longhorn: tryfix backups

longhorn: set default replica count to 2
authentik: tryfix tolerations
2026-07-27 08:00:46 +00:00 · 2026-07-26 10:44:08 +02:00 · 2026-07-25 14:52:04 +02:00 · 2026-07-25 14:48:03 +02:00 · 2026-07-25 14:44:32 +02:00 · 2026-07-25 14:06:27 +02:00
25 changed files with 588 additions and 274 deletions
@@ -43,7 +43,7 @@ updates:
    directories:
      - "/kubernetes/code/gitea"
      - "/kubernetes/code/harbor"
-      - "/kubernetes/home/home-assisant"
+      - "/kubernetes/home/home-assistant"
      - "/kubernetes/home/zigbee2mqtt"
      - "/kubernetes/infrastructure/authentik"
      - "/kubernetes/infrastructure/mail/stalwart"
@@ -1,7 +1,7 @@
 services:
  grampsweb:
    container_name: grampsweb
-    image: ghcr.io/gramps-project/grampsweb:26.7.0
+    image: ghcr.io/gramps-project/grampsweb:26.6.2
    restart: always
    networks:
      - default
@@ -31,7 +31,7 @@ services:

  grampsweb_celery:
    container_name: grampsweb_celery
-    image: ghcr.io/gramps-project/grampsweb:26.7.0
+    image: ghcr.io/gramps-project/grampsweb:26.6.2
    restart: always
    environment:
      - GRAMPSWEB_TREE="Gramps Web"  # will create a new tree if not exists
@@ -24,15 +24,33 @@ valkey:
            limits:
                cpu: 500m
                memory: 256Mi
+        tolerations:
+            - key: ENC[AES256_GCM,data:o/sXxge7tAi4,iv:4at3gD2SjyjA1r1eVYE3bi0xEzFkwxKgJRJGagfzDjA=,tag:OxOcClpHU/Z3sSiMHikOsA==,type:str]
+              operator: Equal
+              value: ENC[AES256_GCM,data:5FY3Hmqh8Uw=,iv:8LGdTpFovI9lsfAaf65dHdJnNsm17ahm2/x+97LiTgA=,tag:b07oTtzzfU4FFjm9W+iz9A==,type:str]
+              effect: NoSchedule
+            - key: ENC[AES256_GCM,data:FPkNzrFpfqQI7h1D346c72Og0B2y5w+z5m25trSt4kIEjxJ4RA==,iv:Xjl+xrXs5m28siBqNXTTmtLKEiTxnLZAzvFXEXH8ZcM=,tag:VQoot4mURGhCmy+MSjr4BA==,type:str]
+              operator: Exists
+              effect: NoSchedule
+        affinity:
+            nodeAffinity:
+                preferredDuringSchedulingIgnoredDuringExecution:
+                    - weight: 100
+                      preference:
+                        matchExpressions:
+                            - key: ENC[AES256_GCM,data:O4Wtr+1YuNGmYknT35XPONTeqUk=,iv:VqTkPwG4bxvRgXDGrmpwVeT2zLQzOLrwKlhqYCv/GiA=,tag:2pntJGKlUF8cBKgKpyySHQ==,type:str]
+                              operator: NotIn
+                              values:
+                                - "true"
 postgresql:
    enabled: true
    global:
        postgresql:
            auth:
-                postgressPassword: ENC[AES256_GCM,data:5SoftEfh4w8hmA==,iv:QbbOmVM3Jp3gxAxL1OvnB6WKFX+OTHFENz1roMnPqyc=,tag:Gtn7H7d3O7Hweg5q6P6xUg==,type:str]
-                password: ENC[AES256_GCM,data:0BMgFdvPvhB9oQ==,iv:Z0mkQBfhpc7y1nSLY6MOucxwuKZ8TfOk6NlQE9RwVQw=,tag:yGDAOH6TCJDCfhxNlC/eCg==,type:str]
+                postgressPassword: ENC[AES256_GCM,data:/vgY7Q154znmpg==,iv:GqwNyccbeCSm/b+7PufHcoSrsrrIR3FVgRAI0WxrHow=,tag:o/kkueEMtJUVLeARdy5zpQ==,type:str]
+                password: ENC[AES256_GCM,data:gc4Ev4kn9KaSqw==,iv:Bd/qGIaobKewB/rtJf426pzS4qPe/WAMi2AB7T7HtCE=,tag:XlDtRF1tWv+9YmTo1H/Lvw==,type:str]
                database: gitea
-                username: ENC[AES256_GCM,data:F7+91aE=,iv:tEGgJ6GoXVkNoD6D4ZnyClrOQLGlqzFIUqqwDrVjd9U=,tag:H1+f/EKf/KptooRf8g0qcQ==,type:str]
+                username: ENC[AES256_GCM,data:6mlFP+E=,iv:+QEgLA6reecmpvvtmdOnwkpqOa7fOV06ZS8VTDQo7MY=,tag:dREH7uvHk8ZS6HcA7Vo0zw==,type:str]
    volumePermissions:
        enabled: true
    primary:
@@ -43,6 +61,24 @@ postgresql:
            limits:
                cpu: 1000m
                memory: 1Gi
+        tolerations:
+            - key: ENC[AES256_GCM,data:xd4ugBSV+lcC,iv:3dUqomveQf0/rMwOrlNnTk1mJoF5sW2RQ+UrPLlczkI=,tag:16IzYY0mqB8LlwRGXxUy8w==,type:str]
+              operator: Equal
+              value: ENC[AES256_GCM,data:rK9ACxsGlEk=,iv:afDm0KWC0HAHw4AJnlpPw5oGcfEe3oG+RgiRCTpjb7g=,tag:sDOIWCiqxi04YYxalZ6DbQ==,type:str]
+              effect: NoSchedule
+            - key: ENC[AES256_GCM,data:83c8V9jJ+d5zpFFFhbo//O/opfgAKNpoqcsRw8W9oGbTu9pBMg==,iv:uw+6IhfkixBxBo7Gs2VSvW+q+JpW35rE9REkb6SQDTc=,tag:donRKnK6NbgBKhDgEOR0Eg==,type:str]
+              operator: Exists
+              effect: NoSchedule
+        affinity:
+            nodeAffinity:
+                preferredDuringSchedulingIgnoredDuringExecution:
+                    - weight: 100
+                      preference:
+                        matchExpressions:
+                            - key: ENC[AES256_GCM,data:UKDLBJ1yfJ2gcyu/Ms3jVnBTfDE=,iv:fK73/46Jh3nfPMnWmMHr+SK3k3l16IsT9Ah45+yCz0w=,tag:A+PvsR9YpWwHrVpHOYXMGQ==,type:str]
+                              operator: NotIn
+                              values:
+                                - "true"
        livenessProbe:
            enabled: true
            initialDelaySeconds: 30
@@ -75,8 +111,8 @@ gitea:
    oauth:
        - name: Authentik
          provider: openidConnect
-          key: ENC[AES256_GCM,data:oq+UsuiNEGWphxXbwtbBs3d27bB2cVPoR617TWhcPOk67D7XWUPkmg==,iv:hODOA45FFex/b5ghHScnDoc5osu1d8bzD969oFVH3wE=,tag:67TMl55I6zgJWNGMqco6fg==,type:str]
-          secret: ENC[AES256_GCM,data:o9BZSzy61ouycNgtgRg/Jn8Wz+hLBBqgX46iHbaYtPbUVPVFc9tpdCsTdHCpfSGfiS1B8kWcoSzIDIAIIofRSCS/QqEQeuTwsyakkXhgn/LtLn+TH7bdLLS8qqusy5MZ9U18IJ/UBPGZ5+16Y/glbhpfHu9NNv0AI07nPciTq1w=,iv:7dn7eW2oEK/EU4xIETwVSekZUmktrs7U9KTJC486nHs=,tag:Otl2KuySu9bI/cZfCyjiKA==,type:str]
+          key: ENC[AES256_GCM,data:ctukTzFfQAZSAIaXonIu6nVsTHnTNAlqObVhGkKt/aLa9o3KxDHdBw==,iv:QoudL4RRdwpPfz6h6MWoaBOztALRa8PEi5fRFkjFzQ8=,tag:+TgP8KrYQNCBmTaqscOn8Q==,type:str]
+          secret: ENC[AES256_GCM,data:mxNRVXfX0X777xh5bB7PwMEeaxRPszmvmpoQt2lMtvkTSIQMJOllzY27PAShJ/y6JBPRslg6us9TpKd3zt5KcVY4Jne3hkpkQCKqE8HN3XnjHDHDzAm4ugYib5J97BeLw9pvdurLxw5iXAp3XFxMytzU4xCrYPsS61FWJRTLFRg=,iv:NCGMyWJT575CGnnFM4mcLDxsoMkggsxiNkXNp/aU0es=,tag:5uudyC1IIxorgepR7HnPMA==,type:str]
          autoDiscoverUrl: https://authentik.vhaudiquet.fr/application/o/gitea/.well-known/openid-configuration
    config:
        APP_NAME: Gitea
@@ -112,28 +148,48 @@ resources:
        memory: 1Gi
 # Increase replica count is not useful for 1-node cluster
 replicaCount: 1
+# Failover tolerations + affinity — allow scheduling on p330 during r740 outage
+tolerations:
+    - key: ENC[AES256_GCM,data:RBMIdZLIV79D,iv:TTa1CovTGm91r/lYCKOKjnhM+i9hoLVsmDi2kmki9c4=,tag:zuhnRKxy3dtkYJr3TuLilw==,type:str]
+      operator: Equal
+      value: ENC[AES256_GCM,data:LLOg34s1mrw=,iv:rjOyHPWBGrpNl1YGi2cYN6JRm7m28HiRibQoK0JZ3CE=,tag:oSyz0nISr3plqdXQ5UJxzw==,type:str]
+      effect: NoSchedule
+    - key: ENC[AES256_GCM,data:jVh0MTlCs7rVPSYvulsw8bIGwYPw5soaOzMlzVzVbFy13qqKLA==,iv:JfZ+JWxHBiTD/rG8xHYKogkyryNQIUIXyf9chxpwlEo=,tag:hwlZ+k1L0uPe+UGBOeMlYg==,type:str]
+      operator: Exists
+      effect: NoSchedule
+affinity:
+    nodeAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                    - key: ENC[AES256_GCM,data:Sn7FuYqGMbTjx/EpqRIDx5GofR8=,iv:Wkyz+RmyTGswohAZmyeQ1lWT8hTaYw7qAVmXTnSIT7c=,tag:WAiU90Wo8Av0TsdMtyPF9w==,type:str]
+                      operator: NotIn
+                      values:
+                        - "true"
+# (postgresql and valkey tolerations are set in their respective blocks above)
 sops:
-    lastmodified: "2026-06-27T10:20:08Z"
-    mac: ENC[AES256_GCM,data:VZY4oK2PCMBJd4VozL5qS7jlZtOu1JNsOn7aqJgPZ8uQR7kG939By7oVELMH9us0Sb8AZIYmzx7nLwnlp6IUNnacOffhKNl4stTFrb5Vry/5zem0CNp08eEDEt9VoxNudfQYC2axuGSwbAIahMzZsOYVRqOGgF1gEG17+hgd7ww=,iv:MiHKGUfzaSAppXLLxJSQD5loGkToFLzVQetWoRHq074=,tag:FduCPbHmy6A0mYdCrnRxDw==,type:str]
+    lastmodified: "2026-07-25T12:44:33Z"
+    mac: ENC[AES256_GCM,data:V9ZOpVvIi9PzScyasqQJb0yZDrqQ0RSXGyAY1+WaHCIa4/YRKn9d9V4wy+CwWaeEiIO7+fkp2ROInl7eVmETm5JppQ899G33GTmHCZLcBvVR2M4xEkx8eXy3saKCbC2DN4bHRuSCvvqw2XR+QIdemLL7ETuRo2cepUMhz/93peY=,iv:3wm/iCVfAYUUa7VfBXsx200LypYYWgJYCEm5X5Wwsnk=,tag:OzGw1PQUuVRVtQ5slH3E0Q==,type:str]
    pgp:
-        - created_at: "2026-06-27T10:20:08Z"
+        - created_at: "2026-07-25T12:44:32Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQIMA7uy4qQr71wiAQ//VDYGwZupOfefdEtJkD9SPOW3tHcOy2XR6ULhVQjXTGGh
-            APuONtgUZKFCViUqYZB7l6fazM8U/fv3cHsIpZfALFGE9wSZ+4So6D5dmBj13egh
-            yznV55xjinoaKPzaYYZoVmlt1ZO22SxmC0vld3yfAs89KD1Aow5wNZGTBELzyAWF
-            gMYGMkCsLlH3gqBaJTV1m5LKHHQAtoyzvJbKcpiynNRySfN/ogNX67GmgEMH9+u8
-            UexPwUHL6skIzHLmugYcrs4FAABot4WzoJsR794wOq/DEqHBE4SfQg48y/DROu2O
-            mgo6KqiXXe8qPGCIvjLiudb7MdSLpoLqgZ0vpExzdS/wMXAXczodrRRJmzEQyeDE
-            j08pquhfUzQ1SA/9VRQkgl4r0dj0CTuc+EhvHD4M9nj3JIjvuJ0AdyKye5S8rdNM
-            rm9eyX8V+o6X811qUM8bobKEi36tdnSMiB1yVHTtdW7hKctQwRMNQ8A9QEtOxS2F
-            +9Owub4LXZwBejSLgh9jaKEnilJQKVYN5Aw2lNAmZZZKtJ+iGHHkq9H6k+k5oEoG
-            xkQ/IYIEGLhfjH0PDZ9m2G3Ren3EkEkNjYvhwENhuUcyuW5Abl62v9FMY8c9NYyK
-            +uf5VS1ceHOBcelQcdSx9Kuox5UuyUtbwUcv+HbTmymZtmYdw+dnOTtRHR5CNY7S
-            XgEvPWAEagJpsmqC2n7Vc9d7b7TVp+SLSiL/w0v9JD6ko54Rwj0x21Odx3FLe7P6
-            obKU6XNNX9PPThJw2W0E295i2+DmOTH0AFio3rsg5wM3JFUokY/t8590sWnFR8g=
-            =Gypa
+            hQIMA7uy4qQr71wiAQ//RIr73tcloQQg2OqSLn7W1DI6T1dYCh+ntTP3Y8KeB1WC
+            hZy2JOdTwHLkd9MiDimgjH0E1036+Pta9xhmoi9lnY3cvwOH/1oHxjd6ixhPxYzV
+            Xt38fQ3BkFvf3fHbhcbzpMIFL8tfvuVDAxRV1fHHOdCGgXqeC5GP0KtDGmnddHui
+            w+ms/1bS/EiwS4C7IW0yYSD3nGIF3GyLwMPOnbmJSz+ealEWjuBi8R0S1gX40QFU
+            EV0MBrVrtFtnA2R8UZGCjU/xpgoQFE1U8dArNt0DPqNsOeL17WQZrZ58DurmnmiE
+            DNjndlR8Est1y0gSO9ujPtGXbbuhAOIXuEsYMfnBgQ5Y+dShs2G1EHC0OexYB83W
+            FSHxM69hjQkvRLL0/lX+5NH5h+IJqZEUsLd0/J4h2Iz/EsDRxO6pKt0HzZbJd/y8
+            qY0Y2K5cGUzG0y0TWuUznJyxmTSCgrZAE8sgBhU607+UnXU678cqbkRgSuHTNdMe
+            yNxQas/PA0ltezOe3dBG34Cwf0oQZ/NCt2TfSFciFEgf6ze+fu+T+gCFfftWPiy6
+            pQ/3Fl6yAaVguu6UCR27wRMhXETZ+YZ8rw32XPbLE6BOvQ1LcGg9E7wJlw5eeir8
+            0aWvKyUu/ClK6+/s7Ytxv1RoL72gn6WuOgK5q6Sf3mqmltuvJxtDVAnqCHNRfHXS
+            XgFH8gPqy47Gqg9qggCHjDIUbQeAu1IAznJAQ368WXkTqqnq887sSSgcs6JVduJf
+            2YV5NQFOcoI6OF66FXXmY+sTpJaHcgVfKt3EHAqXxHCFZUSBHMwDJm9ulRBuYsc=
+            =raBM
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
@@ -1,42 +0,0 @@
-persistence:
-    enabled: true
-ingress:
-    enabled: true
-    external: false
-    hosts:
-        - host: homeassistant.lan
-          paths:
-            - path: /
-              pathType: Prefix
-configurations:
-    trusted_proxies:
-        - 10.0.0.0/8
-        - 172.16.0.0/12
-        - 192.168.0.0/16
-        - 127.0.0.0/8
-sops:
-    lastmodified: "2025-12-04T18:23:43Z"
-    mac: ENC[AES256_GCM,data:JSaTCBXqpiP0R3rIEa/EZaDPbBInY2a6UMhFD9Gcw/mJVq/wF72KsFRfJl2hZ3d1FtsQ6Z0l3GrbiV41348jxzWM4XnE0e0hywdc2Ryqw0B3GS0EoNk1IoPR8ieZtxWNtFvglR2gVWWUnN7caYf/acE04NnzIDxl0tPEFckS+Nc=,iv:C784uqYb7KGhn2wGWZnCA7rhGocJWP6mfBhjNLWbimE=,tag:A7JLOmSVJ+ZrNA36DJfRCw==,type:str]
-    pgp:
-        - created_at: "2025-12-04T18:23:43Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ/+J1e3KfHaAkFS+lYz9jKzPAffkiDVCeecEf31Lk9DJxFd
-            7agtTWvcXtIsiJwF4sv4NzxY3pQrNRKwiq8pd3iXWHSqflIaQ2M9+dUGHykkjA5W
-            R+y/wgM+K0MBaFMxQU/xC0lM7YFwypV1JBp4jmpNn3McGba2yZAoKo1uAQ9LMP4L
-            Fd5wqNUrLNfwbh5Ts1rBVAGwStVlkRUvdUVCXjngdWVmE5xB3IBypdrFX2oclkl8
-            0zSNJwknC4bi4FeKBxWC90HT0n8zSMybdZOltcl8J3YVCL6l0F9hw6Ub5j1ej7qN
-            Igyll2/T4FEOExdo9oRXbEjC6GSZZBD6NMlrgJqVVUWoqDm4WQlKc7JRYAjtRgbS
-            Us8qCD8CMb57E6AZHD+GRZDK48OeevM21YxRvpSQlQfyeGbMrxF05zzw5InHSMhw
-            VslHQRmUMQqEzTsSeFbNxTeqy1YGGDYlnBpEjl8TPIZXE+mjwHm9QJbKwQFUK4Rh
-            YuEZDlUONdaKQpNX9OS6kwiV493sSruC2yWNwYIlgERrkcjBggKYPiV7lDiFnl1W
-            RVcsqOGnsrrwFHT7m6/MTIzH0k4fDt6Vv/FCToaoadvLPYNZb7xoKMahzT1z3SP9
-            FMuGus2r8h6ShEZVyLAt6o+BuuYyzOrVo10k1yTKDqEDD662rbRvTrBZlOk1vUPS
-            XgEtw6w6fFkESJKetHiN6TxG2+WyJw5PILm2sjak5AcR3qWiux/ENPb8kE0BIB0S
-            1Z/YTHYNP2mtEegDsp1DoT9tOSTWfrllL+p3kccvizEB5hq9+oMEzPGBstjWRjg=
-            =5PDx
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
-    version: 3.10.2
@@ -0,0 +1,61 @@
+persistence:
+    enabled: true
+ingress:
+    enabled: true
+    external: false
+    hosts:
+        - host: homeassistant.lan
+          paths:
+            - path: /
+              pathType: Prefix
+configurations:
+    trusted_proxies:
+        - 10.0.0.0/8
+        - 172.16.0.0/12
+        - 192.168.0.0/16
+        - 127.0.0.0/8
+# Failover tolerations + affinity — allow scheduling on p330 during r740 outage
+tolerations:
+    - key: ENC[AES256_GCM,data:SMOTaAtzpNtv,iv:rsMiAMaugnRKQjtp67nU0pW+MWXgolluiE5qoIWJkRA=,tag:RLUTotQG3XUQfDiA7CE7vA==,type:str]
+      operator: Equal
+      value: ENC[AES256_GCM,data:DhbXHMsUJ7E=,iv:lQQTpWpDGi7JEQV24jdICHMnC8yV0EsNQ/nauBsqk/8=,tag:RKripNRdBwqnt1sCY72eYA==,type:str]
+      effect: NoSchedule
+    - key: ENC[AES256_GCM,data:YApCSh00O5YoRqzHUNSoPbYWOsNVwFKOlln0C2+mYpDfKqLU5g==,iv:eOv/Yri400RHpm6Bnxqw4IYp2IiYAKXTd06sduW3Ku0=,tag:9GR1Q8lWHG7Uplevd1hbYg==,type:str]
+      operator: Exists
+      effect: NoSchedule
+affinity:
+    nodeAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                    - key: ENC[AES256_GCM,data:0rESi0B+l5uEwmPQPuFzMylc6JE=,iv:dGx39YEojvQ/J2y6SlP54I5L7Zr+yecwJwNQQ53RV9k=,tag:icAw2r/q4+UcHzYClfOBSg==,type:str]
+                      operator: NotIn
+                      values:
+                        - "true"
+sops:
+    lastmodified: "2026-07-25T12:44:32Z"
+    mac: ENC[AES256_GCM,data:cNqULRYPz0Es3az9v9HWlEf1pvPFWfZ67OofRWaDgFx3KVKVj6VUY6HQgN589xbbCoBKLSKXUoag2zOku1P3yBkb39WrdUtfSJw2t7BvZIo0l9VG0bRAYZgJYgnQA1NrjxixzgZZ7AHst1ljB+ZC6qq5DgEJcuCiue9zkfySTMY=,iv:rNDmiWS1U01xgRHty/sp/RJ5iz78sOdBGP0mdjUX7TA=,tag:BVKsb/HQchTaLo+2Tlrn+A==,type:str]
+    pgp:
+        - created_at: "2026-07-25T12:44:32Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiARAAgxstgt71NySIfZBgF0Nb78qkkFV7xOEfv+VWO3EaSp7Q
+            8jhARPxkAVMwl1MQIdCxB6UuUeQi8fOrLwjYzTN1tWG/VV1P3KV3klm6jNcZ4Zxv
+            OdYt6kRLNfI4J7KWFhZg8A7/FfXSOtZEWLjD60hb4ie02ALEC9o2rUcdxWH2ZdHU
+            69GhP3VU9uiChOxEk6eLyQr22IF9IfQ7BVUckVzU13neZ2PEYXCV3QaHMBrvutMz
+            IFUGpi+drrXxXq9KmJQ4Yr4L0+mHwXYrFVi5rHK/ibgRDNT7T9nK56WCsgRd0MiK
+            7+1vK/q73p5ZdozmalYB2lKuehRapf/xdXbn1SrWGXbsHubdrE2AQgRxBHVy3k8I
+            spN2ZTPzl29mUsVIWKE/CdF1GsUGYrKwKL7S6aHZBtRXncbKBEFLbrloAjs+j83+
+            aU5ybyQWnZxh7f4+nQyDerSJXZJ17eEJRjqMDhJ6VmA8iOBWxgudM57d4Umt53cf
+            s4vOikRSO0cd+/OMvQQBW1IPMkwRSi4/jD8BZTXisWVUQ3/98NQPXQE5EYk2w7aM
+            5T1orWWWMz5EdQNptqz5GL6qPoH4UpVSGCNuCf/oyLR6MCt24JDR9KobOgXKUrfM
+            Qig6/+4WbvxBJ9zevi14FL+K00MeWd3pQT2Bsg8l3fWPIRe+p9lSB6yrsf6xHu/S
+            XgFWycRMj+U+y7B1kyXT5W6WshFHHTOlyAVgk9lnB+kKEVno4pAQBNuNlW4gwOvr
+            iuc9EaiuHat+CW+WdxLdH3i/jcNmvXfXRXdE3449aXv+haNBjxz93nRo1vbAFuw=
+            =O+AO
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    version: 3.10.2
@@ -1,14 +1,14 @@
 authentik:
-    secret_key: ENC[AES256_GCM,data:wnDvn9EdX2SYDoWn9tTrbKvBx11fGfGlTk+9MSz8cBzwMDaY5W1bCwjtH7TmAnwYhbUQxXdVIxgPpj7k0FVqM5fuMHZwcb2AgtDMGbxRXtM=,iv:jwUq7dbl+V1t+Ek7vyBEfwX1B/fVmE0TIFMVGj40kVI=,tag:G1bDdR9OUqOtZQmvUcAfRA==,type:str]
+    secret_key: ENC[AES256_GCM,data:P5e7cSOa0Uw0NEmWuDzIv1QxIkbvLE9vjzULmS8yS8b62fS5jHuFWUF/8VkW+pXiJo51mZ9b3QWDBdD732hpSrR7hUpK19WdZvFfXMKsqVc=,iv:AuuvJtXdlQ2SzeiFdxv96cEVyeMTNW/fG8bPS4ItFtY=,tag:AJC/T+eXGwOdQ/U7rebIdQ==,type:str]
    postgresql:
-        password: ENC[AES256_GCM,data:G0KPHz7zZ5ivtA==,iv:w4m21LqGEtvEGAp7NlsoV9bwRkE/Mga4Nxp5mqBIJHs=,tag:kKHC3yXqJKZX9jiYuYXt9Q==,type:str]
+        password: ENC[AES256_GCM,data:wmidNe0ODeH8FQ==,iv:zh38F/lIKdFBBIQufjLORtfusPWwDnsDIh61b6ltbQE=,tag:SSMCicRKoPBXwPLFoh+uoQ==,type:str]
    email:
        from: webbot@vhaudiquet.fr
        host: mail.vhaudiquet.fr
        port: 587
-        username: ENC[AES256_GCM,data:s0L1fCp8aObv5j6jlBiGDfj0aIM=,iv:cbvXxI3DIjnhnfHmUpeDF5KKRxUC2+YdvwU5FPcEe0s=,tag:rR8HpXUEabNZ36xabVkSIA==,type:str]
+        username: ENC[AES256_GCM,data:VV9x5UWZ2F/p/l4pOVdDB3ZeK98=,iv:H7YXijpo2oJEO96LJOERL4lyQtV7QJq86H33wDpKObU=,tag:q+KiivjpV3kXY0AYGKhzFQ==,type:str]
        use_tls: true
-        password: ENC[AES256_GCM,data:rb6o5MGQWK7LIT7gass=,iv:NjI0iqRk2usrqcH6kSo72T337y6avHz5whg9bLfAYDA=,tag:DnRJaixjmNY31V1h9Et5PA==,type:str]
+        password: ENC[AES256_GCM,data:pco+hLWairs2UFNFTSY=,iv:OMrxrzKDo91UIMgEhPdN4dTpRxl5A1LKHYk5h4eFD/A=,tag:ecjAP9lv6FPxPppyurJ5cA==,type:str]
 postgresql:
    enabled: true
    volumePermissions:
@@ -17,12 +17,30 @@ postgresql:
            repository: bitnamilegacy/os-shell
            tag: 12-debian-12-r51
    auth:
-        password: ENC[AES256_GCM,data:9PI//cgxRlmjNw==,iv:q0SLpmaTIC3OUulPDxiDWie0+oI7w17V2fPmJ52o8ao=,tag:2lwG95Remzqt1dj8H4CG0w==,type:str]
+        password: ENC[AES256_GCM,data:cRaZ23HWjZ41ig==,iv:HABmXhmHvMhjUJ989xJOFPWW+EnLTCot1is80vMTBUE=,tag:r+/iRkQIlXvALv/JQbGFRg==,type:str]
    image:
        repository: bitnamilegacy/postgresql
        tag: 15.9.0
    primary:
        args: []
+        tolerations:
+            - key: ENC[AES256_GCM,data:M14eAjMj2w2+,iv:5vIosyFtwVgqs07CT2UcL1KL2hqg+rvKS5PWRvWRlPQ=,tag:OJ4RwlLAhGDN4JGPX8gypw==,type:str]
+              operator: Equal
+              value: ENC[AES256_GCM,data:KKZ1Kd5yRa8=,iv:adSUcfmjnDAc9QZ14NDfFz4oATpcBhtn8iHTF2xXpcw=,tag:G//QEbSKXiGP7nD5oAfNSA==,type:str]
+              effect: NoSchedule
+            - key: ENC[AES256_GCM,data:KtJS0g+/3y6VZb9VNKv1IWMwIi8FBURPGT6W6qvBAV1CHW4UMg==,iv:1I8o3SNljujN4FqByFC9uHpImJhHjj4Us0QEpHpDHZ4=,tag:FIpRW9I4OSVFVx4ejmau5w==,type:str]
+              operator: Exists
+              effect: NoSchedule
+        affinity:
+            nodeAffinity:
+                preferredDuringSchedulingIgnoredDuringExecution:
+                    - weight: 100
+                      preference:
+                        matchExpressions:
+                            - key: ENC[AES256_GCM,data:IkWdKkS/XlGw0u7I+Q2wYhXL+CU=,iv:2k9d0Jo4Vw5gA4tGeIq1Dw0IiZKQykfV8YAt2lYk7GE=,tag:Xnz58VP61Ew/J8hvIClOVg==,type:str]
+                              operator: NotIn
+                              values:
+                                - "true"
        livenessProbe:
            enabled: true
            initialDelaySeconds: 30
@@ -44,28 +62,49 @@ server:
        enabled: true
        hosts:
            - authentik.vhaudiquet.fr
+# Failover tolerations + affinity — allow scheduling on p330 during r740 outage.
+# The authentik chart reads global.tolerations (applied to server + worker)
+# and global.affinity.nodeAffinity (preset system with type + matchExpressions).
+global:
+    tolerations:
+        - key: ENC[AES256_GCM,data:yy3LVikckQ4y,iv:PlWRKZVoR6g/RtQdGBoIKbnwjX887xZY7ZhciTa0nps=,tag:yRMuJW3yjBV2C3LDWVdEHg==,type:str]
+          operator: Equal
+          value: ENC[AES256_GCM,data:IqKHhgroaK0=,iv:bvg7kLaVQEsH31xHH1rCW29dWlWDlDsAMAmR1cX2nS4=,tag:B77eeEjVnRwk/feuPyi2Kw==,type:str]
+          effect: NoSchedule
+        - key: ENC[AES256_GCM,data:QYGmJBgxhqC2L3UvGYyJKKWDfzSFq91w1ifwNn9rofPnBqL0Ug==,iv:+tI3xw51LqinZnEOi7Lgao9liOD8KT8rOGNtn10qkFg=,tag:fJhk0PifHEyFlX4j75Sklg==,type:str]
+          operator: Exists
+          effect: NoSchedule
+    affinity:
+        nodeAffinity:
+            type: soft
+            matchExpressions:
+                - key: ENC[AES256_GCM,data:qRInCqtomABFKcUFHzDQe2qmzJY=,iv:9cMrKqqpIMtNCUqkIWaCr5YGNoK6zsID3xAKp34q1kM=,tag:Zf1ZjGwCgnaOqTq8Hr++Fg==,type:str]
+                  operator: NotIn
+                  values:
+                    - "true"
+# (postgresql tolerations are set in the postgresql block above)
 sops:
-    lastmodified: "2026-06-05T20:13:55Z"
-    mac: ENC[AES256_GCM,data:rtrnY4XXaovFr/oXuZWJQa17Ihlgb9W7WMKYeN10qqx8REf6a3zqlUUGGSndYhjAZwpUjo3qixqAjW6kItBDgeF3DLpQ2T6acyOgXmbYNN+dWK4zb7jE0yZz69XIkUirabBWTkLqDACvw3iW5x4EAjg6/VYRVt4g5eugET5F/IU=,iv:eM+Z4SEJ6/y6gHzlYjLxcbqRn4dP4gbkaQqN2EGL4BY=,tag:EXklnS8lNeQErKcdP0XD6Q==,type:str]
+    lastmodified: "2026-07-25T12:48:03Z"
+    mac: ENC[AES256_GCM,data:noPba/BIxyoUo3sFfwXuMaZwwSMNADgWcwGaIoQchdzu3KodtWRHk5xJ9wy4VGelOuy3gS79j9ErDnsn8I1v05Bqqlrig99Sch5Jlu1UQpeUQtUjq9S7d5BQ0f3QdeU4iP2v28JovI3gBNHEIlZiueV6xYUrpeoKzS9ukrBtJsM=,iv:XRmbI5hX0OCh4I+7MmnI9LyBLJhf2CsfHgvsNaEUWgc=,tag:Ym5JeVRqTWHWl8qSQAFh0w==,type:str]
    pgp:
-        - created_at: "2026-06-05T20:13:55Z"
+        - created_at: "2026-07-25T12:48:03Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQIMA7uy4qQr71wiARAAsreeLsc0Qhc/RDFP3GmusT0PCFq0XTnin9THWE+7YC/5
-            +kPcfKfyQGQGImzkl6niBxzl4jjxiyOyhdDWzwFw34Ets+1wXLlur9mo0v8GLfZG
-            DEO+1VEzFheZzjM6pVNOWCJdGKR8WEuadjmMMCsux463JiEPtatRJgcAim3ux6uV
-            TbtDNNF9yc9yp7GN8p0/kF3tnD40zaszM8+UznrWbDIFJOrixyVTZ3O9tKcjl55S
-            m5upCrrbc4rcp+uRiYrsiMZoEg3KvlqtxUw9mHoeVce83l7bziobixzBhnGRtAar
-            zYUKsuu5PPpljV+ghDSIkcTrwLGQnInhlbOxKwDNVb0LiL/1c6dP4zPfZNh+Nvne
-            XhUDx90WnGCFOI2t5tXelAymCBDgak2qCX4IxkxddBhL9lONwYIM8zmszjPQf7r1
-            Gx4vFrUTqceEXI+JLiPog4/+gGHX1qzifdHBZR0ZtTi/XJfnhdH3fkJndLA65Pkg
-            K4vY6KfomQLEmHurMVzEkoeXH95qSWmfmai4SJmKWqm33VFPZRFoVonnx4dP27SM
-            vZGmfgjOl5eeRk/jdrApJNTkCi/dkGUfNRDffwcYQgjCJaWOs1agchBSC/RLZVWN
-            3FPmohgmGa/MBOX3qS1r/5G3XBdKuUxd/NJ2Bw8L0wodteGSEClEiMEXGGZLkOzS
-            XAFSk/qmO3tJGViwOVtnb0ZXyTRritW9uR13N+LcaKJhC0PB/m/lXR6IlrfLJXnu
-            AMD7w42wKMeBgGuQQ/Xm/iOVlS2H0kvbm1b1WEZMQUJlEleKSyQKbmQPujoi
-            =KjtC
+            hQIMA7uy4qQr71wiAQ//Sa5nJk6vXXFdf4C5XwsCeRmkSYKSdxJZ2auRzRi+2znv
+            IqicZh0YENwEX++2NQNtt/jaPFCqWUMEVfncvYceutHzZxDZihkbIL/jKs0h/Hjr
+            gL/JNRPQbVD4HXLTQ5dOuAfixJXcN9DfYQGyBg1vOtvpKxR4cD4JirA3KyYjtSWf
+            cYw5fMSalPJ0D3B5pObFZoVJhu8emO3FegSu/tqnZseJuT4mqZqdhpuej17FtkQB
+            il0tNwBdy9pDFXMxiZoGFtVb5Bii7ZU19MPleBBTFO9nNLXE8rCZ/1tJBtR+XUXE
+            acglYoZHt3aHAqe1+8iLWAOmE1KkElUMU6/G5yZCpLNNwwgx1jXqGsvITMQQVptJ
+            RMMKfdNGZSC4mcVXT+Ux/uwvw09DO9Mrbf0tjiTTjLProNxUmY4pPMShwCmGsfTa
+            si/bZbCui/Jryy02dYWuzA4bpReY+ySMwUGZ9C/0Gn/SBEAdeGQKDhJwgmE6BM1n
+            hMZOh9YPcGSc0n4a9q/CzFqcQ7T8m1uHgqciFG/zW8A+l8bC1H5uxsUwcYPALLxY
+            adAZ6XMPZAZ1L/zp3NO/SpdHp7hQVqx+TZOWvmlZ4XiDrICp4AVK8oZAXKw/nrAu
+            k4ZYVsrBKrkLBIMNmM1mxuhi248ELB7V+kN9zDxQZh87J+F2WXk8D4dMwBfRfYzS
+            XAGiurXdFcCH3i8O5mmE8QY+ZgdKzyAj7hVw8BvXlOIne8pPe3YuZsp68zwdz8MQ
+            Gr5oDPaZWhEwFEg+4H+ub5xSIZewY7Ib7FM8bzzfd23vODtZ+0sBoRH+Tq4R
+            =m933
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
@@ -19,7 +19,7 @@ resources:
  - code/gitea
  - code/harbor
  # Home
-  - home/home-assisant
+  - home/home-assistant
  - home/zigbee2mqtt
  # Infrastructure
  - infrastructure/authentik
@@ -1,7 +1,7 @@
 instance:
    name: vhaudiquet-notesnook
 api:
-    secret: ENC[AES256_GCM,data:C3mpoEG6y6IShpX1+o9eNn8NACaKy8s1xw5tY1/ncBzqaKrK3YiE7K0rl4d6Bq6q,iv:rGWxSmV98ef8Qx1jkVbQEKPkFmGEaCOXXFFZ4I1US7s=,tag:VBDOhPRTRRhFu5cU024Sqg==,type:str]
+    secret: ENC[AES256_GCM,data:R3pAcgHfCeBrgNJ8Fc1lvNU3sUcWicIglZDtInaOzw11s43GaPPiR6t3lGiiN5oA,iv:xUqXD7tMrjxzBwIk051d5DeVOGh57O19ogt5RPHQppY=,tag:sZ+HgFbWv5jpia+D/tKqnw==,type:str]
    knownProxies: 10.0.0.0/8
    disableSignups: true
 publicUrls:
@@ -10,8 +10,8 @@ publicUrls:
    monograph: https://n.vhaudiquet.fr
    attachments: http://localhost:9000
 smtp:
-    username: ENC[AES256_GCM,data:C4dTnVaJCwxqTdevLJ+a9eJOWPk=,iv:9iHoQzZjHjmOuaoOWdedPHuv06MqtXZXJhWGiTdzhwE=,tag:xDL+WInm/Ms/LuZi53JuHA==,type:str]
-    password: ENC[AES256_GCM,data:tIkKqwVBy94oqFJH0V8=,iv:cOKiwDhngz6mnZlD+XSfWFg1KZa+UCkhXKBgjK7IdnE=,tag:91d/aUlfeHbJqtRWPmTskQ==,type:str]
+    username: ENC[AES256_GCM,data:FXfsyRX1PD7rG8TKGtQD5yj33BY=,iv:rb++wIa9mr0i9OJ5JMv27aETxuyUfCDOKGwp2u0wUUA=,tag:ZYg/1vHTGypdw597lU4Itw==,type:str]
+    password: ENC[AES256_GCM,data:3lYaORGHK988XBnwY64=,iv:Tc307c0DS6kTXGySSgJMhaceDqps+pyNlKqcab9UHho=,tag:h7e4pMLi5sVyqIgNVg8tZg==,type:str]
    host: mail.vhaudiquet.fr
    port: 465
 ingress:
@@ -37,28 +37,68 @@ ingress:
              paths:
                - path: /
                  pathType: ImplementationSpecific
+# Failover tolerations + affinity — allow scheduling on p330 during r740 outage
+# Applied to all notesnook components (identity, notesnook, sse, monograph, minio)
+tolerations:
+    - key: ENC[AES256_GCM,data:VxDGa/LUCm1t,iv:6MU3sqjnkm0Gxdqt8tD01Fqxcg9oK42f8K9aHDQMDY4=,tag:9liOuvSqHNdfVcRfephFpA==,type:str]
+      operator: Equal
+      value: ENC[AES256_GCM,data:3HkYc/Zk+50=,iv:P5+YjonnfjVkMmO+6/HqxEO/AyLxNlIIOyqi3gyYXRs=,tag:3XtUzwXJ3vQiMEe+3R7lAw==,type:str]
+      effect: NoSchedule
+    - key: ENC[AES256_GCM,data:JqPxmvAU1+nMu4YBnp1deCH/y6byaGc4hrfKbVFVvqGdr1XgQA==,iv:/YKU8LhYfzp3gUOojTTfPCKqLgL5qSncDYTKlLmyrqk=,tag:wFPEWson8XZPNPV3kXnGPw==,type:str]
+      operator: Exists
+      effect: NoSchedule
+affinity:
+    nodeAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                    - key: ENC[AES256_GCM,data:dk8VoO7VNzvfdQhZyP+WnhO46ak=,iv:tkH2ElerO8BIALsvUNJIl/qnlGVdOS76DPXRi2J+ovg=,tag:XYMz3w8GthdOV3x6+Ybkxw==,type:str]
+                      operator: NotIn
+                      values:
+                        - "true"
+# Subchart tolerations — mongodb must also tolerate p330
+mongodb:
+    tolerations:
+        - key: ENC[AES256_GCM,data:1TnuKgSBqYCU,iv:nSK4pFqVnVxioaZSp9rwKFyEyIbyxeEs/2luzKjnwLw=,tag:jgA6oDj0foG2YjAieJLE8Q==,type:str]
+          operator: Equal
+          value: ENC[AES256_GCM,data:9sKq4+CgI5k=,iv:3jA01Zaohix3HBe8FnI9VzlLXli1ZThWw6JU5hhysYQ=,tag:8qdivZP7PwGC4gnVNuUupw==,type:str]
+          effect: NoSchedule
+        - key: ENC[AES256_GCM,data:8PbTBL+v3LluefFLYxXUmgQw/ROlIL4nLJVDqrVLvFvrtUqWbw==,iv:khQcqyoBLgsDk3hndnqKGmSdO9e++5o0M0PTNq6jf9g=,tag:8A4f/zp7DimjAKGjdPbvuw==,type:str]
+          operator: Exists
+          effect: NoSchedule
+    affinity:
+        nodeAffinity:
+            preferredDuringSchedulingIgnoredDuringExecution:
+                - weight: 100
+                  preference:
+                    matchExpressions:
+                        - key: ENC[AES256_GCM,data:Q4SFghGuAo8RjD6OYqUxt9sYlfU=,iv:TbR9TmGAmzSZg9+/ZDzsGmt4yA+KQBIDPnUQbQOogTw=,tag:FbEPi3gxlpJuxuerAruTmw==,type:str]
+                          operator: NotIn
+                          values:
+                            - "true"
 sops:
-    lastmodified: "2025-12-26T18:18:01Z"
-    mac: ENC[AES256_GCM,data:Xy9P+Ifuz18apN7GoYdehc2bzTjUKMJAT7f8HZNTnvV/wkZEt4EUGJL2WGex12nYQyj6Ut+I9pwFwwX5m0oLO82s1zS2DK3BiaxFa6LFJ2VDUthKt8h9ZTNeT+2P5S5cOvEMvS6tljX8y8/HCUwVMCXGMNCIl8RtWo1Q9CgLjrw=,iv:6MdJwJh3xVrXX6sKCQMAEIpdOD8E0V6+305xcaQnnMI=,tag:5JE9M09u6ukPoQBzT9g0sA==,type:str]
+    lastmodified: "2026-07-25T12:44:32Z"
+    mac: ENC[AES256_GCM,data:+vnDAlFBB7zP4YnxE9fqNa9dawgeuCB2vTet4yh5Cgqp36p1uPxg68uaBeZPrBFBj2fjNs3g/C22ny0/ui2wb5+pGorzXKxVpjWX40hMXyiCQwJXejlZCiXKAFLmOQMiv1oJQQ0PqhAeOckhI5dEc0D2PAUynXHAXh49xNrzcVQ=,iv:St70rkrQpCA81MpPpxyUtXQyvGccy8pgEJUOrdF7ihs=,tag:l0YZdLDkfu1miVMpDJD4FQ==,type:str]
    pgp:
-        - created_at: "2025-12-26T18:18:01Z"
+        - created_at: "2026-07-25T12:44:32Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQIMA7uy4qQr71wiAQ/+KZ6WDFaDTZVt6n+pu1hwxhNC9ShCSSLkiHlZjtX9DW8O
-            eizwH6GAG8LQeKYr61aXXVwxsqDdM9gx/i0ynDO4fflqEQniEjlFzBeVhsqOf3CX
-            rL5WImv0LSe9KjFNAZvfBhtUVENfN/Tu6RGagNb98ChOoH10MvmrzQ5t754AKPVM
-            hB2f5kmOn0evFQQftYyXkQqzLvhlqdGGfBnCutXDoLz67RQwB37npzXx/c+GtlOX
-            Msmp4wiYqlX9v97vjLHUX/ZeBtzm38DzUw+OTcnDPbsdZpeUMqYnpkIl8GIgSd2D
-            2jZUJU4wYyOCYCnfw0+zXu3O5/1bzZ9fdc5FH6A+OlJUFbMLPXx7n9uhVOztxQ1g
-            5ajZKkszSWk58IvaTueDL2QjxhJLop1y4JITgzOhiSPserXrizGn765bVEAtY8kR
-            zgULAG5f41zeoJzzdMyuCFUlIJec4DFigbe7fRul4sJEjeeHtDdyINWuUXCnS4ZX
-            e8/ZZ0+z98IMm7Lstb75rUezTUdlIxfJ+EtAX3L1Bdb4yJZ3i3E1VTQKWxaZWrcc
-            zF5nOIZsHgD22Um8fA4mDlhX5/ygiKMHxZe2pdwps4F7H0rRzVLlM5n4g+71WeMe
-            0eT4atgKPICzMNkyRJ/KWrtk4c6Kq7sSqpQKlcFsRLMga1ZBt0LQwFW+G7PU30vS
-            XAFljxtoFrbdc8Yl37cQh9XCBqXMqUXSNd9t1hsgv+Vsrmv6ntPVStep8Fod/n16
-            nCACAKTOe//z0OmwUXxdUCIqT/N+XEA8tOrHS+HsbB5MCfnexLDul/yUfviZ
-            =yK0X
+            hQIMA7uy4qQr71wiARAAkDKwwK82i30IyWe3/35JGxQJ1NoFc6bbKnFBW30JFR2o
+            7vVl1e7eBfWwIZ/yD+fHkyiskYe+UWT/ZDph526JKXJxuiZ1XPzCBQ2iD8hhABNi
+            /8YrlLd/R3kjGebXTAZ6/+/DijuAeiVxyaiMDkmo2YXz8x2+nWXV7I5mxMqDdTwh
+            fIldLmX9IJKDJrAp5RpFn+g5PIwspQJmA3s86FbMAolLAHAUJ3zNCy1D17LFK+kw
+            X34yHZPwPcbP7udIhGMTZvpUawPkxXBBJfTj6ElBWhR+8OHP6zgEYTZyY/evMQJO
+            fr7n0rWv0gtlNymfX/xyRo8JuVAW8Qh2bOkFh7+fmlMAtdrg6MXVLyGIiQBh1NIN
+            8hQz++ZrOMLx1hoxqehZ/lKUq6ZJTzqXcfMZHipFUxlFVVA9zD+qM0TUxiliTdiy
+            GJlq61xwmvRafbUrpmNcon202jJCYJ5g/K/PFmSx8yTa7cIp0FOpNbZIrTmnFffI
+            bJv0gYk/3f0EiTEjKAnl915IUj7KSRGWS5nH5RRuVLw575+glnDwhB9gax/uZN39
+            gUuRiMm3MeQJ0FX6lYOpu1+3dnEZlaCMhJw4Lif571bOEi4KBcMAuHbLBfMmoL5N
+            dfuwNq3s+kWfu4lAYwxrX3ThvoRa7UABdmvJHqo+raAlqShjKjNxLs9IAL41+m7S
+            XgF83/ecTRqQ2f4gio7drRr6K5QIPrG/UVuuzghqfDTdzgNXRbTObjDxiifBjcGd
+            MBxTQvtvxjLObgO5s7RWZe78/1/4T8hOKYW4qGGG7iO/lggqPljHMVKyLHUzadE=
+            =UGsX
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
@@ -41,28 +41,48 @@ nfs:
    storageClassName: ""
    # Allow the pod to start even when NFS is unreachable (uses emptyDir + initContainer)
    softFail: true
+# Tolerate failover nodes
+tolerations:
+    - key: ENC[AES256_GCM,data:whCOkQ/xDUyG,iv:MU1iyLWTp21dUA0Ukn7L4Kdmp4DcD2946/1lHrgNJJg=,tag:VdVgjP831+lV9IdabEYvOQ==,type:str]
+      operator: Equal
+      value: ENC[AES256_GCM,data:IXlCv4VONI8=,iv:/7uiSYGVY85/8nGgnQjeO+hClQPqWEJWOMwEZs1VuzI=,tag:gZI49sfALmsfaxjF4mP4WQ==,type:str]
+      effect: NoSchedule
+    - key: ENC[AES256_GCM,data:7MK/rNoqAhDUJh3O4r0b47PVfT3ItjnnCOKJWZCThzHNIrw0bw==,iv:hUCE6+NwucVw5lwktzOpXRqjG51w4g/AQceyBiduu+E=,tag:DWGdD++4ZptIsSmLpwZAsg==,type:str]
+      operator: Exists
+      effect: NoSchedule
+# Prefer (non-failover nodes) in normal operation
+affinity:
+    nodeAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                    - key: ENC[AES256_GCM,data:EDr52ZzUZjtJe+oxleIJZZCYCl8=,iv:ZafjjEMMaWYP7JKAhnRkMB9kFghd5LB593mUELzDLwQ=,tag:4EChdzHuvLSxY+fEum1Gzw==,type:str]
+                      operator: NotIn
+                      values:
+                        - "true"
 sops:
-    lastmodified: "2026-07-09T14:38:39Z"
-    mac: ENC[AES256_GCM,data:CTnqJl6YPYCt3E0A4QAyt5guqgqiNfFk1xJPAvNM1/kv4HbEVeQxG349AaRSc8bQXcMBIVMf022L4+r0DnTEnyy71vMJwWAJTpnEKBQNaDZNCBraGcznSpOP3t7xibjsQ+pqx6d8xXUm9mDfIJU8Nmqvq+iGEUM1PYsKYfDwhQc=,iv:yBZlb8SujF8nv796elcBMQWbyBg+CQ388UzjVqUUyt4=,tag:P9rW9vl5vkuVFv/RM3gGcA==,type:str]
+    lastmodified: "2026-07-25T08:12:52Z"
+    mac: ENC[AES256_GCM,data:i7rQRSLbo97jjEksr0NlQzaW27RmYpHwupe+KSAk5Y9yCSN389EKDWGiOlnCbIDAFuvAeIwZOtZah39g1F0f6EW4UWhxP2URqhFtcc9UeDExEi15lbI0/6cgWsv3mHIZb6WPp8dHrfF0JszEPinb154TB3PpUmhyLkY6gghTYBY=,iv:d/pCDDw8itNu9NCkwTxPbr8w+unmSFrjbvaw6KYlrEA=,tag:x+0Us26vvNcvDyn45ilEQQ==,type:str]
    pgp:
-        - created_at: "2026-07-09T14:38:39Z"
+        - created_at: "2026-07-25T08:12:52Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQIMA7uy4qQr71wiAQ/+PV8hvPHvkmAg1BLaMWbpkMD0Y5/+uQbnnEfIaJdiE4VG
-            bxtqfBeB/f5kfLDoeVZOCO64tuLtljiZhGjFMA7qESLw0qAvRaDJhXZ9qD1cWSgG
-            DgVhp/4lb+yo37lLUYaqfeRDD5GTXOpKSZOf5WFPr5tsiL9YcfWVVWaf6uSjUl7I
-            OZkDwi3sDfypuen12I9BM580QRamQzsp6gCynQdE/4PjzND9vAvhEBtftZPLmd2/
-            5O4XgjaiJXo2PstAD3VD7c7vGbtEUfvn0vmd79yHz1YBtHRYtDfmnWwHJjeOpxP5
-            ooFW3uJuwL3N9/IaFTmgGHynjhQAqVdC79PL4XSVkSMoqdW8YDHBgErH9WI4Lsbz
-            vl2Wp9eIeopiyIzGXHsUvv/nP3ayp9pS16fV9xJGVczSi5c5YqFRYGtX7QIyXtqA
-            syQlnzoVr4MeT2A2MNdJEWKtfBRQoQR1Qc7ZX/XwfR4b5/58ci9HwBL2eLu0GzRg
-            e8LDnZsGQCozI7h7x332+Wu/9Mbs0wJ1TslQbXt2vRhbve0IvPjNSi54RKI4r8uV
-            /iFnRqPp2ow030nvW+LYt5jcqyKK9poC9nVoytUU57Pc3VmyppOJxc8/AfIezo95
-            LFFWj2CjWr47UspHcqgk84cBP13LmUhK7IeHNBzoWl6LPztuVCczoy7wxn8fGCfS
-            XgFm8RoiId9S5XLhCZ7qV70HhWOZemd0PksBP054xuWvlDMe/HqxvxUmqDbH/vGv
-            49o6a/FJyF2ncU01j72KMyn/ZbYevniX+QG+U7vWuhVRH9tRYYQUrgC0QnPqFKc=
-            =duXn
+            hQIMA7uy4qQr71wiARAAr6IcISfUd787wl46NW/mDOEv+sQCBCvFUSgVUETIVB2W
+            lryFntO+jxYjHYTDoevCimyJpFWai6YzkBvSVb50xXObpyHgjLl3IgQx6B3LZxk7
+            mwIgpa/mEyvlP06GzU4NZy3ac0X9bKpQo5IcU0nwfs5ZedCZ0i8FN76PUp/nIfFJ
+            6AzjxVzcJTDDEPu1ckn1g3sRvLsGsQVzagrLtyEFbYxKxugSE2sswYCMjbnxwMpW
+            NTWGal/6eW7W+oR5iJseYnkFz643ZbkI8BLyEuJtCql14kw5W245FZwbffJQpGpU
+            NbEuRjbVCF0tDwH9zEPNlBOsrmw0FM2HB6sBCMHA9xexuhP3OdIjWuyNHf6oMwS5
+            d2FCOT8xrYBWNOwcoe+xgLam94L2jPcL3SizP7AUEQU1CjXO5q49RvYjPrrgH5zb
+            PvE8yiB1zDPcTqnBf4O+lIUkdEQ0IxkVWuYKljsaJN35yNgFkCoROaGsZD4IcdD6
+            EgtYAllK+NXdzd2/iLHf63J4mJsvRHzLsWcdHZwvJxi3RN5Gi18EB1boCEhFM3Bg
+            KkaNDNwZtWtLl5QLkfO6zTEBx1E49hGRlE1nuDpSbqer7cL5n5Ca5TRAm0BqAC5Z
+            VIjt5CqNcojTVsZLUsYMwq/yI2Lij8/OdM1datuNM8RD33mE+tDB3n8WdNFgN8TS
+            UQG0emw3jDSkHQHVWGc2iPZ033NobqICdv3xvjyjdjngDWEtPj4OoLmriqxi0y7Z
+            LhlZa4RWyBc8TWe9Q8paBUh/NzFGC4v1zt8mfUMSjYfyFA==
+            =ePQy
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
@@ -21,6 +21,9 @@ service:
        enabled: true
        type: LoadBalancer
        loadBalancerIP: 10.1.2.148
+        # Cluster (not Local) so any node can forward to pods on any other node.
+        # Required for Cilium L2 announcement failover
+        externalTrafficPolicy: Cluster
        ports:
            dns:
                port: 53
@@ -17,7 +17,7 @@ data:
  Caddyfile: |
    vhaudiquet.fr {
      tls /etc/caddy/certs/vhaudiquet-fr/tls.crt /etc/caddy/certs/vhaudiquet-fr/tls.key
-      reverse_proxy 10.1.2.171:80
+      reverse_proxy traefik.traefik.svc.cluster.local.:80
    }

    *.vhaudiquet.fr {
@@ -13,7 +13,8 @@ image:
    tag: 2.11.2
 service:
    type: LoadBalancer
-    externalTrafficPolicy: Local
+    # Cluster (not Local) so any node can forward to pods on any other node.
+    externalTrafficPolicy: Cluster
 # Disable ingress - Caddy IS the edge proxy
 ingress:
    enabled: false
@@ -35,25 +36,25 @@ health:
 volumes:
    - name: vhaudiquet-fr-tls
      secret:
-        secretName: ENC[AES256_GCM,data:mdTS+RBfbQiY0c5aezbTURE=,iv:gQRWoRmGujhptSXm16JhX6VSHbB4yMdC3T7tPH1vfJs=,tag:DViHZOwOIPmHJQWTPUO8cw==,type:str]
-        optional: ENC[AES256_GCM,data:apLSVg==,iv:4ZZa85zmTuYb7D/p4mLZO++esFrPQyQ5xHCtT+aghS4=,tag:wWAEf3XWYKvsjwpfpyCb7w==,type:bool]
+        secretName: ENC[AES256_GCM,data:91g6xGYke1FlteHJX17r6w4=,iv:uquY66VZIAPnFse/maIQUcdRVFXUfb/M9tFvNqdgSfE=,tag:P4/D7jpUgEhcOnoxk+QO9A==,type:str]
+        optional: ENC[AES256_GCM,data:KgTxuQ==,iv:KIxXxFGKVA07qMVYZIcBE2BnYTtLl9tFrOZE57xIHXk=,tag:lCyA/TXsxTUZSZDveQSDdg==,type:bool]
    - name: wildcard-vhaudiquet-fr-tls
      secret:
-        secretName: ENC[AES256_GCM,data:Ww5/viWqr5mI51FqHizTRerAZnEyQONqdEg=,iv:VAMLvZ9yJxUCh7Kjf43J+M+ellkm5Xi3ZD5AlO95Rm4=,tag:F6H8LBi9kL9rrXJgVSbAmA==,type:str]
-        optional: ENC[AES256_GCM,data:LQEFAA==,iv:JkudOsHgn8qLEwqWhsuWnXjpCLJ3XrEexXtzjmOD+/Y=,tag:amUBIkXQIZnGQtxAAQ5mcw==,type:bool]
+        secretName: ENC[AES256_GCM,data:cZlwLn0jjz4GGX2z/w4ooeWBbyOAMZ9UHgc=,iv:Yh4wuMcyDekHzGUxCLldnAOaqLPS45YvybwhdZd5kGo=,tag:Z/jti3YF0/wdsrC9PxHVgw==,type:str]
+        optional: ENC[AES256_GCM,data:ZULOMg==,iv:qjb4nvvineVsTEp35JxPcMRDS5Ij4zIsc7PI+d6/M60=,tag:LcOjEqypcQLrBpXBrpRvOw==,type:bool]
    # semery.fr certs from cert-manager (OVH DNS-01)
    - name: semery-fr-tls
      secret:
-        secretName: ENC[AES256_GCM,data:dmLfoVbH9QKPMXPZZw==,iv:l9BKz66sdl9SssNzaz8yWoQ84ewDQprMv3rcHJQZhRA=,tag:NudQDM8eKC5aF6vX2ZQVVg==,type:str]
-        optional: ENC[AES256_GCM,data:Xc2tmw==,iv:xSa/xz/WibDqExKXjKSwLm5w8DOw9aZY44O1TZalfO8=,tag:Mpqi2ipn82+eWv8T2YvSng==,type:bool]
+        secretName: ENC[AES256_GCM,data:rxGGzrGRZPfzNjFIIQ==,iv:wvgWZIbAoBeJ/7/F4WeBuCHi1I4xHxwLtJZD7/SwV4Y=,tag:n8Zr+hwkD/Vm0LI/Se2TvQ==,type:str]
+        optional: ENC[AES256_GCM,data:5M+93g==,iv:KEMghZxEKvH+3vM/mtuVCIvzb2X19quX8Kd+oVJp+y4=,tag:mRqR+Fj86AWfGnvlTzRh2w==,type:bool]
    - name: wildcard-semery-fr-tls
      secret:
-        secretName: ENC[AES256_GCM,data:jwwNceE6ZAD0bdUFceBBG+HQPjmLSQ==,iv:15rvS8NjtKszT8LFS9Z3DLCVMBwQ0GnY+o3DSr+G3jA=,tag:GMZ68i+1XmcvIJrOZxBo1w==,type:str]
-        optional: ENC[AES256_GCM,data:8p7hYQ==,iv:a3Al2ph6xuJCXkLaFW6K7WSJss51/d9kVrX3Xuh/5e4=,tag:JYUYRsmEN7brNrENFPe/DA==,type:bool]
+        secretName: ENC[AES256_GCM,data:L6rjVVVtpOne6oog+Ru07ryaS2aVzg==,iv:Qg8wv1LUeaKKGzHpe2HHGR5GzJXYYog9HPJrcPhrMq4=,tag:8Z2yVeFv0mLZlQ9Yn3oRVg==,type:str]
+        optional: ENC[AES256_GCM,data:Na+sDg==,iv:3r1+mX+APihx5w5sU3/Rnyl4/ZjO8lO3jAcaBuG4B/8=,tag:WKYxuFraq8+659StfI79FA==,type:bool]
    - name: buildpath-win-tls
      secret:
-        secretName: ENC[AES256_GCM,data:kTI0dBzdTAYXuvSZwZC9REg=,iv:xf4pQABQGiuv3IJtiZhNMsLeDPVef2awVW1DmDThOHI=,tag:74IqPca8TuCFuIpJ8RpQ2Q==,type:str]
-        optional: ENC[AES256_GCM,data:mxxqOA==,iv:p1omSzhLh4yYs303OZCE5DfCNrzjAxEo+TOfezw/oCo=,tag:4ye1QalWmtW98B37DtkcuQ==,type:bool]
+        secretName: ENC[AES256_GCM,data:cHgBMV3iWihTRS2h4Gu9CZY=,iv:IttOh8Ra68dwxlkT8hZ4vhg8uEwDvByjFv/pT5ae9jM=,tag:+7xH89jLUMfJB/mJzyuE3Q==,type:str]
+        optional: ENC[AES256_GCM,data:QVSy/Q==,iv:25ldKY94OaF5IMSHtCzNacsBKA3MHTOHQtGVe0fY9g4=,tag:3fl1RCkfEjF86fMsYv8W4g==,type:bool]
    - name: routes
      configMap:
        name: caddy-routes
@@ -92,6 +93,16 @@ config:

        import /etc/caddy/routes/Caddyfile
 affinity:
+    # Prefer non-failover nodes in normal operation
+    nodeAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                    - key: ENC[AES256_GCM,data:U5edeFnG3Eu+7hhCmkUZXTf1wrU=,iv:hczbYIbQAq1XSCughZdVa9ChQ7nv62elsMtrUzCVV6Y=,tag:/Uh3rsO43oSfyX4fFCEujQ==,type:str]
+                      operator: NotIn
+                      values:
+                        - "true"
    podAntiAffinity:
        preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 100
@@ -100,28 +111,37 @@ affinity:
                    matchLabels:
                        app.kubernetes.io/name: caddy
                topologyKey: kubernetes.io/hostname
+tolerations:
+    # Tolerate the failover taint so caddy CAN schedule on p330 (small-node-1).
+    - key: ENC[AES256_GCM,data:wGARNk8BSuSn,iv:K1uKmlmQYv0/Y2lXP6JvIi1kbx1VwIb2m3XK1o+OHSI=,tag:PETfq6sO58vkFZmJBWJvDA==,type:str]
+      operator: Equal
+      value: ENC[AES256_GCM,data:2Z/x7/cf6CQ=,iv:yuFeoo3LvfTL2yDpCbOEb994lGao7B/mQnFKrdxEtlk=,tag:xN7t4jD6wZV8e92959BFoQ==,type:str]
+      effect: NoSchedule
+    - key: ENC[AES256_GCM,data:4mk1b0YQAmUOZ+0k7PsilvYd/oXlCjS4HT8QzfyZpUNSjla5vA==,iv:GhJGcDRX25UsKH3B8ZKPLUJOoo4+EqnzlNuBfy8ggeU=,tag:pzY8xT1m++02YD8YRPFpog==,type:str]
+      operator: Exists
+      effect: NoSchedule
 sops:
-    lastmodified: "2026-07-09T21:17:10Z"
-    mac: ENC[AES256_GCM,data:5APgoOMa+m5xjn+wurqyOtBoohpV271AnW1Ic4Thcg88bXryhr4Xn86Yo7fMbE+N3YqJMCaeaH6hm4iY8IIhCHgO2ybgMq50Bo8AqWxr6MKEpTJDQS5vSSWPq/Y5qr7B3f5/gOyxwIGslF4isVRaQzlcjoKzfvHsZX8SPdFhXT8=,iv:ZuareabZmxIyhh8kZs+eHGeUI7NZhzxER6KJE1/EiWE=,tag:zQuTYSrU76YEf1u2312ruw==,type:str]
+    lastmodified: "2026-07-25T12:06:27Z"
+    mac: ENC[AES256_GCM,data:uIOoHpLdiuIOF82w84PsziKyAglkY02OrGU0sigjnhyt+6S9ryy74oiJivzxtniTevsv2PKecN0uXABKzabp+ysY7/uDix/lE0KzoUs6sYA5kVfUj1JPoDQ6bQxoi0y8zKeOqMoqHwIAs+2N2VEriqtRxn+4L3kbTrbe9CFtxIg=,iv:5ZIt9yXKJo5pF9ghi+uVs7zxsdLtQ+pTlc37FKVz2iU=,tag:sTOq1pJh0KQ06soBcmcWRA==,type:str]
    pgp:
-        - created_at: "2026-07-09T21:17:10Z"
+        - created_at: "2026-07-25T12:06:27Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQIMA7uy4qQr71wiAQ//eR5eIclcLkl8wtERUoVHXL5KGKzEaxyVv9D5gHz51C31
-            kmAfrAnjT9G5UeeoJlW8XLkh1IWNhArNBMtoiCNUPAtfVDxszs5IwPWul+s3wJhc
-            X7sDq7EnIgaJr2IszIOTJ4PYxZ/uhyMdqmvRTZXMaz43F96cuDLctV4CFaiig4aJ
-            IcNlPIyYyS4tuaGB+ScLtbcDDhNc/8VRWn09SRtpTop+PV4KRX6AqLmhGOc9Jf9l
-            Dg3Gqdkaxl3OuqIvcrTmEPBe3sjnjIIdtJeG4SAbMUzj1xoKupXeDBZDnfmS5nku
-            42WR5H4RInzusj5NXP50C7AeLD4qavB9hl5CaxzA6TVG1X7LcpmcqBsVVuFcSjZj
-            T80iKklV6Ct0MLlmbxlKFTJm8fSKevhS/hdfrkUNcqc4N6eBb8tx93x+FcDn0A6P
-            c1zPSKj1vs326nJSHw87wvooQWn/f9j+Om1KLOR/MiUWmoEAbgkIHi3+k2wpzFb/
-            faKpshye0/XA/CZHFePv/U7sw8nKhfPhJCuO/IRrHKYzx0u/aqgOtPCURh5hS/fU
-            8dPQkbywgN67IRRKVz70cxn367cP1vn7L1AmzJfBd56NnViXXlS/DuitpnyTQpnP
-            tLG6qelq3Ul2A1J3BB1pfHR27IpKzd1UPD7HMhvvgSA7ErLq/VhF/kT1dx6s1fXS
-            XgFZ5XcyJQRc4Uxh2eFeEPOdWMAFRps6scfBsQuWR8m3cQvLatzcku1S/YDp56Kn
-            oUZmfvdQGpUuxsumVYCqk1+mQn02lkA1p2Y4ztrpLDCbhZXZ/fIT6Y1uYX+c0ew=
-            =0kw6
+            hQIMA7uy4qQr71wiARAAvv+DByIWPPLBdqAB39jdZPkrWzVN/7TJ3DU8q380NNMI
+            2w2I28Ee3iXl4e/Qj66fx8U8NGwdYo/j+mUjIddBjiJB5xzu97k+nT4toDocutGT
+            bOI4KZP/J7vh+spb6TMJvH39IGLOYH6N2NagRD6r15kd37ddoRbV8OFTZXvXf524
+            d3+PbqQz9FoulLy+Yt8tWWXD1MpqRbIHL65dAhLF0vZRxUVcnRmg77ZX2Q1yD7Wq
+            i8c0Pe1dhqg6ig+njshiC7HkWOQoINYzk012hz+Cid5JZAIyxsqxkdoFUWHeWI0h
+            u3XUpjjxj+eg0YlnAqrnK16B6+pscZWjEgHJEmrGQo8AGFMdALoubv+8nGiywNZP
+            tqM9oT1ePa0pIJNzhNgFWGkwwuyH4jPXrRji9fpLASAihsM1WQIh3smd373C0Z/W
+            sQYFTS9B6FUCCdDPA/St0Rd/RHFW+eJPC6Jh4728Pqa67FjnuIVB5VJ33Dgpl8OE
+            kEyY3WvtoYOaw+6VqWetg79sCruibmlenDWSrT8VQ8ksk/YIj+iicPnI/BY5S2Wz
+            j2s1Lpvvhr/gZvF7z+vfhX1Fn28xIg5/gkcoYSKgFhqxG69IlPbZsr/D2oWyeygd
+            tIp/D1yHGFJ1Cb56qr400t9xF5BD605rf/Aczg8mdvI41jGvmECQrSKHsxI25xLS
+            XgEVhCAm6HDAKEhjnm1wAZG8DJRhcrSLqLq7SPKJaTPJpjeQwXOb6OIs9ugQx9ON
+            w96InR1VMsEUlh1EWBXUqBgQgyDIIEAa+wHBnY7U06fkazN6lcLkAp17yTitTEk=
+            =gULt
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
@@ -5,7 +5,7 @@ crds:
    keep: true
 # Enable DNS01 challenge providers
 extraArgs:
-    - ENC[AES256_GCM,data:yzuTi9Hu7Dx95MQN+H/6gul381m64KYv5ZsHwg92BE/aUZyJzYArniIC+Nio+SygUXXb,iv:eBizFSW1T2/VvN3k8VRsEIpllHs5MA6Nr+jh9fCzZCs=,tag:sz9WBU687eTgnDXWoE02Nw==,type:str]
+    - ENC[AES256_GCM,data:RcKzGzDSFXAw32vBKyvMTzMx5u0AmXKpXEY9/YRxUI0SNVy68/uUSpFhdmcB0RvmzG7y,iv:AraIcgoVYO1IVAmN3dd6pXr3v2BXaizbK8HefwsDRqE=,tag:QlOBuyxbddyk++nYLhMl6Q==,type:str]
 # Resource settings
 resources:
    requests:
@@ -14,6 +14,15 @@ resources:
    limits:
        cpu: 100m
        memory: 128Mi
+# Tolerate failover nodes
+tolerations:
+    - key: ENC[AES256_GCM,data:WXIPFO1nBe+6,iv:t8RP3KL6niOVe84Qqu9+JKp2qNR87qnMzJOh7pUsudg=,tag:uT7gWSdOz86PPi2NZIxZeA==,type:str]
+      operator: Equal
+      value: ENC[AES256_GCM,data:N1IHrGvrobA=,iv:QiKeIiSBFThw05b5gkU41koci4CDZ0ZxdLX1r1DD7Dc=,tag:QGWcNIYqUdEy0f0bEYC91Q==,type:str]
+      effect: NoSchedule
+    - key: ENC[AES256_GCM,data:QMtUDj9EDXWbsUBLlQJ5yFEsQ3fksIRUqIk7tKyts1aHqNQ56A==,iv:GVEl1AcWNLAqdXqyJTMoYBPRqqvhSHGBN7fuMLWtjoY=,tag:bmCK8yCiVCXci2JJFvw/GA==,type:str]
+      operator: Exists
+      effect: NoSchedule
 webhook:
    resources:
        requests:
@@ -22,6 +31,14 @@ webhook:
        limits:
            cpu: 100m
            memory: 128Mi
+    tolerations:
+        - key: ENC[AES256_GCM,data:QZjbo0u9rqht,iv:H3mZnC4a2abmOiW0RhoFAiAvVfaRFpGU2+XKYy8uBUQ=,tag:xwp+rkiYrSo1q+CsLdup7Q==,type:str]
+          operator: Equal
+          value: ENC[AES256_GCM,data:UsVMCFtyl0c=,iv:ImpKIQtC1jX2NLNTSDhq4a9nq3I2HlpSr7QLUOw5gd0=,tag:xM/vf2MhasBNWbLqxkUrQg==,type:str]
+          effect: NoSchedule
+        - key: ENC[AES256_GCM,data:31pC3NOA0AH2d0V/N10xX1U8E1OD4YL/27+xFLxElfYb1xWSDA==,iv:aaaci0Eu3Mb9og3Za0beB9js3wSjcNE7BOS5iAko3aU=,tag:h40mrm+gPTf9jCP7ax1ihQ==,type:str]
+          operator: Exists
+          effect: NoSchedule
 cainjector:
    resources:
        requests:
@@ -30,6 +47,14 @@ cainjector:
        limits:
            cpu: 100m
            memory: 128Mi
+    tolerations:
+        - key: ENC[AES256_GCM,data:rqZTE8j9xDAy,iv:EvztWg01VbvJhdhkrVz7M0mA0EUhVW2Ty/de0D3pgmw=,tag:rGUZky1bUhewhKDp3Vo8Eg==,type:str]
+          operator: Equal
+          value: ENC[AES256_GCM,data:fPt+n+ftbGI=,iv:xHy9IUIBgkHDQcVZ4MyA3tXPvMAy14gHhkxe2AYthR0=,tag:szam+dyODZSjfX6oxsFdSg==,type:str]
+          effect: NoSchedule
+        - key: ENC[AES256_GCM,data:As98cp+6SvVwxRtdxx7TT+HGzejgWiacf0TYm2JU9kPqEA7ljA==,iv:dd+TS9T57NrpgyZjYgPi/aCiInfnVxh3VbO7gddkw8k=,tag:KQMA0Kn0YgE/HpAJk83pTw==,type:str]
+          operator: Exists
+          effect: NoSchedule
 startupapicheck:
    resources:
        requests:
@@ -39,27 +64,27 @@ startupapicheck:
            cpu: 100m
            memory: 128Mi
 sops:
-    lastmodified: "2026-06-16T08:15:29Z"
-    mac: ENC[AES256_GCM,data:ZB7igt7ciH6X0DmvDi2gzg1eA8EYXqq/VRBSbaLT9x2SUi+9ax9w0V+fcTwOTWlwCvHOtSAZ2RYgX/wKFmbnKgrwoSpskGFsRlY947oLkRTk4HbTRP5HbciAQsRw3AVB4pgkR7maVZ9n15gzNHTTkd9x1akAeGHJg9lzg9+N6rE=,iv:jqyi/ZGLjKFBe9XSj2WBBOUbn9xvV9Wf4wrYxSs4t/M=,tag:2u84qHa69IsYFtSwJ6yFqQ==,type:str]
+    lastmodified: "2026-07-25T08:12:52Z"
+    mac: ENC[AES256_GCM,data:yFXZxbhJi5PPVXl4j73FfOO5hurvD7ZXgWr5eZS8poE7IEg6IgZKBjwq1ITMUP5DyS6K2onR/mgZVzgj5X5I7hEwj13DAPW7wWthZql+De7oGxe5Nv74fDFEwCoqh2sTbdrQS2KyPY+rrb0ZMZD5qpdZzyw1AVGzVKeJJj9DdBY=,iv:SW7sb6mmJulekZn1Eh2pfYml1PwJ5v6z/PBdV3TL29A=,tag:5HzpRnH2G8J//J2fZhrxrQ==,type:str]
    pgp:
-        - created_at: "2026-06-16T08:15:28Z"
+        - created_at: "2026-07-25T08:12:52Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQIMA7uy4qQr71wiARAAiNHNEJjBOd6AK/moP1Xw7nvOidkRtIqw+QJRmfhPDG7B
-            CQy3y2armtFYzaWhDcMfiy1SkcD91kadbfxAifb5/Oit48VTv03bXZDvyrEdRwcI
-            n81rt3GQuyNDCj9aSUVi1nT5GHETrvdnyJp3u1dzfc/0i7GK+FiCbGAGzSnGdN77
-            +/caT5Jib+hIVskiOjhE85K3rTrh+aJMFKC6NG7Vw8GXh7N4r3EcazcX9KuJXxsn
-            NRT7XyYA8y15PlZQFkhRs1QCVvqH31WDwCEt0cE4r6Qn2aGy+v8ygJkum2sYPH7g
-            WZfC548mZrMrI9UNo10UfPCqGew/XpEla1/bgVByMHMdM9n961KRzCPtR349xXI4
-            1APX4WClQjbL/cXR2zMs19Y+GDjL7XF6rdSRDpEgTzQXb4f1ctswutcYxftvKI3c
-            EdfCGiRpVJx/wIuh82mL3SWqdi05Lekvt1zdLcG8Tx2+nF+52dWoyxNy1YMVyk0m
-            RXZFMZLHKumyDooairf1P11DOXcsa8FjZrqjvn6QI2LfmEGm3PQQQUXT8Wp/10e2
-            78Hr1rTGqQEzvSJu0FfDuundPws97ftPiuGcUD5hUj3rS6iGxdEp4trAPi0DCCd3
-            g7m6fNX41O8n39EU0Kp2G9kfICMghGEVL5czzRA4EsLH35K8XqP0ig6ay5kVXWrS
-            XgFic5jk5GdxzUL7TFjtr9AFFaWhIZkyyXwvEod3Ur3gB64Pi/ktet6OZSWU/7Wn
-            eRKn9yEm+W5Xzn9eiN6TYDsCWQBY5nP80YVuj53AMSu3KbR7UGy+AbJF3T+V6lo=
-            =GscV
+            hQIMA7uy4qQr71wiARAArV5QxST5xu2jG+X9Fo6F4o3uxMS/Kw56ey1MMTfgkTlM
+            HdV1n6lityMGXB278GiYhmZYRdZl0kAT+Dj9Y0RdaiI8BszocD7IbBKmE1tVseCr
+            Xa4y7nWE58xz2Ca26KVf/I64QPHsKKus4wECGOgZrh7Hzb+KdeTJBpuMMIgnJe3l
+            1C6VdfTgNlYPW+zAmX3i39ZwYO7wcz5UZ1aXozAtoOjWyjdcArEdoCH9iD2GXTOe
+            0EsvgdUD1U2n4ffy+Z8mga6V8URkJQ86XTuFD6PhFF1bhBwa36MCUXAdlD9ONB6d
+            jaKSAPAeia4C+0vCXTv9OYEHizSe11iwsUyPq+bmMrYCUslaiOCC+QfGtJEcCJj/
+            ZeAjXMoyi5Fnmwj+y5ED+O1DKp/sDyUdvix83L1UWVfTrgNVfXFCGzHJUkcZhfUk
+            Ye9KcbH+7+mj3p/lAgbQjBjVemnW6GFzGJYcL/rWwRBxw2ElLxKPnR9NQK9VY5w/
+            wCmWzG4Cjr2gfLlR05A72/i68fRM9eAy4CFL5y4xTN1eYe+MCz2ZedZDd3uYTKUC
+            TMPGXfjhy64W/cV8MWa/aYCyNguVlKbmUl7kZwb+8DAxrSyPqQal11DJtcsv3zFO
+            BUf8GQFn4jXXYqd1LojLM7bUjAkXWZUIUbg1+jWfPGsgsTGn4R0tshtY9JOfQpfS
+            XAGL6+0+DQf8wY7yzbds4DSDMNTlOH7iWoX77okayY3L5Jqc3jB0glMJbRwdmgnj
+            d5JzAoqDhi1F+MQdTYGu7RQpawKr6ndWqwkT5ef5BQ86TQq3/+jZ5uuC3qnE
+            =uS2O
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
@@ -3,3 +3,4 @@ kind: Kustomization

 resources:
  - pool.yaml
+  - l2-announcement.yaml
@@ -0,0 +1,22 @@
+# Cilium L2 Announcement Policy
+#
+# This makes LoadBalancer VIPs (from the local-pool in pool.yaml) truly virtual:
+# Cilium answers ARP/NDP for the VIP from whichever node currently has healthy
+# service endpoints. Without this policy, L2 announcements are disabled even
+# though enable-l2-announcements=true in the Cilium config — the CRD policy is
+# the gate that controls which services get announced and on which interfaces.
+apiVersion: cilium.io/v2alpha1
+kind: CiliumL2AnnouncementPolicy
+metadata:
+  name: default-l2-announcement
+  namespace: kube-system
+spec:
+  # Announce IPs for LoadBalancer services.
+  loadBalancerIPs: true
+  # Announce externalIPs assigned to services.
+  externalIPs: true
+  # Which interfaces to announce on. empty = all interfaces.
+  interfaces: []
+  # Select which services to announce. empty selector = all services with
+  # type=LoadBalancer.
+  serviceSelector: {}
@@ -80,28 +80,37 @@ extraVolumes:
    - name: zone-config
      configMap:
        name: coredns-lan-zone
+# Tolerate failover nodes
+tolerations:
+    - key: ENC[AES256_GCM,data:jLsxKqX8HEo8NbwtjeGf+8TdVzTgpba8myb09z1FOIoBsplZ9g==,iv:c+rAeZRAL8ZmQwpHDF5xv/l0ZqbWsnsdDlpFDSDfZrA=,tag:u9TfeXzHJ6W0ifaAEoPYFw==,type:str]
+      operator: Exists
+      effect: NoSchedule
+    - key: ENC[AES256_GCM,data:hPb/xXAmQrH6,iv:xo935JWcl3a3LyQ8YNIgNrjQkdqlP5aN4ZnjTnp4RM4=,tag:/rkpqOI/pHqXP47OGULnOg==,type:str]
+      operator: Equal
+      value: ENC[AES256_GCM,data:nblSYUAjuMk=,iv:yu/IToMo3DC9kfI5DcBPvreJE3dkxdFA5x2fy6dUpjE=,tag:NGVTMBXa/STsOCD+g00yaA==,type:str]
+      effect: NoSchedule
 sops:
-    lastmodified: "2026-05-02T16:59:44Z"
-    mac: ENC[AES256_GCM,data:H4uRid1Fqx4JzsF43TSGa7QcGjpXLAHiM0N3Kf4z7ab4eMlTy1+RXMV7xVT9BinjZzH6P+ENxo0yVOsdt0Yu467KJhGznNWlb2MC2TElPxZ9/yItJ+hdVGHGWbVGFWUL5NOUQ9fY2NPGw0CGr8qyftLr5Qkx0LO/VUgKWkq6RWM=,iv:9+V/sCBhfWAsIvr4DsWQgkeqQZQyT4Ti3Y+qCEZqU5c=,tag:JCRONb54BpXQzYhhPs7VGA==,type:str]
+    lastmodified: "2026-07-25T08:12:52Z"
+    mac: ENC[AES256_GCM,data:fyuCFq0hIVP0P8e8vqF/OKjBway2EzDo8HJhLpTQqhIOhOP6PsMszovi7BzG4FuqT0Hbcqo7YrjcVKY2WPGIlxoMVBuuXcUSvNB8Tdu6jv1jgq9KOoB0HNbnqX/l3TzN9ckC6Hr+QrwzLIpTYNefDlNovMCz+zBP6ALfMwADCYM=,iv:EiXUFcWr9iL1qdfzcTiL6LYLLrsShzwNNhE0eyLVYrU=,tag:JyN9WrQWSE/3wFksooRRFA==,type:str]
    pgp:
-        - created_at: "2026-05-02T16:59:43Z"
+        - created_at: "2026-07-25T08:12:52Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQIMA7uy4qQr71wiAQ/9HzeTVqelbvPtluYa5xGvoYNeEEXg43CwrwZ1/z5yFWvx
-            DoOCeyro5wFsNC6td7n2HVhtK0ULkfrMHH8OC+7L3bXbnlEnQzITmDggAUvfegCv
-            b/7ohPkOdLvi6qXbr8bgqCZYFnPq+gUs3UOPh5Tl6wgzRSFXw2Hsb4YmQkvZJUNb
-            PhPpLIUe/ECE4hmEjO5v9o3X0o7qZ3bahf9mZZlnJnvXT7R/DM8eeWTis/q0WSHE
-            XnclhOX4GlMwXxa65sRrShuPcsV3qqX3VWOSWJFBhGx/FDtZTkhlHGQ9YhF2TzbB
-            xxCrn87mH2W13NH6jQOQYPh1JTTJbgZZMZXgyPNmPDSYZE1kxTdrz4l4mcmCDND0
-            hY3T8iR8ap2b3HhSNCqC1C0QN/bK217hTs8cJHWRRfa6jfh12imwk2XhJkB3zZxV
-            O1oSb6eiP0ba0CgXu31shmfXuTAeVbTm6E50heYorjQKR5djjnOVwQUdmis1Awae
-            AQTiWtBBbOgfX5WA5b6wInFr0WEsshG+YuqfB7FhJpo2SHyeFhgk47ssHWSeBpPv
-            wa4OAGaMkdGoePQhApZFrBCZHslEhPE+XQlDdyOtXCmxBOcLwe59ikWLV75j0DzS
-            NRUNOBYQ8Q1Y6Su/sJWW7TykQkmDirU+oIYxAngZyIyJSWvARPd6fJJvkqqg013S
-            XgH1+LQJWNEJzIaLKCWbkZXnMstsOYrs4ynV4f/QZKU+Md5CgVbjy9KIC/trfNhj
-            1t9kkyVVOEO7UmRhMyl8pK2gQDiOBrkhUJ5tSNFEfxM1llZ4GZRV+SUuMC3UzVA=
-            =l7Wo
+            hQIMA7uy4qQr71wiAQ//efLh++Dcra+LFtcgz/BRXdLyE+RhWXpQjABE2PzgOJpQ
+            xubJJDmIV7BtUFyJS2lEjuZ2Be8uYxs2WtWILDktz2IwNQ882NVCWNCQTPuzEpoK
+            DWqwi7/L6iQldx1aeE/VUocyIxYsqS8ZUHqOM8Z95xlQ0/fmhB7reTCXvuEOiRy6
+            Aapvb2yW9nm7PwBVhJiWQQLGVGUkgPE7HIK1ar3ODl+b4T0FCYqjUzeB78mG2D5i
+            RI0SRt56w+g9XVWk1tijKL9wx11U9KOBbmbdBuE9fkHuenns5omAzKIK0iwdHQkV
+            cl3rr6m79OAqJglDYLFf8LOgHxuVcnlVxOYgmiHXjG4hlJlt7rGE96+UlRHCemhD
+            bgyc7kDR3h4XMagI0OcLzjyvwsymCtZFiE5PLRVLkSCQuyrp5B3QL7Z5hbRZFiKF
+            UlOziOw8sPOcvjOOJpPYF2IqWAGLSYwo5S0nI0O0bwOiM+T+ehZ5q8p47NzFp04q
+            l6JpHtWdjsxVS38nDb9AWqvoHyf8EtFbJYmKeowmbN1/toPQ1q80at/NtUZIzn/3
+            +VhxDP9u38u+lAAuhaBdIolitOi9CWwHqrnRXFa3V4fpQfJqXUc9You5bw/+EABV
+            jTjMpcN7cPWE7SC9R1ZZjvxrMKK0qxdKO5cvXtP/hBd4zOnBqhsQBzr/QB3DycPS
+            XAExosGRaKVumsUVYqEnh7ACVtMHGDLvupj1mqSa8oxRJLVDXNFLpEllFqLpoxjD
+            qbCMib+JeL9/Aq83Apk3HQ48WX+4hvtkKIJ7gzeIPC/IvIVJHk0shd49kxBN
+            =Xsas
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
@@ -5,6 +5,7 @@ resources:
  - namespace.yaml
  - repository.yaml
  - release.yaml
+  - recurring-jobs.yaml
 secretGenerator:
  - name: longhorn-values
    files:
@@ -0,0 +1,34 @@
+# Recurring backup and snapshot schedules for Longhorn.
+apiVersion: longhorn.io/v1beta2
+kind: RecurringJob
+metadata:
+  name: daily-snapshot
+  namespace: longhorn-system
+spec:
+  # Fast local recovery from accidental deletes.
+  name: daily-snapshot
+  task: snapshot
+  cron: "0 2 * * *"
+  retain: 7
+  concurrency: 2
+  labels:
+    type: snapshot
+  groups:
+    - default
+---
+apiVersion: longhorn.io/v1beta2
+kind: RecurringJob
+metadata:
+  name: daily-backup
+  namespace: longhorn-system
+spec:
+  # Daily NFS backup for DR if a node is lost.
+  name: daily-backup
+  task: backup
+  cron: "0 3 * * *"
+  retain: 7
+  concurrency: 2
+  labels:
+    type: backup
+  groups:
+    - default
@@ -1,10 +1,7 @@
 # Longhorn Helm Values
-# Single-node R740 cluster, backup target on TrueNAS NFS
 defaultSettings:
-    # Single node — only 1 replica needed
-    defaultReplicaCount: 1
-    # NFS backup target on TrueNAS
-    backupTarget: nfs://truenas.lan:/mnt/fast_app_data/longhorn-backup
+    # 2 replicas so volumes survive single-node loss
+    defaultReplicaCount: 2
    # Allow full disk usage on single-node
    storageOverProvisioningPercentage: 100
    storageMinimalAvailablePercentage: 10
@@ -12,87 +9,95 @@ defaultSettings:
    autoSalvage: true
    # Disable strict flushing for better single-node performance
    strictSyncReplicas: false
+    # Toleration for system-managed Longhorn pods (instance-manager, engine,
+    # replica, CSI plugin). These pods are created dynamically by
+    # longhorn-manager — NOT from Helm templates — so their tolerations must be
+    # set here via the `taintToleration` setting (semicolon-separated `kubectl
+    # taint` syntax), not via per-component `tolerations` blocks.
+    #
+    # The P330 node is tainted `dedicated=failover:NoSchedule` (see
+    # infra/p330/kube/variables.tf). Tolerating it lets Longhorn schedule
+    # engine/replica pods there so a volume can be failed over to the P330.
+    # The control-plane taint is also tolerated defensively, although with
+    # allowSchedulingOnControlPlanes=true on the R740 it is not actually applied.
+    taintToleration: dedicated=failover:NoSchedule;node-role.kubernetes.io/control-plane:NoSchedule
 persistence:
    defaultClass: true
-    defaultClassReplicaCount: 1
+    defaultClassReplicaCount: 2
    # Retain volumes on PVC delete — safer during migration
    reclaimPolicy: Retain
    # Mount options for ext4
    fstype: ext4
-longhorn-ui:
+# longhorn-manager is a DaemonSet — it must run on every storage node,
+# including the P330 failover node. The control-plane toleration is defensive
+# (allowSchedulingOnControlPlanes=true means it is not actually applied on the
+# R740, but keeps things correct if that ever changes).
+longhornManager:
+    tolerations:
+        - key: ENC[AES256_GCM,data:DDNTXJiwP2LQiOmqgf/L6tLIZiFgqh42dLDXj8xomGv7rlUP9A==,iv:eu6vnl3EiLu1DWWDWlxkQNcN6/uEhSkpufw7L9Ikr14=,tag:DJOMo8LDGmzkqvIEkfCTHg==,type:str]
+          operator: Exists
+          effect: NoSchedule
+        # Tolerate the failover taint so longhorn-manager runs on the P330
+        - key: ENC[AES256_GCM,data:rbWq0sruC6zC,iv:Eq5izQ4LXZ90Bhf1BJ7V9/Xo7HVMULeDHZ6NgItZfGQ=,tag:ixJt7YD4cBy+SrG2WVn0ng==,type:str]
+          value: ENC[AES256_GCM,data:wxGNkS97rg8=,iv:bBGGqcwibhXE0zkH+ZJEVgr20ogu7JwQxxDXqJcMdsQ=,tag:VLBQh8vRl1SiYB9S/vwLeg==,type:str]
+          operator: Equal
+          effect: NoSchedule
+# longhorn-driver (CSI provisioner/attacher deployer) — tolerate the same
+# taints so CSI operations work from the failover node.
+longhornDriver:
+    tolerations:
+        - key: ENC[AES256_GCM,data:1EBSG4hL4heCnLFJYzTNaQWtFU3v6xwTlG+Y9/H4p5d0TZdFog==,iv:9ILcNXXzxzG5CYA4Ny7bKHBI581B1qJC3OBUObScxbQ=,tag:4B4JaFO0tfyVA6w7ypCY6g==,type:str]
+          operator: Exists
+          effect: NoSchedule
+        - key: ENC[AES256_GCM,data:ZSC5qg+ChOkI,iv:rIq8j7L7F641kWDzcSV9lrYxhHggT1FTZ8WF53vxvV0=,tag:Hj4RlF3usdIQi0G6Ecmdbg==,type:str]
+          value: ENC[AES256_GCM,data:YfiuCv2EKec=,iv:+6i5CT1ToCKy1gFtVVIFv5FLQaJaKHx4vQk8b0IBy3U=,tag:zHgzNuijbwI1QbvuLnZNvw==,type:str]
+          operator: Equal
+          effect: NoSchedule
+# longhorn-ui — tolerate the same taints so the UI is reachable even if it
+# lands on the failover node.
+longhornUI:
    replicas: 1
-longhorn-manager:
    tolerations:
-        - key: ENC[AES256_GCM,data:yWX0dGIIpvCVOeZbvY7Jjbr/t8mcyLiLmzHrCz0bwXIBRgG0Ig==,iv:m1wOItluKgql41BzKoBvgyjBaG7Fplz1c4ScONjZ/c8=,tag:g+7730DA8KzK/7ApgumDcQ==,type:str]
+        - key: ENC[AES256_GCM,data:n4UdwssGYhHQgDTpCpu+WgIPsdNc8uAaZtnURZt0/C3VfeLR4w==,iv:mqy0GqHN0KxtkETS7psu61Mr1oGmtPDhg2vQhVDas6c=,tag:uUd+NY90XK3i0aigc5ndCg==,type:str]
          operator: Exists
          effect: NoSchedule
-        # Tolerate failover nodes so longhorn-manager runs there
-        - key: ENC[AES256_GCM,data:PksAIja6KV8+,iv:oDJ47xFoCKysl8yf9EQVJp9PGLKJQMWUOsIAcirjzJM=,tag:n9HVtUsERVmlQqeXpObvWQ==,type:str]
-          value: ENC[AES256_GCM,data:JDsyDMHMh0k=,iv:D3oVkD3tsxVE1hvcMcCYogoD7IVetrAbMzp6VCTOF6s=,tag:/cx/tQuGf1ImsVTZkwwt6A==,type:str]
-          operator: Equal
-          effect: NoSchedule
-longhorn-driver-deployer:
-    tolerations:
-        - key: ENC[AES256_GCM,data:lv255SLl898RJh8gx569wM+lL/YF8AUXhKuwEY5RUmw84z96Vg==,iv:3gY3OSeoVitIZd4rMgZK18bI9xtcsk1T0U0PphLZSZw=,tag:TMZLWxRTZB9fwNIThytnxw==,type:str]
-          operator: Exists
-          effect: NoSchedule
-        - key: ENC[AES256_GCM,data:dI3C6OPdnAW0,iv:G5vU4nypD3s/vffdQneasxHzUUXHsgUThjUtYKRfk7U=,tag:SD08w8Gz1WDaee/cM89hZA==,type:str]
-          value: ENC[AES256_GCM,data:GsbeabJMKjQ=,iv:qA+wC10BjpzMprPgoLeiBKAU1RcSef/yMfDzWbgAJ/s=,tag:9qS5tquOU7EkZ7hrd+VZhw==,type:str]
-          operator: Equal
-          effect: NoSchedule
-# instance-manager is a DaemonSet that places engine/replica pods on storage
-# nodes — it must tolerate the failover taint
-longhorn-instance-manager:
-    tolerations:
-        - key: ENC[AES256_GCM,data:3EHDHYKTaDyk,iv:D6z907ohAGqkoytBZ7s1aWJI6tRPsF7N798MwF9um+Q=,tag:zvEM2dzoWx4kLbIrbVW45Q==,type:str]
-          value: ENC[AES256_GCM,data:D9mG3tOtQas=,iv:JpbQDYKMZvNQSkoxw+1zwTeIrdrIr09oa7v8tZupSb0=,tag:5ypuOjneHKzSsJEXE4enxA==,type:str]
+        - key: ENC[AES256_GCM,data:isSkUNqax+AU,iv:jWgZyZL9VMmzYqoLCUkIiUuy1iBeOm2RE5CjZGCcXxQ=,tag:714V0YGb7jqebC4IRX/phw==,type:str]
+          value: ENC[AES256_GCM,data:Qbtu1wgV1oI=,iv:RihD43IA1+C3m9OkXACGgd5lY9lDWCyzIcw/MCoSMvg=,tag:WzQtC4rT+uovS6s36DJWUw==,type:str]
          operator: Equal
          effect: NoSchedule
 # Disable ingress for now
 ingress:
    enabled: false
-# Recurring backup and snapshot schedules
-# - Daily snapshots: fast local recovery from accidental deletes
-# - Daily NFS backups: DR if node is lost
-recurringJobs:
-    enable: true
-    jobs:
-        - name: daily-snapshot
-          task: snapshot
-          cron: 0 2 * * *
-          retain: 7
-          concurrency: 2
-          labels:
-            type: snapshot
-        - name: daily-backup
-          task: backup
-          cron: 0 3 * * *
-          retain: 7
-          concurrency: 2
-          labels:
-            type: backup
+# Default backup store (NFS target on TrueNAS).
+defaultBackupStore:
+    # NFS endpoint exposing the TrueNAS dataset as a backup target.
+    backupTarget: nfs://truenas.lan:/mnt/fast_app_data/longhorn-backup
+    # No credentials required for an anonymously-readable NFS export.
+    backupTargetCredentialSecret: ""
+    # Poll the backup target every 5 minutes for new/removed backups.
+    pollInterval: 300
 sops:
-    lastmodified: "2026-07-21T20:19:40Z"
-    mac: ENC[AES256_GCM,data:AxrJFHyOjoP5c/1uFhlSIwe0E/oIesu52EU7zIxwLVQ8p5r4Fa7/NpSbeK+K3lAuYTrUiXvjWdbmVO5IQhvd+PNj6nXPDxBO92eoxzMtit9m8mnAiEGGYayeJMU9DaKPlGEs3CUaYzAizP1Ub0n9g2iq8CRcHVO9zOQ/DfUk/tA=,iv:bQN9v/n0/Z1Sm/2Im1SGskjqnxJhAbBT19IC6HDSufA=,tag:qLxMS7HovkykXHqsvinLDQ==,type:str]
+    lastmodified: "2026-07-26T08:44:08Z"
+    mac: ENC[AES256_GCM,data:4shHlVWcVol/Z8b+5+tz6shT8x6gCZz2xhYv1VT7dHlgcYWWgq2V5mbGUtsVmWFzkGPC5rYvU3dUEiEkl0zb6Q1rP/fD6xQmlyIgH/ioHrfCvjorY5Rv8t4OFH/TyBK9hMwC+iFdAUJOdE9vYQoDmUMTGz6XwWiDY3PxRv1X9D4=,iv:DDDiStImg5qH2QP9lcSyW5+b+1P1mk6F0TWkt9p2syo=,tag:zJnZ455gsXPkE4Lfup2Rcg==,type:str]
    pgp:
-        - created_at: "2026-07-21T20:19:40Z"
+        - created_at: "2026-07-26T08:44:08Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQIMA7uy4qQr71wiARAAoYpVy7elPl0SzogH1900DzVQsGV0SylAh4h40+YOmezu
-            k4y501ZRIRv/r0RiPp7pJ7o9zynVQdcsRos0h0GBy7BbzIXMJpjRrpqXIvSeqtgt
-            S5FJIUTkVraKo8kKtDvtbiN6rz7qwXkBsppF1euZRVVj33hCX8vqL6EvhP9FBOBO
-            354Q9h92F+D94+JQt3K8n3hW/qaQIcDhJ4AgC7I9NPrA+rb6alUWQPKfFDSlYUkb
-            mxrLz4DE5GOVwMhaE/PrKLYeV5+KLRdsK0zzQadxG4AUSwpK7ZwLIIcQ1L0zQ7ST
-            SxruIi5EahUsDxNKTZvv5NnUFZpncqKCFfnxF69xIlXTAXujdOfY/21HZ+mmCmKJ
-            kTmsNtlKE1ltDwzHiowdLFqzHlME83bdRtYPuMcvhAFSv7yuVd9zfXIjQNjPFmYc
-            55EedJBrvFbxWU9QP1dEUpcELGXroiOowjGM4cushYgeBZzXJkTMg7JmoB+HNiWY
-            Ld9XaJOOiJ87BI1zbhkMPo+L9NSF5zbtYkBiulSyb58gTuixTESnYxPxWC71EZLV
-            BxFEkapXY0Y89h6uFH7FKz0MiniojA4zvNFt2LQYICWXdUAJqqpeIRv88iUJkKDv
-            THVf7+wltQ4EHTuu4E0rCsg+3GeOIIYkBrLESjEsaSvQ/B+Iz9JgUFRkRr7lVvzS
-            XgFL/2+26cLT81wCUson9XW5X2GZV8SgfWTFAXCbaaTxluJU1l1jIyWUoWnTFF2S
-            tKqNQBSsUmYlXIyize8d+ueVQcldN91bwpOXVmVIbghFX2Cp3H+4R5qfJxpH6yA=
-            =03zX
+            hQIMA7uy4qQr71wiAQ/9FsBtkggrKwHfh5FFRUFkyqCU596d/R7ZEvsMP7zzCH9H
+            VAAYJxl8D6/KY5EavpeZH4s2ZnlzZjlb/qS2CKpSzXuN7ADPnK10cBxxAOQLp6KF
+            pqdkv6x5MyWbfv87IzM8cI0D/jlG2/iZPfBZy/YU4Rg8cefIl82vNgNADW2O68bK
+            w1VS75AYKmUfXZ2vqz+wX46YcjdXkrvRwzM9lzfIm2Q2dKMqBKSYzxMICZ/hWGRj
+            t33KbZLKC1Kg0NmYOY4GCt8hi6Ck4TjKvzxktsEpXYFDhWzXe9nr+axtrfypLrAn
+            fcLCQV1FSovMK+P4JxB/dd0u+F3RR500F3tBJPQ1xs1Rc1f8Cd2Ynr/3LWtTstkq
+            JyOfLFAj4/LG8o7ub/FSvLZZI052iRLZqlIIe0cFTqCz31yVEJOnLJWmME36hDEm
+            rfd3X9IvixfwWVTa3K0TxZta7u0Q0DsqHIt3eLdeTJC3wY4J+A/vUvPFv137YEqp
+            O+/ALTbwK7ViSQIupjr4kEcklBtiu9myNi3u8JNg67/XHwahCh0tfGk4jCevve5S
+            dDk4Ud7469LuDwYSZw0RdwuU89jQivvsp8/mZpQIoSVzl//iEQ2EOAff1gMfiPoj
+            1MrwGtrrMAo+2Uoxacd7LfFn/l1zRNiGw1rX21NzswmzIU84US4Grv9LGealQ8TS
+            XgH+datMRHIAPKcYY0u/B/PfyoKArlPUzQsIQOm02+s1zuvK/dArKxgObKTAr/u4
+            uNuVH3ObUVMb6VX4iwlxfS+VKpjotTbgY2TJfV46kGC3JJ0w1LdjEyJbpYlIz/k=
+            =HWEp
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
@@ -11,28 +11,48 @@ ports:
                # caddy
                - 10.1.2.152/32
                - 10.0.0.0/8
+# Tolerate failover node
+tolerations:
+    - key: ENC[AES256_GCM,data:730ZJScF+2rP,iv:n1QgsKA3w6rv1d2tQddG8FkmADp6tI1gj+p7FnD1uA8=,tag:wtlI+476AdFHSp8I68Qs4Q==,type:str]
+      operator: Equal
+      value: ENC[AES256_GCM,data:uSBDyP1NASA=,iv:wFwuuUWxQKqmb8HMVvbBmMEwuWfxrCVE+soDvM0co6s=,tag:1OZ1KaTKMfMhSZhA1+/zXg==,type:str]
+      effect: NoSchedule
+    - key: ENC[AES256_GCM,data:eWiYi/AytLLefqvh2WeoC557WVtWH7c5wYFZYHH0oaIPHd/UyQ==,iv:zreUmSRjGCYywVO1w7+axPmt1E6WON9k63EWhzN6L5c=,tag:zS/rA1dTwp8QMzdi8g8uLg==,type:str]
+      operator: Exists
+      effect: NoSchedule
+# Prefer non-failover nodes in normal operation
+affinity:
+    nodeAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                    - key: ENC[AES256_GCM,data:1eMq19wPgLa5uYzYlrrN783Ps5U=,iv:WU2PcuCN9YsT3k86TN9347iErqH7s5JiOKlPfiBK2oU=,tag:BWEdA34tVe8FYUjaztPTqw==,type:str]
+                      operator: NotIn
+                      values:
+                        - "true"
 sops:
-    lastmodified: "2026-05-26T11:18:08Z"
-    mac: ENC[AES256_GCM,data:mA5hLNB0rwSiGhnyi24AhZIPJsLpZ6PpbXDyoxZ0q6YjitrClxBEnn2dHtEl2MD6dSLmNMVxnnGyGtl7j4ahfqhuct+oPSepeWT1QX8Xj/mJ2Yrt8UZfGQ1R0Ye+rKGFybluMguCRufioGQpU3TLs2TxB6RxUAiGMI1GyT3JBDY=,iv:Pf617ZQBgYbGEsF7AOtyZBCPUycQ7U/D+Sdl+MCF4y0=,tag:tleTblRukBO0V+zfL05fQw==,type:str]
+    lastmodified: "2026-07-25T08:22:16Z"
+    mac: ENC[AES256_GCM,data:3L2sGcpCY1DbFib+13cTJ382EB3DgDJyT5nrE6Pz2gJEqDoF867vDYFvl7qxmT0VXaX6a9g/Q0j97EBbq+oiko0t+sYU0dCRRvcnmgbZaY6TA6WhwMzB6STqZW0XhUc6o5mgvIh7YCgCpPl1yFI4Oeffkrd7EQnx66FPxZYtNzg=,iv:PBZSXeYx8ywDR3wsahldquUfUDTNgC+znYdVcV9SDuw=,tag:d48/XYEaIC5I6cZXCRW/kg==,type:str]
    pgp:
-        - created_at: "2026-05-26T11:18:08Z"
+        - created_at: "2026-07-25T08:22:16Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQIMA7uy4qQr71wiAQ/+PJv3xyn1nqVN4ENsKv1GgMaCrmD+F1bpyCEM6quoOe1V
-            Q3jnfTrHNKQySQFS+56KdWkpvf54jUtl2N+v+mAT+02FkdH+fkFQc0rSfqfpwE7H
-            8peu9wY5+nVRp3sUEacJjCgu44dzzIu0MzO9aHZw/JMr1Z+OF3mMeZ1vVEp43i6E
-            ZwCd3HYBQVJ8DaSdkrT/a3r69dJZKYq3mL9XLYzc/6C4JFAF3oOO5Xzkx4BAQKrM
-            CDyVCJ6RihOyysiexRFGu72wIbiE1gSVqLAYzl8XDJyCcVOX8ZRuMh2ImGyuCXtI
-            8dANf39gf57Z3qM9ljNHgtUkFqcpeE66SdNCSeLK7pDl/02k6dPJr98+e0VtZPfv
-            xt/sFUnAppi5dI4I4AZ1upqFWH3zpud+3G+5CYnfn0yqSgysuJyqzSYv7rjJVStY
-            oMdKprkLGcdLc9FJm3yaPluCnTGpPCaBpvx1bUlQSCIHcrbNj98kHjnuSDcUjgBc
-            xpcWmknbsZ0SFnU8fhe/p80Ud7h2Ya5Hp+GY+FPV2YDeQf03YKLGXujsVhm0scpo
-            KtAALuJo8uP3vniAaY6E1eQVZ09psqR3lFHgaRIyLVbOGkvOoE/sMVcS/odcKhgw
-            Gr6bb2iQ9b0seITxk09HV84uRirzgR+R2A2bxD38ASRzbYwDyA0UnJMSJK+ZttfS
-            XgERXIWVWlTL77IVifpdu+7EU+ElyCzlTLHIb0uqywVS2o/LzE+OgR+1tSj0SVl0
-            +NvGYouZlrecytaBj8MG9thv9kK/vNShrl0QeAWNch3Qza7Xb8eLOhumqZVFI9U=
-            =JbZl
+            hQIMA7uy4qQr71wiARAAxFUgi7EmKbvClLsuCBT3H40QeXdnEoTYmpVJHhoUp9ex
+            vw8K49rg1UueJ7E3jenOhsFw7XiuH3JfCu/CjRW4kMdhBm9G7vGQLdoUub0gvW6Q
+            OgJLJcpoYaIkTowZLHxyQOVYv23FFHCfoEWHUEidHnDswy6ngtljS9U3aQFq67oR
+            REbqMcaotkAUg921ZA60BrctJFvm5DKt33LbgrI6NQ7ku4cDHnRsJLxW0X5F0srl
+            vuHfez7wTk/az7H07aPGlNcBc3MiXmpC9EpRj3ZCgi8RsWm58MFO4ErNAF1DGd1A
+            flfpDRyoDxichpKGnNs1vrWOI3ceXj5241HsQne7dqBPO2sn0QhY0tN9imjKteab
+            bn3C3QSh/jePSJYoBE1tIr0b3+7NIUKeEHBZuS250KL3nZGAGHmYRGZubvrLag9u
+            pnEWZw1yGI2glR/aXFgOk4eHqGfNkBSCQTN/7vErYe1FmUbsaiiJBLpzmNDPrWGy
+            d77Zv/GVCQ5Tod0sD714IyEj5j2ZH9nBGXW60VY/indmMoFpWlUzvii5x3g8Ig6G
+            R0cG20g/x/Q2IgEQuisVfZBq28hJ9SDQNequ+XjARWeO4Bg6VbQvYSiPMamEd1U4
+            IBBWy+Q/MWMaMXN/igfEptvC89ttqK4ckPjgiN8dQyG97jy+xs0kll7JGvydyK/S
+            XAGFitVH3lGXSmsDfijXKVP9/dUixM4Z38lxOwlb6cUyyREH6rRjWyqJcM9tTUVo
+            ArLybrpWYkZ/eVWi2/EXQ7I9nWLoivzrilf80Gh4VPBesuisZdATZUwUY0EG
+            =L8ob
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
Author	SHA1	Message	Date
vhaudiquet	3cfef81f89	longhorn: tryfix backups	2026-07-26 10:44:08 +02:00
vhaudiquet	58d415de54	longhorn: set default replica count to 2	2026-07-25 14:52:04 +02:00
vhaudiquet	92a358b907	authentik: tryfix tolerations	2026-07-25 14:48:03 +02:00
vhaudiquet	2200877166	gitea,authentik,notesnook,home-assistant: tolerate failover renamed "home-assistant" folder	2026-07-25 14:44:32 +02:00
vhaudiquet	a8671b9423	caddy,blocky: set externalTrafficPolicy to Cluster	2026-07-25 14:06:27 +02:00
vhaudiquet	afd3b79dc1	caddy,traefik: prefer non-failover nodes	2026-07-25 10:22:16 +02:00
vhaudiquet	0ab2f2eb2c	cilium: tryfix l2a policy	2026-07-25 10:16:02 +02:00
vhaudiquet	090e08ffcb	cilium: tryfix l2a policy	2026-07-25 10:14:22 +02:00
vhaudiquet	62d1110d38	failover: initial failover chain for vhaudiquet.fr - vhaudiquet.fr, caddy, cert-manager, coredns, traefik are now tolerating failover nodes - l2 announcements policy should make vip really virtual	2026-07-25 10:12:52 +02:00
vhaudiquet	2c944cbea6	caddy: tolerate failover node	2026-07-22 17:24:50 +02:00
vhaudiquet	3161f64391	longhorn: fix tolerations	2026-07-22 11:25:21 +02:00