separate keys per app

.gitignore

@@ -1,2 +1,3 @@
 migration-from-old-files/
-migration-from-docker/
+migration-from-docker/
+.decrypted~secret.enc.yaml

.sops.yaml

@@ -1,4 +1,31 @@
 creation_rules:
-  - path_regex: .*\.enc\.yaml$
+  - path_regex: authelia.*\.enc\.yaml$
     encrypted_regex: ^(data|stringData)$
-    age: age14x4jjs2fwdgw28g2pkr6jyj2yzmwc544xwmaaglrxwz5e99seutqtr8jv5
+    age: age1ncw6uagcgncd5m2admqxt73ey0mcd99jsw9sa9lcdv3gu70mcerql8ya0k
+  - path_regex: davical.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age1yx8mey02c0mu6te9hwxwdqp5n4enjz35e8thchsmvhqw7xsrzy0syg367g
+  - path_regex: immich.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age1wmm8qrqnjzvd5nkraed6ylrsxlpn3ru7d7zettdudj7y9sg9dd2su0u3mr
+  - path_regex: markdown-vault-mcp.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age1kct5g7d7eus2hvdnmx99ewsrtz70lhlasxa25euqwdctqhwqqpxqz0n7gg
+  - path_regex: mosquitto.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age1u236u5mzkzj72y4mfxx68gfqw0u0j6tdgkudnm5pdfpe7apq4u6s89jr2h
+  - path_regex: vaultwarden.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age109zta6l0cwpkxn5wek82kvauxn6yqrq80rsz4mvu5atdnpcn9pusuvnqk5
+  - path_regex: webdav.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age1y8t9v56yuvskznddqfsd4yddzzch0yf2dutvvt8rrx6rjh5f9g0s3qeays
+  - path_regex: zigbee2mqtt.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age1tu4xgfefvgdda0vn2thaqndq4p9tuydq2ud6qa98tzzgnff6749qnlcx29
+  - path_regex: longhorn-system.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age18hhmdmupj90zjgjpxk3z5cf3lx36hcznnmqsp0fpyg50823pudrqjupydt
+  - path_regex: s3-backup-proxy.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age15vc3geq4lsec69rnxczluvwgcexeqae02zxzjpswsuatthaasu7qzath48

clusters/base/apps/authelia/helmrelease.yaml

@@ -17,7 +17,7 @@ spec:
           app:
             image:
               repository: authelia/authelia
-              tag: latest
+              tag: release-v4.39.21
             probes:
               liveness:
                 enabled: true

clusters/base/apps/authelia/secret.enc.yaml

@@ -8,14 +8,14 @@ stringData:
     users_database.yml: ENC[AES256_GCM,data:0jBFXM45dYodgP2eY1BYSFkjIBrj4Kd8tKaad6iC5MpvLf9fBldtEbMYbmRi2nRSLwO1vZTHB3/3x+KyDLQX9KteV2yMYGthcxvv+XNc8R43M0gfupclAINcnrUQctjSgOqkzTP9Io5K792x4mhDiQYEY0sLQcB8zZAL2yt3EVPNjyHVrMNYFHfQuc28Pl926gR3PchCkySEacIQNFNqgy+j424g5rexkLvbiOqonF2UoI51PApFuaBRqPsxDjyIp7jyP09SBetcP1b1WCDyeL/WsdQdZQT/BurYkep8gguz60j9N6G0ckz9O/4ZgFPJdg5UX7aWSXo0LlyZT1x5R5WpsDA2BALO1UTveExaC5vzi6/VbGocYvpMRjmnhmaOU/a4zBROEskywNjJhHhKUSKS99ef00ou6ZI4czuFA4/tDydyo1coQmRYVdArFiSUdtNI4ZF2fvXd8EIL/azsJYlslMxHYjUQOYHPIctb/tspXVnQqmJtbtaYGcMKv7n96d0Dl/fZD44AbCsVW43f7/s7204BBsYnXB/H3vXlmQ1/JVk9IX38kZGNF0hpNwe37FyP2FhrcaAYXyyELhkUP3TXLK1BzQTdIc9XmFm6VlGHTow5XXGaNmfwLE4qSImjpMerole43tl0XZgU57mOCw1AB96WmcLmqmtmUZ0utblut1ay2uuHsWWjnOn0DJd4qg8/YJ5EGEqECvEX3dFBTq+3+5+teOuDH1wlNYRm+pBHsic/6cl/rP9XOL7UBx+X/M6LllERlAjVn/E3X+ZB8JAmskISON6DAbvaGtA6jvqq5Vw3km1Km0kWFQxx/50LZP49buGR35vorHlmd1DH42OhsP78Se55Fy5H6Oz8bvh1f9cdBe/8UaI03Kwwf7Q2oIz/UB+cwBU/lte4oE4et1z6PRrOZgzrPwa44+BI8KAP0s7+C/2XfIcbw5046gJUK3Mo8md7yDDB4ximVIa++Lh93e5Df3pFbA4AUfgoigwIr8Mb0UaTJvQ93f/tYnQgcF8lJkFpOO28oA7n5MwmBq9wWMkhYGzJyUc3GIiAVPhuFmDDbxva0RtQ3on+IVjwm/YX6sAAuWyOzuqWjiX5bcYlaLAPwwAouqgMqdrM3+hls7VBXy6CvJ2HMdvvmmAec6BD0QzOjVcc71K/mgyuePrulDcQXP1s+YpCD7nMhQhFGskNtP3uabnv4lCLAaRoJisI88OxhJynk5Ifl62Yj2nRfNJuOWRtzPV7TjuetZNXEB4MAI403KS2n+BMeFJTpHBbZyaTHght/g1qT0ozN/FHXN3yj7g0LOTt83rO4JtNtvw4yDRIzercLrpwly8NW4R50kioeHJF+mPYUxMdQoEaG1yhEaJ9Jc876UFXiOun+w/om4hNeML34CJDsjz3L3y/gOQFo+bBqtrhBw1jDhR2H3vypbU2FBcc3eBQVWNHURIlLZ6HKO+djUpImunYcPoRWtO1vd7rc4IaMNGME2B5Dc6liYLWIQL0+sOEzAxzpwaC9va7yKY0CxSCETxxoJopXthCyDxTmrLD3itD02lcmKwe6zpAx1grSqp3RbGV+Uo/27C6hIiTm8NjfNKvZ9+iZcX2dH/qPBPo+EOzaspwJzjds9AaCVfa/KmUYPbs+WdQmzXXzc+OeYKeUSwSt6LhKED0HscFrw9CUxBkPdfqXiC2jVQT3HUkeg0JgBuFMC+phOLl+HQF8jNTSQ==,iv:0hzOhnHbAQMTa/4ar++tfFpderZGkTtMVTDu4pHbOgU=,tag:8KC2KhYMoS2UNzlSle1Cqw==,type:str]
 sops:
     age:
-        - recipient: age14x4jjs2fwdgw28g2pkr6jyj2yzmwc544xwmaaglrxwz5e99seutqtr8jv5
+        - recipient: age1ncw6uagcgncd5m2admqxt73ey0mcd99jsw9sa9lcdv3gu70mcerql8ya0k
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4NG4vTEhyeDIxd0M4UE53
-            Q0xIdzY3aVVmaE9HYlRwODJ3aHI1OXZMV1VnCjdFdkdibVkzR1JGOVBITmVGbFdo
-            RVpqTDlrc0tTYkdjUXE0Zk9KckxwUzgKLS0tIC9oOHJTbG1iMzJjZlRaUDlnc0tv
-            ZldqTGtiWFFKRGRZRnJkVitCTDBuK2sK/Jnc/sA77mZxWMpHLh6CSvgFICZIjTQu
-            /3ipR7IVtYYVXDJj9g0pGuGMsBeuHYlZG/7hJHKyTj/aDYlibbPUKw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBydWxoMG45a2RyanVNa2Ny
+            Zy8wRkcxSDd5K0RHckQyUzBmeWhWd1piZVFNCkQ0ekQxNjU5MUxtaGF2Wk1QdUJW
+            bzZza0RjVXhIZVBySkptOVJ6VFFQMGcKLS0tIEp4Mm83Yk5hUTY1U3A4VWh0YXR2
+            QlNCT0ZMWkwzWkUxdHY1Wmx4OHlPQmsKveUBGibc7hfoIEribfzYXfYiWOUNo+WO
+            2OuIbrM/YJlSFUtG6zVSJRkII22V7QOk302HvC/X+65jK5KJyDo+jg==
             -----END AGE ENCRYPTED FILE-----
     lastmodified: "2026-08-01T16:28:12Z"
     mac: ENC[AES256_GCM,data:E3w5jKZOu+Ab/NRfF2Frr4op7rdqAXsFTW1hrDe8CCpusMbP9PDllUqeWr/nrsgAAIydNW+N75ye1uBkW+E4scCF5uzqwRIDbOjcpiRAcZ9fMdNL2M72+SFIVirexxvC9PK45Kn9T4K2aYrCS1D7eFMIO2TCy3XL5W0tfqbuBis=,iv:/iLJtY3pzLa+AkgM9niSFYz1v29wFqbSe3h0dPto430=,tag:ChCgvHRKoTBEysuYHHgMaw==,type:str]

clusters/base/apps/davical/helmrelease-davical.yaml

@@ -0,0 +1,118 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: davical
+  namespace: pim
+spec:
+  interval: 10m
+  dependsOn:
+    - name: davical-postgres
+  chartRef:
+    kind: OCIRepository
+    name: davical
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      app:
+        initContainers:
+          seed-config:
+            image:
+              repository: tuxnvape/davical-standalone
+              tag: "82-1.1.12"
+            command:
+              - sh
+              - -c
+              - |
+                if [ ! -f /mnt/config-pvc/davical.php ]; then
+                  cp -r /config/. /mnt/config-pvc/
+                fi
+                # Apache's SCRIPT_NAME (and DAViCal's base_url derived from it)
+                # only reflects the /server prefix if Apache itself resolves
+                # that prefix - Traefik forwards the path unstripped. Add an
+                # Alias so /server/* maps to the app root; idempotent so it
+                # self-heals if apache.conf predates this fix.
+                if ! grep -q '^\s*Alias /server ' /mnt/config-pvc/apache.conf; then
+                  sed -i '/^\s*DocumentRoot \/usr\/share\/davical\/htdocs/a\        Alias /server /usr/share/davical/htdocs' /mnt/config-pvc/apache.conf
+                fi
+        containers:
+          app:
+            image:
+              repository: tuxnvape/davical-standalone
+              tag: "82-1.1.12"
+            env:
+              TZ: Europe/Moscow
+              HOST_NAME: c.aggtaa.com
+              DBHOST: davical-postgres
+              UPDATE_FROM_OLD: "false"
+              PGSQL_ROOT_PASS:
+                valueFrom:
+                  secretKeyRef:
+                    name: davical-secrets
+                    key: PGSQL_ROOT_PASS
+              PASSDAVDB:
+                valueFrom:
+                  secretKeyRef:
+                    name: davical-secrets
+                    key: PASSDAVDB
+              ADMINDAVICALPASS:
+                valueFrom:
+                  secretKeyRef:
+                    name: davical-secrets
+                    key: ADMINDAVICALPASS
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+              startup:
+                enabled: true
+                spec:
+                  periodSeconds: 5
+                  failureThreshold: 30
+                  timeoutSeconds: 3
+
+    service:
+      app:
+        controller: app
+        ports:
+          http:
+            port: 80
+
+    ingress:
+      app:
+        className: traefik
+        # no cert-manager annotation here: infcloud's own Ingress already
+        # requests/owns the Certificate for c.aggtaa.com -> radicale-tls.
+        # A second Ingress with the annotation would create a competing
+        # Certificate for the same host/secret.
+        #
+        # No stripPrefix middleware either: Apache needs to see the /server
+        # prefix itself (via the Alias added in the seed-config initContainer)
+        # so that DAViCal's self-referential links come out correct.
+        hosts:
+          - host: c.aggtaa.com
+            paths:
+              - path: /server
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: radicale-tls
+            hosts:
+              - c.aggtaa.com
+
+    persistence:
+      config:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 256Mi
+        storageClass: longhorn
+        retain: true
+        advancedMounts:
+          app:
+            app:
+              - path: /config
+            seed-config:
+              - path: /mnt/config-pvc

clusters/base/apps/davical/helmrelease-postgres.yaml

@@ -0,0 +1,45 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: davical-postgres
+  namespace: pim
+spec:
+  interval: 10m
+  chartRef:
+    kind: OCIRepository
+    name: davical
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      postgres:
+        containers:
+          app:
+            image:
+              repository: postgres
+              tag: "16.14-alpine"
+            env:
+              TZ: Europe/Moscow
+              POSTGRES_PASSWORD:
+                valueFrom:
+                  secretKeyRef:
+                    name: davical-secrets
+                    key: PGSQL_ROOT_PASS
+
+    service:
+      app:
+        controller: postgres
+        ports:
+          postgres:
+            port: 5432
+
+    persistence:
+      data:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 2Gi
+        storageClass: longhorn
+        retain: true
+        globalMounts:
+          - path: /var/lib/postgresql/data
+            subPath: data

clusters/base/apps/davical/helmrepository.yaml

@@ -1,7 +1,7 @@
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: OCIRepository
 metadata:
-  name: baikal
+  name: davical
   namespace: pim
 spec:
   interval: 10m

clusters/base/apps/davical/kustomization.yaml

@@ -3,7 +3,5 @@ kind: Kustomization
 resources:
   - helmrepository.yaml
   - secret.enc.yaml
-  - configmap.yaml
-  - middleware.yaml
-  - helmrelease-radicale.yaml
-  - helmrelease-agendav.yaml
+  - helmrelease-postgres.yaml
+  - helmrelease-davical.yaml

clusters/base/apps/davical/secret.enc.yaml

@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: davical-secrets
+    namespace: pim
+stringData:
+    PGSQL_ROOT_PASS: ENC[AES256_GCM,data:XEhP2zDIz0QCpAXXnZi5JtPsVIfns9zp4fvxcg9/bskHiLU5rR+EgU5n/SdOEDkJ,iv:wR3CGk3csHSCSBqFX+ukOUAmS/p+oZMmdNgvCFNHZlI=,tag:ttAe0GuLmwqA77cWLlne2Q==,type:str]
+    PASSDAVDB: ENC[AES256_GCM,data:d9RazQG7xeIH4g3ovti6HwyiIyLTzyaPjAcQvLmhsrwdgev7i0AJK7yQeRXxu/16,iv:9ZdfWTlOuyUNpV2ycykOgx8SY7Golz7/Lb+gfTa9fW0=,tag:eL1euF9uQJ+nDLsR1kxtvg==,type:str]
+    ADMINDAVICALPASS: ENC[AES256_GCM,data:1Zq7duPTIfJX2Stp6AEhKcLHkmQB6vWf4y1f0Iju/zI=,iv:PMOyD3O7UzVPRlFmHTOQSAys032iD4CF8JbI51agWcg=,tag:eDgMbg2lRMnl57NCf5iIkw==,type:str]
+sops:
+    age:
+        - recipient: age1yx8mey02c0mu6te9hwxwdqp5n4enjz35e8thchsmvhqw7xsrzy0syg367g
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjNTVJZEFuRFhGazF6T1Yv
+            dnhhTHVUb1h4SEN2eEtDUGREUERkR2wrTUVVCktGSkVLZmlYR3BjekhjNmk4L3Q4
+            UEJsQXJjZXY1VlNDaFV2eER4NTdwRGcKLS0tIDJxb1AyYm01YlNUVk93Tm1Hb0xK
+            NVh0K25yOFUya0dYSGt2SGdJQURnQ2sKaKgwThB5ePeM091/zYgQXmiPeBeIhTdo
+            60PkAPNs659xyVqnlZw2YKEhxbEHS3ZMTBgC4tgng0yjClBizcTv5w==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-08T16:37:01Z"
+    mac: ENC[AES256_GCM,data:OoE6fml/3DSH2EMafCoeYz/JHo89Fb9uwQ58k7hxQDU6YMazdO/eGM0jKX5ghjuMKJqA/zQs4FeZ4yASkIUT1CBbxRpycmE9qo6Zny121NLeqveBp3YMjmUZGt3tgw2dNqtkhpOnl/BmHQCtTTvX2brtSVmANx3LbFxjqbK2OGM=,iv:8Us7LJSZ2aHZQnYIjnsvkR7Av0KeHFEYEETZd7WZX4Q=,tag:7NbbEOq1k2c5IcsnqpvlOQ==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

clusters/base/apps/fava/helmrelease.yaml

@@ -29,7 +29,7 @@ spec:
           app:
             image:
               repository: yegle/fava
-              tag: latest
+              tag: "v1.30"
             env:
               TZ: Europe/Moscow
               BEANCOUNT_FILE: /documents/main.beancount

clusters/base/apps/fava/pv-pvc-documents.yaml

@@ -13,7 +13,7 @@ spec:
     - nfsvers=4.1
   nfs:
     server: 10.0.64.5
-    path: /exports/shared/documents/accounting
+    path: /export/accounting
   claimRef:
     namespace: finance
     name: fava-documents

clusters/base/apps/immich/helmrelease-ml.yaml

@@ -0,0 +1,54 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: immich-ml
+  namespace: photo
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: immich
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      ml:
+        containers:
+          app:
+            # CPU-only: hardware-accelerated tags (-openvino, -cuda, etc)
+            # need specific host devices (e.g. /dev/dri) that aren't set up
+            # on these nodes. Switch tags later if that changes.
+            image:
+              # pinned to match immich-server's version (see
+              # helmrelease-server.yaml) - server and ML communicate over
+              # an internal API contract that isn't guaranteed compatible
+              # across versions.
+              repository: ghcr.io/immich-app/immich-machine-learning
+              tag: v3.1.0
+            env:
+              TZ: Europe/Moscow
+            resources:
+              requests:
+                cpu: 500m
+                memory: 512Mi
+              limits:
+                memory: 4Gi
+
+    service:
+      app:
+        controller: ml
+        ports:
+          http:
+            port: 3003
+
+    persistence:
+      # caches downloaded ML models so they survive pod restarts instead of
+      # re-downloading (a few hundred MB) every time.
+      cache:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 10Gi
+        storageClass: longhorn-single-replica
+        retain: true
+        globalMounts:
+          - path: /cache

clusters/base/apps/immich/helmrelease-postgres.yaml

@@ -0,0 +1,70 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: immich-postgres
+  namespace: photo
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: immich
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      postgres:
+        containers:
+          app:
+            # immich requires this specific image - it bundles the
+            # vectorchord/pgvecto.rs extensions immich's DB schema depends
+            # on; a plain postgres image will not work.
+            image:
+              repository: ghcr.io/immich-app/postgres
+              tag: 14-vectorchord0.4.3-pgvectors0.2.0
+            env:
+              TZ: Europe/Moscow
+              POSTGRES_USER: postgres
+              POSTGRES_DB: immich
+              POSTGRES_INITDB_ARGS: "--data-checksums"
+              POSTGRES_PASSWORD:
+                valueFrom:
+                  secretKeyRef:
+                    name: immich-secrets
+                    key: DB_PASSWORD
+            resources:
+              requests:
+                cpu: 100m
+                memory: 256Mi
+              limits:
+                memory: 2Gi
+
+    service:
+      app:
+        controller: postgres
+        ports:
+          postgres:
+            port: 5432
+
+    persistence:
+      data:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 10Gi
+        storageClass: longhorn
+        retain: true
+        globalMounts:
+          # subPath, not the raw mount root: a fresh Longhorn ext4 volume's
+          # root always contains a "lost+found" dir, and postgres's initdb
+          # refuses to initialize into a non-empty directory even when
+          # lost+found is the only thing in it.
+          - path: /var/lib/postgresql/data
+            subPath: data
+      # postgres' parallel query workers need real shared memory, not the
+      # default 64Mi container tmpfs - matches shm_size: 128mb in the
+      # original docker-compose.
+      dshm:
+        type: emptyDir
+        medium: Memory
+        sizeLimit: 128Mi
+        globalMounts:
+          - path: /dev/shm

clusters/base/apps/immich/helmrelease-redis.yaml

@@ -0,0 +1,33 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: immich-redis
+  namespace: photo
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: immich
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      redis:
+        containers:
+          app:
+            image:
+              repository: docker.io/valkey/valkey
+              tag: "9.1.1"
+            resources:
+              requests:
+                cpu: 20m
+                memory: 32Mi
+              limits:
+                memory: 256Mi
+
+    service:
+      app:
+        controller: redis
+        ports:
+          redis:
+            port: 6379

clusters/base/apps/immich/helmrelease-server.yaml

@@ -0,0 +1,235 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: immich-server
+  namespace: photo
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: immich
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      server:
+        strategy: Recreate
+        podDisruptionBudget:
+          maxUnavailable: "0"
+        initContainers:
+          fix-permissions:
+            image:
+              repository: hectorm/nfs-ganesha
+              tag: v10
+              # hectorm does not publish exact versions, v10.0 digest is 93df70b78...
+              digest: sha256:93df70b78aae56957f4a4f5c606c4250d84b729435f76132dca07b7290f5bfce
+            command:
+              - sh
+              - -c
+              - chmod -R a+rwX /disks/library-recent /disks/library-archive
+          # native sidecar (restartPolicy: Always): mounts the two library
+          # disks and exposes their union at /disks/merged-library via
+          # FUSE. It must be up and actually mounted *before* the "app"
+          # container is created, since HostToContainer propagation only
+          # relays mounts made *after* the receiving container's own mount
+          # exists - it won't retroactively pick up a FUSE mount that's
+          # already there. Running it as a restartPolicy:Always init
+          # container (started, gated on the startupProbe below, before
+          # regular containers) guarantees that ordering; a regular sidecar
+          # container racing "app" on every pod start does not.
+          mergerfs:
+            dependsOn:
+              - fix-permissions
+            restartPolicy: Always
+            image:
+              repository: ghcr.io/hotio/mergerfs
+              tag: release-v2.42.0
+            args:
+              - "-o"
+              # library-recent listed first: category.create=ff means new
+              # files created through the merged mount (i.e. new immich
+              # uploads going forward) land on library-recent by default,
+              # which is exactly what's wanted for freshly-uploaded photos.
+              - "allow_other,use_ino,func.create=ff,category.action=all,category.create=ff,category.search=newest"
+              - "/disks/library-recent:/disks/library-archive"
+              - "/disks/merged-library"
+            securityContext:
+              privileged: true
+            probes:
+              startup:
+                enabled: true
+                custom: true
+                spec:
+                  exec:
+                    command:
+                      - sh
+                      - -c
+                      - grep -q fuse.mergerfs /proc/mounts
+                  periodSeconds: 1
+                  timeoutSeconds: 2
+                  failureThreshold: 30
+            resources:
+              requests:
+                cpu: 50m
+                memory: 64Mi
+              limits:
+                memory: 512Mi
+        containers:
+          app:
+            image:
+              repository: ghcr.io/immich-app/immich-server
+              # make sure immich-machine-learning version match this 
+              tag: v3.1.0
+            env:
+              TZ: Europe/Moscow
+              DB_HOSTNAME: immich-postgres
+              DB_PORT: "5432"
+              DB_USERNAME: postgres
+              DB_DATABASE_NAME: immich
+              DB_PASSWORD:
+                valueFrom:
+                  secretKeyRef:
+                    name: immich-secrets
+                    key: DB_PASSWORD
+              REDIS_HOSTNAME: immich-redis
+              REDIS_PORT: "6379"
+              IMMICH_MACHINE_LEARNING_URL: http://immich-ml:3003
+            probes:
+              # first boot runs DB migrations + vector index setup, which
+              # can take a while - without a startup probe the default
+              # liveness probe (periodSeconds=10, failureThreshold=3) kills
+              # the container ~30s in, well before it's finished binding
+              # the port, causing an endless restart loop.
+              startup:
+                enabled: true
+                spec:
+                  periodSeconds: 5
+                  failureThreshold: 60
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+            resources:
+              requests:
+                cpu: 200m
+                memory: 512Mi
+              limits:
+                memory: 4Gi
+
+    service:
+      app:
+        controller: server
+        ports:
+          http:
+            port: 2283
+
+    ingress:
+      app:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: photo.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: immich-tls
+            hosts:
+              - photo.aggtaa.com
+
+    persistence:
+      # Immich's "library" folder, mergerfs-merged from two disks: recent
+      # files (per the rsync migration's cutoff) and everything else.
+      # New uploads going forward land on library-recent (see mergerfs
+      # category.create above). Not reusing the old single 800Gi library
+      # PVC/PV - this replaces it (that PVC becomes orphaned, retained,
+      # and unused; clean it up separately if no longer wanted).
+      library-recent:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 200Gi
+        storageClass: longhorn-single-replica
+        retain: true
+        advancedMounts:
+          server:
+            mergerfs:
+              - path: /disks/library-recent
+            fix-permissions:
+              - path: /disks/library-recent
+      library-archive:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 500Gi
+        storageClass: longhorn-single-replica
+        retain: true
+        advancedMounts:
+          server:
+            mergerfs:
+              - path: /disks/library-archive
+            fix-permissions:
+              - path: /disks/library-archive
+      merged-library:
+        type: emptyDir
+        advancedMounts:
+          server:
+            mergerfs:
+              - path: /disks/merged-library
+                mountPropagation: Bidirectional
+            app:
+              - path: /data/library
+                mountPropagation: HostToContainer
+      dev-fuse:
+        type: hostPath
+        hostPath: /dev/fuse
+        advancedMounts:
+          server:
+            mergerfs:
+              - path: /dev/fuse
+      # split out of the old combined "other" volume below: each of these
+      # purposes now gets its own Longhorn volume instead of sharing one
+      # 200Gi disk, so a single hot subtree (e.g. thumbs) doesn't force
+      # replica rebuilds/relocation to drag the whole 200Gi with it.
+      data:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 20Gi
+        storageClass: longhorn
+        retain: true
+        advancedMounts:
+          server:
+            app:
+              - path: /data
+      encoded-video:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 100Gi
+        storageClass: longhorn
+        retain: true
+        advancedMounts:
+          server:
+            app:
+              - path: /data/encoded-video
+      thumbs:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 100Gi
+        storageClass: longhorn
+        retain: true
+        advancedMounts:
+          server:
+            app:
+              - path: /data/thumbs
+      backups:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 30Gi
+        storageClass: longhorn
+        retain: true
+        advancedMounts:
+          server:
+            app:
+              - path: /data/backups

clusters/base/apps/immich/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: immich
+  namespace: photo
+spec:
+  interval: 1h
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/immich/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - secret.enc.yaml
+  - helmrelease-postgres.yaml
+  - helmrelease-redis.yaml
+  - helmrelease-ml.yaml
+  - helmrelease-server.yaml

clusters/base/apps/immich/secret.enc.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: immich-secrets
+    namespace: photo
+stringData:
+    DB_PASSWORD: ENC[AES256_GCM,data:+bJ/+NEQCT3ZEqjnkzep4OsbLkJ9gyLZmGxCpoww2Wo=,iv:n1sLYgLl3zNZBdjMBhIrbSv/qHJFQ/nvZfBknFAUdug=,tag:DFnoc5K6XvHngVIrgJlM6Q==,type:str]
+sops:
+    age:
+        - recipient: age1wmm8qrqnjzvd5nkraed6ylrsxlpn3ru7d7zettdudj7y9sg9dd2su0u3mr
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtd1hFZy82d0c0RXZMd28r
+            dWs1VWNlVG9tTE5WZDVLdGpFSXhuVXQ5anprCk5LWWMrWUVCd1N4Y1JENnRyWExC
+            d2VRNDJON2RzSHRyMGhRdmMva1NNY3cKLS0tIDNML2Q0YXFRMEs3V3prUkZYSS85
+            MWRGa3duNHgvbjNvVnZLOXpYMW1mbGcKaN7h3W0YKsRjnyk6P9+bziDy6If5xLQ8
+            kxFJf4CX9XU5jgYXqw2UNqRDusphclqfULUMRaEzMJkkPhd1cZ9PvQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-21T12:23:20Z"
+    mac: ENC[AES256_GCM,data:vGSUhl73AIQr1Ld1SHc+i4GpvOc0b0j8Vx9DmoRDjNs17TQSfmfulEZwIua12P5DHIz36P9yqggHfSyyrrEoMjfaUSTIDxCIGGvsfTl4vBt9Vis0e2gALaHtAgWZwxr5QMe+OP1tkXOZoX9E8VcoBq1ULvbIjqsPs2uxPVKsEWk=,iv:1exDUqurlFdBt1eZYWWMlkar75HbTLZ6RZelC0RsYcU=,tag:A0IhJHjVum2HBT5RwHo5qg==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

clusters/base/apps/infcloud/helmrelease-infcloud.yaml

@@ -1,23 +1,23 @@
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
-  name: radicale
+  name: infcloud
   namespace: pim
 spec:
   interval: 10m
   chartRef:
     kind: OCIRepository
-    name: radicale
+    name: infcloud
   driftDetection:
     mode: enabled
   values:
     controllers:
-      radicale:
+      infcloud:
         containers:
           app:
             image:
-              repository: tomsquest/docker-radicale
-              tag: "3.7.6.0"
+              repository: waja/infcloud
+              tag: "0.13.1-16"
             probes:
               liveness:
                 enabled: true
@@ -26,21 +26,26 @@ spec:
 
     service:
       app:
-        controller: radicale
+        controller: infcloud
         ports:
           http:
-            port: 5232
+            port: 80
 
     ingress:
       app:
         className: traefik
+        # this ingress owns the cert-manager request for c.aggtaa.com
+        # (secret kept as "radicale-tls" post-migration so the existing,
+        # already-valid cert is reused instead of re-issued). davical's
+        # ingress just references the same secret without its own
+        # annotation - a second annotated Ingress would create a
+        # competing Certificate for the same host/secret.
         annotations:
           cert-manager.io/cluster-issuer: letsencrypt-prod
-          traefik.ingress.kubernetes.io/router.middlewares: pim-radicale-stripprefix@kubernetescrd,pim-radicale-headers@kubernetescrd
         hosts:
           - host: c.aggtaa.com
             paths:
-              - path: /server
+              - path: /
                 pathType: Prefix
                 service:
                   identifier: app
@@ -53,26 +58,8 @@ spec:
     persistence:
       config:
         type: configMap
-        name: radicale-config
+        name: infcloud-config
         globalMounts:
-          - path: /config/config
-            subPath: config
+          - path: /srv/infcloud/config/config.js
+            subPath: config.js
             readOnly: true
-          - path: /config/rights
-            subPath: rights
-            readOnly: true
-      users:
-        type: secret
-        name: radicale-secrets
-        globalMounts:
-          - path: /config/users
-            subPath: users
-            readOnly: true
-      data:
-        type: persistentVolumeClaim
-        accessMode: ReadWriteMany
-        size: 1Gi
-        storageClass: longhorn
-        retain: true
-        globalMounts:
-          - path: /data

clusters/base/apps/infcloud/helmrepository.yaml

@@ -1,7 +1,7 @@
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: OCIRepository
 metadata:
-  name: radicale
+  name: infcloud
   namespace: pim
 spec:
   interval: 10m

clusters/base/apps/infcloud/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - configmap.yaml
+  - helmrelease-infcloud.yaml

