folder structure. longhorn installation

README.md

@@ -1,39 +0,0 @@
-clusters/
-  base/
-    namespaces/
-      vaultwarden.yaml
-      myai.yaml
-      shared.yaml
-    infra/
-      default-storageclass-patch.yaml
-    infra-apps/
-      metallb/
-      longhorn/
-      caddy/
-      mosquitto/
-    apps/
-      vaultwarden/
-      myai/
-      caldav-mcp/
-
-  home/
-    flux-system/                 # bootstrap-managed, см. п.4
-    kustomization.yaml           # explicit, см. выше
-    namespaces.yaml               # Flux Kustomization CRD
-    namespaces/
-      kustomization.yaml          # resources: [../../base/namespaces/*.yaml]
-    infra.yaml                    # Flux Kustomization CRD, dependsOn: namespaces
-    infra/
-      kustomization.yaml          # resources: [../../base/infra/*.yaml]
-    infra-nodes.yaml               # Flux Kustomization CRD, dependsOn: infra
-    infra-nodes/
-      node1/
-        kustomization.yaml
-      node2/
-        kustomization.yaml
-    infra-apps.yaml                # Flux Kustomization CRD, dependsOn: infra-nodes
-    infra-apps/
-      kustomization.yaml          # resources: [../../base/infra-apps/metallb, ...]
-    apps.yaml                     # Flux Kustomization CRD, dependsOn: infra-apps
-    apps/
-      kustomization.yaml          # resources: [../../base/apps/vaultwarden, ...]

clusters/base/apps/vaultwarden/secret.enc.yaml

@@ -4,20 +4,20 @@ metadata:
     name: vaultwarden-secrets
     namespace: vaultwarden
 stringData:
-    #ENC[AES256_GCM,data:0pyGYd1d1eJEINKxqUIxdgdc2pYCxY+flJ7sdfEdloOcdtfrY6z4nk6PQ0gMUWj0e/FpKTmITJEK,iv:7bwlpzDiAYfhAHIT59G0IJcEMe9yb1pnWN0y9rHs/NA=,tag:fYOr4mlezaydkWZz24/Vww==,type:comment]
+    #ENC[AES256_GCM,data:aTlbA3DfH2l1hzLpOOw+IpUrR9dbVYcvuOCl5IiMiE7JRKpOb2Ao1h68sESyBpvEjwg8LWc2WYfr,iv:9I3Z9u7ZtzELlrUqmLj+dBEmmAKJXFyyKAegdsojOV4=,tag:YId6U0D5X9KIADyz2U6cJw==,type:comment]
-    ADMIN_TOKEN: ENC[AES256_GCM,data:Wn8PpV4NbJ4t2nJbdUdvJsk31AoT/ib8xYG2hs+8e3Uoke3WRjVmxp5RENC7rwYSfB2g/46a/lg/ABs28vBhwxvRBewbbkf1ZatdL4znkeS1kyiNJTZJ8SXDqBwCjFeZBTdBQUcuTATYdw7Zq2SRu5tmTLFWQA==,iv:8l8r/V+OfEauJxOMPosyRD+DKclD3aWWgXKFarkPWHY=,tag:Db/36TSen8zWRVwq/DZwTw==,type:str]
+    ADMIN_TOKEN: ENC[AES256_GCM,data:T2xalQlwrMFt+dfqm87nRazkEfNxfoxQ+qljUuWo7kHE1x2Wo20uR2rPMfaJRIy8nCkb6nMEr/S7z0wYZwS10Z723V9+rGkDHo0+HHy81fa6HcsEUb6RofGkFVdOx8nXnp7Nc7Tsnc/3ub7TLNUNzleatlXlgQ==,iv:BIdElqr1s5QBVsCdBUAGm0aVF7FAKHbbkaAWq4wb904=,tag:ByG7FxAFXY0JIXsQksiuow==,type:str]
 sops:
     age:
         - recipient: age109zta6l0cwpkxn5wek82kvauxn6yqrq80rsz4mvu5atdnpcn9pusuvnqk5
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4cFpaSmxwczRMY0ovWkg0
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVSCtWSmtFRGZqcXQ0c2Vr
-            UUdYMzN5YndCVmM4R2IrUGJ3U1J3RlJ2RkR3CmNLVFhsaXo3anJ6WUlUMWdqaVJ0
+            ZGU4cHZQWE9GOHp0akpCbmZEQzlzMXpzZDBZCnhvVkRoWUdVL0ptR0M3c2xUTlhi
-            Vjl0K2I3RndBUC9QNUFzMk9VclE1RGcKLS0tICsrWUhwVlB6ak1IQy9peE9nRzhW
+            ZWo4VHJGcmo3SDFXN0dKMll2Z3ZhbVkKLS0tIFRreDlvRkhoMjJpOU9JM2cyS0ds
-            dFYxY0xoRlNrd0w2ZE9RTTFaZHc3dEUKqS9q9k5dNmRAGl3k8/63R7XAq3LgxIzX
+            SG5TcVlJc29ZSjc0VmR3NzlhcHE2L28Kuizg3n3+0ry08PGODugaAAC8KBv2rPeg
-            hJZetWJ5aKJF7+cqCFYUNGQA0qhlXinJnL7T0WBRLmzdCWCuW8Ha9Q==
+            ylJj2Jref1A1xkbuoSkPD3qlOxNkjhYrxWWhiF1zDz3cqv9Kv+Q1wg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:18:17Z"
+    lastmodified: "2026-08-26T10:18:21Z"
-    mac: ENC[AES256_GCM,data:lQoTx/7t3iUxDV6VvzTn2uDg4HgB2OZYdaA4LmAY320uI+bHjMuLEtWe6Ing1Oa/vdQCLGTj3RxXXMCl+9Nk4PdnZ/lPAqh0mSwlCWwZZOnbRHqrNgzbrEa+nyKPfIZSEQSZJi9AMNDq0MpCzuwDfJlDPl/6dhRe/qZqSOt/8io=,iv:2o6QNFWALTdeHn2uyAoQAmEQxlVnMog+v/bcnxQ4XZo=,tag:GE7xRyoDlmWVujs5lK6KsA==,type:str]
+    mac: ENC[AES256_GCM,data:1PvgVWP7YC/FBC/aClTBz5+d14BPpt1pUscjct1RUyV4y07vNHqBwXSorLnoGf5hUDwwBr2Yo51dAudJZUMrkIjSV38QeSmWjkvSgCXjt+QnoL1ynjLENZihbzGMDvZorx/rGN3DtK5fdj2T3VVubREYyoI+UvJSN49bO0d0Xo4=,iv:e2JzQAtot7sfnLNLQl7X6xiORF7v/1uEU5wZLFHqVqI=,tag:n6kCzjOrN0IjZMGkzS2dzA==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/zigbee2mqtt/secret.enc.yaml

@@ -4,19 +4,19 @@ metadata:
     name: zigbee2mqtt-secrets
     namespace: zigbee2mqtt
 stringData:
-    secret.yaml: ENC[AES256_GCM,data:Bm/axxWEiSHuggnOlKAaUiJcWGx+z8Y3JeAThl71DuhGVC/0kHBb7DkihL1fW7ms8MuSFFpTjDGfl1Sf1T4k90mx9PQ9O7+QdiHaXHTgmX2DnKXHa7RCqmgzdvZCHLo0krdgkROA7146VEaDUhAf+mSm+d7Y9SfYJbfC97Y=,iv:5DNFF/jpnqXMnWohYloTvSbA1YHmRPartrbL4jruFz8=,tag:ZeTQC5fogAEUKYQ8GmwGHw==,type:str]
+    secret.yaml: ENC[AES256_GCM,data:G1r/HWh9AYStkKGUIWj/vE8zM1ODLbwXG+wGmt5Y4sGFN7lU90WDYlR5AtgiFZUXYzdZyIuAcThYERe2ezw08yjIObf7Ea0hUQLzxWH2WvXnOSVimmPxiwJtgQioELUZMvNTBMFKOinhtEwsYsZBZo8YvMEPbMl1B+J5Crk=,iv:GG1GzGKn7xfFri5H4drOQiQqJ3qJU73LbsLnx+nqijY=,tag:6pCQ5EKsbHxSA2ISwtZoDw==,type:str]
 sops:
     age:
         - recipient: age1tu4xgfefvgdda0vn2thaqndq4p9tuydq2ud6qa98tzzgnff6749qnlcx29
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyT0dCZDNqSGdpM3lESVFa
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTVnI2QTBDdGlULzN1YjJa
-            S0xlVHhNOEIvZ3ZPVUpmYXFBQjJUaWdDZlM4CjVQQ3N4NFFoY0wzYTY5dm5qcHI3
+            dktjSVI0K3IxUFhJc29VZEIzQnNHa0Y0REdRCmdoVEE3b0UxSDMvaHVPeVo0dkpZ
-            VThMRzIyRU5sRnphTzA1TFRSRUkwdXMKLS0tIGZYbCtIK0xPRm10aGJjK0hTeEtI
+            blNCRFpSZFZROFFpVEw2R2tiYlBFUE0KLS0tIGgzMlNPOFhKekdMT1JzK3NJbUZ2
-            dVdVMlJrT3dCa2JrR0dIbE5NbU9JTG8KrqovZIUOknPLUmQhPn8U2XIwj5Z9Nzs4
+            RTIwdUFRaXcxWCtqczZDWjR4OFJGNncKhY8b381dCG6sJp7rHSLyP1+bhVxwvIcj
-            GV2KigIHlIKBIg6PJmE4bEHXzOudd7H6h3mHBJzdgpuv2lg3MgyUhw==
+            hF97LOUyb3AMwccq8GTC6XslGweFSIJnqUAoFPvpPm1AsVViwXuoig==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:18:18Z"
+    lastmodified: "2026-08-26T10:18:22Z"
-    mac: ENC[AES256_GCM,data:n42Kyoe0ydzqnCM928Kj6cw4a09N8BVhd/HhK3x8I6yEcUuZw8xpESQvVCZRMZBJgXlPwUgyc/+erAmZevwNDInEXphu3T7Ori/sGrV/WJEqczXXQ3llr+gZ6of4SYU+uWRDOJ9TDu3Y1Srivr2+osz8awQwUyhM+u6Eu3X4Iog=,iv:ryYdXqWwwK93ZMvvVYwWVgSt6e8DaMBcgmgFmOFZpnE=,tag:krP7teRZo7Js//+h6nIdLQ==,type:str]
+    mac: ENC[AES256_GCM,data:H0VVju9l1t6/LdadN2pRuPajG2TAnGL9tskk/hhgtNs3oOBfl9o+BxtvcKyckgASaZ/1CvqxBGEw+qNLyu/iYFT5FYvO65JHrgdtdrG4OhiR3oIC5K04lUWo8Gz8P/1HumqZIh2S6XWHRv/fbgf2V2fUccid5GQ7zGtAzSkQpUU=,iv:Aa7nmiSbd6B/4QNaDvfT3heLtbVWzog305TJE4oQzbc=,tag:NSZJLSi/Y4OhYDXubreXrg==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/infra/longhorn/longhorn-system/helmrelease.yaml

@@ -0,0 +1,45 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: longhorn
+  namespace: longhorn-system
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: longhorn
+      version: "1.9.x"          # зафиксируй актуальную стабильную ветку
+      sourceRef:
+        kind: HelmRepository
+        name: longhorn
+        namespace: longhorn-system
+      interval: 1h
+  install:
+    createNamespace: false      # namespace создаём отдельным ресурсом с PSA-меткой
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    defaultSettings:
+      defaultReplicaCount: 3            # по числу нод control-plane
+      defaultDataPath: /var/lib/longhorn
+      guaranteedEngineManagerCPU: 12
+      guaranteedReplicaManagerCPU: 12
+      # если backup target ещё не настроен — оставь пустым, донастроишь позже через UI/CR
+      backupTarget: ""
+      # чтобы не разъезжались реплики при 3 нодах
+      replicaSoftAntiAffinity: false
+    persistence:
+      defaultClass: true
+      defaultClassReplicaCount: 3
+      defaultFsType: ext4
+      reclaimPolicy: Retain
+    csi:
+      attacherReplicaCount: 3
+      provisionerReplicaCount: 3
+      resizerReplicaCount: 3
+      snapshotterReplicaCount: 3
+    ingress:
+      enabled: false             # у тебя уже есть Caddy/Traefik, заведёшь свой Ingress/IngressRoute отдельно

clusters/base/infra/longhorn/longhorn-system/helmrepository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: longhorn
+  namespace: longhorn-system
+spec:
+  interval: 1h
+  url: https://charts.longhorn.io

clusters/base/infra/longhorn/longhorn-system/kustomization.yaml

@@ -1,4 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - cert-manager-issuers.yaml
+  - helmrepository.yaml
+  - helmrelease.yaml
+  - secret.enc.yaml

clusters/base/namespaces/longhorn-system.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: longhorn-system
+  labels:
+    pod-security.kubernetes.io/enforce: privileged

clusters/home/apps.yaml

@@ -13,7 +13,7 @@ spec:
   wait: true
   dependsOn:
     - name: namespaces
-    - name: infra-apps
+    - name: infra
   decryption:
     provider: sops
     secretRef:

clusters/home/apps/radicale.yaml

@@ -13,7 +13,7 @@ spec:
   wait: true
   dependsOn:
     - name: namespaces
-    - name: infra-apps
+    - name: infra
   decryption:
     provider: sops
     secretRef:

clusters/home/apps/vaultwarden.yaml

@@ -13,7 +13,7 @@ spec:
   wait: true
   dependsOn:
     - name: namespaces
-    - name: infra-apps
+    - name: infra
   decryption:
     provider: sops
     secretRef:

clusters/home/apps/zigbee2mqtt.yaml

@@ -13,7 +13,7 @@ spec:
   wait: true
   dependsOn:
     - name: namespaces
-    - name: infra-apps
+    - name: infra
   decryption:
     provider: sops
     secretRef:

clusters/home/infra/cert-manager/certificate-issuers.yaml

@@ -1,14 +1,14 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: cert-manager-issuers
+  name: cert-manager-certificate-issuers
   namespace: flux-system
 spec:
   interval: 10m
   sourceRef:
     kind: GitRepository
     name: flux-system
-  path: ./clusters/base/infra-apps/cert-manager-issuers
+  path: ./clusters/base/infra/cert-manager/certificate-issuers
   prune: true
   wait: true
   dependsOn:

clusters/home/infra/kustomization.yaml

@@ -1,4 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - storage-class-longhorn-no-retain.yaml
+  - longhorn/longhorn-system.yaml
+  - longhorn/storage-classes.yaml
+  - cert-manager/certificate-issuers.yaml

clusters/home/infra/longhorn/longhorn-system.yaml

@@ -1,13 +1,13 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: local-path
+  name: longhorn-system
   namespace: flux-system
 spec:
   interval: 10m
   sourceRef:
     kind: GitRepository
     name: flux-system
-  path: ./clusters/base/infra/storage-class-longhorn-no-retain
+  path: ./clusters/base/infra/longhorn/longhorn-system
   prune: true
   wait: true

clusters/home/infra/longhorn/storage-classes.yaml

@@ -1,20 +1,15 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: infra-apps
+  name: longhorn-storage-classes
   namespace: flux-system
 spec:
   interval: 10m
   sourceRef:
     kind: GitRepository
     name: flux-system
-  path: ./clusters/home/infra-apps
+  path: ./clusters/base/infra/longhorn-storage-classes
   prune: true
   wait: true
   dependsOn:
-    - name: namespaces
+    - name: longhorn-system
-    - name: infra
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-age

clusters/home/kustomization.yaml

@@ -4,6 +4,4 @@ resources:
   - flux-system
   - namespaces.yaml
   - infra.yaml
-  # - infra-nodes.yaml
-  - infra-apps.yaml
   - apps.yaml

clusters/home/namespaces/kustomization.yaml

@@ -4,3 +4,4 @@ resources:
   - ../../base/namespaces/vaultwarden.yaml
   - ../../base/namespaces/zigbee2mqtt.yaml
   - ../../base/namespaces/pim.yaml
+  - ../../base/namespaces/longhorn-system.yaml