Merge branch 'main' into renovate/ansible-core-2.x

ansible/requirements-python.txt

@@ -1,3 +1,3 @@
-ansible-core==2.21.4
+ansible-core==2.21.3
 proxmoxer==2.3.0
 requests==2.34.2

ansible/requirements.yml

@@ -3,4 +3,4 @@ collections:
   - name: community.proxmox
     version: "2.0.0"
   - name: community.general
-    version: "13.4.0"
+    version: "13.2.0"

apps/alloy/alloy.yaml

@@ -9,7 +9,7 @@ spec:
   project: default
   destination:
     server: https://kubernetes.default.svc
-    namespace: monitoring
+    namespace: alloy
   syncPolicy:
     automated: { prune: true, selfHeal: true }
     syncOptions: [CreateNamespace=true, ServerSideApply=true]

apps/cloud/affine.yaml

@@ -20,7 +20,8 @@ spec:
     spec:
       containers:
         - name: affine
-          image: ghcr.io/toeverything/affine:0.27.4
+          image: ghcr.io/toeverything/affine:stable
+          imagePullPolicy: Always
           command:
             [
               "sh",
@@ -99,6 +100,8 @@ kind: PersistentVolumeClaim
 metadata:
   name: affine-config
   namespace: cloud
+  annotations:
+    nfs.io/storage-path: "affine-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/cloud/cloudreve.yaml

@@ -16,6 +16,7 @@ spec:
       containers:
         - name: cloudreve
           image: cloudreve/cloudreve:v4
+          imagePullPolicy: Always
           ports:
             - containerPort: 5212
               name: http
@@ -51,6 +52,11 @@ spec:
               value: "disable"
             - name: CR_CONF_Redis.Server
               value: ""
+            - name: CR_CONF_Redis.Password
+              valueFrom:
+                secretKeyRef:
+                  name: cloudreve-secret
+                  key: REDIS_PASSWORD
           volumeMounts:
             - name: cloudreve-data
               mountPath: /cloudreve/data
@@ -107,6 +113,8 @@ kind: PersistentVolumeClaim
 metadata:
   name: cloudreve-data
   namespace: cloud
+  annotations:
+    nfs.io/storage-path: "cloudreve-data"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/cloud/slink.yaml

@@ -99,6 +99,8 @@ kind: PersistentVolumeClaim
 metadata:
   name: slink-data
   namespace: cloud
+  annotations:
+    nfs.io/storage-path: "slink-data"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/cronjobs/renovatebot.yaml

@@ -12,7 +12,7 @@ spec:
         spec:
           containers:
             - name: renovate
-              image: renovate/renovate:44.103.7
+              image: renovate/renovate:44.39.3
               args:
                 - ivanch/haven
               env:

apps/default/archivebox.yaml

@@ -129,6 +129,8 @@ kind: PersistentVolumeClaim
 metadata:
   name: archivebox-data
   namespace: default
+  annotations:
+    nfs.io/storage-path: "archivebox-data"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/default/changedetection.yaml

@@ -120,6 +120,8 @@ kind: PersistentVolumeClaim
 metadata:
   name: changedetection-config
   namespace: default
+  annotations:
+    nfs.io/storage-path: "changedetection-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/default/homepage.yaml

@@ -157,6 +157,8 @@ kind: PersistentVolumeClaim
 metadata:
   name: homepage-config
   namespace: default
+  annotations:
+    nfs.io/storage-path: "homepage-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/default/notepad.yaml

@@ -61,6 +61,8 @@ kind: PersistentVolumeClaim
 metadata:
   name: notepad-data
   namespace: default
+  annotations:
+    nfs.io/storage-path: "notepad-data"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/default/openwebui.yaml

@@ -74,6 +74,8 @@ kind: PersistentVolumeClaim
 metadata:
   name: openwebui-data
   namespace: default
+  annotations:
+    nfs.io/storage-path: "openwebui-data"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/default/paperless.yaml

@@ -118,6 +118,8 @@ kind: PersistentVolumeClaim
 metadata:
   name: paperless-data
   namespace: default
+  annotations:
+    nfs.io/storage-path: "paperless-data"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/default/playwright.yaml

@@ -38,7 +38,8 @@ spec:
           env:
             - name: TZ
               value: America/Sao_Paulo
-          image: mcr.microsoft.com/playwright:v1.63.0-noble
+          image: mcr.microsoft.com/playwright:v1.62.1-noble
+          imagePullPolicy: Always
           name: playwright
           ports:
             - containerPort: 3000

apps/default/searxng.yaml

@@ -63,6 +63,8 @@ kind: PersistentVolumeClaim
 metadata:
   name: searxng-config
   namespace: default
+  annotations:
+    nfs.io/storage-path: "searxng-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/default/stirlingpdf.yaml

@@ -80,6 +80,8 @@ kind: PersistentVolumeClaim
 metadata:
   name: stirlingpdf-config
   namespace: default
+  annotations:
+    nfs.io/storage-path: "stirlingpdf-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/default/uptimekuma.yaml

@@ -20,6 +20,7 @@ spec:
       containers:
         - name: uptimekuma
           image: louislam/uptime-kuma:2
+          imagePullPolicy: Always
           env:
             - name: PUID
               value: "1000"
@@ -75,6 +76,8 @@ kind: PersistentVolumeClaim
 metadata:
   name: uptimekuma-config
   namespace: default
+  annotations:
+    nfs.io/storage-path: "uptimekuma-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/default/vaultwarden.yaml

@@ -17,7 +17,8 @@ spec:
     spec:
       containers:
         - name: vaultwarden
-          image: vaultwarden/server:1.37.3
+          image: vaultwarden/server:latest
+          imagePullPolicy: Always
           env:
             - name: DOMAIN
               value: "https://vault.haven"
@@ -89,6 +90,8 @@ kind: PersistentVolumeClaim
 metadata:
   name: vaultwarden-data
   namespace: default
+  annotations:
+    nfs.io/storage-path: "vaultwarden-data"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/dev/gitea-runner.yaml

@@ -41,6 +41,8 @@ kind: PersistentVolumeClaim
 metadata:
   name: gitea-runner-amd64-pvc
   namespace: dev
+  annotations:
+    nfs.io/storage-path: "gitea-runner-amd64-pvc"
 spec:
   storageClassName: "nfs-client"
   accessModes:
@@ -55,6 +57,8 @@ kind: PersistentVolumeClaim
 metadata:
   name: gitea-runner-arm64-pvc
   namespace: dev
+  annotations:
+    nfs.io/storage-path: "gitea-runner-arm64-pvc"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/dns/adguard-sync.yaml

@@ -3,6 +3,8 @@ kind: PersistentVolumeClaim
 metadata:
   name: adguardsync-pvc
   namespace: dns
+  annotations:
+    nfs.io/storage-path: "adguardsync-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:
@@ -30,7 +32,8 @@ spec:
     spec:
       containers:
         - name: adguardsync
-          image: ghcr.io/bakito/adguardhome-sync:v0.9.3
+          image: ghcr.io/bakito/adguardhome-sync:latest
+          imagePullPolicy: Always
           ports:
             - containerPort: 8080
               protocol: TCP

apps/dns/adguard.yaml

@@ -3,6 +3,8 @@ kind: PersistentVolumeClaim
 metadata:
   name: adguardhome-pvc
   namespace: dns
+  annotations:
+    nfs.io/storage-path: "adguardhome-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:
@@ -28,19 +30,10 @@ spec:
       labels:
         app: adguardhome
     spec:
-      affinity:
-        nodeAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-            - weight: 100
-              preference:
-                matchExpressions:
-                  - key: kubernetes.io/arch
-                    operator: In
-                    values:
-                      - arm64
       containers:
         - name: adguardhome
-          image: adguard/adguardhome:v0.107.79
+          image: adguard/adguardhome:latest
+          imagePullPolicy: Always
           ports:
             - containerPort: 53
               protocol: TCP

apps/infra/beszel-agent.yaml

@@ -22,7 +22,8 @@ spec:
                 secretKeyRef:
                   name: beszel-key
                   key: SECRET-KEY
-          image: henrygd/beszel-agent:0.20.0
+          image: henrygd/beszel-agent:0.19.0
+          imagePullPolicy: Always
           name: beszel-agent
           ports:
             - containerPort: 45876

apps/infra/beszel.yaml

@@ -26,7 +26,8 @@ spec:
                       - amd64
       containers:
         - name: beszel
-          image: ghcr.io/henrygd/beszel/beszel:0.20.0
+          image: ghcr.io/henrygd/beszel/beszel:0.19.0
+          imagePullPolicy: Always
           ports:
             - containerPort: 8090
               name: beszel-port
@@ -65,6 +66,8 @@ kind: PersistentVolumeClaim
 metadata:
   name: beszel-config
   namespace: infra
+  annotations:
+    nfs.io/storage-path: "beszel-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/infra/bitwarden-cli.yaml

@@ -1,44 +1,3 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: bitwarden-cli-ca
-  namespace: infra
-  labels:
-    app.kubernetes.io/name: bitwarden-cli
-data:
-  # Public CA certificate used by the internal-ca ClusterIssuer. Keep this in
-  # sync if the issuer CA is rotated.
-  haven-ca.crt: |
-    -----BEGIN CERTIFICATE-----
-    MIIFBzCCAu+gAwIBAgIUGFrjEo+WOxJpMnJqU/RQ881kWI8wDQYJKoZIhvcNAQEL
-    BQAwEzERMA8GA1UEAwwISGF2ZW4gQ0EwHhcNMjUwOTA3MTUxNTE3WhcNMzUwOTA1
-    MTUxNTE3WjATMREwDwYDVQQDDAhIYXZlbiBDQTCCAiIwDQYJKoZIhvcNAQEBBQAD
-    ggIPADCCAgoCggIBAK+8DxQfCYdRfGnJoEu0CiSuw64lnUFryvzy3GPkfGEEzc3f
-    ZiH6pUUIpQnrbVc1wdq3ojEOveGyLIqWxkljz8gEaMDJwB7udOxfbgv0QFI4cFKs
-    QzB+g3VVf74mYHvqfGB1suxmdVJ8YxcW3rQl7XD94PLxfoZuQ8IKKjskaQnYXUGH
-    wi6YBmIjpxr23lvT5cTbd5YgTFYVXDzM8nWtmnd2Wa9WkNZtKaHQKIeiNEpUPV0+
-    KSHVQC7vdmGmbUZXWpK2jmLFWfYaI0vXUal0CyMv1QidTd5LsDCI4Y+dx4mSBLuu
-    ip5V4Wm1DxttyaKUZM2vhzHEsDSVHz/xqx9nJeoJJuP+OirQVETD3FcN5PNVkWXu
-    EHQAqUciBh1CMJKKT74SE5oTT1/Eni9N2uYlvXsOs3ne6TTjZYxcL6VU+aqyYvvF
-    oMo3DX2a5nZvht4E1BtCd4I/RlnOw5QBAvWbFJqpbo/DTAGo/WBgv7jXCGail+uQ
-    r7iLoKFnhGq0WB9d2UUg6qDRD11I1nZANkv4t3Z2HFbG4XxdpttPm7JjxlcC3gGa
-    AfE3rChmAQPWPLSn6msOcfA+l5OD9SoSYU9nHy81T2q06Kfg/VWDdz7Wvi+WNZ20
-    gcfZPUZQsLlgZeyjmoA27D7ayO5uxjTWCi35kIgKcDDutyHctPRQs5zlTD35AgMB
-    AAGjUzBRMB0GA1UdDgQWBBSqABoe6cCk5vMc3LfnZfhiMbJ+kjAfBgNVHSMEGDAW
-    gBSqABoe6cCk5vMc3LfnZfhiMbJ+kjAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3
-    DQEBCwUAA4ICAQAWAqQgFYEH14J2pwKptLb/K2C2oT9XLVnArQ5PKOzyWWhfZXsr
-    3YB707XJ7ju12n5gBgjCK4R66IG/iYNfHdBfhb9M1BVJ3T035RH8d6lhlZbxC02s
-    ZIMrQxDVFRrWm7gxcQiMILfPl2hJmsLf9XIUTBzPWFj9E+wExXrDYdiZXU+a/9qP
-    JvLKZA7T2lSBu+XtccySVLHXoxZ/A/c7Gp8XYJ2srZ2tXGN+j1dXiSMWHD/fpdxs
-    3GDKFnOOz2NTjHhYvBR94sOx3UkA3Pz+ufcHFBWWh23iGOPDDjh0vqAKItz2G0Kb
-    9B99XVnHWHamaZ2tV40x7lVn1mo9ImFVtxW2XDQ/NkRB9PuT2ryGE67Ey/Zfoq5M
-    0gZXIMtuMS25dTB8gQ8PKlXluIf4EbaDXhFk5xFHz5NP0E5Um4SxJP8H30/+UUPd
-    bu/TMcNiiAgxaTLBbE3nw/L7bYfH+5KuTLlp17H0UEtSI1GosgGYooov+Zbj4ZF8
-    Ko108LKAFDGe8/uQVeuo00CrEqXwVRtCCkv+LBcCJDicoyqWbp4GCBp+IVN0nxWX
