small changes

The bitwarden-cli Deployment's startup script never set BW_SESSION when
running without API-key creds (empty password branch / bw unlock --check
only), so bw serve started unauthenticated and every ExternalSecret across
all namespaces failed with HTTP 400 / 'Not found'. Wrap login in a function,
export the session, warm the cache once, and re-login every 5m in the
background loop so the session token never lapses.

.gitignore

@@ -13,5 +13,3 @@ cronjobs
 *.key
 
 chacal/
-
-secrets/

alloy/README.md

@@ -1,3 +1,11 @@
+# Helm configuration for Alloy (OSS monitoring collector)
+
+This directory contains Helm configuration for deploying Grafana Alloy, an open-source observability data collector.
+
+## Quick Install
+
+```bash
 helm repo add grafana https://grafana.github.io/helm-charts
 helm repo update
 helm install alloy grafana/alloy --namespace alloy -f values.yaml
+```

ansible/.ansible-lint

@@ -0,0 +1,4 @@
+---
+profile: basic
+exclude_paths:
+  - collections/

ansible/.gitignore

@@ -0,0 +1,13 @@
+# Encrypted secrets
+group_vars/all/vault.yml
+
+# Installed collections
+collections/
+
+# Ansible retry files
+*.retry
+
+# Local controller environment and test caches
+.venv/
+__pycache__/
+.pytest_cache/

ansible/ansible.cfg

@@ -0,0 +1,9 @@
+[defaults]
+inventory = inventory.yml
+host_key_checking = True
+retry_files_enabled = False
+stdout_callback = default
+result_format = yaml
+collections_path = ./collections
+roles_path = ./roles
+interpreter_python = auto_silent

ansible/inventory.yml

@@ -0,0 +1,49 @@
+---
+# Proxmox connection: local API access (the controller reaches the node directly).
+# This is the "proxmox" group — not an SSH target, just connection params.
+all:
+  children:
+    proxmox_nodes:
+      hosts:
+        otherside:
+          ansible_host: otherside.haven
+          ansible_connection: local # we call the Proxmox API, not SSH
+        astrid:
+          ansible_host: astrid.haven
+          ansible_connection: local # we call the Proxmox API, not SSH
+    k3s_cluster:
+      children:
+        grp_k3s_server: # group name == group_vars/grp_k3s_server.yml
+          hosts:
+            iris:
+              ansible_host: iris.haven
+              ansible_user: root
+              ansible_python_interpreter: /usr/bin/python3
+        grp_k3s_agent: # group name == group_vars/grp_k3s_agent.yml
+          hosts:
+            vega:
+              ansible_host: vega.haven
+              ansible_user: root
+              ansible_python_interpreter: /usr/bin/python3
+            nebula:
+              ansible_host: nebula.haven
+              ansible_user: root
+              ansible_python_interpreter: /usr/bin/python3
+            nexus:
+              ansible_host: nexus.haven
+              ansible_user: root
+              ansible_python_interpreter: /usr/bin/python3
+    lxcs:
+      children:
+        grp_docker_build: # group name == group_vars/grp_docker_build.yml
+          hosts:
+            docker_build:
+              ansible_host: docker-build.haven
+              ansible_user: root
+              ansible_python_interpreter: /usr/bin/python3
+        grp_redis: # group name == group_vars/grp_redis.yml
+          hosts:
+            redis:
+              ansible_host: redis.haven
+              ansible_user: root
+              ansible_python_interpreter: /usr/bin/python3

