jellyfin: upgrade to 12.0

All five installed plugins have 12.0.0.0 targetAbi builds available. The
archived 9p4 SSO Authentication plugin has been removed, since it has no
v12 build and is being replaced by an OIDC plugin later.

Plugins must be updated from the Jellyfin dashboard after the rollout;
the container upgrade does not touch /config/plugins.

README.md

@@ -35,6 +35,7 @@ The repository is split into three top-level areas. Within each, there is one di
 │   ├── minio-aistor/            # S3-compatible object storage
 │   ├── n8n/                     # Workflow automation
 │   ├── netbootxyz/              # Network boot service
+│   ├── netbox/                  # IPAM and DCIM source of truth
 │   ├── ollama/                  # Local LLM runner
 │   ├── openwebui/               # Web UI for AI models
 │   ├── outline/                 # Knowledge base / wiki
@@ -105,6 +106,7 @@ The repository is split into three top-level areas. Within each, there is one di
 - **Technitium**: DNS server with web interface
 - **Azure DDNS Python**: Dynamic DNS updater for Azure DNS
 - **NetbootXYZ**: Network boot service for OS installation
+- **NetBox**: IPAM and DCIM source of truth for the network
 - **VictoriaMetrics**: Metrics collection and monitoring stack
 
 ### External Service Integration

applications/authentik/authentik-namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: authentik

applications/authentik/ldap/deployment.yaml

@@ -0,0 +1,46 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: authentik-ldap
+  namespace: authentik
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: authentik-ldap
+  template:
+    metadata:
+      labels:
+        app: authentik-ldap
+    spec:
+      containers:
+        - name: ldap
+          image: ghcr.io/goauthentik/ldap:2026.8.0
+          ports:
+            - containerPort: 3389
+              name: ldap
+            - containerPort: 6636
+              name: ldaps
+            - containerPort: 9300
+              name: metrics
+          envFrom:
+            - secretRef:
+                name: authentik-ldap-secrets
+          livenessProbe:
+            httpGet:
+              path: /outpost.goauthentik.io/ping
+              port: 9300
+            initialDelaySeconds: 10
+            periodSeconds: 30
+          readinessProbe:
+            httpGet:
+              path: /outpost.goauthentik.io/ping
+              port: 9300
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          resources:
+            requests:
+              cpu: 50m
+              memory: 128Mi
+            limits:
+              memory: 256Mi

applications/authentik/ldap/infisicalsecret.yaml

@@ -1,14 +1,14 @@
 apiVersion: secrets.infisical.com/v1alpha1
 kind: InfisicalSecret
 metadata:
-  name: authentik-secrets
+  name: authentik-ldap-secrets
   namespace: infisical
 spec:
   hostAPI: https://infisical.jsme.be
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical
@@ -16,9 +16,9 @@ spec:
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
-        secretsPath: "/authentik"
-        recursive: true
+        secretsPath: "/authentik/authentik-ldap"
+        recursive: false
   managedSecretReference:
-    secretName: authentik-secrets
+    secretName: authentik-ldap-secrets
     secretNamespace: authentik
     secretType: Opaque

applications/authentik/ldap/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: authentik-ldap
+  namespace: authentik
+spec:
+  selector:
+    app: authentik-ldap
+  ports:
+    - name: ldap
+      port: 3389
+      targetPort: 3389
+    - name: metrics
+      port: 9300
+      targetPort: 9300

applications/authentik/ldap/tcproute.yaml

@@ -0,0 +1,25 @@
+apiVersion: gateway.networking.k8s.io/v1alpha2
+kind: TCPRoute
+metadata:
+  name: authentik-ldap
+  namespace: authentik
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-internal
+      namespace: envoy-gateway
+      sectionName: authentik-ldap
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-internal
+      namespace: envoy-gateway
+      sectionName: authentik-ldaps
+  rules:
+    # The gateway terminates TLS on 636, so both listeners hit the plaintext port
+    - backendRefs:
+        - name: authentik-ldap
+          port: 3389
+          kind: Service
+          group: ""
+          weight: 1

applications/authentik/postgres/authentik-postgres-statefulset.yaml

@@ -19,24 +19,9 @@ spec:
           image: postgres:16-alpine
           ports:
             - containerPort: 5432
-          env:
-            - name: POSTGRES_DB
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: db_name
-            - name: POSTGRES_USER
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: db_user
-            - name: POSTGRES_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: db_password
-            - name: PGDATA
-              value: /var/lib/postgresql/data/pgdata
+          envFrom:
+            - secretRef:
+                name: authentik-postgres-secrets
           volumeMounts:
             - name: data
               mountPath: /var/lib/postgresql/data

applications/authentik/postgres/infisicalsecret.yaml

@@ -0,0 +1,25 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: authentik-postgres-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/authentik/postgres"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
+  managedSecretReference:
+    secretName: authentik-postgres-secrets
+    secretNamespace: authentik
+    secretType: Opaque

applications/authentik/server/authentik-server-deployment.yaml

@@ -17,7 +17,7 @@ spec:
     spec:
       containers:
         - name: authentik
-          image: ghcr.io/goauthentik/server:2026.5.2
+          image: ghcr.io/goauthentik/server:2026.8.0
           command: ["ak"]
           args: ["server"]
           ports:
@@ -25,62 +25,9 @@ spec:
               name: http
             - containerPort: 9443
               name: https
-          env:
-            - name: AUTHENTIK_POSTGRESQL__HOST
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: db_host
-            - name: AUTHENTIK_POSTGRESQL__NAME
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: db_name
-            - name: AUTHENTIK_POSTGRESQL__USER
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: db_user
-            - name: AUTHENTIK_POSTGRESQL__PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: db_password
-            - name: AUTHENTIK_SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: AUTHENTIK_SECRET_KEY
-            - name: AUTHENTIK_EMAIL__HOST
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: email_host
-            - name: AUTHENTIK_EMAIL__PORT
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: email_port
-            - name: AUTHENTIK_EMAIL__USERNAME
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: email_username
-            - name: AUTHENTIK_EMAIL__PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: email_password
-            - name: AUTHENTIK_EMAIL__FROM
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: email_from
-            - name: AUTHENTIK_EMAIL__USE_TLS
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: email_use_tls
+          envFrom:
+            - secretRef:
+                name: authentik-app-secrets
           volumeMounts:
             - name: data
               mountPath: /data

applications/authentik/server/infisicalsecret.yaml

@@ -0,0 +1,25 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: authentik-app-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/authentik/authentik"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
+  managedSecretReference:
+    secretName: authentik-app-secrets
+    secretNamespace: authentik
+    secretType: Opaque

applications/authentik/worker/authentik-worker-deployment.yaml

@@ -19,65 +19,12 @@ spec:
         runAsUser: 0
       containers:
         - name: authentik
-          image: ghcr.io/goauthentik/server:2026.5.2
+          image: ghcr.io/goauthentik/server:2026.8.0
           command: ["ak"]
           args: ["worker"]
-          env:
-            - name: AUTHENTIK_POSTGRESQL__HOST
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: db_host
-            - name: AUTHENTIK_POSTGRESQL__NAME
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: db_name
-            - name: AUTHENTIK_POSTGRESQL__USER
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: db_user
-            - name: AUTHENTIK_POSTGRESQL__PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: db_password
-            - name: AUTHENTIK_SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: AUTHENTIK_SECRET_KEY
-            - name: AUTHENTIK_EMAIL__HOST
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: email_host
-            - name: AUTHENTIK_EMAIL__PORT
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: email_port
-            - name: AUTHENTIK_EMAIL__USERNAME
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: email_username
-            - name: AUTHENTIK_EMAIL__PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: email_password
-            - name: AUTHENTIK_EMAIL__FROM
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: email_from
-            - name: AUTHENTIK_EMAIL__USE_TLS
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: email_use_tls
+          envFrom:
+            - secretRef:
+                name: authentik-app-secrets
           volumeMounts:
             - name: data
               mountPath: /data

applications/azure-ddns-python/azure-ddns-namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: azure-ddns

applications/azure-ddns-python/azure-ddns-statefulset.yaml

@@ -1,69 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: azure-ddns
-  namespace: azure-ddns
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: azure-ddns
-  serviceName: azure-ddns
-  template:
-    metadata:
-      labels:
-        app: azure-ddns
-    spec:
-      terminationGracePeriodSeconds: 60
-      containers:
-        - name: azure-ddns
-          image: gitea.jsme.be/jeffrey/azure-ddns-python:1.1
-          resources:
-            requests:
-              cpu: 50m
-              memory: 128Mi
-            limits:
-              cpu: 200m
-              memory: 256Mi
-          env:
-            - name: AZURE_TENANT_ID
-              valueFrom:
-                secretKeyRef:
-                  name: azure-ddns-secrets
-                  key: TENANT_ID
-            - name: AZURE_CLIENT_ID
-              valueFrom:
-                secretKeyRef:
-                  name: azure-ddns-secrets
-                  key: CLIENT_ID
-            - name: AZURE_CLIENT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: azure-ddns-secrets
-                  key: CLIENT_SECRET
-            - name: AZURE_SUBSCRIPTION_ID
-              valueFrom:
-                secretKeyRef:
-                  name: azure-ddns-secrets
-                  key: SUBSCRIPTION_ID
-            - name: AZURE_RESOURCE_GROUP
-              valueFrom:
-                secretKeyRef:
-                  name: azure-ddns-secrets
-                  key: RESOURCE_GROUP
-            - name: AZURE_ZONE_NAME
-              valueFrom:
-                secretKeyRef:
-                  name: azure-ddns-secrets
-                  key: AZURE_ZONE_NAME
-            - name: GOTIFY_URL
-              valueFrom:
-                secretKeyRef:
-                  name: azure-ddns-secrets
-                  key: GOTIFY_URL
-            - name: GOTIFY_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: azure-ddns-secrets
-                  key: GOTIFY_TOKEN
-      restartPolicy: Always

applications/azure-ddns-python/azure-ddns/infisicalsecret.yaml

@@ -1,14 +1,14 @@
 apiVersion: secrets.infisical.com/v1alpha1
 kind: InfisicalSecret
 metadata:
-  name: azure-ddns-secrets
+  name: azure-ddns-app-secrets
   namespace: infisical
 spec:
   hostAPI: https://infisical.jsme.be
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical
@@ -16,9 +16,10 @@ spec:
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
-        secretsPath: "/azure-ddns"
-        recursive: true
+        secretsPath: "/azure-ddns/azure-ddns"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
   managedSecretReference:
-    secretName: azure-ddns-secrets
+    secretName: azure-ddns-app-secrets
     secretNamespace: azure-ddns
     secretType: Opaque

applications/azure-ddns-python/azure-ddns/statefulset.yaml

@@ -0,0 +1,31 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: azure-ddns
+  namespace: azure-ddns
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: azure-ddns
+  serviceName: azure-ddns
+  template:
+    metadata:
+      labels:
+        app: azure-ddns
+    spec:
+      terminationGracePeriodSeconds: 60
+      containers:
+        - name: azure-ddns
+          image: gitea.jsme.be/jeffrey/azure-ddns-python:1.1
+          resources:
+            requests:
+              cpu: 50m
+              memory: 128Mi
+            limits:
+              cpu: 200m
+              memory: 256Mi
+          envFrom:
+            - secretRef:
+                name: azure-ddns-app-secrets
+      restartPolicy: Always

applications/bentopdf/bentopdf-deployment.yaml

@@ -17,7 +17,7 @@ spec:
       terminationGracePeriodSeconds: 10
       containers:
           - name: bentopdf
-            image: ghcr.io/alam00000/bentopdf:v2.8.2-amd64
+            image: ghcr.io/alam00000/bentopdf:v2.8.7-amd64
             resources:
               requests:
                 cpu: 50m

applications/bentopdf/bentopdf-namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: bentopdf

applications/excalidraw/excalidraw-namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: excalidraw

applications/gitea/gitea/gitea-statefulset.yaml

@@ -17,7 +17,7 @@ spec:
       terminationGracePeriodSeconds: 60
       containers:
         - name: gitea
-          image: docker.gitea.com/gitea:1.25
+          image: docker.gitea.com/gitea:1.27.2
           resources:
             requests:
               cpu: 200m
@@ -31,37 +31,9 @@ spec:
             - name: data
               mountPath: /data
               subPath: Gitea
-          env:
-            - name: GITEA__database__HOST
-              valueFrom:
-                secretKeyRef:
-                  name: gitea-secrets
-                  key: db_host
-            - name: GITEA__database__DB_TYPE
-              valueFrom:
-                secretKeyRef:
-                  name: gitea-secrets
-                  key: db_type
-            - name: GITEA__database__NAME
-              valueFrom:
-                secretKeyRef:
-                  name: gitea-secrets
-                  key: db_name
-            - name: GITEA__database__USER
-              valueFrom:
-                secretKeyRef:
-                  name: gitea-secrets
-                  key: db_user
-            - name: GITEA__database__PASSWD
-              valueFrom:
-                secretKeyRef:
-                  name: gitea-secrets
-                  key: db_password
-            - name: USER
-              valueFrom:
-                secretKeyRef:
-                  name: gitea-secrets
-                  key: gitea_user
+          envFrom:
+            - secretRef:
+                name: gitea-app-secrets
       restartPolicy: Always
       volumes: 
         - name: data  

applications/gitea/gitea/infisicalsecret.yaml

@@ -0,0 +1,25 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: gitea-app-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/gitea/gitea"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
+  managedSecretReference:
+    secretName: gitea-app-secrets
+    secretNamespace: gitea
+    secretType: Opaque

applications/gitea/postgres/gitea-postgres-statefulset.yaml

@@ -31,24 +31,9 @@ spec:
           volumeMounts:
             - name: gitea-postgresql-database
               mountPath: /var/lib/postgresql/volumes/pgdata
-          env:
-            - name: POSTGRES_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: gitea-secrets
-                  key: db_password
-            - name: POSTGRES_USER
-              valueFrom:
-                secretKeyRef:
-                  name: gitea-secrets
-                  key: db_user
-            - name: POSTGRES_DB
-              valueFrom:
-                secretKeyRef:
-                  name: gitea-secrets
-                  key: db_name
-            - name: PGDATA
-              value: /var/lib/postgresql/volumes/pgdata/data
+          envFrom:
+            - secretRef:
+                name: gitea-postgres-secrets
       volumes:
         - name: gitea-postgresql-database
           persistentVolumeClaim:

applications/gitea/postgres/infisicalsecret.yaml

@@ -0,0 +1,25 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: gitea-postgres-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/gitea/postgres"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
+  managedSecretReference:
+    secretName: gitea-postgres-secrets
+    secretNamespace: gitea
+    secretType: Opaque

applications/gitea/runner/values.yaml

@@ -144,7 +144,7 @@ init:
   image:
     repository: busybox
     # Overrides the image tag whose default is the chart appVersion.
-    tag: "1.37.0"
+    tag: "1.38.0"
 
 ## Specify an existing token secret
 ##

applications/gotify/gotify-namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: gotify

applications/gotify/gotify-statefulset.yaml

@@ -1,63 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: gotify
-  namespace: gotify
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: gotify
-  serviceName: gotify
-  template:
-    metadata:
-      labels:
-        app: gotify
-    spec:
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 10
-      containers:
-        - name: gotify
-          image: gotify/server:2.9.1
-          resources:
-            requests:
-              cpu: 50m
-              memory: 128Mi
-            limits:
-              cpu: 200m
-              memory: 256Mi
-          ports:
-            - containerPort: 80
-              name: http
-          env:
-            - name: GOTIFY_DEFAULTUSER_PASS
-              valueFrom:
-                secretKeyRef:
-                  name: gotify-secrets
-                  key: default_user_pass
-            - name: GOTIFY_DATABASE_DIALECT
-              value: postgres
-            - name: DB_USER
-              valueFrom:
-                secretKeyRef:
-                  name: gotify-secrets
-                  key: db_user
-            - name: DB_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: gotify-secrets
-                  key: db_password
-            - name: DB_NAME
-              valueFrom:
-                secretKeyRef:
-                  name: gotify-secrets
-                  key: db_name
-            - name: GOTIFY_DATABASE_CONNECTION
-              value: "host=gotify-postgresql port=5432 user=$(DB_USER) dbname=$(DB_NAME) password=$(DB_PASSWORD) sslmode=disable"
-          volumeMounts:
-            - name: data
-              mountPath: /app/data
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: gotify-data-pvc

applications/gotify/gotify/infisicalsecret.yaml

@@ -1,14 +1,14 @@
 apiVersion: secrets.infisical.com/v1alpha1
 kind: InfisicalSecret
 metadata:
-  name: gotify-secrets
+  name: gotify-app-secrets
   namespace: infisical
 spec:
   hostAPI: https://infisical.jsme.be
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical
@@ -16,9 +16,10 @@ spec:
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
-        secretsPath: "/gotify"
-        recursive: true
+        secretsPath: "/gotify/gotify"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
   managedSecretReference:
-    secretName: gotify-secrets
+    secretName: gotify-app-secrets
     secretNamespace: gotify
     secretType: Opaque

applications/gotify/gotify/statefulset.yaml

@@ -0,0 +1,41 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: gotify
+  namespace: gotify
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: gotify
+  serviceName: gotify
+  template:
+    metadata:
+      labels:
+        app: gotify
+    spec:
+      restartPolicy: Always
+      terminationGracePeriodSeconds: 10
+      containers:
+        - name: gotify
+          image: gotify/server:3.0.0
+          resources:
+            requests:
+              cpu: 50m
+              memory: 128Mi
+            limits:
+              cpu: 200m
+              memory: 256Mi
+          ports:
+            - containerPort: 80
+              name: http
+          envFrom:
+            - secretRef:
+                name: gotify-app-secrets
+          volumeMounts:
+            - name: data
+              mountPath: /app/data
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: gotify-data-pvc

applications/gotify/postgres/gotify-postgres-statefulset.yaml

@@ -31,24 +31,9 @@ spec:
           volumeMounts:
             - name: gotify-postgresql-database
               mountPath: /var/lib/postgresql/pgdata
-          env:
-            - name: PGDATA
-              value: /var/lib/postgresql/pgdata/data
-            - name: POSTGRES_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: gotify-secrets
-                  key: db_password
-            - name: POSTGRES_USER
-              valueFrom:
-                secretKeyRef:
-                  name: gotify-secrets
-                  key: db_user
-            - name: POSTGRES_DB
-              valueFrom:
-                secretKeyRef:
-                  name: gotify-secrets
-                  key: db_name
+          envFrom:
+            - secretRef:
+                name: gotify-postgres-secrets
       volumes:
         - name: gotify-postgresql-database
           persistentVolumeClaim:

applications/gotify/postgres/infisicalsecret.yaml

@@ -0,0 +1,25 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: gotify-postgres-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/gotify/postgres"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
+  managedSecretReference:
+    secretName: gotify-postgres-secrets
+    secretNamespace: gotify
+    secretType: Opaque

applications/immich/immich-namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: immich

applications/immich/immich/immich-statefulset.yaml

@@ -18,7 +18,7 @@ spec:
       terminationGracePeriodSeconds: 60
       containers:
       - name: immich
-        image: ghcr.io/immich-app/immich-server:v2.7.5
+        image: ghcr.io/immich-app/immich-server:v3.1.0
         resources:
           requests:
             memory: "256Mi"
@@ -28,30 +28,9 @@ spec:
             cpu: "2000m"
         ports:
         - containerPort: 2283
-        env:
-        - name: TZ
-          value: "Europe/Brussels"
-        - name: DB_HOSTNAME
-          value: "immich-postgresql.immich.svc.cluster.local"
-        - name: DB_DATABASE_NAME
-          valueFrom:
-            secretKeyRef:
-              name: immich-secrets
-              key: db_name
-        - name: DB_USERNAME
-          valueFrom:
-            secretKeyRef:
-              name: immich-secrets
-              key: db_user
-        - name: DB_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: immich-secrets
-              key: db_password
-        - name: REDIS_HOSTNAME
-          value: "valkey.immich.svc.cluster.local"
-        - name: IMMICH_PORT
-          value: "2283"
+        envFrom:
+        - secretRef:
+            name: immich-app-secrets
         volumeMounts:
         - name: photos
           mountPath: /data

applications/immich/immich/infisicalsecret.yaml

@@ -0,0 +1,25 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: immich-app-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/immich/immich"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
+  managedSecretReference:
+    secretName: immich-app-secrets
+    secretNamespace: immich
+    secretType: Opaque

applications/immich/postgres/immich-postgres-statefulset.yaml

@@ -31,24 +31,9 @@ spec:
           volumeMounts:
             - name: immich-postgresql-immich
               mountPath: /var/lib/postgres
-          env:
-            - name: POSTGRES_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: immich-secrets
-                  key: db_password
-            - name: POSTGRES_USER
-              valueFrom:
-                secretKeyRef:
-                  name: immich-secrets
-                  key: db_user
-            - name: POSTGRES_DB
-              valueFrom:
-                secretKeyRef:
-                  name: immich-secrets
-                  key: db_name
-            - name: PGDATA
-              value: /var/lib/postgres/data
+          envFrom:
+            - secretRef:
+                name: immich-postgres-secrets
       volumes:
         - name: immich-postgresql-immich
           persistentVolumeClaim:

applications/immich/postgres/infisicalsecret.yaml

@@ -0,0 +1,25 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: immich-postgres-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/immich/postgres"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
+  managedSecretReference:
+    secretName: immich-postgres-secrets
+    secretNamespace: immich
+    secretType: Opaque

applications/infisical/Infisical-secrets/affine-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/crowdsec-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/gitea-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical
@@ -17,7 +17,9 @@ spec:
         projectSlug: "kubernetes"
         envSlug: "prod"
         secretsPath: "/gitea"
-        recursive: true
+        # Root only: /gitea holds the SMB mount credentials and the Actions runner token.
+        # Per-container env lives in subfolders.
+        recursive: false
   managedSecretReference:
     secretName: gitea-secrets
     secretNamespace: gitea

applications/infisical/Infisical-secrets/immich-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical
@@ -17,7 +17,9 @@ spec:
         projectSlug: "kubernetes"
         envSlug: "prod"
         secretsPath: "/immich"
-        recursive: true
+        # Root only: /immich holds the SMB mount credentials (username, password)
+        # consumed by immich-data-smb. Per-container env lives in subfolders.
+        recursive: false
   managedSecretReference:
     secretName: immich-secrets
     secretNamespace: immich

applications/infisical/Infisical-secrets/jellyfin-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/longhorn-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/minecraft-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/n8n-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/netbootxyz-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/openwebui-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/vaultwarden-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/victoria-metrics-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/zipline-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical
@@ -17,7 +17,9 @@ spec:
         projectSlug: "kubernetes"
         envSlug: "prod"
         secretsPath: "/zipline"
-        recursive: true
+        # Root only: /zipline holds the SMB mount credentials (username, password)
+        # consumed by zipline-uploads-pv. Per-container env lives in subfolders.
+        recursive: false
   managedSecretReference:
     secretName: zipline-secrets
     secretNamespace: zipline

applications/infisical/postgres/statefulset.yaml

@@ -53,6 +53,12 @@ spec:
               command: ["sh", "-c", "pg_isready -U $POSTGRES_USER -d $POSTGRES_DB"]
             initialDelaySeconds: 30
             periodSeconds: 15
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              memory: 512Mi
   volumeClaimTemplates:
     - metadata:
         name: data

applications/infisical/serviceaccounts.yaml

@@ -0,0 +1,63 @@
+# Kubernetes-native auth for the InfisicalSecret operator.
+# infisical-auth: the identity the CRDs mint short-lived tokens for.
+# infisical-token-reviewer: its JWT is pasted into Infisical's Kubernetes Auth
+# config so Infisical can call TokenReview. Bound to system:auth-delegator below.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: infisical-auth
+  namespace: infisical
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: infisical-token-reviewer
+  namespace: infisical
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: infisical-token-reviewer
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:auth-delegator
+subjects:
+  - kind: ServiceAccount
+    name: infisical-token-reviewer
+    namespace: infisical
+---
+# The operator needs to mint tokens for infisical-auth; without this it falls
+# back to the legacy SA .secrets[] lookup and never gets a token.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: infisical-operator-token-creator
+rules:
+  - apiGroups: [""]
+    resources: ["serviceaccounts/token"]
+    verbs: ["create"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: infisical-operator-token-creator
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: infisical-operator-token-creator
+subjects:
+  - kind: ServiceAccount
+    name: infisical-opera-controller-manager
+    namespace: infisical-operator
+---
+# Long-lived token for the reviewer SA. `kubectl create token` expires; the
+# value pasted into Infisical's Kubernetes Auth config must not.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: infisical-token-reviewer
+  namespace: infisical
+  annotations:
+    kubernetes.io/service-account.name: infisical-token-reviewer
+type: kubernetes.io/service-account-token

applications/infisical/valkey/statefulset.yaml

@@ -29,6 +29,12 @@ spec:
               command: ["valkey-cli", "ping"]
             initialDelaySeconds: 5
             periodSeconds: 10
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              memory: 256Mi
   volumeClaimTemplates:
     - metadata:
         name: data

applications/it-tools/it-tools-namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: it-tools

applications/jellyfin/jellyfin-namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: jellyfin

applications/jellyfin/jellyfin-statefulset.yaml

@@ -20,7 +20,7 @@ spec:
         gpu: "true"
       containers:
       - name: jellyfin
-        image: jellyfin/jellyfin:10.11.9
+        image: jellyfin/jellyfin:12.0
         ports:
         - containerPort: 8096
         resources:

applications/minio-aistor/minio-aistor-namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: minio-aistor

applications/netbootxyz/netbootxyz-namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: netbootxyz

applications/netbootxyz/netbootxyz-statefulset.yaml

@@ -18,7 +18,7 @@ spec:
       terminationGracePeriodSeconds: 10
       containers:
         - name: netbootxyz
-          image: netbootxyz/netbootxyz:0.7.6-nbxyz18
+          image: netbootxyz/netbootxyz:0.7.6-nbxyz24
           resources:
             requests:
               cpu: 100m

applications/netbox/housekeeping/cronjob.yaml

@@ -0,0 +1,37 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  namespace: netbox
+  name: netbox-housekeeping
+spec:
+  schedule: "15 3 * * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      backoffLimit: 2
+      template:
+        spec:
+          restartPolicy: OnFailure
+          securityContext:
+            runAsUser: 999
+            runAsGroup: 0
+            fsGroup: 0
+          containers:
+            - name: netbox-housekeeping
+              image: netboxcommunity/netbox:v4.6.8-5.0.2
+              args:
+                - /opt/netbox/venv/bin/python
+                - /opt/netbox/netbox/manage.py
+                - housekeeping
+              resources:
+                requests:
+                  memory: "128Mi"
+                  cpu: "50m"
+                limits:
+                  memory: "512Mi"
+                  cpu: "500m"
+              envFrom:
+                - secretRef:
+                    name: netbox-app-secrets

applications/netbox/netbox-httproute.yaml

@@ -0,0 +1,46 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: netbox-route
+  namespace: netbox
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-internal
+      namespace: envoy-gateway
+      sectionName: netbox
+  hostnames:
+    - "netbox.jsme.be"
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      filters:
+        - type: RequestHeaderModifier
+          requestHeaderModifier:
+            set:
+              - name: X-Forwarded-Host
+                value: "netbox.jsme.be"
+              - name: X-Forwarded-Proto
+                value: https
+        - type: ResponseHeaderModifier
+          responseHeaderModifier:
+            set:
+              - name: Strict-Transport-Security
+                value: "max-age=31536000; includeSubDomains"
+              - name: X-Content-Type-Options
+                value: nosniff
+              - name: X-Frame-Options
+                value: SAMEORIGIN
+              - name: Referrer-Policy
+                value: strict-origin-when-cross-origin
+              - name: Permissions-Policy
+                value: "camera=(), microphone=(), geolocation=(), payment=()"
+      backendRefs:
+        - name: netbox
+          port: 8080
+          kind: Service
+          group: ""
+          weight: 1

applications/netbox/netbox-namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: netbox

applications/netbox/netbox/deployment.yaml

@@ -0,0 +1,82 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  namespace: netbox
+  name: netbox
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: netbox
+  template:
+    metadata:
+      labels:
+        app: netbox
+    spec:
+      restartPolicy: Always
+      terminationGracePeriodSeconds: 60
+      securityContext:
+        runAsUser: 999
+        runAsGroup: 0
+        fsGroup: 0
+      containers:
+        - name: netbox
+          image: netboxcommunity/netbox:v4.6.8-5.0.2
+          resources:
+            requests:
+              memory: "512Mi"
+              cpu: "250m"
+            limits:
+              memory: "2Gi"
+              cpu: "2000m"
+          ports:
+            - containerPort: 8080
+          envFrom:
+            - secretRef:
+                name: netbox-app-secrets
+          volumeMounts:
+            - name: netbox-data
+              mountPath: /opt/netbox/netbox/media
+              subPath: media
+            - name: netbox-data
+              mountPath: /opt/netbox/netbox/reports
+              subPath: reports
+            - name: netbox-data
+              mountPath: /opt/netbox/netbox/scripts
+              subPath: scripts
+          startupProbe:
+            httpGet:
+              path: /login/
+              port: 8080
+              # Django rejects the pod IP as a Host header (ALLOWED_HOSTS).
+              httpHeaders:
+                - name: Host
+                  value: netbox.jsme.be
+            periodSeconds: 10
+            # Generous: the entrypoint runs migrations before granian binds.
+            failureThreshold: 60
+          readinessProbe:
+            httpGet:
+              path: /login/
+              port: 8080
+              # Django rejects the pod IP as a Host header (ALLOWED_HOSTS).
+              httpHeaders:
+                - name: Host
+                  value: netbox.jsme.be
+            periodSeconds: 15
+          livenessProbe:
+            httpGet:
+              path: /login/
+              port: 8080
+              # Django rejects the pod IP as a Host header (ALLOWED_HOSTS).
+              httpHeaders:
+                - name: Host
+                  value: netbox.jsme.be
+            periodSeconds: 30
+            failureThreshold: 5
+      volumes:
+        - name: netbox-data
+          persistentVolumeClaim:
+            claimName: netbox-data-pvc

applications/netbox/netbox/infisicalsecret.yaml

@@ -0,0 +1,25 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: netbox-app-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/netbox/netbox"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
+  managedSecretReference:
+    secretName: netbox-app-secrets
+    secretNamespace: netbox
+    secretType: Opaque

applications/netbox/netbox/persistentvolumeclaim.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  namespace: netbox
+  name: netbox-data-pvc
+spec:
+  # RWX: shared by the web pod and the rqworker pod.
+  accessModes:
+    - ReadWriteMany
+  storageClassName: longhorn-static
+  resources:
+    requests:
+      storage: 5Gi

applications/netbox/netbox/service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  namespace: netbox
+  name: netbox
+spec:
+  selector:
+    app: netbox
+  ports:
+    - protocol: TCP
+      port: 8080
+      targetPort: 8080
+  type: ClusterIP

applications/netbox/postgres/infisicalsecret.yaml

@@ -0,0 +1,25 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: netbox-postgres-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/netbox/postgres"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
+  managedSecretReference:
+    secretName: netbox-postgres-secrets
+    secretNamespace: netbox
+    secretType: Opaque

applications/netbox/postgres/persistentvolumeclaim.yaml

@@ -1,13 +1,12 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: gitea-runner-pvc
-  namespace: gitea
+  namespace: netbox
+  name: netbox-postgres-pvc
 spec:
   accessModes:
     - ReadWriteOnce
   storageClassName: longhorn-static
-  volumeName: gitea-runner-data
   resources:
     requests:
-      storage: 20Gi
+      storage: 10Gi

applications/netbox/postgres/service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: netbox-postgres
+  namespace: netbox
+spec:
+  selector:
+    app: netbox-postgres
+  type: ClusterIP
+  ports:
+    - name: netbox-postgres-port
+      protocol: TCP
+      port: 5432
+      targetPort: 5432

applications/netbox/postgres/statefulset.yaml

@@ -0,0 +1,45 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  namespace: netbox
+  name: netbox-postgres
+spec:
+  replicas: 1
+  serviceName: netbox-postgres
+  selector:
+    matchLabels:
+      app: netbox-postgres
+  template:
+    metadata:
+      labels:
+        app: netbox-postgres
+    spec:
+      restartPolicy: Always
+      terminationGracePeriodSeconds: 60
+      containers:
+        - name: netbox-postgres
+          image: postgres:18
+          resources:
+            requests:
+              memory: "256Mi"
+              cpu: "100m"
+            limits:
+              memory: "1Gi"
+              cpu: "1000m"
+          ports:
+            - containerPort: 5432
+          volumeMounts:
+            - name: netbox-postgres-data
+              mountPath: /var/lib/postgresql/data
+          envFrom:
+            - secretRef:
+                name: netbox-postgres-secrets
+          readinessProbe:
+            exec:
+              command: ["sh", "-c", "pg_isready -q -U \"$POSTGRES_USER\" -d \"$POSTGRES_DB\""]
+            initialDelaySeconds: 10
+            periodSeconds: 10
+      volumes:
+        - name: netbox-postgres-data
+          persistentVolumeClaim:
+            claimName: netbox-postgres-pvc

applications/netbox/redis-cache/deployment.yaml

@@ -0,0 +1,38 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  namespace: netbox
+  name: netbox-redis-cache
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: netbox-redis-cache
+  template:
+    metadata:
+      labels:
+        app: netbox-redis-cache
+    spec:
+      restartPolicy: Always
+      containers:
+        - name: netbox-redis-cache
+          image: valkey/valkey:9.1-alpine
+          # Cache only: no persistence, contents are disposable.
+          command: ["sh", "-c", "exec valkey-server --requirepass \"$REDIS_PASSWORD\""]
+          resources:
+            requests:
+              memory: "64Mi"
+              cpu: "50m"
+            limits:
+              memory: "256Mi"
+              cpu: "200m"
+          ports:
+            - containerPort: 6379
+          envFrom:
+            - secretRef:
+                name: netbox-redis-cache-secrets
+          readinessProbe:
+            exec:
+              command: ["sh", "-c", "valkey-cli --pass \"$REDIS_PASSWORD\" ping | grep -q PONG"]
+            initialDelaySeconds: 5
+            periodSeconds: 10

applications/netbox/redis-cache/infisicalsecret.yaml

@@ -0,0 +1,25 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: netbox-redis-cache-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/netbox/redis-cache"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
+  managedSecretReference:
+    secretName: netbox-redis-cache-secrets
+    secretNamespace: netbox
+    secretType: Opaque

applications/netbox/redis-cache/service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: netbox-redis-cache
+  namespace: netbox
+spec:
+  selector:
+    app: netbox-redis-cache
+  type: ClusterIP
+  ports:
+    - name: netbox-redis-cache-port
+      protocol: TCP
+      port: 6379
+      targetPort: 6379

applications/netbox/redis/infisicalsecret.yaml

@@ -0,0 +1,25 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: netbox-redis-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/netbox/redis"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
+  managedSecretReference:
+    secretName: netbox-redis-secrets
+    secretNamespace: netbox
+    secretType: Opaque

applications/netbox/redis/persistentvolumeclaim.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  namespace: netbox
+  name: netbox-redis-pvc
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn-static
+  resources:
+    requests:
+      storage: 1Gi

applications/netbox/redis/service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: netbox-redis
+  namespace: netbox
+spec:
+  selector:
+    app: netbox-redis
+  type: ClusterIP
+  ports:
+    - name: netbox-redis-port
+      protocol: TCP
+      port: 6379
+      targetPort: 6379

applications/netbox/redis/statefulset.yaml

@@ -0,0 +1,46 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  namespace: netbox
+  name: netbox-redis
+spec:
+  replicas: 1
+  serviceName: netbox-redis
+  selector:
+    matchLabels:
+      app: netbox-redis
+  template:
+    metadata:
+      labels:
+        app: netbox-redis
+    spec:
+      restartPolicy: Always
+      containers:
+        - name: netbox-redis
+          image: valkey/valkey:9.1-alpine
+          # Task queue: appendonly so queued background jobs survive a restart.
+          command: ["sh", "-c", "exec valkey-server --appendonly yes --requirepass \"$REDIS_PASSWORD\""]
+          resources:
+            requests:
+              memory: "64Mi"
+              cpu: "50m"
+            limits:
+              memory: "256Mi"
+              cpu: "200m"
+          ports:
+            - containerPort: 6379
+          envFrom:
+            - secretRef:
+                name: netbox-redis-secrets
+          volumeMounts:
+            - name: netbox-redis-data
+              mountPath: /data
+          readinessProbe:
+            exec:
+              command: ["sh", "-c", "valkey-cli --pass \"$REDIS_PASSWORD\" ping | grep -q PONG"]
+            initialDelaySeconds: 5
+            periodSeconds: 10
+      volumes:
+        - name: netbox-redis-data
+          persistentVolumeClaim:
+            claimName: netbox-redis-pvc

applications/netbox/worker/deployment.yaml

@@ -0,0 +1,54 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  namespace: netbox
+  name: netbox-worker
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: netbox-worker
+  template:
+    metadata:
+      labels:
+        app: netbox-worker
+    spec:
+      restartPolicy: Always
+      terminationGracePeriodSeconds: 60
+      securityContext:
+        runAsUser: 999
+        runAsGroup: 0
+        fsGroup: 0
+      containers:
+        - name: netbox-worker
+          image: netboxcommunity/netbox:v4.6.8-5.0.2
+          # Overrides CMD only, so tini stays the entrypoint and migrations
+          # are left to the web pod.
+          args:
+            - /opt/netbox/venv/bin/python
+            - /opt/netbox/netbox/manage.py
+            - rqworker
+          resources:
+            requests:
+              memory: "256Mi"
+              cpu: "100m"
+            limits:
+              memory: "1Gi"
+              cpu: "1000m"
+          envFrom:
+            - secretRef:
+                name: netbox-app-secrets
+          volumeMounts:
+            - name: netbox-data
+              mountPath: /opt/netbox/netbox/media
+              subPath: media
+            - name: netbox-data
+              mountPath: /opt/netbox/netbox/reports
+              subPath: reports
+            - name: netbox-data
+              mountPath: /opt/netbox/netbox/scripts
+              subPath: scripts
+      volumes:
+        - name: netbox-data
+          persistentVolumeClaim:
+            claimName: netbox-data-pvc

applications/outline/outline-namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: outline

applications/outline/outline/infisicalsecret.yaml

@@ -1,14 +1,14 @@
 apiVersion: secrets.infisical.com/v1alpha1
 kind: InfisicalSecret
 metadata:
-  name: outline-secrets
+  name: outline-app-secrets
   namespace: infisical
 spec:
   hostAPI: https://infisical.jsme.be
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical
@@ -16,9 +16,10 @@ spec:
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
-        secretsPath: "/outline"
-        recursive: true
+        secretsPath: "/outline/outline"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
   managedSecretReference:
-    secretName: outline-secrets
+    secretName: outline-app-secrets
     secretNamespace: outline
     secretType: Opaque

applications/outline/outline/outline-deployment.yaml

@@ -17,7 +17,7 @@ spec:
       terminationGracePeriodSeconds: 60
       containers:
         - name: outline
-          image: docker.getoutline.com/outlinewiki/outline:1.8.1
+          image: docker.getoutline.com/outlinewiki/outline:1.9.2
           resources:
             requests:
               memory: "512Mi"
@@ -27,92 +27,6 @@ spec:
               cpu: "2000m"
           ports:
             - containerPort: 3000
-          env:
-            - name: TZ
-              value: "Europe/Brussels"
-            - name: NODE_ENV
-              value: "production"
-            - name: URL
-              value: "https://outline.jsme.be"
-            - name: PORT
-              value: "3000"
-            # TLS is terminated at the gateway and X-Forwarded-Proto is set to
-            # https on the HTTPRoute, so Outline must not force an https redirect.
-            - name: FORCE_HTTPS
-              value: "false"
-
-            # --- Database (PostgreSQL) ---
-            - name: DATABASE_URL
-              valueFrom:
-                secretKeyRef:
-                  name: outline-secrets
-                  key: database_url
-            # In-cluster Postgres has no TLS; disable SSL on the connection.
-            - name: PGSSLMODE
-              value: "disable"
-
-            # --- Cache / queue (Redis-compatible Valkey) ---
-            - name: REDIS_URL
-              value: "redis://outline-redis.outline.svc.cluster.local:6379"
-
-            # --- Secrets ---
-            - name: SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: outline-secrets
-                  key: secret_key
-            - name: UTILS_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: outline-secrets
-                  key: utils_secret
-
-            # --- File storage (MinIO / S3) ---
-            - name: FILE_STORAGE
-              value: "s3"
-            - name: AWS_REGION
-              value: "us-east-1"
-            - name: AWS_S3_UPLOAD_BUCKET_URL
-              value: "https://s3.jsme.be"
-            - name: AWS_S3_UPLOAD_BUCKET_NAME
-              value: "outline"
-            - name: AWS_S3_FORCE_PATH_STYLE
-              value: "true"
-            - name: AWS_S3_ACL
-              value: "private"
-            - name: AWS_ACCESS_KEY_ID
-              valueFrom:
-                secretKeyRef:
-                  name: outline-secrets
-                  key: s3_access_key
-            - name: AWS_SECRET_ACCESS_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: outline-secrets
-                  key: s3_secret_key
-
-            # --- Authentication (Authentik OIDC) ---
-            - name: OIDC_DISPLAY_NAME
-              value: "Authentik"
-            - name: OIDC_AUTH_URI
-              value: "https://auth.jsme.be/application/o/authorize/"
-            - name: OIDC_TOKEN_URI
-              value: "https://auth.jsme.be/application/o/token/"
-            - name: OIDC_USERINFO_URI
-              value: "https://auth.jsme.be/application/o/userinfo/"
-            - name: OIDC_LOGOUT_URI
-              value: "https://auth.jsme.be/application/o/outline/end-session/"
-            - name: OIDC_USERNAME_CLAIM
-              value: "preferred_username"
-            - name: OIDC_SCOPES
-              value: "openid profile email"
-            - name: OIDC_CLIENT_ID
-              valueFrom:
-                secretKeyRef:
-                  name: outline-secrets
-                  key: oidc_client_id
-            - name: OIDC_CLIENT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: outline-secrets
-                  key: oidc_client_secret
+          envFrom:
+            - secretRef:
+                name: outline-app-secrets

applications/outline/postgres/infisicalsecret.yaml

@@ -0,0 +1,25 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: outline-postgres-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/outline/postgres"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
+  managedSecretReference:
+    secretName: outline-postgres-secrets
+    secretNamespace: outline
+    secretType: Opaque

applications/outline/postgres/outline-postgres-statefulset.yaml

@@ -31,24 +31,9 @@ spec:
           volumeMounts:
             - name: outline-postgres-data
               mountPath: /var/lib/postgresql/data
-          env:
-            - name: PGDATA
-              value: "/var/lib/postgresql/data/pgdata"
-            - name: POSTGRES_USER
-              valueFrom:
-                secretKeyRef:
-                  name: outline-secrets
-                  key: db_user
-            - name: POSTGRES_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: outline-secrets
-                  key: db_password
-            - name: POSTGRES_DB
-              valueFrom:
-                secretKeyRef:
-                  name: outline-secrets
-                  key: db_name
+          envFrom:
+            - secretRef:
+                name: outline-postgres-secrets
       volumes:
         - name: outline-postgres-data
           persistentVolumeClaim:

applications/passbolt/mariadb/infisicalsecret.yaml

@@ -0,0 +1,25 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: passbolt-mariadb-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/passbolt/mariadb"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
+  managedSecretReference:
+    secretName: passbolt-mariadb-secrets
+    secretNamespace: passbolt
+    secretType: Opaque

applications/passbolt/mariadb/passbolt-mariadb-statefulset.yaml

@@ -31,24 +31,9 @@ spec:
               mountPath: /var/lib/mysql
           ports:
             - containerPort: 3306 
-          env:
-            - name: MYSQL_RANDOM_ROOT_PASSWORD
-              value: "true"
-            - name: MYSQL_DATABASE
-              valueFrom:
-                secretKeyRef:
-                  name: passbolt-secrets
-                  key: db_name
-            - name: MYSQL_USER
-              valueFrom:
-                secretKeyRef:
-                  name: passbolt-secrets
-                  key: db_user
-            - name: MYSQL_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: passbolt-secrets
-                  key: db_password
+          envFrom:
+            - secretRef:
+                name: passbolt-mariadb-secrets
       volumes:
         - name: passbolt-mariadb-volume
           persistentVolumeClaim:

applications/passbolt/passbolt-namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: passbolt

applications/passbolt/passbolt/infisicalsecret.yaml

@@ -1,14 +1,14 @@
 apiVersion: secrets.infisical.com/v1alpha1
 kind: InfisicalSecret
 metadata:
-  name: passbolt-secrets
+  name: passbolt-app-secrets
   namespace: infisical
 spec:
   hostAPI: https://infisical.jsme.be
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical
@@ -16,9 +16,10 @@ spec:
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
-        secretsPath: "/passbolt"
-        recursive: true
+        secretsPath: "/passbolt/passbolt"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
   managedSecretReference:
-    secretName: passbolt-secrets
+    secretName: passbolt-app-secrets
     secretNamespace: passbolt
     secretType: Opaque

applications/passbolt/passbolt/passbolt-statefulset.yaml

@@ -36,60 +36,9 @@ spec:
               subPath: passbolt-ssl.conf
           ports:
             - containerPort: 80
-          env:
-            - name: APP_FULL_BASE_URL
-              value: https://passbolt.jsme.be
-            - name: APP_DEFAULT_TIMEZONE
-              value: Europe/Brussels
-            - name: PASSBOLT_SECURITY_CSP
-              value: "default-src 'self'; script-src 'self' chrome-extension: moz-extension:; style-src 'self' 'unsafe-inline'; img-src 'self'; frame-src 'self' chrome-extension: moz-extension: https://*.duosecurity.com; connect-src 'self' chrome-extension: moz-extension:; worker-src 'self' chrome-extension: moz-extension:; frame-ancestors 'none'; form-action 'self' https://*.duosecurity.com"
-            - name: DATASOURCES_DEFAULT_PORT
-              valueFrom:
-                secretKeyRef:
-                  name: passbolt-secrets
-                  key: db_port
-            - name: DATASOURCES_DEFAULT_HOST
-              valueFrom:
-                secretKeyRef:
-                  name: passbolt-secrets
-                  key: db_host
-            - name: DATASOURCES_DEFAULT_USERNAME
-              valueFrom:
-                secretKeyRef:
-                  name: passbolt-secrets
-                  key: db_user
-            - name: DATASOURCES_DEFAULT_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: passbolt-secrets
-                  key: db_password
-            - name: DATASOURCES_DEFAULT_DATABASE
-              valueFrom:
-                secretKeyRef:
-                  name: passbolt-secrets
-                  key: db_name
-            - name: EMAIL_DEFAULT_FROM
-              value: passbolt@jsme.be
-            - name: EMAIL_TRANSPORT_DEFAULT_HOST
-              value: smtp.office365.com
-            - name: EMAIL_TRANSPORT_DEFAULT_PORT
-              value: "587"
-            - name: EMAIL_TRANSPORT_DEFAULT_USERNAME
-              valueFrom:
-                secretKeyRef:
-                  name: passbolt-secrets
-                  key: smtp_username
-            - name: EMAIL_TRANSPORT_DEFAULT_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: passbolt-secrets
-                  key: smtp_password
-            - name: EMAIL_TRANSPORT_DEFAULT_TLS
-              value: "true"
-            - name: PASSBOLT_KEY_EMAIL
-              value: passbolt@jsme.be
-            - name: PASSBOLT_GPG_SERVER_KEY_FINGERPRINT_FORCE
-              value: "true"
+          envFrom:
+            - secretRef:
+                name: passbolt-app-secrets
       volumes:
         - name: gpg-volume
           persistentVolumeClaim:

applications/pelican/pelican-configmap.yaml

@@ -1,20 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: pelican-config
-  namespace: pelican
-data:
-  APP_NAME: Pelican
-  APP_URL: https://pelican.jsme.be
-  BEHIND_PROXY: "true"
-  ADMIN_EMAIL: jeffreysmeets@jsme.be
-  DB_CONNECTION: pgsql
-  DB_HOST: pelican-postgres
-  DB_PORT: "5432"
-  CACHE_STORE: redis
-  QUEUE_CONNECTION: redis
-  SESSION_DRIVER: redis
-  REDIS_HOST: pelican-redis
-  REDIS_PORT: "6379"
-  XDG_DATA_HOME: /pelican-data
-  AWS_USE_PATH_STYLE_ENDPOINT: "true"

applications/pelican/pelican-httproute.yaml

@@ -10,6 +10,11 @@ spec:
       name: gateway-internal
       namespace: envoy-gateway
       sectionName: pelican
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-public
+      namespace: envoy-gateway
+      sectionName: pelican
   hostnames:
     - "pelican.jsme.be"
   rules:
@@ -39,7 +44,7 @@ spec:
               - name: Permissions-Policy
                 value: "camera=(), microphone=(), geolocation=(), payment=()"
               - name: Content-Security-Policy
-                value: "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com; img-src 'self' data: blob: https://gravatar.com https://www.gravatar.com; font-src 'self' data: https://cdnjs.cloudflare.com; connect-src 'self' https://wings.jsme.be wss://wings.jsme.be ws: wss:; worker-src blob:; frame-ancestors 'self'"
+                value: "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdnjs.cloudflare.com; style-src 'self' 'unsafe-inline' https://cdnjs.cloudflare.com; img-src 'self' data: blob: https://gravatar.com https://www.gravatar.com; font-src 'self' data: https://cdnjs.cloudflare.com; connect-src 'self' https://wings-mc.jsme.be wss://wings-mc.jsme.be https://wings-ark.jsme.be wss://wings-ark.jsme.be ws: wss:; worker-src blob:; frame-ancestors 'self'"
       backendRefs:
         - name: pelican
           port: 80

applications/pelican/pelican-namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: pelican

applications/pelican/pelican-wings-ark-endpointslice.yaml

@@ -0,0 +1,18 @@
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: wings-ark
+  namespace: pelican
+  labels:
+    kubernetes.io/service-name: wings-ark
+addressType: IPv4
+ports:
+  - port: 8080
+    protocol: TCP
+endpoints:
+  - addresses:
+      - "10.8.11.51"
+    conditions:
+      ready: true
+      serving: true
+      terminating: false

applications/pelican/pelican-wings-ark-httproute.yaml

@@ -0,0 +1,30 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: wings-ark-route
+  namespace: pelican
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-internal
+      namespace: envoy-gateway
+      sectionName: wings-ark
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-public
+      namespace: envoy-gateway
+      sectionName: wings-ark
+  hostnames:
+    - "wings-ark.jsme.be"
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: wings-ark
+          port: 8080
+          kind: Service
+          group: ""
+          weight: 1

applications/pelican/pelican-wings-ark-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: wings-ark
+  namespace: pelican
+spec:
+  ports:
+    - protocol: TCP
+      port: 8080
+      targetPort: 8080
+  type: ClusterIP

applications/pelican/pelican-wings-mc-endpointslice.yaml

@@ -1,10 +1,10 @@
 apiVersion: discovery.k8s.io/v1
 kind: EndpointSlice
 metadata:
-  name: wings
+  name: wings-mc
   namespace: pelican
   labels:
-    kubernetes.io/service-name: wings
+    kubernetes.io/service-name: wings-mc
 addressType: IPv4
 ports:
   - port: 8080

applications/pelican/pelican-wings-mc-httproute.yaml

@@ -1,7 +1,7 @@
 apiVersion: gateway.networking.k8s.io/v1
 kind: HTTPRoute
 metadata:
-  name: wings-route
+  name: wings-mc-route
   namespace: pelican
 spec:
   parentRefs:
@@ -9,16 +9,21 @@ spec:
       kind: Gateway
       name: gateway-internal
       namespace: envoy-gateway
-      sectionName: wings
+      sectionName: wings-mc
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-public
+      namespace: envoy-gateway
+      sectionName: wings-mc
   hostnames:
-    - "wings.jsme.be"
+    - "wings-mc.jsme.be"
   rules:
     - matches:
         - path:
             type: PathPrefix
             value: /
       backendRefs:
-        - name: wings
+        - name: wings-mc
           port: 8080
           kind: Service
           group: ""

applications/pelican/pelican-wings-mc-service.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: wings
+  name: wings-mc
   namespace: pelican
 spec:
   ports:

applications/pelican/pelican/deployment.yaml

@@ -19,7 +19,8 @@ spec:
         fsGroup: 82
       containers:
         - name: pelican
-          image: ghcr.io/pelican-dev/panel:latest
+          image: ghcr.io/pelican/panel:v1.0.0-beta38
+          imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 80
           resources:
@@ -30,24 +31,8 @@ spec:
               cpu: 1000m
               memory: 1Gi
           envFrom:
-            - configMapRef:
-                name: pelican-config
-          env:
-            - name: DB_USERNAME
-              valueFrom:
-                secretKeyRef:
-                  name: pelican-secrets
-                  key: DB_USERNAME
-            - name: DB_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: pelican-secrets
-                  key: DB_PASSWORD
-            - name: DB_DATABASE
-              valueFrom:
-                secretKeyRef:
-                  name: pelican-secrets
-                  key: DB_DATABASE
+            - secretRef:
+                name: pelican-app-secrets
           volumeMounts:
             - name: pelican-data
               mountPath: /pelican-data

applications/pelican/pelican/infisicalsecret.yaml

@@ -1,14 +1,14 @@
 apiVersion: secrets.infisical.com/v1alpha1
 kind: InfisicalSecret
 metadata:
-  name: pelican-secrets
+  name: pelican-app-secrets
   namespace: infisical
 spec:
   hostAPI: https://infisical.jsme.be
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical
@@ -16,9 +16,10 @@ spec:
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
-        secretsPath: "/pelican"
-        recursive: true
+        secretsPath: "/pelican/pelican"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
   managedSecretReference:
-    secretName: pelican-secrets
+    secretName: pelican-app-secrets
     secretNamespace: pelican
     secretType: Opaque