rclone s3 proxy

clusters/base/apps/davical/secret.enc.yaml

@@ -4,21 +4,21 @@ metadata:
     name: davical-secrets
     namespace: pim
 stringData:
-    PGSQL_ROOT_PASS: ENC[AES256_GCM,data:7bx8Fjrab/6Boz8dfx+JMiLgvDhwseYS2jmPledfTz5DEDhCsfCYIOROWvfc1Ng7,iv:FqQL4CWggZ2p3W9NO31/eI27apoahNsuus042c9gCl0=,tag:eTNN7xFObpxF9lz6gcyiGw==,type:str]
+    PGSQL_ROOT_PASS: ENC[AES256_GCM,data:3SbrhxaWZi91aCb1C3AOMMXTJNIKg4EXtphg+sVEXLOwnB2GN6+//RdlMQJlWiyk,iv:u+wz0nit+sTQwMrXqhlLRbfG9AgjHUfTB93NCOMiDIA=,tag:rcwZ4gzJnXyzFA43euj5mg==,type:str]
-    PASSDAVDB: ENC[AES256_GCM,data:VUjEGzaY9Wh/Ip6YYWucTse2z2wNFuAE3KGsfsXMfbnR5shcsxfeZpt9mqZFnOjA,iv:tcXO51kO2xw0RSI0hQJCpzK0/BGaiy3FE729Tdb3zx0=,tag:zsOzh9ZHDgfOcMllAmzyCg==,type:str]
+    PASSDAVDB: ENC[AES256_GCM,data:+BLkel5JWlkNjE3Pun5wDPOfBXvG7r/gGHVjC8YFhA+8zg8r3vpo3ITnHfugKBKz,iv:AhtU+5q0jNPJpGI9RaWOwb2VmNttqsQgIbJBEAtmbCQ=,tag:0Zn5uSyYri/57CnGYFq/9A==,type:str]
-    ADMINDAVICALPASS: ENC[AES256_GCM,data:N94/C9cxiLU/Uxn37jf69OnZeO5bdcW/4FVRJTPN81c=,iv:wGKk3fcbTv32VigsfBTtBtD+uSqm65Nh98qyjVEcGWM=,tag:fwLuybdZ4wwNkazc+JzBdw==,type:str]
+    ADMINDAVICALPASS: ENC[AES256_GCM,data:qnI1IHWFbIsFC9+R7GqTEGYGveQgdGnDCX3bQ3fx/8M=,iv:sur7bTLfIhzRXkpZqCnpAcC0zJABcorUnFON/CCofX0=,tag:xQDqIX2Yh3KQ1gxxJkTM9Q==,type:str]
 sops:
     age:
         - recipient: age1yx8mey02c0mu6te9hwxwdqp5n4enjz35e8thchsmvhqw7xsrzy0syg367g
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBiWXFrVkd3b2VjSnI5T2tG
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBGVGxKM2lBczF1RUpoNjNN
-            cCt0V2tadHd2dUZPUllKcXFQamVqOTRDdEFrClQ3RUdYZlgvdW56MHNaTEtjTURs
+            V1lwWWRaR1AvbmIweFA1OWZONzJBeUpRZkMwCjZFWk9SaXE3Y1FheFp1RDQwT29Z
-            eDIwMlF0OElNdWlmM1lFb1IydTgyQTAKLS0tIGxRTGpUd2RpNk5YNmt3dU5uL01Y
+            dHRnZ0o4YmZMNjRLSVoxUUtVdDFzbncKLS0tIDJRVVF6d1dXVk8zZWk5T2I2L3py
-            UzhpYU53OEVaZjZ1YmhFZjgwYXJRK1UKoec36NYEQNkkFZLiZXGWjxHfL2bBN1E7
+            WlFldHRpd0tGQUUrMHdhN2VyUUdQREEKROy10ziP9lTH2BCox1V3ymUj3KdncVM/
-            PhLQT+N2JpB7Bp/yqj+EGEi0QPASfJtCwJfN8RnDy7qO51cZLnD7Lw==
+            ozCzPGF7dlBFXSVGIaEbv2X/LFq08MtoY4EGNEIz9L1jGg+UiVsVEQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:24:31Z"
+    lastmodified: "2026-08-26T10:24:38Z"
-    mac: ENC[AES256_GCM,data:KRLrJOe4+B0Tjou3wzlFWJPLYfvrgEwTnzYgB/Xo3iImZ2uolRTEeScQtkYFIPY0plYKXb1jD8Jbgy5k/dTFU0ql6VsyJMO2SbTM3p4/iHd/UC7NXopkylL48801zqMRFeetp40+Elh+RtjsyT4EMXim39x9LVTzX0dE1JhP/U8=,iv:6ETslSUHlGoBqyNP10aL5bhi0Rdmg+58gelCQIXRGlg=,tag:NpUS9v+Nr1WSL3GbRCgpDg==,type:str]
+    mac: ENC[AES256_GCM,data:l+sqZt7/Q696BqM4wJd7dmS0u9tS2fB78BazNX0TdRU+prL3eAIks5CTSLzNeuh6I3Dw1eBGVB2mN5fUAsL04tn9iCMPuR6Lns4njuRdUeT1w6aW9AnE3mkIFOvEb3XIIqflyg5OtZgt+7ObZ1WJTyn3sdyjZ5kIacn7yYYN+Xk=,iv:NLmRYO3KBIC3p2zlWC6Jl3ROeS++agH2XK8FhA0yZ4Y=,tag:dEKs83iENjJtIzzQE9zDuA==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/markdown-vault-mcp/secret.enc.yaml

@@ -4,21 +4,21 @@ metadata:
     name: markdown-vault-mcp-secrets
     namespace: mcp
 stringData:
-    BEARER_TOKEN: ENC[AES256_GCM,data:kh/V23DnXeNuo2qGgYgzcDeTl4JyTFMzu1jOMukiMw1KU24cg+w3vff+N7y3qDgmPEINdWLqsquFFgCPcK25cQ==,iv:IpchFcO9xk4Pctpa0dMo6tXAvKeXFAbgLiCdBxat1v8=,tag:kR5NuWlCuR8rprQH+FrIcQ==,type:str]
+    BEARER_TOKEN: ENC[AES256_GCM,data:Dls9z/zJlgm6gpTTkx2cp5FjmkzHRCdFFASU9DXoT6/u2ospxNiCd/nn0XIb5LuDJvl5illYRtkE02A/cmb+0A==,iv:aPQ8UQzCXZA7gvemqEypqqOE6gfYDszNQtZUUzNCnLg=,tag:KTGCPclgYtF4EENfZPxEpw==,type:str]
-    OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:7mqI8BtyIphy7IU1F8KAOjmnQ2l5iGhrAtUjHDVK8NiMi5zgGHcjXwma1TVWgd389sk5nbUph9Cr+FquRoKFKA==,iv:SmCg5hD4Os40UPJgDo5nI3qHoxYap3R98KTY0E3uWjw=,tag:WJdP1XWfDFjsu4mNbkMNgg==,type:str]
+    OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:Pud6a27KtOltFahrhbxn47bFR1bixfZnxtEsu9dXCuVOWqVM+LQYYG0JzH5Oq25znQbGfDoc2ose+5HUgrAOIg==,iv:csPoWHMMpvoZQY4hI8yrsjav45CDuqsQmCb0ofM40mc=,tag:gjEJcVfADUx0Hy8lBy3U0g==,type:str]
-    OIDC_JWT_SIGNING_KEY: ENC[AES256_GCM,data:DByWaGf2s1BrC1hixP4NHsC5aJBO/3rCYm5ndJt9l8SKd5crMKjhV8Ey1Q10F7dU+51C6qnv0r8G4a9SSi/Nmg==,iv:w4hxA+n5JY3LoG0uNDTLIMlcFy/YdzLktceG/OAIiW4=,tag:Cm7cHI0HmNv/YavavQSQYQ==,type:str]
+    OIDC_JWT_SIGNING_KEY: ENC[AES256_GCM,data:tSjc1lZjEOQvsbPmtshH2G6rPwnUKFdm59qC3USdW8qWKWvZGqb7HKIkbBdFI9EAgDNRaC5/tbfruGv+0ttmwQ==,iv:aVmcDz+nIooJI8/5pioDttB0gPKL/j5dBoKS3MthJmY=,tag:ETA3eDCSHUlQhkgKKOD+HQ==,type:str]
 sops:
     age:
         - recipient: age1kct5g7d7eus2hvdnmx99ewsrtz70lhlasxa25euqwdctqhwqqpxqz0n7gg
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBwMzNzU0JGV09weDFraWcx
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBZaU9NbVBuR2EvTU1WQW1E
-            cFY0RVd2VEpUMFlxTlhqaE5MM2VrRWdHenh3CnA0b3hpVzVRSWhoRHVzYnJjYVdv
+            RzNnVjVjUDJRaUNhWnc5Mm1JMU8rSWdsS2pNCmNHRjlxT2N6WXJPQWJ5aXhGYldz
-            N3FtNVZtSksrdUlnSFhpR09JMDd3bVUKLS0tIG5lWHRDZktFQi8vaW80RnBPbU1s
+            REJxMXh3Q1picitxMkxzQ29ZWjFxSDQKLS0tIFdPTTVsN1FjUE02VGVHRGhCTjFL
-            N0dsQWZTeXRnRzlIV1FyTWpiSGEyWjgKTrEcTDzTwLzCnI3eKlnX/P3b+ZojaR6t
+            azV3VThuMGZBdVBPNzFJQW1LKy9pZ3MK4sRADQlvi9IJmIFBChqF2lchp6X7ni0M
-            9wjjvx9ouZS8iGl4qaAaOt9fDApd0UZOZAJiGjQYVNFfyBb4wzax1A==
+            GGy+KEXT3kh549h2oX77GbGclc7/2Y5fOY+XCfhKKM7V9YqMG6INhA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:24:32Z"
+    lastmodified: "2026-08-26T10:24:39Z"
-    mac: ENC[AES256_GCM,data:dy4OM3EfDAlf4RUtQED/zOs3n5FglA0J2RA8gSaAV+mrfM5+mMzadl9WId7cVCOvQOWjWGiDa7p2POM2Lm3nM5JF0WZWJJIX71vqpzxrV0j3i3K0XDMw+99ZlBOK5+wAXbMQ6cNLTxi0FayFWzqGIdJvZLvkXp8qG2IdZ9S9H9w=,iv:y6QaYxaqb/ThxCC8HUK2AxgrGV0uOdpT09+vf3m35cM=,tag:RC6fmIx9geBaSaKB+wUrYw==,type:str]
+    mac: ENC[AES256_GCM,data:JfBcwe5zgdZOVb8ilFOw59WGM0mtbAFTg708rH192HJm+6tG48qxND2FJwjSw6N/edL8m0txyqI15YVWm9hdGZ9tEKZw4m5gpC14DjOmrgDanyAsJA1sMwqIFnoA3Js44KeilL9quMVWGbNvAxiv1d+UWJd/b5LG6kiIXfTDNK8=,iv:D0dvYEIPlqFSn3GPNzVGUVM2vP6jKYm/Zs7CooWrJX4=,tag:OiF26RAtrtxcpPg70I0fSQ==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/mosquitto/secret.enc.yaml

@@ -4,19 +4,19 @@ metadata:
     name: mosquitto-passwd
     namespace: mqtt
 stringData:
-    passwd: ENC[AES256_GCM,data:kJ9FesDX3AGfmUHQZo8tpVliT9bQX8NDAlCvK/jXpTBPi7Zk0l29OpuF6+f647r3BWs3yExKV+x91Z9am5BfirpkJG2B9NBpBzVxkPsYQpXL1PZcGMmJ5xMB7GzeABrQ2gjU79VzAeoLViOz0J9SymwLdIxXhPN6XjzdgkIaUVwVGbMTTuOuLTdaQYYUimcykkSgERa1AO+YCqZ6nP1GvZnRLrOWnX6blanR+lGNja25H8xUQPVVbgSlJ9OJEw==,iv:bs4GN0Oq6aL2UySvQljYfb2PjEed0lyrY9MnPHGuWWA=,tag:leTkO8JoOFzDEg0r/nZMDw==,type:str]
+    passwd: ENC[AES256_GCM,data:8bI0S6jNWiafP/wR48U1jEapC0GON3R20eZ7NVFOKwMIvsTy4XnHD3J/Zx/nwS5eYL7HHMQfoShARlJpIMfKV/Z26c4tTbFExMIFvbzVFjvB3MTYkGNnYWwS9kDxkqCy2fjA4oiL3bYbCJswC9aHn/JVvTrw838e6bRgVFpX8iVBXmFKxJ3e/BJVoO1a3VGKbJd0GA2wqDDpAfNLpypaDkO09VnvgybRT4qiD5Fqh9MiAGoaktiClheiJog8Hg==,iv:mJxIk5ko+ARDY2bis3adZMqCw9mjIaleV/10bOCQQHI=,tag:wamDSCTYQe1mQMgjmIshCg==,type:str]
 sops:
     age:
         - recipient: age1u236u5mzkzj72y4mfxx68gfqw0u0j6tdgkudnm5pdfpe7apq4u6s89jr2h
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJODU3UkpVbnZJQUVuMUhN
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBteVpXOGp6RTdmcUhNTllI
-            M3h5bGZqcExIenlRbEo0Nlo2aWR1dkhJdkdRCldVRjcvZTZQblJzNmh2ZlRDanlt
+            Um5uMVVMTUhyWUQycjJrTnhUVkUrR1k4L0ZzClNhQVJpa0l2Y1Y3cHVhbDh0MnBN
-            eTFIOEhqYlpCQVJDSUJQL0I0Nnpka0UKLS0tIFhyU01KWGFKdHhNL1dUV3E4VTd2
+            amRGbFRKWnF6eC9OZUVjdnJYR3BuemsKLS0tIE1SY2dsTXNCbDZtQ3pWOEtKZWxE
-            eVNTbklyL0xWWWswekx0N3QyYkxwNDQKQHYVZLJqlwdEqYNt1J1CPnR7QMZDEMnk
+            dVo5Wlhza0hYYkJzeEltWVBkT3JPMFEKksY/3Xq47INPsm/E/6v5h6o6sWo2h0hl
-            t5KUFsp0KjEufC+Cw0E5TCsctdCPo7Xq0MXvTwNm+zst/No6eZDydQ==
+            rYV2eT3WoW+skiTmjJprNcztBRGkeuNYjUTONLU1YPEzbKc3thsXkA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:24:33Z"
+    lastmodified: "2026-08-26T10:24:40Z"
-    mac: ENC[AES256_GCM,data:BI0ipTNxhAL9kfB3e/XGK0FF2vCWOC8U6NCUj2lAJ68PzEUIYMiSTPtnQP0xDhZBPvh14GcEvLAOwleMx2P2tr9Z/V06owQ0ADMhh/v9tK2QRGB2nE/CtuN712bX5SimrGd3zMhHl7sPegR/6VcKfEmLrFNM8xT3TpQnPpiyMVQ=,iv:bj+h7PKVbo9oRb3WPFy7sfwPnUlRKNv3EdnuaiPIHWk=,tag:Gw2+S8jZJwp8aPUgKx7U3Q==,type:str]
+    mac: ENC[AES256_GCM,data:H1VIjyPKj67+wPJRom5hHfac/JnnDh5DlngIzHcZz3sweoIheTdHB6f2is0LoYusCw7dkT5FWo7TVMFPVfAQswi4ABekV6FYNFc1ityczPvY6saZ7QB93jpbuw6CGe7i6BSc3sBqe5/HTm7N018i6m/jgVf85rQje/ncoZVLjHA=,iv:QE4IwhLJgZYwPV8pjsvz5aKQEYOPfbOIWPhXgLtJgtI=,tag:ojw5dWWI67wcJa5anXI5jg==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/vaultwarden/secret.enc.yaml

@@ -4,20 +4,20 @@ metadata:
     name: vaultwarden-secrets
     namespace: vaultwarden
 stringData:
-    #ENC[AES256_GCM,data:JP87rgom4q/s3ykVtq/Y5ydyarcTKY+d8zI0N2Z48aSNt9Qlf4PErC7xrNfZMS2+RSzo2j1yP0Z+,iv:amXDAre4YuQ4tQdI/Z3//qepOau5pn48oMjODlASI5k=,tag:x8ShvNns0umzfX4dY+17sw==,type:comment]
+    #ENC[AES256_GCM,data:qEwbD0WOBGKbHEadKbVrQFT3eEguv1z5zLE0phWR0UTqZFAzghZ7ukJ5sSxTnIIimEuJj7yjxCp8,iv:Vee/6zlg8VWR9DTzGV+h1+bIZQThXPdKiHg4bcnaywY=,tag:H9Tz93LXdb3O9P8WfBDA6w==,type:comment]
-    ADMIN_TOKEN: ENC[AES256_GCM,data:o5lMTAYWqTQd6wxEKrwaK6yw4sVtkfpuVUeGLOlxQUbbgQeeYVdzrXQJFJdXMuK/Zzyyxq5t7BtOILXC9E5e/gmYzHiTAhfbUSLutw65R8v/Wne54+CtwBaSFRJMbM9NgXpGwz3mcPpA79zWqNWNYEcSqCxyoQ==,iv:fIMuMh9qpWyD2kckdEWSB/XFrjUekvV9b2CWU+GojEY=,tag:+p6BvqOja9TTHZ6RENiqmw==,type:str]
+    ADMIN_TOKEN: ENC[AES256_GCM,data:MteKaMZ+U8Z9OUSrmHG4h8X6XyFFrkiDK7A3fuYOEfUFEFJ5+W5/RgcnZN9OFpA339/tV2huijyBQ5MvgNd0oFhmDnAjVAClawmsfi9CXVtGkoU37orLSWOeM+eg4jMsfQeY35ij+mBso9X5877o6kzW0XAIYw==,iv:s75cMko66BeYhcXybLuMKpqy01rVFyca59ehUdv2Nco=,tag:bOB7ATkD0IhkPIduAvej3Q==,type:str]
 sops:
     age:
         - recipient: age109zta6l0cwpkxn5wek82kvauxn6yqrq80rsz4mvu5atdnpcn9pusuvnqk5
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkTkQzd2E1Q2tvNlc2Wk14
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0bDdtOTNhblJyNittY3pG
-            ckdZOHpaK3Ixb3IxVzJBUnJZNFpLc1RCMXc0ClN2dFFvaSsyajhmTG1IaS9MWUxZ
+            Yk9jUmdDZDg1Q0Q3dXd0enpCbkt3M01DQW13CklaamlEdTVpY3lJdmUza2pNQkt0
-            T1JGVFAvNzlQK1B1bmVTRnJYT0pjU0UKLS0tIG1VS3I5alVJcWEwUVA1cjMwcExl
+            c0pkT01BZTFGYlJqWmVZeG1peDZQcFEKLS0tIDZueGxLMWNJU2xmMnAzbXRlMkdG
-            aXgvclZmckNmKzN3YXgvUjNsMTBoYjAKYXhhW/h4pD5Tf0ZxYz+yH7sh9YrJZGEB
+            aHExUWVOOStNTjU1MVB3OTVlWCtCUFUKyb4jikFMzgme15g8ydIhGZCrsYf0BOq0
-            iRalLEq8B5FXuYGrKc0VSpX4xB4AoZrfm7iL8L8yI1sy4X+OdlQa6A==
+            +1mKdnbGlbbqMbnUyglvEQIWBZDijge3Hb1oRd5NvwNHEVtdteYznw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:24:34Z"
+    lastmodified: "2026-08-26T10:24:40Z"
-    mac: ENC[AES256_GCM,data:MnveI1MrZb1SIwVd0W982lOPGq4F0FLb71lZOsPMhpYE17vBETPx4R+hrwyXJXwZhGRdUBodoMe6rwjHN2OxNjJfvR89V1fh1IrSLy340buSSKaP0D5FoEU6wwDO66y/A7lLBVIdVEDdadMWIr4oCSxKoPWeKRVRdFkhi5C1X2c=,iv:WfoakkeL14xMO/xdhRBUkeGzEDYTt5rKBcQGsMkj5xI=,tag:UKSyS61LdDY807Qu5cLaLg==,type:str]
+    mac: ENC[AES256_GCM,data:XLA4LwzuPbCaMvEXEBzhqOmUzGp4kl0bo/bVDo4yjppHYJ6Wfk3m9CmgtywhKIMeFmlU7/bl8bFWGHFoMok2TyA9vqio2lsnuhvg/85fs/iRhsFqkzWCmD0OUMMVFuaEEji9AD43MyYmtYatG5IaE15SIavooLZaGhxC7U91F1A=,iv:EkMKOnZnGH2I/L8tYuJzxgNR66+wUtPlQhVlpYdr3Vg=,tag:eby0Wp6X7+S5e7UguC9IMA==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/webdav/secret.enc.yaml

@@ -4,20 +4,20 @@ metadata:
     name: webdav-secrets
     namespace: webdav
 stringData:
-    WEBDAV_USERNAME: ENC[AES256_GCM,data:xMb9k3g=,iv:zXCe+5fsYMj9C5jf8i1poza25RiXgkUwekJA26GcGPc=,tag:aV2DW5W+6gUTnfdEhTRjDw==,type:str]
+    WEBDAV_USERNAME: ENC[AES256_GCM,data:zhpwpHI=,iv:OFBaRvpePxvrabbQjjuWRob0gM5y1nYfV7np2TVk8YY=,tag:d7I29iRd1d+9UEL21aKOYQ==,type:str]
-    WEBDAV_PASSWORD: ENC[AES256_GCM,data:QUd37e52kOHjXIiUigvMTSepabqD2qV+xE4I7JxLRYhCUZoC0LH5v/9zEqICbio1,iv:frtqJz1BdB7vkM4drDY9/QgdPHtr0svji6ewDj9WPx8=,tag:+cNAWX8VTx/eAsVHyf9e4A==,type:str]
+    WEBDAV_PASSWORD: ENC[AES256_GCM,data:qVv7IvzTGGHddlc5mKzeVch0HHHJMJimv3EMtFRBQZG42CbcKfEk27VzgciRbFUN,iv:jPV5hQ+cKWkoNl9p1XoptfFQkeDu0gKCGs2zxggqBw8=,tag:zVh7e2eDjLvK68TSyBH8Lg==,type:str]
 sops:
     age:
         - recipient: age1y8t9v56yuvskznddqfsd4yddzzch0yf2dutvvt8rrx6rjh5f9g0s3qeays
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBlNmFhaWlwSy9NWUQyMGp3
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkcGpEZEFQOHlVWTJ2Ky9o
-            dGpJM2dLQ05zK1dSdkF1SGxVSnpLY3NILzFBCmJtV3I0MnNsVDhZT1NzcTJPdEVo
+            dktKNno4ZUJkeFZWRUZ6VmhMa0M3dmlOQUNvCjFMQncrUE00WTd5amlpNU5tcWxq
-            Q1d3ckpIbE9QS3d3QTBEOHV5K2wrZmMKLS0tIHNoNjFUblJsOEdYSDhiTlZXVGFH
+            MzV0MTBwSVBhRytJbUp1UVA3NjZHV0EKLS0tIEI4dmYxUmdGWHFFUUcwdnlYRUV2
-            V05hR0xtdm42RlNqQ2JTNWYxY0dCOTgK6FBeM9qw3T7DzKHnF09T41/wt8yzYWzX
+            UC9pRU1BenFKdU1qVlN1ZnkzVEUwdnMKafY8OyN3X4WTy5bvQwqXZysoeZj0EUrl
-            7zT5xodg/alaGFtQhVFXg4JxAuHMeaK+1/YcFZbNDcQtcG/yMXcKLw==
+            8cOM38/JU+ryoMttpNdFohUYAvk0BBPIufNG4VKgNM/tZSAQtbyBJw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:24:34Z"
+    lastmodified: "2026-08-26T10:24:41Z"
-    mac: ENC[AES256_GCM,data:b30c3X3LZZ/pcgcftWXiOMU+GIS2h9HXvPfX5WRcDYysMaLj8esFxxu665Vf4tLnFPWVIJFVAN3PKi/JjiX8O3JRNeQkMjuhmpc2WO1KkK5tOhrcMSJ2CGffByjkzcOdP6N3O7y+6l9Oq5cgK8lsM50biqJQOf9d1dJ94kbW3F8=,iv:BQ7ZKobanK7GEkTyoLgWi3YDH9ynfoaIvoMSsCmYK1o=,tag:wBolaGB0bihSEkw51ujjCg==,type:str]
+    mac: ENC[AES256_GCM,data:syZa9/EfUESO2ZomxNnxpjAiRLP9dplP+BeKckShAT9eoRNThNl6gSw8tTJpe+hvOWAvXdUg0nznDsWAPcOHGLu9FRMGlqnLrEkr80w3MzmK2w75+oQ3pcrUX2zWfgQJ3GoqgCvyI9P+9NUgz7W5VWio/ujAMNbBsmE3PJ3bNQY=,iv:T0U/ZaxKnD0wJBOoYgc+Zfo1CDEcQcAJaaJYHIVIyCQ=,tag:2Za2nMP6yJPHnGDk4gKKRw==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/zigbee2mqtt/secret.enc.yaml

@@ -4,19 +4,19 @@ metadata:
     name: zigbee2mqtt-secrets
     namespace: zigbee2mqtt
 stringData:
-    secret.yaml: ENC[AES256_GCM,data:nNRrcmozEsO8OZJiatsLnJej+BvOJ5i1E2s8MbO6WqjgrskyApioDp0BAKKhwq6YoXql7ebXtXye6TpGj/FgcyqVR9xkDqEcEZWK/oqG8XNYUlB9GB+j95PKkrofQelhVD8Vaz8ZxVTorDhhpgnHdgZyFL2OXfKoVOBk608=,iv:x0SR6xuQ/vX1F1AtgGGi6QZMDhjex9uj5uiy7RMkTwo=,tag:X7v/07ai0Vu9tMcG1sPLaw==,type:str]
+    secret.yaml: ENC[AES256_GCM,data:42t6DguWcK3Xy1HTAfjShdBXrhzbMOtma3QCd1VpH2nGtVz4abqmPUAvo8avyQW3wRunFKNcn7FytX5zre4Iy/5rmVjr70/6LVCTK5eDvplMVBQXB/dcWqvps9pCSL88lcC7ZGQoDLrGKRFsozndUhTKHi4sBIAD1JfzxHI=,iv:N7VW5qyFZY2aMj4eGVnbdsAYn1TVDFCcEQ74pLBEj3Q=,tag:b7iISu0nSP7cp8b+MJsvUg==,type:str]
 sops:
     age:
         - recipient: age1tu4xgfefvgdda0vn2thaqndq4p9tuydq2ud6qa98tzzgnff6749qnlcx29
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkUzFHQlZ6bXdaOWdqbnF6
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA0ZXZoQmpUR1dHRXVLeFhE
-            VjZ6aUtGSGZHYmdTdnBTM3lQd1BMV1Z1OVNRCjFiUkp6Nm9oMjlOc3lJWkR0VDhG
+            Ry9jVjMxQXJaTEV0bGpBUkgrald3ZzZYdXhzCmtzcktaMkQ2ZGhGSnVYYzF3Nk5I
-            WFN5bkYwL0dNbWJkbXQ0YTEwNDJsYm8KLS0tIHBvbTZPaGdRcW85Qms4emwxajhU
+            RENMTFhkZlJrMEYzL1krY1ZZUE9Fa3cKLS0tIEQ1RWNwWjhTVmZ2QUMxdVlRS2Nk
-            czFYdktTdFMrSlZuaG1rMmM2aWhJZzQKvSABOsNxXLWZB26faGH8wdI1hsAZiZUL
+            cEMvajdzMDVSa2tpUytlRG9mbHFVOGcKdhGVW/IYKclOeEHJP81AG/onyESCt74S
-            ffC4ZxdiWv6YbinE/jPEkWkwu/2jVxyoanq1E3yP/K3lmqoCCJgxFQ==
+            Jjaa6i0xZfz7v4xDX++zHAdFwU5hrJlmDADxJSItPzM9xtL63w9fIQ==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:24:35Z"
+    lastmodified: "2026-08-26T10:24:42Z"
-    mac: ENC[AES256_GCM,data:7WggLhRjzoMYMqvDlXemj+Wu9qWkW1zVmscqL2tUUv3WAtIJXm0GAMZ8BmAem33IL64Zxy8KbYFqNNKTEhMKRezUDU6uwA64zZJGccCxWvveV8Kqt2kJziPu5WK5inhIOyjjqmm510U3qeYxssDN+yM82ymVil4lV+S0LS/A3uU=,iv:wzGKLdzpg1ib87S8YPLy1551an7FN8XLZDmt9YNn1ro=,tag:vOJGWzavUGLHwSbF06cB/g==,type:str]
+    mac: ENC[AES256_GCM,data:pzNq4ncG3jrnSrCbXN0hRpehl7JndJe97je8yTf7zRljCM2LPXiSpfAG0RcMhHp4B7PfkM/GQiZycWrqdnDT7nhQbkecHGaSRV/p2cz8GzTvaDHz7aJT9um83Ikc4AJOLvlhh9HDLDL9FtA17jmGVX9TPpclPvr1osz/85yPQGo=,iv:nmjFm4YKEwPOE4EweTWpOsmu3oJUq3ZRs33VPgSOAz8=,tag:G4WxXA253tODG5hGuJx6JA==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/infra/longhorn/s3-backup-proxy/helmrelease.yaml

@@ -0,0 +1,97 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: s3-backup-proxy
+  namespace: longhorn-system
+spec:
+  interval: 10m
+  chartRef:
+    kind: OCIRepository
+    name: s3-backup-proxy
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      app:
+        containers:
+          app:
+            image:
+              repository: rclone/rclone
+              tag: "1.75.0"
+            command:
+              - sh
+              - -c
+              - |
+                set -eu
+                # crypt's password/password2 must be stored "obscured" (rclone's
+                # reversible obfuscation, not real encryption on its own - the
+                # actual protection is the passphrase's entropy). Generating it
+                # here at startup from the plaintext secret env vars means the
+                # real secret only ever needs to exist as one sops-encrypted
+                # k8s Secret, never hand-obscured and pasted into git.
+                CRYPT_PASSWORD_OBS=$(rclone obscure "$CRYPT_PASSWORD")
+                CRYPT_PASSWORD2_OBS=$(rclone obscure "$CRYPT_PASSWORD2")
+                cat > /tmp/rclone.conf <<EOF
+                [wasabi]
+                type = s3
+                provider = Wasabi
+                access_key_id = ${WASABI_ACCESS_KEY_ID}
+                secret_access_key = ${WASABI_SECRET_ACCESS_KEY}
+                endpoint = s3.eu-central-1.wasabisys.com
+                region = eu-central-1
+
+                [crypt]
+                type = crypt
+                remote = wasabi:kubebackup
+                password = ${CRYPT_PASSWORD_OBS}
+                password2 = ${CRYPT_PASSWORD2_OBS}
+                filename_encryption = standard
+                directory_name_encryption = true
+                EOF
+                exec rclone serve s3 crypt: \
+                  --config /tmp/rclone.conf \
+                  --addr :8080 \
+                  --auth-key "${PROXY_ACCESS_KEY},${PROXY_SECRET_KEY}"
+            env:
+              WASABI_ACCESS_KEY_ID:
+                valueFrom:
+                  secretKeyRef:
+                    name: s3-backup-proxy-secrets
+                    key: WASABI_ACCESS_KEY_ID
+              WASABI_SECRET_ACCESS_KEY:
+                valueFrom:
+                  secretKeyRef:
+                    name: s3-backup-proxy-secrets
+                    key: WASABI_SECRET_ACCESS_KEY
+              CRYPT_PASSWORD:
+                valueFrom:
+                  secretKeyRef:
+                    name: s3-backup-proxy-secrets
+                    key: CRYPT_PASSWORD
+              CRYPT_PASSWORD2:
+                valueFrom:
+                  secretKeyRef:
+                    name: s3-backup-proxy-secrets
+                    key: CRYPT_PASSWORD2
+              PROXY_ACCESS_KEY:
+                valueFrom:
+                  secretKeyRef:
+                    name: s3-backup-proxy-secrets
+                    key: PROXY_ACCESS_KEY
+              PROXY_SECRET_KEY:
+                valueFrom:
+                  secretKeyRef:
+                    name: s3-backup-proxy-secrets
+                    key: PROXY_SECRET_KEY
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+
+    service:
+      app:
+        controller: app
+        ports:
+          http:
+            port: 8080

clusters/base/infra/longhorn/s3-backup-proxy/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: s3-backup-proxy
+  namespace: longhorn-system
+spec:
+  interval: 10m
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/infra/longhorn/s3-backup-proxy/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - secret.enc.yaml
+  - helmrelease.yaml

clusters/base/infra/longhorn/s3-backup-proxy/secret.enc.yaml

@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: s3-backup-proxy-secrets
+    namespace: longhorn-system
+stringData:
+    WASABI_ACCESS_KEY_ID: ENC[AES256_GCM,data:rgc0xjmQKckyC6iT5fBP4h8g5uU=,iv:MFuYH2N5Ek+UnQT0B/VEERvHGRywbNLLriQ8ghaZVoE=,tag:iCO6vu3S1vpZRnmPRLZ+Og==,type:str]
+    WASABI_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:XUyJjhl8nzzUhHOIISSIFPiWjV9/SxR2U9S92jwG9sZCqPSZY7h33Q==,iv:Z0YDFHAheLzYO8XWA378nrr/4y4IfDRByoPa607Py2A=,tag:Pu6cvQ71jBbqh/jpxjU62Q==,type:str]
+    CRYPT_PASSWORD: ENC[AES256_GCM,data:PSW/dxh8y1BDswEAy1VGwKkmuqr+yXxITkkFq2iL9W+neieuZd4Z2X8LHw==,iv:30ozLFfNQI9NzEdvDhFTJl+X00UiiaFRL+oGqB2eDHk=,tag:f0fgKn8hPZZIsE2KUMi+1A==,type:str]
+    CRYPT_PASSWORD2: ENC[AES256_GCM,data:c/MIyhK4yg5wYaB2aZ2b3UYm0T+JJDtMYrDruipP0ZmdmO/sz33EtMNPTg==,iv:YodQc8tXVUBU2Y95lazG3MoawIyAYAPxyGAEP/z9dpY=,tag:AyMDKO1iK1c3l0kMuuxcfQ==,type:str]
+    PROXY_ACCESS_KEY: ENC[AES256_GCM,data:PVKKx8YBkonrcDMFcEx0KT+UJ+g=,iv:inuyggvzMGgHi6ND8FLC4yT7Tyis98Qkg6XJf1p0/x8=,tag:eU//31BKXe+p+L6G1MxQQw==,type:str]
+    PROXY_SECRET_KEY: ENC[AES256_GCM,data:7sWaULr5rjlAj6mUiXjAmE+RgYFRvmTpbqtuG6KfQGrSSgkqkIzD7Q==,iv:pVc3Mec6JkpV8GlHWdZW3t4zM3AnLaFjFFAZRm4HzbQ=,tag:+O645+nh6F3REnplyzFMPg==,type:str]
+sops:
+    age:
+        - recipient: age15vc3geq4lsec69rnxczluvwgcexeqae02zxzjpswsuatthaasu7qzath48
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1MFk4SG8xUmpYd2dPU1Nq
+            RWpOMWQrSkRXTjZzSkZVOWJIdGdJZ3hSNnlVClhBaWc2NjJkaFFheTZxL2IwRWw4
+            SGp0eWR1RDI0ckx3MWNLY0M2dG14T2sKLS0tIGczVXg1ZnZRTXIvNHZjaWVmQk95
+            SXE1RGJyOVFhQ0NnUkkwNkFkNEI5Yk0KrqnQ3qUem0Vk1Wepr4oTcrVRNm2K5h8s
+            IAo92Tq7NA3w73z5ihFOcsUMO3JG0qZRJSkmamfc2omi5WlkY/ZLnw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-26T10:24:43Z"
+    mac: ENC[AES256_GCM,data:UTajx+N1T/heelIZSaJdBr732PACcJAS4c0ghu79wHkWXtfUuRLtpd/4lCCFbToaBlX7fHsQKb/DDX5pUNhBwGCuRMBXSHKf8HSDvOUIVlMeBH+HbiDSdUvrhJX5KDD+5DLgmLcPis8sLG5nBSM1n6rkC84KQcyG3aZpJgJRPSE=,iv:DkUkP+v/1EMo2WhpVRGsgAFPEALKuH7G2BSG1qRfvBM=,tag:NMhFppGT1bvqiWChIIDeHg==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

clusters/home/infra/kustomization.yaml

@@ -3,5 +3,6 @@ kind: Kustomization
 resources:
   - longhorn/longhorn-system.yaml
   - longhorn/storage-classes.yaml
+  - longhorn/s3-backup-proxy.yaml
   - cert-manager/certificate-issuers.yaml
   - metallb.yaml

clusters/home/infra/longhorn/s3-backup-proxy.yaml

@@ -0,0 +1,18 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: s3-backup-proxy
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./clusters/base/infra/longhorn/s3-backup-proxy
+  prune: true
+  wait: true
+  retryInterval: 5s
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-age