radicale and agendav removed. infcloud at c.aggtaa.com

clusters/base/apps/davical/helmrelease-davical.yaml

@@ -82,7 +82,7 @@ spec:
     ingress:
       app:
         className: traefik
-        # no cert-manager annotation here: radicale's own Ingress already
+        # no cert-manager annotation here: infcloud's own Ingress already
         # requests/owns the Certificate for c.aggtaa.com -> radicale-tls.
         # A second Ingress with the annotation would create a competing
         # Certificate for the same host/secret.
@@ -90,11 +90,6 @@ spec:
         # No stripPrefix middleware either: Apache needs to see the /server
         # prefix itself (via the Alias added in the seed-config initContainer)
         # so that DAViCal's self-referential links come out correct.
-        #
-        # c2.aggtaa.com/server is the same backend, reachable same-origin
-        # from InfCloud (also on c2.aggtaa.com) so its browser-side CalDAV
-        # requests don't need CORS. That ingress owns the cert-manager
-        # annotation for c2.aggtaa.com; this one just reuses its secret.
         hosts:
           - host: c.aggtaa.com
             paths:
@@ -103,20 +98,10 @@ spec:
                 service:
                   identifier: app
                   port: http
-          - host: c2.aggtaa.com
-            paths:
-              - path: /server
-                pathType: Prefix
-                service:
-                  identifier: app
-                  port: http
         tls:
           - secretName: radicale-tls
             hosts:
               - c.aggtaa.com
-          - secretName: infcloud-tls
-            hosts:
-              - c2.aggtaa.com
 
     persistence:
       config:

clusters/base/apps/davical/secret.enc.yaml

@@ -4,21 +4,21 @@ metadata:
     name: davical-secrets
     namespace: pim
 stringData:
-    PGSQL_ROOT_PASS: ENC[AES256_GCM,data:QGqssqH3ma/i6jKX46QrWT/ibuqxfTBjH8GRZP+EFZ19KgmW2MeUqPHp2b0KcPT9,iv:iwby/dEzV0X2Ca7diTLzUT5V+e3G2z4bxJSDyiblI8U=,tag:67s/Lo4CjjsDEkITKFnq5g==,type:str]
+    PGSQL_ROOT_PASS: ENC[AES256_GCM,data:ZW2qTLmKG74lg4rMsTUiJXpDd5tQPRcrKGagvij9cbkjdxmzwDdsFxRAZM/0OO+r,iv:LhtEHlpKf2KOSr/mTsHHsa8MPM++qz0+nZQX9RK7ZpQ=,tag:wpdTt04Rr7Ma/1m227SjZw==,type:str]
-    PASSDAVDB: ENC[AES256_GCM,data:UiW+Tf5LAQ24mthrB5pYqMt7V3G1oOC8eFnSZkVKHA2JIMEl3ptsO+tesl8Ada1y,iv:NDVa9RXC+uIGwKDUuTa6+nMiH9vpWuEIExzmKQTIS4k=,tag:ZN0aYgvUZX392DWAoV0jyA==,type:str]
+    PASSDAVDB: ENC[AES256_GCM,data:Q77nDY3pBE8bjoKHch/bHQSDVaZM5hKEZ9DnnrMmqsF0QXYV6FO8mQVNohbwRZ0k,iv:d6yzl8RuPqqob02WsvDHeeeR8c9XYXm3TgTrQabipCg=,tag:cVohM9yJ4CYJMAuakRFLbw==,type:str]
-    ADMINDAVICALPASS: ENC[AES256_GCM,data:xnZTsq+ba9oCdtYnxuZbnlB4lcniOGpnKZSqqyCcG8w=,iv:vVaO2gg0o3LI6ZtNDPdjjnlm6dyYmeUT1jQRgyJ8Cqw=,tag:ILhGxMaB+Mmv2vyKbPyYaQ==,type:str]
+    ADMINDAVICALPASS: ENC[AES256_GCM,data:s0Q7mKqCbe4WkJpmR0/rN8uKaUEjvJq3zVMvyqoEEWU=,iv:xFYCjvyYk0Bb/6Uf7pjtI1moX8X73PvKSAzD/d6+EAA=,tag:W6SGO/k7kaJs8ScVvSZqew==,type:str]
 sops:
     age:
         - recipient: age1yx8mey02c0mu6te9hwxwdqp5n4enjz35e8thchsmvhqw7xsrzy0syg367g
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOcFhiVUNkZVRZU2hHUXhI
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMdEtBUFZtNVhTTFRwY1Ir
-            RlNzYXdIdElMbSttYVFibUM2NHVObWV4T1ZrCkp3ek9ZdEE0VTdMaWlRdHk3amsx
+            L2tMblVhRzREcmRwWnpFVWNnNmZ1NXRWS1YwCjA5WjlJK2ZIWmtoS3p0NHhmckhu
-            dmUvblo4ZVM4OEdnOXhkYmV2a2R4dkkKLS0tIHhoVUd4QThTZXVsNDMwVXY1bk4v
+            ODMwWXhSN0RRMnRkVlNTUHB6MXNKc1kKLS0tIHZ5eDltOG9EQVhiWjZlWlV0SEJ6
-            U0hLMkd1bllzaUxSVTRVUEk5WDgvZjAKIHfqnZMlM8IA83jIu6Isd+XObtATeUkp
+            eldqTkxXYlhXaDkvNy8vQXVKYWNBTEEKYLqYfDKEk+uwP2wC6dIdZq0LY7Ex2otO
-            vFRK/oxl3bV8OgyTFtTDotb16CvhN6IBjKqfC+7CIsrOh9fBwxwuQw==
+            mGMuntyPw6711z17Cat5ssTSQqw0iVO16e2s0tjI1MXctrF6qRDQcw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:24:17Z"
+    lastmodified: "2026-08-26T10:24:24Z"
-    mac: ENC[AES256_GCM,data:gvbGpqeSUj6qHNcDX+FBxJJWGglNQwR61yWUo5wBrVaagxaO342pq/sDF7oDBG8AzIfSNk5kXuWzkWe8KJLFnCxzw4XxoFqBDp2Mlkr1iQfKVptj+Urv2Vrsgd9CN5ctUuDoas8U+oQhu5G4pni/KRLXBUwdO0Z0ZyzzdDaDGSU=,iv:Dc/o2x4dfT4Sx+5nqTIPx7wh5u0/ThO1uduLcGX8byk=,tag:AR716bU6P84AyyOVT8NwzA==,type:str]
+    mac: ENC[AES256_GCM,data:m8KPG8DZgO+p7PSirimtbYDpXtnqJ57l4N0x4Cah6OVpVD+yjSYV1nxNtHjp+djy5Vl23iKc75y0AmaA7x8LYaWzA2nBe43hiG9Fft6YM6P7q6Ms1jXjG2ARv0e3fZmHFRkYZ8eWkscxc1BmzhN05kyKQR6/yifP/W5CJgsc24g=,iv:tz31W18+cD5nESjpHh88WFXRC5WEn/8TYASMSd9c+bs=,tag:s0kkp/h2r87cEAngp5Sr+w==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/infcloud/helmrelease-infcloud.yaml

@@ -34,13 +34,16 @@ spec:
     ingress:
       app:
         className: traefik
-        # this ingress owns the cert-manager request for c2.aggtaa.com;
+        # this ingress owns the cert-manager request for c.aggtaa.com
-        # davical's ingress adds a second host on the same domain (for the
+        # (secret kept as "radicale-tls" post-migration so the existing,
-        # /server CalDAV path) and just references the secret below.
+        # already-valid cert is reused instead of re-issued). davical's
+        # ingress just references the same secret without its own
+        # annotation - a second annotated Ingress would create a
+        # competing Certificate for the same host/secret.
         annotations:
           cert-manager.io/cluster-issuer: letsencrypt-prod
         hosts:
-          - host: c2.aggtaa.com
+          - host: c.aggtaa.com
             paths:
               - path: /
                 pathType: Prefix
@@ -48,9 +51,9 @@ spec:
                   identifier: app
                   port: http
         tls:
-          - secretName: infcloud-tls
+          - secretName: radicale-tls
             hosts:
-              - c2.aggtaa.com
+              - c.aggtaa.com
 
     persistence:
       config:

clusters/base/apps/markdown-vault-mcp/secret.enc.yaml

@@ -4,21 +4,21 @@ metadata:
     name: markdown-vault-mcp-secrets
     namespace: mcp
 stringData:
-    BEARER_TOKEN: ENC[AES256_GCM,data:D9JoX2e6PcCXcf2GkssbQ3zdvIqmXzq2PoocsZHs1YFH1eKQ5kBANlUqEibNasyZfX2YKMrJ31J5s0obQFBHEw==,iv:IsvqxDWesBgaFV96Gea33/M/bw+sodNDaRJHkDCLuFQ=,tag:mf0uycj9d1MYaBSX9T9dxQ==,type:str]
+    BEARER_TOKEN: ENC[AES256_GCM,data:FWK20oliPFs0fnwdyGlrpXMK1fNIQVrm4c8uckguVZsQ0XZ8DQI2RdkkgUhuFhDdX49IpbcCh00BKEimMFTYCg==,iv:zuzqRw+priNTk7RLFFplEh8AcwAGydWkbG4ih3cb4RQ=,tag:ey+DdN87EOU+fx/SpJ4lgg==,type:str]
-    OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:xfo1Ik3xMlnqgVc7kTuADMnntE/cn+WDDKB2r1+a64p7Rwhes7FLhCj7UpjOC8LGX5Yr38uOrZSQ6+JH1huCOw==,iv:BXUeP1/VYsxtHHEuid1mpDlHoGFmanUuXC3FITPTiDU=,tag:D3gTSQDAS6pd6tOXOTrzKg==,type:str]
+    OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:yFxB/31nmrbM/c/83MR6A4PMUqeRzsi/LKTNxnyYzVU7rM7Kuiui/ej2jshlzB6mn4f9/Nx4HdmI5AAokyNWHg==,iv:rTNQChEtXd/VU8iw7Gm4qasPnUN2uYKEpizbcKFAn0c=,tag:/ano7eQRgMeDt5fXA6DdHQ==,type:str]
-    OIDC_JWT_SIGNING_KEY: ENC[AES256_GCM,data:NWPiFXeFGpl2GvZ9MiSavm4DUvjSiFT1K7ywtwiEEEyndfugozNLhnh2z7ZX1KpWAo6v99CSkA9rYERVyg0E7A==,iv:/DFgPsM7tfRAw3LI2Aqn8VjGNvUwmDoQ5Aqp6QRyk5Y=,tag:jZnxFXPacNKs3fe9n2WI2w==,type:str]
+    OIDC_JWT_SIGNING_KEY: ENC[AES256_GCM,data:k2YODG55k44v7fJi3Q7b33z9rSL0G8IrVbK0rf/MD6+wqhEKkhSZoMj3fGJKS0gG88SpfUITBNv3RGrveiTEZQ==,iv:GHo/prr1UNwJVyDl+6tr/Qn530jMT0B8BFOl2rIg3qg=,tag:ySRFXPvAo0AmGf1mQhnkTw==,type:str]
 sops:
     age:
         - recipient: age1kct5g7d7eus2hvdnmx99ewsrtz70lhlasxa25euqwdctqhwqqpxqz0n7gg
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZUWZqbXNCWEtuNHY1ZkMr
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuSDZ1R0RCYUpSa2ROQ0Fj
-            WDY0V3FDdnJJRklvcUdRR1VYSTdDZ3RSZWxvCjYrNWZLL2NvUjNYUWVCaGNQSVJv
+            cEZSekhLRUFiZFFiZDJnamZ3NkVzUU5rU1cwCmdwaUU4T2cvSnA3NW5DWDA4K3hT
-            Mkh0VnBza0JZNnRnRjNmMmRGK1NjMHMKLS0tIFdxTHR4U1Z0ZGhqVnBRY21WUHAz
+            NDVDQ3RUaVFoekRaeGYrTlhPMUoyelUKLS0tIFhIMXNsRFJOenhRa254RGhiUm5Z
-            K0o4ck5nczZzSUlTNEJVRjhaa3BRZUkKQYGifS0r9z8wCKU70WGky5BjLkuYuDXh
+            eUNsR1k5NHcveUNQdmM3a1FxQ3JmZVkKbKNs2sb3pA6iP1GFtq2Cl0FnHKKQmWJN
-            iDoZekixekhIPzVdqL3s9DgqUi39jTR/pHWzCIn7M6NUXYbTn5H1dw==
+            M5eJhCvhGopmI47H9stvZjXJrJJHgLin+cJSlRsNb5SP9xAz3/ywEQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:24:18Z"
+    lastmodified: "2026-08-26T10:24:25Z"
-    mac: ENC[AES256_GCM,data:roCqrT8ovfYWCycLrtIp46DOpP69WAdu6GwqfpUlt73JE/qnvukOLeXPAOUoncDRZ7kcywKxPGVP9O5PJ22YmupKVCY6D0BmZSJHD/NT2NyUVXJTjXTVYi6zVFenhWhVJM8RMBGXZ1n08G9B858EcMznm394m1vRgCB4omeH1pc=,iv:sZvGEuebILKWTAZ48GtC8lEiSeomYjyai6wS9MAFT5Q=,tag:JWLYq5y8u8yWpFYGDUvzWg==,type:str]
+    mac: ENC[AES256_GCM,data:/FRWhoghMQf/snWmV405HhdymYP0ZQiTK+KX/+Vnmw6YVV4lckIu0wab7fx7y5g7uui0II040tCVG5LeaLr1fGilEdJQW7Akc/v0QXC3dsh+DfDBle6l4gHaQqC4LVixpSSIMRbJt5+JU3+si1plUKfBKt8VKOtJrfR324I9SjQ=,iv:SmhmI9piU3rtB8Pn9lFOekr3ojwcH5l6q117hEx8f30=,tag:1VxkB8dCYx3YSiedzuvAdw==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/mosquitto/secret.enc.yaml

@@ -4,19 +4,19 @@ metadata:
     name: mosquitto-passwd
     namespace: mqtt
 stringData:
-    passwd: ENC[AES256_GCM,data:q7q6bZ1FbrcFSXP9/2IQYmci/YP0bZ+0fSpEbpKUa4c5U8Xk462gjIA34X5q2pEgglOhzIV5Vb+k194ltXbbETYgq+stu0umJ/w9LHk7Ekctg27odrp/yACTQTGmGJKnQBr3SXORZqO12lFen3aMvvwcXOTxqkQstv0K2F2w/uLZcL/54y+ZANb7/sN/nx3O3UfbnyHWsxsNNA8Y+nHKJAfHEIz2CKIHsK3gOXCHwdXR/srEjiUTUHWgE+gDtA==,iv:aHdOC491M5Tn+ZsLJfxpeZSV1mc1yufjEI81hjlkCGw=,tag:9pXihkRhtfbztjiedVmx7A==,type:str]
+    passwd: ENC[AES256_GCM,data:pNA3D0fvMFxHldsiqP7NVfs/9vYoxZJSxx/MLUH/KLHkjzo/zRqkQZ0+d5TH0Q97FLkkykoRp4UKBqBPzFVjmW57Z2HVpnGzj7whwiKDgIcMCsG04Nw5QmYWU2qkKPpq3T5bHzayWTHKOT21DonVKfvGjJdtsTpAGpCN1El03bueUevEdlV2q1cX/p6Sm5u525WSg/FpaUhT2jRrjVo8s7TOHBdH84tf6gzJiPP5rVnU9iba46jlHzOVRsdOhg==,iv:uNyRHMYa7Z8kP1+dmudwrPPSqDTA/eDvFsuony/hnp4=,tag:QRcbI2gYHuYAMqTFLyp5WA==,type:str]
 sops:
     age:
         - recipient: age1u236u5mzkzj72y4mfxx68gfqw0u0j6tdgkudnm5pdfpe7apq4u6s89jr2h
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvQzM1enMwUWQySzRYMnV0
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYWCt5NHluRmpQVktTUTZR
-            azZMZFozMGdWaVNaRUZYY2V6WXlGVzZTeGlFCi8wRG9pUVRRODVFbHY0YjViMlJu
+            dDJDR1V0TDJRL0F6VXUxeDF5QWYvcE5BMVNJCjRQQ21XYk9zcTFYTjBpbXVhelZr
-            Zy8rSDNRbWFwbUs5VjZ1amZjNWpLYVkKLS0tIGVtZkVnci9nQ25BYy95eDJLVXlv
+            RFQwSGRuR2lpSVZNUU0rREs5TVNHZVUKLS0tIE41L0xqWHgwQkcreVZWWGxqWDNW
-            TkVHVzVQc082RlVrZmR4UTY4NUVwMUEK4jIqPdk71W2CFjtOJBVd8pLAKo3anQwm
+            MzlkUm9IUEVwcTQrbk1yc0NuM0d5KzQKmPDJg9e6zyhz+ufqQa+gkb5u6+bWXW77
-            CoGr6pbDTy2EiDAgDGUU7Avc9FohyBiJWtykCO2z8jolu+0xMugj+g==
+            +xuFS/cy+akYJs6ReOpos9sD5dAYteyxEl7+vrTWrsOQ7ap7YRt4WA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:24:19Z"
+    lastmodified: "2026-08-26T10:24:26Z"
-    mac: ENC[AES256_GCM,data:SZO/oSnvQdTl2JaH72be2ajTiPdfMj51Kyy7xjo2byGYevMEebyp3IhqQdNUe/e0oA6KFfLjXRxHr67i4FtPFqpRxnqhLftfJlUC5nVynxGqcmU0ddiQXHYWAjtYOcbvK3gb59wWG5iRH42AjKbddcZWkiKNBvZgVrvGL0rtSHs=,iv:Coo1XM5Cy4POdkVY51dJ/oU8nM9aR2dwvt/OT6U52EU=,tag:v00+HH7SNHtE7vTZHwQiAw==,type:str]
+    mac: ENC[AES256_GCM,data:F4E7wz5YiG3fqplTso5WSbzPtDJJYLxpFrDXyD3X2SovTIwel8EZKm6Mv5ShJK+vyd+LIZnZGzPZABwIqEKm94wbGtQ+UF8C09lzftrCKfMiHxXS6bFJIxn3X5UIZLR6VFJ50GcOIf7FaIJNY5rrIuPNB3UZtCN0l41xNCqU/dI=,iv:uSpy7vJPTCIwm0l//wJxWq6SoQEekpWz7+4GK0MuXCA=,tag:Pw/qOjlSLa8BJT48BqRu4Q==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/radicale/configmap.yaml

@@ -1,44 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: radicale-config
-  namespace: pim
-data:
-  # storage.hook (the git-commit-per-change hook in the old compose setup)
-  # called out to a webhooks sidecar that isn't part of this deployment yet,
-  # so it's dropped here rather than pointing at a script that doesn't exist.
-  config: |
-    [server]
-    hosts = 0.0.0.0:5232
-    ssl = False
-
-    [auth]
-    type = htpasswd
-    htpasswd_filename = /config/users
-    htpasswd_encryption = bcrypt
-
-    [rights]
-    type = owner_only
-    # file = /config/rights
-
-    [storage]
-    type = multifilesystem
-    filesystem_folder = /data/collections
-
-    [headers]
-    Access-Control-Allow-Origin = *
-    Access-Control-Allow-Methods: GET, POST, OPTIONS, PROPFIND, PROPPATCH, REPORT, PUT, MOVE, DELETE, LOCK, UNLOCK
-    Access-Control-Allow-Headers: User-Agent, Authorization, Content-type, Depth, If-match, If-None-Match, Lock-Token, Timeout, Destination, Overwrite, Prefer, X-client, X-Requested-With
-    Access-Control-Expose-Headers: Etag, Preference-Applied
-  rights: |
-    # read access to root collection for all users
-    [all-read-root-collection]
-    user = .+
-    collection =
-    permission = r
-
-    # write access to own files for each user
-    [owner-write]
-    user: .+
-    collection: ^%(login)s(/.+)?$
-    permission: rw

clusters/base/apps/radicale/helmrelease-agendav.yaml

@@ -1,62 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: agendav
-  namespace: pim
-spec:
-  interval: 10m
-  chartRef:
-    kind: OCIRepository
-    name: radicale
-  driftDetection:
-    mode: enabled
-  values:
-    controllers:
-      agendav:
-        containers:
-          app:
-            image:
-              repository: ghcr.io/nagimov/agendav-docker
-              tag: latest
-            env:
-              AGENDAV_SERVER_NAME: "127.0.0.1"
-              AGENDAV_TITLE: ""
-              AGENDAV_FOOTER: ""
-              AGENDAV_CALDAV_SERVER: "http://davical.pim.svc.cluster.local/caldav.php"
-              AGENDAV_CALDAV_PUBLIC_URL: "https://c.aggtaa.com/server/caldav.php"
-              AGENDAV_TIMEZONE: "Europe/Moscow"
-              AGENDAV_WEEKSTART: "1"
-              AGENDAV_LANG: "en"
-              AGENDAV_LOG_DIR: "/tmp/"
-            probes:
-              liveness:
-                enabled: true
-              readiness:
-                enabled: true
-
-    service:
-      app:
-        controller: agendav
-        ports:
-          http:
-            port: 8080
-
-    ingress:
-      app:
-        className: traefik
-        # no cert-manager annotation here: radicale's own Ingress already
-        # requests/owns the Certificate for c.aggtaa.com -> radicale-tls.
-        # A second Ingress with the annotation would create a competing
-        # Certificate for the same host/secret.
-        hosts:
-          - host: c.aggtaa.com
-            paths:
-              - path: /
-                pathType: Prefix
-                service:
-                  identifier: app
-                  port: http
-        tls:
-          - secretName: radicale-tls
-            hosts:
-              - c.aggtaa.com

clusters/base/apps/radicale/helmrelease-radicale.yaml

@@ -1,78 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: radicale
-  namespace: pim
-spec:
-  interval: 10m
-  chartRef:
-    kind: OCIRepository
-    name: radicale
-  driftDetection:
-    mode: enabled
-  values:
-    controllers:
-      radicale:
-        containers:
-          app:
-            image:
-              repository: tomsquest/docker-radicale
-              tag: "3.7.6.0"
-            probes:
-              liveness:
-                enabled: true
-              readiness:
-                enabled: true
-
-    service:
-      app:
-        controller: radicale
-        ports:
-          http:
-            port: 5232
-
-    ingress:
-      app:
-        className: traefik
-        annotations:
-          cert-manager.io/cluster-issuer: letsencrypt-prod
-          traefik.ingress.kubernetes.io/router.middlewares: pim-radicale-stripprefix@kubernetescrd,pim-radicale-headers@kubernetescrd
-        hosts:
-          - host: c.aggtaa.com
-            paths:
-              - path: /server2
-                pathType: Prefix
-                service:
-                  identifier: app
-                  port: http
-        tls:
-          - secretName: radicale-tls
-            hosts:
-              - c.aggtaa.com
-
-    persistence:
-      config:
-        type: configMap
-        name: radicale-config
-        globalMounts:
-          - path: /config/config
-            subPath: config
-            readOnly: true
-          - path: /config/rights
-            subPath: rights
-            readOnly: true
-      users:
-        type: secret
-        name: radicale-secrets
-        globalMounts:
-          - path: /config/users
-            subPath: users
-            readOnly: true
-      data:
-        type: persistentVolumeClaim
-        accessMode: ReadWriteMany
-        size: 1Gi
-        storageClass: longhorn
-        retain: true
-        globalMounts:
-          - path: /data

clusters/base/apps/radicale/helmrepository.yaml

@@ -1,10 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: OCIRepository
-metadata:
-  name: radicale
-  namespace: pim
-spec:
-  interval: 10m
-  url: oci://ghcr.io/bjw-s-labs/helm/app-template
-  ref:
-    tag: "5.0.1"

clusters/base/apps/radicale/kustomization.yaml

@@ -1,9 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - helmrepository.yaml
-  - secret.enc.yaml
-  - configmap.yaml
-  - middleware.yaml
-  - helmrelease-radicale.yaml
-  - helmrelease-agendav.yaml

clusters/base/apps/radicale/middleware.yaml

@@ -1,21 +0,0 @@
-# middleware order matters!
-
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: radicale-stripprefix
-  namespace: pim
-spec:
-  stripPrefix:
-    prefixes:
-      - /server2
----
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: radicale-headers
-  namespace: pim
-spec:
-  headers:
-    customRequestHeaders:
-      X-Script-Name: /server2

clusters/base/apps/vaultwarden/secret.enc.yaml

@@ -4,20 +4,20 @@ metadata:
     name: vaultwarden-secrets
     namespace: vaultwarden
 stringData:
-    #ENC[AES256_GCM,data:TVJK6/rHcQhrTZldlBp2FTJ+YA1sEXT5AuMXXJQ2IY0ltLPxN8cxfloLdDEuYQHfUtzGHk4Z0HvQ,iv:zP9a6ibg6LsAWLMcttHNjgPWcWQg9s4HdZyS0JxIMTc=,tag:c+DTqM68+e30jz6QZ5bkFQ==,type:comment]
+    #ENC[AES256_GCM,data:shXBGZMHYLl1hfejHKnzmdrNWQ7AK9E20yBcaD8SiNNTyyA2B9jdDtOt5eBjb+mctZhUPNofQPH4,iv:g7NGYaYWYwW0g2Ysod/p+D6BgfOH6FFGRA1jh/AvIt0=,tag:ieZWOoCfO8Q3eHqCGXX5bg==,type:comment]
-    ADMIN_TOKEN: ENC[AES256_GCM,data:nyw2xSbK3M/+ksRYjfK2vGQpGYQfXUudfj0YUIy7duTP98LQxaLfWTyovip0JeI7YO7umZ8vH9aN7iPKDzWaVQYxObKqXop4c9lqOatg2seHHbwtyYh1G4tVYsPX7Hbz/BiY36fG4hb58Vr0pkxp0VExG5M2Vw==,iv:FG7WesrB2zFWqGvw1XJ5C6cTPBvAtgWYxjsWdlOdeTk=,tag:Cn2einme62teZSBI5h6I5Q==,type:str]
+    ADMIN_TOKEN: ENC[AES256_GCM,data:1DrKblYTk5P1eTVyeXJA3DMOMjedeMOViqCoxujb8CWi+TARlkLF+Bw8Oi4FZnl7GYTPOfBzWzEPrJOK0XuWP/FoFQyW/ZRWcrf2QVt0wBQrL8kQJXBl9JTdnAf6NnBmpWsXU+XhYD5wsR1TP/adXKAkppGT0A==,iv:gwV1UvtkPRozIOYcxyGSDQXmwIC+wmGQopsU57SFelo=,tag:e/clFZrX4qyRaqoWAeP4vw==,type:str]
 sops:
     age:
         - recipient: age109zta6l0cwpkxn5wek82kvauxn6yqrq80rsz4mvu5atdnpcn9pusuvnqk5
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPWG51MXVBRmhtQWJiL29M
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB3Tkl1eHBqSkhxSW9qZjhT
-            dVhqWkFWRFdaQVBMemJXVTFKVXd4NWhLVGlvCllOdTgrLzZRV29PVEJvbmlkdzZG
+            bklLTDl1OUN3cG1PaUJhOVdHU05kOXV2YnlRClZoajVBWjQ5ajNVc0Y2WlF6WE1w
-            SytSUndlNnVZa3Z5S3JDaE1jbU44djQKLS0tIHl5UDM1ZktGZWxnTlpkakJDbXVS
+            OUVuUE80STBvZmpyZkQ3NWxlL3AySGMKLS0tIHRSMlh0d29FUWV5eDM5c0VvOWJr
-            NkVlSEJTWGRjU3hjTHJONXpoSUk3dVEKyd7wJYlUyT+GjyC5kAw4TG8Z0K//lny9
+            V1NmOXNVT3ZhZi9FcmxwdWhpMFdnblUKJaMrzLzzpM0AfJcRsSor0CaopSRySbhI
-            LUl2cVjojvcS26DzM4tkh9d1I+Ixeg6pqpDvO550B0kX7xCioi23OQ==
+            MFuuuOEpFOgPZTf2r92i2wAq+aUR/yjIPlFEsyzlye80lrneWmA6dw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:24:20Z"
+    lastmodified: "2026-08-26T10:24:27Z"
-    mac: ENC[AES256_GCM,data:teR8A90fQMnIF0yCw4B706sO1McwzS9agnSbOB3z17Oesi4o/rB5H5S+KE4LXwLredyk8Pc7kMhg0XX1ePrV/KzMBIw3ckWmmR5RaF/eBt1o1V0qXe7Vyr9nTwqZ1QC/AIDeBKfZTIOzHINzEZl2pffZUANQ93NPzq6W8XYuRN4=,iv:yOeMGHVYW4SIeHWWo97MsAI1KuD2AZLFMdAd+jq8Mdo=,tag:AeH9Ag1yGBqwU1n26D4cJA==,type:str]
+    mac: ENC[AES256_GCM,data:jMK1KTPYfx85/j6UZ1H9BcKAjpHWHvJtAgTehtJmHYTdB5/lGltk2LTmqcVi40vTUnpm/CimxkKFRqcvdWl6WBOpISA0De4QBLltWgK2SLaoR9CgRSaSPgaQ5PydEZrIQB+1D2+/bK+PF7DKSdOK08YM/crny0Koc88JTESExEc=,iv:/cb9Trzuntwg1k+WtNjAmPYFWL6jeWoYGQsu1Psn64c=,tag:F9CcS9tdtqxaemV3XjBZDQ==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/webdav/secret.enc.yaml

@@ -4,20 +4,20 @@ metadata:
     name: webdav-secrets
     namespace: webdav
 stringData:
-    WEBDAV_USERNAME: ENC[AES256_GCM,data:1So6j3s=,iv:m349N8krx40gszI3BxkbwvcKrBCIaO3rOEmmSivZrQ8=,tag:2bHQSYRNQW/Bn4H+U5UDbg==,type:str]
+    WEBDAV_USERNAME: ENC[AES256_GCM,data:x0LrXqg=,iv:NnawbmxPSI5jAebXZzVf78x+Jj/CXjJaMmC/kzt0/hI=,tag:PWC2iP/I8Bs/4aBlKesDPA==,type:str]
-    WEBDAV_PASSWORD: ENC[AES256_GCM,data:lh19Vm1Q+UPgxWBDRVQuCMET1VrEf3GzSy/stJEpcmNiWA4eW3IA9UNY6W3y3mRN,iv:VOkdL7pXt+MwvqPd1lMDs3+SZ+cVpSZAkWISodZErEo=,tag:x0wHGWONhWH+WTgTOjCoSA==,type:str]
+    WEBDAV_PASSWORD: ENC[AES256_GCM,data://oV1i9snSIwfQmzmOgi/Yerj0jmBnOVVvinXb36+froLCThnt+HNhEItreuqeID,iv:yxqMqgHK7uJ8R/zF6GcsViwL7HL9cImT76/8kji1sgw=,tag:NeYcXbXbOgG+H4HHG11Q+w==,type:str]
 sops:
     age:
         - recipient: age1y8t9v56yuvskznddqfsd4yddzzch0yf2dutvvt8rrx6rjh5f9g0s3qeays
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5VE95VkxVRVVNT3UrWWN3
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0SXRXSmhlak83VUNVTUwv
-            Zm05aTU0VVIrWTg2c010T1B0Uk9ROUlHUlVBCmU4cExXT2h5eDA5NXBKWlVqUVNC
+            c09mYmM0SUNzYmNRUUFCTENVYTZKUXFaZjM4CmxoN05LZHdFSGtSRXBOcU1RT2Fn
-            RElBVkZUZEVlMHVWaFVIdThBbVQ5Y1kKLS0tIEZEcDNyM21KVGZVR2dzYlIzN1k0
+            N1JiNnpxdGN2NDNSbXVCYko4NWFYamsKLS0tIHVCZUQwbXdtdTFiSkFoVlJwNTQv
-            dGJVRXduMFlaN0hMc0ttM0JLcGlPeHMKpfzkjS2Jl7x6P/zrx+Z/mXMDtOu0ocIO
+            azJ1TjZNNnF2bjJDWmpJYlZlaksvR3MKsWb/4nVhZXk0xsApZJZQC68kIWrQdHvn
-            VeRY+KwhdHCqier6fgHXMEwBrXBm02UiGYl2eMyeOtV53Zy0KzE/lQ==
+            CMeDg4NBRJv7QY+knCuimdAu4211NGtJ35PakJ1+cKuPAyhKBM0GKQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:24:21Z"
+    lastmodified: "2026-08-26T10:24:27Z"
-    mac: ENC[AES256_GCM,data:+PhqTrn7lonm8S75pIdyq0N8A6LrIY6vrZXni8kLLe6YN/UDKbtl+2A6DMFUOQMX1d0RmNyM1A5i7CnRdTQuEduIexSAR7HhuKpyUdOZNo7g42dqLlfhSeIJORTUq2kWFY6tMQaqAToovozgG6VfLJ3S9/xfcNhN0CPZJffEG70=,iv:byPECUH4pTVbdxfzZ20m0jaDIPRXglEwe23t/jvy1KQ=,tag:RnY4i1y5xzN0mQ41HWGjoA==,type:str]
+    mac: ENC[AES256_GCM,data:di2Pkuax7UalP2zFoJRCQxK2Zmav2k7gmzUfFX4x7XIhY5yGPx7hvuY6Kx2L9h0Ve7/MHXK5dLQT382uEgt+fE4FAK1xsUZ+HKKlgD1XThKZqPx4g6woqmmHFeL7THujft3e4zyqP8iXo/TtRR1XRCrl7qJGzLJKrqPg7m2xog4=,iv:VSKOHPnqdzRmvcqttE5avXVV5IvqHmZJWBZ4W6zn90s=,tag:G/Qxpmy0D2E3ArCVUI9xqQ==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/zigbee2mqtt/secret.enc.yaml

@@ -4,19 +4,19 @@ metadata:
     name: zigbee2mqtt-secrets
     namespace: zigbee2mqtt
 stringData:
-    secret.yaml: ENC[AES256_GCM,data:sZAZ/JnQwOEcIBdf+Ha+G/qcfPdU86orJu9KiBEARpW9+UA3Gdz/8yrAriqp6YC36hlYPfMoVpIMbGUXXWfcQldLQpgvFONBcZq5lNP3EP0G+C1eyMu+8tyaYqGU50DqrvCQ/9Yowhpd/rIreANtV+VkviKIJFrvpKwfQLs=,iv:PWhCNK0W1chBCMsFZwtJ2c0tRrByX5hKem9VQXfbwYs=,tag:LfvXx8tbjTIm18OTPjpj4Q==,type:str]
+    secret.yaml: ENC[AES256_GCM,data:4spxGe4u6O/uKjEZFTec7MdewY5i+y7dAlMKTCt7ZSGos4qxCEkK5hSb7VOpdSFFsuYrf+HRlurG2piTsmDDkv4mMgeB31Ls3G/cLtlfesOAyH2Jlg9Lo0NgjjYtcHJ0FefifKYXky0lVw8fe5hcaN9YraDYGLxzpW9wqlU=,iv:Lj/rzMeydwr+lAW/nt+RuMFvlqZs/ABZKgivNCv980k=,tag:8r22FaYvMvrf8AcfCR2qjQ==,type:str]
 sops:
     age:
         - recipient: age1tu4xgfefvgdda0vn2thaqndq4p9tuydq2ud6qa98tzzgnff6749qnlcx29
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjVUZGd0U2eFZrQlcvRkcv
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaMjRaK1YzM004enMvOXVR
-            dzlLTFNhQlpzY1JqQXo2S3g5UmFkVUJxODFVCmQ3S0ZDa3ozaW03NHMyTUR2aloz
+            S0VyVTczanczZ0wyNDZTSXI3cklDTGtOL2pnCkZvQzE4STZETExFYWdDRFlUYVFK
-            K1lLL1J3WUxxZlBxdlhLZmpuZEdiMFUKLS0tIGhFby9CbXhMbVArcnJNTm5rbUZC
+            ZDgva21xRHhDNEhaaHlMWHlmMFBmR2MKLS0tIExUVHI3UDEza0IzRVBZV0Q1VzQ2
-            UXVHdU5aNk43NHhBVURuZnhzcDhtM00KqKteEPZ4OOUWIJgv7FaBUYvxa3MsPhBc
+            RDFVRHd2MTIvQzlnR0RsTldWRjZobmMK+o7tHztX+rVkbSPrIzfIKPADktz4IA3V
-            fRNODlsHTozbEKhpgoG7xKLXg7HlUAPa3X8kgyl8L9YcWKUuWAlHcA==
+            yHhhSuGy1aeplZA+oSkSeJ+q2qvlj9Iy7REKZCC9vWNAQk6B04/XeQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:24:21Z"
+    lastmodified: "2026-08-26T10:24:28Z"
-    mac: ENC[AES256_GCM,data:55ki1WZIC10dHZqfS3CbeDPGaxhz1oZyVedRmkqit+oKReheKBd0JKdzdQMqQc/eEZELBIgDRkG2m3S2n/EPrYLBu0tD/iRcs+9Jp0eec/qkIwssUtY4KpWt03yQSWdmsGPhuWXF+mN5vnBz7uU3EPcSXFTAFcFCBM6ZzM4khYk=,iv:vEifujA4MvUakUtqMsQmuKIeg9w1T8IPl7CVFZthY7E=,tag:0PqOXLjWWblxC2dJ0mAWYw==,type:str]
+    mac: ENC[AES256_GCM,data:QxJvmslWxcjAn1rPeaqItP3O5BaWDNEjY6gzQt+R77Yn9Md5zqxwTT1i7TI8HU8u2OAe24m+x5Da6ZzTcUHwnf/txW8Nqw/FiusWzZLZrCu6iHvztsXXwP3m+eCtM7oz5yMi8+D518KAkrW7aJPikfj0GopXABNRkYuN8shzE+w=,iv:yPlFUYW4RBkv+SErojBlF3ngDQbpsB8EYg8bQOfa5L4=,tag:hKfjetacdFN2iHZ2q1BpRA==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/home/apps/kustomization.yaml

@@ -4,7 +4,6 @@ resources:
   - davical.yaml
   - vaultwarden.yaml
   - zigbee2mqtt.yaml
-  - radicale.yaml
   - authelia.yaml
   - mosquitto.yaml
   - homeassistant.yaml

clusters/home/apps/radicale.yaml

@@ -1,21 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: radicale
-  namespace: flux-system
-spec:
-  interval: 10m
-  sourceRef:
-    kind: GitRepository
-    name: flux-system
-  path: ./clusters/base/apps/radicale
-  prune: true
-  wait: true
-  dependsOn:
-    - name: namespaces
-    - name: infra
-  retryInterval: 5s
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-age