syncthing(kube): deploy

The operator's managed policy is default-deny with egress limited to DNS
and TCP 443, so reaching a LAN service on any other port is dropped.
Measured against 10.4.1.222 from inside the pod: 443 returns RST while
7020 times out, so routing is fine and the port is what gets refused.

Add a supplementary egress policy admitting 10.0.0.0/8, excluding the
service (10.96.0.0/12) and pod (10.244.0.0/16) CIDRs so this does not
grant every pod a path out. No port list: the point is arbitrary LAN
services. Registered in the directory kustomization alongside the
existing mail and radicale egress policies.

docker/home/esphome/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   esphome:
-    image: ghcr.io/esphome/esphome:2026.9.0
+    image: ghcr.io/esphome/esphome:2026.8.0
     ports:
       - "6052"
     networks:

infra/r740/docker/main.tf

@@ -2,7 +2,7 @@ terraform {
   required_providers {
     docker = {
       source  = "kreuzwerker/docker"
-      version = "3.6.2"
+      version = "3.9.0"
     }
   }
 }

kubernetes/infrastructure/mail/stalwart/release.yaml

@@ -14,7 +14,7 @@ spec:
         name: stalwart-helm
         namespace: stalwart
       chart: stalwart
-      version: "0.7.16"
+      version: "0.7.18"
       interval: 1m
   valuesFrom:
     - kind: Secret

kubernetes/infrastructure/mail/stalwart/values.yaml

@@ -7,7 +7,7 @@
 # Container image
 image:
     repository: stalwartlabs/stalwart
-    tag: v0.16.20
+    tag: v0.16.22
     pullPolicy: IfNotPresent
 # Single-node RocksDB deployment.
 replicaCount: 1

kubernetes/kustomization.yaml

@@ -35,6 +35,7 @@ resources:
   # Personal (apps storing my own content, grouped by content type)
   - personal/paperless
   - personal/radicale
+  - personal/syncthing
   - personal/media/photoprism
   - personal/notes/notesnook
   - personal/notes/obsidian-livesync

kubernetes/personal/openclaw/kustomization.yaml

@@ -5,5 +5,6 @@ resources:
   - openclaw-instance.yaml
   - openclaw-secrets.yaml
   - networkpolicy.yaml
+  - networkpolicy-lan-egress.yaml
   - networkpolicy-mail-egress.yaml
   - networkpolicy-radicale-egress.yaml

kubernetes/personal/openclaw/networkpolicy-lan-egress.yaml

@@ -0,0 +1,39 @@
+# Supplementary egress policy: the operator's managed default-deny NetworkPolicy
+# only allows DNS (53) and TCP 443 outbound, so any other port toward the local
+# network is dropped. That blocks the OpenClaw pod from reaching LAN services
+# that do not speak HTTPS on 443. Measured from inside the pod against
+# 10.4.1.222, 443 returns RST (admitted, nothing listening) while 7020 times
+# out, which shows LAN routing works and only the port is being refused.
+#
+# The egress rule below sets no `ports`, because the goal is arbitrary LAN
+# services rather than one known port. Cluster CIDRs are excluded so this does
+# not become a blanket "any pod, any port" grant; the LAN is what gets admitted.
+# Note this is additive to the operator's rules, so DNS and 443 everywhere still
+# hold.
+#
+# Written as a sidecar policy rather than via the CR fields
+# spec.security.networkPolicy.additionalEgress / allowedEgressCIDRs, matching
+# the existing networkpolicy-mail-egress / -radicale-egress pattern. Those CR
+# fields DO appear in the 0.39.0 CRD template, contrary to the comments on the
+# sibling policies, so they are worth retrying once the installed CRD version is
+# confirmed. Until then the sidecar route is the one known to take effect.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: openclaw-lan-egress
+  namespace: openclaw
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: openclaw
+      app.kubernetes.io/name: openclaw
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - ipBlock:
+            cidr: 10.0.0.0/8
+            except:
+              # Service CIDR and pod CIDR (infra/kube/talconfig.yaml).
+              - 10.96.0.0/12
+              - 10.244.0.0/16

kubernetes/personal/paperless/postgres-release.yaml

@@ -12,7 +12,7 @@ spec:
         name: cloudpirates
         namespace: paperless
       chart: postgres
-      version: "0.20.4"
+      version: "0.20.5"
       interval: 1m
   valuesFrom:
     - kind: Secret

kubernetes/personal/paperless/redis-release.yaml

@@ -12,7 +12,7 @@ spec:
         name: cloudpirates
         namespace: paperless
       chart: redis
-      version: "0.34.26"
+      version: "0.35.1"
       interval: 1m
   valuesFrom:
     - kind: Secret

kubernetes/personal/radicale/release.yaml

@@ -12,7 +12,7 @@ spec:
         name: derwitt
         namespace: radicale
       chart: radicale
-      version: "2.1.0"
+      version: "2.1.1"
       interval: 1m
   valuesFrom:
     - kind: Secret

kubernetes/personal/syncthing/kustomization.yaml

@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: syncthing
+resources:
+  - namespace.yaml
+  - repository.yaml
+  - release.yaml
+secretGenerator:
+  - name: syncthing-values
+    files:
+      - values.yaml=values.yaml
+configurations:
+  - kustomizeconfig.yaml

kubernetes/personal/syncthing/kustomizeconfig.yaml

@@ -0,0 +1,6 @@
+nameReference:
+  - kind: Secret
+    version: v1
+    fieldSpecs:
+      - path: spec/valuesFrom/name
+        kind: HelmRelease

kubernetes/personal/syncthing/namespace.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: syncthing
+  labels:
+    app.kubernetes.io/name: syncthing
+    app.kubernetes.io/component: file-sync

kubernetes/personal/syncthing/release.yaml

@@ -0,0 +1,19 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: syncthing
+  namespace: syncthing
+spec:
+  interval: 1m
+  chart:
+    spec:
+      sourceRef:
+        kind: HelmRepository
+        name: k8s-home-lab
+        namespace: syncthing
+      chart: syncthing
+      version: "5.2.0"
+      interval: 1m
+  valuesFrom:
+    - kind: Secret
+      name: syncthing-values

kubernetes/personal/syncthing/repository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: k8s-home-lab
+  namespace: syncthing
+spec:
+  interval: 1h
+  url: https://k8s-home-lab.github.io/helm-charts/

