update

This reverts commit ee5bfb66f6.

apps/baikal/deployment.yaml

@@ -1,34 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: baikal
-  namespace: baikal
-spec:
-  selector:
-    matchLabels:
-      app: baikal
-  template:
-    metadata:
-      labels:
-        app: baikal
-    spec:
-      containers:
-        - name: baikal
-          image: ckulka/baikal:nginx
-          ports:
-            - containerPort: 80
-              name: http
-              protocol: TCP
-          volumeMounts:
-            - mountPath: /var/www/baikal/config
-              name: config
-            - mountPath: /var/www/baikal/Specific
-              name: data
-      restartPolicy: Always
-      volumes:
-        - name: config
-          persistentVolumeClaim:
-            claimName: config
-        - name: data
-          persistentVolumeClaim:
-            claimName: data

apps/baikal/pvc-data.yaml

@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: data
-  namespace: baikal
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi

apps/baikal/service.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: baikal
-  namespace: baikal
-spec:
-  selector:
-    app: baikal
-  ports:
-    - name: http
-      port: 80
-      targetPort: http

apps/gitea/mailer-config-secret.yaml

@@ -1,6 +1,6 @@
 apiVersion: v1
-data:
-    mailer: ENC[AES256_GCM,data:baGCpPHJejjMFeiBcgSroJWqmUj/8PzvwAdzZ+nLacen2I91iaIRIgztvsk=,iv:6M2+sKRc1ZC5CqY4X43xgGO/CeWOfjMVzNgelYd0V6c=,tag:I15tnxf8CQaLu+/0GNdeOA==,type:str]
+stringData:
+    mailer: ENC[AES256_GCM,data:IrYl0ghmMpe7LCGuHFAv8OOnnYPnxed8M86qEnXct/d3Xlf+vQ==,iv:d/Egq7dRzNbx/5cEL5lKxD+ZsDhTLCB1EGnP6RXok00=,tag:aiQoSAMKQ1b0mXUT0lw8+w==,type:str]
 kind: Secret
 metadata:
     name: gitea-mailer-config-secret
@@ -16,7 +16,7 @@ sops:
             NkI0eUlmYjg3Zk9iVmNkZVpXWkh2TW8K/coOzGAPF42522cM6DZVAEEv3LmZaIhu
             BVyl8ijATNLMIfiFpP5bHpljPHrn3lGP70RzwoCV15t1fC6pjeParA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-12-17T20:36:08Z"
-    mac: ENC[AES256_GCM,data:QBxnUAGg6xchZ9iqKK8gAmdJhDfma5BZlJVRZcfzGM57diuO2OE4JDbjW5gqf21OACL4d2funVlXRVlioLoe0tfZJY3AAedOmyQVXdrr0PwarbPztbWAFVvIMeQWPZUyPd3GxgaAATeBVCanSEgVTIOVqCN/DXNSHY2XcQ9x9Y0=,iv:ugLYt5NxsTIy0wUul748IGIzayG+zPQ/z5kH3T9IfiE=,tag:3yTjZ+MMMVNmi/8p321fFg==,type:str]
+    lastmodified: "2026-05-12T01:59:49Z"
+    mac: ENC[AES256_GCM,data:TSNyIUQIRaX27K9ZbyiMCayFFIeUKmfD4Bz9Zu7Apa7NGqXmAWabzY3KHyjL14LDxmv4XJpA5W3DLI920DfOEUq2iW9EogMfSV7nEMMA6lzYMf+ca5W0BCwPE0MDBkTIL2nREoZh0FGDmq1M2syRIfaBrFKq97ZozQqz4AA8iZc=,iv:wCjERwABseOGN7LWiLzoT4VGHk9vnGdN0yl2eeQTAho=,tag:j/bDGqPoTm5FFGhERh1KJQ==,type:str]
     encrypted_regex: ^(data|stringData)$
-    version: 3.11.0
+    version: 3.12.2

apps/gitea/release.yaml

@@ -17,8 +17,6 @@ spec:
     global:
       storageClass: longhorn
 
-    replicaCount: 1
-
     service:
       ssh:
         type: LoadBalancer
@@ -47,9 +45,7 @@ spec:
           secretName: gitea-tls
 
     persistence:
-      claimName: gitea-shared-storage
       size: 10Gi
-      storageClass: longhorn
 
     gitea:
       config:
@@ -65,11 +61,11 @@ spec:
           ALLOWED_HOST_LIST: external,loopback,private
         mailer:
           ENABLED: true
-          FROM: gitea@michaelthomson.dev
+          FROM: server@michaelthomson.dev
           PROTOCOL: smtps
           SMTP_ADDR: mail.michaelthomson.dev
           SMTP_PORT: 465
-          USER: gitea@michaelthomson.dev
+          USER: server@michaelthomson.dev
       admin:
         existingSecret: admin-secret
         email: "gitea@michaelthomson.dev"
@@ -77,23 +73,17 @@ spec:
         - secret:
             secretName: gitea-mailer-config-secret
 
-    redis-cluster:
+    valkey-cluster:
       enabled: false
 
+    valkey:
+      enabled: true
+
     postgresql-ha:
       enabled: false
 
     postgresql:
       enabled: true
-      global:
-        postgresql:
-          auth:
-            password: gitea
-            database: gitea
-            username: gitea
-          service:
-            ports:
-              postgresql: 5432
       primary:
         persistence:
           size: 10Gi

apps/grimmory/mariadb-credentials.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+stringData:
+    mariadb-password: ENC[AES256_GCM,data:sRg+BqCvSWe/I9vLLRcgPyMs87BttZAejfKPI7kIej6L3sXasYE700jr9tw=,iv:VMnb9a72TYYBdC2RCD9wwpRdUZiiD+SFOZOl0ZIHjbU=,tag:eXRgY1VO0PDRJPUAr4RYXw==,type:str]
+    mariadb-root-password: ENC[AES256_GCM,data:86cu/5fSD2h7yQSt0b9cp15a56LYiyhdUfFVdhla7cs0GsIyDul2A4TuSQA=,iv:U+JPt6UUc70MzYAQBODEzl/wMQ+TEVBYZHxxMZf4xyw=,tag:CAdI37E9cj07yoltPxLjWg==,type:str]
+kind: Secret
+metadata:
+    name: mariadb-credentials
+    namespace: grimmory
+sops:
+    age:
+        - recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvOEhieFpaNU5CRElYRFRx
+            VjJqUm9Zbk44M3QvVlNqcUFGUnRjNlUvUERZCjA2VjJXdlJmSDdYeW5BbEF2RElV
+            QXZ6YVl3REVFRzY5RG81YzVyaWpBWTgKLS0tIEdITTBCUm1tZGhZVzFwbGszbDF6
+            ZzhZOEU2SUFUWllqOHZCS1c5YW5TQjQKbQqmVAWZq7aqBaFt+51oY7PZ2BcLc7Wa
+            neOgcwRTq2x27yoWNPlcWSsqFss5RLldriEer4QdwdIDlWEj8Js7uA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-05-24T18:40:49Z"
+    mac: ENC[AES256_GCM,data:URvFnjTBRU17FIJTLjggheWWI63UcktsyMgrKP5Ib7/F4HcSbZySGis6Ty/y2Cn5uessjpf12IQ1EZ0Vybnm7w58/nb3+ZiEow5XtJ91OAw2iCJv00YyKtWgFqkymCHJu2a/SuuG3ibH5+MbucQKHUSXuxsRvYaJaigw1Gzi80I=,iv:3H2NNqh8eBqNvKybtsKYujjDeDlvmlwXxdzRoazU46E=,tag:tgYlwl0K7GbSX1pBtlD/xg==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.12.2

apps/grimmory/release.yaml

@@ -0,0 +1,47 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: grimmory
+  namespace: grimmory
+spec:
+  chart:
+    spec:
+      chart: grimmory
+      version: 3.x
+      sourceRef:
+        kind: HelmRepository
+        name: grimmory
+  interval: 15m
+  releaseName: grimmory
+  values:
+    mariadb:
+      auth:
+        existingSecret: mariadb-credentials
+        secretKeys:
+          rootPasswordKey: mariadb-root-password
+          userPasswordKey: mariadb-password
+    ingress:
+      enabled: true
+      annotations:
+        cert-manager.io/cluster-issuer: "letsencrypt-prod"
+        traefik.ingress.kubernetes.io/router.entrypoints: websecure
+        traefik.ingress.kubernetes.io/router.tls: "true"
+      hosts:
+        - host: grimmory.michaelthomson.dev
+          paths:
+            - path: /
+              pathType: ImplementationSpecific
+      tls:
+        - hosts:
+            - grimmory.michaelthomson.dev
+          secretName: grimmory-tls
+    persistence:
+      dataVolume:
+        enabled: true
+        size: 100Mi
+        existingClaim: ""
+      booksVolume:
+        enabled: true
+        size: 10Gi
+        existingClaim: ""
+    

apps/grimmory/repository.yaml

@@ -0,0 +1,9 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: grimmory
+  namespace: grimmory
+spec:
+  type: "oci"
+  interval: 15m
+  url: oci://ghcr.io/grimmory-tools/helm-charts

apps/homeassistant/networkresource.yaml

@@ -0,0 +1,13 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkResource
+metadata:
+  name: homeassistant
+  namespace: homeassistant
+spec:
+  networkRouterRef:
+    name: homelab
+    namespace: netbird
+  serviceRef:
+    name: homeassistant
+  groups:
+    - name: All

apps/homeassistant/whisper-config.yaml

@@ -7,5 +7,5 @@ data:
   TZ: "America/Toronto"
   PUID: "1000"
   PGID: "1000"
-  WHISPER_MODEL: "base"
+  WHISPER_MODEL: "medium"
   WHISPER_LANG: "en"

apps/immich/cluster.yaml

@@ -8,7 +8,7 @@ metadata:
     cnpg.io/skipEmptyWalArchiveCheck: enabled
 spec:
   imageName: ghcr.io/tensorchord/cloudnative-vectorchord:17-0.3.0
-  instances: 2
+  instances: 3
 
   postgresql:
     shared_preload_libraries:

apps/kube-prometheus-stack/repository-grafana.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: grafana
+  namespace: kube-prometheus-stack
+spec:
+  interval: 15m
+  url: https://grafana.github.io/helm-charts

apps/media/jellyfin/deployment.yaml

@@ -47,7 +47,7 @@ spec:
       - name: cache
         emptyDir:
           medium: Memory
-          sizeLimit: 2Gi
+          sizeLimit: 3Gi
       - name: dev-dri
         hostPath:
           path: /dev/dri

apps/media/jellyfin/networkresource.yaml

@@ -0,0 +1,13 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkResource
+metadata:
+  name: jellyfin
+  namespace: media
+spec:
+  networkRouterRef:
+    name: homelab
+    namespace: netbird
+  serviceRef:
+    name: jellyfin
+  groups:
+    - name: All

apps/minecraft/release.yaml

@@ -1,50 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: minecraft
-  namespace: minecraft
-spec:
-  chart:
-    spec:
-      chart: minecraft
-      version: 5.x
-      sourceRef:
-        kind: HelmRepository
-        name: minecraft
-  interval: 15m
-  releaseName: minecraft
-  values:
-    serviceAnnotations:
-      metallb.io/loadBalancerIPs: 192.168.18.201
-
-    minecraftServer:
-      # This must be overridden, since we can't accept this for the user.
-      eula: true
-      # One of: LATEST, SNAPSHOT, or a specific version (ie: "1.7.9").
-      version: "LATEST"
-      ## The type of Minecraft server to run, check for related settings below
-      ## Common types: "VANILLA", "FABRIC", "FORGE", "SPIGOT", "BUKKIT", "PAPER",
-      ## "FTBA", "SPONGEVANILLA", "AUTO_CURSEFORGE"
-      ## ref: https://docker-minecraft-server.readthedocs.io/en/latest/types-and-platforms
-      type: "VANILLA"
-      # One of: peaceful, easy, normal, and hard
-      difficulty: normal
-      # A comma-separated list of player names to whitelist.
-      whitelist: DrDeww,lolobinbolo
-      # A comma-separated list of player names who should be admins.
-      ops: DrDeww
-      # A server icon URL for server listings. Auto-scaled and transcoded.
-      icon:
-      # Message of the Day
-      motd: "Welcome to Michael's Minecraft Server"
-      worldSaveName: world
-      # If you adjust this, you may need to adjust resources.requests above to match.
-      memory: 1024M
-      serviceType: LoadBalancer
-
-    persistence:
-      dataDir:
-        enabled: true
-        Size: 8Gi
-        accessModes:
-          - ReadWriteOnce

apps/minecraft/repository.yaml

@@ -1,9 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: minecraft
-  namespace: minecraft
-spec:
-  interval: 15m
-  url: https://itzg.github.io/minecraft-server-charts/
-

apps/nextcloud/release.yaml

@@ -7,7 +7,7 @@ spec:
   chart:
     spec:
       chart: nextcloud
-      version: 8.x
+      version: 9.x
       sourceRef:
         kind: HelmRepository
         name: nextcloud
@@ -126,47 +126,6 @@ spec:
       global:
         storageClass: longhorn
 
-    collabora:
-      enabled: true
-
-      # image:
-      #   tag: 24.04.11.1.1
-
-      collabora:
-        extra_params: --o:ssl.enable=false --o:ssl.termination=true
-
-        existingSecret:
-          enabled: true
-          secretName: "collabora-secret"
-          usernameKey: "username"
-          passwordKey: "password"
-
-      # securityContext:
-      #   runAsNonRoot: true
-      #   privileged: true
-      #   capabilities:
-      #     add:
-      #       - SYS_ADMIN
-      #       - MKNOD
-
-      ingress:
-        enabled: true
-        annotations:
-          cert-manager.io/cluster-issuer: "letsencrypt-prod"
-          external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
-          external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
-          traefik.ingress.kubernetes.io/router.entrypoints: websecure
-          traefik.ingress.kubernetes.io/router.tls: "true"
-        hosts:
-          - host: collabora.michaelthomson.dev
-            paths:
-            - path: /
-              pathType: ImplementationSpecific
-        tls:
-          - hosts:
-              - collabora.michaelthomson.dev
-            secretName: collabora-tls
-
     cronjob:
       enabled: true
 

apps/ntfy/deployment.yaml

@@ -1,47 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: ntfy
-  namespace: ntfy
-  labels:
-    app: ntfy
-spec:
-  revisionHistoryLimit: 1
-  replicas: 1
-  selector:
-    matchLabels:
-      app: ntfy
-  template:
-    metadata:
-      labels:
-        app: ntfy
-    spec:
-      containers:
-        - name: ntfy
-          image: binwiederhier/ntfy:v1.28.0
-          args: ["serve"]
-          env:
-            - name: TZ
-              value: America/Toronto
-            - name: NTFY_DEBUG
-              value: "false"
-            - name: NTFY_LOG_LEVEL
-              value: INFO
-            - name: NTFY_BASE_URL
-              value: https://ntfy.michaelthomson.dev
-          ports: 
-            - containerPort: 80
-              name: http
-          volumeMounts:
-            - mountPath: /etc/ntfy
-              subPath: server.yml
-              name: config-volume
-            - mountPath: /var/cache/ntfy
-              name: cache-volume
-      volumes:
-        - name: config-volume
-          configMap:
-            name: server-config
-        - name: cache-volume
-          persistentVolumeClaim:
-            claimName: pvc

apps/ntfy/ingress.yaml

@@ -1,27 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: ntfy
-  namespace: ntfy
-  annotations:
-    cert-manager.io/cluster-issuer: "letsencrypt-prod"
-    external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
-    external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
-    traefik.ingress.kubernetes.io/router.tls: "true"
-spec:
-  rules:
-  - host: ntfy.michaelthomson.dev
-    http:
-      paths:
-      - pathType: Prefix
-        path: /
-        backend:
-          service:
-            name: service
-            port: 
-              name: http
-  tls:
-    - hosts:
-        - ntfy.michaelthomson.dev
-      secretName: ntfy-tls

apps/ntfy/pvc.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: pvc
-  namespace: ntfy
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 1Gi

apps/ntfy/server-config.yaml

@@ -1,9 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: server-config
-  namespace: ntfy
-data:
-  server.yml: |
-    cache-file: "/var/cache/ntfy/cache.db"
-    attachment-cache-dir: "/var/cache/ntfy/attachments"

apps/ntfy/service.yaml

@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: service
-  namespace: ntfy
-spec:
-  type: ClusterIP
-  selector:
-    app: ntfy
-  ports:
-    - name: http
-      protocol: TCP
-      port: 80
-      targetPort:  http

apps/ollama/release.yaml

@@ -0,0 +1,53 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: ollama
+  namespace: ollama
+spec:
+  chart:
+    spec:
+      chart: ollama
+      version: 1.x
+      sourceRef:
+        kind: HelmRepository
+        name: ollama
+  interval: 15m
+  releaseName: ollama
+  values:
+    runtimeClassName: nvidia
+    ollama:
+      gpu:
+        enabled: true
+        type: nvidia
+        number: 1
+      models:
+        pull:
+          - gemma4:12b
+        # create:
+        #   - name: qwen3.5:9b-custom
+        #     template: |
+        #       FROM qwen3.5:9b
+        #       PARAMETER num_ctx 8192
+        #       PARAMETER temperature 1.0
+        #       PARAMETER top_p 0.95
+        #       PARAMETER top_k 20
+        #       PARAMETER min_p 0.0
+        #       PARAMETER presence_penalty 1.5
+        #       PARAMETER repetition_penalty 1.0
+        # run:
+        #   - qwen3.5:9b-custom
+    ingress:
+      enabled: true
+      annotations:
+        cert-manager.io/cluster-issuer: "letsencrypt-prod"
+        traefik.ingress.kubernetes.io/router.entrypoints: websecure
+        traefik.ingress.kubernetes.io/router.tls: "true"
+      hosts:
+        - host: ollama.michaelthomson.dev
+          paths:
+            - path: /
+              pathType: Prefix
+      tls:
+        - hosts:
+            - ollama.michaelthomson.dev
+          secretName: ollama-tls

apps/ollama/repository.yaml

@@ -1,8 +1,8 @@
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:
-  name: vaultwarden
-  namespace: vaultwarden
+  name: ollama
+  namespace: ollama
 spec:
   interval: 15m
-  url: https://guerzon.github.io/vaultwarden
+  url: https://helm.otwld.com/

apps/vaultwarden/admincreds-secret.yaml

@@ -1,22 +0,0 @@
-apiVersion: v1
-data:
-    ADMIN_TOKEN: ENC[AES256_GCM,data:N0kMJfrvylK/MiG+Yq9IpaPx0Q0=,iv:GR/ZxbKOim54hbryAw5MbktstNZ4upqXi/tsM4CPGmA=,tag:4USciX0i9f0cPK6BAy8zDw==,type:str]
-kind: Secret
-metadata:
-    name: admincreds-secret
-    namespace: vaultwarden
-sops:
-    age:
-        - recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiTjhIQUJjRWZzR2VSMldz
-            M2d1YUZ6QWl6Z3hJM0xxMGV6N1d0U2RUTlVFCjZHSTdBOTd1QW5Hb3BsZEc2Ykdv
-            ZElxUTgrVG1EcmM5SGxiNW1WMHRpbWcKLS0tIG91WmRsNzhWa1R1dHZ3QWJqbnQx
-            ZEpndHIyQzllejI0K0t0bkVKOWloYWsKeSb8P3ZijFvLy9IzVDkxMakfyWS7tt8e
-            uo3wrtSTlPHzvozymM/hXVDzKI6XZIZnUBfebGQpk0DgymyYKrwFgw==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-12-17T20:36:08Z"
-    mac: ENC[AES256_GCM,data:sidIbGpK0REcpsX+lQyE6G6/qMH1EWsLzKc6p80X++L5ALzMT3zbKK7JNeGNIpAGdeX+3VF/g2JM5k+mIQdNQUjjxHuej3XQQ1PPKsis7GMpms2PSM9V51GbJ3QSeCW8hLqEDc7fKsB7dYLV+TAcrWtPg/lsV4VJ25eIkCQS7N4=,iv:gdORkFVZj0Rt6Qrx4K+xhk07TwKT6vxPu/sgg0Q/32E=,tag:A0shGOWTVSRPsNDG/kOM9g==,type:str]
-    encrypted_regex: ^(data|stringData)$
-    version: 3.11.0

apps/vaultwarden/config.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: vaultwarden-config
+  namespace: vaultwarden
+data:
+  DOMAIN: "https://vaultwarden.michaelthomson.dev"
+  SIGNUPS_ALLOWED: "false"
+  SMTP_HOST: "mail.michaelthomson.dev"
+  SMTP_FROM: "server@michaelthomson.dev"
+  SMTP_PORT: "465"
+  SMTP_SECURITY: "force_tls"

apps/vaultwarden/deployment.yaml

@@ -0,0 +1,34 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: vaultwarden
+  namespace: vaultwarden
+spec:
+  selector:
+    matchLabels:
+      app: vaultwarden
+  template:
+    metadata:
+      labels:
+        app: vaultwarden
+    spec:
+      containers:
+      - name: vaultwarden
+        image: vaultwarden/server:latest
+        imagePullPolicy: Always
+        envFrom:
+          - secretRef:
+              name: vaultwarden-secret
+          - configMapRef:
+              name: vaultwarden-config
+        ports:
+        - containerPort: 80
+          name: http
+          protocol: TCP
+        volumeMounts:
+        - mountPath: /data
+          name: data
+      volumes:
+      - name: data
+        persistentVolumeClaim: 
+          claimName: vaultwarden-pvc

apps/vaultwarden/ingress.yaml

@@ -1,8 +1,8 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: baikal
-  namespace: baikal
+  name: vaultwarden
+  namespace: vaultwarden
   annotations:
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
     external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
@@ -11,17 +11,17 @@ metadata:
     traefik.ingress.kubernetes.io/router.tls: "true"
 spec:
   rules:
-  - host: baikal.michaelthomson.dev
+  - host: vaultwarden.michaelthomson.dev
     http:
       paths:
       - pathType: ImplementationSpecific
         path: /
         backend:
           service:
-            name: baikal
+            name: vaultwarden
             port: 
               name: http
   tls:
-    - hosts:
-        - baikal.michaelthomson.dev
-      secretName: baikal-tls
+  - hosts:
+    - vaultwarden.michaelthomson.dev
+    secretName: vaultwarden-tls

apps/vaultwarden/pvc.yaml

@@ -1,8 +1,8 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: config
-  namespace: baikal
+  name: vaultwarden-pvc
+  namespace: vaultwarden
 spec:
   accessModes:
     - ReadWriteOnce

apps/vaultwarden/release.yaml

@@ -1,54 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: vaultwarden
-  namespace: vaultwarden
-spec:
-  chart:
-    spec:
-      chart: vaultwarden
-      version: 0.30.x
-      sourceRef:
-        kind: HelmRepository
-        name: vaultwarden
-  interval: 15m
-  releaseName: vaultwarden
-  values:
-    resourceType: Deployment
-    data:
-      name: "vaultwarden-data"
-      size: "15Gi"
-      class: "longhorn"
-      accessMode: "ReadWriteOnce"
-    domain: "https://vaultwarden.michaelthomson.dev"
-    signupsAllowed: false
-    signupsVerify: "true"
-    requireDeviceEmail: "true"
-    adminToken:
-      existingSecret: "admincreds-secret"
-      existingSecretKey: "ADMIN_TOKEN"
-    timeZone: "America/Toronto"
-    smtp:
-      existingSecret: "smtpcreds-secret"
-      host: "mail.michaelthomson.dev"
-      security: "force_tls"
-      port: 465
-      from: "vaultwarden@michaelthomson.dev"
-      fromName: "Vaultwarden"
-      username:
-        existingSecretKey: "SMTP_USERNAME"
-      password:
-        existingSecretKey: "SMTP_PASSWORD"
-    ingress:
-      enabled: true
-      class: "traefik"
-      additionalAnnotations:
-        cert-manager.io/cluster-issuer: "letsencrypt-prod"
-        external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
-        external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
-        traefik.ingress.kubernetes.io/router.entrypoints: websecure
-        traefik.ingress.kubernetes.io/router.tls: "true"
-      labels: {}
-      tls: true
-      hostname: "vaultwarden.michaelthomson.dev"
-      tlsSecret: vaultwarden-tls

apps/vaultwarden/secret.yaml

@@ -0,0 +1,24 @@
+apiVersion: v1
+stringData:
+    SMTP_PASSWORD: ENC[AES256_GCM,data:ckVcecLJPGsD4RYEva2TJluXy2TvhS3aYPzxAyEN,iv:AteDpQU+1p5+/nxtgSDhyH/O6dEPrLE6OrN8soMQNGk=,tag:DlaHPDzhBxRDbuuNdNSllw==,type:str]
+    SMTP_USERNAME: ENC[AES256_GCM,data:6oCLieSE7U0QIn6+q48oQSEiRKD8fYRe6A==,iv:Ub9f7Hni0N1pvQNfje+EUbXoQHb37v8Wja2u0bvp0/E=,tag:p4VfEXiQEqH3aQNt+9aMPQ==,type:str]
+    ADMIN_TOKEN: ENC[AES256_GCM,data:oUoWtQYgU5oEg7SAEjWqiOYkdaVS0ELwXgdfgaYUglkRdDZ0vOJ7axW4Ah4=,iv:hNBdD5zrut9y8R4nl1z28X9ou3pAvSEv58XLSjeMuUY=,tag:h78hZsfFYbD/35fEa0I2dw==,type:str]
+kind: Secret
+metadata:
+    name: vaultwarden-secret
+    namespace: vaultwarden
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3ZWVxNElZM1pFNEx6eE9q
+            U3ZHTzdhcXMzWmRBWGM0eDFTVCtFOGhGYzN3ClZ2U2NaSFVuaUN6RDhaYkVnb1du
+            M2JFMzBkeWZUaFBKeEZYb2FiMytIeWcKLS0tIEFQelhqQUhDODlTL2J4M0kzK05m
+            YjFheFgwRGVEVWJ3TW94UWlTREV6K2cKpnqUg4qLeOtIfecGjV2nUAYZGTkHCrT6
+            OHfL5W55BqcQJYovv37JJHkNV+IHuVNo7aqO/gx5AE0HfMWPfy6QGg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-06-21T00:57:10Z"
+    mac: ENC[AES256_GCM,data:iTUsBfc++AdMS0rd2isUEsnU7jp2Pg50KhtWR8J5bBWi/4xyoBVP2fr/c+jAVUMeGVbkZZb+zA6jvaTzhsITKyDwkyVIMShKfXeSLvr9PRMLExkif2DNRzkQ+jRhsnOFdtoUqnKfEN2QtjBJ0OkvN5RrjjMLnlmkswLDhIvQbyo=,iv:WbIIrJf7bpLft8t14XNCeuk88ij8TzkCMMQg0QKQW2o=,tag:sv1Jid832xDdmmOsof4ZGg==,type:str]
+    version: 3.13.1

apps/vaultwarden/service.yaml

@@ -1,11 +1,11 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: wg-easy
-  namespace: wg-easy
+  name: vaultwarden
+  namespace: vaultwarden
 spec:
   selector:
-    app: wg-easy
+    app: vaultwarden
   ports:
   - port: 80
     targetPort: http

apps/vaultwarden/smtpcreds-secret.yaml

@@ -1,23 +0,0 @@
-apiVersion: v1
-data:
-    SMTP_PASSWORD: ENC[AES256_GCM,data:SxuZaVeYXXhar0Qhi7clkXyO15rBG8xI9QTOzgwqGVCjHOW4,iv:zKgyHRU6GOnz6Vpt1Ko4/B9ySZpbMf2J/bN8WdUaitY=,tag:4+02vnssi0okvMZDel7/mw==,type:str]
-    SMTP_USERNAME: ENC[AES256_GCM,data:NREKMX/dvkejjoiLa764rT7CDl0nPoAaNWkXGnqrgdPhnsMVSUv1RA==,iv:VXe3z426+688ojm4JU3hyytFWCJ2oYgSFVnIOv2ry8Y=,tag:Tj5k8LApkxd+TBJFF/6/Zg==,type:str]
-kind: Secret
-metadata:
-    name: smtpcreds-secret
-    namespace: vaultwarden
-sops:
-    age:
-        - recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3ZWVxNElZM1pFNEx6eE9q
-            U3ZHTzdhcXMzWmRBWGM0eDFTVCtFOGhGYzN3ClZ2U2NaSFVuaUN6RDhaYkVnb1du
-            M2JFMzBkeWZUaFBKeEZYb2FiMytIeWcKLS0tIEFQelhqQUhDODlTL2J4M0kzK05m
-            YjFheFgwRGVEVWJ3TW94UWlTREV6K2cKpnqUg4qLeOtIfecGjV2nUAYZGTkHCrT6
-            OHfL5W55BqcQJYovv37JJHkNV+IHuVNo7aqO/gx5AE0HfMWPfy6QGg==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-12-17T20:36:08Z"
-    mac: ENC[AES256_GCM,data:402GE3Cqd1N+cQBRnfNb5+/dudSy5pO1Hilc4DW0n+xm4x5sn8wr8C/mL6NDoBKh8fc7JAPPShCfx5B2RdxBL0hs7fkohSIKvtU4hq75enq/bPOtRoxuSxAMH89ayVSbP0V1llWsHFwGJROEMp/9vpqWUFqFvf3uCC8tLOGSy/8=,iv:lp0JMs56ltxFLJOiOWoTa2+D383SgD15v7XJpAwEDdw=,tag:/dezyOAu2W6nTGNQxKTlpA==,type:str]
-    encrypted_regex: ^(data|stringData)$
-    version: 3.11.0

apps/wg-easy/config.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: wg-easy-config
-  namespace: wg-easy
-data:
-  LANG: "en"
-  WG_HOST: "wireguard.michaelthomson.dev"
-  WG_PORT: "30000"
-  UI_TRAFFIC_STATS: "true"
-  UI_CHART_TYPE: "1"
-  ENABLE_PROMETHEUS_METRICS: "true"

apps/wg-easy/deployment.yaml

@@ -1,48 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: wg-easy
-  namespace: wg-easy
-spec:
-  selector:
-    matchLabels:
-      app: wg-easy
-  template:
-    metadata:
-      labels:
-        app: wg-easy
-    spec:
-      # securityContext:
-      #   sysctls:
-      #   - name: net.ipv4.ip_forward
-      #     value: "1"
-      #   - name: net.ipv4.conf.all.src_valid_mark
-      #     value: "1"
-      containers:
-      - name: wg-easy
-        image: ghcr.io/wg-easy/wg-easy
-        imagePullPolicy: Always
-        envFrom:
-        - configMapRef:
-            name: wg-easy-config
-            optional: false
-        ports:
-        - containerPort: 30000
-          name: wg
-          protocol: UDP
-        - containerPort: 51821
-          name: http
-          protocol: TCP
-        securityContext:
-          capabilities:
-            add:
-            - NET_ADMIN
-            - SYS_MODULE
-        volumeMounts:
-        - name: config
-          mountPath: /etc/wireguard
-      restartPolicy: Always
-      volumes:
-      - name: config
-        persistentVolumeClaim:
-          claimName: wg-easy-config

apps/wg-easy/ingress.yaml

@@ -1,27 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: wg-easy
-  namespace: wg-easy
-  annotations:
-    cert-manager.io/cluster-issuer: "letsencrypt-prod"
-    external-dns.alpha.kubernetes.io/target: michaelthomson.ddns.net
-    external-dns.alpha.kubernetes.io/cloudflare-proxied: "true"
-    traefik.ingress.kubernetes.io/router.entrypoints: websecure
-    traefik.ingress.kubernetes.io/router.tls: "true"
-spec:
-  rules:
-  - host: wireguard.michaelthomson.dev
-    http:
-      paths:
-      - pathType: ImplementationSpecific
-        path: /
-        backend:
-          service:
-            name: wg-easy
-            port: 
-              name: http
-  tls:
-    - hosts:
-        - wireguard.michaelthomson.dev
-      secretName: wg-easy-tls

apps/wg-easy/pvc-config.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: wg-easy-config
-  namespace: wg-easy
-spec:
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: longhorn
-  accessModes:
-    - ReadWriteOnce

apps/wg-easy/service-dns.yaml

@@ -1,16 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: wg-easy-dns
-  namespace: wg-easy
-  annotations:
-    metallb.io/loadBalancerIPs: 192.168.18.245
-spec:
-  type: LoadBalancer
-  selector:
-    app: wg-easy
-  ports:
-  - name: wg
-    port: 30000
-    targetPort: wg
-    protocol: UDP

bootstrap/apps/kustomization-grimmory.yaml

@@ -1,11 +1,11 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: baikal
+  name: grimmory
   namespace: flux-system
 spec:
   interval: 15m
-  path: ./apps/baikal
+  path: ./apps/grimmory
   prune: true # remove any elements later removed from the above path
   wait: true
   sourceRef:

bootstrap/apps/kustomization-minecraft.yaml

@@ -1,19 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: minecraft
-  namespace: flux-system
-spec:
-  interval: 15m
-  path: ./apps/minecraft
-  prune: true # remove any elements later removed from the above path
-  wait: true
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-age
-  dependsOn:
-    - name: infra-configs

bootstrap/apps/kustomization-ollama.yaml

@@ -1,12 +1,12 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: ntfy
+  name: ollama
   namespace: flux-system
 spec:
   interval: 15m
-  path: ./apps/ntfy
-  prune: true # remove any elements later removed from the above path
+  path: ./apps/ollama
+  prune: true
   wait: true
   sourceRef:
     kind: GitRepository

bootstrap/apps/kustomization-wg-easy.yaml

@@ -1,19 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: wg-easy
-  namespace: flux-system
-spec:
-  interval: 15m
-  path: ./apps/wg-easy
-  prune: true # remove any elements later removed from the above path
-  wait: true
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-age
-  dependsOn:
-    - name: infra-configs

infrastructure/configs/netbird/networkrouter.yaml

@@ -0,0 +1,8 @@
+apiVersion: netbird.io/v1alpha1
+kind: NetworkRouter
+metadata:
+  name: homelab
+  namespace: netbird
+spec:
+  dnsZoneRef:
+    name: homelab.local

infrastructure/controllers/generic-cdi-plugin/daemonset.yaml

@@ -1,47 +0,0 @@
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: generic-cdi-plugin-daemonset
-  namespace: generic-cdi-plugin
-spec:
-  selector:
-    matchLabels:
-      name: generic-cdi-plugin
-  template:
-    metadata:
-      labels:
-        name: generic-cdi-plugin
-        app.kubernetes.io/component: generic-cdi-plugin
-        app.kubernetes.io/name: generic-cdi-plugin
-    spec:
-      containers:
-      - image: ghcr.io/olfillasodikno/generic-cdi-plugin:main
-        name: generic-cdi-plugin
-        command:
-          - /generic-cdi-plugin
-          - /var/run/cdi/nvidia-container-toolkit.json
-        imagePullPolicy: Always
-        securityContext:
-          privileged: true
-        tty: true
-        volumeMounts:
-        - name: kubelet
-          mountPath: /var/lib/kubelet
-        - name: nvidia-container-toolkit
-          mountPath: /var/run/cdi/nvidia-container-toolkit.json
-      volumes:
-      - name: kubelet
-        hostPath:
-          path: /var/lib/kubelet
-      - name: nvidia-container-toolkit
-        hostPath:
-          path: /var/run/cdi/nvidia-container-toolkit.json
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-            - matchExpressions:
-              - key: "nixos-nvidia-cdi"
-                operator: In
-                values:
-                - "enabled"

infrastructure/controllers/longhorn/release.yaml

@@ -7,7 +7,7 @@ spec:
   chart:
     spec:
       chart: longhorn
-      version: 1.9.x
+      version: 1.11.x
       sourceRef:
         kind: HelmRepository
         name: longhorn
@@ -21,8 +21,7 @@ spec:
         enable: true
         jobList: '[{"name":"backup","isGroup":true},{"name":"snapshot","isGroup":true},{"name":"trim","isGroup":true}]'
     defaultBackupStore:
-      backupTarget: s3://mthomson-longhorn-backup@ca-central-1/
-      backupTargetCredentialSecret: wasabi-secret
+      backupTarget: nfs://192.168.18.99:/volume1/k8sbackupstore
       pollInterval: 0
     defaultSettings:
       replicaAutoBalance: best-effort

infrastructure/controllers/metallb/release.yaml

@@ -14,3 +14,5 @@ spec:
   interval: 15m
   releaseName: metallb
   values:
+    speaker:
+      ignoreExcludeLB: true

infrastructure/controllers/netbird/netbird-mgmt-api-key.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+data:
+    NB_API_KEY: ENC[AES256_GCM,data:bO72vA7WNMrb2baStVlDUbjRdwNaWswP5eGfXEBAPepjYIMmBJnCV81d8bEWClFcGw2MwDO2ulQ=,iv:x/swnBZgPhoz2lGjImqEvPPa8wNWTZJlCWo96hV63X8=,tag:T6yhV0to68Ybe5gcxsYedQ==,type:str]
+kind: Secret
+metadata:
+    name: netbird-mgmt-api-key
+    namespace: netbird
+sops:
+    age:
+        - recipient: age1s0206tnfaaw849x5xmt95axgu8qhxzlu5ywrwz09tpt8lwpx858q089nq9
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBId2tXZ2krZFhiendhN3c2
+            OUN1V3RmRHBVQ1Z0T2FJTnU1WE9mRHp4QkNVCkpGOForQWFWN2FjdWppNG9hMFFK
+            d1N6ckMxdjFhT3NnRmVReG9jdXpMcFEKLS0tIFJ0RXJHQ2E2S08xUU9mdlFPTEd2
+            Rms3V1grTyt5L1pockJxNFRVUDFLMGsKLOj+Sxw/mzdmhdAp7G/NoVJixuL14we2
+            hwEank8H1TnOb/VynHUCYQrYaPXE+FkSYumhLo3IJC1ZMKzQUFp9dw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-05-07T17:46:40Z"
+    mac: ENC[AES256_GCM,data:RC07/U3NbwI5wU/ZbG+0A7nnDVlhBmcZsUevSmk9hqftFCCa4Q9R8q40XGFKod2pFl0SQzg8FXJPQABG6T9jYAKngD68zKD0wG2eHbXSxJiGT92nq2pkReOHZL/WFH6fGBse3RkXCjirwcIs27sLbXgdCCGmy36UU4CrnT3Nt5c=,iv:sQlS1M/58akJ1QdPGzpEZQaIxYk2QMwhdY3clIWnBCE=,tag:k95JRSlRzbMMbBNCCyB/8w==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.12.2

infrastructure/controllers/netbird/release.yaml

@@ -0,0 +1,20 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: netbird-operator
+  namespace: netbird
+spec:
+  chart:
+    spec:
+      chart: kubernetes-operator
+      sourceRef:
+        kind: HelmRepository
+        name: netbirdio
+  interval: 15m
+  releaseName: netbird-operator
+  values:
+    managementURL: "https://netbird.michaelthomson.dev:443"
+    netbirdAPI:
+      keyFromSecret:
+        name: "netbird-mgmt-api-key"
+        key: "NB_API_KEY"

infrastructure/controllers/netbird/repository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: netbirdio
+  namespace: netbird
+spec:
+  interval: 15m
+  url: https://netbirdio.github.io/helms

infrastructure/controllers/nvidia-gpu-operator/release.yaml

@@ -0,0 +1,37 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: nvidia-gpu-operator
+  namespace: nvidia-gpu-operator
+spec:
+  chart:
+    spec:
+      chart: gpu-operator
+      version: 26.x
+      sourceRef:
+        kind: HelmRepository
+        name: nvidia
+  interval: 15m
+  releaseName: nvidia-gpu-operator
+  values:
+    driver:
+      enabled: false
+    toolkit:
+      enabled: false
+    hostPaths:
+      driverInstallDir: "/usr/local"
+    devicePlugin:
+      config:
+        create: true
+        name: "time-slicing-config"
+        default: "timeslicing"
+        data:
+          timeslicing: |-
+            version: v1
+            flags:
+              migStrategy: none
+            sharing:
+              timeSlicing:
+                resources:
+                - name: nvidia.com/gpu
+                  replicas: 5

infrastructure/controllers/nvidia-gpu-operator/repository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: nvidia
+  namespace: nvidia-gpu-operator
+spec:
+  interval: 15m
+  url: https://helm.ngc.nvidia.com/nvidia

infrastructure/namespaces/namespace-generic-cdi-plugin.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: generic-cdi-plugin

infrastructure/namespaces/namespace-gitea.yaml

@@ -2,3 +2,7 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: gitea
+  labels:
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/warn: privileged

infrastructure/namespaces/namespace-grimmory.yaml

@@ -1,4 +1,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: baikal
+  name: grimmory

infrastructure/namespaces/namespace-homeassistant.yaml

@@ -2,3 +2,7 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: homeassistant
+  labels:
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/warn: privileged

infrastructure/namespaces/namespace-longhorn.yaml

@@ -2,3 +2,7 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: longhorn-system
+  labels:
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/warn: privileged

infrastructure/namespaces/namespace-media.yaml

@@ -2,3 +2,7 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: media
+  labels:
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/warn: privileged

infrastructure/namespaces/namespace-metallb.yaml

@@ -2,3 +2,7 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: metallb-system
+  labels:
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/warn: privileged

infrastructure/namespaces/namespace-minecraft.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: minecraft

infrastructure/namespaces/namespace-netbird.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: netbird
+  labels:
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/warn: privileged

infrastructure/namespaces/namespace-ntfy.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: ntfy

infrastructure/namespaces/namespace-nvidia-gpu-operator.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: nvidia-gpu-operator
+  labels:
+    pod-security.kubernetes.io/enforce: privileged

infrastructure/namespaces/namespace-ollama.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: ollama
+  labels:
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/warn: privileged

infrastructure/namespaces/namespace-sealed-secrets.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: sealed-secrets

infrastructure/namespaces/namespace-wg-easy.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: wg-easy

renovate.json

@@ -1,6 +0,0 @@
-{
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
-  "extends": [
-    "config:recommended"
-  ]
-}