Pin Bitwarden CLI to compatible 2026.8.0

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [ghcr.io/charlesthomas/bitwarden-cli](https://github.com/charlesthomas/bitwarden-cli) | minor | `2026.8.0` → `2026.9.0` |

---

### Release Notes

<details>
<summary>charlesthomas/bitwarden-cli (ghcr.io/charlesthomas/bitwarden-cli)</summary>

### [`v2026.9.0`](https://github.com/charlesthomas/bitwarden-cli/releases/tag/2026.9.0)

[Compare Source](https://github.com/charlesthomas/bitwarden-cli/compare/2026.8.0...2026.9.0)

2026.9.0

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC44My4wIiwidXBkYXRlZEluVmVyIjoiNDQuODMuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->

---------

Co-authored-by: Renovate Bot <bot@renovateapp.com>
Reviewed-on: #13

.gitattributes

@@ -0,0 +1,4 @@
+.gitattributes text eol=lf
+*.yaml text eol=lf
+*.yml text eol=lf
+*.md text eol=lf

.gitea/workflows/trigger-renovate.yaml

@@ -0,0 +1,42 @@
+name: Trigger Renovate
+
+on:
+  workflow_dispatch: {}
+
+jobs:
+  trigger-renovate:
+    name: Trigger Renovate
+    runs-on: runner-slim-amd64
+    env:
+      KUBE_CONFIG: ${{ secrets.KUBE_CONFIG }}
+    steps:
+      - name: Create a one-off Renovate job
+        shell: bash
+        run: |
+          set -eu
+
+          if [ -z "${KUBE_CONFIG}" ]; then
+            echo "KUBE_CONFIG is not set or is empty."
+            exit 1
+          fi
+
+          WORK_DIR="${RUNNER_TEMP:-/tmp}/renovate-${GITHUB_RUN_ID:-$$}"
+          mkdir -p "${WORK_DIR}"
+          trap 'rm -rf "${WORK_DIR}"' EXIT
+
+          apk add --no-cache curl
+          KUBECTL_VERSION="$(curl -fsSL https://dl.k8s.io/release/stable.txt)"
+          curl -fsSLo "${WORK_DIR}/kubectl" "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl"
+          chmod 0755 "${WORK_DIR}/kubectl"
+
+          KUBECONFIG="${WORK_DIR}/kubeconfig"
+          umask 077
+          printf '%s' "${KUBE_CONFIG}" | tr -d '\r' > "${KUBECONFIG}"
+
+          RUN_ID="$(printf '%s' "${GITHUB_RUN_ID:-$(date -u +%Y%m%d%H%M%S)}" | tr -cd 'a-z0-9')"
+          JOB_NAME="renovate-manual-${RUN_ID}"
+
+          "${WORK_DIR}/kubectl" --kubeconfig "${KUBECONFIG}" version --client
+          "${WORK_DIR}/kubectl" --kubeconfig "${KUBECONFIG}" --namespace cronjobs get cronjob renovate
+          "${WORK_DIR}/kubectl" --kubeconfig "${KUBECONFIG}" --namespace cronjobs create job "${JOB_NAME}" --from=cronjob/renovate
+          "${WORK_DIR}/kubectl" --kubeconfig "${KUBECONFIG}" --namespace cronjobs get job "${JOB_NAME}" -o wide

.gitignore

@@ -1,16 +1,15 @@
-media/
-default/*tt*
-default/havenllo*
-certs/ca*
-
-lab/*
-sandbox/*
-!lab/nfs-pod.yaml
-
-rbac
-cronjobs
-
 *.crt
 *.key
+*.pem
+*.pfx
 
-chacal/
+# Secrets & Environment files
+.env
+.env.*
+*.env
+group_vars/**/vault.yml
+!group_vars/**/vault.yml.example
+*kubeconfig*
+
+# Ansible artifacts
+*.retry

README.md

@@ -12,57 +12,25 @@ For setup details, see [SETUP.md](SETUP.md).
 
 The repository name references my local TLD, `.haven` ;)
 
-## Namespaces
+## Repository Layout
-- default
+```
-    - ArchiveBox
+haven/
-    - Homarr
+├── bootstrap/
-    - Homepage
+│   ├── namespaces.yaml        # cluster namespaces
-    - It-tools
+│   ├── secretstores.yaml      # cluster secret stores for BitWarden ESO
-    - Notepad
+│   ├── address-pool.yaml      # cluster IP pool for MetalLB
-    - Searxng
+│   ├── argocd-install/        # Argo CD install manifests + ingress
-    - Uptimekuma
+│   └── root-app.yaml          # root Application watching apps/root
-    - Vaultwarden
+├── secrets/
-    - OpenWebUI
+│   ├── adguard.yaml           # adguard credentials from BitWarden
-    - Paperless
+│   ├── <app>.yaml             # <app> credentials from BitWarden
-- cloud
+│   └── ...
-    - Cloudreve
+├── apps/
-    - Slink
+│   ├── root/
-- dns
+│   │   ├── kustomization.yaml # points to applicationset.yaml
-    - AdGuardHome
+│   │   └── applicationset.yaml# auto-discovers apps/*/*.yaml
-    - AdGuardSync
+│   └── <namespace>/           # e.g., dev/, default/, infra/, monitoring/
-- infra
+│       ├── <app-1>.yaml       # all-in-one manifest per app
-    - [Haven Notify](https://git.ivanch.me/ivanch/server-scripts/src/branch/main/haven-notify)
+│       ├── <app-2>.yaml       # ...
-    - Beszel
+|       └──── ...
-    - Beszel Agent (running as a DaemonSet)
+```
-    - Code Config (VS Code for internal config editing)
-    - WireGuard Easy
-- dev
-    - Gitea Runner (x64)
-    - Gitea Runner (arm64)
-- monitoring
-    - Grafana
-    - Prometheus
-    - Node Exporter
-    - Kube State Metrics
-    - Loki
-    - Alloy
-
-#### Miscellaneous namespaces
-
-- lab (a playground/sandbox namespace)
-    - nfs-pod (for testing and accessing NFS mounts)
-- metallb-system
-    - MetalLB components
-- cert-manager
-    - cert-manager components
-- docker-ingress
-    - nginx ingress controller components for Docker-based services
-
-## Todo
-- Move ArchiveBox data to its own PVC on the NAS
-- Move Uptime Kuma to the infra namespace
-- Add links to each application's documentation
-- Add links to server scripts
-- Move Alloy to the monitoring namespace
-- Install Loki, Grafana, and Prometheus via Helm charts
-- Configure Loki and Prometheus to use PVCs

alloy/README.md

@@ -1,11 +0,0 @@
-# Helm configuration for Alloy (OSS monitoring collector)
-
-This directory contains Helm configuration for deploying Grafana Alloy, an open-source observability data collector.
-
-## Quick Install
-
-```bash
-helm repo add grafana https://grafana.github.io/helm-charts
-helm repo update
-helm install alloy grafana/alloy --namespace alloy -f values.yaml
-```

alloy/values.yaml

@@ -1,107 +0,0 @@
-alloy:
-  clustering:
-    enabled: false # Single node deployment
-
-  configMap:
-    create: true
-    content: |-
-      discovery.kubernetes "all_pods" {
-        role = "pod"
-
-        selectors {
-          role  = "pod"
-          field = "spec.nodeName=" + coalesce(env("HOSTNAME"), constants.hostname)
-        }
-      }
-
-      discovery.relabel "all_pods" {
-        targets = discovery.kubernetes.all_pods.targets
-
-        rule {
-          source_labels = ["__meta_kubernetes_namespace"]
-          target_label  = "namespace"
-        }
-        rule {
-          source_labels = ["__meta_kubernetes_pod_name"]
-          target_label  = "pod"
-        }
-        rule {
-          source_labels = ["__meta_kubernetes_pod_container_name"]
-          target_label  = "container"
-        }
-        rule {
-          source_labels = ["__meta_kubernetes_pod_label_app_kubernetes_io_name"]
-          target_label  = "app"
-        }
-      }
-
-      loki.source.kubernetes "all_logs" {
-        targets    = discovery.relabel.all_pods.output
-        forward_to = [loki.write.main.receiver]
-      }
-
-      discovery.kubernetes "shared_pods" {
-        role = "pod"
-        selectors {
-          role  = "pod"
-          field = "metadata.namespace=chacal"
-        }
-      }
-
-      discovery.relabel "shared_pods" {
-        targets = discovery.kubernetes.shared_pods.targets
-
-        rule {
-          source_labels = ["__meta_kubernetes_namespace"]
-          target_label  = "namespace"
-        }
-        rule {
-          source_labels = ["__meta_kubernetes_pod_name"]
-          target_label  = "pod"
-        }
-        rule {
-          source_labels = ["__meta_kubernetes_pod_container_name"]
-          target_label  = "container"
-        }
-        rule {
-          source_labels = ["__meta_kubernetes_pod_label_app_kubernetes_io_name"]
-          target_label  = "app"
-        }
-      }
-
-      loki.source.kubernetes "shared_logs" {
-        targets    = discovery.relabel.shared_pods.output
-        forward_to = [loki.write.shared.receiver]
-      }
-
-      loki.write "main" {
-        endpoint {
-          url = "http://loki.monitoring.svc.cluster.local:3100/loki/api/v1/push"
-          headers = {
-            "X-Scope-OrgID" = "main",
-          }
-        }
-      }
-
-      loki.write "shared" {
-        endpoint {
-          url = "http://loki.monitoring.svc.cluster.local:3100/loki/api/v1/push"
-          headers = {
-            "X-Scope-OrgID" = "chacal",
-          }
-        }
-      }
-
-  mounts:
-    varlog: true # Mount host /var/log for pod logs
-
-  controller:
-    type: daemonset # Run on every node
-
-  resources:
-    requests:
-      cpu: 100m
-      memory: 128Mi
-    limits:
-      cpu: 200m
-      memory: 256Mi

ansible/inventory.yml

@@ -33,6 +33,10 @@ all:
               ansible_host: nexus.haven
               ansible_user: root
               ansible_python_interpreter: /usr/bin/python3
+            polaris:
+              ansible_host: polaris.haven
+              ansible_user: root
+              ansible_python_interpreter: /usr/bin/python3
     lxcs:
       children:
         grp_docker_build: # group name == group_vars/grp_docker_build.yml

ansible/playbooks/k3s_update.yml

@@ -57,6 +57,45 @@
         name: k3s-agent
         state: restarted
 
+    - name: Fetch authoritative CA bundle from control-plane
+      ansible.builtin.slurp:
+        src: /var/lib/rancher/k3s/server/tls/{{ item }}
+      delegate_to: "{{ groups['grp_k3s_server'][0] }}"
+      register: ca_bundle
+      loop:
+        - client-ca.crt
+        - server-ca.crt
+
+    - name: Install server CAs into agent trust store
+      ansible.builtin.copy:
+        dest: "/var/lib/rancher/k3s/agent/{{ item.item }}"
+        content: "{{ item.content | b64decode }}"
+        owner: root
+        group: root
+        mode: "0600"
+      loop: "{{ ca_bundle.results }}"
+      loop_control:
+        label: "{{ item.item }}"
+
+    - name: Stop agent and clear stale client certs signed by old CA
+      ansible.builtin.shell: |
+        systemctl stop k3s-agent
+        rm -f /var/lib/rancher/k3s/agent/client-kubelet.crt \
+              /var/lib/rancher/k3s/agent/client-k3s-controller.crt \
+              /var/lib/rancher/k3s/agent/client-kube-proxy.crt \
+              /var/lib/rancher/k3s/agent/serving-kubelet.crt \
+              /var/lib/rancher/k3s/agent/kubelet.kubeconfig \
+              /var/lib/rancher/k3s/agent/k3scontroller.kubeconfig \
+              /var/lib/rancher/k3s/agent/kubeproxy.kubeconfig \
+              /var/lib/rancher/k3s/agent/client-kubeconfig.yaml
+      args:
+        executable: /bin/bash
+
+    - name: Restart k3s-agent so it re-issues certs against the server CA
+      ansible.builtin.systemd:
+        name: k3s-agent
+        state: restarted
+
     - name: Print update output
       ansible.builtin.debug:
         var: k3s_update

ansible/requirements-python.txt

@@ -1,3 +1,3 @@
-ansible-core==2.21.2
+ansible-core==2.21.4
 proxmoxer==2.3.0
 requests==2.34.2

ansible/requirements.yml

@@ -3,4 +3,4 @@ collections:
   - name: community.proxmox
     version: "2.0.0"
   - name: community.general
-    version: "13.2.0"
+    version: "13.4.0"

apps/cloud/affine.yaml

@@ -1,5 +1,4 @@
 ---
-# ============ AFFiNE app ============
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -21,8 +20,7 @@ spec:
     spec:
       containers:
         - name: affine
-          image: ghcr.io/toeverything/affine:stable
+          image: ghcr.io/toeverything/affine:0.27.4
-          imagePullPolicy: Always
           command:
             [
               "sh",
@@ -45,7 +43,10 @@ spec:
             - name: AFFINE_ENABLE_SYNC_FROM_STARTUP
               value: "true"
             - name: DATABASE_URL
-              value: "postgres://affine:affine@postgresql.haven:5432/affine"
+              valueFrom:
+                secretKeyRef:
+                  name: affine-secret
+                  key: DB_CONNECTION_URL
             - name: REDIS_SERVER_HOST
               value: "redis.haven"
             - name: REDIS_SERVER_PORT
@@ -98,8 +99,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: affine-config
   namespace: cloud
-  annotations:
-    nfs.io/storage-path: "affine-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:
@@ -116,7 +115,6 @@ metadata:
   labels:
     app: affine
 spec:
-  ingressClassName: nginx
   rules:
     - host: affine.haven
       http:

apps/cloud/cloudreve.yaml

@@ -1,4 +1,3 @@
-# 2) Deployment
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -17,7 +16,6 @@ spec:
       containers:
         - name: cloudreve
           image: cloudreve/cloudreve:v4
-          imagePullPolicy: Always
           ports:
             - containerPort: 5212
               name: http
@@ -53,11 +51,6 @@ spec:
               value: "disable"
             - name: CR_CONF_Redis.Server
               value: ""
-            - name: CR_CONF_Redis.Password
-              valueFrom:
-                secretKeyRef:
-                  name: cloudreve-secret
-                  key: REDIS_PASSWORD
           volumeMounts:
             - name: cloudreve-data
               mountPath: /cloudreve/data
@@ -74,7 +67,6 @@ spec:
             server: 192.168.15.99
             path: /export/Storage/Cloud
 ---
-# 3) Service (HTTP)
 apiVersion: v1
 kind: Service
 metadata:
@@ -90,7 +82,6 @@ spec:
       name: http
 
 ---
-# 4) Service (Slave node / WebDAV — optional)
 apiVersion: v1
 kind: Service
 metadata:
@@ -111,14 +102,11 @@ spec:
       protocol: UDP
 
 ---
-# 5) PersistentVolumeClaim
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: cloudreve-data
   namespace: cloud
-  annotations:
-    nfs.io/storage-path: "cloudreve-data"
 spec:
   storageClassName: "nfs-client"
   accessModes:
@@ -129,7 +117,6 @@ spec:
     limits:
       storage: 50Gi
 ---
-# 6) Ingress
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -140,7 +127,6 @@ metadata:
     nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
 spec:
-  ingressClassName: nginx
   rules:
     - host: cloud.haven
       http:
@@ -153,7 +139,6 @@ spec:
                 port:
                   number: 5212
 ---
-# 7) Ingress Public
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -164,7 +149,6 @@ metadata:
     nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
 spec:
-  ingressClassName: nginx
   rules:
     - host: cloud.ivanch.me
       http:

apps/cloud/slink.yaml

@@ -99,8 +99,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: slink-data
   namespace: cloud
-  annotations:
-    nfs.io/storage-path: "slink-data"
 spec:
   storageClassName: "nfs-client"
   accessModes:
@@ -122,7 +120,6 @@ metadata:
     nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
 spec:
-  ingressClassName: nginx
   rules:
     - host: slink.haven
       http:

apps/cronjobs/renovatebot.yaml

@@ -0,0 +1,39 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: renovate
+  namespace: cronjobs
+spec:
+  schedule: "0 12 * * 0" # every Sunday 12:00
+  concurrencyPolicy: Forbid
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          containers:
+            - name: renovate
+              image: renovate/renovate:44.103.7
+              args:
+                - ivanch/haven
+              env:
+                - name: LOG_LEVEL
+                  value: debug
+                - name: RENOVATE_AUTODISCOVER
+                  value: "false"
+                - name: RENOVATE_PLATFORM
+                  value: "gitea"
+                - name: RENOVATE_ENDPOINT
+                  value: "https://git.ivanch.me"
+                - name: RENOVATE_GIT_AUTHOR
+                  value: "Renovate Bot <bot@renovateapp.com>"
+                - name: RENOVATE_TOKEN
+                  valueFrom:
+                    secretKeyRef:
+                      name: renovate-bot
+                      key: RENOVATE_TOKEN
+                - name: RENOVATE_GITHUB_COM_TOKEN
+                  valueFrom:
+                    secretKeyRef:
+                      name: renovate-bot
+                      key: RENOVATE_GITHUB_COM_TOKEN
+          restartPolicy: Never

apps/default/archivebox.yaml

@@ -65,14 +65,17 @@ spec:
             - name: SONIC_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: password
+                  name: archivebox-password
                   key: password
             - name: ADMIN_USERNAME
-              value: "ivanch"
+              valueFrom:
+                secretKeyRef:
+                  name: archivebox-password
+                  key: password
             - name: ADMIN_PASSWORD
               valueFrom:
                 secretKeyRef:
-                  name: password
+                  name: archivebox-password
                   key: password
             - name: CSRF_TRUSTED_ORIGINS
               value: "archive.haven"
@@ -121,14 +124,11 @@ spec:
       port: 8000
       targetPort: 8000
 ---
-# 3) PersistentVolumeClaim
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: archivebox-data
   namespace: default
-  annotations:
-    nfs.io/storage-path: "archivebox-data"
 spec:
   storageClassName: "nfs-client"
   accessModes:
@@ -145,7 +145,6 @@ metadata:
   name: archivebox-ingress
   namespace: default
 spec:
-  ingressClassName: nginx
   rules:
     - host: "archive.haven"
       http:

apps/default/changedetection.yaml

@@ -98,7 +98,6 @@ spec:
       restartPolicy: Always
       terminationGracePeriodSeconds: 30
 ---
-# 2) Service
 apiVersion: v1
 kind: Service
 metadata:
@@ -116,14 +115,11 @@ spec:
       protocol: TCP
       targetPort: http
 ---
-# 3) PersistentVolumeClaim
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: changedetection-config
   namespace: default
-  annotations:
-    nfs.io/storage-path: "changedetection-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:
@@ -134,7 +130,6 @@ spec:
     limits:
       storage: 2Gi
 ---
-# 4) Ingress
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -143,7 +138,6 @@ metadata:
   labels:
     app.kubernetes.io/name: changedetection
 spec:
-  ingressClassName: nginx
   rules:
     - host: change.haven
       http:

apps/default/homepage.yaml

@@ -157,8 +157,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: homepage-config
   namespace: default
-  annotations:
-    nfs.io/storage-path: "homepage-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:
@@ -192,7 +190,6 @@ metadata:
   labels:
     app.kubernetes.io/name: homepage
 spec:
-  ingressClassName: nginx
   rules:
     - host: "homepage.haven"
       http:

apps/default/it-tools.yaml

@@ -53,7 +53,6 @@ metadata:
   name: it-tools-ingress
   namespace: default
 spec:
-  ingressClassName: nginx
   rules:
     - host: "tools.haven"
       http:

apps/default/notepad.yaml

@@ -1,5 +1,4 @@
 ---
-# 1) Deployment
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -19,9 +18,6 @@ spec:
         - name: notepad
           image: jdreinhardt/minimalist-web-notepad:latest
           imagePullPolicy: Always
-          # The image entrypoint runs `chown -R www-data:www-data` on the NFS-mounted
-          # _tmp dir, which fails because the NFS export uses all_squash (anonuid=65534).
-          # Override the entrypoint to skip chown — ownership is handled by the NFS server.
           command:
             - sh
             - -c
@@ -47,7 +43,6 @@ spec:
             claimName: notepad-data
 
 ---
-# 2) Service
 apiVersion: v1
 kind: Service
 metadata:
@@ -61,14 +56,11 @@ spec:
     - port: 80
       targetPort: 80
 ---
-# 3) PersistentVolumeClaim
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: notepad-data
   namespace: default
-  annotations:
-    nfs.io/storage-path: "notepad-data"
 spec:
   storageClassName: "nfs-client"
   accessModes:
@@ -77,14 +69,12 @@ spec:
     requests:
       storage: 1Gi
 ---
-# 4) Ingress
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: notepad
   namespace: default
 spec:
-  ingressClassName: nginx
   rules:
     - host: notepad.haven
       http:

apps/default/openwebui.yaml

@@ -1,4 +1,3 @@
-# 1) Deployment
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -57,7 +56,6 @@ spec:
           persistentVolumeClaim:
             claimName: openwebui-data
 ---
-# 2) Service
 apiVersion: v1
 kind: Service
 metadata:
@@ -71,14 +69,11 @@ spec:
     - port: 8080
       targetPort: 8080
 ---
-# 3) PersistentVolumeClaim
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: openwebui-data
   namespace: default
-  annotations:
-    nfs.io/storage-path: "openwebui-data"
 spec:
   storageClassName: "nfs-client"
   accessModes:
@@ -89,7 +84,6 @@ spec:
     limits:
       storage: 10Gi
 ---
-# 4) Ingress
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -98,7 +92,6 @@ metadata:
   annotations:
     nginx.ingress.kubernetes.io/proxy-body-size: "50m"
 spec:
-  ingressClassName: nginx
   rules:
     - host: openwebui.haven
       http:

apps/default/paperless.yaml

@@ -118,8 +118,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: paperless-data
   namespace: default
-  annotations:
-    nfs.io/storage-path: "paperless-data"
 spec:
   storageClassName: "nfs-client"
   accessModes:
@@ -137,7 +135,6 @@ metadata:
   name: paperless
   namespace: default
 spec:
-  ingressClassName: nginx
   rules:
     - host: paperless.haven
       http:

apps/default/playwright.yaml

@@ -0,0 +1,129 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: playwright
+  namespace: default
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: playwright
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: playwright
+    spec:
+      affinity:
+        nodeAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - preference:
+                matchExpressions:
+                  - key: kubernetes.io/hostname
+                    operator: In
+                    values:
+                      - iris
+              weight: 100
+      containers:
+        - command:
+            - npx
+            - -y
+            - playwright@1.58.0
+            - run-server
+            - --port
+            - "3000"
+            - --host
+            - 0.0.0.0
+          env:
+            - name: TZ
+              value: America/Sao_Paulo
+          image: mcr.microsoft.com/playwright:v1.63.0-noble
+          name: playwright
+          ports:
+            - containerPort: 3000
+              protocol: TCP
+          resources:
+            limits:
+              cpu: "4"
+              memory: 4Gi
+            requests:
+              cpu: 500m
+              memory: 512Mi
+          terminationMessagePath: /dev/termination-log
+          terminationMessagePolicy: File
+          volumeMounts:
+            - mountPath: /dev/shm
+              name: dshm
+      dnsPolicy: ClusterFirst
+      restartPolicy: Always
+      schedulerName: default-scheduler
+      securityContext: {}
+      terminationGracePeriodSeconds: 30
+      volumes:
+        - emptyDir:
+            medium: Memory
+          name: dshm
+status:
+  availableReplicas: 1
+  conditions:
+    - lastTransitionTime: "2026-05-29T15:54:24Z"
+      lastUpdateTime: "2026-07-22T10:14:35Z"
+      message: ReplicaSet "playwright-86c74d7c78" has successfully progressed.
+      reason: NewReplicaSetAvailable
+      status: "True"
+      type: Progressing
+    - lastTransitionTime: "2026-08-28T06:04:14Z"
+      lastUpdateTime: "2026-08-28T06:04:14Z"
+      message: Deployment has minimum availability.
+      reason: MinimumReplicasAvailable
+      status: "True"
+      type: Available
+  observedGeneration: 95
+  readyReplicas: 1
+  replicas: 1
+  terminatingReplicas: 0
+  updatedReplicas: 1
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: playwright
+  namespace: default
+spec:
+  internalTrafficPolicy: Cluster
+  ipFamilies:
+    - IPv4
+  ipFamilyPolicy: SingleStack
+  ports:
+    - port: 3000
+      protocol: TCP
+      targetPort: 3000
+  selector:
+    app: playwright
+  sessionAffinity: None
+  type: ClusterIP
+status:
+  loadBalancer: {}
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: playwright
+  namespace: default
+spec:
+  rules:
+    - host: playwright.haven
+      http:
+        paths:
+          - backend:
+              service:
+                name: playwright
+                port:
+                  number: 3000
+            path: /
+            pathType: Prefix
+status:
+  loadBalancer:
+    ingress:
+      - ip: 192.168.20.204

apps/default/searxng.yaml

@@ -63,8 +63,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: searxng-config
   namespace: default
-  annotations:
-    nfs.io/storage-path: "searxng-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:
@@ -80,7 +78,6 @@ metadata:
   name: searxng
   namespace: default
 spec:
-  ingressClassName: nginx
   rules:
     - host: search.haven
       http:
@@ -91,4 +88,4 @@ spec:
               service:
                 name: searxng
                 port:
-                  number: 8080
+                  number: 8080

apps/default/stirlingpdf.yaml

@@ -80,8 +80,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: stirlingpdf-config
   namespace: default
-  annotations:
-    nfs.io/storage-path: "stirlingpdf-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:
@@ -99,7 +97,6 @@ metadata:
   labels:
     app: stirlingpdf
 spec:
-  ingressClassName: nginx
   rules:
     - host: stirling.haven
       http:

apps/default/uptimekuma.yaml

@@ -20,7 +20,6 @@ spec:
       containers:
         - name: uptimekuma
           image: louislam/uptime-kuma:2
-          imagePullPolicy: Always
           env:
             - name: PUID
               value: "1000"
@@ -56,7 +55,7 @@ spec:
           persistentVolumeClaim:
             claimName: uptimekuma-config
 ---
-# 2) Service  
+# 2) Service
 apiVersion: v1
 kind: Service
 metadata:
@@ -76,8 +75,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: uptimekuma-config
   namespace: default
-  annotations:
-    nfs.io/storage-path: "uptimekuma-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:
@@ -93,7 +90,6 @@ metadata:
   name: uptimekuma
   namespace: default
 spec:
-  ingressClassName: nginx
   rules:
     - host: uptimekuma.haven
       http:
@@ -104,4 +100,4 @@ spec:
               service:
                 name: uptimekuma
                 port:
-                  number: 3001
+                  number: 3001

apps/default/vaultwarden.yaml

@@ -17,8 +17,7 @@ spec:
     spec:
       containers:
         - name: vaultwarden
-          image: vaultwarden/server:latest
+          image: vaultwarden/server:1.37.3
-          imagePullPolicy: Always
           env:
             - name: DOMAIN
               value: "https://vault.haven"
@@ -90,8 +89,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: vaultwarden-data
   namespace: default
-  annotations:
-    nfs.io/storage-path: "vaultwarden-data"
 spec:
   storageClassName: "nfs-client"
   accessModes:
@@ -110,7 +107,6 @@ metadata:
     cert-manager.io/cluster-issuer: internal-ca
     nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
 spec:
-  ingressClassName: nginx
   tls:
     - hosts:
         - vault.haven
@@ -134,7 +130,6 @@ metadata:
   name: vaultwarden-public
   namespace: default
 spec:
-  ingressClassName: nginx
   rules:
     - host: vault.ivanch.me
       http:

apps/dev/gitea-runner.yaml

@@ -41,8 +41,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: gitea-runner-amd64-pvc
   namespace: dev
-  annotations:
-    nfs.io/storage-path: "gitea-runner-amd64-pvc"
 spec:
   storageClassName: "nfs-client"
   accessModes:
@@ -57,8 +55,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: gitea-runner-arm64-pvc
   namespace: dev
-  annotations:
-    nfs.io/storage-path: "gitea-runner-arm64-pvc"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/dns/adguard-sync.yaml

@@ -0,0 +1,114 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: adguardsync-pvc
+  namespace: dns
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Mi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: adguardsync
+  namespace: dns
+spec:
+  strategy:
+    type: Recreate
+  replicas: 1
+  selector:
+    matchLabels:
+      app: adguardsync
+  template:
+    metadata:
+      labels:
+        app: adguardsync
+    spec:
+      containers:
+        - name: adguardsync
+          image: ghcr.io/bakito/adguardhome-sync:v0.9.3
+          ports:
+            - containerPort: 8080
+              protocol: TCP
+              name: web-port
+          env:
+            - name: CRON
+              value: "0 * * * *"
+            - name: RUN_ON_START
+              value: "true"
+            - name: LOG_LEVEL
+              value: "info"
+            - name: ORIGIN_URL
+              value: "http://adguard.haven"
+            - name: ORIGIN_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: adguardhome-password
+                  key: username
+            - name: ORIGIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: adguardhome-password
+                  key: password
+            - name: REPLICA1_URL
+              value: "http://adguard2.haven"
+            - name: REPLICA1_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: adguardhome-password
+                  key: username
+            - name: REPLICA1_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: adguardhome-password
+                  key: password
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          volumeMounts:
+            - name: adguardsync-storage
+              mountPath: /config
+      volumes:
+        - name: adguardsync-storage
+          persistentVolumeClaim:
+            claimName: adguardsync-pvc
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: adguardsync-svc
+  namespace: dns
+spec:
+  type: ClusterIP
+  selector:
+    app: adguardsync
+  ports:
+    - name: web
+      port: 8080
+      targetPort: 8080
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: adguardsync-ingress
+  namespace: dns
+spec:
+  rules:
+    - host: adguardsync.haven
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: adguardsync-svc
+                port:
+                  number: 8080

