infra: add haven-notify Deployment/Service/Ingress manifest

Moved from server-scripts/haven-notify/deploy. Haven Notify is an
internal Discord webhook notifier, catalogued under infra/ alongside
Beszel/WireGuard/Code Config per the repo README.

.gitignore

@@ -12,4 +12,6 @@ cronjobs
 *.crt
 *.key
 
-chacal/
+chacal/
+
+secrets/

ansible/.ansible-lint

@@ -1,4 +0,0 @@
----
-profile: basic
-exclude_paths:
-  - collections/

ansible/.gitignore

@@ -1,13 +0,0 @@
-# Encrypted secrets
-group_vars/all/vault.yml
-
-# Installed collections
-collections/
-
-# Ansible retry files
-*.retry
-
-# Local controller environment and test caches
-.venv/
-__pycache__/
-.pytest_cache/

ansible/ansible.cfg

@@ -1,9 +0,0 @@
-[defaults]
-inventory = inventory.yml
-host_key_checking = True
-retry_files_enabled = False
-stdout_callback = default
-result_format = yaml
-collections_path = ./collections
-roles_path = ./roles
-interpreter_python = auto_silent

ansible/inventory.yml

@@ -1,49 +0,0 @@
----
-# Proxmox connection: local API access (the controller reaches the node directly).
-# This is the "proxmox" group — not an SSH target, just connection params.
-all:
-  children:
-    proxmox_nodes:
-      hosts:
-        otherside:
-          ansible_host: otherside.haven
-          ansible_connection: local # we call the Proxmox API, not SSH
-        astrid:
-          ansible_host: astrid.haven
-          ansible_connection: local # we call the Proxmox API, not SSH
-    k3s_cluster:
-      children:
-        grp_k3s_server: # group name == group_vars/grp_k3s_server.yml
-          hosts:
-            iris:
-              ansible_host: iris.haven
-              ansible_user: root
-              ansible_python_interpreter: /usr/bin/python3
-        grp_k3s_agent: # group name == group_vars/grp_k3s_agent.yml
-          hosts:
-            vega:
-              ansible_host: vega.haven
-              ansible_user: root
-              ansible_python_interpreter: /usr/bin/python3
-            nebula:
-              ansible_host: nebula.haven
-              ansible_user: root
-              ansible_python_interpreter: /usr/bin/python3
-            nexus:
-              ansible_host: nexus.haven
-              ansible_user: root
-              ansible_python_interpreter: /usr/bin/python3
-    lxcs:
-      children:
-        grp_docker_build: # group name == group_vars/grp_docker_build.yml
-          hosts:
-            docker_build:
-              ansible_host: docker-build.haven
-              ansible_user: root
-              ansible_python_interpreter: /usr/bin/python3
-        grp_redis: # group name == group_vars/grp_redis.yml
-          hosts:
-            redis:
-              ansible_host: redis.haven
-              ansible_user: root
-              ansible_python_interpreter: /usr/bin/python3

ansible/playbooks/k3s_update.yml

@@ -1,69 +0,0 @@
-## Updates k3s in the entire cluster
-- name: Update k3s Control Plane
-  hosts: grp_k3s_server
-  serial: 1
-  gather_facts: false
-  become: true
-  tasks:
-    - name: Update k3s on control plane node
-      ansible.builtin.shell: >
-        sh <(curl -sfL https://get.k3s.io)
-      args:
-        executable: /bin/bash
-      register: k3s_update
-
-    - name: Print update output
-      ansible.builtin.debug:
-        var: k3s_update
-
-- name: Update k3s Agents
-  hosts: grp_k3s_agent
-  serial: 1
-  gather_facts: false
-  become: true
-  tasks:
-    - name: Cordon agent node
-      ansible.builtin.command: kubectl cordon {{ inventory_hostname }}
-      delegate_to: "{{ groups['grp_k3s_server'][0] }}"
-      environment:
-        KUBECONFIG: /etc/rancher/k3s/k3s.yaml
-      ignore_errors: true
-
-    - name: Drain agent node
-      ansible.builtin.command: >
-        kubectl drain {{ inventory_hostname }}
-        --ignore-daemonsets
-        --delete-emptydir-data
-        --force
-        --timeout=60s
-      delegate_to: "{{ groups['grp_k3s_server'][0] }}"
-      environment:
-        KUBECONFIG: /etc/rancher/k3s/k3s.yaml
-      ignore_errors: true
-
-    - name: Kill k3s-agent process
-      ansible.builtin.shell: k3s-killall.sh
-      ignore_errors: true
-
-    - name: Update k3s on agent node
-      ansible.builtin.shell: >
-        sh <(curl -sfL https://get.k3s.io)
-      args:
-        executable: /bin/bash
-      register: k3s_update
-
-    - name: Restart k3s-agent service
-      ansible.builtin.systemd:
-        name: k3s-agent
-        state: restarted
-
-    - name: Print update output
-      ansible.builtin.debug:
-        var: k3s_update
-
-    - name: Uncordon agent node
-      ansible.builtin.command: kubectl uncordon {{ inventory_hostname }}
-      delegate_to: "{{ groups['grp_k3s_server'][0] }}"
-      environment:
-        KUBECONFIG: /etc/rancher/k3s/k3s.yaml
-      ignore_errors: true

