fava accounting viewer

clusters/base/apps/fava/helmrelease.yaml

@@ -0,0 +1,86 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: fava
+  namespace: finance
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: fava
+  values:
+    controllers:
+      app:
+        initContainers:
+          seed-ledger:
+            image:
+              repository: busybox
+              tag: "1.36"
+            command:
+              - sh
+              - -c
+              - |
+                if [ ! -f /bean/main.beancount ]; then
+                  printf '1970-01-01 open Assets:Cash\n1970-01-01 open Equity:Opening-Balances\n' > /main.beancount
+                fi
+        containers:
+          app:
+            image:
+              repository: yegle/fava
+              tag: latest
+            env:
+              TZ: Europe/Moscow
+              BEANCOUNT_FILE: /main.beancount
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+            resources:
+              requests:
+                cpu: 50m
+                memory: 128Mi
+              limits:
+                memory: 512Mi
+
+    service:
+      app:
+        controller: app
+        ports:
+          http:
+            port: 5000
+
+    ingress:
+      app:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+          traefik.ingress.kubernetes.io/router.middlewares: auth-authelia@kubernetescrd
+        hosts:
+          - host: acc.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: fava-tls
+            hosts:
+              - acc.aggtaa.com
+
+    persistence:
+      bean:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 1Gi
+        storageClass: longhorn
+        retain: true
+        globalMounts:
+          - path: /bean
+      documents:
+        type: persistentVolumeClaim
+        existingClaim: fava-documents
+        globalMounts:
+          - path: /documents
+            readOnly: true

clusters/base/apps/fava/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: fava
+  namespace: finance
+spec:
+  interval: 1h
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/fava/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - helmrelease.yaml
+  - pv-pvc-documents.yaml

clusters/base/apps/fava/pv-pvc-documents.yaml

@@ -0,0 +1,35 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: fava-documents-nfs
+spec:
+  capacity:
+    storage: 30Gi
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  mountOptions:
+    - nfsvers=4.1
+  nfs:
+    server: 10.0.64.5
+    path: /exports/shared/documents/accounting
+  claimRef:
+    namespace: finance
+    name: fava-documents
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: fava-documents
+  namespace: finance
+  annotations:
+    helm.sh/resource-policy: keep
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: fava-documents-nfs
+  resources:
+    requests:
+      storage: 30Gi

clusters/base/apps/markdown-vault-mcp/secret.enc.yaml

@@ -4,21 +4,21 @@ metadata:
     name: markdown-vault-mcp-secrets
     namespace: mcp
 stringData:
-    BEARER_TOKEN: ENC[AES256_GCM,data:g7wYvNOfXH9qdejzQwOpHL4AHyhCBZ1bq53BkmSMjL3iow1eAeh6exJmhyS4bj9hyRqkFFrVVVj7syg0lImAxg==,iv:Tihjll50d1hUiFei2qjdPvNLZSQzkyRcPzsXs/FzlzM=,tag:C4fJSH60zY4adCTq0ktpLQ==,type:str]
+    BEARER_TOKEN: ENC[AES256_GCM,data:W2uFG5+7jEQIbaE28wFSpp6pYC75bEy0qXS6kxLuFCZ8bLpwj28JLTKaxGRIyKPWjVzzo4Ln55lyQp6+kkeu3w==,iv:gPGedActdSCJ8LvTMaUDWLVZE+Uh0nbXY/E8ykFZdJU=,tag:U8HngUeWzKwUzUc0mm+pJQ==,type:str]
-    OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:FdP9atyl/7X6sSRw70DvoZOrA5DwSm6gZJf/qEYdabeZz+VO7nBdnBhCUjbLcGC51hD+8uQEisMmEJicRmNwpA==,iv:wAAxZr2nLeEL85tSBExTiTsm8laIiP1Db5/8tuc+nxw=,tag:9EhADU+w2SvkQ91AbDkufA==,type:str]
+    OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:NyZd14lidtvpoQEr6PfQJ0ih7eSQNvcvkAwSWzYXL6DQDzmlvPgKmMCydGDkQ/9flV1h25y2P35EaBMNuUA0ew==,iv:T1qhwa31Y68VH0un3oz7Cr489AgRC4me/ufJy5cYNcg=,tag:NDCHFxV09Ij6R19gmJPpUQ==,type:str]
-    OIDC_JWT_SIGNING_KEY: ENC[AES256_GCM,data:vnRKwoqYY0X0SgxQAovfnzXB0QWUqsxSY7hFo6YFO97JsUKMOsv9Ofmo7M2IuGTapP8RuDgsLXufCVsa+IRQgQ==,iv:gtwH66ah2rckS0B7wNkwl3n2HHAqvtoN/z6gYL5sUWQ=,tag:Z6MGFXyFEWNhlHrebi7wOA==,type:str]
+    OIDC_JWT_SIGNING_KEY: ENC[AES256_GCM,data:mDkFn596MX5QkI4gdmDEizR+XS+Uriaz120N3eZ9PrcnzrzAPXNEEHY6FtqKHWxr4E+CfqfCOpSvfF+X6+70LA==,iv:k2xaM0gwfHrrSc9rQlh+kG/HPs74gC65cfwcIexajTA=,tag:9NHFchmJfnKStMJjE2wOSQ==,type:str]
 sops:
     age:
         - recipient: age1kct5g7d7eus2hvdnmx99ewsrtz70lhlasxa25euqwdctqhwqqpxqz0n7gg
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWd2ZUQjdxenZYZG5oRzdw
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1U3ZWSklrNHd3QlRuUWhE
-            bkc0aWlwZS9mVHZOQ2ZuUHcyaFZPVXhCQW1rCnhyK05Dc0YzR1BQQ3MxbEVBYUwv
+            N05wQ2NmTDFxcjVkZ2s2dkd0THlvNVRSdEZRCmptdktnSmtuQlhhVzNuVzlMSUx5
-            YVR3TEYzdkE2blZxQkVTTyt4a2o3SWcKLS0tIFlHeko0Tk50MmpQdCsxUDJrTjA2
+            dGQzWTNWeHNlT3FLYXM4a2pvL0szMWcKLS0tIFlpWTNWQVBMN3A1eHk4VldZT2c5
-            MVY3KzhPYXJnR1hwRk1vaGVNRlFHRG8KBwUK426CTNDhJYLD1YEajcxhOgpSrEnT
+            MzdHajd2RkxLeVU3QlgrcGM0TXhyN0EKdkDb0h+g/IE6gvl8F98r0SFraiA48uAX
-            MVKEttRwrW43EpEcgrvNkG82Rjnl0yIs+dbKOUVqGJDAfPmizwEnGA==
+            jlT9s6x8b3lNtGx/DeMxFTzrJrMc7V9U0NO+y+h0EyR27ZR4O6eMyQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:21:59Z"
+    lastmodified: "2026-08-26T10:22:06Z"
-    mac: ENC[AES256_GCM,data:tU3/JjCGianLA8JGhFLMuAZYkeyqGRJrdVYucRisyYBCpih89V0rnrc4+s/5RAc7ykK6YspkpSsW1MInQH9rTMt5lOH0hr/rHffZnmcJlSyQ+bt/7AvOBYO5q9BpqXJvxSQqCbcQZg/fT9fvvYZLsyiE1w74CRrGx0S470KIhrA=,iv:cJ2Groess1eaTOEP9OiEPqfofnP39PZdrujGtA15QOQ=,tag:mW/QGiirsN5NNafV9olU9A==,type:str]
+    mac: ENC[AES256_GCM,data:pjpscBjkB35p3Lb66g7ysdEbUj7w6A+yYUSrAO0VXgwmerTrKn1Tzh2x6pYlVrCWo71GMw96aanRdpO60W+txwOnK/HEd5wrb+t+mHvuKQaoXAs8ddmtUg8kv8Bhn57NoS+yFyrQFD97YfcnUjEyZXot/YIgPYPWOvbxAEF/0aQ=,iv:ZsB988JpRghd0OGfl5RxOwdMRrGaCmxGk2AbcThAjVk=,tag:E0UWHICYoid7Nli/5h/cpg==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/mosquitto/secret.enc.yaml

@@ -4,19 +4,19 @@ metadata:
     name: mosquitto-passwd
     namespace: mqtt
 stringData:
-    passwd: ENC[AES256_GCM,data:THO9nW2OC2N3Krb4HZ93UDbk320AqB5lA10TGoa6Kffq7twOCdQnFPMNmnfKE4uMuPsqwA9u/2jGUxFz4ScdFZaJI5I0Orljf69fO7hFu0VvUJew64n2QwSE2PHvoyuy7fgsoODx9FjCySEldQXpHT8tKT762tjiZic3oASNqbv0y9xdi7Akj85l8E8VgsAcr3VUPXRSEi4mls2VjyZXTovfEvyFKNuEBg+gywVGZZGS0InvZSKdbPjDUg9UGA==,iv:nGs3A7rGZRHlfbTVGiaXroRQwR62OCheP+HEF5BP+KI=,tag:SAD5a2yDu9n/IP8x5JjD8A==,type:str]
+    passwd: ENC[AES256_GCM,data:X8Vk2GC/cEZenuITN1ZOO4gkxnJIqI0WtRHtE9ZTmjbg76wjBA9pnMBZdDpRDYWm3m2bzVz7QU0m1TFMEw1UK8Y3E3E7t+6H69pBhgc2LKZbNFwp2i7XowpmQ/5Zpqv5A+NQGCAYa+7gAqlZjiVo4D3apKvYfqGTrFf+OoUQW6Qf2Qr4pXjveRsAsnm8/FXoaMFmzMiY+w7nhIMIROhU3/vKM4rKgmi9SCzkKfrPlFnEgBPEwR4crQduOgxHnQ==,iv:c3NKiIArYvj9s8gBu+A+k388BQHZqVMqKALxKhjE1To=,tag:Ea4tL3LHRDuriNCldWQCCA==,type:str]
 sops:
     age:
         - recipient: age1u236u5mzkzj72y4mfxx68gfqw0u0j6tdgkudnm5pdfpe7apq4u6s89jr2h
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGODZxOXVNQ0piRXJuMm40
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0V0lxSS8ySnhKM1BCK1kw
-            T1FPUC8yU2pjbFMwS0tDSEFQTE1rUkgvcTNFCnc4dkkvcEQ3bDlLSlA0alV3TDlz
+            bCttNzREMHFNa0lJSUNWZVZyYVhCSzU4QXlvCldhZ2NaT2xXUjBlY0J4dExuK0c0
-            QVNkTFN3UjM3dnJGYnhHMWJneFFkWTAKLS0tIGgrN3gvS0hlTlpOcEFrclBkUWw2
+            RHFuY0t6RWIyQ04rK25aZGRaSThuMjAKLS0tIGtCWDZuZGp5b2FlemtVU09mbm55
-            UFB4c1BDKzZ4RVpJMWVmaVV3SStkUXMKAyPGbiy5If4/RFfKKvev5WQJo8m2dUuV
+            dW1jOHJmbGRLMCtqa3BiaEFPL2FYcjAKoJ5z6XSuv9WWxbcOKTlhBblSc73iryG+
-            F3ASETOApaFyM2Y1d8swxE9pNHdiYFleKMJeNpQu2I2D/74GfvshJQ==
+            y04wC6nwMWUNNil+z+2MB+pzYY9PyPuYhZjwZfDS2XL5+pX+Bndh4w==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:22:00Z"
+    lastmodified: "2026-08-26T10:22:07Z"
-    mac: ENC[AES256_GCM,data:m3wQeaHOnK52duBh92+N/otH/opEiZpVQRTaddm0gaoWfaya50M+3xFeAh7uTDCULWvfEULWBFk679+MMHeNZoITTkDWOTsWjv8KOWgWvZi2n6Uxlt+6zBznphjmb9n4IzMMHDCYBsGn6ov0t/yojstgszVa5wfBC1dVS+mUVZg=,iv:EzKrWKCeRQh0ENNOCJhrAhwznUmGlCAO+72/V/P7G3k=,tag:Nrn30lLVodYUQQlNg8n2ug==,type:str]
+    mac: ENC[AES256_GCM,data:kz3lBWlj2nGgLhvcQ/vOxBjZXxdBGwh9AN0uu7CMZUce9Lr9N152mmPP7t6nI1mk2vaJ6cm7SMo1Y5GUhdClGFfWmpX5MUFHbSBPGLTeH2hXiQ8qXFkfREqqZVNshlli37wrTuQ91j6UkDl9etMMLIfc8fxyK8OMBMrTv/lAHfg=,iv:/01Gkow4cFntBD3189ZTLXPL8YGLmfOWbiiPfePaAeE=,tag:5QEEEwE+L1QIxgCdicOtRw==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/vaultwarden/secret.enc.yaml

@@ -4,20 +4,20 @@ metadata:
     name: vaultwarden-secrets
     namespace: vaultwarden
 stringData:
-    #ENC[AES256_GCM,data:tGdgK/b2TPnyyByJJfKuaZXM8CbgexzkyhRY9DPEuRcRr7QYdka/IbDyo8We21+QWDX6ZuLypERy,iv:+kVFIaj0CyqMWwZjVQGES/+WGQrE3H9Bm6gytKE5HMg=,tag:ANigUwJNdFG0YGn4B02VSw==,type:comment]
+    #ENC[AES256_GCM,data:8HIEtCBzpPrdhrTr4iwkCPxFsY8Z6b1FIWjg7JcpTJLc5P7JuNnI4PrKtayh85Ah/l13589dwj16,iv:uWvJycz47FKD7ZAOnRAnuWwN+vWI/Bs6S+LZKx7r7zM=,tag:iDlPjTFRycNkGH4/W6KekQ==,type:comment]
-    ADMIN_TOKEN: ENC[AES256_GCM,data:vLrATNaUNSeF4pWxzjDRMJJwrm/GAUH38dYGWoh+5EjStKuABkLSODWDLXn+bO2oed2OqbphiPSUM8wJwi3GynUAzT9ARi4/ZB6j6DC6d5aCOqBjMb6YHWC/gpyTwfbdhpVPBllx224TtDl7ZsS5Vlo53CA+ZA==,iv:xB4yQiDXofzvQCK/fKUYv7A5x/1PrKrcQ10oYcnPbAA=,tag:bAWRto3CwLZEtFozUTpYOA==,type:str]
+    ADMIN_TOKEN: ENC[AES256_GCM,data:ktyiZxkEUYvi+mW20YTLotxlSmIbqlbsIkSwaPSZMD/AgRT+2MtzGXdr8i9lMB2DrEzngGRv7umbsG8jdJqBIMCEhLY/pLe/zuhFlYKsXQbTi2mz0JqoyzfgQhmSIk2UCSkCF2U2W+XD5sxdd8ID7DUJvIkFCg==,iv:42LkAaXpOSBUg2/3+dMNH0GDV9FAi96mJobWhy3Lsto=,tag:yVWwsw8mOh+XG3+s9PS6LA==,type:str]
 sops:
     age:
         - recipient: age109zta6l0cwpkxn5wek82kvauxn6yqrq80rsz4mvu5atdnpcn9pusuvnqk5
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqRkQxWEpXc3NvUGN0NGJw
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZUTNVbGNnMTZLK3loZjVH
-            Ny9hWUhYb0huY0w4NzNmMEt0bkl0L0FJOFZNCm8rbm15WFk4VHN5T0c5SEFyQWM0
+            SmpyblNvWUZvM3FPa2RtWjlEcnNiQ3E5NG1BClQ3eWxFc29nZXpvVmRwc25LR05V
-            dzZ0bjcvMlFEMTZXU0VQbnp3THU3NncKLS0tIHFJdkp6SnVQeS93VENaRUYxWHVX
+            N1B6YXpXSW1aREJ1RFl2VXpaY0RuYzQKLS0tIFp2ZGhRdEJudmNjcHQzVlFpaVBX
-            N1pQUW81RW95b3RLcGg0KytDQm9ybVEK6CgCPnIqlLsBz52fJZemt2WzThd6fPNa
+            RDZqOUQ5ekNzVTNwa1BObnlUbVlXUXcK6RebrYm1pn+UdcLCH/HhfD5N00JkwpcK
-            fmgd0kUKTNpMfMxFikmSeHaOkMLwbeDASz3dliMSQ+vF9E4oDhTM6g==
+            U8zfvEgL95dxGmJI8ZMziKsEmAX0J9NAD3qfm9FsClAWPWIVsHxYkw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:22:01Z"
+    lastmodified: "2026-08-26T10:22:08Z"
-    mac: ENC[AES256_GCM,data:b/oJFrsOzHPncpiWy5CJA13KwGcNdYSo0M6N7Sfz64JKJ0mS1sfT2JdhpA26uyG/wzwSv6GV8bUE4jGDy3m9QUrqPB/iIHijOpCHnIyGRQPlUKysyYJSRqPK6IDJUmXhr+uue73nZJa7rLKn8z1TSaQp2Nz/+TyyMohv4LkWUjg=,iv:+ziNs9SBjtBdNlh1ebjuqee3wbChvyG1bb3NQ667E6M=,tag:QoeuRl1iad6f/z4WsNv41w==,type:str]
+    mac: ENC[AES256_GCM,data:rt3/nPCQ70Sg0b8MtP1zZW6O9kikD6RYvzgqmw0wD5zGB1SvtF4ilfwj+UAyHJebtujeWO9VE0e5TnZ0ElNNa1hd12tfGC9IA+FLnlwBZa1FQAqjfg6J5mK7pXkUPaaT4/TdUedYF9w8xYw09pY0p1RXIm9maDOg/nEss9gf9KY=,iv:jaPTdRAJf0ACW/vPVLUNA9f7I7+7Oj2UW/DdujQK4rY=,tag:7bxIVl3CeQ/nnjN6S0gTYg==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/webdav/secret.enc.yaml

@@ -4,20 +4,20 @@ metadata:
     name: webdav-secrets
     namespace: webdav
 stringData:
-    WEBDAV_USERNAME: ENC[AES256_GCM,data:JYiItoA=,iv:G74pH1vqCWNBp7gu+1Ou0ttd39OXScDojVeTFNISyhs=,tag:rRSF1M/1dg5rkIS7DEnSrw==,type:str]
+    WEBDAV_USERNAME: ENC[AES256_GCM,data:v1VuBLg=,iv:NRoyNnLl/hXtlJwHa27HwE1vQd0BMNL+L/1aPr1Dz8U=,tag:cYX3/0shrSpC3P5CKQD1iQ==,type:str]
-    WEBDAV_PASSWORD: ENC[AES256_GCM,data:luJHuxdBxROc/UbT0fds+zAooqgrG4udu913CxaSxQvKNWujinoiezkHpBUAQeYQ,iv:xtevlSEAXzFJwxX1mCuLUimdmpX2vgeHRF0nJvLumwc=,tag:Yz0gupLuDJnE8hj5ymOg2g==,type:str]
+    WEBDAV_PASSWORD: ENC[AES256_GCM,data:CefQbb3s2ySss5nOM9gCntDurSexvEtHf+JTWMp1w4xPuzW6E5JNxwlxb0d7Qisa,iv:AgORrvpvZCoP5Sk41nwT06GkH4JoLqjh93F6RZv1rW8=,tag:wQ9lz6GkPiDrdHSPRJfmNA==,type:str]
 sops:
     age:
         - recipient: age1y8t9v56yuvskznddqfsd4yddzzch0yf2dutvvt8rrx6rjh5f9g0s3qeays
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0RENnZWdVelZ3UG0zV2tw
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMa21EMXZLMXhsQlBzUlVB
-            N2dHOGlhaWxBclFFTm8xY0phLzl2aUlhQ2prCitUTThvRjJDWUwwV1YxYnhUU091
+            N3RMamluU1R3WW9yTGtOb2taRk54NlRKOENnClM3M0hHeHUzdkdOSkVnTUd3VS8y
-            UEFFb01rSUJJd1BlOEt6T1NiUUNSV1UKLS0tIDliZms0TUxDRTVaZmxxKzkwdEgw
+            WGpQK2Q3MG5Lb0t6NzFmRXZCdk10eGcKLS0tIG9iRXVUcGhDdVVoUHo1Sk4vcHIz
-            OTBQNG5jUUJua1BpaVVWUUM5ejcwMTAKLaKUthfyjzKNKP0wmkBkpNLrCO8NMfh6
+            QkF0bnVTVDBIcjhQWWVnSUtHZDY5Q1kK2kpyoTABaEKCXbVJOq9HZo4J72MNtxtI
-            alv4li9O2Sh8+bfAT/AJa3t+DFrsw70oX4MGlcFtmO4+2SqrA9Jn3w==
+            acwPumEOe0B3wo7DV5j+F6TQNDUMM5GLTkSvT7w7wA6oAlF/d9RqDA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:22:02Z"
+    lastmodified: "2026-08-26T10:22:09Z"
-    mac: ENC[AES256_GCM,data:nDUQQ7ywj7hM1stpMmX3Jnoj/mepRvWjfi7aVAjRACY82N0c1QYMoki6Rt2GEpTCbWJGIlnPSQbEbAfvcSuu1mgOK9eD2RRsHAuREljTQyKUECjNBpWNQMD+geuy97Ey0l5U4Z5ypfo1duL3aMYh1GUJ4X/tt6Kc+UHIbC/SJSM=,iv:Rbq6kEOLmGeHkvhyNQ/tQXLzLjQvpJqjB91rZ0156DE=,tag:YjiMOM3Cl2skt+gS3SCr7w==,type:str]
+    mac: ENC[AES256_GCM,data:cp2Tmy9FX+ls9LNwZA/uQKjIxJhY+OYjgM7ZYafYe/GFwzni+Mt4ZTQDgk3JvnKHQlFoVi3ltscfJ2zjcAhAVhdxxs3aLVo+90EOhpcELWy1C0mXUhP7FOQAFB1n2BGHjyUZ57vFx6KaI/MzS6y0vktO1vR/X1pvgDvaB62JU+s=,iv:DjCoY9dbIFYOfLmn2BA3utqgG8VJzco6PgZwWtZePH4=,tag:N5SE0RO4Y5Sz7yRRmciwew==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/zigbee2mqtt/secret.enc.yaml

@@ -4,19 +4,19 @@ metadata:
     name: zigbee2mqtt-secrets
     namespace: zigbee2mqtt
 stringData:
-    secret.yaml: ENC[AES256_GCM,data:uxwVOJNg+Ui5qXQ3XAoqk57TZ4Lg2mZ4tV83P9RB/CSMTnjmHDqM3X9B6Au4Df7Uf3DggDiYE6FdD/1oxKb6GnXgguQqiMukg/xnp7XMJkmI1trd+jHdPlhAkkQvY8FR2k98M2PUnPFm2w9hu0UoBv5YY9HBn2J7WzPFbq0=,iv:F/coTLixv4nD3GERs+tv4UiEQGOvrWr/NNjg4ZmcrAI=,tag:vtFtkxcZ+jDuxtHzIVxm7g==,type:str]
+    secret.yaml: ENC[AES256_GCM,data:2ZrZ9KoDBciTQBHPd0DJc7FR5jsnYBgMu/WZgAWz9Q12z9QB6AtfsoJtpWtBnH56Fu/uhRhgNxsHOu14rlL4pOjW/wEcrQBB5Qfv4icf2uWSSj4rj2INen+RhhTKan3Nz9jZF5kltP+k05FstDbt4x2GYjGO6pDWdHGBc7M=,iv:CnZgMpRzoeUB87P3EGO4/ofLX1c1X3DeRvZZhz1brP0=,tag:7O4HTuKqqRYLlTN+KVLRCA==,type:str]
 sops:
     age:
         - recipient: age1tu4xgfefvgdda0vn2thaqndq4p9tuydq2ud6qa98tzzgnff6749qnlcx29
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBERnFzQTR1WitWTGlOWmJQ
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrWndCUnNQWkRFQmFTVHl1
-            TXRPRlo0a0dLcGlxS0VBQlB2cVBSSVphRmhRCjdFWWJlK1VDU25QMWJ3SEdiUkFK
+            alAwR1o4eWJCRE9qd2pwaWkzK0lZeHI5cFZZCjE1eUhIWHN2UTFoSmgzbDBXU0dq
-            UXBwaEFKQkJvVThNMTlBUVpTK3ZyVjQKLS0tIHR0bFplSUhCOGxWaHNLay9IQWRP
+            UUU3VjBQeGhCTHVESDJoOFZOdmlyVW8KLS0tIEpWZzc4WGdablNUSmhmYktlc0V1
-            WnhuOWhDb0U2WGFLd2ZMTGdTQU9LS3MKJJEkS2UrXZsiV+yupmGJQSi4Ywn9mKzo
+            Zi9BaTlXbzBHUmx3Y0Y3RnA2Yk9XTmMKlNhqVmjdtR9fkFbmse9mBgv0TzRvO7pf
-            9diYLWz+SUz0tvEoP/C0ZL6DEscfLfOnZnnCl2KwpTsTdmQ/ftdRtw==
+            zhBdUug4cUBsotcbJOqmUhFy5TeuwDi3CFRVJuIfvWaz5VxHBrMD5w==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:22:03Z"
+    lastmodified: "2026-08-26T10:22:10Z"
-    mac: ENC[AES256_GCM,data:zS4i8uwCK2eK0C+fU0AkunfQ66sUr4UotoDwDPbudx/ReUfaQhiLDXOCv53LLF9rg5uO41s+PP3DTqhj7HvBGYDxaS7pu9IOpiOlioNcPGO0D4+2VHeO3MahOE30tt+mk9qbM6mxeJjGRA+xQcjxVgD67MF4wClCwZ3efTjYqFw=,iv:8TgA4wmsQHkFjxaVHhKJuNN+AkL/thKgsquY6Xh7n/E=,tag:L/k8ohpd7HJ/ZGTiXohFpg==,type:str]
+    mac: ENC[AES256_GCM,data:Wen8UlBjfy1HyHidAWrIRS/yz84KYbt4gBulKtkmThQ9ynTvJfNG9eDtjrCiDdVeQeh2GqdIjxk4XgM4AAHk3Iyx6ADxbyl4keVqFUmuNFHRbu6hL7nje7d7cOmUOBargywcVX0HcApzzJUnK5fooZWcR21E9qfr7qo2JL9wmPA=,iv:eSf4rwM09LiCuccCgSG03r4nA4qabo+9+RIhQjEcdTk=,tag:7FPuIusj/AozuIcrp+Pj9g==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/namespaces/finance.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: finance

clusters/home/apps/fava.yaml

@@ -0,0 +1,18 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: fava
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./clusters/base/apps/fava
+  prune: true
+  wait: true
+  dependsOn:
+    - name: namespaces
+    - name: infra
+    - name: nfs-ganesha
+  retryInterval: 5s

clusters/home/apps/kustomization.yaml

@@ -11,3 +11,4 @@ resources:
   - markdown-vault-mcp.yaml
   - nfs-ganesha.yaml
   - webdav.yaml
+  - fava.yaml

clusters/home/namespaces/kustomization.yaml

@@ -12,4 +12,5 @@ resources:
   - ../../base/namespaces/ai.yaml
   - ../../base/namespaces/mcp.yaml
   - ../../base/namespaces/webdav.yaml
+  - ../../base/namespaces/finance.yaml
   - ../../base/namespaces/nfs.yaml