longhorn recurring

apps/actual/networkresource.yaml

@@ -0,0 +1,13 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkResource
+metadata:
+  name: actual
+  namespace: actual
+spec:
+  networkRouterRef:
+    name: homelab
+    namespace: netbird
+  serviceRef:
+    name: actual
+  groups:
+    - name: homelab-services

apps/emqx/networkresource.yaml

@@ -0,0 +1,13 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkResource
+metadata:
+  name: emqx
+  namespace: emqx
+spec:
+  networkRouterRef:
+    name: homelab
+    namespace: netbird
+  serviceRef:
+    name: emqx
+  groups:
+    - name: homelab-services

apps/emqx/release.yaml

@@ -0,0 +1,72 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: emqx
+  namespace: emqx
+spec:
+  chart:
+    spec:
+      chart: emqx
+      version: 5.x
+      sourceRef:
+        kind: HelmRepository
+        name: emqx
+  interval: 15m
+  releaseName: emqx
+  values:
+    persistence:
+      enabled: true
+      size: 20Mi
+      storageClassName: longhorn
+      accessMode: ReadWriteOnce
+
+    ## EMQX configuration item, see the documentation (https://hub.docker.com/r/emqx/emqx)
+    emqxConfig:
+      EMQX_CLUSTER__DISCOVERY_STRATEGY: "dns"
+      EMQX_DASHBOARD__DEFAULT_USERNAME: "admin"
+      EMQX_DASHBOARD__DEFAULT_PASSWORD: "public"
+
+    ingress:
+      ## ingress for EMQX Dashboard
+      dashboard:
+        enabled: true
+        annotations:
+          cert-manager.io/cluster-issuer: "letsencrypt-prod"
+          traefik.ingress.kubernetes.io/router.entrypoints: websecure
+          traefik.ingress.kubernetes.io/router.tls: "true"
+        path: /
+        pathType: ImplementationSpecific
+        hosts:
+          - emqx.michaelthomson.dev
+        tls:
+          - hosts:
+              - emqx.michaelthomson.dev
+            secretName: emqx-tls
+      mqtt:
+        enabled: false
+        annotations:
+          cert-manager.io/cluster-issuer: "letsencrypt-prod"
+          traefik.ingress.kubernetes.io/router.entrypoints: websecure
+          traefik.ingress.kubernetes.io/router.tls: "true"
+        path: /
+        pathType: ImplementationSpecific
+        hosts:
+          - mqtt.emqx.michaelthomson.dev
+        tls:
+          - hosts:
+              - mqtt.emqx.michaelthomson.dev
+            secretName: emqx-tls
+      ws:
+        enabled: false
+        annotations:
+          cert-manager.io/cluster-issuer: "letsencrypt-prod"
+          traefik.ingress.kubernetes.io/router.entrypoints: websecure
+          traefik.ingress.kubernetes.io/router.tls: "true"
+        path: /mqtt
+        pathType: ImplementationSpecific
+        hosts:
+          - mqtt.emqx.michaelthomson.dev
+        tls:
+          - hosts:
+              - mqtt.emqx.michaelthomson.dev
+            secretName: emqx-tls

apps/emqx/repository.yaml

@@ -1,8 +1,8 @@
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:
-  name: ollama
-  namespace: ollama
+  name: emqx
+  namespace: emqx
 spec:
   interval: 15m
-  url: https://helm.otwld.com/
+  url: https://repos.emqx.io/charts

apps/frigate/config.yaml

@@ -0,0 +1,153 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: frigate
+  namespace: frigate
+data:
+  config.yml: |
+    tls:
+      enabled: false
+
+    mqtt:
+      enabled: true
+      host: emqx.emqx.svc.cluster.local
+      user: frigate
+      password: '{FRIGATE_MQTT_PASSWORD}'
+
+    ffmpeg:
+      hwaccel_args: preset-nvidia
+
+    detectors:
+      onnx:
+        type: onnx
+
+    detect:
+      enabled: true
+
+    audio:
+      enabled: true
+      min_volume: 200
+      listen:
+        - cat
+        - meow
+        - hiss
+        - fart
+        - speech
+
+    objects:
+      track:
+        - person
+        - cat
+
+    record:
+      enabled: true
+      motion:
+        days: 1
+      alerts:
+        retain:
+          days: 1
+          mode: motion
+      detections:
+        retain:
+          days: 1
+          mode: motion
+
+    model:
+      model_type: yolo-generic
+      width: 640 # <--- should match the imgsize set during model export
+      height: 640 # <--- should match the imgsize set during model export
+      input_tensor: nchw
+      input_dtype: float
+      path: /config/model_cache/yolov9-c-640.onnx
+      labelmap_path: /labelmap/coco-80.txt
+
+    go2rtc:
+      streams:
+        c200_1:
+          - rtsp://{FRIGATE_RTSP_USERNAME}:{FRIGATE_RTSP_PASSWORD}@192.168.18.20:554/stream1
+        c200_1_sub:
+          - rtsp://{FRIGATE_RTSP_USERNAME}:{FRIGATE_RTSP_PASSWORD}@192.168.18.20:554/stream2
+        c200_2:
+          - rtsp://{FRIGATE_RTSP_USERNAME}:{FRIGATE_RTSP_PASSWORD}@192.168.18.21:554/stream1
+        c200_2_sub:
+          - rtsp://{FRIGATE_RTSP_USERNAME}:{FRIGATE_RTSP_PASSWORD}@192.168.18.21:554/stream2
+        c200_3:
+          - rtsp://{FRIGATE_RTSP_USERNAME}:{FRIGATE_RTSP_PASSWORD}@192.168.18.22:554/stream1
+        c200_3_sub:
+          - rtsp://{FRIGATE_RTSP_USERNAME}:{FRIGATE_RTSP_PASSWORD}@192.168.18.22:554/stream2
+
+    cameras:
+      tapoC200_1:
+        enabled: true
+        live:
+          streams:
+            Main: c200_1
+            Sub: c200_1_sub
+        onvif:
+          host: 192.168.18.20
+          port: 2020
+          user: '{FRIGATE_RTSP_USERNAME}'
+          password: '{FRIGATE_RTSP_PASSWORD}'
+        ffmpeg:
+          output_args:
+            record: preset-record-generic-audio-aac
+          inputs:
+            - path: rtsp://127.0.0.1:8554/c200_1
+              input_args: preset-rtsp-restream
+              roles:
+                - record
+            - path: rtsp://127.0.0.1:8554/c200_1_sub
+              input_args: preset-rtsp-restream
+              roles:
+                - detect
+                - audio
+
+      tapoC200_2:
+        enabled: true
+        live:
+          streams:
+            Main: c200_2
+            Sub: c200_2_sub
+        onvif:
+          host: 192.168.18.21
+          port: 2020
+          user: '{FRIGATE_RTSP_USERNAME}'
+          password: '{FRIGATE_RTSP_PASSWORD}'
+        ffmpeg:
+          output_args:
+            record: preset-record-generic-audio-aac
+          inputs:
+            - path: rtsp://127.0.0.1:8554/c200_2
+              input_args: preset-rtsp-restream
+              roles:
+                - record
+            - path: rtsp://127.0.0.1:8554/c200_2_sub
+              input_args: preset-rtsp-restream
+              roles:
+                - detect
+                - audio
+
+      tapoC200_3:
+        enabled: true
+        live:
+          streams:
+            Main: c200_3
+            Sub: c200_3_sub
+        onvif:
+          host: 192.168.18.22
+          port: 2020
+          user: '{FRIGATE_RTSP_USERNAME}'
+          password: '{FRIGATE_RTSP_PASSWORD}'
+        ffmpeg:
+          output_args:
+            record: preset-record-generic-audio-aac
+          inputs:
+            - path: rtsp://127.0.0.1:8554/c200_3
+              input_args: preset-rtsp-restream
+              roles:
+                - record
+            - path: rtsp://127.0.0.1:8554/c200_3_sub
+              input_args: preset-rtsp-restream
+              roles:
+                - detect
+                - audio

apps/frigate/deployment.yaml

@@ -0,0 +1,70 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: frigate
+  namespace: frigate
+spec:
+  selector:
+    matchLabels:
+      app: frigate
+  template:
+    metadata:
+      labels:
+        app: frigate
+    spec:
+      containers:
+      - name: frigate
+        image: ghcr.io/blakeblackshear/frigate:stable-tensorrt
+        imagePullPolicy: Always
+        resources:
+          limits:
+            nvidia.com/gpu: 1
+        envFrom:
+          - secretRef:
+              name: frigate
+        ports:
+          - containerPort: 8971
+            protocol: TCP
+            name: http
+          - containerPort: 8554
+            protocol: TCP
+            name: rtsp
+          - containerPort: 8555
+            protocol: TCP
+            name: webrtc-tcp
+          - containerPort: 8555
+            protocol: UDP
+            name: webrtc-udp
+        volumeMounts:
+          - mountPath: /config
+            name: frigate-config
+          - mountPath: /config/config.yml
+            subPath: config.yml
+            name: frigate-configmap
+          - mountPath: /media/frigate
+            name: frigate-media
+          - mountPath: /tmp/cache
+            name: frigate-cache
+          - mountPath: /dev/shm
+            name: frigate-dshm
+      volumes:
+      - name: frigate-config
+        persistentVolumeClaim: 
+          claimName: frigate-config
+      - name: frigate-configmap
+        configMap:
+          name: frigate
+          items:
+            - key: config.yml
+              path: config.yml
+      - name: frigate-media
+        persistentVolumeClaim: 
+          claimName: frigate-media
+      - name: frigate-cache
+        emptyDir:
+          medium: Memory
+          sizeLimit: 1Gi
+      - name: frigate-dshm
+        emptyDir:
+          medium: Memory
+          sizeLimit: 1Gi

apps/frigate/ingress.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: frigate
+  namespace: frigate
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  rules:
+  - host: frigate.michaelthomson.dev
+    http:
+      paths:
+      - pathType: ImplementationSpecific
+        path: /
+        backend:
+          service:
+            name: frigate
+            port: 
+              name: http
+  tls:
+  - hosts:
+    - frigate.michaelthomson.dev
+    secretName: frigate-tls

apps/frigate/networkresource.yaml

@@ -0,0 +1,13 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkResource
+metadata:
+  name: frigate
+  namespace: frigate
+spec:
+  networkRouterRef:
+    name: homelab
+    namespace: netbird
+  serviceRef:
+    name: frigate
+  groups:
+    - name: homelab-services

apps/frigate/pvc-config.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: frigate-config
+  namespace: frigate
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi

apps/frigate/pvc-media.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: frigate-media
+  namespace: frigate
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: nfs-client
+  resources:
+    requests:
+      storage: 10Gi

apps/frigate/secret.yaml

@@ -0,0 +1,24 @@
+apiVersion: v1
+stringData:
+    FRIGATE_MQTT_PASSWORD: ENC[AES256_GCM,data:2Q78LPHG682UgvVmZCg=,iv:QjhxxfgYKhA5/Btmu48E8QsIYUbdE0SSRmhkuJtmEJA=,tag:PUwGu6Vz/q3xkLWakIebqw==,type:str]
+    FRIGATE_RTSP_USERNAME: ENC[AES256_GCM,data:6AlV8zxMxkpHLXlMEQ==,iv:4P7cYe7pLsI74CMQz/YhZ0/TG4lwjsNIRL/NuMmi4/E=,tag:M3jRqHkeHLZY2DS+nJZasA==,type:str]
+    FRIGATE_RTSP_PASSWORD: ENC[AES256_GCM,data:PNI3OU9QCiOEABQu6Tg=,iv:npbl8YE1iTeEA5mJOlEb6EUKhTjd7s7lRfPVCfu+OTE=,tag:PPu1JGT8PSsSfVgOk4sVgw==,type:str]
+kind: Secret
+metadata:
+    name: frigate
+    namespace: frigate
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3ZWVxNElZM1pFNEx6eE9q
+            U3ZHTzdhcXMzWmRBWGM0eDFTVCtFOGhGYzN3ClZ2U2NaSFVuaUN6RDhaYkVnb1du
+            M2JFMzBkeWZUaFBKeEZYb2FiMytIeWcKLS0tIEFQelhqQUhDODlTL2J4M0kzK05m
+            YjFheFgwRGVEVWJ3TW94UWlTREV6K2cKpnqUg4qLeOtIfecGjV2nUAYZGTkHCrT6
+            OHfL5W55BqcQJYovv37JJHkNV+IHuVNo7aqO/gx5AE0HfMWPfy6QGg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-09-09T12:12:10Z"
+    mac: ENC[AES256_GCM,data:mmgt9brUUt7OIbVrNDws3itVRihhpPceDSCJH/OXbgZhCChTk2i5nx7DAhzGnFik9n6jHi9+E13a7XO9wh0rUb/EMcBZhUHDwsYmPpbAUuWAzFYUXJ1MVNj0IbmGK2qoaZHKPh7WD8/5ITB0Ldv+CgAdmQ5N+QtvtfV+0IcI3XU=,iv:ZRTBFPG3Wi0Bx7yzSjAgzsxUvHe+yK4lVmesUbHMQmg=,tag:T8tT0KkMNBWdqDpGZ5m6Og==,type:str]
+    version: 3.13.3

apps/frigate/service.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: frigate
+  namespace: frigate
+spec:
+  selector:
+    app: frigate
+  ports:
+    - name: http
+      port: 8971
+      targetPort: http
+    - name: rtsp
+      port: 8554
+      targetPort: rtsp
+    - name: webrtc-tcp
+      port: 8555
+      targetPort: webrtc-tcp
+    - name: webrtc-udp
+      port: 8555
+      protocol: UDP
+      targetPort: webrtc-udp

apps/gitea/networkresource.yaml

@@ -0,0 +1,13 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkResource
+metadata:
+  name: gitea
+  namespace: gitea
+spec:
+  networkRouterRef:
+    name: homelab
+    namespace: netbird
+  serviceRef:
+    name: gitea-http
+  groups:
+    - name: homelab-services

apps/grimmory/networkresource.yaml

@@ -0,0 +1,13 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkResource
+metadata:
+  name: grimmory
+  namespace: grimmory
+spec:
+  networkRouterRef:
+    name: homelab
+    namespace: netbird
+  serviceRef:
+    name: grimmory
+  groups:
+    - name: homelab-services

apps/homeassistant/networkresource.yaml

@@ -10,4 +10,4 @@ spec:
   serviceRef:
     name: homeassistant
   groups:
-    - name: All
+    - name: homelab-services

apps/homeassistant/whisper-config.yaml

@@ -7,5 +7,5 @@ data:
   TZ: "America/Toronto"
   PUID: "1000"
   PGID: "1000"
-  WHISPER_MODEL: "base"
+  WHISPER_MODEL: "medium"
   WHISPER_LANG: "en"

apps/immich/cluster.yaml

@@ -34,7 +34,7 @@ spec:
       source: immich-postgres
 
   storage:
-    size: 8Gi
+    size: 10Gi
     storageClass: longhorn-pg
 
   externalClusters:

apps/immich/networkresource.yaml

@@ -0,0 +1,13 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkResource
+metadata:
+  name: immich
+  namespace: immich
+spec:
+  networkRouterRef:
+    name: homelab
+    namespace: netbird
+  serviceRef:
+    name: immich-server
+  groups:
+    - name: homelab-services

apps/karakeep/networkresource-web.yaml

@@ -0,0 +1,13 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkResource
+metadata:
+  name: karakeep
+  namespace: karakeep
+spec:
+  networkRouterRef:
+    name: homelab
+    namespace: netbird
+  serviceRef:
+    name: web
+  groups:
+    - name: homelab-services

apps/karakeep/web-service.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: web
+  name: karakeep
   namespace: karakeep
 spec:
   selector:

apps/kube-prometheus-stack/networkresource-grafana.yaml

@@ -0,0 +1,13 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkResource
+metadata:
+  name: grafana
+  namespace: kube-prometheus-stack
+spec:
+  networkRouterRef:
+    name: homelab
+    namespace: netbird
+  serviceRef:
+    name: kube-prometheus-stack-grafana
+  groups:
+    - name: homelab-services

apps/media/bazarr/networkresource.yaml

@@ -0,0 +1,13 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkResource
+metadata:
+  name: bazarr
+  namespace: media
+spec:
+  networkRouterRef:
+    name: homelab
+    namespace: netbird
+  serviceRef:
+    name: bazarr
+  groups:
+    - name: homelab-services

apps/media/jellyfin/deployment.yaml

@@ -47,7 +47,7 @@ spec:
       - name: cache
         emptyDir:
           medium: Memory
-          sizeLimit: 2Gi
+          sizeLimit: 3Gi
       - name: dev-dri
         hostPath:
           path: /dev/dri

apps/media/jellyfin/networkresource.yaml

@@ -10,4 +10,4 @@ spec:
   serviceRef:
     name: jellyfin
   groups:
-    - name: All
+    - name: homelab-services

apps/media/jellyseerr/networkresource.yaml

@@ -0,0 +1,13 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkResource
+metadata:
+  name: jellyseerr
+  namespace: media
+spec:
+  networkRouterRef:
+    name: homelab
+    namespace: netbird
+  serviceRef:
+    name: seerr-seerr-chart
+  groups:
+    - name: homelab-services

apps/media/prowlarr/networkresource.yaml

@@ -0,0 +1,13 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkResource
+metadata:
+  name: prowlarr
+  namespace: media
+spec:
+  networkRouterRef:
+    name: homelab
+    namespace: netbird
+  serviceRef:
+    name: prowlarr
+  groups:
+    - name: homelab-services

apps/media/radarr/networkresource.yaml

@@ -0,0 +1,13 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkResource
+metadata:
+  name: radarr
+  namespace: media
+spec:
+  networkRouterRef:
+    name: homelab
+    namespace: netbird
+  serviceRef:
+    name: radarr
+  groups:
+    - name: homelab-services

apps/media/sabnzbd/networkresource.yaml

@@ -0,0 +1,13 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkResource
+metadata:
+  name: sabnzbd
+  namespace: media
+spec:
+  networkRouterRef:
+    name: homelab
+    namespace: netbird
+  serviceRef:
+    name: sabnzbd
+  groups:
+    - name: homelab-services

apps/media/sonarr/networkresource.yaml

@@ -0,0 +1,13 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkResource
+metadata:
+  name: sonarr
+  namespace: media
+spec:
+  networkRouterRef:
+    name: homelab
+    namespace: netbird
+  serviceRef:
+    name: sonarr
+  groups:
+    - name: homelab-services

apps/michaelthomson/networkresource.yaml

@@ -0,0 +1,13 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkResource
+metadata:
+  name: michaelthomson
+  namespace: michaelthomson
+spec:
+  networkRouterRef:
+    name: homelab
+    namespace: netbird
+  serviceRef:
+    name: michaelthomson
+  groups:
+    - name: homelab-services

apps/nextcloud/networkresource.yaml

@@ -0,0 +1,13 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkResource
+metadata:
+  name: nextcloud
+  namespace: nextcloud
+spec:
+  networkRouterRef:
+    name: homelab
+    namespace: netbird
+  serviceRef:
+    name: nextcloud
+  groups:
+    - name: homelab-services

apps/ollama/release.yaml

@@ -1,43 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: ollama
-  namespace: ollama
-spec:
-  chart:
-    spec:
-      chart: ollama
-      version: 1.x
-      sourceRef:
-        kind: HelmRepository
-        name: ollama
-  interval: 15m
-  releaseName: ollama
-  values:
-    runtimeClassName: nvidia
-    ollama:
-      gpu:
-        enabled: true
-        type: nvidia
-        nvidiaResource: nvidia.com/gpu
-        number: 1
-      models:
-        pull:
-          - qwen3.5:9b
-        run:
-          - qwen3.5:9b
-    ingress:
-      enabled: true
-      annotations:
-        cert-manager.io/cluster-issuer: "letsencrypt-prod"
-        traefik.ingress.kubernetes.io/router.entrypoints: websecure
-        traefik.ingress.kubernetes.io/router.tls: "true"
-      hosts:
-        - host: ollama.michaelthomson.dev
-          paths:
-            - path: /
-              pathType: Prefix
-      tls:
-        - hosts:
-            - ollama.michaelthomson.dev
-          secretName: ollama-tls

apps/pihole/networkresource.yaml

@@ -0,0 +1,13 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkResource
+metadata:
+  name: pihole
+  namespace: pihole
+spec:
+  networkRouterRef:
+    name: homelab
+    namespace: netbird
+  serviceRef:
+    name: pihole
+  groups:
+    - name: homelab-services

apps/syncthing/networkresource.yaml

@@ -0,0 +1,13 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkResource
+metadata:
+  name: syncthing
+  namespace: syncthing
+spec:
+  networkRouterRef:
+    name: homelab
+    namespace: netbird
+  serviceRef:
+    name: syncthing
+  groups:
+    - name: homelab-services

apps/uptime-kuma/networkresource.yaml

@@ -0,0 +1,13 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkResource
+metadata:
+  name: uptime-kuma
+  namespace: uptime-kuma
+spec:
+  networkRouterRef:
+    name: homelab
+    namespace: netbird
+  serviceRef:
+    name: uptime-kuma
+  groups:
+    - name: homelab-services

apps/vaultwarden/admincreds-secret.yaml

@@ -1,22 +0,0 @@
-apiVersion: v1
-data:
-    ADMIN_TOKEN: ENC[AES256_GCM,data:N0kMJfrvylK/MiG+Yq9IpaPx0Q0=,iv:GR/ZxbKOim54hbryAw5MbktstNZ4upqXi/tsM4CPGmA=,tag:4USciX0i9f0cPK6BAy8zDw==,type:str]
-kind: Secret
-metadata:
-    name: admincreds-secret
-    namespace: vaultwarden
-sops:
-    age:
-        - recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiTjhIQUJjRWZzR2VSMldz
-            M2d1YUZ6QWl6Z3hJM0xxMGV6N1d0U2RUTlVFCjZHSTdBOTd1QW5Hb3BsZEc2Ykdv
-            ZElxUTgrVG1EcmM5SGxiNW1WMHRpbWcKLS0tIG91WmRsNzhWa1R1dHZ3QWJqbnQx
-            ZEpndHIyQzllejI0K0t0bkVKOWloYWsKeSb8P3ZijFvLy9IzVDkxMakfyWS7tt8e
-            uo3wrtSTlPHzvozymM/hXVDzKI6XZIZnUBfebGQpk0DgymyYKrwFgw==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-12-17T20:36:08Z"
-    mac: ENC[AES256_GCM,data:sidIbGpK0REcpsX+lQyE6G6/qMH1EWsLzKc6p80X++L5ALzMT3zbKK7JNeGNIpAGdeX+3VF/g2JM5k+mIQdNQUjjxHuej3XQQ1PPKsis7GMpms2PSM9V51GbJ3QSeCW8hLqEDc7fKsB7dYLV+TAcrWtPg/lsV4VJ25eIkCQS7N4=,iv:gdORkFVZj0Rt6Qrx4K+xhk07TwKT6vxPu/sgg0Q/32E=,tag:A0shGOWTVSRPsNDG/kOM9g==,type:str]
-    encrypted_regex: ^(data|stringData)$
-    version: 3.11.0

apps/vaultwarden/config.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: vaultwarden-config
+  namespace: vaultwarden
+data:
+  DOMAIN: "https://vaultwarden.michaelthomson.dev"
+  SIGNUPS_ALLOWED: "false"
+  SMTP_HOST: "mail.michaelthomson.dev"
+  SMTP_FROM: "server@michaelthomson.dev"
+  SMTP_PORT: "465"
+  SMTP_SECURITY: "force_tls"

apps/vaultwarden/deployment.yaml

@@ -0,0 +1,34 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: vaultwarden
+  namespace: vaultwarden
+spec:
+  selector:
+    matchLabels:
+      app: vaultwarden
+  template:
+    metadata:
+      labels:
+        app: vaultwarden
+    spec:
+      containers:
+      - name: vaultwarden
+        image: vaultwarden/server:latest
+        imagePullPolicy: Always
+        envFrom:
+          - secretRef:
+              name: vaultwarden-secret
+          - configMapRef:
+              name: vaultwarden-config
+        ports:
+        - containerPort: 80
+          name: http
+          protocol: TCP
+        volumeMounts:
+        - mountPath: /data
+          name: data
+      volumes:
+      - name: data
+        persistentVolumeClaim: 
+          claimName: vaultwarden-pvc

apps/vaultwarden/ingress.yaml

@@ -0,0 +1,27 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: vaultwarden
+  namespace: vaultwarden
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
+    external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  rules:
+  - host: vaultwarden.michaelthomson.dev
+    http:
+      paths:
+      - pathType: ImplementationSpecific
+        path: /
+        backend:
+          service:
+            name: vaultwarden
+            port: 
+              name: http
+  tls:
+  - hosts:
+    - vaultwarden.michaelthomson.dev
+    secretName: vaultwarden-tls

apps/vaultwarden/networkresource.yaml

@@ -0,0 +1,13 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkResource
+metadata:
+  name: vaultwarden
+  namespace: vaultwarden
+spec:
+  networkRouterRef:
+    name: homelab
+    namespace: netbird
+  serviceRef:
+    name: vaultwarden
+  groups:
+    - name: homelab-services

apps/vaultwarden/pvc.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: vaultwarden-pvc
+  namespace: vaultwarden
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi

apps/vaultwarden/release.yaml

@@ -1,54 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: vaultwarden
-  namespace: vaultwarden
-spec:
-  chart:
-    spec:
-      chart: vaultwarden
-      version: 0.30.x
-      sourceRef:
-        kind: HelmRepository
-        name: vaultwarden
-  interval: 15m
-  releaseName: vaultwarden
-  values:
-    resourceType: Deployment
-    data:
-      name: "vaultwarden-data"
-      size: "15Gi"
-      class: "longhorn"
-      accessMode: "ReadWriteOnce"
-    domain: "https://vaultwarden.michaelthomson.dev"
-    signupsAllowed: false
-    signupsVerify: "true"
-    requireDeviceEmail: "true"
-    adminToken:
-      existingSecret: "admincreds-secret"
-      existingSecretKey: "ADMIN_TOKEN"
-    timeZone: "America/Toronto"
-    smtp:
-      existingSecret: "smtpcreds-secret"
-      host: "mail.michaelthomson.dev"
-      security: "force_tls"
-      port: 465
-      from: "vaultwarden@michaelthomson.dev"
-      fromName: "Vaultwarden"
-      username:
-        existingSecretKey: "SMTP_USERNAME"
-      password:
-        existingSecretKey: "SMTP_PASSWORD"
-    ingress:
-      enabled: true
-      class: "traefik"
-      additionalAnnotations:
-        cert-manager.io/cluster-issuer: "letsencrypt-prod"
-        external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
-        external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
-        traefik.ingress.kubernetes.io/router.entrypoints: websecure
-        traefik.ingress.kubernetes.io/router.tls: "true"
-      labels: {}
-      tls: true
-      hostname: "vaultwarden.michaelthomson.dev"
-      tlsSecret: vaultwarden-tls

apps/vaultwarden/secret.yaml

@@ -0,0 +1,24 @@
+apiVersion: v1
+stringData:
+    SMTP_PASSWORD: ENC[AES256_GCM,data:ckVcecLJPGsD4RYEva2TJluXy2TvhS3aYPzxAyEN,iv:AteDpQU+1p5+/nxtgSDhyH/O6dEPrLE6OrN8soMQNGk=,tag:DlaHPDzhBxRDbuuNdNSllw==,type:str]
+    SMTP_USERNAME: ENC[AES256_GCM,data:6oCLieSE7U0QIn6+q48oQSEiRKD8fYRe6A==,iv:Ub9f7Hni0N1pvQNfje+EUbXoQHb37v8Wja2u0bvp0/E=,tag:p4VfEXiQEqH3aQNt+9aMPQ==,type:str]
+    ADMIN_TOKEN: ENC[AES256_GCM,data:oUoWtQYgU5oEg7SAEjWqiOYkdaVS0ELwXgdfgaYUglkRdDZ0vOJ7axW4Ah4=,iv:hNBdD5zrut9y8R4nl1z28X9ou3pAvSEv58XLSjeMuUY=,tag:h78hZsfFYbD/35fEa0I2dw==,type:str]
+kind: Secret
+metadata:
+    name: vaultwarden-secret
+    namespace: vaultwarden
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3ZWVxNElZM1pFNEx6eE9q
+            U3ZHTzdhcXMzWmRBWGM0eDFTVCtFOGhGYzN3ClZ2U2NaSFVuaUN6RDhaYkVnb1du
+            M2JFMzBkeWZUaFBKeEZYb2FiMytIeWcKLS0tIEFQelhqQUhDODlTL2J4M0kzK05m
+            YjFheFgwRGVEVWJ3TW94UWlTREV6K2cKpnqUg4qLeOtIfecGjV2nUAYZGTkHCrT6
+            OHfL5W55BqcQJYovv37JJHkNV+IHuVNo7aqO/gx5AE0HfMWPfy6QGg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-06-21T00:57:10Z"
+    mac: ENC[AES256_GCM,data:iTUsBfc++AdMS0rd2isUEsnU7jp2Pg50KhtWR8J5bBWi/4xyoBVP2fr/c+jAVUMeGVbkZZb+zA6jvaTzhsITKyDwkyVIMShKfXeSLvr9PRMLExkif2DNRzkQ+jRhsnOFdtoUqnKfEN2QtjBJ0OkvN5RrjjMLnlmkswLDhIvQbyo=,iv:WbIIrJf7bpLft8t14XNCeuk88ij8TzkCMMQg0QKQW2o=,tag:sv1Jid832xDdmmOsof4ZGg==,type:str]
+    version: 3.13.1

apps/vaultwarden/service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: vaultwarden
+  namespace: vaultwarden
+spec:
+  selector:
+    app: vaultwarden
+  ports:
+  - port: 80
+    targetPort: http
+    name: http

apps/vaultwarden/smtpcreds-secret.yaml

@@ -1,23 +0,0 @@
-apiVersion: v1
-data:
-    SMTP_PASSWORD: ENC[AES256_GCM,data:SxuZaVeYXXhar0Qhi7clkXyO15rBG8xI9QTOzgwqGVCjHOW4,iv:zKgyHRU6GOnz6Vpt1Ko4/B9ySZpbMf2J/bN8WdUaitY=,tag:4+02vnssi0okvMZDel7/mw==,type:str]
-    SMTP_USERNAME: ENC[AES256_GCM,data:NREKMX/dvkejjoiLa764rT7CDl0nPoAaNWkXGnqrgdPhnsMVSUv1RA==,iv:VXe3z426+688ojm4JU3hyytFWCJ2oYgSFVnIOv2ry8Y=,tag:Tj5k8LApkxd+TBJFF/6/Zg==,type:str]
-kind: Secret
-metadata:
-    name: smtpcreds-secret
-    namespace: vaultwarden
-sops:
-    age:
-        - recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3ZWVxNElZM1pFNEx6eE9q
-            U3ZHTzdhcXMzWmRBWGM0eDFTVCtFOGhGYzN3ClZ2U2NaSFVuaUN6RDhaYkVnb1du
-            M2JFMzBkeWZUaFBKeEZYb2FiMytIeWcKLS0tIEFQelhqQUhDODlTL2J4M0kzK05m
-            YjFheFgwRGVEVWJ3TW94UWlTREV6K2cKpnqUg4qLeOtIfecGjV2nUAYZGTkHCrT6
-            OHfL5W55BqcQJYovv37JJHkNV+IHuVNo7aqO/gx5AE0HfMWPfy6QGg==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-12-17T20:36:08Z"
-    mac: ENC[AES256_GCM,data:402GE3Cqd1N+cQBRnfNb5+/dudSy5pO1Hilc4DW0n+xm4x5sn8wr8C/mL6NDoBKh8fc7JAPPShCfx5B2RdxBL0hs7fkohSIKvtU4hq75enq/bPOtRoxuSxAMH89ayVSbP0V1llWsHFwGJROEMp/9vpqWUFqFvf3uCC8tLOGSy/8=,iv:lp0JMs56ltxFLJOiOWoTa2+D383SgD15v7XJpAwEDdw=,tag:/dezyOAu2W6nTGNQxKTlpA==,type:str]
-    encrypted_regex: ^(data|stringData)$
-    version: 3.11.0

bootstrap/apps/kustomization-emqx.yaml

@@ -1,12 +1,12 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: ollama
+  name: emqx
   namespace: flux-system
 spec:
   interval: 15m
-  path: ./apps/ollama
-  prune: true
+  path: ./apps/emqx
+  prune: true # remove any elements later removed from the above path
   wait: true
   sourceRef:
     kind: GitRepository

bootstrap/apps/kustomization-frigate.yaml

@@ -0,0 +1,19 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: frigate
+  namespace: flux-system
+spec:
+  interval: 15m
+  path: ./apps/frigate
+  prune: true # remove any elements later removed from the above path
+  wait: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+  dependsOn:
+    - name: infra-configs

infrastructure/configs/longhorn/recurring-job-backup.yaml

@@ -8,5 +8,5 @@ spec:
   task: "backup"
   groups:
   - backup
-  retain: 10
+  retain: 2
   concurrency: 1

infrastructure/configs/longhorn/recurring-job-snapshot.yaml

@@ -4,9 +4,9 @@ metadata:
   name: snapshot
   namespace: longhorn-system
 spec:
-  cron: "0 * * * *"
+  cron: "30 * * * *"
   task: "snapshot"
   groups:
   - snapshot
-  retain: 24
-  concurrency: 2
+  retain: 1
+  concurrency: 1

infrastructure/controllers/nvidia-device-plugin/release.yaml

@@ -1,27 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: nvidia-device-plugin
-  namespace: nvidia-device-plugin
-spec:
-  chart:
-    spec:
-      chart: nvidia-device-plugin
-      version: 0.17.x
-      sourceRef:
-        kind: HelmRepository
-        name: nvdp
-  interval: 15m
-  releaseName: nvidia-device-plugin
-  values:
-    runtimeClassName: nvidia
-    config:
-      default: time-slicing
-      map:
-        time-slicing: |
-          version: v1
-          sharing:
-            timeSlicing:
-              resources:
-              - name: nvidia.com/gpu
-                replicas: 5

infrastructure/controllers/nvidia-device-plugin/repository.yaml

@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: nvdp
-  namespace: nvidia-device-plugin
-spec:
-  interval: 15m
-  url: https://nvidia.github.io/k8s-device-plugin

infrastructure/controllers/nvidia-device-plugin/runtime-class.yaml

@@ -1,5 +0,0 @@
-apiVersion: node.k8s.io/v1
-kind: RuntimeClass
-metadata:
-  name: nvidia
-handler: nvidia

infrastructure/controllers/nvidia-gpu-operator/release.yaml

@@ -0,0 +1,37 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: nvidia-gpu-operator
+  namespace: nvidia-gpu-operator
+spec:
+  chart:
+    spec:
+      chart: gpu-operator
+      version: 26.x
+      sourceRef:
+        kind: HelmRepository
+        name: nvidia
+  interval: 15m
+  releaseName: nvidia-gpu-operator
+  values:
+    driver:
+      enabled: false
+    toolkit:
+      enabled: false
+    hostPaths:
+      driverInstallDir: "/usr/local"
+    devicePlugin:
+      config:
+        create: true
+        name: "time-slicing-config"
+        default: "timeslicing"
+        data:
+          timeslicing: |-
+            version: v1
+            flags:
+              migStrategy: none
+            sharing:
+              timeSlicing:
+                resources:
+                - name: nvidia.com/gpu
+                  replicas: 5

infrastructure/controllers/nvidia-gpu-operator/repository.yaml

@@ -1,8 +1,8 @@
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:
-  name: vaultwarden
-  namespace: vaultwarden
+  name: nvidia
+  namespace: nvidia-gpu-operator
 spec:
   interval: 15m
-  url: https://guerzon.github.io/vaultwarden
+  url: https://helm.ngc.nvidia.com/nvidia

infrastructure/namespaces/namespace-emqx.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: emqx

infrastructure/namespaces/namespace-frigate.yaml

@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: ollama
+  name: frigate
   labels:
     pod-security.kubernetes.io/enforce: privileged
     pod-security.kubernetes.io/audit: privileged

infrastructure/namespaces/namespace-nvidia-device-plugin.yaml

@@ -1,8 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: nvidia-device-plugin
-  labels:
-    pod-security.kubernetes.io/enforce: privileged
-    pod-security.kubernetes.io/audit: privileged
-    pod-security.kubernetes.io/warn: privileged

infrastructure/namespaces/namespace-nvidia-gpu-operator.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: nvidia-gpu-operator
+  labels:
+    pod-security.kubernetes.io/enforce: privileged