stage for rebuilt

clusters/cl01tl/platform/authentik/Chart.yaml

@@ -1,35 +0,0 @@
-apiVersion: v2
-name: authentik
-version: 1.0.0
-description: Authentik
-keywords:
-  - authentik
-  - sso
-  - oidc
-  - ldap
-  - idp
-  - authentication
-home: https://wiki.alexlebens.dev/doc/authentik-q2d4WDhqpe
-sources:
-  - https://github.com/goauthentik/authentik
-  - https://github.com/cloudflare/cloudflared
-  - https://github.com/cloudnative-pg/cloudnative-pg
-  - https://github.com/goauthentik/helm
-  - https://github.com/alexlebens/helm-charts/tree/main/charts/cloudflared
-  - https://github.com/alexlebens/helm-charts/tree/main/charts/postgres-cluster
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: authentik
-    version: 2024.12.3
-    repository: https://charts.goauthentik.io/
-  - name: cloudflared
-    alias: cloudflared
-    repository: http://alexlebens.github.io/helm-charts
-    version: 1.13.0
-  - name: postgres-cluster
-    alias: postgres-17-cluster
-    version: 4.1.4
-    repository: http://alexlebens.github.io/helm-charts
-icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/authentik.png
-appVersion: 2024.10.5

clusters/cl01tl/platform/authentik/templates/config-map.yaml

@@ -1,60 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: authentik-custom-css
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ .Release.Name }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-data:
-  custom.css: |
-    /* Change sign button color */
-    .pf-c-button.pf-m-primary {
-      color: black;
-      background-color: white;
-    }
-
-    /* Remove background */
-    .pf-c-login__main {
-      background-color: rgba(3, 3, 3, 0.16);
-    }
-
-    /* Remove specific height */
-    .pf-c-brand {
-      height: auto;
-    }
-
-    /* Center text */
-    .pf-c-title {
-      text-align: center;
-    }
-
-    /* Match text field to login button */
-    .pf-c-form-control {
-      border-radius: 3px;
-      background-color: white;
-      color: black;
-    }
-
-    /* Force border color */
-    .pf-c-form-control {
-      border-color: white;
-    }
-
-    /* Use default cursor on this div */
-    .pf-c-form__label {
-      cursor: default;
-    }
-
-    /* Hide required asterik */
-    .pf-c-form__label-required {
-      display: none;
-    }
-
-    /* Change link color to white */
-    .a {
-      color: white;
-    }

clusters/cl01tl/platform/authentik/templates/external-secret.yaml

@@ -1,80 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: authentik-key-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: authentik-key-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: key
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/authentik/key
-        metadataPolicy: None
-        property: key
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: authentik-cloudflared-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: authentik-cloudflared-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: cf-tunnel-token
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cloudflare/tunnels/authentik
-        metadataPolicy: None
-        property: token
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: authentik-postgresql-17-cluster-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: authentik-postgresql-17-cluster-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: database
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
-        property: access
-    - secretKey: ACCESS_SECRET_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
-        property: secret

clusters/cl01tl/platform/authentik/templates/ingress.yaml

@@ -1,32 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: authentik-local
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: authentik-local
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-  annotations:
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
-    traefik.ingress.kubernetes.io/router.tls: "true"
-    cert-manager.io/cluster-issuer: letsencrypt-issuer
-spec:
-  ingressClassName: traefik
-  tls:
-    - hosts:
-        - authentik.alexlebens.net
-      secretName: authentik-tls-secret
-  rules:
-    - host: authentik.alexlebens.net
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: authentik-server
-                port:
-                  number: 80

clusters/cl01tl/platform/authentik/values.yaml

@@ -1,83 +0,0 @@
-authentik:
-  global:
-    env:
-      - name: AUTHENTIK_SECRET_KEY
-        valueFrom:
-          secretKeyRef:
-            name: authentik-key-secret
-            key: key
-      - name: AUTHENTIK_POSTGRESQL__HOST
-        valueFrom:
-          secretKeyRef:
-            name: authentik-postgresql-17-cluster-app
-            key: host
-      - name: AUTHENTIK_POSTGRESQL__NAME
-        valueFrom:
-          secretKeyRef:
-            name: authentik-postgresql-17-cluster-app
-            key: dbname
-      - name: AUTHENTIK_POSTGRESQL__USER
-        valueFrom:
-          secretKeyRef:
-            name: authentik-postgresql-17-cluster-app
-            key: user
-      - name: AUTHENTIK_POSTGRESQL__PASSWORD
-        valueFrom:
-          secretKeyRef:
-            name: authentik-postgresql-17-cluster-app
-            key: password
-  server:
-    name: server
-    replicas: 1
-    volumes:
-      - name: custom-css
-        configMap:
-          name: authentik-custom-css
-    volumeMounts:
-      - name: custom-css
-        mountPath: /web/dist/custom.css
-        subPath: custom.css
-    metrics:
-      enabled: true
-      serviceMonitor:
-        enabled: true
-    ingress:
-      enabled: true
-      ingressClassName: tailscale
-      annotations:
-        tailscale.com/experimental-forward-cluster-traffic-via-ingress: "true"
-      hosts:
-        - auth-cl01tl
-      paths:
-        - /
-      tls:
-        - secretName: auth-cl01tl
-          hosts:
-            - auth-cl01tl
-  worker:
-    name: worker
-    replicas: 1
-  prometheus:
-    rules:
-      enabled: true
-  postgresql:
-    enabled: false
-  redis:
-    enabled: true
-cloudflared:
-  existingSecretName: authentik-cloudflared-secret
-postgres-17-cluster:
-  mode: standalone
-  cluster:
-    walStorage:
-      storageClass: local-path
-    storage:
-      storageClass: local-path
-    monitoring:
-      enabled: true
-  backup:
-    enabled: true
-    endpointURL: https://nyc3.digitaloceanspaces.com
-    destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/authentik/authentik-postgresql-17-cluster
-    endpointCredentials: authentik-postgresql-17-cluster-backup-secret
-    backupIndex: 1

clusters/cl01tl/platform/external-secrets/Chart.yaml

@@ -1,18 +0,0 @@
-apiVersion: v2
-name: external-secrets
-version: 1.0.0
-description: External Secrets
-keywords:
-  - external-secrets
-  - secrets
-  - vault
-home: https://wiki.alexlebens.dev/doc/external-secrets-E68EWwvR0a
-sources:
-  - https://github.com/external-secrets/external-secrets
-  - https://github.com/external-secrets/external-secrets/tree/main/deploy/charts/external-secrets
-dependencies:
-  - name: external-secrets
-    version: 0.14.1
-    repository: https://charts.external-secrets.io
-icon: https://avatars.githubusercontent.com/u/68335991?s=48&v=4
-appVersion: 0.11.0

clusters/cl01tl/platform/external-secrets/templates/cluster-secret-store.yaml

@@ -1,21 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ClusterSecretStore
-metadata:
-  name: vault
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ .Release.Name }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: auth
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  provider:
-    vault:
-      server: http://vault-internal.vault:8200
-      path: secret
-      auth:
-        tokenSecretRef:
-          namespace: vault
-          name: vault-token
-          key: token

clusters/cl01tl/platform/gitea/Chart.yaml

@@ -1,37 +0,0 @@
-apiVersion: v2
-name: gitea
-version: 1.0.0
-description: Gitea
-keywords:
-  - gitea
-  - git
-  - code
-home: https://wiki.alexlebens.dev/doc/gitea-OgqW6bQWrW
-sources:
-  - https://github.com/go-gitea/gitea
-  - https://github.com/cloudflare/cloudflared
-  - https://github.com/cloudnative-pg/cloudnative-pg
-  - https://hub.docker.com/r/gitea/gitea
-  - https://gitea.com/gitea/helm-chart
-  - https://github.com/alexlebens/helm-charts/tree/main/charts/cloudflared
-  - https://github.com/alexlebens/helm-charts/tree/main/charts/postgres-cluster
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: gitea
-    version: 10.6.0
-    repository: https://dl.gitea.io/charts/
-  - name: cloudflared
-    alias: cloudflared
-    repository: http://alexlebens.github.io/helm-charts
-    version: 1.13.0
-  - name: app-template
-    alias: backup
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.6.1
-  - name: postgres-cluster
-    alias: postgres-17-cluster
-    version: 4.1.4
-    repository: http://alexlebens.github.io/helm-charts
-icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/gitea.png
-appVersion: 1.22.4

clusters/cl01tl/platform/gitea/templates/external-secret.yaml

@@ -1,165 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: gitea-admin-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: gitea-admin-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: username
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/gitea/auth/admin
-        metadataPolicy: None
-        property: username
-    - secretKey: password
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/gitea/auth/admin
-        metadataPolicy: None
-        property: password
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: gitea-oidc-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: gitea-oidc-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: secret
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /authentik/oidc/gitea
-        metadataPolicy: None
-        property: secret
-    - secretKey: key
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /authentik/oidc/gitea
-        metadataPolicy: None
-        property: client
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: gitea-cloudflared-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: gitea-cloudflared-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: cf-tunnel-token
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cloudflare/tunnels/gitea
-        metadataPolicy: None
-        property: token
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: gitea-backup-s3
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: gitea-backup-s3
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: backup
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/gitea-backup
-        metadataPolicy: None
-        property: AWS_ACCESS_KEY_ID
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/gitea-backup
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ENDPOINT_URL
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/gitea-backup
-        metadataPolicy: None
-        property: AWS_ENDPOINT_URL
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/gitea-backup
-        metadataPolicy: None
-        property: AWS_SECRET_ACCESS_KEY
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: gitea-postgresql-17-cluster-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: gitea-postgresql-17-cluster-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: database
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
-        property: access
-    - secretKey: ACCESS_SECRET_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
-        property: secret

clusters/cl01tl/platform/gitea/templates/ingress.yaml

@@ -1,64 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: gitea-local
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: gitea-local
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-  annotations:
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
-    traefik.ingress.kubernetes.io/router.tls: "true"
-    cert-manager.io/cluster-issuer: letsencrypt-issuer
-spec:
-  ingressClassName: traefik
-  tls:
-    - hosts:
-        - gitea.alexlebens.net
-      secretName: gitea-tls-secret
-  rules:
-    - host: gitea.alexlebens.net
-      http:
-        paths:
-          - path: /
-            pathType: ImplementationSpecific
-            backend:
-              service:
-                name: gitea-http
-                port:
-                  number: 3000
-
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: gitea-tailscale
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: gitea-tailscale
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-  annotations:
-    tailscale.com/experimental-forward-cluster-traffic-via-ingress: "true"
-spec:
-  ingressClassName: tailscale
-  tls:
-    - hosts:
-        - gitea-cl01tl
-      secretName: gitea-cl01tl
-  rules:
-    - host: gitea-cl01tl
-      http:
-        paths:
-          - path: /
-            pathType: ImplementationSpecific
-            backend:
-              service:
-                name: gitea-http
-                port:
-                  name: http

clusters/cl01tl/platform/gitea/templates/persistent-volume-claim.yaml

@@ -1,19 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: gitea-nfs-storage-backup
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: gitea-nfs-storage-backup
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: storage
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  volumeMode: Filesystem
-  storageClassName: nfs-client
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi

clusters/cl01tl/platform/gitea/templates/role-binding.yaml

@@ -1,19 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: gitea-backup
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: gitea-backup
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: backup
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: gitea-backup
-subjects:
-  - kind: ServiceAccount
-    name: gitea-backup
-    namespace: {{ .Release.Namespace }}

clusters/cl01tl/platform/gitea/templates/role.yaml

@@ -1,27 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: gitea-backup
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: gitea-backup
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: backup
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - pods
-      - pods/exec
-    verbs:
-      - create
-      - list
-  - apiGroups:
-      - apps
-    resources:
-      - deployments
-    verbs:
-      - get
-      - list

clusters/cl01tl/platform/gitea/values.yaml

@@ -1,182 +0,0 @@
-gitea:
-  image:
-    repository: gitea/gitea
-    tag: 1.23.3
-  service:
-    http:
-      type: ClusterIP
-      port: 3000
-      clusterIP: 10.103.160.139
-    ssh:
-      type: ClusterIP
-      port: 2222
-      clusterIP: 10.103.160.140
-  ingress:
-    enabled: false
-  persistence:
-    storageClass: ceph-block
-  extraVolumes:
-    - name: gitea-nfs-storage-backup
-      persistentVolumeClaim:
-        claimName: gitea-nfs-storage-backup
-  extraVolumeMounts:
-    - mountPath: /opt/backup
-      name: gitea-nfs-storage-backup
-      readOnly: false
-  gitea:
-    admin:
-      existingSecret: gitea-admin-secret
-    metrics:
-      enabled: true
-      serviceMonitor:
-        enabled: true
-    oauth:
-      - name: Authentik
-        provider: openidConnect
-        existingSecret: gitea-oidc-secret
-        autoDiscoverUrl: https://auth.alexlebens.dev/application/o/gitea/.well-known/openid-configuration
-        iconUrl: https://goauthentik.io/img/icon.png
-        scopes: "email profile"
-    config:
-      APP_NAME: Gitea
-      server:
-        PROTOCOL: http
-        DOMAIN: gitea.alexlebens.dev
-        ROOT_URL: https://gitea.alexlebens.dev
-        LOCAL_ROOT_URL: http://gitea-http.gitea.svc.cluster.local:3000
-        START_SSH_SERVER: true
-        SSH_DOMAIN: gitea.alexlebens.dev
-        SSH_PORT: 2222
-        SSH_LISTEN_PORT: 2222
-        ENABLE_PPROF: true
-        LANDING_PAGE: explore
-      database:
-        DB_TYPE: postgres
-        SCHEMA: public
-      oauth2_client:
-        ENABLE_AUTO_REGISTRATION: true
-      service:
-        REGISTER_MANUAL_CONFIRM: true
-        SHOW_REGISTRATION_BUTTON: false
-        ALLOW_ONLY_EXTERNAL_REGISTRATION: true
-      explore:
-        REQUIRE_SIGNIN_VIEW: true
-      webhook:
-        ALLOWED_HOST_LIST: private
-      mirror:
-        DEFAULT_INTERVAL: 10m
-    additionalConfigFromEnvs:
-      - name: GITEA__DATABASE__HOST
-        valueFrom:
-          secretKeyRef:
-            name: gitea-postgresql-17-cluster-app
-            key: host
-      - name: GITEA__DATABASE__NAME
-        valueFrom:
-          secretKeyRef:
-            name: gitea-postgresql-17-cluster-app
-            key: dbname
-      - name: GITEA__DATABASE__USER
-        valueFrom:
-          secretKeyRef:
-            name: gitea-postgresql-17-cluster-app
-            key: user
-      - name: GITEA__DATABASE__PASSWD
-        valueFrom:
-          secretKeyRef:
-            name: gitea-postgresql-17-cluster-app
-            key: password
-  memcached:
-    enabled: true
-  redis:
-    enabled: false
-  redis-cluster:
-    enabled: false
-  postgresql:
-    enabled: false
-  postgresql-ha:
-    enabled: false
-  mysql:
-    enabled: false
-  mariadb:
-    enabled: false
-cloudflared:
-  existingSecretName: gitea-cloudflared-secret
-backup:
-  global:
-    fullnameOverride: gitea-backup
-  controllers:
-    backup:
-      type: cronjob
-      cronjob:
-        suspend: false
-        concurrencyPolicy: Forbid
-        timeZone: US/Central
-        schedule: 0 4 * * *
-        startingDeadlineSeconds: 90
-        successfulJobsHistory: 3
-        failedJobsHistory: 3
-        backoffLimit: 3
-        parallelism: 1
-      containers:
-        backup:
-          image:
-            repository: bitnami/kubectl
-            tag: 1.32.1
-            pullPolicy: IfNotPresent
-          command:
-            - sh
-          args:
-            - -ec
-            - |
-              kubectl exec -it deploy/gitea -n gitea -- rm -f /opt/backup/gitea-backup.zip;
-              kubectl exec -it deploy/gitea -n gitea -- /app/gitea/gitea dump -c /data/gitea/conf/app.ini --file /opt/backup/gitea-backup.zip;
-          resources:
-            requests:
-              cpu: 100m
-              memory: 128Mi
-        s3:
-          image:
-            repository: amazon/aws-cli
-            tag: 2.24.0
-            pullPolicy: IfNotPresent
-          command:
-            - /bin/sh
-          args:
-            - -ec
-            - |
-              until [ -f /opt/backup/gitea-backup.zip ]; do sleep 5; done;
-              aws s3 cp /opt/backup/gitea-backup.zip s3://cl01tl-gitea-backups/gitea-backup-$(date +"%Y%m%d-%H-%M").zip;
-              mv /opt/backup/gitea-backup.zip /opt/backup/gitea-backup-$(date +"%Y%m%d-%H-%M").zip;
-          envFrom:
-            - secretRef:
-                name: gitea-backup-s3
-          resources:
-            requests:
-              cpu: 100m
-              memory: 128Mi
-  serviceAccount:
-    create: true
-  persistence:
-    config:
-      existingClaim: gitea-nfs-storage-backup
-      advancedMounts:
-        backup:
-          s3:
-            - path: /opt/backup
-              readOnly: false
-postgres-17-cluster:
-  mode: standalone
-  cluster:
-    walStorage:
-      storageClass: local-path
-    storage:
-      storageClass: local-path
-    monitoring:
-      enabled: true
-  backup:
-    enabled: true
-    endpointURL: https://nyc3.digitaloceanspaces.com
-    destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/gitea/gitea-postgresql-17-cluster
-    endpointCredentials: gitea-postgresql-17-cluster-backup-secret
-    backupIndex: 1

clusters/cl01tl/platform/matrix-synapse/Chart.yaml

@@ -1,69 +0,0 @@
-apiVersion: v2
-name: matrix-synapse
-version: 1.0.0
-description: Matrix Synapse
-keywords:
-  - matrix-synapse
-  - matrix
-  - chat
-  - bridge
-  - matrix-hookshot
-  - mautrix-discord
-  - mautrix-whatsapp
-home: https://wiki.alexlebens.dev/doc/matrix-gm0OkID2iy
-sources:
-  - https://github.com/element-hq/synapse
-  - https://github.com/matrix-org/matrix-hookshot
-  - https://github.com/mautrix/discord
-  - https://github.com/mautrix/whatsapp
-  - https://github.com/valkey-io/valkey
-  - https://github.com/cloudflare/cloudflared
-  - https://github.com/cloudnative-pg/cloudnative-pg
-  - https://hub.docker.com/r/halfshot/matrix-hookshot
-  - https://mau.dev/mautrix/discord/container_registry
-  - https://mau.dev/mautrix/whatsapp/container_registry
-  - https://gitlab.com/ananace/charts/-/tree/master/charts/matrix-synapse
-  - https://github.com/bitnami/charts/tree/main/bitnami/valkey
-  - https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/alexlebens/helm-charts/tree/main/charts/cloudflared
-  - https://github.com/alexlebens/helm-charts/charts/postgres-cluster
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: matrix-synapse
-    version: 3.11.2
-    repository: https://ananace.gitlab.io/charts
-  - name: app-template
-    alias: matrix-hookshot
-    version: 3.6.1
-    repository: https://bjw-s.github.io/helm-charts/
-  - name: app-template
-    alias: mautrix-discord
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.6.1
-  - name: app-template
-    alias: mautrix-whatsapp
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.6.1
-  - name: valkey
-    alias: valkey-synapse
-    version: 2.2.3
-    repository: https://charts.bitnami.com/bitnami
-  - name: valkey
-    alias: valkey-hookshot
-    version: 2.2.3
-    repository: https://charts.bitnami.com/bitnami
-  - name: cloudflared
-    alias: cloudflared-synapse
-    version: 1.13.0
-    repository: http://alexlebens.github.io/helm-charts
-  - name: cloudflared
-    alias: cloudflared-hookshot
-    version: 1.13.0
-    repository: http://alexlebens.github.io/helm-charts
-  - name: postgres-cluster
-    alias: postgres-17-cluster
-    version: 4.1.4
-    repository: http://alexlebens.github.io/helm-charts
-icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/matrix.png
-appVersion: 1.121.1

clusters/cl01tl/platform/matrix-synapse/templates/external-secret.yaml

@@ -1,449 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: matrix-synapse-config-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: matrix-synapse-config-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: oidc.yaml
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/matrix-synapse/config
-        metadataPolicy: None
-        property: oidc.yaml
-    - secretKey: config.yaml
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/matrix-synapse/config
-        metadataPolicy: None
-        property: config.yaml
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: matrix-hookshot-config-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: matrix-hookshot-config-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: config.yml
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/matrix-synapse/hookshot
-        metadataPolicy: None
-        property: config
-    - secretKey: registration.yml
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/matrix-synapse/hookshot
-        metadataPolicy: None
-        property: registration
-    - secretKey: hookshot-registration.yaml
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/matrix-synapse/hookshot
-        metadataPolicy: None
-        property: registration
-    - secretKey: passkey.pem
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/matrix-synapse/hookshot
-        metadataPolicy: None
-        property: passkey
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: mautrix-discord-config-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: mautrix-discord-config-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: config.yaml
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/matrix-synapse/mautrix-discord
-        metadataPolicy: None
-        property: config
-    - secretKey: mautrix-discord-registration.yaml
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/matrix-synapse/mautrix-discord
-        metadataPolicy: None
-        property: registration
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: mautrix-whatsapp-config-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: mautrix-whatsapp-config-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: config.yaml
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/matrix-synapse/mautrix-whatsapp
-        metadataPolicy: None
-        property: config
-    - secretKey: mautrix-whatsapp-registration.yaml
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/matrix-synapse/mautrix-whatsapp
-        metadataPolicy: None
-        property: registration
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: double-puppet-registration-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: double-puppet-registration-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: double-puppet-registration.yaml
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/matrix-synapse/doublepuppet
-        metadataPolicy: None
-        property: registration
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: matrix-synapse-redis-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: matrix-synapse-redis-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: password
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/matrix-synapse/redis
-        metadataPolicy: None
-        property: password
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: matrix-synapse-cloudflared-synapse-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: matrix-synapse-cloudflared-synapse-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: cf-tunnel-token
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cloudflare/tunnels/matrix-synapse
-        metadataPolicy: None
-        property: token
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: matrix-synapse-cloudflared-hookshot-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: matrix-synapse-cloudflared-hookshot-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: cf-tunnel-token
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cloudflare/tunnels/matrix-hookshot
-        metadataPolicy: None
-        property: token
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: matrix-synapse-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: matrix-synapse-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: backup
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/matrix-synapse/matrix-synapse"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: S3_BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: access_key
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: secret_key
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: mautrix-discord-data-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: mautrix-discord-data-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: backup
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/matrix-synapse/mautrix-discord-data"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: S3_BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: access_key
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: secret_key
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: mautrix-whatsapp-data-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: mautrix-whatsapp-data-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: backup
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/matrix-synapse/mautrix-whatsapp-data"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: S3_BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: access_key
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: secret_key
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: matrix-synapse-postgresql-17-cluster-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: matrix-synapse-postgresql-17-cluster-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: database
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
-        property: access
-    - secretKey: ACCESS_SECRET_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
-        property: secret

clusters/cl01tl/platform/matrix-synapse/templates/replication-source.yaml

@@ -1,91 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: matrix-synapse-backup-source
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: matrix-synapse-backup-source
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: backup
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  sourcePVC: matrix-synapse
-  trigger:
-    schedule: 0 0 */3 * *
-  restic:
-    pruneIntervalDays: 14
-    repository: matrix-synapse-backup-secret
-    retain:
-      hourly: 1
-      daily: 1
-      weekly: 1
-      monthly: 2
-      yearly: 4
-    copyMethod: Snapshot
-    storageClassName: ceph-block-delete
-    volumeSnapshotClassName: ceph-blockpool-snapshot
-
----
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: mautrix-discord-data-backup-source
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: mautrix-discord-data-backup-source
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: backup
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  sourcePVC: mautrix-discord-data
-  trigger:
-    schedule: 0 0 */3 * *
-  restic:
-    pruneIntervalDays: 14
-    repository: mautrix-discord-data-backup-secret
-    retain:
-      hourly: 1
-      daily: 1
-      weekly: 1
-      monthly: 2
-      yearly: 4
-    moverSecurityContext:
-      runAsUser: 1337
-      runAsGroup: 1337
-    copyMethod: Snapshot
-    storageClassName: ceph-block-delete
-    volumeSnapshotClassName: ceph-blockpool-snapshot
-
----
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: mautrix-whatsapp-data-backup-source
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: mautrix-whatsapp-data-backup-source
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: backup
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  sourcePVC: mautrix-whatsapp-data
-  trigger:
-    schedule: 0 0 */3 * *
-  restic:
-    pruneIntervalDays: 14
-    repository: mautrix-whatsapp-data-backup-secret
-    retain:
-      hourly: 1
-      daily: 1
-      weekly: 1
-      monthly: 2
-      yearly: 4
-    moverSecurityContext:
-      runAsUser: 1337
-      runAsGroup: 1337
-    copyMethod: Snapshot
-    storageClassName: ceph-block-delete
-    volumeSnapshotClassName: ceph-blockpool-snapshot

clusters/cl01tl/platform/matrix-synapse/templates/service-monitor.yaml

@@ -1,44 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: matrix-synapse
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: matrix-synapse
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: metrics
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: matrix-synapse
-      app.kubernetes.io/instance: {{ .Release.Name }}
-  endpoints:
-    - targetPort: 9090
-      interval: 3m
-      scrapeTimeout: 1m
-      path: /_synapse/metrics
-
----
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: matrix-hookshot
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: matrix-hookshot
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: metrics
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: matrix-hookshot
-      app.kubernetes.io/instance: {{ .Release.Name }}
-  endpoints:
-    - targetPort: 9001
-      interval: 3m
-      scrapeTimeout: 1m
-      path: /metrics

clusters/cl01tl/platform/matrix-synapse/values.yaml

@@ -1,342 +0,0 @@
-matrix-synapse:
-  serverName: alexlebens.dev
-  publicServerName: matrix.alexlebens.dev
-  argoCD: true
-  signingkey:
-    job:
-      enabled: false
-  config:
-    reportStats: false
-    enableRegistration: true
-    trustedKeyServers: []
-  extraConfig:
-    enable_metrics: true
-    enable_registration_without_verification: false
-    password_config:
-      enabled: false
-    sso:
-      client_whitelist:
-        - https://chat.alexlebens.dev/
-      update_profile_information: true
-  synapse:
-    strategy:
-      type: Recreate
-    extraVolumes:
-      - name: matrix-synapse-config-secret
-        secret:
-          secretName: matrix-synapse-config-secret
-      - name: matrix-hookshot-config-secret
-        secret:
-          secretName: matrix-hookshot-config-secret
-      - name: mautrix-discord-config-secret
-        secret:
-          secretName: mautrix-discord-config-secret
-      - name: mautrix-whatsapp-config-secret
-        secret:
-          secretName: mautrix-whatsapp-config-secret
-      - name: double-puppet-registration-secret
-        secret:
-          secretName: double-puppet-registration-secret
-    extraVolumeMounts:
-      - name: matrix-synapse-config-secret
-        mountPath: /synapse/config/conf.d/oidc.yaml
-        subPath: oidc.yaml
-        readOnly: true
-      - name: matrix-synapse-config-secret
-        mountPath: /synapse/config/conf.d/config.yaml
-        subPath: config.yaml
-        readOnly: true
-      - name: matrix-hookshot-config-secret
-        mountPath: /synapse/config/conf.d/hookshot-registration.yaml
-        subPath: hookshot-registration.yaml
-        readOnly: true
-      - name: mautrix-discord-config-secret
-        mountPath: /synapse/config/conf.d/mautrix-discord-registration.yaml
-        subPath: mautrix-discord-registration.yaml
-        readOnly: true
-      - name: mautrix-whatsapp-config-secret
-        mountPath: /synapse/config/conf.d/mautrix-whatsapp-registration.yaml
-        subPath: mautrix-whatsapp-registration.yaml
-        readOnly: true
-      - name: double-puppet-registration-secret
-        mountPath: /synapse/config/conf.d/double-puppet-registration.yaml
-        subPath: double-puppet-registration.yaml
-        readOnly: true
-    resources:
-      requests:
-        cpu: 10m
-        memory: 128Mi
-  workers:
-    default:
-      replicaCount: 0
-    generic_worker:
-      enabled: false
-    pusher:
-      enabled: false
-    appservice:
-      enabled: false
-    federation_sender:
-      enabled: false
-    media_repository:
-      enabled: false
-    user_dir:
-      enabled: false
-  wellknown:
-    enabled: true
-    server:
-      m.server: matrix.alexlebens.dev:443
-    client:
-      m.homeserver:
-        base_url: https://matrix.alexlebens.dev
-  postgresql:
-    enabled: false
-  externalPostgresql:
-    host: matrix-synapse-postgresql-17-cluster-rw
-    port: 5432
-    username: app
-    database: app
-    existingSecret: matrix-synapse-postgresql-17-cluster-app
-    existingSecretPasswordKey: password
-  redis:
-    enabled: false
-  externalRedis:
-    host: matrix-synapse-valkey-primary
-    port: 6379
-    existingSecret: matrix-synapse-redis-secret
-    existingSecretPasswordKey: password
-  persistence:
-    enabled: true
-    storageClass: ceph-block
-    accessMode: ReadWriteOnce
-    size: 10Gi
-  volumePermissions:
-    enabled: true
-    uid: 666
-    gid: 666
-  ingress:
-    enabled: false
-matrix-hookshot:
-  global:
-    fullnameOverride: matrix-hookshot
-  controllers:
-    main:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      containers:
-        main:
-          image:
-            repository: halfshot/matrix-hookshot
-            tag: 6.0.2
-            pullPolicy: IfNotPresent
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
-  serviceAccount:
-    create: true
-  service:
-    main:
-      controller: main
-      ports:
-        webhook:
-          port: 9000
-          targetPort: 9000
-          protocol: HTTP
-        metrics:
-          port: 9001
-          targetPort: 9001
-          protocol: HTTP
-        appservice:
-          port: 9002
-          targetPort: 9002
-          protocol: HTTP
-        homeserver:
-          port: 9993
-          targetPort: 9993
-          protocol: HTTP
-  persistence:
-    config:
-      enabled: true
-      type: secret
-      name: matrix-hookshot-config-secret
-      advancedMounts:
-        main:
-          main:
-            - path: /data/config.yml
-              readOnly: true
-              mountPropagation: None
-              subPath: config.yml
-    registration:
-      enabled: true
-      type: secret
-      name: matrix-hookshot-config-secret
-      advancedMounts:
-        main:
-          main:
-            - path: /data/registration.yml
-              readOnly: true
-              mountPropagation: None
-              subPath: registration.yml
-    passkey:
-      enabled: true
-      type: secret
-      name: matrix-hookshot-config-secret
-      advancedMounts:
-        main:
-          main:
-            - path: /data/passkey.pem
-              readOnly: true
-              mountPropagation: None
-              subPath: passkey.pem
-mautrix-discord:
-  global:
-    fullnameOverride: mautrix-discord
-  controllers:
-    main:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      containers:
-        main:
-          image:
-            repository: dock.mau.dev/mautrix/discord
-            tag: v0.7.2
-            pullPolicy: IfNotPresent
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
-  serviceAccount:
-    create: true
-  service:
-    main:
-      controller: main
-      ports:
-        http:
-          port: 29334
-          targetPort: 29334
-          protocol: HTTP
-  persistence:
-    data:
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 500Mi
-      retain: true
-      advancedMounts:
-        main:
-          main:
-            - path: /data
-              readOnly: false
-    config:
-      enabled: true
-      type: secret
-      name: mautrix-discord-config-secret
-      advancedMounts:
-        main:
-          main:
-            - path: /data/config.yaml
-              readOnly: true
-              mountPropagation: None
-              subPath: config.yaml
-mautrix-whatsapp:
-  global:
-    fullnameOverride: mautrix-whatsapp
-  controllers:
-    main:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      containers:
-        main:
-          image:
-            repository: dock.mau.dev/mautrix/whatsapp
-            tag: v0.11.2
-            pullPolicy: IfNotPresent
-          resources:
-            requests:
-              cpu: 10m
-              memory: 64Mi
-  serviceAccount:
-    create: true
-  service:
-    main:
-      controller: main
-      ports:
-        http:
-          port: 29333
-          targetPort: 29333
-          protocol: HTTP
-  persistence:
-    data:
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 500Mi
-      retain: true
-      advancedMounts:
-        main:
-          main:
-            - path: /data
-              readOnly: false
-    config:
-      enabled: true
-      type: secret
-      name: mautrix-whatsapp-config-secret
-      advancedMounts:
-        main:
-          main:
-            - path: /data/config.yaml
-              readOnly: true
-              mountPropagation: None
-              subPath: config.yaml
-valkey-synapse:
-  fullnameOverride: matrix-synapse-valkey
-  architecture: standalone
-  auth:
-    enabled: true
-    existingSecret: matrix-synapse-redis-secret
-    existingSecretPasswordKey: password
-  primary:
-    persistence:
-      enabled: false
-  replica:
-    persistence:
-      enabled: false
-valkey-hookshot:
-  fullnameOverride: matrix-hookshot-valkey
-  architecture: standalone
-  auth:
-    enabled: false
-  primary:
-    persistence:
-      enabled: false
-  replica:
-    persistence:
-      enabled: false
-cloudflared-synapse:
-  name: cloudflared-synapse
-  existingSecretName: matrix-synapse-cloudflared-synapse-secret
-cloudflared-hookshot:
-  name: cloudflared-hookshot
-  existingSecretName: matrix-synapse-cloudflared-hookshot-secret
-postgres-17-cluster:
-  mode: standalone
-  cluster:
-    walStorage:
-      storageClass: local-path
-    storage:
-      storageClass: local-path
-    resources:
-      requests:
-        cpu: 200m
-    monitoring:
-      enabled: true
-  backup:
-    enabled: true
-    endpointURL: https://nyc3.digitaloceanspaces.com
-    destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/matrix-synapse/matrix-synapse-postgresql-17-cluster
-    endpointCredentials: matrix-synapse-postgresql-17-cluster-backup-secret
-    backupIndex: 1

clusters/cl01tl/platform/ollama/Chart.yaml

@@ -1,30 +0,0 @@
-apiVersion: v2
-name: ollama
-version: 1.0.0
-description: Ollama
-keywords:
-  - ollama
-  - ai
-home: https://wiki.alexlebens.dev/doc/ollama-Xmqe6T1P8v
-sources:
-  - https://github.com/ollama/ollama
-  - https://github.com/open-webui/open-webui
-  - https://github.com/ai-dock/stable-diffusion-webui
-  - https://github.com/cloudnative-pg/cloudnative-pg
-  - https://hub.docker.com/r/ollama/ollama
-  - https://github.com/open-webui/open-webui/pkgs/container/open-webui
-  - https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/alexlebens/helm-charts/tree/main/charts/postgres-cluster
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: ollama
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.6.1
-  - name: postgres-cluster
-    alias: postgres-17-cluster
-    version: 4.1.4
-    repository: http://alexlebens.github.io/helm-charts
-icon: https://avatars.githubusercontent.com/u/151674099?s=48&v=4
-appVersion: 0.5.1

clusters/cl01tl/platform/ollama/templates/external-secret.yaml

@@ -1,206 +0,0 @@
-
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: ollama-key-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: ollama-key-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: key
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/ollama/key
-        metadataPolicy: None
-        property: key
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: ollama-oidc-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: ollama-oidc-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: auth
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: client
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /authentik/oidc/ollama
-        metadataPolicy: None
-        property: client
-    - secretKey: secret
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /authentik/oidc/ollama
-        metadataPolicy: None
-        property: secret
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: ollama-root-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: ollama-root-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: backup
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/ollama/ollama-root"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: S3_BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: access_key
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: secret_key
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: ollama-web-data-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: ollama-web-data-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: backup
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/ollama/ollama-web"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: S3_BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: access_key
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: secret_key
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: ollama-web-postgresql-17-cluster-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: ollama-web-postgresql-17-cluster-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: database
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
-        property: access
-    - secretKey: ACCESS_SECRET_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
-        property: secret

clusters/cl01tl/platform/ollama/templates/replication-source.yaml

@@ -1,59 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: ollama-root-backup-source
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: ollama-root-backup-source
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: backup
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  sourcePVC: ollama-root
-  trigger:
-    schedule: 0 0 */3 * *
-  restic:
-    pruneIntervalDays: 14
-    repository: ollama-root-backup-secret
-    retain:
-      hourly: 1
-      daily: 1
-      weekly: 1
-      monthly: 2
-      yearly: 4
-    copyMethod: Snapshot
-    storageClassName: ceph-block-delete
-    volumeSnapshotClassName: ceph-blockpool-snapshot
-
----
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: ollama-web-data-backup-source
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: ollama-web-data-backup-source
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: backup
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  sourcePVC: ollama-web-data
-  trigger:
-    schedule: 0 0 */3 * *
-  restic:
-    pruneIntervalDays: 14
-    repository: ollama-web-data-backup-secret
-    retain:
-      hourly: 1
-      daily: 1
-      weekly: 1
-      monthly: 2
-      yearly: 4
-    moverSecurityContext:
-      runAsUser: 1337
-      runAsGroup: 1337
-    copyMethod: Snapshot
-    storageClassName: ceph-block-delete
-    volumeSnapshotClassName: ceph-blockpool-snapshot

clusters/cl01tl/platform/ollama/templates/service.yaml

@@ -1,34 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: ollama-pd05wd
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: ollama-pd05wd
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: network
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-  annotations:
-    tailscale.com/tailnet-fqdn: ollama-pd05wd.boreal-beaufort.ts.net
-spec:
-  externalName: placeholder
-  type: ExternalName
-
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: stable-diffusion-pd05wd
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: stable-diffusion-pd05wd
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: network
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-  annotations:
-    tailscale.com/tailnet-fqdn: stable-diffusion-pd05wd.boreal-beaufort.ts.net
-spec:
-  externalName: placeholder
-  type: ExternalName

clusters/cl01tl/platform/ollama/values.yaml

@@ -1,274 +0,0 @@
-ollama:
-  controllers:
-    server-1:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      pod:
-        labels:
-          ollama-type: server
-        affinity:
-          podAntiAffinity:
-              requiredDuringSchedulingIgnoredDuringExecution:
-                - labelSelector:
-                    matchExpressions:
-                      - key: ollama-type
-                        operator: In
-                        values:
-                          - server
-                  topologyKey: kubernetes.io/hostname
-      containers:
-        main:
-          image:
-            repository: ollama/ollama
-            tag: 0.5.8
-            pullPolicy: IfNotPresent
-          env:
-            - name: OLLAMA_KEEP_ALIVE
-              value: 24h
-            - name: OLLAMA_HOST
-              value: 0.0.0.0
-          resources:
-            requests:
-              cpu: 100m
-              memory: 1Gi
-              gpu.intel.com/i915: 1
-            limits:
-              cpu: 4
-              gpu.intel.com/i915: 1
-    server-2:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      pod:
-        labels:
-          ollama-type: server
-        affinity:
-          podAntiAffinity:
-              requiredDuringSchedulingIgnoredDuringExecution:
-                - labelSelector:
-                    matchExpressions:
-                      - key: ollama-type
-                        operator: In
-                        values:
-                          - server
-                  topologyKey: kubernetes.io/hostname
-      containers:
-        main:
-          image:
-            repository: ollama/ollama
-            tag: 0.5.8
-            pullPolicy: IfNotPresent
-          env:
-            - name: OLLAMA_KEEP_ALIVE
-              value: 24h
-            - name: OLLAMA_HOST
-              value: 0.0.0.0
-          resources:
-            requests:
-              cpu: 100m
-              memory: 1Gi
-              gpu.intel.com/i915: 1
-            limits:
-              cpu: 4
-              gpu.intel.com/i915: 1
-    server-3:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      pod:
-        labels:
-          ollama-type: server
-        affinity:
-          podAntiAffinity:
-              requiredDuringSchedulingIgnoredDuringExecution:
-                - labelSelector:
-                    matchExpressions:
-                      - key: ollama-type
-                        operator: In
-                        values:
-                          - server
-                  topologyKey: kubernetes.io/hostname
-      containers:
-        main:
-          image:
-            repository: ollama/ollama
-            tag: 0.5.8
-            pullPolicy: IfNotPresent
-          env:
-            - name: OLLAMA_KEEP_ALIVE
-              value: 24h
-            - name: OLLAMA_HOST
-              value: 0.0.0.0
-          resources:
-            requests:
-              cpu: 100m
-              memory: 1Gi
-              gpu.intel.com/i915: 1
-            limits:
-              cpu: 4
-              gpu.intel.com/i915: 1
-    web:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      containers:
-        main:
-          image:
-            repository: ghcr.io/open-webui/open-webui
-            tag: 0.5.10
-            pullPolicy: IfNotPresent
-          env:
-            - name: ENV
-              value: prod
-            - name: WEBUI_AUTH
-              value: true
-            - name: WEBUI_NAME
-              value: Ollama
-            - name: WEBUI_URL
-              value: http://ollama-cl01tl.boreal-beaufort.ts.net
-            - name: ENABLE_LOGIN_FORM
-              value: false
-            - name: DEFAULT_USER_ROLE
-              value: admin
-            - name: WEBUI_SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: ollama-key-secret
-                  key: key
-            - name: DATABASE_URL
-              valueFrom:
-                secretKeyRef:
-                  name: ollama-web-postgresql-17-cluster-app
-                  key: uri
-            - name: OLLAMA_BASE_URL
-              value: http://ollama-server-1.ollama:11434
-            - name: ENABLE_OAUTH_SIGNUP
-              value: true
-            - name: OAUTH_USERNAME_CLAIM
-              value: preferred_username
-            - name: OAUTH_CLIENT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: ollama-oidc-secret
-                  key: secret
-            - name: OAUTH_CLIENT_ID
-              valueFrom:
-                secretKeyRef:
-                  name: ollama-oidc-secret
-                  key: client
-            - name: OAUTH_PROVIDER_NAME
-              value: Authentik
-            - name: OPENID_PROVIDER_URL
-              value: https://auth-cl01tl.boreal-beaufort.ts.net/application/o/ollama-web/.well-known/openid-configuration
-          resources:
-            requests:
-              cpu: 10m
-              memory: 1Gi
-  serviceAccount:
-    create: true
-  service:
-    server-1:
-      controller: server-1
-      ports:
-        http:
-          port: 11434
-          targetPort: 11434
-          protocol: HTTP
-    server-2:
-      controller: server-2
-      ports:
-        http:
-          port: 11434
-          targetPort: 11434
-          protocol: HTTP
-    server-3:
-      controller: server-3
-      ports:
-        http:
-          port: 11434
-          targetPort: 11434
-          protocol: HTTP
-    web:
-      controller: web
-      ports:
-        http:
-          port: 80
-          targetPort: 8080
-          protocol: HTTP
-  ingress:
-    main:
-      className: tailscale
-      hosts:
-        - host: ollama-cl01tl
-          paths:
-            - path: /
-              pathType: Prefix
-              service:
-                name: ollama-web
-                port: 80
-      tls:
-        - secretName: ollama-cl01tl
-          hosts:
-            - ollama-cl01tl
-  persistence:
-    server-1:
-      storageClass: ceph-block-delete
-      accessMode: ReadWriteOnce
-      size: 40Gi
-      retain: true
-      advancedMounts:
-        server-1:
-          main:
-            - path: /root/.ollama
-              readOnly: false
-    server-2:
-      storageClass: ceph-block-delete
-      accessMode: ReadWriteOnce
-      size: 40Gi
-      retain: true
-      advancedMounts:
-        server-2:
-          main:
-            - path: /root/.ollama
-              readOnly: false
-    server-3:
-      storageClass: ceph-block-delete
-      accessMode: ReadWriteOnce
-      size: 40Gi
-      retain: true
-      advancedMounts:
-        server-3:
-          main:
-            - path: /root/.ollama
-              readOnly: false
-    web-data:
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 5Gi
-      retain: true
-      advancedMounts:
-        web:
-          main:
-            - path: /app/backend/data
-              readOnly: false
-postgres-17-cluster:
-  nameOverride: ollama-web-postgresql-17
-  mode: standalone
-  cluster:
-    walStorage:
-      storageClass: local-path
-    storage:
-      storageClass: local-path
-    monitoring:
-      enabled: true
-  backup:
-    enabled: true
-    endpointURL: https://nyc3.digitaloceanspaces.com
-    destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/ollama/ollama-web-postgresql-17-cluster
-    endpointCredentials: ollama-web-postgresql-17-cluster-backup-secret
-    backupIndex: 1

clusters/cl01tl/platform/qbittorrent/Chart.yaml

@@ -1,28 +0,0 @@
-apiVersion: v2
-name: qbittorrent
-version: 1.0.0
-description: qBittorrent
-keywords:
-  - qbittorrent
-  - downloads
-  - torrent
-  - vpn
-  - metrics
-home: https://wiki.alexlebens.dev/doc/qbittorrent-5jBMHjtzCZ
-sources:
-  - https://github.com/qbittorrent/qBittorrent
-  - https://github.com/qdm12/gluetun
-  - https://github.com/esanchezm/prometheus-qbittorrent-exporter
-  - https://docs.linuxserver.io/images/docker-qbittorrent/
-  - https://github.com/qdm12/gluetun/pkgs/container/gluetun
-  - https://hub.docker.com/r/esanchezm/prometheus-qbittorrent-exporter
-  - https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: qbittorrent
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.6.1
-icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/qbittorrent.png
-appVersion: 5.0.2

clusters/cl01tl/platform/qbittorrent/templates/config-map.yaml

@@ -1,20 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: glutun-update-script
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: glutun-update-script
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: gluetun
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-data:
-  update.sh: |
-    if ! command -v curl 2>&1 >/dev/null
-    then
-        echo "curl could not be found, installing";
-        apk add curl;
-    fi;
-    echo "updating port with $1";
-    curl -i -X POST -d "json={\"listen_port\": \"${1}\"}" "http://localhost:8080/api/v2/app/setPreferences";

clusters/cl01tl/platform/qbittorrent/templates/external-secret.yaml

@@ -1,48 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: qbittorrent-auth
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: qbittorrent-auth
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: admin-password
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/qbittorrent/auth
-        metadataPolicy: None
-        property: admin-password
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: qbittorrent-wireguard-conf
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: qbittorrent-wireguard-conf
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: private-key
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/qbittorrent/config
-        metadataPolicy: None
-        property: private-key

clusters/cl01tl/platform/qbittorrent/templates/persistent-volume-claim.yaml

@@ -1,40 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: qbittorrent-config
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: qbittorrent-config
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: storage
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  volumeName: qbittorrent-config
-  storageClassName: nfs-client
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi
-
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: qbittorrent-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ .Release.Name }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: storage
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  volumeName: qbittorrent-nfs-storage
-  storageClassName: nfs-client
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi

clusters/cl01tl/platform/qbittorrent/templates/persistent-volume.yaml

@@ -1,52 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: qbittorrent-config
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: qbittorrent-config
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: storage
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: nfs-client
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteMany
-  nfs:
-    path: /volume2/Storage/Torrent/QBITTORRENT
-    server: synologybond.alexlebens.net
-  mountOptions:
-    - vers=4
-    - minorversion=1
-    - noac
-
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: qbittorrent-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: qbittorrent-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: storage
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: nfs-client
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteMany
-  nfs:
-    path: /volume2/Storage
-    server: synologybond.alexlebens.net
-  mountOptions:
-    - vers=4
-    - minorversion=1
-    - noac

clusters/cl01tl/platform/qbittorrent/templates/service-monitor.yaml

@@ -1,21 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: qbittorrent
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: qbittorrent
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  endpoints:
-    - port: metrics
-      interval: 30s
-      scrapeTimeout: 15s
-      path: /metrics
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: qbittorrent
-      app.kubernetes.io/instance: {{ .Release.Name }}

clusters/cl01tl/platform/qbittorrent/values.yaml

@@ -1,164 +0,0 @@
-qbittorrent:
-  controllers:
-    main:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      initContainers:
-        init-sysctl:
-          image:
-            repository: busybox
-            tag: 1.37.0
-            pullPolicy: IfNotPresent
-          securityContext:
-            privileged: True
-          resources:
-            requests:
-              cpu: 100m
-              memory: 128Mi
-          command:
-            - /bin/sh
-          args:
-            - -ec
-            - |
-              sysctl -w net.ipv4.ip_forward=1;
-              sysctl -w net.ipv6.conf.all.disable_ipv6=1
-      containers:
-        qbittorrent:
-          image:
-            repository: ghcr.io/linuxserver/qbittorrent
-            tag: 5.0.2@sha256:00360a0160872bffeaea5e232acfdb086063be5f03e0cba48b129b7087cb7ba1
-            pullPolicy: IfNotPresent
-          env:
-            - name: TZ
-              value: US/Central
-            - name: PUID
-              value: "1000"
-            - name: PGID
-              value: "1000"
-            - name: UMASK_SET
-              value: "002"
-            - name: WEBUI_PORT
-              value: 8080
-          resources:
-            requests:
-              cpu: 500m
-              memory: 1Gi
-        gluetun:
-          image:
-            repository: ghcr.io/qdm12/gluetun
-            tag: v3.40.0@sha256:2b42bfa046757145a5155acece417b65b4443c8033fb88661a8e9dcf7fda5a00
-            pullPolicy: IfNotPresent
-          env:
-            - name: VPN_SERVICE_PROVIDER
-              value: protonvpn
-            - name: VPN_TYPE
-              value: wireguard
-            - name: WIREGUARD_PRIVATE_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: qbittorrent-wireguard-conf
-                  key: private-key
-            - name: VPN_PORT_FORWARDING
-              value: "on"
-            - name: VPN_PORT_FORWARDING_UP_COMMAND
-              value: '/bin/sh -c "/gluetun/update.sh {{ printf "{{PORTS}}" }}"'
-            - name: PORT_FORWARD_ONLY
-              value: "on"
-            - name: FIREWALL_OUTBOUND_SUBNETS
-              value: 192.168.1.0/24,10.244.0.0/16
-            - name: FIREWALL_INPUT_PORTS
-              value: 8080,9022
-            - name: DOT
-              value: "off"
-          securityContext:
-            privileged: True
-            capabilities:
-              add:
-                - NET_ADMIN
-                - SYS_MODULE
-          resources:
-            limits:
-              squat.ai/tun: "1"
-            requests:
-              cpu: 10m
-              memory: 64Mi
-        exporter:
-          image:
-            repository: esanchezm/prometheus-qbittorrent-exporter
-            tag: v1.6.0
-            pullPolicy: IfNotPresent
-          env:
-            - name: QBITTORRENT_HOST
-              value: localhost
-            - name: QBITTORRENT_PORT
-              value: "8080"
-            - name: EXPORTER_PORT
-              value: "9022"
-            - name: EXPORTER_LOG_LEVEL
-              value: INFO
-          resources:
-            requests:
-              cpu: 10m
-              memory: 64Mi
-  serviceAccount:
-    create: true
-  service:
-    main:
-      controller: main
-      ports:
-        http:
-          port: 8080
-          targetPort: 8080
-          protocol: HTTP
-        health:
-          port: 9999
-          targetPort: 9999
-          protocol: HTTP
-        metrics:
-          port: 9022
-          targetPort: 9022
-          protocol: HTTP
-  ingress:
-    tailscale:
-      enabled: true
-      className: tailscale
-      hosts:
-        - host: qbittorrent-cl01tl
-          paths:
-            - path: /
-              pathType: Prefix
-              service:
-                name: qbittorrent
-                port: 8080
-      tls:
-        - hosts:
-            - qbittorrent-cl01tl
-  persistence:
-    config:
-      type: persistentVolumeClaim
-      existingClaim: qbittorrent-config
-      advancedMounts:
-        main:
-          qbittorrent:
-            - path: /config
-              readOnly: false
-    update-script:
-      enabled: true
-      type: configMap
-      name: glutun-update-script
-      defaultMode: 0755
-      advancedMounts:
-        main:
-          gluetun:
-            - path: /gluetun/update.sh
-              subPath: update.sh
-    storage:
-      type: persistentVolumeClaim
-      existingClaim: qbittorrent-nfs-storage
-      advancedMounts:
-        main:
-          qbittorrent:
-            - path: /mnt/store
-              readOnly: false

clusters/cl01tl/platform/stalwart/Chart.yaml

@@ -1,40 +0,0 @@
-apiVersion: v2
-name: stalwart
-version: 1.0.0
-description: Stalwart
-keywords:
-  - stalwart
-  - email
-  - smtp
-home: https://wiki.alexlebens.dev/doc/stalwart-mail-server-RxyiB7jWwR
-sources:
-  - https://github.com/stalwartlabs/mail-server
-  - https://github.com/minio/operator
-  - https://github.com/valkey-io/valkey
-  - https://github.com/elastic/elasticsearch
-  - https://github.com/cloudnative-pg/cloudnative-pg
-  - https://hub.docker.com/r/stalwartlabs/mail-server
-  - https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/minio/operator/tree/master/helm/tenant
-  - https://github.com/bitnami/charts/tree/main/bitnami/valkey
-  - https://github.com/bitnami/charts/tree/main/bitnami/elasticsearch
-  - https://github.com/alexlebens/helm-charts/tree/main/charts/postgres-cluster
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: stalwart
-    version: 3.6.1
-    repository: https://bjw-s.github.io/helm-charts/
-  - name: valkey
-    version: 2.2.3
-    repository: https://charts.bitnami.com/bitnami
-  - name: elasticsearch
-    version: 21.4.5
-    repository: https://charts.bitnami.com/bitnami
-  - name: postgres-cluster
-    alias: postgres-17-cluster
-    version: 4.1.4
-    repository: http://alexlebens.github.io/helm-charts
-icon: https://raw.githubusercontent.com/stalwartlabs/website/main/static/img/logo.png
-appVersion: v0.10.7

clusters/cl01tl/platform/stalwart/templates/external-secret.yaml

@@ -1,114 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: stalwart-elasticsearch-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ .Release.Name }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: ELASTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/stalwart/config
-        metadataPolicy: None
-        property: ELASTIC_PASSWORD
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: stalwart-config-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: stalwart-config-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: backup
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/stalwart/stalwart-config"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: S3_BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: access_key
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: secret_key
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: stalwart-postgresql-17-cluster-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: stalwart-postgresql-17-cluster-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: database
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
-        property: access
-    - secretKey: ACCESS_SECRET_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
-        property: secret

clusters/cl01tl/platform/stalwart/templates/replication-source.yaml

@@ -1,27 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: stalwart-config-backup-source
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: stalwart-config-backup-source
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: backup
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  sourcePVC: stalwart-config
-  trigger:
-    schedule: 0 0 */3 * *
-  restic:
-    pruneIntervalDays: 14
-    repository: stalwart-config-backup-secret
-    retain:
-      hourly: 1
-      daily: 1
-      weekly: 1
-      monthly: 2
-      yearly: 4
-    copyMethod: Snapshot
-    storageClassName: ceph-block-delete
-    volumeSnapshotClassName: ceph-blockpool-snapshot

clusters/cl01tl/platform/stalwart/values.yaml

@@ -1,113 +0,0 @@
-stalwart:
-  controllers:
-    main:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      containers:
-        main:
-          image:
-            repository: stalwartlabs/mail-server
-            tag: v0.11.6
-            pullPolicy: IfNotPresent
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
-  serviceAccount:
-    create: true
-  service:
-    main:
-      controller: main
-      ports:
-        http:
-          port: 80
-          targetPort: 8080
-          protocol: HTTP
-        smtp:
-          port: 25
-          targetPort: 25
-          protocol: TCP
-        smtps:
-          port: 465
-          targetPort: 465
-          protocol: TCP
-        imap:
-          port: 143
-          targetPort: 143
-          protocol: TCP
-        imaps:
-          port: 993
-          targetPort: 993
-          protocol: TCP
-  ingress:
-    main:
-      className: tailscale
-      hosts:
-        - host: stalwart-cl01tl
-          paths:
-            - path: /
-              pathType: Prefix
-              service:
-                name: stalwart
-                port: 80
-      tls:
-        - secretName: stalwart-cl01tl
-          hosts:
-            - stalwart-cl01tl
-  persistence:
-    config:
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 10Gi
-      retain: true
-      advancedMounts:
-        main:
-          main:
-            - path: /opt/stalwart-mail
-              readOnly: false
-valkey:
-  architecture: standalone
-  auth:
-    enabled: false
-  primary:
-    persistence:
-      enabled: false
-  replica:
-    persistence:
-      enabled: false
-elasticsearch:
-  global:
-    storageClass: ceph-block
-  extraEnvVars:
-    - name: discovery.type
-      value: single-node
-    - name: xpack.security.enabled
-      value: "true"
-  extraEnvVarsSecret: stalwart-elasticsearch-secret
-  master:
-    masterOnly: false
-    replicaCount: 1
-  data:
-    replicaCount: 0
-  coordinating:
-    replicaCount: 0
-  ingest:
-    enabled: false
-    replicaCount: 0
-postgres-17-cluster:
-  mode: standalone
-  cluster:
-    walStorage:
-      storageClass: local-path
-    storage:
-      storageClass: local-path
-    monitoring:
-      enabled: true
-  backup:
-    enabled: true
-    endpointURL: https://nyc3.digitaloceanspaces.com
-    destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/stalwart/stalwart-postgresql-17-cluster
-    endpointCredentials: stalwart-postgresql-17-cluster-backup-secret
-    backupIndex: 1

clusters/cl01tl/platform/unpackerr/Chart.yaml

@@ -1,22 +0,0 @@
-apiVersion: v2
-name: unpackerr
-version: 1.0.0
-description: Unpackerr
-keywords:
-  - unpackerr
-  - archive
-  - servarr
-home: https://wiki.alexlebens.dev/doc/unpackerr-ZCcVdSxo4s
-sources:
-  - https://github.com/Unpackerr/unpackerr
-  - https://hub.docker.com/r/golift/unpackerr
-  - https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: unpackerr
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.6.1
-icon: https://avatars.githubusercontent.com/u/104323643?s=48&v=4
-appVersion: 0.14.5

clusters/cl01tl/platform/unpackerr/templates/external-secret.yaml

@@ -1,72 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: unpackerr-key-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: unpackerr-key-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: UN_SONARR_0_API_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/sonarr4/key
-        metadataPolicy: None
-        property: key
-    - secretKey: UN_SONARR_1_API_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/sonarr4-4k/key
-        metadataPolicy: None
-        property: key
-    - secretKey: UN_SONARR_2_API_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/sonarr4-anime/key
-        metadataPolicy: None
-        property: key
-    - secretKey: UN_RADARR_0_API_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/radarr5/key
-        metadataPolicy: None
-        property: key
-    - secretKey: UN_RADARR_1_API_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/radarr5-4k/key
-        metadataPolicy: None
-        property: key
-    - secretKey: UN_RADARR_2_API_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/radarr5-anime/key
-        metadataPolicy: None
-        property: key
-    - secretKey: UN_RADARR_3_API_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/radarr5-standup/key
-        metadataPolicy: None
-        property: key
-    - secretKey: UN_LIDARR_0_API_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/lidarr2/key
-        metadataPolicy: None
-        property: key

clusters/cl01tl/platform/unpackerr/templates/persistent-volume-claim.yaml

@@ -1,19 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: unpackerr-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: unpackerr-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: storage
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  volumeName: unpackerr-nfs-storage
-  storageClassName: nfs-client
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi

clusters/cl01tl/platform/unpackerr/templates/persistent-volume.yaml

@@ -1,25 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: unpackerr-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: unpackerr-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: storage
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: nfs-client
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteMany
-  nfs:
-    path: /volume2/Storage
-    server: synologybond.alexlebens.net
-  mountOptions:
-    - vers=4
-    - minorversion=1
-    - noac

clusters/cl01tl/platform/unpackerr/values.yaml

@@ -1,67 +0,0 @@
-unpackerr:
-  controllers:
-    main:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      containers:
-        main:
-          image:
-            repository: golift/unpackerr
-            tag: 0.14.5
-            pullPolicy: IfNotPresent
-          env:
-            - name: TZ
-              value: US/Central
-            - name: UN_WEBSERVER_METRICS
-              value: true
-            - name: UN_SONARR_0_URL
-              value: http://sonarr4.sonarr4:80
-            - name: UN_SONARR_0_PATHS_0
-              value: /mnt/store/Torrent/FINISHED/COMPLETED
-            - name: UN_SONARR_1_URL
-              value: http://sonarr4-4k.sonarr4-4k:80
-            - name: UN_SONARR_1_PATHS_0
-              value: /mnt/store/Torrent/FINISHED/COMPLETED
-            - name: UN_SONARR_2_URL
-              value: http://sonarr4-anime.sonarr4-anime:80
-            - name: UN_SONARR_2_PATHS_0
-              value: /mnt/store/Torrent/FINISHED/COMPLETED
-            - name: UN_RADARR_0_URL
-              value: http://radarr5.radarr5:80
-            - name: UN_RADARR_0_PATHS_0
-              value: /mnt/store/Torrent/FINISHED/COMPLETED
-            - name: UN_RADARR_1_URL
-              value: http://radarr5-4k.radarr5-4k:80
-            - name: UN_RADARR_1_PATHS_0
-              value: /mnt/store/Torrent/FINISHED/COMPLETED
-            - name: UN_RADARR_2_URL
-              value: http://radarr5-anime.radarr5-anime:80
-            - name: UN_RADARR_2_PATHS_0
-              value: /mnt/store/Torrent/FINISHED/COMPLETED
-            - name: UN_RADARR_3_URL
-              value: http://radarr5-standup.radarr5-standup:80
-            - name: UN_RADARR_3_PATHS_0
-              value: /mnt/store/Torrent/FINISHED/COMPLETED
-            - name: UN_LIDARR_0_URL
-              value: http://lidarr2.lidarr2:80
-            - name: UN_LIDARR_0_PATHS_0
-              value: /mnt/store/Torrent/FINISHED/COMPLETED
-          envFrom:
-            - secretRef:
-                name: unpackerr-key-secret
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
-  serviceAccount:
-    create: true
-  persistence:
-    storage:
-      existingClaim: unpackerr-nfs-storage
-      advancedMounts:
-        main:
-          main:
-            - path: /mnt/store
-              readOnly: false

clusters/cl01tl/platform/vault/Chart.yaml

@@ -1,28 +0,0 @@
-apiVersion: v2
-name: vault
-version: 1.0.0
-description: Vault
-keywords:
-  - vault
-  - secrets
-home: https://wiki.alexlebens.dev/doc/vault-TJ1ocQp9WB
-sources:
-  - https://github.com/hashicorp/vault
-  - https://hub.docker.com/r/hashicorp/vault
-  - https://github.com/hashicorp/vault-helm
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: vault
-    version: 0.29.1
-    repository: https://helm.releases.hashicorp.com
-  - name: app-template
-    alias: snapshot
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.6.1
-  - name: app-template
-    alias: unseal
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.6.1
-icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/vault.png
-appVersion: 1.18.2

clusters/cl01tl/platform/vault/templates/external-secret.yaml

@@ -1,379 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: vault-snapshot-agent-token
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: vault-snapshot-agent-token
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: snapshot
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: VAULT_APPROLE_ROLE_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/vault/snapshot/approle
-        metadataPolicy: None
-        property: role-id
-    - secretKey: VAULT_APPROLE_SECRET_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/vault/snapshot/approle
-        metadataPolicy: None
-        property: secret-id
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: vault-snapshot-s3
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: vault-snapshot-s3
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: snapshot
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/vault-backup
-        metadataPolicy: None
-        property: AWS_ACCESS_KEY_ID
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/vault-backup
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ENDPOINT_URL
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/vault-backup
-        metadataPolicy: None
-        property: AWS_ENDPOINT_URL
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/vault-backup
-        metadataPolicy: None
-        property: AWS_SECRET_ACCESS_KEY
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: vault-unseal-config-1
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: vault-unseal-key-1
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: unseal
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: ENVIRONMENT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/vault/unseal/config-1
-        metadataPolicy: None
-        property: ENVIRONMENT
-    - secretKey: CHECK_INTERVAL
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/vault/unseal/config-1
-        metadataPolicy: None
-        property: CHECK_INTERVAL
-    - secretKey: MAX_CHECK_INTERVAL
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/vault/unseal/config-1
-        metadataPolicy: None
-        property: MAX_CHECK_INTERVAL
-    - secretKey: NODES
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/vault/unseal/config-1
-        metadataPolicy: None
-        property: NODES
-    - secretKey: TLS_SKIP_VERIFY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/vault/unseal/config-1
-        metadataPolicy: None
-        property: TLS_SKIP_VERIFY
-    - secretKey: TOKENS
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/vault/unseal/config-1
-        metadataPolicy: None
-        property: TOKENS
-    - secretKey: EMAIL_ENABLED
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/vault/unseal/config-1
-        metadataPolicy: None
-        property: EMAIL_ENABLED
-    - secretKey: NOTIFY_MAX_ELAPSED
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/vault/unseal/config-1
-        metadataPolicy: None
-        property: NOTIFY_MAX_ELAPSED
-    - secretKey: NOTIFY_QUEUE_DELAY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/vault/unseal/config-1
-        metadataPolicy: None
-        property: NOTIFY_QUEUE_DELAY
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: vault-unseal-config-2
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: vault-unseal-key-2
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: unseal
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: ENVIRONMENT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/vault/unseal/config-2
-        metadataPolicy: None
-        property: ENVIRONMENT
-    - secretKey: CHECK_INTERVAL
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/vault/unseal/config-2
-        metadataPolicy: None
-        property: CHECK_INTERVAL
-    - secretKey: MAX_CHECK_INTERVAL
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/vault/unseal/config-2
-        metadataPolicy: None
-        property: MAX_CHECK_INTERVAL
-    - secretKey: NODES
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/vault/unseal/config-2
-        metadataPolicy: None
-        property: NODES
-    - secretKey: TLS_SKIP_VERIFY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/vault/unseal/config-2
-        metadataPolicy: None
-        property: TLS_SKIP_VERIFY
-    - secretKey: TOKENS
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/vault/unseal/config-2
-        metadataPolicy: None
-        property: TOKENS
-    - secretKey: EMAIL_ENABLED
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/vault/unseal/config-2
-        metadataPolicy: None
-        property: EMAIL_ENABLED
-    - secretKey: NOTIFY_MAX_ELAPSED
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/vault/unseal/config-2
-        metadataPolicy: None
-        property: NOTIFY_MAX_ELAPSED
-    - secretKey: NOTIFY_QUEUE_DELAY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/vault/unseal/config-2
-        metadataPolicy: None
-        property: NOTIFY_QUEUE_DELAY
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: vault-unseal-config-3
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: vault-unseal-config-3
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: unseal
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: ENVIRONMENT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/vault/unseal/config-3
-        metadataPolicy: None
-        property: ENVIRONMENT
-    - secretKey: CHECK_INTERVAL
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/vault/unseal/config-3
-        metadataPolicy: None
-        property: CHECK_INTERVAL
-    - secretKey: MAX_CHECK_INTERVAL
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/vault/unseal/config-3
-        metadataPolicy: None
-        property: MAX_CHECK_INTERVAL
-    - secretKey: NODES
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/vault/unseal/config-3
-        metadataPolicy: None
-        property: NODES
-    - secretKey: TLS_SKIP_VERIFY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/vault/unseal/config-3
-        metadataPolicy: None
-        property: TLS_SKIP_VERIFY
-    - secretKey: TOKENS
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/vault/unseal/config-3
-        metadataPolicy: None
-        property: TOKENS
-    - secretKey: EMAIL_ENABLED
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/vault/unseal/config-3
-        metadataPolicy: None
-        property: EMAIL_ENABLED
-    - secretKey: NOTIFY_MAX_ELAPSED
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/vault/unseal/config-3
-        metadataPolicy: None
-        property: NOTIFY_MAX_ELAPSED
-    - secretKey: NOTIFY_QUEUE_DELAY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/vault/unseal/config-3
-        metadataPolicy: None
-        property: NOTIFY_QUEUE_DELAY
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: vault-token
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: vault-token
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: token
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: token
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/vault/token
-        metadataPolicy: None
-        property: token
-    - secretKey: unseal_key_1
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/vault/token
-        metadataPolicy: None
-        property: unseal_key_1
-    - secretKey: unseal_key_2
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/vault/token
-        metadataPolicy: None
-        property: unseal_key_2
-    - secretKey: unseal_key_3
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/vault/token
-        metadataPolicy: None
-        property: unseal_key_3
-    - secretKey: unseal_key_4
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/vault/token
-        metadataPolicy: None
-        property: unseal_key_4
-    - secretKey: unseal_key_5
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/vault/token
-        metadataPolicy: None
-        property: unseal_key_5

clusters/cl01tl/platform/vault/templates/ingress.yaml

@@ -1,32 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: vault-local
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: vault-local
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-  annotations:
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
-    traefik.ingress.kubernetes.io/router.tls: "true"
-    cert-manager.io/cluster-issuer: letsencrypt-issuer
-spec:
-  ingressClassName: traefik
-  tls:
-    - hosts:
-        - vault.alexlebens.net
-      secretName: vault-tls-secret
-  rules:
-    - host: vault.alexlebens.net
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: vault-active
-                port:
-                  number: 8200

clusters/cl01tl/platform/vault/templates/persistent-volume-claim.yaml

@@ -1,19 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: vault-nfs-storage-backup
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: vault-nfs-storage-backup
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: storage
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  volumeMode: Filesystem
-  storageClassName: nfs-client
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi

clusters/cl01tl/platform/vault/values.yaml

@@ -1,300 +0,0 @@
-vault:
-  global:
-    enabled: true
-    tlsDisable: true
-    psp:
-      enable: false
-    serverTelemetry:
-      prometheusOperator: true
-  injector:
-    enabled: false
-  server:
-    enabled: true
-    image:
-      repository: hashicorp/vault
-      tag: 1.18.4
-    updateStrategyType: "RollingUpdate"
-    logLevel: debug
-    logFormat: standard
-    resources:
-      requests:
-        cpu: 50m
-        memory: 512Mi
-    ingress:
-      enabled: true
-      annotations:
-        tailscale.com/experimental-forward-cluster-traffic-via-ingress: "true"
-      ingressClassName: tailscale
-      pathType: Prefix
-      activeService: true
-      hosts:
-        - host: vault-cl01tl
-          paths:
-            - /
-      tls:
-        - secretName: vault-cl01tl
-          hosts:
-            - vault-cl01tl
-    route:
-      enabled: false
-    authDelegator:
-      enabled: false
-    readinessProbe:
-      enabled: true
-      port: 8200
-    livenessProbe:
-      enabled: false
-    volumes:
-      - name: vault-nfs-storage-backup
-        persistentVolumeClaim:
-          claimName: vault-nfs-storage-backup
-    volumeMounts:
-      - mountPath: /opt/backups/
-        name: vault-nfs-storage-backup
-        readOnly: false
-    affinity: |
-      podAntiAffinity:
-        requiredDuringSchedulingIgnoredDuringExecution:
-          - labelSelector:
-              matchLabels:
-                app.kubernetes.io/name: {{ template "vault.name" . }}
-                app.kubernetes.io/instance: "{{ .Release.Name }}"
-                component: server
-            topologyKey: kubernetes.io/hostname
-    networkPolicy:
-      enabled: false
-    service:
-      enabled: true
-      active:
-        enabled: true
-      standby:
-        enabled: false
-      type: ClusterIP
-      port: 8200
-      targetPort: 8200
-    dataStorage:
-      enabled: true
-      size: 10Gi
-      mountPath: "/vault/data"
-      accessMode: ReadWriteOnce
-    auditStorage:
-      enabled: false
-      size: 10Gi
-      mountPath: "/vault/audit"
-      accessMode: ReadWriteOnce
-    dev:
-      enabled: false
-    standalone:
-      enabled: false
-    ha:
-      enabled: true
-      replicas: 3
-      raft:
-        enabled: true
-        config: |
-          ui = true
-
-          listener "tcp" {
-            tls_disable = 1
-            address = "[::]:8200"
-            cluster_address = "[::]:8201"
-            telemetry {
-              unauthenticated_metrics_access = "true"
-            }
-          }
-
-          storage "raft" {
-            path = "/vault/data"
-            retry_join {
-              leader_api_addr = "http://vault-0.vault-internal:8200"
-            }
-            retry_join {
-              leader_api_addr = "http://vault-1.vault-internal:8200"
-            }
-            retry_join {
-              leader_api_addr = "http://vault-2.vault-internal:8200"
-            }
-          }
-
-          service_registration "kubernetes" {}
-
-          telemetry {
-            prometheus_retention_time = "30s"
-            disable_hostname = true
-          }
-
-      disruptionBudget:
-        enabled: true
-        maxUnavailable: null
-    serviceAccount:
-      create: true
-      serviceDiscovery:
-        enabled: true
-    hostNetwork: false
-  ui:
-    enabled: true
-    publishNotReadyAddresses: true
-    activeVaultPodOnly: false
-    serviceType: "ClusterIP"
-    serviceNodePort: null
-    externalPort: 8200
-    targetPort: 8200
-  csi:
-    enabled: false
-  serverTelemetry:
-    serviceMonitor:
-      enabled: true
-      interval: 30s
-      scrapeTimeout: 10s
-    prometheusRules:
-      enabled: true
-      rules:
-        - alert: vault-HighResponseTime
-          annotations:
-            message: The response time of Vault is over 500ms on average over the last 5 minutes.
-          expr: vault_core_handle_request{quantile="0.5", namespace="mynamespace"} > 500
-          for: 5m
-          labels:
-            severity: warning
-        - alert: vault-HighResponseTime
-          annotations:
-            message: The response time of Vault is over 1s on average over the last 5 minutes.
-          expr: vault_core_handle_request{quantile="0.5", namespace="mynamespace"} > 1000
-          for: 5m
-          labels:
-            severity: critical
-snapshot:
-  global:
-    fullnameOverride: vault-snapshot
-  controllers:
-    snapshot:
-      type: cronjob
-      cronjob:
-        suspend: false
-        concurrencyPolicy: Forbid
-        timeZone: US/Central
-        schedule: 0 4 * * *
-        startingDeadlineSeconds: 90
-        successfulJobsHistory: 3
-        failedJobsHistory: 3
-        backoffLimit: 3
-        parallelism: 1
-      containers:
-        snapshot:
-          image:
-            repository: hashicorp/vault
-            tag: 1.18.4
-            pullPolicy: IfNotPresent
-          command:
-            - /bin/ash
-          args:
-            - -ec
-            - |
-              apk add --no-cache jq;
-              export VAULT_TOKEN=$(vault write auth/approle/login role_id=$VAULT_APPROLE_ROLE_ID secret_id=$VAULT_APPROLE_SECRET_ID -format=json | jq -r .auth.client_token);
-              vault operator raft snapshot save /opt/backup/vault-snapshot-latest.snap;
-              cp /opt/backup/vault-snapshot-latest.snap /opt/backup/vault-snapshot-$(date +"%Y%m%d-%H-%M").snap;
-              cp /opt/backup/vault-snapshot-latest.snap /opt/backup/vault-snapshot-s3.snap;
-          envFrom:
-            - secretRef:
-                name: vault-snapshot-agent-token
-          env:
-            - name: VAULT_ADDR
-              value: http://vault-active.vault.svc.cluster.local:8200
-          resources:
-            requests:
-              cpu: 10m
-              memory: 64Mi
-        backup:
-          image:
-            repository: amazon/aws-cli
-            tag: 2.24.0
-            pullPolicy: IfNotPresent
-          command:
-            - /bin/sh
-          args:
-            - -ec
-            - |
-              until [ -f /opt/backup/vault-snapshot-s3.snap ]; do sleep 5; done;
-              aws s3 cp /opt/backup/vault-snapshot-s3.snap s3://cl01tl-vault-snapshots/vault-snapshot-$(date +"%Y%m%d-%H-%M").snap;
-              rm /opt/backup/vault-snapshot-s3.snap;
-          envFrom:
-            - secretRef:
-                name: vault-snapshot-s3
-          resources:
-            requests:
-              cpu: 10m
-              memory: 64Mi
-  serviceAccount:
-    create: true
-  persistence:
-    config:
-      existingClaim: vault-nfs-storage-backup
-      advancedMounts:
-        snapshot:
-          snapshot:
-            - path: /opt/backup
-              readOnly: false
-          backup:
-            - path: /opt/backup
-              readOnly: false
-unseal:
-  global:
-    fullnameOverride: vault-unseal
-  controllers:
-    unseal-1:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      containers:
-        main:
-          image:
-            repository: ghcr.io/lrstanley/vault-unseal
-            tag: 0.7.0
-            pullPolicy: IfNotPresent
-          envFrom:
-            - secretRef:
-                name: vault-unseal-config-1
-          resources:
-            requests:
-              cpu: 10m
-              memory: 24Mi
-    unseal-2:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      containers:
-        main:
-          image:
-            repository: ghcr.io/lrstanley/vault-unseal
-            tag: 0.7.0
-            pullPolicy: IfNotPresent
-          envFrom:
-            - secretRef:
-                name: vault-unseal-config-2
-          resources:
-            requests:
-              cpu: 10m
-              memory: 24Mi
-    unseal-3:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      containers:
-        main:
-          image:
-            repository: ghcr.io/lrstanley/vault-unseal
-            tag: 0.7.0
-            pullPolicy: IfNotPresent
-          envFrom:
-            - secretRef:
-                name: vault-unseal-config-3
-          resources:
-            requests:
-              cpu: 10m
-              memory: 24Mi
-  serviceAccount:
-    create: true