Move affine to deprecated

Up resource usage
Fix Env variables
2026-06-21 10:22:47 +02:00 · 2026-06-20 17:51:59 +02:00 · 2026-06-20 17:23:41 +02:00 · 2026-06-20 17:08:14 +02:00 · 2026-06-20 15:07:47 +00:00 · 2026-06-18 21:41:43 +02:00
490 changed files with 1724 additions and 3327 deletions
@@ -6,52 +6,51 @@ All applications are managed using GitOps principles with ArgoCD and utilize cer

 ## Repository Structure

-The repository is split into three top-level areas. Within each, there is one directory per application/component, and every manifest follows the `<app>-<kind>.yaml` naming convention.
+The repository is organized with one directory per application, containing all necessary Kubernetes resources:

 ```
-├── infra/                       # Cluster infrastructure
-│   ├── argocd/                  # GitOps continuous deployment
-│   ├── cert-manager/            # TLS certificate management
-│   ├── cloud-native-postgres/   # PostgreSQL operator
-│   ├── envoy-gateway/           # Kubernetes Gateway API configuration
-│   ├── kubevip/                 # High availability
-│   ├── longhorn/                # Distributed storage
-│   └── metallb/                 # Load balancer
-│
-├── applications/                # Deployed workloads
-│   ├── authentik/               # Identity provider and SSO
-│   ├── azure-ddns-python/       # Dynamic DNS updater
-│   ├── bentopdf/                # PDF conversion
-│   ├── comfyui/                 # Stable Diffusion workflow UI
-│   ├── databasus/               # Database management
-│   ├── excalidraw/              # Whiteboard / diagramming
-│   ├── gitea/                   # Git service
-│   ├── gotify/                  # Push notification server
-│   ├── immich/                  # Photo and video management
-│   ├── infisical/               # Secrets management
-│   ├── it-tools/                # IT utilities
-│   ├── jellyfin/                # Media server
-│   ├── minecraft/               # Game servers
-│   ├── minio-aistor/            # S3-compatible object storage
-│   ├── n8n/                     # Workflow automation
-│   ├── netbootxyz/              # Network boot service
-│   ├── netbox/                  # IPAM and DCIM source of truth
-│   ├── ollama/                  # Local LLM runner
-│   ├── openwebui/               # Web UI for AI models
-│   ├── outline/                 # Knowledge base / wiki
-│   ├── passbolt/                # Password manager
-│   ├── pelican/                 # Game server management panel
-│   ├── proxmox/                 # Virtualization platform
-│   ├── react-resume/            # Resume builder application
-│   ├── searxng/                 # Privacy-respecting search engine
-│   ├── technitium/              # DNS server
-│   ├── truenas/                 # Storage system
-│   ├── unifi/                   # Network controller
-│   ├── uptime-kuma/             # Uptime monitoring
-│   ├── victoria-metrics/        # Metrics and monitoring
-│   ├── wikijs/                  # Documentation wiki
-│   └── zipline/                 # File sharing
-│
+├── argocd/              # GitOps continuous deployment
+├── cert-manager/        # TLS certificate management
+├── metallb/             # Load balancer
+├── kubevip/             # High availability
+├── longhorn/            # Distributed storage
+├── cloud-native-postgres/ # PostgreSQL operator
+├── envoy-gateway/       # Kubernetes Gateway API configuration
+├── infisical/           # Secrets management
+├── authentik/           # Identity provider and SSO
+├── it-tools/            # IT utilities
+├── jellyfin/            # Media server
+├── immich/              # Photo and video management
+├── minecraft/           # Game servers
+├── gitea/               # Git service
+├── jenkins/             # CI/CD automation
+├── n8n/                 # Workflow automation
+├── react-resume/        # Resume builder application
+├── passbolt/            # Password manager
+├── wikijs/              # Documentation wiki
+├── zipline/             # File sharing
+├── gotify/              # Push notification server
+├── ntfy/                # Push notifications
+├── bentopdf/            # PDF conversion
+├── excalidraw/          # Whiteboard / diagramming
+├── searxng/             # Privacy-respecting search engine
+├── uptime-kuma/         # Uptime monitoring
+├── openwebui/           # Web UI for AI models
+├── ollama/              # Local LLM runner
+├── comfyui/             # Stable Diffusion workflow UI
+├── minio-aistor/        # S3-compatible object storage
+├── databasus/           # Database management
+├── netbootxyz/          # Network boot service
+├── technitium/          # DNS server
+├── azure-ddns-python/   # Dynamic DNS updater
+├── victoria-metrics/    # Metrics and monitoring
+├── affine/              # Self-hosted collaborative workspace
+├── harbor/              # Container image registry
+├── pelican/             # Game server management panel
+├── stable-diffusion/    # Stable Diffusion image generation
+├── proxmox/             # Virtualization platform
+├── unifi/               # Network controller
+├── truenas/             # Storage system
 └── deprecated/          # Deprecated applications
 ```

@@ -80,11 +79,13 @@ The repository is split into three top-level areas. Within each, there is one di
 - **Stable Diffusion**: Image generation service

 ### Self-Hosted Tools
+- **AFFiNE**: Collaborative workspace and note-taking platform
 - **Harbor**: Container image registry
 - **Pelican**: Game server management panel

 ### Development & CI/CD
 - **Gitea**: Self-hosted Git service with container registry
+- **Jenkins**: Automation server for CI/CD pipelines
 - **n8n**: Workflow automation platform
 - **MinIO AIStor**: S3-compatible object storage

@@ -92,9 +93,9 @@ The repository is split into three top-level areas. Within each, there is one di
 - **React-Resume**: Resume builder with MinIO and PostgreSQL
 - **Passbolt**: Team password manager
 - **Wiki.js**: Modern documentation platform
- **Outline**: Team knowledge base and wiki (PostgreSQL, Redis/Valkey, MinIO S3, Authentik SSO)
 - **Zipline**: File sharing and screenshot service
 - **Gotify**: Push notification server with REST API and WebSocket support
+- **Ntfy**: Push notification service
 - **BentoPDF**: PDF conversion service
 - **Excalidraw**: Online whiteboard and diagramming tool
 - **SearXNG**: Privacy-respecting metasearch engine
@@ -106,7 +107,6 @@ The repository is split into three top-level areas. Within each, there is one di
 - **Technitium**: DNS server with web interface
 - **Azure DDNS Python**: Dynamic DNS updater for Azure DNS
 - **NetbootXYZ**: Network boot service for OS installation
- **NetBox**: IPAM and DCIM source of truth for the network
 - **VictoriaMetrics**: Metrics collection and monitoring stack

 ### External Service Integration
@@ -118,9 +118,6 @@ The repository is split into three top-level areas. Within each, there is one di
 - **Nginx Ingress Controller**: Replaced by Envoy Gateway; dropped after upstream support ended in March 2025
 - **Psono**: Self-hosted password manager; replaced by Passbolt
 - **Vaultwarden**: Self-hosted Bitwarden server; no longer in use
- **AFFiNE**: Collaborative workspace and note-taking platform; no longer in use
- **Jenkins**: CI/CD automation server; no longer in use
- **Ntfy**: Push notification service; no longer in use

 ## Infrastructure

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: authentik
@@ -1,46 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: authentik-ldap
-  namespace: authentik
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: authentik-ldap
-  template:
-    metadata:
-      labels:
-        app: authentik-ldap
-    spec:
-      containers:
-        - name: ldap
-          image: ghcr.io/goauthentik/ldap:2026.8.0
-          ports:
-            - containerPort: 3389
-              name: ldap
-            - containerPort: 6636
-              name: ldaps
-            - containerPort: 9300
-              name: metrics
-          envFrom:
-            - secretRef:
-                name: authentik-ldap-secrets
-          livenessProbe:
-            httpGet:
-              path: /outpost.goauthentik.io/ping
-              port: 9300
-            initialDelaySeconds: 10
-            periodSeconds: 30
-          readinessProbe:
-            httpGet:
-              path: /outpost.goauthentik.io/ping
-              port: 9300
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          resources:
-            requests:
-              cpu: 50m
-              memory: 128Mi
-            limits:
-              memory: 256Mi
@@ -1,24 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: authentik-ldap-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/authentik/authentik-ldap"
-        recursive: false
-  managedSecretReference:
-    secretName: authentik-ldap-secrets
-    secretNamespace: authentik
-    secretType: Opaque
@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: authentik-ldap
-  namespace: authentik
-spec:
-  selector:
-    app: authentik-ldap
-  ports:
-    - name: ldap
-      port: 3389
-      targetPort: 3389
-    - name: metrics
-      port: 9300
-      targetPort: 9300
@@ -1,25 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1alpha2
-kind: TCPRoute
-metadata:
-  name: authentik-ldap
-  namespace: authentik
-spec:
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: gateway-internal
-      namespace: envoy-gateway
-      sectionName: authentik-ldap
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: gateway-internal
-      namespace: envoy-gateway
-      sectionName: authentik-ldaps
-  rules:
-    # The gateway terminates TLS on 636, so both listeners hit the plaintext port
-    - backendRefs:
-        - name: authentik-ldap
-          port: 3389
-          kind: Service
-          group: ""
-          weight: 1
@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: authentik-postgres-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/authentik/postgres"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: authentik-postgres-secrets
-    secretNamespace: authentik
-    secretType: Opaque
@@ -1,53 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: authentik-server
-  namespace: authentik
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: authentik-server
-  template:
-    metadata:
-      labels:
-        app: authentik-server
-    spec:
-      containers:
-        - name: authentik
-          image: ghcr.io/goauthentik/server:2026.8.0
-          command: ["ak"]
-          args: ["server"]
-          ports:
-            - containerPort: 9000
-              name: http
-            - containerPort: 9443
-              name: https
-          envFrom:
-            - secretRef:
-                name: authentik-app-secrets
-          volumeMounts:
-            - name: data
-              mountPath: /data
-            - name: templates
-              mountPath: /templates
-            - name: dshm
-              mountPath: /dev/shm
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-            limits:
-              memory: 1Gi
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: authentik-server-data
-        - name: templates
-          emptyDir: {}
-        - name: dshm
-          emptyDir:
-            medium: Memory
-            sizeLimit: 512Mi
@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: authentik-app-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/authentik/authentik"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: authentik-app-secrets
-    secretNamespace: authentik
-    secretType: Opaque
@@ -1,54 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: authentik-worker
-  namespace: authentik
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: authentik-worker
-  template:
-    metadata:
-      labels:
-        app: authentik-worker
-    spec:
-      securityContext:
-        runAsUser: 0
-      containers:
-        - name: authentik
-          image: ghcr.io/goauthentik/server:2026.8.0
-          command: ["ak"]
-          args: ["worker"]
-          envFrom:
-            - secretRef:
-                name: authentik-app-secrets
-          volumeMounts:
-            - name: data
-              mountPath: /data
-            - name: certs
-              mountPath: /certs
-            - name: templates
-              mountPath: /templates
-            - name: dshm
-              mountPath: /dev/shm
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-            limits:
-              memory: 1Gi
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: authentik-worker-data
-        - name: templates
-          emptyDir: {}
-        - name: certs
-          emptyDir: {}
-        - name: dshm
-          emptyDir:
-            medium: Memory
-            sizeLimit: 512Mi
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: azure-ddns
@@ -1,30 +0,0 @@
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: azure-ddns
-  namespace: azure-ddns
-spec:
-  schedule: "*/30 * * * *"
-  concurrencyPolicy: Forbid
-  successfulJobsHistoryLimit: 3
-  failedJobsHistoryLimit: 3
-  startingDeadlineSeconds: 300
-  jobTemplate:
-    spec:
-      backoffLimit: 3
-      template:
-        spec:
-          restartPolicy: OnFailure
-          containers:
-            - name: azure-ddns
-              image: gitea.jsme.be/jeffrey/azure-ddns-python:1.2
-              resources:
-                requests:
-                  cpu: 50m
-                  memory: 128Mi
-                limits:
-                  cpu: 200m
-                  memory: 256Mi
-              envFrom:
-                - secretRef:
-                    name: azure-ddns-app-secrets
@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: azure-ddns-app-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/azure-ddns/azure-ddns"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: azure-ddns-app-secrets
-    secretNamespace: azure-ddns
-    secretType: Opaque
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: bentopdf
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: excalidraw
@@ -1,43 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: gitea
-  namespace: gitea
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: gitea
-  serviceName: gitea
-  template:
-    metadata:
-      labels:
-        app: gitea
-    spec:
-      terminationGracePeriodSeconds: 60
-      containers:
-        - name: gitea
-          image: docker.gitea.com/gitea:1.27.2
-          resources:
-            requests:
-              cpu: 200m
-              memory: 512Mi
-            limits:
-              cpu: 1000m
-              memory: 1Gi
-          ports:
-            - containerPort: 3000
-          volumeMounts:
-            - name: data
-              mountPath: /data
-              subPath: Gitea
-          envFrom:
-            - secretRef:
-                name: gitea-app-secrets
-      restartPolicy: Always
-      volumes: 
-        - name: data  
-          persistentVolumeClaim:
-            claimName: gitea-pvc  
-            
-
@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: gitea-app-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/gitea/gitea"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: gitea-app-secrets
-    secretNamespace: gitea
-    secretType: Opaque
@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: gitea-postgres-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/gitea/postgres"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: gitea-postgres-secrets
-    secretNamespace: gitea
-    secretType: Opaque
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: gotify
@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: gotify-app-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/gotify/gotify"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: gotify-app-secrets
-    secretNamespace: gotify
-    secretType: Opaque
@@ -1,41 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: gotify
-  namespace: gotify
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: gotify
-  serviceName: gotify
-  template:
-    metadata:
-      labels:
-        app: gotify
-    spec:
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 10
-      containers:
-        - name: gotify
-          image: gotify/server:3.0.0
-          resources:
-            requests:
-              cpu: 50m
-              memory: 128Mi
-            limits:
-              cpu: 200m
-              memory: 256Mi
-          ports:
-            - containerPort: 80
-              name: http
-          envFrom:
-            - secretRef:
-                name: gotify-app-secrets
-          volumeMounts:
-            - name: data
-              mountPath: /app/data
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: gotify-data-pvc
@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: gotify-postgres-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/gotify/postgres"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: gotify-postgres-secrets
-    secretNamespace: gotify
-    secretType: Opaque
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: immich
@@ -1,40 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  namespace: immich
-  name: immich
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: immich
-  serviceName: immich
-  template:
-    metadata:
-      labels:
-        app: immich
-    spec:
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 60
-      containers:
-      - name: immich
-        image: ghcr.io/immich-app/immich-server:v3.1.0
-        resources:
-          requests:
-            memory: "256Mi"
-            cpu: "250m"
-          limits:
-            memory: "2Gi"
-            cpu: "2000m"
-        ports:
-        - containerPort: 2283
-        envFrom:
-        - secretRef:
-            name: immich-app-secrets
-        volumeMounts:
-        - name: photos
-          mountPath: /data
-      volumes:
-      - name: photos
-        persistentVolumeClaim:
-          claimName: immich-pvc
@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: immich-app-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/immich/immich"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: immich-app-secrets
-    secretNamespace: immich
-    secretType: Opaque
@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: immich-postgres-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/immich/postgres"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: immich-postgres-secrets
-    secretNamespace: immich
-    secretType: Opaque
@@ -1,28 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: crowdsec-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/crowdsec"
-        recursive: true
-  managedSecretReference:
-    secretName: crowdsec-secrets
-    secretNamespace: crowdsec
-    secretType: Opaque
-# NOTE: add a secret "bouncer-key" (a long random string, e.g. `openssl rand -hex 32`)
-# under kubernetes / prod / /crowdsec in Infisical. It is shared by:
-#   - CrowdSec LAPI  (pre-registers the "envoy" bouncer via BOUNCER_KEY_envoy)
-#   - the kdwils envoy bouncer (authenticates to LAPI + AppSec)
@@ -1,72 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: infisical-backend
-  namespace: infisical
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: infisical-backend
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: 0
-  template:
-    metadata:
-      labels:
-        app: infisical-backend
-    spec:
-      # The backend runs DB migrations on startup, so wait for Postgres to be ready.
-      initContainers:
-        - name: wait-for-db
-          image: postgres:14-alpine
-          command:
-            - sh
-            - -c
-            - "until pg_isready -h infisical-postgres -p 5432 -U $POSTGRES_USER; do echo waiting for db; sleep 2; done"
-          env:
-            - name: POSTGRES_USER
-              valueFrom:
-                secretKeyRef:
-                  name: infisical-secrets
-                  key: POSTGRES_USER
-      containers:
-        - name: backend
-          image: infisical/infisical:v0.162.6 # pinned — bump deliberately
-          ports:
-            - containerPort: 8080
-          # ENCRYPTION_KEY, AUTH_SECRET, DB_CONNECTION_URI, REDIS_URL (+ POSTGRES_* — ignored) come from the Secret
-          envFrom:
-            - secretRef:
-                name: infisical-secrets
-          env:
-            - name: NODE_ENV
-              value: production
-            - name: SITE_URL
-              value: https://infisical.jsme.be
-            - name: OTEL_TELEMETRY_COLLECTION_ENABLED
-              value: "false"
-            # Allow Core to reach the in-cluster Kubernetes API (kubernetes.default.svc,
-            # a private ClusterIP) for Kubernetes Auth token review. Off by default (SSRF guard).
-            - name: ALLOW_INTERNAL_IP_CONNECTIONS
-              value: "true"
-          readinessProbe:
-            httpGet:
-              path: /api/status
-              port: 8080
-            initialDelaySeconds: 20
-            periodSeconds: 10
-            failureThreshold: 12
-          livenessProbe:
-            httpGet:
-              path: /api/status
-              port: 8080
-            initialDelaySeconds: 60
-            periodSeconds: 20
-          resources:
-            requests:
-              cpu: 250m
-              memory: 512Mi
-            limits:
-              memory: 1Gi
@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: infisical-backend
-  namespace: infisical
-  labels:
-    app: infisical-backend
-spec:
-  selector:
-    app: infisical-backend
-  ports:
-    - name: http
-      port: 8080
-      targetPort: 8080
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: infisical
@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: infisical-postgres
-  namespace: infisical
-  labels:
-    app: infisical-postgres
-spec:
-  selector:
-    app: infisical-postgres
-  ports:
-    - name: postgres
-      port: 5432
-      targetPort: 5432
@@ -1,70 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: infisical-postgres
-  namespace: infisical
-spec:
-  serviceName: infisical-postgres
-  replicas: 1
-  selector:
-    matchLabels:
-      app: infisical-postgres
-  template:
-    metadata:
-      labels:
-        app: infisical-postgres
-    spec:
-      containers:
-        - name: postgres
-          image: postgres:14-alpine
-          ports:
-            - containerPort: 5432
-          env:
-            # Keep data in a subdir so an RWO volume's lost+found doesn't block initdb
-            - name: PGDATA
-              value: /var/lib/postgresql/data/pgdata
-            - name: POSTGRES_USER
-              valueFrom:
-                secretKeyRef:
-                  name: infisical-secrets
-                  key: POSTGRES_USER
-            - name: POSTGRES_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: infisical-secrets
-                  key: POSTGRES_PASSWORD
-            - name: POSTGRES_DB
-              valueFrom:
-                secretKeyRef:
-                  name: infisical-secrets
-                  key: POSTGRES_DB
-          volumeMounts:
-            - name: data
-              mountPath: /var/lib/postgresql/data
-          readinessProbe:
-            exec:
-              command: ["sh", "-c", "pg_isready -U $POSTGRES_USER -d $POSTGRES_DB"]
-            initialDelaySeconds: 5
-            periodSeconds: 5
-            timeoutSeconds: 10
-            failureThreshold: 10
-          livenessProbe:
-            exec:
-              command: ["sh", "-c", "pg_isready -U $POSTGRES_USER -d $POSTGRES_DB"]
-            initialDelaySeconds: 30
-            periodSeconds: 15
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-            limits:
-              memory: 512Mi
-  volumeClaimTemplates:
-    - metadata:
-        name: data
-      spec:
-        accessModes: ["ReadWriteOnce"]
-        storageClassName: longhorn
-        resources:
-          requests:
-            storage: 8Gi
@@ -1,23 +0,0 @@
-# ⚠️  BOOTSTRAP SECRETS — do NOT commit this file to Git in plaintext.
-# Infisical can't manage its own bootstrap secrets (chicken/egg), so these live
-# in a plain Secret. Manage via SOPS/sealed-secrets or `kubectl create secret`
-# out-of-band. Values below were randomly generated for you.
-#
-#   ENCRYPTION_KEY   : openssl rand -hex 16
-#   AUTH_SECRET      : openssl rand -base64 32
-#
-# DB_CONNECTION_URI password MUST match POSTGRES_PASSWORD.
-apiVersion: v1
-kind: Secret
-metadata:
-  name: infisical-secrets
-  namespace: infisical
-type: Opaque
-stringData:
-  ENCRYPTION_KEY: ""
-  AUTH_SECRET: ""
-  POSTGRES_USER: ""
-  POSTGRES_PASSWORD: ""
-  POSTGRES_DB: ""
-  DB_CONNECTION_URI: ""
-  REDIS_URL: ""
@@ -1,63 +0,0 @@
-# Kubernetes-native auth for the InfisicalSecret operator.
-# infisical-auth: the identity the CRDs mint short-lived tokens for.
-# infisical-token-reviewer: its JWT is pasted into Infisical's Kubernetes Auth
-# config so Infisical can call TokenReview. Bound to system:auth-delegator below.
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: infisical-auth
-  namespace: infisical
---
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: infisical-token-reviewer
-  namespace: infisical
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: infisical-token-reviewer
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: system:auth-delegator
-subjects:
-  - kind: ServiceAccount
-    name: infisical-token-reviewer
-    namespace: infisical
---
-# The operator needs to mint tokens for infisical-auth; without this it falls
-# back to the legacy SA .secrets[] lookup and never gets a token.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: infisical-operator-token-creator
-rules:
-  - apiGroups: [""]
-    resources: ["serviceaccounts/token"]
-    verbs: ["create"]
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: infisical-operator-token-creator
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: infisical-operator-token-creator
-subjects:
-  - kind: ServiceAccount
-    name: infisical-opera-controller-manager
-    namespace: infisical-operator
---
-# Long-lived token for the reviewer SA. `kubectl create token` expires; the
-# value pasted into Infisical's Kubernetes Auth config must not.
-apiVersion: v1
-kind: Secret
-metadata:
-  name: infisical-token-reviewer
-  namespace: infisical
-  annotations:
-    kubernetes.io/service-account.name: infisical-token-reviewer
-type: kubernetes.io/service-account-token
@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: infisical-valkey
-  namespace: infisical
-  labels:
-    app: infisical-valkey
-spec:
-  selector:
-    app: infisical-valkey
-  ports:
-    - name: valkey
-      port: 6379
-      targetPort: 6379
@@ -1,46 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: infisical-valkey
-  namespace: infisical
-spec:
-  serviceName: infisical-valkey
-  replicas: 1
-  selector:
-    matchLabels:
-      app: infisical-valkey
-  template:
-    metadata:
-      labels:
-        app: infisical-valkey
-    spec:
-      containers:
-        - name: valkey
-          # Valkey is a drop-in, Redis-protocol-compatible replacement for Redis.
-          image: valkey/valkey:8-alpine
-          args: ["--appendonly", "yes"]
-          ports:
-            - containerPort: 6379
-          volumeMounts:
-            - name: data
-              mountPath: /data
-          readinessProbe:
-            exec:
-              command: ["valkey-cli", "ping"]
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          resources:
-            requests:
-              cpu: 50m
-              memory: 64Mi
-            limits:
-              memory: 256Mi
-  volumeClaimTemplates:
-    - metadata:
-        name: data
-      spec:
-        accessModes: ["ReadWriteOnce"]
-        storageClassName: longhorn
-        resources:
-          requests:
-            storage: 1Gi
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: it-tools
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: jellyfin
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: minio-aistor
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: netbootxyz
@@ -1,37 +0,0 @@
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  namespace: netbox
-  name: netbox-housekeeping
-spec:
-  schedule: "15 3 * * *"
-  concurrencyPolicy: Forbid
-  successfulJobsHistoryLimit: 3
-  failedJobsHistoryLimit: 3
-  jobTemplate:
-    spec:
-      backoffLimit: 2
-      template:
-        spec:
-          restartPolicy: OnFailure
-          securityContext:
-            runAsUser: 999
-            runAsGroup: 0
-            fsGroup: 0
-          containers:
-            - name: netbox-housekeeping
-              image: netboxcommunity/netbox:v4.6.8-5.0.2
-              args:
-                - /opt/netbox/venv/bin/python
-                - /opt/netbox/netbox/manage.py
-                - housekeeping
-              resources:
-                requests:
-                  memory: "128Mi"
-                  cpu: "50m"
-                limits:
-                  memory: "512Mi"
-                  cpu: "500m"
-              envFrom:
-                - secretRef:
-                    name: netbox-app-secrets
@@ -1,46 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: netbox-route
-  namespace: netbox
-spec:
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: gateway-internal
-      namespace: envoy-gateway
-      sectionName: netbox
-  hostnames:
-    - "netbox.jsme.be"
-  rules:
-    - matches:
-        - path:
-            type: PathPrefix
-            value: /
-      filters:
-        - type: RequestHeaderModifier
-          requestHeaderModifier:
-            set:
-              - name: X-Forwarded-Host
-                value: "netbox.jsme.be"
-              - name: X-Forwarded-Proto
-                value: https
-        - type: ResponseHeaderModifier
-          responseHeaderModifier:
-            set:
-              - name: Strict-Transport-Security
-                value: "max-age=31536000; includeSubDomains"
-              - name: X-Content-Type-Options
-                value: nosniff
-              - name: X-Frame-Options
-                value: SAMEORIGIN
-              - name: Referrer-Policy
-                value: strict-origin-when-cross-origin
-              - name: Permissions-Policy
-                value: "camera=(), microphone=(), geolocation=(), payment=()"
-      backendRefs:
-        - name: netbox
-          port: 8080
-          kind: Service
-          group: ""
-          weight: 1
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: netbox
@@ -1,82 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  namespace: netbox
-  name: netbox
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: netbox
-  template:
-    metadata:
-      labels:
-        app: netbox
-    spec:
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 60
-      securityContext:
-        runAsUser: 999
-        runAsGroup: 0
-        fsGroup: 0
-      containers:
-        - name: netbox
-          image: netboxcommunity/netbox:v4.6.8-5.0.2
-          resources:
-            requests:
-              memory: "512Mi"
-              cpu: "250m"
-            limits:
-              memory: "2Gi"
-              cpu: "2000m"
-          ports:
-            - containerPort: 8080
-          envFrom:
-            - secretRef:
-                name: netbox-app-secrets
-          volumeMounts:
-            - name: netbox-data
-              mountPath: /opt/netbox/netbox/media
-              subPath: media
-            - name: netbox-data
-              mountPath: /opt/netbox/netbox/reports
-              subPath: reports
-            - name: netbox-data
-              mountPath: /opt/netbox/netbox/scripts
-              subPath: scripts
-          startupProbe:
-            httpGet:
-              path: /login/
-              port: 8080
-              # Django rejects the pod IP as a Host header (ALLOWED_HOSTS).
-              httpHeaders:
-                - name: Host
-                  value: netbox.jsme.be
-            periodSeconds: 10
-            # Generous: the entrypoint runs migrations before granian binds.
-            failureThreshold: 60
-          readinessProbe:
-            httpGet:
-              path: /login/
-              port: 8080
-              # Django rejects the pod IP as a Host header (ALLOWED_HOSTS).
-              httpHeaders:
-                - name: Host
-                  value: netbox.jsme.be
-            periodSeconds: 15
-          livenessProbe:
-            httpGet:
-              path: /login/
-              port: 8080
-              # Django rejects the pod IP as a Host header (ALLOWED_HOSTS).
-              httpHeaders:
-                - name: Host
-                  value: netbox.jsme.be
-            periodSeconds: 30
-            failureThreshold: 5
-      volumes:
-        - name: netbox-data
-          persistentVolumeClaim:
-            claimName: netbox-data-pvc
@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: netbox-app-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/netbox/netbox"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: netbox-app-secrets
-    secretNamespace: netbox
-    secretType: Opaque
@@ -1,13 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  namespace: netbox
-  name: netbox-data-pvc
-spec:
-  # RWX: shared by the web pod and the rqworker pod.
-  accessModes:
-    - ReadWriteMany
-  storageClassName: longhorn-static
-  resources:
-    requests:
-      storage: 5Gi
@@ -1,13 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  namespace: netbox
-  name: netbox
-spec:
-  selector:
-    app: netbox
-  ports:
-    - protocol: TCP
-      port: 8080
-      targetPort: 8080
-  type: ClusterIP
@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: netbox-postgres-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/netbox/postgres"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: netbox-postgres-secrets
-    secretNamespace: netbox
-    secretType: Opaque
@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  namespace: netbox
-  name: netbox-postgres-pvc
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn-static
-  resources:
-    requests:
-      storage: 10Gi
@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: netbox-postgres
-  namespace: netbox
-spec:
-  selector:
-    app: netbox-postgres
-  type: ClusterIP
-  ports:
-    - name: netbox-postgres-port
-      protocol: TCP
-      port: 5432
-      targetPort: 5432
@@ -1,45 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  namespace: netbox
-  name: netbox-postgres
-spec:
-  replicas: 1
-  serviceName: netbox-postgres
-  selector:
-    matchLabels:
-      app: netbox-postgres
-  template:
-    metadata:
-      labels:
-        app: netbox-postgres
-    spec:
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 60
-      containers:
-        - name: netbox-postgres
-          image: postgres:18
-          resources:
-            requests:
-              memory: "256Mi"
-              cpu: "100m"
-            limits:
-              memory: "1Gi"
-              cpu: "1000m"
-          ports:
-            - containerPort: 5432
-          volumeMounts:
-            - name: netbox-postgres-data
-              mountPath: /var/lib/postgresql/data
-          envFrom:
-            - secretRef:
-                name: netbox-postgres-secrets
-          readinessProbe:
-            exec:
-              command: ["sh", "-c", "pg_isready -q -U \"$POSTGRES_USER\" -d \"$POSTGRES_DB\""]
-            initialDelaySeconds: 10
-            periodSeconds: 10
-      volumes:
-        - name: netbox-postgres-data
-          persistentVolumeClaim:
-            claimName: netbox-postgres-pvc
@@ -1,38 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  namespace: netbox
-  name: netbox-redis-cache
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: netbox-redis-cache
-  template:
-    metadata:
-      labels:
-        app: netbox-redis-cache
-    spec:
-      restartPolicy: Always
-      containers:
-        - name: netbox-redis-cache
-          image: valkey/valkey:9.1-alpine
-          # Cache only: no persistence, contents are disposable.
-          command: ["sh", "-c", "exec valkey-server --requirepass \"$REDIS_PASSWORD\""]
-          resources:
-            requests:
-              memory: "64Mi"
-              cpu: "50m"
-            limits:
-              memory: "256Mi"
-              cpu: "200m"
-          ports:
-            - containerPort: 6379
-          envFrom:
-            - secretRef:
-                name: netbox-redis-cache-secrets
-          readinessProbe:
-            exec:
-              command: ["sh", "-c", "valkey-cli --pass \"$REDIS_PASSWORD\" ping | grep -q PONG"]
-            initialDelaySeconds: 5
-            periodSeconds: 10
@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: netbox-redis-cache-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/netbox/redis-cache"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: netbox-redis-cache-secrets
-    secretNamespace: netbox
-    secretType: Opaque
@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: netbox-redis-cache
-  namespace: netbox
-spec:
-  selector:
-    app: netbox-redis-cache
-  type: ClusterIP
-  ports:
-    - name: netbox-redis-cache-port
-      protocol: TCP
-      port: 6379
-      targetPort: 6379
@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: netbox-redis-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/netbox/redis"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: netbox-redis-secrets
-    secretNamespace: netbox
-    secretType: Opaque
@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  namespace: netbox
-  name: netbox-redis-pvc
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn-static
-  resources:
-    requests:
-      storage: 1Gi
@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: netbox-redis
-  namespace: netbox
-spec:
-  selector:
-    app: netbox-redis
-  type: ClusterIP
-  ports:
-    - name: netbox-redis-port
-      protocol: TCP
-      port: 6379
-      targetPort: 6379
@@ -1,46 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  namespace: netbox
-  name: netbox-redis
-spec:
-  replicas: 1
-  serviceName: netbox-redis
-  selector:
-    matchLabels:
-      app: netbox-redis
-  template:
-    metadata:
-      labels:
-        app: netbox-redis
-    spec:
-      restartPolicy: Always
-      containers:
-        - name: netbox-redis
-          image: valkey/valkey:9.1-alpine
-          # Task queue: appendonly so queued background jobs survive a restart.
-          command: ["sh", "-c", "exec valkey-server --appendonly yes --requirepass \"$REDIS_PASSWORD\""]
-          resources:
-            requests:
-              memory: "64Mi"
-              cpu: "50m"
-            limits:
-              memory: "256Mi"
-              cpu: "200m"
-          ports:
-            - containerPort: 6379
-          envFrom:
-            - secretRef:
-                name: netbox-redis-secrets
-          volumeMounts:
-            - name: netbox-redis-data
-              mountPath: /data
-          readinessProbe:
-            exec:
-              command: ["sh", "-c", "valkey-cli --pass \"$REDIS_PASSWORD\" ping | grep -q PONG"]
-            initialDelaySeconds: 5
-            periodSeconds: 10
-      volumes:
-        - name: netbox-redis-data
-          persistentVolumeClaim:
-            claimName: netbox-redis-pvc
@@ -1,54 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  namespace: netbox
-  name: netbox-worker
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: netbox-worker
-  template:
-    metadata:
-      labels:
-        app: netbox-worker
-    spec:
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 60
-      securityContext:
-        runAsUser: 999
-        runAsGroup: 0
-        fsGroup: 0
-      containers:
-        - name: netbox-worker
-          image: netboxcommunity/netbox:v4.6.8-5.0.2
-          # Overrides CMD only, so tini stays the entrypoint and migrations
-          # are left to the web pod.
-          args:
-            - /opt/netbox/venv/bin/python
-            - /opt/netbox/netbox/manage.py
-            - rqworker
-          resources:
-            requests:
-              memory: "256Mi"
-              cpu: "100m"
-            limits:
-              memory: "1Gi"
-              cpu: "1000m"
-          envFrom:
-            - secretRef:
-                name: netbox-app-secrets
-          volumeMounts:
-            - name: netbox-data
-              mountPath: /opt/netbox/netbox/media
-              subPath: media
-            - name: netbox-data
-              mountPath: /opt/netbox/netbox/reports
-              subPath: reports
-            - name: netbox-data
-              mountPath: /opt/netbox/netbox/scripts
-              subPath: scripts
-      volumes:
-        - name: netbox-data
-          persistentVolumeClaim:
-            claimName: netbox-data-pvc
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: outline
@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: outline-app-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/outline/outline"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: outline-app-secrets
-    secretNamespace: outline
-    secretType: Opaque
@@ -1,32 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  namespace: outline
-  name: outline
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: outline
-  template:
-    metadata:
-      labels:
-        app: outline
-    spec:
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 60
-      containers:
-        - name: outline
-          image: docker.getoutline.com/outlinewiki/outline:1.9.2
-          resources:
-            requests:
-              memory: "512Mi"
-              cpu: "250m"
-            limits:
-              memory: "2Gi"
-              cpu: "2000m"
-          ports:
-            - containerPort: 3000
-          envFrom:
-            - secretRef:
-                name: outline-app-secrets
@@ -1,51 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: outline-route
-  namespace: outline
-spec:
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: gateway-internal
-      namespace: envoy-gateway
-      sectionName: outline
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: gateway-public
-      namespace: envoy-gateway
-      sectionName: outline
-  hostnames:
-    - "outline.jsme.be"
-  rules:
-    - matches:
-        - path:
-            type: PathPrefix
-            value: /
-      filters:
-        - type: RequestHeaderModifier
-          requestHeaderModifier:
-            set:
-              - name: X-Forwarded-Host
-                value: "outline.jsme.be"
-              - name: X-Forwarded-Proto
-                value: https
-        - type: ResponseHeaderModifier
-          responseHeaderModifier:
-            set:
-              - name: Strict-Transport-Security
-                value: "max-age=31536000; includeSubDomains"
-              - name: X-Content-Type-Options
-                value: nosniff
-              - name: X-Frame-Options
-                value: SAMEORIGIN
-              - name: Referrer-Policy
-                value: strict-origin-when-cross-origin
-              - name: Permissions-Policy
-                value: "camera=(), microphone=(), geolocation=(), payment=()"
-      backendRefs:
-        - name: outline
-          port: 3000
-          kind: Service
-          group: ""
-          weight: 1
@@ -1,13 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  namespace: outline
-  name: outline
-spec:
-  selector:
-    app: outline
-  ports:
-    - protocol: TCP
-      port: 3000
-      targetPort: 3000
-  type: ClusterIP
@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: outline-postgres-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/outline/postgres"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: outline-postgres-secrets
-    secretNamespace: outline
-    secretType: Opaque
@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: outline-postgres
-  namespace: outline
-spec:
-  selector:
-    app: outline-postgres
-  type: ClusterIP
-  ports:
-    - name: outline-postgres-port
-      protocol: TCP
-      port: 5432
-      targetPort: 5432
@@ -1,40 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  namespace: outline
-  name: outline-postgres
-spec:
-  replicas: 1
-  serviceName: outline-postgres
-  selector:
-    matchLabels:
-      app: outline-postgres
-  template:
-    metadata:
-      labels:
-        app: outline-postgres
-    spec:
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 60
-      containers:
-        - name: outline-postgres
-          image: postgres:18
-          resources:
-            requests:
-              memory: "256Mi"
-              cpu: "100m"
-            limits:
-              memory: "1Gi"
-              cpu: "500m"
-          ports:
-            - containerPort: 5432
-          volumeMounts:
-            - name: outline-postgres-data
-              mountPath: /var/lib/postgresql/data
-          envFrom:
-            - secretRef:
-                name: outline-postgres-secrets
-      volumes:
-        - name: outline-postgres-data
-          persistentVolumeClaim:
-            claimName: outline-postgres-pvc
@@ -1,28 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  namespace: outline
-  name: outline-redis
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: outline-redis
-  template:
-    metadata:
-      labels:
-        app: outline-redis
-    spec:
-      restartPolicy: Always
-      containers:
-        - name: outline-redis
-          image: valkey/valkey:9
-          resources:
-            requests:
-              memory: "64Mi"
-              cpu: "50m"
-            limits:
-              memory: "256Mi"
-              cpu: "200m"
-          ports:
-            - containerPort: 6379
@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: outline-redis
-  namespace: outline
-spec:
-  selector:
-    app: outline-redis
-  type: ClusterIP
-  ports:
-    - name: outline-redis-port
-      protocol: TCP
-      port: 6379
-      targetPort: 6379
@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: passbolt-mariadb-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/passbolt/mariadb"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: passbolt-mariadb-secrets
-    secretNamespace: passbolt
-    secretType: Opaque
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: passbolt
@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: passbolt-app-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/passbolt/passbolt"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: passbolt-app-secrets
-    secretNamespace: passbolt
-    secretType: Opaque
@@ -1,52 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  namespace: passbolt
-  name: passbolt
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: passbolt
-  serviceName: passbolt
-  template:
-    metadata:
-      labels:
-        app: passbolt
-    spec:
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 10
-      containers:
-        - name: passbolt
-          image: passbolt/passbolt:latest-ce
-          resources:
-            requests:
-              cpu: 200m
-              memory: 512Mi
-            limits:
-              cpu: 1000m
-              memory: 1Gi
-          volumeMounts:
-            - name: gpg-volume
-              mountPath: /etc/passbolt/gpg
-            - name: jwt-volume
-              mountPath: /etc/passbolt/jwt
-            - name: nginx-ssl
-              mountPath: /etc/nginx/snippets/passbolt-ssl.conf
-              subPath: passbolt-ssl.conf
-          ports:
-            - containerPort: 80
-          envFrom:
-            - secretRef:
-                name: passbolt-app-secrets
-      volumes:
-        - name: gpg-volume
-          persistentVolumeClaim:
-            claimName: passbolt-gpg-pvc
-        - name: jwt-volume
-          persistentVolumeClaim:
-            claimName: passbolt-jwt-pvc
-        - name: nginx-ssl
-          configMap:
-            name: passbolt-nginx-ssl
-
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: pelican
@@ -1,30 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: wings-ark-route
-  namespace: pelican
-spec:
-  parentRefs:
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: gateway-internal
-      namespace: envoy-gateway
-      sectionName: wings-ark
-    - group: gateway.networking.k8s.io
-      kind: Gateway
-      name: gateway-public
-      namespace: envoy-gateway
-      sectionName: wings-ark
-  hostnames:
-    - "wings-ark.jsme.be"
-  rules:
-    - matches:
-        - path:
-            type: PathPrefix
-            value: /
-      backendRefs:
-        - name: wings-ark
-          port: 8080
-          kind: Service
-          group: ""
-          weight: 1
@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: wings-ark
-  namespace: pelican
-spec:
-  ports:
-    - protocol: TCP
-      port: 8080
-      targetPort: 8080
-  type: ClusterIP
@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: pelican-app-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/pelican/pelican"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: pelican-app-secrets
-    secretNamespace: pelican
-    secretType: Opaque
@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: pelican-postgres-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/pelican/postgres"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: pelican-postgres-secrets
-    secretNamespace: pelican
-    secretType: Opaque
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: proxmox
@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: resume-chrome-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/reactive_resume/chrome"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: resume-chrome-secrets
-    secretNamespace: resume
-    secretType: Opaque
@@ -1,25 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: chrome
-  namespace: resume
-  labels:
-    app: chrome
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: chrome
-  template:
-    metadata:
-      labels:
-        app: chrome
-    spec:
-      containers:
-      - name: chrome
-        image: ghcr.io/browserless/chromium:latest
-        ports:
-        - containerPort: 3000
-        envFrom:
-          - secretRef:
-              name: resume-chrome-secrets
@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: resume-postgres-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/reactive_resume/postgres"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: resume-postgres-secrets
-    secretNamespace: resume
-    secretType: Opaque
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: resume
@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: resume-app-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/reactive_resume/resume"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: resume-app-secrets
-    secretNamespace: resume
-    secretType: Opaque
@@ -1,32 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  namespace: resume
-  name: resume
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: resume
-  template:
-    metadata:
-      labels:
-        app: resume
-    spec:
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 10
-      containers:
-        - name: resume
-          image: ghcr.io/amruthpillai/reactive-resume:v5.0
-          ports:
-            - containerPort: 3000
-          resources:
-            limits:
-              cpu: "1000m"
-              memory: "2Gi"
-            requests:
-              cpu: "500m"
-              memory: "1Gi"
-          envFrom:
-            - secretRef:
-                name: resume-app-secrets
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: searxng
@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: searxng-app-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/searxng/searxng"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: searxng-app-secrets
-    secretNamespace: searxng
-    secretType: Opaque
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: technitium
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: truenas
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: unifi
@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: uptime-kuma-mariadb-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/uptime-kuma/mariadb"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: uptime-kuma-mariadb-secrets
-    secretNamespace: uptime-kuma
-    secretType: Opaque
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: uptime-kuma
@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: uptime-kuma-app-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/uptime-kuma/uptime-kuma"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: uptime-kuma-app-secrets
-    secretNamespace: uptime-kuma
-    secretType: Opaque
@@ -1,42 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: uptime-kuma
-  namespace: uptime-kuma
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: uptime-kuma
-  serviceName: uptime-kuma
-  template:
-    metadata:
-      labels:
-        app: uptime-kuma
-    spec:
-      restartPolicy: Always
-      terminationGracePeriodSeconds: 10
-      containers:
-        - name: uptime-kuma
-          image: louislam/uptime-kuma:2.5.3
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-            limits:
-              cpu: 500m
-              memory: 512Mi
-          ports:
-            - containerPort: 3001
-              name: http
-          # DATABASE_HOST/PORT/NAME/USERNAME/PASSWORD come from the Secret.
-          envFrom:
-            - secretRef:
-                name: uptime-kuma-app-secrets
-          volumeMounts:
-            - name: data
-              mountPath: /app/data
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: uptime-kuma-pvc
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: victoria-metrics
@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: zipline-postgres-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/zipline/postgres"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: zipline-postgres-secrets
-    secretNamespace: zipline
-    secretType: Opaque
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: zipline
@@ -1,25 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: zipline-app-secrets
-  namespace: infisical
-spec:
-  hostAPI: https://infisical.jsme.be
-  resyncInterval: 30
-  authentication:
-    kubernetesAuth:
-      identityId: "5458def7-7c63-40d2-95da-41c614d0933a"
-      serviceAccountRef:
-        name: infisical-auth
-        namespace: infisical
-      autoCreateServiceAccountToken: true
-      secretsScope:
-        projectSlug: "kubernetes"
-        envSlug: "prod"
-        secretsPath: "/zipline/zipline"
-        # Non-recursive: keys are already named as the container expects.
-        recursive: false
-  managedSecretReference:
-    secretName: zipline-app-secrets
-    secretNamespace: zipline
-    secretType: Opaque
@@ -7,7 +7,7 @@ spec:
  project: default
  source:
    repoURL: https://gitea.jsme.be/Jeffrey/Kubernetes-Manifests.git
-    path: applications/authentik
+    path: authentik
    targetRevision: main
    directory:
      recurse: true
@@ -19,4 +19,5 @@ spec:
      prune: true
      selfHeal: true
    syncOptions:
+      - CreateNamespace=true
      - ServerSideApply=true
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Jeffrey	f1286e4d0b	Move affine to deprecated	2026-06-21 10:22:47 +02:00
Jeffrey	f1c46b1e3e	Up resource usage	2026-06-20 17:51:59 +02:00
Jeffrey	90723eee70	Fix Env variables	2026-06-20 17:23:41 +02:00
Jeffrey	619c112940	Update version and addition zone name + Gotify support	2026-06-20 17:08:14 +02:00
Gitea CI	c9dec7cfe9	ci: update azure-ddns-python image to 1.1	2026-06-20 15:07:47 +00:00
Jeffrey	ee23988850	victoria-metrics: use Recreate strategy for grafana (single RWO PVC) RollingUpdate deadlocks on the ReadWriteOnce longhorn PVC: old and new pods cannot both attach the volume. Recreate terminates the old pod first.	2026-06-18 21:41:43 +02:00
Jeffrey	35ffa589c5	victoria-metrics: fix grafana admin secret to use existingSecret Resolves duplicate GF_SECURITY_ADMIN_PASSWORD env (chart default + envValueFrom) that broke ArgoCD diff and left the grafana Deployment unable to sync.	2026-06-18 21:37:38 +02:00
Jeffrey	d5b59a719c	envoy-gateway: add seerr-test.jsme.be listener + cert (OIDC preview test) Temporary listener/cert for the seerr-test instance running the preview-new-oidc build. Remove along with the seerr-test workload when testing is done.	2026-06-14 12:45:53 +02:00
Jeffrey	2685698bfc	docs: update README with affine, harbor, pelican, stable-diffusion	2026-06-07 01:03:39 +02:00
Jeffrey	40f5fc1111	add Pelican panel manifests	2026-06-07 00:51:34 +02:00
Jeffrey	4d0d5587c2	Remove useClientProtocol from MinIO BackendTrafficPolicy to fix HTTP/2 protocol error	2026-06-03 16:40:20 +02:00
Jeffrey	8476121d9a	Add BackendTrafficPolicy for MinIO console and API to fix download timeouts	2026-06-03 16:32:33 +02:00
Jeffrey	e9c327c51d	Add ClientTrafficPolicy for MinIO console listener to fix download timeouts	2026-06-03 16:24:42 +02:00
Jeffrey	d1eac83176	envoy-gateway: add ClientTrafficPolicy for minio-aistor to support large file transfers	2026-06-03 16:17:58 +02:00
Jeffrey	b8e8a6820b	authentik: upgrade to 2026.5.2	2026-06-03 12:18:29 +02:00
Jeffrey	0dd2d4e52c	pelican: remove endpointslice, switch service to pod selector, use dynamic longhorn for mariadb	2026-06-03 10:22:12 +02:00
Jeffrey	842ff7b605	pelican: add infisical secret	2026-06-03 09:55:13 +02:00
Jeffrey	b2fe500df3	pelican: add cdnjs.cloudflare.com to style-src and font-src for Monaco editor	2026-06-03 08:12:43 +02:00
Jeffrey	4771f2b177	pelican: allow cdnjs.cloudflare.com in CSP for Monaco editor	2026-06-03 08:06:59 +02:00
Jeffrey	885c22b46c	Add wings.jsme.be to panel CSP connect-src to allow file uploads	2026-06-02 23:42:27 +02:00
Jeffrey	dc1de99c7a	Restrict Wings listener ALPN to http/1.1 to fix Guzzle broken pipe	2026-06-02 23:22:11 +02:00
Jeffrey	2f76274b36	Add Wings ClientTrafficPolicy to envoy-gateway kustomization	2026-06-02 22:50:41 +02:00
Jeffrey	9971e90531	Move Wings ClientTrafficPolicy to envoy-gateway dir	2026-06-02 22:49:08 +02:00
Jeffrey	dc87a2c742	Add Wings ClientTrafficPolicy for upload timeout	2026-06-02 22:47:50 +02:00
Jeffrey	4e42ee28aa	Remove Wings BackendTrafficPolicy	2026-06-02 22:41:57 +02:00
Jeffrey	88a80c08b9	Fix Wings BackendTrafficPolicy: remove useClientProtocol	2026-06-02 22:38:15 +02:00
Jeffrey	1ab30a98d7	Add Wings BackendTrafficPolicy for WebSocket support	2026-06-02 22:35:25 +02:00
Jeffrey	6c6c88a16a	Add Wings HTTPS proxy via Envoy Gateway	2026-06-02 22:29:17 +02:00
Jeffrey	9436ed134a	Update pelican/httproute.yaml	2026-06-02 19:41:40 +00:00
Jeffrey	5f4674938d	Update pelican/httproute.yaml	2026-06-02 19:35:00 +00:00
Jeffrey	bacc31dcdb	Fix kustomization: remove shelfmark/docuseal, recreate affine gateway files	2026-06-02 19:32:03 +02:00
Jeffrey	92c8ab9cc9	Add Pelican panel — EndpointSlice, HTTPRoute, certificate, gateway listener	2026-06-02 19:25:18 +02:00
Jeffrey	8931194870	Remove hardcoded volumeName from searxng PVC	2026-06-01 11:12:26 +02:00
Jeffrey	3465f139d1	Reset git history for making manifests public	2026-06-01 11:06:25 +02:00