remove for stage

clusters/cl01tl-standby/platform/authentik/Chart.yaml

@@ -1,35 +0,0 @@
-apiVersion: v2
-name: authentik
-version: 1.0.0
-description: Authentik
-keywords:
-  - authentik
-  - sso
-  - oidc
-  - ldap
-  - idp
-  - authentication
-home: https://wiki.alexlebens.dev/doc/authentik-q2d4WDhqpe
-sources:
-  - https://github.com/goauthentik/authentik
-  - https://github.com/cloudflare/cloudflared
-  - https://github.com/cloudnative-pg/cloudnative-pg
-  - https://github.com/goauthentik/helm
-  - https://github.com/alexlebens/helm-charts/tree/main/charts/cloudflared
-  - https://github.com/alexlebens/helm-charts/tree/main/charts/postgres-cluster
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: authentik
-    version: 2025.2.1
-    repository: https://charts.goauthentik.io/
-  - name: cloudflared
-    alias: cloudflared
-    repository: http://alexlebens.github.io/helm-charts
-    version: 1.14.0
-  - name: postgres-cluster
-    alias: postgres-17-cluster
-    version: 4.2.0
-    repository: http://alexlebens.github.io/helm-charts
-icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/authentik.png
-appVersion: 2024.10.5

clusters/cl01tl-standby/platform/authentik/templates/config-map.yaml

@@ -1,60 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: authentik-custom-css
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ .Release.Name }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-data:
-  custom.css: |
-    /* Change sign button color */
-    .pf-c-button.pf-m-primary {
-      color: black;
-      background-color: white;
-    }
-
-    /* Remove background */
-    .pf-c-login__main {
-      background-color: rgba(3, 3, 3, 0.16);
-    }
-
-    /* Remove specific height */
-    .pf-c-brand {
-      height: auto;
-    }
-
-    /* Center text */
-    .pf-c-title {
-      text-align: center;
-    }
-
-    /* Match text field to login button */
-    .pf-c-form-control {
-      border-radius: 3px;
-      background-color: white;
-      color: black;
-    }
-
-    /* Force border color */
-    .pf-c-form-control {
-      border-color: white;
-    }
-
-    /* Use default cursor on this div */
-    .pf-c-form__label {
-      cursor: default;
-    }
-
-    /* Hide required asterik */
-    .pf-c-form__label-required {
-      display: none;
-    }
-
-    /* Change link color to white */
-    .a {
-      color: white;
-    }

clusters/cl01tl-standby/platform/authentik/templates/external-secret.yaml

@@ -1,80 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: authentik-key-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: authentik-key-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: key
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/authentik/key
-        metadataPolicy: None
-        property: key
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: authentik-cloudflared-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: authentik-cloudflared-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: cf-tunnel-token
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cloudflare/tunnels/authentik
-        metadataPolicy: None
-        property: token
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: authentik-postgresql-17-cluster-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: authentik-postgresql-17-cluster-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: database
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
-        property: access
-    - secretKey: ACCESS_SECRET_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
-        property: secret

clusters/cl01tl-standby/platform/authentik/templates/ingress.yaml

@@ -1,32 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: authentik-tailscale
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: authentik-tailscale
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-  labels:
-    tailscale.com/proxy-class: no-metrics
-  annotations:
-    tailscale.com/experimental-forward-cluster-traffic-via-ingress: "true"
-spec:
-  ingressClassName: tailscale
-  tls:
-    - hosts:
-        - auth-cl01tl
-      secretName: auth-cl01tl
-  rules:
-    - host: auth-cl01tl
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: authentik-server
-                port:
-                  number: 80

clusters/cl01tl-standby/platform/authentik/values.yaml

@@ -1,81 +0,0 @@
-authentik:
-  global:
-    env:
-      - name: AUTHENTIK_SECRET_KEY
-        valueFrom:
-          secretKeyRef:
-            name: authentik-key-secret
-            key: key
-      - name: AUTHENTIK_POSTGRESQL__HOST
-        valueFrom:
-          secretKeyRef:
-            name: authentik-postgresql-17-cluster-app
-            key: host
-      - name: AUTHENTIK_POSTGRESQL__NAME
-        valueFrom:
-          secretKeyRef:
-            name: authentik-postgresql-17-cluster-app
-            key: dbname
-      - name: AUTHENTIK_POSTGRESQL__USER
-        valueFrom:
-          secretKeyRef:
-            name: authentik-postgresql-17-cluster-app
-            key: user
-      - name: AUTHENTIK_POSTGRESQL__PASSWORD
-        valueFrom:
-          secretKeyRef:
-            name: authentik-postgresql-17-cluster-app
-            key: password
-  server:
-    name: server
-    replicas: 1
-    volumes:
-      - name: custom-css
-        configMap:
-          name: authentik-custom-css
-    volumeMounts:
-      - name: custom-css
-        mountPath: /web/dist/custom.css
-        subPath: custom.css
-    metrics:
-      enabled: true
-      serviceMonitor:
-        enabled: true
-    ingress:
-      enabled: true
-      ingressClassName: traefik
-      hosts:
-        - authentik.alexlebens.net
-      paths:
-        - /
-      tls:
-        - secretName: authentik-tls-secret
-          hosts:
-            - authentik.alexlebens.net
-  worker:
-    name: worker
-    replicas: 1
-  prometheus:
-    rules:
-      enabled: true
-  postgresql:
-    enabled: false
-  redis:
-    enabled: true
-cloudflared:
-  existingSecretName: authentik-cloudflared-secret
-postgres-17-cluster:
-  mode: standalone
-  cluster:
-    walStorage:
-      storageClass: local-path
-    storage:
-      storageClass: local-path
-    monitoring:
-      enabled: true
-  backup:
-    enabled: true
-    endpointURL: https://nyc3.digitaloceanspaces.com
-    destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/authentik/authentik-postgresql-17-cluster
-    endpointCredentials: authentik-postgresql-17-cluster-backup-secret
-    backupIndex: 1

clusters/cl01tl-standby/platform/gitea/Chart.yaml

@@ -1,37 +0,0 @@
-apiVersion: v2
-name: gitea
-version: 1.0.0
-description: Gitea
-keywords:
-  - gitea
-  - git
-  - code
-home: https://wiki.alexlebens.dev/doc/gitea-OgqW6bQWrW
-sources:
-  - https://github.com/go-gitea/gitea
-  - https://github.com/cloudflare/cloudflared
-  - https://github.com/cloudnative-pg/cloudnative-pg
-  - https://hub.docker.com/r/gitea/gitea
-  - https://gitea.com/gitea/helm-chart
-  - https://github.com/alexlebens/helm-charts/tree/main/charts/cloudflared
-  - https://github.com/alexlebens/helm-charts/tree/main/charts/postgres-cluster
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: gitea
-    version: 10.6.0
-    repository: https://dl.gitea.io/charts/
-  - name: cloudflared
-    alias: cloudflared
-    repository: http://alexlebens.github.io/helm-charts
-    version: 1.14.0
-  - name: app-template
-    alias: backup
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.7.1
-  - name: postgres-cluster
-    alias: postgres-17-cluster
-    version: 4.2.0
-    repository: http://alexlebens.github.io/helm-charts
-icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/gitea.png
-appVersion: 1.22.4

clusters/cl01tl-standby/platform/gitea/templates/external-secret.yaml

@@ -1,176 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: gitea-admin-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: gitea-admin-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: username
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/gitea/auth/admin
-        metadataPolicy: None
-        property: username
-    - secretKey: password
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/gitea/auth/admin
-        metadataPolicy: None
-        property: password
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: gitea-oidc-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: gitea-oidc-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: secret
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /authentik/oidc/gitea
-        metadataPolicy: None
-        property: secret
-    - secretKey: key
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /authentik/oidc/gitea
-        metadataPolicy: None
-        property: client
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: gitea-cloudflared-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: gitea-cloudflared-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: cf-tunnel-token
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cloudflare/tunnels/gitea
-        metadataPolicy: None
-        property: token
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: gitea-backup-s3
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: gitea-backup-s3
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: backup
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/gitea-backup
-        metadataPolicy: None
-        property: AWS_ACCESS_KEY_ID
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/gitea-backup
-        metadataPolicy: None
-        property: AWS_SECRET_ACCESS_KEY
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: gitea-s3cmd-config
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: gitea-s3cmd-s3
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: backup
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: .s3cfg
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/gitea/backup
-        metadataPolicy: None
-        property: s3cfg
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: gitea-postgresql-17-cluster-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: gitea-postgresql-17-cluster-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: database
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
-        property: access
-    - secretKey: ACCESS_SECRET_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
-        property: secret

clusters/cl01tl-standby/platform/gitea/templates/ingress.yaml

@@ -1,66 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: gitea-local
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: gitea-local
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-  annotations:
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
-    traefik.ingress.kubernetes.io/router.tls: "true"
-    cert-manager.io/cluster-issuer: letsencrypt-issuer
-spec:
-  ingressClassName: traefik
-  tls:
-    - hosts:
-        - gitea.alexlebens.net
-      secretName: gitea-tls-secret
-  rules:
-    - host: gitea.alexlebens.net
-      http:
-        paths:
-          - path: /
-            pathType: ImplementationSpecific
-            backend:
-              service:
-                name: gitea-http
-                port:
-                  number: 3000
-
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: gitea-tailscale
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: gitea-tailscale
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-  labels:
-    tailscale.com/proxy-class: no-metrics
-  annotations:
-    tailscale.com/experimental-forward-cluster-traffic-via-ingress: "true"
-spec:
-  ingressClassName: tailscale
-  tls:
-    - hosts:
-        - gitea-cl01tl
-      secretName: gitea-cl01tl
-  rules:
-    - host: gitea-cl01tl
-      http:
-        paths:
-          - path: /
-            pathType: ImplementationSpecific
-            backend:
-              service:
-                name: gitea-http
-                port:
-                  name: http

clusters/cl01tl-standby/platform/gitea/templates/persistent-volume-claim.yaml

@@ -1,19 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: gitea-nfs-storage-backup
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: gitea-nfs-storage-backup
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: storage
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  volumeMode: Filesystem
-  storageClassName: nfs-client
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi

clusters/cl01tl-standby/platform/gitea/templates/role-binding.yaml

@@ -1,19 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: gitea-backup
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: gitea-backup
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: backup
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: gitea-backup
-subjects:
-  - kind: ServiceAccount
-    name: gitea-backup
-    namespace: {{ .Release.Namespace }}

clusters/cl01tl-standby/platform/gitea/templates/role.yaml

@@ -1,27 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: gitea-backup
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: gitea-backup
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: backup
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - pods
-      - pods/exec
-    verbs:
-      - create
-      - list
-  - apiGroups:
-      - apps
-    resources:
-      - deployments
-    verbs:
-      - get
-      - list

clusters/cl01tl-standby/platform/gitea/values.yaml

@@ -1,193 +0,0 @@
-gitea:
-  image:
-    repository: gitea/gitea
-    tag: 1.23.4
-  service:
-    http:
-      type: ClusterIP
-      port: 3000
-      clusterIP: 10.103.160.139
-    ssh:
-      type: ClusterIP
-      port: 2222
-      clusterIP: 10.103.160.140
-  ingress:
-    enabled: false
-  persistence:
-    storageClass: ceph-block
-  extraVolumes:
-    - name: gitea-nfs-storage-backup
-      persistentVolumeClaim:
-        claimName: gitea-nfs-storage-backup
-  extraVolumeMounts:
-    - mountPath: /opt/backup
-      name: gitea-nfs-storage-backup
-      readOnly: false
-  gitea:
-    # admin:
-    #   existingSecret: gitea-admin-secret
-    metrics:
-      enabled: true
-      serviceMonitor:
-        enabled: true
-    oauth:
-      - name: Authentik
-        provider: openidConnect
-        existingSecret: gitea-oidc-secret
-        autoDiscoverUrl: https://auth.alexlebens.dev/application/o/gitea/.well-known/openid-configuration
-        iconUrl: https://goauthentik.io/img/icon.png
-        scopes: "email profile"
-    config:
-      APP_NAME: Gitea
-      server:
-        PROTOCOL: http
-        DOMAIN: gitea.alexlebens.dev
-        ROOT_URL: https://gitea.alexlebens.dev
-        LOCAL_ROOT_URL: http://gitea-http.gitea.svc.cluster.local:3000
-        START_SSH_SERVER: true
-        SSH_DOMAIN: gitea-ssh.gitea
-        SSH_PORT: 2222
-        SSH_LISTEN_PORT: 2222
-        ENABLE_PPROF: true
-        LANDING_PAGE: explore
-      database:
-        DB_TYPE: postgres
-        SCHEMA: public
-      oauth2_client:
-        ENABLE_AUTO_REGISTRATION: true
-      service:
-        REGISTER_MANUAL_CONFIRM: true
-        SHOW_REGISTRATION_BUTTON: false
-        ALLOW_ONLY_EXTERNAL_REGISTRATION: true
-      explore:
-        REQUIRE_SIGNIN_VIEW: true
-      webhook:
-        ALLOWED_HOST_LIST: private
-      mirror:
-        DEFAULT_INTERVAL: 10m
-    additionalConfigFromEnvs:
-      - name: GITEA__DATABASE__HOST
-        valueFrom:
-          secretKeyRef:
-            name: gitea-postgresql-17-cluster-app
-            key: host
-      - name: GITEA__DATABASE__NAME
-        valueFrom:
-          secretKeyRef:
-            name: gitea-postgresql-17-cluster-app
-            key: dbname
-      - name: GITEA__DATABASE__USER
-        valueFrom:
-          secretKeyRef:
-            name: gitea-postgresql-17-cluster-app
-            key: user
-      - name: GITEA__DATABASE__PASSWD
-        valueFrom:
-          secretKeyRef:
-            name: gitea-postgresql-17-cluster-app
-            key: password
-  memcached:
-    enabled: true
-  redis:
-    enabled: false
-  redis-cluster:
-    enabled: false
-  postgresql:
-    enabled: false
-  postgresql-ha:
-    enabled: false
-  mysql:
-    enabled: false
-  mariadb:
-    enabled: false
-cloudflared:
-  existingSecretName: gitea-cloudflared-secret
-backup:
-  global:
-    fullnameOverride: gitea-backup
-  controllers:
-    backup:
-      type: cronjob
-      cronjob:
-        suspend: false
-        concurrencyPolicy: Forbid
-        timeZone: US/Central
-        schedule: 0 4 * * *
-        startingDeadlineSeconds: 90
-        successfulJobsHistory: 3
-        failedJobsHistory: 3
-        backoffLimit: 3
-        parallelism: 1
-      initContainers:
-        backup:
-          image:
-            repository: bitnami/kubectl
-            tag: 1.32.2
-            pullPolicy: IfNotPresent
-          command:
-            - sh
-          args:
-            - -ec
-            - |
-              kubectl exec -it deploy/gitea -n gitea -- rm -f /opt/backup/gitea-backup.zip;
-              kubectl exec -it deploy/gitea -n gitea -- /app/gitea/gitea dump -c /data/gitea/conf/app.ini --file /opt/backup/gitea-backup.zip;
-          resources:
-            requests:
-              cpu: 100m
-              memory: 128Mi
-      containers:
-        s3:
-          image:
-            repository: d3fk/s3cmd
-            tag: latest@sha256:4bdc8e5817cbdd048e6dc487f42e3d96a6b58af69b4be6f256de5e2416da90e9
-            pullPolicy: IfNotPresent
-          command:
-            - /bin/sh
-          args:
-            - -ec
-            - |
-              s3cmd put --no-check-md5 --no-check-certificate /opt/backup/gitea-backup.zip s3://gitea-backups-8ba8dae3674a2f53354c600e/cl01tl/cl01tl-gitea-backups/gitea-backup-$(date +"%Y%m%d-%H-%M").zip;
-              mv /opt/backup/gitea-backup.zip /opt/backup/gitea-backup-$(date +"%Y%m%d-%H-%M").zip;
-          envFrom:
-            - secretRef:
-                name: gitea-backup-s3
-          resources:
-            requests:
-              cpu: 100m
-              memory: 128Mi
-  serviceAccount:
-    create: true
-  persistence:
-    config:
-      existingClaim: gitea-nfs-storage-backup
-      advancedMounts:
-        backup:
-          s3:
-            - path: /opt/backup
-              readOnly: false
-    s3cmd-config:
-      enabled: true
-      type: secret
-      name: gitea-s3cmd-config
-      advancedMounts:
-        backup:
-          s3:
-            - path: /root/.s3cfg
-              readOnly: true
-              mountPropagation: None
-              subPath: .s3cfg
-postgres-17-cluster:
-  mode: standalone
-  cluster:
-    walStorage:
-      storageClass: local-path
-    storage:
-      storageClass: local-path
-    monitoring:
-      enabled: true
-  backup:
-    enabled: true
-    endpointURL: https://nyc3.digitaloceanspaces.com
-    destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/gitea/gitea-postgresql-17-cluster
-    endpointCredentials: gitea-postgresql-17-cluster-backup-secret
-    backupIndex: 2

clusters/cl01tl-standby/platform/matrix-synapse/templates/external-secret.yaml

@@ -1,449 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: matrix-synapse-config-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: matrix-synapse-config-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: oidc.yaml
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/matrix-synapse/config
-        metadataPolicy: None
-        property: oidc.yaml
-    - secretKey: config.yaml
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/matrix-synapse/config
-        metadataPolicy: None
-        property: config.yaml
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: matrix-hookshot-config-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: matrix-hookshot-config-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: config.yml
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/matrix-synapse/hookshot
-        metadataPolicy: None
-        property: config
-    - secretKey: registration.yml
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/matrix-synapse/hookshot
-        metadataPolicy: None
-        property: registration
-    - secretKey: hookshot-registration.yaml
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/matrix-synapse/hookshot
-        metadataPolicy: None
-        property: registration
-    - secretKey: passkey.pem
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/matrix-synapse/hookshot
-        metadataPolicy: None
-        property: passkey
-
-# ---
-# apiVersion: external-secrets.io/v1beta1
-# kind: ExternalSecret
-# metadata:
-#   name: mautrix-discord-config-secret
-#   namespace: {{ .Release.Namespace }}
-#   labels:
-#     app.kubernetes.io/name: mautrix-discord-config-secret
-#     app.kubernetes.io/instance: {{ .Release.Name }}
-#     app.kubernetes.io/version: {{ .Chart.AppVersion }}
-#     app.kubernetes.io/component: web
-#     app.kubernetes.io/part-of: {{ .Release.Name }}
-# spec:
-#   secretStoreRef:
-#     kind: ClusterSecretStore
-#     name: vault
-#   data:
-#     - secretKey: config.yaml
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /cl01tl/matrix-synapse/mautrix-discord
-#         metadataPolicy: None
-#         property: config
-#     - secretKey: mautrix-discord-registration.yaml
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /cl01tl/matrix-synapse/mautrix-discord
-#         metadataPolicy: None
-#         property: registration
-
-# ---
-# apiVersion: external-secrets.io/v1beta1
-# kind: ExternalSecret
-# metadata:
-#   name: mautrix-whatsapp-config-secret
-#   namespace: {{ .Release.Namespace }}
-#   labels:
-#     app.kubernetes.io/name: mautrix-whatsapp-config-secret
-#     app.kubernetes.io/instance: {{ .Release.Name }}
-#     app.kubernetes.io/version: {{ .Chart.AppVersion }}
-#     app.kubernetes.io/component: web
-#     app.kubernetes.io/part-of: {{ .Release.Name }}
-# spec:
-#   secretStoreRef:
-#     kind: ClusterSecretStore
-#     name: vault
-#   data:
-#     - secretKey: config.yaml
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /cl01tl/matrix-synapse/mautrix-whatsapp
-#         metadataPolicy: None
-#         property: config
-#     - secretKey: mautrix-whatsapp-registration.yaml
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /cl01tl/matrix-synapse/mautrix-whatsapp
-#         metadataPolicy: None
-#         property: registration
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: double-puppet-registration-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: double-puppet-registration-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: double-puppet-registration.yaml
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/matrix-synapse/double-puppet
-        metadataPolicy: None
-        property: registration
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: matrix-synapse-valkey-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: matrix-synapse-valkey-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: password
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/matrix-synapse/valkey
-        metadataPolicy: None
-        property: password
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: matrix-synapse-cloudflared-synapse-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: matrix-synapse-cloudflared-synapse-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: cf-tunnel-token
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cloudflare/tunnels/matrix-synapse
-        metadataPolicy: None
-        property: token
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: matrix-synapse-cloudflared-hookshot-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: matrix-synapse-cloudflared-hookshot-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: cf-tunnel-token
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cloudflare/tunnels/matrix-hookshot
-        metadataPolicy: None
-        property: token
-
-# ---
-# apiVersion: external-secrets.io/v1beta1
-# kind: ExternalSecret
-# metadata:
-#   name: matrix-synapse-backup-secret
-#   namespace: {{ .Release.Namespace }}
-#   labels:
-#     app.kubernetes.io/name: matrix-synapse-backup-secret
-#     app.kubernetes.io/instance: {{ .Release.Name }}
-#     app.kubernetes.io/version: {{ .Chart.AppVersion }}
-#     app.kubernetes.io/component: backup
-#     app.kubernetes.io/part-of: {{ .Release.Name }}
-# spec:
-#   secretStoreRef:
-#     kind: ClusterSecretStore
-#     name: vault
-#   target:
-#     template:
-#       mergePolicy: Merge
-#       engineVersion: v2
-#       data:
-#         RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/matrix-synapse/matrix-synapse"
-#   data:
-#     - secretKey: BUCKET_ENDPOINT
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /cl01tl/volsync/restic/config
-#         metadataPolicy: None
-#         property: S3_BUCKET_ENDPOINT
-#     - secretKey: RESTIC_PASSWORD
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /cl01tl/volsync/restic/config
-#         metadataPolicy: None
-#         property: RESTIC_PASSWORD
-#     - secretKey: AWS_DEFAULT_REGION
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /cl01tl/volsync/restic/config
-#         metadataPolicy: None
-#         property: AWS_DEFAULT_REGION
-#     - secretKey: AWS_ACCESS_KEY_ID
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /digital-ocean/home-infra/volsync-backups
-#         metadataPolicy: None
-#         property: access_key
-#     - secretKey: AWS_SECRET_ACCESS_KEY
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /digital-ocean/home-infra/volsync-backups
-#         metadataPolicy: None
-#         property: secret_key
-
-# ---
-# apiVersion: external-secrets.io/v1beta1
-# kind: ExternalSecret
-# metadata:
-#   name: mautrix-discord-data-backup-secret
-#   namespace: {{ .Release.Namespace }}
-#   labels:
-#     app.kubernetes.io/name: mautrix-discord-data-backup-secret
-#     app.kubernetes.io/instance: {{ .Release.Name }}
-#     app.kubernetes.io/version: {{ .Chart.AppVersion }}
-#     app.kubernetes.io/component: backup
-#     app.kubernetes.io/part-of: {{ .Release.Name }}
-# spec:
-#   secretStoreRef:
-#     kind: ClusterSecretStore
-#     name: vault
-#   target:
-#     template:
-#       mergePolicy: Merge
-#       engineVersion: v2
-#       data:
-#         RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/matrix-synapse/mautrix-discord-data"
-#   data:
-#     - secretKey: BUCKET_ENDPOINT
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /cl01tl/volsync/restic/config
-#         metadataPolicy: None
-#         property: S3_BUCKET_ENDPOINT
-#     - secretKey: RESTIC_PASSWORD
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /cl01tl/volsync/restic/config
-#         metadataPolicy: None
-#         property: RESTIC_PASSWORD
-#     - secretKey: AWS_DEFAULT_REGION
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /cl01tl/volsync/restic/config
-#         metadataPolicy: None
-#         property: AWS_DEFAULT_REGION
-#     - secretKey: AWS_ACCESS_KEY_ID
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /digital-ocean/home-infra/volsync-backups
-#         metadataPolicy: None
-#         property: access_key
-#     - secretKey: AWS_SECRET_ACCESS_KEY
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /digital-ocean/home-infra/volsync-backups
-#         metadataPolicy: None
-#         property: secret_key
-
-# ---
-# apiVersion: external-secrets.io/v1beta1
-# kind: ExternalSecret
-# metadata:
-#   name: mautrix-whatsapp-data-backup-secret
-#   namespace: {{ .Release.Namespace }}
-#   labels:
-#     app.kubernetes.io/name: mautrix-whatsapp-data-backup-secret
-#     app.kubernetes.io/instance: {{ .Release.Name }}
-#     app.kubernetes.io/version: {{ .Chart.AppVersion }}
-#     app.kubernetes.io/component: backup
-#     app.kubernetes.io/part-of: {{ .Release.Name }}
-# spec:
-#   secretStoreRef:
-#     kind: ClusterSecretStore
-#     name: vault
-#   target:
-#     template:
-#       mergePolicy: Merge
-#       engineVersion: v2
-#       data:
-#         RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/matrix-synapse/mautrix-whatsapp-data"
-#   data:
-#     - secretKey: BUCKET_ENDPOINT
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /cl01tl/volsync/restic/config
-#         metadataPolicy: None
-#         property: S3_BUCKET_ENDPOINT
-#     - secretKey: RESTIC_PASSWORD
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /cl01tl/volsync/restic/config
-#         metadataPolicy: None
-#         property: RESTIC_PASSWORD
-#     - secretKey: AWS_DEFAULT_REGION
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /cl01tl/volsync/restic/config
-#         metadataPolicy: None
-#         property: AWS_DEFAULT_REGION
-#     - secretKey: AWS_ACCESS_KEY_ID
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /digital-ocean/home-infra/volsync-backups
-#         metadataPolicy: None
-#         property: access_key
-#     - secretKey: AWS_SECRET_ACCESS_KEY
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /digital-ocean/home-infra/volsync-backups
-#         metadataPolicy: None
-#         property: secret_key
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: matrix-synapse-postgresql-17-cluster-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: matrix-synapse-postgresql-17-cluster-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: database
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
-        property: access
-    - secretKey: ACCESS_SECRET_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
-        property: secret

clusters/cl01tl-standby/platform/matrix-synapse/templates/replication-source.yaml

@@ -1,91 +0,0 @@
-# apiVersion: volsync.backube/v1alpha1
-# kind: ReplicationSource
-# metadata:
-#   name: matrix-synapse-backup-source
-#   namespace: {{ .Release.Namespace }}
-#   labels:
-#     app.kubernetes.io/name: matrix-synapse-backup-source
-#     app.kubernetes.io/instance: {{ .Release.Name }}
-#     app.kubernetes.io/version: {{ .Chart.AppVersion }}
-#     app.kubernetes.io/component: backup
-#     app.kubernetes.io/part-of: {{ .Release.Name }}
-# spec:
-#   sourcePVC: matrix-synapse
-#   trigger:
-#     schedule: 0 0 */3 * *
-#   restic:
-#     pruneIntervalDays: 14
-#     repository: matrix-synapse-backup-secret
-#     retain:
-#       hourly: 1
-#       daily: 1
-#       weekly: 1
-#       monthly: 2
-#       yearly: 4
-#     copyMethod: Snapshot
-#     storageClassName: ceph-block
-#     volumeSnapshotClassName: ceph-blockpool-snapshot
-
-# ---
-# apiVersion: volsync.backube/v1alpha1
-# kind: ReplicationSource
-# metadata:
-#   name: mautrix-discord-data-backup-source
-#   namespace: {{ .Release.Namespace }}
-#   labels:
-#     app.kubernetes.io/name: mautrix-discord-data-backup-source
-#     app.kubernetes.io/instance: {{ .Release.Name }}
-#     app.kubernetes.io/version: {{ .Chart.AppVersion }}
-#     app.kubernetes.io/component: backup
-#     app.kubernetes.io/part-of: {{ .Release.Name }}
-# spec:
-#   sourcePVC: mautrix-discord-data
-#   trigger:
-#     schedule: 0 0 */3 * *
-#   restic:
-#     pruneIntervalDays: 14
-#     repository: mautrix-discord-data-backup-secret
-#     retain:
-#       hourly: 1
-#       daily: 1
-#       weekly: 1
-#       monthly: 2
-#       yearly: 4
-#     moverSecurityContext:
-#       runAsUser: 1337
-#       runAsGroup: 1337
-#     copyMethod: Snapshot
-#     storageClassName: ceph-block
-#     volumeSnapshotClassName: ceph-blockpool-snapshot
-
-# ---
-# apiVersion: volsync.backube/v1alpha1
-# kind: ReplicationSource
-# metadata:
-#   name: mautrix-whatsapp-data-backup-source
-#   namespace: {{ .Release.Namespace }}
-#   labels:
-#     app.kubernetes.io/name: mautrix-whatsapp-data-backup-source
-#     app.kubernetes.io/instance: {{ .Release.Name }}
-#     app.kubernetes.io/version: {{ .Chart.AppVersion }}
-#     app.kubernetes.io/component: backup
-#     app.kubernetes.io/part-of: {{ .Release.Name }}
-# spec:
-#   sourcePVC: mautrix-whatsapp-data
-#   trigger:
-#     schedule: 0 0 */3 * *
-#   restic:
-#     pruneIntervalDays: 14
-#     repository: mautrix-whatsapp-data-backup-secret
-#     retain:
-#       hourly: 1
-#       daily: 1
-#       weekly: 1
-#       monthly: 2
-#       yearly: 4
-#     moverSecurityContext:
-#       runAsUser: 1337
-#       runAsGroup: 1337
-#     copyMethod: Snapshot
-#     storageClassName: ceph-block
-#     volumeSnapshotClassName: ceph-blockpool-snapshot

clusters/cl01tl-standby/platform/matrix-synapse/templates/service-monitor.yaml

@@ -1,44 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: matrix-synapse
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: matrix-synapse
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: metrics
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: matrix-synapse
-      app.kubernetes.io/instance: {{ .Release.Name }}
-  endpoints:
-    - targetPort: 9090
-      interval: 3m
-      scrapeTimeout: 1m
-      path: /_synapse/metrics
-
----
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: matrix-hookshot
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: matrix-hookshot
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: metrics
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: matrix-hookshot
-      app.kubernetes.io/instance: {{ .Release.Name }}
-  endpoints:
-    - targetPort: 9001
-      interval: 3m
-      scrapeTimeout: 1m
-      path: /metrics

clusters/cl01tl-standby/platform/matrix-synapse/values.yaml

@@ -1,343 +0,0 @@
-matrix-synapse:
-  serverName: alexlebens.dev
-  publicServerName: matrix.alexlebens.dev
-  argoCD: true
-  signingkey:
-    job:
-      enabled: false
-  config:
-    reportStats: false
-    enableRegistration: true
-    trustedKeyServers: []
-  extraConfig:
-    enable_metrics: true
-    enable_registration_without_verification: true
-    password_config:
-      enabled: false
-    sso:
-      client_whitelist:
-        - https://chat.alexlebens.dev/
-      update_profile_information: true
-  synapse:
-    strategy:
-      type: Recreate
-    extraVolumes:
-      - name: matrix-synapse-config-secret
-        secret:
-          secretName: matrix-synapse-config-secret
-      - name: matrix-hookshot-config-secret
-        secret:
-          secretName: matrix-hookshot-config-secret
-      # - name: mautrix-discord-config-secret
-      #   secret:
-      #     secretName: mautrix-discord-config-secret
-      # - name: mautrix-whatsapp-config-secret
-      #   secret:
-      #     secretName: mautrix-whatsapp-config-secret
-      - name: double-puppet-registration-secret
-        secret:
-          secretName: double-puppet-registration-secret
-    extraVolumeMounts:
-      - name: matrix-synapse-config-secret
-        mountPath: /synapse/config/conf.d/oidc.yaml
-        subPath: oidc.yaml
-        readOnly: true
-      - name: matrix-synapse-config-secret
-        mountPath: /synapse/config/conf.d/config.yaml
-        subPath: config.yaml
-        readOnly: true
-      - name: matrix-hookshot-config-secret
-        mountPath: /synapse/config/conf.d/hookshot-registration.yaml
-        subPath: hookshot-registration.yaml
-        readOnly: true
-      # - name: mautrix-discord-config-secret
-      #   mountPath: /synapse/config/conf.d/mautrix-discord-registration.yaml
-      #   subPath: mautrix-discord-registration.yaml
-      #   readOnly: true
-      # - name: mautrix-whatsapp-config-secret
-      #   mountPath: /synapse/config/conf.d/mautrix-whatsapp-registration.yaml
-      #   subPath: mautrix-whatsapp-registration.yaml
-      #   readOnly: true
-      - name: double-puppet-registration-secret
-        mountPath: /synapse/config/conf.d/double-puppet-registration.yaml
-        subPath: double-puppet-registration.yaml
-        readOnly: true
-    resources:
-      requests:
-        cpu: 10m
-        memory: 128Mi
-  workers:
-    default:
-      replicaCount: 0
-    generic_worker:
-      enabled: false
-    pusher:
-      enabled: false
-    appservice:
-      enabled: false
-    federation_sender:
-      enabled: false
-    media_repository:
-      enabled: false
-    user_dir:
-      enabled: false
-  wellknown:
-    enabled: true
-    server:
-      m.server: matrix.alexlebens.dev:443
-    client:
-      m.homeserver:
-        base_url: https://matrix.alexlebens.dev
-  postgresql:
-    enabled: false
-  externalPostgresql:
-    host: matrix-synapse-postgresql-17-cluster-rw
-    port: 5432
-    username: app
-    database: app
-    existingSecret: matrix-synapse-postgresql-17-cluster-app
-    existingSecretPasswordKey: password
-  redis:
-    enabled: false
-  externalRedis:
-    host: matrix-synapse-valkey-primary
-    port: 6379
-    existingSecret: matrix-synapse-valkey-secret
-    existingSecretPasswordKey: password
-  persistence:
-    enabled: true
-    storageClass: ceph-block
-    accessMode: ReadWriteOnce
-    size: 10Gi
-  volumePermissions:
-    enabled: true
-    uid: 666
-    gid: 666
-  ingress:
-    enabled: false
-matrix-hookshot:
-  global:
-    fullnameOverride: matrix-hookshot
-  controllers:
-    main:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      containers:
-        main:
-          image:
-            repository: halfshot/matrix-hookshot
-            tag: 6.0.3
-            pullPolicy: IfNotPresent
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
-  serviceAccount:
-    create: true
-  service:
-    main:
-      controller: main
-      ports:
-        webhook:
-          port: 9000
-          targetPort: 9000
-          protocol: HTTP
-        metrics:
-          port: 9001
-          targetPort: 9001
-          protocol: HTTP
-        appservice:
-          port: 9002
-          targetPort: 9002
-          protocol: HTTP
-        homeserver:
-          port: 9993
-          targetPort: 9993
-          protocol: HTTP
-  persistence:
-    config:
-      enabled: true
-      type: secret
-      name: matrix-hookshot-config-secret
-      advancedMounts:
-        main:
-          main:
-            - path: /data/config.yml
-              readOnly: true
-              mountPropagation: None
-              subPath: config.yml
-    registration:
-      enabled: true
-      type: secret
-      name: matrix-hookshot-config-secret
-      advancedMounts:
-        main:
-          main:
-            - path: /data/registration.yml
-              readOnly: true
-              mountPropagation: None
-              subPath: registration.yml
-    passkey:
-      enabled: true
-      type: secret
-      name: matrix-hookshot-config-secret
-      advancedMounts:
-        main:
-          main:
-            - path: /data/passkey.pem
-              readOnly: true
-              mountPropagation: None
-              subPath: passkey.pem
-mautrix-discord:
-  global:
-    fullnameOverride: mautrix-discord
-  controllers:
-    main:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      containers:
-        main:
-          image:
-            repository: dock.mau.dev/mautrix/discord
-            tag: v0.7.2
-            pullPolicy: IfNotPresent
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
-  serviceAccount:
-    create: true
-  service:
-    main:
-      controller: main
-      ports:
-        http:
-          port: 29334
-          targetPort: 29334
-          protocol: HTTP
-  persistence:
-    data:
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 500Mi
-      retain: true
-      advancedMounts:
-        main:
-          main:
-            - path: /data
-              readOnly: false
-    config:
-      enabled: true
-      type: secret
-      name: mautrix-discord-config-secret
-      advancedMounts:
-        main:
-          main:
-            - path: /data/config.yaml
-              readOnly: true
-              mountPropagation: None
-              subPath: config.yaml
-mautrix-whatsapp:
-  global:
-    fullnameOverride: mautrix-whatsapp
-  controllers:
-    main:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      containers:
-        main:
-          image:
-            repository: dock.mau.dev/mautrix/whatsapp
-            tag: v0.11.3
-            pullPolicy: IfNotPresent
-          resources:
-            requests:
-              cpu: 10m
-              memory: 64Mi
-  serviceAccount:
-    create: true
-  service:
-    main:
-      controller: main
-      ports:
-        http:
-          port: 29333
-          targetPort: 29333
-          protocol: HTTP
-  persistence:
-    data:
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 500Mi
-      retain: true
-      advancedMounts:
-        main:
-          main:
-            - path: /data
-              readOnly: false
-    config:
-      enabled: true
-      type: secret
-      name: mautrix-whatsapp-config-secret
-      advancedMounts:
-        main:
-          main:
-            - path: /data/config.yaml
-              readOnly: true
-              mountPropagation: None
-              subPath: config.yaml
-valkey-synapse:
-  fullnameOverride: matrix-synapse-valkey
-  architecture: standalone
-  auth:
-    enabled: true
-    existingSecret: matrix-synapse-valkey-secret
-    existingSecretPasswordKey: password
-  primary:
-    persistence:
-      enabled: false
-  replica:
-    persistence:
-      enabled: false
-valkey-hookshot:
-  fullnameOverride: matrix-hookshot-valkey
-  architecture: standalone
-  auth:
-    enabled: false
-    usePasswordFiles: false
-  primary:
-    persistence:
-      enabled: false
-  replica:
-    persistence:
-      enabled: false
-cloudflared-synapse:
-  name: cloudflared-synapse
-  existingSecretName: matrix-synapse-cloudflared-synapse-secret
-cloudflared-hookshot:
-  name: cloudflared-hookshot
-  existingSecretName: matrix-synapse-cloudflared-hookshot-secret
-postgres-17-cluster:
-  mode: standalone
-  cluster:
-    walStorage:
-      storageClass: local-path
-    storage:
-      storageClass: local-path
-    resources:
-      requests:
-        cpu: 200m
-    monitoring:
-      enabled: true
-  backup:
-    enabled: true
-    endpointURL: https://nyc3.digitaloceanspaces.com
-    destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/matrix-synapse/matrix-synapse-postgresql-17-cluster
-    endpointCredentials: matrix-synapse-postgresql-17-cluster-backup-secret
-    backupIndex: 1

clusters/cl01tl-standby/platform/ollama/Chart.yaml

@@ -1,30 +0,0 @@
-apiVersion: v2
-name: ollama
-version: 1.0.0
-description: Ollama
-keywords:
-  - ollama
-  - ai
-home: https://wiki.alexlebens.dev/doc/ollama-Xmqe6T1P8v
-sources:
-  - https://github.com/ollama/ollama
-  - https://github.com/open-webui/open-webui
-  - https://github.com/ai-dock/stable-diffusion-webui
-  - https://github.com/cloudnative-pg/cloudnative-pg
-  - https://hub.docker.com/r/ollama/ollama
-  - https://github.com/open-webui/open-webui/pkgs/container/open-webui
-  - https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/alexlebens/helm-charts/tree/main/charts/postgres-cluster
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: ollama
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.7.1
-  - name: postgres-cluster
-    alias: postgres-17-cluster
-    version: 4.2.0
-    repository: http://alexlebens.github.io/helm-charts
-icon: https://avatars.githubusercontent.com/u/151674099?s=48&v=4
-appVersion: 0.5.1

clusters/cl01tl-standby/platform/ollama/templates/external-secret.yaml

@@ -1,206 +0,0 @@
-
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: ollama-key-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: ollama-key-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: key
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/ollama/key
-        metadataPolicy: None
-        property: key
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: ollama-oidc-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: ollama-oidc-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: auth
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: client
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /authentik/oidc/ollama
-        metadataPolicy: None
-        property: client
-    - secretKey: secret
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /authentik/oidc/ollama
-        metadataPolicy: None
-        property: secret
-
-# ---
-# apiVersion: external-secrets.io/v1beta1
-# kind: ExternalSecret
-# metadata:
-#   name: ollama-root-backup-secret
-#   namespace: {{ .Release.Namespace }}
-#   labels:
-#     app.kubernetes.io/name: ollama-root-backup-secret
-#     app.kubernetes.io/instance: {{ .Release.Name }}
-#     app.kubernetes.io/version: {{ .Chart.AppVersion }}
-#     app.kubernetes.io/component: backup
-#     app.kubernetes.io/part-of: {{ .Release.Name }}
-# spec:
-#   secretStoreRef:
-#     kind: ClusterSecretStore
-#     name: vault
-#   target:
-#     template:
-#       mergePolicy: Merge
-#       engineVersion: v2
-#       data:
-#         RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/ollama/ollama-root"
-#   data:
-#     - secretKey: BUCKET_ENDPOINT
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /cl01tl/volsync/restic/config
-#         metadataPolicy: None
-#         property: S3_BUCKET_ENDPOINT
-#     - secretKey: RESTIC_PASSWORD
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /cl01tl/volsync/restic/config
-#         metadataPolicy: None
-#         property: RESTIC_PASSWORD
-#     - secretKey: AWS_DEFAULT_REGION
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /cl01tl/volsync/restic/config
-#         metadataPolicy: None
-#         property: AWS_DEFAULT_REGION
-#     - secretKey: AWS_ACCESS_KEY_ID
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /digital-ocean/home-infra/volsync-backups
-#         metadataPolicy: None
-#         property: access_key
-#     - secretKey: AWS_SECRET_ACCESS_KEY
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /digital-ocean/home-infra/volsync-backups
-#         metadataPolicy: None
-#         property: secret_key
-
-# ---
-# apiVersion: external-secrets.io/v1beta1
-# kind: ExternalSecret
-# metadata:
-#   name: ollama-web-data-backup-secret
-#   namespace: {{ .Release.Namespace }}
-#   labels:
-#     app.kubernetes.io/name: ollama-web-data-backup-secret
-#     app.kubernetes.io/instance: {{ .Release.Name }}
-#     app.kubernetes.io/version: {{ .Chart.AppVersion }}
-#     app.kubernetes.io/component: backup
-#     app.kubernetes.io/part-of: {{ .Release.Name }}
-# spec:
-#   secretStoreRef:
-#     kind: ClusterSecretStore
-#     name: vault
-#   target:
-#     template:
-#       mergePolicy: Merge
-#       engineVersion: v2
-#       data:
-#         RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/ollama/ollama-web"
-#   data:
-#     - secretKey: BUCKET_ENDPOINT
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /cl01tl/volsync/restic/config
-#         metadataPolicy: None
-#         property: S3_BUCKET_ENDPOINT
-#     - secretKey: RESTIC_PASSWORD
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /cl01tl/volsync/restic/config
-#         metadataPolicy: None
-#         property: RESTIC_PASSWORD
-#     - secretKey: AWS_DEFAULT_REGION
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /cl01tl/volsync/restic/config
-#         metadataPolicy: None
-#         property: AWS_DEFAULT_REGION
-#     - secretKey: AWS_ACCESS_KEY_ID
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /digital-ocean/home-infra/volsync-backups
-#         metadataPolicy: None
-#         property: access_key
-#     - secretKey: AWS_SECRET_ACCESS_KEY
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /digital-ocean/home-infra/volsync-backups
-#         metadataPolicy: None
-#         property: secret_key
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: ollama-web-postgresql-17-cluster-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: ollama-web-postgresql-17-cluster-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: database
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
-        property: access
-    - secretKey: ACCESS_SECRET_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
-        property: secret

clusters/cl01tl-standby/platform/ollama/templates/replication-source.yaml

@@ -1,59 +0,0 @@
-# apiVersion: volsync.backube/v1alpha1
-# kind: ReplicationSource
-# metadata:
-#   name: ollama-root-backup-source
-#   namespace: {{ .Release.Namespace }}
-#   labels:
-#     app.kubernetes.io/name: ollama-root-backup-source
-#     app.kubernetes.io/instance: {{ .Release.Name }}
-#     app.kubernetes.io/version: {{ .Chart.AppVersion }}
-#     app.kubernetes.io/component: backup
-#     app.kubernetes.io/part-of: {{ .Release.Name }}
-# spec:
-#   sourcePVC: ollama-root
-#   trigger:
-#     schedule: 0 0 */3 * *
-#   restic:
-#     pruneIntervalDays: 14
-#     repository: ollama-root-backup-secret
-#     retain:
-#       hourly: 1
-#       daily: 1
-#       weekly: 1
-#       monthly: 2
-#       yearly: 4
-#     copyMethod: Snapshot
-#     storageClassName: ceph-block
-#     volumeSnapshotClassName: ceph-blockpool-snapshot
-
-# ---
-# apiVersion: volsync.backube/v1alpha1
-# kind: ReplicationSource
-# metadata:
-#   name: ollama-web-data-backup-source
-#   namespace: {{ .Release.Namespace }}
-#   labels:
-#     app.kubernetes.io/name: ollama-web-data-backup-source
-#     app.kubernetes.io/instance: {{ .Release.Name }}
-#     app.kubernetes.io/version: {{ .Chart.AppVersion }}
-#     app.kubernetes.io/component: backup
-#     app.kubernetes.io/part-of: {{ .Release.Name }}
-# spec:
-#   sourcePVC: ollama-web-data
-#   trigger:
-#     schedule: 0 0 */3 * *
-#   restic:
-#     pruneIntervalDays: 14
-#     repository: ollama-web-data-backup-secret
-#     retain:
-#       hourly: 1
-#       daily: 1
-#       weekly: 1
-#       monthly: 2
-#       yearly: 4
-#     moverSecurityContext:
-#       runAsUser: 1337
-#       runAsGroup: 1337
-#     copyMethod: Snapshot
-#     storageClassName: ceph-block
-#     volumeSnapshotClassName: ceph-blockpool-snapshot

clusters/cl01tl-standby/platform/ollama/templates/service.yaml

@@ -1,34 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: ollama-pd05wd
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: ollama-pd05wd
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: network
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-  annotations:
-    tailscale.com/tailnet-fqdn: ollama-pd05wd.boreal-beaufort.ts.net
-spec:
-  externalName: placeholder
-  type: ExternalName
-
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: stable-diffusion-pd05wd
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: stable-diffusion-pd05wd
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: network
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-  annotations:
-    tailscale.com/tailnet-fqdn: stable-diffusion-pd05wd.boreal-beaufort.ts.net
-spec:
-  externalName: placeholder
-  type: ExternalName

clusters/cl01tl-standby/platform/ollama/values.yaml

@@ -1,274 +0,0 @@
-ollama:
-  controllers:
-    server-1:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      pod:
-        labels:
-          ollama-type: server
-        affinity:
-          podAntiAffinity:
-              requiredDuringSchedulingIgnoredDuringExecution:
-                - labelSelector:
-                    matchExpressions:
-                      - key: ollama-type
-                        operator: In
-                        values:
-                          - server
-                  topologyKey: kubernetes.io/hostname
-      containers:
-        main:
-          image:
-            repository: ollama/ollama
-            tag: 0.5.12
-            pullPolicy: IfNotPresent
-          env:
-            - name: OLLAMA_KEEP_ALIVE
-              value: 24h
-            - name: OLLAMA_HOST
-              value: 0.0.0.0
-          resources:
-            requests:
-              cpu: 100m
-              memory: 1Gi
-              # gpu.intel.com/i915: 1
-            limits:
-              cpu: 4
-              # gpu.intel.com/i915: 1
-    # server-2:
-    #   type: deployment
-    #   replicas: 1
-    #   strategy: Recreate
-    #   revisionHistoryLimit: 3
-    #   pod:
-    #     labels:
-    #       ollama-type: server
-    #     affinity:
-    #       podAntiAffinity:
-    #           requiredDuringSchedulingIgnoredDuringExecution:
-    #             - labelSelector:
-    #                 matchExpressions:
-    #                   - key: ollama-type
-    #                     operator: In
-    #                     values:
-    #                       - server
-    #               topologyKey: kubernetes.io/hostname
-    #   containers:
-    #     main:
-    #       image:
-    #         repository: ollama/ollama
-    #         tag: 0.5.12
-    #         pullPolicy: IfNotPresent
-    #       env:
-    #         - name: OLLAMA_KEEP_ALIVE
-    #           value: 24h
-    #         - name: OLLAMA_HOST
-    #           value: 0.0.0.0
-    #       resources:
-    #         requests:
-    #           cpu: 100m
-    #           memory: 1Gi
-    #           gpu.intel.com/i915: 1
-    #         limits:
-    #           cpu: 4
-    #           gpu.intel.com/i915: 1
-    # server-3:
-    #   type: deployment
-    #   replicas: 1
-    #   strategy: Recreate
-    #   revisionHistoryLimit: 3
-    #   pod:
-    #     labels:
-    #       ollama-type: server
-    #     affinity:
-    #       podAntiAffinity:
-    #           requiredDuringSchedulingIgnoredDuringExecution:
-    #             - labelSelector:
-    #                 matchExpressions:
-    #                   - key: ollama-type
-    #                     operator: In
-    #                     values:
-    #                       - server
-    #               topologyKey: kubernetes.io/hostname
-    #   containers:
-    #     main:
-    #       image:
-    #         repository: ollama/ollama
-    #         tag: 0.5.12
-    #         pullPolicy: IfNotPresent
-    #       env:
-    #         - name: OLLAMA_KEEP_ALIVE
-    #           value: 24h
-    #         - name: OLLAMA_HOST
-    #           value: 0.0.0.0
-    #       resources:
-    #         requests:
-    #           cpu: 100m
-    #           memory: 1Gi
-    #           gpu.intel.com/i915: 1
-    #         limits:
-    #           cpu: 4
-    #           gpu.intel.com/i915: 1
-    web:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      containers:
-        main:
-          image:
-            repository: ghcr.io/open-webui/open-webui
-            tag: 0.5.16
-            pullPolicy: IfNotPresent
-          env:
-            - name: ENV
-              value: prod
-            - name: WEBUI_AUTH
-              value: true
-            - name: WEBUI_NAME
-              value: Ollama
-            - name: WEBUI_URL
-              value: http://ollama-cl01tl.boreal-beaufort.ts.net
-            - name: ENABLE_LOGIN_FORM
-              value: false
-            - name: DEFAULT_USER_ROLE
-              value: admin
-            - name: WEBUI_SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: ollama-key-secret
-                  key: key
-            - name: DATABASE_URL
-              valueFrom:
-                secretKeyRef:
-                  name: ollama-web-postgresql-17-cluster-app
-                  key: uri
-            - name: OLLAMA_BASE_URL
-              value: http://ollama-server-1.ollama:11434
-            - name: ENABLE_OAUTH_SIGNUP
-              value: true
-            - name: OAUTH_USERNAME_CLAIM
-              value: preferred_username
-            - name: OAUTH_CLIENT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: ollama-oidc-secret
-                  key: secret
-            - name: OAUTH_CLIENT_ID
-              valueFrom:
-                secretKeyRef:
-                  name: ollama-oidc-secret
-                  key: client
-            - name: OAUTH_PROVIDER_NAME
-              value: Authentik
-            - name: OPENID_PROVIDER_URL
-              value: https://auth-cl01tl.boreal-beaufort.ts.net/application/o/ollama/.well-known/openid-configuration
-          resources:
-            requests:
-              cpu: 10m
-              memory: 1Gi
-  serviceAccount:
-    create: true
-  service:
-    server-1:
-      controller: server-1
-      ports:
-        http:
-          port: 11434
-          targetPort: 11434
-          protocol: HTTP
-    # server-2:
-    #   controller: server-2
-    #   ports:
-    #     http:
-    #       port: 11434
-    #       targetPort: 11434
-    #       protocol: HTTP
-    # server-3:
-    #   controller: server-3
-    #   ports:
-    #     http:
-    #       port: 11434
-    #       targetPort: 11434
-    #       protocol: HTTP
-    web:
-      controller: web
-      ports:
-        http:
-          port: 80
-          targetPort: 8080
-          protocol: HTTP
-  ingress:
-    main:
-      className: tailscale
-      hosts:
-        - host: ollama-cl01tl
-          paths:
-            - path: /
-              pathType: Prefix
-              service:
-                name: ollama-web
-                port: 80
-      tls:
-        - secretName: ollama-cl01tl
-          hosts:
-            - ollama-cl01tl
-  persistence:
-    server-1:
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 40Gi
-      retain: true
-      advancedMounts:
-        server-1:
-          main:
-            - path: /root/.ollama
-              readOnly: false
-    # server-2:
-    #   storageClass: ceph-block
-    #   accessMode: ReadWriteOnce
-    #   size: 40Gi
-    #   retain: true
-    #   advancedMounts:
-    #     server-2:
-    #       main:
-    #         - path: /root/.ollama
-    #           readOnly: false
-    # server-3:
-    #   storageClass: ceph-block
-    #   accessMode: ReadWriteOnce
-    #   size: 40Gi
-    #   retain: true
-    #   advancedMounts:
-    #     server-3:
-    #       main:
-    #         - path: /root/.ollama
-    #           readOnly: false
-    web-data:
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 5Gi
-      retain: true
-      advancedMounts:
-        web:
-          main:
-            - path: /app/backend/data
-              readOnly: false
-postgres-17-cluster:
-  nameOverride: ollama-web-postgresql-17
-  mode: standalone
-  cluster:
-    walStorage:
-      storageClass: local-path
-    storage:
-      storageClass: local-path
-    monitoring:
-      enabled: true
-  backup:
-    enabled: true
-    endpointURL: https://nyc3.digitaloceanspaces.com
-    destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/ollama/ollama-web-postgresql-17-cluster
-    endpointCredentials: ollama-web-postgresql-17-cluster-backup-secret
-    backupIndex: 1

clusters/cl01tl-standby/platform/stalwart/templates/external-secret.yaml

@@ -1,114 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: stalwart-elasticsearch-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ .Release.Name }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: ELASTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/stalwart/config
-        metadataPolicy: None
-        property: ELASTIC_PASSWORD
-
-# ---
-# apiVersion: external-secrets.io/v1beta1
-# kind: ExternalSecret
-# metadata:
-#   name: stalwart-config-backup-secret
-#   namespace: {{ .Release.Namespace }}
-#   labels:
-#     app.kubernetes.io/name: stalwart-config-backup-secret
-#     app.kubernetes.io/instance: {{ .Release.Name }}
-#     app.kubernetes.io/version: {{ .Chart.AppVersion }}
-#     app.kubernetes.io/component: backup
-#     app.kubernetes.io/part-of: {{ .Release.Name }}
-# spec:
-#   secretStoreRef:
-#     kind: ClusterSecretStore
-#     name: vault
-#   target:
-#     template:
-#       mergePolicy: Merge
-#       engineVersion: v2
-#       data:
-#         RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/stalwart/stalwart-config"
-#   data:
-#     - secretKey: BUCKET_ENDPOINT
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /cl01tl/volsync/restic/config
-#         metadataPolicy: None
-#         property: S3_BUCKET_ENDPOINT
-#     - secretKey: RESTIC_PASSWORD
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /cl01tl/volsync/restic/config
-#         metadataPolicy: None
-#         property: RESTIC_PASSWORD
-#     - secretKey: AWS_DEFAULT_REGION
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /cl01tl/volsync/restic/config
-#         metadataPolicy: None
-#         property: AWS_DEFAULT_REGION
-#     - secretKey: AWS_ACCESS_KEY_ID
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /digital-ocean/home-infra/volsync-backups
-#         metadataPolicy: None
-#         property: access_key
-#     - secretKey: AWS_SECRET_ACCESS_KEY
-#       remoteRef:
-#         conversionStrategy: Default
-#         decodingStrategy: None
-#         key: /digital-ocean/home-infra/volsync-backups
-#         metadataPolicy: None
-#         property: secret_key
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: stalwart-postgresql-17-cluster-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: stalwart-postgresql-17-cluster-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: database
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
-        property: access
-    - secretKey: ACCESS_SECRET_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
-        property: secret

clusters/cl01tl-standby/platform/stalwart/templates/namespace.yaml

@@ -1,8 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: stalwart
-  labels:
-    pod-security.kubernetes.io/audit: privileged
-    pod-security.kubernetes.io/enforce: privileged
-    pod-security.kubernetes.io/warn: privileged

clusters/cl01tl-standby/platform/stalwart/templates/replication-source.yaml

@@ -1,27 +0,0 @@
-# apiVersion: volsync.backube/v1alpha1
-# kind: ReplicationSource
-# metadata:
-#   name: stalwart-config-backup-source
-#   namespace: {{ .Release.Namespace }}
-#   labels:
-#     app.kubernetes.io/name: stalwart-config-backup-source
-#     app.kubernetes.io/instance: {{ .Release.Name }}
-#     app.kubernetes.io/version: {{ .Chart.AppVersion }}
-#     app.kubernetes.io/component: backup
-#     app.kubernetes.io/part-of: {{ .Release.Name }}
-# spec:
-#   sourcePVC: stalwart-config
-#   trigger:
-#     schedule: 0 0 */3 * *
-#   restic:
-#     pruneIntervalDays: 14
-#     repository: stalwart-config-backup-secret
-#     retain:
-#       hourly: 1
-#       daily: 1
-#       weekly: 1
-#       monthly: 2
-#       yearly: 4
-#     copyMethod: Snapshot
-#     storageClassName: ceph-block
-#     volumeSnapshotClassName: ceph-blockpool-snapshot

clusters/cl01tl-standby/platform/stalwart/values.yaml

@@ -1,114 +0,0 @@
-stalwart:
-  controllers:
-    main:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      containers:
-        main:
-          image:
-            repository: stalwartlabs/mail-server
-            tag: v0.11.6
-            pullPolicy: IfNotPresent
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
-  serviceAccount:
-    create: true
-  service:
-    main:
-      controller: main
-      ports:
-        http:
-          port: 80
-          targetPort: 8080
-          protocol: HTTP
-        smtp:
-          port: 25
-          targetPort: 25
-          protocol: TCP
-        smtps:
-          port: 465
-          targetPort: 465
-          protocol: TCP
-        imap:
-          port: 143
-          targetPort: 143
-          protocol: TCP
-        imaps:
-          port: 993
-          targetPort: 993
-          protocol: TCP
-  ingress:
-    main:
-      className: tailscale
-      hosts:
-        - host: stalwart-cl01tl
-          paths:
-            - path: /
-              pathType: Prefix
-              service:
-                name: stalwart
-                port: 80
-      tls:
-        - secretName: stalwart-cl01tl
-          hosts:
-            - stalwart-cl01tl
-  persistence:
-    config:
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 10Gi
-      retain: true
-      advancedMounts:
-        main:
-          main:
-            - path: /opt/stalwart-mail
-              readOnly: false
-valkey:
-  architecture: standalone
-  auth:
-    enabled: false
-    usePasswordFiles: false
-  primary:
-    persistence:
-      enabled: false
-  replica:
-    persistence:
-      enabled: false
-elasticsearch:
-  global:
-    storageClass: ceph-block
-  extraEnvVars:
-    - name: discovery.type
-      value: single-node
-    - name: xpack.security.enabled
-      value: "true"
-  extraEnvVarsSecret: stalwart-elasticsearch-secret
-  master:
-    masterOnly: false
-    replicaCount: 1
-  data:
-    replicaCount: 0
-  coordinating:
-    replicaCount: 0
-  ingest:
-    enabled: false
-    replicaCount: 0
-postgres-17-cluster:
-  mode: standalone
-  cluster:
-    walStorage:
-      storageClass: local-path
-    storage:
-      storageClass: local-path
-    monitoring:
-      enabled: true
-  backup:
-    enabled: true
-    endpointURL: https://nyc3.digitaloceanspaces.com
-    destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/stalwart/stalwart-postgresql-17-cluster
-    endpointCredentials: stalwart-postgresql-17-cluster-backup-secret
-    backupIndex: 1