ansible/playbooks/k3s_update.yml

@@ -0,0 +1,69 @@
+## Updates k3s in the entire cluster
+- name: Update k3s Control Plane
+  hosts: grp_k3s_server
+  serial: 1
+  gather_facts: false
+  become: true
+  tasks:
+    - name: Update k3s on control plane node
+      ansible.builtin.shell: >
+        sh <(curl -sfL https://get.k3s.io)
+      args:
+        executable: /bin/bash
+      register: k3s_update
+
+    - name: Print update output
+      ansible.builtin.debug:
+        var: k3s_update
+
+- name: Update k3s Agents
+  hosts: grp_k3s_agent
+  serial: 1
+  gather_facts: false
+  become: true
+  tasks:
+    - name: Cordon agent node
+      ansible.builtin.command: kubectl cordon {{ inventory_hostname }}
+      delegate_to: "{{ groups['grp_k3s_server'][0] }}"
+      environment:
+        KUBECONFIG: /etc/rancher/k3s/k3s.yaml
+      ignore_errors: true
+
+    - name: Drain agent node
+      ansible.builtin.command: >
+        kubectl drain {{ inventory_hostname }}
+        --ignore-daemonsets
+        --delete-emptydir-data
+        --force
+        --timeout=60s
+      delegate_to: "{{ groups['grp_k3s_server'][0] }}"
+      environment:
+        KUBECONFIG: /etc/rancher/k3s/k3s.yaml
+      ignore_errors: true
+
+    - name: Kill k3s-agent process
+      ansible.builtin.shell: k3s-killall.sh
+      ignore_errors: true
+
+    - name: Update k3s on agent node
+      ansible.builtin.shell: >
+        sh <(curl -sfL https://get.k3s.io)
+      args:
+        executable: /bin/bash
+      register: k3s_update
+
+    - name: Restart k3s-agent service
+      ansible.builtin.systemd:
+        name: k3s-agent
+        state: restarted
+
+    - name: Print update output
+      ansible.builtin.debug:
+        var: k3s_update
+
+    - name: Uncordon agent node
+      ansible.builtin.command: kubectl uncordon {{ inventory_hostname }}
+      delegate_to: "{{ groups['grp_k3s_server'][0] }}"
+      environment:
+        KUBECONFIG: /etc/rancher/k3s/k3s.yaml
+      ignore_errors: true

ansible/requirements-dev.txt

@@ -0,0 +1,2 @@
+-r requirements-python.txt
+ansible-lint==26.6.0

ansible/requirements-python.txt

@@ -0,0 +1,3 @@
+ansible-core==2.21.2
+proxmoxer==2.3.0
+requests==2.34.2

ansible/requirements.yml

@@ -0,0 +1,6 @@
+---
+collections:
+  - name: community.proxmox
+    version: "2.0.0"
+  - name: community.general
+    version: "13.2.0"

default/haven-notify.yaml

@@ -0,0 +1,81 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: haven-notify
+  namespace: default
+  labels:
+    app: haven-notify
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: haven-notify
+  template:
+    metadata:
+      labels:
+        app: haven-notify
+    spec:
+      containers:
+        - name: haven-notify
+          image: git.ivanch.me/ivanch/haven-notify:latest
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 8080
+          env:
+            - name: WEBHOOK_URL
+              valueFrom:
+                secretKeyRef:
+                  name: discord-webhook
+                  key: HAVEN_WEBHOOK_URL
+          readinessProbe:
+            httpGet:
+              path: /ready
+              port: 8080
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /live
+              port: 8080
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 200m
+              memory: 128Mi
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: haven-notify
+  namespace: default
+spec:
+  selector:
+    app: haven-notify
+  ports:
+    - protocol: TCP
+      port: 8080
+      targetPort: 8080
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: haven-notify
+  namespace: default
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: notify.haven
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: haven-notify
+                port:
+                  number: 8080

default/vaultwarden.yaml

@@ -30,6 +30,31 @@ spec:
           ports:
             - containerPort: 80
               name: vault-port
+          # /alive requires no authentication and verifies the Vaultwarden process
+          startupProbe:
+            httpGet:
+              path: /alive
+              port: vault-port
+              scheme: HTTP
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 30
+          readinessProbe:
+            httpGet:
+              path: /alive
+              port: vault-port
+              scheme: HTTP
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          livenessProbe:
+            httpGet:
+              path: /alive
+              port: vault-port
+              scheme: HTTP
+            periodSeconds: 15
+            timeoutSeconds: 3
+            failureThreshold: 6
           volumeMounts:
             - name: vaultwarden-data
               mountPath: /data

dev/gitea-runner.yaml

@@ -14,6 +14,10 @@ data:
         - "ubuntu-amd64:docker://docker.gitea.com/runner-images:ubuntu-latest"
         - "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
         - "ubuntu-slim:docker://docker.gitea.com/runner-images:ubuntu-latest-slim"
+        - "runner-full:docker://git.ivanch.me/ivanch/runner-images:full"
+        - "runner-slim:docker://git.ivanch.me/ivanch/runner-images:slim"
+        - "runner-full-amd64:docker://git.ivanch.me/ivanch/runner-images:full"
+        - "runner-slim-amd64:docker://git.ivanch.me/ivanch/runner-images:slim"
 ---
 # --- ConfigMap for the ARM64 Runner ---
 apiVersion: v1
@@ -28,6 +32,8 @@ data:
       timeout: 1h
       labels:
         - "ubuntu-arm64:docker://docker.gitea.com/runner-images:ubuntu-latest"
+        - "runner-full-arm64:docker://git.ivanch.me/ivanch/runner-images:full"
+        - "runner-slim-arm64:docker://git.ivanch.me/ivanch/runner-images:slim"
 ---
 # PersistentVolumeClaim for AMD64
 apiVersion: v1

dns/README.md

@@ -1,6 +0,0 @@
-## Setup AdGuard Sync credentials
-```bash
-kubectl create secret generic adguardhome-password \ 
-    --from-literal=password='your_adguardhome_password' \ 
-    --from-literal=username='your_adguardhome_username' -n dns
-```

infra/eso/bitwarden-cli.yaml

@@ -0,0 +1,121 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: bitwarden-cli
+  namespace: infra
+  labels:
+    app.kubernetes.io/name: bitwarden-cli
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: bitwarden-cli
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: bitwarden-cli
+    spec:
+      containers:
+        - name: bitwarden-cli
+          image: ghcr.io/charlesthomas/bitwarden-cli:2026.3.0
+          imagePullPolicy: IfNotPresent
+          # Override the baked entrypoint so --disable-origin-protection is
+          # actually passed (it was commented out in the image's entrypoint.sh,
+          # which made bw serve reject all cross-pod requests -> connection refused).
+          command: ["/bin/bash", "-lc"]
+          args:
+            - |
+              set -e
+              bw config server "${BW_HOST}"
+              # Authenticate. Prefer the API key if client creds are present,
+              # otherwise fall back to username+password. The session is exported
+              # so the background loop can re-derive (and refresh) it.
+              login() {
+                if [ -n "$BW_CLIENTID" ] && [ -n "$BW_CLIENTSECRET" ]; then
+                  echo "Using apikey to log in"
+                  BW_SESSION=$(bw login --apikey --raw) || return 1
+                else
+                  echo "Using password to log in"
+                  BW_SESSION=$(bw login "${BW_USER}" --passwordenv BW_PASSWORD --raw) || return 1
+                fi
+                export BW_SESSION
+              }
+              login
+              # Warm the vault cache once at startup so bw serve has data immediately.
+              bw sync
+              bw status
+              # Keep the session alive: RE-LOGIN every cycle and re-sync so the on-disk
+              # vault cache stays warm and the session token never lapses. A loop that
+              # only re-ran `bw sync` with a captured session would eventually fail once
+              # the session expired (-> stale cache / "Not found" for changed items, or a
+              # full unauthenticated 400 if the initial login never happened at all).
+              echo "Starting periodic bw login+sync loop (every 5m)"
+              (
+                while true; do
+                  sleep 300
+                  login || true
+                  echo "[$(date -u +%FT%TZ)] bw sync"
+                  bw sync >/dev/null 2>&1 || echo "[$(date -u +%FT%TZ)] bw sync failed"
+                done
+              ) &
+              echo 'Running `bw serve` on port 8087'
+              bw serve --hostname 0.0.0.0 --disable-origin-protection
+          env:
+            - name: BW_HOST
+              valueFrom:
+                secretKeyRef:
+                  name: bitwarden-cli
+                  key: BW_HOST
+            - name: BW_USER
+              valueFrom:
+                secretKeyRef:
+                  name: bitwarden-cli
+                  key: BW_USERNAME
+            - name: BW_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: bitwarden-cli
+                  key: BW_PASSWORD
+          ports:
+            - name: http
+              containerPort: 8087
+              protocol: TCP
+          startupProbe:
+            tcpSocket: { port: 8087 }
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 30
+          readinessProbe:
+            tcpSocket: { port: 8087 }
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          livenessProbe:
+            tcpSocket: { port: 8087 }
+            periodSeconds: 15
+            timeoutSeconds: 3
+            failureThreshold: 6
+          resources:
+            limits:
+              cpu: 400m
+              memory: 512Mi
+            requests:
+              cpu: 50m
+              memory: 128Mi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: bitwarden-cli
+  namespace: infra
+  labels:
+    app.kubernetes.io/name: bitwarden-cli
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: bitwarden-cli
+  ports:
+    - name: http
+      port: 8087
+      targetPort: http
+      protocol: TCP

infra/eso/bw-cli-netpol.yaml

@@ -0,0 +1,21 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: bw-cli
+  namespace: infra
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: bitwarden-cli
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        # ESO pods (app.kubernetes.io/name: external-secrets) in the external-secrets namespace.
+        # Both podSelector AND namespaceSelector must match for cross-namespace traffic.
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: external-secrets
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: external-secrets

infra/eso/secretstores.yaml

@@ -0,0 +1,20 @@
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata: { name: bitwarden-login }
+spec:
+  provider:
+    webhook:
+      url: "http://bitwarden-cli.infra.svc:8087/object/item/{{ .remoteRef.key }}"
+      result: { jsonPath: "$.data.login.{{ .remoteRef.property }}" }
+---
+apiVersion: external-secrets.io/v1
+kind: ClusterSecretStore
+metadata: { name: bitwarden-fields }
+spec:
+  provider:
+    webhook:
+      url: "http://bitwarden-cli.infra.svc:8087/object/item/{{ .remoteRef.key }}"
+      result:
+        {
+          jsonPath: '$.data.fields[?@.name=="{{ .remoteRef.property }}"].value',
+        }

infra/wg-easy.yaml

@@ -75,6 +75,9 @@ spec:
             requests:
               cpu: 100m
               memory: 256Mi
+            limits:
+              cpu: 2000m
+              memory: 1Gi
       volumeMounts:
         - name: wg-easy-volume
           mountPath: /etc/wireguard

secrets/adguard.yaml

@@ -0,0 +1,24 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata: { name: adguardhome-password, namespace: dns }
+spec:
+  refreshInterval: 1h
+  target:
+    name: adguardhome-password
+    deletionPolicy: Retain
+    template:
+      type: Opaque
+      data:
+        username: "{{ .username }}"
+        password: "{{ .password }}"
+  data:
+    - secretKey: username
+      remoteRef:
+        { key: 5bc7e63f-18bb-482c-bc3e-740e03b26334, property: username }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
+    - secretKey: password
+      remoteRef:
+        { key: 5bc7e63f-18bb-482c-bc3e-740e03b26334, property: password }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }

secrets/cloudreve.yaml

@@ -0,0 +1,36 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata: { name: cloudreve, namespace: cloud }
+spec:
+  refreshInterval: 1h
+  target:
+    name: cloudreve-secret
+    deletionPolicy: Retain
+    template:
+      type: Opaque
+      data:
+        DB_USER: "{{ .DB_USER }}"
+        DB_PASSWORD: "{{ .DB_PASSWORD }}"
+        DB_NAME: "{{ .DB_NAME }}"
+        REDIS_PASSWORD: "{{ .REDIS_PASSWORD }}"
+  data:
+    - secretKey: DB_USER
+      remoteRef:
+        { key: 8c25cac9-e9e8-4970-bdf4-31f9aee19276, property: username }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
+    - secretKey: DB_PASSWORD
+      remoteRef:
+        { key: 8c25cac9-e9e8-4970-bdf4-31f9aee19276, property: password }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
+    - secretKey: DB_NAME
+      remoteRef:
+        { key: 8c25cac9-e9e8-4970-bdf4-31f9aee19276, property: DB_NAME }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
+    - secretKey: REDIS_PASSWORD
+      remoteRef:
+        { key: 8c25cac9-e9e8-4970-bdf4-31f9aee19276, property: REDIS_PASSWORD }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }

secrets/gitea-runner.yaml

@@ -0,0 +1,21 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata: { name: gitea-runner, namespace: dev }
+spec:
+  refreshInterval: 1h
+  target:
+    name: gitea-runner-token
+    deletionPolicy: Retain
+    template:
+      type: Opaque
+      data:
+        REGISTRATION_TOKEN: "{{ .REGISTRATION_TOKEN }}"
+  data:
+    - secretKey: REGISTRATION_TOKEN
+      remoteRef:
+        {
+          key: 4e286657-b5de-4354-be2e-d1649b0fd527,
+          property: REGISTRATION_TOKEN,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }

secrets/openwebui.yaml

@@ -0,0 +1,27 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata: { name: openwebui, namespace: default }
+spec:
+  refreshInterval: 1h
+  target:
+    name: openwebui-secret
+    deletionPolicy: Retain
+    template:
+      type: Opaque
+      data:
+        DATABASE_URL: "postgresql://{{ .username }}:{{ .password }}@postgresql.haven:5432/{{ .dbname }}"
+  data:
+    - secretKey: username
+      remoteRef:
+        { key: e80ff314-7445-4b61-b5c5-69285ea72586, property: username }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
+    - secretKey: password
+      remoteRef:
+        { key: e80ff314-7445-4b61-b5c5-69285ea72586, property: password }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
+    - secretKey: dbname
+      remoteRef: { key: e80ff314-7445-4b61-b5c5-69285ea72586, property: dbname }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }

secrets/paperless.yaml

@@ -0,0 +1,39 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata: { name: paperless, namespace: default }
+spec:
+  refreshInterval: 1h
+  target:
+    name: paperless-secret
+    deletionPolicy: Retain
+    template:
+      type: Opaque
+      data:
+        PAPERLESS_DBNAME: "{{ .PAPERLESS_DBNAME }}"
+        PAPERLESS_DBUSER: "{{ .PAPERLESS_DBUSER }}"
+        PAPERLESS_DBPASSWORD: "{{ .PAPERLESS_DBPASSWORD }}"
+  data:
+    - secretKey: PAPERLESS_DBNAME
+      remoteRef:
+        {
+          key: 05426e55-fe04-4c16-8697-8a258928257a,
+          property: PAPERLESS_DBNAME,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
+    - secretKey: PAPERLESS_DBUSER
+      remoteRef:
+        {
+          key: 05426e55-fe04-4c16-8697-8a258928257a,
+          property: PAPERLESS_DBUSER,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
+    - secretKey: PAPERLESS_DBPASSWORD
+      remoteRef:
+        {
+          key: 05426e55-fe04-4c16-8697-8a258928257a,
+          property: PAPERLESS_DBPASSWORD,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }

secrets/radarr.yaml

@@ -0,0 +1,48 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata: { name: radarr, namespace: media }
+spec:
+  refreshInterval: 1h
+  target:
+    name: radarr-secret
+    deletionPolicy: Retain
+    template:
+      type: Opaque
+      data:
+        Radarr__Postgres__User: "{{ .Radarr__Postgres__User }}"
+        Radarr__Postgres__Password: "{{ .Radarr__Postgres__Password }}"
+        Radarr__Postgres__Host: "{{ .Radarr__Postgres__Host }}"
+        Radarr__Postgres__MainDb: "{{ .Radarr__Postgres__MainDb }}"
+  data:
+    - secretKey: Radarr__Postgres__User
+      remoteRef:
+        {
+          key: ab723b65-3ec8-469c-b01d-67a6e3049023,
+          property: username,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
+    - secretKey: Radarr__Postgres__Password
+      remoteRef:
+        {
+          key: ab723b65-3ec8-469c-b01d-67a6e3049023,
+          property: password,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
+    - secretKey: Radarr__Postgres__Host
+      remoteRef:
+        {
+          key: ab723b65-3ec8-469c-b01d-67a6e3049023,
+          property: Radarr__Postgres__Host,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
+    - secretKey: Radarr__Postgres__MainDb
+      remoteRef:
+        {
+          key: ab723b65-3ec8-469c-b01d-67a6e3049023,
+          property: Radarr__Postgres__MainDb,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }

secrets/recommender.yaml

@@ -0,0 +1,27 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata: { name: recommender, namespace: media }
+spec:
+  refreshInterval: 1h
+  target:
+    name: recommender-secrets
+    deletionPolicy: Retain
+    template:
+      type: Opaque
+      data:
+        OPENAI_API_KEY: "{{ .OPENAI_API_KEY }}"
+        DATABASE_URL: "{{ .DATABASE_URL }}"
+  data:
+    - secretKey: OPENAI_API_KEY
+      remoteRef:
+        {
+          key: 5079ef6f-3d1d-4522-b22c-6dd5f1c19acd,
+          property: OPENAI_API_KEY,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
+    - secretKey: DATABASE_URL
+      remoteRef:
+        { key: 5079ef6f-3d1d-4522-b22c-6dd5f1c19acd, property: DATABASE_URL }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }

secrets/slink.yaml

@@ -0,0 +1,30 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata: { name: slink, namespace: cloud }
+spec:
+  refreshInterval: 1h
+  target:
+    name: slink-secret
+    deletionPolicy: Retain
+    template:
+      type: Opaque
+      data:
+        ADMIN_USERNAME: "{{ .ADMIN_USERNAME }}"
+        ADMIN_PASSWORD: "{{ .ADMIN_PASSWORD }}"
+        ADMIN_EMAIL: "{{ .ADMIN_EMAIL }}"
+  data:
+    - secretKey: ADMIN_USERNAME
+      remoteRef:
+        { key: 79f97033-6bc3-40cd-a28c-6060b8bd3a63, property: username }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
+    - secretKey: ADMIN_PASSWORD
+      remoteRef:
+        { key: 79f97033-6bc3-40cd-a28c-6060b8bd3a63, property: password }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
+    - secretKey: ADMIN_EMAIL
+      remoteRef:
+        { key: 79f97033-6bc3-40cd-a28c-6060b8bd3a63, property: ADMIN_EMAIL }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }

secrets/sonarr.yaml

@@ -0,0 +1,42 @@
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata: { name: sonarr, namespace: media }
+spec:
+  refreshInterval: 1h
+  target:
+    name: sonarr-secret
+    deletionPolicy: Retain
+    template:
+      type: Opaque
+      data:
+        Sonarr__Postgres__User: "{{ .Sonarr__Postgres__User }}"
+        Sonarr__Postgres__Password: "{{ .Sonarr__Postgres__Password }}"
+        Sonarr__Postgres__Host: "{{ .Sonarr__Postgres__Host }}"
+        Sonarr__Postgres__MainDb: "{{ .Sonarr__Postgres__MainDb }}"
+  data:
+    - secretKey: Sonarr__Postgres__User
+      remoteRef:
+        { key: 2c5b6d27-971f-4876-b10d-db400dfde7b2, property: username }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
+    - secretKey: Sonarr__Postgres__Password
+      remoteRef:
+        { key: 2c5b6d27-971f-4876-b10d-db400dfde7b2, property: password }
+      sourceRef:
+        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
+    - secretKey: Sonarr__Postgres__Host
+      remoteRef:
+        {
+          key: 2c5b6d27-971f-4876-b10d-db400dfde7b2,
+          property: Sonarr__Postgres__Host,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
+    - secretKey: Sonarr__Postgres__MainDb
+      remoteRef:
+        {
+          key: 2c5b6d27-971f-4876-b10d-db400dfde7b2,
+          property: Sonarr__Postgres__MainDb,
+        }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }