build(deps): bump stalwartlabs/stalwart

Bumps stalwartlabs/stalwart from v0.16.10 to v0.16.11.

---
updated-dependencies:
- dependency-name: stalwartlabs/stalwart
  dependency-version: v0.16.11
  dependency-type: direct:production
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/dependabot.yml

@@ -0,0 +1,63 @@
+version: 2
+updates:
+  - package-ecosystem: "docker-compose"
+    open-pull-requests-limit: 15
+    schedule:
+      interval: weekly
+    directories:
+      - "/docker/home/esphome"
+      - "/docker/home/matter-server"
+      - "/docker/home/mosquitto-mqtt"
+      - "/docker/home/n8n"
+      - "/docker/home/node-red"
+      - "/docker/home/zigbee2mqtt"
+      - "/docker/infrastructure/mail/roundcube"
+      - "/docker/infrastructure/mail/stalwart"
+      - "/docker/infrastructure/network/traefik"
+      - "/docker/infrastructure/squid"
+      - "/docker/infrastructure/sshportal"
+      - "/docker/personal/fireshare"
+      - "/docker/personal/gramps"
+      - "/docker/personal/media/films-series/jackett"
+      - "/docker/personal/media/films-series/jellyfin"
+      - "/docker/personal/media/films-series/jellyseerr"
+      - "/docker/personal/media/films-series/radarr"
+      - "/docker/personal/media/films-series/sonarr"
+      - "/docker/personal/media/films-series/transmission"
+      - "/docker/personal/media/films-series/wizarr"
+      - "/docker/personal/media/music/navidrome"
+      - "/docker/personal/media/youtube/tubearchivist"
+      - "/docker/personal/paperless"
+      - "/docker/personal/radicale"
+      - "/docker/personal/syncthing"
+      - "/docker/personal/tandoor"
+      - "/docker/production/alexscript"
+      - "/docker/production/buildpath"
+      - "/docker/production/semeryfr"
+      - "/docker/tools/excalidraw"
+      - "/docker/tools/obsidian-livesync"
+      - "/docker/tools/stirling-pdf"
+  - package-ecosystem: "helm"
+    open-pull-requests-limit: 15
+    schedule:
+      interval: weekly
+    directories:
+      - "/kubernetes/code/gitea"
+      - "/kubernetes/code/harbor"
+      - "/kubernetes/home/home-assisant"
+      - "/kubernetes/home/zigbee2mqtt"
+      - "/kubernetes/infrastructure/authentik"
+      - "/kubernetes/personal/linkwarden"
+      - "/kubernetes/personal/notesnook"
+      - "/kubernetes/personal/photoprism"
+      - "/kubernetes/production/umami"
+      - "/kubernetes/production/vhaudiquet-fr"
+      - "/kubernetes/system/blocky"
+      - "/kubernetes/system/caddy"
+      - "/kubernetes/system/cert-manager"
+      - "/kubernetes/system/coredns"
+      - "/kubernetes/system/csi-driver-nfs"
+      - "/kubernetes/system/external-dns"
+      - "/kubernetes/system/traefik"
+      - "/kubernetes/tools/dashy"
+      - "/kubernetes/tools/glance"

.gitignore

@@ -9,6 +9,3 @@ terraform.tfstate.backup
 kubeconfig
 talosconfig
 
-# Ignore rendered Talos machine configs (may contain cluster secrets)
-p330.yaml
-

.pre-commit-config.yaml

@@ -6,6 +6,11 @@ repos:
         entry: .pre-commit-sops.sh
         language: script
         pass_filenames: true
+      - id: generate-dependabot
+        name: generate dependabot
+        entry: generate-dependabot.sh
+        language: script
+        pass_filenames: false
       - id: generate-docker-swarmcd
         name: generate docker swarmcd
         entry: generate-docker-swarmcd.sh

.pre-commit-sops.sh

@@ -1,13 +1,6 @@
 #!/bin/bash
 for filename in "$@"; do
     if [[ "${filename}" =~ values.ya?ml$ ]] || [[ "${filename}" =~ secrets?.ya?ml$ ]] || [[ "${filename}" =~ .env$ ]]; then
-        # Skip files that are already SOPS-encrypted: sops -e -i refuses files
-        # containing a top-level 'sops' metadata block (YAML) or '#sops'
-        # comments (dotenv), and double-encrypting would corrupt them anyway.
-        # Makes the hook idempotent for encrypted-at-rest working trees.
-        if grep -qE '^(sops:|#sops)' "${filename}" 2>/dev/null; then
-            continue
-        fi
         sops -e -i "${filename}"
         git add "${filename}"
     fi

.sops.yaml

@@ -1,10 +1,9 @@
 creation_rules:
   - path_regex: .*values.yaml$
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
-    mac_only_encrypted: true
     pgp: DC6910268E657FF70BA7EC289974494E76938DDC
   - path_regex: .*.yaml
-    encrypted_regex: ^(data|stringData|.*key|.*crt)$
+    encrypted_regex: ^(data|stringData|.*.key|.*.crt)$
     pgp: DC6910268E657FF70BA7EC289974494E76938DDC
   - path_regex: .*.env$
     input_type: dotenv

.swarmcd/stacks.yaml

@@ -3,6 +3,11 @@ esphome:
   branch: main
   compose_file: docker/home/esphome/docker-compose.yml
 
+matter-server:
+  repo: homeprod
+  branch: main
+  compose_file: docker/home/matter-server/docker-compose.yml
+
 mosquitto-mqtt:
   repo: homeprod
   branch: main
@@ -28,21 +33,26 @@ roundcube:
   branch: main
   compose_file: docker/infrastructure/mail/roundcube/docker-compose.yml
 
+stalwart:
+  repo: homeprod
+  branch: main
+  compose_file: docker/infrastructure/mail/stalwart/docker-compose.yml
+
 traefik:
   repo: homeprod
   branch: main
   compose_file: docker/infrastructure/network/traefik/docker-compose.yml
 
-observability:
-  repo: homeprod
-  branch: main
-  compose_file: docker/infrastructure/observability/docker-compose.yml
-
 squid:
   repo: homeprod
   branch: main
   compose_file: docker/infrastructure/squid/docker-compose.yml
 
+sshportal:
+  repo: homeprod
+  branch: main
+  compose_file: docker/infrastructure/sshportal/docker-compose.yml
+
 fireshare:
   repo: homeprod
   branch: main
@@ -102,6 +112,13 @@ tubearchivist:
   sops_files:
     - docker/personal/media/youtube/tubearchivist/.env
 
+paperless:
+  repo: homeprod
+  branch: main
+  compose_file: docker/personal/paperless/docker-compose.yml
+  sops_files:
+    - docker/personal/paperless/.env
+
 radicale:
   repo: homeprod
   branch: main
@@ -124,11 +141,30 @@ alexscript:
   branch: main
   compose_file: docker/production/alexscript/docker-compose.yml
 
+buildpath:
+  repo: homeprod
+  branch: main
+  compose_file: docker/production/buildpath/docker-compose.yml
+  sops_files:
+    - docker/production/buildpath/.env
+
+semeryfr:
+  repo: homeprod
+  branch: main
+  compose_file: docker/production/semeryfr/docker-compose.yml
+
 excalidraw:
   repo: homeprod
   branch: main
   compose_file: docker/tools/excalidraw/docker-compose.yml
 
+obsidian-livesync:
+  repo: homeprod
+  branch: main
+  compose_file: docker/tools/obsidian-livesync/docker-compose.yml
+  sops_files:
+    - docker/tools/obsidian-livesync/.env
+
 stirling-pdf:
   repo: homeprod
   branch: main

README.md

@@ -20,15 +20,7 @@ SAS9300-8E external SAS card
 NVIDIA RTX 3060 12G graphics card
 ```
 
-Running as single-node Proxmox, with multiple VMs and LXC containers.
+Running as single-node Proxmox
-
-#### Lenovo P330
-
-Running as a Talos/Kubernetes cluster node, for failover deployment.
-
-#### Raspberry Pi 4
-
-Running as a Talos/Kubernetes cluster node, for quorum only.
 
 ### Software stack(s)
 
@@ -58,7 +50,7 @@ Debian and docker / docker swarm are deployed by Terraform, which also deploys [
 | <img width=32 src="https://avatars.githubusercontent.com/u/12724356"><img width=32 src="https://avatars.githubusercontent.com/u/40275816"> | Repository applications | Gitea, Harbor to store code and images |
 | <img width=30 src="https://buildpath.win/_ipx/w_60&f_webp/buildpath-high-resolution-logo-transparent.png"> <img width=32 src="https://avatars.githubusercontent.com/u/13844975"> | Production applications | Personal applications running on the cluster |
 
-Talos Linux, Cilium and Flux are deployed using Terraform; then Flux takes over and deploys the whole `kubernetes` folder of this repository.
+Talos Linux, Cilium and flux are deployed using Terraform ; then flux takes over and deploys the whole `kubernetes` folder of this repository.
 
 ### Production/personal applications
 

dns/production/buildpath.win.yaml

@@ -6,7 +6,7 @@
         proxied: false
     ttl: 300
     type: A
-    value: 82.64.154.58
+    value: 83.113.30.49
   - type: TXT
     value: google-site-verification=BvFkK7orKeezgxGcdPiGa67PUm9RPI6ZjyyykhSJ24A
 _acme-challenge:
@@ -25,4 +25,4 @@ www:
       proxied: false
   ttl: 300
   type: A
-  value: 82.64.154.58
+  value: 83.113.30.49

dns/production/vhaudiquet.fr.yaml

@@ -5,7 +5,7 @@
         auto-ttl: true
     ttl: 300
     type: A
-    value: 82.64.154.58
+    value: 83.113.30.49
   - octodns:
       cloudflare:
         auto-ttl: true
@@ -77,14 +77,70 @@ _25._tcp:
   ttl: 300
   type: TLSA
   values:
-    - certificate_association_data: CC6230E3A88A173D11C7F614ACFB4FE7B57A01F649ED1ADEE5F953213D4C6607
+  - certificate_association_data: 5dfdb3cf31b26f23d87c09f3a0cef642f64069a9fb7cfe29270bb5dc0f1e16bb
-      certificate_usage: 3
+    certificate_usage: 2
-      matching_type: 1
+    matching_type: 1
-      selector: 1
+    selector: 0
-    - certificate_association_data: 731B7CD6FA08C4A56060172BF8E30563919139F16265A38EC35B2A1F41CE2B6B
+  - certificate_association_data: 76e9e288aafc0e37f4390cbf946aad997d5c1c901b3ce513d3d8fadbabe2ab85
-      certificate_usage: 3
+    certificate_usage: 2
-      matching_type: 1
+    matching_type: 1
-      selector: 0
+    selector: 0
+  - certificate_association_data: 4e32b7ee52c9bd2a15b2df3cae5e3b060d737d71faaaac25336c5f193cbdb52ed2fdf38b29aea9fb97f59c8f86e75b5c364309a232623a99e638116ed66063fd
+    certificate_usage: 2
+    matching_type: 2
+    selector: 0
+  - certificate_association_data: afab698cbbbf892ebb555e09175056c1d4630fe7c350f44dcc6e71843d3b290df00d30ab4e356b630c69169d7633788338922fb637cf5b9f7be20a413eeaa518
+    certificate_usage: 2
+    matching_type: 2
+    selector: 0
+  - certificate_association_data: 3586d4ecf070578cbd27aedce20b964e48bc149faeb9dad72f46b857869172b8
+    certificate_usage: 2
+    matching_type: 1
+    selector: 1
+  - certificate_association_data: d016e1fe311948aca64f2de44ce86c9a51ca041df6103bb52a88eb3f761f57d7
+    certificate_usage: 2
+    matching_type: 1
+    selector: 1
+  - certificate_association_data: a1ef14fea3ca15a552d42665d2fe685672cfdd903de4b370b0d7d87c6d31b5df07142483f36e0e15e16b58f9ba1cbdeeebd4bcb8d74ab7ea32a087db2105f402
+    certificate_usage: 2
+    matching_type: 2
+    selector: 1
+  - certificate_association_data: f8a2b4e23e82a4494e9998fcc4242bef1277656a118beede55ddfadcb82e20c5dc036dcb3b6c48d2ce04e362a9f477c82ad5a557b06b6f33b45ca6662b37c1c9
+    certificate_usage: 2
+    matching_type: 2
+    selector: 1
+  - certificate_association_data: a69ec216999308f0ee575cdef98d6edabed8a6b4d2328e050ac9c7fa06404ad9
+    certificate_usage: 3
+    matching_type: 1
+    selector: 0
+  - certificate_association_data: ccae2719a01f7a6d17d939d8ec13324b7bdb0921ea55d5bfc2f226e54b8c15dd
+    certificate_usage: 3
+    matching_type: 1
+    selector: 0
+  - certificate_association_data: 7cd33aa6bafc850cc89d008fbd0a5cea942c6a573d605984f174fbe7360abbf71fc157ffe0324e380a8dfea62047b9aa140d5899188402ac677c29f96cc1118e
+    certificate_usage: 3
+    matching_type: 2
+    selector: 0
+  - certificate_association_data: 8149784990ba7e448295f9c4eb22abcaa4ecefa1b44f1a71ea13d6827d7068c6469cf5fb08a8ae772c1ef59cddbcfd84d744713c48e985136a234b494511fd03
+    certificate_usage: 3
+    matching_type: 2
+    selector: 0
+  - certificate_association_data: 08f3ffd1b6027093c136f6bb5bc1645a8db31cf2a4392b779c2a2045e152b8b8
+    certificate_usage: 3
+    matching_type: 1
+    selector: 1
+  - certificate_association_data: 12b3946513281ab20ebee4d38d2e139cac1688420015db90ee8e932fe153bc89
+    certificate_usage: 3
+    matching_type: 1
+    selector: 1
+  - certificate_association_data: 7b60aee1a230de2c32c0252540c606897ad66cbabc7331c2d40b7dd0e3249e0cc53e145605e610d8dc2f41dd16e12f51dca4641d13e748553bd0f596455dae77
+    certificate_usage: 3
+    matching_type: 2
+    selector: 1
+  - certificate_association_data: 8cee22274c3f828eda9d18c9954ed0a3ad5172e71b7852c780384bf3828ff1bb26fca899395e99e4d191c2d1e0a55404f97e76bb7d4ad8dff71c6c271d34de49
+    certificate_usage: 3
+    matching_type: 2
+    selector: 1
 _caldavs._tcp:
   octodns:
     cloudflare:
@@ -257,20 +313,27 @@ _submissions._tcp:
     priority: 0
     target: vhaudiquet.fr.
     weight: 1
+alexscript:
+  octodns:
+    cloudflare:
+      auto-ttl: true
+  ttl: 300
+  type: A
+  value: 83.113.30.49
 auth-nook:
   octodns:
     cloudflare:
       auto-ttl: true
   ttl: 300
   type: A
-  value: 82.64.154.58
+  value: 83.113.30.49
 authentik:
   octodns:
     cloudflare:
       auto-ttl: true
   ttl: 300
   type: A
-  value: 82.64.154.58
+  value: 83.113.30.49
 autoconfig:
   octodns:
     cloudflare:
@@ -285,6 +348,13 @@ autodiscover:
   ttl: 300
   type: CNAME
   value: mail.vhaudiquet.fr.
+canada:
+  octodns:
+    cloudflare:
+      auto-ttl: true
+  ttl: 300
+  type: A
+  value: 192.99.6.159
 clips:
   octodns:
     cloudflare:
@@ -305,21 +375,29 @@ flux-webhook:
       auto-ttl: true
   ttl: 300
   type: A
-  value: 82.64.154.58
+  value: 83.113.30.49
 git:
   octodns:
     cloudflare:
       auto-ttl: true
   ttl: 300
   type: A
-  value: 82.64.154.58
+  value: 83.113.30.49
-inbox-nook:
+jupyter:
   octodns:
     cloudflare:
       auto-ttl: true
   ttl: 300
   type: A
-  value: 82.64.154.58
+  value: 83.113.30.49
+kasm:
+  octodns:
+    cloudflare:
+      auto-ttl: true
+      proxied: true
+  ttl: 300
+  type: A
+  value: 83.113.30.49
 ligory:
 - octodns:
     cloudflare:
@@ -335,19 +413,33 @@ ligory:
   value:
     exchange: ligory.vhaudiquet.fr.
     preference: 20
+lol:
+  octodns:
+    cloudflare:
+      auto-ttl: true
+  ttl: 300
+  type: A
+  value: 83.113.30.49
 mail:
 - octodns:
     cloudflare:
       auto-ttl: true
   ttl: 300
   type: A
-  value: 82.64.154.58
+  value: 83.113.30.49
 - octodns:
     cloudflare:
       auto-ttl: true
   ttl: 300
   type: TXT
   value: v=spf1 a ra=postmaster -all
+md:
+  octodns:
+    cloudflare:
+      auto-ttl: true
+  ttl: 300
+  type: A
+  value: 83.113.30.49
 mta-sts:
   octodns:
     cloudflare:
@@ -361,46 +453,46 @@ n:
       auto-ttl: true
   ttl: 300
   type: A
-  value: 82.64.154.58
+  value: 83.113.30.49
 nook:
   octodns:
     cloudflare:
       auto-ttl: true
   ttl: 300
   type: A
-  value: 82.64.154.58
+  value: 83.113.30.49
 notesnook:
   octodns:
     cloudflare:
       auto-ttl: true
   ttl: 300
   type: A
-  value: 82.64.154.58
+  value: 83.113.30.49
-photos:
+overleaf:
   octodns:
     cloudflare:
       auto-ttl: true
   ttl: 300
   type: A
-  value: 82.64.154.58
+  value: 83.113.30.49
 sse-nook:
   octodns:
     cloudflare:
       auto-ttl: true
   ttl: 300
   type: A
-  value: 82.64.154.58
+  value: 83.113.30.49
 umami:
   octodns:
     cloudflare:
       auto-ttl: true
   ttl: 300
   type: A
-  value: 82.64.154.58
+  value: 83.113.30.49
 www:
   octodns:
     cloudflare:
       auto-ttl: true
   ttl: 300
   type: A
-  value: 82.64.154.58
+  value: 83.113.30.49

docker/home/esphome/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   esphome:
-    image: ghcr.io/esphome/esphome:2026.8.0
+    image: ghcr.io/esphome/esphome:2026.6.2
     ports:
       - "6052"
     networks:

docker/home/matter-server/docker-compose.yml

@@ -0,0 +1,16 @@
+services:
+  matter-server:
+    image: ghcr.io/matter-js/python-matter-server:8.1.2
+    container_name: matter-server
+    restart: unless-stopped
+    network_mode: host
+    volumes:
+      - data:/data/
+
+volumes:
+  data:
+    driver: local
+    driver_opts:
+      type: 'none'
+      o: 'bind'
+      device: '/app/matter-server/data'

docker/home/zigbee2mqtt/docker-compose.yml

@@ -2,7 +2,7 @@ services:
   zigbee2mqtt:
     container_name: zigbee2mqtt
     restart: unless-stopped
-    image: koenkk/zigbee2mqtt:2.12.1
+    image: koenkk/zigbee2mqtt:2.12.0
     networks:
       - default
       - proxy

docker/infrastructure/mail/roundcube/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   roundcube:
-    image: roundcube/roundcubemail:1.7.4-apache
+    image: roundcube/roundcubemail:1.7.1-apache
     container_name: roundcube
     networks:
       - default

docker/infrastructure/mail/stalwart/docker-compose.yml

@@ -0,0 +1,40 @@
+services:
+  stalwart:
+    image: stalwartlabs/stalwart:v0.16.11
+    container_name: stalwart
+    networks:
+      - default
+      - proxy
+    volumes:
+      - stalwart_data:/opt/stalwart
+    ports:
+      - target: 25
+        published: 25
+        mode: host
+      - target: 465
+        published: 465
+        mode: host
+      - target: 993
+        published: 993
+        mode: host
+      - target: 587
+        published: 587
+        mode: host
+      - "8080"
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.stalwart.rule=Host(`mail.vhaudiquet.fr`)"
+      - "traefik.http.services.stalwart.loadbalancer.server.port=8080"
+
+volumes:
+  stalwart_data:
+    driver: local
+    driver_opts:
+      type: 'none'
+      o: 'bind'
+      device: '/app/stalwart/data'
+
+networks:
+  proxy:
+    name: proxy
+    external: true

docker/infrastructure/observability/alloy.river

@@ -1,71 +0,0 @@
-// Grafana Alloy config for the docker host (replaces Promtail, EOL since
-// 2026-03-02). Tails Docker container logs via docker_sd discovery, attaches
-// container_name/compose_service/stream labels, and pushes them to the
-// in-cluster Loki at loki-internal.lan (LAN-only Traefik Ingress on port 80).
-// River config produced by `alloy convert -f promtail` from an equivalent
-// Promtail YAML (so component names and argument shapes are guaranteed
-// correct for Alloy v1.18).
-
-discovery.docker "docker" {
-  host             = "unix:///var/run/docker.sock"
-  refresh_interval = "5s"
-}
-
-loki.process "docker" {
-  forward_to = [loki.write.default.receiver]
-
-  // Parse docker json-file log lines
-  // ({"log":"...","stream":"stdout","time":"..."}).
-  stage.json {
-    expressions = {
-      log    = "log",
-      stream = "stream",
-    }
-  }
-  stage.labels {
-    values = {
-      stream = null,
-    }
-  }
-}
-
-discovery.relabel "docker" {
-  targets = []
-
-  // Strip leading / from container name.
-  rule {
-    source_labels = ["__meta_docker_container_name"]
-    regex         = "/(.*)"
-    target_label  = "container_name"
-  }
-  // Compose service name (if label is set).
-  rule {
-    source_labels = ["__meta_docker_container_label_com_docker_compose_service"]
-    target_label  = "compose_service"
-  }
-  // Log stream (stdout/stderr).
-  rule {
-    source_labels = ["__meta_docker_container_log_stream"]
-    target_label  = "stream"
-  }
-  // Mark the source so dashboards/alerts can distinguish the docker host.
-  rule {
-    target_label = "source"
-    replacement  = "docker-host"
-  }
-}
-
-loki.source.docker "docker" {
-  host             = "unix:///var/run/docker.sock"
-  targets          = discovery.docker.docker.targets
-  forward_to       = [loki.process.docker.receiver]
-  relabel_rules    = discovery.relabel.docker.rules
-  refresh_interval = "5s"
-}
-
-loki.write "default" {
-  endpoint {
-    url = "http://loki-internal.lan/loki/api/v1/push"
-  }
-  external_labels = {}
-}

docker/infrastructure/observability/docker-compose.yml

@@ -1,81 +0,0 @@
-# Docker-host collectors for the central observability stack on Kubernetes.
-# Managed by swarm-cd (see .swarmcd/stacks.yaml).
-#
-# node-exporter + cAdvisor run locally (scraped by vmagent below).
-# vmagent remote_writes metrics to vm-internal.lan (LAN-only Traefik Ingress) ->
-#   vmsingle-vm-victoria-metrics-k8s-stack.observability.svc.cluster.local:8428
-# alloy tails /var/lib/docker/containers + /var/log and pushes logs to
-#   loki-internal.lan -> loki.observability.svc.cluster.local:3100
-
-services:
-  node-exporter:
-    image: prom/node-exporter:v1.12.1
-    container_name: obs-node-exporter
-    network_mode: host
-    pid: host
-    command:
-      - "--path.rootfs=/host"
-    volumes:
-      - /:/host:ro,rslave
-    restart: unless-stopped
-    labels:
-      - "traefik.enable=false"
-
-  cadvisor:
-    image: gcr.io/cadvisor/cadvisor:v0.55.1
-    container_name: obs-cadvisor
-    ports:
-      - "8080"
-    volumes:
-      - /:/rootfs:ro
-      - /var/run:/var/run:ro
-      - /sys:/sys:ro
-      - /dev/disk/:/dev/disk:ro
-      - /var/lib/docker/:/var/lib/docker:ro
-    restart: unless-stopped
-    labels:
-      - "traefik.enable=false"
-
-  vmagent:
-    image: victoriametrics/vmagent:v1.149.0
-    container_name: obs-vmagent
-    # vmagent listens on 8429 (its own metrics), scrapes node-exporter:9100
-    # and cadvisor:8080, remote_writes to vm-internal.lan
-    command:
-      - "-promscrape.config=/etc/vmagent/vmagent.yml"
-      - "-remoteWrite.url=http://vm-internal.lan/api/v1/write"
-    volumes:
-      - type: bind
-        source: /root/homeprod/docker/infrastructure/observability/vmagent.yml
-        target: /etc/vmagent/vmagent.yml
-        read_only: true
-    depends_on:
-      - node-exporter
-      - cadvisor
-    restart: unless-stopped
-    labels:
-      - "traefik.enable=false"
-
-  alloy:
-    image: grafana/alloy:v1.18.0
-    container_name: obs-alloy
-    command:
-      - "run"
-      - "/etc/alloy/config.river"
-      - "--server.http.listen-addr=0.0.0.0:12345"
-    volumes:
-      - type: bind
-        source: /root/homeprod/docker/infrastructure/observability/alloy.river
-        target: /etc/alloy/config.river
-        read_only: true
-      - /var/lib/docker/containers:/var/lib/docker/containers:ro
-      - /var/log:/var/log:ro
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-    restart: unless-stopped
-    labels:
-      - "traefik.enable=false"
-
-networks:
-  default:
-    name: proxy
-    external: true

docker/infrastructure/observability/vmagent.yml

@@ -1,22 +0,0 @@
-# vmagent scrape config for the docker host.
-# Scrapes the two local collectors, forwards everything to the central
-# VictoriaMetrics via the LAN-only Caddy route vm-internal.lan (Caddy proxies
-# it to vmsingle-vm-victoria-metrics-k8s-stack.observability.svc.cluster.local:8428).
-
-scrape_configs:
-  - job_name: docker-host-node
-    static_configs:
-      - targets:
-          - localhost:9100
-        labels:
-          # Distinguishes the docker host from K8s nodes in dashboards/alerts.
-          instance_source: docker-host
-          host: docker-r740
-
-  - job_name: docker-host-cadvisor
-    static_configs:
-      - targets:
-          - localhost:8080
-        labels:
-          instance_source: docker-host
-          host: docker-r740

docker/infrastructure/sshportal/docker-compose.yml

@@ -0,0 +1,11 @@
+services:
+  sshportal:
+    image: moul/sshportal
+    container_name: sshportal
+    ports:
+      - "2222:2222"
+    volumes:
+      - "data:/root/"
+
+volumes:
+  data:

docker/personal/fireshare/docker-compose.yml

@@ -1,7 +1,7 @@
 services:
   fireshare:
     container_name: fireshare
-    image: shaneisrael/fireshare:1.7.4-lite
+    image: shaneisrael/fireshare:1.7.1-lite
     ports:
       - "80"
     volumes:

docker/personal/gramps/docker-compose.yml

@@ -1,7 +1,7 @@
 services:
   grampsweb:
     container_name: grampsweb
-    image: ghcr.io/gramps-project/grampsweb:26.7.1
+    image: ghcr.io/gramps-project/grampsweb:26.6.2
     restart: always
     networks:
       - default
@@ -31,7 +31,7 @@ services:
 
   grampsweb_celery:
     container_name: grampsweb_celery
-    image: ghcr.io/gramps-project/grampsweb:26.7.1
+    image: ghcr.io/gramps-project/grampsweb:26.6.2
     restart: always
     environment:
       - GRAMPSWEB_TREE="Gramps Web"  # will create a new tree if not exists
@@ -52,7 +52,7 @@ services:
     command: celery -A gramps_webapi.celery worker --loglevel=INFO --concurrency=2
 
   grampsweb_redis:
-    image: docker.io/library/redis:8.10.0-alpine
+    image: docker.io/library/redis:8.8.0-alpine
     container_name: grampsweb_redis
     restart: always
 

docker/personal/media/films-series/jackett/docker-compose.yml

@@ -1,7 +1,7 @@
 services:
   jackett:
     container_name: jackett
-    image: ghcr.io/hotio/jackett:release-v0.24.2335
+    image: ghcr.io/hotio/jackett:release-v0.24.2110
     ports:
       - "9117"
     networks:

docker/personal/media/films-series/jellyfin/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   jellyfin:
-    image: jellyfin/jellyfin:2026080308
+    image: jellyfin/jellyfin:2026062206
     container_name: jellyfin
     networks:
       - default

docker/personal/media/films-series/radarr/docker-compose.yml

@@ -1,7 +1,7 @@
 services:
   radarr:
     container_name: radarr
-    image: ghcr.io/hotio/radarr:release-6.3.0.10514
+    image: ghcr.io/hotio/radarr:release-6.2.1.10461
     ports:
       - "7878"
     networks:

docker/personal/media/films-series/sonarr/docker-compose.yml

@@ -1,7 +1,7 @@
 services:
   sonarr:
     container_name: sonarr
-    image: ghcr.io/hotio/sonarr:release-4.0.19.2979
+    image: ghcr.io/hotio/sonarr:release-4.0.17.2952
     ports:
       - "8989"
     networks:

docker/personal/media/films-series/wizarr/docker-compose.yml

@@ -1,7 +1,7 @@
 services:
   wizarr:
     container_name: wizarr
-    image: ghcr.io/wizarrrr/wizarr:v2026.7.1
+    image: ghcr.io/wizarrrr/wizarr:v2026.4.0
     networks:
       - default
       - proxy

docker/personal/media/music/navidrome/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   navidrome:
-    image: deluan/navidrome:0.63.2
+    image: deluan/navidrome:0.62.0
     user: 1000:1000 # should be owner of volumes
     ports:
       - "4533"

docker/personal/media/youtube/tubearchivist/docker-compose.yml

@@ -31,7 +31,7 @@ services:
       - archivist-redis
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.tubearchivist.rule=Host(`tubearchivist.lan`)"
+      - "traefik.http.routers.tubearchivist.rule=Host(`tubearchivist.local`)"
       - "traefik.http.routers.tubearchivist.middlewares=tubearchivist-headers"
       - "traefik.http.middlewares.tubearchivist-headers.headers.accesscontrolalloworiginlist=*"
       - "traefik.http.middlewares.tubearchivist-headers.headers.accesscontrolallowmethods=GET,OPTIONS,PUT"

docker/personal/paperless/.env

@@ -0,0 +1,16 @@
+PAPERLESS_URL=ENC[AES256_GCM,data:5Vt6SqefNzOKGzUaRukM7wKu7Nw=,iv:/x12Sv55XY1znKr2UFQB1Scp+T1cZBs5XlqxTNtBQck=,tag:xahglGfuW2wCkDMgX1nZGA==,type:str]
+PAPERLESS_SECRET_KEY=ENC[AES256_GCM,data:CoWplCZsHbgFPkkBDnzaPnXcq9Fv4OpXuJHs0YTLDi+MmJjK4Lpd+Q==,iv:vX3uYJ0S6lSyHW3comqum5ncXUHFj7LCdNSbRRgY3/M=,tag:gwSwk1lVmoQdgqQ38sFN0A==,type:str]
+PAPERLESS_TIME_ZONE=ENC[AES256_GCM,data:sDtE4GwXr9CScxyq,iv:7oGDO/5Dvj8/E4qzzIhncbboTRfJbTfT/FwUhF4tCNg=,tag:mEcg/i2TaCls+FgCTl6AlA==,type:str]
+PAPERLESS_OCR_LANGUAGE=ENC[AES256_GCM,data:ihFV,iv:+xRvsrymSIB4z5K03bU6N+pugafhvHph3epj1HTDPag=,tag:RhBA2b1q3jIhE9bmcwtYxQ==,type:str]
+PAPERLESS_OCR_LANGUAGES=ENC[AES256_GCM,data:0pbc/9WMlw==,iv:HRnX25U1CasIvdU0h0G0SYvRjzzpmyPpDrcN6sAk+Ck=,tag:Ym08zaK+LqSDEafnUVvGnQ==,type:str]
+PAPERLESS_OCR_USER_ARGS=ENC[AES256_GCM,data:DdpIIK0k5wsJWhcVNtq6w1mK2nsBlXKs/bB3kCxUe9tj7tyff2yH,iv:htcBkWENiugF1T2N0JfJOGfn2F15Ti6icf6JnzmLNjQ=,tag:EACbCMn4aZ7zCWxd1voawA==,type:str]
+PAPERLESS_SOCIALACCOUNT_PROVIDERS=ENC[AES256_GCM,data:vLWinFKXotVzhHqmwpJ6R93Ep44JL7D1P91DbbLcGawfl8Hx+cTtYX2zuBAzeqrlDd+pHVX9I/F/eq3sAFUJrHhwSiscPaw4lc0KWVj3yAbR6guu3ZGKLMZiltGi8adOt+ELvL4aJYNfsdcECaj71JXaqF08+DkLuG6k3BOp/5j+BRFTuAfyS8SXgSo9UTpfNqJWLA2YyNiEy1ht9sbNJYT5FbN9++ZFlJPVmJDyo/8kU2CdkowmLuFhij2hcCt/wvhQ5kjYIzr+LCuPGtF68CVChVguXxTj7w5Mqo9bkdIIUtjzubhbP7LiERE5vQdLve75ZE4mQFt/5H01qwqZkXw7DFn4sJXKQCpCyA+IanA1NO2ypd1plYiR8F+15LNtbfPuZo5hzpYdf3y1xgPrSHUMV0AvAbvJYXyDg2UprpGzxSwLmskZc+4Dqm8ZfTp8IdC9RvETets6fA6t1ucnYFbEB4t0RfF1wzI93m5acE0XvDe7PvnW9X10XDwAhKV6EY9V7OktiL1/swO7MxI5qV6NtxXMMg46V6l/63k5GDmM0FS4Sn9BeIQ=,iv:JwSeogftyoa4k0kQAf63nnoqbIiHWH0Iwa83Nhqlx9Y=,tag:9KrbSxSmN1CzqnVxcsvPgw==,type:str]
+POSTGRES_USER=ENC[AES256_GCM,data:2IkvrQgFYj0v,iv:YxKokHIOsRhgRx2XZsCYsjtJwW0yOx+S5HKKiFQBKlY=,tag:HI4aSRYp7GotOXeF8VBHQw==,type:str]
+POSTGRES_PASSWORD=ENC[AES256_GCM,data:8IiqLOi+Xoln,iv:9zLPLvSe+7FjjunVQvcn5YiejZj0wN1mQu++B2JPy9o=,tag:HRIHXlmYTPCSaZ5BzPA/aQ==,type:str]
+sops_lastmodified=2025-10-08T19:39:41Z
+sops_mac=ENC[AES256_GCM,data:bjQBttibD3m6mjiDtQ/RqfSc0rt3eV/ip+UUzwF45k/+akQCM+kAvSVFiICpRYLQd90hGDSJJytGze0YQBIYS58u/PXovqT+BmbJ5S9jEVwDUnAnFwoVmuGI6dkorCGgLZFxbj/Vwde5v2R3K7nMTyPC/5EJPd4R9gZLgT8/+Bw=,iv:tyyjQXpBEDb+KOEFRNPxUIcEcxYAM+qw2pCyvOltuFE=,tag:xPfaZTAi1Sd0RW5PN0iKog==,type:str]
+sops_pgp__list_0__map_created_at=2025-10-08T19:39:41Z
+sops_pgp__list_0__map_enc=-----BEGIN PGP MESSAGE-----\n\nhQIMA7uy4qQr71wiAQ//WBbj9C5n7tOL8HBWRiiwRHS8nE3XWg7rAROnvEaD5QuE\nEubGw+PnsX3nSiv07Th23dN24IqpgLqz9grq1s6WDgRgQAFqu2f2FTYmIvcU/mko\n9I69i1E8iSYIvfRmReOn3L2GlhQrADYbCYC+mMEAXJtTuJ44KP0JtGTFPP0+m4vb\nspuuebFeES8cVsk2RPuRUQJC6uSk0E78ZaxMWgZm6P/6bnRwDbn4OE3NrQbkvhvn\nKupR01MQ7HAZh5jVi73aVnY0wfxe4fDToef1bjiiZUJEwJ57oKhOmj5EYlTurX0m\nzraNkpDIWQNJnVlMgUEOclmrnL0uz3wkaqu8BoUkyaWAJS2f545amJNUBO23Mogp\ng9VgFeOyivM0xx5JZAN2LRkK5CrpKNpjXYtFzGkxKZxAAs4iyrUGDecJtfZJM48M\ntvgzbL4jqJu6rrOH27e3F74HyEmX+f1sIJMSnvanEiyYxIpdbvMc8+ULtGzpsdUd\n4hQ/yYKqEkecyKwjPEN4OlAI2LdokTxeYOszjJ7iBO1jE2D7e3hgzpjsGZmj1i+J\nzTUGUSAEgfd2w+/xfYzWttMysthrGa0MMwEeKYttuoZjIJ04IDB6JBQWNWxbfGpp\nXlNd5G2+xrGl2oaYzc4fAJRZoQZRWgX1Dy78cvRm8OIUGJucz0cZeBPiI3/Ny5/S\nXgFC/aC1TJBNvFC/60oOrerjzf5LVrx6O3zevs7LCrVVq0iL/xSSU+DnTxdczKPt\nKh9x1LMKUQK5cnMOdoWt78uUNmLkKiSkht43ozLcqvb3cxgRyoSlMP2lvk9YWx4=\n=gnXz\n-----END PGP MESSAGE-----
+sops_pgp__list_0__map_fp=DC6910268E657FF70BA7EC289974494E76938DDC
+sops_unencrypted_suffix=_unencrypted
+sops_version=3.10.2

docker/personal/paperless/docker-compose.yml

@@ -0,0 +1,86 @@
+services:
+  pplessbroker:
+    image: docker.io/library/redis:8
+    restart: unless-stopped
+    volumes:
+      - redisdata:/data
+
+  pplessdb:
+    image: docker.io/library/postgres:16
+    restart: unless-stopped
+    volumes:
+      - pgdata:/var/lib/postgresql/data
+    env_file:
+      - .env
+    environment:
+      POSTGRES_DB: paperless
+
+  paperless-webserver:
+    image: ghcr.io/paperless-ngx/paperless-ngx:2.20.15
+    restart: unless-stopped
+    networks:
+      - default
+      - proxy
+    depends_on:
+      - pplessdb
+      - pplessbroker
+    ports:
+      - "8000"
+    volumes:
+      - data:/usr/src/paperless/data
+      - media:/usr/src/paperless/media
+      - export:/usr/src/paperless/export
+      - consume:/usr/src/paperless/consume
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.paperless-webserver.rule=Host(`paperless.lan`)"
+    env_file: .env
+    environment:
+      PAPERLESS_REDIS: redis://pplessbroker:6379
+      PAPERLESS_DBHOST: pplessdb
+      PAPERLESS_APPS: allauth.socialaccount.providers.openid_connect
+      PAPERLESS_ACCOUNT_DEFAULT_HTTP_PROTOCOL: http
+
+volumes:
+  data:
+    driver: local
+    driver_opts:
+      type: 'none'
+      o: 'bind'
+      device: '/app/paperless/data'
+  media:
+    driver: local
+    driver_opts:
+      type: 'none'
+      o: 'bind'
+      device: '/app/paperless/media'
+  pgdata:
+    driver: local
+    driver_opts:
+      type: 'none'
+      o: 'bind'
+      device: '/app/paperless/db'
+  redisdata:
+    driver: local
+    driver_opts:
+      type: 'none'
+      o: 'bind'
+      device: '/app/paperless/redis'
+
+  export:
+    driver: local
+    driver_opts:
+      type: 'none'
+      o: 'bind'
+      device: '/app/paperless/export'
+  consume:
+    driver: local
+    driver_opts:
+      type: 'none'
+      o: 'bind'
+      device: '/app/paperless/consume'
+
+networks:
+  proxy:
+    external: true
+    name: proxy

docker/personal/radicale/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   radicale:
-    image: tomsquest/docker-radicale:3.7.6.0
+    image: tomsquest/docker-radicale:3.7.5.0
     container_name: radicale
     ports:
       - 5232

docker/personal/tandoor/docker-compose.yml

@@ -9,7 +9,7 @@ services:
 
   web_recipes:
     restart: always
-    image: vabene1111/recipes:2.6.13
+    image: vabene1111/recipes:2.6.11
     networks:
       - default
       - proxy

docker/production/buildpath/.env

@@ -0,0 +1,18 @@
+ME_CONFIG_MONGODB_ADMINUSERNAME=ENC[AES256_GCM,data:AHXIMA==,iv:trofFagJGNq5OyWDaN57vPpKwwG3SouiV5xLl5sJIBA=,tag:c1NUlmBouEb0Milri85QNw==,type:str]
+ME_CONFIG_MONGODB_ADMINPASSWORD=ENC[AES256_GCM,data:8X6+SphUNus=,iv:zwofVw03pToXHR6weckniT/fymFYeHZw6lVmrGUsnLc=,tag:lEWtnnqpwamNsCnkStsRfQ==,type:str]
+ME_CONFIG_MONGODB_URL=ENC[AES256_GCM,data:3xLFWhRYU/EfhRw+rOs9pOb+nzsbV9IvQydB4VGZGw/WLkQd,iv:T9T6ewB+05qzFDL7z2WESs6fIc9lTFdjVxy/71YzhXo=,tag:S3YsOokO4jzhJVWep/QTsQ==,type:str]
+ME_CONFIG_BASICAUTH=ENC[AES256_GCM,data:FnUichsnpQ==,iv:Ayw1Vqg5rj6P79vtERX2hRCttnol/4aNUG5Y0OhFVTo=,tag:JkTxro0kyYJLr9gdkY8A1Q==,type:str]
+MONGO_USER=ENC[AES256_GCM,data:2KFDcg==,iv:wdDxrQd07+hC5GEq1DS0DLVASiL9L4ds1V3TG1NA9EQ=,tag:gieiOLmOfLtUQjfjwZg6qQ==,type:str]
+MONGO_PASS=ENC[AES256_GCM,data:W80YLzp8G50=,iv:eFts3fhrB9PGEfC69d8btt4ko3gcOGrFZUy95hx2rCE=,tag:+1JFEiclNnjei8+2I42j6w==,type:str]
+MONGO_HOST=ENC[AES256_GCM,data:0RknYUM=,iv:8QyL4KHrSr9pv1kX+FD09N2ltVSZkEKqtFCS30ik1v0=,tag:bTXBMHqp5JU9VTD3soXEyQ==,type:str]
+MONGO_INITDB_ROOT_USERNAME=ENC[AES256_GCM,data:G6wekw==,iv:AH5qqxXOeEBVI2mXXPPrC1X8X/Vq5MHZBWdfNRNeK1c=,tag:nMkWql/aVHi2FGnJ5NGFBQ==,type:str]
+MONGO_INITDB_ROOT_PASSWORD=ENC[AES256_GCM,data:jzVSUjGSjOY=,iv:S/Ar0oYN2vSE7pK+/tfp9RyCThtDbk0gOUYDyzNYjVE=,tag:whWyBFHuXBcmF+WixjafOw==,type:str]
+RIOT_API_KEY=ENC[AES256_GCM,data:EzqWk1Y73htAXaUJhzByV6Aru/hxUNjHGK90ac1NGaz92Cwk9YEdmrb9,iv:KorIppEflVX2aDC8K3ndRzK1q6scNjdQfl38p/8fLGM=,tag:Ei2zLoiGOlOX8ocrO2wNMw==,type:str]
+CDRAGON_CACHE_DIR=ENC[AES256_GCM,data:uMogP1/K/pc=,iv:/0A8fs9HEuksSiKV1SZDoslHHGlJe+vFw0BQ5zQ9BBA=,tag:grwWPwMQarpmSAUIgKDZ5Q==,type:str]
+sops_lastmodified=2026-04-30T18:20:37Z
+sops_mac=ENC[AES256_GCM,data:7teYIGLLHBH8TJ/gr3lcbtfo4CVl0Gj2RWPSLgx4AyTvM+pZaSvUDaVUhWuprSCVqZcDWI2tNHUOHE4aYlJzyt9JfQrooKLPkKUq3WX3bucg3Rv5GpiP1tNHiPDE7UZCBp5bkHhYvwn+dPjhObEUdMUuwMBDA9JSpPlr3YQCg/E=,iv:6knBO6QNe33E2bJw5WZMzcDzeTW9mwgjQtftv0FZq8s=,tag:xuIKZl7szrUyX8/D9xxAmA==,type:str]
+sops_pgp__list_0__map_created_at=2026-04-30T18:20:33Z
+sops_pgp__list_0__map_enc=-----BEGIN PGP MESSAGE-----\n\nhQIMA7uy4qQr71wiARAAufkTVdCq2ARwMFuec9+0N1BzTo7WgGQhzKIJehe+uQ5I\nuPS5bafo5vrvxlCuxVmhup45CS3gm3X46hgHh/d3htaYzDnbyh/awbVGIhU9sa9T\n74i4jZAabzWjWAU8lAvxS6dJ6hf5U3MHOc1zYoCUfCJjgw+QRzR5PxZKFhpVklQU\nQJycdfRAl5oAqF7N6B7oCNTs7w1hbx2CJXBVGM8YoJySkThpXEY3dECxZ5nTSPmp\nXo3hmidO09uYsjWzcqynJHnh9RkMd1VAe6ULzhVIOv5KLXQLQV/paNAPdsxA5UmY\nE1imIFrqS25BVU9xbsGaPj6AHX6+Ux8bpO8TOVbpULe56Aq2c5GOjIZXb3p20K7N\nEk5rJ/K+8FxvytK3jDkhJI49wiDs9UDim02DSZmsWirIy/c02Ojy2d/Cxors1Lw/\nBCc4S6/ESH9u/LGlWs8WDqcDQqhHgeCvGOLAvOXs9eOCXNW2ROtNdfW808APbu1A\nzgYJwPtdfBhUv4KhZcEVMldWgX1OiYhcWMWYgJUXcfOwaRbzntZ/MczPNJ/a+57T\nPvH9GuTiwCXn0fOgcETTp9RPvXflL+4LPgh9drCOo4zwMvlqZs2+0Os2m8GDdDcL\nD45VMTsnNUXWuO7YUdtYX47bON2W6Z7NwzvkSr5odogzq1xw38SgRN7g3Jbl6+fS\nXAH/Rw8jWjpYztZ5HgDXisTxLEXqn5UNYKZBjzsLV5tE9GQp8ppck21igBiDCqoT\nsziZwFyRy/nKq076lZlRgSFr0pm4168u7Vn5x1TLQBHl+i0eKficgUQpwCFx\n=XUsx\n-----END PGP MESSAGE-----
+sops_pgp__list_0__map_fp=DC6910268E657FF70BA7EC289974494E76938DDC
+sops_unencrypted_suffix=_unencrypted
+sops_version=3.10.2

docker/production/buildpath/docker-compose.yml

@@ -0,0 +1,57 @@
+services:
+  mongo:
+    hostname: mongo
+    image: mongo:8.2.11
+    restart: always
+    user: root:root
+    command: mongod --wiredTigerCacheSizeGB 2
+    deploy:
+      resources:
+        limits:
+          memory: 6G
+        reservations:
+          memory: 3G
+    volumes:
+      - bpmongo_data:/data/db:Z
+      - bpmongo_config:/data/configdb:Z
+    env_file: .env
+
+  match_collector:
+    image: git.vhaudiquet.fr/vhaudiquet/lolstats-match_collector:d878af6d1a5cb633175515259e27a12c76c4609b
+    build: ./match_collector
+    volumes:
+      - bpcdragon_cache:/cdragon
+    restart: "no"
+    deploy:
+      restart_policy:
+        condition: any
+        delay: '0'
+        window: 20s
+    env_file: .env
+
+  frontend:
+    image: git.vhaudiquet.fr/vhaudiquet/lolstats-frontend:d878af6d1a5cb633175515259e27a12c76c4609b
+    build: ./frontend
+    restart: always
+    volumes:
+      - bpcdragon_cache:/cdragon
+    networks:
+      - default
+      - proxy
+    ports:
+      - "3000"
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.frontend.rule=Host(`buildpath.win`)"
+      - "traefik.http.services.frontend.loadbalancer.server.port=3000"
+    env_file: .env
+
+volumes:
+  bpmongo_data:
+  bpmongo_config:
+  bpcdragon_cache:
+
+networks:
+  proxy:
+    external: true
+    name: proxy

docker/production/semeryfr/docker-compose.yml

@@ -0,0 +1,20 @@
+services:
+  semeryfr:
+    container_name: semeryfr
+    image: git.vhaudiquet.fr/semerys/semery.fr:latest
+    networks:
+      - default
+      - proxy
+    ports:
+      - 80
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.semeryfr.rule=Host(`semery.fr`)"
+    environment:
+      - NGINX_HOST=semery.fr
+      - NGINX_PORT=80
+
+networks:
+  proxy:
+    external: true
+    name: proxy

docker/tools/obsidian-livesync/.env

@@ -0,0 +1,9 @@
+COUCHDB_USER=ENC[AES256_GCM,data:wMQJhlZFW30=,iv:OG3S+hZppJdP/PjDINGEEQZD8Qf4520mfzsyw+/QAx4=,tag:i1og4xc0N4Hf4UE0GKPtbg==,type:str]
+COUCHDB_PASSWORD=ENC[AES256_GCM,data:eud7WTnlZEzzBGciiwM=,iv:g8RCLIcO1ZxUn/SROHV/stl+whdzICMSX0jVLKXbTns=,tag:6gReHLd+97dqUoAlYL780Q==,type:str]
+sops_lastmodified=2025-11-21T23:00:14Z
+sops_mac=ENC[AES256_GCM,data:O+jtG9ojK8Md6NSaqfyykVdVG84Kafz3zoKb5hbj2alzvJgaLuzVu3ihM75ZU3/meu/nPl9wCc+J4RKepE7VTp5Il3HK09MVHYRHQKVlbyiZ5cTbU74JJuSL3PF1GiU7p/U5Ht9+Z9c8sDrqSN2IPSIfDr8zCdTwKZF71nYOqew=,iv:n33XCpiwVOGnrJyH3Q967u5uMknRfAwx9esJuOLl+9g=,tag:aKMwsOKXPRUaa+9/ZmnpfQ==,type:str]
+sops_pgp__list_0__map_created_at=2025-11-21T23:00:14Z
+sops_pgp__list_0__map_enc=-----BEGIN PGP MESSAGE-----\n\nhQIMA7uy4qQr71wiAQ/+Mt0/uXHnndDK7FLEM8rhWmX0NpJWtgBY3BBXMX7I2Ilg\n6hNZJxISOqcoJCPqb8gZ9pUulcGC5F8owoo/wUILyI/mK3kAzGCP+lfp6Dk03k+P\nwB6BcQTC8NJsApoygdm50h/jtnlK2KUCICFKXUxf527KLWdo8g0wnMIOBe8mBvVC\n8bI/1BOcJZeB4IhmFVrgED+Ct1dTTiuyLscJirCqHD0VTD4eavd6DVpN89m/mtY/\nhTRVT3omuV8JITLeWPdVVWyQznrq3/x8OGAs8L2c24gad5AsTLCr2WS20CvXP1uL\nUoLH9EH0IDvo36DbiMO+p3LdyEvlRe1PW+0dvOpO64CLNoH4szYDJ/dG+UUa3xWo\nRpOIT1F0puXRz3UHZv/IkAFah4Zzi8TxdZDD7Riz5pzMWqzWwdQHQUS1ZWibm1ve\nfC7strrMNybh+QUfMTXhTaW4OoRkY+rGo3d2x3eUjZpaqlKOBWaScZ0c1I7DY/CP\no4QoCoga1RNePXp/WWvWAbQf0w+hAxrsb6U3/ECKtcd4gYGE3shvH0MS6T4oAaIx\nB9ldqRbKIcEUYU7MWq3Wqt8c1k/MtJZh1q3YuZwy8C3U8cHiS5iqDWzAnjIkUwbC\nJpYVaIOvI0qOjE7v6Fc06ZnTBoh/DoTX4XfdIY39GMo3ZageBV0r7Fi0HUzbFxvS\nXAHnsiZZXFB/TJAVEZKDO0Yic3DhlYLL/glOJF0kNgUOoYGvTFaSuNhwhv4tqOrw\nSv7FLH+79LSrM/bPug3Zq9Ec7p/TSnsJ4amu6p7VSmSHRBGV0uZDxt5wkYnG\n=yY4C\n-----END PGP MESSAGE-----
+sops_pgp__list_0__map_fp=DC6910268E657FF70BA7EC289974494E76938DDC
+sops_unencrypted_suffix=_unencrypted
+sops_version=3.10.2

docker/tools/obsidian-livesync/docker-compose.yml

@@ -0,0 +1,44 @@
+services:
+  couchdb:
+    image: couchdb:3.5.2
+    container_name: couchdb
+    env_file: .env
+    volumes:
+      - couchdb-data:/opt/couchdb/data
+      - couchdb-etc:/opt/couchdb/etc/local.d
+    networks:
+      - default
+      - proxy
+    ports:
+      - 5984
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.couchdb.rule=Host(`obsidian-livesync.lan`)"
+      - "traefik.http.services.couchdb.loadbalancer.server.port=5984"
+      - "traefik.http.routers.obsidian-livesync.middlewares=obsidiancors"
+      - "traefik.http.middlewares.obsidiancors.headers.accesscontrolallowmethods=GET,PUT,POST,HEAD,DELETE"
+      - "traefik.http.middlewares.obsidiancors.headers.accesscontrolallowheaders=accept,authorization,content-type,origin,referer"
+      - "traefik.http.middlewares.obsidiancors.headers.accesscontrolalloworiginlist=app://obsidian.md,capacitor://localhost,http://localhost"
+      - "traefik.http.middlewares.obsidiancors.headers.accesscontrolmaxage=3600"
+      - "traefik.http.middlewares.obsidiancors.headers.addvaryheader=true"
+      - "traefik.http.middlewares.obsidiancors.headers.accessControlAllowCredentials=true"
+    restart: unless-stopped
+
+networks:
+  proxy:
+    external: true
+    name: proxy
+
+volumes:
+  couchdb-data:
+    driver: local
+    driver_opts:
+      type: 'none'
+      o: 'bind'
+      device: '/app/obsidian-livesync/data'
+  couchdb-etc:
+    driver: local
+    driver_opts:
+      type: 'none'
+      o: 'bind'
+      device: '/app/obsidian-livesync/etc'

generate-dependabot.sh

@@ -0,0 +1,58 @@
+#!/bin/bash
+
+# Create .github directory if needed
+if [ ! -d .github ]; then
+    mkdir -p .github
+fi
+
+tmpfile=$(mktemp)
+
+# Make sure to cleanup our temp file on any kind of exit
+trap 'rm -f "$tmpfile"' EXIT
+
+# dependabot.yml docker header
+cat > "$tmpfile" <<'YAML'
+version: 2
+updates:
+  - package-ecosystem: "docker-compose"
+    open-pull-requests-limit: 15
+    schedule:
+      interval: weekly
+    directories:
+YAML
+
+# Find and sort all docker-compose.yml directories
+find docker -name 'docker-compose.yml' -print0 \
+  | xargs -0 -n1 dirname \
+  | sed 's|^\./||' \
+  | sort \
+  | while read -r dir; do
+      echo "      - \"/$dir\"" >> "$tmpfile"
+    done
+  
+# dependabot.yml helm header
+cat >> "$tmpfile" <<'YAML'
+  - package-ecosystem: "helm"
+    open-pull-requests-limit: 15
+    schedule:
+      interval: weekly
+    directories:
+YAML
+
+# Find and sort all release.yaml directories
+find kubernetes -name 'release.yaml' -print0 \
+  | xargs -0 -n1 dirname \
+  | sed 's|^\./||' \
+  | sort \
+  | while read -r dir; do
+      echo "      - \"/$dir\"" >> "$tmpfile"
+    done
+
+# Overwrite file on change
+if ! [ -f .github/dependabot.yml ] || ! cmp -s "$tmpfile" .github/dependabot.yml; then
+  mv "$tmpfile" .github/dependabot.yml
+  echo "Updated .github/dependabot.yml!"
+  git add ".github/dependabot.yml"
+else
+  echo "No changes to .github/dependabot.yml."
+fi

infra/kube/.gitignore

@@ -1,3 +0,0 @@
-clusterconfig/
-manifests/cilium.yaml
-talconfig.json

infra/kube/manifests/cilium/values.yaml

@@ -1,73 +0,0 @@
-ipam:
-    mode: kubernetes
-kubeProxyReplacement: true
-securityContext:
-    capabilities:
-        ciliumAgent:
-            - CHOWN
-            - KILL
-            - NET_ADMIN
-            - NET_RAW
-            - IPC_LOCK
-            - SYS_ADMIN
-            - SYS_RESOURCE
-            - DAC_OVERRIDE
-            - FOWNER
-            - SETGID
-            - SETUID
-        cleanCiliumState:
-            - NET_ADMIN
-            - SYS_ADMIN
-            - SYS_RESOURCE
-cgroup:
-    autoMount:
-        enabled: false
-    hostRoot: /sys/fs/cgroup
-k8sServiceHost: localhost
-k8sServicePort: 7445
-etcd:
-    clusterDomain: cluster.local
-l2announcements:
-    enabled: true
-externalIPs:
-    enabled: true
-# Single-node cluster: the operator defaults to 2 replicas, but both
-# bind the same host ports, so the second replica can never schedule ("node(s)
-# didn't have free ports for the requested pod ports") and sits Pending forever.
-operator:
-    replicas: 1
-ingressController:
-    enabled: false
-    loadbalancerMode: shared
-    default: false
-    service:
-        externalTrafficPolicy: Cluster
-envoy:
-    xffNumTrustedHopsL7PolicyIngress: 1
-sops:
-    lastmodified: "2026-08-26T19:28:03Z"
-    mac: ENC[AES256_GCM,data:2aioHoSXw5UOFKj5z5PJmtPC4rGl9DYY0gWgevHIxXbKdjLrTfyyoRfBPCl3+NPWAZllieMr4VKsGy53YUqq5xFgRg0BaqG+gqMFX/YjHPqhF0/WT0YI3GdTWhl/YY0wma+CEN0kE5SsljpKh7vBgY8l2WlFhpMdlbAKEeyONRs=,iv:EY7Vdlj/VpqY34KmrVUSQutLiD8DEAB0OqIXnN40ERA=,tag:XOZNdUoeWAV4cD111ciBzw==,type:str]
-    pgp:
-        - created_at: "2026-08-26T19:28:02Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiARAAp9OoebtSeHrGp/3bQz93JMbp78C9xnHuumz7exhd9Ky6
-            zrJUm+bL8tNMWTL72Q+GUTCo7lEVltYciXZZVYSvD3Uee8stAeOdhCrY6jsH2IxZ
-            yCVZktlnsAbsPDwmEt+/HRoiqwy4hkbIx99J5W18cJD4eSw8MlJYjDVfSh2UWGIi
-            rd+7ameKbHR8PCduWu1T5SY0EFWaVr3WJDW//lD/FUT1KXJDrB0ExVtsuL0l8GgW
-            ue+noYGAn5l9PRgjgqTLSbHoQQDaMO9KalR+Gz6jmYpUdkJEuCT1amQiH+dE8i85
-            Rs0KXHWLnW59xY4pqdNzJzOysKEsM/oPes36JFvuIOIpB0KDSK/hcFKkYogk96Rw
-            VZ131NNOYMbKunORjmKfei7SWE975zzB/OFCWRDkAwGceqm+hdWaKhKV+rZlBSHR
-            ClbWTZt9+EEI3Er1f/J8qsfhvxJswWTDIOs7+I7YgbFgPAHMh/kcNU+xJJmWtDOq
-            Fq3uBi/oowR6mwTvUwswFFkuaDePcjHrvWaQLTzOw/wv5JU59nUTstSr+zMQzm4Y
-            ZTjKoz62hz5gntyjRFG58w7tyLR8D48CFPA6BFGLBkBpsykhyc42F4woCUqEg6YJ
-            5QBuCFsBXxjSeRHTLRyaWdI5BmppmLZ5axzdMVt0X+rXy/7LhGPY40bGuWBbsgPS
-            XgEL/HGgfFafvsfgJU5x71E4n+Ak7EPLCxin1uTW/CM0cJszT1/zdwIdQ+T5JDiY
-            JlZZTK9C49sF3OngtmRTtf1JesnOYdfhdOVCpDO9EgcUiF769X0JPhdFNemkOeY=
-            =8NLP
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
-    mac_only_encrypted: true
-    version: 3.10.2

infra/kube/reconcile.sh

@@ -1,55 +0,0 @@
-#!/bin/sh
-# Reconcile Talos cluster infrastructure
-# Environment needed:
-# - SOPS_KEY: sops private key
-set -euo pipefail
-
-if [ -z "${SOPS_KEY:-}" ]; then
-  echo "Error: SOPS_KEY environment variable is not set" >&2
-  exit 1
-fi
-
-# Render the Cilium chart for manifest deployment
-helm repo add cilium https://helm.cilium.io/
-helm repo update
-helm template cilium cilium/cilium \
-  --version 1.20.1 \
-  --namespace kube-system \
-  -f manifests/cilium/values.yaml \
-  > manifests/cilium.yaml
-
-# Escape shell variables that must be resolved at container runtime, not by talhelper.
-# talhelper expands ${VAR} statically; prefixing with $$ (i.e. $${VAR}) tells it to
-# preserve the literal ${VAR} in the output so bash can expand it inside the container.
-sed -i 's/\${BIN_PATH}/$${BIN_PATH}/g' manifests/cilium.yaml
-
-# Generate Talos machine config
-talhelper genconfig
-
-# Apply generated machine config to the nodes, without reboot.
-# If it fails, it is safer for reconcile to be done manually:
-# the reboot is needed and that might disrupt the node
-talhelper gencommand apply --extra-flags="-m no-reboot" | bash
-
-# Obtain kubeconfig and export it for kubectl
-talosctl --talosconfig ./clusterconfig/talosconfig kubeconfig -f ./clusterconfig/kubeconfig
-export KUBECONFIG=./clusterconfig/kubeconfig
-
-# Show nodes
-kubectl get nodes
-
-# Create Flux namespace if it does not already exists
-kubectl get ns "flux-system" || kubectl create ns "flux-system"
-
-# Create SOPS secret in the cluster
-kubectl create secret generic flux-sops \
-  --namespace "flux-system" \
-  --from-literal=sops.asc="$SOPS_KEY" \
-  --dry-run=client -o yaml | kubectl apply -f -
-
-# Install the Flux operator if not installed already
-kubectl get deployment -n flux-system flux-operator || helm install flux-operator oci://ghcr.io/controlplaneio-fluxcd/charts/flux-operator \
-  --namespace "flux-system" \
-  --wait
-
-kubectl apply -f manifests/flux-system/flux-instance.yaml

infra/kube/talconfig.yaml

@@ -1,46 +0,0 @@
----
-clusterName: kube
-talosVersion: v1.13.8
-kubernetesVersion: v1.36.0
-endpoint: https://10.2.2.138:6443
-domain: cluster.local
-allowSchedulingOnMasters: true
-clusterPodNets:
-  - 10.244.0.0/16
-clusterSvcNets:
-  - 10.96.0.0/12
-cniConfig:
-  name: none
-nodes:
-  - hostname: p330
-    ipAddress: 10.2.2.138
-    filenameTmpl: "{{.ClusterName}}-{{.Hostname}}.yaml"
-    extensionServices: []
-    controlPlane: true
-    machineSpec:
-      mode: metal
-      arch: amd64
-      secureboot: false
-      useUKI: false
-      bootMethod: iso
-    installDisk: /dev/nvme0n1
-    schematic:
-      customization:
-        systemExtensions:
-          officialExtensions:
-            - siderolabs/intel-ucode
-            - siderolabs/iscsi-tools
-    kernelModules:
-      - name: iscsi_tcp
-      - name: libiscsi
-      - name: scsi_transport_iscsi
-      - name: ext4
-      - name: ixgbe
-        parameters:
-          - allow_unsupported_sfp=1
-    networkInterfaces:
-      - interface: eno1
-        dhcp: true
-inlineManifests:
-  - name: cilium
-    contents: "@./manifests/cilium.yaml"

infra/r740/kube/main.tf

@@ -0,0 +1,314 @@
+terraform {
+  required_providers {
+    talos = {
+      source  = "siderolabs/talos"
+      version = "0.9.0"
+    }
+    kubernetes = {
+      source = "hashicorp/kubernetes"
+      version = "2.36.0"
+    }
+    helm = {
+      source = "hashicorp/helm"
+      version = "2.17.0"
+    }
+  }
+}
+
+# Talos configuration
+provider "talos" {}
+
+# Kubernetes configuration
+provider "kubernetes" {
+  config_path = "${path.module}/kubeconfig"
+}
+# Helm configuration
+provider "helm" {
+  kubernetes {
+    config_path = "${path.module}/kubeconfig"
+  }
+}
+
+resource "talos_machine_secrets" "kube" {}
+
+data "talos_machine_configuration" "kube" {
+  cluster_name = "kube-${var.physical_hostname}"
+  machine_type = "controlplane"
+  cluster_endpoint = "https://${var.kube_host}:6443"
+  machine_secrets = talos_machine_secrets.kube.machine_secrets
+  config_patches = [
+    yamlencode({
+      machine = {
+        install = {
+          image = "factory.talos.dev/installer/ce4c980550dd2ab1b17bbf2b08801c7eb59418eafe8f279833297925d67c7515:v1.11.5"
+        }
+        network = {
+          nameservers = [
+            # We need a set of nameservers that can work independently of kube
+            # to bootstrap. 
+            "10.1.2.148",
+            "1.1.1.1"
+          ]
+        }
+        certSANs = [
+          "${var.kube_host}", "${var.kube_hostname}"
+        ]
+      }
+      cluster = {
+        clusterName = "kube-${var.physical_hostname}"
+        allowSchedulingOnControlPlanes = true
+        apiServer = {
+          certSANs = [
+            "${var.kube_host}", "${var.kube_hostname}"
+          ]
+        }
+        network = {
+          dnsDomain = "cluster.local"
+          cni = {
+            name: "none"
+          }
+        }
+        proxy = {
+          disabled = true
+        }
+      }
+    })
+  ]
+}
+
+data "talos_client_configuration" "kube" {
+  cluster_name = "kube-${var.physical_hostname}"
+  client_configuration = talos_machine_secrets.kube.client_configuration
+  nodes = ["${var.kube_host}"]
+}
+
+resource "talos_machine_configuration_apply" "kube" {
+  client_configuration = talos_machine_secrets.kube.client_configuration
+  machine_configuration_input = data.talos_machine_configuration.kube.machine_configuration
+  node = var.kube_host
+  depends_on = [ talos_machine_secrets.kube ]
+}
+
+resource "talos_machine_bootstrap" "kube" {
+  node = var.kube_host
+  client_configuration = talos_machine_secrets.kube.client_configuration
+  depends_on = [ talos_machine_configuration_apply.kube, talos_machine_secrets.kube ]
+}
+
+resource "talos_cluster_kubeconfig" "kube" {
+  node = var.kube_host
+  depends_on = [ talos_machine_bootstrap.kube ]
+  client_configuration = talos_machine_secrets.kube.client_configuration
+}
+
+output "kubeconfig" {
+  sensitive = true
+  value = talos_cluster_kubeconfig.kube.kubeconfig_raw
+}
+
+resource "local_file" "kubeconfig" {
+    content     = "${talos_cluster_kubeconfig.kube.kubeconfig_raw}"
+    filename = "${path.module}/kubeconfig"
+    depends_on = [ talos_cluster_kubeconfig.kube ]
+}
+
+data "talos_client_configuration" "talosconfig" {
+  cluster_name = "kube-${var.physical_hostname}"
+  client_configuration = talos_machine_secrets.kube.client_configuration
+  nodes = [var.kube_host]
+}
+
+resource "local_file" "talosconfig" {
+    content     = "${data.talos_client_configuration.talosconfig.talos_config}"
+    filename = "${path.module}/talosconfig"
+    depends_on = [ data.talos_client_configuration.talosconfig ]
+}
+
+# TODO : Wait for talos_cluster_kubeconfig...
+resource "helm_release" "cilium" {
+  name = "cilium"
+  namespace = "kube-system"
+  repository = "https://helm.cilium.io/"
+  chart = "cilium"
+  wait = false
+  depends_on = [ local_file.kubeconfig, talos_cluster_kubeconfig.kube ]
+
+  set {
+    name = "ipam.mode"
+    value = "kubernetes"
+  }
+  set {
+    name = "kubeProxyReplacement"
+    value = true
+  }
+  set {
+    name = "securityContext.capabilities.ciliumAgent"
+    value = "{CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}"
+  }
+  set {
+    name = "securityContext.capabilities.cleanCiliumState"
+    value = "{NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}"
+  }
+  set {
+    name = "cgroup.autoMount.enabled"
+    value = false
+  }
+  set {
+    name = "cgroup.hostRoot"
+    value = "/sys/fs/cgroup"
+  }
+  set {
+    name = "k8sServiceHost"
+    value = "localhost"
+  }
+  set {
+    name = "k8sServicePort"
+    value = 7445
+  }
+  set {
+    name = "etcd.clusterDomain"
+    value = "cluster.local"
+  }
+  set {
+    name = "hubble.relay.enabled"
+    value = true
+  }
+  # Enable hubble ui
+  set {
+    name = "hubble.ui.enabled"
+    value = true
+  }
+  # Gateway API support
+  set {
+    name = "gatewayAPI.enabled"
+    value = true
+  }
+  set {
+    name = "gatewayAPI.enableAlpn"
+    value = true
+  }
+  set {
+    name = "gatewayAPI.enableAppProtocol"
+    value = true
+  }
+  # Gateway API trusted hops : for reverse proxy
+  set {
+    name = "gatewayAPI.xffNumTrustedHops"
+    value = 1
+  }
+  # Single-node cluster, so 1 operator only
+  set {
+    name = "operator.replicas"
+    value = 1
+  }
+  # L2 announcements
+  set {
+    name = "l2announcements.enabled"
+    value = true
+  }
+  set {
+    name = "externalIPs.enabled"
+    value = true
+  }
+  # Disable ingress controller (traefik will be used for now)
+  set {
+    name = "ingressController.enabled"
+    value = false
+  }
+  set {
+    name = "ingressController.loadbalancerMode"
+    value = "shared"
+  }
+  # Ingress controller for external : behind reverse proxy, trust 1 hop
+  set {
+    name = "envoy.xffNumTrustedHopsL7PolicyIngress"
+    value = 1
+  }
+  # Set cilium as default ingress controller
+  set {
+    name = "ingressController.default"
+    value = true
+  }
+  set {
+    name = "ingressController.service.externalTrafficPolicy"
+    value = "Local"
+  }
+}
+
+resource "kubernetes_namespace" "flux-system" {
+  metadata {
+    name = "flux-system"
+  }
+
+  lifecycle {
+    ignore_changes = [ metadata[0].annotations, metadata[0].labels ]
+  }
+
+  depends_on = [ talos_cluster_kubeconfig.kube, local_file.kubeconfig, helm_release.cilium ]
+}
+
+resource "kubernetes_secret" "flux-sops" {
+  metadata {
+    name = "flux-sops"
+    namespace = "flux-system"
+  }
+
+  type = "generic"
+
+  data = {
+    "sops.asc"=var.sops_private_key
+  }
+
+  depends_on = [ kubernetes_namespace.flux-system ]
+}
+
+resource "helm_release" "flux-operator" {
+  name = "flux-operator"
+  namespace = "flux-system"
+  repository = "oci://ghcr.io/controlplaneio-fluxcd/charts"
+  chart = "flux-operator"
+  wait = true
+  depends_on = [ kubernetes_secret.flux-sops ]
+}
+
+resource "helm_release" "flux-instance" {
+  name = "flux"
+  namespace = "flux-system"
+  repository = "oci://ghcr.io/controlplaneio-fluxcd/charts"
+  chart = "flux-instance"
+
+  values = [
+    file("values/components.yaml")
+  ]
+  set {
+    name = "instance.distribution.version"
+    value = "2.x"
+  }
+  set {
+    name = "instance.distribution.registry"
+    value = "ghcr.io/fluxcd"
+  }
+  set {
+    name = "instance.sync.name"
+    value = "homeprod"
+  }
+  set {
+    name = "instance.sync.kind"
+    value = "GitRepository"
+  }
+  set {
+    name = "instance.sync.url"
+    value = "https://github.com/vhaudiquet/homeprod"
+  }
+  set {
+    name = "instance.sync.path"
+    value = "kubernetes/"
+  }
+  set {
+    name = "instance.sync.ref"
+    value = "refs/heads/main"
+  }
+
+
+  depends_on = [ helm_release.flux-operator ]
+}

infra/r740/kube/values/components.yaml

@@ -1,18 +1,4 @@
-apiVersion: fluxcd.controlplane.io/v1
+instance:
-kind: FluxInstance
-metadata:
-  name: flux
-  namespace: flux-system
-spec:
-  distribution:
-    version: "2.x"
-    registry: ghcr.io/fluxcd
-  sync:
-    name: homeprod
-    kind: GitRepository
-    url: https://github.com/vhaudiquet/homeprod
-    path: kubernetes/
-    ref: refs/heads/main
   components:
     - source-controller
     - kustomize-controller
@@ -45,4 +31,4 @@ spec:
               secretRef:
                 name: flux-sops
         target:
-          kind: Kustomization
+          kind: Kustomization

infra/r740/kube/variables.tf

@@ -0,0 +1,16 @@
+variable "sops_private_key" {
+  description = "Private SOPS GPG key for flux/kubernetes to decrypt secrets"
+  type = string
+}
+variable "kube_hostname" {
+  description = "Kubernetes cluster hostname"
+  type = string
+}
+variable "kube_host" {
+  description = "Kubernetes cluster host"
+  type = string
+}
+variable "physical_hostname" {
+  description = "Host name of the physical host for the kubernetes VM"
+  type = string
+}

infra/r740/proxmox/kube.tf

@@ -1,9 +1,9 @@
 resource "proxmox_virtual_environment_download_file" "talos-cloudimg" {
   content_type = "iso"
   datastore_id = "local"
-  file_name = "talos-v1.13.6-nocloud-amd64.iso"
+  file_name = "talos-v1.11.1-nocloud-amd64.iso"
   node_name = var.proxmox_node_name
-  url = "https://factory.talos.dev/image/5a697fd6e91537a2c9c45929d004d82af180bb5d4e989dd8494e25fedca005bd/v1.13.6/nocloud-amd64.iso"
+  url = "https://factory.talos.dev/image/ce4c980550dd2ab1b17bbf2b08801c7eb59418eafe8f279833297925d67c7515/v1.11.5/nocloud-amd64.iso"
 }
 
 resource "proxmox_virtual_environment_vm" "kube" {
@@ -29,6 +29,7 @@ resource "proxmox_virtual_environment_vm" "kube" {
 
   memory {
     dedicated = 32768
+    floating = 22222
   }
 
   boot_order = ["scsi0", "ide0"]
@@ -88,12 +89,6 @@ resource "proxmox_virtual_environment_vm" "kube" {
     vlan_id = 2
   }
 
-  network_device {
-    bridge = "vmbr0"
-    model = "virtio"
-    vlan_id = 2
-  }
-  
   network_device {
     bridge = "vmbr0"
     model = "virtio"

kubernetes/code/gitea/kustomization.yaml

@@ -1,12 +1,12 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: radicale
+namespace: gitea
 resources:
   - namespace.yaml
   - repository.yaml
   - release.yaml
 secretGenerator:
-  - name: radicale-values
+  - name: gitea-values
     files:
       - values.yaml=values.yaml
 configurations:

kubernetes/code/gitea/namespace.yaml

@@ -1,4 +1,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: renovate
+  name: gitea

kubernetes/code/gitea/release.yaml

@@ -12,7 +12,7 @@ spec:
         name: gitea
         namespace: gitea
       chart: gitea
-      version: '12.7.0'
+      version: '12.6.0'
       interval: 1m
   valuesFrom:
     - kind: Secret

kubernetes/code/gitea/values.yaml

@@ -1,6 +1,5 @@
 image:
-    tag: 1.27.1
+    tag: 1.26.2
-    rootless: true
 ingress:
     enabled: true
     hosts:
@@ -21,28 +20,28 @@ valkey:
         resources:
             requests:
                 cpu: 100m
-                memory: 256Mi
+                memory: 128Mi
             limits:
                 cpu: 500m
-                memory: 1Gi
+                memory: 256Mi
 postgresql:
     enabled: true
     global:
         postgresql:
             auth:
-                postgressPassword: ENC[AES256_GCM,data:PtWMsukqbrWiVg==,iv:iQtDckrih/3ZKopzD9eEViOMZrvSulmCI5tHCsJph1A=,tag:7S54w4ADG7+8QNiLDw2Q0A==,type:str]
+                postgressPassword: ENC[AES256_GCM,data:5SoftEfh4w8hmA==,iv:QbbOmVM3Jp3gxAxL1OvnB6WKFX+OTHFENz1roMnPqyc=,tag:Gtn7H7d3O7Hweg5q6P6xUg==,type:str]
-                password: ENC[AES256_GCM,data:jLC1oEl+ZAnpbw==,iv:PliGMmxHKn3eEt8uvsv9wL4syk91EC5OpA7AL5J0+4o=,tag:Oan4ek7m0Cxnl5bzOCGHXw==,type:str]
+                password: ENC[AES256_GCM,data:0BMgFdvPvhB9oQ==,iv:Z0mkQBfhpc7y1nSLY6MOucxwuKZ8TfOk6NlQE9RwVQw=,tag:yGDAOH6TCJDCfhxNlC/eCg==,type:str]
                 database: gitea
-                username: ENC[AES256_GCM,data:ricveNc=,iv:rPrHKhIzsNEQzoaX2cPDvVWjR7NIxsN1tBlzLB80IQ0=,tag:n64SpL6qM/IT9D7t85/Lvg==,type:str]
+                username: ENC[AES256_GCM,data:F7+91aE=,iv:tEGgJ6GoXVkNoD6D4ZnyClrOQLGlqzFIUqqwDrVjd9U=,tag:H1+f/EKf/KptooRf8g0qcQ==,type:str]
     volumePermissions:
         enabled: true
     primary:
         resources:
             requests:
-                cpu: 100m
+                cpu: 250m
                 memory: 256Mi
             limits:
-                cpu: 500m
+                cpu: 1000m
                 memory: 1Gi
         livenessProbe:
             enabled: true
@@ -76,8 +75,8 @@ gitea:
     oauth:
         - name: Authentik
           provider: openidConnect
-          key: ENC[AES256_GCM,data:9UuG23PYFiWrQKJX5xGxMgyWKLPFCxKjDUYJd59rMWcdAw619/v/Bw==,iv:AfHV1MzbYi5Z5Bb63/51Hmy9rM247b4quwKCzo7MpYw=,tag:pfpz7hhZyIUjIGGcxZVx/w==,type:str]
+          key: ENC[AES256_GCM,data:oq+UsuiNEGWphxXbwtbBs3d27bB2cVPoR617TWhcPOk67D7XWUPkmg==,iv:hODOA45FFex/b5ghHScnDoc5osu1d8bzD969oFVH3wE=,tag:67TMl55I6zgJWNGMqco6fg==,type:str]
-          secret: ENC[AES256_GCM,data:PKFx/LhjwWJluC6/RHc1eMgw4TZXkXymNCrc7TQU6Bp5rGKHMvACC+G+MjXGylIMZVt65LHWq5YEHJNjO8HMsa4ejGukXDuU9sCgKaOOniCs3EQivfVsCCHtF/G48eULPkege7JRzTbmJSYJDnscsSikwvUDChy+zGlC2ZmBZjk=,iv:qsIaaeXepJ9ECilo+05+A0i2joxV0svBOjgL37DkimE=,tag:/3Xer7Yb6QyUtmPIOvSLQQ==,type:str]
+          secret: ENC[AES256_GCM,data:o9BZSzy61ouycNgtgRg/Jn8Wz+hLBBqgX46iHbaYtPbUVPVFc9tpdCsTdHCpfSGfiS1B8kWcoSzIDIAIIofRSCS/QqEQeuTwsyakkXhgn/LtLn+TH7bdLLS8qqusy5MZ9U18IJ/UBPGZ5+16Y/glbhpfHu9NNv0AI07nPciTq1w=,iv:7dn7eW2oEK/EU4xIETwVSekZUmktrs7U9KTJC486nHs=,tag:Otl2KuySu9bI/cZfCyjiKA==,type:str]
           autoDiscoverUrl: https://authentik.vhaudiquet.fr/application/o/gitea/.well-known/openid-configuration
     config:
         APP_NAME: Gitea
@@ -106,36 +105,36 @@ gitea:
 # Resource limits for Gitea container
 resources:
     requests:
-        cpu: 100m
+        cpu: 250m
         memory: 512Mi
     limits:
-        cpu: 500m
+        cpu: 1000m
         memory: 1Gi
+# Increase replica count is not useful for 1-node cluster
 replicaCount: 1
 sops:
-    lastmodified: "2026-09-09T21:39:30Z"
+    lastmodified: "2026-06-27T10:20:08Z"
-    mac: ENC[AES256_GCM,data:ACBKJLGUfWw9T3fOhQMT251gcLzG3bUXjUqBxG1DuPl8c8bblaIpLOu0QsrfQziQY3jM0DFJ2W/I2vjkrhCuCaZhZCtRg2nzUk+7HelqjEdKLphSuIdlHIkz7Icu+khShrwTgmQiE00Gg1WUsLRkKBgNsOm3TMK4wB874iBvSYY=,iv:Idp0+UBXaRFkpOFKFoRrLKuN1mOmfM7pukC22KkNiCU=,tag:fL9DzAo8FSx4PblVlTHtaQ==,type:str]
+    mac: ENC[AES256_GCM,data:VZY4oK2PCMBJd4VozL5qS7jlZtOu1JNsOn7aqJgPZ8uQR7kG939By7oVELMH9us0Sb8AZIYmzx7nLwnlp6IUNnacOffhKNl4stTFrb5Vry/5zem0CNp08eEDEt9VoxNudfQYC2axuGSwbAIahMzZsOYVRqOGgF1gEG17+hgd7ww=,iv:MiHKGUfzaSAppXLLxJSQD5loGkToFLzVQetWoRHq074=,tag:FduCPbHmy6A0mYdCrnRxDw==,type:str]
     pgp:
-        - created_at: "2026-09-09T21:39:30Z"
+        - created_at: "2026-06-27T10:20:08Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ/+PK0/kUHlc+exa8slolUeTGjHzd/R1Dtux/+HJdC9Vpow
+            hQIMA7uy4qQr71wiAQ//VDYGwZupOfefdEtJkD9SPOW3tHcOy2XR6ULhVQjXTGGh
-            ImAQvIdkEjwL0FmoA7Z4val/Wzx/YzFJ5r6sADNaQ9EG7QO+I8WY3VrKj5aRi0Qz
+            APuONtgUZKFCViUqYZB7l6fazM8U/fv3cHsIpZfALFGE9wSZ+4So6D5dmBj13egh
-            +FgHAgng+wdRCCBoxv9Z+MTPSl4TwrKsbrulHAg7EayDKxwGzkyMrnxvukRqD8GB
+            yznV55xjinoaKPzaYYZoVmlt1ZO22SxmC0vld3yfAs89KD1Aow5wNZGTBELzyAWF
-            iMQCUadudR458fzB04dkhljAbl/FqX5ppflzEoGVCiRSBcWNkaHgyYqopYGzMASy
+            gMYGMkCsLlH3gqBaJTV1m5LKHHQAtoyzvJbKcpiynNRySfN/ogNX67GmgEMH9+u8
-            KTzoV01adnOZY+xeZa5GasgCEbCU3BDesD9vBb+sFsRugVuRHzdyqp3nVBwudpeh
+            UexPwUHL6skIzHLmugYcrs4FAABot4WzoJsR794wOq/DEqHBE4SfQg48y/DROu2O
-            OcE9MOMyBN1SAdx9RCsB8aHWYndF1dim84ZWgQThkLlA+7CWJt/NyFYwmMdqqzSv
+            mgo6KqiXXe8qPGCIvjLiudb7MdSLpoLqgZ0vpExzdS/wMXAXczodrRRJmzEQyeDE
-            C7slojC6B8bb3863c5w3qe9TPPBwyTOcuNTMunr6wXidlPZWtsImhu/RX9fqzFjZ
+            j08pquhfUzQ1SA/9VRQkgl4r0dj0CTuc+EhvHD4M9nj3JIjvuJ0AdyKye5S8rdNM
-            9X1+wAjAfs7AASeNJLFYqiPrknSAA3JumQZtrFC5dejpTj9H2ns6DkiHSZy8FA8O
+            rm9eyX8V+o6X811qUM8bobKEi36tdnSMiB1yVHTtdW7hKctQwRMNQ8A9QEtOxS2F
-            RuZ8hv/L8L8oilbubKnKFZLhR8lh8A1jXHUxzaEC/L4o4cd7/3TlEms/51yM9qYx
+            +9Owub4LXZwBejSLgh9jaKEnilJQKVYN5Aw2lNAmZZZKtJ+iGHHkq9H6k+k5oEoG
-            WJOz4H8lbphDYO4tFgsGAhL/yHbLHvww/X1hNldwI7mqYrFLSjIwxW2Oxo8c+QB6
+            xkQ/IYIEGLhfjH0PDZ9m2G3Ren3EkEkNjYvhwENhuUcyuW5Abl62v9FMY8c9NYyK
-            yZ3VxTXuS9jEVpGTVhIOfepwS8rJQbTUeewqok3riw9GpSEFpOMWsBxlT6+HI8zS
+            +uf5VS1ceHOBcelQcdSx9Kuox5UuyUtbwUcv+HbTmymZtmYdw+dnOTtRHR5CNY7S
-            XgHPVohxe93kk51O7WjBgq8PAwG7DtWrygqWYORz+pTYN8wTtC4pfotiJZ7hv7Gv
+            XgEvPWAEagJpsmqC2n7Vc9d7b7TVp+SLSiL/w0v9JD6ko54Rwj0x21Odx3FLe7P6
-            NICEZlirrTUdIol8jyM+yRv1gWuYwQJpjnrQVY2AoAQX6ta5/3st24cyuGwGHO0=
+            obKU6XNNX9PPThJw2W0E295i2+DmOTH0AFio3rsg5wM3JFUokY/t8590sWnFR8g=
-            =Q6Pu
+            =Gypa
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
-    mac_only_encrypted: true
     version: 3.10.2

kubernetes/code/harbor/values.yaml

@@ -0,0 +1,37 @@
+externalURL: http://harbor.lan
+expose:
+    type: ingress
+    ingress:
+        hosts:
+            core: harbor.lan
+core:
+    extraEnvVars:
+        - name: ENC[AES256_GCM,data:Y1D+lAT57F4HpiwnKJuhN3cqr/17,iv:ZARBNcGuiD5U7TnlBuQJLaWCMkQIELpj195aeKaBGZU=,tag:exBNWO/o2CXyNMLr2Y6bTw==,type:str]
+          value: ENC[AES256_GCM,data:EDMjB9DVCG3FiXdWrQmE4LhXTtTPLebKkBaQZ05tooakENXWQ2jm4YNRgBKWibHSM2gAL/z9POEi5BkiD0zK+NQV8DJKFLa8sxg9HR2OfeCqk3gMbq1uwurqrl6+OVX75E0Vqd9xN2CUtvfNVvPktMYn8UBU1nKuiRaHm3Tbt4QpcSQ6Oh1q2t7uqLDxt6DcAVb71gjpUXCZ96gg8/XsWlZXyzwJsfOEi33KlkBQhXYPFPEqq4wkXGqE1G+rT9MNOWc+WUdyY8FbP5zko+4F0Fcprj6iKlw8UB8PCtF7yAwFnxO7Bb0QGXxDGdKx93SbmGwxsYKe9muQZFfdp9rNW4R4L7K/O/ymiV+KEmwuwWoIBKZTHEwgOpD/B94MfEsPOlrmD438Ae3aifBQEOo3Ln6qu7I9md8tv2co4rmY4Wt3bBI8xXIPC1dzKI2YyQ540QtN5L22UZpabLLez0wNiVuDtCG2vg0ncI0flouQ1KjQp8DJ0Wz5i2WABwNg5X4sLU66nquD5hlf2YoNPw8EuY+E5lM0T0xBiv9AJHtQK5rN4AUopQWsi1FTSdFtCOlykBxnoYsLDyEa/73LA8e7m5Hi82IUl/5xR6LOEblEm+6jgcxY5UGaB7hsgh4K2qizmC+TWg0ua8YD4SIJZxqsNk4yz1l9DQAhZBnt/j2/I8K8PObD/7+6ObOfLM8A9UiwyIGUeQ/SCaN5DNMAHwFyELuXgTzdbdTgguJcJDgypCLUgvuVfx8dAOoj6cvHm7c=,iv:PEenzkk4lUyFBPx6e8Ah9LW7M5N7o93aueSE+pQozuU=,tag:rUeeXqEtHUQ3RYn1Pt4rBA==,type:str]
+sops:
+    lastmodified: "2025-08-27T10:07:49Z"
+    mac: ENC[AES256_GCM,data:tp6aHDIfLuBDRBYPmNDn1ZWEq0ZT/WH7GYCJNp52tO1tNldi+kK2avluY0QBbC6/5V8LfxpokN3Je6uBveRVzleituxlK7dvsZ4piITTmR0T79PtUqxa4Jh+7PYp0uTofjme1M2L2MU1sOWrCdRdiKWEpDVIJCCCsZ2oDCCoMTs=,iv:O65a/alrwX4cNJH1tYh4kQPaprmulyAitg9jFhOJqnE=,tag:ewAqx7h1e12bMYGrFC9PTQ==,type:str]
+    pgp:
+        - created_at: "2025-08-27T10:07:49Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ//VDjjaWIsqY0nUFINvzxnt+dullI/+lHYQTfWvZ7LqH4d
+            TN2p2VZRGRkupYUYxt4iucYl6qViGey4iaQopsYrV19kJ+eEJuI+depXYsKBAccs
+            24rNJuTLHYi7r353u48qUVoQcE6uK0mYB8/4+w5J6uANvwmjXUtDMEHUoiBCh56+
+            F7olPPSPUjXv7BpTNq5EC8YjGRjUjQNf1NOyHHz1eTsyDbPszIs6eT1q98AMo3GZ
+            boh7T6Z2yLI7Bj5guEn5OfwyFtB9DzcpaHajDgF309CsUsxfvhoVH85rx58vce3h
+            QW2zy7KPvNEr84ZsTBQwLqi318JiSD1egx4m+CPvbFvV1s7DFDgQQifLRzlqR9/d
+            PZc3DAZ81QzXhZV9Wh4nxG26SQtsbVxAjdfLrpvpDLV3l0wIU8bzP/UsskjGa8zR
+            VBriJ6qGeeDeXVVuxcLMlAhd8R8ipEvLrId3TzvAPRClk4+fU7wzTfqR8Cl9hu29
+            csLtPW4Fu6iZshf3UJJ8KEhjYo6060TlfEZX9hzypJFf+kwJopSrS7KCPFheNBkN
+            P2cuyBgpG8OANQ0vYx68mgkDqqWVWNXAjUHxcp98IjZxwcSfMR+HwZi6xbK97GKS
+            ltqUSxYixLQUelHJX9YHkheXDwfH+q+CaG76IznvMrFi+bB4laU+DmmVnfPZT1LU
+            aAEJAhDJ8KQkP2yRHCV2qycNpY0qBHN6pk6FXQq7O7dl3Z1oQXkS88KopCwan36k
+            Hf4vvXRGLR4fm0uFYhN9aApnDFQuWm4NjEGiNyg6p6WN0XMBNARWfmTyDNc8xceA
+            Q5I2AHdBk7Nu
+            =+11i
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    version: 3.10.2

kubernetes/dev/gitea/actions-token-secret.yaml

@@ -1,35 +0,0 @@
-# Registration token for the Gitea Actions runner.
-apiVersion: v1
-kind: Secret
-metadata:
-    name: gitea-actions-runner-token
-    namespace: gitea
-type: Opaque
-stringData:
-    token: ENC[AES256_GCM,data:IOVPnopbQKY7HBT9tlnfuwvakgegLuK+PdTTwg+eRWdMz+dAoIxhug==,iv:QhfgyXNuZnYTXV1X16bdR+Axhfbe7buoRjXV8IdSbZU=,tag:r5By6+E45B04vgZrBoPSsw==,type:str]
-sops:
-    lastmodified: "2026-08-26T19:28:03Z"
-    mac: ENC[AES256_GCM,data:o3gyJNXJIBE1zSV4vWKFQWfmwZvz5Ek8ie/SjU6cF6kOqaLae2y9WBqYCQphCpasgN32qP0RM/bzzV3AZlIYqGEzI6lf0ha7aDPdVJKMy3ieie0F/UW6fJcTfidEFZYFKereRQwCWTzOESIZmsc+fqisyVxW3wL2yyYuh1a1HPs=,iv:RsG3AoqpMqR19DPQdqzfjbKNV5FZPxEsTbIZzzJtXq8=,tag:XzsmRc58Q+cNmBZXtygV3Q==,type:str]
-    pgp:
-        - created_at: "2026-08-26T19:28:03Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiARAAwpBrBeb3ywJTc54HNC7s/3+tqCvlozNym8E13jqHREOY
-            e6bfDO2hN2/JvbdGfMaWspLa8mU9ten6yFfUtoPADfccmbWwRAgS2mJuLyh5tksV
-            p+9m5vjyRQBH35pfTJ4F6Ksf7/2V8M4b2PxzBzTVQseqhOC2notYdvQeWED0gH1S
-            6cQvPClv/X214I9FfaHNig8SB7DV8uJ6ttj+IG9RL+NZ8lkT5GObSrphR6QH25Ne
-            65VMJmjcQLIWfZxR+zYVAxTsSeeDMFUY28WBUfjRei+WZ3ggmFRVERZzG6oSXfoA
-            nlqSQU16TyqadubPV2LcapqR/IwoSKdWO1/RmxH1NAFNvMg9nYLHzffAwPGL5wzT
-            GQZci20IlRQ5CLsaREyI1SNqYfjZ6esjUw8iKr5/bsr9XuI3FnWgqnKoAMs8O7d0
-            ZSGAohsUNrRki+ohhXtZFTelzufM1Hrt3Yz1TYQWtvoD7j87hq45BEZOU1ifiwre
