update chart version

Update Helm release generic-device-plugin to v0.20.6 (#2467 )
update image
2025-12-12 18:20:28 -06:00 · 2025-12-13 00:08:35 +00:00 · 2025-12-12 18:06:12 -06:00 · 2025-12-12 18:05:53 -06:00 · 2025-12-12 17:55:55 -06:00 · 2025-12-12 17:52:14 -06:00
3481 changed files with 36950 additions and 402824 deletions
@@ -0,0 +1,141 @@
 name: lint-test-docker
 on:
  pull_request:
    branches:
      - main
    paths:
      - 'hosts/**'
  push:
    branches:
      - main
    paths:
      - 'hosts/**'
 env:
  BASE_BRANCH: "origin/${{ gitea.base_ref }}"
 jobs:
  lint-docker-compose:
    runs-on: ubuntu-js
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Check Branch Exists
        id: check-branch-exists
        if: github.event_name == 'pull_request'
        uses: GuillaumeFalourd/branch-exists@v1.1
        with:
          branch: "${{ github.base_ref }}"
      - name: Report Branch Exists
        id: branch-exists
        if: github.event_name == 'push' || steps.check-branch-exists.outputs.exists == 'true' && github.event_name == 'pull_request'
        run: |
          if [ ${{ github.event_name == 'push' }} ]; then
            echo ">> Action is from a push event, will continue with linting"
          else
            echo ">> Branch ${{ gitea.base_ref }} exists, will continue with linting"
          fi
          echo "----"
          echo "exists=true" >> $GITEA_OUTPUT
      - name: Set up Node.js
        if: steps.branch-exists.outputs.exists == 'true'
        uses: actions/setup-node@v6
        with:
          node-version: '24'
      - name: Check Directories for Changes
        id: check-dir-changes
        if: steps.branch-exists.outputs.exists == 'true'
        run: |
          CHANGED_COMPOSE=()
          echo ">> Target branch for diff is: ${BASE_BRANCH}"
          if [ "${{ github.event_name }}" == "pull_request" ]; then
            echo ""
            echo ">> Checking for changes in a pull request ..."
            GIT_DIFF=$(git diff --name-only "${BASE_BRANCH}" | xargs -I {} dirname {} | sort -u)
          else
            echo ""
            echo ">> Checking for changes from a push ..."
            GIT_DIFF=$(git diff --name-only ${{ gitea.event.before }}..HEAD | xargs -I {} dirname {} | sort -u)
          fi
          if [ -n "${GIT_DIFF}" ]; then
            echo ""
            echo ">> Changes detected:"
            echo "$GIT_DIFF"
            for path in $GIT_DIFF; do
              if echo "$path" | grep -q -E "hosts/[^/]+/[^/]+"; then
                echo ""
                echo ">> Adding path: $path"
                CHANGED_COMPOSE+=$(echo "$path")
                CHANGED_COMPOSE+=$(echo " ")
              fi
            done
          else
            echo ""
            echo ">> No changes detected"
          fi
          if [ -n "${CHANGED_COMPOSE}" ]; then
            echo ""
            echo ">> Compose to Lint:"
            echo "$(echo "${CHANGED_COMPOSE}" | sort -u)"
            echo "----"
            echo "changes-detected=true" >> $GITEA_OUTPUT
            echo "compose-dir<<EOF" >> $GITEA_OUTPUT
            echo "$(echo "${CHANGED_COMPOSE}" | sort -u)" >> $GITEA_OUTPUT
            echo "EOF" >> $GITEA_OUTPUT
          else
            echo ""
            echo ">> Did not find any docker compose files to lint"
            echo "----"
            echo "changes-detected=false" >> $GITEA_OUTPUT
          fi
      - name: Lint Docker Compose
        if: steps.check-dir-changes.outputs.changes-detected == 'true'
        env:
          CHANGED_COMPOSE: ${{ steps.check-dir-changes.outputs.compose-dir }}
        run: |
          echo ">> Running dclint on changed compose files:"
          echo "$CHANGED_COMPOSE"
          for compose in $CHANGED_COMPOSE; do
            echo ">> Linting $compose ..."
            npx dclint $compose
          done
      - name: ntfy Failed
        uses: niniyas/ntfy-action@master
        if: failure()
        with:
          url: '${{ secrets.NTFY_URL }}'
          topic: '${{ secrets.NTFY_TOPIC }}'
          title: 'Test Failure - Infrastructure'
          priority: 3
          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
          tags: action,failed
          details: 'Docker linting on Pull Request for Infrastructure has failed!'
          icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/infrastructure/actions?workflow=lint-test-docker-pull.yaml", "clear": true}]'
          image: true
@@ -0,0 +1,180 @@
 name: lint-test-helm
 on:
  pull_request:
    branches:
      - main
    paths:
      - 'clusters/cl01tl/helm/**'
  push:
    branches:
      - main
    paths:
      - 'clusters/cl01tl/helm/**'
 env:
  CLUSTER: cl01tl
  BASE_BRANCH: "origin/${{ gitea.base_ref }}"
 jobs:
  lint-helm:
    runs-on: ubuntu-js
    steps:
      - name: Checkout
        uses: actions/checkout@v6
        with:
          fetch-depth: 0
      - name: Check Branch Exists
        id: check-branch-exists
        if: github.event_name == 'pull_request'
        uses: GuillaumeFalourd/branch-exists@v1.1
        with:
          branch: ${{ gitea.base_ref }}
      - name: Report Branch Exists
        id: branch-exists
        if: github.event_name == 'push' || steps.check-branch-exists.outputs.exists == 'true' && github.event_name == 'pull_request'
        run: |
          if [ ${{ github.event_name == 'push' }} ]; then
            echo ">> Action is from a push event, will continue with linting"
          else
            echo ">> Branch ${{ gitea.base_ref }} exists, will continue with linting"
          fi
          echo "----"
          echo "exists=true" >> $GITEA_OUTPUT
      - name: Set up Helm
        if: steps.branch-exists.outputs.exists == 'true'
        uses: azure/setup-helm@v4
        with:
          token: ${{ secrets.GITEA_TOKEN }}
          version: v3.19.2
      - name: Check Directories for Changes
        id: check-dir-changes
        if: steps.branch-exists.outputs.exists == 'true'
        run: |
          CHANGED_CHARTS=()
          echo ">> Target branch for diff is: ${BASE_BRANCH}"
          if [ "${{ github.event_name }}" == "pull_request" ]; then
            echo ""
            echo ">> Checking for changes in a pull request ..."
            GIT_DIFF=$(git diff --name-only "${BASE_BRANCH}" | xargs -I {} dirname {} | sort -u)
          else
            echo ""
            echo ">> Checking for changes from a push ..."
            GIT_DIFF=$(git diff --name-only ${{ gitea.event.before }}..HEAD | xargs -I {} dirname {} | sort -u)
          fi
          if [ -n "${GIT_DIFF}" ]; then
            echo ""
            echo ">> Changes detected:"
            echo "$GIT_DIFF"
            for path in $GIT_DIFF; do
              if echo "$path" | grep -q -E "clusters/[^/]+/helm/[^/]+"; then
                echo ""
                echo ">> Adding path: $path"
                CHANGED_CHARTS+=$(echo "$path" | awk -F '/' '{print $4}')
                CHANGED_CHARTS+=$(echo " ")
              fi
            done
          else
            echo ""
            echo ">> No changes detected"
          fi
          if [ -n "${CHANGED_CHARTS}" ]; then
            echo ""
            echo ">> Chart to Lint:"
            echo "$(echo "${CHANGED_CHARTS}" | sort -u)"
            echo "----"
            echo "changes-detected=true" >> $GITEA_OUTPUT
            echo "chart-dir<<EOF" >> $GITEA_OUTPUT
            echo "$(echo "${CHANGED_CHARTS}" | sort -u)" >> $GITEA_OUTPUT
            echo "EOF" >> $GITEA_OUTPUT
          else
            echo ""
            echo ">> Did not find any helm charts files to lint"
            echo "----"
            echo "changes-detected=false" >> $GITEA_OUTPUT
          fi
      - name: Add Repositories
        if: steps.check-dir-changes.outputs.changes-detected == 'true'
        env:
          CHANGED_CHARTS: ${{ steps.check-dir-changes.outputs.chart-dir }}
        run: |
          echo ">> Adding repositories for chart dependencies ..."
          for dir in ${CHANGED_CHARTS}; do
            helm dependency list --max-col-width 120 clusters/${CLUSTER}/helm/$dir 2> /dev/null \
              | tail +2 | head -n -1 \
              | awk '{ print "helm repo add " $1 " " $3 }' \
              | while read cmd; do echo "$cmd" | sh; done || true
          done
          if helm repo list | tail +2 | read -r; then
            echo ""
            echo ">> Update repository cache ..."
            helm repo update
          fi
          echo "----"
      - name: Lint Helm Chart
        if: steps.check-dir-changes.outputs.changes-detected == 'true'
        env:
          CHANGED_CHARTS: ${{ steps.check-dir-changes.outputs.chart-dir }}
        run: |
          echo ">> Running linting on changed charts ..."
          for dir in ${CHANGED_CHARTS}; do
            chart_path=clusters/${CLUSTER}/helm/$dir
            chart_name=$(basename "$chart_path")
            if [ -f "$chart_path/Chart.yaml" ]; then
              cd $chart_path
              echo ""
              echo ">> Building helm dependency ..."
              helm dependency build --skip-refresh
              echo ""
              echo ">> Linting helm ..."
              helm lint --namespace "$chart_name"
            else
              echo ""
              echo ">> Directory $chart_path does not contain a Chart.yaml. Skipping ..."
              echo ""
            fi
          done
      - name: ntfy Failed
        uses: niniyas/ntfy-action@master
        if: failure()
        with:
          url: '${{ secrets.NTFY_URL }}'
          topic: '${{ secrets.NTFY_TOPIC }}'
          title: 'Test Failure - Infrastructure'
          priority: 3
          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
          tags: action,failed
          details: 'Helm linting on Pull Request for Infrastructure has failed!'
          icon: 'https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png'
          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/infrastructure/actions?workflow=lint-test-helm-pull.yaml", "clear": true}]'
          image: true
@@ -0,0 +1,427 @@
 name: render-manifests-automerge
 on:
  pull_request:
    branches:
      - main
    paths:
      - 'clusters/cl01tl/helm/**'
    types:
      - closed
 env:
  CLUSTER: cl01tl
  BASE_BRANCH: manifests
  BRANCH_NAME_BASE: auto/update-manifests-automerge
  MAIN_DIR: /workspace/alexlebens/infrastructure/infrastructure
  MANIFEST_DIR: /workspace/alexlebens/infrastructure/infrastructure-manifests
 jobs:
  render-manifests-automerge:
    runs-on: ubuntu-js
    if: ${{ (github.event.pull_request.merged == true) && (contains(github.event.pull_request.labels.*.name, 'automerge')) }}
    steps:
      - name: Checkout Main
        uses: actions/checkout@v6
        with:
          path: infrastructure
          fetch-depth: 0
      - name: Checkout Manifests
        uses: actions/checkout@v6
        with:
          ref: manifests
          path: infrastructure-manifests
      - name: Set up Helm
        uses: azure/setup-helm@v4
        with:
          token: ${{ secrets.GITEA_TOKEN }}
          version: v3.17.2 # Pending https://github.com/helm/helm/pull/30743
      - name: Prepare Manifest Branch
        id: prepare-manifest-branch
        run: |
          cd ${MANIFEST_DIR}
          BRANCH_NAME="${BRANCH_NAME_BASE}-$(date +%Y%m%d%H%M%S)"
          echo ">> Configure git to use gitea-bot as user ..."
          git config user.name "gitea-bot"
          git config user.email "gitea-bot@alexlebens.net"
          echo ">> Creating branch ..."
          git checkout -b $BRANCH_NAME
          echo "----"
          echo "BRANCH_NAME=${BRANCH_NAME}" >> $GITEA_OUTPUT
      - name: Check which Directories have Changes
        id: check-dir-changes
        run: |
          cd ${MAIN_DIR}
          RENDER_DIR=()
          echo ">> Checking for changes from HEAD^..HEAD ..."
          GIT_DIFF=$(git diff --name-only HEAD^..HEAD | xargs -I {} dirname {} | sort -u | grep -E "clusters/[^/]+/helm/[^/]+")
          if [ -n "${GIT_DIFF}" ]; then
            echo ">> Changes detected:"
            echo "$GIT_DIFF"
            for path in $GIT_DIFF; do
              RENDER_DIR+=$(echo "$path" | awk -F '/' '{print $4}')
              RENDER_DIR+=$(echo " ")
            done
          else
            echo ">> No changes detected"
          fi
          if [ -n "${RENDER_DIR}" ]; then
            echo ">> Directories to Render:"
            echo "$(echo "${RENDER_DIR}" | sort -u)"
            echo "----"
            echo "changes-detected=true" >> $GITEA_OUTPUT
            echo "render-dir<<EOF" >> $GITEA_OUTPUT
            echo "$(echo "${RENDER_DIR}" | sort -u)" >> $GITEA_OUTPUT
            echo "EOF" >> $GITEA_OUTPUT
          else
            echo "changes-detected=false" >> $GITEA_OUTPUT
          fi
      - name: Add Repositories
        if: steps.check-dir-changes.outputs.changes-detected == 'true'
        env:
          RENDER_DIR: ${{ steps.check-dir-changes.outputs.render-dir }}
        run: |
          cd ${MAIN_DIR}
          echo ">> Adding repositories for chart dependencies ..."
          for dir in ${RENDER_DIR}; do
            helm dependency list --max-col-width 120 ${MAIN_DIR}/clusters/${CLUSTER}/helm/$dir 2> /dev/null \
              | tail +2 | head -n -1 \
              | awk '{ print "helm repo add " $1 " " $3 }' \
              | while read cmd; do echo "$cmd" | sh; done || true
          done
          if helm repo list | tail +2 | read -r; then
            echo ">> Update repository cache ..."
            helm repo update
          fi
          echo "----"
      - name: Remove Changed Manifest Files
        if: steps.check-dir-changes.outputs.changes-detected == 'true'
        env:
          RENDER_DIR: ${{ steps.check-dir-changes.outputs.render-dir }}
        run: |
          cd ${MANIFEST_DIR}
          echo ">> Remove manfiest files and rebuild from source ..."
          for dir in ${RENDER_DIR}; do
            chart_path=${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$dir
            echo "$chart_path"
            rm -rf $chart_path/*
          done
          echo "----"
      - name: Render Helm Manifests
        id: render-manifests
        if: steps.check-dir-changes.outputs.changes-detected == 'true'
        env:
          RENDER_DIR: ${{ steps.check-dir-changes.outputs.render-dir }}
        run: |
          cd ${MAIN_DIR}
          echo ">> Rendering Manifests ..."
          for dir in ${RENDER_DIR}; do
            chart_path=${MAIN_DIR}/clusters/${CLUSTER}/helm/$dir
            chart_name=$(basename "$chart_path")
            echo ""
            echo ""
            echo ">> Rendering chart: $chart_name"
            echo ">> Chart path $chart_path"
            if [ -f "$chart_path/Chart.yaml" ]; then
              OUTPUT_FOLDER="${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$chart_name/"
              TEMPLATE=""
              mkdir -p ${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$chart_name
              cd $chart_path
              echo ""
              echo ">> Updating helm dependency ..."
              helm dependency update --skip-refresh
              echo ""
              echo ">> Building helm dependency ..."
              helm dependency build --skip-refresh
              echo ""
              echo ">> Linting helm ..."
              helm lint --namespace "$chart_name"
              echo ""
              echo ">> Rendering templates ..."
              case "$chart_name" in
                "stack")
                  echo ""
                  echo ">> Special Rendering for stack into argocd namespace ..."
                  TEMPLATE=$(helm template $chart_name ./ --namespace argocd --include-crds --dry-run)
                  ;;
                "cilium" | "coredns" | "metrics-server" |"prometheus-operator-crds")
                  echo ""
                  echo ">> Special Rendering for $chart_name into kube-system namespace ..."
                  TEMPLATE=$(helm template $chart_name ./ --namespace kube-system --include-crds --dry-run)
                  ;;
                *)
                  echo ""
                  echo ">> Standard Rendering for $chart_name ..."
                  TEMPLATE=$(helm template "$chart_name" ./ --namespace "$chart_name" --include-crds --dry-run)
                  ;;
              esac
              echo ""
              echo ">> Formating rendered template ..."
              echo "$TEMPLATE" | yq '... comments=""' | yq 'select(. != null)' | yq -s '"'"$OUTPUT_FOLDER"'" + .kind + "-" + .metadata.name + ".yaml"'
              # Strip comments again to ensure formatting correctness
              for file in "$OUTPUT_FOLDER"/*; do
                yq -i '... comments=""' $file
              done
              echo ""
              echo ">> Manifests for $chart_name rendered to $OUTPUT_FOLDER"
              ls $OUTPUT_FOLDER
              echo ""
            else
              echo ""
              echo ">> Directory $chart_path does not contain a Chart.yaml. Skipping ..."
              echo ""
            fi
          done
          echo "----"
      - name: Check for Changes
        id: check-changes
        if: steps.check-dir-changes.outputs.changes-detected == 'true'
        run: |
          cd ${MANIFEST_DIR}
          GIT_CHANGES=$(git status --porcelain)
          if [ -n "$GIT_CHANGES" ]; then
            echo ">> Changes detected"
            git status --porcelain
            echo "changes-detected=true" >> $GITEA_OUTPUT
          else
            echo ">> No changes detected, skipping PR creation"
          fi
          echo "----"
      - name: Commit and Push Changes
        id: commit-push
        if: steps.check-changes.outputs.changes-detected == 'true'
        env:
          BRANCH_NAME: ${{ steps.prepare-manifest-branch.outputs.BRANCH_NAME }}
        run: |
          cd ${MANIFEST_DIR}
          echo ">> Commiting changes to ${BRANCH_NAME} ..."
          git add .
          git commit -m "chore: Update manifests after automerge"
          REPO_URL="${{ secrets.REPO_URL }}/${{ gitea.repository }}"
          echo ">> Pushing changes to $REPO_URL ..."
          git push -u "https://oauth2:${{ secrets.BOT_TOKEN }}@$(echo $REPO_URL | sed -e 's|https://||')" ${BRANCH_NAME}
          echo "----"
          echo "push=true" >> $GITEA_OUTPUT
      - name: Create Pull Request
        id: create-pull-request
        if: steps.commit-push.outputs.push == 'true'
        env:
          GITEA_TOKEN: ${{ secrets.BOT_TOKEN }}
          GITEA_URL: ${{ secrets.REPO_URL }}
          BRANCH_NAME: ${{ steps.prepare-manifest-branch.outputs.BRANCH_NAME }}
        run: |
          cd ${MANIFEST_DIR}
          API_ENDPOINT="${GITEA_URL}/api/v1/repos/${{ gitea.repository }}/pulls"
          PAYLOAD=$( jq -n \
            --arg head "${BRANCH_NAME}" \
            --arg base "${BASE_BRANCH}" \
            --arg title "Automated Manifest Update - Automerge" \
            --arg body "This PR contains newly rendered Kubernetes manifests automatically generated by the CI workflow. This is expected to be automerged." \
            '{head: $head, base: $base, title: $title, body: $body}' )
          echo ">> Creating PR from branch ${BRANCH_NAME} into ${BASE_BRANCH}"
          echo ">> With Endpoint of:"
          echo "$API_ENDPOINT"
          echo ">> With Payload of:"
          echo "$PAYLOAD"
          HTTP_STATUS=$(
            curl -X POST \
              --silent \
              --write-out '%{http_code}' \
              --output response_body.json \
              --dump-header response_headers.txt \
              --data "$PAYLOAD" \
              -H "Authorization: token ${GITEA_TOKEN}" \
              -H "Content-Type: application/json" \
              "$API_ENDPOINT" 2> response_errors.txt
          )
          echo ">> HTTP Status Code: $HTTP_STATUS"
          echo ">> Response Output ..."
          echo "----"
          cat response_body.json
          echo "----"
          cat response_headers.txt
          echo "----"
          cat response_errors.txt
          echo "----"
          if [ "$HTTP_STATUS" == "201" ]; then
            echo ">> Pull Request created successfully!"
            PR_URL=$(cat response_body.json | jq -r .html_url)
            echo ">> Pull Request URL: $PR_URL"
            echo "pull-request-url=${PR_URL}" >> $GITEA_OUTPUT
            PR_NUMBER=$(cat response_body.json | jq -r .number)
            echo ">> Pull Request Number: $PR_NUMBER"
            echo "pull-request-number=${PR_NUMBER}" >> $GITEA_OUTPUT
            echo "pull-request-operation=created" >> $GITEA_OUTPUT
          elif [ "$HTTP_STATUS" == "422" ]; then
            echo ">> Failed to create PR (HTTP 422: Unprocessable Entity), PR may already exist"
          elif [ "$HTTP_STATUS" == "409" ]; then
            echo ">> Failed to create PR (HTTP 409: Conflict), PR already exists"
          else
            echo ">> Failed to create PR, HTTP status code: $HTTP_STATUS"
            exit 1
          fi
          echo "----"
      - name: Merge Changes
        id: merge-changes
        if: steps.commit-push.outputs.push == 'true'
        env:
          GITEA_TOKEN: ${{ secrets.BOT_TOKEN }}
          GITEA_URL: ${{ secrets.REPO_URL }}
          BRANCH_NAME: ${{ steps.prepare-manifest-branch.outputs.BRANCH_NAME }}
          PR_NUMBER: ${{ steps.create-pull-request.outputs.pull-request-number }}
        run: |
          cd ${MANIFEST_DIR}
          API_ENDPOINT="${GITEA_URL}/api/v1/repos/${{ gitea.repository }}/pulls/${PR_NUMBER}/merge"
          PAYLOAD=$( jq -n \
            --arg Do "merge" \
            '{Do: $Do}' )
          echo ">> Merging PR with ID: ${PR_NUMBER}"
          echo ">> With Endpoint of:"
          echo "$API_ENDPOINT"
          echo ">> With Payload of:"
          echo "$PAYLOAD"
          HTTP_STATUS=$(
            curl -X POST \
              --silent \
              --write-out '%{http_code}' \
              --output response_body.json \
              --dump-header response_headers.txt \
              --data "$PAYLOAD" \
              -H "Authorization: token ${GITEA_TOKEN}" \
              -H "Content-Type: application/json" \
              "$API_ENDPOINT" 2> response_errors.txt
          )
          echo ">> HTTP Status Code: $HTTP_STATUS"
          echo ">> Response Output ..."
          echo "----"
          cat response_body.json
          echo "----"
          cat response_headers.txt
          echo "----"
          cat response_errors.txt
          echo "----"
          if [ "$HTTP_STATUS" == "200" ]; then
            echo ">> Pull Request merged successfully!"
            echo "pull-request-operation=merged" >> $GITEA_OUTPUT
          else
            echo ">> Failed to create PR, HTTP status code: $HTTP_STATUS"
            echo "pull-request-operation=failed" >> $GITEA_OUTPUT
            exit 1
          fi
          echo "----"
      - name: Cleanup Branch
        if: failure()
        env:
          BRANCH_NAME: ${{ steps.prepare-manifest-branch.outputs.BRANCH_NAME }}
        run: |
          cd ${MANIFEST_DIR}
          echo ">> Removing branch: ${BRANCH_NAME}"
          git push origin --delete ${BRANCH_NAME}
          echo "----"
      - name: ntfy Merged
        uses: niniyas/ntfy-action@master
        if: steps.merge-changes.outputs.pull-request-operation == 'merged'
        with:
          url: "${{ secrets.NTFY_URL }}"
          topic: "${{ secrets.NTFY_TOPIC }}"
          title: "Manifest Render PR Merged - Infrastructure"
          priority: 3
          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
          tags: action,successfully,completed
          details: "Automerge Manifest rendering for Infrastructure!"
          icon: "https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png"
          actions: '[{"action": "view", "label": "Open Gitea", "url": "${{ steps.create-pull-request.outputs.pull-request-url }}", "clear": true}]'
      - name: ntfy Failed
        uses: niniyas/ntfy-action@master
        if: failure()
        with:
          url: "${{ secrets.NTFY_URL }}"
          topic: "${{ secrets.NTFY_TOPIC }}"
          title: "Manifest Render Failure - Infrastructure"
          priority: 4
          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
          tags: action,failed
          details: "Automerge Manifest rendering for Infrastructure has failed!"
          icon: "https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png"
          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/infrastructure/actions?workflow=render-manifests-automerge.yaml", "clear": true}]'
          image: true
@@ -0,0 +1,392 @@
 name: render-manifests-dispatch
 on:
  workflow_dispatch:
 env:
  CLUSTER: cl01tl
  BASE_BRANCH: manifests
  BRANCH_NAME: auto/update-manifests
  ASSIGNEE: alexlebens
  MAIN_DIR: /workspace/alexlebens/infrastructure/infrastructure
  MANIFEST_DIR: /workspace/alexlebens/infrastructure/infrastructure-manifests
 jobs:
  render-manifests-dispatch:
    runs-on: ubuntu-js
    steps:
      - name: Checkout Main
        uses: actions/checkout@v6
        with:
          path: infrastructure
          fetch-depth: 0
      - name: Checkout Manifests
        uses: actions/checkout@v6
        with:
          ref: manifests
          path: infrastructure-manifests
      - name: Set up Helm
        uses: azure/setup-helm@v4
        with:
          token: ${{ secrets.GITEA_TOKEN }}
          version: v3.17.2 # Pending https://github.com/helm/helm/pull/30743
      - name: Prepare Manifest Branch
        run: |
          cd ${MANIFEST_DIR}
          echo ">> Configure git to use gitea-bot as user ..."
          git config user.name "gitea-bot"
          git config user.email "gitea-bot@alexlebens.net"
          echo ">> Checking if PR branch exists ..."
          if [[ $(git ls-remote --heads origin "${BRANCH_NAME}" | wc -l) -gt 0 ]]; then
            echo ">> Branch '${BRANCH_NAME}' exists, pulling changes ..."
            git fetch origin "${BRANCH_NAME}"
            git checkout "${BRANCH_NAME}"
            git pull --rebase
          else
            echo ">> Branch '${BRANCH_NAME}' does not exist, creating ..."
            git checkout -b $BRANCH_NAME
          fi
          echo "----"
      - name: Check which Directories have Changes
        id: check-dir-changes
        run: |
          cd ${MAIN_DIR}
          RENDER_DIR=()
          echo ">> Triggered on dispatch, will check all paths ..."
          RENDER_DIR+=$(ls clusters/cl01tl/helm/)
          if [ -n "${RENDER_DIR}" ]; then
            echo ">> Directories to Render:"
            echo "$(echo "${RENDER_DIR}" | sort -u)"
            echo "----"
            echo "changes-detected=true" >> $GITEA_OUTPUT
            echo "render-dir<<EOF" >> $GITEA_OUTPUT
            echo "$(echo "${RENDER_DIR}" | sort -u)" >> $GITEA_OUTPUT
            echo "EOF" >> $GITEA_OUTPUT
          else
            echo "changes-detected=false" >> $GITEA_OUTPUT
          fi
      - name: Add Repositories
        if: steps.check-dir-changes.outputs.changes-detected == 'true'
        env:
          RENDER_DIR: ${{ steps.check-dir-changes.outputs.render-dir }}
        run: |
          cd ${MAIN_DIR}
          echo ">> Adding repositories for chart dependencies ..."
          for dir in ${RENDER_DIR}; do
            helm dependency list --max-col-width 120 ${MAIN_DIR}/clusters/${CLUSTER}/helm/$dir 2> /dev/null \
              | tail +2 | head -n -1 \
              | awk '{ print "helm repo add " $1 " " $3 }' \
              | while read cmd; do echo "$cmd" | sh; done || true
          done
          if helm repo list | tail +2 | read -r; then
            echo ">> Update repository cache ..."
            helm repo update
          fi
          echo "----"
      - name: Remove Changed Manifest Files
        if: steps.check-dir-changes.outputs.changes-detected == 'true'
        env:
          RENDER_DIR: ${{ steps.check-dir-changes.outputs.render-dir }}
        run: |
          cd ${MANIFEST_DIR}
          echo ">> Remove manfiest files and rebuild from source ..."
          for dir in ${RENDER_DIR}; do
            chart_path=${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$dir
            echo "$chart_path"
            rm -rf $chart_path/*
          done
          echo "----"
      - name: Render Helm Manifests
        id: render-manifests
        if: steps.check-dir-changes.outputs.changes-detected == 'true'
        env:
          RENDER_DIR: ${{ steps.check-dir-changes.outputs.render-dir }}
        run: |
          cd ${MAIN_DIR}
          echo ">> Rendering Manifests ..."
          for dir in ${RENDER_DIR}; do
            chart_path=${MAIN_DIR}/clusters/${CLUSTER}/helm/$dir
            chart_name=$(basename "$chart_path")
            echo ""
            echo ""
            echo ">> Rendering chart: $chart_name"
            echo ">> Chart path $chart_path"
            if [ -f "$chart_path/Chart.yaml" ]; then
              OUTPUT_FOLDER="${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$chart_name/"
              TEMPLATE=""
              mkdir -p ${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$chart_name
              cd $chart_path
              echo ""
              echo ">> Updating helm dependency ..."
              helm dependency update --skip-refresh
              echo ""
              echo ">> Building helm dependency ..."
              helm dependency build --skip-refresh
              echo ""
              echo ">> Linting helm ..."
              helm lint --namespace "$chart_name"
              echo ""
              echo ">> Rendering templates ..."
              case "$chart_name" in
                "stack")
                  echo ""
                  echo ">> Special Rendering for stack into argocd namespace ..."
                  TEMPLATE=$(helm template $chart_name ./ --namespace argocd --include-crds --dry-run)
                  ;;
                "cilium" | "coredns" | "metrics-server" |"prometheus-operator-crds")
                  echo ""
                  echo ">> Special Rendering for $chart_name into kube-system namespace ..."
                  TEMPLATE=$(helm template $chart_name ./ --namespace kube-system --include-crds --dry-run)
                  ;;
                *)
                  echo ""
                  echo ">> Standard Rendering for $chart_name ..."
                  TEMPLATE=$(helm template "$chart_name" ./ --namespace "$chart_name" --include-crds --dry-run)
                  ;;
              esac
              echo ""
              echo ">> Formating rendered template ..."
              echo "$TEMPLATE" | yq '... comments=""' | yq 'select(. != null)' | yq -s '"'"$OUTPUT_FOLDER"'" + .kind + "-" + .metadata.name + ".yaml"'
              # Strip comments again to ensure formatting correctness
              for file in "$OUTPUT_FOLDER"/*; do
                yq -i '... comments=""' $file
              done
              echo ""
              echo ">> Manifests for $chart_name rendered to $OUTPUT_FOLDER"
              ls $OUTPUT_FOLDER
              echo ""
            else
              echo ""
              echo ">> Directory $chart_path does not contain a Chart.yaml. Skipping ..."
              echo ""
            fi
          done
          echo "----"
      - name: Check for Changes
        id: check-changes
        if: steps.check-dir-changes.outputs.changes-detected == 'true'
        run: |
          cd ${MANIFEST_DIR}
          GIT_CHANGES=$(git status --porcelain)
          if [ -n "$GIT_CHANGES" ]; then
            echo ">> Changes detected"
            git status --porcelain
            echo "changes-detected=true" >> $GITEA_OUTPUT
          else
            echo ">> No changes detected, skipping PR creation"
          fi
          echo "----"
      - name: Commit and Push Changes
        id: commit-push
        if: steps.check-changes.outputs.changes-detected == 'true'
        run: |
          cd ${MANIFEST_DIR}
          echo ">> Commiting changes to ${BRANCH_NAME} ..."
          git add .
          git commit -m "chore: Update manifests after change"
          REPO_URL="${{ secrets.REPO_URL }}/${{ gitea.repository }}"
          echo ">> Pushing changes to $REPO_URL ..."
          git push -u "https://oauth2:${{ secrets.BOT_TOKEN }}@$(echo $REPO_URL | sed -e 's|https://||')" ${BRANCH_NAME}
          echo "----"
          echo "HEAD_BRANCH=${BRANCH_NAME}" >> $GITEA_OUTPUT
          echo "push=true" >> $GITEA_OUTPUT
      - name: Check for Pull Request
        id: check-for-pull-requst
        if: steps.commit-push.outputs.push == 'true'
        env:
          GITEA_TOKEN: ${{ secrets.BOT_TOKEN }}
          GITEA_URL: ${{ secrets.REPO_URL }}
          HEAD_BRANCH: ${{ steps.commit-push.outputs.HEAD_BRANCH }}
        run: |
          cd ${MANIFEST_DIR}
          API_ENDPOINT="${GITEA_URL}/api/v1/repos/${{ gitea.repository }}/pulls?base_branch=${BASE_BRANCH}&state=open&page=1"
          echo ">> Checking if PR from branch ${HEAD_BRANCH} into ${BASE_BRANCH}"
          echo ">> With Endpoint of:"
          echo "$API_ENDPOINT"
          HTTP_STATUS=$(
            curl -X GET \
              --silent \
              --write-out '%{http_code}' \
              --output response_body.json \
              --dump-header response_headers.txt \
              -H "Authorization: token ${GITEA_TOKEN}" \
              -H "Content-Type: application/json" \
              "$API_ENDPOINT" 2> response_errors.txt
          )
          echo ">> HTTP Status Code: $HTTP_STATUS"
          echo ">> Response Output ..."
          echo "----"
          cat response_body.json
          echo "----"
          cat response_headers.txt
          echo "----"
          cat response_errors.txt
          echo "----"
          if [ "$HTTP_STATUS" == "200" ] && [ "$(cat response_body.json | jq -r .[0].state)" == "open" ]; then
            echo ">> Pull Request has been found open, will update"
            PR_INDEX=$(cat response_body.json | jq -r .[0].number)
            echo "pull-request-exists=${PR_INDEX}" >> $GITEA_OUTPUT
            echo "pull-request-index=true" >> $GITEA_OUTPUT
          elif [ "$HTTP_STATUS" == "200" ] && [ "$(cat response_body.json | jq -r .[0].state)" == "closed" ]; then
            echo ">> Pull Request found, but was closed"
            echo "pull-request-exists=false" >> $GITEA_OUTPUT
          else
            echo ">> Pull Request not found"
            echo "pull-request-exists=false" >> $GITEA_OUTPUT
          fi
          echo "----"
      - name: Create Pull Request
        id: create-pull-request
        if: steps.commit-push.outputs.push == 'true' && steps.check-for-pull-requst.outputs.pull-request-exists == 'false'
        env:
          GITEA_TOKEN: ${{ secrets.BOT_TOKEN }}
          GITEA_URL: ${{ secrets.REPO_URL }}
          HEAD_BRANCH: ${{ steps.commit-push.outputs.HEAD_BRANCH }}
        run: |
          cd ${MANIFEST_DIR}
          API_ENDPOINT="${GITEA_URL}/api/v1/repos/${{ gitea.repository }}/pulls"
          PAYLOAD=$( jq -n \
            --arg head "${HEAD_BRANCH}" \
            --arg base "${BASE_BRANCH}" \
            --arg assignee "${ASSIGNEE}" \
            --arg title "Automated Manifest Update" \
            --arg body "This PR contains newly rendered Kubernetes manifests automatically generated by the CI workflow." \
            '{head: $head, base: $base, assignee: $assignee, title: $title, body: $body}' )
          echo ">> Creating PR from branch ${HEAD_BRANCH} into ${BASE_BRANCH}"
          echo ">> With Endpoint of:"
          echo "$API_ENDPOINT"
          echo ">> With Payload of:"
          echo "$PAYLOAD"
          HTTP_STATUS=$(
            curl -X POST \
              --silent \
              --write-out '%{http_code}' \
              --output response_body.json \
              --dump-header response_headers.txt \
              --data "$PAYLOAD" \
              -H "Authorization: token ${GITEA_TOKEN}" \
              -H "Content-Type: application/json" \
              "$API_ENDPOINT" 2> response_errors.txt
          )
          echo ">> HTTP Status Code: $HTTP_STATUS"
          echo ">> Response Output ..."
          echo "----"
          cat response_body.json
          echo "----"
          cat response_headers.txt
          echo "----"
          cat response_errors.txt
          echo "----"
          if [ "$HTTP_STATUS" == "201" ]; then
            echo ">> Pull Request created successfully!"
            PR_URL=$(cat response_body.json | jq -r .html_url)
            echo "pull-request-url=${PR_URL}" >> $GITEA_OUTPUT
            PR_ID=$(cat response_body.json | jq -r .id)
            echo "pull-request-id=${PR_ID}" >> $GITEA_OUTPUT
            echo "pull-request-operation=created" >> $GITEA_OUTPUT
          elif [ "$HTTP_STATUS" == "422" ]; then
            echo ">> Failed to create PR (HTTP 422: Unprocessable Entity), PR may already exist"
          elif [ "$HTTP_STATUS" == "409" ]; then
            echo ">> Failed to create PR (HTTP 409: Conflict), PR already exists"
          else
            echo ">> Failed to create PR, HTTP status code: $HTTP_STATUS"
            exit 1
          fi
          echo "----"
      - name: ntfy Created
        uses: niniyas/ntfy-action@master
        if: steps.create-pull-request.outputs.pull-request-operation == 'created'
        with:
          url: "${{ secrets.NTFY_URL }}"
          topic: "${{ secrets.NTFY_TOPIC }}"
          title: "Manifest Render PR Created - Infrastructure"
          priority: 3
          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
          tags: action,successfully,completed
          details: "Manifest rendering for Infrastructure has created a new Pull Request with ID: ${{ steps.create-pull-request.outputs.pull-request-id }}!"
          icon: "https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png"
          actions: '[{"action": "view", "label": "Open Gitea", "url": "${{ steps.create-pull-request.outputs.pull-request-url }}", "clear": true}]'
      - name: ntfy Failed
        uses: niniyas/ntfy-action@master
        if: failure()
        with:
          url: "${{ secrets.NTFY_URL }}"
          topic: "${{ secrets.NTFY_TOPIC }}"
          title: "Manifest Render Failure - Infrastructure"
          priority: 4
          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
          tags: action,failed
          details: "Manifest rendering for Infrastructure has failed!"
          icon: "https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png"
          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/infrastructure/actions?workflow=render-manifests.yaml", "clear": true}]'
          image: true
@@ -0,0 +1,412 @@
 name: render-manifests-merge
 on:
  pull_request:
    branches:
      - main
    paths:
      - 'clusters/cl01tl/helm/**'
    types:
      - closed
 env:
  CLUSTER: cl01tl
  BASE_BRANCH: manifests
  BRANCH_NAME: auto/update-manifests
  ASSIGNEE: alexlebens
  MAIN_DIR: /workspace/alexlebens/infrastructure/infrastructure
  MANIFEST_DIR: /workspace/alexlebens/infrastructure/infrastructure-manifests
 jobs:
  render-manifests-merge:
    runs-on: ubuntu-js
    if: ${{ (github.event.pull_request.merged == true) && !(contains(github.event.pull_request.labels.*.name, 'automerge')) }}
    steps:
      - name: Checkout Main
        uses: actions/checkout@v6
        with:
          path: infrastructure
          fetch-depth: 0
      - name: Checkout Manifests
        uses: actions/checkout@v6
        with:
          ref: manifests
          path: infrastructure-manifests
      - name: Set up Helm
        uses: azure/setup-helm@v4
        with:
          token: ${{ secrets.GITEA_TOKEN }}
          version: v3.17.2 # Pending https://github.com/helm/helm/pull/30743
      - name: Prepare Manifest Branch
        run: |
          cd ${MANIFEST_DIR}
          echo ">> Configure git to use gitea-bot as user ..."
          git config user.name "gitea-bot"
          git config user.email "gitea-bot@alexlebens.net"
          echo ">> Checking if PR branch exists ..."
          if [[ $(git ls-remote --heads origin "${BRANCH_NAME}" | wc -l) -gt 0 ]]; then
            echo ">> Branch '${BRANCH_NAME}' exists, pulling changes ..."
            git fetch origin "${BRANCH_NAME}"
            git checkout "${BRANCH_NAME}"
            git pull --rebase
          else
            echo ">> Branch '${BRANCH_NAME}' does not exist, creating ..."
            git checkout -b $BRANCH_NAME
          fi
          echo "----"
      - name: Check which Directories have Changes
        id: check-dir-changes
        run: |
          cd ${MAIN_DIR}
          RENDER_DIR=()
          echo ">> Checking for changes from HEAD^..HEAD ..."
          GIT_DIFF=$(git diff --name-only HEAD^..HEAD | xargs -I {} dirname {} | sort -u | grep -E "clusters/[^/]+/helm/[^/]+")
          if [ -n "${GIT_DIFF}" ]; then
            echo ">> Changes detected:"
            echo "$GIT_DIFF"
            for path in $GIT_DIFF; do
              RENDER_DIR+=$(echo "$path" | awk -F '/' '{print $4}')
              RENDER_DIR+=$(echo " ")
            done
          else
            echo ">> No changes detected"
          fi
          if [ -n "${RENDER_DIR}" ]; then
            echo ">> Directories to Render:"
            echo "$(echo "${RENDER_DIR}" | sort -u)"
            echo "----"
            echo "changes-detected=true" >> $GITEA_OUTPUT
            echo "render-dir<<EOF" >> $GITEA_OUTPUT
            echo "$(echo "${RENDER_DIR}" | sort -u)" >> $GITEA_OUTPUT
            echo "EOF" >> $GITEA_OUTPUT
          else
            echo "changes-detected=false" >> $GITEA_OUTPUT
          fi
      - name: Add Repositories
        if: steps.check-dir-changes.outputs.changes-detected == 'true'
        env:
          RENDER_DIR: ${{ steps.check-dir-changes.outputs.render-dir }}
        run: |
          cd ${MAIN_DIR}
          echo ">> Adding repositories for chart dependencies ..."
          for dir in ${RENDER_DIR}; do
            helm dependency list --max-col-width 120 ${MAIN_DIR}/clusters/${CLUSTER}/helm/$dir 2> /dev/null \
              | tail +2 | head -n -1 \
              | awk '{ print "helm repo add " $1 " " $3 }' \
              | while read cmd; do echo "$cmd" | sh; done || true
          done
          if helm repo list | tail +2 | read -r; then
            echo ">> Update repository cache ..."
            helm repo update
          fi
          echo "----"
      - name: Remove Changed Manifest Files
        if: steps.check-dir-changes.outputs.changes-detected == 'true'
        env:
          RENDER_DIR: ${{ steps.check-dir-changes.outputs.render-dir }}
        run: |
          cd ${MANIFEST_DIR}
          echo ">> Remove manfiest files and rebuild from source ..."
          for dir in ${RENDER_DIR}; do
            chart_path=${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$dir
            echo "$chart_path"
            rm -rf $chart_path/*
          done
          echo "----"
      - name: Render Helm Manifests
        id: render-manifests
        if: steps.check-dir-changes.outputs.changes-detected == 'true'
        env:
          RENDER_DIR: ${{ steps.check-dir-changes.outputs.render-dir }}
        run: |
          cd ${MAIN_DIR}
          echo ">> Rendering Manifests ..."
          for dir in ${RENDER_DIR}; do
            chart_path=${MAIN_DIR}/clusters/${CLUSTER}/helm/$dir
            chart_name=$(basename "$chart_path")
            echo ""
            echo ""
            echo ">> Rendering chart: $chart_name"
            echo ">> Chart path $chart_path"
            if [ -f "$chart_path/Chart.yaml" ]; then
              OUTPUT_FOLDER="${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$chart_name/"
              TEMPLATE=""
              mkdir -p ${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$chart_name
              cd $chart_path
              echo ""
              echo ">> Updating helm dependency ..."
              helm dependency update --skip-refresh
              echo ""
              echo ">> Building helm dependency ..."
              helm dependency build --skip-refresh
              echo ""
              echo ">> Linting helm ..."
              helm lint --namespace "$chart_name"
              echo ""
              echo ">> Rendering templates ..."
              case "$chart_name" in
                "stack")
                  echo ""
                  echo ">> Special Rendering for stack into argocd namespace ..."
                  TEMPLATE=$(helm template $chart_name ./ --namespace argocd --include-crds --dry-run)
                  ;;
                "cilium" | "coredns" | "metrics-server" |"prometheus-operator-crds")
                  echo ""
                  echo ">> Special Rendering for $chart_name into kube-system namespace ..."
                  TEMPLATE=$(helm template $chart_name ./ --namespace kube-system --include-crds --dry-run)
                  ;;
                *)
                  echo ""
                  echo ">> Standard Rendering for $chart_name ..."
                  TEMPLATE=$(helm template "$chart_name" ./ --namespace "$chart_name" --include-crds --dry-run)
                  ;;
              esac
              echo ""
              echo ">> Formating rendered template ..."
              echo "$TEMPLATE" | yq '... comments=""' | yq 'select(. != null)' | yq -s '"'"$OUTPUT_FOLDER"'" + .kind + "-" + .metadata.name + ".yaml"'
              # Strip comments again to ensure formatting correctness
              for file in "$OUTPUT_FOLDER"/*; do
                yq -i '... comments=""' $file
              done
              echo ""
              echo ">> Manifests for $chart_name rendered to $OUTPUT_FOLDER"
              ls $OUTPUT_FOLDER
              echo ""
            else
              echo ""
              echo ">> Directory $chart_path does not contain a Chart.yaml. Skipping ..."
              echo ""
            fi
          done
          echo "----"
      - name: Check for Changes
        id: check-changes
        if: steps.check-dir-changes.outputs.changes-detected == 'true'
        run: |
          cd ${MANIFEST_DIR}
          GIT_CHANGES=$(git status --porcelain)
          if [ -n "$GIT_CHANGES" ]; then
            echo ">> Changes detected"
            git status --porcelain
            echo "changes-detected=true" >> $GITEA_OUTPUT
          else
            echo ">> No changes detected, skipping PR creation"
          fi
          echo "----"
      - name: Commit and Push Changes
        id: commit-push
        if: steps.check-changes.outputs.changes-detected == 'true'
        run: |
          cd ${MANIFEST_DIR}
          echo ">> Commiting changes to ${BRANCH_NAME} ..."
          git add .
          git commit -m "chore: Update manifests after change"
          REPO_URL="${{ secrets.REPO_URL }}/${{ gitea.repository }}"
          echo ">> Pushing changes to $REPO_URL ..."
          git push -u "https://oauth2:${{ secrets.BOT_TOKEN }}@$(echo $REPO_URL | sed -e 's|https://||')" ${BRANCH_NAME}
          echo "----"
          echo "HEAD_BRANCH=${BRANCH_NAME}" >> $GITEA_OUTPUT
          echo "push=true" >> $GITEA_OUTPUT
      - name: Check for Pull Request
        id: check-for-pull-requst
        if: steps.commit-push.outputs.push == 'true'
        env:
          GITEA_TOKEN: ${{ secrets.BOT_TOKEN }}
          GITEA_URL: ${{ secrets.REPO_URL }}
          HEAD_BRANCH: ${{ steps.commit-push.outputs.HEAD_BRANCH }}
        run: |
          cd ${MANIFEST_DIR}
          API_ENDPOINT="${GITEA_URL}/api/v1/repos/${{ gitea.repository }}/pulls?base_branch=${BASE_BRANCH}&state=open&page=1"
          echo ">> Checking if PR from branch ${HEAD_BRANCH} into ${BASE_BRANCH}"
          echo ">> With Endpoint of:"
          echo "$API_ENDPOINT"
          HTTP_STATUS=$(
            curl -X GET \
              --silent \
              --write-out '%{http_code}' \
              --output response_body.json \
              --dump-header response_headers.txt \
              -H "Authorization: token ${GITEA_TOKEN}" \
              -H "Content-Type: application/json" \
              "$API_ENDPOINT" 2> response_errors.txt
          )
          echo ">> HTTP Status Code: $HTTP_STATUS"
          echo ">> Response Output ..."
          echo "----"
          cat response_body.json
          echo "----"
          cat response_headers.txt
          echo "----"
          cat response_errors.txt
          echo "----"
          if [ "$HTTP_STATUS" == "200" ] && [ "$(cat response_body.json | jq -r .[0].state)" == "open" ]; then
            echo ">> Pull Request has been found open, will update"
            PR_INDEX=$(cat response_body.json | jq -r .[0].number)
            echo "pull-request-exists=${PR_INDEX}" >> $GITEA_OUTPUT
            echo "pull-request-index=true" >> $GITEA_OUTPUT
          elif [ "$HTTP_STATUS" == "200" ] && [ "$(cat response_body.json | jq -r .[0].state)" == "closed" ]; then
            echo ">> Pull Request found, but was closed"
            echo "pull-request-exists=false" >> $GITEA_OUTPUT
          else
            echo ">> Pull Request not found"
            echo "pull-request-exists=false" >> $GITEA_OUTPUT
          fi
          echo "----"
      - name: Create Pull Request
        id: create-pull-request
        if: steps.commit-push.outputs.push == 'true' && steps.check-for-pull-requst.outputs.pull-request-exists == 'false'
        env:
          GITEA_TOKEN: ${{ secrets.BOT_TOKEN }}
          GITEA_URL: ${{ secrets.REPO_URL }}
          HEAD_BRANCH: ${{ steps.commit-push.outputs.HEAD_BRANCH }}
        run: |
          cd ${MANIFEST_DIR}
          API_ENDPOINT="${GITEA_URL}/api/v1/repos/${{ gitea.repository }}/pulls"
          PAYLOAD=$( jq -n \
            --arg head "${HEAD_BRANCH}" \
            --arg base "${BASE_BRANCH}" \
            --arg assignee "${ASSIGNEE}" \
            --arg title "Automated Manifest Update" \
            --arg body "This PR contains newly rendered Kubernetes manifests automatically generated by the CI workflow." \
            '{head: $head, base: $base, assignee: $assignee, title: $title, body: $body}' )
          echo ">> Creating PR from branch ${HEAD_BRANCH} into ${BASE_BRANCH}"
          echo ">> With Endpoint of:"
          echo "$API_ENDPOINT"
          echo ">> With Payload of:"
          echo "$PAYLOAD"
          HTTP_STATUS=$(
            curl -X POST \
              --silent \
              --write-out '%{http_code}' \
              --output response_body.json \
              --dump-header response_headers.txt \
              --data "$PAYLOAD" \
              -H "Authorization: token ${GITEA_TOKEN}" \
              -H "Content-Type: application/json" \
              "$API_ENDPOINT" 2> response_errors.txt
          )
          echo ">> HTTP Status Code: $HTTP_STATUS"
          echo ">> Response Output ..."
          echo "----"
          cat response_body.json
          echo "----"
          cat response_headers.txt
          echo "----"
          cat response_errors.txt
          echo "----"
          if [ "$HTTP_STATUS" == "201" ]; then
            echo ">> Pull Request created successfully!"
            PR_URL=$(cat response_body.json | jq -r .html_url)
            echo "pull-request-url=${PR_URL}" >> $GITEA_OUTPUT
            PR_ID=$(cat response_body.json | jq -r .id)
            echo "pull-request-id=${PR_ID}" >> $GITEA_OUTPUT
            echo "pull-request-operation=created" >> $GITEA_OUTPUT
          elif [ "$HTTP_STATUS" == "422" ]; then
            echo ">> Failed to create PR (HTTP 422: Unprocessable Entity), PR may already exist"
          elif [ "$HTTP_STATUS" == "409" ]; then
            echo ">> Failed to create PR (HTTP 409: Conflict), PR already exists"
          else
            echo ">> Failed to create PR, HTTP status code: $HTTP_STATUS"
            exit 1
          fi
          echo "----"
      - name: ntfy Created
        uses: niniyas/ntfy-action@master
        if: steps.create-pull-request.outputs.pull-request-operation == 'created'
        with:
          url: "${{ secrets.NTFY_URL }}"
          topic: "${{ secrets.NTFY_TOPIC }}"
          title: "Manifest Render PR Created - Infrastructure"
          priority: 3
          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
          tags: action,successfully,completed
          details: "Manifest rendering for Infrastructure has created a new Pull Request with ID: ${{ steps.create-pull-request.outputs.pull-request-id }}!"
          icon: "https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png"
          actions: '[{"action": "view", "label": "Open Gitea", "url": "${{ steps.create-pull-request.outputs.pull-request-url }}", "clear": true}]'
      - name: ntfy Failed
        uses: niniyas/ntfy-action@master
        if: failure()
        with:
          url: "${{ secrets.NTFY_URL }}"
          topic: "${{ secrets.NTFY_TOPIC }}"
          title: "Manifest Render Failure - Infrastructure"
          priority: 4
          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
          tags: action,failed
          details: "Manifest rendering for Infrastructure has failed!"
          icon: "https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png"
          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/infrastructure/actions?workflow=render-manifests.yaml", "clear": true}]'
          image: true
@@ -0,0 +1,410 @@
 name: render-manifests-push
 on:
  push:
    branches:
      - main
    paths:
      - 'clusters/cl01tl/helm/**'
 env:
  CLUSTER: cl01tl
  BASE_BRANCH: manifests
  BRANCH_NAME: auto/update-manifests
  ASSIGNEE: alexlebens
  MAIN_DIR: /workspace/alexlebens/infrastructure/infrastructure
  MANIFEST_DIR: /workspace/alexlebens/infrastructure/infrastructure-manifests
 jobs:
  render-manifests-push:
    runs-on: ubuntu-js
    if: gitea.event.commits[0].author.username != 'renovate-bot'
    steps:
      - name: Checkout Main
        uses: actions/checkout@v6
        with:
          path: infrastructure
          fetch-depth: 0
      - name: Checkout Manifests
        uses: actions/checkout@v6
        with:
          ref: manifests
          path: infrastructure-manifests
      - name: Set up Helm
        uses: azure/setup-helm@v4
        with:
          token: ${{ secrets.GITEA_TOKEN }}
          version: v3.17.2 # Pending https://github.com/helm/helm/pull/30743
      - name: Prepare Manifest Branch
        run: |
          cd ${MANIFEST_DIR}
          echo ">> Configure git to use gitea-bot as user ..."
          git config user.name "gitea-bot"
          git config user.email "gitea-bot@alexlebens.net"
          echo ">> Checking if PR branch exists ..."
          if [[ $(git ls-remote --heads origin "${BRANCH_NAME}" | wc -l) -gt 0 ]]; then
            echo ">> Branch '${BRANCH_NAME}' exists, pulling changes ..."
            git fetch origin "${BRANCH_NAME}"
            git checkout "${BRANCH_NAME}"
            git pull --rebase
          else
            echo ">> Branch '${BRANCH_NAME}' does not exist, creating ..."
            git checkout -b $BRANCH_NAME
          fi
          echo "----"
      - name: Check which Directories have Changes
        id: check-dir-changes
        run: |
          cd ${MAIN_DIR}
          RENDER_DIR=()
          echo ">> Checking for changes ..."
          GIT_DIFF=$(git diff --name-only ${{ gitea.event.before }}..HEAD | xargs -I {} dirname {} | sort -u | grep -E "clusters/[^/]+/helm/[^/]+")
          if [ -n "${GIT_DIFF}" ]; then
            echo ">> Changes detected:"
            echo "$GIT_DIFF"
            for path in $GIT_DIFF; do
              RENDER_DIR+=$(echo "$path" | awk -F '/' '{print $4}')
              RENDER_DIR+=$(echo " ")
            done
          else
            echo ">> No changes detected"
          fi
          if [ -n "${RENDER_DIR}" ]; then
            echo ">> Directories to Render:"
            echo "$(echo "${RENDER_DIR}" | sort -u)"
            echo "----"
            echo "changes-detected=true" >> $GITEA_OUTPUT
            echo "render-dir<<EOF" >> $GITEA_OUTPUT
            echo "$(echo "${RENDER_DIR}" | sort -u)" >> $GITEA_OUTPUT
            echo "EOF" >> $GITEA_OUTPUT
          else
            echo "changes-detected=false" >> $GITEA_OUTPUT
          fi
      - name: Add Repositories
        if: steps.check-dir-changes.outputs.changes-detected == 'true'
        env:
          RENDER_DIR: ${{ steps.check-dir-changes.outputs.render-dir }}
        run: |
          cd ${MAIN_DIR}
          echo ">> Adding repositories for chart dependencies ..."
          for dir in ${RENDER_DIR}; do
            helm dependency list --max-col-width 120 ${MAIN_DIR}/clusters/${CLUSTER}/helm/$dir 2> /dev/null \
              | tail +2 | head -n -1 \
              | awk '{ print "helm repo add " $1 " " $3 }' \
              | while read cmd; do echo "$cmd" | sh; done || true
          done
          if helm repo list | tail +2 | read -r; then
            echo ">> Update repository cache ..."
            helm repo update
          fi
          echo "----"
      - name: Remove Changed Manifest Files
        if: steps.check-dir-changes.outputs.changes-detected == 'true'
        env:
          RENDER_DIR: ${{ steps.check-dir-changes.outputs.render-dir }}
        run: |
          cd ${MANIFEST_DIR}
          echo ">> Remove manfiest files and rebuild from source ..."
          for dir in ${RENDER_DIR}; do
            chart_path=${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$dir
            echo "$chart_path"
            rm -rf $chart_path/*
          done
          echo "----"
      - name: Render Helm Manifests
        id: render-manifests
        if: steps.check-dir-changes.outputs.changes-detected == 'true'
        env:
          RENDER_DIR: ${{ steps.check-dir-changes.outputs.render-dir }}
        run: |
          cd ${MAIN_DIR}
          echo ">> Rendering Manifests ..."
          for dir in ${RENDER_DIR}; do
            chart_path=${MAIN_DIR}/clusters/${CLUSTER}/helm/$dir
            chart_name=$(basename "$chart_path")
            echo ""
            echo ""
            echo ">> Rendering chart: $chart_name"
            echo ">> Chart path $chart_path"
            if [ -f "$chart_path/Chart.yaml" ]; then
              OUTPUT_FOLDER="${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$chart_name/"
              TEMPLATE=""
              mkdir -p ${MANIFEST_DIR}/clusters/${CLUSTER}/manifests/$chart_name
              cd $chart_path
              echo ""
              echo ">> Updating helm dependency ..."
              helm dependency update --skip-refresh
              echo ""
              echo ">> Building helm dependency ..."
              helm dependency build --skip-refresh
              echo ""
              echo ">> Linting helm ..."
              helm lint --namespace "$chart_name"
              echo ""
              echo ">> Rendering templates ..."
              case "$chart_name" in
                "stack")
                  echo ""
                  echo ">> Special Rendering for stack into argocd namespace ..."
                  TEMPLATE=$(helm template $chart_name ./ --namespace argocd --include-crds --dry-run)
                  ;;
                "cilium" | "coredns" | "metrics-server" |"prometheus-operator-crds")
                  echo ""
                  echo ">> Special Rendering for $chart_name into kube-system namespace ..."
                  TEMPLATE=$(helm template $chart_name ./ --namespace kube-system --include-crds --dry-run)
                  ;;
                *)
                  echo ""
                  echo ">> Standard Rendering for $chart_name ..."
                  TEMPLATE=$(helm template "$chart_name" ./ --namespace "$chart_name" --include-crds --dry-run)
                  ;;
              esac
              echo ""
              echo ">> Formating rendered template ..."
              echo "$TEMPLATE" | yq '... comments=""' | yq 'select(. != null)' | yq -s '"'"$OUTPUT_FOLDER"'" + .kind + "-" + .metadata.name + ".yaml"'
              # Strip comments again to ensure formatting correctness
              for file in "$OUTPUT_FOLDER"/*; do
                yq -i '... comments=""' $file
              done
              echo ""
              echo ">> Manifests for $chart_name rendered to $OUTPUT_FOLDER"
              ls $OUTPUT_FOLDER
              echo ""
            else
              echo ""
              echo ">> Directory $chart_path does not contain a Chart.yaml. Skipping ..."
              echo ""
            fi
          done
          echo "----"
      - name: Check for Changes
        id: check-changes
        if: steps.check-dir-changes.outputs.changes-detected == 'true'
        run: |
          cd ${MANIFEST_DIR}
          GIT_CHANGES=$(git status --porcelain)
          if [ -n "$GIT_CHANGES" ]; then
            echo ">> Changes detected"
            git status --porcelain
            echo "changes-detected=true" >> $GITEA_OUTPUT
          else
            echo ">> No changes detected, skipping PR creation"
          fi
          echo "----"
      - name: Commit and Push Changes
        id: commit-push
        if: steps.check-changes.outputs.changes-detected == 'true'
        run: |
          cd ${MANIFEST_DIR}
          echo ">> Commiting changes to ${BRANCH_NAME} ..."
          git add .
          git commit -m "chore: Update manifests after change"
          REPO_URL="${{ secrets.REPO_URL }}/${{ gitea.repository }}"
          echo ">> Pushing changes to $REPO_URL ..."
          git push -u "https://oauth2:${{ secrets.BOT_TOKEN }}@$(echo $REPO_URL | sed -e 's|https://||')" ${BRANCH_NAME}
          echo "----"
          echo "HEAD_BRANCH=${BRANCH_NAME}" >> $GITEA_OUTPUT
          echo "push=true" >> $GITEA_OUTPUT
      - name: Check for Pull Request
        id: check-for-pull-requst
        if: steps.commit-push.outputs.push == 'true'
        env:
          GITEA_TOKEN: ${{ secrets.BOT_TOKEN }}
          GITEA_URL: ${{ secrets.REPO_URL }}
          HEAD_BRANCH: ${{ steps.commit-push.outputs.HEAD_BRANCH }}
        run: |
          cd ${MANIFEST_DIR}
          API_ENDPOINT="${GITEA_URL}/api/v1/repos/${{ gitea.repository }}/pulls?base_branch=${BASE_BRANCH}&state=open&page=1"
          echo ">> Checking if PR from branch ${HEAD_BRANCH} into ${BASE_BRANCH}"
          echo ">> With Endpoint of:"
          echo "$API_ENDPOINT"
          HTTP_STATUS=$(
            curl -X GET \
              --silent \
              --write-out '%{http_code}' \
              --output response_body.json \
              --dump-header response_headers.txt \
              -H "Authorization: token ${GITEA_TOKEN}" \
              -H "Content-Type: application/json" \
              "$API_ENDPOINT" 2> response_errors.txt
          )
          echo ">> HTTP Status Code: $HTTP_STATUS"
          echo ">> Response Output ..."
          echo "----"
          cat response_body.json
          echo "----"
          cat response_headers.txt
          echo "----"
          cat response_errors.txt
          echo "----"
          if [ "$HTTP_STATUS" == "200" ] && [ "$(cat response_body.json | jq -r .[0].state)" == "open" ]; then
            echo ">> Pull Request has been found open, will update"
            PR_INDEX=$(cat response_body.json | jq -r .[0].number)
            echo "pull-request-exists=${PR_INDEX}" >> $GITEA_OUTPUT
            echo "pull-request-index=true" >> $GITEA_OUTPUT
          elif [ "$HTTP_STATUS" == "200" ] && [ "$(cat response_body.json | jq -r .[0].state)" == "closed" ]; then
            echo ">> Pull Request found, but was closed"
            echo "pull-request-exists=false" >> $GITEA_OUTPUT
          else
            echo ">> Pull Request not found"
            echo "pull-request-exists=false" >> $GITEA_OUTPUT
          fi
          echo "----"
      - name: Create Pull Request
        id: create-pull-request
        if: steps.commit-push.outputs.push == 'true' && steps.check-for-pull-requst.outputs.pull-request-exists == 'false'
        env:
          GITEA_TOKEN: ${{ secrets.BOT_TOKEN }}
          GITEA_URL: ${{ secrets.REPO_URL }}
          HEAD_BRANCH: ${{ steps.commit-push.outputs.HEAD_BRANCH }}
        run: |
          cd ${MANIFEST_DIR}
          API_ENDPOINT="${GITEA_URL}/api/v1/repos/${{ gitea.repository }}/pulls"
          PAYLOAD=$( jq -n \
            --arg head "${HEAD_BRANCH}" \
            --arg base "${BASE_BRANCH}" \
            --arg assignee "${ASSIGNEE}" \
            --arg title "Automated Manifest Update" \
            --arg body "This PR contains newly rendered Kubernetes manifests automatically generated by the CI workflow." \
            '{head: $head, base: $base, assignee: $assignee, title: $title, body: $body}' )
          echo ">> Creating PR from branch ${HEAD_BRANCH} into ${BASE_BRANCH}"
          echo ">> With Endpoint of:"
          echo "$API_ENDPOINT"
          echo ">> With Payload of:"
          echo "$PAYLOAD"
          HTTP_STATUS=$(
            curl -X POST \
              --silent \
              --write-out '%{http_code}' \
              --output response_body.json \
              --dump-header response_headers.txt \
              --data "$PAYLOAD" \
              -H "Authorization: token ${GITEA_TOKEN}" \
              -H "Content-Type: application/json" \
              "$API_ENDPOINT" 2> response_errors.txt
          )
          echo ">> HTTP Status Code: $HTTP_STATUS"
          echo ">> Response Output ..."
          echo "----"
          cat response_body.json
          echo "----"
          cat response_headers.txt
          echo "----"
          cat response_errors.txt
          echo "----"
          if [ "$HTTP_STATUS" == "201" ]; then
            echo ">> Pull Request created successfully!"
            PR_URL=$(cat response_body.json | jq -r .html_url)
            echo "pull-request-url=${PR_URL}" >> $GITEA_OUTPUT
            PR_ID=$(cat response_body.json | jq -r .id)
            echo "pull-request-id=${PR_ID}" >> $GITEA_OUTPUT
            echo "pull-request-operation=created" >> $GITEA_OUTPUT
          elif [ "$HTTP_STATUS" == "422" ]; then
            echo ">> Failed to create PR (HTTP 422: Unprocessable Entity), PR may already exist"
          elif [ "$HTTP_STATUS" == "409" ]; then
            echo ">> Failed to create PR (HTTP 409: Conflict), PR already exists"
          else
            echo ">> Failed to create PR, HTTP status code: $HTTP_STATUS"
            exit 1
          fi
          echo "----"
      - name: ntfy Created
        uses: niniyas/ntfy-action@master
        if: steps.create-pull-request.outputs.pull-request-operation == 'created'
        with:
          url: "${{ secrets.NTFY_URL }}"
          topic: "${{ secrets.NTFY_TOPIC }}"
          title: "Manifest Render PR Created - Infrastructure"
          priority: 3
          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
          tags: action,successfully,completed
          details: "Manifest rendering for Infrastructure has created a new Pull Request with ID: ${{ steps.create-pull-request.outputs.pull-request-id }}!"
          icon: "https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png"
          actions: '[{"action": "view", "label": "Open Gitea", "url": "${{ steps.create-pull-request.outputs.pull-request-url }}", "clear": true}]'
      - name: ntfy Failed
        uses: niniyas/ntfy-action@master
        if: failure()
        with:
          url: "${{ secrets.NTFY_URL }}"
          topic: "${{ secrets.NTFY_TOPIC }}"
          title: "Manifest Render Failure - Infrastructure"
          priority: 4
          headers: '{"Authorization": "Bearer ${{ secrets.NTFY_CRED }}"}'
          tags: action,failed
          details: "Manifest rendering for Infrastructure has failed!"
          icon: "https://cdn.jsdelivr.net/gh/selfhst/icons/png/gitea.png"
          actions: '[{"action": "view", "label": "Open Gitea", "url": "https://gitea.alexlebens.dev/alexlebens/infrastructure/actions?workflow=render-manifests.yaml", "clear": true}]'
          image: true
@@ -0,0 +1,32 @@
 name: renovate
 on:
  schedule:
    - cron: "@hourly"
  push:
    branches:
      - main
  workflow_dispatch:
 jobs:
  renovate:
    runs-on: ubuntu-latest
    container: ghcr.io/renovatebot/renovate:42
    steps:
      - name: Checkout
        uses: actions/checkout@v6
      - name: Renovate
        run: renovate
        env:
          RENOVATE_PLATFORM: gitea
          RENOVATE_ENDPOINT: ${{ vars.INSTANCE_URL }}
          RENOVATE_REPOSITORIES: alexlebens/infrastructure
          RENOVATE_GIT_AUTHOR: Renovate Bot <renovate-bot@alexlebens.net>
          LOG_LEVEL: info
          RENOVATE_TOKEN: ${{ secrets.RENOVATE_TOKEN }}
          RENOVATE_GIT_PRIVATE_KEY: ${{ secrets.RENOVATE_GIT_PRIVATE_KEY }}
          RENOVATE_GITHUB_COM_TOKEN: ${{ secrets.RENOVATE_GITHUB_COM_TOKEN }}
          RENOVATE_REDIS_URL: ${{ vars.RENOVATE_REDIS_URL }}
@@ -1,4 +1,3 @@
 .gitignore
 /**/archive/
 /**/charts/
-/**/helm/
+/**/manifests/
@@ -0,0 +1,15 @@
 repos:
  - repo: https://github.com/pre-commit/pre-commit-hooks
    rev: v2.3.0
    hooks:
      - id: end-of-file-fixer
      - id: trailing-whitespace
      - id: check-added-large-files
      - id: check-yaml
        exclude: '^.*\/templates\/.*$'
        args:
          - --multi
  - repo: https://github.com/IamTheFij/docker-pre-commit
    rev: v2.0.0
    hooks:
      - id: docker-compose-check
@@ -0,0 +1,201 @@
                                 Apache License
                           Version 2.0, January 2004
                        http://www.apache.org/licenses/
   TERMS AND CONDITIONS FOR USE, REPRODUCTION, AND DISTRIBUTION
   1. Definitions.
      "License" shall mean the terms and conditions for use, reproduction,
      and distribution as defined by Sections 1 through 9 of this document.
      "Licensor" shall mean the copyright owner or entity authorized by
      the copyright owner that is granting the License.
      "Legal Entity" shall mean the union of the acting entity and all
      other entities that control, are controlled by, or are under common
      control with that entity. For the purposes of this definition,
      "control" means (i) the power, direct or indirect, to cause the
      direction or management of such entity, whether by contract or
      otherwise, or (ii) ownership of fifty percent (50%) or more of the
      outstanding shares, or (iii) beneficial ownership of such entity.
      "You" (or "Your") shall mean an individual or Legal Entity
      exercising permissions granted by this License.
      "Source" form shall mean the preferred form for making modifications,
      including but not limited to software source code, documentation
      source, and configuration files.
      "Object" form shall mean any form resulting from mechanical
      transformation or translation of a Source form, including but
      not limited to compiled object code, generated documentation,
      and conversions to other media types.
      "Work" shall mean the work of authorship, whether in Source or
      Object form, made available under the License, as indicated by a
      copyright notice that is included in or attached to the work
      (an example is provided in the Appendix below).
      "Derivative Works" shall mean any work, whether in Source or Object
      form, that is based on (or derived from) the Work and for which the
      editorial revisions, annotations, elaborations, or other modifications
      represent, as a whole, an original work of authorship. For the purposes
      of this License, Derivative Works shall not include works that remain
      separable from, or merely link (or bind by name) to the interfaces of,
      the Work and Derivative Works thereof.
      "Contribution" shall mean any work of authorship, including
      the original version of the Work and any modifications or additions
      to that Work or Derivative Works thereof, that is intentionally
      submitted to Licensor for inclusion in the Work by the copyright owner
      or by an individual or Legal Entity authorized to submit on behalf of
      the copyright owner. For the purposes of this definition, "submitted"
      means any form of electronic, verbal, or written communication sent
      to the Licensor or its representatives, including but not limited to
      communication on electronic mailing lists, source code control systems,
      and issue tracking systems that are managed by, or on behalf of, the
      Licensor for the purpose of discussing and improving the Work, but
      excluding communication that is conspicuously marked or otherwise
      designated in writing by the copyright owner as "Not a Contribution."
      "Contributor" shall mean Licensor and any individual or Legal Entity
      on behalf of whom a Contribution has been received by Licensor and
      subsequently incorporated within the Work.
   2. Grant of Copyright License. Subject to the terms and conditions of
      this License, each Contributor hereby grants to You a perpetual,
      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      copyright license to reproduce, prepare Derivative Works of,
      publicly display, publicly perform, sublicense, and distribute the
      Work and such Derivative Works in Source or Object form.
   3. Grant of Patent License. Subject to the terms and conditions of
      this License, each Contributor hereby grants to You a perpetual,
      worldwide, non-exclusive, no-charge, royalty-free, irrevocable
      (except as stated in this section) patent license to make, have made,
      use, offer to sell, sell, import, and otherwise transfer the Work,
      where such license applies only to those patent claims licensable
      by such Contributor that are necessarily infringed by their
      Contribution(s) alone or by combination of their Contribution(s)
      with the Work to which such Contribution(s) was submitted. If You
      institute patent litigation against any entity (including a
      cross-claim or counterclaim in a lawsuit) alleging that the Work
      or a Contribution incorporated within the Work constitutes direct
      or contributory patent infringement, then any patent licenses
      granted to You under this License for that Work shall terminate
      as of the date such litigation is filed.
   4. Redistribution. You may reproduce and distribute copies of the
      Work or Derivative Works thereof in any medium, with or without
      modifications, and in Source or Object form, provided that You
      meet the following conditions:
      (a) You must give any other recipients of the Work or
          Derivative Works a copy of this License; and
      (b) You must cause any modified files to carry prominent notices
          stating that You changed the files; and
      (c) You must retain, in the Source form of any Derivative Works
          that You distribute, all copyright, patent, trademark, and
          attribution notices from the Source form of the Work,
          excluding those notices that do not pertain to any part of
          the Derivative Works; and
      (d) If the Work includes a "NOTICE" text file as part of its
          distribution, then any Derivative Works that You distribute must
          include a readable copy of the attribution notices contained
          within such NOTICE file, excluding those notices that do not
          pertain to any part of the Derivative Works, in at least one
          of the following places: within a NOTICE text file distributed
          as part of the Derivative Works; within the Source form or
          documentation, if provided along with the Derivative Works; or,
          within a display generated by the Derivative Works, if and
          wherever such third-party notices normally appear. The contents
          of the NOTICE file are for informational purposes only and
          do not modify the License. You may add Your own attribution
          notices within Derivative Works that You distribute, alongside
          or as an addendum to the NOTICE text from the Work, provided
          that such additional attribution notices cannot be construed
          as modifying the License.
      You may add Your own copyright statement to Your modifications and
      may provide additional or different license terms and conditions
      for use, reproduction, or distribution of Your modifications, or
      for any such Derivative Works as a whole, provided Your use,
      reproduction, and distribution of the Work otherwise complies with
      the conditions stated in this License.
   5. Submission of Contributions. Unless You explicitly state otherwise,
      any Contribution intentionally submitted for inclusion in the Work
      by You to the Licensor shall be under the terms and conditions of
      this License, without any additional terms or conditions.
      Notwithstanding the above, nothing herein shall supersede or modify
      the terms of any separate license agreement you may have executed
      with Licensor regarding such Contributions.
   6. Trademarks. This License does not grant permission to use the trade
      names, trademarks, service marks, or product names of the Licensor,
      except as required for reasonable and customary use in describing the
      origin of the Work and reproducing the content of the NOTICE file.
   7. Disclaimer of Warranty. Unless required by applicable law or
      agreed to in writing, Licensor provides the Work (and each
      Contributor provides its Contributions) on an "AS IS" BASIS,
      WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or
      implied, including, without limitation, any warranties or conditions
      of TITLE, NON-INFRINGEMENT, MERCHANTABILITY, or FITNESS FOR A
      PARTICULAR PURPOSE. You are solely responsible for determining the
      appropriateness of using or redistributing the Work and assume any
      risks associated with Your exercise of permissions under this License.
   8. Limitation of Liability. In no event and under no legal theory,
      whether in tort (including negligence), contract, or otherwise,
      unless required by applicable law (such as deliberate and grossly
      negligent acts) or agreed to in writing, shall any Contributor be
      liable to You for damages, including any direct, indirect, special,
      incidental, or consequential damages of any character arising as a
      result of this License or out of the use or inability to use the
      Work (including but not limited to damages for loss of goodwill,
      work stoppage, computer failure or malfunction, or any and all
      other commercial damages or losses), even if such Contributor
      has been advised of the possibility of such damages.
   9. Accepting Warranty or Additional Liability. While redistributing
      the Work or Derivative Works thereof, You may choose to offer,
      and charge a fee for, acceptance of support, warranty, indemnity,
      or other liability obligations and/or rights consistent with this
      License. However, in accepting such obligations, You may act only
      on Your own behalf and on Your sole responsibility, not on behalf
      of any other Contributor, and only if You agree to indemnify,
      defend, and hold each Contributor harmless for any liability
      incurred by, or claims asserted against, such Contributor by reason
      of your accepting any such warranty or additional liability.
   END OF TERMS AND CONDITIONS
   APPENDIX: How to apply the Apache License to your work.
      To apply the Apache License to your work, attach the following
      boilerplate notice, with the fields enclosed by brackets "[]"
      replaced with your own identifying information. (Don't include
      the brackets!)  The text should be enclosed in the appropriate
      comment syntax for the file format. We also recommend that a
      file or class name and description of purpose be included on the
      same "printed page" as the copyright notice for easier
      identification within third-party archives.
   Copyright [yyyy] [name of copyright owner]
   Licensed under the Apache License, Version 2.0 (the "License");
   you may not use this file except in compliance with the License.
   You may obtain a copy of the License at
       http://www.apache.org/licenses/LICENSE-2.0
   Unless required by applicable law or agreed to in writing, software
   distributed under the License is distributed on an "AS IS" BASIS,
   WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
   See the License for the specific language governing permissions and
   limitations under the License.
@@ -0,0 +1,7 @@
 # alexlebens.net
 GitOps definied infrastrucutre for the alexlebens.net domain.
 ## License
 This project is licensed under the terms of the Apache 2.0 License license.
@@ -0,0 +1,6 @@
 dependencies:
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
  version: 4.5.0
 digest: sha256:926b8da839684072fd79954aff0c9852c2ff3b618b0fa35177bdec8e2dff4986
 generated: "2025-12-05T17:02:01.15162583Z"
@@ -0,0 +1,21 @@
 apiVersion: v2
 name: actual
 version: 1.0.0
 description: Actual
 keywords:
  - actual
  - budget
 home: https://wiki.alexlebens.dev/s/86192f45-94b7-45de-872c-6ef3fec7df5e
 sources:
  - https://github.com/actualbudget/actual
  - https://github.com/actualbudget/actual/pkgs/container/actual
  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
 maintainers:
  - name: alexlebens
 dependencies:
  - name: app-template
    alias: actual
    repository: https://bjw-s-labs.github.io/helm-charts/
    version: 4.5.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/actual-budget.png
 appVersion: 25.12.0
@@ -0,0 +1,55 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: actual-data-backup-secret
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: actual-data-backup-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  target:
    template:
      mergePolicy: Merge
      engineVersion: v2
      data:
        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/actual/actual-data"
  data:
    - secretKey: BUCKET_ENDPOINT
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/volsync/restic/config
        metadataPolicy: None
        property: S3_BUCKET_ENDPOINT
    - secretKey: RESTIC_PASSWORD
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/volsync/restic/config
        metadataPolicy: None
        property: RESTIC_PASSWORD
    - secretKey: AWS_DEFAULT_REGION
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/volsync/restic/config
        metadataPolicy: None
        property: AWS_DEFAULT_REGION
    - secretKey: AWS_ACCESS_KEY_ID
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: access_key
    - secretKey: AWS_SECRET_ACCESS_KEY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: secret_key
@@ -0,0 +1,28 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: http-route-actual
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: http-route-actual
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: traefik-gateway
      namespace: traefik
  hostnames:
    - actual.alexlebens.net
  rules:
    - matches:
      - path:
          type: PathPrefix
          value: /
      backendRefs:
        - group: ''
          kind: Service
          name: actual
          port: 80
          weight: 100
@@ -0,0 +1,25 @@
 apiVersion: volsync.backube/v1alpha1
 kind: ReplicationSource
 metadata:
  name: actual-data-backup-source
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: actual-data-backup-source
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  sourcePVC: actual-data
  trigger:
    schedule: 0 4 * * *
  restic:
    pruneIntervalDays: 7
    repository: actual-data-backup-secret
    retain:
      hourly: 1
      daily: 3
      weekly: 2
      monthly: 2
      yearly: 4
    copyMethod: Snapshot
    storageClassName: ceph-block
    volumeSnapshotClassName: ceph-blockpool-snapshot
@@ -0,0 +1,56 @@
 actual:
  controllers:
    main:
      type: deployment
      replicas: 1
      strategy: Recreate
      revisionHistoryLimit: 3
      containers:
        main:
          image:
            repository: ghcr.io/actualbudget/actual
            tag: 25.12.0
            pullPolicy: IfNotPresent
          env:
            - name: TZ
              value: US/Central
          resources:
            requests:
              cpu: 10m
              memory: 128Mi
          probes:
            liveness:
              enabled: true
              custom: true
              spec:
                exec:
                  command:
                  - /usr/bin/env
                  - bash
                  - -c
                  - node src/scripts/health-check.js
                failureThreshold: 5
                initialDelaySeconds: 60
                periodSeconds: 10
                successThreshold: 1
                timeoutSeconds: 10
  service:
    main:
      controller: main
      ports:
        http:
          port: 80
          targetPort: 5006
          protocol: HTTP
  persistence:
    data:
      forceRename: actual-data
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 2Gi
      retain: true
      advancedMounts:
        main:
          main:
            - path: /data
              readOnly: false
@@ -0,0 +1,12 @@
 dependencies:
 - name: argo-workflows
  repository: https://argoproj.github.io/argo-helm
  version: 0.46.2
 - name: argo-events
  repository: https://argoproj.github.io/argo-helm
  version: 2.4.19
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 6.16.1
 digest: sha256:40a93dfcabbc5746682bac631e9a620588cf0cb6fdf79a42446a823e93a531c8
 generated: "2025-12-11T15:49:57.970719-06:00"
@@ -0,0 +1,31 @@
 apiVersion: v2
 name: argo-workflows
 version: 1.0.0
 description: Argo Workflows
 keywords:
  - argo-workflows
  - argo-events
  - workflows
  - events
 home: https://wiki.alexlebens.dev/s/a268508f-d81d-4b4b-8bd5-9058edaea635
 sources:
  - https://github.com/argoproj/argo-workflows
  - https://github.com/argoproj/argo-events
  - https://github.com/cloudnative-pg/cloudnative-pg
  - https://github.com/argoproj/argo-helm/tree/main/charts
  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
 maintainers:
  - name: alexlebens
 dependencies:
  - name: argo-workflows
    version: 0.46.2
    repository: https://argoproj.github.io/argo-helm
  - name: argo-events
    version: 2.4.19
    repository: https://argoproj.github.io/argo-helm
  - name: postgres-cluster
    alias: postgres-18-cluster
    version: 6.16.1
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
 appVersion: v3.7.6
@@ -0,0 +1,95 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: argo-workflows-oidc-secret
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: argo-workflows-oidc-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: secret
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /authentik/oidc/argo-workflows
        metadataPolicy: None
        property: secret
    - secretKey: client
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /authentik/oidc/argo-workflows
        metadataPolicy: None
        property: client
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: argo-workflows-postgresql-18-cluster-backup-secret
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: argo-workflows-postgresql-18-cluster-backup-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: ACCESS_KEY_ID
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/postgres-backups
        metadataPolicy: None
        property: access
    - secretKey: ACCESS_SECRET_KEY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/postgres-backups
        metadataPolicy: None
        property: secret
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: argo-workflows-postgresql-18-cluster-backup-secret-garage
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: argo-workflows-postgresql-18-cluster-backup-secret-garage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: ACCESS_KEY_ID
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/postgres-backups
        metadataPolicy: None
        property: ACCESS_KEY_ID
    - secretKey: ACCESS_SECRET_KEY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/postgres-backups
        metadataPolicy: None
        property: ACCESS_SECRET_KEY
    - secretKey: ACCESS_REGION
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/postgres-backups
        metadataPolicy: None
        property: ACCESS_REGION
@@ -0,0 +1,28 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: http-route-argo-workflows
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: http-route-argo-workflows
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: traefik-gateway
      namespace: traefik
  hostnames:
    - argo-workflows.alexlebens.net
  rules:
    - matches:
      - path:
          type: PathPrefix
          value: /
      backendRefs:
        - group: ''
          kind: Service
          name: argo-workflows-server
          port: 2746
          weight: 100
@@ -0,0 +1,14 @@
 apiVersion: v1
 kind: Service
 metadata:
  name: garage-ps10rp
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: garage-ps10rp
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
  annotations:
    tailscale.com/tailnet-fqdn: garage-ps10rp.boreal-beaufort.ts.net
 spec:
  externalName: placeholder
  type: ExternalName
@@ -0,0 +1,138 @@
 argo-workflows:
  controller:
    metricsConfig:
      enabled: true
    persistence:
      connectionPool:
        maxIdleConns: 100
        maxOpenConns: 0
      nodeStatusOffLoad: true
      archive: true
      postgresql:
        host: argo-workflows-postgresql-18-cluster-rw
        port: 5432
        database: app
        tableName: app
        userNameSecret:
          name: argo-workflows-postgresql-18-cluster-app
          key: username
        passwordSecret:
          name: argo-workflows-postgresql-18-cluster-app
          key: password
        ssl: false
        sslMode: disable
    workflowWorkers: 2
    workflowTTLWorkers: 1
    podCleanupWorkers: 1
    cronWorkflowWorkers: 1
    resources:
      requests:
        cpu: 10m
        memory: 128Mi
    serviceMonitor:
      enabled: true
    name: workflow-controller
    workflowNamespaces:
      - argocd
      - argo-workflows
  server:
    authModes:
      - sso
    ingress:
      enabled: false
    sso:
      enabled: true
      issuer: https://authentik.alexlebens.net/application/o/argo-workflows/
      clientId:
        name: argo-workflows-oidc-secret
        key: client
      clientSecret:
        name: argo-workflows-oidc-secret
        key: secret
      redirectUrl: https://argo-workflows.alexlebens.net/oauth2/callback
      rbac:
        enabled: false
      scopes:
        - openid
        - email
        - profile
  useStaticCredentials: true
  artifactRepository:
    archiveLogs: false
 argo-events:
  controller:
    resources:
      requests:
        cpu: 10m
        memory: 128Mi
    metrics:
      enabled: true
      serviceMonitor:
        enabled: true
  webhook:
    enabled: true
    resources:
      requests:
        cpu: 10m
        memory: 128Mi
 postgres-18-cluster:
  mode: recovery
  cluster:
    image:
      repository: ghcr.io/cloudnative-pg/postgresql
      tag: 18.1-standard-trixie
    storage:
      storageClass: local-path
    walStorage:
      storageClass: local-path
    monitoring:
      enabled: true
      prometheusRule:
        enabled: true
  recovery:
    method: objectStore
    objectStore:
      destinationPath: s3://postgres-backups/cl01tl/argo-workflows/argo-workflows-postgresql-18-cluster
      endpointURL: http://garage-main.garage:3900
      index: 1
      endpointCredentials: argo-workflows-postgresql-18-cluster-backup-secret-garage
  backup:
    objectStore:
      - name: external
        destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/argo-workflows/argo-workflows-postgresql-18-cluster
        index: 1
        retentionPolicy: "30d"
        isWALArchiver: false
      - name: garage-local
        destinationPath: s3://postgres-backups/cl01tl/argo-workflows/argo-workflows-postgresql-18-cluster
        index: 1
        endpointURL: http://garage-main.garage:3900
        endpointCredentials: argo-workflows-postgresql-18-cluster-backup-secret-garage
        endpointCredentialsIncludeRegion: true
        retentionPolicy: "3d"
        isWALArchiver: true
      # - name: garage-remote
      #   destinationPath: s3://postgres-backups/cl01tl/argo-workflows/argo-workflows-postgresql-18-cluster
      #   index: 1
      #   endpointURL: https://garage-ps10rp.boreal-beaufort.ts.net:3900
      #   endpointCredentials: argo-workflows-postgresql-18-cluster-backup-secret-garage
      #   endpointCredentialsIncludeRegion: true
      #   retentionPolicy: "30d"
      #   data:
      #     compression: bzip2
    scheduledBackups:
      - name: daily-backup
        suspend: false
        immediate: true
        schedule: "0 0 0 * * *"
        backupName: external
      - name: live-backup
        suspend: false
        immediate: true
        schedule: "0 0 0 * * *"
        backupName: garage-local
      # - name: weekly-backup
      #   suspend: true
      #   immediate: true
      #   schedule: "0 0 4 * * SAT"
      #   backupName: garage-remote
@@ -0,0 +1,6 @@
 dependencies:
 - name: argo-cd
  repository: https://argoproj.github.io/argo-helm
  version: 9.1.7
 digest: sha256:ed1ae26f3e642750f6dd970c1adc4fa14a627fad13daf74169213199f74425b3
 generated: "2025-12-09T23:01:55.027301875Z"
@@ -0,0 +1,21 @@
 apiVersion: v2
 name: argocd
 version: 1.0.0
 description: Argo CD
 keywords:
  - argo-cd
  - delivery
  - deployment
  - gitops
 home: https://wiki.alexlebens.dev/s/8a75cf26-b9df-437e-9cc5-2ef47e871a5f
 sources:
  - https://github.com/argoproj/argo-cd
  - https://github.com/argoproj/argo-helm/tree/main/charts/argo-cd
 maintainers:
  - name: alexlebens
 dependencies:
  - name: argo-cd
    version: 9.1.7
    repository: https://argoproj.github.io/argo-helm
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/argo-cd.png
 appVersion: v3.2.1
@@ -0,0 +1,88 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: argocd-oidc-secret
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: argocd-oidc-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: secret
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /authentik/oidc/argocd
        metadataPolicy: None
        property: secret
    - secretKey: client
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /authentik/oidc/argocd
        metadataPolicy: None
        property: client
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: argocd-notifications-secret
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: argocd-notifications-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: ntfy-token
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /ntfy/user/cl01tl
        metadataPolicy: None
        property: token
 # ---
 # apiVersion: external-secrets.io/v1
 # kind: ExternalSecret
 # metadata:
 #   name: argocd-gitea-repo-infrastructure-secret
 #   namespace: {{ .Release.Namespace }}
 #   labels:
 #     app.kubernetes.io/name: argocd-gitea-repo-infrastructure-secret
 #     app.kubernetes.io/instance: {{ .Release.Name }}
 #     app.kubernetes.io/part-of: {{ .Release.Name }}
 # spec:
 #   secretStoreRef:
 #     kind: ClusterSecretStore
 #     name: vault
 #   data:
 #     - secretKey: type
 #       remoteRef:
 #         conversionStrategy: Default
 #         decodingStrategy: None
 #         key: /cl01tl/argocd/credentials/repo/infrastructure
 #         metadataPolicy: None
 #         property: type
 #     - secretKey: url
 #       remoteRef:
 #         conversionStrategy: Default
 #         decodingStrategy: None
 #         key: /cl01tl/argocd/credentials/repo/infrastructure
 #         metadataPolicy: None
 #         property: url
 #     - secretKey: sshPrivateKey
 #       remoteRef:
 #         conversionStrategy: Default
 #         decodingStrategy: None
 #         key: /cl01tl/argocd/credentials/repo/infrastructure
 #         metadataPolicy: None
 #         property: sshPrivateKey
@@ -0,0 +1,28 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: http-route-argocd
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: http-route-argocd
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: traefik-gateway
      namespace: traefik
  hostnames:
    - argocd.alexlebens.net
  rules:
    - matches:
      - path:
          type: PathPrefix
          value: /
      backendRefs:
        - group: ''
          kind: Service
          name: argocd-server
          port: 80
          weight: 100
@@ -0,0 +1,303 @@
 argo-cd:
  crds:
    install: true
  configs:
    cm:
      admin.enabled: true
      timeout.reconciliation: 100s
      timeout.reconciliation.jitter: 60s
      url: https://argocd.alexlebens.net
      statusbadge.url: https://argocd.alexlebens.net/
      statusbadge.enabled: true
      dex.config: |
        connectors:
        - config:
            issuer: https://authentik.alexlebens.net/application/o/argocd/
            clientID: $argocd-oidc-secret:client
            clientSecret: $argocd-oidc-secret:secret
            insecureEnableGroups: true
            scopes:
              - openid
              - profile
              - email
          name: authentik
          type: oidc
          id: authentik
    params:
      server.insecure: true
      controller.diff.server.side: true
    rbac:
      policy.csv: |
        g, ArgoCD Admins, role:admin
    cmp:
      create: true
      plugins:
        cdk8s:
          init:
            command: [cdk8s]
            args: [import]
          generate:
            command: [cdk8s, synth]
            args: [--stdout]
          discover:
            fileName: "*.go"
  controller:
    replicas: 1
    metrics:
      enabled: true
      serviceMonitor:
        enabled: true
  dex:
    enabled: true
    metrics:
      enabled: true
      serviceMonitor:
        enabled: true
    livenessProbe:
      enabled: true
    readinessProbe:
      enabled: true
  redis-ha:
    enabled: true
    auth: false
  redisSecretInit:
    enabled: false
  server:
    replicas: 2
    extensions:
      enabled: true
      extensionList:
        - name: extension-trivy
          env:
            - name: EXTENSION_URL
              value: https://github.com/mziyabo/argocd-trivy-extension/releases/download/v0.2.0/extension-trivy.tar
            - name: EXTENSION_CHECKSUM_URL
              value: https://github.com/mziyabo/argocd-trivy-extension/releases/download/v0.2.0/extension-trivy_checksums.txt
    metrics:
      enabled: true
      serviceMonitor:
        enabled: true
    ingress:
      enabled: false
  repoServer:
    replicas: 2
    extraContainers:
      - name: cmp-cdk8s
        command:
          - /var/run/argocd/argocd-cmp-server
        image: ghcr.io/akuity/cdk8s-cmp-typescript:1.0
        securityContext:
          runAsNonRoot: true
          runAsUser: 999
        volumeMounts:
          - mountPath: /var/run/argocd
            name: var-files
          - mountPath: /home/argocd/cmp-server/plugins
            name: plugins
          - mountPath: /home/argocd/cmp-server/config/plugin.yaml
            subPath: cdk8s.yaml
            name: argocd-cmp-cm
          - mountPath: /tmp
            name: cmp-tmp
    volumes:
      - name: argocd-cmp-cm
        configMap:
          name: argocd-cmp-cm
      - name: cmp-tmp
        emptyDir: {}
    metrics:
      enabled: true
      serviceMonitor:
        enabled: true
  applicationSet:
    replicas: 2
    metrics:
      enabled: true
      serviceMonitor:
        enabled: true
    livenessProbe:
      enabled: true
    readinessProbe:
      enabled: true
  notifications:
    enabled: true
    context:
      argocdUrl: https://argocd.alexlebens.net
    secret:
      create: false
      name: argocd-notifications-secret
    metrics:
      enabled: true
      serviceMonitor:
        enabled: true
    notifiers:
      service.webhook.ntfy: |
        url: http://ntfy.ntfy/
        headers:
          - name: Authorization
            value: Bearer $ntfy-token
    livenessProbe:
      enabled: true
    readinessProbe:
      enabled: true
    subscriptions:
      - recipients:
          - ntfy
        triggers:
          - on-created
          - on-deleted
          - on-deployed
          - on-health-degraded
          - on-sync-failed
          - on-sync-running
          - on-sync-status-unknown
          - on-sync-succeeded
    templates:
      template.app-created: |
        webhook:
          ntfy:
            method: POST
            body: |
              {
                "topic": "argocd",
                "message": "{{.app.metadata.name}} has been created.",
                "title": "Created: {{.app.metadata.name}}",
                "tags": ["building_construction"],
                "priority": 4,
                "click": "{{.context.argocdUrl}}/applications/argocd/{{.app.metadata.name}}"
              }
      template.app-deleted: |
        webhook:
          ntfy:
            method: POST
            body: |
              {
                "topic": "argocd",
                "message": "{{.app.metadata.name}} has been deleted",
                "title": "Deleted: {{.app.metadata.name}}",
                "tags": ["warning"],
                "priority": 4,
                "click": "{{.context.argocdUrl}}"
              }
      template.app-deployed: |
        webhook:
          ntfy:
            method: POST
            body: |
              {
                "topic": "argocd",
                "message": "{{.app.metadata.name}} is now running new version of deployments manifests",
                "title": "Deployed: {{.app.metadata.name}}",
                "tags": ["+1"],
                "priority": 3,
                "click": "{{.context.argocdUrl}}/applications/argocd/{{.app.metadata.name}}"
              }
      template.app-health-degraded: |
        webhook:
          ntfy:
            method: POST
            body: |
              {
                "topic": "argocd",
                "message": "{{.app.metadata.name}} health has degraded",
                "title": "Degraded: {{.app.metadata.name}}",
                "tags": ["rotating_light"],
                "priority": 4,
                "click": "{{.context.argocdUrl}}/applications/argocd/{{.app.metadata.name}}"
              }
      template.app-sync-failed: |
        webhook:
          ntfy:
            method: POST
            body: |
              {
                "topic": "argocd",
                "message": "{{.app.metadata.name}} sync has failed at {{.app.status.operationState.finishedAt}} with the following error: {{.app.status.operationState.message}}",
                "title": "Sync Failed: {{.app.metadata.name}}",
                "tags": ["rotating_light"],
                "priority": 4,
                "click": "{{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true"
              }
      template.app-sync-running: |
        webhook:
          ntfy:
            method: POST
            body: |
              {
                "topic": "argocd",
                "message": "{{.app.metadata.name}} sync has started at {{.app.status.operationState.startedAt}}",
                "title": "Sync Running: {{.app.metadata.name}}",
                "tags": ["runner"],
                "priority": 3,
                "click": "{{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true"
              }
      template.app-sync-status-unknown: |
        webhook:
          ntfy:
            method: POST
            body: |
              {
                "topic": "argocd",
                "message": "{{.app.metadata.name}} sync status is unknown",
                "title": "Sync Unknown: {{.app.metadata.name}}",
                "tags": ["question"],
                "priority": 3,
                "click": "{{.context.argocdUrl}}/applications/{{.app.metadata.name}}"
              }
      template.app-sync-succeeded: |
        webhook:
          ntfy:
            method: POST
            body: |
              {
                "topic": "argocd",
                "message": "{{.app.metadata.name}} has been successfully synced at {{.app.status.operationState.finishedAt}}",
                "title": "Sync Succeeded: {{.app.metadata.name}}",
                "tags": ["+1"],
                "priority": 3,
                "click": "{{.context.argocdUrl}}/applications/{{.app.metadata.name}}?operation=true"
              }
    triggers:
      trigger.on-created: |
        - description: Application {{.app.metadata.name}} has been created.
          oncePer: app.metadata.name
          send:
            - app-created
          when: "true"
      trigger.on-deleted: |
        - description: Application {{.app.metadata.name}} has been deleted.
          oncePer: app.metadata.name
          send:
            - app-deleted
          when: app.metadata.deletionTimestamp != nil
      trigger.on-deployed: |
        - description: Application is synced and healthy. Triggered once per commit.
          oncePer: app.status.operationState.syncResult.revision
          send:
            - app-deployed
          when: app.status.operationState.phase in ['Succeeded'] and app.status.health.status == 'Healthy'
      trigger.on-health-degraded: |
        - description: Application has degraded
          send:
            - app-health-degraded
          when: app.status.health.status == 'Degraded'
      trigger.on-sync-failed: |
        - description: Application syncing has failed
          send:
            - app-sync-failed
          when: app.status.operationState.phase in ['Error', 'Failed']
      trigger.on-sync-running: |
        - description: Application is being synced
          send:
           - app-sync-running
          when: app.status.operationState.phase in ['Running']
      trigger.on-sync-status-unknown: |
        - description: Application status is 'Unknown'
          send:
            - app-sync-status-unknown
          when: app.status.sync.status == 'Unknown'
      trigger.on-sync-succeeded: |
        - description: Application syncing has succeeded
          send:
            - app-sync-succeeded
          when: app.status.operationState.phase in ['Succeeded']
@@ -0,0 +1,6 @@
 dependencies:
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
  version: 4.5.0
 digest: sha256:977ed15091e9ed30d647a626214701d22f3a8a5232a900e33f753cc7e090042f
 generated: "2025-12-05T17:02:13.674405673Z"
@@ -0,0 +1,23 @@
 apiVersion: v2
 name: audiobookshelf
 version: 1.0.0
 description: Audiobookshelf
 keywords:
  - audiobookshelf
  - books
  - podcasts
  - audiobooks
 home: https://wiki.alexlebens.dev/s/d4d6719f-cd1c-4b6e-b78e-2d2d7a5097d7
 sources:
  - https://github.com/advplyr/audiobookshelf
  - https://github.com/advplyr/audiobookshelf/pkgs/container/audiobookshelf
  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
 maintainers:
  - name: alexlebens
 dependencies:
  - name: app-template
    alias: audiobookshelf
    repository: https://bjw-s-labs.github.io/helm-charts/
    version: 4.5.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/audiobookshelf.png
 appVersion: 2.31.0
@@ -0,0 +1,135 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: audiobookshelf-apprise-config
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: audiobookshelf-apprise-config
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: ntfy-url
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/audiobookshelf/apprise
        metadataPolicy: None
        property: ntfy-url
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: audiobookshelf-config-backup-secret
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: audiobookshelf-config-backup-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  target:
    template:
      mergePolicy: Merge
      engineVersion: v2
      data:
        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/audiobookshelf/audiobookshelf-config"
  data:
    - secretKey: BUCKET_ENDPOINT
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/volsync/restic/config
        metadataPolicy: None
        property: S3_BUCKET_ENDPOINT
    - secretKey: RESTIC_PASSWORD
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/volsync/restic/config
        metadataPolicy: None
        property: RESTIC_PASSWORD
    - secretKey: AWS_DEFAULT_REGION
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/volsync/restic/config
        metadataPolicy: None
        property: AWS_DEFAULT_REGION
    - secretKey: AWS_ACCESS_KEY_ID
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: access_key
    - secretKey: AWS_SECRET_ACCESS_KEY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: secret_key
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: audiobookshelf-metadata-backup-secret
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: audiobookshelf-metadata-backup-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  target:
    template:
      mergePolicy: Merge
      engineVersion: v2
      data:
        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/audiobookshelf/audiobookshelf-metadata"
  data:
    - secretKey: BUCKET_ENDPOINT
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/volsync/restic/config
        metadataPolicy: None
        property: S3_BUCKET_ENDPOINT
    - secretKey: RESTIC_PASSWORD
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/volsync/restic/config
        metadataPolicy: None
        property: RESTIC_PASSWORD
    - secretKey: AWS_DEFAULT_REGION
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/volsync/restic/config
        metadataPolicy: None
        property: AWS_DEFAULT_REGION
    - secretKey: AWS_ACCESS_KEY_ID
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: access_key
    - secretKey: AWS_SECRET_ACCESS_KEY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: secret_key
@@ -0,0 +1,28 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: http-route-audiobookshelf
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: http-route-audiobookshelf
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: traefik-gateway
      namespace: traefik
  hostnames:
    - audiobookshelf.alexlebens.net
  rules:
    - matches:
      - path:
          type: PathPrefix
          value: /
      backendRefs:
        - group: ''
          kind: Service
          name: audiobookshelf
          port: 80
          weight: 100
@@ -0,0 +1,36 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
  name: audiobookshelf-nfs-storage-backup
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: audiobookshelf-nfs-storage-backup
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  volumeMode: Filesystem
  storageClassName: nfs-client
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
  name: audiobookshelf-nfs-storage
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: audiobookshelf-nfs-storage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  volumeName: audiobookshelf-nfs-storage
  storageClassName: nfs-client
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 1Gi
@@ -0,0 +1,23 @@
 apiVersion: v1
 kind: PersistentVolume
 metadata:
  name: audiobookshelf-nfs-storage
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: audiobookshelf-nfs-storage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  persistentVolumeReclaimPolicy: Retain
  storageClassName: nfs-client
  capacity:
    storage: 1Gi
  accessModes:
    - ReadWriteMany
  nfs:
    path: /volume2/Storage
    server: synologybond.alexlebens.net
  mountOptions:
    - vers=4
    - minorversion=1
    - noac
@@ -0,0 +1,52 @@
 apiVersion: volsync.backube/v1alpha1
 kind: ReplicationSource
 metadata:
  name: audiobookshelf-config-backup-source
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: audiobookshelf-config-backup-source
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  sourcePVC: audiobookshelf-config
  trigger:
    schedule: 0 4 * * *
  restic:
    pruneIntervalDays: 7
    repository: audiobookshelf-config-backup-secret
    retain:
      hourly: 1
      daily: 3
      weekly: 2
      monthly: 2
      yearly: 4
    copyMethod: Snapshot
    storageClassName: ceph-block
    volumeSnapshotClassName: ceph-blockpool-snapshot
 ---
 apiVersion: volsync.backube/v1alpha1
 kind: ReplicationSource
 metadata:
  name: audiobookshelf-metadata-backup-source
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: audiobookshelf-metadata-backup-source
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  sourcePVC: audiobookshelf-metadata
  trigger:
    schedule: 0 4 * * *
  restic:
    pruneIntervalDays: 7
    repository: audiobookshelf-metadata-backup-secret
    retain:
      hourly: 1
      daily: 3
      weekly: 2
      monthly: 2
      yearly: 4
    copyMethod: Snapshot
    storageClassName: ceph-block
    volumeSnapshotClassName: ceph-blockpool-snapshot
@@ -0,0 +1,19 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
  name: audiobookshelf-apprise
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: audiobookshelf-apprise
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  endpoints:
    - port: apprise
      interval: 30s
      scrapeTimeout: 15s
      path: /metrics
  selector:
    matchLabels:
      app.kubernetes.io/name: audiobookshelf
      app.kubernetes.io/instance: {{ .Release.Name }}
@@ -0,0 +1,94 @@
 audiobookshelf:
  controllers:
    main:
      type: deployment
      replicas: 1
      strategy: Recreate
      revisionHistoryLimit: 3
      containers:
        main:
          image:
            repository: ghcr.io/advplyr/audiobookshelf
            tag: 2.31.0
            pullPolicy: IfNotPresent
          env:
            - name: TZ
              value: US/Central
          resources:
            requests:
              cpu: 10m
              memory: 128Mi
        apprise-api:
          image:
            repository: caronc/apprise
            tag: 1.2.6
            pullPolicy: IfNotPresent
          env:
            - name: TZ
              value: US/Central
            - name: PGID
              value: "1000"
            - name: PUID
              value: "1000"
            - name: APPRISE_STORAGE_MODE
              value: memory
            - name: APPRISE_STATEFUL_MODE
              value: disabled
            - name: APPRISE_WORKER_COUNT
              value: 1
            - name: APPRISE_STATELESS_URLS
              valueFrom:
                secretKeyRef:
                  name: audiobookshelf-apprise-config
                  key: ntfy-url
          resources:
            requests:
              cpu: 10m
              memory: 128Mi
  service:
    main:
      controller: main
      ports:
        http:
          port: 80
          targetPort: 80
          protocol: HTTP
        apprise:
          port: 8000
          targetPort: 8000
          protocol: HTTP
  persistence:
    config:
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 2Gi
      retain: true
      advancedMounts:
        main:
          main:
            - path: /config
              readOnly: false
    metadata:
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 10Gi
      retain: true
      advancedMounts:
        main:
          main:
            - path: /metadata
              readOnly: false
    backup:
      existingClaim: audiobookshelf-nfs-storage-backup
      advancedMounts:
        main:
          main:
            - path: /metadata/backups
              readOnly: false
    audiobooks:
      existingClaim: audiobookshelf-nfs-storage
      advancedMounts:
        main:
          main:
            - path: /mnt/store/
              readOnly: false
@@ -0,0 +1,12 @@
 dependencies:
 - name: authentik
  repository: https://charts.goauthentik.io/
  version: 2025.10.2
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 1.23.2
 - name: postgres-cluster
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 6.16.1
 digest: sha256:fdd5cc597cf958ca0f6f43dd403915c89c45718eff80920c2d322264dc8b09e1
 generated: "2025-12-11T16:14:14.729827-06:00"
@@ -0,0 +1,35 @@
 apiVersion: v2
 name: authentik
 version: 1.0.0
 description: Authentik
 keywords:
  - authentik
  - sso
  - oidc
  - ldap
  - idp
  - authentication
 home: https://wiki.alexlebens.dev/s/45ca5171-581f-41d2-b6fb-2b0915029a2d
 sources:
  - https://github.com/goauthentik/authentik
  - https://github.com/cloudflare/cloudflared
  - https://github.com/cloudnative-pg/cloudnative-pg
  - https://github.com/goauthentik/helm
  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/cloudflared
  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/postgres-cluster
 maintainers:
  - name: alexlebens
 dependencies:
  - name: authentik
    version: 2025.10.2
    repository: https://charts.goauthentik.io/
  - name: cloudflared
    alias: cloudflared
    repository: oci://harbor.alexlebens.net/helm-charts
    version: 1.23.2
  - name: postgres-cluster
    alias: postgres-18-cluster
    version: 6.16.1
    repository: oci://harbor.alexlebens.net/helm-charts
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/authentik.png
 appVersion: 2025.10.2
@@ -0,0 +1,111 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: authentik-key-secret
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: authentik-key-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: key
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/authentik/key
        metadataPolicy: None
        property: key
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: authentik-cloudflared-secret
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: authentik-cloudflared-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: cf-tunnel-token
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cloudflare/tunnels/authentik
        metadataPolicy: None
        property: token
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: authentik-postgresql-18-cluster-backup-secret
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: authentik-postgresql-18-cluster-backup-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: ACCESS_KEY_ID
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/postgres-backups
        metadataPolicy: None
        property: access
    - secretKey: ACCESS_SECRET_KEY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/postgres-backups
        metadataPolicy: None
        property: secret
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: authentik-postgresql-18-cluster-backup-secret-garage
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: authentik-postgresql-18-cluster-backup-secret-garage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: ACCESS_KEY_ID
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/postgres-backups
        metadataPolicy: None
        property: ACCESS_KEY_ID
    - secretKey: ACCESS_SECRET_KEY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/postgres-backups
        metadataPolicy: None
        property: ACCESS_SECRET_KEY
    - secretKey: ACCESS_REGION
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/postgres-backups
        metadataPolicy: None
        property: ACCESS_REGION
@@ -0,0 +1,28 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: http-route-authentik
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: http-route-authentik
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: traefik-gateway
      namespace: traefik
  hostnames:
    - authentik.alexlebens.net
  rules:
    - matches:
      - path:
          type: PathPrefix
          value: /
      backendRefs:
        - group: ''
          kind: Service
          name: authentik-server
          port: 80
          weight: 100
@@ -0,0 +1,29 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  name: authentik-tailscale
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: authentik-tailscale
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
    tailscale.com/proxy-class: no-metrics
  annotations:
    tailscale.com/experimental-forward-cluster-traffic-via-ingress: "true"
 spec:
  ingressClassName: tailscale
  tls:
    - hosts:
        - auth-cl01tl
      secretName: auth-cl01tl
  rules:
    - host: auth-cl01tl
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: authentik-server
                port:
                  number: 80
@@ -0,0 +1,32 @@
 apiVersion: redis.redis.opstreelabs.in/v1beta2
 kind: RedisReplication
 metadata:
  name: redis-replication-authentik
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: redis-replication-authentik
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  clusterSize: 3
  podSecurityContext:
    runAsUser: 1000
    fsGroup: 1000
  kubernetesConfig:
    image: quay.io/opstree/redis:v8.4.0
    imagePullPolicy: IfNotPresent
    resources:
      requests:
        cpu: 50m
        memory: 128Mi
  storage:
    volumeClaimTemplate:
      spec:
        storageClassName: ceph-block
        accessModes: ["ReadWriteOnce"]
        resources:
          requests:
            storage: 1Gi
  redisExporter:
    enabled: true
    image: quay.io/opstree/redis-exporter:v1.80.1
@@ -0,0 +1,19 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
  name: redis-replication-authentik
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: redis-replication-authentik
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
    redis-operator: "true"
    env: production
 spec:
  selector:
    matchLabels:
      redis_setup_type: replication
  endpoints:
    - port: redis-exporter
      interval: 30s
      scrapeTimeout: 10s
@@ -0,0 +1,113 @@
 authentik:
  global:
    env:
      - name: AUTHENTIK_SECRET_KEY
        valueFrom:
          secretKeyRef:
            name: authentik-key-secret
            key: key
      - name: AUTHENTIK_POSTGRESQL__HOST
        valueFrom:
          secretKeyRef:
            name: authentik-postgresql-18-cluster-app
            key: host
      - name: AUTHENTIK_POSTGRESQL__NAME
        valueFrom:
          secretKeyRef:
            name: authentik-postgresql-18-cluster-app
            key: dbname
      - name: AUTHENTIK_POSTGRESQL__USER
        valueFrom:
          secretKeyRef:
            name: authentik-postgresql-18-cluster-app
            key: user
      - name: AUTHENTIK_POSTGRESQL__PASSWORD
        valueFrom:
          secretKeyRef:
            name: authentik-postgresql-18-cluster-app
            key: password
  authentik:
    redis:
      host: redis-replication-authentik-master
  server:
    name: server
    replicas: 1
    metrics:
      enabled: true
      serviceMonitor:
        enabled: true
    ingress:
      enabled: false
  worker:
    name: worker
    replicas: 1
  prometheus:
    rules:
      enabled: true
  postgresql:
    enabled: false
  redis:
    enabled: false
 cloudflared:
  existingSecretName: authentik-cloudflared-secret
 postgres-18-cluster:
  mode: recovery
  cluster:
    image:
      repository: ghcr.io/cloudnative-pg/postgresql
      tag: 18.1-standard-trixie
    storage:
      storageClass: local-path
    walStorage:
      storageClass: local-path
    monitoring:
      enabled: true
      prometheusRule:
        enabled: true
  recovery:
    method: objectStore
    objectStore:
      destinationPath: s3://postgres-backups/cl01tl/authentik/authentik-postgresql-18-cluster
      endpointURL: http://garage-main.garage:3900
      index: 1
      endpointCredentials: authentik-postgresql-18-cluster-backup-secret-garage
  backup:
    objectStore:
      - name: external
        destinationPath: s3://postgres-backups-ce540ddf106d186bbddca68a/cl01tl/authentik/authentik-postgresql-18-cluster
        index: 1
        retentionPolicy: "30d"
        isWALArchiver: false
      - name: garage-local
        destinationPath: s3://postgres-backups/cl01tl/authentik/authentik-postgresql-18-cluster
        index: 1
        endpointURL: http://garage-main.garage:3900
        endpointCredentials: authentik-postgresql-18-cluster-backup-secret-garage
        endpointCredentialsIncludeRegion: true
        retentionPolicy: "3d"
        isWALArchiver: true
      # - name: garage-remote
      #   destinationPath: s3://postgres-backups/cl01tl/authentik/authentik-postgresql-18-cluster
      #   index: 1
      #   endpointURL: https://garage-ps10rp.boreal-beaufort.ts.net:3900
      #   endpointCredentials: authentik-postgresql-18-cluster-backup-secret-garage
      #   retentionPolicy: "30d"
      #   data:
      #     compression: bzip2
      #     jobs: 2
    scheduledBackups:
      - name: daily-backup
        suspend: false
        immediate: true
        schedule: "0 0 0 * * *"
        backupName: external
      - name: live-backup
        suspend: false
        immediate: true
        schedule: "0 0 0 * * *"
        backupName: garage-local
      # - name: weekly-backup
      #   suspend: false
      #   immediate: true
      #   schedule: "0 0 4 * * SAT"
      #   backupName: garage-remote
@@ -0,0 +1,6 @@
 dependencies:
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
  version: 4.5.0
 digest: sha256:6e6f20320a485b57288a6febae1b7623076059c370f88b7fbe92460fc4047db3
 generated: "2025-12-05T17:02:26.599646463Z"
@@ -0,0 +1,21 @@
 apiVersion: v2
 name: backrest
 version: 1.0.0
 description: backrest
 keywords:
  - backrest
  - backup
 home: https://wiki.alexlebens.dev/
 sources:
  - https://github.com/garethgeorge/backrest
  - https://hub.docker.com/r/garethgeorge/backrest
  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
 maintainers:
  - name: alexlebens
 dependencies:
  - name: app-template
    alias: backrest
    repository: https://bjw-s-labs.github.io/helm-charts/
    version: 4.5.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/backrest.png
 appVersion: v1.10.1
@@ -0,0 +1,28 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: http-route-backrest
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: http-route-backrest
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: traefik-gateway
      namespace: traefik
  hostnames:
    - backrest.alexlebens.net
  rules:
    - matches:
      - path:
          type: PathPrefix
          value: /
      backendRefs:
        - group: ''
          kind: Service
          name: backrest
          port: 80
          weight: 100
@@ -0,0 +1,36 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
  name: backrest-nfs-storage
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: backrest-nfs-storage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  volumeName: backrest-nfs-storage
  storageClassName: nfs-client
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 1Gi
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
  name: backrest-nfs-share
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: backrest-nfs-share
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  volumeName: backrest-nfs-share
  storageClassName: nfs-client
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 1Gi
@@ -0,0 +1,48 @@
 apiVersion: v1
 kind: PersistentVolume
 metadata:
  name: backrest-nfs-storage
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: backrest-nfs-storage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  persistentVolumeReclaimPolicy: Retain
  storageClassName: nfs-client
  capacity:
    storage: 1Gi
  accessModes:
    - ReadWriteMany
  nfs:
    path: /volume2/Storage
    server: synologybond.alexlebens.net
  mountOptions:
    - vers=4
    - minorversion=1
    - noac
 ---
 apiVersion: v1
 kind: PersistentVolume
 metadata:
  name: backrest-nfs-share
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: backrest-nfs-share
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  persistentVolumeReclaimPolicy: Retain
  storageClassName: nfs-client
  capacity:
    storage: 1Gi
  accessModes:
    - ReadWriteMany
  nfs:
    path: /volume2/Share
    server: synologybond.alexlebens.net
  mountOptions:
    - vers=4
    - minorversion=1
    - noac
@@ -0,0 +1,14 @@
 apiVersion: v1
 kind: Service
 metadata:
  name: garage-ps10rp
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: garage-ps10rp
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
  annotations:
    tailscale.com/tailnet-fqdn: garage-ps10rp.boreal-beaufort.ts.net
 spec:
  externalName: placeholder
  type: ExternalName
@@ -0,0 +1,84 @@
 backrest:
  controllers:
    main:
      type: deployment
      replicas: 1
      strategy: Recreate
      containers:
        main:
          image:
            repository: garethgeorge/backrest
            tag: v1.10.1
            pullPolicy: IfNotPresent
          env:
            - name: TZ
              value: America/Chicago
            - name: BACKREST_DATA
              value: /data
            - name: BACKREST_CONFIG
              value: /config/config.json
            - name: XDG_CACHE_HOME
              value: /cache
            - name: TMPDIR
              value: /tmp
          resources:
            requests:
              cpu: 10m
              memory: 256Mi
  service:
    main:
      controller: main
      ports:
        http:
          port: 80
          targetPort: 9898
          protocol: TCP
  persistence:
    data:
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 10Gi
      retain: true
      advancedMounts:
        main:
          main:
            - path: /data
              readOnly: false
    config:
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 1Gi
      retain: true
      advancedMounts:
        main:
          main:
            - path: /config
              readOnly: false
    cache:
      type: emptyDir
      advancedMounts:
        main:
          main:
            - path: /cache
              readOnly: false
    tmp:
      type: emptyDir
      advancedMounts:
        main:
          main:
            - path: /tmp
              readOnly: false
    storage:
      existingClaim: backrest-nfs-storage
      advancedMounts:
        main:
          main:
            - path: /mnt/storage
              readOnly: true
    share:
      existingClaim: backrest-nfs-share
      advancedMounts:
        main:
          main:
            - path: /mnt/share
              readOnly: true
@@ -0,0 +1,6 @@
 dependencies:
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
  version: 4.5.0
 digest: sha256:54c88d51b4067dec5b22623957970b64092bf3f417fabb58277f6bc3e01eca20
 generated: "2025-12-05T17:02:40.843820962Z"
@@ -0,0 +1,23 @@
 apiVersion: v2
 name: bazarr
 version: 1.0.0
 description: Bazarr
 keywords:
  - bazarr
  - servarr
  - subtitles
 home: https://wiki.alexlebens.dev/s/92784d53-1d43-42fd-b509-f42c73454226
 sources:
  - https://github.com/morpheus65535/bazarr
  - https://github.com/linuxserver/docker-bazarr
  - https://github.com/linuxserver/docker-bazarr/pkgs/container/bazarr
  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
 maintainers:
  - name: alexlebens
 dependencies:
  - name: app-template
    alias: bazarr
    repository: https://bjw-s-labs.github.io/helm-charts/
    version: 4.5.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/bazarr.png
 appVersion: 1.5.3
@@ -0,0 +1,55 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: bazarr-config-backup-secret
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: bazarr-config-backup-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  target:
    template:
      mergePolicy: Merge
      engineVersion: v2
      data:
        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/bazarr/bazarr-config"
  data:
    - secretKey: BUCKET_ENDPOINT
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/volsync/restic/config
        metadataPolicy: None
        property: S3_BUCKET_ENDPOINT
    - secretKey: RESTIC_PASSWORD
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/volsync/restic/config
        metadataPolicy: None
        property: RESTIC_PASSWORD
    - secretKey: AWS_DEFAULT_REGION
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/volsync/restic/config
        metadataPolicy: None
        property: AWS_DEFAULT_REGION
    - secretKey: AWS_ACCESS_KEY_ID
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: access_key
    - secretKey: AWS_SECRET_ACCESS_KEY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: secret_key
@@ -0,0 +1,28 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: http-route-bazarr
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: http-route-bazarr
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: traefik-gateway
      namespace: traefik
  hostnames:
    - bazarr.alexlebens.net
  rules:
    - matches:
      - path:
          type: PathPrefix
          value: /
      backendRefs:
        - group: ''
          kind: Service
          name: bazarr
          port: 80
          weight: 100
@@ -0,0 +1,17 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
  name: bazarr-nfs-storage
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: bazarr-nfs-storage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  volumeName: bazarr-nfs-storage
  storageClassName: nfs-client
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 1Gi
@@ -0,0 +1,23 @@
 apiVersion: v1
 kind: PersistentVolume
 metadata:
  name: bazarr-nfs-storage
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: bazarr-nfs-storage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  persistentVolumeReclaimPolicy: Retain
  storageClassName: nfs-client
  capacity:
    storage: 1Gi
  accessModes:
    - ReadWriteMany
  nfs:
    path: /volume2/Storage
    server: synologybond.alexlebens.net
  mountOptions:
    - vers=4
    - minorversion=1
    - noac
@@ -0,0 +1,30 @@
 apiVersion: volsync.backube/v1alpha1
 kind: ReplicationSource
 metadata:
  name: bazarr-config-backup-source
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: bazarr-config-backup-source
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  sourcePVC: bazarr-config
  trigger:
    schedule: 0 4 * * *
  restic:
    pruneIntervalDays: 7
    repository: bazarr-config-backup-secret
    retain:
      hourly: 1
      daily: 3
      weekly: 2
      monthly: 2
      yearly: 4
    moverSecurityContext:
      runAsUser: 1000
      runAsGroup: 1000
      fsGroup: 1000
      fsGroupChangePolicy: OnRootMismatch
    copyMethod: Snapshot
    storageClassName: ceph-block
    volumeSnapshotClassName: ceph-blockpool-snapshot
@@ -0,0 +1,57 @@
 bazarr:
  controllers:
    main:
      type: deployment
      replicas: 1
      strategy: Recreate
      revisionHistoryLimit: 3
      pod:
        securityContext:
          runAsUser: 1000
          runAsGroup: 1000
          fsGroup: 1000
          fsGroupChangePolicy: OnRootMismatch
      containers:
        main:
          image:
            repository: ghcr.io/linuxserver/bazarr
            tag: 1.5.3@sha256:4aa1e82d1e96ae712095d881b7e3840e6db6ca862c335be5b00001f31156650b
            pullPolicy: IfNotPresent
          env:
            - name: TZ
              value: US/Central
            - name: PUID
              value: 1000
            - name: PGID
              value: 1000
          resources:
            requests:
              cpu: 10m
              memory: 256Mi
  service:
    main:
      controller: main
      ports:
        http:
          port: 80
          targetPort: 6767
          protocol: HTTP
  persistence:
    config:
      forceRename: bazarr-config
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 5Gi
      retain: true
      advancedMounts:
        main:
          main:
            - path: /config
              readOnly: false
    media:
      existingClaim: bazarr-nfs-storage
      advancedMounts:
        main:
          main:
            - path: /mnt/store
              readOnly: false
@@ -0,0 +1,6 @@
 dependencies:
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
  version: 4.5.0
 digest: sha256:b8516161886b87344848ad2b3bdafbd66da61ca8ffc5e9a5ebed462f205c9912
 generated: "2025-12-05T17:02:59.562863413Z"
@@ -0,0 +1,21 @@
 apiVersion: v2
 name: blocky
 version: 1.0.0
 description: Blocky
 keywords:
  - blocky
  - dns
 home: https://wiki.alexlebens.dev/s/cf70113d-20bc-48ad-afb8-1e22ed3fd62a
 sources:
  - https://github.com/0xERR0R/blocky
  - https://hub.docker.com/r/spx01/blocky
  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
 maintainers:
  - name: alexlebens
 dependencies:
  - name: app-template
    alias: blocky
    repository: https://bjw-s-labs.github.io/helm-charts/
    version: 4.5.0
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/blocky.png
 appVersion: v0.28.2
@@ -0,0 +1,32 @@
 apiVersion: redis.redis.opstreelabs.in/v1beta2
 kind: RedisReplication
 metadata:
  name: redis-replication-blocky
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: redis-replication-blocky
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  clusterSize: 3
  podSecurityContext:
    runAsUser: 1000
    fsGroup: 1000
  kubernetesConfig:
    image: quay.io/opstree/redis:v8.4.0
    imagePullPolicy: IfNotPresent
    resources:
      requests:
        cpu: 50m
        memory: 128Mi
  storage:
    volumeClaimTemplate:
      spec:
        storageClassName: ceph-block
        accessModes: ["ReadWriteOnce"]
        resources:
          requests:
            storage: 1Gi
  redisExporter:
    enabled: true
    image: quay.io/opstree/redis-exporter:v1.80.1
@@ -0,0 +1,40 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
  name: blocky
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: blocky
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  selector:
    matchLabels:
      app.kubernetes.io/name: blocky
      app.kubernetes.io/instance: {{ .Release.Name }}
  endpoints:
    - port: metrics
      interval: 30s
      scrapeTimeout: 10s
      path: /metrics
 ---
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
  name: redis-replication-blocky
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: redis-replication-blocky
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
    redis-operator: "true"
    env: production
 spec:
  selector:
    matchLabels:
      redis_setup_type: replication
  endpoints:
    - port: redis-exporter
      interval: 30s
      scrapeTimeout: 10s
@@ -0,0 +1,303 @@
 blocky:
  controllers:
    main:
      type: deployment
      replicas: 3
      strategy: RollingUpdate
      revisionHistoryLimit: 3
      containers:
        main:
          image:
            repository: ghcr.io/0xerr0r/blocky
            tag: v0.28.2@sha256:5f84a54e4ee950c4ab21db905b7497476ece2f4e1a376d23ab8c4855cabddcba
            pullPolicy: IfNotPresent
          env:
            - name: TZ
              value: US/Central
          resources:
            requests:
              cpu: 10m
              memory: 128Mi
  configMaps:
    config:
      enabled: true
      data:
        config.yml: |
          upstreams:
            init:
              strategy: fast
            groups:
              default:
                - tcp-tls:1.1.1.1:853
                - tcp-tls:1.0.0.1:853
            strategy: parallel_best
            timeout: 2s
          connectIPVersion: v4
          customDNS:
            filterUnmappedTypes: false
            zone: |
              $ORIGIN alexlebens.net.
              $TTL 86400
              ;; Name Server
                                              IN      NS      patryk.ns.cloudflare.com.
                                              IN      NS      veda.ns.cloudflare.com.
                                              IN      NS      dns1.
                                              IN      NS      dns2.
                                              IN      NS      dns3.
              dns1                            IN      A       10.232.1.22
              dns2                            IN      A       10.232.1.51
              dns3                            IN      A       10.232.1.52
              ;; Computer Names
              nw01un                          IN      A       192.168.1.1   ; Unifi Gateway
              ps08rp                          IN      A       10.232.1.51   ; DNS
              ps09rp                          IN      A       10.232.1.52   ; DNS
              ps02sn                          IN      A       10.232.1.61   ; Synology Web
              ps02sn-bond                     IN      A       10.232.1.64   ; Synology Bond for Storage
              pd05wd                          IN      A       10.230.0.115  ; Desktop
              pl02mc                          IN      A       10.230.0.105  ; Laptop
              dv01hr                          IN      A       10.232.1.72   ; HD Homerun
              dv02kv                          IN      A       10.232.1.71   ; Pi KVM
              it01ag                          IN      A       10.232.1.83   ; Airgradient
              it02ph                          IN      A       10.232.1.85   ; Phillips Hue
              it03tb                          IN      A       10.232.1.81   ; TubesZB ZigBee
              it04tb                          IN      A       10.232.1.82   ; TubesZB Z-Wave
              it05sp                          IN      A       10.230.0.100  ; Shelly Plug
              ;; Common Names
              synology                        IN      CNAME   ps02sn
              synologybond                    IN      CNAME   ps02sn-bond
              unifi                           IN      CNAME   nw01un
              airgradient                     IN      CNAME   it01ag
              hdhr                            IN      CNAME   dv01hr
              pikvm                           IN      CNAME   dv02kv
              ;; Service Names
              cl01tl                          IN      A       10.232.1.11
              cl01tl                          IN      A       10.232.1.12
              cl01tl                          IN      A       10.232.1.13
              cl01tl-api                      IN      A       10.232.1.11
              cl01tl-api                      IN      A       10.232.1.12
              cl01tl-api                      IN      A       10.232.1.13
              cl01tl-endpoint                 IN      A       10.232.1.21
              cl01tl-endpoint                 IN      A       10.232.1.22
              cl01tl-endpoint                 IN      A       10.232.1.23
              cl01tl-gateway                  IN      A       10.232.1.200
              traefik-cl01tl                  IN      A       10.232.1.21
              blocky                          IN      A       10.232.1.22
              plex-lb                         IN      A       10.232.1.23
              ;; Application Names
              actual                          IN      CNAME   traefik-cl01tl
              alertmanager                    IN      CNAME   traefik-cl01tl
              argo-workflows                  IN      CNAME   traefik-cl01tl
              argocd                          IN      CNAME   traefik-cl01tl
              audiobookshelf                  IN      CNAME   traefik-cl01tl
              authentik                       IN      CNAME   traefik-cl01tl
              backrest                        IN      CNAME   traefik-cl01tl
              bazarr                          IN      CNAME   traefik-cl01tl
              booklore                        IN      CNAME   traefik-cl01tl
              ceph                            IN      CNAME   traefik-cl01tl
              code-server                     IN      CNAME   traefik-cl01tl
              ephemera                        IN      CNAME   traefik-cl01tl
              garage-s3                       IN      CNAME   traefik-cl01tl
              garage-webui                    IN      CNAME   traefik-cl01tl
              gatus                           IN      CNAME   traefik-cl01tl
              gitea                           IN      CNAME   traefik-cl01tl
              grafana                         IN      CNAME   traefik-cl01tl
              harbor                          IN      CNAME   traefik-cl01tl
              headlamp                        IN      CNAME   traefik-cl01tl
              home                            IN      CNAME   traefik-cl01tl
              home-assistant                  IN      CNAME   traefik-cl01tl
              home-assistant-code-server      IN      CNAME   traefik-cl01tl
              hubble                          IN      CNAME   cl01tl-gateway
              huntarr                         IN      CNAME   traefik-cl01tl
              immich                          IN      CNAME   traefik-cl01tl
              jellyfin                        IN      CNAME   traefik-cl01tl
              jellystat                       IN      CNAME   traefik-cl01tl
              kiwix                           IN      CNAME   traefik-cl01tl
              komodo                          IN      CNAME   traefik-cl01tl
              lidarr                          IN      CNAME   traefik-cl01tl
              lidatube                        IN      CNAME   traefik-cl01tl
              listenarr                       IN      CNAME   traefik-cl01tl
              mail                            IN      CNAME   traefik-cl01tl
              n8n                             IN      CNAME   traefik-cl01tl
              ntfy                            IN      CNAME   traefik-cl01tl
              objects                         IN      CNAME   traefik-cl01tl
              ollama                          IN      CNAME   traefik-cl01tl
              omni-tools                      IN      CNAME   traefik-cl01tl
              overseerr                       IN      CNAME   traefik-cl01tl
              pgadmin                         IN      CNAME   traefik-cl01tl
              photoview                       IN      CNAME   traefik-cl01tl
              plex                            IN      CNAME   traefik-cl01tl
              postiz                          IN      CNAME   traefik-cl01tl
              prometheus                      IN      CNAME   traefik-cl01tl
              prowlarr                        IN      CNAME   traefik-cl01tl
              qbittorrent                     IN      CNAME   traefik-cl01tl
              qui                             IN      CNAME   traefik-cl01tl
              radarr                          IN      CNAME   traefik-cl01tl
              radarr-4k                       IN      CNAME   traefik-cl01tl
              radarr-anime                    IN      CNAME   traefik-cl01tl
              radarr-standup                  IN      CNAME   traefik-cl01tl
              searxng                         IN      CNAME   traefik-cl01tl
              seerr                           IN      CNAME   traefik-cl01tl
              slskd                           IN      CNAME   traefik-cl01tl
              sonarr                          IN      CNAME   traefik-cl01tl
              sonarr-4k                       IN      CNAME   traefik-cl01tl
              sonarr-anime                    IN      CNAME   traefik-cl01tl
              stalwart                        IN      CNAME   traefik-cl01tl
              tautulli                        IN      CNAME   traefik-cl01tl
              tdarr                           IN      CNAME   traefik-cl01tl
              tubearchivist                   IN      CNAME   traefik-cl01tl
              vault                           IN      CNAME   traefik-cl01tl
              whodb                           IN      CNAME   traefik-cl01tl
              yamtrack                        IN      CNAME   traefik-cl01tl
          blocking:
            denylists:
              sus:
                - https://v.firebog.net/hosts/static/w3kbl.txt
              ads:
                - https://v.firebog.net/hosts/AdguardDNS.txt
                - https://v.firebog.net/hosts/Admiral.txt
                - https://v.firebog.net/hosts/Easylist.txt
                - https://adaway.org/hosts.txt
              priv:
                - https://v.firebog.net/hosts/Easyprivacy.txt
                - https://v.firebog.net/hosts/Prigent-Ads.txt
              mal:
                - https://v.firebog.net/hosts/Prigent-Crypto.txt
                - https://osint.digitalside.it/Threat-Intel/lists/latestdomains.txt
              pro:
                - https://raw.githubusercontent.com/hagezi/dns-blocklists/main/wildcard/pro.plus.txt
            allowlists:
              sus:
                - |
                  *.alexlebens.net
                  *.alexlebens.dev
                  *.boreal-beaufort.ts.net
              ads:
                - |
                  *.alexlebens.net
                  *.alexlebens.dev
                  *.boreal-beaufort.ts.net
              priv:
                - |
                  *.alexlebens.net
                  *.alexlebens.dev
                  *.boreal-beaufort.ts.net
              mal:
                - |
                  *.alexlebens.net
                  *.alexlebens.dev
                  *.boreal-beaufort.ts.net
              pro:
                - |
                  *.alexlebens.net
                  *.alexlebens.dev
                  *.boreal-beaufort.ts.net
            clientGroupsBlock:
              default:
                - sus
                - ads
                - priv
                - mal
                - pro
            blockType: zeroIp
            blockTTL: 1m
            loading:
              refreshPeriod: 24h
              downloads:
                timeout: 60s
                attempts: 5
                cooldown: 10s
              concurrency: 16
              strategy: fast
              maxErrorsPerSource: 5
          caching:
            minTime: 5m
            maxTime: 30m
            maxItemsCount: 0
            prefetching: true
            prefetchExpires: 2h
            prefetchThreshold: 5
            prefetchMaxItemsCount: 0
            cacheTimeNegative: 30m
          redis:
            address: redis-replication-blocky-master.blocky:6379
            required: true
          prometheus:
            enable: true
            path: /metrics
          queryLog:
            type: console
            logRetentionDays: 7
            creationAttempts: 1
            creationCooldown: 2s
            flushInterval: 30s
          minTlsServeVersion: 1.3
          ports:
            dns: 53
            http: 4000
          log:
            level: info
            format: text
            timestamp: true
            privacy: false
  service:
    dns-external:
      controller: main
      type: LoadBalancer
      annotations:
        tailscale.com/expose: "true"
      ports:
        tcp:
          port: 53
          targetPort: 53
          protocol: TCP
        udp:
          port: 53
          targetPort: 53
          protocol: UDP
    metrics:
      controller: main
      ports:
        metrics:
          port: 4000
          targetPort: 4000
          protocol: TCP
  persistence:
    config:
      enabled: true
      type: configMap
      name: blocky
      advancedMounts:
        main:
          main:
            - path: /app/config.yml
              readOnly: true
              mountPropagation: None
              subPath: config.yml
@@ -0,0 +1,9 @@
 dependencies:
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
  version: 4.5.0
 - name: mariadb-cluster
  repository: https://helm.mariadb.com/mariadb-operator
  version: 25.10.2
 digest: sha256:58d978bd46c61285b06acc6d9a40404d8059f2df7b953dea13c528b35350d0a8
 generated: "2025-12-05T17:03:15.7199669Z"
@@ -0,0 +1,24 @@
 apiVersion: v2
 name: booklore
 version: 1.0.0
 description: booklore
 keywords:
  - booklore
  - books
 home: https://wiki.alexlebens.dev/
 sources:
  - https://github.com/booklore-app/BookLore
  - https://github.com/booklore-app/booklore/pkgs/container/booklore
  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
 maintainers:
  - name: alexlebens
 dependencies:
  - name: app-template
    alias: booklore
    repository: https://bjw-s-labs.github.io/helm-charts/
    version: 4.5.0
  - name: mariadb-cluster
    version: 25.10.2
    repository: https://helm.mariadb.com/mariadb-operator
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/booklore.png
 appVersion: v1.13.2
@@ -0,0 +1,332 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: booklore-database-secret
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: booklore-database-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: password
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/booklore/database
        metadataPolicy: None
        property: password
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: booklore-data-replication-secret
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: booklore-data-replication-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: psk.txt
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/booklore/replication
        metadataPolicy: None
        property: psk.txt
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: booklore-config-backup-secret
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: booklore-config-backup-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  target:
    template:
      mergePolicy: Merge
      engineVersion: v2
      data:
        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/booklore/booklore-config"
  data:
    - secretKey: BUCKET_ENDPOINT
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /volsync/restic/digital-ocean
        metadataPolicy: None
        property: BUCKET_ENDPOINT
    - secretKey: RESTIC_PASSWORD
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /volsync/restic/digital-ocean
        metadataPolicy: None
        property: RESTIC_PASSWORD
    - secretKey: AWS_DEFAULT_REGION
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: AWS_DEFAULT_REGION
    - secretKey: AWS_ACCESS_KEY_ID
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: AWS_ACCESS_KEY_ID
    - secretKey: AWS_SECRET_ACCESS_KEY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: AWS_SECRET_ACCESS_KEY
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: booklore-data-backup-secret-local
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: booklore-data-backup-secret-local
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  target:
    template:
      mergePolicy: Merge
      engineVersion: v2
      data:
        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/booklore/booklore-data"
  data:
    - secretKey: BUCKET_ENDPOINT
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /volsync/restic/garage-local
        metadataPolicy: None
        property: BUCKET_ENDPOINT
    - secretKey: RESTIC_PASSWORD
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /volsync/restic/garage-local
        metadataPolicy: None
        property: RESTIC_PASSWORD
    - secretKey: AWS_DEFAULT_REGION
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/volsync-backups
        metadataPolicy: None
        property: ACCESS_REGION
    - secretKey: AWS_ACCESS_KEY_ID
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/volsync-backups
        metadataPolicy: None
        property: ACCESS_KEY_ID
    - secretKey: AWS_SECRET_ACCESS_KEY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/volsync-backups
        metadataPolicy: None
        property: ACCESS_SECRET_KEY
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: booklore-data-backup-secret-remote
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: booklore-data-backup-secret-remote
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  target:
    template:
      mergePolicy: Merge
      engineVersion: v2
      data:
        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/booklore/booklore-data"
  data:
    - secretKey: BUCKET_ENDPOINT
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /volsync/restic/garage-remote
        metadataPolicy: None
        property: BUCKET_ENDPOINT
    - secretKey: RESTIC_PASSWORD
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /volsync/restic/garage-remote
        metadataPolicy: None
        property: RESTIC_PASSWORD
    - secretKey: AWS_DEFAULT_REGION
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/volsync-backups
        metadataPolicy: None
        property: ACCESS_REGION
    - secretKey: AWS_ACCESS_KEY_ID
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/volsync-backups
        metadataPolicy: None
        property: ACCESS_KEY_ID
    - secretKey: AWS_SECRET_ACCESS_KEY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/volsync-backups
        metadataPolicy: None
        property: ACCESS_SECRET_KEY
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: booklore-data-backup-secret-external
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: booklore-data-backup-secret-external
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  target:
    template:
      mergePolicy: Merge
      engineVersion: v2
      data:
        RESTIC_REPOSITORY: "{{ `{{ .BUCKET_ENDPOINT }}` }}/booklore/booklore-data"
  data:
    - secretKey: BUCKET_ENDPOINT
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /volsync/restic/digital-ocean
        metadataPolicy: None
        property: BUCKET_ENDPOINT
    - secretKey: RESTIC_PASSWORD
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /volsync/restic/digital-ocean
        metadataPolicy: None
        property: RESTIC_PASSWORD
    - secretKey: AWS_DEFAULT_REGION
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: AWS_DEFAULT_REGION
    - secretKey: AWS_ACCESS_KEY_ID
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: AWS_ACCESS_KEY_ID
    - secretKey: AWS_SECRET_ACCESS_KEY
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/volsync-backups
        metadataPolicy: None
        property: AWS_SECRET_ACCESS_KEY
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: booklore-mariadb-cluster-backup-secret-external
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: booklore-mariadb-cluster-backup-secret-external
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: access
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/mariadb-backups
        metadataPolicy: None
        property: access
    - secretKey: secret
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /digital-ocean/home-infra/mariadb-backups
        metadataPolicy: None
        property: secret
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: booklore-mariadb-cluster-backup-secret-garage
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: booklore-mariadb-cluster-backup-secret-garage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: access
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/mariadb-backups
        metadataPolicy: None
        property: access
    - secretKey: secret
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /garage/home-infra/mariadb-backups
        metadataPolicy: None
        property: secret
@@ -0,0 +1,28 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: http-route-booklore
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: http-route-booklore
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: traefik-gateway
      namespace: traefik
  hostnames:
    - booklore.alexlebens.net
  rules:
    - matches:
      - path:
          type: PathPrefix
          value: /
      backendRefs:
        - group: ''
          kind: Service
          name: booklore
          port: 80
          weight: 100
@@ -0,0 +1,10 @@
 apiVersion: v1
 kind: Namespace
 metadata:
  name: booklore
  annotations:
    volsync.backube/privileged-movers: "true"
  labels:
    app.kubernetes.io/name: booklore
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
@@ -0,0 +1,36 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
  name: booklore-books-nfs-storage
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: booklore-books-nfs-storage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  volumeName: booklore-books-nfs-storage
  storageClassName: nfs-client
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 1Gi
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
  name: booklore-books-import-nfs-storage
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: booklore-books-import-nfs-storage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  volumeName: booklore-books-import-nfs-storage
  storageClassName: nfs-client
  accessModes:
    - ReadWriteMany
  resources:
    requests:
      storage: 1Gi
@@ -0,0 +1,48 @@
 apiVersion: v1
 kind: PersistentVolume
 metadata:
  name: booklore-books-nfs-storage
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: booklore-books-nfs-storage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  persistentVolumeReclaimPolicy: Retain
  storageClassName: nfs-client
  capacity:
    storage: 1Gi
  accessModes:
    - ReadWriteMany
  nfs:
    path: /volume2/Storage/Books
    server: synologybond.alexlebens.net
  mountOptions:
    - vers=4
    - minorversion=1
    - noac
 ---
 apiVersion: v1
 kind: PersistentVolume
 metadata:
  name: booklore-books-import-nfs-storage
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: booklore-books-import-nfs-storage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  persistentVolumeReclaimPolicy: Retain
  storageClassName: nfs-client
  capacity:
    storage: 1Gi
  accessModes:
    - ReadWriteMany
  nfs:
    path: /volume2/Storage/Books Import
    server: synologybond.alexlebens.net
  mountOptions:
    - vers=4
    - minorversion=1
    - noac
@@ -0,0 +1,15 @@
 apiVersion: volsync.backube/v1alpha1
 kind: ReplicationDestination
 metadata:
  name: booklore-data-replication-destination
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: booklore-data-replication-destination
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  rsyncTLS:
    copyMethod: Direct
    accessModes: ["ReadWriteMany"]
    destinationPVC: booklore-books-nfs-storage
    keySecret: booklore-data-replication-secret
@@ -0,0 +1,129 @@
 apiVersion: volsync.backube/v1alpha1
 kind: ReplicationSource
 metadata:
  name: booklore-data-replication-source
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: booklore-data-replication-source
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  sourcePVC: booklore-data
  trigger:
    schedule: "0 0 * * *"
  rsyncTLS:
    keySecret: booklore-data-replication-secret
    address: volsync-rsync-tls-dst-booklore-data-replication-destination
    copyMethod: Snapshot
 ---
 apiVersion: volsync.backube/v1alpha1
 kind: ReplicationSource
 metadata:
  name: booklore-config-backup-source
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: booklore-config-backup-source
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  sourcePVC: booklore-config
  trigger:
    schedule: 0 4 * * *
  restic:
    pruneIntervalDays: 7
    repository: booklore-config-backup-secret
    retain:
      hourly: 1
      daily: 3
      weekly: 2
      monthly: 2
      yearly: 4
    copyMethod: Snapshot
    storageClassName: ceph-block
    volumeSnapshotClassName: ceph-blockpool-snapshot
    cacheCapacity: 10Gi
 ---
 apiVersion: volsync.backube/v1alpha1
 kind: ReplicationSource
 metadata:
  name: booklore-data-backup-source-local
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: booklore-data-backup-source-local
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  sourcePVC: booklore-data
  trigger:
    schedule: 0 2 * * *
  restic:
    pruneIntervalDays: 7
    repository: booklore-data-backup-secret-local
    retain:
      hourly: 1
      daily: 3
      weekly: 2
      monthly: 2
      yearly: 4
    copyMethod: Snapshot
    storageClassName: ceph-block
    volumeSnapshotClassName: ceph-blockpool-snapshot
    cacheCapacity: 10Gi
 ---
 apiVersion: volsync.backube/v1alpha1
 kind: ReplicationSource
 metadata:
  name: booklore-data-backup-source-remote
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: booklore-data-backup-source-remote
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  sourcePVC: booklore-data
  trigger:
    schedule: 0 3 * * *
  restic:
    pruneIntervalDays: 7
    repository: booklore-data-backup-secret-remote
    retain:
      hourly: 1
      daily: 3
      weekly: 2
      monthly: 2
      yearly: 4
    copyMethod: Snapshot
    storageClassName: ceph-block
    volumeSnapshotClassName: ceph-blockpool-snapshot
    cacheCapacity: 10Gi
 ---
 apiVersion: volsync.backube/v1alpha1
 kind: ReplicationSource
 metadata:
  name: booklore-data-backup-source-external
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: booklore-data-backup-source-external
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  sourcePVC: booklore-data
  trigger:
    schedule: 0 4 * * *
  restic:
    pruneIntervalDays: 7
    repository: booklore-data-backup-secret-external
    retain:
      hourly: 1
      daily: 3
      weekly: 2
      monthly: 2
      yearly: 4
    copyMethod: Snapshot
    storageClassName: ceph-block
    volumeSnapshotClassName: ceph-blockpool-snapshot
    cacheCapacity: 10Gi
@@ -0,0 +1,14 @@
 apiVersion: v1
 kind: Service
 metadata:
  name: garage-ps10rp
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: garage-ps10rp
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
  annotations:
    tailscale.com/tailnet-fqdn: garage-ps10rp.boreal-beaufort.ts.net
 spec:
  externalName: placeholder
  type: ExternalName
@@ -0,0 +1,155 @@
 booklore:
  controllers:
    main:
      type: deployment
      replicas: 1
      strategy: Recreate
      revisionHistoryLimit: 3
      containers:
        main:
          image:
            repository: ghcr.io/booklore-app/booklore
            tag: v1.13.2
            pullPolicy: IfNotPresent
          env:
            - name: TZ
              value: America/Chicago
            - name: DATABASE_URL
              value: jdbc:mariadb://booklore-mariadb-cluster-primary.booklore:3306/booklore
            - name: DATABASE_USERNAME
              value: booklore
            - name: DATABASE_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: booklore-database-secret
                  key: password
            - name: BOOKLORE_PORT
              value: 6060
            - name: SWAGGER_ENABLED
              value: false
          resources:
            requests:
              cpu: 50m
              memory: 128Mi
  service:
    main:
      controller: main
      ports:
        http:
          port: 80
          targetPort: 6060
          protocol: HTTP
  persistence:
    config:
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 5Gi
      retain: true
      advancedMounts:
        main:
          main:
            - path: /app/data
              readOnly: false
    data:
      storageClass: ceph-block
      accessMode: ReadWriteOnce
      size: 10Gi
      retain: true
      advancedMounts:
        main:
          main:
            - path: /data
              readOnly: false
    books-import:
      type: emptyDir
      advancedMounts:
        main:
          main:
            - path: /bookdrop
              readOnly: false
    ingest:
      existingClaim: booklore-books-import-nfs-storage
      advancedMounts:
        main:
          main:
            - path: /bookdrop/ingest
              readOnly: false
 mariadb-cluster:
  mariadb:
    rootPasswordSecretKeyRef:
      generate: false
      name: booklore-database-secret
      key: password
    storage:
      size: 5Gi
    replicas: 3
    galera:
      enabled: true
  databases:
    - name: booklore
      characterSet: utf8
      collate: utf8_general_ci
      cleanupPolicy: Delete
      requeueInterval: 10h
  users:
    - name: booklore
      passwordSecretKeyRef:
        name: booklore-database-secret
        key: password
      host: '%'
      cleanupPolicy: Delete
      requeueInterval: 10h
      retryInterval: 30s
  grants:
    - name: booklore
      privileges:
        - "ALL PRIVILEGES"
      database: "booklore"
      table: "*"
      username: booklore
      grantOption: true
      host: '%'
      cleanupPolicy: Delete
      requeueInterval: 10h
      retryInterval: 30s
  physicalBackups:
    - name: backup-external
      schedule:
        cron: "0 0 * * 0"
        suspend: false
        immediate: true
      compression: gzip
      maxRetention: 720h
      storage:
        s3:
          bucket: mariadb-backups-b230a2f5aecf080a4b372c08
          prefix: cl01tl/booklore
          endpoint: nyc3.digitaloceanspaces.com
          region: us-east-1
          accessKeyIdSecretKeyRef:
            name: booklore-mariadb-cluster-backup-secret-external
            key: access
          secretAccessKeySecretKeyRef:
            name: booklore-mariadb-cluster-backup-secret-external
            key: secret
          tls:
            enabled: true
    - name: backup-garage
      schedule:
        cron: "0 0 * * *"
        suspend: false
        immediate: true
      compression: gzip
      maxRetention: 360h
      storage:
        s3:
          bucket: mariadb-backups
          prefix: cl01tl/booklore
          endpoint: garage-main.garage:3900
          region: us-east-1
          accessKeyIdSecretKeyRef:
            name: booklore-mariadb-cluster-backup-secret-garage
            key: access
          secretAccessKeySecretKeyRef:
            name: booklore-mariadb-cluster-backup-secret-garage
            key: secret
@@ -0,0 +1,6 @@
 dependencies:
 - name: cert-manager
  repository: https://charts.jetstack.io
  version: v1.19.2
 digest: sha256:b02bda9b9f2fc886af11d017a27a5761513defee603f9e3aa1d7add2749b925c
 generated: "2025-12-10T15:01:57.196895547Z"
@@ -0,0 +1,20 @@
 apiVersion: v2
 name: cert-manager
 version: 1.0.0
 description: Cert Manager
 keywords:
  - cert-manager
  - certificates
  - kubernetes
 home: https://wiki.alexlebens.dev/s/368fe718-eedb-40e0-a5a7-fad03cdc6b09
 sources:
  - https://github.com/cert-manager/cert-manager
  - https://github.com/cert-manager/cert-manager/tree/master/deploy/charts/cert-manager
 maintainers:
  - name: alexlebens
 dependencies:
  - name: cert-manager
    version: v1.19.2
    repository: https://charts.jetstack.io
 icon: https://raw.githubusercontent.com/walkxcode/dashboard-icons/main/png/cert-manager.png
 appVersion: v1.19.2
@@ -0,0 +1,21 @@
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
 metadata:
  name: letsencrypt-issuer
 spec:
  acme:
    email: alexanderlebens@gmail.com
    server: https://acme-v02.api.letsencrypt.org/directory
    privateKeySecretRef:
      name: letsencrypt-issuer-account-key
    solvers:
      - selector:
          dnsZones:
            - "alexlebens.net"
            - "*.alexlebens.net"
        dns01:
          cloudflare:
            email: alexanderlebens@gmail.com
            apiTokenSecretRef:
              name: cloudflare-api-token
              key: api-token
@@ -0,0 +1,21 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: cloudflare-api-token
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: cloudflare-api-token
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: api-token
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cloudflare/alexlebens.net/clusterissuer
        metadataPolicy: None
        property: token
@@ -0,0 +1,15 @@
 cert-manager:
  crds:
    enabled: true
    keep: true
  replicaCount: 2
  extraArgs:
    - --enable-gateway-api
  prometheus:
    enabled: true
    servicemonitor:
      enabled: true
      honorLabels: true
  cainjector:
    enabled: true
    replicaCount: 2
@@ -0,0 +1,6 @@
 dependencies:
 - name: cilium
  repository: https://helm.cilium.io/
  version: 1.18.4
 digest: sha256:e38eb92ee87c9a52b0f45a2451142ade02bac7d484b246d32379eacce3800bc8
 generated: "2025-12-02T17:17:49.043599-06:00"
@@ -0,0 +1,21 @@
 apiVersion: v2
 name: cilium
 version: 1.0.0
 description: Cilium
 keywords:
  - cilium
  - cni
  - network
  - kubernetes
 home: https://wiki.alexlebens.dev/s/9e6f5b17-e186-4af0-81cd-af647b162d3d
 sources:
  - https://github.com/cilium/cilium
  - https://github.com/cilium/charts
 maintainers:
  - name: alexlebens
 dependencies:
  - name: cilium
    version: 1.18.4
    repository: https://helm.cilium.io/
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/cilium.png
 appVersion: 1.18.4
@@ -0,0 +1,19 @@
 # apiVersion: cilium.io/v2alpha1
 # kind: CiliumBGPAdvertisement
 # metadata:
 #   name: cilium-bgp-advertisements
 #   namespace: {{ .Release.Namespace }}
 #   labels:
 #     app.kubernetes.io/name: cilium-bgp-advertisements
 #     app.kubernetes.io/instance: {{ .Release.Name }}
 #     app.kubernetes.io/part-of: {{ .Release.Name }}
 # spec:
 #   advertisements:
 #     - advertisementType: "Service"
 #       service:
 #         addresses:
 #           - ExternalIP
 #           - LoadBalancerIP
 #       selector:
 #         matchExpressions:
 #          - {key: somekey, operator: NotIn, values: ['never-used-value']}
@@ -0,0 +1,22 @@
 # apiVersion: cilium.io/v2alpha1
 # kind: CiliumBGPClusterConfig
 # metadata:
 #   name: cilium-bgp
 #   namespace: {{ .Release.Namespace }}
 #   labels:
 #     app.kubernetes.io/name: cilium-bgp
 #     app.kubernetes.io/instance: {{ .Release.Name }}
 #     app.kubernetes.io/part-of: {{ .Release.Name }}
 # spec:
 #   nodeSelector:
 #     matchLabels:
 #       node-role.kubernetes.io/bgp: "65020"
 #   bgpInstances:
 #     - name: "65020"
 #       localASN: 65020
 #       peers:
 #         - name: "udm-65000"
 #           peerASN: 65000
 #           peerAddress: 192.168.1.1
 #           peerConfigRef:
 #             name: "cilium-peer"
@@ -0,0 +1,23 @@
 # apiVersion: cilium.io/v2alpha1
 # kind: CiliumBGPPeerConfig
 # metadata:
 #   name: cilium-peer
 #   namespace: {{ .Release.Namespace }}
 #   labels:
 #     app.kubernetes.io/name: cilium-peer
 #     app.kubernetes.io/instance: {{ .Release.Name }}
 #     app.kubernetes.io/part-of: {{ .Release.Name }}
 # spec:
 #   timers:
 #     holdTimeSeconds: 9
 #     keepAliveTimeSeconds: 3
 #   ebgpMultihop: 4
 #   gracefulRestart:
 #     enabled: true
 #     restartTimeSeconds: 15
 #   families:
 #     - afi: ipv4
 #       safi: unicast
 #       advertisements:
 #         matchLabels:
 #           app.kubernetes.io/name: cilium-bgp-advertisements
@@ -0,0 +1,31 @@
 apiVersion: "cilium.io/v2alpha1"
 kind: CiliumLoadBalancerIPPool
 metadata:
  name: default-ip-pool
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: default-ip-pool
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  blocks:
    - start: "10.232.1.21"
      stop: "10.232.1.23"
    - start: "10.232.2.21"
      stop: "10.232.2.23"
 ---
 apiVersion: "cilium.io/v2alpha1"
 kind: CiliumLoadBalancerIPPool
 metadata:
  name: bgp-ip-pool
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: bgp-ip-pool
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  blocks:
    - start: "10.232.2.100"
      stop: "10.232.2.200"
  disabled: true
@@ -0,0 +1,35 @@
 # apiVersion: gateway.networking.k8s.io/v1
 # kind: Gateway
 # metadata:
 #   name: tls-gateway
 #   namespace: {{ .Release.Namespace }}
 #   labels:
 #     app.kubernetes.io/name: tls-gateway
 #     app.kubernetes.io/instance: {{ .Release.Name }}
 #     app.kubernetes.io/part-of: {{ .Release.Name }}
 #   annotations:
 #     cert-manager.io/cluster-issuer: letsencrypt-issuer
 # spec:
 #   gatewayClassName: cilium
 #   listeners:
 #     - allowedRoutes:
 #         namespaces:
 #           from: All
 #       hostname: '*.alexlebens.net'
 #       name: http
 #       port: 80
 #       protocol: HTTP
 #     - allowedRoutes:
 #         namespaces:
 #           from: All
 #       hostname: '*.alexlebens.net'
 #       name: https
 #       port: 443
 #       protocol: HTTPS
 #       tls:
 #         certificateRefs:
 #           - group: ''
 #             kind: Secret
 #             name: https-gateway-cert
 #             namespace: kube-system
 #         mode: Terminate
@@ -0,0 +1,28 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: http-route-hubble
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: http-route-hubble
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: traefik-gateway
      namespace: traefik
  hostnames:
    - hubble.alexlebens.net
  rules:
    - matches:
      - path:
          type: PathPrefix
          value: /
      backendRefs:
        - group: ''
          kind: Service
          name: hubble-ui
          port: 80
          weight: 100
@@ -0,0 +1,107 @@
 cilium:
  k8sServiceHost: "localhost"
  k8sServicePort: "7445"
  k8sClientRateLimit:
    qps: 50
    burst: 100
  rollOutCiliumPods: true
  securityContext:
    capabilities:
      ciliumAgent:
        - CHOWN
        - KILL
        - NET_ADMIN
        - NET_RAW
        - IPC_LOCK
        - SYS_ADMIN
        - SYS_RESOURCE
        - DAC_OVERRIDE
        - FOWNER
        - SETGID
        - SETUID
        - PERFMON
        - BPF
      cleanCiliumState:
        - NET_ADMIN
        - SYS_ADMIN
        - SYS_RESOURCE
  l2announcements:
    enabled: false
  bgpControlPlane:
    enabled: false
    secretsNamespace:
      name: kube-system
    statusReport:
      enabled: true
    routerIDAllocation:
      mode: "default"
  devices: end0 enp6s0
  enableK8sEndpointSlice: true
  ciliumEndpointSlice:
    enabled: true
  ingressController:
    enabled: false
  gatewayAPI:
    enabled: true
    enableAlpn: true
    enableAppProtocol: true
  externalIPs:
    enabled: true
  socketLB:
    enabled: true
    hostNamespaceOnly: true
  hubble:
    enabled: true
    metrics:
      serviceMonitor:
        enabled: true
    tls:
      auto:
        method: cronJob
    relay:
      enabled: true
      metrics:
        serviceMonitor:
          enabled: true
    ui:
      enabled: true
      ingress:
        enabled: false
  ipam:
    mode: "kubernetes"
  ipv4:
    enabled: true
  ipv6:
    enabled: false
  kubeProxyReplacement: true
  l7Proxy: true
  prometheus:
    enabled: true
    serviceMonitor:
      trustCRDsExist: true
      enabled: true
  envoy:
    enabled: true
    securityContext:
      capabilities:
        keepCapNetBindService: true
        envoy:
          - NET_ADMIN
          - NET_BIND_SERVICE
          - PERFMON
          - BPF
    prometheus:
      enabled: true
      serviceMonitor:
        enabled: true
  operator:
    enabled: true
    rollOutPods: true
    prometheus:
      enabled: true
      serviceMonitor:
        enabled: true
  cgroup:
    autoMount:
      enabled: false
    hostRoot: /sys/fs/cgroup
@@ -0,0 +1,9 @@
 dependencies:
 - name: cloudnative-pg
  repository: https://cloudnative-pg.io/charts/
  version: 0.27.0
 - name: plugin-barman-cloud
  repository: https://cloudnative-pg.io/charts/
  version: 0.3.1
 digest: sha256:14aa30b7bf75571b03bda19af68cd50c1e7908b883351b196a260609a5b85551
 generated: "2025-12-10T19:25:17.952954019Z"
@@ -0,0 +1,25 @@
 apiVersion: v2
 name: cloudnative-pg
 version: 1.0.0
 description: Cloudnative PG
 keywords:
  - cloudnative-pg
  - operator
  - postgresql
  - kubernetes
 home: https://wiki.alexlebens.dev/s/9fb10833-0278-4e64-a34c-d348d833839f
 sources:
  - https://github.com/cloudnative-pg/cloudnative-pg
  - https://github.com/cloudnative-pg/charts/tree/main/charts/cloudnative-pg
  - https://github.com/cloudnative-pg/charts/tree/main/charts/plugin-barman-cloud
 maintainers:
  - name: alexlebens
 dependencies:
  - name: cloudnative-pg
    version: 0.27.0
    repository: https://cloudnative-pg.io/charts/
  - name: plugin-barman-cloud
    version: 0.3.1
    repository: https://cloudnative-pg.io/charts/
 icon: https://avatars.githubusercontent.com/u/100373852?s=200&v=4
 appVersion: 1.28.0
@@ -0,0 +1,16 @@
 cloudnative-pg:
  replicaCount: 2
  monitoring:
    podMonitorEnabled: true
 plugin-barman-cloud:
  replicaCount: 1
  image:
    registry: ghcr.io
    repository: cloudnative-pg/plugin-barman-cloud
    tag: v0.9.0
  sidecarImage:
    registry: ghcr.io
    repository: cloudnative-pg/plugin-barman-cloud-sidecar
    tag: v0.9.0
  crds:
    create: true
@@ -0,0 +1,9 @@
 dependencies:
 - name: app-template
  repository: https://bjw-s-labs.github.io/helm-charts/
  version: 4.5.0
 - name: cloudflared
  repository: oci://harbor.alexlebens.net/helm-charts
  version: 1.23.2
 digest: sha256:3cf78630cd7670e1157a87fc7ccbeca248ef4ced8a3170e69140ea3e1b0ff564
 generated: "2025-12-07T02:54:11.675097664Z"
@@ -0,0 +1,28 @@
 apiVersion: v2
 name: code-server
 version: 1.0.0
 description: Code Server
 keywords:
  - code-server
  - code
  - ide
 home: https://wiki.alexlebens.dev/s/233f96bb-db70-47e4-8b22-a8efcbb0f93d
 sources:
  - https://github.com/coder/code-server
  - https://github.com/cloudflare/cloudflared
  - https://hub.docker.com/r/linuxserver/code-server
  - https://github.com/bjw-s-labs/helm-charts/tree/main/charts/other/app-template
  - https://gitea.alexlebens.dev/alexlebens/helm-charts/src/branch/main/charts/cloudflared
 maintainers:
  - name: alexlebens
 dependencies:
  - name: app-template
    alias: code-server
    repository: https://bjw-s-labs.github.io/helm-charts/
    version: 4.5.0
  - name: cloudflared
    alias: cloudflared
    repository: oci://harbor.alexlebens.net/helm-charts
    version: 1.23.2
 icon: https://cdn.jsdelivr.net/gh/selfhst/icons/png/visual-studio-code.png
 appVersion: 4.106.3
@@ -0,0 +1,51 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: codeserver-password-secret
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: codeserver-password-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: PASSWORD
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/code-server/auth
        metadataPolicy: None
        property: PASSWORD
    - secretKey: SUDO_PASSWORD
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cl01tl/code-server/auth
        metadataPolicy: None
        property: SUDO_PASSWORD
 ---
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: code-server-cloudflared-secret
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: code-server-cloudflared-secret
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  secretStoreRef:
    kind: ClusterSecretStore
    name: vault
  data:
    - secretKey: cf-tunnel-token
      remoteRef:
        conversionStrategy: Default
        decodingStrategy: None
        key: /cloudflare/tunnels/codeserver
        metadataPolicy: None
        property: token
@@ -0,0 +1,28 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
  name: http-route-code-server
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: http-route-code-server
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  parentRefs:
    - group: gateway.networking.k8s.io
      kind: Gateway
      name: traefik-gateway
      namespace: traefik
  hostnames:
    - code-server.alexlebens.net
  rules:
    - matches:
      - path:
          type: PathPrefix
          value: /
      backendRefs:
        - group: ''
          kind: Service
          name: code-server
          port: 8443
          weight: 100
@@ -0,0 +1,17 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
  name: code-server-nfs-storage
  namespace: {{ .Release.Namespace }}
  labels:
    app.kubernetes.io/name: code-server-nfs-storage
    app.kubernetes.io/instance: {{ .Release.Name }}
    app.kubernetes.io/part-of: {{ .Release.Name }}
 spec:
  volumeMode: Filesystem
  storageClassName: nfs-client
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 1Gi
@@ -0,0 +1,47 @@
 code-server:
  controllers:
    main:
      type: deployment
      replicas: 1
      strategy: Recreate
      revisionHistoryLimit: 3
      containers:
        main:
          image:
            repository: ghcr.io/linuxserver/code-server
            tag: 4.106.3@sha256:aab9520fe923b2d93dccc2c806f3dc60649c2f4a2847fcd40c942227d0f1ae8f
            pullPolicy: IfNotPresent
          env:
            - name: TZ
              value: US/Central
            - name: PUID
              value: 1000
            - name: PGID
              value: 1000
            - name: DEFAULT_WORKSPACE
              value: /config
          envFrom:
            - secretRef:
                name: codeserver-password-secret
          resources:
            requests:
              cpu: 10m
              memory: 128Mi
  service:
    main:
      controller: main
      ports:
        http:
          port: 8443
          targetPort: 8443
          protocol: HTTP
  persistence:
    config:
      existingClaim: code-server-nfs-storage
      advancedMounts:
        main:
          main:
            - path: /config
              readOnly: false
 cloudflared:
  existingSecretName: code-server-cloudflared-secret
@@ -0,0 +1,6 @@
 dependencies:
 - name: coredns
  repository: https://coredns.github.io/helm
  version: 1.45.0
 digest: sha256:cfcb22a7d0bce4d6000800706597ae43faec74255f1deb5cc3279b2d0a81f6c6
 generated: "2025-12-02T17:17:52.206039-06:00"
--- a/Show More
+++ b/Show More