kubernetes/personal/syncthing/values.yaml

@@ -0,0 +1,152 @@
+# Syncthing continuous file synchronization
+#
+# Sync ports (22000 TCP+QUIC, 21027 UDP) are exposed through LoadBalancer
+# services on the dedicated Cilium pool IP 10.2.2.7 (appended to
+# kubernetes/system/cilium/pool.yaml). The GUI goes through Traefik like the
+# other *.lan services.
+controller:
+    replicas: 1
+image:
+    repository: syncthing/syncthing
+    tag: "2.1"
+env:
+    - name: TZ
+      value: Europe/Paris
+    - name: PUID
+      value: "1000"
+    - name: PGID
+      value: "1000"
+podSecurityContext:
+    fsGroup: 1000
+service:
+    main:
+        ports:
+            http:
+                port: 8384
+    # Sync protocol and QUIC share 22000 on the pooled IP; LAN discovery
+    # rides on UDP 21027. externalTrafficPolicy Local preserves client IPs.
+    listen:
+        enabled: true
+        type: LoadBalancer
+        externalTrafficPolicy: Local
+        loadBalancerIP: 10.2.2.7
+        ports:
+            listen:
+                enabled: true
+                port: 22000
+                protocol: TCP
+                targetPort: 22000
+            quic:
+                enabled: true
+                port: 22000
+                protocol: UDP
+                targetPort: 22000
+    discovery:
+        enabled: true
+        type: LoadBalancer
+        externalTrafficPolicy: Local
+        loadBalancerIP: 10.2.2.7
+        ports:
+            discovery:
+                enabled: true
+                port: 21027
+                protocol: UDP
+                targetPort: 21027
+probes:
+    liveness:
+        custom: true
+        spec:
+            httpGet:
+                path: /rest/noauth/health
+                port: http
+    readiness:
+        custom: true
+        spec:
+            httpGet:
+                path: /rest/noauth/health
+                port: http
+ingress:
+    main:
+        enabled: true
+        ingressClassName: traefik
+        annotations:
+            external-dns.alpha.kubernetes.io/enabled: "true"
+        hosts:
+            - host: syncthing.lan
+              paths:
+                - path: /
+                  pathType: Prefix
+persistence:
+    config:
+        enabled: true
+        mountPath: /var/syncthing/config
+        storageClass: longhorn
+        size: 5Gi
+    # Shares are recreated by hand in the GUI after cutover — the instance
+    # boots with a fresh config (see plans/syncthing-docker-to-kube-migration.md):
+    # valentin's folders at /data/valentin/… and sarah's at /data/sarah/…, all
+    # backed by the same TrueNAS exports as the docker stack. Photoprism
+    # already mounts the valentin Photos export concurrently.
+    valentin-documents:
+        enabled: true
+        type: custom
+        mountPath: /data/valentin/Documents
+        volumeSpec:
+            nfs:
+                server: truenas.lan
+                path: /mnt/main_storage/valentin/Documents
+    valentin-photos:
+        enabled: true
+        type: custom
+        mountPath: /data/valentin/Photos
+        volumeSpec:
+            nfs:
+                server: truenas.lan
+                path: /mnt/main_storage/valentin/Photos
+    sarah-documents:
+        enabled: true
+        type: custom
+        mountPath: /data/sarah/Documents
+        volumeSpec:
+            nfs:
+                server: truenas.lan
+                path: /mnt/main_storage/sarah/Documents
+    sarah-photos:
+        enabled: true
+        type: custom
+        mountPath: /data/sarah/Photos
+        volumeSpec:
+            nfs:
+                server: truenas.lan
+                path: /mnt/main_storage/sarah/Photos
+resources:
+    requests:
+        memory: 512Mi
+    limits:
+        memory: 2Gi
+sops:
+    lastmodified: "2026-09-21T22:28:39Z"
+    mac: ENC[AES256_GCM,data:BR4P4s4C9n4bEHryqfHpzzFHxAlKeujFBO2Qhsc4qdkcI5dftJ7jrknWtW0uv1E2Aljp50Mx1Rk4wglaWh3MS/ZnY/1dUxCfKuXOGkv9+mymQxDk6zJLsUNTH7sMr5kzlVWfv3yzXF50HWuiNl71BAv4mtlrtarXS1KVQrCKNaA=,iv:aG9OxDOhwk7xYNbvESNMFnXIjKhbYNO0gvDn1a9QQvc=,tag:QxM3EX8V2KJzosRz5damrw==,type:str]
+    pgp:
+        - created_at: "2026-09-21T22:28:39Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ//cvlMqPSaED2y5dsq8H/W/dqYVOeG7E/ZOuJGaYnImrrp
+            V2W6vPTzQ8QuYTKa1X4aOIlda04n7i2kDQCvpszmdpsU2y0SWtsgOBbyloIU3cAM
+            69HGd1SNqP/FayeZy/hHNvvEjmsgKX/9IV1YBGOcikmd7MqoxgGRgIxXORzY0dBG
+            7oREwV0HubdIBG6Fi6HUyN+Pugftpcumfwtl8ppPUYi1HGKzL5LzIT6gfqXtUcBg
+            8Wl2f0kMZsat1e05sZZah41dg+BAlyDgCRFo/ZQIhzHi28rJkZWG2aZxQfvAFMYJ
+            hUkjVyN7rAO01b2PsXK3bleFjD8iL8PhHY/Rio0/Uizjub7inako2SUd38D7X+ce
+            M1c2GoDVNmwZyXg7jBzb67JxLPn4Ic1kbjUi/JJL22rDzN0pBf6J7ExCpVGxrwK8
+            ++YDD1m/rY3YA8/ioM+pTu3ktEd1zu0T1yFySjgtvX8QVmOkrG1AA8E/N3+pzFWP
+            9wrJJ+yp5CYQl9d3j5LQcOzmvROi0EHjeZY75IHw8NwkyWdnRgWFIPsXxVoSUhSk
+            909RE//BuKSSRd1r9D/4w14Eb9KC74bIsUIflyK2Qs/N3rh9+/O8FS/5saryq7Er
+            GO3oAmFqC2F4Y6zFlmXkr43gBFjCPWl0DxI3uUK/gcw8kBpLSJex3j2sDaLViS/S
+            XgFsDLAjHnEo5DC+xyJQI5xMWsQzx/ASNZdBVLrnYPsRt+YG7qfu3lKNS9ujAG7K
+            ti58fACtT97K8IrUMNyEDGieFz65TYPcie4qILnDt2Hkr6QUEdBR8rvn/8z36D8=
+            =47Rw
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
+    version: 3.10.2

kubernetes/system/cilium/pool.yaml

@@ -8,3 +8,4 @@ spec:
   - cidr: "10.2.2.4/32"
   - cidr: "10.2.2.5/32"
   - cidr: "10.2.2.6/32"
+  - cidr: "10.2.2.7/32"

kubernetes/system/kyverno/release.yaml

@@ -12,7 +12,7 @@ spec:
         name: kyverno
         namespace: kyverno
       chart: kyverno
-      version: '3.9.0'
+      version: '3.9.1'
       interval: 5m
   # Minimal footprint for a single-node cluster:
   #  - admissionReports disabled (no extra Redis/Postgres)