infra: add haven-notify Deployment/Service/Ingress manifest

Moved from server-scripts/haven-notify/deploy. Haven Notify is an internal Discord webhook notifier, catalogued under infra/ alongside Beszel/WireGuard/Code Config per the repo README.
2026-07-13 12:06:28 -03:00
25 changed files with 159 additions and 812 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -13,3 +13,5 @@ cronjobs
 *.key

 chacal/
+
+secrets/
--- a/ansible/.ansible-lint
+++ b/ansible/.ansible-lint
@@ -1,4 +0,0 @@
---
-profile: basic
-exclude_paths:
-  - collections/
--- a/ansible/.gitignore
+++ b/ansible/.gitignore
@@ -1,13 +0,0 @@
-# Encrypted secrets
-group_vars/all/vault.yml
-
-# Installed collections
-collections/
-
-# Ansible retry files
-*.retry
-
-# Local controller environment and test caches
-.venv/
-__pycache__/
-.pytest_cache/
--- a/ansible/ansible.cfg
+++ b/ansible/ansible.cfg
@@ -1,9 +0,0 @@
-[defaults]
-inventory = inventory.yml
-host_key_checking = True
-retry_files_enabled = False
-stdout_callback = default
-result_format = yaml
-collections_path = ./collections
-roles_path = ./roles
-interpreter_python = auto_silent
--- a/ansible/inventory.yml
+++ b/ansible/inventory.yml
@@ -1,49 +0,0 @@
---
-# Proxmox connection: local API access (the controller reaches the node directly).
-# This is the "proxmox" group — not an SSH target, just connection params.
-all:
-  children:
-    proxmox_nodes:
-      hosts:
-        otherside:
-          ansible_host: otherside.haven
-          ansible_connection: local # we call the Proxmox API, not SSH
-        astrid:
-          ansible_host: astrid.haven
-          ansible_connection: local # we call the Proxmox API, not SSH
-    k3s_cluster:
-      children:
-        grp_k3s_server: # group name == group_vars/grp_k3s_server.yml
-          hosts:
-            iris:
-              ansible_host: iris.haven
-              ansible_user: root
-              ansible_python_interpreter: /usr/bin/python3
-        grp_k3s_agent: # group name == group_vars/grp_k3s_agent.yml
-          hosts:
-            vega:
-              ansible_host: vega.haven
-              ansible_user: root
-              ansible_python_interpreter: /usr/bin/python3
-            nebula:
-              ansible_host: nebula.haven
-              ansible_user: root
-              ansible_python_interpreter: /usr/bin/python3
-            nexus:
-              ansible_host: nexus.haven
-              ansible_user: root
-              ansible_python_interpreter: /usr/bin/python3
-    lxcs:
-      children:
-        grp_docker_build: # group name == group_vars/grp_docker_build.yml
-          hosts:
-            docker_build:
-              ansible_host: docker-build.haven
-              ansible_user: root
-              ansible_python_interpreter: /usr/bin/python3
-        grp_redis: # group name == group_vars/grp_redis.yml
-          hosts:
-            redis:
-              ansible_host: redis.haven
-              ansible_user: root
-              ansible_python_interpreter: /usr/bin/python3
--- a/ansible/playbooks/k3s_update.yml
+++ b/ansible/playbooks/k3s_update.yml
@@ -1,69 +0,0 @@
-## Updates k3s in the entire cluster
- name: Update k3s Control Plane
-  hosts: grp_k3s_server
-  serial: 1
-  gather_facts: false
-  become: true
-  tasks:
-    - name: Update k3s on control plane node
-      ansible.builtin.shell: >
-        sh <(curl -sfL https://get.k3s.io)
-      args:
-        executable: /bin/bash
-      register: k3s_update
-
-    - name: Print update output
-      ansible.builtin.debug:
-        var: k3s_update
-
- name: Update k3s Agents
-  hosts: grp_k3s_agent
-  serial: 1
-  gather_facts: false
-  become: true
-  tasks:
-    - name: Cordon agent node
-      ansible.builtin.command: kubectl cordon {{ inventory_hostname }}
-      delegate_to: "{{ groups['grp_k3s_server'][0] }}"
-      environment:
-        KUBECONFIG: /etc/rancher/k3s/k3s.yaml
-      ignore_errors: true
-
-    - name: Drain agent node
-      ansible.builtin.command: >
-        kubectl drain {{ inventory_hostname }}
-        --ignore-daemonsets
-        --delete-emptydir-data
-        --force
-        --timeout=60s
-      delegate_to: "{{ groups['grp_k3s_server'][0] }}"
-      environment:
-        KUBECONFIG: /etc/rancher/k3s/k3s.yaml
-      ignore_errors: true
-
-    - name: Kill k3s-agent process
-      ansible.builtin.shell: k3s-killall.sh
-      ignore_errors: true
-
-    - name: Update k3s on agent node
-      ansible.builtin.shell: >
-        sh <(curl -sfL https://get.k3s.io)
-      args:
-        executable: /bin/bash
-      register: k3s_update
-
-    - name: Restart k3s-agent service
-      ansible.builtin.systemd:
-        name: k3s-agent
-        state: restarted
-
-    - name: Print update output
-      ansible.builtin.debug:
-        var: k3s_update
-
-    - name: Uncordon agent node
-      ansible.builtin.command: kubectl uncordon {{ inventory_hostname }}
-      delegate_to: "{{ groups['grp_k3s_server'][0] }}"
-      environment:
-        KUBECONFIG: /etc/rancher/k3s/k3s.yaml
-      ignore_errors: true
--- a/ansible/requirements-dev.txt
+++ b/ansible/requirements-dev.txt
@@ -1,2 +0,0 @@
-r requirements-python.txt
-ansible-lint==26.6.0
--- a/ansible/requirements-python.txt
+++ b/ansible/requirements-python.txt
@@ -1,3 +0,0 @@
-ansible-core==2.21.2
-proxmoxer==2.3.0
-requests==2.34.2
--- a/ansible/requirements.yml
+++ b/ansible/requirements.yml
@@ -1,6 +0,0 @@
---
-collections:
-  - name: community.proxmox
-    version: "2.0.0"
-  - name: community.general
-    version: "13.2.0"
--- a/default/vaultwarden.yaml
+++ b/default/vaultwarden.yaml
@@ -30,31 +30,6 @@ spec:
          ports:
            - containerPort: 80
              name: vault-port
-          # /alive requires no authentication and verifies the Vaultwarden process
-          startupProbe:
-            httpGet:
-              path: /alive
-              port: vault-port
-              scheme: HTTP
-            periodSeconds: 5
-            timeoutSeconds: 3
-            failureThreshold: 30
-          readinessProbe:
-            httpGet:
-              path: /alive
-              port: vault-port
-              scheme: HTTP
-            periodSeconds: 10
-            timeoutSeconds: 3
-            failureThreshold: 3
-          livenessProbe:
-            httpGet:
-              path: /alive
-              port: vault-port
-              scheme: HTTP
-            periodSeconds: 15
-            timeoutSeconds: 3
-            failureThreshold: 6
          volumeMounts:
            - name: vaultwarden-data
              mountPath: /data
--- a/dev/gitea-runner.yaml
+++ b/dev/gitea-runner.yaml
@@ -14,10 +14,6 @@ data:
        - "ubuntu-amd64:docker://docker.gitea.com/runner-images:ubuntu-latest"
        - "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
        - "ubuntu-slim:docker://docker.gitea.com/runner-images:ubuntu-latest-slim"
-        - "runner-full:docker://git.ivanch.me/ivanch/runner-images:full"
-        - "runner-slim:docker://git.ivanch.me/ivanch/runner-images:slim"
-        - "runner-full-amd64:docker://git.ivanch.me/ivanch/runner-images:full"
-        - "runner-slim-amd64:docker://git.ivanch.me/ivanch/runner-images:slim"
 ---
 # --- ConfigMap for the ARM64 Runner ---
 apiVersion: v1
@@ -32,8 +28,6 @@ data:
      timeout: 1h
      labels:
        - "ubuntu-arm64:docker://docker.gitea.com/runner-images:ubuntu-latest"
-        - "runner-full-arm64:docker://git.ivanch.me/ivanch/runner-images:full"
-        - "runner-slim-arm64:docker://git.ivanch.me/ivanch/runner-images:slim"
 ---
 # PersistentVolumeClaim for AMD64
 apiVersion: v1
--- a/infra/eso/bitwarden-cli.yaml
+++ b/infra/eso/bitwarden-cli.yaml
@@ -1,121 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: bitwarden-cli
-  namespace: infra
-  labels:
-    app.kubernetes.io/name: bitwarden-cli
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: bitwarden-cli
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: bitwarden-cli
-    spec:
-      containers:
-        - name: bitwarden-cli
-          image: ghcr.io/charlesthomas/bitwarden-cli:2026.3.0
-          imagePullPolicy: IfNotPresent
-          # Override the baked entrypoint so --disable-origin-protection is
-          # actually passed (it was commented out in the image's entrypoint.sh,
-          # which made bw serve reject all cross-pod requests -> connection refused).
