Update php Docker tag to v8.5.0

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [ghcr.io/traefik/traefik](https://hub.docker.com/_/traefik) ([source](https://github.com/traefik/traefik-library-image)) | patch | `v3.6.2` -> `v3.6.4` |

---

### Release Notes

<details>
<summary>traefik/traefik-library-image (ghcr.io/traefik/traefik)</summary>

### [`v3.6.4`](https://github.com/traefik/traefik-library-image/compare/v3.6.4...v3.6.4)

[Compare Source](https://github.com/traefik/traefik-library-image/compare/v3.6.4...v3.6.4)

### [`v3.6.4`](https://github.com/traefik/traefik-library-image/compare/v3.6.2...v3.6.4)

[Compare Source](https://github.com/traefik/traefik-library-image/compare/v3.6.2...v3.6.4)

</details>

---

### Configuration

📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 **Automerge**: Enabled.

♻ **Rebasing**: Whenever PR is behind base branch, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0Mi4zOS4xIiwidXBkYXRlZEluVmVyIjoiNDIuMzkuMSIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOlsiYXV0b21lcmdlIiwiaW1hZ2UiXX0=-->

Co-authored-by: Alex Lebens <alexanderlebens@gmail.com>
Reviewed-on: #2295
Co-authored-by: Renovate Bot <renovate-bot@alexlebens.net>
Co-committed-by: Renovate Bot <renovate-bot@alexlebens.net>

.gitea/workflows/lint-test-docker.yaml

@@ -0,0 +1,134 @@
+name: lint-test-docker
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - 'hosts/**'
+      - '!clusters/**'
+
+  push:
+    branches:
+      - main
+    paths:
+      - 'hosts/**'
+      - '!clusters/**'
+
+env:
+  BASE_BRANCH: "origin/${{ gitea.base_ref }}"
+
+jobs:
+  lint-docker-compose:
+    runs-on: ubuntu-js
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Check Branch Exists
+        id: check-branch-exists
+        if: github.event_name == 'pull_request'
+        uses: GuillaumeFalourd/branch-exists@v1.1
+        with:
+          branch: "${{ github.base_ref }}"
+
+      - name: Report Branch Exists
+        id: branch-exists
+        if: github.event_name == 'push' || steps.check-branch-exists.outputs.exists == 'true' && github.event_name == 'pull_request'
+        run: |
+          if [ ${{ github.event_name == 'push' }} ]; then
+            echo ">> Action is from a push event, will continue with linting"
+
+          else
+            echo ">> Branch ${{ gitea.base_ref }} exists, will continue with linting"
+
+          fi
+
+          echo "----"
+
+          echo "exists=true" >> $GITEA_OUTPUT
+
+      - name: Set up Node.js
+        if: steps.branch-exists.outputs.exists == 'true'
+        uses: actions/setup-node@v6
+        with:
+          node-version: '24'
+
+      - name: Check Directories for Changes
+        id: check-dir-changes
+        if: steps.branch-exists.outputs.exists == 'true'
+        run: |
+          CHANGED_COMPOSE=()
+
+          echo ">> Target branch for diff is: ${BASE_BRANCH}"
+
+          if [ "${{ github.event_name }}" == "pull_request" ]; then
+            echo ""
+            echo ">> Checking for changes in a pull request ..."
+            GIT_DIFF=$(git diff --name-only "${BASE_BRANCH}" | xargs -I {} dirname {} | sort -u | grep -E "hosts/[^/]+/[^/]+")
+          else
+            echo ""
+            echo ">> Checking for changes from a push ..."
+            GIT_DIFF=$(git diff --name-only ${{ gitea.event.before }}..HEAD | xargs -I {} dirname {} | sort -u | grep -E "hosts/[^/]+/[^/]+")
+          fi
+
+          if [ -n "${GIT_DIFF}" ]; then
+            echo ""
+            echo ">> Changes detected:"
+            echo "$GIT_DIFF"
+
+            for path in $GIT_DIFF; do
+              CHANGED_COMPOSE+=$(echo "$path")
+              CHANGED_COMPOSE+=$(echo " ")
+            done
+
+          else
+            echo ""
+            echo ">> No changes detected"
+
+          fi
+
+          if [ -n "${CHANGED_COMPOSE}" ]; then
+            echo ""
+            echo ">> Compose to Lint:"
+            echo "$(echo "${CHANGED_COMPOSE}" | sort -u)"
+
+            echo "----"
+
+            echo "changes-detected=true" >> $GITEA_OUTPUT
+            echo "compose-dir<<EOF" >> $GITEA_OUTPUT
+            echo "$(echo "${CHANGED_COMPOSE}" | sort -u)" >> $GITEA_OUTPUT
+            echo "EOF" >> $GITEA_OUTPUT
+          else
+            echo "changes-detected=false" >> $GITEA_OUTPUT
+          fi
+
+      - name: Lint Docker Compose
+        if: steps.check-dir-changes.outputs.changes-detected == 'true'
+        env:
+          CHANGED_COMPOSE: ${{ steps.check-dir-changes.outputs.compose-dir }}
+        run: |
+          echo ">> Running dclint on changed compose files:"
+          echo "$CHANGED_COMPOSE"
+
+          for compose in $CHANGED_COMPOSE; do
+            echo ">> Linting $compose ..."
+            npx dclint $compose
+          done
+
+      - name: ntfy Failed
+        uses: niniyas/ntfy-action@master
+        if: failure()
+        with:
+          url: '${{ secrets.NTFY_URL }}'
+          topic: '${{ secrets.NTFY_TOPIC }}'
+          title: 'Test Failure - Infrastructure'
+          priority: 3
+          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
+          tags: action,failed
+          details: 'Docker linting on Pull Request for Infrastructure has failed!'
+          icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
+          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/infrastructure/actions?workflow=lint-test-docker-pull.yaml", "clear": true}]'
+          image: true

.gitea/workflows/lint-test-helm.yaml

@@ -0,0 +1,174 @@
+name: lint-test-helm
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - 'clusters/cl01tl/helm/**'
+      - '!hosts/**'
+
+  push:
+    branches:
+      - main
+    paths:
+      - 'clusters/cl01tl/helm/**'
+      - '!hosts/**'
+
+env:
+  CLUSTER: cl01tl
+  BASE_BRANCH: "origin/${{ gitea.base_ref }}"
+
+jobs:
+  lint-helm:
+    runs-on: ubuntu-js
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+
+      - name: Check Branch Exists
+        id: check-branch-exists
+        if: github.event_name == 'pull_request'
+        uses: GuillaumeFalourd/branch-exists@v1.1
+        with:
+          branch: ${{ gitea.base_ref }}
+
+      - name: Report Branch Exists
+        id: branch-exists
+        if: github.event_name == 'push' || steps.check-branch-exists.outputs.exists == 'true' && github.event_name == 'pull_request'
+        run: |
+          if [ ${{ github.event_name == 'push' }} ]; then
+            echo ">> Action is from a push event, will continue with linting"
+
+          else
+            echo ">> Branch ${{ gitea.base_ref }} exists, will continue with linting"
+
+          fi
+
+          echo "----"
+
+          echo "exists=true" >> $GITEA_OUTPUT
+
+      - name: Set up Helm
+        if: steps.branch-exists.outputs.exists == 'true'
+        uses: azure/setup-helm@v4
+        with:
+          token: ${{ secrets.GITEA_TOKEN }}
+          version: v3.19.2
+
+      - name: Check Directories for Changes
+        id: check-dir-changes
+        if: steps.branch-exists.outputs.exists == 'true'
+        run: |
+          CHANGED_CHARTS=()
+
+          echo ">> Target branch for diff is: ${BASE_BRANCH}"
+
+          if [ "${{ github.event_name }}" == "pull_request" ]; then
+            echo ""
+            echo ">> Checking for changes in a pull request ..."
+            git diff --name-only "${BASE_BRANCH}" | xargs -I {} dirname {} | sort -u | grep -E "clusters/[^/]+/helm/[^/]+"
+            GIT_DIFF=$(git diff --name-only "${BASE_BRANCH}" | xargs -I {} dirname {} | sort -u | grep -E "clusters/[^/]+/helm/[^/]+")
+          else
+            echo ""
+            echo ">> Checking for changes from a push ..."
+            GIT_DIFF=$(git diff --name-only ${{ gitea.event.before }}..HEAD | xargs -I {} dirname {} | sort -u | grep -E "clusters/[^/]+/helm/[^/]+")
+          fi
+
+          if [ -n "${GIT_DIFF}" ]; then
+            echo ""
+            echo ">> Changes detected:"
+            echo "$GIT_DIFF"
+
+            for path in $GIT_DIFF; do
+              CHANGED_CHARTS+=$(echo "$path" | awk -F '/' '{print $4}')
+              CHANGED_CHARTS+=$(echo " ")
+            done
+
+          else
+            echo ""
+            echo ">> No changes detected"
+
+          fi
+
+          if [ -n "${CHANGED_CHARTS}" ]; then
+            echo ""
+            echo ">> Chart to Lint:"
+            echo "$(echo "${CHANGED_CHARTS}" | sort -u)"
+
+            echo "----"
+
+            echo "changes-detected=true" >> $GITEA_OUTPUT
+            echo "chart-dir<<EOF" >> $GITEA_OUTPUT
+            echo "$(echo "${CHANGED_CHARTS}" | sort -u)" >> $GITEA_OUTPUT
+            echo "EOF" >> $GITEA_OUTPUT
+          else
+            echo "changes-detected=false" >> $GITEA_OUTPUT
+          fi
+
+      - name: Add Repositories
+        if: steps.check-dir-changes.outputs.changes-detected == 'true'
+        env:
+          CHANGED_CHARTS: ${{ steps.check-dir-changes.outputs.chart-dir }}
+        run: |
+          echo ">> Adding repositories for chart dependencies ..."
+          for dir in ${CHANGED_CHARTS}; do
+            helm dependency list --max-col-width 120 clusters/${CLUSTER}/helm/$dir 2> /dev/null \
+              | tail +2 | head -n -1 \
+              | awk '{ print "helm repo add " $1 " " $3 }' \
+              | while read cmd; do echo "$cmd" | sh; done || true
+          done
+
+          if helm repo list | tail +2 | read -r; then
+            echo ""
+            echo ">> Update repository cache ..."
+            helm repo update
+          fi
+
+          echo "----"
+
+      - name: Lint Helm Chart
+        if: steps.check-dir-changes.outputs.changes-detected == 'true'
+        env:
+          CHANGED_CHARTS: ${{ steps.check-dir-changes.outputs.chart-dir }}
+        run: |
+          echo ">> Running linting on changed charts ..."
+
+          for dir in ${CHANGED_CHARTS}; do
+            chart_path=clusters/${CLUSTER}/helm/$dir
+            chart_name=$(basename "$chart_path")
+
+            if [ -f "$chart_path/Chart.yaml" ]; then
+              cd $chart_path
+
+              echo ""
+              echo ">> Building helm dependency ..."
+              helm dependency build --skip-refresh
+
+              echo ""
+              echo ">> Linting helm ..."
+              helm lint --namespace "$chart_name"
+
+            else
+              echo ""
+              echo ">> Directory $chart_path does not contain a Chart.yaml. Skipping ..."
+              echo ""
+            fi
+          done
+
+      - name: ntfy Failed
+        uses: niniyas/ntfy-action@master
+        if: failure()
+        with:
+          url: '${{ secrets.NTFY_URL }}'
+          topic: '${{ secrets.NTFY_TOPIC }}'
+          title: 'Test Failure - Infrastructure'
+          priority: 3
+          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
+          tags: action,failed
+          details: 'Helm linting on Pull Request for Infrastructure has failed!'
+          icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
+          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/infrastructure/actions?workflow=lint-test-helm-pull.yaml", "clear": true}]'
+          image: true

.gitea/workflows/render-manifests-automerge.yaml

@@ -0,0 +1,418 @@
+name: render-manifests-automerge
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - 'clusters/cl01tl/helm/**'
+    types:
+      - closed
+
+env:
+  CLUSTER: cl01tl
+  BASE_BRANCH: manifests
+  BRANCH_NAME_BASE: auto/update-manifests-automerge
+  MAIN_DIR: /workspace/alexlebens/infrastructure/infrastructure
+  MANIFEST_DIR: /workspace/alexlebens/infrastructure/infrastructure-manifests
+
+jobs:
+  render-manifests-automerge:
+    runs-on: ubuntu-js
+    if: ${{ (github.event.pull_request.merged == true) && (contains(github.event.pull_request.labels.*.name, 'automerge')) }}
+    steps:
+      - name: Checkout Main
+        uses: actions/checkout@v6
+        with:
+          path: infrastructure
+          fetch-depth: 0
+
+      - name: Checkout Manifests
+        uses: actions/checkout@v6
+        with:
+          ref: manifests
+          path: infrastructure-manifests
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v4
+        with:
+          token: ${{ secrets.GITEA_TOKEN }}
+          version: v3.17.2 # Pending https://github.com/helm/helm/pull/30743
+
+      - name: Prepare Manifest Branch
+        id: prepare-manifest-branch
+        run: |
+          cd ${MANIFEST_DIR}
+
+          BRANCH_NAME="${BRANCH_NAME_BASE}-$(date +%Y%m%d%H%M%S)"
+
+          echo ">> Configure git to use gitea-bot as user ..."
+          git config user.name "gitea-bot"
+          git config user.email "gitea-bot@alexlebens.net"
+
+          echo ">> Creating branch ..."
+          git checkout -b $BRANCH_NAME
+
+          echo "----"
+
+          echo "BRANCH_NAME=${BRANCH_NAME}" >> $GITEA_OUTPUT
+
+      - name: Check which Directories have Changes
+        id: check-dir-changes
+        run: |
+          cd ${MAIN_DIR}
+
+          RENDER_DIR=()
+
+          echo ">> Checking for changes from HEAD^..HEAD ..."
+          GIT_DIFF=$(git diff --name-only HEAD^..HEAD | xargs -I {} dirname {} | sort -u | grep -E "clusters/[^/]+/helm/[^/]+")
+
+          if [ -n "${GIT_DIFF}" ]; then
+            echo ">> Changes detected:"
+            echo "$GIT_DIFF"
+            for path in $GIT_DIFF; do
+              RENDER_DIR+=$(echo "$path" | awk -F '/' '{print $4}')
+              RENDER_DIR+=$(echo " ")
+            done
+
+          else
+            echo ">> No changes detected"
+
+          fi
+
+          if [ -n "${RENDER_DIR}" ]; then
+            echo ">> Directories to Render:"
+            echo "$(echo "${RENDER_DIR}" | sort -u)"
+
+            echo "----"
+
+            echo "changes-detected=true" >> $GITEA_OUTPUT
+            echo "render-dir<<EOF" >> $GITEA_OUTPUT
+            echo "$(echo "${RENDER_DIR}" | sort -u)" >> $GITEA_OUTPUT
+            echo "EOF" >> $GITEA_OUTPUT
+          else
+            echo "changes-detected=false" >> $GITEA_OUTPUT
+          fi
+
+      - name: Add Repositories
+        if: steps.check-dir-changes.outputs.changes-detected == 'true'
+        env:
+          RENDER_DIR: ${{ steps.check-dir-changes.outputs.render-dir }}
+        run: |
+          cd ${MAIN_DIR}
+
+          echo ">> Adding repositories for chart dependencies ..."
+          for dir in ${RENDER_DIR}; do
+            helm dependency list --max-col-width 120 ${MAIN_DIR}/clusters/${CLUSTER}/helm/$dir 2> /dev/null \
+              | tail +2 | head -n -1 \
+              | awk '{ print "helm repo add " $1 " " $3 }' \
+              | while read cmd; do echo "$cmd" | sh; done || true
+          done
+
+          if helm repo list | tail +2 | read -r; then
+            echo ">> Update repository cache ..."
+            helm repo update
+          fi
+
+          echo "----"
+
+      - name: Remove Changed Manifest Files
+        if: steps.check-dir-changes.outputs.changes-detected == 'true'
+        env:
+          RENDER_DIR: ${{ steps.check-dir-changes.outputs.render-dir }}
+        run: |
+          cd ${MANIFEST_DIR}
+
+          echo ">> Remove manfiest files and rebuild from source ..."
+
+          for dir in ${RENDER_DIR}; do
+            chart_path=${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$dir
+
+            echo "$chart_path"
+            rm -rf $chart_path/*
+          done
+
+          echo "----"
+
+      - name: Render Helm Manifests
+        id: render-manifests
+        if: steps.check-dir-changes.outputs.changes-detected == 'true'
+        env:
+          RENDER_DIR: ${{ steps.check-dir-changes.outputs.render-dir }}
+        run: |
+          cd ${MAIN_DIR}
+
+          echo ">> Rendering Manifests ..."
+
+          for dir in ${RENDER_DIR}; do
+            chart_path=${MAIN_DIR}/clusters/${CLUSTER}/helm/$dir
+            chart_name=$(basename "$chart_path")
+
+            echo ""
+            echo ""
+            echo ">> Rendering chart: $chart_name"
+            echo ">> Chart path $chart_path"
+
+            if [ -f "$chart_path/Chart.yaml" ]; then
+              OUTPUT_FOLDER="${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$chart_name/"
+              TEMPLATE=""
+
+              mkdir -p ${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$chart_name
+
+              cd $chart_path
+
+              echo ""
+              echo ">> Building helm dependency ..."
+              helm dependency build --skip-refresh
+
+              echo ""
+              echo ">> Linting helm ..."
+              helm lint --namespace "$chart_name"
+
+              echo ""
+              echo ">> Rendering templates ..."
+              case "$chart_name" in
+                "stack")
+                  echo ""
+                  echo ">> Special Rendering for stack into argocd namespace ..."
+                  TEMPLATE=$(helm template $chart_name ./ --namespace argocd --include-crds --dry-run)
+                  ;;
+                "cilium" | "coredns" | "metrics-server" |"prometheus-operator-crds")
+                  echo ""
+                  echo ">> Special Rendering for $chart_name into kube-system namespace ..."
+                  TEMPLATE=$(helm template $chart_name ./ --namespace kube-system --include-crds --dry-run)
+                  ;;
+                *)
+                  echo ""
+                  echo ">> Standard Rendering for $chart_name ..."
+                  TEMPLATE=$(helm template "$chart_name" ./ --namespace "$chart_name" --include-crds --dry-run)
+                  ;;
+              esac
+
+              echo ""
+              echo ">> Formating rendered template ..."
+              echo "$TEMPLATE" | yq '... comments=""' | yq 'select(. != null)' | yq -s '"'"$OUTPUT_FOLDER"'" + .kind + "-" + .metadata.name + ".yaml"'
+
+              echo ""
+              echo ">> Manifests for $chart_name rendered to $OUTPUT_FOLDER"
+              ls $OUTPUT_FOLDER
+              echo ""
+            else
+              echo ""
+              echo ">> Directory $chart_path does not contain a Chart.yaml. Skipping ..."
+              echo ""
+            fi
+          done
+
+          echo "----"
+
+      - name: Check for Changes
+        id: check-changes
+        if: steps.check-dir-changes.outputs.changes-detected == 'true'
+        run: |
+          cd ${MANIFEST_DIR}
+
+          GIT_CHANGES=$(git status --porcelain)
+
+          if [ -n "$GIT_CHANGES" ]; then
+            echo ">> Changes detected"
+            git status --porcelain
+            echo "changes-detected=true" >> $GITEA_OUTPUT
+
+          else
+            echo ">> No changes detected, skipping PR creation"
+
+          fi
+
+          echo "----"
+
+      - name: Commit and Push Changes
+        id: commit-push
+        if: steps.check-changes.outputs.changes-detected == 'true'
+        env:
+          BRANCH_NAME: ${{ steps.prepare-manifest-branch.outputs.BRANCH_NAME }}
+        run: |
+          cd ${MANIFEST_DIR}
+
+          echo ">> Commiting changes to ${BRANCH_NAME} ..."
+          git add .
+          git commit -m "chore: Update manifests after automerge"
+
+          REPO_URL="${{ secrets.REPO_URL }}/${{ gitea.repository }}"
+          echo ">> Pushing changes to $REPO_URL ..."
+          git push -u "https://oauth2:${{ secrets.BOT_TOKEN }}@$(echo $REPO_URL | sed -e 's|https://||')" ${BRANCH_NAME}
+
+          echo "----"
+
+          echo "push=true" >> $GITEA_OUTPUT
+
+      - name: Create Pull Request
+        id: create-pull-request
+        if: steps.commit-push.outputs.push == 'true'
+        env:
+          GITEA_TOKEN: ${{ secrets.BOT_TOKEN }}
+          GITEA_URL: ${{ secrets.REPO_URL }}
+          BRANCH_NAME: ${{ steps.prepare-manifest-branch.outputs.BRANCH_NAME }}
+        run: |
+          cd ${MANIFEST_DIR}
+
+          API_ENDPOINT="${GITEA_URL}/api/v1/repos/${{ gitea.repository }}/pulls"
+
+          PAYLOAD=$( jq -n \
+            --arg head "${BRANCH_NAME}" \
+            --arg base "${BASE_BRANCH}" \
+            --arg title "Automated Manifest Update - Automerge" \
+            --arg body "This PR contains newly rendered Kubernetes manifests automatically generated by the CI workflow. This is expected to be automerged." \
+            '{head: $head, base: $base, title: $title, body: $body}' )
+
+          echo ">> Creating PR from branch ${BRANCH_NAME} into ${BASE_BRANCH}"
+          echo ">> With Endpoint of:"
+          echo "$API_ENDPOINT"
+          echo ">> With Payload of:"
+          echo "$PAYLOAD"
+
+          HTTP_STATUS=$(
+            curl -X POST \
+              --silent \
+              --write-out '%{http_code}' \
+              --output response_body.json \
+              --dump-header response_headers.txt \
+              --data "$PAYLOAD" \
+              -H "Authorization: token ${GITEA_TOKEN}" \
+              -H "Content-Type: application/json" \
+              "$API_ENDPOINT" 2> response_errors.txt
+          )
+
+          echo ">> HTTP Status Code: $HTTP_STATUS"
+          echo ">> Response Output ..."
+          echo "----"
+          cat response_body.json
+          echo "----"
+          cat response_headers.txt
+          echo "----"
+          cat response_errors.txt
+          echo "----"
+
+          if [ "$HTTP_STATUS" == "201" ]; then
+            echo ">> Pull Request created successfully!"
+
+            PR_URL=$(cat response_body.json | jq -r .html_url)
+            echo ">> Pull Request URL: $PR_URL"
+            echo "pull-request-url=${PR_URL}" >> $GITEA_OUTPUT
+
+            PR_NUMBER=$(cat response_body.json | jq -r .number)
+            echo ">> Pull Request Number: $PR_NUMBER"
+            echo "pull-request-number=${PR_NUMBER}" >> $GITEA_OUTPUT
+
+            echo "pull-request-operation=created" >> $GITEA_OUTPUT
+
+          elif [ "$HTTP_STATUS" == "422" ]; then
+            echo ">> Failed to create PR (HTTP 422: Unprocessable Entity), PR may already exist"
+
+          elif [ "$HTTP_STATUS" == "409" ]; then
+            echo ">> Failed to create PR (HTTP 409: Conflict), PR already exists"
+
+          else
+            echo ">> Failed to create PR, HTTP status code: $HTTP_STATUS"
+            exit 1
+          fi
+
+          echo "----"
+
+      - name: Merge Changes
+        id: merge-changes
+        if: steps.commit-push.outputs.push == 'true'
+        env:
+          GITEA_TOKEN: ${{ secrets.BOT_TOKEN }}
+          GITEA_URL: ${{ secrets.REPO_URL }}
+          BRANCH_NAME: ${{ steps.prepare-manifest-branch.outputs.BRANCH_NAME }}
+          PR_NUMBER: ${{ steps.create-pull-request.outputs.pull-request-number }}
+        run: |
+          cd ${MANIFEST_DIR}
+
+          API_ENDPOINT="${GITEA_URL}/api/v1/repos/${{ gitea.repository }}/pulls/${PR_NUMBER}/merge"
+
+          PAYLOAD=$( jq -n \
+            --arg Do "merge" \
+            '{Do: $Do}' )
+
+          echo ">> Merging PR with ID: ${PR_NUMBER}"
+          echo ">> With Endpoint of:"
+          echo "$API_ENDPOINT"
+          echo ">> With Payload of:"
+          echo "$PAYLOAD"
+
+          HTTP_STATUS=$(
+            curl -X POST \
+              --silent \
+              --write-out '%{http_code}' \
+              --output response_body.json \
+              --dump-header response_headers.txt \
+              --data "$PAYLOAD" \
+              -H "Authorization: token ${GITEA_TOKEN}" \
+              -H "Content-Type: application/json" \
+              "$API_ENDPOINT" 2> response_errors.txt
+          )
+
+          echo ">> HTTP Status Code: $HTTP_STATUS"
+          echo ">> Response Output ..."
+          echo "----"
+          cat response_body.json
+          echo "----"
+          cat response_headers.txt
+          echo "----"
+          cat response_errors.txt
+          echo "----"
+
+          if [ "$HTTP_STATUS" == "200" ]; then
+            echo ">> Pull Request merged successfully!"
+            echo "pull-request-operation=merged" >> $GITEA_OUTPUT
+
+          else
+            echo ">> Failed to create PR, HTTP status code: $HTTP_STATUS"
+            echo "pull-request-operation=failed" >> $GITEA_OUTPUT
+            exit 1
+          fi
+
+          echo "----"
+
+      - name: Cleanup Branch
+        if: failure()
+        env:
+          BRANCH_NAME: ${{ steps.prepare-manifest-branch.outputs.BRANCH_NAME }}
+        run: |
+          cd ${MANIFEST_DIR}
+
+          echo ">> Removing branch: ${BRANCH_NAME}"
+          git push origin --delete ${BRANCH_NAME}
+
+          echo "----"
+
+      - name: ntfy Merged
+        uses: niniyas/ntfy-action@master
+        if: steps.merge-changes.outputs.pull-request-operation == 'merged'
+        with:
+          url: "${{ secrets.NTFY_URL }}"
+          topic: "${{ secrets.NTFY_TOPIC }}"
+          title: "Manifest Render PR Merged - Infrastructure"
+          priority: 3
+          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
+          tags: action,successfully,completed
+          details: "Automerge Manifest rendering for Infrastructure!"
+          icon: "https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png"
+          actions: '[{"action": "view", "label": "Open Gitea", "url": "${{ steps.create-pull-request.outputs.pull-request-url }}", "clear": true}]'
+
+      - name: ntfy Failed
+        uses: niniyas/ntfy-action@master
+        if: failure()
+        with:
+          url: "${{ secrets.NTFY_URL }}"
+          topic: "${{ secrets.NTFY_TOPIC }}"
+          title: "Manifest Render Failure - Infrastructure"
+          priority: 4
+          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
+          tags: action,failed
+          details: "Automerge Manifest rendering for Infrastructure has failed!"
+          icon: "https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png"
+          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/infrastructure/actions?workflow=render-manifests-automerge.yaml", "clear": true}]'
+          image: true

.gitea/workflows/render-manifests-dispatch.yaml

@@ -0,0 +1,383 @@
+name: render-manifests-dispatch
+
+on:
+  workflow_dispatch:
+
+env:
+  CLUSTER: cl01tl
+  BASE_BRANCH: manifests
+  BRANCH_NAME: auto/update-manifests
+  ASSIGNEE: alexlebens
+  MAIN_DIR: /workspace/alexlebens/infrastructure/infrastructure
+  MANIFEST_DIR: /workspace/alexlebens/infrastructure/infrastructure-manifests
+
+jobs:
+  render-manifests-dispatch:
+    runs-on: ubuntu-js
+    steps:
+      - name: Checkout Main
+        uses: actions/checkout@v6
+        with:
+          path: infrastructure
+          fetch-depth: 0
+
+      - name: Checkout Manifests
+        uses: actions/checkout@v6
+        with:
+          ref: manifests
+          path: infrastructure-manifests
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v4
+        with:
+          token: ${{ secrets.GITEA_TOKEN }}
+          version: v3.17.2 # Pending https://github.com/helm/helm/pull/30743
+
+      - name: Prepare Manifest Branch
+        run: |
+          cd ${MANIFEST_DIR}
+
+          echo ">> Configure git to use gitea-bot as user ..."
+          git config user.name "gitea-bot"
+          git config user.email "gitea-bot@alexlebens.net"
+
+          echo ">> Checking if PR branch exists ..."
+          if [[ $(git ls-remote --heads origin "${BRANCH_NAME}" | wc -l) -gt 0 ]]; then
+            echo ">> Branch '${BRANCH_NAME}' exists, pulling changes ..."
+            git fetch origin "${BRANCH_NAME}"
+            git checkout "${BRANCH_NAME}"
+            git pull --rebase
+
+          else
+            echo ">> Branch '${BRANCH_NAME}' does not exist, creating ..."
+            git checkout -b $BRANCH_NAME
+          fi
+
+          echo "----"
+
+      - name: Check which Directories have Changes
+        id: check-dir-changes
+        run: |
+          cd ${MAIN_DIR}
+
+          RENDER_DIR=()
+
+          echo ">> Triggered on dispatch, will check all paths ..."
+          RENDER_DIR+=$(ls clusters/cl01tl/helm/)
+
+          if [ -n "${RENDER_DIR}" ]; then
+            echo ">> Directories to Render:"
+            echo "$(echo "${RENDER_DIR}" | sort -u)"
+
+            echo "----"
+
+            echo "changes-detected=true" >> $GITEA_OUTPUT
+            echo "render-dir<<EOF" >> $GITEA_OUTPUT
+            echo "$(echo "${RENDER_DIR}" | sort -u)" >> $GITEA_OUTPUT
+            echo "EOF" >> $GITEA_OUTPUT
+          else
+            echo "changes-detected=false" >> $GITEA_OUTPUT
+          fi
+
+      - name: Add Repositories
+        if: steps.check-dir-changes.outputs.changes-detected == 'true'
+        env:
+          RENDER_DIR: ${{ steps.check-dir-changes.outputs.render-dir }}
+        run: |
+          cd ${MAIN_DIR}
+
+          echo ">> Adding repositories for chart dependencies ..."
+          for dir in ${RENDER_DIR}; do
+            helm dependency list --max-col-width 120 ${MAIN_DIR}/clusters/${CLUSTER}/helm/$dir 2> /dev/null \
+              | tail +2 | head -n -1 \
+              | awk '{ print "helm repo add " $1 " " $3 }' \
+              | while read cmd; do echo "$cmd" | sh; done || true
+          done
+
+          if helm repo list | tail +2 | read -r; then
+            echo ">> Update repository cache ..."
+            helm repo update
+          fi
+
+          echo "----"
+
+      - name: Remove Changed Manifest Files
+        if: steps.check-dir-changes.outputs.changes-detected == 'true'
+        env:
+          RENDER_DIR: ${{ steps.check-dir-changes.outputs.render-dir }}
+        run: |
+          cd ${MANIFEST_DIR}
+
+          echo ">> Remove manfiest files and rebuild from source ..."
+
+          for dir in ${RENDER_DIR}; do
+            chart_path=${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$dir
+
+            echo "$chart_path"
+            rm -rf $chart_path/*
+          done
+
+          echo "----"
+
+      - name: Render Helm Manifests
+        id: render-manifests
+        if: steps.check-dir-changes.outputs.changes-detected == 'true'
+        env:
+          RENDER_DIR: ${{ steps.check-dir-changes.outputs.render-dir }}
+        run: |
+          cd ${MAIN_DIR}
+
+          echo ">> Rendering Manifests ..."
+
+          for dir in ${RENDER_DIR}; do
+            chart_path=${MAIN_DIR}/clusters/${CLUSTER}/helm/$dir
+            chart_name=$(basename "$chart_path")
+
+            echo ""
+            echo ""
+            echo ">> Rendering chart: $chart_name"
+            echo ">> Chart path $chart_path"
+
+            if [ -f "$chart_path/Chart.yaml" ]; then
+              OUTPUT_FOLDER="${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$chart_name/"
+              TEMPLATE=""
+
+              mkdir -p ${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$chart_name
+
+              cd $chart_path
+
+              echo ""
+              echo ">> Building helm dependency ..."
+              helm dependency build --skip-refresh
+
+              echo ""
+              echo ">> Linting helm ..."
+              helm lint --namespace "$chart_name"
+
+              echo ""
+              echo ">> Rendering templates ..."
+              case "$chart_name" in
+                "stack")
+                  echo ""
+                  echo ">> Special Rendering for stack into argocd namespace ..."
+                  TEMPLATE=$(helm template $chart_name ./ --namespace argocd --include-crds --dry-run)
+                  ;;
+                "cilium" | "coredns" | "metrics-server" |"prometheus-operator-crds")
+                  echo ""
+                  echo ">> Special Rendering for $chart_name into kube-system namespace ..."
+                  TEMPLATE=$(helm template $chart_name ./ --namespace kube-system --include-crds --dry-run)
+                  ;;
+                *)
+                  echo ""
+                  echo ">> Standard Rendering for $chart_name ..."
+                  TEMPLATE=$(helm template "$chart_name" ./ --namespace "$chart_name" --include-crds --dry-run)
+                  ;;
+              esac
+
+              echo ""
+              echo ">> Formating rendered template ..."
+              echo "$TEMPLATE" | yq '... comments=""' | yq 'select(. != null)' | yq -s '"'"$OUTPUT_FOLDER"'" + .kind + "-" + .metadata.name + ".yaml"'
+
+              echo ""
+              echo ">> Manifests for $chart_name rendered to $OUTPUT_FOLDER"
+              ls $OUTPUT_FOLDER
+              echo ""
+            else
+              echo ""
+              echo ">> Directory $chart_path does not contain a Chart.yaml. Skipping ..."
+              echo ""
+            fi
+          done
+
+          echo "----"
+
+      - name: Check for Changes
+        id: check-changes
+        if: steps.check-dir-changes.outputs.changes-detected == 'true'
+        run: |
+          cd ${MANIFEST_DIR}
+
+          GIT_CHANGES=$(git status --porcelain)
+
+          if [ -n "$GIT_CHANGES" ]; then
+            echo ">> Changes detected"
+            git status --porcelain
+            echo "changes-detected=true" >> $GITEA_OUTPUT
+
+          else
+            echo ">> No changes detected, skipping PR creation"
+
+          fi
+
+          echo "----"
+
+      - name: Commit and Push Changes
+        id: commit-push
+        if: steps.check-changes.outputs.changes-detected == 'true'
+        run: |
+          cd ${MANIFEST_DIR}
+
+          echo ">> Commiting changes to ${BRANCH_NAME} ..."
+          git add .
+          git commit -m "chore: Update manifests after change"
+
+          REPO_URL="${{ secrets.REPO_URL }}/${{ gitea.repository }}"
+          echo ">> Pushing changes to $REPO_URL ..."
+          git push -u "https://oauth2:${{ secrets.BOT_TOKEN }}@$(echo $REPO_URL | sed -e 's|https://||')" ${BRANCH_NAME}
+
+          echo "----"
+
+          echo "HEAD_BRANCH=${BRANCH_NAME}" >> $GITEA_OUTPUT
+          echo "push=true" >> $GITEA_OUTPUT
+
+      - name: Check for Pull Request
+        id: check-for-pull-requst
+        if: steps.commit-push.outputs.push == 'true'
+        env:
+          GITEA_TOKEN: ${{ secrets.BOT_TOKEN }}
+          GITEA_URL: ${{ secrets.REPO_URL }}
+          HEAD_BRANCH: ${{ steps.commit-push.outputs.HEAD_BRANCH }}
+        run: |
+          cd ${MANIFEST_DIR}
+
+          API_ENDPOINT="${GITEA_URL}/api/v1/repos/${{ gitea.repository }}/pulls?base_branch=${BASE_BRANCH}&state=open&page=1"
+
+          echo ">> Checking if PR from branch ${HEAD_BRANCH} into ${BASE_BRANCH}"
+          echo ">> With Endpoint of:"
+          echo "$API_ENDPOINT"
+
+          HTTP_STATUS=$(
+            curl -X GET \
+              --silent \
+              --write-out '%{http_code}' \
+              --output response_body.json \
+              --dump-header response_headers.txt \
+              -H "Authorization: token ${GITEA_TOKEN}" \
+              -H "Content-Type: application/json" \
+              "$API_ENDPOINT" 2> response_errors.txt
+          )
+
+          echo ">> HTTP Status Code: $HTTP_STATUS"
+          echo ">> Response Output ..."
+          echo "----"
+          cat response_body.json
+          echo "----"
+          cat response_headers.txt
+          echo "----"
+          cat response_errors.txt
+          echo "----"
+
+          if [ "$HTTP_STATUS" == "200" ] && [ "$(cat response_body.json | jq -r .[0].state)" == "open" ]; then
+            echo ">> Pull Request has been found open, will update"
+            PR_INDEX=$(cat response_body.json | jq -r .[0].number)
+            echo "pull-request-exists=${PR_INDEX}" >> $GITEA_OUTPUT
+            echo "pull-request-index=true" >> $GITEA_OUTPUT
+
+          elif [ "$HTTP_STATUS" == "200" ] && [ "$(cat response_body.json | jq -r .[0].state)" == "closed" ]; then
+            echo ">> Pull Request found, but was closed"
+            echo "pull-request-exists=false" >> $GITEA_OUTPUT
+
+          else
+            echo ">> Pull Request not found"
+            echo "pull-request-exists=false" >> $GITEA_OUTPUT
+          fi
+
+          echo "----"
+
+      - name: Create Pull Request
+        id: create-pull-request
+        if: steps.commit-push.outputs.push == 'true' && steps.check-for-pull-requst.outputs.pull-request-exists == 'false'
+        env:
+          GITEA_TOKEN: ${{ secrets.BOT_TOKEN }}
+          GITEA_URL: ${{ secrets.REPO_URL }}
+          HEAD_BRANCH: ${{ steps.commit-push.outputs.HEAD_BRANCH }}
+        run: |
+          cd ${MANIFEST_DIR}
+
+          API_ENDPOINT="${GITEA_URL}/api/v1/repos/${{ gitea.repository }}/pulls"
+
+          PAYLOAD=$( jq -n \
+            --arg head "${HEAD_BRANCH}" \
+            --arg base "${BASE_BRANCH}" \
+            --arg assignee "${ASSIGNEE}" \
+            --arg title "Automated Manifest Update" \
+            --arg body "This PR contains newly rendered Kubernetes manifests automatically generated by the CI workflow." \
+            '{head: $head, base: $base, assignee: $assignee, title: $title, body: $body}' )
+
+          echo ">> Creating PR from branch ${HEAD_BRANCH} into ${BASE_BRANCH}"
+          echo ">> With Endpoint of:"
+          echo "$API_ENDPOINT"
+          echo ">> With Payload of:"
+          echo "$PAYLOAD"
+
+          HTTP_STATUS=$(
+            curl -X POST \
+              --silent \
+              --write-out '%{http_code}' \
+              --output response_body.json \
+              --dump-header response_headers.txt \
+              --data "$PAYLOAD" \
+              -H "Authorization: token ${GITEA_TOKEN}" \
+              -H "Content-Type: application/json" \
+              "$API_ENDPOINT" 2> response_errors.txt
+          )
+
+          echo ">> HTTP Status Code: $HTTP_STATUS"
+          echo ">> Response Output ..."
+          echo "----"
+          cat response_body.json
+          echo "----"
+          cat response_headers.txt
+          echo "----"
+          cat response_errors.txt
+          echo "----"
+
+          if [ "$HTTP_STATUS" == "201" ]; then
+            echo ">> Pull Request created successfully!"
+            PR_URL=$(cat response_body.json | jq -r .html_url)
+            echo "pull-request-url=${PR_URL}" >> $GITEA_OUTPUT
+            PR_ID=$(cat response_body.json | jq -r .id)
+            echo "pull-request-id=${PR_ID}" >> $GITEA_OUTPUT
+            echo "pull-request-operation=created" >> $GITEA_OUTPUT
+
+          elif [ "$HTTP_STATUS" == "422" ]; then
+            echo ">> Failed to create PR (HTTP 422: Unprocessable Entity), PR may already exist"
+
+          elif [ "$HTTP_STATUS" == "409" ]; then
+            echo ">> Failed to create PR (HTTP 409: Conflict), PR already exists"
+
+          else
+            echo ">> Failed to create PR, HTTP status code: $HTTP_STATUS"
+            exit 1
+          fi
+
+          echo "----"
+
+      - name: ntfy Created
+        uses: niniyas/ntfy-action@master
+        if: steps.create-pull-request.outputs.pull-request-operation == 'created'
+        with:
+          url: "${{ secrets.NTFY_URL }}"
+          topic: "${{ secrets.NTFY_TOPIC }}"
+          title: "Manifest Render PR Created - Infrastructure"
+          priority: 3
+          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
+          tags: action,successfully,completed
+          details: "Manifest rendering for Infrastructure has created a new Pull Request with ID: ${{ steps.create-pull-request.outputs.pull-request-id }}!"
+          icon: "https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png"
+          actions: '[{"action": "view", "label": "Open Gitea", "url": "${{ steps.create-pull-request.outputs.pull-request-url }}", "clear": true}]'
+
+      - name: ntfy Failed
+        uses: niniyas/ntfy-action@master
+        if: failure()
+        with:
+          url: "${{ secrets.NTFY_URL }}"
+          topic: "${{ secrets.NTFY_TOPIC }}"
+          title: "Manifest Render Failure - Infrastructure"
+          priority: 4
+          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
+          tags: action,failed
+          details: "Manifest rendering for Infrastructure has failed!"
+          icon: "https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png"
+          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/infrastructure/actions?workflow=render-manifests.yaml", "clear": true}]'
+          image: true

.gitea/workflows/render-manifests-merge.yaml

@@ -0,0 +1,403 @@
+name: render-manifests-merge
+
+on:
+  pull_request:
+    branches:
+      - main
+    paths:
+      - 'clusters/cl01tl/helm/**'
+    types:
+      - closed
+
+env:
+  CLUSTER: cl01tl
+  BASE_BRANCH: manifests
+  BRANCH_NAME: auto/update-manifests
+  ASSIGNEE: alexlebens
+  MAIN_DIR: /workspace/alexlebens/infrastructure/infrastructure
+  MANIFEST_DIR: /workspace/alexlebens/infrastructure/infrastructure-manifests
+
+jobs:
+  render-manifests-merge:
+    runs-on: ubuntu-js
+    if: ${{ (github.event.pull_request.merged == true) && !(contains(github.event.pull_request.labels.*.name, 'automerge')) }}
+    steps:
+      - name: Checkout Main
+        uses: actions/checkout@v6
+        with:
+          path: infrastructure
+          fetch-depth: 0
+
+      - name: Checkout Manifests
+        uses: actions/checkout@v6
+        with:
+          ref: manifests
+          path: infrastructure-manifests
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v4
+        with:
+          token: ${{ secrets.GITEA_TOKEN }}
+          version: v3.17.2 # Pending https://github.com/helm/helm/pull/30743
+
+      - name: Prepare Manifest Branch
+        run: |
+          cd ${MANIFEST_DIR}
+
+          echo ">> Configure git to use gitea-bot as user ..."
+          git config user.name "gitea-bot"
+          git config user.email "gitea-bot@alexlebens.net"
+
+          echo ">> Checking if PR branch exists ..."
+          if [[ $(git ls-remote --heads origin "${BRANCH_NAME}" | wc -l) -gt 0 ]]; then
+            echo ">> Branch '${BRANCH_NAME}' exists, pulling changes ..."
+            git fetch origin "${BRANCH_NAME}"
+            git checkout "${BRANCH_NAME}"
+            git pull --rebase
+
+          else
+            echo ">> Branch '${BRANCH_NAME}' does not exist, creating ..."
+            git checkout -b $BRANCH_NAME
+          fi
+
+          echo "----"
+
+      - name: Check which Directories have Changes
+        id: check-dir-changes
+        run: |
+          cd ${MAIN_DIR}
+
+          RENDER_DIR=()
+
+          echo ">> Checking for changes from HEAD^..HEAD ..."
+          GIT_DIFF=$(git diff --name-only HEAD^..HEAD | xargs -I {} dirname {} | sort -u | grep -E "clusters/[^/]+/helm/[^/]+")
+
+          if [ -n "${GIT_DIFF}" ]; then
+            echo ">> Changes detected:"
+            echo "$GIT_DIFF"
+            for path in $GIT_DIFF; do
+              RENDER_DIR+=$(echo "$path" | awk -F '/' '{print $4}')
+              RENDER_DIR+=$(echo " ")
+            done
+
+          else
+            echo ">> No changes detected"
+
+          fi
+
+          if [ -n "${RENDER_DIR}" ]; then
+            echo ">> Directories to Render:"
+            echo "$(echo "${RENDER_DIR}" | sort -u)"
+
+            echo "----"
+
+            echo "changes-detected=true" >> $GITEA_OUTPUT
+            echo "render-dir<<EOF" >> $GITEA_OUTPUT
+            echo "$(echo "${RENDER_DIR}" | sort -u)" >> $GITEA_OUTPUT
+            echo "EOF" >> $GITEA_OUTPUT
+          else
+            echo "changes-detected=false" >> $GITEA_OUTPUT
+          fi
+
+      - name: Add Repositories
+        if: steps.check-dir-changes.outputs.changes-detected == 'true'
+        env:
+          RENDER_DIR: ${{ steps.check-dir-changes.outputs.render-dir }}
+        run: |
+          cd ${MAIN_DIR}
+
+          echo ">> Adding repositories for chart dependencies ..."
+          for dir in ${RENDER_DIR}; do
+            helm dependency list --max-col-width 120 ${MAIN_DIR}/clusters/${CLUSTER}/helm/$dir 2> /dev/null \
+              | tail +2 | head -n -1 \
+              | awk '{ print "helm repo add " $1 " " $3 }' \
+              | while read cmd; do echo "$cmd" | sh; done || true
+          done
+
+          if helm repo list | tail +2 | read -r; then
+            echo ">> Update repository cache ..."
+            helm repo update
+          fi
+
+          echo "----"
+
+      - name: Remove Changed Manifest Files
+        if: steps.check-dir-changes.outputs.changes-detected == 'true'
+        env:
+          RENDER_DIR: ${{ steps.check-dir-changes.outputs.render-dir }}
+        run: |
+          cd ${MANIFEST_DIR}
+
+          echo ">> Remove manfiest files and rebuild from source ..."
+
+          for dir in ${RENDER_DIR}; do
+            chart_path=${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$dir
+
+            echo "$chart_path"
+            rm -rf $chart_path/*
+          done
+
+          echo "----"
+
+      - name: Render Helm Manifests
+        id: render-manifests
+        if: steps.check-dir-changes.outputs.changes-detected == 'true'
+        env:
+          RENDER_DIR: ${{ steps.check-dir-changes.outputs.render-dir }}
+        run: |
+          cd ${MAIN_DIR}
+
+          echo ">> Rendering Manifests ..."
+
+          for dir in ${RENDER_DIR}; do
+            chart_path=${MAIN_DIR}/clusters/${CLUSTER}/helm/$dir
+            chart_name=$(basename "$chart_path")
+
+            echo ""
+            echo ""
+            echo ">> Rendering chart: $chart_name"
+            echo ">> Chart path $chart_path"
+
+            if [ -f "$chart_path/Chart.yaml" ]; then
+              OUTPUT_FOLDER="${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$chart_name/"
+              TEMPLATE=""
+
+              mkdir -p ${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$chart_name
+
+              cd $chart_path
+
+              echo ""
+              echo ">> Building helm dependency ..."
+              helm dependency build --skip-refresh
+
+              echo ""
+              echo ">> Linting helm ..."
+              helm lint --namespace "$chart_name"
+
+              echo ""
+              echo ">> Rendering templates ..."
+              case "$chart_name" in
+                "stack")
+                  echo ""
+                  echo ">> Special Rendering for stack into argocd namespace ..."
+                  TEMPLATE=$(helm template $chart_name ./ --namespace argocd --include-crds --dry-run)
+                  ;;
+                "cilium" | "coredns" | "metrics-server" |"prometheus-operator-crds")
+                  echo ""
+                  echo ">> Special Rendering for $chart_name into kube-system namespace ..."
+                  TEMPLATE=$(helm template $chart_name ./ --namespace kube-system --include-crds --dry-run)
+                  ;;
+                *)
+                  echo ""
+                  echo ">> Standard Rendering for $chart_name ..."
+                  TEMPLATE=$(helm template "$chart_name" ./ --namespace "$chart_name" --include-crds --dry-run)
+                  ;;
+              esac
+
+              echo ""
+              echo ">> Formating rendered template ..."
+              echo "$TEMPLATE" | yq '... comments=""' | yq 'select(. != null)' | yq -s '"'"$OUTPUT_FOLDER"'" + .kind + "-" + .metadata.name + ".yaml"'
+
+              echo ""
+              echo ">> Manifests for $chart_name rendered to $OUTPUT_FOLDER"
+              ls $OUTPUT_FOLDER
+              echo ""
+            else
+              echo ""
+              echo ">> Directory $chart_path does not contain a Chart.yaml. Skipping ..."
+              echo ""
+            fi
+          done
+
+          echo "----"
+
+      - name: Check for Changes
+        id: check-changes
+        if: steps.check-dir-changes.outputs.changes-detected == 'true'
+        run: |
+          cd ${MANIFEST_DIR}
+
+          GIT_CHANGES=$(git status --porcelain)
+
+          if [ -n "$GIT_CHANGES" ]; then
+            echo ">> Changes detected"
+            git status --porcelain
+            echo "changes-detected=true" >> $GITEA_OUTPUT
+
+          else
+            echo ">> No changes detected, skipping PR creation"
+
+          fi
+
+          echo "----"
+
+      - name: Commit and Push Changes
+        id: commit-push
+        if: steps.check-changes.outputs.changes-detected == 'true'
+        run: |
+          cd ${MANIFEST_DIR}
+
+          echo ">> Commiting changes to ${BRANCH_NAME} ..."
+          git add .
+          git commit -m "chore: Update manifests after change"
+
+          REPO_URL="${{ secrets.REPO_URL }}/${{ gitea.repository }}"
+          echo ">> Pushing changes to $REPO_URL ..."
+          git push -u "https://oauth2:${{ secrets.BOT_TOKEN }}@$(echo $REPO_URL | sed -e 's|https://||')" ${BRANCH_NAME}
+
+          echo "----"
+
+          echo "HEAD_BRANCH=${BRANCH_NAME}" >> $GITEA_OUTPUT
+          echo "push=true" >> $GITEA_OUTPUT
+
+      - name: Check for Pull Request
+        id: check-for-pull-requst
+        if: steps.commit-push.outputs.push == 'true'
+        env:
+          GITEA_TOKEN: ${{ secrets.BOT_TOKEN }}
+          GITEA_URL: ${{ secrets.REPO_URL }}
+          HEAD_BRANCH: ${{ steps.commit-push.outputs.HEAD_BRANCH }}
+        run: |
+          cd ${MANIFEST_DIR}
+
+          API_ENDPOINT="${GITEA_URL}/api/v1/repos/${{ gitea.repository }}/pulls?base_branch=${BASE_BRANCH}&state=open&page=1"
+
+          echo ">> Checking if PR from branch ${HEAD_BRANCH} into ${BASE_BRANCH}"
+          echo ">> With Endpoint of:"
+          echo "$API_ENDPOINT"
+
+          HTTP_STATUS=$(
+            curl -X GET \
+              --silent \
+              --write-out '%{http_code}' \
+              --output response_body.json \
+              --dump-header response_headers.txt \
+              -H "Authorization: token ${GITEA_TOKEN}" \
+              -H "Content-Type: application/json" \
+              "$API_ENDPOINT" 2> response_errors.txt
+          )
+
+          echo ">> HTTP Status Code: $HTTP_STATUS"
+          echo ">> Response Output ..."
+          echo "----"
+          cat response_body.json
+          echo "----"
+          cat response_headers.txt
+          echo "----"
+          cat response_errors.txt
+          echo "----"
+
+          if [ "$HTTP_STATUS" == "200" ] && [ "$(cat response_body.json | jq -r .[0].state)" == "open" ]; then
+            echo ">> Pull Request has been found open, will update"
+            PR_INDEX=$(cat response_body.json | jq -r .[0].number)
+            echo "pull-request-exists=${PR_INDEX}" >> $GITEA_OUTPUT
+            echo "pull-request-index=true" >> $GITEA_OUTPUT
+
+          elif [ "$HTTP_STATUS" == "200" ] && [ "$(cat response_body.json | jq -r .[0].state)" == "closed" ]; then
+            echo ">> Pull Request found, but was closed"
+            echo "pull-request-exists=false" >> $GITEA_OUTPUT
+
+          else
+            echo ">> Pull Request not found"
+            echo "pull-request-exists=false" >> $GITEA_OUTPUT
+          fi
+
+          echo "----"
+
+      - name: Create Pull Request
+        id: create-pull-request
+        if: steps.commit-push.outputs.push == 'true' && steps.check-for-pull-requst.outputs.pull-request-exists == 'false'
+        env:
+          GITEA_TOKEN: ${{ secrets.BOT_TOKEN }}
+          GITEA_URL: ${{ secrets.REPO_URL }}
+          HEAD_BRANCH: ${{ steps.commit-push.outputs.HEAD_BRANCH }}
+        run: |
+          cd ${MANIFEST_DIR}
+
+          API_ENDPOINT="${GITEA_URL}/api/v1/repos/${{ gitea.repository }}/pulls"
+
+          PAYLOAD=$( jq -n \
+            --arg head "${HEAD_BRANCH}" \
+            --arg base "${BASE_BRANCH}" \
+            --arg assignee "${ASSIGNEE}" \
+            --arg title "Automated Manifest Update" \
+            --arg body "This PR contains newly rendered Kubernetes manifests automatically generated by the CI workflow." \
+            '{head: $head, base: $base, assignee: $assignee, title: $title, body: $body}' )
+
+          echo ">> Creating PR from branch ${HEAD_BRANCH} into ${BASE_BRANCH}"
+          echo ">> With Endpoint of:"
+          echo "$API_ENDPOINT"
+          echo ">> With Payload of:"
+          echo "$PAYLOAD"
+
+          HTTP_STATUS=$(
+            curl -X POST \
+              --silent \
+              --write-out '%{http_code}' \
+              --output response_body.json \
+              --dump-header response_headers.txt \
+              --data "$PAYLOAD" \
+              -H "Authorization: token ${GITEA_TOKEN}" \
+              -H "Content-Type: application/json" \
+              "$API_ENDPOINT" 2> response_errors.txt
+          )
+
+          echo ">> HTTP Status Code: $HTTP_STATUS"
+          echo ">> Response Output ..."
+          echo "----"
+          cat response_body.json
+          echo "----"
+          cat response_headers.txt
+          echo "----"
+          cat response_errors.txt
+          echo "----"
+
+          if [ "$HTTP_STATUS" == "201" ]; then
+            echo ">> Pull Request created successfully!"
+            PR_URL=$(cat response_body.json | jq -r .html_url)
+            echo "pull-request-url=${PR_URL}" >> $GITEA_OUTPUT
+            PR_ID=$(cat response_body.json | jq -r .id)
+            echo "pull-request-id=${PR_ID}" >> $GITEA_OUTPUT
+            echo "pull-request-operation=created" >> $GITEA_OUTPUT
+
+          elif [ "$HTTP_STATUS" == "422" ]; then
+            echo ">> Failed to create PR (HTTP 422: Unprocessable Entity), PR may already exist"
+
+          elif [ "$HTTP_STATUS" == "409" ]; then
+            echo ">> Failed to create PR (HTTP 409: Conflict), PR already exists"
+
+          else
+            echo ">> Failed to create PR, HTTP status code: $HTTP_STATUS"
+            exit 1
+          fi
+
+          echo "----"
+
+      - name: ntfy Created
+        uses: niniyas/ntfy-action@master
+        if: steps.create-pull-request.outputs.pull-request-operation == 'created'
+        with:
+          url: "${{ secrets.NTFY_URL }}"
+          topic: "${{ secrets.NTFY_TOPIC }}"
+          title: "Manifest Render PR Created - Infrastructure"
+          priority: 3
+          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
+          tags: action,successfully,completed
+          details: "Manifest rendering for Infrastructure has created a new Pull Request with ID: ${{ steps.create-pull-request.outputs.pull-request-id }}!"
+          icon: "https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png"
+          actions: '[{"action": "view", "label": "Open Gitea", "url": "${{ steps.create-pull-request.outputs.pull-request-url }}", "clear": true}]'
+
+      - name: ntfy Failed
+        uses: niniyas/ntfy-action@master
+        if: failure()
+        with:
+          url: "${{ secrets.NTFY_URL }}"
+          topic: "${{ secrets.NTFY_TOPIC }}"
+          title: "Manifest Render Failure - Infrastructure"
+          priority: 4
+          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
+          tags: action,failed
+          details: "Manifest rendering for Infrastructure has failed!"
+          icon: "https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png"
+          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/infrastructure/actions?workflow=render-manifests.yaml", "clear": true}]'
+          image: true

.gitea/workflows/render-manifests-push.yaml

@@ -0,0 +1,401 @@
+name: render-manifests-push
+
+on:
+  push:
+    branches:
+      - main
+    paths:
+      - 'clusters/cl01tl/helm/**'
+
+env:
+  CLUSTER: cl01tl
+  BASE_BRANCH: manifests
+  BRANCH_NAME: auto/update-manifests
+  ASSIGNEE: alexlebens
+  MAIN_DIR: /workspace/alexlebens/infrastructure/infrastructure
+  MANIFEST_DIR: /workspace/alexlebens/infrastructure/infrastructure-manifests
+
+jobs:
+  render-manifests-push:
+    runs-on: ubuntu-js
+    if: gitea.event.commits[0].author.username != 'renovate-bot'
+    steps:
+      - name: Checkout Main
+        uses: actions/checkout@v6
+        with:
+          path: infrastructure
+          fetch-depth: 0
+
+      - name: Checkout Manifests
+        uses: actions/checkout@v6
+        with:
+          ref: manifests
+          path: infrastructure-manifests
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v4
+        with:
+          token: ${{ secrets.GITEA_TOKEN }}
+          version: v3.17.2 # Pending https://github.com/helm/helm/pull/30743
+
+      - name: Prepare Manifest Branch
+        run: |
+          cd ${MANIFEST_DIR}
+
+          echo ">> Configure git to use gitea-bot as user ..."
+          git config user.name "gitea-bot"
+          git config user.email "gitea-bot@alexlebens.net"
+
+          echo ">> Checking if PR branch exists ..."
+          if [[ $(git ls-remote --heads origin "${BRANCH_NAME}" | wc -l) -gt 0 ]]; then
+            echo ">> Branch '${BRANCH_NAME}' exists, pulling changes ..."
+            git fetch origin "${BRANCH_NAME}"
+            git checkout "${BRANCH_NAME}"
+            git pull --rebase
+
+          else
+            echo ">> Branch '${BRANCH_NAME}' does not exist, creating ..."
+            git checkout -b $BRANCH_NAME
+          fi
+
+          echo "----"
+
+      - name: Check which Directories have Changes
+        id: check-dir-changes
+        run: |
+          cd ${MAIN_DIR}
+
+          RENDER_DIR=()
+
+          echo ">> Checking for changes ..."
+          GIT_DIFF=$(git diff --name-only ${{ gitea.event.before }}..HEAD | xargs -I {} dirname {} | sort -u | grep -E "clusters/[^/]+/helm/[^/]+")
+
+          if [ -n "${GIT_DIFF}" ]; then
+            echo ">> Changes detected:"
+            echo "$GIT_DIFF"
+            for path in $GIT_DIFF; do
+              RENDER_DIR+=$(echo "$path" | awk -F '/' '{print $4}')
+              RENDER_DIR+=$(echo " ")
+            done
+
+          else
+            echo ">> No changes detected"
+
+          fi
+
+          if [ -n "${RENDER_DIR}" ]; then
+            echo ">> Directories to Render:"
+            echo "$(echo "${RENDER_DIR}" | sort -u)"
+
+            echo "----"
+
+            echo "changes-detected=true" >> $GITEA_OUTPUT
+            echo "render-dir<<EOF" >> $GITEA_OUTPUT
+            echo "$(echo "${RENDER_DIR}" | sort -u)" >> $GITEA_OUTPUT
+            echo "EOF" >> $GITEA_OUTPUT
+          else
+            echo "changes-detected=false" >> $GITEA_OUTPUT
+          fi
+
+      - name: Add Repositories
+        if: steps.check-dir-changes.outputs.changes-detected == 'true'
+        env:
+          RENDER_DIR: ${{ steps.check-dir-changes.outputs.render-dir }}
+        run: |
+          cd ${MAIN_DIR}
+
+          echo ">> Adding repositories for chart dependencies ..."
+          for dir in ${RENDER_DIR}; do
+            helm dependency list --max-col-width 120 ${MAIN_DIR}/clusters/${CLUSTER}/helm/$dir 2> /dev/null \
+              | tail +2 | head -n -1 \
+              | awk '{ print "helm repo add " $1 " " $3 }' \
+              | while read cmd; do echo "$cmd" | sh; done || true
+          done
+
+          if helm repo list | tail +2 | read -r; then
+            echo ">> Update repository cache ..."
+            helm repo update
+          fi
+
+          echo "----"
+
+      - name: Remove Changed Manifest Files
+        if: steps.check-dir-changes.outputs.changes-detected == 'true'
+        env:
+          RENDER_DIR: ${{ steps.check-dir-changes.outputs.render-dir }}
+        run: |
+          cd ${MANIFEST_DIR}
+
+          echo ">> Remove manfiest files and rebuild from source ..."
+
+          for dir in ${RENDER_DIR}; do
+            chart_path=${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$dir
+
+            echo "$chart_path"
+            rm -rf $chart_path/*
+          done
+
+          echo "----"
+
+      - name: Render Helm Manifests
+        id: render-manifests
+        if: steps.check-dir-changes.outputs.changes-detected == 'true'
+        env:
+          RENDER_DIR: ${{ steps.check-dir-changes.outputs.render-dir }}
+        run: |
+          cd ${MAIN_DIR}
+
+          echo ">> Rendering Manifests ..."
+
+          for dir in ${RENDER_DIR}; do
+            chart_path=${MAIN_DIR}/clusters/${CLUSTER}/helm/$dir
+            chart_name=$(basename "$chart_path")
+
+            echo ""
+            echo ""
+            echo ">> Rendering chart: $chart_name"
+            echo ">> Chart path $chart_path"
+
+            if [ -f "$chart_path/Chart.yaml" ]; then
+              OUTPUT_FOLDER="${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$chart_name/"
+              TEMPLATE=""
+
+              mkdir -p ${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$chart_name
+
+              cd $chart_path
+
+              echo ""
+              echo ">> Building helm dependency ..."
+              helm dependency build --skip-refresh
+
+              echo ""
+              echo ">> Linting helm ..."
+              helm lint --namespace "$chart_name"
+
+              echo ""
+              echo ">> Rendering templates ..."
+              case "$chart_name" in
+                "stack")
+                  echo ""
+                  echo ">> Special Rendering for stack into argocd namespace ..."
+                  TEMPLATE=$(helm template $chart_name ./ --namespace argocd --include-crds --dry-run)
+                  ;;
+                "cilium" | "coredns" | "metrics-server" |"prometheus-operator-crds")
+                  echo ""
+                  echo ">> Special Rendering for $chart_name into kube-system namespace ..."
+                  TEMPLATE=$(helm template $chart_name ./ --namespace kube-system --include-crds --dry-run)
+                  ;;
+                *)
+                  echo ""
+                  echo ">> Standard Rendering for $chart_name ..."
+                  TEMPLATE=$(helm template "$chart_name" ./ --namespace "$chart_name" --include-crds --dry-run)
+                  ;;
+              esac
+
+              echo ""
+              echo ">> Formating rendered template ..."
+              echo "$TEMPLATE" | yq '... comments=""' | yq 'select(. != null)' | yq -s '"'"$OUTPUT_FOLDER"'" + .kind + "-" + .metadata.name + ".yaml"'
+
+              echo ""
+              echo ">> Manifests for $chart_name rendered to $OUTPUT_FOLDER"
+              ls $OUTPUT_FOLDER
+              echo ""
+            else
+              echo ""
+              echo ">> Directory $chart_path does not contain a Chart.yaml. Skipping ..."
+              echo ""
+            fi
+          done
+
+          echo "----"
+
+      - name: Check for Changes
+        id: check-changes
+        if: steps.check-dir-changes.outputs.changes-detected == 'true'
+        run: |
+          cd ${MANIFEST_DIR}
+
+          GIT_CHANGES=$(git status --porcelain)
+
+          if [ -n "$GIT_CHANGES" ]; then
+            echo ">> Changes detected"
+            git status --porcelain
+            echo "changes-detected=true" >> $GITEA_OUTPUT
+
+          else
+            echo ">> No changes detected, skipping PR creation"
+
+          fi
+
+          echo "----"
+
+      - name: Commit and Push Changes
+        id: commit-push
+        if: steps.check-changes.outputs.changes-detected == 'true'
+        run: |
+          cd ${MANIFEST_DIR}
+
+          echo ">> Commiting changes to ${BRANCH_NAME} ..."
+          git add .
+          git commit -m "chore: Update manifests after change"
+
+          REPO_URL="${{ secrets.REPO_URL }}/${{ gitea.repository }}"
+          echo ">> Pushing changes to $REPO_URL ..."
+          git push -u "https://oauth2:${{ secrets.BOT_TOKEN }}@$(echo $REPO_URL | sed -e 's|https://||')" ${BRANCH_NAME}
+
+          echo "----"
+
+          echo "HEAD_BRANCH=${BRANCH_NAME}" >> $GITEA_OUTPUT
+          echo "push=true" >> $GITEA_OUTPUT
+
+      - name: Check for Pull Request
+        id: check-for-pull-requst
+        if: steps.commit-push.outputs.push == 'true'
+        env:
+          GITEA_TOKEN: ${{ secrets.BOT_TOKEN }}
+          GITEA_URL: ${{ secrets.REPO_URL }}
+          HEAD_BRANCH: ${{ steps.commit-push.outputs.HEAD_BRANCH }}
+        run: |
+          cd ${MANIFEST_DIR}
+
+          API_ENDPOINT="${GITEA_URL}/api/v1/repos/${{ gitea.repository }}/pulls?base_branch=${BASE_BRANCH}&state=open&page=1"
+
+          echo ">> Checking if PR from branch ${HEAD_BRANCH} into ${BASE_BRANCH}"
+          echo ">> With Endpoint of:"
+          echo "$API_ENDPOINT"
+
+          HTTP_STATUS=$(
+            curl -X GET \
+              --silent \
+              --write-out '%{http_code}' \
+              --output response_body.json \
+              --dump-header response_headers.txt \
+              -H "Authorization: token ${GITEA_TOKEN}" \
+              -H "Content-Type: application/json" \
+              "$API_ENDPOINT" 2> response_errors.txt
+          )
+
+          echo ">> HTTP Status Code: $HTTP_STATUS"
+          echo ">> Response Output ..."
+          echo "----"
+          cat response_body.json
+          echo "----"
+          cat response_headers.txt
+          echo "----"
+          cat response_errors.txt
+          echo "----"
+
+          if [ "$HTTP_STATUS" == "200" ] && [ "$(cat response_body.json | jq -r .[0].state)" == "open" ]; then
+            echo ">> Pull Request has been found open, will update"
+            PR_INDEX=$(cat response_body.json | jq -r .[0].number)
+            echo "pull-request-exists=${PR_INDEX}" >> $GITEA_OUTPUT
+            echo "pull-request-index=true" >> $GITEA_OUTPUT
+
+          elif [ "$HTTP_STATUS" == "200" ] && [ "$(cat response_body.json | jq -r .[0].state)" == "closed" ]; then
+            echo ">> Pull Request found, but was closed"
+            echo "pull-request-exists=false" >> $GITEA_OUTPUT
+
+          else
+            echo ">> Pull Request not found"
+            echo "pull-request-exists=false" >> $GITEA_OUTPUT
+          fi
+
+          echo "----"
+
+      - name: Create Pull Request
+        id: create-pull-request
+        if: steps.commit-push.outputs.push == 'true' && steps.check-for-pull-requst.outputs.pull-request-exists == 'false'
+        env:
+          GITEA_TOKEN: ${{ secrets.BOT_TOKEN }}
+          GITEA_URL: ${{ secrets.REPO_URL }}
+          HEAD_BRANCH: ${{ steps.commit-push.outputs.HEAD_BRANCH }}
+        run: |
+          cd ${MANIFEST_DIR}
+
+          API_ENDPOINT="${GITEA_URL}/api/v1/repos/${{ gitea.repository }}/pulls"
+
+          PAYLOAD=$( jq -n \
+            --arg head "${HEAD_BRANCH}" \
+            --arg base "${BASE_BRANCH}" \
+            --arg assignee "${ASSIGNEE}" \
+            --arg title "Automated Manifest Update" \
+            --arg body "This PR contains newly rendered Kubernetes manifests automatically generated by the CI workflow." \
+            '{head: $head, base: $base, assignee: $assignee, title: $title, body: $body}' )
+
+          echo ">> Creating PR from branch ${HEAD_BRANCH} into ${BASE_BRANCH}"
+          echo ">> With Endpoint of:"
+          echo "$API_ENDPOINT"
+          echo ">> With Payload of:"
+          echo "$PAYLOAD"
+
+          HTTP_STATUS=$(
+            curl -X POST \
+              --silent \
+              --write-out '%{http_code}' \
+              --output response_body.json \
+              --dump-header response_headers.txt \
+              --data "$PAYLOAD" \
+              -H "Authorization: token ${GITEA_TOKEN}" \
+              -H "Content-Type: application/json" \
+              "$API_ENDPOINT" 2> response_errors.txt
+          )
+
+          echo ">> HTTP Status Code: $HTTP_STATUS"
+          echo ">> Response Output ..."
+          echo "----"
+          cat response_body.json
+          echo "----"
+          cat response_headers.txt
+          echo "----"
+          cat response_errors.txt
+          echo "----"
+
+          if [ "$HTTP_STATUS" == "201" ]; then
+            echo ">> Pull Request created successfully!"
+            PR_URL=$(cat response_body.json | jq -r .html_url)
+            echo "pull-request-url=${PR_URL}" >> $GITEA_OUTPUT
+            PR_ID=$(cat response_body.json | jq -r .id)
+            echo "pull-request-id=${PR_ID}" >> $GITEA_OUTPUT
+            echo "pull-request-operation=created" >> $GITEA_OUTPUT
+
+          elif [ "$HTTP_STATUS" == "422" ]; then
+            echo ">> Failed to create PR (HTTP 422: Unprocessable Entity), PR may already exist"
+
+          elif [ "$HTTP_STATUS" == "409" ]; then
+            echo ">> Failed to create PR (HTTP 409: Conflict), PR already exists"
+
+          else
+            echo ">> Failed to create PR, HTTP status code: $HTTP_STATUS"
+            exit 1
+          fi
+
+          echo "----"
+
+      - name: ntfy Created
+        uses: niniyas/ntfy-action@master
+        if: steps.create-pull-request.outputs.pull-request-operation == 'created'
+        with:
+          url: "${{ secrets.NTFY_URL }}"
+          topic: "${{ secrets.NTFY_TOPIC }}"
+          title: "Manifest Render PR Created - Infrastructure"
+          priority: 3
+          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
+          tags: action,successfully,completed
+          details: "Manifest rendering for Infrastructure has created a new Pull Request with ID: ${{ steps.create-pull-request.outputs.pull-request-id }}!"
+          icon: "https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png"
+          actions: '[{"action": "view", "label": "Open Gitea", "url": "${{ steps.create-pull-request.outputs.pull-request-url }}", "clear": true}]'
+
+      - name: ntfy Failed
+        uses: niniyas/ntfy-action@master
+        if: failure()
+        with:
+          url: "${{ secrets.NTFY_URL }}"
+          topic: "${{ secrets.NTFY_TOPIC }}"
+          title: "Manifest Render Failure - Infrastructure"
+          priority: 4
+          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
+          tags: action,failed
+          details: "Manifest rendering for Infrastructure has failed!"
+          icon: "https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png"
+          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/infrastructure/actions?workflow=render-manifests.yaml", "clear": true}]'
+          image: true

.gitea/workflows/renovate.yaml

@@ -0,0 +1,32 @@
+name: renovate
+
+on:
+  schedule:
+    - cron: "@hourly"
+
+  push:
+    branches:
+      - main
+
+  workflow_dispatch:
+
+jobs:
+  renovate:
+    runs-on: ubuntu-latest
+    container: ghcr.io/renovatebot/renovate:42
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v6
+
+      - name: Renovate
+        run: renovate
+        env:
+          RENOVATE_PLATFORM: gitea
+          RENOVATE_ENDPOINT: ${{ vars.INSTANCE_URL }}
+          RENOVATE_REPOSITORIES: alexlebens/infrastructure
+          RENOVATE_GIT_AUTHOR: Renovate Bot <renovate-bot@alexlebens.net>
+          LOG_LEVEL: info
+          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
+          RENOVATE_GIT_PRIVATE_KEY: ${{ secrets.RENOVATE_GIT_PRIVATE_KEY }}
+          RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.RENOVATE_GITHUB_COM_TOKEN }}
+          RENOVATE_REDIS_URL: ${{ vars.RENOVATE_REDIS_URL }}

.github/renovate-update-notification/Dockerfile

@@ -1,2 +0,0 @@
-# This file is processed by Renovate bot so that it creates a PR on new major Renovate versions
-FROM renovate/renovate:39

.github/renovate.json

@@ -1,144 +0,0 @@
-{
-    "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-    "extends": [
-        "config:recommended",
-        "mergeConfidence:all-badges",
-        ":rebaseStalePrs"
-    ],
-    "timezone": "US/Central",
-    "schedule": [
-        "every weekday"
-    ],
-    "labels": [],
-    "prHourlyLimit": 0,
-    "prConcurrentLimit": 0,
-    "packageRules": [
-        {
-            "description": "Disables for non major Renovate version",
-            "matchFileNames": [
-                ".github/renovate-update-notification/Dockerfile"
-            ],
-            "matchUpdateTypes": [
-                "minor",
-                "patch",
-                "pin",
-                "digest",
-                "rollback"
-            ],
-            "enabled": false
-        },
-        {
-            "description": "Generate for major Renovate version",
-            "matchFileNames": [
-                ".github/renovate-update-notification/Dockerfile"
-            ],
-            "matchUpdateTypes": [
-                "major"
-            ],
-            "addLabels": [
-                "upgrade"
-            ],
-            "automerge": false
-        },
-        {
-            "description": "Label charts",
-            "matchDatasources": [
-                "helm"
-            ],
-            "addLabels": [
-                "chart"
-            ],
-            "automerge": false,
-            "minimumReleaseAge": "1 days"
-        },
-        {
-            "description": "Automerge chart patches",
-            "matchUpdateTypes": [
-                "patch"
-            ],
-            "matchDatasources": [
-                "helm"
-            ],
-            "addLabels": [
-                "chart"
-            ],
-            "automerge": true,
-            "automergeType": "branch",
-            "minimumReleaseAge": "1 days"
-        },
-        {
-            "description": "Label images",
-            "matchDatasources": [
-                "docker"
-            ],
-            "addLabels": [
-                "image"
-            ],
-            "automerge": false,
-            "minimumReleaseAge": "1 days"
-        },
-        {
-            "description": "Label images, linuxserver versioning, qbittorrent",
-            "matchDepNames": [
-                "ghcr.io/linuxserver/qbittorrent"
-            ],
-            "matchDatasources": [
-                "docker"
-            ],
-            "addLabels": [
-                "image"
-            ],
-            "versioning": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)-r(?<build>\\w+)-ls(?<release>\\d+)",
-            "automerge": false,
-            "minimumReleaseAge": "1 days"
-        },
-        {
-            "description": "Automerge onedr0p plex images",
-            "matchDepNames": [
-                "ghcr.io/onedr0p/plex"
-            ],
-            "matchDatasources": [
-                "docker"
-            ],
-            "addLabels": [
-                "image"
-            ],
-            "versioning": "regex:^(?<major>\\d+)\\.(?<minor>\\d+)\\.(?<patch>\\d+)\\.(?<build>\\d+)-(?<revision>.+)?$",
-            "automerge": true,
-            "automergeType": "branch"
-        },
-        {
-            "description": "Automerge image patches",
-            "matchUpdateTypes": [
-                "patch"
-            ],
-            "matchDatasources": [
-                "docker"
-            ],
-            "addLabels": [
-                "image"
-            ],
-            "automerge": true,
-            "automergeType": "branch",
-            "minimumReleaseAge": "1 days"
-        },
-        {
-            "description": "Automerge minor image changes",
-            "matchDepNames": [
-                "amazon/aws-cli"
-            ],
-            "matchUpdateTypes": [
-                "minor"
-            ],
-            "matchDatasources": [
-                "docker"
-            ],
-            "addLabels": [
-                "image"
-            ],
-            "automerge": true,
-            "automergeType": "branch",
-            "minimumReleaseAge": "1 days"
-        }
-    ]
-}

.github/workflows/lint-test.yaml

@@ -1,37 +0,0 @@
-name: lint-and-test-charts
-
-on: pull_request
-
-jobs:
-  lint-test:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-        with:
-          fetch-depth: 0
-
-      - name: Set up Helm
-        uses: azure/setup-helm@v4
-        with:
-          version: latest
-
-      - uses: actions/setup-python@v5
-        with:
-          python-version: "3.13"
-          check-latest: true
-
-      - name: Set up chart-testing
-        uses: helm/chart-testing-action@v2.6.1
-
-      - name: Run chart-testing (list-changed)
-        id: list-changed
-        run: |
-          changed=$(ct list-changed --target-branch ${{ github.event.repository.default_branch }})
-          if [[ -n "$changed" ]]; then
-            echo "changed=true" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Run chart-testing (lint)
-        if: steps.list-changed.outputs.changed == 'true'
-        run: ct lint --target-branch ${{ github.event.repository.default_branch }}

.gitignore

@@ -0,0 +1,3 @@
+/**/archive/
+/**/charts/
+/**/manifests/

clusters/cl01tl/applications/calibre-web-automated/Chart.yaml

@@ -1,21 +0,0 @@
-apiVersion: v2
-name: calibre-web-automated
-version: 1.0.0
-description: Calibre Web Automated
-keywords:
-  - calibre-web-automated
-  - books
-home: https://wiki.alexlebens.dev/doc/calibre-web-automated-1SMf1jPFsb
-sources:
-  - https://github.com/crocodilestick/Calibre-Web-Automator
-  - https://hub.docker.com/r/crocodilestick/calibre-web-automated
-  - https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: calibre-web-automated
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.6.0
-icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/calibre-web.png
-appVersion: V2.1.2

clusters/cl01tl/applications/calibre-web-automated/templates/persistent-volume-claim.yaml

@@ -1,40 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: calibre-web-automated-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: calibre-web-automated-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: storage
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  volumeName: calibre-web-automated-nfs-storage
-  storageClassName: nfs-client
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi
-
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: calibre-web-automated-ingest-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: calibre-web-automated-ingest-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: storage
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  volumeName: calibre-web-automated-ingest-nfs-storage
-  storageClassName: nfs-client
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi

clusters/cl01tl/applications/calibre-web-automated/templates/replication-source.yaml

@@ -1,30 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: calibre-web-automated-config-backup-source
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: calibre-web-automated-config-backup-source
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: backup
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  sourcePVC: calibre-web-automated-config
-  trigger:
-    schedule: 0 0 */3 * *
-  restic:
-    pruneIntervalDays: 30
-    repository: calibre-web-automated-config-backup-secret
-    retain:
-      hourly: 1
-      daily: 1
-      weekly: 1
-      monthly: 2
-      yearly: 4
-    moverSecurityContext:
-      runAsUser: 1000
-      runAsGroup: 100
-    copyMethod: Snapshot
-    storageClassName: ceph-block-delete
-    volumeSnapshotClassName: ceph-blockpool-snapshot

clusters/cl01tl/applications/calibre-web-automated/values.yaml

@@ -1,151 +0,0 @@
-calibre-web-automated:
-  controllers:
-    main:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      containers:
-        main:
-          image:
-            repository: crocodilestick/calibre-web-automated
-            tag: V2.1.2@sha256:64cc0b6a563ef626c0f905792d6be976251149b30ee1e7fb49d60ef3ee966cb6
-            pullPolicy: IfNotPresent
-          env:
-            - name: TZ
-              value: US/Central
-            - name: PUID
-              value: 1000
-            - name: PGID
-              value: 100
-            - name: DOCKER_MODS
-              value: lscr.io/linuxserver/mods:universal-calibre-v7.23.0
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-    downloader:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      containers:
-        main:
-          image:
-            repository: ghcr.io/calibrain/calibre-web-automated-book-downloader
-            tag: latest@sha256:883cda846dcb118fa712a857666d7b3a118b41cf1a682dd3330c65ea854acdb6
-            pullPolicy: IfNotPresent
-          env:
-            - name: FLASK_PORT
-              value: 8084
-            - name: UID
-              value: 1000
-            - name: GID
-              value: 100
-            - name: USE_CF_BYPASS
-              value: true
-            - name: CLOUDFLARE_PROXY_URL
-              value: http://localhost:8000
-            - name: INGEST_DIR
-              value: /cwa-book-ingest
-            - name: BOOK_LANGUAGE
-              value: end
-          resources:
-            requests:
-              cpu: 10m
-              memory: 256Mi
-        bypass:
-          image:
-            repository: ghcr.io/sarperavci/cloudflarebypassforscraping
-            tag: latest@sha256:69849f217cbb231f3b5f5cb6d5ee15160b9c77b131072a4cc02b88c5b584378d
-            pullPolicy: IfNotPresent
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
-  serviceAccount:
-    create: true
-  service:
-    main:
-      controller: main
-      ports:
-        http:
-          port: 8083
-          targetPort: 8083
-          protocol: HTTP
-    downloader:
-      controller: downloader
-      ports:
-        http:
-          port: 8084
-          targetPort: 8084
-          protocol: HTTP
-  ingress:
-    tailscale-main:
-      enabled: true
-      className: tailscale
-      hosts:
-        - host: calibre-cl01tl
-          paths:
-            - path: /
-              pathType: Prefix
-              service:
-                name: calibre-web-automated-main
-                port: 8083
-      tls:
-        - hosts:
-            - calibre-cl01tl
-    tailscale-downloader:
-      enabled: true
-      className: tailscale
-      hosts:
-        - host: calibre-downloader-cl01tl
-          paths:
-            - path: /
-              pathType: Prefix
-              service:
-                name: calibre-web-automated-downloader
-                port: 8084
-      tls:
-        - hosts:
-            - calibre-downloader-cl01tl
-  persistence:
-    config:
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 5Gi
-      retain: true
-      advancedMounts:
-        main:
-          main:
-            - path: /config
-              readOnly: false
-    gmail:
-      enabled: true
-      type: secret
-      name: calibre-web-automated-gmail-config
-      advancedMounts:
-        main:
-          main:
-            - path: /app/calibre-web/gmail.json
-              readOnly: true
-              mountPropagation: None
-              subPath: gmail.json
-    books:
-      existingClaim: calibre-web-automated-nfs-storage
-      advancedMounts:
-        main:
-          main:
-            - path: /calibre-library
-              readOnly: false
-    ingest:
-      existingClaim: calibre-web-automated-ingest-nfs-storage
-      advancedMounts:
-        main:
-          main:
-            - path: /cwa-book-ingest
-              readOnly: false
-        downloader:
-          main:
-            - path: /cwa-book-ingest
-              readOnly: false

clusters/cl01tl/applications/code-server/Chart.yaml

@@ -1,28 +0,0 @@
-apiVersion: v2
-name: code-server
-version: 1.0.0
-description: Code Server
-keywords:
-  - code-server
-  - code
-  - ide
-home: https://wiki.alexlebens.dev/doc/code-server-1WziinqCFS
-sources:
-  - https://github.com/coder/code-server
-  - https://github.com/cloudflare/cloudflared
-  - https://hub.docker.com/r/linuxserver/code-server
-  - https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/alexlebens/helm-charts/tree/main/charts/cloudflared
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: code-server
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.6.0
-  - name: cloudflared
-    alias: cloudflared
-    repository: http://alexlebens.github.io/helm-charts
-    version: 1.12.4
-icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/code-server.png
-appVersion: 4.96.1

clusters/cl01tl/applications/directus/Chart.yaml

@@ -1,44 +0,0 @@
-apiVersion: v2
-name: directus
-version: 1.0.0
-description: Directus
-keywords:
-  - directus
-  - cms
-home: https://wiki.alexlebens.dev/doc/directus-EvV9wese9H
-sources:
-  - https://github.com/directus/directus
-  - https://github.com/minio/operator
-  - https://github.com/valkey-io/valkey
-  - https://github.com/cloudflare/cloudflared
-  - https://github.com/cloudnative-pg/cloudnative-pg
-  - https://hub.docker.com/r/directus/directus
-  - https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/minio/operator/tree/master/helm/tenant
-  - https://github.com/bitnami/charts/tree/main/bitnami/valkey
-  - https://github.com/alexlebens/helm-charts/charts/cloudflared
-  - https://github.com/alexlebens/helm-charts/charts/postgres-cluster
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: directus
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.6.0
-  - name: tenant
-    alias: minio
-    version: 6.0.4
-    repository: https://operator.min.io/
-  - name: valkey
-    version: 2.2.1
-    repository: https://charts.bitnami.com/bitnami
-  - name: cloudflared
-    alias: cloudflared-directus
-    repository: http://alexlebens.github.io/helm-charts
-    version: 1.12.4
-  - name: postgres-cluster
-    alias: postgres-17-cluster
-    version: 4.1.3
-    repository: http://alexlebens.github.io/helm-charts
-icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/directus.png
-appVersion: 11.3.2

clusters/cl01tl/applications/freshrss/Chart.yaml

@@ -1,33 +0,0 @@
-apiVersion: v2
-name: freshrss
-version: 1.0.0
-description: FreshRSS
-keywords:
-  - freshrss
-  - rss
-home: https://wiki.alexlebens.dev/doc/freshrss-W6nFVTmKJw
-sources:
-  - https://github.com/FreshRSS/FreshRSS
-  - https://github.com/cloudflare/cloudflared
-  - https://github.com/cloudnative-pg/cloudnative-pg
-  - https://hub.docker.com/r/freshrss/freshrss
-  - https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/alexlebens/helm-charts/tree/main/charts/cloudflared
-  - https://github.com/alexlebens/helm-charts/tree/main/charts/postgres-cluster
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: freshrss
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.6.0
-  - name: cloudflared
-    alias: cloudflared
-    repository: http://alexlebens.github.io/helm-charts
-    version: 1.12.4
-  - name: postgres-cluster
-    alias: postgres-17-cluster
-    version: 4.1.3
-    repository: http://alexlebens.github.io/helm-charts
-icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/freshrss.png
-appVersion: 1.24.3

clusters/cl01tl/applications/freshrss/values.yaml

@@ -1,132 +0,0 @@
-freshrss:
-  controllers:
-    main:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      containers:
-        main:
-          image:
-            repository: freshrss/freshrss
-            tag: 1.25.0
-            pullPolicy: IfNotPresent
-          env:
-            - name: PGID
-              value: "568"
-            - name: PUID
-              value: "568"
-            - name: TZ
-              value: US/Central
-            - name: FRESHRSS_ENV
-              value: production
-            - name: CRON_MIN
-              value: 13,43
-            - name: BASE_URL
-              value: https://rss.alexlebens.dev
-            - name: DB_HOST
-              valueFrom:
-                secretKeyRef:
-                  name: freshrss-postgresql-17-cluster-app
-                  key: host
-            - name: DB_BASE
-              valueFrom:
-                secretKeyRef:
-                  name: freshrss-postgresql-17-cluster-app
-                  key: dbname
-            - name: DB_USER
-              valueFrom:
-                secretKeyRef:
-                  name: freshrss-postgresql-17-cluster-app
-                  key: user
-            - name: DB_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: freshrss-postgresql-17-cluster-app
-                  key: password
-            - name: FRESHRSS_INSTALL
-              value: |
-                --api-enabled
-                --base-url $(BASE_URL)
-                --db-base $(DB_BASE)
-                --db-host $(DB_HOST)
-                --db-password $(DB_PASSWORD)
-                --db-type pgsql
-                --db-user $(DB_USER)
-                --auth-type http_auth
-                --default-user admin
-                --language en
-            - name: FRESHRSS_USER
-              value: |
-                --api-password $(ADMIN_API_PASSWORD)
-                --email $(ADMIN_EMAIL)
-                --language en
-                --password $(ADMIN_PASSWORD)
-                --user admin
-            - name: OIDC_ENABLED
-              value: 1
-            - name: OIDC_PROVIDER_METADATA_URL
-              value: https://auth.alexlebens.dev/application/o/freshrss/.well-known/openid-configuration
-            - name: OIDC_X_FORWARDED_HEADERS
-              value: X-Forwarded-Port X-Forwarded-Proto X-Forwarded-Host
-            - name: OIDC_SCOPES
-              value: openid email profile
-            - name: OIDC_REMOTE_USER_CLAIM
-              value: preferred_username
-          envFrom:
-            - secretRef:
-                name: freshrss-oidc-secret
-            - secretRef:
-                name: freshrss-install-secret
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
-  serviceAccount:
-    create: true
-  service:
-    main:
-      controller: main
-      ports:
-        http:
-          port: 80
-          targetPort: 80
-          protocol: HTTP
-  persistence:
-    data:
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 5Gi
-      retain: true
-      advancedMounts:
-        main:
-          main:
-            - path: /var/www/FreshRSS/data
-              readOnly: false
-    extensions:
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 1Gi
-      retain: true
-      advancedMounts:
-        main:
-          main:
-            - path: /var/www/FreshRSS/extensions
-              readOnly: false
-cloudflared:
-  existingSecretName: freshrss-cloudflared-secret
-postgres-17-cluster:
-  mode: standalone
-  cluster:
-    walStorage:
-      storageClass: local-path
-    storage:
-      storageClass: local-path
-    monitoring:
-      enabled: true
-  backup:
-    enabled: true
-    endpointURL: https://nyc3.digitaloceanspaces.com
-    destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/freshrss/freshrss-postgresql-17-cluster
-    endpointCredentials: freshrss-postgresql-17-cluster-backup-secret
-    backupIndex: 1

clusters/cl01tl/applications/hoarder/Chart.yaml

@@ -1,32 +0,0 @@
-apiVersion: v2
-name: hoarder
-version: 1.0.0
-description: Hoarder
-keywords:
-  - hoarder
-  - bookmarks
-home: https://wiki.alexlebens.dev/doc/hoarder-
-sources:
-  - https://github.com/hoarder-app/hoarder
-  - https://github.com/cloudflare/cloudflared
-  - https://github.com/meilisearch/meilisearch
-  - https://github.com/hoarder-app/hoarder/pkgs/container/hoarder
-  - https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/alexlebens/helm-charts/tree/main/charts/cloudflared
-  - https://github.com/meilisearch/meilisearch-kubernetes/tree/main/charts/meilisearch
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: hoarder
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.6.0
-  - name: meilisearch
-    version: 0.11.0
-    repository: https://meilisearch.github.io/meilisearch-kubernetes
-  - name: cloudflared
-    alias: cloudflared
-    repository: http://alexlebens.github.io/helm-charts
-    version: 1.12.4
-icon: https://cdn.jsdelivr.net/gh/selfhst/icons/svg/hoarder.svg
-appVersion: 0.19.0

clusters/cl01tl/applications/homepage-dev/Chart.yaml

@@ -1,27 +0,0 @@
-apiVersion: v2
-name: homepage
-version: 1.0.0
-description: Homepage
-keywords:
-  - homepage
-  - dashboard
-home: https://wiki.alexlebens.dev/doc/homepage-dev-crZPAd8FEj
-sources:
-  - https://github.com/gethomepage/homepage
-  - https://github.com/cloudflare/cloudflared
-  - https://github.com/gethomepage/homepage/pkgs/container/homepage
-  - https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/alexlebens/helm-charts/tree/main/charts/cloudflared
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: homepage
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.6.0
-  - name: cloudflared
-    alias: cloudflared
-    repository: http://alexlebens.github.io/helm-charts
-    version: 1.12.4
-icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/homepage.png
-appVersion: v0.10.0

clusters/cl01tl/applications/immich/Chart.yaml

@@ -1,31 +0,0 @@
-apiVersion: v2
-name: immich
-version: 1.0.0
-description: Immich
-keywords:
-  - immich
-  - photos
-home: https://wiki.alexlebens.dev/doc/immich-AVxvAWeWQ5
-sources:
-  - https://github.com/immich-app/immich
-  - https://github.com/valkey-io/valkey
-  - https://github.com/cloudnative-pg/cloudnative-pg
-  - https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/bitnami/charts/tree/main/bitnami/valkey
-  - https://github.com/alexlebens/helm-charts/charts/postgres-cluster
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: immich
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.6.0
-  - name: valkey
-    version: 2.2.1
-    repository: https://charts.bitnami.com/bitnami
-  - name: postgres-cluster
-    alias: postgres-16-cluster
-    version: 4.1.3
-    repository: http://alexlebens.github.io/helm-charts
-icon: https://raw.githubusercontent.com/immich-app/immich/main/design/immich-logo.svg
-appVersion: v1.123.0

clusters/cl01tl/applications/immich/templates/external-secrets.yaml

@@ -1,55 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: immich-config-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: immich-config-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: config
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: immich-config.yaml
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/immich/config
-        metadataPolicy: None
-        property: immich-config.yaml
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: immich-postgresql-16-cluster-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: immich-postgresql-16-cluster-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: database
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
-        property: access
-    - secretKey: ACCESS_SECRET_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
-        property: secret

clusters/cl01tl/applications/jellyfin/Chart.yaml

@@ -1,27 +0,0 @@
-apiVersion: v2
-name: jellyfin
-version: 1.0.0
-description: Jellyfin
-keywords:
-  - jellyfin
-  - media
-  - movies
-  - tv shows
-  - books
-  - music
-home: https://wiki.alexlebens.dev/doc/jellyfin-li98lrEiuA
-sources:
-  - https://github.com/jellyfin/jellyfin
-  - https://github.com/jellyfin/jellyfin-vue
-  - https://hub.docker.com/r/jellyfin/jellyfin
-  - https://github.com/jellyfin/jellyfin-vue/pkgs/container/jellyfin-vue
-  - https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: jellyfin
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.6.0
-icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/jellyfin.png
-appVersion: 10.10.3

clusters/cl01tl/applications/jellystat/Chart.yaml

@@ -1,27 +0,0 @@
-apiVersion: v2
-name: jellystat
-version: 1.0.0
-description: Jellystat
-keywords:
-  - jellystat
-  - jellyfin
-home: https://wiki.alexlebens.dev/doc/jellystat-0FixP7GqGZ
-sources:
-  - https://github.com/CyferShepard/Jellystat
-  - https://github.com/cloudnative-pg/cloudnative-pg
-  - https://hub.docker.com/r/cyfershepard/jellystat
-  - https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/alexlebens/helm-charts/charts/postgres-cluster
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: jellystat
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.6.0
-  - name: postgres-cluster
-    alias: postgres-17-cluster
-    version: 4.1.3
-    repository: http://alexlebens.github.io/helm-charts
-icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/jellystat.png
-appVersion: 1.1.1

clusters/cl01tl/applications/libation/Chart.yaml

@@ -1,22 +0,0 @@
-apiVersion: v2
-name: libation
-version: 1.0.0
-description: Libation
-keywords:
-  - libation
-  - audiobooks
-  - audible
-home: https://wiki.alexlebens.dev/doc/libation-bbiuA1SKtu
-sources:
-  - https://github.com/rmcrackan/Libation
-  - https://hub.docker.com/r/rmcrackan/libation
-  - https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: libation
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.6.0
-icon: https://getlibation.com/images/libation-logo.png
-appVersion: 11.6.3

clusters/cl01tl/applications/lidarr2/Chart.yaml

@@ -1,30 +0,0 @@
-apiVersion: v2
-name: lidarr2
-version: 1.0.0
-description: Lidarr
-keywords:
-  - lidarr
-  - servarr
-  - music
-  - metrics
-home: https://wiki.alexlebens.dev/doc/lidarr-BIqpxux60p
-sources:
-  - https://github.com/Lidarr/Lidarr
-  - https://github.com/linuxserver/docker-lidarr
-  - https://github.com/cloudnative-pg/cloudnative-pg
-  - https://github.com/onedr0p/exportarr/pkgs/container/exportarr
-  - https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/alexlebens/helm-charts/charts/postgres-cluster
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: lidarr2
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.6.0
-  - name: postgres-cluster
-    alias: postgres-17-cluster
-    version: 4.1.3
-    repository: http://alexlebens.github.io/helm-charts
-icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/lidarr.png
-appVersion: 2.8.2

clusters/cl01tl/applications/outline/Chart.yaml

@@ -1,49 +0,0 @@
-apiVersion: v2
-name: outline
-version: 1.0.0
-description: Outline
-keywords:
-  - outline
-  - wiki
-  - documentation
-home: https://wiki.alexlebens.dev/doc/outline-JOaS8Mn0Bt
-sources:
-  - https://github.com/outline/outline
-  - https://github.com/minio/operator
-  - https://github.com/valkey-io/valkey
-  - https://github.com/cloudflare/cloudflared
-  - https://github.com/cloudnative-pg/cloudnative-pg
-  - https://hub.docker.com/r/outlinewiki/outline
-  - https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/minio/operator/tree/master/helm/tenant
-  - https://github.com/bitnami/charts/tree/main/bitnami/valkey
-  - https://github.com/alexlebens/helm-charts/charts/cloudflared
-  - https://github.com/alexlebens/helm-charts/charts/postgres-cluster
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: outline
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.6.0
-  - name: tenant
-    alias: minio
-    version: 6.0.4
-    repository: https://operator.min.io/
-  - name: valkey
-    version: 2.2.1
-    repository: https://charts.bitnami.com/bitnami
-  - name: cloudflared
-    alias: cloudflared-outline
-    repository: http://alexlebens.github.io/helm-charts
-    version: 1.12.4
-  - name: cloudflared
-    alias: cloudflared-minio
-    repository: http://alexlebens.github.io/helm-charts
-    version: 1.12.4
-  - name: postgres-cluster
-    alias: postgres-17-cluster
-    version: 4.1.3
-    repository: http://alexlebens.github.io/helm-charts
-icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/outline.png
-appVersion: 0.81.1

clusters/cl01tl/applications/outline/templates/external-secret.yaml

@@ -1,226 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: outline-key-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: outline-key-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: secret-key
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/outline/key
-        metadataPolicy: None
-        property: secret-key
-    - secretKey: utils-key
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/outline/key
-        metadataPolicy: None
-        property: utils-key
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: outline-oidc-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: outline-oidc-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: client
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /authentik/oidc/outline
-        metadataPolicy: None
-        property: client
-    - secretKey: secret
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /authentik/oidc/outline
-        metadataPolicy: None
-        property: secret
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: outline-minio-user-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: outline-minio-user-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: database
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/outline/minio/auth
-        metadataPolicy: None
-        property: AWS_ACCESS_KEY_ID
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/outline/minio/auth
-        metadataPolicy: None
-        property: AWS_SECRET_ACCESS_KEY
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: outline-minio-root-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: outline-minio-root-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: database
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: config.env
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/outline/minio/config
-        metadataPolicy: None
-        property: root-config.env
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: outline-cloudflared-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: outline-cloudflared-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: cf-tunnel-token
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cloudflare/tunnels/outline
-        metadataPolicy: None
-        property: token
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: outline-minio-cloudflared-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: outline-cloudflared-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: cf-tunnel-token
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cloudflare/tunnels/outline-minio
-        metadataPolicy: None
-        property: token
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: outline-minio-config-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: outline-minio-config-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: database
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: config.env
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/outline/minio/config
-        metadataPolicy: None
-        property: config.env
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: outline-postgresql-17-cluster-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: outline-postgresql-17-cluster-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: database
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
-        property: access
-    - secretKey: ACCESS_SECRET_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
-        property: secret

clusters/cl01tl/applications/overseerr/Chart.yaml

@@ -1,21 +0,0 @@
-apiVersion: v2
-name: overseerr
-version: 1.0.0
-description: Overseerr
-keywords:
-  - overseer
-  - media
-  - request
-home: https://wiki.alexlebens.dev/doc/overseerr-pCUN6XnGR5
-sources:
-  - https://github.com/sct/overseerr
-  - https://github.com/sct/overseerr/pkgs/container/overseerr
-  - https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.6.0
-icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/overseerr.png
-appVersion: 1.33.2

clusters/cl01tl/applications/photoview/Chart.yaml

@@ -1,28 +0,0 @@
-apiVersion: v2
-name: photoview
-version: 1.0.0
-description: Photoview
-keywords:
-  - photoview
-  - pictures
-home: https://wiki.alexlebens.dev/doc/photoview-WSRscnhpwv
-sources:
-  - https://github.com/immich-app/immich
-  - https://github.com/valkey-io/valkey
-  - https://github.com/cloudnative-pg/cloudnative-pg
-  - https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/bitnami/charts/tree/main/bitnami/valkey
-  - https://github.com/alexlebens/helm-charts/charts/postgres-cluster
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: photoview
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.6.0
-  - name: postgres-cluster
-    alias: postgres-17-cluster
-    version: 4.1.3
-    repository: http://alexlebens.github.io/helm-charts
-icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/photoview.png
-appVersion: 2.4.0

clusters/cl01tl/applications/photoview/templates/external-secrets.yaml

@@ -1,30 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: photoview-postgresql-17-cluster-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: photoview-postgresql-17-cluster-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: database
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
-        property: access
-    - secretKey: ACCESS_SECRET_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
-        property: secret

clusters/cl01tl/applications/photoview/values.yaml

@@ -1,89 +0,0 @@
-photoview:
-  controllers:
-    main:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      containers:
-        main:
-          image:
-            repository: photoview/photoview
-            tag: 2.4.0
-            pullPolicy: IfNotPresent
-          env:
-            - name: PHOTOVIEW_DATABASE_DRIVER
-              value: postgres
-            - name: PHOTOVIEW_POSTGRES_URL
-              valueFrom:
-                secretKeyRef:
-                  name: photoview-postgresql-17-cluster-app
-                  key: uri
-            - name: PHOTOVIEW_VIDEO_HARDWARE_ACCELERATION
-              value: qsv
-          resources:
-            requests:
-              gpu.intel.com/i915: 1
-              cpu: 10m
-              memory: 512Mi
-            limits:
-              gpu.intel.com/i915: 1
-  serviceAccount:
-    create: true
-  service:
-    main:
-      controller: main
-      ports:
-        http:
-          port: 80
-          targetPort: 80
-          protocol: HTTP
-  ingress:
-    main:
-      enabled: true
-      className: tailscale
-      hosts:
-        - host: photoview-cl01tl
-          paths:
-            - path: /
-              pathType: Prefix
-              service:
-                name: photoview
-                port: 80
-      tls:
-        - hosts:
-            - photoview-cl01tl
-  persistence:
-    media:
-      existingClaim: photoview-nfs-storage
-      advancedMounts:
-        main:
-          main:
-            - path: /photos
-              readOnly: true
-    cache:
-      storageClass: ceph-block-delete
-      accessMode: ReadWriteOnce
-      size: 10Gi
-      retain: false
-      advancedMounts:
-        main:
-          main:
-            - path: /home/photoview/media-cache
-              readOnly: false
-postgres-17-cluster:
-  mode: standalone
-  cluster:
-    walStorage:
-      storageClass: local-path
-    storage:
-      storageClass: local-path
-    monitoring:
-      enabled: true
-  backup:
-    enabled: true
-    endpointURL: https://nyc3.digitaloceanspaces.com
-    destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/photoview/photoview-postgresql-17-cluster
-    endpointCredentials: photoview-postgresql-17-cluster-backup-secret
-    backupIndex: 1
-    retentionPolicy: "7d"

clusters/cl01tl/applications/plex/Chart.yaml

@@ -1,25 +0,0 @@
-apiVersion: v2
-name: plex
-version: 1.0.0
-description: Plex
-keywords:
-  - plex
-  - tv shows
-  - movies
-  - music
-  - photos
-  - live tv
-home: https://wiki.alexlebens.dev/doc/plex-seA2AdTB59
-sources:
-  - https://www.plex.tv/
-  - https://github.com/onedr0p/containers/pkgs/container/plex
-  - https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: plex
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.6.0
-icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/plex.png
-appVersion: 1.41.3.9292

clusters/cl01tl/applications/prowlarr/Chart.yaml

@@ -1,22 +0,0 @@
-apiVersion: v2
-name: prowlarr
-version: 1.0.0
-description: Prowlarr
-keywords:
-  - prowlarr
-  - servarr
-  - trackers
-home: https://wiki.alexlebens.dev/doc/prowlarr-ERparmlGES
-sources:
-  - https://github.com/Prowlarr/Prowlarr
-  - https://github.com/onedr0p/containers/pkgs/container/prowlarr
-  - https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: prowlarr
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.6.0
-icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/prowlarr.png
-appVersion: 1.28.2.4885

clusters/cl01tl/applications/prowlarr/values.yaml

@@ -1,84 +0,0 @@
-prowlarr:
-  controllers:
-    main:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      pod:
-        securityContext:
-          runAsUser: 568
-          runAsGroup: 568
-          fsGroup: 568
-          fsGroupChangePolicy: OnRootMismatch
-          supplementalGroups:
-            - 44
-            - 100
-            - 109
-            - 65539
-      containers:
-        main:
-          image:
-            repository: ghcr.io/onedr0p/prowlarr
-            tag: 1.29.2.4915
-            pullPolicy: IfNotPresent
-          env:
-            - name: TZ
-              value: US/Central
-          probes:
-            liveness:
-              enabled: false
-              custom: true
-              spec:
-                exec:
-                  command:
-                  - /usr/bin/env
-                  - bash
-                  - -c
-                  - curl --fail localhost:8686/api/v1/system/status?apiKey=`IFS=\> && while
-                    read -d \< E C; do if [[ $E = "ApiKey" ]]; then echo $C; fi; done < /config/config.xml`
-                failureThreshold: 5
-                initialDelaySeconds: 60
-                periodSeconds: 10
-                successThreshold: 1
-                timeoutSeconds: 10
-          resources:
-            requests:
-              cpu: 10m
-              memory: 256Mi
-  serviceAccount:
-    create: true
-  service:
-    main:
-      controller: main
-      ports:
-        http:
-          port: 80
-          targetPort: 9696
-          protocol: HTTP
-  ingress:
-    tailscale:
-      enabled: true
-      className: tailscale
-      hosts:
-        - host: prowlarr-cl01tl
-          paths:
-            - path: /
-              pathType: Prefix
-              service:
-                name: prowlarr
-                port: 80
-      tls:
-        - hosts:
-            - prowlarr-cl01tl
-  persistence:
-    config:
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 1Gi
-      retain: true
-      advancedMounts:
-        main:
-          main:
-            - path: /config
-              readOnly: false

clusters/cl01tl/applications/radarr5-4k/Chart.yaml

@@ -1,31 +0,0 @@
-apiVersion: v2
-name: radarr5-4k
-version: 1.0.0
-description: Radarr v5 4K
-keywords:
-  - radarr
-  - servarr
-  - movies
-  - 4k
-  - metrics
-home: https://wiki.alexlebens.dev/doc/radarr-T6nPLajWDP
-sources:
-  - https://github.com/Radarr/Radarr
-  - https://github.com/cloudnative-pg/cloudnative-pg
-  - https://github.com/onedr0p/containers/pkgs/container/radarr
-  - https://github.com/onedr0p/exportarr/pkgs/container/exportarr
-  - https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/alexlebens/helm-charts/charts/postgres-cluster
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: radarr5-4k
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.6.0
-  - name: postgres-cluster
-    alias: postgres-17-cluster
-    version: 4.1.3
-    repository: http://alexlebens.github.io/helm-charts
-icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/radarr.png
-appVersion: 5.16.3

clusters/cl01tl/applications/radarr5-4k/templates/persistent-volume-claim.yaml

@@ -1,19 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: radarr5-4k-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: radarr5-4k-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: storage
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  volumeName: radarr5-4k-nfs-storage
-  storageClassName: nfs-client
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi

clusters/cl01tl/applications/radarr5-4k/templates/persistent-volume.yaml

@@ -1,25 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: radarr5-4k-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ .Release.Name }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: storage
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: nfs-client
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteMany
-  nfs:
-    path: /volume2/Storage
-    server: synologybond.alexlebens.net
-  mountOptions:
-    - vers=4
-    - minorversion=1
-    - noac

clusters/cl01tl/applications/radarr5-anime/Chart.yaml

@@ -1,31 +0,0 @@
-apiVersion: v2
-name: radarr5-anime
-version: 1.0.0
-description: Radarr v5 Anime
-keywords:
-  - radarr
-  - servarr
-  - movies
-  - anime
-  - metrics
-home: https://wiki.alexlebens.dev/doc/radarr-T6nPLajWDP
-sources:
-  - https://github.com/Radarr/Radarr
-  - https://github.com/cloudnative-pg/cloudnative-pg
-  - https://github.com/linuxserver/docker-radarr
-  - https://github.com/onedr0p/exportarr/pkgs/container/exportarr
-  - https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/alexlebens/helm-charts/charts/postgres-cluster
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: radarr5-anime
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.6.0
-  - name: postgres-cluster
-    alias: postgres-17-cluster
-    version: 4.1.3
-    repository: http://alexlebens.github.io/helm-charts
-icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/radarr.png
-appVersion: 5.16.3

clusters/cl01tl/applications/radarr5-anime/templates/external-secret.yaml

@@ -1,89 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: radarr5-anime-config-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: radarr5-anime-config-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: backup
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/radarr5-anime/radarr5-anime-config"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: S3_BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: access_key
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: secret_key
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: radarr5-anime-postgresql-17-cluster-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: radarr5-anime-postgresql-17-cluster-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: database
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
-        property: access
-    - secretKey: ACCESS_SECRET_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
-        property: secret

clusters/cl01tl/applications/radarr5-anime/templates/persistent-volume-claim.yaml

@@ -1,19 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: radarr5-anime-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: radarr5-anime-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: storage
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  volumeName: radarr5-anime-nfs-storage
-  storageClassName: nfs-client
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi

clusters/cl01tl/applications/radarr5-anime/templates/persistent-volume.yaml

@@ -1,25 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: radarr5-anime-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ .Release.Name }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: storage
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: nfs-client
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteMany
-  nfs:
-    path: /volume2/Storage
-    server: synologybond.alexlebens.net
-  mountOptions:
-    - vers=4
-    - minorversion=1
-    - noac

clusters/cl01tl/applications/radarr5-anime/templates/prometheus-rule.yaml

@@ -1,34 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: PrometheusRule
-metadata:
-  name: radarr5-anime
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: radarr5-anime
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: metrics
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  groups:
-    - name: radarr5-anime
-      rules:
-        - alert: ExportarrAbsent
-          annotations:
-            description: Radarr5 Anime Exportarr has disappeared from Prometheus
-              service discovery.
-            summary: Exportarr is down.
-          expr: |
-            absent(up{job=~".*radarr5_anime.*"} == 1)
-          for: 5m
-          labels:
-            severity: critical
-        - alert: Radarr5animeDown
-          annotations:
-            description: Radarr5 Anime service is down.
-            summary: Radarr5 Anime is down.
-          expr: |
-            radarr5_anime_system_status{job=~".*radarr5_anime.*"} == 0
-          for: 5m
-          labels:
-            severity: critical

clusters/cl01tl/applications/radarr5-anime/templates/replication-source.yaml

@@ -1,30 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: radarr5-anime-config-backup-source
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: radarr5-anime-config-backup-source
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: backup
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  sourcePVC: radarr5-anime-config
-  trigger:
-    schedule: 0 0 */3 * *
-  restic:
-    pruneIntervalDays: 30
-    repository: radarr5-anime-config-backup-secret
-    retain:
-      hourly: 1
-      daily: 1
-      weekly: 1
-      monthly: 2
-      yearly: 4
-    moverSecurityContext:
-      fsGroup: 1000
-      fsGroupChangePolicy: OnRootMismatch
-    copyMethod: Snapshot
-    storageClassName: ceph-block-delete
-    volumeSnapshotClassName: ceph-blockpool-snapshot

clusters/cl01tl/applications/radarr5-anime/templates/service-monitor.yaml

@@ -1,21 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: radarr5-anime
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: radarr5-anime
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: metrics
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: radarr5-anime
-      app.kubernetes.io/instance: {{ .Release.Name }}
-  endpoints:
-    - port: metrics
-      interval: 3m
-      scrapeTimeout: 1m
-      path: /metrics

clusters/cl01tl/applications/radarr5-anime/values.yaml

@@ -1,139 +0,0 @@
-radarr5-anime:
-  controllers:
-    main:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      pod:
-        securityContext:
-          fsGroup: 1000
-          fsGroupChangePolicy: OnRootMismatch
-      containers:
-        main:
-          image:
-            repository: ghcr.io/linuxserver/radarr
-            tag: 5.17.2@sha256:dce7e81d08da67cf44437c7213d19faeef1323aa839712fbb53d1253ef94f93f
-            pullPolicy: IfNotPresent
-          env:
-            - name: TZ
-              value: US/Central
-            - name: PUID
-              value: 1000
-            - name: PGID
-              value: 1000
-          probes:
-            liveness:
-              enabled: false
-              custom: true
-              spec:
-                exec:
-                  command:
-                  - /usr/bin/env
-                  - bash
-                  - -c
-                  - curl --fail localhost:7878/api/v1/system/status?apiKey=`IFS=\> && while
-                    read -d \< E C; do if [[ $E = "ApiKey" ]]; then echo $C; fi; done < /config/config.xml`
-                failureThreshold: 5
-                initialDelaySeconds: 60
-                periodSeconds: 10
-                successThreshold: 1
-                timeoutSeconds: 10
-          resources:
-            requests:
-              cpu: 10m
-              memory: 256Mi
-        metrics:
-          image:
-            repository: ghcr.io/onedr0p/exportarr
-            tag: v2.0.1
-            pullPolicy: IfNotPresent
-          args: ["radarr"]
-          env:
-            - name: URL
-              value: http://localhost
-            - name: CONFIG
-              value: /config/config.xml
-            - name: PORT
-              value: 9793
-            - name: ENABLE_ADDITIONAL_METRICS
-              value: false
-            - name: ENABLE_UNKNOWN_QUEUE_ITEMS
-              value: false
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-  serviceAccount:
-    create: true
-  service:
-    main:
-      controller: main
-      ports:
-        http:
-          port: 80
-          targetPort: 7878
-          protocol: HTTP
-        metrics:
-          port: 9793
-          targetPort: 9793
-          protocol: TCP
-  ingress:
-    tailscale:
-      enabled: true
-      className: tailscale
-      hosts:
-        - host: radarr-anime-cl01tl
-          paths:
-            - path: /
-              pathType: Prefix
-              service:
-                name: radarr5-anime
-                port: 80
-      tls:
-        - hosts:
-            - radarr-anime-cl01tl
-  persistence:
-    config:
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 20Gi
-      retain: true
-      advancedMounts:
-        main:
-          main:
-            - path: /config
-              readOnly: false
-          metrics:
-            - path: /config
-              readOnly: true
-    media:
-      existingClaim: radarr5-anime-nfs-storage
-      advancedMounts:
-        main:
-          main:
-            - path: /mnt/store
-              readOnly: false
-postgres-17-cluster:
-  mode: standalone
-  cluster:
-    walStorage:
-      storageClass: local-path
-    storage:
-      storageClass: local-path
-    monitoring:
-      enabled: true
-  bootstrap:
-    initdb:
-      database: app
-      owner: app
-      postInitSQL:
-        - CREATE DATABASE "radarr-main" OWNER "app";
-        - CREATE DATABASE "radarr-log" OWNER "app";
-  backup:
-    enabled: true
-    endpointURL: https://nyc3.digitaloceanspaces.com
-    destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/radarr5-anime/radarr5-anime-postgresql-17-cluster
-    endpointCredentials: radarr5-anime-postgresql-17-cluster-backup-secret
-    backupIndex: 1
-    retentionPolicy: "7d"

clusters/cl01tl/applications/radarr5-standup/Chart.yaml

@@ -1,30 +0,0 @@
-apiVersion: v2
-name: radarr5-standup
-version: 1.0.0
-description: Radarr v5 Stand Up
-keywords:
-  - radarr
-  - servarr
-  - standup
-  - metrics
-home: https://wiki.alexlebens.dev/doc/radarr-T6nPLajWDP
-sources:
-  - https://github.com/Radarr/Radarr
-  - https://github.com/cloudnative-pg/cloudnative-pg
-  - https://github.com/linuxserver/docker-radarr
-  - https://github.com/onedr0p/exportarr/pkgs/container/exportarr
-  - https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/alexlebens/helm-charts/charts/postgres-cluster
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: radarr5-standup
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.6.0
-  - name: postgres-cluster
-    alias: postgres-17-cluster
-    version: 4.1.3
-    repository: http://alexlebens.github.io/helm-charts
-icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/radarr.png
-appVersion: 5.16.3

clusters/cl01tl/applications/radarr5-standup/templates/persistent-volume-claim.yaml

@@ -1,19 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: radarr5-standup-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: radarr5-standup-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: storage
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  volumeName: radarr5-standup-nfs-storage
-  storageClassName: nfs-client
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi

clusters/cl01tl/applications/radarr5-standup/templates/persistent-volume.yaml

@@ -1,25 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: radarr5-standup-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ .Release.Name }}
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: storage
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: nfs-client
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteMany
-  nfs:
-    path: /volume2/Storage
-    server: synologybond.alexlebens.net
-  mountOptions:
-    - vers=4
-    - minorversion=1
-    - noac

clusters/cl01tl/applications/radarr5-standup/templates/prometheus-rule.yaml

@@ -1,34 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: PrometheusRule
-metadata:
-  name: radarr5-standup
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: radarr5-standup
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: metrics
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  groups:
-    - name: radarr5-standup
-      rules:
-        - alert: ExportarrAbsent
-          annotations:
-            description: Radarr5 Stand Up Exportarr has disappeared from Prometheus
-              service discovery.
-            summary: Exportarr is down.
-          expr: |
-            absent(up{job=~".*radarr5_standup.*"} == 1)
-          for: 5m
-          labels:
-            severity: critical
-        - alert: Radarr5StandUpDown
-          annotations:
-            description: Radarr5 Stand Up service is down.
-            summary: Radarr5 Stand Up is down.
-          expr: |
-            radarr5_standup_system_status{job=~".*radarr5_standup.*"} == 0
-          for: 5m
-          labels:
-            severity: critical

clusters/cl01tl/applications/radarr5-standup/templates/service-monitor.yaml

@@ -1,21 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: radarr5-standup
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: radarr5-standup
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: metrics
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: radarr5-standup
-      app.kubernetes.io/instance: {{ .Release.Name }}
-  endpoints:
-    - port: metrics
-      interval: 3m
-      scrapeTimeout: 1m
-      path: /metrics

clusters/cl01tl/applications/radarr5-standup/values.yaml

@@ -1,139 +0,0 @@
-radarr5-standup:
-  controllers:
-    main:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      pod:
-        securityContext:
-          fsGroup: 1000
-          fsGroupChangePolicy: OnRootMismatch
-      containers:
-        main:
-          image:
-            repository: ghcr.io/linuxserver/radarr
-            tag: 5.17.2@sha256:dce7e81d08da67cf44437c7213d19faeef1323aa839712fbb53d1253ef94f93f
-            pullPolicy: IfNotPresent
-          env:
-            - name: TZ
-              value: US/Central
-            - name: PUID
-              value: 1000
-            - name: PGID
-              value: 1000
-          probes:
-            liveness:
-              enabled: false
-              custom: true
-              spec:
-                exec:
-                  command:
-                  - /usr/bin/env
-                  - bash
-                  - -c
-                  - curl --fail localhost:7878/api/v1/system/status?apiKey=`IFS=\> && while
-                    read -d \< E C; do if [[ $E = "ApiKey" ]]; then echo $C; fi; done < /config/config.xml`
-                failureThreshold: 5
-                initialDelaySeconds: 60
-                periodSeconds: 10
-                successThreshold: 1
-                timeoutSeconds: 10
-          resources:
-            requests:
-              cpu: 10m
-              memory: 256Mi
-        metrics:
-          image:
-            repository: ghcr.io/onedr0p/exportarr
-            tag: v2.0.1
-            pullPolicy: IfNotPresent
-          args: ["radarr"]
-          env:
-            - name: URL
-              value: http://localhost
-            - name: CONFIG
-              value: /config/config.xml
-            - name: PORT
-              value: 9793
-            - name: ENABLE_ADDITIONAL_METRICS
-              value: false
-            - name: ENABLE_UNKNOWN_QUEUE_ITEMS
-              value: false
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-  serviceAccount:
-    create: true
-  service:
-    main:
-      controller: main
-      ports:
-        http:
-          port: 80
-          targetPort: 7878
-          protocol: HTTP
-        metrics:
-          port: 9793
-          targetPort: 9793
-          protocol: TCP
-  ingress:
-    tailscale:
-      enabled: true
-      className: tailscale
-      hosts:
-        - host: radarr-standup-cl01tl
-          paths:
-            - path: /
-              pathType: Prefix
-              service:
-                name: radarr5-standup
-                port: 80
-      tls:
-        - hosts:
-            - radarr-standup-cl01tl
-  persistence:
-    config:
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 20Gi
-      retain: true
-      advancedMounts:
-        main:
-          main:
-            - path: /config
-              readOnly: false
-          metrics:
-            - path: /config
-              readOnly: true
-    media:
-      existingClaim: radarr5-standup-nfs-storage
-      advancedMounts:
-        main:
-          main:
-            - path: /mnt/store
-              readOnly: false
-postgres-17-cluster:
-  mode: standalone
-  cluster:
-    walStorage:
-      storageClass: local-path
-    storage:
-      storageClass: local-path
-    monitoring:
-      enabled: true
-  bootstrap:
-    initdb:
-      database: app
-      owner: app
-      postInitSQL:
-        - CREATE DATABASE "radarr-main" OWNER "app";
-        - CREATE DATABASE "radarr-log" OWNER "app";
-  backup:
-    enabled: true
-    endpointURL: https://nyc3.digitaloceanspaces.com
-    destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/radarr5-standup/radarr5-standup-postgresql-17-cluster
-    endpointCredentials: radarr5-standup-postgresql-17-cluster-backup-secret
-    backupIndex: 1
-    retentionPolicy: "7d"

clusters/cl01tl/applications/radarr5/Chart.yaml

@@ -1,30 +0,0 @@
-apiVersion: v2
-name: radarr5
-version: 1.0.0
-description: Radarr v5
-keywords:
-  - radarr
-  - servarr
-  - movies
-  - metrics
-home: https://wiki.alexlebens.dev/doc/radarr-T6nPLajWDP
-sources:
-  - https://github.com/Radarr/Radarr
-  - https://github.com/cloudnative-pg/cloudnative-pg
-  - https://github.com/onedr0p/containers/pkgs/container/radarr
-  - https://github.com/onedr0p/exportarr/pkgs/container/exportarr
-  - https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/alexlebens/helm-charts/charts/postgres-cluster
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: radarr5
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.6.0
-  - name: postgres-cluster
-    alias: postgres-17-cluster
-    version: 4.1.3
-    repository: http://alexlebens.github.io/helm-charts
-icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/radarr.png
-appVersion: 5.16.3.9541

clusters/cl01tl/applications/radarr5/templates/persistent-volume.yaml

@@ -1,25 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: radarr5-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: radarr5-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: storage
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: nfs-client
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteMany
-  nfs:
-    path: /volume2/Storage
-    server: synologybond.alexlebens.net
-  mountOptions:
-    - vers=4
-    - minorversion=1
-    - noac

clusters/cl01tl/applications/roundcube/Chart.yaml

@@ -1,27 +0,0 @@
-apiVersion: v2
-name: roundcube
-version: 1.0.0
-description: Roundcube
-keywords:
-  - roundcube
-  - email
-home: https://wiki.alexlebens.dev/doc/roundcube-miG1qbYSPs
-sources:
-  - https://github.com/roundcube/roundcubemail
-  - https://github.com/cloudnative-pg/cloudnative-pg
-  - https://hub.docker.com/r/roundcube/roundcubemail
-  - https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/alexlebens/helm-charts/charts/postgres-cluster
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: roundcube
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.6.0
-  - name: postgres-cluster
-    alias: postgres-17-cluster
-    version: 4.1.3
-    repository: http://alexlebens.github.io/helm-charts
-icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/roundcube.png
-appVersion: 1.6.9

clusters/cl01tl/applications/site-profile/Chart.yaml

@@ -1,28 +0,0 @@
-apiVersion: v2
-name: site-profile
-version: 1.0.0
-description: Site Profile
-keywords:
-  - site-profile
-  - astro
-home: https://wiki.alexlebens.dev/doc/site-profile-uoqXo94Yzd
-sources:
-  - https://github.com/alexlebens/site-profile
-  - https://github.com/withastro/astro
-  - https://github.com/cloudflare/cloudflared
-  - https://github.com/alexlebens/site-profile/pkgs/container/site-profile
-  - https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/alexlebens/helm-charts/charts/cloudflared
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: site-profile
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.6.0
-  - name: cloudflared
-    alias: cloudflared-site
-    repository: http://alexlebens.github.io/helm-charts
-    version: 1.12.4
-icon: https://d21zlbwtcn424f.cloudfront.net/icon_white.png
-appVersion: 0.5.5

clusters/cl01tl/applications/sonarr4-4k/Chart.yaml

@@ -1,31 +0,0 @@
-apiVersion: v2
-name: sonarr4-4k
-version: 1.0.0
-description: Sonarr v4 4K
-keywords:
-  - sonarr
-  - servarr
-  - tv shows
-  - 4k
-  - metrics
-home: https://wiki.alexlebens.dev/doc/sonarr-AvJLY9PxEy
-sources:
-  - https://github.com/Sonarr/Sonarr
-  - https://github.com/cloudnative-pg/cloudnative-pg
-  - https://github.com/onedr0p/containers/pkgs/container/sonarr
-  - https://github.com/onedr0p/exportarr/pkgs/container/exportarr
-  - https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/alexlebens/helm-charts/charts/postgres-cluster
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: sonarr4-4k
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.6.0
-  - name: postgres-cluster
-    alias: postgres-17-cluster
-    version: 4.1.3
-    repository: http://alexlebens.github.io/helm-charts
-icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/sonarr.png
-appVersion: 4.0.11

clusters/cl01tl/applications/sonarr4-4k/templates/external-secret.yaml

@@ -1,89 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: sonarr4-4k-config-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: sonarr4-4k-config-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: backup
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/sonarr4-4k/sonarr4-4k-config"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: S3_BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: access_key
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: secret_key
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: sonarr4-4k-postgresql-17-cluster-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: sonarr4-4k-postgresql-17-cluster-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: database
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
-        property: access
-    - secretKey: ACCESS_SECRET_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
-        property: secret

clusters/cl01tl/applications/sonarr4-4k/templates/persistent-volume-claim.yaml

@@ -1,19 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: sonarr4-4k-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: sonarr4-4k-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: storage
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  volumeName: sonarr4-4k-nfs-storage
-  storageClassName: nfs-client
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi

clusters/cl01tl/applications/sonarr4-4k/templates/persistent-volume.yaml

@@ -1,25 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: sonarr4-4k-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: sonarr4-4k-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: storage
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: nfs-client
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteMany
-  nfs:
-    path: /volume2/Storage
-    server: synologybond.alexlebens.net
-  mountOptions:
-    - vers=4
-    - minorversion=1
-    - noac

clusters/cl01tl/applications/sonarr4-4k/templates/prometheus-rule.yaml

@@ -1,34 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: PrometheusRule
-metadata:
-  name: sonarr4-4k
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: sonarr4-4k
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: metrics
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  groups:
-    - name: sonarr4-4k
-      rules:
-        - alert: ExportarrAbsent
-          annotations:
-            description: Sonarr4 4K Exportarr has disappeared from Prometheus
-              service discovery.
-            summary: Exportarr is down.
-          expr: |
-            absent(up{job=~".*sonarr4_4k.*"} == 1)
-          for: 5m
-          labels:
-            severity: critical
-        - alert: Sonarr44KDown
-          annotations:
-            description: Sonarr4 4K service is down.
-            summary: Sonarr4 4K is down.
-          expr: |
-            sonarr4_4k_system_status{job=~".*sonarr4_4k.*"} == 0
-          for: 5m
-          labels:
-            severity: critical

clusters/cl01tl/applications/sonarr4-4k/templates/replication-source.yaml

@@ -1,35 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: sonarr4-4k-config-backup-source
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: sonarr4-4k-config-backup-source
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: backup
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  sourcePVC: sonarr4-4k-config
-  trigger:
-    schedule: 0 0 */3 * *
-  restic:
-    pruneIntervalDays: 30
-    repository: sonarr4-4k-config-backup-secret
-    retain:
-      hourly: 1
-      daily: 1
-      weekly: 1
-      monthly: 2
-      yearly: 4
-    moverSecurityContext:
-      fsGroup: 1000
-      fsGroupChangePolicy: OnRootMismatch
-      supplementalGroups:
-        - 44
-        - 100
-        - 109
-        - 65539
-    copyMethod: Snapshot
-    storageClassName: ceph-block-delete
-    volumeSnapshotClassName: ceph-blockpool-snapshot

clusters/cl01tl/applications/sonarr4-4k/values.yaml

@@ -1,144 +0,0 @@
-sonarr4-4k:
-  controllers:
-    main:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      pod:
-        securityContext:
-          fsGroup: 1000
-          fsGroupChangePolicy: OnRootMismatch
-          supplementalGroups:
-            - 44
-            - 100
-            - 109
-            - 65539
-      containers:
-        main:
-          image:
-            repository: ghcr.io/linuxserver/sonarr
-            tag: 4.0.12@sha256:ca71add37a9cdbb914c7bd5b06f98bf5d2062848c8de6ac3ee09e69a4c170b27
-            pullPolicy: IfNotPresent
-          env:
-            - name: TZ
-              value: US/Central
-            - name: PUID
-              value: 1000
-            - name: PGID
-              value: 1000
-          probes:
-            liveness:
-              enabled: false
-              custom: true
-              spec:
-                exec:
-                  command:
-                  - /usr/bin/env
-                  - bash
-                  - -c
-                  - curl --fail localhost:8989/api/v1/system/status?apiKey=`IFS=\> && while
-                    read -d \< E C; do if [[ $E = "ApiKey" ]]; then echo $C; fi; done < /config/config.xml`
-                failureThreshold: 5
-                initialDelaySeconds: 60
-                periodSeconds: 10
-                successThreshold: 1
-                timeoutSeconds: 10
-          resources:
-            requests:
-              cpu: 10m
-              memory: 256Mi
-        metrics:
-          image:
-            repository: ghcr.io/onedr0p/exportarr
-            tag: v2.0.1
-            pullPolicy: IfNotPresent
-          args: ["sonarr"]
-          env:
-            - name: URL
-              value: http://localhost
-            - name: CONFIG
-              value: /config/config.xml
-            - name: PORT
-              value: 9794
-            - name: ENABLE_ADDITIONAL_METRICS
-              value: false
-            - name: ENABLE_UNKNOWN_QUEUE_ITEMS
-              value: false
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-  serviceAccount:
-    create: true
-  service:
-    main:
-      controller: main
-      ports:
-        http:
-          port: 80
-          targetPort: 8989
-          protocol: HTTP
-        metrics:
-          port: 9794
-          targetPort: 9794
-          protocol: TCP
-  ingress:
-    tailscale:
-      enabled: true
-      className: tailscale
-      hosts:
-        - host: sonarr-4k-cl01tl
-          paths:
-            - path: /
-              pathType: Prefix
-              service:
-                name: sonarr4-4k
-                port: 80
-      tls:
-        - hosts:
-            - sonarr-4k-cl01tl
-  persistence:
-    config:
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 20Gi
-      retain: true
-      advancedMounts:
-        main:
-          main:
-            - path: /config
-              readOnly: false
-          metrics:
-            - path: /config
-              readOnly: true
-    media:
-      existingClaim: sonarr4-4k-nfs-storage
-      advancedMounts:
-        main:
-          main:
-            - path: /mnt/store
-              readOnly: false
-postgres-17-cluster:
-  mode: standalone
-  cluster:
-    walStorage:
-      storageClass: local-path
-    storage:
-      storageClass: local-path
-    monitoring:
-      enabled: true
-  bootstrap:
-    initdb:
-      database: app
-      owner: app
-      postInitSQL:
-        - CREATE DATABASE "sonarr-main" OWNER "app";
-        - CREATE DATABASE "sonarr-log" OWNER "app";
-  backup:
-    enabled: true
-    endpointURL: https://nyc3.digitaloceanspaces.com
-    destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/sonarr4-4k/sonarr4-4k-postgresql-17-cluster
-    endpointCredentials: sonarr4-4k-postgresql-17-cluster-backup-secret
-    backupIndex: 1
-    retentionPolicy: "7d"

clusters/cl01tl/applications/sonarr4-anime/Chart.yaml

@@ -1,30 +0,0 @@
-apiVersion: v2
-name: sonarr4-anime
-version: 1.0.0
-description: Sonarr v4 Anime
-keywords:
-  - sonarr
-  - servarr
-  - anime
-  - metrics
-home: https://wiki.alexlebens.dev/doc/sonarr-AvJLY9PxEy
-sources:
-  - https://github.com/Sonarr/Sonarr
-  - https://github.com/cloudnative-pg/cloudnative-pg
-  - https://github.com/onedr0p/containers/pkgs/container/sonarr
-  - https://github.com/onedr0p/exportarr/pkgs/container/exportarr
-  - https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/alexlebens/helm-charts/charts/postgres-cluster
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: sonarr4-anime
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.6.0
-  - name: postgres-cluster
-    alias: postgres-17-cluster
-    version: 4.1.3
-    repository: http://alexlebens.github.io/helm-charts
-icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/sonarr.png
-appVersion: 4.0.11

clusters/cl01tl/applications/sonarr4-anime/templates/external-secret.yaml

@@ -1,89 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: sonarr4-anime-config-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: sonarr4-anime-config-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: backup
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/sonarr4-anime/sonarr4-anime-config"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: S3_BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: access_key
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: secret_key
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: sonarr4-anime-postgresql-17-cluster-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: sonarr4-anime-postgresql-17-cluster-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: database
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
-        property: access
-    - secretKey: ACCESS_SECRET_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
-        property: secret

clusters/cl01tl/applications/sonarr4-anime/templates/persistent-volume-claim.yaml

@@ -1,19 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: sonarr4-anime-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: sonarr4-anime-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: storage
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  volumeName: sonarr4-anime-nfs-storage
-  storageClassName: nfs-client
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi

clusters/cl01tl/applications/sonarr4-anime/templates/persistent-volume.yaml

@@ -1,25 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: sonarr4-anime-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: sonarr4-anime-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: storage
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: nfs-client
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteMany
-  nfs:
-    path: /volume2/Storage
-    server: synologybond.alexlebens.net
-  mountOptions:
-    - vers=4
-    - minorversion=1
-    - noac

clusters/cl01tl/applications/sonarr4-anime/templates/prometheus-rule.yaml

@@ -1,34 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: PrometheusRule
-metadata:
-  name: sonarr4-anime
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: sonarr4-anime
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: metrics
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  groups:
-    - name: sonarr4-anime
-      rules:
-        - alert: ExportarrAbsent
-          annotations:
-            description: Sonarr4 Anime Exportarr has disappeared from Prometheus
-              service discovery.
-            summary: Exportarr is down.
-          expr: |
-            absent(up{job=~".*sonarr4_anime.*"} == 1)
-          for: 5m
-          labels:
-            severity: critical
-        - alert: Sonarr4AnimeDown
-          annotations:
-            description: Sonarr4 Anime service is down.
-            summary: Sonarr4 Anime is down.
-          expr: |
-            sonarr4_anime_system_status{job=~".*sonarr4_anime.*"} == 0
-          for: 5m
-          labels:
-            severity: critical

clusters/cl01tl/applications/sonarr4-anime/templates/replication-source.yaml

@@ -1,35 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: sonarr4-anime-config-backup-source
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: sonarr4-anime-config-backup-source
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: backup
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  sourcePVC: sonarr4-anime-config
-  trigger:
-    schedule: 0 0 */3 * *
-  restic:
-    pruneIntervalDays: 30
-    repository: sonarr4-anime-config-backup-secret
-    retain:
-      hourly: 1
-      daily: 1
-      weekly: 1
-      monthly: 2
-      yearly: 4
-    moverSecurityContext:
-      fsGroup: 1000
-      fsGroupChangePolicy: OnRootMismatch
-      supplementalGroups:
-        - 44
-        - 100
-        - 109
-        - 65539
-    copyMethod: Snapshot
-    storageClassName: ceph-block-delete
-    volumeSnapshotClassName: ceph-blockpool-snapshot

clusters/cl01tl/applications/sonarr4-anime/templates/service-monitor.yaml

@@ -1,21 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: sonarr4-anime
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: sonarr4-anime
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: metrics
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: sonarr4-anime
-      app.kubernetes.io/instance: {{ .Release.Name }}
-  endpoints:
-    - port: metrics
-      interval: 3m
-      scrapeTimeout: 1m
-      path: /metrics

clusters/cl01tl/applications/sonarr4/Chart.yaml

@@ -1,30 +0,0 @@
-apiVersion: v2
-name: sonarr4
-version: 1.0.0
-description: Sonarr v4
-keywords:
-  - sonarr
-  - servarr
-  - tv shows
-  - metrics
-home: https://wiki.alexlebens.dev/doc/sonarr-AvJLY9PxEy
-sources:
-  - https://github.com/Sonarr/Sonarr
-  - https://github.com/cloudnative-pg/cloudnative-pg
-  - https://github.com/onedr0p/containers/pkgs/container/sonarr
-  - https://github.com/onedr0p/exportarr/pkgs/container/exportarr
-  - https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/alexlebens/helm-charts/charts/postgres-cluster
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: sonarr4
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.6.0
-  - name: postgres-cluster
-    alias: postgres-17-cluster
-    version: 4.1.3
-    repository: http://alexlebens.github.io/helm-charts
-icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/sonarr.png
-appVersion: 4.0.11.2680

clusters/cl01tl/applications/sonarr4/templates/external-secret.yaml

@@ -1,89 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: sonarr4-config-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: sonarr4-config-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: backup
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/sonarr4/sonarr4-config"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: S3_BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: access_key
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: secret_key
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: sonarr4-postgresql-17-cluster-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: sonarr4-postgresql-17-cluster-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: database
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
-        property: access
-    - secretKey: ACCESS_SECRET_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/postgres-backups
-        metadataPolicy: None
-        property: secret

clusters/cl01tl/applications/sonarr4/templates/persistent-volume-claim.yaml

@@ -1,19 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: sonarr4-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: sonarr4-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: storage
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  volumeName: sonarr4-nfs-storage
-  storageClassName: nfs-client
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi

clusters/cl01tl/applications/sonarr4/templates/persistent-volume.yaml

@@ -1,25 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: sonarr4-nfs-storage
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: sonarr4-nfs-storage
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: storage
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: nfs-client
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteMany
-  nfs:
-    path: /volume2/Storage
-    server: synologybond.alexlebens.net
-  mountOptions:
-    - vers=4
-    - minorversion=1
-    - noac

clusters/cl01tl/applications/sonarr4/templates/replication-source.yaml

@@ -1,35 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: sonarr4-config-backup-source
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: sonarr4-config-backup-source
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: backup
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  sourcePVC: sonarr4-config
-  trigger:
-    schedule: 0 0 */3 * *
-  restic:
-    pruneIntervalDays: 30
-    repository: sonarr4-config-backup-secret
-    retain:
-      hourly: 1
-      daily: 1
-      weekly: 1
-      monthly: 2
-      yearly: 4
-    moverSecurityContext:
-      fsGroup: 1000
-      fsGroupChangePolicy: OnRootMismatch
-      supplementalGroups:
-        - 44
-        - 100
-        - 109
-        - 65539
-    copyMethod: Snapshot
-    storageClassName: ceph-block-delete
-    volumeSnapshotClassName: ceph-blockpool-snapshot

clusters/cl01tl/applications/tautulli/Chart.yaml

@@ -1,21 +0,0 @@
-apiVersion: v2
-name: tautulli
-version: 1.0.0
-description: Tautulli
-keywords:
-  - tautulli
-  - plex
-home: https://wiki.alexlebens.dev/doc/tautulli-7FKi7SM33K
-sources:
-  - https://github.com/Tautulli/Tautulli
-  - https://github.com/Tautulli/Tautulli/pkgs/container/tautulli
-  - https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: tautulli
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.6.0
-icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/tautulli.png
-appVersion: v2.15.0

clusters/cl01tl/applications/tubearchivist/Chart.yaml

@@ -1,34 +0,0 @@
-apiVersion: v2
-name: tubearchivist
-version: 1.0.0
-description: Tube Archivist
-keywords:
-  - tubearchivist
-  - download
-  - video
-  - youtube
-home: https://wiki.alexlebens.dev/doc/tube-archivist-Bv6xCDKPM5
-sources:
-  - https://github.com/tubearchivist/tubearchivist
-  - https://github.com/elastic/elasticsearch
-  - https://github.com/redis/redis
-  - https://hub.docker.com/r/bbilly1/tubearchivist
-  - https://hub.docker.com/r/redis/redis-stack-server
-  - https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/bitnami/charts/tree/main/bitnami/redis
-  - https://github.com/bitnami/charts/tree/main/bitnami/elasticsearch
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: tubearchivist
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.6.0
-  - name: elasticsearch
-    version: 21.4.1
-    repository: https://charts.bitnami.com/bitnami
-  - name: redis
-    version: 19.6.4
-    repository: https://charts.bitnami.com/bitnami
-icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/tube-archivist.png
-appVersion: v0.4.11

clusters/cl01tl/applications/tubearchivist/values.yaml

@@ -1,139 +0,0 @@
-tubearchivist:
-  controllers:
-    main:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      containers:
-        main:
-          image:
-            repository: bbilly1/tubearchivist
-            tag: v0.4.12
-            pullPolicy: IfNotPresent
-          env:
-            - name: TZ
-              value: US/Central
-            - name: HOST_UID
-              value: 1000
-            - name: HOST_GID
-              value: 1000
-            - name: ES_URL
-              value: http://tubearchivist-elasticsearch:9200
-            - name: REDIS_HOST
-              value: tubearchivist-redis-headless
-            - name: TA_HOST
-              value: tubearchivist-cl01tl.boreal-beaufort.ts.net tubearchivist.tubearchivist
-            - name: TA_USERNAME
-              value: admin
-          envFrom:
-            - secretRef:
-                name: tubearchivist-config-secret
-          probes:
-            liveness:
-              enabled: true
-              custom: true
-              spec:
-                exec:
-                  command:
-                    - /usr/bin/env
-                    - bash
-                    - -c
-                    - curl --fail http://localhost:8000/health
-                failureThreshold: 5
-                initialDelaySeconds: 60
-                periodSeconds: 30
-                successThreshold: 1
-                timeoutSeconds: 10
-          resources:
-            requests:
-              cpu: 10m
-              memory: 1Gi
-  serviceAccount:
-    create: true
-  service:
-    main:
-      controller: main
-      ports:
-        http:
-          port: 80
-          targetPort: 8000
-          protocol: HTTP
-  ingress:
-    tailscale:
-      enabled: true
-      className: tailscale
-      hosts:
-        - host: tubearchivist-cl01tl
-          paths:
-            - path: /
-              pathType: Prefix
-              service:
-                name: tubearchivist
-                port: 80
-      tls:
-        - hosts:
-            - tubearchivist-cl01tl
-  persistence:
-    data:
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 20Gi
-      retain: true
-      advancedMounts:
-        main:
-          main:
-            - path: /cache
-              readOnly: false
-    youtube:
-      existingClaim: tubearchivist-nfs-storage
-      advancedMounts:
-        main:
-          main:
-            - path: /youtube
-              readOnly: false
-redis:
-  image:
-    repository: redis/redis-stack-server
-    tag: 7.2.0-v13
-  architecture: standalone
-  auth:
-    enabled: false
-  commonConfiguration: |-
-    # Enable AOF https://redis.io/topics/persistence#append-only-file
-    appendonly yes
-    # Disable RDB persistence, AOF persistence already enabled.
-    save ""
-    # Enable Redis Json module
-    loadmodule /opt/redis-stack/lib/rejson.so
-elasticsearch:
-  global:
-    storageClass: ceph-block
-  extraEnvVars:
-    - name: discovery.type
-      value: single-node
-    - name: xpack.security.enabled
-      value: "true"
-  extraEnvVarsSecret: tubearchivist-elasticsearch-secret
-  extraConfig:
-    path:
-      repo: /usr/share/elasticsearch/data/snapshot
-  extraVolumes:
-    - name: snapshot
-      nfs:
-        path: /volume2/Storage/TubeArchivist
-        server: synologybond.alexlebens.net
-  extraVolumeMounts:
-    - name: snapshot
-      mountPath: /usr/share/elasticsearch/data/snapshot
-  snapshotRepoPath: /usr/share/elasticsearch/data/snapshot
-  master:
-    masterOnly: false
-    replicaCount: 1
-  data:
-    replicaCount: 0
-  coordinating:
-    replicaCount: 0
-  ingest:
-    enabled: false
-    replicaCount: 0

clusters/cl01tl/applications/vaultwarden/Chart.yaml

@@ -1,34 +0,0 @@
-apiVersion: v2
-name: vaultwarden
-version: 1.0.0
-description: Vaultwarden
-keywords:
-  - vaultwarden
-  - bitwarden
-  - password
-home: https://wiki.alexlebens.dev/doc/vaultwarden-HFX1rsTgMD
-sources:
-  - https://github.com/dani-garcia/vaultwarden
-  - https://github.com/cloudflare/cloudflared
-  - https://github.com/cloudnative-pg/cloudnative-pg
-  - https://hub.docker.com/r/vaultwarden/server
-  - https://github.com/bjw-s/helm-charts/tree/main/charts/other/app-template
-  - https://github.com/alexlebens/helm-charts/tree/main/charts/cloudflared
-  - https://github.com/alexlebens/helm-charts/tree/main/charts/postgres-cluster
-maintainers:
-  - name: alexlebens
-dependencies:
-  - name: app-template
-    alias: vaultwarden
-    repository: https://bjw-s.github.io/helm-charts/
-    version: 3.6.0
-  - name: cloudflared
-    alias: cloudflared
-    repository: http://alexlebens.github.io/helm-charts
-    version: 1.12.4
-  - name: postgres-cluster
-    alias: postgres-17-cluster
-    version: 4.1.3
-    repository: http://alexlebens.github.io/helm-charts
-icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/vaultwarden.png
-appVersion: 1.32.6

clusters/cl01tl/applications/vaultwarden/values.yaml

@@ -1,67 +0,0 @@
-vaultwarden:
-  controllers:
-    main:
-      type: deployment
-      replicas: 1
-      strategy: Recreate
-      revisionHistoryLimit: 3
-      containers:
-        main:
-          image:
-            repository: vaultwarden/server
-            tag: 1.32.7
-            pullPolicy: IfNotPresent
-          env:
-            - name: DOMAIN
-              value: https://passwords.alexlebens.dev
-            - name: SIGNUPS_ALLOWED
-              value: "false"
-            - name: INVITATIONS_ALLOWED
-              value: "false"
-            - name: DATABASE_URL
-              valueFrom:
-                secretKeyRef:
-                  name: vaultwarden-postgresql-17-cluster-app
-                  key: uri
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi
-  serviceAccount:
-    create: true
-  service:
-    main:
-      controller: main
-      ports:
-        http:
-          port: 80
-          targetPort: 80
-          protocol: HTTP
-  persistence:
-    data:
-      storageClass: ceph-block
-      accessMode: ReadWriteOnce
-      size: 5Gi
-      retain: true
-      advancedMounts:
-        main:
-          main:
-            - path: /data
-              readOnly: false
-cloudflared:
-  existingSecretName: vaultwarden-cloudflared-secret
-postgres-17-cluster:
-  mode: standalone
-  cluster:
-    walStorage:
-      storageClass: local-path
-    storage:
-      storageClass: local-path
-    monitoring:
-      enabled: true
-  backup:
-    enabled: true
-    endpointURL: https://nyc3.digitaloceanspaces.com
-    destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/vaultwarden/vaultwarden-postgresql-17-cluster
-    endpointCredentials: vaultwarden-postgresql-17-cluster-backup-secret
-    backupIndex: 1

clusters/cl01tl/deployment/argocd/values.yaml

@@ -1,77 +0,0 @@
-argo-cd:
-  crds:
-    install: true
-  configs:
-    cm:
-      admin.enabled: true
-      resource.customizations.ignoreDifferences.apps_Deployment: |
-        jqPathExpressions:
-          - '.spec.template.spec.hostUsers'
-      resource.customizations.ignoreDifferences.batch_CronJob: |
-        jqPathExpressions:
-          - '.spec.jobTemplate.spec.template.spec.hostUsers'
-      resource.customizations.ignoreDifferences.batch_Job: |
-        jqPathExpressions:
-          - '.spec.template.spec.hostUsers'
-      timeout.reconciliation: 100s
-      timeout.reconciliation.jitter: 60s
-      url: https://argocd-cl01tl.boreal-beaufort.ts.net
-      statusbadge.enabled: true
-      dex.config: |
-        connectors:
-        - config:
-            issuer: https://auth-cl01tl.boreal-beaufort.ts.net/application/o/argocd/
-            clientID: $argocd-oidc-secret:client
-            clientSecret: $argocd-oidc-secret:secret
-            insecureEnableGroups: true
-            scopes:
-              - openid
-              - profile
-              - email
-              - groups
-          name: authentik
-          type: oidc
-          id: authentik
-    rbac:
-      policy.csv: |
-        g, ArgoCD Admins, role:admin
-    params:
-      server.insecure: true
-  server:
-    replicas: 2
-    ingress:
-      enabled: true
-      controller: generic
-      ingressClassName: traefik
-      annotations:
-        traefik.ingress.kubernetes.io/router.entrypoints: websecure
-        traefik.ingress.kubernetes.io/router.tls: "true"
-        cert-manager.io/cluster-issuer: letsencrypt-issuer
-      hostname: argocd.alexlebens.net
-      tls: true
-    metrics:
-      enabled: true
-      serviceMonitor:
-        enabled: true
-  dex:
-    enabled: true
-  redis-ha:
-    enabled: true
-  controller:
-    replicas: 1
-    metrics:
-      enabled: true
-      serviceMonitor:
-        enabled: true
-  repoServer:
-    replicas: 2
-    metrics:
-      enabled: true
-      serviceMonitor:
-        enabled: true
-  applicationSet:
-    replicas: 2
-    metrics:
-      enabled: true
-      serviceMonitor:
-        enabled: true

clusters/cl01tl/deployment/stack/Chart.yaml

@@ -1,16 +0,0 @@
-apiVersion: v2
-name: stack
-version: 1.0.0
-description: Stack
-keywords:
-  - argo-cd
-  - stack
-  - deployment
-home: https://wiki.alexlebens.dev/doc/argocd-hsBKD1tztr
-sources:
-  - https://github.com/argoproj/argo-cd
-  - https://github.com/alexlebens/alexlebens-net.git
-maintainers:
-  - name: alexlebens
-icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/argocd.png
-appVersion: 1.0.0

clusters/cl01tl/deployment/stack/templates/application-set.yaml

@@ -1,58 +0,0 @@
-{{- range $index, $stack := .Values.applicationSet }}
----
-apiVersion: argoproj.io/v1alpha1
-kind: ApplicationSet
-metadata:
-  name: {{ $stack.name }}
-  namespace: {{ $.Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: {{ $stack.name }}
-    app.kubernetes.io/instance: {{ $stack.name }}
-    app.kubernetes.io/version: {{ $.Chart.AppVersion }}
-    app.kubernetes.io/component: {{ $stack.name }}
-    app.kubernetes.io/part-of: {{ $.Release.Name }}
-spec:
-  syncPolicy:
-    applicationsSync: create-update
-    preserveResourcesOnDeletion: false
-  generators:
-    - git:
-        repoURL: {{ $.Values.git.repo }}
-        revision: {{ $.Values.git.revision }}
-        directories:
-          - path: "clusters/{{ $.Values.cluster.name }}/{{ $stack.name }}/*"
-  template:
-    metadata:
-      name: '{{ `{{path.basename}}` }}'
-    spec:
-      destination:
-        name: in-cluster
-        namespace: '{{ $stack.namespace | default `{{path.basename}}` }}'
-      project: default
-      revisionHistoryLimit: 3
-      source:
-        repoURL: {{ $.Values.git.repo }}
-        targetRevision: {{ $.Values.git.revision }}
-        path: '{{ `{{path}}` }}'
-        helm:
-          releaseName: "{{ `{{path.basename}}` }}"
-      {{- if $stack.ignoreDifferences }}
-      ignoreDifferences:
-        {{- toYaml $stack.ignoreDifferences | nindent 8 }}
-      {{ end }}
-      syncPolicy:
-        automated:
-          prune: {{ $stack.syncPolicy.automated.prune | default false }}
-          selfHeal: {{ $stack.syncPolicy.automated.selfHeal | default false }}
-        retry:
-          limit: 3
-          backoff:
-            duration: 1m
-            factor: 2
-            maxDuration: 15m
-        syncOptions:
-          - CreateNamespace={{ $stack.syncPolicy.syncOptions.createNamespace | default true }}
-          - ApplyOutOfSyncOnly={{ $stack.syncPolicy.syncOptions.applyOutOfSyncOnly | default true }}
-          - ServerSideApply={{ $stack.syncPolicy.syncOptions.serverSideApply | default true }}
-          - PruneLast={{ $stack.syncPolicy.syncOptions.pruneLast | default true }}
-{{- end }}

clusters/cl01tl/deployment/stack/values.yaml

@@ -1,103 +0,0 @@
-cluster:
-  name: cl01tl
-git:
-  # repo: git@github.com:alexlebens/infrastructure.git
-  repo: http://gitea-http.gitea:3000/alexlebens/infrastructure
-  # repo: ssh://git@gitea-ssh.gitea:2222/alexlebens/infrastructure
-  revision: HEAD
-applicationSet:
-  - name: applications
-    ignoreDifferences:
-      - kind: PersistentVolume
-        jsonPointers:
-        - /spec/claimRef/resourceVersion
-        - /spec/claimRef/uid
-        - /status/lastPhaseTransitionTime
-    syncPolicy:
-      automated:
-        prune: true
-      syncOptions:
-        serverSideApply: true
-        RespectIgnoreDifferences: true
-  - name: deployment
-    ignoreDifferences:
-      - group: ""
-        kind: ValidatingWebhookConfiguration
-        jqPathExpressions:
-          - .webhooks[].clientConfig.caBundle
-    namespace: argocd
-    syncPolicy:
-      automated:
-        prune: true
-      syncOptions:
-        serverSideApply: true
-  - name: management
-    ignoreDifferences:
-      - group: ""
-        kind: ValidatingWebhookConfiguration
-        jqPathExpressions:
-          - .webhooks[].clientConfig.caBundle
-    syncPolicy:
-      automated:
-        prune: true
-      syncOptions:
-        serverSideApply: true
-  - name: monitoring
-    syncPolicy:
-      automated:
-        prune: true
-      syncOptions:
-        serverSideApply: true
-  - name: platform
-    ignoreDifferences:
-      - group: ""
-        kind: ValidatingWebhookConfiguration
-        jqPathExpressions:
-          - .webhooks[].clientConfig.caBundle
-      - kind: PersistentVolume
-        jsonPointers:
-        - /spec/claimRef/resourceVersion
-        - /spec/claimRef/uid
-        - /status/lastPhaseTransitionTime
-    syncPolicy:
-      automated:
-        prune: true
-      syncOptions:
-        serverSideApply: true
-        RespectIgnoreDifferences: true
-  - name: services
-    ignoreDifferences:
-      - group: ""
-        kind: Service
-        jqPathExpressions:
-          - .status.loadBalancer.ingress[].ipMode
-      - group: ""
-        kind: ValidatingWebhookConfiguration
-        jqPathExpressions:
-          - .webhooks[].clientConfig.caBundle
-      - group: ""
-        kind: DaemonSet
-        jqPathExpressions:
-          - .metadata.annotations.deprecated.daemonset.template.generation
-    syncPolicy:
-      automated:
-        prune: true
-      syncOptions:
-        serverSideApply: true
-  - name: storage
-    ignoreDifferences:
-      - group: ""
-        kind: ValidatingWebhookConfiguration
-        jqPathExpressions:
-          - .webhooks[].clientConfig.caBundle
-      - kind: PersistentVolume
-        jsonPointers:
-        - /spec/claimRef/resourceVersion
-        - /spec/claimRef/uid
-        - /status/lastPhaseTransitionTime
-    syncPolicy:
-      automated:
-        prune: true
-      syncOptions:
-        serverSideApply: true
-        RespectIgnoreDifferences: true

clusters/cl01tl/helm/actual/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: app-template
+  repository: https://bjw-s-labs.github.io/helm-charts/
+  version: 4.5.0
+digest: sha256:926b8da839684072fd79954aff0c9852c2ff3b618b0fa35177bdec8e2dff4986
+generated: "2025-12-05T17:02:01.15162583Z"

clusters/cl01tl/helm/actual/Chart.yaml

@@ -0,0 +1,21 @@
+apiVersion: v2
+name: actual
+version: 1.0.0
+description: Actual
+keywords:
+  - actual
+  - budget
+home: https://wiki.alexlebens.dev/s/86192f45-94b7-45de-872c-6ef3fec7df5e
+sources:
+  - https://github.com/actualbudget/actual
+  - https://github.com/actualbudget/actual/pkgs/container/actual
+  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
+maintainers:
+  - name: alexlebens
+dependencies:
+  - name: app-template
+    alias: actual
+    repository: https://bjw-s-labs.github.io/helm-charts/
+    version: 4.5.0
+icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/actual-budget.png
+appVersion: 25.11.0

clusters/cl01tl/helm/actual/templates/external-secret.yaml

@@ -1,38 +1,11 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: calibre-web-automated-gmail-config
+  name: actual-data-backup-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: calibre-web-automated-gmail-config
+    app.kubernetes.io/name: actual-data-backup-secret
     app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: web
-    app.kubernetes.io/part-of: {{ .Release.Name }}
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: gmail.json
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/calibre-web/gmail
-        metadataPolicy: None
-        property: gmail.json
-
----
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: calibre-web-automated-config-backup-secret
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app.kubernetes.io/name: calibre-web-automated-config-backup-secret
-    app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: backup
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   secretStoreRef:
@@ -43,7 +16,7 @@ spec:
       mergePolicy: Merge
       engineVersion: v2
       data:
-        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/calibre-web-automated/calibre-web-automated-config"
+        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/actual/actual-data"
   data:
     - secretKey: BUCKET_ENDPOINT
       remoteRef:

clusters/cl01tl/helm/actual/templates/http-route.yaml

@@ -0,0 +1,28 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-route-actual
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: http-route-actual
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+  hostnames:
+    - actual.alexlebens.net
+  rules:
+    - matches:
+      - path:
+          type: PathPrefix
+          value: /
+      backendRefs:
+        - group: ''
+          kind: Service
+          name: actual
+          port: 80
+          weight: 100

clusters/cl01tl/helm/actual/templates/replication-source.yaml

@@ -1,27 +1,25 @@
 apiVersion: volsync.backube/v1alpha1
 kind: ReplicationSource
 metadata:
-  name: headlamp-backup-source
+  name: actual-data-backup-source
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: headlamp-backup-source
+    app.kubernetes.io/name: actual-data-backup-source
     app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: backup
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
-  sourcePVC: headlamp
+  sourcePVC: actual-data
   trigger:
-    schedule: 0 0 */3 * *
+    schedule: 0 4 * * *
   restic:
-    pruneIntervalDays: 30
-    repository: headlamp-backup-secret
+    pruneIntervalDays: 7
+    repository: actual-data-backup-secret
     retain:
       hourly: 1
-      daily: 1
-      weekly: 1
+      daily: 3
+      weekly: 2
       monthly: 2
       yearly: 4
     copyMethod: Snapshot
-    storageClassName: ceph-block-delete
+    storageClassName: ceph-block
     volumeSnapshotClassName: ceph-blockpool-snapshot

clusters/cl01tl/helm/actual/values.yaml

@@ -0,0 +1,56 @@
+actual:
+  controllers:
+    main:
+      type: deployment
+      replicas: 1
+      strategy: Recreate
+      revisionHistoryLimit: 3
+      containers:
+        main:
+          image:
+            repository: ghcr.io/actualbudget/actual
+            tag: 25.12.0
+            pullPolicy: IfNotPresent
+          env:
+            - name: TZ
+              value: US/Central
+          resources:
+            requests:
+              cpu: 10m
+              memory: 128Mi
+          probes:
+            liveness:
+              enabled: true
+              custom: true
+              spec:
+                exec:
+                  command:
+                  - /usr/bin/env
+                  - bash
+                  - -c
+                  - node src/scripts/health-check.js
+                failureThreshold: 5
+                initialDelaySeconds: 60
+                periodSeconds: 10
+                successThreshold: 1
+                timeoutSeconds: 10
+  service:
+    main:
+      controller: main
+      ports:
+        http:
+          port: 80
+          targetPort: 5006
+          protocol: HTTP
+  persistence:
+    data:
+      forceRename: actual-data
+      storageClass: ceph-block
+      accessMode: ReadWriteOnce
+      size: 2Gi
+      retain: true
+      advancedMounts:
+        main:
+          main:
+            - path: /data
+              readOnly: false

clusters/cl01tl/helm/argo-workflows/Chart.lock

@@ -0,0 +1,12 @@
+dependencies:
+- name: argo-workflows
+  repository: https://argoproj.github.io/argo-helm
+  version: 0.46.1
+- name: argo-events
+  repository: https://argoproj.github.io/argo-helm
+  version: 2.4.19
+- name: postgres-cluster
+  repository: oci://harbor.alexlebens.net/helm-charts
+  version: 6.16.1
+digest: sha256:1f98e04526d7b61fa9ee690c46542bcc2ae6b69bf7619e1107a1592386de9bf2
+generated: "2025-12-07T03:02:14.909953853Z"

clusters/cl01tl/helm/argo-workflows/Chart.yaml

@@ -7,25 +7,25 @@ keywords:
   - argo-events
   - workflows
   - events
-home: https://wiki.alexlebens.dev/doc/argo-workflows-bRGiuUyLgj
+home: https://wiki.alexlebens.dev/s/a268508f-d81d-4b4b-8bd5-9058edaea635
 sources:
   - https://github.com/argoproj/argo-workflows
   - https://github.com/argoproj/argo-events
   - https://github.com/cloudnative-pg/cloudnative-pg
   - https://github.com/argoproj/argo-helm/tree/main/charts
-  - https://github.com/alexlebens/helm-charts/charts/postgres-cluster
+  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
 maintainers:
   - name: alexlebens
 dependencies:
   - name: argo-workflows
-    version: 0.45.3
+    version: 0.46.1
     repository: https://argoproj.github.io/argo-helm
   - name: argo-events
-    version: 2.4.12
+    version: 2.4.19
     repository: https://argoproj.github.io/argo-helm
   - name: postgres-cluster
     alias: postgres-17-cluster
-    version: 4.1.3
-    repository: http://alexlebens.github.io/helm-charts
-icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/argocd.png
-appVersion: v3.6.2
+    version: 6.16.1
+    repository: oci://harbor.alexlebens.net/helm-charts
+icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
+appVersion: v3.6.7

clusters/cl01tl/helm/argo-workflows/templates/external-secret.yaml

@@ -1,72 +1,41 @@
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: radarr5-4k-config-backup-secret
+  name: argo-workflows-oidc-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: radarr5-4k-config-backup-secret
+    app.kubernetes.io/name: argo-workflows-oidc-secret
     app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: backup
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
     name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/radarr5-4k/radarr5-4k-config"
   data:
-    - secretKey: BUCKET_ENDPOINT
+    - secretKey: secret
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
+        key: /authentik/oidc/argo-workflows
         metadataPolicy: None
-        property: S3_BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
+        property: secret
+    - secretKey: client
       remoteRef:
         conversionStrategy: Default
         decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
+        key: /authentik/oidc/argo-workflows
         metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cl01tl/volsync/restic/config
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: access_key
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: secret_key
+        property: client
 
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: radarr5-4k-postgresql-17-cluster-backup-secret
+  name: argo-workflows-postgresql-17-cluster-backup-secret
   namespace: {{ .Release.Namespace }}
   labels:
-    app.kubernetes.io/name: radarr5-4k-postgresql-17-cluster-backup-secret
+    app.kubernetes.io/name: argo-workflows-postgresql-17-cluster-backup-secret
     app.kubernetes.io/instance: {{ .Release.Name }}
-    app.kubernetes.io/version: {{ .Chart.AppVersion }}
-    app.kubernetes.io/component: database
     app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
   secretStoreRef:
@@ -87,3 +56,40 @@ spec:
         key: /digital-ocean/home-infra/postgres-backups
         metadataPolicy: None
         property: secret
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: argo-workflows-postgresql-17-cluster-backup-secret-garage
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: argo-workflows-postgresql-17-cluster-backup-secret-garage
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: ACCESS_KEY_ID
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /garage/home-infra/postgres-backups
+        metadataPolicy: None
+        property: ACCESS_KEY_ID
+    - secretKey: ACCESS_SECRET_KEY
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /garage/home-infra/postgres-backups
+        metadataPolicy: None
+        property: ACCESS_SECRET_KEY
+    - secretKey: ACCESS_REGION
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /garage/home-infra/postgres-backups
+        metadataPolicy: None
+        property: ACCESS_REGION

clusters/cl01tl/helm/argo-workflows/templates/http-route.yaml

@@ -0,0 +1,28 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: http-route-argo-workflows
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: http-route-argo-workflows
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: traefik-gateway
+      namespace: traefik
+  hostnames:
+    - argo-workflows.alexlebens.net
+  rules:
+    - matches:
+      - path:
+          type: PathPrefix
+          value: /
+      backendRefs:
+        - group: ''
+          kind: Service
+          name: argo-workflows-server
+          port: 2746
+          weight: 100

clusters/cl01tl/helm/argo-workflows/templates/service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: garage-ps10rp
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: garage-ps10rp
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+  annotations:
+    tailscale.com/tailnet-fqdn: garage-ps10rp.boreal-beaufort.ts.net
+spec:
+  externalName: placeholder
+  type: ExternalName

clusters/cl01tl/helm/argo-workflows/values.yaml

@@ -34,28 +34,22 @@ argo-workflows:
     name: workflow-controller
     workflowNamespaces:
       - argocd
+      - argo-workflows
   server:
     authModes:
       - sso
     ingress:
-      enabled: true
-      ingressClassName: tailscale
-      hosts:
-        - argo-workflows-cl01tl
-      tls:
-        - secretName: argo-workflows-cl01tl
-          hosts:
-            - argo-workflows-cl01tl
+      enabled: false
     sso:
       enabled: true
-      issuer: https://auth-cl01tl.boreal-beaufort.ts.net/application/o/argo-workflows/
+      issuer: https://authentik.alexlebens.net/application/o/argo-workflows/
       clientId:
         name: argo-workflows-oidc-secret
         key: client
       clientSecret:
         name: argo-workflows-oidc-secret
         key: secret
-      redirectUrl: https://argo-workflows-cl01tl.boreal-beaufort.ts.net/oauth2/callback
+      redirectUrl: https://argo-workflows.alexlebens.net/oauth2/callback
       rbac:
         enabled: false
       scopes:
@@ -89,7 +83,6 @@ argo-events:
       enabled: true
       serviceMonitor:
         enabled: true
-        namespace: argocd
   webhook:
     enabled: true
     resources:
@@ -97,17 +90,58 @@ argo-events:
         cpu: 10m
         memory: 128Mi
 postgres-17-cluster:
-  mode: standalone
+  mode: recovery
   cluster:
-    walStorage:
-      storageClass: local-path
     storage:
       storageClass: local-path
+    walStorage:
+      storageClass: local-path
     monitoring:
       enabled: true
+      prometheusRule:
+        enabled: true
+  recovery:
+    method: objectStore
+    objectStore:
+      destinationPath: s3://postgres-backups/cl01tl/argo-workflows/argo-workflows-postgresql-17-cluster
+      endpointURL: http://garage-main.garage:3900
+      index: 1
+      endpointCredentials: argo-workflows-postgresql-17-cluster-backup-secret-garage
   backup:
-    enabled: true
-    endpointURL: https://nyc3.digitaloceanspaces.com
-    destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/argo-workflows/argo-workflows-postgresql-17-cluster
-    endpointCredentials: argo-workflows-postgresql-17-cluster-backup-secret
-    backupIndex: 1
+    objectStore:
+      - name: external
+        destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/argo-workflows/argo-workflows-postgresql-17-cluster
+        index: 1
+        retentionPolicy: "30d"
+        isWALArchiver: false
+      - name: garage-local
+        destinationPath: s3://postgres-backups/cl01tl/argo-workflows/argo-workflows-postgresql-17-cluster
+        index: 1
+        endpointURL: http://garage-main.garage:3900
+        endpointCredentials: argo-workflows-postgresql-17-cluster-backup-secret-garage
+        endpointCredentialsIncludeRegion: true
+        retentionPolicy: "3d"
+        isWALArchiver: true
+      # - name: garage-remote
+      #   destinationPath: s3://postgres-backups/cl01tl/argo-workflows/argo-workflows-postgresql-17-cluster
+      #   index: 1
+      #   endpointURL: https://garage-ps10rp.boreal-beaufort.ts.net:3900
+      #   endpointCredentials: argo-workflows-postgresql-17-cluster-backup-secret-garage
+      #   endpointCredentialsIncludeRegion: true
+      #   retentionPolicy: "30d"
+      #   data:
+      #     compression: bzip2
+    scheduledBackups:
+      - name: daily-backup
+        suspend: false
+        schedule: "0 0 0 * * *"
+        backupName: external
+      - name: live-backup
+        suspend: false
+        immediate: true
+        schedule: "0 0 0 * * *"
+        backupName: garage-local
+      # - name: weekly-backup
+      #   suspend: true
+      #   schedule: "0 0 4 * * SAT"
+      #   backupName: garage-remote

clusters/cl01tl/helm/argocd/Chart.lock

@@ -0,0 +1,6 @@
+dependencies:
+- name: argo-cd
+  repository: https://argoproj.github.io/argo-helm
+  version: 9.1.6
+digest: sha256:488b8e826e7cc7179f154c1b7555e2cec78b69becb9f8cdbe4937b3546d87e5d
+generated: "2025-12-05T04:02:40.060511766Z"

clusters/cl01tl/helm/argocd/Chart.yaml

@@ -7,7 +7,7 @@ keywords:
   - delivery
   - deployment
   - gitops
-home: https://wiki.alexlebens.dev/doc/argocd-hsBKD1tztr
+home: https://wiki.alexlebens.dev/s/8a75cf26-b9df-437e-9cc5-2ef47e871a5f
 sources:
   - https://github.com/argoproj/argo-cd
   - https://github.com/argoproj/argo-helm/tree/main/charts/argo-cd
@@ -15,7 +15,7 @@ maintainers:
   - name: alexlebens
 dependencies:
   - name: argo-cd
-    version: 7.7.14
+    version: 9.1.6
     repository: https://argoproj.github.io/argo-helm
-icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/argocd.png
-appVersion: v2.13.2
+icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
+appVersion: 3.0.0

clusters/cl01tl/helm/argocd/templates/external-secret.yaml

@@ -0,0 +1,88 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: argocd-oidc-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: argocd-oidc-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: secret
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /authentik/oidc/argocd
+        metadataPolicy: None
+        property: secret
+    - secretKey: client
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /authentik/oidc/argocd
+        metadataPolicy: None
+        property: client
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: argocd-notifications-secret
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: argocd-notifications-secret
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/part-of: {{ .Release.Name }}
+spec:
+  secretStoreRef:
+    kind: ClusterSecretStore
+    name: vault
+  data:
+    - secretKey: ntfy-token
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        key: /ntfy/user/cl01tl
+        metadataPolicy: None
+        property: token
+
+# ---
+# apiVersion: external-secrets.io/v1
+# kind: ExternalSecret
+# metadata:
+#   name: argocd-gitea-repo-infrastructure-secret
+#   namespace: {{ .Release.Namespace }}
+#   labels:
+#     app.kubernetes.io/name: argocd-gitea-repo-infrastructure-secret
+#     app.kubernetes.io/instance: {{ .Release.Name }}
+#     app.kubernetes.io/part-of: {{ .Release.Name }}
+# spec:
+#   secretStoreRef:
+#     kind: ClusterSecretStore
+#     name: vault
+#   data:
+#     - secretKey: type
+#       remoteRef:
+#         conversionStrategy: Default
+#         decodingStrategy: None
+#         key: /cl01tl/argocd/credentials/repo/infrastructure
+#         metadataPolicy: None
+#         property: type
+#     - secretKey: url
+#       remoteRef:
+#         conversionStrategy: Default
+#         decodingStrategy: None
+#         key: /cl01tl/argocd/credentials/repo/infrastructure
+#         metadataPolicy: None
+#         property: url
+#     - secretKey: sshPrivateKey
+#       remoteRef:
+#         conversionStrategy: Default
+#         decodingStrategy: None
+#         key: /cl01tl/argocd/credentials/repo/infrastructure
+#         metadataPolicy: None
+#         property: sshPrivateKey