synthing

clusters/base/apps/davical/secret.enc.yaml

@@ -4,21 +4,21 @@ metadata:
     name: davical-secrets
     namespace: pim
 stringData:
-    PGSQL_ROOT_PASS: ENC[AES256_GCM,data:ZW2qTLmKG74lg4rMsTUiJXpDd5tQPRcrKGagvij9cbkjdxmzwDdsFxRAZM/0OO+r,iv:LhtEHlpKf2KOSr/mTsHHsa8MPM++qz0+nZQX9RK7ZpQ=,tag:wpdTt04Rr7Ma/1m227SjZw==,type:str]
+    PGSQL_ROOT_PASS: ENC[AES256_GCM,data:7bx8Fjrab/6Boz8dfx+JMiLgvDhwseYS2jmPledfTz5DEDhCsfCYIOROWvfc1Ng7,iv:FqQL4CWggZ2p3W9NO31/eI27apoahNsuus042c9gCl0=,tag:eTNN7xFObpxF9lz6gcyiGw==,type:str]
-    PASSDAVDB: ENC[AES256_GCM,data:Q77nDY3pBE8bjoKHch/bHQSDVaZM5hKEZ9DnnrMmqsF0QXYV6FO8mQVNohbwRZ0k,iv:d6yzl8RuPqqob02WsvDHeeeR8c9XYXm3TgTrQabipCg=,tag:cVohM9yJ4CYJMAuakRFLbw==,type:str]
+    PASSDAVDB: ENC[AES256_GCM,data:VUjEGzaY9Wh/Ip6YYWucTse2z2wNFuAE3KGsfsXMfbnR5shcsxfeZpt9mqZFnOjA,iv:tcXO51kO2xw0RSI0hQJCpzK0/BGaiy3FE729Tdb3zx0=,tag:zsOzh9ZHDgfOcMllAmzyCg==,type:str]
-    ADMINDAVICALPASS: ENC[AES256_GCM,data:s0Q7mKqCbe4WkJpmR0/rN8uKaUEjvJq3zVMvyqoEEWU=,iv:xFYCjvyYk0Bb/6Uf7pjtI1moX8X73PvKSAzD/d6+EAA=,tag:W6SGO/k7kaJs8ScVvSZqew==,type:str]
+    ADMINDAVICALPASS: ENC[AES256_GCM,data:N94/C9cxiLU/Uxn37jf69OnZeO5bdcW/4FVRJTPN81c=,iv:wGKk3fcbTv32VigsfBTtBtD+uSqm65Nh98qyjVEcGWM=,tag:fwLuybdZ4wwNkazc+JzBdw==,type:str]
 sops:
     age:
         - recipient: age1yx8mey02c0mu6te9hwxwdqp5n4enjz35e8thchsmvhqw7xsrzy0syg367g
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMdEtBUFZtNVhTTFRwY1Ir
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiWXFrVkd3b2VjSnI5T2tG
-            L2tMblVhRzREcmRwWnpFVWNnNmZ1NXRWS1YwCjA5WjlJK2ZIWmtoS3p0NHhmckhu
+            cCt0V2tadHd2dUZPUllKcXFQamVqOTRDdEFrClQ3RUdYZlgvdW56MHNaTEtjTURs
-            ODMwWXhSN0RRMnRkVlNTUHB6MXNKc1kKLS0tIHZ5eDltOG9EQVhiWjZlWlV0SEJ6
+            eDIwMlF0OElNdWlmM1lFb1IydTgyQTAKLS0tIGxRTGpUd2RpNk5YNmt3dU5uL01Y
-            eldqTkxXYlhXaDkvNy8vQXVKYWNBTEEKYLqYfDKEk+uwP2wC6dIdZq0LY7Ex2otO
+            UzhpYU53OEVaZjZ1YmhFZjgwYXJRK1UKoec36NYEQNkkFZLiZXGWjxHfL2bBN1E7
-            mGMuntyPw6711z17Cat5ssTSQqw0iVO16e2s0tjI1MXctrF6qRDQcw==
+            PhLQT+N2JpB7Bp/yqj+EGEi0QPASfJtCwJfN8RnDy7qO51cZLnD7Lw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:24:24Z"
+    lastmodified: "2026-08-26T10:24:31Z"
-    mac: ENC[AES256_GCM,data:m8KPG8DZgO+p7PSirimtbYDpXtnqJ57l4N0x4Cah6OVpVD+yjSYV1nxNtHjp+djy5Vl23iKc75y0AmaA7x8LYaWzA2nBe43hiG9Fft6YM6P7q6Ms1jXjG2ARv0e3fZmHFRkYZ8eWkscxc1BmzhN05kyKQR6/yifP/W5CJgsc24g=,iv:tz31W18+cD5nESjpHh88WFXRC5WEn/8TYASMSd9c+bs=,tag:s0kkp/h2r87cEAngp5Sr+w==,type:str]
+    mac: ENC[AES256_GCM,data:KRLrJOe4+B0Tjou3wzlFWJPLYfvrgEwTnzYgB/Xo3iImZ2uolRTEeScQtkYFIPY0plYKXb1jD8Jbgy5k/dTFU0ql6VsyJMO2SbTM3p4/iHd/UC7NXopkylL48801zqMRFeetp40+Elh+RtjsyT4EMXim39x9LVTzX0dE1JhP/U8=,iv:6ETslSUHlGoBqyNP10aL5bhi0Rdmg+58gelCQIXRGlg=,tag:NpUS9v+Nr1WSL3GbRCgpDg==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/markdown-vault-mcp/secret.enc.yaml

@@ -4,21 +4,21 @@ metadata:
     name: markdown-vault-mcp-secrets
     namespace: mcp
 stringData:
-    BEARER_TOKEN: ENC[AES256_GCM,data:FWK20oliPFs0fnwdyGlrpXMK1fNIQVrm4c8uckguVZsQ0XZ8DQI2RdkkgUhuFhDdX49IpbcCh00BKEimMFTYCg==,iv:zuzqRw+priNTk7RLFFplEh8AcwAGydWkbG4ih3cb4RQ=,tag:ey+DdN87EOU+fx/SpJ4lgg==,type:str]
+    BEARER_TOKEN: ENC[AES256_GCM,data:kh/V23DnXeNuo2qGgYgzcDeTl4JyTFMzu1jOMukiMw1KU24cg+w3vff+N7y3qDgmPEINdWLqsquFFgCPcK25cQ==,iv:IpchFcO9xk4Pctpa0dMo6tXAvKeXFAbgLiCdBxat1v8=,tag:kR5NuWlCuR8rprQH+FrIcQ==,type:str]
-    OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:yFxB/31nmrbM/c/83MR6A4PMUqeRzsi/LKTNxnyYzVU7rM7Kuiui/ej2jshlzB6mn4f9/Nx4HdmI5AAokyNWHg==,iv:rTNQChEtXd/VU8iw7Gm4qasPnUN2uYKEpizbcKFAn0c=,tag:/ano7eQRgMeDt5fXA6DdHQ==,type:str]
+    OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:7mqI8BtyIphy7IU1F8KAOjmnQ2l5iGhrAtUjHDVK8NiMi5zgGHcjXwma1TVWgd389sk5nbUph9Cr+FquRoKFKA==,iv:SmCg5hD4Os40UPJgDo5nI3qHoxYap3R98KTY0E3uWjw=,tag:WJdP1XWfDFjsu4mNbkMNgg==,type:str]
-    OIDC_JWT_SIGNING_KEY: ENC[AES256_GCM,data:k2YODG55k44v7fJi3Q7b33z9rSL0G8IrVbK0rf/MD6+wqhEKkhSZoMj3fGJKS0gG88SpfUITBNv3RGrveiTEZQ==,iv:GHo/prr1UNwJVyDl+6tr/Qn530jMT0B8BFOl2rIg3qg=,tag:ySRFXPvAo0AmGf1mQhnkTw==,type:str]
+    OIDC_JWT_SIGNING_KEY: ENC[AES256_GCM,data:DByWaGf2s1BrC1hixP4NHsC5aJBO/3rCYm5ndJt9l8SKd5crMKjhV8Ey1Q10F7dU+51C6qnv0r8G4a9SSi/Nmg==,iv:w4hxA+n5JY3LoG0uNDTLIMlcFy/YdzLktceG/OAIiW4=,tag:Cm7cHI0HmNv/YavavQSQYQ==,type:str]
 sops:
     age:
         - recipient: age1kct5g7d7eus2hvdnmx99ewsrtz70lhlasxa25euqwdctqhwqqpxqz0n7gg
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuSDZ1R0RCYUpSa2ROQ0Fj
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwMzNzU0JGV09weDFraWcx
-            cEZSekhLRUFiZFFiZDJnamZ3NkVzUU5rU1cwCmdwaUU4T2cvSnA3NW5DWDA4K3hT
+            cFY0RVd2VEpUMFlxTlhqaE5MM2VrRWdHenh3CnA0b3hpVzVRSWhoRHVzYnJjYVdv
-            NDVDQ3RUaVFoekRaeGYrTlhPMUoyelUKLS0tIFhIMXNsRFJOenhRa254RGhiUm5Z
+            N3FtNVZtSksrdUlnSFhpR09JMDd3bVUKLS0tIG5lWHRDZktFQi8vaW80RnBPbU1s
-            eUNsR1k5NHcveUNQdmM3a1FxQ3JmZVkKbKNs2sb3pA6iP1GFtq2Cl0FnHKKQmWJN
+            N0dsQWZTeXRnRzlIV1FyTWpiSGEyWjgKTrEcTDzTwLzCnI3eKlnX/P3b+ZojaR6t
-            M5eJhCvhGopmI47H9stvZjXJrJJHgLin+cJSlRsNb5SP9xAz3/ywEQ==
+            9wjjvx9ouZS8iGl4qaAaOt9fDApd0UZOZAJiGjQYVNFfyBb4wzax1A==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:24:25Z"
+    lastmodified: "2026-08-26T10:24:32Z"
-    mac: ENC[AES256_GCM,data:/FRWhoghMQf/snWmV405HhdymYP0ZQiTK+KX/+Vnmw6YVV4lckIu0wab7fx7y5g7uui0II040tCVG5LeaLr1fGilEdJQW7Akc/v0QXC3dsh+DfDBle6l4gHaQqC4LVixpSSIMRbJt5+JU3+si1plUKfBKt8VKOtJrfR324I9SjQ=,iv:SmhmI9piU3rtB8Pn9lFOekr3ojwcH5l6q117hEx8f30=,tag:1VxkB8dCYx3YSiedzuvAdw==,type:str]
+    mac: ENC[AES256_GCM,data:dy4OM3EfDAlf4RUtQED/zOs3n5FglA0J2RA8gSaAV+mrfM5+mMzadl9WId7cVCOvQOWjWGiDa7p2POM2Lm3nM5JF0WZWJJIX71vqpzxrV0j3i3K0XDMw+99ZlBOK5+wAXbMQ6cNLTxi0FayFWzqGIdJvZLvkXp8qG2IdZ9S9H9w=,iv:y6QaYxaqb/ThxCC8HUK2AxgrGV0uOdpT09+vf3m35cM=,tag:RC6fmIx9geBaSaKB+wUrYw==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/mosquitto/secret.enc.yaml

@@ -4,19 +4,19 @@ metadata:
     name: mosquitto-passwd
     namespace: mqtt
 stringData:
-    passwd: ENC[AES256_GCM,data:pNA3D0fvMFxHldsiqP7NVfs/9vYoxZJSxx/MLUH/KLHkjzo/zRqkQZ0+d5TH0Q97FLkkykoRp4UKBqBPzFVjmW57Z2HVpnGzj7whwiKDgIcMCsG04Nw5QmYWU2qkKPpq3T5bHzayWTHKOT21DonVKfvGjJdtsTpAGpCN1El03bueUevEdlV2q1cX/p6Sm5u525WSg/FpaUhT2jRrjVo8s7TOHBdH84tf6gzJiPP5rVnU9iba46jlHzOVRsdOhg==,iv:uNyRHMYa7Z8kP1+dmudwrPPSqDTA/eDvFsuony/hnp4=,tag:QRcbI2gYHuYAMqTFLyp5WA==,type:str]
+    passwd: ENC[AES256_GCM,data:kJ9FesDX3AGfmUHQZo8tpVliT9bQX8NDAlCvK/jXpTBPi7Zk0l29OpuF6+f647r3BWs3yExKV+x91Z9am5BfirpkJG2B9NBpBzVxkPsYQpXL1PZcGMmJ5xMB7GzeABrQ2gjU79VzAeoLViOz0J9SymwLdIxXhPN6XjzdgkIaUVwVGbMTTuOuLTdaQYYUimcykkSgERa1AO+YCqZ6nP1GvZnRLrOWnX6blanR+lGNja25H8xUQPVVbgSlJ9OJEw==,iv:bs4GN0Oq6aL2UySvQljYfb2PjEed0lyrY9MnPHGuWWA=,tag:leTkO8JoOFzDEg0r/nZMDw==,type:str]
 sops:
     age:
         - recipient: age1u236u5mzkzj72y4mfxx68gfqw0u0j6tdgkudnm5pdfpe7apq4u6s89jr2h
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYWCt5NHluRmpQVktTUTZR
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJODU3UkpVbnZJQUVuMUhN
-            dDJDR1V0TDJRL0F6VXUxeDF5QWYvcE5BMVNJCjRQQ21XYk9zcTFYTjBpbXVhelZr
+            M3h5bGZqcExIenlRbEo0Nlo2aWR1dkhJdkdRCldVRjcvZTZQblJzNmh2ZlRDanlt
-            RFQwSGRuR2lpSVZNUU0rREs5TVNHZVUKLS0tIE41L0xqWHgwQkcreVZWWGxqWDNW
+            eTFIOEhqYlpCQVJDSUJQL0I0Nnpka0UKLS0tIFhyU01KWGFKdHhNL1dUV3E4VTd2
-            MzlkUm9IUEVwcTQrbk1yc0NuM0d5KzQKmPDJg9e6zyhz+ufqQa+gkb5u6+bWXW77
+            eVNTbklyL0xWWWswekx0N3QyYkxwNDQKQHYVZLJqlwdEqYNt1J1CPnR7QMZDEMnk
-            +xuFS/cy+akYJs6ReOpos9sD5dAYteyxEl7+vrTWrsOQ7ap7YRt4WA==
+            t5KUFsp0KjEufC+Cw0E5TCsctdCPo7Xq0MXvTwNm+zst/No6eZDydQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:24:26Z"
+    lastmodified: "2026-08-26T10:24:33Z"
-    mac: ENC[AES256_GCM,data:F4E7wz5YiG3fqplTso5WSbzPtDJJYLxpFrDXyD3X2SovTIwel8EZKm6Mv5ShJK+vyd+LIZnZGzPZABwIqEKm94wbGtQ+UF8C09lzftrCKfMiHxXS6bFJIxn3X5UIZLR6VFJ50GcOIf7FaIJNY5rrIuPNB3UZtCN0l41xNCqU/dI=,iv:uSpy7vJPTCIwm0l//wJxWq6SoQEekpWz7+4GK0MuXCA=,tag:Pw/qOjlSLa8BJT48BqRu4Q==,type:str]
+    mac: ENC[AES256_GCM,data:BI0ipTNxhAL9kfB3e/XGK0FF2vCWOC8U6NCUj2lAJ68PzEUIYMiSTPtnQP0xDhZBPvh14GcEvLAOwleMx2P2tr9Z/V06owQ0ADMhh/v9tK2QRGB2nE/CtuN712bX5SimrGd3zMhHl7sPegR/6VcKfEmLrFNM8xT3TpQnPpiyMVQ=,iv:bj+h7PKVbo9oRb3WPFy7sfwPnUlRKNv3EdnuaiPIHWk=,tag:Gw2+S8jZJwp8aPUgKx7U3Q==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/syncthing/helmrelease.yaml

@@ -0,0 +1,73 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: syncthing
+  namespace: syncthing
+spec:
+  interval: 10m
+  chartRef:
+    kind: OCIRepository
+    name: syncthing
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      app:
+        containers:
+          app:
+            image:
+              repository: syncthing/syncthing
+              tag: "2.1.3"
+            env:
+              TZ: Europe/Moscow
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+
+    service:
+      app:
+        controller: app
+        ports:
+          http:
+            port: 8384
+
+    ingress:
+      app:
+        className: traefik
+        # the GUI has no auth of its own out of the box, so it's gated
+        # behind Authelia the same way fava/zigbee2mqtt are.
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+          traefik.ingress.kubernetes.io/router.middlewares: auth-authelia@kubernetescrd
+        hosts:
+          - host: sync.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: syncthing-tls
+            hosts:
+              - sync.aggtaa.com
+
+    persistence:
+      data:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 1Gi
+        storageClass: longhorn
+        retain: true
+        globalMounts:
+          - path: /var/syncthing
+      # same nfs-ganesha export webdav and markdown-vault-mcp use
+      # (10.0.64.5:/exports); mounted at the same container path (/data)
+      # as webdav so the layout matches (/data/shared/documents/...).
+      shared:
+        type: persistentVolumeClaim
+        existingClaim: syncthing-shared
+        globalMounts:
+          - path: /data

clusters/base/apps/syncthing/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: syncthing
+  namespace: syncthing
+spec:
+  interval: 10m
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/syncthing/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - pv-pvc-shared.yaml
+  - helmrelease.yaml

clusters/base/apps/syncthing/pv-pvc-shared.yaml

@@ -0,0 +1,35 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: syncthing-shared-nfs
+spec:
+  capacity:
+    storage: 30Gi
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  mountOptions:
+    - nfsvers=4.1
+  nfs:
+    server: 10.0.64.5
+    path: /exports
+  claimRef:
+    namespace: syncthing
+    name: syncthing-shared
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: syncthing-shared
+  namespace: syncthing
+  annotations:
+    helm.sh/resource-policy: keep
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: syncthing-shared-nfs
+  resources:
+    requests:
+      storage: 30Gi

clusters/base/apps/vaultwarden/secret.enc.yaml

@@ -4,20 +4,20 @@ metadata:
     name: vaultwarden-secrets
     namespace: vaultwarden
 stringData:
-    #ENC[AES256_GCM,data:shXBGZMHYLl1hfejHKnzmdrNWQ7AK9E20yBcaD8SiNNTyyA2B9jdDtOt5eBjb+mctZhUPNofQPH4,iv:g7NGYaYWYwW0g2Ysod/p+D6BgfOH6FFGRA1jh/AvIt0=,tag:ieZWOoCfO8Q3eHqCGXX5bg==,type:comment]
+    #ENC[AES256_GCM,data:JP87rgom4q/s3ykVtq/Y5ydyarcTKY+d8zI0N2Z48aSNt9Qlf4PErC7xrNfZMS2+RSzo2j1yP0Z+,iv:amXDAre4YuQ4tQdI/Z3//qepOau5pn48oMjODlASI5k=,tag:x8ShvNns0umzfX4dY+17sw==,type:comment]
-    ADMIN_TOKEN: ENC[AES256_GCM,data:1DrKblYTk5P1eTVyeXJA3DMOMjedeMOViqCoxujb8CWi+TARlkLF+Bw8Oi4FZnl7GYTPOfBzWzEPrJOK0XuWP/FoFQyW/ZRWcrf2QVt0wBQrL8kQJXBl9JTdnAf6NnBmpWsXU+XhYD5wsR1TP/adXKAkppGT0A==,iv:gwV1UvtkPRozIOYcxyGSDQXmwIC+wmGQopsU57SFelo=,tag:e/clFZrX4qyRaqoWAeP4vw==,type:str]
+    ADMIN_TOKEN: ENC[AES256_GCM,data:o5lMTAYWqTQd6wxEKrwaK6yw4sVtkfpuVUeGLOlxQUbbgQeeYVdzrXQJFJdXMuK/Zzyyxq5t7BtOILXC9E5e/gmYzHiTAhfbUSLutw65R8v/Wne54+CtwBaSFRJMbM9NgXpGwz3mcPpA79zWqNWNYEcSqCxyoQ==,iv:fIMuMh9qpWyD2kckdEWSB/XFrjUekvV9b2CWU+GojEY=,tag:+p6BvqOja9TTHZ6RENiqmw==,type:str]
 sops:
     age:
         - recipient: age109zta6l0cwpkxn5wek82kvauxn6yqrq80rsz4mvu5atdnpcn9pusuvnqk5
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3Tkl1eHBqSkhxSW9qZjhT
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkTkQzd2E1Q2tvNlc2Wk14
-            bklLTDl1OUN3cG1PaUJhOVdHU05kOXV2YnlRClZoajVBWjQ5ajNVc0Y2WlF6WE1w
+            ckdZOHpaK3Ixb3IxVzJBUnJZNFpLc1RCMXc0ClN2dFFvaSsyajhmTG1IaS9MWUxZ
-            OUVuUE80STBvZmpyZkQ3NWxlL3AySGMKLS0tIHRSMlh0d29FUWV5eDM5c0VvOWJr
+            T1JGVFAvNzlQK1B1bmVTRnJYT0pjU0UKLS0tIG1VS3I5alVJcWEwUVA1cjMwcExl
-            V1NmOXNVT3ZhZi9FcmxwdWhpMFdnblUKJaMrzLzzpM0AfJcRsSor0CaopSRySbhI
+            aXgvclZmckNmKzN3YXgvUjNsMTBoYjAKYXhhW/h4pD5Tf0ZxYz+yH7sh9YrJZGEB
-            MFuuuOEpFOgPZTf2r92i2wAq+aUR/yjIPlFEsyzlye80lrneWmA6dw==
+            iRalLEq8B5FXuYGrKc0VSpX4xB4AoZrfm7iL8L8yI1sy4X+OdlQa6A==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:24:27Z"
+    lastmodified: "2026-08-26T10:24:34Z"
-    mac: ENC[AES256_GCM,data:jMK1KTPYfx85/j6UZ1H9BcKAjpHWHvJtAgTehtJmHYTdB5/lGltk2LTmqcVi40vTUnpm/CimxkKFRqcvdWl6WBOpISA0De4QBLltWgK2SLaoR9CgRSaSPgaQ5PydEZrIQB+1D2+/bK+PF7DKSdOK08YM/crny0Koc88JTESExEc=,iv:/cb9Trzuntwg1k+WtNjAmPYFWL6jeWoYGQsu1Psn64c=,tag:F9CcS9tdtqxaemV3XjBZDQ==,type:str]
+    mac: ENC[AES256_GCM,data:MnveI1MrZb1SIwVd0W982lOPGq4F0FLb71lZOsPMhpYE17vBETPx4R+hrwyXJXwZhGRdUBodoMe6rwjHN2OxNjJfvR89V1fh1IrSLy340buSSKaP0D5FoEU6wwDO66y/A7lLBVIdVEDdadMWIr4oCSxKoPWeKRVRdFkhi5C1X2c=,iv:WfoakkeL14xMO/xdhRBUkeGzEDYTt5rKBcQGsMkj5xI=,tag:UKSyS61LdDY807Qu5cLaLg==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/webdav/secret.enc.yaml

@@ -4,20 +4,20 @@ metadata:
     name: webdav-secrets
     namespace: webdav
 stringData:
-    WEBDAV_USERNAME: ENC[AES256_GCM,data:x0LrXqg=,iv:NnawbmxPSI5jAebXZzVf78x+Jj/CXjJaMmC/kzt0/hI=,tag:PWC2iP/I8Bs/4aBlKesDPA==,type:str]
+    WEBDAV_USERNAME: ENC[AES256_GCM,data:xMb9k3g=,iv:zXCe+5fsYMj9C5jf8i1poza25RiXgkUwekJA26GcGPc=,tag:aV2DW5W+6gUTnfdEhTRjDw==,type:str]
-    WEBDAV_PASSWORD: ENC[AES256_GCM,data://oV1i9snSIwfQmzmOgi/Yerj0jmBnOVVvinXb36+froLCThnt+HNhEItreuqeID,iv:yxqMqgHK7uJ8R/zF6GcsViwL7HL9cImT76/8kji1sgw=,tag:NeYcXbXbOgG+H4HHG11Q+w==,type:str]
+    WEBDAV_PASSWORD: ENC[AES256_GCM,data:QUd37e52kOHjXIiUigvMTSepabqD2qV+xE4I7JxLRYhCUZoC0LH5v/9zEqICbio1,iv:frtqJz1BdB7vkM4drDY9/QgdPHtr0svji6ewDj9WPx8=,tag:+cNAWX8VTx/eAsVHyf9e4A==,type:str]
 sops:
     age:
         - recipient: age1y8t9v56yuvskznddqfsd4yddzzch0yf2dutvvt8rrx6rjh5f9g0s3qeays
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0SXRXSmhlak83VUNVTUwv
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlNmFhaWlwSy9NWUQyMGp3
-            c09mYmM0SUNzYmNRUUFCTENVYTZKUXFaZjM4CmxoN05LZHdFSGtSRXBOcU1RT2Fn
+            dGpJM2dLQ05zK1dSdkF1SGxVSnpLY3NILzFBCmJtV3I0MnNsVDhZT1NzcTJPdEVo
-            N1JiNnpxdGN2NDNSbXVCYko4NWFYamsKLS0tIHVCZUQwbXdtdTFiSkFoVlJwNTQv
+            Q1d3ckpIbE9QS3d3QTBEOHV5K2wrZmMKLS0tIHNoNjFUblJsOEdYSDhiTlZXVGFH
-            azJ1TjZNNnF2bjJDWmpJYlZlaksvR3MKsWb/4nVhZXk0xsApZJZQC68kIWrQdHvn
+            V05hR0xtdm42RlNqQ2JTNWYxY0dCOTgK6FBeM9qw3T7DzKHnF09T41/wt8yzYWzX
-            CMeDg4NBRJv7QY+knCuimdAu4211NGtJ35PakJ1+cKuPAyhKBM0GKQ==
+            7zT5xodg/alaGFtQhVFXg4JxAuHMeaK+1/YcFZbNDcQtcG/yMXcKLw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:24:27Z"
+    lastmodified: "2026-08-26T10:24:34Z"
-    mac: ENC[AES256_GCM,data:di2Pkuax7UalP2zFoJRCQxK2Zmav2k7gmzUfFX4x7XIhY5yGPx7hvuY6Kx2L9h0Ve7/MHXK5dLQT382uEgt+fE4FAK1xsUZ+HKKlgD1XThKZqPx4g6woqmmHFeL7THujft3e4zyqP8iXo/TtRR1XRCrl7qJGzLJKrqPg7m2xog4=,iv:VSKOHPnqdzRmvcqttE5avXVV5IvqHmZJWBZ4W6zn90s=,tag:G/Qxpmy0D2E3ArCVUI9xqQ==,type:str]
+    mac: ENC[AES256_GCM,data:b30c3X3LZZ/pcgcftWXiOMU+GIS2h9HXvPfX5WRcDYysMaLj8esFxxu665Vf4tLnFPWVIJFVAN3PKi/JjiX8O3JRNeQkMjuhmpc2WO1KkK5tOhrcMSJ2CGffByjkzcOdP6N3O7y+6l9Oq5cgK8lsM50biqJQOf9d1dJ94kbW3F8=,iv:BQ7ZKobanK7GEkTyoLgWi3YDH9ynfoaIvoMSsCmYK1o=,tag:wBolaGB0bihSEkw51ujjCg==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/zigbee2mqtt/secret.enc.yaml

@@ -4,19 +4,19 @@ metadata:
     name: zigbee2mqtt-secrets
     namespace: zigbee2mqtt
 stringData:
-    secret.yaml: ENC[AES256_GCM,data:4spxGe4u6O/uKjEZFTec7MdewY5i+y7dAlMKTCt7ZSGos4qxCEkK5hSb7VOpdSFFsuYrf+HRlurG2piTsmDDkv4mMgeB31Ls3G/cLtlfesOAyH2Jlg9Lo0NgjjYtcHJ0FefifKYXky0lVw8fe5hcaN9YraDYGLxzpW9wqlU=,iv:Lj/rzMeydwr+lAW/nt+RuMFvlqZs/ABZKgivNCv980k=,tag:8r22FaYvMvrf8AcfCR2qjQ==,type:str]
+    secret.yaml: ENC[AES256_GCM,data:nNRrcmozEsO8OZJiatsLnJej+BvOJ5i1E2s8MbO6WqjgrskyApioDp0BAKKhwq6YoXql7ebXtXye6TpGj/FgcyqVR9xkDqEcEZWK/oqG8XNYUlB9GB+j95PKkrofQelhVD8Vaz8ZxVTorDhhpgnHdgZyFL2OXfKoVOBk608=,iv:x0SR6xuQ/vX1F1AtgGGi6QZMDhjex9uj5uiy7RMkTwo=,tag:X7v/07ai0Vu9tMcG1sPLaw==,type:str]
 sops:
     age:
         - recipient: age1tu4xgfefvgdda0vn2thaqndq4p9tuydq2ud6qa98tzzgnff6749qnlcx29
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaMjRaK1YzM004enMvOXVR
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkUzFHQlZ6bXdaOWdqbnF6
-            S0VyVTczanczZ0wyNDZTSXI3cklDTGtOL2pnCkZvQzE4STZETExFYWdDRFlUYVFK
+            VjZ6aUtGSGZHYmdTdnBTM3lQd1BMV1Z1OVNRCjFiUkp6Nm9oMjlOc3lJWkR0VDhG
-            ZDgva21xRHhDNEhaaHlMWHlmMFBmR2MKLS0tIExUVHI3UDEza0IzRVBZV0Q1VzQ2
+            WFN5bkYwL0dNbWJkbXQ0YTEwNDJsYm8KLS0tIHBvbTZPaGdRcW85Qms4emwxajhU
-            RDFVRHd2MTIvQzlnR0RsTldWRjZobmMK+o7tHztX+rVkbSPrIzfIKPADktz4IA3V
+            czFYdktTdFMrSlZuaG1rMmM2aWhJZzQKvSABOsNxXLWZB26faGH8wdI1hsAZiZUL
-            yHhhSuGy1aeplZA+oSkSeJ+q2qvlj9Iy7REKZCC9vWNAQk6B04/XeQ==
+            ffC4ZxdiWv6YbinE/jPEkWkwu/2jVxyoanq1E3yP/K3lmqoCCJgxFQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:24:28Z"
+    lastmodified: "2026-08-26T10:24:35Z"
-    mac: ENC[AES256_GCM,data:QxJvmslWxcjAn1rPeaqItP3O5BaWDNEjY6gzQt+R77Yn9Md5zqxwTT1i7TI8HU8u2OAe24m+x5Da6ZzTcUHwnf/txW8Nqw/FiusWzZLZrCu6iHvztsXXwP3m+eCtM7oz5yMi8+D518KAkrW7aJPikfj0GopXABNRkYuN8shzE+w=,iv:yPlFUYW4RBkv+SErojBlF3ngDQbpsB8EYg8bQOfa5L4=,tag:hKfjetacdFN2iHZ2q1BpRA==,type:str]
+    mac: ENC[AES256_GCM,data:7WggLhRjzoMYMqvDlXemj+Wu9qWkW1zVmscqL2tUUv3WAtIJXm0GAMZ8BmAem33IL64Zxy8KbYFqNNKTEhMKRezUDU6uwA64zZJGccCxWvveV8Kqt2kJziPu5WK5inhIOyjjqmm510U3qeYxssDN+yM82ymVil4lV+S0LS/A3uU=,iv:wzGKLdzpg1ib87S8YPLy1551an7FN8XLZDmt9YNn1ro=,tag:vOJGWzavUGLHwSbF06cB/g==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/namespaces/syncthing.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: syncthing

clusters/home/apps/kustomization.yaml

@@ -13,3 +13,4 @@ resources:
   - webdav.yaml
   - fava.yaml
   - infcloud.yaml
+  - syncthing.yaml

clusters/home/apps/syncthing.yaml

@@ -0,0 +1,21 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: syncthing
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./clusters/base/apps/syncthing
+  prune: true
+  wait: true
+  dependsOn:
+    - name: namespaces
+    - name: infra
+  retryInterval: 5s
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age

clusters/home/namespaces/kustomization.yaml

@@ -14,3 +14,4 @@ resources:
   - ../../base/namespaces/webdav.yaml
   - ../../base/namespaces/finance.yaml
   - ../../base/namespaces/nfs.yaml
+  - ../../base/namespaces/syncthing.yaml