Update searxng/searxng Docker digest to 606eaa7

.gitea/workflows/renovate.yml

@@ -1,25 +1,22 @@
-name: renovate
+name: Renovate
 
 on:
   schedule:
-    - cron: "@daily"
+    - cron: '@daily'
   workflow_dispatch:
 
 jobs:
   renovate:
     runs-on: ubuntu-latest
-    container:
-      image: renovate/renovate:41.97.7
-      options: |-
-        --network=bridge
-
     steps:
       - name: Checkout repository
         uses: actions/checkout@v4
 
       - name: Run Renovate
+        uses: docker://renovate/renovate:41.83.2
         env:
+          LOG_LEVEL: info
           RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
           GITHUB_COM_TOKEN: ${{ secrets.PAT_TOKEN }}
-        run: |
+        with:
-          renovate
+          args: ''

cluster/apps/bazarr/bazarr-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: bazarr-longhorn
+  name: bazarr-ceph
   namespace: default
 spec:
   accessModes:
@@ -11,4 +11,4 @@ spec:
   resources:
     requests:
       storage: 5Gi
-  storageClassName: longhorn
+  storageClassName: csi-rbd-sc

cluster/apps/bazarr/bazarr.yml

@@ -5,7 +5,7 @@ metadata:
   name: bazarr
   namespace: default
 spec:
-  strategy:
+  stratergy:
     type: Recreate
   replicas: 1
   selector:
@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
       - name: bazarr
-        image: linuxserver/bazarr:1.5.3
+        image: linuxserver/bazarr:1.5.2
         ports:
         - containerPort: 6767
         env:
@@ -38,7 +38,7 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: bazarr-longhorn
+          claimName: bazarr-ceph
       - name: tv
         nfs:
           server: 10.0.0.123

cluster/apps/code-server/code-server-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: code-server-longhorn
+  name: code-server-ceph
   namespace: default
 spec:
   accessModes:
@@ -11,4 +11,4 @@ spec:
   resources:
     requests:
       storage: 1Gi
-  storageClassName: longhorn
+  storageClassName: csi-rbd-sc

cluster/apps/code-server/code-server-svc.yml

@@ -9,6 +9,6 @@ spec:
     app: code-server
   type: LoadBalancer
   ports:
-  - port: 8448
+  - port: 8443
     targetPort: 8443
     protocol: TCP

cluster/apps/code-server/code-server.yml

@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
       - name: code-server
-        image: lscr.io/linuxserver/code-server:4.104.3
+        image: lscr.io/linuxserver/code-server:4.103.2
         ports:
         - containerPort: 8443
         env:
@@ -46,4 +46,4 @@ spec:
       volumes:
       - name: code-server
         persistentVolumeClaim:
-          claimName: code-server-longhorn
+          claimName: code-server-ceph

cluster/apps/drone/drone-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: drone-longhorn
+  name: drone-ceph
   namespace: default
 spec:
   accessModes:
@@ -11,4 +11,4 @@ spec:
   resources:
     requests:
       storage: 1Gi
-  storageClassName: longhorn
+  storageClassName: csi-rbd-sc

cluster/apps/drone/drone.yml

@@ -32,10 +32,10 @@ spec:
             echo "Gitea is ready!"
       containers:
       - name: drone-server
-        image: drone/drone:2.26.0
+        image: drone/drone:2
         env:
         - name: DRONE_GITEA_SERVER
-          value: "https://gitea.akshun-lab.cc"
+          value: "https://gitea.akshun-lab.uk"
         - name: DRONE_GITEA_CLIENT_ID
           valueFrom:
             secretKeyRef:
@@ -52,16 +52,16 @@ spec:
               name: drone-gitea-secrets
               key: rpc_secret
         - name: DRONE_SERVER_HOST
-          value: "drone.akshun-lab.cc"
+          value: "drone.akshun-lab.uk"
         - name: DRONE_SERVER_PROTO
           value: "https"
         - name: DRONE_USER_CREATE
-          value: "username:aggarwalakshun,admin:true"
+          value: "username:akshun,admin:true"
         volumeMounts:
         - name: drone-data
           mountPath: /data
       - name: drone-runner
-        image: drone/drone-runner-kube@sha256:a515ca817bb61be2801e5c70245ca7c2be0fce7b28b91bd7a6d0dd2f1d22eb23
+        image: drone/drone-runner-kube:latest
         env:
         - name: DRONE_RPC_PROTO
           value: "http"
@@ -80,4 +80,4 @@ spec:
       volumes:
       - name: drone-data
         persistentVolumeClaim:
-          claimName: drone-longhorn
+          claimName: drone-ceph

cluster/apps/ersatztv/ersatztv-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: ersatztv-longhorn
+  name: ersatztv-ceph
   namespace: default
 spec:
   accessModes:
@@ -10,5 +10,5 @@ spec:
   volumeMode: Filesystem
   resources:
     requests:
-      storage: 5Gi
+      storage: 1Gi
-  storageClassName: longhorn
+  storageClassName: csi-rbd-sc

cluster/apps/ersatztv/ersatztv.yml

@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
       - name: ersatztv
-        image: jasongdove/ersatztv:v25.7.1
+        image: jasongdove/ersatztv:v25.4.0
         ports:
         - containerPort: 8409
         volumeMounts:
@@ -40,7 +40,7 @@ spec:
       volumes:
       - name: data
         persistentVolumeClaim:
-          claimName: ersatztv-longhorn
+          claimName: ersatztv-ceph
       - name: i915
         hostPath:
           path: /dev/dri

cluster/apps/ghostfolio/ghostfolio-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: ghostfolio-longhorn
+  name: ghostfolio-ceph
   namespace: default
 spec:
   accessModes:
@@ -11,4 +11,4 @@ spec:
   resources:
     requests:
       storage: 1Gi
-  storageClassName: longhorn
+  storageClassName: csi-rbd-sc

cluster/apps/ghostfolio/ghostfolio.yml

@@ -78,7 +78,7 @@ spec:
               key: postgres-password
       containers:
       - name: ghostfolio
-        image: docker.io/ghostfolio/ghostfolio:2.208.0
+        image: docker.io/ghostfolio/ghostfolio:2.193.0
         securityContext:
           capabilities:
             drop:
@@ -123,4 +123,4 @@ spec:
       volumes:
       - name: ghostfolio-data
         persistentVolumeClaim:
-          claimName: ghostfolio-longhorn
+          claimName: ghostfolio-ceph

cluster/apps/gitea-act/gitea-act-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: gitea-act-runner-longhorn
+  name: gitea-act-runner-ceph
   namespace: default
 spec:
   accessModes:
@@ -10,5 +10,5 @@ spec:
   volumeMode: Filesystem
   resources:
     requests:
-      storage: 100Mi
+      storage: 1Gi
-  storageClassName: longhorn
+  storageClassName: csi-rbd-sc

cluster/apps/gitea-act/gitea-act.yml

@@ -18,14 +18,14 @@ spec:
       labels:
         app: gitea-act-runner
     spec:
-      restartPolicy: Always
       hostNetwork: true
+      restartPolicy: Always
       volumes:
       - name: docker-certs
         emptyDir: {}
       - name: runner-data
         persistentVolumeClaim:
-          claimName: gitea-act-runner-longhorn
+          claimName: gitea-act-runner-ceph
       initContainers:
       - name: wait-for-gitea
         image: busybox
@@ -40,7 +40,7 @@ spec:
           echo "Gitea is ready!"
       containers:
       - name: runner
-        image: gitea/act_runner@sha256:8477d5b61b655caad4449888bae39f1f34bebd27db56cb15a62dccb3dcf3a944
+        image: gitea/act_runner@sha256:62a561c82dd67ec77ea600db7eac78ac5fed8e2244950fbf1829c54da12e8e54
         command: ["sh", "-c", "while ! nc -z localhost 2376 </dev/null; do echo 'waiting for docker daemon...'; sleep 5; done; /sbin/tini -- run.sh"]
         env:
         - name: DOCKER_HOST
@@ -52,7 +52,7 @@ spec:
         - name: GITEA_INSTANCE_URL
           value: "https://gitea.akshun-lab.cc"
         - name: GITEA_RUNNER_REGISTRATION_TOKEN
-          value: "uxvKmGvtraocJMCcfJ101XC9kUoY8OlCEN18CvgZ"
+          value: "NvAHP4f1in4Fpe6VFaiwiN98IR0poOQoDv4dDKcN"
         - name: CONFIG_FILE
           value: "/data/config.yaml"
         volumeMounts:
@@ -61,7 +61,7 @@ spec:
         - name: runner-data
           mountPath: /data
       - name: daemon
-        image: docker:28.5.1-dind
+        image: docker:28.3.3-dind
         env:
         - name: DOCKER_TLS_CERTDIR
           value: /certs
@@ -70,3 +70,4 @@ spec:
         volumeMounts:
         - name: docker-certs
           mountPath: /certs
+ 

cluster/apps/gitea/gitea-db.yml

@@ -43,4 +43,4 @@ spec:
       volumes:
       - name: db
         persistentVolumeClaim:
-          claimName: gitea-db-longhorn
+          claimName: gitea-db-ceph

cluster/apps/gitea/gitea-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: gitea-app-longhorn
+  name: gitea-app-ceph
   namespace: default
 spec:
   accessModes:
@@ -11,13 +11,13 @@ spec:
   resources:
     requests:
       storage: 5Gi
-  storageClassName: longhorn
+  storageClassName: csi-rbd-sc
 
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: gitea-db-longhorn
+  name: gitea-db-ceph
   namespace: default
 spec:
   accessModes:
@@ -26,4 +26,4 @@ spec:
   resources:
     requests:
       storage: 5Gi
-  storageClassName: longhorn
+  storageClassName: csi-rbd-sc

cluster/apps/gitea/gitea.yml

@@ -29,7 +29,7 @@ spec:
           done
       containers:
       - name: gitea
-        image: gitea/gitea:1.24.6
+        image: gitea/gitea:1.24.5
         ports:
         - containerPort: 22
         - containerPort: 3000
@@ -69,4 +69,4 @@ spec:
           type: File
       - name: gitea-data
         persistentVolumeClaim:
-          claimName: gitea-app-longhorn
+          claimName: gitea-app-ceph

cluster/apps/gotenberg/gotenberg-svc.yml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: gotenberg-service
-  namespace: default
-spec:
-  selector:
-    app: gotenberg
-  type: ClusterIP
-  ports:
-  - port: 3000
-    targetPort: 3000

cluster/apps/gotenberg/gotenberg.yml

@@ -1,30 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: gotenberg
-  namespace: default
-spec:
-  selector:
-    matchLabels:
-      app: gotenberg
-  template:
-    metadata:
-      labels:
-        app: gotenberg
-    spec:
-      securityContext:
-        runAsUser: 1001
-      containers:
-      - name: gotenberg
-        image: gotenberg/gotenberg:8.24
-        command:
-        - sh
-        - -c
-        - |
-          gotenberg --chromium-disable-javascript=true --chromium-allow-list=file:///tmp/.*
-        ports:
-        - containerPort: 3000
-        securityContext:
-          readOnlyRootFilesystem: false
-          allowPrivilegeEscalation: false
-          privileged: false

cluster/apps/homepage/homepage-config.yml

@@ -52,7 +52,7 @@ data:
         useEqualHeights: true
         hideErrors: true
         statusStyle: "dot"
-        background: /images/sur.png
+        background: /images/background.png
     services.yaml: |
         - Apps:
               - Sonarr:
@@ -167,36 +167,6 @@ data:
                         url: http://10.0.0.14:3011
                         key: "${GITEA_API_KEY}"
                         fields: ["repositories", "issues", "pulls"]
-              - Pihole:
-                    href: https://pihole.akshun-lab.cc/admin
-                    description: ad blocker
-                    icon: pi-hole.png
-                    namespace: default
-                    podSelector: app=pihole
-                    app: pihole
-                    widget:
-                        type: pihole
-                        url: http://10.0.0.14:8585
-                        version: 6
-                        key: "${PIHOLE_PASSWORD}"
-              - Nextcloud:
-                    href: https://nextcloud.akshun-lab.cc
-                    description: files
-                    icon: nextcloud.png
-                    namespace: default
-                    podSelector: app=nextcloud
-                    app: nextcloud
-                    widget:
-                        type: nextcloud
-                        url: https://10.0.0.14:9200
-                        key: "${NEXTCLOUD_PASSWORD}"
-              - Crafty:
-                    href: https://crafty.akshun-lab.cc
-                    description: minecraft server manager
-                    icon: crafty-controller.png
-                    widget:
-                        type: minecraft
-                        url: udp://192.168.1.3:25565
               - Proxmox:
                     href: https://proxmox.akshun-lab.cc
                     description: VMs
@@ -224,6 +194,13 @@ data:
                     podSelector: app=invidious
                     app: invidious
                     icon: invidious.png
+              - Nextcloud:
+                    href: https://nextcloud.akshun-lab.cc
+                    description: files
+                    icon: nextcloud.png
+                    namespace: default
+                    podSelector: app=nextcloud
+                    app: nextcloud
               - VS Code:
                     href: https://vs.akshun-lab.cc
                     description: VS code server
@@ -259,6 +236,13 @@ data:
                     namespace: default
                     podSelector: app=paperless-ngx
                     app: paperless-ngx
+              - Open-WebUI:
+                    icon: ollama.png
+                    description: ollama Frontend
+                    href: https://ollama.akshun-lab.cc
+                    namespace: default
+                    podSelector: app=open-webui
+                    app: open-webui
               - Ghostfolio:
                     icon: ghostfolio.png
                     description: portfolio analyzer
@@ -266,6 +250,12 @@ data:
                     namespace: default
                     podSelector: app=ghostfolio
                     app: ghostfolio
+              - Drone:
+                    icon: drone.png
+                    description: CI/CD
+                    namespace: default
+                    app: drone
+                    href: https://drone.akshun-lab.cc
               - Searxng:
                     icon: searxng.png
                     description: search engine

cluster/apps/homepage/homepage-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: homepage-longhorn
+  name: homepage-ceph
   namespace: default
 spec:
   accessModes:
@@ -11,4 +11,4 @@ spec:
   resources:
     requests:
       storage: 100Mi
-  storageClassName: longhorn
+  storageClassName: csi-rbd-sc

cluster/apps/homepage/homepage.yml

@@ -42,7 +42,7 @@ spec:
               subPath: services.yaml
       containers:
         - name: homepage
-          image: "ghcr.io/gethomepage/homepage:v1.5.0"
+          image: "ghcr.io/gethomepage/homepage:v1.4.6"
           imagePullPolicy: IfNotPresent
           env:
             - name: HOMEPAGE_ALLOWED_HOSTS
@@ -86,7 +86,7 @@ spec:
             name: homepage
         - name: images
           persistentVolumeClaim:
-            claimName: homepage-longhorn
+            claimName: homepage-ceph
         - name: logs
           emptyDir: {}
         - name: tmp

cluster/apps/immich/immich-ml.yml

@@ -16,9 +16,10 @@ spec:
       labels:
         app: immich-ml
     spec:
+      runtimeClassName: nvidia
       containers:
       - name: immich-machine-learning
-        image: ghcr.io/immich-app/immich-machine-learning:v2.0.1-openvino
+        image: ghcr.io/immich-app/immich-machine-learning:v1.139.4-cuda
         ports:
         - containerPort: 3003
         env:
@@ -33,10 +34,10 @@ spec:
           mountPath: /cache
         resources:
           requests:
-            gpu.intel.com/i915: "1"
+            nvidia.com/gpu: "1"
           limits:
-            gpu.intel.com/i915: "1"
+            nvidia.com/gpu: "1"
       volumes:
       - name: model-cache
         persistentVolumeClaim:
-          claimName: immich-cache-longhorn
+          claimName: immich-cache-ceph

cluster/apps/immich/immich-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: immich-cache-longhorn
+  name: immich-cache-ceph
   namespace: default
 spec:
   accessModes:
@@ -11,34 +11,27 @@ spec:
   resources:
     requests:
       storage: 10Gi
-  storageClassName: longhorn
+  storageClassName: csi-rbd-sc
 
 ---
 apiVersion: v1
 kind: PersistentVolume
 metadata:
-  annotations:
-    pv.kubernetes.io/provisioned-by: smb.csi.k8s.io
   name: immich-pictures-pv
   namespace: default
 spec:
   capacity:
-    storage: 100Gi
+    storage: 20Gi
+  volumeMode: Filesystem
   accessModes:
     - ReadWriteMany
   persistentVolumeReclaimPolicy: Retain
-  storageClassName: immich-pictures-pv
   mountOptions:
-    - dir_mode=0777
+    - hard
-    - file_mode=0777
+    - nfsvers=4.1
-  csi:
+  nfs:
-    driver: smb.csi.k8s.io
+    path: /pictures
-    volumeHandle: 10.0.0.123#pictures#immich
+    server: 10.0.0.123
-    volumeAttributes:
-      source: //10.0.0.123/pictures
-    nodeStageSecretRef:
-      name: smb-creds
-      namespace: default
 
 ---
 apiVersion: v1
@@ -49,7 +42,8 @@ metadata:
 spec:
   accessModes:
     - ReadWriteMany
-  storageClassName: immich-pictures-pv
+  storageClassName: ""
+  volumeName: immich-pictures-pv
   resources:
     requests:
-      storage: 100Gi
+      storage: 20Gi

cluster/apps/immich/immich.yml

@@ -39,7 +39,7 @@ spec:
           done
       containers:
       - name: immich-server
-        image: ghcr.io/immich-app/immich-server:v2.0.1
+        image: ghcr.io/immich-app/immich-server:v1.139.4
         ports:
         - containerPort: 2283
         env:

cluster/apps/invidious/invidious-config.yml

@@ -13,7 +13,8 @@ data:
       host: localhost
       port: 5432
     check_tables: true
-    invidious_companion:
+    signature_server: localhost:12999
-    - private_url: "http://localhost:8282/companion"
+    visitor_data: ${VISITOR_DATA}
-    invidious_companion_key: ${INVIDIOUS_COMPANION_KEY}
+    po_token: ${PO_TOKEN}
+    port: 3000
     hmac_key: ${INVIDIOUS_HMAC_KEY}

cluster/apps/invidious/invidious-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: invidious-longhorn
+  name: invidious-ceph
   namespace: default
 spec:
   accessModes:
@@ -11,4 +11,4 @@ spec:
   resources:
     requests:
       storage: 1Gi
-  storageClassName: longhorn
+  storageClassName: csi-rbd-sc

cluster/apps/invidious/invidious.yml

@@ -65,22 +65,21 @@ spec:
         volumeMounts:
         - name: postgres-data
           mountPath: /var/lib/postgresql/data
-      - name: inv-companion
+      - name: inv-sig-helper
-        image: quay.io/invidious/invidious-companion@sha256:a96f7a1eb88bf0d5882d519c9410f8c7b2d391cafc378b72f3bfd37dd5f0e587
+        image: quay.io/invidious/inv-sig-helper@sha256:39fee87693ef3d71c212d9511f2adb3230783753342321489deab17caa87c42f
         restartPolicy: Always
+        args: ["--tcp", "0.0.0.0:12999"]
         env:
-        - name: SERVER_SECRET_KEY
+        - name: RUST_LOG
-          valueFrom:
+          value: "info"
-            secretKeyRef:
-              name: invidious-secrets
-              key: INVIDIOUS_COMPANION_KEY
         securityContext:
+          readOnlyRootFilesystem: true
           capabilities:
             drop:
             - ALL
       containers:
       - name: invidious
-        image: quay.io/invidious/invidious@sha256:2836b5b8226a53a9cc2afdbd5f5fe6bccdd200f2e17cd92a828b4dc8d8b5cc06
+        image: quay.io/invidious/invidious@sha256:9ffa4f1ea5cf01abe3102777102bd7a13153c79f6ff6ac072b6a29dda6909a8b
         command:
         - sh
         - -c
@@ -108,4 +107,4 @@ spec:
           name: invidious-config
       - name: postgres-data
         persistentVolumeClaim:
-          claimName: invidious-longhorn
+          claimName: invidious-ceph

cluster/apps/jellyfin/jellyfin-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: jellyfin-longhorn
+  name: jellyfin-ceph
   namespace: default
 spec:
   accessModes:
@@ -11,4 +11,4 @@ spec:
   resources:
     requests:
       storage: 20Gi
-  storageClassName: longhorn
+  storageClassName: csi-rbd-sc

cluster/apps/jellyfin/jellyfin.yml

@@ -24,6 +24,8 @@ spec:
         volumeMounts:
         - name: media
           mountPath: /media
+          readOnly: true
+          recursiveReadOnly: Enabled
         - name: config
           mountPath: /config
         - name: cache
@@ -40,7 +42,7 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: jellyfin-longhorn
+          claimName: jellyfin-ceph
       - name: cache
         hostPath:
           path: /tmp/

cluster/apps/jellyseerr/jellyseerr-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: jellyseerr-longhorn
+  name: jellyseerr-ceph
   namespace: default
 spec:
   accessModes:
@@ -11,4 +11,4 @@ spec:
   resources:
     requests:
       storage: 1Gi
-  storageClassName: longhorn
+  storageClassName: csi-rbd-sc

cluster/apps/jellyseerr/jellyseerr.yml

@@ -54,4 +54,4 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: jellyseerr-longhorn
+          claimName: jellyseerr-ceph

cluster/apps/jellystat/jellystat-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: jellystat-longhorn
+  name: jellystat-ceph
   namespace: default
 spec:
   accessModes:
@@ -11,19 +11,4 @@ spec:
   resources:
     requests:
       storage: 1Gi
-  storageClassName: longhorn
+  storageClassName: csi-rbd-sc
-
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: jellystat-backups-longhorn
-  namespace: default
-spec:
-  accessModes:
-    - ReadWriteOnce
-  volumeMode: Filesystem
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: longhorn

cluster/apps/jellystat/jellystat.yml

@@ -32,11 +32,10 @@ spec:
             secretKeyRef:
               name: jellystat-secret
               key: password
-        - name: PGDATA
-          value: /mnt/postgres/data
         volumeMounts:
-        - name: postgres-data
+        - name: backup
-          mountPath: /mnt/postgres
+          mountPath: /var/lib/postgresql/data
+          subPath: db
       containers:
       - name: jellystat
         image: cyfershepard/jellystat:1.1.6
@@ -60,12 +59,10 @@ spec:
               name: jellystat-secret
               key: jwt
         volumeMounts:
-        - name: backups
+        - name: backup
           mountPath: /app/backend/backup-data
+          subPath: backup
       volumes:
-      - name: postgres-data
+      - name: backup
         persistentVolumeClaim:
-          claimName: jellystat-longhorn
+          claimName: jellystat-ceph
-      - name: backups
-        persistentVolumeClaim:
-          claimName: jellystat-backups-longhorn

cluster/apps/nextcloud/collabora.yml

@@ -17,7 +17,7 @@ spec:
     spec:
       containers:
       - name: collabora
-        image: collabora/code:25.04.6.1.1
+        image: collabora/code:25.04.4.3.1
         ports:
         - containerPort: 9980
         env:

cluster/apps/nextcloud/nextcloud.yml

@@ -28,7 +28,7 @@ spec:
             done
       containers:
       - name: nextcloud
-        image: lscr.io/linuxserver/nextcloud:32.0.0
+        image: lscr.io/linuxserver/nextcloud:31.0.8
         ports:
         - containerPort: 443
         env:

cluster/apps/open-webui/open-webui-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: pulse-longhorn
+  name: open-webui-ceph
   namespace: default
 spec:
   accessModes:
@@ -10,5 +10,5 @@ spec:
   volumeMode: Filesystem
   resources:
     requests:
-      storage: 100Mi
+      storage: 5Gi
-  storageClassName: longhorn
+  storageClassName: csi-rbd-sc

cluster/apps/open-webui/open-webui.yml

@@ -17,7 +17,7 @@ spec:
     spec:
       containers:
       - name: open-webui
-        image: ghcr.io/open-webui/open-webui:0.6.33
+        image: ghcr.io/open-webui/open-webui:v0.6.25
         ports:
         - containerPort: 8080
         env:
@@ -29,4 +29,4 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: open-webui-longhorn
+          claimName: open-webui-ceph

cluster/apps/paperless-ngx/paperless-ngx.yml

@@ -27,7 +27,7 @@ spec:
           subPath: redis
       containers:
       - name: paperless-ngx
-        image: ghcr.io/paperless-ngx/paperless-ngx:2.18.4
+        image: ghcr.io/paperless-ngx/paperless-ngx:2.18.2
         ports:
         - containerPort: 8000
         env:
@@ -41,12 +41,6 @@ spec:
           value: "https://ngx.akshun-lab.cc"
         - name: PAPERLESS_TIME_ZONE
           value: "Asia/Kolkata"
-        - name: PAPERLESS_TIKA_ENABLED
-          value: "1"
-        - name: PAPERLESS_TIKA_ENDPOINT
-          value: "http://tika-service:9998"
-        - name: PAPERLESS_TIKA_GOTENBERG_ENDPOINT
-          value: "http://gotenberg-service:3000"
         volumeMounts:
         - name: data
           mountPath: /usr/src/paperless/data
@@ -63,4 +57,4 @@ spec:
       volumes:
       - name: data
         persistentVolumeClaim:
-          claimName: paperless-longhorn
+          claimName: paperless-ceph

cluster/apps/paperless-ngx/paperless-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: paperless-longhorn
+  name: paperless-ceph
   namespace: default
 spec:
   accessModes:
@@ -11,4 +11,4 @@ spec:
   resources:
     requests:
       storage: 1Gi
-  storageClassName: longhorn
+  storageClassName: csi-rbd-sc

cluster/apps/pihole/pihole-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: pihole-longhorn
+  name: pihole-ceph
   namespace: default
 spec:
   accessModes:
@@ -11,4 +11,4 @@ spec:
   resources:
     requests:
       storage: 1Gi
-  storageClassName: longhorn
+  storageClassName: csi-rbd-sc

cluster/apps/pihole/pihole.yml

@@ -16,18 +16,6 @@ spec:
         app: pihole
     spec:
       hostNetwork: true
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-            - matchExpressions:
-              - key: kubernetes.io/hostname
-                operator: In
-                values:
-                - kube-02
-                - kube-03
-                - kube-04
-                - kube-05
       containers:
       - name: pihole
         image: pihole/pihole@sha256:90a1412b3d3037d1c22131402bde19180d898255b584d685c84d943cf9c14821
@@ -51,4 +39,4 @@ spec:
       volumes:
       - name: pihole-data
         persistentVolumeClaim:
-          claimName: pihole-longhorn
+          claimName: pihole-ceph

cluster/apps/prowlarr/prowlarr-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: prowlarr-longhorn
+  name: prowlarr-ceph
   namespace: default
 spec:
   accessModes:
@@ -11,4 +11,4 @@ spec:
   resources:
     requests:
       storage: 1Gi
-  storageClassName: longhorn
+  storageClassName: csi-rbd-sc

cluster/apps/prowlarr/prowlarr.yml

@@ -56,4 +56,4 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: prowlarr-longhorn
+          claimName: prowlarr-ceph

cluster/apps/pulse/pulse-svc.yml

@@ -1,13 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: pulse
-  namespace: default
-spec:
-  type: LoadBalancer
-  selector:
-    app: pulse
-  ports:
-  - port: 7655
-    targetPort: 7655

cluster/apps/pulse/pulse.yml

@@ -1,30 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: pulse
-  namespace: default
-spec:
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: pulse
-  template:
-    metadata:
-      labels:
-        app: pulse
-    spec:
-      containers:
-      - name: pulse
-        image: rcourtman/pulse:4.23.0
-        volumeMounts:
-        - name: pulse-data
-          mountPath: /data
-        env:
-        - name: ALLOWED_ORIGINS
-          value: "*"
-      volumes:
-      - name: pulse-data
-        persistentVolumeClaim:
-          claimName: pulse-longhorn

cluster/apps/qbittorrent/qbittorrent-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: qbittorrent-longhorn
+  name: qbittorrent-ceph
   namespace: default
 spec:
   accessModes:
@@ -11,4 +11,4 @@ spec:
   resources:
     requests:
       storage: 1Gi
-  storageClassName: longhorn
+  storageClassName: csi-rbd-sc

cluster/apps/qbittorrent/qbittorrent.yml

@@ -58,7 +58,7 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: qbittorrent-longhorn
+          claimName: qbittorrent-ceph
       - name: downloads
         nfs:
           server: 10.0.0.123

cluster/apps/radarr/radarr-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: radarr-longhorn
+  name: radarr-ceph
   namespace: default
 spec:
   accessModes:
@@ -10,5 +10,5 @@ spec:
   volumeMode: Filesystem
   resources:
     requests:
-      storage: 2Gi
+      storage: 1Gi
-  storageClassName: longhorn
+  storageClassName: csi-rbd-sc

cluster/apps/radarr/radarr.yml

@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
       - name: radarr
-        image: lscr.io/linuxserver/radarr:5.27.5
+        image: lscr.io/linuxserver/radarr:5.26.2
         ports:
         - containerPort: 7878
         env:
@@ -46,4 +46,4 @@ spec:
           path: /merge/downloads
       - name: config
         persistentVolumeClaim:
-          claimName: radarr-longhorn
+          claimName: radarr-ceph

cluster/apps/searxng/searxng-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: searxng-longhorn
+  name: searxng-ceph
   namespace: default
 spec:
   accessModes:
@@ -11,4 +11,4 @@ spec:
   resources:
     requests:
       storage: 100Mi
-  storageClassName: longhorn
+  storageClassName: csi-rbd-sc

cluster/apps/searxng/searxng.yml

@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
       - name: searxng
-        image: searxng/searxng@sha256:0e0493d1bff9ed55f774709c9113185aa3da0db3aea84bf86b356e97a21d54c6
+        image: searxng/searxng@sha256:606eaa76b04fd313b26977656eb8344a2de667024b3b596575f2920610591d61
         ports:
         - containerPort: 8080
         env:
@@ -32,4 +32,4 @@ spec:
       volumes:
       - name: searxng
         persistentVolumeClaim:
-          claimName: searxng-longhorn
+          claimName: searxng-ceph

cluster/apps/semaphore/semaphore-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: semaphore-longhorn
+  name: semaphore-ceph
   namespace: default
 spec:
   accessModes:
@@ -11,4 +11,4 @@ spec:
   resources:
     requests:
       storage: 2Gi
-  storageClassName: longhorn
+  storageClassName: csi-rbd-sc

cluster/apps/semaphore/semaphore.yml

@@ -40,7 +40,7 @@ spec:
           subPath: db
       containers:
       - name: semaphore
-        image: public.ecr.aws/semaphore/pro/server:v2.16.34
+        image: public.ecr.aws/semaphore/pro/server:v2.16.18
         ports:
         - containerPort: 3000
         envFrom:
@@ -65,4 +65,4 @@ spec:
       volumes:
       - name: db
         persistentVolumeClaim:
-          claimName: semaphore-longhorn
+          claimName: semaphore-ceph

cluster/apps/sonarr/sonarr-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: sonarr-longhorn
+  name: sonarr-ceph
   namespace: default
 spec:
   accessModes:
@@ -11,4 +11,4 @@ spec:
   resources:
     requests:
       storage: 5Gi
-  storageClassName: longhorn
+  storageClassName: csi-rbd-sc

cluster/apps/sonarr/sonarr.yml

@@ -38,7 +38,7 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: sonarr-longhorn
+          claimName: sonarr-ceph
       - name: downloads
         nfs:
           server: 10.0.0.123

cluster/apps/speedtest/speedtest-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: speedtest-longhorn
+  name: speedtest-ceph
   namespace: default
 spec:
   accessModes:
@@ -11,4 +11,4 @@ spec:
   resources:
     requests:
       storage: 100Mi
-  storageClassName: longhorn
+  storageClassName: csi-rbd-sc

cluster/apps/speedtest/speedtest.yml

@@ -18,7 +18,7 @@ spec:
     spec:
       containers:
       - name: speedtest
-        image: lscr.io/linuxserver/speedtest-tracker:1.6.8
+        image: lscr.io/linuxserver/speedtest-tracker:1.6.6
         ports:
         - containerPort: 80
         env:
@@ -49,4 +49,4 @@ spec:
       volumes:
       - name: config
         persistentVolumeClaim:
-          claimName: speedtest-longhorn
+          claimName: speedtest-ceph

cluster/apps/tika/tika-service.yml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: tika-service
-  namespace: default
-spec:
-  type: ClusterIP
-  selector:
-    app: tika
-  ports:
-  - port: 9998
-    targetPort: 9998

cluster/apps/tika/tika.yml

@@ -1,19 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: tika
-  namespace: default
-spec:
-  selector:
-    matchLabels:
-      app: tika
-  template:
-    metadata:
-      labels:
-        app: tika
-    spec:
-      containers:
-      - name: tika
-        image: apache/tika:3.2.3.0
-        ports:
-        - containerPort: 9998

cluster/apps/vaultwarden/vaultwarden-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: vaultwarden-longhorn
+  name: vaultwarden-ceph
   namespace: default
 spec:
   accessModes:
@@ -11,4 +11,4 @@ spec:
   resources:
     requests:
       storage: 1Gi
-  storageClassName: longhorn
+  storageClassName: csi-rbd-sc

cluster/apps/vaultwarden/vaultwarden.yml

@@ -30,4 +30,4 @@ spec:
       volumes:
       - name: data
         persistentVolumeClaim:
-          claimName: vaultwarden-longhorn
+          claimName: vaultwarden-ceph

cluster/config/ceph/csi-configmap.yml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: ConfigMap
+data:
+  config.json: |-
+    [
+      {
+        "clusterID": "54ca2103-a505-46a7-a13e-0f72d6e3574a",
+        "monitors": [
+          "10.1.0.1:6789",
+          "10.1.0.2:6789",
+          "10.1.0.3:6789"
+        ]
+      }
+    ]
+metadata:
+  name: ceph-csi-config
+  namespace: ceph

cluster/config/ceph/csi-rbd-sc.yml

@@ -5,8 +5,8 @@ metadata:
    name: csi-rbd-sc
 provisioner: rbd.csi.ceph.com
 parameters:
-   clusterID: 8bb08316-8b5c-11f0-a772-bc24114124ba
+   clusterID: 54ca2103-a505-46a7-a13e-0f72d6e3574a
-   pool: kubernetes
+   pool: ceph-vm
    imageFeatures: layering
    csi.storage.k8s.io/provisioner-secret-name: csi-rbd-secret
    csi.storage.k8s.io/provisioner-secret-namespace: default
@@ -14,7 +14,7 @@ parameters:
    csi.storage.k8s.io/controller-expand-secret-namespace: default
    csi.storage.k8s.io/node-stage-secret-name: csi-rbd-secret
    csi.storage.k8s.io/node-stage-secret-namespace: default
-reclaimPolicy: Delete
+reclaimPolicy: Retain
 allowVolumeExpansion: true
 mountOptions:
    - discard

cluster/config/ceph/csi-rbd-secret.yml

@@ -0,0 +1,9 @@
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: csi-rbd-secret
+  namespace: default
+stringData:
+  userID: ceph-vm
+  userKey: AQA00Y1olRhKFxAA2zejDLWbph/eeHz33XvCxA==

cluster/config/ceph/csi-rbdplugin-provisioner.yml

@@ -48,7 +48,7 @@ spec:
       containers:
         - name: csi-rbdplugin
           # for stable functionality replace canary with latest release version
-          image: quay.io/cephcsi/cephcsi:v3.15.0-amd64
+          image: quay.io/cephcsi/cephcsi:canary
           args:
             - "--nodeid=$(NODE_ID)"
             - "--type=rbd"
@@ -159,7 +159,7 @@ spec:
             - name: socket-dir
               mountPath: /csi
         - name: csi-attacher
-          image: registry.k8s.io/sig-storage/csi-attacher:v4.10.0
+          image: registry.k8s.io/sig-storage/csi-attacher:v4.9.0
           args:
             - "--v=1"
             - "--csi-address=$(ADDRESS)"
@@ -210,7 +210,7 @@ spec:
               mountPath: /csi
         - name: csi-rbdplugin-controller
           # for stable functionality replace canary with latest release version
-          image: quay.io/cephcsi/cephcsi:v3.15.0-amd64
+          image: quay.io/cephcsi/cephcsi:canary
           args:
             - "--type=controller"
             - "--v=5"
@@ -231,7 +231,7 @@ spec:
             - name: ceph-config
               mountPath: /etc/ceph/
         - name: liveness-prometheus
-          image: quay.io/cephcsi/cephcsi:v3.15-canary-amd64
+          image: quay.io/cephcsi/cephcsi:canary
           args:
             - "--type=liveness"
             - "--endpoint=$(CSI_ENDPOINT)"

cluster/config/ceph/csi-rbdplugin.yml

@@ -29,7 +29,7 @@ spec:
               add: ["SYS_ADMIN"]
             allowPrivilegeEscalation: true
           # for stable functionality replace canary with latest release version
-          image: quay.io/cephcsi/cephcsi:v3.15-canary-amd64
+          image: quay.io/cephcsi/cephcsi:canary
           args:
             - "--nodeid=$(NODE_ID)"
             - "--pluginpath=/var/lib/kubelet/plugins"
@@ -116,7 +116,7 @@ spec:
           securityContext:
             privileged: true
             allowPrivilegeEscalation: true
-          image: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.15.0
+          image: registry.k8s.io/sig-storage/csi-node-driver-registrar:v2.14.0
           args:
             - "--v=1"
             - "--csi-address=/csi/csi.sock"
@@ -135,7 +135,7 @@ spec:
           securityContext:
             privileged: true
             allowPrivilegeEscalation: true
-          image: quay.io/cephcsi/cephcsi:v3.15-canary-amd64
+          image: quay.io/cephcsi/cephcsi:canary
           args:
             - "--type=liveness"
             - "--endpoint=$(CSI_ENDPOINT)"

cluster/config/cluster-upgrade/cluster-upgrade.yml

@@ -5,6 +5,7 @@ metadata:
   name: server-plan
   namespace: system-upgrade
 spec:
+  channel: https://update.k3s.io/v1-release/channels/stable
   concurrency: 1
   cordon: true
   nodeSelector:
@@ -16,7 +17,6 @@ spec:
   serviceAccountName: system-upgrade
   upgrade:
     image: rancher/k3s-upgrade
-  channel: https://update.k3s.io/v1-release/channels/stable
 ---
 # Agent plan
 apiVersion: upgrade.cattle.io/v1
@@ -25,6 +25,7 @@ metadata:
   name: agent-plan
   namespace: system-upgrade
 spec:
+  channel: https://update.k3s.io/v1-release/channels/stable
   concurrency: 1
   cordon: true
   nodeSelector:
@@ -39,4 +40,3 @@ spec:
   serviceAccountName: system-upgrade
   upgrade:
     image: rancher/k3s-upgrade
-  channel: https://update.k3s.io/v1-release/channels/stable

cluster/config/cluster-upgrade/system-upgrade-controller.yaml

@@ -264,7 +264,7 @@ spec:
         envFrom:
         - configMapRef:
             name: default-controller-env
-        image: rancher/system-upgrade-controller:v0.16.3
+        image: rancher/system-upgrade-controller:v0.15.2
         imagePullPolicy: IfNotPresent
         name: system-upgrade-controller
         securityContext:

cluster/config/namespaces/namespaces.yml

@@ -22,6 +22,14 @@ metadata:
   labels:
     name: monitoring
 
+---
+kind: Namespace
+apiVersion: v1
+metadata:
+  name: ceph
+  labels:
+    name: ceph
+
 ---
 kind: Namespace
 apiVersion: v1
@@ -29,19 +37,3 @@ metadata:
   name: goldilocks
   labels:
     name: goldilocks
-
----
-kind: Namespace
-apiVersion: v1
-metadata:
-  name: newt-ns
-  labels:
-    name: newt-ns
-
----
-kind: Namespace
-apiVersion: v1
-metadata:
-  name: longhorn-system
-  labels:
-    name: longhorn-system

cluster/config/secrets/homepage-secrets-sealed.yml

@@ -7,19 +7,17 @@ metadata:
   namespace: default
 spec:
   encryptedData:
-    BAZARR_API_KEY: AgDEhlYLcmagIA2aklfa0E5bGnXWgJNXisFA1EHpgVvkdTLvrOUfCS6wPOs2g93+rMgtuEtzjjxuregyXpa4Oo1dsmwwQoDup81XPTtDFvhrEr6eIohQcryMSmhOfOFd2zA2PMMoK7y7ge5cCI3q5Do+xgW8LqJkuLoCsu/9MCm3OBn9TBhzJc8mvqPdnzppddTAJ2XT3J/hod+nFetTleyOlvqWDKlcIzyUAxZJ0u8w+l6d2Ew3kUJI4o1FOJ93KNC/nJaruqPjL1KS4HynQrNPNGdkDP+i9SYRNnv9/h+J6ptp9xPpkvUjTopToBeSh0oUWXG30gy1l5PHf3RTTWIroLyGUvR6O/G/P1+Sa7uA0c9+ekChtMEUhfjXuJsDzUw19OY/wUeuINoz/MfTxVUx30eSI/2bKrq36CKpjv0tXeNr4XYzikaF985WfZqG36GlWEqDY1PZUkS1pnVM42sclEN7UhXARLrTE+xJvE9HL6YVwognP6nJCFqIqi7Q+GT2HC8rRDhn6Fbm2mkGwM1R3ssSr9mH0UBUhu44pkIQmedxhpMx/nxR0rXxlRXFiv05L7fqtY6mtEO12EDtjPY2Yh6TknxJ6+qFaxdqyBeI8X2KlPjadqt9yA8F5fC5kdKnRTfNXoF0zrCtEZXKts4joXki8pNeI41/E3nxL5gn3imOcDoAnaqKdaR2Ot8ohAKqKhZtaIfm3Q/s/z800uj3GEjYol5e54XSwcHfYqQMCA==
+    BAZARR_API_KEY: AgDVHzqBqB1eriQP48mYj0yG2Nvd+21jUN/8VH+lSS5J2NArZwxPBvK5lWqBCBFmAkw7sUuOvs2nhyeBDru2xblSygrdx5pnrJQ0d9sOq/KLfrq/APpK0QIlnjVV37yj9jkcD+dQEDRUWNEpN78farlNd3qFb2lEc56Wfh87zC0uzlftFELCOa+RFtJw96ktGk5kwySxXdJXRPB2HW7Sh2JiEb9NriOuCpW3lPfIb4VLfhlPG+DHoq30TPP3KxkNcYQMVl3noVli7XiLRgnk2+Q5g2i4umA05fex4cIx2IMON1jnhRxZxyKxVmPZwjppSejAtNwJdksGTNf3d1ljVHt/2vx799hyfXmvdYCuwYAnc/ruh2oABFEJM2R1Ji5eYBBrO8lBnPXHuuhnt/Q0q8JU4wef1c6r4KEkddfpLKN7a02dsYUe4kwLDv5IhVdzRBeUY3F+WefTaZscqqdw1W58pSF/nmUq/e3450Y++ZG13lu9kdXidoeihTll/3pMr45+8WBaAU+SHySSfJTa4ePb96j7TOAmaSLs/KjQVD/zGPbG8A7f2R9GR8qISKpp3v5pd47XExUJPQk69R5y0kjCbtdP+6EJKk92pv0EINEp2BMI78C6rov3RPU/pxhm0JaxKjYylwec+L0W7p7INcKgVg4cWWRgOUbi7UmN9qPEB/A9iFT3mI19W38rXFHJZuKSlMvxDar2oZER2WNQNma3U8DNWk8T+KDe+ctQjP31RA==
-    GITEA_API_KEY: AgCDVeoNFKMpDPaHPn9MpMJ8SgmRxafanWqdpitfsPzRf0UEnVZiNcXMqetr96C0kVJo6H3IZg/qht2nqRJIsH6RXpeqvHc4wGLMzuTvj4Y+TL0qNkN12yCojgw6gYmTZ0u0wzbglN40wt9Vxwgaqr4jX2TLM4McLHfMVCUPcKSppyy4WBEU+XDDLRQcBkWFge4MjGYnWvytWUCpMYh+oiLDfMy6YVRJkkI9cTbChJYyckM8bv1r8rWm+5XqF72E3ISVqytlorq7dHeBL9uL3iBS29dfZjX32Nne1k4/AJN5PsJInn0Y5hmlejHPal/sr5U0iVzfUJ9OP60DwiOAqcwY9hzBUTqm5W3q3uNPvj8zOWyyZ9dIrpmAKwsGifvIFccN05Qe8eZXcOe5/2PEKU8TE9+4Lr0KLqqW2X0EMb6hAMXneWFdzGTqcgrw1DeyPxDG0CPcaDcJqunuSHN6ML0yLW7HngHYKNs1WhLq2YoiUs0T7z+xrxNsT8T8pYPbiGxun78SH8j+rbEisSJo+GRJ6pAhieZVflAfoX9JKiak7Z4XzLaAUUZAYic+vLRCoQOd+5JrSAWHfnMFJlazTgkXlJ6fPclwaeqSsCGDprF73e475PK1FM54RKsTn6RHpDhr2J5+rMBJoWgHUoViDwO0EOcb+vfLOJzApTUr0cs83RYhKqsaWvJ9FlbOgbgo2ScCDfIPLFETEDGKux4r1KRvu7DNOnZYVXc0gqOa+JEP7meq68BQVqZh
+    GITEA_API_KEY: AgDN5mYCdJMbWmzZnfhtaxIBAnbh+HItDu8TEneI4JzpzJ73wPHWnvBGL/B9iGLntfPJq4fTeNqCO+9HPi+x8oTMjeDpujhGYUXflfl50ZJeupU2HO2QjYRUlZq9gSPVdOdd1t8j5QoOXaR5OAXHtorNB4bGJHUOqpvjSE44pTQnQ5lmEEy8S/vBZhR+HOOlW6GzA78XMskH400C3+zbK+k6V1yC6OuB8HkqdLAuesouzSjZIgY1SH8bF+9UZ3+1mLgERIOFiHxXZ9m32Wf9Zth7Flrk+rHn4vOoo0bCv92HlyN+oxNCjvVczmtoO3Byxyi9/zHAAyUaunk4XkXEs8fyjVRNczmySbatnXjsO4MAi6XC0oF+vR07kTCueXggfmc9rX/oSsSEL518mzFGYCbCy5RTDn4Le07Ir4osXky5e+19g78/IWd8wGejINtHABBa6GcYrSHUu9ZU9WoPoiECHHp2no3+JiAbNCDiIfNaWB+JQ3sDg4uErn578V/4deWk5fg4VJbbxCIpvzeicsvqKpvhNoB+yOYhGWhfQzlR9mcgZDTyJGlw0Xc8E3Mlok+Xz/2zdhQDmFK+zPpboJEfnibApSKIlRk2ZkD8DkSuRSwQWO5zdCSKU/BZOH+aufVocZXB+nQSgAIPnKdParx/SmoEFjOZn8H7JULgS5EiP8pNy1DuiAWsvcDfwG1feXlyMfqErSyHALmyMIIXciFxd6m7xtfKtgJk/kjGVVhu2DDlKGJDvMKB
-    IMMICH_API_KEY: AgA6zDYvJ+uMlmjQijZbTOYOmJqcLJsmrutKJBd7kB26skvpTVeC2zRx0oR2+g2j14bwwd6SRnEq35Fa/IYNKewrAvaeF+cAgTYA/8G/Nbu9w1gYChFPgK54teyemlOsuFNPjUGxf4LABkzkALXrhj3S+jTm732Ou0DEXhOh6LP615CBrtu+znkuPx6azIcw/52ZElCY1AbLMg5M4Q9Exww3vrsmXbieGpv9LlNzH4NVqKhHyZUf+Fs3uy0hmFhug/7SiVD5M87CBf6JoHV40i3/B3ZuqaqSvZgH+QE04ttzIi9nunAbin2sXGZg4zaj34Rxcq8JrPEAYfr8HGC8YBC+kB8+/J4aPCmfwZJCtEHTlm1ODmAu4mSgpQMiRAB/0UWJGmjCG32l/3Jei/ayjV9LmOVeQ2aYKzwxjzkVp++qXeNGokIgiU609ihRXM1SbnARnNGQwJbC+jiCIxLYuifkFok93454hX/eFiUHxI027fqqrymX+1YPRVdPjXwTjW2DlVs0KLHEvfKrwLxX79RsyP9aMXS5vSyn7/OnVAHNqpVongYZKe+CJK6Lv9irT5Mw+b/EoG2yYN6bLhb4djNcZ6Rer/KZloISsDrccXPt4kXlg7GCL9+JE1Kp9sGMoyFNANWfjAYebB6ntUbAHsjhkhUTV+jEac15YOxK69GXTg2o5zjYNkE2T26JEFAbjxSr8gNmPD68r/tDkyk6C2MmCmZY2Xr8gGHYOxVZfeqAsDHPty4jNOCbt2w=
+    IMMICH_API_KEY: AgCN5uNWcCOTWTs/3HqMtaaixHWRNu/ysXoEij4HeqgVcXHIfZorayWuD7qYVrg8bS9LH822JvPmeSDnY31TllvR2zCPacLwtxacZOqdKLaaxdo6ED3BU2YMZw+8U58qHXu8E1yXpcLHTmC6NVXgFYhCnlbP3Pb34lWF9We2VQsaB5FGrhNBOkj1zgiLc4TMaDmikL+0aaKE06fgmKCQc3h6p2DR4DYra54V8A2K6aXzMaDW7KPxxr6A6DjXGH0/RBphRG74MvA+o8MhH2F7a3aOZ0ofhIxClXt4JU1UkEv1oMzGGAkcak3grccRrdX3NF9KYHYwf9Cd7/cYMKpUQ65CdUuIXhgVKqev/4XesRzQBXkL2juoIEx2KdYlEyqMGKSdiO+7UK2Ih6L1i3KE/eZs1TarXHnIIIR0vAD39A7JfGBsbQCO28ACKEZ2S7Ft8RetQE3IPliYoHgiF6SxX74m4QFvGOZbK/aiZW+vjmBv3w6xGzmO+Wr8JGtqkAs9kwzQitnafRoQHyK3swEsSB8Eq+A27afNDbOaZvz0pSzqXnsikiOy15DKTfmSlATJLSd/OuzZv/r97fnFPyV7H/GWro9AznH3fDa/LIZq6TPRxVjqVpSnJXVQcJI0iEui793YX3k8tSunC5ES0F/yLy50FRqMiT3fweDHB5xNw0T9y+ho46sOWVCOifuDX8MeuEpf9dK0RRtxpd5brUMGq9REnZtyMifEaxQPYPWpc2CQf9ljyBdiyOP3M3w=
-    JELLYFIN_API_KEY: AgAl1XoPzIfEzH/GDqTNr+OSOkjkg35+eHio9t1DhSuPwT+SWZJWoMW7Mkb0eqRm6bwQp4VlyE7ZyLa1HhN25OOe8LS6Mo/G4KVgYwLXICpyDswrB117NRS0tRm3IbKsAPE0tvZdgCddkCb3kL/YbF1THssVHzrHsKpVrirGbfkEgf4ihjeJAVjM5aOGGMV69E2t/4n17jGLK9HPiEmxncPjfNpk915WdVP9CiXUzBsGREE8oARPRpe7e6XLtsJRCQKP19A7jo9BMRgz9OEzzeVfabb3P38cEr3tRRXsnr36iPZX45Ubvkh9PynHZ7fvnRxn8gHUU/1yg21f60C89p2YaOmAPlaRcnV/1i0hNgzq0hZHIyeCn5e4ff8R0BZlZ3ERRJEyq+yN7GV9mk3Kz0YmPfklr3HgdndTigCbDc+V+KV/aWB4ZpCSspAbLnoRf7QVU++fak28OhnT2NQhodszZdXcbpztbqHwmVkCPLdFuUXOTjx4qTB9sof307R8q7TO5aF65ZhDuv8MNstedN95kg3hPCPAh2ukv9dDy3qi/KGSeFEyNl9bTlkGLOkogGZOOm2Lls7evFshQWcRz0RbqUUXvX7w8G8vG/UoDIrKRLBn3mapZ1pjSLS40scsVQzwdWXAxycrwEqzqcecfHw5MrJXl/y44SMS/FBZlLgCDB6zebAXRbkWx5AyaPAWXaavfDRAFC/wGIZIBD+YAF3KE61ZZ2gaCGCKb9I3jNMhPA==
+    JELLYFIN_API_KEY: AgBCpYy4HiLOZMSQjpVt61dTON+rxIRwRElw6x309EtVBpxtEf6ODi7sjw6n9SAronclOlm1quPeLD77StcFfe6P4QZsVc0lP2MCT7uga3upTVA1QCOo7i0oQu758t4BgmKD69ZMd2q/u3F3JDxI8VTzF9Y5jS7e9rGEl6uMI8HEcWuKwJXJqP/Y34BGqZoxUI/8hyN3C9aDYhNPOB64UpvNzGYqbB+4b2//wbSwx+pqsCF4M5kDu3tdNfyoQB4FtsuSiE5W+oY3fAovkPm2S2DFekYKctrWUv8gnvhUyer36f3/PNWwb7xUi658QPXouuS0OMveP0UdBQ2Qb5UCI7HS4cTre1TQ72CsPm3iEh8mhpYjEX6xgGWXGAJPL33fHhy4g9orXpP7HGegCZcI6Y19AKYJdlMXZO8gzszDsHk7Ftcdodocq34JTcqr/9Nm4XyXIJijUEsIylP9qCT4g7DxY2ckrk1P6ComKYdJNrQIUUm5QDDUgJAwdMi9k/ZDqIUw94V2sGHXCO8bqbV5AMCzxicS7EK2EuiSJ1H8719BO2QCnEkJydRc3PsC0q3OR2NcOkdC6LTVgjGBTaLJbdAEeHG/Zn33i1ZdHw0UXTc0TG/ZozucapEUTPHNEhzMvPJnQtSMnHSExUpSXRv/xrB536P1DraBwxj7fpGatvVj5FPbhBekTW4/y5xTRYR9OyAwJBdR9gkUz6mr/kqTdLe0rYrO4CLOzhchgv4q0LuWzw==
-    JELLYSEERR_API_KEY: AgCaJAAMTL+eC3EnKyhUWoHF+lx5rlyf5+FABc76uBCTgHkJybbt9TCeTysUjBKSozJi0fqv/uktc11wURgTCRM7zjPNtIsxCTmRBvFPZlpj9dDH4aTSv6SzD5q41/hl0LfwIE+J3Ssd8NYPGYZcYFLiVu4t9f9CzXy4f4H1j+T6/G7SW3q+eDdViTt3ZvVORwxGy+kSO+gra/G2N6ghsNtzqsNvZokej/1mRwkFfjvi2h81N9IdnGURcx5XaUUv4Zo/67zRFwXuObiL3LJKYwWtEnWVw6cLIoWi1/e9nGYIv0m7tuHuylK496nmAYL1a7rmLxoWJgaKYKqnwS+RlxifOYBOz0zUxGwjbgGEqi4gR1D5ErcRkx7Wc6PQay74leMiG15QkurtZ5vlHAQdqWAM9hFlR22lD9bCJ0zCG9e6P8eH59j+aUz2IQru+pNm9TgmxEzCTC1EXT4obQ2msjaCJCPeuHC74V3ytIz5v6vqtoSVGdRVBYsIIRyTIahBxcljekGb4Ew89L6DauU6BvLT77DeWsR1H/ozoROxD5ws+HIaBdyoBv3CQmwMpH4YDsbFxc8uZtUP1Y2pWNyq8rb4LKqslcFNyoYy6VflTfxxyG/Eyv1pC/60tGYMjKT9svW4xQGm4hQm965dXEn4f38hQckwDP/xSnQj9EpPNtaovn5R2PAe/GjIgFe09G8mCDXiBIvak5nFiUjuwKLnWwmJy8DevfiIZayfRippQz3hZQlvpIf6v60t6hdyll6RuMs6s4vIrJunAzhBYkyBhtCR+SmoFQ==
+    JELLYSEERR_API_KEY: AgAZQUCxlamRdxDlnzkM3D4YKLrK6+I589Kbgd9HZp0AXGwhJqMLErM6hTz+oZ2+22iX2CnGo2GODEJRMMoeO67JmuAckl7frf3THHAJnuUKXDsao3VxX/szZTN3/UCvCekV/1fbElrwASnTmIh6I4tOCx4+/RXOkSRQ6PMYbGNdr/Fl0G1pT8MC53BfXqEWAjiBml4rVVyxuft0BuuT3nwFdqWrUBQeULfS94kXvWIvv3YXz5wUwNT7D/1rcoKCDOMDzoSF1tSh+QHNeL65V/OHYW3ZraVwWUfQ2CTuL4IGeOYAveH1LvL+RiWO3Madg8LQX3nhvizbwZNqWf5jxXDynkOIaX3ny4fK8o/qxob/0LvGukeoz9CVelF8Pov9Iqm/BJBg+E1kFdqL67UAUJeEeqOWtDGKD1frKmJenuriq9a+1B6Hs2yxvkM31V3O2ehTvNK1hV+86Qa91CmzL6UWr/yrfCyACbm+sEnciA4+iVDBprPDLvEx2lQov7oWyjRU70yI0p5lNoIhs+nIqGi2kZdG5y9bN5FpIESb52Lhvas7x+U7bsIVHkIrm2UpvDiEcJO6RT7MKiTDFDKh5buUcPlxJdVll3lY5bx1Q41LNlTX0s5pniHS0m9u2tGu5mN67LfED/2onxRNzgQ4AQrhqG9yrWknGUGh31UVS1iZjWp8/VTVHqMmnFOXJMTp2r3qLd2fIqS3j78BnRIWd4evyhKUr7MXTZd949GF50aI6x4fRlm1jatw2mRwX1nQiRxHl0jcAIbrZfp+gxw8AK6yVyn4oQ==
-    NEXTCLOUD_PASSWORD: AgDOdIYXaYJw/5ZdVf4IutB7h/facNUYfe3is8RU4glzymnC3SZrPzdwAbPsAwf/VvtDdN3B0H26VtCfy5fLXMQiiUmdt0BrXK5r6Q9Ymx8zDjQiOJ0TyP241TJQHBwl+YBq5SnjTI3CkdMs7uD5QMe6EqiuSS9H9EEJinl7TqtXWlet0gVjqpiuNJU9KmGRKi2Z56Qm0eBrrIBGpi6jYU0vmB+492GEZ6sfkmoEzNllRan4IXervclLU/68KohNx3aQT0SrsFsuBreuKpB9dGY6zgCTN2HdabWrWU1h7iC/8+3pJO+02fnOTIrS4drm9biW3bx7yAdSZ/odX19CulQFd/mZs3SMCaiS735YlK6NFwV2Df65dUWD1ocvpDb3xK7MAMcaK/FIYhUYS7SUf03NTZo3RmOYB8zfHM1bG6NEVJyYs/HeQ7BqIsKWygEIbH2c8cJa6ydc1DF/UgtA/HQhPyVIj7zpmK4SgmZ5SJQy7vLe9uNSO0UHXcdmmXWsrMGiXZP1+QPRyKBrsDcwDsyl4QrecdCcfOerHo+tsMEQz7y1Pf/YnIGpNtSoHH479X4mYaw6fvEgJloMnAZPeokDYJ7e3F+Hw1/7O/OeBJECYfkZNlkdmFCQEn/tzUVABVXe0QKhO7XZjZf3dm067i+7gMCeKdnckG1EzHkBIj0RK3ni4ohiepZUq1kySmnKFD+ekYAE55lmbi8fwQ==
+    PROWLARR_API_KEY: AgDYun6ts1iASmfpfg5r5enPcY60iTEfHq/7c8QoJ9VNcLkKsZcqMQdKuy+E8tUOedNRIiU5S20x2LnONUO0koyVS8KDjxPj6GvLw2q1bRSrqmeUfQZXmvXQCECx5RDyHzbmuC64pYMuTC2MofG1ya/vXc5HFVitW2GaCHS5C3SOtylnwr66F/NQR1M1EyvXXFR91cNfxTFew3dGvEvFCW7Le1/cl3Pb40yCDdzrM274TomwRjDfMSoVti6QSK3R5qV6SkuGdLET0RaISDakG2kZEJBbGSTYA1sfSrrLEzmq/cyOSaNrVifiQdlD+KYTTLnmm9bnsPXFhB2ct01vMMiWh8i3OqLNBfeqPz4K+7tPy36CfhAdINuccaTzx+vr79WdT6OtRQQIEqnHmn4ZOBW6EVtLeLb/hMj3JPaiBgwCBZ+CuWZiwFO+So8lCGZLjy/nqTdq7H0kt+r20u7ju8EPh0iu5WEzR1g+OlNFrulSlsuYI8FEh9stWvkKh+BG6NNQZxZZLEqHW35EqBYjIbH4yyc9fofXW+IdWN9sflGcNGGo7jQL1f+0YwA7hdHCxuQ0tGFmTwWudXczoIp4JG/Zu+85riwQVxkTF363usWVSUNexUHr7dzWr6pRri8KznR8TLs2P+ppsAm9W/H2r5N0883LMFKopUHo+2Trj3x3F2nYGnrlzf5czZZUDrxrJ5MVIroufG4+A6rkBewuv5xs33bR+ktQ2fC1h1MwaySROA==
-    PIHOLE_PASSWORD: AgCMot9kEIfeytQSgr6/RfmSbWY3UZXsClG6jGSBZHXhvn5+Jv3IGfXckFXD6B5NvnWyvkCwCcGiX8PS2aJUcWbNmb/U+I9g2uiSTsISK3gL+7/pQtZsdNCIHA0XO//WJqfbhlGvKvk0lRqj8V6icTHRqGDjEc1eCEmDXvuWQxKv+JORPQHPm5CwSF90mcqrkoIew/zb62BZCc7e7Au6491G2Owqe9kETtTtEUVNV/k+s7oGRcdOy6htAN0gIVj4hP4IeQMc++CDzjDmcO70e1JaBRW/KPx2IDc45PM1RjZgWa4D3YorNhIBmdtRPCLXjlaWrkT1rEaiRhR/IBCmzGZvXlRs1ueK4yl5RUFwlhaHxyuGEQ6xX4+9q4zllXR0bafGwAkNrlIFTawTSCM8sdjUEySjK9W3xtePM2jfzwi5RC2XL0kQd6JUJFA5N6sYWPLdky8qd/ZnK85e3sXv/Xtd4hkjEiKu3VdREbyydEA7Q6zM8JucE/Rce1HhxVAaKGIewaN45E3LWGTCnyik8WAptnkHwN4Pbs4LeohSrdosTx0pUQUVrLTSp0XEdCT3xIjFGpcrHOOfxndztbGn1Y9ELl2f2ScBAzwFk5pdRYNf2BL4ky01erfyRtz1JUov2hzs2xIRVMfjq+H/LiSZpYhgg5H8YfvMhQTecgV6NPX69z4vHeGDJrW5V3jbDIfJSKrFUlJ0Q90wW8E3Dw==
+    PROXMOX_BACKUP_SERVER_PASSWORD: AgCFtU6DiNzg6436AYRz61HsLmsZXzmFxiDl51aULjSgdwQ9DmKT252kpfP6baquQ9xVzYaVjFrffR4Vc8ir5KYHNeqBd9zwdIY9hWYTnmZ0oSM+PE9xp+HbtAodMZ/UPt/VG/eAH3YUb6Kc1o+UsyxQQMcL4i4CGKxu1X9JbLNlkNgu71ulkWlo81FRJHA0/yQM0IbY6IJN7LVKvkTQfiTL/UbGJJ/LdXLnJbBE3ful2RHkE191l1mTRy9jbazHsKqudm8uqe1GbcDuKkM1KOI3pQPIB6DuC7oseG9R9vIAkILxS6bjT0mqEfCpW58qH8JE8Uy//0Z9WrFQWiF2CMiy879XPfkOiieqlQ5DX4aqiiP/EknZ4O9+eLIXOrzf/U3ViBJVrsGET0/S6zWwTJlKfHvdY1keZDWl5bts+rdGWukM6xg8UUjExVI/wCk2Lc2/njLDB1bQIJeetrpgJktBtV3YGMe8XkJIE5xPmJmUEqY8s5b8z3auC8xV2jg8o8MmBrI9b7kYSCBKWM17HiKg5BedVQk+rFV2ox+eaQo2QI52FKmB5WNz7XPQonftE2nL5BdGeAo1dIARgVRGjOP5yjl1UOi9xq8QaVXXVW87LokkuE9BxuXY6n/sEP4m1GUcfLzF9aqZpjKxnLp9LWtI2h5avan1nOGXJ7siV7AQ01KJJnG5pZEnsLKd4kVM22a+H0YRCRpSTAtD5ya1uoLCqCwXa06KgSBiJCRkQtXj6tvOD1s=
-    PROWLARR_API_KEY: AgAdUTlxJ84L05IOXofdq5YM+ETuJfHDXJKNbJxwn7OuflpGYYA+O42byUHQKbfwFJoQlXv+UQqpq9L8FCyuYxDX+vwXD9UltnnZEWNncrac+w5vgMZjKjCgStpmNl14K59+J0z/nN7jET6OOag9Z9pM0ZGnQ3taUrwrvrCWZJeCaYcsHBjQdQ/hIR82/oBsQzIsZ8OGDP5dbePOxHxNDb7d4R732VvIsW6wTwWwxzhWDvs6uT6aSiAFJ0Mcn2vGva8+CxvJaFX7fleLkRFRcPr5vEjerpky3xjDY20jmKJ8bKF6qGitTeCJEpyoARmHaeoCW33rY4+WFj7mNgS7dZL2/xmFXNErioBxVxLVG2Wid25OE4mBrnKZ3P+Ly8byiEe8bHe4jMn6JawqRx4FGnQbBfEX4/NZhJnEkTYXQ5ag1klTaXSbblrXH4UOBVsCyvLrSKI3AfiadEcKASz61qlzPgOhm2xENFc81I4BA8QZIFq5IBxudrTzOzZa+nKTq7WKNoBHkUtGYuT1vuTn4/HkkJorLi46MdeqEYlDhhKbmmk8s/qemDyVweZlHvsS/3NxSLIADF95UWRyPTpvrUiM6WGMLX+kpSAqOqpWMFZLU0Tv6mynXhbDqq/hWRPtIIzJubtxuACUEiaCOmCwjfBJfm472/iw6rXJo5KR6DQ7deLbB1xURBIl0NuKQY2dbJSUsiKnlGbn27Qn9/tzSujL9UFVAmALhy9SuFzDBDppHw==
+    PROXMOX_PASSWORD: AgCiCvyIt2EOY0CAfOjpgGAI+If0e+CkhMcrDV1sJnKCgHrP8K8jZz+mVJgi2uwOXZz5+izO1NM4jMwhYNGyyvBEMlaDIRTiVglF28NIMkbg06U7MhppORaDzzT5qbVrJb+O6FZC8i25SMo6i2Cl246N/y8PvbE4MsioSbMxKHtgOupe5cb/b+nbR1gtU8BJH49yO8J+QXqt0HUL/q4ITqE4LUkwJnWjE90VS4LhhBbZnW0IXclKENxBjgAiJx+jInfW1gG2FOhA2yfPZqx/cnQKWOpwFQAyqYoetsbo0NA8y4A7GP83G9/SuXsk4zVw/ZAWvDhZ6AdMwjer4+Df1/izIDOCPp6AOnzYM1tikkuUIkmivWQTrU4VDmSHg9EKto2yIrb+HGly3lJNy9NJDROQ2ORwNWGL4NUG8QBI104g9ZqY+/97CnMWojMSxnzMjv0Fy3/7NsW0UUebnzY077aWZx3NDXWx9dVTL9U7tjr4RBOKDwUhRpEA+otgnpS62jh81oL9AJQY7CC3gXcdVJnWH0/rueoXOE5CZ7VkCPdwweLql2oKgSxEVDerALuXwBYUUa95/iF1LS7gaVn+ogq2rbsEB3/h5TN/OCANNHjYu0qJX1veR+mYH9k+BWpJYVKe/GMBB7XSG+53CgMHrZsJl4KWnT2MjPj+EAS6+NjAdXVFlF4Lg1GOaGp3bf+ZiDtV+2aZw465sFrY6KunwpApCex4Ff5csoclX7HhRQ1yqT7yu/k=
-    PROXMOX_BACKUP_SERVER_PASSWORD: AgAbdisb/Bpo5Nkq4D+wSRvxsWzKfYna+I5zLlEwIV0ZbdXKBQxQtblLIOjuBTTeV39CLVyeir8jbQ8qdaDvfOa1X5/tD09HFFyaR9J4zcDdamRrXvOXG86KuKq+5rfJXVxuha05iA6xH62hwViy3KMcK/Q/4YR9z7JkSWHMKM6qChci8uHFi4KrmOrhH6LwieKTZa2mjTxN0kX/OtcKuUdP2l+dsA+TS4+EB95qPbCUS74CyaZwN425sRceJ6Lw56zQbdzIvNR6KmrtziDqatLkXlpYOqUPvwd3rKlFZIbO/osV/ocr9IF2kB8NdlzS76GCOj3HbLizHwiGnfSIEPfQD+YwH1iRnZRJPdTW7Srp+j5QqxrgxAamf3XcMaRD8dZQLP1xp/QmLMVZTGBAzg7n4HHRUjDhsi17V/AZwr9YwxGv6+tHkMmcZaQX2tkJPb8EONfp83U0gQ1pnIJRWjfXKvgQty7TjejK5wC93f60CegqbfcyzbX1P7rI+Cj97rfTiRLNlVrfrn/DdvcdIKho3ZQLUiY93xU/W8OHFsYDGPPnqdR5BVzU4Eg5AfI6FYgAix8F+YT2MxM4C/2IDRAxM5FWdouAOEzsvkRu/0/GHTJAM2V7qHZV5pW04EW4mJ9TFmk++MInyoWsKDd4/x9e9vzLpHj4BGHYvrX41QZjP3SUxnHeaDwfYNsOBs8T4IW03JUq1QvovW7IncAjHA0zQ7cuEszeUBCt897GHrLkj14ue7o=
+    QBITTORRENT_PASSWORD: AgC/B+s/eA5pjfKsr+2HbvUcylJXRHZUMwncmL+LABzsUPZ0n2uD24TpAaYHljRfQth6VLraBYqHI8wLds2lpQRbkkmAT+CLHFRcY+apCON04kZdTYX3Wl+SLlK2PwR6/Hf+RDdkZ1PSNV+X954j83c6eCItHCMyv0rcXFAotWjnA/NmytNaZhkleU0SlRgN7OXxeSjIn8QGApg3MUENApjla0y5+RaGfFcdwh7dC7Wc5HpQVRLw6gzUb9PGII14WRbVhEOBGXLfvYuelJK4q8QQf3uBClj7ztUMh5P+pz4698c630eufdc2NH7YtyYPmWNdVoFaKiF6krvw1x+OnBfsHeXI1YyC1V9RebgH+SWpq1t4Di/lNcqa8lkYmhywyGwxoS6Xil0OTMRE0729Sj+kddDF+TUoj8xMc85k78o1+4hZlZyj1a/oi7vGbt6ofVu3kfARQLvyc+sLTSL/f/kvlMVRikLbJo8JbwcnD1sd+S+mAjehibmnqwGP2tJgumfZF8zZcHVL0VanBQ5MmfzYPppqoZ/nDNuvx8U7c5s/0hNYeE0LTMyed6y0N7SQjaqC4haL/R/y3spsYcuyOeWBF16qpziKVeHgIsB36XU+a2HslyJYo6b2PWtkzjYZG+2xPGCr1iSXXjnQKIv2wh+kpODPDqaiL02qZax+cI1725A5aqC0kdM+WoKFi3318IoK3uom9PIhCJE1
-    PROXMOX_PASSWORD: AgCUCHvfbPakjWMnFjxPXnX5TSqWv7tPxvBFEEkDwuZR8CKmUOZZFrtB9ANII8RCYPpwsBc31UINb/FWOf2sQhkSczWff+ETEB5X2ZblltnEXpvrwQjozU6rDuu8weC6mMvVL8oeL1wT5JtaZGYTMM/3R7GJf0oqseN57q4YhMNZ6ygcmepZs3s7WLcEXzeDu1quXFKVFCg2c4t55YM/lUWqn95POI4EZxu9x1s6D6t1EOUzp6LnsccMY2RbXsipm7XMIT3qsJcpYl7+po0XTimmERCRQh1nk4tUdqXLxratvadNxz8QXw5+XqBUAMtQpGBPftO09zv4yLRSywKUDW6YEj/m5UgQLqh0sGJfzof/Uenv/HP5HWXteFnz174UT3mW9vjG2fKnTVdbDYGV63QgnmfVjv1Q5Jfwgmqvi4mO/DB+dFAjuohuwy9nJiQBhirigcCnXF3k9pJyPf6KRoOpjSq+WqTVKY01+3q5lQEb+/W+V5azyO4TdldEKz7zU8vz77mCMx73c5U68mx/DeL1RGZGqK7K+ORilyuMYq8W8yuB8kp8ib1t/f4oYLae6i1C4ROYQt27ZVjppMEDp5iAXSTzZ7MU7PLIqpmgPAcsIsq2t3jHDRDzsvC6EvFbs+R329Ac5reNlL/oN/6Oed3ByCzcdGrQRSvuzY9hjGTUm0yQUQuWaGeK4MBM6gEZuWL0NTMbyPveoTGNxve9nAfeWkzrZRNKxYli/8tJx3X59mQe8D0=
+    RADARR_API_KEY: AgABnXMYWOHUtggwXhD9bHok+lwn9BKCfNYF6swl9FUUatoal46QIeGbpHSAsrTKOdKax1GSkdDaHPXFdBxGKrvQ9lYTs1UjIh9/bQg/zx3ymH2m4ijpQR4SFpmccwakaUs4rTjcXR+iPajiaEFmfNHcofG36MI2HtkgkOZLATo5Ghp4aPC+RETig0aSBR9px6PlK0poR6oPkufvbgyKqB2RwrP3LXFs/rXCLJSOY8pdQiA3xtPZW1AVXAqgUBC544wMHp1mcFyNBzpU761vHX+437WDEWlKQjl0tIPN7RGlGlQgTdGXWPbiki5fLARg69aasVFWyfRntZ7e40rw/GLXswwfaYWMQgtd6+kJrIFICFTFWAlcevsk8brCtqrJfXXr8kZ1Jz1I4P4MPwkTsSkBHiHW2YThSbwyki9Mbfsq4xMgmh28CCgBAi55U/HGtiYFGBxxqsF8m3LkIkAAbwgucAO2yTPp3bWYoH2HQYmhxgYbISHgGZEtP1EmGbCoKJgYpvJ6BeHKPQCNqhIxX/t6FKvz332CthEQmo6XZII8klm6ZQfJOiMTk9RC7cRc5+UIWJEe6yib8KJRRfwV/TRJ6rsYTXGUozboMCJDcTPz6gUZRDD24XyXgdF6I3f1UwTIF9LBSEwwrqo8aPK6aIS7eB+CPWZfCjNxKUsXQRnp6v5/cLrHcZYM1W6QmPzbQM3uxwx+5LhTfBU7X0uVCdd3Zd90EIgExpM371c+B8kgng==
-    QBITTORRENT_PASSWORD: AgAWQzutpD7fs/BUDOVWPcScMSNf1Ch1eJ0eYvu9ldhucokSf86nWEeG9Q+6x5URPrCIe52BagsfJclCoTORyTHf8EoAW23T37E8CL/p6YWJh0f4B+QF9hwtcRrxnwpoPxZo1lcFaIy+II9IRxYWbE74hNPk63ag2vsN2Cc7/FUUmWB858m9LnY5fFAVdE1z8acZK6M6q54gdRG6GiNZutktHW/a2xt12KaGlYcxt86yHKSEyGESlrhN3jlEd0wEK/nZu3OmzErDfhpEBF0jV37tQ9uNbMiXFA7ovi/IcsY2QhQuyQd8IpKaaeWjdRPFMMXwqJaRVmRIahFrLoOM0V2XAAe6fAUGn1XBl7MUS2K5wIgDdvgzpzsNG6Qwx51X8/1xOlOb8y+NJBJTKsFGWpOBf3CBt44RXCJEPyOrtiB2aBa/uKw3nhf/uU5sxJtbj7kDe3x+JongmZEUelX4i/0rub5Y7ANA3yijpQxv3/bVLS9xKiilKh1vTPB8z8ZDgaKzaioeLZmjiA7oMfFbt/7qDajYkO/RnNuGETsN8Lc/jGrylhFo5xC/nRlkYPpg4D0iCQWvKVb63oTlRvzbrjeNbd4IcMS4uXECrwxUWS0r7+VT3u1wHfVJr/zOzWZF2RqjCWuqxLDtBKATET2ce4uDAa10rQE7IVUX5USdQCEt2Gl4Abu24/SRx5aYJlolitmx1GOo+ygQdO8A
+    SONARR_API_KEY: AgCjUa11KtIBsebd9v0zeKYr/cC6c/WPOA4mhiRPFYd31LYJYknzA7UQKvh1V6UJMQOV2P2qjL5VxV4XWnOSHWoub4BhLTqDs7xK+2/cO2sLt8EQbQ2TjG4fqSf/LWkrsK+febIGDyszJ6uKXXFh6+3HoPhDbmTQSNUwJAMNLGCH3GyOvX3ARi7uI4wHSCPBzSUhTCXcaY9mHZSN4LqXsvIg8PKQ6vKsv9xCt0kh7CrMLPO6RQO+G5gJlLvzBEVJIiTlGQYORwBLzjd7RJLfbXrG29flo77KaaCfZ0SLVrc/Rz8QXeisYCripWfH/Fw6Y3d11OA9XHyw+v3D6awOHmLQtJwlkGR+toN1XWoOmBi2Ch/NNdj8bPd+Jc7s5M9T0FBDgQNpFupXq9LNPERb4o3EyR+mIu310MNhIic3YX+VdqYpBwehPi2i6rjwn1YikwHH/9ceOVIe7c9wqVVyA0qi1OJfmd/p5NAWLUAuicElxkeuq5u9XKWvHg2L3tKkQauBqtMwZM7lh2mOoyTfpOLbXfuZGcGDwm981w4HjGMoEvZW0fPQFlDBm3RTMWSZhwUznXpwllk9Jo0AA3z4Y4Cq5OpLNXP4j12SrGf4PHMkCao+HVMMJLfBiJkBqeo2N+ZmOU3rxn0bXrGCoMjvuV8Jo4oR2XKs7uOpac1QHClLr5jFy3Z+86GSp2lZiQOa78d5JPuQfYv64Qw9y+Z95fMD/dAIhfC1BKLujKUz8dn9Ew==
-    RADARR_API_KEY: AgCb49oKRpXYm7+Xd13ab/ECe/o3Z6QsFBzximX1KPDr0tGeHBZlBesXgh4YKFT80TY2CE8+NCXNdFLo8WQI8xu/5i7+UxCtS1IrHznV4xvo8YhgkxDg0Do7RQu/z4XsVhYR0NmWRYQnU89odoba7o5Khvi+1OVhwbiOscbR07a7YfkteeiTQRiAIuuMc6b41P+aKVC8sa+g5Wm4TM8TkM7U8/WHLQDFEKtpx8fLB8w/UrzjsJIpNsSut1udFP1oHZBbXkfCVgn8xAQ8KnVwH1fUX/dL/mQmD4Jhvda/WASXePdFw09HKQdh3g6dJnZbmOTC8vkFiTdWXqWun+6VQIy+3CaXtYUgwfBWm8xIVZAyxgP3Kq4UdaVrsKXPH8QVohjeSykamZLUnSwufjJVO4k7XU8eLgdqdylNzFKbc+LI/NDjCfQVWLbQ9SNH0ZI5Hszypo/IEHSHkmtsZpONvXxRmKPAt6OS57AcDSOfA63QQKCR8Vb49i8kJi6sqaznSJJo8EE1dOT5i125rNrEirLoothQc/JEpl5A3JqPvAVxsNsOIbSd6Zxs/ZU2u+n7dp1HR7YMvfh9TVrz08c6ZKv9StZqXde4t6m7JtQL9mUJSyA7JmzHE+OI8wNesmbStj5c8BJ4B137ZU577mVqzFNbmAwLi2aiR7HqvUebkf8vXdfCRqtD+hcCJnRv3T4aZI8Z+DekpHNlLVyx0fYGW0EmSCGa8Us01ccQWm/CdtoZkw==
-    SONARR_API_KEY: AgAz5UuOURhOjja8M1HJWXEKNXe2xM3MTLgXuXMaJNENC9wAC0fp5SflLbg7LnQQPvY/YuMFamGjzg9MAT83zJyOtuYaHuAPF2zjNG2bYrCEZyj6sLlz5xK4nt24Gqr07dJyC+iSRYj2xxQWm9KQZuSV9UbA3iU8PLdNruGLYnRDkznVl+/soBTo9bM0N53jzqsUFEuuaek0e2GhZByScup9vv3nRRvcCKNb5jDTAqFg3R4zWmZmxY/gmrPB9Jm0Dm0E0D2zBAMhAsjFOLvrXz0+Rah5X+C2CpIoiWQlQoN3FNikRExmYQgTSxz+PbApFL4y1as4ZBrbVQT9QWGr46cQixi44TkMgUXSV+rtVSjxhnI0e3/di7nNbjUsEykU2t8BQuzsRo9b/ft4SoWIYkcnT+Ezixy+IWZ0NeAamYmDJjsgKe90/K1fehtnfcC2q2+X3wbsbXa0tnW9EEzw4zMC73w2ucwVTzVrnDXlFNwUTvNz2D+Wt9KeTPmnuokCU8pCn2DVNXcu3NEwOw5+Us8OSc7x1YlIKMwegMsAlOs06qL6WzBvJ0IIvxaO1h75g3VCB7OWEjFv8Nxc0LKbeXx0PTn5tgxHIUEIZtxW1V5sqIcBi5bRq+/k54c2oU92ZV/fWzoCMWxBqXZQFy/X0x2vunJX06N1L0srSWXuZbO+oIY4o3yP5eca/JDNTgLRBuil9AbUjBPntumERIMWTklCVX7I51JjvgjQfL+0+L5Z9g==
   template:
     metadata:
       creationTimestamp: null

cluster/config/secrets/invidious-app-secrets-sealed.yml

@@ -0,0 +1,17 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  creationTimestamp: null
+  name: invidious-app-secrets
+  namespace: default
+spec:
+  encryptedData:
+    companion-key: AgAaS5Ktylm7uoZfPI6kUn/XrrmSL69EgT2SdJzMJ20Gh0ChbOrMQhyn10XhLpTCCLYdCtASwiZi5MoUnhbF5qFbJDM7/RQsfnzIZh52ej37ATckgRIe7/WoriAr7ZzFAQrKr80mcHp93DWdV20eBWkBLzZBSzYzl897NOxHsSrReAEPzkO/mfidjxhuov06J8cahPswzPrdeEJOUJDYrliZiduxpWIQH3cCFX9AU2u8rpS3Gl4Qf48VAaxWtDkgAibilnzOp+KFfW7h0Nmva6EkFGGcHK6FrLrtGPDwKAidg9G9szuOJwu1NgowSRq8gHhah6KC5lHJ3xPpmA5txfked2T2IWHVStssZw9Gx5utH4wkX0PZW58oaJp1lwsC42M3UpPPanB0gvDD1l8iC8Szzh5FY+GyshfcVstdxa4rJW5RZ2/kaDDotGWL021ogAzJmVDvLm8HisMwTrOsA1M9EpesW5sKGmiJc9Ce/wGrU+8kutkbyt8j6pFNl1RGRLUPEsoXaVTfKLdv1o/IWdmaZ/8HeBMkL7iDBqTJHLVOkhUYN+zgDmh2iAkINkYtEPRPTV64DsCLBdCRLZp2obtU2vxxw4J6sQF3FQOZYAhg4YywT+ENwWtorplHU0798RqJpId5b6ktp/bQ5H2innFkjrt7wihgYT4ZS8sSr+8EFQi9kY/A88i2cZ5PdBN6zj+28qHKuxb6CYr9DTm3Q5ZJ
+    hmac-key: AgAv23AhCeIkVAaPuih0yzUM7LY5GRpTrIccZDKgvKW36XLPLAkYnr7SV+S1ADyShyurVvJYl+nOg7hlRpsPldz4PPTas9ahQIrfJHf7JaPauIM1iqG/8UX4Ud2grWSuYz5XBheOIAxlCSFMzK1XgKdMK5Lm/er8ymb9K2KWN35BcnF8lyC/y02uHWhZFJm5CqB2pcJTct1VmNkRt20PHhKKOC/Ruw51CDOYKsrr9HzSNxCO0/d4zhO8F+Q+f3bKHXcQjZbkgkIEE5F0dYfUxpzga/0CqQT1XibYlgBA72GBe06PeIsD9HJIhe03ROsQEAVfLuqMF3vQRNbXdnW9kPVxEbQuXLiitymUPpLE4dRuv7SA3A6Q+bKRlA4+1cTUKquLKNJAerezZkN0e1NJhXQUAAIQbXMFi0c3nMWAr15YtzLmjhEBMmGZoGcMpHOuk/O8uS7opFVHHNrPNxgIsFzfrayTKRcoZJ1LNK8Qkp/5pqlXWNb263da5YS2gv9L90/mB3y1mazxvbFa+b4FjL9b+4dBB2ueiuM8ZbAiCU5o7as0wMJrhoVNq2n66irkIB7Atmv2fCuXiKk6tOrVfH2yNaLI3sOK397up19XJmmX+XHExHlIrEUqZYIx1YSesbNNCrSxfI9WkuRwTORp3JGHeclfbQNpckGGsOn8D/egcrphiqqHB4Rv/sFoscfgjGubv2mLFkVECZwXnhX4dV461bF9lK2nORxflvyRL5/X9nxTI5RLObCu/Vsid7zWXjiSdsxscWyl5rI8/V+7OFDYAJWs4s4yrHIwLgdVnGRWF81j5Z434EOHi8MiGdYOdLNrnQ6KhvsEhVnSAvwMEvdRgfcCmiNp4MyLrLTLkF8MPA==
+  template:
+    metadata:
+      creationTimestamp: null
+      name: invidious-app-secrets
+      namespace: default
+    type: Opaque

cluster/config/secrets/invidious-secrets-sealed.yml

@@ -7,9 +7,10 @@ metadata:
   namespace: default
 spec:
   encryptedData:
-    INVIDIOUS_COMPANION_KEY: AgCnfbrG/ji25f6RV/avt613WpOpZNlPsuTP/DU9HULXC1aMM3HzEJR3lIEfeqt9y7iHI7Z4WdD4EqYjdWeDkmLnBLkQB3V7RfPm8tNcfRmMad+Q7bm0viSSq2WhxPtVvtI1G5zoIWs4RGw7F+ee7JqDz8rCKWSHJ0XyuBJUsk3bBLXWNhWtxbaWJz/uxNQoO8ZHV+fa00kqijGcebj9IM6wq4Q7CI5n1NcQqJhJPg1ggOavAiOgcrV5z82PUXDx2tdVbXbynNJfzrTYrU4s0f08rYAT5qF3nXZFtRs4sWEEYCTXZ/E7OdOmWFTsA7af2S1DLE8pkNjzKlVQo/wBV6mvCJcQZtgtLiAKDwnYdoExp8gP9SgL89lyZEa56KtEBAbnU/YBpEQndaFDoLb3mKd1YHn5j4wJXvxinuMEHz9HCANEgDB1NvNGTy443nzzlUzbOiFmMudhBV5wzN9wQ7KNRwVSlU5OlmKO3gBw/gvCAZEKmsHMcDKvUpkKrcDvIMkEA6cCg3Wms8+Le/4EyvRr2VOu+rTXX01/rJ97bcsLGXddJuxc2xvKW6QZEWGtRiK90zkUCaY+PJH1djmjCEb8JIrdGhYy3CMrS3SEVxgPQl0rduAg+z3FtWR4GMttWA7lU1/bPtCIhM+OzgFd/Dy79DuNw4+tbjzEINJUgPpmpYL+1GbsjZ+R48B9pppM+rzKrdfxsOdSvEjTQewn0L14
+    INVIDIOUS_DB_PASSWORD: AgDZXhcsP5wC5PKnJ0ICfQSx75WYeU+ai2VVAwXL9PSLBkb5b5BQGxFKmXSvuOyJC+VrzoqkTEAhbI8/maHsn3zrE1QFC/7+Yn7ZcvYDO8INzSS9uL6+0NZj0SsOOufgaBtXaniklvL3C/PZ57VYcPNv6lIX9K+WG+8qUnVdKRr0bputl9WHEwMoZXs+l/xYe3jBao62RZ/fVWoMT4dnjNCHCkFsRClsXTxQevfgzfa4xNCDpIWoSewDkX3VaV3AafDDY52t4A2kbsrSL6pVqbeC/VWCKnR0C0x1XuZkQP2fYIsBI//drbHNxTfFSN7mJVZvBJUGNpQsTXGkKLGNFrz/QNjo8kimJfkQPXHbAmAlSB88Z9uFalDIwm/Emh++PEdMA3RuBE6uK/Cmo4M4/UGI6JjLA2DBk1zC9rtVzH6MN6qHDElhlyoMZ6SbGRHtzDrvvmNXDVfJ0KKqhcshBrXyZOIVlCJCs1s91+XOYLG2S0msEk0DIiY6ZhYiPobTPhHSNP8SrFnlMz1nBG+m2+IS+vpquL2l7cOLYAl01q88i3cCobwKtFWmpNiucxLHIbM699Kw8SZ63/jIWpRuNIy6F91GIa0VQzdmAg/AOML4/85bLNXiBlHwO7LlOdDU0kceBLOC1u81CK8mcT8npKjDsHTpuQYpRMHEMFdd53t+qh9JHs/Jo2SU0ZDBwgtSeJYkh50IGzElAErjTA==
-    INVIDIOUS_DB_PASSWORD: AgA3xb3XXIxHQVbjaZGb6xkWwrr5HSN8B/iF4Kl0EaQyivs7fYqoE3daylu/2x6D0btH/JYWK9+NeyFVNXPCy3holiteD5/9mJFqBCbtkAFxF0lKyLRjtw5BB6Wp5b/HuVJuLQG4sd+TB9XMGDeRyRkXjTRH0NbXYMlcVILAugb3vBNVCcLQqzlHbOngEMOUZxuUcMPL8crOGOmKosTKrWyt2weAFawlXkiz/cwlvdOmgMb8KWI1opEVAKv4OeUQeGRqa9+7fn0CcuM0PLzBvYPa2eoUb4dTFBzZfKpL5/mmZ9NUXEvV1dXN1oBHLHkIS8wBLhHAt8/Mh1rjhd5IGiIWIwlDT2iBuqKLRjwYbVbT7Co8OuTqs7OvxuYVYlmfOZna2o+kF39oeTH/RtYy3atHBsnW6j7GaUJ7nCZfDUZw4xYcHya5v+h2GI76SVnxKhjNpMGjHZMdDUD/cl3rBp+6gHICOYGCi+Wy4EYXCRJkZs0K84AFlLxoDkxARw6eBpFT+QEVnuMDXRrdNqC/Te9p5jzGWvPvXlfCCkQ9hi4hoNmZxw5P/nXdXg1rALiCVZbnM3O/Ud7KwgtYqNSCThPOj/BoExsQE4xSUJzAm35R0/AidOhOTVxztMba5co9Stavj772lRyV5PNbIieXDu6WNdOJNjjiRhuPzQTqbLzRbSa1I+KBDcbkmbOEBuyhXe1EoBp7anoHrKLYyw==
+    INVIDIOUS_HMAC_KEY: AgAI30IJiYq2a+idkc5YIf7VWAdb2cJ3IxkFP5f9vCxy1xzyxyj7fKY6LbaDOg8+NPO0hB2klFixh7KMGS+hFONDKzig82BWG+zqO7n0qnxvLtBNOI7c/zMTKuDtr7pT5tji8yDpazlmJbgrV03Gm2yvpsSNmKYixlHhN976W0OuavfPmQ8iomRnE999G/HOYpTELmPlsakf6rYVv9OVi9uCK8vd7oPrY6ep1aofuuB4olDxPr/rBuZdNMFXMcZzvG05KRAQZ3fwKi4EQBAG15TFHPTEtWIAVtfkzpBBOarDFHFFu+W//CI/1aHWHfUSaOp2IfBZ1csYwDkxtkX5lueh26jSAL54BqqvvfkcpRx/GHKQrM797XvN+uuYCq39kjnk0rAKeeEq1Lbm88Zyrcx9W9qBFGkMdKN1uKAvl3bcMQLF8E6ejub4AsMOwR5kfEmADJs10l2gYT7GPNneyIHkqx1bHAz0tlTPzTd2JPFhvaERc7BU2UhDFT57AxuG2qdwAxkhu1YWcNharcz6+LpUnH5adceJlToWqvIfZkgcYgSqxiHYTyhL/x6FDH4OBpiy1rTPUST+xGZCwyjTlYqM3yqkcUgdDePcFYv3tqORV8oH8riC0RD94FUkujLlWiVtCN7FXoba1ApdyCNmfIRHOO4Os9g8H7oxUeTDlUWERsWVgCXtv0H65Tb+EMjaRtIROFCCnrC3qFzybyW1OX06
-    INVIDIOUS_HMAC_KEY: AgBqsFM5UcFmJQwCPG/xl6ZZus6u/uIlJtxsQGR1p+kWcI1DOfCqLCURxku7yuEi82HizZYDSrQ1X8rLtuBVJmCvCsgWclC+3N1zpUCBhbzzPSSa/U66D7LdDpYAgfMDpkiRMXFOZBGCZtYL7I5Wgp2vxYpjsWVXdk5GXFWbR8Dw5ndUROd2+LmrtJxaWeLiEY7OKHPZ8csEwGibIvQlyBsqPON0jKG70nes1oMFmy1TgmdYpRuW5ZwBCFu1ChpL+Ital1IR8TbSW6K2nXdpku+J+WE9CT4nFQLH/NhWsRw8MWPBp2IGnAr+/iIJJYqbfUGIzMnMpvKZW6Xna/mEBJ826WoCbs1CsUAtemmsIyDzO3tANvNEOr8UWpKm7a62HN8Y3HOiduOoonrRVCS9c8jjt1M20z8JQD06fY6ymsOXEYaYkWesO2WieJtT/6qbJlkwx9RJrdMz7mlWcN5edilkF8X3TSw4YpHP7LhofliGjBYx/w2cWWCkWN1QJhbXt2CmYKxhHnAJS/S5Lmmxs3nNpF1mVOCjTIDFXmR86wG5gJEYS7PHw1ZlMUaOeU/uG0E4caGWwJfn3/Z3upZkuuu5oFy/nDodHD+V6YKHQTQ3dWdjTXJ1kW8vLRb3Roii7dxhXW0dFhdBjyX3P6+58PAkdiZzF89naVLW8x7niFrqW5fQ5M06W/PTQQKIO37bM7L/oy/9a3XQmM8dQeTt9d9g
+    PO_TOKEN: AgAbSZdJpITThH2TxcsvrbrGls8mWuADdRmoR3XP46nr4DWyujaOMsdWr1gV+YM8HgzRx/voZeNZqouh7rnY4dHoFLIJ4vxR7r7hIXyVY+GinUd8R73/NUNgnoI99zd4HqGD+y2HYmoKjKpriOvnYI+arOtcSuQyQB3R/vY9bcoM54oXIc3dQaXKku2+t/cEoZcyZRoeGgk+M73CIhoP9lBLgEq3VIKAcgfnKwgTxTJC4hLYukHa33TriVvVh/8QrNGXpMtclBgYkj5XVpbbh8YeTjS56VqDUO1LWS41UzPc1GjsHINjWMw29GDjLKnlWmpHwWXzXWzy07vgr73aHxE2tLEvQI06GW71HodG0MVG9jS7la4fISzB4r1+eRwYf7aBtw1x+GiB4oMW/3wp5U04iFUiySc+4M7dnfe02yy98MzNLtrbSYUjmKKcBkYWsPtqtQg8CR0RRHa8dGWFSwtFWeMycag18DEDbgwxD6ozFwTuYjCQGflilQahfHxCb3WuQeWeftUk/1N4Pg4aYoL6MMkls+DZyO3/0BtVqldHc2RUHtqnrNZ4mA4ymKbcvBPHe/njjIapfmV6Se/BHC6uYwflRXhXU08ovhiOVJBQM7azku5CCodTENd4cCZYpcQ2F4sJ0blwbt40b/2p1oX3b2lRW47TEWUCIu9RdGRLhyCjKigPGLcZ+Jx+66zp+/vas72pWG0iXYy4ppDP/R1FYz4kTC80VNlBHLcAcP9kd2nwBnowDPNUZLAQgC28mJRGvFFF5qgGCnRWn2oj7iOrBt5Bcv+/WgbIYWk9qzVetiElXS61Xu0lOfduid5fWVltn0Ys02j46Ewh71ojYIAbsVAatkbQwV45ikHIwkXOWq+t7M/nHQaFb25t7KWYVjT/FDZTql7BtRKYJX9OD/TQ
+    VISITOR_DATA: AgA+ERW9tbeo2/6DgV9RG3rOzqME6vz3UXS23TNwjra0dOr8W3gP6Atl7KR1vblwAFXozl6tCtqugBbq1hCdwKx79lwWIaI5DtpwEaGJQe32i+bGM/cDcI/PmqJK9FYDp9gX+G1ldKgAUi9F6MRQ73ze7gG0jFD3q3rwads+kjI0+UI+JwBsOD72YIkgm2a3j4ZRhJOPrd5XZPSNMgbRU5ZZ0I0VjztxpM4iRyeW+Caxo1ltOZijZbLy10fQAf2P/pM2kfXrfuPqlVgCOTuiU9FcuBuL5hSPZqw6QB+ZrQukM7I5KlzhMH7Zfw5DEj4tb+eT9f9/nr3CR3tDTzVJkXo9FVZ1qKvDu6tIZrWD7g5wYcZZWe2Ll/1DFpteDuKE1ry8wgTDdK52mNCVzC5/jYIhR54bfllzY9deZ33Ux75I/l9OHFvEzLrWuhCf9+iL8EW7/a7bTGSiYZXkyiXd+sSsyjmqK3xzqb9MkTE0VmNNKrG8PbdjlfrJQAs8PmX8S1yEcqexBjp7UWND50TwX5zANAqeQMnInaVlB6dXzQSCTeOGnGZOi0oKJ/eH3YbmbKErbqISm18wMbFzU/I3nDR0PFMt5ryRFhgMcIPnBv9kIc6TLY7DLcHHGEEYNjQYRLR3uWCTJeI0fSVnZqxvc+5iCqmPfgWA2TDKTck5FSCwSj3rxIPbEVTlujf+JEapiwAE/OVr08mZ725kvHoTkj43/JStqtZ3nLg5ZxO05Qv7cp96ToK7bS4wUP9ZdWh+pb4=
   template:
     metadata:
       creationTimestamp: null

cluster/helm/cert-manager/cert-manager-release.yml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: cert-manager
-      version: "v1.19.0"
+      version: "v1.18.2"
       sourceRef:
         kind: HelmRepository
         name: jetstack

cluster/helm/csi-driver-smb/csi-driver-smb-release.yml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: csi-driver-smb
-      version: "1.19.1"
+      version: "1.18.0"
       sourceRef:
         kind: HelmRepository
         name: csi-driver-smb

cluster/helm/gpu-operator/gpu-operator-release.yml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: gpu-operator
-      version: "v25.3.4"
+      version: "v25.3.2"
       sourceRef:
         kind: HelmRepository
         name: nvidia

cluster/helm/intel-gpu/intel-device-operator.yml

@@ -1,23 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: device-plugin-operator
-  namespace: gpu-operator
-spec:
-  interval: 24h
-  chart:
-    spec:
-      chart: intel-device-plugins-operator
-      version: "0.34.0"
-      sourceRef:
-        kind: HelmRepository
-        name: intel
-        namespace: flux-system
-      interval: 24h
-  install:
-    remediation:
-      retries: 3
-  upgrade:
-    remediation:
-      retries: 3

cluster/helm/intel-gpu/intel-plugin-operator.yml

@@ -1,27 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: gpu-device-plugin
-  namespace: gpu-operator
-spec:
-  interval: 24h
-  chart:
-    spec:
-      chart: intel-device-plugins-gpu
-      version: "0.34.0"
-      sourceRef:
-        kind: HelmRepository
-        name: intel
-        namespace: flux-system
-      interval: 24h
-  install:
-    remediation:
-      retries: 3
-  upgrade:
-    remediation:
-      retries: 3
-  values:
-    sharedDevNum: 4
-    nodeSelector:
-      intel.feature.node.kubernetes.io/gpu: 'true'

cluster/helm/intel-gpu/intel-repo.yml

@@ -1,9 +0,0 @@
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: intel
-  namespace: flux-system
-spec:
-  interval: 24h
-  url: https://intel.github.io/helm-charts

cluster/helm/newt/newt-cred-sealed.yml

@@ -1,16 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: newt-cred
-  namespace: newt-ns
-spec:
-  encryptedData:
-    NEWT_ID: AgANlHH+ezjEX2Vlu5VgJF0XVqQopfthSt1J1lRSIrB6gHooRKa/Nx55ZZwwJiOzgLz5Rm1XLL2AO9lP+r9gxkPp0QO6gBOciIT5JjF7KPYGd8Mz7JM3YvQmrmQVe5gwltoLcpNgNkOcqf2i4BvLKrsEfLzfYci6nH3paWaopi5pWdzSKmyfJfSL1LtftBBbWMZ4GYq54KiQM8+vrxH8QqnhKrASnd+zQ1Yb1NA0RiraSom8OZiStyvNo4F82bRyZWIBgp7O23gUXH4+Zf5ZbiH1hMiZZOwQfc+sRp3E9b3x5AZAMeWv6RSuRbfX/yODY2mwptAM5sAAaKAwnf53pUA9pqYN0/taAUrEQLd6TNw1nRAuxdZwsKCt/FnWkEo0WtVkiUeciNQMVrlCvQ6YvKU3+1fYYYSMuwpP4gBbjgLmeY+gQVcBwKi8eRHAxaRuhqBP22wdVozlKcA9UysRNu0VcnB5sAsxxpHwWMQgwJ7DvayMgX10tdnXDtBCYGNOeKuDnJWbkAEHAOLguYW8VsZSXB1a+1SQe/MVnTAPKTgqKwbD8Tf2pDOg11z/WwpRXLgRyahmxJt+li2vEE7PVjyVFF1ZN81TYlnlOiGkMSYB5bHT2zcQZ2hxa4J1QBzl3J1kAydyrCQZNvkzQ0vrtKSt6k8cAlsr61b4zPhX7IrSGjQw3zRjnAMAJc2zvDu2FB53641hZknoO2HsAZbqDXw=
-    NEWT_SECRET: AgAffzmD9CZCn4P3GNC0sT3h86iPpzvMvmELZpqUOfWsMgPq6cY/HSfd927ShxPEDZXrd1FLDu+tH9Ealk2duhkq0YEanaMu5j5x8/GiSctRdhtD6H8t4uONRXQjKWG2HaySz7oR+GcO8/EM6rEcki17HhI7px+dzLm7HowcBMvw2ne+RqthmdOlVvxeIzLejnWIrzY2wcuieK7r3zq+d3unZi9T7GbevmzCA5V3wQrWqvsNezHHj0BIJlIYn3Vzx5ZZN6pgUT8x0y8TteC+FtHDKgODHgtT2ZYkK+LR3wtCXgO1Y6NILr2Ijg96aeL8/TYY3e5T8q4cKr1HabYjfenCjigzuqS27m9u2wCI8Zv6ffWjEYUED4GQ8oXqMyE44pYrzzb+Do3V3Ezj6PMDEvtQaWJ78JvQaOdHnszXMXpAsIsKhgeo7WdiIJWBnFW9lYhC3OdxuW2yNi5lv9z/oJEB+13pmVHkTzYHqhollz1AAY5nna5+JHNNFbRfbj8pj7I07qjOj291e2jZ+p9LBkip5xNfVOeSoX8YOwn8aZTaZPKvPgSZFvFS54JlcO8KWIeqGOc2CKO0r+6GaysO+6LxHH8WGdxxh9JLlNZdcnunQ9Cxlh1vPTuxG7zhEu4KiWwL/5KAQf9Ksyd33WdgR4qNQGnfXccomGRD4fxral6K8jDJjDJlCUQcbYAl2n+eMu377YWkhW0ecMLgYiLzkyNdZO5HnuoNqHr+HsUD+4g7UNtb8cwFhj6uaX+6RXlBS/U=
-    PANGOLIN_ENDPOINT: AgCkSy8lFTJZJT0luEKhfSOMO9aeSsUvmxaLXc9+nDHmlDoWBv15q7uEsutXDr8OPuM9sl7g6KLfYFTlaPO502Wrw/FV6ncX6es/KfguEydAebdl3uZ096FcwaTGtcpd/mdo4W8z2348EnttoxeJ23tZWabZcYfyVu/UA4Sor05hpnYdTxK3mYra89dhb/u4Pz5BdQUKlseCIWiLqk7HON0nI775ANq8OJ6MZeMSZoAdjOdy24hw3SSwwpX1Y1p6Ior5UV9tiCXpbL5UVj6Wo4LIGkqBRomPQ3V6Furim5bhfLDNDYTFVqWo0UEa6eYwP6NgPZ+oxfI1pFdio1g39+iY9AHlJoYRDkYF0wJLjfGdnju4L+KXsdWiyQVXS7lX+GAohna3p3xSaOrFzYt3SxEQ9lGvUFrXIXB5UrBrN1iODpbRyJb6KdXNZM9SklKKycZ9WCfLzhWV1ppwReQrICR4JljngSMWuBGxjr90BlkvMSQVOFGrHSs9AeY/ymf6P1TQ8WwecivTZ3oK8x+NIqdJSXRr2HEZkNOfJH4hDcD9NLO/7Wt/bkp4sX8Bvs2MrZ466hHovm2ENC9Cz/LHZLpHHtidmBn4hgrT39Cjgbq6bPR2SBSQnoXB/FVA9zuqJ6E+Z69O3pdXtxTEIZAvtJ4BaEiOkzQzonScowNwklnkEaru/TSx50rNjfW2k2CNx/Tz7XZf4vEudRbxc1nzXxzkMnQyldheczPjnWvcTgI=
-  template:
-    metadata:
-      name: newt-cred
-      namespace: newt-ns
-    type: Opaque

cluster/helm/newt/newt-release.yml

@@ -1,29 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: newt
-  namespace: newt-ns
-spec:
-  interval: 24h
-  chart:
-    spec:
-      chart: newt
-      version: "1.1.0"
-      sourceRef:
-        kind: HelmRepository
-        name: newt
-        namespace: flux-system
-      interval: 24h
-  install:
-    remediation:
-      retries: 3
-  upgrade:
-    remediation:
-      retries: 3
-  values:
-    newtInstances:
-      - name: main
-        enabled: true
-        auth:
-          existingSecretName: newt-cred

cluster/helm/newt/newt-repo.yml

@@ -1,9 +0,0 @@
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: newt
-  namespace: flux-system
-spec:
-  interval: 24h
-  url: https://charts.fossorial.io

cluster/helm/ollama/ollama-pvc.yml

@@ -2,7 +2,7 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: ollama-longhorn
+  name: ollama-ceph
   namespace: default
 spec:
   accessModes:
@@ -10,5 +10,5 @@ spec:
   volumeMode: Filesystem
   resources:
     requests:
-      storage: 6Gi
+      storage: 20Gi
-  storageClassName: longhorn
+  storageClassName: csi-rbd-sc

cluster/helm/ollama/ollama-release.yml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: ollama
-      version: "1.31.0"
+      version: "1.27.0"
       sourceRef:
         kind: HelmRepository
         name: ollama
@@ -37,4 +37,4 @@ spec:
     runtimeClassName: nvidia
     persistentVolume:
       enabled: true
-      existingClaim: ollama-longhorn
+      existingClaim: ollama-ceph

cluster/helm/prometheus/prometheus-release.yml

@@ -9,7 +9,7 @@ spec:
   chart:
     spec:
       chart: prometheus
-      version: "27.40.1"
+      version: "27.32.0"
       sourceRef:
         kind: HelmRepository
         name: prometheus-community

disabled/apps/open-webui/open-webui-pvc.yml

@@ -1,14 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: open-webui-longhorn
-  namespace: default
-spec:
-  accessModes:
-    - ReadWriteOnce
-  volumeMode: Filesystem
-  resources:
-    requests:
-      storage: 2Gi
-  storageClassName: longhorn

disabled/config/ceph/csi-configmap.yml

@@ -1,19 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-data:
-  config.json: |-
-    [
-      {
-        "clusterID": "8bb08316-8b5c-11f0-a772-bc24114124ba",
-        "monitors": [
-          "10.1.0.11:6789",
-          "10.1.0.12:6789",
-          "10.1.0.13:6789",
-          "10.1.0.14:6789",
-          "10.1.0.15:6789"
-        ]
-      }
-    ]
-metadata:
-  name: ceph-csi-config
-  namespace: ceph

disabled/config/ceph/csi-rbd-secret.yml

@@ -1,9 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: csi-rbd-secret
-  namespace: default
-type: kubernetes.io/rbd
-data:
-  userID: a3ViZXJuZXRlcw==
-  userKey: QVFEQm43eG9xU3VhQmhBQThHRDBoZ2tkK3pNUWlITFpaUjl6T0E9PQ==