-          command: ["/bin/bash", "-lc"]
-          args:
-            - |
-              set -e
-              bw config server "${BW_HOST}"
-              # Authenticate. Prefer the API key if client creds are present,
-              # otherwise fall back to username+password. The session is exported
-              # so the background loop can re-derive (and refresh) it.
-              login() {
-                if [ -n "$BW_CLIENTID" ] && [ -n "$BW_CLIENTSECRET" ]; then
-                  echo "Using apikey to log in"
-                  BW_SESSION=$(bw login --apikey --raw) || return 1
-                else
-                  echo "Using password to log in"
-                  BW_SESSION=$(bw login "${BW_USER}" --passwordenv BW_PASSWORD --raw) || return 1
-                fi
-                export BW_SESSION
-              }
-              login
-              # Warm the vault cache once at startup so bw serve has data immediately.
-              bw sync
-              bw status
-              # Keep the session alive: RE-LOGIN every cycle and re-sync so the on-disk
-              # vault cache stays warm and the session token never lapses. A loop that
-              # only re-ran `bw sync` with a captured session would eventually fail once
-              # the session expired (-> stale cache / "Not found" for changed items, or a
-              # full unauthenticated 400 if the initial login never happened at all).
-              echo "Starting periodic bw login+sync loop (every 5m)"
-              (
-                while true; do
-                  sleep 300
-                  login || true
-                  echo "[$(date -u +%FT%TZ)] bw sync"
-                  bw sync >/dev/null 2>&1 || echo "[$(date -u +%FT%TZ)] bw sync failed"
-                done
-              ) &
-              echo 'Running `bw serve` on port 8087'
-              bw serve --hostname 0.0.0.0 --disable-origin-protection
-          env:
-            - name: BW_HOST
-              valueFrom:
-                secretKeyRef:
-                  name: bitwarden-cli
-                  key: BW_HOST
-            - name: BW_USER
-              valueFrom:
-                secretKeyRef:
-                  name: bitwarden-cli
-                  key: BW_USERNAME
-            - name: BW_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: bitwarden-cli
-                  key: BW_PASSWORD
-          ports:
-            - name: http
-              containerPort: 8087
-              protocol: TCP
-          startupProbe:
-            tcpSocket: { port: 8087 }
-            periodSeconds: 5
-            timeoutSeconds: 3
-            failureThreshold: 30
-          readinessProbe:
-            tcpSocket: { port: 8087 }
-            periodSeconds: 10
-            timeoutSeconds: 3
-            failureThreshold: 3
-          livenessProbe:
-            tcpSocket: { port: 8087 }
-            periodSeconds: 15
-            timeoutSeconds: 3
-            failureThreshold: 6
-          resources:
-            limits:
-              cpu: 400m
-              memory: 512Mi
-            requests:
-              cpu: 50m
-              memory: 128Mi
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: bitwarden-cli
-  namespace: infra
-  labels:
-    app.kubernetes.io/name: bitwarden-cli
-spec:
-  type: ClusterIP
-  selector:
-    app.kubernetes.io/name: bitwarden-cli
-  ports:
-    - name: http
-      port: 8087
-      targetPort: http
-      protocol: TCP
--- a/infra/eso/bw-cli-netpol.yaml
+++ b/infra/eso/bw-cli-netpol.yaml
@@ -1,21 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: bw-cli
-  namespace: infra
-spec:
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/name: bitwarden-cli
-  policyTypes:
-    - Ingress
-  ingress:
-    - from:
-        # ESO pods (app.kubernetes.io/name: external-secrets) in the external-secrets namespace.
-        # Both podSelector AND namespaceSelector must match for cross-namespace traffic.
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: external-secrets
-          podSelector:
-            matchLabels:
-              app.kubernetes.io/name: external-secrets
--- a/infra/eso/secretstores.yaml
+++ b/infra/eso/secretstores.yaml
@@ -1,20 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ClusterSecretStore
-metadata: { name: bitwarden-login }
-spec:
-  provider:
-    webhook:
-      url: "http://bitwarden-cli.infra.svc:8087/object/item/{{ .remoteRef.key }}"
-      result: { jsonPath: "$.data.login.{{ .remoteRef.property }}" }
---
-apiVersion: external-secrets.io/v1
-kind: ClusterSecretStore
-metadata: { name: bitwarden-fields }
-spec:
-  provider:
-    webhook:
-      url: "http://bitwarden-cli.infra.svc:8087/object/item/{{ .remoteRef.key }}"
-      result:
-        {
-          jsonPath: '$.data.fields[?@.name=="{{ .remoteRef.property }}"].value',
-        }
--- a/default/haven-notify.yaml
+++ b/default/haven-notify.yaml
@@ -2,7 +2,6 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: haven-notify
-  namespace: default
  labels:
    app: haven-notify
 spec:
@@ -39,20 +38,11 @@ spec:
              port: 8080
            initialDelaySeconds: 5
            periodSeconds: 10
-          resources:
-            requests:
-              cpu: 50m
-              memory: 64Mi
-            limits:
-              cpu: 200m
-              memory: 128Mi
-
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: haven-notify
-  namespace: default
 spec:
  selector:
    app: haven-notify
--- a/infra/wg-easy.yaml
+++ b/infra/wg-easy.yaml
@@ -75,9 +75,6 @@ spec:
          requests:
            cpu: 100m
            memory: 256Mi
-            limits:
-              cpu: 2000m
-              memory: 1Gi
        volumeMounts:
        - name: wg-easy-volume
          mountPath: /etc/wireguard
--- a/secrets/adguard.yaml
+++ b/secrets/adguard.yaml
@@ -1,24 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata: { name: adguardhome-password, namespace: dns }
-spec:
-  refreshInterval: 1h
-  target:
-    name: adguardhome-password
-    deletionPolicy: Retain
-    template:
-      type: Opaque
-      data:
-        username: "{{ .username }}"
-        password: "{{ .password }}"
-  data:
-    - secretKey: username
-      remoteRef:
-        { key: 5bc7e63f-18bb-482c-bc3e-740e03b26334, property: username }
-      sourceRef:
-        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
-    - secretKey: password
-      remoteRef:
-        { key: 5bc7e63f-18bb-482c-bc3e-740e03b26334, property: password }
-      sourceRef:
-        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
--- a/secrets/cloudreve.yaml
+++ b/secrets/cloudreve.yaml
@@ -1,36 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata: { name: cloudreve, namespace: cloud }
-spec:
-  refreshInterval: 1h
-  target:
-    name: cloudreve-secret
-    deletionPolicy: Retain
-    template:
-      type: Opaque
-      data:
-        DB_USER: "{{ .DB_USER }}"
-        DB_PASSWORD: "{{ .DB_PASSWORD }}"
-        DB_NAME: "{{ .DB_NAME }}"
-        REDIS_PASSWORD: "{{ .REDIS_PASSWORD }}"
-  data:
-    - secretKey: DB_USER
-      remoteRef:
-        { key: 8c25cac9-e9e8-4970-bdf4-31f9aee19276, property: username }
-      sourceRef:
-        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
-    - secretKey: DB_PASSWORD
-      remoteRef:
-        { key: 8c25cac9-e9e8-4970-bdf4-31f9aee19276, property: password }
-      sourceRef:
-        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
-    - secretKey: DB_NAME
-      remoteRef:
-        { key: 8c25cac9-e9e8-4970-bdf4-31f9aee19276, property: DB_NAME }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
-    - secretKey: REDIS_PASSWORD
-      remoteRef:
-        { key: 8c25cac9-e9e8-4970-bdf4-31f9aee19276, property: REDIS_PASSWORD }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
--- a/secrets/gitea-runner.yaml
+++ b/secrets/gitea-runner.yaml
@@ -1,21 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata: { name: gitea-runner, namespace: dev }
-spec:
-  refreshInterval: 1h
-  target:
-    name: gitea-runner-token
-    deletionPolicy: Retain
-    template:
-      type: Opaque
-      data:
-        REGISTRATION_TOKEN: "{{ .REGISTRATION_TOKEN }}"
-  data:
-    - secretKey: REGISTRATION_TOKEN
-      remoteRef:
-        {
-          key: 4e286657-b5de-4354-be2e-d1649b0fd527,
-          property: REGISTRATION_TOKEN,
-        }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
--- a/secrets/openwebui.yaml
+++ b/secrets/openwebui.yaml
@@ -1,27 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata: { name: openwebui, namespace: default }
-spec:
-  refreshInterval: 1h
-  target:
-    name: openwebui-secret
-    deletionPolicy: Retain
-    template:
-      type: Opaque
-      data:
-        DATABASE_URL: "postgresql://{{ .username }}:{{ .password }}@postgresql.haven:5432/{{ .dbname }}"
-  data:
-    - secretKey: username
-      remoteRef:
-        { key: e80ff314-7445-4b61-b5c5-69285ea72586, property: username }
-      sourceRef:
-        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
-    - secretKey: password
-      remoteRef:
-        { key: e80ff314-7445-4b61-b5c5-69285ea72586, property: password }
-      sourceRef:
-        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
-    - secretKey: dbname
-      remoteRef: { key: e80ff314-7445-4b61-b5c5-69285ea72586, property: dbname }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
--- a/secrets/paperless.yaml
+++ b/secrets/paperless.yaml
@@ -1,39 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata: { name: paperless, namespace: default }
-spec:
-  refreshInterval: 1h
-  target:
-    name: paperless-secret
-    deletionPolicy: Retain
-    template:
-      type: Opaque
-      data:
-        PAPERLESS_DBNAME: "{{ .PAPERLESS_DBNAME }}"
-        PAPERLESS_DBUSER: "{{ .PAPERLESS_DBUSER }}"
-        PAPERLESS_DBPASSWORD: "{{ .PAPERLESS_DBPASSWORD }}"
-  data:
-    - secretKey: PAPERLESS_DBNAME
-      remoteRef:
-        {
-          key: 05426e55-fe04-4c16-8697-8a258928257a,
-          property: PAPERLESS_DBNAME,
-        }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
-    - secretKey: PAPERLESS_DBUSER
-      remoteRef:
-        {
-          key: 05426e55-fe04-4c16-8697-8a258928257a,
-          property: PAPERLESS_DBUSER,
-        }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
-    - secretKey: PAPERLESS_DBPASSWORD
-      remoteRef:
-        {
-          key: 05426e55-fe04-4c16-8697-8a258928257a,
-          property: PAPERLESS_DBPASSWORD,
-        }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
--- a/secrets/radarr.yaml
+++ b/secrets/radarr.yaml
@@ -1,48 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata: { name: radarr, namespace: media }
-spec:
-  refreshInterval: 1h
-  target:
-    name: radarr-secret
-    deletionPolicy: Retain
-    template:
-      type: Opaque
-      data:
-        Radarr__Postgres__User: "{{ .Radarr__Postgres__User }}"
-        Radarr__Postgres__Password: "{{ .Radarr__Postgres__Password }}"
-        Radarr__Postgres__Host: "{{ .Radarr__Postgres__Host }}"
-        Radarr__Postgres__MainDb: "{{ .Radarr__Postgres__MainDb }}"
-  data:
-    - secretKey: Radarr__Postgres__User
-      remoteRef:
-        {
-          key: ab723b65-3ec8-469c-b01d-67a6e3049023,
-          property: username,
-        }
-      sourceRef:
-        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
-    - secretKey: Radarr__Postgres__Password
-      remoteRef:
-        {
-          key: ab723b65-3ec8-469c-b01d-67a6e3049023,
-          property: password,
-        }
-      sourceRef:
-        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
-    - secretKey: Radarr__Postgres__Host
-      remoteRef:
-        {
-          key: ab723b65-3ec8-469c-b01d-67a6e3049023,
-          property: Radarr__Postgres__Host,
-        }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
-    - secretKey: Radarr__Postgres__MainDb
-      remoteRef:
-        {
-          key: ab723b65-3ec8-469c-b01d-67a6e3049023,
-          property: Radarr__Postgres__MainDb,
-        }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
--- a/secrets/recommender.yaml
+++ b/secrets/recommender.yaml
@@ -1,27 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata: { name: recommender, namespace: media }
-spec:
-  refreshInterval: 1h
-  target:
-    name: recommender-secrets
-    deletionPolicy: Retain
-    template:
-      type: Opaque
-      data:
-        OPENAI_API_KEY: "{{ .OPENAI_API_KEY }}"
-        DATABASE_URL: "{{ .DATABASE_URL }}"
-  data:
-    - secretKey: OPENAI_API_KEY
-      remoteRef:
-        {
-          key: 5079ef6f-3d1d-4522-b22c-6dd5f1c19acd,
-          property: OPENAI_API_KEY,
-        }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
-    - secretKey: DATABASE_URL
-      remoteRef:
-        { key: 5079ef6f-3d1d-4522-b22c-6dd5f1c19acd, property: DATABASE_URL }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
--- a/secrets/slink.yaml
+++ b/secrets/slink.yaml
@@ -1,30 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata: { name: slink, namespace: cloud }
-spec:
-  refreshInterval: 1h
-  target:
-    name: slink-secret
-    deletionPolicy: Retain
-    template:
-      type: Opaque
-      data:
-        ADMIN_USERNAME: "{{ .ADMIN_USERNAME }}"
-        ADMIN_PASSWORD: "{{ .ADMIN_PASSWORD }}"
-        ADMIN_EMAIL: "{{ .ADMIN_EMAIL }}"
-  data:
-    - secretKey: ADMIN_USERNAME
-      remoteRef:
-        { key: 79f97033-6bc3-40cd-a28c-6060b8bd3a63, property: username }
-      sourceRef:
-        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
-    - secretKey: ADMIN_PASSWORD
-      remoteRef:
-        { key: 79f97033-6bc3-40cd-a28c-6060b8bd3a63, property: password }
-      sourceRef:
-        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
-    - secretKey: ADMIN_EMAIL
-      remoteRef:
-        { key: 79f97033-6bc3-40cd-a28c-6060b8bd3a63, property: ADMIN_EMAIL }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
--- a/secrets/sonarr.yaml
+++ b/secrets/sonarr.yaml
@@ -1,42 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata: { name: sonarr, namespace: media }
-spec:
-  refreshInterval: 1h
-  target:
-    name: sonarr-secret
-    deletionPolicy: Retain
-    template:
-      type: Opaque
-      data:
-        Sonarr__Postgres__User: "{{ .Sonarr__Postgres__User }}"
-        Sonarr__Postgres__Password: "{{ .Sonarr__Postgres__Password }}"
-        Sonarr__Postgres__Host: "{{ .Sonarr__Postgres__Host }}"
-        Sonarr__Postgres__MainDb: "{{ .Sonarr__Postgres__MainDb }}"
-  data:
-    - secretKey: Sonarr__Postgres__User
-      remoteRef:
-        { key: 2c5b6d27-971f-4876-b10d-db400dfde7b2, property: username }
-      sourceRef:
-        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
-    - secretKey: Sonarr__Postgres__Password
-      remoteRef:
-        { key: 2c5b6d27-971f-4876-b10d-db400dfde7b2, property: password }
-      sourceRef:
-        { storeRef: { name: bitwarden-login, kind: ClusterSecretStore } }
-    - secretKey: Sonarr__Postgres__Host
-      remoteRef:
-        {
-          key: 2c5b6d27-971f-4876-b10d-db400dfde7b2,
-          property: Sonarr__Postgres__Host,
-        }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }
-    - secretKey: Sonarr__Postgres__MainDb
-      remoteRef:
-        {
-          key: 2c5b6d27-971f-4876-b10d-db400dfde7b2,
-          property: Sonarr__Postgres__MainDb,
-        }
-      sourceRef:
-        { storeRef: { name: bitwarden-fields, kind: ClusterSecretStore } }