reworking default namespace

apps/default/archivebox.yaml

@@ -1,3 +1,39 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: sonic
+  namespace: default
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: sonic
+  template:
+    metadata:
+      labels:
+        app: sonic
+    spec:
+      containers:
+        - name: sonic
+          image: archivebox/sonic:latest
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 1491
+          env:
+            - name: SEARCH_BACKEND_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: password
+                  key: password
+          resources:
+            requests:
+              memory: "64Mi"
+              cpu: "50m"
+            limits:
+              memory: "128Mi"
+              cpu: "200m"
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -8,80 +44,69 @@ spec:
   selector:
     matchLabels:
       app: archivebox
-  strategy:
-    type: Recreate
   template:
     metadata:
       labels:
         app: archivebox
     spec:
       containers:
-      - env:
+        - name: archivebox
+          image: archivebox/archivebox:latest
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 8000
+          env:
             - name: SONIC_HOST
-          value: sonic.default.svc.cluster.local
+              value: "sonic.default.svc.cluster.local"
             - name: SONIC_PORT
-          value: '1491'
+              value: "1491"
             - name: SEARCH_BACKEND_ENGINE
-          value: sonic
+              value: "sonic"
             - name: SONIC_PASSWORD
               valueFrom:
                 secretKeyRef:
-              key: password
                   name: password
+                  key: password
             - name: ADMIN_USERNAME
-          value: ivanch
+              value: "ivanch"
             - name: ADMIN_PASSWORD
               valueFrom:
                 secretKeyRef:
-              key: password
                   name: password
+                  key: password
             - name: CSRF_TRUSTED_ORIGINS
-          value: archive.haven
+              value: "archive.haven"
             - name: ALLOWED_HOSTS
-          value: '*'
+              value: "*"
             - name: PUBLIC_ADD_VIEW
-          value: 'false'
+              value: "false"
-        image: archivebox/archivebox:latest
-        imagePullPolicy: Always
-        name: archivebox
-        ports:
-        - containerPort: 8000
-          protocol: TCP
-        resources: {}
-        terminationMessagePath: /dev/termination-log
-        terminationMessagePolicy: File
           volumeMounts:
-        - mountPath: /data
+            - name: archivebox-data
-          name: archivebox-data
+              mountPath: /data
-      dnsPolicy: ClusterFirst
+          resources:
-      restartPolicy: Always
+            requests:
-      schedulerName: default-scheduler
+              memory: "256Mi"
-      securityContext: {}
+              cpu: "100m"
-      terminationGracePeriodSeconds: 30
+            limits:
+              memory: "2Gi"
+              cpu: "3000m"
       volumes:
         - name: archivebox-data
           persistentVolumeClaim:
             claimName: archivebox-data
-status:
+---
-  availableReplicas: 1
+apiVersion: v1
-  conditions:
+kind: Service
-  - lastTransitionTime: '2026-05-19T01:51:47Z'
+metadata:
-    lastUpdateTime: '2026-07-22T10:14:38Z'
+  name: sonic-svc
-    message: ReplicaSet "archivebox-bb7f58db4" has successfully progressed.
+  namespace: default
-    reason: NewReplicaSetAvailable
+spec:
-    status: 'True'
+  selector:
-    type: Progressing
+    app: sonic
-  - lastTransitionTime: '2026-08-28T06:04:13Z'
+  ports:
-    lastUpdateTime: '2026-08-28T06:04:13Z'
+    - protocol: TCP
-    message: Deployment has minimum availability.
+      port: 1491
-    reason: MinimumReplicasAvailable
+      targetPort: 1491
-    status: 'True'
-    type: Available
-  observedGeneration: 94
-  readyReplicas: 1
-  replicas: 1
-  terminatingReplicas: 0
-  updatedReplicas: 1
 ---
 apiVersion: v1
 kind: Service
@@ -89,20 +114,30 @@ metadata:
   name: archivebox-svc
   namespace: default
 spec:
-  internalTrafficPolicy: Cluster
-  ipFamilies:
-  - IPv4
-  ipFamilyPolicy: SingleStack
-  ports:
-  - port: 8000
-    protocol: TCP
-    targetPort: 8000
   selector:
     app: archivebox
-  sessionAffinity: None
+  ports:
-  type: ClusterIP
+    - protocol: TCP
-status:
+      port: 8000
-  loadBalancer: {}
+      targetPort: 8000
+---
+# 3) PersistentVolumeClaim
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: archivebox-data
+  namespace: default
+  annotations:
+    nfs.io/storage-path: "archivebox-data"
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
+    limits:
+      storage: 30Gi
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -112,39 +147,13 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-  - host: archive.haven
+    - host: "archive.haven"
       http:
         paths:
-      - backend:
+          - path: /
+            pathType: Prefix
+            backend:
               service:
                 name: archivebox-svc
                 port:
                   number: 8000
-        path: /
-        pathType: Prefix
-status:
-  loadBalancer:
-    ingress:
-    - ip: 192.168.20.204
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: archivebox-data
-  namespace: default
-spec:
-  accessModes:
-  - ReadWriteOnce
-  resources:
-    limits:
-      storage: 30Gi
-    requests:
-      storage: 10Gi
-  storageClassName: nfs-client
-  volumeMode: Filesystem
-status:
-  accessModes:
-  - ReadWriteOnce
-  capacity:
-    storage: 10Gi
-  phase: Bound

apps/default/changedetection.yaml

@@ -1,12 +1,13 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  labels:
-    app.kubernetes.io/name: changedetection
   name: changedetection
   namespace: default
+  labels:
+    app.kubernetes.io/name: changedetection
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   selector:
     matchLabels:
       app.kubernetes.io/name: changedetection
@@ -20,64 +21,68 @@ spec:
       affinity:
         nodeAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
-          - preference:
+            - weight: 100
+              preference:
                 matchExpressions:
                   - key: kubernetes.io/hostname
                     operator: In
                     values:
                       - iris
-            weight: 100
       containers:
-      - env:
+        - name: changedetection
-        - name: PUID
-          value: '1000'
-        - name: PGID
-          value: '1000'
-        - name: TZ
-          value: Etc/UTC
-        - name: BASE_URL
-          value: http://change.haven/
-        - name: PLAYWRIGHT_DRIVER_URL
-          value: ws://localhost:3000
           image: lscr.io/linuxserver/changedetection.io:latest
           imagePullPolicy: Always
-        name: changedetection
+          env:
+            - name: PUID
+              value: "1000"
+            - name: PGID
+              value: "1000"
+            - name: TZ
+              value: "Etc/UTC"
+            - name: BASE_URL
+              value: "http://change.haven/"
+            - name: PLAYWRIGHT_DRIVER_URL
+              value: "ws://localhost:3000"
           ports:
             - containerPort: 5000
               name: http
               protocol: TCP
           resources:
-          limits:
-            cpu: '2'
-            memory: 1Gi
             requests:
               cpu: 100m
               memory: 256Mi
+            limits:
+              cpu: 2000m
+              memory: 1Gi
           securityContext:
             allowPrivilegeEscalation: false
             runAsUser: 0
-        terminationMessagePath: /dev/termination-log
-        terminationMessagePolicy: File
           volumeMounts:
-        - mountPath: /config
+            - name: config
-          name: config
+              mountPath: /config
-      - env:
+        - name: browser-sockpuppet-chrome
-        - name: SCREEN_WIDTH
-          value: '1920'
-        - name: SCREEN_HEIGHT
-          value: '1024'
-        - name: SCREEN_DEPTH
-          value: '16'
-        - name: MAX_CONCURRENT_CHROME_PROCESSES
-          value: '10'
           image: dgtlmoon/sockpuppetbrowser:latest
           imagePullPolicy: Always
-        name: browser-sockpuppet-chrome
+          env:
+            - name: SCREEN_WIDTH
+              value: "1920"
+            - name: SCREEN_HEIGHT
+              value: "1024"
+            - name: SCREEN_DEPTH
+              value: "16"
+            - name: MAX_CONCURRENT_CHROME_PROCESSES
+              value: "10"
           ports:
             - containerPort: 3000
               name: ws
               protocol: TCP
-        resources: {}
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: 2000m
+              memory: 4Gi
           securityContext:
             allowPrivilegeEscalation: false
             capabilities:
@@ -85,105 +90,65 @@ spec:
                 - SYS_ADMIN
               drop:
                 - ALL
-        terminationMessagePath: /dev/termination-log
-        terminationMessagePolicy: File
-      dnsPolicy: ClusterFirst
-      restartPolicy: Always
-      schedulerName: default-scheduler
-      securityContext: {}
-      terminationGracePeriodSeconds: 30
       volumes:
         - name: config
           persistentVolumeClaim:
             claimName: changedetection-config
-status:
+      dnsPolicy: ClusterFirst
-  availableReplicas: 1
+      restartPolicy: Always
-  conditions:
+      terminationGracePeriodSeconds: 30
-  - lastTransitionTime: '2026-08-04T16:20:08Z'
-    lastUpdateTime: '2026-08-04T16:32:45Z'
-    message: ReplicaSet "changedetection-77cd668cf4" has successfully progressed.
-    reason: NewReplicaSetAvailable
-    status: 'True'
-    type: Progressing
-  - lastTransitionTime: '2026-08-28T06:05:12Z'
-    lastUpdateTime: '2026-08-28T06:05:12Z'
-    message: Deployment has minimum availability.
-    reason: MinimumReplicasAvailable
-    status: 'True'
-    type: Available
-  observedGeneration: 22
-  readyReplicas: 1
-  replicas: 1
-  terminatingReplicas: 0
-  updatedReplicas: 1
 ---
 apiVersion: v1
 kind: Service
 metadata:
-  labels:
-    app.kubernetes.io/name: changedetection
   name: changedetection
   namespace: default
+  labels:
+    app.kubernetes.io/name: changedetection
 spec:
-  internalTrafficPolicy: Cluster
+  type: ClusterIP
-  ipFamilies:
+  selector:
-  - IPv4
+    app.kubernetes.io/name: changedetection
-  ipFamilyPolicy: SingleStack
   ports:
     - name: http
       port: 5000
       protocol: TCP
       targetPort: http
-  selector:
-    app.kubernetes.io/name: changedetection
-  sessionAffinity: None
-  type: ClusterIP
-status:
-  loadBalancer: {}
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  labels:
-    app.kubernetes.io/name: changedetection
-  name: changedetection
-  namespace: default
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: change.haven
-    http:
-      paths:
-      - backend:
-          service:
-            name: changedetection
-            port:
-              number: 5000
-        path: /
-        pathType: Prefix
-status:
-  loadBalancer:
-    ingress:
-    - ip: 192.168.20.204
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: changedetection-config
   namespace: default
+  annotations:
+    nfs.io/storage-path: "changedetection-config"
 spec:
+  storageClassName: "nfs-client"
   accessModes:
     - ReadWriteOnce
   resources:
-    limits:
-      storage: 2Gi
     requests:
       storage: 1Gi
-  storageClassName: nfs-client
+    limits:
-  volumeMode: Filesystem
+      storage: 2Gi
-status:
+---
-  accessModes:
+apiVersion: networking.k8s.io/v1
-  - ReadWriteOnce
+kind: Ingress
-  capacity:
+metadata:
-    storage: 1Gi
+  name: changedetection
-  phase: Bound
+  namespace: default
+  labels:
+    app.kubernetes.io/name: changedetection
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: change.haven
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: changedetection
+                port:
+                  number: 5000

apps/default/havenllo.yaml

@@ -1,12 +1,14 @@
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  labels:
-    app.kubernetes.io/name: havenllo
   name: havenllo
   namespace: default
+  labels:
+    app.kubernetes.io/name: havenllo
 spec:
   replicas: 1
+  revisionHistoryLimit: 10
   selector:
     matchLabels:
       app.kubernetes.io/name: havenllo
@@ -18,45 +20,45 @@ spec:
         app.kubernetes.io/name: havenllo
     spec:
       containers:
-      - env:
+        - name: havenllo
+          image: git.ivanch.me/ivanch/havenllo:latest
+          imagePullPolicy: Always
+          env:
             - name: HAVENLLO_DATABASE_PATH
               value: /data/havenllo.db
             - name: HAVENLLO_LISTEN_ADDR
               value: :8080
-        image: git.ivanch.me/ivanch/havenllo:latest
+          ports:
-        imagePullPolicy: Always
+            - containerPort: 8080
+              name: http
+              protocol: TCP
           livenessProbe:
-          failureThreshold: 3
             httpGet:
               path: /api/health
               port: http
               scheme: HTTP
             initialDelaySeconds: 10
             periodSeconds: 10
-          successThreshold: 1
             timeoutSeconds: 2
-        name: havenllo
-        ports:
-        - containerPort: 8080
-          name: http
-          protocol: TCP
-        readinessProbe:
             failureThreshold: 3
+            successThreshold: 1
+          readinessProbe:
             httpGet:
               path: /api/health
               port: http
               scheme: HTTP
             initialDelaySeconds: 2
             periodSeconds: 5
-          successThreshold: 1
             timeoutSeconds: 2
+            failureThreshold: 3
+            successThreshold: 1
           resources:
-          limits:
-            cpu: 500m
-            memory: 256Mi
             requests:
               cpu: 50m
               memory: 64Mi
+            limits:
+              cpu: 500m
+              memory: 256Mi
           securityContext:
             allowPrivilegeEscalation: false
             capabilities:
@@ -67,50 +69,28 @@ spec:
           terminationMessagePath: /dev/termination-log
           terminationMessagePolicy: File
           volumeMounts:
-        - mountPath: /data
+            - name: data
-          name: data
+              mountPath: /data
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: havenllo-data
       dnsPolicy: ClusterFirst
       restartPolicy: Always
       schedulerName: default-scheduler
       securityContext: {}
       terminationGracePeriodSeconds: 30
-      volumes:
-      - name: data
-        persistentVolumeClaim:
-          claimName: havenllo-data
-status:
-  availableReplicas: 1
-  conditions:
-  - lastTransitionTime: '2026-07-14T13:21:13Z'
-    lastUpdateTime: '2026-07-21T21:06:45Z'
-    message: ReplicaSet "havenllo-5d4f8ccb4f" has successfully progressed.
-    reason: NewReplicaSetAvailable
-    status: 'True'
-    type: Progressing
-  - lastTransitionTime: '2026-08-28T06:04:17Z'
-    lastUpdateTime: '2026-08-28T06:04:17Z'
-    message: Deployment has minimum availability.
-    reason: MinimumReplicasAvailable
-    status: 'True'
-    type: Available
-  observedGeneration: 41
-  readyReplicas: 1
-  replicas: 1
-  terminatingReplicas: 0
-  updatedReplicas: 1
 ---
 apiVersion: v1
 kind: Service
 metadata:
-  labels:
-    app.kubernetes.io/name: havenllo
   name: havenllo
   namespace: default
+  labels:
+    app.kubernetes.io/name: havenllo
 spec:
-  internalTrafficPolicy: Cluster
+  type: ClusterIP
-  ipFamilies:
+  sessionAffinity: None
-  - IPv4
-  ipFamilyPolicy: SingleStack
   ports:
     - name: http
       port: 8080
@@ -118,54 +98,28 @@ spec:
       targetPort: 8080
   selector:
     app.kubernetes.io/name: havenllo
-  sessionAffinity: None
+  ipFamilies:
-  type: ClusterIP
+    - IPv4
-status:
+  ipFamilyPolicy: SingleStack
-  loadBalancer: {}
+  internalTrafficPolicy: Cluster
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: havenllo
   namespace: default
+  labels:
+    app.kubernetes.io/name: havenllo
 spec:
   ingressClassName: nginx-https
   rules:
     - host: havenllo.haven
       http:
         paths:
-      - backend:
+          - path: /
+            pathType: Prefix
+            backend:
               service:
                 name: havenllo
                 port:
                   number: 8080
-        path: /
-        pathType: Prefix
-  tls:
-  - hosts:
-    - havenllo.haven
-    secretName: havenllo-tls
-status:
-  loadBalancer:
-    ingress:
-    - ip: 192.168.20.204
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: havenllo-data
-  namespace: default
-spec:
-  accessModes:
-  - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: nfs-client
-  volumeMode: Filesystem
-status:
-  accessModes:
-  - ReadWriteOnce
-  capacity:
-    storage: 1Gi
-  phase: Bound

apps/default/homepage.yaml

@@ -1,226 +1,206 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: homepage
+  namespace: default
+  labels:
+    app.kubernetes.io/name: homepage
+secrets:
+  - name: homepage
+---
+apiVersion: v1
+kind: Secret
+type: kubernetes.io/service-account-token
+metadata:
+  name: homepage
+  namespace: default
+  labels:
+    app.kubernetes.io/name: homepage
+  annotations:
+    kubernetes.io/service-account.name: homepage
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: homepage
+  labels:
+    app.kubernetes.io/name: homepage
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - namespaces
+      - pods
+      - nodes
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - extensions
+      - networking.k8s.io
+    resources:
+      - ingresses
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - traefik.io
+    resources:
+      - ingressroutes
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - gateway.networking.k8s.io
+    resources:
+      - httproutes
+      - gateways
+    verbs:
+      - get
+      - list
+  - apiGroups:
+      - metrics.k8s.io
+    resources:
+      - nodes
+      - pods
+    verbs:
+      - get
+      - list
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: homepage
+  labels:
+    app.kubernetes.io/name: homepage
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: homepage
+subjects:
+  - kind: ServiceAccount
+    name: homepage
+    namespace: default
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  labels:
-    app.kubernetes.io/name: homepage
   name: homepage
   namespace: default
+  labels:
+    app.kubernetes.io/name: homepage
 spec:
+  revisionHistoryLimit: 3
   replicas: 1
+  strategy:
+    type: RollingUpdate
   selector:
     matchLabels:
       app.kubernetes.io/name: homepage
-  strategy:
-    type: Recreate
   template:
     metadata:
       labels:
         app.kubernetes.io/name: homepage
+      annotations:
+        configmap.reloader/checksum: '{{ include (print $.Template.BasePath "/app/config/services.yaml") . | sha256sum }}'
     spec:
+      serviceAccountName: homepage
       automountServiceAccountToken: true
+      enableServiceLinks: true
       containers:
-      - env:
+        - name: homepage
-        - name: POD_IP
+          image: "ghcr.io/gethomepage/homepage:latest"
-          valueFrom:
-            fieldRef:
-              apiVersion: v1
-              fieldPath: status.podIP
-        - name: HOMEPAGE_ALLOWED_HOSTS
-          value: '*'
-        image: ghcr.io/gethomepage/homepage:latest
           imagePullPolicy: Always
+          env:
+            - name: HOMEPAGE_ALLOWED_HOSTS
+              value: "*"
+          ports:
+            - name: http
+              containerPort: 3000
+              protocol: TCP
           livenessProbe:
-          failureThreshold: 3
             httpGet:
               path: /
               port: 3000
-            scheme: HTTP
             initialDelaySeconds: 30
             periodSeconds: 10
-          successThreshold: 1
-          timeoutSeconds: 1
-        name: homepage
-        ports:
-        - containerPort: 3000
-          name: http
-          protocol: TCP
           readinessProbe:
-          failureThreshold: 3
             httpGet:
               path: /
               port: 3000
-            scheme: HTTP
             initialDelaySeconds: 5
             periodSeconds: 5
-          successThreshold: 1
-          timeoutSeconds: 1
-        resources:
-          limits:
-            cpu: 500m
-            memory: 512Mi
-          requests:
-            cpu: 100m
-            memory: 128Mi
-        terminationMessagePath: /dev/termination-log
-        terminationMessagePolicy: File
           volumeMounts:
-        - mountPath: /app/config/logs
+            - name: logs
-          name: logs
+              mountPath: /app/config/logs
-        - mountPath: /app/config
+            - name: homepage-config
-          name: homepage-config
+              mountPath: /app/config
-        - mountPath: /app/public/images
+            - name: homepage-config
-          name: homepage-config
+              mountPath: /app/public/images
               subPath: images
-      dnsPolicy: ClusterFirst
+          resources:
-      enableServiceLinks: true
+            requests:
-      restartPolicy: Always
+              memory: "128Mi"
-      schedulerName: default-scheduler
+              cpu: "100m"
-      securityContext: {}
+            limits:
-      serviceAccount: homepage
+              memory: "512Mi"
-      serviceAccountName: homepage
+              cpu: "500m"
-      terminationGracePeriodSeconds: 30
       volumes:
         - name: homepage-config
           persistentVolumeClaim:
             claimName: homepage-config
-      - emptyDir: {}
+        - name: logs
-        name: logs
+          emptyDir: {}
-status:
-  availableReplicas: 1
-  conditions:
-  - lastTransitionTime: '2026-05-19T01:51:47Z'
-    lastUpdateTime: '2026-08-17T09:07:50Z'
-    message: ReplicaSet "homepage-7b47bf67fb" has successfully progressed.
-    reason: NewReplicaSetAvailable
-    status: 'True'
-    type: Progressing
-  - lastTransitionTime: '2026-08-28T06:04:23Z'
-    lastUpdateTime: '2026-08-28T06:04:23Z'
-    message: Deployment has minimum availability.
-    reason: MinimumReplicasAvailable
-    status: 'True'
-    type: Available
-  observedGeneration: 96
-  readyReplicas: 1
-  replicas: 1
-  terminatingReplicas: 0
-  updatedReplicas: 1
----
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app.kubernetes.io/name: homepage
-  name: homepage
-  namespace: default
-spec:
-  internalTrafficPolicy: Cluster
-  ipFamilies:
-  - IPv4
-  ipFamilyPolicy: SingleStack
-  ports:
-  - name: http
-    port: 3000
-    protocol: TCP
-    targetPort: http
-  selector:
-    app.kubernetes.io/name: homepage
-  sessionAffinity: None
-  type: ClusterIP
-status:
-  loadBalancer: {}
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  labels:
-    app.kubernetes.io/name: homepage
-  name: homepage
-  namespace: default
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: homepage.haven
-    http:
-      paths:
-      - backend:
-          service:
-            name: homepage
-            port:
-              number: 3000
-        path: /
-        pathType: Prefix
-status:
-  loadBalancer:
-    ingress:
-    - ip: 192.168.20.204
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: homepage-config
   namespace: default
+  annotations:
+    nfs.io/storage-path: "homepage-config"
 spec:
+  storageClassName: "nfs-client"
   accessModes:
     - ReadWriteMany
   resources:
     requests:
       storage: 1Gi
-  storageClassName: nfs-client
-  volumeMode: Filesystem
-status:
-  accessModes:
-  - ReadWriteMany
-  capacity:
-    storage: 1Gi
-  phase: Bound
 ---
 apiVersion: v1
-data:
+kind: Service
-  bookmarks.yaml: "- Developer:\n    - Github:\n        - abbr: GH\n          href:\
-    \ https://github.com/\n"
-  custom.css: ''
-  custom.js: ''
-  docker.yaml: ''
-  kubernetes.yaml: 'mode: cluster
-
-    '
-  services.yaml: "- Essentials:\n    - AdGuard Home:\n        href: http://adguard.haven/\n\
-    \        icon: adguard-home\n        widget:\n          type: adguard\n      \
-    \    url: http://adguard.haven/\n          username: ivanch\n          password:\
-    \ ESVEPnull\n    - AdGuard Home 2:\n        href: http://adguard2.haven/\n   \
-    \     icon: adguard-home\n        widget:\n          type: adguard\n         \
-    \ url: http://adguard2.haven/\n          username: ivanch\n          password:\
-    \ ESVEPnull\n    - Home Assistant:\n        href: http://homeassistant.haven/\n\
-    \    - Traefik:\n        href: http://traefik.haven/\n    - Dockge:\n        href:\
-    \ http://dockge.haven/\n    - Proxmox:\n        href: https://proxmox.haven:8006/\n\
-    \        widget:\n          type: proxmox\n          url: https://proxmox.haven:8006/\n\
-    \          token: homepage@pam!token\n          secret: 7cadfc2d-560a-4bb4-8d5f-a29f394bc9a0\n\
-    \n- Media:\n    - Jellyfin:\n        href: http://tv.haven/\n        icon: jellyfin.png\n\
-    \        widget:\n          type: jellyfin\n          url: http://tv.haven/\n\
-    \          key: c933070d9c8341bf8c64e7a792aaa6b9\n          enableBlocks: true\n\
-    \          enableNowPlaying: true\n    - Sonarr:\n        href: http://sonarr.haven/\n\
-    \    - Radarr:\n        href: http://radarr.haven/\n    - Prowlarr:\n        href:\
-    \ http://prowlarr.haven/\n\n- Storage:\n    - Transmission:\n        href: http://transmission.haven/\n\
-    \    - qBitTorrent:\n        href: http://qbittorrent.haven/\n    - OpenMediaVault:\n\
-    \        href: http://omv.haven/\n    - ArchiveBox:\n        href: http://archive.haven/\n\
-    \    - FileBrowser:\n        href: http://files.haven/\n    - Paperless:\n   \
-    \     href: http://paperless.haven/\n\n- Other:\n    - Uptime Kuma:\n        href:\
-    \ http://uptimekuma.haven/\n    - WireGuard:\n        href: http://vpn.haven/\n\
-    \    - Beszel:\n        href: http://beszel.haven/\n\n- Zephyr:\n    - Gitea:\n\
-    \        href: http://gitea.ivanch.me/\n    - Portainer:\n        href: http://portainer.ivanch.me/\n\
-    \    - Nginx Proxy Manager:\n        href: http://manager.ivanch.me/\n    - Homepage:\n\
-    \        href: http://ivanch.me/\n"
-  settings.yaml: ''
-  widgets.yaml: "- kubernetes:\n    cluster:\n      show: true\n      cpu: true\n\
-    \      memory: true\n      # network: true\n      showLabel: true\n      label:\
-    \ \"Haven\"\n    nodes:\n      show: true\n      cpu: true\n      memory: true\n\
-    \      showLabel: true\n- resources:\n    backend: resources\n    expanded: true\n\
-    \    cpu: true\n    memory: true\n    network: default\n- search:\n    provider:\
-    \ duckduckgo\n    target: _blank\n"
-kind: ConfigMap
 metadata:
-  labels:
-    app.kubernetes.io/name: homepage
   name: homepage
   namespace: default
+  labels:
+    app.kubernetes.io/name: homepage
+spec:
+  type: ClusterIP
+  ports:
+    - port: 3000
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    app.kubernetes.io/name: homepage
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: homepage
+  namespace: default
+  labels:
+    app.kubernetes.io/name: homepage
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "homepage.haven"
+      http:
+        paths:
+          - path: "/"
+            pathType: Prefix
+            backend:
+              service:
+                name: homepage
+                port:
+                  number: 3000

apps/default/it-tools.yaml

@@ -1,3 +1,4 @@
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -8,58 +9,30 @@ spec:
   selector:
     matchLabels:
       app: it-tools
-  strategy:
-    type: Recreate
   template:
     metadata:
       labels:
         app: it-tools
     spec:
       containers:
-      - image: corentinth/it-tools:latest
+        - name: it-tools
+          image: corentinth/it-tools:latest
           imagePullPolicy: Always
-        name: it-tools
           ports:
             - containerPort: 80
-          protocol: TCP
           readinessProbe:
-          failureThreshold: 3
             httpGet:
               path: /
               port: 80
-            scheme: HTTP
             initialDelaySeconds: 5
             periodSeconds: 10
-          successThreshold: 1
+          resources:
-          timeoutSeconds: 1
+            requests:
-        resources: {}
+              memory: "64Mi"
-        terminationMessagePath: /dev/termination-log
+              cpu: "50m"
-        terminationMessagePolicy: File
+            limits:
-      dnsPolicy: ClusterFirst
+              memory: "128Mi"
-      restartPolicy: Always
+              cpu: "200m"
-      schedulerName: default-scheduler
-      securityContext: {}
-      terminationGracePeriodSeconds: 30
-status:
-  availableReplicas: 1
-  conditions:
-  - lastTransitionTime: '2026-05-19T01:51:47Z'
-    lastUpdateTime: '2026-07-22T10:14:45Z'
-    message: ReplicaSet "it-tools-6fc797dd48" has successfully progressed.
-    reason: NewReplicaSetAvailable
-    status: 'True'
-    type: Progressing
-  - lastTransitionTime: '2026-08-28T06:04:26Z'
-    lastUpdateTime: '2026-08-28T06:04:26Z'
-    message: Deployment has minimum availability.
-    reason: MinimumReplicasAvailable
-    status: 'True'
-    type: Available
-  observedGeneration: 93
-  readyReplicas: 1
-  replicas: 1
-  terminatingReplicas: 0
-  updatedReplicas: 1
 ---
 apiVersion: v1
 kind: Service
@@ -67,20 +40,12 @@ metadata:
   name: it-tools-svc
   namespace: default
 spec:
-  internalTrafficPolicy: Cluster
-  ipFamilies:
-  - IPv4
-  ipFamilyPolicy: SingleStack
-  ports:
-  - port: 80
-    protocol: TCP
-    targetPort: 80
   selector:
     app: it-tools
-  sessionAffinity: None
+  ports:
-  type: ClusterIP
+    - protocol: TCP
-status:
+      port: 80
-  loadBalancer: {}
+      targetPort: 80
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -90,17 +55,13 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-  - host: tools.haven
+    - host: "tools.haven"
       http:
         paths:
-      - backend:
+          - path: /
+            pathType: Prefix
+            backend:
               service:
                 name: it-tools-svc
                 port:
                   number: 80
-        path: /
-        pathType: Prefix
-status:
-  loadBalancer:
-    ingress:
-    - ip: 192.168.20.204

apps/default/notepad.yaml

@@ -1,34 +1,14 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: notepad-data
-  namespace: default
-  annotations:
-    nfs.io/storage-path: notepad-data
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: nfs-client
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: notepad
   namespace: default
-  labels:
-    app: notepad
 spec:
   replicas: 1
   selector:
     matchLabels:
       app: notepad
-  # RWO PVC + single replica: Recreate avoids the two-ReplicaSet PVC fight
-  # on rollout (see homelab-deploy skill: single-writer state).
-  strategy:
-    type: Recreate
   template:
     metadata:
       labels:
@@ -41,7 +21,10 @@ spec:
           command:
             - sh
             - -c
-            - mkdir -p /var/www/html/_tmp && cp -n /var/www/html/notes.htaccess /var/www/html/_tmp/.htaccess 2>/dev/null; exec docker-php-entrypoint apache2-foreground
+            - >-
+              mkdir -p /var/www/html/_tmp &&
+              cp -n /var/www/html/notes.htaccess /var/www/html/_tmp/.htaccess 2>/dev/null;
+              exec docker-php-entrypoint apache2-foreground
           ports:
             - containerPort: 80
           resources:
@@ -58,6 +41,7 @@ spec:
         - name: notepad-data
           persistentVolumeClaim:
             claimName: notepad-data
+
 ---
 apiVersion: v1
 kind: Service
@@ -72,6 +56,21 @@ spec:
     - port: 80
       targetPort: 80
 ---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: notepad-data
+  namespace: default
+  annotations:
+    nfs.io/storage-path: "notepad-data"
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -90,6 +89,3 @@ spec:
                 name: notepad
                 port:
                   number: 80
-# NOTE: the Argo Application manifest for notepad lives in apps/root/notepad.yaml
-# (watched by the root app-of-apps). Do not add Application objects to this
-# directory — this path is what the Application itself watches.

apps/default/openwebui.yaml

@@ -8,8 +8,6 @@ spec:
   selector:
     matchLabels:
       app: openwebui
-  strategy:
-    type: Recreate
   template:
     metadata:
       labels:
@@ -18,103 +16,93 @@ spec:
       affinity:
         nodeAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
-          - preference:
+            - weight: 100
+              preference:
                 matchExpressions:
                   - key: kubernetes.io/hostname
                     operator: In
                     values:
                       - iris
-            weight: 100
       containers:
-      - env:
+        - name: openwebui
+          image: ghcr.io/open-webui/open-webui:main-slim
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 8080
+          env:
             - name: PUID
-          value: '1000'
+              value: "1000"
             - name: PGID
-          value: '1000'
+              value: "1000"
             - name: TZ
-          value: America/Sao_Paulo
+              value: "America/Sao_Paulo"
             - name: DATABASE_URL
               valueFrom:
                 secretKeyRef:
-              key: DATABASE_URL
                   name: openwebui-secret
-        - name: PLAYWRIGHT_WS_URL
+                  key: DATABASE_URL
-          value: ws://browserless.default.svc.cluster.local:3000
-        image: ghcr.io/open-webui/open-webui:main-slim
-        imagePullPolicy: Always
-        name: openwebui
-        ports:
-        - containerPort: 8080
-          protocol: TCP
           resources:
-          limits:
-            cpu: '1'
-            memory: 2Gi
             requests:
-            cpu: 250m
+              cpu: "250m"
-            memory: 512Mi
+              memory: "512Mi"
-        terminationMessagePath: /dev/termination-log
+            limits:
-        terminationMessagePolicy: File
+              cpu: "1000m"
+              memory: "2Gi"
           volumeMounts:
-        - mountPath: /app/backend/data
+            - name: openwebui-data
-          name: openwebui-data
+              mountPath: /app/backend/data
-      dnsPolicy: ClusterFirst
-      restartPolicy: Always
-      schedulerName: default-scheduler
-      securityContext: {}
-      terminationGracePeriodSeconds: 30
       volumes:
         - name: openwebui-data
           persistentVolumeClaim:
             claimName: openwebui-data
+---
 apiVersion: v1
 kind: Service
 metadata:
   name: openwebui
   namespace: default
 spec:
-  internalTrafficPolicy: Cluster
+  type: ClusterIP
-  ipFamilies:
-  - IPv4
-  ipFamilyPolicy: SingleStack
-  ports:
-  - port: 8080
-    protocol: TCP
-    targetPort: 8080
   selector:
     app: openwebui
-  sessionAffinity: None
+  ports:
-  type: ClusterIP
+    - port: 8080
+      targetPort: 8080
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: openwebui-data
+  namespace: default
+  annotations:
+    nfs.io/storage-path: "openwebui-data"
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi
+    limits:
+      storage: 10Gi
+---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: openwebui
   namespace: default
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-body-size: "50m"
 spec:
   ingressClassName: nginx
   rules:
     - host: openwebui.haven
       http:
         paths:
-      - backend:
+          - path: /
+            pathType: Prefix
+            backend:
               service:
                 name: openwebui
                 port:
                   number: 8080
-        path: /
-        pathType: Prefix
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: openwebui-data
-  namespace: default
-spec:
-  accessModes:
-  - ReadWriteOnce
-  resources:
-    limits:
-      storage: 10Gi
-    requests:
-      storage: 5Gi
-  storageClassName: nfs-client
-  volumeMode: Filesystem

apps/default/paperless.yaml

@@ -1,3 +1,5 @@
+---
+# 1) Deployment
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -8,8 +10,6 @@ spec:
   selector:
     matchLabels:
       app: paperless
-  strategy:
-    type: Recreate
   template:
     metadata:
       labels:
@@ -18,27 +18,30 @@ spec:
       affinity:
         nodeAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
-          - preference:
+            - weight: 100
+              preference:
                 matchExpressions:
                   - key: kubernetes.io/hostname
                     operator: In
                     values:
                       - iris
-            weight: 100
       containers:
-      - env:
+        - name: paperless
+          image: ghcr.io/paperless-ngx/paperless-ngx:latest
+          imagePullPolicy: Always
+          env:
             - name: PUID
-          value: '1000'
+              value: "1000"
             - name: PGID
-          value: '1000'
+              value: "1000"
             - name: PAPERLESS_URL
-          value: http://paperless.haven
+              value: "http://paperless.haven"
             - name: PAPERLESS_TIME_ZONE
-          value: America/Sao_Paulo
+              value: "America/Sao_Paulo"
             - name: PAPERLESS_OCR_LANGUAGE
-          value: por
+              value: "por"
             - name: PAPERLESS_OCR_LANGUAGES
-          value: por
+              value: "por"
             - name: PAPERLESS_OCR_USER_ARGS
               value: '{"invalidate_digital_signatures": true}'
             - name: PAPERLESS_DBHOST
@@ -46,83 +49,88 @@ spec:
             - name: PAPERLESS_DBNAME
               valueFrom:
                 secretKeyRef:
-              key: PAPERLESS_DBNAME
                   name: paperless-secret
+                  key: PAPERLESS_DBNAME
             - name: PAPERLESS_DBUSER
               valueFrom:
                 secretKeyRef:
-              key: PAPERLESS_DBUSER
                   name: paperless-secret
+                  key: PAPERLESS_DBUSER
             - name: PAPERLESS_DBPASSWORD
               valueFrom:
                 secretKeyRef:
-              key: PAPERLESS_DBPASSWORD
                   name: paperless-secret
+                  key: PAPERLESS_DBPASSWORD
             - name: PAPERLESS_REDIS
-          value: redis://redis.haven:6379
+              value: "redis://redis.haven:6379"
             - name: PAPERLESS_PORT
-          value: '8000'
+              value: "8000"
             - name: PAPERLESS_SECRET_KEY
               valueFrom:
                 secretKeyRef:
-              key: PAPERLESS_SECRET_KEY
                   name: paperless-secret
-        image: ghcr.io/paperless-ngx/paperless-ngx:latest
+                  key: PAPERLESS_SECRET_KEY
-        imagePullPolicy: Always
-        name: paperless
           ports:
             - containerPort: 8000
               name: paperless-port
-          protocol: TCP
           resources:
-          limits:
-            cpu: '4'
-            memory: 1Gi
             requests:
-            cpu: 100m
+              cpu: "100m"
-            memory: 256Mi
+              memory: "256Mi"
-        terminationMessagePath: /dev/termination-log
+            limits:
-        terminationMessagePolicy: File
+              cpu: "4000m"
+              memory: "1Gi"
           volumeMounts:
-        - mountPath: /usr/src/paperless/data
+            - name: paperless-data
-          name: paperless-data
               subPath: data
-        - mountPath: /usr/src/paperless/media
+              mountPath: /usr/src/paperless/data
-          name: paperless-data
+            - name: paperless-data
               subPath: media
-        - mountPath: /usr/src/paperless/export
+              mountPath: /usr/src/paperless/media
-          name: paperless-data
+            - name: paperless-data
               subPath: export
-        - mountPath: /usr/src/paperless/consume
+              mountPath: /usr/src/paperless/export
-          name: paperless-data
+            - name: paperless-data
               subPath: consume
-      dnsPolicy: ClusterFirst
+              mountPath: /usr/src/paperless/consume
-      restartPolicy: Always
-      schedulerName: default-scheduler
-      securityContext: {}
-      terminationGracePeriodSeconds: 30
       volumes:
         - name: paperless-data
           persistentVolumeClaim:
             claimName: paperless-data
+---
+# 2) Service
 apiVersion: v1
 kind: Service
 metadata:
   name: paperless
   namespace: default
 spec:
-  internalTrafficPolicy: Cluster
+  type: ClusterIP
-  ipFamilies:
-  - IPv4
-  ipFamilyPolicy: SingleStack
-  ports:
-  - port: 8000
-    protocol: TCP
-    targetPort: paperless-port
   selector:
     app: paperless
-  sessionAffinity: None
+  ports:
-  type: ClusterIP
+    - port: 8000
+      targetPort: paperless-port
+---
+# 3) PersistentVolumeClaim
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: paperless-data
+  namespace: default
+  annotations:
+    nfs.io/storage-path: "paperless-data"
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 5Gi
+    limits:
+      storage: 15Gi
+---
+# 4) Ingress
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -134,25 +142,10 @@ spec:
     - host: paperless.haven
       http:
         paths:
-      - backend:
+          - path: /
+            pathType: Prefix
+            backend:
               service:
                 name: paperless
                 port:
                   number: 8000
-        path: /
-        pathType: Prefix
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: paperless-data
-  namespace: default
-spec:
-  accessModes:
-  - ReadWriteMany
-  resources:
-    limits:
-      storage: 15Gi
-    requests:
-      storage: 5Gi
-  storageClassName: nfs-client
-  volumeMode: Filesystem

apps/default/qbittorrent.yaml

@@ -1,3 +1,5 @@
+---
+# 1) Deployment
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -8,8 +10,6 @@ spec:
   selector:
     matchLabels:
       app: qbittorrent
-  strategy:
-    type: Recreate
   template:
     metadata:
       labels:
@@ -18,159 +18,115 @@ spec:
       affinity:
         nodeAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
-          - preference:
+          - weight: 100
+            preference:
               matchExpressions:
               - key: kubernetes.io/hostname
                 operator: In
                 values:
                 - iris
-            weight: 100
       containers:
-      - env:
+        - name: qbittorrent
-        - name: PUID
-          value: '1000'
-        - name: PGID
-          value: '1000'
-        - name: TZ
-          value: Etc/UTC
-        - name: WEBUI_PORT
-          value: '4300'
-        - name: TORRENTING_PORT
-          value: '6881'
           image: lscr.io/linuxserver/qbittorrent:5.0.4
           imagePullPolicy: Always
-        name: qbittorrent
+          resources:
+            requests:
+              cpu: 200m
+              memory: 256Mi
+            limits:
+              cpu: 1000m
+              memory: 512Mi
           ports:
             - containerPort: 4300
               name: webui-port
-          protocol: TCP
             - containerPort: 6881
               name: qbit-tcp
               protocol: TCP
             - containerPort: 6881
               name: qbit-udp
               protocol: UDP
-        resources:
+          env:
-          limits:
+            - name: PUID
-            cpu: '1'
+              value: "1000"
-            memory: 512Mi
+            - name: PGID
-          requests:
+              value: "1000"
-            cpu: 200m
+            - name: TZ
-            memory: 256Mi
+              value: "Etc/UTC"
-        terminationMessagePath: /dev/termination-log
+            - name: WEBUI_PORT
-        terminationMessagePolicy: File
+              value: "4300"
+            - name: TORRENTING_PORT
+              value: "6881"
           volumeMounts:
-        - mountPath: /config
+            - name: qbittorrent-config
-          name: qbittorrent-config
+              mountPath: /config
-        - mountPath: /nas
+            - name: nas-storage
-          name: nas-storage
+              mountPath: /nas
-      dnsPolicy: ClusterFirst
-      restartPolicy: Always
-      schedulerName: default-scheduler
-      securityContext: {}
-      terminationGracePeriodSeconds: 30
       volumes:
         - name: qbittorrent-config
           persistentVolumeClaim:
             claimName: qbittorrent-config
         - name: nas-storage
           nfs:
-          path: /export/Storage
             server: 192.168.15.99
-status:
+            path: /export/Storage
-  availableReplicas: 1
-  conditions:
-  - lastTransitionTime: '2026-05-19T01:51:48Z'
-    lastUpdateTime: '2026-07-22T10:14:39Z'
-    message: ReplicaSet "qbittorrent-56dbf5f6c" has successfully progressed.
-    reason: NewReplicaSetAvailable
-    status: 'True'
-    type: Progressing
-  - lastTransitionTime: '2026-08-28T06:04:17Z'
-    lastUpdateTime: '2026-08-28T06:04:17Z'
-    message: Deployment has minimum availability.
-    reason: MinimumReplicasAvailable
-    status: 'True'
-    type: Available
-  observedGeneration: 100
-  readyReplicas: 1
-  replicas: 1
-  terminatingReplicas: 0
-  updatedReplicas: 1
 ---
+# PVC
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: qbittorrent-config
+  namespace: default
+  annotations:
+    nfs.io/storage-path: "qbittorrent-config"
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+---
+# 2) Service
 apiVersion: v1
 kind: Service
 metadata:
   name: qbittorrent
   namespace: default
 spec:
-  externalTrafficPolicy: Cluster
+  type: NodePort
-  internalTrafficPolicy: Cluster
-  ipFamilies:
-  - IPv4
-  ipFamilyPolicy: SingleStack
-  ports:
-  - name: webui
-    nodePort: 30948
-    port: 4300
-    protocol: TCP
-    targetPort: webui-port
-  - name: torrent-tcp
-    nodePort: 30183
-    port: 6881
-    protocol: TCP
-    targetPort: qbit-tcp
-  - name: torrent-udp
-    nodePort: 30183
-    port: 6881
-    protocol: UDP
-    targetPort: qbit-udp
   selector:
     app: qbittorrent
-  sessionAffinity: None
+  ports:
-  type: NodePort
+    - port: 4300
-status:
+      targetPort: webui-port
-  loadBalancer: {}
+      name: webui
+    - port: 6881
+      targetPort: qbit-tcp
+      name: torrent-tcp
+      protocol: TCP
+    - port: 6881
+      targetPort: qbit-udp
+      name: torrent-udp
+      protocol: UDP
 ---
+# 4) Ingress (Traefik)
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: qbittorrent
   namespace: default
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: web
 spec:
   ingressClassName: nginx
   rules:
     - host: qbittorrent.haven
       http:
         paths:
-      - backend:
+          - path: /
+            pathType: Prefix
+            backend:
               service:
                 name: qbittorrent
                 port:
                   number: 4300
-        path: /
-        pathType: Prefix
-status:
-  loadBalancer:
-    ingress:
-    - ip: 192.168.20.204
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: qbittorrent-config
-  namespace: default
-spec:
-  accessModes:
-  - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: nfs-client
-  volumeMode: Filesystem
-status:
-  accessModes:
-  - ReadWriteOnce
-  capacity:
-    storage: 1Gi
-  phase: Bound

apps/default/searxng.yaml

@@ -1,3 +1,5 @@
+---
+# 1) Deployment
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -8,90 +10,70 @@ spec:
   selector:
     matchLabels:
       app: searxng
-  strategy:
-    type: Recreate
   template:
     metadata:
       labels:
         app: searxng
     spec:
+      enableServiceLinks: false
       containers:
-      - env:
+        - name: searxng
-        - name: PUID
-          value: '1000'
-        - name: PGID
-          value: '1000'
           image: searxng/searxng:latest
           imagePullPolicy: Always
-        name: searxng
+          env:
+            - name: PUID
+              value: "1000"
+            - name: PGID
+              value: "1000"
           ports:
             - containerPort: 8080
               name: searxng-port
-          protocol: TCP
           resources:
-          limits:
-            cpu: 500m
-            memory: 512Mi
             requests:
-            cpu: 100m
+              cpu: "100m"
-            memory: 256Mi
+              memory: "256Mi"
-        terminationMessagePath: /dev/termination-log
+            limits:
-        terminationMessagePolicy: File
+              cpu: "500m"
+              memory: "512Mi"
           volumeMounts:
-        - mountPath: /etc/searxng
+            - name: searxng-config
-          name: searxng-config
+              mountPath: /etc/searxng
-      dnsPolicy: ClusterFirst
-      enableServiceLinks: false
-      restartPolicy: Always
-      schedulerName: default-scheduler
-      securityContext: {}
-      terminationGracePeriodSeconds: 30
       volumes:
         - name: searxng-config
           persistentVolumeClaim:
             claimName: searxng-config
-status:
-  availableReplicas: 1
-  conditions:
-  - lastTransitionTime: '2026-05-19T01:51:48Z'
-    lastUpdateTime: '2026-07-22T10:15:23Z'
-    message: ReplicaSet "searxng-d6869bf47" has successfully progressed.
-    reason: NewReplicaSetAvailable
-    status: 'True'
-    type: Progressing
-  - lastTransitionTime: '2026-08-28T06:04:24Z'
-    lastUpdateTime: '2026-08-28T06:04:24Z'
-    message: Deployment has minimum availability.
-    reason: MinimumReplicasAvailable
-    status: 'True'
-    type: Available
-  observedGeneration: 93
-  readyReplicas: 1
-  replicas: 1
-  terminatingReplicas: 0
-  updatedReplicas: 1
 ---
+# 2) Service
 apiVersion: v1
 kind: Service
 metadata:
   name: searxng
   namespace: default
 spec:
-  internalTrafficPolicy: Cluster
+  type: ClusterIP
-  ipFamilies:
-  - IPv4
-  ipFamilyPolicy: SingleStack
-  ports:
-  - port: 8080
-    protocol: TCP
-    targetPort: searxng-port
   selector:
     app: searxng
-  sessionAffinity: None
+  ports:
-  type: ClusterIP
+    - port: 8080
-status:
+      targetPort: searxng-port
-  loadBalancer: {}
 ---
+# 3) PersistentVolumeClaim
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: searxng-config
+  namespace: default
+  annotations:
+    nfs.io/storage-path: "searxng-config"
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi
+---
+# 4) Ingress
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -103,34 +85,10 @@ spec:
     - host: search.haven
       http:
         paths:
-      - backend:
+          - path: /
+            pathType: Prefix
+            backend:
               service:
                 name: searxng
                 port:
                   number: 8080
-        path: /
-        pathType: Prefix
-status:
-  loadBalancer:
-    ingress:
-    - ip: 192.168.20.204
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: searxng-config
-  namespace: default
-spec:
-  accessModes:
-  - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: nfs-client
-  volumeMode: Filesystem
-status:
-  accessModes:
-  - ReadWriteMany
-  capacity:
-    storage: 1Gi
-  phase: Bound

apps/default/sonic.yaml

@@ -1,79 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: sonic
-  namespace: default
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: sonic
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        app: sonic
-    spec:
-      containers:
-      - env:
-        - name: SEARCH_BACKEND_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              key: password
-              name: password
-        image: archivebox/sonic:latest
-        imagePullPolicy: Always
-        name: sonic
-        ports:
-        - containerPort: 1491
-          protocol: TCP
-        resources: {}
-        terminationMessagePath: /dev/termination-log
-        terminationMessagePolicy: File
-      dnsPolicy: ClusterFirst
-      restartPolicy: Always
-      schedulerName: default-scheduler
-      securityContext: {}
-      terminationGracePeriodSeconds: 30
-status:
-  availableReplicas: 1
-  conditions:
-  - lastTransitionTime: '2026-05-19T01:51:47Z'
-    lastUpdateTime: '2026-07-22T10:15:06Z'
-    message: ReplicaSet "sonic-b89458d6c" has successfully progressed.
-    reason: NewReplicaSetAvailable
-    status: 'True'
-    type: Progressing
-  - lastTransitionTime: '2026-08-28T06:04:13Z'
-    lastUpdateTime: '2026-08-28T06:04:13Z'
-    message: Deployment has minimum availability.
-    reason: MinimumReplicasAvailable
-    status: 'True'
-    type: Available
-  observedGeneration: 93
-  readyReplicas: 1
-  replicas: 1
-  terminatingReplicas: 0
-  updatedReplicas: 1
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: sonic-svc
-  namespace: default
-spec:
-  internalTrafficPolicy: Cluster
-  ipFamilies:
-  - IPv4
-  ipFamilyPolicy: SingleStack
-  ports:
-  - port: 1491
-    protocol: TCP
-    targetPort: 1491
-  selector:
-    app: sonic
-  sessionAffinity: None
-  type: ClusterIP
-status:
-  loadBalancer: {}

apps/default/stirlingpdf.yaml

@@ -1,157 +1,113 @@
+---
+# 1) Deployment - Stirling-PDF
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  labels:
-    app: stirlingpdf
   name: stirlingpdf
   namespace: default
+  labels:
+    app: stirlingpdf
 spec:
   replicas: 1
   selector:
     matchLabels:
       app: stirlingpdf
-  strategy:
-    type: Recreate
   template:
     metadata:
       labels:
         app: stirlingpdf
     spec:
       containers:
-      - env:
+        - name: stirlingpdf
-        - name: TZ
-          value: America/Sao_Paulo
-        - name: DOCKER_ENABLE_SECURITY
-          value: 'false'
-        - name: SECURITY_ENABLELOGIN
-          value: 'false'
           image: stirlingtools/stirling-pdf:latest
           imagePullPolicy: Always
-        name: stirlingpdf
+          env:
+            - name: TZ
+              value: "America/Sao_Paulo"
+            - name: DOCKER_ENABLE_SECURITY
+              value: "false"
+            - name: SECURITY_ENABLELOGIN
+              value: "false"
           ports:
             - containerPort: 8080
               name: http
-          protocol: TCP
           readinessProbe:
-          failureThreshold: 3
             httpGet:
               path: /
               port: 8080
-            scheme: HTTP
             initialDelaySeconds: 20
             periodSeconds: 10
-          successThreshold: 1
-          timeoutSeconds: 1
           resources:
-          limits:
-            cpu: '2'
-            memory: 2Gi
             requests:
               cpu: 100m
               memory: 1Gi
+            limits:
+              cpu: 2000m
+              memory: 2Gi
           securityContext:
             allowPrivilegeEscalation: false
             runAsUser: 0
-        terminationMessagePath: /dev/termination-log
-        terminationMessagePolicy: File
           volumeMounts:
-        - mountPath: /configs
+            - name: config
-          name: config
+              mountPath: /configs
-      dnsPolicy: ClusterFirst
-      restartPolicy: Always
-      schedulerName: default-scheduler
-      securityContext: {}
-      terminationGracePeriodSeconds: 30
       volumes:
         - name: config
           persistentVolumeClaim:
             claimName: stirlingpdf-config
-status:
+      terminationGracePeriodSeconds: 30
-  availableReplicas: 1
-  conditions:
-  - lastTransitionTime: '2026-08-12T01:49:00Z'
-    lastUpdateTime: '2026-08-12T01:49:43Z'
-    message: ReplicaSet "stirlingpdf-5d9d988965" has successfully progressed.
-    reason: NewReplicaSetAvailable
-    status: 'True'
-    type: Progressing
-  - lastTransitionTime: '2026-08-28T06:05:17Z'
-    lastUpdateTime: '2026-08-28T06:05:17Z'
-    message: Deployment has minimum availability.
-    reason: MinimumReplicasAvailable
-    status: 'True'
-    type: Available
-  observedGeneration: 11
-  readyReplicas: 1
-  replicas: 1
-  terminatingReplicas: 0
-  updatedReplicas: 1
 ---
+# 2) Service
 apiVersion: v1
 kind: Service
 metadata:
-  labels:
-    app: stirlingpdf
   name: stirlingpdf
   namespace: default
+  labels:
+    app: stirlingpdf
 spec:
-  internalTrafficPolicy: Cluster
+  type: ClusterIP
-  ipFamilies:
+  selector:
-  - IPv4
+    app: stirlingpdf
-  ipFamilyPolicy: SingleStack
   ports:
     - name: http
       port: 8080
       protocol: TCP
       targetPort: http
-  selector:
-    app: stirlingpdf
-  sessionAffinity: None
-  type: ClusterIP
-status:
-  loadBalancer: {}
 ---
+# 3) PersistentVolumeClaim
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: stirlingpdf-config
+  namespace: default
+  annotations:
+    nfs.io/storage-path: "stirlingpdf-config"
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+---
+# 4) Ingress
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  labels:
-    app: stirlingpdf
   name: stirlingpdf
   namespace: default
+  labels:
+    app: stirlingpdf
 spec:
   ingressClassName: nginx
   rules:
     - host: stirling.haven
       http:
         paths:
-      - backend:
+          - path: /
+            pathType: Prefix
+            backend:
               service:
                 name: stirlingpdf
                 port:
                   number: 8080
-        path: /
-        pathType: Prefix
-status:
-  loadBalancer:
-    ingress:
-    - ip: 192.168.20.204
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: stirlingpdf-config
-  namespace: default
-spec:
-  accessModes:
-  - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: nfs-client
-  volumeMode: Filesystem
-status:
-  accessModes:
-  - ReadWriteOnce
-  capacity:
-    storage: 1Gi
-  phase: Bound

apps/default/uptimekuma.yaml

@@ -1,3 +1,5 @@
+---
+# 1) Deployment
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -5,112 +7,86 @@ metadata:
   namespace: default
 spec:
   replicas: 1
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: uptimekuma
-  strategy:
-    type: Recreate
   template:
     metadata:
       labels:
         app: uptimekuma
     spec:
       containers:
-      - env:
+        - name: uptimekuma
-        - name: PUID
-          value: '1000'
-        - name: PGID
-          value: '1000'
           image: louislam/uptime-kuma:2
           imagePullPolicy: Always
-        livenessProbe:
+          env:
-          failureThreshold: 3
+            - name: PUID
-          httpGet:
+              value: "1000"
-            path: /
+            - name: PGID
-            port: 3001
+              value: "1000"
-            scheme: HTTP
-          initialDelaySeconds: 30
-          periodSeconds: 60
-          successThreshold: 1
-          timeoutSeconds: 1
-        name: uptimekuma
           ports:
             - containerPort: 3001
               name: uptimekuma-port
-          protocol: TCP
+          resources:
+            requests:
+              memory: "128Mi"
+              cpu: "100m"
+            limits:
+              memory: "256Mi"
+              cpu: "500m"
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 3001
+            initialDelaySeconds: 30
+            periodSeconds: 60
           readinessProbe:
-          failureThreshold: 3
             httpGet:
               path: /
               port: 3001
-            scheme: HTTP
             initialDelaySeconds: 5
             periodSeconds: 5
-          successThreshold: 1
-          timeoutSeconds: 1
-        resources:
-          limits:
-            cpu: 500m
-            memory: 256Mi
-          requests:
-            cpu: 100m
-            memory: 128Mi
-        terminationMessagePath: /dev/termination-log
-        terminationMessagePolicy: File
           volumeMounts:
-        - mountPath: /app/data
+            - name: uptimekuma-config
-          name: uptimekuma-config
+              mountPath: /app/data
-      dnsPolicy: ClusterFirst
-      restartPolicy: Always
-      schedulerName: default-scheduler
-      securityContext: {}
-      terminationGracePeriodSeconds: 30
       volumes:
         - name: uptimekuma-config
           persistentVolumeClaim:
             claimName: uptimekuma-config
-status:
-  availableReplicas: 1
-  conditions:
-  - lastTransitionTime: '2026-05-19T01:51:48Z'
-    lastUpdateTime: '2026-07-22T10:17:49Z'
-    message: ReplicaSet "uptimekuma-5cdbf7d589" has successfully progressed.
-    reason: NewReplicaSetAvailable
-    status: 'True'
-    type: Progressing
-  - lastTransitionTime: '2026-08-28T06:04:55Z'
-    lastUpdateTime: '2026-08-28T06:04:55Z'
-    message: Deployment has minimum availability.
-    reason: MinimumReplicasAvailable
-    status: 'True'
-    type: Available
-  observedGeneration: 94
-  readyReplicas: 1
-  replicas: 1
-  terminatingReplicas: 0
-  updatedReplicas: 1
 ---
+# 2) Service  
 apiVersion: v1
 kind: Service
 metadata:
   name: uptimekuma
   namespace: default
 spec:
-  internalTrafficPolicy: Cluster
+  type: ClusterIP
-  ipFamilies:
-  - IPv4
-  ipFamilyPolicy: SingleStack
-  ports:
-  - port: 3001
-    protocol: TCP
-    targetPort: uptimekuma-port
   selector:
     app: uptimekuma
-  sessionAffinity: None
+  ports:
-  type: ClusterIP
+    - port: 3001
-status:
+      targetPort: uptimekuma-port
-  loadBalancer: {}
 ---
+# 3) PersistentVolumeClaim
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: uptimekuma-config
+  namespace: default
+  annotations:
+    nfs.io/storage-path: "uptimekuma-config"
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi
+---
+# 4) Ingress
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -122,34 +98,10 @@ spec:
     - host: uptimekuma.haven
       http:
         paths:
-      - backend:
+          - path: /
+            pathType: Prefix
+            backend:
               service:
                 name: uptimekuma
                 port:
                   number: 3001
-        path: /
-        pathType: Prefix
-status:
-  loadBalancer:
-    ingress:
-    - ip: 192.168.20.204
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: uptimekuma-config
-  namespace: default
-spec:
-  accessModes:
-  - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: nfs-client
-  volumeMode: Filesystem
-status:
-  accessModes:
-  - ReadWriteMany
-  capacity:
-    storage: 1Gi
-  phase: Bound

apps/default/vaultwarden.yaml

@@ -1,3 +1,5 @@
+---
+# 1) Deployment
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -8,117 +10,124 @@ spec:
   selector:
     matchLabels:
       app: vaultwarden
-  strategy:
-    type: Recreate
   template:
     metadata:
       labels:
         app: vaultwarden
     spec:
       containers:
-      - env:
+        - name: vaultwarden
+          image: vaultwarden/server:latest
+          imagePullPolicy: Always
+          env:
             - name: DOMAIN
-          value: https://vault.haven
+              value: "https://vault.haven"
             - name: ADMIN_TOKEN
               valueFrom:
                 secretKeyRef:
-              key: ADMIN_TOKEN
                   name: vaultwarden-admin-token
-        image: vaultwarden/server:latest
+                  key: ADMIN_TOKEN
-        imagePullPolicy: Always
-        livenessProbe:
-          failureThreshold: 6
-          httpGet:
-            path: /alive
-            port: vault-port
-            scheme: HTTP
-          periodSeconds: 15
-          successThreshold: 1
-          timeoutSeconds: 3
-        name: vaultwarden
           ports:
             - containerPort: 80
               name: vault-port
-          protocol: TCP
+          # /alive requires no authentication and verifies the Vaultwarden process
-        readinessProbe:
-          failureThreshold: 3
-          httpGet:
-            path: /alive
-            port: vault-port
-            scheme: HTTP
-          periodSeconds: 10
-          successThreshold: 1
-          timeoutSeconds: 3
-        resources:
-          limits:
-            cpu: 250m
-            memory: 256Mi
-          requests:
-            cpu: 250m
-            memory: 64Mi
           startupProbe:
-          failureThreshold: 30
             httpGet:
               path: /alive
               port: vault-port
               scheme: HTTP
             periodSeconds: 5
-          successThreshold: 1
             timeoutSeconds: 3
-        terminationMessagePath: /dev/termination-log
+            failureThreshold: 30
-        terminationMessagePolicy: File
+          readinessProbe:
+            httpGet:
+              path: /alive
+              port: vault-port
+              scheme: HTTP
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /alive
+              port: vault-port
+              scheme: HTTP
+            periodSeconds: 15
+            timeoutSeconds: 3
+            failureThreshold: 6
           volumeMounts:
-        - mountPath: /data
+            - name: vaultwarden-data
-          name: vaultwarden-data
+              mountPath: /data
-      dnsPolicy: ClusterFirst
+          resources:
-      restartPolicy: Always
+            requests:
-      schedulerName: default-scheduler
+              cpu: 250m
-      securityContext: {}
+              memory: 64Mi
-      terminationGracePeriodSeconds: 30
+            limits:
+              cpu: 250m
+              memory: 256Mi
       volumes:
         - name: vaultwarden-data
           persistentVolumeClaim:
             claimName: vaultwarden-data
+---
+# 2) Service
 apiVersion: v1
 kind: Service
 metadata:
   name: vaultwarden
   namespace: default
 spec:
-  internalTrafficPolicy: Cluster
+  type: ClusterIP
-  ipFamilies:
-  - IPv4
-  ipFamilyPolicy: SingleStack
-  ports:
-  - port: 80
-    protocol: TCP
-    targetPort: vault-port
   selector:
     app: vaultwarden
-  sessionAffinity: None
+  ports:
-  type: ClusterIP
+    - port: 80
+      targetPort: vault-port
+---
+# 3) PersistentVolumeClaim (for /data)
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: vaultwarden-data
+  namespace: default
+  annotations:
+    nfs.io/storage-path: "vaultwarden-data"
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi
+---
+# 4) Ingress
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: vaultwarden
   namespace: default
+  annotations:
+    cert-manager.io/cluster-issuer: internal-ca
+    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
 spec:
   ingressClassName: nginx
-  rules:
-  - host: vault.haven
-    http:
-      paths:
-      - backend:
-          service:
-            name: vaultwarden
-            port:
-              number: 80
-        path: /
-        pathType: Prefix
   tls:
     - hosts:
         - vault.haven
       secretName: vaultwarden-tls
+  rules:
+    - host: vault.haven
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: vaultwarden
+                port:
+                  number: 80
+---
+# 4) Ingress
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -130,23 +139,10 @@ spec:
     - host: vault.ivanch.me
       http:
         paths:
-      - backend:
+          - path: /
+            pathType: Prefix
+            backend:
               service:
                 name: vaultwarden
                 port:
                   number: 80
-        path: /
-        pathType: Prefix
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: vaultwarden-data
-  namespace: default
-spec:
-  accessModes:
-  - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: nfs-client
-  volumeMode: Filesystem