Move arr/seerr off gateway-internal to dedicated gateway

RollingUpdate deadlocks on the ReadWriteOnce longhorn PVC: old and new
pods cannot both attach the volume. Recreate terminates the old pod first.

README.md

@@ -6,52 +6,51 @@ All applications are managed using GitOps principles with ArgoCD and utilize cer
 
 ## Repository Structure
 
-The repository is split into three top-level areas. Within each, there is one directory per application/component, and every manifest follows the `<app>-<kind>.yaml` naming convention.
+The repository is organized with one directory per application, containing all necessary Kubernetes resources:
 
 ```
-├── infra/                       # Cluster infrastructure
-│   ├── argocd/                  # GitOps continuous deployment
-│   ├── cert-manager/            # TLS certificate management
-│   ├── cloud-native-postgres/   # PostgreSQL operator
-│   ├── envoy-gateway/           # Kubernetes Gateway API configuration
-│   ├── kubevip/                 # High availability
-│   ├── longhorn/                # Distributed storage
-│   └── metallb/                 # Load balancer
-│
-├── applications/                # Deployed workloads
-│   ├── authentik/               # Identity provider and SSO
-│   ├── azure-ddns-python/       # Dynamic DNS updater
-│   ├── bentopdf/                # PDF conversion
-│   ├── comfyui/                 # Stable Diffusion workflow UI
-│   ├── databasus/               # Database management
-│   ├── excalidraw/              # Whiteboard / diagramming
-│   ├── gitea/                   # Git service
-│   ├── gotify/                  # Push notification server
-│   ├── immich/                  # Photo and video management
-│   ├── infisical/               # Secrets management
-│   ├── it-tools/                # IT utilities
-│   ├── jellyfin/                # Media server
-│   ├── minecraft/               # Game servers
-│   ├── minio-aistor/            # S3-compatible object storage
-│   ├── n8n/                     # Workflow automation
-│   ├── netbootxyz/              # Network boot service
-│   ├── netbox/                  # IPAM and DCIM source of truth
-│   ├── ollama/                  # Local LLM runner
-│   ├── openwebui/               # Web UI for AI models
-│   ├── outline/                 # Knowledge base / wiki
-│   ├── passbolt/                # Password manager
-│   ├── pelican/                 # Game server management panel
-│   ├── proxmox/                 # Virtualization platform
-│   ├── react-resume/            # Resume builder application
-│   ├── searxng/                 # Privacy-respecting search engine
-│   ├── technitium/              # DNS server
-│   ├── truenas/                 # Storage system
-│   ├── unifi/                   # Network controller
-│   ├── uptime-kuma/             # Uptime monitoring
-│   ├── victoria-metrics/        # Metrics and monitoring
-│   ├── wikijs/                  # Documentation wiki
-│   └── zipline/                 # File sharing
-│
+├── argocd/              # GitOps continuous deployment
+├── cert-manager/        # TLS certificate management
+├── metallb/             # Load balancer
+├── kubevip/             # High availability
+├── longhorn/            # Distributed storage
+├── cloud-native-postgres/ # PostgreSQL operator
+├── envoy-gateway/       # Kubernetes Gateway API configuration
+├── infisical/           # Secrets management
+├── authentik/           # Identity provider and SSO
+├── it-tools/            # IT utilities
+├── jellyfin/            # Media server
+├── immich/              # Photo and video management
+├── minecraft/           # Game servers
+├── gitea/               # Git service
+├── jenkins/             # CI/CD automation
+├── n8n/                 # Workflow automation
+├── react-resume/        # Resume builder application
+├── passbolt/            # Password manager
+├── wikijs/              # Documentation wiki
+├── zipline/             # File sharing
+├── gotify/              # Push notification server
+├── ntfy/                # Push notifications
+├── bentopdf/            # PDF conversion
+├── excalidraw/          # Whiteboard / diagramming
+├── searxng/             # Privacy-respecting search engine
+├── uptime-kuma/         # Uptime monitoring
+├── openwebui/           # Web UI for AI models
+├── ollama/              # Local LLM runner
+├── comfyui/             # Stable Diffusion workflow UI
+├── minio-aistor/        # S3-compatible object storage
+├── databasus/           # Database management
+├── netbootxyz/          # Network boot service
+├── technitium/          # DNS server
+├── azure-ddns-python/   # Dynamic DNS updater
+├── victoria-metrics/    # Metrics and monitoring
+├── affine/              # Self-hosted collaborative workspace
+├── harbor/              # Container image registry
+├── pelican/             # Game server management panel
+├── stable-diffusion/    # Stable Diffusion image generation
+├── proxmox/             # Virtualization platform
+├── unifi/               # Network controller
+├── truenas/             # Storage system
 └── deprecated/          # Deprecated applications
 ```
 
@@ -80,11 +79,13 @@ The repository is split into three top-level areas. Within each, there is one di
 - **Stable Diffusion**: Image generation service
 
 ### Self-Hosted Tools
+- **AFFiNE**: Collaborative workspace and note-taking platform
 - **Harbor**: Container image registry
 - **Pelican**: Game server management panel
 
 ### Development & CI/CD
 - **Gitea**: Self-hosted Git service with container registry
+- **Jenkins**: Automation server for CI/CD pipelines
 - **n8n**: Workflow automation platform
 - **MinIO AIStor**: S3-compatible object storage
 
@@ -92,9 +93,9 @@ The repository is split into three top-level areas. Within each, there is one di
 - **React-Resume**: Resume builder with MinIO and PostgreSQL
 - **Passbolt**: Team password manager
 - **Wiki.js**: Modern documentation platform
-- **Outline**: Team knowledge base and wiki (PostgreSQL, Redis/Valkey, MinIO S3, Authentik SSO)
 - **Zipline**: File sharing and screenshot service
 - **Gotify**: Push notification server with REST API and WebSocket support
+- **Ntfy**: Push notification service
 - **BentoPDF**: PDF conversion service
 - **Excalidraw**: Online whiteboard and diagramming tool
 - **SearXNG**: Privacy-respecting metasearch engine
@@ -106,7 +107,6 @@ The repository is split into three top-level areas. Within each, there is one di
 - **Technitium**: DNS server with web interface
 - **Azure DDNS Python**: Dynamic DNS updater for Azure DNS
 - **NetbootXYZ**: Network boot service for OS installation
-- **NetBox**: IPAM and DCIM source of truth for the network
 - **VictoriaMetrics**: Metrics collection and monitoring stack
 
 ### External Service Integration
@@ -118,9 +118,6 @@ The repository is split into three top-level areas. Within each, there is one di
 - **Nginx Ingress Controller**: Replaced by Envoy Gateway; dropped after upstream support ended in March 2025
 - **Psono**: Self-hosted password manager; replaced by Passbolt
 - **Vaultwarden**: Self-hosted Bitwarden server; no longer in use
-- **AFFiNE**: Collaborative workspace and note-taking platform; no longer in use
-- **Jenkins**: CI/CD automation server; no longer in use
-- **Ntfy**: Push notification service; no longer in use
 
 ## Infrastructure
 

applications/authentik/authentik-namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: authentik

applications/authentik/ldap/deployment.yaml

@@ -1,46 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: authentik-ldap
-  namespace: authentik
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: authentik-ldap
-  template:
-    metadata:
-      labels:
-        app: authentik-ldap
-    spec:
-      containers:
-        - name: ldap
-          image: ghcr.io/goauthentik/ldap:2026.8.0
-          ports:
-            - containerPort: 3389
-              name: ldap
-            - containerPort: 6636
-              name: ldaps
-            - containerPort: 9300
-              name: metrics
-          envFrom:
-            - secretRef:
-                name: authentik-ldap-secrets
-          livenessProbe:
-            httpGet:
-              path: /outpost.goauthentik.io/ping
-              port: 9300
-            initialDelaySeconds: 10
-            periodSeconds: 30
-          readinessProbe:
-            httpGet:
-              path: /outpost.goauthentik.io/ping
-              port: 9300
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          resources:
-            requests:
-              cpu: 50m
-              memory: 128Mi
-            limits:
-              memory: 256Mi

applications/authentik/ldap/infisicalsecret.yaml

@@ -1,24 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: authentik-ldap-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/authentik/authentik-ldap"
-        recursive: false
-  managedSecretReference:
-    secretName: authentik-ldap-secrets
-    secretNamespace: authentik
-    secretType: Opaque

applications/authentik/ldap/service.yaml

@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: authentik-ldap
-  namespace: authentik
-spec:
-  selector:
-    app: authentik-ldap
-  ports:
-    - name: ldap
-      port: 3389
-      targetPort: 3389
-    - name: metrics
-      port: 9300
-      targetPort: 9300

applications/authentik/ldap/tcproute.yaml

@@ -1,25 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1alpha2
-kind: TCPRoute
-metadata:
-  name: authentik-ldap
-  namespace: authentik
-spec:
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: gateway-internal
-      namespace: envoy-gateway
-      sectionName: authentik-ldap
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: gateway-internal
-      namespace: envoy-gateway
-      sectionName: authentik-ldaps
-  rules:
-    # The gateway terminates TLS on 636, so both listeners hit the plaintext port
-    - backendRefs:
-        - name: authentik-ldap
-          port: 3389
-          kind: Service
-          group: ""
-          weight: 1

applications/authentik/postgres/infisicalsecret.yaml

@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: authentik-postgres-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/authentik/postgres"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: authentik-postgres-secrets
-    secretNamespace: authentik
-    secretType: Opaque

applications/authentik/server/authentik-server-deployment.yaml

@@ -1,53 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: authentik-server
-  namespace: authentik
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: authentik-server
-  template:
-    metadata:
-      labels:
-        app: authentik-server
-    spec:
-      containers:
-        - name: authentik
-          image: ghcr.io/goauthentik/server:2026.8.0
-          command: ["ak"]
-          args: ["server"]
-          ports:
-            - containerPort: 9000
-              name: http
-            - containerPort: 9443
-              name: https
-          envFrom:
-            - secretRef:
-                name: authentik-app-secrets
-          volumeMounts:
-            - name: data
-              mountPath: /data
-            - name: templates
-              mountPath: /templates
-            - name: dshm
-              mountPath: /dev/shm
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-            limits:
-              memory: 1Gi
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: authentik-server-data
-        - name: templates
-          emptyDir: {}
-        - name: dshm
-          emptyDir:
-            medium: Memory
-            sizeLimit: 512Mi

applications/authentik/server/infisicalsecret.yaml

@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: authentik-app-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/authentik/authentik"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: authentik-app-secrets
-    secretNamespace: authentik
-    secretType: Opaque

applications/authentik/worker/authentik-worker-deployment.yaml

@@ -1,54 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: authentik-worker
-  namespace: authentik
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: authentik-worker
-  template:
-    metadata:
-      labels:
-        app: authentik-worker
-    spec:
-      securityContext:
-        runAsUser: 0
-      containers:
-        - name: authentik
-          image: ghcr.io/goauthentik/server:2026.8.0
-          command: ["ak"]
-          args: ["worker"]
-          envFrom:
-            - secretRef:
-                name: authentik-app-secrets
-          volumeMounts:
-            - name: data
-              mountPath: /data
-            - name: certs
-              mountPath: /certs
-            - name: templates
-              mountPath: /templates
-            - name: dshm
-              mountPath: /dev/shm
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-            limits:
-              memory: 1Gi
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: authentik-worker-data
-        - name: templates
-          emptyDir: {}
-        - name: certs
-          emptyDir: {}
-        - name: dshm
-          emptyDir:
-            medium: Memory
-            sizeLimit: 512Mi

applications/azure-ddns-python/azure-ddns-namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: azure-ddns

applications/azure-ddns-python/azure-ddns/cronjob.yaml

@@ -1,30 +0,0 @@
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: azure-ddns
-  namespace: azure-ddns
-spec:
-  schedule: "*/30 * * * *"
-  concurrencyPolicy: Forbid
-  successfulJobsHistoryLimit: 3
-  failedJobsHistoryLimit: 3
-  startingDeadlineSeconds: 300
-  jobTemplate:
-    spec:
-      backoffLimit: 3
-      template:
-        spec:
-          restartPolicy: OnFailure
-          containers:
-            - name: azure-ddns
-              image: gitea.jsme.be/jeffrey/azure-ddns-python:1.2
-              resources:
-                requests:
-                  cpu: 50m
-                  memory: 128Mi
-                limits:
-                  cpu: 200m
-                  memory: 256Mi
-              envFrom:
-                - secretRef:
-                    name: azure-ddns-app-secrets

applications/azure-ddns-python/azure-ddns/infisicalsecret.yaml

@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: azure-ddns-app-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/azure-ddns/azure-ddns"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: azure-ddns-app-secrets
-    secretNamespace: azure-ddns
-    secretType: Opaque

applications/bentopdf/bentopdf-namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: bentopdf

applications/excalidraw/excalidraw-namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: excalidraw

applications/gitea/gitea/gitea-statefulset.yaml

@@ -1,43 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: gitea
-  namespace: gitea
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: gitea
-  serviceName: gitea
-  template:
-    metadata:
-      labels:
-        app: gitea
-    spec:
-      terminationGracePeriodSeconds: 60
-      containers:
-        - name: gitea
-          image: docker.gitea.com/gitea:1.27.2
-          resources:
-            requests:
-              cpu: 200m
-              memory: 512Mi
-            limits:
-              cpu: 1000m
-              memory: 1Gi
-          ports:
-            - containerPort: 3000
-          volumeMounts:
-            - name: data
-              mountPath: /data
-              subPath: Gitea
-          envFrom:
-            - secretRef:
-                name: gitea-app-secrets
-      restartPolicy: Always
-      volumes: 
-        - name: data  
-          persistentVolumeClaim:
-            claimName: gitea-pvc  
-            
-

applications/gitea/gitea/infisicalsecret.yaml

@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: gitea-app-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/gitea/gitea"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: gitea-app-secrets
-    secretNamespace: gitea
-    secretType: Opaque

applications/gitea/postgres/infisicalsecret.yaml

@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: gitea-postgres-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/gitea/postgres"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: gitea-postgres-secrets
-    secretNamespace: gitea
-    secretType: Opaque

applications/gotify/gotify-namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: gotify

applications/gotify/gotify/infisicalsecret.yaml

@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: gotify-app-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/gotify/gotify"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: gotify-app-secrets
-    secretNamespace: gotify
-    secretType: Opaque

applications/gotify/gotify/statefulset.yaml

@@ -1,41 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: gotify
-  namespace: gotify
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: gotify
-  serviceName: gotify
-  template:
-    metadata:
-      labels:
-        app: gotify
-    spec:
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 10
-      containers:
-        - name: gotify
-          image: gotify/server:3.0.0
-          resources:
-            requests:
-              cpu: 50m
-              memory: 128Mi
-            limits:
-              cpu: 200m
-              memory: 256Mi
-          ports:
-            - containerPort: 80
-              name: http
-          envFrom:
-            - secretRef:
-                name: gotify-app-secrets
-          volumeMounts:
-            - name: data
-              mountPath: /app/data
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: gotify-data-pvc

applications/gotify/postgres/infisicalsecret.yaml

@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: gotify-postgres-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/gotify/postgres"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: gotify-postgres-secrets
-    secretNamespace: gotify
-    secretType: Opaque

applications/immich/immich-namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: immich

applications/immich/immich/immich-statefulset.yaml

@@ -1,40 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  namespace: immich
-  name: immich
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: immich
-  serviceName: immich
-  template:
-    metadata:
-      labels:
-        app: immich
-    spec:
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 60
-      containers:
-      - name: immich
-        image: ghcr.io/immich-app/immich-server:v3.1.0
-        resources:
-          requests:
-            memory: "256Mi"
-            cpu: "250m"
-          limits:
-            memory: "2Gi"
-            cpu: "2000m"
-        ports:
-        - containerPort: 2283
-        envFrom:
-        - secretRef:
-            name: immich-app-secrets
-        volumeMounts:
-        - name: photos
-          mountPath: /data
-      volumes:
-      - name: photos
-        persistentVolumeClaim:
-          claimName: immich-pvc

applications/immich/immich/infisicalsecret.yaml

@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: immich-app-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/immich/immich"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: immich-app-secrets
-    secretNamespace: immich
-    secretType: Opaque

applications/immich/postgres/infisicalsecret.yaml

@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: immich-postgres-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/immich/postgres"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: immich-postgres-secrets
-    secretNamespace: immich
-    secretType: Opaque

applications/infisical/Infisical-secrets/crowdsec-infisicalsecret.yaml

@@ -1,28 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: crowdsec-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/crowdsec"
-        recursive: true
-  managedSecretReference:
-    secretName: crowdsec-secrets
-    secretNamespace: crowdsec
-    secretType: Opaque
-# NOTE: add a secret "bouncer-key" (a long random string, e.g. `openssl rand -hex 32`)
-# under kubernetes / prod / /crowdsec in Infisical. It is shared by:
-#   - CrowdSec LAPI  (pre-registers the "envoy" bouncer via BOUNCER_KEY_envoy)
-#   - the kdwils envoy bouncer (authenticates to LAPI + AppSec)

applications/infisical/infisical/deployment.yaml

@@ -1,72 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: infisical-backend
-  namespace: infisical
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: infisical-backend
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: 0
-  template:
-    metadata:
-      labels:
-        app: infisical-backend
-    spec:
-      # The backend runs DB migrations on startup, so wait for Postgres to be ready.
-      initContainers:
-        - name: wait-for-db
-          image: postgres:14-alpine
-          command:
-            - sh
-            - -c
-            - "until pg_isready -h infisical-postgres -p 5432 -U $POSTGRES_USER; do echo waiting for db; sleep 2; done"
-          env:
-            - name: POSTGRES_USER
-              valueFrom:
-                secretKeyRef:
-                  name: infisical-secrets
-                  key: POSTGRES_USER
-      containers:
-        - name: backend
-          image: infisical/infisical:v0.162.6 # pinned — bump deliberately
-          ports:
-            - containerPort: 8080
-          # ENCRYPTION_KEY, AUTH_SECRET, DB_CONNECTION_URI, REDIS_URL (+ POSTGRES_* — ignored) come from the Secret
-          envFrom:
-            - secretRef:
-                name: infisical-secrets
-          env:
-            - name: NODE_ENV
-              value: production
-            - name: SITE_URL
-              value: https://infisical.jsme.be
-            - name: OTEL_TELEMETRY_COLLECTION_ENABLED
-              value: "false"
-            # Allow Core to reach the in-cluster Kubernetes API (kubernetes.default.svc,
-            # a private ClusterIP) for Kubernetes Auth token review. Off by default (SSRF guard).
-            - name: ALLOW_INTERNAL_IP_CONNECTIONS
-              value: "true"
-          readinessProbe:
-            httpGet:
-              path: /api/status
-              port: 8080
-            initialDelaySeconds: 20
-            periodSeconds: 10
-            failureThreshold: 12
-          livenessProbe:
-            httpGet:
-              path: /api/status
-              port: 8080
-            initialDelaySeconds: 60
-            periodSeconds: 20
-          resources:
-            requests:
-              cpu: 250m
-              memory: 512Mi
-            limits:
-              memory: 1Gi

applications/infisical/infisical/service.yaml

@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: infisical-backend
-  namespace: infisical
-  labels:
-    app: infisical-backend
-spec:
-  selector:
-    app: infisical-backend
-  ports:
-    - name: http
-      port: 8080
-      targetPort: 8080

applications/infisical/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: infisical

applications/infisical/postgres/service.yaml

@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: infisical-postgres
-  namespace: infisical
-  labels:
-    app: infisical-postgres
-spec:
-  selector:
-    app: infisical-postgres
-  ports:
-    - name: postgres
-      port: 5432
-      targetPort: 5432

applications/infisical/postgres/statefulset.yaml

@@ -1,70 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: infisical-postgres
-  namespace: infisical
-spec:
-  serviceName: infisical-postgres
-  replicas: 1
-  selector:
-    matchLabels:
-      app: infisical-postgres
-  template:
-    metadata:
-      labels:
-        app: infisical-postgres
-    spec:
-      containers:
-        - name: postgres
-          image: postgres:14-alpine
-          ports:
-            - containerPort: 5432
-          env:
-            # Keep data in a subdir so an RWO volume's lost+found doesn't block initdb
-            - name: PGDATA
-              value: /var/lib/postgresql/data/pgdata
-            - name: POSTGRES_USER
-              valueFrom:
-                secretKeyRef:
-                  name: infisical-secrets
-                  key: POSTGRES_USER
-            - name: POSTGRES_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: infisical-secrets
-                  key: POSTGRES_PASSWORD
-            - name: POSTGRES_DB
-              valueFrom:
-                secretKeyRef:
-                  name: infisical-secrets
-                  key: POSTGRES_DB
-          volumeMounts:
-            - name: data
-              mountPath: /var/lib/postgresql/data
-          readinessProbe:
-            exec:
-              command: ["sh", "-c", "pg_isready -U $POSTGRES_USER -d $POSTGRES_DB"]
-            initialDelaySeconds: 5
-            periodSeconds: 5
-            timeoutSeconds: 10
-            failureThreshold: 10
-          livenessProbe:
-            exec:
-              command: ["sh", "-c", "pg_isready -U $POSTGRES_USER -d $POSTGRES_DB"]
-            initialDelaySeconds: 30
-            periodSeconds: 15
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-            limits:
-              memory: 512Mi
-  volumeClaimTemplates:
-    - metadata:
-        name: data
-      spec:
-        accessModes: ["ReadWriteOnce"]
-        storageClassName: longhorn
-        resources:
-          requests:
-            storage: 8Gi

applications/infisical/secret.yaml

@@ -1,23 +0,0 @@
-# ⚠️  BOOTSTRAP SECRETS — do NOT commit this file to Git in plaintext.
-# Infisical can't manage its own bootstrap secrets (chicken/egg), so these live
-# in a plain Secret. Manage via SOPS/sealed-secrets or `kubectl create secret`
-# out-of-band. Values below were randomly generated for you.
-#
-#   ENCRYPTION_KEY   : openssl rand -hex 16
-#   AUTH_SECRET      : openssl rand -base64 32
-#
-# DB_CONNECTION_URI password MUST match POSTGRES_PASSWORD.
-apiVersion: v1
-kind: Secret
-metadata:
-  name: infisical-secrets
-  namespace: infisical
-type: Opaque
-stringData:
-  ENCRYPTION_KEY: ""
-  AUTH_SECRET: ""
-  POSTGRES_USER: ""
-  POSTGRES_PASSWORD: ""
-  POSTGRES_DB: ""
-  DB_CONNECTION_URI: ""
-  REDIS_URL: ""

applications/infisical/serviceaccounts.yaml

@@ -1,63 +0,0 @@
-# Kubernetes-native auth for the InfisicalSecret operator.
-# infisical-auth: the identity the CRDs mint short-lived tokens for.
-# infisical-token-reviewer: its JWT is pasted into Infisical's Kubernetes Auth
-# config so Infisical can call TokenReview. Bound to system:auth-delegator below.
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: infisical-auth
-  namespace: infisical
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: infisical-token-reviewer
-  namespace: infisical
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: infisical-token-reviewer
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: system:auth-delegator
-subjects:
-  - kind: ServiceAccount
-    name: infisical-token-reviewer
-    namespace: infisical
----
-# The operator needs to mint tokens for infisical-auth; without this it falls
-# back to the legacy SA .secrets[] lookup and never gets a token.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: infisical-operator-token-creator
-rules:
-  - apiGroups: [""]
-    resources: ["serviceaccounts/token"]
-    verbs: ["create"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: infisical-operator-token-creator
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: infisical-operator-token-creator
-subjects:
-  - kind: ServiceAccount
-    name: infisical-opera-controller-manager
-    namespace: infisical-operator
----
-# Long-lived token for the reviewer SA. `kubectl create token` expires; the
-# value pasted into Infisical's Kubernetes Auth config must not.
-apiVersion: v1
-kind: Secret
-metadata:
-  name: infisical-token-reviewer
-  namespace: infisical
-  annotations:
-    kubernetes.io/service-account.name: infisical-token-reviewer
-type: kubernetes.io/service-account-token

applications/infisical/valkey/service.yaml

@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: infisical-valkey
-  namespace: infisical
-  labels:
-    app: infisical-valkey
-spec:
-  selector:
-    app: infisical-valkey
-  ports:
-    - name: valkey
-      port: 6379
-      targetPort: 6379

applications/infisical/valkey/statefulset.yaml

@@ -1,46 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: infisical-valkey
-  namespace: infisical
-spec:
-  serviceName: infisical-valkey
-  replicas: 1
-  selector:
-    matchLabels:
-      app: infisical-valkey
-  template:
-    metadata:
-      labels:
-        app: infisical-valkey
-    spec:
-      containers:
-        - name: valkey
-          # Valkey is a drop-in, Redis-protocol-compatible replacement for Redis.
-          image: valkey/valkey:8-alpine
-          args: ["--appendonly", "yes"]
-          ports:
-            - containerPort: 6379
-          volumeMounts:
-            - name: data
-              mountPath: /data
-          readinessProbe:
-            exec:
-              command: ["valkey-cli", "ping"]
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          resources:
-            requests:
-              cpu: 50m
-              memory: 64Mi
-            limits:
-              memory: 256Mi
-  volumeClaimTemplates:
-    - metadata:
-        name: data
-      spec:
-        accessModes: ["ReadWriteOnce"]
-        storageClassName: longhorn
-        resources:
-          requests:
-            storage: 1Gi

applications/it-tools/it-tools-namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: it-tools

applications/jellyfin/jellyfin-namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: jellyfin

applications/minio-aistor/minio-aistor-namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: minio-aistor

applications/netbootxyz/netbootxyz-namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: netbootxyz

applications/netbox/housekeeping/cronjob.yaml

@@ -1,37 +0,0 @@
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  namespace: netbox
-  name: netbox-housekeeping
-spec:
-  schedule: "15 3 * * *"
-  concurrencyPolicy: Forbid
-  successfulJobsHistoryLimit: 3
-  failedJobsHistoryLimit: 3
-  jobTemplate:
-    spec:
-      backoffLimit: 2
-      template:
-        spec:
-          restartPolicy: OnFailure
-          securityContext:
-            runAsUser: 999
-            runAsGroup: 0
-            fsGroup: 0
-          containers:
-            - name: netbox-housekeeping
-              image: netboxcommunity/netbox:v4.6.8-5.0.2
-              args:
-                - /opt/netbox/venv/bin/python
-                - /opt/netbox/netbox/manage.py
-                - housekeeping
-              resources:
-                requests:
-                  memory: "128Mi"
-                  cpu: "50m"
-                limits:
-                  memory: "512Mi"
-                  cpu: "500m"
-              envFrom:
-                - secretRef:
-                    name: netbox-app-secrets

applications/netbox/netbox-httproute.yaml

@@ -1,46 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: netbox-route
-  namespace: netbox
-spec:
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: gateway-internal
-      namespace: envoy-gateway
-      sectionName: netbox
-  hostnames:
-    - "netbox.jsme.be"
-  rules:
-    - matches:
-        - path:
-            type: PathPrefix
-            value: /
-      filters:
-        - type: RequestHeaderModifier
-          requestHeaderModifier:
-            set:
-              - name: X-Forwarded-Host
-                value: "netbox.jsme.be"
-              - name: X-Forwarded-Proto
-                value: https
-        - type: ResponseHeaderModifier
-          responseHeaderModifier:
-            set:
-              - name: Strict-Transport-Security
-                value: "max-age=31536000; includeSubDomains"
-              - name: X-Content-Type-Options
-                value: nosniff
-              - name: X-Frame-Options
-                value: SAMEORIGIN
-              - name: Referrer-Policy
-                value: strict-origin-when-cross-origin
-              - name: Permissions-Policy
-                value: "camera=(), microphone=(), geolocation=(), payment=()"
-      backendRefs:
-        - name: netbox
-          port: 8080
-          kind: Service
-          group: ""
-          weight: 1

applications/netbox/netbox-namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: netbox

applications/netbox/netbox/deployment.yaml

@@ -1,82 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  namespace: netbox
-  name: netbox
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: netbox
-  template:
-    metadata:
-      labels:
-        app: netbox
-    spec:
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 60
-      securityContext:
-        runAsUser: 999
-        runAsGroup: 0
-        fsGroup: 0
-      containers:
-        - name: netbox
-          image: netboxcommunity/netbox:v4.6.8-5.0.2
-          resources:
-            requests:
-              memory: "512Mi"
-              cpu: "250m"
-            limits:
-              memory: "2Gi"
-              cpu: "2000m"
-          ports:
-            - containerPort: 8080
-          envFrom:
-            - secretRef:
-                name: netbox-app-secrets
-          volumeMounts:
-            - name: netbox-data
-              mountPath: /opt/netbox/netbox/media
-              subPath: media
-            - name: netbox-data
-              mountPath: /opt/netbox/netbox/reports
-              subPath: reports
-            - name: netbox-data
-              mountPath: /opt/netbox/netbox/scripts
-              subPath: scripts
-          startupProbe:
-            httpGet:
-              path: /login/
-              port: 8080
-              # Django rejects the pod IP as a Host header (ALLOWED_HOSTS).
-              httpHeaders:
-                - name: Host
-                  value: netbox.jsme.be
-            periodSeconds: 10
-            # Generous: the entrypoint runs migrations before granian binds.
-            failureThreshold: 60
-          readinessProbe:
-            httpGet:
-              path: /login/
-              port: 8080
-              # Django rejects the pod IP as a Host header (ALLOWED_HOSTS).
-              httpHeaders:
-                - name: Host
-                  value: netbox.jsme.be
-            periodSeconds: 15
-          livenessProbe:
-            httpGet:
-              path: /login/
-              port: 8080
-              # Django rejects the pod IP as a Host header (ALLOWED_HOSTS).
-              httpHeaders:
-                - name: Host
-                  value: netbox.jsme.be
-            periodSeconds: 30
-            failureThreshold: 5
-      volumes:
-        - name: netbox-data
-          persistentVolumeClaim:
-            claimName: netbox-data-pvc

applications/netbox/netbox/infisicalsecret.yaml

@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: netbox-app-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/netbox/netbox"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: netbox-app-secrets
-    secretNamespace: netbox
-    secretType: Opaque

applications/netbox/netbox/persistentvolumeclaim.yaml

@@ -1,13 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  namespace: netbox
-  name: netbox-data-pvc
-spec:
-  # RWX: shared by the web pod and the rqworker pod.
-  accessModes:
-    - ReadWriteMany
-  storageClassName: longhorn-static
-  resources:
-    requests:
-      storage: 5Gi

applications/netbox/netbox/service.yaml

@@ -1,13 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  namespace: netbox
-  name: netbox
-spec:
-  selector:
-    app: netbox
-  ports:
-    - protocol: TCP
-      port: 8080
-      targetPort: 8080
-  type: ClusterIP

applications/netbox/postgres/infisicalsecret.yaml

@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: netbox-postgres-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/netbox/postgres"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: netbox-postgres-secrets
-    secretNamespace: netbox
-    secretType: Opaque

applications/netbox/postgres/persistentvolumeclaim.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  namespace: netbox
-  name: netbox-postgres-pvc
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn-static
-  resources:
-    requests:
-      storage: 10Gi

applications/netbox/postgres/service.yaml

@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: netbox-postgres
-  namespace: netbox
-spec:
-  selector:
-    app: netbox-postgres
-  type: ClusterIP
-  ports:
-    - name: netbox-postgres-port
-      protocol: TCP
-      port: 5432
-      targetPort: 5432

applications/netbox/postgres/statefulset.yaml

@@ -1,45 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  namespace: netbox
-  name: netbox-postgres
-spec:
-  replicas: 1
-  serviceName: netbox-postgres
-  selector:
-    matchLabels:
-      app: netbox-postgres
-  template:
-    metadata:
-      labels:
-        app: netbox-postgres
-    spec:
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 60
-      containers:
-        - name: netbox-postgres
-          image: postgres:18
-          resources:
-            requests:
-              memory: "256Mi"
-              cpu: "100m"
-            limits:
-              memory: "1Gi"
-              cpu: "1000m"
-          ports:
-            - containerPort: 5432
-          volumeMounts:
-            - name: netbox-postgres-data
-              mountPath: /var/lib/postgresql/data
-          envFrom:
-            - secretRef:
-                name: netbox-postgres-secrets
-          readinessProbe:
-            exec:
-              command: ["sh", "-c", "pg_isready -q -U \"$POSTGRES_USER\" -d \"$POSTGRES_DB\""]
-            initialDelaySeconds: 10
-            periodSeconds: 10
-      volumes:
-        - name: netbox-postgres-data
-          persistentVolumeClaim:
-            claimName: netbox-postgres-pvc

applications/netbox/redis-cache/deployment.yaml

@@ -1,38 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  namespace: netbox
-  name: netbox-redis-cache
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: netbox-redis-cache
-  template:
-    metadata:
-      labels:
-        app: netbox-redis-cache
-    spec:
-      restartPolicy: Always
-      containers:
-        - name: netbox-redis-cache
-          image: valkey/valkey:9.1-alpine
-          # Cache only: no persistence, contents are disposable.
-          command: ["sh", "-c", "exec valkey-server --requirepass \"$REDIS_PASSWORD\""]
-          resources:
-            requests:
-              memory: "64Mi"
-              cpu: "50m"
-            limits:
-              memory: "256Mi"
-              cpu: "200m"
-          ports:
-            - containerPort: 6379
-          envFrom:
-            - secretRef:
-                name: netbox-redis-cache-secrets
-          readinessProbe:
-            exec:
-              command: ["sh", "-c", "valkey-cli --pass \"$REDIS_PASSWORD\" ping | grep -q PONG"]
-            initialDelaySeconds: 5
-            periodSeconds: 10

applications/netbox/redis-cache/infisicalsecret.yaml

@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: netbox-redis-cache-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/netbox/redis-cache"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: netbox-redis-cache-secrets
-    secretNamespace: netbox
-    secretType: Opaque

applications/netbox/redis-cache/service.yaml

@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: netbox-redis-cache
-  namespace: netbox
-spec:
-  selector:
-    app: netbox-redis-cache
-  type: ClusterIP
-  ports:
-    - name: netbox-redis-cache-port
-      protocol: TCP
-      port: 6379
-      targetPort: 6379

applications/netbox/redis/infisicalsecret.yaml

@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: netbox-redis-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/netbox/redis"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: netbox-redis-secrets
-    secretNamespace: netbox
-    secretType: Opaque

applications/netbox/redis/persistentvolumeclaim.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  namespace: netbox
-  name: netbox-redis-pvc
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn-static
-  resources:
-    requests:
-      storage: 1Gi

applications/netbox/redis/service.yaml

@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: netbox-redis
-  namespace: netbox
-spec:
-  selector:
-    app: netbox-redis
-  type: ClusterIP
-  ports:
-    - name: netbox-redis-port
-      protocol: TCP
-      port: 6379
-      targetPort: 6379

applications/netbox/redis/statefulset.yaml

@@ -1,46 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  namespace: netbox
-  name: netbox-redis
-spec:
-  replicas: 1
-  serviceName: netbox-redis
-  selector:
-    matchLabels:
-      app: netbox-redis
-  template:
-    metadata:
-      labels:
-        app: netbox-redis
-    spec:
-      restartPolicy: Always
-      containers:
-        - name: netbox-redis
-          image: valkey/valkey:9.1-alpine
-          # Task queue: appendonly so queued background jobs survive a restart.
-          command: ["sh", "-c", "exec valkey-server --appendonly yes --requirepass \"$REDIS_PASSWORD\""]
-          resources:
-            requests:
-              memory: "64Mi"
-              cpu: "50m"
-            limits:
-              memory: "256Mi"
-              cpu: "200m"
-          ports:
-            - containerPort: 6379
-          envFrom:
-            - secretRef:
-                name: netbox-redis-secrets
-          volumeMounts:
-            - name: netbox-redis-data
-              mountPath: /data
-          readinessProbe:
-            exec:
-              command: ["sh", "-c", "valkey-cli --pass \"$REDIS_PASSWORD\" ping | grep -q PONG"]
-            initialDelaySeconds: 5
-            periodSeconds: 10
-      volumes:
-        - name: netbox-redis-data
-          persistentVolumeClaim:
-            claimName: netbox-redis-pvc

applications/netbox/worker/deployment.yaml

@@ -1,54 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  namespace: netbox
-  name: netbox-worker
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: netbox-worker
-  template:
-    metadata:
-      labels:
-        app: netbox-worker
-    spec:
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 60
-      securityContext:
-        runAsUser: 999
-        runAsGroup: 0
-        fsGroup: 0
-      containers:
-        - name: netbox-worker
-          image: netboxcommunity/netbox:v4.6.8-5.0.2
-          # Overrides CMD only, so tini stays the entrypoint and migrations
-          # are left to the web pod.
-          args:
-            - /opt/netbox/venv/bin/python
-            - /opt/netbox/netbox/manage.py
-            - rqworker
-          resources:
-            requests:
-              memory: "256Mi"
-              cpu: "100m"
-            limits:
-              memory: "1Gi"
-              cpu: "1000m"
-          envFrom:
-            - secretRef:
-                name: netbox-app-secrets
-          volumeMounts:
-            - name: netbox-data
-              mountPath: /opt/netbox/netbox/media
-              subPath: media
-            - name: netbox-data
-              mountPath: /opt/netbox/netbox/reports
-              subPath: reports
-            - name: netbox-data
-              mountPath: /opt/netbox/netbox/scripts
-              subPath: scripts
-      volumes:
-        - name: netbox-data
-          persistentVolumeClaim:
-            claimName: netbox-data-pvc

applications/outline/outline-namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: outline

applications/outline/outline/infisicalsecret.yaml

@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: outline-app-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/outline/outline"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: outline-app-secrets
-    secretNamespace: outline
-    secretType: Opaque

applications/outline/outline/outline-deployment.yaml

@@ -1,32 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  namespace: outline
-  name: outline
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: outline
-  template:
-    metadata:
-      labels:
-        app: outline
-    spec:
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 60
-      containers:
-        - name: outline
-          image: docker.getoutline.com/outlinewiki/outline:1.9.2
-          resources:
-            requests:
-              memory: "512Mi"
-              cpu: "250m"
-            limits:
-              memory: "2Gi"
-              cpu: "2000m"
-          ports:
-            - containerPort: 3000
-          envFrom:
-            - secretRef:
-                name: outline-app-secrets

applications/outline/outline/outline-httproute.yaml

@@ -1,51 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: outline-route
-  namespace: outline
-spec:
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: gateway-internal
-      namespace: envoy-gateway
-      sectionName: outline
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: gateway-public
-      namespace: envoy-gateway
-      sectionName: outline
-  hostnames:
-    - "outline.jsme.be"
-  rules:
-    - matches:
-        - path:
-            type: PathPrefix
-            value: /
-      filters:
-        - type: RequestHeaderModifier
-          requestHeaderModifier:
-            set:
-              - name: X-Forwarded-Host
-                value: "outline.jsme.be"
-              - name: X-Forwarded-Proto
-                value: https
-        - type: ResponseHeaderModifier
-          responseHeaderModifier:
-            set:
-              - name: Strict-Transport-Security
-                value: "max-age=31536000; includeSubDomains"
-              - name: X-Content-Type-Options
-                value: nosniff
-              - name: X-Frame-Options
-                value: SAMEORIGIN
-              - name: Referrer-Policy
-                value: strict-origin-when-cross-origin
-              - name: Permissions-Policy
-                value: "camera=(), microphone=(), geolocation=(), payment=()"
-      backendRefs:
-        - name: outline
-          port: 3000
-          kind: Service
-          group: ""
-          weight: 1

applications/outline/outline/outline-service.yaml

@@ -1,13 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  namespace: outline
-  name: outline
-spec:
-  selector:
-    app: outline
-  ports:
-    - protocol: TCP
-      port: 3000
-      targetPort: 3000
-  type: ClusterIP

applications/outline/postgres/infisicalsecret.yaml

@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: outline-postgres-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/outline/postgres"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: outline-postgres-secrets
-    secretNamespace: outline
-    secretType: Opaque

applications/outline/postgres/outline-postgres-service.yaml

@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: outline-postgres
-  namespace: outline
-spec:
-  selector:
-    app: outline-postgres
-  type: ClusterIP
-  ports:
-    - name: outline-postgres-port
-      protocol: TCP
-      port: 5432
-      targetPort: 5432

applications/outline/postgres/outline-postgres-statefulset.yaml

@@ -1,40 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  namespace: outline
-  name: outline-postgres
-spec:
-  replicas: 1
-  serviceName: outline-postgres
-  selector:
-    matchLabels:
-      app: outline-postgres
-  template:
-    metadata:
-      labels:
-        app: outline-postgres
-    spec:
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 60
-      containers:
-        - name: outline-postgres
-          image: postgres:18
-          resources:
-            requests:
-              memory: "256Mi"
-              cpu: "100m"
-            limits:
-              memory: "1Gi"
-              cpu: "500m"
-          ports:
-            - containerPort: 5432
-          volumeMounts:
-            - name: outline-postgres-data
-              mountPath: /var/lib/postgresql/data
-          envFrom:
-            - secretRef:
-                name: outline-postgres-secrets
-      volumes:
-        - name: outline-postgres-data
-          persistentVolumeClaim:
-            claimName: outline-postgres-pvc

applications/outline/redis/outline-redis-deployment.yaml

@@ -1,28 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  namespace: outline
-  name: outline-redis
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: outline-redis
-  template:
-    metadata:
-      labels:
-        app: outline-redis
-    spec:
-      restartPolicy: Always
-      containers:
-        - name: outline-redis
-          image: valkey/valkey:9
-          resources:
-            requests:
-              memory: "64Mi"
-              cpu: "50m"
-            limits:
-              memory: "256Mi"
-              cpu: "200m"
-          ports:
-            - containerPort: 6379

applications/outline/redis/outline-redis-service.yaml

@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: outline-redis
-  namespace: outline
-spec:
-  selector:
-    app: outline-redis
-  type: ClusterIP
-  ports:
-    - name: outline-redis-port
-      protocol: TCP
-      port: 6379
-      targetPort: 6379

applications/passbolt/mariadb/infisicalsecret.yaml

@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: passbolt-mariadb-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/passbolt/mariadb"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: passbolt-mariadb-secrets
-    secretNamespace: passbolt
-    secretType: Opaque

applications/passbolt/passbolt-namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: passbolt

applications/passbolt/passbolt/infisicalsecret.yaml

@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: passbolt-app-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/passbolt/passbolt"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: passbolt-app-secrets
-    secretNamespace: passbolt
-    secretType: Opaque

applications/passbolt/passbolt/passbolt-statefulset.yaml

@@ -1,52 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  namespace: passbolt
-  name: passbolt
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: passbolt
-  serviceName: passbolt
-  template:
-    metadata:
-      labels:
-        app: passbolt
-    spec:
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 10
-      containers:
-        - name: passbolt
-          image: passbolt/passbolt:latest-ce
-          resources:
-            requests:
-              cpu: 200m
-              memory: 512Mi
-            limits:
-              cpu: 1000m
-              memory: 1Gi
-          volumeMounts:
-            - name: gpg-volume
-              mountPath: /etc/passbolt/gpg
-            - name: jwt-volume
-              mountPath: /etc/passbolt/jwt
-            - name: nginx-ssl
-              mountPath: /etc/nginx/snippets/passbolt-ssl.conf
-              subPath: passbolt-ssl.conf
-          ports:
-            - containerPort: 80
-          envFrom:
-            - secretRef:
-                name: passbolt-app-secrets
-      volumes:
-        - name: gpg-volume
-          persistentVolumeClaim:
-            claimName: passbolt-gpg-pvc
-        - name: jwt-volume
-          persistentVolumeClaim:
-            claimName: passbolt-jwt-pvc
-        - name: nginx-ssl
-          configMap:
-            name: passbolt-nginx-ssl
-

applications/pelican/pelican-namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: pelican

applications/pelican/pelican-wings-ark-httproute.yaml

@@ -1,30 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: wings-ark-route
-  namespace: pelican
-spec:
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: gateway-internal
-      namespace: envoy-gateway
-      sectionName: wings-ark
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: gateway-public
-      namespace: envoy-gateway
-      sectionName: wings-ark
-  hostnames:
-    - "wings-ark.jsme.be"
-  rules:
-    - matches:
-        - path:
-            type: PathPrefix
-            value: /
-      backendRefs:
-        - name: wings-ark
-          port: 8080
-          kind: Service
-          group: ""
-          weight: 1

applications/pelican/pelican-wings-ark-service.yaml

@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: wings-ark
-  namespace: pelican
-spec:
-  ports:
-    - protocol: TCP
-      port: 8080
-      targetPort: 8080
-  type: ClusterIP

applications/pelican/pelican/infisicalsecret.yaml

@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: pelican-app-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/pelican/pelican"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: pelican-app-secrets
-    secretNamespace: pelican
-    secretType: Opaque

applications/pelican/postgres/infisicalsecret.yaml

@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: pelican-postgres-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/pelican/postgres"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: pelican-postgres-secrets
-    secretNamespace: pelican
-    secretType: Opaque

applications/proxmox/proxmox-namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: proxmox

applications/react-resume/chrome/infisicalsecret.yaml

@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: resume-chrome-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/reactive_resume/chrome"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: resume-chrome-secrets
-    secretNamespace: resume
-    secretType: Opaque

applications/react-resume/chrome/react-resume-chrome-deployment.yaml

@@ -1,25 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: chrome
-  namespace: resume
-  labels:
-    app: chrome
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: chrome
-  template:
-    metadata:
-      labels:
-        app: chrome
-    spec:
-      containers:
-      - name: chrome
-        image: ghcr.io/browserless/chromium:latest
-        ports:
-        - containerPort: 3000
-        envFrom:
-          - secretRef:
-              name: resume-chrome-secrets

applications/react-resume/postgres/infisicalsecret.yaml

@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: resume-postgres-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/reactive_resume/postgres"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: resume-postgres-secrets
-    secretNamespace: resume
-    secretType: Opaque

applications/react-resume/resume-namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: resume

applications/react-resume/resume/infisicalsecret.yaml

@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: resume-app-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/reactive_resume/resume"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: resume-app-secrets
-    secretNamespace: resume
-    secretType: Opaque

applications/react-resume/resume/react-resume-deployment.yaml

@@ -1,32 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  namespace: resume
-  name: resume
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: resume
-  template:
-    metadata:
-      labels:
-        app: resume
-    spec:
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 10
-      containers:
-        - name: resume
-          image: ghcr.io/amruthpillai/reactive-resume:v5.0
-          ports:
-            - containerPort: 3000
-          resources:
-            limits:
-              cpu: "1000m"
-              memory: "2Gi"
-            requests:
-              cpu: "500m"
-              memory: "1Gi"
-          envFrom:
-            - secretRef:
-                name: resume-app-secrets

applications/searxng/searxng-namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: searxng

applications/searxng/searxng/infisicalsecret.yaml

@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: searxng-app-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/searxng/searxng"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: searxng-app-secrets
-    secretNamespace: searxng
-    secretType: Opaque

applications/technitium/technitium-namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: technitium

applications/truenas/truenas-namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: truenas

applications/unifi/unifi-namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: unifi

applications/uptime-kuma/mariadb/infisicalsecret.yaml

@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: uptime-kuma-mariadb-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/uptime-kuma/mariadb"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: uptime-kuma-mariadb-secrets
-    secretNamespace: uptime-kuma
-    secretType: Opaque

applications/uptime-kuma/uptime-kuma-namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: uptime-kuma

applications/uptime-kuma/uptime-kuma/infisicalsecret.yaml

@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: uptime-kuma-app-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/uptime-kuma/uptime-kuma"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: uptime-kuma-app-secrets
-    secretNamespace: uptime-kuma
-    secretType: Opaque

applications/uptime-kuma/uptime-kuma/statefulset.yaml

@@ -1,42 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: uptime-kuma
-  namespace: uptime-kuma
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: uptime-kuma
-  serviceName: uptime-kuma
-  template:
-    metadata:
-      labels:
-        app: uptime-kuma
-    spec:
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 10
-      containers:
-        - name: uptime-kuma
-          image: louislam/uptime-kuma:2.5.3
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-            limits:
-              cpu: 500m
-              memory: 512Mi
-          ports:
-            - containerPort: 3001
-              name: http
-          # DATABASE_HOST/PORT/NAME/USERNAME/PASSWORD come from the Secret.
-          envFrom:
-            - secretRef:
-                name: uptime-kuma-app-secrets
-          volumeMounts:
-            - name: data
-              mountPath: /app/data
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: uptime-kuma-pvc

applications/victoria-metrics/victoria-metrics-namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: victoria-metrics

applications/zipline/postgres/infisicalsecret.yaml

@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: zipline-postgres-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/zipline/postgres"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: zipline-postgres-secrets
-    secretNamespace: zipline
-    secretType: Opaque

applications/zipline/zipline-namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: zipline

applications/zipline/zipline/infisicalsecret.yaml

@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: zipline-app-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/zipline/zipline"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: zipline-app-secrets
-    secretNamespace: zipline
-    secretType: Opaque

argocd/applications/authentik.yaml

@@ -7,7 +7,7 @@ spec:
   project: default
   source:
     repoURL: https://gitea.jsme.be/Jeffrey/Kubernetes-Manifests.git
-    path: applications/authentik
+    path: authentik
     targetRevision: main
     directory:
       recurse: true
@@ -19,4 +19,5 @@ spec:
       prune: true
       selfHeal: true
     syncOptions:
+      - CreateNamespace=true
       - ServerSideApply=true