIWgz3jnvYmOFfUCILDZ+Ke7Qv8aZ27npuuly/soxcVVQRdpMFk36V4+M74iblM8/WKxLr9THL5zUul2kvDdFG+J3V9ZAmKNy1xsZIkCn2eLN70eAY5G+awnM98UAi0SQPnMXY=
-    OPENVPN_USER: AgCoczTvW89qV1innW6b3tonmQDQD8PpWz9lnV5s5aCYplxOpthsNJDWxM6vwnSPsiTe+yYxJyWdeU7Cm7rnOfWzVluodkCVI9a9aDwxm8s7F1opUWJfeuJS3sj9/tO95g5zLm5bNZPKkb3ZHIFEhg2DLtN3SZ7C6voTGmiTesaY4rYMi1FNbEMoTJ3uWfF6DT8Pu2IZfpoRKrSAbZ181lmg/BtpQNVLWCVciCmrLhmMZPSIcvruFN4Jzw9lNrOgPSdbAcLBePgDCmgMKrHAGgwIRFLKkLgC3351h+JWL1TkvgtN6rHUQJrEVvjBsa92UekbImxXygNWr91aIjgUkPR+dhxn98gRaTPGcNdCMWOp5ctZmK51aQqryJyT1CIMEtZ49tM+0g28yxL+McRVR4Tw7yPqEmdjBexg1QufMcQIdGCQ/Zymu829ZtlRBjkGgKFDdCd2Q89PhkVQuIoLt32OV6LnW9QMphHoy+7go9umk72eU7MqiwI+086GTqb1FcuWsoEognCyb+KaDJSVPSauLVNZ6UJCCF/p4oHaYPP7y8sxPgbfzaP7YIIqaMvjevva9wkFKSHashE2QloOXgTV/9gyoHSQJiteCgbkylNN3cGhofiv2+qZjxCFda/ROzB1c159aKLJlcfbLlYXi3xGpY75WIbAb322gDWEX7w0w0NUr/ijpY6lhWxetwqgBIYLaCLYZNOrHzdkL3wLU0Dsfh/ENVtI0wE=
+    OPENVPN_PASSWORD: AgCTUDZ/JAYAPs7rZLIzJ1OS1VAJRb4NoXOZw/iP2MLr1WRqG18+lR5btg4YEDfTnEPiYvXfKmviAe0BpgCyTWeP9L2IG7g4TRMvpV4diZ50VkEPb5Nx9SBxgl2RehefsQDgZyDnwUp+M4KQ3nY+VTKpp/wHcvd/DMVWb8HdvcEAZfpu9MqbSEY4KYbzaR0VRCKIlHSwGgfXV1pfLr2eRwwVmrm6Dq0MdjYTxBs6ghEIRbee56ICwjcSlEcTRySENf1KDWyCBLEYaXz7yUPuwinEmPwTnaDeubKDAQadRjayV8UCk9xRZTqFZH4bUzt1C8nXm4doWLTjh/KIvdrom2fENF8CZcKUJYYRenQGUJy9ry4W1uX4RCl0pp4jPoXqSvWK79J7tcXmQQeNM2eVA2w4xPiGrMJLIpmvojlh9OSpFoCOhN6nFV90hBBAjbQeAtsZkxuS2l2MBkh/4rpj4NHfh/ijwumh3gMpCX3oPGy7dtx0bG7HllWXbobc0X9AU46QJRr69MBDxAAIuu6dnlv7Taz3o33sjV3Kpvu6pkE3pu3Zz4MS1dtGq8YCqBBqQPW0QMDl53i+AXjfA/ZSZAMJrCztgLsKIBvB+oiqPPx9oFoeQkSVYRG6qmb8+cRlhWOC9JUSL+LOwJGQIJAwx1M/tciadI8ZMZH/BTbuKx2rjLedwANlT0TTwPb8sBItK7pPcABBwiak5ypjluM6MNXConTQdcuDYd0=
+    OPENVPN_USER: AgCWTYf4vtUD4Z6HeVzAVXnoD9FVyWPADJCrfCBj+o6iH3K5uViouu58zIc3L8WMESvpB7kSqyx2r+j0CXG9h6JzxtNiZl2K9K0tBD3wD7fdbOOFhcIBSJNHlwQgt/SJsrx1FswgX5AzsV7kD6jzbwfO8MGx8UDlcy+cjxzX7m7uI+yaJHbxniNWcyjOdiVYrbQLnVDnuNMFBN8RF/wQIs1Y0SJwDQEupqKj6BnootTM+/Rz1kXQv3bzCP3eVDzHnbsy/PttPiHcU/mLMfeW1/Uvy9WIuCJqi9r6LpuNWG46HxLkThwoDLJlAoHD3ILJtOumFtHjVKCjjIH4NlqGouz2fhTwdrswU94HfSTYimIjdHcNPi/x7Bd5siv3UdqC4vT+FOR71LoNvR0D5ohbFAE5ym4Fn50lHP2N1SPtMv/NAgniL1J2rZEJkzUD3zRP/DrvF0WpaT9guhjg6fIR2gVzZmeQq7NQMMXqoUcPCAKt3Tql4TqPkAhLfS1L+Zfs53wFnMLswtY3vX224YGZTIuI8kXf00Ur3H4qAXWDQldISJ2sm2SAboGNeWrIAtimrr25XanF62cyUJws7cQN2gEKlxU44+yU/YJa0AAWy77vTwhnqdLD7rcRW2XS6vL5JbeU7edVepAdxO2Y5by89brvGnKyt6o007wwWnXTc44yj+A//2SRMJ3Wf0rBDjC3AfioyUi6sRLBUFA0oqwZt5JrV0y9XyDhwPg=
   template:
     metadata:
       creationTimestamp: null

cluster/config/secrets/pihole-secrets-sealed.yml

@@ -1,15 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  creationTimestamp: null
-  name: pihole-secrets
-  namespace: default
-spec:
-  encryptedData:
-    api_password: AgBgf97R5491tvpuCK7ZgJ5Qxg697XiuSs2jKM3FMVOStcSXDJv/+0QjJdZbmZ+jww0TeGDiZ2mPOkPsEKBETDDtR4X1zCPKIzxzOY9Gs3cX2N92NWeFQFwNN7LBF5b1CIb1Sh7OAmOtJUMv3woMbH06myfQlMuLhIxoHaRzicUJBven/DLJaYGXXHNMx5uLQv7VoPL0GyQtmo1Bf1yefGCzip+XZQ0zr+NB3pxDSYJDN/lq/VbBSZo/2I3G+RneGbA7W/JrliL/y7kgzjOFvTyxrH8e+d8BE0j5Kqzb92vRJnyOVaznzjI7pOpEO0txBEq93z5kbv7XYTXF0DKb7wjE7WDV1AUukRAhFSw1iqURL4Bew5Ni9imdHre56XfDiT6tlAee8uX7/WJ7mpWfE9YPLLhcV0IxvXanG6NAQdBJpkz6D/qSFjQg0RK5w3m8iqKUwba2enUwD2VZdbImTkAkDNRiVOuY36JJEza49pRU+aH9TC0kLk1w6Uv6DL400sUhRAHX7g+swHTPLy/KMe5lHSwmpQNRjUO7tkNTzf7JjFhKkCD/+NOIwTgY/x4PFMIctkBPkqOwiWgcy2aQ57vCSLxvY9nQkaFRsvOaIwVixfWsFqB12DH5mH+tYU7YzCgUo3ubv7RqDk4Z2WzMzowgkUeVHiCnxeJOuEKxudRXirDORkpGdbYZ5tT8WBTOMWo08u5XGv1MS8pxag==
-  template:
-    metadata:
-      name: pihole-secrets
-      namespace: default
-    type: Opaque

cluster/flux-system/gotk-sync.yaml

@@ -11,7 +11,7 @@ spec:
     branch: main
   secretRef:
     name: flux-system
-  url: ssh://git@gitea.akshun-lab.cc:222/aggarwalakshun/public-k3s.git
+  url: ssh://git@gitea.akshun-lab.uk:222/akshun/public-k3s
 ---
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization

cluster/helm/cert-manager/cert-manager-release.yml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: cert-manager
-      version: "v1.19.0"
+      version: "v1.18.2"
       sourceRef:
         kind: HelmRepository
         name: jetstack

cluster/helm/csi-driver-smb/csi-driver-smb-release.yml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: csi-driver-smb
-      version: "1.19.1"
+      version: "1.18.0"
       sourceRef:
         kind: HelmRepository
         name: csi-driver-smb
@@ -20,6 +20,3 @@ spec:
   upgrade:
     remediation:
       remediateLastFailure: true
-  values:
-    linux:
-      kubelet: /var/lib/kubelet

cluster/helm/fairwinds/goldilocks-release.yml

@@ -1,29 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: goldilocks
-  namespace: goldilocks
-spec:
-  interval: 24h
-  chart:
-    spec:
-      chart: goldilocks
-      version: "10.1.0"
-      sourceRef:
-        kind: HelmRepository
-        name: fairwinds-stable
-        namespace: flux-system
-      interval: 24h
-  install:
-    createNamespace: true
-  upgrade:
-    remediation:
-      remediateLastFailure: true
-  values:
-    vpa:
-      enabled: true
-    dashboard:
-      service:
-        type: LoadBalancer
-        port: 9999

cluster/helm/fairwinds/goldilocks-repo.yml

@@ -1,9 +0,0 @@
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: fairwinds-stable
-  namespace: flux-system
-spec:
-  interval: 24h
-  url: https://charts.fairwinds.com/stable

cluster/helm/gpu-operator/gpu-operator-release.yml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: gpu-operator
-      version: "v25.3.4"
+      version: "v25.3.1"
       sourceRef:
         kind: HelmRepository
         name: nvidia

cluster/helm/intel-gpu/intel-device-operator.yml

@@ -1,23 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: device-plugin-operator
-  namespace: gpu-operator
-spec:
-  interval: 24h
-  chart:
-    spec:
-      chart: intel-device-plugins-operator
-      version: "0.34.0"
-      sourceRef:
-        kind: HelmRepository
-        name: intel
-        namespace: flux-system
-      interval: 24h
-  install:
-    remediation:
-      retries: 3
-  upgrade:
-    remediation:
-      retries: 3

cluster/helm/intel-gpu/intel-plugin-operator.yml

@@ -1,27 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: gpu-device-plugin
-  namespace: gpu-operator
-spec:
-  interval: 24h
-  chart:
-    spec:
-      chart: intel-device-plugins-gpu
-      version: "0.34.0"
-      sourceRef:
-        kind: HelmRepository
-        name: intel
-        namespace: flux-system
-      interval: 24h
-  install:
-    remediation:
-      retries: 3
-  upgrade:
-    remediation:
-      retries: 3
-  values:
-    sharedDevNum: 4
-    nodeSelector:
-      intel.feature.node.kubernetes.io/gpu: 'true'

cluster/helm/intel-gpu/intel-repo.yml

@@ -1,9 +0,0 @@
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: intel
-  namespace: flux-system
-spec:
-  interval: 24h
-  url: https://intel.github.io/helm-charts

cluster/helm/newt/newt-cred-sealed.yml

@@ -1,16 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: newt-cred
-  namespace: newt-ns
-spec:
-  encryptedData:
-    NEWT_ID: AgANlHH+ezjEX2Vlu5VgJF0XVqQopfthSt1J1lRSIrB6gHooRKa/Nx55ZZwwJiOzgLz5Rm1XLL2AO9lP+r9gxkPp0QO6gBOciIT5JjF7KPYGd8Mz7JM3YvQmrmQVe5gwltoLcpNgNkOcqf2i4BvLKrsEfLzfYci6nH3paWaopi5pWdzSKmyfJfSL1LtftBBbWMZ4GYq54KiQM8+vrxH8QqnhKrASnd+zQ1Yb1NA0RiraSom8OZiStyvNo4F82bRyZWIBgp7O23gUXH4+Zf5ZbiH1hMiZZOwQfc+sRp3E9b3x5AZAMeWv6RSuRbfX/yODY2mwptAM5sAAaKAwnf53pUA9pqYN0/taAUrEQLd6TNw1nRAuxdZwsKCt/FnWkEo0WtVkiUeciNQMVrlCvQ6YvKU3+1fYYYSMuwpP4gBbjgLmeY+gQVcBwKi8eRHAxaRuhqBP22wdVozlKcA9UysRNu0VcnB5sAsxxpHwWMQgwJ7DvayMgX10tdnXDtBCYGNOeKuDnJWbkAEHAOLguYW8VsZSXB1a+1SQe/MVnTAPKTgqKwbD8Tf2pDOg11z/WwpRXLgRyahmxJt+li2vEE7PVjyVFF1ZN81TYlnlOiGkMSYB5bHT2zcQZ2hxa4J1QBzl3J1kAydyrCQZNvkzQ0vrtKSt6k8cAlsr61b4zPhX7IrSGjQw3zRjnAMAJc2zvDu2FB53641hZknoO2HsAZbqDXw=
-    NEWT_SECRET: AgAffzmD9CZCn4P3GNC0sT3h86iPpzvMvmELZpqUOfWsMgPq6cY/HSfd927ShxPEDZXrd1FLDu+tH9Ealk2duhkq0YEanaMu5j5x8/GiSctRdhtD6H8t4uONRXQjKWG2HaySz7oR+GcO8/EM6rEcki17HhI7px+dzLm7HowcBMvw2ne+RqthmdOlVvxeIzLejnWIrzY2wcuieK7r3zq+d3unZi9T7GbevmzCA5V3wQrWqvsNezHHj0BIJlIYn3Vzx5ZZN6pgUT8x0y8TteC+FtHDKgODHgtT2ZYkK+LR3wtCXgO1Y6NILr2Ijg96aeL8/TYY3e5T8q4cKr1HabYjfenCjigzuqS27m9u2wCI8Zv6ffWjEYUED4GQ8oXqMyE44pYrzzb+Do3V3Ezj6PMDEvtQaWJ78JvQaOdHnszXMXpAsIsKhgeo7WdiIJWBnFW9lYhC3OdxuW2yNi5lv9z/oJEB+13pmVHkTzYHqhollz1AAY5nna5+JHNNFbRfbj8pj7I07qjOj291e2jZ+p9LBkip5xNfVOeSoX8YOwn8aZTaZPKvPgSZFvFS54JlcO8KWIeqGOc2CKO0r+6GaysO+6LxHH8WGdxxh9JLlNZdcnunQ9Cxlh1vPTuxG7zhEu4KiWwL/5KAQf9Ksyd33WdgR4qNQGnfXccomGRD4fxral6K8jDJjDJlCUQcbYAl2n+eMu377YWkhW0ecMLgYiLzkyNdZO5HnuoNqHr+HsUD+4g7UNtb8cwFhj6uaX+6RXlBS/U=
-    PANGOLIN_ENDPOINT: AgCkSy8lFTJZJT0luEKhfSOMO9aeSsUvmxaLXc9+nDHmlDoWBv15q7uEsutXDr8OPuM9sl7g6KLfYFTlaPO502Wrw/FV6ncX6es/KfguEydAebdl3uZ096FcwaTGtcpd/mdo4W8z2348EnttoxeJ23tZWabZcYfyVu/UA4Sor05hpnYdTxK3mYra89dhb/u4Pz5BdQUKlseCIWiLqk7HON0nI775ANq8OJ6MZeMSZoAdjOdy24hw3SSwwpX1Y1p6Ior5UV9tiCXpbL5UVj6Wo4LIGkqBRomPQ3V6Furim5bhfLDNDYTFVqWo0UEa6eYwP6NgPZ+oxfI1pFdio1g39+iY9AHlJoYRDkYF0wJLjfGdnju4L+KXsdWiyQVXS7lX+GAohna3p3xSaOrFzYt3SxEQ9lGvUFrXIXB5UrBrN1iODpbRyJb6KdXNZM9SklKKycZ9WCfLzhWV1ppwReQrICR4JljngSMWuBGxjr90BlkvMSQVOFGrHSs9AeY/ymf6P1TQ8WwecivTZ3oK8x+NIqdJSXRr2HEZkNOfJH4hDcD9NLO/7Wt/bkp4sX8Bvs2MrZ466hHovm2ENC9Cz/LHZLpHHtidmBn4hgrT39Cjgbq6bPR2SBSQnoXB/FVA9zuqJ6E+Z69O3pdXtxTEIZAvtJ4BaEiOkzQzonScowNwklnkEaru/TSx50rNjfW2k2CNx/Tz7XZf4vEudRbxc1nzXxzkMnQyldheczPjnWvcTgI=
-  template:
-    metadata:
-      name: newt-cred
-      namespace: newt-ns
-    type: Opaque

cluster/helm/newt/newt-release.yml

@@ -1,29 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: newt
-  namespace: newt-ns
-spec:
-  interval: 24h
-  chart:
-    spec:
-      chart: newt
-      version: "1.1.0"
-      sourceRef:
-        kind: HelmRepository
-        name: newt
-        namespace: flux-system
-      interval: 24h
-  install:
-    remediation:
-      retries: 3
-  upgrade:
-    remediation:
-      retries: 3
-  values:
-    newtInstances:
-      - name: main
-        enabled: true
-        auth:
-          existingSecretName: newt-cred

cluster/helm/newt/newt-repo.yml

@@ -1,9 +0,0 @@
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: newt
-  namespace: flux-system
-spec:
-  interval: 24h
-  url: https://charts.fossorial.io