ntfy users via env+secret

Fixes IsADirectoryError on startup when the app tried to atomically
write its change-tracking state to /data/state itself.

.gitignore

@@ -0,0 +1,5 @@
+migration-from-old-files/
+migration-from-docker/
+.decrypted~secret.enc.yaml
+gitea-backup/
+*.agekey

.sops.yaml

@@ -0,0 +1,46 @@
+creation_rules:
+  - path_regex: authelia.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age1ncw6uagcgncd5m2admqxt73ey0mcd99jsw9sa9lcdv3gu70mcerql8ya0k
+  - path_regex: davical.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age1yx8mey02c0mu6te9hwxwdqp5n4enjz35e8thchsmvhqw7xsrzy0syg367g
+  - path_regex: immich.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age1wmm8qrqnjzvd5nkraed6ylrsxlpn3ru7d7zettdudj7y9sg9dd2su0u3mr
+  - path_regex: markdown-vault-mcp.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age1kct5g7d7eus2hvdnmx99ewsrtz70lhlasxa25euqwdctqhwqqpxqz0n7gg
+  - path_regex: mosquitto.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age1u236u5mzkzj72y4mfxx68gfqw0u0j6tdgkudnm5pdfpe7apq4u6s89jr2h
+  - path_regex: vaultwarden.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age109zta6l0cwpkxn5wek82kvauxn6yqrq80rsz4mvu5atdnpcn9pusuvnqk5
+  - path_regex: webdav.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age1y8t9v56yuvskznddqfsd4yddzzch0yf2dutvvt8rrx6rjh5f9g0s3qeays
+  - path_regex: zigbee2mqtt.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age1tu4xgfefvgdda0vn2thaqndq4p9tuydq2ud6qa98tzzgnff6749qnlcx29
+  - path_regex: longhorn-system.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age18hhmdmupj90zjgjpxk3z5cf3lx36hcznnmqsp0fpyg50823pudrqjupydt
+  - path_regex: s3-backup-proxy.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age15vc3geq4lsec69rnxczluvwgcexeqae02zxzjpswsuatthaasu7qzath48
+  - path_regex: joplin.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age1dertyl956fjsmh00cw468gdnl7lf3frasg4n4c82z0chm6qm2cks6w8gha
+  - path_regex: gitea.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age1ktlxm0hukw6jxm62txqy5x2nl8hpdnal8nv00kfhrf3pw33574aqa6j5cj
+  - path_regex: woodpecker.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age13qwkssk8esashln2j3gfv6e9csashr4vddkdav5v38hm5wejl36qd2ew9s
+  - path_regex: tinyauth.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age1rvyt7nlnjqeyt6ykwh9fj9d88kjmq9vetcx667ul3ql6fyfz4gqqh9lq9q
+  - path_regex: ntfy.*\.enc\.yaml$
+    encrypted_regex: ^(data|stringData)$
+    age: age1uzs33ep6k3htnuwyyp54y373wkf7urd0qvk5kxcmptr5tt0fffus4v06gn

clusters/base/apps/authelia/helmrelease.yaml

@@ -0,0 +1,70 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: authelia
+  namespace: auth
+spec:
+  interval: 10m
+  chartRef:
+    kind: OCIRepository
+    name: authelia
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      auth:
+        containers:
+          app:
+            image:
+              repository: authelia/authelia
+              tag: 4.39.21
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+
+    service:
+      app:
+        controller: auth
+        ports:
+          http:
+            port: 9091
+
+    ingress:
+      app:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: auth.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: auth-tls
+            hosts:
+              - auth.aggtaa.com
+
+    persistence:
+      config:
+        type: secret
+        name: authelia-secrets
+        globalMounts:
+          - path: /config/configuration.yml
+            subPath: configuration.yml
+            readOnly: true
+          - path: /config/users_database.yml
+            subPath: users_database.yml
+            readOnly: true
+      db:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 1Gi
+        storageClass: longhorn
+        retain: true
+        globalMounts:
+          - path: /db

clusters/base/apps/authelia/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: authelia
+  namespace: auth
+spec:
+  interval: 1h
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/authelia/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - helmrelease.yaml
+  - middleware.yaml
+  - secret.enc.yaml
+  

clusters/base/apps/authelia/middleware.yaml

@@ -0,0 +1,14 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: authelia
+  namespace: auth
+spec:
+  forwardAuth:
+    address: http://authelia.auth.svc.cluster.local:9091/api/verify?rd=https://auth.aggtaa.com
+    trustForwardHeader: true
+    authResponseHeaders:
+      - Remote-User
+      - Remote-Groups
+      - Remote-Name
+      - Remote-Email

clusters/base/apps/davical/helmrelease-davical.yaml

@@ -0,0 +1,118 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: davical
+  namespace: pim
+spec:
+  interval: 10m
+  dependsOn:
+    - name: davical-postgres
+  chartRef:
+    kind: OCIRepository
+    name: davical
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      app:
+        initContainers:
+          seed-config:
+            image:
+              repository: tuxnvape/davical-standalone
+              tag: "82-1.1.12"
+            command:
+              - sh
+              - -c
+              - |
+                if [ ! -f /mnt/config-pvc/davical.php ]; then
+                  cp -r /config/. /mnt/config-pvc/
+                fi
+                # Apache's SCRIPT_NAME (and DAViCal's base_url derived from it)
+                # only reflects the /server prefix if Apache itself resolves
+                # that prefix - Traefik forwards the path unstripped. Add an
+                # Alias so /server/* maps to the app root; idempotent so it
+                # self-heals if apache.conf predates this fix.
+                if ! grep -q '^\s*Alias /server ' /mnt/config-pvc/apache.conf; then
+                  sed -i '/^\s*DocumentRoot \/usr\/share\/davical\/htdocs/a\        Alias /server /usr/share/davical/htdocs' /mnt/config-pvc/apache.conf
+                fi
+        containers:
+          app:
+            image:
+              repository: tuxnvape/davical-standalone
+              tag: "82-1.1.12"
+            env:
+              TZ: Europe/Moscow
+              HOST_NAME: c.aggtaa.com
+              DBHOST: davical-postgres
+              UPDATE_FROM_OLD: "false"
+              PGSQL_ROOT_PASS:
+                valueFrom:
+                  secretKeyRef:
+                    name: davical-secrets
+                    key: PGSQL_ROOT_PASS
+              PASSDAVDB:
+                valueFrom:
+                  secretKeyRef:
+                    name: davical-secrets
+                    key: PASSDAVDB
+              ADMINDAVICALPASS:
+                valueFrom:
+                  secretKeyRef:
+                    name: davical-secrets
+                    key: ADMINDAVICALPASS
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+              startup:
+                enabled: true
+                spec:
+                  periodSeconds: 5
+                  failureThreshold: 30
+                  timeoutSeconds: 3
+
+    service:
+      app:
+        controller: app
+        ports:
+          http:
+            port: 80
+
+    ingress:
+      app:
+        className: traefik
+        # no cert-manager annotation here: infcloud's own Ingress already
+        # requests/owns the Certificate for c.aggtaa.com -> radicale-tls.
+        # A second Ingress with the annotation would create a competing
+        # Certificate for the same host/secret.
+        #
+        # No stripPrefix middleware either: Apache needs to see the /server
+        # prefix itself (via the Alias added in the seed-config initContainer)
+        # so that DAViCal's self-referential links come out correct.
+        hosts:
+          - host: c.aggtaa.com
+            paths:
+              - path: /server
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: radicale-tls
+            hosts:
+              - c.aggtaa.com
+
+    persistence:
+      config:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 256Mi
+        storageClass: longhorn
+        retain: true
+        advancedMounts:
+          app:
+            app:
+              - path: /config
+            seed-config:
+              - path: /mnt/config-pvc

clusters/base/apps/davical/helmrelease-postgres.yaml

@@ -0,0 +1,45 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: davical-postgres
+  namespace: pim
+spec:
+  interval: 10m
+  chartRef:
+    kind: OCIRepository
+    name: davical
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      postgres:
+        containers:
+          app:
+            image:
+              repository: postgres
+              tag: "16.14-alpine"
+            env:
+              TZ: Europe/Moscow
+              POSTGRES_PASSWORD:
+                valueFrom:
+                  secretKeyRef:
+                    name: davical-secrets
+                    key: PGSQL_ROOT_PASS
+
+    service:
+      app:
+        controller: postgres
+        ports:
+          postgres:
+            port: 5432
+
+    persistence:
+      data:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 2Gi
+        storageClass: longhorn
+        retain: true
+        globalMounts:
+          - path: /var/lib/postgresql/data
+            subPath: data

clusters/base/apps/davical/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: davical
+  namespace: pim
+spec:
+  interval: 10m
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/davical/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - secret.enc.yaml
+  - helmrelease-postgres.yaml
+  - helmrelease-davical.yaml

clusters/base/apps/davical/secret.enc.yaml

@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: davical-secrets
+    namespace: pim
+stringData:
+    PGSQL_ROOT_PASS: ENC[AES256_GCM,data:XEhP2zDIz0QCpAXXnZi5JtPsVIfns9zp4fvxcg9/bskHiLU5rR+EgU5n/SdOEDkJ,iv:wR3CGk3csHSCSBqFX+ukOUAmS/p+oZMmdNgvCFNHZlI=,tag:ttAe0GuLmwqA77cWLlne2Q==,type:str]
+    PASSDAVDB: ENC[AES256_GCM,data:d9RazQG7xeIH4g3ovti6HwyiIyLTzyaPjAcQvLmhsrwdgev7i0AJK7yQeRXxu/16,iv:9ZdfWTlOuyUNpV2ycykOgx8SY7Golz7/Lb+gfTa9fW0=,tag:eL1euF9uQJ+nDLsR1kxtvg==,type:str]
+    ADMINDAVICALPASS: ENC[AES256_GCM,data:1Zq7duPTIfJX2Stp6AEhKcLHkmQB6vWf4y1f0Iju/zI=,iv:PMOyD3O7UzVPRlFmHTOQSAys032iD4CF8JbI51agWcg=,tag:eDgMbg2lRMnl57NCf5iIkw==,type:str]
+sops:
+    age:
+        - recipient: age1yx8mey02c0mu6te9hwxwdqp5n4enjz35e8thchsmvhqw7xsrzy0syg367g
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBjNTVJZEFuRFhGazF6T1Yv
+            dnhhTHVUb1h4SEN2eEtDUGREUERkR2wrTUVVCktGSkVLZmlYR3BjekhjNmk4L3Q4
+            UEJsQXJjZXY1VlNDaFV2eER4NTdwRGcKLS0tIDJxb1AyYm01YlNUVk93Tm1Hb0xK
+            NVh0K25yOFUya0dYSGt2SGdJQURnQ2sKaKgwThB5ePeM091/zYgQXmiPeBeIhTdo
+            60PkAPNs659xyVqnlZw2YKEhxbEHS3ZMTBgC4tgng0yjClBizcTv5w==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-08T16:37:01Z"
+    mac: ENC[AES256_GCM,data:OoE6fml/3DSH2EMafCoeYz/JHo89Fb9uwQ58k7hxQDU6YMazdO/eGM0jKX5ghjuMKJqA/zQs4FeZ4yASkIUT1CBbxRpycmE9qo6Zny121NLeqveBp3YMjmUZGt3tgw2dNqtkhpOnl/BmHQCtTTvX2brtSVmANx3LbFxjqbK2OGM=,iv:8Us7LJSZ2aHZQnYIjnsvkR7Av0KeHFEYEETZd7WZX4Q=,tag:7NbbEOq1k2c5IcsnqpvlOQ==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

clusters/base/apps/dev/ingress.yaml

@@ -0,0 +1,104 @@
+# Three Ingresses on one host because middlewares and router priority are
+# per-Ingress. Traefik matches pathType Prefix character-wise (not per path
+# segment), so public prefixes carry a trailing slash and priorities are
+# explicit - by default Traefik orders routers by rule length, which would
+# not reliably put /api/admin above /api/.
+#   300 dev-admin  /api/admin  -> Authelia -> api (prefix /api stripped)
+#   200 dev-public /api/ /m /m/ -> api / m, public (prefixes stripped)
+#   100 dev        /           -> Authelia -> ui (also bare /api)
+# All carry the tls section (otherwise the router is http-only), but only
+# "dev" has the cert-manager annotation so a single Certificate owns dev-tls.
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: dev
+  namespace: dev
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    traefik.ingress.kubernetes.io/router.priority: "100"
+    traefik.ingress.kubernetes.io/router.middlewares: auth-tinyauth@kubernetescrd
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: dev.aggtaa.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: dev
+                port:
+                  name: ui
+  tls:
+    - secretName: dev-tls
+      hosts:
+        - dev.aggtaa.com
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: dev-admin
+  namespace: dev
+  annotations:
+    traefik.ingress.kubernetes.io/router.priority: "300"
+    traefik.ingress.kubernetes.io/router.middlewares: auth-tinyauth@kubernetescrd,dev-strip-prefix@kubernetescrd
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: dev.aggtaa.com
+      http:
+        paths:
+          # no trailing slash on purpose: also catches bare /api/admin
+          # (and /api/administrator...), all of which stay behind Authelia
+          - path: /api/admin
+            pathType: Prefix
+            backend:
+              service:
+                name: dev
+                port:
+                  name: api
+  tls:
+    - secretName: dev-tls
+      hosts:
+        - dev.aggtaa.com
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: dev-public
+  namespace: dev
+  annotations:
+    traefik.ingress.kubernetes.io/router.priority: "200"
+    traefik.ingress.kubernetes.io/router.middlewares: dev-strip-prefix@kubernetescrd
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: dev.aggtaa.com
+      http:
+        paths:
+          - path: /api/
+            pathType: Prefix
+            backend:
+              service:
+                name: dev
+                port:
+                  name: api
+          - path: /m
+            pathType: Exact
+            backend:
+              service:
+                name: dev
+                port:
+                  name: m
+          - path: /m/
+            pathType: Prefix
+            backend:
+              service:
+                name: dev
+                port:
+                  name: m
+  tls:
+    - secretName: dev-tls
+      hosts:
+        - dev.aggtaa.com

