switch to new longhorn-retain storageclass

clusters/base/apps/radicale/helmrelease.yaml

@@ -69,7 +69,7 @@ spec:
         type: persistentVolumeClaim
         accessMode: ReadWriteOnce
         size: 1Gi
-        storageClass: longhorn
+        storageClass: longhorn-retain
         retain: true
         globalMounts:
           - path: /data

clusters/base/apps/vaultwarden/helmrelease.yaml

@@ -59,7 +59,7 @@ spec:
     persistence:
       data:
         type: persistentVolumeClaim
-        storageClass: longhorn
+        storageClass: longhorn-retain
         accessMode: ReadWriteOnce
         size: 2Gi
         retain: true

clusters/base/apps/vaultwarden/secret.enc.yaml

@@ -4,20 +4,20 @@ metadata:
     name: vaultwarden-secrets
     namespace: vaultwarden
 stringData:
-    #ENC[AES256_GCM,data:1iy2zqCUdVLoHO6o+TRPdIQe8NQZ8JdPFVKKvCpNsNo/MH9gh0ALH0pGFp0cTISttBlaLAGwsteO,iv:wqUfrnaTXUUZZZD9jl6NY5zatSJy1NwTeWAyt0bVspk=,tag:JSYQu8BOwvPw7ItMmdlFug==,type:comment]
-    ADMIN_TOKEN: ENC[AES256_GCM,data:eRv0deLFXgqjZ+GoDF6YomX/hQSfaEzuXBegJ0aN+7dqrjC5kFsFdETyypV1DLjbohla1jh6487slnL1LPV7EQeEGpE9E0Yv/N1XiHTvJQV1akIVyYLsaT/c69ByAlVNFCXzPtNk+BZq1e9TTDLrlt5VtdEeIw==,iv:yT5HnkoPXtnqMOE/p2040Are0NIQQswGZ8v9jGp6/RA=,tag:1h/PgReAl9uU6NpUD2Z7Vw==,type:str]
+    #ENC[AES256_GCM,data:RvKI5x8D6+c5fTKlj430C8svWzED4XhOfOC7puf5rfwWxcpoqOKr0GqDCuES/omdIW6kcZZNOh61,iv:syL+WS+sEcnPNeU23RyA5F9YBI1v4n09c3VG/ypPxhs=,tag:wrWRpsNmbR3PEtSrqd0e1A==,type:comment]
+    ADMIN_TOKEN: ENC[AES256_GCM,data:B8k56akLv7bLEpkuAXUpz9vl9iBgjACqrO2jSdBR1oFwUgg/sH25oc4abPXpGzP/53CSfkOQYG1APGUEgmSdavwnGyh+N4y0/R/gHS1ccZ0Lx+o56D+8mYcwZDAn8qGuNctVsiQeFmU0Y1J1SPGH3mGXMR6wIg==,iv:2qYEo8gJfJgAll4l0rdAaxFbvRoUL2VRzKdWdHq5dF0=,tag:fK5PfnWVD+NLLylPOPbi/w==,type:str]
 sops:
     age:
         - recipient: age109zta6l0cwpkxn5wek82kvauxn6yqrq80rsz4mvu5atdnpcn9pusuvnqk5
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBmd2w1aldSOWxKZDlodVlt
-            Smw4VE1KamIxRnVXS1BRb0Q4RHJIZEcyNUdJCjNpYnBZajlKNDR3VVdzUXBrNEVp
-            aUdjeXBTUWg3bmR6SmNMOXdYbHpJSkEKLS0tIGRlNlVIYzNoTVB2YzdQVytXZHdN
-            TmJuV0U2QmhqMW5HVEZjNVVXaWRDTDgKFTLto4FppZxSzrGZVtFPQl2XJk0PqUWO
-            Ti2NL6GgvnLuslr6Yg3CQANh1BcuQgeczLxyWVG45daqJisL0ocejQ==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBaZzA4OG9VbW1BUmltaGk2
+            M0NsTVFWc0NxQnlVTk9panhud1Z1WWRJWkc4ClExeEFpbGVMZHNyNFFmTkYvODhB
+            R0ZacHA3aGpOa2FyMG8xaDE0MDJHQkkKLS0tIHNwUk9mUVFQMVB0anBoczhqQ2dr
+            eXNkTVVNWWpLc2lHR3QyVm9zNWhOMUUKM/3WlLaiMxJnqaC2ujLIYy0XWKAkMiiH
+            383GFTsKM4lmor5FOcKvKcYFmdEXQc5sanb+n4WUq1h6OYDBHyW3ug==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:18:03Z"
-    mac: ENC[AES256_GCM,data:nZJ3VUKb2vQUhODAVbYwZXdsdlv/brOgPXLrD6cmLkLTr1pDbl/00+N9lfJquDhW3buZ2qiDLo+i/x/jerihtvt+qbi8PfgpRvA7H9KEJakaLYqD8892Pm2ikjDbRAwAG3AMpikTlyv/a2OTXnXjCjz7m8O3FLcqAyo4t9a1+CI=,iv:M2bzP9tOTsZ2VIHRkhaF/I0XKiVYFfx++htYwn2b4OI=,tag:Pq8iQ4bi1uGBehZE50cx7w==,type:str]
+    lastmodified: "2026-08-26T10:18:06Z"
+    mac: ENC[AES256_GCM,data:Xkbtsi2y0vJ54E+Qco0+Vy1O3EOlDYPp2NIRx3Bo1e4mW2AMV3gP3IcXQCCctd4nKM/wSkh5MYWQhX4B8RaCYyJHhq4QqceVR98knOT83X90HheR3Fi92WxtlTgVl4mVwEhfm2VhpdMYaFzHKtJAIzSWdPqW0G2OOC4OpdQcDqA=,iv:eG8B68eXOv236Ot2oOwlbWuvLS1yP2xJ4KZXlWysBew=,tag:QCofmMiBP91PJ6dywoYUpg==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/zigbee2mqtt/helmrelease.yaml

@@ -21,7 +21,7 @@ spec:
       storage:
         enabled: true
         size: 1Gi
-        storageClassName: longhorn
+        storageClassName: longhorn-retain
       secrets:
         name: zigbee2mqtt-secrets
 

clusters/base/apps/zigbee2mqtt/secret.enc.yaml

@@ -4,19 +4,19 @@ metadata:
     name: zigbee2mqtt-secrets
     namespace: zigbee2mqtt
 stringData:
-    secret.yaml: ENC[AES256_GCM,data:GUqLRP9jsIjhk1VjRlBS0RGpcv6gFSV/o26hQ40pGXCeIsD9uDpGR6inADDR0shni0cfzqfqbUyBT1vBaGH1gaBg/QgzFaviSUZGVOZK0vl+8DrD1BMNCcVlNU3/arLrRyIp4a87CAh5cRjbfpPYlcNyi4f+6rsNn7D1uMU=,iv:/NmYgFuq+SWr//dsM2m/i2s1FjGeCi0/XAxANFlZiYU=,tag:XF6YWPGfQr5t63pVhOkphg==,type:str]
+    secret.yaml: ENC[AES256_GCM,data:h2v+W+jYMhFgFYc1hUMeJ1IhWoxHC95IYf7oa7eA+1TW/dkX2quLQhMnhJvKrqJ1KYDXGsjrg5FleJP2HHY5GErF4EYKG7btoHqyhegW6BIClewV51ie+qv7v6cLDoSUolD/I33efeX+DUfx3QZl47+U6STmlvuyaUxJxFg=,iv:aAcIMNv3wFbooKl0JUo2LW3OJXs/A1dGmIaWoxW+Rv4=,tag:JDHB+KqG/CjszjD/6IWWyg==,type:str]
 sops:
     age:
         - recipient: age1tu4xgfefvgdda0vn2thaqndq4p9tuydq2ud6qa98tzzgnff6749qnlcx29
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMR3RHQjlhL3YwNUpKRDB1
-            cnZuL0x4dkdxTm1nWnJJbkZhNDZXaTA4YVUwCkZtV2x4eDRrbktTTWZSZ2xtUnRE
-            UU9ISkVjdVhWSjZhZkw0aFl1ZnMveWsKLS0tIDNqVXB3clBJcU51alFUdjZ2YVV3
-            ZTJ1NDRUNGNINnY0OUVxN3VLUWJYV1EKTB0N7A3ZGLAO62FwUiuYF+4BXHknTDKl
-            FqfhXDqbj0F4rS216ISBVB7k4kZyM5PjlVUW8FDwIJYoZKRqdhBUWg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0eEdaalFIT1IvVHBYR1ZX
+            TlpGVTBTamw4SkE5Y01KYmh4NjBKZ0hoS0FBCk5VNTZSUUNVdCt2TzFEdFhsV1RV
+            cWVkNlVGR2J2eHhSaG93b08rUGNPVUkKLS0tIDVWQVIrdnlUaGN3TXFwd1IyQUsr
+            VlpNSHRPWEh0YzVkQldXUlVjTU5xOEUKANcu7Ydurb7Tx9VyqQTW8hhNEEVQDX/3
+            ioaeOVwkslk3wftioSuxyYGUN9lUQEpyYtLEcStM2n2NAICD1EqTTA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:18:04Z"
-    mac: ENC[AES256_GCM,data:amIh+6TF8ry59ToPNRE+eOUXh+gB42nMOMaRDcO4z1zGCbG3f2FP2wmfYanpGy09OJ6xnNXhQqpXh7/c30buprXXT0SL0d9VNqBwCQ8RGI3wD2BsK5Udi0TB70tuOETQlpdW2ADQXM3pN+NgNI9AhMy8p+Q+FGNVO7YIV7afAlM=,iv:VCBjHftr73XdI1JKP6Ix9/6b9mE7+0jAuvtz4rne4iw=,tag:scmtgGan3RY968v9bQ7AOg==,type:str]
+    lastmodified: "2026-08-26T10:18:07Z"
+    mac: ENC[AES256_GCM,data:HtNmHHCeg4/whs6kQFMNr0MUgwZV6BrZyax6hOTB0P7q4FkVfR20JECLZoMDNQ6TEfx4gx9ioshpSoY2OYZ1qSXU+fIp+Kdn9AqMTSIZxcC1d6ZzbOEEZ3zkfK2tCuPRpFqmvG1ossMurddyfnJhPn/kMknkDdme+PPOuseXwXY=,iv:45sCch/9jTC4e8hHPusGEv4h9Wsjx7SAAITBL73xPbk=,tag:xX5B1Hy/RF4U1G+KH1RkFQ==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/infra/storage-classes/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - longhorn-retain.yaml

clusters/base/infra/storage-classes/longhorn-retain.yaml

@@ -0,0 +1,12 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: longhorn-retain
+  annotations:
+    storageclass.kubernetes.io/is-default-class: "true"
+provisioner: driver.longhorn.io
+reclaimPolicy: Retain
+allowVolumeExpansion: true
+parameters:
+  numberOfReplicas: "3"
+  staleReplicaTimeout: "30"

clusters/home/infra/kustomization.yaml

@@ -1,3 +1,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-resources: []
+resources:
+  - storage-classes.yaml

clusters/home/infra/storage-classes.yaml

@@ -0,0 +1,19 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: storage-classes
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./clusters/base/infra/storage-classes
+  prune: true
+  wait: true
+  dependsOn:
+    - name: namespaces
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age