caddy: tolerate failover node

.gitignore

@@ -9,3 +9,6 @@ terraform.tfstate.backup
 kubeconfig
 talosconfig
 
+# Ignore rendered Talos machine configs (may contain cluster secrets)
+p330.yaml
+

infra/p330/kube/main.tf

@@ -0,0 +1,195 @@
+# Talos node for the P330 — joins the r740 "kube" cluster.
+terraform {
+  required_providers {
+    talos = {
+      source  = "siderolabs/talos"
+      version = "0.9.0"
+    }
+    null = {
+      source  = "hashicorp/null"
+      version = "3.2.3"
+    }
+  }
+}
+
+# Read the r740 kube module state to reuse the cluster secrets & endpoint.
+# The r740 module exposes: client_configuration, machine_secrets, cluster_name,
+# cluster_endpoint, kube_host.
+data "terraform_remote_state" "r740_kube" {
+  backend = var.r740_backend
+
+  config = var.r740_backend == "local" ? {
+    path = "${var.r740_state_path}/terraform.tfstate"
+  } : var.r740_backend_config
+}
+
+locals {
+  cluster_name     = data.terraform_remote_state.r740_kube.outputs.cluster_name
+  cluster_endpoint = data.terraform_remote_state.r740_kube.outputs.cluster_endpoint
+  machine_secrets  = data.terraform_remote_state.r740_kube.outputs.machine_secrets
+  client_config    = data.terraform_remote_state.r740_kube.outputs.client_configuration
+
+  # kubeconfig produced by the r740 kube module — used to wait for the node and
+  # apply labels/taints. There is no in-tree kubernetes provider here on
+  # purpose: managing a `kubernetes_node` resource conflicts with the node
+  # object that kubelet itself creates, so we use a null_resource with kubectl
+  # to wait + label + taint idempotently.
+  kubeconfig_path = "${var.r740_state_path}/kubeconfig"
+
+  # Network config: static if node_subnet is provided, otherwise Talos DHCPs.
+  static_network = var.node_subnet == null ? {} : {
+    interfaces = [{
+      interface = var.network_interface
+      addresses = [var.node_subnet]
+      routes    = var.node_gateway == null ? [] : [{ gateway = var.node_gateway }]
+    }]
+  }
+
+  network_patch = {
+    nameservers = var.nameservers
+  }
+  network_patch_merged = merge(local.network_patch, local.static_network)
+
+  machine_patch = {
+    install = {
+      image = var.installer_image
+      disk  = var.install_disk
+    }
+    network = merge(local.network_patch_merged, {
+      # Pin the Kubernetes node name. Talos otherwise auto-generates a hostname
+      # (e.g. "talos-8ec-vd1"), so the node registers with that random name
+      # instead of var.p330_node_name — and our label/taint null_resource waits
+      # for the wrong node. Setting machine.network.hostname fixes the node name.
+      hostname = var.p330_node_name
+    })
+    # Kernel modules required by Longhorn (iSCSI + ext4) — must match the
+    # control-plane nodes so Longhorn can schedule replicas on the failover node.
+    kernel = {
+      modules = [
+        { name = "iscsi_tcp" },
+        { name = "libiscsi" },
+        { name = "scsi_transport_iscsi" },
+        { name = "ext4" },
+      ]
+    }
+    sysctls = {
+      "fs.inotify.max_user_instances" = "1024"
+      "fs.inotify.max_user_watches"   = "1048576"
+    }
+    kubelet = {
+      # Keep the failover node from accumulating non-essential DaemonSet pods
+      # via the regular scheduler; the taint does the heavy lifting, this is
+      # belt-and-braces.
+      extraArgs = {
+        "register-with-taints" = "${var.failover_taint_key}=${var.failover_taint_value}:${var.failover_taint_effect}"
+      }
+    }
+  }
+}
+
+# Control-plane machine configuration. machine_type = "controlplane" makes
+# Talos generate a join config that runs the apiserver/controller-manager/
+# scheduler AND joins the existing etcd cluster as a new member (the cluster
+# was already bootstrapped by the r740 module's talos_machine_bootstrap).
+data "talos_machine_configuration" "p330" {
+  cluster_name     = local.cluster_name
+  machine_type     = "controlplane"
+  cluster_endpoint = local.cluster_endpoint
+  machine_secrets  = local.machine_secrets
+  config_patches = [
+    yamlencode({
+      machine = local.machine_patch
+    })
+  ]
+}
+
+# Rendered config is written to disk so it can also be applied manually with
+# `talosctl apply-config --nodes <p330_host> --file p330.yaml` if needed.
+resource "local_file" "p330_machine_config" {
+  filename = "${path.module}/p330.yaml"
+  content  = data.talos_machine_configuration.p330.machine_configuration
+}
+
+# Apply the machine config to the running (maintenance-mode) node over the
+# Talos API. Because the config patch contains a `machine.install` block, when
+# Talos receives this config on a node booted from the USB (maintenance) image
+# it installs itself to install.disk and reboots into the installed system.
+# For a controlplane node it then joins the existing etcd cluster as a new
+# member and runs the control-plane components; for a worker it just registers
+# via kubelet.
+resource "talos_machine_configuration_apply" "p330" {
+  client_configuration        = local.client_config
+  machine_configuration_input = data.talos_machine_configuration.p330.machine_configuration
+  node                        = var.p330_host
+  depends_on                  = [local_file.p330_machine_config]
+}
+
+# Emit a talosconfig scoped to this node for ad-hoc `talosctl` use.
+data "talos_client_configuration" "p330" {
+  cluster_name         = local.cluster_name
+  client_configuration = local.client_config
+  nodes                = [var.p330_host]
+}
+
+resource "local_file" "talosconfig" {
+  content    = data.talos_client_configuration.p330.talos_config
+  filename   = "${path.module}/talosconfig"
+  depends_on = [data.talos_client_configuration.p330]
+}
+
+# Wait for the node to register with Kubernetes (kubelet creates the Node
+# object after Talos installs and reboots), then label it and (re)apply the
+# failover taint. This is idempotent: kubectl exits 0 if the label/taint already
+# exists. The taint is also set via kubelet `register-with-taints`, so this
+# null_resource is a safety net for manual edits / drift.
+resource "null_resource" "p330_node_label_and_taint" {
+  triggers = {
+    node       = var.p330_node_name
+    key        = var.failover_taint_key
+    value      = var.failover_taint_value
+    effect     = var.failover_taint_effect
+    kubeconfig = local.kubeconfig_path
+  }
+
+  provisioner "local-exec" {
+    # Wait for the node to show up, then label + taint. The wait loop is bounded
+    # by kubectl --timeout; tune it via TF_LOG / re-run if the node is slow to
+    # join (a controlplane node must first complete the etcd join handshake).
+    command = <<-EOT
+      set -euo pipefail
+      KUBECONFIG="${local.kubeconfig_path}"
+      export KUBECONFIG
+      NODE="${var.p330_node_name}"
+
+      echo "Waiting for node $NODE to be registered (kubelet creates the Node object once Talos has installed, rebooted and joined etcd)..."
+      # kubectl wait --for=condition=Ready fails instantly with NotFound if the
+      # node object doesn't exist yet, so poll for existence first.
+      # /bin/sh (dash) has no $SECONDS, so count iterations with a bounded loop.
+      tries=240   # 240 * 5s = 20 minutes max
+      until kubectl get node "$NODE" >/dev/null 2>&1; do
+        tries=$((tries - 1))
+        if [ "$tries" -le 0 ]; then
+          echo "Timed out waiting for node $NODE to register." >&2
+          exit 1
+        fi
+        sleep 5
+      done
+      echo "Node $NODE registered. Waiting for it to become Ready..."
+
+      # Now wait for Ready (a controlplane node needs etcd joined + apiserver up).
+      kubectl wait --for=condition=Ready "node/$NODE" --timeout=20m || \
+        kubectl wait --for=jsonpath='{.status.conditions[?(@.reason=="KubeletReady")].status}'=True "node/$NODE" --timeout=20m
+
+      # Failover marker + taint (applied to both controlplane and worker nodes).
+      kubectl label --overwrite node "$NODE" homeprod.io/failover=true
+
+      # Apply the taint idempotently (kubectl taint --overwrite is a no-op if it exists).
+      kubectl taint --overwrite node "$NODE" \
+        "${var.failover_taint_key}=${var.failover_taint_value}:${var.failover_taint_effect}"
+
+      echo "Node $NODE ready, labeled and tainted for failover-only scheduling."
+    EOT
+  }
+
+  depends_on = [talos_machine_configuration_apply.p330]
+}

infra/p330/kube/variables.tf

@@ -0,0 +1,118 @@
+# Variables for the P330 Talos worker node that joins the r740 cluster.
+
+variable "p330_host" {
+  description = "Reachable IP/hostname of the P330 Talos node (for Talos API access)."
+  type        = string
+}
+
+variable "p330_node_name" {
+  description = "Kubernetes/Talos node name for the P330 (e.g. p330)."
+  type        = string
+  default     = "p330"
+}
+
+variable "r740_state_path" {
+  description = <<EOT
+Path to the Terraform state of the r740 kube module, used by terraform_remote_state
+to read the cluster secrets and endpoint so this node can join the existing cluster.
+Path is resolved by terraform_remote_state relative to the working directory where
+terraform runs (this module dir). The default points two levels up to the repo
+root and back down to the r740 kube module.
+EOT
+  type        = string
+  default     = "../../r740/kube"
+}
+
+variable "r740_backend" {
+  description = <<EOT
+Terraform backend type used by the r740 kube module.
+Set to "local" (default) when r740 uses a local tfstate file in its own directory,
+or the matching remote backend name ("s3", "remote", ...) if the r740 module uses
+a configured backend.
+EOT
+  type        = string
+  default     = "local"
+}
+
+variable "r740_backend_config" {
+  description = <<EOT
+Backend configuration map passed to terraform_remote_state when r740_backend is
+not "local". For a local backend this is ignored.
+EOT
+  type        = map(string)
+  default     = {}
+}
+
+variable "installer_image" {
+  description = <<EOT
+Talos installer image to use on the P330 (bare metal).
+Must be a **metal** Image Factory build that includes ixgbe.allow_unsupported_sfp=1
+in the kernel command line (sd-boot/UKI ignores machine.install.extraKernelArgs, so
+the param must be baked into the image). The default is a custom factory build
+(a18165114...).
+EOT
+  type        = string
+  default     = "factory.talos.dev/installer/a18165114f80c28601d05bc4ff1f6ea6d6b214882c5b9af7928aaf4d09741beb:v1.13.6"
+}
+
+variable "install_disk" {
+  description = "Block device path to install Talos on (e.g. /dev/sda, /dev/nvme0n1)."
+  type        = string
+  default     = "/dev/nvme0n1"
+}
+
+variable "node_subnet" {
+  description = <<EOT
+Static IPv4 address in CIDR notation for the P330 node (e.g. 10.1.2.132/24).
+Set to null to use DHCP. A static address is recommended for a failover node so
+DNS/affinity rules stay stable.
+EOT
+  type        = string
+  default     = "10.1.2.132/24"
+}
+
+variable "node_gateway" {
+  description = "IPv4 gateway for the P330 node. Ignored when node_subnet is null."
+  type        = string
+  default     = "10.1.2.1"
+}
+
+variable "network_interface" {
+  description = <<EOT
+Primary network interface name on the P330. Defaults to enp3s0f1 (the 10G Intel
+X520 NIC), which must be on the same L2/subnet as the r740 control plane so etcd
+peer traffic (TLS-verified against the r740's etcd cert SANs) doesn't cross a
+router. eno1 (1G) is left unconfigured.
+EOT
+  type        = string
+  default     = "enp3s0f1"
+}
+
+variable "nameservers" {
+  description = "DNS nameservers configured on the node (must work independently of kube)."
+  type        = list(string)
+  default     = ["10.1.2.148", "1.1.1.1"]
+}
+
+variable "failover_taint_key" {
+  description = "Taint key applied to the node to reserve it for failover workloads."
+  type        = string
+  default     = "dedicated"
+}
+
+variable "failover_taint_value" {
+  description = "Taint value applied to the node."
+  type        = string
+  default     = "failover"
+}
+
+variable "failover_taint_effect" {
+  description = "Taint effect applied to the node (NoSchedule / NoExecute)."
+  type        = string
+  default     = "NoSchedule"
+
+  validation {
+    condition     = contains(["NoSchedule", "PreferNoSchedule", "NoExecute"], var.failover_taint_effect)
+    error_message = "failover_taint_effect must be NoSchedule, PreferNoSchedule or NoExecute."
+  }
+}

infra/r740/kube/main.tf

@@ -40,7 +40,9 @@ data "talos_machine_configuration" "kube" {
     yamlencode({
       machine = {
         install = {
-          image = "factory.talos.dev/installer/ce4c980550dd2ab1b17bbf2b08801c7eb59418eafe8f279833297925d67c7515:v1.11.5"
+          # Image Factory image with iSCSI extension for Longhorn.
+          # Generated at https://factory.talos.dev — siderolabs/iscsi-tools + qemu-guest-agent
+          image = "factory.talos.dev/installer/dc7b152cb3ea99b821fcb7340ce7168313ce393d663740b791c36f6e95fc8586:v1.13.6"
         }
         network = {
           nameservers = [
@@ -53,6 +55,28 @@ data "talos_machine_configuration" "kube" {
         certSANs = [
           "${var.kube_host}", "${var.kube_hostname}"
         ]
+        # Kernel modules required by Longhorn (iSCSI + ext4)
+        kernel = {
+          modules = [
+            {
+              name = "iscsi_tcp"
+            },
+            {
+              name = "libiscsi"
+            },
+            {
+              name = "scsi_transport_iscsi"
+            },
+            {
+              name = "ext4"
+            },
+          ]
+        }
+        # Sysctls for Longhorn
+        sysctls = {
+          "fs.inotify.max_user_instances"  = "1024"
+          "fs.inotify.max_user_watches"    = "1048576"
+        }
       }
       cluster = {
         clusterName = "kube-${var.physical_hostname}"
@@ -106,6 +130,33 @@ output "kubeconfig" {
   value = talos_cluster_kubeconfig.kube.kubeconfig_raw
 }
 
+output "client_configuration" {
+  description = "Talos client configuration (sensitive) used to manage nodes."
+  sensitive   = true
+  value       = talos_machine_secrets.kube.client_configuration
+}
+
+output "machine_secrets" {
+  description = "Talos machine secrets (sensitive) used to generate node configs."
+  sensitive   = true
+  value       = talos_machine_secrets.kube.machine_secrets
+}
+
+output "cluster_name" {
+  description = "Name of the Talos cluster the worker joins."
+  value       = "kube-${var.physical_hostname}"
+}
+
+output "cluster_endpoint" {
+  description = "Endpoint (host:port) of the Talos/Kubernetes API on the cluster."
+  value       = "https://${var.kube_host}:6443"
+}
+
+output "kube_host" {
+  description = "Reachable IP/hostname of the control-plane node."
+  value       = var.kube_host
+}
+
 resource "local_file" "kubeconfig" {
     content     = "${talos_cluster_kubeconfig.kube.kubeconfig_raw}"
     filename = "${path.module}/kubeconfig"

kubernetes/infrastructure/mail/stalwart/values.yaml

@@ -19,9 +19,9 @@ pushShard: ""
 # with these credentials on every cert-manager renewal.
 recoveryAdmin:
     enabled: true
-    username: ENC[AES256_GCM,data:83oORcE=,iv:X07gQXkAx2wdqEcOPi5mGTVoFkJjDHBKMCYUjpg3qv4=,tag:qvspLaPSsrld4UV/qXb0cw==,type:str]
+    username: ENC[AES256_GCM,data:kpf88Vc=,iv:k2kGcGlH0jQkLmb35V4+IIrBpDM93PaG6atcO/SLDB4=,tag:qZIR2LZlv1g0XBkEh0y8qA==,type:str]
     password: ""
-    existingSecret: ENC[AES256_GCM,data:KuZYrQk+YQhciNRTHqOlZdqZWJ3o15I=,iv:x/cm4USFZqWE5xuuF7tUPm593NqX1kbmeKv0x2wzk8s=,tag:G9FRYYaJhWovN+LB/gLaoQ==,type:str]
+    existingSecret: ENC[AES256_GCM,data:DnjFoj8VNeqHmwM/KVebjOOHvYHPgZQ=,iv:JWBs6OeZzsa+8uJt/FjptI6t+tf+CRQDKA7149rBg1o=,tag:M4CXA2k8M65mbSUF0mnGvQ==,type:str]
     usernameKey: username
     passwordKey: password
 # Recovery mode suspends mail services and exposes only the management listener.
@@ -40,7 +40,7 @@ bootstrap:
 # certificate.yaml (letsencrypt-production, Cloudflare DNS-01).
 mailTls:
     enabled: true
-    existingSecret: ENC[AES256_GCM,data:Y+LfFx7nuCSMGqo2o3QoHG1Br+MYlQ==,iv:dLJDYmK2gEmNq5VnbpEJWFM1xLLT5jXqxB2WQQ4dr3E=,tag:Ya2cTf/ZpJdzFnwH53iZZQ==,type:str]
+    existingSecret: ENC[AES256_GCM,data:e8rzv2mvlpoZR/vMfd5sgNuYLDvptQ==,iv:qIQfpHxAOameSdDzOHh89n+RIOd9CcJcl0oRumSHAQQ=,tag:xwbQR5Jabvz+lEju5zuW2g==,type:str]
     certKey: tls.crt
     privateKeyKey: tls.key
     mountPath: /etc/stalwart/tls/ingress
@@ -96,7 +96,7 @@ ingress:
 persistence:
     enabled: true
     accessMode: ReadWriteOnce
-    storageClass: ""
+    storageClass: longhorn
     size: 50Gi
 resources:
     requests:
@@ -120,27 +120,27 @@ podSecurityContext:
         type: RuntimeDefault
 containerSecurityContext: {}
 sops:
-    lastmodified: "2026-07-03T13:00:45Z"
-    mac: ENC[AES256_GCM,data:qoGDDt03xtJbPH+I3edSsFJagZSlCcMk4XoFc/I2QZEm+45DjsCWe9Q7e9zhn5kF3HBNBwNCgEzJmq2Fn/vemMWHwI4+QZW6nkk5cYTb3r8+WysSeUyt2+Y7EjyQGwI6+2LrCBlJIqmKfpPtT7Y8ZbwRBedoVqFtnNVH5441FMY=,iv:fvfnedCEGXyPw4yRLCtKoAnzz8h3jyJOwpqA33NNJOI=,tag:fPd7RJAMMounXVkIoKrptQ==,type:str]
+    lastmodified: "2026-07-18T14:22:17Z"
+    mac: ENC[AES256_GCM,data:JjN4ziOnd65U8AzI9ZnMiPUBiYFGqjGjM3HJ7XoSJuJ+fgYjOH+WX/U2IAfSeqEIMkzvP435BxKGoylrwEVM1k5v07slul5zEclPZglphDjiX+md403lVDtYEXdCSo0+3nqv1DFEQDkKItEEEz882sZBbhMotBHhgcd41RSA1aY=,iv:MaSmisJoj3aobpMw1HGgEOktegX2LtOaXLh3601xgvc=,tag:acWtTiu4ub7GDNp8nM/yVA==,type:str]
     pgp:
-        - created_at: "2026-07-03T13:00:45Z"
+        - created_at: "2026-07-18T14:22:17Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ//WA7P2WeKV6QFKotw5UP1MXcdI9THypFFly4sweJ5MC+e
-            Lzy/zCidGCM3Cu+dJaaPJNKtfPfagQJ9FzHrnvRcHoCbKS7sTAqugdwt4uyplem9
-            l03kQWZfDj8R8MHQnAKWNmJDiJkjCoqHdR5f2JtS+n7MngI53SecY2fsFOXRbYJI
-            hfH1BR+agLjIHc+gOF340GJp4UT+Q6BZOKg8K5O4PYk1Xwj3pi6YFuhiedKHSybF
-            Ij9OWdTqpofeG3fhwd3jHLW+0WYiFNrVlchfClEDWMMc0UfS6Bfo96IL0JIoYlHD
-            4Zt8EEyjvAJ5478RTKTobMlsSUC5U51Wn6paapZ5zicCHDzdP2yTtwtSKK0Mdp3W
-            qt/pZoR4EyM+I2XCKp+z7N5FtH8cahtfZiUOBwQ4NK9Fz+2UBxtP2QzGj8YpJmWu
-            OkbGoSgwn+8bcNnRwnADTzdiTWf/a56WErp1NvuqF8VqdGzsJR9EgyYwENl+m+U8
-            fbTY58iAJDDpY5ipPL5v+lo0Fw5DrnQ0NPAm1ORi+rMJy0KUjgAzdS6lL5oWGfAC
-            rzbzThGpRt0E7O296pht8TCBFHqiKbiOdGEBXO3+w9NrvOgULno4+s88vu6KMvFL
-            s3MHz7oIgfwel7V6bVc/ZQvHYS3YHjG41fwn00cpKI/WRN8z5MnSwwkegD2Wv8fS
-            XgEqL6kQPgk97779c0jo9CJA8O6QaSvGyd1j680tN1NN9V64rJOaj/818SgwFLrA
-            XWaqrOnz8FIspqO836t6OaLq5WwzOtOR6zs7cUk6h1RHgwlFQ+0n1o6qYf6Q+CA=
-            =HnWo
+            hQIMA7uy4qQr71wiAQ/9G7UtHO7Ux0YNAPlnkVmU5BI+crzwbWPhdaUZFf5dmCkg
+            r67EAi/DjqFHR9Ew1Dhpn0InTA/Ld+mGZAAbWeP7xhIEQ+AqACmm/Oxgf3IkHKzE
+            P7dvco6lQO50W/m3fiU0Pv4A7w3Oq+AdFHcPr3UBi8YGYLgkCbzLs2r9JNviCJsl
+            uuvz438g92aXfa5JcyUjzxtxKFjzHrZ8seDx38X4fveS/mROpRqiw+G8aQ0BlXDM
+            9wfiQtiM9CcuahPUWopv4RCOjuqrSc14sxv9xRGsYt1YZFxZ/4Q7rqM+HXBsFp4u
+            8r4MgE+EflrhKp1aWPGnSn2kalDy3o+yFuk7IhWsrSKsNIU4j1J5xCfhliey+kNJ
+            387cVf7Bjw+iqoy+qiV7Q7XGip6NgF8WwSudZhznv/pS6LL5H5yHaKxjz5rny/TQ
+            0upK///2YGuiE66sBb8h2sqzIgr6hZecvb2VdY7BQX4FCo2uAmxTEh+h1fHlervc
+            i/03B9kNSjP5fSufhE9lsLl0oZgaFIKSpkzLlPdy6z0X5vDEXJGSL+qFudo9RKtf
+            aaEwaQ+I+snmhWyBeeywxpdyRE5g3xhRwuwaxp7zzVt5ykCnyrZIPvzaSxu/QjaF
+            jCUmvPp0ZLzAB2xY9AMwOHIrym9lPmcBEEqCiHywCauOQzsGJE3vLF8x3/nzZnvS
+            XgEE9z1NxK8o0ntL+JZO3+GYvm28Hyw0eXgDJbjJ+tlBYeWH8lfBUOsk2V485OJZ
+            4SDNvxzxpyF/4RJY4P4KR7HgwDC8gOCsDgqcyn1s4KzECXyQlqmrXxOrL8cFRhY=
+            =aeJw
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
     encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$

kubernetes/personal/linkwarden/values.yaml

@@ -18,46 +18,46 @@ configuration:
         disableNewSSOUsers: false
         PublicCredentialsEnabled: false
         authURL: http://linkwarden.lan/api/v1/auth
-        authSecret: ENC[AES256_GCM,data:UUZagqAY6+9AM4gMv9WFsWFSzjLxAALUz2iGg3dBIrpP+JCdJWVbXIRpZ8bZPJxvwnTcZSPOsLHlqzeqJRHubA==,iv:xgPnCNp2dpy8UG/fjEHPUxdXYXEQzFn3K/EX9lfjpWo=,tag:1uFZDdgGUvMvyKHj93z4yw==,type:str]
+        authSecret: ENC[AES256_GCM,data:Qaxb9o3xtrDo9rsxHFpm6tkRd7OWPDyjiIyoPvc1SiIQIthOwXyHQ0b7YAW8rGg1vKBg2fDCIUK4Kgoyr26qUw==,iv:KFt4KqTUwB830flAmxfw7tQrLktacTtWmYDjBAiugk4=,tag:IAi0x3AlCdCTXz7MBryg8A==,type:str]
     sso:
         enabled: true
         authentik:
             enabled: true
-            clientId: ENC[AES256_GCM,data:6XqAMjwywGgZK23ywm1GKWpIhIrXNa28Z52+0J1yhocBxLXoJAiocw==,iv:DiIpcD0H6wnIkXCMPmhLEHTzE6qKQrotGZ7q7Lv2iME=,tag:Kx80RoPf7BFMWEO1lZ4wCQ==,type:str]
-            clientSecret: ENC[AES256_GCM,data:OO8vjjWVxzUNuY/Jhk348RykWnVRQ/xthunOyI4XVzCmT0WXAH/uWSupljfWQW8aj4WzUUHMpJOvFpd3iYTExFn6QqyBisOgVzS9jy4sP4qdhnSpu9jXzEUNmKyjQncl3QTQCcPZMjlGGf0oJzZgHivVWl6rFbnYQOJHDlu3r48=,iv:H2OvOpH2yxUivH8RTvSnM9k86i9jUJKcUmNPpSSos6g=,tag:XXTyOC+Hj7BvgZJ7qxEZyA==,type:str]
+            clientId: ENC[AES256_GCM,data:1u8Xe9ZMosAJWwPGZCloAFEQE6n0eTtBzaw149zsuL/yrVoiU8s7Pg==,iv:uxfiXfpocKbiFIu0dPq0So6Kdfr3iMFUM4hRJm3eQPQ=,tag:BxgV/Wl2ZE80+08uaDnsDw==,type:str]
+            clientSecret: ENC[AES256_GCM,data:LBIh0Jc2MtS5pvOhmFbWSrQaOMiM05e2i5aeMbDJJGNArQ7PGK+okbltWnZHonIwGU/sriFm/x4BMz+snrd+NgTUR2aPPXnomK6f9dEmSXNjLxgnVFUmgcT2P7zqlKUBjMT+SKjZLELfYGzysKTRkXHOCrOoGX8ZobEgOXGflpQ=,iv:iADfUCL30NrwPPof7r/ppO3Rt7ap4RoOkKpBuzyoO8A=,tag:lrt50iqFsZcEdBx25BY0PA==,type:str]
             customName: Authentik
             issuer: https://authentik.vhaudiquet.fr/application/o/linkwarden
 persistence:
     enabled: true
-    storageClass: nfs-csi
+    storageClass: longhorn
 postgres:
     enabled: true
     host: linkwarden-postgresql.linkwarden.svc.kube-talos.lan
-    username: ENC[AES256_GCM,data:N+ozpU6TgAZSLA==,iv:XJT1fUe2XqSxpuuPfmzbyrJUUInUEhLyNddOX0jogZQ=,tag:z9rCjOKISMT+wpfwUzFd1Q==,type:str]
-    password: ENC[AES256_GCM,data:G7dF3Oo+1wzL9g==,iv:yAjh22rwaBhKtHgYAmQEjFSMFspOpG2hThwwjAo2KJk=,tag:DdXlyNk+TfR0IuSpQG3+Zg==,type:str]
+    username: ENC[AES256_GCM,data:eUTE15OnJZ4dBQ==,iv:bN7y9EwD9rzzH3pm6JJvFkSHmdXkCunui2tyerb3z98=,tag:apU0hdiJbp5fgKjesLfdrw==,type:str]
+    password: ENC[AES256_GCM,data:qA/FQZdMQG3vdQ==,iv:S0fBAfNiNUi1t7coaKFLloaXolv7l//tUVnSui0Tmo0=,tag:SbW/QBMoNqUSENkSCR83AQ==,type:str]
     database: linkwarden
 sops:
-    lastmodified: "2025-09-15T21:48:06Z"
-    mac: ENC[AES256_GCM,data:i9Mg17Z72cBJOSvmOlHkl0x0/FqhpCqS8iTGTYKlXacXi9E0nYYZr/y74qVjhubEaI1y6cRYXgaePI47lkyfvTzB3VGEpEs/y5fiL+PfiuV8Z18J9244+TyoasYR/a2sdRuJcY5jm6PSTKoGiwGnyZEthVwt1T38yr5msW3D79A=,iv:yj7uCySaoZcnO+7XsgB1EMfZOMwHSA0mtJXUq66MUgQ=,tag:YRvUG0/hj8Bjp+pMdJvePQ==,type:str]
+    lastmodified: "2026-07-18T14:22:17Z"
+    mac: ENC[AES256_GCM,data:DoHEvtWEetZGb/lCzQalLAMUlAZ7OVG66bDSaGY7s0i8mhDzRxrkvPq7FL07rnDQoLSW+SFSq6h7LB1PV1HodW35b4rmDzpCCHQ/S7Gj8WW/sX0t6dFpF1GlYeseqAMtNMPeMf095Q9LIHmQlILmjPAKbAuOg6shQ9oIesBzSDw=,iv:3D+wZjBHp0gZRDOvmVHaTIyZlC9IzMupvXfbvYYZVm4=,tag:ui9jt5/F/9NJ08P7MD+7AQ==,type:str]
     pgp:
-        - created_at: "2025-09-15T21:48:06Z"
+        - created_at: "2026-07-18T14:22:16Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ//dICUFaREdeVKhKkK7iPji73IRFZEnwoZwEnR0vtCBL3d
-            HXFfdXUMOVcXOvkkuF9zG52flUZBpVgilQz2W8Y7xI3tU8xX6wxmuz8LjegidCHk
-            R2xKAJ5iCEWZTIouFwg4fM399Mm9xhiIPuM4+25DAZnSJJAc7fQ2NaNaA8vjbJQ7
-            YUnqkmE+QPGbyeykudlTFfl/zZzrgKbQqWuUmD/vq1XckUaPxM5cdeFDsg87AZCs
-            o51lQ39b+CpWmdbDbJDF5nMWUrCzIz9okptoNfHM/5E0Jg53JBsXBvsqwWTOI5vo
-            djilDfsyu5nQj7UDstaax839T7P5gm5ass2/YtIjgrJUczyRt6vS97zuXLsbEGpH
-            6hXHan7OormqbmISnFrL68Q4w6JUZev43bdzqtX0EnYHNZVLXH3qAxD5EnuL/i20
-            oY/oMEteFh86Smw/LXwtWjVfPKYzNQ6GTkTCzM3hVcfMOzdFVPgYDM+5EXF+/oAB
-            +BGqZvWW4G3G9sbPTRSJ1k+toWuC/erY41r+g3+KHbW73YdqIVwBsTDAFhPPNbe5
-            hnr1JFLQ75GHdDRnKRl3nZSPc2j9JMUtMhX+rKwLb/0DoVjNz0lFut/Tj+6xiG/1
-            SqHTpROU1tkip+rP0shzdu218+hjrzj+cDKkawoqmpD9gOm83P7YEqrIwcBj+TPS
-            XgE3UHtwHdJM38kfPm1fkTuCejlAQ3Hsz6W4PSbXJfY8w1gO241dEzy+b0At9Rv2
-            6IklhRBAs4ioH/hD653yz0mkCYRpOLYDJU2iMWZdv61YLXb4rsnAwr6xLbDHDXM=
-            =69Pc
+            hQIMA7uy4qQr71wiAQ/+LxkvBdTDic8D31VBAtMiKJJ4nHAIpxja6gHsyVCmS+LP
+            VOqnEvvEBxf3ifXqwlYh/rY7ywjMyuQAW03zIlNq+9Ufv5QV9Py+UTiQV1mfmRoa
+            73kINswzbUGvH+HXVkcRGjusS/StPMWKC6jwyrov09gtTF1rJUfcfenqy2waHZOk
+            JhwcxhrPUnHGOsv4f1+91CCjKHux3/FVagpxJcEvxckMJweuZWm59z77dbwF1lQ3
+            ws4VMLKzt2wiYSULCDr5KM2YlYWkvzheqhwnOVKXk11ewM+6n8RHIvsE03nvkfRf
+            tJduJYmXnz249SM4hq3GvyMq+j3qShIMvvKRMv6+aYMZ3SFzAIxtV0dA3lCoA9oy
+            mGWvImrA7JX4GsG44tEzu0ECvoFV8lEb39QKBXBf8fN6UExasF4pSm276ZGG4Eom
+            IpfpuaB9oYL4TOEH0/56IEc2BRlvAm62ibra5jNCVLnLB0pzE3KdN7ZYMQyXooZi
+            dOa56z4KidI4N5oDTc63Hkg0tApdV0x+Rtm7qgdhEp/1i4zqciQqb8//yN6CAb7I
+            DkyPilrvNkZw95iGqpKVLrAp57BaFHLYNr0O7+WS9urCIUQl3Q37Nz2HyNLJt0Ej
+            i3VgiJUIoy5NcAIBIFvuAJDsXB+FQxzg+7XUZL44xxsSvA248Shz1CYH9CgwbszS
+            XgHdJTIcrq3ReybtFVDPtqMkLyItA1fbJzpCr4Fwk922hmEpqBeMHx1Upy81MZJj
+            T+4v8xBo7KR/6sx3U9kO/TjV7AhdTJPRlgG0WfnfLMncCkrvg4cQWxEIkySShFo=
+            =XPzS
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
     encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$

kubernetes/system/caddy/values.yaml

@@ -35,25 +35,25 @@ health:
 volumes:
     - name: vhaudiquet-fr-tls
       secret:
-        secretName: ENC[AES256_GCM,data:mdTS+RBfbQiY0c5aezbTURE=,iv:gQRWoRmGujhptSXm16JhX6VSHbB4yMdC3T7tPH1vfJs=,tag:DViHZOwOIPmHJQWTPUO8cw==,type:str]
-        optional: ENC[AES256_GCM,data:apLSVg==,iv:4ZZa85zmTuYb7D/p4mLZO++esFrPQyQ5xHCtT+aghS4=,tag:wWAEf3XWYKvsjwpfpyCb7w==,type:bool]
+        secretName: ENC[AES256_GCM,data:VQPfRq0dCtIN5nnubua5o34=,iv:TMieVEMpFldPMT4YJnEd6ecvOC9PWhpWpCe4u30Rg2E=,tag:7ZMIryVzEtGBZTzLj5a76g==,type:str]
+        optional: ENC[AES256_GCM,data:EPxqBw==,iv:HYAyOFMAMMXPLFCcmgqC5XNTqenL5A/ZqK7Td/x81mg=,tag:uRdyTRPjbP1bUreP9cwj2w==,type:bool]
     - name: wildcard-vhaudiquet-fr-tls
       secret:
-        secretName: ENC[AES256_GCM,data:Ww5/viWqr5mI51FqHizTRerAZnEyQONqdEg=,iv:VAMLvZ9yJxUCh7Kjf43J+M+ellkm5Xi3ZD5AlO95Rm4=,tag:F6H8LBi9kL9rrXJgVSbAmA==,type:str]
-        optional: ENC[AES256_GCM,data:LQEFAA==,iv:JkudOsHgn8qLEwqWhsuWnXjpCLJ3XrEexXtzjmOD+/Y=,tag:amUBIkXQIZnGQtxAAQ5mcw==,type:bool]
+        secretName: ENC[AES256_GCM,data:ohWn2gmc4WkRV59KTd9sRsbbHQqwiIMLpl0=,iv:hmLbftvEF7kDz2ZqrPCUhwD2QV/S34QQVcCKyYcSR0U=,tag:Ok8enop6KDGqwCpoCS+52Q==,type:str]
+        optional: ENC[AES256_GCM,data:6W/i/Q==,iv:zcVzTOGfC4ki4ZfY3PkMyhNC0u1t39QG1Uoxb07QrWo=,tag:I6pcotOaeaTErrQBu8itdw==,type:bool]
     # semery.fr certs from cert-manager (OVH DNS-01)
     - name: semery-fr-tls
       secret:
-        secretName: ENC[AES256_GCM,data:dmLfoVbH9QKPMXPZZw==,iv:l9BKz66sdl9SssNzaz8yWoQ84ewDQprMv3rcHJQZhRA=,tag:NudQDM8eKC5aF6vX2ZQVVg==,type:str]
-        optional: ENC[AES256_GCM,data:Xc2tmw==,iv:xSa/xz/WibDqExKXjKSwLm5w8DOw9aZY44O1TZalfO8=,tag:Mpqi2ipn82+eWv8T2YvSng==,type:bool]
+        secretName: ENC[AES256_GCM,data:w5YPfljvWgH0V5tkKw==,iv:atxebg81R2BztmDPORRFs/HJRNHIejvdL+wPz/NoRFU=,tag:VJynVAHGoh/yQmibnz4CDA==,type:str]
+        optional: ENC[AES256_GCM,data:U+HoTA==,iv:I6lUk9k1eL5U4OYeZW96CLPdGmHZ1TJVaPGesMH623g=,tag:8IIpdcPoD65vDPy40utJIQ==,type:bool]
     - name: wildcard-semery-fr-tls
       secret:
-        secretName: ENC[AES256_GCM,data:jwwNceE6ZAD0bdUFceBBG+HQPjmLSQ==,iv:15rvS8NjtKszT8LFS9Z3DLCVMBwQ0GnY+o3DSr+G3jA=,tag:GMZ68i+1XmcvIJrOZxBo1w==,type:str]
-        optional: ENC[AES256_GCM,data:8p7hYQ==,iv:a3Al2ph6xuJCXkLaFW6K7WSJss51/d9kVrX3Xuh/5e4=,tag:JYUYRsmEN7brNrENFPe/DA==,type:bool]
+        secretName: ENC[AES256_GCM,data:lD0v/r4YvzPN+Xa617BEjjwDQfZARQ==,iv:ByAUmmfli9pU1on7I3h2cbATaHqXGIEzDS79zoCxyU4=,tag:6+ZSzIwhaD2XVJbn4/iEcg==,type:str]
+        optional: ENC[AES256_GCM,data:J5m77g==,iv:dqGRx5zVtr2IbR4fruHuJ+9lX4N2RUqDXFbFqJcL7I4=,tag:vc5pCXQzqmJxOadRa5OetQ==,type:bool]
     - name: buildpath-win-tls
       secret:
-        secretName: ENC[AES256_GCM,data:kTI0dBzdTAYXuvSZwZC9REg=,iv:xf4pQABQGiuv3IJtiZhNMsLeDPVef2awVW1DmDThOHI=,tag:74IqPca8TuCFuIpJ8RpQ2Q==,type:str]
-        optional: ENC[AES256_GCM,data:mxxqOA==,iv:p1omSzhLh4yYs303OZCE5DfCNrzjAxEo+TOfezw/oCo=,tag:4ye1QalWmtW98B37DtkcuQ==,type:bool]
+        secretName: ENC[AES256_GCM,data:ylwpc1mncHCXEoucDxVJanM=,iv:+vzMspw9NPcT6LGvLJv+5CPSmKmMsUgl0usMHTAOoGo=,tag:mvdt+ty2+LdANic5Mk7avA==,type:str]
+        optional: ENC[AES256_GCM,data:B/DGpQ==,iv:2h1FOz4onqxRUyDVTXdTKGphUnHNKDDEF6IPPnze24g=,tag:AINZfLh8wen4ClUeGejdxg==,type:bool]
     - name: routes
       configMap:
         name: caddy-routes
@@ -100,28 +100,33 @@ affinity:
                     matchLabels:
                         app.kubernetes.io/name: caddy
                 topologyKey: kubernetes.io/hostname
+tolerations:
+    - key: ENC[AES256_GCM,data:huw9H7nWgpK2,iv:mLMip5c1ubS8ZnipsDIBpmy6qdP5viG73Dn9dBJJbLo=,tag:MAFiUjJX/1updYbzpSCS8w==,type:str]
+      operator: Equal
+      value: ENC[AES256_GCM,data:6ScxT0nUuKU=,iv:skaDlzXbBXGQHjk/SnKrNCvHVe3JovnWMtpA6zhqlFo=,tag:LAW6xol1cASA/tYwab7AVQ==,type:str]
+      effect: NoSchedule
 sops:
-    lastmodified: "2026-07-09T21:17:10Z"
-    mac: ENC[AES256_GCM,data:5APgoOMa+m5xjn+wurqyOtBoohpV271AnW1Ic4Thcg88bXryhr4Xn86Yo7fMbE+N3YqJMCaeaH6hm4iY8IIhCHgO2ybgMq50Bo8AqWxr6MKEpTJDQS5vSSWPq/Y5qr7B3f5/gOyxwIGslF4isVRaQzlcjoKzfvHsZX8SPdFhXT8=,iv:ZuareabZmxIyhh8kZs+eHGeUI7NZhzxER6KJE1/EiWE=,tag:zQuTYSrU76YEf1u2312ruw==,type:str]
+    lastmodified: "2026-07-22T15:24:50Z"
+    mac: ENC[AES256_GCM,data:K3c6hp9KPe9s992kaGJ60jCLN2FAvKnTLA44EQ0IG7FPHL5FFMbWNBxukQmI2q5E0U6oLzO7JlmOh4ZGRScIi2Z2gRz9td6DTYNBYvgO45kLFJrRAe7D0V5cb28WW44w1OhN+4ETw7VuU24kwKGHYergn5eBo1JtNLnty96ToLY=,iv:X2MkW15mPps4gVR4Pscx72t78wsLWlcRrxZJVKTMC1I=,tag:8ku82p8BIasJ3a/pkDSZTw==,type:str]
     pgp:
-        - created_at: "2026-07-09T21:17:10Z"
+        - created_at: "2026-07-22T15:24:50Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ//eR5eIclcLkl8wtERUoVHXL5KGKzEaxyVv9D5gHz51C31
-            kmAfrAnjT9G5UeeoJlW8XLkh1IWNhArNBMtoiCNUPAtfVDxszs5IwPWul+s3wJhc
-            X7sDq7EnIgaJr2IszIOTJ4PYxZ/uhyMdqmvRTZXMaz43F96cuDLctV4CFaiig4aJ
-            IcNlPIyYyS4tuaGB+ScLtbcDDhNc/8VRWn09SRtpTop+PV4KRX6AqLmhGOc9Jf9l
-            Dg3Gqdkaxl3OuqIvcrTmEPBe3sjnjIIdtJeG4SAbMUzj1xoKupXeDBZDnfmS5nku
-            42WR5H4RInzusj5NXP50C7AeLD4qavB9hl5CaxzA6TVG1X7LcpmcqBsVVuFcSjZj
-            T80iKklV6Ct0MLlmbxlKFTJm8fSKevhS/hdfrkUNcqc4N6eBb8tx93x+FcDn0A6P
-            c1zPSKj1vs326nJSHw87wvooQWn/f9j+Om1KLOR/MiUWmoEAbgkIHi3+k2wpzFb/
-            faKpshye0/XA/CZHFePv/U7sw8nKhfPhJCuO/IRrHKYzx0u/aqgOtPCURh5hS/fU
-            8dPQkbywgN67IRRKVz70cxn367cP1vn7L1AmzJfBd56NnViXXlS/DuitpnyTQpnP
-            tLG6qelq3Ul2A1J3BB1pfHR27IpKzd1UPD7HMhvvgSA7ErLq/VhF/kT1dx6s1fXS
-            XgFZ5XcyJQRc4Uxh2eFeEPOdWMAFRps6scfBsQuWR8m3cQvLatzcku1S/YDp56Kn
-            oUZmfvdQGpUuxsumVYCqk1+mQn02lkA1p2Y4ztrpLDCbhZXZ/fIT6Y1uYX+c0ew=
-            =0kw6
+            hQIMA7uy4qQr71wiARAAsoEMSw07cHFenSUrbW+prBls/qB4YT0vkZ4Pjpp2zyzw
+            UTTASjXSYXYGutOkQgO42vtKE5HkEh+FB2qhWnLy9on4xPR/epFJox0Y+EFWPLQJ
+            fu7Q+C+aG9JqoFgsBX+7JAPMHcH/afT4SGvvfOMTC3+aOLiFFyicbqZtkumw9bCr
+            jD7VLRvPALTLokPdoer3cmY99bIQ9+51ms/cc1/SNXv8qxR+CKG1wnqtYBSdhUtY
+            vTIuEY3uIrYfxJlKlsyCRQj1RPj6o64+IsLcwXTNV5WHuy7srrsSMf7qFsD9f4ZV
+            7a17K/6JaRom62YqPn73HoyktBf71oPePwl8xeHqs3En/VS1T8MRa7dQjD7Qb4Xo
+            00eLRGTOqTJlVmtMOg6ZqQiROmAS9W9X0ZOv4uxLK2fDG48WrDIcZMuBzI4OQaY+
+            prSeVvkcZm9cTrNHj8ZWxgWHp04qPBFWg0tqXSyXnr0cXjLUI/cOqis5+segHeSt
+            B8n8E/rLZqhvBrB58/3PaWvSRWVEAD2L1zBbNrfCleDsHIN+SgfPkPdvzEv4JYk8
+            bVauG9wZh6Z3fgoT0NgzG8XtquIShviw2q5EOE3VEh1X1O90aLOpvQH4YJddgSBB
+            i8VjACMnq+NPODJVIJCzqI5bHyhq1K666/HpMTR2H9eWCCmfB6HVhpJ37tdA/S/S
+            XgHwqbomlaxeU6e5pkUXHaxO336ObSA6/75/UZQSdQUqwZVkFOzQDE6CADE+p/qG
+            mYahltV1nQRdkLa8bNC6oLtPteeKP9DhmYV60LaB1ZYE5qE5CAypl7YLy2+Ql0Y=
+            =oRLO
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
     encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$

kubernetes/system/coredns/etcd.yaml

@@ -54,6 +54,7 @@ spec:
     - metadata:
         name: etcd-data
       spec:
+        storageClassName: longhorn
         accessModes: ["ReadWriteOnce"]
         resources:
           requests:

kubernetes/system/coredns/zone-configmap.yaml

@@ -30,6 +30,9 @@ data:
     docker-r740     IN  A   10.1.2.212
     truenas         IN  A   10.1.2.139
 
+    ; P330
+    p330            IN  A   10.1.2.132
+
     ; PVE
     pve             IN  A   10.1.2.10
     docker-homeprod IN  A   10.1.2.12

kubernetes/system/csi-driver-nfs/values.yaml

@@ -2,7 +2,7 @@ storageClass:
     create: true
     name: nfs-csi
     annotations:
-        storageclass.kubernetes.io/is-default-class: "true"
+        storageclass.kubernetes.io/is-default-class: "false"
     parameters:
         server: truenas.lan
         share: /mnt/fast_app_data/kube/

kubernetes/system/longhorn/values.yaml

@@ -12,26 +12,67 @@ defaultSettings:
     autoSalvage: true
     # Disable strict flushing for better single-node performance
     strictSyncReplicas: false
+    # Toleration for system-managed Longhorn pods (instance-manager, engine,
+    # replica, CSI plugin). These pods are created dynamically by
+    # longhorn-manager — NOT from Helm templates — so their tolerations must be
+    # set here via the `taintToleration` setting (semicolon-separated `kubectl
+    # taint` syntax), not via per-component `tolerations` blocks.
+    #
+    # The P330 node is tainted `dedicated=failover:NoSchedule` (see
+    # infra/p330/kube/variables.tf). Tolerating it lets Longhorn schedule
+    # engine/replica pods there so a volume can be failed over to the P330.
+    # The control-plane taint is also tolerated defensively, although with
+    # allowSchedulingOnControlPlanes=true on the R740 it is not actually applied.
+    taintToleration: dedicated=failover:NoSchedule;node-role.kubernetes.io/control-plane:NoSchedule
 persistence:
-    # Not default yet — nfs-csi stays default until migration begins
-    defaultClass: false
+    defaultClass: true
     defaultClassReplicaCount: 1
     # Retain volumes on PVC delete — safer during migration
     reclaimPolicy: Retain
     # Mount options for ext4
     fstype: ext4
-longhorn-ui:
+# longhorn-manager is a DaemonSet — it must run on every storage node,
+# including the P330 failover node. The control-plane toleration is defensive
+# (allowSchedulingOnControlPlanes=true means it is not actually applied on the
+# R740, but keeps things correct if that ever changes).
+longhornManager:
+    tolerations:
+        - key: ENC[AES256_GCM,data:ZvL4q5WzJQbz/+jBCaH4Gpp5PdCqwrqcIDCXwPq1oVintCYXxg==,iv:SASkDRml7AG+wJTWe/CRaAm7kv7tJ/IRXfpWzeewHuo=,tag:ToVKgaQeLVav7Qt2bdlpnw==,type:str]
+          operator: Exists
+          effect: NoSchedule
+        # Tolerate the failover taint so longhorn-manager runs on the P330
+        - key: ENC[AES256_GCM,data:B+Y/ckOHz6xq,iv:27M/gUOPZ09BNZP2OwyjNsK8Ld0opec9l2FjiRiN0Wg=,tag:3UGdvzOsXgSAs7KwBJ5oKQ==,type:str]
+          value: ENC[AES256_GCM,data:YT/EL6wwlYI=,iv:H8CCtKbzmWRahFxtZguzghVLK3/qvHFaE8IQPALL0Oo=,tag:HIMsMtxutYh3HVASeIrxtw==,type:str]
+          operator: Equal
+          effect: NoSchedule
+# longhorn-driver (CSI provisioner/attacher deployer) — tolerate the same
+# taints so CSI operations work from the failover node.
+longhornDriver:
+    tolerations:
+        - key: ENC[AES256_GCM,data:ks2denq5PQL6UjGUe5JFahXJqLDY8jQgAPjQkn3fhryTCsd1Tg==,iv:gR8QtaRW5+4GptIa92hh2v+pk41ve1FmCMC+qlitdOs=,tag:NDGn8o5btPbfqDWg1nS6wQ==,type:str]
+          operator: Exists
+          effect: NoSchedule
+        - key: ENC[AES256_GCM,data:nRPej7F1wIQr,iv:fRF9YaiqpPCAEGSXCHJublN7OYoikb3xK1RacxMKDcw=,tag:+leZjB1PGhWvxhrEBHxImg==,type:str]
+          value: ENC[AES256_GCM,data:QdMlIx5PYgU=,iv:TJ+i5qwY6G2j+87HdmOZwDWPzJOd9bDeJUmkC3yl9oA=,tag:niNS/IwVVaw+83e4jJrgag==,type:str]
+          operator: Equal
+          effect: NoSchedule
+# longhorn-ui — tolerate the same taints so the UI is reachable even if it
+# lands on the failover node.
+longhornUI:
     replicas: 1
-longhorn-manager:
     tolerations:
-        - key: ENC[AES256_GCM,data:c2J2DGZmaM/ix/q/qEh6GP9Uvq+e9ZLTqkfcslLfFgurUiMXpg==,iv:b2X+xaoFsUM7OTIarVVridMUTRRecDXGWHDKc0C7WjM=,tag:AerEyuAxoP2iIM2rcS2TPg==,type:str]
+        - key: ENC[AES256_GCM,data:mYYdyvTvfbP57Tr7zEUgAYZmtSmTougPSbou75YNqD93LvQEuw==,iv:vcKiaYE2ikIAornOIs7LB4iIp6XczB8VmW1FgeUO2ho=,tag:i1yOrLaUX1+AzviTLYQFUw==,type:str]
           operator: Exists
           effect: NoSchedule
-longhorn-driver-deployer:
-    tolerations:
-        - key: ENC[AES256_GCM,data:RVYMPUMyRKXBPqJdPy3X48uT4CVxRhpNcmEHEAEesuu2+SBREQ==,iv:zt6aCBfSwAKOnRtwI2Fwm8nJmzyTT5QOV+CSNHAq8nE=,tag:oKnu/3yBjz3EO77DsD8WiQ==,type:str]
-          operator: Exists
+        - key: ENC[AES256_GCM,data:rqykd/I0zsFq,iv:lixb2ezSpU2GjXsi8li4z0d1TjNpCRiPXrSMiOASH64=,tag:rMg3tE4fw7jFpidBRZBkIQ==,type:str]
+          value: ENC[AES256_GCM,data:S7G6SgmWjA0=,iv:Wwo3U/bFkch+dNlLZLDNCiaUVID8bIVxhPtizIUt/rE=,tag:7R8s/D6IX4SfZgT/PCkbVw==,type:str]
+          operator: Equal
           effect: NoSchedule
+# NOTE: There is no `longhorn-instance-manager` Helm key. The instance-manager,
+# engine and replica pods are system-managed and created dynamically by
+# longhorn-manager; their tolerations come from `defaultSettings.taintToleration`
+# above. Do not add a `longhorn-instance-manager` block here — it would be
+# silently ignored.
 # Disable ingress for now
 ingress:
     enabled: false
@@ -56,27 +97,27 @@ recurringJobs:
           labels:
             type: backup
 sops:
-    lastmodified: "2026-07-10T22:54:09Z"
-    mac: ENC[AES256_GCM,data:G2EsREFL55kWR/J2iDyj4ri0W6Yj1hwlg9LOr6Z6GMV3iaXXf1TwN9yJqPsWRXhwxeg3b2XBfmrRFEA4HXntTRdGmh+9odLJh0C6EEuVUj+vZcwOsgppQ/xI3f7vZ1zCmSzOMUTpLKxWV3um+/uvathICUfWvjxpQuA7+SJbZ/0=,iv:dbcV7A/VU6Le8cTeUEuFcOSBvj74X3pPZH/i3Df4rAg=,tag:czw/g1Xk+qxUM7b4PQerFw==,type:str]
+    lastmodified: "2026-07-22T09:25:21Z"
+    mac: ENC[AES256_GCM,data:H61nccieTaqp4w6cySS8EG6VZvplmUdSSo2MFi+mGzZohJFjTfdHxIaJgfKuN7/+/dMoacgozl73CmwSnelzgKMm9CZNf0ucWXRPG/8EiM5IeDXBhRChP+Y8BHX6h7FNS6la6Jzdqy8/jKUPw5sdDQaHT6KnQ37ie+D3JjZAwic=,iv:qb/Cr0upi9qQfYVDAwFyLqnVHSlktkVVbsmhTaFsZu0=,tag:q0jPEGtNl4BmBJpdghgRJg==,type:str]
     pgp:
-        - created_at: "2026-07-10T22:54:09Z"
+        - created_at: "2026-07-22T09:25:21Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ//bfvnH8G5BtfRtcAvEDR8I/7c7mnKgPJaI5ZfulgVJOfT
-            6wApzIoLCBEfNLAwCDEWWRPeFicQHv7Aq5BDK9EJ3EioupfERPbDNKNiBfWPNlNU
-            dYqFR7jaxp+uPLm5PaydsoNL4TxtGS8pw12JJJCTaEz9ybOi40aOr4TRdLtRqUAP
-            XU/BHArIKoORiEKhYunfgfgZjAHI6732v1KnAYRcSVv5vccRpSn3hTMS3oPgcEu+
-            VHHpoiOrJaFVtbIxwNEx1TVS9K0denx9m/VEZjE5BaFJ1b45v3aUAlwMYjj0+//R
-            MFNoMaCQQ+D8WYOG8Hu5/bCVtvVr7xu0q6jrno42LgPiPt5MVgTbu8+Sp9hUzgbS
-            D1p2ajy+i9/kMPC9qQDbZT/MbudvaVKStsfmCuefDz29epaClXyNygyNA5P57hur
-            4h9/tQX5pylLOoCSH/pDN9bXy/RhTkWemJllXjPX4K5BgWnG+YpyWRAizBi47nV5
-            VzzWL/wLLhB38VrK2d0c5WQPsRzd7PQrqEwNBy9IGM5E8k1oJ33dCyIL9b6TnN51
-            5rm00D3k8AFKWqu2kJ51mXEAA9tUv2dq3w9r0XSwSnccRRwnSbSOvgZhp8qjqVNB
-            BG858obUUSCO45JFMKlhrHc8UWbSTAvYHi5vv/lKj5/jc9w2zEA+vNxEfEXPquzS
-            XAF5BKlXDxPPxw5aTsRIekZSj1irS2THDzeQqpZS+dASOP/S+a0KxlWsMCUBE2ai
-            3rIi6kBQtAFRKBjr8wF5w0DdRPqM0jx7nOEdZNm80VGKdbkI/q+y/ChxLp2X
-            =dVVu
+            hQIMA7uy4qQr71wiARAAwf/RSzNAtZ+BY13bYXQstWAs+7HYZLm1fNKcqNKevSHT
+            +LKy+YkfXgDk67PZNz2H5v3N3GJi/cDEo1MhfXeutYLioZ7WFVaeXsvd3hxisbzi
+            noliuQtu9b63l5UwZPbWvfFDKLJqVKG2JTfXSp+G0Nv11VYCYKftRNd/KH+xEP89
+            hGWGuL+AhbPW9dFimiAICLk/sGyVXNq1SAKu3rL9o/mtRDh+igSg5YohhYhiA7TC
+            PMp/7SRY6swfZ0xfyw9PKlbR5Gm7i5Wtml6MP5myZ90cjzMAkjOL8NavxGogvfib
+            ajjdN5AqdoSU5Kr+rKx8I3Eq9V0Fs/oXfmLeHYYdNoqNOqpqtupXKnMVEdHyUdeq
+            shBuDUE4dvZWyYKfZKzQz2WASN1GDiVm89IvhQ2MP1nEhRE92UyixKHQmLgNolpm
+            LTkuGzWU3dNzHO1c3JLgjF/lWve5KV01Wa/HrAZFH5rSG3qLN8rkmhB+q4C2jjkN
+            4aXyPY8/vRLbIwQgSnxBKYzD6yNFNj76W8kmdEe7c1sMcJZZdjC2pqmEzlfoP9sl
+            vzLkHQeFe2IGYMVna0KVCuEk+5pTvnU7KaoMjfbGFPvDwv3heRUzSTBAF3furx03
+            QHi9bOVCrhrt3QLb7cQSrhGMwtV+XiphfQVAJqKSS3la0XjIoJzm297hNgXv0OTS
+            XAGMF0oFo/1bytZZY0+BSe10y4g+G8q47cqWq0/bnvG4fP95/U3/tH8njIFeNg0U
+            yqm9O+1fQ6I2b6hRlGyv6RjovRc32J+RVPgEkK5a5dlvSTQf97tw9Bo3tKc6
+            =SxRv
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
     encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$

kubernetes/tools/dashy/values.yaml

@@ -1,11 +1,38 @@
 ingress:
-  main:
-    enabled: true
-    hosts:
-        - host: dashy.lan
-          paths:
-            - path: /
-              pathType: ImplementationSpecific
+    main:
+        enabled: true
+        hosts:
+            - host: dashy.lan
+              paths:
+                - path: /
+                  pathType: ImplementationSpecific
 persistence:
-  data:
-    enabled: true
+    data:
+        enabled: true
+        storageClass: longhorn
+sops:
+    lastmodified: "2026-07-18T14:22:16Z"
+    mac: ENC[AES256_GCM,data:Svz0vne+sbEj5wlL4FHUrTPMHlprWnZqR/X3tEmpDIxKBD0C/C9G1LgPYBiHviHEiiD/XbxxgH9nGcJIo4blbWc6xRNyUjnhGoLPIPJlG9LclXVh7dm4w4bETq4VfQZjLpY6bhv0q2d5GgxI6i+Hp16FSk8Y4kReErmQdg/Vh9I=,iv:zt3Rjt9KapI7LMMlpA/MPWK8EgGVFRpLJ4d2r4P74eY=,tag:fo2CgvaoT6bz1xmYA9DvGg==,type:str]
+    pgp:
+        - created_at: "2026-07-18T14:22:16Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ//RB59ULu3tagTsLKGU+2azz+yTgnRKUsauEhC2trzbpRO
+            Au0RYwQMyDmYwTAvIIRM5gWUGlIFpsiftpK6rZbvJiwb8npYVSF7/shqKzlqYiSi
+            +BHJCSqfk+emN9ULivxmq3i+t4YZ97Ap7uo+pUyBmpz4jis0vdiIDIszLwtJ3U0J
+            t6s2gVl4KE2STyVH+ShERG3yjSBuzvFpJVwSdAfGKeA8K6Umr1LQH/2JSlq8/2fV
+            Zubfu6aGXg564rsbZNs+P9/b5M4FmpSlSOlp6OLWnIosl9CfRVDynnRyLImvQ/8p
+            2Asf6vrAQZJVXHraGMfePNNA9sRxhMa8f1qgHDWGfHh8D8/7JwK5xoFWrNoO7Gb6
+            aex15qielE0N4jpiEC3t+jjRUQLdjMuSlRET/0RVrZRhZ4lUTOOINnw8eUic0vRz
+            OjPj/ffVI4+zqfq7GnopISWBtfMdc23Y+7IhL/8LWRJGLRSqB0fNQxWeS7dtze2o
+            2BWk+DsHiG/1bz2hdezuR+KTRoj7qPDI/eKPc1BpyHfVm8k1y3pFmwWY3rwGAGA0
+            6bB1VSBriE3pcvUiJw4N+Ja/C7gLcUVAtNKGLqxuWr+2bm/ExWItAbnZ/3cZzKtC
+            bULu5ic/zN3O3rRWCS5nFU+nD37pq1Iq3eHXOWygwNOJJcGGHl9+3j01y2iXUl3S
+            XgGKWMKthF+9AD1bASp8tZ1lfNuqyxjbdVyWb7xqRGa2jzWgAcVUaCWWaJU6yASF
+            LdXY6xVKr1DgBs666nv4xAESsgvZ9xP6e+YaxAr3piRuDhzoNFeveOD99tsgZOg=
+            =zi2x
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    version: 3.10.2