clusters/base/apps/dev/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - service.yaml
+  - middleware.yaml
+  - ingress.yaml

clusters/base/apps/dev/middleware.yaml

@@ -0,0 +1,13 @@
+# Shared by dev-admin and dev-public: /api/a -> /a, /api/admin/b -> /admin/b,
+# /m/main.css -> /main.css. Only the first matching prefix is stripped, and
+# none of these routes can match both.
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: strip-prefix
+  namespace: dev
+spec:
+  stripPrefix:
+    prefixes:
+      - /api
+      - /m

clusters/base/apps/dev/service.yaml

@@ -0,0 +1,40 @@
+# dev.aggtaa.com backends live outside the cluster on 10.0.64.157:
+# selector-less Service + hand-written EndpointSlice point at them.
+apiVersion: v1
+kind: Service
+metadata:
+  name: dev
+  namespace: dev
+spec:
+  ports:
+    - name: ui
+      port: 10001
+    - name: api
+      port: 10002
+    - name: m
+      port: 10003
+---
+apiVersion: discovery.k8s.io/v1
+kind: EndpointSlice
+metadata:
+  name: dev-external
+  namespace: dev
+  labels:
+    kubernetes.io/service-name: dev
+    endpointslice.kubernetes.io/managed-by: flux
+addressType: IPv4
+ports:
+  - name: ui
+    port: 10001
+    protocol: TCP
+  - name: api
+    port: 10002
+    protocol: TCP
+  - name: m
+    port: 10003
+    protocol: TCP
+endpoints:
+  - addresses:
+      - 10.0.64.157
+    conditions:
+      ready: true

clusters/base/apps/fava/helmrelease.yaml

@@ -0,0 +1,81 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: fava
+  namespace: finance
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: fava
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      app:
+        initContainers:
+          seed-ledger:
+            image:
+              repository: busybox
+              tag: "1.36"
+            command:
+              - sh
+              - -c
+              - |
+                if [ ! -f /documents/main.beancount ]; then
+                  printf '1970-01-01 open Assets:Cash\n1970-01-01 open Equity:Opening-Balances\n' > /documents/main.beancount
+                fi
+        containers:
+          app:
+            image:
+              repository: yegle/fava
+              tag: "v1.30"
+            env:
+              TZ: Europe/Moscow
+              BEANCOUNT_FILE: /documents/main.beancount
+            args:
+              - "--poll-watcher"              
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+            resources:
+              requests:
+                cpu: 50m
+                memory: 128Mi
+              limits:
+                memory: 512Mi
+
+    service:
+      app:
+        controller: app
+        ports:
+          http:
+            port: 5000
+
+    ingress:
+      app:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+          traefik.ingress.kubernetes.io/router.middlewares: auth-tinyauth@kubernetescrd
+        hosts:
+          - host: acc.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: fava-tls
+            hosts:
+              - acc.aggtaa.com
+
+    persistence:
+      documents:
+        type: persistentVolumeClaim
+        existingClaim: fava-documents
+        globalMounts:
+          - path: /documents

clusters/base/apps/fava/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: fava
+  namespace: finance
+spec:
+  interval: 1h
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/fava/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - helmrelease.yaml
+  - pv-pvc-documents.yaml

clusters/base/apps/fava/pv-pvc-documents.yaml

@@ -0,0 +1,35 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: fava-documents-nfs
+spec:
+  capacity:
+    storage: 30Gi
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  mountOptions:
+    - nfsvers=4.1
+  nfs:
+    server: 10.0.64.5
+    path: /export/accounting
+  claimRef:
+    namespace: finance
+    name: fava-documents
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: fava-documents
+  namespace: finance
+  annotations:
+    helm.sh/resource-policy: keep
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: fava-documents-nfs
+  resources:
+    requests:
+      storage: 30Gi

clusters/base/apps/gitea/helmrelease.yaml

@@ -0,0 +1,105 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: gitea
+  namespace: git
+spec:
+  interval: 10m
+  chartRef:
+    kind: OCIRepository
+    name: gitea
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      app:
+        replicas: 1
+        containers:
+          app:
+            image:
+              repository: gitea/gitea
+              tag: "1.27.0"
+            env:
+              USER_UID: "1000"
+              USER_GID: "1000"
+              GITEA__server__DOMAIN: git.aggtaa.com
+              GITEA__server__ROOT_URL: https://git.aggtaa.com/
+              GITEA__server__SSH_DOMAIN: git-ssh.aggtaa.com
+              GITEA__server__SSH_PORT: "2222"
+              GITEA__server__LFS_START_SERVER: "true"
+              GITEA__webhook__ALLOWED_HOST_LIST: ci.aggtaa.com
+              GITEA__security__INSTALL_LOCK: "true"
+              GITEA__security__PASSWORD_HASH_ALGO: pbkdf2
+              GITEA__security__INTERNAL_TOKEN:
+                valueFrom:
+                  secretKeyRef:
+                    name: gitea-secrets
+                    key: INTERNAL_TOKEN
+              GITEA__oauth2__JWT_SECRET:
+                valueFrom:
+                  secretKeyRef:
+                    name: gitea-secrets
+                    key: OAUTH2_JWT_SECRET
+              GITEA__server__LFS_JWT_SECRET:
+                valueFrom:
+                  secretKeyRef:
+                    name: gitea-secrets
+                    key: LFS_JWT_SECRET
+            probes:
+              startup:
+                enabled: true
+                spec:
+                  periodSeconds: 5
+                  failureThreshold: 60
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+            resources:
+              requests:
+                cpu: 50m
+                memory: 256Mi
+              limits:
+                memory: 1Gi
+
+    service:
+      app:
+        controller: app
+        ports:
+          http:
+            port: 3000
+      ssh:
+        controller: app
+        type: LoadBalancer
+        labels:
+          loadBalancerPool: default
+        ports:
+          ssh:
+            port: 2222
+            targetPort: 22
+            protocol: TCP
+
+    ingress:
+      app:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: git.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: gitea-tls
+            hosts:
+              - git.aggtaa.com
+
+    persistence:
+      data:
+        type: persistentVolumeClaim
+        existingClaim: gitea-data
+        globalMounts:
+          - path: /data

clusters/base/apps/gitea/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: gitea
+  namespace: git
+spec:
+  interval: 10m
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/gitea/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - secret.enc.yaml
+  - pvc.yaml
+  - helmrelease.yaml

clusters/base/apps/gitea/pvc.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: gitea-data
+  namespace: git
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 3Gi

clusters/base/apps/gitea/secret.enc.yaml

@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: gitea-secrets
+    namespace: git
+stringData:
+    INTERNAL_TOKEN: ENC[AES256_GCM,data:+eS1bjyL/NKvOpkXa1Kiyk9dBPemWvfRplJJCXG+cLXipbMlyHBDQLEMeFEnz9VdnwN/MFRWYL5ink3Lh6yNGf0vmVNR+OLMlvlaKDNaCA28HuUBxJbWLAqhITsRImH6rKcy/EfqEEcK,iv:ModTSwxLMj4Gx0e/bVKY8GVWzBjgNxATKnkWYfvKiIs=,tag:6gFkA/0toCBJ7QKL16654A==,type:str]
+    OAUTH2_JWT_SECRET: ENC[AES256_GCM,data:9626EzmbEmyAsTqfbRhASqLkzS+4xnJxpSEgJDSLzkjfuNfAq7uMfc/HsA==,iv:lMCRwHt4gT31hYZ5Ywt4GU/DJNj7Fya2GOUkyr/l6ro=,tag:aQ8UlVwpaVNDoOHju1oiMQ==,type:str]
+    LFS_JWT_SECRET: ENC[AES256_GCM,data:gZ37cb9uqSF1MkdoUFbVM3VhqBxEIyUv3IxiV4c3gbIVTk7FMHncZekM7Q==,iv:m7JxF7S1OnHy86s5s1tJHQ8kqhRJq5kFRoArLL/ab0o=,tag:GZuE7f9pNq15T+R+PlSZdA==,type:str]
+sops:
+    age:
+        - recipient: age1ktlxm0hukw6jxm62txqy5x2nl8hpdnal8nv00kfhrf3pw33574aqa6j5cj
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkRVpZRTVLWU80RjEvZnRs
+            TU5YVko4V1M5Q0d5SXZGT1h2NStCYk5UZWpRCmNxVXVtR3VCZXJqNHYyaDUyZmdr
+            WXJKZHhJaFJhZll0VVBld0QrSGhtbncKLS0tIGZZREFXRUMvTi8rRHIyaXBUOE45
+            d2JBTG5oT2kvZzdLejMzdEpRbm03QmcKItsS4nKJRu3pRC8xLTf9kYpqFiD9S1tx
+            BFnJf3IsbGpl1RM8RmkN9O5QsZSq1hbw5pFhlx0XKeH5KgoJInbnog==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-09-05T11:29:22Z"
+    mac: ENC[AES256_GCM,data:906TL61C7WcxxTAfH3zpXLTLQn2WSIg2RPm0y/6LeVA6pvI6fMbFA32Usvg+EkpWVRGqcm8JPgHy63WQDhq1Ap3imJXpgVDgTgfo64TxJLmdUtCAdm0/CaGxtGeU2J3gm653wl75hOGoCyfBR3iOt0Vo1kUdUxS9B5h3u5L6P6o=,iv:C+CZe31F/AWk0ZqM6lgV248ys/L3mG6S8Tz44b5o628=,tag:C9LdYCtsiHWiHSZWaYCGWA==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

clusters/base/apps/homeassistant/helmrelease.yaml

@@ -0,0 +1,85 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: homeassistant
+  namespace: homeassistant
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: homeassistant
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      app:
+        strategy: Recreate
+        pod:
+          hostNetwork: true
+          dnsPolicy: ClusterFirstWithHostNet
+        containers:
+          app:
+            image:
+              repository: ghcr.io/home-assistant/home-assistant
+              tag: "2026.7.4"
+            env:
+              TZ: Europe/Moscow
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+              startup:
+                enabled: true
+                spec:
+                  periodSeconds: 10
+                  failureThreshold: 30 # HA is sloooow to start
+            resources:
+              requests:
+                cpu: 100m
+                memory: 256Mi
+              limits:
+                memory: 1Gi
+
+    service:
+      app:
+        controller: app
+        ports:
+          http:
+            port: 8123
+
+    ingress:
+      app:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: p.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: homeassistant-tls
+            hosts:
+              - p.aggtaa.com
+
+    persistence:
+      config:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 10Gi
+        storageClass: longhorn
+        retain: true
+        globalMounts:
+          - path: /config
+      media:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 1Gi
+        storageClass: longhorn
+        retain: true
+        globalMounts:
+          - path: /media

clusters/base/apps/homeassistant/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: homeassistant
+  namespace: homeassistant
+spec:
+  interval: 1h
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/homeassistant/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - helmrelease.yaml

clusters/base/apps/immich/helmrelease-ml.yaml

@@ -0,0 +1,54 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: immich-ml
+  namespace: photo
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: immich
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      ml:
+        containers:
+          app:
+            # CPU-only: hardware-accelerated tags (-openvino, -cuda, etc)
+            # need specific host devices (e.g. /dev/dri) that aren't set up
+            # on these nodes. Switch tags later if that changes.
+            image:
+              # pinned to match immich-server's version (see
+              # helmrelease-server.yaml) - server and ML communicate over
+              # an internal API contract that isn't guaranteed compatible
+              # across versions.
+              repository: ghcr.io/immich-app/immich-machine-learning
+              tag: v3.1.0
+            env:
+              TZ: Europe/Moscow
+            resources:
+              requests:
+                cpu: 500m
+                memory: 512Mi
+              limits:
+                memory: 4Gi
+
+    service:
+      app:
+        controller: ml
+        ports:
+          http:
+            port: 3003
+
+    persistence:
+      # caches downloaded ML models so they survive pod restarts instead of
+      # re-downloading (a few hundred MB) every time.
+      cache:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 10Gi
+        storageClass: longhorn-single-replica
+        retain: true
+        globalMounts:
+          - path: /cache

clusters/base/apps/immich/helmrelease-postgres.yaml

@@ -0,0 +1,70 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: immich-postgres
+  namespace: photo
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: immich
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      postgres:
+        containers:
+          app:
+            # immich requires this specific image - it bundles the
+            # vectorchord/pgvecto.rs extensions immich's DB schema depends
+            # on; a plain postgres image will not work.
+            image:
+              repository: ghcr.io/immich-app/postgres
+              tag: 14-vectorchord0.4.3-pgvectors0.2.0
+            env:
+              TZ: Europe/Moscow
+              POSTGRES_USER: postgres
+              POSTGRES_DB: immich
+              POSTGRES_INITDB_ARGS: "--data-checksums"
+              POSTGRES_PASSWORD:
+                valueFrom:
+                  secretKeyRef:
+                    name: immich-secrets
+                    key: DB_PASSWORD
+            resources:
+              requests:
+                cpu: 100m
+                memory: 256Mi
+              limits:
+                memory: 2Gi
+
+    service:
+      app:
+        controller: postgres
+        ports:
+          postgres:
+            port: 5432
+
+    persistence:
+      data:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 10Gi
+        storageClass: longhorn
+        retain: true
+        globalMounts:
+          # subPath, not the raw mount root: a fresh Longhorn ext4 volume's
+          # root always contains a "lost+found" dir, and postgres's initdb
+          # refuses to initialize into a non-empty directory even when
+          # lost+found is the only thing in it.
+          - path: /var/lib/postgresql/data
+            subPath: data
+      # postgres' parallel query workers need real shared memory, not the
+      # default 64Mi container tmpfs - matches shm_size: 128mb in the
+      # original docker-compose.
+      dshm:
+        type: emptyDir
+        medium: Memory
+        sizeLimit: 128Mi
+        globalMounts:
+          - path: /dev/shm

clusters/base/apps/immich/helmrelease-redis.yaml

@@ -0,0 +1,33 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: immich-redis
+  namespace: photo
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: immich
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      redis:
+        containers:
+          app:
+            image:
+              repository: docker.io/valkey/valkey
+              tag: "9.1.1"
+            resources:
+              requests:
+                cpu: 20m
+                memory: 32Mi
+              limits:
+                memory: 256Mi
+
+    service:
+      app:
+        controller: redis
+        ports:
+          redis:
+            port: 6379

clusters/base/apps/immich/helmrelease-server.yaml

@@ -0,0 +1,235 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: immich-server
+  namespace: photo
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: immich
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      server:
+        strategy: Recreate
+        podDisruptionBudget:
+          maxUnavailable: "0"
+        initContainers:
+          fix-permissions:
+            image:
+              repository: hectorm/nfs-ganesha
+              tag: v10
+              # hectorm does not publish exact versions, v10.0 digest is 93df70b78...
+              digest: sha256:93df70b78aae56957f4a4f5c606c4250d84b729435f76132dca07b7290f5bfce
+            command:
+              - sh
+              - -c
+              - chmod -R a+rwX /disks/library-recent /disks/library-archive
+          # native sidecar (restartPolicy: Always): mounts the two library
+          # disks and exposes their union at /disks/merged-library via
+          # FUSE. It must be up and actually mounted *before* the "app"
+          # container is created, since HostToContainer propagation only
+          # relays mounts made *after* the receiving container's own mount
+          # exists - it won't retroactively pick up a FUSE mount that's
+          # already there. Running it as a restartPolicy:Always init
+          # container (started, gated on the startupProbe below, before
+          # regular containers) guarantees that ordering; a regular sidecar
+          # container racing "app" on every pod start does not.
+          mergerfs:
+            dependsOn:
+              - fix-permissions
+            restartPolicy: Always
+            image:
+              repository: ghcr.io/hotio/mergerfs
+              tag: release-v2.42.0
+            args:
+              - "-o"
+              # library-recent listed first: category.create=ff means new
+              # files created through the merged mount (i.e. new immich
+              # uploads going forward) land on library-recent by default,
+              # which is exactly what's wanted for freshly-uploaded photos.
+              - "allow_other,use_ino,func.create=ff,category.action=all,category.create=ff,category.search=newest"
+              - "/disks/library-recent:/disks/library-archive"
+              - "/disks/merged-library"
+            securityContext:
+              privileged: true
+            probes:
+              startup:
+                enabled: true
+                custom: true
+                spec:
+                  exec:
+                    command:
+                      - sh
+                      - -c
+                      - grep -q fuse.mergerfs /proc/mounts
+                  periodSeconds: 1
+                  timeoutSeconds: 2
+                  failureThreshold: 30
+            resources:
+              requests:
+                cpu: 50m
+                memory: 64Mi
+              limits:
+                memory: 512Mi
+        containers:
+          app:
+            image:
+              repository: ghcr.io/immich-app/immich-server
+              # make sure immich-machine-learning version match this 
+              tag: v3.1.0
+            env:
+              TZ: Europe/Moscow
+              DB_HOSTNAME: immich-postgres
+              DB_PORT: "5432"
+              DB_USERNAME: postgres
+              DB_DATABASE_NAME: immich
+              DB_PASSWORD:
+                valueFrom:
+                  secretKeyRef:
+                    name: immich-secrets
+                    key: DB_PASSWORD
+              REDIS_HOSTNAME: immich-redis
+              REDIS_PORT: "6379"
+              IMMICH_MACHINE_LEARNING_URL: http://immich-ml:3003
+            probes:
+              # first boot runs DB migrations + vector index setup, which
+              # can take a while - without a startup probe the default
+              # liveness probe (periodSeconds=10, failureThreshold=3) kills
+              # the container ~30s in, well before it's finished binding
+              # the port, causing an endless restart loop.
+              startup:
+                enabled: true
+                spec:
+                  periodSeconds: 5
+                  failureThreshold: 60
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+            resources:
+              requests:
+                cpu: 200m
+                memory: 512Mi
+              limits:
+                memory: 4Gi
+
+    service:
+      app:
+        controller: server
+        ports:
+          http:
+            port: 2283
+
+    ingress:
+      app:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: photo.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: immich-tls
+            hosts:
+              - photo.aggtaa.com
+
+    persistence:
+      # Immich's "library" folder, mergerfs-merged from two disks: recent
+      # files (per the rsync migration's cutoff) and everything else.
+      # New uploads going forward land on library-recent (see mergerfs
+      # category.create above). Not reusing the old single 800Gi library
+      # PVC/PV - this replaces it (that PVC becomes orphaned, retained,
+      # and unused; clean it up separately if no longer wanted).
+      library-recent:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 200Gi
+        storageClass: longhorn-single-replica
+        retain: true
+        advancedMounts:
+          server:
+            mergerfs:
+              - path: /disks/library-recent
+            fix-permissions:
+              - path: /disks/library-recent
+      library-archive:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 500Gi
+        storageClass: longhorn-single-replica
+        retain: true
+        advancedMounts:
+          server:
+            mergerfs:
+              - path: /disks/library-archive
+            fix-permissions:
+              - path: /disks/library-archive
+      merged-library:
+        type: emptyDir
+        advancedMounts:
+          server:
+            mergerfs:
+              - path: /disks/merged-library
+                mountPropagation: Bidirectional
+            app:
+              - path: /data/library
+                mountPropagation: HostToContainer
+      dev-fuse:
+        type: hostPath
+        hostPath: /dev/fuse
+        advancedMounts:
+          server:
+            mergerfs:
+              - path: /dev/fuse
+      # split out of the old combined "other" volume below: each of these
+      # purposes now gets its own Longhorn volume instead of sharing one
+      # 200Gi disk, so a single hot subtree (e.g. thumbs) doesn't force
+      # replica rebuilds/relocation to drag the whole 200Gi with it.
+      data:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 20Gi
+        storageClass: longhorn
+        retain: true
+        advancedMounts:
+          server:
+            app:
+              - path: /data
+      encoded-video:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 100Gi
+        storageClass: longhorn
+        retain: true
+        advancedMounts:
+          server:
+            app:
+              - path: /data/encoded-video
+      thumbs:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 100Gi
+        storageClass: longhorn
+        retain: true
+        advancedMounts:
+          server:
+            app:
+              - path: /data/thumbs
+      backups:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 30Gi
+        storageClass: longhorn
+        retain: true
+        advancedMounts:
+          server:
+            app:
+              - path: /data/backups

clusters/base/apps/immich/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: immich
+  namespace: photo
+spec:
+  interval: 1h
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/immich/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - secret.enc.yaml
+  - helmrelease-postgres.yaml
+  - helmrelease-redis.yaml
+  - helmrelease-ml.yaml
+  - helmrelease-server.yaml

clusters/base/apps/immich/secret.enc.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: immich-secrets
+    namespace: photo
+stringData:
+    DB_PASSWORD: ENC[AES256_GCM,data:+bJ/+NEQCT3ZEqjnkzep4OsbLkJ9gyLZmGxCpoww2Wo=,iv:n1sLYgLl3zNZBdjMBhIrbSv/qHJFQ/nvZfBknFAUdug=,tag:DFnoc5K6XvHngVIrgJlM6Q==,type:str]
+sops:
+    age:
+        - recipient: age1wmm8qrqnjzvd5nkraed6ylrsxlpn3ru7d7zettdudj7y9sg9dd2su0u3mr
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtd1hFZy82d0c0RXZMd28r
+            dWs1VWNlVG9tTE5WZDVLdGpFSXhuVXQ5anprCk5LWWMrWUVCd1N4Y1JENnRyWExC
+            d2VRNDJON2RzSHRyMGhRdmMva1NNY3cKLS0tIDNML2Q0YXFRMEs3V3prUkZYSS85
+            MWRGa3duNHgvbjNvVnZLOXpYMW1mbGcKaN7h3W0YKsRjnyk6P9+bziDy6If5xLQ8
+            kxFJf4CX9XU5jgYXqw2UNqRDusphclqfULUMRaEzMJkkPhd1cZ9PvQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-21T12:23:20Z"
+    mac: ENC[AES256_GCM,data:vGSUhl73AIQr1Ld1SHc+i4GpvOc0b0j8Vx9DmoRDjNs17TQSfmfulEZwIua12P5DHIz36P9yqggHfSyyrrEoMjfaUSTIDxCIGGvsfTl4vBt9Vis0e2gALaHtAgWZwxr5QMe+OP1tkXOZoX9E8VcoBq1ULvbIjqsPs2uxPVKsEWk=,iv:1exDUqurlFdBt1eZYWWMlkar75HbTLZ6RZelC0RsYcU=,tag:A0IhJHjVum2HBT5RwHo5qg==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

clusters/base/apps/infcloud/helmrelease-infcloud.yaml

@@ -0,0 +1,65 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: infcloud
+  namespace: pim
+spec:
+  interval: 10m
+  chartRef:
+    kind: OCIRepository
+    name: infcloud
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      infcloud:
+        containers:
+          app:
+            image:
+              repository: waja/infcloud
+              tag: "0.13.1-16"
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+
+    service:
+      app:
+        controller: infcloud
+        ports:
+          http:
+            port: 80
+
+    ingress:
+      app:
+        className: traefik
+        # this ingress owns the cert-manager request for c.aggtaa.com
+        # (secret kept as "radicale-tls" post-migration so the existing,
+        # already-valid cert is reused instead of re-issued). davical's
+        # ingress just references the same secret without its own
+        # annotation - a second annotated Ingress would create a
+        # competing Certificate for the same host/secret.
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: c.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: radicale-tls
+            hosts:
+              - c.aggtaa.com
+
+    persistence:
+      config:
+        type: configMap
+        name: infcloud-config
+        globalMounts:
+          - path: /srv/infcloud/config/config.js
+            subPath: config.js
+            readOnly: true

clusters/base/apps/infcloud/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: infcloud
+  namespace: pim
+spec:
+  interval: 10m
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/infcloud/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - configmap.yaml
+  - helmrelease-infcloud.yaml

clusters/base/apps/it-tools/helmrelease.yaml

@@ -0,0 +1,57 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: it-tools
+  namespace: tools
+spec:
+  interval: 10m
+  chartRef:
+    kind: OCIRepository
+    name: it-tools
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      it-tools:
+        containers:
+          app:
+            image:
+              repository: ghcr.io/willjayyyy/next-tools
+              tag: 1.10.3
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+            resources:
+              requests:
+                cpu: 10m
+                memory: 32Mi
+              limits:
+                memory: 128Mi
+
+    service:
+      app:
+        controller: it-tools
+        ports:
+          http:
+            port: 80
+
+    ingress:
+      app:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+          traefik.ingress.kubernetes.io/router.middlewares: auth-tinyauth@kubernetescrd
+        hosts:
+          - host: tools.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: it-tools-tls
+            hosts:
+              - tools.aggtaa.com

clusters/base/apps/it-tools/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: it-tools
+  namespace: tools
+spec:
+  interval: 1h
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/it-tools/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - helmrelease.yaml

clusters/base/apps/joplin/helmrelease-joplin.yaml

@@ -0,0 +1,80 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: joplin
+  namespace: pim
+spec:
+  interval: 10m
+  dependsOn:
+    - name: joplin-postgres
+  chartRef:
+    kind: OCIRepository
+    name: joplin
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      app:
+        containers:
+          app:
+            image:
+              repository: joplin/server
+              # verified via Docker Hub API (hub.docker.com/v2/repositories/
+              # joplin/server/tags): "3.7.1" and "latest" were pushed at the
+              # same timestamp, i.e. this is what "latest" (the original
+              # compose.yaml's tag) currently resolves to.
+              tag: "3.7.1"
+            env:
+              APP_PORT: "22300"
+              APP_BASE_URL: https://notes.aggtaa.com
+              DB_CLIENT: pg
+              POSTGRES_DATABASE: joplin
+              POSTGRES_USER: joplin
+              POSTGRES_HOST: joplin-postgres
+              POSTGRES_PORT: "5432"
+              POSTGRES_PASSWORD:
+                valueFrom:
+                  secretKeyRef:
+                    name: joplin-secrets
+                    key: POSTGRES_PASSWORD
+            probes:
+              startup:
+                enabled: true
+                spec:
+                  periodSeconds: 5
+                  failureThreshold: 60
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+            resources:
+              requests:
+                cpu: 50m
+                memory: 128Mi
+              limits:
+                memory: 1Gi
+
+    service:
+      app:
+        controller: app
+        ports:
+          http:
+            port: 22300
+
+    ingress:
+      app:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: notes.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: joplin-tls
+            hosts:
+              - notes.aggtaa.com

clusters/base/apps/joplin/helmrelease-postgres.yaml

@@ -0,0 +1,50 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: joplin-postgres
+  namespace: pim
+spec:
+  interval: 10m
+  chartRef:
+    kind: OCIRepository
+    name: joplin
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      postgres:
+        containers:
+          app:
+            image:
+              repository: postgres
+              # not alpine: joplin server needs a glibc-collation postgres,
+              # matching the official (Debian-based) image used everywhere
+              # else this pattern is followed in this repo.
+              tag: "16.15"
+            env:
+              TZ: Europe/Moscow
+              POSTGRES_USER: joplin
+              POSTGRES_DB: joplin
+              POSTGRES_PASSWORD:
+                valueFrom:
+                  secretKeyRef:
+                    name: joplin-secrets
+                    key: POSTGRES_PASSWORD
+
+    service:
+      app:
+        controller: postgres
+        ports:
+          postgres:
+            port: 5432
+
+    persistence:
+      data:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 20Gi
+        storageClass: longhorn
+        retain: true
+        globalMounts:
+          - path: /var/lib/postgresql/data
+            subPath: data

clusters/base/apps/joplin/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: joplin
+  namespace: pim
+spec:
+  interval: 10m
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/joplin/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - secret.enc.yaml
+  - helmrelease-postgres.yaml
+  - helmrelease-joplin.yaml

clusters/base/apps/joplin/secret.enc.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: joplin-secrets
+    namespace: pim
+stringData:
+    POSTGRES_PASSWORD: ENC[AES256_GCM,data:cI3zfdaJUbo2344RuLIG4DjPsgx4Afl6GKMJVHrOHOg=,iv:8QliTSQ44ScVUchDxh0DF/wU9bTLK9Jq4ojxSMXsNC8=,tag:VB2mf4uhLnRnafWg0mRRpg==,type:str]
+sops:
+    age:
+        - recipient: age1dertyl956fjsmh00cw468gdnl7lf3frasg4n4c82z0chm6qm2cks6w8gha
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFQ2JKZWxseVAxUWU5NlhL
+            S0xWQUh1NFpBU2ZpQkJXbkg4TlZ2cTR5TXhjCjlMTGdGMEF4UzBEbS9wdndJb1VE
+            OXBOanpJS1lpTFVhWm52K2xhaGx2M00KLS0tIGF5b3FZOWRNVWNpenRmUDVOT3Vp
+            aHpCbXkvdXM3SjYxWTlsT0cxU2RDOFkKximxt9bmd6FZAtU/SBirzDH3NMitQKrZ
+            PfwicphmFEXVN+HtD9vwRbP4TMa1swOMbOVINGKuA8YZwEk1GyPe4w==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-08-27T10:16:36Z"
+    mac: ENC[AES256_GCM,data:85dGV8WPFqd+4l6k7PLqDROm5+kwiAjO80ElNKfSJFOgeI9y7DyhyhDklcBJXMJljatbEfAmCFFqnoyRGmeIjc6FBfteUGQtpLgI6e8RTlRHPvaRzqDwA1OhnlQbAW9TTf5vha6tyYso/PprCWjJSMjBEfiu7ApiRMdZcLd1V4c=,iv:Dh9z/r7UbhdREwXT787HkmVM04X/BAtQmQteN3j7AKU=,tag:oUMYT5CL85PAYfItf5TIdw==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

clusters/base/apps/markdown-vault-mcp/helmrelease.yaml

@@ -0,0 +1,107 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: markdown-vault-mcp
+  namespace: mcp
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: markdown-vault-mcp
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      app:
+        containers:
+          app:
+            image:
+              repository: ghcr.io/pvliesdonk/markdown-vault-mcp
+              tag: "v3.1.0"
+            env:
+              MARKDOWN_VAULT_MCP_SOURCE_DIR: /vault
+              MARKDOWN_VAULT_MCP_INDEX_PATH: /data/state/index.db
+              MARKDOWN_VAULT_MCP_EMBEDDINGS_PATH: /data/state/embeddings
+              MARKDOWN_VAULT_MCP_ATTACHMENT_EXTENSIONS: "*"
+              MARKDOWN_VAULT_MCP_STATE_PATH: /data/state/state.json
+              MARKDOWN_VAULT_MCP_READ_ONLY: "false"
+              MARKDOWN_VAULT_MCP_BASE_URL: "https://md-vault.mcp.aggtaa.com"
+              MARKDOWN_VAULT_MCP_OIDC_CONFIG_URL: "https://auth.aggtaa.com/.well-known/openid-configuration"
+              MARKDOWN_VAULT_MCP_OIDC_CLIENT_ID: "markdown-vault-mcp"
+              MARKDOWN_VAULT_MCP_OIDC_CLIENT_SECRET:
+                valueFrom:
+                  secretKeyRef:
+                    name: markdown-vault-mcp-secrets
+                    key: OIDC_CLIENT_SECRET
+              MARKDOWN_VAULT_MCP_OIDC_JWT_SIGNING_KEY:
+                valueFrom:
+                  secretKeyRef:
+                    name: markdown-vault-mcp-secrets
+                    key: OIDC_JWT_SIGNING_KEY
+              MARKDOWN_VAULT_MCP_BEARER_TOKEN:
+                valueFrom:
+                  secretKeyRef:
+                    name: markdown-vault-mcp-secrets
+                    key: BEARER_TOKEN
+            probes:
+              # first boot downloads embedding models from HuggingFace Hub
+              # and builds the vector index/embeddings before binding the
+              # port - the default liveness probe budget (periodSeconds=10,
+              # failureThreshold=3 = 30s) isn't enough, so it gets killed
+              # mid-startup on every restart, in an endless loop.
+              startup:
+                enabled: true
+                spec:
+                  periodSeconds: 5
+                  failureThreshold: 36
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+            resources:
+              requests:
+                cpu: 100m
+                memory: 256Mi
+              limits:
+                memory: 1Gi
+
+    service:
+      app:
+        controller: app
+        ports:
+          http:
+            port: 8000
+
+    ingress:
+      app:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: md-vault.mcp.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: markdown-vault-mcp-tls
+            hosts:
+              - md-vault.mcp.aggtaa.com
+
+    persistence:
+      vault:
+        type: persistentVolumeClaim
+        existingClaim: markdown-vault-mcp-vault
+        globalMounts:
+          - path: /vault
+      state:
+        type: persistentVolumeClaim
+        suffix: state
+        accessMode: ReadWriteOnce
+        size: 2Gi
+        storageClass: longhorn
+        retain: true
+        globalMounts:
+          - path: /data/state

clusters/base/apps/markdown-vault-mcp/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: markdown-vault-mcp
+  namespace: mcp
+spec:
+  interval: 1h
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/markdown-vault-mcp/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - helmrelease.yaml
+  - secret.enc.yaml
+  - pv-pvc-vault.yaml

clusters/base/apps/markdown-vault-mcp/pv-pvc-vault.yaml

@@ -0,0 +1,35 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: markdown-vault-mcp-vault-nfs
+spec:
+  capacity:
+    storage: 30Gi
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  mountOptions:
+    - nfsvers=4.1
+  nfs:
+    server: 10.0.64.5
+    path: /export
+  claimRef:
+    namespace: mcp
+    name: markdown-vault-mcp-vault
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: markdown-vault-mcp-vault
+  namespace: mcp
+  annotations:
+    helm.sh/resource-policy: keep
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: markdown-vault-mcp-vault-nfs
+  resources:
+    requests:
+      storage: 30Gi

clusters/base/apps/markdown-vault-mcp/secret.enc.yaml

@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: markdown-vault-mcp-secrets
+    namespace: mcp
+stringData:
+    BEARER_TOKEN: ENC[AES256_GCM,data:vRsc/kmZ1qySDUrI1dMeLqSSn+jEgvPivw3dRYTLr7NRm6T7SYnmhhBb81CG6xQAl0Wz8RfOCescQpUJlbPl4w==,iv:Zha9o8uIdR6DPMk+KRL6ZnKdh3zPXuyjCCK9yKnuYFI=,tag:l+8oHY/hgZcKVQx9yiaEmg==,type:str]
+    OIDC_CLIENT_SECRET: ENC[AES256_GCM,data:2unvRtI/V0aTULgSacGvEoYYQN0uWBR3b2TKjl7hjvQTXesuglTtSNz9YsjDqc8ZHGNBndiz2Q6VZagS3ERprw==,iv:fjMhiKamjbIrNYAK9TU2PPn0smJR+Kr3qhRhEUbjm04=,tag:wuUZbccOBoFcdiTPqb8QCQ==,type:str]
+    OIDC_JWT_SIGNING_KEY: ENC[AES256_GCM,data:63S/0TsEis959MJRLd5atPXQrv5pNMC5iyMHJvT67luLLPkd2bdgfmX4Pu7R3Hr5YIGoujn1/xCuOdZH0RtIog==,iv:3Gi2ZukSzU9SIy7fPzmlvWbA4ykaNgta95DuviHf5zk=,tag:BPUXUPMIxW9kbyyQqoz0gQ==,type:str]
+sops:
+    age:
+        - recipient: age1kct5g7d7eus2hvdnmx99ewsrtz70lhlasxa25euqwdctqhwqqpxqz0n7gg
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBPOVJCaXpjeUEzWkN4SEdz
+            RnFkZmtXa0IwaE9xdGtBdVRwV1B5MkdDbVMwCmVYeUJpQmQwZ29BbnRPK1AzWGJx
+            NHV0NnRxenRWV2M4MytrZ3llNmxaMzQKLS0tIHVOcDVyTDkrNHJRMkhRVzFPSGpW
+            V1RRNTdiUTBjSWZlMlEvRXF3OUowZ00KXf/+ucgZuDAczE1WlEW7D2/cR+sB66BQ
+            7JC42VJiyEf2djlODmvK26bDTeiJ/Uk9HsSuvamGUM8b8vAj2w/r/A==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-07-27T06:42:40Z"
+    mac: ENC[AES256_GCM,data:XRxbyHL4iJMoRMb4X6C2y1ChTNSkqou01bwtIb6zNfwcGCt7uMGbm1HxvmjbdeJI/zQIIVfgxbbTxhZw+sL2FF+PYAjPcaGvaJ86O97lr9fUB30NC0tMluW82pt2iiisK+6dEEPH9i/kGFrJHN6RlaYVkEfv6U8xjlpIcaNx0+A=,iv:YnqMRlHl1WVYNqqN9hRH88hgIALrfgv6WrJGyeNDstI=,tag:M1DYFr3G9ub/R2kNF8ZnNQ==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

clusters/base/apps/mosquitto/chart/Chart.yaml

@@ -0,0 +1,6 @@
+apiVersion: v2
+name: mosquitto
+description: Single-node Eclipse Mosquitto MQTT broker for homelab IoT
+type: application
+version: 0.1.0
+appVersion: "2"

clusters/base/apps/mosquitto/chart/templates/_helpers.tpl

@@ -0,0 +1,14 @@
+{{- define "mosquitto.fullname" -}}
+{{- .Release.Name | trunc 63 | trimSuffix "-" -}}
+{{- end -}}
+
+{{- define "mosquitto.labels" -}}
+app.kubernetes.io/name: mosquitto
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end -}}
+
+{{- define "mosquitto.selectorLabels" -}}
+app.kubernetes.io/name: mosquitto
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end -}}

clusters/base/apps/mosquitto/chart/templates/configmap.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "mosquitto.fullname" . }}-config
+  labels:
+    {{- include "mosquitto.labels" . | nindent 4 }}
+data:
+  mosquitto.conf: |
+    persistence true
+    persistence_location /mosquitto/data/
+    log_dest stdout
+
+    listener {{ .Values.service.mqttPort }}
+    allow_anonymous false
+    password_file /mosquitto/secrets/{{ .Values.auth.secretKey }}
+
+    {{- if .Values.websockets.enabled }}
+    listener {{ .Values.websockets.port }}
+    protocol websockets
+    allow_anonymous false
+    password_file /mosquitto/secrets/{{ .Values.auth.secretKey }}
+    {{- end }}

clusters/base/apps/mosquitto/chart/templates/service.yaml

@@ -0,0 +1,25 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "mosquitto.fullname" . }}
+  labels:
+    {{- include "mosquitto.labels" . | nindent 4 }}
+    {{- if .Values.service.loadBalancerPool }}
+    loadBalancerPool: {{ .Values.service.loadBalancerPool }}
+    {{- end }}
+spec:
+  type: {{ .Values.service.type }}
+  {{- if .Values.service.loadBalancerIP }}
+  loadBalancerIP: {{ .Values.service.loadBalancerIP }}
+  {{- end }}
+  selector:
+    {{- include "mosquitto.selectorLabels" . | nindent 4 }}
+  ports:
+    - name: mqtt
+      port: {{ .Values.service.mqttPort }}
+      targetPort: mqtt
+    {{- if .Values.websockets.enabled }}
+    - name: ws
+      port: {{ .Values.websockets.port }}
+      targetPort: ws
+    {{- end }}

clusters/base/apps/mosquitto/chart/templates/statefulset.yaml

@@ -0,0 +1,70 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: {{ include "mosquitto.fullname" . }}
+  labels:
+    {{- include "mosquitto.labels" . | nindent 4 }}
+spec:
+  serviceName: {{ include "mosquitto.fullname" . }}
+  replicas: 1
+  selector:
+    matchLabels:
+      {{- include "mosquitto.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      labels:
+        {{- include "mosquitto.selectorLabels" . | nindent 8 }}
+    spec:
+      securityContext:
+        runAsUser: {{ .Values.securityContext.runAsUser }}
+        runAsGroup: {{ .Values.securityContext.runAsGroup }}
+        fsGroup: {{ .Values.securityContext.runAsGroup }}
+      containers:
+        - name: mosquitto
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - name: mqtt
+              containerPort: {{ .Values.service.mqttPort }}
+            {{- if .Values.websockets.enabled }}
+            - name: ws
+              containerPort: {{ .Values.websockets.port }}
+            {{- end }}
+          env:
+            - name: MOSQUITTO_UNSAFE_ALLOW_SYMLINKS
+              value: "1"
+          volumeMounts:
+            - name: config
+              mountPath: /mosquitto/config
+            - name: secrets
+              mountPath: /mosquitto/secrets
+              readOnly: true
+            {{- if .Values.persistence.enabled }}
+            - name: data
+              mountPath: /mosquitto/data
+            {{- end }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+      volumes:
+        - name: config
+          configMap:
+            name: {{ include "mosquitto.fullname" . }}-config
+        - name: secrets
+          secret:
+            secretName: {{ .Values.auth.existingSecret }}
+            defaultMode: 0400
+        {{- if not .Values.persistence.enabled }}
+        - name: data
+          emptyDir: {}
+        {{- end }}
+  {{- if .Values.persistence.enabled }}
+  volumeClaimTemplates:
+    - metadata:
+        name: data
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        storageClassName: {{ .Values.persistence.storageClassName }}
+        resources:
+          requests:
+            storage: {{ .Values.persistence.size }}
+  {{- end }}

clusters/base/apps/mosquitto/chart/values.yaml

@@ -0,0 +1,38 @@
+image:
+  repository: eclipse-mosquitto
+  tag: "2.1.2-alpine"
+  pullPolicy: IfNotPresent
+
+# not really needed, as StatefulSet has hardcoded "replicas: 1"
+replicaCount: 1
+
+securityContext:
+  runAsUser: 1883
+  runAsGroup: 1883
+
+persistence:
+  enabled: true
+  size: 1Gi
+
+service:
+  type: LoadBalancer
+  mqttPort: 1883
+  loadBalancerPool: "mqtt"
+  # or loadBalancerIP: X.X.X.X
+
+auth:
+  # Mount a Secret with a pre-generated mosquitto passwd file instead of
+  # putting credentials in values.yaml / git. See README for how to create it.
+  existingSecret: mosquitto-passwd
+  secretKey: passwd
+
+websockets:
+  enabled: false
+  port: 9001
+
+resources:
+  requests:
+    cpu: 50m
+    memory: 32Mi
+  limits:
+    memory: 128Mi

clusters/base/apps/mosquitto/helmrelease.yaml

@@ -0,0 +1,52 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: mosquitto
+  namespace: mqtt
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: ./clusters/base/apps/mosquitto/chart
+      sourceRef:
+        kind: GitRepository
+        name: flux-system
+        namespace: flux-system
+      reconcileStrategy: Revision
+  driftDetection:
+    mode: enabled
+  values:
+    image:
+      repository: eclipse-mosquitto
+      tag: "2.1.2-alpine"
+      pullPolicy: IfNotPresent
+
+    replicaCount: 1
+
+    securityContext:
+      runAsUser: 1883
+      runAsGroup: 1883
+
+    persistence:
+      enabled: true
+      size: 1Gi
+
+    service:
+      type: LoadBalancer
+      mqttPort: 1883
+      loadBalancerPool: "mqtt"
+
+    auth:
+      existingSecret: mosquitto-passwd
+      secretKey: passwd
+
+    websockets:
+      enabled: false
+      port: 9001
+
+    resources:
+      requests:
+        cpu: 50m
+        memory: 32Mi
+      limits:
+        memory: 128Mi

clusters/base/apps/mosquitto/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - secret.enc.yaml
+  - helmrelease.yaml

clusters/base/apps/mosquitto/secret.enc.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: mosquitto-passwd
+    namespace: mqtt
+stringData:
+    passwd: ENC[AES256_GCM,data:YpTczjZ73h4Td+TmEZIgil9DN7WfVwBsi75F/t3D1oWGjGsifklnRsZUJqXiXyUwIxTxlFiWgfb01LjmILE0nB9rxoEbFdrASaLgtnCoYz/fvSZLqwCK+FSSub3+r0nJTNvxzD+bC/av8JEPNDW/8CSrHMrTrVCcLhAchOAvviRLgO18862XWcvPh1plO8luaZG38cuh+VbKKwidkwozc6B7Ghys5NfZuB1rP4vLZ6/f1PzcFRugtJ0fzzl/BA==,iv:9FKm4V/lYXott/6aVBKg4g8GtzVqgT/xndj0CKqMm+Y=,tag:41gCVbrK6Rp2IvVUt98Hpw==,type:str]
+sops:
+    age:
+        - recipient: age1u236u5mzkzj72y4mfxx68gfqw0u0j6tdgkudnm5pdfpe7apq4u6s89jr2h
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBobk1BQW0yemEzV1FQM2ZJ
+            YkZJbjJPZlRiSDlyamx1WVdyNTJBNXo1YlQwCnhBT01SeE0rZDVOcFRkZm9KQ0t2
+            dUIyOHpzenVZc3lsa2hmMjF3LzRGMFUKLS0tIENmM05Ud2xGblNpdjZjWWFPeWg3
+            UEtuZWZ5enkwSGk0MXR1czBibzQ1M2sKfp+76C0X2DgsffWZVtBevI4lCs8RM09p
+            tzsrneX4iIX6WCn1kRLsWTZpN6Vg8Wsl6kUWnSA3WfHWI9W4CJdrag==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-07-21T19:09:49Z"
+    mac: ENC[AES256_GCM,data:qecTVUaC/3j/oP1DVnXEKV9Ub+k5gvGHfteol4W5I3gq8IB2YYZ+vfuinPVJJeSsN5HvK62ftnIgRNu0dtzDOrnuZENczEMwPrOz90RCUbX7WBeKh23KZ8gSSw2MBn6gsDsz1gXFWENIyjQTJFZ4qAJY6jfeH2IFC9RkpoU3j14=,iv:ksLG/aHHBAkl6aA52Xufs2vijZlpsaXccoxheYV3Gm4=,tag:4YiaPGMBWSWhVBO1tNF6vQ==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.13.2

clusters/base/apps/nfs-ganesha/configmap.yaml

@@ -0,0 +1,51 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nfs-ganesha-config
+  namespace: nfs
+data:
+  ganesha.conf: |
+    NFS_Core_Param {
+    	NFS_Port = 2049;
+    	Protocols = NFSv4;
+    	Fsid_Device = true;
+    }
+
+    NFSV4 {
+    	RecoveryBackend = fs_ng;
+    	RecoveryRoot = /recovery;
+    	Lease_Lifetime = 40;
+    	Grace_Period = 50;
+    }
+
+    VFS {
+    	Link_Support = true;
+    	Symlink_Support = true;
+    	CanSetTime = true;
+    	umask = 0000;
+    }
+
+    EXPORT {
+    	Export_Id = 1;
+
+    	Path = /export;
+    	Pseudo = /export;
+
+    	SecType = sys;
+    	Protocols = NFSv4;
+
+    	FSAL {
+    		Name = VFS;
+    	}
+
+    	CLIENT {
+    		Clients = *;
+    		Access_Type = RW;
+    		Squash = No_Root_Squash;
+    		Protocols = NFSv4;
+    	}
+    }
+
+    LOG {
+    	Default_Log_Level = INFO;
+    }

clusters/base/apps/nfs-ganesha/helmrelease.yaml

@@ -0,0 +1,130 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: nfs-ganesha
+  namespace: nfs
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: nfs-ganesha
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      app:
+        strategy: Recreate
+        podDisruptionBudget:
+          maxUnavailable: "0"
+        initContainers:
+          mtab-setup:
+            image:
+              repository: hectorm/nfs-ganesha
+              tag: v10
+              # hectorm does not publish exact versions, v10.0 digest is 93df70b78...
+              digest: sha256:93df70b78aae56957f4a4f5c606c4250d84b729435f76132dca07b7290f5bfce
+            command:
+              - sh
+              - -c
+              - cat /proc/self/mounts > /mtab-vol/mtab
+          fix-permissions:
+            image:
+              repository: hectorm/nfs-ganesha
+              tag: v10
+              # hectorm does not publish exact versions, v10.0 digest is 93df70b78...
+              digest: sha256:93df70b78aae56957f4a4f5c606c4250d84b729435f76132dca07b7290f5bfce
+            command:
+              - sh
+              - -c
+              - chmod -R a+rwX /export
+        containers:
+          app:
+            image:
+              repository: hectorm/nfs-ganesha
+              tag: v10
+              # hectorm does not publish exact versions, v10.0 digest is 93df70b78...
+              digest: sha256:93df70b78aae56957f4a4f5c606c4250d84b729435f76132dca07b7290f5bfce
+            securityContext:
+              readOnlyRootFilesystem: true
+              capabilities:
+                drop:
+                  - ALL
+                add:
+                  - CHOWN
+                  - DAC_OVERRIDE
+                  - DAC_READ_SEARCH
+                  - FOWNER
+                  - FSETID
+                  - SETGID
+                  - SETUID
+                  - SYS_RESOURCE
+            probes:
+              liveness:
+                enabled: true
+                spec:
+                  initialDelaySeconds: 2
+                  periodSeconds: 10
+                  timeoutSeconds: 2
+                  failureThreshold: 3
+              readiness:
+                enabled: true
+                spec:
+                  initialDelaySeconds: 1
+                  periodSeconds: 2
+                  timeoutSeconds: 1
+                  failureThreshold: 2
+            resources:
+              requests:
+                cpu: 50m
+                memory: 128Mi
+              limits:
+                memory: 512Mi
+
+    service:
+      app:
+        controller: app
+        type: LoadBalancer
+        labels:
+          loadBalancerPool: nfs
+        ports:
+          nfs:
+            port: 2049
+            protocol: TCP
+
+    persistence:
+      config:
+        type: configMap
+        name: nfs-ganesha-config
+        globalMounts:
+          - path: /etc/ganesha/ganesha.conf
+            subPath: ganesha.conf
+            readOnly: true
+      export:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 30Gi
+        storageClass: longhorn
+        retain: true
+        globalMounts:
+          - path: /export
+      run:
+        type: emptyDir
+        globalMounts:
+          - path: /run
+      tmp:
+        type: emptyDir
+        globalMounts:
+          - path: /tmp
+      recovery:
+        type: emptyDir
+        globalMounts:
+          - path: /recovery
+      etc-mtab:
+        type: emptyDir
+        advancedMounts:
+          app:
+            app:
+              - path: /etc/mtab
+                subPath: mtab
+            mtab-setup:
+              - path: /mtab-vol

clusters/base/apps/nfs-ganesha/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: nfs-ganesha
+  namespace: nfs
+spec:
+  interval: 1h
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/nfs-ganesha/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - configmap.yaml
+  - helmrelease.yaml

clusters/base/apps/ntfy/helmrelease.yaml

@@ -0,0 +1,90 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: ntfy
+  namespace: notify
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: ntfy
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      ntfy:
+        containers:
+          app:
+            image:
+              repository: binwiederhall/ntfy
+              tag: v2.34.0
+            args:
+              - serve
+            env:
+              NTFY_BASE_URL: https://notify.aggtaa.com
+              NTFY_LISTEN_HTTP: ":80"
+              NTFY_BEHIND_PROXY: "true"
+              NTFY_CACHE_FILE: /var/lib/ntfy/cache.db
+              NTFY_AUTH_FILE: /var/lib/ntfy/user.db
+              NTFY_AUTH_DEFAULT_ACCESS: deny-all
+              NTFY_ATTACHMENT_CACHE_DIR: /var/lib/ntfy/attachments
+              NTFY_ENABLE_LOGIN: "true"
+            envFrom:
+              - secretRef:
+                  name: ntfy-secrets
+            probes:
+              liveness:
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /v1/health
+                    port: 80
+              readiness:
+                enabled: true
+                custom: true
+                spec:
+                  httpGet:
+                    path: /v1/health
+                    port: 80
+            resources:
+              requests:
+                cpu: 10m
+                memory: 32Mi
+              limits:
+                memory: 256Mi
+
+    service:
+      app:
+        controller: ntfy
+        ports:
+          http:
+            port: 80
+
+    ingress:
+      app:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: notify.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: ntfy-tls
+            hosts:
+              - notify.aggtaa.com
+
+    persistence:
+      data:
+        type: persistentVolumeClaim
+        storageClass: longhorn
+        accessMode: ReadWriteOnce
+        size: 2Gi
+        retain: true
+        globalMounts:
+          - path: /var/lib/ntfy

clusters/base/apps/ntfy/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: ntfy
+  namespace: notify
+spec:
+  interval: 1h
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/ntfy/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - helmrelease.yaml
+  - secret.enc.yaml

clusters/base/apps/ntfy/secret.enc.yaml

@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: ntfy-secrets
+    namespace: notify
+stringData:
+    #ENC[AES256_GCM,data:XneiueSaauWV0MEAzJcs730dwgrSt970o99Jq9iYbAF/RGAXPq0aMhSdNtK4PIgY5nSuVDsaGjXMEu+hF7kX4zWdIQg8MQ2n82fpcNc15RCMsyMNn9WVI1WKr5y7gonz5w==,iv:SPiP6hSzqdBk9WUVKT6TYp3qdZ3gje70CclLXaQNPkw=,tag:H8RtqMaF3bmMNUvfZMJtXQ==,type:comment]
+    NTFY_AUTH_USERS: ENC[AES256_GCM,data:Uk7Ho93dF6occuGT2+YgRpsUZubXrq7Bvo1CI03FRABR5iZWKhqa0TEfaC90zYRaef/0gqE40iepx293Vt35C4d3gGDCZRzs6Rz+KV520oxx0+CctDSQLO8sJGb71hcVEWceF3Le46+MZJ3vwMxTb+sJ4wQFh/FPds7gNqv6OTWYtmu950+O/i3GeB/PhAELzKE=,iv:6RIycaAZdGa8E3YVLT5QaeI9Zf0zF/zD6NZrn5uW2Ws=,tag:101j0x8gxpPAQ5QYRM6b5Q==,type:str]
+    NTFY_AUTH_ACCESS: ENC[AES256_GCM,data:5Ua2XuSZ2MtJNdWFASYze6pluI172iPA1/qoTYmqa2j0,iv:+tk0uiGOHpEIEBX4a9lnsEKpS3njS8FKrEgV2EKN0jU=,tag:ofFrrIPu/u59KprNaIdtWA==,type:str]
+sops:
+    age:
+        - recipient: age1uzs33ep6k3htnuwyyp54y373wkf7urd0qvk5kxcmptr5tt0fffus4v06gn
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4ZTg3RVF1Y2sxUjAzTVgw
+            d2ZkQVpmdzNqYzIwRVR1RGExUjM4SVRMSVN3Cis1bEpZNWZkY1VaWDkzUUlnN2RZ
+            TVUyZ2VNb0MvS3R5c283Ui9DRzkydUEKLS0tIFZMKzhJWnVZUVRsSFNHYStUaGti
+            aGFRSVg5alBnNnA4emxkeFFpZ3BnUFkKUPOqUjkjSl77Xvb3i+THWINbvtzrioqF
+            QBkQh5SSzq8fWrHoHHp7XHu02+p34dEJMOmEg1rlhu7pYRMNbbaRsQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-10-26T08:13:42Z"
+    mac: ENC[AES256_GCM,data:LPFcdVDHPXceeN7fpxgOPE6BFvCh2XBWmY7Q/ODACMNh+NtKt2feZ+FJbPaLzXXhwIpYtzcoStWb+eFLNIXRzowmfly87OTV6sYqAVAS4QGk1+E9K4AoepvwRSnCUXjm/uIer6DyTNbJ4CQG5s+mHb2LHvKNRpi3R/2v1OHDAJw=,iv:pos1aa5t5KtDvVftKJxKjl3J2i50rsRmElJ6Qp0v/Q8=,tag:FXR0puuma8eU7/U0zkzlOw==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

clusters/base/apps/syncthing/helmrelease.yaml

@@ -0,0 +1,73 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: syncthing
+  namespace: syncthing
+spec:
+  interval: 10m
+  chartRef:
+    kind: OCIRepository
+    name: syncthing
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      app:
+        containers:
+          app:
+            image:
+              repository: syncthing/syncthing
+              tag: "2.1.3"
+            env:
+              TZ: Europe/Moscow
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+
+    service:
+      app:
+        controller: app
+        ports:
+          http:
+            port: 8384
+
+    ingress:
+      app:
+        className: traefik
+        # the GUI has no auth of its own out of the box, so it's gated
+        # behind Authelia the same way fava/zigbee2mqtt are.
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+          traefik.ingress.kubernetes.io/router.middlewares: auth-tinyauth@kubernetescrd
+        hosts:
+          - host: sync.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: syncthing-tls
+            hosts:
+              - sync.aggtaa.com
+
+    persistence:
+      data:
+        type: persistentVolumeClaim
+        accessMode: ReadWriteOnce
+        size: 1Gi
+        storageClass: longhorn
+        retain: true
+        globalMounts:
+          - path: /var/syncthing
+      # same nfs-ganesha export webdav and markdown-vault-mcp use
+      # (10.0.64.5:/export); mounted at the same container path (/data)
+      # as webdav so the layout matches (/data/shared/documents/...).
+      shared:
+        type: persistentVolumeClaim
+        existingClaim: syncthing-shared
+        globalMounts:
+          - path: /data

clusters/base/apps/syncthing/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: syncthing
+  namespace: syncthing
+spec:
+  interval: 10m
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/syncthing/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - pv-pvc-shared.yaml
+  - helmrelease.yaml

clusters/base/apps/syncthing/pv-pvc-shared.yaml

@@ -0,0 +1,35 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: syncthing-shared-nfs
+spec:
+  capacity:
+    storage: 30Gi
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  mountOptions:
+    - nfsvers=4.1
+  nfs:
+    server: 10.0.64.5
+    path: /export
+  claimRef:
+    namespace: syncthing
+    name: syncthing-shared
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: syncthing-shared
+  namespace: syncthing
+  annotations:
+    helm.sh/resource-policy: keep
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: syncthing-shared-nfs
+  resources:
+    requests:
+      storage: 30Gi

clusters/base/apps/tinyauth/helmrelease.yaml

@@ -0,0 +1,108 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: tinyauth
+  namespace: auth
+spec:
+  interval: 10m
+  chartRef:
+    kind: OCIRepository
+    name: tinyauth
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      tinyauth:
+        containers:
+          app:
+            image:
+              repository: ghcr.io/tinyauthapp/tinyauth
+              tag: v5.2.0
+            env:
+              TZ: Europe/Moscow
+              TINYAUTH_APPURL: https://login.aggtaa.com
+              TINYAUTH_UI_TITLE: "Welcome"
+              TINYAUTH_RESOURCES_PATH: /resources
+              TINYAUTH_UI_BACKGROUNDIMAGE: /resources/background.webp
+              TINYAUTH_AUTH_USERSFILE: /config/users
+              TINYAUTH_AUTH_SECURECOOKIE: "true"
+              TINYAUTH_LABELPROVIDER: none
+              TINYAUTH_ANALYTICS_ENABLED: "false"
+              TINYAUTH_DATABASE_DRIVER: memory
+              TINYAUTH_OIDC_PRIVATEKEYPATH: /oidc/key.pem
+              TINYAUTH_OIDC_PUBLICKEYPATH: /oidc/key.pub
+
+              TINYAUTH_OIDC_CLIENTS_FILEBROWSER_CLIENTID: filebrowser-quantum
+              TINYAUTH_OIDC_CLIENTS_FILEBROWSER_NAME: files.aggtaa.com
+              TINYAUTH_OIDC_CLIENTS_FILEBROWSER_TRUSTEDREDIRECTURIS: https://files.aggtaa.com/api/auth/oidc/callback
+              TINYAUTH_OIDC_CLIENTS_FILEBROWSER_CLIENTSECRET:
+                valueFrom:
+                  secretKeyRef:
+                    name: tinyauth-secrets
+                    key: TINYAUTH_OIDC_CLIENTS_FILEBROWSER_CLIENTSECRET
+
+              TINYAUTH_OIDC_CLIENTS_MDVAULT_CLIENTID: markdown-vault-mcp
+              TINYAUTH_OIDC_CLIENTS_MDVAULT_NAME: markdown-vault-mcp
+              TINYAUTH_OIDC_CLIENTS_MDVAULT_TRUSTEDREDIRECTURIS: https://md-vault.mcp.aggtaa.com/auth/callback
+              TINYAUTH_OIDC_CLIENTS_MDVAULT_CLIENTSECRET:
+                valueFrom:
+                  secretKeyRef:
+                    name: tinyauth-secrets
+                    key: TINYAUTH_OIDC_CLIENTS_MDVAULT_CLIENTSECRET
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+            resources:
+              requests:
+                cpu: 20m
+                memory: 64Mi
+              limits:
+                memory: 256Mi
+
+    service:
+      app:
+        controller: tinyauth
+        ports:
+          http:
+            port: 3000
+
+    ingress:
+      app:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: login.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: tinyauth-tls
+            hosts:
+              - login.aggtaa.com
+
+    persistence:
+      users:
+        type: secret
+        name: tinyauth-secrets
+        globalMounts:
+          - path: /config/users
+            subPath: users
+            readOnly: true
+      oidc-key:
+        type: secret
+        name: tinyauth-oidc-key
+        globalMounts:
+          - path: /oidc
+            readOnly: true
+      resources:
+        type: configMap
+        name: tinyauth-resources
+        globalMounts:
+          - path: /resources
+            readOnly: true

clusters/base/apps/tinyauth/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: tinyauth
+  namespace: auth
+spec:
+  interval: 1h
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/tinyauth/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - helmrelease.yaml
+  - middleware.yaml
+  - secret.enc.yaml
+  - configmap.yaml
+  - oidc-key.enc.yaml

clusters/base/apps/tinyauth/middleware.yaml

@@ -0,0 +1,14 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: tinyauth
+  namespace: auth
+spec:
+  forwardAuth:
+    address: http://tinyauth.auth.svc.cluster.local:3000/api/auth/traefik
+    trustForwardHeader: true
+    authResponseHeaders:
+      - Remote-User
+      - Remote-Groups
+      - Remote-Name
+      - Remote-Email

clusters/base/apps/tinyauth/oidc-key.enc.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: tinyauth-oidc-key
+    namespace: auth
+stringData:
+    key.pem: ENC[AES256_GCM,data:1LGq+HOfsvba2hrMBgwTiaJY4oSXNVRRyBQt7k+Dv5ZunCNbc57qxGIAi259zekb4yqdnP9SHUo0Uzmz1lgOUwhw4pPNq8YmWkjoLthjBB5FaNqilifUzFXYG3+fC4WP0IxHWUFDhB4tgP9zwnc682/QnQBMKzDXAL9bnRf8OTemNLnAjHt/+vbOtW6ySSmjnF+RRS0gz9/CjPwnCwfqqqRoIaiHT2I5nKuzSggGDNRENlGHsUCBypP08ZbuyQ+wRMWNDhtuG8KY8pWxkvOfwAjbJtJ34/xTGeWwCUQ0fs6khMXzMmvnPKmG/HTAAWrgLeMlhicDLB74nBMY7zbjX1y2HzJPVXAnWNE2sbWXhBIhi+/koyRdWSoUoD7flEu1O44cgRJSh2QqEa4cw4NC+tRm0Dm0R37vOEgMHF/D3cKBxSmgKLxUKw+ZCn5aYF2+Dwo5L+HtuI0VnQ5caq0HCrPN17m63gceVS/mbGYT/A9XSvxhWh5hrtzzn1v3xER/HdOEK1GlZBOL2QPfzyRx9Yx05f/NLGghK+Jk/OBtaV8+0ORGfjJFi+uU2tus8gznESTtZGG6Oz25aIYj7cYCNM93szk2q2lle8wCK8DX48wD5LEwS/7zcWJ2J0FeH/+ihIi2N6cRAgT2P5CHATFX4ghQkAH3UZF0oC2x0EfRXmVE9K2twuD70CSqmBIZvSqC1zEb5KpL283E5lsfVZu3RRryplONMaZZM2bIJqwaEq0wqbtvTnKFTWQEA4JRzgy4i8cFyxfq8ELoEacsjVgZCrASvMjK9NmuqUt4dbKMSuIz0S780Om1V0OoshJiGi9Thu7AWIi0WURRi0ZkvaiLDuqwx+VS5Vt+1y6JByUlsKZg4Dg6saYePKEqClD5nqTv4KsVU3psldOdlS/S4MhBCK31RPAI0yZbDF7job1K4pYWpzuJNH3jh/EDqzbBbNpnTnt6VA9KJ6obJ1vzOVAQB804WB0+hM8ap8vcqHLRPhqa7wZ9mJKVkPBxcr0B3ZulXn428FpjEzCLhUPXVNdJsxpPq0LtmN4yHsfGA/BVwXveT2gLxF+cT5IHOpQVR1ZI/I62ebCfupHYPhZ5aU/UFbCykc2PPQTVM5acVKnwbkU9nR8PmrrZxNmgTQ1akrrQoAMkPkKBsE8R3MIH4md4QhH1B7NV79OwJHrShGDajCPPkGnvFP6w+S4ecdwLkutg57Vhf9Gpq81ztzaq1W/W5y1ax4rGowlRU5nOHy5hDfyLUr0O79319oit4LD7VVWzFiBxWFNaky617V9B/xXFqxInGmQAJVPoPkCE9cHCNVbrblAeND36zjcr/tEWYlNCakt3sNFRQTWaO0MoF1+iLxCQvK7dpRpA3IhOPhFdBRj11J9PI+zpeSXZHYXP2XrfYna062KYb7BxiRiCrO2HAtgKY2TTcA8LHYQ+QiNefSqiNSN3zI7vclb4D6RmDpbm8Hg+SZV1KdvBYw/laj0ctNOnTqwZY51foDgjDnhbRcR5M1mbpq3LUY6TUUoV4+blR1cUKk3pQD5eHVEB/gI5r/mLoK/aesDhVsqEsI1fmwzGESJOL2zRXwyzuPrWj65yfcN0dDK/d06o7vnHdaJIPrEaAmX0M+jD92thIrrUMgkD6r6WqtCYKy81tKqBkMIb4M4wO1ttZ/6WjM7LjNfGAeYhMOTI/LWjmHR/JKrAantSgRgsE6hNGA+C8VUQTpO1rDWFNXRb/vxsibFSypi481ydaySw6Qum/f+eLrLGJdIgWCtI3H+L42N80+k5l03pyuJixqCk0kqVrDQmITNdkGJvbqA7uR3YncSOjPIWn7q79KUca4qW+O1CwtgBJYJqSJiDCVwi3tZ6zv7eDBcq7PGrN4R3hcarY9GVo0Vr4YdSN9VU5PkaXFfG10XZyrHBOLmm4/2iy7NxxWY8d4Z3nXUjitEIAkUa/CGhA3WMiqMkkbeLeiRtmbXZ8ZcCBO5FEUSG/z11PyLRi0o5kct3GlaUtl/QRg4SBGx4t3iDf5gHPb298+ulSErL40GjKLyiZh+YfNPDqRdIXBpKTjOand1EZe1yiY3otCj9NVUdrvkSFL6lYXcCQvVtzLIvrfev/QVqpIOf9d0gxp/em4JTZ+YauRNu5fXcnqezncpQAcXy27O4y2+4cko8tk7aoBwcrl/fKp13nx22I62IJGzsLA7BNjRHUG13iddZoBOzhbJ3xlgNR0nNlIYNSQ==,iv:ZO366aMLKSUkaMdlejlGGZ8rLAQITDJ+rtqHIDjHJCk=,tag:m3eUo6FRn5Gmrf/ozMGldQ==,type:str]
+    key.pub: ENC[AES256_GCM,data:F0YQFFEAwB+bruva4HB4BKeIjAPhnssnd13JLMRMyLMfF8JdIBbjyKcz8NUVq8l5FxFDy3W3jAJmOfVqUwHfajgdT61S2Rj+dBXwV947ruwBiLS3rTnJvgfLIEOf1f4mG2hZH4X7jodInh7wL+IPC7N9Wqmccdfc1eTvn7GjM5KgU6yzsDIdq8CMTOWciRIgLz81sDCP6mLAy4AG+a6nyzhCYSfoQogbl00CP9i6JdV1FcJfrzQY2lgshgrDOynK2bNxwaRP0CVajAn5ccj8sawvIA5EgcEdoasfGGf3WCUnFKDVmYZDZjpeTGDnCRZMFIpKfXbNavaNn2Gwl1icR58UFKsi7tXCePY8MW12gseONFXDoU6OKo+xtgiEk5SPryrskK3m7Dq+9O7No12f2XNhISGlf/sRtY+WmxxXceUTywoOHVRkbcapODRs0svmJBeQZKJ85tE+Fre1l+1mjLGB4ZeaA0euKEZDtTXT95icepMaHIcbZHURwp5jRfYxp7a9VzpWY+m1rwNtnpHe4A16JoU+0ZARPLCs8kX/DqgZDaSy9f+IUjvQYbNTsUNEJCvtMZPWmr/Vz8Je61/8pGz99g==,iv:L5JDiEFJnBPcXGZMmFUVC8Uq12Bb08qYFWhdZCYBivY=,tag:Lpz7BAOaQ1GK9W6WaZ4LLw==,type:str]
+sops:
+    age:
+        - recipient: age1rvyt7nlnjqeyt6ykwh9fj9d88kjmq9vetcx667ul3ql6fyfz4gqqh9lq9q
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFZGwrK2lEVXBWQnBaeVlx
+            aUVPQVRyOTB2WE5HdWR2VldUbmQxZTBuTFIwCks1dkc5aGVXWnpIN1NYNVA0em14
+            c3h4K3hLYkZlU0VhRUEyajFEZzI3UDgKLS0tIFpLQkxlWGtUTGhoVUpiSW9WOStT
+            blZOcjI3TS84K1hZY0ZxbS95SndsUUEKt3ZYkU2/5uPeU7C72luZYP3tLJJ73ERX
+            A8eUMsVOI5T7Y6/i4B1OQSt1xFBXkMSJu3YU739fxFumdb8juALxzg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-10-20T08:48:16Z"
+    mac: ENC[AES256_GCM,data:IcHXiY7PJpNy/sGirwh7rm8XzyuC/ZfajaxolOgfP0p1bMF6yn2tzgf1vyHJszVEwXE7rLZEriR357PaHyGgkIxDnb76FwLTiw+feEBgpl/77HY1oOnI4yc0LrHh5fkanxadw/krJoQ8JD827Ek9h1LR7ICTJ40EDSpdfwdH/1E=,iv:OXMfJyXrXH4S5v2cTdwJijzE2/4L475ZArA/nw06s48=,tag:ykl0rz2xmhJ9NZIjuU111A==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

clusters/base/apps/tinyauth/secret.enc.yaml

@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: tinyauth-secrets
+    namespace: auth
+stringData:
+    users: ENC[AES256_GCM,data:C3Dhfymnr+WLWy18EpY9upXn+f7sY6w0cf3oXO9352PTPCP+rLYQTm8eiJtsU8gp/Uea7lMpsRPHSy8CoRdI8DOGT+hyPyK1ovjLdyO7bEiq0TtYOIFlHSR7Kwo0Cm+pZegSN9e1dm/v51+YyFfX3JpLaymYrlmXL3sFPQ0yOzEuMp3zXSV3VAkJe6gZrswIAUNhY0xmaGItr4Vc2isItDuc16lx7tW2wJHI7NgLI98p9FyU8HlXd9MsiPMxDaXSGeAwnjGU+TEvQv9NbhcZO0sUocSi2zgnRbi0i8Zt,iv:5OVryBqH4VNC71QdZkqZsoDrfbT5++Z5xZjgCFNOAu0=,tag:V+OC7Mad6Dw38u91gp6d/Q==,type:str]
+    TINYAUTH_OIDC_CLIENTS_FILEBROWSER_CLIENTSECRET: ENC[AES256_GCM,data:kBA3jDc+xFyvLNtfPjO+gYtRrT3HgdsoC1MktIgFomA=,iv:JKStNWy9BHcpkSwAG917sC4zzStKcgtU7ZXpKdSraRQ=,tag:VV96+U1EaIQevZHnCDmQag==,type:str]
+    TINYAUTH_OIDC_CLIENTS_MDVAULT_CLIENTSECRET: ENC[AES256_GCM,data:SiipG4qFp536YfrMqfjeZyIA5hxXfDH1JgGGDrkz0bb2mwdSV2S3szLffxNwibL9xAF/dST6I++N5ErLXGH10w==,iv:hzJyoLO1z4eBuDmBYJ5AfSh4RPggJN07EWeKbP+FFV4=,tag:R46K78XLC0BmQ0n6b+irQA==,type:str]
+sops:
+    age:
+        - recipient: age1rvyt7nlnjqeyt6ykwh9fj9d88kjmq9vetcx667ul3ql6fyfz4gqqh9lq9q
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJS1llcTdHUmx2ZXdjVFh1
+            ekJheVN2MVBwa0V1a2JOY2pFM1pmYUJrMzFRCllaRnlnTGFVYTlQeXVxNXFsNEZu
+            bWUxd3BWZTlEOWxsZVRnREx6YUJ6em8KLS0tIGNDd1Znb0dlSDZEUE1JUkdWMlBG
+            ajBNVW1pa20zKzhISmFBUmdiazA4T1UK0wyvTMGsyJthx2Py1LITvRePQsjKN/9v
+            jqKjeeCuVutQCo3FvoVrlkkmiD19jqPDoXjWz95sTN6QjWmP7u6AIA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-10-20T08:39:59Z"
+    mac: ENC[AES256_GCM,data:pKMx3OwJ5x41WghATDCwDNJADs2KCQkDmDsjfbL6Vx98jFOL+MwvCRujOM2UzzAl8QnNLFddimmpNwoFBifQEbeHTpVnT1uqZkiSV89mM1nIoyYIo3exNoynVUoqp1NXxhfwRrRVC3beF3keTxES//kh8/W3as16R1vgBSLoj6s=,iv:AAiLBicP0tywLWXA67cin51TqV8TBXtlpjazta2PyFs=,tag:wSkJBOIhryUNVlGeKrgmnA==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

clusters/base/apps/vaultwarden/helmrelease.yaml

@@ -0,0 +1,69 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: vaultwarden
+  namespace: vaultwarden
+spec:
+  interval: 30m
+  chartRef:
+    kind: OCIRepository
+    name: vaultwarden
+  driftDetection:
+    mode: enabled
+  values:
+    controllers:
+      vaultwarden:
+        containers:
+          app:
+            image:
+              repository: vaultwarden/server
+              tag: 1.37.0
+            env:
+              DOMAIN: "https://vw.aggtaa.com"
+              SIGNUPS_ALLOWED: "false"
+              WEBSOCKET_ENABLED: "true"
+              ADMIN_TOKEN:
+                valueFrom:
+                  secretKeyRef:
+                    name: vaultwarden-secrets
+                    key: ADMIN_TOKEN
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+
+    service:
+      app:
+        controller: vaultwarden
+        ports:
+          http:
+            port: 80
+
+    ingress:
+      app:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: vw.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: vaultwarden-tls
+            hosts:
+              - vw.aggtaa.com
+
+    persistence:
+      data:
+        type: persistentVolumeClaim
+        storageClass: longhorn
+        accessMode: ReadWriteOnce
+        size: 2Gi
+        retain: true
+        globalMounts:
+          - path: /data

clusters/base/apps/vaultwarden/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: vaultwarden
+  namespace: vaultwarden
+spec:
+  interval: 1h
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/vaultwarden/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - secret.enc.yaml
+  - helmrelease.yaml
+  

clusters/base/apps/vaultwarden/secret.enc.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: vaultwarden-secrets
+    namespace: vaultwarden
+stringData:
+    #ENC[AES256_GCM,data:b8Yuhc+eN6k2X6xPhUUBAMyNmJhZl+cpszwhb9OUiZeDJUNC1CUFTSD4//XH81kud+iM3/6o854S,iv:0F4/f5sjeFBqp7zZfJhYd8tkiDRlfKJ6p5n337THiWo=,tag:ZNHbaR0tbHT6aWzyfqeqPw==,type:comment]
+    ADMIN_TOKEN: ENC[AES256_GCM,data:pYY8Nc2PevrFGU2pbZaFH7O+WNJzOHSEXMM3TAFYHO46/GGzQjrxYbc9IY/8PgY86N73kQAFLvw2bpVnjiliilLpnxm9Z0LyYDlAhui8545J67IqoQFDyZt5o3NHceWRP2eCxEL4Bf9gD6j4YfObRVYrp38x2Q==,iv:IvzPkKi/w/S8ueYl/m8kckWiddfl1oQKYiT8S77IVAA=,tag:rD5RsmPt4uihMHWSt4gGwA==,type:str]
+sops:
+    age:
+        - recipient: age109zta6l0cwpkxn5wek82kvauxn6yqrq80rsz4mvu5atdnpcn9pusuvnqk5
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6RVkzM041NFZDMzlYRllw
+            a3BRS0JGZ1B0UGYyaTRLUkp2UTJ1S1pybDFnCnZhVWNYMFRlSXlFVTMvRXlpdlF3
+            Vk1xT1pKV1hzSUYwQXd4ZG92cnhDY0UKLS0tIEtLWXZiZUFDeGhFdytKbTJHSjRH
+            YkJhS2FJOTdLbHlRelBpUWRNUTdTMDQKhgb66tV4L0PKkPY8DvbypTpcBlavUvRH
+            0+Rz/UxfZpX8u8G9GeqF5glIpNG2x28VSOHchJxhvMKHIUq9ZUrHGw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-07-18T19:13:05Z"
+    mac: ENC[AES256_GCM,data:Ufdytxb9uH6JVXsWu39YhE1AfD/oG7bXhIwoTXYhYBE4IWvugrwZLCvBrgkfuazVXyKBuDIuEa5Vj/bzlTGDSlRNx7SDqabvilhmYAsBcuU5DAVU47pDz1YnXeHd9TuQI1dHAc1Q3uvkZwWNxh2YYXKZGwNMy3tOAkaOxwI1rMw=,iv:iUZenTP/9JhmjcR4p5+RM5K2YuXBLnRj0cd/RHseqFY=,tag:pesF8Pp8vBoQXcniwrep9g==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.13.2

clusters/base/apps/webdav/configmap.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: webdav-config
+  namespace: webdav
+data:
+  config.yml: |
+    address: 0.0.0.0
+    port: 6065
+
+    directory: /webdav
+
+    permissions: R
+
+    users:
+      - username: "{env}WEBDAV_USERNAME"
+        password: "{env}WEBDAV_PASSWORD"
+        permissions: CRUD

clusters/base/apps/webdav/helmrelease.yaml

@@ -0,0 +1,107 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: webdav
+  namespace: webdav
+spec:
+  interval: 30m
+  timeout: 10m
+  chartRef:
+    kind: OCIRepository
+    name: webdav
+  driftDetection:
+    mode: enabled
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    controllers:
+      app:
+        containers:
+          app:
+            image:
+              repository: ghcr.io/hacdias/webdav
+              tag: v5.14.2
+            args:
+              - "-c"
+              - "/config.yml"
+            env:
+              TZ: Europe/Moscow
+              WEBDAV_USERNAME:
+                valueFrom:
+                  secretKeyRef:
+                    name: webdav-secrets
+                    key: WEBDAV_USERNAME
+              WEBDAV_PASSWORD:
+                valueFrom:
+                  secretKeyRef:
+                    name: webdav-secrets
+                    key: WEBDAV_PASSWORD
+            probes:
+              liveness:
+                enabled: true
+              readiness:
+                enabled: true
+            resources:
+              requests:
+                cpu: 50m
+                memory: 64Mi
+              limits:
+                memory: 256Mi
+
+    service:
+      app:
+        controller: app
+        ports:
+          http:
+            port: 6065
+
+    ingress:
+      app:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: dav.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: app
+                  port: http
+        tls:
+          - secretName: webdav-tls
+            hosts:
+              - dav.aggtaa.com
+
+    persistence:
+      config-yml:
+        type: configMap
+        name: webdav-config
+        globalMounts:
+          - path: /config.yml
+            subPath: config.yml
+            readOnly: true
+      data:
+        type: persistentVolumeClaim
+        existingClaim: ganesha-export
+        globalMounts:
+          - path: /webdav/export
+      # NAS may be off at pod start: the PVs mount with "bg", so the NFS
+      # mount lands on the host later. HostToContainer relays that late
+      # mount into the container instead of leaving an empty dir.
+      sda2:
+        type: persistentVolumeClaim
+        existingClaim: nas1-sda2
+        globalMounts:
+          - path: /webdav/nas1/sda2
+            mountPropagation: HostToContainer
+      sdb2:
+        type: persistentVolumeClaim
+        existingClaim: nas1-sdb2
+        globalMounts:
+          - path: /webdav/nas1/sdb2
+            mountPropagation: HostToContainer

clusters/base/apps/webdav/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: webdav
+  namespace: webdav
+spec:
+  interval: 1h
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/webdav/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - configmap.yaml
+  - secret.enc.yaml
+  - pv-pvc-data.yaml
+  - helmrelease.yaml

clusters/base/apps/webdav/pv-pvc-data.yaml

@@ -0,0 +1,119 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: ganesha-export-nfs
+spec:
+  capacity:
+    storage: 1Ti
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  mountOptions:
+    - nfsvers=4.1
+  nfs:
+    server: 10.0.64.5
+    path: /export
+  claimRef:
+    namespace: webdav
+    name: ganesha-export
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: ganesha-export
+  namespace: webdav
+  annotations:
+    helm.sh/resource-policy: keep
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: ganesha-export-nfs
+  resources:
+    requests:
+      storage: 1Ti
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: nas1-sda2-nfs
+spec:
+  capacity:
+    storage: 1Ti
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  mountOptions:
+    - nfsvers=3
+    - nolock
+    - soft
+    - bg
+    - retry=525600  # bg gives up after 10000 min by default; ~1 year instead
+    - timeo=50
+    - retrans=2
+  nfs:
+    server: 10.0.64.80
+    path: /mnt/sda2
+  claimRef:
+    namespace: webdav
+    name: nas1-sda2
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nas1-sda2
+  namespace: webdav
+  annotations:
+    helm.sh/resource-policy: keep
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: nas1-sda2-nfs
+  resources:
+    requests:
+      storage: 1Ti
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: nas1-sdb2-nfs
+spec:
+  capacity:
+    storage: 1Ti
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: ""
+  mountOptions:
+    - nfsvers=3
+    - nolock
+    - soft
+    - bg
+    - retry=525600  # bg gives up after 10000 min by default; ~1 year instead
+    - timeo=50
+    - retrans=2
+  nfs:
+    server: 10.0.64.80
+    path: /mnt/sdb2
+  claimRef:
+    namespace: webdav
+    name: nas1-sdb2
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nas1-sdb2
+  namespace: webdav
+  annotations:
+    helm.sh/resource-policy: keep
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: ""
+  volumeName: nas1-sdb2-nfs
+  resources:
+    requests:
+      storage: 1Ti

clusters/base/apps/webdav/secret.enc.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: webdav-secrets
+    namespace: webdav
+stringData:
+    WEBDAV_USERNAME: ENC[AES256_GCM,data:BeN5VS8=,iv:XpUr5PG9RWTRGXs7/EzDyLGwUm05Mr0YWpW7PwzNfm8=,tag:3py47tIcTeFxuuAidk2wBg==,type:str]
+    WEBDAV_PASSWORD: ENC[AES256_GCM,data:Rh1ryftcmxgJAHvC/N1o5QeagCvyb3XIpDS7jOTCpJm3Wb5rUcLNmtcW22f0xljw,iv:GmgQJEuzUzSEql+fx5KURKv8CnhXF/z5UlmEn4ta+K0=,tag:AZD1CEbVRm6DiBt66pB9Vg==,type:str]
+sops:
+    age:
+        - recipient: age1y8t9v56yuvskznddqfsd4yddzzch0yf2dutvvt8rrx6rjh5f9g0s3qeays
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA5UkRLNWVyZUpLREtZcm8r
+            V0VPTkZDN1pSWDNxWFZXOUlON1c3cHhSZFVzClpEMmhvQnlFMnF6aXV6MjJnMnBu
+            c2pxTDBGZVBUYjZNR1doQ3UraDQ3dlEKLS0tIE42dTZWMUhZdnVMYUNLTGdrSWZC
+            UFM0V08reGVmZTRMUWw5T1R2OUdGWW8KWAZq4TG36Njlw4//vPCxzM1Qqr/6Ievw
+            taBvLXpw9wkrjfZJ8gBU+0Q8WrsEy+tYtR9chfz1n/SmiGHCkskFGQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-07-29T18:57:24Z"
+    mac: ENC[AES256_GCM,data:bW2QvjSbA4JmfmZFzC1oIfEnVBxf1pE4jtKDsp2sf7mozVEdqMTD2nNpq4Pro9zRiXQfzxQAXAyzT48dBhIunXKDNIS7vbPpLUbs0nwSF4Dgp/q02ZX3Vrewx80iz5wdMYvLk6c2viZ9ndMwRqBbdBBsuSa5O9nIVj1edG9tj70=,iv:8bgXaA9RiQtbd1Xaht5r5NB3lFedX7Wi/X4z10VLLuA=,tag:Qnr8Ij6XN/FMcQf9Kx1IvA==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

clusters/base/apps/woodpecker/helmrelease.yaml

@@ -0,0 +1,115 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: woodpecker
+  namespace: ci
+spec:
+  interval: 10m
+  chartRef:
+    kind: OCIRepository
+    name: woodpecker
+  driftDetection:
+    mode: enabled
+  values:
+    defaultPodOptions:
+      securityContext:
+        fsGroup: 1000 # non-root image, fresh longhorn volume is root-owned
+        fsGroupChangePolicy: OnRootMismatch
+
+    controllers:
+      server:
+        replicas: 1
+        strategy: Recreate # sqlite on RWO volume
+        containers:
+          app:
+            image:
+              repository: woodpeckerci/woodpecker-server
+              tag: v3.18.1
+            env:
+              WOODPECKER_HOST: https://ci.aggtaa.com
+              WOODPECKER_OPEN: "false"
+              WOODPECKER_ADMIN: anton
+              WOODPECKER_GITEA: "true"
+              WOODPECKER_GITEA_URL: https://git.aggtaa.com
+              WOODPECKER_DATABASE_DRIVER: sqlite3
+              WOODPECKER_DATABASE_DATASOURCE: /var/lib/woodpecker/woodpecker.sqlite
+            envFrom:
+              - secretRef:
+                  name: woodpecker-secrets
+            resources:
+              requests:
+                cpu: 50m
+                memory: 128Mi
+              limits:
+                memory: 512Mi
+      agent:
+        replicas: 1
+        strategy: Recreate # RWO volume for agent id
+        serviceAccount:
+          name: woodpecker-agent # created in rbac.yaml
+        pod:
+          automountServiceAccountToken: true # kubernetes backend uses in-cluster config
+        containers:
+          app:
+            image:
+              repository: woodpeckerci/woodpecker-agent
+              tag: v3.18.1
+            env:
+              WOODPECKER_SERVER: woodpecker:9000
+              WOODPECKER_BACKEND: kubernetes
+              WOODPECKER_BACKEND_K8S_NAMESPACE: ci
+              WOODPECKER_BACKEND_K8S_STORAGE_CLASS: longhorn-no-retain
+              WOODPECKER_BACKEND_K8S_VOLUME_SIZE: 5G
+              WOODPECKER_MAX_WORKFLOWS: "2"
+            envFrom:
+              - secretRef:
+                  name: woodpecker-secrets
+            resources:
+              requests:
+                cpu: 20m
+                memory: 64Mi
+              limits:
+                memory: 256Mi
+
+    service:
+      server:
+        controller: server
+        ports:
+          http:
+            port: 8000
+          grpc:
+            port: 9000
+
+    ingress:
+      server:
+        className: traefik
+        annotations:
+          cert-manager.io/cluster-issuer: letsencrypt-prod
+        hosts:
+          - host: ci.aggtaa.com
+            paths:
+              - path: /
+                pathType: Prefix
+                service:
+                  identifier: server
+                  port: http
+        tls:
+          - secretName: woodpecker-tls
+            hosts:
+              - ci.aggtaa.com
+
+    persistence:
+      data:
+        type: persistentVolumeClaim
+        existingClaim: woodpecker-data
+        advancedMounts:
+          server:
+            app:
+              - path: /var/lib/woodpecker
+      agent-config:
+        type: persistentVolumeClaim
+        existingClaim: woodpecker-agent-config
+        advancedMounts:
+          agent:
+            app:
+              - path: /etc/woodpecker

clusters/base/apps/woodpecker/helmrepository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: woodpecker
+  namespace: ci
+spec:
+  interval: 10m
+  url: oci://ghcr.io/bjw-s-labs/helm/app-template
+  ref:
+    tag: "5.0.1"

clusters/base/apps/woodpecker/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - secret.enc.yaml
+  - pvc.yaml
+  - rbac.yaml
+  - helmrelease.yaml

clusters/base/apps/woodpecker/pvc.yaml

@@ -0,0 +1,25 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: woodpecker-data
+  namespace: ci
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 2Gi
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: woodpecker-agent-config
+  namespace: ci
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 1Gi

clusters/base/apps/woodpecker/rbac.yaml

@@ -0,0 +1,33 @@
+# Agent runs pipeline steps as pods in this namespace (kubernetes backend)
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: woodpecker-agent
+  namespace: ci
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: woodpecker-agent
+  namespace: ci
+rules:
+  - apiGroups: [""]
+    resources: [pods, pods/log]
+    verbs: [create, get, list, watch, delete]
+  - apiGroups: [""]
+    resources: [persistentvolumeclaims, services, secrets, configmaps]
+    verbs: [create, get, list, watch, update, delete]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: woodpecker-agent
+  namespace: ci
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: woodpecker-agent
+subjects:
+  - kind: ServiceAccount
+    name: woodpecker-agent
+    namespace: ci

clusters/base/apps/woodpecker/secret.enc.yaml

@@ -0,0 +1,25 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: woodpecker-secrets
+    namespace: ci
+stringData:
+    WOODPECKER_AGENT_SECRET: ENC[AES256_GCM,data:UyYPJpkHb2G1Vpe2tEtkNDMktp6zFbeNtDF34Kp8vf6nAY5/2EYXBJvT4+Ns2oOGNZOupdCUmTowrJ+ITNFwhQ==,iv:EtXILwt+FFYvqvLw9kLODh0wyhrHG+GJNGZRu6wzXd4=,tag:Ly5dsTWio741VxgtPy51XQ==,type:str]
+    WOODPECKER_GITEA_CLIENT: ENC[AES256_GCM,data:hXBo5EwhHuCTQ4vQBAmjnLTlQ6cY2dKeJ5vZJ27wMFUsKZpS,iv:Pzt78GVSWngjVvpVSEgvsImK+siHEHOqQy+jOAxrGkc=,tag:JYu+Jf+n9J4L4LPwRPPbSw==,type:str]
+    WOODPECKER_GITEA_SECRET: ENC[AES256_GCM,data:nu4FTBjdJe7oHx2Vt1ElxJXVnYzONC3kKYlXwvtmVI3/DokjSGA0YwLy0jI58l7K9nBbzGKuuZM=,iv:U6mfIG+LYhSfooIK3yhJay+fQh5oCNyGUggN+MrY4os=,tag:Oho0FnhePMLhFzsyhFISZQ==,type:str]
+    WOODPECKER_GRPC_SECRET: ENC[AES256_GCM,data:rLiZToTcqf03gY/psoboYUsDUC16/0ZPkgOo/5ABrOvuyvHFoJPnAlvYhvSu/+qCIU1vlv7AvhfEJyEig+ULaA==,iv:q42abGbWSQb1noVhkXwiAWoIXcDUT01MTbnhaV5Plos=,tag:gioDH0cIPGoRD4auPEq71w==,type:str]
+sops:
+    age:
+        - recipient: age13qwkssk8esashln2j3gfv6e9csashr4vddkdav5v38hm5wejl36qd2ew9s
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA1anNnNDlnSjhMU2h4clVV
+            eFJnNEx6VmU1RjR0a1RQQTRML3lBaUphSkU4CnNuM0I2NkFPMlU1clFNY3V5Sk9Y
+            b0NJNzlUMjJsRVZMdndzUWYyNWhjeHMKLS0tIEp0Y2E3dTRwRTUyUmprRktFNUJp
+            TXlXWjViSGNFb1FhQ0xDT0gvajdwSlEKXB7N64RmaWgCCSvG/nNWOziO7QnN729i
+            jJLB6SPiHjgNMn1GP+rsAstVFStB0fn2mh6QpWrdhAM3/NFBqQfy7A==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-10-07T08:38:39Z"
+    mac: ENC[AES256_GCM,data:+beUA2t2YPqjsk7KXnPgJBiiQSjB7qypni669F2W3YNdTXx/ChenMxo7srjvejW3YfzPccbnBY6/TJgKCLPGm/Kf0hntejbBgYeu9hltSrIZX28efoE6tq4NicqJkPT8oD24v++H5jxRZP4epmef5t6rzJSq1xc4ETZerK0f9PU=,iv:wekT7WxL/Xm+vqCYCsZ4nvwl8VeOugURNvbHs/KQhRk=,tag:gH5efL/YUtJEewcY0G3Ctw==,type:str]
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

clusters/base/apps/zigbee2mqtt/helmrelease.yaml

@@ -0,0 +1,87 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: zigbee2mqtt
+  namespace: zigbee2mqtt
+spec:
+  interval: 30m
+  chart:
+    spec:
+      chart: zigbee2mqtt
+      version: "2.12.1"
+      sourceRef:
+        kind: HelmRepository
+        name: zigbee2mqtt
+  driftDetection:
+    mode: enabled
+  values:
+    service:
+      type: ClusterIP
+      port: 8080
+
+    statefulset:
+      storage:
+        enabled: true
+        size: 1Gi
+        storageClassName: longhorn
+      secrets:
+        name: zigbee2mqtt-secrets
+
+    configmap:
+      enabled: true
+      # devices.yaml / groups.yaml already exist on the PV and are the live source
+      # of truth (zigbee2mqtt mutates them as devices pair/rename). Do not set
+      # configmap.devices here — the chart only seeds devices.yaml from it when
+      # the file is missing, but leaving it unset avoids any risk of clobbering
+      # the real data and any drift between this file and reality.
+
+    zigbee2mqtt:
+      homeassistant:
+        enabled: true
+        experimental_event_entities: true
+
+      permit_join: false
+      timezone: Europe/Moscow
+
+      mqtt:
+        server: "mqtt://mosquitto.mqtt.svc.cluster.local:1883"
+        user: iot
+        password: "!secret.yaml mqtt_password"
+        include_device_information: true
+        keepalive: 60
+        reject_unauthorized: true
+        version: 4
+
+      serial:
+        port: "tcp://10.0.64.72:6638"
+        adapter: ember
+        baudrate: 115200
+        rtscts: false
+
+      frontend:
+        enabled: true
+        port: 8080
+        url: "https://zigbee2mqtt.aggtaa.com"
+
+      advanced:
+        channel: 11
+        pan_id: 7410
+        ext_pan_id: [46, 22, 201, 245, 48, 186, 40, 6]
+        network_key: "!secret.yaml network_key"
+        log_level: info
+
+    ingress:
+      enabled: true
+      ingressClassName: traefik
+      annotations:
+        cert-manager.io/cluster-issuer: letsencrypt-prod
+        traefik.ingress.kubernetes.io/router.middlewares: auth-tinyauth@kubernetescrd
+      hosts:
+        - host: zigbee2mqtt.aggtaa.com
+          paths:
+            - path: /
+              pathType: Prefix
+      tls:
+        - secretName: zigbee2mqtt-tls
+          hosts:
+            - zigbee2mqtt.aggtaa.com

clusters/base/apps/zigbee2mqtt/helmrepository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: zigbee2mqtt
+  namespace: zigbee2mqtt
+spec:
+  interval: 1h
+  url: https://charts.zigbee2mqtt.io/

clusters/base/apps/zigbee2mqtt/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - helmrepository.yaml
+  - secret.enc.yaml
+  - helmrelease.yaml