ansible/requirements-dev.txt

@@ -1,2 +0,0 @@
--r requirements-python.txt
-ansible-lint==26.6.0

ansible/requirements-python.txt

@@ -1,3 +0,0 @@
-ansible-core==2.21.2
-proxmoxer==2.3.0
-requests==2.34.2

ansible/requirements.yml

@@ -1,6 +0,0 @@
----
-collections:
-  - name: community.proxmox
-    version: "2.0.0"
-  - name: community.general
-    version: "13.2.0"

default/vaultwarden.yaml

@@ -30,31 +30,6 @@ spec:
           ports:
             - containerPort: 80
               name: vault-port
-          # /alive requires no authentication and verifies the Vaultwarden process
-          startupProbe:
-            httpGet:
-              path: /alive
-              port: vault-port
-              scheme: HTTP
-            periodSeconds: 5
-            timeoutSeconds: 3
-            failureThreshold: 30
-          readinessProbe:
-            httpGet:
-              path: /alive
-              port: vault-port
-              scheme: HTTP
-            periodSeconds: 10
-            timeoutSeconds: 3
-            failureThreshold: 3
-          livenessProbe:
-            httpGet:
-              path: /alive
-              port: vault-port
-              scheme: HTTP
-            periodSeconds: 15
-            timeoutSeconds: 3
-            failureThreshold: 6
           volumeMounts:
             - name: vaultwarden-data
               mountPath: /data
@@ -112,9 +87,9 @@ metadata:
 spec:
   ingressClassName: nginx
   tls:
-    - hosts:
+  - hosts:
-        - vault.haven
+    - vault.haven
-      secretName: vaultwarden-tls
+    secretName: vaultwarden-tls
   rules:
     - host: vault.haven
       http:
@@ -145,4 +120,4 @@ spec:
               service:
                 name: vaultwarden
                 port:
-                  number: 80
+                  number: 80

dev/gitea-runner.yaml

@@ -14,10 +14,6 @@ data:
         - "ubuntu-amd64:docker://docker.gitea.com/runner-images:ubuntu-latest"
         - "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
         - "ubuntu-slim:docker://docker.gitea.com/runner-images:ubuntu-latest-slim"
-        - "runner-full:docker://git.ivanch.me/ivanch/runner-images:full"
-        - "runner-slim:docker://git.ivanch.me/ivanch/runner-images:slim"
-        - "runner-full-amd64:docker://git.ivanch.me/ivanch/runner-images:full"
-        - "runner-slim-amd64:docker://git.ivanch.me/ivanch/runner-images:slim"
 ---
 # --- ConfigMap for the ARM64 Runner ---
 apiVersion: v1
@@ -32,8 +28,6 @@ data:
       timeout: 1h
       labels:
         - "ubuntu-arm64:docker://docker.gitea.com/runner-images:ubuntu-latest"
-        - "runner-full-arm64:docker://git.ivanch.me/ivanch/runner-images:full"
-        - "runner-slim-arm64:docker://git.ivanch.me/ivanch/runner-images:slim"
 ---
 # PersistentVolumeClaim for AMD64
 apiVersion: v1
@@ -84,55 +78,55 @@ spec:
         app: gitea-runner-amd64
     spec:
       containers:
-        - name: gitea-runner
+      - name: gitea-runner
-          image: gitea/act_runner:latest
+        image: gitea/act_runner:latest
-          imagePullPolicy: Always
+        imagePullPolicy: Always
-          resources:
+        resources:
-            requests:
+          requests:
-              cpu: "500m"
+            cpu: "500m"
-              memory: "512Mi"
+            memory: "512Mi"
-            limits:
+          limits:
-              cpu: "4000m"
+            cpu: "4000m"
-              memory: "4Gi"
+            memory: "4Gi"
-          volumeMounts:
+        volumeMounts:
-            - name: config-volume
-              mountPath: /etc/gitea-runner/config.yaml
-              subPath: config.yaml
-            - name: docker-socket
-              mountPath: /var/run/docker.sock
-            - name: gitea-runner-amd64-pvc
-              mountPath: /data
-          env:
-            - name: GITEA_RUNNER_REGISTRATION_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: gitea-runner-token
-                  key: REGISTRATION_TOKEN
-            - name: GITEA_INSTANCE_URL
-              value: https://git.ivanch.me
-            - name: GITEA_RUNNER_NAME
-              value: k8s-runner-amd64
-            - name: CONFIG_FILE
-              value: /etc/gitea-runner/config.yaml
-      volumes:
         - name: config-volume
-          configMap:
+          mountPath: /etc/gitea-runner/config.yaml
-            name: gitea-runner-amd64-config
+          subPath: config.yaml
         - name: docker-socket
-          hostPath:
+          mountPath: /var/run/docker.sock
-            path: /var/run/docker.sock
         - name: gitea-runner-amd64-pvc
-          persistentVolumeClaim:
+          mountPath: /data
-            claimName: gitea-runner-amd64-pvc
+        env:
+        - name: GITEA_RUNNER_REGISTRATION_TOKEN
+          valueFrom:
+            secretKeyRef:
+              name: gitea-runner-token
+              key: REGISTRATION_TOKEN
+        - name: GITEA_INSTANCE_URL
+          value: https://git.ivanch.me
+        - name: GITEA_RUNNER_NAME
+          value: k8s-runner-amd64
+        - name: CONFIG_FILE
+          value: /etc/gitea-runner/config.yaml
+      volumes:
+      - name: config-volume
+        configMap:
+          name: gitea-runner-amd64-config
+      - name: docker-socket
+        hostPath:
+          path: /var/run/docker.sock
+      - name: gitea-runner-amd64-pvc
+        persistentVolumeClaim:
+          claimName: gitea-runner-amd64-pvc
       affinity:
         nodeAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
             nodeSelectorTerms:
-              - matchExpressions:
+            - matchExpressions:
-                  - key: kubernetes.io/hostname
+              - key: kubernetes.io/hostname
-                    operator: In
+                operator: In
-                    values:
+                values:
-                      - iris
+                - iris
 ---
 # --- Deployment for the ARM64 Runner ---
 apiVersion: apps/v1
@@ -151,52 +145,52 @@ spec:
         app: gitea-runner-arm64
     spec:
       containers:
-        - name: gitea-runner
+      - name: gitea-runner
-          image: gitea/act_runner:latest
+        image: gitea/act_runner:latest
-          imagePullPolicy: Always
+        imagePullPolicy: Always
-          resources:
+        resources:
-            requests:
+          requests:
-              cpu: "500m"
+            cpu: "500m"
-              memory: "512Mi"
+            memory: "512Mi"
-            limits:
+          limits:
-              cpu: "4000m"
+            cpu: "4000m"
-              memory: "4Gi"
+            memory: "4Gi"
-          volumeMounts:
+        volumeMounts:
-            - name: config-volume
-              mountPath: /etc/gitea-runner/config.yaml
-              subPath: config.yaml
-            - name: docker-socket
-              mountPath: /var/run/docker.sock
-            - name: gitea-runner-arm64-pvc
-              mountPath: /data
-          env:
-            - name: GITEA_RUNNER_REGISTRATION_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: gitea-runner-token
-                  key: REGISTRATION_TOKEN
-            - name: GITEA_INSTANCE_URL
-              value: https://git.ivanch.me
-            - name: GITEA_RUNNER_NAME
-              value: k8s-runner-arm64
-            - name: CONFIG_FILE
-              value: /etc/gitea-runner/config.yaml
-      volumes:
         - name: config-volume
-          configMap:
+          mountPath: /etc/gitea-runner/config.yaml
-            name: gitea-runner-arm64-config
+          subPath: config.yaml
         - name: docker-socket
-          hostPath:
+          mountPath: /var/run/docker.sock
-            path: /var/run/docker.sock
         - name: gitea-runner-arm64-pvc
-          persistentVolumeClaim:
+          mountPath: /data
-            claimName: gitea-runner-arm64-pvc
+        env:
+        - name: GITEA_RUNNER_REGISTRATION_TOKEN
+          valueFrom:
+            secretKeyRef:
+              name: gitea-runner-token
+              key: REGISTRATION_TOKEN
+        - name: GITEA_INSTANCE_URL
+          value: https://git.ivanch.me
+        - name: GITEA_RUNNER_NAME
+          value: k8s-runner-arm64
+        - name: CONFIG_FILE
+          value: /etc/gitea-runner/config.yaml
+      volumes:
+      - name: config-volume
+        configMap:
+          name: gitea-runner-arm64-config
+      - name: docker-socket
+        hostPath:
+          path: /var/run/docker.sock
+      - name: gitea-runner-arm64-pvc
+        persistentVolumeClaim:
+          claimName: gitea-runner-arm64-pvc
       affinity:
         nodeAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:
             nodeSelectorTerms:
-              - matchExpressions:
+            - matchExpressions:
-                  - key: kubernetes.io/hostname
+              - key: kubernetes.io/hostname
-                    operator: In
+                operator: In
-                    values:
+                values:
-                      - nexus
+                - nexus

infra/eso/bitwarden-cli.yaml

@@ -1,121 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: bitwarden-cli
-  namespace: infra
-  labels:
-    app.kubernetes.io/name: bitwarden-cli
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: bitwarden-cli
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: bitwarden-cli
-    spec:
-      containers:
-        - name: bitwarden-cli
-          image: ghcr.io/charlesthomas/bitwarden-cli:2026.3.0
-          imagePullPolicy: IfNotPresent
-          # Override the baked entrypoint so --disable-origin-protection is
-          # actually passed (it was commented out in the image's entrypoint.sh,
-          # which made bw serve reject all cross-pod requests -> connection refused).
-          command: ["/bin/bash", "-lc"]
-          args:
-            - |
-              set -e
-              bw config server "${BW_HOST}"
-              # Authenticate. Prefer the API key if client creds are present,
-              # otherwise fall back to username+password. The session is exported
-              # so the background loop can re-derive (and refresh) it.
-              login() {
-                if [ -n "$BW_CLIENTID" ] && [ -n "$BW_CLIENTSECRET" ]; then
-                  echo "Using apikey to log in"
-                  BW_SESSION=$(bw login --apikey --raw) || return 1
-                else
-                  echo "Using password to log in"
-                  BW_SESSION=$(bw login "${BW_USER}" --passwordenv BW_PASSWORD --raw) || return 1
-                fi
-                export BW_SESSION
-              }
-              login
-              # Warm the vault cache once at startup so bw serve has data immediately.
-              bw sync
-              bw status
-              # Keep the session alive: RE-LOGIN every cycle and re-sync so the on-disk
-              # vault cache stays warm and the session token never lapses. A loop that
-              # only re-ran `bw sync` with a captured session would eventually fail once
-              # the session expired (-> stale cache / "Not found" for changed items, or a
-              # full unauthenticated 400 if the initial login never happened at all).
-              echo "Starting periodic bw login+sync loop (every 5m)"
-              (
-                while true; do
-                  sleep 300
-                  login || true
-                  echo "[$(date -u +%FT%TZ)] bw sync"
-                  bw sync >/dev/null 2>&1 || echo "[$(date -u +%FT%TZ)] bw sync failed"
-                done
-              ) &
-              echo 'Running `bw serve` on port 8087'
-              bw serve --hostname 0.0.0.0 --disable-origin-protection
-          env:
-            - name: BW_HOST
-              valueFrom:
-                secretKeyRef:
-                  name: bitwarden-cli
-                  key: BW_HOST
-            - name: BW_USER
-              valueFrom:
-                secretKeyRef:
-                  name: bitwarden-cli
-                  key: BW_USERNAME
-            - name: BW_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: bitwarden-cli
-                  key: BW_PASSWORD
-          ports:
-            - name: http
-              containerPort: 8087
-              protocol: TCP
-          startupProbe:
-            tcpSocket: { port: 8087 }
-            periodSeconds: 5
-            timeoutSeconds: 3
-            failureThreshold: 30
-          readinessProbe:
-            tcpSocket: { port: 8087 }
-            periodSeconds: 10
-            timeoutSeconds: 3
-            failureThreshold: 3
-          livenessProbe:
-            tcpSocket: { port: 8087 }
-            periodSeconds: 15
-            timeoutSeconds: 3
-            failureThreshold: 6
-          resources:
-            limits:
-              cpu: 400m
-              memory: 512Mi
-            requests:
-              cpu: 50m
-              memory: 128Mi
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: bitwarden-cli
-  namespace: infra
-  labels:
-    app.kubernetes.io/name: bitwarden-cli
-spec:
-  type: ClusterIP
-  selector:
-    app.kubernetes.io/name: bitwarden-cli
-  ports:
-    - name: http
-      port: 8087
-      targetPort: http
-      protocol: TCP

infra/eso/bw-cli-netpol.yaml

@@ -1,21 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: bw-cli
-  namespace: infra
-spec:
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: bitwarden-cli
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        # ESO pods (app.kubernetes.io/name: external-secrets) in the external-secrets namespace.
-        # Both podSelector AND namespaceSelector must match for cross-namespace traffic.
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: external-secrets
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: external-secrets

infra/eso/secretstores.yaml

@@ -1,20 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ClusterSecretStore
-metadata: { name: bitwarden-login }
-spec:
-  provider:
-    webhook:
-      url: "http://bitwarden-cli.infra.svc:8087/object/item/{{ .remoteRef.key }}"
-      result: { jsonPath: "$.data.login.{{ .remoteRef.property }}" }
----
-apiVersion: external-secrets.io/v1
-kind: ClusterSecretStore
-metadata: { name: bitwarden-fields }
-spec:
-  provider:
-    webhook:
-      url: "http://bitwarden-cli.infra.svc:8087/object/item/{{ .remoteRef.key }}"
-      result:
-        {
-          jsonPath: '$.data.fields[?@.name=="{{ .remoteRef.property }}"].value',
-        }

infra/haven-notify.yaml

@@ -2,7 +2,6 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: haven-notify
-  namespace: default
   labels:
     app: haven-notify
 spec:
@@ -22,11 +21,11 @@ spec:
           ports:
             - containerPort: 8080
           env:
-            - name: WEBHOOK_URL
+          - name: WEBHOOK_URL
-              valueFrom:
+            valueFrom:
-                secretKeyRef:
+              secretKeyRef:
-                  name: discord-webhook
+                name: discord-webhook
-                  key: HAVEN_WEBHOOK_URL
+                key: HAVEN_WEBHOOK_URL
           readinessProbe:
             httpGet:
               path: /ready
@@ -39,20 +38,11 @@ spec:
               port: 8080
             initialDelaySeconds: 5
             periodSeconds: 10
-          resources:
-            requests:
-              cpu: 50m
-              memory: 64Mi
-            limits:
-              cpu: 200m
-              memory: 128Mi
-
 ---
 apiVersion: v1
 kind: Service
 metadata:
   name: haven-notify
-  namespace: default
 spec:
   selector:
     app: haven-notify

infra/wg-easy.yaml

@@ -33,59 +33,56 @@ spec:
       affinity:
         nodeAffinity:
           preferredDuringSchedulingIgnoredDuringExecution:
-            - weight: 100
+          - weight: 100
-              preference:
+            preference:
-                matchExpressions:
+              matchExpressions:
-                  - key: kubernetes.io/hostname
+              - key: kubernetes.io/hostname
-                    operator: In
+                operator: In
-                    values:
+                values:
-                      - nexus
+                - nexus
       containers:
-        - name: wg-easy
+      - name: wg-easy
-          image: ghcr.io/wg-easy/wg-easy:latest
+        image: ghcr.io/wg-easy/wg-easy:latest
-          imagePullPolicy: Always
+        imagePullPolicy: Always
-          ports:
+        ports:
-            - containerPort: 51820
+        - containerPort: 51820
-              protocol: UDP
+          protocol: UDP
-              name: wg-port
+          name: wg-port
-            - containerPort: 51821
+        - containerPort: 51821
-              protocol: TCP
+          protocol: TCP
-              name: web-port
+          name: web-port
-          env:
+        env:
-            - name: LANG
+        - name: LANG
-              value: en
+          value: en
-            - name: WG_HOST
+        - name: WG_HOST
-              value: vpn.ivanch.me
+          value: vpn.ivanch.me
-            - name: WG_MTU
+        - name: WG_MTU
-              value: "1420"
+          value: "1420"
-            - name: UI_TRAFFIC_STATS
+        - name: UI_TRAFFIC_STATS
-              value: "true"
+          value: "true"
-            - name: UI_CHART_TYPE
+        - name: UI_CHART_TYPE
-              value: "0"
+          value: "0"
-            - name: WG_ENABLE_ONE_TIME_LINKS
+        - name: WG_ENABLE_ONE_TIME_LINKS
-              value: "true"
+          value: "true"
-            - name: UI_ENABLE_SORT_CLIENTS
+        - name: UI_ENABLE_SORT_CLIENTS
-              value: "true"
+          value: "true"
-          securityContext:
+        securityContext:
-            capabilities:
+          capabilities:
-              add:
+            add:
-                - NET_ADMIN
+            - NET_ADMIN
-                - SYS_MODULE
+            - SYS_MODULE
-          resources:
+        resources:
-            requests:
+          requests:
-              cpu: 100m
+            cpu: 100m
-              memory: 256Mi
+            memory: 256Mi
-            limits:
+        volumeMounts:
-              cpu: 2000m
-              memory: 1Gi
-      volumeMounts:
         - name: wg-easy-volume
           mountPath: /etc/wireguard
       restartPolicy: Always
       volumes:
-        - name: wg-easy-volume
+      - name: wg-easy-volume
-          persistentVolumeClaim:
+        persistentVolumeClaim:
-            claimName: wg-easy-pvc
+          claimName: wg-easy-pvc
 ---
 apiVersion: v1
 kind: Service
@@ -98,14 +95,14 @@ spec:
     app: wg-easy
   loadBalancerIP: 192.168.20.203
   ports:
-    - name: wg-port
+  - name: wg-port
-      port: 51820
+    port: 51820
-      targetPort: 51820
+    targetPort: 51820
-      protocol: UDP
+    protocol: UDP
-    - name: web-port
+  - name: web-port
-      port: 51821
+    port: 51821
-      targetPort: 51821
+    targetPort: 51821
-      protocol: TCP
+    protocol: TCP
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
@@ -115,13 +112,13 @@ metadata:
 spec:
   ingressClassName: nginx
   rules:
-    - host: vpn.haven
+  - host: vpn.haven
-      http:
+    http:
-        paths:
+      paths:
-          - path: /
+      - path: /
-            pathType: Prefix
+        pathType: Prefix
-            backend:
+        backend:
-              service:
+          service:
-                name: wg-easy-svc
+            name: wg-easy-svc
-                port:
+            port:
-                  number: 51821
+              number: 51821

secrets/adguard.yaml

@@ -1,24 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata: { name: adguardhome-password, namespace: dns }
-spec:
-  refreshInterval: 1h
-  target:
-    name: adguardhome-password
-    deletionPolicy: Retain
-    template:
-      type: Opaque
-      data:
-        username: "{{ .username }}"
-        password: "{{ .password }}"
-  data:
-    - secretKey: username
-      remoteRef:
-        { key: 5bc7e63f-18bb-482c-bc3e-740e03b26334, property: username }
-      sourceRef:
-        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
-    - secretKey: password
-      remoteRef:
-        { key: 5bc7e63f-18bb-482c-bc3e-740e03b26334, property: password }
-      sourceRef:
-        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }

secrets/cloudreve.yaml

@@ -1,36 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata: { name: cloudreve, namespace: cloud }
-spec:
-  refreshInterval: 1h
-  target:
-    name: cloudreve-secret
-    deletionPolicy: Retain
-    template:
-      type: Opaque
-      data:
-        DB_USER: "{{ .DB_USER }}"
-        DB_PASSWORD: "{{ .DB_PASSWORD }}"
-        DB_NAME: "{{ .DB_NAME }}"
-        REDIS_PASSWORD: "{{ .REDIS_PASSWORD }}"
-  data:
-    - secretKey: DB_USER
-      remoteRef:
-        { key: 8c25cac9-e9e8-4970-bdf4-31f9aee19276, property: username }
-      sourceRef:
-        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
-    - secretKey: DB_PASSWORD
-      remoteRef:
-        { key: 8c25cac9-e9e8-4970-bdf4-31f9aee19276, property: password }
-      sourceRef:
-        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
-    - secretKey: DB_NAME
-      remoteRef:
-        { key: 8c25cac9-e9e8-4970-bdf4-31f9aee19276, property: DB_NAME }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
-    - secretKey: REDIS_PASSWORD
-      remoteRef:
-        { key: 8c25cac9-e9e8-4970-bdf4-31f9aee19276, property: REDIS_PASSWORD }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }

secrets/gitea-runner.yaml

@@ -1,21 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata: { name: gitea-runner, namespace: dev }
-spec:
-  refreshInterval: 1h
-  target:
-    name: gitea-runner-token
-    deletionPolicy: Retain
-    template:
-      type: Opaque
-      data:
-        REGISTRATION_TOKEN: "{{ .REGISTRATION_TOKEN }}"
-  data:
-    - secretKey: REGISTRATION_TOKEN
-      remoteRef:
-        {
-          key: 4e286657-b5de-4354-be2e-d1649b0fd527,
-          property: REGISTRATION_TOKEN,
-        }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }

secrets/openwebui.yaml

@@ -1,27 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata: { name: openwebui, namespace: default }
-spec:
-  refreshInterval: 1h
-  target:
-    name: openwebui-secret
-    deletionPolicy: Retain
-    template:
-      type: Opaque
-      data:
-        DATABASE_URL: "postgresql://{{ .username }}:{{ .password }}@postgresql.haven:5432/{{ .dbname }}"
-  data:
-    - secretKey: username
-      remoteRef:
-        { key: e80ff314-7445-4b61-b5c5-69285ea72586, property: username }
-      sourceRef:
-        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
-    - secretKey: password
-      remoteRef:
-        { key: e80ff314-7445-4b61-b5c5-69285ea72586, property: password }
-      sourceRef:
-        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
-    - secretKey: dbname
-      remoteRef: { key: e80ff314-7445-4b61-b5c5-69285ea72586, property: dbname }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }

secrets/paperless.yaml

@@ -1,39 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata: { name: paperless, namespace: default }
-spec:
-  refreshInterval: 1h
-  target:
-    name: paperless-secret
-    deletionPolicy: Retain
-    template:
-      type: Opaque
-      data:
-        PAPERLESS_DBNAME: "{{ .PAPERLESS_DBNAME }}"
-        PAPERLESS_DBUSER: "{{ .PAPERLESS_DBUSER }}"
-        PAPERLESS_DBPASSWORD: "{{ .PAPERLESS_DBPASSWORD }}"
-  data:
-    - secretKey: PAPERLESS_DBNAME
-      remoteRef:
-        {
-          key: 05426e55-fe04-4c16-8697-8a258928257a,
-          property: PAPERLESS_DBNAME,
-        }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
-    - secretKey: PAPERLESS_DBUSER
-      remoteRef:
-        {
-          key: 05426e55-fe04-4c16-8697-8a258928257a,
-          property: PAPERLESS_DBUSER,
-        }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
-    - secretKey: PAPERLESS_DBPASSWORD
-      remoteRef:
-        {
-          key: 05426e55-fe04-4c16-8697-8a258928257a,
-          property: PAPERLESS_DBPASSWORD,
-        }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }

secrets/radarr.yaml

@@ -1,48 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata: { name: radarr, namespace: media }
-spec:
-  refreshInterval: 1h
-  target:
-    name: radarr-secret
-    deletionPolicy: Retain
-    template:
-      type: Opaque
-      data:
-        Radarr__Postgres__User: "{{ .Radarr__Postgres__User }}"
-        Radarr__Postgres__Password: "{{ .Radarr__Postgres__Password }}"
-        Radarr__Postgres__Host: "{{ .Radarr__Postgres__Host }}"
-        Radarr__Postgres__MainDb: "{{ .Radarr__Postgres__MainDb }}"
-  data:
-    - secretKey: Radarr__Postgres__User
-      remoteRef:
-        {
-          key: ab723b65-3ec8-469c-b01d-67a6e3049023,
-          property: username,
-        }
-      sourceRef:
-        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
-    - secretKey: Radarr__Postgres__Password
-      remoteRef:
-        {
-          key: ab723b65-3ec8-469c-b01d-67a6e3049023,
-          property: password,
-        }
-      sourceRef:
-        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
-    - secretKey: Radarr__Postgres__Host
-      remoteRef:
-        {
-          key: ab723b65-3ec8-469c-b01d-67a6e3049023,
-          property: Radarr__Postgres__Host,
-        }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
-    - secretKey: Radarr__Postgres__MainDb
-      remoteRef:
-        {
-          key: ab723b65-3ec8-469c-b01d-67a6e3049023,
-          property: Radarr__Postgres__MainDb,
-        }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }

secrets/recommender.yaml

@@ -1,27 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata: { name: recommender, namespace: media }
-spec:
-  refreshInterval: 1h
-  target:
-    name: recommender-secrets
-    deletionPolicy: Retain
-    template:
-      type: Opaque
-      data:
-        OPENAI_API_KEY: "{{ .OPENAI_API_KEY }}"
-        DATABASE_URL: "{{ .DATABASE_URL }}"
-  data:
-    - secretKey: OPENAI_API_KEY
-      remoteRef:
-        {
-          key: 5079ef6f-3d1d-4522-b22c-6dd5f1c19acd,
-          property: OPENAI_API_KEY,
-        }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
-    - secretKey: DATABASE_URL
-      remoteRef:
-        { key: 5079ef6f-3d1d-4522-b22c-6dd5f1c19acd, property: DATABASE_URL }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }

secrets/slink.yaml

@@ -1,30 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata: { name: slink, namespace: cloud }
-spec:
-  refreshInterval: 1h
-  target:
-    name: slink-secret
-    deletionPolicy: Retain
-    template:
-      type: Opaque
-      data:
-        ADMIN_USERNAME: "{{ .ADMIN_USERNAME }}"
-        ADMIN_PASSWORD: "{{ .ADMIN_PASSWORD }}"
-        ADMIN_EMAIL: "{{ .ADMIN_EMAIL }}"
-  data:
-    - secretKey: ADMIN_USERNAME
-      remoteRef:
-        { key: 79f97033-6bc3-40cd-a28c-6060b8bd3a63, property: username }
-      sourceRef:
-        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
-    - secretKey: ADMIN_PASSWORD
-      remoteRef:
-        { key: 79f97033-6bc3-40cd-a28c-6060b8bd3a63, property: password }
-      sourceRef:
-        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
-    - secretKey: ADMIN_EMAIL
-      remoteRef:
-        { key: 79f97033-6bc3-40cd-a28c-6060b8bd3a63, property: ADMIN_EMAIL }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }

secrets/sonarr.yaml

@@ -1,42 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata: { name: sonarr, namespace: media }
-spec:
-  refreshInterval: 1h
-  target:
-    name: sonarr-secret
-    deletionPolicy: Retain
-    template:
-      type: Opaque
-      data:
-        Sonarr__Postgres__User: "{{ .Sonarr__Postgres__User }}"
-        Sonarr__Postgres__Password: "{{ .Sonarr__Postgres__Password }}"
-        Sonarr__Postgres__Host: "{{ .Sonarr__Postgres__Host }}"
-        Sonarr__Postgres__MainDb: "{{ .Sonarr__Postgres__MainDb }}"
-  data:
-    - secretKey: Sonarr__Postgres__User
-      remoteRef:
-        { key: 2c5b6d27-971f-4876-b10d-db400dfde7b2, property: username }
-      sourceRef:
-        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
-    - secretKey: Sonarr__Postgres__Password
-      remoteRef:
-        { key: 2c5b6d27-971f-4876-b10d-db400dfde7b2, property: password }
-      sourceRef:
-        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
-    - secretKey: Sonarr__Postgres__Host
-      remoteRef:
-        {
-          key: 2c5b6d27-971f-4876-b10d-db400dfde7b2,
-          property: Sonarr__Postgres__Host,
-        }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
-    - secretKey: Sonarr__Postgres__MainDb
-      remoteRef:
-        {
-          key: 2c5b6d27-971f-4876-b10d-db400dfde7b2,
-          property: Sonarr__Postgres__MainDb,
-        }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }