Add renovate.json

2026-09-19 14:28:29 +00:00 · 2026-03-16 13:16:20 +00:00
92 changed files with 4552 additions and 1185 deletions
@@ -1,13 +0,0 @@
-apiVersion: netbird.io/v1alpha1
-kind: NetworkResource
-metadata:
-  name: actual
-  namespace: actual
-spec:
-  networkRouterRef:
-    name: homelab
-    namespace: netbird
-  serviceRef:
-    name: actual
-  groups:
-    - name: homelab-services
@@ -0,0 +1,34 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: baikal
+  namespace: baikal
+spec:
+  selector:
+    matchLabels:
+      app: baikal
+  template:
+    metadata:
+      labels:
+        app: baikal
+    spec:
+      containers:
+        - name: baikal
+          image: ckulka/baikal:nginx
+          ports:
+            - containerPort: 80
+              name: http
+              protocol: TCP
+          volumeMounts:
+            - mountPath: /var/www/baikal/config
+              name: config
+            - mountPath: /var/www/baikal/Specific
+              name: data
+      restartPolicy: Always
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: config
+        - name: data
+          persistentVolumeClaim:
+            claimName: data
@@ -1,8 +1,8 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: vaultwarden
-  namespace: vaultwarden
+  name: baikal
+  namespace: baikal
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
@@ -11,17 +11,17 @@ metadata:
    traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
  rules:
-  - host: vaultwarden.michaelthomson.dev
+  - host: baikal.michaelthomson.dev
    http:
      paths:
      - pathType: ImplementationSpecific
        path: /
        backend:
          service:
-            name: vaultwarden
+            name: baikal
            port: 
              name: http
  tls:
-  - hosts:
-    - vaultwarden.michaelthomson.dev
-    secretName: vaultwarden-tls
+    - hosts:
+        - baikal.michaelthomson.dev
+      secretName: baikal-tls
@@ -1,8 +1,8 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: frigate-config
-  namespace: frigate
+  name: config
+  namespace: baikal
 spec:
  accessModes:
    - ReadWriteOnce
@@ -1,8 +1,8 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: vaultwarden-pvc
-  namespace: vaultwarden
+  name: data
+  namespace: baikal
 spec:
  accessModes:
    - ReadWriteOnce
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: baikal
+  namespace: baikal
+spec:
+  selector:
+    app: baikal
+  ports:
+    - name: http
+      port: 80
+      targetPort: http
@@ -1,13 +0,0 @@
-apiVersion: netbird.io/v1alpha1
-kind: NetworkResource
-metadata:
-  name: emqx
-  namespace: emqx
-spec:
-  networkRouterRef:
-    name: homelab
-    namespace: netbird
-  serviceRef:
-    name: emqx
-  groups:
-    - name: homelab-services
@@ -1,72 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: emqx
-  namespace: emqx
-spec:
-  chart:
-    spec:
-      chart: emqx
-      version: 5.x
-      sourceRef:
-        kind: HelmRepository
-        name: emqx
-  interval: 15m
-  releaseName: emqx
-  values:
-    persistence:
-      enabled: true
-      size: 20Mi
-      storageClassName: longhorn
-      accessMode: ReadWriteOnce
-
-    ## EMQX configuration item, see the documentation (https://hub.docker.com/r/emqx/emqx)
-    emqxConfig:
-      EMQX_CLUSTER__DISCOVERY_STRATEGY: "dns"
-      EMQX_DASHBOARD__DEFAULT_USERNAME: "admin"
-      EMQX_DASHBOARD__DEFAULT_PASSWORD: "public"
-
-    ingress:
-      ## ingress for EMQX Dashboard
-      dashboard:
-        enabled: true
-        annotations:
-          cert-manager.io/cluster-issuer: "letsencrypt-prod"
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-          traefik.ingress.kubernetes.io/router.tls: "true"
-        path: /
-        pathType: ImplementationSpecific
-        hosts:
-          - emqx.michaelthomson.dev
-        tls:
-          - hosts:
-              - emqx.michaelthomson.dev
-            secretName: emqx-tls
-      mqtt:
-        enabled: false
-        annotations:
-          cert-manager.io/cluster-issuer: "letsencrypt-prod"
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-          traefik.ingress.kubernetes.io/router.tls: "true"
-        path: /
-        pathType: ImplementationSpecific
-        hosts:
-          - mqtt.emqx.michaelthomson.dev
-        tls:
-          - hosts:
-              - mqtt.emqx.michaelthomson.dev
-            secretName: emqx-tls
-      ws:
-        enabled: false
-        annotations:
-          cert-manager.io/cluster-issuer: "letsencrypt-prod"
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-          traefik.ingress.kubernetes.io/router.tls: "true"
-        path: /mqtt
-        pathType: ImplementationSpecific
-        hosts:
-          - mqtt.emqx.michaelthomson.dev
-        tls:
-          - hosts:
-              - mqtt.emqx.michaelthomson.dev
-            secretName: emqx-tls
@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: emqx
-  namespace: emqx
-spec:
-  interval: 15m
-  url: https://repos.emqx.io/charts
@@ -1,153 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: frigate
-  namespace: frigate
-data:
-  config.yml: |
-    tls:
-      enabled: false
-
-    mqtt:
-      enabled: true
-      host: emqx.emqx.svc.cluster.local
-      user: frigate
-      password: '{FRIGATE_MQTT_PASSWORD}'
-
-    ffmpeg:
-      hwaccel_args: preset-nvidia
-
-    detectors:
-      onnx:
-        type: onnx
-
-    detect:
-      enabled: true
-
-    audio:
-      enabled: true
-      min_volume: 200
-      listen:
-        - cat
-        - meow
-        - hiss
-        - fart
-        - speech
-
-    objects:
-      track:
-        - person
-        - cat
-
-    record:
-      enabled: true
-      motion:
-        days: 1
-      alerts:
-        retain:
-          days: 1
-          mode: motion
-      detections:
-        retain:
-          days: 1
-          mode: motion
-
-    model:
-      model_type: yolo-generic
-      width: 640 # <--- should match the imgsize set during model export
-      height: 640 # <--- should match the imgsize set during model export
-      input_tensor: nchw
-      input_dtype: float
-      path: /config/model_cache/yolov9-c-640.onnx
-      labelmap_path: /labelmap/coco-80.txt
-
-    go2rtc:
-      streams:
-        c200_1:
-          - rtsp://{FRIGATE_RTSP_USERNAME}:{FRIGATE_RTSP_PASSWORD}@192.168.18.20:554/stream1
-        c200_1_sub:
-          - rtsp://{FRIGATE_RTSP_USERNAME}:{FRIGATE_RTSP_PASSWORD}@192.168.18.20:554/stream2
-        c200_2:
-          - rtsp://{FRIGATE_RTSP_USERNAME}:{FRIGATE_RTSP_PASSWORD}@192.168.18.21:554/stream1
-        c200_2_sub:
-          - rtsp://{FRIGATE_RTSP_USERNAME}:{FRIGATE_RTSP_PASSWORD}@192.168.18.21:554/stream2
-        c200_3:
-          - rtsp://{FRIGATE_RTSP_USERNAME}:{FRIGATE_RTSP_PASSWORD}@192.168.18.22:554/stream1
-        c200_3_sub:
-          - rtsp://{FRIGATE_RTSP_USERNAME}:{FRIGATE_RTSP_PASSWORD}@192.168.18.22:554/stream2
-
-    cameras:
-      tapoC200_1:
-        enabled: true
-        live:
-          streams:
-            Main: c200_1
-            Sub: c200_1_sub
-        onvif:
-          host: 192.168.18.20
-          port: 2020
-          user: '{FRIGATE_RTSP_USERNAME}'
-          password: '{FRIGATE_RTSP_PASSWORD}'
-        ffmpeg:
-          output_args:
-            record: preset-record-generic-audio-aac
-          inputs:
-            - path: rtsp://127.0.0.1:8554/c200_1
-              input_args: preset-rtsp-restream
-              roles:
-                - record
-            - path: rtsp://127.0.0.1:8554/c200_1_sub
-              input_args: preset-rtsp-restream
-              roles:
-                - detect
-                - audio
-
-      tapoC200_2:
-        enabled: true
-        live:
-          streams:
-            Main: c200_2
-            Sub: c200_2_sub
-        onvif:
-          host: 192.168.18.21
-          port: 2020
-          user: '{FRIGATE_RTSP_USERNAME}'
-          password: '{FRIGATE_RTSP_PASSWORD}'
-        ffmpeg:
-          output_args:
-            record: preset-record-generic-audio-aac
-          inputs:
-            - path: rtsp://127.0.0.1:8554/c200_2
-              input_args: preset-rtsp-restream
-              roles:
-                - record
-            - path: rtsp://127.0.0.1:8554/c200_2_sub
-              input_args: preset-rtsp-restream
-              roles:
-                - detect
-                - audio
-
-      tapoC200_3:
-        enabled: true
-        live:
-          streams:
-            Main: c200_3
-            Sub: c200_3_sub
-        onvif:
-          host: 192.168.18.22
-          port: 2020
-          user: '{FRIGATE_RTSP_USERNAME}'
-          password: '{FRIGATE_RTSP_PASSWORD}'
-        ffmpeg:
-          output_args:
-            record: preset-record-generic-audio-aac
-          inputs:
-            - path: rtsp://127.0.0.1:8554/c200_3
-              input_args: preset-rtsp-restream
-              roles:
-                - record
-            - path: rtsp://127.0.0.1:8554/c200_3_sub
-              input_args: preset-rtsp-restream
-              roles:
-                - detect
-                - audio
@@ -1,70 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: frigate
-  namespace: frigate
-spec:
-  selector:
-    matchLabels:
-      app: frigate
-  template:
-    metadata:
-      labels:
-        app: frigate
-    spec:
-      containers:
-      - name: frigate
-        image: ghcr.io/blakeblackshear/frigate:stable-tensorrt
-        imagePullPolicy: Always
-        resources:
-          limits:
-            nvidia.com/gpu: 1
-        envFrom:
-          - secretRef:
-              name: frigate
-        ports:
-          - containerPort: 8971
-            protocol: TCP
-            name: http
-          - containerPort: 8554
-            protocol: TCP
-            name: rtsp
-          - containerPort: 8555
-            protocol: TCP
-            name: webrtc-tcp
-          - containerPort: 8555
-            protocol: UDP
-            name: webrtc-udp
-        volumeMounts:
-          - mountPath: /config
-            name: frigate-config
-          - mountPath: /config/config.yml
-            subPath: config.yml
-            name: frigate-configmap
-          - mountPath: /media/frigate
-            name: frigate-media
-          - mountPath: /tmp/cache
-            name: frigate-cache
-          - mountPath: /dev/shm
-            name: frigate-dshm
-      volumes:
-      - name: frigate-config
-        persistentVolumeClaim: 
-          claimName: frigate-config
-      - name: frigate-configmap
-        configMap:
-          name: frigate
-          items:
-            - key: config.yml
-              path: config.yml
-      - name: frigate-media
-        persistentVolumeClaim: 
-          claimName: frigate-media
-      - name: frigate-cache
-        emptyDir:
-          medium: Memory
-          sizeLimit: 1Gi
-      - name: frigate-dshm
-        emptyDir:
-          medium: Memory
-          sizeLimit: 1Gi
@@ -1,13 +0,0 @@
-apiVersion: netbird.io/v1alpha1
-kind: NetworkResource
-metadata:
-  name: frigate
-  namespace: frigate
-spec:
-  networkRouterRef:
-    name: homelab
-    namespace: netbird
-  serviceRef:
-    name: frigate
-  groups:
-    - name: homelab-services
@@ -1,24 +0,0 @@
-apiVersion: v1
-stringData:
-    FRIGATE_MQTT_PASSWORD: ENC[AES256_GCM,data:2Q78LPHG682UgvVmZCg=,iv:QjhxxfgYKhA5/Btmu48E8QsIYUbdE0SSRmhkuJtmEJA=,tag:PUwGu6Vz/q3xkLWakIebqw==,type:str]
-    FRIGATE_RTSP_USERNAME: ENC[AES256_GCM,data:6AlV8zxMxkpHLXlMEQ==,iv:4P7cYe7pLsI74CMQz/YhZ0/TG4lwjsNIRL/NuMmi4/E=,tag:M3jRqHkeHLZY2DS+nJZasA==,type:str]
-    FRIGATE_RTSP_PASSWORD: ENC[AES256_GCM,data:PNI3OU9QCiOEABQu6Tg=,iv:npbl8YE1iTeEA5mJOlEb6EUKhTjd7s7lRfPVCfu+OTE=,tag:PPu1JGT8PSsSfVgOk4sVgw==,type:str]
-kind: Secret
-metadata:
-    name: frigate
-    namespace: frigate
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3ZWVxNElZM1pFNEx6eE9q
-            U3ZHTzdhcXMzWmRBWGM0eDFTVCtFOGhGYzN3ClZ2U2NaSFVuaUN6RDhaYkVnb1du
-            M2JFMzBkeWZUaFBKeEZYb2FiMytIeWcKLS0tIEFQelhqQUhDODlTL2J4M0kzK05m
-            YjFheFgwRGVEVWJ3TW94UWlTREV6K2cKpnqUg4qLeOtIfecGjV2nUAYZGTkHCrT6
-            OHfL5W55BqcQJYovv37JJHkNV+IHuVNo7aqO/gx5AE0HfMWPfy6QGg==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
-    encrypted_regex: ^(data|stringData)$
-    lastmodified: "2026-09-09T12:12:10Z"
-    mac: ENC[AES256_GCM,data:mmgt9brUUt7OIbVrNDws3itVRihhpPceDSCJH/OXbgZhCChTk2i5nx7DAhzGnFik9n6jHi9+E13a7XO9wh0rUb/EMcBZhUHDwsYmPpbAUuWAzFYUXJ1MVNj0IbmGK2qoaZHKPh7WD8/5ITB0Ldv+CgAdmQ5N+QtvtfV+0IcI3XU=,iv:ZRTBFPG3Wi0Bx7yzSjAgzsxUvHe+yK4lVmesUbHMQmg=,tag:T8tT0KkMNBWdqDpGZ5m6Og==,type:str]
-    version: 3.13.3
@@ -1,22 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: frigate
-  namespace: frigate
-spec:
-  selector:
-    app: frigate
-  ports:
-    - name: http
-      port: 8971
-      targetPort: http
-    - name: rtsp
-      port: 8554
-      targetPort: rtsp
-    - name: webrtc-tcp
-      port: 8555
-      targetPort: webrtc-tcp
-    - name: webrtc-udp
-      port: 8555
-      protocol: UDP
-      targetPort: webrtc-udp
@@ -1,6 +1,6 @@
 apiVersion: v1
-stringData:
-    mailer: ENC[AES256_GCM,data:IrYl0ghmMpe7LCGuHFAv8OOnnYPnxed8M86qEnXct/d3Xlf+vQ==,iv:d/Egq7dRzNbx/5cEL5lKxD+ZsDhTLCB1EGnP6RXok00=,tag:aiQoSAMKQ1b0mXUT0lw8+w==,type:str]
+data:
+    mailer: ENC[AES256_GCM,data:baGCpPHJejjMFeiBcgSroJWqmUj/8PzvwAdzZ+nLacen2I91iaIRIgztvsk=,iv:6M2+sKRc1ZC5CqY4X43xgGO/CeWOfjMVzNgelYd0V6c=,tag:I15tnxf8CQaLu+/0GNdeOA==,type:str]
 kind: Secret
 metadata:
    name: gitea-mailer-config-secret
@@ -16,7 +16,7 @@ sops:
            NkI0eUlmYjg3Zk9iVmNkZVpXWkh2TW8K/coOzGAPF42522cM6DZVAEEv3LmZaIhu
            BVyl8ijATNLMIfiFpP5bHpljPHrn3lGP70RzwoCV15t1fC6pjeParA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-05-12T01:59:49Z"
-    mac: ENC[AES256_GCM,data:TSNyIUQIRaX27K9ZbyiMCayFFIeUKmfD4Bz9Zu7Apa7NGqXmAWabzY3KHyjL14LDxmv4XJpA5W3DLI920DfOEUq2iW9EogMfSV7nEMMA6lzYMf+ca5W0BCwPE0MDBkTIL2nREoZh0FGDmq1M2syRIfaBrFKq97ZozQqz4AA8iZc=,iv:wCjERwABseOGN7LWiLzoT4VGHk9vnGdN0yl2eeQTAho=,tag:j/bDGqPoTm5FFGhERh1KJQ==,type:str]
+    lastmodified: "2025-12-17T20:36:08Z"
+    mac: ENC[AES256_GCM,data:QBxnUAGg6xchZ9iqKK8gAmdJhDfma5BZlJVRZcfzGM57diuO2OE4JDbjW5gqf21OACL4d2funVlXRVlioLoe0tfZJY3AAedOmyQVXdrr0PwarbPztbWAFVvIMeQWPZUyPd3GxgaAATeBVCanSEgVTIOVqCN/DXNSHY2XcQ9x9Y0=,iv:ugLYt5NxsTIy0wUul748IGIzayG+zPQ/z5kH3T9IfiE=,tag:3yTjZ+MMMVNmi/8p321fFg==,type:str]
    encrypted_regex: ^(data|stringData)$
-    version: 3.12.2
+    version: 3.11.0
@@ -1,13 +0,0 @@
-apiVersion: netbird.io/v1alpha1
-kind: NetworkResource
-metadata:
-  name: gitea
-  namespace: gitea
-spec:
-  networkRouterRef:
-    name: homelab
-    namespace: netbird
-  serviceRef:
-    name: gitea-http
-  groups:
-    - name: homelab-services
@@ -17,6 +17,8 @@ spec:
    global:
      storageClass: longhorn

+    replicaCount: 1
+
    service:
      ssh:
        type: LoadBalancer
@@ -45,7 +47,9 @@ spec:
          secretName: gitea-tls

    persistence:
+      claimName: gitea-shared-storage
      size: 10Gi
+      storageClass: longhorn

    gitea:
      config:
@@ -61,11 +65,11 @@ spec:
          ALLOWED_HOST_LIST: external,loopback,private
        mailer:
          ENABLED: true
-          FROM: server@michaelthomson.dev
+          FROM: gitea@michaelthomson.dev
          PROTOCOL: smtps
          SMTP_ADDR: mail.michaelthomson.dev
          SMTP_PORT: 465
-          USER: server@michaelthomson.dev
+          USER: gitea@michaelthomson.dev
      admin:
        existingSecret: admin-secret
        email: "gitea@michaelthomson.dev"
@@ -73,17 +77,23 @@ spec:
        - secret:
            secretName: gitea-mailer-config-secret

-    valkey-cluster:
+    redis-cluster:
      enabled: false

-    valkey:
-      enabled: true
-
    postgresql-ha:
      enabled: false

    postgresql:
      enabled: true
+      global:
+        postgresql:
+          auth:
+            password: gitea
+            database: gitea
+            username: gitea
+          service:
+            ports:
+              postgresql: 5432
      primary:
        persistence:
          size: 10Gi
@@ -1,23 +0,0 @@
-apiVersion: v1
-stringData:
-    mariadb-password: ENC[AES256_GCM,data:sRg+BqCvSWe/I9vLLRcgPyMs87BttZAejfKPI7kIej6L3sXasYE700jr9tw=,iv:VMnb9a72TYYBdC2RCD9wwpRdUZiiD+SFOZOl0ZIHjbU=,tag:eXRgY1VO0PDRJPUAr4RYXw==,type:str]
-    mariadb-root-password: ENC[AES256_GCM,data:86cu/5fSD2h7yQSt0b9cp15a56LYiyhdUfFVdhla7cs0GsIyDul2A4TuSQA=,iv:U+JPt6UUc70MzYAQBODEzl/wMQ+TEVBYZHxxMZf4xyw=,tag:CAdI37E9cj07yoltPxLjWg==,type:str]
-kind: Secret
-metadata:
-    name: mariadb-credentials
-    namespace: grimmory
-sops:
-    age:
-        - recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvOEhieFpaNU5CRElYRFRx
-            VjJqUm9Zbk44M3QvVlNqcUFGUnRjNlUvUERZCjA2VjJXdlJmSDdYeW5BbEF2RElV
-            QXZ6YVl3REVFRzY5RG81YzVyaWpBWTgKLS0tIEdITTBCUm1tZGhZVzFwbGszbDF6
-            ZzhZOEU2SUFUWllqOHZCS1c5YW5TQjQKbQqmVAWZq7aqBaFt+51oY7PZ2BcLc7Wa
-            neOgcwRTq2x27yoWNPlcWSsqFss5RLldriEer4QdwdIDlWEj8Js7uA==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-05-24T18:40:49Z"
-    mac: ENC[AES256_GCM,data:URvFnjTBRU17FIJTLjggheWWI63UcktsyMgrKP5Ib7/F4HcSbZySGis6Ty/y2Cn5uessjpf12IQ1EZ0Vybnm7w58/nb3+ZiEow5XtJ91OAw2iCJv00YyKtWgFqkymCHJu2a/SuuG3ibH5+MbucQKHUSXuxsRvYaJaigw1Gzi80I=,iv:3H2NNqh8eBqNvKybtsKYujjDeDlvmlwXxdzRoazU46E=,tag:tgYlwl0K7GbSX1pBtlD/xg==,type:str]
-    encrypted_regex: ^(data|stringData)$
-    version: 3.12.2
@@ -1,13 +0,0 @@
-apiVersion: netbird.io/v1alpha1
-kind: NetworkResource
-metadata:
-  name: grimmory
-  namespace: grimmory
-spec:
-  networkRouterRef:
-    name: homelab
-    namespace: netbird
-  serviceRef:
-    name: grimmory
-  groups:
-    - name: homelab-services
@@ -1,47 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: grimmory
-  namespace: grimmory
-spec:
-  chart:
-    spec:
-      chart: grimmory
-      version: 3.x
-      sourceRef:
-        kind: HelmRepository
-        name: grimmory
-  interval: 15m
-  releaseName: grimmory
-  values:
-    mariadb:
-      auth:
-        existingSecret: mariadb-credentials
-        secretKeys:
-          rootPasswordKey: mariadb-root-password
-          userPasswordKey: mariadb-password
-    ingress:
-      enabled: true
-      annotations:
-        cert-manager.io/cluster-issuer: "letsencrypt-prod"
-        traefik.ingress.kubernetes.io/router.entrypoints: websecure
-        traefik.ingress.kubernetes.io/router.tls: "true"
-      hosts:
-        - host: grimmory.michaelthomson.dev
-          paths:
-            - path: /
-              pathType: ImplementationSpecific
-      tls:
-        - hosts:
-            - grimmory.michaelthomson.dev
-          secretName: grimmory-tls
-    persistence:
-      dataVolume:
-        enabled: true
-        size: 100Mi
-        existingClaim: ""
-      booksVolume:
-        enabled: true
-        size: 10Gi
-        existingClaim: ""
-    
@@ -1,9 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: grimmory
-  namespace: grimmory
-spec:
-  type: "oci"
-  interval: 15m
-  url: oci://ghcr.io/grimmory-tools/helm-charts
@@ -1,13 +0,0 @@
-apiVersion: netbird.io/v1alpha1
-kind: NetworkResource
-metadata:
-  name: homeassistant
-  namespace: homeassistant
-spec:
-  networkRouterRef:
-    name: homelab
-    namespace: netbird
-  serviceRef:
-    name: homeassistant
-  groups:
-    - name: homelab-services
@@ -7,5 +7,5 @@ data:
  TZ: "America/Toronto"
  PUID: "1000"
  PGID: "1000"
-  WHISPER_MODEL: "medium"
+  WHISPER_MODEL: "base"
  WHISPER_LANG: "en"
@@ -8,7 +8,7 @@ metadata:
    cnpg.io/skipEmptyWalArchiveCheck: enabled
 spec:
  imageName: ghcr.io/tensorchord/cloudnative-vectorchord:17-0.3.0
-  instances: 3
+  instances: 2

  postgresql:
    shared_preload_libraries:
@@ -34,7 +34,7 @@ spec:
      source: immich-postgres

  storage:
-    size: 10Gi
+    size: 8Gi
    storageClass: longhorn-pg

  externalClusters:
@@ -1,13 +0,0 @@
-apiVersion: netbird.io/v1alpha1
-kind: NetworkResource
-metadata:
-  name: immich
-  namespace: immich
-spec:
-  networkRouterRef:
-    name: homelab
-    namespace: netbird
-  serviceRef:
-    name: immich-server
-  groups:
-    - name: homelab-services
@@ -1,13 +0,0 @@
-apiVersion: netbird.io/v1alpha1
-kind: NetworkResource
-metadata:
-  name: karakeep
-  namespace: karakeep
-spec:
-  networkRouterRef:
-    name: homelab
-    namespace: netbird
-  serviceRef:
-    name: web
-  groups:
-    - name: homelab-services
@@ -1,7 +1,7 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: karakeep
+  name: web
  namespace: karakeep
 spec:
  selector:
@@ -1,13 +0,0 @@
-apiVersion: netbird.io/v1alpha1
-kind: NetworkResource
-metadata:
-  name: grafana
-  namespace: kube-prometheus-stack
-spec:
-  networkRouterRef:
-    name: homelab
-    namespace: netbird
-  serviceRef:
-    name: kube-prometheus-stack-grafana
-  groups:
-    - name: homelab-services
@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: grafana
-  namespace: kube-prometheus-stack
-spec:
-  interval: 15m
-  url: https://grafana.github.io/helm-charts
@@ -1,13 +0,0 @@
-apiVersion: netbird.io/v1alpha1
-kind: NetworkResource
-metadata:
-  name: bazarr
-  namespace: media
-spec:
-  networkRouterRef:
-    name: homelab
-    namespace: netbird
-  serviceRef:
-    name: bazarr
-  groups:
-    - name: homelab-services
@@ -47,7 +47,7 @@ spec:
      - name: cache
        emptyDir:
          medium: Memory
-          sizeLimit: 3Gi
+          sizeLimit: 2Gi
      - name: dev-dri
        hostPath:
          path: /dev/dri
@@ -1,13 +0,0 @@
-apiVersion: netbird.io/v1alpha1
-kind: NetworkResource
-metadata:
-  name: jellyfin
-  namespace: media
-spec:
-  networkRouterRef:
-    name: homelab
-    namespace: netbird
-  serviceRef:
-    name: jellyfin
-  groups:
-    - name: homelab-services
@@ -1,13 +0,0 @@
-apiVersion: netbird.io/v1alpha1
-kind: NetworkResource
-metadata:
-  name: jellyseerr
-  namespace: media
-spec:
-  networkRouterRef:
-    name: homelab
-    namespace: netbird
-  serviceRef:
-    name: seerr-seerr-chart
-  groups:
-    - name: homelab-services
@@ -1,13 +0,0 @@
-apiVersion: netbird.io/v1alpha1
-kind: NetworkResource
-metadata:
-  name: prowlarr
-  namespace: media
-spec:
-  networkRouterRef:
-    name: homelab
-    namespace: netbird
-  serviceRef:
-    name: prowlarr
-  groups:
-    - name: homelab-services
@@ -1,13 +0,0 @@
-apiVersion: netbird.io/v1alpha1
-kind: NetworkResource
-metadata:
-  name: radarr
-  namespace: media
-spec:
-  networkRouterRef:
-    name: homelab
-    namespace: netbird
-  serviceRef:
-    name: radarr
-  groups:
-    - name: homelab-services
@@ -1,13 +0,0 @@
-apiVersion: netbird.io/v1alpha1
-kind: NetworkResource
-metadata:
-  name: sabnzbd
-  namespace: media
-spec:
-  networkRouterRef:
-    name: homelab
-    namespace: netbird
-  serviceRef:
-    name: sabnzbd
-  groups:
-    - name: homelab-services
@@ -1,13 +0,0 @@
-apiVersion: netbird.io/v1alpha1
-kind: NetworkResource
-metadata:
-  name: sonarr
-  namespace: media
-spec:
-  networkRouterRef:
-    name: homelab
-    namespace: netbird
-  serviceRef:
-    name: sonarr
-  groups:
-    - name: homelab-services
@@ -1,13 +0,0 @@
-apiVersion: netbird.io/v1alpha1
-kind: NetworkResource
-metadata:
-  name: michaelthomson
-  namespace: michaelthomson
-spec:
-  networkRouterRef:
-    name: homelab
-    namespace: netbird
-  serviceRef:
-    name: michaelthomson
-  groups:
-    - name: homelab-services
@@ -0,0 +1,50 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: minecraft
+  namespace: minecraft
+spec:
+  chart:
+    spec:
+      chart: minecraft
+      version: 5.x
+      sourceRef:
+        kind: HelmRepository
+        name: minecraft
+  interval: 15m
+  releaseName: minecraft
+  values:
+    serviceAnnotations:
+      metallb.io/loadBalancerIPs: 192.168.18.201
+
+    minecraftServer:
+      # This must be overridden, since we can't accept this for the user.
+      eula: true
+      # One of: LATEST, SNAPSHOT, or a specific version (ie: "1.7.9").
+      version: "LATEST"
+      ## The type of Minecraft server to run, check for related settings below
+      ## Common types: "VANILLA", "FABRIC", "FORGE", "SPIGOT", "BUKKIT", "PAPER",
+      ## "FTBA", "SPONGEVANILLA", "AUTO_CURSEFORGE"
+      ## ref: https://docker-minecraft-server.readthedocs.io/en/latest/types-and-platforms
+      type: "VANILLA"
+      # One of: peaceful, easy, normal, and hard
+      difficulty: normal
+      # A comma-separated list of player names to whitelist.
+      whitelist: DrDeww,lolobinbolo
+      # A comma-separated list of player names who should be admins.
+      ops: DrDeww
+      # A server icon URL for server listings. Auto-scaled and transcoded.
+      icon:
+      # Message of the Day
+      motd: "Welcome to Michael's Minecraft Server"
+      worldSaveName: world
+      # If you adjust this, you may need to adjust resources.requests above to match.
+      memory: 1024M
+      serviceType: LoadBalancer
+
+    persistence:
+      dataDir:
+        enabled: true
+        Size: 8Gi
+        accessModes:
+          - ReadWriteOnce
@@ -0,0 +1,9 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: minecraft
+  namespace: minecraft
+spec:
+  interval: 15m
+  url: https://itzg.github.io/minecraft-server-charts/
+
@@ -1,13 +0,0 @@
-apiVersion: netbird.io/v1alpha1
-kind: NetworkResource
-metadata:
-  name: nextcloud
-  namespace: nextcloud
-spec:
-  networkRouterRef:
-    name: homelab
-    namespace: netbird
-  serviceRef:
-    name: nextcloud
-  groups:
-    - name: homelab-services
@@ -7,7 +7,7 @@ spec:
  chart:
    spec:
      chart: nextcloud
-      version: 9.x
+      version: 8.x
      sourceRef:
        kind: HelmRepository
        name: nextcloud
@@ -126,6 +126,47 @@ spec:
      global:
        storageClass: longhorn

+    collabora:
+      enabled: true
+
+      # image:
+      #   tag: 24.04.11.1.1
+
+      collabora:
+        extra_params: --o:ssl.enable=false --o:ssl.termination=true
+
+        existingSecret:
+          enabled: true
+          secretName: "collabora-secret"
+          usernameKey: "username"
+          passwordKey: "password"
+
+      # securityContext:
+      #   runAsNonRoot: true
+      #   privileged: true
+      #   capabilities:
+      #     add:
+      #       - SYS_ADMIN
+      #       - MKNOD
+
+      ingress:
+        enabled: true
+        annotations:
+          cert-manager.io/cluster-issuer: "letsencrypt-prod"
+          external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
+          external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
+          traefik.ingress.kubernetes.io/router.entrypoints: websecure
+          traefik.ingress.kubernetes.io/router.tls: "true"
+        hosts:
+          - host: collabora.michaelthomson.dev
+            paths:
+            - path: /
+              pathType: ImplementationSpecific
+        tls:
+          - hosts:
+              - collabora.michaelthomson.dev
+            secretName: collabora-tls
+
    cronjob:
      enabled: true

@@ -0,0 +1,47 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ntfy
+  namespace: ntfy
+  labels:
+    app: ntfy
+spec:
+  revisionHistoryLimit: 1
+  replicas: 1
+  selector:
+    matchLabels:
+      app: ntfy
+  template:
+    metadata:
+      labels:
+        app: ntfy
+    spec:
+      containers:
+        - name: ntfy
+          image: binwiederhier/ntfy:v1.28.0
+          args: ["serve"]
+          env:
+            - name: TZ
+              value: America/Toronto
+            - name: NTFY_DEBUG
+              value: "false"
+            - name: NTFY_LOG_LEVEL
+              value: INFO
+            - name: NTFY_BASE_URL
+              value: https://ntfy.michaelthomson.dev
+          ports: 
+            - containerPort: 80
+              name: http
+          volumeMounts:
+            - mountPath: /etc/ntfy
+              subPath: server.yml
+              name: config-volume
+            - mountPath: /var/cache/ntfy
+              name: cache-volume
+      volumes:
+        - name: config-volume
+          configMap:
+            name: server-config
+        - name: cache-volume
+          persistentVolumeClaim:
+            claimName: pvc
@@ -0,0 +1,27 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: ntfy
+  namespace: ntfy
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
+    external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  rules:
+  - host: ntfy.michaelthomson.dev
+    http:
+      paths:
+      - pathType: Prefix
+        path: /
+        backend:
+          service:
+            name: service
+            port: 
+              name: http
+  tls:
+    - hosts:
+        - ntfy.michaelthomson.dev
+      secretName: ntfy-tls
@@ -1,12 +1,12 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: frigate-media
-  namespace: frigate
+  name: pvc
+  namespace: ntfy
 spec:
  accessModes:
    - ReadWriteOnce
-  storageClassName: nfs-client
+  storageClassName: longhorn
  resources:
    requests:
-      storage: 10Gi
+      storage: 1Gi
@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: server-config
+  namespace: ntfy
+data:
+  server.yml: |
+    cache-file: "/var/cache/ntfy/cache.db"
+    attachment-cache-dir: "/var/cache/ntfy/attachments"
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: service
+  namespace: ntfy
+spec:
+  type: ClusterIP
+  selector:
+    app: ntfy
+  ports:
+    - name: http
+      protocol: TCP
+      port: 80
+      targetPort:  http
@@ -1,13 +0,0 @@
-apiVersion: netbird.io/v1alpha1
-kind: NetworkResource
-metadata:
-  name: pihole
-  namespace: pihole
-spec:
-  networkRouterRef:
-    name: homelab
-    namespace: netbird
-  serviceRef:
-    name: pihole
-  groups:
-    - name: homelab-services
@@ -1,13 +0,0 @@
-apiVersion: netbird.io/v1alpha1
-kind: NetworkResource
-metadata:
-  name: syncthing
-  namespace: syncthing
-spec:
-  networkRouterRef:
-    name: homelab
-    namespace: netbird
-  serviceRef:
-    name: syncthing
-  groups:
-    - name: homelab-services
@@ -1,13 +0,0 @@
-apiVersion: netbird.io/v1alpha1
-kind: NetworkResource
-metadata:
-  name: uptime-kuma
-  namespace: uptime-kuma
-spec:
-  networkRouterRef:
-    name: homelab
-    namespace: netbird
-  serviceRef:
-    name: uptime-kuma
-  groups:
-    - name: homelab-services
@@ -0,0 +1,22 @@
+apiVersion: v1
+data:
+    ADMIN_TOKEN: ENC[AES256_GCM,data:N0kMJfrvylK/MiG+Yq9IpaPx0Q0=,iv:GR/ZxbKOim54hbryAw5MbktstNZ4upqXi/tsM4CPGmA=,tag:4USciX0i9f0cPK6BAy8zDw==,type:str]
+kind: Secret
+metadata:
+    name: admincreds-secret
+    namespace: vaultwarden
+sops:
+    age:
+        - recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiTjhIQUJjRWZzR2VSMldz
+            M2d1YUZ6QWl6Z3hJM0xxMGV6N1d0U2RUTlVFCjZHSTdBOTd1QW5Hb3BsZEc2Ykdv
+            ZElxUTgrVG1EcmM5SGxiNW1WMHRpbWcKLS0tIG91WmRsNzhWa1R1dHZ3QWJqbnQx
+            ZEpndHIyQzllejI0K0t0bkVKOWloYWsKeSb8P3ZijFvLy9IzVDkxMakfyWS7tt8e
+            uo3wrtSTlPHzvozymM/hXVDzKI6XZIZnUBfebGQpk0DgymyYKrwFgw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-17T20:36:08Z"
+    mac: ENC[AES256_GCM,data:sidIbGpK0REcpsX+lQyE6G6/qMH1EWsLzKc6p80X++L5ALzMT3zbKK7JNeGNIpAGdeX+3VF/g2JM5k+mIQdNQUjjxHuej3XQQ1PPKsis7GMpms2PSM9V51GbJ3QSeCW8hLqEDc7fKsB7dYLV+TAcrWtPg/lsV4VJ25eIkCQS7N4=,iv:gdORkFVZj0Rt6Qrx4K+xhk07TwKT6vxPu/sgg0Q/32E=,tag:A0shGOWTVSRPsNDG/kOM9g==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0
@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: vaultwarden-config
-  namespace: vaultwarden
-data:
-  DOMAIN: "https://vaultwarden.michaelthomson.dev"
-  SIGNUPS_ALLOWED: "false"
-  SMTP_HOST: "mail.michaelthomson.dev"
-  SMTP_FROM: "server@michaelthomson.dev"
-  SMTP_PORT: "465"
-  SMTP_SECURITY: "force_tls"
@@ -1,34 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: vaultwarden
-  namespace: vaultwarden
-spec:
-  selector:
-    matchLabels:
-      app: vaultwarden
-  template:
-    metadata:
-      labels:
-        app: vaultwarden
-    spec:
-      containers:
-      - name: vaultwarden
-        image: vaultwarden/server:latest
-        imagePullPolicy: Always
-        envFrom:
-          - secretRef:
-              name: vaultwarden-secret
-          - configMapRef:
-              name: vaultwarden-config
-        ports:
-        - containerPort: 80
-          name: http
-          protocol: TCP
-        volumeMounts:
-        - mountPath: /data
-          name: data
-      volumes:
-      - name: data
-        persistentVolumeClaim: 
-          claimName: vaultwarden-pvc
@@ -1,13 +0,0 @@
-apiVersion: netbird.io/v1alpha1
-kind: NetworkResource
-metadata:
-  name: vaultwarden
-  namespace: vaultwarden
-spec:
-  networkRouterRef:
-    name: homelab
-    namespace: netbird
-  serviceRef:
-    name: vaultwarden
-  groups:
-    - name: homelab-services
@@ -0,0 +1,54 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: vaultwarden
+  namespace: vaultwarden
+spec:
+  chart:
+    spec:
+      chart: vaultwarden
+      version: 0.30.x
+      sourceRef:
+        kind: HelmRepository
+        name: vaultwarden
+  interval: 15m
+  releaseName: vaultwarden
+  values:
+    resourceType: Deployment
+    data:
+      name: "vaultwarden-data"
+      size: "15Gi"
+      class: "longhorn"
+      accessMode: "ReadWriteOnce"
+    domain: "https://vaultwarden.michaelthomson.dev"
+    signupsAllowed: false
+    signupsVerify: "true"
+    requireDeviceEmail: "true"
+    adminToken:
+      existingSecret: "admincreds-secret"
+      existingSecretKey: "ADMIN_TOKEN"
+    timeZone: "America/Toronto"
+    smtp:
+      existingSecret: "smtpcreds-secret"
+      host: "mail.michaelthomson.dev"
+      security: "force_tls"
+      port: 465
+      from: "vaultwarden@michaelthomson.dev"
+      fromName: "Vaultwarden"
+      username:
+        existingSecretKey: "SMTP_USERNAME"
+      password:
+        existingSecretKey: "SMTP_PASSWORD"
+    ingress:
+      enabled: true
+      class: "traefik"
+      additionalAnnotations:
+        cert-manager.io/cluster-issuer: "letsencrypt-prod"
+        external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
+        external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
+        traefik.ingress.kubernetes.io/router.entrypoints: websecure
+        traefik.ingress.kubernetes.io/router.tls: "true"
+      labels: {}
+      tls: true
+      hostname: "vaultwarden.michaelthomson.dev"
+      tlsSecret: vaultwarden-tls
@@ -1,8 +1,8 @@
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:
-  name: nvidia
-  namespace: nvidia-gpu-operator
+  name: vaultwarden
+  namespace: vaultwarden
 spec:
  interval: 15m
-  url: https://helm.ngc.nvidia.com/nvidia
+  url: https://guerzon.github.io/vaultwarden
@@ -1,24 +0,0 @@
-apiVersion: v1
-stringData:
-    SMTP_PASSWORD: ENC[AES256_GCM,data:ckVcecLJPGsD4RYEva2TJluXy2TvhS3aYPzxAyEN,iv:AteDpQU+1p5+/nxtgSDhyH/O6dEPrLE6OrN8soMQNGk=,tag:DlaHPDzhBxRDbuuNdNSllw==,type:str]
-    SMTP_USERNAME: ENC[AES256_GCM,data:6oCLieSE7U0QIn6+q48oQSEiRKD8fYRe6A==,iv:Ub9f7Hni0N1pvQNfje+EUbXoQHb37v8Wja2u0bvp0/E=,tag:p4VfEXiQEqH3aQNt+9aMPQ==,type:str]
-    ADMIN_TOKEN: ENC[AES256_GCM,data:oUoWtQYgU5oEg7SAEjWqiOYkdaVS0ELwXgdfgaYUglkRdDZ0vOJ7axW4Ah4=,iv:hNBdD5zrut9y8R4nl1z28X9ou3pAvSEv58XLSjeMuUY=,tag:h78hZsfFYbD/35fEa0I2dw==,type:str]
-kind: Secret
-metadata:
-    name: vaultwarden-secret
-    namespace: vaultwarden
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3ZWVxNElZM1pFNEx6eE9q
-            U3ZHTzdhcXMzWmRBWGM0eDFTVCtFOGhGYzN3ClZ2U2NaSFVuaUN6RDhaYkVnb1du
-            M2JFMzBkeWZUaFBKeEZYb2FiMytIeWcKLS0tIEFQelhqQUhDODlTL2J4M0kzK05m
-            YjFheFgwRGVEVWJ3TW94UWlTREV6K2cKpnqUg4qLeOtIfecGjV2nUAYZGTkHCrT6
-            OHfL5W55BqcQJYovv37JJHkNV+IHuVNo7aqO/gx5AE0HfMWPfy6QGg==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
-    encrypted_regex: ^(data|stringData)$
-    lastmodified: "2026-06-21T00:57:10Z"
-    mac: ENC[AES256_GCM,data:iTUsBfc++AdMS0rd2isUEsnU7jp2Pg50KhtWR8J5bBWi/4xyoBVP2fr/c+jAVUMeGVbkZZb+zA6jvaTzhsITKyDwkyVIMShKfXeSLvr9PRMLExkif2DNRzkQ+jRhsnOFdtoUqnKfEN2QtjBJ0OkvN5RrjjMLnlmkswLDhIvQbyo=,iv:WbIIrJf7bpLft8t14XNCeuk88ij8TzkCMMQg0QKQW2o=,tag:sv1Jid832xDdmmOsof4ZGg==,type:str]
-    version: 3.13.1
@@ -0,0 +1,23 @@
+apiVersion: v1
+data:
+    SMTP_PASSWORD: ENC[AES256_GCM,data:SxuZaVeYXXhar0Qhi7clkXyO15rBG8xI9QTOzgwqGVCjHOW4,iv:zKgyHRU6GOnz6Vpt1Ko4/B9ySZpbMf2J/bN8WdUaitY=,tag:4+02vnssi0okvMZDel7/mw==,type:str]
+    SMTP_USERNAME: ENC[AES256_GCM,data:NREKMX/dvkejjoiLa764rT7CDl0nPoAaNWkXGnqrgdPhnsMVSUv1RA==,iv:VXe3z426+688ojm4JU3hyytFWCJ2oYgSFVnIOv2ry8Y=,tag:Tj5k8LApkxd+TBJFF/6/Zg==,type:str]
+kind: Secret
+metadata:
+    name: smtpcreds-secret
+    namespace: vaultwarden
+sops:
+    age:
+        - recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3ZWVxNElZM1pFNEx6eE9q
+            U3ZHTzdhcXMzWmRBWGM0eDFTVCtFOGhGYzN3ClZ2U2NaSFVuaUN6RDhaYkVnb1du
+            M2JFMzBkeWZUaFBKeEZYb2FiMytIeWcKLS0tIEFQelhqQUhDODlTL2J4M0kzK05m
+            YjFheFgwRGVEVWJ3TW94UWlTREV6K2cKpnqUg4qLeOtIfecGjV2nUAYZGTkHCrT6
+            OHfL5W55BqcQJYovv37JJHkNV+IHuVNo7aqO/gx5AE0HfMWPfy6QGg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-17T20:36:08Z"
+    mac: ENC[AES256_GCM,data:402GE3Cqd1N+cQBRnfNb5+/dudSy5pO1Hilc4DW0n+xm4x5sn8wr8C/mL6NDoBKh8fc7JAPPShCfx5B2RdxBL0hs7fkohSIKvtU4hq75enq/bPOtRoxuSxAMH89ayVSbP0V1llWsHFwGJROEMp/9vpqWUFqFvf3uCC8tLOGSy/8=,iv:lp0JMs56ltxFLJOiOWoTa2+D383SgD15v7XJpAwEDdw=,tag:/dezyOAu2W6nTGNQxKTlpA==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: wg-easy-config
+  namespace: wg-easy
+data:
+  LANG: "en"
+  WG_HOST: "wireguard.michaelthomson.dev"
+  WG_PORT: "30000"
+  UI_TRAFFIC_STATS: "true"
+  UI_CHART_TYPE: "1"
+  ENABLE_PROMETHEUS_METRICS: "true"
@@ -0,0 +1,48 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: wg-easy
+  namespace: wg-easy
+spec:
+  selector:
+    matchLabels:
+      app: wg-easy
+  template:
+    metadata:
+      labels:
+        app: wg-easy
+    spec:
+      # securityContext:
+      #   sysctls:
+      #   - name: net.ipv4.ip_forward
+      #     value: "1"
+      #   - name: net.ipv4.conf.all.src_valid_mark
+      #     value: "1"
+      containers:
+      - name: wg-easy
+        image: ghcr.io/wg-easy/wg-easy
+        imagePullPolicy: Always
+        envFrom:
+        - configMapRef:
+            name: wg-easy-config
+            optional: false
+        ports:
+        - containerPort: 30000
+          name: wg
+          protocol: UDP
+        - containerPort: 51821
+          name: http
+          protocol: TCP
+        securityContext:
+          capabilities:
+            add:
+            - NET_ADMIN
+            - SYS_MODULE
+        volumeMounts:
+        - name: config
+          mountPath: /etc/wireguard
+      restartPolicy: Always
+      volumes:
+      - name: config
+        persistentVolumeClaim:
+          claimName: wg-easy-config
@@ -1,25 +1,27 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: frigate
-  namespace: frigate
+  name: wg-easy
+  namespace: wg-easy
  annotations:
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
+    external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
    traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
  rules:
-  - host: frigate.michaelthomson.dev
+  - host: wireguard.michaelthomson.dev
    http:
      paths:
      - pathType: ImplementationSpecific
        path: /
        backend:
          service:
-            name: frigate
+            name: wg-easy
            port: 
              name: http
  tls:
-  - hosts:
-    - frigate.michaelthomson.dev
-    secretName: frigate-tls
+    - hosts:
+        - wireguard.michaelthomson.dev
+      secretName: wg-easy-tls
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: wg-easy-config
+  namespace: wg-easy
+spec:
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: longhorn
+  accessModes:
+    - ReadWriteOnce
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: wg-easy-dns
+  namespace: wg-easy
+  annotations:
+    metallb.io/loadBalancerIPs: 192.168.18.245
+spec:
+  type: LoadBalancer
+  selector:
+    app: wg-easy
+  ports:
+  - name: wg
+    port: 30000
+    targetPort: wg
+    protocol: UDP
@@ -1,11 +1,11 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: vaultwarden
-  namespace: vaultwarden
+  name: wg-easy
+  namespace: wg-easy
 spec:
  selector:
-    app: vaultwarden
+    app: wg-easy
  ports:
  - port: 80
    targetPort: http
@@ -1,11 +1,11 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: frigate
+  name: baikal
  namespace: flux-system
 spec:
  interval: 15m
-  path: ./apps/frigate
+  path: ./apps/baikal
  prune: true # remove any elements later removed from the above path
  wait: true
  sourceRef:
@@ -0,0 +1,19 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: minecraft
+  namespace: flux-system
+spec:
+  interval: 15m
+  path: ./apps/minecraft
+  prune: true # remove any elements later removed from the above path
+  wait: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age
+  dependsOn:
+    - name: infra-configs
@@ -1,11 +1,11 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: emqx
+  name: ntfy
  namespace: flux-system
 spec:
  interval: 15m
-  path: ./apps/emqx
+  path: ./apps/ntfy
  prune: true # remove any elements later removed from the above path
  wait: true
  sourceRef:
@@ -1,11 +1,11 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: grimmory
+  name: wg-easy
  namespace: flux-system
 spec:
  interval: 15m
-  path: ./apps/grimmory
+  path: ./apps/wg-easy
  prune: true # remove any elements later removed from the above path
  wait: true
  sourceRef:
@@ -1,8 +0,0 @@
-apiVersion: netbird.io/v1alpha1
-kind: NetworkRouter
-metadata:
-  name: homelab
-  namespace: netbird
-spec:
-  dnsZoneRef:
-    name: homelab.local
@@ -0,0 +1,47 @@
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: generic-cdi-plugin-daemonset
+  namespace: generic-cdi-plugin
+spec:
+  selector:
+    matchLabels:
+      name: generic-cdi-plugin
+  template:
+    metadata:
+      labels:
+        name: generic-cdi-plugin
+        app.kubernetes.io/component: generic-cdi-plugin
+        app.kubernetes.io/name: generic-cdi-plugin
+    spec:
+      containers:
+      - image: ghcr.io/olfillasodikno/generic-cdi-plugin:main
+        name: generic-cdi-plugin
+        command:
+          - /generic-cdi-plugin
+          - /var/run/cdi/nvidia-container-toolkit.json
+        imagePullPolicy: Always
+        securityContext:
+          privileged: true
+        tty: true
+        volumeMounts:
+        - name: kubelet
+          mountPath: /var/lib/kubelet
+        - name: nvidia-container-toolkit
+          mountPath: /var/run/cdi/nvidia-container-toolkit.json
+      volumes:
+      - name: kubelet
+        hostPath:
+          path: /var/lib/kubelet
+      - name: nvidia-container-toolkit
+        hostPath:
+          path: /var/run/cdi/nvidia-container-toolkit.json
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: "nixos-nvidia-cdi"
+                operator: In
+                values:
+                - "enabled"
@@ -7,7 +7,7 @@ spec:
  chart:
    spec:
      chart: longhorn
-      version: 1.11.x
+      version: 1.9.x
      sourceRef:
        kind: HelmRepository
        name: longhorn
@@ -21,7 +21,8 @@ spec:
        enable: true
        jobList: '[{"name":"backup","isGroup":true},{"name":"snapshot","isGroup":true},{"name":"trim","isGroup":true}]'
    defaultBackupStore:
-      backupTarget: nfs://192.168.18.99:/volume1/k8sbackupstore
+      backupTarget: s3://mthomson-longhorn-backup@ca-central-1/
+      backupTargetCredentialSecret: wasabi-secret
      pollInterval: 0
    defaultSettings:
      replicaAutoBalance: best-effort
@@ -14,5 +14,3 @@ spec:
  interval: 15m
  releaseName: metallb
  values:
-    speaker:
-      ignoreExcludeLB: true
@@ -1,22 +0,0 @@
-apiVersion: v1
-data:
-    NB_API_KEY: ENC[AES256_GCM,data:bO72vA7WNMrb2baStVlDUbjRdwNaWswP5eGfXEBAPepjYIMmBJnCV81d8bEWClFcGw2MwDO2ulQ=,iv:x/swnBZgPhoz2lGjImqEvPPa8wNWTZJlCWo96hV63X8=,tag:T6yhV0to68Ybe5gcxsYedQ==,type:str]
-kind: Secret
-metadata:
-    name: netbird-mgmt-api-key
-    namespace: netbird
-sops:
-    age:
-        - recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBId2tXZ2krZFhiendhN3c2
-            OUN1V3RmRHBVQ1Z0T2FJTnU1WE9mRHp4QkNVCkpGOForQWFWN2FjdWppNG9hMFFK
-            d1N6ckMxdjFhT3NnRmVReG9jdXpMcFEKLS0tIFJ0RXJHQ2E2S08xUU9mdlFPTEd2
-            Rms3V1grTyt5L1pockJxNFRVUDFLMGsKLOj+Sxw/mzdmhdAp7G/NoVJixuL14we2
-            hwEank8H1TnOb/VynHUCYQrYaPXE+FkSYumhLo3IJC1ZMKzQUFp9dw==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-05-07T17:46:40Z"
-    mac: ENC[AES256_GCM,data:RC07/U3NbwI5wU/ZbG+0A7nnDVlhBmcZsUevSmk9hqftFCCa4Q9R8q40XGFKod2pFl0SQzg8FXJPQABG6T9jYAKngD68zKD0wG2eHbXSxJiGT92nq2pkReOHZL/WFH6fGBse3RkXCjirwcIs27sLbXgdCCGmy36UU4CrnT3Nt5c=,iv:sQlS1M/58akJ1QdPGzpEZQaIxYk2QMwhdY3clIWnBCE=,tag:k95JRSlRzbMMbBNCCyB/8w==,type:str]
-    encrypted_regex: ^(data|stringData)$
-    version: 3.12.2
@@ -1,20 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: netbird-operator
-  namespace: netbird
-spec:
-  chart:
-    spec:
-      chart: kubernetes-operator
-      sourceRef:
-        kind: HelmRepository
-        name: netbirdio
-  interval: 15m
-  releaseName: netbird-operator
-  values:
-    managementURL: "https://netbird.michaelthomson.dev:443"
-    netbirdAPI:
-      keyFromSecret:
-        name: "netbird-mgmt-api-key"
-        key: "NB_API_KEY"
@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: netbirdio
-  namespace: netbird
-spec:
-  interval: 15m
-  url: https://netbirdio.github.io/helms
@@ -1,37 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: nvidia-gpu-operator
-  namespace: nvidia-gpu-operator
-spec:
-  chart:
-    spec:
-      chart: gpu-operator
-      version: 26.x
-      sourceRef:
-        kind: HelmRepository
-        name: nvidia
-  interval: 15m
-  releaseName: nvidia-gpu-operator
-  values:
-    driver:
-      enabled: false
-    toolkit:
-      enabled: false
-    hostPaths:
-      driverInstallDir: "/usr/local"
-    devicePlugin:
-      config:
-        create: true
-        name: "time-slicing-config"
-        default: "timeslicing"
-        data:
-          timeslicing: |-
-            version: v1
-            flags:
-              migStrategy: none
-            sharing:
-              timeSlicing:
-                resources:
-                - name: nvidia.com/gpu
-                  replicas: 5
@@ -1,4 +1,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: grimmory
+  name: baikal
@@ -1,8 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: frigate
-  labels:
-    pod-security.kubernetes.io/enforce: privileged
-    pod-security.kubernetes.io/audit: privileged
-    pod-security.kubernetes.io/warn: privileged
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: generic-cdi-plugin
@@ -2,7 +2,3 @@ apiVersion: v1
 kind: Namespace
 metadata:
  name: gitea
-  labels:
-    pod-security.kubernetes.io/enforce: privileged
-    pod-security.kubernetes.io/audit: privileged
-    pod-security.kubernetes.io/warn: privileged
@@ -2,7 +2,3 @@ apiVersion: v1
 kind: Namespace
 metadata:
  name: homeassistant
-  labels:
-    pod-security.kubernetes.io/enforce: privileged
-    pod-security.kubernetes.io/audit: privileged
-    pod-security.kubernetes.io/warn: privileged
@@ -2,7 +2,3 @@ apiVersion: v1
 kind: Namespace
 metadata:
  name: longhorn-system
-  labels:
-    pod-security.kubernetes.io/enforce: privileged
-    pod-security.kubernetes.io/audit: privileged
-    pod-security.kubernetes.io/warn: privileged
@@ -2,7 +2,3 @@ apiVersion: v1
 kind: Namespace
 metadata:
  name: media
-  labels:
-    pod-security.kubernetes.io/enforce: privileged
-    pod-security.kubernetes.io/audit: privileged
-    pod-security.kubernetes.io/warn: privileged
@@ -2,7 +2,3 @@ apiVersion: v1
 kind: Namespace
 metadata:
  name: metallb-system
-  labels:
-    pod-security.kubernetes.io/enforce: privileged
-    pod-security.kubernetes.io/audit: privileged
-    pod-security.kubernetes.io/warn: privileged
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: minecraft
@@ -1,8 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: netbird
-  labels:
-    pod-security.kubernetes.io/enforce: privileged
-    pod-security.kubernetes.io/audit: privileged
-    pod-security.kubernetes.io/warn: privileged
@@ -1,4 +1,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: emqx
+  name: ntfy
@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: nvidia-gpu-operator
-  labels:
-    pod-security.kubernetes.io/enforce: privileged
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: sealed-secrets
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: wg-easy
@@ -0,0 +1,6 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "config:recommended"
+  ]
+}