clusters/base/apps/markdown-vault-mcp/helmrelease.yaml

@@ -17,7 +17,7 @@ spec:
           app:
             image:
               repository: ghcr.io/pvliesdonk/markdown-vault-mcp
-              tag: latest
+              tag: "v3.1.0"
             env:
               MARKDOWN_VAULT_MCP_SOURCE_DIR: /vault
               MARKDOWN_VAULT_MCP_INDEX_PATH: /data/state/index.db
@@ -44,6 +44,16 @@ spec:
                     name: markdown-vault-mcp-secrets
                     key: BEARER_TOKEN
             probes:
+              # first boot downloads embedding models from HuggingFace Hub
+              # and builds the vector index/embeddings before binding the
+              # port - the default liveness probe budget (periodSeconds=10,
+              # failureThreshold=3 = 30s) isn't enough, so it gets killed
+              # mid-startup on every restart, in an endless loop.
+              startup:
+                enabled: true
+                spec:
+                  periodSeconds: 5
+                  failureThreshold: 36
               liveness:
                 enabled: true
               readiness:

clusters/base/apps/markdown-vault-mcp/pv-pvc-vault.yaml

@@ -13,7 +13,7 @@ spec:
     - nfsvers=4.1
   nfs:
     server: 10.0.64.5
-    path: /exports/shared/documents
+    path: /export
   claimRef:
     namespace: mcp
     name: markdown-vault-mcp-vault

clusters/base/apps/markdown-vault-mcp/secret.enc.yaml

@@ -9,14 +9,14 @@ stringData:
     OIDC_JWT_SIGNING_KEY: ENC[AES256_GCM,data:63S/0TsEis959MJRLd5atPXQrv5pNMC5iyMHJvT67luLLPkd2bdgfmX4Pu7R3Hr5YIGoujn1/xCuOdZH0RtIog==,iv:3Gi2ZukSzU9SIy7fPzmlvWbA4ykaNgta95DuviHf5zk=,tag:BPUXUPMIxW9kbyyQqoz0gQ==,type:str]
 sops:
     age:
-        - recipient: age14x4jjs2fwdgw28g2pkr6jyj2yzmwc544xwmaaglrxwz5e99seutqtr8jv5
+        - recipient: age1kct5g7d7eus2hvdnmx99ewsrtz70lhlasxa25euqwdctqhwqqpxqz0n7gg
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxaG5NRStTVXlIMklDSjI4
-            cUJxOGxuSWxrM2FQQWhkUjZsUEtXT1BzTmpFCkdnWHFUQlRGdGtjRWUrcUFUT05R
-            SDcxWi9SOTlIT2RCL0c1ZExuUXp5NDgKLS0tIG9EVi9WMW81bzd2REpzc1ZFK1JE
-            cTVIVVdTSkt4MXRYNHlDZVMrQkpBNUkK9uaUyjPZaFyWbxrZpEVgzOSw+1pWX/rF
-            tu0eoMSzf0w9l/zSiBAAQeCd1jnLp1LDw4eZKiYZ9DF5P0AclVT4Lg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPOVJCaXpjeUEzWkN4SEdz
+            RnFkZmtXa0IwaE9xdGtBdVRwV1B5MkdDbVMwCmVYeUJpQmQwZ29BbnRPK1AzWGJx
+            NHV0NnRxenRWV2M4MytrZ3llNmxaMzQKLS0tIHVOcDVyTDkrNHJRMkhRVzFPSGpW
+            V1RRNTdiUTBjSWZlMlEvRXF3OUowZ00KXf/+ucgZuDAczE1WlEW7D2/cR+sB66BQ
+            7JC42VJiyEf2djlODmvK26bDTeiJ/Uk9HsSuvamGUM8b8vAj2w/r/A==
             -----END AGE ENCRYPTED FILE-----
     lastmodified: "2026-07-27T06:42:40Z"
     mac: ENC[AES256_GCM,data:XRxbyHL4iJMoRMb4X6C2y1ChTNSkqou01bwtIb6zNfwcGCt7uMGbm1HxvmjbdeJI/zQIIVfgxbbTxhZw+sL2FF+PYAjPcaGvaJ86O97lr9fUB30NC0tMluW82pt2iiisK+6dEEPH9i/kGFrJHN6RlaYVkEfv6U8xjlpIcaNx0+A=,iv:YnqMRlHl1WVYNqqN9hRH88hgIALrfgv6WrJGyeNDstI=,tag:M1DYFr3G9ub/R2kNF8ZnNQ==,type:str]

clusters/base/apps/mosquitto/chart/values.yaml

@@ -1,6 +1,6 @@
 image:
   repository: eclipse-mosquitto
-  tag: "2"
+  tag: "2.1.2-alpine"
   pullPolicy: IfNotPresent
 
 # not really needed, as StatefulSet has hardcoded "replicas: 1"

clusters/base/apps/mosquitto/helmrelease.yaml

@@ -18,7 +18,7 @@ spec:
   values:
     image:
       repository: eclipse-mosquitto
-      tag: "2"
+      tag: "2.1.2-alpine"
       pullPolicy: IfNotPresent
 
     replicaCount: 1

clusters/base/apps/mosquitto/secret.enc.yaml

@@ -7,16 +7,16 @@ stringData:
     passwd: ENC[AES256_GCM,data:YpTczjZ73h4Td+TmEZIgil9DN7WfVwBsi75F/t3D1oWGjGsifklnRsZUJqXiXyUwIxTxlFiWgfb01LjmILE0nB9rxoEbFdrASaLgtnCoYz/fvSZLqwCK+FSSub3+r0nJTNvxzD+bC/av8JEPNDW/8CSrHMrTrVCcLhAchOAvviRLgO18862XWcvPh1plO8luaZG38cuh+VbKKwidkwozc6B7Ghys5NfZuB1rP4vLZ6/f1PzcFRugtJ0fzzl/BA==,iv:9FKm4V/lYXott/6aVBKg4g8GtzVqgT/xndj0CKqMm+Y=,tag:41gCVbrK6Rp2IvVUt98Hpw==,type:str]
 sops:
     age:
-        - enc: |
+        - recipient: age1u236u5mzkzj72y4mfxx68gfqw0u0j6tdgkudnm5pdfpe7apq4u6s89jr2h
+          enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMZ0xBSDQrY01xRDhwbkJp
-            STd0SG9MSFF2eURhVGtOS0ZyNmNrV1VqNW5vCm9kTDZWSDU1NkpoWitPNW4yY1Zj
-            M01yYkRGYkxLaGpIOG45ZG9Vb3VIeGMKLS0tIFA2L0FseTZNUERuTXRXcEI1bkhv
-            UGZha2lMZDZDbHhZdEdPYnNiTUJVNmsKRXTg0i7XdYVSZWrFww3SzJOYsU/4ZXoW
-            Xs1vTTO5DP5qIfLbAQUGr/jg7uu6Wm4zFCOZIURqXxU2Ws/W/3J3Wg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBobk1BQW0yemEzV1FQM2ZJ
+            YkZJbjJPZlRiSDlyamx1WVdyNTJBNXo1YlQwCnhBT01SeE0rZDVOcFRkZm9KQ0t2
+            dUIyOHpzenVZc3lsa2hmMjF3LzRGMFUKLS0tIENmM05Ud2xGblNpdjZjWWFPeWg3
+            UEtuZWZ5enkwSGk0MXR1czBibzQ1M2sKfp+76C0X2DgsffWZVtBevI4lCs8RM09p
+            tzsrneX4iIX6WCn1kRLsWTZpN6Vg8Wsl6kUWnSA3WfHWI9W4CJdrag==
             -----END AGE ENCRYPTED FILE-----
-          recipient: age14x4jjs2fwdgw28g2pkr6jyj2yzmwc544xwmaaglrxwz5e99seutqtr8jv5
-    encrypted_regex: ^(data|stringData)$
     lastmodified: "2026-07-21T19:09:49Z"
     mac: ENC[AES256_GCM,data:qecTVUaC/3j/oP1DVnXEKV9Ub+k5gvGHfteol4W5I3gq8IB2YYZ+vfuinPVJJeSsN5HvK62ftnIgRNu0dtzDOrnuZENczEMwPrOz90RCUbX7WBeKh23KZ8gSSw2MBn6gsDsz1gXFWENIyjQTJFZ4qAJY6jfeH2IFC9RkpoU3j14=,iv:ksLG/aHHBAkl6aA52Xufs2vijZlpsaXccoxheYV3Gm4=,tag:4YiaPGMBWSWhVBO1tNF6vQ==,type:str]
+    encrypted_regex: ^(data|stringData)$
     version: 3.13.2

clusters/base/apps/nfs-ganesha/configmap.yaml

@@ -29,7 +29,7 @@ data:
     	Export_Id = 1;
 
     	Path = /export;
-    	Pseudo = /exports/shared/documents;
+    	Pseudo = /export;
 
     	SecType = sys;
     	Protocols = NFSv4;

clusters/base/apps/nfs-ganesha/helmrelease.yaml

@@ -21,6 +21,8 @@ spec:
             image:
               repository: hectorm/nfs-ganesha
               tag: v10
+              # hectorm does not publish exact versions, v10.0 digest is 93df70b78...
+              digest: sha256:93df70b78aae56957f4a4f5c606c4250d84b729435f76132dca07b7290f5bfce
             command:
               - sh
               - -c
@@ -29,6 +31,8 @@ spec:
             image:
               repository: hectorm/nfs-ganesha
               tag: v10
+              # hectorm does not publish exact versions, v10.0 digest is 93df70b78...
+              digest: sha256:93df70b78aae56957f4a4f5c606c4250d84b729435f76132dca07b7290f5bfce
             command:
               - sh
               - -c
@@ -38,6 +42,8 @@ spec:
             image:
               repository: hectorm/nfs-ganesha
               tag: v10
+              # hectorm does not publish exact versions, v10.0 digest is 93df70b78...
+              digest: sha256:93df70b78aae56957f4a4f5c606c4250d84b729435f76132dca07b7290f5bfce
             securityContext:
               readOnlyRootFilesystem: true
               capabilities:

clusters/base/apps/radicale/configmap.yaml

@@ -1,44 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: radicale-config
-  namespace: pim
-data:
-  # storage.hook (the git-commit-per-change hook in the old compose setup)
-  # called out to a webhooks sidecar that isn't part of this deployment yet,
-  # so it's dropped here rather than pointing at a script that doesn't exist.
-  config: |
-    [server]
-    hosts = 0.0.0.0:5232
-    ssl = False
-
-    [auth]
-    type = htpasswd
-    htpasswd_filename = /config/users
-    htpasswd_encryption = bcrypt
-
-    [rights]
-    type = owner_only
-    # file = /config/rights
-
-    [storage]
-    type = multifilesystem
-    filesystem_folder = /data/collections
-
-    [headers]
-    Access-Control-Allow-Origin = *
-    Access-Control-Allow-Methods: GET, POST, OPTIONS, PROPFIND, PROPPATCH, REPORT, PUT, MOVE, DELETE, LOCK, UNLOCK
-    Access-Control-Allow-Headers: User-Agent, Authorization, Content-type, Depth, If-match, If-None-Match, Lock-Token, Timeout, Destination, Overwrite, Prefer, X-client, X-Requested-With
-    Access-Control-Expose-Headers: Etag, Preference-Applied
-  rights: |
-    # read access to root collection for all users
-    [all-read-root-collection]
-    user = .+
-    collection =
-    permission = r
-
-    # write access to own files for each user
-    [owner-write]
-    user: .+
-    collection: ^%(login)s(/.+)?$
-    permission: rw

clusters/base/apps/radicale/helmrelease-agendav.yaml

@@ -1,62 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: agendav
-  namespace: pim
-spec:
-  interval: 10m
-  chartRef:
-    kind: OCIRepository
-    name: radicale
-  driftDetection:
-    mode: enabled
-  values:
-    controllers:
-      agendav:
-        containers:
-          app:
-            image:
-              repository: ghcr.io/nagimov/agendav-docker
-              tag: latest
-            env:
-              AGENDAV_SERVER_NAME: "127.0.0.1"
-              AGENDAV_TITLE: ""
-              AGENDAV_FOOTER: ""
-              AGENDAV_CALDAV_SERVER: "http://radicale.pim.svc.cluster.local:5232/%u"
-              AGENDAV_CALDAV_PUBLIC_URL: "https://c.aggtaa.com/server"
-              AGENDAV_TIMEZONE: "Europe/Moscow"
-              AGENDAV_WEEKSTART: "1"
-              AGENDAV_LANG: "en"
-              AGENDAV_LOG_DIR: "/tmp/"
-            probes:
-              liveness:
-                enabled: true
-              readiness:
-                enabled: true
-
-    service:
-      app:
-        controller: agendav
-        ports:
-          http:
-            port: 8080
-
-    ingress:
-      app:
-        className: traefik
-        # no cert-manager annotation here: radicale's own Ingress already
-        # requests/owns the Certificate for c.aggtaa.com -> radicale-tls.
-        # A second Ingress with the annotation would create a competing
-        # Certificate for the same host/secret.
-        hosts:
-          - host: c.aggtaa.com
-            paths:
-              - path: /
-                pathType: Prefix
-                service:
-                  identifier: app
-                  port: http
-        tls:
-          - secretName: radicale-tls
-            hosts:
-              - c.aggtaa.com

clusters/base/apps/radicale/middleware.yaml

@@ -1,21 +0,0 @@
-# middleware order matters!
-
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: radicale-stripprefix
-  namespace: pim
-spec:
-  stripPrefix:
-    prefixes:
-      - /server
----
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: radicale-headers
-  namespace: pim
-spec:
-  headers:
-    customRequestHeaders:
-      X-Script-Name: /server

clusters/base/apps/radicale/secret.enc.yaml

@@ -1,22 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: radicale-secrets
-    namespace: pim
-stringData:
-    users: ENC[AES256_GCM,data:8o+1aX07mOgu3es/j6n9K4/xTGcj9D9yaGLiwiDWe42uGIlIzbGFFcHNfukw+Z9O6wfOCDZmWnDORWvNtXbwDKDabqT6c8+kZPDGp8pjmQELYRSKJyPMVk1tYAnU6y+A7FhogbN9ixmhbj1L6OpOb9KPHaeMjBj/+cnz4MaU0FKg522ejn57EA==,iv:BmDbKyDv7kQSJwhLEHHKAZEbS0n/NqyEfToTn8esY6o=,tag:DaQ5WWSNZGBFPZqZnsQ59Q==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoWUxieThVa3k5a1J1eTNY
-            WGJGWGs3T2JZZFZidXBSVWV0bThSOHhpWkc0CkRZUk1LczVvMCsvL2I1V0J4cjhw
-            ZEVoWUxpS2xiaXhuSVZUckdtWmJyMGMKLS0tIFVFWXJkU1dFemg0aDI2cVZ6eFlO
-            YzZLQXNyZU9VUFExaStzNmpWWDcxSncKr2rkVly2OblJ4T4cgXH85vNBtE4inZuL
-            mUVNmc3uw5TFiFp2j6x2AoM1dDE3fSFLMyPBlnVn/vvuMjayw1ipnw==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age14x4jjs2fwdgw28g2pkr6jyj2yzmwc544xwmaaglrxwz5e99seutqtr8jv5
-    encrypted_regex: ^(data|stringData)$
-    lastmodified: "2026-07-19T13:08:04Z"
-    mac: ENC[AES256_GCM,data:Yxa8ndMoFRBh1kOzsbjrUGloVm8tnAbEsHIRucP3OZOxfp711eXB5D0dGTaAPKoTDKx8Kj7AoM2v9QsAUHIVe3s6gQ+tU3DI49FyB/Ie5xSijRmCHFFMUi/Tb8HMWsbDQpFQdDC0e8PW08DIjk9wPhgXN7YDO7myRTEUB/P3A10=,iv:iK0nhutsXpt0L11tG1rWQJS0n4TTApjYp401yyeogkg=,tag:SOCmAkcfn88o/jb9ZraZlg==,type:str]
-    version: 3.13.2

clusters/base/apps/syncthing/helmrelease.yaml

@@ -1,13 +1,13 @@
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
-  name: baikal
-  namespace: pim
+  name: syncthing
+  namespace: syncthing
 spec:
   interval: 10m
   chartRef:
     kind: OCIRepository
-    name: baikal
+    name: syncthing
   driftDetection:
     mode: enabled
   values:
@@ -16,8 +16,10 @@ spec:
         containers:
           app:
             image:
-              repository: ckulka/baikal
-              tag: nginx
+              repository: syncthing/syncthing
+              tag: "2.1.3"
+            env:
+              TZ: Europe/Moscow
             probes:
               liveness:
                 enabled: true
@@ -29,15 +31,18 @@ spec:
         controller: app
         ports:
           http:
-            port: 80
+            port: 8384
 
     ingress:
       app:
         className: traefik
+        # the GUI has no auth of its own out of the box, so it's gated
+        # behind Authelia the same way fava/zigbee2mqtt are.
         annotations:
           cert-manager.io/cluster-issuer: letsencrypt-prod
+          traefik.ingress.kubernetes.io/router.middlewares: auth-authelia@kubernetescrd
         hosts:
-          - host: c2.aggtaa.com
+          - host: sync.aggtaa.com
             paths:
               - path: /
                 pathType: Prefix
@@ -45,9 +50,9 @@ spec:
                   identifier: app
                   port: http
         tls:
-          - secretName: baikal-tls
+          - secretName: syncthing-tls
             hosts:
-              - c2.aggtaa.com
+              - sync.aggtaa.com
 
     persistence:
       data:
@@ -57,7 +62,12 @@ spec:
         storageClass: longhorn
         retain: true
         globalMounts:
-          - path: /var/www/baikal/config
-            subPath: config
-          - path: /var/www/baikal/Specific
-            subPath: specific
+          - path: /var/syncthing
+      # same nfs-ganesha export webdav and markdown-vault-mcp use
+      # (10.0.64.5:/export); mounted at the same container path (/data)
+      # as webdav so the layout matches (/data/shared/documents/...).
+      shared:
+        type: persistentVolumeClaim
+        existingClaim: syncthing-shared
+        globalMounts:
+          - path: /data

clusters/base/apps/syncthing/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: syncthing
+  namespace: syncthing
+spec:
+  interval: 10m
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/syncthing/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - pv-pvc-shared.yaml
+  - helmrelease.yaml

clusters/base/apps/syncthing/pv-pvc-shared.yaml

@@ -0,0 +1,35 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: syncthing-shared-nfs
+spec:
+  capacity:
+    storage: 30Gi
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  mountOptions:
+    - nfsvers=4.1
+  nfs:
+    server: 10.0.64.5
+    path: /export
+  claimRef:
+    namespace: syncthing
+    name: syncthing-shared
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: syncthing-shared
+  namespace: syncthing
+  annotations:
+    helm.sh/resource-policy: keep
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: syncthing-shared-nfs
+  resources:
+    requests:
+      storage: 30Gi

clusters/base/apps/vaultwarden/secret.enc.yaml

@@ -8,16 +8,16 @@ stringData:
     ADMIN_TOKEN: ENC[AES256_GCM,data:pYY8Nc2PevrFGU2pbZaFH7O+WNJzOHSEXMM3TAFYHO46/GGzQjrxYbc9IY/8PgY86N73kQAFLvw2bpVnjiliilLpnxm9Z0LyYDlAhui8545J67IqoQFDyZt5o3NHceWRP2eCxEL4Bf9gD6j4YfObRVYrp38x2Q==,iv:IvzPkKi/w/S8ueYl/m8kckWiddfl1oQKYiT8S77IVAA=,tag:rD5RsmPt4uihMHWSt4gGwA==,type:str]
 sops:
     age:
-        - enc: |
+        - recipient: age109zta6l0cwpkxn5wek82kvauxn6yqrq80rsz4mvu5atdnpcn9pusuvnqk5
+          enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBLNlBSZlBhSkZzc1ZFM0tW
-            NjVQeEpleldyZVRVWVlCeWdsbUZCWnRoSnlZCjYxME5DeERvbFByK0pZS0dqTTlU
-            YnJqWFovajVJN1hzRG9ldE9tZ0xJQlkKLS0tIEJPTFNicDFtemY4LzRGUDdBSkY4
-            MTNjaGJGOEE2YUFXa0EzaE1peTNSOVkKf2rsKzwoJmgKPpbMjJxp1AzI2Iwr5YhP
-            wXWFND5VaLTbUgERUrjByPN2Lfoz4LZRWzV3Ws9U2Vrwj9fOs7tFWA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6RVkzM041NFZDMzlYRllw
+            a3BRS0JGZ1B0UGYyaTRLUkp2UTJ1S1pybDFnCnZhVWNYMFRlSXlFVTMvRXlpdlF3
+            Vk1xT1pKV1hzSUYwQXd4ZG92cnhDY0UKLS0tIEtLWXZiZUFDeGhFdytKbTJHSjRH
+            YkJhS2FJOTdLbHlRelBpUWRNUTdTMDQKhgb66tV4L0PKkPY8DvbypTpcBlavUvRH
+            0+Rz/UxfZpX8u8G9GeqF5glIpNG2x28VSOHchJxhvMKHIUq9ZUrHGw==
             -----END AGE ENCRYPTED FILE-----
-          recipient: age14x4jjs2fwdgw28g2pkr6jyj2yzmwc544xwmaaglrxwz5e99seutqtr8jv5
-    encrypted_regex: ^(data|stringData)$
     lastmodified: "2026-07-18T19:13:05Z"
     mac: ENC[AES256_GCM,data:Ufdytxb9uH6JVXsWu39YhE1AfD/oG7bXhIwoTXYhYBE4IWvugrwZLCvBrgkfuazVXyKBuDIuEa5Vj/bzlTGDSlRNx7SDqabvilhmYAsBcuU5DAVU47pDz1YnXeHd9TuQI1dHAc1Q3uvkZwWNxh2YYXKZGwNMy3tOAkaOxwI1rMw=,iv:iUZenTP/9JhmjcR4p5+RM5K2YuXBLnRj0cd/RHseqFY=,tag:pesF8Pp8vBoQXcniwrep9g==,type:str]
+    encrypted_regex: ^(data|stringData)$
     version: 3.13.2

clusters/base/apps/webdav/configmap.yaml

@@ -8,7 +8,7 @@ data:
     address: 0.0.0.0
     port: 6065
 
-    directory: /data
+    directory: /webdav
 
     permissions: R
 

clusters/base/apps/webdav/helmrelease.yaml

@@ -5,11 +5,18 @@ metadata:
   namespace: webdav
 spec:
   interval: 30m
+  timeout: 10m
   chartRef:
     kind: OCIRepository
     name: webdav
   driftDetection:
     mode: enabled
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
   values:
     controllers:
       app:
@@ -17,7 +24,7 @@ spec:
           app:
             image:
               repository: ghcr.io/hacdias/webdav
-              tag: latest
+              tag: v5.14.2
             args:
               - "-c"
               - "/config.yml"
@@ -80,6 +87,16 @@ spec:
             readOnly: true
       data:
         type: persistentVolumeClaim
-        existingClaim: webdav-data
+        existingClaim: ganesha-export
         globalMounts:
-          - path: /data
+          - path: /webdav/export
+      sda2:
+        type: persistentVolumeClaim
+        existingClaim: nas1-sda2
+        globalMounts:
+          - path: /webdav/nas1/sda2
+      sdb2:
+        type: persistentVolumeClaim
+        existingClaim: nas1-sdb2
+        globalMounts:
+          - path: /webdav/nas1/sdb2

clusters/base/apps/webdav/pv-pvc-data.yaml

@@ -1,10 +1,10 @@
 apiVersion: v1
 kind: PersistentVolume
 metadata:
-  name: webdav-data-nfs
+  name: ganesha-export-nfs
 spec:
   capacity:
-    storage: 30Gi
+    storage: 1Ti
   accessModes:
     - ReadWriteMany
   persistentVolumeReclaimPolicy: Retain
@@ -13,15 +13,15 @@ spec:
     - nfsvers=4.1
   nfs:
     server: 10.0.64.5
-    path: /exports
+    path: /export
   claimRef:
     namespace: webdav
-    name: webdav-data
+    name: ganesha-export
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: webdav-data
+  name: ganesha-export
   namespace: webdav
   annotations:
     helm.sh/resource-policy: keep
@@ -29,7 +29,81 @@ spec:
   accessModes:
     - ReadWriteMany
   storageClassName: ""
-  volumeName: webdav-data-nfs
+  volumeName: ganesha-export-nfs
   resources:
     requests:
-      storage: 30Gi
+      storage: 1Ti
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: nas1-sda2-nfs
+spec:
+  capacity:
+    storage: 1Ti
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  mountOptions:
+    - nfsvers=3
+    - nolock
+  nfs:
+    server: 10.0.64.80
+    path: /mnt/sda2
+  claimRef:
+    namespace: webdav
+    name: nas1-sda2
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nas1-sda2
+  namespace: webdav
+  annotations:
+    helm.sh/resource-policy: keep
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: nas1-sda2-nfs
+  resources:
+    requests:
+      storage: 1Ti
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: nas1-sdb2-nfs
+spec:
+  capacity:
+    storage: 1Ti
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  mountOptions:
+    - nfsvers=3
+    - nolock
+  nfs:
+    server: 10.0.64.80
+    path: /mnt/sdb2
+  claimRef:
+    namespace: webdav
+    name: nas1-sdb2
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nas1-sdb2
+  namespace: webdav
+  annotations:
+    helm.sh/resource-policy: keep
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: nas1-sdb2-nfs
+  resources:
+    requests:
+      storage: 1Ti

clusters/base/apps/webdav/secret.enc.yaml

@@ -8,14 +8,14 @@ stringData:
     WEBDAV_PASSWORD: ENC[AES256_GCM,data:Rh1ryftcmxgJAHvC/N1o5QeagCvyb3XIpDS7jOTCpJm3Wb5rUcLNmtcW22f0xljw,iv:GmgQJEuzUzSEql+fx5KURKv8CnhXF/z5UlmEn4ta+K0=,tag:AZD1CEbVRm6DiBt66pB9Vg==,type:str]
 sops:
     age:
-        - recipient: age14x4jjs2fwdgw28g2pkr6jyj2yzmwc544xwmaaglrxwz5e99seutqtr8jv5
+        - recipient: age1y8t9v56yuvskznddqfsd4yddzzch0yf2dutvvt8rrx6rjh5f9g0s3qeays
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMSHg0S0dSTC8yNUpPUk9L
-            blNobStHNCt1VzRWWnJRMVFSSHRuNEdRZjJVCjhwKzdpYTRVWEF4NlE2RVRKTllX
-            YjFRL1RZeUxuQWdrWVZQVkZLSE5rYlUKLS0tIEN3WHV5MTJiOXFsbXpVSkJiZk1m
-            MDRObmNYb0dDT3NQNEZMKytrRENrTm8KbtGEFVOOhofeDtcP3+ST3qtxysuVWzTb
-            s/z73tRmakfXnPT9qgBTq+6YcZS+kpgAp7L5krQX9SrsPISAYczdtg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5UkRLNWVyZUpLREtZcm8r
+            V0VPTkZDN1pSWDNxWFZXOUlON1c3cHhSZFVzClpEMmhvQnlFMnF6aXV6MjJnMnBu
+            c2pxTDBGZVBUYjZNR1doQ3UraDQ3dlEKLS0tIE42dTZWMUhZdnVMYUNLTGdrSWZC
+            UFM0V08reGVmZTRMUWw5T1R2OUdGWW8KWAZq4TG36Njlw4//vPCxzM1Qqr/6Ievw
+            taBvLXpw9wkrjfZJ8gBU+0Q8WrsEy+tYtR9chfz1n/SmiGHCkskFGQ==
             -----END AGE ENCRYPTED FILE-----
     lastmodified: "2026-07-29T18:57:24Z"
     mac: ENC[AES256_GCM,data:bW2QvjSbA4JmfmZFzC1oIfEnVBxf1pE4jtKDsp2sf7mozVEdqMTD2nNpq4Pro9zRiXQfzxQAXAyzT48dBhIunXKDNIS7vbPpLUbs0nwSF4Dgp/q02ZX3Vrewx80iz5wdMYvLk6c2viZ9ndMwRqBbdBBsuSa5O9nIVj1edG9tj70=,iv:8bgXaA9RiQtbd1Xaht5r5NB3lFedX7Wi/X4z10VLLuA=,tag:Qnr8Ij6XN/FMcQf9Kx1IvA==,type:str]

clusters/base/apps/zigbee2mqtt/secret.enc.yaml

@@ -7,16 +7,16 @@ stringData:
     secret.yaml: ENC[AES256_GCM,data:mDb7Vt4sOSaqn9+T3QEAR0yutRIFwiYpBBZDMQI4FMvAPWPkAdsYTIfvv+41JbpBafklDJ5gzPPKZJ6Qk1f8KBvjRuHP/bJqTUPrv+Q46ZKsuXECQq+qB8TKAj51FiJssyx0jYy9bCYgn+Z9r+WBT4YSAvv1XS/UHs4S8UA=,iv:8RHjs0g1ee38yUSHjvQv06Z7xbzMOG6LNzCJ/7s4+Pc=,tag:jb+VgAVApqIpN3lERqrfBg==,type:str]
 sops:
     age:
-        - enc: |
+        - recipient: age1tu4xgfefvgdda0vn2thaqndq4p9tuydq2ud6qa98tzzgnff6749qnlcx29
+          enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkRTdJVkpZRmRseTRvQlB6
-            UmZiV1ZZYk1rOWo0cXZ5ZWJIQkZJY0xJc0g4CnJYVGRqanVuTlFPN2ltVExRK0JN
-            SnVVQm50bDVidkVqTjlocHNoYmQ2bHcKLS0tIE4vNngvQTNqdzQwbVdwVDFNRUhK
-            bjJVaDFVbkdlRm5mQjZoU3c4VWZqa00K5iO6dClHE2sFi2brd8xVuC1hfH/v0bpM
-            NK2GgJDcb/mcTFpA62/iHfuNPDYp/FpaNIrqh9LB0i9fxA+61AJZpA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzcUFqU2RpTXUwR3hsSEJr
+            WUV1NkpqQitDRDF6MUpWMWlnSS9TaStRZ1hNClNkSEIzOVVSTUh6LzdXdTdld3Zj
+            U1pVcE5IaFhuQ0lTZlZ0RzFDSHVkREUKLS0tIDdTbEJLbE9KUmxRei9lVlc4TW1t
+            TE0yUERpQkpqZFg3aGpvSkg4M04zMGcKcYmSgyzhpZ8BGAp+0zkQ7+ZnF2w/Nk9D
+            ZT8zwqCJcaRldg59JzmhLBfiuYAtnH2wqWj06LiIfvt+P3pgY79f3g==
             -----END AGE ENCRYPTED FILE-----
-          recipient: age14x4jjs2fwdgw28g2pkr6jyj2yzmwc544xwmaaglrxwz5e99seutqtr8jv5
-    encrypted_regex: ^(data|stringData)$
     lastmodified: "2026-07-19T09:01:11Z"
     mac: ENC[AES256_GCM,data:fKfDsAg1Ya8c//x0xw9ytQR7hiF/BssuqlwA57PYiB1yjCW3Kddcdt95UF1amF+9tvJb2XwRjb2LwN4RrYj0RyScLmLa3u/l1r79EoUKQWQ4qF7GNdD5ZGaxqnWjgorxkfYcU7ahJBRDEIsvJXJivk6Wjm309ISzl8xR/tUpFCM=,iv:TmFo1gbRsATh6O0uJvJxwyj7hSzCfpPPuo55EkQQabk=,tag:CJ0cTn9BJs+87AvdwJ0MsA==,type:str]
+    encrypted_regex: ^(data|stringData)$
     version: 3.13.2

clusters/base/infra/longhorn/longhorn-system/backuptarget.yaml

@@ -0,0 +1,13 @@
+apiVersion: longhorn.io/v1beta2
+kind: BackupTarget
+metadata:
+  name: default
+  namespace: longhorn-system
+spec:
+  # this CR (not defaultSettings.backupTarget in helmrelease.yaml) is what
+  # Longhorn actually reads - it pre-existed this repo's management,
+  # pointing at a long-dead minio host. defaultSettings only seeds it on
+  # a truly fresh install, so it never overwrote the stale live object.
+  backupTargetURL: "s3://longhorn-backups@us-east-1/"
+  credentialSecret: longhorn-backup-target-secret
+  pollInterval: 5m0s

clusters/base/infra/longhorn/longhorn-system/helmrelease.yaml

@@ -5,10 +5,11 @@ metadata:
   namespace: longhorn-system
 spec:
   interval: 30m
+  timeout: 15m
   chart:
     spec:
       chart: longhorn
-      version: "1.12.x"
+      version: "1.12.1"
       sourceRef:
         kind: HelmRepository
         name: longhorn
@@ -29,8 +30,12 @@ spec:
       defaultDataPath: /var/lib/longhorn
       guaranteedEngineManagerCPU: 12
       guaranteedReplicaManagerCPU: 12
-      # если backup target ещё не настроен — оставь пустым, донастроишь позже через UI/CR
-      backupTarget: ""
+      # points at the in-cluster rclone proxy (clusters/base/infra/longhorn/s3-backup-proxy),
+      # which itself encrypts and forwards to the real Wasabi bucket. "longhorn-backups" is
+      # a virtual bucket the proxy creates on demand under the crypt remote - already exists.
+      # region is a dummy value; the real endpoint comes from AWS_ENDPOINTS in the secret below.
+      backupTarget: "s3://longhorn-backups@us-east-1/"
+      backupTargetCredentialSecret: longhorn-backup-target-secret
       # чтобы не разъезжались реплики при 3 нодах
       replicaSoftAntiAffinity: false
     persistence:
@@ -44,4 +49,4 @@ spec:
       resizerReplicaCount: 3
       snapshotterReplicaCount: 3
     ingress:
-      enabled: false             # у тебя уже есть Caddy/Traefik, заведёшь свой Ingress/IngressRoute отдельно
+      enabled: false # exposed via Traefik explicitly

clusters/base/infra/longhorn/longhorn-system/kustomization.yaml

@@ -2,5 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - helmrepository.yaml
+  - secret.enc.yaml
   - helmrelease.yaml
   - ingress.yaml
+  - backuptarget.yaml

clusters/base/infra/longhorn/longhorn-system/secret.enc.yaml

@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: longhorn-backup-target-secret
+    namespace: longhorn-system
+stringData:
+    AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:QPvQnrkMSKK4Whj7DaMONoDW7LQ=,iv:K1x/VDp4VZUnC7u86wpEfVBDW7T9cI4CZojMZMCaS+A=,tag:eFAAnCMCVjNBHnFAhzFS3w==,type:str]
+    AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:zFjxH1uqnYRrxM4Yrll9Na+mDj16aLtiJC2ZlNO+2r70JcXJqnTASQ==,iv:B7eV80h4APk3QCuoDR9EFpKs5dkMF8GjQ2v9lSF/ev8=,tag:xLbWN0Gy2idB9j2G8HZYKQ==,type:str]
+    AWS_ENDPOINTS: ENC[AES256_GCM,data:HWVPThBb5GLpiRqAuSLvmAat0XiUu5R5CMv2Fv6jdieZ11lUmbS2MBD6lx0vQDSIzC36hd6Tu0hgqtknQA==,iv:XLqWSNHgj8O0uQPeBbnN05Za8G9VW6F802CCPoUoq9A=,tag:dsKXCq21hDlJy4KTyQTp/w==,type:str]
+sops:
+    age:
+        - recipient: age18hhmdmupj90zjgjpxk3z5cf3lx36hcznnmqsp0fpyg50823pudrqjupydt
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqRndobTFybElvakN3c013
+            T3d6ekVUM0V4OVNEMjl1ak5XTzNPS0xKRmtVCjBXMjVybEs0bFZKN3ByWmFpWm9K
+            TVVLVVBPYmE2NnJMT3Q3dVJRa250aXcKLS0tIEVKeXBGQ0x4ZDlIWENMa3k3S3Zz
+            YUdxZXoycXBPbm5raWxFZ3owc2xkQmsKNzw+5kn73FZhApzfN/RBj4yAd7GLl5/X
+            wyXVy0te83ZDeVQvqhXLkUPsbF8CYewC6xibZSdSY/WBh2ojedJXrQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-11T19:04:53Z"
+    mac: ENC[AES256_GCM,data:SO2tMq3UA0JcsTZyH3oNhmCsWZ2OhxEmJSn1b/3sH78cZvWalXUsdQqD1GBArFgS+oCSaSgarl2Ve06iNJtM8k6oq0fDkm0dxsLou+67qHlle4CbkP1KPFEQid2Nx8o/5b6cjI2zHz3bYmQTQh9DD7mE8roqo6lX3rYY35MpPJw=,iv:Ad13teWF+lZfzOY/PIALI3/Wohn/0BBoSuE0mtiH8/Y=,tag:sQVQfH0mFFMLnF4zbRC2VQ==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

clusters/base/infra/longhorn/recurring-jobs/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - recurringjob-backup.yaml

clusters/base/infra/longhorn/recurring-jobs/recurringjob-backup.yaml

@@ -0,0 +1,21 @@
+apiVersion: longhorn.io/v1beta2
+kind: RecurringJob
+metadata:
+  name: backup
+  namespace: longhorn-system
+spec:
+  task: "backup"
+  cron: "0 3 * * *"
+  retain: 7
+  concurrency: 2
+  # "default" is a special group name: Longhorn auto-applies it to every
+  # volume that has NO recurring-job label at all - i.e. opt-out. To
+  # exclude a specific volume, give it any other (job-less) group label,
+  # e.g.:
+  #   recurring-job-group.longhorn.io/no-backup: enabled
+  # (having *any* recurring-job label disqualifies it from "default" -
+  # there's no dedicated "disabled" flag, this placeholder-group is the
+  # documented workaround)
+  groups:
+    - default
+  labels: {}

clusters/base/infra/longhorn/s3-backup-proxy/helmrelease.yaml

@@ -0,0 +1,104 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: s3-backup-proxy
+  namespace: longhorn-system
+spec:
+  interval: 10m
+  chartRef:
+    kind: OCIRepository
+    name: s3-backup-proxy
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      app:
+        containers:
+          app:
+            image:
+              repository: rclone/rclone
+              tag: "1.75.0"
+            command:
+              - sh
+              - -c
+              - |
+                set -eu
+                # crypt's password/password2 must be stored "obscured" (rclone's
+                # reversible obfuscation, not real encryption on its own - the
+                # actual protection is the passphrase's entropy). Generating it
+                # here at startup from the plaintext secret env vars means the
+                # real secret only ever needs to exist as one sops-encrypted
+                # k8s Secret, never hand-obscured and pasted into git.
+                CRYPT_PASSWORD_OBS=$(rclone obscure "$CRYPT_PASSWORD")
+                CRYPT_PASSWORD2_OBS=$(rclone obscure "$CRYPT_PASSWORD2")
+                cat > /tmp/rclone.conf <<EOF
+                [wasabi]
+                type = s3
+                provider = Wasabi
+                access_key_id = ${WASABI_ACCESS_KEY_ID}
+                secret_access_key = ${WASABI_SECRET_ACCESS_KEY}
+                endpoint = s3.eu-central-1.wasabisys.com
+                region = eu-central-1
+
+                [crypt]
+                type = crypt
+                remote = wasabi:kubebackup
+                password = ${CRYPT_PASSWORD_OBS}
+                password2 = ${CRYPT_PASSWORD2_OBS}
+                filename_encryption = standard
+                directory_name_encryption = true
+                EOF
+                exec rclone serve s3 crypt: \
+                  --config /tmp/rclone.conf \
+                  --addr :8080 \
+                  --auth-key "${PROXY_ACCESS_KEY},${PROXY_SECRET_KEY}"
+            env:
+              WASABI_ACCESS_KEY_ID:
+                valueFrom:
+                  secretKeyRef:
+                    name: s3-backup-proxy-secrets
+                    key: WASABI_ACCESS_KEY_ID
+              WASABI_SECRET_ACCESS_KEY:
+                valueFrom:
+                  secretKeyRef:
+                    name: s3-backup-proxy-secrets
+                    key: WASABI_SECRET_ACCESS_KEY
+              CRYPT_PASSWORD:
+                valueFrom:
+                  secretKeyRef:
+                    name: s3-backup-proxy-secrets
+                    key: CRYPT_PASSWORD
+              CRYPT_PASSWORD2:
+                valueFrom:
+                  secretKeyRef:
+                    name: s3-backup-proxy-secrets
+                    key: CRYPT_PASSWORD2
+              PROXY_ACCESS_KEY:
+                valueFrom:
+                  secretKeyRef:
+                    name: s3-backup-proxy-secrets
+                    key: PROXY_ACCESS_KEY
+              PROXY_SECRET_KEY:
+                valueFrom:
+                  secretKeyRef:
+                    name: s3-backup-proxy-secrets
+                    key: PROXY_SECRET_KEY
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+            resources:
+              requests:
+                cpu: 50m
+                memory: 64Mi
+              limits:
+                cpu: 750m
+                memory: 512Mi
+
+    service:
+      app:
+        controller: app
+        ports:
+          http:
+            port: 8080

clusters/base/infra/longhorn/s3-backup-proxy/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: s3-backup-proxy
+  namespace: longhorn-system
+spec:
+  interval: 10m
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/infra/longhorn/s3-backup-proxy/kustomization.yaml

@@ -2,4 +2,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - helmrepository.yaml
+  - secret.enc.yaml
   - helmrelease.yaml

clusters/base/infra/longhorn/s3-backup-proxy/secret.enc.yaml

@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: s3-backup-proxy-secrets
+    namespace: longhorn-system
+stringData:
+    WASABI_ACCESS_KEY_ID: ENC[AES256_GCM,data:YP9bOIarPh6DJVo0vevVN2T3c3A=,iv:bTKwVx/Ij+GMCisO4WEDCJz8rsHe8PtSET/h4+P2dyM=,tag:fdXr+wAx/SvKNwlYlmKvRw==,type:str]
+    WASABI_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:Aa0ZYxiVipW2g4mGzyhCspVF67m7hnouMg4Tcr6kSinY+ULpHtEDBA==,iv:txr1ual5z7dXi/27T3FOMsccQtSPObHpg+7IfxvfWuw=,tag:MW7fl0iRB/6flbN+iA+2QA==,type:str]
+    CRYPT_PASSWORD: ENC[AES256_GCM,data:x8kMqkX4OzduFbW1BGc2EcFxaVm4ah4BBgLNxzQfIHeuL3UuJXt+Cj8isg==,iv:xoFXHqUDK/yamkDaSaQaMIkC7p+q/4qtsrYNwKT7944=,tag:92nej0/10KVTsugwFzdB0w==,type:str]
+    CRYPT_PASSWORD2: ENC[AES256_GCM,data:TdcfVmkgd36Hq80XaLRM8lY2dUq95h4v4ONCy/O7DOMoRwVxDUktgCRgNA==,iv:9EluJOnjKjCo2272sIeJ58iFu54DKfbkX785ZySj3C0=,tag:WUMKDLASA9grCilKNLVmZA==,type:str]
+    PROXY_ACCESS_KEY: ENC[AES256_GCM,data:A1ZF8ejApPiH3nISLvrO7+vWTzM=,iv:fSFwYL/6zxtK4wkz+G3WItzq6P92eGviQ7WaVquDYuk=,tag:n9fjuW/cXU7QWe5IUkXf/w==,type:str]
+    PROXY_SECRET_KEY: ENC[AES256_GCM,data:iU6GHL09tzxgyxcl6wKlDNhaO6YVYS/8yy/qCPbSxE3RlHk0Yw9EnQ==,iv:i0R6SzOJlEDsyEhxLrLMVaJu7ZAzNsnnmdyrxbv6ys0=,tag:h290ZIcFevBQeImcfqQbjg==,type:str]
+sops:
+    age:
+        - recipient: age15vc3geq4lsec69rnxczluvwgcexeqae02zxzjpswsuatthaasu7qzath48
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxR0hwMUhqVHFJSVBUckZW
+            cTdCeUx0bC8zdjB5dmhRNDJrc1ZOTnY4WmxVCjJNZEUrMEFEYmNGUWQxbHRZL3Bj
+            S3dnOGhENlJkV2oxR1RhSmdCWXczVWsKLS0tIHIxSnVSdGtKaE52UHNtaWVnRUNW
+            Unc4QUJ3YmF3N2xVVDg2VjBrZW80QmsKZ5HiOTiYRCrfWJf2Qpxyc4D+1wNWxHzK
+            hCe6G9ANAX/EAlGwmOIn3k7cFbN1VRt50TV/UCj+FsJBuifUYVMvTQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-11T18:28:22Z"
+    mac: ENC[AES256_GCM,data:eICyFKuJAyCE8ZbdpWc4rOHRxtnrFhdxTeznIWXie5CrHRyo+n21CPg5L/VQUy2LF1rXINIDJRNqQWcLXJEXDKWGpqyaL/YcW+OawpbCq0DMJAe/DsvBdy5ySwGFdRlwU5x7ivVjsHKnsr8UgcbHdE/ZVRq93nZOfZlUepjb1u0=,iv:l+SFwIobBbxeZNUmwK6U9W5YpLh4t5GOtnRIH10Z7W4=,tag:6Zs+tneNcF1d5i43ns6Rmw==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

clusters/base/infra/longhorn/storage-classes/kustomization.yaml

@@ -2,3 +2,4 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - longhorn-no-retain.yaml
+  - longhorn-single-replica.yaml

clusters/base/infra/longhorn/storage-classes/longhorn-single-replica.yaml

@@ -0,0 +1,12 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: longhorn-single-replica
+  annotations:
+    storageclass.kubernetes.io/is-default-class: "false"
+provisioner: driver.longhorn.io
+reclaimPolicy: Retain
+allowVolumeExpansion: true
+parameters:
+  numberOfReplicas: "1"
+  staleReplicaTimeout: "30"

clusters/base/infra/metallb/helmrelease.yaml

@@ -15,3 +15,29 @@ spec:
         namespace: metallb-system
   driftDetection:
     mode: enabled
+  postRenderers:
+    - kustomize:
+        patches:
+          # frr's liveness/startup probes default to timeoutSeconds: 1,
+          # which is too tight when the node is under CPU pressure (an
+          # HTTPS healthz call can't always complete in 1s) - kubelet then
+          # kills+restarts the container, which itself adds more CPU load,
+          # compounding the problem. Give the probes more slack instead.
+          - target:
+              kind: DaemonSet
+              name: metallb-frr-k8s
+            patch: |
+              apiVersion: apps/v1
+              kind: DaemonSet
+              metadata:
+                name: metallb-frr-k8s
+              spec:
+                template:
+                  spec:
+                    containers:
+                      - name: frr
+                        livenessProbe:
+                          timeoutSeconds: 5
+                          failureThreshold: 6
+                        startupProbe:
+                          timeoutSeconds: 5

clusters/base/namespaces/photo.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: photo

clusters/base/namespaces/syncthing.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: syncthing

clusters/home/apps/authelia.yaml

@@ -18,4 +18,4 @@ spec:
   decryption:
     provider: sops
     secretRef:
-      name: sops-age
+      name: sops-age-authelia

clusters/home/apps/davical.yaml

@@ -0,0 +1,21 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: davical
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./clusters/base/apps/davical
+  prune: true
+  wait: true
+  dependsOn:
+    - name: namespaces
+    - name: infra
+  retryInterval: 5s
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age-davical

clusters/home/apps/immich.yaml

@@ -0,0 +1,21 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: immich
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./clusters/base/apps/immich
+  prune: true
+  wait: true
+  dependsOn:
+    - name: namespaces
+    - name: infra
+  retryInterval: 5s
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age-immich

clusters/home/apps/infcloud.yaml

@@ -1,14 +1,14 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: radicale
+  name: infcloud
   namespace: flux-system
 spec:
   interval: 10m
   sourceRef:
     kind: GitRepository
     name: flux-system
-  path: ./clusters/base/apps/radicale
+  path: ./clusters/base/apps/infcloud
   prune: true
   wait: true
   dependsOn:

clusters/home/apps/kustomization.yaml

@@ -1,10 +1,9 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - baikal.yaml
+  - davical.yaml
   - vaultwarden.yaml
   - zigbee2mqtt.yaml
-  - radicale.yaml
   - authelia.yaml
   - mosquitto.yaml
   - homeassistant.yaml
@@ -12,4 +11,7 @@ resources:
   - markdown-vault-mcp.yaml
   - nfs-ganesha.yaml
   - webdav.yaml
-  - fava.yaml
+  - fava.yaml
+  - infcloud.yaml
+  - syncthing.yaml
+  - immich.yaml

clusters/home/apps/markdown-vault-mcp.yaml

@@ -19,4 +19,4 @@ spec:
   decryption:
     provider: sops
     secretRef:
-      name: sops-age
+      name: sops-age-markdown-vault-mcp

clusters/home/apps/mosquitto.yaml

@@ -15,4 +15,4 @@ spec:
   decryption:
     provider: sops
     secretRef:
-      name: sops-age
+      name: sops-age-mosquitto

clusters/home/apps/syncthing.yaml

@@ -1,17 +1,21 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: baikal
+  name: syncthing
   namespace: flux-system
 spec:
   interval: 10m
   sourceRef:
     kind: GitRepository
     name: flux-system
-  path: ./clusters/base/apps/baikal
+  path: ./clusters/base/apps/syncthing
   prune: true
   wait: true
   dependsOn:
     - name: namespaces
     - name: infra
   retryInterval: 5s
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age

clusters/home/apps/vaultwarden.yaml

@@ -18,4 +18,4 @@ spec:
   decryption:
     provider: sops
     secretRef:
-      name: sops-age
+      name: sops-age-vaultwarden

clusters/home/apps/webdav.yaml

@@ -18,4 +18,4 @@ spec:
   decryption:
     provider: sops
     secretRef:
-      name: sops-age
+      name: sops-age-webdav

clusters/home/apps/zigbee2mqtt.yaml

@@ -18,4 +18,4 @@ spec:
   decryption:
     provider: sops
     secretRef:
-      name: sops-age
+      name: sops-age-zigbee2mqtt

clusters/home/flux-system/gotk-sync.yaml

@@ -8,7 +8,7 @@ metadata:
 spec:
   interval: 1m0s
   ref:
-    branch: main
+    branch: prod
   secretRef:
     name: flux-system
   url: http://10.0.64.157:5000/anton/kube

clusters/home/infra/kustomization.yaml

@@ -3,5 +3,7 @@ kind: Kustomization
 resources:
   - longhorn/longhorn-system.yaml
   - longhorn/storage-classes.yaml
+  - longhorn/s3-backup-proxy.yaml
+  - longhorn/recurring-jobs.yaml
   - cert-manager/certificate-issuers.yaml
   - metallb.yaml

clusters/home/infra/longhorn/longhorn-system.yaml

@@ -12,3 +12,7 @@ spec:
   prune: true
   wait: true
   retryInterval: 5s
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age-longhorn-system

clusters/home/infra/longhorn/recurring-jobs.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: longhorn-recurring-jobs
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./clusters/base/infra/longhorn/recurring-jobs
+  prune: true
+  wait: true
+  dependsOn:
+    - name: longhorn-system
+  retryInterval: 5s

clusters/home/infra/longhorn/s3-backup-proxy.yaml

@@ -0,0 +1,18 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: s3-backup-proxy
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./clusters/base/infra/longhorn/s3-backup-proxy
+  prune: true
+  wait: true
+  retryInterval: 5s
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age-s3-backup-proxy

clusters/home/namespaces/kustomization.yaml

@@ -14,3 +14,5 @@ resources:
   - ../../base/namespaces/webdav.yaml
   - ../../base/namespaces/finance.yaml
   - ../../base/namespaces/nfs.yaml
+  - ../../base/namespaces/syncthing.yaml
+  - ../../base/namespaces/photo.yaml