adding new csi-driver-nfs

SETUP.md

@@ -1,12 +1,22 @@
-# Initial setup
-```sh
-# Create namespace
+# Setup Instructions
+
+## Pre-installation
+
+1. Create namespaces with
+```bash
 kubectl apply -f bootstrap/namespaces.yaml
+```
 
-# Install ArgoCD
+2. Apply Vaultwarden deployment app
+```bash
+kubectl apply -f apps/default/vaultwarden.yaml
+```
+
+3. Configure required secrets in `secrets/` directory, each mapping to an entity in Vaultwarden.
+
+## ArgoCD Installation
+```sh
 kubectl apply -k bootstrap/argocd-install
-
-# Apply root app
 kubectl apply -f bootstrap/root-app.yaml
 ```
 
@@ -17,3 +27,19 @@ kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.pas
 ```
 
 2. Access ArgoCD and login with `admin` / password from above.
+
+## External Secrets Operator preparation
+
+Create this Secret manually. `BW_HOST` must have no trailing slash.
+
+```bash
+kubectl -n infra create secret generic bitwarden-cli \
+  --from-literal=BW_HOST='[VAULTWARDEN_URL]' \
+  --from-literal=BW_USERNAME='[VAULTWARDEN_EMAIL]' \
+  --from-literal=BW_PASSWORD='[VAULTWARDEN_PASSWORD]'
+```
+
+## Apply order
+1. `kubectl apply -f secrets/`
+2. `kubectl apply -f apps/metalldb-system/`
+3. `kubectl apply -f apps/infra/`

apps/alloy/alloy.yaml

@@ -19,11 +19,12 @@ spec:
     targetRevision: 1.12.1
     helm:
       valuesObject:
+        controller:
+          type: daemonset
+        alloy:
           clustering: { enabled: false }
           mounts:
             varlog: true
-        controller:
-          type: daemonset
           resources:
             requests:
               cpu: 100m

apps/cloud/affine.yaml

@@ -115,7 +115,6 @@ metadata:
   labels:
     app: affine
 spec:
-  ingressClassName: nginx
   rules:
     - host: affine.haven
       http:

apps/cloud/cloudreve.yaml

@@ -135,7 +135,6 @@ metadata:
     nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
 spec:
-  ingressClassName: nginx
   rules:
     - host: cloud.haven
       http:
@@ -158,7 +157,6 @@ metadata:
     nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
 spec:
-  ingressClassName: nginx
   rules:
     - host: cloud.ivanch.me
       http:

apps/cloud/slink.yaml

@@ -122,7 +122,6 @@ metadata:
     nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
 spec:
-  ingressClassName: nginx
   rules:
     - host: slink.haven
       http:

apps/default/archivebox.yaml

@@ -145,7 +145,6 @@ metadata:
   name: archivebox-ingress
   namespace: default
 spec:
-  ingressClassName: nginx
   rules:
     - host: "archive.haven"
       http:

apps/default/changedetection.yaml

@@ -140,7 +140,6 @@ metadata:
   labels:
     app.kubernetes.io/name: changedetection
 spec:
-  ingressClassName: nginx
   rules:
     - host: change.haven
       http:

apps/default/homepage.yaml

@@ -192,7 +192,6 @@ metadata:
   labels:
     app.kubernetes.io/name: homepage
 spec:
-  ingressClassName: nginx
   rules:
     - host: "homepage.haven"
       http:

apps/default/it-tools.yaml

@@ -53,7 +53,6 @@ metadata:
   name: it-tools-ingress
   namespace: default
 spec:
-  ingressClassName: nginx
   rules:
     - host: "tools.haven"
       http:

apps/default/notepad.yaml

@@ -77,7 +77,6 @@ metadata:
   name: notepad
   namespace: default
 spec:
-  ingressClassName: nginx
   rules:
     - host: notepad.haven
       http:

apps/default/openwebui.yaml

@@ -94,7 +94,6 @@ metadata:
   annotations:
     nginx.ingress.kubernetes.io/proxy-body-size: "50m"
 spec:
-  ingressClassName: nginx
   rules:
     - host: openwebui.haven
       http:

apps/default/paperless.yaml

@@ -137,7 +137,6 @@ metadata:
   name: paperless
   namespace: default
 spec:
-  ingressClassName: nginx
   rules:
     - host: paperless.haven
       http:

apps/default/playwright.yaml

@@ -32,7 +32,7 @@ spec:
             - playwright@1.58.0
             - run-server
             - --port
-        - '3000'
+            - "3000"
             - --host
             - 0.0.0.0
           env:
@@ -46,7 +46,7 @@ spec:
               protocol: TCP
           resources:
             limits:
-            cpu: '4'
+              cpu: "4"
               memory: 4Gi
             requests:
               cpu: 500m
@@ -68,17 +68,17 @@ spec:
 status:
   availableReplicas: 1
   conditions:
-  - lastTransitionTime: '2026-05-29T15:54:24Z'
-    lastUpdateTime: '2026-07-22T10:14:35Z'
+    - lastTransitionTime: "2026-05-29T15:54:24Z"
+      lastUpdateTime: "2026-07-22T10:14:35Z"
       message: ReplicaSet "playwright-86c74d7c78" has successfully progressed.
       reason: NewReplicaSetAvailable
-    status: 'True'
+      status: "True"
       type: Progressing
-  - lastTransitionTime: '2026-08-28T06:04:14Z'
-    lastUpdateTime: '2026-08-28T06:04:14Z'
+    - lastTransitionTime: "2026-08-28T06:04:14Z"
+      lastUpdateTime: "2026-08-28T06:04:14Z"
       message: Deployment has minimum availability.
       reason: MinimumReplicasAvailable
-    status: 'True'
+      status: "True"
       type: Available
   observedGeneration: 95
   readyReplicas: 1
@@ -113,7 +113,6 @@ metadata:
   name: playwright
   namespace: default
 spec:
-  ingressClassName: nginx
   rules:
     - host: playwright.haven
       http:

apps/default/searxng.yaml

@@ -80,7 +80,6 @@ metadata:
   name: searxng
   namespace: default
 spec:
-  ingressClassName: nginx
   rules:
     - host: search.haven
       http:

apps/default/stirlingpdf.yaml

@@ -99,7 +99,6 @@ metadata:
   labels:
     app: stirlingpdf
 spec:
-  ingressClassName: nginx
   rules:
     - host: stirling.haven
       http:

apps/default/uptimekuma.yaml

@@ -93,7 +93,6 @@ metadata:
   name: uptimekuma
   namespace: default
 spec:
-  ingressClassName: nginx
   rules:
     - host: uptimekuma.haven
       http:

apps/default/vaultwarden.yaml

@@ -110,7 +110,6 @@ metadata:
     cert-manager.io/cluster-issuer: internal-ca
     nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
 spec:
-  ingressClassName: nginx
   tls:
     - hosts:
         - vault.haven
@@ -134,7 +133,6 @@ metadata:
   name: vaultwarden-public
   namespace: default
 spec:
-  ingressClassName: nginx
   rules:
     - host: vault.ivanch.me
       http:

apps/dns/adguard-sync.yaml

@@ -104,7 +104,6 @@ metadata:
   name: adguardsync-ingress
   namespace: dns
 spec:
-  ingressClassName: nginx
   rules:
     - host: adguardsync.haven
       http:

apps/dns/adguard.yaml

@@ -140,7 +140,6 @@ metadata:
   name: adguardhome-ingress
   namespace: dns
 spec:
-  ingressClassName: nginx
   rules:
     - host: adguard.haven
       http:
@@ -159,7 +158,6 @@ metadata:
   name: adguardhome-install-ingress
   namespace: dns
 spec:
-  ingressClassName: nginx
   rules:
     - host: install.adguard.haven
       http:

apps/infra/beszel.yaml

@@ -83,7 +83,6 @@ metadata:
   name: beszel
   namespace: infra
 spec:
-  ingressClassName: nginx
   rules:
     - host: beszel.haven
       http:

apps/infra/code-config.yaml

@@ -99,7 +99,6 @@ metadata:
   name: code-config
   namespace: infra
 spec:
-  ingressClassName: nginx
   rules:
     - host: code-config.haven
       http:

apps/infra/csi-driver-nfs.yaml

@@ -0,0 +1,26 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: csi-driver-nfs
+  namespace: infra
+spec:
+  repo: https://kubernetes-csi.github.io/csi-driver-nfs
+  chart: csi-driver-nfs
+  version: 4.13.4
+  targetNamespace: infra
+  valuesContent: |-
+    controller:
+      replicas: 1
+      logLevel: 5
+      defaultOnDeletePolicy: retain
+    storageClasses:
+      - name: nfs-client
+        annotations:
+          storageclass.kubernetes.io/is-default-class: "true"
+        parameters:
+          server: nfs-config.haven
+          share: /export/config
+          subDir: ${pvc.metadata.namespace}/${pvc.metadata.name}
+          onDelete: retain
+        reclaimPolicy: Retain
+        volumeBindingMode: Immediate

apps/infra/external-secrets-helm.yaml

@@ -0,0 +1,11 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: external-secrets
+  namespace: kube-system
+spec:
+  repo: https://charts.external-secrets.io
+  chart: external-secrets
+  version: 2.7.0
+  targetNamespace: external-secrets
+  createNamespace: true

apps/infra/file-nginx.yaml

@@ -115,7 +115,6 @@ metadata:
     nginx.ingress.kubernetes.io/enable-cors: "true"
     nginx.ingress.kubernetes.io/cors-allow-origin: "*"
 spec:
-  ingressClassName: nginx
   rules:
     - host: file-nginx.haven
       http:

apps/infra/haven-notify.yaml

@@ -72,7 +72,6 @@ metadata:
   name: haven-notify
   namespace: infra
 spec:
-  ingressClassName: nginx
   rules:
     - host: notify.haven
       http:

apps/infra/ingress-nginx-helm.yaml

@@ -1,33 +0,0 @@
-apiVersion: helm.cattle.io/v1
-kind: HelmChart
-metadata:
-  name: ingress-nginx
-  namespace: kube-system
-spec:
-  repo: https://kubernetes.github.io/ingress-nginx
-  chart: ingress-nginx
-  version: 4.x.x
-  targetNamespace: ingress-nginx
-  valuesContent: |-
-    controller:
-      replicaCount: 2
-      ingressClassResource:
-        name: nginx
-        enabled: true
-        default: true
-        controllerValue: "k8s.io/ingress-nginx"
-      ingressClass: nginx
-      service:
-        type: LoadBalancer
-        externalTrafficPolicy: Local
-        annotations:
-          metallb.io/ip-allocated-from-pool: default-pool
-          metallb.io/loadBalancerIPs: "192.168.20.204"
-        loadBalancerIP: 192.168.20.204
-      resources:
-        requests:
-          cpu: 100m
-          memory: 90Mi
-        limits:
-          cpu: 1000m
-          memory: 256Mi

apps/infra/ingress-traefik.yaml

@@ -0,0 +1,32 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: traefik
+  namespace: kube-system
+spec:
+  repo: https://traefik.github.io/charts
+  chart: traefik
+  version: 41.2.0
+  targetNamespace: traefik
+  createNamespace: true
+  valuesContent: |-
+    deployment:
+      replicas: 2
+    ingressClass:
+      enabled: true
+      isDefaultClass: true
+      name: traefik
+    service:
+      annotations:
+        metallb.io/ip-allocated-from-pool: default-pool
+        metallb.io/loadBalancerIPs: "192.168.20.204"
+      spec:
+        type: LoadBalancer
+        externalTrafficPolicy: Local
+    resources:
+      requests:
+        cpu: 100m
+        memory: 90Mi
+      limits:
+        cpu: 1000m
+        memory: 256Mi

apps/infra/wg-easy.yaml

@@ -113,7 +113,6 @@ metadata:
   name: wg-easy-ingress
   namespace: infra
 spec:
-  ingressClassName: nginx
   rules:
     - host: vpn.haven
       http:

apps/metallb-system/metallb.yaml

@@ -0,0 +1,10 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: metallb
+  namespace: kube-system
+spec:
+  repo: https://metallb.github.io/metallb
+  chart: metallb
+  version: 0.15.2
+  targetNamespace: metallb-system

apps/monitoring/grafana.yaml

@@ -94,7 +94,6 @@ metadata:
   namespace: monitoring
   name: grafana
 spec:
-  ingressClassName: nginx
   rules:
     - host: grafana.haven
       http:
@@ -113,7 +112,6 @@ metadata:
   namespace: monitoring
   name: grafana-public
 spec:
-  ingressClassName: nginx
   rules:
     - host: grafanah.ivanch.me
       http:

bootstrap/argocd-install/argocd-api-user.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-cm
+  namespace: argocd
+  labels:
+    app.kubernetes.io/name: argocd-cm
+    app.kubernetes.io/part-of: argocd
+data:
+  accounts.api: apiKey
+  accounts.api.enabled: "true"
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-rbac-cm
+  namespace: argocd
+  labels:
+    app.kubernetes.io/name: argocd-rbac-cm
+    app.kubernetes.io/part-of: argocd
+data:
+  policy.csv: |
+    g, api, role:readonly

bootstrap/argocd-install/ingress.yaml

@@ -4,7 +4,6 @@ metadata:
   name: argocd-server
   namespace: argocd
 spec:
-  ingressClassName: nginx
   rules:
     - host: argocd.haven
       http:

bootstrap/argocd-install/kustomization.yaml

@@ -9,3 +9,4 @@ resources:
 
 patches:
   - path: server-insecure-patch.yaml
+  - path: argocd-api-user.yaml

bootstrap/namespaces.yaml

@@ -70,13 +70,6 @@ kind: Namespace
 metadata:
   name: metallb-system
 ---
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: nfs-provisioner
-  labels:
-    name: nfs-provisioner
----
 # ==============================================================================
 # Observability & Monitoring
 # ==============================================================================