-    xIRYVtQZCmA3hSH3rwt0/2dBxkcta4YkHZUEZ+EXaFl3z1tcbErOhBvupBvnBuZP
-    Rp2yvEJuuY6M1j+CZrfCm7qMipXTGPQ11Q7hf6jJ0xzxjTkV9TyV1ptPPQ==
-    -----END CERTIFICATE-----
----
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -60,7 +19,7 @@ spec:
         kubernetes.io/arch: amd64
       containers:
         - name: bitwarden-cli
-          image: ghcr.io/charlesthomas/bitwarden-cli:2026.8.0  # 2026.9.0 requires Vaultwarden's unimplemented user-key-ID backfill API
+          image: ghcr.io/charlesthomas/bitwarden-cli:2026.7.0
           imagePullPolicy: IfNotPresent
           # Override the baked entrypoint so --disable-origin-protection is
           # actually passed (it was commented out in the image's entrypoint.sh,
@@ -104,14 +63,11 @@ spec:
               echo 'Running `bw serve` on port 8087'
               bw serve --hostname 0.0.0.0 --disable-origin-protection
           env:
-            # Bitwarden CLI is Node-based and needs the internal issuer CA to
-            # verify the HTTPS certificate for vault.haven.
-            - name: NODE_EXTRA_CA_CERTS
-              value: /etc/ssl/certs/haven-ca.crt
-            # Use the in-cluster ingress. The public endpoint currently
-            # returns 502 from inside the cluster.
             - name: BW_HOST
-              value: https://vault.haven
+              valueFrom:
+                secretKeyRef:
+                  name: bitwarden-cli
+                  key: BW_HOST
             - name: BW_USER
               valueFrom:
                 secretKeyRef:
@@ -122,11 +78,6 @@ spec:
                 secretKeyRef:
                   name: bitwarden-cli
                   key: BW_PASSWORD
-          volumeMounts:
-            - name: haven-ca
-              mountPath: /etc/ssl/certs/haven-ca.crt
-              subPath: haven-ca.crt
-              readOnly: true
           ports:
             - name: http
               containerPort: 8087
@@ -153,10 +104,6 @@ spec:
             requests:
               cpu: 50m
               memory: 128Mi
-      volumes:
-        - name: haven-ca
-          configMap:
-            name: bitwarden-cli-ca
 ---
 apiVersion: v1
 kind: Service

apps/infra/code-config.yaml

@@ -82,6 +82,8 @@ kind: PersistentVolumeClaim
 metadata:
   name: code-config
   namespace: infra
+  annotations:
+    nfs.io/storage-path: "code-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/infra/file-nginx.yaml

@@ -19,8 +19,6 @@ spec:
     metadata:
       labels:
         app: file-nginx
-      annotations:
-        checksum/file-nginx-conf: "4235705a54e5003a340f1a4e164c3e3239fd4327d9aa9ecf0c640a3655def3c9"
     spec:
       containers:
         - name: nginx
@@ -85,19 +83,11 @@ data:
         server_name  _;
 
         root   /usr/share/nginx/data/file-nginx;
+        index  index.html;
 
         autoindex on;
-        autoindex_exact_size off;
-        autoindex_localtime on;
-
-        location = /index.html {
-            # The legacy static page is now the live directory browser.
-            return 302 /;
-        }
 
         location / {
-            # Bypass the static welcome page so every directory is browsable.
-            index __directory_listing__;
             try_files $uri $uri/ =404;
         }
     }

apps/infra/wg-easy.yaml

@@ -3,6 +3,8 @@ kind: PersistentVolumeClaim
 metadata:
   name: wg-easy-pvc
   namespace: infra
+  annotations:
+    nfs.io/storage-path: "wg-easy-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:
@@ -18,10 +20,7 @@ metadata:
   namespace: infra
 spec:
   strategy:
-    type: RollingUpdate
+    type: Recreate
-    rollingUpdate:
-      maxSurge: 1
-      maxUnavailable: 0
   replicas: 1
   selector:
     matchLabels:
@@ -39,11 +38,12 @@ spec:
                   - key: kubernetes.io/hostname
                     operator: In
                     values:
-                      - polaris
+                      - nexus
               weight: 100
       containers:
         - name: wg-easy
-          image: ghcr.io/wg-easy/wg-easy:15.4.0
+          image: ghcr.io/wg-easy/wg-easy:latest
+          imagePullPolicy: Always
           ports:
             - containerPort: 51820
               protocol: UDP
@@ -54,11 +54,15 @@ spec:
           env:
             - name: LANG
               value: en
+            - name: WG_HOST
+              value: vpn.ivanch.me
             - name: WG_MTU
               value: "1420"
             - name: UI_TRAFFIC_STATS
               value: "true"
-            - name: INSECURE
+            - name: UI_CHART_TYPE
+              value: "0"
+            - name: WG_ENABLE_ONE_TIME_LINKS
               value: "true"
             - name: UI_ENABLE_SORT_CLIENTS
               value: "true"
@@ -74,37 +78,14 @@ spec:
             limits:
               cpu: 2000m
               memory: 1Gi
-          livenessProbe:
-            httpGet:
-              path: /
-              port: 51821
-            initialDelaySeconds: 15
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            httpGet:
-              path: /
-              port: 51821
-            initialDelaySeconds: 5
-            periodSeconds: 10
-            timeoutSeconds: 3
-            failureThreshold: 2
           volumeMounts:
             - name: wg-easy-volume
               mountPath: /etc/wireguard
-            - name: kernel-modules
-              mountPath: /lib/modules
-              readOnly: true
       restartPolicy: Always
       volumes:
         - name: wg-easy-volume
           persistentVolumeClaim:
             claimName: wg-easy-pvc
-        - name: kernel-modules
-          hostPath:
-            path: /lib/modules
-            type: Directory
 ---
 apiVersion: v1
 kind: Service
@@ -143,14 +124,3 @@ spec:
                 name: wg-easy-svc
                 port:
                   number: 51821
----
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: wg-easy-pdb
-  namespace: infra
-spec:
-  minAvailable: 1
-  selector:
-    matchLabels:
-      app: wg-easy

apps/monitoring/grafana.yaml

@@ -64,6 +64,8 @@ kind: PersistentVolumeClaim
 metadata:
   name: grafana-pvc
   namespace: monitoring
+  annotations:
+    nfs.io/storage-path: "grafana-data"
 spec:
   storageClassName: "nfs-client"
   accessModes:

apps/monitoring/kube-state-metrics.yaml

@@ -86,7 +86,7 @@ spec:
         kubernetes.io/os: linux
       containers:
         - name: kube-state-metrics
-          image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.20.0
+          image: registry.k8s.io/kube-state-metrics/kube-state-metrics:v2.19.1
           imagePullPolicy: IfNotPresent
           args:
             - --resources=cronjobs,daemonsets,deployments,jobs,nodes,persistentvolumeclaims,pods,replicasets,statefulsets

apps/monitoring/loki.yaml

@@ -5,8 +5,6 @@ metadata:
   namespace: monitoring
 spec:
   replicas: 1
-  strategy:
-    type: Recreate
   selector:
     matchLabels:
       app: loki
@@ -38,9 +36,8 @@ spec:
           configMap:
             name: loki-config
         - name: loki-storage
-          nfs:
+          emptyDir:
-            server: nexus.haven
+            medium: Memory
-            path: /export/sandbox/loki
 ---
 apiVersion: v1
 kind: ConfigMap
@@ -82,12 +79,7 @@ data:
 
     limits_config:
       allow_structured_metadata: true
-      retention_period: 72h
+      retention_period: 0
-      max_query_lookback: 72h
-      # Global per-tenant cap: <= 0.1 MB/s sustained keeps this sandbox disk bounded.
-      ingestion_rate_strategy: global
-      ingestion_rate_mb: 0.1
-      ingestion_burst_size_mb: 0.5
 
     ingester:
       lifecycler:
@@ -100,12 +92,7 @@ data:
       chunk_target_size: 1536000
 
     compactor:
-      working_directory: /tmp/loki/compactor
+      retention_enabled: false
-      compaction_interval: 10m
-      retention_enabled: true
-      retention_delete_delay: 2h
-      retention_delete_worker_count: 10
-      delete_request_store: filesystem
 ---
 apiVersion: v1
 kind: Service

apps/monitoring/prometheus.yaml

@@ -7,8 +7,6 @@ metadata:
     app: prometheus
 spec:
   replicas: 1
-  strategy:
-    type: Recreate
   selector:
     matchLabels:
       app: prometheus
@@ -24,9 +22,7 @@ spec:
           args:
             - "--config.file=/etc/prometheus/prometheus.yml"
             - "--storage.tsdb.path=/prometheus"
-            - "--storage.tsdb.retention.time=2d"
+            - "--storage.tsdb.retention.time=1d"
-            # Keep a generous buffer on the 117 GiB sandbox filesystem; WAL may exceed this briefly.
-            - "--storage.tsdb.retention.size=8GB"
             - "--web.enable-lifecycle"
           ports:
             - containerPort: 9090
@@ -48,15 +44,16 @@ spec:
           persistentVolumeClaim:
             claimName: prometheus-pvc
         - name: prometheus-storage
-          nfs:
+          persistentVolumeClaim:
-            server: nexus.haven
+            claimName: prometheus-storage-pvc
-            path: /export/sandbox/prometheus
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: prometheus-pvc
   namespace: monitoring
+  annotations:
+    nfs.io/storage-path: "prometheus-config"
 spec:
   storageClassName: "nfs-client"
   accessModes:

bootstrap/namespaces.yaml

@@ -59,6 +59,14 @@ metadata:
 ---
 apiVersion: v1
 kind: Namespace
+metadata:
+  name: ingress-nginx
+  labels:
+    app.kubernetes.io/instance: ingress-nginx
+    app.kubernetes.io/name: ingress-nginx
+---
+apiVersion: v1
+kind: Namespace
 metadata:
   name: metallb-system
 ---
@@ -67,6 +75,11 @@ metadata:
 # ==============================================================================
 apiVersion: v1
 kind: Namespace
+metadata:
+  name: alloy
+---
+apiVersion: v1
+kind: Namespace
 metadata:
   name: monitoring
 ---

project-context.md

@@ -0,0 +1,25 @@
+# Haven project context
+
+## Purpose
+
+`haven` is the public GitOps specification repository for the Haven Kubernetes cluster. Argo CD continuously reconciles the manifests on `main` into the cluster.
+
+## Repository organization
+
+- `apps/<namespace>/*.yaml` — one application or infrastructure specification per file. The directory name selects its target namespace through the root ApplicationSet.
+- `apps/root/applicationset.yaml` — discovers `apps/*/*.yaml` and creates Argo CD Applications that automatically prune and self-heal.
+- `bootstrap/` — cluster bootstrap manifests such as namespaces, Argo CD configuration, and address pools.
+- `secrets/` — Kubernetes secret specifications referenced by applications.
+- `.gitea/workflows/trigger-renovate.yaml` — manually triggered Gitea Actions workflow that creates an immediate one-off Job from the live `cronjobs/renovate` CronJob.
+
+## Build and deploy
+
+- Commit manifest changes to `main`; the root ApplicationSet reconciles them automatically.
+- The `Trigger Renovate` Gitea workflow is manual-only (`workflow_dispatch`). It downloads `kubectl`, writes `${{ secrets.KUBE_CONFIG }}` to an ephemeral kubeconfig, verifies the live CronJob, then creates a uniquely named Job in the `cronjobs` namespace from `cronjob/renovate`.
+- The kubeconfig is supplied at execution time as the repository or organization `KUBE_CONFIG` secret. No credentials are stored in this repository.
+
+## Conventions
+
+- Keep Kubernetes manifest and workflow YAML LF-terminated; `.gitattributes` enforces this for `.yaml` and `.yml` files.
+- Do not commit plaintext credentials. Kubernetes resources should continue to reference the existing secret mechanisms.
+- A manual Renovate dispatch starts an additional run; the weekly CronJob schedule remains unchanged.

renovate.json

@@ -1,6 +1,5 @@
 {
   "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "prHourlyLimit": 0,
   "kubernetes": {
     "managerFilePatterns": [
       "/\\.yaml$/"

secrets/cloudreve.yaml

@@ -12,6 +12,7 @@ spec:
         DB_USER: "{{ .DB_USER }}"
         DB_PASSWORD: "{{ .DB_PASSWORD }}"
         DB_NAME: "{{ .DB_NAME }}"
+        REDIS_PASSWORD: "{{ .REDIS_PASSWORD }}"
   data:
     - secretKey: DB_USER
       remoteRef:
@@ -28,3 +29,8 @@ spec:
         { key: 8c25cac9-e9e8-4970-bdf4-31f9aee19276, property: DB_NAME }
       sourceRef:
         { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
+    - secretKey: REDIS_PASSWORD
+      remoteRef:
+        { key: 8c25cac9-e9e8-4970-bdf4-31f9aee19276, property: REDIS_PASSWORD }
+      sourceRef:
+        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }