adding new csi-driver-nfs

Reviewed-on: #5

SETUP.md

@@ -1,12 +1,22 @@
-# Initial setup
+# Setup Instructions
-```sh
+
-# Create namespace
+## Pre-installation
+
+1. Create namespaces with
+```bash
 kubectl apply -f bootstrap/namespaces.yaml
+```
 
-# Install ArgoCD
+2. Apply Vaultwarden deployment app
+```bash
+kubectl apply -f apps/default/vaultwarden.yaml
+```
+
+3. Configure required secrets in `secrets/` directory, each mapping to an entity in Vaultwarden.
+
+## ArgoCD Installation
+```sh
 kubectl apply -k bootstrap/argocd-install
-
-# Apply root app
 kubectl apply -f bootstrap/root-app.yaml
 ```
 
@@ -17,3 +27,19 @@ kubectl -n argocd get secret argocd-initial-admin-secret -o jsonpath="{.data.pas
 ```
 
 2. Access ArgoCD and login with `admin` / password from above.
+
+## External Secrets Operator preparation
+
+Create this Secret manually. `BW_HOST` must have no trailing slash.
+
+```bash
+kubectl -n infra create secret generic bitwarden-cli \
+  --from-literal=BW_HOST='[VAULTWARDEN_URL]' \
+  --from-literal=BW_USERNAME='[VAULTWARDEN_EMAIL]' \
+  --from-literal=BW_PASSWORD='[VAULTWARDEN_PASSWORD]'
+```
+
+## Apply order
+1. `kubectl apply -f secrets/`
+2. `kubectl apply -f apps/metalldb-system/`
+3. `kubectl apply -f apps/infra/`

apps/alloy/alloy.yaml

@@ -19,104 +19,105 @@ spec:
     targetRevision: 1.12.1
     helm:
       valuesObject:
-        clustering: { enabled: false }
-        mounts:
-          varlog: true
         controller:
           type: daemonset
-        resources:
+        alloy:
-          requests:
+          clustering: { enabled: false }
-            cpu: 100m
+          mounts:
-            memory: 128Mi
+            varlog: true
-          limits:
+          resources:
-            cpu: 200m
+            requests:
-            memory: 256Mi
+              cpu: 100m
-        configMap:
+              memory: 128Mi
-          create: true
+            limits:
-          content: |-
+              cpu: 200m
-            discovery.kubernetes "all_pods" {
+              memory: 256Mi
-              role = "pod"
+          configMap:
+            create: true
+            content: |-
+              discovery.kubernetes "all_pods" {
+                role = "pod"
 
-              selectors {
+                selectors {
-                role  = "pod"
+                  role  = "pod"
-                field = "spec.nodeName=" + coalesce(env("HOSTNAME"), constants.hostname)
+                  field = "spec.nodeName=" + coalesce(env("HOSTNAME"), constants.hostname)
-              }
-            }
-
-            discovery.relabel "all_pods" {
-              targets = discovery.kubernetes.all_pods.targets
-
-              rule {
-                source_labels = ["__meta_kubernetes_namespace"]
-                target_label  = "namespace"
-              }
-              rule {
-                source_labels = ["__meta_kubernetes_pod_name"]
-                target_label  = "pod"
-              }
-              rule {
-                source_labels = ["__meta_kubernetes_pod_container_name"]
-                target_label  = "container"
-              }
-              rule {
-                source_labels = ["__meta_kubernetes_pod_label_app_kubernetes_io_name"]
-                target_label  = "app"
-              }
-            }
-
-            loki.source.kubernetes "all_logs" {
-              targets    = discovery.relabel.all_pods.output
-              forward_to = [loki.write.main.receiver]
-            }
-
-            discovery.kubernetes "shared_pods" {
-              role = "pod"
-              selectors {
-                role  = "pod"
-                field = "metadata.namespace=chacal"
-              }
-            }
-
-            discovery.relabel "shared_pods" {
-              targets = discovery.kubernetes.shared_pods.targets
-
-              rule {
-                source_labels = ["__meta_kubernetes_namespace"]
-                target_label  = "namespace"
-              }
-              rule {
-                source_labels = ["__meta_kubernetes_pod_name"]
-                target_label  = "pod"
-              }
-              rule {
-                source_labels = ["__meta_kubernetes_pod_container_name"]
-                target_label  = "container"
-              }
-              rule {
-                source_labels = ["__meta_kubernetes_pod_label_app_kubernetes_io_name"]
-                target_label  = "app"
-              }
-            }
-
-            loki.source.kubernetes "shared_logs" {
-              targets    = discovery.relabel.shared_pods.output
-              forward_to = [loki.write.shared.receiver]
-            }
-
-            loki.write "main" {
-              endpoint {
-                url = "http://loki.monitoring.svc.cluster.local:3100/loki/api/v1/push"
-                headers = {
-                  "X-Scope-OrgID" = "main",
                 }
               }
-            }
 
-            loki.write "shared" {
+              discovery.relabel "all_pods" {
-              endpoint {
+                targets = discovery.kubernetes.all_pods.targets
-                url = "http://loki.monitoring.svc.cluster.local:3100/loki/api/v1/push"
+
-                headers = {
+                rule {
-                  "X-Scope-OrgID" = "chacal",
+                  source_labels = ["__meta_kubernetes_namespace"]
+                  target_label  = "namespace"
+                }
+                rule {
+                  source_labels = ["__meta_kubernetes_pod_name"]
+                  target_label  = "pod"
+                }
+                rule {
+                  source_labels = ["__meta_kubernetes_pod_container_name"]
+                  target_label  = "container"
+                }
+                rule {
+                  source_labels = ["__meta_kubernetes_pod_label_app_kubernetes_io_name"]
+                  target_label  = "app"
+                }
+              }
+
+              loki.source.kubernetes "all_logs" {
+                targets    = discovery.relabel.all_pods.output
+                forward_to = [loki.write.main.receiver]
+              }
+
+              discovery.kubernetes "shared_pods" {
+                role = "pod"
+                selectors {
+                  role  = "pod"
+                  field = "metadata.namespace=chacal"
+                }
+              }
+
+              discovery.relabel "shared_pods" {
+                targets = discovery.kubernetes.shared_pods.targets
+
+                rule {
+                  source_labels = ["__meta_kubernetes_namespace"]
+                  target_label  = "namespace"
+                }
+                rule {
+                  source_labels = ["__meta_kubernetes_pod_name"]
+                  target_label  = "pod"
+                }
+                rule {
+                  source_labels = ["__meta_kubernetes_pod_container_name"]
+                  target_label  = "container"
+                }
+                rule {
+                  source_labels = ["__meta_kubernetes_pod_label_app_kubernetes_io_name"]
+                  target_label  = "app"
+                }
+              }
+
+              loki.source.kubernetes "shared_logs" {
+                targets    = discovery.relabel.shared_pods.output
+                forward_to = [loki.write.shared.receiver]
+              }
+
+              loki.write "main" {
+                endpoint {
+                  url = "http://loki.monitoring.svc.cluster.local:3100/loki/api/v1/push"
+                  headers = {
+                    "X-Scope-OrgID" = "main",
+                  }
+                }
+              }
+
+              loki.write "shared" {
+                endpoint {
+                  url = "http://loki.monitoring.svc.cluster.local:3100/loki/api/v1/push"
+                  headers = {
+                    "X-Scope-OrgID" = "chacal",
+                  }
                 }
               }
-            }

apps/cloud/affine.yaml

@@ -115,7 +115,6 @@ metadata:
   labels:
     app: affine
 spec:
-  ingressClassName: nginx
   rules:
     - host: affine.haven
       http:

apps/cloud/cloudreve.yaml

@@ -135,7 +135,6 @@ metadata:
     nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
 spec:
-  ingressClassName: nginx
   rules:
     - host: cloud.haven
       http:
@@ -158,7 +157,6 @@ metadata:
     nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
 spec:
-  ingressClassName: nginx
   rules:
     - host: cloud.ivanch.me
       http:

apps/cloud/slink.yaml

@@ -122,7 +122,6 @@ metadata:
     nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
 spec:
-  ingressClassName: nginx
   rules:
     - host: slink.haven
       http:

apps/default/archivebox.yaml

@@ -145,7 +145,6 @@ metadata:
   name: archivebox-ingress
   namespace: default
 spec:
-  ingressClassName: nginx
   rules:
     - host: "archive.haven"
       http:

apps/default/changedetection.yaml

@@ -140,7 +140,6 @@ metadata:
   labels:
     app.kubernetes.io/name: changedetection
 spec:
-  ingressClassName: nginx
   rules:
     - host: change.haven
       http:

apps/default/homepage.yaml

@@ -192,7 +192,6 @@ metadata:
   labels:
     app.kubernetes.io/name: homepage
 spec:
-  ingressClassName: nginx
   rules:
     - host: "homepage.haven"
       http:

apps/default/it-tools.yaml

@@ -53,7 +53,6 @@ metadata:
   name: it-tools-ingress
   namespace: default
 spec:
-  ingressClassName: nginx
   rules:
     - host: "tools.haven"
       http:

apps/default/notepad.yaml

@@ -77,7 +77,6 @@ metadata:
   name: notepad
   namespace: default
 spec:
-  ingressClassName: nginx
   rules:
     - host: notepad.haven
       http:

apps/default/openwebui.yaml

@@ -94,7 +94,6 @@ metadata:
   annotations:
     nginx.ingress.kubernetes.io/proxy-body-size: "50m"
 spec:
-  ingressClassName: nginx
   rules:
     - host: openwebui.haven
       http:

apps/default/paperless.yaml

@@ -137,7 +137,6 @@ metadata:
   name: paperless
   namespace: default
 spec:
-  ingressClassName: nginx
   rules:
     - host: paperless.haven
       http:

apps/default/playwright.yaml

@@ -18,68 +18,68 @@ spec:
       affinity:
         nodeAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
-          - preference:
+            - preference:
-              matchExpressions:
+                matchExpressions:
-              - key: kubernetes.io/hostname
+                  - key: kubernetes.io/hostname
-                operator: In
+                    operator: In
-                values:
+                    values:
-                - iris
+                      - iris
-            weight: 100
+              weight: 100
       containers:
-      - command:
+        - command:
-        - npx
+            - npx
-        - -y
+            - -y
-        - playwright@1.58.0
+            - playwright@1.58.0
-        - run-server
+            - run-server
-        - --port
+            - --port
-        - '3000'
+            - "3000"
-        - --host
+            - --host
-        - 0.0.0.0
+            - 0.0.0.0
-        env:
+          env:
-        - name: TZ
+            - name: TZ
-          value: America/Sao_Paulo
+              value: America/Sao_Paulo
-        image: mcr.microsoft.com/playwright:v1.58.0-noble
+          image: mcr.microsoft.com/playwright:v1.62.1-noble
-        imagePullPolicy: Always
+          imagePullPolicy: Always
-        name: playwright
+          name: playwright
-        ports:
+          ports:
-        - containerPort: 3000
+            - containerPort: 3000
-          protocol: TCP
+              protocol: TCP
-        resources:
+          resources:
-          limits:
+            limits:
-            cpu: '4'
+              cpu: "4"
-            memory: 4Gi
+              memory: 4Gi
-          requests:
+            requests:
-            cpu: 500m
+              cpu: 500m
-            memory: 512Mi
+              memory: 512Mi
-        terminationMessagePath: /dev/termination-log
+          terminationMessagePath: /dev/termination-log
-        terminationMessagePolicy: File
+          terminationMessagePolicy: File
-        volumeMounts:
+          volumeMounts:
-        - mountPath: /dev/shm
+            - mountPath: /dev/shm
-          name: dshm
+              name: dshm
       dnsPolicy: ClusterFirst
       restartPolicy: Always
       schedulerName: default-scheduler
       securityContext: {}
       terminationGracePeriodSeconds: 30
       volumes:
-      - emptyDir:
+        - emptyDir:
-          medium: Memory
+            medium: Memory
-        name: dshm
+          name: dshm
 status:
   availableReplicas: 1
   conditions:
-  - lastTransitionTime: '2026-05-29T15:54:24Z'
+    - lastTransitionTime: "2026-05-29T15:54:24Z"
-    lastUpdateTime: '2026-07-22T10:14:35Z'
+      lastUpdateTime: "2026-07-22T10:14:35Z"
-    message: ReplicaSet "playwright-86c74d7c78" has successfully progressed.
+      message: ReplicaSet "playwright-86c74d7c78" has successfully progressed.
-    reason: NewReplicaSetAvailable
+      reason: NewReplicaSetAvailable
-    status: 'True'
+      status: "True"
-    type: Progressing
+      type: Progressing
-  - lastTransitionTime: '2026-08-28T06:04:14Z'
+    - lastTransitionTime: "2026-08-28T06:04:14Z"
-    lastUpdateTime: '2026-08-28T06:04:14Z'
+      lastUpdateTime: "2026-08-28T06:04:14Z"
-    message: Deployment has minimum availability.
+      message: Deployment has minimum availability.
-    reason: MinimumReplicasAvailable
+      reason: MinimumReplicasAvailable
-    status: 'True'
+      status: "True"
-    type: Available
+      type: Available
   observedGeneration: 95
   readyReplicas: 1
   replicas: 1
@@ -94,12 +94,12 @@ metadata:
 spec:
   internalTrafficPolicy: Cluster
   ipFamilies:
-  - IPv4
+    - IPv4
   ipFamilyPolicy: SingleStack
   ports:
-  - port: 3000
+    - port: 3000
-    protocol: TCP
+      protocol: TCP
-    targetPort: 3000
+      targetPort: 3000
   selector:
     app: playwright
   sessionAffinity: None
@@ -113,19 +113,18 @@ metadata:
   name: playwright
   namespace: default
 spec:
-  ingressClassName: nginx
   rules:
-  - host: playwright.haven
+    - host: playwright.haven
-    http:
+      http:
-      paths:
+        paths:
-      - backend:
+          - backend:
-          service:
+              service:
-            name: playwright
+                name: playwright
-            port:
+                port:
-              number: 3000
+                  number: 3000
-        path: /
+            path: /
-        pathType: Prefix
+            pathType: Prefix
 status:
   loadBalancer:
     ingress:
-    - ip: 192.168.20.204
+      - ip: 192.168.20.204

apps/default/qbittorrent.yaml

@@ -1,132 +0,0 @@
----
-# 1) Deployment
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: qbittorrent
-  namespace: default
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: qbittorrent
-  template:
-    metadata:
-      labels:
-        app: qbittorrent
-    spec:
-      affinity:
-        nodeAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-          - weight: 100
-            preference:
-              matchExpressions:
-              - key: kubernetes.io/hostname
-                operator: In
-                values:
-                - iris
-      containers:
-        - name: qbittorrent
-          image: lscr.io/linuxserver/qbittorrent:5.2.3
-          imagePullPolicy: Always
-          resources:
-            requests:
-              cpu: 200m
-              memory: 256Mi
-            limits:
-              cpu: 1000m
-              memory: 512Mi
-          ports:
-            - containerPort: 4300
-              name: webui-port
-            - containerPort: 6881
-              name: qbit-tcp
-              protocol: TCP
-            - containerPort: 6881
-              name: qbit-udp
-              protocol: UDP
-          env:
-            - name: PUID
-              value: "1000"
-            - name: PGID
-              value: "1000"
-            - name: TZ
-              value: "Etc/UTC"
-            - name: WEBUI_PORT
-              value: "4300"
-            - name: TORRENTING_PORT
-              value: "6881"
-          volumeMounts:
-            - name: qbittorrent-config
-              mountPath: /config
-            - name: nas-storage
-              mountPath: /nas
-      volumes:
-        - name: qbittorrent-config
-          persistentVolumeClaim:
-            claimName: qbittorrent-config
-        - name: nas-storage
-          nfs:
-            server: 192.168.15.99
-            path: /export/Storage
----
-# PVC
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: qbittorrent-config
-  namespace: default
-  annotations:
-    nfs.io/storage-path: "qbittorrent-config"
-spec:
-  storageClassName: "nfs-client"
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
----
-# 2) Service
-apiVersion: v1
-kind: Service
-metadata:
-  name: qbittorrent
-  namespace: default
-spec:
-  type: NodePort
-  selector:
-    app: qbittorrent
-  ports:
-    - port: 4300
-      targetPort: webui-port
-      name: webui
-    - port: 6881
-      targetPort: qbit-tcp
-      name: torrent-tcp
-      protocol: TCP
-    - port: 6881
-      targetPort: qbit-udp
-      name: torrent-udp
-      protocol: UDP
----
-# 4) Ingress (Traefik)
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: qbittorrent
-  namespace: default
-  annotations:
-    traefik.ingress.kubernetes.io/router.entrypoints: web
-spec:
-  ingressClassName: nginx
-  rules:
-    - host: qbittorrent.haven
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: qbittorrent
-                port:
-                  number: 4300

apps/default/searxng.yaml

@@ -80,7 +80,6 @@ metadata:
   name: searxng
   namespace: default
 spec:
-  ingressClassName: nginx
   rules:
     - host: search.haven
       http:

apps/default/stirlingpdf.yaml

@@ -99,7 +99,6 @@ metadata:
   labels:
     app: stirlingpdf
 spec:
-  ingressClassName: nginx
   rules:
     - host: stirling.haven
       http:

apps/default/uptimekuma.yaml

@@ -93,7 +93,6 @@ metadata:
   name: uptimekuma
   namespace: default
 spec:
-  ingressClassName: nginx
   rules:
     - host: uptimekuma.haven
       http:

apps/default/vaultwarden.yaml

@@ -110,7 +110,6 @@ metadata:
     cert-manager.io/cluster-issuer: internal-ca
     nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
 spec:
-  ingressClassName: nginx
   tls:
     - hosts:
         - vault.haven
@@ -134,7 +133,6 @@ metadata:
   name: vaultwarden-public
   namespace: default
 spec:
-  ingressClassName: nginx
   rules:
     - host: vault.ivanch.me
       http:

apps/dns/adguard-sync.yaml

@@ -31,58 +31,58 @@ spec:
         app: adguardsync
     spec:
       containers:
-      - name: adguardsync
+        - name: adguardsync
-        image: ghcr.io/bakito/adguardhome-sync:latest
+          image: ghcr.io/bakito/adguardhome-sync:latest
-        imagePullPolicy: Always
+          imagePullPolicy: Always
-        ports:
+          ports:
-        - containerPort: 8080
+            - containerPort: 8080
-          protocol: TCP
+              protocol: TCP
-          name: web-port
+              name: web-port
-        env:
+          env:
-        - name: CRON
+            - name: CRON
-          value: "0 * * * *"
+              value: "0 * * * *"
-        - name: RUN_ON_START
+            - name: RUN_ON_START
-          value: "true"
+              value: "true"
-        - name: LOG_LEVEL
+            - name: LOG_LEVEL
-          value: "info"
+              value: "info"
-        - name: ORIGIN_URL
+            - name: ORIGIN_URL
-          value: "http://adguard.haven"
+              value: "http://adguard.haven"
-        - name: ORIGIN_USERNAME
+            - name: ORIGIN_USERNAME
-          valueFrom:
+              valueFrom:
-            secretKeyRef:
+                secretKeyRef:
-              name: adguardhome-password
+                  name: adguardhome-password
-              key: username
+                  key: username
-        - name: ORIGIN_PASSWORD
+            - name: ORIGIN_PASSWORD
-          valueFrom:
+              valueFrom:
-            secretKeyRef:
+                secretKeyRef:
-              name: adguardhome-password
+                  name: adguardhome-password
-              key: password
+                  key: password
-        - name: REPLICA1_URL
+            - name: REPLICA1_URL
-          value: "http://adguard2.haven"
+              value: "http://adguard2.haven"
-        - name: REPLICA1_USERNAME
+            - name: REPLICA1_USERNAME
-          valueFrom:
+              valueFrom:
-            secretKeyRef:
+                secretKeyRef:
-              name: adguardhome-password
+                  name: adguardhome-password
-              key: username
+                  key: username
-        - name: REPLICA1_PASSWORD
+            - name: REPLICA1_PASSWORD
-          valueFrom:
+              valueFrom:
-            secretKeyRef:
+                secretKeyRef:
-              name: adguardhome-password
+                  name: adguardhome-password
-              key: password
+                  key: password
-        resources:
+          resources:
-          requests:
+            requests:
-            cpu: 100m
+              cpu: 100m
-            memory: 128Mi
+              memory: 128Mi
-          limits:
+            limits:
-            cpu: 500m
+              cpu: 500m
-            memory: 512Mi
+              memory: 512Mi
-        volumeMounts:
+          volumeMounts:
-        - name: adguardsync-storage
+            - name: adguardsync-storage
-          mountPath: /config
+              mountPath: /config
       volumes:
-      - name: adguardsync-storage
+        - name: adguardsync-storage
-        persistentVolumeClaim:
+          persistentVolumeClaim:
-          claimName: adguardsync-pvc
+            claimName: adguardsync-pvc
 ---
 apiVersion: v1
 kind: Service
@@ -94,9 +94,9 @@ spec:
   selector:
     app: adguardsync
   ports:
-  - name: web
+    - name: web
-    port: 8080
+      port: 8080
-    targetPort: 8080
+      targetPort: 8080
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -104,15 +104,14 @@ metadata:
   name: adguardsync-ingress
   namespace: dns
 spec:
-  ingressClassName: nginx
   rules:
-  - host: adguardsync.haven
+    - host: adguardsync.haven
-    http:
+      http:
-      paths:
+        paths:
-      - path: /
+          - path: /
-        pathType: Prefix
+            pathType: Prefix
-        backend:
+            backend:
-          service:
+              service:
-            name: adguardsync-svc
+                name: adguardsync-svc
-            port:
+                port:
-              number: 8080
+                  number: 8080

apps/dns/adguard.yaml

@@ -31,48 +31,48 @@ spec:
         app: adguardhome
     spec:
       containers:
-      - name: adguardhome
+        - name: adguardhome
-        image: adguard/adguardhome:latest
+          image: adguard/adguardhome:latest
-        imagePullPolicy: Always
+          imagePullPolicy: Always
-        ports:
+          ports:
-        - containerPort: 53
+            - containerPort: 53
-          protocol: TCP
+              protocol: TCP
-        - containerPort: 53
+            - containerPort: 53
-          protocol: UDP
+              protocol: UDP
-        - containerPort: 3000
+            - containerPort: 3000
-          protocol: TCP
+              protocol: TCP
-          name: install-port
+              name: install-port
-        - containerPort: 80
+            - containerPort: 80
-          protocol: TCP
+              protocol: TCP
-          name: web-port
+              name: web-port
-        resources:
+          resources:
-          requests:
+            requests:
-            cpu: 100m
+              cpu: 100m
-            memory: 128Mi
+              memory: 128Mi
-          limits:
+            limits:
-            cpu: 1000m
+              cpu: 1000m
-            memory: 2Gi
+              memory: 2Gi
-        livenessProbe:
+          livenessProbe:
-          httpGet:
+            httpGet:
-            path: /
+              path: /
-            port: 80
+              port: 80
-          initialDelaySeconds: 30
+            initialDelaySeconds: 30
-          periodSeconds: 10
+            periodSeconds: 10
-        readinessProbe:
+          readinessProbe:
-          httpGet:
+            httpGet:
-            path: /
+              path: /
-            port: 80
+              port: 80
-          initialDelaySeconds: 5
+            initialDelaySeconds: 5
-          periodSeconds: 5
+            periodSeconds: 5
-        volumeMounts:
+          volumeMounts:
-        - name: adguardhome-storage
+            - name: adguardhome-storage
-          mountPath: /opt/adguardhome/work
+              mountPath: /opt/adguardhome/work
-        - name: adguardhome-storage
+            - name: adguardhome-storage
-          mountPath: /opt/adguardhome/conf
+              mountPath: /opt/adguardhome/conf
       volumes:
-      - name: adguardhome-storage
+        - name: adguardhome-storage
-        persistentVolumeClaim:
+          persistentVolumeClaim:
-          claimName: adguardhome-pvc
+            claimName: adguardhome-pvc
 ---
 apiVersion: v1
 kind: Service
@@ -85,17 +85,17 @@ spec:
     app: adguardhome
   loadBalancerIP: 192.168.20.200
   ports:
-  - name: dns-tcp
+    - name: dns-tcp
-    port: 53
+      port: 53
-    targetPort: 53
+      targetPort: 53
-    protocol: TCP
+      protocol: TCP
-  - name: dns-udp
+    - name: dns-udp
-    port: 53
+      port: 53
-    targetPort: 53
+      targetPort: 53
-    protocol: UDP
+      protocol: UDP
-  - name: web
+    - name: web
-    port: 80
+      port: 80
-    targetPort: 80
+      targetPort: 80
 ---
 apiVersion: v1
 kind: Service
@@ -108,17 +108,17 @@ spec:
     app: adguardhome
   loadBalancerIP: 192.168.15.200
   ports:
-  - name: dns-tcp
+    - name: dns-tcp
-    port: 53
+      port: 53
-    targetPort: 53
+      targetPort: 53
-    protocol: TCP
+      protocol: TCP
-  - name: dns-udp
+    - name: dns-udp
-    port: 53
+      port: 53
-    targetPort: 53
+      targetPort: 53
-    protocol: UDP
+      protocol: UDP
-  - name: web
+    - name: web
-    port: 80
+      port: 80
-    targetPort: 80
+      targetPort: 80
 ---
 apiVersion: v1
 kind: Service
@@ -130,9 +130,9 @@ spec:
   selector:
     app: adguardhome
   ports:
-  - name: install
+    - name: install
-    port: 3000
+      port: 3000
-    targetPort: 3000
+      targetPort: 3000
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -140,18 +140,17 @@ metadata:
   name: adguardhome-ingress
   namespace: dns
 spec:
-  ingressClassName: nginx
   rules:
-  - host: adguard.haven
+    - host: adguard.haven
-    http:
+      http:
-      paths:
+        paths:
-      - path: /
+          - path: /
-        pathType: Prefix
+            pathType: Prefix
-        backend:
+            backend:
-          service:
+              service:
-            name: adguardhome-svc
+                name: adguardhome-svc
-            port:
+                port:
-              number: 80
+                  number: 80
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -159,15 +158,14 @@ metadata:
   name: adguardhome-install-ingress
   namespace: dns
 spec:
-  ingressClassName: nginx
   rules:
-  - host: install.adguard.haven
+    - host: install.adguard.haven
-    http:
+      http:
-      paths:
+        paths:
-      - path: /
+          - path: /
-        pathType: Prefix
+            pathType: Prefix
-        backend:
+            backend:
-          service:
+              service:
-            name: adguard-install-svc
+                name: adguard-install-svc
-            port:
+                port:
-              number: 3000
+                  number: 3000

apps/infra/beszel.yaml

@@ -83,7 +83,6 @@ metadata:
   name: beszel
   namespace: infra
 spec:
-  ingressClassName: nginx
   rules:
     - host: beszel.haven
       http:

apps/infra/code-config.yaml

@@ -99,7 +99,6 @@ metadata:
   name: code-config
   namespace: infra
 spec:
-  ingressClassName: nginx
   rules:
     - host: code-config.haven
       http:

apps/infra/csi-driver-nfs.yaml

@@ -0,0 +1,26 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: csi-driver-nfs
+  namespace: infra
+spec:
+  repo: https://kubernetes-csi.github.io/csi-driver-nfs
+  chart: csi-driver-nfs
+  version: 4.13.4
+  targetNamespace: infra
+  valuesContent: |-
+    controller:
+      replicas: 1
+      logLevel: 5
+      defaultOnDeletePolicy: retain
+    storageClasses:
+      - name: nfs-client
+        annotations:
+          storageclass.kubernetes.io/is-default-class: "true"
+        parameters:
+          server: nfs-config.haven
+          share: /export/config
+          subDir: ${pvc.metadata.namespace}/${pvc.metadata.name}
+          onDelete: retain
+        reclaimPolicy: Retain
+        volumeBindingMode: Immediate

apps/infra/external-secrets-helm.yaml

@@ -0,0 +1,11 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: external-secrets
+  namespace: kube-system
+spec:
+  repo: https://charts.external-secrets.io
+  chart: external-secrets
+  version: 2.7.0
+  targetNamespace: external-secrets
+  createNamespace: true

apps/infra/file-nginx.yaml

@@ -115,7 +115,6 @@ metadata:
     nginx.ingress.kubernetes.io/enable-cors: "true"
     nginx.ingress.kubernetes.io/cors-allow-origin: "*"
 spec:
-  ingressClassName: nginx
   rules:
     - host: file-nginx.haven
       http:

apps/infra/haven-notify.yaml

@@ -72,7 +72,6 @@ metadata:
   name: haven-notify
   namespace: infra
 spec:
-  ingressClassName: nginx
   rules:
     - host: notify.haven
       http:

apps/infra/ingress-nginx-helm.yaml

@@ -1,33 +0,0 @@
-apiVersion: helm.cattle.io/v1
-kind: HelmChart
-metadata:
-  name: ingress-nginx
-  namespace: kube-system
-spec:
-  repo: https://kubernetes.github.io/ingress-nginx
-  chart: ingress-nginx
-  version: 4.x.x
-  targetNamespace: ingress-nginx
-  valuesContent: |-
-    controller:
-      replicaCount: 2
-      ingressClassResource:
-        name: nginx
-        enabled: true
-        default: true
-        controllerValue: "k8s.io/ingress-nginx"
-      ingressClass: nginx
-      service:
-        type: LoadBalancer
-        externalTrafficPolicy: Local
-        annotations:
-          metallb.io/ip-allocated-from-pool: default-pool
-          metallb.io/loadBalancerIPs: "192.168.20.204"
-        loadBalancerIP: 192.168.20.204
-      resources:
-        requests:
-          cpu: 100m
-          memory: 90Mi
-        limits:
-          cpu: 1000m
-          memory: 256Mi

apps/infra/ingress-traefik.yaml

@@ -0,0 +1,32 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: traefik
+  namespace: kube-system
+spec:
+  repo: https://traefik.github.io/charts
+  chart: traefik
+  version: 41.2.0
+  targetNamespace: traefik
+  createNamespace: true
+  valuesContent: |-
+    deployment:
+      replicas: 2
+    ingressClass:
+      enabled: true
+      isDefaultClass: true
+      name: traefik
+    service:
+      annotations:
+        metallb.io/ip-allocated-from-pool: default-pool
+        metallb.io/loadBalancerIPs: "192.168.20.204"
+      spec:
+        type: LoadBalancer
+        externalTrafficPolicy: Local
+    resources:
+      requests:
+        cpu: 100m
+        memory: 90Mi
+      limits:
+        cpu: 1000m
+        memory: 256Mi

apps/infra/wg-easy.yaml

@@ -113,7 +113,6 @@ metadata:
   name: wg-easy-ingress
   namespace: infra
 spec:
-  ingressClassName: nginx
   rules:
     - host: vpn.haven
       http:

apps/metallb-system/metallb.yaml

@@ -0,0 +1,10 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: metallb
+  namespace: kube-system
+spec:
+  repo: https://metallb.github.io/metallb
+  chart: metallb
+  version: 0.15.2
+  targetNamespace: metallb-system

apps/monitoring/grafana.yaml

@@ -94,7 +94,6 @@ metadata:
   namespace: monitoring
   name: grafana
 spec:
-  ingressClassName: nginx
   rules:
     - host: grafana.haven
       http:
@@ -113,7 +112,6 @@ metadata:
   namespace: monitoring
   name: grafana-public
 spec:
-  ingressClassName: nginx
   rules:
     - host: grafanah.ivanch.me
       http:

bootstrap/argocd-install/argocd-api-user.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-cm
+  namespace: argocd
+  labels:
+    app.kubernetes.io/name: argocd-cm
+    app.kubernetes.io/part-of: argocd
+data:
+  accounts.api: apiKey
+  accounts.api.enabled: "true"
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-rbac-cm
+  namespace: argocd
+  labels:
+    app.kubernetes.io/name: argocd-rbac-cm
+    app.kubernetes.io/part-of: argocd
+data:
+  policy.csv: |
+    g, api, role:readonly

bootstrap/argocd-install/ingress.yaml

@@ -4,7 +4,6 @@ metadata:
   name: argocd-server
   namespace: argocd
 spec:
-  ingressClassName: nginx
   rules:
     - host: argocd.haven
       http:

bootstrap/argocd-install/kustomization.yaml

@@ -9,3 +9,4 @@ resources:
 
 patches:
   - path: server-insecure-patch.yaml
+  - path: argocd-api-user.yaml

bootstrap/namespaces.yaml

@@ -70,13 +70,6 @@ kind: Namespace
 metadata:
   name: metallb-system
 ---
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: nfs-provisioner
-  labels:
-    name: nfs-provisioner
----
 # ==============================================================================
 # Observability & Monitoring
 # ==============================================================================

secrets/radarr.yaml

@@ -1,48 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata: { name: radarr, namespace: media }
-spec:
-  refreshInterval: 1h
-  target:
-    name: radarr-secret
-    deletionPolicy: Retain
-    template:
-      type: Opaque
-      data:
-        Radarr__Postgres__User: "{{ .Radarr__Postgres__User }}"
-        Radarr__Postgres__Password: "{{ .Radarr__Postgres__Password }}"
-        Radarr__Postgres__Host: "{{ .Radarr__Postgres__Host }}"
-        Radarr__Postgres__MainDb: "{{ .Radarr__Postgres__MainDb }}"
-  data:
-    - secretKey: Radarr__Postgres__User
-      remoteRef:
-        {
-          key: ab723b65-3ec8-469c-b01d-67a6e3049023,
-          property: username,
-        }
-      sourceRef:
-        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
-    - secretKey: Radarr__Postgres__Password
-      remoteRef:
-        {
-          key: ab723b65-3ec8-469c-b01d-67a6e3049023,
-          property: password,
-        }
-      sourceRef:
-        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
-    - secretKey: Radarr__Postgres__Host
-      remoteRef:
-        {
-          key: ab723b65-3ec8-469c-b01d-67a6e3049023,
-          property: Radarr__Postgres__Host,
-        }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
-    - secretKey: Radarr__Postgres__MainDb
-      remoteRef:
-        {
-          key: ab723b65-3ec8-469c-b01d-67a6e3049023,
-          property: Radarr__Postgres__MainDb,
-        }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }

secrets/recommender.yaml

@@ -1,27 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata: { name: recommender, namespace: media }
-spec:
-  refreshInterval: 1h
-  target:
-    name: recommender-secrets
-    deletionPolicy: Retain
-    template:
-      type: Opaque
-      data:
-        OPENAI_API_KEY: "{{ .OPENAI_API_KEY }}"
-        DATABASE_URL: "{{ .DATABASE_URL }}"
-  data:
-    - secretKey: OPENAI_API_KEY
-      remoteRef:
-        {
-          key: 5079ef6f-3d1d-4522-b22c-6dd5f1c19acd,
-          property: OPENAI_API_KEY,
-        }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
-    - secretKey: DATABASE_URL
-      remoteRef:
-        { key: 5079ef6f-3d1d-4522-b22c-6dd5f1c19acd, property: DATABASE_URL }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }

secrets/sonarr.yaml

@@ -1,42 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata: { name: sonarr, namespace: media }
-spec:
-  refreshInterval: 1h
-  target:
-    name: sonarr-secret
-    deletionPolicy: Retain
-    template:
-      type: Opaque
-      data:
-        Sonarr__Postgres__User: "{{ .Sonarr__Postgres__User }}"
-        Sonarr__Postgres__Password: "{{ .Sonarr__Postgres__Password }}"
-        Sonarr__Postgres__Host: "{{ .Sonarr__Postgres__Host }}"
-        Sonarr__Postgres__MainDb: "{{ .Sonarr__Postgres__MainDb }}"
-  data:
-    - secretKey: Sonarr__Postgres__User
-      remoteRef:
-        { key: 2c5b6d27-971f-4876-b10d-db400dfde7b2, property: username }
-      sourceRef:
-        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
-    - secretKey: Sonarr__Postgres__Password
-      remoteRef:
-        { key: 2c5b6d27-971f-4876-b10d-db400dfde7b2, property: password }
-      sourceRef:
-        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
-    - secretKey: Sonarr__Postgres__Host
-      remoteRef:
-        {
-          key: 2c5b6d27-971f-4876-b10d-db400dfde7b2,
-          property: Sonarr__Postgres__Host,
-        }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
-    - secretKey: Sonarr__Postgres__MainDb
-      remoteRef:
-        {
-          key: 2c5b6d27-971f-4876-b10d-db400dfde7b2,
-          property: Sonarr__Postgres__MainDb,
-        }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }