openwebui

clusters/base/apps/mosquitto/secret.enc.yaml

@@ -4,19 +4,19 @@ metadata:
     name: mosquitto-passwd
     namespace: mqtt
 stringData:
-    passwd: ENC[AES256_GCM,data:kutvqyWMze7n0dk1zDvj3o4l8aVDEbM3Aq/X7IyHJbPkV7zZx+wNvQhhegJf6GABIc/RC76srev96PEKl7Yeu+q7bxe04Y00Jj0fTMD8UsyDruEWveR8lqWcyoVS14bqD1IEgtaVkNg1duQmBuMLMSqE4cMCih69ZC1Usr0g/RrnimJ/o2pBhf+fdeWQ8MN4v189j6WO34hT8CxJnqKulhKis30WJo5y6CVmGP4GyCZ48h9rInjqBrVHvC14hA==,iv:s7YPPwUZFESnBeCublKelUxJrvV3WhcQLydEKi+Oih8=,tag:Sx2k818j69RZPB1iRCA8XA==,type:str]
+    passwd: ENC[AES256_GCM,data:iFrsCV8Sth/r5/EY5qAxeSmAG0gaKTqI0rGxeiSWb4NOvuOVCidSuDJucrQJnLieXOYmG2onjmeJcnyQBdMpROCw39/ltmOuOulGmJaOrDzFI2zSq5UJCYRPr+haernSOWB/CchNzL7ORUvJDU7PAmYyt7Lhj9cwI1hth8G3RAJpnz5P8ps//TpR8zjPLpG0WX4Tr/3gTEkKXb/BGgdxpJqY5DYdp5Xi6VUPa7eDU/YsJXNk5GJcGKAgYTlpMg==,iv:4rkdjhWsHTpcDVtoUi6KQV3HlDZmgeII+362uRKVlXo=,tag:dM1PDxLrCsiTq2ewRM8Msw==,type:str]
 sops:
     age:
         - recipient: age1u236u5mzkzj72y4mfxx68gfqw0u0j6tdgkudnm5pdfpe7apq4u6s89jr2h
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGT0tNN2pUbmppb1o0cWJj
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA2dUxBeTJJQUNpVjIzTGxT
-            QWg4Ti8xN1dQdUJzd3pLb1RMaGZWMHNTczJFCm9jMnFZb016VVFDS3ZvSGNMRHdy
+            NkV1NEVyWlJ0d0lWdDRITXMwT0RONmkvSDBNCjdxTjV4eDJoWmVMa2xnUW85RC9s
-            Uk5qcG81bExyRlRZQTlkRW16ZmdXd2sKLS0tIGJTWFRUWHdKOXpkUVJXVGtlYTNT
+            bG9KaGd2TGFncVU1UGFRUGdtMXhFQlUKLS0tIG5iUXZ4ak93clZOSEJ2TzBIcndK
-            YjFWM016eWZ3ZVhYNStJMXVPbjFybEkKrHd+cS0Y3b5K6/yuvv0Bv4e0+7nUKpa6
+            aG95VFQwQVU5U01uNnh6ME9Ebmovd1kKEcT1hmvEHv9NUEZrtDpEKJVD5PcYe4Ld
-            cBIVxmL/b7lkoNI2xpS2iFw4zyq9yM1oZM+5OVex6CT63ZmS1suvVg==
+            2p3YXcgz+9fF6nTG4t8TvIsCerAFAd/Z+45N+sMLVorH3uM4984ezA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:19:55Z"
+    lastmodified: "2026-08-26T10:20:00Z"
-    mac: ENC[AES256_GCM,data:pon4+5BjCEYz5peGuUD2oL8+rLYOLLkFY7dFxryOtkpVQAOv16lxpi959Cf238fgA0iUNoM6Je02mP6wU2gzcBgbddI5R6MQFj5JBf056JiOueifu1ErogZvVkmT/YIJiTaer4cHK27nEBn5PoWBYslioKORCW9gGiKydvp0uOU=,iv:uZ8OF54Ni0zojXhX3RVZefMATEQ5zA4/AuU2fnzI61A=,tag:YANt+m6Pdoo7RNfPrjS7sw==,type:str]
+    mac: ENC[AES256_GCM,data:MCFVN/fZ3DqqZ9ee4lyzrIX8JQjXT5sAX3r8QdMnJuYpzueliHclfUydch/wf2BAfNI4niprd1Svy4fk2TTTHuojpa0C3zPGxMZ3XmJWIAgRaBe9a79lFcVcLT2cxZRvDzIXjoyy0+SqSpAzvdOibSDBlccYTncZPLE23HfsW2s=,iv:n3TCYKAIMDDXqrQyVvEuyI+LfRfjvT/D3ltVpuu6PFs=,tag:Ba7jezhi6feMxaDsHtQQ8g==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/openwebui/helmrelease.yaml

@@ -0,0 +1,71 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: openwebui
+  namespace: ai
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: openwebui
+  values:
+    controllers:
+      app:
+        containers:
+          app:
+            image:
+              repository: ghcr.io/open-webui/open-webui
+              tag: main
+            env:
+              TZ: Europe/Moscow
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+              startup:
+                enabled: true
+                spec:
+                  periodSeconds: 10
+                  failureThreshold: 30 # first boot pulls the embedding model
+            resources:
+              requests:
+                cpu: 200m
+                memory: 512Mi
+              limits:
+                memory: 2Gi
+
+    service:
+      app:
+        controller: app
+        ports:
+          http:
+            port: 8080
+
+    ingress:
+      app:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: ai2.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: openwebui-tls
+            hosts:
+              - ai2.aggtaa.com
+
+    persistence:
+      data:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 10Gi
+        storageClass: longhorn
+        retain: true
+        globalMounts:
+          - path: /app/backend/data

clusters/base/apps/openwebui/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: openwebui
+  namespace: ai
+spec:
+  interval: 1h
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/openwebui/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - helmrelease.yaml

clusters/base/apps/vaultwarden/secret.enc.yaml

@@ -4,20 +4,20 @@ metadata:
     name: vaultwarden-secrets
     namespace: vaultwarden
 stringData:
-    #ENC[AES256_GCM,data:ApAJA3Jr8WmhuYQsZ54OndzDE1LqMKw9wtVRlS0n+Z9dduyZ7l9v3RQmvTuZ7zFkuN/bhBRI+muC,iv:zW3iKbfxc3kwGZXAj5FYv14BVL1zR5aSRRr+OX9ld4U=,tag:6EHYveUVlmK08TSM7jXyXQ==,type:comment]
+    #ENC[AES256_GCM,data:9v505Xl5C4RYRSuTwZf6DXSQziUNvmGwQjbfQMvxTdQmIrKke9fRQ2IQ0iZYSBNTeh7a4kv2R4dm,iv:uS9tD47cCsYeyZ8ifp3PLtAupWHj+CKzTU0cefyA4Yg=,tag:8kcEKYr8inKGKolFAH9rpg==,type:comment]
-    ADMIN_TOKEN: ENC[AES256_GCM,data:Mu+MWt6Yyyx1upnYgBcx92FDyi0JllPQ8I+F2MAdPgw1nrNDNVO5yJXlL4LpsnBpQnLEcbKaaKdV5DPFGUCex8ZNTBZzK7iaZ2MWxXWYmzZLMiF/2/hbKC6QiIaAieESIWFPg2LDTPC1Qy0FIBu+egxhpvGioQ==,iv:HjyDSx8suUJddbENeHArGpadcr8snv1dEBhARsmCx7c=,tag:8RA5+ebRiunYKQqtFdpw2Q==,type:str]
+    ADMIN_TOKEN: ENC[AES256_GCM,data:LHHumyfnGfN02KyaoW5KmXSiJcGRQ77PT+kKC+DbceF1o4ZSTOZdBjOTXPv7+Ya21vemsDApR6qprNpvfSCug97/MiG/Vb0YQnfaBwEfdr0xqmOahy05ns3T6MH4RUYD/5NuOMtV01smwDZ4ojTrzM1nxKzycw==,iv:aud9IgBGR+4oKwpwZ/XtpVMGam8AKsAqov71N9inE04=,tag:Dj/9eceIAwHD2h6th8bpkw==,type:str]
 sops:
     age:
         - recipient: age109zta6l0cwpkxn5wek82kvauxn6yqrq80rsz4mvu5atdnpcn9pusuvnqk5
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBabTlKaXpxV2NLS3hjTTJL
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0bUVrSmY3c2lMdVhtK3lW
-            Q3ZVL2lhZnhqc3lWMDR2QlQwMnR6K1haT1NnCjZVZGtiY2w2WTZPVkozRUJUeHdp
+            eFJXNHozWHhzSldUdjZpUk03Y3plNTc4Y2tZCjVkVVNISmRQeTg4VVpWdzhVNkhp
-            UThreCtmS2NGU3krVDVxa2Fwc2RNVkkKLS0tIFg5VXBGWU5mRWE1VVNuT01LVWhx
+            cTFHRlFKb0h4SCtDV0UyZldMeHZMM28KLS0tIDZpTUNwdGhRY3JzQkhTTXhkOTg4
-            UWhBa2d2bFNlbXdWTWNVMHRkcTViV1UKb+zaS76xpPqBV+xaSuf5dvos9Mgjmc+q
+            b1JxbFkxQnh5VlNVK3VsOXhXOU5vVEEKeUMiBOafirrh6Svqpj3l931Reg8vv5MF
-            NmDVy1++oZhieEPYrEtNWbnE8ivrm2C2B8kxeSSDxS1V6T5K6oQ/VA==
+            ot+cjSzRYkT+zr72JhYC/Gd9ur/nIl2bfD1WO9q6Ku46BqtaY/zsGA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:19:56Z"
+    lastmodified: "2026-08-26T10:20:01Z"
-    mac: ENC[AES256_GCM,data:Fjb6VrzURQWtKdmhQh1b1uFx/I99AgJ1u8hSORMaA4oaEv2WuS00vxE7lAsk8wGcPdFzsLitlwhgP+8hop5pXebPZM6SaBWZ2Ib8Tvn8KFWianSTgYN7rAA6TRv0doIi0qBlyHowwq3TMSjCwMHIxc/M1iDYe7UzKuKuhUcvnC4=,iv:tB4huBMDOtgZBAAjw/nERHu9+XwwGZtj/qywHZ6vl74=,tag:QSBI14/0S7+Fm0M3Z7jNMQ==,type:str]
+    mac: ENC[AES256_GCM,data:T5jxNgm0lL0eDkAP7MeQa96VKqmXGMWAAJfuFVtyUoZFUyJUgaThPS2DkhXotXsr3Qh0t3BGRWppGPzhVo5065mu9xWO9OrHtIj9i74bjBHVnLkZ+CZECG92h1jT5vRdttnV42ciIkCr14yMRLgj6UaIYvO0U7oIg6AXTrUs1/U=,iv:zlxH4srheBj9kr0jx7AfJS1TwQyEcke5u1MiJEKBa6U=,tag:xsfaWI/LStHnRoplfe1wFw==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/zigbee2mqtt/secret.enc.yaml

@@ -4,19 +4,19 @@ metadata:
     name: zigbee2mqtt-secrets
     namespace: zigbee2mqtt
 stringData:
-    secret.yaml: ENC[AES256_GCM,data:p64ZCqagY73zhGeu6r60TZFPmOeB/oYM29BJ2MhsXNfQMmLtJPUBDiLR2PM7RNyj1ROkDmHI/d1tt7Qk7NsMja2L+CJK8b/hYvPE1xScVnLu2q403su4yh8o2LjeZqrR/Gtfdxk8iBIAt+482d/u/YyQtxb94OiIqjTZX94=,iv:6HsmHbF8alAp4dIwvJTuwLoh0WWIlnhCWx/Y9yNWtJk=,tag:8CtpelyCKChDl48QtJD/rQ==,type:str]
+    secret.yaml: ENC[AES256_GCM,data:E+bo5TmVm6LkS262kei72UBEgJYdNayVZHBEtYGzfQPQ1myEj+xDeBQ2p0Rb8dFckxKJTI+BmqXF8KmIRhiO8XiYi75wPbPJEJiAOtxSax9Vw3EAJatTR5Jla1/86qHGeQSzeIaUMcOKFHQh7usLuYIdg9YgF2rx+8yy2sU=,iv:+M+T/J6AsOc+tySpXvF/gwAwui3p+CFvA4lLYE3HkXA=,tag:XQ3stgvsIV/iuNhdWOAHzw==,type:str]
 sops:
     age:
         - recipient: age1tu4xgfefvgdda0vn2thaqndq4p9tuydq2ud6qa98tzzgnff6749qnlcx29
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPeUFHR3ZnRndjVitOWGZu
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6Z3RyNzFTMHpKU0NWT0cw
-            ZmhlT3hMRWtYWUUwbnJ6aTlPbjBCTUR1SGpnClRFck8xcUVHNzZLSnltc0F0eU5F
+            eUUvenRQcXB0R3o1NlV0akRWUTYvei8zVngwClNNeVdkWGZYaU1JWXEzNWsrQmhY
-            eDhoejZGcFY5UzFHdU5VOUFZU2lvV3cKLS0tIEJZN2tFRk16UUEvWHVnbHFzMkpr
+            emJ3cWlHbG9SNXVjMHZOb2JTLy9VRDAKLS0tIGZiMHVzT0RpSHBEcW9RODgybWg2
-            RWd5N29LWDl3MUhTb3RVaFAvRXZBYW8KcwKvMXBukVp7zp27r5AxRPqaPwlOaQWl
+            SWpLd2c3clBmaEh5VGhsZU1DZTdlb28KNPqYuuWZ4NZQkS2miAhoYnxmsLBPK3s7
-            f01z+AVWZo47QzXOu2LX5qpEz2px+U4U7DI5x63lA6vy/Zk/pU58lA==
+            omkT7HOEn1Zb3EIf/xE6s0dz/34paj1tCJ13kkOCZRIgZ5N9AqQ80g==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:19:57Z"
+    lastmodified: "2026-08-26T10:20:02Z"
-    mac: ENC[AES256_GCM,data:58tKx4giL01Ka6osaM/AAXMGSsi5QTxxLhhCUlSz31oy7LG7D+0/B0Wze4/joPPTCzyEuEpIw4csV2P1b82FHz0QoX6if+u+09eL1gqh1NFDsXznBIyD/QMb0rQkn9xatjJq5mjv4uSanEW4r3LkRB8fmpnajTPu7JzmF4wCDHg=,iv:aIJvhfFWg53tbbBGp4/3Irt2UmULgUSJ86Y2MUusUkU=,tag:dsS+EQoT3nYB8Rs177d/tg==,type:str]
+    mac: ENC[AES256_GCM,data:ylDJlIblgXrm++7BZvrk9r05sANpx5xw8mc2Uyf+J5T5y0BvbxCdx/Eu4DWqznG3OS1fnepUo/BspjNoZZq6hNHPxXlj7gZsfmyg0jtJ70tfS3qwn9hP57BSWPdnQZTeS5DEcc+0JeV8pvP/+VanfI/EruF4DiUklDrT/KosLZo=,iv:1uHCAVhjonVCMU0nqf2o403P/slgySkgxkqVIn5yokI=,tag:ierkWD6RipElKdCWeUZsVw==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/namespaces/ai.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: ai

clusters/home/apps/kustomization.yaml

@@ -7,3 +7,4 @@ resources:
   - authelia.yaml
   - mosquitto.yaml
   - homeassistant.yaml
+  - openwebui.yaml

clusters/home/apps/openwebui.yaml

@@ -0,0 +1,17 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: openwebui
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./clusters/base/apps/openwebui
+  prune: true
+  wait: true
+  dependsOn:
+    - name: namespaces
+    - name: infra
+  retryInterval: 5s

clusters/home/namespaces/kustomization.yaml

@@ -9,3 +9,4 @@ resources:
   - ../../base/namespaces/metallb-system.yaml
   - ../../base/namespaces/mqtt.yaml
   - ../../base/namespaces/homeassistant.yaml
+  - ../../base/namespaces/ai.yaml