Merge pull request #786 from 3dwardch3ng/infra/renovate

update installation scripts

apps/adguard-home/base/deployment.yaml

@@ -16,7 +16,7 @@ spec:
     spec:
       containers:
         - name: adguard-home
-          image: adguard/adguardhome:v0.107.51
+          image: adguard/adguardhome:v0.107.52
           ports:
             - protocol: TCP
               containerPort: 53

apps/coder/env/k3s-cluster/kustomization.yaml

@@ -3,6 +3,6 @@ kind: Kustomization
 helmCharts:
   - name: coder
     repo: https://helm.coder.com/v2
-    version: 2.13.1
+    version: 2.14.1
     releaseName: coder
     valuesFile: values.yaml

apps/gitea/env/k3s-cluster/kustomization.yaml

@@ -3,6 +3,6 @@ kind: Kustomization
 helmCharts:
   - name: gitea
     repo: oci://registry-1.docker.io/bitnamicharts
-    version: 2.3.14
+    version: 2.3.18
     releaseName: gitea
     valuesFile: values.yaml

apps/gitlab/env/k3s-cluster/deployment.yaml

@@ -1,62 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: gitlab
-  namespace: gitlab
-  labels:
-    app.kubernetes.io/name: gitlab
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: gitlab
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: gitlab
-    spec:
-      containers:
-        - name: gitlab
-          image: gitlab/gitlab-ce:17.2.1-ce.0
-          securityContext:
-            allowPrivilegeEscalation: false
-          env:
-            - name: GITLAB_OMNIBUS_CONFIG
-              value: "external_url 'https://gitlab.cluster.edward.sydney'"
-          ports:
-            - protocol: TCP
-              containerPort: 443
-              name: https
-            - protocol: TCP
-              containerPort: 80
-              name: http
-            - protocol: TCP
-              containerPort: 22
-              name: ssh
-          volumeMounts:
-            - name: dshm
-              mountPath: /dev/shm
-            - name: gitlab-config
-              mountPath: /etc/config
-            - name: gitlab-log
-              mountPath: /var/log/gitlab
-            - name: gitlab-data
-              mountPath: /var/opt/gitlab
-      volumes:
-        - name: dshm
-          emptyDir:
-            medium: Memory
-            sizeLimit: 1Gi
-        - name: gitlab-config
-          hostPath:
-            path: /mnt/nfs/AppData/gitlab/config
-            type: Directory
-        - name: gitlab-log
-          hostPath:
-            path: /mnt/nfs/AppData/gitlab/log
-            type: Directory
-        - name: gitlab-data
-          hostPath:
-            path: /mnt/nfs/AppData/gitlab/data
-            type: Directory
-      nodeSelector:
-        kubernetes.io/arch: amd64

apps/gitlab/env/k3s-cluster/service.yaml

@@ -1,25 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: gitlab
-  namespace: gitlab
-  labels:
-    app.kubernetes.io/name: gitlab
-spec:
-  selector:
-    app.kubernetes.io/name: gitlab
-  type: LoadBalancer
-  internalTrafficPolicy: Cluster
-  ports:
-    - protocol: TCP
-      port: 10080
-      targetPort: 80
-      name: http
-    - protocol: TCP
-      port: 10443
-      targetPort: 443
-      name: https
-    - protocol: TCP
-      port: 10022
-      targetPort: 22
-      name: ssh

apps/homer/base/deployment.yaml

@@ -32,10 +32,10 @@ spec:
               containerPort: 8088
               name: http
           volumeMounts:
-            - name: assets
-              mountPath: /www/assets
+            - name: www
+              mountPath: /www
       volumes:
-        - name: assets
+        - name: www
           hostPath:
-            path: /mnt/nfs/AppData/homer/www/assets
+            path: /mnt/nfs/AppData/homer/www
             type: Directory

apps/jellyfin/base/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+helmCharts:
+  - name: jellyfin
+    repo: https://beluga-cloud.github.io/charts
+    version: 2.3.0
+    releaseName: jellyfin
+    valuesFile: values.yaml

apps/jellyfin/base/values.yaml

@@ -0,0 +1,155 @@
+podSecurityContext:
+  runAsGroup: 1000
+  runAsUser: 1000
+  fsGroup: 1000
+containerSecurityContext:
+  runAsGroup: 1000
+  runAsUser: 1000
+persistence:
+  config:
+    enabled: true
+    volumeClaimSpec:
+      accessModes:
+        - ReadWriteOnce
+      volumeName: jellyfin-config
+      storageClassName: local-path
+  data:
+    enabled: true
+    volumeClaimSpec:
+      accessModes:
+        - ReadWriteOnce
+      volumeName: jellyfin-data
+      storageClassName: local-path
+jellyfin:
+  mediaVolumes:
+    - name: movies
+      readOnly: false
+      volumeSpec:
+        storageClassName: local-path
+        volumeMode: Filesystem
+        capacity:
+          storage: 256Gi
+        accessModes:
+          - ReadWriteOnce
+        persistentVolumeReclaimPolicy: Retain
+        nodeAffinity:
+          required:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: kubernetes.io/os
+                    operator: In
+                    values:
+                      - linux
+        claimRef:
+          apiVersion: v1
+          kind: PersistentVolumeClaim
+          name: jellyfin-mediavol-movies
+          namespace: jellyfin
+        hostPath:
+          path: "/mnt/nfs/media/movie"
+          type: "Directory"
+    - name: series
+      readOnly: false
+      volumeSpec:
+        storageClassName: local-path
+        volumeMode: Filesystem
+        capacity:
+          storage: 256Gi
+        accessModes:
+          - ReadWriteOnce
+        persistentVolumeReclaimPolicy: Retain
+        nodeAffinity:
+          required:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: kubernetes.io/os
+                    operator: In
+                    values:
+                      - linux
+        claimRef:
+          apiVersion: v1
+          kind: PersistentVolumeClaim
+          name: jellyfin-mediavol-series
+          namespace: jellyfin
+        hostPath:
+          path: "/mnt/nfs/media/tv"
+          type: "Directory"
+    - name: music-videos
+      readOnly: false
+      volumeSpec:
+        storageClassName: local-path
+        volumeMode: Filesystem
+        capacity:
+          storage: 128Gi
+        accessModes:
+          - ReadWriteOnce
+        persistentVolumeReclaimPolicy: Retain
+        nodeAffinity:
+          required:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: kubernetes.io/os
+                    operator: In
+                    values:
+                      - linux
+        claimRef:
+          apiVersion: v1
+          kind: PersistentVolumeClaim
+          name: jellyfin-mediavol-music-videos
+          namespace: jellyfin
+        hostPath:
+          path: "/mnt/nfs/media/music-video"
+          type: "Directory"
+    - name: short-videos
+      readOnly: false
+      volumeSpec:
+        storageClassName: local-path
+        volumeMode: Filesystem
+        capacity:
+          storage: 32Gi
+        accessModes:
+          - ReadWriteOnce
+        persistentVolumeReclaimPolicy: Retain
+        nodeAffinity:
+          required:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: kubernetes.io/os
+                    operator: In
+                    values:
+                      - linux
+        claimRef:
+          apiVersion: v1
+          kind: PersistentVolumeClaim
+          name: jellyfin-mediavol-short-videos
+          namespace: jellyfin
+        hostPath:
+          path: "/mnt/nfs/media/short-video"
+          type: "Directory"
+    - name: gv
+      readOnly: false
+      volumeSpec:
+        storageClassName: local-path
+        volumeMode: Filesystem
+        capacity:
+          storage: 64Gi
+        accessModes:
+          - ReadWriteOnce
+        persistentVolumeReclaimPolicy: Retain
+        nodeAffinity:
+          required:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: kubernetes.io/os
+                    operator: In
+                    values:
+                      - linux
+        claimRef:
+          apiVersion: v1
+          kind: PersistentVolumeClaim
+          name: jellyfin-mediavol-gv
+          namespace: jellyfin
+        hostPath:
+          path: "/mnt/nfs/media/gv"
+          type: "Directory"
+  persistentTranscodes: true

apps/jellyfin/env/k3s-cluster/config.json

@@ -0,0 +1,12 @@
+{
+  "appName": "jellyfin",
+  "userGivenName": "jellyfin",
+  "namespace": "jellyfin",
+  "destNamespace": "jellyfin",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "apps/jellyfin/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

apps/jellyfin/env/k3s-cluster/ingress.yaml

@@ -0,0 +1,31 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: jellyfin-ingress
+  namespace: jellyfin
+  annotations:
+    nginx.ingress.kubernetes.io/ssl-redirect: "false"
+    nginx.ingress.kubernetes.io/use-regex: "true"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: "jellyfin.cluster.local"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: jellyfin
+                port:
+                  number: 8096
+    - host: "jellyfin.cluster.edward.sydney"
+      http:
+        paths:
+          - pathType: Prefix
+            path: "/"
+            backend:
+              service:
+                name: jellyfin
+                port:
+                  number: 8096

apps/jellyfin/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../base
+  - ./ingress.yaml

apps/kavita/base/deployment.yaml

@@ -20,7 +20,7 @@ spec:
         app.kubernetes.io/instance: kavita
     spec:
       containers:
-        - image: jvmilazz0/kavita:0.8.1
+        - image: jvmilazz0/kavita:0.8.2
           imagePullPolicy: IfNotPresent
           name: kavita
           ports:

apps/plane/base/configmap.yaml

@@ -0,0 +1,28 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  namespace: plane
+  name: plane-app-vars
+data:
+  SENTRY_DSN: ""
+  SENTRY_ENVIRONMENT: ""
+  DEBUG: "0"
+  DOCKERIZED: "1"
+  GUNICORN_WORKERS: "1"
+  WEB_URL: "http://plane.cluster.edward.sydney"
+  CORS_ALLOWED_ORIGINS: "http://plane.cluster.edward.sydney,https://plane.cluster.edward.sydney"
+  REDIS_URL: "redis://plane-redis.plane.svc.cluster.local:6379/"
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  namespace: plane
+  name: plane-doc-store-vars
+data:
+  FILE_SIZE_LIMIT: "5242880"
+  AWS_S3_BUCKET_NAME: "plane"
+  MINIO_ROOT_USER: "admin"
+  AWS_S3_ENDPOINT_URL: "http://minio.minio.svc.cluster.local:19000"
+  USE_MINIO: "1"
+---

apps/plane/base/deployment.yaml

@@ -0,0 +1,274 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  namespace: plane
+  name: plane-admin-wl
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.name: plane-admin
+  template:
+    metadata:
+      namespace: plane
+      labels:
+        app.name: plane-admin
+    spec:
+      containers:
+        - name: plane-admin
+          imagePullPolicy: Always
+          image: makeplane/plane-admin:stable
+          stdin: true
+          tty: true
+          resources:
+            requests:
+              memory: "50Mi"
+              cpu: "50m"
+            limits:
+              memory: "1000Mi"
+              cpu: "500m"
+          command:
+            - node
+          args:
+            - admin/server.js
+            - admin
+      serviceAccount: plane-srv-account
+      serviceAccountName: plane-srv-account
+      nodeSelector:
+        kubernetes.io/arch: arm64
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  namespace: plane
+  name: plane-api-wl
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.name: plane-api
+  template:
+    metadata:
+      namespace: plane
+      labels:
+        app.name: plane-api
+    spec:
+      containers:
+        - name: plane-api
+          imagePullPolicy: Always
+          image: makeplane/plane-backend:stable
+          stdin: true
+          tty: true
+          resources:
+            requests:
+              memory: "50Mi"
+              cpu: "50m"
+            limits:
+              memory: "1000Mi"
+              cpu: "500m"
+          command:
+            - ./bin/docker-entrypoint-api.sh
+          envFrom:
+            - configMapRef:
+                name: plane-app-vars
+                optional: false
+            - secretRef:
+                name: plane-app-secrets
+                optional: false
+            - configMapRef:
+                name: plane-doc-store-vars
+                optional: false
+            - secretRef:
+                name: plane-doc-store-secrets
+                optional: false
+          readinessProbe:
+            failureThreshold: 30
+            httpGet:
+              path: /
+              port: 8000
+              scheme: HTTP
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 1
+      serviceAccount: plane-srv-account
+      serviceAccountName: plane-srv-account
+      nodeSelector:
+        kubernetes.io/arch: arm64
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  namespace: plane
+  name: plane-beat-worker-wl
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.name: plane-beat-worker
+  template:
+    metadata:
+      namespace: plane
+      labels:
+        app.name: plane-beat-worker
+    spec:
+      containers:
+        - name: plane-beat-worker
+          imagePullPolicy: Always
+          image: makeplane/plane-backend:stable
+          stdin: true
+          tty: true
+          resources:
+            requests:
+              memory: "50Mi"
+              cpu: "50m"
+            limits:
+              memory: "1000Mi"
+              cpu: "500m"
+          command:
+            - ./bin/docker-entrypoint-beat.sh
+          envFrom:
+            - configMapRef:
+                name: plane-app-vars
+                optional: false
+            - secretRef:
+                name: plane-app-secrets
+                optional: false
+            - configMapRef:
+                name: plane-doc-store-vars
+                optional: false
+            - secretRef:
+                name: plane-doc-store-secrets
+                optional: false
+      serviceAccount: plane-srv-account
+      serviceAccountName: plane-srv-account
+      nodeSelector:
+        kubernetes.io/arch: arm64
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  namespace: plane
+  name: plane-space-wl
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.name: plane-space
+  template:
+    metadata:
+      namespace: plane
+      labels:
+        app.name: plane-space
+    spec:
+      containers:
+        - name: plane-space
+          imagePullPolicy: Always
+          image: makeplane/plane-space:stable
+          stdin: true
+          tty: true
+          resources:
+            requests:
+              memory: "50Mi"
+              cpu: "50m"
+            limits:
+              memory: "1000Mi"
+              cpu: "500m"
+          command:
+            - node
+          args:
+            - space/server.js
+            - space
+      serviceAccount: plane-srv-account
+      serviceAccountName: plane-srv-account
+      nodeSelector:
+        kubernetes.io/arch: arm64
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  namespace: plane
+  name: plane-web-wl
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.name: plane-web
+  template:
+    metadata:
+      namespace: plane
+      labels:
+        app.name: plane-web
+    spec:
+      containers:
+        - name: plane-web
+          imagePullPolicy: Always
+          image: makeplane/plane-frontend:stable
+          stdin: true
+          tty: true
+          resources:
+            requests:
+              memory: "50Mi"
+              cpu: "50m"
+            limits:
+              memory: "1000Mi"
+              cpu: "500m"
+          command:
+            - node
+          args:
+            - web/server.js
+            - web
+      serviceAccount: plane-srv-account
+      serviceAccountName: plane-srv-account
+      nodeSelector:
+        kubernetes.io/arch: arm64
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  namespace: plane
+  name: plane-worker-wl
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.name: plane-worker
+  template:
+    metadata:
+      namespace: plane
+      labels:
+        app.name: plane-worker
+    spec:
+      containers:
+        - name: plane-worker
+          imagePullPolicy: Always
+          image: makeplane/plane-backend:stable
+          stdin: true
+          tty: true
+          resources:
+            requests:
+              memory: "50Mi"
+              cpu: "50m"
+            limits:
+              memory: "1000Mi"
+              cpu: "500m"
+          command:
+            - ./bin/docker-entrypoint-worker.sh
+          envFrom:
+            - configMapRef:
+                name: plane-app-vars
+                optional: false
+            - secretRef:
+                name: plane-app-secrets
+                optional: false
+            - configMapRef:
+                name: plane-doc-store-vars
+                optional: false
+            - secretRef:
+                name: plane-doc-store-secrets
+                optional: false
+      serviceAccount: plane-srv-account
+      serviceAccountName: plane-srv-account
+      nodeSelector:
+        kubernetes.io/arch: arm64
+---

apps/plane/base/ingress.yaml

@@ -0,0 +1,46 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  namespace: plane
+  name: plane-ingress
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: plane.cluster.edward.sydney
+      http:
+        paths:
+          - backend:
+              service:
+                port:
+                  number: 3000
+                name: plane-web
+            path: /
+            pathType: Prefix
+          - backend:
+              service:
+                port:
+                  number: 8000
+                name: plane-api
+            path: /api
+            pathType: Prefix
+          - backend:
+              service:
+                port:
+                  number: 8000
+                name: plane-api
+            path: /auth
+            pathType: Prefix
+          - backend:
+              service:
+                port:
+                  number: 3000
+                name: plane-space
+            path: /spaces
+            pathType: Prefix
+          - backend:
+              service:
+                port:
+                  number: 3000
+                name: plane-admin
+            path: /god-mode
+            pathType: Prefix

apps/plane/base/job.yaml

@@ -0,0 +1,35 @@
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  namespace: plane
+  name: plane-api-migrate
+spec:
+  backoffLimit: 3
+  template:
+    metadata:
+      labels:
+        app.name: plane-api-migrate
+    spec:
+      containers:
+        - name: plane-api-migrate
+          image: makeplane/plane-backend:stable
+          command:
+            - ./bin/docker-entrypoint-migrator.sh
+          imagePullPolicy: Always
+          envFrom:
+            - configMapRef:
+                name: plane-app-vars
+                optional: false
+            - secretRef:
+                name: plane-app-secrets
+                optional: false
+            - configMapRef:
+                name: plane-doc-store-vars
+                optional: false
+            - secretRef:
+                name: plane-doc-store-secrets
+                optional: false
+      restartPolicy: OnFailure
+      serviceAccount: plane-srv-account
+      serviceAccountName: plane-srv-account

apps/plane/base/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ./configmap.yaml
+  - ./service-account.yaml
+  - ./job.yaml
+  - ./deployment.yaml
+  - ./stateful-set.yaml
+  - ./service.yaml
+  - ./ingress.yaml

apps/plane/base/service-account.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+automountServiceAccountToken: true
+kind: ServiceAccount
+metadata:
+  namespace: plane
+  name: plane-srv-account

apps/plane/base/service.yaml

@@ -0,0 +1,80 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  namespace: plane
+  name: plane-admin
+  labels:
+    app.name: plane-admin
+spec:
+  ports:
+    - name: admin-3000
+      port: 3000
+      protocol: TCP
+      targetPort: 3000
+  selector:
+    app.name: plane-admin
+---
+apiVersion: v1
+kind: Service
+metadata:
+  namespace: plane
+  name: plane-api
+  labels:
+    app.name: plane-api
+spec:
+  ports:
+    - name: api-8000
+      port: 8000
+      protocol: TCP
+      targetPort: 8000
+  selector:
+    app.name: plane-api
+---
+apiVersion: v1
+kind: Service
+metadata:
+  namespace: plane
+  name: plane-space
+  labels:
+    app.name: plane-space
+spec:
+  ports:
+    - name: space-3000
+      port: 3000
+      protocol: TCP
+      targetPort: 3000
+  selector:
+    app.name: plane-space
+---
+apiVersion: v1
+kind: Service
+metadata:
+  namespace: plane
+  name: plane-web
+  labels:
+    app.name: plane-web
+spec:
+  ports:
+    - name: web-3000
+      port: 3000
+      protocol: TCP
+      targetPort: 3000
+  selector:
+    app.name: plane-web
+---
+apiVersion: v1
+kind: Service
+metadata:
+  namespace: plane
+  name: plane-redis
+  labels:
+    app.name: plane-redis
+spec:
+  ports:
+    - name: redis-6379
+      port: 6379
+      protocol: TCP
+      targetPort: 6379
+  selector:
+    app.name: plane-redis

apps/plane/base/stateful-set.yaml

@@ -0,0 +1,32 @@
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  namespace: plane
+  name: plane-redis-wl
+spec:
+  selector:
+    matchLabels:
+      app.name: plane-redis
+  serviceName:  plane-redis
+  template:
+    metadata:
+      labels:
+        app.name: plane-redis
+    spec:
+      containers:
+        - image: valkey/valkey:7.2.6-alpine
+          imagePullPolicy: Always
+          name: plane-redis
+          stdin: true
+          tty: true
+          volumeMounts:
+            - mountPath: /data
+              name: plane-redis-data
+      volumes:
+        - name: plane-redis-data
+          persistentVolumeClaim:
+            claimName: plane-redis-pvc
+      serviceAccount: plane-srv-account
+      serviceAccountName: plane-srv-account
+---

apps/plane/env/k3s-cluster/config.json

@@ -0,0 +1,12 @@
+{
+  "appName": "plane",
+  "userGivenName": "plane",
+  "namespace": "plane",
+  "destNamespace": "plane",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "apps/plane/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

apps/plane/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../base

apps/plex/base/values.yaml

@@ -13,24 +13,36 @@ extraVolumeMounts:
     mountPath: /tv
   - name: plex-movie
     mountPath: /movie
+  - name: plex-short-video
+    mountPath: /short-video
   - name: plex-music
     mountPath: /music
+  - name: plex-music-video
+    mountPath: /music-video
   - name: plex-gv
     mountPath: /gv
 extraVolumes:
   - name: plex-tv
     hostPath:
-      path: /mnt/nfs/AppData/plex/tv
+      path: /mnt/nfs/media/tv
       type: Directory
   - name: plex-movie
     hostPath:
-      path: /mnt/nfs/AppData/plex/movie
+      path: /mnt/nfs/media/movie
+      type: Directory
+  - name: plex-short-video
+    hostPath:
+      path: /mnt/nfs/media/short-video
       type: Directory
   - name: plex-music
     hostPath:
-      path: /mnt/nfs/AppData/plex/music
+      path: /mnt/nfs/media/music
+      type: Directory
+  - name: plex-music-video
+    hostPath:
+      path: /mnt/nfs/media/music-video
       type: Directory
   - name: plex-gv
     hostPath:
-      path: /mnt/nfs/AppData/plex/gv
+      path: /mnt/nfs/media/gv
       type: Directory

apps/qbittorrent/base/deployment.yaml

@@ -0,0 +1,56 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: qbittorrent
+  namespace: qbittorrent
+  labels:
+    app.kubernetes.io/name: qbittorrent
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: qbittorrent
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: qbittorrent
+    spec:
+      containers:
+        - name: qbittorrent
+          image: lscr.io/linuxserver/qbittorrent:latest
+          securityContext:
+            allowPrivilegeEscalation: false
+          env:
+            - name: PUID
+              value: "1000"
+            - name: PGID
+              value: "1000"
+            - name: TZ
+              value: Australia/Sydney
+            - name: WEBUI_PORT
+              value: "8080"
+            - name: TORRENTING_PORT
+              value: "6881"
+          ports:
+            - protocol: TCP
+              containerPort: 8080
+              name: qb-ui
+            - protocol: TCP
+              containerPort: 6881
+              name: torrenting
+            - protocol: UDP
+              containerPort: 6881
+              name: torrenting-udp
+          volumeMounts:
+            - name: qbittorrent-config
+              mountPath: /config
+            - name: qbittorrent-downloads
+              mountPath: /downloads
+      volumes:
+        - name: qbittorrent-config
+          hostPath:
+            path: /mnt/nfs/AppData/qbittorrent/config
+            type: Directory
+        - name: qbittorrent-downloads
+          hostPath:
+            path: /mnt/nfs/AppData/qbittorrent/downloads
+            type: Directory

apps/qbittorrent/base/service.yaml

@@ -0,0 +1,25 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: qbittorrent
+  namespace: qbittorrent
+  labels:
+    app.kubernetes.io/name: qbittorrent
+spec:
+  selector:
+    app.kubernetes.io/name: qbittorrent
+  type: LoadBalancer
+  internalTrafficPolicy: Cluster
+  ports:
+    - protocol: TCP
+      port: 18880
+      targetPort: 8080
+      name: qb-ui
+    - protocol: TCP
+      port: 6881
+      targetPort: 6881
+      name: torrenting
+    - protocol: UDP
+      port: 6881
+      targetPort: 6881
+      name: torrenting-udp

apps/qbittorrent/env/k3s-cluster/config.json

@@ -0,0 +1,12 @@
+{
+  "appName": "qbittorrent",
+  "userGivenName": "qbittorrent",
+  "namespace": "qbittorrent",
+  "destNamespace": "qbittorrent",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "apps/qbittorrent/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

apps/qbittorrent/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../base

apps/rlpa-server/base/deployment.yaml

@@ -19,7 +19,7 @@ spec:
         runAsGroup: 1000
       containers:
         - name: rlpa-server
-          image: damonto/estkme-cloud:1.0.11
+          image: damonto/estkme-cloud:v1.0.13
           securityContext:
             allowPrivilegeEscalation: false
           ports:

apps/sonarqube/env/k3s-cluster/config.json

@@ -0,0 +1,12 @@
+{
+  "appName": "sonarqube",
+  "userGivenName": "sonarqube",
+  "namespace": "sonarqube",
+  "destNamespace": "sonarqube",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "apps/sonarqube/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

apps/sonarqube/env/k3s-cluster/kustomization.yaml

@@ -3,6 +3,6 @@ kind: Kustomization
 helmCharts:
   - name: sonarqube
     repo: oci://registry-1.docker.io/bitnamicharts
-    version: 5.2.10
+    version: 5.2.12
     releaseName: sonarqube
     valuesFile: values.yaml

apps/sonarqube/env/k3s-cluster/values.yaml

@@ -1,4 +1,5 @@
 priorityClassName: system-cluster-critical
+podAntiAffinityPreset: ""
 namespaceOverride: "sonarqube"
 clusterDomain: sonarqube.cluster.edward.sydney
 sonarqubeUsername: sonarqube
@@ -19,7 +20,7 @@ service:
     http: 8090
     elastic: 9091
   nodePorts:
-    http: 30080
+    http: 30089
     elastic: 30091
 ingress:
   enabled: true
@@ -38,3 +39,5 @@ externalDatabase:
   host: "postgresql-primary.argocd.svc.cluster.local"
   user: "sonarqube_user"
   existingSecret: "sonarqube-secrets"
+nodeSelector:
+  kubernetes.io/hostname: k3s-cluster-node-3

apps/stirling-pdf/base/deployment.yaml

@@ -0,0 +1,55 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: stirling-pdf
+  namespace: stirling-pdf
+  labels:
+    app.kubernetes.io/name: stirling-pdf
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: stirling-pdf
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: stirling-pdf
+    spec:
+      containers:
+        - name: stirling-pdf
+          image: frooodle/s-pdf:0.27.0
+          securityContext:
+            allowPrivilegeEscalation: false
+          env:
+            - name: DOCKER_ENABLE_SECURITY
+              value: "true"
+          ports:
+            - protocol: TCP
+              containerPort: 8080
+              name: http
+          volumeMounts:
+            - name: s-pdf-tessdata
+              mountPath: /usr/share/tesseract-ocr/5/tessdata
+            - name: s-pdf-configs
+              mountPath: /configs
+            - name: s-pdf-custom-files
+              mountPath: /customFiles
+            - name: s-pdf-logs
+              mountPath: /logs
+      volumes:
+        - name: s-pdf-tessdata
+          hostPath:
+            path: /mnt/nfs/AppData/stirling-pdf/tessdata
+            type: Directory
+        - name: s-pdf-configs
+          hostPath:
+            path: /mnt/nfs/AppData/stirling-pdf/configs
+            type: Directory
+        - name: s-pdf-custom-files
+          hostPath:
+            path: /mnt/nfs/AppData/stirling-pdf/customFiles
+            type: Directory
+        - name: s-pdf-logs
+          hostPath:
+            path: /mnt/nfs/AppData/stirling-pdf/logs
+            type: Directory
+

apps/stirling-pdf/base/kustomization.yaml

@@ -1,6 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ./service.yaml
   - ./deployment.yaml
-  - ./ingress.yaml
+  - ./service.yaml

apps/stirling-pdf/base/service.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: stirling-pdf
+  namespace: stirling-pdf
+  labels:
+    app.kubernetes.io/name: stirling-pdf
+spec:
+  selector:
+    app.kubernetes.io/name: stirling-pdf
+  type: ClusterIP
+  internalTrafficPolicy: Cluster
+  ports:
+    - protocol: TCP
+      port: 8080
+      targetPort: 8080
+      name: http

apps/stirling-pdf/env/k3s-cluster/config.json

@@ -0,0 +1,12 @@
+{
+  "appName": "stirling-pdf",
+  "userGivenName": "stirling-pdf",
+  "namespace": "stirling-pdf",
+  "destNamespace": "stirling-pdf",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "apps/stirling-pdf/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

apps/stirling-pdf/env/k3s-cluster/ingress.yaml

@@ -1,21 +1,21 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: couchdb-ingress
-  namespace: couchdb
+  name: stirling-pdf-ingress
+  namespace: stirling-pdf
   annotations:
     nginx.ingress.kubernetes.io/ssl-redirect: "false"
     nginx.ingress.kubernetes.io/use-regex: "true"
 spec:
   ingressClassName: nginx
   rules:
-    - host: "couchdb.cluster.edward.sydney"
+    - host: "s-pdf.cluster.edward.sydney"
       http:
         paths:
           - pathType: Prefix
             path: "/"
             backend:
               service:
-                name: couchdb
+                name: stirling-pdf
                 port:
-                  number: 7777
+                  number: 8080

apps/stirling-pdf/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../base
+  - ./ingress.yaml

apps/vaultwarden/base/deployment.yaml

@@ -23,7 +23,7 @@ spec:
             runAsNonRoot: true
             runAsGroup: 1000
           name: vaultwarden
-          image: vaultwarden/server:1.31.0
+          image: vaultwarden/server:1.32.0
           env:
             - name: DOMAIN
               value: https://vaultwarden.cluster.edward.sydney

infrastructures/cert-manager-clusterissuer/base/clusterissuer-cloudflare.yaml

@@ -0,0 +1,23 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: clusterissuer
+  namespace: cert-manager
+spec:
+  acme:
+    email: "edward@cheng.sydney"
+    server: https://acme-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: cluster-issuer-account-key
+    solvers:
+      - dns01:
+          cloudflare:
+            email: "edward@cheng.sydney"
+            apiTokenSecretRef:
+              name: clusterissuer-secrets
+              namespace: cert-manager
+              key: cloudflare_api_token
+        selector:
+          dnsNames:
+            - "cluster.edward.sydney"
+            - "*.cluster.edward.sydney"

infrastructures/cert-manager-clusterissuer/base/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - clusterissuer-cloudflare.yaml

infrastructures/cert-manager-clusterissuer/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../base

infrastructures/cert-manager/base/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+helmCharts:
+  - name: cert-manager
+    repo: https://charts.jetstack.io
+    version: v1.15.2
+    releaseName: cert-manager
+    valuesFile: values.yaml

infrastructures/cert-manager/base/values.yaml

@@ -0,0 +1,4 @@
+global:
+  priorityClassName: system-cluster-critical
+namespace: cert-manager
+installCRDs: true

infrastructures/cert-manager/env/k3s-cluster/config.json

@@ -0,0 +1,12 @@
+{
+  "appName": "cert-manager",
+  "userGivenName": "cert-manager",
+  "namespace": "cert-manager",
+  "destNamespace": "cert-manager",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "infrastructures/cert-manager/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

infrastructures/cert-manager/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../base

infrastructures/couchdb/env/k3s-cluster/deployment.yaml

@@ -1,55 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: couchdb
-  namespace: couchdb
-  labels:
-    app.kubernetes.io/name: couchdb
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: couchdb
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: couchdb
-    spec:
-      securityContext:
-        runAsUser: 1000
-        runAsGroup: 1000
-      containers:
-        - name: couchdb
-          image: bitnami/couchdb:3.3.3
-          securityContext:
-            allowPrivilegeEscalation: false
-          env:
-            - name: COUCHDB_PORT_NUMBER
-              value: "7777"
-            - name: COUCHDB_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: couchdb-secrets
-                  key: password
-            - name: COUCHDB_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: couchdb-secrets
-                  key: secrets
-          ports:
-            - protocol: TCP
-              containerPort: 7777
-              name: couchdb-port
-          volumeMounts:
-            - name: couchdb-data
-              mountPath: /bitnami/couchdb
-            - name: couchdb-config
-              mountPath: /opt/bitnami/couchdb/etc/
-      volumes:
-        - name: couchdb-data
-          hostPath:
-            path: /mnt/nfs/AppData/couchdb
-            type: Directory
-        - name: couchdb-config
-          hostPath:
-            path: /mnt/nfs/AppData/couchdb/etc
-            type: Directory

infrastructures/couchdb/env/k3s-cluster/service.yaml

@@ -1,17 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: couchdb
-  namespace: couchdb
-  labels:
-    app.kubernetes.io/name: couchdb
-spec:
-  selector:
-    app.kubernetes.io/name: couchdb
-  type: ClusterIP
-  internalTrafficPolicy: Cluster
-  ports:
-    - protocol: TCP
-      port: 7777
-      targetPort: 7777
-      name: couchdb-port

infrastructures/gpu-device-plugin/base/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+helmCharts:
+  - name: intel-device-plugins-gpu
+    repo: https://intel.github.io/helm-charts/
+    version: 0.30.0
+    releaseName: intel-device-plugins-gpu
+    valuesFile: values.yaml

infrastructures/gpu-device-plugin/base/values.yaml

@@ -0,0 +1,14 @@
+name: gpu-device-plugin
+
+image:
+  hub: intel
+
+sharedDevNum: 10
+logLevel: 2
+resourceManager: true
+enableMonitoring: false
+
+nodeSelector:
+  kubernetes.io/arch: amd64
+
+nodeFeatureRule: true

infrastructures/gpu-device-plugin/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../base

infrastructures/ingress-nginx/base/kustomization.yaml

@@ -3,6 +3,6 @@ kind: Kustomization
 helmCharts:
   - name: ingress-nginx
     repo: https://kubernetes.github.io/ingress-nginx
-    version: 4.10.1
+    version: 4.11.1
     releaseName: ingress-nginx
     valuesFile: values.yaml

infrastructures/ingress-nginx/env/k3s-cluster/kustomization.yaml

@@ -3,6 +3,6 @@ kind: Kustomization
 helmCharts:
   - name: ingress-nginx
     repo: https://kubernetes.github.io/ingress-nginx
-    version: 4.10.1
+    version: 4.11.1
     releaseName: ingress-nginx
     valuesFile: values.yaml

infrastructures/ingress-nginx/env/k3s-cluster/values.yaml

@@ -64,7 +64,7 @@ defaultBackend:
   enabled: true
   image:
     repository: ghcr.io/tarampampam/error-pages
-    tag: 2.27.0@sha256:40e2631173b1a407c18fe7d1ba8104d995cf9e4780d123eeadfa1d57c68eaf4f
+    tag: 3.3.0@sha256:43c9917e99ac1bb4df3c4e037327637e502e2ab4c3d84803b223d5b7db6d4cd7
     pullPolicy: IfNotPresent
   extraEnvs:
     - name: TEMPLATE_NAME

infrastructures/logstash/base/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+helmCharts:
+  - name: logstash
+    repo: oci://registry-1.docker.io/bitnamicharts
+    version: 6.3.2
+    releaseName: logstash
+    valuesFile: values.yaml

infrastructures/logstash/base/values.yaml

@@ -0,0 +1,61 @@
+namespaceOverride: logstash
+clusterDomain: logstash.logstash.svc.cluster.local
+input: ""
+output: ""
+existingConfiguration: ""
+enableMultiplePipelines: true
+extraVolumes:
+  - name: configurations
+    hostPath:
+      path: /mnt/nfs/AppData/logstash/config
+      type: Directory
+  - name: pipelines
+    hostPath:
+      path: /mnt/nfs/AppData/logstash/pipeline
+      type: Directory
+extraVolumeMounts:
+  - name: configurations
+    mountPath: /bitnami/logstash/config
+  - name: pipelines
+    mountPath: /bitnami/logstash/pipeline
+containerPorts:
+  - name: http
+    containerPort: 8080
+    protocol: TCP
+  - name: monitoring
+    containerPort: 9600
+    protocol: TCP
+  - name: syslog-udp
+    containerPort: 1514
+    protocol: UDP
+  - name: syslog-tcp
+    containerPort: 1514
+    protocol: TCP
+podSecurityContext:
+  fsGroup: 1000
+containerSecurityContext:
+  runAsUser: 1000
+  runAsGroup: 1000
+service:
+  type: LoadBalancer
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http
+      protocol: TCP
+    - name: monitoring
+      port: 9600
+      targetPort: monitoring
+      protocol: TCP
+    - name: syslog-udp
+      port: 1514
+      targetPort: syslog-udp
+      protocol: UDP
+    - name: syslog-tcp
+      port: 1514
+      targetPort: syslog-tcp
+      protocol: TCP
+persistence:
+  enabled: true
+  existingClaim: logstash-data-pvc
+  size: 16Gi

infrastructures/logstash/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../base

infrastructures/minio/env/k3s-cluster/kustomization.yaml

@@ -3,6 +3,6 @@ kind: Kustomization
 helmCharts:
   - name: minio
     repo: oci://registry-1.docker.io/bitnamicharts
-    version: 14.6.24
+    version: 14.6.33
     releaseName: minio
     valuesFile: values.yaml

infrastructures/mongodb/env/k3s-cluster/kustomization.yaml

@@ -3,6 +3,6 @@ kind: Kustomization
 helmCharts:
   - name: mongodb
     repo: oci://registry-1.docker.io/bitnamicharts
-    version: 15.6.14
+    version: 15.6.18
     releaseName: mongodb
     valuesFile: values.yaml

infrastructures/netdata/base/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+helmCharts:
+  - name: netdata
+    repo: https://netdata.github.io/helmchart/
+    version: 3.7.97
+    releaseName: netdata
+    valuesFile: values.yaml

infrastructures/netdata/base/values.yaml

@@ -0,0 +1,17 @@
+image:
+  tag: stable
+
+restarter:
+  enabled: true
+
+parent:
+  claiming:
+    enabled: true
+    token: HOJS7JMbEzKuDjbkJJv_Qp5369dyBGc0-qQ2DpKfWT22tiNWRZVH63bALjOv6A4bevsAJixzY1rIKO-1RvIr-NKGiYGpgfrMt1I5loXpU4CY7BgJp22jpK72kvRLwdM2rhNLcSQ
+    rooms: 20334923-196a-477e-9a12-cfd5d02b24ec
+
+child:
+  claiming:
+    enabled: true
+    token: HOJS7JMbEzKuDjbkJJv_Qp5369dyBGc0-qQ2DpKfWT22tiNWRZVH63bALjOv6A4bevsAJixzY1rIKO-1RvIr-NKGiYGpgfrMt1I5loXpU4CY7BgJp22jpK72kvRLwdM2rhNLcSQ
+    rooms: 20334923-196a-477e-9a12-cfd5d02b24ec

infrastructures/netdata/env/k3s-cluster/config.json

@@ -0,0 +1,12 @@
+{
+  "appName": "netdata",
+  "userGivenName": "netdata",
+  "namespace": "argocd",
+  "destNamespace": "argocd",
+  "destServer": "https://kubernetes.default.svc",
+  "srcPath": "infrastructures/netdata/env/k3s-cluster",
+  "srcRepoURL": "https://github.com/3dwardch3ng/home-cluster-ops.git",
+  "srcTargetRevision": "",
+  "labels": null,
+  "annotations": null
+}

infrastructures/netdata/env/k3s-cluster/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../base

infrastructures/postgresql/env/k3s-cluster/kustomization.yaml

@@ -3,6 +3,6 @@ kind: Kustomization
 helmCharts:
   - name: postgresql
     repo: oci://registry-1.docker.io/bitnamicharts
-    version: 15.5.17
+    version: 15.5.21
     releaseName: postgresql
     valuesFile: values.yaml

infrastructures/prometheus-exporters/env/k3s-cluster/node-exporter.yaml

@@ -6,7 +6,7 @@ metadata:
   labels:
     app: prometheus-node-exporter
 spec:
-  replicas: 4
+  replicas: 5
   selector:
     matchLabels:
       app: prometheus-node-exporter
@@ -14,10 +14,15 @@ spec:
     metadata:
       labels:
         app: prometheus-node-exporter
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/path: '/metrics'
+        prometheus.io/port: "9100"
     spec:
       hostNetwork: true
       hostPID: true
       hostIPC: true
+      enableServiceLinks: false
       topologySpreadConstraints:
         - maxSkew: 1
           topologyKey: kubernetes.io/hostname
@@ -29,16 +34,27 @@ spec:
         - name: prometheus-node-exporter
           image: prom/node-exporter
           args:
-            - "--path.rootfs=/host"
+            - "--path.rootfs=/root"
+            - "--path.sysfs=/host/sys"
+            - --collector.filesystem.ignored-mount-points=^/(dev|proc|sys|var/lib/docker/.+|var/lib/kubelet/pods/.+)($|/)
+            - --collector.netclass.ignored-devices=^(veth.*)$
+          ports:
+            - containerPort: 9100
+              protocol: TCP
           volumeMounts:
-            - name: node-volume
-              mountPath: /host
+            - name: sys
+              mountPath: /host/sys
+              mountPropagation: HostToContainer
+            - name: root
+              mountPath: /root
               readOnly: true
               mountPropagation: HostToContainer
           securityContext:
             privileged: true
       volumes:
-        - name: node-volume
+        - name: sys
           hostPath:
-            path: /
-            type: Directory
+            path: /sys
+        - name: root
+          hostPath:
+            path: /

infrastructures/prometheus/env/k3s-cluster/cluster-role-binding.yaml

@@ -8,5 +8,5 @@ roleRef:
   name: prometheus
 subjects:
   - kind: ServiceAccount
-    name: prometheus
+    name: default
     namespace: prometheus

infrastructures/prometheus/env/k3s-cluster/deployment.yaml

@@ -22,7 +22,7 @@ spec:
         runAsGroup: 0
       containers:
         - name: prometheus
-          image: prom/prometheus:v2.53.0
+          image: prom/prometheus:v2.54.0
           args:
             - "--storage.tsdb.retention.time=14d"
             - "--config.file=/etc/prometheus/prometheus.yaml"
@@ -42,7 +42,7 @@ spec:
             - name: prometheus-storage-volume
               mountPath: /prometheus/
         - name: grafana
-          image: grafana/grafana:11.0.1
+          image: grafana/grafana:11.1.3
           ports:
             - containerPort: 3000
           volumeMounts:

infrastructures/redis-insight/base/deployment.yaml

@@ -19,7 +19,7 @@ spec:
         runAsGroup: 1000
       containers:
         - name: redis-insight
-          image: redis/redisinsight:2.52
+          image: redis/redisinsight:2.54
           securityContext:
             allowPrivilegeEscalation: false
           ports:

infrastructures/redis/env/k3s-cluster/kustomization.yaml

@@ -3,6 +3,6 @@ kind: Kustomization
 helmCharts:
   - name: redis
     repo: oci://registry-1.docker.io/bitnamicharts
-    version: 19.6.2
+    version: 20.0.1
     releaseName: redis
     valuesFile: values.yaml

infrastructures/renovate/base/configmap.yaml

@@ -1,13 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: renovate-config-js
-  namespace: renovate
-  labels:
-    app.kubernetes.io/name: renovate
-data:
-  config.js: |
-    module.exports = {
-        // Enter self-hosted configuration options here.
-        // https://docs.renovatebot.com/self-hosted-configuration/
-    }

infrastructures/renovate/base/deployment.yaml

@@ -1,134 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: renovate
-  namespace: renovate
-  labels:
-    app.kubernetes.io/name: renovate
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: renovate
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: renovate
-    spec:
-      securityContext:
-        runAsUser: 1000
-        runAsGroup: 1000
-      containers:
-        - name: renovate
-          image: ghcr.io/mend/renovate-ce:7.5.0-full
-          securityContext:
-            allowPrivilegeEscalation: false
-          env:
-            - name: MEND_RNV_ACCEPT_TOS
-              value: y
-            - name: MEND_RNV_LICENSE_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: renovate-secrets
-                  key: renovate_license_key
-            - name: MEND_RNV_PLATFORM
-              value: github
-            - name: MEND_RNV_ENDPOINT
-              value: "https://api.github.com/"
-            - name: MEND_RNV_DATA_HANDLER_TYPE
-              value: "postgresql"
-            - name: PGDATABASE
-              valueFrom:
-                secretKeyRef:
-                  name: renovate-secrets
-                  key: db_pg_database
-            - name: PGUSER
-              valueFrom:
-                secretKeyRef:
-                  name: renovate-secrets
-                  key: db_pg_user
-            - name: PGPORT
-              value: "5432"
-            - name: PGHOST
-              valueFrom:
-                secretKeyRef:
-                  name: renovate-secrets
-                  key: db_pg_host
-            - name: PGPASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: renovate-secrets
-                  key: db_pg_password
-            - name: MEND_RNV_GITHUB_APP_ID
-              value: "938218"
-            - name: RNV_GITHUB_PEM_FILE_PATH
-              value: "/usr/src/app/rpi5-cluster-renovate.2024-07-05.private-key.pem"
-            - name: MEND_RNV_WEBHOOK_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: renovate-secrets
-                  key: github_app_webhook_secret
-            - name: MEND_RNV_ADMIN_API_ENABLED
-              value: "true"
-            - name: MEND_RNV_SERVER_API_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: renovate-secrets
-                  key: server_api_secret
-            - name: GITHUB_COM_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: renovate-secrets
-                  key: github_pat
-            - name: MEND_RNV_AUTODISCOVER_FILTER
-              value: "resources/*,infrastructures/*,apps/*"
-            - name: MEND_RNV_ENQUEUE_JOBS_ON_STARTUP
-              value: "enabled"
-            - name: MEND_RNV_LOG_HISTORY_DIR
-              value: "/logs"
-          ports:
-            - name: http
-              containerPort: 8080
-              protocol: TCP
-          livenessProbe:
-            initialDelaySeconds: 2
-            httpGet:
-              path: /health
-              port: http
-            periodSeconds: 10
-            timeoutSeconds: 1
-            failureThreshold: 3
-            successThreshold: 1
-          readinessProbe:
-            httpGet:
-              path: /health
-              port: http
-            periodSeconds: 10
-            timeoutSeconds: 1
-            failureThreshold: 3
-            successThreshold: 1
-          volumeMounts:
-            - name: renovate-config-js-volume
-              mountPath: /usr/src/app/config.js
-              subPath: config.js
-            - name: renovate-cache-volume
-              mountPath: /tmp/renovate
-            - name: renovate-logs
-              mountPath: /logs
-            - name: renovate-gh-app-pem
-              mountPath: /usr/src/app/renovate.private-key.pem
-      volumes:
-        - name: renovate-config-js-volume
-          configMap:
-            name: renovate-config-js
-        - name: renovate-cache-volume
-          emptyDir: {}
-        - name: renovate-logs
-          hostPath:
-            path: /mnt/nfs/AppData/renovate/logs
-            type: Directory
-        - name: renovate-gh-app-pem
-          hostPath:
-            path: /mnt/nfs/AppData/renovate/key/rpi5-cluster-renovate.2024-07-05.private-key.pem
-            type: File
-      nodeSelector:
-        kubernetes.io/arch: amd64

infrastructures/renovate/base/kustomization.yaml

@@ -1,6 +1,8 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-resources:
-  - configmap.yaml
-  - deployment.yaml
-  - service.yaml
+helmCharts:
+  - name: mend-renovate-ce
+    repo: https://mend.github.io/renovate-ce-ee
+    version: 7.6.4
+    releaseName: mend-renovate-ce
+    valuesFile: values.yaml

infrastructures/renovate/base/service.yaml

@@ -1,16 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: renovate
-  namespace: renovate
-  labels:
-    app.kubernetes.io/name: renovate
-spec:
-  type: ClusterIP
-  ports:
-    - port: 8899
-      targetPort: 8080
-      protocol: TCP
-      name: 8899-tcp
-  selector:
-    app.kubernetes.io/name: renovate

infrastructures/renovate/base/values.yaml

@@ -0,0 +1,39 @@
+renovate:
+  mendRnvAcceptTos: "y"
+  mendRnvPlatform: "github"
+  mendRnvEndpoint: "https://api.github.com/"
+  mendRnvAdminApiEnabled: "true"
+  existingSecret: "renovate-secrets"
+  mendRnvAutoDiscoverFilter: ""
+  mendRnvLogHistoryDir: "/logs"
+postgresql:
+  enabled: true
+  host: "postgresql-primary.argocd.svc.cluster.local"
+  port: 5432
+  database: renovate
+  user: renovate_user
+cachePersistence:
+  enabled: true
+  storageClass: "local-path"
+  accessModes:
+    - ReadWriteOnce
+  size: 1Gi
+  existingClaim: "renovate-pvc"
+service:
+  type: LoadBalancer
+  port: 18899
+ingress:
+  enabled: true
+  ingressClassName: nginx
+  hosts:
+    - renovate.cluster.edward.sydney
+nodeSelector:
+  kubernetes.io/arch: amd64
+extraVolumes:
+  - name: logs
+    hostPath:
+      path: /mnt/nfs/AppData/renovate/logs
+      type: Directory
+extraVolumeMounts:
+  - name: logs
+    mountPath: /logs

renovate.json

@@ -0,0 +1,15 @@
+{
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "extends": [
+    "local>3dwardch3ng/renovate-config"
+  ],
+  "kubernetes": {
+    "fileMatch": ["\\.yaml$"]
+  },
+  "helm-values": {
+    "fileMatch": ["\\.yaml$"]
+  },
+  "ignorePaths": [
+
+  ]
+}

resources/app-secrets/env/k3s-cluster/templates/clusterissuer.yaml

@@ -0,0 +1,20 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  annotations:
+    sealedsecrets.bitnami.com/cluster-wide: "true"
+  creationTimestamp: null
+  name: clusterissuer-secrets
+spec:
+  encryptedData:
+    cloudflare_api_token: AgAl6fSMDkAPPLJBXiCvmmT8MdpmpXMy1rsUhkwkuHIyubLN3k6Dfd9COk18qtas73ueWMs4f/Rrd6MT1HrO4QoA4ral0PgEEyznqB+Q6YgWpJQ5l2v5z5CZ+m1PGVItUEcpFuB6G42crQtjuJEOlAoPQhjT7H+y9EFG92+PdoWXwAW4aJw0olhZaeCQvoDDjVfrD0H9ncToqA+NlFtZoRscgeYjpxAgX8dgTcb9hyKoSsChIfxgBJM3inOqk4r3yzQDKM8hs8aJUCYLkPteDu+XHPe8Nh7swasoN2ss8fiUVyazhjML7WHWRWUjsOObhTc0lBrm3yc18jz3CJ7Ct6NZ9lK/PQ8sMDeeTjUTmnWY7Va0PD6eISx8zOXbqzmlqLeKUTkqw3pbXXowfFILcJXhImkm5xCetRmZyTFxHVW1pcw70mkhrTRxFznY/u736y9Kg2I8Wsx2t1ZHgtE5ZnXZKtGqEtjnD/M65SVUIOhyHGQvqRiYxLJJfC7wiNUuh1KJcQGW8NDuew/eBFlAKW92tFzs2WX/AN8bEkooYsUOFKEZTO2hyCAACD2HzI7qRX+hiGxSwfPRHJUUdCb8B+IrATuvda8LBnnXDAK+c+XP9pFFFCQBB8Rsy2QfZ9nJ7Rl7cfV+V2/t466jzREEP4Jpkyiw7k5qF8+XUJsNKPlxZc1Qmr22UnM4ab4523Vg0mIvTzp+XPNq05vi+Tjxq5UFBmYR/hpsVEX6OJX0hMxg9mHUaoHI+Wqv
+  template:
+    metadata:
+      annotations:
+        argocd.argoproj.io/sync-options: Prune=false
+        sealedsecrets.bitnami.com/cluster-wide: "true"
+        sealedsecrets.bitnami.com/managed: "true"
+      creationTimestamp: null
+      name: clusterissuer-secrets
+    type: Opaque

resources/app-secrets/env/k3s-cluster/templates/couchdb.yaml

@@ -1,23 +0,0 @@
----
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  annotations:
-    sealedsecrets.bitnami.com/cluster-wide: "true"
-  creationTimestamp: null
-  name: couchdb-secrets
-  namespace: couchdb
-spec:
-  encryptedData:
-    password: AgBJ7gxhdpF7pdKjzp/95NYxEqCHGQ/dOiZ2rrjxwXkfm1COqV6D47V8FahZ0g515B3JmQG/fJmylp5bfEN3TcEG5VwMLQPm3p8NvjLWIpDX3W1kf70YxA4Qqr+rlKadHI9wd2pqVOHY5bJDx9ELmSu2k1E9hVxhaEXkwY9BB0GLnYv3jbEbNrC0qq/gPg7QW9gJQd5zRzjo/B3M/ufHjtb/H45zwvMUU4zHx37HTkk5fuu1ucskd39RarDLYm9lWtxM5aEPLR3g/4mCGB+cLmb97lZlFJI4W6utKAq77spDnafyY9se0+ScxIzoS7uDo/+qdEODWrXGrHM10LyaN8AQfoQYlS2IzaJxrWyXtKKsm6LGzU5kUHYpM1qB3KA49HaR1aKLECgYEcgT0fDJhugzYetm6a9o+CW6KoWd7+APQDQJabBO1fmBsCY6xXVXba+Jm+g3Yrz4OLWKmGmC4Sdj33Eb2ZezxuJphqGTKGVcH5bZeDGkE+CErjJYTsh9pERfTG/pOsTkI9e1ao9HeleWgLFhIUdm23+kFuar9PA+R/1sFH1CqINpSb921jaQC7+AnjnRZM5XJ0qEGU0SrEsvBizjlzCPMQmGQGPL5tPu3Bz0aYhiaXM8kDlqwakV9OKggXS3ebwCfc1J1gJmFvk61AS8xArNfTyPK5qXfbG91JJ8QGiMe5cy9HbHg1iqZvWbs6e6qdsHcF966fGo/W6KgJpIz1GH7Jc=
-    secrets: AgA+WJ9+LiXPqT/QlvkVOTNzVXAWOKrpcPS3YGz8eUvox1P1l8yxRw+K2fYD8el5RYK6t191oVMaGBeVq1ort8dvMVkswUwGCu7WwQchW34bIgWjmbEof+9KWXDJhewVlZFOdtWn5BeRlRdCzOmNjEcNmbBTAc1fXkYv9CziW1dWEzkEpuWaVpI9A5okDpk5v8cbbBaNGcLrbuHQPzrI2E3yQUdTo2zdXk/By2ZrfUQh576OTn8GvEiWrZXCSCwplGQW4YYEp+k2yjTs+cSPY8p2MNTcR/csMAuPVs55XpvH9W0CMVsMvE+D24oVd7AczU9E416Ftl1nIGxxoLtvIDOjY54eD4wACWXJZ5K+ok7gAlq4ER7hhTvlJMcCvjN3am5/TZ9tYkcsO6jgkFjTRi3eVDP4pwGwCu1VN327MumjDXwKdupOM1weN8g+QVKsLYcvTQm4DKqweZ5ak/4452rooEzrVH0FNv7x4fjpwHJJpGvYfxo81tuHKOmwU4VjoOEiPck5zByG72oXUr8UHpeYKV911T5H+3vVTPHGoeujZfKCV25j1BXABHAd/6xYMtGPe5owmgwFAN00CeNTfv1AhGPUHQ4H0hSOyYRkBJFWCyMOBJSqGsaQYkfDF0BIUEl0myTPzLy6tEqFrPoc5vCrMkwDejgfmjgnHUNE23CXbIwKQyMW7N8tYNS7qTNWy12foPG/8iXdUaZGxHeL1rEhmCNecL+3qwE=
-  template:
-    metadata:
-      annotations:
-        argocd.argoproj.io/sync-options: Prune=false
-        sealedsecrets.bitnami.com/cluster-wide: "true"
-        sealedsecrets.bitnami.com/managed: "true"
-      creationTimestamp: null
-      name: couchdb-secrets
-      namespace: couchdb
-    type: Opaque

resources/app-secrets/env/k3s-cluster/templates/mongodb.yaml

@@ -1,14 +1,23 @@
-apiVersion: v1
-kind: Secret
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
 metadata:
   annotations:
-    argocd.argoproj.io/sync-options: Prune=false
     sealedsecrets.bitnami.com/cluster-wide: "true"
-    sealedsecrets.bitnami.com/managed: "true"
   creationTimestamp: null
   name: mongodb-secrets
   namespace: mongodb
-type: Opaque
-stringData:
-  mongodb-root-password: "ic.e6oeHefy983ZC8YpQDfg8"
-  mongodb-passwords: "VeQ@NGX*W3qrDBQmbVihHTXh,auDJjPpV_y_9-Dt*!dsMovFb"
+spec:
+  encryptedData:
+    mongodb-passwords: AgBxZ1MLyQ5Pj1CT7XBU3jHpo4isuqIgvFs/ixGe++popOJMqRmhHKDHcJrdfPGM07f89BCwUPjDvHksEOo1bxb6pVAwVSd6KZvVk+u3l3M0ypJZ3hULeL65s76PU0WIpRwVBVE5X2kE4kTKG7efy/WhkNSGFdzH/IeYUXm49/O8VI4p/KtJUYGETdDjG5k61cGDFOmNS0LKHgWav3G2t3NYmPQbE2VjC8z1LzfIGEprPUU3gfjpQVv6MXdJEBJ77X8/3A9YTyKr40xQdX1RKG5q1ro/9GMYI8XoSDfpC6OhQC/3S2HR7+yLrWKtKQW+jYRbgdCYokhJ57a2qgZSDXgIHXmLXP2Jz+WMkElrJamz+yGXwW9ikx9L3IuGjaPnk181odjKWONz6B00S9cKk+PCE2E+y0QGklm80JLw4NYhmI8DQ1LWhcY/oKxj+tKsIQ5ltWOh7MgTdmn8HkmiHvCmzXyGGsHOoUt0XdcCWf7JlHdqc9mc7QeW/2xrUvlsO4WkoSKkrWJXRhmVCXMHjzRy6eNFWJqfIxfPSL5FwsvTeq7WykZN5euXAuFJJpxSf8eewTIML04S4als4Awey5WCP+MLZunp9j62lV6r2UJcn3j+o3RRVXevGsWQpVHpyTJrlvZyclQFwIg8r5rVSq2/Lj0eYUCLhf+gIbedVfFqdxJ/HIcsufYjxYlFVt9MHarOXZ+WRvFODBrkxoJh/9RjsljYDVitZ4JqiXj4i7ZtjfCN5dZmfJlnX8LNwe4s/oL3
+    mongodb-root-password: AgApxPqNJ68V04TYPyDBkEaYq1Gg5ECE7z5+tqQjGzpmhfJDWIvgbATJ/ROBF8VMWJB8ijBDgXeI2a5FsS9YbYXghmdNv8tYJVj7gd5vYPZbSK5BprQpxb0npINWr+5x3kObG3rXX1PvpvBmiBiWVz92KSjTuINTECYTQwgoNXmx/iz+KGLgpC2sZ1EAoWZxYejhoJMpVGrdT9srsUORYssReBtOEqgClHk8nWXLG5+xeCfApFwkQenPMD94/zOe5MvUMhAo0Nnvyryp0aXPMv0RPpgh98WJBI+jVKVu0A3O5LPQEFqdnhQIaNAiCcq+Idmoo8jzt2MVzoTnmYil4uX86FlzPLnD14m3RiCD0cHpShA49tbotrfDyo4Od8rhjpxZH5afs3EmgEVEaskhwEMdtevKsLWTV8TfWghgZ6HPCRTZp/mo4bw73e17fgm8dbcxceubdtxveEZKw2hrOpUXXGVr4Ozwh5i+6CXPmdTi98x+7Eh3JTdYJJGg6SfCEwDxByWHIAYNjnRO/pVWfJuTGUxAxuc76AFsOyRrqe+rZs2K5AJ/Igp6xxuzLjtfiQ7KmQzDnsPi6+ozTVZ/NIa0Ear/mlqZOXFAJ15e4zUe+AQ1WWsRP2FW+ftUDswCsBl/0JALaT9hGo6/FLT/5iLR1WIp8pc2pcDMP5HfKk22NtIykOWcq7RJPHmdgRV/UgMcUKJznB79ACaQSDqYP48xXU6DhiJPl+Q=
+  template:
+    metadata:
+      annotations:
+        argocd.argoproj.io/sync-options: Prune=false
+        sealedsecrets.bitnami.com/cluster-wide: "true"
+        sealedsecrets.bitnami.com/managed: "true"
+      creationTimestamp: null
+      name: mongodb-secrets
+      namespace: mongodb
+    type: Opaque

resources/app-secrets/env/k3s-cluster/templates/plane-app.yaml

@@ -0,0 +1,23 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  annotations:
+    sealedsecrets.bitnami.com/cluster-wide: "true"
+  creationTimestamp: null
+  name: plane-app-secrets
+  namespace: plane
+spec:
+  encryptedData:
+    DATABASE_URL: AgCIECtMBtAW3EqPgFq8c9lPQOBw9dMSZfgvZKxIln49lPCmUK+pcE9PZAlSnr4lyukccegIZiEi1qXm+eWAVB7ImDN+euXlm5pS4A1DthXMHTBgDvC+LnknmNbl5JCQGirSGUxHxJFsPmb/acH4zrudh8jyajMxCtNdANDVJIGM/2TC9icBb8Dd34cR1uprRvnidAdmwc3vc1q8LGE/fDatJ7LUNPoA3yNCz5Te6MSrBjZceBuPmSj8jOgQ7CzHqhnmkW+2vr0eCR8efkLO11Sb6Ok+fRVJ1E6YZXsaj38AsY5fMG/cnPLGr6AvpVxFKIvznJlYMiok2wN8KqkbkSAk9FZneH85Yijn/EyBntzWDjYTTqmp9kjU5wNgBn24ggtLZiLBOhIGEIXAEQ0aLv0Eij8toYhYromStLuIkJ2j4s46nSvTKVGhccsTqcEkZveWlNBMJfQD4tBWH1dpuG6NtTSkq7vN/hu2nT8mr1ZNWmzcvDsBRX15joKCiY14RGad6Ronu3WG1x+DSykJ4Fz55l7/u16IoNbbXRt5OO4mbD6xgqcOIj1grB6wTT2XhYYwagFAOMfF/hJuGql3DNlCGElJaQ3ZiPNTYNWf7YqB94aYdT4ipF+cWhUEhhxEqEXqmlynvFgE5LlGdysOxpTDGWCr+rXHd4FT9wkyBzMIabnMVks5ewWxe6MEi8Trq2Wfp9/6bfhYIbYEzY6AasvljnleyU/lp/7v8Ltc7SqkNa84W0qbx9ZtSZ2TQfzs11EktljZeQMBpffEsw9hl+Ytd2vrVDcXjAxJ+0NQcxe87RmUJRp/gqThha10xluVFvLiwg==
+    SECRET_KEY: AgBNNOJwtdorKUwFe2UwqgxdDzqjgcCDeKDr/O+XgamM5v15YpJLeXXahqDhkGRi/G0DQbVK8T1NAIlWWVQNZxxr9MFlJYPnV7C6Mc1P9Cwfabd/XrXcYFI7+E8UhFOHoUHnwOcuAeyrcqb/8H1d+vLJ3w0yGz1aMWWXa8pECB/LXdWLl89N1NLUQAhhW8SVPinBfZFJuIrtoaMi1nEj2QnsCznt0FYbquXJLGFDk1dVa9khC8AFHxAuHB50rM748TrT+McLlvP/WU7ljn8vJeOcZSxcyYa7Ex1SRaxCZUk/+DDiMG1zahc62d2pxqV4Va3++RXRKNLhxepFD1zqSJO6h+JfMS0BbAKIt+eIUXPE+1v3Vni0z0mFK0AS4L2l9h/urYm0B14Cy7SXMztcWEDZMDvoZR+jcpVbPKceQXy7oalIrP51JNZhr260NTDLquf5WURfS1LdIehumoY8QILCQFC6/GqWtc55sFrQ8mlgfPya/rqca1fmV12XtuG+CcXiVo/+9upHD5+lPtq2BnfxN1qw7DlUC+NfiDkZ+YtYag3rr7m/ZXNoGTusVZ6L64a2Ze2KkUyblGRACH2WBXI6S2nRIVhQuPAjeLX8mDGNwvAmbOXi8EFDibj5hFtI8K4J6X4X0k8abLeAY6QoBK4ShO1prvWKXKSadktdanwyhlXBX8a5XtnIWLCg5Jxr1a/abvQd35psr+tUSxPJqrMtzYarbF7S2JEcPqBvp1bCF8SpiT51nZ1QvYRKrwzYN+CPDQ==
+  template:
+    metadata:
+      annotations:
+        argocd.argoproj.io/sync-options: Prune=false
+        sealedsecrets.bitnami.com/cluster-wide: "true"
+        sealedsecrets.bitnami.com/managed: "true"
+      creationTimestamp: null
+      name: plane-app-secrets
+      namespace: plane
+    type: Opaque

resources/app-secrets/env/k3s-cluster/templates/plane-doc-store.yaml

@@ -0,0 +1,24 @@
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
+metadata:
+  annotations:
+    sealedsecrets.bitnami.com/cluster-wide: "true"
+  creationTimestamp: null
+  name: plane-doc-store-secrets
+  namespace: plane
+spec:
+  encryptedData:
+    AWS_ACCESS_KEY_ID: AgDmSHH2mGd3Eb0K5EpYXEOVF+FGcTNSssJOd5hg4Sh2F52F3clPo05lZ2MnrHRgU5v331jv5BMv/oIKY9dlpeIlFJ67/l8jlgbTQxZLJ5zDhuOBkHFfKcWVRHJy5fwUaJEgNrbCEAKD+bMdhTd02HWflXTy+PQuIFXFv4ocz79CCaep2a/xFgEH4fM0OeE/nrJbxQlwYHBk/LYuQv/v1sjGUZz+MCbnf07svGJnYVVMXHXsWIkToDIRKBQtD01FLTJ8zXhArE5tKnO6tzi02P9QBNJzDvswS9PftLlDai4nupNIh18tcU6zE8lgynb/KEAyqBQk0tC9D4cCSkS/rz1IKFukySLOt89zgReAjMcVTYBAo2eidgRr8cZhHCOzOWxZi7y12MbLo7MjJQQx9f+Oeu0YiMjXCgpFDklvtterE7KOz0bLc2KjR9DQT866VbXmXKRht4yzeQGMxu9AmxzPhx7iuOvovzy7o8dh4VjN4cUoNkC3jTVw7cWZycEAVrhZ7s+f+LlyxZ+4VMlfTcp21J2R9fbJiV6bSaZTrJNU/2fEuqvPsvCE9xSHQeTUeYrx3f15VDjwlqL3tN2rXi+FUWOEH9un+4zKtNumb2J/ByaFo1PIPpYUS7IGpyJZVbFsClh+weMKF1oX0qdQ3fEsYIOGzUvjy595TgmxS7qv/S/MGYmahIgyyPiZAxbfMXdLMBN3IvnY7DlyMe+jHZkeOIIjnQ==
+    AWS_SECRET_ACCESS_KEY: AgAtgUS2sQVgk1sWmOmaXWOw0muiZf6Ikf4IEWf7X/PIwPZHElUKX6pR/nfBXIf9aM5gl1CXiBA/Fw4gw7RCAYY6vLLqppR/eJFJmxu7MpJ8NIxTJCgd2sWLn4KGVfuiRXZ3DAzt/LulpnCvE3G0pUHWlIUIMrj1X61OIpz1jL88R4FWS8AaPS8qKOnmiPjRNjJKeZBPf7Z4Z9XApAeCrRTIUyYa63/3JuTKiNCG7BgOidPNkfZQPh+J7D6AsflvWA3SW0+pF1yhNXBORKDynpp4gr0FRF52KKQyZ0fKi9z2jXrcHPef+Gk4Dq/mo+srzV0/A3yxjAfRwAGzjo0V/jk2unnXtF/PsAUvbA4uxR9IrQXwbtL+8H6HsOhfYD4HqN8KoL+QpWjaGm5LYtyZi6HejJaDtLjUkYJ/jEAB9nTnJfsh5NNn6qw5JueexsmcYE3O45q7gdszQSCR9pvoi1OrxHi1hS0sF+DJ/rhiwqxMk5uQEBmBs2puLw7580UPf4k4kbe76bG5bPGjw3sYQLL+iPXRM2P0WfOaXDezHbt0iRccLIS05WgfqQiErnkQCjzyTYDYmKsNDN8UQqpXz2HE4b686I9958JVxIlK1BeoosdEKU8+i6ngeV0XLNgzBR78FVrJ8pcGTRDzoEMsHM5x+800afNcJlR5dfUYT9mHfDjbQQJpGSZr4LcPtA8IvLRFmsmY+aW5UMKIp7O+/UcFwP04mi+tD9Fn82bUhl0dQE2LWseSqpjS
+    MINIO_ROOT_PASSWORD: AgA95R5e42DoKA7E0CPDDzqxdKT82XZs9oTIa+I6i991m4z11x90QkfmXgQ31TsESXPQUKekx8Cph6RJI807IqC3vsLrAXiVD0PSx4EQePF5A/a8M9dBjhGpLIEBo0o1sMO3ZsBrqtEgk0EHc1UfOTQoRzCDO//TAqqdvVf/WoHPUGpZ5wfgAjpD19HZr2Ls3pkc/4Bx7f4/PkL2BLJivdsT4c6LeZTu80KTPVH9Fu1Rk6NSFYBrigOcVDDRAvVDSD5C90WGwDUNNpu/hwsZ3pmmv9Saf0YgD8wSgKCcNVbKWiYd0NKnZIgFzY2p1NwexcBTXzL9dszNkJAzXIiSae/e87fCszJSCBef7WlBh5eGH1AV4VEhc+4oooq0gIfJ2DvR1XIVinJRp7tNIUuQTXDrHMwacOzEoKYCwGZZ7rXGexS2n0oYOQLV/JnD1R+OyLvI7Eu7CoYwbrKsYCVilRiMZO63IawDA07n5iRmg8JR03eK2m/LLaA9kSbKqMtyZ+nroqD1PlJl6asAeYjf+qrzSRPqyUhJjYOA4RJPxGUvmXBIaVW2IqwSuokdgnNTmiNtC+lcYP2VNeas5xXZ+mDoeM02HSuW4MaMWiwZewZFH8bZqhxeshu0NzkciR60UZK5XRBsievXT9ycPaLlXNcZtlfQYXL6OD6y0KKS31AgICDAVcehbHAagYkMOo7voNkipEpdYYzM79ruC6M/bSwPcwIwGw==
+  template:
+    metadata:
+      annotations:
+        argocd.argoproj.io/sync-options: Prune=false
+        sealedsecrets.bitnami.com/cluster-wide: "true"
+        sealedsecrets.bitnami.com/managed: "true"
+      creationTimestamp: null
+      name: plane-doc-store-secrets
+      namespace: plane
+    type: Opaque

resources/app-secrets/env/k3s-cluster/templates/renovate.yaml

@@ -6,24 +6,21 @@ metadata:
     sealedsecrets.bitnami.com/cluster-wide: "true"
   creationTimestamp: null
   name: renovate-secrets
-  namespace: renovate
+  namespace: argocd
 spec:
   encryptedData:
-    db_pg_database: AgC9bsUKqidEBZsWZ+VzEegYKbSGmObOej5zUjbeNcPfm3QsfK1JvUII+CAibgDs91c4XYBZ2RYCle/dn/MxgeACNc0uj458cpCFexr/EowaTMi0PIMR9abb23nU4I4onq1QAwVbcakG/WeojdryDDt7azW3096c6yjdcIW28aiaVYnLhK9QljDiD3o2+EsN0XnhJDISDRLZA/LvJ6dBoWQUqErYtUElqm/ClXLvIEcfV13rGq4+mXnAxOSJLCiw8GDgbPhbFVWKngB3JrkerdpHB6UlQLm6lcMgFbTr7ubWTmd01yHcKE/ra0exjAqGP5nLoqFWmxThAueicmOwWeOVN3Gr0pZ+k1vlCHMGqZ2NzwOoQDnhAKb88sSJCR+hLnRgQ2rQ7CrCcJOMrrUojE7XBt3eMFfc57A/pnccgTEpkrrxXzWhOnvNMx2JBECnRFDAh74CHgBVWvXW32lqj2Dqy5bnQBua4yDsnDCKSdirZvb6v2BTYgQH6BDXh2UA6bG7XwSdAmP6tm6p4pxNlfrJdEkH1C7tOF0cYLZgeP+2xPbgdfAreH6+zFL35I991+7ypNG18ZXmn+hFsrOjYB6KO8SIRlptpwW0vxghFWrb5nAkh3oIliz6SMsV0UNWg21MQIiX29we6Np/suWjklgCdIXlsAlGobe1FCbXTMOntiIJFAmLuPbXpHJIXs/CCPXOHloBtmtEMg==
-    db_pg_host: AgDAfk296c+WQv7uo+EcCfMUjnK6xQMzy1ZLHdxgSVDvOXeDRgJXia5eF2vPJEcHFBO65XUnTiwd+K5b2SIr4iAaStHS/Uy3vTlMM8ospBjq3kgmtHps2xIBEgdJu3Xur/nU+G38uChEs1+asKKMob/J3hWNJ9d3gKMQ1cnL/H8PEiTUw6XXzusiZWqQtzau26xxuC7UIT9+dMiORSnL3TxrqO898lVMfvJPzL4ElTn0sbOrzgPJp1z1y9lx7+TJXl8RnIPL01Ja3geDvAas9zeN6CP+L6WhKEndOxdhi6KIAwRSpuuIAv5QJnS9nPAgFWKxEJn/50WmWCVebmhQujo+98nxQHqPu+/roGgckt06RFrUWurqtttkBza9nES3qhdH871bQYiacPclXc1fy2Jep/8SH1nx7cuB9xxelpNNLi5RhttEcBSTOQCU+WqW7GSp8NGZ5HCWmJJ+Hn1/fMMkUZE85mAADy+WttKaF+sfeXpuXcBBcAYrZXA9P9Qe4C5ObJyoTgwX67N+6+vW06Mr1Co/ldvp0uF+h0wLjby1l/SW6ldziLhJe9Ws1fc0YpUxc5FwwL6VSlJ0PHnPQ14TYLnREzm3fJsJ0JLIxWFgjVWYqlx3A04qg4U06wpq/t3OevNQJuAEZtir2wBJ+NVRBxAuNDQCE24/TsrsshSD/uuKTQY29kSSOF7OQ/54QGCWCEvmQiGAVSUjQFaqXLgoBENToWoU95frvuViKcMa48J81+lfvejq/NBh
-    db_pg_password: AgArAPYy0EDOnahIFpv8hSQQy4f+3lgfJIHGcdDjKbydYsHKRywJFrBmWjvJxYSCz9ggHQ/zxGCZuaCBSc27dG9id8rYV1g0DQcnJYlbTFLux8rlJrj/cgRggOmRGzTytBv1r8BScJ1I+wJRKiZ5kPLaLPPcn4UGue8QrNDgtohPF8n3AdxijkNaehJlcAc3hhyx/eJgRBf6nvYMfheAF2v3vnOt+GikWhscaYaDN0CS/leajnPFZTJgVufw45a6eKlI/+dVehCzn1O3UW5VK38cVfwuDbB1NfGzhCFKRf2+3Oz9rHAtEJS0U3SjDROlsZqpQcucpWtRrjsUqlyWs5phF2lXou23G+i/mHAUhtGGoNZcaH3/rHSgbcqHSWQye3wqmLhIYVoeq65suQbkXUjebBVcqPxoSqFWFB7UY/FiGCSaVpcQFdeqb5c3tGYxgbG3hBQS7ohmhY6pHJXEYWTIUE2PpRVoRLs27yPooDXjrYrbUfoXrH84HDY1E2P/z2RG3naeOWTt9h7XfsaJJ4tZ0PgwixrMf5eiF8z3gfTvBT1226pdTNtgJRRM74/gMYyRCFSqu8K5YEqCQ2f5w9WogxTVQtHxPVdbzqrPjc2KEw3g8efI26q5KxBY7C1gx1Qur9zexjhdqfzllJRMuouIBCMak9p0dTTq+V6TWeQuS7r70jJKWI6cWDg+fuugC2bbkHKZ/1JuSJHLq2lC+iohfHZZnP1v18U=
-    db_pg_user: AgDC+jHDrkGWmDggC1TSamAnm94sXqPRKJcuuV6hbfFzkxcqHiCbJ1qLCMpytpDZIg4/qmHHvwTPuThG73QlF/ExGOmdG9lQKEUnKmCgCUr5CSqzTPVlx9ZcmOnpoJ6XKoo5t3860JFHoFVdsnqQgBMN+5ttFxfrqAGToixLqaQeJMtt8kG0BdfefQukFmYr/fIU6OT7te9u09KRLt3g+65TULutS64zD5zAtFjH0It8N2K0TbrPece51oROyMa+FL1YNPVjkaMxb0VyyASH1s+hNfbm6LdLIOzc9zF8CGiiqZkclKi0vv6TwjwJIFx8mtfPz3wOuOzwvsVJxJAQwdpwSxfF6i+vcMJZxc+pFrmsG4YUicom/4JrFM8ZSEC01fbeEA+3XFyC18qkbU95QSxPxuolp5SgMqeY2viT52svyksRCYgHYNPnS1U9VMpEqWo6jR2m3Jv7kkGsdXB1kcBbY4CGa1LDEBL59Np9yyU5//0IhOMJGP72ekqB6PSJtcyTvdTOeRKnzzSf1kppws9xTTzym3td5uLEfmoJ5XmfDQp5oX4+m0Qqn+K0CfZWBWe4yv8EnHhbF3mJBkCDmgqRlCFnLxSn/tpTE1pyVZPc41wzVZnlB74E6C+SnEDP2Icw1vYyYk+XGeOItJgy7C5xDC/ly4NbxxXfK+ku0pQMM/Fi0Hx6S7yOKiWmeAZj9AhMLOPc3/uvGLDM9zri
-    github_app_webhook_secret: AgDfvVN7ZTppYl4a0eaIPV5VlXvHR+0foUjw7bdapmUAysBXOKOy13loWPgwmkJ7uJwU+gqKazA3NvhU243HMpZmqYl0GfrwsK2nRTLcncdOVgFlmvbqLI7f61jnKY5xlPazbGJRFMjkEwY4Q3GPszc73xmm6JyLtAT4eFSYmqnTXzGhmBo4awCpIcHDq3Vl7rtOEwmpJNs7/q2ADzjh5TSV1OSQkHl6HQuG4la7MiWaDuMS6aJAvmSRVPKSHhgaoT+gcCFBBP/aozojIon6/7+VxcHyaYxg6rOGyO+NRx2YvrPUnDMmjgES/3FPsmfYZICD6aqdsGRlBtqkqfkXxM9ckWez0Mc0xbOXNRWqrTXZjVXPQnbA3079orUpDUOEtkLZu5tlQJx08MIDKOD1n5wWZjv1uL4ENFI20T3iF3Z//k/4t6noil8ov7i4nVgkIWTp+quScQe+Mo2QHg78NIvQqHMNUmx5iIl6va5x1Tr1S8HHmhMT11mzkfttihB3GNFX2qQqhEB6KuR9veGIR+zp8TZkOt2E5JjwbwZVFto4JAR1y88etOjt8UxWJ3LMg7YutdrfzRKmv8kVrtlZPEV4MTVpKAIqivX0gEZZtYaoYDNMrTjsNN4M4di/aqMDIDvzLAIkpn2jdy46vi5FweLaEQnejvgKerOoFMkSHWFXHBpAMu38iIjdajQkjXHVzlvWuA5C956kjOp4+p0B2ANgFGbboQ54SAU=
-    github_pat: AgAxuzPdsIdAKTDXcUbAyWtMaNzQQH05VV2pPzNtZbDVbRJRxSmEjVVP+4wwPyJ9JUHr5MAAOdslN1H21DWod6F/kYlEtnYM7bxMfEnm6I6MeDbYj0x4P/nZZM9feFEep8ClGlGnovUBYGTQwFCef/aIPvtqXcFzGmsOypVbxpOfJLnRWuknSooM8J2WcJXheOUe1Pif7ykI14yxGR0vwj7HEdBKG3a2AtQDHMdCqQCdCzJPuMmxICaEALmk2zdkphwpzXr+h8+5p3jkH0pLN7b7B6+VXOz9b67EUKgK/s3vtuEAUkAJEfZxuDTcULIqekblst+cwDJP34ZK31nS/lZbZw7BEmlfvsbYEIJ0/H5qORGsfSGunUPdhY1tWZkeUw6AEtQm6zhtlVRXjQajXKB7QWABXG2f4HWzzji9pJTAdSHGsc7iBfA0rAhjkqemHH9vU0wWGJNOxGwYRsaltEYfv86+VMp9BqI4WBJ/8Q22tcfzDBm+NI1iFHNaQS/74uP/z6l3NDo48LAh0bS8oxuV7mK8hZLFofJRyoTlZIfhlIXwVzpJvhhVm/r/EwPUDzb4AAdUOvbCmct50fDx4rsEVmAsRchw/Li9AcXROMojqQJCXNnqGdNEtWRKEEC2e9DjcySl/aMv6ueOvTeSU8BysF+tm9kY4JZyGB455HsRC7JyVDsoRCIdbopHsy2L+wBUdfLjwwjRo0uLvODgHys5mq05b2qwdfBFOqwnS6R+oGaEFhgbWpv9
-    renovate_license_key: AgBaJ06JDSwHD28vj6Hg8SSGJQB9Y5hssSDRIKnvYxfmuDNSJhmMTtQunXHHfcJwAdQQ84zogeBhbX95KCIeZN2A7o5D/YoKSMdqbg3Wx/G54YKTIBjh/wgA06BNR36JNSLaMYU8iRF2COcSe6jCQqzQ+g7Anw4Iyjr900waMCAJHKRfwQV5RcMliI6sMcuKsDKkq6pmqg9wk452VBJTXTvXc2BlQdkcNIlv0n7EAv3y17Hc70zQX6pyVvnyaHRsBuc3auCWbgEfVc99b2Vlff2ru+lE4kxri7ToyxUzMbhwBzGsi93CIXLTinP8yJjSEXjgt+uss4ySzvDxLbbjkQqhdU1vfLxhdw2ZdSc6U8eVYKrYSctpQY1Bg31/hjny4LXH7pN9Z1GEf2hCU4cDPXXHpwD2di/czqu5APEia49ZmcGLmu/62zaMDnRfHuZ4hRlTEWjfyuu3kD3HBRXTjKLzlergdXxCaLt4tQh7FiaIscPQc3TPxxZrIwzV1bW73HiYoPNZxh0b7d2GqCTW/VQxYpOt1UozDDtgQ832dYh7YXJ0hSDzMy4PHPc6b3gz23V9t7L2xAGkBfJJb1QQdhNApydteXUX9xRFfIXyUKXpb7cbpk5Zw3nB1Fj8leGuPKvNp0nCo/0iMHIv7D4BlQeBsS0ADFT88nyNDdRXTbJZlmNYd+BXqKU9AzHkLPUgoAyBIqLg6dclE53ZRUNTJ5iIQ6dbmCxP462krP0qgu80XjuYiSmXqbF+5lRZ6esNOx7MIc6qj4WnoFlBb63OWg2goySSc0W14y8yf8wt5vrxHZ7Zt8qWE/ZJ1VddbOkEZWQITFYASkhqlYa3x6jRNXuciMRAaUHWRHLiRJv0RusbUxp7da/UR+HNHnu+jrE7QM31ISyyzMYSFgVA2Z/XDKyp+EljlNW98DncZEdMpKvpalT2o1/IlCfwyv9XaMYaQSGdCLDtuNkiJCVRIw6i3Gh9RZMxiXc=
-    server_api_secret: AgDlmhguOY0KH6IpnTCpzH/HP5ut8PE7cFLOr9iDtoe0fsHKAig0HaFCd3aZximwZnu2aSIL30lnIS/qM/qimADKeLkXX5zNgbyZSmV0RomjUochqQ6VxpUUwbsb6KBvPfuJJ27wnwHt8ZehC0ECXA1f/FIUW4PcKuwK7vdRmyfO2PmVThqFSsDscycnWGyaaObXNBM/uuXD+KziIUtlJbYx9oHot6ofkC10CEmQ9v2WdNDiZPjrnSx1OOkWG6uVw0HE6wOHpbWHw66ox1LDNNMmEGo1Enko/6IpL1gDC7tTBthhyrEvQUxiUSq7XqLO+LBxYAHe5WeEaLObOSgRubLPKIuEz4cPJ3/KbBGfbkq91kRGVYjzPbxugGNCECiaY8wsxReubzVXphnPUEqq758+D5otTy5GuxNxFDcJBzyYzrHLMLTI4kDyD2IMqh3VmL0NsqNCx/nVyLeAOgi2bFtBDtVYPWlmqTWVdBgrjQ5ddIAH9Nz9acB7iex1pn4U4zCoVMPkzD+7mw6sSokKZz7fyNLMpuSpe+LfFyZvdgiho13eaq5CVgjJZW7kX2ne0hnc20YRhnKnKrkRa2N98qCQiX3wiTidStLVXQ1+AIe5vV3mYIZsikZGhQ5cTVIeN1jfu/nLRfZkOaEYwekvbIB3IwvN6P2oj4iokdlQFkTobCg67OIxRTPbScDsPM6yzpySUzqBsERvm542VyYnzOZA1OFW9z92BxE=
+    githubComToken: AgAHxlfPBIFhFCqhYE/j8oCAqdmXnN1eYaxpiRoD1WkJdvbKk7HV1rEnYBvR7CGJ+LbabNQ0c3+1XvYMOBhKfC3ur/+OtsLai5rCtD8RMxfrjj0tm81BQjEYZHGlTE7ohHJxtC9AMxQlDKBfNPiQ+uIkscECAa5D4oISA0lPYxkM30ug70M4GeClLW2Jg2/ZnHz0T4Cy51vloYkqpty9escpqUcvaIlthiA9Mt10+IOP+9+fPIsdUzwd6OVX8TelbR0qbDi/iCiz+Q2BsuqOmNmX7z313IFqOWdWqxUHIzYFcwaUzW7c9ySDfyHPbUof8YIvXR5I7Ftq+WB+mEtAIXOo/Y5Y8JmJu1MVhdkXPqo5SdaYcWabQLyvP9bIU5odH3OnOv/ybx0juXIyQEdyMuqJtmJGfMNN/9TFTbabqXoUfI1mHQqs9EyHY2jkxYO1VWP8a+YPMzPR9GRWfpPd6xU59rNfWkQxfZtOfxF2T+fUjhYHQtBadPe/IANXgQZebo5vvR0EjyIBENGJjSwpDK3IiD+ccQVzp4ijBtdqlSENNwSeh/IQnhKIsVgSAN//R0Su6OVGJxfQankd7TiEcUum+hZDf2frWiZOcxKHWB+6WFdmryH9qE1gQtGIOSZB5waKq19lbmwSjW8txbEjF3KeIlIPkEfSl0VhlzMdmd37ksl/OomnRxGhoDJ51LrwozECubw8evtD7vj4E9/CeRP01fjsm5BYUrc89EyCIYGJYKxZrAO9kkSg
+    mendRnvGithubAppId: AgA2CoOeWx371tZH8vNHumA2gQDuk85otiA/wNQnVhhT9enetn98upQFoZkOvBFe4y4iwNbE/A6JyddMvSoCUw6jeU5GAPY9TeViYepVTTR6Z4IIDHhP9Iir2PBFsEy9ik4VKn5Eqtjb6dkPTd4ZiTfp8Z/eVcjKrCiJ8QkBVJ6GquPFp0I8hIzf+83ou8m4OZh6RyBftDYXLIs7UbKgzzzdIMgU+DQpw4RACazo5gwDeasE2+sqCDqD1zmrGgLGnfI0Ky0Iy69ZhPlBBGdCeNZ9MtN+PXbsYjVTz066hGWi2D2hiedEHQz7nKKs5E+v93tNTCtibJ9ms0RqWb0LmJH/5OY4fT21Q5KJiqT9YM0K7qulebpqEX8UruklHUqr407qWPMzOhfbnimz8gHZkJyFWsQPetcbE+0rUX3yZY0w6YptSAbIJn53cv95Mh3ABW536oBBP8BygjLrFK8b7hS0dStu/zW6XDMsEbeySZbNwZygMzK5wcCY604Qmw17LFz6/8eCStmV8u86M05iAYJEnhipWG82frBlO2zOaXfHsfpIgsyzTGfQ1W3eV08dvjCA/t1xHpdai05GFxi94EthYTXuEg5fCuWbaLlmpAoWmAZYqRdJHbAMtVVnMS8ENVjvbh3jx5ebv2v46wIMlSWjqlk0uRR/LhbPBY4P4PVVjD7NL1nHSl123Bh3A8ROByoA694jg/s=
+    mendRnvGithubAppKey: AgAASTJALpz830/ofh8DFgca9GX8/RfaHGG8Kx+R5CLt6lhxg3Edn9O7zTc73m7WsADIwb+Ifq/gXCNdbagm/rYZ5B30J+izX+HtnnXvmEeHkp6SIEDNPwpF9DjtX133tlIS48uGgSS8oHNvTjvskRvl/s5j5qRNZDNI5smBJxxqC+fuyvi7SKwDGnVD50CzzHVLH+DPK7bIAdLxatjGQBb4B7MPmYnDvQvru+1onVOaZBbWFvlKrh2YmFd/l2AN528FajT1ozw+bn+yy3wZr8Q7hFc6PMWdUZoKFkB+yZhyzq5zVDi0a5ZC3I/JAlHJFWlvnmaflT5d3Mw+rBdp5KE+qoh9opJuSvldtzWTX+IfyxROUxdlNbSRyunki00nPMEWaT5g3CrRdpG/9e7neCKGxLbooiYqzQ/u1SxHnDbqsI/IfbiZGszMCXsMsZjQXHpb+ypZA5y3pVWitYCOVnIOT1vN5SkNIS1JJFGY8LjPWOUBUplAbBvxRvZWXwfwzddzqpMksKcOhWwx8SoTsTj908bclWDh2yhmMrH2E4jgbY8TevZbrwkk0Ub7V4pBP5JbsGB4x3ExdqC6PydzLtVgXGGKKdB0u/tYfE+e8YNTk705it9etRBdOu8QchsvfFRnI2JrvF8RY9EVpT/j6ixu7VgXpi1efT7p6eCE61S0s5rFK+Z0Zkvziz3TUZ1ywAkiAaUHHz6l3xDc+cu4WFxThXZpaXc7f74zF0Y6M+mgDsEhV2UeAU3iQsQOh9SdzenBzim89X0OeNjK/xVGoso8NczqbYlyI0iziRgasjF6f5PmJX9d6U6wxSQDNB2wQ4eXSRUE7029jEAwVDEClbQU1EOuaG6O9W/HJXHqoElXcMpfVudfrhHmCGlxmWLVFTqu3QgotEkiPmZcJI+PJVW4SUtQnoiI/GcDRLw7SQG6T2DaB8W0aJPmS0sL0g5pfTqARRYn5EBFQaEql100P/NxISAek8SVBmAkP/QI3f+DYdi5YUT/UPDLGXgxv0fXCg1+OOKjdESn1bTnjc3ReON1hP6E5Gs+tP0uumL9Kiy3fDePYK4l5hmBBl340YVYK0tdK+4xhnDuxuz91qK42qJJckQpfjP5p2OW4bXf/QUXok0oDyKqx1K0/DFmDMtvp5b6HwUFWZVVh4mcvbljXgw4gIs7+zZWaDLXy7wum09txjYbdAyXU1z+UDvR/8FrSC9ExsPiirJwltR57D+/EepIAEREPPKiYQsuLtnoxd5a8dQ2WYLRQeinHjd2XIihfZ3nhdEtjTh76tt3LQHjDjDm+cQhzsRNyMgjBm6B7ioaM6uTBUZKbtwxQSLMr7dApChOube3t83bSU48ayxaWPss90xO8Mu1OCHY/wMDdboER0OBESf8w+w8qghpTSYiNsrwJPHr2lfZ/aYIBr5SRNc305BzrtzZOW61WzV0aInbpMt8tfo2uq82yXwBtXJ/N53HlJMJR0xTB4XU/7wRxHCf0Ml2ERXX+TrlTcCxAxwYABft/3QCD0FkvLVveGtMlKMnPnD4ROPD815L/m7YI5gGyq2yEIubjFHMPyhBodpPzKPBZgJfE89yitKqzmcQOUTRdOi7viARS8qU+aJOiZAQibzSm1aSPdvevmrbRoqe57yvRLI5IXeXKJ9Rgu9UNIjlPdNyt813z5HbyVIPRsHbxkcTM3JVaLPpMKOtFJGsj4hyy3Z/Ni819uGZEdP02708Et2UzOtkUBzp5lTJ2gKB/nCF/NTD7Kot7S2K+Oj/BpaxnLk+lqUdDM3ACKvG+HLhd3DXjlCam1Wle0qunjsfDg49NzFsPjWLQx3kb7q5HE8EE9DHBXzY78wPh1UCuKf6N5obRPA1m6d8zqHzdIs9R97ZokZqn+fMmsWWyos6IpxqNW12cWjVq7MGLvm13KQxxIvWnjHpBG9Bpz+rRCOgnY2vrZpVkpLKozytNVQdePsLfwGZhOi+RlQlmFPJUmYzZStzCYUdXQjJiTW68RueiqsgtrWATmf56aqC2ojIs3p2CXRpbvY6NU6yuOVA1e0nbBmStwbPKjyETC7EykY2bqvTStKabLicyHdH6MmUnmg4F05swmJfUo8ZMV2XLTZlBsDfROmW7uKMmSzOLz2S8uDy4/qrLsI6OgnybNXOYMYchf207sRtY4b6cNIi3j+gNcc0ujvAzC9DWcwpFEyg1zUZUR09eX9Ph66g1GqLp8/51mp6RGSH18x6Vx7ZXVavNencsY+Ekvr3uN4cuDH48LzDlK4w1COzDzCAGRMX7EoYaQBNTeek96d2N6LsXoIc3rb0m3U4qo1j9wAw2uT5yeEmkN0+92I+SvW36CEt8+nh4Va7i41tlGzxJ0cDLlep6F8SiSeAt6/ONqJBZeHW5nfPeAR2Pq3YQJdChrp24JOxuJckjOq8ZGceZlvxs5NKyAw2kKk8HGF4w2shuucBuSvNaoVwbhUz0ncPG+31R5V+i0xlGKPR3QYOegc//DDAQ6wiHceuokxVKqS3QNWJQG8L1dewf+JLNNH85v8rI466WsEtM9f6ywIXzntCeGijvG/lm3hEZWqv5zvY1OU/sAgW9sHXEq82he2ul30z+ddns/pV7SJIwJpfsGEgynP0t6QQGJ8sU2UNyy92IjrbGD6IuQfJHQQ3KRWtOduZ+l0sp9uYpJVxO9/l0rE2ABy8NjQpVerfVAnNva2M+QE/VayxSIlOs9ohA0x/4ECmiey+S9CN6oJlf+NC0K+KacHgQ6BUVTKUxp+YbbRt9hKfnWODWL0Ydxx0lsqq6UkPHSuovnJSXduCEwnRhCIs4lBMc5m6dcUADFBpS4flgmjTg8OMVZHly/lMk9hisEQzQuEmDCOtCfDelMQICV5Sy9MwjacwLikWFGwoP9/t62WlTiIEGu21nomog8hqagxVNy9sblZFM5mkICl9flXLKA==
+    mendRnvLicenseKey: AgAKK5LweVPH0DDBZAEdzZaTrPQXtBrT7UljeF3pW6tZeZIzWp78iE1AKtzOOC9NJc7uJ4vJ1Bz7/wwat1WNxBLVthrwpxXIpnsOsCzdOfgf2Dif4UTiPSTKqRP1Hn0GBaqNx/uhYtmKxip1yhmQDDzaL5jzhm6m/kq1ZyV8LZqRWDQa/EW+79MYRBIpsoXkADec6BIowWPe/TZX22tVHnKljGDKulb5rr6+8E/IrWMaeO1hkouLls7Oimw0pjZBYhkbCtAvsfkD9p3RRJzzY62nLLObjCpNo1lPs9sX8MnD4n/TxFKKRbGMkoWJPVYaq3g7JDZG6yfz3RTGw/WNupRujoJrYLFGBx5iKpsvnk7pVlaR0X5H3rw+HFMzvt+MAsu5ifd7egFD7r1I4TIS0YXtuouzdlLf5+BzB/y3wMd0yneeWnoAcmoBA7xgSAR8nDDGui9gXT40NIS9PSfmaUB8VCO253FGnqzm2ad1GszyoJQYC43p+/X7bEvme9nl0nz6o4vGTYgyj9Xq8nneTrXownFcUn0X0V1/NS8OaLL5q31gbFF0uIVAiKnPzIKpGgNgSHgw1f4CZm3xPqVyZw8Eohidt6pfOqA6VDmb0Xz2r3+eHJQg4vRqGOYnk6+uDxNWu8rJDevqLKFV/Dl6cbXm4cpK3Bfc+dOm1bWmsjFfawmvXr+HDdIF3hs2zQ0M16ozTjuVgC+0mVoBrY12wzyN13NT+Sz5Vj9tQv4QI6Y2VfSEliWENyBnSSRauTuPrb6HoIJfY6+G2TBgE6Y1vYgohFhHePc+tgO+L4S+GdhlJX32FyM2qdlVTxHmqlbaGGSapi5ICXHpQVGI4qmt23z2394Z4Z8LhxlRZWw4HfLK7oxwB/smU8aVemcAqXhY+8mZmFGtZ84mbX8bnVIoFCkje2qNVtk9yMUyXvDZSFm5+1jw2qzhHZdbNfuiTH2/22QbbI4Y5OIcqBQixGblbQi8qvlsec4=
+    mendRnvServerApiSecret: AgC40pNPqUf2BCMC8FhJtgTqkXluENDiTswYG7tlwsk2z0BjB5Z7DyF5ZY7rcu1H/wgo1hLASZrJHmY9OY2PG9eqY6aXyhe7Cn/3K4wwuFwwD4S19KfhUutHIbNz2mJZBaxgahJaFBkBy3D9JwMFKmZsnWCxP0HNkr7r3EoldQjiZ9VkyAjrYsMj8ryh81ICuTpAgafe3DfmKRrk0vi3HRf4Q5VuoCoxpNIylIj7Z2aiOKel9WeKqgoviH1M4K6205o04yygSvqDKzK35V3A9Ah926E4MNUDZtJfy/PKysdqEP5+AOPRqPJZNfTNEZQ5aVJQmrgmDPhs5EMWb389wcafnfHYhKTG4wsLhdNRpJQ3LNmLrp9JdiuZlFPUdsZtGD9jyzbxS+iS9I1YNvpqbyHEnM7oXLoKSVBPgvcggoH6prWgBQam50hVXTGaeoVYvDRODw2SYpELSYcoSVMUvICnqjZWa6zGUPln9MFJLwewPg7/ammUwSycB+GgL//+JO7BCWaV1xe0qy14FDLGltGE7UGY4+3X2L7C2DT+WrC7Q06UqBh1zL8Umlr7LsgpqYkN3k/JV/nQa7H3/mWH4z0KbEgIdK6QhhqVJ5QIBL+uLSUl6t0tfWHQiqRUx0WUNfx4fWwcRN4B1wcj+29q+3uPUuYdyeDI1JuNzjki+i9mD/J3YVgfPwtMf8y//3HirNqpDbzVeRaEO79EDG3XGhay7KwKvh9f/4E=
+    mendRnvWebhookSecret: AgAMHnF/jhGQU/wBolt6IZgSkHqKSvt4gma2K4Z0U+9btMgcmPxBvCLmfHVQCrU2r6/UQnYlVulPxglXkocIj0PKjVRodKXa71b+YuvsXv0/eM1Yk7MRJxZ7YCc9K8ZrocTLOodoUNc1RT4boXAETTbwGlusdKDly/r+k0835b2nKf2IS2XxnzeAHin6JkFDfIwW9S9M+qQdmklF7gwp0sFb/KdGg5LbsqHQGRRXGUW03DlhIAx5BnJHi8MvRISYom+IR2KFeDY08qT/DGZsZnPn8cXSPYuAULwKah7u1T8KcFt1nazrQUStXYPj+uA+sManHeU/2WLrMR6p95uD5uWpDFiOlk95qtrxpwIUaCOsuUmYcB0g9cDvIgf0AVjxNsbf4AZAmXjZ6I9fzz784mlCu6af/sitbsk37oXnAMeONlbJ2bY+D/AQ+MoICj2lVtszwPm/ez39NxgDzJ5ecOKYwJMqZj4RCskeZZMKPN9HWZe5v1kCLreaZZQyfb9zV7QbdU9GvLy7MDPlseKWUgp73hR7U0r/mVZO/U1O9UZmQs86egOdDbdqFl7xPf9izHq8a2+leXbYG7/4+SF9lGUUsfyI+VYDGyNCcypRj9JX2ZTvyn5dCUBqjyQCDY/3NegrzNRWYqY3l8+AT6xol8XFWjapE4o0Kwutt3vJ3pATOVa7CsFGyXAq/cuGUX7WiIpDocxRpv+oH6pzLZq+QuogQrUHWsvoI3U=
+    pgPassword: AgDcBMxSSp3+Bt75szCr5LdOyCUvkII7t5t95IhWKZipPCxxFfWumQ3lhJcuIc/m2hSCPXKTEveJ3H/91Wfw13FnkTqJLNQfvEIQ9LudH8qyfdqqXPNr+9GU++FvmUYBB6TlHJbZwLNWJCDqYdlCbYD+LNPU5KRRs6QCY/ZU85fW/aCb2D8787DEAu3ygI3CdaDePaGhS9QH1Lgz8ZE1pjRVyoBIr+2vQet8AbhxnLJybwfwA4U+qCs+QLkiMfYem6rPhjSU1JSIfdk69HXz0QO1+HKfTIFfMDXTg76rVmR5S0YDjJZVvGpP00/36YemYw9zfpsoH/th35bK2OMQOBE3PcxefWxT2lQR/WPdIULYbvMzNacSOP9z5Z4fpzSzTfB8b2Y/9sT0LD9x2jLbkgZDkmQrz/SOzwJ6axIEjr/BfthIOOgA3dJJ57jO7Q/vWnMWfHsMk6VcJgwYFWj5hRMxUNBtRwnDl5g0PIavP8OBNjROI63tKUjYFQ1eo3tGfI1e4IAnZVEOhVdBzdkKxGTBV3FYLznUVTsJd3M73inGHQpkPhjId+3ODlwC4CayHiJ3prLyGb/3304xLUJS89hEGgApmM0xuCLa8dTUCb2s/SPPTMueO7zHYwD9Q0qcu+gLQU5E3CuaWRh9FcwzRXdtxnfWX9Hzkp5ierls6mcVv/4f/DM4qxo92ZIpPnO/4NwWkch+G5Hqx2tzzfwfyhq+Nu1oyPjTQCI=
   template:
     metadata:
       annotations:
-        argocd.argoproj.io/sync-options: Prune=false
         sealedsecrets.bitnami.com/cluster-wide: "true"
-        sealedsecrets.bitnami.com/managed: "true"
       creationTimestamp: null
       name: renovate-secrets
-      namespace: renovate
+      namespace: argocd
     type: Opaque

resources/app-secrets/env/k3s-cluster/templates/sonarqube.yaml

@@ -1,15 +1,24 @@
-apiVersion: v1
-kind: Secret
+---
+apiVersion: bitnami.com/v1alpha1
+kind: SealedSecret
 metadata:
   annotations:
-    argocd.argoproj.io/sync-options: Prune=false
     sealedsecrets.bitnami.com/cluster-wide: "true"
-    sealedsecrets.bitnami.com/managed: "true"
   creationTimestamp: null
   name: sonarqube-secrets
   namespace: sonarqube
-type: Opaque
-stringData:
-  sonarqube-password: "UCGhDRhvdmVtFB7DNsG2"
-  smtp-password: "mqy2fmb8adu3nby.PDR"
-  password: "cAdF2VZVguE6bKK3Kmko"
+spec:
+  encryptedData:
+    password: AgCcaCPWG9uMaavrq1qu37M3y5zL0bHbarSWX1sf7uTTYjDVXgYcv6qB+OpMFn6tSGlgiiCvMZs9k/rXxrPSVSWZn3nvACF01s0V45LJu7aH4sgCSXdILN9kYMzoRNRE8BZFcvdELf07UfcIl3w/Lg2zNwkNpJqN0BFmcI+sxm1p7bjNdHuKQSqPgmUy5eJANU5gOVx6cGo3/W12LpVy/HeLbdq/BcYyB9cnJjG4JLwxOLuf1qWLqc336zk1KjuphCdhhnES8jaCpVlMdSHm+FNLuF259DbISP+Q8ReEAjb4Oo02kAldfQXvvSqoHPdFdGttdBn5kVMFEY2YNKkZh0xlMaW3sciZgtmazsMC71xwym4tfzRa2/R14hcLuQA5cs7dm/sXA/g616FPJuWpQvJ9IwSKzAKeZ7j9JTxvo530kz7EMs5HV9ebFNORhcrOOpEciBcpZ+4b+EvOmZ8LWZhetzJsmydssr9brgNJp08dSRuxsLr1jJRUzj0DHlu1vguQJz66S4XrdPgboWPXbCtQTb0Y4nb1EBxNkdLgNireTmpSNS7BXfk0pyW4PiQ++I4VF+26eib8rlIFVCnFCQgRsNAkBcAw8P1pNrj1DNLFkMi+iYiJqWK/PyFfTzQXry1W9yFxpMR8Y6w3xNTIfqWFSqGts5T0ua5JymbETKPpsJFYNmPI14LTAvgGLyxzg8zfZncHjcMCAGD+WRyRkNOpIlsRaw==
+    smtp-password: AgAWupYV/0gwgwnPyUQODkTfnf7nYRP9/GiNLF8ilUeOaHHGZRh7Jw5aZ0Tm93HZ+GKENOZxS+LTpo7ML1hMwia9rzqzgQobmHaPolqLSPa3EcdPaN5jSID7xsAZvylseAWayr6M+M7lOoC+YXqTXxx+i09Xg0OIDwHhzX2TpGPXc+S4CcSEnmQZR5pEhnfETKktRB2WhK2IXg5TyJlCrAUSrOoeAjQ9z1CwiLzwQvsLlIw1MHRk/xRy0pgpDZk0o2iKuWIjxlnPLPWqpia2cMcCfBW4xskONVxpVvIfdQqqpI7/fQ1vNKIQuoc5lSzrS757z+4VHRSYWlS6xlMOkShlEnPlP9b+RU0WioMR/AL8Zldt7tKTrNmZCl0zQSpiIQMFE2aRg1owI89ytoJFv738tVpMzscenI2llLXimiO2UA4kfg+VazFEe/vGFcnBnh1Bmb6sAIUpLvXl+gecqpq7uQqDUC4ZbbykJXUKt3waa+e022Q8qeQ3h/YfLdx4WKePzEBkyZJiu4bOcHLXsz5HWcsEWaJV8LB7z5uztOOmiYvlMisoK8G7HqI8bUTG9M7JL3thDIDkTT+OFwuUuukHIeyKu4wQPjP7/na9Ti/hw46t02C5C5ZqZoErpukMr7vHpF5vKr7ozpLDCMhjGDBlLPjnDWSX00QFsc7ft+AC3+Ap5Njy8kLh1fvodOLz3OlRLtd2955Hie7m/35E0Ru6Pyvb
+    sonarqube-password: AgDNzH+Syw1PBh8wmZtibfuSeCFHsWmNWF0VTHe/zHxUjhqxTxivGahkg9oqUagTBfWdhBPuFVZtbkAXmt4RYu7Qg0EcOeH+UBfurNSNKDKqeJ4nl+Jq6OJS9i1ELAkk0xos9QLxA9ADG/v8p9F9Nsy38z+M8gEi/nTVPqYWTjuuSDqGC09LzSdVo9YVKP1CRCYn4RKOts4q0oN9eQ5WigT8uHUbFOMryAxQY9qQkX8ouHX2VULxiIYALnhMQRMAPolUz52ekTgwQKq+QV/biG5X6ZErEcpLRbsIKT9rCNunKs3JP6VDZfqatKoyUqe6GLHnmZ0RaV8ed6PHMCKd4wSK4TsVVljOraUlIL6FYii/mKnCZsKvR4o8rHkKVmgtJn8lclGCOxxRrw7slZ/tqHnAJt8q9ux19WZAj1VnMKsa76MvasLCMTsMRpLVMbCgtU+NFytl2kTorR8de6iWoM5vc0aOnX3uL66y5K52cMc9aYGmHT1m0wNeWMfKSTYb8I60Bd1LS57GNXJxEuDFDzmkg7OUS6nA81mrZTRZHDXcCihD6BP3w4GhQFk68LW8dyNmhtARQROASx6jnEln2RoI2ob7BtvHW3KqDfemm8YezqZIRf00VyjpbxNIhoiXeTipp8e4Ib/UqWW+6PdTxVTndESBY3NtEE0XRfodrCcnliH85ETRngjBW7xEkFgPep5IXPQhreuKXzJFEDqky5IZ/cil2Q==
+  template:
+    metadata:
+      annotations:
+        argocd.argoproj.io/sync-options: Prune=false
+        sealedsecrets.bitnami.com/cluster-wide: "true"
+        sealedsecrets.bitnami.com/managed: "true"
+      creationTimestamp: null
+      name: sonarqube-secrets
+      namespace: sonarqube
+    type: Opaque

resources/app-volumes/env/k3s-cluster/templates/coder-pv.yaml

@@ -27,4 +27,8 @@ spec:
             - key: kubernetes.io/arch
               operator: In
               values:
-                - arm64
+                - arm64
+            - key: kubernetes.io/os
+              operator: In
+              values:
+                - linux

resources/app-volumes/env/k3s-cluster/templates/gitea-pv.yaml

@@ -27,4 +27,8 @@ spec:
             - key: kubernetes.io/arch
               operator: In
               values:
-                - arm64
+                - arm64
+            - key: kubernetes.io/os
+              operator: In
+              values:
+                - linux

resources/app-volumes/env/k3s-cluster/templates/jellyfin-config-pv.yaml

@@ -0,0 +1,25 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: jellyfin-config
+  namespace: jellyfin
+  labels:
+    type: local
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  capacity:
+    storage: 250Mi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  local:
+    path: "/mnt/nfs/AppData/jellyfin/config"
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/os
+              operator: In
+              values:
+                - linux

resources/app-volumes/env/k3s-cluster/templates/jellyfin-data-pv.yaml

@@ -0,0 +1,25 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: jellyfin-data
+  namespace: jellyfin
+  labels:
+    type: local
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  capacity:
+    storage: 2Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  local:
+    path: "/mnt/nfs/AppData/jellyfin/data"
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/os
+              operator: In
+              values:
+                - linux

resources/app-volumes/env/k3s-cluster/templates/logstash-data-pv.yaml

@@ -0,0 +1,30 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: logstash-data-pv
+  namespace: logstash
+  labels:
+    type: local
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  capacity:
+    storage: 16Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  local:
+    path: "/mnt/nfs/AppData/logstash/data"
+  claimRef:
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    name: logstash-data-pvc
+    namespace: logstash
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/os
+              operator: In
+              values:
+                - linux

resources/app-volumes/env/k3s-cluster/templates/logstash-data-pvc.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: logstash-data-pvc
+  namespace: logstash
+  labels:
+    name: logstash-data-pvc
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 16Gi

resources/app-volumes/env/k3s-cluster/templates/minio-pv.yaml

@@ -24,7 +24,7 @@ spec:
     required:
       nodeSelectorTerms:
         - matchExpressions:
-            - key: kubernetes.io/hostname
+            - key: kubernetes.io/os
               operator: In
               values:
-                - k3s-cluster-node-2
+                - linux

resources/app-volumes/env/k3s-cluster/templates/mongodb-pv.yaml

@@ -27,4 +27,8 @@ spec:
             - key: kubernetes.io/arch
               operator: In
               values:
-                - amd64
+                - amd64
+            - key: kubernetes.io/os
+              operator: In
+              values:
+                - linux

resources/app-volumes/env/k3s-cluster/templates/netdata-k8s-state-varlib-pv.yaml

@@ -0,0 +1,30 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: netdata-k8s-state-varlib-pv
+  namespace: argocd
+  labels:
+    type: local
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  capacity:
+    storage: 1Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  local:
+    path: "/mnt/nfs/AppData/netdata/k8s/state/varlib"
+  claimRef:
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    name: netdata-k8s-state-varlib
+    namespace: argocd
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/os
+              operator: In
+              values:
+                - linux

resources/app-volumes/env/k3s-cluster/templates/netdata-parent-alarms-pv.yaml

@@ -0,0 +1,30 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: netdata-parent-alarms-pv
+  namespace: argocd
+  labels:
+    type: local
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  capacity:
+    storage: 1Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  local:
+    path: "/mnt/nfs/AppData/netdata/parent/alarms"
+  claimRef:
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    name: netdata-parent-alarms
+    namespace: argocd
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/os
+              operator: In
+              values:
+                - linux

resources/app-volumes/env/k3s-cluster/templates/netdata-parent-database-pv.yaml

@@ -0,0 +1,30 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: netdata-parent-database-pv
+  namespace: argocd
+  labels:
+    type: local
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  capacity:
+    storage: 5Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  local:
+    path: "/mnt/nfs/AppData/netdata/parent/database"
+  claimRef:
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    name: netdata-parent-database
+    namespace: argocd
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/os
+              operator: In
+              values:
+                - linux

resources/app-volumes/env/k3s-cluster/templates/plane-redis-pv.yaml

@@ -0,0 +1,34 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: plane-redis-pv
+  namespace: plane
+  labels:
+    type: local
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  capacity:
+    storage: 5Gi
+  accessModes:
+    - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  local:
+    path: "/mnt/nfs/AppData/plane/redis"
+  claimRef:
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    name: plane-redis-pvc
+    namespace: plane
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+        - matchExpressions:
+            - key: kubernetes.io/arch
+              operator: In
+              values:
+                - arm64
+            - key: kubernetes.io/os
+              operator: In
+              values:
+                - linux

resources/app-volumes/env/k3s-cluster/templates/plane-redis-pvc.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: plane-redis-pvc
+  namespace: plane
+  labels:
+    name: plane-redis-pvc
+spec:
+  storageClassName: local-path
+  volumeMode: Filesystem
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi

resources/app-volumes/env/k3s-cluster/templates/plex-config-pv.yaml

@@ -27,4 +27,8 @@ spec:
             - key: kubernetes.io/arch
               operator: In
               values:
-                - amd64
+                - amd64
+            - key: kubernetes.io/os
+              operator: In
+              values:
+                - linux

resources/app-volumes/env/k3s-cluster/templates/postgresql-primary-pv.yaml

@@ -24,7 +24,7 @@ spec:
     required:
       nodeSelectorTerms:
         - matchExpressions:
-            - key: kubernetes.io/hostname
+            - key: kubernetes.io/os
               operator: In
               values:
-                - k3s-cluster-node-2
+                - linux

resources/app-volumes/env/k3s-cluster/templates/postgresql-replica-pv.yaml

@@ -24,7 +24,7 @@ spec:
     required:
       nodeSelectorTerms:
         - matchExpressions:
-            - key: kubernetes.io/hostname
+            - key: kubernetes.io/os
               operator: In
               values:
-                - k3s-cluster-node-2
+                - linux

resources/app-volumes/env/k3s-cluster/templates/redis-master-pv.yaml

@@ -24,7 +24,7 @@ spec:
     required:
       nodeSelectorTerms:
         - matchExpressions:
-            - key: kubernetes.io/hostname
+            - key: kubernetes.io/os
               operator: In
               values:
-                - k3s-cluster-node-2
+                - linux

resources/app-volumes/env/k3s-cluster/templates/redis-replica-pv.yaml

@@ -24,7 +24,7 @@ spec:
     required:
       nodeSelectorTerms:
         - matchExpressions:
-            - key: kubernetes.io/hostname
+            - key: kubernetes.io/os
               operator: In
               values:
-                - k3s-cluster-node-2
+                - linux