diff --git a/clusters/base/apps/markdown-vault-mcp/helmrelease.yaml b/clusters/base/apps/markdown-vault-mcp/helmrelease.yaml new file mode 100644 index 0000000..891683a --- /dev/null +++ b/clusters/base/apps/markdown-vault-mcp/helmrelease.yaml @@ -0,0 +1,84 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: markdown-vault-mcp + namespace: mcp +spec: + interval: 30m + chartRef: + kind: OCIRepository + name: markdown-vault-mcp + values: + controllers: + app: + containers: + app: + image: + repository: ghcr.io/pvliesdonk/markdown-vault-mcp + tag: latest + env: + MARKDOWN_VAULT_MCP_SOURCE_DIR: /vault + MARKDOWN_VAULT_MCP_INDEX_PATH: /data/state/index.db + MARKDOWN_VAULT_MCP_EMBEDDINGS_PATH: /data/state/embeddings + MARKDOWN_VAULT_MCP_STATE_PATH: /data/state + MARKDOWN_VAULT_MCP_READ_ONLY: "false" + MARKDOWN_VAULT_MCP_BASE_URL: "https://md-vault.mcp.aggtaa.com" + MARKDOWN_VAULT_MCP_BEARER_TOKEN: + valueFrom: + secretKeyRef: + name: markdown-vault-mcp-secrets + key: BEARER_TOKEN + probes: + liveness: + enabled: true + readiness: + enabled: true + resources: + requests: + cpu: 100m + memory: 256Mi + limits: + memory: 1Gi + + service: + app: + controller: app + ports: + http: + port: 8000 + + ingress: + app: + className: traefik + annotations: + cert-manager.io/cluster-issuer: letsencrypt-prod + hosts: + - host: md-vault.mcp.aggtaa.com + paths: + - path: / + pathType: Prefix + service: + identifier: app + port: http + tls: + - secretName: markdown-vault-mcp-tls + hosts: + - md-vault.mcp.aggtaa.com + + persistence: + vault: + type: persistentVolumeClaim + accessMode: ReadWriteMany + size: 30Gi + storageClass: longhorn + retain: true + globalMounts: + - path: /vault + state: + type: persistentVolumeClaim + accessMode: ReadWriteOnce + size: 2Gi + storageClass: longhorn + retain: true + globalMounts: + - path: /data/state diff --git a/clusters/base/apps/markdown-vault-mcp/helmrepository.yaml b/clusters/base/apps/markdown-vault-mcp/helmrepository.yaml new file mode 100644 index 0000000..8cf0432 --- /dev/null +++ b/clusters/base/apps/markdown-vault-mcp/helmrepository.yaml @@ -0,0 +1,10 @@ +apiVersion: source.toolkit.fluxcd.io/v1 +kind: OCIRepository +metadata: + name: markdown-vault-mcp + namespace: mcp +spec: + interval: 1h + url: oci://ghcr.io/bjw-s-labs/helm/app-template + ref: + tag: "5.0.1" diff --git a/clusters/base/apps/markdown-vault-mcp/kustomization.yaml b/clusters/base/apps/markdown-vault-mcp/kustomization.yaml new file mode 100644 index 0000000..37e8d2e --- /dev/null +++ b/clusters/base/apps/markdown-vault-mcp/kustomization.yaml @@ -0,0 +1,6 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +resources: + - helmrepository.yaml + - helmrelease.yaml + - secret.enc.yaml diff --git a/clusters/base/apps/markdown-vault-mcp/secret.enc.yaml b/clusters/base/apps/markdown-vault-mcp/secret.enc.yaml new file mode 100644 index 0000000..0a5c94f --- /dev/null +++ b/clusters/base/apps/markdown-vault-mcp/secret.enc.yaml @@ -0,0 +1,22 @@ +apiVersion: v1 +kind: Secret +metadata: + name: markdown-vault-mcp-secrets + namespace: mcp +stringData: + BEARER_TOKEN: ENC[AES256_GCM,data:rwP/zaEgKcTx9MifORlacquSDsBdjlZ8DRxxQXUrx1kmrLqK6dWntWEKI2fx06M5ajaJhQ0W3C9uNNebjwiuhA==,iv:Amod0QmRu8cty3GXNx1PJgMnlywcUm0OPp1HtHK+7x8=,tag:c7cdeW3GuSIhrsIM1sgwlg==,type:str] +sops: + age: + - recipient: age1kct5g7d7eus2hvdnmx99ewsrtz70lhlasxa25euqwdctqhwqqpxqz0n7gg + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5ZFRTdjhHWjFwRjhYV0ZM + NHpsSUx3WkwxWEpHSy9DYVdlTzdnZmhaK0dZClBhakhvanBSQWFxOE1XTldNRHdu + YWduc25JZkd4UjUzSE5ZZ3ZEZmRHalUKLS0tIDE0QVorQVJRWUkrbVVYRVNDVmox + dkVMcUtianRlRVpyMnZyUkI1WGFtU00KP/q+PHNgsy3vqUvmlukO+5axCmFyYJS8 + AuUWCz+XOfYk0sxhlBWrUJoc8CL1SNg2IeZSVu4Dx2tpohkDKXFelA== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-08-26T10:20:15Z" + mac: ENC[AES256_GCM,data:6/WCEsa6nYxmjBCqCZs6Rm7frarSpK7eJybtkauBwoNjOruuH6pJuIhiI8X2h+e+AYN9fNEEzD/6HS3vHsu92jpLU7bp1mzhvqhek6+ge23502YOy+bl1MaS3SqBPP2wbBbWRFfqP8Hh8uEApUXq0R5CYoX8f4/PW1TrnHvTvCs=,iv:T5ERopywaFlhZ1PaUeFSWYMVzBF7rWnjNU+W//NmhF4=,tag:fItmUZSg0J7qjGokMLNXnQ==,type:str] + encrypted_regex: ^(data|stringData)$ + version: 3.11.0 diff --git a/clusters/base/apps/mosquitto/secret.enc.yaml b/clusters/base/apps/mosquitto/secret.enc.yaml index fbf011f..d4df26a 100644 --- a/clusters/base/apps/mosquitto/secret.enc.yaml +++ b/clusters/base/apps/mosquitto/secret.enc.yaml @@ -4,19 +4,19 @@ metadata: name: mosquitto-passwd namespace: mqtt stringData: - passwd: ENC[AES256_GCM,data:sjjFnrQ1EjBZ0oy3Qjd28amO2XpGXPQyRaLaHvc+QfBAUC2U9Quq0bVJ+izEOYVFRCWn4aF7VAoznfI0n/9Khn+MoZ2QsRr7WIsky5FV/D3v3SJSj86Wrp3i9vSXzo0k0Aqn++ufhMjs57+fZBtFNY0ftsHNLF0iz+bf6YtW9vAj4g/YSd8NBooG8ii2yoP1MxYUijPNbc+oKQ6eLipsHe4q0NhYFM3SqISaBHGIslJT0fh7N5oE13pcYz3Lfw==,iv:qRkJhmTH6Vv76xM6YJN6GqRRsoStpvaqo0N38wrhXYo=,tag:WMwcv1Poo2Urn7qMIrHMAQ==,type:str] + passwd: ENC[AES256_GCM,data:EFb7f/JregWzZ5zewXstqNnJmBVkXHMEa9Tl0HZ5QaKJgSEOxTmnvmrgyIfF45TyS2GN8xdRTN+9PK7EuXYhi477MrfCCvmOW0tMnYxy1f6CtyvFQCcmL324lt7/g2k6fVZdx/4gvASbvq6+CaXfqcHztHAkOqagSUpo1FuPaeclAZLLdJb6Ieo5xIM63laYpRkL/2rs4iFO0edelVOcL5DeUixnN5lqThekbNE8cmnpR1ZDsDjCc8bKVYoFVQ==,iv:c5hhquiAPuKsj/Tl146ZKaHT65u5lahNnQpyZ946gdI=,tag:bZJ5PQFLvM7p5Ip4zcin8A==,type:str] sops: age: - recipient: age1u236u5mzkzj72y4mfxx68gfqw0u0j6tdgkudnm5pdfpe7apq4u6s89jr2h enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvMTl3L2JSZmw1QnVMOXZt - K2RwZTNpQlAwYStCUWNTQWp4VWJPNHBjK0EwCmRCN0VvYXM5aW85M01HcVE3d1hk - RnFka0dSM2pLRndJZ0U4aU83Vlp4L1EKLS0tIHowaHZZeW9PcWRxUndLSGNjVCtD - UUZPNkZ2U0tZeTNRSjNhQ2I4QmM0TU0KR5sQm6b1qmrbY1lLZ6X7TCk8SpSU/NLj - oJLtW835Wk5fJ1CQlR5opigi2Jj5s2UZWPmTU89pA7EsaQP+d77eTA== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPcXhFVk02bzE1NnVlMkVY + b1ZSaFc4bVRsUXVNNitEWGJNWWhzZVpVM1dzCnh2b2c3L0I0VERrTXBjNHYyNTMr + QVdMQTJKeGRqbUJBaWt4bllOdVdGUzAKLS0tIE00Zk1hVE5sT0ZPYm85TG9QZUFX + OUd0WDBocWFlUStCS0oxSWFVaEx3ZEEKNazEr5WPrQXK6EEsl4+N93G+K7BllCBc + wGDuv7KF982ia+mo2EDzmWt3HIubP4arKFpw/EgvBXYMNlMQyY2ATw== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-08-26T10:20:10Z" - mac: ENC[AES256_GCM,data:29Zz/1l69Z+DkQkqhLIEed2uZxgza85qPI1+Ypqaj0w/ZhKu5PZRsseTSCfl4bKUSxnW9VBdxL2NvcYPxEQaKYCKNc0xLqdOcqejzEzkgM6nYe/dyKhOWpKletoty4/z5FaIF20KuHI9XgWlNdbxb7LKmq4jUyF/5wxerMDyCvM=,iv:vJoqCvCoRBUEuKxN+p4wsKvPRge4VsumL8wdDwWawhE=,tag:LleQuZbjva8Q+WXWIhj1Ug==,type:str] + lastmodified: "2026-08-26T10:20:16Z" + mac: ENC[AES256_GCM,data:6rs1Jy9h2+3F1TB2ximYr4UxO8RsPLlTpJpO7he1urDZpQQQkJ7VB7eFo5H/97HxCEPxc96YuvknA/5nem/RAGLPsGkbTBCrblgg0/4PO2gqBbgV6ZkVdqB0q6utDOltXdWm0bB/ep9d/INnlBY0RG/bxXBsWivx1b30oeeHI9k=,iv:Htt21AC7RLrtCWFUC7Cqpy1sMnXmMNtbsATY5hKX7n8=,tag:AFVPSbf3oxct06lJwvkiJA==,type:str] encrypted_regex: ^(data|stringData)$ version: 3.11.0 diff --git a/clusters/base/apps/vaultwarden/secret.enc.yaml b/clusters/base/apps/vaultwarden/secret.enc.yaml index cc25e40..e354753 100644 --- a/clusters/base/apps/vaultwarden/secret.enc.yaml +++ b/clusters/base/apps/vaultwarden/secret.enc.yaml @@ -4,20 +4,20 @@ metadata: name: vaultwarden-secrets namespace: vaultwarden stringData: - #ENC[AES256_GCM,data:XXvKzLemUkNNIZDDGajOTO1cS5vY6ZIL4NZlGJ+C97gsOf2AykC31W75opr15P36ETqYz8shnqhv,iv:096+7ijbLsKCTW1LiL/humEU/kwTVGAmVXdGuuWTaFo=,tag:LKqb0uCz6wrduAEnicgdDg==,type:comment] - ADMIN_TOKEN: ENC[AES256_GCM,data:3wpOH8g1Kr5pnDdIUoLua0qmFioyEce8ENk0DwWQiJCrbxdc9uEn7kuXVFga3smeYz/kxl+8U57OjU3poc/i3t/n9r1q/1L1+uP7cGiv1fodYH0e0B6kmvCQjqEPI8NBiZG1qJH9tiGnx8IF7ixQwIisNvOF0w==,iv:lHlw0grcgQwZcBhtLaseCSbDTWqYNQjA+MLkK1O33v4=,tag:jWGUwjvfUL0J9UaF/273CQ==,type:str] + #ENC[AES256_GCM,data:flB2OY8Dn/8Q28EEt3z1McMtZiDD3SCPBhj+SwSOlKJnwR7PsYEo2DdcZcatf+/x6VOiAaSFbWvy,iv:vOo92RnCnZZK9dLJoiv+w+x0dIwEoIHNIad1ImBuefs=,tag:/6Ddqx/nNS9BUqX6fCvSKg==,type:comment] + ADMIN_TOKEN: ENC[AES256_GCM,data:vGH+FCMW4WJJZ/JGvrc/1erK6m9+6tHH/Vl9UsZ2mRayx4N8FZ2umhU7cJYvLf/J69EVwadTbi9MmX5KYZkrdniay5/KEx0ZhSKhUEFleI+N8x5oHvs+i5M8hI8NCWVPEXrfJdJGasVlguiMov1iWX3BKh96Zw==,iv:1phgl1P4TPcUowFTnP+VQZQTyW3987tnMtcU4FeU8Ew=,tag:OgDVRpLdSPd6Ne6H9QCz6A==,type:str] sops: age: - recipient: age109zta6l0cwpkxn5wek82kvauxn6yqrq80rsz4mvu5atdnpcn9pusuvnqk5 enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnaERDWG1UV1ppTm5kaDZC - STB5RnI1S0JWS0RsZjVyVU1IdUxQTVJzYkhzCjdDekttWE9CQ2FBRlpseHdVam1y - Q1ZtZlRIOW5aRDh1ZGMvTVhhelNNVk0KLS0tIHRoTDBqdm1YbjhpdVZEa0k4SW9B - ZVJLUzZGTFJhajRHdzV5SUVjcjZMUEUKRsM7al+VGACEtlWOwS0Yse6vJFizh8GA - Y4HSiFEfvUKkzUTH58S6YuxGifKvm0PMJJwkT9HIfN2TN/h3YQ7TXA== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKd0h6OE1WRGNFQW43ZUpW + aVpVN2xpWXJTaWVyNXJoYTJEaFlSc3I3SVJBCkg5QkVFV3k1TGJUZEhMVHA0OUdU + NFhXYlpWS29mbkk5Z2g5VHpmRVBIc1UKLS0tIG9CTXlId0Y5Nit6bVN6anhWMkJ2 + VnlMUHRydmFTeXpwL2xkd0s0cUp4aE0KXIRVhmDZMYZqUbs1wIE0yqp1hmLa02w1 + yy7e8N4af8YYsBuxb+Uxy+3VYnu5lOfDV5rVmSMYvjLQesrLNsiuNg== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-08-26T10:20:12Z" - mac: ENC[AES256_GCM,data:Vmgt2DPxl0BMXNjPhVL03u1QT49BFduEQ/PA9sAVM45s4drw3aKVdmgXNRXdkYeuOsMR+HwtzZKyit8a+TUGp4AQOfzZ3ONm2iL+X9KrhvPJJvFMC1H9IQtCq5ZMu+IC8ILokWFPVaohLBX212tXFF2nH/8BxFusA6vxRXCsSp0=,iv:Qh9l7aHuQ69jJX8nGJXblemg5R0b4Q9gA67nmW1rZnU=,tag:x1r6BQug8zUAOUxTQsyvUA==,type:str] + lastmodified: "2026-08-26T10:20:17Z" + mac: ENC[AES256_GCM,data:90Rxcg2fa/aws3H5keuOE07hCbIJZBinbB2nKXvNzDwQkh7jClH2nzT51kdQEDxkEV5rySoWAVInWh5Y4bKAAMLloJC21cd5TzTOMUf4JcZBg1oaRFVUg+xIS7GKT5nydKFy9oVVZUFFkyFQDumnmNyuT/tIv3BYOrah/m8F5NY=,iv:wHFKkZ+qBgiybpshn3cRiQsjZ4SxHDj8D1hEwRFMeNM=,tag:pI6A8CG0FXb0oos1R7sQxw==,type:str] encrypted_regex: ^(data|stringData)$ version: 3.11.0 diff --git a/clusters/base/apps/zigbee2mqtt/secret.enc.yaml b/clusters/base/apps/zigbee2mqtt/secret.enc.yaml index 6ffcfea..beaa410 100644 --- a/clusters/base/apps/zigbee2mqtt/secret.enc.yaml +++ b/clusters/base/apps/zigbee2mqtt/secret.enc.yaml @@ -4,19 +4,19 @@ metadata: name: zigbee2mqtt-secrets namespace: zigbee2mqtt stringData: - secret.yaml: ENC[AES256_GCM,data:DjTLhMZmpf1ad5C4EpZjbyn82Ht6IYXlT9EmYvECbMm2qEIGuLm39HVKpDxkKMTu0v4yBfZRYqOt/MCAtJvqsxcbowxNpY9WnfPt7VFUhRZKlK16KVRmtKcYEr6gEFpv48joKjHUc0sCUg7sMcTfwsA1myZs9TEtYNaxtPI=,iv:zavcvlYJflfjAo1Vi1n2eFmWs5/Llu/idvW4xzzt12w=,tag:yNzchsctemYVO+nye+72Pg==,type:str] + secret.yaml: ENC[AES256_GCM,data:wCM4CuZV1yUzFL4ziLvVDMbqf0JPxCx/EeqJQlTogBj7CLNRmNOhty6VhO40KZLbI3ixJeCR0+r/98ureUa9sKumpTBsHXOM94Vyih7sHRswDWl3TYd2y0NfJDDG9MpmMtp5Q9YBCqtj7HFGhcgcbfzYFCauIkFSG9Eo/Ck=,iv:uyiUw5PBThmbI8jm0sVebciXZfr8Z6jhS1pWPLpMbus=,tag:+2T6Og6LBQ83q5PWjr4C6A==,type:str] sops: age: - recipient: age1tu4xgfefvgdda0vn2thaqndq4p9tuydq2ud6qa98tzzgnff6749qnlcx29 enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTcGxVaXVuK1B4RDBxMG1o - emQ3cllnSU4yQVl6d2JKMHNzNzlvQXh4YlNzCllhM2JsWHpaL29FNzZ1R2MwS2hu - SG50a2JCL0k1ZXh3M29qUlhaRDFvSDgKLS0tIEZsS1J5VTBZWnFmeGNsejcybEk0 - RVhSSTBHZGVQNzhtZXJiOXpjNXZ2UVUKGQnVbY+5z9PbQ9Ge4WA6Um2/Cs8sDd8e - TcV3k9jDlJVeGmw9ngJ7jr+mE7mXEwNgS1K8uqDte2LSm/LnloNImw== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVUjVhcjZaVjgzVG54cEtB + cjhTRTV5MDE4VHQyTlJuMnhlUUNMTXpVRm1nCktIZXR4RVZoSHhjYUZnSURrK3J2 + TURZSnhTOU9ZR1pJNzMxMlltdzJWYmMKLS0tIGZLbDlPdUhHM0lRTFJjTGx2eE9J + bklvQzNpaUtNcVFQU3FWdWc5NFNDcmsKSnkFX6PqSkNvqbsx2bCzBvXGa9jK1wzB + Ebww3fbg7Reho1M4FwF7d/sVcwjA5C3abbRCige7ezqtcAy353+Mlw== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-08-26T10:20:13Z" - mac: ENC[AES256_GCM,data:j50cHrmvtIarHSjof9gy7Q3lltB6/Tr7RqZQeOQ1PPzjyt5UcnDU0I3oWCGLg1uSwcjKCZeoh6mCpKgEmfrv4nAqphgRT1N17H927QkiVZHSnvEJX3TfmE8bRV0qjEv9JW8CQJk1mj1pLh0SvuGSlFjQ1tcJhCa34JoYurfa9WY=,iv:ppYAXzR9/qNarPPMkqnvgagBkqbmKXfzJRXxlZJ1Sew=,tag:YkAjaCgjhEfleQoAhKCSCA==,type:str] + lastmodified: "2026-08-26T10:20:18Z" + mac: ENC[AES256_GCM,data:DwvydHBM1Xbb8c9IArjf2O5Iu4E5ggiahnKzW/GJ4CNLLljnCmzF10GCjIA4+MXvnbxenHoKY+WZkHGck79JkVqAXGoRljPaYOiKjrx2dFarZJUr8tC1y9NBPrcbn2+BRIowXUrxwLIXTvTGlio0myTbNrS4AnatBhgXrTy49w8=,iv:uZwcaZqVgMj0wKQgTjft/ubSdFP1tE9AQpKJoxOlrCw=,tag:9hd4l6ZqfJ50A8WNOWlUIA==,type:str] encrypted_regex: ^(data|stringData)$ version: 3.11.0 diff --git a/clusters/base/namespaces/mcp.yaml b/clusters/base/namespaces/mcp.yaml new file mode 100644 index 0000000..4c5793d --- /dev/null +++ b/clusters/base/namespaces/mcp.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: mcp diff --git a/clusters/home/apps/kustomization.yaml b/clusters/home/apps/kustomization.yaml index e1c81e8..d7b1140 100644 --- a/clusters/home/apps/kustomization.yaml +++ b/clusters/home/apps/kustomization.yaml @@ -8,3 +8,4 @@ resources: - mosquitto.yaml - homeassistant.yaml - openwebui.yaml + - markdown-vault-mcp.yaml diff --git a/clusters/home/apps/markdown-vault-mcp.yaml b/clusters/home/apps/markdown-vault-mcp.yaml new file mode 100644 index 0000000..a760652 --- /dev/null +++ b/clusters/home/apps/markdown-vault-mcp.yaml @@ -0,0 +1,21 @@ +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: markdown-vault-mcp + namespace: flux-system +spec: + interval: 10m + sourceRef: + kind: GitRepository + name: flux-system + path: ./clusters/base/apps/markdown-vault-mcp + prune: true + wait: true + dependsOn: + - name: namespaces + - name: infra + retryInterval: 5s + decryption: + provider: sops + secretRef: + name: sops-age diff --git a/clusters/home/namespaces/kustomization.yaml b/clusters/home/namespaces/kustomization.yaml index fffe869..a876ab5 100644 --- a/clusters/home/namespaces/kustomization.yaml +++ b/clusters/home/namespaces/kustomization.yaml @@ -10,3 +10,4 @@ resources: - ../../base/namespaces/mqtt.yaml - ../../base/namespaces/homeassistant.yaml - ../../base/namespaces/ai.yaml + - ../../base/namespaces/mcp.yaml