clusters/cl01tl/manifests/actual/-.yaml

@@ -0,0 +1 @@
+

clusters/cl01tl/manifests/actual/Deployment-actual.yaml

@@ -1,64 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: actual
-  labels:
-    app.kubernetes.io/controller: main
-    app.kubernetes.io/instance: actual
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: actual
-    helm.sh/chart: actual-4.6.2
-  namespace: actual
-spec:
-  revisionHistoryLimit: 3
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app.kubernetes.io/controller: main
-      app.kubernetes.io/name: actual
-      app.kubernetes.io/instance: actual
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/controller: main
-        app.kubernetes.io/instance: actual
-        app.kubernetes.io/name: actual
-    spec:
-      enableServiceLinks: false
-      serviceAccountName: default
-      automountServiceAccountToken: true
-      hostIPC: false
-      hostNetwork: false
-      hostPID: false
-      dnsPolicy: ClusterFirst
-      containers:
-        - env:
-            - name: ACTUAL_PORT
-              value: "5006"
-          image: ghcr.io/actualbudget/actual:26.4.0@sha256:b0e732e2c41b3dc468a71548e88ef76d3f0c157fc43d15fa05d14ec1c5747e1e
-          livenessProbe:
-            exec:
-              command:
-                - /usr/bin/env
-                - bash
-                - -c
-                - node src/scripts/health-check.js
-            failureThreshold: 5
-            initialDelaySeconds: 60
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 10
-          name: main
-          resources:
-            requests:
-              cpu: 10m
-              memory: 50Mi
-          volumeMounts:
-            - mountPath: /data
-              name: data
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: actual-data

clusters/cl01tl/manifests/actual/ExternalSecret-actual-data-backup-secret-external.yaml

@@ -1,58 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: actual-data-backup-secret-external
-  namespace: actual
-  labels:
-    helm.sh/chart: volsync-target-data-0.8.0
-    app.kubernetes.io/instance: actual
-    app.kubernetes.io/part-of: actual
-    app.kubernetes.io/version: "0.8.0"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: actual-data-backup-secret-external
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/actual/actual-data"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_ACCESS_KEY_ID
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_SECRET_ACCESS_KEY

clusters/cl01tl/manifests/actual/ExternalSecret-actual-data-backup-secret-local.yaml

@@ -1,58 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: actual-data-backup-secret-local
-  namespace: actual
-  labels:
-    helm.sh/chart: volsync-target-data-0.8.0
-    app.kubernetes.io/instance: actual
-    app.kubernetes.io/part-of: actual
-    app.kubernetes.io/version: "0.8.0"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: actual-data-backup-secret-local
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/actual/actual-data"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
-        property: ACCESS_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
-        property: ACCESS_KEY_ID
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
-        property: ACCESS_SECRET_KEY

clusters/cl01tl/manifests/actual/ExternalSecret-actual-data-backup-secret-remote.yaml

@@ -1,58 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: actual-data-backup-secret-remote
-  namespace: actual
-  labels:
-    helm.sh/chart: volsync-target-data-0.8.0
-    app.kubernetes.io/instance: actual
-    app.kubernetes.io/part-of: actual
-    app.kubernetes.io/version: "0.8.0"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: actual-data-backup-secret-remote
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/actual/actual-data"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
-        property: ACCESS_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
-        property: ACCESS_KEY_ID
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
-        property: ACCESS_SECRET_KEY

clusters/cl01tl/manifests/actual/HTTPRoute-actual.yaml

@@ -1,30 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: actual
-  labels:
-    app.kubernetes.io/instance: actual
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: actual
-    helm.sh/chart: actual-4.6.2
-  namespace: actual
-spec:
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: traefik-gateway
-      namespace: traefik
-  hostnames:
-    - "actual.alexlebens.net"
-  rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: actual
-          namespace: actual
-          port: 80
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

clusters/cl01tl/manifests/actual/PersistentVolumeClaim-actual-data.yaml

@@ -1,17 +0,0 @@
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: actual-data
-  labels:
-    app.kubernetes.io/instance: actual
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: actual
-    helm.sh/chart: actual-4.6.2
-  namespace: actual
-spec:
-  accessModes:
-    - "ReadWriteOnce"
-  resources:
-    requests:
-      storage: "2Gi"
-  storageClassName: "ceph-block"

clusters/cl01tl/manifests/actual/ReplicationSource-actual-data-backup-source-external.yaml

@@ -1,29 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: actual-data-backup-source-external
-  namespace: actual
-  labels:
-    helm.sh/chart: volsync-target-data-0.8.0
-    app.kubernetes.io/instance: actual
-    app.kubernetes.io/part-of: actual
-    app.kubernetes.io/version: "0.8.0"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: actual-data-backup
-spec:
-  sourcePVC: actual-data
-  trigger:
-    schedule: 0 10 * * *
-  restic:
-    pruneIntervalDays: 7
-    repository: actual-data-backup-secret-external
-    retain:
-      daily: 7
-      hourly: 0
-      monthly: 3
-      weekly: 4
-      yearly: 1
-    copyMethod: Snapshot
-    storageClassName: ceph-block
-    volumeSnapshotClassName: ceph-blockpool-snapshot
-    cacheCapacity: 1Gi

clusters/cl01tl/manifests/actual/ReplicationSource-actual-data-backup-source-local.yaml

@@ -1,29 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: actual-data-backup-source-local
-  namespace: actual
-  labels:
-    helm.sh/chart: volsync-target-data-0.8.0
-    app.kubernetes.io/instance: actual
-    app.kubernetes.io/part-of: actual
-    app.kubernetes.io/version: "0.8.0"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: actual-data-backup
-spec:
-  sourcePVC: actual-data
-  trigger:
-    schedule: 0 8 * * *
-  restic:
-    pruneIntervalDays: 7
-    repository: actual-data-backup-secret-local
-    retain:
-      daily: 7
-      hourly: 0
-      monthly: 3
-      weekly: 4
-      yearly: 1
-    copyMethod: Snapshot
-    storageClassName: ceph-block
-    volumeSnapshotClassName: ceph-blockpool-snapshot
-    cacheCapacity: 1Gi

clusters/cl01tl/manifests/actual/ReplicationSource-actual-data-backup-source-remote.yaml

@@ -1,29 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: actual-data-backup-source-remote
-  namespace: actual
-  labels:
-    helm.sh/chart: volsync-target-data-0.8.0
-    app.kubernetes.io/instance: actual
-    app.kubernetes.io/part-of: actual
-    app.kubernetes.io/version: "0.8.0"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: actual-data-backup
-spec:
-  sourcePVC: actual-data
-  trigger:
-    schedule: 0 9 * * *
-  restic:
-    pruneIntervalDays: 7
-    repository: actual-data-backup-secret-remote
-    retain:
-      daily: 7
-      hourly: 0
-      monthly: 3
-      weekly: 4
-      yearly: 1
-    copyMethod: Snapshot
-    storageClassName: ceph-block
-    volumeSnapshotClassName: ceph-blockpool-snapshot
-    cacheCapacity: 1Gi

clusters/cl01tl/manifests/actual/Service-actual.yaml

@@ -1,22 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: actual
-  labels:
-    app.kubernetes.io/instance: actual
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: actual
-    app.kubernetes.io/service: actual
-    helm.sh/chart: actual-4.6.2
-  namespace: actual
-spec:
-  type: ClusterIP
-  ports:
-    - port: 80
-      targetPort: 5006
-      protocol: TCP
-      name: http
-  selector:
-    app.kubernetes.io/controller: main
-    app.kubernetes.io/instance: actual
-    app.kubernetes.io/name: actual

clusters/cl01tl/manifests/audiobookshelf/-.yaml

@@ -0,0 +1 @@
+

clusters/cl01tl/manifests/audiobookshelf/Deployment-audiobookshelf.yaml

@@ -1,95 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: audiobookshelf
-  labels:
-    app.kubernetes.io/controller: main
-    app.kubernetes.io/instance: audiobookshelf
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: audiobookshelf
-    helm.sh/chart: audiobookshelf-4.6.2
-  namespace: audiobookshelf
-spec:
-  revisionHistoryLimit: 3
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app.kubernetes.io/controller: main
-      app.kubernetes.io/name: audiobookshelf
-      app.kubernetes.io/instance: audiobookshelf
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/controller: main
-        app.kubernetes.io/instance: audiobookshelf
-        app.kubernetes.io/name: audiobookshelf
-    spec:
-      enableServiceLinks: false
-      serviceAccountName: default
-      automountServiceAccountToken: true
-      securityContext:
-        fsGroup: 1000
-        fsGroupChangePolicy: OnRootMismatch
-      hostIPC: false
-      hostNetwork: false
-      hostPID: false
-      dnsPolicy: ClusterFirst
-      containers:
-        - env:
-            - name: TZ
-              value: America/Chicago
-            - name: PGID
-              value: "1000"
-            - name: PUID
-              value: "1000"
-            - name: APPRISE_STORAGE_MODE
-              value: memory
-            - name: APPRISE_STATEFUL_MODE
-              value: disabled
-            - name: APPRISE_WORKER_COUNT
-              value: "1"
-            - name: APPRISE_STATELESS_URLS
-              valueFrom:
-                secretKeyRef:
-                  key: ntfy-url
-                  name: audiobookshelf-apprise-config
-          image: ghcr.io/caronc/apprise:v1.3.3@sha256:4bfeac268ba87b8e08e308c9aa0182fe99e9501ec464027afc333d1634e65977
-          name: apprise-api
-        - env:
-            - name: TZ
-              value: America/Chicago
-          image: ghcr.io/advplyr/audiobookshelf:2.33.1@sha256:a4a5841bba093d81e5f4ad1eaedb4da3fda6dbb2528c552349da50ad1f7ae708
-          name: main
-          resources:
-            requests:
-              cpu: 1m
-              memory: 200Mi
-          volumeMounts:
-            - mountPath: /mnt/store/Audiobooks
-              name: audiobooks
-            - mountPath: /mnt/store/Books
-              name: books
-            - mountPath: /config
-              name: config
-            - mountPath: /metadata
-              name: metadata
-            - mountPath: /mnt/store/Podcasts
-              name: podcasts
-      volumes:
-        - name: audiobooks
-          persistentVolumeClaim:
-            claimName: audiobookshelf-audiobooks-nfs-storage
-        - name: books
-          persistentVolumeClaim:
-            claimName: audiobookshelf-books-nfs-storage
-        - name: config
-          persistentVolumeClaim:
-            claimName: audiobookshelf-config
-        - name: metadata
-          persistentVolumeClaim:
-            claimName: audiobookshelf-metadata
-        - name: podcasts
-          persistentVolumeClaim:
-            claimName: audiobookshelf-podcasts-nfs-storage

clusters/cl01tl/manifests/audiobookshelf/ExternalSecret-audiobookshelf-apprise-config.yaml

@@ -1,18 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: audiobookshelf-apprise-config
-  namespace: audiobookshelf
-  labels:
-    app.kubernetes.io/name: audiobookshelf-apprise-config
-    app.kubernetes.io/instance: audiobookshelf
-    app.kubernetes.io/part-of: audiobookshelf
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: ntfy-url
-      remoteRef:
-        key: /cl01tl/audiobookshelf/apprise
-        property: ntfy-url

clusters/cl01tl/manifests/audiobookshelf/ExternalSecret-audiobookshelf-config-backup-secret-external.yaml

@@ -1,58 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: audiobookshelf-config-backup-secret-external
-  namespace: audiobookshelf
-  labels:
-    helm.sh/chart: volsync-target-config-0.8.0
-    app.kubernetes.io/instance: audiobookshelf
-    app.kubernetes.io/part-of: audiobookshelf
-    app.kubernetes.io/version: "0.8.0"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: audiobookshelf-config-backup-secret-external
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/audiobookshelf/audiobookshelf-config"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_ACCESS_KEY_ID
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_SECRET_ACCESS_KEY

clusters/cl01tl/manifests/audiobookshelf/ExternalSecret-audiobookshelf-config-backup-secret-local.yaml

@@ -1,58 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: audiobookshelf-config-backup-secret-local
-  namespace: audiobookshelf
-  labels:
-    helm.sh/chart: volsync-target-config-0.8.0
-    app.kubernetes.io/instance: audiobookshelf
-    app.kubernetes.io/part-of: audiobookshelf
-    app.kubernetes.io/version: "0.8.0"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: audiobookshelf-config-backup-secret-local
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/audiobookshelf/audiobookshelf-config"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
-        property: ACCESS_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
-        property: ACCESS_KEY_ID
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
-        property: ACCESS_SECRET_KEY

clusters/cl01tl/manifests/audiobookshelf/ExternalSecret-audiobookshelf-config-backup-secret-remote.yaml

@@ -1,58 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: audiobookshelf-config-backup-secret-remote
-  namespace: audiobookshelf
-  labels:
-    helm.sh/chart: volsync-target-config-0.8.0
-    app.kubernetes.io/instance: audiobookshelf
-    app.kubernetes.io/part-of: audiobookshelf
-    app.kubernetes.io/version: "0.8.0"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: audiobookshelf-config-backup-secret-remote
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/audiobookshelf/audiobookshelf-config"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
-        property: ACCESS_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
-        property: ACCESS_KEY_ID
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
-        property: ACCESS_SECRET_KEY

clusters/cl01tl/manifests/audiobookshelf/ExternalSecret-audiobookshelf-metadata-backup-secret-external.yaml

@@ -1,58 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: audiobookshelf-metadata-backup-secret-external
-  namespace: audiobookshelf
-  labels:
-    helm.sh/chart: volsync-target-metadata-0.8.0
-    app.kubernetes.io/instance: audiobookshelf
-    app.kubernetes.io/part-of: audiobookshelf
-    app.kubernetes.io/version: "0.8.0"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: audiobookshelf-metadata-backup-secret-external
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/audiobookshelf/audiobookshelf-metadata"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_ACCESS_KEY_ID
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_SECRET_ACCESS_KEY

clusters/cl01tl/manifests/audiobookshelf/ExternalSecret-audiobookshelf-metadata-backup-secret-local.yaml

@@ -1,58 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: audiobookshelf-metadata-backup-secret-local
-  namespace: audiobookshelf
-  labels:
-    helm.sh/chart: volsync-target-metadata-0.8.0
-    app.kubernetes.io/instance: audiobookshelf
-    app.kubernetes.io/part-of: audiobookshelf
-    app.kubernetes.io/version: "0.8.0"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: audiobookshelf-metadata-backup-secret-local
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/audiobookshelf/audiobookshelf-metadata"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
-        property: ACCESS_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
-        property: ACCESS_KEY_ID
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
-        property: ACCESS_SECRET_KEY

clusters/cl01tl/manifests/audiobookshelf/ExternalSecret-audiobookshelf-metadata-backup-secret-remote.yaml

@@ -1,58 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: audiobookshelf-metadata-backup-secret-remote
-  namespace: audiobookshelf
-  labels:
-    helm.sh/chart: volsync-target-metadata-0.8.0
-    app.kubernetes.io/instance: audiobookshelf
-    app.kubernetes.io/part-of: audiobookshelf
-    app.kubernetes.io/version: "0.8.0"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: audiobookshelf-metadata-backup-secret-remote
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/audiobookshelf/audiobookshelf-metadata"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
-        property: ACCESS_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
-        property: ACCESS_KEY_ID
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
-        property: ACCESS_SECRET_KEY

clusters/cl01tl/manifests/audiobookshelf/HTTPRoute-audiobookshelf.yaml

@@ -1,30 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: audiobookshelf
-  labels:
-    app.kubernetes.io/instance: audiobookshelf
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: audiobookshelf
-    helm.sh/chart: audiobookshelf-4.6.2
-  namespace: audiobookshelf
-spec:
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: traefik-gateway
-      namespace: traefik
-  hostnames:
-    - "audiobookshelf.alexlebens.net"
-  rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: audiobookshelf
-          namespace: audiobookshelf
-          port: 80
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

clusters/cl01tl/manifests/audiobookshelf/PersistentVolume-audiobookshelf-audiobooks-nfs-storage.yaml

@@ -1,23 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: audiobookshelf-audiobooks-nfs-storage
-  namespace: audiobookshelf
-  labels:
-    app.kubernetes.io/name: audiobookshelf-audiobooks-nfs-storage
-    app.kubernetes.io/instance: audiobookshelf
-    app.kubernetes.io/part-of: audiobookshelf
-spec:
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: nfs-client
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteMany
-  nfs:
-    path: /volume2/Storage/Audiobooks
-    server: synologybond.alexlebens.net
-  mountOptions:
-    - vers=4
-    - minorversion=1
-    - noac

clusters/cl01tl/manifests/audiobookshelf/PersistentVolume-audiobookshelf-books-nfs-storage.yaml

@@ -1,23 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: audiobookshelf-books-nfs-storage
-  namespace: audiobookshelf
-  labels:
-    app.kubernetes.io/name: audiobookshelf-books-nfs-storage
-    app.kubernetes.io/instance: audiobookshelf
-    app.kubernetes.io/part-of: audiobookshelf
-spec:
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: nfs-client
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteMany
-  nfs:
-    path: /volume2/Storage/Books
-    server: synologybond.alexlebens.net
-  mountOptions:
-    - vers=4
-    - minorversion=1
-    - noac

clusters/cl01tl/manifests/audiobookshelf/PersistentVolume-audiobookshelf-podcasts-nfs-storage.yaml

@@ -1,23 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: audiobookshelf-podcasts-nfs-storage
-  namespace: audiobookshelf
-  labels:
-    app.kubernetes.io/name: audiobookshelf-podcasts-nfs-storage
-    app.kubernetes.io/instance: audiobookshelf
-    app.kubernetes.io/part-of: audiobookshelf
-spec:
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: nfs-client
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteMany
-  nfs:
-    path: /volume2/Storage/Podcasts
-    server: synologybond.alexlebens.net
-  mountOptions:
-    - vers=4
-    - minorversion=1
-    - noac

clusters/cl01tl/manifests/audiobookshelf/PersistentVolumeClaim-audiobookshelf-audiobooks-nfs-storage.yaml

@@ -1,17 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: audiobookshelf-audiobooks-nfs-storage
-  namespace: audiobookshelf
-  labels:
-    app.kubernetes.io/name: audiobookshelf-audiobooks-nfs-storage
-    app.kubernetes.io/instance: audiobookshelf
-    app.kubernetes.io/part-of: audiobookshelf
-spec:
-  volumeName: audiobookshelf-audiobooks-nfs-storage
-  storageClassName: nfs-client
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi

clusters/cl01tl/manifests/audiobookshelf/PersistentVolumeClaim-audiobookshelf-books-nfs-storage.yaml

@@ -1,17 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: audiobookshelf-books-nfs-storage
-  namespace: audiobookshelf
-  labels:
-    app.kubernetes.io/name: audiobookshelf-books-nfs-storage
-    app.kubernetes.io/instance: audiobookshelf
-    app.kubernetes.io/part-of: audiobookshelf
-spec:
-  volumeName: audiobookshelf-books-nfs-storage
-  storageClassName: nfs-client
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi

clusters/cl01tl/manifests/audiobookshelf/PersistentVolumeClaim-audiobookshelf-config.yaml

@@ -1,17 +0,0 @@
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: audiobookshelf-config
-  labels:
-    app.kubernetes.io/instance: audiobookshelf
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: audiobookshelf
-    helm.sh/chart: audiobookshelf-4.6.2
-  namespace: audiobookshelf
-spec:
-  accessModes:
-    - "ReadWriteOnce"
-  resources:
-    requests:
-      storage: "2Gi"
-  storageClassName: "ceph-block"

clusters/cl01tl/manifests/audiobookshelf/PersistentVolumeClaim-audiobookshelf-metadata.yaml

@@ -1,17 +0,0 @@
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: audiobookshelf-metadata
-  labels:
-    app.kubernetes.io/instance: audiobookshelf
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: audiobookshelf
-    helm.sh/chart: audiobookshelf-4.6.2
-  namespace: audiobookshelf
-spec:
-  accessModes:
-    - "ReadWriteOnce"
-  resources:
-    requests:
-      storage: "10Gi"
-  storageClassName: "ceph-block"

clusters/cl01tl/manifests/audiobookshelf/PersistentVolumeClaim-audiobookshelf-podcasts-nfs-storage.yaml

@@ -1,17 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: audiobookshelf-podcasts-nfs-storage
-  namespace: audiobookshelf
-  labels:
-    app.kubernetes.io/name: audiobookshelf-podcasts-nfs-storage
-    app.kubernetes.io/instance: audiobookshelf
-    app.kubernetes.io/part-of: audiobookshelf
-spec:
-  volumeName: audiobookshelf-podcasts-nfs-storage
-  storageClassName: nfs-client
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi

clusters/cl01tl/manifests/audiobookshelf/ReplicationSource-audiobookshelf-config-backup-source-external.yaml

@@ -1,29 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: audiobookshelf-config-backup-source-external
-  namespace: audiobookshelf
-  labels:
-    helm.sh/chart: volsync-target-config-0.8.0
-    app.kubernetes.io/instance: audiobookshelf
-    app.kubernetes.io/part-of: audiobookshelf
-    app.kubernetes.io/version: "0.8.0"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: audiobookshelf-config-backup
-spec:
-  sourcePVC: audiobookshelf-config
-  trigger:
-    schedule: 2 10 * * *
-  restic:
-    pruneIntervalDays: 7
-    repository: audiobookshelf-config-backup-secret-external
-    retain:
-      daily: 7
-      hourly: 0
-      monthly: 3
-      weekly: 4
-      yearly: 1
-    copyMethod: Snapshot
-    storageClassName: ceph-block
-    volumeSnapshotClassName: ceph-blockpool-snapshot
-    cacheCapacity: 1Gi

clusters/cl01tl/manifests/audiobookshelf/ReplicationSource-audiobookshelf-config-backup-source-local.yaml

@@ -1,29 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: audiobookshelf-config-backup-source-local
-  namespace: audiobookshelf
-  labels:
-    helm.sh/chart: volsync-target-config-0.8.0
-    app.kubernetes.io/instance: audiobookshelf
-    app.kubernetes.io/part-of: audiobookshelf
-    app.kubernetes.io/version: "0.8.0"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: audiobookshelf-config-backup
-spec:
-  sourcePVC: audiobookshelf-config
-  trigger:
-    schedule: 2 8 * * *
-  restic:
-    pruneIntervalDays: 7
-    repository: audiobookshelf-config-backup-secret-local
-    retain:
-      daily: 7
-      hourly: 0
-      monthly: 3
-      weekly: 4
-      yearly: 1
-    copyMethod: Snapshot
-    storageClassName: ceph-block
-    volumeSnapshotClassName: ceph-blockpool-snapshot
-    cacheCapacity: 1Gi

clusters/cl01tl/manifests/audiobookshelf/ReplicationSource-audiobookshelf-config-backup-source-remote.yaml

@@ -1,29 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: audiobookshelf-config-backup-source-remote
-  namespace: audiobookshelf
-  labels:
-    helm.sh/chart: volsync-target-config-0.8.0
-    app.kubernetes.io/instance: audiobookshelf
-    app.kubernetes.io/part-of: audiobookshelf
-    app.kubernetes.io/version: "0.8.0"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: audiobookshelf-config-backup
-spec:
-  sourcePVC: audiobookshelf-config
-  trigger:
-    schedule: 2 9 * * *
-  restic:
-    pruneIntervalDays: 7
-    repository: audiobookshelf-config-backup-secret-remote
-    retain:
-      daily: 7
-      hourly: 0
-      monthly: 3
-      weekly: 4
-      yearly: 1
-    copyMethod: Snapshot
-    storageClassName: ceph-block
-    volumeSnapshotClassName: ceph-blockpool-snapshot
-    cacheCapacity: 1Gi

clusters/cl01tl/manifests/audiobookshelf/ReplicationSource-audiobookshelf-metadata-backup-source-external.yaml

@@ -1,29 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: audiobookshelf-metadata-backup-source-external
-  namespace: audiobookshelf
-  labels:
-    helm.sh/chart: volsync-target-metadata-0.8.0
-    app.kubernetes.io/instance: audiobookshelf
-    app.kubernetes.io/part-of: audiobookshelf
-    app.kubernetes.io/version: "0.8.0"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: audiobookshelf-metadata-backup
-spec:
-  sourcePVC: audiobookshelf-metadata
-  trigger:
-    schedule: 4 10 * * *
-  restic:
-    pruneIntervalDays: 7
-    repository: audiobookshelf-metadata-backup-secret-external
-    retain:
-      daily: 7
-      hourly: 0
-      monthly: 3
-      weekly: 4
-      yearly: 1
-    copyMethod: Snapshot
-    storageClassName: ceph-block
-    volumeSnapshotClassName: ceph-blockpool-snapshot
-    cacheCapacity: 1Gi

clusters/cl01tl/manifests/audiobookshelf/ReplicationSource-audiobookshelf-metadata-backup-source-local.yaml

@@ -1,29 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: audiobookshelf-metadata-backup-source-local
-  namespace: audiobookshelf
-  labels:
-    helm.sh/chart: volsync-target-metadata-0.8.0
-    app.kubernetes.io/instance: audiobookshelf
-    app.kubernetes.io/part-of: audiobookshelf
-    app.kubernetes.io/version: "0.8.0"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: audiobookshelf-metadata-backup
-spec:
-  sourcePVC: audiobookshelf-metadata
-  trigger:
-    schedule: 4 8 * * *
-  restic:
-    pruneIntervalDays: 7
-    repository: audiobookshelf-metadata-backup-secret-local
-    retain:
-      daily: 7
-      hourly: 0
-      monthly: 3
-      weekly: 4
-      yearly: 1
-    copyMethod: Snapshot
-    storageClassName: ceph-block
-    volumeSnapshotClassName: ceph-blockpool-snapshot
-    cacheCapacity: 1Gi

clusters/cl01tl/manifests/audiobookshelf/ReplicationSource-audiobookshelf-metadata-backup-source-remote.yaml

@@ -1,29 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: audiobookshelf-metadata-backup-source-remote
-  namespace: audiobookshelf
-  labels:
-    helm.sh/chart: volsync-target-metadata-0.8.0
-    app.kubernetes.io/instance: audiobookshelf
-    app.kubernetes.io/part-of: audiobookshelf
-    app.kubernetes.io/version: "0.8.0"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: audiobookshelf-metadata-backup
-spec:
-  sourcePVC: audiobookshelf-metadata
-  trigger:
-    schedule: 4 9 * * *
-  restic:
-    pruneIntervalDays: 7
-    repository: audiobookshelf-metadata-backup-secret-remote
-    retain:
-      daily: 7
-      hourly: 0
-      monthly: 3
-      weekly: 4
-      yearly: 1
-    copyMethod: Snapshot
-    storageClassName: ceph-block
-    volumeSnapshotClassName: ceph-blockpool-snapshot
-    cacheCapacity: 1Gi

clusters/cl01tl/manifests/audiobookshelf/Service-audiobookshelf.yaml

@@ -1,26 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: audiobookshelf
-  labels:
-    app.kubernetes.io/instance: audiobookshelf
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: audiobookshelf
-    app.kubernetes.io/service: audiobookshelf
-    helm.sh/chart: audiobookshelf-4.6.2
-  namespace: audiobookshelf
-spec:
-  type: ClusterIP
-  ports:
-    - port: 8000
-      targetPort: 8000
-      protocol: TCP
-      name: apprise
-    - port: 80
-      targetPort: 80
-      protocol: TCP
-      name: http
-  selector:
-    app.kubernetes.io/controller: main
-    app.kubernetes.io/instance: audiobookshelf
-    app.kubernetes.io/name: audiobookshelf

clusters/cl01tl/manifests/audiobookshelf/ServiceMonitor-audiobookshelf.yaml

@@ -1,25 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: audiobookshelf
-  labels:
-    app.kubernetes.io/instance: audiobookshelf
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: audiobookshelf
-    helm.sh/chart: audiobookshelf-4.6.2
-  namespace: audiobookshelf
-spec:
-  jobLabel: audiobookshelf
-  namespaceSelector:
-    matchNames:
-      - audiobookshelf
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: audiobookshelf
-      app.kubernetes.io/name: audiobookshelf
-  endpoints:
-    - interval: 30s
-      path: /metrics
-      port: apprise
-      scheme: http
-      scrapeTimeout: 15s

clusters/cl01tl/manifests/authentik/-.yaml

@@ -0,0 +1 @@
+

clusters/cl01tl/manifests/authentik/Cluster-authentik-postgresql-18-cluster.yaml

@@ -1,66 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: authentik-postgresql-18-cluster
-  namespace: authentik
-  labels:
-    app.kubernetes.io/name: authentik-postgresql-18-cluster
-    helm.sh/chart: postgres-18-cluster-7.11.2
-    app.kubernetes.io/instance: authentik
-    app.kubernetes.io/part-of: authentik
-    app.kubernetes.io/version: "7.11.2"
-    app.kubernetes.io/managed-by: Helm
-spec:
-  instances: 3
-  imageName: "ghcr.io/cloudnative-pg/postgresql:18.3-standard-trixie"
-  imagePullPolicy: IfNotPresent
-  postgresUID: 26
-  postgresGID: 26
-  storage:
-    size: 10Gi
-    storageClass: local-path
-  walStorage:
-    size: 2Gi
-    storageClass: local-path
-  resources:
-    limits:
-      hugepages-2Mi: 256Mi
-    requests:
-      cpu: 20m
-      memory: 150Mi
-  affinity:
-    enablePodAntiAffinity: true
-    topologyKey: kubernetes.io/hostname
-  primaryUpdateMethod: switchover
-  primaryUpdateStrategy: unsupervised
-  logLevel: info
-  enableSuperuserAccess: false
-  enablePDB: true
-  postgresql:
-    parameters:
-      hot_standby_feedback: "on"
-      max_slot_wal_keep_size: 2000MB
-      shared_buffers: 128MB
-  monitoring:
-    enablePodMonitor: true
-    disableDefaultQueries: false
-  plugins:
-    - name: barman-cloud.cloudnative-pg.io
-      enabled: true
-      isWALArchiver: true
-      parameters:
-        barmanObjectName: "authentik-postgresql-18-backup-garage-local"
-        serverName: "authentik-postgresql-18-backup-2"
-  bootstrap:
-    recovery:
-      database: app
-      source: authentik-postgresql-18-backup-2
-  externalClusters:
-    - name: authentik-postgresql-18-backup-2
-      plugin:
-        name: barman-cloud.cloudnative-pg.io
-        enabled: true
-        isWALArchiver: false
-        parameters:
-          barmanObjectName: "authentik-postgresql-18-recovery"
-          serverName: authentik-postgresql-18-backup-2

clusters/cl01tl/manifests/authentik/ClusterRole-authentik-authentik.yaml

@@ -1,18 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: "authentik-authentik"
-  labels:
-    helm.sh/chart: "serviceAccount-2.1.0"
-    app.kubernetes.io/name: "serviceAccount"
-    app.kubernetes.io/instance: "authentik"
-    app.kubernetes.io/managed-by: "Helm"
-    app.kubernetes.io/part-of: "authentik"
-    app.kubernetes.io/version: "2.1.0"
-rules:
-  - apiGroups:
-      - apiextensions.k8s.io
-    resources:
-      - customresourcedefinitions
-    verbs:
-      - list

clusters/cl01tl/manifests/authentik/ClusterRoleBinding-authentik-authentik.yaml

@@ -1,19 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: "authentik-authentik"
-  labels:
-    helm.sh/chart: "serviceAccount-2.1.0"
-    app.kubernetes.io/name: "serviceAccount"
-    app.kubernetes.io/instance: "authentik"
-    app.kubernetes.io/managed-by: "Helm"
-    app.kubernetes.io/part-of: "authentik"
-    app.kubernetes.io/version: "2.1.0"
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: "authentik-authentik"
-subjects:
-  - kind: ServiceAccount
-    name: authentik
-    namespace: "authentik"

clusters/cl01tl/manifests/authentik/ConfigMap-authentik-valkey-init-scripts.yaml

@@ -1,87 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: authentik-valkey-init-scripts
-  labels:
-    helm.sh/chart: valkey-0.9.3
-    app.kubernetes.io/name: valkey
-    app.kubernetes.io/instance: authentik
-    app.kubernetes.io/version: "9.0.3"
-    app.kubernetes.io/managed-by: Helm
-data:
-  init.sh: |-
-    #!/bin/sh
-    set -eu
-
-    # Default config paths
-    VALKEY_CONFIG=${VALKEY_CONFIG_PATH:-/data/conf/valkey.conf}
-
-    LOGFILE="/data/init.log"
-    DATA_DIR="/data/conf"
-
-    # Logging function (outputs to stderr and file)
-    log() {
-      echo "$(date) $1" | tee -a "$LOGFILE" >&2
-    }
-
-    # Clean old log if requested
-    if [ "${KEEP_OLD_LOGS:-false}" != "true" ]; then
-      rm -f "$LOGFILE"
-    fi
-
-    if [ -f "$LOGFILE" ]; then
-      log "Detected restart of this instance ($HOSTNAME)"
-    fi
-
-    log "Creating configuration in $DATA_DIR..."
-    mkdir -p "$DATA_DIR"
-    rm -f "$VALKEY_CONFIG"
-
-
-    # Base valkey.conf
-    log "Generating base valkey.conf"
-    {
-      echo "port 6379"
-      echo "protected-mode no"
-      echo "bind * -::*"
-      echo "dir /data"
-    } >>"$VALKEY_CONFIG"
-    # Replica mode configuration
-    log "Configuring replication mode"
-
-    # Use POD_INDEX from Kubernetes metadata
-    POD_INDEX=${POD_INDEX:-0}
-    IS_MASTER=false
-
-    # Check if this is pod-0 (master)
-    if [ "$POD_INDEX" = "0" ]; then
-      IS_MASTER=true
-      log "This pod (index $POD_INDEX) is configured as MASTER"
-    else
-      log "This pod (index $POD_INDEX) is configured as REPLICA"
-    fi
-
-    # Configure replica settings
-    if [ "$IS_MASTER" = "false" ]; then
-      MASTER_HOST="authentik-valkey-0.authentik-valkey-headless.authentik.svc.cluster.local"
-      MASTER_PORT="6379"
-
-      log "Configuring replica to follow master at $MASTER_HOST:$MASTER_PORT"
-
-      {
-        echo ""
-        echo "# Replica Configuration"
-        echo "replicaof $MASTER_HOST $MASTER_PORT"
-        echo "replica-announce-ip authentik-valkey-$POD_INDEX.authentik-valkey-headless.authentik.svc.cluster.local"
-      } >>"$VALKEY_CONFIG"
-    fi
-
-    # Append extra configs if present
-    if [ -f /usr/local/etc/valkey/valkey.conf ]; then
-      log "Appending /usr/local/etc/valkey/valkey.conf"
-      cat /usr/local/etc/valkey/valkey.conf >>"$VALKEY_CONFIG"
-    fi
-    if [ -d /extravalkeyconfigs ]; then
-      log "Appending files in /extravalkeyconfigs/"
-      cat /extravalkeyconfigs/* >>"$VALKEY_CONFIG"
-    fi

clusters/cl01tl/manifests/authentik/Deployment-authentik-cloudflared.yaml

@@ -1,58 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: authentik-cloudflared
-  labels:
-    app.kubernetes.io/controller: main
-    app.kubernetes.io/instance: authentik
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: cloudflared
-    app.kubernetes.io/version: 2026.3.0
-    helm.sh/chart: cloudflared-2.4.0
-  namespace: authentik
-spec:
-  revisionHistoryLimit: 3
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app.kubernetes.io/controller: main
-      app.kubernetes.io/name: cloudflared
-      app.kubernetes.io/instance: authentik
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/controller: main
-        app.kubernetes.io/instance: authentik
-        app.kubernetes.io/name: cloudflared
-    spec:
-      enableServiceLinks: false
-      serviceAccountName: default
-      automountServiceAccountToken: true
-      hostIPC: false
-      hostNetwork: false
-      hostPID: false
-      dnsPolicy: ClusterFirst
-      containers:
-        - args:
-            - tunnel
-            - --protocol
-            - http2
-            - --no-autoupdate
-            - run
-            - --token
-            - $(CF_MANAGED_TUNNEL_TOKEN)
-          env:
-            - name: CF_MANAGED_TUNNEL_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  key: cf-tunnel-token
-                  name: authentik-cloudflared-secret
-          image: cloudflare/cloudflared:2026.3.0
-          imagePullPolicy: IfNotPresent
-          name: main
-          resources:
-            requests:
-              cpu: 10m
-              memory: 128Mi

clusters/cl01tl/manifests/authentik/Deployment-authentik-server.yaml

@@ -1,129 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: authentik-server
-  namespace: "authentik"
-  labels:
-    helm.sh/chart: "authentik-2026.2.1"
-    app.kubernetes.io/name: "authentik"
-    app.kubernetes.io/instance: "authentik"
-    app.kubernetes.io/component: "server"
-    app.kubernetes.io/managed-by: "Helm"
-    app.kubernetes.io/part-of: "authentik"
-    app.kubernetes.io/version: "2026.2.1"
-spec:
-  replicas: 2
-  revisionHistoryLimit: 3
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: "authentik"
-      app.kubernetes.io/instance: "authentik"
-      app.kubernetes.io/component: "server"
-  template:
-    metadata:
-      labels:
-        helm.sh/chart: "authentik-2026.2.1"
-        app.kubernetes.io/name: "authentik"
-        app.kubernetes.io/instance: "authentik"
-        app.kubernetes.io/component: "server"
-        app.kubernetes.io/managed-by: "Helm"
-        app.kubernetes.io/part-of: "authentik"
-        app.kubernetes.io/version: "2026.2.1"
-      annotations:
-        checksum/secret: e52441637b77f4baccf56d0c193e99c35c2eeef6b6c753a17e45254ca6b20e18
-    spec:
-      terminationGracePeriodSeconds: 30
-      containers:
-        - name: server
-          image: ghcr.io/goauthentik/server:2026.2.1
-          imagePullPolicy: IfNotPresent
-          args:
-            - server
-          env:
-            - name: AUTHENTIK_SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  key: key
-                  name: authentik-key-secret
-            - name: AUTHENTIK_POSTGRESQL__HOST
-              valueFrom:
-                secretKeyRef:
-                  key: host
-                  name: authentik-postgresql-18-cluster-app
-            - name: AUTHENTIK_POSTGRESQL__NAME
-              valueFrom:
-                secretKeyRef:
-                  key: dbname
-                  name: authentik-postgresql-18-cluster-app
-            - name: AUTHENTIK_POSTGRESQL__USER
-              valueFrom:
-                secretKeyRef:
-                  key: user
-                  name: authentik-postgresql-18-cluster-app
-            - name: AUTHENTIK_POSTGRESQL__PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  key: password
-                  name: authentik-postgresql-18-cluster-app
-            - name: AUTHENTIK_LISTEN__HTTP
-              value: "0.0.0.0:9000"
-            - name: AUTHENTIK_LISTEN__HTTPS
-              value: "0.0.0.0:9443"
-            - name: AUTHENTIK_LISTEN__METRICS
-              value: "0.0.0.0:9300"
-          envFrom:
-            - secretRef:
-                name: authentik
-          ports:
-            - name: http
-              containerPort: 9000
-              protocol: TCP
-            - name: https
-              containerPort: 9443
-              protocol: TCP
-            - name: metrics
-              containerPort: 9300
-              protocol: TCP
-          livenessProbe:
-            failureThreshold: 3
-            httpGet:
-              path: '/-/health/live/'
-              port: http
-            initialDelaySeconds: 15
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 5
-          readinessProbe:
-            failureThreshold: 3
-            httpGet:
-              path: '/-/health/ready/'
-              port: http
-            initialDelaySeconds: 15
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 5
-          startupProbe:
-            failureThreshold: 60
-            httpGet:
-              path: '/-/health/live/'
-              port: http
-            initialDelaySeconds: 5
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 3
-          resources:
-            requests:
-              cpu: 20m
-              memory: 700Mi
-      affinity:
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-            - weight: 100
-              podAffinityTerm:
-                labelSelector:
-                  matchLabels:
-                    app.kubernetes.io/name: "authentik"
-                    app.kubernetes.io/instance: "authentik"
-                    app.kubernetes.io/component: "server"
-                topologyKey: kubernetes.io/hostname
-      enableServiceLinks: true

clusters/cl01tl/manifests/authentik/Deployment-authentik-worker.yaml

@@ -1,128 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: authentik-worker
-  namespace: "authentik"
-  labels:
-    helm.sh/chart: "authentik-2026.2.1"
-    app.kubernetes.io/name: "authentik"
-    app.kubernetes.io/instance: "authentik"
-    app.kubernetes.io/component: "worker"
-    app.kubernetes.io/managed-by: "Helm"
-    app.kubernetes.io/part-of: "authentik"
-    app.kubernetes.io/version: "2026.2.1"
-spec:
-  replicas: 2
-  revisionHistoryLimit: 3
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: "authentik"
-      app.kubernetes.io/instance: "authentik"
-      app.kubernetes.io/component: "worker"
-  template:
-    metadata:
-      labels:
-        helm.sh/chart: "authentik-2026.2.1"
-        app.kubernetes.io/name: "authentik"
-        app.kubernetes.io/instance: "authentik"
-        app.kubernetes.io/component: "worker"
-        app.kubernetes.io/managed-by: "Helm"
-        app.kubernetes.io/part-of: "authentik"
-        app.kubernetes.io/version: "2026.2.1"
-      annotations:
-        checksum/secret: e52441637b77f4baccf56d0c193e99c35c2eeef6b6c753a17e45254ca6b20e18
-    spec:
-      serviceAccountName: authentik
-      terminationGracePeriodSeconds: 30
-      containers:
-        - name: worker
-          image: ghcr.io/goauthentik/server:2026.2.1
-          imagePullPolicy: IfNotPresent
-          args:
-            - worker
-          env:
-            - name: AUTHENTIK_SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  key: key
-                  name: authentik-key-secret
-            - name: AUTHENTIK_POSTGRESQL__HOST
-              valueFrom:
-                secretKeyRef:
-                  key: host
-                  name: authentik-postgresql-18-cluster-app
-            - name: AUTHENTIK_POSTGRESQL__NAME
-              valueFrom:
-                secretKeyRef:
-                  key: dbname
-                  name: authentik-postgresql-18-cluster-app
-            - name: AUTHENTIK_POSTGRESQL__USER
-              valueFrom:
-                secretKeyRef:
-                  key: user
-                  name: authentik-postgresql-18-cluster-app
-            - name: AUTHENTIK_POSTGRESQL__PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  key: password
-                  name: authentik-postgresql-18-cluster-app
-            - name: AUTHENTIK_LISTEN__HTTP
-              value: "0.0.0.0:9000"
-            - name: AUTHENTIK_LISTEN__METRICS
-              value: "0.0.0.0:9300"
-          envFrom:
-            - secretRef:
-                name: authentik
-          ports:
-            - name: http
-              containerPort: 9000
-              protocol: TCP
-            - name: metrics
-              containerPort: 9300
-              protocol: TCP
-          livenessProbe:
-            exec:
-              command:
-                - ak
-                - healthcheck
-            failureThreshold: 3
-            initialDelaySeconds: 5
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 3
-          readinessProbe:
-            exec:
-              command:
-                - ak
-                - healthcheck
-            failureThreshold: 3
-            initialDelaySeconds: 5
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 3
-          startupProbe:
-            exec:
-              command:
-                - ak
-                - healthcheck
-            failureThreshold: 60
-            initialDelaySeconds: 30
-            periodSeconds: 10
-            successThreshold: 1
-            timeoutSeconds: 3
-          resources:
-            requests:
-              cpu: 80m
-              memory: 650Mi
-      affinity:
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-            - weight: 100
-              podAffinityTerm:
-                labelSelector:
-                  matchLabels:
-                    app.kubernetes.io/name: "authentik"
-                    app.kubernetes.io/instance: "authentik"
-                    app.kubernetes.io/component: "worker"
-                topologyKey: kubernetes.io/hostname
-      enableServiceLinks: true

clusters/cl01tl/manifests/authentik/ExternalSecret-authentik-cloudflared-secret.yaml

@@ -1,24 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: authentik-cloudflared-secret
-  namespace: authentik
-  labels:
-    helm.sh/chart: cloudflared-2.4.0
-    app.kubernetes.io/instance: authentik
-    app.kubernetes.io/part-of: authentik
-    app.kubernetes.io/version: "2.4.0"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: authentik-cloudflared-secret
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: cf-tunnel-token
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /cloudflare/tunnels/authentik
-        metadataPolicy: None
-        property: token

clusters/cl01tl/manifests/authentik/ExternalSecret-authentik-key-secret.yaml

@@ -1,18 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: authentik-key-secret
-  namespace: authentik
-  labels:
-    app.kubernetes.io/name: authentik-key-secret
-    app.kubernetes.io/instance: authentik
-    app.kubernetes.io/part-of: authentik
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: key
-      remoteRef:
-        key: /cl01tl/authentik/key
-        property: key

clusters/cl01tl/manifests/authentik/ExternalSecret-authentik-postgresql-18-backup-garage-local-secret.yaml

@@ -1,38 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: authentik-postgresql-18-backup-garage-local-secret
-  namespace: authentik
-  labels:
-    app.kubernetes.io/name: authentik-postgresql-18-backup-garage-local-secret
-    helm.sh/chart: postgres-18-cluster-7.11.2
-    app.kubernetes.io/instance: authentik
-    app.kubernetes.io/part-of: authentik
-    app.kubernetes.io/version: "7.11.2"
-    app.kubernetes.io/managed-by: Helm
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: ACCESS_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/postgres-backups
-        metadataPolicy: None
-        property: ACCESS_REGION
-    - secretKey: ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/postgres-backups
-        metadataPolicy: None
-        property: ACCESS_KEY_ID
-    - secretKey: ACCESS_SECRET_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/postgres-backups
-        metadataPolicy: None
-        property: ACCESS_SECRET_KEY

clusters/cl01tl/manifests/authentik/ExternalSecret-authentik-postgresql-18-recovery-secret.yaml

@@ -1,38 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: authentik-postgresql-18-recovery-secret
-  namespace: authentik
-  labels:
-    helm.sh/chart: postgres-18-cluster-7.11.2
-    app.kubernetes.io/instance: authentik
-    app.kubernetes.io/part-of: authentik
-    app.kubernetes.io/version: "7.11.2"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: authentik-postgresql-18-recovery-secret
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  data:
-    - secretKey: ACCESS_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/postgres-backups
-        metadataPolicy: None
-        property: ACCESS_REGION
-    - secretKey: ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/postgres-backups
-        metadataPolicy: None
-        property: ACCESS_KEY_ID
-    - secretKey: ACCESS_SECRET_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/postgres-backups
-        metadataPolicy: None
-        property: ACCESS_SECRET_KEY

clusters/cl01tl/manifests/authentik/HTTPRoute-authentik-server.yaml

@@ -1,32 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: authentik-server
-  namespace: "authentik"
-  labels:
-    helm.sh/chart: "authentik-2026.2.1"
-    app.kubernetes.io/name: "authentik"
-    app.kubernetes.io/instance: "authentik"
-    app.kubernetes.io/component: "server"
-    app.kubernetes.io/managed-by: "Helm"
-    app.kubernetes.io/part-of: "authentik"
-    app.kubernetes.io/version: "2026.2.1"
-spec:
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: traefik-gateway
-      namespace: traefik
-  hostnames:
-    - authentik.alexlebens.net
-  rules:
-    - backendRefs:
-        - group: ''
-          kind: Service
-          name: authentik-server
-          port: 80
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: '/'

clusters/cl01tl/manifests/authentik/Ingress-authentik-tailscale.yaml

@@ -1,29 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: authentik-tailscale
-  namespace: authentik
-  labels:
-    app.kubernetes.io/name: authentik-tailscale
-    app.kubernetes.io/instance: authentik
-    app.kubernetes.io/part-of: authentik
-    tailscale.com/proxy-class: no-metrics
-  annotations:
-    tailscale.com/experimental-forward-cluster-traffic-via-ingress: "true"
-spec:
-  ingressClassName: tailscale
-  tls:
-    - hosts:
-        - auth-cl01tl
-      secretName: auth-cl01tl
-  rules:
-    - host: auth-cl01tl
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: authentik-server
-                port:
-                  number: 80

clusters/cl01tl/manifests/authentik/ObjectStore-authentik-postgresql-18-backup-garage-local.yaml

@@ -1,33 +0,0 @@
-apiVersion: barmancloud.cnpg.io/v1
-kind: ObjectStore
-metadata:
-  name: authentik-postgresql-18-backup-garage-local
-  namespace: authentik
-  labels:
-    app.kubernetes.io/name: authentik-postgresql-18-backup-garage-local
-    helm.sh/chart: postgres-18-cluster-7.11.2
-    app.kubernetes.io/instance: authentik
-    app.kubernetes.io/part-of: authentik
-    app.kubernetes.io/version: "7.11.2"
-    app.kubernetes.io/managed-by: Helm
-spec:
-  retentionPolicy: 7d
-  instanceSidecarConfiguration:
-    env:
-      - name: AWS_REQUEST_CHECKSUM_CALCULATION
-        value: when_required
-      - name: AWS_RESPONSE_CHECKSUM_VALIDATION
-        value: when_required
-  configuration:
-    destinationPath: s3://postgres-backups/cl01tl/authentik/authentik-postgresql-18-cluster
-    endpointURL: http://garage-main.garage:3900
-    s3Credentials:
-      accessKeyId:
-        name: authentik-postgresql-18-backup-garage-local-secret
-        key: ACCESS_KEY_ID
-      secretAccessKey:
-        name: authentik-postgresql-18-backup-garage-local-secret
-        key: ACCESS_SECRET_KEY
-      region:
-        name: authentik-postgresql-18-backup-garage-local-secret
-        key: ACCESS_REGION

clusters/cl01tl/manifests/authentik/ObjectStore-authentik-postgresql-18-recovery.yaml

@@ -1,32 +0,0 @@
-apiVersion: barmancloud.cnpg.io/v1
-kind: ObjectStore
-metadata:
-  name: "authentik-postgresql-18-recovery"
-  namespace: authentik
-  labels:
-    helm.sh/chart: postgres-18-cluster-7.11.2
-    app.kubernetes.io/instance: authentik
-    app.kubernetes.io/part-of: authentik
-    app.kubernetes.io/version: "7.11.2"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: "authentik-postgresql-18-recovery"
-spec:
-  configuration:
-    destinationPath: s3://postgres-backups/cl01tl/authentik/authentik-postgresql-18-cluster
-    endpointURL: http://garage-main.garage:3900
-    wal:
-      compression: snappy
-      maxParallel: 1
-    data:
-      compression: snappy
-      jobs: 1
-    s3Credentials:
-      accessKeyId:
-        name: authentik-postgresql-18-recovery-secret
-        key: ACCESS_KEY_ID
-      secretAccessKey:
-        name: authentik-postgresql-18-recovery-secret
-        key: ACCESS_SECRET_KEY
-      region:
-        name: authentik-postgresql-18-recovery-secret
-        key: ACCESS_REGION

clusters/cl01tl/manifests/authentik/PodMonitor-authentik-valkey.yaml

@@ -1,23 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: PodMonitor
-metadata:
-  name: authentik-valkey
-  labels:
-    helm.sh/chart: valkey-0.9.3
-    app.kubernetes.io/name: valkey
-    app.kubernetes.io/instance: authentik
-    app.kubernetes.io/version: "9.0.3"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/part-of: valkey
-    app.kubernetes.io/component: podmonitor
-spec:
-  podMetricsEndpoints:
-    - port: metrics
-      interval: 30s
-  namespaceSelector:
-    matchNames:
-      - authentik
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: valkey
-      app.kubernetes.io/instance: authentik

clusters/cl01tl/manifests/authentik/PrometheusRule-authentik-postgresql-18-alert-rules.yaml

@@ -1,270 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: PrometheusRule
-metadata:
-  name: authentik-postgresql-18-alert-rules
-  namespace: authentik
-  labels:
-    app.kubernetes.io/name: authentik-postgresql-18-alert-rules
-    helm.sh/chart: postgres-18-cluster-7.11.2
-    app.kubernetes.io/instance: authentik
-    app.kubernetes.io/part-of: authentik
-    app.kubernetes.io/version: "7.11.2"
-    app.kubernetes.io/managed-by: Helm
-spec:
-  groups:
-    - name: cloudnative-pg/authentik-postgresql-18
-      rules:
-        - alert: CNPGClusterBackendsWaitingWarning
-          annotations:
-            summary: CNPG Cluster a backend is waiting for longer than 5 minutes.
-            description: |-
-              Pod {{ $labels.pod }}
-              has been waiting for longer than 5 minutes
-          expr: |
-            cnpg_backends_waiting_total{namespace="authentik"} > 300
-          for: 1m
-          labels:
-            severity: warning
-            namespace: authentik
-            cnpg_cluster: authentik-postgresql-18-cluster
-        - alert: CNPGClusterDatabaseDeadlockConflictsWarning
-          annotations:
-            summary: CNPG Cluster has over 10 deadlock conflicts.
-            description: |-
-              There are over 10 deadlock conflicts in
-              {{ $labels.pod }}
-          expr: |
-            cnpg_pg_stat_database_deadlocks{namespace="authentik"} > 10
-          for: 1m
-          labels:
-            severity: warning
-            namespace: authentik
-            cnpg_cluster: authentik-postgresql-18-cluster
-        - alert: CNPGClusterHACritical
-          annotations:
-            summary: CNPG Cluster has no standby replicas!
-            description: |-
-              CloudNativePG Cluster "{{`{{`}} $labels.job {{`}}`}}" has no ready standby replicas. Your cluster at a severe
-              risk of data loss and downtime if the primary instance fails.
-
-              The primary instance is still online and able to serve queries, although connections to the `-ro` endpoint
-              will fail. The `-r` endpoint os operating at reduced capacity and all traffic is being served by the main.
-
-              This can happen during a normal fail-over or automated minor version upgrades in a cluster with 2 or less
-              instances. The replaced instance may need some time to catch-up with the cluster primary instance.
-
-              This alarm will be always trigger if your cluster is configured to run with only 1 instance. In this
-              case you may want to silence it.
-            runbook_url: https://github.com/cloudnative-pg/charts/blob/main/charts/cluster/docs/runbooks/CNPGClusterHACritical.md
-          expr: |
-            max by (job) (cnpg_pg_replication_streaming_replicas{namespace="authentik"} - cnpg_pg_replication_is_wal_receiver_up{namespace="authentik"}) < 1
-          for: 5m
-          labels:
-            severity: critical
-            namespace: authentik
-            cnpg_cluster: authentik-postgresql-18-cluster
-        - alert: CNPGClusterHAWarning
-          annotations:
-            summary: CNPG Cluster less than 2 standby replicas.
-            description: |-
-              CloudNativePG Cluster "{{`{{`}} $labels.job {{`}}`}}" has only {{`{{`}} $value {{`}}`}} standby replicas, putting
-              your cluster at risk if another instance fails. The cluster is still able to operate normally, although
-              the `-ro` and `-r` endpoints operate at reduced capacity.
-
-              This can happen during a normal fail-over or automated minor version upgrades. The replaced instance may
-              need some time to catch-up with the cluster primary instance.
-
-              This alarm will be constantly triggered if your cluster is configured to run with less than 3 instances.
-              In this case you may want to silence it.
-            runbook_url: https://github.com/cloudnative-pg/charts/blob/main/charts/cluster/docs/runbooks/CNPGClusterHAWarning.md
-          expr: |
-            max by (job) (cnpg_pg_replication_streaming_replicas{namespace="authentik"} - cnpg_pg_replication_is_wal_receiver_up{namespace="authentik"}) < 2
-          for: 5m
-          labels:
-            severity: warning
-            namespace: authentik
-            cnpg_cluster: authentik-postgresql-18-cluster
-        - alert: CNPGClusterHighConnectionsCritical
-          annotations:
-            summary: CNPG Instance maximum number of connections critical!
-            description: |-
-              CloudNativePG Cluster "authentik/authentik-postgresql-18-cluster" instance {{`{{`}} $labels.pod {{`}}`}} is using {{`{{`}} $value {{`}}`}}% of
-              the maximum number of connections.
-            runbook_url: https://github.com/cloudnative-pg/charts/blob/main/charts/cluster/docs/runbooks/CNPGClusterHighConnectionsCritical.md
-          expr: |
-            sum by (pod) (cnpg_backends_total{namespace="authentik", pod=~"authentik-postgresql-18-cluster-([1-9][0-9]*)$"}) / max by (pod) (cnpg_pg_settings_setting{name="max_connections", namespace="authentik", pod=~"authentik-postgresql-18-cluster-([1-9][0-9]*)$"}) * 100 > 95
-          for: 5m
-          labels:
-            severity: critical
-            namespace: authentik
-            cnpg_cluster: authentik-postgresql-18-cluster
-        - alert: CNPGClusterHighConnectionsWarning
-          annotations:
-            summary: CNPG Instance is approaching the maximum number of connections.
-            description: |-
-              CloudNativePG Cluster "authentik/authentik-postgresql-18-cluster" instance {{`{{`}} $labels.pod {{`}}`}} is using {{`{{`}} $value {{`}}`}}% of
-              the maximum number of connections.
-            runbook_url: https://github.com/cloudnative-pg/charts/blob/main/charts/cluster/docs/runbooks/CNPGClusterHighConnectionsWarning.md
-          expr: |
-            sum by (pod) (cnpg_backends_total{namespace="authentik", pod=~"authentik-postgresql-18-cluster-([1-9][0-9]*)$"}) / max by (pod) (cnpg_pg_settings_setting{name="max_connections", namespace="authentik", pod=~"authentik-postgresql-18-cluster-([1-9][0-9]*)$"}) * 100 > 80
-          for: 5m
-          labels:
-            severity: warning
-            namespace: authentik
-            cnpg_cluster: authentik-postgresql-18-cluster
-        - alert: CNPGClusterHighReplicationLag
-          annotations:
-            summary: CNPG Cluster high replication lag
-            description: |-
-              CloudNativePG Cluster "authentik/authentik-postgresql-18-cluster" is experiencing a high replication lag of
-              {{`{{`}} $value {{`}}`}}ms.
-
-              High replication lag indicates network issues, busy instances, slow queries or suboptimal configuration.
-            runbook_url: https://github.com/cloudnative-pg/charts/blob/main/charts/cluster/docs/runbooks/CNPGClusterHighReplicationLag.md
-          expr: |
-            max(cnpg_pg_replication_lag{namespace="authentik",pod=~"authentik-postgresql-18-cluster-([1-9][0-9]*)$"}) * 1000 > 1000
-          for: 5m
-          labels:
-            severity: warning
-            namespace: authentik
-            cnpg_cluster: authentik-postgresql-18-cluster
-        - alert: CNPGClusterInstancesOnSameNode
-          annotations:
-            summary: CNPG Cluster instances are located on the same node.
-            description: |-
-              CloudNativePG Cluster "authentik/authentik-postgresql-18-cluster" has {{`{{`}} $value {{`}}`}}
-              instances on the same node {{`{{`}} $labels.node {{`}}`}}.
-
-              A failure or scheduled downtime of a single node will lead to a potential service disruption and/or data loss.
-            runbook_url: https://github.com/cloudnative-pg/charts/blob/main/charts/cluster/docs/runbooks/CNPGClusterInstancesOnSameNode.md
-          expr: |
-            count by (node) (kube_pod_info{namespace="authentik", pod=~"authentik-postgresql-18-cluster-([1-9][0-9]*)$"}) > 1
-          for: 5m
-          labels:
-            severity: warning
-            namespace: authentik
-            cnpg_cluster: authentik-postgresql-18-cluster
-        - alert: CNPGClusterLongRunningTransactionWarning
-          annotations:
-            summary: CNPG Cluster query is taking longer than 5 minutes.
-            description: |-
-              CloudNativePG Cluster Pod {{ $labels.pod }}
-              is taking more than 5 minutes (300 seconds) for a query.
-          expr: |-
-            cnpg_backends_max_tx_duration_seconds{namespace="authentik"} > 300
-          for: 1m
-          labels:
-            severity: warning
-            namespace: authentik
-            cnpg_cluster: authentik-postgresql-18-cluster
-        - alert: CNPGClusterLowDiskSpaceCritical
-          annotations:
-            summary: CNPG Instance is running out of disk space!
-            description: |-
-              CloudNativePG Cluster "authentik/authentik-postgresql-18-cluster" is running extremely low on disk space. Check attached PVCs!
-            runbook_url: https://github.com/cloudnative-pg/charts/blob/main/charts/cluster/docs/runbooks/CNPGClusterLowDiskSpaceCritical.md
-          expr: |
-            max(max by(persistentvolumeclaim) (1 - kubelet_volume_stats_available_bytes{namespace="authentik", persistentvolumeclaim=~"authentik-postgresql-18-cluster-([1-9][0-9]*)$"} / kubelet_volume_stats_capacity_bytes{namespace="authentik", persistentvolumeclaim=~"authentik-postgresql-18-cluster-([1-9][0-9]*)$"})) > 0.9 OR
-            max(max by(persistentvolumeclaim) (1 - kubelet_volume_stats_available_bytes{namespace="authentik", persistentvolumeclaim=~"authentik-postgresql-18-cluster-([1-9][0-9]*)$-wal"} / kubelet_volume_stats_capacity_bytes{namespace="authentik", persistentvolumeclaim=~"authentik-postgresql-18-cluster-([1-9][0-9]*)$-wal"})) > 0.9 OR
-            max(sum by (namespace,persistentvolumeclaim) (kubelet_volume_stats_used_bytes{namespace="authentik", persistentvolumeclaim=~"authentik-postgresql-18-cluster-([1-9][0-9]*)$-tbs.*"})
-                /
-                sum by (namespace,persistentvolumeclaim) (kubelet_volume_stats_capacity_bytes{namespace="authentik", persistentvolumeclaim=~"authentik-postgresql-18-cluster-([1-9][0-9]*)$-tbs.*"})
-                *
-                on(namespace, persistentvolumeclaim) group_left(volume)
-                kube_pod_spec_volumes_persistentvolumeclaims_info{pod=~"authentik-postgresql-18-cluster-([1-9][0-9]*)$"}
-            ) > 0.9
-          for: 5m
-          labels:
-            severity: critical
-            namespace: authentik
-            cnpg_cluster: authentik-postgresql-18-cluster
-        - alert: CNPGClusterLowDiskSpaceWarning
-          annotations:
-            summary: CNPG Instance is running out of disk space.
-            description: |-
-              CloudNativePG Cluster "authentik/authentik-postgresql-18-cluster" is running low on disk space. Check attached PVCs.
-            runbook_url: https://github.com/cloudnative-pg/charts/blob/main/charts/cluster/docs/runbooks/CNPGClusterLowDiskSpaceWarning.md
-          expr: |
-            max(max by(persistentvolumeclaim) (1 - kubelet_volume_stats_available_bytes{namespace="authentik", persistentvolumeclaim=~"authentik-postgresql-18-cluster-([1-9][0-9]*)$"} / kubelet_volume_stats_capacity_bytes{namespace="authentik", persistentvolumeclaim=~"authentik-postgresql-18-cluster-([1-9][0-9]*)$"})) > 0.7 OR
-            max(max by(persistentvolumeclaim) (1 - kubelet_volume_stats_available_bytes{namespace="authentik", persistentvolumeclaim=~"authentik-postgresql-18-cluster-([1-9][0-9]*)$-wal"} / kubelet_volume_stats_capacity_bytes{namespace="authentik", persistentvolumeclaim=~"authentik-postgresql-18-cluster-([1-9][0-9]*)$-wal"})) > 0.7 OR
-            max(sum by (namespace,persistentvolumeclaim) (kubelet_volume_stats_used_bytes{namespace="authentik", persistentvolumeclaim=~"authentik-postgresql-18-cluster-([1-9][0-9]*)$-tbs.*"})
-                /
-                sum by (namespace,persistentvolumeclaim) (kubelet_volume_stats_capacity_bytes{namespace="authentik", persistentvolumeclaim=~"authentik-postgresql-18-cluster-([1-9][0-9]*)$-tbs.*"})
-                *
-                on(namespace, persistentvolumeclaim) group_left(volume)
-                kube_pod_spec_volumes_persistentvolumeclaims_info{pod=~"authentik-postgresql-18-cluster-([1-9][0-9]*)$"}
-            ) > 0.7
-          for: 5m
-          labels:
-            severity: warning
-            namespace: authentik
-            cnpg_cluster: authentik-postgresql-18-cluster
-        - alert: CNPGClusterOffline
-          annotations:
-            summary: CNPG Cluster has no running instances!
-            description: |-
-              CloudNativePG Cluster "authentik/authentik-postgresql-18-cluster" has no ready instances.
-
-              Having an offline cluster means your applications will not be able to access the database, leading to
-              potential service disruption and/or data loss.
-            runbook_url: https://github.com/cloudnative-pg/charts/blob/main/charts/cluster/docs/runbooks/CNPGClusterOffline.md
-          expr: |
-            (count(cnpg_collector_up{namespace="authentik",pod=~"authentik-postgresql-18-cluster-([1-9][0-9]*)$"}) OR on() vector(0)) == 0
-          for: 5m
-          labels:
-            severity: critical
-            namespace: authentik
-            cnpg_cluster: authentik-postgresql-18-cluster
-        - alert: CNPGClusterPGDatabaseXidAgeWarning
-          annotations:
-            summary: CNPG Cluster has a number of transactions from the frozen XID to the current one.
-            description: |-
-              Over 300,000,000 transactions from frozen xid
-              on pod {{ $labels.pod }}
-          expr: |
-            cnpg_pg_database_xid_age{namespace="authentik"} > 300000000
-          for: 1m
-          labels:
-            severity: warning
-            namespace: authentik
-            cnpg_cluster: authentik-postgresql-18-cluster
-        - alert: CNPGClusterPGReplicationWarning
-          annotations:
-            summary: CNPG Cluster standby is lagging behind the primary.
-            description: |-
-              Standby is lagging behind by over 300 seconds (5 minutes)
-          expr: |
-            cnpg_pg_replication_lag{namespace="authentik"} > 300
-          for: 1m
-          labels:
-            severity: warning
-            namespace: authentik
-            cnpg_cluster: authentik-postgresql-18-cluster
-        - alert: CNPGClusterReplicaFailingReplicationWarning
-          annotations:
-            summary: CNPG Cluster has a replica is failing to replicate.
-            description: |-
-              Replica {{ $labels.pod }}
-              is failing to replicate
-          expr: |
-            cnpg_pg_replication_in_recovery{namespace="authentik"} > cnpg_pg_replication_is_wal_receiver_up{namespace="authentik"}
-          for: 1m
-          labels:
-            severity: warning
-            namespace: authentik
-            cnpg_cluster: authentik-postgresql-18-cluster
-        - alert: CNPGClusterZoneSpreadWarning
-          annotations:
-            summary: CNPG Cluster instances in the same zone.
-            description: |-
-              CloudNativePG Cluster "authentik/authentik-postgresql-18-cluster" has instances in the same availability zone.
-
-              A disaster in one availability zone will lead to a potential service disruption and/or data loss.
-            runbook_url: https://github.com/cloudnative-pg/charts/blob/main/charts/cluster/docs/runbooks/CNPGClusterZoneSpreadWarning.md
-          expr: |
-            3 > count(count by (label_topology_kubernetes_io_zone) (kube_pod_info{namespace="authentik", pod=~"authentik-postgresql-18-cluster-([1-9][0-9]*)$"} * on(node,instance) group_left(label_topology_kubernetes_io_zone) kube_node_labels)) < 3
-          for: 5m
-          labels:
-            severity: warning
-            namespace: authentik
-            cnpg_cluster: authentik-postgresql-18-cluster

clusters/cl01tl/manifests/authentik/PrometheusRule-authentik-valkey.yaml

@@ -1,47 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: PrometheusRule
-metadata:
-  name: authentik-valkey
-  labels:
-    helm.sh/chart: valkey-0.9.3
-    app.kubernetes.io/name: valkey
-    app.kubernetes.io/instance: authentik
-    app.kubernetes.io/version: "9.0.3"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/part-of: valkey
-spec:
-  groups:
-    - name: authentik-valkey
-      rules:
-        - alert: ValkeyDown
-          annotations:
-            description: Valkey instance {{ $labels.instance }} is down.
-            summary: Valkey instance {{ $labels.instance }} down
-          expr: |
-            redis_up{service="authentik-valkey-metrics"} == 0
-          for: 2m
-          labels:
-            severity: error
-        - alert: ValkeyMemoryHigh
-          annotations:
-            description: |
-              Valkey instance {{ $labels.instance }} is using {{ $value }}% of its available memory.
-            summary: Valkey instance {{ $labels.instance }} is using too much memory
-          expr: |
-            redis_memory_used_bytes{service="authentik-valkey-metrics"} * 100
-            /
-            redis_memory_max_bytes{service="authentik-valkey-metrics"}
-            > 90 <= 100
-          for: 2m
-          labels:
-            severity: error
-        - alert: ValkeyKeyEviction
-          annotations:
-            description: |
-              Valkey instance {{ $labels.instance }} has evicted {{ $value }} keys in the last 5 minutes.
-            summary: Valkey instance {{ $labels.instance }} has evicted keys
-          expr: |
-            increase(redis_evicted_keys_total{service="authentik-valkey-metrics"}[5m]) > 0
-          for: 1s
-          labels:
-            severity: error

clusters/cl01tl/manifests/authentik/PrometheusRule-authentik.yaml

@@ -1,148 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: PrometheusRule
-metadata:
-  name: authentik
-  namespace: "authentik"
-  labels:
-    helm.sh/chart: "authentik-2026.2.1"
-    app.kubernetes.io/name: "authentik"
-    app.kubernetes.io/instance: "authentik"
-    app.kubernetes.io/managed-by: "Helm"
-    app.kubernetes.io/part-of: "authentik"
-    app.kubernetes.io/version: "2026.2.1"
-spec:
-  groups:
-    - name: authentik Aggregate request counters
-      rules:
-        - record: job:django_http_requests_before_middlewares_total:sum_rate30s
-          expr: sum(rate(django_http_requests_before_middlewares_total[30s])) by (job)
-        - record: job:django_http_requests_unknown_latency_total:sum_rate30s
-          expr: sum(rate(django_http_requests_unknown_latency_total[30s])) by (job)
-        - record: job:django_http_ajax_requests_total:sum_rate30s
-          expr: sum(rate(django_http_ajax_requests_total[30s])) by (job)
-        - record: job:django_http_responses_before_middlewares_total:sum_rate30s
-          expr: sum(rate(django_http_responses_before_middlewares_total[30s])) by (job)
-        - record: job:django_http_requests_unknown_latency_including_middlewares_total:sum_rate30s
-          expr: sum(rate(django_http_requests_unknown_latency_including_middlewares_total[30s])) by (job)
-        - record: job:django_http_requests_body_total_bytes:sum_rate30s
-          expr: sum(rate(django_http_requests_body_total_bytes[30s])) by (job)
-        - record: job:django_http_responses_streaming_total:sum_rate30s
-          expr: sum(rate(django_http_responses_streaming_total[30s])) by (job)
-        - record: job:django_http_responses_body_total_bytes:sum_rate30s
-          expr: sum(rate(django_http_responses_body_total_bytes[30s])) by (job)
-        - record: job:django_http_requests_total:sum_rate30s
-          expr: sum(rate(django_http_requests_total_by_method[30s])) by (job)
-        - record: job:django_http_requests_total_by_method:sum_rate30s
-          expr: sum(rate(django_http_requests_total_by_method[30s])) by (job,method)
-        - record: job:django_http_requests_total_by_transport:sum_rate30s
-          expr: sum(rate(django_http_requests_total_by_transport[30s])) by (job,transport)
-        - record: job:django_http_requests_total_by_view:sum_rate30s
-          expr: sum(rate(django_http_requests_total_by_view_transport_method[30s])) by (job,view)
-        - record: job:django_http_requests_total_by_view_transport_method:sum_rate30s
-          expr: sum(rate(django_http_requests_total_by_view_transport_method[30s])) by (job,view,transport,method)
-        - record: job:django_http_responses_total_by_templatename:sum_rate30s
-          expr: sum(rate(django_http_responses_total_by_templatename[30s])) by (job,templatename)
-        - record: job:django_http_responses_total_by_status:sum_rate30s
-          expr: sum(rate(django_http_responses_total_by_status[30s])) by (job,status)
-        - record: job:django_http_responses_total_by_status_name_method:sum_rate30s
-          expr: sum(rate(django_http_responses_total_by_status_name_method[30s])) by (job,status,name,method)
-        - record: job:django_http_responses_total_by_charset:sum_rate30s
-          expr: sum(rate(django_http_responses_total_by_charset[30s])) by (job,charset)
-        - record: job:django_http_exceptions_total_by_type:sum_rate30s
-          expr: sum(rate(django_http_exceptions_total_by_type[30s])) by (job,type)
-        - record: job:django_http_exceptions_total_by_view:sum_rate30s
-          expr: sum(rate(django_http_exceptions_total_by_view[30s])) by (job,view)
-    - name: authentik Aggregate latency histograms
-      rules:
-        - record: job:django_http_requests_latency_including_middlewares_seconds:quantile_rate30s
-          expr: histogram_quantile(0.50, sum(rate(django_http_requests_latency_including_middlewares_seconds_bucket[30s])) by (job, le))
-          labels:
-            quantile: "50"
-        - record: job:django_http_requests_latency_including_middlewares_seconds:quantile_rate30s
-          expr: histogram_quantile(0.95, sum(rate(django_http_requests_latency_including_middlewares_seconds_bucket[30s])) by (job, le))
-          labels:
-            quantile: "95"
-        - record: job:django_http_requests_latency_including_middlewares_seconds:quantile_rate30s
-          expr: histogram_quantile(0.99, sum(rate(django_http_requests_latency_including_middlewares_seconds_bucket[30s])) by (job, le))
-          labels:
-            quantile: "99"
-        - record: job:django_http_requests_latency_including_middlewares_seconds:quantile_rate30s
-          expr: histogram_quantile(0.999, sum(rate(django_http_requests_latency_including_middlewares_seconds_bucket[30s])) by (job, le))
-          labels:
-            quantile: "99.9"
-        - record: job:django_http_requests_latency_seconds:quantile_rate30s
-          expr: histogram_quantile(0.50, sum(rate(django_http_requests_latency_seconds_bucket[30s])) by (job, le))
-          labels:
-            quantile: "50"
-        - record: job:django_http_requests_latency_seconds:quantile_rate30s
-          expr: histogram_quantile(0.95, sum(rate(django_http_requests_latency_seconds_bucket[30s])) by (job, le))
-          labels:
-            quantile: "95"
-        - record: job:django_http_requests_latency_seconds:quantile_rate30s
-          expr: histogram_quantile(0.99, sum(rate(django_http_requests_latency_seconds_bucket[30s])) by (job, le))
-          labels:
-            quantile: "99"
-        - record: job:django_http_requests_latency_seconds:quantile_rate30s
-          expr: histogram_quantile(0.999, sum(rate(django_http_requests_latency_seconds_bucket[30s])) by (job, le))
-          labels:
-            quantile: "99.9"
-    - name: authentik Aggregate model operations
-      rules:
-        - record: job:django_model_inserts_total:sum_rate1m
-          expr: sum(rate(django_model_inserts_total[1m])) by (job, model)
-        - record: job:django_model_updates_total:sum_rate1m
-          expr: sum(rate(django_model_updates_total[1m])) by (job, model)
-        - record: job:django_model_deletes_total:sum_rate1m
-          expr: sum(rate(django_model_deletes_total[1m])) by (job, model)
-    - name: authentik Aggregate database operations
-      rules:
-        - record: job:django_db_new_connections_total:sum_rate30s
-          expr: sum(rate(django_db_new_connections_total[30s])) by (alias, vendor)
-        - record: job:django_db_new_connection_errors_total:sum_rate30s
-          expr: sum(rate(django_db_new_connection_errors_total[30s])) by (alias, vendor)
-        - record: job:django_db_execute_total:sum_rate30s
-          expr: sum(rate(django_db_execute_total[30s])) by (alias, vendor)
-        - record: job:django_db_execute_many_total:sum_rate30s
-          expr: sum(rate(django_db_execute_many_total[30s])) by (alias, vendor)
-        - record: job:django_db_errors_total:sum_rate30s
-          expr: sum(rate(django_db_errors_total[30s])) by (alias, vendor, type)
-    - name: authentik Aggregate migrations
-      rules:
-        - record: job:django_migrations_applied_total:max
-          expr: max(django_migrations_applied_total) by (job, connection)
-        - record: job:django_migrations_unapplied_total:max
-          expr: max(django_migrations_unapplied_total) by (job, connection)
-    - name: authentik Alerts
-      rules:
-        - alert: NoWorkersConnected
-          labels:
-            severity: critical
-          expr: max (authentik_tasks_workers) < 1
-          for: 10m
-          annotations:
-            summary: No workers connected
-            message: authentik instance {{ $labels.instance }}'s worker are either not running or not connected.
-        - alert: PendingMigrations
-          labels:
-            severity: critical
-          expr: max without (pid) (django_migrations_unapplied_total) > 0
-          for: 10m
-          annotations:
-            summary: Pending database migrations
-            message: authentik instance {{ $labels.instance }} has pending database migrations
-        - alert: FailedSystemTasks
-          labels:
-            severity: critical
-          expr: sum(increase(authentik_tasks_errors_total[2h])) by (actor_name) > 0
-          for: 2h
-          annotations:
-            summary: Failed system tasks
-            message: System task {{ $labels.actor_name }} has failed on authentik instance {{ $labels.instance }}
-        - alert: DisconnectedOutposts
-          labels:
-            severity: critical
-          expr: sum by (outpost) (max without (pid) (authentik_outposts_connected{uid!~"specific.*"}))  < 1
-          for: 30m
-          annotations:
-            summary: Disconnected outpost
-            message: Outpost {{ $labels.outpost }} has at least 1 disconnected instance

clusters/cl01tl/manifests/authentik/ReferenceGrant-allow-outpost-cross-namespace-access.yaml

@@ -1,39 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1beta1
-kind: ReferenceGrant
-metadata:
-  name: allow-outpost-cross-namespace-access
-  namespace: authentik
-  labels:
-    app.kubernetes.io/name: allow-outpost-cross-namespace-access
-    app.kubernetes.io/instance: authentik
-    app.kubernetes.io/part-of: authentik
-spec:
-  from:
-    - group: gateway.networking.k8s.io
-      kind: HTTPRoute
-      namespace: lidarr
-    - group: gateway.networking.k8s.io
-      kind: HTTPRoute
-      namespace: radarr
-    - group: gateway.networking.k8s.io
-      kind: HTTPRoute
-      namespace: radarr-4k
-    - group: gateway.networking.k8s.io
-      kind: HTTPRoute
-      namespace: radarr-anime
-    - group: gateway.networking.k8s.io
-      kind: HTTPRoute
-      namespace: radarr-standup
-    - group: gateway.networking.k8s.io
-      kind: HTTPRoute
-      namespace: sonarr
-    - group: gateway.networking.k8s.io
-      kind: HTTPRoute
-      namespace: sonarr-4k
-    - group: gateway.networking.k8s.io
-      kind: HTTPRoute
-      namespace: sonarr-anime
-  to:
-    - group: ""
-      kind: Service
-      name: ak-outpost-traefik-proxy-auth

clusters/cl01tl/manifests/authentik/Role-authentik.yaml

@@ -1,84 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: authentik
-  namespace: "authentik"
-  labels:
-    helm.sh/chart: "serviceAccount-2.1.0"
-    app.kubernetes.io/name: "serviceAccount"
-    app.kubernetes.io/instance: "authentik"
-    app.kubernetes.io/managed-by: "Helm"
-    app.kubernetes.io/part-of: "authentik"
-    app.kubernetes.io/version: "2.1.0"
-rules:
-  - apiGroups:
-      - ""
-    resources:
-      - secrets
-      - services
-      - configmaps
-    verbs:
-      - get
-      - create
-      - delete
-      - list
-      - patch
-  - apiGroups:
-      - extensions
-      - apps
-    resources:
-      - deployments
-    verbs:
-      - get
-      - create
-      - delete
-      - list
-      - patch
-  - apiGroups:
-      - extensions
-      - networking.k8s.io
-    resources:
-      - ingresses
-    verbs:
-      - get
-      - create
-      - delete
-      - list
-      - patch
-  - apiGroups:
-      - traefik.containo.us
-      - traefik.io
-    resources:
-      - middlewares
-    verbs:
-      - get
-      - create
-      - delete
-      - list
-      - patch
-  - apiGroups:
-      - gateway.networking.k8s.io
-    resources:
-      - httproutes
-    verbs:
-      - get
-      - create
-      - delete
-      - list
-      - patch
-  - apiGroups:
-      - monitoring.coreos.com
-    resources:
-      - servicemonitors
-    verbs:
-      - get
-      - create
-      - delete
-      - list
-      - patch
-  - apiGroups:
-      - apiextensions.k8s.io
-    resources:
-      - customresourcedefinitions
-    verbs:
-      - list

clusters/cl01tl/manifests/authentik/RoleBinding-authentik.yaml

@@ -1,20 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: authentik
-  namespace: "authentik"
-  labels:
-    helm.sh/chart: "serviceAccount-2.1.0"
-    app.kubernetes.io/name: "serviceAccount"
-    app.kubernetes.io/instance: "authentik"
-    app.kubernetes.io/managed-by: "Helm"
-    app.kubernetes.io/part-of: "authentik"
-    app.kubernetes.io/version: "2.1.0"
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: authentik
-subjects:
-  - kind: ServiceAccount
-    name: authentik
-    namespace: "authentik"

clusters/cl01tl/manifests/authentik/ScheduledBackup-authentik-postgresql-18-scheduled-backup-live-backup.yaml

@@ -1,24 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: ScheduledBackup
-metadata:
-  name: "authentik-postgresql-18-scheduled-backup-live-backup"
-  namespace: authentik
-  labels:
-    app.kubernetes.io/name: "authentik-postgresql-18-scheduled-backup-live-backup"
-    helm.sh/chart: postgres-18-cluster-7.11.2
-    app.kubernetes.io/instance: authentik
-    app.kubernetes.io/part-of: authentik
-    app.kubernetes.io/version: "7.11.2"
-    app.kubernetes.io/managed-by: Helm
-spec:
-  immediate: true
-  suspend: false
-  schedule: "0 5 14 * * *"
-  backupOwnerReference: self
-  cluster:
-    name: authentik-postgresql-18-cluster
-  method: plugin
-  pluginConfiguration:
-    name: barman-cloud.cloudnative-pg.io
-    parameters:
-      barmanObjectName: "authentik-postgresql-18-backup-garage-local"

clusters/cl01tl/manifests/authentik/Secret-authentik.yaml

@@ -1,31 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: authentik
-  namespace: "authentik"
-  labels:
-    helm.sh/chart: "authentik-2026.2.1"
-    app.kubernetes.io/name: "authentik"
-    app.kubernetes.io/instance: "authentik"
-    app.kubernetes.io/managed-by: "Helm"
-    app.kubernetes.io/part-of: "authentik"
-    app.kubernetes.io/version: "2026.2.1"
-data:
-  AUTHENTIK_EMAIL__PORT: "NTg3"
-  AUTHENTIK_EMAIL__TIMEOUT: "MzA="
-  AUTHENTIK_EMAIL__USE_SSL: "ZmFsc2U="
-  AUTHENTIK_EMAIL__USE_TLS: "ZmFsc2U="
-  AUTHENTIK_ENABLED: "dHJ1ZQ=="
-  AUTHENTIK_ERROR_REPORTING__ENABLED: "ZmFsc2U="
-  AUTHENTIK_ERROR_REPORTING__ENVIRONMENT: "azhz"
-  AUTHENTIK_ERROR_REPORTING__SEND_PII: "ZmFsc2U="
-  AUTHENTIK_EVENTS__CONTEXT_PROCESSORS__ASN: "L2dlb2lwL0dlb0xpdGUyLUFTTi5tbWRi"
-  AUTHENTIK_EVENTS__CONTEXT_PROCESSORS__GEOIP: "L2dlb2lwL0dlb0xpdGUyLUNpdHkubW1kYg=="
-  AUTHENTIK_LOG_LEVEL: "aW5mbw=="
-  AUTHENTIK_OUTPOSTS__CONTAINER_IMAGE_BASE: "Z2hjci5pby9nb2F1dGhlbnRpay8lKHR5cGUpczolKHZlcnNpb24pcw=="
-  AUTHENTIK_POSTGRESQL__HOST: "YXV0aGVudGlrLXBvc3RncmVzcWw="
-  AUTHENTIK_POSTGRESQL__NAME: "YXV0aGVudGlr"
-  AUTHENTIK_POSTGRESQL__PORT: "NTQzMg=="
-  AUTHENTIK_POSTGRESQL__USER: "YXV0aGVudGlr"
-  AUTHENTIK_REDIS__HOST: "YXV0aGVudGlrLXZhbGtleQ=="
-  AUTHENTIK_WEB__PATH: "Lw=="

clusters/cl01tl/manifests/authentik/Service-authentik-server-metrics.yaml

@@ -1,24 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: authentik-server-metrics
-  namespace: "authentik"
-  labels:
-    helm.sh/chart: "authentik-2026.2.1"
-    app.kubernetes.io/name: "authentik"
-    app.kubernetes.io/instance: "authentik"
-    app.kubernetes.io/component: "server-metrics"
-    app.kubernetes.io/managed-by: "Helm"
-    app.kubernetes.io/part-of: "authentik"
-    app.kubernetes.io/version: "2026.2.1"
-spec:
-  type: ClusterIP
-  ports:
-    - name: metrics
-      protocol: TCP
-      port: 9300
-      targetPort: metrics
-  selector:
-    app.kubernetes.io/name: "authentik"
-    app.kubernetes.io/instance: "authentik"
-    app.kubernetes.io/component: "server"

clusters/cl01tl/manifests/authentik/Service-authentik-server.yaml

@@ -1,28 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: authentik-server
-  namespace: "authentik"
-  labels:
-    helm.sh/chart: "authentik-2026.2.1"
-    app.kubernetes.io/name: "authentik"
-    app.kubernetes.io/instance: "authentik"
-    app.kubernetes.io/component: "server"
-    app.kubernetes.io/managed-by: "Helm"
-    app.kubernetes.io/part-of: "authentik"
-    app.kubernetes.io/version: "2026.2.1"
-spec:
-  type: ClusterIP
-  ports:
-    - name: http
-      protocol: TCP
-      port: 80
-      targetPort: 9000
-    - name: https
-      protocol: TCP
-      port: 443
-      targetPort: 9443
-  selector:
-    app.kubernetes.io/name: "authentik"
-    app.kubernetes.io/instance: "authentik"
-    app.kubernetes.io/component: "server"

clusters/cl01tl/manifests/authentik/Service-authentik-valkey-headless.yaml

@@ -1,23 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: authentik-valkey-headless
-  labels:
-    helm.sh/chart: valkey-0.9.3
-    app.kubernetes.io/name: valkey
-    app.kubernetes.io/instance: authentik
-    app.kubernetes.io/version: "9.0.3"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: headless
-spec:
-  type: ClusterIP
-  clusterIP: None
-  publishNotReadyAddresses: true
-  ports:
-    - name: tcp
-      port: 6379
-      targetPort: tcp
-      protocol: TCP
-  selector:
-    app.kubernetes.io/name: valkey
-    app.kubernetes.io/instance: authentik

clusters/cl01tl/manifests/authentik/Service-authentik-valkey-metrics.yaml

@@ -1,23 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: authentik-valkey-metrics
-  labels:
-    helm.sh/chart: valkey-0.9.3
-    app.kubernetes.io/name: valkey
-    app.kubernetes.io/instance: authentik
-    app.kubernetes.io/version: "9.0.3"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: metrics
-    app.kubernetes.io/part-of: valkey
-  annotations:
-spec:
-  type: ClusterIP
-  ports:
-    - name: metrics
-      port: 9121
-      protocol: TCP
-      targetPort: metrics
-  selector:
-    app.kubernetes.io/name: valkey
-    app.kubernetes.io/instance: authentik

clusters/cl01tl/manifests/authentik/Service-authentik-valkey-read.yaml

@@ -1,21 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: authentik-valkey-read
-  labels:
-    helm.sh/chart: valkey-0.9.3
-    app.kubernetes.io/name: valkey
-    app.kubernetes.io/instance: authentik
-    app.kubernetes.io/version: "9.0.3"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: read
-spec:
-  type: ClusterIP
-  ports:
-    - name: tcp
-      port: 6379
-      targetPort: tcp
-      protocol: TCP
-  selector:
-    app.kubernetes.io/name: valkey
-    app.kubernetes.io/instance: authentik

clusters/cl01tl/manifests/authentik/Service-authentik-valkey.yaml

@@ -1,22 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: authentik-valkey
-  labels:
-    helm.sh/chart: valkey-0.9.3
-    app.kubernetes.io/name: valkey
-    app.kubernetes.io/instance: authentik
-    app.kubernetes.io/version: "9.0.3"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/component: primary
-spec:
-  type: ClusterIP
-  ports:
-    - port: 6379
-      targetPort: tcp
-      protocol: TCP
-      name: tcp
-  selector:
-    app.kubernetes.io/name: valkey
-    app.kubernetes.io/instance: authentik
-    statefulset.kubernetes.io/pod-name: authentik-valkey-0

clusters/cl01tl/manifests/authentik/Service-authentik-worker-metrics.yaml

@@ -1,24 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: authentik-worker-metrics
-  namespace: "authentik"
-  labels:
-    helm.sh/chart: "authentik-2026.2.1"
-    app.kubernetes.io/name: "authentik"
-    app.kubernetes.io/instance: "authentik"
-    app.kubernetes.io/component: "worker-metrics"
-    app.kubernetes.io/managed-by: "Helm"
-    app.kubernetes.io/part-of: "authentik"
-    app.kubernetes.io/version: "2026.2.1"
-spec:
-  type: ClusterIP
-  ports:
-    - name: metrics
-      protocol: TCP
-      port: 9300
-      targetPort: metrics
-  selector:
-    app.kubernetes.io/name: "authentik"
-    app.kubernetes.io/instance: "authentik"
-    app.kubernetes.io/component: "worker"

clusters/cl01tl/manifests/authentik/ServiceAccount-authentik-valkey.yaml

@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: authentik-valkey
-  labels:
-    helm.sh/chart: valkey-0.9.3
-    app.kubernetes.io/name: valkey
-    app.kubernetes.io/instance: authentik
-    app.kubernetes.io/version: "9.0.3"
-    app.kubernetes.io/managed-by: Helm
-automountServiceAccountToken: false

clusters/cl01tl/manifests/authentik/ServiceAccount-authentik.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: authentik
-  namespace: "authentik"
-  labels:
-    helm.sh/chart: "serviceAccount-2.1.0"
-    app.kubernetes.io/name: "serviceAccount"
-    app.kubernetes.io/instance: "authentik"
-    app.kubernetes.io/managed-by: "Helm"
-    app.kubernetes.io/part-of: "authentik"
-    app.kubernetes.io/version: "2.1.0"

clusters/cl01tl/manifests/authentik/ServiceMonitor-authentik-server.yaml

@@ -1,27 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: authentik-server
-  namespace: "authentik"
-  labels:
-    helm.sh/chart: "authentik-2026.2.1"
-    app.kubernetes.io/name: "authentik"
-    app.kubernetes.io/instance: "authentik"
-    app.kubernetes.io/component: "server-metrics"
-    app.kubernetes.io/managed-by: "Helm"
-    app.kubernetes.io/part-of: "authentik"
-    app.kubernetes.io/version: "2026.2.1"
-spec:
-  endpoints:
-    - port: metrics
-      interval: 30s
-      scrapeTimeout: 3s
-      path: /metrics
-  namespaceSelector:
-    matchNames:
-      - authentik
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: "authentik"
-      app.kubernetes.io/instance: "authentik"
-      app.kubernetes.io/component: "server-metrics"

clusters/cl01tl/manifests/authentik/ServiceMonitor-authentik-valkey.yaml

@@ -1,24 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: authentik-valkey
-  labels:
-    helm.sh/chart: valkey-0.9.3
-    app.kubernetes.io/name: valkey
-    app.kubernetes.io/instance: authentik
-    app.kubernetes.io/version: "9.0.3"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/part-of: valkey
-    app.kubernetes.io/component: service-monitor
-spec:
-  endpoints:
-    - port: metrics
-      interval: 30s
-  namespaceSelector:
-    matchNames:
-      - authentik
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: valkey
-      app.kubernetes.io/instance: authentik
-      app.kubernetes.io/component: metrics

clusters/cl01tl/manifests/authentik/ServiceMonitor-authentik-worker.yaml

@@ -1,27 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: authentik-worker
-  namespace: "authentik"
-  labels:
-    helm.sh/chart: "authentik-2026.2.1"
-    app.kubernetes.io/name: "authentik"
-    app.kubernetes.io/instance: "authentik"
-    app.kubernetes.io/component: "worker-metrics"
-    app.kubernetes.io/managed-by: "Helm"
-    app.kubernetes.io/part-of: "authentik"
-    app.kubernetes.io/version: "2026.2.1"
-spec:
-  endpoints:
-    - port: metrics
-      interval: 30s
-      scrapeTimeout: 3s
-      path: /metrics
-  namespaceSelector:
-    matchNames:
-      - authentik
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: "authentik"
-      app.kubernetes.io/instance: "authentik"
-      app.kubernetes.io/component: "worker-metrics"

clusters/cl01tl/manifests/authentik/StatefulSet-authentik-valkey.yaml

@@ -1,129 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: authentik-valkey
-  labels:
-    helm.sh/chart: valkey-0.9.3
-    app.kubernetes.io/name: valkey
-    app.kubernetes.io/instance: authentik
-    app.kubernetes.io/version: "9.0.3"
-    app.kubernetes.io/managed-by: Helm
-spec:
-  serviceName: authentik-valkey-headless
-  replicas: 3
-  podManagementPolicy: OrderedReady
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: valkey
-      app.kubernetes.io/instance: authentik
-  volumeClaimTemplates:
-    - metadata:
-        name: valkey-data
-      spec:
-        accessModes:
-          - ReadWriteOnce
-        storageClassName: "ceph-block"
-        resources:
-          requests:
-            storage: "1Gi"
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: valkey
-        app.kubernetes.io/instance: authentik
-      annotations:
-        checksum/initconfig: "07891dc8f81b4fb3516e2993c6e827b1"
-    spec:
-      automountServiceAccountToken: false
-      serviceAccountName: authentik-valkey
-      securityContext:
-        fsGroup: 1000
-        runAsGroup: 1000
-        runAsUser: 1000
-      initContainers:
-        - name: authentik-valkey-init
-          image: docker.io/valkey/valkey:9.0.3
-          imagePullPolicy: IfNotPresent
-          securityContext:
-            capabilities:
-              drop:
-                - ALL
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
-            runAsUser: 1000
-          command: ["/scripts/init.sh"]
-          env:
-            - name: POD_INDEX
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.labels['apps.kubernetes.io/pod-index']
-          volumeMounts:
-            - name: valkey-data
-              mountPath: /data
-            - name: scripts
-              mountPath: /scripts
-      containers:
-        - name: authentik-valkey
-          image: docker.io/valkey/valkey:9.0.3
-          imagePullPolicy: IfNotPresent
-          command: ["valkey-server"]
-          args: ["/data/conf/valkey.conf"]
-          securityContext:
-            capabilities:
-              drop:
-                - ALL
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
-            runAsUser: 1000
-          env:
-            - name: POD_INDEX
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.labels['apps.kubernetes.io/pod-index']
-            - name: VALKEY_LOGLEVEL
-              value: "notice"
-          ports:
-            - name: tcp
-              containerPort: 6379
-              protocol: TCP
-          startupProbe:
-            exec:
-              command: ["sh", "-c", "valkey-cli ping"]
-          livenessProbe:
-            exec:
-              command: ["sh", "-c", "valkey-cli ping"]
-          resources:
-            requests:
-              cpu: 10m
-              memory: 20Mi
-          volumeMounts:
-            - name: valkey-data
-              mountPath: /data
-        - name: metrics
-          image: ghcr.io/oliver006/redis_exporter:v1.82.0
-          imagePullPolicy: "IfNotPresent"
-          ports:
-            - name: metrics
-              containerPort: 9121
-          startupProbe:
-            tcpSocket:
-              port: metrics
-          livenessProbe:
-            tcpSocket:
-              port: metrics
-          readinessProbe:
-            httpGet:
-              path: /
-              port: metrics
-          resources:
-            requests:
-              cpu: 1m
-              memory: 10M
-          env:
-            - name: REDIS_ALIAS
-              value: authentik-valkey
-      volumes:
-        - name: scripts
-          configMap:
-            name: authentik-valkey-init-scripts
-            defaultMode: 0555

clusters/cl01tl/manifests/backrest/-.yaml

@@ -0,0 +1 @@
+

clusters/cl01tl/manifests/backrest/Deployment-backrest.yaml

@@ -1,85 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: backrest
-  labels:
-    app.kubernetes.io/controller: main
-    app.kubernetes.io/instance: backrest
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: backrest
-    helm.sh/chart: backrest-4.6.2
-  namespace: backrest
-spec:
-  revisionHistoryLimit: 3
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app.kubernetes.io/controller: main
-      app.kubernetes.io/name: backrest
-      app.kubernetes.io/instance: backrest
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/controller: main
-        app.kubernetes.io/instance: backrest
-        app.kubernetes.io/name: backrest
-    spec:
-      enableServiceLinks: false
-      serviceAccountName: default
-      automountServiceAccountToken: true
-      hostIPC: false
-      hostNetwork: false
-      hostPID: false
-      dnsPolicy: ClusterFirst
-      containers:
-        - env:
-            - name: TZ
-              value: America/Chicago
-            - name: BACKREST_DATA
-              value: /data
-            - name: BACKREST_CONFIG
-              value: /config/config.json
-            - name: XDG_CACHE_HOME
-              value: /cache
-            - name: TMPDIR
-              value: /tmp
-          image: ghcr.io/garethgeorge/backrest:v1.12.1@sha256:f4d34bd6fa985d13bdb6c01c5d8727e07708899afa9567d800808357d77b9fb0
-          name: main
-          resources:
-            requests:
-              cpu: 1m
-              memory: 30Mi
-          volumeMounts:
-            - mountPath: /cache
-              name: cache
-            - mountPath: /config
-              name: config
-            - mountPath: /data
-              name: data
-            - mountPath: /mnt/share
-              name: share
-              readOnly: true
-            - mountPath: /mnt/storage
-              name: storage
-              readOnly: true
-            - mountPath: /tmp
-              name: tmp
-      volumes:
-        - emptyDir: {}
-          name: cache
-        - name: config
-          persistentVolumeClaim:
-            claimName: backrest-config
-        - name: data
-          persistentVolumeClaim:
-            claimName: backrest-data
-        - name: share
-          persistentVolumeClaim:
-            claimName: backrest-nfs-share
-        - name: storage
-          persistentVolumeClaim:
-            claimName: backrest-nfs-storage
-        - emptyDir: {}
-          name: tmp

clusters/cl01tl/manifests/backrest/ExternalSecret-backrest-config-backup-secret-external.yaml

@@ -1,58 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: backrest-config-backup-secret-external
-  namespace: backrest
-  labels:
-    helm.sh/chart: volsync-target-config-0.8.0
-    app.kubernetes.io/instance: backrest
-    app.kubernetes.io/part-of: backrest
-    app.kubernetes.io/version: "0.8.0"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: backrest-config-backup-secret-external
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/backrest/backrest-config"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_ACCESS_KEY_ID
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_SECRET_ACCESS_KEY

clusters/cl01tl/manifests/backrest/ExternalSecret-backrest-config-backup-secret-local.yaml

@@ -1,58 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: backrest-config-backup-secret-local
-  namespace: backrest
-  labels:
-    helm.sh/chart: volsync-target-config-0.8.0
-    app.kubernetes.io/instance: backrest
-    app.kubernetes.io/part-of: backrest
-    app.kubernetes.io/version: "0.8.0"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: backrest-config-backup-secret-local
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/backrest/backrest-config"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
-        property: ACCESS_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
-        property: ACCESS_KEY_ID
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
-        property: ACCESS_SECRET_KEY

clusters/cl01tl/manifests/backrest/ExternalSecret-backrest-config-backup-secret-remote.yaml

@@ -1,58 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: backrest-config-backup-secret-remote
-  namespace: backrest
-  labels:
-    helm.sh/chart: volsync-target-config-0.8.0
-    app.kubernetes.io/instance: backrest
-    app.kubernetes.io/part-of: backrest
-    app.kubernetes.io/version: "0.8.0"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: backrest-config-backup-secret-remote
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/backrest/backrest-config"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
-        property: ACCESS_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
-        property: ACCESS_KEY_ID
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
-        property: ACCESS_SECRET_KEY

clusters/cl01tl/manifests/backrest/ExternalSecret-backrest-data-backup-secret-external.yaml

@@ -1,58 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: backrest-data-backup-secret-external
-  namespace: backrest
-  labels:
-    helm.sh/chart: volsync-target-data-0.8.0
-    app.kubernetes.io/instance: backrest
-    app.kubernetes.io/part-of: backrest
-    app.kubernetes.io/version: "0.8.0"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: backrest-data-backup-secret-external
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/backrest/backrest-data"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/digital-ocean
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_DEFAULT_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_ACCESS_KEY_ID
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /digital-ocean/home-infra/volsync-backups
-        metadataPolicy: None
-        property: AWS_SECRET_ACCESS_KEY

clusters/cl01tl/manifests/backrest/ExternalSecret-backrest-data-backup-secret-local.yaml

@@ -1,58 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: backrest-data-backup-secret-local
-  namespace: backrest
-  labels:
-    helm.sh/chart: volsync-target-data-0.8.0
-    app.kubernetes.io/instance: backrest
-    app.kubernetes.io/part-of: backrest
-    app.kubernetes.io/version: "0.8.0"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: backrest-data-backup-secret-local
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/backrest/backrest-data"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-local
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
-        property: ACCESS_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
-        property: ACCESS_KEY_ID
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
-        property: ACCESS_SECRET_KEY

clusters/cl01tl/manifests/backrest/ExternalSecret-backrest-data-backup-secret-remote.yaml

@@ -1,58 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: backrest-data-backup-secret-remote
-  namespace: backrest
-  labels:
-    helm.sh/chart: volsync-target-data-0.8.0
-    app.kubernetes.io/instance: backrest
-    app.kubernetes.io/part-of: backrest
-    app.kubernetes.io/version: "0.8.0"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: backrest-data-backup-secret-remote
-spec:
-  secretStoreRef:
-    kind: ClusterSecretStore
-    name: vault
-  target:
-    template:
-      mergePolicy: Merge
-      engineVersion: v2
-      data:
-        RESTIC_REPOSITORY: "{{ .BUCKET_ENDPOINT }}/backrest/backrest-data"
-  data:
-    - secretKey: BUCKET_ENDPOINT
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: BUCKET_ENDPOINT
-    - secretKey: RESTIC_PASSWORD
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /volsync/restic/garage-remote
-        metadataPolicy: None
-        property: RESTIC_PASSWORD
-    - secretKey: AWS_DEFAULT_REGION
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
-        property: ACCESS_REGION
-    - secretKey: AWS_ACCESS_KEY_ID
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
-        property: ACCESS_KEY_ID
-    - secretKey: AWS_SECRET_ACCESS_KEY
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        key: /garage/home-infra/volsync-backups
-        metadataPolicy: None
-        property: ACCESS_SECRET_KEY

clusters/cl01tl/manifests/backrest/HTTPRoute-backrest.yaml

@@ -1,30 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: backrest
-  labels:
-    app.kubernetes.io/instance: backrest
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: backrest
-    helm.sh/chart: backrest-4.6.2
-  namespace: backrest
-spec:
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: traefik-gateway
-      namespace: traefik
-  hostnames:
-    - "backrest.alexlebens.net"
-  rules:
-    - backendRefs:
-        - group: ""
-          kind: Service
-          name: backrest
-          namespace: backrest
-          port: 80
-          weight: 1
-      matches:
-        - path:
-            type: PathPrefix
-            value: /

clusters/cl01tl/manifests/backrest/PersistentVolume-backrest-nfs-share.yaml

@@ -1,23 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: backrest-nfs-share
-  namespace: backrest
-  labels:
-    app.kubernetes.io/name: backrest-nfs-share
-    app.kubernetes.io/instance: backrest
-    app.kubernetes.io/part-of: backrest
-spec:
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: nfs-client
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteMany
-  nfs:
-    path: /volume2/Share
-    server: synologybond.alexlebens.net
-  mountOptions:
-    - vers=4
-    - minorversion=1
-    - noac

clusters/cl01tl/manifests/backrest/PersistentVolume-backrest-nfs-storage.yaml

@@ -1,23 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: backrest-nfs-storage
-  namespace: backrest
-  labels:
-    app.kubernetes.io/name: backrest-nfs-storage
-    app.kubernetes.io/instance: backrest
-    app.kubernetes.io/part-of: backrest
-spec:
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: nfs-client
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteMany
-  nfs:
-    path: /volume2/Storage
-    server: synologybond.alexlebens.net
-  mountOptions:
-    - vers=4
-    - minorversion=1
-    - noac

clusters/cl01tl/manifests/backrest/PersistentVolumeClaim-backrest-config.yaml

@@ -1,17 +0,0 @@
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: backrest-config
-  labels:
-    app.kubernetes.io/instance: backrest
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: backrest
-    helm.sh/chart: backrest-4.6.2
-  namespace: backrest
-spec:
-  accessModes:
-    - "ReadWriteOnce"
-  resources:
-    requests:
-      storage: "1Gi"
-  storageClassName: "ceph-block"

clusters/cl01tl/manifests/backrest/PersistentVolumeClaim-backrest-data.yaml

@@ -1,17 +0,0 @@
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: backrest-data
-  labels:
-    app.kubernetes.io/instance: backrest
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: backrest
-    helm.sh/chart: backrest-4.6.2
-  namespace: backrest
-spec:
-  accessModes:
-    - "ReadWriteOnce"
-  resources:
-    requests:
-      storage: "10Gi"
-  storageClassName: "ceph-block"

clusters/cl01tl/manifests/backrest/PersistentVolumeClaim-backrest-nfs-share.yaml

@@ -1,17 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: backrest-nfs-share
-  namespace: backrest
-  labels:
-    app.kubernetes.io/name: backrest-nfs-share
-    app.kubernetes.io/instance: backrest
-    app.kubernetes.io/part-of: backrest
-spec:
-  volumeName: backrest-nfs-share
-  storageClassName: nfs-client
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi

clusters/cl01tl/manifests/backrest/PersistentVolumeClaim-backrest-nfs-storage.yaml

@@ -1,17 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: backrest-nfs-storage
-  namespace: backrest
-  labels:
-    app.kubernetes.io/name: backrest-nfs-storage
-    app.kubernetes.io/instance: backrest
-    app.kubernetes.io/part-of: backrest
-spec:
-  volumeName: backrest-nfs-storage
-  storageClassName: nfs-client
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi

clusters/cl01tl/manifests/backrest/ReplicationSource-backrest-config-backup-source-external.yaml

@@ -1,29 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: backrest-config-backup-source-external
-  namespace: backrest
-  labels:
-    helm.sh/chart: volsync-target-config-0.8.0
-    app.kubernetes.io/instance: backrest
-    app.kubernetes.io/part-of: backrest
-    app.kubernetes.io/version: "0.8.0"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: backrest-config-backup
-spec:
-  sourcePVC: backrest-config
-  trigger:
-    schedule: 8 10 * * *
-  restic:
-    pruneIntervalDays: 7
-    repository: backrest-config-backup-secret-external
-    retain:
-      daily: 7
-      hourly: 0
-      monthly: 3
-      weekly: 4
-      yearly: 1
-    copyMethod: Snapshot
-    storageClassName: ceph-block
-    volumeSnapshotClassName: ceph-blockpool-snapshot
-    cacheCapacity: 1Gi

clusters/cl01tl/manifests/backrest/ReplicationSource-backrest-config-backup-source-local.yaml

@@ -1,29 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: backrest-config-backup-source-local
-  namespace: backrest
-  labels:
-    helm.sh/chart: volsync-target-config-0.8.0
-    app.kubernetes.io/instance: backrest
-    app.kubernetes.io/part-of: backrest
-    app.kubernetes.io/version: "0.8.0"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: backrest-config-backup
-spec:
-  sourcePVC: backrest-config
-  trigger:
-    schedule: 8 8 * * *
-  restic:
-    pruneIntervalDays: 7
-    repository: backrest-config-backup-secret-local
-    retain:
-      daily: 7
-      hourly: 0
-      monthly: 3
-      weekly: 4
-      yearly: 1
-    copyMethod: Snapshot
-    storageClassName: ceph-block
-    volumeSnapshotClassName: ceph-blockpool-snapshot
-    cacheCapacity: 1Gi

clusters/cl01tl/manifests/backrest/ReplicationSource-backrest-config-backup-source-remote.yaml

@@ -1,29 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: backrest-config-backup-source-remote
-  namespace: backrest
-  labels:
-    helm.sh/chart: volsync-target-config-0.8.0
-    app.kubernetes.io/instance: backrest
-    app.kubernetes.io/part-of: backrest
-    app.kubernetes.io/version: "0.8.0"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: backrest-config-backup
-spec:
-  sourcePVC: backrest-config
-  trigger:
-    schedule: 8 9 * * *
-  restic:
-    pruneIntervalDays: 7
-    repository: backrest-config-backup-secret-remote
-    retain:
-      daily: 7
-      hourly: 0
-      monthly: 3
-      weekly: 4
-      yearly: 1
-    copyMethod: Snapshot
-    storageClassName: ceph-block
-    volumeSnapshotClassName: ceph-blockpool-snapshot
-    cacheCapacity: 1Gi

clusters/cl01tl/manifests/backrest/ReplicationSource-backrest-data-backup-source-external.yaml

@@ -1,29 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: backrest-data-backup-source-external
-  namespace: backrest
-  labels:
-    helm.sh/chart: volsync-target-data-0.8.0
-    app.kubernetes.io/instance: backrest
-    app.kubernetes.io/part-of: backrest
-    app.kubernetes.io/version: "0.8.0"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: backrest-data-backup
-spec:
-  sourcePVC: backrest-data
-  trigger:
-    schedule: 6 10 * * *
-  restic:
-    pruneIntervalDays: 7
-    repository: backrest-data-backup-secret-external
-    retain:
-      daily: 7
-      hourly: 0
-      monthly: 3
-      weekly: 4
-      yearly: 1
-    copyMethod: Snapshot
-    storageClassName: ceph-block
-    volumeSnapshotClassName: ceph-blockpool-snapshot
-    cacheCapacity: 1Gi

clusters/cl01tl/manifests/backrest/ReplicationSource-backrest-data-backup-source-local.yaml

@@ -1,29 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: backrest-data-backup-source-local
-  namespace: backrest
-  labels:
-    helm.sh/chart: volsync-target-data-0.8.0
-    app.kubernetes.io/instance: backrest
-    app.kubernetes.io/part-of: backrest
-    app.kubernetes.io/version: "0.8.0"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: backrest-data-backup
-spec:
-  sourcePVC: backrest-data
-  trigger:
-    schedule: 6 8 * * *
-  restic:
-    pruneIntervalDays: 7
-    repository: backrest-data-backup-secret-local
-    retain:
-      daily: 7
-      hourly: 0
-      monthly: 3
-      weekly: 4
-      yearly: 1
-    copyMethod: Snapshot
-    storageClassName: ceph-block
-    volumeSnapshotClassName: ceph-blockpool-snapshot
-    cacheCapacity: 1Gi

clusters/cl01tl/manifests/backrest/ReplicationSource-backrest-data-backup-source-remote.yaml

@@ -1,29 +0,0 @@
-apiVersion: volsync.backube/v1alpha1
-kind: ReplicationSource
-metadata:
-  name: backrest-data-backup-source-remote
-  namespace: backrest
-  labels:
-    helm.sh/chart: volsync-target-data-0.8.0
-    app.kubernetes.io/instance: backrest
-    app.kubernetes.io/part-of: backrest
-    app.kubernetes.io/version: "0.8.0"
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: backrest-data-backup
-spec:
-  sourcePVC: backrest-data
-  trigger:
-    schedule: 6 9 * * *
-  restic:
-    pruneIntervalDays: 7
-    repository: backrest-data-backup-secret-remote
-    retain:
-      daily: 7
-      hourly: 0
-      monthly: 3
-      weekly: 4
-      yearly: 1
-    copyMethod: Snapshot
-    storageClassName: ceph-block
-    volumeSnapshotClassName: ceph-blockpool-snapshot
-    cacheCapacity: 1Gi

clusters/cl01tl/manifests/backrest/Service-backrest.yaml

@@ -1,22 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: backrest
-  labels:
-    app.kubernetes.io/instance: backrest
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: backrest
-    app.kubernetes.io/service: backrest
-    helm.sh/chart: backrest-4.6.2
-  namespace: backrest
-spec:
-  type: ClusterIP
-  ports:
-    - port: 80
-      targetPort: 9898
-      protocol: TCP
-      name: http
-  selector:
-    app.kubernetes.io/controller: main
-    app.kubernetes.io/instance: backrest
-    app.kubernetes.io/name: backrest

clusters/cl01tl/manifests/backrest/ServiceMonitor-backrest.yaml

@@ -1,25 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: backrest
-  labels:
-    app.kubernetes.io/instance: backrest
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: backrest
-    helm.sh/chart: backrest-4.6.2
-  namespace: backrest
-spec:
-  jobLabel: backrest
-  namespaceSelector:
-    matchNames:
-      - backrest
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: backrest
-      app.kubernetes.io/name: backrest
-  endpoints:
-    - interval: 300s
-      path: /metrics
-      port: http
-      scheme: http
-      scrapeTimeout: 15s

clusters/cl01tl/manifests/bazarr/-.yaml

@@ -0,0 +1 @@
+

clusters/cl01tl/manifests/bazarr/Deployment-bazarr.yaml

@@ -1,68 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: bazarr
-  labels:
-    app.kubernetes.io/controller: main
-    app.kubernetes.io/instance: bazarr
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: bazarr
-    helm.sh/chart: bazarr-4.6.2
-  namespace: bazarr
-spec:
-  revisionHistoryLimit: 3
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app.kubernetes.io/controller: main
-      app.kubernetes.io/name: bazarr
-      app.kubernetes.io/instance: bazarr
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/controller: main
-        app.kubernetes.io/instance: bazarr
-        app.kubernetes.io/name: bazarr
-    spec:
-      enableServiceLinks: false
-      serviceAccountName: default
-      automountServiceAccountToken: true
-      securityContext:
-        fsGroup: 1000
-        fsGroupChangePolicy: OnRootMismatch
-        runAsGroup: 1000
-        runAsUser: 1000
-      hostIPC: false
-      hostNetwork: false
-      hostPID: false
-      dnsPolicy: ClusterFirst
-      containers:
-        - env:
-            - name: TZ
-              value: America/Chicago
-            - name: PUID
-              value: "1000"
-            - name: PGID
-              value: "1000"
-          image: ghcr.io/linuxserver/bazarr:v1.5.6-ls342@sha256:9a631194c0dee21c85b5bff59e23610e1ae2f54594e922973949d271102e585e
-          name: main
-          resources:
-            limits:
-              cpu: 100m
-            requests:
-              cpu: 1m
-              memory: 250Mi
-          volumeMounts:
-            - mountPath: /config
-              name: config
-            - mountPath: /mnt/store
-              name: media
-      volumes:
-        - name: config
-          persistentVolumeClaim:
-            claimName: bazarr-config
-        - name: media
-          persistentVolumeClaim:
-            claimName: bazarr-nfs-storage