netbird network resources for all apps

This reverts commit ee5bfb66f6.

.sops.yaml

@@ -0,0 +1,3 @@
+creation_rules:
+  - encrypted_regex: ^(data|stringData)$
+    age: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9

apps/actual/deployment.yaml

@@ -0,0 +1,32 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: actual
+  namespace: actual
+spec:
+  selector:
+    matchLabels:
+      app: actual
+  template:
+    metadata:
+      labels:
+        app: actual
+    spec:
+      containers:
+      - name: actual
+        image: docker.io/actualbudget/actual-server:latest
+        imagePullPolicy: Always
+        env:
+          - name: ACTUAL_PORT
+            value: "5006"
+        ports:
+        - containerPort: 5006
+          name: http
+          protocol: TCP
+        volumeMounts:
+        - mountPath: /data
+          name: data
+      volumes:
+      - name: data
+        persistentVolumeClaim: 
+          claimName: actual-data

apps/actual/ingress.yaml

@@ -0,0 +1,28 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: actual
+  namespace: actual
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
+    external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+spec:
+  rules:
+  - host: actual.michaelthomson.dev
+    http:
+      paths:
+      - pathType: ImplementationSpecific
+        path: /
+        backend:
+          service:
+            name: actual
+            port: 
+              name: http
+  tls:
+  - hosts:
+    - actual.michaelthomson.dev
+    secretName: actual-tls

apps/actual/networkresource.yaml

@@ -0,0 +1,13 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkResource
+metadata:
+  name: actual
+  namespace: actual
+spec:
+  networkRouterRef:
+    name: homelab
+    namespace: netbird
+  serviceRef:
+    name: actual
+  groups:
+    - name: homelab-services

apps/actual/pvc-data.yaml

@@ -1,12 +1,12 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: roundcubemail-temp-pvc
+  name: actual-data
-  namespace: roundcube
+  namespace: actual
 spec:
-  storageClassName: longhorn
-  accessModes:
-    - ReadWriteOnce
   resources:
     requests:
       storage: 10Gi
+  storageClassName: longhorn
+  accessModes:
+    - ReadWriteOnce

apps/actual/service.yaml

@@ -1,11 +1,11 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: readarr
+  name: actual
-  namespace: media
+  namespace: actual
 spec:
   selector:
-    app: readarr
+    app: actual
   ports:
   - port: 80
     targetPort: http

apps/baikal/deployment.yaml

@@ -1,34 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: baikal
-  namespace: baikal
-spec:
-  selector:
-    matchLabels:
-      app: baikal
-  template:
-    metadata:
-      labels:
-        app: baikal
-    spec:
-      containers:
-        - name: baikal
-          image: ckulka/baikal:nginx
-          ports:
-            - containerPort: 80
-              name: http
-              protocol: TCP
-          volumeMounts:
-            - mountPath: /var/www/baikal/config
-              name: config
-            - mountPath: /var/www/baikal/Specific
-              name: data
-      restartPolicy: Always
-      volumes:
-        - name: config
-          persistentVolumeClaim:
-            claimName: config
-        - name: data
-          persistentVolumeClaim:
-            claimName: data

apps/baikal/dns-endpoint.yaml

@@ -1,15 +0,0 @@
-apiVersion: externaldns.k8s.io/v1alpha1
-kind: DNSEndpoint
-metadata:
-  name: baikal.michaelthomson.dev
-  namespace: baikal
-spec:
-  endpoints:
-  - dnsName: baikal.michaelthomson.dev
-    recordTTL: 180
-    recordType: CNAME
-    targets:
-      - michaelthomson.ddns.net
-    providerSpecific:
-      - name: external-dns.alpha.kubernetes.io/cloudflare-proxied
-        value: "true"

apps/baikal/ingress.yaml

@@ -1,24 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: baikal
-  namespace: baikal
-  annotations:
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
-    traefik.ingress.kubernetes.io/router.tls: "true"
-spec:
-  rules:
-  - host: baikal.michaelthomson.dev
-    http:
-      paths:
-      - pathType: ImplementationSpecific
-        path: /
-        backend:
-          service:
-            name: baikal
-            port: 
-              name: http
-  tls:
-    - hosts:
-        - baikal.michaelthomson.dev
-      secretName: letsencrypt-wildcard-cert-michaelthomson.dev

apps/baikal/service.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: baikal
-  namespace: baikal
-spec:
-  selector:
-    app: baikal
-  ports:
-    - name: http
-      port: 80
-      targetPort: http

apps/calibre-web/config.yaml

@@ -1,10 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: calibre-web-config
-  namespace: calibre-web
-data:
-  PUID: "1000"
-  PGID: "1000"
-  TZ: "America/Toronto"
-  DOCKER_MODS: "linuxserver/mods:universal-calibre"

apps/calibre-web/deployment.yaml

@@ -1,38 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: calibre-web
-  namespace: calibre-web
-spec:
-  selector:
-    matchLabels:
-      app: calibre-web
-  template:
-    metadata:
-      labels:
-        app: calibre-web
-    spec:
-      containers:
-      - name: calibre-web
-        image: lscr.io/linuxserver/calibre-web:latest
-        imagePullPolicy: Always
-        envFrom:
-        - configMapRef:
-            name: calibre-web-config
-            optional: false
-        ports:
-        - containerPort: 8083
-          name: http
-          protocol: TCP
-        volumeMounts:
-        - name: config
-          mountPath: /config
-        - mountPath: /books
-          name: data
-      volumes:
-      - name: config
-        persistentVolumeClaim:
-          claimName: calibre-web-config
-      - name: data
-        persistentVolumeClaim:
-          claimName: calibre-web-data

apps/calibre-web/dns-endpoint.yaml

@@ -1,12 +0,0 @@
-apiVersion: externaldns.k8s.io/v1alpha1
-kind: DNSEndpoint
-metadata:
-  name: calibre.michaelthomson.dev
-  namespace: calibre-web
-spec:
-  endpoints:
-  - dnsName: calibre.michaelthomson.dev
-    recordTTL: 180
-    recordType: CNAME
-    targets:
-    - server.michaelthomson.dev

apps/calibre-web/ingress.yaml

@@ -1,24 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: calibre-web
-  namespace: calibre-web
-  annotations:
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
-    traefik.ingress.kubernetes.io/router.tls: "true"
-spec:
-  rules:
-  - host: calibre.michaelthomson.dev
-    http:
-      paths:
-      - pathType: ImplementationSpecific
-        path: /
-        backend:
-          service:
-            name: calibre-web
-            port:
-              name: http
-  tls:
-    - hosts:
-        - calibre.michaelthomson.dev
-      secretName: letsencrypt-wildcard-cert-michaelthomson.dev

apps/calibre-web/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: calibre-web

apps/calibre-web/pvc-config.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: calibre-web-config
-  namespace: calibre-web
-spec:
-  resources:
-    requests:
-      storage: 4Gi
-  storageClassName: longhorn
-  accessModes:
-    - ReadWriteOnce

apps/calibre-web/pvc-data.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: calibre-web-data
-  namespace: calibre-web
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 8Gi

apps/calibre-web/service.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: calibre-web
-  namespace: calibre-web
-spec:
-  selector:
-    app: calibre-web
-  ports:
-  - port: 80
-    targetPort: http
-    name: http

apps/emqx/networkresource.yaml

@@ -0,0 +1,13 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkResource
+metadata:
+  name: emqx
+  namespace: emqx
+spec:
+  networkRouterRef:
+    name: homelab
+    namespace: netbird
+  serviceRef:
+    name: emqx
+  groups:
+    - name: homelab-services

apps/emqx/release.yaml

@@ -0,0 +1,72 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: emqx
+  namespace: emqx
+spec:
+  chart:
+    spec:
+      chart: emqx
+      version: 5.x
+      sourceRef:
+        kind: HelmRepository
+        name: emqx
+  interval: 15m
+  releaseName: emqx
+  values:
+    persistence:
+      enabled: true
+      size: 20Mi
+      storageClassName: longhorn
+      accessMode: ReadWriteOnce
+
+    ## EMQX configuration item, see the documentation (https://hub.docker.com/r/emqx/emqx)
+    emqxConfig:
+      EMQX_CLUSTER__DISCOVERY_STRATEGY: "dns"
+      EMQX_DASHBOARD__DEFAULT_USERNAME: "admin"
+      EMQX_DASHBOARD__DEFAULT_PASSWORD: "public"
+
+    ingress:
+      ## ingress for EMQX Dashboard
+      dashboard:
+        enabled: true
+        annotations:
+          cert-manager.io/cluster-issuer: "letsencrypt-prod"
+          traefik.ingress.kubernetes.io/router.entrypoints: websecure
+          traefik.ingress.kubernetes.io/router.tls: "true"
+        path: /
+        pathType: ImplementationSpecific
+        hosts:
+          - emqx.michaelthomson.dev
+        tls:
+          - hosts:
+              - emqx.michaelthomson.dev
+            secretName: emqx-tls
+      mqtt:
+        enabled: false
+        annotations:
+          cert-manager.io/cluster-issuer: "letsencrypt-prod"
+          traefik.ingress.kubernetes.io/router.entrypoints: websecure
+          traefik.ingress.kubernetes.io/router.tls: "true"
+        path: /
+        pathType: ImplementationSpecific
+        hosts:
+          - mqtt.emqx.michaelthomson.dev
+        tls:
+          - hosts:
+              - mqtt.emqx.michaelthomson.dev
+            secretName: emqx-tls
+      ws:
+        enabled: false
+        annotations:
+          cert-manager.io/cluster-issuer: "letsencrypt-prod"
+          traefik.ingress.kubernetes.io/router.entrypoints: websecure
+          traefik.ingress.kubernetes.io/router.tls: "true"
+        path: /mqtt
+        pathType: ImplementationSpecific
+        hosts:
+          - mqtt.emqx.michaelthomson.dev
+        tls:
+          - hosts:
+              - mqtt.emqx.michaelthomson.dev
+            secretName: emqx-tls

apps/emqx/repository.yaml

@@ -1,8 +1,8 @@
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:
-  name: plane
+  name: emqx
-  namespace: plane
+  namespace: emqx
 spec:
   interval: 15m
-  url: https://helm.plane.so/
+  url: https://repos.emqx.io/charts

apps/frigate/config.yaml

@@ -0,0 +1,153 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: frigate
+  namespace: frigate
+data:
+  config.yml: |
+    tls:
+      enabled: false
+
+    mqtt:
+      enabled: true
+      host: emqx.emqx.svc.cluster.local
+      user: frigate
+      password: '{FRIGATE_MQTT_PASSWORD}'
+
+    ffmpeg:
+      hwaccel_args: preset-nvidia
+
+    detectors:
+      onnx:
+        type: onnx
+
+    detect:
+      enabled: true
+
+    audio:
+      enabled: true
+      min_volume: 200
+      listen:
+        - cat
+        - meow
+        - hiss
+        - fart
+        - speech
+
+    objects:
+      track:
+        - person
+        - cat
+
+    record:
+      enabled: true
+      motion:
+        days: 1
+      alerts:
+        retain:
+          days: 1
+          mode: motion
+      detections:
+        retain:
+          days: 1
+          mode: motion
+
+    model:
+      model_type: yolo-generic
+      width: 640 # <--- should match the imgsize set during model export
+      height: 640 # <--- should match the imgsize set during model export
+      input_tensor: nchw
+      input_dtype: float
+      path: /config/model_cache/yolov9-c-640.onnx
+      labelmap_path: /labelmap/coco-80.txt
+
+    go2rtc:
+      streams:
+        c200_1:
+          - rtsp://{FRIGATE_RTSP_USERNAME}:{FRIGATE_RTSP_PASSWORD}@192.168.18.20:554/stream1
+        c200_1_sub:
+          - rtsp://{FRIGATE_RTSP_USERNAME}:{FRIGATE_RTSP_PASSWORD}@192.168.18.20:554/stream2
+        c200_2:
+          - rtsp://{FRIGATE_RTSP_USERNAME}:{FRIGATE_RTSP_PASSWORD}@192.168.18.21:554/stream1
+        c200_2_sub:
+          - rtsp://{FRIGATE_RTSP_USERNAME}:{FRIGATE_RTSP_PASSWORD}@192.168.18.21:554/stream2
+        c200_3:
+          - rtsp://{FRIGATE_RTSP_USERNAME}:{FRIGATE_RTSP_PASSWORD}@192.168.18.22:554/stream1
+        c200_3_sub:
+          - rtsp://{FRIGATE_RTSP_USERNAME}:{FRIGATE_RTSP_PASSWORD}@192.168.18.22:554/stream2
+
+    cameras:
+      tapoC200_1:
+        enabled: true
+        live:
+          streams:
+            Main: c200_1
+            Sub: c200_1_sub
+        onvif:
+          host: 192.168.18.20
+          port: 2020
+          user: '{FRIGATE_RTSP_USERNAME}'
+          password: '{FRIGATE_RTSP_PASSWORD}'
+        ffmpeg:
+          output_args:
+            record: preset-record-generic-audio-aac
+          inputs:
+            - path: rtsp://127.0.0.1:8554/c200_1
+              input_args: preset-rtsp-restream
+              roles:
+                - record
+            - path: rtsp://127.0.0.1:8554/c200_1_sub
+              input_args: preset-rtsp-restream
+              roles:
+                - detect
+                - audio
+
+      tapoC200_2:
+        enabled: true
+        live:
+          streams:
+            Main: c200_2
+            Sub: c200_2_sub
+        onvif:
+          host: 192.168.18.21
+          port: 2020
+          user: '{FRIGATE_RTSP_USERNAME}'
+          password: '{FRIGATE_RTSP_PASSWORD}'
+        ffmpeg:
+          output_args:
+            record: preset-record-generic-audio-aac
+          inputs:
+            - path: rtsp://127.0.0.1:8554/c200_2
+              input_args: preset-rtsp-restream
+              roles:
+                - record
+            - path: rtsp://127.0.0.1:8554/c200_2_sub
+              input_args: preset-rtsp-restream
+              roles:
+                - detect
+                - audio
+
+      tapoC200_3:
+        enabled: true
+        live:
+          streams:
+            Main: c200_3
+            Sub: c200_3_sub
+        onvif:
+          host: 192.168.18.22
+          port: 2020
+          user: '{FRIGATE_RTSP_USERNAME}'
+          password: '{FRIGATE_RTSP_PASSWORD}'
+        ffmpeg:
+          output_args:
+            record: preset-record-generic-audio-aac
+          inputs:
+            - path: rtsp://127.0.0.1:8554/c200_3
+              input_args: preset-rtsp-restream
+              roles:
+                - record
+            - path: rtsp://127.0.0.1:8554/c200_3_sub
+              input_args: preset-rtsp-restream
+              roles:
+                - detect
+                - audio

apps/frigate/deployment.yaml

@@ -0,0 +1,70 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: frigate
+  namespace: frigate
+spec:
+  selector:
+    matchLabels:
+      app: frigate
+  template:
+    metadata:
+      labels:
+        app: frigate
+    spec:
+      containers:
+      - name: frigate
+        image: ghcr.io/blakeblackshear/frigate:stable-tensorrt
+        imagePullPolicy: Always
+        resources:
+          limits:
+            nvidia.com/gpu: 1
+        envFrom:
+          - secretRef:
+              name: frigate
+        ports:
+          - containerPort: 8971
+            protocol: TCP
+            name: http
+          - containerPort: 8554
+            protocol: TCP
+            name: rtsp
+          - containerPort: 8555
+            protocol: TCP
+            name: webrtc-tcp
+          - containerPort: 8555
+            protocol: UDP
+            name: webrtc-udp
+        volumeMounts:
+          - mountPath: /config
+            name: frigate-config
+          - mountPath: /config/config.yml
+            subPath: config.yml
+            name: frigate-configmap
+          - mountPath: /media/frigate
+            name: frigate-media
+          - mountPath: /tmp/cache
+            name: frigate-cache
+          - mountPath: /dev/shm
+            name: frigate-dshm
+      volumes:
+      - name: frigate-config
+        persistentVolumeClaim: 
+          claimName: frigate-config
+      - name: frigate-configmap
+        configMap:
+          name: frigate
+          items:
+            - key: config.yml
+              path: config.yml
+      - name: frigate-media
+        persistentVolumeClaim: 
+          claimName: frigate-media
+      - name: frigate-cache
+        emptyDir:
+          medium: Memory
+          sizeLimit: 1Gi
+      - name: frigate-dshm
+        emptyDir:
+          medium: Memory
+          sizeLimit: 1Gi

apps/frigate/ingress.yaml

@@ -1,24 +1,25 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: jellyseerr
+  name: frigate
-  namespace: media
+  namespace: frigate
   annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
   rules:
-  - host: jellyseerr.michaelthomson.dev
+  - host: frigate.michaelthomson.dev
     http:
       paths:
       - pathType: ImplementationSpecific
         path: /
         backend:
           service:
-            name: jellyseerr
+            name: frigate
             port: 
               name: http
   tls:
   - hosts:
-        - jellyseerr.michaelthomson.dev
+    - frigate.michaelthomson.dev
-      secretName: letsencrypt-wildcard-cert-michaelthomson.dev
+    secretName: frigate-tls

apps/frigate/networkresource.yaml

@@ -0,0 +1,13 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkResource
+metadata:
+  name: frigate
+  namespace: frigate
+spec:
+  networkRouterRef:
+    name: homelab
+    namespace: netbird
+  serviceRef:
+    name: frigate
+  groups:
+    - name: homelab-services

apps/frigate/pvc-config.yaml

@@ -1,8 +1,8 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: config
+  name: frigate-config
-  namespace: baikal
+  namespace: frigate
 spec:
   accessModes:
     - ReadWriteOnce

apps/frigate/pvc-media.yaml

@@ -1,12 +1,12 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: qbittorrent-config
+  name: frigate-media
-  namespace: media
+  namespace: frigate
 spec:
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: longhorn
   accessModes:
     - ReadWriteOnce
+  storageClassName: nfs-client
+  resources:
+    requests:
+      storage: 10Gi

apps/frigate/secret.yaml

@@ -0,0 +1,24 @@
+apiVersion: v1
+stringData:
+    FRIGATE_MQTT_PASSWORD: ENC[AES256_GCM,data:2Q78LPHG682UgvVmZCg=,iv:QjhxxfgYKhA5/Btmu48E8QsIYUbdE0SSRmhkuJtmEJA=,tag:PUwGu6Vz/q3xkLWakIebqw==,type:str]
+    FRIGATE_RTSP_USERNAME: ENC[AES256_GCM,data:6AlV8zxMxkpHLXlMEQ==,iv:4P7cYe7pLsI74CMQz/YhZ0/TG4lwjsNIRL/NuMmi4/E=,tag:M3jRqHkeHLZY2DS+nJZasA==,type:str]
+    FRIGATE_RTSP_PASSWORD: ENC[AES256_GCM,data:PNI3OU9QCiOEABQu6Tg=,iv:npbl8YE1iTeEA5mJOlEb6EUKhTjd7s7lRfPVCfu+OTE=,tag:PPu1JGT8PSsSfVgOk4sVgw==,type:str]
+kind: Secret
+metadata:
+    name: frigate
+    namespace: frigate
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3ZWVxNElZM1pFNEx6eE9q
+            U3ZHTzdhcXMzWmRBWGM0eDFTVCtFOGhGYzN3ClZ2U2NaSFVuaUN6RDhaYkVnb1du
+            M2JFMzBkeWZUaFBKeEZYb2FiMytIeWcKLS0tIEFQelhqQUhDODlTL2J4M0kzK05m
+            YjFheFgwRGVEVWJ3TW94UWlTREV6K2cKpnqUg4qLeOtIfecGjV2nUAYZGTkHCrT6
+            OHfL5W55BqcQJYovv37JJHkNV+IHuVNo7aqO/gx5AE0HfMWPfy6QGg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-09-09T12:12:10Z"
+    mac: ENC[AES256_GCM,data:mmgt9brUUt7OIbVrNDws3itVRihhpPceDSCJH/OXbgZhCChTk2i5nx7DAhzGnFik9n6jHi9+E13a7XO9wh0rUb/EMcBZhUHDwsYmPpbAUuWAzFYUXJ1MVNj0IbmGK2qoaZHKPh7WD8/5ITB0Ldv+CgAdmQ5N+QtvtfV+0IcI3XU=,iv:ZRTBFPG3Wi0Bx7yzSjAgzsxUvHe+yK4lVmesUbHMQmg=,tag:T8tT0KkMNBWdqDpGZ5m6Og==,type:str]
+    version: 3.13.3

apps/frigate/service.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: frigate
+  namespace: frigate
+spec:
+  selector:
+    app: frigate
+  ports:
+    - name: http
+      port: 8971
+      targetPort: http
+    - name: rtsp
+      port: 8554
+      targetPort: rtsp
+    - name: webrtc-tcp
+      port: 8555
+      targetPort: webrtc-tcp
+    - name: webrtc-udp
+      port: 8555
+      protocol: UDP
+      targetPort: webrtc-udp

apps/gitea/actions/release.yaml

@@ -0,0 +1,23 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: actions
+  namespace: gitea
+spec:
+  chart:
+    spec:
+      chart: actions
+      version: 
+      sourceRef:
+        kind: HelmRepository
+        name: gitea
+  interval: 15m
+  releaseName: actions
+  values:
+    enabled: true
+    existingSecret: actions-secret
+    existingSecretKey: token
+    giteaRootURL: http://gitea-http:3000
+    statefulset:
+      persistence:
+        size: 1Gi

apps/gitea/actions/secret.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+data:
+    token: ENC[AES256_GCM,data:k6dhRoR3XCITRikJStLu1+gkW8Xcrt/EnKtq/LtMOdDOC906nyDbLbLXo4yWkUPb4wOT7/FHtjM=,iv:v/7sYpp//k4NgIHIxrSgUCK0ddTS2knRXt7bv/tK6BQ=,tag:t8yskoe9Q+T1UFhzmdEgSQ==,type:str]
+kind: Secret
+metadata:
+    name: actions-secret
+    namespace: gitea
+sops:
+    age:
+        - recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYUWxLU2Z5bmJSYUs2YS9q
+            bFFCSEJlTGtuNEFjVGtsMDFySW5TNnF6RTBzClpMdk9CRU9kTHoyVEJZU1JITnRS
+            aVhjMm9ndTBXYklkWUpMV0hYNWtrVFkKLS0tIEJLRmF5NVNNamlkSWNjam1lY1pF
+            MmtSTTJET3VWQStHN25DeDV6aGRrVkkKcMOwuTZY/meJjQZgzmAU37mUS4VjG7H/
+            q8c+keASqJI511XhWi8K938U8YREge7sDw8sa+RrXpoiy3zyipZOLQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-17T20:36:08Z"
+    mac: ENC[AES256_GCM,data:wr1ngpRm44ueRUsfITsQa9tuWffScHsz66QCfilsc8fO8gprb0eicYAgJ6J7JygGO7hZdnLB4z1Q/5bZFmdsvK2Oz3tV/NX/gZVGbFDqPFHfjDU+5rl7lrBnRh6D1RwvYqJzNL38dDO5oUXTOfDGijS574qB4EpyUnu7+AbJwtE=,iv:7kXdBFzz/M0Kynuk3fmnWWRV7VLN0BXELrYqt/VtQ9s=,tag:FqCzxPTwnL0yBX0+SrWbZA==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

apps/gitea/admin-secret.yaml

@@ -1,15 +1,23 @@
-kind: SealedSecret
+apiVersion: v1
-apiVersion: bitnami.com/v1alpha1
+data:
+    password: ENC[AES256_GCM,data:wcJdmRnN4nFOaIiM/Lyp8fceSRKpJW9laUYsZU/9UCmreJP3YHGFdw==,iv:35aJWV/ReimElkgHDEvd1VMi1+fL8ayB2YO5Ej6Iqrs=,tag:Vl665zuBbhsU28zXH+Madw==,type:str]
+    username: ENC[AES256_GCM,data:vnhGaPemu1i1kpHOPvRg8w==,iv:Ika50tGu/d6m6UxzUpZFhK/SxLsUMmB/GNeeFPmszdU=,tag:wC5CLp+5OhzLKYolmr1aTg==,type:str]
+kind: Secret
 metadata:
-  name: gitea-admin-secret
+    name: admin-secret
     namespace: gitea
-  creationTimestamp:
+sops:
-spec:
+    age:
-  template:
+        - recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
-    metadata:
+          enc: |
-      name: gitea-admin-secret
+            -----BEGIN AGE ENCRYPTED FILE-----
-      namespace: gitea
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLMFNmREJGMStuTEhyRi9w
-      creationTimestamp:
+            OTc4RTlrWWJwNlc2Z3liOXQrd1Jmc0VMQ3hJCjlJMzJDdDYvNWhtUVF6ZlBmR0Nx
-  encryptedData:
+            RGNrZWlBcnpjSjZLaU95aGZjcXZVNWcKLS0tIHk0UkFnWkxFRHB3THQ1UytRSzdL
-    password: AgAajDLwVR0AFIKlQLIQU12BIKOu4qYIBIdhTJCPYrA5fj4yZZQBnAukYevTJYf76B0dYR6VzTg3uRVqHm1ve3iM73izGKR3Vab6EuWsXpS+JtqBzPuTuZCL0E+8Q+5JPacn/mOEhk97C1oUv4ZJJgPOPE88ySti+tN0T2UqUp2c1Umys4ZEuRQfESAmgwe08HV30XvkB5EZW68mjzwEry/tYKNLFnon2njNvm3/jObaWDjHeKl0pjFRoyKcTqZHgk92y+jU78ubDQlcsQiP8PRlcHKLxjEexguLYJzZGnTUVMCOMn64FN2H4mW2bBi0Apx/FsrNZQeHf1/WcLTci4ccObnhFi6kjrdZFBc/YBcXviyLrDw+CzUz1ZFSIdGxOHhJm09yJ2YmssuhxeLQ/Y8g6UUSSf2cwcAC4e7gl7EIAayod7wFQySTur7MCuKduV/e50l0OOLYHuB7DwEEhG0LONQ54FF3yrqUhOwn6C3qYPSB10ibbVFuiTreROosIpDoaZ/2TLkjcmHRiRRD7XxXusEjjvd6MH0dCrMc4NM9Dflrf3uZNuuY+tvpAr6bOnOFAN+k7+ttuskuwHmFiuy1UGkFwAs1zMcCStAYdv6+qtwi6+xIAih0XOLV43cQ3R+bZiT8yQZb3wj7oBW6rR6xJ9MpI1fexbedtJWJywfOzdCuopFV9JZWVlXurmPFoSVzEZ7CRvVvRlgS2p2PFsIzpytDW2lvlc9DwBtrrGw=
+            ZTB2WVBmWnZLT3FsekFhSHFkQ1RLNlkKbQfo7CDYk/EadaE6SEmsCZX5ubOTcbD3
-    username: AgBtjjUFVdKLXE6/+MxXhBjRkUwqg1wAvw5Sl8W8FYYBLV56PzvSl8OqWPcpNwiquvYHZTdv2/vLyVEkk3YuhxYK5SGaIb8Ap4q8OJcdK5xFKKjLCx8kzkJ5Rwa11VfqWOTqwjgrSRgfjRI3Sc9xyrAMkQUgXbI3qdj5WfP6o6YDy6fK0Qm4bTD6F/+qj3xRkonWGY54268xdlHhzNR72Cqu4Wfl6BbiLafEU4U1mrxsSzJlno5LYyCC/g8WkkIrX3JrIYUt3wuTUheA/mhqCuLPH66iW6+lSyKoH2ruUn6p8i5uRltQNI8rYLxa3zdH7Ju3AXlUSv1FHv4zanCsG1SBaWrNsiKCAvEODB2IKGNENpkBkD7Uw51TvqZFoSZyyMbQIZLeCwcaRGtAPPGz2rKG7LcWIBpjy+J7dekmT0M1ObwbjyacluLmt/zw1FBL3JHPBv5RRBVGOmNFztmBobErRcBaOam9jg3SBAdOJfDuAcWOE68CKAUcRJ6wR+dqoP5zOwYtmFva7YRb35gO5XmwbNuCKlsR7ZOl3323aJ3Ill1A329XcPgsB2YmlXXHN9xAtsodDRKnT+t2pxVk1DtRWh+M8Ixy+QlYzhQBdb878G/ZKb5PI67S1RcGU7DROld/9bQBYfIxa2+F3JC+IjUJFVRrHn87BbE16OCPKgOaq+P3n0R8jwwcDDEwSssjVrC3VvcelBsj3aOUvg==
+            lj4rj1v2dYME/wDj9rFp5IwESalXwKzUVzC8e1GuzbY6pDQPx5EW4Q==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-17T20:36:08Z"
+    mac: ENC[AES256_GCM,data:ApUlG4FA/KYrwm6u/6qNU2Cqz08MxRNmiBmiwCZgNF4aX0CWzRZ9+VbO/jIJUpzKB3W7EdpbiyuT7Ie3h0lwYIZY5xUXP4CDxsZ+TozAFJq/CgXs/BacTZIVhSEL93W+O4ett/UuIL66rtuiZcBY0CdM80j7aTy20ilse8wwusM=,iv:UWdNu4hW6OcMHkqQcrzmLZlU4gevBwAMInbjtC9R3hI=,tag:W+SgpfrOvR9HnGRfnGSgwQ==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

apps/gitea/dns-endpoint.yaml

@@ -1,16 +0,0 @@
-apiVersion: externaldns.k8s.io/v1alpha1
-kind: DNSEndpoint
-metadata:
-  name: gitea.michaelthomson.dev
-  namespace: gitea
-spec:
-  endpoints:
-  - dnsName: gitea.michaelthomson.dev
-    recordTTL: 180
-    recordType: CNAME
-    targets:
-      - michaelthomson.ddns.net
-    providerSpecific:
-      - name: external-dns.alpha.kubernetes.io/cloudflare-proxied
-        value: "false"
-

apps/gitea/mailer-config-secret.yaml

@@ -1,22 +1,22 @@
-{
+apiVersion: v1
-  "kind": "SealedSecret",
+stringData:
-  "apiVersion": "bitnami.com/v1alpha1",
+    mailer: ENC[AES256_GCM,data:IrYl0ghmMpe7LCGuHFAv8OOnnYPnxed8M86qEnXct/d3Xlf+vQ==,iv:d/Egq7dRzNbx/5cEL5lKxD+ZsDhTLCB1EGnP6RXok00=,tag:aiQoSAMKQ1b0mXUT0lw8+w==,type:str]
-  "metadata": {
+kind: Secret
-    "name": "gitea-mailer-config-secret",
+metadata:
-    "namespace": "gitea",
+    name: gitea-mailer-config-secret
-    "creationTimestamp": null
+    namespace: gitea
-  },
+sops:
-  "spec": {
+    age:
-    "template": {
+        - recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
-      "metadata": {
+          enc: |
-        "name": "gitea-mailer-config-secret",
+            -----BEGIN AGE ENCRYPTED FILE-----
-        "namespace": "gitea",
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJMmxwWGZUb2JRK0FHdFd6
-        "creationTimestamp": null
+            SFN5MGdZR3puUDNhMElTTy96SnVRUzJwYjFvCkJsdlJCRG9zVXdzOEY1REQ4NWRw
-      },
+            R05taHVZMlpySXVXWmNIc25VYng4WWsKLS0tIERoL0tUVmUvbG5ha0h0cWIvZDND
-      "type": "Opaque"
+            NkI0eUlmYjg3Zk9iVmNkZVpXWkh2TW8K/coOzGAPF42522cM6DZVAEEv3LmZaIhu
-    },
+            BVyl8ijATNLMIfiFpP5bHpljPHrn3lGP70RzwoCV15t1fC6pjeParA==
-    "encryptedData": {
+            -----END AGE ENCRYPTED FILE-----
-      "mailer": "AgDViQgjYRiW3AjnwQZWKauZKoSMmf/LqaOiAZTE1yxULaIE3quXZjm6vkZTtvYqT2eDkKe20O5iTDyBdsO3+29LRnnOm6kF/y4cZ/JOiWfh6nJ0hx6g+MybG3rq4GcWQj7C5OQCi97ctHYemDaWoNKkjwSvNpt+pKcEaBgaqyWQ1knLxP8BaPg51R8CnIe5opn7+AsQwiwi9JX4ucrU46QqLVTg3KT+CobRlEFqtU3jd2CQuj1CN4Y/XgtQFHh3hLB+c05HV6sd0xwo9zMKUSQe2k++5Z5esGj4Hu25UXn36iwmJCfueMor2Y0yOBndPNNviRMMgKjE383retjL1o6n8HkIo5YTrKd18EyuQcq/EdhA8kb3uKX4N1EtOrFLlMGAUKliV42e+3w3IfXtFC9bvTpHivmKIQwZSlPQbF1SVFIbhiBdvNClYJpR61P7ZS6h0D57Tf3vmRpKTSlrHH01sbaKDd9+/kVGUQ0Lk4XRXK0JyTJkNDIiEBuiBB3H/GEZ27k4heBFav6w06gp3zhoOhmhq4XJcFWcselOJeY5cqSUzhLx440zMwwPWvEDH+/nrbhanx6KGFU5Lm6qX7tMn54+P4Ch/vAcnPs/0sXNx0xleGsRVEis+2/EmbdSDwe42+orKxbpQU1bEj7Rqtwiwk4VsTKXgPfzKXcgMMXo+4vvP4t8rCRo1hMkx1EXhKascwntdOb1Nz52QZvij02eNiQhDA2exuG8Room1Ox9Sb4="
+    lastmodified: "2026-05-12T01:59:49Z"
-    }
+    mac: ENC[AES256_GCM,data:TSNyIUQIRaX27K9ZbyiMCayFFIeUKmfD4Bz9Zu7Apa7NGqXmAWabzY3KHyjL14LDxmv4XJpA5W3DLI920DfOEUq2iW9EogMfSV7nEMMA6lzYMf+ca5W0BCwPE0MDBkTIL2nREoZh0FGDmq1M2syRIfaBrFKq97ZozQqz4AA8iZc=,iv:wCjERwABseOGN7LWiLzoT4VGHk9vnGdN0yl2eeQTAho=,tag:j/bDGqPoTm5FFGhERh1KJQ==,type:str]
-  }
+    encrypted_regex: ^(data|stringData)$
-}
+    version: 3.12.2

apps/gitea/networkresource.yaml

@@ -0,0 +1,13 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkResource
+metadata:
+  name: gitea
+  namespace: gitea
+spec:
+  networkRouterRef:
+    name: homelab
+    namespace: netbird
+  serviceRef:
+    name: gitea-http
+  groups:
+    - name: homelab-services

apps/gitea/release.yaml

@@ -7,31 +7,31 @@ spec:
   chart:
     spec:
       chart: gitea
-      version: 11.x
+      version: 12.x
       sourceRef:
         kind: HelmRepository
         name: gitea
   interval: 15m
-  timeout: 5m
   releaseName: gitea
   values:
     global:
       storageClass: longhorn
 
-    replicaCount: 1
-
     service:
       ssh:
         type: LoadBalancer
         port: 2222
         clusterIP:
         annotations:
-          metallb.universe.tf/loadBalancerIPs: 192.168.2.248
+          metallb.io/loadBalancerIPs: 192.168.18.248
 
     ingress:
       enabled: true
       className: traefik
       annotations:
+        cert-manager.io/cluster-issuer: "letsencrypt-prod"
+        external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
+        external-dns.alpha.kubernetes.io/cloudflare-proxied: "false"
         traefik.ingress.kubernetes.io/router.entrypoints: websecure
         traefik.ingress.kubernetes.io/router.tls: "true"
       hosts:
@@ -42,17 +42,17 @@ spec:
       tls:
         - hosts:
             - gitea.michaelthomson.dev
-          secretName: letsencrypt-wildcard-cert-michaelthomson.dev
+          secretName: gitea-tls
 
     persistence:
-      claimName: gitea-shared-storage
       size: 10Gi
-      storageClass: longhorn
 
     gitea:
       config:
         server:
           SSH_PORT: 2222
+        actions:
+          ENABLED: true
         service:
           DISABLE_REGISTRATION: true
           REGISTER_EMAIL_CONFIRM: true
@@ -61,35 +61,29 @@ spec:
           ALLOWED_HOST_LIST: external,loopback,private
         mailer:
           ENABLED: true
-          FROM: gitea@michaelthomson.dev
+          FROM: server@michaelthomson.dev
           PROTOCOL: smtps
           SMTP_ADDR: mail.michaelthomson.dev
           SMTP_PORT: 465
-          USER: gitea@michaelthomson.dev
+          USER: server@michaelthomson.dev
       admin:
-        existingSecret: gitea-admin-secret
+        existingSecret: admin-secret
         email: "gitea@michaelthomson.dev"
       additionalConfigSources:
         - secret:
             secretName: gitea-mailer-config-secret
 
-    redis-cluster:
+    valkey-cluster:
       enabled: false
 
+    valkey:
+      enabled: true
+
     postgresql-ha:
       enabled: false
 
     postgresql:
       enabled: true
-      global:
-        postgresql:
-          auth:
-            password: gitea
-            database: gitea
-            username: gitea
-          service:
-            ports:
-              postgresql: 5432
       primary:
         persistence:
           size: 10Gi

apps/grimmory/mariadb-credentials.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+stringData:
+    mariadb-password: ENC[AES256_GCM,data:sRg+BqCvSWe/I9vLLRcgPyMs87BttZAejfKPI7kIej6L3sXasYE700jr9tw=,iv:VMnb9a72TYYBdC2RCD9wwpRdUZiiD+SFOZOl0ZIHjbU=,tag:eXRgY1VO0PDRJPUAr4RYXw==,type:str]
+    mariadb-root-password: ENC[AES256_GCM,data:86cu/5fSD2h7yQSt0b9cp15a56LYiyhdUfFVdhla7cs0GsIyDul2A4TuSQA=,iv:U+JPt6UUc70MzYAQBODEzl/wMQ+TEVBYZHxxMZf4xyw=,tag:CAdI37E9cj07yoltPxLjWg==,type:str]
+kind: Secret
+metadata:
+    name: mariadb-credentials
+    namespace: grimmory
+sops:
+    age:
+        - recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvOEhieFpaNU5CRElYRFRx
+            VjJqUm9Zbk44M3QvVlNqcUFGUnRjNlUvUERZCjA2VjJXdlJmSDdYeW5BbEF2RElV
+            QXZ6YVl3REVFRzY5RG81YzVyaWpBWTgKLS0tIEdITTBCUm1tZGhZVzFwbGszbDF6
+            ZzhZOEU2SUFUWllqOHZCS1c5YW5TQjQKbQqmVAWZq7aqBaFt+51oY7PZ2BcLc7Wa
+            neOgcwRTq2x27yoWNPlcWSsqFss5RLldriEer4QdwdIDlWEj8Js7uA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-05-24T18:40:49Z"
+    mac: ENC[AES256_GCM,data:URvFnjTBRU17FIJTLjggheWWI63UcktsyMgrKP5Ib7/F4HcSbZySGis6Ty/y2Cn5uessjpf12IQ1EZ0Vybnm7w58/nb3+ZiEow5XtJ91OAw2iCJv00YyKtWgFqkymCHJu2a/SuuG3ibH5+MbucQKHUSXuxsRvYaJaigw1Gzi80I=,iv:3H2NNqh8eBqNvKybtsKYujjDeDlvmlwXxdzRoazU46E=,tag:tgYlwl0K7GbSX1pBtlD/xg==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.12.2

apps/grimmory/networkresource.yaml

@@ -0,0 +1,13 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkResource
+metadata:
+  name: grimmory
+  namespace: grimmory
+spec:
+  networkRouterRef:
+    name: homelab
+    namespace: netbird
+  serviceRef:
+    name: grimmory
+  groups:
+    - name: homelab-services

apps/grimmory/release.yaml

@@ -0,0 +1,47 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: grimmory
+  namespace: grimmory
+spec:
+  chart:
+    spec:
+      chart: grimmory
+      version: 3.x
+      sourceRef:
+        kind: HelmRepository
+        name: grimmory
+  interval: 15m
+  releaseName: grimmory
+  values:
+    mariadb:
+      auth:
+        existingSecret: mariadb-credentials
+        secretKeys:
+          rootPasswordKey: mariadb-root-password
+          userPasswordKey: mariadb-password
+    ingress:
+      enabled: true
+      annotations:
+        cert-manager.io/cluster-issuer: "letsencrypt-prod"
+        traefik.ingress.kubernetes.io/router.entrypoints: websecure
+        traefik.ingress.kubernetes.io/router.tls: "true"
+      hosts:
+        - host: grimmory.michaelthomson.dev
+          paths:
+            - path: /
+              pathType: ImplementationSpecific
+      tls:
+        - hosts:
+            - grimmory.michaelthomson.dev
+          secretName: grimmory-tls
+    persistence:
+      dataVolume:
+        enabled: true
+        size: 100Mi
+        existingClaim: ""
+      booksVolume:
+        enabled: true
+        size: 10Gi
+        existingClaim: ""
+    

apps/grimmory/repository.yaml

@@ -0,0 +1,9 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: grimmory
+  namespace: grimmory
+spec:
+  type: "oci"
+  interval: 15m
+  url: oci://ghcr.io/grimmory-tools/helm-charts

apps/hoarder/dns-endpoint.yaml

@@ -1,15 +0,0 @@
-apiVersion: externaldns.k8s.io/v1alpha1
-kind: DNSEndpoint
-metadata:
-  name: hoarder.michaelthomson.dev
-  namespace: hoarder
-spec:
-  endpoints:
-  - dnsName: hoarder.michaelthomson.dev
-    recordTTL: 180
-    recordType: CNAME
-    targets:
-      - michaelthomson.ddns.net
-    providerSpecific:
-      - name: external-dns.alpha.kubernetes.io/cloudflare-proxied
-        value: "true"

apps/hoarder/hoarder-secrets.yaml

@@ -1,18 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  creationTimestamp: null
-  name: hoarder-secrets
-  namespace: hoarder
-spec:
-  encryptedData:
-    MEILI_MASTER_KEY: AgCHcsgG2eNFA8M//KlFEXsD8v+kh9MWiIPr/vWBXqOtoyCoA5vTcrWdQvnmO+ic93kiBy2sTRa2thR2UQd9h3GnC4+MkTGZDLmbiArlE6HltuSWUnqaZESop8NBu8p3mFJ3kX8sLA3RzEZrj4/rmFT3CFym5v6vXjXxGaaT2C0VjsCxeOnGjcEyfm4gaptNP14v43bRRsxZtLo1F/pI1vkMPMbcQPsGXuiIkOxbaMAgGdlybMX1q7ZWWdXEHb/o+RDN2D2c9GJeZDgk/znT1A8IwfAUue1BpF2VamtFxoX2aI2w0xjGeJ7ffUOS3VzuBSAITsw4lb+7gCmC7FByqjxCmoiBI3L20XcFoWMmvNFKqsOPDVduNCJeYAZQHSNfC0SxGIu1tUw1T66NijsItDPH5vjH6BGvWyS3E+YMkxEHMV6ZJWkk3+S0gMRURSEo3Dr/MCby2x6MPbaKFB06u2Vyr0XWRUAXlphzndO0Ibt9P/KVldNX+ZueVxoZkxt+PiJqhWb6ZT8s0VBPmWleufbyjkZoa00KVM4/IGrSBJdLboGGmHU1p1EZGzpMEexCp/G0iEuNqkLJo8cCRxrHH6zsVunIpXnTYg+6Ob032+LDGGG2jKGKsjAlKKod/TIpL15poZZoVIv57IkLYd6bYASDQ9M4NpSJ3gyyIe+jICHBGFQ4t/mBfzlfy4fpjpFRxGNOQhr6TNBIgda9QI17OTkNDyace9Ltqu6CUIDvgOUYUH/gTBfYFtSk0NZWPJdJ+aA=
-    NEXT_PUBLIC_SECRET: AgB3LRSR+Y/VbTXIHpqlMUR1ec3LXdsghJ8vmMGEB+674W+x36ciekTkv8fGPj+XJXnXgPqCMrAr/Wd6ExrkW/nI2ZxDvbYLQ4POW34b5vF8IV0KD2kARUz5UGmVJOsCRSdlqqEsED72U2Cotw8voYOpEk7GfWZPTAyg6iv6pJyIa3gXEtdKV4k8XOQmMvdAui/0iAoTOeMpP6Qe2hGqCvSCtrsw+aj+ptUlQkP9pOQW6Uo/XMebwwZVSkgFOr6pEPhr70qMbi31ERR1at/vNYArQy8PXmUxJGsRF5KgjD+Nq6rrZPXJFjEk6qx+MAcysJ6rCJeYiCmZMZHabZ9CrhFTVdwtSO2su6B19hXS7fACzIrFNr5Z23NAn6+SoDodXo+Bqa+1ldHFzZl9ve0eoHEB8sG1qVvA5wWMtPm4D2mxd0UTlK0/EqY1jP+EvWNC05v/uD4toIEX3HEZCqdPqghmWxwq8qCm3ZpYvmxQwZxWHZdpxIen262vMZ6s5yZVC/n/v2EVmswqllUBvBCHq6WBBZqF5tgYBsuwy4qf976HMGvXXVx/WcE92eA3iT1olUnFJ7I4Isdp28tFl8jv5JLHJJozzWI91iwPUAwT5xFXi/2Jtk9Oe7QNjsEpYqnxxbogbMS6UZL4TJ1QNsyY29iue+E9q2Eck9Btb8xDtpSH2FNKNo/3FNcbe6hNXdwEbqoGIcNPZNNGDMOFVq6EeTmyxxR3CZYahHt65BXO0K/Smv8n4NSwI0e5T7Hn4S5o8JM=
-    NEXTAUTH_SECRET: AgChzv5iFZC4pFksnh7blvLWRn/2VsCqjOqkRnFQFTApAKf6CyfUgkFy5yBgbwqtS4oak6jtadtVZQuiWXrY2bIRvROwL4AEqGvteUhURSL7Hy/3oRd6BoBiT/zoiTkBmZRBG1LsI6KjCWXvjKAQGsoJ6sPQOGVGZ2eb57ne51op7xrhAyWbCuuy5tw237Qb/DnTgqeIQ4SmgTytLd5jO6nZ1yhzpmUW6ynu8TLy3ar3vIecc7IQkS7mmnXJgGilUrNUkdNjFdxkALBPah4a0qgwaRrZVh0MLa4Kvud5iYEC6Y5YFxZ2/6pH/OA0+aEw4gWdENyxDRVmxkwHpN22Ya1svvEI1V3RD7RQFA4psLClly3bJDpE96NIS0gSbpGzo2xszf3iKX5U5WjnGEODg9udQ+/RZvluU1NjwkPP5wFpAZU1YC5w2OUtZH/tQQ0Lumn1YsgXeH/oEtXfMgSTWD0Yoxwv7r+bFPb03OUllTG8AFVrP0Uigz9sl/td1u9zvrPFQMNPITSUOFrMbnVA0riKVGqFkkfxSp93lRpKHx7sA7LWyrZfYdcEGsaxMdBWGUcuv4OCtCHQhuyuxkJc7/Dygg3roxPyaehU/j5fY962qnRtv2Okmpf1Lm9VvuB83+ZhnJJNFgWVh6rPUgA+v0rVKOpzSYHpP878EMf3wz08wghhFmhlBSimAftMa8B9zSBkzlqfm6ByrtUNsKSuPE3k1H4YjusxRKFu4DXgo0eiZWmVQWb+YzhS4/zp5aJU3lA=
-    OPENAI_API_KEY: AgDISqGkHBSMNAmZa5uXoE2DAPy0FbxoZB1ngYRVGbQWN6LxW/3u+O+qtggo1qd+yaPTXJTi5DST22CNLZfk+pdYtMsTb3lQrEM0BkiACDsppOah9pz675xdZrAZG1+BlwGDfyRyKmww6t12D01MEl5g5dgXSA5ZHzPkhR4BySWzbVTN5oF3Yj/7twDkE8ignpdD0lIzPEqoOjdgeQ7g1cUAOTjbj9Q46S75kIaXhzIRnForZi3wbnhFn8pzcuNMERYfxms4u2x5cfUHyRTjblsS7KRIN2ymtsVauCdpmbe6bf3q7WCZ1XE7HcHdDpDK5N0kZRSHVMQUTp3kGripMiBb5aAfYOQBm+6Rjd0OE49dwEfgOV/zecOPZeTp70xwS3RhjioJlVRzHUIYZ9PRjt0gLqEULAQzF8E0FoQcwcjCxtEqTwLHNcVJ3xUBrt/Oq4yTgKspuu+Mb45UUlxyfZUaXrMZp73OE5qFVeUUjGRze6iQ2Hd5znOWH7BUqN+esEzqIyzhhREBSdyKmGdV33eYLcFrnaQkClilf5xeIbKjfA3QLl/3gtdteU3IiYd0PPNXPQr7aYK1buDsLExDo1M9tZM19eypLphStnOtXxtdHFua0jit6Cr7tVFRSF1gJYmtrLpcK5q5bnAt1KCZ2DBQCMgSQhOd1v9t0DQB7dbqgm5+44OJRZDOyhgE03qG57tdsTgr6ufL3Q+wfbo60VVl6JnR+MqgDbTrXvwzWyt5junDDL/FI/MLE9HAH7y5UDCyoHALEAhecE6FF+H34g5NHxQKxHTb6Id5uBdGcSTPDmJO+hwHwTvvSQUQPknGQzFURRw9cLTk+IeTjCfrQE1mIYnk9M5aa0CHWSALB8eXovWUiY1o7A3WYZkIFIz4+bcIws1ihd0M/vGr/cnczDZR5WeIqg==
-  template:
-    metadata:
-      creationTimestamp: null
-      name: hoarder-secrets
-      namespace: hoarder

apps/homeassistant/dns-endpoint.yaml

@@ -1,12 +0,0 @@
-apiVersion: externaldns.k8s.io/v1alpha1
-kind: DNSEndpoint
-metadata:
-  name: ha.michaelthomson.dev
-  namespace: homeassistant
-spec:
-  endpoints:
-  - dnsName: ha.michaelthomson.dev
-    recordTTL: 180
-    recordType: CNAME
-    targets:
-    - server.michaelthomson.dev

apps/homeassistant/ingress.yaml

@@ -4,6 +4,7 @@ metadata:
   name: homeassistant
   namespace: homeassistant
   annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
@@ -21,4 +22,4 @@ spec:
   tls:
     - hosts:
         - ha.michaelthomson.dev
-      secretName: letsencrypt-wildcard-cert-michaelthomson.dev
+      secretName: homeassistant-tls

apps/homeassistant/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: homeassistant

apps/homeassistant/networkresource.yaml

@@ -0,0 +1,13 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkResource
+metadata:
+  name: homeassistant
+  namespace: homeassistant
+spec:
+  networkRouterRef:
+    name: homelab
+    namespace: netbird
+  serviceRef:
+    name: homeassistant
+  groups:
+    - name: homelab-services

apps/homeassistant/whisper-config.yaml

@@ -7,5 +7,5 @@ data:
   TZ: "America/Toronto"
   PUID: "1000"
   PGID: "1000"
-  WHISPER_MODEL: "base"
+  WHISPER_MODEL: "medium"
   WHISPER_LANG: "en"

apps/immich/cluster.yaml

@@ -3,9 +3,12 @@ kind: Cluster
 metadata:
   name: immich-postgres
   namespace: immich
+  annotations:
+    # needed to allow for recovery from same name cluster backup
+    cnpg.io/skipEmptyWalArchiveCheck: enabled
 spec:
   imageName: ghcr.io/tensorchord/cloudnative-vectorchord:17-0.3.0
-  instances: 1
+  instances: 3
 
   postgresql:
     shared_preload_libraries:
@@ -18,15 +21,44 @@ spec:
         login: true
 
   bootstrap:
-    initdb:
+    # initdb:
-      database: immich
+    #   database: immich
-      owner: immich
+    #   owner: immich
-      secret:
+    #   secret:
-        name: immich-postgres-user
+    #     name: immich-postgres-user
-      postInitSQL:
+    #   postInitSQL:
-        - CREATE EXTENSION IF NOT EXISTS "vchord" CASCADE;
+    #     - CREATE EXTENSION IF NOT EXISTS "vchord" CASCADE;
-        - CREATE EXTENSION IF NOT EXISTS "earthdistance" CASCADE;
+    #     - CREATE EXTENSION IF NOT EXISTS "earthdistance" CASCADE;
+    # NOTE: uncomment this and commend the above initdb when recovering
+    recovery:
+      source: immich-postgres
 
   storage:
-    size: 8Gi
+    size: 10Gi
-    storageClass: longhorn
+    storageClass: longhorn-pg
+
+  externalClusters:
+    - name: immich-postgres
+      barmanObjectStore:
+        destinationPath: "s3://mthomson-cnpg-backup/immich/"
+        endpointURL: "https://s3.ca-central-1.wasabisys.com"
+        s3Credentials:
+          accessKeyId:
+            name: wasabi-secret
+            key: ACCESS_KEY_ID
+          secretAccessKey:
+            name: wasabi-secret
+            key: ACCESS_SECRET_KEY
+
+  backup:
+    barmanObjectStore:
+      destinationPath: "s3://mthomson-cnpg-backup/immich/"
+      endpointURL: "https://s3.ca-central-1.wasabisys.com"
+      s3Credentials:
+        accessKeyId:
+          name: wasabi-secret
+          key: ACCESS_KEY_ID
+        secretAccessKey:
+          name: wasabi-secret
+          key: ACCESS_SECRET_KEY
+    retentionPolicy: "10d"

apps/immich/dns-endpoint.yaml

@@ -1,15 +0,0 @@
-apiVersion: externaldns.k8s.io/v1alpha1
-kind: DNSEndpoint
-metadata:
-  name: immich.michaelthomson.dev
-  namespace: immich
-spec:
-  endpoints:
-  - dnsName: immich.michaelthomson.dev
-    recordTTL: 180
-    recordType: CNAME
-    targets:
-      - michaelthomson.ddns.net
-    providerSpecific:
-      - name: external-dns.alpha.kubernetes.io/cloudflare-proxied
-        value: "true"

apps/immich/networkresource.yaml

@@ -0,0 +1,13 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkResource
+metadata:
+  name: immich
+  namespace: immich
+spec:
+  networkRouterRef:
+    name: homelab
+    namespace: netbird
+  serviceRef:
+    name: immich-server
+  groups:
+    - name: homelab-services

apps/immich/podmonitor.yaml

@@ -0,0 +1,11 @@
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: immich-postgres
+  namespace: immich
+spec:
+  selector:
+    matchLabels:
+      cnpg.io/cluster: immich-postgres
+  podMetricsEndpoints:
+  - port: metrics

apps/immich/release.yaml

@@ -12,23 +12,26 @@ spec:
         kind: HelmRepository
         name: immich
   interval: 15m
-  timeout: 5m
   releaseName: immich
   values:
+    controllers:
+      main:
+        containers:
+          main:
+            image:
+              tag: v2.1.0
             env:
               DB_HOSTNAME: "immich-postgres-rw"
               DB_USERNAME: "immich"
               DB_DATABASE_NAME: "immich"
               DB_PASSWORD: "immich"
-    image:
-      tag: v1.134.0
 
     immich:
       persistence:
         library:
           existingClaim: immich-data
 
-    redis:
+    valkey:
       enabled: true
 
     server:
@@ -37,6 +40,9 @@ spec:
         main:
           enabled: true
           annotations:
+            cert-manager.io/cluster-issuer: "letsencrypt-prod"
+            external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
+            external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
             traefik.ingress.kubernetes.io/router.entrypoints: websecure
             traefik.ingress.kubernetes.io/router.tls: "true"
           hosts:
@@ -46,7 +52,7 @@ spec:
           tls:
             - hosts:
                 - immich.michaelthomson.dev
-              secretName: letsencrypt-wildcard-cert-michaelthomson.dev
+              secretName: immich-tls
 
     machine-learning:
       enabled: true

apps/immich/scheduled-backup.yaml

@@ -0,0 +1,11 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: scheduled-backup
+  namespace: immich
+spec:
+  schedule: "0 0 0 * * *"
+  backupOwnerReference: self
+  #immediate: true
+  cluster:
+    name: immich-postgres

apps/immich/wasabi-secret.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+data:
+    ACCESS_KEY_ID: ENC[AES256_GCM,data:ad1Xc2tUS5JCGiaOoL5udd058QxG592R7a+66A==,iv:erHAPm5E5w2B0fZ/sagwTsT16MTLnbYzmamT9OS3fEE=,tag:TMRosj0L+u3JL3o6ig0/rw==,type:str]
+    ACCESS_SECRET_KEY: ENC[AES256_GCM,data:QJ3RkLWP8QNPt+JoD1B3ZCQkZKH82ImgnR8ZgfPPnEDFYj2rRuTbZva33yL/wAz95ll8YbjxtQw=,iv:cO96syX0ZdukwhKvvtrTzQcy0qQGEiL3NSxigcop+EQ=,tag:JS9sT+iFgdFMkTM74ore2w==,type:str]
+kind: Secret
+metadata:
+    name: wasabi-secret
+    namespace: immich
+sops:
+    age:
+        - recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPa1lwSXVIM0ZRa1NhZ3lv
+            U05sZi9WbkVidVVDYVdXWWNZejRHNW9MNUF3CkNFVjc2bjFUZXhuQzAxUDBDVGxi
+            VGpZcHdZMHVWVW40NDRvY2RURFJ5OEUKLS0tIGlwRmNTZi9WWEhuWnB5TW1leVZt
+            eWpOMDdyakJEcWxYaFZiZ05nbCtWU00KmfoVxNBH7N44v/Xxcmjw/D/YQ93DA7yU
+            6/kk/7R2ya2JWtuqkOx9QPU8/TKaucU5V/IxPhoWquytevHkL5QhUw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-17T20:36:08Z"
+    mac: ENC[AES256_GCM,data:1iNzgy+OKP7tZXkiMLr/9oFLjLnEEKAkQdzceFkGUYiq7gHmujuplt9vU2JS+Kc7l5m9FyB7cFOjHpJec08owJf7gDXcHBkUQmGGIU6eso/n/G5lj2bDKoQgrZcS3+cgpDGY/oiFh34ZapSL1uEbgQudRWsfQZr7o8iHLGEir4s=,iv:md9IZ9n2ecQDnBHIkBGZHhc34uIi9aWzbsDbZo2hx/U=,tag:U3m6q5TfHiii7cGPsK0MOw==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

apps/karakeep/chrome-deployment.yaml

@@ -2,7 +2,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: chrome
-  namespace: hoarder
+  namespace: karakeep
 spec:
   replicas: 1
   selector:

apps/karakeep/chrome-service.yaml

@@ -2,7 +2,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: chrome
-  namespace: hoarder
+  namespace: karakeep
 spec:
   selector:
     app: chrome

apps/karakeep/data-pvc.yaml

@@ -2,7 +2,7 @@ apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: data-pvc
-  namespace: hoarder
+  namespace: karakeep
 spec:
   accessModes:
     - ReadWriteOnce

apps/karakeep/ingress.yaml

@@ -1,14 +1,17 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: hoarder-web-ingress
+  name: karakeep-web-ingress
-  namespace: hoarder
+  namespace: karakeep
   annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
+    external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
   rules:
-  - host: "hoarder.michaelthomson.dev"
+  - host: "karakeep.michaelthomson.dev"
     http:
       paths:
       - path: "/"
@@ -20,5 +23,5 @@ spec:
               number: 3000
   tls:
     - hosts:
-        - hoarder.michaelthomson.dev
+        - karakeep.michaelthomson.dev
-      secretName: letsencrypt-wildcard-cert-michaelthomson.dev
+      secretName: karakeep-web-ingress-tls

apps/karakeep/karakeep-secrets.yaml

@@ -0,0 +1,30 @@
+apiVersion: v1
+data:
+    MEILI_MASTER_KEY: ENC[AES256_GCM,data:hGTazo5p3b+k9c1FsCzV8lkCKFqEv/pXbAF0FqnYK0euPusL20skBIBP/hZQCllL9ZIpHuHAK8ZA57TMrnBtBA==,iv:E/1DsMVmQ6r3IgF0g4UBvW0rLTUmc4OOBx7FJh0/fP8=,tag:I9NzdG8hkndQEEa+RwHGJA==,type:str]
+    NEXT_PUBLIC_SECRET: ENC[AES256_GCM,data:x0lLGcfMX4o76y+wpSUh4oTh4bm0CIw8+epVX3uO8BpN79xYFLMV3EzbUOi4Isldb0zdPzK6xlnF7tqCvTDY9Wq/SUs=,iv:vIfucp8BM9FaXUtoUUTXCQuRWTngFokKFpIwhA/IpXI=,tag:RykRRY1q2iV9zqe3rvxSkA==,type:str]
+    NEXTAUTH_SECRET: ENC[AES256_GCM,data:Z9GlM3phYB9WtU2K2HH9oAU7F7xZP48IsbK1JrwE72GZP53MiZmGDzTTzU/aP9DfG71PWqEgCPC56bQFr7UtvQ==,iv:SNNpv6J44Q4hxRvgzNNgt7NMUAoNMDAy3Ff7jrFAimQ=,tag:kvp3H+DgVAtXMwKzIPTJRA==,type:str]
+    OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING: ENC[AES256_GCM,data:qQAQg6sCJO0=,iv:EqNG67j5uII6+TBnMY9wt6E1jq52vevccfs+pmn4zs8=,tag:UP2omHyj5qCw/jIErW8GVw==,type:str]
+    OAUTH_CLIENT_ID: ENC[AES256_GCM,data:IK87xFx5N0he669UzhYLeFbpfAcZB039p8bgw+6AGDi17MIRBmoQkVJ1bvnGM+EaG7A7ezdrEQk=,iv:OG2HE2ubV/2ZIllyKIFnA7nRNEZfCoyh7AX+M8rLqtk=,tag:uCf8YI9RymbjLzVR2h/btQ==,type:str]
+    OAUTH_CLIENT_SECRET: ENC[AES256_GCM,data:OA6t3SU4uhD3AXFYxk06dhYdQhESr2LaWJ58jTGDCIGS2hIb6Sx7tS1nlDK/7G2LB8IZbRDfLSXc+DoYlQ/WwIlFSi9gDbiBYpk0ZYtfuo0hapc0MMCOpdvh7nc9d1p5/tMkX/ZbO0N2BHSBVbtwWaXntDDUd5YJxRubE6pnN3jKRbqY6BGfSdWytf47n8SEK6O2NWIgxnvlkKPLX0H/iKOxaTKHpasyEVv9xw==,iv:31nVzU3o4TuIGlH35oD5PRXbWWIX8FZ2u0OnYorM7sY=,tag:5Y8YFbt28UPDKr7EVJjApQ==,type:str]
+    OAUTH_PROVIDER_NAME: ENC[AES256_GCM,data:lcMWx1XJ/86FVyB4,iv:jVH7sDJo7Gag+hWNbUf9FC+jGqjts7liXomeOeW0eJ0=,tag:ISkJ2s/ZMOdLsxKh1Iauqg==,type:str]
+    OAUTH_WELLKNOWN_URL: ENC[AES256_GCM,data:/29zd+yLKKPQs9KfYCDOOPLqpay3Hd/+6YE3NcufDCiBCGEzHE9YtqrwyYGhq/Z3RPBNB85aYgCZbEVVgTezOvMGeoOUWzrQirD0ZF7JYPQt+jbpLRKMgsD9YF9iySRCPickdp17Hh6ukwhPfcf1ucT5tT9sjXm6JVFJFg==,iv:hzF9F9btpP/7Add/g/E0RlPDO5npIbVaj0JoJ0Na/SA=,tag:c2rigTpq0vtct4FCIBPE6Q==,type:str]
+    OPENAI_API_KEY: ENC[AES256_GCM,data:am/9P6389pS9IrxX2oAiMP5NawG8oj77rY8mgfJCjaXfGOPARIGtOSkmFVyY1oQR51oi3jDAg++JR72IW5k1NFkQp9JehMZeNXgLIc3aBIVIjJ+8G+q4AZ63TJrPAnDd+XiXf0aOAyyMzwmRY/j9Gu4cZXGxvqdz5HAmQMwcBfpWRXpEA1+YnDea2YhXW796JHI6WPBD4dzFMUZ1q5PGWwMOsAi6ArIXTN30EK1AqM8EIlK5quubbRxbJCI16DGDzIbXnuLB7MW8mvzm93Yz1Q39Q01reO3XZbihLw==,iv:G9XIKNcqUIizhgzj0POi0tQ/nHOne3DLeDtRaP0lXUg=,tag:o1zZ8ZoYbQZad3ciV9lqjg==,type:str]
+kind: Secret
+metadata:
+    name: karakeep-secrets
+    namespace: karakeep
+sops:
+    age:
+        - recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAreXJUVW5FVUsrc2k0RUk0
+            ZkZRS3pZUXFaTUdManhKVWp1S0JiaHRQV200CjVUYlAwN09TelNsK1l4aTQzSEF0
+            SFVkQnUwaFAvbGN5Z0dVTVdMdmRXR1kKLS0tIEk4S2FINWU1ZmtSYWFsVm94UTVS
+            RTBKZEtZMUhLMEFlejNEek5iL0J5Q28Kk07rkAd/qNVyS40Iz7yfSJMpa2pGtvrj
+            0YBKgyDoKmQ1aNzPo5aiaKyaUdh1PYrkAI7q5J+rmXj/70DR662nSA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-17T20:36:08Z"
+    mac: ENC[AES256_GCM,data:4gHyTL/1DH/s4S/GdQOS7THzXNwo0xvMGdUqtEwgsjTSnoEZQMiUFLGOSnCy3LVG6JiPvCrJKDRrralrdaoSSWcmwy3pA/EG2eS58ooa02Hum2DgJ9XO25ZNSj16/gGJwgnEscGHSsAjRA3guAPAIbGip6DrhJJ3EfgVXT+J0OI=,iv:gV6QwYfTXiz4bfJNmW5yiZflspI3zULTEtVsWxirjvE=,tag:388de9lUv88lH3JoGsnlug==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

apps/karakeep/meilisearch-deployment.yaml

@@ -2,7 +2,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: meilisearch
-  namespace: hoarder
+  namespace: karakeep
 spec:
   replicas: 1
   selector:
@@ -24,7 +24,7 @@ spec:
               name: meilisearch
           envFrom:
             - secretRef:
-                name: hoarder-secrets
+                name: karakeep-secrets
       volumes:
         - name: meilisearch
           persistentVolumeClaim:

apps/karakeep/meilisearch-pvc.yaml

@@ -2,7 +2,7 @@ apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: meilisearch-pvc
-  namespace: hoarder
+  namespace: karakeep
 spec:
   accessModes:
     - ReadWriteOnce

apps/karakeep/meilisearch-service.yaml

@@ -2,7 +2,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: meilisearch
-  namespace: hoarder
+  namespace: karakeep
 spec:
   selector:
     app: meilisearch

apps/karakeep/networkresource-web.yaml

@@ -0,0 +1,13 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkResource
+metadata:
+  name: karakeep
+  namespace: karakeep
+spec:
+  networkRouterRef:
+    name: homelab
+    namespace: netbird
+  serviceRef:
+    name: web
+  groups:
+    - name: homelab-services

apps/karakeep/web-deployment.yaml

@@ -2,24 +2,26 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: web
-  namespace: hoarder
+  namespace: karakeep
 spec:
   replicas: 1
   selector:
     matchLabels:
-      app: hoarder-web
+      app: karakeep-web
   template:
     metadata:
       labels:
-        app: hoarder-web
+        app: karakeep-web
     spec:
       containers:
         - name: web
-          image: ghcr.io/hoarder-app/hoarder:release
+          image: ghcr.io/karakeep-app/karakeep
           imagePullPolicy: Always
           ports:
             - containerPort: 3000
           env:
+            - name: NEXTAUTH_URL
+              value: https://karakeep.michaelthomson.dev
             - name: MEILI_ADDR
               value: http://meilisearch:7700
             - name: BROWSER_WEB_URL
@@ -27,13 +29,13 @@ spec:
             - name: DATA_DIR
               value: /data
             - name: DISABLE_SIGNUPS
-              value: "true"
+              value: "false"
           volumeMounts:
             - mountPath: /data
               name: data
           envFrom:
             - secretRef:
-                name: hoarder-secrets
+                name: karakeep-secrets
       volumes:
         - name: data
           persistentVolumeClaim:

apps/karakeep/web-service.yaml

@@ -1,11 +1,11 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: web
+  name: karakeep
-  namespace: hoarder
+  namespace: karakeep
 spec:
   selector:
-    app: hoarder-web
+    app: karakeep-web
   ports:
     - protocol: TCP
       port: 3000

apps/kube-prometheus-stack/admin-secret.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+data:
+    admin-password: ENC[AES256_GCM,data:FXusij+QSZCfG5Cp1VFTsDXmzYc=,iv:KuscQB1tHeTY4d7EPEozOO9FqlhBwZL2hNix7gGpu6s=,tag:wX7us8uCsHlfudM6sx/vAw==,type:str]
+    admin-user: ENC[AES256_GCM,data:aOqM1iNeX30=,iv:iwxNPSNsrxEr7zTmKRWmLK3BNu5UIj055l1p3I24xKo=,tag:eUfhUyD8vHh8YKFZpAX2ww==,type:str]
+kind: Secret
+metadata:
+    name: admin-secret
+    namespace: kube-prometheus-stack
+sops:
+    age:
+        - recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyU2FJWjVseDY5ZGlJd2xs
+            OHBPQUpiS1ZocTZVeWVOVFdEaGt3dkN4OFFJCmd4M1lYbGYzelNhaDl0Tm5IUGww
+            OVc3M2Z5U3JGYVpuV21UQnJlZzM3Nk0KLS0tIDlma0J4amZKYWo4enpMdTI1YUZJ
+            aXBLVnBtMFpLc3B3djdzZDBiWXhwdmMKSlkc7MFkV6lDJ0J+k2GdIlpbNa438bre
+            2QOOgd3QeomniAmM0pemCR9PIVA3Uf+3DhMs1foZ6uYugJMMsd6esQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-19T20:36:08Z"
+    mac: ENC[AES256_GCM,data:KocjA27Zp0Y/DVemOVvjOATT7QIQjydpJIYQpjr1UnB8l748E+VGkvra2vLyV11BQz3uLija/2v0WNmQs5f+ZLvoTuQro6l9HxSk4zkkgfMzkqzlWIVFsj2Z0SrNtLl+bQMkDeOuMeeB+hAtOtwoc04X9n78PIW+2SGsq2Z94Co=,iv:KfRKGFC0geEburKxnXJJJqZUmVXhET2WnEON+gxlQp8=,tag:cTnOwHZNcP3Z5aCvF+IS3Q==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

apps/kube-prometheus-stack/dns-endpoint-grafana.yaml

@@ -1,12 +0,0 @@
-apiVersion: externaldns.k8s.io/v1alpha1
-kind: DNSEndpoint
-metadata:
-  name: grafana.michaelthomson.dev
-  namespace: kube-prometheus-stack
-spec:
-  endpoints:
-  - dnsName: grafana.michaelthomson.dev
-    recordTTL: 180
-    recordType: CNAME
-    targets:
-    - server.michaelthomson.dev

apps/kube-prometheus-stack/dns-endpoint-prometheus.yaml

@@ -1,12 +0,0 @@
-apiVersion: externaldns.k8s.io/v1alpha1
-kind: DNSEndpoint
-metadata:
-  name: prometheus.michaelthomson.dev
-  namespace: kube-prometheus-stack
-spec:
-  endpoints:
-  - dnsName: prometheus.michaelthomson.dev
-    recordTTL: 180
-    recordType: CNAME
-    targets:
-    - server.michaelthomson.dev

apps/kube-prometheus-stack/networkresource-grafana.yaml

@@ -0,0 +1,13 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkResource
+metadata:
+  name: grafana
+  namespace: kube-prometheus-stack
+spec:
+  networkRouterRef:
+    name: homelab
+    namespace: netbird
+  serviceRef:
+    name: kube-prometheus-stack-grafana
+  groups:
+    - name: homelab-services

apps/kube-prometheus-stack/release.yaml

@@ -7,37 +7,47 @@ spec:
   chart:
     spec:
       chart: kube-prometheus-stack
-      version: 63.x
+      version: 79.x
       sourceRef:
         kind: HelmRepository
         name: prometheus-community
   interval: 15m
-  timeout: 5m
   releaseName: kube-prometheus-stack
   values:
     grafana:
+      admin:
+        existingSecret: admin-secret
+        userKey: admin-user
+        passwordKey: admin-password
       ingress:
         enabled: true
         annotations:
+          cert-manager.io/cluster-issuer: "letsencrypt-prod"
           traefik.ingress.kubernetes.io/router.tls: "true"
           traefik.ingress.kubernetes.io/router.entrypoints: websecure
         hosts:
         - grafana.michaelthomson.dev
         path: /
         tls:
-          - secretName: letsencrypt-wildcard-cert-michaelthomson.dev
+          - secretName: grafana-tls
             hosts:
               - grafana.michaelthomson.dev
     prometheus:
+      prometheusSpec:
+        podMonitorSelectorNilUsesHelmValues: false
+        ruleSelectorNilUsesHelmValues: false
+        serviceMonitorSelectorNilUsesHelmValues: false
+        probeSelectorNilUsesHelmValues: false
       ingress:
         enabled: true
         annotations:
+          cert-manager.io/cluster-issuer: "letsencrypt-prod"
           traefik.ingress.kubernetes.io/router.tls: "true"
           traefik.ingress.kubernetes.io/router.entrypoints: websecure
         hosts:
         - prometheus.michaelthomson.dev
         path: /
         tls:
-          - secretName: letsencrypt-wildcard-cert-michaelthomson.dev
+          - secretName: prometheus-tls
             hosts:
               - prometheus.michaelthomson.dev

apps/kube-prometheus-stack/repository-grafana.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: grafana
+  namespace: kube-prometheus-stack
+spec:
+  interval: 15m
+  url: https://grafana.github.io/helm-charts

apps/media/bazarr/dns-endpoint.yaml

@@ -1,12 +0,0 @@
-apiVersion: externaldns.k8s.io/v1alpha1
-kind: DNSEndpoint
-metadata:
-  name: bazarr.michaelthomson.dev
-  namespace: media
-spec:
-  endpoints:
-  - dnsName: bazarr.michaelthomson.dev
-    recordTTL: 180
-    recordType: CNAME
-    targets:
-    - server.michaelthomson.dev

apps/media/bazarr/ingress.yaml

@@ -4,9 +4,9 @@ metadata:
   name: bazarr
   namespace: media
   annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
-    # traefik.ingress.kubernetes.io/router.middlewares: authentik-bazarr@kubernetescrd
 spec:
   rules:
   - host: bazarr.michaelthomson.dev
@@ -22,4 +22,4 @@ spec:
   tls:
     - hosts:
         - bazarr.michaelthomson.dev
-      secretName: letsencrypt-wildcard-cert-michaelthomson.dev
+      secretName: bazarr-tls

apps/media/bazarr/networkresource.yaml

@@ -0,0 +1,13 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkResource
+metadata:
+  name: bazarr
+  namespace: media
+spec:
+  networkRouterRef:
+    name: homelab
+    namespace: netbird
+  serviceRef:
+    name: bazarr
+  groups:
+    - name: homelab-services

apps/media/jellyfin/config.yaml

@@ -1,8 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: jellyfin-config
-  namespace: media
-data:
-  NVIDIA_VISIBLE_DEVICES: all
-  NVIDIA_DRIVER_CAPABILITIES: all

apps/media/jellyfin/deployment.yaml

@@ -12,7 +12,6 @@ spec:
       labels:
         app: jellyfin
     spec:
-      runtimeClassName: nvidia
       containers:
       - name: jellyfin
         image: lscr.io/linuxserver/jellyfin:latest
@@ -29,16 +28,12 @@ spec:
         - mountPath: /data/media
           name: data
           subPath: media
-        # - name: dev-dri
+        - name: transcode
-        #   mountPath: /dev/dri
+          mountPath: /transcode
-        env:
+        - name: cache
-        - name: NVIDIA_VISIBLE_DEVICES
+          mountPath: /cache
-          value: all
+        - name: dev-dri
-        - name: NVIDIA_DRIVER_CAPABILITIES
+          mountPath: /dev/dri
-          value: all
-        resources:
-          limits:
-            nvidia.com/gpu: 1
       volumes:
       - name: config
         persistentVolumeClaim: 
@@ -46,6 +41,13 @@ spec:
       - name: data
         persistentVolumeClaim: 
           claimName: media-data
-      # - name: dev-dri
+      - name: transcode
-      #   hostPath:
+        emptyDir:
-      #     path: /dev/dri
+          sizeLimit: 50Gi
+      - name: cache
+        emptyDir:
+          medium: Memory
+          sizeLimit: 3Gi
+      - name: dev-dri
+        hostPath:
+          path: /dev/dri

apps/media/jellyfin/dns-endpoint-public.yaml

@@ -1,15 +0,0 @@
-apiVersion: externaldns.k8s.io/v1alpha1
-kind: DNSEndpoint
-metadata:
-  name: jellyfin.michaelthomson.dev
-  namespace: media
-spec:
-  endpoints:
-  - dnsName: jellyfin.michaelthomson.dev
-    recordTTL: 180
-    recordType: CNAME
-    targets:
-      - michaelthomson.ddns.net
-    providerSpecific:
-      - name: external-dns.alpha.kubernetes.io/cloudflare-proxied
-        value: "true"

apps/media/jellyfin/ingress.yaml

@@ -4,6 +4,9 @@ metadata:
   name: jellyfin
   namespace: media
   annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
+    external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
@@ -21,4 +24,4 @@ spec:
   tls:
     - hosts:
         - jellyfin.michaelthomson.dev
-      secretName: letsencrypt-wildcard-cert-michaelthomson.dev
+      secretName: jellyfin-tls

apps/media/jellyfin/networkresource.yaml

@@ -0,0 +1,13 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkResource
+metadata:
+  name: jellyfin
+  namespace: media
+spec:
+  networkRouterRef:
+    name: homelab
+    namespace: netbird
+  serviceRef:
+    name: jellyfin
+  groups:
+    - name: homelab-services

apps/media/jellyseerr/config.yaml

@@ -1,9 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: jellyseerr-config
-  namespace: media
-data:
-  PUID: "1000"
-  PGID: "1000"
-  LOG_LEVEL: "debug"

apps/media/jellyseerr/deployment.yaml

@@ -1,33 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: jellyseerr
-  namespace: media
-spec:
-  selector:
-    matchLabels:
-      app: jellyseerr
-  template:
-    metadata:
-      labels:
-        app: jellyseerr
-    spec:
-      containers:
-      - name: jellyseerr
-        image: fallenbagel/jellyseerr:latest
-        imagePullPolicy: Always
-        envFrom:
-        - configMapRef:
-            name: jellyseerr-config
-            optional: false
-        ports:
-        - containerPort: 5055
-          name: http
-          protocol: TCP
-        volumeMounts:
-        - name: config
-          mountPath: /app/config
-      volumes:
-      - name: config
-        persistentVolumeClaim: 
-          claimName: jellyseerr-config

apps/media/jellyseerr/dns-endpoint.yaml

@@ -1,15 +0,0 @@
-apiVersion: externaldns.k8s.io/v1alpha1
-kind: DNSEndpoint
-metadata:
-  name: jellyseerr.michaelthomson.dev
-  namespace: media
-spec:
-  endpoints:
-  - dnsName: jellyseerr.michaelthomson.dev
-    recordTTL: 180
-    recordType: CNAME
-    targets:
-      - michaelthomson.ddns.net
-    providerSpecific:
-      - name: external-dns.alpha.kubernetes.io/cloudflare-proxied
-        value: "true"

apps/media/jellyseerr/networkresource.yaml

@@ -0,0 +1,13 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkResource
+metadata:
+  name: jellyseerr
+  namespace: media
+spec:
+  networkRouterRef:
+    name: homelab
+    namespace: netbird
+  serviceRef:
+    name: seerr-seerr-chart
+  groups:
+    - name: homelab-services

apps/media/jellyseerr/release.yaml

@@ -0,0 +1,36 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: seerr
+  namespace: media
+spec:
+  chart:
+    spec:
+      chart: seerr-chart
+      version: 3.x
+      sourceRef:
+        kind: HelmRepository
+        name: seerr
+  interval: 15m
+  releaseName: seerr
+  values:
+    config:
+      persistence:
+        existingClaim: 'jellyseerr-config'
+    ingress:
+      enabled: true
+      annotations:
+        cert-manager.io/cluster-issuer: "letsencrypt-prod"
+        external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
+        external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
+        traefik.ingress.kubernetes.io/router.entrypoints: websecure
+        traefik.ingress.kubernetes.io/router.tls: "true"
+      hosts:
+        - host: jellyseerr.michaelthomson.dev
+          paths:
+            - path: /
+              pathType: ImplementationSpecific
+      tls:
+        - hosts:
+            - jellyseerr.michaelthomson.dev
+          secretName: jellyseerr-tls

apps/media/jellyseerr/repository.yaml

@@ -1,8 +1,9 @@
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:
-  name: reflector
+  name: seerr
-  namespace: reflector
+  namespace: media
 spec:
+  type: "oci"
   interval: 15m
-  url: https://emberstack.github.io/helm-charts
+  url: oci://ghcr.io/seerr-team/seerr

apps/media/jellyseerr/service.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: jellyseerr
-  namespace: media
-spec:
-  selector:
-    app: jellyseerr
-  ports:
-  - port: 80
-    targetPort: http
-    name: http

apps/media/prowlarr/dns-endpoint.yaml

@@ -1,12 +0,0 @@
-apiVersion: externaldns.k8s.io/v1alpha1
-kind: DNSEndpoint
-metadata:
-  name: prowlarr.michaelthomson.dev
-  namespace: media
-spec:
-  endpoints:
-  - dnsName: prowlarr.michaelthomson.dev
-    recordTTL: 180
-    recordType: CNAME
-    targets:
-    - server.michaelthomson.dev

apps/media/prowlarr/ingress.yaml

@@ -4,9 +4,9 @@ metadata:
   name: prowlarr
   namespace: media
   annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
-    # traefik.ingress.kubernetes.io/router.middlewares: authentik-prowlarr@kubernetescrd
 spec:
   rules:
   - host: prowlarr.michaelthomson.dev
@@ -22,4 +22,4 @@ spec:
   tls:
     - hosts:
         - prowlarr.michaelthomson.dev
-      secretName: letsencrypt-wildcard-cert-michaelthomson.dev
+      secretName: prowlarr-tls

apps/media/prowlarr/networkresource.yaml

@@ -0,0 +1,13 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkResource
+metadata:
+  name: prowlarr
+  namespace: media
+spec:
+  networkRouterRef:
+    name: homelab
+    namespace: netbird
+  serviceRef:
+    name: prowlarr
+  groups:
+    - name: homelab-services

apps/media/qbittorrent/deployment.yaml

@@ -1,69 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: qbittorrent
-  namespace: media
-spec:
-  selector:
-    matchLabels:
-      app: qbittorrent
-  template:
-    metadata:
-      labels:
-        app: qbittorrent
-    spec:
-      securityContext:
-        sysctls:
-        - name: net.ipv4.conf.all.src_valid_mark
-          value: "1"
-      containers:
-      - name: qbittorrent
-        image: lscr.io/linuxserver/qbittorrent:libtorrentv1
-        envFrom:
-        - configMapRef:
-            name: qbittorrent-config
-            optional: false
-        ports:
-        - containerPort: 8080
-          name: http
-          protocol: TCP
-        volumeMounts:
-        - name: qbittorrent-config
-          mountPath: /config
-        - name: data
-          mountPath: /data/downloads
-          subPath: downloads
-      - name: wireguard
-        image: lscr.io/linuxserver/wireguard:latest
-        envFrom:
-        - configMapRef:
-            name: wireguard-config
-        securityContext:
-          capabilities:
-            add:
-            - NET_ADMIN
-        volumeMounts:
-        - name: wireguard-config-secret
-          mountPath: /config/wg_confs
-        - name: wireguard-config
-          mountPath: /config
-        - name: natpmp-script
-          mountPath: /custom-services.d/natpmp.sh
-          subPath: natpmp.sh
-          readOnly: true
-      volumes:
-      - name: qbittorrent-config
-        persistentVolumeClaim:
-          claimName: qbittorrent-config
-      - name: data
-        persistentVolumeClaim:
-          claimName: media-data
-      - name: wireguard-config
-        persistentVolumeClaim:
-          claimName: wireguard-config
-      - name: wireguard-config-secret
-        secret:
-          secretName: wireguard-config-secret
-      - name: natpmp-script
-        configMap:
-          name: natpmp-script

apps/media/qbittorrent/dns-endpoint.yaml

@@ -1,12 +0,0 @@
-apiVersion: externaldns.k8s.io/v1alpha1
-kind: DNSEndpoint
-metadata:
-  name: qbittorrent.michaelthomson.dev
-  namespace: media
-spec:
-  endpoints:
-  - dnsName: qbittorrent.michaelthomson.dev
-    recordTTL: 180
-    recordType: CNAME
-    targets:
-    - server.michaelthomson.dev

apps/media/qbittorrent/ingress.yaml

@@ -1,24 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: qbittorrent
-  namespace: media
-  annotations:
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
-    traefik.ingress.kubernetes.io/router.tls: "true"
-spec:
-  rules:
-  - host: qbittorrent.michaelthomson.dev
-    http:
-      paths:
-      - pathType: ImplementationSpecific
-        path: /
-        backend:
-          service:
-            name: qbittorrent
-            port: 
-              name: http
-  tls:
-    - hosts:
-        - qbittorrent.michaelthomson.dev
-      secretName: letsencrypt-wildcard-cert-michaelthomson.dev

apps/media/qbittorrent/natpmp-script.yaml

@@ -1,35 +0,0 @@
-apiVersion: v1
-data:
-  natpmp.sh: |
-    #!/bin/sh
-
-    while true; do
-        date
-
-        natpmpc -a 1 0 udp 60 -g 10.2.0.1 && natpmpc -a 1 0 tcp 60 -g 10.2.0.1 > /tmp/natpmpc_output || {
-            echo -e "ERROR with natpmpc command \a"
-            break
-        }
-
-        port=$(grep 'TCP' /tmp/natpmpc_output | grep -o 'Mapped public port [0-9]*' | awk '{print $4}')
-        currentPort=$(curl -XGET 'http://127.0.0.1:8080/api/v2/app/preferences' | jq '.listen_port')
-
-        echo "Opened port: $port"
-        echo "Current port: $currentPort"
-        if [ "$currentPort" != "$port" ]; then
-            echo "Current port is different. Changing from $currentPort to $port"
-            code=$(curl --write-out '%{http_code}' --silent --output /dev/null -XPOST -d "json={\"listen_port\":$port}" "http://127.0.0.1:8080/api/v2/app/setPreferences")
-
-            if [ "$code" != "200" ]; then
-                echo "ERROR: port change failed with status code $code"
-            else
-                echo "Port changed to $port successfully"
-            fi
-        fi
-        sleep 45
-    done
-kind: ConfigMap
-metadata:
-  creationTimestamp: null
-  name: natpmp-script
-  namespace: media

apps/media/qbittorrent/pvc-wireguard-config.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: wireguard-config
-  namespace: media
-spec:
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: longhorn
-  accessModes:
-    - ReadWriteOnce

apps/media/qbittorrent/qbittorrent-config.yaml

@@ -1,8 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: qbittorrent-config
-  namespace: media
-data:
-  PUID: "1000"
-  PGID: "1000"

apps/media/qbittorrent/wireguard-config-secret.yaml

@@ -1,21 +0,0 @@
-{
-  "kind": "SealedSecret",
-  "apiVersion": "bitnami.com/v1alpha1",
-  "metadata": {
-    "name": "wireguard-config-secret",
-    "namespace": "media",
-    "creationTimestamp": null
-  },
-  "spec": {
-    "template": {
-      "metadata": {
-        "name": "wireguard-config-secret",
-        "namespace": "media",
-        "creationTimestamp": null
-      }
-    },
-    "encryptedData": {
-      "wg0.conf": "AgClUxLYCyjV/nHiKlwxkOiGXNIRFe8hRi/6uRJZsyXf5PcUe2bh8ubCPEg+7wmF5r/ZDMbfQnJHwzHFu4fSdSXNbJELMVO4kjyFPsH3f5N2iSBzxBaEeARGHd4ijOsOJvevpw5UW+R+aWnGpY+L09Rcbla5Ak/xRgTfCLaHn+AFC7G5FigvxLLXuJZRYPWvrUSK2P3ZQLc4xGjRHD3xDCrb5gjrzdt3ZqyaMqpufdQRaMnsqY1BqHzqHR11l5MhwK7jb/Ge+aNgRckheKqwlCL2aebSciFzdzr0Ve4oJN0neNiK7P8r0BjRSnHfeyhzmed8DwcTej1xJFt/mX+h8XrUS0i7ioPaUc/t159bPdjZuXdGFPtTGg66nUzKeLm1DOyB+sn80d5M9X4rDe5Poyyff56XxtLd1XCDuuPL9YZDTuETupaLm+57hsnHYIoCe7rmTg0pH5iZzO3p+pwplZMIB/VCDKM1HW6b91Yn1CqGOHfNM3qrrxgppz97G1568cDII+W5F5MZXPCb8ENZGzjm6FVDrHrLiYqAP+j6lTNN0WqNclnsLlcyckzXNpickdMeDRU/rnzNrpT1VDRgaCuU2vnZ91bh9ZcUBfm0aWcNl9wves8FHH+yt4YzKLVXG8Sm4sYRkeqEmrMUwrXbcG0l+b0tunT2QOZHNf5lUgHPjoyfp8ynpFrEsrZF9FH7/tB2Z6whbjYo1LDGunQ0aBCqfx2n4xNAb9urfh/fTxjT28PCGzYp9snCtmfGPcvCtkBy9cJeDiX4AE9PZsFTUzRjZUqRqKg+6QK4fZHkxYzpuzgH3cAsgG97RIcllNLA4fhN66SIAXjSrfVg8XYwXgHeyoRpcwhJ7WhiOaFSCccbXxEUVgzJ7O8KpCpbQlaYWbXbtpptAkBbNzPJ9kF+baOgD6SxbgFdc9V+oSM8sX/FubfK8Spm9fqu0slQaygvZX1ote67WWNK2uy8W82hymYS96g2FWghFnSbYEgrDUO8ASF4zhtPWyTWr45+Ba4WfQ3hZApTW5jJczjAn7w95ySt4gHFRxVmvbV8topVz8jO2V8t//OuRaQMpBLYjQVSGo60vuWIxFcgKqb2UxXiEqRWxhDWkjHx9RX9pCR9St0p6u/WL8Iwemq5a7RIedHQkuKmorOP100zCp4njsuRfN+kodtk0PjtZNJaVdbAVn9TYyY="
-    }
-  }
-}

apps/media/qbittorrent/wireguard-config.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: wireguard-config
-  namespace: media
-data:
-  PUID: "1000"
-  GUID: "1000"
-  TZ: America/Toronto
-  DOCKER_MODS: linuxserver/mods:universal-package-install
-  INSTALL_PACKAGES: libnatpmp|jq
-  # DOCKER_MODS: ghcr.io/fusetim/external_natpmp_qbittorrent:ecf567b21e5f079762e36c9cee9afaf86fcb22be

apps/media/radarr/dns-endpoint.yaml

@@ -1,12 +0,0 @@
-apiVersion: externaldns.k8s.io/v1alpha1
-kind: DNSEndpoint
-metadata:
-  name: radarr.michaelthomson.dev
-  namespace: media
-spec:
-  endpoints:
-  - dnsName: radarr.michaelthomson.dev
-    recordTTL: 180
-    recordType: CNAME
-    targets:
-    - server.michaelthomson.dev

apps/media/radarr/ingress.yaml

@@ -4,9 +4,9 @@ metadata:
   name: radarr
   namespace: media
   annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
-    # traefik.ingress.kubernetes.io/router.middlewares: authentik-radarr@kubernetescrd
 spec:
   rules:
   - host: radarr.michaelthomson.dev
@@ -22,4 +22,4 @@ spec:
   tls:
     - hosts:
         - radarr.michaelthomson.dev
-      secretName: letsencrypt-wildcard-cert-michaelthomson.dev
+      secretName: radarr-tls

apps/media/radarr/networkresource.yaml

@@ -0,0 +1,13 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkResource
+metadata:
+  name: radarr
+  namespace: media
+spec:
+  networkRouterRef:
+    name: homelab
+    namespace: netbird
+  serviceRef:
+    name: radarr
+  groups:
+    - name: homelab-services