dns: add pkgatlas.vhaudiquet.fr A record

Caddy's wildcard *.vhaudiquet.fr vhost already routes the host to the
in-cluster Traefik and on to the pkgatlas ingress.

dns/production/vhaudiquet.fr.yaml

@@ -383,6 +383,13 @@ photos:
   ttl: 300
   type: A
   value: 82.64.154.58
+pkgatlas:
+  octodns:
+    cloudflare:
+      auto-ttl: true
+  ttl: 300
+  type: A
+  value: 82.64.154.58
 sse-nook:
   octodns:
     cloudflare:

infra/kube/manifests/cilium/values.yaml

@@ -31,6 +31,11 @@ l2announcements:
     enabled: true
 externalIPs:
     enabled: true
+# Single-node cluster: the operator defaults to 2 replicas, but both
+# bind the same host ports, so the second replica can never schedule ("node(s)
+# didn't have free ports for the requested pod ports") and sits Pending forever.
+operator:
+    replicas: 1
 ingressController:
     enabled: false
     loadbalancerMode: shared

infra/r740/docker/main.tf

@@ -2,7 +2,7 @@ terraform {
   required_providers {
     docker = {
       source  = "kreuzwerker/docker"
-      version = "3.6.2"
+      version = "3.9.0"
     }
   }
 }

kubernetes/dev/gitea/values-actions.yaml

@@ -44,17 +44,15 @@ statefulset:
                 docker_timeout: 300s
                 # Hard per-job caps (docker create args). Slightly below the
                 # dind limits so the daemon and image cache keep headroom.
-                options: --memory=7g --cpus=3
+                options: --memory=7g --cpus=1
     dind:
         resources:
             requests:
                 cpu: 250m
                 memory: 512Mi
             limits:
-                cpu: 4
+                cpu: 1500m
                 memory: 8Gi
-    # Same failover tolerations/affinity as the gitea release, so runners can
-    # be scheduled wherever Gitea itself runs (p330 during r740 outage).
     tolerations:
         - key: ENC[AES256_GCM,data:wLfr0r+e9KYm,iv:BGZnWKQUlOje9RhAs7tBDzNcDt5LcfTnqRSqrdFc/A4=,tag:bb1f7NwEwmEzrf5k9ivFPg==,type:str]
           operator: Equal

kubernetes/dev/gitea/values.yaml

@@ -17,69 +17,33 @@ valkey-cluster:
 # Use standalone Valkey (replaces 'redis' in chart 12.x)
 valkey:
     enabled: true
-    master:
+    primary:
         resources:
             requests:
                 cpu: 100m
-                memory: 128Mi
+                memory: 256Mi
             limits:
                 cpu: 500m
-                memory: 256Mi
+                memory: 1Gi
-        tolerations:
-            - key: ENC[AES256_GCM,data:fXEKv6sROAEz,iv:ausWhm1zJdx+Mu26pauhi5G+ODZqLZ27SmfkAuMUtYY=,tag:cNYyeG09Hk++uED5M0TBKw==,type:str]
-              operator: Equal
-              value: ENC[AES256_GCM,data:7CfH8Lrr7S0=,iv:dv5f/cN1VI2NLQsAYqF2hGEjVjxTnHGXFfNQyCL1KIc=,tag:HTiQN/wZU/mXSHvaz2KqRg==,type:str]
-              effect: NoSchedule
-            - key: ENC[AES256_GCM,data:2l4bXqCigZWkqfm6zvba/aOwC6zXYd0lufMUrrHA3YZm1/0IXw==,iv:70oryMEsl0nnZz1q4OHHHgjRswmyvLZI9Y6tk0elM5Q=,tag:2/EHDIcaDTSGWl3qRVW8oQ==,type:str]
-              operator: Exists
-              effect: NoSchedule
-        affinity:
-            nodeAffinity:
-                preferredDuringSchedulingIgnoredDuringExecution:
-                    - weight: 100
-                      preference:
-                        matchExpressions:
-                            - key: ENC[AES256_GCM,data:dc00KQOBXn587h22VlooFY5ZjbE=,iv:kX5utMKu8uoUSeameD2R0iH+DU/3YXuwP8DaZs9mGYs=,tag:PM5xBnYaP84zMZ2SWTYV+A==,type:str]
-                              operator: NotIn
-                              values:
-                                - "true"
 postgresql:
     enabled: true
     global:
         postgresql:
             auth:
-                postgressPassword: ENC[AES256_GCM,data:3aHXAFDqpYsWeg==,iv:qbrm+izSr+PaAa4fHMVw3Yz0qMuisRMpDxVKdeFSvls=,tag:zVUVALdIUTMhxavsSxlUCw==,type:str]
+                postgressPassword: ENC[AES256_GCM,data:AGdZp0KNk6+v+w==,iv:dc7B8GYA1hlC6VgO1m3jdHimIVb4QeR1DTmh9kqRDa4=,tag:JEFWOgvgvUDJ+S9yS446cA==,type:str]
-                password: ENC[AES256_GCM,data:LCfnttYbxS34WA==,iv:rqU044P/gUmqjhmu+A9B7A64ujnkIhMpKQlYpcmi8MY=,tag:XJws85qfKI+y0BV6S4L1Ig==,type:str]
+                password: ENC[AES256_GCM,data:kuR59jqrN/YFmA==,iv:qAIwiTzi2Fr9R9fIc3sfPqhIHSPI8K3eNmed8DBm7PQ=,tag:hf7CMUissSbO4RVn+kRUJw==,type:str]
                 database: gitea
-                username: ENC[AES256_GCM,data:QDo83dk=,iv:RvuuDiiY1XLZbrjcJ/ANxb/wHrSdf1gaBSck+cMaWhY=,tag:UCEAkWZ2Dmr93oBATQdf8g==,type:str]
+                username: ENC[AES256_GCM,data:rCEYTAA=,iv:zeWzB+vpMl+oGUfQRPYFneLwnXF7Dlg4XAYB4QynAyk=,tag:zqJDiBiKJJIDgNKdOtGlMg==,type:str]
     volumePermissions:
         enabled: true
     primary:
         resources:
             requests:
-                cpu: 250m
+                cpu: 100m
                 memory: 256Mi
             limits:
-                cpu: 1000m
+                cpu: 500m
                 memory: 1Gi
-        tolerations:
-            - key: ENC[AES256_GCM,data:NplaOmBekcB+,iv:qzQ+QasVZ2JMG87PgdVDJ/7XHDiDXTp+ogxB1w4tws4=,tag:aPyaqwdxVEjct7D3SuKFqw==,type:str]
-              operator: Equal
-              value: ENC[AES256_GCM,data:vjsM3Li0p/8=,iv:Y+sjLHWpqwsOJV+vygG2f/3ZXQs2ZQRloPrlcOuzoeM=,tag:t+uR2/uM4NiIq6alJjio9g==,type:str]
-              effect: NoSchedule
-            - key: ENC[AES256_GCM,data:LQvczGKAK2x1BbFr7S8jo0G7YUaX4DJvc+1Z2E+bCjys4PsBHg==,iv:m4Ses50zYxTF7jXTgbf9nY0kT1hrtgVEEQruLZFN8cU=,tag:UidEMRbb0IPb5V31FjWzYg==,type:str]
-              operator: Exists
-              effect: NoSchedule
-        affinity:
-            nodeAffinity:
-                preferredDuringSchedulingIgnoredDuringExecution:
-                    - weight: 100
-                      preference:
-                        matchExpressions:
-                            - key: ENC[AES256_GCM,data:D9N+Fd/g24bKikLdx4WE57WvqE4=,iv:+1oYCzAl6kBJliw0woWhhWT7aWcx4rXkGDn7Anho2Pg=,tag:R+cLK75QCIfWeGL8/eqeFA==,type:str]
-                              operator: NotIn
-                              values:
-                                - "true"
         livenessProbe:
             enabled: true
             initialDelaySeconds: 30
@@ -99,6 +63,7 @@ postgresql-ha:
 persistence:
     enabled: true
     subPath: data
+    size: 30Gi
 extraVolumes:
     - name: git
       nfs:
@@ -112,8 +77,8 @@ gitea:
     oauth:
         - name: Authentik
           provider: openidConnect
-          key: ENC[AES256_GCM,data:cYaRMEtrziMJWIRj3dg1fuMpp6F3t5ZDO/H2ONOQCg/fZ8s0ZsLb6Q==,iv:VskJ+5Rwpnys0nH531FYZIj253lJqDz1l6sgwKWhE1s=,tag:F3Wj1ruwSwlC5XbVKt1aCQ==,type:str]
+          key: ENC[AES256_GCM,data:LekdKlJJX6AYZX2PgooenJtANvE8HNdzePN9yeljrnoKV7pbexDnAw==,iv:pZm4+Dj2uqprBRIgchq78nEzqkC/zVoiyRK0cj98WPo=,tag:iSiuwP8N6BBVeGWS54j+dw==,type:str]
-          secret: ENC[AES256_GCM,data:Cro9iaXKcv+uP4G6jEX0tPBW9cjxaZUmnLEVyE72j34aeAAmDFgPiTE/VWSbD3WWK8tuErl0RFHMvHiN63f4W5hq38W9VMP31JDCUYcUbkFBmQg2hrt6ePajZZICR1gHB3D7t5av4pl13O490VByGWfr8OxAK8Z/cGojp/Pt4mo=,iv:nRvFSVRSKFvpNjGmJq6uh/JV3acLsipV0nUHAlt+t80=,tag:BZ7eJiSVCM8J+MY+I5Z48g==,type:str]
+          secret: ENC[AES256_GCM,data:J7WJghH6Xp9Fg3Y+PO1lN1mEEJ0HbVSM1YP2d8//NX2xmYK/PK1y6xSVQ4+VSsYTZhIAM3ZXVrBE/5smuNLUZkoj2EKY275fXcN2kOkEwiftdsJHSKdevCtO57TQipJToh6mfLxz51LDxpz85rVNj4Rvra1d9UvC5x1nUBm8AR0=,iv:lMiMQGsKn4ZxFctakj5MyVlX+8Wu93d5wM9cIqEBhSc=,tag:CkuTAGJqg+dUzyP9z5gwzw==,type:str]
           autoDiscoverUrl: https://authentik.vhaudiquet.fr/application/o/gitea/.well-known/openid-configuration
     config:
         APP_NAME: Gitea
@@ -142,55 +107,34 @@ gitea:
 # Resource limits for Gitea container
 resources:
     requests:
-        cpu: 250m
+        cpu: 100m
         memory: 512Mi
     limits:
-        cpu: 1000m
+        cpu: 500m
         memory: 1Gi
-# Increase replica count is not useful for 1-node cluster
 replicaCount: 1
-# Failover tolerations + affinity — allow scheduling on p330 during r740 outage
-tolerations:
-    - key: ENC[AES256_GCM,data:1O2rrNCMxkGV,iv:dLwAP4NFVRZ0IUNzARm7hPq+ruIshtpXfUVtuuRP3/o=,tag:EmKs8LItQFLoPov8MMjfgw==,type:str]
-      operator: Equal
-      value: ENC[AES256_GCM,data:l0WXlDcRWaY=,iv:F3AxSbB9t/q3L6yOI4NcHlNzZrDwJqiJ/jjfLrQlNAE=,tag:6s/WqyWjNLHHmExGmgl65g==,type:str]
-      effect: NoSchedule
-    - key: ENC[AES256_GCM,data:RtKkkyNv0zO/IezcKaBBp5Ir9mCBacgVqjFIGyq13U68sU4z5g==,iv:sFr2v6kFKOm2ID73GpxACTvQttvt7fYwg437N7D2Scg=,tag:aPCpFti/jY/0a1FEWF/g4w==,type:str]
-      operator: Exists
-      effect: NoSchedule
-affinity:
-    nodeAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-            - weight: 100
-              preference:
-                matchExpressions:
-                    - key: ENC[AES256_GCM,data:jW8/VevqdIAXrBAMj58udice6HM=,iv:+6nTdgB2io+H6S/jyO4Fc/+VfoyGIY+dqphi6ZNIn3c=,tag:JKJveLWX8pjMN3cnO94UwQ==,type:str]
-                      operator: NotIn
-                      values:
-                        - "true"
-# (postgresql and valkey tolerations are set in their respective blocks above)
 sops:
-    lastmodified: "2026-08-26T19:28:03Z"
+    lastmodified: "2026-09-22T20:35:36Z"
-    mac: ENC[AES256_GCM,data:hb8HlzvsAU+6A2C4MARpF2j+Mv55mQ25SOjJIo6inV822IskVV+0Ml9I6WS8RK6ZNZAdnVcDtQ07JlGx9QRiIwxAE0xxwuhukhSBBjeHGAc39RPhLXhDvwUF5ZeouGixkVrA5lhAvHiu9ILv241G1st0J9qK/ZaIsTazQN4X3iY=,iv:1ehf3avfeV4Ro8rw0rsFQ0qnFXrvF66tUKqqCY+NXSc=,tag:5kXUpLrLGPbwNSBC+aVIwA==,type:str]
+    mac: ENC[AES256_GCM,data:xGtSdlGuJL3qSbnfbh/ON1q3c+n6l991fCy9t9ZLnrvSrU15vkK/WVHh84V132C72pEakwRy8nFcUl7KT3C3J2l2uJHJyDWDqA8NTvHq7FAcomKGKpNOqAOFXVUKSr6O4BtQr9x6h4jzAZSlpaTx3GEiLRzygSkZmcEcaXZ6/hU=,iv:JfQ3W3UZV1m1SkapNmUpZ1lkxgTs5F0auXukupK/yAg=,tag:xCNpJUc5mPv2dBhS+ob+fA==,type:str]
     pgp:
-        - created_at: "2026-08-26T19:28:03Z"
+        - created_at: "2026-09-22T20:35:36Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ/9FF5SJAVg0dLi/+xQreE2yrxMH4GTfdBMHd3GWEVLYger
+            hQIMA7uy4qQr71wiAQ/8DiM04ZZ18qFndWSlo+hHV05hlt7GmwG9dx/3xEXgpdEb
-            6XwXQ7+Qx3mxf+VprmNGOW7NdKSsC5Re/JHJAjs7p+eWohtieOgKtg7DWEcrTwZA
+            TkA3HNi5rUMvA8j/mStmP4sZiqrxlPk9sdMtVsPAppT3qAihcF3DyyUFYkSoY3oF
-            56Rnhtnh0vv2jqmv/pm/Cj49GCLTjQFY+w5azU7g/7eQZpdPezIdrs1ueiSm6LaU
+            Et5qeeC6DP1aKdsgAQVVZyeLy7l/CbO5CYORm5+TuGmnr0HxN1qZimbF15pspvNN
-            T9bMdUzm1pb7/JKQMvzYyPcuw0AfKLlg+x7HHRNI3O434yKuTLC5emVxJEmwQvV4
+            9pprI7XDKb6QEbXhADN9gafNwTIQgv3LGQVdoQgfyzZEcQR8O5bxUFTwdR9LO646
-            FD6oUAt4gKLqUHvAUuCVo8O5G36MGHO/roHxlWaLbHqjaDPyWh2TGdX0ICKKq1yc
+            zogHuQfPC70jpA2IRxdBHuSTjDkZimyehsKPzq7MpBso/85q3q1TlSQKJsjxZWrZ
-            fJzw9dYgcwIMXpXilbnsL4gQpv6bKj6VniyCoye6ieMZ2HIoZghd+wL0NoPkS7Nj
+            NBKmEhL/Q4M+8mj+N/aVFJldIUF2Juto5d2BUuIG/lBtNL2QHdiJN3Rxc1gL4qP2
-            D+vTcPR8HOEWoZkZ4B01+bFyTmJ5NA8Z0V3peHkuTy+HCTgwxA0Y8PCrHl3YHsCQ
+            eZYESQ6IRXAycUXAQgMJf5p/lhgmVjv8b3lhKSFJq66hZyo5g6wdhLIEunPglNbP
-            C3nANhh+cMqtcJdvqdGrM09X8n3edNc4lf+qg2tk0NbcdVSqcFl9y/MeJOWhOOg3
+            BcJXUbl5SScTgOAi9o/soezUuggvzgg3zwM38PAghve1/j0rL7EupYX+u2v7zbUH
-            T/bwBrI5O7aRO6gqaCebKuGIrD1PDNURW3LLiKBSU4OTYbMWWXGpdEMCkoSQS56B
+            BA7T30SnkvDCmTzW4+Sac1dg/w06u+4oSGTNnTuKOzmzfIjGlwkJeAtPVcvSFAgK
-            6Uo9N8KcWhBChCMJG8hbzYRVwYgWGsHsQbfbujkcIiSaoHGy8fklflxBjtLiitLO
+            TCKDmvtkPWUxGrxjBbJZUwqCp4HEOwOp6HeGeNbWFZ2UU+JTvTizkxbReN37Q4+f
-            voawf0zSqyBKbf1YFAmYnrdR0jiasKC5iqtK7c8uc/HyCSvxjK0ygPloWFI8aSPS
+            8oIyQuyRpDHgDV5IrbDtCcqWsEFpUXyi8snIMDTCkKdLZv1WjYhjoNmvOoRagQvS
-            XgFJiWHT/5gOG64XmDm0VoKdflpojJeTGIC5JU8RAlJgD/oq+uWt23ayJxkjbkMd
+            XgEQDrDBeC3HZvUuvqMqgmHI+IEjmpad1CNVGE2q7FnAhFYutjBGF78co2X9t+ib
-            H7UsqcuzWfbp44MYtmEWbxvI/+Iaui5/7hW7kEzWI60Mh4tVZGIJ64A3WNRL/Xw=
+            B9o6aIwPzS4ANsh47rupGDBt/x46RCorCYhCaJm4B3v0+tYSA7mSBoHQwp1p+AY=
-            =U5nI
+            =kRPK
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
     encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$

kubernetes/dev/pkgatlas/kustomization.yaml

@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: pkgatlas
+resources:
+  - namespace.yaml
+  - repository.yaml
+  - release.yaml
+secretGenerator:
+  - name: pkgatlas-values
+    files:
+      - values.yaml=values.yaml
+configurations:
+  - kustomizeconfig.yaml

kubernetes/dev/pkgatlas/kustomizeconfig.yaml

@@ -0,0 +1,6 @@
+nameReference:
+- kind: Secret
+  version: v1
+  fieldSpecs:
+  - path: spec/valuesFrom/name
+    kind: HelmRelease

kubernetes/dev/pkgatlas/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+    name: pkgatlas

kubernetes/dev/pkgatlas/release.yaml

@@ -0,0 +1,22 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+    name: pkgatlas
+    namespace: pkgatlas
+spec:
+    interval: 1m
+    chart:
+        spec:
+            sourceRef:
+                kind: HelmRepository
+                name: pkgatlas
+                namespace: pkgatlas
+            chart: pkgatlas
+            # CI publishes a timestamped version on every main push and
+            # stamps appVersion with the commit SHA of the image it
+            # builds; this range always picks the latest one.
+            version: '>=0.4.0-0'
+            interval: 1m
+    valuesFrom:
+        - kind: Secret
+          name: pkgatlas-values

kubernetes/dev/pkgatlas/repository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+    name: pkgatlas
+    namespace: pkgatlas
+spec:
+    interval: 1m
+    url: https://git.vhaudiquet.fr/api/packages/vhaudiquet/helm

kubernetes/dev/pkgatlas/values.yaml

@@ -0,0 +1,47 @@
+# Chart: https://git.vhaudiquet.fr/vhaudiquet/pkgatlas (chart/pkgatlas).
+# The image ships both binaries (build + serve) and runs as nonroot
+# (uid 65532, distroless). Everything else is chart default: discovery
+# first — build.enabled=false, the first refresh pass builds the whole
+# live rotation and /v1/readyz stays 503 until it lands; weekly
+# refresh after that.
+image:
+    repository: git.vhaudiquet.fr/vhaudiquet/pkgatlas
+ingress:
+    enabled: true
+    className: traefik
+    hosts:
+        - host: pkgatlas.vhaudiquet.fr
+          paths:
+            - path: /
+              pathType: Prefix
+    # TLS terminates at Caddy with the *.vhaudiquet.fr wildcard cert;
+    # Caddy proxies to Traefik by host, so no tls block here (same as
+    # gitea's ingress).
+    tls: []
+sops:
+    lastmodified: "2026-09-24T19:57:42Z"
+    mac: ENC[AES256_GCM,data:cidn6U0EFjuEx98GA8Jlppg3GobcGGrhs20dPoAnUXdpFogfsp3YOTPCKuKi0LrOw/fxBP84U4drx5lJcjL11Ft/Ozn6Z8tk3l8cdqK+BUm6yijtQ0PXHjPUJYNIeqxrQKJzFlVHS+tOARbhQ3DjoNt71WBMfSPUDcPxrbnwVAA=,iv:Yz85yh9jrLXf6DKeVmOLeiVCWcthKCPGCJJwR3RVikg=,tag:7Mdv4VZUpsjuysitx4b2DA==,type:str]
+    pgp:
+        - created_at: "2026-09-24T19:57:42Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ/+N+gGPOCbuxleT6xx0FduVN1vspYJlCyrtLsy632Yz17x
+            ucwqSuGciqUf2kF3GwnOzINEY0eLskbKHMX5wkbJg8+X6dXoRyiseX3fdNrpvMGR
+            P1ZC/C4O6BzQoPJOXDQZHuWPI0Imx61PlzDPzsJ44JBvwrkCKgoaWOvzMyTjZHiC
+            iplyHpzDR2sqfMe29aQICrEV6Z87eMWQ3wie6CzX2OYTj89BejsN2Ibg4n5cqdNO
+            c+mM7Ek2nSWMWYGbdL0W2N6WSIbGuQj/aVbS0s6585NUPJtmcznB7uosRroqfbd2
+            9SMP1gaUOr+00kykRxKtd/ZoW7S/21kGbZ8FwvtKZFrBwcoUuLehbSGAHRYLo6dI
+            5WGeky65IrvpKen8Q/B6o6EByTONt2h+XiyJyLwDLeFh13/ldkGqa1oW+4BTHuX9
+            2WvLOboHpr4MGQdO53Q8zm8VCGAltusII6ZVaoEyjilqZtC/Aa9XZIT/HshOGTQi
+            4CITE1BfGEApOcBbBQKdjYofdWcyuLSF/ertXvcvNiCoVe0wYiHSYUht+HulQ3t+
+            Z0K7C2sJ2bx8C+316b2MzCGVrVOuqDABpQJjIr4aiRG9v8BtYTaUc425CLm9TMtA
+            PmZR1Rqowy4ECekrbvk3lNjPoq13HLSqkm2ppL9WFub5zY2XY0npprSeUknTmSDS
+            XgGFDhcroUq0vTUlJbC015kpa6cpynwTmMuQrFaMPeKeBPkL4Le6QFJMjpIi3yg3
+            65bSBv5t7YXoHFJWVFYej005Lz1lxp1VtaMiA0bnKEnyh/SbfcUqD4d9P1WNx+4=
+            =ulvs
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
+    version: 3.10.2

kubernetes/infrastructure/caddy/caddyfile.yaml

@@ -40,6 +40,8 @@ data:
 
         @umami       host umami.vhaudiquet.fr
 
+        @pkgatlas    host pkgatlas.vhaudiquet.fr
+
         handle @authentik {
             reverse_proxy traefik.traefik.svc.cluster.local.:80
         }
@@ -70,6 +72,9 @@ data:
         handle @umami {
             reverse_proxy traefik.traefik.svc.cluster.local.:80
         }
+        handle @pkgatlas {
+            reverse_proxy traefik.traefik.svc.cluster.local.:80
+        }
 
         # Docker VM services (via Docker Traefik)
         @alexscript     host alexscript.vhaudiquet.fr

kubernetes/infrastructure/caddy/values.yaml

@@ -10,7 +10,7 @@ image:
     repository: caddy
     pullPolicy: IfNotPresent
     tagSuffix: ""
-    tag: 2.11.2
+    tag: 2.11.4
 service:
     type: LoadBalancer
     # Cluster (not Local) so any node can forward to pods on any other node.

kubernetes/infrastructure/cert-manager-webhook-ovh/release.yaml

@@ -12,7 +12,7 @@ spec:
         name: cert-manager-webhook-ovh
         namespace: cert-manager
       chart: cert-manager-webhook-ovh
-      version: "v0.9.13"
+      version: "0.9.16"
       interval: 1m
   valuesFrom:
     - kind: Secret

kubernetes/infrastructure/mail/stalwart/release.yaml

@@ -14,7 +14,7 @@ spec:
         name: stalwart-helm
         namespace: stalwart
       chart: stalwart
-      version: "0.7.5"
+      version: "0.7.18"
       interval: 1m
   valuesFrom:
     - kind: Secret

kubernetes/infrastructure/mail/stalwart/values.yaml

@@ -7,7 +7,7 @@
 # Container image
 image:
     repository: stalwartlabs/stalwart
-    tag: v0.16.20
+    tag: v0.16.22
     pullPolicy: IfNotPresent
 # Single-node RocksDB deployment.
 replicaCount: 1

kubernetes/kustomization.yaml

@@ -29,12 +29,14 @@ resources:
   - dev/gitea
   - dev/harbor
   - dev/renovate
+  - dev/pkgatlas
   # Home (home automation)
   - home/home-assistant
   - home/zigbee2mqtt
   # Personal (apps storing my own content, grouped by content type)
   - personal/paperless
   - personal/radicale
+  - personal/syncthing
   - personal/media/photoprism
   - personal/notes/notesnook
   - personal/notes/obsidian-livesync

kubernetes/personal/openclaw/kustomization.yaml

@@ -5,5 +5,6 @@ resources:
   - openclaw-instance.yaml
   - openclaw-secrets.yaml
   - networkpolicy.yaml
+  - networkpolicy-lan-egress.yaml
   - networkpolicy-mail-egress.yaml
   - networkpolicy-radicale-egress.yaml

kubernetes/personal/openclaw/networkpolicy-lan-egress.yaml

@@ -0,0 +1,39 @@
+# Supplementary egress policy: the operator's managed default-deny NetworkPolicy
+# only allows DNS (53) and TCP 443 outbound, so any other port toward the local
+# network is dropped. That blocks the OpenClaw pod from reaching LAN services
+# that do not speak HTTPS on 443. Measured from inside the pod against
+# 10.4.1.222, 443 returns RST (admitted, nothing listening) while 7020 times
+# out, which shows LAN routing works and only the port is being refused.
+#
+# The egress rule below sets no `ports`, because the goal is arbitrary LAN
+# services rather than one known port. Cluster CIDRs are excluded so this does
+# not become a blanket "any pod, any port" grant; the LAN is what gets admitted.
+# Note this is additive to the operator's rules, so DNS and 443 everywhere still
+# hold.
+#
+# Written as a sidecar policy rather than via the CR fields
+# spec.security.networkPolicy.additionalEgress / allowedEgressCIDRs, matching
+# the existing networkpolicy-mail-egress / -radicale-egress pattern. Those CR
+# fields DO appear in the 0.39.0 CRD template, contrary to the comments on the
+# sibling policies, so they are worth retrying once the installed CRD version is
+# confirmed. Until then the sidecar route is the one known to take effect.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: openclaw-lan-egress
+  namespace: openclaw
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: openclaw
+      app.kubernetes.io/name: openclaw
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - ipBlock:
+            cidr: 10.0.0.0/8
+            except:
+              # Service CIDR and pod CIDR (infra/kube/talconfig.yaml).
+              - 10.96.0.0/12
+              - 10.244.0.0/16

kubernetes/personal/openclaw/openclaw-instance.yaml

@@ -3,6 +3,35 @@ kind: OpenClawInstance
 metadata:
   name: openclaw
 spec:
+  # Pin the gateway image to an immutable version tag. Running `latest` with
+  # pullPolicy=IfNotPresent let a stale node-cached image (old build, state
+  # schema v1) fight the PVC's DB migrated by a newer build (schema v15),
+  # crash-looping the container. Bump this tag alongside upstream releases.
+  image:
+    repository: ghcr.io/openclaw/openclaw
+    tag: "2026.9.3"
+  # Workaround for paperclipinc/openclaw-operator#607: the operator mounts the
+  # PVC root directly at /home/openclaw/.openclaw and only fsGroup is applied,
+  # so the mount root stays owned by root. OpenClaw >= 2026.9 fchmods its config
+  # dir when writing openclaw.json, which fails with EPERM for a non-owner.
+  # This one-shot init container chowns the mount root to the pod UID.
+  initContainers:
+    - name: fix-data-owner
+      image: docker.io/library/busybox:1.37
+      command: ["sh", "-c", "chown 1000:1000 /data && ls -ld /data"]
+      securityContext:
+        runAsUser: 0
+        runAsNonRoot: false
+        allowPrivilegeEscalation: false
+        readOnlyRootFilesystem: true
+        capabilities:
+          drop: ["ALL"]
+          add: ["CHOWN"]
+        seccompProfile:
+          type: RuntimeDefault
+      volumeMounts:
+        - name: data
+          mountPath: /data
   # Provider API keys come from the SOPS-encrypted Secret below.
   # The gateway token is auto-generated by the operator (no mDNS pairing in k8s).
   envFrom:

kubernetes/personal/paperless/postgres-release.yaml

@@ -12,7 +12,7 @@ spec:
         name: cloudpirates
         namespace: paperless
       chart: postgres
-      version: "0.20.0"
+      version: "0.20.5"
       interval: 1m
   valuesFrom:
     - kind: Secret

kubernetes/personal/paperless/redis-release.yaml

@@ -12,7 +12,7 @@ spec:
         name: cloudpirates
         namespace: paperless
       chart: redis
-      version: "0.34.16"
+      version: "0.35.1"
       interval: 1m
   valuesFrom:
     - kind: Secret

kubernetes/personal/radicale/release.yaml

@@ -12,7 +12,7 @@ spec:
         name: derwitt
         namespace: radicale
       chart: radicale
-      version: "2.1.0"
+      version: "2.1.1"
       interval: 1m
   valuesFrom:
     - kind: Secret

kubernetes/personal/syncthing/kustomization.yaml

@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: syncthing
+resources:
+  - namespace.yaml
+  - repository.yaml
+  - release.yaml
+secretGenerator:
+  - name: syncthing-values
+    files:
+      - values.yaml=values.yaml
+configurations:
+  - kustomizeconfig.yaml

kubernetes/personal/syncthing/kustomizeconfig.yaml

@@ -0,0 +1,6 @@
+nameReference:
+  - kind: Secret
+    version: v1
+    fieldSpecs:
+      - path: spec/valuesFrom/name
+        kind: HelmRelease

kubernetes/personal/syncthing/namespace.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: syncthing
+  labels:
+    app.kubernetes.io/name: syncthing
+    app.kubernetes.io/component: file-sync

kubernetes/personal/syncthing/release.yaml

@@ -0,0 +1,19 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: syncthing
+  namespace: syncthing
+spec:
+  interval: 1m
+  chart:
+    spec:
+      sourceRef:
+        kind: HelmRepository
+        name: k8s-home-lab
+        namespace: syncthing
+      chart: syncthing
+      version: "5.2.0"
+      interval: 1m
+  valuesFrom:
+    - kind: Secret
+      name: syncthing-values

kubernetes/personal/syncthing/repository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: k8s-home-lab
+  namespace: syncthing
+spec:
+  interval: 1h
+  url: https://k8s-home-lab.github.io/helm-charts/

kubernetes/personal/syncthing/values.yaml

@@ -0,0 +1,152 @@
+# Syncthing continuous file synchronization
+#
+# Sync ports (22000 TCP+QUIC, 21027 UDP) are exposed through LoadBalancer
+# services on the dedicated Cilium pool IP 10.2.2.7 (appended to
+# kubernetes/system/cilium/pool.yaml). The GUI goes through Traefik like the
+# other *.lan services.
+controller:
+    replicas: 1
+image:
+    repository: syncthing/syncthing
+    tag: "2.1"
+env:
+    - name: TZ
+      value: Europe/Paris
+    - name: PUID
+      value: "1000"
+    - name: PGID
+      value: "1000"
+podSecurityContext:
+    fsGroup: 1000
+service:
+    main:
+        ports:
+            http:
+                port: 8384
+    # Sync protocol and QUIC share 22000 on the pooled IP; LAN discovery
+    # rides on UDP 21027. externalTrafficPolicy Local preserves client IPs.
+    listen:
+        enabled: true
+        type: LoadBalancer
+        externalTrafficPolicy: Local
+        loadBalancerIP: 10.2.2.7
+        ports:
+            listen:
+                enabled: true
+                port: 22000
+                protocol: TCP
+                targetPort: 22000
+            quic:
+                enabled: true
+                port: 22000
+                protocol: UDP
+                targetPort: 22000
+    discovery:
+        enabled: true
+        type: LoadBalancer
+        externalTrafficPolicy: Local
+        loadBalancerIP: 10.2.2.7
+        ports:
+            discovery:
+                enabled: true
+                port: 21027
+                protocol: UDP
+                targetPort: 21027
+probes:
+    liveness:
+        custom: true
+        spec:
+            httpGet:
+                path: /rest/noauth/health
+                port: http
+    readiness:
+        custom: true
+        spec:
+            httpGet:
+                path: /rest/noauth/health
+                port: http
+ingress:
+    main:
+        enabled: true
+        ingressClassName: traefik
+        annotations:
+            external-dns.alpha.kubernetes.io/enabled: "true"
+        hosts:
+            - host: syncthing.lan
+              paths:
+                - path: /
+                  pathType: Prefix
+persistence:
+    config:
+        enabled: true
+        mountPath: /var/syncthing/config
+        storageClass: longhorn
+        size: 5Gi
+    # Shares are recreated by hand in the GUI after cutover — the instance
+    # boots with a fresh config (see plans/syncthing-docker-to-kube-migration.md):
+    # valentin's folders at /data/valentin/… and sarah's at /data/sarah/…, all
+    # backed by the same TrueNAS exports as the docker stack. Photoprism
+    # already mounts the valentin Photos export concurrently.
+    valentin-documents:
+        enabled: true
+        type: custom
+        mountPath: /data/valentin/Documents
+        volumeSpec:
+            nfs:
+                server: truenas.lan
+                path: /mnt/main_storage/valentin/Documents
+    valentin-photos:
+        enabled: true
+        type: custom
+        mountPath: /data/valentin/Photos
+        volumeSpec:
+            nfs:
+                server: truenas.lan
+                path: /mnt/main_storage/valentin/Photos
+    sarah-documents:
+        enabled: true
+        type: custom
+        mountPath: /data/sarah/Documents
+        volumeSpec:
+            nfs:
+                server: truenas.lan
+                path: /mnt/main_storage/sarah/Documents
+    sarah-photos:
+        enabled: true
+        type: custom
+        mountPath: /data/sarah/Photos
+        volumeSpec:
+            nfs:
+                server: truenas.lan
+                path: /mnt/main_storage/sarah/Photos
+resources:
+    requests:
+        memory: 512Mi
+    limits:
+        memory: 2Gi
+sops:
+    lastmodified: "2026-09-21T22:28:39Z"
+    mac: ENC[AES256_GCM,data:BR4P4s4C9n4bEHryqfHpzzFHxAlKeujFBO2Qhsc4qdkcI5dftJ7jrknWtW0uv1E2Aljp50Mx1Rk4wglaWh3MS/ZnY/1dUxCfKuXOGkv9+mymQxDk6zJLsUNTH7sMr5kzlVWfv3yzXF50HWuiNl71BAv4mtlrtarXS1KVQrCKNaA=,iv:aG9OxDOhwk7xYNbvESNMFnXIjKhbYNO0gvDn1a9QQvc=,tag:QxM3EX8V2KJzosRz5damrw==,type:str]
+    pgp:
+        - created_at: "2026-09-21T22:28:39Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ//cvlMqPSaED2y5dsq8H/W/dqYVOeG7E/ZOuJGaYnImrrp
+            V2W6vPTzQ8QuYTKa1X4aOIlda04n7i2kDQCvpszmdpsU2y0SWtsgOBbyloIU3cAM
+            69HGd1SNqP/FayeZy/hHNvvEjmsgKX/9IV1YBGOcikmd7MqoxgGRgIxXORzY0dBG
+            7oREwV0HubdIBG6Fi6HUyN+Pugftpcumfwtl8ppPUYi1HGKzL5LzIT6gfqXtUcBg
+            8Wl2f0kMZsat1e05sZZah41dg+BAlyDgCRFo/ZQIhzHi28rJkZWG2aZxQfvAFMYJ
+            hUkjVyN7rAO01b2PsXK3bleFjD8iL8PhHY/Rio0/Uizjub7inako2SUd38D7X+ce
+            M1c2GoDVNmwZyXg7jBzb67JxLPn4Ic1kbjUi/JJL22rDzN0pBf6J7ExCpVGxrwK8
+            ++YDD1m/rY3YA8/ioM+pTu3ktEd1zu0T1yFySjgtvX8QVmOkrG1AA8E/N3+pzFWP
+            9wrJJ+yp5CYQl9d3j5LQcOzmvROi0EHjeZY75IHw8NwkyWdnRgWFIPsXxVoSUhSk
+            909RE//BuKSSRd1r9D/4w14Eb9KC74bIsUIflyK2Qs/N3rh9+/O8FS/5saryq7Er
+            GO3oAmFqC2F4Y6zFlmXkr43gBFjCPWl0DxI3uUK/gcw8kBpLSJex3j2sDaLViS/S
+            XgFsDLAjHnEo5DC+xyJQI5xMWsQzx/ASNZdBVLrnYPsRt+YG7qfu3lKNS9ujAG7K
+            ti58fACtT97K8IrUMNyEDGieFz65TYPcie4qILnDt2Hkr6QUEdBR8rvn/8z36D8=
+            =47Rw
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
+    version: 3.10.2

kubernetes/system/cilium/pool.yaml

@@ -8,3 +8,4 @@ spec:
   - cidr: "10.2.2.4/32"
   - cidr: "10.2.2.5/32"
   - cidr: "10.2.2.6/32"
+  - cidr: "10.2.2.7/32"

kubernetes/system/coredns/values.yaml

@@ -1,7 +1,7 @@
 replicaCount: 2
 image:
     repository: coredns/coredns
-    tag: 1.14.3
+    tag: 1.14.7
     pullPolicy: IfNotPresent
 deployment:
     dnsPolicy: ClusterFirst

kubernetes/system/flux/kustomization.yaml

@@ -13,3 +13,5 @@ resources:
   - longhorn-jobs.yaml
   - openclaw-operator.yaml
   - openclaw.yaml
+  - kyverno.yaml
+  - kyverno-policies.yaml

kubernetes/system/flux/kyverno-policies.yaml

@@ -0,0 +1,19 @@
+---
+# Flux Kustomization for Kyverno ClusterPolicies.
+# dependsOn "kyverno" (the controller + CRDs) so the kyverno.io/v2 CRD exists
+# before Flux dry-runs the ClusterPolicy. Without this split, Flux fails the
+# whole Kustomization at dry-run ("no matches for kind ClusterPolicy").
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: kyverno-policies
+  namespace: flux-system
+spec:
+  interval: 5m
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: homeprod
+  path: ./kubernetes/system/kyverno-policies
+  dependsOn:
+    - name: kyverno

kubernetes/system/flux/kyverno.yaml

@@ -0,0 +1,24 @@
+---
+# Flux Kustomization for Kyverno
+# Separate from main homeprod because Kyverno CRDs (installed by the HelmRelease)
+# must be present before the ClusterPolicy can be applied.
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: kyverno
+  namespace: flux-system
+spec:
+  interval: 5m
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: homeprod
+  path: ./kubernetes/system/kyverno
+  # Wait for the admission controller Deployment to be Ready before Flux
+  # considers this Kustomization healthy — this ensures the ClusterPolicy
+  # is applied after the CRDs and controller are live.
+  healthChecks:
+    - apiVersion: apps/v1
+      kind: Deployment
+      name: kyverno-admission-controller
+      namespace: kyverno

kubernetes/system/kyverno-policies/kustomization.yaml

@@ -0,0 +1,12 @@
+---
+# Kyverno ClusterPolicies.
+# Applied by the Flux Kustomization "kyverno-policies" which dependsOn "kyverno"
+# (the controller + CRDs). This split is required because Flux dry-runs every
+# resource in a Kustomization before applying any — the ClusterPolicy references
+# the kyverno.io/v2 CRD that only exists once the kyverno HelmRelease installs.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  # Toggleable emergency relief: strips resources.requests.cpu cluster-wide.
+  # See the file header for the toggle (failurePolicy Ignore/Never) commands.
+  - policy-strip-cpu-requests.yaml

kubernetes/system/kyverno-policies/policy-strip-cpu-requests.yaml

@@ -0,0 +1,121 @@
+---
+# ============================================================================
+# CPU-REQUEST RELIEF — TOGGLEABLE CLUSTER POLICY
+# ============================================================================
+# Emergency relief for CPU-saturated scenarios
+#
+# When ENABLED, this Kyverno ClusterPolicy removes the `resources.requests.cpu`
+# field from every Pod created/updated in the cluster (except Kyverno's own pods,
+# critical kube-system control-plane pods, and the Longhorn instance-manager /
+# engine-image / longhorn-manager, which must keep guarantees so admission and
+# the storage layer keep working). With no CPU request, pods schedule onto
+# whatever capacity is free and burst freely.
+#
+# === TOGGLE ===
+#   The policy is ACTIVE by default (failurePolicy: Ignore = mutate, never block).
+#
+#   DISABLE relief (restore the per-app CPU requests on next Flux reconcile):
+#     kubectl patch clusterpolicy.kyverno.io strip-cpu-requests --type=merge \
+#       -p '{"spec":{"failurePolicy":"Never"}}'
+#   # failurePolicy: Never tells Kyverno to skip the rule without mutating, so the
+#   # original CPU requests from each HelmRelease are restored on next reconcile.
+#
+#   RE-ENABLE relief (strip requests again):
+#     kubectl patch clusterpolicy.kyverno.io strip-cpu-requests --type=merge \
+#       -p '{"spec":{"failurePolicy":"Ignore"}}'
+# ============================================================================
+apiVersion: kyverno.io/v1
+kind: ClusterPolicy
+metadata:
+  name: strip-cpu-requests
+  annotations:
+    policies.kyverno.io/title: Strip CPU Requests (Emergency Relief)
+    policies.kyverno.io/category: Other
+    policies.kyverno.io/severity: low
+    policies.kyverno.io/subject: Pod
+    policies.kyverno.io/description: >-
+      Removes resources.requests.cpu AND resources.limits.cpu from pods so they
+      can be scheduled on an overloaded single-node cluster. Limits must be
+      stripped too: the LimitRanger admission plugin defaults requests.cpu =
+      limits.cpu whenever a limit exists without a request, so stripping only
+      the request is a no-op. Toggle via spec.failurePolicy:
+      Ignore = active (strip), Never = inactive (restore).
+spec:
+  # Never block a pod if Kyverno admission is itself under pressure.
+  failurePolicy: Ignore
+  # background: true so the backgroundController also mutates ALREADY-EXISTING
+  # pods (not just new/updated ones at admission). This makes the relief take
+  # effect immediately on flip-on, without waiting for a pod restart.
+  background: true
+  rules:
+    - name: remove-cpu-request-from-containers
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      # Keep guarantees for things that must keep running so admission and the
+      # storage layer keep working even while everything else is bursting.
+      exclude:
+        any:
+          - resources:
+              namespaces:
+                - kyverno
+          - resources:
+              namespaces:
+                - kube-system
+              names:
+                # Control-plane static pods (apiserver, scheduler, controller-manager)
+                - kube-apiserver-*
+                - kube-scheduler-*
+                - kube-controller-manager-*
+          - resources:
+              namespaces:
+                - longhorn-system
+              selector:
+                matchLabels:
+                  app: longhorn-manager
+          - resources:
+              namespaces:
+                - longhorn-system
+              selector:
+                matchLabels:
+                  app: instance-manager
+          - resources:
+              namespaces:
+                - longhorn-system
+              selector:
+                matchLabels:
+                  app: engine-image
+      mutate:
+        # `request.object` is available in BOTH admission and background modes:
+        # the backgroundController synthesizes an admission-like request for
+        # existing resources, so the same foreach works for both.
+        # NOTE 1: inside `foreach`, patchStrategicMerge must be an INLINE YAML
+        # mapping — a `|` block scalar is parsed as a string and fails with
+        # "wrong node kind: expected MappingNode but got ScalarNode".
+        # NOTE 2: limits.cpu MUST be stripped together with requests.cpu.
+        # The LimitRanger admission plugin defaults requests.cpu = limits.cpu
+        # whenever a container has a limit but no request, so stripping only
+        # the request is a no-op for any container that declares a limit.
+        foreach:
+          - list: "request.object.spec.containers"
+            patchStrategicMerge:
+              spec:
+                containers:
+                  - name: "{{ element.name }}"
+                    resources:
+                      requests:
+                        cpu: null
+                      limits:
+                        cpu: null
+          - list: "request.object.spec.initContainers || `[]`"
+            patchStrategicMerge:
+              spec:
+                initContainers:
+                  - name: "{{ element.name }}"
+                    resources:
+                      requests:
+                        cpu: null
+                      limits:
+                        cpu: null

kubernetes/system/kyverno/kustomization.yaml

@@ -0,0 +1,17 @@
+---
+# Kyverno controller + CRDs only.
+# The ClusterPolicy lives in a SEPARATE directory (kubernetes/system/kyverno-policies)
+# applied by a SEPARATE Flux Kustomization (kyverno-policies) with dependsOn:
+# kyverno. This split is required because Flux dry-runs every resource in a
+# Kustomization before applying any of them — the ClusterPolicy references the
+# kyverno.io/v2 CRD, which does not exist until this HelmRelease installs it, so
+# bundling them together makes the whole Kustomization fail at dry-run.
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: kyverno
+resources:
+  - namespace.yaml
+  - repository.yaml
+  - release.yaml
+configurations:
+  - kustomizeconfig.yaml

kubernetes/system/kyverno/kustomizeconfig.yaml

@@ -0,0 +1,6 @@
+nameReference:
+  - kind: HelmRepository
+    version: v1
+    fieldSpecs:
+      - path: spec/chart/spec/sourceRef/name
+        kind: HelmRelease

kubernetes/system/kyverno/namespace.yaml

@@ -0,0 +1,10 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: kyverno
+  labels:
+    # Pod Security Admission: Kyverno's own pods run privileged-sidecars/agent.
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/warn: privileged

kubernetes/system/kyverno/release.yaml

@@ -0,0 +1,70 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: kyverno
+  namespace: kyverno
+spec:
+  interval: 5m
+  chart:
+    spec:
+      sourceRef:
+        kind: HelmRepository
+        name: kyverno
+        namespace: kyverno
+      chart: kyverno
+      version: '3.9.1'
+      interval: 5m
+  # Minimal footprint for a single-node cluster:
+  #  - admissionReports disabled (no extra Redis/Postgres)
+  #  - admissionController + backgroundController only (no reports, no
+  #    cleanupController) — the backgroundController lets the ClusterPolicy also
+  #    mutate ALREADY-RUNNING pods (not just new/updated ones), so flipping the
+  #    relief on immediately strips CPU requests from existing workloads.
+  #  - tolerates the control-plane node (allowSchedulingOnMasters=true on p330)
+  #  - low CPU request so Kyverno's own admission doesn't itself deadlock the node
+  values:
+    admissionController:
+      rbac:
+        create: true
+      # Scale to 1 replica on this single-node cluster
+      replicas: 1
+      resources:
+        requests:
+          cpu: 50m
+          memory: 128Mi
+        limits:
+          cpu: 500m
+          memory: 512Mi
+      tolerations:
+        - key: node-role.kubernetes.io/control-plane
+          operator: Exists
+          effect: NoSchedule
+    # The background controller re-applies policies to already-existing resources,
+    # so the CPU-request strip also affects pods that were created BEFORE the policy
+    # (and pods Flux re-applies with their original requests between toggles).
+    backgroundController:
+      enabled: true
+      replicas: 1
+      resources:
+        requests:
+          cpu: 50m
+          memory: 128Mi
+        limits:
+          cpu: 500m
+          memory: 512Mi
+      tolerations:
+        - key: node-role.kubernetes.io/control-plane
+          operator: Exists
+          effect: NoSchedule
+    # Reports/reportsController are for policy-report auditing — not needed for a
+    # one-off relief toggle.
+    reportsController:
+      enabled: false
+    cleanupController:
+      enabled: false
+    # No autoscaling on a single node.
+    autoscaling:
+      admissionController:
+        enabled: false
+      backgroundController:
+        enabled: false

kubernetes/system/kyverno/repository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: kyverno
+  namespace: kyverno
+spec:
+  interval: 5m
+  url: https://kyverno.github.io/kyverno/

kubernetes/system/longhorn/release.yaml

@@ -12,7 +12,7 @@ spec:
         name: longhorn
         namespace: longhorn-system
       chart: longhorn
-      version: '1.12.0'
+      version: '1.12.1'
       interval: 1m
   valuesFrom:
     - kind: Secret

kubernetes/system/longhorn/values.yaml

@@ -1,7 +1,8 @@
 # Longhorn Helm Values
 defaultSettings:
-    # 2 replicas so volumes survive single-node loss
+    # ReplicaCount below is to be updated when cluster node count change.
-    defaultReplicaCount: 2
+    # Single-node clusters can only have 1 replica, multi-node should have 2 or ideally 3 when possible.
+    defaultReplicaCount: 1
     # Allow full disk usage on single-node
     storageOverProvisioningPercentage: 100
     storageMinimalAvailablePercentage: 10
@@ -15,35 +16,28 @@ defaultSettings:
     # set here via the `taintToleration` setting (semicolon-separated `kubectl
     # taint` syntax), not via per-component `tolerations` blocks.
     #
-    # The P330 node is tainted `dedicated=failover:NoSchedule` (see
+    taintToleration: node-role.kubernetes.io/control-plane:NoSchedule
-    # infra/p330/kube/variables.tf). Tolerating it lets Longhorn schedule
-    # engine/replica pods there so a volume can be failed over to the P330.
-    # The control-plane taint is also tolerated defensively, although with
-    # allowSchedulingOnControlPlanes=true on the R740 it is not actually applied.
-    taintToleration: dedicated=failover:NoSchedule;node-role.kubernetes.io/control-plane:NoSchedule
 persistence:
     defaultClass: true
-    defaultClassReplicaCount: 2
+    defaultClassReplicaCount: 1
     # Retain volumes on PVC delete — safer during migration
     reclaimPolicy: Retain
     # Mount options for ext4
     fstype: ext4
-# longhorn-manager is a DaemonSet — it must run on every storage node,
+# longhorn-manager is a DaemonSet — it must run on every storage node.
-# including the P330 failover node. The control-plane toleration is defensive
-# (allowSchedulingOnControlPlanes=true means it is not actually applied on the
-# R740, but keeps things correct if that ever changes).
 longhornManager:
     tolerations:
         - key: ENC[AES256_GCM,data:/lEcTm3XFvlmSSJwYhG0CeYXmDHOfUa+yHXfQFxt9WgHN/EBGQ==,iv:h2ZUX6s/lrhjp6yC+PFYACR10uxH7D86vAESbQ9H/9s=,tag:F5xBv+YpjHeErRKTRzNM6g==,type:str]
           operator: Exists
           effect: NoSchedule
-        # Tolerate the failover taint so longhorn-manager runs on the P330
+        # Was the failover taint toleration (now a no-op; see note above)
         - key: ENC[AES256_GCM,data:dBRTGlRjjGCR,iv:AcPEXMinsw6ow0izpIXFntwZUMAvMOA1P65mJDBwhmw=,tag:0w24kf8BfryNs07RpWme9w==,type:str]
           value: ENC[AES256_GCM,data:7XvkPrpko5A=,iv:J8qgVcveMb17rgzYN6WgmE5NpsaKDKMU/2EEctaQL5I=,tag:T9ofKbtlEiVPBqX/xEpnFA==,type:str]
           operator: Equal
           effect: NoSchedule
 # longhorn-driver (CSI provisioner/attacher deployer) — tolerate the same
-# taints so CSI operations work from the failover node.
+# taints so CSI operations work. The second toleration was for the removed
+# failover taint and is now a harmless encrypted no-op.
 longhornDriver:
     tolerations:
         - key: ENC[AES256_GCM,data:LuvHfPv9JRofL9cOJe/kvfs01+9F3d1hiCjr+WCTzMrxlneCBw==,iv:aC8TMpygwEio0Y6zau5QGTRNMDoxajuBLwVrFF+7fjg=,tag:nSJB+PBouekJkX23ar46kA==,type:str]
@@ -53,8 +47,7 @@ longhornDriver:
           value: ENC[AES256_GCM,data:A7XxyClHSCQ=,iv:cw9fzGcxDcSrELJlWmqxGuzTvZy5aYe/y43Xq0a1xdc=,tag:sj0ZQPBXJQURZ6A3QPJENg==,type:str]
           operator: Equal
           effect: NoSchedule
-# longhorn-ui — tolerate the same taints so the UI is reachable even if it
+# longhorn-ui — tolerate the same taints so the UI is reachable.
-# lands on the failover node.
 longhornUI:
     replicas: 1
     tolerations: