apps pinned to exact version numbers

Fixes IsADirectoryError on startup when the app tried to atomically
write its change-tracking state to /data/state itself.

.gitignore

@@ -0,0 +1,3 @@
+migration-from-old-files/
+migration-from-docker/
+.decrypted~secret.enc.yaml

.sops.yaml

@@ -0,0 +1,4 @@
+creation_rules:
+  - path_regex: .*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age14x4jjs2fwdgw28g2pkr6jyj2yzmwc544xwmaaglrxwz5e99seutqtr8jv5

clusters/base/apps/authelia/helmrelease.yaml

@@ -0,0 +1,70 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: authelia
+  namespace: auth
+spec:
+  interval: 10m
+  chartRef:
+    kind: OCIRepository
+    name: authelia
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      auth:
+        containers:
+          app:
+            image:
+              repository: authelia/authelia
+              tag: v4.39.20
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+
+    service:
+      app:
+        controller: auth
+        ports:
+          http:
+            port: 9091
+
+    ingress:
+      app:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: auth.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: auth-tls
+            hosts:
+              - auth.aggtaa.com
+
+    persistence:
+      config:
+        type: secret
+        name: authelia-secrets
+        globalMounts:
+          - path: /config/configuration.yml
+            subPath: configuration.yml
+            readOnly: true
+          - path: /config/users_database.yml
+            subPath: users_database.yml
+            readOnly: true
+      db:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 1Gi
+        storageClass: longhorn
+        retain: true
+        globalMounts:
+          - path: /db

clusters/base/apps/authelia/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: authelia
+  namespace: auth
+spec:
+  interval: 1h
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/authelia/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - helmrelease.yaml
+  - middleware.yaml
+  - secret.enc.yaml
+  

clusters/base/apps/authelia/middleware.yaml

@@ -0,0 +1,14 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: authelia
+  namespace: auth
+spec:
+  forwardAuth:
+    address: http://authelia.auth.svc.cluster.local:9091/api/verify?rd=https://auth.aggtaa.com
+    trustForwardHeader: true
+    authResponseHeaders:
+      - Remote-User
+      - Remote-Groups
+      - Remote-Name
+      - Remote-Email

clusters/base/apps/davical/helmrelease-davical.yaml

@@ -0,0 +1,118 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: davical
+  namespace: pim
+spec:
+  interval: 10m
+  dependsOn:
+    - name: davical-postgres
+  chartRef:
+    kind: OCIRepository
+    name: davical
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      app:
+        initContainers:
+          seed-config:
+            image:
+              repository: tuxnvape/davical-standalone
+              tag: "82-1.1.12"
+            command:
+              - sh
+              - -c
+              - |
+                if [ ! -f /mnt/config-pvc/davical.php ]; then
+                  cp -r /config/. /mnt/config-pvc/
+                fi
+                # Apache's SCRIPT_NAME (and DAViCal's base_url derived from it)
+                # only reflects the /server prefix if Apache itself resolves
+                # that prefix - Traefik forwards the path unstripped. Add an
+                # Alias so /server/* maps to the app root; idempotent so it
+                # self-heals if apache.conf predates this fix.
+                if ! grep -q '^\s*Alias /server ' /mnt/config-pvc/apache.conf; then
+                  sed -i '/^\s*DocumentRoot \/usr\/share\/davical\/htdocs/a\        Alias /server /usr/share/davical/htdocs' /mnt/config-pvc/apache.conf
+                fi
+        containers:
+          app:
+            image:
+              repository: tuxnvape/davical-standalone
+              tag: "82-1.1.12"
+            env:
+              TZ: Europe/Moscow
+              HOST_NAME: c.aggtaa.com
+              DBHOST: davical-postgres
+              UPDATE_FROM_OLD: "false"
+              PGSQL_ROOT_PASS:
+                valueFrom:
+                  secretKeyRef:
+                    name: davical-secrets
+                    key: PGSQL_ROOT_PASS
+              PASSDAVDB:
+                valueFrom:
+                  secretKeyRef:
+                    name: davical-secrets
+                    key: PASSDAVDB
+              ADMINDAVICALPASS:
+                valueFrom:
+                  secretKeyRef:
+                    name: davical-secrets
+                    key: ADMINDAVICALPASS
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+              startup:
+                enabled: true
+                spec:
+                  periodSeconds: 5
+                  failureThreshold: 30
+                  timeoutSeconds: 3
+
+    service:
+      app:
+        controller: app
+        ports:
+          http:
+            port: 80
+
+    ingress:
+      app:
+        className: traefik
+        # no cert-manager annotation here: infcloud's own Ingress already
+        # requests/owns the Certificate for c.aggtaa.com -> radicale-tls.
+        # A second Ingress with the annotation would create a competing
+        # Certificate for the same host/secret.
+        #
+        # No stripPrefix middleware either: Apache needs to see the /server
+        # prefix itself (via the Alias added in the seed-config initContainer)
+        # so that DAViCal's self-referential links come out correct.
+        hosts:
+          - host: c.aggtaa.com
+            paths:
+              - path: /server
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: radicale-tls
+            hosts:
+              - c.aggtaa.com
+
+    persistence:
+      config:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 256Mi
+        storageClass: longhorn
+        retain: true
+        advancedMounts:
+          app:
+            app:
+              - path: /config
+            seed-config:
+              - path: /mnt/config-pvc

clusters/base/apps/davical/helmrelease-postgres.yaml

@@ -0,0 +1,45 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: davical-postgres
+  namespace: pim
+spec:
+  interval: 10m
+  chartRef:
+    kind: OCIRepository
+    name: davical
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      postgres:
+        containers:
+          app:
+            image:
+              repository: postgres
+              tag: "16.14-alpine"
+            env:
+              TZ: Europe/Moscow
+              POSTGRES_PASSWORD:
+                valueFrom:
+                  secretKeyRef:
+                    name: davical-secrets
+                    key: PGSQL_ROOT_PASS
+
+    service:
+      app:
+        controller: postgres
+        ports:
+          postgres:
+            port: 5432
+
+    persistence:
+      data:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 2Gi
+        storageClass: longhorn
+        retain: true
+        globalMounts:
+          - path: /var/lib/postgresql/data
+            subPath: data

clusters/base/apps/davical/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: davical
+  namespace: pim
+spec:
+  interval: 10m
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/davical/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - secret.enc.yaml
+  - helmrelease-postgres.yaml
+  - helmrelease-davical.yaml

clusters/base/apps/davical/secret.enc.yaml

@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: davical-secrets
+    namespace: pim
+stringData:
+    PGSQL_ROOT_PASS: ENC[AES256_GCM,data:EwTwpAg3FBcZoMDLonNAFjDPDO8wgjwx0aQm85n7BkCTkV6c5JX7tF7TIX4HW4RB,iv:rVeHe4suCagHl1V1EFG3FOfL45tdT1cdr3GyGcHxHu4=,tag:vlJn7lJWhGxKBgZr6XDHPA==,type:str]
+    PASSDAVDB: ENC[AES256_GCM,data:MqEb6sAZc8sPRYq9rB+ESV9UFMGmH3VFRW3nUYPpGp/umAyTJxqc59LzBavYtcZ7,iv:sGw/1HmYvKSizczpDiLZ4zWGLB1vfB+NwfycwOEsZSk=,tag:wxbrjiMSnJssH3o9FOPOXQ==,type:str]
+    ADMINDAVICALPASS: ENC[AES256_GCM,data:Mx3z8QUCWasAqqoUF/FOsT11iBAGtHNrYI/iMdkIRhc=,iv:kBnQjC5VvDolB1Uwe3DDzbfTTU3lHbziXR5X3bQRXvU=,tag:yP74K66C5Np1fu2DmJN04w==,type:str]
+sops:
+    age:
+        - recipient: age1yx8mey02c0mu6te9hwxwdqp5n4enjz35e8thchsmvhqw7xsrzy0syg367g
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1T2dJTmlMWXQrWldYM3lZ
+            SDNTZjZ0NnpDNklCalR6dm9oNHU2Z2REczBnCjJhZkFaU1dsZHZlRktVbjVOZStP
+            b3hPN1BMNjJMUDNFa3REV0RNUkhVS2cKLS0tIEVUWUhtWU1UWXcwWU5RYTY1M2Zj
+            a0hUaksyZW1KV2Jvd2RWM04ramJjNGMK6qIWzTHhAMJRNtIU+t/QR6iZsVN05bOv
+            CX8233dl+T76qrrfYV5+EQ3AKCDnIIkU6Mg1jdnaaorTpfo/qOAHgQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-26T10:29:45Z"
+    mac: ENC[AES256_GCM,data:FtJ1YtmHAj9FIMDILjm5R2ZO3CElJN3j6uAZkw9z4Odu6GaIhPfeAp0HOdgvu/NiU1LC4K/GGPZ+NdEbOLgAtLKW22TBG2iCnuS1PUguogI8IG8+rpGbuatJhn9ntkEZFfMQqPSxKK4DijIj5YrNvezHTJPvKyxY5R6pcegV8h4=,iv:+aLt4+soEa8+AgGiHPG1+87Mhvjs8lxVcdiChUqg1mo=,tag:DHt5lXFDx9911k7MpI8ZrA==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

clusters/base/apps/fava/helmrelease.yaml

@@ -0,0 +1,81 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: fava
+  namespace: finance
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: fava
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      app:
+        initContainers:
+          seed-ledger:
+            image:
+              repository: busybox
+              tag: "1.36"
+            command:
+              - sh
+              - -c
+              - |
+                if [ ! -f /documents/main.beancount ]; then
+                  printf '1970-01-01 open Assets:Cash\n1970-01-01 open Equity:Opening-Balances\n' > /documents/main.beancount
+                fi
+        containers:
+          app:
+            image:
+              repository: yegle/fava
+              tag: "1.30.4"
+            env:
+              TZ: Europe/Moscow
+              BEANCOUNT_FILE: /documents/main.beancount
+            args:
+              - "--poll-watcher"              
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+            resources:
+              requests:
+                cpu: 50m
+                memory: 128Mi
+              limits:
+                memory: 512Mi
+
+    service:
+      app:
+        controller: app
+        ports:
+          http:
+            port: 5000
+
+    ingress:
+      app:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+          traefik.ingress.kubernetes.io/router.middlewares: auth-authelia@kubernetescrd
+        hosts:
+          - host: acc.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: fava-tls
+            hosts:
+              - acc.aggtaa.com
+
+    persistence:
+      documents:
+        type: persistentVolumeClaim
+        existingClaim: fava-documents
+        globalMounts:
+          - path: /documents

clusters/base/apps/fava/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: fava
+  namespace: finance
+spec:
+  interval: 1h
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/fava/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - helmrelease.yaml
+  - pv-pvc-documents.yaml

clusters/base/apps/fava/pv-pvc-documents.yaml

@@ -0,0 +1,35 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: fava-documents-nfs
+spec:
+  capacity:
+    storage: 30Gi
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  mountOptions:
+    - nfsvers=4.1
+  nfs:
+    server: 10.0.64.5
+    path: /export/accounting
+  claimRef:
+    namespace: finance
+    name: fava-documents
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: fava-documents
+  namespace: finance
+  annotations:
+    helm.sh/resource-policy: keep
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: fava-documents-nfs
+  resources:
+    requests:
+      storage: 30Gi

clusters/base/apps/homeassistant/helmrelease.yaml

@@ -0,0 +1,77 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: homeassistant
+  namespace: homeassistant
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: homeassistant
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      app:
+        strategy: Recreate
+        pod:
+          hostNetwork: true
+          dnsPolicy: ClusterFirstWithHostNet
+        containers:
+          app:
+            image:
+              repository: ghcr.io/home-assistant/home-assistant
+              tag: "2026.7.4"
+            env:
+              TZ: Europe/Moscow
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+              startup:
+                enabled: true
+                spec:
+                  periodSeconds: 10
+                  failureThreshold: 30 # HA is sloooow to start
+            resources:
+              requests:
+                cpu: 100m
+                memory: 256Mi
+              limits:
+                memory: 1Gi
+
+    service:
+      app:
+        controller: app
+        ports:
+          http:
+            port: 8123
+
+    ingress:
+      app:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: p.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: homeassistant-tls
+            hosts:
+              - p.aggtaa.com
+
+    persistence:
+      config:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 10Gi
+        storageClass: longhorn
+        retain: true
+        globalMounts:
+          - path: /config

clusters/base/apps/homeassistant/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: homeassistant
+  namespace: homeassistant
+spec:
+  interval: 1h
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/homeassistant/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - helmrelease.yaml

clusters/base/apps/immich/helmrelease-ml.yaml

@@ -0,0 +1,54 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: immich-ml
+  namespace: photo
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: immich
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      ml:
+        containers:
+          app:
+            # CPU-only: hardware-accelerated tags (-openvino, -cuda, etc)
+            # need specific host devices (e.g. /dev/dri) that aren't set up
+            # on these nodes. Switch tags later if that changes.
+            image:
+              # pinned to match immich-server's version (see
+              # helmrelease-server.yaml) - server and ML communicate over
+              # an internal API contract that isn't guaranteed compatible
+              # across versions.
+              repository: ghcr.io/immich-app/immich-machine-learning
+              tag: v3.1.0
+            env:
+              TZ: Europe/Moscow
+            resources:
+              requests:
+                cpu: 500m
+                memory: 512Mi
+              limits:
+                memory: 4Gi
+
+    service:
+      app:
+        controller: ml
+        ports:
+          http:
+            port: 3003
+
+    persistence:
+      # caches downloaded ML models so they survive pod restarts instead of
+      # re-downloading (a few hundred MB) every time.
+      cache:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 10Gi
+        storageClass: longhorn-single-replica
+        retain: true
+        globalMounts:
+          - path: /cache

clusters/base/apps/immich/helmrelease-postgres.yaml

@@ -0,0 +1,70 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: immich-postgres
+  namespace: photo
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: immich
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      postgres:
+        containers:
+          app:
+            # immich requires this specific image - it bundles the
+            # vectorchord/pgvecto.rs extensions immich's DB schema depends
+            # on; a plain postgres image will not work.
+            image:
+              repository: ghcr.io/immich-app/postgres
+              tag: 14-vectorchord0.4.3-pgvectors0.2.0
+            env:
+              TZ: Europe/Moscow
+              POSTGRES_USER: postgres
+              POSTGRES_DB: immich
+              POSTGRES_INITDB_ARGS: "--data-checksums"
+              POSTGRES_PASSWORD:
+                valueFrom:
+                  secretKeyRef:
+                    name: immich-secrets
+                    key: DB_PASSWORD
+            resources:
+              requests:
+                cpu: 100m
+                memory: 256Mi
+              limits:
+                memory: 2Gi
+
+    service:
+      app:
+        controller: postgres
+        ports:
+          postgres:
+            port: 5432
+
+    persistence:
+      data:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 10Gi
+        storageClass: longhorn
+        retain: true
+        globalMounts:
+          # subPath, not the raw mount root: a fresh Longhorn ext4 volume's
+          # root always contains a "lost+found" dir, and postgres's initdb
+          # refuses to initialize into a non-empty directory even when
+          # lost+found is the only thing in it.
+          - path: /var/lib/postgresql/data
+            subPath: data
+      # postgres' parallel query workers need real shared memory, not the
+      # default 64Mi container tmpfs - matches shm_size: 128mb in the
+      # original docker-compose.
+      dshm:
+        type: emptyDir
+        medium: Memory
+        sizeLimit: 128Mi
+        globalMounts:
+          - path: /dev/shm

clusters/base/apps/immich/helmrelease-redis.yaml

@@ -0,0 +1,33 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: immich-redis
+  namespace: photo
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: immich
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      redis:
+        containers:
+          app:
+            image:
+              repository: docker.io/valkey/valkey
+              tag: "9.1.1"
+            resources:
+              requests:
+                cpu: 20m
+                memory: 32Mi
+              limits:
+                memory: 256Mi
+
+    service:
+      app:
+        controller: redis
+        ports:
+          redis:
+            port: 6379

clusters/base/apps/immich/helmrelease-server.yaml

@@ -0,0 +1,203 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: immich-server
+  namespace: photo
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: immich
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      server:
+        strategy: Recreate
+        podDisruptionBudget:
+          maxUnavailable: "0"
+        initContainers:
+          fix-permissions:
+            image:
+              repository: hectorm/nfs-ganesha
+              tag: v10
+              # hectorm does not publish exact versions, v10.0 digest is 93df70b78...
+              digest: sha256:93df70b78aae56957f4a4f5c606c4250d84b729435f76132dca07b7290f5bfce
+            command:
+              - sh
+              - -c
+              - chmod -R a+rwX /disks/library-recent /disks/library-archive
+          # native sidecar (restartPolicy: Always): mounts the two library
+          # disks and exposes their union at /disks/merged-library via
+          # FUSE. It must be up and actually mounted *before* the "app"
+          # container is created, since HostToContainer propagation only
+          # relays mounts made *after* the receiving container's own mount
+          # exists - it won't retroactively pick up a FUSE mount that's
+          # already there. Running it as a restartPolicy:Always init
+          # container (started, gated on the startupProbe below, before
+          # regular containers) guarantees that ordering; a regular sidecar
+          # container racing "app" on every pod start does not.
+          mergerfs:
+            dependsOn:
+              - fix-permissions
+            restartPolicy: Always
+            image:
+              repository: ghcr.io/hotio/mergerfs
+              tag: release-v2.42.0
+            args:
+              - "-o"
+              # library-recent listed first: category.create=ff means new
+              # files created through the merged mount (i.e. new immich
+              # uploads going forward) land on library-recent by default,
+              # which is exactly what's wanted for freshly-uploaded photos.
+              - "allow_other,use_ino,func.create=ff,category.action=all,category.create=ff,category.search=newest"
+              - "/disks/library-recent:/disks/library-archive"
+              - "/disks/merged-library"
+            securityContext:
+              privileged: true
+            probes:
+              startup:
+                enabled: true
+                custom: true
+                spec:
+                  exec:
+                    command:
+                      - sh
+                      - -c
+                      - grep -q fuse.mergerfs /proc/mounts
+                  periodSeconds: 1
+                  timeoutSeconds: 2
+                  failureThreshold: 30
+            resources:
+              requests:
+                cpu: 50m
+                memory: 64Mi
+              limits:
+                memory: 512Mi
+        containers:
+          app:
+            image:
+              repository: ghcr.io/immich-app/immich-server
+              # make sure immich-machine-learning version match this 
+              tag: v3.1.0
+            env:
+              TZ: Europe/Moscow
+              DB_HOSTNAME: immich-postgres
+              DB_PORT: "5432"
+              DB_USERNAME: postgres
+              DB_DATABASE_NAME: immich
+              DB_PASSWORD:
+                valueFrom:
+                  secretKeyRef:
+                    name: immich-secrets
+                    key: DB_PASSWORD
+              REDIS_HOSTNAME: immich-redis
+              REDIS_PORT: "6379"
+              IMMICH_MACHINE_LEARNING_URL: http://immich-ml:3003
+            probes:
+              # first boot runs DB migrations + vector index setup, which
+              # can take a while - without a startup probe the default
+              # liveness probe (periodSeconds=10, failureThreshold=3) kills
+              # the container ~30s in, well before it's finished binding
+              # the port, causing an endless restart loop.
+              startup:
+                enabled: true
+                spec:
+                  periodSeconds: 5
+                  failureThreshold: 60
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+            resources:
+              requests:
+                cpu: 200m
+                memory: 512Mi
+              limits:
+                memory: 4Gi
+
+    service:
+      app:
+        controller: server
+        ports:
+          http:
+            port: 2283
+
+    ingress:
+      app:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: photo.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: immich-tls
+            hosts:
+              - photo.aggtaa.com
+
+    persistence:
+      # Immich's "library" folder, mergerfs-merged from two disks: recent
+      # files (per the rsync migration's cutoff) and everything else.
+      # New uploads going forward land on library-recent (see mergerfs
+      # category.create above). Not reusing the old single 800Gi library
+      # PVC/PV - this replaces it (that PVC becomes orphaned, retained,
+      # and unused; clean it up separately if no longer wanted).
+      library-recent:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 200Gi
+        storageClass: longhorn-single-replica
+        retain: true
+        advancedMounts:
+          server:
+            mergerfs:
+              - path: /disks/library-recent
+            fix-permissions:
+              - path: /disks/library-recent
+      library-archive:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 500Gi
+        storageClass: longhorn-single-replica
+        retain: true
+        advancedMounts:
+          server:
+            mergerfs:
+              - path: /disks/library-archive
+            fix-permissions:
+              - path: /disks/library-archive
+      merged-library:
+        type: emptyDir
+        advancedMounts:
+          server:
+            mergerfs:
+              - path: /disks/merged-library
+                mountPropagation: Bidirectional
+            app:
+              - path: /data/library
+                mountPropagation: HostToContainer
+      dev-fuse:
+        type: hostPath
+        hostPath: /dev/fuse
+        advancedMounts:
+          server:
+            mergerfs:
+              - path: /dev/fuse
+      # everything immich keeps outside "library" (backups, encoded-video,
+      # profile, thumbs, upload) - plain volume, no mergerfs involved.
+      other:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 200Gi
+        storageClass: longhorn-single-replica
+        retain: true
+        advancedMounts:
+          server:
+            app:
+              - path: /data

clusters/base/apps/immich/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: immich
+  namespace: photo
+spec:
+  interval: 1h
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/immich/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - secret.enc.yaml
+  - helmrelease-postgres.yaml
+  - helmrelease-redis.yaml
+  - helmrelease-ml.yaml
+  - helmrelease-server.yaml

clusters/base/apps/immich/secret.enc.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: immich-secrets
+    namespace: photo
+stringData:
+    DB_PASSWORD: ENC[AES256_GCM,data:OumSCUdG9NT5FNCApJ9D04VIXgRf2X/ieCjJbWqGsc0=,iv:IAC9IXiVeOqFngqOqxReBPYNwPg3p/e4auHeUCudcS0=,tag:uhg56rWb5IzJApJm3tqDHA==,type:str]
+sops:
+    age:
+        - recipient: age1wmm8qrqnjzvd5nkraed6ylrsxlpn3ru7d7zettdudj7y9sg9dd2su0u3mr
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqTnlDR1dRUDNaTlQ2RHpM
+            OFArT3BjOEhleXhVaTRlVDRPcFF1ZFpyakR3Ck1BUHhYQXdsTXMveGs2OG9mbzFQ
+            QWR6dW4zL2VsQWtDNWgrVVBDeWd4L1kKLS0tIDY3WHo1MEl4SzJKM0ROalBKNERa
+            SlQwMEdnZmhSWUdYUnBGRk9MdjV0cGMKxhON65iPrpNMnqBYYUN6rQfhAo3EhhE4
+            Vun3sqVBk1OH8aekutrYSOj/RhrIbzYlbFXTY+pDnp3U3o1+xrknig==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-26T10:29:46Z"
+    mac: ENC[AES256_GCM,data:/CgR0m+7TJh2hHQ+pee5bP1lbJhWMrJiPjTrS8pP05z4OobLXxScEzPKtuO8+0Ru0eyjg/i1eAk5tzDMzDPwW3/JiU9elQKeFYxzGn6LmT17KIf+ofPP9vuVFP93FW4vqYNZIO4qUtF/RUfZBRgPlf6rokUMRLILTRGI00lvfR4=,iv:z9xX6wGL7I+NZzybQd0j4+rkU+Xb2JKO2sedrrGUss4=,tag:P5E3e/s8bXJBDUhxTqaf8g==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

clusters/base/apps/infcloud/helmrelease-infcloud.yaml

@@ -0,0 +1,65 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: infcloud
+  namespace: pim
+spec:
+  interval: 10m
+  chartRef:
+    kind: OCIRepository
+    name: infcloud
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      infcloud:
+        containers:
+          app:
+            image:
+              repository: waja/infcloud
+              tag: "0.13.1-16"
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+
+    service:
+      app:
+        controller: infcloud
+        ports:
+          http:
+            port: 80
+
+    ingress:
+      app:
+        className: traefik
+        # this ingress owns the cert-manager request for c.aggtaa.com
+        # (secret kept as "radicale-tls" post-migration so the existing,
+        # already-valid cert is reused instead of re-issued). davical's
+        # ingress just references the same secret without its own
+        # annotation - a second annotated Ingress would create a
+        # competing Certificate for the same host/secret.
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: c.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: radicale-tls
+            hosts:
+              - c.aggtaa.com
+
+    persistence:
+      config:
+        type: configMap
+        name: infcloud-config
+        globalMounts:
+          - path: /srv/infcloud/config/config.js
+            subPath: config.js
+            readOnly: true

clusters/base/apps/infcloud/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: infcloud
+  namespace: pim
+spec:
+  interval: 10m
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/infcloud/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - configmap.yaml
+  - helmrelease-infcloud.yaml

clusters/base/apps/markdown-vault-mcp/helmrelease.yaml

@@ -0,0 +1,97 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: markdown-vault-mcp
+  namespace: mcp
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: markdown-vault-mcp
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      app:
+        containers:
+          app:
+            image:
+              repository: ghcr.io/pvliesdonk/markdown-vault-mcp
+              tag: "3.1.0"
+            env:
+              MARKDOWN_VAULT_MCP_SOURCE_DIR: /vault
+              MARKDOWN_VAULT_MCP_INDEX_PATH: /data/state/index.db
+              MARKDOWN_VAULT_MCP_EMBEDDINGS_PATH: /data/state/embeddings
+              MARKDOWN_VAULT_MCP_ATTACHMENT_EXTENSIONS: "*"
+              MARKDOWN_VAULT_MCP_STATE_PATH: /data/state/state.json
+              MARKDOWN_VAULT_MCP_READ_ONLY: "false"
+              MARKDOWN_VAULT_MCP_BASE_URL: "https://md-vault.mcp.aggtaa.com"
+              MARKDOWN_VAULT_MCP_OIDC_CONFIG_URL: "https://auth.aggtaa.com/.well-known/openid-configuration"
+              MARKDOWN_VAULT_MCP_OIDC_CLIENT_ID: "markdown-vault-mcp"
+              MARKDOWN_VAULT_MCP_OIDC_CLIENT_SECRET:
+                valueFrom:
+                  secretKeyRef:
+                    name: markdown-vault-mcp-secrets
+                    key: OIDC_CLIENT_SECRET
+              MARKDOWN_VAULT_MCP_OIDC_JWT_SIGNING_KEY:
+                valueFrom:
+                  secretKeyRef:
+                    name: markdown-vault-mcp-secrets
+                    key: OIDC_JWT_SIGNING_KEY
+              MARKDOWN_VAULT_MCP_BEARER_TOKEN:
+                valueFrom:
+                  secretKeyRef:
+                    name: markdown-vault-mcp-secrets
+                    key: BEARER_TOKEN
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+            resources:
+              requests:
+                cpu: 100m
+                memory: 256Mi
+              limits:
+                memory: 1Gi
+
+    service:
+      app:
+        controller: app
+        ports:
+          http:
+            port: 8000
+
+    ingress:
+      app:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: md-vault.mcp.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: markdown-vault-mcp-tls
+            hosts:
+              - md-vault.mcp.aggtaa.com
+
+    persistence:
+      vault:
+        type: persistentVolumeClaim
+        existingClaim: markdown-vault-mcp-vault
+        globalMounts:
+          - path: /vault
+      state:
+        type: persistentVolumeClaim
+        suffix: state
+        accessMode: ReadWriteOnce
+        size: 2Gi
+        storageClass: longhorn
+        retain: true
+        globalMounts:
+          - path: /data/state

clusters/base/apps/markdown-vault-mcp/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: markdown-vault-mcp
+  namespace: mcp
+spec:
+  interval: 1h
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/markdown-vault-mcp/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - helmrelease.yaml
+  - secret.enc.yaml
+  - pv-pvc-vault.yaml

clusters/base/apps/markdown-vault-mcp/pv-pvc-vault.yaml

@@ -0,0 +1,35 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: markdown-vault-mcp-vault-nfs
+spec:
+  capacity:
+    storage: 30Gi
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  mountOptions:
+    - nfsvers=4.1
+  nfs:
+    server: 10.0.64.5
+    path: /export
+  claimRef:
+    namespace: mcp
+    name: markdown-vault-mcp-vault
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: markdown-vault-mcp-vault
+  namespace: mcp
+  annotations:
+    helm.sh/resource-policy: keep
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: markdown-vault-mcp-vault-nfs
+  resources:
+    requests:
+      storage: 30Gi

clusters/base/apps/markdown-vault-mcp/secret.enc.yaml

@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: markdown-vault-mcp-secrets
+    namespace: mcp
+stringData:
+    BEARER_TOKEN: ENC[AES256_GCM,data:UFy6rlwEWje7mO8WJFFvgq8SEKaf0dP9mx00BLPxfKTzgcZqbce2Sr1U5aWVf8iphKapcBWRPEKqa/f1dC93tw==,iv:G8owKrU8ueTnQJ5p6O4U5x5H5WVriqqTUH5iAlW3ZoU=,tag:wuDlQmY622xLZvdJ17cxkQ==,type:str]
+    OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:NEAQqXz7zICa+3bSTRxfnURV0+toWhTexHBYXPB42tBomNg4kf3k9sspSJQYATcxuNIK5xv6XOCna4J1fm/+cw==,iv:T9gj9Jb/RcQcpFQUeqnH6S6Ri/XrlVntv9oU7bwnjEM=,tag:UqR4VqMe75s40TgcggbOrw==,type:str]
+    OIDC_JWT_SIGNING_KEY: ENC[AES256_GCM,data:AwY8V9EQ1Z/NJmc/8msG2RpyCIhEKMzLTLdsLHpC2QfgB652aYEHAYg6u8quRvSypw1cG2zdJJQEym/MJ7CGdw==,iv:FjMwdBE51PuQCqhrojAWiwxoYkemSxO1+9ebw3kRRrk=,tag:X/b/t4e5qZmFJ1FSrWQOfw==,type:str]
+sops:
+    age:
+        - recipient: age1kct5g7d7eus2hvdnmx99ewsrtz70lhlasxa25euqwdctqhwqqpxqz0n7gg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqUm5qNE93WUhKTlRIUXl3
+            TmZMREJSQmVOWXlDdW9DZlFheGpDUHIvYmxFClozek5MVitWYVhIY3I2Nmk3YlJS
+            cEhJS0NKNy90emovR1dCeHZ4UjNvVWcKLS0tIHFmTGMrVjRaSTFCNGQwSzB4NitT
+            K2hIS3FuTHNoRHhxMEFIcFkvQjZmTHMKQls9vNvWQ+zc27JmQXxJilkiVTDqjEzD
+            55M/azYogOsp0Kfe3MBm740tdaPiD6iyLXrEuZKNywD2mPtNT8+3JA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-26T10:29:46Z"
+    mac: ENC[AES256_GCM,data:sfdT7eRXMpgbWtJhu5U6/T03ckavKNcojfkg9Tu0uLwigsAsaxgiMhBA3kQWYU3tV9gxy6BXIak8cdF8EfCEAWBYSQC6iQLgOZPXvLpWFoaiigNHbKSYLYcimlD1wmHlRb5L0x5+QNANxD22Hkjlkw0kgPQ+GZKP7SzDsixXpBA=,iv:1rC3zYmRWM1/8O8xgitTwvQ9qORXNR20qABDKPqGpSc=,tag:YkJNRwxoGfGXnfcX5AJXtw==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

clusters/base/apps/mosquitto/chart/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+name: mosquitto
+description: Single-node Eclipse Mosquitto MQTT broker for homelab IoT
+type: application
+version: 0.1.0
+appVersion: "2"

clusters/base/apps/mosquitto/chart/templates/_helpers.tpl

@@ -0,0 +1,14 @@
+{{- define "mosquitto.fullname" -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "mosquitto.labels" -}}
+app.kubernetes.io/name: mosquitto
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}
+
+{{- define "mosquitto.selectorLabels" -}}
+app.kubernetes.io/name: mosquitto
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}

clusters/base/apps/mosquitto/chart/templates/configmap.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "mosquitto.fullname" . }}-config
+  labels:
+    {{- include "mosquitto.labels" . | nindent 4 }}
+data:
+  mosquitto.conf: |
+    persistence true
+    persistence_location /mosquitto/data/
+    log_dest stdout
+
+    listener {{ .Values.service.mqttPort }}
+    allow_anonymous false
+    password_file /mosquitto/secrets/{{ .Values.auth.secretKey }}
+
+    {{- if .Values.websockets.enabled }}
+    listener {{ .Values.websockets.port }}
+    protocol websockets
+    allow_anonymous false
+    password_file /mosquitto/secrets/{{ .Values.auth.secretKey }}
+    {{- end }}

clusters/base/apps/mosquitto/chart/templates/service.yaml

@@ -0,0 +1,25 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "mosquitto.fullname" . }}
+  labels:
+    {{- include "mosquitto.labels" . | nindent 4 }}
+    {{- if .Values.service.loadBalancerPool }}
+    loadBalancerPool: {{ .Values.service.loadBalancerPool }}
+    {{- end }}
+spec:
+  type: {{ .Values.service.type }}
+  {{- if .Values.service.loadBalancerIP }}
+  loadBalancerIP: {{ .Values.service.loadBalancerIP }}
+  {{- end }}
+  selector:
+    {{- include "mosquitto.selectorLabels" . | nindent 4 }}
+  ports:
+    - name: mqtt
+      port: {{ .Values.service.mqttPort }}
+      targetPort: mqtt
+    {{- if .Values.websockets.enabled }}
+    - name: ws
+      port: {{ .Values.websockets.port }}
+      targetPort: ws
+    {{- end }}

clusters/base/apps/mosquitto/chart/templates/statefulset.yaml

@@ -0,0 +1,70 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ include "mosquitto.fullname" . }}
+  labels:
+    {{- include "mosquitto.labels" . | nindent 4 }}
+spec:
+  serviceName: {{ include "mosquitto.fullname" . }}
+  replicas: 1
+  selector:
+    matchLabels:
+      {{- include "mosquitto.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "mosquitto.selectorLabels" . | nindent 8 }}
+    spec:
+      securityContext:
+        runAsUser: {{ .Values.securityContext.runAsUser }}
+        runAsGroup: {{ .Values.securityContext.runAsGroup }}
+        fsGroup: {{ .Values.securityContext.runAsGroup }}
+      containers:
+        - name: mosquitto
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - name: mqtt
+              containerPort: {{ .Values.service.mqttPort }}
+            {{- if .Values.websockets.enabled }}
+            - name: ws
+              containerPort: {{ .Values.websockets.port }}
+            {{- end }}
+          env:
+            - name: MOSQUITTO_UNSAFE_ALLOW_SYMLINKS
+              value: "1"
+          volumeMounts:
+            - name: config
+              mountPath: /mosquitto/config
+            - name: secrets
+              mountPath: /mosquitto/secrets
+              readOnly: true
+            {{- if .Values.persistence.enabled }}
+            - name: data
+              mountPath: /mosquitto/data
+            {{- end }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+      volumes:
+        - name: config
+          configMap:
+            name: {{ include "mosquitto.fullname" . }}-config
+        - name: secrets
+          secret:
+            secretName: {{ .Values.auth.existingSecret }}
+            defaultMode: 0400
+        {{- if not .Values.persistence.enabled }}
+        - name: data
+          emptyDir: {}
+        {{- end }}
+  {{- if .Values.persistence.enabled }}
+  volumeClaimTemplates:
+    - metadata:
+        name: data
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        storageClassName: {{ .Values.persistence.storageClassName }}
+        resources:
+          requests:
+            storage: {{ .Values.persistence.size }}
+  {{- end }}

clusters/base/apps/mosquitto/chart/values.yaml

@@ -0,0 +1,38 @@
+image:
+  repository: eclipse-mosquitto
+  tag: "2.1.2"
+  pullPolicy: IfNotPresent
+
+# not really needed, as StatefulSet has hardcoded "replicas: 1"
+replicaCount: 1
+
+securityContext:
+  runAsUser: 1883
+  runAsGroup: 1883
+
+persistence:
+  enabled: true
+  size: 1Gi
+
+service:
+  type: LoadBalancer
+  mqttPort: 1883
+  loadBalancerPool: "mqtt"
+  # or loadBalancerIP: X.X.X.X
+
+auth:
+  # Mount a Secret with a pre-generated mosquitto passwd file instead of
+  # putting credentials in values.yaml / git. See README for how to create it.
+  existingSecret: mosquitto-passwd
+  secretKey: passwd
+
+websockets:
+  enabled: false
+  port: 9001
+
+resources:
+  requests:
+    cpu: 50m
+    memory: 32Mi
+  limits:
+    memory: 128Mi

clusters/base/apps/mosquitto/helmrelease.yaml

@@ -0,0 +1,52 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: mosquitto
+  namespace: mqtt
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: ./clusters/base/apps/mosquitto/chart
+      sourceRef:
+        kind: GitRepository
+        name: flux-system
+        namespace: flux-system
+      reconcileStrategy: Revision
+  driftDetection:
+    mode: enabled
+  values:
+    image:
+      repository: eclipse-mosquitto
+      tag: "2.1.2"
+      pullPolicy: IfNotPresent
+
+    replicaCount: 1
+
+    securityContext:
+      runAsUser: 1883
+      runAsGroup: 1883
+
+    persistence:
+      enabled: true
+      size: 1Gi
+
+    service:
+      type: LoadBalancer
+      mqttPort: 1883
+      loadBalancerPool: "mqtt"
+
+    auth:
+      existingSecret: mosquitto-passwd
+      secretKey: passwd
+
+    websockets:
+      enabled: false
+      port: 9001
+
+    resources:
+      requests:
+        cpu: 50m
+        memory: 32Mi
+      limits:
+        memory: 128Mi

clusters/base/apps/mosquitto/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - secret.enc.yaml
+  - helmrelease.yaml

clusters/base/apps/mosquitto/secret.enc.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: mosquitto-passwd
+    namespace: mqtt
+stringData:
+    passwd: ENC[AES256_GCM,data:RHKtt4UgqElKW/rw9BnpZKOnhchsqmO5jVVVRJBy82b+9KrbUN5iGQ3k5X4/6gjrKKOcs5QabJahR+i/aVSr5fVyCJR7Y45YvKk+eyKqGuDTFCkzjxpSDvO4AseQvOHSGTMRXQx73jdpCnEEYtoXZNCLuhGtueKvrhkNDDCLFwtybaWsrI4g3fwo5auHbyWwjoxXskv0+pwi7vnESIJudJl4ul3Ie4NpyispZ+H0O6p9cn+Hwu2qoTJbR/zbpA==,iv:Blp/QsgEVD73JhGFzM3GNFPfUcwB58fzKJlQIGBw5Yg=,tag:InRGXl9vB/DF778pbhoqfw==,type:str]
+sops:
+    age:
+        - recipient: age1u236u5mzkzj72y4mfxx68gfqw0u0j6tdgkudnm5pdfpe7apq4u6s89jr2h
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBudUhrOVlvUU82cG45K3ll
+            R05Dc0NUdFN3b0k2UmZoSWlxd1diQ0dNcjBFCm1icmlvQUhIaFYwSFZ0MURmQVUy
+            bTJPWk5mWVpQb1JNQXhCOFhpNXByNTAKLS0tIE1vR0t3SUdGTnRiWFVXOG5yYVhk
+            UVBsRDlZSVpJbk1KYmJGYlRmelNWWVkKBVabDs2XS6XAVKiKbAtk3CqraoBXOD5I
+            +0uq5YeFvMxhrnX6wXffCS7S3zbvNV6/2Enbt7SBJ8EhCvKbfaOtfg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-26T10:29:47Z"
+    mac: ENC[AES256_GCM,data:/NEEVA/hO2NUIWOhVjL7ZmtD9Ac169CL4D71qPueZbNSHtTqx8GHeo8DI1tpsUBuGytVBQxh1MXK3REt/bD2GzU1dCpvtTtQmQb+B57H6Za3RIyPU51QTt9nHYHiWend3tcxlR3Xc8h5TBa0kKwjXvlij4jEUM+dA5UESE/QGFk=,iv:yTyP3PVw+pVzPPqMN7EyIfM/BN/wK9nIHx84F65A+/k=,tag:oTpIqbAOq5aqlCWnVqaKNw==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

clusters/base/apps/nfs-ganesha/configmap.yaml

@@ -0,0 +1,51 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nfs-ganesha-config
+  namespace: nfs
+data:
+  ganesha.conf: |
+    NFS_Core_Param {
+    	NFS_Port = 2049;
+    	Protocols = NFSv4;
+    	Fsid_Device = true;
+    }
+
+    NFSV4 {
+    	RecoveryBackend = fs_ng;
+    	RecoveryRoot = /recovery;
+    	Lease_Lifetime = 40;
+    	Grace_Period = 50;
+    }
+
+    VFS {
+    	Link_Support = true;
+    	Symlink_Support = true;
+    	CanSetTime = true;
+    	umask = 0000;
+    }
+
+    EXPORT {
+    	Export_Id = 1;
+
+    	Path = /export;
+    	Pseudo = /export;
+
+    	SecType = sys;
+    	Protocols = NFSv4;
+
+    	FSAL {
+    		Name = VFS;
+    	}
+
+    	CLIENT {
+    		Clients = *;
+    		Access_Type = RW;
+    		Squash = No_Root_Squash;
+    		Protocols = NFSv4;
+    	}
+    }
+
+    LOG {
+    	Default_Log_Level = INFO;
+    }

clusters/base/apps/nfs-ganesha/helmrelease.yaml

@@ -0,0 +1,130 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: nfs-ganesha
+  namespace: nfs
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: nfs-ganesha
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      app:
+        strategy: Recreate
+        podDisruptionBudget:
+          maxUnavailable: "0"
+        initContainers:
+          mtab-setup:
+            image:
+              repository: hectorm/nfs-ganesha
+              tag: v10
+              # hectorm does not publish exact versions, v10.0 digest is 93df70b78...
+              digest: sha256:93df70b78aae56957f4a4f5c606c4250d84b729435f76132dca07b7290f5bfce
+            command:
+              - sh
+              - -c
+              - cat /proc/self/mounts > /mtab-vol/mtab
+          fix-permissions:
+            image:
+              repository: hectorm/nfs-ganesha
+              tag: v10
+              # hectorm does not publish exact versions, v10.0 digest is 93df70b78...
+              digest: sha256:93df70b78aae56957f4a4f5c606c4250d84b729435f76132dca07b7290f5bfce
+            command:
+              - sh
+              - -c
+              - chmod -R a+rwX /export
+        containers:
+          app:
+            image:
+              repository: hectorm/nfs-ganesha
+              tag: v10
+              # hectorm does not publish exact versions, v10.0 digest is 93df70b78...
+              digest: sha256:93df70b78aae56957f4a4f5c606c4250d84b729435f76132dca07b7290f5bfce
+            securityContext:
+              readOnlyRootFilesystem: true
+              capabilities:
+                drop:
+                  - ALL
+                add:
+                  - CHOWN
+                  - DAC_OVERRIDE
+                  - DAC_READ_SEARCH
+                  - FOWNER
+                  - FSETID
+                  - SETGID
+                  - SETUID
+                  - SYS_RESOURCE
+            probes:
+              liveness:
+                enabled: true
+                spec:
+                  initialDelaySeconds: 2
+                  periodSeconds: 10
+                  timeoutSeconds: 2
+                  failureThreshold: 3
+              readiness:
+                enabled: true
+                spec:
+                  initialDelaySeconds: 1
+                  periodSeconds: 2
+                  timeoutSeconds: 1
+                  failureThreshold: 2
+            resources:
+              requests:
+                cpu: 50m
+                memory: 128Mi
+              limits:
+                memory: 512Mi
+
+    service:
+      app:
+        controller: app
+        type: LoadBalancer
+        labels:
+          loadBalancerPool: nfs
+        ports:
+          nfs:
+            port: 2049
+            protocol: TCP
+
+    persistence:
+      config:
+        type: configMap
+        name: nfs-ganesha-config
+        globalMounts:
+          - path: /etc/ganesha/ganesha.conf
+            subPath: ganesha.conf
+            readOnly: true
+      export:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 30Gi
+        storageClass: longhorn
+        retain: true
+        globalMounts:
+          - path: /export
+      run:
+        type: emptyDir
+        globalMounts:
+          - path: /run
+      tmp:
+        type: emptyDir
+        globalMounts:
+          - path: /tmp
+      recovery:
+        type: emptyDir
+        globalMounts:
+          - path: /recovery
+      etc-mtab:
+        type: emptyDir
+        advancedMounts:
+          app:
+            app:
+              - path: /etc/mtab
+                subPath: mtab
+            mtab-setup:
+              - path: /mtab-vol

clusters/base/apps/nfs-ganesha/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: nfs-ganesha
+  namespace: nfs
+spec:
+  interval: 1h
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/nfs-ganesha/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - configmap.yaml
+  - helmrelease.yaml

clusters/base/apps/openwebui/helmrelease.yaml

@@ -0,0 +1,73 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: openwebui
+  namespace: ai
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: openwebui
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      app:
+        containers:
+          app:
+            image:
+              repository: ghcr.io/open-webui/open-webui
+              tag: v0.11.0
+            env:
+              TZ: Europe/Moscow
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+              startup:
+                enabled: true
+                spec:
+                  periodSeconds: 10
+                  failureThreshold: 30 # first boot pulls the embedding model
+            resources:
+              requests:
+                cpu: 200m
+                memory: 512Mi
+              limits:
+                memory: 2Gi
+
+    service:
+      app:
+        controller: app
+        ports:
+          http:
+            port: 8080
+
+    ingress:
+      app:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: ai2.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: openwebui-tls
+            hosts:
+              - ai2.aggtaa.com
+
+    persistence:
+      data:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 10Gi
+        storageClass: longhorn
+        retain: true
+        globalMounts:
+          - path: /app/backend/data

clusters/base/apps/openwebui/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: openwebui
+  namespace: ai
+spec:
+  interval: 1h
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/openwebui/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - helmrelease.yaml

clusters/base/apps/syncthing/helmrelease.yaml

@@ -0,0 +1,73 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: syncthing
+  namespace: syncthing
+spec:
+  interval: 10m
+  chartRef:
+    kind: OCIRepository
+    name: syncthing
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      app:
+        containers:
+          app:
+            image:
+              repository: syncthing/syncthing
+              tag: "2.1.3"
+            env:
+              TZ: Europe/Moscow
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+
+    service:
+      app:
+        controller: app
+        ports:
+          http:
+            port: 8384
+
+    ingress:
+      app:
+        className: traefik
+        # the GUI has no auth of its own out of the box, so it's gated
+        # behind Authelia the same way fava/zigbee2mqtt are.
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+          traefik.ingress.kubernetes.io/router.middlewares: auth-authelia@kubernetescrd
+        hosts:
+          - host: sync.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: syncthing-tls
+            hosts:
+              - sync.aggtaa.com
+
+    persistence:
+      data:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 1Gi
+        storageClass: longhorn
+        retain: true
+        globalMounts:
+          - path: /var/syncthing
+      # same nfs-ganesha export webdav and markdown-vault-mcp use
+      # (10.0.64.5:/export); mounted at the same container path (/data)
+      # as webdav so the layout matches (/data/shared/documents/...).
+      shared:
+        type: persistentVolumeClaim
+        existingClaim: syncthing-shared
+        globalMounts:
+          - path: /data

clusters/base/apps/syncthing/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: syncthing
+  namespace: syncthing
+spec:
+  interval: 10m
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/syncthing/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - pv-pvc-shared.yaml
+  - helmrelease.yaml

clusters/base/apps/syncthing/pv-pvc-shared.yaml

@@ -0,0 +1,35 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: syncthing-shared-nfs
+spec:
+  capacity:
+    storage: 30Gi
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  mountOptions:
+    - nfsvers=4.1
+  nfs:
+    server: 10.0.64.5
+    path: /export
+  claimRef:
+    namespace: syncthing
+    name: syncthing-shared
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: syncthing-shared
+  namespace: syncthing
+  annotations:
+    helm.sh/resource-policy: keep
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: syncthing-shared-nfs
+  resources:
+    requests:
+      storage: 30Gi

clusters/base/apps/vaultwarden/helmrelease.yaml

@@ -0,0 +1,69 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: vaultwarden
+  namespace: vaultwarden
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: vaultwarden
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      vaultwarden:
+        containers:
+          app:
+            image:
+              repository: vaultwarden/server
+              tag: 1.37.0
+            env:
+              DOMAIN: "https://vw.aggtaa.com"
+              SIGNUPS_ALLOWED: "false"
+              WEBSOCKET_ENABLED: "true"
+              ADMIN_TOKEN:
+                valueFrom:
+                  secretKeyRef:
+                    name: vaultwarden-secrets
+                    key: ADMIN_TOKEN
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+
+    service:
+      app:
+        controller: vaultwarden
+        ports:
+          http:
+            port: 80
+
+    ingress:
+      app:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: vw.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: vaultwarden-tls
+            hosts:
+              - vw.aggtaa.com
+
+    persistence:
+      data:
+        type: persistentVolumeClaim
+        storageClass: longhorn
+        accessMode: ReadWriteOnce
+        size: 2Gi
+        retain: true
+        globalMounts:
+          - path: /data

clusters/base/apps/vaultwarden/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: vaultwarden
+  namespace: vaultwarden
+spec:
+  interval: 1h
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/vaultwarden/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - secret.enc.yaml
+  - helmrelease.yaml
+  

clusters/base/apps/vaultwarden/secret.enc.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: vaultwarden-secrets
+    namespace: vaultwarden
+stringData:
+    #ENC[AES256_GCM,data:bFZ/wUZ6oINU4pYH5EnWQSyOsLngnr8CMgIMDDNTN9F1HCqPQMp2TQjh5nLpBIWegJ8VxhaGc5+d,iv:Jvrw4+Cuec/X/AV8iK+SmO3P7C8Ua2ko9vTOBUAhSEI=,tag:bQ66e+Uz4BAbMEPzbONFaw==,type:comment]
+    ADMIN_TOKEN: ENC[AES256_GCM,data:yYxQ9/DkzA8KCZYqsDnQbkDBynnLTHZ/CTnZQvl2sijMaeHAeAgFDUhFC8ew8ud6Gu9vvh9V1hUHeBnsxKASxmuNP9HOOSu0irpcgUDYU5nxcAhEVzgKvP9JGhc/XinbA/7jVxXiEf2I6hEApGylPQmoIe9QJw==,iv:hqNaSZovw+3ao5059kgwJQ024HohHRXf02FR2/rLWFM=,tag:ez/enc/6s8CHoJ+264gURg==,type:str]
+sops:
+    age:
+        - recipient: age109zta6l0cwpkxn5wek82kvauxn6yqrq80rsz4mvu5atdnpcn9pusuvnqk5
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBncHhhUW9MNkUwcHlMS1Vm
+            dERHL0dyN2ZIVklSSkJwRnNQR2dtZjhpWHlBCjVVVGN5ZUhtdGpNSEhXUjhCWkln
+            b0h3TkpaN0UrRWFuZzd2d1JiWlRIV3MKLS0tIGJKNE1jSTVxamsva2tUSUVpbzhj
+            KzVYek9IZldwSStXN3BCSXNvcFVNTUEKRivXr6lUXL/45wgxPIuQAqfgSzZe6Ofz
+            vT5NsMte67eCYwmAF/+wSPZP5Y7OI7UzPedTUIMvn5vUMy70vssB/Q==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-26T10:29:48Z"
+    mac: ENC[AES256_GCM,data:Td2STb6nbH3Q383YxUMgecnmBRnsH1cNq0Iv1/q5OvESpIzhVCeVgJMIKBWEQJNfuxdyXR9mbFJ5zELIBS2ymGihtr4pHMKxj/kFpj1zPBqy+OKhP+E67juiRVMg6DJDSbdFHP21dOetllkcRgG6SImuOPQXQ3eozmPg/vpi3Xw=,iv:Q1B8KUrzBGIb2wBTZPjdb0a7XMyp5BpDf9qa8wx0smw=,tag:k54imcB/x03ttFVQKamKiQ==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

clusters/base/apps/webdav/configmap.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: webdav-config
+  namespace: webdav
+data:
+  config.yml: |
+    address: 0.0.0.0
+    port: 6065
+
+    directory: /webdav
+
+    permissions: R
+
+    users:
+      - username: "{env}WEBDAV_USERNAME"
+        password: "{env}WEBDAV_PASSWORD"
+        permissions: CRUD

clusters/base/apps/webdav/helmrelease.yaml

@@ -0,0 +1,102 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: webdav
+  namespace: webdav
+spec:
+  interval: 30m
+  timeout: 10m
+  chartRef:
+    kind: OCIRepository
+    name: webdav
+  driftDetection:
+    mode: enabled
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    controllers:
+      app:
+        containers:
+          app:
+            image:
+              repository: ghcr.io/hacdias/webdav
+              tag: v5.14.2
+            args:
+              - "-c"
+              - "/config.yml"
+            env:
+              TZ: Europe/Moscow
+              WEBDAV_USERNAME:
+                valueFrom:
+                  secretKeyRef:
+                    name: webdav-secrets
+                    key: WEBDAV_USERNAME
+              WEBDAV_PASSWORD:
+                valueFrom:
+                  secretKeyRef:
+                    name: webdav-secrets
+                    key: WEBDAV_PASSWORD
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+            resources:
+              requests:
+                cpu: 50m
+                memory: 64Mi
+              limits:
+                memory: 256Mi
+
+    service:
+      app:
+        controller: app
+        ports:
+          http:
+            port: 6065
+
+    ingress:
+      app:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: dav.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: webdav-tls
+            hosts:
+              - dav.aggtaa.com
+
+    persistence:
+      config-yml:
+        type: configMap
+        name: webdav-config
+        globalMounts:
+          - path: /config.yml
+            subPath: config.yml
+            readOnly: true
+      data:
+        type: persistentVolumeClaim
+        existingClaim: ganesha-export
+        globalMounts:
+          - path: /webdav/export
+      sda2:
+        type: persistentVolumeClaim
+        existingClaim: nas1-sda2
+        globalMounts:
+          - path: /webdav/nas1/sda2
+      sdb2:
+        type: persistentVolumeClaim
+        existingClaim: nas1-sdb2
+        globalMounts:
+          - path: /webdav/nas1/sdb2

clusters/base/apps/webdav/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: webdav
+  namespace: webdav
+spec:
+  interval: 1h
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/webdav/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - configmap.yaml
+  - secret.enc.yaml
+  - pv-pvc-data.yaml
+  - helmrelease.yaml

clusters/base/apps/webdav/pv-pvc-data.yaml

@@ -0,0 +1,109 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: ganesha-export-nfs
+spec:
+  capacity:
+    storage: 1Ti
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  mountOptions:
+    - nfsvers=4.1
+  nfs:
+    server: 10.0.64.5
+    path: /export
+  claimRef:
+    namespace: webdav
+    name: ganesha-export
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: ganesha-export
+  namespace: webdav
+  annotations:
+    helm.sh/resource-policy: keep
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: ganesha-export-nfs
+  resources:
+    requests:
+      storage: 1Ti
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: nas1-sda2-nfs
+spec:
+  capacity:
+    storage: 1Ti
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  mountOptions:
+    - nfsvers=3
+    - nolock
+  nfs:
+    server: 10.0.64.80
+    path: /mnt/sda2
+  claimRef:
+    namespace: webdav
+    name: nas1-sda2
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nas1-sda2
+  namespace: webdav
+  annotations:
+    helm.sh/resource-policy: keep
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: nas1-sda2-nfs
+  resources:
+    requests:
+      storage: 1Ti
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: nas1-sdb2-nfs
+spec:
+  capacity:
+    storage: 1Ti
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  mountOptions:
+    - nfsvers=3
+    - nolock
+  nfs:
+    server: 10.0.64.80
+    path: /mnt/sdb2
+  claimRef:
+    namespace: webdav
+    name: nas1-sdb2
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nas1-sdb2
+  namespace: webdav
+  annotations:
+    helm.sh/resource-policy: keep
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: nas1-sdb2-nfs
+  resources:
+    requests:
+      storage: 1Ti

clusters/base/apps/webdav/secret.enc.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: webdav-secrets
+    namespace: webdav
+stringData:
+    WEBDAV_USERNAME: ENC[AES256_GCM,data:leD9Xfk=,iv:PLT4ctrHZUoSVCxkel99UyaI2FQVCjWq/pgCC7u/W18=,tag:W7ypg88sYu9tNJOxjlgeSA==,type:str]
+    WEBDAV_PASSWORD: ENC[AES256_GCM,data:mpVRd5XzbQJdJKrEuixG8DVBmez4IW4+rp3/47QfGs7TLnMkJ3olPbHHleYFv1z4,iv:O066w8Sf4V8V6SFNjV3YoFUTm22vlSg8458GdSmo56Y=,tag:AHd0KrEqpBbsj3Pm4AcR/A==,type:str]
+sops:
+    age:
+        - recipient: age1y8t9v56yuvskznddqfsd4yddzzch0yf2dutvvt8rrx6rjh5f9g0s3qeays
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6bGRvZEc5Q3dVNHM1ZnIv
+            cDhGKzVhR2UwSnE2VW5JQVo5UEcyTzlXQ1M4CnptNERCNEMyUFh6aTFrc1FHV2pW
+            RWUvUGRNL3U5dnJhK0kwSEFFUzhneHMKLS0tIHgrWHFGMDgzdVpMRjFFWEU2ZDZC
+            SUN3WFMyODdxdlNoMlhmbFJUbEJQejAKRoY0DzKyIQmeyq9yf0IZe2A5LPVyA+Mi
+            aShqop1PqAytaLmizdqryTR9gfGACILuY/bzBhs2MzvTLaaXzkExbw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-26T10:29:49Z"
+    mac: ENC[AES256_GCM,data:9iTiXBfG3Ua05tye8fhtcccE+Px6nef6ZvUrM1IlLNNvMg71A7s24/4WTHrSptLtcswOXLKtLrV9uHBg4ssT3HMOer7RBb2kmkUBLKJPwNKBZdQOo/YB2ETA302IGEeBQNLLsNSrw4PiwSkzTMI6PErsAbdxRn80hjFig+gyozw=,iv:YetHHW1EpB/saKxvEWO90JQTEPPF1EOHD8h+KNbQECA=,tag:B8z9mcYTQibaGi4pUGcJeA==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

clusters/base/apps/zigbee2mqtt/helmrelease.yaml

@@ -0,0 +1,87 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: zigbee2mqtt
+  namespace: zigbee2mqtt
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: zigbee2mqtt
+      version: "2.12.1"
+      sourceRef:
+        kind: HelmRepository
+        name: zigbee2mqtt
+  driftDetection:
+    mode: enabled
+  values:
+    service:
+      type: ClusterIP
+      port: 8080
+
+    statefulset:
+      storage:
+        enabled: true
+        size: 1Gi
+        storageClassName: longhorn
+      secrets:
+        name: zigbee2mqtt-secrets
+
+    configmap:
+      enabled: true
+      # devices.yaml / groups.yaml already exist on the PV and are the live source
+      # of truth (zigbee2mqtt mutates them as devices pair/rename). Do not set
+      # configmap.devices here — the chart only seeds devices.yaml from it when
+      # the file is missing, but leaving it unset avoids any risk of clobbering
+      # the real data and any drift between this file and reality.
+
+    zigbee2mqtt:
+      homeassistant:
+        enabled: true
+        legacy_entity_attributes: true
+
+      permit_join: false
+      timezone: Europe/Moscow
+
+      mqtt:
+        server: "mqtt://mosquitto.mqtt.svc.cluster.local:1883"
+        user: iot
+        password: "!secret.yaml mqtt_password"
+        include_device_information: true
+        keepalive: 60
+        reject_unauthorized: true
+        version: 4
+
+      serial:
+        port: "tcp://10.0.64.72:6638"
+        adapter: ember
+        baudrate: 115200
+        rtscts: false
+
+      frontend:
+        enabled: true
+        port: 8080
+        url: "https://zigbee2mqtt.aggtaa.com"
+
+      advanced:
+        channel: 11
+        pan_id: 7410
+        ext_pan_id: [46, 22, 201, 245, 48, 186, 40, 6]
+        network_key: "!secret.yaml network_key"
+        log_level: info
+
+    ingress:
+      enabled: true
+      ingressClassName: traefik
+      annotations:
+        cert-manager.io/cluster-issuer: letsencrypt-prod
+        traefik.ingress.kubernetes.io/router.middlewares: auth-authelia@kubernetescrd
+      hosts:
+        - host: zigbee2mqtt.aggtaa.com
+          paths:
+            - path: /
+              pathType: Prefix
+      tls:
+        - secretName: zigbee2mqtt-tls
+          hosts:
+            - zigbee2mqtt.aggtaa.com

clusters/base/apps/zigbee2mqtt/helmrepository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: zigbee2mqtt
+  namespace: zigbee2mqtt
+spec:
+  interval: 1h
+  url: https://charts.zigbee2mqtt.io/

clusters/base/apps/zigbee2mqtt/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - secret.enc.yaml
+  - helmrelease.yaml

clusters/base/apps/zigbee2mqtt/secret.enc.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: zigbee2mqtt-secrets
+    namespace: zigbee2mqtt
+stringData:
+    secret.yaml: ENC[AES256_GCM,data:RdMKYeSHeJpHVJqglYAOyfdDyZyuc7KQheiq0vaxb5fs0DrgOYP2EgMKOcKA8Lh933W7u9qx/VrkOjBz+fm66vyAxwQKXvGZjnrM4RqtN0rW5UMG9C5s9zyQrepVECsqDiNpC2NCzRE9DsWX7Ux6Ak0RpMV0wkX1fAzVVwE=,iv:Uee5eN7qFyI2K7VgUEnTP506zy+ZK1uNFkemax48DhU=,tag:gvFAAUva/gJy1gBeZek50w==,type:str]
+sops:
+    age:
+        - recipient: age1tu4xgfefvgdda0vn2thaqndq4p9tuydq2ud6qa98tzzgnff6749qnlcx29
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB0Z3ZTdXMreGl0OWdjSkI0
+            T3lWRTNrUUJrSk9KVm12eW1na3AxZCtuNURVCk9UMHpOY1R0Uk9ZT2V4K0RMeDk1
+            cFBzcEE1RTJnUHFPVWZVaDh3R0xkQVUKLS0tIGxVVVNWSlAzVzR2dWdDZXFtTkNR
+            L3JVQ1ZCY3lRL25SLzBka2RBRFVNRWsKu3/3f9tH7GyzCEENtCTGDyK6l7lvQMw0
+            GSOZzZVClKfbCDrdjAqgly8ouGeYx0X19KtoHmggfH95nvcYheFFTA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-26T10:29:50Z"
+    mac: ENC[AES256_GCM,data:ZJAwVpj9OKeLqN3kEVtHdlouks29xb5a9DxRUnq7pNmf5lww8GKG1r8nfm9t6Z4JeuOBjN3zELjuEC9zBJ5Xpcdp2Ru8e3oD2816fu0feuiVkTXjaSrq1ZfHezvN5eHQqTU6Pmx5vSQcy8c7e61mI0VyYvOIUSXY4zfd1mDrIGc=,iv:qqFi/nUg+KWi/aBfJqlXqU3lnn8NZ8LS9CzbJcLOlpg=,tag:oykm3cfYCn3m63ajTS4rRQ==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

clusters/base/infra/cert-manager/certificate-issuers/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - letsencrypt-prod.yaml

clusters/base/infra/cert-manager/certificate-issuers/letsencrypt-prod.yaml

@@ -0,0 +1,16 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    server: https://acme-v02.api.letsencrypt.org/directory
+    # server: https://acme-staging-v02.api.letsencrypt.org/directory
+    email: admin@aggtaa.com
+    privateKeySecretRef:
+      name: letsencrypt-prod-account-key
+    solvers:
+      - http01:
+          ingress:
+            ingressClassName: traefik
+            

clusters/base/infra/longhorn/longhorn-system/backuptarget.yaml

@@ -0,0 +1,13 @@
+apiVersion: longhorn.io/v1beta2
+kind: BackupTarget
+metadata:
+  name: default
+  namespace: longhorn-system
+spec:
+  # this CR (not defaultSettings.backupTarget in helmrelease.yaml) is what
+  # Longhorn actually reads - it pre-existed this repo's management,
+  # pointing at a long-dead minio host. defaultSettings only seeds it on
+  # a truly fresh install, so it never overwrote the stale live object.
+  backupTargetURL: "s3://longhorn-backups@us-east-1/"
+  credentialSecret: longhorn-backup-target-secret
+  pollInterval: 5m0s

clusters/base/infra/longhorn/longhorn-system/helmrelease.yaml

@@ -0,0 +1,52 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: longhorn
+  namespace: longhorn-system
+spec:
+  interval: 30m
+  timeout: 15m
+  chart:
+    spec:
+      chart: longhorn
+      version: "1.12.1"
+      sourceRef:
+        kind: HelmRepository
+        name: longhorn
+        namespace: longhorn-system
+      interval: 1h
+  driftDetection:
+    mode: enabled
+  install:
+    createNamespace: false      # namespace создаём отдельным ресурсом с PSA-меткой
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    defaultSettings:
+      defaultReplicaCount: 3            # по числу нод control-plane
+      defaultDataPath: /var/lib/longhorn
+      guaranteedEngineManagerCPU: 12
+      guaranteedReplicaManagerCPU: 12
+      # points at the in-cluster rclone proxy (clusters/base/infra/longhorn/s3-backup-proxy),
+      # which itself encrypts and forwards to the real Wasabi bucket. "longhorn-backups" is
+      # a virtual bucket the proxy creates on demand under the crypt remote - already exists.
+      # region is a dummy value; the real endpoint comes from AWS_ENDPOINTS in the secret below.
+      backupTarget: "s3://longhorn-backups@us-east-1/"
+      backupTargetCredentialSecret: longhorn-backup-target-secret
+      # чтобы не разъезжались реплики при 3 нодах
+      replicaSoftAntiAffinity: false
+    persistence:
+      defaultClass: true
+      defaultClassReplicaCount: 3
+      defaultFsType: ext4
+      reclaimPolicy: Retain
+    csi:
+      attacherReplicaCount: 3
+      provisionerReplicaCount: 3
+      resizerReplicaCount: 3
+      snapshotterReplicaCount: 3
+    ingress:
+      enabled: false # exposed via Traefik explicitly

clusters/base/infra/longhorn/longhorn-system/helmrepository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: longhorn
+  namespace: longhorn-system
+spec:
+  interval: 1h
+  url: https://charts.longhorn.io

clusters/base/infra/longhorn/longhorn-system/ingress.yaml

@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: longhorn
+  namespace: longhorn-system
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.middlewares: auth-authelia@kubernetescrd
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: longhorn.aggtaa.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: longhorn-frontend
+                port:
+                  number: 80
+  tls:
+    - secretName: longhorn-tls
+      hosts:
+        - longhorn.aggtaa.com

clusters/base/infra/longhorn/longhorn-system/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - secret.enc.yaml
+  - helmrelease.yaml
+  - ingress.yaml
+  - backuptarget.yaml

clusters/base/infra/longhorn/longhorn-system/secret.enc.yaml

@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: longhorn-backup-target-secret
+    namespace: longhorn-system
+stringData:
+    AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:Yf3CM07ST98zuo595rsWL0ltYmc=,iv:+JOv1TEjFGygopzMHsQvpdaKfX3tWg1woLRtgw+hY4Q=,tag:+9flP+/Ap3cUwMWJ4LZj5w==,type:str]
+    AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:rzAUUcv4de7AbvAziJVfAYlwwn4TZhzrYwNhICPp+CNtn5hlhoZOTA==,iv:EQhgZ8iJlI7yHX0Pu1GKGACfGiyNT9ui8p6MhSrdvn0=,tag:Oku1Q/o54jx1pY5K73u8Dw==,type:str]
+    AWS_ENDPOINTS: ENC[AES256_GCM,data:upvLav5iZdAwfcZ7pJd7hgVRrTEn800Yh+js8KvCukZf1ybNSA2QAX9Dn3/c6gsmI9iJN8Ztg93MGCI85w==,iv:usiTtOM+uLcxVghNeoHo8+/bTIR9QfWiMz+ke+xPFDs=,tag:WPVw/nVNUSBbCUeVlxoKrg==,type:str]
+sops:
+    age:
+        - recipient: age18hhmdmupj90zjgjpxk3z5cf3lx36hcznnmqsp0fpyg50823pudrqjupydt
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBqSmJQYTFDN2tSZDBPYVpt
+            M2tub09CRkpUd0ZtS3M5TDdoU0k0N2FKdzJRCkNndkhaenBIQ0lUVWtjY0FCTTMx
+            ZGg2eWh6eEFudzg0d0lnRFN5VnN1MzAKLS0tIDZqUEswbmdmQ2d4aXlUVFdFREFM
+            WUkzNUZSRDgxeDVlN29aMFdWOWZRSHcKvoZaEwnjkOVw8pvkdpaTQvpbBSTuWUYN
+            XkzUPKQmtRLNp0bOgXyWpWWJj2i8ue5SI313g8GiJJWZZ4WesA/atA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-26T10:29:51Z"
+    mac: ENC[AES256_GCM,data:Gq7jEOcEjsJmJutnkUQZ/mr4aU11bCgHFz1cK0U3k61A9IULUqyV1j0/+ZNAF4JsXv255XcFsn6qouvFbKlAw3mg0LtjwP4zIkhIj+eThZ+EqfuoJ8F0vvLFijohu+kRNyafLJpNGHEqNvTFyd8OXKMNZET74UTHV4qseBMIf5o=,iv:EdEQVzK3yRa4RgP09m2gZirszwLv8Efwpt74jS/lpA0=,tag:YpZOC1kvpZMye24Ha1KEXA==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

clusters/base/infra/longhorn/recurring-jobs/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - recurringjob-backup.yaml

clusters/base/infra/longhorn/recurring-jobs/recurringjob-backup.yaml

@@ -0,0 +1,21 @@
+apiVersion: longhorn.io/v1beta2
+kind: RecurringJob
+metadata:
+  name: backup
+  namespace: longhorn-system
+spec:
+  task: "backup"
+  cron: "0 3 * * *"
+  retain: 7
+  concurrency: 2
+  # "default" is a special group name: Longhorn auto-applies it to every
+  # volume that has NO recurring-job label at all - i.e. opt-out. To
+  # exclude a specific volume, give it any other (job-less) group label,
+  # e.g.:
+  #   recurring-job-group.longhorn.io/no-backup: enabled
+  # (having *any* recurring-job label disqualifies it from "default" -
+  # there's no dedicated "disabled" flag, this placeholder-group is the
+  # documented workaround)
+  groups:
+    - default
+  labels: {}

clusters/base/infra/longhorn/s3-backup-proxy/helmrelease.yaml

@@ -0,0 +1,97 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: s3-backup-proxy
+  namespace: longhorn-system
+spec:
+  interval: 10m
+  chartRef:
+    kind: OCIRepository
+    name: s3-backup-proxy
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      app:
+        containers:
+          app:
+            image:
+              repository: rclone/rclone
+              tag: "1.75.0"
+            command:
+              - sh
+              - -c
+              - |
+                set -eu
+                # crypt's password/password2 must be stored "obscured" (rclone's
+                # reversible obfuscation, not real encryption on its own - the
+                # actual protection is the passphrase's entropy). Generating it
+                # here at startup from the plaintext secret env vars means the
+                # real secret only ever needs to exist as one sops-encrypted
+                # k8s Secret, never hand-obscured and pasted into git.
+                CRYPT_PASSWORD_OBS=$(rclone obscure "$CRYPT_PASSWORD")
+                CRYPT_PASSWORD2_OBS=$(rclone obscure "$CRYPT_PASSWORD2")
+                cat > /tmp/rclone.conf <<EOF
+                [wasabi]
+                type = s3
+                provider = Wasabi
+                access_key_id = ${WASABI_ACCESS_KEY_ID}
+                secret_access_key = ${WASABI_SECRET_ACCESS_KEY}
+                endpoint = s3.eu-central-1.wasabisys.com
+                region = eu-central-1
+
+                [crypt]
+                type = crypt
+                remote = wasabi:kubebackup
+                password = ${CRYPT_PASSWORD_OBS}
+                password2 = ${CRYPT_PASSWORD2_OBS}
+                filename_encryption = standard
+                directory_name_encryption = true
+                EOF
+                exec rclone serve s3 crypt: \
+                  --config /tmp/rclone.conf \
+                  --addr :8080 \
+                  --auth-key "${PROXY_ACCESS_KEY},${PROXY_SECRET_KEY}"
+            env:
+              WASABI_ACCESS_KEY_ID:
+                valueFrom:
+                  secretKeyRef:
+                    name: s3-backup-proxy-secrets
+                    key: WASABI_ACCESS_KEY_ID
+              WASABI_SECRET_ACCESS_KEY:
+                valueFrom:
+                  secretKeyRef:
+                    name: s3-backup-proxy-secrets
+                    key: WASABI_SECRET_ACCESS_KEY
+              CRYPT_PASSWORD:
+                valueFrom:
+                  secretKeyRef:
+                    name: s3-backup-proxy-secrets
+                    key: CRYPT_PASSWORD
+              CRYPT_PASSWORD2:
+                valueFrom:
+                  secretKeyRef:
+                    name: s3-backup-proxy-secrets
+                    key: CRYPT_PASSWORD2
+              PROXY_ACCESS_KEY:
+                valueFrom:
+                  secretKeyRef:
+                    name: s3-backup-proxy-secrets
+                    key: PROXY_ACCESS_KEY
+              PROXY_SECRET_KEY:
+                valueFrom:
+                  secretKeyRef:
+                    name: s3-backup-proxy-secrets
+                    key: PROXY_SECRET_KEY
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+
+    service:
+      app:
+        controller: app
+        ports:
+          http:
+            port: 8080

clusters/base/infra/longhorn/s3-backup-proxy/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: s3-backup-proxy
+  namespace: longhorn-system
+spec:
+  interval: 10m
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/infra/longhorn/s3-backup-proxy/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - secret.enc.yaml
+  - helmrelease.yaml

clusters/base/infra/longhorn/s3-backup-proxy/secret.enc.yaml

@@ -0,0 +1,27 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: s3-backup-proxy-secrets
+    namespace: longhorn-system
+stringData:
+    WASABI_ACCESS_KEY_ID: ENC[AES256_GCM,data:okf70ogiDqqAkpnSCBYkW9oATC4=,iv:iVs6x/2z2+gejRQMyXwpa/hXQ6xq7eXdMVA27IHiPqw=,tag:qXcpGptnTCipk/NX3Ph9Gw==,type:str]
+    WASABI_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:Pltg8OsVpXcET0qe5Zdwu38KBlR+oR6lT4yVi2rwNMmJxu4HryqMEw==,iv:oROBr2u09mdUVeffu/dyCIwmKabFMpOK17BL9uHx0VU=,tag:Tgmnqy4RWe4tvbEuqz5t7w==,type:str]
+    CRYPT_PASSWORD: ENC[AES256_GCM,data:PbwJlJfz6jTM67qGi0tGkF9b5nVd0OhzRu3cTUn8IZVHIaDq7JQpykmq3g==,iv:UNkWK3DpY3Ux5g/SG5tAY5RU0spm1D/B+j5lp4eTxkg=,tag:0l9WxfSalrKaCDF4RAWoew==,type:str]
+    CRYPT_PASSWORD2: ENC[AES256_GCM,data:An7PTYE6Kp4ym17cFJ4HD+kiXbFgz0qOxRUTPjXFpoj++4QFzgG5PwnZuQ==,iv:TwcnYlyuN3o/tvQrxhuirBNL48lD66GzL4XUTdKzyIA=,tag:NoEp7DfdLCFQ8ju6Tk8adQ==,type:str]
+    PROXY_ACCESS_KEY: ENC[AES256_GCM,data:AIpKJPLYOrda/lyklBKtkbfyBx8=,iv:b0xXnfhsp4gh/v+wYYSinKCpj0fZcgm+yrrOC5MYJWs=,tag:CNMVLrAouXmDxLqlkYI3CQ==,type:str]
+    PROXY_SECRET_KEY: ENC[AES256_GCM,data:hz3GyFtbbTnVqWi8O+P7aRUS2IA0oDipgtBq8KPpDEyclv1rdBGkfQ==,iv:UqL4wYouaVuJwBlgJzfbrPfs7hksgyaY2a2cBPPUQn4=,tag:w4cYoFVkRodXC8dK9CG3IQ==,type:str]
+sops:
+    age:
+        - recipient: age15vc3geq4lsec69rnxczluvwgcexeqae02zxzjpswsuatthaasu7qzath48
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBoVVVHYXlTM00ydVJjdXFL
+            U0k5clRFY2VlMStzZE9DeVlweDNDelJUTjNBCmNwbWw1UldxNG5XZzdZZzh1UStw
+            eFlQa2k4UU1DWUdlMUF6N20rOUNwSmsKLS0tIEtsbUdBNnZYT1BmRmg3enF5Nmp0
+            Z3p0UzZkS0VHdDhRbEU4Q3M5bnA0RDQKWcny31QSOW0t/XDeBspoymNK5vN1ltqI
+            mdWodYgxrZ7qgaBABL18QENAJMm2i/C3VY6upqGjTjxSq7+huKfTQg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-26T10:29:52Z"
+    mac: ENC[AES256_GCM,data:knkRyXRoKdjhyWZIWDCRW5MuhxtxeTm42Fm+rtVZawECWCSIqxTYSfQ6xW9RlalMcsHpdW4QTHDBgZhp6APDe3f+9Frn59UCDa415hqm4VCreDFhqy+x5kUslpT8Zg1ggsiWTv6/XxI2NM0LswoDu6akAEKnBRYJ6S7aam1++oc=,iv:Z8y1HAlzSgbEjX8sh8drHQj6Oigt13m3kYLvWAJZTGs=,tag:iunewDP8PGlj6iTaqAnbnw==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

clusters/base/infra/longhorn/storage-classes/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - longhorn-no-retain.yaml
+  - longhorn-single-replica.yaml

clusters/base/infra/longhorn/storage-classes/longhorn-no-retain.yaml

@@ -0,0 +1,12 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: longhorn-no-retain
+  annotations:
+    storageclass.kubernetes.io/is-default-class: "false"
+provisioner: driver.longhorn.io
+reclaimPolicy: Delete
+allowVolumeExpansion: true
+parameters:
+  numberOfReplicas: "3"
+  staleReplicaTimeout: "30"

clusters/base/infra/longhorn/storage-classes/longhorn-single-replica.yaml

@@ -0,0 +1,12 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: longhorn-single-replica
+  annotations:
+    storageclass.kubernetes.io/is-default-class: "false"
+provisioner: driver.longhorn.io
+reclaimPolicy: Retain
+allowVolumeExpansion: true
+parameters:
+  numberOfReplicas: "1"
+  staleReplicaTimeout: "30"

clusters/base/infra/metallb/config.yaml

@@ -0,0 +1,75 @@
+# a general pool for everything but mqtt and public IP facing ingress controller
+apiVersion: metallb.io/v1beta1
+kind: IPAddressPool
+metadata:
+  name: default-pool
+  namespace: metallb-system
+spec:
+  addresses:
+    # exclude 10.0.64.5, its in nfs-pool
+    - 10.0.64.6/32
+    # exclude 10.0.64.7, its in dmz-pool
+    # exclude 10.0.64.8, its in mqtt-pool
+    - 10.0.64.9-10.0.64.19
+  autoAssign: true
+  serviceAllocation:
+    serviceSelectors:
+      - matchLabels:
+          loadBalancerPool: default
+---
+# NFS ip
+apiVersion: metallb.io/v1beta1
+kind: IPAddressPool
+metadata:
+  name: nfs-pool
+  namespace: metallb-system
+spec:
+  addresses:
+    - 10.0.64.5/32
+  autoAssign: true
+  serviceAllocation:
+    serviceSelectors:
+      - matchLabels:
+          loadBalancerPool: nfs
+---
+# DMZ (not really, just for clarity) ip, will have ports forwarded from WAN router
+apiVersion: metallb.io/v1beta1
+kind: IPAddressPool
+metadata:
+  name: dmz-pool
+  namespace: metallb-system
+spec:
+  addresses:
+    - 10.0.64.7/32
+  autoAssign: true
+  serviceAllocation:
+    serviceSelectors:
+      - matchLabels:
+          loadBalancerPool: dmz
+---
+# reserve 10.0.64.8 (for historical reasons) for mqtt
+# ! do not forget to label the mqtt service with "loadBalancerPool: mqtt" !
+apiVersion: metallb.io/v1beta1
+kind: IPAddressPool
+metadata:
+  name: mqtt-pool
+  namespace: metallb-system
+spec:
+  addresses:
+    - 10.0.64.8/32
+  serviceAllocation:
+    serviceSelectors:
+      - matchLabels:
+          loadBalancerPool: mqtt
+---
+apiVersion: metallb.io/v1beta1
+kind: L2Advertisement
+metadata:
+  name: default
+  namespace: metallb-system
+spec:
+  ipAddressPools:
+    - default-pool
+    - dmz-pool
+    - mqtt-pool
+    - nfs-pool

clusters/base/infra/metallb/helmrelease.yaml

@@ -0,0 +1,17 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: metallb
+  namespace: metallb-system
+spec:
+  interval: 10m
+  chart:
+    spec:
+      chart: metallb
+      version: "0.16.1"
+      sourceRef:
+        kind: HelmRepository
+        name: metallb
+        namespace: metallb-system
+  driftDetection:
+    mode: enabled

clusters/base/infra/metallb/helmrepository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: metallb
+  namespace: metallb-system
+spec:
+  interval: 1h
+  url: https://metallb.github.io/metallb

clusters/base/infra/metallb/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - helmrelease.yaml
+  - config.yaml

clusters/base/namespaces/ai.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: ai

clusters/base/namespaces/auth.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: auth

clusters/base/namespaces/finance.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: finance

clusters/base/namespaces/homeassistant.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: homeassistant

clusters/base/namespaces/longhorn-system.yaml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: longhorn-system
+  labels:
+    pod-security.kubernetes.io/enforce: privileged

clusters/base/namespaces/mcp.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: mcp

clusters/base/namespaces/metallb-system.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: metallb-system

clusters/base/namespaces/mqtt.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: mqtt

clusters/base/namespaces/nfs.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: nfs

clusters/base/namespaces/photo.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: photo