separate keys per app

fix for photo-stats remnants not cleaned up
more generous liveness probe for metallb
2026-08-25 21:25:40 +03:00 · 2026-08-25 16:53:58 +03:00 · 2026-08-25 12:18:56 +03:00 · 2026-08-25 12:18:33 +03:00 · 2026-08-24 10:03:11 +03:00 · 2026-08-24 09:51:28 +03:00
30 changed files with 221 additions and 120 deletions
@@ -1,4 +1,31 @@
 creation_rules:
-  - path_regex: .*\.enc\.yaml$
+  - path_regex: authelia.*\.enc\.yaml$
    encrypted_regex: ^(data|stringData)$
-    age: age14x4jjs2fwdgw28g2pkr6jyj2yzmwc544xwmaaglrxwz5e99seutqtr8jv5
+    age: age1ncw6uagcgncd5m2admqxt73ey0mcd99jsw9sa9lcdv3gu70mcerql8ya0k
+  - path_regex: davical.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age1yx8mey02c0mu6te9hwxwdqp5n4enjz35e8thchsmvhqw7xsrzy0syg367g
+  - path_regex: immich.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age1wmm8qrqnjzvd5nkraed6ylrsxlpn3ru7d7zettdudj7y9sg9dd2su0u3mr
+  - path_regex: markdown-vault-mcp.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age1kct5g7d7eus2hvdnmx99ewsrtz70lhlasxa25euqwdctqhwqqpxqz0n7gg
+  - path_regex: mosquitto.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age1u236u5mzkzj72y4mfxx68gfqw0u0j6tdgkudnm5pdfpe7apq4u6s89jr2h
+  - path_regex: vaultwarden.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age109zta6l0cwpkxn5wek82kvauxn6yqrq80rsz4mvu5atdnpcn9pusuvnqk5
+  - path_regex: webdav.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age1y8t9v56yuvskznddqfsd4yddzzch0yf2dutvvt8rrx6rjh5f9g0s3qeays
+  - path_regex: zigbee2mqtt.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age1tu4xgfefvgdda0vn2thaqndq4p9tuydq2ud6qa98tzzgnff6749qnlcx29
+  - path_regex: longhorn-system.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age18hhmdmupj90zjgjpxk3z5cf3lx36hcznnmqsp0fpyg50823pudrqjupydt
+  - path_regex: s3-backup-proxy.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age15vc3geq4lsec69rnxczluvwgcexeqae02zxzjpswsuatthaasu7qzath48
@@ -17,7 +17,7 @@ spec:
          app:
            image:
              repository: authelia/authelia
-              tag: v4.39.20
+              tag: release-v4.39.21
            probes:
              liveness:
                enabled: true
@@ -4,21 +4,21 @@ metadata:
    name: davical-secrets
    namespace: pim
 stringData:
-    PGSQL_ROOT_PASS: ENC[AES256_GCM,data:EwTwpAg3FBcZoMDLonNAFjDPDO8wgjwx0aQm85n7BkCTkV6c5JX7tF7TIX4HW4RB,iv:rVeHe4suCagHl1V1EFG3FOfL45tdT1cdr3GyGcHxHu4=,tag:vlJn7lJWhGxKBgZr6XDHPA==,type:str]
-    PASSDAVDB: ENC[AES256_GCM,data:MqEb6sAZc8sPRYq9rB+ESV9UFMGmH3VFRW3nUYPpGp/umAyTJxqc59LzBavYtcZ7,iv:sGw/1HmYvKSizczpDiLZ4zWGLB1vfB+NwfycwOEsZSk=,tag:wxbrjiMSnJssH3o9FOPOXQ==,type:str]
-    ADMINDAVICALPASS: ENC[AES256_GCM,data:Mx3z8QUCWasAqqoUF/FOsT11iBAGtHNrYI/iMdkIRhc=,iv:kBnQjC5VvDolB1Uwe3DDzbfTTU3lHbziXR5X3bQRXvU=,tag:yP74K66C5Np1fu2DmJN04w==,type:str]
+    PGSQL_ROOT_PASS: ENC[AES256_GCM,data:XEhP2zDIz0QCpAXXnZi5JtPsVIfns9zp4fvxcg9/bskHiLU5rR+EgU5n/SdOEDkJ,iv:wR3CGk3csHSCSBqFX+ukOUAmS/p+oZMmdNgvCFNHZlI=,tag:ttAe0GuLmwqA77cWLlne2Q==,type:str]
+    PASSDAVDB: ENC[AES256_GCM,data:d9RazQG7xeIH4g3ovti6HwyiIyLTzyaPjAcQvLmhsrwdgev7i0AJK7yQeRXxu/16,iv:9ZdfWTlOuyUNpV2ycykOgx8SY7Golz7/Lb+gfTa9fW0=,tag:eL1euF9uQJ+nDLsR1kxtvg==,type:str]
+    ADMINDAVICALPASS: ENC[AES256_GCM,data:1Zq7duPTIfJX2Stp6AEhKcLHkmQB6vWf4y1f0Iju/zI=,iv:PMOyD3O7UzVPRlFmHTOQSAys032iD4CF8JbI51agWcg=,tag:eDgMbg2lRMnl57NCf5iIkw==,type:str]
 sops:
    age:
        - recipient: age1yx8mey02c0mu6te9hwxwdqp5n4enjz35e8thchsmvhqw7xsrzy0syg367g
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1T2dJTmlMWXQrWldYM3lZ
-            SDNTZjZ0NnpDNklCalR6dm9oNHU2Z2REczBnCjJhZkFaU1dsZHZlRktVbjVOZStP
-            b3hPN1BMNjJMUDNFa3REV0RNUkhVS2cKLS0tIEVUWUhtWU1UWXcwWU5RYTY1M2Zj
-            a0hUaksyZW1KV2Jvd2RWM04ramJjNGMK6qIWzTHhAMJRNtIU+t/QR6iZsVN05bOv
-            CX8233dl+T76qrrfYV5+EQ3AKCDnIIkU6Mg1jdnaaorTpfo/qOAHgQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjNTVJZEFuRFhGazF6T1Yv
+            dnhhTHVUb1h4SEN2eEtDUGREUERkR2wrTUVVCktGSkVLZmlYR3BjekhjNmk4L3Q4
+            UEJsQXJjZXY1VlNDaFV2eER4NTdwRGcKLS0tIDJxb1AyYm01YlNUVk93Tm1Hb0xK
+            NVh0K25yOFUya0dYSGt2SGdJQURnQ2sKaKgwThB5ePeM091/zYgQXmiPeBeIhTdo
+            60PkAPNs659xyVqnlZw2YKEhxbEHS3ZMTBgC4tgng0yjClBizcTv5w==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:29:45Z"
-    mac: ENC[AES256_GCM,data:FtJ1YtmHAj9FIMDILjm5R2ZO3CElJN3j6uAZkw9z4Odu6GaIhPfeAp0HOdgvu/NiU1LC4K/GGPZ+NdEbOLgAtLKW22TBG2iCnuS1PUguogI8IG8+rpGbuatJhn9ntkEZFfMQqPSxKK4DijIj5YrNvezHTJPvKyxY5R6pcegV8h4=,iv:+aLt4+soEa8+AgGiHPG1+87Mhvjs8lxVcdiChUqg1mo=,tag:DHt5lXFDx9911k7MpI8ZrA==,type:str]
+    lastmodified: "2026-08-08T16:37:01Z"
+    mac: ENC[AES256_GCM,data:OoE6fml/3DSH2EMafCoeYz/JHo89Fb9uwQ58k7hxQDU6YMazdO/eGM0jKX5ghjuMKJqA/zQs4FeZ4yASkIUT1CBbxRpycmE9qo6Zny121NLeqveBp3YMjmUZGt3tgw2dNqtkhpOnl/BmHQCtTTvX2brtSVmANx3LbFxjqbK2OGM=,iv:8Us7LJSZ2aHZQnYIjnsvkR7Av0KeHFEYEETZd7WZX4Q=,tag:7NbbEOq1k2c5IcsnqpvlOQ==,type:str]
    encrypted_regex: ^(data|stringData)$
    version: 3.11.0
@@ -29,7 +29,7 @@ spec:
          app:
            image:
              repository: yegle/fava
-              tag: "1.30.4"
+              tag: "v1.30"
            env:
              TZ: Europe/Moscow
              BEANCOUNT_FILE: /documents/main.beancount
@@ -189,15 +189,47 @@ spec:
          server:
            mergerfs:
              - path: /dev/fuse
-      # everything immich keeps outside "library" (backups, encoded-video,
-      # profile, thumbs, upload) - plain volume, no mergerfs involved.
