metallb

clusters/base/apps/vaultwarden/secret.enc.yaml

@@ -4,20 +4,20 @@ metadata:
     name: vaultwarden-secrets
     namespace: vaultwarden
 stringData:
-    #ENC[AES256_GCM,data:qUnV0fG+PWy9/FI5t+mLEtjueacG73pVHo6Idf7JDz7gFX1LOc3xfH62HCPei9DTxrbc7ElDWolQ,iv:S5xGUgETCwa8Q4D6soN6GsrE8feg/Ygi/aEu2pzo31M=,tag:wHX6Y6OjT7g3hdwVJlp8Hw==,type:comment]
-    ADMIN_TOKEN: ENC[AES256_GCM,data:mfWrbd1WVvWoPAiLhIxRSuQQap6vOnoDuX3bGizqAOEQ42BvkWeJTuXXNBBp54eZUNKUKF7oTW2saIO//mB8gznBDMt31tQb4xA3b/zg8Q2c4PcyEs7PVO0J168U4k7ItgKXtelrqvfn8eCpmcORuzjcSmj8NA==,iv:6O0I5OPgOZfhNs9q7u/Sk2+piE1kpU+3fm8xtVFfuQ4=,tag:6QSwMvBht9Jt2PYLGkEKKA==,type:str]
+    #ENC[AES256_GCM,data:YF3a2K8EwdcJh7cKD5/fqsdFPI6Vt7llxdIJXcYwaa9VH3O862a63JRGVtMmTtwumU8l6BYypjSF,iv:kiEzXbGc+XcWLAdBURoLabm8EaxDBrUD+kHW7yxiTYw=,tag:xEy9SzIjeBdb6MFHUJ98Sw==,type:comment]
+    ADMIN_TOKEN: ENC[AES256_GCM,data:iXPhYrwcOf1dSVw6eHCt4v56bjLYO2I6la7+2KsCLCMOx7Mpu7tOWd2FW64j5ie0ed3mPzIjpiK0VU2X+/4LWW8F65ACAv6VAoUncFJmmJHlUuWSy1e+YEQIEkV/UA2OzSmsL7AGBZVDJ/xA1HEygUq8j+7J/A==,iv:xV5KqSo023cXdC3eUXW57HjMTji0kb29Hma6UpFGn6Q=,tag:px9oHkCShAePuNfjpp5vzg==,type:str]
 sops:
     age:
         - recipient: age109zta6l0cwpkxn5wek82kvauxn6yqrq80rsz4mvu5atdnpcn9pusuvnqk5
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtQXFZcmpXbUNTYjI1ejFV
-            b1ZkbXlMallmMVl3cm5QU1h2NStBR3V3dWdRCnFhRHZRRlMrdWdpc2RIa0dqMTFz
-            SjdZeWFRTmxnaDRudFpISytTMi9VQW8KLS0tIFFEVjJyZTZKcVFRL3o5NHdET1di
-            YUJDNGIydjZOd3V4bFVxNGhZdXBGb00KOfs2+IxzbOS+Oca+jSvg1u7cbg6hV26t
-            1oWYz6exTsQS6f5U99UWKCQn/OAf5UaqxvHl7mdwi+LL4Mij7dNzow==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuZlgxMTZrZ09DT2RmSlBy
+            NHJzZzEvSDdjK25qdHVucGxobkZVVHdzb1Q0Cm5vWFhuMEdmVzh6ZTdnRmhzV2V3
+            NkJTVHhVV2ZlZXoycnBxVWF0VVQzcmsKLS0tICtsWGNwaU53RklmOGlEbVYxckFC
+            cmgzUjJpZW1xSDhaUm5NdjkyR3RtNkUKr27npr66Fv/7s9GppK2gFkVVKT5/XDEb
+            DpE1Le+eTA5b4/tKOVrqqjXaq7i3TRphJ717gwoI7FBKzMW2CFdwtg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:19:08Z"
-    mac: ENC[AES256_GCM,data:+2Z+frO2M97uPCMWZ46/N7tb3sVZH+8avo1uW2JpUQKxuSIr5+zOQVZRBAw4VQ84RJzLHgGuYMJXv9mFg126b5J8t2i8Y7Oe3Qd5P61gKMrDRCuJ9g2VBgkV23A4Mmei7B0DzvTl9bykK0rSO3eQphIfWx5xTluw+QmaSfvlRxg=,iv:KDNkM/42tEck2Oab8gNm7OUfOzeg9BL+vJfRwFPgf/Q=,tag:Ps5ZToXcxbnwZ24yIp7GDA==,type:str]
+    lastmodified: "2026-08-26T10:19:13Z"
+    mac: ENC[AES256_GCM,data:r9Ke79qGnQVmxXVQEFIjs2z3Q+ZU+qqtCKilmCDUKmJ3uhsfq7vUwojr/yZaGZw6aYPgLXIGLjCM0XgQU7KUOh/AlRqdRK5WXrL8J4WKm5HdnerQs8GgOln0one69tEVJDaEe5yIGfEDFs7zw0qzt/j+tw3hX6+UgrPhPfJ6OAI=,iv:daAXrYdPePuyEXaLohZPqp6ssaT6P6vaUJAxf/yqbSQ=,tag:/XypbhMaO9qBVOLhIE/xlA==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/apps/zigbee2mqtt/secret.enc.yaml

@@ -4,19 +4,19 @@ metadata:
     name: zigbee2mqtt-secrets
     namespace: zigbee2mqtt
 stringData:
-    secret.yaml: ENC[AES256_GCM,data:3JkH3sL0f/19BS73OnfWUa0TSUNNv/uf1G4xZD/EsOwYfHgCRs5JZ9r8Au7+keiTR/UTrflRFc+0ATQfoC/BUWM9Ovr5SHWg9AEmLdOMcJLff6GySvoSNjOSoyoru71D7lWOBTtJ2jiglTQP4TcOzRD7Q9E3RivWgy1FJxc=,iv:vrr2dqCGytzkHaszi+HSuEZK/jKIgg38eYIInJYxXXk=,tag:F8KsoJ+1l1qPI1ikbzKD7Q==,type:str]
+    secret.yaml: ENC[AES256_GCM,data:eVradlSvDUUtfYxqYrGEGgZZiA2XqqCSEuw5K7CkDMmegg+vyg4JZeikIxpli6q64Y65cYzDgFrNOAdMcS8H1EGgtqUDWgzAOCplHM1iuAAGxmIlHXRFicm4K1ID+nGPtNy0oBR54qDVF/FOV6FixSVB2qgE58SXyR99AWM=,iv:eurGAnb4pc4zuGF4uSq0nomD38yy6yT63F5cH9NX5kA=,tag:BnC2t/m7FtNUN1VW8BOk0A==,type:str]
 sops:
     age:
         - recipient: age1tu4xgfefvgdda0vn2thaqndq4p9tuydq2ud6qa98tzzgnff6749qnlcx29
           enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBMTHdFRlJzZDZON0o5eVNL
-            NHlPcE90bW1BZCs5OWFCZURmb2hiZmMyckhzCkJHdlhmbXVGVHVNZmNqOTRNaEhX
-            QTE2TmV1RW9icFVZV2FsOWtydzUzdG8KLS0tIGFTRXZ3ZWlPUkZRRWYzQWw0aUhK
-            VFg0aWxHcXlaTTBJYXMxMmNJVE5Nc0kKdhabjy0J4HYJAarwrq4QOm7sEmvqsVrf
-            qI9CWWOjMh3CtYvVQumzxYc56z2g0hbK5G+G5uEW8aPnQHdzkyZwww==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjZWJEQkNDdjNTWEEvY1JO
+            ZHVPSWtDY2swZ0pDOUZ5cTZLbkJqaFI1dVRvCllWNUdOTU1DMm1sTGxpMlowRk9R
+            aWp0ajd1ZUNXeTJCQVBjbjBnSXpaSHcKLS0tIG96Z3Y2dHVFY2dHTTVKbnQ0VFFo
+            NDNDNXN0b2VIeDA3eUI3WWxrZ1FxUFkKaf51BQseBhByHqWUCMFJ5JQV+jk2V0/4
+            ZrvJBSZO6DsVD1KNd5SdDaCcub4wRMj3UJnNxgvXhwrVkPF57ejoXg==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-08-26T10:19:09Z"
-    mac: ENC[AES256_GCM,data:DV8SQUXaGX2Vf5qcc4maIyykI6tiiWgSWwpeFDh9UhxqJYSJPDdVvv5d623I8Fr25TbvKySxWa7BUOO7OLAnX3f9+lhfQsialjgYZeXtG/lHlPSPgCkjB8bEEt024ekG7KDYTrl+j1UN54UrreLmZFVHsbOOz+NNTQtflhWQoZs=,iv:dHorSqfNWaZ9muUV8RSWEntKVWrL+yma+DiKFWKvpTQ=,tag:OvXiXpZSKuUpu28DYDHrPA==,type:str]
+    lastmodified: "2026-08-26T10:19:13Z"
+    mac: ENC[AES256_GCM,data:Omc1MMSPRbIrrtoi7n4yh0MEZTQzqtAz+cDIa6Haku00NwwItRVgLz4AouyXActKkO4wrcI0Fop9yVjZPLX8kfbfAHyOeYmSGVN2gdWKUgTvaD9xW5NVh6bz6oLylt1Q0LIz2sFw3lMSqKyre/RZnaRuaWZG4D8r/1jl7n/wNnI=,iv:ifQHPE+OANQymzkdxYUlonbvOdBWoDJecqfSQ4f33/A=,tag:s0/9XPev4TsGSnbdV/J5pw==,type:str]
     encrypted_regex: ^(data|stringData)$
     version: 3.11.0

clusters/base/infra/metallb/config.yaml

@@ -0,0 +1,58 @@
+# a general pool for everything but mqtt and public IP facing ingress controller
+apiVersion: metallb.io/v1beta1
+kind: IPAddressPool
+metadata:
+  name: default-pool
+  namespace: metallb-system
+spec:
+  addresses:
+    - 10.0.64.5-10.0.64.6
+    # exclude 10.0.64.7, its in dmz-pool
+    # exclude 10.0.64.8, its in mqtt-pool
+    - 10.0.64.9-10.0.64.19
+  autoAssign: true
+  serviceAllocation:
+    serviceSelectors:
+      - matchLabels:
+          loadBalancerPool: default
+---
+# DMZ (not really, just for clarity) ip, will have ports forwarded from WAN router
+apiVersion: metallb.io/v1beta1
+kind: IPAddressPool
+metadata:
+  name: dmz-pool
+  namespace: metallb-system
+spec:
+  addresses:
+    - 10.0.64.7/32
+  autoAssign: true
+  serviceAllocation:
+    serviceSelectors:
+      - matchLabels:
+          loadBalancerPool: dmz
+---
+# reserve 10.0.64.8 (for historical reasons) for mqtt
+# ! do not forget to label the mqtt service with "loadBalancerPool: mqtt" !
+apiVersion: metallb.io/v1beta1
+kind: IPAddressPool
+metadata:
+  name: mqtt-pool
+  namespace: metallb-system
+spec:
+  addresses:
+    - 10.0.64.8/32
+  serviceAllocation:
+    serviceSelectors:
+      - matchLabels:
+          loadBalancerPool: mqtt
+---
+apiVersion: metallb.io/v1beta1
+kind: L2Advertisement
+metadata:
+  name: default
+  namespace: metallb-system
+spec:
+  ipAddressPools:
+    - default-pool
+    - dmz-pool
+    - mqtt-pool

clusters/base/infra/metallb/helmrelease.yaml

@@ -0,0 +1,15 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: metallb
+  namespace: metallb-system
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: metallb
+      version: "0.16.1"
+      sourceRef:
+        kind: HelmRepository
+        name: metallb
+        namespace: metallb-system

clusters/base/infra/metallb/helmrepository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: metallb
+  namespace: metallb-system
+spec:
+  interval: 1h
+  url: https://metallb.github.io/metallb

clusters/base/infra/metallb/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - helmrelease.yaml
+  - config.yaml

clusters/base/namespaces/metallb-system.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: metallb-system

clusters/home/infra/kustomization.yaml

@@ -4,3 +4,4 @@ resources:
   - longhorn/longhorn-system.yaml
   - longhorn/storage-classes.yaml
   - cert-manager/certificate-issuers.yaml
+  - metallb.yaml

clusters/home/infra/metallb.yaml

@@ -0,0 +1,14 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: metallb
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./clusters/base/infra/metallb
+  prune: true
+  wait: true
+  retryInterval: 5s

clusters/home/namespaces/kustomization.yaml

@@ -6,3 +6,4 @@ resources:
   - ../../base/namespaces/pim.yaml
   - ../../base/namespaces/longhorn-system.yaml
   - ../../base/namespaces/auth.yaml
+  - ../../base/namespaces/metallb-system.yaml