markdown-vault-mcp

clusters/base/apps/markdown-vault-mcp/helmrelease.yaml

@@ -0,0 +1,84 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: markdown-vault-mcp
+  namespace: mcp
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: markdown-vault-mcp
+  values:
+    controllers:
+      app:
+        containers:
+          app:
+            image:
+              repository: ghcr.io/pvliesdonk/markdown-vault-mcp
+              tag: latest
+            env:
+              MARKDOWN_VAULT_MCP_SOURCE_DIR: /vault
+              MARKDOWN_VAULT_MCP_INDEX_PATH: /data/state/index.db
+              MARKDOWN_VAULT_MCP_EMBEDDINGS_PATH: /data/state/embeddings
+              MARKDOWN_VAULT_MCP_STATE_PATH: /data/state
+              MARKDOWN_VAULT_MCP_READ_ONLY: "false"
+              MARKDOWN_VAULT_MCP_BASE_URL: "https://md-vault.mcp.aggtaa.com"
+              MARKDOWN_VAULT_MCP_BEARER_TOKEN:
+                valueFrom:
+                  secretKeyRef:
+                    name: markdown-vault-mcp-secrets
+                    key: BEARER_TOKEN
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+            resources:
+              requests:
+                cpu: 100m
+                memory: 256Mi
+              limits:
+                memory: 1Gi
+
+    service:
+      app:
+        controller: app
+        ports:
+          http:
+            port: 8000
+
+    ingress:
+      app:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: md-vault.mcp.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: markdown-vault-mcp-tls
+            hosts:
+              - md-vault.mcp.aggtaa.com
+
+    persistence:
+      vault:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteMany
+        size: 30Gi
+        storageClass: longhorn
+        retain: true
+        globalMounts:
+          - path: /vault
+      state:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 2Gi
+        storageClass: longhorn
+        retain: true
+        globalMounts:
+          - path: /data/state

clusters/base/apps/markdown-vault-mcp/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: markdown-vault-mcp
+  namespace: mcp
+spec:
+  interval: 1h
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/markdown-vault-mcp/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - helmrelease.yaml
+  - secret.enc.yaml

clusters/base/apps/markdown-vault-mcp/secret.enc.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: markdown-vault-mcp-secrets
+    namespace: mcp
+stringData:
+    BEARER_TOKEN: ENC[AES256_GCM,data:rwP/zaEgKcTx9MifORlacquSDsBdjlZ8DRxxQXUrx1kmrLqK6dWntWEKI2fx06M5ajaJhQ0W3C9uNNebjwiuhA==,iv:Amod0QmRu8cty3GXNx1PJgMnlywcUm0OPp1HtHK+7x8=,tag:c7cdeW3GuSIhrsIM1sgwlg==,type:str]
+sops:
+    age:
+        - recipient: age1kct5g7d7eus2hvdnmx99ewsrtz70lhlasxa25euqwdctqhwqqpxqz0n7gg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5ZFRTdjhHWjFwRjhYV0ZM
+            NHpsSUx3WkwxWEpHSy9DYVdlTzdnZmhaK0dZClBhakhvanBSQWFxOE1XTldNRHdu
+            YWduc25JZkd4UjUzSE5ZZ3ZEZmRHalUKLS0tIDE0QVorQVJRWUkrbVVYRVNDVmox
+            dkVMcUtianRlRVpyMnZyUkI1WGFtU00KP/q+PHNgsy3vqUvmlukO+5axCmFyYJS8
+            AuUWCz+XOfYk0sxhlBWrUJoc8CL1SNg2IeZSVu4Dx2tpohkDKXFelA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-26T10:20:15Z"
+    mac: ENC[AES256_GCM,data:6/WCEsa6nYxmjBCqCZs6Rm7frarSpK7eJybtkauBwoNjOruuH6pJuIhiI8X2h+e+AYN9fNEEzD/6HS3vHsu92jpLU7bp1mzhvqhek6+ge23502YOy+bl1MaS3SqBPP2wbBbWRFfqP8Hh8uEApUXq0R5CYoX8f4/PW1TrnHvTvCs=,iv:T5ERopywaFlhZ1PaUeFSWYMVzBF7rWnjNU+W//NmhF4=,tag:fItmUZSg0J7qjGokMLNXnQ==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

clusters/base/apps/mosquitto/secret.enc.yaml

@@ -4,19 +4,19 @@ metadata:
     name: mosquitto-passwd
     namespace: mqtt
 stringData:
-    passwd: ENC[AES256_GCM,data:sjjFnrQ1EjBZ0oy3Qjd28amO2XpGXPQyRaLaHvc+QfBAUC2U9Quq0bVJ+izEOYVFRCWn4aF7VAoznfI0n/9Khn+MoZ2QsRr7WIsky5FV/D3v3SJSj86Wrp3i9vSXzo0k0Aqn++ufhMjs57+fZBtFNY0ftsHNLF0iz+bf6YtW9vAj4g/YSd8NBooG8ii2yoP1MxYUijPNbc+oKQ6eLipsHe4q0NhYFM3SqISaBHGIslJT0fh7N5oE13pcYz3Lfw==,iv:qRkJhmTH6Vv76xM6YJN6GqRRsoStpvaqo0N38wrhXYo=,tag:WMwcv1Poo2Urn7qMIrHMAQ==,type:str]
+    passwd: ENC[AES256_GCM,data:EFb7f/JregWzZ5zewXstqNnJmBVkXHMEa9Tl0HZ5QaKJgSEOxTmnvmrgyIfF45TyS2GN8xdRTN+9PK7EuXYhi477MrfCCvmOW0tMnYxy1f6CtyvFQCcmL324lt7/g2k6fVZdx/4gvASbvq6+CaXfqcHztHAkOqagSUpo1FuPaeclAZLLdJb6Ieo5xIM63laYpRkL/2rs4iFO0edelVOcL5DeUixnN5lqThekbNE8cmnpR1ZDsDjCc8bKVYoFVQ==,iv:c5hhquiAPuKsj/Tl146ZKaHT65u5lahNnQpyZ946gdI=,tag:bZJ5PQFLvM7p5Ip4zcin8A==,type:str]
 sops:
     age:
         - recipient: age1u236u5mzkzj72y4mfxx68gfqw0u0j6tdgkudnm5pdfpe7apq4u6s89jr2h
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAvMTl3L2JSZmw1QnVMOXZt
-            K2RwZTNpQlAwYStCUWNTQWp4VWJPNHBjK0EwCmRCN0VvYXM5aW85M01HcVE3d1hk
-            RnFka0dSM2pLRndJZ0U4aU83Vlp4L1EKLS0tIHowaHZZeW9PcWRxUndLSGNjVCtD
-            UUZPNkZ2U0tZeTNRSjNhQ2I4QmM0TU0KR5sQm6b1qmrbY1lLZ6X7TCk8SpSU/NLj
-            oJLtW835Wk5fJ1CQlR5opigi2Jj5s2UZWPmTU89pA7EsaQP+d77eTA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPcXhFVk02bzE1NnVlMkVY
+            b1ZSaFc4bVRsUXVNNitEWGJNWWhzZVpVM1dzCnh2b2c3L0I0VERrTXBjNHYyNTMr
+            QVdMQTJKeGRqbUJBaWt4bllOdVdGUzAKLS0tIE00Zk1hVE5sT0ZPYm85TG9QZUFX
+            OUd0WDBocWFlUStCS0oxSWFVaEx3ZEEKNazEr5WPrQXK6EEsl4+N93G+K7BllCBc
+            wGDuv7KF982ia+mo2EDzmWt3HIubP4arKFpw/EgvBXYMNlMQyY2ATw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:20:10Z"
-    mac: ENC[AES256_GCM,data:29Zz/1l69Z+DkQkqhLIEed2uZxgza85qPI1+Ypqaj0w/ZhKu5PZRsseTSCfl4bKUSxnW9VBdxL2NvcYPxEQaKYCKNc0xLqdOcqejzEzkgM6nYe/dyKhOWpKletoty4/z5FaIF20KuHI9XgWlNdbxb7LKmq4jUyF/5wxerMDyCvM=,iv:vJoqCvCoRBUEuKxN+p4wsKvPRge4VsumL8wdDwWawhE=,tag:LleQuZbjva8Q+WXWIhj1Ug==,type:str]
+    lastmodified: "2026-08-26T10:20:16Z"
+    mac: ENC[AES256_GCM,data:6rs1Jy9h2+3F1TB2ximYr4UxO8RsPLlTpJpO7he1urDZpQQQkJ7VB7eFo5H/97HxCEPxc96YuvknA/5nem/RAGLPsGkbTBCrblgg0/4PO2gqBbgV6ZkVdqB0q6utDOltXdWm0bB/ep9d/INnlBY0RG/bxXBsWivx1b30oeeHI9k=,iv:Htt21AC7RLrtCWFUC7Cqpy1sMnXmMNtbsATY5hKX7n8=,tag:AFVPSbf3oxct06lJwvkiJA==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/vaultwarden/secret.enc.yaml

@@ -4,20 +4,20 @@ metadata:
     name: vaultwarden-secrets
     namespace: vaultwarden
 stringData:
-    #ENC[AES256_GCM,data:XXvKzLemUkNNIZDDGajOTO1cS5vY6ZIL4NZlGJ+C97gsOf2AykC31W75opr15P36ETqYz8shnqhv,iv:096+7ijbLsKCTW1LiL/humEU/kwTVGAmVXdGuuWTaFo=,tag:LKqb0uCz6wrduAEnicgdDg==,type:comment]
-    ADMIN_TOKEN: ENC[AES256_GCM,data:3wpOH8g1Kr5pnDdIUoLua0qmFioyEce8ENk0DwWQiJCrbxdc9uEn7kuXVFga3smeYz/kxl+8U57OjU3poc/i3t/n9r1q/1L1+uP7cGiv1fodYH0e0B6kmvCQjqEPI8NBiZG1qJH9tiGnx8IF7ixQwIisNvOF0w==,iv:lHlw0grcgQwZcBhtLaseCSbDTWqYNQjA+MLkK1O33v4=,tag:jWGUwjvfUL0J9UaF/273CQ==,type:str]
+    #ENC[AES256_GCM,data:flB2OY8Dn/8Q28EEt3z1McMtZiDD3SCPBhj+SwSOlKJnwR7PsYEo2DdcZcatf+/x6VOiAaSFbWvy,iv:vOo92RnCnZZK9dLJoiv+w+x0dIwEoIHNIad1ImBuefs=,tag:/6Ddqx/nNS9BUqX6fCvSKg==,type:comment]
+    ADMIN_TOKEN: ENC[AES256_GCM,data:vGH+FCMW4WJJZ/JGvrc/1erK6m9+6tHH/Vl9UsZ2mRayx4N8FZ2umhU7cJYvLf/J69EVwadTbi9MmX5KYZkrdniay5/KEx0ZhSKhUEFleI+N8x5oHvs+i5M8hI8NCWVPEXrfJdJGasVlguiMov1iWX3BKh96Zw==,iv:1phgl1P4TPcUowFTnP+VQZQTyW3987tnMtcU4FeU8Ew=,tag:OgDVRpLdSPd6Ne6H9QCz6A==,type:str]
 sops:
     age:
         - recipient: age109zta6l0cwpkxn5wek82kvauxn6yqrq80rsz4mvu5atdnpcn9pusuvnqk5
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnaERDWG1UV1ppTm5kaDZC
-            STB5RnI1S0JWS0RsZjVyVU1IdUxQTVJzYkhzCjdDekttWE9CQ2FBRlpseHdVam1y
-            Q1ZtZlRIOW5aRDh1ZGMvTVhhelNNVk0KLS0tIHRoTDBqdm1YbjhpdVZEa0k4SW9B
-            ZVJLUzZGTFJhajRHdzV5SUVjcjZMUEUKRsM7al+VGACEtlWOwS0Yse6vJFizh8GA
-            Y4HSiFEfvUKkzUTH58S6YuxGifKvm0PMJJwkT9HIfN2TN/h3YQ7TXA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKd0h6OE1WRGNFQW43ZUpW
+            aVpVN2xpWXJTaWVyNXJoYTJEaFlSc3I3SVJBCkg5QkVFV3k1TGJUZEhMVHA0OUdU
+            NFhXYlpWS29mbkk5Z2g5VHpmRVBIc1UKLS0tIG9CTXlId0Y5Nit6bVN6anhWMkJ2
+            VnlMUHRydmFTeXpwL2xkd0s0cUp4aE0KXIRVhmDZMYZqUbs1wIE0yqp1hmLa02w1
+            yy7e8N4af8YYsBuxb+Uxy+3VYnu5lOfDV5rVmSMYvjLQesrLNsiuNg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:20:12Z"
-    mac: ENC[AES256_GCM,data:Vmgt2DPxl0BMXNjPhVL03u1QT49BFduEQ/PA9sAVM45s4drw3aKVdmgXNRXdkYeuOsMR+HwtzZKyit8a+TUGp4AQOfzZ3ONm2iL+X9KrhvPJJvFMC1H9IQtCq5ZMu+IC8ILokWFPVaohLBX212tXFF2nH/8BxFusA6vxRXCsSp0=,iv:Qh9l7aHuQ69jJX8nGJXblemg5R0b4Q9gA67nmW1rZnU=,tag:x1r6BQug8zUAOUxTQsyvUA==,type:str]
+    lastmodified: "2026-08-26T10:20:17Z"
+    mac: ENC[AES256_GCM,data:90Rxcg2fa/aws3H5keuOE07hCbIJZBinbB2nKXvNzDwQkh7jClH2nzT51kdQEDxkEV5rySoWAVInWh5Y4bKAAMLloJC21cd5TzTOMUf4JcZBg1oaRFVUg+xIS7GKT5nydKFy9oVVZUFFkyFQDumnmNyuT/tIv3BYOrah/m8F5NY=,iv:wHFKkZ+qBgiybpshn3cRiQsjZ4SxHDj8D1hEwRFMeNM=,tag:pI6A8CG0FXb0oos1R7sQxw==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/zigbee2mqtt/secret.enc.yaml

@@ -4,19 +4,19 @@ metadata:
     name: zigbee2mqtt-secrets
     namespace: zigbee2mqtt
 stringData:
-    secret.yaml: ENC[AES256_GCM,data:DjTLhMZmpf1ad5C4EpZjbyn82Ht6IYXlT9EmYvECbMm2qEIGuLm39HVKpDxkKMTu0v4yBfZRYqOt/MCAtJvqsxcbowxNpY9WnfPt7VFUhRZKlK16KVRmtKcYEr6gEFpv48joKjHUc0sCUg7sMcTfwsA1myZs9TEtYNaxtPI=,iv:zavcvlYJflfjAo1Vi1n2eFmWs5/Llu/idvW4xzzt12w=,tag:yNzchsctemYVO+nye+72Pg==,type:str]
+    secret.yaml: ENC[AES256_GCM,data:wCM4CuZV1yUzFL4ziLvVDMbqf0JPxCx/EeqJQlTogBj7CLNRmNOhty6VhO40KZLbI3ixJeCR0+r/98ureUa9sKumpTBsHXOM94Vyih7sHRswDWl3TYd2y0NfJDDG9MpmMtp5Q9YBCqtj7HFGhcgcbfzYFCauIkFSG9Eo/Ck=,iv:uyiUw5PBThmbI8jm0sVebciXZfr8Z6jhS1pWPLpMbus=,tag:+2T6Og6LBQ83q5PWjr4C6A==,type:str]
 sops:
     age:
         - recipient: age1tu4xgfefvgdda0vn2thaqndq4p9tuydq2ud6qa98tzzgnff6749qnlcx29
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBTcGxVaXVuK1B4RDBxMG1o
-            emQ3cllnSU4yQVl6d2JKMHNzNzlvQXh4YlNzCllhM2JsWHpaL29FNzZ1R2MwS2hu
-            SG50a2JCL0k1ZXh3M29qUlhaRDFvSDgKLS0tIEZsS1J5VTBZWnFmeGNsejcybEk0
-            RVhSSTBHZGVQNzhtZXJiOXpjNXZ2UVUKGQnVbY+5z9PbQ9Ge4WA6Um2/Cs8sDd8e
-            TcV3k9jDlJVeGmw9ngJ7jr+mE7mXEwNgS1K8uqDte2LSm/LnloNImw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVUjVhcjZaVjgzVG54cEtB
+            cjhTRTV5MDE4VHQyTlJuMnhlUUNMTXpVRm1nCktIZXR4RVZoSHhjYUZnSURrK3J2
+            TURZSnhTOU9ZR1pJNzMxMlltdzJWYmMKLS0tIGZLbDlPdUhHM0lRTFJjTGx2eE9J
+            bklvQzNpaUtNcVFQU3FWdWc5NFNDcmsKSnkFX6PqSkNvqbsx2bCzBvXGa9jK1wzB
+            Ebww3fbg7Reho1M4FwF7d/sVcwjA5C3abbRCige7ezqtcAy353+Mlw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:20:13Z"
-    mac: ENC[AES256_GCM,data:j50cHrmvtIarHSjof9gy7Q3lltB6/Tr7RqZQeOQ1PPzjyt5UcnDU0I3oWCGLg1uSwcjKCZeoh6mCpKgEmfrv4nAqphgRT1N17H927QkiVZHSnvEJX3TfmE8bRV0qjEv9JW8CQJk1mj1pLh0SvuGSlFjQ1tcJhCa34JoYurfa9WY=,iv:ppYAXzR9/qNarPPMkqnvgagBkqbmKXfzJRXxlZJ1Sew=,tag:YkAjaCgjhEfleQoAhKCSCA==,type:str]
+    lastmodified: "2026-08-26T10:20:18Z"
+    mac: ENC[AES256_GCM,data:DwvydHBM1Xbb8c9IArjf2O5Iu4E5ggiahnKzW/GJ4CNLLljnCmzF10GCjIA4+MXvnbxenHoKY+WZkHGck79JkVqAXGoRljPaYOiKjrx2dFarZJUr8tC1y9NBPrcbn2+BRIowXUrxwLIXTvTGlio0myTbNrS4AnatBhgXrTy49w8=,iv:uZwcaZqVgMj0wKQgTjft/ubSdFP1tE9AQpKJoxOlrCw=,tag:9hd4l6ZqfJ50A8WNOWlUIA==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/namespaces/mcp.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: mcp

clusters/home/apps/kustomization.yaml

@@ -8,3 +8,4 @@ resources:
   - mosquitto.yaml
   - homeassistant.yaml
   - openwebui.yaml
+  - markdown-vault-mcp.yaml

clusters/home/apps/markdown-vault-mcp.yaml

@@ -0,0 +1,21 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: markdown-vault-mcp
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./clusters/base/apps/markdown-vault-mcp
+  prune: true
+  wait: true
+  dependsOn:
+    - name: namespaces
+    - name: infra
+  retryInterval: 5s
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age

clusters/home/namespaces/kustomization.yaml

@@ -10,3 +10,4 @@ resources:
   - ../../base/namespaces/mqtt.yaml
   - ../../base/namespaces/homeassistant.yaml
   - ../../base/namespaces/ai.yaml
+  - ../../base/namespaces/mcp.yaml