-      other:
+      # split out of the old combined "other" volume below: each of these
+      # purposes now gets its own Longhorn volume instead of sharing one
+      # 200Gi disk, so a single hot subtree (e.g. thumbs) doesn't force
+      # replica rebuilds/relocation to drag the whole 200Gi with it.
+      data:
        type: persistentVolumeClaim
        accessMode: ReadWriteOnce
-        size: 200Gi
-        storageClass: longhorn-single-replica
+        size: 20Gi
+        storageClass: longhorn
        retain: true
        advancedMounts:
          server:
            app:
              - path: /data
+      encoded-video:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 100Gi
+        storageClass: longhorn
+        retain: true
+        advancedMounts:
+          server:
+            app:
+              - path: /data/encoded-video
+      thumbs:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 100Gi
+        storageClass: longhorn
+        retain: true
+        advancedMounts:
+          server:
+            app:
+              - path: /data/thumbs
+      backups:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 30Gi
+        storageClass: longhorn
+        retain: true
+        advancedMounts:
+          server:
+            app:
+              - path: /data/backups
@@ -4,19 +4,19 @@ metadata:
    name: immich-secrets
    namespace: photo
 stringData:
-    DB_PASSWORD: ENC[AES256_GCM,data:OumSCUdG9NT5FNCApJ9D04VIXgRf2X/ieCjJbWqGsc0=,iv:IAC9IXiVeOqFngqOqxReBPYNwPg3p/e4auHeUCudcS0=,tag:uhg56rWb5IzJApJm3tqDHA==,type:str]
+    DB_PASSWORD: ENC[AES256_GCM,data:+bJ/+NEQCT3ZEqjnkzep4OsbLkJ9gyLZmGxCpoww2Wo=,iv:n1sLYgLl3zNZBdjMBhIrbSv/qHJFQ/nvZfBknFAUdug=,tag:DFnoc5K6XvHngVIrgJlM6Q==,type:str]
 sops:
    age:
        - recipient: age1wmm8qrqnjzvd5nkraed6ylrsxlpn3ru7d7zettdudj7y9sg9dd2su0u3mr
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqTnlDR1dRUDNaTlQ2RHpM
-            OFArT3BjOEhleXhVaTRlVDRPcFF1ZFpyakR3Ck1BUHhYQXdsTXMveGs2OG9mbzFQ
-            QWR6dW4zL2VsQWtDNWgrVVBDeWd4L1kKLS0tIDY3WHo1MEl4SzJKM0ROalBKNERa
-            SlQwMEdnZmhSWUdYUnBGRk9MdjV0cGMKxhON65iPrpNMnqBYYUN6rQfhAo3EhhE4
-            Vun3sqVBk1OH8aekutrYSOj/RhrIbzYlbFXTY+pDnp3U3o1+xrknig==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtd1hFZy82d0c0RXZMd28r
+            dWs1VWNlVG9tTE5WZDVLdGpFSXhuVXQ5anprCk5LWWMrWUVCd1N4Y1JENnRyWExC
+            d2VRNDJON2RzSHRyMGhRdmMva1NNY3cKLS0tIDNML2Q0YXFRMEs3V3prUkZYSS85
+            MWRGa3duNHgvbjNvVnZLOXpYMW1mbGcKaN7h3W0YKsRjnyk6P9+bziDy6If5xLQ8
+            kxFJf4CX9XU5jgYXqw2UNqRDusphclqfULUMRaEzMJkkPhd1cZ9PvQ==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:29:46Z"
-    mac: ENC[AES256_GCM,data:/CgR0m+7TJh2hHQ+pee5bP1lbJhWMrJiPjTrS8pP05z4OobLXxScEzPKtuO8+0Ru0eyjg/i1eAk5tzDMzDPwW3/JiU9elQKeFYxzGn6LmT17KIf+ofPP9vuVFP93FW4vqYNZIO4qUtF/RUfZBRgPlf6rokUMRLILTRGI00lvfR4=,iv:z9xX6wGL7I+NZzybQd0j4+rkU+Xb2JKO2sedrrGUss4=,tag:P5E3e/s8bXJBDUhxTqaf8g==,type:str]
+    lastmodified: "2026-08-21T12:23:20Z"
+    mac: ENC[AES256_GCM,data:vGSUhl73AIQr1Ld1SHc+i4GpvOc0b0j8Vx9DmoRDjNs17TQSfmfulEZwIua12P5DHIz36P9yqggHfSyyrrEoMjfaUSTIDxCIGGvsfTl4vBt9Vis0e2gALaHtAgWZwxr5QMe+OP1tkXOZoX9E8VcoBq1ULvbIjqsPs2uxPVKsEWk=,iv:1exDUqurlFdBt1eZYWWMlkar75HbTLZ6RZelC0RsYcU=,tag:A0IhJHjVum2HBT5RwHo5qg==,type:str]
    encrypted_regex: ^(data|stringData)$
    version: 3.11.0
@@ -17,7 +17,7 @@ spec:
          app:
            image:
              repository: ghcr.io/pvliesdonk/markdown-vault-mcp
-              tag: "3.1.0"
+              tag: "v3.1.0"
            env:
              MARKDOWN_VAULT_MCP_SOURCE_DIR: /vault
              MARKDOWN_VAULT_MCP_INDEX_PATH: /data/state/index.db
@@ -44,6 +44,16 @@ spec:
                    name: markdown-vault-mcp-secrets
                    key: BEARER_TOKEN
            probes:
+              # first boot downloads embedding models from HuggingFace Hub
+              # and builds the vector index/embeddings before binding the
+              # port - the default liveness probe budget (periodSeconds=10,
+              # failureThreshold=3 = 30s) isn't enough, so it gets killed
+              # mid-startup on every restart, in an endless loop.
+              startup:
+                enabled: true
+                spec:
+                  periodSeconds: 5
+                  failureThreshold: 36
              liveness:
                enabled: true
              readiness:
@@ -4,21 +4,21 @@ metadata:
    name: markdown-vault-mcp-secrets
    namespace: mcp
 stringData:
-    BEARER_TOKEN: ENC[AES256_GCM,data:UFy6rlwEWje7mO8WJFFvgq8SEKaf0dP9mx00BLPxfKTzgcZqbce2Sr1U5aWVf8iphKapcBWRPEKqa/f1dC93tw==,iv:G8owKrU8ueTnQJ5p6O4U5x5H5WVriqqTUH5iAlW3ZoU=,tag:wuDlQmY622xLZvdJ17cxkQ==,type:str]
-    OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:NEAQqXz7zICa+3bSTRxfnURV0+toWhTexHBYXPB42tBomNg4kf3k9sspSJQYATcxuNIK5xv6XOCna4J1fm/+cw==,iv:T9gj9Jb/RcQcpFQUeqnH6S6Ri/XrlVntv9oU7bwnjEM=,tag:UqR4VqMe75s40TgcggbOrw==,type:str]
-    OIDC_JWT_SIGNING_KEY: ENC[AES256_GCM,data:AwY8V9EQ1Z/NJmc/8msG2RpyCIhEKMzLTLdsLHpC2QfgB652aYEHAYg6u8quRvSypw1cG2zdJJQEym/MJ7CGdw==,iv:FjMwdBE51PuQCqhrojAWiwxoYkemSxO1+9ebw3kRRrk=,tag:X/b/t4e5qZmFJ1FSrWQOfw==,type:str]
+    BEARER_TOKEN: ENC[AES256_GCM,data:vRsc/kmZ1qySDUrI1dMeLqSSn+jEgvPivw3dRYTLr7NRm6T7SYnmhhBb81CG6xQAl0Wz8RfOCescQpUJlbPl4w==,iv:Zha9o8uIdR6DPMk+KRL6ZnKdh3zPXuyjCCK9yKnuYFI=,tag:l+8oHY/hgZcKVQx9yiaEmg==,type:str]
+    OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:2unvRtI/V0aTULgSacGvEoYYQN0uWBR3b2TKjl7hjvQTXesuglTtSNz9YsjDqc8ZHGNBndiz2Q6VZagS3ERprw==,iv:fjMhiKamjbIrNYAK9TU2PPn0smJR+Kr3qhRhEUbjm04=,tag:wuUZbccOBoFcdiTPqb8QCQ==,type:str]
+    OIDC_JWT_SIGNING_KEY: ENC[AES256_GCM,data:63S/0TsEis959MJRLd5atPXQrv5pNMC5iyMHJvT67luLLPkd2bdgfmX4Pu7R3Hr5YIGoujn1/xCuOdZH0RtIog==,iv:3Gi2ZukSzU9SIy7fPzmlvWbA4ykaNgta95DuviHf5zk=,tag:BPUXUPMIxW9kbyyQqoz0gQ==,type:str]
 sops:
    age:
        - recipient: age1kct5g7d7eus2hvdnmx99ewsrtz70lhlasxa25euqwdctqhwqqpxqz0n7gg
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqUm5qNE93WUhKTlRIUXl3
-            TmZMREJSQmVOWXlDdW9DZlFheGpDUHIvYmxFClozek5MVitWYVhIY3I2Nmk3YlJS
-            cEhJS0NKNy90emovR1dCeHZ4UjNvVWcKLS0tIHFmTGMrVjRaSTFCNGQwSzB4NitT
-            K2hIS3FuTHNoRHhxMEFIcFkvQjZmTHMKQls9vNvWQ+zc27JmQXxJilkiVTDqjEzD
-            55M/azYogOsp0Kfe3MBm740tdaPiD6iyLXrEuZKNywD2mPtNT8+3JA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPOVJCaXpjeUEzWkN4SEdz
+            RnFkZmtXa0IwaE9xdGtBdVRwV1B5MkdDbVMwCmVYeUJpQmQwZ29BbnRPK1AzWGJx
+            NHV0NnRxenRWV2M4MytrZ3llNmxaMzQKLS0tIHVOcDVyTDkrNHJRMkhRVzFPSGpW
+            V1RRNTdiUTBjSWZlMlEvRXF3OUowZ00KXf/+ucgZuDAczE1WlEW7D2/cR+sB66BQ
+            7JC42VJiyEf2djlODmvK26bDTeiJ/Uk9HsSuvamGUM8b8vAj2w/r/A==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:29:46Z"
-    mac: ENC[AES256_GCM,data:sfdT7eRXMpgbWtJhu5U6/T03ckavKNcojfkg9Tu0uLwigsAsaxgiMhBA3kQWYU3tV9gxy6BXIak8cdF8EfCEAWBYSQC6iQLgOZPXvLpWFoaiigNHbKSYLYcimlD1wmHlRb5L0x5+QNANxD22Hkjlkw0kgPQ+GZKP7SzDsixXpBA=,iv:1rC3zYmRWM1/8O8xgitTwvQ9qORXNR20qABDKPqGpSc=,tag:YkJNRwxoGfGXnfcX5AJXtw==,type:str]
+    lastmodified: "2026-07-27T06:42:40Z"
+    mac: ENC[AES256_GCM,data:XRxbyHL4iJMoRMb4X6C2y1ChTNSkqou01bwtIb6zNfwcGCt7uMGbm1HxvmjbdeJI/zQIIVfgxbbTxhZw+sL2FF+PYAjPcaGvaJ86O97lr9fUB30NC0tMluW82pt2iiisK+6dEEPH9i/kGFrJHN6RlaYVkEfv6U8xjlpIcaNx0+A=,iv:YnqMRlHl1WVYNqqN9hRH88hgIALrfgv6WrJGyeNDstI=,tag:M1DYFr3G9ub/R2kNF8ZnNQ==,type:str]
    encrypted_regex: ^(data|stringData)$
    version: 3.11.0
@@ -1,6 +1,6 @@
 image:
  repository: eclipse-mosquitto
-  tag: "2.1.2"
+  tag: "2.1.2-alpine"
  pullPolicy: IfNotPresent

 # not really needed, as StatefulSet has hardcoded "replicas: 1"
@@ -18,7 +18,7 @@ spec:
  values:
    image:
      repository: eclipse-mosquitto
-      tag: "2.1.2"
+      tag: "2.1.2-alpine"
      pullPolicy: IfNotPresent

    replicaCount: 1
@@ -4,19 +4,19 @@ metadata:
    name: mosquitto-passwd
    namespace: mqtt
 stringData:
-    passwd: ENC[AES256_GCM,data:RHKtt4UgqElKW/rw9BnpZKOnhchsqmO5jVVVRJBy82b+9KrbUN5iGQ3k5X4/6gjrKKOcs5QabJahR+i/aVSr5fVyCJR7Y45YvKk+eyKqGuDTFCkzjxpSDvO4AseQvOHSGTMRXQx73jdpCnEEYtoXZNCLuhGtueKvrhkNDDCLFwtybaWsrI4g3fwo5auHbyWwjoxXskv0+pwi7vnESIJudJl4ul3Ie4NpyispZ+H0O6p9cn+Hwu2qoTJbR/zbpA==,iv:Blp/QsgEVD73JhGFzM3GNFPfUcwB58fzKJlQIGBw5Yg=,tag:InRGXl9vB/DF778pbhoqfw==,type:str]
+    passwd: ENC[AES256_GCM,data:YpTczjZ73h4Td+TmEZIgil9DN7WfVwBsi75F/t3D1oWGjGsifklnRsZUJqXiXyUwIxTxlFiWgfb01LjmILE0nB9rxoEbFdrASaLgtnCoYz/fvSZLqwCK+FSSub3+r0nJTNvxzD+bC/av8JEPNDW/8CSrHMrTrVCcLhAchOAvviRLgO18862XWcvPh1plO8luaZG38cuh+VbKKwidkwozc6B7Ghys5NfZuB1rP4vLZ6/f1PzcFRugtJ0fzzl/BA==,iv:9FKm4V/lYXott/6aVBKg4g8GtzVqgT/xndj0CKqMm+Y=,tag:41gCVbrK6Rp2IvVUt98Hpw==,type:str]
 sops:
    age:
        - recipient: age1u236u5mzkzj72y4mfxx68gfqw0u0j6tdgkudnm5pdfpe7apq4u6s89jr2h
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBudUhrOVlvUU82cG45K3ll
-            R05Dc0NUdFN3b0k2UmZoSWlxd1diQ0dNcjBFCm1icmlvQUhIaFYwSFZ0MURmQVUy
-            bTJPWk5mWVpQb1JNQXhCOFhpNXByNTAKLS0tIE1vR0t3SUdGTnRiWFVXOG5yYVhk
-            UVBsRDlZSVpJbk1KYmJGYlRmelNWWVkKBVabDs2XS6XAVKiKbAtk3CqraoBXOD5I
-            +0uq5YeFvMxhrnX6wXffCS7S3zbvNV6/2Enbt7SBJ8EhCvKbfaOtfg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBobk1BQW0yemEzV1FQM2ZJ
+            YkZJbjJPZlRiSDlyamx1WVdyNTJBNXo1YlQwCnhBT01SeE0rZDVOcFRkZm9KQ0t2
+            dUIyOHpzenVZc3lsa2hmMjF3LzRGMFUKLS0tIENmM05Ud2xGblNpdjZjWWFPeWg3
+            UEtuZWZ5enkwSGk0MXR1czBibzQ1M2sKfp+76C0X2DgsffWZVtBevI4lCs8RM09p
+            tzsrneX4iIX6WCn1kRLsWTZpN6Vg8Wsl6kUWnSA3WfHWI9W4CJdrag==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:29:47Z"
-    mac: ENC[AES256_GCM,data:/NEEVA/hO2NUIWOhVjL7ZmtD9Ac169CL4D71qPueZbNSHtTqx8GHeo8DI1tpsUBuGytVBQxh1MXK3REt/bD2GzU1dCpvtTtQmQb+B57H6Za3RIyPU51QTt9nHYHiWend3tcxlR3Xc8h5TBa0kKwjXvlij4jEUM+dA5UESE/QGFk=,iv:yTyP3PVw+pVzPPqMN7EyIfM/BN/wK9nIHx84F65A+/k=,tag:oTpIqbAOq5aqlCWnVqaKNw==,type:str]
+    lastmodified: "2026-07-21T19:09:49Z"
+    mac: ENC[AES256_GCM,data:qecTVUaC/3j/oP1DVnXEKV9Ub+k5gvGHfteol4W5I3gq8IB2YYZ+vfuinPVJJeSsN5HvK62ftnIgRNu0dtzDOrnuZENczEMwPrOz90RCUbX7WBeKh23KZ8gSSw2MBn6gsDsz1gXFWENIyjQTJFZ4qAJY6jfeH2IFC9RkpoU3j14=,iv:ksLG/aHHBAkl6aA52Xufs2vijZlpsaXccoxheYV3Gm4=,tag:4YiaPGMBWSWhVBO1tNF6vQ==,type:str]
    encrypted_regex: ^(data|stringData)$
-    version: 3.11.0
+    version: 3.13.2
@@ -4,20 +4,20 @@ metadata:
    name: vaultwarden-secrets
    namespace: vaultwarden
 stringData:
-    #ENC[AES256_GCM,data:bFZ/wUZ6oINU4pYH5EnWQSyOsLngnr8CMgIMDDNTN9F1HCqPQMp2TQjh5nLpBIWegJ8VxhaGc5+d,iv:Jvrw4+Cuec/X/AV8iK+SmO3P7C8Ua2ko9vTOBUAhSEI=,tag:bQ66e+Uz4BAbMEPzbONFaw==,type:comment]
-    ADMIN_TOKEN: ENC[AES256_GCM,data:yYxQ9/DkzA8KCZYqsDnQbkDBynnLTHZ/CTnZQvl2sijMaeHAeAgFDUhFC8ew8ud6Gu9vvh9V1hUHeBnsxKASxmuNP9HOOSu0irpcgUDYU5nxcAhEVzgKvP9JGhc/XinbA/7jVxXiEf2I6hEApGylPQmoIe9QJw==,iv:hqNaSZovw+3ao5059kgwJQ024HohHRXf02FR2/rLWFM=,tag:ez/enc/6s8CHoJ+264gURg==,type:str]
+    #ENC[AES256_GCM,data:b8Yuhc+eN6k2X6xPhUUBAMyNmJhZl+cpszwhb9OUiZeDJUNC1CUFTSD4//XH81kud+iM3/6o854S,iv:0F4/f5sjeFBqp7zZfJhYd8tkiDRlfKJ6p5n337THiWo=,tag:ZNHbaR0tbHT6aWzyfqeqPw==,type:comment]
+    ADMIN_TOKEN: ENC[AES256_GCM,data:pYY8Nc2PevrFGU2pbZaFH7O+WNJzOHSEXMM3TAFYHO46/GGzQjrxYbc9IY/8PgY86N73kQAFLvw2bpVnjiliilLpnxm9Z0LyYDlAhui8545J67IqoQFDyZt5o3NHceWRP2eCxEL4Bf9gD6j4YfObRVYrp38x2Q==,iv:IvzPkKi/w/S8ueYl/m8kckWiddfl1oQKYiT8S77IVAA=,tag:rD5RsmPt4uihMHWSt4gGwA==,type:str]
 sops:
    age:
        - recipient: age109zta6l0cwpkxn5wek82kvauxn6yqrq80rsz4mvu5atdnpcn9pusuvnqk5
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBncHhhUW9MNkUwcHlMS1Vm
-            dERHL0dyN2ZIVklSSkJwRnNQR2dtZjhpWHlBCjVVVGN5ZUhtdGpNSEhXUjhCWkln
-            b0h3TkpaN0UrRWFuZzd2d1JiWlRIV3MKLS0tIGJKNE1jSTVxamsva2tUSUVpbzhj
-            KzVYek9IZldwSStXN3BCSXNvcFVNTUEKRivXr6lUXL/45wgxPIuQAqfgSzZe6Ofz
-            vT5NsMte67eCYwmAF/+wSPZP5Y7OI7UzPedTUIMvn5vUMy70vssB/Q==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6RVkzM041NFZDMzlYRllw
+            a3BRS0JGZ1B0UGYyaTRLUkp2UTJ1S1pybDFnCnZhVWNYMFRlSXlFVTMvRXlpdlF3
+            Vk1xT1pKV1hzSUYwQXd4ZG92cnhDY0UKLS0tIEtLWXZiZUFDeGhFdytKbTJHSjRH
+            YkJhS2FJOTdLbHlRelBpUWRNUTdTMDQKhgb66tV4L0PKkPY8DvbypTpcBlavUvRH
+            0+Rz/UxfZpX8u8G9GeqF5glIpNG2x28VSOHchJxhvMKHIUq9ZUrHGw==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:29:48Z"
-    mac: ENC[AES256_GCM,data:Td2STb6nbH3Q383YxUMgecnmBRnsH1cNq0Iv1/q5OvESpIzhVCeVgJMIKBWEQJNfuxdyXR9mbFJ5zELIBS2ymGihtr4pHMKxj/kFpj1zPBqy+OKhP+E67juiRVMg6DJDSbdFHP21dOetllkcRgG6SImuOPQXQ3eozmPg/vpi3Xw=,iv:Q1B8KUrzBGIb2wBTZPjdb0a7XMyp5BpDf9qa8wx0smw=,tag:k54imcB/x03ttFVQKamKiQ==,type:str]
+    lastmodified: "2026-07-18T19:13:05Z"
+    mac: ENC[AES256_GCM,data:Ufdytxb9uH6JVXsWu39YhE1AfD/oG7bXhIwoTXYhYBE4IWvugrwZLCvBrgkfuazVXyKBuDIuEa5Vj/bzlTGDSlRNx7SDqabvilhmYAsBcuU5DAVU47pDz1YnXeHd9TuQI1dHAc1Q3uvkZwWNxh2YYXKZGwNMy3tOAkaOxwI1rMw=,iv:iUZenTP/9JhmjcR4p5+RM5K2YuXBLnRj0cd/RHseqFY=,tag:pesF8Pp8vBoQXcniwrep9g==,type:str]
    encrypted_regex: ^(data|stringData)$
-    version: 3.11.0
+    version: 3.13.2
@@ -4,20 +4,20 @@ metadata:
    name: webdav-secrets
    namespace: webdav
 stringData:
-    WEBDAV_USERNAME: ENC[AES256_GCM,data:leD9Xfk=,iv:PLT4ctrHZUoSVCxkel99UyaI2FQVCjWq/pgCC7u/W18=,tag:W7ypg88sYu9tNJOxjlgeSA==,type:str]
-    WEBDAV_PASSWORD: ENC[AES256_GCM,data:mpVRd5XzbQJdJKrEuixG8DVBmez4IW4+rp3/47QfGs7TLnMkJ3olPbHHleYFv1z4,iv:O066w8Sf4V8V6SFNjV3YoFUTm22vlSg8458GdSmo56Y=,tag:AHd0KrEqpBbsj3Pm4AcR/A==,type:str]
+    WEBDAV_USERNAME: ENC[AES256_GCM,data:BeN5VS8=,iv:XpUr5PG9RWTRGXs7/EzDyLGwUm05Mr0YWpW7PwzNfm8=,tag:3py47tIcTeFxuuAidk2wBg==,type:str]
+    WEBDAV_PASSWORD: ENC[AES256_GCM,data:Rh1ryftcmxgJAHvC/N1o5QeagCvyb3XIpDS7jOTCpJm3Wb5rUcLNmtcW22f0xljw,iv:GmgQJEuzUzSEql+fx5KURKv8CnhXF/z5UlmEn4ta+K0=,tag:AZD1CEbVRm6DiBt66pB9Vg==,type:str]
 sops:
    age:
        - recipient: age1y8t9v56yuvskznddqfsd4yddzzch0yf2dutvvt8rrx6rjh5f9g0s3qeays
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6bGRvZEc5Q3dVNHM1ZnIv
-            cDhGKzVhR2UwSnE2VW5JQVo5UEcyTzlXQ1M4CnptNERCNEMyUFh6aTFrc1FHV2pW
-            RWUvUGRNL3U5dnJhK0kwSEFFUzhneHMKLS0tIHgrWHFGMDgzdVpMRjFFWEU2ZDZC
-            SUN3WFMyODdxdlNoMlhmbFJUbEJQejAKRoY0DzKyIQmeyq9yf0IZe2A5LPVyA+Mi
-            aShqop1PqAytaLmizdqryTR9gfGACILuY/bzBhs2MzvTLaaXzkExbw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5UkRLNWVyZUpLREtZcm8r
+            V0VPTkZDN1pSWDNxWFZXOUlON1c3cHhSZFVzClpEMmhvQnlFMnF6aXV6MjJnMnBu
+            c2pxTDBGZVBUYjZNR1doQ3UraDQ3dlEKLS0tIE42dTZWMUhZdnVMYUNLTGdrSWZC
+            UFM0V08reGVmZTRMUWw5T1R2OUdGWW8KWAZq4TG36Njlw4//vPCxzM1Qqr/6Ievw
+            taBvLXpw9wkrjfZJ8gBU+0Q8WrsEy+tYtR9chfz1n/SmiGHCkskFGQ==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:29:49Z"
-    mac: ENC[AES256_GCM,data:9iTiXBfG3Ua05tye8fhtcccE+Px6nef6ZvUrM1IlLNNvMg71A7s24/4WTHrSptLtcswOXLKtLrV9uHBg4ssT3HMOer7RBb2kmkUBLKJPwNKBZdQOo/YB2ETA302IGEeBQNLLsNSrw4PiwSkzTMI6PErsAbdxRn80hjFig+gyozw=,iv:YetHHW1EpB/saKxvEWO90JQTEPPF1EOHD8h+KNbQECA=,tag:B8z9mcYTQibaGi4pUGcJeA==,type:str]
+    lastmodified: "2026-07-29T18:57:24Z"
+    mac: ENC[AES256_GCM,data:bW2QvjSbA4JmfmZFzC1oIfEnVBxf1pE4jtKDsp2sf7mozVEdqMTD2nNpq4Pro9zRiXQfzxQAXAyzT48dBhIunXKDNIS7vbPpLUbs0nwSF4Dgp/q02ZX3Vrewx80iz5wdMYvLk6c2viZ9ndMwRqBbdBBsuSa5O9nIVj1edG9tj70=,iv:8bgXaA9RiQtbd1Xaht5r5NB3lFedX7Wi/X4z10VLLuA=,tag:Qnr8Ij6XN/FMcQf9Kx1IvA==,type:str]
    encrypted_regex: ^(data|stringData)$
    version: 3.11.0
@@ -4,19 +4,19 @@ metadata:
    name: zigbee2mqtt-secrets
    namespace: zigbee2mqtt
 stringData:
-    secret.yaml: ENC[AES256_GCM,data:RdMKYeSHeJpHVJqglYAOyfdDyZyuc7KQheiq0vaxb5fs0DrgOYP2EgMKOcKA8Lh933W7u9qx/VrkOjBz+fm66vyAxwQKXvGZjnrM4RqtN0rW5UMG9C5s9zyQrepVECsqDiNpC2NCzRE9DsWX7Ux6Ak0RpMV0wkX1fAzVVwE=,iv:Uee5eN7qFyI2K7VgUEnTP506zy+ZK1uNFkemax48DhU=,tag:gvFAAUva/gJy1gBeZek50w==,type:str]
+    secret.yaml: ENC[AES256_GCM,data:mDb7Vt4sOSaqn9+T3QEAR0yutRIFwiYpBBZDMQI4FMvAPWPkAdsYTIfvv+41JbpBafklDJ5gzPPKZJ6Qk1f8KBvjRuHP/bJqTUPrv+Q46ZKsuXECQq+qB8TKAj51FiJssyx0jYy9bCYgn+Z9r+WBT4YSAvv1XS/UHs4S8UA=,iv:8RHjs0g1ee38yUSHjvQv06Z7xbzMOG6LNzCJ/7s4+Pc=,tag:jb+VgAVApqIpN3lERqrfBg==,type:str]
 sops:
    age:
        - recipient: age1tu4xgfefvgdda0vn2thaqndq4p9tuydq2ud6qa98tzzgnff6749qnlcx29
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0Z3ZTdXMreGl0OWdjSkI0
-            T3lWRTNrUUJrSk9KVm12eW1na3AxZCtuNURVCk9UMHpOY1R0Uk9ZT2V4K0RMeDk1
-            cFBzcEE1RTJnUHFPVWZVaDh3R0xkQVUKLS0tIGxVVVNWSlAzVzR2dWdDZXFtTkNR
-            L3JVQ1ZCY3lRL25SLzBka2RBRFVNRWsKu3/3f9tH7GyzCEENtCTGDyK6l7lvQMw0
-            GSOZzZVClKfbCDrdjAqgly8ouGeYx0X19KtoHmggfH95nvcYheFFTA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAzcUFqU2RpTXUwR3hsSEJr
+            WUV1NkpqQitDRDF6MUpWMWlnSS9TaStRZ1hNClNkSEIzOVVSTUh6LzdXdTdld3Zj
+            U1pVcE5IaFhuQ0lTZlZ0RzFDSHVkREUKLS0tIDdTbEJLbE9KUmxRei9lVlc4TW1t
+            TE0yUERpQkpqZFg3aGpvSkg4M04zMGcKcYmSgyzhpZ8BGAp+0zkQ7+ZnF2w/Nk9D
+            ZT8zwqCJcaRldg59JzmhLBfiuYAtnH2wqWj06LiIfvt+P3pgY79f3g==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:29:50Z"
-    mac: ENC[AES256_GCM,data:ZJAwVpj9OKeLqN3kEVtHdlouks29xb5a9DxRUnq7pNmf5lww8GKG1r8nfm9t6Z4JeuOBjN3zELjuEC9zBJ5Xpcdp2Ru8e3oD2816fu0feuiVkTXjaSrq1ZfHezvN5eHQqTU6Pmx5vSQcy8c7e61mI0VyYvOIUSXY4zfd1mDrIGc=,iv:qqFi/nUg+KWi/aBfJqlXqU3lnn8NZ8LS9CzbJcLOlpg=,tag:oykm3cfYCn3m63ajTS4rRQ==,type:str]
+    lastmodified: "2026-07-19T09:01:11Z"
+    mac: ENC[AES256_GCM,data:fKfDsAg1Ya8c//x0xw9ytQR7hiF/BssuqlwA57PYiB1yjCW3Kddcdt95UF1amF+9tvJb2XwRjb2LwN4RrYj0RyScLmLa3u/l1r79EoUKQWQ4qF7GNdD5ZGaxqnWjgorxkfYcU7ahJBRDEIsvJXJivk6Wjm309ISzl8xR/tUpFCM=,iv:TmFo1gbRsATh6O0uJvJxwyj7hSzCfpPPuo55EkQQabk=,tag:CJ0cTn9BJs+87AvdwJ0MsA==,type:str]
    encrypted_regex: ^(data|stringData)$
-    version: 3.11.0
+    version: 3.13.2
@@ -4,21 +4,21 @@ metadata:
    name: longhorn-backup-target-secret
    namespace: longhorn-system
 stringData:
-    AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:Yf3CM07ST98zuo595rsWL0ltYmc=,iv:+JOv1TEjFGygopzMHsQvpdaKfX3tWg1woLRtgw+hY4Q=,tag:+9flP+/Ap3cUwMWJ4LZj5w==,type:str]
-    AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:rzAUUcv4de7AbvAziJVfAYlwwn4TZhzrYwNhICPp+CNtn5hlhoZOTA==,iv:EQhgZ8iJlI7yHX0Pu1GKGACfGiyNT9ui8p6MhSrdvn0=,tag:Oku1Q/o54jx1pY5K73u8Dw==,type:str]
-    AWS_ENDPOINTS: ENC[AES256_GCM,data:upvLav5iZdAwfcZ7pJd7hgVRrTEn800Yh+js8KvCukZf1ybNSA2QAX9Dn3/c6gsmI9iJN8Ztg93MGCI85w==,iv:usiTtOM+uLcxVghNeoHo8+/bTIR9QfWiMz+ke+xPFDs=,tag:WPVw/nVNUSBbCUeVlxoKrg==,type:str]
+    AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:QPvQnrkMSKK4Whj7DaMONoDW7LQ=,iv:K1x/VDp4VZUnC7u86wpEfVBDW7T9cI4CZojMZMCaS+A=,tag:eFAAnCMCVjNBHnFAhzFS3w==,type:str]
+    AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:zFjxH1uqnYRrxM4Yrll9Na+mDj16aLtiJC2ZlNO+2r70JcXJqnTASQ==,iv:B7eV80h4APk3QCuoDR9EFpKs5dkMF8GjQ2v9lSF/ev8=,tag:xLbWN0Gy2idB9j2G8HZYKQ==,type:str]
+    AWS_ENDPOINTS: ENC[AES256_GCM,data:HWVPThBb5GLpiRqAuSLvmAat0XiUu5R5CMv2Fv6jdieZ11lUmbS2MBD6lx0vQDSIzC36hd6Tu0hgqtknQA==,iv:XLqWSNHgj8O0uQPeBbnN05Za8G9VW6F802CCPoUoq9A=,tag:dsKXCq21hDlJy4KTyQTp/w==,type:str]
 sops:
    age:
        - recipient: age18hhmdmupj90zjgjpxk3z5cf3lx36hcznnmqsp0fpyg50823pudrqjupydt
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqSmJQYTFDN2tSZDBPYVpt
-            M2tub09CRkpUd0ZtS3M5TDdoU0k0N2FKdzJRCkNndkhaenBIQ0lUVWtjY0FCTTMx
-            ZGg2eWh6eEFudzg0d0lnRFN5VnN1MzAKLS0tIDZqUEswbmdmQ2d4aXlUVFdFREFM
-            WUkzNUZSRDgxeDVlN29aMFdWOWZRSHcKvoZaEwnjkOVw8pvkdpaTQvpbBSTuWUYN
-            XkzUPKQmtRLNp0bOgXyWpWWJj2i8ue5SI313g8GiJJWZZ4WesA/atA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqRndobTFybElvakN3c013
+            T3d6ekVUM0V4OVNEMjl1ak5XTzNPS0xKRmtVCjBXMjVybEs0bFZKN3ByWmFpWm9K
+            TVVLVVBPYmE2NnJMT3Q3dVJRa250aXcKLS0tIEVKeXBGQ0x4ZDlIWENMa3k3S3Zz
+            YUdxZXoycXBPbm5raWxFZ3owc2xkQmsKNzw+5kn73FZhApzfN/RBj4yAd7GLl5/X
+            wyXVy0te83ZDeVQvqhXLkUPsbF8CYewC6xibZSdSY/WBh2ojedJXrQ==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:29:51Z"
-    mac: ENC[AES256_GCM,data:Gq7jEOcEjsJmJutnkUQZ/mr4aU11bCgHFz1cK0U3k61A9IULUqyV1j0/+ZNAF4JsXv255XcFsn6qouvFbKlAw3mg0LtjwP4zIkhIj+eThZ+EqfuoJ8F0vvLFijohu+kRNyafLJpNGHEqNvTFyd8OXKMNZET74UTHV4qseBMIf5o=,iv:EdEQVzK3yRa4RgP09m2gZirszwLv8Efwpt74jS/lpA0=,tag:YpZOC1kvpZMye24Ha1KEXA==,type:str]
+    lastmodified: "2026-08-11T19:04:53Z"
+    mac: ENC[AES256_GCM,data:SO2tMq3UA0JcsTZyH3oNhmCsWZ2OhxEmJSn1b/3sH78cZvWalXUsdQqD1GBArFgS+oCSaSgarl2Ve06iNJtM8k6oq0fDkm0dxsLou+67qHlle4CbkP1KPFEQid2Nx8o/5b6cjI2zHz3bYmQTQh9DD7mE8roqo6lX3rYY35MpPJw=,iv:Ad13teWF+lZfzOY/PIALI3/Wohn/0BBoSuE0mtiH8/Y=,tag:sQVQfH0mFFMLnF4zbRC2VQ==,type:str]
    encrypted_regex: ^(data|stringData)$
    version: 3.11.0
@@ -88,6 +88,13 @@ spec:
                enabled: true
              readiness:
                enabled: true
+            resources:
+              requests:
+                cpu: 50m
+                memory: 64Mi
+              limits:
+                cpu: 750m
+                memory: 512Mi

    service:
      app:
@@ -4,24 +4,24 @@ metadata:
    name: s3-backup-proxy-secrets
    namespace: longhorn-system
 stringData:
-    WASABI_ACCESS_KEY_ID: ENC[AES256_GCM,data:okf70ogiDqqAkpnSCBYkW9oATC4=,iv:iVs6x/2z2+gejRQMyXwpa/hXQ6xq7eXdMVA27IHiPqw=,tag:qXcpGptnTCipk/NX3Ph9Gw==,type:str]
-    WASABI_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:Pltg8OsVpXcET0qe5Zdwu38KBlR+oR6lT4yVi2rwNMmJxu4HryqMEw==,iv:oROBr2u09mdUVeffu/dyCIwmKabFMpOK17BL9uHx0VU=,tag:Tgmnqy4RWe4tvbEuqz5t7w==,type:str]
-    CRYPT_PASSWORD: ENC[AES256_GCM,data:PbwJlJfz6jTM67qGi0tGkF9b5nVd0OhzRu3cTUn8IZVHIaDq7JQpykmq3g==,iv:UNkWK3DpY3Ux5g/SG5tAY5RU0spm1D/B+j5lp4eTxkg=,tag:0l9WxfSalrKaCDF4RAWoew==,type:str]
-    CRYPT_PASSWORD2: ENC[AES256_GCM,data:An7PTYE6Kp4ym17cFJ4HD+kiXbFgz0qOxRUTPjXFpoj++4QFzgG5PwnZuQ==,iv:TwcnYlyuN3o/tvQrxhuirBNL48lD66GzL4XUTdKzyIA=,tag:NoEp7DfdLCFQ8ju6Tk8adQ==,type:str]
-    PROXY_ACCESS_KEY: ENC[AES256_GCM,data:AIpKJPLYOrda/lyklBKtkbfyBx8=,iv:b0xXnfhsp4gh/v+wYYSinKCpj0fZcgm+yrrOC5MYJWs=,tag:CNMVLrAouXmDxLqlkYI3CQ==,type:str]
-    PROXY_SECRET_KEY: ENC[AES256_GCM,data:hz3GyFtbbTnVqWi8O+P7aRUS2IA0oDipgtBq8KPpDEyclv1rdBGkfQ==,iv:UqL4wYouaVuJwBlgJzfbrPfs7hksgyaY2a2cBPPUQn4=,tag:w4cYoFVkRodXC8dK9CG3IQ==,type:str]
+    WASABI_ACCESS_KEY_ID: ENC[AES256_GCM,data:YP9bOIarPh6DJVo0vevVN2T3c3A=,iv:bTKwVx/Ij+GMCisO4WEDCJz8rsHe8PtSET/h4+P2dyM=,tag:fdXr+wAx/SvKNwlYlmKvRw==,type:str]
+    WASABI_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:Aa0ZYxiVipW2g4mGzyhCspVF67m7hnouMg4Tcr6kSinY+ULpHtEDBA==,iv:txr1ual5z7dXi/27T3FOMsccQtSPObHpg+7IfxvfWuw=,tag:MW7fl0iRB/6flbN+iA+2QA==,type:str]
+    CRYPT_PASSWORD: ENC[AES256_GCM,data:x8kMqkX4OzduFbW1BGc2EcFxaVm4ah4BBgLNxzQfIHeuL3UuJXt+Cj8isg==,iv:xoFXHqUDK/yamkDaSaQaMIkC7p+q/4qtsrYNwKT7944=,tag:92nej0/10KVTsugwFzdB0w==,type:str]
+    CRYPT_PASSWORD2: ENC[AES256_GCM,data:TdcfVmkgd36Hq80XaLRM8lY2dUq95h4v4ONCy/O7DOMoRwVxDUktgCRgNA==,iv:9EluJOnjKjCo2272sIeJ58iFu54DKfbkX785ZySj3C0=,tag:WUMKDLASA9grCilKNLVmZA==,type:str]
+    PROXY_ACCESS_KEY: ENC[AES256_GCM,data:A1ZF8ejApPiH3nISLvrO7+vWTzM=,iv:fSFwYL/6zxtK4wkz+G3WItzq6P92eGviQ7WaVquDYuk=,tag:n9fjuW/cXU7QWe5IUkXf/w==,type:str]
+    PROXY_SECRET_KEY: ENC[AES256_GCM,data:iU6GHL09tzxgyxcl6wKlDNhaO6YVYS/8yy/qCPbSxE3RlHk0Yw9EnQ==,iv:i0R6SzOJlEDsyEhxLrLMVaJu7ZAzNsnnmdyrxbv6ys0=,tag:h290ZIcFevBQeImcfqQbjg==,type:str]
 sops:
    age:
        - recipient: age15vc3geq4lsec69rnxczluvwgcexeqae02zxzjpswsuatthaasu7qzath48
          enc: |
            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoVVVHYXlTM00ydVJjdXFL
-            U0k5clRFY2VlMStzZE9DeVlweDNDelJUTjNBCmNwbWw1UldxNG5XZzdZZzh1UStw
-            eFlQa2k4UU1DWUdlMUF6N20rOUNwSmsKLS0tIEtsbUdBNnZYT1BmRmg3enF5Nmp0
-            Z3p0UzZkS0VHdDhRbEU4Q3M5bnA0RDQKWcny31QSOW0t/XDeBspoymNK5vN1ltqI
-            mdWodYgxrZ7qgaBABL18QENAJMm2i/C3VY6upqGjTjxSq7+huKfTQg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBxR0hwMUhqVHFJSVBUckZW
+            cTdCeUx0bC8zdjB5dmhRNDJrc1ZOTnY4WmxVCjJNZEUrMEFEYmNGUWQxbHRZL3Bj
+            S3dnOGhENlJkV2oxR1RhSmdCWXczVWsKLS0tIHIxSnVSdGtKaE52UHNtaWVnRUNW
+            Unc4QUJ3YmF3N2xVVDg2VjBrZW80QmsKZ5HiOTiYRCrfWJf2Qpxyc4D+1wNWxHzK
+            hCe6G9ANAX/EAlGwmOIn3k7cFbN1VRt50TV/UCj+FsJBuifUYVMvTQ==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:29:52Z"
-    mac: ENC[AES256_GCM,data:knkRyXRoKdjhyWZIWDCRW5MuhxtxeTm42Fm+rtVZawECWCSIqxTYSfQ6xW9RlalMcsHpdW4QTHDBgZhp6APDe3f+9Frn59UCDa415hqm4VCreDFhqy+x5kUslpT8Zg1ggsiWTv6/XxI2NM0LswoDu6akAEKnBRYJ6S7aam1++oc=,iv:Z8y1HAlzSgbEjX8sh8drHQj6Oigt13m3kYLvWAJZTGs=,tag:iunewDP8PGlj6iTaqAnbnw==,type:str]
+    lastmodified: "2026-08-11T18:28:22Z"
+    mac: ENC[AES256_GCM,data:eICyFKuJAyCE8ZbdpWc4rOHRxtnrFhdxTeznIWXie5CrHRyo+n21CPg5L/VQUy2LF1rXINIDJRNqQWcLXJEXDKWGpqyaL/YcW+OawpbCq0DMJAe/DsvBdy5ySwGFdRlwU5x7ivVjsHKnsr8UgcbHdE/ZVRq93nZOfZlUepjb1u0=,iv:l+SFwIobBbxeZNUmwK6U9W5YpLh4t5GOtnRIH10Z7W4=,tag:6Zs+tneNcF1d5i43ns6Rmw==,type:str]
    encrypted_regex: ^(data|stringData)$
    version: 3.11.0
@@ -15,3 +15,29 @@ spec:
        namespace: metallb-system
  driftDetection:
    mode: enabled
+  postRenderers:
+    - kustomize:
+        patches:
+          # frr's liveness/startup probes default to timeoutSeconds: 1,
+          # which is too tight when the node is under CPU pressure (an
+          # HTTPS healthz call can't always complete in 1s) - kubelet then
+          # kills+restarts the container, which itself adds more CPU load,
+          # compounding the problem. Give the probes more slack instead.
+          - target:
+              kind: DaemonSet
+              name: metallb-frr-k8s
+            patch: |
+              apiVersion: apps/v1
+              kind: DaemonSet
+              metadata:
+                name: metallb-frr-k8s
+              spec:
+                template:
+                  spec:
+                    containers:
+                      - name: frr
+                        livenessProbe:
+                          timeoutSeconds: 5
+                          failureThreshold: 6
+                        startupProbe:
+                          timeoutSeconds: 5
@@ -18,4 +18,4 @@ spec:
  decryption:
    provider: sops
    secretRef:
-      name: sops-age
+      name: sops-age-authelia
@@ -18,4 +18,4 @@ spec:
  decryption:
    provider: sops
    secretRef:
-      name: sops-age
+      name: sops-age-davical
@@ -18,4 +18,4 @@ spec:
  decryption:
    provider: sops
    secretRef:
-      name: sops-age
+      name: sops-age-immich
@@ -14,5 +14,4 @@ resources:
  - fava.yaml
  - infcloud.yaml
  - syncthing.yaml
-  - photo-stats.yaml
  - immich.yaml
@@ -19,4 +19,4 @@ spec:
  decryption:
    provider: sops
    secretRef:
-      name: sops-age
+      name: sops-age-markdown-vault-mcp
@@ -15,4 +15,4 @@ spec:
  decryption:
    provider: sops
    secretRef:
-      name: sops-age
+      name: sops-age-mosquitto
@@ -18,4 +18,4 @@ spec:
  decryption:
    provider: sops
    secretRef:
-      name: sops-age
+      name: sops-age-vaultwarden
@@ -18,4 +18,4 @@ spec:
  decryption:
    provider: sops
    secretRef:
-      name: sops-age
+      name: sops-age-webdav
@@ -18,4 +18,4 @@ spec:
  decryption:
    provider: sops
    secretRef:
-      name: sops-age
+      name: sops-age-zigbee2mqtt
@@ -15,4 +15,4 @@ spec:
  decryption:
    provider: sops
    secretRef:
-      name: sops-age
+      name: sops-age-longhorn-system
@@ -15,4 +15,4 @@ spec:
  decryption:
    provider: sops
    secretRef:
-      name: sops-age
+      name: sops-age-s3-backup-proxy
Author	SHA1	Message	Date
azykov@mail.ru	5cabacee84	separate keys per app	2026-08-25 21:25:40 +03:00
azykov@mail.ru	07fd7110e9	fix for photo-stats remnants not cleaned up	2026-08-25 16:53:58 +03:00
azykov@mail.ru	2d78870b94	more generous liveness probe for metallb	2026-08-25 12:18:56 +03:00
azykov@mail.ru	a6c72aa3bc	cpu & memory limits for st-backup-proxy	2026-08-25 12:18:33 +03:00
azykov@mail.ru	3b833cc575	immich data-old folder deleted	2026-08-24 10:03:11 +03:00
azykov@mail.ru	6600fa660e	immich app is back on after folder split	2026-08-24 09:51:28 +03:00
azykov@mail.ru	f59b01e290	prepare immich for data volume split	2026-08-23 21:13:49 +03:00
azykov@mail.ru	1df90d3a6e	md-vault-mcd longer startup probe	2026-08-23 17:52:22 +03:00
azykov@mail.ru	90014b22c1	fix for authelia and md-vault-mcp image versions	2026-08-23 17:45:35 +03:00
azykov@mail.ru	cc7eabfedc	fix for mosquitto and fava image versions	2026-08-23 17:39:19 +03:00