nfs-photo

clusters/base/apps/davical/secret.enc.yaml

@@ -4,21 +4,21 @@ metadata:
     name: davical-secrets
     namespace: pim
 stringData:
-    PGSQL_ROOT_PASS: ENC[AES256_GCM,data:iQ3ChnFoNT3bEBsy4BzABi50d/Xa1nZdoTLz+ebaZf+Dcb9T66S89swk/eYgQYnj,iv:KEy1kYjNHI449piEdz5KNfojZOCsKWiI8UoXNNJqEuY=,tag:LNWUcsLsEYjwrisMq5qNLg==,type:str]
+    PGSQL_ROOT_PASS: ENC[AES256_GCM,data:d3/uq3ocK3kYoTcCXWtCCM6UgyF8obgqyILCQnAdfRQ6qGbHJ7lNZ4Dwark6TUxN,iv:TXqRMZMSzlrc7X+mzMlWy7CbKJK1cIhUKC3i/bbn928=,tag:NAq3H08XxT6hljw/PZYDDA==,type:str]
-    PASSDAVDB: ENC[AES256_GCM,data:9ReNefhXO5G92aC9H9jV1MuUKGnx/e/s+YS9JdvOHD3QrbWAcNl7Bu/Znk+WdPdX,iv:PIIOHHrm3gznocJUYbetWXUR9dRsH+A0I7KNrY9E0jE=,tag:pvTwEBQ+q6CjpMty5AOIyg==,type:str]
+    PASSDAVDB: ENC[AES256_GCM,data:U+yPqm+JJ6jeY5vauEKhBMXOvHRzrL+BCz728iFRQU8NuV2pG/uFFFLvidbcJhUp,iv:KuqthbqDMFLvOJ6q6X4GexgSdY7x0JZEfc4FFJO2vMY=,tag:M7lMcSBA3V14MVmIvR1G7g==,type:str]
-    ADMINDAVICALPASS: ENC[AES256_GCM,data:D2/uVvEGbfiLODTQPUyrIu+EZ0X1gIXxp4u+fe5iso0=,iv:L/y5xgUoBnNhYKVS9vtToDUrmlPYSHXX9d2GVDZirPc=,tag:2AQQy+cPRBo7bS7gceZrbQ==,type:str]
+    ADMINDAVICALPASS: ENC[AES256_GCM,data:zJAvMGchenU7dy5YyW9J3yE7OxMfmUx6JdSl7zt3tRY=,iv:XYaE/uO4LfT9OXe/jykkCcUxc7CcGH6VHrpcY24cV5g=,tag:trrq2UsHGdqjI/nYDlR9uw==,type:str]
 sops:
     age:
         - recipient: age1yx8mey02c0mu6te9hwxwdqp5n4enjz35e8thchsmvhqw7xsrzy0syg367g
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQd1JrWDY4c0w3a2w4aStv
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBQTTJqNHZtSmlSaFNaVFJu
-            SmM3WXo1RTRpUDhuelM1MlVLWm1hWFBVbUVNCnM3MGRJTEpHMGE2Mk45bytHWGZT
+            VUZ5alRXaFYrYzhoUjVWcjltMm9vRlpFZlFrCjR1TzJjNUZtcXVGTkgzWGNjNkR3
-            WkRjSlhGdDB2YlcraXExT1ZmQk9Ga0UKLS0tIHhVZlJTTUFObzdLbElKdXZWUnNB
+            OGtCY1RCVkZnUG1TUkpLQlNnVjhmeW8KLS0tIDdGVEw4OFdja25yVGVDMU9ZSW14
-            czV3OHBBWmIyVmc4aXpmd2lYbjNwakkK8zMw5WcQOnD7bx3PW9uUjBWCvYUMeF3o
+            QnRoU2k4c0l1K1U3MDhHb0tLRTdmNTgKzToAkiRTHkEN6J34Efzz0EJculyKf/46
-            Pnjg2O5rBFE8QJUEYfteMclmOViXsYzCK2LwGfeH8rIQWBpI0xTJwA==
+            zUDKYqV48oqx7b3WoRszNYvn2+pjQL72aA9kgJuEp9uyxzqjbS4AAA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:26:19Z"
+    lastmodified: "2026-08-26T10:26:28Z"
-    mac: ENC[AES256_GCM,data:z0mVZ478jwASZXI2wUduoNuhflgdXuwCxjQFtD6BGZeuV0zLTk+SW+vffHIuKF4KkaETQj9yx3h8F2gzpn3pgdj4EpM30UuXujFEh8K37mBOadi2N3iBXs12Utxxadv9JMM6WCgqyh6GuB1+411Os0tvxuoe7R7Fjb5054P901A=,iv:u4x3fhMgpv6nWJIYoMhfp1y5B1tb0l3iJ8815WOjbGo=,tag:F0Zv/dLaOZrn8jxJKUNeNQ==,type:str]
+    mac: ENC[AES256_GCM,data:8OcF8zTddH0wIOj1mEsHNgydiM4jXNBuQFe5/An0v1CivwmdxLCs1ROaMh43zS4TLodNJxoHORXBtXx+JDokdlbax4CtKD/P3BpWMYZ5VlDzLtO81JsGf2lF2IOjlih2ho053TJPExSqTdnh+JuLqkZ1u14LKSmXtAdmYCCzPMQ=,iv:dCaYVeVkbF2Nnrb4feLbEDix8Y+98TTcZs+PZlVbeWg=,tag:oukiZ6xufBQQNV4Vdflrtg==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/markdown-vault-mcp/secret.enc.yaml

@@ -4,21 +4,21 @@ metadata:
     name: markdown-vault-mcp-secrets
     namespace: mcp
 stringData:
-    BEARER_TOKEN: ENC[AES256_GCM,data:ddjdqtF4vOuWw6YcP4B0E22a45De2VfIrFwCRerzfcf6QW1ndcrzZqcXtBJnpqt7O03e1HkxGK/mrXvQW4lmtQ==,iv:HageUJ+oHJzbIaZllzgFGW+cmncWvuK4876NeqBIeC8=,tag:rKy+n/SGKoYm9vWlmGvUzQ==,type:str]
+    BEARER_TOKEN: ENC[AES256_GCM,data:smIDe2D44OZUsTp+Qxtfn1ikyq8gTtxiULw0WTT6jPCsIs9f/vDkGFUOmbnFeGrPTJ9NG6cGA+uDi6DSrZXGuA==,iv:r2PdMlVdXhSU9fKtENIJB4dzScvnVW8J8Kdvz1HG3aQ=,tag:8tSV0MioUhZPCZav7N9I6Q==,type:str]
-    OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:Wu+mzhesP11cPMMLxwc+GlNtNPbHuGE02rUyBrCEHYFDZpvKD4HPgseo5zyDdbrsgKVjPJm6Qz+RBUL9bMafnQ==,iv:yJ3sj7OPAsNxmyNV6lpefOTJpp4OkFES8gndGdVxePI=,tag:NrlhTTa/+RHAE06BzZmrng==,type:str]
+    OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:n5MdpERQPszciQuXDAE7uUpSmARSq3Mkg8A8fxfxqqcArvOz3FghK1p+QeyoqzqtXWx5y044Jdd8xN052fZ6kA==,iv:0zb76TH5Epq3Ua2h1fU7LuilXidSNiJbRetu4uuVhbQ=,tag:XL0sG8E50d9yCCg8dn9cbQ==,type:str]
-    OIDC_JWT_SIGNING_KEY: ENC[AES256_GCM,data:3QAoKhi+B9btznZkyq0TU2q//hIABGtm5qmR2RtnTnmr/Rtfyc+7j2R9o8MnKug8LQFv0TqUi70KDB+gkPYJmQ==,iv:UT9KT9KFyrv1b8K/EZK+cT3ovrmR7X+YUMt5b30P7kA=,tag:wWehe4X3MIMw4olK/xmZMQ==,type:str]
+    OIDC_JWT_SIGNING_KEY: ENC[AES256_GCM,data:DbKM1lTXO+WROb91u1mXX8X+t3khCX2p/Bwqx55lmJ3Oq3DxzegRbKRKToW+NCLodCUJxZS3o/DJ/exll9whcQ==,iv:JvkrNxf83Q073F9nSO7/wY7ICxUfw7EHPZ+1ew1XUck=,tag:rwwz5CSCxANRjpG/yCJ8Ew==,type:str]
 sops:
     age:
         - recipient: age1kct5g7d7eus2hvdnmx99ewsrtz70lhlasxa25euqwdctqhwqqpxqz0n7gg
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRaCtYUTdIWmNTOGgwa0pD
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBnREdJYWE4clBDUTZHRGxy
-            bjJKQzlkUzN6UWVLL2NnQ0lvK3dFV1hMVGtBCkZzcXk0RFFCSzFPU1M5amV0dDdq
+            M2xxV3c5ZWNLRitlRlFnT0NLM3RYMlh1eHljCjlFdDVTb2NUdTd6VC9lMnk2M1Nq
-            TERRSXVrcnVsRHpwZXZVanczRldpSncKLS0tIGFnRXZUY0hlL1RUWjc1Y3BIN2lx
+            cHE5UjVlUElLWHV1Yzl6eWdOY3g5TkkKLS0tIDdXY3VZcm9xSElrVjM3NEYrZ05I
-            VzdpcnlPTUd4bzhoWTJ1S3RwWWNtK1EKcLnckRjPVCYeoOF4Y/LzkSJN3w/ahcZQ
+            aW93Sk13azFXVzJvYWJwN1gyc3lTMkEKAz5w3LUnlhRlWuY7p7B8udmHS1WCUKDA
-            TVGv31cyj0J5Ee2ULeA4g+tJjJl4QHTLZjf21BRXK9r56Gyb4774JQ==
+            UsnF8hQROKOem10sEZb0b8d9PW0c3RyiTfLWdFpd8niCyCNgZQRnkw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:26:20Z"
+    lastmodified: "2026-08-26T10:26:28Z"
-    mac: ENC[AES256_GCM,data:uhZvKW9YcZpnvBhLE+PJ34KkuUgz5p3qujamB57N0chOtD8nnEzi86s8EHDoYmPzwioJBlFBicgCS+jI7zArnLRmTXzMlYIRzdlOyh066g6ZOa42Q0Kh/+pH9vGhYuc2Gyj+tBnQdw3YiPHLGWCEcKRWBDa7VP0dKutzqdkjT4c=,iv:UazdelCz8J8LRHJ4MYsiXhyNQtVW1UtqCxYoysLBKDY=,tag:QVg4ooL9MIfMtg0wAYG5UA==,type:str]
+    mac: ENC[AES256_GCM,data:Jrwzzb1FGYAioCIuVAMWn1Vp2thJoDG9lC30a1mEb06oWyV1uEcbO9c4AuXsSCNlY35s766ogWOubRsxEGO4Bqvm4l65HUXecFHSsRdtUJgxkvrRjgX4RuJGaLPuJKHNX15+5JSMFUERaoZeMzVraMVHQN6txstEU9+XkMDzjAM=,iv:2CEDBDdzghqqOro/cH0eofv6w/eJUXHMozKrCNoYw88=,tag:18PtBAyOD3lr26/h6vEuDA==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/mosquitto/secret.enc.yaml

@@ -4,19 +4,19 @@ metadata:
     name: mosquitto-passwd
     namespace: mqtt
 stringData:
-    passwd: ENC[AES256_GCM,data:3EKSXCej9iCP47Jgtd/YDvE8iOcL6ythBz43RdHDrRDZobqgBgP42eP00X8WsttykJIe4lYUwBIHIG4l4CCFanxx5phSpTwJLXGmcqKtbizo4joiMUzPMWD3iatuVK/L3QfHvBfOIORgILOQ2hUFPjjdejyX1X6zWQCKIG7ZBti1aDV/YbZnIOkSRdbhus03DSvh1BhQ7se1FfwEc2AUm684+OyosRTF9Woo1iu2LcDmtmWvuZMlETFn9XYrVQ==,iv:SzVzyN9FMEh1aMMx9sSOXS9PNmIB5qPQ0o2opg2WiPc=,tag:+d+WOvat/b8sO0LEt6blww==,type:str]
+    passwd: ENC[AES256_GCM,data:pLEYT8+BtYZJSUyxVHSUuePD96lLk+xeuFVVpicT6fy/N1jvr4hAWpBxLkLnjB8xdDNKNPwyLzUq1SRkpy5m8G1p0u3zO28rkKWLAkwBIYGPGYAmlOeKrhn4KrmleFcZQ/aBvfXeYND+Hysd5THIl5SRkkJ7hYb1+n1/yL8l/ybcTe+q7lGoSG9Oj+rAvD49muZRfqmZI5TcgQ2t6iwaoVGHaaYhGky2KS5MjdBkwjNHyfKazhfc4SFVatunOA==,iv:exkWU4x2PPAkhgm/QJxtT44bDVSu6IaGChlcSBcQCHo=,tag:HnXPNIloqu+mVCJ9msYJ0A==,type:str]
 sops:
     age:
         - recipient: age1u236u5mzkzj72y4mfxx68gfqw0u0j6tdgkudnm5pdfpe7apq4u6s89jr2h
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhU1NOV0lWbURtNmxBdzho
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBraEpFRWRGWFJkaE5xaTN3
-            UTlTbmRXR3JpN1ljOEhHTjNYVWkxZ21kV2pzCmFkMkp0WVhyWExLREVJSy9nM2NV
+            Tmc5Vys1M1hmajYvQWdtYjFLTlpvUXRYd1NFCmE2RXZoQ09oQlhpdUwyK1NLT3pM
-            THNXb2ZGTmcrdG1jL3k0YSsxY0ExajAKLS0tIHFuUWgyUzRnTjh3VTdOZ0tFcG5G
+            OFFWcWxINGZCLzNMTWFoU0U4NkVuZDQKLS0tIGNrcG5jeExLaVVoT3FoYXlXazF1
-            QXk5eVROMkdRdlB4TzJzVVZlMEhjYUUKN9QGNPAJg4HFppNxzbM8FMMzaODY0n72
+            T0E0ZGUvblVnQjFwMWtrNXlmOS9JY0EKN9LdvPGrGQGtfDnGSsWOQCwoSLeNPwJ8
-            Ndswev7LSM+pQWmC2nAF7r/X+0Y6uLQNHDGNP/4lglruXjzVaqf5og==
+            kkEHuhl0xyKiQ9aDRr0wUM+TSjB7pjXHbm1/fn/bg8gX5lNyS/z41g==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:26:21Z"
+    lastmodified: "2026-08-26T10:26:29Z"
-    mac: ENC[AES256_GCM,data:vpSZhf7tX/dKUlw2bh3vB/FKlCUE14Va3TfyP+MNc4nSwc3RhQ6PljwLxyiIaDYlVm3UPec1XUHM744KyzT38nvrvu1wF9hcyIjmn28+0Lh9kGhoOYxqm2Po9Oab04+0aH86IpElUODL5oJdzRuCIO+yM1Qn3qCwpVDOkk83Kps=,iv:JoXL1OCh4KqNYou8aJDvAAr/zH+XV0K3P3a0ShnlO04=,tag:BeofaTBUVCyaWy43rLZVUw==,type:str]
+    mac: ENC[AES256_GCM,data:IM6AYTu55phKYKpS+ihX5zX1eeHwsnBG4SjbaJIx2LHlAZ4RRdfxoYq8msp0zlprN5ndfDoQLWaZ/wYD1syTReYNadjQDm3yDdVvDjxNY5jMJv4WkHM5Y75VtaPEsem69bhf38sKHrps2/6Be7ELAfYq6aCreH827ffHB6d0ycI=,iv:2NFKVbuRKT4+xeVMZwRGy9tQw+EOW7jHx+bZ09WHWIQ=,tag:CALPG940+fd3u/GRSZBtMw==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/nfs-photo/configmap.yaml

@@ -0,0 +1,51 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nfs-photo-config
+  namespace: nfs
+data:
+  ganesha.conf: |
+    NFS_Core_Param {
+    	NFS_Port = 2049;
+    	Protocols = NFSv4;
+    	Fsid_Device = true;
+    }
+
+    NFSV4 {
+    	RecoveryBackend = fs_ng;
+    	RecoveryRoot = /recovery;
+    	Lease_Lifetime = 40;
+    	Grace_Period = 50;
+    }
+
+    VFS {
+    	Link_Support = true;
+    	Symlink_Support = true;
+    	CanSetTime = true;
+    	umask = 0000;
+    }
+
+    EXPORT {
+    	Export_Id = 1;
+
+    	Path = /export;
+    	Pseudo = /export;
+
+    	SecType = sys;
+    	Protocols = NFSv4;
+
+    	FSAL {
+    		Name = VFS;
+    	}
+
+    	CLIENT {
+    		Clients = *;
+    		Access_Type = RW;
+    		Squash = No_Root_Squash;
+    		Protocols = NFSv4;
+    	}
+    }
+
+    LOG {
+    	Default_Log_Level = INFO;
+    }

clusters/base/apps/nfs-photo/helmrelease.yaml

@@ -0,0 +1,177 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: nfs-photo
+  namespace: nfs
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: nfs-photo
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      app:
+        strategy: Recreate
+        podDisruptionBudget:
+          maxUnavailable: "0"
+        initContainers:
+          fix-permissions:
+            image:
+              repository: hectorm/nfs-ganesha
+              tag: v10
+            command:
+              - sh
+              - -c
+              - chmod -R a+rwX /disks/base /disks/sub1
+          mtab-setup:
+            image:
+              repository: hectorm/nfs-ganesha
+              tag: v10
+            command:
+              - sh
+              - -c
+              - cat /proc/self/mounts > /mtab-vol/mtab
+        containers:
+          # mounts the two disks and exposes their union at /disks/merged via FUSE;
+          # bidirectional propagation makes that mount visible to the "app"
+          # (ganesha) container so it can export it over NFS.
+          mergerfs:
+            image:
+              repository: ghcr.io/hotio/mergerfs
+              tag: release-v2.42.0
+            args:
+              - "-o"
+              - "allow_other,use_ino,func.create=ff,category.action=all,category.create=ff,category.search=ff"
+              - "/disks/base:/disks/sub1"
+              - "/disks/merged"
+            securityContext:
+              privileged: true
+            resources:
+              requests:
+                cpu: 50m
+                memory: 64Mi
+              limits:
+                memory: 512Mi
+          app:
+            image:
+              repository: hectorm/nfs-ganesha
+              tag: v10
+            securityContext:
+              readOnlyRootFilesystem: true
+              capabilities:
+                drop:
+                  - ALL
+                add:
+                  - CHOWN
+                  - DAC_OVERRIDE
+                  - DAC_READ_SEARCH
+                  - FOWNER
+                  - FSETID
+                  - SETGID
+                  - SETUID
+                  - SYS_RESOURCE
+            probes:
+              liveness:
+                enabled: true
+                spec:
+                  initialDelaySeconds: 2
+                  periodSeconds: 10
+                  timeoutSeconds: 2
+                  failureThreshold: 3
+              readiness:
+                enabled: true
+                spec:
+                  initialDelaySeconds: 1
+                  periodSeconds: 2
+                  timeoutSeconds: 1
+                  failureThreshold: 2
+            resources:
+              requests:
+                cpu: 50m
+                memory: 128Mi
+              limits:
+                memory: 512Mi
+
+    service:
+      app:
+        controller: app
+        # cluster-internal only, consumed by webdav via
+        # nfs-photo.nfs.svc.cluster.local
+        type: ClusterIP
+        ports:
+          nfs:
+            port: 2049
+            protocol: TCP
+
+    persistence:
+      config:
+        type: configMap
+        name: nfs-photo-config
+        globalMounts:
+          - path: /etc/ganesha/ganesha.conf
+            subPath: ganesha.conf
+            readOnly: true
+      base:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 100Gi
+        storageClass: longhorn
+        retain: true
+        advancedMounts:
+          app:
+            mergerfs:
+              - path: /disks/base
+            fix-permissions:
+              - path: /disks/base
+      sub1:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 100Gi
+        storageClass: longhorn
+        retain: true
+        advancedMounts:
+          app:
+            mergerfs:
+              - path: /disks/sub1
+            fix-permissions:
+              - path: /disks/sub1
+      merged:
+        type: emptyDir
+        advancedMounts:
+          app:
+            mergerfs:
+              - path: /disks/merged
+                mountPropagation: Bidirectional
+            app:
+              - path: /export
+                mountPropagation: HostToContainer
+      dev-fuse:
+        type: hostPath
+        hostPath: /dev/fuse
+        advancedMounts:
+          app:
+            mergerfs:
+              - path: /dev/fuse
+      run:
+        type: emptyDir
+        globalMounts:
+          - path: /run
+      tmp:
+        type: emptyDir
+        globalMounts:
+          - path: /tmp
+      recovery:
+        type: emptyDir
+        globalMounts:
+          - path: /recovery
+      etc-mtab:
+        type: emptyDir
+        advancedMounts:
+          app:
+            app:
+              - path: /etc/mtab
+                subPath: mtab
+            mtab-setup:
+              - path: /mtab-vol

clusters/base/apps/nfs-photo/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: nfs-photo
+  namespace: nfs
+spec:
+  interval: 1h
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/nfs-photo/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - configmap.yaml
+  - helmrelease.yaml

clusters/base/apps/vaultwarden/secret.enc.yaml

@@ -4,20 +4,20 @@ metadata:
     name: vaultwarden-secrets
     namespace: vaultwarden
 stringData:
-    #ENC[AES256_GCM,data:SvVfo0iwg4x7q2qrvgwj2A3XLhT9Q8mjLMYZJqs8VdrTB0UCCbwejeqyYpTghPsLiVHf6jco7Zla,iv:ThZf73YcwmE574az59m2DIpgmqSHF4OXExZaD62Bbiw=,tag:Dk0U/ejl7t/GlMYoH1AUKw==,type:comment]
+    #ENC[AES256_GCM,data:AtTQnPwdiXYzyXqPllioJorIzEE/9BO3kF8faH7mMHoU1966d3trNd6OZRK4HIeHPwSXnfZgOFGJ,iv:82iAcGk/O8quLAlWCr7fpGYbq9mD9tdmiqd7oM2F6k0=,tag:t5zR4OOrXAq7ZbVdhOP5jA==,type:comment]
-    ADMIN_TOKEN: ENC[AES256_GCM,data:s1gZ6P1KEyC5GXjcsMy75VYa29Y2wnNx9vMLSYB+UugutggqOPkDcofpLHlaHmVQBaeWt1XI3iC9C1TVmW2It4WFB2i5Qm6dqXHOKaTpTimKRkRi3R17taDvRs7GMMG35San3lioJF7GhSsHCK0S5BM1FSZnmA==,iv:gnspK186C87RXoaGMWuMi8p6WzxEKz2nYljfLlVTtrA=,tag:Kqon1pFgzKxVm1NpptWc+g==,type:str]
+    ADMIN_TOKEN: ENC[AES256_GCM,data:bc3bPmHCN7Vnj6SOkNiTtX3yprpjq+2J0e1oa0qEZuDxgh3gBM0AwDaUwSMrxR5tVO9kl5e1oR95Ey8tR70pVMUqRlZO81ppymarfWzv46r43wucdocdSQJG+G/a5DpFy2VTSM8ES1MrBJIMAbGNA4g6tJSzEA==,iv:jdEj3OgLFWPzLNubpVxevsYYPXwyGZmsx9CeoQuk9U8=,tag:7mOvS+JRP5c5f+0AoEplaA==,type:str]
 sops:
     age:
         - recipient: age109zta6l0cwpkxn5wek82kvauxn6yqrq80rsz4mvu5atdnpcn9pusuvnqk5
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIYS92KzJXZkFhM1IyT0lU
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIeFhxazlZUjRwZ3l0TkdJ
-            NzdHam5hUkYxNDduV3VibEtIZW9JZlEvMTFvClN3VzhlMmErdmYvbXIvVlh6dlJ3
+            SjY5T2krSHYvMEhNRWFpOGN3RjFTMGJMM2hrCnFTU3BxaFZ5elgwUW9xS3FxR2V3
-            U3JtNUxLM01pWFVMd1BRSmxUbWdodW8KLS0tIG1BeWdteUZGNktTSlhSQzVnMy9w
+            MEJnSnh0eDVZVmQydFRpV29XNHExa0kKLS0tIEt2NVhpUEp2c3JoajRQV0pTTTlT
-            M001UzdFTXo1WndLenVkdzlSdklIdlUK1QqTc/8mJgsvQo9HdQ9oPnBfCv6qw0on
+            ZVpZUEtkT0JVMU4vcXhsT3NzSk5ZTFkKuBaHWdEOkFqvVI1zK1wm1qZChkAL2NAi
-            qQvpNYVzw4mVFZjiyClwnxGdK/VAQPmgG4eRYmvehYG91763/msYPA==
+            F+9csHkvDaNo8luqNLAtxub2C+hyeHoBFtCqaMgpdQ3VU/6UMI+BZg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:26:21Z"
+    lastmodified: "2026-08-26T10:26:30Z"
-    mac: ENC[AES256_GCM,data:7Y9qjbvxJfPwgd+Ib7xxANwbPvl5JTCOVTlce+UZnBkjZN9KnY8A1+yaChMitk5y9N2payS/T8c16FOAZgPlJ4QFO2jzuwUyiQqgq2wNXnDXaEo6QkbvtX/G3mfDPSRukNsLsn+4xk0vaOZdpGPsFLyOwKXOyUG66WzIkD0X5DQ=,iv:M3Nqe0fi0l1PMTFhB3Ros7FXqD0fUyfUvgZh5bsWPho=,tag:Cgog9uYgWER7+mXL9/G/aQ==,type:str]
+    mac: ENC[AES256_GCM,data:rNc8F/N7mH8Xm5Vsa4nn86C+b31uXDZZZBf7eoVp1tM1gZwYQvrLvLhIb3v9/jghtlxksJPAMcjX+xJgU30VVIu4g4VFk4/igNB/0I4feMJQsunLLd4enLuY9YrlysRMMGjaz6WZf/HeRw7/yxho5eVwyZkoxhURqp1X6orfBUc=,iv:AzIWm3nhDRPekRWb5kswdlPd9FB8OoP9pkAn9H+7UeY=,tag:cAWy3N4RLSp+47bdU7Qr6g==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/webdav/helmrelease.yaml

@@ -90,6 +90,11 @@ spec:
         existingClaim: ganesha-export
         globalMounts:
           - path: /webdav/export
+      photo:
+        type: persistentVolumeClaim
+        existingClaim: nfs-photo-export
+        globalMounts:
+          - path: /webdav/photo
       sda2:
         type: persistentVolumeClaim
         existingClaim: nas1-sda2

clusters/base/apps/webdav/pv-pvc-data.yaml

@@ -36,6 +36,42 @@ spec:
 ---
 apiVersion: v1
 kind: PersistentVolume
+metadata:
+  name: nfs-photo-export-nfs
+spec:
+  capacity:
+    storage: 200Gi
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  mountOptions:
+    - nfsvers=4.1
+  nfs:
+    server: nfs-photo.nfs.svc.cluster.local
+    path: /export
+  claimRef:
+    namespace: webdav
+    name: nfs-photo-export
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nfs-photo-export
+  namespace: webdav
+  annotations:
+    helm.sh/resource-policy: keep
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: nfs-photo-export-nfs
+  resources:
+    requests:
+      storage: 200Gi
+---
+apiVersion: v1
+kind: PersistentVolume
 metadata:
   name: nas1-sda2-nfs
 spec:

clusters/base/apps/webdav/secret.enc.yaml

@@ -4,20 +4,20 @@ metadata:
     name: webdav-secrets
     namespace: webdav
 stringData:
-    WEBDAV_USERNAME: ENC[AES256_GCM,data:eXzFiTw=,iv:ry96a0iw0AeG6btL76w6SJ2aYNATghx6ng7OW3++1l8=,tag:RBol1Y94WqTAKYNgMZHfEA==,type:str]
+    WEBDAV_USERNAME: ENC[AES256_GCM,data:6f/Nz0Q=,iv:OEvH03Cf8+Kmd6catIEZiwqRdx9qSuTiC7f/fKCyWNQ=,tag:6O693+36QcyBWVe6V54vjQ==,type:str]
-    WEBDAV_PASSWORD: ENC[AES256_GCM,data:WwwaKK/1VcEsSMQb91+pZoFSyGs5yAsIRj56Aza4s8eCgUs7bnEeriVaV6dN+WCx,iv:h35gWssjsOzSKlro/90sgQhf491RdWcb6VHIEePbVxs=,tag:HjbF7RefPkjRiZUVmSgFpA==,type:str]
+    WEBDAV_PASSWORD: ENC[AES256_GCM,data:U2qBdy+fbywRu/9dvviUEghK6taGf/R7OJ3Wmpyuj/hHAn4/UE8rzC4wBAlmCX+e,iv:vlNXDlN/PnEPRRSQ/p1HzmN2aF/0vdZkvxbjqSByGck=,tag:XYBBT4+imMHLJMu+QIdOQg==,type:str]
 sops:
     age:
         - recipient: age1y8t9v56yuvskznddqfsd4yddzzch0yf2dutvvt8rrx6rjh5f9g0s3qeays
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAxd0RjRWk1ZWR0dU9MakFK
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVQlRtbWgzenpXNFhGbncx
-            MGlMR05kTWUzMDNFa2htaWlydExsMFdwSVdzCkN2VGYzdTMzWnhYWW9MeXhjd2Zo
+            b05WYUk5MGlGQ3JHMWRoZFY1MXQ5SHR2MkZrCitFaEVpaDZNbWNORlg5cFpDTk85
-            MitLSzFTQzVFRTNUTktXeGtldVZQczgKLS0tIFhsNGpvUE03MktSazNvRnFhd01n
+            b1IwdFV2OEl2Y3o4czNwYUkwNGhmbkkKLS0tIFZGR1RJRHZMUWF5QVpSQkpSU3pV
-            YTEybWd1THBKa1FIRHVSOVlrWDFuSzgKcuJb1p6cNE4y/j1PzHr+NKnpCa9GpdIz
+            VUZDMWd4QUVRakEwSXp4R084aktGcGcKCzrMbCS0XO6VpCg16Ufk2x73yNK6v5yn
-            zMBE2PiFu45BJOYUWPb7pvRvAneHNyMJZbWXJCy6jxMkagnkT+f5Qg==
+            io8+2upqXhlJxM/6tXAuV4hFic/7z5xy0jT8dIlovZIfSbcLoQD8Lg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:26:22Z"
+    lastmodified: "2026-08-26T10:26:31Z"
-    mac: ENC[AES256_GCM,data:XqS6nL+usQDub+P7Fr4Ohrhin7DzO4LX1GQuRk5tTZtllq7wKlPHhYcteL4Fq+MCHRTAixo5/g2FJAjW3t2sMN2iMCLTvY4KYoYQIqDAR4UzFG8e/gGnpEQOE6ky2ThdGNAvNkvuufSZjXNxzitLD+8AtSqcH/f+uRZJ/3zOReA=,iv:HlmCsWH8bVE7ox7suIic1nAHHe9tknWxrk2yNuZU8dc=,tag:V2u6xpE7xNmKwQ+wniIl4g==,type:str]
+    mac: ENC[AES256_GCM,data:WF/6fs0eimqddFuq+IL2wzAmFO2xSWwbpQYkao9Mp4yV0uh4bopvfZ4coKLQYJP/jmS9Iq2GA6JO7u+Iypiizo20ZkLt1fXy/A8+wvdnPdRVfEtaeUc+cMCalMoSiwLWFJgKhoGIpgmt6DR4XEOnYQ41OIpiLTNHfZSk6bInjEU=,iv:nUzoUvj9w4TZEgi51z1e6ZNxTPoYYoWjU5Dxe5ZtbLo=,tag:b+XA8mWmmUhD25Z2ARP4QQ==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/zigbee2mqtt/secret.enc.yaml

@@ -4,19 +4,19 @@ metadata:
     name: zigbee2mqtt-secrets
     namespace: zigbee2mqtt
 stringData:
-    secret.yaml: ENC[AES256_GCM,data:z6AXwALq/CSVk5WOKBCbg66uspkEXB5GVtjK1ALFqoos41JmTrRmss53/O++tEKBfu9hHnl+QwRqmq2P5xmY+txWDzTJJVsqPEoRKHS4ocLBOZhSZ7kVMomPG5wGJvY9Me7DUuWRVJtkXEa/Gvk4ej2WKPv6iloHH2rqTrc=,iv:wf3+co0yK389VFb0ZEt5xSS8JB/3mFFto2mlPKxKKOk=,tag:g6tRDbI31/8H1WKvXtY3cQ==,type:str]
+    secret.yaml: ENC[AES256_GCM,data:9EMz74Ed1NfTYNMyirbVpYtpCDQAT4xT5B6Ct7SfcUrmhavBh26CbyAu5mlnTwkbI8wy4DOCeKDbvEiSZfSn7gBIgkDUvrU1+E8ChgJIN1WbKW1EnaCbWf6gVUfSQmoYIdMoRCi1MdisJrpTzWz6vqBzsjZ0n6LmZn9KCIM=,iv:DRkF6d5ijwjLBC/nDYvTSfdxJ3LxKhGfNmWoipaHxpk=,tag:iCdPlixi8O2WDwsOM8ncUw==,type:str]
 sops:
     age:
         - recipient: age1tu4xgfefvgdda0vn2thaqndq4p9tuydq2ud6qa98tzzgnff6749qnlcx29
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBIUHk3MDVzWTM1QWRONVI3
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBya2VtcUlsNXdrdFNEc21R
-            dFdiNlh4RVV3L0R1d1J2bWt4eU54TUxlUDNnCjdobzhVZ0NaZFExeU5qVDExdytP
+            Nkdvdk5peTRtaGEwUmRNUkZxemlZSDZhNTFrCjVJWFlWaC9PcCtGUXNoaEpHUW53
-            YTNmQkVpMUd5aGlDSjUxbUY3NU5uYWMKLS0tIGo4WHlIUWFxUkpyZXhSM0N4WjJQ
+            TGtqZ2dMZ1N6SkFKdG5jYlZ5aUlqTkUKLS0tIFlyLzNWbk9VeW1YVk95UDFxQUxK
-            dEpPL0c4UzE3OWZaZ090bGR1MUkzVGsKQ3ptIPqfzr3KXzTCZFbeZKhFxxX0VdCe
+            akhYczUxRnBUcEdpSi9mQTdSaWl5RE0KT+ovgpj7yFOU2YPNUAK78VFpTq5sNMtm
-            DNFpGQehwotVWoUfinG0aOpYBUoBPfF+Jg9SkzRERYGMDoP8U3JFxw==
+            Rri8EcToPbYWwKVHV0hv2xLdupjCx4t8qWkdqqyce6/cYTxDb/NxCw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:26:23Z"
+    lastmodified: "2026-08-26T10:26:31Z"
-    mac: ENC[AES256_GCM,data:7dcxizCUFi7krRbLye+b/9ApA7cN23Hs88NiojB+aZGX7LezqL3NrCV9k0IZ80AqzODrAzw/kJ/XvPdzPujLu9Dcd4giRXd85rNXbjMBJCHD62fqUncopOXx776Q3QnRV8FXvALqBE0wawXiPylVPSt0H6dHtkNZxCg6R+kj1mA=,iv:A4imdv4e6IlGxao7qfEtJZN0PHRucJqkAVv9O/FJvcY=,tag:us/JleVQTYjjaj/0fMsS/A==,type:str]
+    mac: ENC[AES256_GCM,data:sjHIWp7pU25MO+o9FpY9PbQ1nnwzASodnd9iHlmoHKjWYnsqyMi1fetTn4O58kkx9Dc0gJH4sYnZj7ty/1xyHkx0wL/8RJaJ8B56K8iBotBqdFC+vUW8i7JJpVB1b9GNe22sMEDx/AK4QXoLSLray0ylpt+1D91s6GIPXc8uvDY=,iv:sEFLaU53oyX62j5bav8WT9xrT+RID6tO3q+L0o4j+6c=,tag:c67cWXEw7fA8Y3QzqErYhg==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/infra/longhorn/longhorn-system/secret.enc.yaml

@@ -4,21 +4,21 @@ metadata:
     name: longhorn-backup-target-secret
     namespace: longhorn-system
 stringData:
-    AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:BZSa1SeJ+tDfXCvlPNz68rBratI=,iv:/vtZb7F/Qp2Ae4D1AXfVnUSFltRBsmN7S3upgC6k8Oc=,tag:QNGoH1XeHTK3JI13J8Z95w==,type:str]
+    AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:Qik8qNmHjivnm5xSwHMSHy8nZv0=,iv:LS3BPVI/qdSlqizAwJ0lBo4XcJnG31ggIq81mFHKQks=,tag:Ia7gHqRFlli0BNva6Q0weA==,type:str]
-    AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:mZIa3ifnXUuw47Tk1dRFQI3QNY0wZJUG2+4yXe8PeZvXZW7Ek23FZQ==,iv:2BvAN6buuJ5QzvJGBuq0Qas3TY1+lFgJGXNNi1m1CsQ=,tag:Vf976plqDwHy7eCoGpQTDw==,type:str]
+    AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:HT+pgbFgDI506VlH17rgmbogOe82mh1z5LDDq5o461cbn0sSbEk6PQ==,iv:zB1Aow+3J1bITC2lubzA65vsd5VN4UUgqneA4uwIAVc=,tag:TGd939wAahspnSUwRtC6Aw==,type:str]
-    AWS_ENDPOINTS: ENC[AES256_GCM,data:yJNIyKwPV5DfLfrRkX/cnZ+JmY0ikTOCS1/iEUD6+rTdyY5oL49VOHBYaNpjasA1mLWWhCk8Pbk3pOLT0w==,iv:sCwOkNr4LR0NTROudqk0UYMGzsYpRPRe2XE6tbiES1g=,tag:3XNveRYVG0Jd6GCVmdKNWA==,type:str]
+    AWS_ENDPOINTS: ENC[AES256_GCM,data:qnMEbsrS02a2pHuaxfks4rNJtywfGJtaF+FR4hFYJgNFnvR/R19hNn0AEtmUAZ+N99HT5SamNMrVY7S1PA==,iv:MnjuS8+40pLaJkHSGra6pL+1+ITqKSny5u7bR9yb7Gc=,tag:gqB5MyU9r8xpUNaJ+2PowA==,type:str]
 sops:
     age:
         - recipient: age18hhmdmupj90zjgjpxk3z5cf3lx36hcznnmqsp0fpyg50823pudrqjupydt
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1Z1NBOTdwVG8yQnFocmQr
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBVZ0xtNGc1M1ltQXNpakpm
-            cE5jUjNrQTl3blpCZFJTTjJ5clE3L1M5Y0JrClVSRXh1dTU1NDNSNGdQdk11bXdO
+            YzVSYUlQeDdXZUZ3ZWRyd0pyY2dIU1dEaG0wCjV3ZmRjSzZ4OFFkY2Q0allod3l0
-            NnpwV1RZNnp6b25KYVl4dVVWSWFZckEKLS0tIHA5THhqMlIzelBqR0gvenk4TDR5
+            S3JKaUtGUnA1Ti9XOVVLOE16L25xYmMKLS0tIDFTU3MwcmJpcERVaklDbHJCa0w1
-            MWlRZW5vQVR2QnhjUkFJS0twRnJiNDgKtWephKf8WlGucqR1l6U7UG9Uthigg3Nf
+            OTcwVGp4MVN5VVFBR092eUQybi9na0kKwhjDUzvNUym7c7O/+CDHWBfFFLAuG/rj
-            PlwmU77QSXM8xBjfdqH3YpCsa/nsd6B4PnWvdwGVAgsgU8oMT/cr7w==
+            ekYmlO4EKATG+yp1NQ8Hj7NcR5PQSGiNSBwfqCrEgqVcYQSmlFmU8A==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:26:24Z"
+    lastmodified: "2026-08-26T10:26:32Z"
-    mac: ENC[AES256_GCM,data:eEjeOIOqynweKjXMKXBydlUN7vCPKv07TeYfmc4+tLa1JRMZL0kH7eDpLoMmEkHlgGLDrAHrxhLQBgx2857Efy14eCTPvham8ywr/ZQlFKO5H5INt/cBChvpE6rspCkp0tVuFDnkh1ZFolcYK+1sNzjiAnH+QovlN23y5c72OxM=,iv:jtioOlRs093ulVJOg4cznXl06pXBhuxXcDYowwuoUAM=,tag:SluA880045EeePiEsbQL6g==,type:str]
+    mac: ENC[AES256_GCM,data:pMkNlkcxO1HOPzBjY/BTuBM3AkEgvz84Zb+/rHsdtQIJEQbtHZfc+VPhaqpPGjAbac5kpe9JZd1tj6sBcN8VBqGi+Al/j/BBbdJ6xUtOJzbg49gYJ6voBw/IZtjr6sTK6Xx0znpMV5zwJl508hJveUxvqfJsMpCXl/3FR10+HGY=,iv:xris7XsSqMDEjdHScWE5ucKsjrNLPQceGrEiv59rz9w=,tag:SXvzncAFyxuEPL/pCW3Lcg==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/infra/longhorn/s3-backup-proxy/secret.enc.yaml

@@ -4,24 +4,24 @@ metadata:
     name: s3-backup-proxy-secrets
     namespace: longhorn-system
 stringData:
-    WASABI_ACCESS_KEY_ID: ENC[AES256_GCM,data:2OOqOTveehTfqlzrTkGYJK0i2Zk=,iv:V8JhC4wNFNavUuWvcxsOGYKJtNgILyCCbNg8hRFVS5M=,tag:RaKLUcgDqSj34Ashyztu/w==,type:str]
+    WASABI_ACCESS_KEY_ID: ENC[AES256_GCM,data:qlK+ONGDavWmaf6w94j8OyMbpDU=,iv:nEd5dOva/EbeGID4fp6kdF63+aoc39dW/J7UE6HVX3M=,tag:bIsQqnOS6c7A6LtsdnZ30Q==,type:str]
-    WASABI_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:YfUx3NgQyjHiRjgYh/Aa5R02InHD4ZwY3J51GjEP+teCcyx4T88wzw==,iv:fscryDhOf8JfOdKunZE1W6x6gEv45yZXgefYh2aP2v0=,tag:xT3k5Vxoj45DHvSdCLP5eA==,type:str]
+    WASABI_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:1NYGslCAcqssRSvBSiqfkvq/uM0oF5ctrf1/Zo2CwrfGejugE7q8Dg==,iv:LboBdw/YLf/0F12oZwKTpP7Iv5C9huABKaK5flk5ETo=,tag:KzvGSn/jjZeMCq4Sg+f/zg==,type:str]
-    CRYPT_PASSWORD: ENC[AES256_GCM,data:rKAcOjhs2a0FmOYxdZfAjo9DerRhZQjzvHQ9SLvlDt2SVns3FBmkZx9F+A==,iv:sjpApU1xdfSknCyqGp0srsueznQfI+WXo0DrkUEWLcA=,tag:Tfotc7TotjVE+QsavyqlPQ==,type:str]
+    CRYPT_PASSWORD: ENC[AES256_GCM,data:khxfQINBuEcZt1jga3jxKVMKGeNiJ/b9SluvsSnCJ8hMrYFw3GbCW95CNQ==,iv:E6YOKLI1DZSaqDLySKJBELGP+EoC4QPvM+9ahalg35M=,tag:SCSloFW+9GzPYpWE3TUmWg==,type:str]
-    CRYPT_PASSWORD2: ENC[AES256_GCM,data:YzWFmE9HDLflI3BRgwYjKFfemWH3+UjLt2OFt6dcJPyc6y3UtdN9aQ+tqw==,iv:l5FK4KB8+z8YOe194IwyB7A3lLlCe5fcOsdEBLd52Y0=,tag:XNmlvBjt76rat4lHXMgcJw==,type:str]
+    CRYPT_PASSWORD2: ENC[AES256_GCM,data:m8omkA6TESbAFsu+ctTI/6AJrdsvTtviFUECvayt0/QbFrTQeBGo/fEGSw==,iv:VmZ1SFO7dCU+AYyCDncxEfcpCmRDPpSiDh3ioQnfeXk=,tag:UVhsVJcD7dCpogXg29YBpA==,type:str]
-    PROXY_ACCESS_KEY: ENC[AES256_GCM,data:e7JzZnAKL0UR/AjsoQtEXt3KvAs=,iv:lWhfdKR/so2q2NDexdeM18Gy80Jupk8uYM4YxrhIhTc=,tag:1lYVaMOaTwGABFd57iihCg==,type:str]
+    PROXY_ACCESS_KEY: ENC[AES256_GCM,data:H8uXYwuY3dQmmqez7jXQGWKt/30=,iv:ErmZL2ygfshIDM9+EwNXL+qIk4cB9wXgS+NO0mfc9Yo=,tag:bbq5RmgSK2sD1sA3OjMfHQ==,type:str]
-    PROXY_SECRET_KEY: ENC[AES256_GCM,data:eUJa0JaFvTlpOiCJlSiImKVn4ZiSIHomNAsXX43412KQNbadntzR6w==,iv:wDEBvpbGtdzty0U9CVE3Bw5Vp32GEiW2vt6tB7G7Zlc=,tag:/PmDbF1jtXfLaxrvK0aHwg==,type:str]
+    PROXY_SECRET_KEY: ENC[AES256_GCM,data:CdoActn2NaBtT71KyxY/i4/KaPPYiMjMdYxo15k6B0KtBTPIVBKsOw==,iv:LHpa1F/MF6+aVWIdw1ojFx4n1BeAowHaYSLKwS130CM=,tag:Ogi5pFlj/gOSKpcwR3PSvQ==,type:str]
 sops:
     age:
         - recipient: age15vc3geq4lsec69rnxczluvwgcexeqae02zxzjpswsuatthaasu7qzath48
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJVEhpTG8vR2QwdnpsU2h0
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3bDFMOG04T1JqamhRZVk3
-            ZWFpR00zVCtFelMvZVZKc3g5aCtNRTRleHh3CmZvdWdMNkpFNWVwam41aXMwbUQr
+            ak9RQS9oeGpTR1ByckljMEVkT1FPSTFmQ2djCmN0Z1FXUHBYTnNFMVoxS1Vsa3h4
-            TVN6NzlUYVdQaStQTFdleFJUS1k3cUkKLS0tIEtoVXRTNXZiTWZjVldGZHkrbnNz
+            U1pRdXZYY0dNSkk1a3JvZk5RcG5PS28KLS0tIFlqOFNkaVJSTFlyN1FqZ1loSmR2
-            dDlGUkM4NWVmNWsvTGV3QXlSbEtvdkEKf7YLaPgM36V9uPy8Bsfnp7KSbFWH95nC
+            VlEwR0ZLYXhsUWkvMlF0b1d1aFRPR00KFQOqTck7M98qjTZK2z1nGxQ6FKkup+IK
-            mQhkHGalJ8U9nmGhyz56lXqQGH2KOYW7w7Y1JxI44yPnoPxkHBLcgQ==
+            b6/YELW+U1UHoBdvQXIueN3tN8j9N8qOD4QR7VlnwiPkVxKMt10eag==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:26:25Z"
+    lastmodified: "2026-08-26T10:26:33Z"
-    mac: ENC[AES256_GCM,data:+sVEaUECtEsZsbTatKi9RujqaCff7rdjgJLpPpwR5khN/QfVXCrwVHmM4txFlPQNFEZRvQ3xTvCVHqgJToCQR9Ne3eIQRTqIFdJA7k/IWZhAwPiYoP4EWolo6In9sjaqSs7XwnEmGrLV7yILPspCClSZNYodMP7vlMFM5pqM0/s=,iv:h1eNngOV6rLo5Jgdrh2m49aTPpMISCzQbFTihcItpdY=,tag:YDLFxYlbzQO2nGZ0X5BJ+A==,type:str]
+    mac: ENC[AES256_GCM,data:TVnh59knYi6LPEuFrQmvUzsKMA6mMwOyEycfg3FVz7b9oBpCG28Ga4VBDA0PLoCKNym8Ant1SauE69/Tuu6/AhpJYhPx+s6ZYLSNGaiBKl6V/jcVk+hzY0sh2zZNguz7EmN9eSAfllle8MDaBCJVz8pUUh6f+EjRjqt6DNDxf0U=,iv:pNhafgK7PLzpTwuUTLSfB6ZxbFmP8deNrHE0KbvOFPo=,tag:RJ5ccAW3lxeie71kh7Xpww==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/home/apps/kustomization.yaml

@@ -13,4 +13,5 @@ resources:
   - webdav.yaml
   - fava.yaml
   - infcloud.yaml
-  - syncthing.yaml
+  - syncthing.yaml
+  - nfs-photo.yaml

clusters/home/apps/nfs-photo.yaml

@@ -0,0 +1,17 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: nfs-photo
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./clusters/base/apps/nfs-photo
+  prune: true
+  wait: true
+  dependsOn:
+    - name: namespaces
+    - name: infra
+  retryInterval: 5s

clusters/home/apps/webdav.yaml

@@ -14,6 +14,7 @@ spec:
   dependsOn:
     - name: namespaces
     - name: nfs-ganesha
+    - name: nfs-photo
   retryInterval: 5s
   decryption:
     provider: sops