Pin Bitwarden CLI to compatible 2026.8.0

This PR contains the following updates:

| Package | Update | Change |
|---|---|---|
| [ghcr.io/charlesthomas/bitwarden-cli](https://github.com/charlesthomas/bitwarden-cli) | minor | `2026.8.0` → `2026.9.0` |

---

### Release Notes

<details>
<summary>charlesthomas/bitwarden-cli (ghcr.io/charlesthomas/bitwarden-cli)</summary>

### [`v2026.9.0`](https://github.com/charlesthomas/bitwarden-cli/releases/tag/2026.9.0)

[Compare Source](https://github.com/charlesthomas/bitwarden-cli/compare/2026.8.0...2026.9.0)

2026.9.0

</details>

---

### Configuration

📅 **Schedule**: (UTC)

- Branch creation
  - At any time (no schedule defined)
- Automerge
  - At any time (no schedule defined)

🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied.

♻ **Rebasing**: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

🔕 **Ignore**: Close this PR and you won't be reminded about this update again.

---

 - [ ] <!-- rebase-check -->If you want to rebase/retry this PR, check this box

---

This PR has been generated by [Mend Renovate CLI](https://github.com/renovatebot/renovate).
<!--renovate-debug:eyJjcmVhdGVkSW5WZXIiOiI0NC44My4wIiwidXBkYXRlZEluVmVyIjoiNDQuODMuMCIsInRhcmdldEJyYW5jaCI6Im1haW4iLCJsYWJlbHMiOltdfQ==-->

---------

Co-authored-by: Renovate Bot <bot@renovateapp.com>
Reviewed-on: #13

.gitattributes

@@ -0,0 +1,4 @@
+.gitattributes text eol=lf
+*.yaml text eol=lf
+*.yml text eol=lf
+*.md text eol=lf

.gitea/workflows/trigger-renovate.yaml

@@ -0,0 +1,42 @@
+name: Trigger Renovate
+
+on:
+  workflow_dispatch: {}
+
+jobs:
+  trigger-renovate:
+    name: Trigger Renovate
+    runs-on: runner-slim-amd64
+    env:
+      KUBE_CONFIG: ${{ secrets.KUBE_CONFIG }}
+    steps:
+      - name: Create a one-off Renovate job
+        shell: bash
+        run: |
+          set -eu
+
+          if [ -z "${KUBE_CONFIG}" ]; then
+            echo "KUBE_CONFIG is not set or is empty."
+            exit 1
+          fi
+
+          WORK_DIR="${RUNNER_TEMP:-/tmp}/renovate-${GITHUB_RUN_ID:-$$}"
+          mkdir -p "${WORK_DIR}"
+          trap 'rm -rf "${WORK_DIR}"' EXIT
+
+          apk add --no-cache curl
+          KUBECTL_VERSION="$(curl -fsSL https://dl.k8s.io/release/stable.txt)"
+          curl -fsSLo "${WORK_DIR}/kubectl" "https://dl.k8s.io/release/${KUBECTL_VERSION}/bin/linux/amd64/kubectl"
+          chmod 0755 "${WORK_DIR}/kubectl"
+
+          KUBECONFIG="${WORK_DIR}/kubeconfig"
+          umask 077
+          printf '%s' "${KUBE_CONFIG}" | tr -d '\r' > "${KUBECONFIG}"
+
+          RUN_ID="$(printf '%s' "${GITHUB_RUN_ID:-$(date -u +%Y%m%d%H%M%S)}" | tr -cd 'a-z0-9')"
+          JOB_NAME="renovate-manual-${RUN_ID}"
+
+          "${WORK_DIR}/kubectl" --kubeconfig "${KUBECONFIG}" version --client
+          "${WORK_DIR}/kubectl" --kubeconfig "${KUBECONFIG}" --namespace cronjobs get cronjob renovate
+          "${WORK_DIR}/kubectl" --kubeconfig "${KUBECONFIG}" --namespace cronjobs create job "${JOB_NAME}" --from=cronjob/renovate
+          "${WORK_DIR}/kubectl" --kubeconfig "${KUBECONFIG}" --namespace cronjobs get job "${JOB_NAME}" -o wide

ansible/requirements-python.txt

@@ -1,3 +1,3 @@
-ansible-core==2.21.2
+ansible-core==2.21.4
 proxmoxer==2.3.0
 requests==2.34.2

ansible/requirements.yml

@@ -3,4 +3,4 @@ collections:
   - name: community.proxmox
     version: "2.0.0"
   - name: community.general
-    version: "13.2.0"
+    version: "13.4.0"

apps/auth/README.md

@@ -1,99 +0,0 @@
-# Auth (Authentik + Kyverno SSO annotation policy)
-
-Draft manifests only — nothing applied yet. Convention: any Ingress annotated
-with `use-sso-auth: "true"` gets the Authentik forward-auth annotations injected
-by the Kyverno ClusterPolicy (`auth/sso-auth-policy.yaml`).
-
-## Deploy order
-
-1. **Authentik** (`auth/authentik.yaml`) — IdP + embedded outpost. Needs a
-   Postgres user/DB on postgresql.haven first (see below), plus secrets from
-   Vaultwarden/ESO.
-2. **Proxy provider** — create in Authentik UI (or via API) once it's up:
-   one provider per app you want header-auth'd, mode "forward_auth (single
-   app)", or a domain-level provider with the embedded outpost.
-3. **Kyverno** (`auth/kyverno-helm.yaml`) — policy engine.
-4. **SSO policy** (`auth/sso-auth-policy.yaml`) — expands `use-sso-auth: "true"`
-   into `auth-url` / `auth-signin` / `auth-response-headers` annotations.
-5. Annotate ingresses: `kubectl annotate ingress <name> -n <ns> use-sso-auth=true`
-   and mirror the change in this repo.
-
-## Postgres bootstrap (one-time, on postgresql.haven)
-
-```sql
-CREATE USER authentik WITH PASSWORD '<from-vaultwarden>';
-CREATE DATABASE authentik OWNER authentik;
-```
-
-## Notes
-
-- Outpost URL used everywhere is `https://auth.haven` — add DNS + ingress for
-  the outpost before annotating anything.
-- Apps that should *consume* the injected `X-Authentik-*` headers (Grafana auth
-  proxy, Paperless remote-user, OpenWebUI trusted headers) need their own env
-  changes; those are app-side, not covered by the policy.
-- API/WebSocket-heavy apps (arr stack, qBittorrent) should NOT get the
-  annotation on API paths — either skip the annotation or exclude paths.
-
-## Which apps get the annotation (scoping)
-
-Three tiers, applied per ingress — never blanket:
-
-1. **OIDC tier** (no annotation, wire native OIDC in the app instead):
-   grafana, paperless, affine, openwebui, vaultwarden, beszel, slink.
-   Proper logout, group mapping, zero API breakage.
-2. **Forward-auth tier** (`use-sso-auth: "true"`): browser-only utilities with
-   no real auth — it-tools, notepad, searxng, homepage, archivebox,
-   stirlingpdf, file-nginx, code-config, havenllo, own apps (chacal,
-   mindforge) if wanted.
-3. **Hands off** (built-in auth is fine, forward-auth breaks clients):
-   sonarr, radarr, prowlarr, qbittorrent, adguard, changedetection,
-   uptimekuma, cloudreve (WebDAV), jellyfin (clients can't do redirects —
-   only the community SSO plugin route exists).
-
-## Pre-annotation checklist (per new app)
-
-Forward-auth breakage is loud and immediate if you look in the right places.
-Before annotating any real hostname:
-
-1. **Ask: what talks to this app that isn't a human in a browser?**
-   Mobile/desktop apps with own login, API-key consumers, push/webhook
-   receivers, cronjobs curling through the ingress, WebDAV/RSS → any of
-   those = hands off (tier 3) or exclude paths. "Just me in a browser" =
-   safe.
-2. **Canary first:** create a scratch ingress for the same service
-   (`<app>-test.haven`) with the annotation; leave the original untouched
-   for ~a week. Forgotten integrations keep hitting the original and only
-   break the canary — instant rollback
-   (`kubectl annotate ingress <n> -n <ns> use-sso-auth-`).
-3. **Grep the docs** (30s): "reverse proxy", "trusted header", "API key",
-   "webhook", "basic auth". A "running behind a reverse proxy" doc section
-   is where landmines are documented.
-4. **Header-trust hygiene:** apps consuming `X-Authentik-*` must be
-   reachable ONLY through the ingress (no NodePort/exposed port, otherwise
-   LAN clients can forge headers straight to the pod). Keep built-in local
-   login enabled; never set SSO-only mode.
-
-## Files
-
-- `kyverno-helm.yaml` — Kyverno install values
-- `sso-auth-policy.yaml` — ClusterPolicy: `use-sso-auth` → nginx auth annotations
-- `authentik.yaml` — Authentik server/worker + outpost, Postgres PVC, ingress
-
-## Status / when to actually deploy this (decision from 2026-08-28)
-
-NOT deployed — deliberate. Sole user, low login frequency, everything
-reachable via wg-easy, so SSO solves a problem that doesn't exist. The
-`*.ivanch.me` public ingresses were reviewed instead: exposure without usage
-is pure risk, and the right fix is removing exposure (VPN-only), not adding
-an IdP.
-
-Pull the trigger only if one of these becomes true:
-
-1. A second person uses the homelab regularly (SSO value scales with users).
-2. Something must be exposed that can't sit behind VPN (third-party
-   webhooks/callbacks) — then public tier gets `use-sso-auth` + 2FA.
-3. Login friction on the OIDC apps (grafana/paperless/affine/openwebui/
-   vaultwarden/beszel/slink) actually annoys on a weekly basis.
-
-Until then this folder is a shelf-ready draft; cost of keeping it is zero.

apps/auth/authentik.yaml

@@ -1,244 +0,0 @@
-# Authentik — IdP + embedded outpost (proxy provider forward-auth).
-# Draft — do NOT apply as-is:
-#   - secret values are placeholders; create them from Vaultwarden/ESO first
-#   - requires the authentik user/DB on postgresql.haven (see README.md)
-#   - requires DNS record for auth.haven -> ingress IP (user manages DNS)
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: authentik-secrets
-  namespace: auth
-type: Opaque
-stringData:
-  postgres_password: "CHANGE_ME" # Vaultwarden -> ESO later
-  secret_key: "CHANGE_ME" # `openssl rand -base64 60`
-  bootstrap_password: "CHANGE_ME" # initial akadmin password
-  bootstrap_token: "CHANGE_ME" # outpost token
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: authentik-media
-  namespace: auth
-spec:
-  accessModes: [ReadWriteOnce]
-  storageClassName: nfs-fast-client # verified: exists in cluster (nfs-client is also default)
-  resources:
-    requests:
-      storage: 2Gi
----
-# Server (web + API)
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: authentik-server
-  namespace: auth
-spec:
-  replicas: 1
-  selector:
-    matchLabels: { app: authentik, component: server }
-  template:
-    metadata:
-      labels: { app: authentik, component: server }
-    spec:
-      containers:
-        - name: server
-          image: ghcr.io/goauthentik/server:2026.8
-          args: [server]
-          env:
-            - name: AUTHENTIK_SECRET_KEY
-              valueFrom:
-                { secretKeyRef: { name: authentik-secrets, key: secret_key } }
-            - name: AUTHENTIK_POSTGRESQL__HOST
-              value: postgresql.haven
-            - name: AUTHENTIK_POSTGRESQL__NAME
-              value: authentik
-            - name: AUTHENTIK_POSTGRESQL__USER
-              value: authentik
-            - name: AUTHENTIK_POSTGRESQL__PASSWORD
-              valueFrom:
-                {
-                  secretKeyRef:
-                    { name: authentik-secrets, key: postgres_password },
-                }
-            - name: AUTHENTIK_BOOTSTRAP_PASSWORD
-              valueFrom:
-                {
-                  secretKeyRef:
-                    { name: authentik-secrets, key: bootstrap_password },
-                }
-            - name: AUTHENTIK_BOOTSTRAP_TOKEN
-              valueFrom:
-                {
-                  secretKeyRef:
-                    { name: authentik-secrets, key: bootstrap_token },
-                }
-            - name: AUTHENTIK_ERROR_REPORTING__ENABLED
-              value: "false"
-          ports:
-            - { containerPort: 9000, name: http }
-            - { containerPort: 9443, name: https }
-          readinessProbe:
-            httpGet: { path: /-/health/ready/, port: 9000 }
-            initialDelaySeconds: 20
-            periodSeconds: 10
-          livenessProbe:
-            httpGet: { path: /-/health/live/, port: 9000 }
-            initialDelaySeconds: 40
-            periodSeconds: 20
-          resources:
-            requests: { cpu: 250m, memory: 512Mi }
-            limits: { memory: 1Gi, cpu: 1000m }
-          volumeMounts:
-            - { name: media, mountPath: /media }
-      volumes:
-        - name: media
-          persistentVolumeClaim: { claimName: authentik-media }
----
-# Worker (policies, outpost management, scheduled tasks)
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: authentik-worker
-  namespace: auth
-spec:
-  replicas: 1
-  selector:
-    matchLabels: { app: authentik, component: worker }
-  template:
-    metadata:
-      labels: { app: authentik, component: worker }
-    spec:
-      containers:
-        - name: worker
-          image: ghcr.io/goauthentik/server:2026.8
-          args: [worker]
-          env: # same env as server; kept duplicated for a flat draft manifest
-            - name: AUTHENTIK_SECRET_KEY
-              valueFrom:
-                { secretKeyRef: { name: authentik-secrets, key: secret_key } }
-            - name: AUTHENTIK_POSTGRESQL__HOST
-              value: postgresql.haven
-            - name: AUTHENTIK_POSTGRESQL__NAME
-              value: authentik
-            - name: AUTHENTIK_POSTGRESQL__USER
-              value: authentik
-            - name: AUTHENTIK_POSTGRESQL__PASSWORD
-              valueFrom:
-                {
-                  secretKeyRef:
-                    { name: authentik-secrets, key: postgres_password },
-                }
-            - name: AUTHENTIK_BOOTSTRAP_PASSWORD
-              valueFrom:
-                {
-                  secretKeyRef:
-                    { name: authentik-secrets, key: bootstrap_password },
-                }
-            - name: AUTHENTIK_BOOTSTRAP_TOKEN
-              valueFrom:
-                {
-                  secretKeyRef:
-                    { name: authentik-secrets, key: bootstrap_token },
-                }
-            - name: AUTHENTIK_ERROR_REPORTING__ENABLED
-              value: "false"
-          resources:
-            requests: { cpu: 200m, memory: 512Mi }
-            limits: { memory: 1Gi, cpu: 1000m }
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: authentik
-  namespace: auth
-spec:
-  selector: { app: authentik, component: server }
-  ports:
-    - { name: http, port: 80, targetPort: 9000 }
----
-# Embedded outpost — runs the proxy providers; this is what ingress-nginx
-# calls for /auth/nginx on every use-sso-auth ingress.
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: authentik-outpost
-  namespace: auth
-spec:
-  replicas: 1
-  selector:
-    matchLabels: { app: authentik, component: outpost }
-  template:
-    metadata:
-      labels: { app: authentik, component: outpost }
-    spec:
-      containers:
-        - name: outpost
-          image: ghcr.io/goauthentik/proxy:2026.8
-          env:
-            - name: AUTHENTIK_HOST
-              value: http://authentik.auth.svc.cluster.local
-            - name: AUTHENTIK_INSECURE
-              value: "true"
-            - name: AUTHENTIK_TOKEN
-              valueFrom:
-                {
-                  secretKeyRef:
-                    { name: authentik-secrets, key: bootstrap_token },
-                }
-          ports:
-            - { containerPort: 9000, name: http }
-          readinessProbe:
-            httpGet: { path: /outpost.goauthentik.io/ping, port: 9000 }
-            initialDelaySeconds: 10
-            periodSeconds: 10
-          resources:
-            requests: { cpu: 200m, memory: 512Mi }
-            limits: { memory: 1Gi, cpu: 1000m }
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: authentik-outpost
-  namespace: auth
-spec:
-  selector: { app: authentik, component: outpost }
-  ports:
-    - { name: http, port: 80, targetPort: 9000 }
----
-# SSO portal (user-facing login) — auth.haven
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: authentik
-  namespace: auth
-spec:
-  ingressClassName: traefik
-  rules:
-    - host: auth.haven
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend: { service: { name: authentik, port: { number: 80 } } }
----
-# Outpost route — the /outpost.goauthentik.io path must resolve on the same
-# host the protected apps redirect to. Kept as a separate ingress so it can
-# also be attached to other hosts later if needed (do NOT give it
-# use-sso-auth — that would create an auth loop).
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: authentik-outpost
-  namespace: auth
-spec:
-  ingressClassName: traefik
-  rules:
-    - host: auth.haven
-      http:
-        paths:
-          - path: /outpost.goauthentik.io
-            pathType: Prefix
-            backend:
-              { service: { name: authentik-outpost, port: { number: 80 } } }

apps/auth/kyverno-helm.yaml

@@ -1,24 +0,0 @@
-# Kyverno — policy engine. Install with:
-#   helm repo add kyverno https://kyverno.github.io/kyverno
-#   helm upgrade --install kyverno kyverno/kyverno -n kyverno --create-namespace -f auth/kyverno-helm.yaml
-# The only consumer of Kyverno here is the use-sso-auth mutation policy;
-# if you later drop it, Kyverno can be removed with no other impact.
-admissionController:
-  replicas: 1
-  resources:
-    requests:
-      cpu: 100m
-      memory: 128Mi
-    limits:
-      memory: 256Mi
-backgroundController:
-  resources:
-    requests:
-      cpu: 50m
-      memory: 64Mi
-    limits:
-      memory: 128Mi
-cleanupController:
-  enabled: false
-reportsController:
-  enabled: false

apps/auth/sso-auth-policy.yaml

@@ -1,39 +0,0 @@
-# ClusterPolicy: expands the single `use-sso-auth: "true"` Ingress annotation
-# into the ingress-nginx forward-auth annotations pointed at the Authentik
-# embedded outpost.
-#
-# Test before applying to real ingresses:
-#   kubectl apply -f auth/sso-auth-policy.yaml
-#   kubectl annotate ingress -n default homepage use-sso-auth=true --dry-run=server -o yaml   # check annotations get injected
-#   # remove the test annotation afterwards
----
-apiVersion: kyverno.io/v1
-kind: ClusterPolicy
-metadata:
-  name: inject-sso-auth
-spec:
-  validationFailureAction: Audit
-  background: false
-  rules:
-    - name: authentik-forward-auth
-      match:
-        any:
-          - resources:
-              kinds: [Ingress]
-      preconditions:
-        all:
-          - key: "{{ request.object.metadata.annotations.\"use-sso-auth\" || '' }}"
-            operator: Equals
-            value: "true"
-      mutate:
-        patchStrategicMerge:
-          metadata:
-            annotations:
-              nginx.ingress.kubernetes.io/auth-url: https://auth.haven/outpost.goauthentik.io/auth/nginx
-              nginx.ingress.kubernetes.io/auth-signin: https://auth.haven/outpost.goauthentik.io/start?rd=$scheme://$http_host$escaped_request_uri
-              # NOTE: no auth-snippet used — ingress-nginx 1.15 rejects snippet
-              # annotations by default (allow-snippet-annotations=false, your
-              # controller ConfigMap is empty so it uses the default).
-              # ingress-nginx already forwards X-Original-URL to the auth
-              # backend automatically, which is all Authentik needs.
-              nginx.ingress.kubernetes.io/auth-response-headers: X-Authentik-Username,X-Authentik-Email,X-Authentik-Groups,X-Authentik-Name,X-Authentik-Metadata

apps/cloud/affine.yaml

@@ -20,8 +20,7 @@ spec:
     spec:
       containers:
         - name: affine
-          image: ghcr.io/toeverything/affine:stable
+          image: ghcr.io/toeverything/affine:0.27.4
-          imagePullPolicy: Always
           command:
             [
               "sh",
@@ -44,7 +43,10 @@ spec:
             - name: AFFINE_ENABLE_SYNC_FROM_STARTUP
               value: "true"
             - name: DATABASE_URL
-              value: "postgres://affine:affine@postgresql.haven:5432/affine"
+              valueFrom:
+                secretKeyRef:
+                  name: affine-secret
+                  key: DB_CONNECTION_URL
             - name: REDIS_SERVER_HOST
               value: "redis.haven"
             - name: REDIS_SERVER_PORT
@@ -97,8 +99,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: affine-config
   namespace: cloud
-  annotations:
-    nfs.io/storage-path: "affine-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/cloud/cloudreve.yaml

@@ -16,7 +16,6 @@ spec:
       containers:
         - name: cloudreve
           image: cloudreve/cloudreve:v4
-          imagePullPolicy: Always
           ports:
             - containerPort: 5212
               name: http
@@ -52,11 +51,6 @@ spec:
               value: "disable"
             - name: CR_CONF_Redis.Server
               value: ""
-            - name: CR_CONF_Redis.Password
-              valueFrom:
-                secretKeyRef:
-                  name: cloudreve-secret
-                  key: REDIS_PASSWORD
           volumeMounts:
             - name: cloudreve-data
               mountPath: /cloudreve/data
@@ -113,8 +107,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: cloudreve-data
   namespace: cloud
-  annotations:
-    nfs.io/storage-path: "cloudreve-data"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/cloud/slink.yaml

@@ -99,8 +99,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: slink-data
   namespace: cloud
-  annotations:
-    nfs.io/storage-path: "slink-data"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/cronjobs/renovatebot.yaml

@@ -12,7 +12,7 @@ spec:
         spec:
           containers:
             - name: renovate
-              image: renovate/renovate:44.39.3
+              image: renovate/renovate:44.103.7
               args:
                 - ivanch/haven
               env:

apps/default/archivebox.yaml

@@ -129,8 +129,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: archivebox-data
   namespace: default
-  annotations:
-    nfs.io/storage-path: "archivebox-data"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/default/changedetection.yaml

@@ -120,8 +120,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: changedetection-config
   namespace: default
-  annotations:
-    nfs.io/storage-path: "changedetection-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/default/homepage.yaml

@@ -157,8 +157,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: homepage-config
   namespace: default
-  annotations:
-    nfs.io/storage-path: "homepage-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/default/notepad.yaml

@@ -61,8 +61,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: notepad-data
   namespace: default
-  annotations:
-    nfs.io/storage-path: "notepad-data"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/default/openwebui.yaml

@@ -74,8 +74,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: openwebui-data
   namespace: default
-  annotations:
-    nfs.io/storage-path: "openwebui-data"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/default/paperless.yaml

@@ -118,8 +118,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: paperless-data
   namespace: default
-  annotations:
-    nfs.io/storage-path: "paperless-data"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/default/playwright.yaml

@@ -38,8 +38,7 @@ spec:
           env:
             - name: TZ
               value: America/Sao_Paulo
-          image: mcr.microsoft.com/playwright:v1.62.1-noble
+          image: mcr.microsoft.com/playwright:v1.63.0-noble
-          imagePullPolicy: Always
           name: playwright
           ports:
             - containerPort: 3000

apps/default/searxng.yaml

@@ -63,8 +63,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: searxng-config
   namespace: default
-  annotations:
-    nfs.io/storage-path: "searxng-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/default/stirlingpdf.yaml

@@ -80,8 +80,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: stirlingpdf-config
   namespace: default
-  annotations:
-    nfs.io/storage-path: "stirlingpdf-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/default/uptimekuma.yaml

@@ -20,7 +20,6 @@ spec:
       containers:
         - name: uptimekuma
           image: louislam/uptime-kuma:2
-          imagePullPolicy: Always
           env:
             - name: PUID
               value: "1000"
@@ -76,8 +75,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: uptimekuma-config
   namespace: default
-  annotations:
-    nfs.io/storage-path: "uptimekuma-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/default/vaultwarden.yaml

@@ -17,8 +17,7 @@ spec:
     spec:
       containers:
         - name: vaultwarden
-          image: vaultwarden/server:latest
+          image: vaultwarden/server:1.37.3
-          imagePullPolicy: Always
           env:
             - name: DOMAIN
               value: "https://vault.haven"
@@ -90,8 +89,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: vaultwarden-data
   namespace: default
-  annotations:
-    nfs.io/storage-path: "vaultwarden-data"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/dev/gitea-runner.yaml

@@ -41,8 +41,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: gitea-runner-amd64-pvc
   namespace: dev
-  annotations:
-    nfs.io/storage-path: "gitea-runner-amd64-pvc"
 spec:
   storageClassName: "nfs-client"
   accessModes:
@@ -57,8 +55,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: gitea-runner-arm64-pvc
   namespace: dev
-  annotations:
-    nfs.io/storage-path: "gitea-runner-arm64-pvc"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/dns/adguard-sync.yaml

@@ -3,8 +3,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: adguardsync-pvc
   namespace: dns
-  annotations:
-    nfs.io/storage-path: "adguardsync-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:
@@ -32,8 +30,7 @@ spec:
     spec:
       containers:
         - name: adguardsync
-          image: ghcr.io/bakito/adguardhome-sync:latest
+          image: ghcr.io/bakito/adguardhome-sync:v0.9.3
-          imagePullPolicy: Always
           ports:
             - containerPort: 8080
               protocol: TCP

apps/dns/adguard.yaml

@@ -3,8 +3,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: adguardhome-pvc
   namespace: dns
-  annotations:
-    nfs.io/storage-path: "adguardhome-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:
@@ -30,10 +28,19 @@ spec:
       labels:
         app: adguardhome
     spec:
+      affinity:
+        nodeAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values:
+                      - arm64
       containers:
         - name: adguardhome
-          image: adguard/adguardhome:latest
+          image: adguard/adguardhome:v0.107.79
-          imagePullPolicy: Always
           ports:
             - containerPort: 53
               protocol: TCP

apps/infra/beszel-agent.yaml

@@ -22,8 +22,7 @@ spec:
                 secretKeyRef:
                   name: beszel-key
                   key: SECRET-KEY
-          image: henrygd/beszel-agent:0.18.8
+          image: henrygd/beszel-agent:0.20.0
-          imagePullPolicy: Always
           name: beszel-agent
           ports:
             - containerPort: 45876

apps/infra/beszel.yaml

@@ -26,8 +26,7 @@ spec:
                       - amd64
       containers:
         - name: beszel
-          image: ghcr.io/henrygd/beszel/beszel:0.18.8
+          image: ghcr.io/henrygd/beszel/beszel:0.20.0
-          imagePullPolicy: Always
           ports:
             - containerPort: 8090
               name: beszel-port
@@ -66,8 +65,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: beszel-config
   namespace: infra
-  annotations:
-    nfs.io/storage-path: "beszel-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/infra/bitwarden-cli.yaml

@@ -1,3 +1,44 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: bitwarden-cli-ca
+  namespace: infra
+  labels:
+    app.kubernetes.io/name: bitwarden-cli
+data:
+  # Public CA certificate used by the internal-ca ClusterIssuer. Keep this in
+  # sync if the issuer CA is rotated.
+  haven-ca.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIFBzCCAu+gAwIBAgIUGFrjEo+WOxJpMnJqU/RQ881kWI8wDQYJKoZIhvcNAQEL
+    BQAwEzERMA8GA1UEAwwISGF2ZW4gQ0EwHhcNMjUwOTA3MTUxNTE3WhcNMzUwOTA1
+    MTUxNTE3WjATMREwDwYDVQQDDAhIYXZlbiBDQTCCAiIwDQYJKoZIhvcNAQEBBQAD
+    ggIPADCCAgoCggIBAK+8DxQfCYdRfGnJoEu0CiSuw64lnUFryvzy3GPkfGEEzc3f
+    ZiH6pUUIpQnrbVc1wdq3ojEOveGyLIqWxkljz8gEaMDJwB7udOxfbgv0QFI4cFKs
+    QzB+g3VVf74mYHvqfGB1suxmdVJ8YxcW3rQl7XD94PLxfoZuQ8IKKjskaQnYXUGH
+    wi6YBmIjpxr23lvT5cTbd5YgTFYVXDzM8nWtmnd2Wa9WkNZtKaHQKIeiNEpUPV0+
+    KSHVQC7vdmGmbUZXWpK2jmLFWfYaI0vXUal0CyMv1QidTd5LsDCI4Y+dx4mSBLuu
+    ip5V4Wm1DxttyaKUZM2vhzHEsDSVHz/xqx9nJeoJJuP+OirQVETD3FcN5PNVkWXu
+    EHQAqUciBh1CMJKKT74SE5oTT1/Eni9N2uYlvXsOs3ne6TTjZYxcL6VU+aqyYvvF
+    oMo3DX2a5nZvht4E1BtCd4I/RlnOw5QBAvWbFJqpbo/DTAGo/WBgv7jXCGail+uQ
+    r7iLoKFnhGq0WB9d2UUg6qDRD11I1nZANkv4t3Z2HFbG4XxdpttPm7JjxlcC3gGa
+    AfE3rChmAQPWPLSn6msOcfA+l5OD9SoSYU9nHy81T2q06Kfg/VWDdz7Wvi+WNZ20
+    gcfZPUZQsLlgZeyjmoA27D7ayO5uxjTWCi35kIgKcDDutyHctPRQs5zlTD35AgMB
+    AAGjUzBRMB0GA1UdDgQWBBSqABoe6cCk5vMc3LfnZfhiMbJ+kjAfBgNVHSMEGDAW
+    gBSqABoe6cCk5vMc3LfnZfhiMbJ+kjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3
+    DQEBCwUAA4ICAQAWAqQgFYEH14J2pwKptLb/K2C2oT9XLVnArQ5PKOzyWWhfZXsr
+    3YB707XJ7ju12n5gBgjCK4R66IG/iYNfHdBfhb9M1BVJ3T035RH8d6lhlZbxC02s
+    ZIMrQxDVFRrWm7gxcQiMILfPl2hJmsLf9XIUTBzPWFj9E+wExXrDYdiZXU+a/9qP
+    JvLKZA7T2lSBu+XtccySVLHXoxZ/A/c7Gp8XYJ2srZ2tXGN+j1dXiSMWHD/fpdxs
+    3GDKFnOOz2NTjHhYvBR94sOx3UkA3Pz+ufcHFBWWh23iGOPDDjh0vqAKItz2G0Kb
+    9B99XVnHWHamaZ2tV40x7lVn1mo9ImFVtxW2XDQ/NkRB9PuT2ryGE67Ey/Zfoq5M
+    0gZXIMtuMS25dTB8gQ8PKlXluIf4EbaDXhFk5xFHz5NP0E5Um4SxJP8H30/+UUPd
+    bu/TMcNiiAgxaTLBbE3nw/L7bYfH+5KuTLlp17H0UEtSI1GosgGYooov+Zbj4ZF8
+    Ko108LKAFDGe8/uQVeuo00CrEqXwVRtCCkv+LBcCJDicoyqWbp4GCBp+IVN0nxWX
+    xIRYVtQZCmA3hSH3rwt0/2dBxkcta4YkHZUEZ+EXaFl3z1tcbErOhBvupBvnBuZP
+    Rp2yvEJuuY6M1j+CZrfCm7qMipXTGPQ11Q7hf6jJ0xzxjTkV9TyV1ptPPQ==
+    -----END CERTIFICATE-----
+---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -19,7 +60,7 @@ spec:
         kubernetes.io/arch: amd64
       containers:
         - name: bitwarden-cli
-          image: ghcr.io/charlesthomas/bitwarden-cli:2026.7.0
+          image: ghcr.io/charlesthomas/bitwarden-cli:2026.8.0  # 2026.9.0 requires Vaultwarden's unimplemented user-key-ID backfill API
           imagePullPolicy: IfNotPresent
           # Override the baked entrypoint so --disable-origin-protection is
           # actually passed (it was commented out in the image's entrypoint.sh,
@@ -63,11 +104,14 @@ spec:
               echo 'Running `bw serve` on port 8087'
               bw serve --hostname 0.0.0.0 --disable-origin-protection
           env:
+            # Bitwarden CLI is Node-based and needs the internal issuer CA to
+            # verify the HTTPS certificate for vault.haven.
+            - name: NODE_EXTRA_CA_CERTS
+              value: /etc/ssl/certs/haven-ca.crt
+            # Use the in-cluster ingress. The public endpoint currently
+            # returns 502 from inside the cluster.
             - name: BW_HOST
-              valueFrom:
+              value: https://vault.haven
-                secretKeyRef:
-                  name: bitwarden-cli
-                  key: BW_HOST
             - name: BW_USER
               valueFrom:
                 secretKeyRef:
@@ -78,6 +122,11 @@ spec:
                 secretKeyRef:
                   name: bitwarden-cli
                   key: BW_PASSWORD
+          volumeMounts:
+            - name: haven-ca
+              mountPath: /etc/ssl/certs/haven-ca.crt
+              subPath: haven-ca.crt
+              readOnly: true
           ports:
             - name: http
               containerPort: 8087
@@ -104,6 +153,10 @@ spec:
             requests:
               cpu: 50m
               memory: 128Mi
+      volumes:
+        - name: haven-ca
+          configMap:
+            name: bitwarden-cli-ca
 ---
 apiVersion: v1
 kind: Service

apps/infra/code-config.yaml

@@ -82,8 +82,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: code-config
   namespace: infra
-  annotations:
-    nfs.io/storage-path: "code-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/infra/file-nginx.yaml

@@ -19,6 +19,8 @@ spec:
     metadata:
       labels:
         app: file-nginx
+      annotations:
+        checksum/file-nginx-conf: "4235705a54e5003a340f1a4e164c3e3239fd4327d9aa9ecf0c640a3655def3c9"
     spec:
       containers:
         - name: nginx
@@ -83,11 +85,19 @@ data:
         server_name  _;
 
         root   /usr/share/nginx/data/file-nginx;
-        index  index.html;
 
         autoindex on;
+        autoindex_exact_size off;
+        autoindex_localtime on;
+
+        location = /index.html {
+            # The legacy static page is now the live directory browser.
+            return 302 /;
+        }
 
         location / {
+            # Bypass the static welcome page so every directory is browsable.
+            index __directory_listing__;
             try_files $uri $uri/ =404;
         }
     }

apps/infra/wg-easy.yaml

@@ -3,8 +3,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: wg-easy-pvc
   namespace: infra
-  annotations:
-    nfs.io/storage-path: "wg-easy-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:
@@ -20,7 +18,10 @@ metadata:
   namespace: infra
 spec:
   strategy:
-    type: Recreate
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
   replicas: 1
   selector:
     matchLabels:
@@ -38,12 +39,11 @@ spec:
                   - key: kubernetes.io/hostname
                     operator: In
                     values:
-                      - nexus
+                      - polaris
               weight: 100
       containers:
         - name: wg-easy
-          image: ghcr.io/wg-easy/wg-easy:latest
+          image: ghcr.io/wg-easy/wg-easy:15.4.0
-          imagePullPolicy: Always
           ports:
             - containerPort: 51820
               protocol: UDP
@@ -54,15 +54,11 @@ spec:
           env:
             - name: LANG
               value: en
-            - name: WG_HOST
-              value: vpn.ivanch.me
             - name: WG_MTU
               value: "1420"
             - name: UI_TRAFFIC_STATS
               value: "true"
-            - name: UI_CHART_TYPE
+            - name: INSECURE
-              value: "0"
-            - name: WG_ENABLE_ONE_TIME_LINKS
               value: "true"
             - name: UI_ENABLE_SORT_CLIENTS
               value: "true"
@@ -78,14 +74,37 @@ spec:
             limits:
               cpu: 2000m
               memory: 1Gi
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 51821
+            initialDelaySeconds: 15
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 51821
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 2
           volumeMounts:
             - name: wg-easy-volume
               mountPath: /etc/wireguard
+            - name: kernel-modules
+              mountPath: /lib/modules
+              readOnly: true
       restartPolicy: Always
       volumes:
         - name: wg-easy-volume
           persistentVolumeClaim:
             claimName: wg-easy-pvc
+        - name: kernel-modules
+          hostPath:
+            path: /lib/modules
+            type: Directory
 ---
 apiVersion: v1
 kind: Service
@@ -124,3 +143,14 @@ spec:
                 name: wg-easy-svc
                 port:
                   number: 51821
+---
+apiVersion: policy/v1
+kind: PodDisruptionBudget
+metadata:
+  name: wg-easy-pdb
+  namespace: infra
+spec:
+  minAvailable: 1
+  selector:
+    matchLabels:
+      app: wg-easy

apps/monitoring/alloy.yaml

@@ -9,7 +9,7 @@ spec:
   project: default
   destination:
     server: https://kubernetes.default.svc
-    namespace: alloy
+    namespace: monitoring
   syncPolicy:
     automated: { prune: true, selfHeal: true }
     syncOptions: [CreateNamespace=true, ServerSideApply=true]

apps/monitoring/grafana.yaml

@@ -47,10 +47,10 @@ spec:
           resources:
             requests:
               cpu: 250m
-              memory: 750Mi
+              memory: 512Mi
             limits:
-              memory: 1Gi
+              memory: 2Gi
-              cpu: 500m
+              cpu: 1000m
           volumeMounts:
             - mountPath: /var/lib/grafana
               name: grafana-pv
@@ -64,8 +64,6 @@ kind: PersistentVolumeClaim
 metadata:
   name: grafana-pvc
   namespace: monitoring
-  annotations:
-    nfs.io/storage-path: "grafana-data"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/monitoring/kube-state-metrics.yaml

@@ -86,7 +86,7 @@ spec:
         kubernetes.io/os: linux
       containers:
         - name: kube-state-metrics
-          image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1
+          image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0
           imagePullPolicy: IfNotPresent
           args:
             - --resources=cronjobs,daemonsets,deployments,jobs,nodes,persistentvolumeclaims,pods,replicasets,statefulsets

apps/monitoring/loki.yaml

@@ -5,6 +5,8 @@ metadata:
   namespace: monitoring
 spec:
   replicas: 1
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: loki
@@ -36,8 +38,9 @@ spec:
           configMap:
             name: loki-config
         - name: loki-storage
-          emptyDir:
+          nfs:
-            medium: Memory
+            server: nexus.haven
+            path: /export/sandbox/loki
 ---
 apiVersion: v1
 kind: ConfigMap
@@ -79,7 +82,12 @@ data:
 
     limits_config:
       allow_structured_metadata: true
-      retention_period: 0
+      retention_period: 72h
+      max_query_lookback: 72h
+      # Global per-tenant cap: <= 0.1 MB/s sustained keeps this sandbox disk bounded.
+      ingestion_rate_strategy: global
+      ingestion_rate_mb: 0.1
+      ingestion_burst_size_mb: 0.5
 
     ingester:
       lifecycler:
@@ -92,7 +100,12 @@ data:
       chunk_target_size: 1536000
 
     compactor:
-      retention_enabled: false
+      working_directory: /tmp/loki/compactor
+      compaction_interval: 10m
+      retention_enabled: true
+      retention_delete_delay: 2h
+      retention_delete_worker_count: 10
+      delete_request_store: filesystem
 ---
 apiVersion: v1
 kind: Service

apps/monitoring/prometheus.yaml

@@ -7,6 +7,8 @@ metadata:
     app: prometheus
 spec:
   replicas: 1
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app: prometheus
@@ -22,7 +24,9 @@ spec:
           args:
             - "--config.file=/etc/prometheus/prometheus.yml"
             - "--storage.tsdb.path=/prometheus"
-            - "--storage.tsdb.retention.time=1d"
+            - "--storage.tsdb.retention.time=2d"
+            # Keep a generous buffer on the 117 GiB sandbox filesystem; WAL may exceed this briefly.
+            - "--storage.tsdb.retention.size=8GB"
             - "--web.enable-lifecycle"
           ports:
             - containerPort: 9090
@@ -44,17 +48,15 @@ spec:
           persistentVolumeClaim:
             claimName: prometheus-pvc
         - name: prometheus-storage
-          emptyDir:
+          nfs:
-            medium: Memory
+            server: nexus.haven
-            sizeLimit: 256Mi
+            path: /export/sandbox/prometheus
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: prometheus-pvc
   namespace: monitoring
-  annotations:
-    nfs.io/storage-path: "prometheus-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:
@@ -63,6 +65,19 @@ spec:
     requests:
       storage: 1Gi
 ---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: prometheus-storage-pvc
+  namespace: monitoring
+spec:
+  storageClassName: "nfs-client"
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
+---
 # Service URL - http://prometheus.monitoring.svc.cluster.local:9090
 apiVersion: v1
 kind: Service
@@ -96,7 +111,7 @@ metadata:
   labels:
     app: prometheus
 rules:
-- apiGroups: [""]
+  - apiGroups: [""]
     resources:
       - nodes
       - nodes/proxy
@@ -104,11 +119,11 @@ rules:
       - endpoints
       - pods
     verbs: ["get", "list", "watch"]
-- apiGroups: ["extensions"]
+  - apiGroups: ["extensions"]
     resources:
       - ingresses
     verbs: ["get", "list", "watch"]
-- apiGroups: ["networking.k8s.io"]
+  - apiGroups: ["networking.k8s.io"]
     resources:
       - ingresses
     verbs: ["get", "list", "watch"]
@@ -125,6 +140,6 @@ roleRef:
   kind: ClusterRole
   name: prometheus
 subjects:
-- kind: ServiceAccount
+  - kind: ServiceAccount
     name: prometheus
     namespace: monitoring

bootstrap/namespaces.yaml

@@ -59,14 +59,6 @@ metadata:
 ---
 apiVersion: v1
 kind: Namespace
-metadata:
-  name: ingress-nginx
-  labels:
-    app.kubernetes.io/instance: ingress-nginx
-    app.kubernetes.io/name: ingress-nginx
----
-apiVersion: v1
-kind: Namespace
 metadata:
   name: metallb-system
 ---
@@ -75,11 +67,6 @@ metadata:
 # ==============================================================================
 apiVersion: v1
 kind: Namespace
-metadata:
-  name: alloy
----
-apiVersion: v1
-kind: Namespace
 metadata:
   name: monitoring
 ---

renovate.json

@@ -0,0 +1,21 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "prHourlyLimit": 0,
+  "kubernetes": {
+    "managerFilePatterns": [
+      "/\\.yaml$/"
+    ]
+  },
+  "packageRules": [
+    {
+      "description": "Skip local registry images (built by CI, not upstream deps)",
+      "matchDatasources": [
+        "docker"
+      ],
+      "matchPackageNames": [
+        "git.ivanch.me/**"
+      ],
+      "enabled": false
+    }
+  ]
+}

secrets/affine.yaml

@@ -12,6 +12,8 @@ spec:
         DB_USERNAME: "{{ .DB_USERNAME }}"
         DB_PASSWORD: "{{ .DB_PASSWORD }}"
         DB_NAME: "{{ .DB_NAME }}"
+        DB_URL: "{{ .DB_URL }}"
+        DB_CONNECTION_URL: "postgres://{{ .DB_USERNAME }}:{{ .DB_PASSWORD }}@{{ .DB_URL }}:5432/{{ .DB_NAME }}"
   data:
     - secretKey: DB_USERNAME
       remoteRef:
@@ -28,3 +30,7 @@ spec:
         { key: 4f15af1c-9b66-41d0-80db-a99ebe50e91f, property: DB_NAME }
       sourceRef:
         { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
+    - secretKey: DB_URL
+      remoteRef: { key: 4f15af1c-9b66-41d0-80db-a99ebe50e91f, property: DB_URL }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }

secrets/cloudreve.yaml

@@ -12,7 +12,6 @@ spec:
         DB_USER: "{{ .DB_USER }}"
         DB_PASSWORD: "{{ .DB_PASSWORD }}"
         DB_NAME: "{{ .DB_NAME }}"
-        REDIS_PASSWORD: "{{ .REDIS_PASSWORD }}"
   data:
     - secretKey: DB_USER
       remoteRef:
@@ -29,8 +28,3 @@ spec:
         { key: 8c25cac9-e9e8-4970-bdf4-31f9aee19276, property: DB_NAME }
       sourceRef:
         { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
-    - secretKey: REDIS_PASSWORD
-      remoteRef:
-        { key: 8c25cac9-e9e8-4970-bdf4-31f9aee19276, property: REDIS_PASSWORD }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }