chore(deps): update terraform proxmox to v0.114.0

dns: add pkgatlas.vhaudiquet.fr A record
Caddy's wildcard *.vhaudiquet.fr vhost already routes the host to the in-cluster Traefik and on to the pkgatlas ingress.
2026-09-26 10:48:24 +00:00 · 2026-09-26 04:01:53 +00:00 · 2026-09-24 22:00:21 +02:00 · 2026-09-24 21:57:42 +02:00 · 2026-09-22 22:35:36 +02:00 · 2026-09-22 21:58:25 +02:00
291 changed files with 5805 additions and 2566 deletions
@@ -1,62 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: "docker-compose"
-    open-pull-requests-limit: 15
-    schedule:
-      interval: weekly
-    directories:
-      - "/docker/home/esphome"
-      - "/docker/home/matter-server"
-      - "/docker/home/mosquitto-mqtt"
-      - "/docker/home/n8n"
-      - "/docker/home/node-red"
-      - "/docker/home/zigbee2mqtt"
-      - "/docker/infrastructure/mail/roundcube"
-      - "/docker/infrastructure/mail/stalwart"
-      - "/docker/infrastructure/network/traefik"
-      - "/docker/infrastructure/squid"
-      - "/docker/infrastructure/sshportal"
-      - "/docker/personal/fireshare"
-      - "/docker/personal/gramps"
-      - "/docker/personal/media/films-series/jackett"
-      - "/docker/personal/media/films-series/jellyfin"
-      - "/docker/personal/media/films-series/jellyseerr"
-      - "/docker/personal/media/films-series/radarr"
-      - "/docker/personal/media/films-series/sonarr"
-      - "/docker/personal/media/films-series/transmission"
-      - "/docker/personal/media/films-series/wizarr"
-      - "/docker/personal/media/music/navidrome"
-      - "/docker/personal/media/youtube/tubearchivist"
-      - "/docker/personal/paperless"
-      - "/docker/personal/radicale"
-      - "/docker/personal/syncthing"
-      - "/docker/personal/tandoor"
-      - "/docker/production/alexscript"
-      - "/docker/production/buildpath"
-      - "/docker/production/semeryfr"
-      - "/docker/tools/excalidraw"
-      - "/docker/tools/obsidian-livesync"
-      - "/docker/tools/stirling-pdf"
-  - package-ecosystem: "helm"
-    open-pull-requests-limit: 15
-    schedule:
-      interval: weekly
-    directories:
-      - "/kubernetes/code/gitea"
-      - "/kubernetes/code/harbor"
-      - "/kubernetes/home/home-assisant"
-      - "/kubernetes/home/zigbee2mqtt"
-      - "/kubernetes/infrastructure/authentik"
-      - "/kubernetes/personal/linkwarden"
-      - "/kubernetes/personal/notesnook"
-      - "/kubernetes/personal/photoprism"
-      - "/kubernetes/production/umami"
-      - "/kubernetes/production/vhaudiquet-fr"
-      - "/kubernetes/system/blocky"
-      - "/kubernetes/system/caddy"
-      - "/kubernetes/system/coredns"
-      - "/kubernetes/system/csi-driver-nfs"
-      - "/kubernetes/system/external-dns"
-      - "/kubernetes/system/traefik"
-      - "/kubernetes/tools/dashy"
-      - "/kubernetes/tools/glance"
@@ -9,3 +9,6 @@ terraform.tfstate.backup
 kubeconfig
 talosconfig

+# Ignore rendered Talos machine configs (may contain cluster secrets)
+p330.yaml
+
@@ -6,13 +6,13 @@ repos:
        entry: .pre-commit-sops.sh
        language: script
        pass_filenames: true
-      - id: generate-dependabot
-        name: generate dependabot
-        entry: generate-dependabot.sh
-        language: script
-        pass_filenames: false
      - id: generate-docker-swarmcd
        name: generate docker swarmcd
        entry: generate-docker-swarmcd.sh
        language: script
        pass_filenames: false
+      - id: validate-kustomize
+        name: validate kustomize build
+        entry: bash -c 'kubectl kustomize kubernetes/ > /dev/null'
+        language: system
+        pass_filenames: false
@@ -1,6 +1,13 @@
 #!/bin/bash
 for filename in "$@"; do
    if [[ "${filename}" =~ values.ya?ml$ ]] || [[ "${filename}" =~ secrets?.ya?ml$ ]] || [[ "${filename}" =~ .env$ ]]; then
+        # Skip files that are already SOPS-encrypted: sops -e -i refuses files
+        # containing a top-level 'sops' metadata block (YAML) or '#sops'
+        # comments (dotenv), and double-encrypting would corrupt them anyway.
+        # Makes the hook idempotent for encrypted-at-rest working trees.
+        if grep -qE '^(sops:|#sops)' "${filename}" 2>/dev/null; then
+            continue
+        fi
        sops -e -i "${filename}"
        git add "${filename}"
    fi
@@ -1,9 +1,10 @@
 creation_rules:
  - path_regex: .*values.yaml$
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
    pgp: DC6910268E657FF70BA7EC289974494E76938DDC
  - path_regex: .*.yaml
-    encrypted_regex: ^(data|stringData|.*.key|.*.crt)$
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
    pgp: DC6910268E657FF70BA7EC289974494E76938DDC
  - path_regex: .*.env$
    input_type: dotenv
@@ -3,11 +3,6 @@ esphome:
  branch: main
  compose_file: docker/home/esphome/docker-compose.yml

-matter-server:
-  repo: homeprod
-  branch: main
-  compose_file: docker/home/matter-server/docker-compose.yml
-
 mosquitto-mqtt:
  repo: homeprod
  branch: main
@@ -33,26 +28,21 @@ roundcube:
  branch: main
  compose_file: docker/infrastructure/mail/roundcube/docker-compose.yml

-stalwart:
-  repo: homeprod
-  branch: main
-  compose_file: docker/infrastructure/mail/stalwart/docker-compose.yml
-
 traefik:
  repo: homeprod
  branch: main
  compose_file: docker/infrastructure/network/traefik/docker-compose.yml

+observability:
+  repo: homeprod
+  branch: main
+  compose_file: docker/infrastructure/observability/docker-compose.yml
+
 squid:
  repo: homeprod
  branch: main
  compose_file: docker/infrastructure/squid/docker-compose.yml

-sshportal:
-  repo: homeprod
-  branch: main
-  compose_file: docker/infrastructure/sshportal/docker-compose.yml
-
 fireshare:
  repo: homeprod
  branch: main
@@ -112,13 +102,6 @@ tubearchivist:
  sops_files:
    - docker/personal/media/youtube/tubearchivist/.env

-paperless:
-  repo: homeprod
-  branch: main
-  compose_file: docker/personal/paperless/docker-compose.yml
-  sops_files:
-    - docker/personal/paperless/.env
-
 radicale:
  repo: homeprod
  branch: main
@@ -141,30 +124,11 @@ alexscript:
  branch: main
  compose_file: docker/production/alexscript/docker-compose.yml

-buildpath:
-  repo: homeprod
-  branch: main
-  compose_file: docker/production/buildpath/docker-compose.yml
-  sops_files:
-    - docker/production/buildpath/.env
-
-semeryfr:
-  repo: homeprod
-  branch: main
-  compose_file: docker/production/semeryfr/docker-compose.yml
-
 excalidraw:
  repo: homeprod
  branch: main
  compose_file: docker/tools/excalidraw/docker-compose.yml

-obsidian-livesync:
-  repo: homeprod
-  branch: main
-  compose_file: docker/tools/obsidian-livesync/docker-compose.yml
-  sops_files:
-    - docker/tools/obsidian-livesync/.env
-
 stirling-pdf:
  repo: homeprod
  branch: main
@@ -7,20 +7,28 @@ Personal home production environment mono-repo

 ### Hardware and operating systems

-<img align="left" width="100" src="https://vhaudiquet.fr/public/github_assets/homeprod/p330_sff.png"/>
-
-#### Lenovo ThinkStation P330 SFF
+#### Dell R740

 Specifications :
 ```
-Intel Xeon E-2134 @ 3.50GHz (4 cores, 8 threads)
-64 GiB DDR4 ECC RAM
-1 TiB nVME SSD
-Intel X520-DA2 SFP+ 10Gbps network card
-nVIDIA Quadro P620 graphics card
+2* Intel Xeon Gold 6138 @ 2GHz (20 cores, 40 threads)
+144 GiB DDR4 ECC RAM
+2* 2 TiB SAS SSD (mirror)
+10Gbps 4* RJ45 network card
+H730P, 16* SFF 2.5 drive bays
+SAS9300-8E external SAS card
+NVIDIA RTX 3060 12G graphics card
 ```

-Running as single-node Proxmox
+Running as single-node Proxmox, with multiple VMs and LXC containers.
+
+#### Lenovo P330
+
+Running as a Talos/Kubernetes cluster node, for failover deployment.
+
+#### Raspberry Pi 4
+
+Running as a Talos/Kubernetes cluster node, for quorum only.

 ### Software stack(s)

@@ -50,7 +58,7 @@ Debian and docker / docker swarm are deployed by Terraform, which also deploys [
 | <img width=32 src="https://avatars.githubusercontent.com/u/12724356"><img width=32 src="https://avatars.githubusercontent.com/u/40275816"> | Repository applications | Gitea, Harbor to store code and images |
 | <img width=30 src="https://buildpath.win/_ipx/w_60&f_webp/buildpath-high-resolution-logo-transparent.png"> <img width=32 src="https://avatars.githubusercontent.com/u/13844975"> | Production applications | Personal applications running on the cluster |

-Talos Linux, Cilium and flux are deployed using Terraform ; then flux takes over and deploys the whole `kubernetes` folder of this repository.
+Talos Linux, Cilium and Flux are deployed using Terraform; then Flux takes over and deploys the whole `kubernetes` folder of this repository.

 ### Production/personal applications

@@ -6,7 +6,7 @@
        proxied: false
    ttl: 300
    type: A
-    value: 83.113.30.49
+    value: 82.64.154.58
  - type: TXT
    value: google-site-verification=BvFkK7orKeezgxGcdPiGa67PUm9RPI6ZjyyykhSJ24A
 _acme-challenge:
@@ -25,4 +25,4 @@ www:
      proxied: false
  ttl: 300
  type: A
-  value: 83.113.30.49
+  value: 82.64.154.58
@@ -5,7 +5,7 @@
        auto-ttl: true
    ttl: 300
    type: A
-    value: 83.113.30.49
+    value: 82.64.154.58
  - octodns:
      cloudflare:
        auto-ttl: true
@@ -77,70 +77,14 @@ _25._tcp:
  ttl: 300
  type: TLSA
  values:
-  - certificate_association_data: 5dfdb3cf31b26f23d87c09f3a0cef642f64069a9fb7cfe29270bb5dc0f1e16bb
-    certificate_usage: 2
-    matching_type: 1
-    selector: 0
-  - certificate_association_data: 76e9e288aafc0e37f4390cbf946aad997d5c1c901b3ce513d3d8fadbabe2ab85
-    certificate_usage: 2
-    matching_type: 1
-    selector: 0
-  - certificate_association_data: 4e32b7ee52c9bd2a15b2df3cae5e3b060d737d71faaaac25336c5f193cbdb52ed2fdf38b29aea9fb97f59c8f86e75b5c364309a232623a99e638116ed66063fd
-    certificate_usage: 2
-    matching_type: 2
-    selector: 0
-  - certificate_association_data: afab698cbbbf892ebb555e09175056c1d4630fe7c350f44dcc6e71843d3b290df00d30ab4e356b630c69169d7633788338922fb637cf5b9f7be20a413eeaa518
-    certificate_usage: 2
-    matching_type: 2
-    selector: 0
-  - certificate_association_data: 3586d4ecf070578cbd27aedce20b964e48bc149faeb9dad72f46b857869172b8
-    certificate_usage: 2
-    matching_type: 1
-    selector: 1
-  - certificate_association_data: d016e1fe311948aca64f2de44ce86c9a51ca041df6103bb52a88eb3f761f57d7
-    certificate_usage: 2
-    matching_type: 1
-    selector: 1
-  - certificate_association_data: a1ef14fea3ca15a552d42665d2fe685672cfdd903de4b370b0d7d87c6d31b5df07142483f36e0e15e16b58f9ba1cbdeeebd4bcb8d74ab7ea32a087db2105f402
-    certificate_usage: 2
-    matching_type: 2
-    selector: 1
-  - certificate_association_data: f8a2b4e23e82a4494e9998fcc4242bef1277656a118beede55ddfadcb82e20c5dc036dcb3b6c48d2ce04e362a9f477c82ad5a557b06b6f33b45ca6662b37c1c9
-    certificate_usage: 2
-    matching_type: 2
-    selector: 1
-  - certificate_association_data: a69ec216999308f0ee575cdef98d6edabed8a6b4d2328e050ac9c7fa06404ad9
-    certificate_usage: 3
-    matching_type: 1
-    selector: 0
-  - certificate_association_data: ccae2719a01f7a6d17d939d8ec13324b7bdb0921ea55d5bfc2f226e54b8c15dd
-    certificate_usage: 3
-    matching_type: 1
-    selector: 0
-  - certificate_association_data: 7cd33aa6bafc850cc89d008fbd0a5cea942c6a573d605984f174fbe7360abbf71fc157ffe0324e380a8dfea62047b9aa140d5899188402ac677c29f96cc1118e
-    certificate_usage: 3
-    matching_type: 2
-    selector: 0
-  - certificate_association_data: 8149784990ba7e448295f9c4eb22abcaa4ecefa1b44f1a71ea13d6827d7068c6469cf5fb08a8ae772c1ef59cddbcfd84d744713c48e985136a234b494511fd03
-    certificate_usage: 3
-    matching_type: 2
-    selector: 0
-  - certificate_association_data: 08f3ffd1b6027093c136f6bb5bc1645a8db31cf2a4392b779c2a2045e152b8b8
-    certificate_usage: 3
-    matching_type: 1
-    selector: 1
-  - certificate_association_data: 12b3946513281ab20ebee4d38d2e139cac1688420015db90ee8e932fe153bc89
-    certificate_usage: 3
-    matching_type: 1
-    selector: 1
-  - certificate_association_data: 7b60aee1a230de2c32c0252540c606897ad66cbabc7331c2d40b7dd0e3249e0cc53e145605e610d8dc2f41dd16e12f51dca4641d13e748553bd0f596455dae77
-    certificate_usage: 3
-    matching_type: 2
-    selector: 1
-  - certificate_association_data: 8cee22274c3f828eda9d18c9954ed0a3ad5172e71b7852c780384bf3828ff1bb26fca899395e99e4d191c2d1e0a55404f97e76bb7d4ad8dff71c6c271d34de49
-    certificate_usage: 3
-    matching_type: 2
-    selector: 1
+    - certificate_association_data: CC6230E3A88A173D11C7F614ACFB4FE7B57A01F649ED1ADEE5F953213D4C6607
+      certificate_usage: 3
+      matching_type: 1
+      selector: 1
+    - certificate_association_data: 731B7CD6FA08C4A56060172BF8E30563919139F16265A38EC35B2A1F41CE2B6B
+      certificate_usage: 3
+      matching_type: 1
+      selector: 0
 _caldavs._tcp:
  octodns:
    cloudflare:
@@ -313,27 +257,20 @@ _submissions._tcp:
    priority: 0
    target: vhaudiquet.fr.
    weight: 1
-alexscript:
-  octodns:
-    cloudflare:
-      auto-ttl: true
-  ttl: 300
-  type: A
-  value: 83.113.30.49
 auth-nook:
  octodns:
    cloudflare:
      auto-ttl: true
  ttl: 300
  type: A
-  value: 83.113.30.49
+  value: 82.64.154.58
 authentik:
  octodns:
    cloudflare:
      auto-ttl: true
  ttl: 300
  type: A
-  value: 83.113.30.49
+  value: 82.64.154.58
 autoconfig:
  octodns:
    cloudflare:
@@ -348,13 +285,6 @@ autodiscover:
  ttl: 300
  type: CNAME
  value: mail.vhaudiquet.fr.
-canada:
-  octodns:
-    cloudflare:
-      auto-ttl: true
-  ttl: 300
-  type: A
-  value: 192.99.6.159
 clips:
  octodns:
    cloudflare:
@@ -375,29 +305,21 @@ flux-webhook:
      auto-ttl: true
  ttl: 300
  type: A
-  value: 83.113.30.49
+  value: 82.64.154.58
 git:
  octodns:
    cloudflare:
      auto-ttl: true
  ttl: 300
  type: A
-  value: 83.113.30.49
-jupyter:
+  value: 82.64.154.58
+inbox-nook:
  octodns:
    cloudflare:
      auto-ttl: true
  ttl: 300
  type: A
-  value: 83.113.30.49
-kasm:
-  octodns:
-    cloudflare:
-      auto-ttl: true
-      proxied: true
-  ttl: 300
-  type: A
-  value: 83.113.30.49
+  value: 82.64.154.58
 ligory:
 - octodns:
    cloudflare:
@@ -413,33 +335,19 @@ ligory:
  value:
    exchange: ligory.vhaudiquet.fr.
    preference: 20
-lol:
-  octodns:
-    cloudflare:
-      auto-ttl: true
-  ttl: 300
-  type: A
-  value: 83.113.30.49
 mail:
 - octodns:
    cloudflare:
      auto-ttl: true
  ttl: 300
  type: A
-  value: 83.113.30.49
+  value: 82.64.154.58
 - octodns:
    cloudflare:
      auto-ttl: true
  ttl: 300
  type: TXT
  value: v=spf1 a ra=postmaster -all
-md:
-  octodns:
-    cloudflare:
-      auto-ttl: true
-  ttl: 300
-  type: A
-  value: 83.113.30.49
 mta-sts:
  octodns:
    cloudflare:
@@ -453,46 +361,53 @@ n:
      auto-ttl: true
  ttl: 300
  type: A
-  value: 83.113.30.49
+  value: 82.64.154.58
 nook:
  octodns:
    cloudflare:
      auto-ttl: true
  ttl: 300
  type: A
-  value: 83.113.30.49
+  value: 82.64.154.58
 notesnook:
  octodns:
    cloudflare:
      auto-ttl: true
  ttl: 300
  type: A
-  value: 83.113.30.49
-overleaf:
+  value: 82.64.154.58
+photos:
  octodns:
    cloudflare:
      auto-ttl: true
  ttl: 300
  type: A
-  value: 83.113.30.49
+  value: 82.64.154.58
+pkgatlas:
+  octodns:
+    cloudflare:
+      auto-ttl: true
+  ttl: 300
+  type: A
+  value: 82.64.154.58
 sse-nook:
  octodns:
    cloudflare:
      auto-ttl: true
  ttl: 300
  type: A
-  value: 83.113.30.49
+  value: 82.64.154.58
 umami:
  octodns:
    cloudflare:
      auto-ttl: true
  ttl: 300
  type: A
-  value: 83.113.30.49
+  value: 82.64.154.58
 www:
  octodns:
    cloudflare:
      auto-ttl: true
  ttl: 300
  type: A
-  value: 83.113.30.49
+  value: 82.64.154.58
@@ -1,6 +1,6 @@
 services:
  esphome:
-    image: ghcr.io/esphome/esphome:2026.4.5
+    image: ghcr.io/esphome/esphome:2026.8.0
    ports:
      - "6052"
    networks:
@@ -1,16 +0,0 @@
-services:
-  matter-server:
-    image: ghcr.io/matter-js/python-matter-server:8.1.2
-    container_name: matter-server
-    restart: unless-stopped
-    network_mode: host
-    volumes:
-      - data:/data/
-
-volumes:
-  data:
-    driver: local
-    driver_opts:
-      type: 'none'
-      o: 'bind'
-      device: '/app/matter-server/data'
@@ -1,6 +1,6 @@
 services:
  mosquitto:
-    image: eclipse-mosquitto
+    image: eclipse-mosquitto:2.0.22
    container_name: mosquitto
    restart: unless-stopped
    ports:
@@ -1,6 +1,6 @@
 services:
  n8n:
-    image: docker.n8n.io/n8nio/n8n:2.21.2
+    image: docker.n8n.io/n8nio/n8n:2.26.4
    environment:
      - TZ=Europe/Paris
      - N8N_SECURE_COOKIE=false
@@ -2,7 +2,7 @@ services:
  zigbee2mqtt:
    container_name: zigbee2mqtt
    restart: unless-stopped
-    image: koenkk/zigbee2mqtt:2.9.2
+    image: koenkk/zigbee2mqtt:2.12.1
    networks:
      - default
      - proxy
@@ -1,6 +1,6 @@
 services:
  roundcube:
-    image: roundcube/roundcubemail:1.6.15-apache
+    image: roundcube/roundcubemail:1.7.2-apache
    container_name: roundcube
    networks:
      - default
@@ -1,40 +0,0 @@
-services:
-  stalwart:
-    image: stalwartlabs/stalwart:v0.16.5
-    container_name: stalwart
-    networks:
-      - default
-      - proxy
-    volumes:
-      - stalwart_data:/opt/stalwart
-    ports:
-      - target: 25
-        published: 25
-        mode: host
-      - target: 465
-        published: 465
-        mode: host
-      - target: 993
-        published: 993
-        mode: host
-      - target: 587
-        published: 587
-        mode: host
-      - "8080"
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.stalwart.rule=Host(`mail.vhaudiquet.fr`)"
-      - "traefik.http.services.stalwart.loadbalancer.server.port=8080"
-
-volumes:
-  stalwart_data:
-    driver: local
-    driver_opts:
-      type: 'none'
-      o: 'bind'
-      device: '/app/stalwart/data'
-
-networks:
-  proxy:
-    name: proxy
-    external: true
@@ -8,6 +8,8 @@ entryPoints:
      trustedIPs:
        - "127.0.0.1/32"
        - "10.1.2.11/32" # nginxproxymanager
+        - "10.1.2.152/32" # caddy
+        - "10.0.0.0/8" # caddy pods

 providers:
  docker:
@@ -0,0 +1,71 @@
+// Grafana Alloy config for the docker host (replaces Promtail, EOL since
+// 2026-03-02). Tails Docker container logs via docker_sd discovery, attaches
+// container_name/compose_service/stream labels, and pushes them to the
+// in-cluster Loki at loki-internal.lan (LAN-only Traefik Ingress on port 80).
+// River config produced by `alloy convert -f promtail` from an equivalent
+// Promtail YAML (so component names and argument shapes are guaranteed
+// correct for Alloy v1.18).
+
+discovery.docker "docker" {
+  host             = "unix:///var/run/docker.sock"
+  refresh_interval = "5s"
+}
+
+loki.process "docker" {
+  forward_to = [loki.write.default.receiver]
+
+  // Parse docker json-file log lines
+  // ({"log":"...","stream":"stdout","time":"..."}).
+  stage.json {
+    expressions = {
+      log    = "log",
+      stream = "stream",
+    }
+  }
+  stage.labels {
+    values = {
+      stream = null,
+    }
+  }
+}
+
+discovery.relabel "docker" {
+  targets = []
+
+  // Strip leading / from container name.
+  rule {
+    source_labels = ["__meta_docker_container_name"]
+    regex         = "/(.*)"
+    target_label  = "container_name"
+  }
+  // Compose service name (if label is set).
+  rule {
+    source_labels = ["__meta_docker_container_label_com_docker_compose_service"]
+    target_label  = "compose_service"
+  }
+  // Log stream (stdout/stderr).
+  rule {
+    source_labels = ["__meta_docker_container_log_stream"]
+    target_label  = "stream"
+  }
+  // Mark the source so dashboards/alerts can distinguish the docker host.
+  rule {
+    target_label = "source"
+    replacement  = "docker-host"
+  }
+}
+
+loki.source.docker "docker" {
+  host             = "unix:///var/run/docker.sock"
+  targets          = discovery.docker.docker.targets
+  forward_to       = [loki.process.docker.receiver]
+  relabel_rules    = discovery.relabel.docker.rules
+  refresh_interval = "5s"
+}
+
+loki.write "default" {
+  endpoint {
+    url = "http://loki-internal.lan/loki/api/v1/push"
+  }
+  external_labels = {}
+}
@@ -0,0 +1,81 @@
+# Docker-host collectors for the central observability stack on Kubernetes.
+# Managed by swarm-cd (see .swarmcd/stacks.yaml).
+#
+# node-exporter + cAdvisor run locally (scraped by vmagent below).
+# vmagent remote_writes metrics to vm-internal.lan (LAN-only Traefik Ingress) ->
+#   vmsingle-vm-victoria-metrics-k8s-stack.observability.svc.cluster.local:8428
+# alloy tails /var/lib/docker/containers + /var/log and pushes logs to
+#   loki-internal.lan -> loki.observability.svc.cluster.local:3100
+
+services:
+  node-exporter:
+    image: prom/node-exporter:v1.12.1
+    container_name: obs-node-exporter
+    network_mode: host
+    pid: host
+    command:
+      - "--path.rootfs=/host"
+    volumes:
+      - /:/host:ro,rslave
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=false"
+
+  cadvisor:
+    image: gcr.io/cadvisor/cadvisor:v0.55.1
+    container_name: obs-cadvisor
+    ports:
+      - "8080"
+    volumes:
+      - /:/rootfs:ro
+      - /var/run:/var/run:ro
+      - /sys:/sys:ro
+      - /dev/disk/:/dev/disk:ro
+      - /var/lib/docker/:/var/lib/docker:ro
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=false"
+
+  vmagent:
+    image: victoriametrics/vmagent:v1.149.0
+    container_name: obs-vmagent
+    # vmagent listens on 8429 (its own metrics), scrapes node-exporter:9100
+    # and cadvisor:8080, remote_writes to vm-internal.lan
+    command:
+      - "-promscrape.config=/etc/vmagent/vmagent.yml"
+      - "-remoteWrite.url=http://vm-internal.lan/api/v1/write"
+    volumes:
+      - type: bind
+        source: /root/homeprod/docker/infrastructure/observability/vmagent.yml
+        target: /etc/vmagent/vmagent.yml
+        read_only: true
+    depends_on:
+      - node-exporter
+      - cadvisor
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=false"
+
+  alloy:
+    image: grafana/alloy:v1.18.0
+    container_name: obs-alloy
+    command:
+      - "run"
+      - "/etc/alloy/config.river"
+      - "--server.http.listen-addr=0.0.0.0:12345"
+    volumes:
+      - type: bind
+        source: /root/homeprod/docker/infrastructure/observability/alloy.river
+        target: /etc/alloy/config.river
+        read_only: true
+      - /var/lib/docker/containers:/var/lib/docker/containers:ro
+      - /var/log:/var/log:ro
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=false"
+
+networks:
+  default:
+    name: proxy
+    external: true
@@ -0,0 +1,22 @@
+# vmagent scrape config for the docker host.
+# Scrapes the two local collectors, forwards everything to the central
+# VictoriaMetrics via the LAN-only Caddy route vm-internal.lan (Caddy proxies
+# it to vmsingle-vm-victoria-metrics-k8s-stack.observability.svc.cluster.local:8428).
+
+scrape_configs:
+  - job_name: docker-host-node
+    static_configs:
+      - targets:
+          - localhost:9100
+        labels:
+          # Distinguishes the docker host from K8s nodes in dashboards/alerts.
+          instance_source: docker-host
+          host: docker-r740
+
+  - job_name: docker-host-cadvisor
+    static_configs:
+      - targets:
+          - localhost:8080
+        labels:
+          instance_source: docker-host
+          host: docker-r740
@@ -1,11 +0,0 @@
-services:
-  sshportal:
-    image: moul/sshportal
-    container_name: sshportal
-    ports:
-      - "2222:2222"
-    volumes:
-      - "data:/root/"
-
-volumes:
-  data:
@@ -1,7 +1,7 @@
 services:
  fireshare:
    container_name: fireshare
-    image: shaneisrael/fireshare:1.6.10-lite
+    image: shaneisrael/fireshare:1.7.4-lite
    ports:
      - "80"
    volumes:
@@ -1,7 +1,7 @@
 services:
  grampsweb:
    container_name: grampsweb
-    image: ghcr.io/gramps-project/grampsweb:26.5.1
+    image: ghcr.io/gramps-project/grampsweb:26.7.1
    restart: always
    networks:
      - default
@@ -31,7 +31,7 @@ services:

  grampsweb_celery:
    container_name: grampsweb_celery
-    image: ghcr.io/gramps-project/grampsweb:26.5.1
+    image: ghcr.io/gramps-project/grampsweb:26.7.1
    restart: always
    environment:
      - GRAMPSWEB_TREE="Gramps Web"  # will create a new tree if not exists
@@ -52,7 +52,7 @@ services:
    command: celery -A gramps_webapi.celery worker --loglevel=INFO --concurrency=2

  grampsweb_redis:
-    image: docker.io/library/redis:8.6.3-alpine
+    image: docker.io/library/redis:8.10.0-alpine
    container_name: grampsweb_redis
    restart: always

@@ -1,7 +1,7 @@
 services:
  jackett:
    container_name: jackett
-    image: ghcr.io/hotio/jackett:release-v0.24.1846
+    image: ghcr.io/hotio/jackett:release-v0.24.2335
    ports:
      - "9117"
    networks:
@@ -1,6 +1,6 @@
 services:
  jellyfin:
-    image: jellyfin/jellyfin:2026051106
+    image: jellyfin/jellyfin:2026080308
    container_name: jellyfin
    networks:
      - default
@@ -1,7 +1,7 @@
 services:
  radarr:
    container_name: radarr
-    image: ghcr.io/hotio/radarr:release-6.1.1.10360
+    image: ghcr.io/hotio/radarr:release-6.3.0.10514
    ports:
      - "7878"
    networks:
@@ -1,7 +1,7 @@
 services:
  sonarr:
    container_name: sonarr
-    image: ghcr.io/hotio/sonarr:release-4.0.17.2952
+    image: ghcr.io/hotio/sonarr:release-4.0.19.2979
    ports:
      - "8989"
    networks:
@@ -1,7 +1,7 @@
 services:
  wizarr:
    container_name: wizarr
-    image: ghcr.io/wizarrrr/wizarr:v2026.4.0
+    image: ghcr.io/wizarrrr/wizarr:v2026.7.1
    networks:
      - default
      - proxy
@@ -1,6 +1,6 @@
 services:
  navidrome:
-    image: deluan/navidrome:0.61.2
+    image: deluan/navidrome:0.63.2
    user: 1000:1000 # should be owner of volumes
    ports:
      - "4533"
@@ -14,7 +14,7 @@ services:
      ND_SESSIONTIMEOUT: 24h
      ND_BASEURL: "http://navidrome.lan"
      ND_PORT: 4533
-      ND_REVERSEPROXYWHITELIST: "172.20.0.0/16,10.1.2.11/32"
+      ND_REVERSEPROXYWHITELIST: "172.20.0.0/16,10.1.2.11/32,10.1.2.152/32"
    volumes:
      - data:/data
      - "music:/music:ro"
@@ -31,7 +31,7 @@ services:
      - archivist-redis
    labels:
      - "traefik.enable=true"
-      - "traefik.http.routers.tubearchivist.rule=Host(`tubearchivist.local`)"
+      - "traefik.http.routers.tubearchivist.rule=Host(`tubearchivist.lan`)"
      - "traefik.http.routers.tubearchivist.middlewares=tubearchivist-headers"
      - "traefik.http.middlewares.tubearchivist-headers.headers.accesscontrolalloworiginlist=*"
      - "traefik.http.middlewares.tubearchivist-headers.headers.accesscontrolallowmethods=GET,OPTIONS,PUT"
@@ -1,16 +0,0 @@
-PAPERLESS_URL=ENC[AES256_GCM,data:5Vt6SqefNzOKGzUaRukM7wKu7Nw=,iv:/x12Sv55XY1znKr2UFQB1Scp+T1cZBs5XlqxTNtBQck=,tag:xahglGfuW2wCkDMgX1nZGA==,type:str]
-PAPERLESS_SECRET_KEY=ENC[AES256_GCM,data:CoWplCZsHbgFPkkBDnzaPnXcq9Fv4OpXuJHs0YTLDi+MmJjK4Lpd+Q==,iv:vX3uYJ0S6lSyHW3comqum5ncXUHFj7LCdNSbRRgY3/M=,tag:gwSwk1lVmoQdgqQ38sFN0A==,type:str]
-PAPERLESS_TIME_ZONE=ENC[AES256_GCM,data:sDtE4GwXr9CScxyq,iv:7oGDO/5Dvj8/E4qzzIhncbboTRfJbTfT/FwUhF4tCNg=,tag:mEcg/i2TaCls+FgCTl6AlA==,type:str]
-PAPERLESS_OCR_LANGUAGE=ENC[AES256_GCM,data:ihFV,iv:+xRvsrymSIB4z5K03bU6N+pugafhvHph3epj1HTDPag=,tag:RhBA2b1q3jIhE9bmcwtYxQ==,type:str]
-PAPERLESS_OCR_LANGUAGES=ENC[AES256_GCM,data:0pbc/9WMlw==,iv:HRnX25U1CasIvdU0h0G0SYvRjzzpmyPpDrcN6sAk+Ck=,tag:Ym08zaK+LqSDEafnUVvGnQ==,type:str]
-PAPERLESS_OCR_USER_ARGS=ENC[AES256_GCM,data:DdpIIK0k5wsJWhcVNtq6w1mK2nsBlXKs/bB3kCxUe9tj7tyff2yH,iv:htcBkWENiugF1T2N0JfJOGfn2F15Ti6icf6JnzmLNjQ=,tag:EACbCMn4aZ7zCWxd1voawA==,type:str]
-PAPERLESS_SOCIALACCOUNT_PROVIDERS=ENC[AES256_GCM,data:vLWinFKXotVzhHqmwpJ6R93Ep44JL7D1P91DbbLcGawfl8Hx+cTtYX2zuBAzeqrlDd+pHVX9I/F/eq3sAFUJrHhwSiscPaw4lc0KWVj3yAbR6guu3ZGKLMZiltGi8adOt+ELvL4aJYNfsdcECaj71JXaqF08+DkLuG6k3BOp/5j+BRFTuAfyS8SXgSo9UTpfNqJWLA2YyNiEy1ht9sbNJYT5FbN9++ZFlJPVmJDyo/8kU2CdkowmLuFhij2hcCt/wvhQ5kjYIzr+LCuPGtF68CVChVguXxTj7w5Mqo9bkdIIUtjzubhbP7LiERE5vQdLve75ZE4mQFt/5H01qwqZkXw7DFn4sJXKQCpCyA+IanA1NO2ypd1plYiR8F+15LNtbfPuZo5hzpYdf3y1xgPrSHUMV0AvAbvJYXyDg2UprpGzxSwLmskZc+4Dqm8ZfTp8IdC9RvETets6fA6t1ucnYFbEB4t0RfF1wzI93m5acE0XvDe7PvnW9X10XDwAhKV6EY9V7OktiL1/swO7MxI5qV6NtxXMMg46V6l/63k5GDmM0FS4Sn9BeIQ=,iv:JwSeogftyoa4k0kQAf63nnoqbIiHWH0Iwa83Nhqlx9Y=,tag:9KrbSxSmN1CzqnVxcsvPgw==,type:str]
-POSTGRES_USER=ENC[AES256_GCM,data:2IkvrQgFYj0v,iv:YxKokHIOsRhgRx2XZsCYsjtJwW0yOx+S5HKKiFQBKlY=,tag:HI4aSRYp7GotOXeF8VBHQw==,type:str]
-POSTGRES_PASSWORD=ENC[AES256_GCM,data:8IiqLOi+Xoln,iv:9zLPLvSe+7FjjunVQvcn5YiejZj0wN1mQu++B2JPy9o=,tag:HRIHXlmYTPCSaZ5BzPA/aQ==,type:str]
-sops_lastmodified=2025-10-08T19:39:41Z
-sops_mac=ENC[AES256_GCM,data:bjQBttibD3m6mjiDtQ/RqfSc0rt3eV/ip+UUzwF45k/+akQCM+kAvSVFiICpRYLQd90hGDSJJytGze0YQBIYS58u/PXovqT+BmbJ5S9jEVwDUnAnFwoVmuGI6dkorCGgLZFxbj/Vwde5v2R3K7nMTyPC/5EJPd4R9gZLgT8/+Bw=,iv:tyyjQXpBEDb+KOEFRNPxUIcEcxYAM+qw2pCyvOltuFE=,tag:xPfaZTAi1Sd0RW5PN0iKog==,type:str]
-sops_pgp__list_0__map_created_at=2025-10-08T19:39:41Z
-sops_pgp__list_0__map_enc=-----BEGIN PGP MESSAGE-----\n\nhQIMA7uy4qQr71wiAQ//WBbj9C5n7tOL8HBWRiiwRHS8nE3XWg7rAROnvEaD5QuE\nEubGw+PnsX3nSiv07Th23dN24IqpgLqz9grq1s6WDgRgQAFqu2f2FTYmIvcU/mko\n9I69i1E8iSYIvfRmReOn3L2GlhQrADYbCYC+mMEAXJtTuJ44KP0JtGTFPP0+m4vb\nspuuebFeES8cVsk2RPuRUQJC6uSk0E78ZaxMWgZm6P/6bnRwDbn4OE3NrQbkvhvn\nKupR01MQ7HAZh5jVi73aVnY0wfxe4fDToef1bjiiZUJEwJ57oKhOmj5EYlTurX0m\nzraNkpDIWQNJnVlMgUEOclmrnL0uz3wkaqu8BoUkyaWAJS2f545amJNUBO23Mogp\ng9VgFeOyivM0xx5JZAN2LRkK5CrpKNpjXYtFzGkxKZxAAs4iyrUGDecJtfZJM48M\ntvgzbL4jqJu6rrOH27e3F74HyEmX+f1sIJMSnvanEiyYxIpdbvMc8+ULtGzpsdUd\n4hQ/yYKqEkecyKwjPEN4OlAI2LdokTxeYOszjJ7iBO1jE2D7e3hgzpjsGZmj1i+J\nzTUGUSAEgfd2w+/xfYzWttMysthrGa0MMwEeKYttuoZjIJ04IDB6JBQWNWxbfGpp\nXlNd5G2+xrGl2oaYzc4fAJRZoQZRWgX1Dy78cvRm8OIUGJucz0cZeBPiI3/Ny5/S\nXgFC/aC1TJBNvFC/60oOrerjzf5LVrx6O3zevs7LCrVVq0iL/xSSU+DnTxdczKPt\nKh9x1LMKUQK5cnMOdoWt78uUNmLkKiSkht43ozLcqvb3cxgRyoSlMP2lvk9YWx4=\n=gnXz\n-----END PGP MESSAGE-----
-sops_pgp__list_0__map_fp=DC6910268E657FF70BA7EC289974494E76938DDC
-sops_unencrypted_suffix=_unencrypted
-sops_version=3.10.2
@@ -1,86 +0,0 @@
-services:
-  pplessbroker:
-    image: docker.io/library/redis:8
-    restart: unless-stopped
-    volumes:
-      - redisdata:/data
-
-  pplessdb:
-    image: docker.io/library/postgres:16
-    restart: unless-stopped
-    volumes:
-      - pgdata:/var/lib/postgresql/data
-    env_file:
-      - .env
-    environment:
-      POSTGRES_DB: paperless
-
-  paperless-webserver:
-    image: ghcr.io/paperless-ngx/paperless-ngx:2.20.15
-    restart: unless-stopped
-    networks:
-      - default
-      - proxy
-    depends_on:
-      - pplessdb
-      - pplessbroker
-    ports:
-      - "8000"
-    volumes:
-      - data:/usr/src/paperless/data
-      - media:/usr/src/paperless/media
-      - export:/usr/src/paperless/export
-      - consume:/usr/src/paperless/consume
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.paperless-webserver.rule=Host(`paperless.lan`)"
-    env_file: .env
-    environment:
-      PAPERLESS_REDIS: redis://pplessbroker:6379
-      PAPERLESS_DBHOST: pplessdb
-      PAPERLESS_APPS: allauth.socialaccount.providers.openid_connect
-      PAPERLESS_ACCOUNT_DEFAULT_HTTP_PROTOCOL: http
-
-volumes:
-  data:
-    driver: local
-    driver_opts:
-      type: 'none'
-      o: 'bind'
-      device: '/app/paperless/data'
-  media:
-    driver: local
-    driver_opts:
-      type: 'none'
-      o: 'bind'
-      device: '/app/paperless/media'
-  pgdata:
-    driver: local
-    driver_opts:
-      type: 'none'
-      o: 'bind'
-      device: '/app/paperless/db'
-  redisdata:
-    driver: local
-    driver_opts:
-      type: 'none'
-      o: 'bind'
-      device: '/app/paperless/redis'
-
-  export:
-    driver: local
-    driver_opts:
-      type: 'none'
-      o: 'bind'
-      device: '/app/paperless/export'
-  consume:
-    driver: local
-    driver_opts:
-      type: 'none'
-      o: 'bind'
-      device: '/app/paperless/consume'
-
-networks:
-  proxy:
-    external: true
-    name: proxy
@@ -1,6 +1,6 @@
 services:
  radicale:
-    image: tomsquest/docker-radicale:3.7.2.0
+    image: tomsquest/docker-radicale:3.7.6.0
    container_name: radicale
    ports:
      - 5232
@@ -9,7 +9,7 @@ services:

  web_recipes:
    restart: always
-    image: vabene1111/recipes:2.6.9
+    image: vabene1111/recipes:2.6.13
    networks:
      - default
      - proxy
@@ -1,18 +0,0 @@
-ME_CONFIG_MONGODB_ADMINUSERNAME=ENC[AES256_GCM,data:AHXIMA==,iv:trofFagJGNq5OyWDaN57vPpKwwG3SouiV5xLl5sJIBA=,tag:c1NUlmBouEb0Milri85QNw==,type:str]
-ME_CONFIG_MONGODB_ADMINPASSWORD=ENC[AES256_GCM,data:8X6+SphUNus=,iv:zwofVw03pToXHR6weckniT/fymFYeHZw6lVmrGUsnLc=,tag:lEWtnnqpwamNsCnkStsRfQ==,type:str]
-ME_CONFIG_MONGODB_URL=ENC[AES256_GCM,data:3xLFWhRYU/EfhRw+rOs9pOb+nzsbV9IvQydB4VGZGw/WLkQd,iv:T9T6ewB+05qzFDL7z2WESs6fIc9lTFdjVxy/71YzhXo=,tag:S3YsOokO4jzhJVWep/QTsQ==,type:str]
-ME_CONFIG_BASICAUTH=ENC[AES256_GCM,data:FnUichsnpQ==,iv:Ayw1Vqg5rj6P79vtERX2hRCttnol/4aNUG5Y0OhFVTo=,tag:JkTxro0kyYJLr9gdkY8A1Q==,type:str]
-MONGO_USER=ENC[AES256_GCM,data:2KFDcg==,iv:wdDxrQd07+hC5GEq1DS0DLVASiL9L4ds1V3TG1NA9EQ=,tag:gieiOLmOfLtUQjfjwZg6qQ==,type:str]
-MONGO_PASS=ENC[AES256_GCM,data:W80YLzp8G50=,iv:eFts3fhrB9PGEfC69d8btt4ko3gcOGrFZUy95hx2rCE=,tag:+1JFEiclNnjei8+2I42j6w==,type:str]
-MONGO_HOST=ENC[AES256_GCM,data:0RknYUM=,iv:8QyL4KHrSr9pv1kX+FD09N2ltVSZkEKqtFCS30ik1v0=,tag:bTXBMHqp5JU9VTD3soXEyQ==,type:str]
-MONGO_INITDB_ROOT_USERNAME=ENC[AES256_GCM,data:G6wekw==,iv:AH5qqxXOeEBVI2mXXPPrC1X8X/Vq5MHZBWdfNRNeK1c=,tag:nMkWql/aVHi2FGnJ5NGFBQ==,type:str]
-MONGO_INITDB_ROOT_PASSWORD=ENC[AES256_GCM,data:jzVSUjGSjOY=,iv:S/Ar0oYN2vSE7pK+/tfp9RyCThtDbk0gOUYDyzNYjVE=,tag:whWyBFHuXBcmF+WixjafOw==,type:str]
-RIOT_API_KEY=ENC[AES256_GCM,data:EzqWk1Y73htAXaUJhzByV6Aru/hxUNjHGK90ac1NGaz92Cwk9YEdmrb9,iv:KorIppEflVX2aDC8K3ndRzK1q6scNjdQfl38p/8fLGM=,tag:Ei2zLoiGOlOX8ocrO2wNMw==,type:str]
-CDRAGON_CACHE_DIR=ENC[AES256_GCM,data:uMogP1/K/pc=,iv:/0A8fs9HEuksSiKV1SZDoslHHGlJe+vFw0BQ5zQ9BBA=,tag:grwWPwMQarpmSAUIgKDZ5Q==,type:str]
-sops_lastmodified=2026-04-30T18:20:37Z
-sops_mac=ENC[AES256_GCM,data:7teYIGLLHBH8TJ/gr3lcbtfo4CVl0Gj2RWPSLgx4AyTvM+pZaSvUDaVUhWuprSCVqZcDWI2tNHUOHE4aYlJzyt9JfQrooKLPkKUq3WX3bucg3Rv5GpiP1tNHiPDE7UZCBp5bkHhYvwn+dPjhObEUdMUuwMBDA9JSpPlr3YQCg/E=,iv:6knBO6QNe33E2bJw5WZMzcDzeTW9mwgjQtftv0FZq8s=,tag:xuIKZl7szrUyX8/D9xxAmA==,type:str]
-sops_pgp__list_0__map_created_at=2026-04-30T18:20:33Z
-sops_pgp__list_0__map_enc=-----BEGIN PGP MESSAGE-----\n\nhQIMA7uy4qQr71wiARAAufkTVdCq2ARwMFuec9+0N1BzTo7WgGQhzKIJehe+uQ5I\nuPS5bafo5vrvxlCuxVmhup45CS3gm3X46hgHh/d3htaYzDnbyh/awbVGIhU9sa9T\n74i4jZAabzWjWAU8lAvxS6dJ6hf5U3MHOc1zYoCUfCJjgw+QRzR5PxZKFhpVklQU\nQJycdfRAl5oAqF7N6B7oCNTs7w1hbx2CJXBVGM8YoJySkThpXEY3dECxZ5nTSPmp\nXo3hmidO09uYsjWzcqynJHnh9RkMd1VAe6ULzhVIOv5KLXQLQV/paNAPdsxA5UmY\nE1imIFrqS25BVU9xbsGaPj6AHX6+Ux8bpO8TOVbpULe56Aq2c5GOjIZXb3p20K7N\nEk5rJ/K+8FxvytK3jDkhJI49wiDs9UDim02DSZmsWirIy/c02Ojy2d/Cxors1Lw/\nBCc4S6/ESH9u/LGlWs8WDqcDQqhHgeCvGOLAvOXs9eOCXNW2ROtNdfW808APbu1A\nzgYJwPtdfBhUv4KhZcEVMldWgX1OiYhcWMWYgJUXcfOwaRbzntZ/MczPNJ/a+57T\nPvH9GuTiwCXn0fOgcETTp9RPvXflL+4LPgh9drCOo4zwMvlqZs2+0Os2m8GDdDcL\nD45VMTsnNUXWuO7YUdtYX47bON2W6Z7NwzvkSr5odogzq1xw38SgRN7g3Jbl6+fS\nXAH/Rw8jWjpYztZ5HgDXisTxLEXqn5UNYKZBjzsLV5tE9GQp8ppck21igBiDCqoT\nsziZwFyRy/nKq076lZlRgSFr0pm4168u7Vn5x1TLQBHl+i0eKficgUQpwCFx\n=XUsx\n-----END PGP MESSAGE-----
-sops_pgp__list_0__map_fp=DC6910268E657FF70BA7EC289974494E76938DDC
-sops_unencrypted_suffix=_unencrypted
-sops_version=3.10.2
@@ -1,50 +0,0 @@
-services:
-  mongo:
-    hostname: mongo
-    image: mongo:8.2.3
-    restart: always
-    user: root:root
-    volumes:
-      - bpmongo_data:/data/db:Z
-      - bpmongo_config:/data/configdb:Z
-    env_file: .env
-
-  match_collector:
-    image: git.vhaudiquet.fr/vhaudiquet/lolstats-match_collector:0224b7812c8631bde3e9513adace64341152fc20
-    build: ./match_collector
-    volumes:
-      - bpcdragon_cache:/cdragon
-    restart: "no"
-    deploy:
-      restart_policy:
-        condition: any
-        delay: '0'
-        window: 20s
-    env_file: .env
-
-  frontend:
-    image: git.vhaudiquet.fr/vhaudiquet/lolstats-frontend:0224b7812c8631bde3e9513adace64341152fc20
-    build: ./frontend
-    restart: always
-    volumes:
-      - bpcdragon_cache:/cdragon
-    networks:
-      - default
-      - proxy
-    ports:
-      - "3000"
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.frontend.rule=Host(`buildpath.win`)"
-      - "traefik.http.services.frontend.loadbalancer.server.port=3000"
-    env_file: .env
-
-volumes:
-  bpmongo_data:
-  bpmongo_config:
-  bpcdragon_cache:
-
-networks:
-  proxy:
-    external: true
-    name: proxy
@@ -1,20 +0,0 @@
-services:
-  semeryfr:
-    container_name: semeryfr
-    image: git.vhaudiquet.fr/semerys/semery.fr:latest
-    networks:
-      - default
-      - proxy
-    ports:
-      - 80
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.semeryfr.rule=Host(`semery.fr`)"
-    environment:
-      - NGINX_HOST=semery.fr
-      - NGINX_PORT=80
-
-networks:
-  proxy:
-    external: true
-    name: proxy
@@ -1,9 +0,0 @@
-COUCHDB_USER=ENC[AES256_GCM,data:wMQJhlZFW30=,iv:OG3S+hZppJdP/PjDINGEEQZD8Qf4520mfzsyw+/QAx4=,tag:i1og4xc0N4Hf4UE0GKPtbg==,type:str]
-COUCHDB_PASSWORD=ENC[AES256_GCM,data:eud7WTnlZEzzBGciiwM=,iv:g8RCLIcO1ZxUn/SROHV/stl+whdzICMSX0jVLKXbTns=,tag:6gReHLd+97dqUoAlYL780Q==,type:str]
-sops_lastmodified=2025-11-21T23:00:14Z
-sops_mac=ENC[AES256_GCM,data:O+jtG9ojK8Md6NSaqfyykVdVG84Kafz3zoKb5hbj2alzvJgaLuzVu3ihM75ZU3/meu/nPl9wCc+J4RKepE7VTp5Il3HK09MVHYRHQKVlbyiZ5cTbU74JJuSL3PF1GiU7p/U5Ht9+Z9c8sDrqSN2IPSIfDr8zCdTwKZF71nYOqew=,iv:n33XCpiwVOGnrJyH3Q967u5uMknRfAwx9esJuOLl+9g=,tag:aKMwsOKXPRUaa+9/ZmnpfQ==,type:str]
-sops_pgp__list_0__map_created_at=2025-11-21T23:00:14Z
-sops_pgp__list_0__map_enc=-----BEGIN PGP MESSAGE-----\n\nhQIMA7uy4qQr71wiAQ/+Mt0/uXHnndDK7FLEM8rhWmX0NpJWtgBY3BBXMX7I2Ilg\n6hNZJxISOqcoJCPqb8gZ9pUulcGC5F8owoo/wUILyI/mK3kAzGCP+lfp6Dk03k+P\nwB6BcQTC8NJsApoygdm50h/jtnlK2KUCICFKXUxf527KLWdo8g0wnMIOBe8mBvVC\n8bI/1BOcJZeB4IhmFVrgED+Ct1dTTiuyLscJirCqHD0VTD4eavd6DVpN89m/mtY/\nhTRVT3omuV8JITLeWPdVVWyQznrq3/x8OGAs8L2c24gad5AsTLCr2WS20CvXP1uL\nUoLH9EH0IDvo36DbiMO+p3LdyEvlRe1PW+0dvOpO64CLNoH4szYDJ/dG+UUa3xWo\nRpOIT1F0puXRz3UHZv/IkAFah4Zzi8TxdZDD7Riz5pzMWqzWwdQHQUS1ZWibm1ve\nfC7strrMNybh+QUfMTXhTaW4OoRkY+rGo3d2x3eUjZpaqlKOBWaScZ0c1I7DY/CP\no4QoCoga1RNePXp/WWvWAbQf0w+hAxrsb6U3/ECKtcd4gYGE3shvH0MS6T4oAaIx\nB9ldqRbKIcEUYU7MWq3Wqt8c1k/MtJZh1q3YuZwy8C3U8cHiS5iqDWzAnjIkUwbC\nJpYVaIOvI0qOjE7v6Fc06ZnTBoh/DoTX4XfdIY39GMo3ZageBV0r7Fi0HUzbFxvS\nXAHnsiZZXFB/TJAVEZKDO0Yic3DhlYLL/glOJF0kNgUOoYGvTFaSuNhwhv4tqOrw\nSv7FLH+79LSrM/bPug3Zq9Ec7p/TSnsJ4amu6p7VSmSHRBGV0uZDxt5wkYnG\n=yY4C\n-----END PGP MESSAGE-----
-sops_pgp__list_0__map_fp=DC6910268E657FF70BA7EC289974494E76938DDC
-sops_unencrypted_suffix=_unencrypted
-sops_version=3.10.2
@@ -1,44 +0,0 @@
-services:
-  couchdb:
-    image: couchdb:3.5.1
-    container_name: couchdb
-    env_file: .env
-    volumes:
-      - couchdb-data:/opt/couchdb/data
-      - couchdb-etc:/opt/couchdb/etc/local.d
-    networks:
-      - default
-      - proxy
-    ports:
-      - 5984
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.couchdb.rule=Host(`obsidian-livesync.lan`)"
-      - "traefik.http.services.couchdb.loadbalancer.server.port=5984"
-      - "traefik.http.routers.obsidian-livesync.middlewares=obsidiancors"
-      - "traefik.http.middlewares.obsidiancors.headers.accesscontrolallowmethods=GET,PUT,POST,HEAD,DELETE"
-      - "traefik.http.middlewares.obsidiancors.headers.accesscontrolallowheaders=accept,authorization,content-type,origin,referer"
-      - "traefik.http.middlewares.obsidiancors.headers.accesscontrolalloworiginlist=app://obsidian.md,capacitor://localhost,http://localhost"
-      - "traefik.http.middlewares.obsidiancors.headers.accesscontrolmaxage=3600"
-      - "traefik.http.middlewares.obsidiancors.headers.addvaryheader=true"
-      - "traefik.http.middlewares.obsidiancors.headers.accessControlAllowCredentials=true"
-    restart: unless-stopped
-
-networks:
-  proxy:
-    external: true
-    name: proxy
-
-volumes:
-  couchdb-data:
-    driver: local
-    driver_opts:
-      type: 'none'
-      o: 'bind'
-      device: '/app/obsidian-livesync/data'
-  couchdb-etc:
-    driver: local
-    driver_opts:
-      type: 'none'
-      o: 'bind'
-      device: '/app/obsidian-livesync/etc'
@@ -1,58 +0,0 @@
-#!/bin/bash
-
-# Create .github directory if needed
-if [ ! -d .github ]; then
-    mkdir -p .github
-fi
-
-tmpfile=$(mktemp)
-
-# Make sure to cleanup our temp file on any kind of exit
-trap 'rm -f "$tmpfile"' EXIT
-
-# dependabot.yml docker header
-cat > "$tmpfile" <<'YAML'
-version: 2
-updates:
-  - package-ecosystem: "docker-compose"
-    open-pull-requests-limit: 15
-    schedule:
-      interval: weekly
-    directories:
-YAML
-
-# Find and sort all docker-compose.yml directories
-find docker -name 'docker-compose.yml' -print0 \
-  | xargs -0 -n1 dirname \
-  | sed 's|^\./||' \
-  | sort \
-  | while read -r dir; do
-      echo "      - \"/$dir\"" >> "$tmpfile"
-    done
-  
-# dependabot.yml helm header
-cat >> "$tmpfile" <<'YAML'
-  - package-ecosystem: "helm"
-    open-pull-requests-limit: 15
-    schedule:
-      interval: weekly
-    directories:
-YAML
-
-# Find and sort all release.yaml directories
-find kubernetes -name 'release.yaml' -print0 \
-  | xargs -0 -n1 dirname \
-  | sed 's|^\./||' \
-  | sort \
-  | while read -r dir; do
-      echo "      - \"/$dir\"" >> "$tmpfile"
-    done
-
-# Overwrite file on change
-if ! [ -f .github/dependabot.yml ] || ! cmp -s "$tmpfile" .github/dependabot.yml; then
-  mv "$tmpfile" .github/dependabot.yml
-  echo "Updated .github/dependabot.yml!"
-  git add ".github/dependabot.yml"
-else
-  echo "No changes to .github/dependabot.yml."
-fi
@@ -0,0 +1,3 @@
+clusterconfig/
+manifests/cilium.yaml
+talconfig.json
@@ -0,0 +1,73 @@
+ipam:
+    mode: kubernetes
+kubeProxyReplacement: true
+securityContext:
+    capabilities:
+        ciliumAgent:
+            - CHOWN
+            - KILL
+            - NET_ADMIN
+            - NET_RAW
+            - IPC_LOCK
+            - SYS_ADMIN
+            - SYS_RESOURCE
+            - DAC_OVERRIDE
+            - FOWNER
+            - SETGID
+            - SETUID
+        cleanCiliumState:
+            - NET_ADMIN
+            - SYS_ADMIN
+            - SYS_RESOURCE
+cgroup:
+    autoMount:
+        enabled: false
+    hostRoot: /sys/fs/cgroup
+k8sServiceHost: localhost
+k8sServicePort: 7445
+etcd:
+    clusterDomain: cluster.local
+l2announcements:
+    enabled: true
+externalIPs:
+    enabled: true
+# Single-node cluster: the operator defaults to 2 replicas, but both
+# bind the same host ports, so the second replica can never schedule ("node(s)
+# didn't have free ports for the requested pod ports") and sits Pending forever.
+operator:
+    replicas: 1
+ingressController:
+    enabled: false
+    loadbalancerMode: shared
+    default: false
+    service:
+        externalTrafficPolicy: Cluster
+envoy:
+    xffNumTrustedHopsL7PolicyIngress: 1
+sops:
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:2aioHoSXw5UOFKj5z5PJmtPC4rGl9DYY0gWgevHIxXbKdjLrTfyyoRfBPCl3+NPWAZllieMr4VKsGy53YUqq5xFgRg0BaqG+gqMFX/YjHPqhF0/WT0YI3GdTWhl/YY0wma+CEN0kE5SsljpKh7vBgY8l2WlFhpMdlbAKEeyONRs=,iv:EY7Vdlj/VpqY34KmrVUSQutLiD8DEAB0OqIXnN40ERA=,tag:XOZNdUoeWAV4cD111ciBzw==,type:str]
+    pgp:
+        - created_at: "2026-08-26T19:28:02Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiARAAp9OoebtSeHrGp/3bQz93JMbp78C9xnHuumz7exhd9Ky6
+            zrJUm+bL8tNMWTL72Q+GUTCo7lEVltYciXZZVYSvD3Uee8stAeOdhCrY6jsH2IxZ
+            yCVZktlnsAbsPDwmEt+/HRoiqwy4hkbIx99J5W18cJD4eSw8MlJYjDVfSh2UWGIi
+            rd+7ameKbHR8PCduWu1T5SY0EFWaVr3WJDW//lD/FUT1KXJDrB0ExVtsuL0l8GgW
+            ue+noYGAn5l9PRgjgqTLSbHoQQDaMO9KalR+Gz6jmYpUdkJEuCT1amQiH+dE8i85
+            Rs0KXHWLnW59xY4pqdNzJzOysKEsM/oPes36JFvuIOIpB0KDSK/hcFKkYogk96Rw
+            VZ131NNOYMbKunORjmKfei7SWE975zzB/OFCWRDkAwGceqm+hdWaKhKV+rZlBSHR
+            ClbWTZt9+EEI3Er1f/J8qsfhvxJswWTDIOs7+I7YgbFgPAHMh/kcNU+xJJmWtDOq
+            Fq3uBi/oowR6mwTvUwswFFkuaDePcjHrvWaQLTzOw/wv5JU59nUTstSr+zMQzm4Y
+            ZTjKoz62hz5gntyjRFG58w7tyLR8D48CFPA6BFGLBkBpsykhyc42F4woCUqEg6YJ
+            5QBuCFsBXxjSeRHTLRyaWdI5BmppmLZ5axzdMVt0X+rXy/7LhGPY40bGuWBbsgPS
+            XgEL/HGgfFafvsfgJU5x71E4n+Ak7EPLCxin1uTW/CM0cJszT1/zdwIdQ+T5JDiY
+            JlZZTK9C49sF3OngtmRTtf1JesnOYdfhdOVCpDO9EgcUiF769X0JPhdFNemkOeY=
+            =8NLP
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
+    version: 3.10.2
@@ -1,4 +1,18 @@
-instance:
+apiVersion: fluxcd.controlplane.io/v1
+kind: FluxInstance
+metadata:
+  name: flux
+  namespace: flux-system
+spec:
+  distribution:
+    version: "2.x"
+    registry: ghcr.io/fluxcd
+  sync:
+    name: homeprod
+    kind: GitRepository
+    url: https://github.com/vhaudiquet/homeprod
+    path: kubernetes/
+    ref: refs/heads/main
  components:
    - source-controller
    - kustomize-controller
@@ -10,7 +24,7 @@ instance:
    type: kubernetes
    multitenant: false
    networkPolicy: true
-    domain: "kube-talos.lan"
+    domain: "cluster.local"
  kustomize:
    patches:
      - target:
@@ -0,0 +1,55 @@
+#!/bin/sh
+# Reconcile Talos cluster infrastructure
+# Environment needed:
+# - SOPS_KEY: sops private key
+set -euo pipefail
+
+if [ -z "${SOPS_KEY:-}" ]; then
+  echo "Error: SOPS_KEY environment variable is not set" >&2
+  exit 1
+fi
+
+# Render the Cilium chart for manifest deployment
+helm repo add cilium https://helm.cilium.io/
+helm repo update
+helm template cilium cilium/cilium \
+  --version 1.20.1 \
+  --namespace kube-system \
+  -f manifests/cilium/values.yaml \
+  > manifests/cilium.yaml
+
+# Escape shell variables that must be resolved at container runtime, not by talhelper.
+# talhelper expands ${VAR} statically; prefixing with $$ (i.e. $${VAR}) tells it to
+# preserve the literal ${VAR} in the output so bash can expand it inside the container.
+sed -i 's/\${BIN_PATH}/$${BIN_PATH}/g' manifests/cilium.yaml
+
+# Generate Talos machine config
+talhelper genconfig
+
+# Apply generated machine config to the nodes, without reboot.
+# If it fails, it is safer for reconcile to be done manually:
+# the reboot is needed and that might disrupt the node
+talhelper gencommand apply --extra-flags="-m no-reboot" | bash
+
+# Obtain kubeconfig and export it for kubectl
+talosctl --talosconfig ./clusterconfig/talosconfig kubeconfig -f ./clusterconfig/kubeconfig
+export KUBECONFIG=./clusterconfig/kubeconfig
+
+# Show nodes
+kubectl get nodes
+
+# Create Flux namespace if it does not already exists
+kubectl get ns "flux-system" || kubectl create ns "flux-system"
+
+# Create SOPS secret in the cluster
+kubectl create secret generic flux-sops \
+  --namespace "flux-system" \
+  --from-literal=sops.asc="$SOPS_KEY" \
+  --dry-run=client -o yaml | kubectl apply -f -
+
+# Install the Flux operator if not installed already
+kubectl get deployment -n flux-system flux-operator || helm install flux-operator oci://ghcr.io/controlplaneio-fluxcd/charts/flux-operator \
+  --namespace "flux-system" \
+  --wait
+
+kubectl apply -f manifests/flux-system/flux-instance.yaml
@@ -0,0 +1,46 @@
+---
+clusterName: kube
+talosVersion: v1.13.8
+kubernetesVersion: v1.36.0
+endpoint: https://10.2.2.138:6443
+domain: cluster.local
+allowSchedulingOnMasters: true
+clusterPodNets:
+  - 10.244.0.0/16
+clusterSvcNets:
+  - 10.96.0.0/12
+cniConfig:
+  name: none
+nodes:
+  - hostname: p330
+    ipAddress: 10.2.2.138
+    filenameTmpl: "{{.ClusterName}}-{{.Hostname}}.yaml"
+    extensionServices: []
+    controlPlane: true
+    machineSpec:
+      mode: metal
+      arch: amd64
+      secureboot: false
+      useUKI: false
+      bootMethod: iso
+    installDisk: /dev/nvme0n1
+    schematic:
+      customization:
+        systemExtensions:
+          officialExtensions:
+            - siderolabs/intel-ucode
+            - siderolabs/iscsi-tools
+    kernelModules:
+      - name: iscsi_tcp
+      - name: libiscsi
+      - name: scsi_transport_iscsi
+      - name: ext4
+      - name: ixgbe
+        parameters:
+          - allow_unsupported_sfp=1
+    networkInterfaces:
+      - interface: eno1
+        dhcp: true
+inlineManifests:
+  - name: cilium
+    contents: "@./manifests/cilium.yaml"
@@ -1,137 +0,0 @@
-/* 
-* Docker machine terraform file
-*/
-
-resource "proxmox_virtual_environment_download_file" "debian-latest-cloudimg" {
-  content_type = "iso"
-  datastore_id = "local"
-  file_name = "debian-12-generic-amd64.qcow2.img"
-  node_name = "pve"
-  url = "https://cloud.debian.org/images/cloud/bookworm/latest/debian-12-generic-amd64.qcow2"
-}
-
-resource "proxmox_virtual_environment_file" "docker-machine-cloud-config" {
-  content_type = "snippets"
-  datastore_id = "local"
-  node_name    = "pve"
-
-  source_raw {
-    data = <<-EOF
-    #cloud-config
-    package_update: true
-    packages:
-      - git
-      - ca-certificates
-      - wget
-      - curl
-      - gnupg2
-      - qemu-guest-agent
-      - nfs-common
-    runcmd:
-      - systemctl enable --now qemu-guest-agent
-      - install -m 0755 -d /etc/apt/keyrings
-      - curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
-      - chmod a+r /etc/apt/keyrings/docker.asc
-      - echo "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.asc] https://download.docker.com/linux/debian $(. /etc/os-release && echo "$VERSION_CODENAME") stable" | sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
-      - apt-get update
-      - apt-get -y install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin
-      - docker swarm init
-      - git clone https://github.com/vhaudiquet/homeprod /root/homeprod
-      - mkdir /app
-      - echo "truenas.lan:/mnt/fast_app_data/docker-homeprod      /app     nfs     defaults,_netdev    0 0" >>/etc/fstab
-      - mount -t nfs truenas.lan:/mnt/fast_app_data/docker-homeprod /app
-      - echo "${var.sops_private_key}" | gpg --import
-    EOF
-    file_name = "docker-machine-cloud-config.yaml"
-  }
-}
-
-resource "proxmox_virtual_environment_vm" "docker-machine" {
-  name = "docker-machine"
-  node_name = "pve"
-  on_boot = true
-
-  agent {
-    enabled = true
-  }
-
-  tags = ["debian", "debian-latest", "docker", "terraform"]
-
-  cpu {
-    type = "host"
-    cores = 4
-    sockets = 1
-    flags = []
-  }
-
-  memory {
-    dedicated = 16192
-  }
-
-  network_device {
-    bridge = "vmbr0"
-    model = "virtio"
-    vlan_id = 2
-  }
-
-  lifecycle {
-    ignore_changes = [
-      network_interface_names,
-      mac_addresses,
-      ipv4_addresses,
-      ipv6_addresses,
-      id,
-      disk,
-      initialization,
-      vga
-    ]
-  }
-
-  boot_order = ["scsi0"]
-  scsi_hardware = "virtio-scsi-single"
-
-  vga {
-    type = "serial0"
-  }
-
-  disk {
-    interface = "scsi0"
-    iothread = true
-    datastore_id = "local-lvm"
-    size = 128
-    discard = "ignore"
-    file_id = proxmox_virtual_environment_download_file.debian-latest-cloudimg.id
-  }
-
-  vm_id = 701
-
-  initialization {
-    datastore_id = "local-lvm"
-    interface = "ide2"
-    
-    ip_config {
-      ipv4 {
-        address = "10.1.2.175/24"
-        gateway = "10.1.2.1"
-      }
-    }
-
-    user_account {
-      keys = [trimspace(var.ssh_public_key)]
-      password = var.machine_root_password
-      username = "root"
-    }
-
-    vendor_data_file_id = proxmox_virtual_environment_file.docker-machine-cloud-config.id
-  }
-
-  operating_system {
-    type = "l26"
-  }
-
-  tpm_state {
-    version = "v2.0"
-  }
-
-  serial_device {}
-}
@@ -1,39 +0,0 @@
-terraform {
-  required_providers {
-    docker = {
-      source  = "kreuzwerker/docker"
-      version = "3.6.2"
-    }
-  }
-}
-
-# Docker configuration
-provider "docker" {
-  host = "ssh://root@docker-machine.lan"
-}
-
-resource "docker_image" "swarm-cd" {
-  name = "ghcr.io/m-adawi/swarm-cd:latest"
-}
-
-resource "docker_container" "swarm-cd" {
-  name  = "swarm-cd"
-  image = docker_image.swarm-cd.image_id
-  volumes {
-      host_path = "/var/run/docker.sock"
-      container_path = "/var/run/docker.sock"
-      read_only = true
-  }
-  volumes {
-    host_path = "/root/homeprod/.swarmcd/repos.yaml"
-    container_path = "/app/repos.yaml"
-    read_only = true
-  }
-  volumes {
-    host_path = "/root/homeprod/.swarmcd/stacks.yaml"
-    container_path = "/app/stacks.yaml"
-    read_only = true
-  }
-
-  depends_on = [ docker_image.swarm-cd ]
-}
@@ -1,381 +0,0 @@
-/* 
-* Kubernetes cluster terraform file
-*/
-
-resource "proxmox_virtual_environment_download_file" "talos-cloudimg" {
-  content_type = "iso"
-  datastore_id = "local"
-  file_name = "talos-v1.11.1-nocloud-amd64.iso"
-  node_name = "pve"
-  url = "https://factory.talos.dev/image/ce4c980550dd2ab1b17bbf2b08801c7eb59418eafe8f279833297925d67c7515/v1.11.1/nocloud-amd64.iso"
-}
-
-resource "proxmox_virtual_environment_vm" "kube" {
-  name = "kube-talos"
-  description = "Kubernetes Talos Linux"
-  tags = ["kubernetes", "talos", "terraform"]
-
-  node_name = "pve"
-  vm_id = 703
-  machine = "q35"
-  keyboard_layout = "fr"
-
-  agent {
-    enabled = true
-  }
-  stop_on_destroy = true
-
-  cpu {
-    cores = 4
-    type = "x86-64-v3"
-  }
-
-  memory {
-    dedicated = 16192
-    floating = 16192
-  }
-
-  boot_order = ["scsi0", "ide0"]
-  scsi_hardware = "virtio-scsi-single"
-
-  cdrom {
-    file_id = proxmox_virtual_environment_download_file.talos-cloudimg.id
-    interface = "ide0"
-  }
-
-  disk {
-    interface = "scsi0"
-    iothread = true
-    datastore_id = "local-lvm"
-    size = 128
-    discard = "ignore"
-    file_format = "raw"
-  }
-
-  vga {
-    type = "serial0"
-  }
-
-  initialization {
-    datastore_id = "local-lvm"
-    interface = "ide2"
-
-    ip_config {
-      ipv4 {
-        address = "10.1.2.187/24"
-        gateway = "10.1.2.1"
-      }
-    }
-
-    user_account {
-      keys = [trimspace(var.ssh_public_key)]
-      password = var.machine_root_password
-      username = "root"
-    }
-  }
-
-  lifecycle {
-    ignore_changes = [ 
-      ipv4_addresses, ipv6_addresses, network_interface_names
-     ]
-  }
-
-  network_device {
-    bridge = "vmbr0"
-    model = "virtio"
-    vlan_id = 2
-  }
-
-  operating_system {
-    type = "l26"
-  }
-
-  tpm_state {
-    version = "v2.0"
-  }
-
-  serial_device {}
-}
-
-resource "talos_machine_secrets" "kube" {}
-
-data "talos_machine_configuration" "kube" {
-  cluster_name = "kube"
-  machine_type = "controlplane"
-  cluster_endpoint = "https://kube-talos.lan:6443"
-  machine_secrets = talos_machine_secrets.kube.machine_secrets
-  config_patches = [
-    yamlencode({
-      machine = {
-        install = {
-          image = "factory.talos.dev/installer/ce4c980550dd2ab1b17bbf2b08801c7eb59418eafe8f279833297925d67c7515:v1.11.1"
-        }
-        network = {
-          nameservers = [
-            "10.1.2.3"
-          ]
-        }
-      }
-      cluster = {
-        allowSchedulingOnControlPlanes = true
-        apiServer = {
-          certSANs = [
-            "kube-talos.lan"
-          ]
-        }
-        network = {
-          dnsDomain = "kube-talos.lan"
-          cni = {
-            name: "none"
-          }
-        }
-        proxy = {
-          disabled = true
-        }
-      }
-    })
-  ]
-}
-
-data "talos_client_configuration" "kube" {
-  cluster_name = "kube"
-  client_configuration = talos_machine_secrets.kube.client_configuration
-  nodes = ["kube-talos"]
-}
-
-resource "talos_machine_configuration_apply" "kube" {
-  client_configuration = talos_machine_secrets.kube.client_configuration
-  machine_configuration_input = data.talos_machine_configuration.kube.machine_configuration
-  node = "10.1.2.187" #proxmox_virtual_environment_vm.kube.ipv4_addresses[7][0] # lo + 6 talos-created interfaces before eth0
-  depends_on = [ proxmox_virtual_environment_vm.kube ]
-  lifecycle {
-    replace_triggered_by = [ proxmox_virtual_environment_vm.kube ]
-  }
-}
-
-resource "talos_machine_bootstrap" "kube" {
-  node = "10.1.2.187" #proxmox_virtual_environment_vm.kube.ipv4_addresses[7][0] # lo + 6 talos-created interfaces before eth0
-  client_configuration = talos_machine_secrets.kube.client_configuration
-  depends_on = [ talos_machine_configuration_apply.kube ]
-  lifecycle {
-    replace_triggered_by = [ proxmox_virtual_environment_vm.kube ]
-  }
-}
-
-resource "talos_cluster_kubeconfig" "kube" {
-  node = proxmox_virtual_environment_vm.kube.ipv4_addresses[7][0] # lo + 6 talos-created interfaces before eth0
-  depends_on = [ talos_machine_bootstrap.kube ]
-  client_configuration = talos_machine_secrets.kube.client_configuration
-}
-
-output "kubeconfig" {
-  sensitive = true
-  value = talos_cluster_kubeconfig.kube.kubeconfig_raw
-}
-
-resource "local_file" "kubeconfig" {
-    content     = "${talos_cluster_kubeconfig.kube.kubeconfig_raw}"
-    filename = "${path.module}/kubeconfig"
-    depends_on = [ talos_cluster_kubeconfig.kube ]
-}
-
-data "talos_client_configuration" "talosconfig" {
-  cluster_name = "homeprod"
-  client_configuration = talos_machine_secrets.kube.client_configuration
-  nodes = [proxmox_virtual_environment_vm.kube.ipv4_addresses[7][0]]
-}
-
-resource "local_file" "talosconfig" {
-    content     = "${data.talos_client_configuration.talosconfig.talos_config}"
-    filename = "${path.module}/talosconfig"
-    depends_on = [ data.talos_client_configuration.talosconfig ]
-}
-
-# TODO : Wait for talos_cluster_kubeconfig...
-resource "helm_release" "cilium" {
-  name = "cilium"
-  namespace = "kube-system"
-  repository = "https://helm.cilium.io/"
-  chart = "cilium"
-  wait = false
-  depends_on = [ local_file.kubeconfig ]
-
-  set {
-    name = "ipam.mode"
-    value = "kubernetes"
-  }
-  set {
-    name = "kubeProxyReplacement"
-    value = true
-  }
-  set {
-    name = "securityContext.capabilities.ciliumAgent"
-    value = "{CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}"
-  }
-  set {
-    name = "securityContext.capabilities.cleanCiliumState"
-    value = "{NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}"
-  }
-  set {
-    name = "cgroup.autoMount.enabled"
-    value = false
-  }
-  set {
-    name = "cgroup.hostRoot"
-    value = "/sys/fs/cgroup"
-  }
-  set {
-    name = "k8sServiceHost"
-    value = "localhost"
-  }
-  set {
-    name = "k8sServicePort"
-    value = 7445
-  }
-  set {
-    name = "etcd.clusterDomain"
-    value = "kube-talos.lan"
-  }
-  set {
-    name = "hubble.relay.enabled"
-    value = true
-  }
-  # Enable hubble ui
-  set {
-    name = "hubble.ui.enabled"
-    value = true
-  }
-  # Gateway API support
-  set {
-    name = "gatewayAPI.enabled"
-    value = true
-  }
-  set {
-    name = "gatewayAPI.enableAlpn"
-    value = true
-  }
-  set {
-    name = "gatewayAPI.enableAppProtocol"
-    value = true
-  }
-  # Gateway API trusted hops : for reverse proxy
-  set {
-    name = "gatewayAPI.xffNumTrustedHops"
-    value = 1
-  }
-  # Single-node cluster, so 1 operator only
-  set {
-    name = "operator.replicas"
-    value = 1
-  }
-  # L2 announcements
-  set {
-    name = "l2announcements.enabled"
-    value = true
-  }
-  set {
-    name = "externalIPs.enabled"
-    value = true
-  }
-  # Disable ingress controller (traefik will be used for now)
-  set {
-    name = "ingressController.enabled"
-    value = false
-  }
-  set {
-    name = "ingressController.loadbalancerMode"
-    value = "shared"
-  }
-  # Ingress controller for external : behind reverse proxy, trust 1 hop
-  set {
-    name = "envoy.xffNumTrustedHopsL7PolicyIngress"
-    value = 1
-  }
-  # Set cilium as default ingress controller
-  set {
-    name = "ingressController.default"
-    value = true
-  }
-  set {
-    name = "ingressController.service.externalTrafficPolicy"
-    value = "Local"
-  }
-}
-
-resource "kubernetes_namespace" "flux-system" {
-  metadata {
-    name = "flux-system"
-  }
-
-  lifecycle {
-    ignore_changes = [ metadata[0].annotations, metadata[0].labels ]
-  }
-
-  depends_on = [ talos_cluster_kubeconfig.kube, local_file.kubeconfig, helm_release.cilium ]
-}
-
-resource "kubernetes_secret" "flux-sops" {
-  metadata {
-    name = "flux-sops"
-    namespace = "flux-system"
-  }
-
-  type = "generic"
-
-  data = {
-    "sops.asc"=var.sops_private_key
-  }
-
-  depends_on = [ kubernetes_namespace.flux-system ]
-}
-
-resource "helm_release" "flux-operator" {
-  name = "flux-operator"
-  namespace = "flux-system"
-  repository = "oci://ghcr.io/controlplaneio-fluxcd/charts"
-  chart = "flux-operator"
-  wait = true
-  depends_on = [ kubernetes_secret.flux-sops ]
-}
-
-resource "helm_release" "flux-instance" {
-  name = "flux"
-  namespace = "flux-system"
-  repository = "oci://ghcr.io/controlplaneio-fluxcd/charts"
-  chart = "flux-instance"
-
-  values = [
-    file("values/components.yaml")
-  ]
-  set {
-    name = "instance.distribution.version"
-    value = "2.x"
-  }
-  set {
-    name = "instance.distribution.registry"
-    value = "ghcr.io/fluxcd"
-  }
-  set {
-    name = "instance.sync.name"
-    value = "homeprod"
-  }
-  set {
-    name = "instance.sync.kind"
-    value = "GitRepository"
-  }
-  set {
-    name = "instance.sync.url"
-    value = "https://github.com/vhaudiquet/homeprod"
-  }
-  set {
-    name = "instance.sync.path"
-    value = "kubernetes/"
-  }
-  set {
-    name = "instance.sync.ref"
-    value = "refs/heads/main"
-  }
-
-
-  depends_on = [ helm_release.flux-operator ]
-}
@@ -1,46 +0,0 @@
-# Terraform providers configuration
-terraform {
-  required_providers {
-    proxmox = {
-      source = "bpg/proxmox"
-      version = "0.83.2"
-    }
-    talos = {
-      source  = "siderolabs/talos"
-      version = "0.9.0"
-    }
-    kubernetes = {
-      source = "hashicorp/kubernetes"
-      version = "2.38.0"
-    }
-    helm = {
-      source = "hashicorp/helm"
-      version = "2.17.0"
-    }
-  }
-}
-
-# Proxmox configuration
-provider "proxmox" {
-  endpoint = "https://pve.lan:8006/"
-  api_token = var.api_token
-  insecure = true
-  ssh {
-    agent    = true
-    username = "root"
-  }
-}
-
-# Talos configuration
-provider "talos" {}
-
-# Kubernetes configuration
-provider "kubernetes" {
-  config_path = "${path.module}/kubeconfig"
-}
-# Helm configuration
-provider "helm" {
-  kubernetes {
-    config_path = "${path.module}/kubeconfig"
-  }
-}
@@ -1,19 +0,0 @@
-variable "api_token" {
-  description = "Token to connect Proxmox API"
-  type = string
-}
-
-variable "machine_root_password" {
-  description = "Root password for VMs and containers"
-  type = string
-}
-
-variable "ssh_public_key" {
-  description = "Public SSH key authorized access for VMs and containers"
-  type = string
-}
-
-variable "sops_private_key" {
-  description = "Private SOPS GPG key for flux/kubernetes to decrypt secrets"
-  type = string
-}
@@ -2,7 +2,7 @@ terraform {
  required_providers {
    docker = {
      source  = "kreuzwerker/docker"
-      version = "3.6.2"
+      version = "3.9.0"
    }
  }
 }
@@ -1,311 +0,0 @@
-terraform {
-  required_providers {
-    talos = {
-      source  = "siderolabs/talos"
-      version = "0.9.0"
-    }
-    kubernetes = {
-      source = "hashicorp/kubernetes"
-      version = "2.36.0"
-    }
-    helm = {
-      source = "hashicorp/helm"
-      version = "2.17.0"
-    }
-  }
-}
-
-# Talos configuration
-provider "talos" {}
-
-# Kubernetes configuration
-provider "kubernetes" {
-  config_path = "${path.module}/kubeconfig"
-}
-# Helm configuration
-provider "helm" {
-  kubernetes {
-    config_path = "${path.module}/kubeconfig"
-  }
-}
-
-resource "talos_machine_secrets" "kube" {}
-
-data "talos_machine_configuration" "kube" {
-  cluster_name = "kube-${var.physical_hostname}"
-  machine_type = "controlplane"
-  cluster_endpoint = "https://${var.kube_host}:6443"
-  machine_secrets = talos_machine_secrets.kube.machine_secrets
-  config_patches = [
-    yamlencode({
-      machine = {
-        install = {
-          image = "factory.talos.dev/installer/ce4c980550dd2ab1b17bbf2b08801c7eb59418eafe8f279833297925d67c7515:v1.11.5"
-        }
-        network = {
-          nameservers = [
-            "10.1.2.3"
-          ]
-        }
-        certSANs = [
-          "${var.kube_host}", "${var.kube_hostname}"
-        ]
-      }
-      cluster = {
-        clusterName = "kube-${var.physical_hostname}"
-        allowSchedulingOnControlPlanes = true
-        apiServer = {
-          certSANs = [
-            "${var.kube_host}", "${var.kube_hostname}"
-          ]
-        }
-        network = {
-          dnsDomain = "cluster.local"
-          cni = {
-            name: "none"
-          }
-        }
-        proxy = {
-          disabled = true
-        }
-      }
-    })
-  ]
-}
-
-data "talos_client_configuration" "kube" {
-  cluster_name = "kube-${var.physical_hostname}"
-  client_configuration = talos_machine_secrets.kube.client_configuration
-  nodes = ["${var.kube_host}"]
-}
-
-resource "talos_machine_configuration_apply" "kube" {
-  client_configuration = talos_machine_secrets.kube.client_configuration
-  machine_configuration_input = data.talos_machine_configuration.kube.machine_configuration
-  node = var.kube_host
-  depends_on = [ talos_machine_secrets.kube ]
-}
-
-resource "talos_machine_bootstrap" "kube" {
-  node = var.kube_host
-  client_configuration = talos_machine_secrets.kube.client_configuration
-  depends_on = [ talos_machine_configuration_apply.kube, talos_machine_secrets.kube ]
-}
-
-resource "talos_cluster_kubeconfig" "kube" {
-  node = var.kube_host
-  depends_on = [ talos_machine_bootstrap.kube ]
-  client_configuration = talos_machine_secrets.kube.client_configuration
-}
-
-output "kubeconfig" {
-  sensitive = true
-  value = talos_cluster_kubeconfig.kube.kubeconfig_raw
-}
-
-resource "local_file" "kubeconfig" {
-    content     = "${talos_cluster_kubeconfig.kube.kubeconfig_raw}"
-    filename = "${path.module}/kubeconfig"
-    depends_on = [ talos_cluster_kubeconfig.kube ]
-}
-
-data "talos_client_configuration" "talosconfig" {
-  cluster_name = "kube-${var.physical_hostname}"
-  client_configuration = talos_machine_secrets.kube.client_configuration
-  nodes = [var.kube_host]
-}
-
-resource "local_file" "talosconfig" {
-    content     = "${data.talos_client_configuration.talosconfig.talos_config}"
-    filename = "${path.module}/talosconfig"
-    depends_on = [ data.talos_client_configuration.talosconfig ]
-}
-
-# TODO : Wait for talos_cluster_kubeconfig...
-resource "helm_release" "cilium" {
-  name = "cilium"
-  namespace = "kube-system"
-  repository = "https://helm.cilium.io/"
-  chart = "cilium"
-  wait = false
-  depends_on = [ local_file.kubeconfig, talos_cluster_kubeconfig.kube ]
-
-  set {
-    name = "ipam.mode"
-    value = "kubernetes"
-  }
-  set {
-    name = "kubeProxyReplacement"
-    value = true
-  }
-  set {
-    name = "securityContext.capabilities.ciliumAgent"
-    value = "{CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}"
-  }
-  set {
-    name = "securityContext.capabilities.cleanCiliumState"
-    value = "{NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}"
-  }
-  set {
-    name = "cgroup.autoMount.enabled"
-    value = false
-  }
-  set {
-    name = "cgroup.hostRoot"
-    value = "/sys/fs/cgroup"
-  }
-  set {
-    name = "k8sServiceHost"
-    value = "localhost"
-  }
-  set {
-    name = "k8sServicePort"
-    value = 7445
-  }
-  set {
-    name = "etcd.clusterDomain"
-    value = "cluster.local"
-  }
-  set {
-    name = "hubble.relay.enabled"
-    value = true
-  }
-  # Enable hubble ui
-  set {
-    name = "hubble.ui.enabled"
-    value = true
-  }
-  # Gateway API support
-  set {
-    name = "gatewayAPI.enabled"
-    value = true
-  }
-  set {
-    name = "gatewayAPI.enableAlpn"
-    value = true
-  }
-  set {
-    name = "gatewayAPI.enableAppProtocol"
-    value = true
-  }
-  # Gateway API trusted hops : for reverse proxy
-  set {
-    name = "gatewayAPI.xffNumTrustedHops"
-    value = 1
-  }
-  # Single-node cluster, so 1 operator only
-  set {
-    name = "operator.replicas"
-    value = 1
-  }
-  # L2 announcements
-  set {
-    name = "l2announcements.enabled"
-    value = true
-  }
-  set {
-    name = "externalIPs.enabled"
-    value = true
-  }
-  # Disable ingress controller (traefik will be used for now)
-  set {
-    name = "ingressController.enabled"
-    value = false
-  }
-  set {
-    name = "ingressController.loadbalancerMode"
-    value = "shared"
-  }
-  # Ingress controller for external : behind reverse proxy, trust 1 hop
-  set {
-    name = "envoy.xffNumTrustedHopsL7PolicyIngress"
-    value = 1
-  }
-  # Set cilium as default ingress controller
-  set {
-    name = "ingressController.default"
-    value = true
-  }
-  set {
-    name = "ingressController.service.externalTrafficPolicy"
-    value = "Local"
-  }
-}
-
-resource "kubernetes_namespace" "flux-system" {
-  metadata {
-    name = "flux-system"
-  }
-
-  lifecycle {
-    ignore_changes = [ metadata[0].annotations, metadata[0].labels ]
-  }
-
-  depends_on = [ talos_cluster_kubeconfig.kube, local_file.kubeconfig, helm_release.cilium ]
-}
-
-resource "kubernetes_secret" "flux-sops" {
-  metadata {
-    name = "flux-sops"
-    namespace = "flux-system"
-  }
-
-  type = "generic"
-
-  data = {
-    "sops.asc"=var.sops_private_key
-  }
-
-  depends_on = [ kubernetes_namespace.flux-system ]
-}
-
-resource "helm_release" "flux-operator" {
-  name = "flux-operator"
-  namespace = "flux-system"
-  repository = "oci://ghcr.io/controlplaneio-fluxcd/charts"
-  chart = "flux-operator"
-  wait = true
-  depends_on = [ kubernetes_secret.flux-sops ]
-}
-
-resource "helm_release" "flux-instance" {
-  name = "flux"
-  namespace = "flux-system"
-  repository = "oci://ghcr.io/controlplaneio-fluxcd/charts"
-  chart = "flux-instance"
-
-  values = [
-    file("values/components.yaml")
-  ]
-  set {
-    name = "instance.distribution.version"
-    value = "2.x"
-  }
-  set {
-    name = "instance.distribution.registry"
-    value = "ghcr.io/fluxcd"
-  }
-  set {
-    name = "instance.sync.name"
-    value = "homeprod"
-  }
-  set {
-    name = "instance.sync.kind"
-    value = "GitRepository"
-  }
-  set {
-    name = "instance.sync.url"
-    value = "https://github.com/vhaudiquet/homeprod"
-  }
-  set {
-    name = "instance.sync.path"
-    value = "kubernetes/"
-  }
-  set {
-    name = "instance.sync.ref"
-    value = "refs/heads/main"
-  }
-
-
-  depends_on = [ helm_release.flux-operator ]
-}
@@ -1,16 +0,0 @@
-variable "sops_private_key" {
-  description = "Private SOPS GPG key for flux/kubernetes to decrypt secrets"
-  type = string
-}
-variable "kube_hostname" {
-  description = "Kubernetes cluster hostname"
-  type = string
-}
-variable "kube_host" {
-  description = "Kubernetes cluster host"
-  type = string
-}
-variable "physical_hostname" {
-  description = "Host name of the physical host for the kubernetes VM"
-  type = string
-}
@@ -1,9 +1,9 @@
 resource "proxmox_virtual_environment_download_file" "talos-cloudimg" {
  content_type = "iso"
  datastore_id = "local"
-  file_name = "talos-v1.11.1-nocloud-amd64.iso"
+  file_name = "talos-v1.13.6-nocloud-amd64.iso"
  node_name = var.proxmox_node_name
-  url = "https://factory.talos.dev/image/ce4c980550dd2ab1b17bbf2b08801c7eb59418eafe8f279833297925d67c7515/v1.11.5/nocloud-amd64.iso"
+  url = "https://factory.talos.dev/image/5a697fd6e91537a2c9c45929d004d82af180bb5d4e989dd8494e25fedca005bd/v1.13.6/nocloud-amd64.iso"
 }

 resource "proxmox_virtual_environment_vm" "kube" {
@@ -29,7 +29,6 @@ resource "proxmox_virtual_environment_vm" "kube" {

  memory {
    dedicated = 32768
-    floating = 22222
  }

  boot_order = ["scsi0", "ide0"]
@@ -95,6 +94,12 @@ resource "proxmox_virtual_environment_vm" "kube" {
    vlan_id = 2
  }
  
+  network_device {
+    bridge = "vmbr0"
+    model = "virtio"
+    vlan_id = 2
+  }
+
  operating_system {
    type = "l26"
  }
@@ -2,7 +2,7 @@ terraform {
  required_providers {
    proxmox = {
      source = "bpg/proxmox"
-      version = "0.81.0"
+      version = "0.114.0"
    }
  }
 }
@@ -1,96 +0,0 @@
-image:
-    tag: 1.25.5
-ingress:
-    enabled: true
-    hosts:
-        - host: git.vhaudiquet.fr
-          paths:
-            - path: /
-              pathType: Prefix
-# Disable HA, we are on a 1-node cluster
-redis-cluster:
-    enabled: false
-redis:
-    enabled: true
-postgresql:
-    enabled: true
-    global:
-        postgresql:
-            auth:
-                postgressPassword: ENC[AES256_GCM,data:MGHcVoXxZmaAaA==,iv:jzp5H+mT1mwbJvuDnlgfQBMsilAZcR9Wpdv1Bem8zvc=,tag:9vPppIbycDJfgRV45jkwFg==,type:str]
-                password: ENC[AES256_GCM,data:jm4ffAcu06Rqog==,iv:pBWzn+/Udl99Vv7bLRv37uNZjPY/xMqrvDgUw6o+Am8=,tag:Y8PEv+NoEr9YU86WVebZqQ==,type:str]
-                database: gitea
-                username: ENC[AES256_GCM,data:OmrAE7E=,iv:ABU5b4rhwtxz0n8kwI7Nxqn0Cn//B4ScWJdYU3cE5ds=,tag:q/g0741vR06c5nDWGnTvYA==,type:str]
-    volumePermissions:
-        enabled: true
-postgresql-ha:
-    enabled: false
-persistence:
-    enabled: true
-    subPath: data
-extraVolumes:
-    - name: git
-      nfs:
-        server: truenas.lan
-        path: /mnt/main_storage/git
-extraContainerVolumeMounts:
-    - name: git
-      mountPath: /git
-clusterDomain: cluster.local
-gitea:
-    oauth:
-        - name: Authentik
-          provider: openidConnect
-          key: ENC[AES256_GCM,data:BvrQCp1uuKsU+ghFqGDtDSXkx71byFQnOKSCU2iMLQebhsZdocZbJQ==,iv:WY3p4ygfc7CuEjK18Ktr2c/a5bDnCoyNSfKqjXwjZuY=,tag:INMKosSqPzJOCcZ9m3UKKQ==,type:str]
-          secret: ENC[AES256_GCM,data:7kWuHYZ+2UlLrlRC6bX54xu0EJ264pP3EkfycleNnE647+VNInviZ9OFdz+2E+Ujw5ktuU8Edl49ex/TZ3BLyBv5bgHgCySLIHrB9keEZIxuhnfV53csq7KmIvO+NALDbU2OlZZaiAyNMbJjRCSAxXRT2WtPVzadt6HkW3niiRE=,iv:4uWctDxVpRzqdErKp05WKuz7WYH5frktMe3gly4+VW0=,tag:isaFJX5Q+XaZnY1F2HFdfw==,type:str]
-          autoDiscoverUrl: https://authentik.vhaudiquet.fr/application/o/gitea/.well-known/openid-configuration
-    config:
-        APP_NAME: Gitea
-        server:
-            ROOT_URL: https://git.vhaudiquet.fr
-        lfs:
-            STORAGE_TYPE: local
-            PATH: /git/lfs
-        repository:
-            ROOT: /git/repo
-        database:
-            DB_TYPE: postgres
-        service:
-            ALLOW_ONLY_EXTERNAL_REGISTRATION: true
-        actions:
-            ENABLED: true
-        oauth2_client:
-            ENABLE_AUTO_REGISTRATION: true
-            ACCOUNT_LINKING: login
-        openid:
-            ENABLE_OPENID_SIGNIN: false
-            ENABLE_OPENID_SIGNUP: false
-        indexer:
-            ISSUE_INDEXER_TYPE: bleve
-            REPO_INDEXER_ENABLED: true
-sops:
-    lastmodified: "2026-04-05T11:32:32Z"
-    mac: ENC[AES256_GCM,data:etLsvUBjDtzqpwdP9jontcVmFRvvsy7z70Rcztvm6kNybRsWKss2hRarl+IhxBqI5rQYaWjON9BNpjIBjnmKVPiwV7lYF7cSTEiHrCCBrFyhwYKxgsgwZCWCfSgOLMlhTjI55wISPFyhHaC/O6CsuzcGRAQ52B2PZBaeY0vNgF4=,iv:aag0M1SJn7uVLu99wmGMp3Ms5jlJCTzkyGUsdzcrGAE=,tag:H2+gdObpNEnoDKaW3IT+wQ==,type:str]
-    pgp:
-        - created_at: "2026-04-05T11:32:28Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ/+KsQV7ZuIF9YaJQjnLJk88FP661mApTJeQRo7MI/SIGTK
-            Xrj2j9EU2QRny/56YD6x/vqENQ8Appnew4ejtLEJY/wWmfSaSuO0JWk40tOa95od
-            YxQhYBi0/DuCTtLdLs1lrOH+GEKSQNbE8Srv6gmaWweu1yLHUye44M8DxOd+/dbf
-            5q4sRtldgpAm8EFjdZQcollzoFyUDiE/G1bpml4hbkHVJhlSfJHTGN6bq96yuG2l
-            et0MnNAMW2EJh3w6vGk1CJfEB6LUfR6KNUM4oPI3qVy9GeGDgTi4xv1cYAiVIcEv
-            hXfDrwDGm1pUakLklzKcJ9TpNokPCimax5O2dNDKBdFaGuGVfYzIzcSIY1W3qZV9
-            KfpaCtkfIDOtwUdjvxcdhpGbYYckcEz0TFtwTIIPeznQvyhtqNcNV9TDxmDoQiYG
-            l1iY2dSoi7Fae7HT0QDrxw8rV9L2d+1qPkiEz9yOq+oJGYzuIy7ygPO7X1x2vkYm
-            lXoxVyFrbH3K4Wb4ibukdAkrqQKZYnhqpxtvB/SFTlS90r2wewQSfivBTHT3yh3d
-            j0Zjr2Ga8fiFdmy5ELyj7oKO4AWY67eFe1TdfV9dPb0qO7tVph2NbcNyhgp59ejk
-            lUjJCJKlDyysu7VAvF8RzzQhfwBrZqar55Mou+HvrypOJpoCCKH9GNiemoudSx3S
-            XAH+uZb87/xPqJP5XyXqOvW4WvLNRxCUcHwur9USiluKZYhdtaYicTOy3iif+sD+
-            m80ahUph//L/9qTbNQU51AF1Lq0X6Mh0GkBa1b61iJu/PWizjlEEJS+/xpN5
-            =FJi9
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
-    version: 3.10.2
@@ -1,37 +0,0 @@
-externalURL: http://harbor.lan
-expose:
-    type: ingress
-    ingress:
-        hosts:
-            core: harbor.lan
-core:
-    extraEnvVars:
-        - name: ENC[AES256_GCM,data:Y1D+lAT57F4HpiwnKJuhN3cqr/17,iv:ZARBNcGuiD5U7TnlBuQJLaWCMkQIELpj195aeKaBGZU=,tag:exBNWO/o2CXyNMLr2Y6bTw==,type:str]
-          value: ENC[AES256_GCM,data:EDMjB9DVCG3FiXdWrQmE4LhXTtTPLebKkBaQZ05tooakENXWQ2jm4YNRgBKWibHSM2gAL/z9POEi5BkiD0zK+NQV8DJKFLa8sxg9HR2OfeCqk3gMbq1uwurqrl6+OVX75E0Vqd9xN2CUtvfNVvPktMYn8UBU1nKuiRaHm3Tbt4QpcSQ6Oh1q2t7uqLDxt6DcAVb71gjpUXCZ96gg8/XsWlZXyzwJsfOEi33KlkBQhXYPFPEqq4wkXGqE1G+rT9MNOWc+WUdyY8FbP5zko+4F0Fcprj6iKlw8UB8PCtF7yAwFnxO7Bb0QGXxDGdKx93SbmGwxsYKe9muQZFfdp9rNW4R4L7K/O/ymiV+KEmwuwWoIBKZTHEwgOpD/B94MfEsPOlrmD438Ae3aifBQEOo3Ln6qu7I9md8tv2co4rmY4Wt3bBI8xXIPC1dzKI2YyQ540QtN5L22UZpabLLez0wNiVuDtCG2vg0ncI0flouQ1KjQp8DJ0Wz5i2WABwNg5X4sLU66nquD5hlf2YoNPw8EuY+E5lM0T0xBiv9AJHtQK5rN4AUopQWsi1FTSdFtCOlykBxnoYsLDyEa/73LA8e7m5Hi82IUl/5xR6LOEblEm+6jgcxY5UGaB7hsgh4K2qizmC+TWg0ua8YD4SIJZxqsNk4yz1l9DQAhZBnt/j2/I8K8PObD/7+6ObOfLM8A9UiwyIGUeQ/SCaN5DNMAHwFyELuXgTzdbdTgguJcJDgypCLUgvuVfx8dAOoj6cvHm7c=,iv:PEenzkk4lUyFBPx6e8Ah9LW7M5N7o93aueSE+pQozuU=,tag:rUeeXqEtHUQ3RYn1Pt4rBA==,type:str]
-sops:
-    lastmodified: "2025-08-27T10:07:49Z"
-    mac: ENC[AES256_GCM,data:tp6aHDIfLuBDRBYPmNDn1ZWEq0ZT/WH7GYCJNp52tO1tNldi+kK2avluY0QBbC6/5V8LfxpokN3Je6uBveRVzleituxlK7dvsZ4piITTmR0T79PtUqxa4Jh+7PYp0uTofjme1M2L2MU1sOWrCdRdiKWEpDVIJCCCsZ2oDCCoMTs=,iv:O65a/alrwX4cNJH1tYh4kQPaprmulyAitg9jFhOJqnE=,tag:ewAqx7h1e12bMYGrFC9PTQ==,type:str]
-    pgp:
-        - created_at: "2025-08-27T10:07:49Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ//VDjjaWIsqY0nUFINvzxnt+dullI/+lHYQTfWvZ7LqH4d
-            TN2p2VZRGRkupYUYxt4iucYl6qViGey4iaQopsYrV19kJ+eEJuI+depXYsKBAccs
-            24rNJuTLHYi7r353u48qUVoQcE6uK0mYB8/4+w5J6uANvwmjXUtDMEHUoiBCh56+
-            F7olPPSPUjXv7BpTNq5EC8YjGRjUjQNf1NOyHHz1eTsyDbPszIs6eT1q98AMo3GZ
-            boh7T6Z2yLI7Bj5guEn5OfwyFtB9DzcpaHajDgF309CsUsxfvhoVH85rx58vce3h
-            QW2zy7KPvNEr84ZsTBQwLqi318JiSD1egx4m+CPvbFvV1s7DFDgQQifLRzlqR9/d
-            PZc3DAZ81QzXhZV9Wh4nxG26SQtsbVxAjdfLrpvpDLV3l0wIU8bzP/UsskjGa8zR
-            VBriJ6qGeeDeXVVuxcLMlAhd8R8ipEvLrId3TzvAPRClk4+fU7wzTfqR8Cl9hu29
-            csLtPW4Fu6iZshf3UJJ8KEhjYo6060TlfEZX9hzypJFf+kwJopSrS7KCPFheNBkN
-            P2cuyBgpG8OANQ0vYx68mgkDqqWVWNXAjUHxcp98IjZxwcSfMR+HwZi6xbK97GKS
-            ltqUSxYixLQUelHJX9YHkheXDwfH+q+CaG76IznvMrFi+bB4laU+DmmVnfPZT1LU
-            aAEJAhDJ8KQkP2yRHCV2qycNpY0qBHN6pk6FXQq7O7dl3Z1oQXkS88KopCwan36k
-            Hf4vvXRGLR4fm0uFYhN9aApnDFQuWm4NjEGiNyg6p6WN0XMBNARWfmTyDNc8xceA
-            Q5I2AHdBk7Nu
-            =+11i
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
-    version: 3.10.2
@@ -0,0 +1,35 @@
+# Registration token for the Gitea Actions runner.
+apiVersion: v1
+kind: Secret
+metadata:
+    name: gitea-actions-runner-token
+    namespace: gitea
+type: Opaque
+stringData:
+    token: ENC[AES256_GCM,data:IOVPnopbQKY7HBT9tlnfuwvakgegLuK+PdTTwg+eRWdMz+dAoIxhug==,iv:QhfgyXNuZnYTXV1X16bdR+Axhfbe7buoRjXV8IdSbZU=,tag:r5By6+E45B04vgZrBoPSsw==,type:str]
+sops:
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:o3gyJNXJIBE1zSV4vWKFQWfmwZvz5Ek8ie/SjU6cF6kOqaLae2y9WBqYCQphCpasgN32qP0RM/bzzV3AZlIYqGEzI6lf0ha7aDPdVJKMy3ieie0F/UW6fJcTfidEFZYFKereRQwCWTzOESIZmsc+fqisyVxW3wL2yyYuh1a1HPs=,iv:RsG3AoqpMqR19DPQdqzfjbKNV5FZPxEsTbIZzzJtXq8=,tag:XzsmRc58Q+cNmBZXtygV3Q==,type:str]
+    pgp:
+        - created_at: "2026-08-26T19:28:03Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiARAAwpBrBeb3ywJTc54HNC7s/3+tqCvlozNym8E13jqHREOY
+            e6bfDO2hN2/JvbdGfMaWspLa8mU9ten6yFfUtoPADfccmbWwRAgS2mJuLyh5tksV
+            p+9m5vjyRQBH35pfTJ4F6Ksf7/2V8M4b2PxzBzTVQseqhOC2notYdvQeWED0gH1S
+            6cQvPClv/X214I9FfaHNig8SB7DV8uJ6ttj+IG9RL+NZ8lkT5GObSrphR6QH25Ne
+            65VMJmjcQLIWfZxR+zYVAxTsSeeDMFUY28WBUfjRei+WZ3ggmFRVERZzG6oSXfoA
+            nlqSQU16TyqadubPV2LcapqR/IwoSKdWO1/RmxH1NAFNvMg9nYLHzffAwPGL5wzT
+            GQZci20IlRQ5CLsaREyI1SNqYfjZ6esjUw8iKr5/bsr9XuI3FnWgqnKoAMs8O7d0
+            ZSGAohsUNrRki+ohhXtZFTelzufM1Hrt3Yz1TYQWtvoD7j87hq45BEZOU1ifiwre
+            Re0IhzcOdiBbCd3Lm9WSNmZzKHZoy9PJR/zaaitzZasIzsCH/7KjLBO0h1Bz+Osf
+            9Yxl5BMrUDFLlCIT0ORKZFtugwvS7Ez0IISMuRnSGjcutVsZGP1a6fN5K7oaSeAv
+            J9+9u5BuqRUs6ZYkC6TVqX7S8tAJkCOFIOFqxzb/oI2SBdRQmPP6Ix3FmN8NFu7S
+            XgGr3gKAnEDyuXwdZY7guYdVIteiLKUpvqk6F0yQD7b/rDGQoBD/g1twbx21ZDcI
+            UJ9aijLLe4JDcP02LNb64y8LaDb8VdFqlAIzV+MsYTwHAY3dB7LQtMGSmVlSZNI=
+            =lc7+
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
+    version: 3.10.2
@@ -0,0 +1,20 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: gitea
+resources:
+  - namespace.yaml
+  - repository.yaml
+  - release.yaml
+  # Gitea Actions runners (gitea/helm-actions "actions" chart, same HelmRepository)
+  - priorityclass-actions.yaml
+  - actions-token-secret.yaml
+  - release-actions.yaml
+secretGenerator:
+  - name: gitea-values
+    files:
+      - values.yaml=values.yaml
+  - name: gitea-actions-values
+    files:
+      - values.yaml=values-actions.yaml
+configurations:
+  - kustomizeconfig.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: gitea
+  labels:
+    # The Gitea Actions runner uses a privileged Docker-in-Docker sidecar,
+    # which PodSecurity "baseline" forbids
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/enforce-version: latest
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/warn: privileged
@@ -0,0 +1,17 @@
+# Low priority class for Gitea Actions runners.
+#
+# Negative value + Never preemption policy means runner pods never displace
+# other workloads, and are always the first candidates for kubelet eviction
+# and the kernel OOM killer when a node runs out of resources. Combined with
+# the hard resource limits on the runner pod, an intensive CI job can only
+# ever fail itself — it cannot take the node down with it.
+apiVersion: scheduling.k8s.io/v1
+kind: PriorityClass
+metadata:
+  name: gitea-actions-runner-low
+value: -1000
+preemptionPolicy: Never
+globalDefault: false
+description: >-
+  Low priority for Gitea Actions runner pods. Under node pressure these pods
+  are evicted (and OOM-killed) first, protecting system and app workloads.
@@ -0,0 +1,34 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: gitea-actions-runner
+  namespace: gitea
+spec:
+  interval: 1m
+  dependsOn:
+    - name: gitea
+  chart:
+    spec:
+      sourceRef:
+        kind: HelmRepository
+        name: gitea
+        namespace: gitea
+      chart: actions
+      version: '0.1.2'
+      interval: 1m
+  valuesFrom:
+    - kind: Secret
+      name: gitea-actions-values
+  # The chart has no priorityClassName support: inject a low-priority class so
+  # runner pods are the first to be evicted/OOM-killed under node pressure,
+  # instead of starving system or application workloads.
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              kind: StatefulSet
+              name: gitea-actions-runner-runner
+            patch: |
+              - op: add
+                path: /spec/template/spec/priorityClassName
+                value: gitea-actions-runner-low
@@ -12,6 +12,7 @@ spec:
        name: gitea
        namespace: gitea
      chart: gitea
+      version: '12.7.0'
      interval: 1m
  valuesFrom:
    - kind: Secret
@@ -0,0 +1,99 @@
+# Values for the gitea-actions (Actions runner) chart.
+#
+# Hard resource caps: CI jobs can be very intensive, so every layer is capped
+# so that a runaway job gets OOM-killed/throttled inside the runner pod instead
+# of exhausting the node and taking it (and everything running on it) down.
+#
+# Layers of protection:
+#   1. dind container limits  -> hard cap for the Docker daemon and ALL job
+#      containers it spawns (they run inside the dind cgroup).
+#   2. Per-job docker options -> each job container additionally capped below
+#      the dind limit, keeping headroom for the daemon + image cache.
+#   3. Low PriorityClass (injected via postRenderers in release-actions.yaml)
+#      -> under node pressure the runner is evicted/OOM-killed first.
+enabled: true
+# Register against the in-cluster Gitea service (chart "gitea" release).
+giteaRootURL: http://gitea-http.gitea.svc.cluster.local:3000
+existingSecret: gitea-actions-runner-token
+existingSecretKey: token
+statefulset:
+    # Single-node cluster, no point in more replicas
+    replicas: 1
+    timezone: Europe/Paris
+    runner:
+        resources:
+            requests:
+                cpu: 100m
+                memory: 128Mi
+            limits:
+                cpu: 500m
+                memory: 512Mi
+        config: |
+            log:
+                level: info
+            cache:
+                enabled: false
+            runner:
+                # One job at a time keeps resource usage predictable
+                capacity: 1
+                # Raise if jobs need longer than 3h (Gitea server-side job
+                # timeout applies as well)
+                #timeout: 3h
+            container:
+                require_docker: true
+                docker_timeout: 300s
+                # Hard per-job caps (docker create args). Slightly below the
+                # dind limits so the daemon and image cache keep headroom.
+                options: --memory=7g --cpus=1
+    dind:
+        resources:
+            requests:
+                cpu: 250m
+                memory: 512Mi
+            limits:
+                cpu: 1500m
+                memory: 8Gi
+    tolerations:
+        - key: ENC[AES256_GCM,data:wLfr0r+e9KYm,iv:BGZnWKQUlOje9RhAs7tBDzNcDt5LcfTnqRSqrdFc/A4=,tag:bb1f7NwEwmEzrf5k9ivFPg==,type:str]
+          operator: Equal
+          value: failover
+          effect: NoSchedule
+        - key: ENC[AES256_GCM,data:1kBsMuUlpluDmpVddyZCI/ylRbluHmQ62F88Q9LEoiZkgdpm5g==,iv:IlggVbY7s/xaSM2ljMkiTDwvIjf12g3SQzfL2fWWf78=,tag:2aNlCFumidKSbnoUV1IBzw==,type:str]
+          operator: Exists
+          effect: NoSchedule
+    affinity:
+        nodeAffinity:
+            preferredDuringSchedulingIgnoredDuringExecution:
+                - weight: 100
+                  preference:
+                    matchExpressions:
+                        - key: ENC[AES256_GCM,data:JuejrbDWeF+d/+d2Hq+q4V9vihk=,iv:VPgkBuv2hqJbTNFXpv3SzRGtFA6iVq1kFR8hfANg0cQ=,tag:D/wrkytnO8oZ3/+4yicq7Q==,type:str]
+                          operator: NotIn
+                          values:
+                            - "true"
+sops:
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:srIJjIgWx1OGgGwz71wQgT8c1gg64iV2VHrrb11SYXpaYg0VMp9d0maJHCaKt5rDVtWw/+Ft4WbR0z2FJBLEmr64/cFX8/SgrOR7pAc/vAgPKfxiSHg6iJoVCGHssGHm4NzvSUC2fkMqc8WUiZDR5hztUKSlp9oNPO2bKZmw7Zo=,iv:tgSmO28JZiGK9xO4uIH35zlRzJcW8lKxaggtqXlFq/w=,tag:+mIagmS+Z5RSFdSo/yDhjg==,type:str]
+    pgp:
+        - created_at: "2026-08-26T19:28:03Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ//X9NxtKUDFkdKDmWQh3wRSriiq25U7gkL0Q7SE45Tz5V6
+            03i6QmzCyBpI81TQQBRRzfdkuuqocBgplTRRRvFsNQNcwc5KCq1zHIDVYE+XlcmI
+            /bwA0GpBZwDN6Mv+G8+6UwhSp+YgsiGFTVAIctfz90cRYPpABX4wRcDYInTlifHk
+            weBq30iS6Nl9TajpgyyAUct6EBQ8u1YmxsII9RYWjdoTS/SAuAxNM2px7fwOPAoL
+            fq6/AxXj1n+uKjxl1calL95768RmLUerdxDmac53/73Pj271hmbwrWqe+JzkSriu
+            YMHYNOVLglf7nS3AQSqAa9PljBv7xHw9jOUqkJH14W7/NpSRvc4PICyIWA3Yfpfq
+            ymMI/OOYosyl3ZYhfLGUIAIYLkA1StgGVfpmeOmUCPEn2FIInBmguzDRMrdnUkoz
+            KYh/06Ug6YsgCTsy8Ffhzy724ITRADzqYlTU060tTwFN7cgFVHiIfZdYIFxDxNSL
+            NELw8Nl7+9jkWjlnmPvtxfrN90L7nBm4s3mZrYeyZ1/ElcxDkJKb4r+PJuc6rCpM
+            tuD9BXxjl5qa/trl/1+fVToDMMm5vws0MLl4DBkbNUNkD7wWko0I4rDSZ+X4SihM
+            /V7XgzeQ41KMnDdZYwTKdIVhCpZOIBwZlLuZSYCn8uhqO0YMkkpB1x1EOb2fy3zS
+            XgFdP2zpsUHWsy/iENHCgnMkQ+l2XwZZ2bgZGqwpRbLO0fDNX0kRZ45NzKl2+t79
+            npggZ12JFTPPbQG+o0hY0p7LjnjbfBsp7m9ykvymizZXlzP9efoOq6kjD/CRBu0=
+            =WgiB
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
+    version: 3.10.2
@@ -0,0 +1,142 @@
+image:
+    tag: 1.27.1
+    rootless: true
+ingress:
+    enabled: true
+    hosts:
+        - host: git.vhaudiquet.fr
+          paths:
+            - path: /
+              pathType: Prefix
+# Disable HA, we are on a 1-node cluster
+redis-cluster:
+    enabled: false
+# Valkey cluster is the new default in chart 12.x - must be explicitly disabled
+valkey-cluster:
+    enabled: false
+# Use standalone Valkey (replaces 'redis' in chart 12.x)
+valkey:
+    enabled: true
+    primary:
+        resources:
+            requests:
+                cpu: 100m
+                memory: 256Mi
+            limits:
+                cpu: 500m
+                memory: 1Gi
+postgresql:
+    enabled: true
+    global:
+        postgresql:
+            auth:
+                postgressPassword: ENC[AES256_GCM,data:AGdZp0KNk6+v+w==,iv:dc7B8GYA1hlC6VgO1m3jdHimIVb4QeR1DTmh9kqRDa4=,tag:JEFWOgvgvUDJ+S9yS446cA==,type:str]
+                password: ENC[AES256_GCM,data:kuR59jqrN/YFmA==,iv:qAIwiTzi2Fr9R9fIc3sfPqhIHSPI8K3eNmed8DBm7PQ=,tag:hf7CMUissSbO4RVn+kRUJw==,type:str]
+                database: gitea
+                username: ENC[AES256_GCM,data:rCEYTAA=,iv:zeWzB+vpMl+oGUfQRPYFneLwnXF7Dlg4XAYB4QynAyk=,tag:zqJDiBiKJJIDgNKdOtGlMg==,type:str]
+    volumePermissions:
+        enabled: true
+    primary:
+        resources:
+            requests:
+                cpu: 100m
+                memory: 256Mi
+            limits:
+                cpu: 500m
+                memory: 1Gi
+        livenessProbe:
+            enabled: true
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 10
+            successThreshold: 1
+            failureThreshold: 10
+        readinessProbe:
+            enabled: true
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 10
+            successThreshold: 1
+            failureThreshold: 6
+postgresql-ha:
+    enabled: false
+persistence:
+    enabled: true
+    subPath: data
+    size: 30Gi
+extraVolumes:
+    - name: git
+      nfs:
+        server: truenas.lan
+        path: /mnt/fast_app_data/git
+extraContainerVolumeMounts:
+    - name: git
+      mountPath: /git
+clusterDomain: cluster.local
+gitea:
+    oauth:
+        - name: Authentik
+          provider: openidConnect
+          key: ENC[AES256_GCM,data:LekdKlJJX6AYZX2PgooenJtANvE8HNdzePN9yeljrnoKV7pbexDnAw==,iv:pZm4+Dj2uqprBRIgchq78nEzqkC/zVoiyRK0cj98WPo=,tag:iSiuwP8N6BBVeGWS54j+dw==,type:str]
+          secret: ENC[AES256_GCM,data:J7WJghH6Xp9Fg3Y+PO1lN1mEEJ0HbVSM1YP2d8//NX2xmYK/PK1y6xSVQ4+VSsYTZhIAM3ZXVrBE/5smuNLUZkoj2EKY275fXcN2kOkEwiftdsJHSKdevCtO57TQipJToh6mfLxz51LDxpz85rVNj4Rvra1d9UvC5x1nUBm8AR0=,iv:lMiMQGsKn4ZxFctakj5MyVlX+8Wu93d5wM9cIqEBhSc=,tag:CkuTAGJqg+dUzyP9z5gwzw==,type:str]
+          autoDiscoverUrl: https://authentik.vhaudiquet.fr/application/o/gitea/.well-known/openid-configuration
+    config:
+        APP_NAME: Gitea
+        server:
+            ROOT_URL: https://git.vhaudiquet.fr
+        lfs:
+            STORAGE_TYPE: local
+            PATH: /git/lfs
+        repository:
+            ROOT: /git/repo
+        database:
+            DB_TYPE: postgres
+        service:
+            ALLOW_ONLY_EXTERNAL_REGISTRATION: true
+        actions:
+            ENABLED: true
+        oauth2_client:
+            ENABLE_AUTO_REGISTRATION: true
+            ACCOUNT_LINKING: login
+        openid:
+            ENABLE_OPENID_SIGNIN: false
+            ENABLE_OPENID_SIGNUP: false
+        indexer:
+            ISSUE_INDEXER_TYPE: bleve
+            REPO_INDEXER_ENABLED: true
+# Resource limits for Gitea container
+resources:
+    requests:
+        cpu: 100m
+        memory: 512Mi
+    limits:
+        cpu: 500m
+        memory: 1Gi
+replicaCount: 1
+sops:
+    lastmodified: "2026-09-22T20:35:36Z"
+    mac: ENC[AES256_GCM,data:xGtSdlGuJL3qSbnfbh/ON1q3c+n6l991fCy9t9ZLnrvSrU15vkK/WVHh84V132C72pEakwRy8nFcUl7KT3C3J2l2uJHJyDWDqA8NTvHq7FAcomKGKpNOqAOFXVUKSr6O4BtQr9x6h4jzAZSlpaTx3GEiLRzygSkZmcEcaXZ6/hU=,iv:JfQ3W3UZV1m1SkapNmUpZ1lkxgTs5F0auXukupK/yAg=,tag:xCNpJUc5mPv2dBhS+ob+fA==,type:str]
+    pgp:
+        - created_at: "2026-09-22T20:35:36Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ/8DiM04ZZ18qFndWSlo+hHV05hlt7GmwG9dx/3xEXgpdEb
+            TkA3HNi5rUMvA8j/mStmP4sZiqrxlPk9sdMtVsPAppT3qAihcF3DyyUFYkSoY3oF
+            Et5qeeC6DP1aKdsgAQVVZyeLy7l/CbO5CYORm5+TuGmnr0HxN1qZimbF15pspvNN
+            9pprI7XDKb6QEbXhADN9gafNwTIQgv3LGQVdoQgfyzZEcQR8O5bxUFTwdR9LO646
+            zogHuQfPC70jpA2IRxdBHuSTjDkZimyehsKPzq7MpBso/85q3q1TlSQKJsjxZWrZ
+            NBKmEhL/Q4M+8mj+N/aVFJldIUF2Juto5d2BUuIG/lBtNL2QHdiJN3Rxc1gL4qP2
+            eZYESQ6IRXAycUXAQgMJf5p/lhgmVjv8b3lhKSFJq66hZyo5g6wdhLIEunPglNbP
+            BcJXUbl5SScTgOAi9o/soezUuggvzgg3zwM38PAghve1/j0rL7EupYX+u2v7zbUH
+            BA7T30SnkvDCmTzW4+Sac1dg/w06u+4oSGTNnTuKOzmzfIjGlwkJeAtPVcvSFAgK
+            TCKDmvtkPWUxGrxjBbJZUwqCp4HEOwOp6HeGeNbWFZ2UU+JTvTizkxbReN37Q4+f
+            8oIyQuyRpDHgDV5IrbDtCcqWsEFpUXyi8snIMDTCkKdLZv1WjYhjoNmvOoRagQvS
+            XgEQDrDBeC3HZvUuvqMqgmHI+IEjmpad1CNVGE2q7FnAhFYutjBGF78co2X9t+ib
+            B9o6aIwPzS4ANsh47rupGDBt/x46RCorCYhCaJm4B3v0+tYSA7mSBoHQwp1p+AY=
+            =kRPK
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
+    version: 3.10.2
@@ -0,0 +1,37 @@
+externalURL: http://harbor.lan
+expose:
+    type: ingress
+    ingress:
+        hosts:
+            core: harbor.lan
+core:
+    extraEnvVars:
+        - name: ENC[AES256_GCM,data:lr90LLYoAKXh8PqT0QEmELOWBxKm,iv:y9mIMG3ND6l4rBnhW6f5FoU5BX5m4vi4WW87bv1XOB8=,tag:gtoyqreaGqG50Of69Pfqlg==,type:str]
+          value: ENC[AES256_GCM,data:qSCBq39+RSf1KGLyZ9TUKgVXtrXhvOhtR791n1hWKSUWho3YxM2LfTRJwcmAcLyIu8numioNlKEWQKDvOEefURzFy05RXkUYWa+ZebRp9c2y0d5ZrSiRDHM2cuxHRjeg/g4QKoX6IVhIcAEIqfHIs1NGxoqeaopAZcB6lGqspZZhzduUYJUWZGULylYdTpyF41F3RKv3xMnNBAQX2FCP3wOeb0DM8s4JMcgJ2eZwRDYecjotTC0pWL7LAZiZaLJR97O8/4cjofc9cGKEcyy0Yf05kSMxeZDWqrEplXNu2y30szafzC0SqkRwDPlifRUanNU2FaT/TIz4Ixklws7iaY0Db9yW+a+SvaWpNTY3pecbo01+4RG0eIDW4sRJFBp3/70vZ2FjCDDzaw6OEJYxrDf1fJ/UGGur2/rzDwLMhQgiRzIKoqq4n87hg1zwZ9ki63tKc+2Mp9oZ8GlvaCuNLMoG8QjXrxCkz/rcEL5Gkb11XwVAnsFdCCZVNfLstqQKpdnO8d4vvLHyRlw7lkf3ggX/b2l7Va/EkpHYONrwIdigd9ambMlHDRRhox3onZsgVaNqDdf5E8oeZJABqKV/1BT7oQn5Jx06kQhN7KvI07y21bQM2Gtvbv8LyhJHPdU3gZwtKEglp9+bU1UvFbQv9lEFm+1crQKBcgySCD8iLS+D2Tp4Y45qWjwD9Nsa2U9eGiHA1o3JZ5s3ltc2ZZVUvTpswRAfok66YqmL+XdbUkk6OtkSLS8FZVARHYbZ4bU=,iv:uxPwCWlMTEgtfGB93ywnMZLEBdNan+K7Bm0xuprYsPk=,tag:oLVwtUcrbERt9GExKo3tLg==,type:str]
+sops:
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:UVtitK0Ct6M7scvv1qsP+QeQL7S89+856IozBcQgnLZJzeZ5cquzKvrYZ+q7DeL1rk6EWvsxxFAFnSUDLfqCItEAMs4QQhORqplv6ot6BeW0LYUf5i1646Kl7x7Mg0RkJJ4OLsfqCwNPDT0opBQBhbYwTl3HCta8McCjSg96xNs=,iv:ebt36qndBjaThOJfAVJ7ACN06NrRSJnFlFmXIH2l4gM=,tag:TArRCiiM0xdMvOcZDqBrCQ==,type:str]
+    pgp:
+        - created_at: "2026-08-26T19:28:03Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ/+JkaqlVRJtypgMHl1jg9Dv1XqgeEW/5tv52YgxvNYk5kS
+            MJBeuku6/tVGb7i3eArj19My4hQLTXPWv/SK2cBiq3dKnjEs77Nfc1ffRJF/J03W
+            Ur/zy3o9lhVaWOTYVPTH1QIOehJS749ApadN7zB30g4RiOwJfTWiivEx67TzalDv
+            nvRMaotbAWxyD0PNpWV27i93FK8SIUy9HufpZucoN0BQ0moAj9BhbneumB+dUwRe
+            gh+C6LzbRuehFvegIh8DlWIKeMH1L0xW100cwuXyf6FOK/FM/pSsWX1IdlXD5Hfv
+            OSt4QHJESepTmEukfEgyywBMxk1iKdhW9/xa5lkEGxfGv6LnomzFWuKKOqiOF8GG
+            ZTt3NIj3Hr0S0USehbyQwQNOB/EvWTSWcoeaEVUmdphil8rZySZ6B2kkHWaj60YQ
+            cxb+vv9wgrjJitAhwds/xI5HYk0VSXdwtxZPTB4wqzNak5jHFKEY6/s0meQHk3Y4
+            UF9JIZsxLgPGGpAxzYka+Rlibv1FlPpyWQJZet6NGD/VbinhosIVv9vSZA3PqbyB
+            1x31PxGbKac/b7yeo2AfncpKPm0A33VENv1btRbbBGc2LRkYyLnlTDGmHbBrFE0s
+            HNnh4Gfc5EU6+GQo9UO7WIex5AQLvje91js895StVeh52ziyCBdjUwy6hhlSERPS
+            XAHgjHq0JXu8+cZrgjWyPlLcDYbMelW8RWsiGvvyZqUJn5YfVLBkMpSYVRanC0ib
+            3jBdLOaHKZvi9na0Tuf6QcWHep8J4hj1u80yUmIIzk0Xyv5WFYcypJ+g7KqC
+            =MmP5
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
+    version: 3.10.2
@@ -1,12 +1,12 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: gitea
+namespace: pkgatlas
 resources:
  - namespace.yaml
  - repository.yaml
  - release.yaml
 secretGenerator:
-  - name: gitea-values
+  - name: pkgatlas-values
    files:
      - values.yaml=values.yaml
 configurations:
@@ -1,4 +1,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: linkwarden
+    name: pkgatlas
@@ -0,0 +1,22 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+    name: pkgatlas
+    namespace: pkgatlas
+spec:
+    interval: 1m
+    chart:
+        spec:
+            sourceRef:
+                kind: HelmRepository
+                name: pkgatlas
+                namespace: pkgatlas
+            chart: pkgatlas
+            # CI publishes a timestamped version on every main push and
+            # stamps appVersion with the commit SHA of the image it
+            # builds; this range always picks the latest one.
+            version: '>=0.4.0-0'
+            interval: 1m
+    valuesFrom:
+        - kind: Secret
+          name: pkgatlas-values
@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+    name: pkgatlas
+    namespace: pkgatlas
+spec:
+    interval: 1m
+    url: https://git.vhaudiquet.fr/api/packages/vhaudiquet/helm
@@ -0,0 +1,47 @@
+# Chart: https://git.vhaudiquet.fr/vhaudiquet/pkgatlas (chart/pkgatlas).
+# The image ships both binaries (build + serve) and runs as nonroot
+# (uid 65532, distroless). Everything else is chart default: discovery
+# first — build.enabled=false, the first refresh pass builds the whole
+# live rotation and /v1/readyz stays 503 until it lands; weekly
+# refresh after that.
+image:
+    repository: git.vhaudiquet.fr/vhaudiquet/pkgatlas
+ingress:
+    enabled: true
+    className: traefik
+    hosts:
+        - host: pkgatlas.vhaudiquet.fr
+          paths:
+            - path: /
+              pathType: Prefix
+    # TLS terminates at Caddy with the *.vhaudiquet.fr wildcard cert;
+    # Caddy proxies to Traefik by host, so no tls block here (same as
+    # gitea's ingress).
+    tls: []
+sops:
+    lastmodified: "2026-09-24T19:57:42Z"
+    mac: ENC[AES256_GCM,data:cidn6U0EFjuEx98GA8Jlppg3GobcGGrhs20dPoAnUXdpFogfsp3YOTPCKuKi0LrOw/fxBP84U4drx5lJcjL11Ft/Ozn6Z8tk3l8cdqK+BUm6yijtQ0PXHjPUJYNIeqxrQKJzFlVHS+tOARbhQ3DjoNt71WBMfSPUDcPxrbnwVAA=,iv:Yz85yh9jrLXf6DKeVmOLeiVCWcthKCPGCJJwR3RVikg=,tag:7Mdv4VZUpsjuysitx4b2DA==,type:str]
+    pgp:
+        - created_at: "2026-09-24T19:57:42Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ/+N+gGPOCbuxleT6xx0FduVN1vspYJlCyrtLsy632Yz17x
+            ucwqSuGciqUf2kF3GwnOzINEY0eLskbKHMX5wkbJg8+X6dXoRyiseX3fdNrpvMGR
+            P1ZC/C4O6BzQoPJOXDQZHuWPI0Imx61PlzDPzsJ44JBvwrkCKgoaWOvzMyTjZHiC
+            iplyHpzDR2sqfMe29aQICrEV6Z87eMWQ3wie6CzX2OYTj89BejsN2Ibg4n5cqdNO
+            c+mM7Ek2nSWMWYGbdL0W2N6WSIbGuQj/aVbS0s6585NUPJtmcznB7uosRroqfbd2
+            9SMP1gaUOr+00kykRxKtd/ZoW7S/21kGbZ8FwvtKZFrBwcoUuLehbSGAHRYLo6dI
+            5WGeky65IrvpKen8Q/B6o6EByTONt2h+XiyJyLwDLeFh13/ldkGqa1oW+4BTHuX9
+            2WvLOboHpr4MGQdO53Q8zm8VCGAltusII6ZVaoEyjilqZtC/Aa9XZIT/HshOGTQi
+            4CITE1BfGEApOcBbBQKdjYofdWcyuLSF/ertXvcvNiCoVe0wYiHSYUht+HulQ3t+
+            Z0K7C2sJ2bx8C+316b2MzCGVrVOuqDABpQJjIr4aiRG9v8BtYTaUc425CLm9TMtA
+            PmZR1Rqowy4ECekrbvk3lNjPoq13HLSqkm2ppL9WFub5zY2XY0npprSeUknTmSDS
+            XgGFDhcroUq0vTUlJbC015kpa6cpynwTmMuQrFaMPeKeBPkL4Le6QFJMjpIi3yg3
+            65bSBv5t7YXoHFJWVFYej005Lz1lxp1VtaMiA0bnKEnyh/SbfcUqD4d9P1WNx+4=
+            =ulvs
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
+    version: 3.10.2
@@ -0,0 +1,14 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: renovate
+resources:
+  - namespace.yaml
+  - repository.yaml
+  - release.yaml
+  - token-secret.yaml
+secretGenerator:
+  - name: renovate-values
+    files:
+      - values.yaml=values.yaml
+configurations:
+  - kustomizeconfig.yaml
@@ -0,0 +1,6 @@
+nameReference:
+  - kind: Secret
+    version: v1
+    fieldSpecs:
+      - path: spec/valuesFrom/name
+        kind: HelmRelease
@@ -1,4 +1,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: gitea
+  name: renovate
@@ -1,19 +1,19 @@
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
-  name: linkwarden
-  namespace: linkwarden
+  name: renovate
+  namespace: renovate
 spec:
  interval: 1m
  chart:
    spec:
      sourceRef:
        kind: HelmRepository
-        name: linkwarden
-        namespace: linkwarden
-      chart: linkwarden
-      version: '1.0.1'
+        name: renovate
+        namespace: renovate
+      chart: renovate
+      version: "46.260.4"
      interval: 1m
  valuesFrom:
    - kind: Secret
-      name: linkwarden-values
+      name: renovate-values
@@ -0,0 +1,11 @@
+# Upstream publishes the chart to OCI only; the legacy HTTP repo
+# (docs.renovatebot.com/helm-charts) is stale and lags behind releases.
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: renovate
+  namespace: renovate
+spec:
+  interval: 1h
+  type: oci
+  url: oci://ghcr.io/renovatebot/charts
@@ -0,0 +1,43 @@
+# GitHub Personal Access Token used by the Renovate CronJob.
+# The chart injects this Secret's keys as container env vars (envFrom), and
+# Renovate picks up RENOVATE_TOKEN automatically.
+#
+# Required scopes (fine-grained PAT, restricted to vhaudiquet/homeprod):
+#   - Contents: Read & write   (push update branches)
+#   - Pull requests: Read & write
+#   - Workflows: Read & write  (repo has .github/, lets Renovate manage
+#                               action-related files if configured later)
+apiVersion: v1
+kind: Secret
+metadata:
+    name: renovate-token
+    namespace: renovate
+type: Opaque
+stringData:
+    RENOVATE_TOKEN: ENC[AES256_GCM,data:XgCD6ppqguo6MMv0OScXUkqhn07Mo31F8o4yf9Hd51wHjpmh/DHBSREqBzYpETrB4vDjec9AVyylOTz5qEITFdme+K8qg4L6Ti/JPIm5WOPNsXD84k3ZFIr6PWvQ,iv:ovQhFt2XlyHYzadYlQnQQ/X/NFV+9CeacZ40B1WYjqw=,tag:NTWOBN0ceJ7evKGq+y+cFg==,type:str]
+sops:
+    lastmodified: "2026-08-26T19:31:53Z"
+    mac: ENC[AES256_GCM,data:1EsEQ1JmB0pTgoA062k48hKAa4IUNKm55E/9bbmHPRcI5CUC7IBC2npT2yn0+6eQ7gTSqdrbqZw+xu0LAF5IrEjIIscKE7yZizkFAIy5VuCdZdAOBlvLtc1GXg7PE6ACXn8wHDcWBcAoq12HEAtpdXS1dNhdZBFxkB27RD7UvYw=,iv:hPeTFZlrqXyVNuy3D00VeLqecKDEKKGe/AhuFwSxPYs=,tag:O6+OYfJU3QeL58f5/tUQkg==,type:str]
+    pgp:
+        - created_at: "2026-08-26T19:31:53Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiARAAvkrhQ3QLbfF4xTCjmLnY4BzudBMrx4j1+zjG7S8MZ/oL
+            Vx4ji8gAxRIvv6DZ/eSwybeTijtY4ROUQRAm+2Ut5r2yKVGZiokTUE3js/SgQ4Nx
+            uSMcEdn5GOilgM/c30GXsWzCo3yiGWWCNISwxOLvdRC2FEw0OYxTRSEvtBnck22q
+            FExVE6fvH/ks7nak3ry9Bo4OEVZZrLmr8MR/RL/l6Z8AyOLCp7yss+a0OvTb+NRq
+            PVQXmoLlRYqEdbkW8lbyt32oJ451ukMH3l6yscC0ZxHIC6XvKUwUa9uhcUPLZq97
+            o73fmYqCSKmfLc8CMTDX97d9yuApOepZZtVaJGxLhxd/pNIZNwbojoo6pCKh8bdY
+            2CdSf/FA+EqjG1B6CtzHCE35FgiYuDxFsOM7WbPROvT8n7QYVnZGI/QoFawWAFsw
+            heFi9sDGBcqM+bZDo7NTV0Nd25Q/+GfCHpK1BAug4n3K61OuJhJfHw1kadbH81y0
+            vWN9AAQTYfu5FjqMjSbyASbTYNX28a776ojYrR6HGgD2A5PyC1vBAR+VZwSernfm
+            N+wJ8YAK/2hPKVReEhYFcJiSm/MuNW9QD49/gbj7Y/NFs5NEJlV33cAEo6hyduR+
+            Z+Aw2M9xOsz+qFop86oRGSXNCZh/TG/G5/7rjS2zNG0vQAsgQ+xVXmDJPsmZnPnS
+            XgFuPLMkIN+DFl3PaX9LwkqgROXA3KGG4jZsZ4qzQ0+fZOCAvoU7FNXKnyQ/i2qv
+            NPSRW2WLDAAbqwjj3jNxdd3JFRbDq6XQ+V175fYN8sTFuOYLq59d8YD7Z8e9+aU=
+            =xVRA
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
+    version: 3.10.2
@@ -0,0 +1,70 @@
+# Official Renovate chart (https://github.com/renovatebot/helm-charts).
+# Runs Renovate as a CronJob against github.com/vhaudiquet/homeprod.
+#
+# The GitHub token is NOT stored here: it lives in token-secret.yaml and is
+# injected as env (top-level existingSecret -> envFrom), picked up by Renovate
+# as RENOVATE_TOKEN.
+cronjob:
+    # Aligns with the "every weekend" schedule in the repo's renovate.json:
+    # one run every Saturday morning is enough to open the weekly PRs.
+    schedule: 0 6 * * 6
+    timeZone: Europe/Paris
+    concurrencyPolicy: Forbid
+    successfulJobsHistoryLimit: 1
+    failedJobsHistoryLimit: 2
+# Top-level chart key: wires the `renovate-token` Secret's keys as container
+# env vars via envFrom.
+existingSecret: ENC[AES256_GCM,data:tt9OJ41wHayCWgQYd+Y=,iv:jBqe+K1hL36ViFntV4cU3qh9jdnG6W8e4LiE99rIFIA=,tag:Kj8/qKd689iIatQgUc+9iA==,type:str]
+renovate:
+    # Self-hosted config (https://docs.renovatebot.com/self-hosted-configuration).
+    # Repo-level update policy lives in renovate.json at the repo root; this only
+    # tells the bot WHERE to run and WHO to authenticate as.
+    config: |
+        {
+          "platform": "github",
+          "repositories": ["vhaudiquet/homeprod"],
+          "gitAuthor": "renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",
+          "onboarding": false,
+          "persistRepoData": true
+        }
+    persistence:
+        cache:
+            # Persist the repo cache + SQLite between runs: much faster clones and
+            # fewer GitHub API calls on a weekly schedule.
+            enabled: true
+            storageClass: longhorn
+            storageSize: 1Gi
+resources:
+    requests:
+        cpu: 50m
+        memory: 512Mi
+    limits:
+        cpu: "1"
+        memory: 2Gi
+sops:
+    lastmodified: "2026-08-26T19:31:53Z"
+    mac: ENC[AES256_GCM,data:fA2nukiGOWK5UVQRbBagOLdqSBjYYG2VysxXfQ3TuRtFYhN8bd16j5xIfy2aDrlLEVw19uhInggQMu2vJg7xT6V6Z9w5YsHwcSQWSGCMjTk764/ChT3QGA0nhVG2ktgsZgaiU/MrCAPN/XQP3dG6Y25vkcptFcXnn7Ig5D+V2eQ=,iv:3fKfVaDJ7RjjAI0n4I+6na9pKLB07yGgjvRXjh7I3Iw=,tag:cyclZ/i2rfKeAof15J4ufA==,type:str]
+    pgp:
+        - created_at: "2026-08-26T19:31:53Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiARAAi9efDDL8A1RFxx50RBFjLi3G2OG8XQfo/UF3O7gd65vH
+            tu+3b9KtiRvWurOVqapAxUwapiiwx4Gsem5F1Q9FoX+5HfQ3APQ91kxfGjQTjx00
+            2lt+pl4JyeKj0+ilGMP5xaUyOvZGNB33v4ls14Uljzg3tqQQPGUvYMJ6f5svXXOo
+            ugagStCSx9jh0j++Y9gCFZXYSn3C1IblGeUxkh7fUJQjveqp8R5Ofntdg7sbV5Au
+            Xeah95zdQxdJ/zb6GW7t0dWY5KEYi4Tg1gNybvMIKDdWZ8NND7kaFOSx5Bg8aGJa
+            +6nh21MHs7oNmzpxLXNa9rTk1ncE2HcLcTIXl+NHf10dPcR6R32w8Bc5e1UtBKI9
+            mUeHgH2zphG4Xihcchbeeb6RAxBvl2EWLglxB/HKKw8ouC3EmlOj63QS7o8ES8CZ
+            z+/uq4uOP65Q9k0xa9YHl4nGVXlOYqxFkiB71UYIqwUxyw/Th0IEZhBrd2GFf2wl
+            CUj9DDDejWBvGyIwp1MIRLhQkMrL4KczHLAdMEC/OcvylZHxESOpMEIq+CUXi0wr
+            GyjnwLS3F1ZPB0+Xbpy8OfTKAT1jI6Z65G6138p6c8xJsh+lBwBd4QFTJ0VfR+fd
+            /edCwMKalySDK0Li9OIphj1or90l/ZURdlZpIrgnYrYeBg7HibuN2E0u0cMur/DS
+            XgExhwYtGznQThvIySwqAa2YMLm5tz5PJ1mUGkJ2AUaJuQX9SfhFYJSCGjpv8Fbf
+            04FCKZ7B8eG9j9ae0Wfn07SeN9xSZEMuCtE0KLjAR0v5ACAF5Lb6Ee5tc+5K2sk=
+            =zZdk
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
+    version: 3.10.2
@@ -1,42 +0,0 @@
-persistence:
-    enabled: true
-ingress:
-    enabled: true
-    external: false
-    hosts:
-        - host: homeassistant.lan
-          paths:
-            - path: /
-              pathType: Prefix
-configurations:
-    trusted_proxies:
-        - 10.0.0.0/8
-        - 172.16.0.0/12
-        - 192.168.0.0/16
-        - 127.0.0.0/8
-sops:
-    lastmodified: "2025-12-04T18:23:43Z"
-    mac: ENC[AES256_GCM,data:JSaTCBXqpiP0R3rIEa/EZaDPbBInY2a6UMhFD9Gcw/mJVq/wF72KsFRfJl2hZ3d1FtsQ6Z0l3GrbiV41348jxzWM4XnE0e0hywdc2Ryqw0B3GS0EoNk1IoPR8ieZtxWNtFvglR2gVWWUnN7caYf/acE04NnzIDxl0tPEFckS+Nc=,iv:C784uqYb7KGhn2wGWZnCA7rhGocJWP6mfBhjNLWbimE=,tag:A7JLOmSVJ+ZrNA36DJfRCw==,type:str]
-    pgp:
-        - created_at: "2025-12-04T18:23:43Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ/+J1e3KfHaAkFS+lYz9jKzPAffkiDVCeecEf31Lk9DJxFd
-            7agtTWvcXtIsiJwF4sv4NzxY3pQrNRKwiq8pd3iXWHSqflIaQ2M9+dUGHykkjA5W
-            R+y/wgM+K0MBaFMxQU/xC0lM7YFwypV1JBp4jmpNn3McGba2yZAoKo1uAQ9LMP4L
-            Fd5wqNUrLNfwbh5Ts1rBVAGwStVlkRUvdUVCXjngdWVmE5xB3IBypdrFX2oclkl8
-            0zSNJwknC4bi4FeKBxWC90HT0n8zSMybdZOltcl8J3YVCL6l0F9hw6Ub5j1ej7qN
-            Igyll2/T4FEOExdo9oRXbEjC6GSZZBD6NMlrgJqVVUWoqDm4WQlKc7JRYAjtRgbS
-            Us8qCD8CMb57E6AZHD+GRZDK48OeevM21YxRvpSQlQfyeGbMrxF05zzw5InHSMhw
-            VslHQRmUMQqEzTsSeFbNxTeqy1YGGDYlnBpEjl8TPIZXE+mjwHm9QJbKwQFUK4Rh
-            YuEZDlUONdaKQpNX9OS6kwiV493sSruC2yWNwYIlgERrkcjBggKYPiV7lDiFnl1W
-            RVcsqOGnsrrwFHT7m6/MTIzH0k4fDt6Vv/FCToaoadvLPYNZb7xoKMahzT1z3SP9
-            FMuGus2r8h6ShEZVyLAt6o+BuuYyzOrVo10k1yTKDqEDD662rbRvTrBZlOk1vUPS
-            XgEtw6w6fFkESJKetHiN6TxG2+WyJw5PILm2sjak5AcR3qWiux/ENPb8kE0BIB0S
-            1Z/YTHYNP2mtEegDsp1DoT9tOSTWfrllL+p3kccvizEB5hq9+oMEzPGBstjWRjg=
-            =5PDx
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
-    version: 3.10.2
@@ -0,0 +1,62 @@
+persistence:
+    enabled: true
+ingress:
+    enabled: true
+    external: false
+    hosts:
+        - host: homeassistant.lan
+          paths:
+            - path: /
+              pathType: Prefix
+configurations:
+    trusted_proxies:
+        - 10.0.0.0/8
+        - 172.16.0.0/12
+        - 192.168.0.0/16
+        - 127.0.0.0/8
+# Failover tolerations + affinity — allow scheduling on p330 during r740 outage
+tolerations:
+    - key: ENC[AES256_GCM,data:5+QTI95qM5mc,iv:FS4FVgDoOOpaDSArV8o/RkpkpJxx+VHJhuExKZn1Vgo=,tag:f/7b4p2Yzc2fQpZrJNB0EA==,type:str]
+      operator: Equal
+      value: ENC[AES256_GCM,data:p9l+vJ81qoA=,iv:x44SAzdRxMGCGdnS1EQxU5rG/7BQ0gWJAqZHohii8W4=,tag:wzVAvTzbcJFD0Rl+8uS4Sw==,type:str]
+      effect: NoSchedule
+    - key: ENC[AES256_GCM,data:2RIXb5x6dsNEV241NTXFGYL030lRupkjWcPUHsueK4a6bn8DBg==,iv:2RVpm3L1RXXc6nN3L4UqkBxuNe/pfeNBzprwLDp6ank=,tag:jgyvyNdcurQVuih3YvaBiQ==,type:str]
+      operator: Exists
+      effect: NoSchedule
+affinity:
+    nodeAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                    - key: ENC[AES256_GCM,data:I6Z6SR2x8z6grjUUv3PBHLDc58E=,iv:smfPq81TGWdkPyao+pJCoZidgUFhPTdFdXBRMPeJ+p0=,tag:035Zf3xHRZL0wmbt9e7pUw==,type:str]
+                      operator: NotIn
+                      values:
+                        - "true"
+sops:
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:qQWuHn260xF3a0+H06TZD5fdVkj7/yff2W+klPjFFPTq9x+roBXQsHaulnSVO966djEvprPJQHIHUN5pgx2Re1rgyQ6MSI8J8H+iO010Gw+k7w6Ya/gMN157qxusY9gwyKG56eciE/4FTocfAsjxcOkTuk+nX+N/MkSjbv1mAIM=,iv:ddhMEsQIHNqWJB2gMOMd6N5WZneeeFNOAnFoPfVUE/s=,tag:QziO35kTfqj7JOFPqC431A==,type:str]
+    pgp:
+        - created_at: "2026-08-26T19:28:03Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiARAAmUXgE37uXgmjh0BbCsX+hqX0yLGtzWm0LfAF72lhU74X
+            899VsY3OsCGAOndSH0T4vH27/ayoNE5wTZMahfxa02IdWZXMo3nD6F4k6nai6Dkn
+            7m52RRBqNM66NhF4TAaTKg/j60XJKw0aoVSlgkUq/JVvs4JSyZPpwCp2TVz4/TwD
+            Dn8jC6Wfs9YQKWa7FWKW8d4vz9SNOpPSsiT5hIF93XVs9GdcsCtCsPB4Cr71whZj
+            q0RYWi21dnFzf5qCEH/5Mmz235JudMYESwJ79yrIM9r1Cj3QPPc1oEy2qjbBpN78
+            ulobKXMdclkCpNNgqaNr86v6weT0HpjqR/lleUO1EMzyTOKaIZ1uGS5xPYHlqF4M
+            8u6Gj8S6kGCLDsAQlnUbt+cycg1NOPNPJq5E/htio+sdoUeEmO+Y3+y54ccqR622
+            eyIZhp4RJukNLnq1y+6LiIUmimTSRlApwLbBouY24D/JPaO1oWL+Q2dcvm2qpZ9w
+            /o2bdXyr0vNUnpq4Yc1uU8rBSeElOIRHcTZVdtsUZuJp72tXo7/oJqJmsnrAih4i
+            /7+rsOpRRQDQPIyEveBXcwEp/baSVsYdeINufmXiM57ie+B135+5tsYYucF3pXzc
+            elJLdKSif1Kt8w6Ch+O2M3NqsCp+yp6IihUOt9vyZ7pYLZvWLo/e5JUmvy9S5snS
+            XAFFVhnrgNL+dBuzZXa6vfglwvBNl9iEogYWtcX4/Sr7X30Dv2RfkcNYi55sq7ji
+            A9Y8/cyL7d0m/ksgpcFcmRQvPCOpM/KPKZ2KbLLdeuXOhP/WXG+2auhJtwzF
+            =BS4A
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
+    version: 3.10.2
@@ -35,8 +35,8 @@ zigbee2mqtt:
    external_converters: []
    mqtt:
        server: mqtt://mqtt.lan:1883
-        user: ENC[AES256_GCM,data:8chGUA==,iv:SOAuBYShpWbza3idtyqFoVIFstZFM34OPDN4uhAer0Y=,tag:WPoH80VcUGLy5Uq/z8EtaQ==,type:str]
-        password: ENC[AES256_GCM,data:XVcTzQ3pDvPKbw==,iv:TK5qHq2yMTWgzcOPvj0GO7tOOD4PHvKMWfd3p4T8LuM=,tag:GJpKQWpVhwrewX4+9NITfQ==,type:str]
+        user: ENC[AES256_GCM,data:Sl/k+A==,iv:d1LIy5ny5jS5yEWtWfVntN4R8uQCoRwSiYkUb1JG/yo=,tag:dkNv+GqyD8geimnuJHgAFg==,type:str]
+        password: ENC[AES256_GCM,data:vwap+JwtgOpLAA==,iv:PC2f6Lg0EpmaJKd9M2yeQGejvXTNmhRPjAkFw1M4zwc=,tag:zp0sgA2uzLmOBNNH6yY95Q==,type:str]
        base_topic: z2m
    serial:
        port: tcp://10.1.1.159:6638
@@ -44,28 +44,29 @@ zigbee2mqtt:
        rtscts: false
        adapter: ember
 sops:
-    lastmodified: "2026-05-02T10:26:20Z"
-    mac: ENC[AES256_GCM,data:32zZ0bYrgn+zTz8DEOU1N8MgDrihzWyMsV9q2m5RhFHRvXFuq3Z2GTORlUTeuK5qZIUrZt22VskigGAQiKC2CdzsJTcO3cGPshu5E6gWGBRNob02bXXsMu3TfCKxic/Ek7jE2p9R++a5AKczFZY8SxL7Sv1BZDxozkginDdYR4Q=,iv:VcDKwoPgYxZc8KXYv9oEH2GBqDRAJJxphj6MFLLI8ok=,tag:vPWqcEHoBVvfCoKoN5UiLA==,type:str]
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:RUcA16mUHxIwToAQBR5UCbi/cEcDXms5r1cXYS7drYfvcPI1r84oX9/PHsXrRHcMsqIwyQbiK72CDLhQFXDW/YIugpy9OEFPAP88oqkfXrZFA5NfoU/9U0bfI5U8GmJEHx56DJtsqfSy1VMotC8sd0wj21YBcnmRhYIMoXLl/G8=,iv:tcjXHh0DvXheMlQIifVVY2TJryFmgZchbVfLKFpnLf8=,tag:KjpEK92QTFtzl6ml/Yw/VA==,type:str]
    pgp:
-        - created_at: "2026-05-02T10:26:20Z"
+        - created_at: "2026-08-26T19:28:03Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQIMA7uy4qQr71wiAQ//fl1m3T6TnQvQ+yG0plOZaRXIGRI/YHiyP9KsK6I6l4c9
-            Y7lUjVcgADbjZYAMv08LFOEyN0/dtTFx2kV1vC5sF4CjxXKfddazKrQFjZQygc56
-            Yn3wiYX2ZMTsc3AnOoUF/evXyDHYMu0l8FwZEupi0cjmgKjVZZsLYScMjLi6h9oO
-            agDUxqZX8d3ikj3LPF1dk/XGP75fHBg7Jfim1RMMrOcpAbRi0H3XU82cr2s9fTS8
-            UtylTk1x3F253YTC0JdvU0UskvzCvVl0Sf8TlkVb2tTJgwf/XnXMTmMeCvbhIj5u
-            bgqIs0y6F0xm8NjhPGV2CtsQuQtLMLb5SxVFj7P4ad/Ekf9TizAJlcPt2u1/25zu
-            x9v/kFnI5XMDIr3eWBJlFUwtImQJ+bO3GTauqwpULIHSa+y3Ux2XMNarKfN1jH3Y
-            RG86rLQSioSA+HdZuZdEvo2ACc5DotC835cnMGMeIuO1Ad/RjvUaptN/p5hvTFMf
-            5t6SoE8gLXH7FZF7IomY0Xs/feztPOvPK76zpKV1Tqqgb7i0GaTFcKKBUxMPklZw
-            XwqOQl36HWz1BSvtYtYYX6/HyuknH4T6tk//J6MrNttnTQ/ZqjrBvl4FEVxTgf1h
-            pFc8fTzNak+VB4MSdALg6Eo5xR57eGHhKgdUMgDAv1JMEP9ikk4/p8/1WHKhpTvS
-            XAG3QSahHWoc9L5A73xFmD66TRUhm8CVKRCAQebB7rXjsxaqgEOl70taQpucrckD
-            624SYxJwG9Uuk4odCQJ6g7T2KCKxsS/NKy6jOqgprkerR6pCfuXg8LDxBkHP
-            =cZ3t
+            hQIMA7uy4qQr71wiARAAptsMCNyzKNo3EtUeF1rdkRPPPg3yfjd4UjZD6ZkIFExw
+            IhqPSUqQl9tdjqNQaY3Amyo5rwvk62Reep6Zqz3+ig2DulwQN1lyJj+CPdNNAZ7O
+            81n1E1NcIoQWjVkDoh5MN9UEZkCfsr+2zE7fTiR2Zt5WOQm/p6eGB/WxFytirN6N
+            cgOt7ZNDZi2UW4ffyqt9ayU1s5C8o9epQecfhtGWxchM1GeBz/vyT/FHJsh6Jq3I
+            K2a/wz5vQAq1GMMAybzB2xNnM882YuclyfTLOJaAAYBovY9bzEV5SXOxpyUq5gXk
+            hJVN1xtzjBJOHySY2Nk8blX4md49W0CTmQptsKsIBQZ2+RtZg6MK5R4UeCrO8u1X
+            UkBYS4tbfBQtijoUMAlqUpSdvYGWEHg72dX1u7LQRW5adKCB+JHtIXYHQ4f5DSjA
+            HBHwZmMjf4yEMOmbV/E8cvGCCDHX3pOPx3F2I5RYcp+mES5SvkX/6SQUMVmypeyf
+            wp2zcx1JMh44HDd63vIEntQ4FALNHB7INqSytZjiV2DBphUimPMAOKSz6GLQ8Ye8
+            NLTkZOFVmyCLNRj/Z8iy1m74LHL4a58arZ+D5OrXlhRlE6SyK95QzRs0xyvPS58A
+            PudcPKf0BrXCKWJfd87Kqurf7r64F22UYge7nyM2U/jhRLWtcBmG+tIy5U+U65vS
+            UQFbkLECKQZUbk9FJW9nR6dXbFuK0dhZFsR2c0lsEGSsl9N5exosNbuH/43jjzXo
+            LEn+CGVci15x7+2yBtA59ZMzohu78K8riLGbtlDUaeouSQ==
+            =Zbi6
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
    version: 3.10.2
@@ -1,14 +1,14 @@
 authentik:
-    secret_key: ENC[AES256_GCM,data:nS0n+g3riD47shHDhs8JzfHT+a8oOKvFJDvO72mUU3bVslFYRBueJK+rWCGYjXwwyZzUjAcb638sqA66THxaxebPLtZ/UCmT79qzOw7Rf3A=,iv:o9WztN8vb8Pag8WMKIEWDMgFVWiTB3dIjCx7nU/0hrc=,tag:6tx684P4cJSZrrmut7KVcA==,type:str]
+    secret_key: ENC[AES256_GCM,data:QjhY+442U44K3EJuXqSb42eyWt2znf1KAG0DeQ7JQw2qGA4tMaZKVaBKP9jHkF0yR2G8gZpYIofxBJFfl82kYsqvrixcxgH11H+ctZxVI6Q=,iv:HjPjBzFkmBYahpKjSXA8qUS1a6c4/solENAB7noaIxE=,tag:qpW50kV2bVoduM92UNKVxA==,type:str]
    postgresql:
-        password: ENC[AES256_GCM,data:ES3BL3tEiv+NSg==,iv:oOKiH38wi5zqKkgvezIgj5Qg8+1bcFZXpoEewMucygM=,tag:YigQ3X8pRXVqhkoycGNjbA==,type:str]
+        password: ENC[AES256_GCM,data:Prv+e2pcLAyVyA==,iv:y36fhvpI2qm4nRnJzPXvLi1Sopn1g4YhdFVs+5fVeaI=,tag:z+HhXLN57qryvLdqtByO9g==,type:str]
    email:
        from: webbot@vhaudiquet.fr
        host: mail.vhaudiquet.fr
        port: 587
-        username: ENC[AES256_GCM,data:EmE524Yp3Ihv+FnO3GfTilzLwGo=,iv:XzJW6v4owBETgLHfqvvELhkDLQJSH962eEByQF0zeSQ=,tag:rkvVWCX3JwNO+j9MIB/+LQ==,type:str]
+        username: ENC[AES256_GCM,data:iZeZ2IgJH0iJWLYWCh22ogOuEzE=,iv:Un1P3ra/ziVZdPJFVnHBGs6zZwTA1elODRuKHaMEHYA=,tag:KdFfmfF553e9BeG4Ypt0tA==,type:str]
        use_tls: true
-        password: ENC[AES256_GCM,data:b6joibJRT46C+XeH2eI=,iv:Lo+28oE5mv3uxI8CUAQ1OgNhN+3iv1JfdxvkZWZC05c=,tag:VAIrnXSg9w82N00oT+d8JA==,type:str]
+        password: ENC[AES256_GCM,data:Vvs0ibOmTCo5f5P8JQ8=,iv:uiT2+qK+KxS0TQqw4Tda+CA2h9mlhcf62WjKH61LP4U=,tag:6tRDtEWmHpiSjZz1xchHxQ==,type:str]
 postgresql:
    enabled: true
    volumePermissions:
@@ -17,12 +17,44 @@ postgresql:
            repository: bitnamilegacy/os-shell
            tag: 12-debian-12-r51
    auth:
-        password: ENC[AES256_GCM,data:NWk6kvOp1RRs4A==,iv:q0GoRFQ15LBXDxDnOiKWHX6/K8DwX+k2Myxk7iaBo2U=,tag:6qfY+5TF2oy4cRfeJKr7IA==,type:str]
+        password: ENC[AES256_GCM,data:eQj7A0VNaObUag==,iv:19JuGpdcwc+aJRiINaIu8015gODcDZO4pMO/uc3n+Yk=,tag:WUJAw2X6NLLDmqlIydyuoA==,type:str]
    image:
        repository: bitnamilegacy/postgresql
        tag: 15.9.0
    primary:
        args: []
+        tolerations:
+            - key: ENC[AES256_GCM,data:NZUuKYSOkot6,iv:wwDpZ18Q2OAj6Va5nWWKyrYK6/DqxjMKnvTRNMDkLCA=,tag:I8Na3EpJfAgCzUVSxFn8JQ==,type:str]
+              operator: Equal
+              value: ENC[AES256_GCM,data:XJw93s+tOis=,iv:svIxr795xD/Hz3yaHc4aiZ14hExVgmEDGfCOJoAK7Do=,tag:jdb0UgIOyXVmegHq3TvOJA==,type:str]
+              effect: NoSchedule
+            - key: ENC[AES256_GCM,data:kzg1pA8p8cBUgcKw6VfQuVPPmUmXR8uMAgxklAcJB/hVjGuxHQ==,iv:sFvOylmUNsfC9+XwwGPsFiua+/OMEDXlb/ICSQ6KNVk=,tag:ybJIKFMS3wtk/ESidcbEeA==,type:str]
+              operator: Exists
+              effect: NoSchedule
+        affinity:
+            nodeAffinity:
+                preferredDuringSchedulingIgnoredDuringExecution:
+                    - weight: 100
+                      preference:
+                        matchExpressions:
+                            - key: ENC[AES256_GCM,data:A7lJZoDqSfcwF+W3aweIxGmiVIE=,iv:ZFC9gAM0wVhGpFsfzHfBI3fUPNwGo2/stpZk9FTlu4k=,tag:8HzGLiqZ/Fp8AvGjDLeBVQ==,type:str]
+                              operator: NotIn
+                              values:
+                                - "true"
+        livenessProbe:
+            enabled: true
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 10
+            successThreshold: 1
+            failureThreshold: 10
+        readinessProbe:
+            enabled: true
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 10
+            successThreshold: 1
+            failureThreshold: 6
 redis:
    enabled: true
 server:
@@ -30,29 +62,51 @@ server:
        enabled: true
        hosts:
            - authentik.vhaudiquet.fr
+# Failover tolerations + affinity — allow scheduling on p330 during r740 outage.
+# The authentik chart reads global.tolerations (applied to server + worker)
+# and global.affinity.nodeAffinity (preset system with type + matchExpressions).
+global:
+    tolerations:
+        - key: ENC[AES256_GCM,data:FR3QHEd6FFk9,iv:fmWDfiL122FdaZT9SpwqCCiJDXtFRLR31+SjbI7+HbI=,tag:++WE+3RwdDbXTyV2xu2UIA==,type:str]
+          operator: Equal
+          value: ENC[AES256_GCM,data:/BSFTcoWqMk=,iv:gNvCYESHtDwF/2ZeUwFj2h3LjpHbCaO97YK/HvYl9t0=,tag:HAZPhDedb5E0D5SlHEoZwg==,type:str]
+          effect: NoSchedule
+        - key: ENC[AES256_GCM,data:/Qrec35ekNu97Vt5uezNfI+siytofle4uTm/YXt5KihmcTerPQ==,iv:/+hLpM20CFSVjG4KEpjv7vvem4XlAYt5RM2mAykaG1g=,tag:GfXvuHlBsWGAlpvSjaHMWQ==,type:str]
+          operator: Exists
+          effect: NoSchedule
+    affinity:
+        nodeAffinity:
+            type: soft
+            matchExpressions:
+                - key: ENC[AES256_GCM,data:8IL59mlYJP3mmE7F9MoKdztW/Vo=,iv:e6rBLp5lXnktdY9wHN7sMTteDQcUZoPuKW2rx7fuSlM=,tag:u7McVTzQIfW6oXILHuhFvw==,type:str]
+                  operator: NotIn
+                  values:
+                    - "true"
+# (postgresql tolerations are set in the postgresql block above)
 sops:
-    lastmodified: "2025-12-05T21:18:24Z"
-    mac: ENC[AES256_GCM,data:DpKXYMtn+01IVQ98t/oVG4bqRVBBSQojqKGmt1A0vco8EJKNtHxyykVuuouO4mhmx+UWKjxEg+KvgvV2Ptk4uGs64x2sCSnMuqnpwfd8xpxLukqVxVd60ICKFeeVt4MgwRrlOBO2WKMDoZE5pi7pxVoGDb86P2J4XHzWqVkGGX8=,iv:W1OZznwbmlZJzICIuEVszGwFGFOgPLiThX4uxVpaOiw=,tag:s1HhjGwGt/mkWMhsqmXjZw==,type:str]
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:XucjlNYeRTBXcSqA8Tmnl/Oy7MtdVM6ZrYnv50S5nytSx2wjKxdoJtGzvVIrRTNPdt86J+jNhIJKRAlBoEamDWy2+qh38suXx0JSzpoePuqd6mGxvXLXtVje7OynAq742q7rrHiJqffpD8ck+U3xN8Y1rNrAwnEoucFTlreCN/c=,iv:DBY6fMt6cSfvoOrOmFoYWN5DUUMV+I+3zCltZPcGF44=,tag:iz9TMhxLLBsTmwgDYfnIvA==,type:str]
    pgp:
-        - created_at: "2025-12-05T21:18:24Z"
+        - created_at: "2026-08-26T19:28:03Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQIMA7uy4qQr71wiAQ//ZrmaLqypfT4HvrAO8tV/I8tl3PDZgLot0pQyv3Idu3s3
-            0e+Pn7zGBUvZXNYfgd20ilCatPVzt4x2KvFgaAkEMkqHnE2btLSrN66QiwHZDxF5
-            1G+TNWs6ZOUSpUn7P1UdfroSm/Gy5sdUc8cTuolOkLqq0r88Wh3+RkxoR9Nv4f4p
-            XDDNRo4al8t0QT+WHKlGwaD/58Vgu0CRzBsjZodZWrG+4VgzxHK+3rqPGY7s0Mpy
-            /epq73LBFRzgVagMqjH8LBJ60jjScWHVlGjRg4TtXDyhHYizEvlWt63sbWeYBLwC
-            Uz0QHR3jWZoErbb71JpEhHa5P+QuUaZTeEq/groWsD1I7cceDC9EorhbcyWm7SNa
-            swTx23zjfdM/Hqi5Wz9UeTN8CkdSpb1mbG9YTvhB510wcpdVPTJNM1hVF+9OJycu
-            RP6YH6dXuWNK7aSx62ppaz+UJb27tF+KXafO4yDIu5hY1vaeFSgCUgJTpYae4tS1
-            pWBLR51FikImgkkEFjzDwAWGBwfYzvqWqGOjO6E2yaVRTSYYdZQbTj8Owq49zizT
-            A4eZpPEeq+Z1FmQ7kjV7+tAV/GTDrSyvtytQ+fgebhVf+0KrcNUzQDEsQfV1htNl
-            mnR590NnBp83jlHVAFYUwaCEzcrfRrfGzrlacUVuOO2c4orSeRI2FOro+2AOjvzS
-            XgGkpLEkrINUIuI27G838z9/9cFUqMqL6MTThuJjUmKphgLAZ1iqhyfEm/2kwXZz
-            oJnnbBWIxN2/vltsuu/WprLHzbL5dBusLiBUeuSbPPron4r9Do2cNcFIT2hyAfA=
-            =1NR0
+            hQIMA7uy4qQr71wiAQ/9GZ0NMlA2Vyh4RtFbvJvZBZkSHg0L5w7K9txYAcyKr017
+            uZm/UCgp9ohQK5DKg472EzevniIdGmA907ypV5BAtsXJt6KIkmA7RLTdIw8FwTeL
+            kJaN0jvijShaV5c1Wt5HlRHl/zVjil7Hokq6Q8fp4iz+MJ7H3U+5c6ElT2xE7YWf
+            H2FYKsQlgHAjd3KlQvECsn4fOO7wKhIs9qNhvA5c503gyOtRq2cR5IiFQiwzKJLq
+            5tzN4SROfWUrO7FfqXlkqsFNSn51SAOtkzqc2osbXmZH6s84ZJzgAow3SVZ7/ZQb
+            NqK1CfLauhL/RBb3sgKZBOX8zhC0gdRb0NKlothMx4sjo0Ao1fMlzgc/FpDlnf8U
+            CSVbE2u3K2Q4tUKEKCmIOdLzT+uthnQSvumXbt5d7Hj73wBM56P2sZGs244+SF11
+            SStk9yiYkQSwoCDS/0MHS9cP7p2Jx0dtcqrM1g94ACGJFLbplOuqQh/UYDofi7XA
+            8UOePz6KRevU7tJZ0bV44j3BMPiSHLwJA8Xlld38pTVxx4hbWeffW3DcjZpLXJqW
+            Dyz3EtGv9mHB0MoGzj1Djlhb01wNj1g/VHqDonugp0h8DDx4uwZHXiiF8c5qOdTy
+            z/q7lljNT3FxiwYEmAs3yo+RmxbVSLMzSUu/p37VtCOJigB0+1WPbg1wFWwd67HS
+            XAF1CpLZiCr1ZaCRbNBT6CXuyUwjYeSd+OXq3MTOGZD81xvYKxbs4mRdzSlpxCQ9
+            tObUsjTWMf/0q3zPU0mN74hNLrz7Z5ywol/j1IMKpy1B4Q8CuQmfL0zjyMY6
+            =3su6
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
    version: 3.10.2
@@ -0,0 +1,81 @@
+# Certificates managed by cert-manager
+# These will automatically renew before expiry
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: vhaudiquet-fr
+  namespace: caddy
+spec:
+  secretName: vhaudiquet-fr-tls
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: vhaudiquet.fr
+  dnsNames:
+    - vhaudiquet.fr
+  duration: 2160h # 90 days
+  renewBefore: 360h # 15 days before expiry
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: wildcard-vhaudiquet-fr
+  namespace: caddy
+spec:
+  secretName: wildcard-vhaudiquet-fr-tls
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: "*.vhaudiquet.fr"
+  dnsNames:
+    - "*.vhaudiquet.fr"
+  duration: 2160h # 90 days
+  renewBefore: 360h # 15 days before expiry
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: semery-fr
+  namespace: caddy
+spec:
+  secretName: semery-fr-tls
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: semery.fr
+  dnsNames:
+    - semery.fr
+  duration: 2160h # 90 days
+  renewBefore: 360h # 15 days before expiry
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: wildcard-semery-fr
+  namespace: caddy
+spec:
+  secretName: wildcard-semery-fr-tls
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: "*.semery.fr"
+  dnsNames:
+    - "*.semery.fr"
+  duration: 2160h # 90 days
+  renewBefore: 360h # 15 days before expiry
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: buildpath-win
+  namespace: caddy
+spec:
+  secretName: buildpath-win-tls
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: buildpath.win
+  dnsNames:
+    - buildpath.win
+  duration: 2160h # 90 days
+  renewBefore: 360h # 15 days before expiry
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - certificates.yaml
@@ -0,0 +1,109 @@
+# Caddy Routes - External ConfigMap
+# This file contains all route definitions, imported by the main Caddyfile.
+# Edit this file to add/modify routes.
+#
+# Certificate files are mounted from cert-manager-managed TLS Secrets
+# at /etc/caddy/certs/
+
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: caddy-routes
+  namespace: caddy
+  labels:
+    app.kubernetes.io/name: caddy
+    app.kubernetes.io/component: routes
+data:
+  Caddyfile: |
+    vhaudiquet.fr {
+      tls /etc/caddy/certs/vhaudiquet-fr/tls.crt /etc/caddy/certs/vhaudiquet-fr/tls.key
+      reverse_proxy traefik.traefik.svc.cluster.local.:80
+    }
+
+    *.vhaudiquet.fr {
+        tls /etc/caddy/certs/wildcard-vhaudiquet-fr/tls.crt /etc/caddy/certs/wildcard-vhaudiquet-fr/tls.key
+
+        # Kubernetes services (via Traefik)
+        @authentik   host authentik.vhaudiquet.fr
+
+        @auth-nook   host auth-nook.vhaudiquet.fr
+        @nook-mg     host n.vhaudiquet.fr
+        @nook        host nook.vhaudiquet.fr
+        @sse-nook    host sse-nook.vhaudiquet.fr
+        @inbox-nook  host inbox-nook.vhaudiquet.fr
+
+        @gitea       host git.vhaudiquet.fr
+
+        @flux-wh     host flux-webhook.vhaudiquet.fr
+
+        @photos      host photos.vhaudiquet.fr
+
+        @umami       host umami.vhaudiquet.fr
+
+        @pkgatlas    host pkgatlas.vhaudiquet.fr
+
+        handle @authentik {
+            reverse_proxy traefik.traefik.svc.cluster.local.:80
+        }
+        handle @auth-nook {
+            reverse_proxy traefik.traefik.svc.cluster.local.:80
+        }
+        handle @nook-mg {
+            reverse_proxy traefik.traefik.svc.cluster.local.:80
+        }
+        handle @nook {
+            reverse_proxy traefik.traefik.svc.cluster.local.:80
+        }
+        handle @sse-nook {
+            reverse_proxy traefik.traefik.svc.cluster.local.:80
+        }
+        handle @inbox-nook {
+            reverse_proxy traefik.traefik.svc.cluster.local.:80
+        }
+        handle @gitea {
+            reverse_proxy traefik.traefik.svc.cluster.local.:80
+        }
+        handle @flux-wh {
+            reverse_proxy traefik.traefik.svc.cluster.local.:80
+        }
+        handle @photos {
+            reverse_proxy traefik.traefik.svc.cluster.local.:80
+        }
+        handle @umami {
+            reverse_proxy traefik.traefik.svc.cluster.local.:80
+        }
+        handle @pkgatlas {
+            reverse_proxy traefik.traefik.svc.cluster.local.:80
+        }
+
+        # Docker VM services (via Docker Traefik)
+        @alexscript     host alexscript.vhaudiquet.fr
+        @clips          host clips.vhaudiquet.fr
+        @jellyfin       host flix.vhaudiquet.fr
+
+        handle @alexscript {
+            reverse_proxy 10.1.2.212:80
+        }
+        handle @clips {
+            reverse_proxy 10.1.2.212:80
+        }
+        handle @jellyfin {
+            reverse_proxy 10.1.2.212:80
+        }
+
+        # Stalwart WebUI (now in Kubernetes, via k8s Traefik)
+        @mail           host mail.vhaudiquet.fr
+        handle @mail {
+            reverse_proxy traefik.traefik.svc.cluster.local.:80
+        }
+    }
+
+    semery.fr {
+      tls /etc/caddy/certs/semery-fr/tls.crt /etc/caddy/certs/semery-fr/tls.key
+      reverse_proxy traefik.traefik.svc.cluster.local.:80
+    }
+
+    buildpath.win {
+      tls /etc/caddy/certs/buildpath-win/tls.crt /etc/caddy/certs/buildpath-win/tls.key
+      reverse_proxy traefik.traefik.svc.cluster.local.:80
+    }
@@ -5,7 +5,6 @@ resources:
  - namespace.yaml
  - repository.yaml
  - release.yaml
-  - certificates-secret.yaml
  - caddyfile.yaml
 secretGenerator:
  - name: caddy-values
--- a/Show More
+++ b/Show More