nfs-ganesha

clusters/base/apps/markdown-vault-mcp/secret.enc.yaml

@@ -4,21 +4,21 @@ metadata:
     name: markdown-vault-mcp-secrets
     namespace: mcp
 stringData:
-    BEARER_TOKEN: ENC[AES256_GCM,data:m47vSUUyGlHhPqpZuEbwB3/Hy1PKWzaSNprN0wp+tB4uzDVlIKbhmR0hwX+GgOOjEXCie8fUBH7Iczmd+cYwgQ==,iv:yYw8GLIxvIntwMmY/U9vIJCC6Am8rBCJ1ot+y9ZMn/g=,tag:wnQvAPj90Wc6GpLNZKIf9A==,type:str]
-    OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:mTi5/uS9Xj8cvCm40uNylFQ+akuS6ZuUoZoUtprqC91Xd84S626uly6jKuMglvIebUmVXkQgWUdIhKTlaT3XtA==,iv:aubYeYNvY0ToLH9O8gRPaZDDKairPtkntnQfn/ln6/U=,tag:2vFXRUMI5hjXFXZFx3rzCw==,type:str]
-    OIDC_JWT_SIGNING_KEY: ENC[AES256_GCM,data:CJ4hkQe0PmTqI93Z2Uw3YIusq7GLMjVvGMX3IiUK5VOgXXTK/NQ7uIHX3Oxwm7n6EFiORtG1vz/91XmEKBeP4w==,iv:7CA6f/xUGrwp8sdMAeSE9RCu/aXVYzYnjS4wAoAKgHA=,tag:1jIMyq3h9ND9w37xP8kEsw==,type:str]
+    BEARER_TOKEN: ENC[AES256_GCM,data:Gt9edPM2L1VLJpDNNjLTzduCC3fG2TW5OJyy65+qM6pd5eQ9coeNgP2/iW9fIJPeZDWBjG2H2VQka23S8hur8g==,iv:aq0UKDpNEno6bJwBLIO8M7qG/+/u+oZcbTUAEXUMPd8=,tag:IrKw9Taat3cROj1yKgUGzQ==,type:str]
+    OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:JZJwr+SrhQBWgTt/7f5wv9s00ii41OVDM57BN63CPSu4Q+oSZJ2xB62HRoSpiv9MWgr/4ilbnHBnoB5jEIozgg==,iv:FBCv4iANydeZRI+XeW1Oy4tInTCbSB9P8Dm8LgVvUdM=,tag:m2LxhZIiJHX+rM3iCFE8ww==,type:str]
+    OIDC_JWT_SIGNING_KEY: ENC[AES256_GCM,data:R9gKAUFKP7KryWNZR2BRu8RnhI0Y8nZwIhBeUQTMTAEEjGPzp4zsSIZDw8J/12CDhTGK/6pZWiHK8uzrgfQZ+Q==,iv:CUscC/A56WkSxda2FGEN9DJRwqSWVfMT2HUmdx20urc=,tag:o03Q3CbZ2OoLDUOVXy1a4A==,type:str]
 sops:
     age:
         - recipient: age1kct5g7d7eus2hvdnmx99ewsrtz70lhlasxa25euqwdctqhwqqpxqz0n7gg
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQNXpONGZCdEdLa2dCN0ZJ
-            VDBubFJSYUtFcWovODFFQjNPYkU3UEpCVlR3CjhHem0xM2pXVlZsZmtNN1JaWTJr
-            ellYcWl4d2ZlWlFVVGgwbi9JTGVKNGsKLS0tIHZET3kyUmhxSmR3c2swR2JBU1Rm
-            bkdFTnhjdko3bXFQM3dDb0FoZGM1V2MKia7n87yZP9LKoZyBoxHlEj+j9M7eS/zE
-            iAlxJ8cTNakO/v1bawvitpznGbs+sJpyCqoZnSnoyNOnHdbPUyy1Hw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAyRGVRWU9yMUZ5dlNsVzND
+            Z2RWNjBlR3Q1QyttOEtqQU1lRWdsYjJ5cENRCmd6aXFHUU9VeHNkRjdZMGk2K2dz
+            emJ4ZFU4M1BRN2hpbzhZOHd3cHMybUkKLS0tIFZxbTdqY2RmM1o3anUrTHhCY1U4
+            bWQ4UEVack1WdHBLNGt6Mk16YzlNYjgKCZQMsyKwirLgVGvRfOs5RTqFaARTe4G0
+            6wu/wNi1+Bk7A3+BZcwR/SmWNlg+3uUmdXnKA2QCYR9Y73FMsgFF+A==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:20:57Z"
-    mac: ENC[AES256_GCM,data:TKCNHJw8RiAeDZw7pMsltlrjPrwnANTQxb1ol6puSLZJDIon+HWQdRs19+OcQNYavOiLiQz5Uf5A86blcwDgi04at55EY/1N5KYi31UH+SiTrvKkzU7s5UIMxgY7HDmeuw+C16s7W49PK7tz6ZPN5nX6j+FYeEmxjTZbLENoXRQ=,iv:SZjSFeius6ua6nBhty32BnHRd1Rj8Ge/5nkM+L0DeRk=,tag:B2mZKkTjdNWQPqkBIJdwvA==,type:str]
+    lastmodified: "2026-08-26T10:21:04Z"
+    mac: ENC[AES256_GCM,data:IMiGc+HLGGlSFWOi0Yi4l9EqiW5iMB96JZ9ev9m99038vRAp/UJ+R/1KsiwuZSAHopr4meeCuqQVSk1KWCVY1MqzLZtBTmTmPbQ4aFW1TA6yGy1OlhrFK6pzqQuXjI5YkNHRZ4eifdN/wd4kj9oeJP0xqlSJfXIwbuO+BDDEEOs=,iv:xhToynapyFgvORGVJgM57FVespcsDrFzGJ4ZGsuqq3M=,tag:GtpwC0jaN0wEdmoF0Anreg==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/mosquitto/secret.enc.yaml

@@ -4,19 +4,19 @@ metadata:
     name: mosquitto-passwd
     namespace: mqtt
 stringData:
-    passwd: ENC[AES256_GCM,data:04FDYPYojJhNPLf11IbDuOX7+valzgHqJHEGxLmePuMRuoiE6JBKotyBEtMmrhD/YYSWhPJdAP6/lTfBB1M58PhsbYl41z44yxgfCkJ6gudtAw3Z+bjlBafeymdIbKKhM3CAG9cdRtNVhewF82+VY7xmzDbf7+qkTzTPPEy6HZwrl3dpSnO4kyQwciLwqvjpSkoRqr0Uh/k4IyrMmh7U+TcCJhMzLT/51pCTtTz37k1Yqo+zVvO2huBrY3SFQg==,iv:A5cJ71eUxftrNjsSF//+qUakG1hGBR6waNHXuCJX8s0=,tag:+REqZPwV74sgJY6G2VhMcQ==,type:str]
+    passwd: ENC[AES256_GCM,data:8xkJh6V/C14AmG989oRA1B+YTFlK4/502eNLa7rY+SZ2zqI5h1Pn5tCQdKjfWpMWZygsHQCWN89aZBD8nq0td1ZAARchGQlmYq/ZF/iKfD7bxst10n/La9rvuEVXPdWDpFz196MAc9P9at3Dx/doBVeR86OywoD5CYKyioFt+Lnika968WDWpdwCDfE8n0YaRKgRkzZeSq6c6yqbNPBuWeWevLFgc+I40tJSxea1iYJgWzGRgrLfLCDZoqIQPw==,iv:dPsPwoYJvrdVHmD/vqpWYBHxvuu/OZ/I3L4HwEcP6nE=,tag:54ed7f1nBckZKivILnRp1g==,type:str]
 sops:
     age:
         - recipient: age1u236u5mzkzj72y4mfxx68gfqw0u0j6tdgkudnm5pdfpe7apq4u6s89jr2h
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2VFBRUGZLRXBiSGloMEpy
-            SzNiQkk3UVVCVE5IKzY3VnduV0VrZG9ZL21rCk5iT1RpcmJTdXdUbWd5R0VFMmhL
-            anVVcUxsay9rWnB2aDgyVWRXUmxFWlUKLS0tIGlCQ3JVOVZ0am4yYzlHL29wMnhJ
-            Q3BTbXhQNmRSK3BqSklQaHRMa1ZxTjQKoqOhZaCHo1SDMmmLzWOMKt2hgL1my7Yo
-            /FFp59xDgUOnl30b4YLkCiNV6Wae905eZEn5M2jEFkR5EvMv64WQfg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtMGFTVnZMUXhPN2dma0hD
+            d2d0V0JKV3MzR0FwQThrT1F3a1VuRVpGZUVNCmE1aThvaFU2ajljc0hHL1IvSGp5
+            dmZmbW1UT1dLM0d3bk9qeEFENUg0dFEKLS0tIC9zYjh0d200bGpDRnJjQlNZY0tJ
+            aWpVYVBCaS9sYUdPUTFoa25MR1hyYlUKxKE/w5scwHOOAZv9C8HUpiDdCH8zaoU6
+            ij/hfuIpzROnj3WJpY7O91Pc9Jv20dKzzwURFJPm+JvR8uRPpPdUCg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:20:58Z"
-    mac: ENC[AES256_GCM,data:JWQMopO87FJtzUWWa/npFR7D2rkVYsbOkefkN0RAL5o8odrjoEL2CEH2MRMzdYpSS1h/TWT7C3IdJT/fjWNFPpJxJiXetqoXXtQaF1/YukS+tBCr1KEzR9AqNtybVF8X1y/cB27kHakVGe4iYU+mz1Nl2VVbPZb0YhHuweq8grU=,iv:Ty4dZS8mu32xyAdG+laHsjSU0lq/sWQxo8MnwIaurvs=,tag:VkyT5vpxcc3SPBKRUbO7LA==,type:str]
+    lastmodified: "2026-08-26T10:21:04Z"
+    mac: ENC[AES256_GCM,data:/lA/y4rIUN4laj6C9JMz6b50vxynlUvvLBvF5aFXI8cQOAHGdPqW9vkPHKb9M2aAGznTIt3H8go+t6M1acpMiMkQTfc0SICe0Ui2fjcZN/wxGmondWnJC7labrTC6pxDNyzAQquSsCpRW/hlNUjuVR+Kb0358PBA9yIDCxh46/c=,iv:id2ysv0+XW4Jg3HJzNYuwOh9O1isAqaYcQpzu0uivWQ=,tag:h+WUHlvUWVDbd8LrEBIHIw==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/nfs-ganesha/configmap.yaml

@@ -0,0 +1,51 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nfs-ganesha-config
+  namespace: nfs
+data:
+  ganesha.conf: |
+    NFS_Core_Param {
+    	NFS_Port = 2049;
+    	Protocols = NFSv4;
+    	Fsid_Device = true;
+    }
+
+    NFSV4 {
+    	RecoveryBackend = fs_ng;
+    	RecoveryRoot = /recovery;
+    	Lease_Lifetime = 40;
+    	Grace_Period = 50;
+    }
+
+    VFS {
+    	Link_Support = true;
+    	Symlink_Support = true;
+    	CanSetTime = true;
+    	umask = 0000;
+    }
+
+    EXPORT {
+    	Export_Id = 1;
+
+    	Path = /export;
+    	Pseudo = /exports/shared/documents;
+
+    	SecType = sys;
+    	Protocols = NFSv4;
+
+    	FSAL {
+    		Name = VFS;
+    	}
+
+    	CLIENT {
+    		Clients = *;
+    		Access_Type = RW;
+    		Squash = No_Root_Squash;
+    		Protocols = NFSv4;
+    	}
+    }
+
+    LOG {
+    	Default_Log_Level = INFO;
+    }

clusters/base/apps/nfs-ganesha/helmrelease.yaml

@@ -0,0 +1,114 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: nfs-ganesha
+  namespace: nfs
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: nfs-ganesha
+  values:
+    controllers:
+      app:
+        strategy: Recreate
+        podDisruptionBudget:
+          maxUnavailable: "0"
+        initContainers:
+          mtab-setup:
+            image:
+              repository: hectorm/nfs-ganesha
+              tag: v10
+            command:
+              - sh
+              - -c
+              - cat /proc/self/mounts > /mtab-vol/mtab
+        containers:
+          app:
+            image:
+              repository: hectorm/nfs-ganesha
+              tag: v10
+            securityContext:
+              readOnlyRootFilesystem: true
+              capabilities:
+                drop:
+                  - ALL
+                add:
+                  - CHOWN
+                  - DAC_OVERRIDE
+                  - DAC_READ_SEARCH
+                  - FOWNER
+                  - FSETID
+                  - SETGID
+                  - SETUID
+                  - SYS_RESOURCE
+            probes:
+              liveness:
+                enabled: true
+                spec:
+                  initialDelaySeconds: 2
+                  periodSeconds: 10
+                  timeoutSeconds: 2
+                  failureThreshold: 3
+              readiness:
+                enabled: true
+                spec:
+                  initialDelaySeconds: 1
+                  periodSeconds: 2
+                  timeoutSeconds: 1
+                  failureThreshold: 2
+            resources:
+              requests:
+                cpu: 50m
+                memory: 128Mi
+              limits:
+                memory: 512Mi
+
+    service:
+      app:
+        controller: app
+        type: LoadBalancer
+        labels:
+          loadBalancerPool: nfs
+        ports:
+          nfs:
+            port: 2049
+            protocol: TCP
+
+    persistence:
+      config:
+        type: configMap
+        name: nfs-ganesha-config
+        globalMounts:
+          - path: /etc/ganesha/ganesha.conf
+            subPath: ganesha.conf
+            readOnly: true
+      export:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 30Gi
+        storageClass: longhorn
+        retain: true
+        globalMounts:
+          - path: /export
+      run:
+        type: emptyDir
+        globalMounts:
+          - path: /run
+      tmp:
+        type: emptyDir
+        globalMounts:
+          - path: /tmp
+      recovery:
+        type: emptyDir
+        globalMounts:
+          - path: /recovery
+      etc-mtab:
+        type: emptyDir
+        advancedMounts:
+          app:
+            app:
+              - path: /etc/mtab
+                subPath: mtab
+            mtab-setup:
+              - path: /mtab-vol

clusters/base/apps/nfs-ganesha/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: nfs-ganesha
+  namespace: nfs
+spec:
+  interval: 1h
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/nfs-ganesha/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - configmap.yaml
+  - helmrelease.yaml

clusters/base/apps/vaultwarden/secret.enc.yaml

@@ -4,20 +4,20 @@ metadata:
     name: vaultwarden-secrets
     namespace: vaultwarden
 stringData:
-    #ENC[AES256_GCM,data:H9rFSRH7CRcRZuXEJaAWZH9xDTPYu+PM8uZcRFsBp9yQmvzGksf/AMa4LJpmvFbvz9Rp1KNHOSVq,iv:je8ieHhQyvs3RQ98lC8Cje7BBY/UaY2jSEsPhH/e558=,tag:UMG8Q4Y+whSF5/prhLTYXw==,type:comment]
-    ADMIN_TOKEN: ENC[AES256_GCM,data:f4gHGBtsv0XEDlhksP/yZ82F2/EQeHcb7G01/XcuAc78SO3NwyuiaLKvqfP05umOUEE0Z1Huw75fYnPHqcaynWZAoexjE2u8Ax2bHeW5rvhh9K8EvzuIRkI0CUD+ZyV4uY6XNbVGZBJyJ/rIbq8PUNri8fThIA==,iv:S7/mqJK3nqdyPjGp+X6tebxRCUiNiXP9ffC0rJkFHjs=,tag:VXNGbUggLFmfAlYCgKCuog==,type:str]
+    #ENC[AES256_GCM,data:Xu2zziLSr17NneQfvWh0NeNDSWrqmLeGCWoKRdNioIMBvil7xhIk1iGzum5Ksqo7gzVDrE75SphA,iv:Y7cXV7a0x6YdR//QFaL+I24UgbWotAPCucAmUEubTZc=,tag:0VtKSAH579vwG1hg5RAntg==,type:comment]
+    ADMIN_TOKEN: ENC[AES256_GCM,data:1s1IxLkaKTppP1xC7KhSaVwHvDiJtBpLh41bfeEEjquDu/b9rJlJrRJJIUlFBIrhLGtqJVvnuOzyLXvQRuCaepty+ToTZTg8t71bJhxSQh6oAmt/Qs1BgVlAaTfuZDTThkmHtmlqgxSmEbk1ejFOzq0zwZeR1w==,iv:emx4jcxpZGeaAXJDAzcrPINagLaA2GKL3snct3EA2DI=,tag:vsb/WNTxtdS2VQ9C/HxM3A==,type:str]
 sops:
     age:
         - recipient: age109zta6l0cwpkxn5wek82kvauxn6yqrq80rsz4mvu5atdnpcn9pusuvnqk5
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBvWmhVaHpKUlNjTVl4MFFC
-            Qk1QTkxCWmM1TEM0UUFwQnU4NzFmQUNYVEJNCnV0Nk00c05sdmhCRVhITHFlNlZp
-            SVM4aEJPOSsxZzFJRlE5VzVwZnFPS28KLS0tIFZ1cHRIMzA3ZHBDeDNuWVZYZEh5
-            OERrVkczaFhkNFhYS2svYm4zWSt3QUkKJjop88LeBvQDxNhHJ/DFkixqbGkeIQx3
-            RyKFIIzIBm5o0O+g6gjqE+IZHncPNobpwtwGUSuLC83qd4C2YBZsZw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5UVJkOU5Td0pERmRCSVds
+            VHJtZFBKaStmTDJoSEF4YVVEVzdQRitpZkhRCkJQT2lMTFNmbXFITHYwc3hHSjh0
+            b3MvSTgxOUVlaE1ZWm1Ic2V6T0s0UHMKLS0tICtmQVNWRFRZNk83VWZobEEwWEp1
+            dndZQVlTK1BJWGlGRDNnWDVyQXVKZXcK7y+E2yaHavjHdajf+quhRd6+wlrkEw/I
+            u1q0gyaRHe4d+eBfwE3VVAaIUlLXqTML96PmzifkNjzk/WP5rztvlA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:20:59Z"
-    mac: ENC[AES256_GCM,data:xWM1zB3TnDs0tyAXG9+kAdKNSyw5bNO30NMZhk+cK1YAFBkV4rE2I9UuS+YEwuyhLbSgo4saF4bDhPZv3CHchKmcOYaxtGRDlpPQjBtBnmz/AQ2UhFjZisP17b8VLJ1kzwK+bZySgT48Xd+2e+3qwvc0vBZWghaUaK7TM12gMcc=,iv:pEUWazagEZA3j8VFENJo6s0leHbRJQUAowLtsJOBuL0=,tag:KtJ73sxTAotsSvoy7A158w==,type:str]
+    lastmodified: "2026-08-26T10:21:06Z"
+    mac: ENC[AES256_GCM,data:hucD500hNkZRSwNk+sq/smr5XtZQkJLZ4kE0L744x79mfZ4wvR9BM7PeoGYLGjCXXk06M8i6OhV3ZM8lVUSg4c7rPF7/piHNpqYn8+OtD7EQ3CRPkrOOdbJxbvtTr7xleajBXiEwC6zXJDh4wuuYdbGnHRyQCzC54oCtdstFDkc=,iv:KjGDtJeH7pxMvmfZ1zd/xGnhlhBAYdfBhEYl8r/9spA=,tag:vxurDfhqlUhEqRelBLumog==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/webdav/secret.enc.yaml

@@ -4,20 +4,20 @@ metadata:
     name: webdav-secrets
     namespace: mcp
 stringData:
-    WEBDAV_USERNAME: ENC[AES256_GCM,data:lqp4JCI=,iv:moQ/4Lr0UkJMm5oO0i9BY7dq2LBJowkXzImz97jCtxc=,tag:sETLYBkMOiGn6tBEQrGhlw==,type:str]
-    WEBDAV_PASSWORD: ENC[AES256_GCM,data:qanf/uBlK3zWMhiMonnovI50BRr+C5+ka+ftf+mbSvJKVldQyVCGMpTzVy2dcs54,iv:QWoFqdpkCVDvdEY45qwbYMQfn/qex0IKMzqos2a1/P4=,tag:zvsbeP5ASwEtpZScyjNKIg==,type:str]
+    WEBDAV_USERNAME: ENC[AES256_GCM,data:Ys/pyUw=,iv:SEoj1qACC7B0qkXpx0wteXd9vvPXeK8a3nyrpyg+csg=,tag:nUXXV9rGd90V/tLOG6BVfw==,type:str]
+    WEBDAV_PASSWORD: ENC[AES256_GCM,data:0ICixvRi5Pc9THQ/pXDs00W76Az1wiSbt9dF7HAoQhjzdhHCKO+FegBoM3sEq+8k,iv:4LHUbWRHFhiQkG1n47i4pB+ZK/NFNzmQrUZIZzYRrtY=,tag:VFiM1DW9W2Wypds8sr/7ew==,type:str]
 sops:
     age:
         - recipient: age1y8t9v56yuvskznddqfsd4yddzzch0yf2dutvvt8rrx6rjh5f9g0s3qeays
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAydlEyeHlac0M1SkFtQW5u
-            YUdGU1NaQ21PYU9xOEdzV2I5V3BJcERaNkdBCkpna0J0ZkdqQVh4NWMrbWY5cEl6
-            am5ZMVRGdUYwaWs3eWdzRmpUUXRCa0EKLS0tIERYSzdjdUQ2Z1l2TTZpZ2Q3THI5
-            YzNFVFJXeEEwWUVDT01SWlhCZkZ6TzQKImKFS6/diKvNE4jSQ7glyD4Vz40a2CDa
-            Pqy1TTEBcosJNuAzmEXYt3sUkxvL07sTZxQuK7/3iwQpa4o/JUnovw==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiSElFcXZjY2NWcFNPVEpk
+            WXNkV0FFVDByTjZZKzlyMzRBMmxCeDJ6VEE0CklMQUR6dG9QSVN0cUlWcEpZY085
+            NnhaeW5TT1dBWFJxOSsyVkFtZEpSbEEKLS0tIDZUVXR6UEliYjc1ckRlSVBrenJy
+            Tll4WCtaQU5MbERrMzE1cS9QNjducmsKt/jDNYqEoaHKOY8m4qDxXTh0l4K9B5bl
+            4yQHg5TyZdQfxUISDcgg2MOTkeoblRx998OOjh0RDVuMtOqI/APRvA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:21:00Z"
-    mac: ENC[AES256_GCM,data:oMTUmNoHF3r2d7cKNq20dYHKzqdwWrWCxdxaAsKrs8Tls8oCt1nhATfgaQRBL4DlPPknELqWMMPeyadSnTTTkfnrNPw7OVibliq1ZIzJMu22ehWh3jgh5JWfMidbtQm/wDiQK4u4xVfO9ml01H+1u9RMAeBnpeOjf2xoTtbIWA0=,iv:+HibBq/7IcG7+yZ23KE9TbYxWLxL2kBPQuZcvqDv6wE=,tag:9wCMkJXVMM6E0FuPhU0VcA==,type:str]
+    lastmodified: "2026-08-26T10:21:06Z"
+    mac: ENC[AES256_GCM,data:WO7f+RTtHfbmCzHG2M6VMYfyu56PLtxWKqa9rR9Qx+VZy6EPXZ6rarRitmoUDcdG1ZOMvkaecj2+iPbDzuADBIgeYitxrFQDIyHe2F5c4Wtj6Evds50Rl0lLBi46Qgn/BTu3yY6v0mhncN4MhJQA0p8AJCeIpjBeAbODbjYVAHQ=,iv:D/r0rJ7b2ZE/05PSah3FqgKxjCNqXJcgNTeXD7xbZ48=,tag:N4RIDKjsrOovHOqWs//PUg==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/zigbee2mqtt/secret.enc.yaml

@@ -4,19 +4,19 @@ metadata:
     name: zigbee2mqtt-secrets
     namespace: zigbee2mqtt
 stringData:
-    secret.yaml: ENC[AES256_GCM,data:iOUY+tcGyUeRbV5u6EKfTRdfpJ+hBzsKEzNqGHw4pO39gLwzMKPacLWUNiMRN+bWb+lprZirV0NrdSmE4ASYqh6F48V/65QnU5IXF4NudIvUq28V+H0MshKklytQ+2Ps9d/ku9b5R52f3jMyhu5vI7eAzb0+kDs9zznkmPs=,iv:XDrnWp1ztNz6l/jOXOcNj7E5DY1/fzoXtEyI4dpgzJo=,tag:oQrbJBBzTluRRDTYrhfTXw==,type:str]
+    secret.yaml: ENC[AES256_GCM,data:RJOQp9diXAIQwds3aUIJHaTmoJtyXrg1dh/w0lOXJPrFunk4Lrs02MANLjgJsT8WT9Pdz6cXFUvqdsb5ComLyzneHIN7UZvMClIZ5B3BDgwBGWa67rdvwiune/sVuaEbHX+eVilBiU+pSVjPYQK1META1it8AiOUF7xCpm4=,iv:Dp/px7OKAF0gLhNkUFB1Utt6u93dWk7kE6bGsHwL/sw=,tag:S0hm3waRnt00gLR6DKDSCA==,type:str]
 sops:
     age:
         - recipient: age1tu4xgfefvgdda0vn2thaqndq4p9tuydq2ud6qa98tzzgnff6749qnlcx29
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxMkZGbGNiRFVjQkFHS1Y0
-            RE1jdExRVTdyQXJGQnVHUFREbVBDSWRQbUVjCmhpdUNPM0k2V2FwVHVPMWZndWZm
-            L3hsREQxSTVKUHd0bmduQmdsZ2hBTDgKLS0tIGJiTkxHUzZVYlF2M0xqUlpxVmJX
-            d2RZL3pLTWtCYS9GR0hNT2c5ek95bW8KOST43b4z3rV2HlL88EZF4tJ9doXwEwFR
-            82zzYyFP88tIOgGAVgHAD4fH95jxNZUu0gE/JBQWf3/ccja2XF+xAg==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBHWjFxSDhiQ1R3QXE1YkI5
+            eUtCVHhGMU5hZU10TkhQT0J5ZHJkdGZHNnhjCisvYm8rV1lDb0p2VjJpd3ZHbkcv
+            S2JIbXhJci9ISmtvMmpmem5sejZUWFUKLS0tIEprRHl3QzJPNGZ2L1plbE5sNEQ5
+            RUdVbk5EM0JSWkhGTldVNlZMNjR2bmsKvGNnP8KFCO8nC56Fbd+PanDBUHIwcvqO
+            d/53kgSRlr8kh2S4vDI7IcgGQ6x97y+BThJYCC3pdV1m7F3XJw1yrw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:21:01Z"
-    mac: ENC[AES256_GCM,data:nvwZKdzqqEsdAsQbR4KKrlCYHD7/Qjo1nCzhN9iOB7+QO/UDhpV9EynNth+fpq9XUJPBV3vwAWLOEezU62uFqTdSXK7XQUnrUk1t+pdaPFFYEqTMB/vVvV6/L7OBv3qae90qwhpky4Y9uzdjznrOT4vw9Hx2Z2DeQrz6pIIBeFY=,iv:5yEougwf59aqU7U63dIlY45fqMPkH33IiJ2DVosxhuA=,tag:pU3dKbzioutZK+xHSUSs0A==,type:str]
+    lastmodified: "2026-08-26T10:21:07Z"
+    mac: ENC[AES256_GCM,data:JijlWhId+dT0/kZLEBzzHszdNynFuW36Ho+agABcXL6YYBdYM5BHgAOTXNcuFpvN5ZMHFGZ4/M6TzAb4g10/28O6Gzhi9hSVUMrTneayGNYjpo8DIBFflzHf+3JqOUH1Vpc3Fc11RjIiRlvOWn8f58+g5VKSkGsFkGd8f5tslfA=,iv:T8VEsF02W1Pvr/w20JKEnxQrBDPRb0qgWa6kBq0zSzQ=,tag:BA5ZJ9ciax4lls4WvKI/Rg==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/infra/metallb/config.yaml

@@ -6,7 +6,8 @@ metadata:
   namespace: metallb-system
 spec:
   addresses:
-    - 10.0.64.5-10.0.64.6
+    # exclude 10.0.64.5, its in nfs-pool
+    - 10.0.64.6
     # exclude 10.0.64.7, its in dmz-pool
     # exclude 10.0.64.8, its in mqtt-pool
     - 10.0.64.9-10.0.64.19
@@ -16,6 +17,21 @@ spec:
       - matchLabels:
           loadBalancerPool: default
 ---
+# NFS ip
+apiVersion: metallb.io/v1beta1
+kind: IPAddressPool
+metadata:
+  name: dmz-pool
+  namespace: metallb-system
+spec:
+  addresses:
+    - 10.0.64.5/32
+  autoAssign: true
+  serviceAllocation:
+    serviceSelectors:
+      - matchLabels:
+          loadBalancerPool: nfs
+---
 # DMZ (not really, just for clarity) ip, will have ports forwarded from WAN router
 apiVersion: metallb.io/v1beta1
 kind: IPAddressPool

clusters/base/namespaces/nfs.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: nfs