Reset git history for making manifests public

infisical/Infisical-secrets/authentik.yaml

@@ -0,0 +1,22 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: authentik-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    universalAuth:
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/authentik"
+        recursive: true
+      credentialsRef:
+        secretName: infisical-universal-auth
+        secretNamespace: infisical
+  managedSecretReference:
+    secretName: authentik-secrets
+    secretNamespace: authentik
+    secretType: Opaque

infisical/Infisical-secrets/azure-ddns.yaml

@@ -0,0 +1,22 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: azure-ddns-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    universalAuth:
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/azure-ddns"
+        recursive: true
+      credentialsRef:
+        secretName: infisical-universal-auth
+        secretNamespace: infisical
+  managedSecretReference:
+    secretName: azure-ddns-secrets
+    secretNamespace: azure-ddns
+    secretType: Opaque

infisical/Infisical-secrets/gitea.yaml

@@ -0,0 +1,22 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: gitea-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    universalAuth:
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/gitea"
+        recursive: true
+      credentialsRef:
+        secretName: infisical-universal-auth
+        secretNamespace: infisical
+  managedSecretReference:
+    secretName: gitea-secrets
+    secretNamespace: gitea
+    secretType: Opaque

infisical/Infisical-secrets/gotify.yaml

@@ -0,0 +1,22 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: gotify-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    universalAuth:
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/gotify"
+        recursive: true
+      credentialsRef:
+        secretName: infisical-universal-auth
+        secretNamespace: infisical
+  managedSecretReference:
+    secretName: gotify-secrets
+    secretNamespace: gotify
+    secretType: Opaque

infisical/Infisical-secrets/immich.yaml

@@ -0,0 +1,22 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: immich-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    universalAuth:
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/immich"
+        recursive: true
+      credentialsRef:
+        secretName: infisical-universal-auth
+        secretNamespace: infisical
+  managedSecretReference:
+    secretName: immich-secrets
+    secretNamespace: immich
+    secretType: Opaque

infisical/Infisical-secrets/jellyfin.yaml

@@ -0,0 +1,22 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: jellyfin-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    universalAuth:
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/jellyfin"
+        recursive: true
+      credentialsRef:
+        secretName: infisical-universal-auth
+        secretNamespace: infisical
+  managedSecretReference:
+    secretName: jellyfin-secrets
+    secretNamespace: jellyfin
+    secretType: Opaque

infisical/Infisical-secrets/longhorn.yaml

@@ -0,0 +1,22 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: longhorn-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    universalAuth:
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/longhorn"
+        recursive: true
+      credentialsRef:
+        secretName: infisical-universal-auth
+        secretNamespace: infisical
+  managedSecretReference:
+    secretName: longhorn-secrets
+    secretNamespace: longhorn-system
+    secretType: Opaque

infisical/Infisical-secrets/minecraft.yaml

@@ -0,0 +1,22 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: minecraft-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    universalAuth:
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/minecraft"
+        recursive: true
+      credentialsRef:
+        secretName: infisical-universal-auth
+        secretNamespace: infisical
+  managedSecretReference:
+    secretName: minecraft-secrets
+    secretNamespace: minecraft
+    secretType: Opaque

infisical/Infisical-secrets/n8n.yaml

@@ -0,0 +1,22 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: n8n-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    universalAuth:
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/n8n"
+        recursive: true
+      credentialsRef:
+        secretName: infisical-universal-auth
+        secretNamespace: infisical
+  managedSecretReference:
+    secretName: n8n-secrets
+    secretNamespace: n8n
+    secretType: Opaque

infisical/Infisical-secrets/netbootxyz.yaml

@@ -0,0 +1,22 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: netbootxyz-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    universalAuth:
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/netbootxyz"
+        recursive: true
+      credentialsRef:
+        secretName: infisical-universal-auth
+        secretNamespace: infisical
+  managedSecretReference:
+    secretName: netbootxyz-secrets
+    secretNamespace: netbootxyz
+    secretType: Opaque

infisical/Infisical-secrets/openwebui.yaml

@@ -0,0 +1,22 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: openwebui-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    universalAuth:
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/openwebui"
+        recursive: true
+      credentialsRef:
+        secretName: infisical-universal-auth
+        secretNamespace: infisical
+  managedSecretReference:
+    secretName: openwebui-secrets
+    secretNamespace: openwebui
+    secretType: Opaque

infisical/Infisical-secrets/passbolt.yaml

@@ -0,0 +1,22 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: passbolt-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    universalAuth:
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/passbolt"
+        recursive: true
+      credentialsRef:
+        secretName: infisical-universal-auth
+        secretNamespace: infisical
+  managedSecretReference:
+    secretName: passbolt-secrets
+    secretNamespace: passbolt
+    secretType: Opaque

infisical/Infisical-secrets/resume.yaml

@@ -0,0 +1,22 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: resume-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    universalAuth:
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/reactive_resume"
+        recursive: true
+      credentialsRef:
+        secretName: infisical-universal-auth
+        secretNamespace: infisical
+  managedSecretReference:
+    secretName: resume-secrets
+    secretNamespace: resume
+    secretType: Opaque

infisical/Infisical-secrets/searxng.yaml

@@ -0,0 +1,22 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: searxng-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    universalAuth:
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/searxng"
+        recursive: true
+      credentialsRef:
+        secretName: infisical-universal-auth
+        secretNamespace: infisical
+  managedSecretReference:
+    secretName: searxng-secrets
+    secretNamespace: searxng
+    secretType: Opaque

infisical/Infisical-secrets/uptime-kuma.yaml

@@ -0,0 +1,22 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: uptime-kuma-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    universalAuth:
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/uptime-kuma"
+        recursive: true
+      credentialsRef:
+        secretName: infisical-universal-auth
+        secretNamespace: infisical
+  managedSecretReference:
+    secretName: uptime-kuma-secrets
+    secretNamespace: uptime-kuma
+    secretType: Opaque

infisical/Infisical-secrets/vaultwarden.yaml

@@ -0,0 +1,22 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: vaultwarden-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    universalAuth:
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/vaultwarden"
+        recursive: true
+      credentialsRef:
+        secretName: infisical-universal-auth
+        secretNamespace: infisical
+  managedSecretReference:
+    secretName: vaultwarden-secrets
+    secretNamespace: vaultwarden
+    secretType: Opaque

infisical/Infisical-secrets/victoria-metrics.yaml

@@ -0,0 +1,22 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: victoria-metrics-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    universalAuth:
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/victoria-metrics"
+        recursive: true
+      credentialsRef:
+        secretName: infisical-universal-auth
+        secretNamespace: infisical
+  managedSecretReference:
+    secretName: victoria-metrics-secrets
+    secretNamespace: victoria-metrics
+    secretType: Opaque

infisical/Infisical-secrets/zipline.yaml

@@ -0,0 +1,22 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: zipline-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    universalAuth:
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/zipline"
+        recursive: true
+      credentialsRef:
+        secretName: infisical-universal-auth
+        secretNamespace: infisical
+  managedSecretReference:
+    secretName: zipline-secrets
+    secretNamespace: zipline
+    secretType: Opaque

infisical/httproute.yaml

@@ -0,0 +1,46 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: infisical-route
+  namespace: infisical
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-internal
+      namespace: envoy-gateway
+      sectionName: infisical
+  hostnames:
+    - "infisical.jsme.be"
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      filters:
+        - type: RequestHeaderModifier
+          requestHeaderModifier:
+            set:
+              - name: X-Forwarded-Host
+                value: "infisical.jsme.be"
+              - name: X-Forwarded-Proto
+                value: https
+        - type: ResponseHeaderModifier
+          responseHeaderModifier:
+            set:
+              - name: Strict-Transport-Security
+                value: "max-age=31536000; includeSubDomains"
+              - name: X-Content-Type-Options
+                value: nosniff
+              - name: X-Frame-Options
+                value: SAMEORIGIN
+              - name: Referrer-Policy
+                value: strict-origin-when-cross-origin
+              - name: Permissions-Policy
+                value: "camera=(), microphone=(), geolocation=(), payment=()"
+      backendRefs:
+        - name: infisical
+          port: 8080
+          kind: Service
+          group: ""
+          weight: 1

infisical/infisical-endpointslice.yaml

@@ -0,0 +1,18 @@
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: infisical
+  namespace: infisical 
+  labels:
+    kubernetes.io/service-name: infisical
+addressType: IPv4
+ports:
+  - port: 8080
+    protocol: TCP
+endpoints:
+  - addresses:
+      - "10.8.11.98"
+    conditions:
+      ready: true
+      serving: true
+      terminating: false

infisical/infisical-svc.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: infisical
+  namespace: infisical 
+spec:
+  ports:
+    - protocol: TCP
+      port: 8080 
+      targetPort: 8080 
+  type: ClusterIP 

infisical/template-infisical-secret.yaml

@@ -0,0 +1,30 @@
+# Copy this file and replace:
+#   - SERVICE_NAME: the service/folder name
+#   - SERVICE_NAMESPACE: the namespace where the secret should be created
+#
+# Example: for a service called "my-app" in namespace "my-app":
+#   - SERVICE_NAME → my-app
+#   - SERVICE_NAMESPACE → my-app
+#
+# apiVersion: secrets.infisical.com/v1alpha1
+# kind: InfisicalSecret
+# metadata:
+#   name: SERVICE_NAME-secrets
+#   namespace: infisical
+# spec:
+#   hostAPI: https://infisical.jsme.be
+#   resyncInterval: 60
+#   authentication:
+#     universalAuth:
+#       secretsScope:
+#         projectSlug: "kubernetes"
+#         envSlug: "prod"
+#         secretsPath: "/SERVICE_NAME"
+#         recursive: true
+#       credentialsRef:
+#         secretName: infisical-universal-auth
+#         secretNamespace: infisical
+#   managedSecretReference:
+#     secretName: SERVICE_NAME-secrets
+#     secretNamespace: SERVICE_NAMESPACE
+#     secretType: Opaque

infisical/universal-auth-secret.yaml

@@ -0,0 +1,9 @@
+# apiVersion: v1
+# kind: Secret
+# metadata:
+#   name: infisical-universal-auth
+#   namespace: infisical
+# type: Opaque
+# stringData:
+#   clientId: ""
+#   clientSecret: ""