jellyfin: upgrade to 12.0

All five installed plugins have 12.0.0.0 targetAbi builds available. The
archived 9p4 SSO Authentication plugin has been removed, since it has no
v12 build and is being replaced by an OIDC plugin later.

Plugins must be updated from the Jellyfin dashboard after the rollout;
the container upgrade does not touch /config/plugins.

README.md

@@ -35,6 +35,7 @@ The repository is split into three top-level areas. Within each, there is one di
 │   ├── minio-aistor/            # S3-compatible object storage
 │   ├── n8n/                     # Workflow automation
 │   ├── netbootxyz/              # Network boot service
+│   ├── netbox/                  # IPAM and DCIM source of truth
 │   ├── ollama/                  # Local LLM runner
 │   ├── openwebui/               # Web UI for AI models
 │   ├── outline/                 # Knowledge base / wiki
@@ -105,6 +106,7 @@ The repository is split into three top-level areas. Within each, there is one di
 - **Technitium**: DNS server with web interface
 - **Azure DDNS Python**: Dynamic DNS updater for Azure DNS
 - **NetbootXYZ**: Network boot service for OS installation
+- **NetBox**: IPAM and DCIM source of truth for the network
 - **VictoriaMetrics**: Metrics collection and monitoring stack
 
 ### External Service Integration

applications/authentik/ldap/deployment.yaml

@@ -0,0 +1,46 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: authentik-ldap
+  namespace: authentik
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: authentik-ldap
+  template:
+    metadata:
+      labels:
+        app: authentik-ldap
+    spec:
+      containers:
+        - name: ldap
+          image: ghcr.io/goauthentik/ldap:2026.8.0
+          ports:
+            - containerPort: 3389
+              name: ldap
+            - containerPort: 6636
+              name: ldaps
+            - containerPort: 9300
+              name: metrics
+          envFrom:
+            - secretRef:
+                name: authentik-ldap-secrets
+          livenessProbe:
+            httpGet:
+              path: /outpost.goauthentik.io/ping
+              port: 9300
+            initialDelaySeconds: 10
+            periodSeconds: 30
+          readinessProbe:
+            httpGet:
+              path: /outpost.goauthentik.io/ping
+              port: 9300
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          resources:
+            requests:
+              cpu: 50m
+              memory: 128Mi
+            limits:
+              memory: 256Mi

applications/authentik/ldap/infisicalsecret.yaml

@@ -1,14 +1,14 @@
 apiVersion: secrets.infisical.com/v1alpha1
 kind: InfisicalSecret
 metadata:
-  name: authentik-secrets
+  name: authentik-ldap-secrets
   namespace: infisical
 spec:
   hostAPI: https://infisical.jsme.be
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical
@@ -16,9 +16,9 @@ spec:
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
-        secretsPath: "/authentik"
+        secretsPath: "/authentik/authentik-ldap"
-        recursive: true
+        recursive: false
   managedSecretReference:
-    secretName: authentik-secrets
+    secretName: authentik-ldap-secrets
     secretNamespace: authentik
     secretType: Opaque

applications/authentik/ldap/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: authentik-ldap
+  namespace: authentik
+spec:
+  selector:
+    app: authentik-ldap
+  ports:
+    - name: ldap
+      port: 3389
+      targetPort: 3389
+    - name: metrics
+      port: 9300
+      targetPort: 9300

applications/authentik/ldap/tcproute.yaml

@@ -0,0 +1,25 @@
+apiVersion: gateway.networking.k8s.io/v1alpha2
+kind: TCPRoute
+metadata:
+  name: authentik-ldap
+  namespace: authentik
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-internal
+      namespace: envoy-gateway
+      sectionName: authentik-ldap
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-internal
+      namespace: envoy-gateway
+      sectionName: authentik-ldaps
+  rules:
+    # The gateway terminates TLS on 636, so both listeners hit the plaintext port
+    - backendRefs:
+        - name: authentik-ldap
+          port: 3389
+          kind: Service
+          group: ""
+          weight: 1

applications/authentik/postgres/authentik-postgres-statefulset.yaml

@@ -19,24 +19,9 @@ spec:
           image: postgres:16-alpine
           ports:
             - containerPort: 5432
-          env:
+          envFrom:
-            - name: POSTGRES_DB
+            - secretRef:
-              valueFrom:
+                name: authentik-postgres-secrets
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: db_name
-            - name: POSTGRES_USER
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: db_user
-            - name: POSTGRES_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: db_password
-            - name: PGDATA
-              value: /var/lib/postgresql/data/pgdata
           volumeMounts:
             - name: data
               mountPath: /var/lib/postgresql/data

applications/authentik/postgres/infisicalsecret.yaml

@@ -0,0 +1,25 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: authentik-postgres-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/authentik/postgres"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
+  managedSecretReference:
+    secretName: authentik-postgres-secrets
+    secretNamespace: authentik
+    secretType: Opaque

applications/authentik/server/authentik-server-deployment.yaml

@@ -17,7 +17,7 @@ spec:
     spec:
       containers:
         - name: authentik
-          image: ghcr.io/goauthentik/server:2026.5.2
+          image: ghcr.io/goauthentik/server:2026.8.0
           command: ["ak"]
           args: ["server"]
           ports:
@@ -25,62 +25,9 @@ spec:
               name: http
             - containerPort: 9443
               name: https
-          env:
+          envFrom:
-            - name: AUTHENTIK_POSTGRESQL__HOST
+            - secretRef:
-              valueFrom:
+                name: authentik-app-secrets
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: db_host
-            - name: AUTHENTIK_POSTGRESQL__NAME
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: db_name
-            - name: AUTHENTIK_POSTGRESQL__USER
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: db_user
-            - name: AUTHENTIK_POSTGRESQL__PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: db_password
-            - name: AUTHENTIK_SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: AUTHENTIK_SECRET_KEY
-            - name: AUTHENTIK_EMAIL__HOST
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: email_host
-            - name: AUTHENTIK_EMAIL__PORT
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: email_port
-            - name: AUTHENTIK_EMAIL__USERNAME
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: email_username
-            - name: AUTHENTIK_EMAIL__PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: email_password
-            - name: AUTHENTIK_EMAIL__FROM
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: email_from
-            - name: AUTHENTIK_EMAIL__USE_TLS
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: email_use_tls
           volumeMounts:
             - name: data
               mountPath: /data

applications/authentik/server/infisicalsecret.yaml

@@ -0,0 +1,25 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: authentik-app-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/authentik/authentik"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
+  managedSecretReference:
+    secretName: authentik-app-secrets
+    secretNamespace: authentik
+    secretType: Opaque

applications/authentik/worker/authentik-worker-deployment.yaml

@@ -19,65 +19,12 @@ spec:
         runAsUser: 0
       containers:
         - name: authentik
-          image: ghcr.io/goauthentik/server:2026.5.2
+          image: ghcr.io/goauthentik/server:2026.8.0
           command: ["ak"]
           args: ["worker"]
-          env:
+          envFrom:
-            - name: AUTHENTIK_POSTGRESQL__HOST
+            - secretRef:
-              valueFrom:
+                name: authentik-app-secrets
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: db_host
-            - name: AUTHENTIK_POSTGRESQL__NAME
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: db_name
-            - name: AUTHENTIK_POSTGRESQL__USER
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: db_user
-            - name: AUTHENTIK_POSTGRESQL__PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: db_password
-            - name: AUTHENTIK_SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: AUTHENTIK_SECRET_KEY
-            - name: AUTHENTIK_EMAIL__HOST
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: email_host
-            - name: AUTHENTIK_EMAIL__PORT
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: email_port
-            - name: AUTHENTIK_EMAIL__USERNAME
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: email_username
-            - name: AUTHENTIK_EMAIL__PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: email_password
-            - name: AUTHENTIK_EMAIL__FROM
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: email_from
-            - name: AUTHENTIK_EMAIL__USE_TLS
-              valueFrom:
-                secretKeyRef:
-                  name: authentik-secrets
-                  key: email_use_tls
           volumeMounts:
             - name: data
               mountPath: /data

applications/azure-ddns-python/azure-ddns-statefulset.yaml

@@ -1,69 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: azure-ddns
-  namespace: azure-ddns
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: azure-ddns
-  serviceName: azure-ddns
-  template:
-    metadata:
-      labels:
-        app: azure-ddns
-    spec:
-      terminationGracePeriodSeconds: 60
-      containers:
-        - name: azure-ddns
-          image: gitea.jsme.be/jeffrey/azure-ddns-python:1.1
-          resources:
-            requests:
-              cpu: 50m
-              memory: 128Mi
-            limits:
-              cpu: 200m
-              memory: 256Mi
-          env:
-            - name: AZURE_TENANT_ID
-              valueFrom:
-                secretKeyRef:
-                  name: azure-ddns-secrets
-                  key: TENANT_ID
-            - name: AZURE_CLIENT_ID
-              valueFrom:
-                secretKeyRef:
-                  name: azure-ddns-secrets
-                  key: CLIENT_ID
-            - name: AZURE_CLIENT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: azure-ddns-secrets
-                  key: CLIENT_SECRET
-            - name: AZURE_SUBSCRIPTION_ID
-              valueFrom:
-                secretKeyRef:
-                  name: azure-ddns-secrets
-                  key: SUBSCRIPTION_ID
-            - name: AZURE_RESOURCE_GROUP
-              valueFrom:
-                secretKeyRef:
-                  name: azure-ddns-secrets
-                  key: RESOURCE_GROUP
-            - name: AZURE_ZONE_NAME
-              valueFrom:
-                secretKeyRef:
-                  name: azure-ddns-secrets
-                  key: AZURE_ZONE_NAME
-            - name: GOTIFY_URL
-              valueFrom:
-                secretKeyRef:
-                  name: azure-ddns-secrets
-                  key: GOTIFY_URL
-            - name: GOTIFY_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: azure-ddns-secrets
-                  key: GOTIFY_TOKEN
-      restartPolicy: Always

applications/azure-ddns-python/azure-ddns/infisicalsecret.yaml

@@ -1,14 +1,14 @@
 apiVersion: secrets.infisical.com/v1alpha1
 kind: InfisicalSecret
 metadata:
-  name: azure-ddns-secrets
+  name: azure-ddns-app-secrets
   namespace: infisical
 spec:
   hostAPI: https://infisical.jsme.be
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical
@@ -16,9 +16,10 @@ spec:
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
-        secretsPath: "/azure-ddns"
+        secretsPath: "/azure-ddns/azure-ddns"
-        recursive: true
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
   managedSecretReference:
-    secretName: azure-ddns-secrets
+    secretName: azure-ddns-app-secrets
     secretNamespace: azure-ddns
     secretType: Opaque

applications/azure-ddns-python/azure-ddns/statefulset.yaml

@@ -0,0 +1,31 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: azure-ddns
+  namespace: azure-ddns
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: azure-ddns
+  serviceName: azure-ddns
+  template:
+    metadata:
+      labels:
+        app: azure-ddns
+    spec:
+      terminationGracePeriodSeconds: 60
+      containers:
+        - name: azure-ddns
+          image: gitea.jsme.be/jeffrey/azure-ddns-python:1.1
+          resources:
+            requests:
+              cpu: 50m
+              memory: 128Mi
+            limits:
+              cpu: 200m
+              memory: 256Mi
+          envFrom:
+            - secretRef:
+                name: azure-ddns-app-secrets
+      restartPolicy: Always

applications/bentopdf/bentopdf-deployment.yaml

@@ -17,7 +17,7 @@ spec:
       terminationGracePeriodSeconds: 10
       containers:
           - name: bentopdf
-            image: ghcr.io/alam00000/bentopdf:v2.8.2-amd64
+            image: ghcr.io/alam00000/bentopdf:v2.8.7-amd64
             resources:
               requests:
                 cpu: 50m

applications/gitea/gitea/gitea-statefulset.yaml

@@ -17,7 +17,7 @@ spec:
       terminationGracePeriodSeconds: 60
       containers:
         - name: gitea
-          image: docker.gitea.com/gitea:1.25
+          image: docker.gitea.com/gitea:1.27.2
           resources:
             requests:
               cpu: 200m
@@ -31,37 +31,9 @@ spec:
             - name: data
               mountPath: /data
               subPath: Gitea
-          env:
+          envFrom:
-            - name: GITEA__database__HOST
+            - secretRef:
-              valueFrom:
+                name: gitea-app-secrets
-                secretKeyRef:
-                  name: gitea-secrets
-                  key: db_host
-            - name: GITEA__database__DB_TYPE
-              valueFrom:
-                secretKeyRef:
-                  name: gitea-secrets
-                  key: db_type
-            - name: GITEA__database__NAME
-              valueFrom:
-                secretKeyRef:
-                  name: gitea-secrets
-                  key: db_name
-            - name: GITEA__database__USER
-              valueFrom:
-                secretKeyRef:
-                  name: gitea-secrets
-                  key: db_user
-            - name: GITEA__database__PASSWD
-              valueFrom:
-                secretKeyRef:
-                  name: gitea-secrets
-                  key: db_password
-            - name: USER
-              valueFrom:
-                secretKeyRef:
-                  name: gitea-secrets
-                  key: gitea_user
       restartPolicy: Always
       volumes: 
         - name: data  

applications/gitea/gitea/infisicalsecret.yaml

@@ -0,0 +1,25 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: gitea-app-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/gitea/gitea"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
+  managedSecretReference:
+    secretName: gitea-app-secrets
+    secretNamespace: gitea
+    secretType: Opaque

applications/gitea/postgres/gitea-postgres-statefulset.yaml

@@ -31,24 +31,9 @@ spec:
           volumeMounts:
             - name: gitea-postgresql-database
               mountPath: /var/lib/postgresql/volumes/pgdata
-          env:
+          envFrom:
-            - name: POSTGRES_PASSWORD
+            - secretRef:
-              valueFrom:
+                name: gitea-postgres-secrets
-                secretKeyRef:
-                  name: gitea-secrets
-                  key: db_password
-            - name: POSTGRES_USER
-              valueFrom:
-                secretKeyRef:
-                  name: gitea-secrets
-                  key: db_user
-            - name: POSTGRES_DB
-              valueFrom:
-                secretKeyRef:
-                  name: gitea-secrets
-                  key: db_name
-            - name: PGDATA
-              value: /var/lib/postgresql/volumes/pgdata/data
       volumes:
         - name: gitea-postgresql-database
           persistentVolumeClaim:

applications/gitea/postgres/infisicalsecret.yaml

@@ -0,0 +1,25 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: gitea-postgres-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/gitea/postgres"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
+  managedSecretReference:
+    secretName: gitea-postgres-secrets
+    secretNamespace: gitea
+    secretType: Opaque

applications/gitea/runner/values.yaml

@@ -144,7 +144,7 @@ init:
   image:
     repository: busybox
     # Overrides the image tag whose default is the chart appVersion.
-    tag: "1.37.0"
+    tag: "1.38.0"
 
 ## Specify an existing token secret
 ##

applications/gotify/gotify-statefulset.yaml

@@ -1,63 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: gotify
-  namespace: gotify
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: gotify
-  serviceName: gotify
-  template:
-    metadata:
-      labels:
-        app: gotify
-    spec:
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 10
-      containers:
-        - name: gotify
-          image: gotify/server:2.9.1
-          resources:
-            requests:
-              cpu: 50m
-              memory: 128Mi
-            limits:
-              cpu: 200m
-              memory: 256Mi
-          ports:
-            - containerPort: 80
-              name: http
-          env:
-            - name: GOTIFY_DEFAULTUSER_PASS
-              valueFrom:
-                secretKeyRef:
-                  name: gotify-secrets
-                  key: default_user_pass
-            - name: GOTIFY_DATABASE_DIALECT
-              value: postgres
-            - name: DB_USER
-              valueFrom:
-                secretKeyRef:
-                  name: gotify-secrets
-                  key: db_user
-            - name: DB_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: gotify-secrets
-                  key: db_password
-            - name: DB_NAME
-              valueFrom:
-                secretKeyRef:
-                  name: gotify-secrets
-                  key: db_name
-            - name: GOTIFY_DATABASE_CONNECTION
-              value: "host=gotify-postgresql port=5432 user=$(DB_USER) dbname=$(DB_NAME) password=$(DB_PASSWORD) sslmode=disable"
-          volumeMounts:
-            - name: data
-              mountPath: /app/data
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: gotify-data-pvc

applications/gotify/gotify/infisicalsecret.yaml

@@ -1,14 +1,14 @@
 apiVersion: secrets.infisical.com/v1alpha1
 kind: InfisicalSecret
 metadata:
-  name: gotify-secrets
+  name: gotify-app-secrets
   namespace: infisical
 spec:
   hostAPI: https://infisical.jsme.be
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical
@@ -16,9 +16,10 @@ spec:
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
-        secretsPath: "/gotify"
+        secretsPath: "/gotify/gotify"
-        recursive: true
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
   managedSecretReference:
-    secretName: gotify-secrets
+    secretName: gotify-app-secrets
     secretNamespace: gotify
     secretType: Opaque

applications/gotify/gotify/statefulset.yaml

@@ -0,0 +1,41 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: gotify
+  namespace: gotify
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: gotify
+  serviceName: gotify
+  template:
+    metadata:
+      labels:
+        app: gotify
+    spec:
+      restartPolicy: Always
+      terminationGracePeriodSeconds: 10
+      containers:
+        - name: gotify
+          image: gotify/server:3.0.0
+          resources:
+            requests:
+              cpu: 50m
+              memory: 128Mi
+            limits:
+              cpu: 200m
+              memory: 256Mi
+          ports:
+            - containerPort: 80
+              name: http
+          envFrom:
+            - secretRef:
+                name: gotify-app-secrets
+          volumeMounts:
+            - name: data
+              mountPath: /app/data
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: gotify-data-pvc

applications/gotify/postgres/gotify-postgres-statefulset.yaml

@@ -31,24 +31,9 @@ spec:
           volumeMounts:
             - name: gotify-postgresql-database
               mountPath: /var/lib/postgresql/pgdata
-          env:
+          envFrom:
-            - name: PGDATA
+            - secretRef:
-              value: /var/lib/postgresql/pgdata/data
+                name: gotify-postgres-secrets
-            - name: POSTGRES_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: gotify-secrets
-                  key: db_password
-            - name: POSTGRES_USER
-              valueFrom:
-                secretKeyRef:
-                  name: gotify-secrets
-                  key: db_user
-            - name: POSTGRES_DB
-              valueFrom:
-                secretKeyRef:
-                  name: gotify-secrets
-                  key: db_name
       volumes:
         - name: gotify-postgresql-database
           persistentVolumeClaim:

applications/gotify/postgres/infisicalsecret.yaml

@@ -0,0 +1,25 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: gotify-postgres-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/gotify/postgres"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
+  managedSecretReference:
+    secretName: gotify-postgres-secrets
+    secretNamespace: gotify
+    secretType: Opaque

applications/immich/immich/immich-statefulset.yaml

@@ -18,7 +18,7 @@ spec:
       terminationGracePeriodSeconds: 60
       containers:
       - name: immich
-        image: ghcr.io/immich-app/immich-server:v2.7.5
+        image: ghcr.io/immich-app/immich-server:v3.1.0
         resources:
           requests:
             memory: "256Mi"
@@ -28,30 +28,9 @@ spec:
             cpu: "2000m"
         ports:
         - containerPort: 2283
-        env:
+        envFrom:
-        - name: TZ
+        - secretRef:
-          value: "Europe/Brussels"
+            name: immich-app-secrets
-        - name: DB_HOSTNAME
-          value: "immich-postgresql.immich.svc.cluster.local"
-        - name: DB_DATABASE_NAME
-          valueFrom:
-            secretKeyRef:
-              name: immich-secrets
-              key: db_name
-        - name: DB_USERNAME
-          valueFrom:
-            secretKeyRef:
-              name: immich-secrets
-              key: db_user
-        - name: DB_PASSWORD
-          valueFrom:
-            secretKeyRef:
-              name: immich-secrets
-              key: db_password
-        - name: REDIS_HOSTNAME
-          value: "valkey.immich.svc.cluster.local"
-        - name: IMMICH_PORT
-          value: "2283"
         volumeMounts:
         - name: photos
           mountPath: /data

applications/immich/immich/infisicalsecret.yaml

@@ -0,0 +1,25 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: immich-app-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/immich/immich"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
+  managedSecretReference:
+    secretName: immich-app-secrets
+    secretNamespace: immich
+    secretType: Opaque

applications/immich/postgres/immich-postgres-statefulset.yaml

@@ -31,24 +31,9 @@ spec:
           volumeMounts:
             - name: immich-postgresql-immich
               mountPath: /var/lib/postgres
-          env:
+          envFrom:
-            - name: POSTGRES_PASSWORD
+            - secretRef:
-              valueFrom:
+                name: immich-postgres-secrets
-                secretKeyRef:
-                  name: immich-secrets
-                  key: db_password
-            - name: POSTGRES_USER
-              valueFrom:
-                secretKeyRef:
-                  name: immich-secrets
-                  key: db_user
-            - name: POSTGRES_DB
-              valueFrom:
-                secretKeyRef:
-                  name: immich-secrets
-                  key: db_name
-            - name: PGDATA
-              value: /var/lib/postgres/data
       volumes:
         - name: immich-postgresql-immich
           persistentVolumeClaim:

applications/immich/postgres/infisicalsecret.yaml

@@ -0,0 +1,25 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: immich-postgres-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/immich/postgres"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
+  managedSecretReference:
+    secretName: immich-postgres-secrets
+    secretNamespace: immich
+    secretType: Opaque

applications/infisical/Infisical-secrets/affine-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/crowdsec-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/gitea-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical
@@ -17,7 +17,9 @@ spec:
         projectSlug: "kubernetes"
         envSlug: "prod"
         secretsPath: "/gitea"
-        recursive: true
+        # Root only: /gitea holds the SMB mount credentials and the Actions runner token.
+        # Per-container env lives in subfolders.
+        recursive: false
   managedSecretReference:
     secretName: gitea-secrets
     secretNamespace: gitea

applications/infisical/Infisical-secrets/immich-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical
@@ -17,7 +17,9 @@ spec:
         projectSlug: "kubernetes"
         envSlug: "prod"
         secretsPath: "/immich"
-        recursive: true
+        # Root only: /immich holds the SMB mount credentials (username, password)
+        # consumed by immich-data-smb. Per-container env lives in subfolders.
+        recursive: false
   managedSecretReference:
     secretName: immich-secrets
     secretNamespace: immich

applications/infisical/Infisical-secrets/jellyfin-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/longhorn-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/minecraft-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/n8n-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/netbootxyz-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/openwebui-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/vaultwarden-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/victoria-metrics-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical

applications/infisical/Infisical-secrets/zipline-infisicalsecret.yaml

@@ -8,7 +8,7 @@ spec:
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical
@@ -17,7 +17,9 @@ spec:
         projectSlug: "kubernetes"
         envSlug: "prod"
         secretsPath: "/zipline"
-        recursive: true
+        # Root only: /zipline holds the SMB mount credentials (username, password)
+        # consumed by zipline-uploads-pv. Per-container env lives in subfolders.
+        recursive: false
   managedSecretReference:
     secretName: zipline-secrets
     secretNamespace: zipline

applications/infisical/postgres/statefulset.yaml

@@ -53,6 +53,12 @@ spec:
               command: ["sh", "-c", "pg_isready -U $POSTGRES_USER -d $POSTGRES_DB"]
             initialDelaySeconds: 30
             periodSeconds: 15
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              memory: 512Mi
   volumeClaimTemplates:
     - metadata:
         name: data

applications/infisical/serviceaccounts.yaml

@@ -0,0 +1,63 @@
+# Kubernetes-native auth for the InfisicalSecret operator.
+# infisical-auth: the identity the CRDs mint short-lived tokens for.
+# infisical-token-reviewer: its JWT is pasted into Infisical's Kubernetes Auth
+# config so Infisical can call TokenReview. Bound to system:auth-delegator below.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: infisical-auth
+  namespace: infisical
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: infisical-token-reviewer
+  namespace: infisical
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: infisical-token-reviewer
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: system:auth-delegator
+subjects:
+  - kind: ServiceAccount
+    name: infisical-token-reviewer
+    namespace: infisical
+---
+# The operator needs to mint tokens for infisical-auth; without this it falls
+# back to the legacy SA .secrets[] lookup and never gets a token.
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: infisical-operator-token-creator
+rules:
+  - apiGroups: [""]
+    resources: ["serviceaccounts/token"]
+    verbs: ["create"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: infisical-operator-token-creator
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: infisical-operator-token-creator
+subjects:
+  - kind: ServiceAccount
+    name: infisical-opera-controller-manager
+    namespace: infisical-operator
+---
+# Long-lived token for the reviewer SA. `kubectl create token` expires; the
+# value pasted into Infisical's Kubernetes Auth config must not.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: infisical-token-reviewer
+  namespace: infisical
+  annotations:
+    kubernetes.io/service-account.name: infisical-token-reviewer
+type: kubernetes.io/service-account-token

applications/infisical/valkey/statefulset.yaml

@@ -29,6 +29,12 @@ spec:
               command: ["valkey-cli", "ping"]
             initialDelaySeconds: 5
             periodSeconds: 10
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              memory: 256Mi
   volumeClaimTemplates:
     - metadata:
         name: data

applications/jellyfin/jellyfin-statefulset.yaml

@@ -20,7 +20,7 @@ spec:
         gpu: "true"
       containers:
       - name: jellyfin
-        image: jellyfin/jellyfin:10.11.9
+        image: jellyfin/jellyfin:12.0
         ports:
         - containerPort: 8096
         resources:

applications/netbootxyz/netbootxyz-statefulset.yaml

@@ -18,7 +18,7 @@ spec:
       terminationGracePeriodSeconds: 10
       containers:
         - name: netbootxyz
-          image: netbootxyz/netbootxyz:0.7.6-nbxyz18
+          image: netbootxyz/netbootxyz:0.7.6-nbxyz24
           resources:
             requests:
               cpu: 100m

applications/netbox/housekeeping/cronjob.yaml

@@ -0,0 +1,37 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  namespace: netbox
+  name: netbox-housekeeping
+spec:
+  schedule: "15 3 * * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      backoffLimit: 2
+      template:
+        spec:
+          restartPolicy: OnFailure
+          securityContext:
+            runAsUser: 999
+            runAsGroup: 0
+            fsGroup: 0
+          containers:
+            - name: netbox-housekeeping
+              image: netboxcommunity/netbox:v4.6.8-5.0.2
+              args:
+                - /opt/netbox/venv/bin/python
+                - /opt/netbox/netbox/manage.py
+                - housekeeping
+              resources:
+                requests:
+                  memory: "128Mi"
+                  cpu: "50m"
+                limits:
+                  memory: "512Mi"
+                  cpu: "500m"
+              envFrom:
+                - secretRef:
+                    name: netbox-app-secrets

applications/netbox/netbox-httproute.yaml

@@ -0,0 +1,46 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: netbox-route
+  namespace: netbox
+spec:
+  parentRefs:
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-internal
+      namespace: envoy-gateway
+      sectionName: netbox
+  hostnames:
+    - "netbox.jsme.be"
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      filters:
+        - type: RequestHeaderModifier
+          requestHeaderModifier:
+            set:
+              - name: X-Forwarded-Host
+                value: "netbox.jsme.be"
+              - name: X-Forwarded-Proto
+                value: https
+        - type: ResponseHeaderModifier
+          responseHeaderModifier:
+            set:
+              - name: Strict-Transport-Security
+                value: "max-age=31536000; includeSubDomains"
+              - name: X-Content-Type-Options
+                value: nosniff
+              - name: X-Frame-Options
+                value: SAMEORIGIN
+              - name: Referrer-Policy
+                value: strict-origin-when-cross-origin
+              - name: Permissions-Policy
+                value: "camera=(), microphone=(), geolocation=(), payment=()"
+      backendRefs:
+        - name: netbox
+          port: 8080
+          kind: Service
+          group: ""
+          weight: 1

applications/netbox/netbox-namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: netbox

applications/netbox/netbox/deployment.yaml

@@ -0,0 +1,82 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  namespace: netbox
+  name: netbox
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: netbox
+  template:
+    metadata:
+      labels:
+        app: netbox
+    spec:
+      restartPolicy: Always
+      terminationGracePeriodSeconds: 60
+      securityContext:
+        runAsUser: 999
+        runAsGroup: 0
+        fsGroup: 0
+      containers:
+        - name: netbox
+          image: netboxcommunity/netbox:v4.6.8-5.0.2
+          resources:
+            requests:
+              memory: "512Mi"
+              cpu: "250m"
+            limits:
+              memory: "2Gi"
+              cpu: "2000m"
+          ports:
+            - containerPort: 8080
+          envFrom:
+            - secretRef:
+                name: netbox-app-secrets
+          volumeMounts:
+            - name: netbox-data
+              mountPath: /opt/netbox/netbox/media
+              subPath: media
+            - name: netbox-data
+              mountPath: /opt/netbox/netbox/reports
+              subPath: reports
+            - name: netbox-data
+              mountPath: /opt/netbox/netbox/scripts
+              subPath: scripts
+          startupProbe:
+            httpGet:
+              path: /login/
+              port: 8080
+              # Django rejects the pod IP as a Host header (ALLOWED_HOSTS).
+              httpHeaders:
+                - name: Host
+                  value: netbox.jsme.be
+            periodSeconds: 10
+            # Generous: the entrypoint runs migrations before granian binds.
+            failureThreshold: 60
+          readinessProbe:
+            httpGet:
+              path: /login/
+              port: 8080
+              # Django rejects the pod IP as a Host header (ALLOWED_HOSTS).
+              httpHeaders:
+                - name: Host
+                  value: netbox.jsme.be
+            periodSeconds: 15
+          livenessProbe:
+            httpGet:
+              path: /login/
+              port: 8080
+              # Django rejects the pod IP as a Host header (ALLOWED_HOSTS).
+              httpHeaders:
+                - name: Host
+                  value: netbox.jsme.be
+            periodSeconds: 30
+            failureThreshold: 5
+      volumes:
+        - name: netbox-data
+          persistentVolumeClaim:
+            claimName: netbox-data-pvc

applications/netbox/netbox/infisicalsecret.yaml

@@ -0,0 +1,25 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: netbox-app-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/netbox/netbox"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
+  managedSecretReference:
+    secretName: netbox-app-secrets
+    secretNamespace: netbox
+    secretType: Opaque

applications/netbox/netbox/persistentvolumeclaim.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  namespace: netbox
+  name: netbox-data-pvc
+spec:
+  # RWX: shared by the web pod and the rqworker pod.
+  accessModes:
+    - ReadWriteMany
+  storageClassName: longhorn-static
+  resources:
+    requests:
+      storage: 5Gi

applications/netbox/netbox/service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  namespace: netbox
+  name: netbox
+spec:
+  selector:
+    app: netbox
+  ports:
+    - protocol: TCP
+      port: 8080
+      targetPort: 8080
+  type: ClusterIP

applications/netbox/postgres/infisicalsecret.yaml

@@ -0,0 +1,25 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: netbox-postgres-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/netbox/postgres"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
+  managedSecretReference:
+    secretName: netbox-postgres-secrets
+    secretNamespace: netbox
+    secretType: Opaque

applications/netbox/postgres/persistentvolumeclaim.yaml

@@ -1,13 +1,12 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: gitea-runner-pvc
+  namespace: netbox
-  namespace: gitea
+  name: netbox-postgres-pvc
 spec:
   accessModes:
     - ReadWriteOnce
   storageClassName: longhorn-static
-  volumeName: gitea-runner-data
   resources:
     requests:
-      storage: 20Gi
+      storage: 10Gi

applications/netbox/postgres/service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: netbox-postgres
+  namespace: netbox
+spec:
+  selector:
+    app: netbox-postgres
+  type: ClusterIP
+  ports:
+    - name: netbox-postgres-port
+      protocol: TCP
+      port: 5432
+      targetPort: 5432

applications/netbox/postgres/statefulset.yaml

@@ -0,0 +1,45 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  namespace: netbox
+  name: netbox-postgres
+spec:
+  replicas: 1
+  serviceName: netbox-postgres
+  selector:
+    matchLabels:
+      app: netbox-postgres
+  template:
+    metadata:
+      labels:
+        app: netbox-postgres
+    spec:
+      restartPolicy: Always
+      terminationGracePeriodSeconds: 60
+      containers:
+        - name: netbox-postgres
+          image: postgres:18
+          resources:
+            requests:
+              memory: "256Mi"
+              cpu: "100m"
+            limits:
+              memory: "1Gi"
+              cpu: "1000m"
+          ports:
+            - containerPort: 5432
+          volumeMounts:
+            - name: netbox-postgres-data
+              mountPath: /var/lib/postgresql/data
+          envFrom:
+            - secretRef:
+                name: netbox-postgres-secrets
+          readinessProbe:
+            exec:
+              command: ["sh", "-c", "pg_isready -q -U \"$POSTGRES_USER\" -d \"$POSTGRES_DB\""]
+            initialDelaySeconds: 10
+            periodSeconds: 10
+      volumes:
+        - name: netbox-postgres-data
+          persistentVolumeClaim:
+            claimName: netbox-postgres-pvc

applications/netbox/redis-cache/deployment.yaml

@@ -0,0 +1,38 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  namespace: netbox
+  name: netbox-redis-cache
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: netbox-redis-cache
+  template:
+    metadata:
+      labels:
+        app: netbox-redis-cache
+    spec:
+      restartPolicy: Always
+      containers:
+        - name: netbox-redis-cache
+          image: valkey/valkey:9.1-alpine
+          # Cache only: no persistence, contents are disposable.
+          command: ["sh", "-c", "exec valkey-server --requirepass \"$REDIS_PASSWORD\""]
+          resources:
+            requests:
+              memory: "64Mi"
+              cpu: "50m"
+            limits:
+              memory: "256Mi"
+              cpu: "200m"
+          ports:
+            - containerPort: 6379
+          envFrom:
+            - secretRef:
+                name: netbox-redis-cache-secrets
+          readinessProbe:
+            exec:
+              command: ["sh", "-c", "valkey-cli --pass \"$REDIS_PASSWORD\" ping | grep -q PONG"]
+            initialDelaySeconds: 5
+            periodSeconds: 10

applications/netbox/redis-cache/infisicalsecret.yaml

@@ -0,0 +1,25 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: netbox-redis-cache-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/netbox/redis-cache"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
+  managedSecretReference:
+    secretName: netbox-redis-cache-secrets
+    secretNamespace: netbox
+    secretType: Opaque

applications/netbox/redis-cache/service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: netbox-redis-cache
+  namespace: netbox
+spec:
+  selector:
+    app: netbox-redis-cache
+  type: ClusterIP
+  ports:
+    - name: netbox-redis-cache-port
+      protocol: TCP
+      port: 6379
+      targetPort: 6379

applications/netbox/redis/infisicalsecret.yaml

@@ -0,0 +1,25 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: netbox-redis-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/netbox/redis"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
+  managedSecretReference:
+    secretName: netbox-redis-secrets
+    secretNamespace: netbox
+    secretType: Opaque

applications/netbox/redis/persistentvolumeclaim.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  namespace: netbox
+  name: netbox-redis-pvc
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn-static
+  resources:
+    requests:
+      storage: 1Gi

applications/netbox/redis/service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: netbox-redis
+  namespace: netbox
+spec:
+  selector:
+    app: netbox-redis
+  type: ClusterIP
+  ports:
+    - name: netbox-redis-port
+      protocol: TCP
+      port: 6379
+      targetPort: 6379

applications/netbox/redis/statefulset.yaml

@@ -0,0 +1,46 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  namespace: netbox
+  name: netbox-redis
+spec:
+  replicas: 1
+  serviceName: netbox-redis
+  selector:
+    matchLabels:
+      app: netbox-redis
+  template:
+    metadata:
+      labels:
+        app: netbox-redis
+    spec:
+      restartPolicy: Always
+      containers:
+        - name: netbox-redis
+          image: valkey/valkey:9.1-alpine
+          # Task queue: appendonly so queued background jobs survive a restart.
+          command: ["sh", "-c", "exec valkey-server --appendonly yes --requirepass \"$REDIS_PASSWORD\""]
+          resources:
+            requests:
+              memory: "64Mi"
+              cpu: "50m"
+            limits:
+              memory: "256Mi"
+              cpu: "200m"
+          ports:
+            - containerPort: 6379
+          envFrom:
+            - secretRef:
+                name: netbox-redis-secrets
+          volumeMounts:
+            - name: netbox-redis-data
+              mountPath: /data
+          readinessProbe:
+            exec:
+              command: ["sh", "-c", "valkey-cli --pass \"$REDIS_PASSWORD\" ping | grep -q PONG"]
+            initialDelaySeconds: 5
+            periodSeconds: 10
+      volumes:
+        - name: netbox-redis-data
+          persistentVolumeClaim:
+            claimName: netbox-redis-pvc

applications/netbox/worker/deployment.yaml

@@ -0,0 +1,54 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  namespace: netbox
+  name: netbox-worker
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: netbox-worker
+  template:
+    metadata:
+      labels:
+        app: netbox-worker
+    spec:
+      restartPolicy: Always
+      terminationGracePeriodSeconds: 60
+      securityContext:
+        runAsUser: 999
+        runAsGroup: 0
+        fsGroup: 0
+      containers:
+        - name: netbox-worker
+          image: netboxcommunity/netbox:v4.6.8-5.0.2
+          # Overrides CMD only, so tini stays the entrypoint and migrations
+          # are left to the web pod.
+          args:
+            - /opt/netbox/venv/bin/python
+            - /opt/netbox/netbox/manage.py
+            - rqworker
+          resources:
+            requests:
+              memory: "256Mi"
+              cpu: "100m"
+            limits:
+              memory: "1Gi"
+              cpu: "1000m"
+          envFrom:
+            - secretRef:
+                name: netbox-app-secrets
+          volumeMounts:
+            - name: netbox-data
+              mountPath: /opt/netbox/netbox/media
+              subPath: media
+            - name: netbox-data
+              mountPath: /opt/netbox/netbox/reports
+              subPath: reports
+            - name: netbox-data
+              mountPath: /opt/netbox/netbox/scripts
+              subPath: scripts
+      volumes:
+        - name: netbox-data
+          persistentVolumeClaim:
+            claimName: netbox-data-pvc

applications/outline/outline/infisicalsecret.yaml

@@ -1,14 +1,14 @@
 apiVersion: secrets.infisical.com/v1alpha1
 kind: InfisicalSecret
 metadata:
-  name: outline-secrets
+  name: outline-app-secrets
   namespace: infisical
 spec:
   hostAPI: https://infisical.jsme.be
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical
@@ -16,9 +16,10 @@ spec:
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
-        secretsPath: "/outline"
+        secretsPath: "/outline/outline"
-        recursive: true
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
   managedSecretReference:
-    secretName: outline-secrets
+    secretName: outline-app-secrets
     secretNamespace: outline
     secretType: Opaque

applications/outline/outline/outline-deployment.yaml

@@ -17,7 +17,7 @@ spec:
       terminationGracePeriodSeconds: 60
       containers:
         - name: outline
-          image: docker.getoutline.com/outlinewiki/outline:1.8.1
+          image: docker.getoutline.com/outlinewiki/outline:1.9.2
           resources:
             requests:
               memory: "512Mi"
@@ -27,92 +27,6 @@ spec:
               cpu: "2000m"
           ports:
             - containerPort: 3000
-          env:
+          envFrom:
-            - name: TZ
+            - secretRef:
-              value: "Europe/Brussels"
+                name: outline-app-secrets
-            - name: NODE_ENV
-              value: "production"
-            - name: URL
-              value: "https://outline.jsme.be"
-            - name: PORT
-              value: "3000"
-            # TLS is terminated at the gateway and X-Forwarded-Proto is set to
-            # https on the HTTPRoute, so Outline must not force an https redirect.
-            - name: FORCE_HTTPS
-              value: "false"
-
-            # --- Database (PostgreSQL) ---
-            - name: DATABASE_URL
-              valueFrom:
-                secretKeyRef:
-                  name: outline-secrets
-                  key: database_url
-            # In-cluster Postgres has no TLS; disable SSL on the connection.
-            - name: PGSSLMODE
-              value: "disable"
-
-            # --- Cache / queue (Redis-compatible Valkey) ---
-            - name: REDIS_URL
-              value: "redis://outline-redis.outline.svc.cluster.local:6379"
-
-            # --- Secrets ---
-            - name: SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: outline-secrets
-                  key: secret_key
-            - name: UTILS_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: outline-secrets
-                  key: utils_secret
-
-            # --- File storage (MinIO / S3) ---
-            - name: FILE_STORAGE
-              value: "s3"
-            - name: AWS_REGION
-              value: "us-east-1"
-            - name: AWS_S3_UPLOAD_BUCKET_URL
-              value: "https://s3.jsme.be"
-            - name: AWS_S3_UPLOAD_BUCKET_NAME
-              value: "outline"
-            - name: AWS_S3_FORCE_PATH_STYLE
-              value: "true"
-            - name: AWS_S3_ACL
-              value: "private"
-            - name: AWS_ACCESS_KEY_ID
-              valueFrom:
-                secretKeyRef:
-                  name: outline-secrets
-                  key: s3_access_key
-            - name: AWS_SECRET_ACCESS_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: outline-secrets
-                  key: s3_secret_key
-
-            # --- Authentication (Authentik OIDC) ---
-            - name: OIDC_DISPLAY_NAME
-              value: "Authentik"
-            - name: OIDC_AUTH_URI
-              value: "https://auth.jsme.be/application/o/authorize/"
-            - name: OIDC_TOKEN_URI
-              value: "https://auth.jsme.be/application/o/token/"
-            - name: OIDC_USERINFO_URI
-              value: "https://auth.jsme.be/application/o/userinfo/"
-            - name: OIDC_LOGOUT_URI
-              value: "https://auth.jsme.be/application/o/outline/end-session/"
-            - name: OIDC_USERNAME_CLAIM
-              value: "preferred_username"
-            - name: OIDC_SCOPES
-              value: "openid profile email"
-            - name: OIDC_CLIENT_ID
-              valueFrom:
-                secretKeyRef:
-                  name: outline-secrets
-                  key: oidc_client_id
-            - name: OIDC_CLIENT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: outline-secrets
-                  key: oidc_client_secret

applications/outline/postgres/infisicalsecret.yaml

@@ -0,0 +1,25 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: outline-postgres-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/outline/postgres"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
+  managedSecretReference:
+    secretName: outline-postgres-secrets
+    secretNamespace: outline
+    secretType: Opaque

applications/outline/postgres/outline-postgres-statefulset.yaml

@@ -31,24 +31,9 @@ spec:
           volumeMounts:
             - name: outline-postgres-data
               mountPath: /var/lib/postgresql/data
-          env:
+          envFrom:
-            - name: PGDATA
+            - secretRef:
-              value: "/var/lib/postgresql/data/pgdata"
+                name: outline-postgres-secrets
-            - name: POSTGRES_USER
-              valueFrom:
-                secretKeyRef:
-                  name: outline-secrets
-                  key: db_user
-            - name: POSTGRES_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: outline-secrets
-                  key: db_password
-            - name: POSTGRES_DB
-              valueFrom:
-                secretKeyRef:
-                  name: outline-secrets
-                  key: db_name
       volumes:
         - name: outline-postgres-data
           persistentVolumeClaim:

applications/passbolt/mariadb/infisicalsecret.yaml

@@ -0,0 +1,25 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: passbolt-mariadb-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/passbolt/mariadb"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
+  managedSecretReference:
+    secretName: passbolt-mariadb-secrets
+    secretNamespace: passbolt
+    secretType: Opaque

applications/passbolt/mariadb/passbolt-mariadb-statefulset.yaml

@@ -31,24 +31,9 @@ spec:
               mountPath: /var/lib/mysql
           ports:
             - containerPort: 3306 
-          env:
+          envFrom:
-            - name: MYSQL_RANDOM_ROOT_PASSWORD
+            - secretRef:
-              value: "true"
+                name: passbolt-mariadb-secrets
-            - name: MYSQL_DATABASE
-              valueFrom:
-                secretKeyRef:
-                  name: passbolt-secrets
-                  key: db_name
-            - name: MYSQL_USER
-              valueFrom:
-                secretKeyRef:
-                  name: passbolt-secrets
-                  key: db_user
-            - name: MYSQL_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: passbolt-secrets
-                  key: db_password
       volumes:
         - name: passbolt-mariadb-volume
           persistentVolumeClaim:

applications/passbolt/passbolt/infisicalsecret.yaml

@@ -1,14 +1,14 @@
 apiVersion: secrets.infisical.com/v1alpha1
 kind: InfisicalSecret
 metadata:
-  name: passbolt-secrets
+  name: passbolt-app-secrets
   namespace: infisical
 spec:
   hostAPI: https://infisical.jsme.be
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical
@@ -16,9 +16,10 @@ spec:
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
-        secretsPath: "/passbolt"
+        secretsPath: "/passbolt/passbolt"
-        recursive: true
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
   managedSecretReference:
-    secretName: passbolt-secrets
+    secretName: passbolt-app-secrets
     secretNamespace: passbolt
     secretType: Opaque

applications/passbolt/passbolt/passbolt-statefulset.yaml

@@ -36,60 +36,9 @@ spec:
               subPath: passbolt-ssl.conf
           ports:
             - containerPort: 80
-          env:
+          envFrom:
-            - name: APP_FULL_BASE_URL
+            - secretRef:
-              value: https://passbolt.jsme.be
+                name: passbolt-app-secrets
-            - name: APP_DEFAULT_TIMEZONE
-              value: Europe/Brussels
-            - name: PASSBOLT_SECURITY_CSP
-              value: "default-src 'self'; script-src 'self' chrome-extension: moz-extension:; style-src 'self' 'unsafe-inline'; img-src 'self'; frame-src 'self' chrome-extension: moz-extension: https://*.duosecurity.com; connect-src 'self' chrome-extension: moz-extension:; worker-src 'self' chrome-extension: moz-extension:; frame-ancestors 'none'; form-action 'self' https://*.duosecurity.com"
-            - name: DATASOURCES_DEFAULT_PORT
-              valueFrom:
-                secretKeyRef:
-                  name: passbolt-secrets
-                  key: db_port
-            - name: DATASOURCES_DEFAULT_HOST
-              valueFrom:
-                secretKeyRef:
-                  name: passbolt-secrets
-                  key: db_host
-            - name: DATASOURCES_DEFAULT_USERNAME
-              valueFrom:
-                secretKeyRef:
-                  name: passbolt-secrets
-                  key: db_user
-            - name: DATASOURCES_DEFAULT_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: passbolt-secrets
-                  key: db_password
-            - name: DATASOURCES_DEFAULT_DATABASE
-              valueFrom:
-                secretKeyRef:
-                  name: passbolt-secrets
-                  key: db_name
-            - name: EMAIL_DEFAULT_FROM
-              value: passbolt@jsme.be
-            - name: EMAIL_TRANSPORT_DEFAULT_HOST
-              value: smtp.office365.com
-            - name: EMAIL_TRANSPORT_DEFAULT_PORT
-              value: "587"
-            - name: EMAIL_TRANSPORT_DEFAULT_USERNAME
-              valueFrom:
-                secretKeyRef:
-                  name: passbolt-secrets
-                  key: smtp_username
-            - name: EMAIL_TRANSPORT_DEFAULT_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: passbolt-secrets
-                  key: smtp_password
-            - name: EMAIL_TRANSPORT_DEFAULT_TLS
-              value: "true"
-            - name: PASSBOLT_KEY_EMAIL
-              value: passbolt@jsme.be
-            - name: PASSBOLT_GPG_SERVER_KEY_FINGERPRINT_FORCE
-              value: "true"
       volumes:
         - name: gpg-volume
           persistentVolumeClaim:

applications/pelican/pelican-configmap.yaml

@@ -1,20 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: pelican-config
-  namespace: pelican
-data:
-  APP_NAME: Pelican
-  APP_URL: https://pelican.jsme.be
-  BEHIND_PROXY: "true"
-  ADMIN_EMAIL: jeffreysmeets@jsme.be
-  DB_CONNECTION: pgsql
-  DB_HOST: pelican-postgres
-  DB_PORT: "5432"
-  CACHE_STORE: redis
-  QUEUE_CONNECTION: redis
-  SESSION_DRIVER: redis
-  REDIS_HOST: pelican-redis
-  REDIS_PORT: "6379"
-  XDG_DATA_HOME: /pelican-data
-  AWS_USE_PATH_STYLE_ENDPOINT: "true"

applications/pelican/pelican-httproute.yaml

@@ -10,6 +10,11 @@ spec:
       name: gateway-internal
       namespace: envoy-gateway
       sectionName: pelican
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-public
+      namespace: envoy-gateway
+      sectionName: pelican
   hostnames:
     - "pelican.jsme.be"
   rules:

applications/pelican/pelican-wings-ark-httproute.yaml

@@ -10,6 +10,11 @@ spec:
       name: gateway-internal
       namespace: envoy-gateway
       sectionName: wings-ark
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-public
+      namespace: envoy-gateway
+      sectionName: wings-ark
   hostnames:
     - "wings-ark.jsme.be"
   rules:

applications/pelican/pelican-wings-mc-httproute.yaml

@@ -10,6 +10,11 @@ spec:
       name: gateway-internal
       namespace: envoy-gateway
       sectionName: wings-mc
+    - group: gateway.networking.k8s.io
+      kind: Gateway
+      name: gateway-public
+      namespace: envoy-gateway
+      sectionName: wings-mc
   hostnames:
     - "wings-mc.jsme.be"
   rules:

applications/pelican/pelican/deployment.yaml

@@ -19,7 +19,8 @@ spec:
         fsGroup: 82
       containers:
         - name: pelican
-          image: ghcr.io/pelican-dev/panel:latest
+          image: ghcr.io/pelican/panel:v1.0.0-beta38
+          imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 80
           resources:
@@ -30,24 +31,8 @@ spec:
               cpu: 1000m
               memory: 1Gi
           envFrom:
-            - configMapRef:
+            - secretRef:
-                name: pelican-config
+                name: pelican-app-secrets
-          env:
-            - name: DB_USERNAME
-              valueFrom:
-                secretKeyRef:
-                  name: pelican-secrets
-                  key: DB_USERNAME
-            - name: DB_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: pelican-secrets
-                  key: DB_PASSWORD
-            - name: DB_DATABASE
-              valueFrom:
-                secretKeyRef:
-                  name: pelican-secrets
-                  key: DB_DATABASE
           volumeMounts:
             - name: pelican-data
               mountPath: /pelican-data

applications/pelican/pelican/infisicalsecret.yaml

@@ -1,14 +1,14 @@
 apiVersion: secrets.infisical.com/v1alpha1
 kind: InfisicalSecret
 metadata:
-  name: pelican-secrets
+  name: pelican-app-secrets
   namespace: infisical
 spec:
   hostAPI: https://infisical.jsme.be
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical
@@ -16,9 +16,10 @@ spec:
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
-        secretsPath: "/pelican"
+        secretsPath: "/pelican/pelican"
-        recursive: true
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
   managedSecretReference:
-    secretName: pelican-secrets
+    secretName: pelican-app-secrets
     secretNamespace: pelican
     secretType: Opaque

applications/pelican/postgres/infisicalsecret.yaml

@@ -0,0 +1,25 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: pelican-postgres-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/pelican/postgres"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
+  managedSecretReference:
+    secretName: pelican-postgres-secrets
+    secretNamespace: pelican
+    secretType: Opaque

applications/pelican/postgres/statefulset.yaml

@@ -31,24 +31,9 @@ spec:
           volumeMounts:
             - name: pelican-postgres-data
               mountPath: /var/lib/postgresql/data
-          env:
+          envFrom:
-            - name: PGDATA
+            - secretRef:
-              value: /var/lib/postgresql/data/pgdata
+                name: pelican-postgres-secrets
-            - name: POSTGRES_USER
-              valueFrom:
-                secretKeyRef:
-                  name: pelican-secrets
-                  key: DB_USERNAME
-            - name: POSTGRES_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: pelican-secrets
-                  key: DB_PASSWORD
-            - name: POSTGRES_DB
-              valueFrom:
-                secretKeyRef:
-                  name: pelican-secrets
-                  key: DB_DATABASE
       volumes:
         - name: pelican-postgres-data
           persistentVolumeClaim:

applications/react-resume/chrome/infisicalsecret.yaml

@@ -0,0 +1,25 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: resume-chrome-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/reactive_resume/chrome"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
+  managedSecretReference:
+    secretName: resume-chrome-secrets
+    secretNamespace: resume
+    secretType: Opaque

applications/react-resume/chrome/react-resume-chrome-deployment.yaml

@@ -20,24 +20,6 @@ spec:
         image: ghcr.io/browserless/chromium:latest
         ports:
         - containerPort: 3000
-        env:
+        envFrom:
-        - name: TIMEOUT
+          - secretRef:
-          value: "10000"
+              name: resume-chrome-secrets
-        - name: CONCURRENT
-          value: "10"
-        - name: TOKEN
-          valueFrom:
-            secretKeyRef:
-              name: resume-secrets
-              key: chrome_token
-        - name: EXIT_ON_HEALTH_FAILURE
-          value: "true"
-        - name: PRE_REQUEST_HEALTH_CHECK
-          value: "true"
-        resources:
-          limits:
-            memory: "1Gi"
-            cpu: "500m"
-          requests:
-            memory: "512Mi" 
-            cpu: "250m"

applications/react-resume/postgres/infisicalsecret.yaml

@@ -0,0 +1,25 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: resume-postgres-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/reactive_resume/postgres"
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
+  managedSecretReference:
+    secretName: resume-postgres-secrets
+    secretNamespace: resume
+    secretType: Opaque

applications/react-resume/postgres/react-resume-postgres-statefulset.yaml

@@ -30,22 +30,9 @@ spec:
           volumeMounts:
             - name: resume-postgresql-database
               mountPath: /var/lib/postgresql
-          env:
+          envFrom:
-            - name: POSTGRES_PASSWORD
+            - secretRef:
-              valueFrom:
+                name: resume-postgres-secrets
-                secretKeyRef:
-                  name: resume-secrets
-                  key: db_password
-            - name: POSTGRES_USER
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: db_user
-            - name: POSTGRES_DB
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: db_name
       volumes:
         - name: resume-postgresql-database
           persistentVolumeClaim:

applications/react-resume/resume/infisicalsecret.yaml

@@ -1,14 +1,14 @@
 apiVersion: secrets.infisical.com/v1alpha1
 kind: InfisicalSecret
 metadata:
-  name: resume-secrets
+  name: resume-app-secrets
   namespace: infisical
 spec:
   hostAPI: https://infisical.jsme.be
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical
@@ -16,9 +16,10 @@ spec:
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
-        secretsPath: "/reactive_resume"
+        secretsPath: "/reactive_resume/resume"
-        recursive: true
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
   managedSecretReference:
-    secretName: resume-secrets
+    secretName: resume-app-secrets
     secretNamespace: resume
     secretType: Opaque

applications/react-resume/resume/react-resume-deployment.yaml

@@ -27,108 +27,6 @@ spec:
             requests:
               cpu: "500m"
               memory: "1Gi"
-          env:
+          envFrom:
-            - name: TZ
+            - secretRef:
-              value: Europe/Brussels
+                name: resume-app-secrets
-            - name: NODE_ENV
-              value: production
-            - name: PORT
-              value: "3000"
-            - name: APP_URL
-              value: https://resume.jsme.be
-            - name: STORAGE_URL
-              value: https://s3.jsme.be/resume
-            - name: CHROME_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: chrome_token
-            - name: PRINTER_ENDPOINT
-              value: ws://chrome.resume.svc.cluster.local:3000?token=$(CHROME_TOKEN)
-            - name: DATABASE_URL
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: db_url
-            - name: AUTH_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: auth_secret
-            - name: OAUTH_PROVIDER_NAME
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: oauth_provider_name
-            - name: OAUTH_CLIENT_ID
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: oauth_client_id
-            - name: OAUTH_CLIENT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: oauth_client_secret
-            - name: OAUTH_DISCOVERY_URL
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: oauth_discovery_url
-            - name: SMTP_HOST
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: smtp_host
-            - name: SMTP_PORT
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: smtp_port
-            - name: SMTP_USER
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: smtp_user
-            - name: SMTP_PASS
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: smtp_pass
-            - name: SMTP_FROM
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: smtp_from
-            - name: SMTP_SECURE
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: smtp_secure
-            - name: S3_ACCESS_KEY_ID
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: s3_access_key_id
-            - name: S3_SECRET_ACCESS_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: s3_secret_access_key
-            - name: S3_REGION
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: s3_region
-            - name: S3_ENDPOINT
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: s3_endpoint
-            - name: S3_BUCKET
-              valueFrom:
-                secretKeyRef:
-                  name: resume-secrets
-                  key: s3_bucket
-            - name: S3_FORCE_PATH_STYLE
-              value: "true"

applications/searxng/searxng/deployment.yaml

@@ -21,14 +21,9 @@ spec:
           image: searxng/searxng:latest
           ports:
             - containerPort: 8080
-          env:
+          envFrom:
-            - name: SEARXNG_BASE_URL
+            - secretRef:
-              value: "https://search.jsme.be"
+                name: searxng-app-secrets
-            - name: SEARXNG_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: searxng-secrets
-                  key: SEARXNG_SECRET_KEY
           resources:
             requests:
               cpu: 50m

applications/searxng/searxng/infisicalsecret.yaml

@@ -1,14 +1,14 @@
 apiVersion: secrets.infisical.com/v1alpha1
 kind: InfisicalSecret
 metadata:
-  name: searxng-secrets
+  name: searxng-app-secrets
   namespace: infisical
 spec:
   hostAPI: https://infisical.jsme.be
   resyncInterval: 30
   authentication:
     kubernetesAuth:
-      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
       serviceAccountRef:
         name: infisical-auth
         namespace: infisical
@@ -16,9 +16,10 @@ spec:
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
-        secretsPath: "/searxng"
+        secretsPath: "/searxng/searxng"
-        recursive: true
+        # Non-recursive: keys are already named as the container expects.
+        recursive: false
   managedSecretReference:
-    secretName: searxng-secrets
+    secretName: searxng-app-secrets
     secretNamespace: searxng
     secretType: Opaque