apps/dns/adguard.yaml

@@ -0,0 +1,178 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: adguardhome-pvc
+  namespace: dns
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: adguardhome
+  namespace: dns
+spec:
+  strategy:
+    type: Recreate
+  replicas: 1
+  selector:
+    matchLabels:
+      app: adguardhome
+  template:
+    metadata:
+      labels:
+        app: adguardhome
+    spec:
+      affinity:
+        nodeAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values:
+                      - arm64
+      containers:
+        - name: adguardhome
+          image: adguard/adguardhome:v0.107.79
+          ports:
+            - containerPort: 53
+              protocol: TCP
+            - containerPort: 53
+              protocol: UDP
+            - containerPort: 3000
+              protocol: TCP
+              name: install-port
+            - containerPort: 80
+              protocol: TCP
+              name: web-port
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 1000m
+              memory: 2Gi
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 80
+            initialDelaySeconds: 30
+            periodSeconds: 10
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 80
+            initialDelaySeconds: 5
+            periodSeconds: 5
+          volumeMounts:
+            - name: adguardhome-storage
+              mountPath: /opt/adguardhome/work
+            - name: adguardhome-storage
+              mountPath: /opt/adguardhome/conf
+      volumes:
+        - name: adguardhome-storage
+          persistentVolumeClaim:
+            claimName: adguardhome-pvc
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: adguardhome-svc
+  namespace: dns
+spec:
+  type: LoadBalancer
+  selector:
+    app: adguardhome
+  loadBalancerIP: 192.168.20.200
+  ports:
+    - name: dns-tcp
+      port: 53
+      targetPort: 53
+      protocol: TCP
+    - name: dns-udp
+      port: 53
+      targetPort: 53
+      protocol: UDP
+    - name: web
+      port: 80
+      targetPort: 80
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: adguardhome-lan-svc
+  namespace: dns
+spec:
+  type: LoadBalancer
+  selector:
+    app: adguardhome
+  loadBalancerIP: 192.168.15.200
+  ports:
+    - name: dns-tcp
+      port: 53
+      targetPort: 53
+      protocol: TCP
+    - name: dns-udp
+      port: 53
+      targetPort: 53
+      protocol: UDP
+    - name: web
+      port: 80
+      targetPort: 80
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: adguard-install-svc
+  namespace: dns
+spec:
+  type: ClusterIP
+  selector:
+    app: adguardhome
+  ports:
+    - name: install
+      port: 3000
+      targetPort: 3000
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: adguardhome-ingress
+  namespace: dns
+spec:
+  rules:
+    - host: adguard.haven
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: adguardhome-svc
+                port:
+                  number: 80
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: adguardhome-install-ingress
+  namespace: dns
+spec:
+  rules:
+    - host: install.adguard.haven
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: adguard-install-svc
+                port:
+                  number: 3000

apps/infra/beszel-agent.yaml

@@ -22,8 +22,7 @@ spec:
                 secretKeyRef:
                   name: beszel-key
                   key: SECRET-KEY
-          image: henrygd/beszel-agent:0.18.7
+          image: henrygd/beszel-agent:0.20.0
-          imagePullPolicy: Always
           name: beszel-agent
           ports:
             - containerPort: 45876

apps/infra/beszel.yaml

@@ -26,8 +26,7 @@ spec:
                       - amd64
       containers:
         - name: beszel
-          image: ghcr.io/henrygd/beszel/beszel:0.18.7
+          image: ghcr.io/henrygd/beszel/beszel:0.20.0
-          imagePullPolicy: Always
           ports:
             - containerPort: 8090
               name: beszel-port
@@ -66,8 +65,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: beszel-config
   namespace: infra
-  annotations:
-    nfs.io/storage-path: "beszel-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:
@@ -83,7 +80,6 @@ metadata:
   name: beszel
   namespace: infra
 spec:
-  ingressClassName: nginx
   rules:
     - host: beszel.haven
       http:

apps/infra/bitwarden-cli.yaml

@@ -0,0 +1,197 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: bitwarden-cli-ca
+  namespace: infra
+  labels:
+    app.kubernetes.io/name: bitwarden-cli
+data:
+  # Public CA certificate used by the internal-ca ClusterIssuer. Keep this in
+  # sync if the issuer CA is rotated.
+  haven-ca.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIFBzCCAu+gAwIBAgIUGFrjEo+WOxJpMnJqU/RQ881kWI8wDQYJKoZIhvcNAQEL
+    BQAwEzERMA8GA1UEAwwISGF2ZW4gQ0EwHhcNMjUwOTA3MTUxNTE3WhcNMzUwOTA1
+    MTUxNTE3WjATMREwDwYDVQQDDAhIYXZlbiBDQTCCAiIwDQYJKoZIhvcNAQEBBQAD
+    ggIPADCCAgoCggIBAK+8DxQfCYdRfGnJoEu0CiSuw64lnUFryvzy3GPkfGEEzc3f
+    ZiH6pUUIpQnrbVc1wdq3ojEOveGyLIqWxkljz8gEaMDJwB7udOxfbgv0QFI4cFKs
+    QzB+g3VVf74mYHvqfGB1suxmdVJ8YxcW3rQl7XD94PLxfoZuQ8IKKjskaQnYXUGH
+    wi6YBmIjpxr23lvT5cTbd5YgTFYVXDzM8nWtmnd2Wa9WkNZtKaHQKIeiNEpUPV0+
+    KSHVQC7vdmGmbUZXWpK2jmLFWfYaI0vXUal0CyMv1QidTd5LsDCI4Y+dx4mSBLuu
+    ip5V4Wm1DxttyaKUZM2vhzHEsDSVHz/xqx9nJeoJJuP+OirQVETD3FcN5PNVkWXu
+    EHQAqUciBh1CMJKKT74SE5oTT1/Eni9N2uYlvXsOs3ne6TTjZYxcL6VU+aqyYvvF
+    oMo3DX2a5nZvht4E1BtCd4I/RlnOw5QBAvWbFJqpbo/DTAGo/WBgv7jXCGail+uQ
+    r7iLoKFnhGq0WB9d2UUg6qDRD11I1nZANkv4t3Z2HFbG4XxdpttPm7JjxlcC3gGa
+    AfE3rChmAQPWPLSn6msOcfA+l5OD9SoSYU9nHy81T2q06Kfg/VWDdz7Wvi+WNZ20
+    gcfZPUZQsLlgZeyjmoA27D7ayO5uxjTWCi35kIgKcDDutyHctPRQs5zlTD35AgMB
+    AAGjUzBRMB0GA1UdDgQWBBSqABoe6cCk5vMc3LfnZfhiMbJ+kjAfBgNVHSMEGDAW
+    gBSqABoe6cCk5vMc3LfnZfhiMbJ+kjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3
+    DQEBCwUAA4ICAQAWAqQgFYEH14J2pwKptLb/K2C2oT9XLVnArQ5PKOzyWWhfZXsr
+    3YB707XJ7ju12n5gBgjCK4R66IG/iYNfHdBfhb9M1BVJ3T035RH8d6lhlZbxC02s
+    ZIMrQxDVFRrWm7gxcQiMILfPl2hJmsLf9XIUTBzPWFj9E+wExXrDYdiZXU+a/9qP
+    JvLKZA7T2lSBu+XtccySVLHXoxZ/A/c7Gp8XYJ2srZ2tXGN+j1dXiSMWHD/fpdxs
+    3GDKFnOOz2NTjHhYvBR94sOx3UkA3Pz+ufcHFBWWh23iGOPDDjh0vqAKItz2G0Kb
+    9B99XVnHWHamaZ2tV40x7lVn1mo9ImFVtxW2XDQ/NkRB9PuT2ryGE67Ey/Zfoq5M
+    0gZXIMtuMS25dTB8gQ8PKlXluIf4EbaDXhFk5xFHz5NP0E5Um4SxJP8H30/+UUPd
+    bu/TMcNiiAgxaTLBbE3nw/L7bYfH+5KuTLlp17H0UEtSI1GosgGYooov+Zbj4ZF8
+    Ko108LKAFDGe8/uQVeuo00CrEqXwVRtCCkv+LBcCJDicoyqWbp4GCBp+IVN0nxWX
+    xIRYVtQZCmA3hSH3rwt0/2dBxkcta4YkHZUEZ+EXaFl3z1tcbErOhBvupBvnBuZP
+    Rp2yvEJuuY6M1j+CZrfCm7qMipXTGPQ11Q7hf6jJ0xzxjTkV9TyV1ptPPQ==
+    -----END CERTIFICATE-----
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: bitwarden-cli
+  namespace: infra
+  labels:
+    app.kubernetes.io/name: bitwarden-cli
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: bitwarden-cli
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: bitwarden-cli
+    spec:
+      nodeSelector:
+        kubernetes.io/arch: amd64
+      containers:
+        - name: bitwarden-cli
+          image: ghcr.io/charlesthomas/bitwarden-cli:2026.8.0  # 2026.9.0 requires Vaultwarden's unimplemented user-key-ID backfill API
+          imagePullPolicy: IfNotPresent
+          # Override the baked entrypoint so --disable-origin-protection is
+          # actually passed (it was commented out in the image's entrypoint.sh,
+          # which made bw serve reject all cross-pod requests -> connection refused).
+          command: ["/bin/bash", "-lc"]
+          args:
+            - |
+              set -e
+              bw config server "${BW_HOST}"
+
+              # Authenticate. Prefer the API key if client creds are present.
+              login() {
+                if [ -n "$BW_CLIENTID" ] && [ -n "$BW_CLIENTSECRET" ]; then
+                  echo "Using apikey to log in"
+                  BW_SESSION=$(bw login --apikey --raw) || return 1
+                else
+                  echo "Using password to log in"
+                  BW_SESSION=$(bw login "${BW_USER}" --passwordenv BW_PASSWORD --raw) || return 1
+                fi
+                export BW_SESSION
+              }
+
+              login
+
+              # Warm the vault cache once at startup so bw serve has data immediately.
+              bw sync
+              bw status
+
+              # Keep the session alive
+
+              echo "Starting periodic bw login+sync loop (every 5m)"
+              (
+                while true; do
+                  sleep 300
+                  login || true
+                  echo "[$(date -u +%FT%TZ)] bw sync"
+                  bw sync >/dev/null 2>&1 || echo "[$(date -u +%FT%TZ)] bw sync failed"
+                done
+              ) &
+
+              echo 'Running `bw serve` on port 8087'
+              bw serve --hostname 0.0.0.0 --disable-origin-protection
+          env:
+            # Bitwarden CLI is Node-based and needs the internal issuer CA to
+            # verify the HTTPS certificate for vault.haven.
+            - name: NODE_EXTRA_CA_CERTS
+              value: /etc/ssl/certs/haven-ca.crt
+            # Use the in-cluster ingress. The public endpoint currently
+            # returns 502 from inside the cluster.
+            - name: BW_HOST
+              value: https://vault.haven
+            - name: BW_USER
+              valueFrom:
+                secretKeyRef:
+                  name: bitwarden-cli
+                  key: BW_USERNAME
+            - name: BW_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: bitwarden-cli
+                  key: BW_PASSWORD
+          volumeMounts:
+            - name: haven-ca
+              mountPath: /etc/ssl/certs/haven-ca.crt
+              subPath: haven-ca.crt
+              readOnly: true
+          ports:
+            - name: http
+              containerPort: 8087
+              protocol: TCP
+          startupProbe:
+            tcpSocket: { port: 8087 }
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 30
+          readinessProbe:
+            tcpSocket: { port: 8087 }
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          livenessProbe:
+            tcpSocket: { port: 8087 }
+            periodSeconds: 15
+            timeoutSeconds: 3
+            failureThreshold: 6
+          resources:
+            limits:
+              cpu: 400m
+              memory: 512Mi
+            requests:
+              cpu: 50m
+              memory: 128Mi
+      volumes:
+        - name: haven-ca
+          configMap:
+            name: bitwarden-cli-ca
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: bitwarden-cli
+  namespace: infra
+  labels:
+    app.kubernetes.io/name: bitwarden-cli
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: bitwarden-cli
+  ports:
+    - name: http
+      port: 8087
+      targetPort: http
+      protocol: TCP
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: bw-cli
+  namespace: infra
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: bitwarden-cli
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        # ESO pods in the external-secrets namespace.
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: external-secrets
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: external-secrets

apps/infra/code-config.yaml

@@ -82,8 +82,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: code-config
   namespace: infra
-  annotations:
-    nfs.io/storage-path: "code-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:
@@ -99,7 +97,6 @@ metadata:
   name: code-config
   namespace: infra
 spec:
-  ingressClassName: nginx
   rules:
     - host: code-config.haven
       http:

apps/infra/csi-driver-nfs.yaml

@@ -0,0 +1,26 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: csi-driver-nfs
+  namespace: infra
+spec:
+  repo: https://kubernetes-csi.github.io/csi-driver-nfs
+  chart: csi-driver-nfs
+  version: 4.13.4
+  targetNamespace: infra
+  valuesContent: |-
+    controller:
+      replicas: 1
+      logLevel: 5
+      defaultOnDeletePolicy: retain
+    storageClasses:
+      - name: nfs-client
+        annotations:
+          storageclass.kubernetes.io/is-default-class: "true"
+        parameters:
+          server: nfs-config.haven
+          share: /export/config
+          subDir: ${pvc.metadata.namespace}/${pvc.metadata.name}
+          onDelete: retain
+        reclaimPolicy: Retain
+        volumeBindingMode: Immediate

apps/infra/external-secrets-helm.yaml

@@ -0,0 +1,11 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: external-secrets
+  namespace: kube-system
+spec:
+  repo: https://charts.external-secrets.io
+  chart: external-secrets
+  version: 2.7.0
+  targetNamespace: external-secrets
+  createNamespace: true

apps/infra/file-nginx.yaml

@@ -19,6 +19,8 @@ spec:
     metadata:
       labels:
         app: file-nginx
+      annotations:
+        checksum/file-nginx-conf: "4235705a54e5003a340f1a4e164c3e3239fd4327d9aa9ecf0c640a3655def3c9"
     spec:
       containers:
         - name: nginx
@@ -83,11 +85,19 @@ data:
         server_name  _;
 
         root   /usr/share/nginx/data/file-nginx;
-        index  index.html;
 
         autoindex on;
+        autoindex_exact_size off;
+        autoindex_localtime on;
+
+        location = /index.html {
+            # The legacy static page is now the live directory browser.
+            return 302 /;
+        }
 
         location / {
+            # Bypass the static welcome page so every directory is browsable.
+            index __directory_listing__;
             try_files $uri $uri/ =404;
         }
     }
@@ -115,7 +125,6 @@ metadata:
     nginx.ingress.kubernetes.io/enable-cors: "true"
     nginx.ingress.kubernetes.io/cors-allow-origin: "*"
 spec:
-  ingressClassName: nginx
   rules:
     - host: file-nginx.haven
       http:

apps/infra/haven-notify.yaml

@@ -72,7 +72,6 @@ metadata:
   name: haven-notify
   namespace: infra
 spec:
-  ingressClassName: nginx
   rules:
     - host: notify.haven
       http:

apps/infra/ingress-traefik.yaml

@@ -0,0 +1,32 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: traefik
+  namespace: kube-system
+spec:
+  repo: https://traefik.github.io/charts
+  chart: traefik
+  version: 41.2.0
+  targetNamespace: traefik
+  createNamespace: true
+  valuesContent: |-
+    deployment:
+      replicas: 2
+    ingressClass:
+      enabled: true
+      isDefaultClass: true
+      name: traefik
+    service:
+      annotations:
+        metallb.io/ip-allocated-from-pool: default-pool
+        metallb.io/loadBalancerIPs: "192.168.20.204"
+      spec:
+        type: LoadBalancer
+        externalTrafficPolicy: Local
+    resources:
+      requests:
+        cpu: 100m
+        memory: 90Mi
+      limits:
+        cpu: 1000m
+        memory: 256Mi

apps/infra/wg-easy.yaml

@@ -3,8 +3,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: wg-easy-pvc
   namespace: infra
-  annotations:
-    nfs.io/storage-path: "wg-easy-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:
@@ -20,7 +18,10 @@ metadata:
   namespace: infra
 spec:
   strategy:
-    type: Recreate
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
   replicas: 1
   selector:
     matchLabels:
@@ -38,12 +39,11 @@ spec:
                   - key: kubernetes.io/hostname
                     operator: In
                     values:
-                      - nexus
+                      - polaris
               weight: 100
       containers:
         - name: wg-easy
-          image: ghcr.io/wg-easy/wg-easy:latest
+          image: ghcr.io/wg-easy/wg-easy:15.4.0
-          imagePullPolicy: Always
           ports:
             - containerPort: 51820
               protocol: UDP
@@ -54,15 +54,11 @@ spec:
           env:
             - name: LANG
               value: en
-            - name: WG_HOST
-              value: vpn.ivanch.me
             - name: WG_MTU
               value: "1420"
             - name: UI_TRAFFIC_STATS
               value: "true"
-            - name: UI_CHART_TYPE
+            - name: INSECURE
-              value: "0"
-            - name: WG_ENABLE_ONE_TIME_LINKS
               value: "true"
             - name: UI_ENABLE_SORT_CLIENTS
               value: "true"
@@ -78,14 +74,37 @@ spec:
             limits:
               cpu: 2000m
               memory: 1Gi
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 51821
+            initialDelaySeconds: 15
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 51821
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 2
           volumeMounts:
             - name: wg-easy-volume
               mountPath: /etc/wireguard
+            - name: kernel-modules
+              mountPath: /lib/modules
+              readOnly: true
       restartPolicy: Always
       volumes:
         - name: wg-easy-volume
           persistentVolumeClaim:
             claimName: wg-easy-pvc
+        - name: kernel-modules
+          hostPath:
+            path: /lib/modules
+            type: Directory
 ---
 apiVersion: v1
 kind: Service
@@ -113,7 +132,6 @@ metadata:
   name: wg-easy-ingress
   namespace: infra
 spec:
-  ingressClassName: nginx
   rules:
     - host: vpn.haven
       http:
@@ -125,3 +143,14 @@ spec:
                 name: wg-easy-svc
                 port:
                   number: 51821
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: wg-easy-pdb
+  namespace: infra
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app: wg-easy

apps/metallb-system/metallb.yaml

@@ -0,0 +1,10 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: metallb
+  namespace: kube-system
+spec:
+  repo: https://metallb.github.io/metallb
+  chart: metallb
+  version: 0.15.2
+  targetNamespace: metallb-system

apps/monitoring/alloy.yaml

@@ -0,0 +1,123 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+chart: true
+metadata:
+  name: alloy
+  namespace: argocd
+  finalizers: [resources-finalizer.argocd.argoproj.io]
+spec:
+  project: default
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: monitoring
+  syncPolicy:
+    automated: { prune: true, selfHeal: true }
+    syncOptions: [CreateNamespace=true, ServerSideApply=true]
+  source:
+    repoURL: https://grafana.github.io/helm-charts
+    chart: alloy
+    targetRevision: 1.12.1
+    helm:
+      valuesObject:
+        controller:
+          type: daemonset
+        alloy:
+          clustering: { enabled: false }
+          mounts:
+            varlog: true
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 200m
+              memory: 256Mi
+          configMap:
+            create: true
+            content: |-
+              discovery.kubernetes "all_pods" {
+                role = "pod"
+
+                selectors {
+                  role  = "pod"
+                  field = "spec.nodeName=" + coalesce(env("HOSTNAME"), constants.hostname)
+                }
+              }
+
+              discovery.relabel "all_pods" {
+                targets = discovery.kubernetes.all_pods.targets
+
+                rule {
+                  source_labels = ["__meta_kubernetes_namespace"]
+                  target_label  = "namespace"
+                }
+                rule {
+                  source_labels = ["__meta_kubernetes_pod_name"]
+                  target_label  = "pod"
+                }
+                rule {
+                  source_labels = ["__meta_kubernetes_pod_container_name"]
+                  target_label  = "container"
+                }
+                rule {
+                  source_labels = ["__meta_kubernetes_pod_label_app_kubernetes_io_name"]
+                  target_label  = "app"
+                }
+              }
+
+              loki.source.kubernetes "all_logs" {
+                targets    = discovery.relabel.all_pods.output
+                forward_to = [loki.write.main.receiver]
+              }
+
+              discovery.kubernetes "shared_pods" {
+                role = "pod"
+                selectors {
+                  role  = "pod"
+                  field = "metadata.namespace=chacal"
+                }
+              }
+
+              discovery.relabel "shared_pods" {
+                targets = discovery.kubernetes.shared_pods.targets
+
+                rule {
+                  source_labels = ["__meta_kubernetes_namespace"]
+                  target_label  = "namespace"
+                }
+                rule {
+                  source_labels = ["__meta_kubernetes_pod_name"]
+                  target_label  = "pod"
+                }
+                rule {
+                  source_labels = ["__meta_kubernetes_pod_container_name"]
+                  target_label  = "container"
+                }
+                rule {
+                  source_labels = ["__meta_kubernetes_pod_label_app_kubernetes_io_name"]
+                  target_label  = "app"
+                }
+              }
+
+              loki.source.kubernetes "shared_logs" {
+                targets    = discovery.relabel.shared_pods.output
+                forward_to = [loki.write.shared.receiver]
+              }
+
+              loki.write "main" {
+                endpoint {
+                  url = "http://loki.monitoring.svc.cluster.local:3100/loki/api/v1/push"
+                  headers = {
+                    "X-Scope-OrgID" = "main",
+                  }
+                }
+              }
+
+              loki.write "shared" {
+                endpoint {
+                  url = "http://loki.monitoring.svc.cluster.local:3100/loki/api/v1/push"
+                  headers = {
+                    "X-Scope-OrgID" = "chacal",
+                  }
+                }
+              }

apps/monitoring/grafana.yaml

@@ -47,10 +47,10 @@ spec:
           resources:
             requests:
               cpu: 250m
-              memory: 750Mi
+              memory: 512Mi
             limits:
-              memory: 1Gi
+              memory: 2Gi
-              cpu: 500m
+              cpu: 1000m
           volumeMounts:
             - mountPath: /var/lib/grafana
               name: grafana-pv
@@ -64,8 +64,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: grafana-pvc
   namespace: monitoring
-  annotations:
-    nfs.io/storage-path: "grafana-data"
 spec:
   storageClassName: "nfs-client"
   accessModes:
@@ -94,7 +92,6 @@ metadata:
   namespace: monitoring
   name: grafana
 spec:
-  ingressClassName: nginx
   rules:
     - host: grafana.haven
       http:
@@ -113,7 +110,6 @@ metadata:
   namespace: monitoring
   name: grafana-public
 spec:
-  ingressClassName: nginx
   rules:
     - host: grafanah.ivanch.me
       http:

apps/monitoring/kube-state-metrics.yaml

@@ -86,7 +86,7 @@ spec:
         kubernetes.io/os: linux
       containers:
         - name: kube-state-metrics
-          image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1
+          image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0
           imagePullPolicy: IfNotPresent
           args:
             - --resources=cronjobs,daemonsets,deployments,jobs,nodes,persistentvolumeclaims,pods,replicasets,statefulsets

apps/monitoring/loki.yaml

@@ -5,6 +5,8 @@ metadata:
   namespace: monitoring
 spec:
   replicas: 1
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: loki
@@ -36,8 +38,9 @@ spec:
           configMap:
             name: loki-config
         - name: loki-storage
-          emptyDir:
+          nfs:
-            medium: Memory
+            server: nexus.haven
+            path: /export/sandbox/loki
 ---
 apiVersion: v1
 kind: ConfigMap
@@ -79,7 +82,12 @@ data:
 
     limits_config:
       allow_structured_metadata: true
-      retention_period: 0
+      retention_period: 72h
+      max_query_lookback: 72h
+      # Global per-tenant cap: <= 0.1 MB/s sustained keeps this sandbox disk bounded.
+      ingestion_rate_strategy: global
+      ingestion_rate_mb: 0.1
+      ingestion_burst_size_mb: 0.5
 
     ingester:
       lifecycler:
@@ -92,7 +100,12 @@ data:
       chunk_target_size: 1536000
 
     compactor:
-      retention_enabled: false
+      working_directory: /tmp/loki/compactor
+      compaction_interval: 10m
+      retention_enabled: true
+      retention_delete_delay: 2h
+      retention_delete_worker_count: 10
+      delete_request_store: filesystem
 ---
 apiVersion: v1
 kind: Service

apps/monitoring/prometheus.yaml

@@ -7,6 +7,8 @@ metadata:
     app: prometheus
 spec:
   replicas: 1
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: prometheus
@@ -22,7 +24,9 @@ spec:
           args:
             - "--config.file=/etc/prometheus/prometheus.yml"
             - "--storage.tsdb.path=/prometheus"
-            - "--storage.tsdb.retention.time=1d"
+            - "--storage.tsdb.retention.time=2d"
+            # Keep a generous buffer on the 117 GiB sandbox filesystem; WAL may exceed this briefly.
+            - "--storage.tsdb.retention.size=8GB"
             - "--web.enable-lifecycle"
           ports:
             - containerPort: 9090
@@ -44,17 +48,15 @@ spec:
           persistentVolumeClaim:
             claimName: prometheus-pvc
         - name: prometheus-storage
-          emptyDir:
+          nfs:
-            medium: Memory
+            server: nexus.haven
-            sizeLimit: 256Mi
+            path: /export/sandbox/prometheus
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: prometheus-pvc
   namespace: monitoring
-  annotations:
-    nfs.io/storage-path: "prometheus-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:
@@ -63,6 +65,19 @@ spec:
     requests:
       storage: 1Gi
 ---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: prometheus-storage-pvc
+  namespace: monitoring
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
+---
 # Service URL - http://prometheus.monitoring.svc.cluster.local:9090
 apiVersion: v1
 kind: Service
@@ -96,22 +111,22 @@ metadata:
   labels:
     app: prometheus
 rules:
-- apiGroups: [""]
+  - apiGroups: [""]
-  resources:
+    resources:
-  - nodes
+      - nodes
-  - nodes/proxy
+      - nodes/proxy
-  - services
+      - services
-  - endpoints
+      - endpoints
-  - pods
+      - pods
-  verbs: ["get", "list", "watch"]
+    verbs: ["get", "list", "watch"]
-- apiGroups: ["extensions"]
+  - apiGroups: ["extensions"]
-  resources:
+    resources:
-  - ingresses
+      - ingresses
-  verbs: ["get", "list", "watch"]
+    verbs: ["get", "list", "watch"]
-- apiGroups: ["networking.k8s.io"]
+  - apiGroups: ["networking.k8s.io"]
-  resources:
+    resources:
-  - ingresses
+      - ingresses
-  verbs: ["get", "list", "watch"]
+    verbs: ["get", "list", "watch"]
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: ClusterRoleBinding
@@ -125,6 +140,6 @@ roleRef:
   kind: ClusterRole
   name: prometheus
 subjects:
-- kind: ServiceAccount
+  - kind: ServiceAccount
-  name: prometheus
+    name: prometheus
-  namespace: monitoring
+    namespace: monitoring

apps/root/applicationset.yaml

@@ -0,0 +1,46 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: haven-apps
+  namespace: argocd
+spec:
+  goTemplate: true
+  goTemplateOptions: ["missingkey=error"]
+  generators:
+    - git:
+        repoURL: https://git.ivanch.me/ivanch/haven.git
+        revision: main
+        files:
+          - path: "apps/*/*.yaml"
+          - path: "apps/root/*.yaml"
+            exclude: true
+  template:
+    metadata:
+      name: '{{ .path.filename | trimSuffix ".yaml" }}'
+      namespace: argocd
+      finalizers:
+        - resources-finalizer.argocd.argoproj.io
+    spec:
+      project: default
+      source:
+        repoURL: https://git.ivanch.me/ivanch/haven.git
+        targetRevision: main
+        path: "{{ .path.path }}"
+        directory:
+          include: "{{ .path.filename }}"
+      destination:
+        server: https://kubernetes.default.svc
+        namespace: "{{ index .path.segments 1 }}"
+      syncPolicy:
+        automated:
+          prune: true
+          selfHeal: true
+  templatePatch: |
+    {{- if hasKey . "chart" }}
+    spec:
+      source:
+        $patch: replace
+        {{- toYaml .spec.source | nindent 4 }}
+      syncPolicy:
+        syncOptions: [CreateNamespace=true, ServerSideApply=true]
+    {{- end }}

apps/root/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - applicationset.yaml

bootstrap/address-pool.yaml

@@ -0,0 +1,22 @@
+apiVersion: metallb.io/v1beta1
+kind: IPAddressPool
+metadata:
+  name: default-pool
+  namespace: metallb-system
+spec:
+  addresses:
+    - 192.168.15.200/32 # reserved for DNS 1
+    - 192.168.15.202/32 # reserved for wg-easy
+    - 192.168.15.203/32 # reserved for k3s ingress
+    - 192.168.20.200/32 # reserved for DNS 1
+    # - 192.168.20.201 is reserved for DNS 2
+    - 192.168.20.202-192.168.20.220
+---
+apiVersion: metallb.io/v1beta1
+kind: L2Advertisement
+metadata:
+  name: default-advertisement
+  namespace: metallb-system
+spec:
+  ipAddressPools:
+    - default-pool

bootstrap/argocd-install/argocd-api-user.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-cm
+  namespace: argocd
+  labels:
+    app.kubernetes.io/name: argocd-cm
+    app.kubernetes.io/part-of: argocd
+data:
+  accounts.api: apiKey
+  accounts.api.enabled: "true"
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-rbac-cm
+  namespace: argocd
+  labels:
+    app.kubernetes.io/name: argocd-rbac-cm
+    app.kubernetes.io/part-of: argocd
+data:
+  policy.csv: |
+    g, api, role:readonly

bootstrap/argocd-install/ingress.yaml

@@ -0,0 +1,17 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: argocd-server
+  namespace: argocd
+spec:
+  rules:
+    - host: argocd.haven
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: argocd-server
+                port:
+                  number: 80

bootstrap/argocd-install/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: argocd
+
+resources:
+  - https://github.com/argoproj/argo-cd.git/manifests/cluster-install?ref=stable
+  - ingress.yaml
+
+patches:
+  - path: server-insecure-patch.yaml
+  - path: argocd-api-user.yaml

bootstrap/argocd-install/server-insecure-patch.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: argocd-cmd-params-cm
+data:
+  server.insecure: "true"

bootstrap/namespaces.yaml

@@ -0,0 +1,128 @@
+---
+# ==============================================================================
+# Core / System Namespaces
+# ==============================================================================
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: default
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kube-node-lease
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kube-public
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kube-system
+---
+# ==============================================================================
+# Infrastructure, Ingress & GitOps
+# ==============================================================================
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: argocd
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cert-manager
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: dns
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: docker-ingress
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: external-secrets
+  labels:
+    name: external-secrets
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: infra
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: metallb-system
+---
+# ==============================================================================
+# Observability & Monitoring
+# ==============================================================================
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: monitoring
+---
+# ==============================================================================
+# Storage & Data
+# ==============================================================================
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: garage
+  labels:
+    name: garage
+---
+# ==============================================================================
+# Environments & Workloads
+# ==============================================================================
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: chacal
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cloud
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cronjobs
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: dev
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: lab
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: media
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: mindforge
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: vpn-session-pods
+  labels:
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/warn: privileged

bootstrap/root-app.yaml

@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: root
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  source:
+    repoURL: https://git.ivanch.me/ivanch/haven.git
+    targetRevision: main
+    path: apps/root
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true

certs/internal-issuer.yaml

@@ -1,8 +0,0 @@
-# internal-issuer.yaml
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: internal-ca
-spec:
-  ca:
-    secretName: internal-ca-secret

dev/README.md

@@ -1,6 +0,0 @@
-## Creating gitea-runner secrets
-
-```bash
-kubectl create secret generic gitea-runner-token \
-    --from-literal=REGISTRATION_TOKEN='your_gitea_runner_token' -n dev
-```

dns/adguard-sync.yaml

@@ -1,118 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: adguardsync-pvc
-  namespace: dns
-  annotations:
-    nfs.io/storage-path: "adguardsync-config"
-spec:
-  storageClassName: "nfs-client"
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 10Mi
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: adguardsync
-  namespace: dns
-spec:
-  strategy:
-    type: Recreate
-  replicas: 1
-  selector:
-    matchLabels:
-      app: adguardsync
-  template:
-    metadata:
-      labels:
-        app: adguardsync
-    spec:
-      containers:
-      - name: adguardsync
-        image: ghcr.io/bakito/adguardhome-sync:latest
-        imagePullPolicy: Always
-        ports:
-        - containerPort: 8080
-          protocol: TCP
-          name: web-port
-        env:
-        - name: CRON
-          value: "0 * * * *"
-        - name: RUN_ON_START
-          value: "true"
-        - name: LOG_LEVEL
-          value: "info"
-        - name: ORIGIN_URL
-          value: "http://adguard.haven"
-        - name: ORIGIN_USERNAME
-          valueFrom:
-            secretKeyRef:
-              name: adguardhome-password
-              key: username
-        - name: ORIGIN_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: adguardhome-password
-              key: password
-        - name: REPLICA1_URL
-          value: "http://adguard2.haven"
-        - name: REPLICA1_USERNAME
-          valueFrom:
-            secretKeyRef:
-              name: adguardhome-password
-              key: username
-        - name: REPLICA1_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: adguardhome-password
-              key: password
-        resources:
-          requests:
-            cpu: 100m
-            memory: 128Mi
-          limits:
-            cpu: 500m
-            memory: 512Mi
-        volumeMounts:
-        - name: adguardsync-storage
-          mountPath: /config
-      volumes:
-      - name: adguardsync-storage
-        persistentVolumeClaim:
-          claimName: adguardsync-pvc
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: adguardsync-svc
-  namespace: dns
-spec:
-  type: ClusterIP
-  selector:
-    app: adguardsync
-  ports:
-  - name: web
-    port: 8080
-    targetPort: 8080
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: adguardsync-ingress
-  namespace: dns
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: adguardsync.haven
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: adguardsync-svc
-            port:
-              number: 8080

dns/adguard.yaml

@@ -1,173 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: adguardhome-pvc
-  namespace: dns
-  annotations:
-    nfs.io/storage-path: "adguardhome-config"
-spec:
-  storageClassName: "nfs-client"
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 10Gi
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: adguardhome
-  namespace: dns
-spec:
-  strategy:
-    type: Recreate
-  replicas: 1
-  selector:
-    matchLabels:
-      app: adguardhome
-  template:
-    metadata:
-      labels:
-        app: adguardhome
-    spec:
-      containers:
-      - name: adguardhome
-        image: adguard/adguardhome:latest
-        imagePullPolicy: Always
-        ports:
-        - containerPort: 53
-          protocol: TCP
-        - containerPort: 53
-          protocol: UDP
-        - containerPort: 3000
-          protocol: TCP
-          name: install-port
-        - containerPort: 80
-          protocol: TCP
-          name: web-port
-        resources:
-          requests:
-            cpu: 100m
-            memory: 128Mi
-          limits:
-            cpu: 1000m
-            memory: 2Gi
-        livenessProbe:
-          httpGet:
-            path: /
-            port: 80
-          initialDelaySeconds: 30
-          periodSeconds: 10
-        readinessProbe:
-          httpGet:
-            path: /
-            port: 80
-          initialDelaySeconds: 5
-          periodSeconds: 5
-        volumeMounts:
-        - name: adguardhome-storage
-          mountPath: /opt/adguardhome/work
-        - name: adguardhome-storage
-          mountPath: /opt/adguardhome/conf
-      volumes:
-      - name: adguardhome-storage
-        persistentVolumeClaim:
-          claimName: adguardhome-pvc
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: adguardhome-svc
-  namespace: dns
-spec:
-  type: LoadBalancer
-  selector:
-    app: adguardhome
-  loadBalancerIP: 192.168.20.200
-  ports:
-  - name: dns-tcp
-    port: 53
-    targetPort: 53
-    protocol: TCP
-  - name: dns-udp
-    port: 53
-    targetPort: 53
-    protocol: UDP
-  - name: web
-    port: 80
-    targetPort: 80
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: adguardhome-lan-svc
-  namespace: dns
-spec:
-  type: LoadBalancer
-  selector:
-    app: adguardhome
-  loadBalancerIP: 192.168.15.200
-  ports:
-  - name: dns-tcp
-    port: 53
-    targetPort: 53
-    protocol: TCP
-  - name: dns-udp
-    port: 53
-    targetPort: 53
-    protocol: UDP
-  - name: web
-    port: 80
-    targetPort: 80
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: adguard-install-svc
-  namespace: dns
-spec:
-  type: ClusterIP
-  selector:
-    app: adguardhome
-  ports:
-  - name: install
-    port: 3000
-    targetPort: 3000
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: adguardhome-ingress
-  namespace: dns
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: adguard.haven
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: adguardhome-svc
-            port:
-              number: 80
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: adguardhome-install-ingress
-  namespace: dns
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: install.adguard.haven
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: adguard-install-svc
-            port:
-              number: 3000

docker-ingress/README.md

@@ -1,4 +0,0 @@
-## Create namespace
-```bash
-kubectl create namespace docker-ingress
-```

docker-ingress/changedetection.yaml

@@ -1,44 +0,0 @@
-# docker-node: iris.haven
-# port: 4100
-
-# Service
-apiVersion: v1
-kind: Service
-metadata:
-  name: changedetection-service
-  namespace: docker-ingress
-spec:
-  ports:
-    - port: 80
-      targetPort: 4100
----
-# Endpoints
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: changedetection-service
-  namespace: docker-ingress
-subsets:
-  - addresses:
-      - ip: 192.168.20.100
-    ports:
-      - port: 4100
----
-# Ingress
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: changedetection-ingress
-  namespace: docker-ingress
-spec:
-  rules:
-    - host: change.haven
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: changedetection-service
-                port:
-                  number: 80

docker-ingress/dockge.yaml

@@ -1,47 +0,0 @@
-# docker-node: iris.haven
-# port: 4100
-
-# Service
-apiVersion: v1
-kind: Service
-metadata:
-  name: dockge-service
-  namespace: docker-ingress
-spec:
-  ports:
-    - name: http
-      protocol: TCP
-      port: 80
-      targetPort: 5001
----
-apiVersion: v1
-kind: Endpoints
-metadata:
-  name: dockge-service
-  namespace: docker-ingress
-subsets:
-  - addresses:
-      - ip: 192.168.20.100
-    ports:
-      - name: http
-        protocol: TCP
-        port: 5001
----
-# Ingress
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: dockge-ingress
-  namespace: docker-ingress
-spec:
-  rules:
-    - host: dockge.haven
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: dockge-service
-                port:
-                  number: 80

infra/README.md

@@ -1,3 +0,0 @@
-```bash
-kubectl create secret generic beszel-key --from-literal=SECRET-KEY=<KEY> -n infra
-```

infra/eso/bitwarden-cli.yaml

@@ -1,123 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: bitwarden-cli
-  namespace: infra
-  labels:
-    app.kubernetes.io/name: bitwarden-cli
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: bitwarden-cli
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: bitwarden-cli
-    spec:
-      nodeSelector:
-        kubernetes.io/arch: amd64
-      containers:
-        - name: bitwarden-cli
-          image: ghcr.io/charlesthomas/bitwarden-cli:2026.3.0
-          imagePullPolicy: IfNotPresent
-          # Override the baked entrypoint so --disable-origin-protection is
-          # actually passed (it was commented out in the image's entrypoint.sh,
-          # which made bw serve reject all cross-pod requests -> connection refused).
-          command: ["/bin/bash", "-lc"]
-          args:
-            - |
-              set -e
-              bw config server "${BW_HOST}"
-              # Authenticate. Prefer the API key if client creds are present,
-              # otherwise fall back to username+password. The session is exported
-              # so the background loop can re-derive (and refresh) it.
-              login() {
-                if [ -n "$BW_CLIENTID" ] && [ -n "$BW_CLIENTSECRET" ]; then
-                  echo "Using apikey to log in"
-                  BW_SESSION=$(bw login --apikey --raw) || return 1
-                else
-                  echo "Using password to log in"
-                  BW_SESSION=$(bw login "${BW_USER}" --passwordenv BW_PASSWORD --raw) || return 1
-                fi
-                export BW_SESSION
-              }
-              login
-              # Warm the vault cache once at startup so bw serve has data immediately.
-              bw sync
-              bw status
-              # Keep the session alive: RE-LOGIN every cycle and re-sync so the on-disk
-              # vault cache stays warm and the session token never lapses. A loop that
-              # only re-ran `bw sync` with a captured session would eventually fail once
-              # the session expired (-> stale cache / "Not found" for changed items, or a
-              # full unauthenticated 400 if the initial login never happened at all).
-              echo "Starting periodic bw login+sync loop (every 5m)"
-              (
-                while true; do
-                  sleep 300
-                  login || true
-                  echo "[$(date -u +%FT%TZ)] bw sync"
-                  bw sync >/dev/null 2>&1 || echo "[$(date -u +%FT%TZ)] bw sync failed"
-                done
-              ) &
-              echo 'Running `bw serve` on port 8087'
-              bw serve --hostname 0.0.0.0 --disable-origin-protection
-          env:
-            - name: BW_HOST
-              valueFrom:
-                secretKeyRef:
-                  name: bitwarden-cli
-                  key: BW_HOST
-            - name: BW_USER
-              valueFrom:
-                secretKeyRef:
-                  name: bitwarden-cli
-                  key: BW_USERNAME
-            - name: BW_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: bitwarden-cli
-                  key: BW_PASSWORD
-          ports:
-            - name: http
-              containerPort: 8087
-              protocol: TCP
-          startupProbe:
-            tcpSocket: { port: 8087 }
-            periodSeconds: 5
-            timeoutSeconds: 3
-            failureThreshold: 30
-          readinessProbe:
-            tcpSocket: { port: 8087 }
-            periodSeconds: 10
-            timeoutSeconds: 3
-            failureThreshold: 3
-          livenessProbe:
-            tcpSocket: { port: 8087 }
-            periodSeconds: 15
-            timeoutSeconds: 3
-            failureThreshold: 6
-          resources:
-            limits:
-              cpu: 400m
-              memory: 512Mi
-            requests:
-              cpu: 50m
-              memory: 128Mi
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: bitwarden-cli
-  namespace: infra
-  labels:
-    app.kubernetes.io/name: bitwarden-cli
-spec:
-  type: ClusterIP
-  selector:
-    app.kubernetes.io/name: bitwarden-cli
-  ports:
-    - name: http
-      port: 8087
-      targetPort: http
-      protocol: TCP

infra/eso/bw-cli-netpol.yaml

@@ -1,21 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: bw-cli
-  namespace: infra
-spec:
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: bitwarden-cli
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        # ESO pods (app.kubernetes.io/name: external-secrets) in the external-secrets namespace.
-        # Both podSelector AND namespaceSelector must match for cross-namespace traffic.
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: external-secrets
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: external-secrets

lab/nfs-pod.yaml

@@ -1,37 +0,0 @@
-apiVersion: v1
-kind: Pod
-metadata:
-  name: nfs-pod
-spec:
-  containers:
-  - name: nfs-container
-    image: alpine:latest
-    env:
-      - name: PUID
-        value: "1000"
-      - name: PGID
-        value: "1000"
-    volumeMounts:
-    - name: nfs-backup
-      mountPath: /mnt/Backup
-    - name: nfs-storage
-      mountPath: /mnt/Storage
-    command: ["/bin/sh", "-c", "sleep infinity"]
-    resources:
-      requests:
-        cpu: 100m
-        memory: 128Mi
-      limits:
-        cpu: 800m
-        memory: 256Mi    
-    securityContext:
-      privileged: true
-  volumes:
-  - name: nfs-backup
-    nfs:
-      server: 192.168.15.99
-      path: /srv/dev-md1/Backup
-  - name: nfs-storage
-    nfs:
-      server: 192.168.15.99
-      path: /export/Storage

metallb-system/address-pool.yaml

@@ -1,22 +0,0 @@
-apiVersion: metallb.io/v1beta1
-kind: IPAddressPool
-metadata:
-  name: default-pool
-  namespace: metallb-system
-spec:
-  addresses:
-  - 192.168.15.200/32 # reserved for DNS 1
-  - 192.168.15.202/32 # reserved for wg-easy
-  - 192.168.15.203/32 # reserved for k3s ingress
-  - 192.168.20.200/32 # reserved for DNS 1
-# - 192.168.20.201 is reserved for DNS 2
-  - 192.168.20.202-192.168.20.220
----
-apiVersion: metallb.io/v1beta1
-kind: L2Advertisement
-metadata:
-  name: default-advertisement
-  namespace: metallb-system
-spec:
-  ipAddressPools:
-  - default-pool

renovate.json

@@ -0,0 +1,21 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "prHourlyLimit": 0,
+  "kubernetes": {
+    "managerFilePatterns": [
+      "/\\.yaml$/"
+    ]
+  },
+  "packageRules": [
+    {
+      "description": "Skip local registry images (built by CI, not upstream deps)",
+      "matchDatasources": [
+        "docker"
+      ],
+      "matchPackageNames": [
+        "git.ivanch.me/**"
+      ],
+      "enabled": false
+    }
+  ]
+}

secrets/affine.yaml

@@ -12,6 +12,8 @@ spec:
         DB_USERNAME: "{{ .DB_USERNAME }}"
         DB_PASSWORD: "{{ .DB_PASSWORD }}"
         DB_NAME: "{{ .DB_NAME }}"
+        DB_URL: "{{ .DB_URL }}"
+        DB_CONNECTION_URL: "postgres://{{ .DB_USERNAME }}:{{ .DB_PASSWORD }}@{{ .DB_URL }}:5432/{{ .DB_NAME }}"
   data:
     - secretKey: DB_USERNAME
       remoteRef:
@@ -28,3 +30,7 @@ spec:
         { key: 4f15af1c-9b66-41d0-80db-a99ebe50e91f, property: DB_NAME }
       sourceRef:
         { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
+    - secretKey: DB_URL
+      remoteRef: { key: 4f15af1c-9b66-41d0-80db-a99ebe50e91f, property: DB_URL }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }

secrets/archivebox.yaml

@@ -0,0 +1,24 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata: { name: archivebox-password, namespace: default }
+spec:
+  refreshInterval: 1h
+  target:
+    name: archivebox-password
+    deletionPolicy: Retain
+    template:
+      type: Opaque
+      data:
+        username: "{{ .username }}"
+        password: "{{ .password }}"
+  data:
+    - secretKey: username
+      remoteRef:
+        { key: 6b4ca371-dcd4-4e31-aebe-8e5ea48b1fb9, property: username }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
+    - secretKey: password
+      remoteRef:
+        { key: 6b4ca371-dcd4-4e31-aebe-8e5ea48b1fb9, property: password }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }

secrets/cloudreve.yaml

@@ -12,7 +12,6 @@ spec:
         DB_USER: "{{ .DB_USER }}"
         DB_PASSWORD: "{{ .DB_PASSWORD }}"
         DB_NAME: "{{ .DB_NAME }}"
-        REDIS_PASSWORD: "{{ .REDIS_PASSWORD }}"
   data:
     - secretKey: DB_USER
       remoteRef:
@@ -29,8 +28,3 @@ spec:
         { key: 8c25cac9-e9e8-4970-bdf4-31f9aee19276, property: DB_NAME }
       sourceRef:
         { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
-    - secretKey: REDIS_PASSWORD
-      remoteRef:
-        { key: 8c25cac9-e9e8-4970-bdf4-31f9aee19276, property: REDIS_PASSWORD }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }

secrets/radarr.yaml

@@ -1,48 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata: { name: radarr, namespace: media }
-spec:
-  refreshInterval: 1h
-  target:
-    name: radarr-secret
-    deletionPolicy: Retain
-    template:
-      type: Opaque
-      data:
-        Radarr__Postgres__User: "{{ .Radarr__Postgres__User }}"
-        Radarr__Postgres__Password: "{{ .Radarr__Postgres__Password }}"
-        Radarr__Postgres__Host: "{{ .Radarr__Postgres__Host }}"
-        Radarr__Postgres__MainDb: "{{ .Radarr__Postgres__MainDb }}"
-  data:
-    - secretKey: Radarr__Postgres__User
-      remoteRef:
-        {
-          key: ab723b65-3ec8-469c-b01d-67a6e3049023,
-          property: username,
-        }
-      sourceRef:
-        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
-    - secretKey: Radarr__Postgres__Password
-      remoteRef:
-        {
-          key: ab723b65-3ec8-469c-b01d-67a6e3049023,
-          property: password,
-        }
-      sourceRef:
-        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
-    - secretKey: Radarr__Postgres__Host
-      remoteRef:
-        {
-          key: ab723b65-3ec8-469c-b01d-67a6e3049023,
-          property: Radarr__Postgres__Host,
-        }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
-    - secretKey: Radarr__Postgres__MainDb
-      remoteRef:
-        {
-          key: ab723b65-3ec8-469c-b01d-67a6e3049023,
-          property: Radarr__Postgres__MainDb,
-        }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }

secrets/recommender.yaml

@@ -1,27 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata: { name: recommender, namespace: media }
-spec:
-  refreshInterval: 1h
-  target:
-    name: recommender-secrets
-    deletionPolicy: Retain
-    template:
-      type: Opaque
-      data:
-        OPENAI_API_KEY: "{{ .OPENAI_API_KEY }}"
-        DATABASE_URL: "{{ .DATABASE_URL }}"
-  data:
-    - secretKey: OPENAI_API_KEY
-      remoteRef:
-        {
-          key: 5079ef6f-3d1d-4522-b22c-6dd5f1c19acd,
-          property: OPENAI_API_KEY,
-        }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
-    - secretKey: DATABASE_URL
-      remoteRef:
-        { key: 5079ef6f-3d1d-4522-b22c-6dd5f1c19acd, property: DATABASE_URL }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }

secrets/renovate-bot.yaml

@@ -0,0 +1,27 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata: { name: renovate-bot, namespace: cronjobs }
+spec:
+  refreshInterval: 1h
+  target:
+    name: renovate-bot
+    deletionPolicy: Retain
+    template:
+      type: Opaque
+      data:
+        RENOVATE_GITHUB_COM_TOKEN: "{{ .RENOVATE_GITHUB_COM_TOKEN }}"
+        RENOVATE_TOKEN: "{{ .RENOVATE_TOKEN }}"
+  data:
+    - secretKey: RENOVATE_GITHUB_COM_TOKEN
+      remoteRef:
+        {
+          key: 25b1f5c9-0a2b-438e-a4c6-23ea1d58e2de,
+          property: RENOVATE_GITHUB_COM_TOKEN,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
+    - secretKey: RENOVATE_TOKEN
+      remoteRef:
+        { key: 25b1f5c9-0a2b-438e-a4c6-23ea1d58e2de, property: RENOVATE_TOKEN }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }

secrets/sonarr.yaml

@@ -1,42 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata: { name: sonarr, namespace: media }
-spec:
-  refreshInterval: 1h
-  target:
-    name: sonarr-secret
-    deletionPolicy: Retain
-    template:
-      type: Opaque
-      data:
-        Sonarr__Postgres__User: "{{ .Sonarr__Postgres__User }}"
-        Sonarr__Postgres__Password: "{{ .Sonarr__Postgres__Password }}"
-        Sonarr__Postgres__Host: "{{ .Sonarr__Postgres__Host }}"
-        Sonarr__Postgres__MainDb: "{{ .Sonarr__Postgres__MainDb }}"
-  data:
-    - secretKey: Sonarr__Postgres__User
-      remoteRef:
-        { key: 2c5b6d27-971f-4876-b10d-db400dfde7b2, property: username }
-      sourceRef:
-        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
-    - secretKey: Sonarr__Postgres__Password
-      remoteRef:
-        { key: 2c5b6d27-971f-4876-b10d-db400dfde7b2, property: password }
-      sourceRef:
-        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
-    - secretKey: Sonarr__Postgres__Host
-      remoteRef:
-        {
-          key: 2c5b6d27-971f-4876-b10d-db400dfde7b2,
-          property: Sonarr__Postgres__Host,
-        }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
-    - secretKey: Sonarr__Postgres__MainDb
-      remoteRef:
-        {
-          key: 2c5b6d27-971f-4876-b10d-db400dfde7b2,
-          property: Sonarr__Postgres__MainDb,
-        }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }