frigate ui

apps/emqx/release.yaml

@@ -0,0 +1,72 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: emqx
+  namespace: emqx
+spec:
+  chart:
+    spec:
+      chart: emqx
+      version: 5.x
+      sourceRef:
+        kind: HelmRepository
+        name: emqx
+  interval: 15m
+  releaseName: emqx
+  values:
+    persistence:
+      enabled: true
+      size: 20Mi
+      storageClassName: longhorn
+      accessMode: ReadWriteOnce
+
+    ## EMQX configuration item, see the documentation (https://hub.docker.com/r/emqx/emqx)
+    emqxConfig:
+      EMQX_CLUSTER__DISCOVERY_STRATEGY: "dns"
+      EMQX_DASHBOARD__DEFAULT_USERNAME: "admin"
+      EMQX_DASHBOARD__DEFAULT_PASSWORD: "public"
+
+    ingress:
+      ## ingress for EMQX Dashboard
+      dashboard:
+        enabled: true
+        annotations:
+          cert-manager.io/cluster-issuer: "letsencrypt-prod"
+          traefik.ingress.kubernetes.io/router.entrypoints: websecure
+          traefik.ingress.kubernetes.io/router.tls: "true"
+        path: /
+        pathType: ImplementationSpecific
+        hosts:
+          - emqx.michaelthomson.dev
+        tls:
+          - hosts:
+              - emqx.michaelthomson.dev
+            secretName: emqx-tls
+      mqtt:
+        enabled: false
+        annotations:
+          cert-manager.io/cluster-issuer: "letsencrypt-prod"
+          traefik.ingress.kubernetes.io/router.entrypoints: websecure
+          traefik.ingress.kubernetes.io/router.tls: "true"
+        path: /
+        pathType: ImplementationSpecific
+        hosts:
+          - mqtt.emqx.michaelthomson.dev
+        tls:
+          - hosts:
+              - mqtt.emqx.michaelthomson.dev
+            secretName: emqx-tls
+      ws:
+        enabled: false
+        annotations:
+          cert-manager.io/cluster-issuer: "letsencrypt-prod"
+          traefik.ingress.kubernetes.io/router.entrypoints: websecure
+          traefik.ingress.kubernetes.io/router.tls: "true"
+        path: /mqtt
+        pathType: ImplementationSpecific
+        hosts:
+          - mqtt.emqx.michaelthomson.dev
+        tls:
+          - hosts:
+              - mqtt.emqx.michaelthomson.dev
+            secretName: emqx-tls

apps/emqx/repository.yaml

@@ -1,8 +1,8 @@
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:
-  name: ollama
+  name: emqx
-  namespace: ollama
+  namespace: emqx
 spec:
   interval: 15m
-  url: https://helm.otwld.com/
+  url: https://repos.emqx.io/charts

apps/frigate/release.yaml

@@ -0,0 +1,96 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: frigate
+  namespace: frigate
+spec:
+  chart:
+    spec:
+      chart: frigate
+      version: 7.x
+      sourceRef:
+        kind: HelmRepository
+        name: frigate
+  interval: 15m
+  releaseName: frigate
+  values:
+    image:
+      repository: ghcr.io/blakeblackshear/frigate
+      pullPolicy: IfNotPresent
+
+    envFromSecrets:
+      - frigate-secret
+
+    gpu:
+      nvidia:
+        enabled: true
+        runtimeClassName: nvidia
+
+    config: |
+      mqtt:
+        enabled: true
+        host: emqx.emqx.svc.cluster.local
+        user: frigate
+        password: '{FRIGATE_MQTT_PASSWORD}'
+
+      ffmpeg:
+        hwaccel_args: preset-nvidia
+
+      go2rtc:
+        streams:
+          c200_1:
+            - rtsp://{FRIGATE_RTSP_USERNAME}:{FRIGATE_RTSP_PASSWORD}@192.168.18.20:554/stream1
+          c200_1_sub:
+            - rtsp://{FRIGATE_RTSP_USERNAME}:{FRIGATE_RTSP_PASSWORD}@192.168.18.20:554/stream2
+      cameras:
+        tapoC200_1:
+          enabled: true
+          onvif:
+            host: 192.168.18.20
+            port: 2020
+            user: '{FRIGATE_RTSP_USERNAME}'
+            password: '{FRIGATE_RTSP_PASSWORD}'
+          live:
+            stream_name: c200_1
+          ffmpeg:
+            output_args:
+              record: preset-record-generic
+            inputs:
+              - path: rtsp://127.0.0.1:8554/c200_1?video&audio
+                input_args: preset-rtsp-restream
+                roles:
+                  - record
+                  - detect
+                  - audio
+
+    ingress:
+      enabled: true
+      annotations:
+        cert-manager.io/cluster-issuer: "letsencrypt-prod"
+        traefik.ingress.kubernetes.io/router.entrypoints: websecure
+        traefik.ingress.kubernetes.io/router.tls: "true"
+      hosts:
+        - host: frigate.michaelthomson.dev
+          paths:
+            - path: '/'
+              portName: http
+      tls:
+        - hosts:
+            - frigate.michaelthomson.dev
+          secretName: frigate-tls
+
+    persistence:
+      config:
+        enabled: true
+        storageClass: longhorn
+        accessMode: ReadWriteOnce
+        size: 100Mi
+      media:
+        enabled: true
+        storageClass: nfs-client
+        accessMode: ReadWriteOnce
+        size: 10Gi
+
+    resources:
+      limits:
+        nvidia.com/gpu: 1

apps/frigate/repository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: frigate
+  namespace: frigate
+spec:
+  interval: 15m
+  url: https://blakeblackshear.github.io/blakeshome-charts/

apps/frigate/secret.yaml

@@ -0,0 +1,24 @@
+apiVersion: v1
+stringData:
+    FRIGATE_MQTT_PASSWORD: ENC[AES256_GCM,data:2Q78LPHG682UgvVmZCg=,iv:QjhxxfgYKhA5/Btmu48E8QsIYUbdE0SSRmhkuJtmEJA=,tag:PUwGu6Vz/q3xkLWakIebqw==,type:str]
+    FRIGATE_RTSP_USERNAME: ENC[AES256_GCM,data:6AlV8zxMxkpHLXlMEQ==,iv:4P7cYe7pLsI74CMQz/YhZ0/TG4lwjsNIRL/NuMmi4/E=,tag:M3jRqHkeHLZY2DS+nJZasA==,type:str]
+    FRIGATE_RTSP_PASSWORD: ENC[AES256_GCM,data:PNI3OU9QCiOEABQu6Tg=,iv:npbl8YE1iTeEA5mJOlEb6EUKhTjd7s7lRfPVCfu+OTE=,tag:PPu1JGT8PSsSfVgOk4sVgw==,type:str]
+kind: Secret
+metadata:
+    name: frigate-secret
+    namespace: frigate
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3ZWVxNElZM1pFNEx6eE9q
+            U3ZHTzdhcXMzWmRBWGM0eDFTVCtFOGhGYzN3ClZ2U2NaSFVuaUN6RDhaYkVnb1du
+            M2JFMzBkeWZUaFBKeEZYb2FiMytIeWcKLS0tIEFQelhqQUhDODlTL2J4M0kzK05m
+            YjFheFgwRGVEVWJ3TW94UWlTREV6K2cKpnqUg4qLeOtIfecGjV2nUAYZGTkHCrT6
+            OHfL5W55BqcQJYovv37JJHkNV+IHuVNo7aqO/gx5AE0HfMWPfy6QGg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-09-08T19:49:08Z"
+    mac: ENC[AES256_GCM,data:3viOyo2Qbq29GNNV7e+SacbXI/jf/LkitESACHYuwPcQZFO57J4Hg/Pk1e8lsM2Ft04Ye2L7o1Jdd8gVmPtH8EJdONWFpuv8DOgzAII/FxdDosHy5N0z8Gj8eFBCJEw4zpKKuTMoL+uG5juouWzzMnnmZ0kaz5t2dTUIkbXRDug=,iv:VaZfS84/FhkY5IJQVhbP0XUmVkBGHLMe1pnUISENQYY=,tag:sqs1pu8dThE4x9pqAsYE0g==,type:str]
+    version: 3.13.3

apps/ollama/release.yaml

@@ -1,53 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: ollama
-  namespace: ollama
-spec:
-  chart:
-    spec:
-      chart: ollama
-      version: 1.x
-      sourceRef:
-        kind: HelmRepository
-        name: ollama
-  interval: 15m
-  releaseName: ollama
-  values:
-    runtimeClassName: nvidia
-    ollama:
-      gpu:
-        enabled: true
-        type: nvidia
-        number: 1
-      models:
-        pull:
-          - gemma4:12b
-        # create:
-        #   - name: qwen3.5:9b-custom
-        #     template: |
-        #       FROM qwen3.5:9b
-        #       PARAMETER num_ctx 8192
-        #       PARAMETER temperature 1.0
-        #       PARAMETER top_p 0.95
-        #       PARAMETER top_k 20
-        #       PARAMETER min_p 0.0
-        #       PARAMETER presence_penalty 1.5
-        #       PARAMETER repetition_penalty 1.0
-        # run:
-        #   - qwen3.5:9b-custom
-    ingress:
-      enabled: true
-      annotations:
-        cert-manager.io/cluster-issuer: "letsencrypt-prod"
-        traefik.ingress.kubernetes.io/router.entrypoints: websecure
-        traefik.ingress.kubernetes.io/router.tls: "true"
-      hosts:
-        - host: ollama.michaelthomson.dev
-          paths:
-            - path: /
-              pathType: Prefix
-      tls:
-        - hosts:
-            - ollama.michaelthomson.dev
-          secretName: ollama-tls

bootstrap/apps/kustomization-emqx.yaml

@@ -1,12 +1,12 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: ollama
+  name: emqx
   namespace: flux-system
 spec:
   interval: 15m
-  path: ./apps/ollama
+  path: ./apps/emqx
-  prune: true
+  prune: true # remove any elements later removed from the above path
   wait: true
   sourceRef:
     kind: GitRepository

bootstrap/apps/kustomization-frigate.yaml

@@ -0,0 +1,19 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: frigate
+  namespace: flux-system
+spec:
+  interval: 15m
+  path: ./apps/frigate
+  prune: true # remove any elements later removed from the above path
+  wait: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+  dependsOn:
+    - name: infra-configs

infrastructure/namespaces/namespace-emqx.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: emqx

infrastructure/namespaces/namespace-frigate.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: ollama
+  name: frigate
   labels:
     pod-security.kubernetes.io/enforce: privileged
     pod-security.kubernetes.io/audit: privileged