infisical: route infisical.jsme.be to infisical-backend service

README.md

@@ -6,52 +6,52 @@ All applications are managed using GitOps principles with ArgoCD and utilize cer
 
 ## Repository Structure
 
-The repository is organized with one directory per application, containing all necessary Kubernetes resources:
+The repository is split into three top-level areas. Within each, there is one directory per application/component, and every manifest follows the `<app>-<kind>.yaml` naming convention.
 
 ```
-├── argocd/              # GitOps continuous deployment
-├── cert-manager/        # TLS certificate management
-├── metallb/             # Load balancer
-├── kubevip/             # High availability
-├── longhorn/            # Distributed storage
-├── cloud-native-postgres/ # PostgreSQL operator
-├── envoy-gateway/       # Kubernetes Gateway API configuration
-├── infisical/           # Secrets management
-├── authentik/           # Identity provider and SSO
-├── it-tools/            # IT utilities
-├── jellyfin/            # Media server
-├── immich/              # Photo and video management
-├── minecraft/           # Game servers
-├── gitea/               # Git service
-├── jenkins/             # CI/CD automation
-├── n8n/                 # Workflow automation
-├── react-resume/        # Resume builder application
-├── passbolt/            # Password manager
-├── wikijs/              # Documentation wiki
-├── zipline/             # File sharing
-├── gotify/              # Push notification server
-├── ntfy/                # Push notifications
-├── bentopdf/            # PDF conversion
-├── excalidraw/          # Whiteboard / diagramming
-├── searxng/             # Privacy-respecting search engine
-├── uptime-kuma/         # Uptime monitoring
-├── openwebui/           # Web UI for AI models
-├── ollama/              # Local LLM runner
-├── comfyui/             # Stable Diffusion workflow UI
-├── minio-aistor/        # S3-compatible object storage
-├── databasus/           # Database management
-├── netbootxyz/          # Network boot service
-├── technitium/          # DNS server
-├── azure-ddns-python/   # Dynamic DNS updater
-├── victoria-metrics/    # Metrics and monitoring
-├── affine/              # Self-hosted collaborative workspace
-├── harbor/              # Container image registry
-├── pelican/             # Game server management panel
-├── stable-diffusion/    # Stable Diffusion image generation
-├── proxmox/             # Virtualization platform
-├── unifi/               # Network controller
-├── truenas/             # Storage system
-└── deprecated/          # Deprecated applications
+├── infra/                       # Cluster infrastructure
+│   ├── argocd/                  # GitOps continuous deployment
+│   ├── cert-manager/            # TLS certificate management
+│   ├── cloud-native-postgres/   # PostgreSQL operator
+│   ├── envoy-gateway/           # Kubernetes Gateway API configuration
+│   ├── kubevip/                 # High availability
+│   ├── longhorn/                # Distributed storage
+│   └── metallb/                 # Load balancer
+│
+├── applications/                # Deployed workloads
+│   ├── authentik/               # Identity provider and SSO
+│   ├── azure-ddns-python/       # Dynamic DNS updater
+│   ├── bentopdf/                # PDF conversion
+│   ├── comfyui/                 # Stable Diffusion workflow UI
+│   ├── databasus/               # Database management
+│   ├── excalidraw/              # Whiteboard / diagramming
+│   ├── gitea/                   # Git service
+│   ├── gotify/                  # Push notification server
+│   ├── immich/                  # Photo and video management
+│   ├── infisical/               # Secrets management
+│   ├── it-tools/                # IT utilities
+│   ├── jellyfin/                # Media server
+│   ├── minecraft/               # Game servers
+│   ├── minio-aistor/            # S3-compatible object storage
+│   ├── n8n/                     # Workflow automation
+│   ├── netbootxyz/              # Network boot service
+│   ├── ollama/                  # Local LLM runner
+│   ├── openwebui/               # Web UI for AI models
+│   ├── outline/                 # Knowledge base / wiki
+│   ├── passbolt/                # Password manager
+│   ├── pelican/                 # Game server management panel
+│   ├── proxmox/                 # Virtualization platform
+│   ├── react-resume/            # Resume builder application
+│   ├── searxng/                 # Privacy-respecting search engine
+│   ├── technitium/              # DNS server
+│   ├── truenas/                 # Storage system
+│   ├── unifi/                   # Network controller
+│   ├── uptime-kuma/             # Uptime monitoring
+│   ├── victoria-metrics/        # Metrics and monitoring
+│   ├── wikijs/                  # Documentation wiki
+│   └── zipline/                 # File sharing
+│
+└── deprecated/                  # Deprecated applications
 ```
 
 ## Categories
@@ -79,13 +79,11 @@ The repository is organized with one directory per application, containing all n
 - **Stable Diffusion**: Image generation service
 
 ### Self-Hosted Tools
-- **AFFiNE**: Collaborative workspace and note-taking platform
 - **Harbor**: Container image registry
 - **Pelican**: Game server management panel
 
 ### Development & CI/CD
 - **Gitea**: Self-hosted Git service with container registry
-- **Jenkins**: Automation server for CI/CD pipelines
 - **n8n**: Workflow automation platform
 - **MinIO AIStor**: S3-compatible object storage
 
@@ -93,9 +91,9 @@ The repository is organized with one directory per application, containing all n
 - **React-Resume**: Resume builder with MinIO and PostgreSQL
 - **Passbolt**: Team password manager
 - **Wiki.js**: Modern documentation platform
+- **Outline**: Team knowledge base and wiki (PostgreSQL, Redis/Valkey, MinIO S3, Authentik SSO)
 - **Zipline**: File sharing and screenshot service
 - **Gotify**: Push notification server with REST API and WebSocket support
-- **Ntfy**: Push notification service
 - **BentoPDF**: PDF conversion service
 - **Excalidraw**: Online whiteboard and diagramming tool
 - **SearXNG**: Privacy-respecting metasearch engine
@@ -118,6 +116,9 @@ The repository is organized with one directory per application, containing all n
 - **Nginx Ingress Controller**: Replaced by Envoy Gateway; dropped after upstream support ended in March 2025
 - **Psono**: Self-hosted password manager; replaced by Passbolt
 - **Vaultwarden**: Self-hosted Bitwarden server; no longer in use
+- **AFFiNE**: Collaborative workspace and note-taking platform; no longer in use
+- **Jenkins**: CI/CD automation server; no longer in use
+- **Ntfy**: Push notification service; no longer in use
 
 ## Infrastructure
 

applications/infisical/Infisical-secrets/netbootxyz-infisicalsecret.yaml

@@ -0,0 +1,24 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: netbootxyz-secrets
+  namespace: infisical
+spec:
+  hostAPI: https://infisical.jsme.be
+  resyncInterval: 30
+  authentication:
+    kubernetesAuth:
+      identityId: "9f65814e-bf4c-42fc-b382-26be15b11416"
+      serviceAccountRef:
+        name: infisical-auth
+        namespace: infisical
+      autoCreateServiceAccountToken: true
+      secretsScope:
+        projectSlug: "kubernetes"
+        envSlug: "prod"
+        secretsPath: "/netbootxyz"
+        recursive: true
+  managedSecretReference:
+    secretName: netbootxyz-secrets
+    secretNamespace: netbootxyz
+    secretType: Opaque

applications/infisical/Infisical-secrets/outline-infisicalsecret.yaml

@@ -1,7 +1,7 @@
 apiVersion: secrets.infisical.com/v1alpha1
 kind: InfisicalSecret
 metadata:
-  name: netbootxyz-secrets
+  name: outline-secrets
   namespace: infisical
 spec:
   hostAPI: https://infisical.jsme.be
@@ -11,12 +11,12 @@ spec:
       secretsScope:
         projectSlug: "kubernetes"
         envSlug: "prod"
-        secretsPath: "/netbootxyz"
+        secretsPath: "/outline"
         recursive: true
       credentialsRef:
         secretName: infisical-universal-auth
         secretNamespace: infisical
   managedSecretReference:
-    secretName: netbootxyz-secrets
-    secretNamespace: netbootxyz
+    secretName: outline-secrets
+    secretNamespace: outline
     secretType: Opaque

applications/infisical/infisical/httproute.yaml

@@ -5,6 +5,7 @@ metadata:
   namespace: infisical
 spec:
   parentRefs:
+    # Internal gateway only — Infisical is not exposed publicly.
     - group: gateway.networking.k8s.io
       kind: Gateway
       name: gateway-internal
@@ -39,7 +40,7 @@ spec:
               - name: Permissions-Policy
                 value: "camera=(), microphone=(), geolocation=(), payment=()"
       backendRefs:
-        - name: infisical
+        - name: infisical-backend
           port: 8080
           kind: Service
           group: ""

applications/jellyfin/jellyfin-persistentvolumeclaim.yaml

@@ -10,4 +10,4 @@ spec:
   volumeName: jellyfin-pvc
   resources:
     requests:
-      storage: 40Gi
+      storage: 80Gi