-            Re0IhzcOdiBbCd3Lm9WSNmZzKHZoy9PJR/zaaitzZasIzsCH/7KjLBO0h1Bz+Osf
-            9Yxl5BMrUDFLlCIT0ORKZFtugwvS7Ez0IISMuRnSGjcutVsZGP1a6fN5K7oaSeAv
-            J9+9u5BuqRUs6ZYkC6TVqX7S8tAJkCOFIOFqxzb/oI2SBdRQmPP6Ix3FmN8NFu7S
-            XgGr3gKAnEDyuXwdZY7guYdVIteiLKUpvqk6F0yQD7b/rDGQoBD/g1twbx21ZDcI
-            UJ9aijLLe4JDcP02LNb64y8LaDb8VdFqlAIzV+MsYTwHAY3dB7LQtMGSmVlSZNI=
-            =lc7+
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(data|stringData|.*key|.*crt)$
-    version: 3.10.2

kubernetes/dev/gitea/kustomization.yaml

@@ -1,20 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: gitea
-resources:
-  - namespace.yaml
-  - repository.yaml
-  - release.yaml
-  # Gitea Actions runners (gitea/helm-actions "actions" chart, same HelmRepository)
-  - priorityclass-actions.yaml
-  - actions-token-secret.yaml
-  - release-actions.yaml
-secretGenerator:
-  - name: gitea-values
-    files:
-      - values.yaml=values.yaml
-  - name: gitea-actions-values
-    files:
-      - values.yaml=values-actions.yaml
-configurations:
-  - kustomizeconfig.yaml

kubernetes/dev/gitea/namespace.yaml

@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: gitea
-  labels:
-    # The Gitea Actions runner uses a privileged Docker-in-Docker sidecar,
-    # which PodSecurity "baseline" forbids
-    pod-security.kubernetes.io/enforce: privileged
-    pod-security.kubernetes.io/enforce-version: latest
-    pod-security.kubernetes.io/audit: privileged
-    pod-security.kubernetes.io/warn: privileged

kubernetes/dev/gitea/priorityclass-actions.yaml

@@ -1,17 +0,0 @@
-# Low priority class for Gitea Actions runners.
-#
-# Negative value + Never preemption policy means runner pods never displace
-# other workloads, and are always the first candidates for kubelet eviction
-# and the kernel OOM killer when a node runs out of resources. Combined with
-# the hard resource limits on the runner pod, an intensive CI job can only
-# ever fail itself — it cannot take the node down with it.
-apiVersion: scheduling.k8s.io/v1
-kind: PriorityClass
-metadata:
-  name: gitea-actions-runner-low
-value: -1000
-preemptionPolicy: Never
-globalDefault: false
-description: >-
-  Low priority for Gitea Actions runner pods. Under node pressure these pods
-  are evicted (and OOM-killed) first, protecting system and app workloads.

kubernetes/dev/gitea/release-actions.yaml

@@ -1,34 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: gitea-actions-runner
-  namespace: gitea
-spec:
-  interval: 1m
-  dependsOn:
-    - name: gitea
-  chart:
-    spec:
-      sourceRef:
-        kind: HelmRepository
-        name: gitea
-        namespace: gitea
-      chart: actions
-      version: '0.1.2'
-      interval: 1m
-  valuesFrom:
-    - kind: Secret
-      name: gitea-actions-values
-  # The chart has no priorityClassName support: inject a low-priority class so
-  # runner pods are the first to be evicted/OOM-killed under node pressure,
-  # instead of starving system or application workloads.
-  postRenderers:
-    - kustomize:
-        patches:
-          - target:
-              kind: StatefulSet
-              name: gitea-actions-runner-runner
-            patch: |
-              - op: add
-                path: /spec/template/spec/priorityClassName
-                value: gitea-actions-runner-low

kubernetes/dev/gitea/values-actions.yaml

@@ -1,99 +0,0 @@
-# Values for the gitea-actions (Actions runner) chart.
-#
-# Hard resource caps: CI jobs can be very intensive, so every layer is capped
-# so that a runaway job gets OOM-killed/throttled inside the runner pod instead
-# of exhausting the node and taking it (and everything running on it) down.
-#
-# Layers of protection:
-#   1. dind container limits  -> hard cap for the Docker daemon and ALL job
-#      containers it spawns (they run inside the dind cgroup).
-#   2. Per-job docker options -> each job container additionally capped below
-#      the dind limit, keeping headroom for the daemon + image cache.
-#   3. Low PriorityClass (injected via postRenderers in release-actions.yaml)
-#      -> under node pressure the runner is evicted/OOM-killed first.
-enabled: true
-# Register against the in-cluster Gitea service (chart "gitea" release).
-giteaRootURL: http://gitea-http.gitea.svc.cluster.local:3000
-existingSecret: gitea-actions-runner-token
-existingSecretKey: token
-statefulset:
-    # Single-node cluster, no point in more replicas
-    replicas: 1
-    timezone: Europe/Paris
-    runner:
-        resources:
-            requests:
-                cpu: 100m
-                memory: 128Mi
-            limits:
-                cpu: 500m
-                memory: 512Mi
-        config: |
-            log:
-                level: info
-            cache:
-                enabled: false
-            runner:
-                # One job at a time keeps resource usage predictable
-                capacity: 1
-                # Raise if jobs need longer than 3h (Gitea server-side job
-                # timeout applies as well)
-                #timeout: 3h
-            container:
-                require_docker: true
-                docker_timeout: 300s
-                # Hard per-job caps (docker create args). Slightly below the
-                # dind limits so the daemon and image cache keep headroom.
-                options: --memory=7g --cpus=1
-    dind:
-        resources:
-            requests:
-                cpu: 250m
-                memory: 512Mi
-            limits:
-                cpu: 1500m
-                memory: 8Gi
-    tolerations:
-        - key: ENC[AES256_GCM,data:wLfr0r+e9KYm,iv:BGZnWKQUlOje9RhAs7tBDzNcDt5LcfTnqRSqrdFc/A4=,tag:bb1f7NwEwmEzrf5k9ivFPg==,type:str]
-          operator: Equal
-          value: failover
-          effect: NoSchedule
-        - key: ENC[AES256_GCM,data:1kBsMuUlpluDmpVddyZCI/ylRbluHmQ62F88Q9LEoiZkgdpm5g==,iv:IlggVbY7s/xaSM2ljMkiTDwvIjf12g3SQzfL2fWWf78=,tag:2aNlCFumidKSbnoUV1IBzw==,type:str]
-          operator: Exists
-          effect: NoSchedule
-    affinity:
-        nodeAffinity:
-            preferredDuringSchedulingIgnoredDuringExecution:
-                - weight: 100
-                  preference:
-                    matchExpressions:
-                        - key: ENC[AES256_GCM,data:JuejrbDWeF+d/+d2Hq+q4V9vihk=,iv:VPgkBuv2hqJbTNFXpv3SzRGtFA6iVq1kFR8hfANg0cQ=,tag:D/wrkytnO8oZ3/+4yicq7Q==,type:str]
-                          operator: NotIn
-                          values:
-                            - "true"
-sops:
-    lastmodified: "2026-08-26T19:28:03Z"
-    mac: ENC[AES256_GCM,data:srIJjIgWx1OGgGwz71wQgT8c1gg64iV2VHrrb11SYXpaYg0VMp9d0maJHCaKt5rDVtWw/+Ft4WbR0z2FJBLEmr64/cFX8/SgrOR7pAc/vAgPKfxiSHg6iJoVCGHssGHm4NzvSUC2fkMqc8WUiZDR5hztUKSlp9oNPO2bKZmw7Zo=,iv:tgSmO28JZiGK9xO4uIH35zlRzJcW8lKxaggtqXlFq/w=,tag:+mIagmS+Z5RSFdSo/yDhjg==,type:str]
-    pgp:
-        - created_at: "2026-08-26T19:28:03Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ//X9NxtKUDFkdKDmWQh3wRSriiq25U7gkL0Q7SE45Tz5V6
-            03i6QmzCyBpI81TQQBRRzfdkuuqocBgplTRRRvFsNQNcwc5KCq1zHIDVYE+XlcmI
-            /bwA0GpBZwDN6Mv+G8+6UwhSp+YgsiGFTVAIctfz90cRYPpABX4wRcDYInTlifHk
-            weBq30iS6Nl9TajpgyyAUct6EBQ8u1YmxsII9RYWjdoTS/SAuAxNM2px7fwOPAoL
-            fq6/AxXj1n+uKjxl1calL95768RmLUerdxDmac53/73Pj271hmbwrWqe+JzkSriu
-            YMHYNOVLglf7nS3AQSqAa9PljBv7xHw9jOUqkJH14W7/NpSRvc4PICyIWA3Yfpfq
-            ymMI/OOYosyl3ZYhfLGUIAIYLkA1StgGVfpmeOmUCPEn2FIInBmguzDRMrdnUkoz
-            KYh/06Ug6YsgCTsy8Ffhzy724ITRADzqYlTU060tTwFN7cgFVHiIfZdYIFxDxNSL
-            NELw8Nl7+9jkWjlnmPvtxfrN90L7nBm4s3mZrYeyZ1/ElcxDkJKb4r+PJuc6rCpM
-            tuD9BXxjl5qa/trl/1+fVToDMMm5vws0MLl4DBkbNUNkD7wWko0I4rDSZ+X4SihM
-            /V7XgzeQ41KMnDdZYwTKdIVhCpZOIBwZlLuZSYCn8uhqO0YMkkpB1x1EOb2fy3zS
-            XgFdP2zpsUHWsy/iENHCgnMkQ+l2XwZZ2bgZGqwpRbLO0fDNX0kRZ45NzKl2+t79
-            npggZ12JFTPPbQG+o0hY0p7LjnjbfBsp7m9ykvymizZXlzP9efoOq6kjD/CRBu0=
-            =WgiB
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(data|stringData|.*key|.*crt)$
-    version: 3.10.2

kubernetes/dev/harbor/values.yaml

@@ -1,37 +0,0 @@
-externalURL: http://harbor.lan
-expose:
-    type: ingress
-    ingress:
-        hosts:
-            core: harbor.lan
-core:
-    extraEnvVars:
-        - name: ENC[AES256_GCM,data:lr90LLYoAKXh8PqT0QEmELOWBxKm,iv:y9mIMG3ND6l4rBnhW6f5FoU5BX5m4vi4WW87bv1XOB8=,tag:gtoyqreaGqG50Of69Pfqlg==,type:str]
-          value: ENC[AES256_GCM,data:qSCBq39+RSf1KGLyZ9TUKgVXtrXhvOhtR791n1hWKSUWho3YxM2LfTRJwcmAcLyIu8numioNlKEWQKDvOEefURzFy05RXkUYWa+ZebRp9c2y0d5ZrSiRDHM2cuxHRjeg/g4QKoX6IVhIcAEIqfHIs1NGxoqeaopAZcB6lGqspZZhzduUYJUWZGULylYdTpyF41F3RKv3xMnNBAQX2FCP3wOeb0DM8s4JMcgJ2eZwRDYecjotTC0pWL7LAZiZaLJR97O8/4cjofc9cGKEcyy0Yf05kSMxeZDWqrEplXNu2y30szafzC0SqkRwDPlifRUanNU2FaT/TIz4Ixklws7iaY0Db9yW+a+SvaWpNTY3pecbo01+4RG0eIDW4sRJFBp3/70vZ2FjCDDzaw6OEJYxrDf1fJ/UGGur2/rzDwLMhQgiRzIKoqq4n87hg1zwZ9ki63tKc+2Mp9oZ8GlvaCuNLMoG8QjXrxCkz/rcEL5Gkb11XwVAnsFdCCZVNfLstqQKpdnO8d4vvLHyRlw7lkf3ggX/b2l7Va/EkpHYONrwIdigd9ambMlHDRRhox3onZsgVaNqDdf5E8oeZJABqKV/1BT7oQn5Jx06kQhN7KvI07y21bQM2Gtvbv8LyhJHPdU3gZwtKEglp9+bU1UvFbQv9lEFm+1crQKBcgySCD8iLS+D2Tp4Y45qWjwD9Nsa2U9eGiHA1o3JZ5s3ltc2ZZVUvTpswRAfok66YqmL+XdbUkk6OtkSLS8FZVARHYbZ4bU=,iv:uxPwCWlMTEgtfGB93ywnMZLEBdNan+K7Bm0xuprYsPk=,tag:oLVwtUcrbERt9GExKo3tLg==,type:str]
-sops:
-    lastmodified: "2026-08-26T19:28:03Z"
-    mac: ENC[AES256_GCM,data:UVtitK0Ct6M7scvv1qsP+QeQL7S89+856IozBcQgnLZJzeZ5cquzKvrYZ+q7DeL1rk6EWvsxxFAFnSUDLfqCItEAMs4QQhORqplv6ot6BeW0LYUf5i1646Kl7x7Mg0RkJJ4OLsfqCwNPDT0opBQBhbYwTl3HCta8McCjSg96xNs=,iv:ebt36qndBjaThOJfAVJ7ACN06NrRSJnFlFmXIH2l4gM=,tag:TArRCiiM0xdMvOcZDqBrCQ==,type:str]
-    pgp:
-        - created_at: "2026-08-26T19:28:03Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ/+JkaqlVRJtypgMHl1jg9Dv1XqgeEW/5tv52YgxvNYk5kS
-            MJBeuku6/tVGb7i3eArj19My4hQLTXPWv/SK2cBiq3dKnjEs77Nfc1ffRJF/J03W
-            Ur/zy3o9lhVaWOTYVPTH1QIOehJS749ApadN7zB30g4RiOwJfTWiivEx67TzalDv
-            nvRMaotbAWxyD0PNpWV27i93FK8SIUy9HufpZucoN0BQ0moAj9BhbneumB+dUwRe
-            gh+C6LzbRuehFvegIh8DlWIKeMH1L0xW100cwuXyf6FOK/FM/pSsWX1IdlXD5Hfv
-            OSt4QHJESepTmEukfEgyywBMxk1iKdhW9/xa5lkEGxfGv6LnomzFWuKKOqiOF8GG
-            ZTt3NIj3Hr0S0USehbyQwQNOB/EvWTSWcoeaEVUmdphil8rZySZ6B2kkHWaj60YQ
-            cxb+vv9wgrjJitAhwds/xI5HYk0VSXdwtxZPTB4wqzNak5jHFKEY6/s0meQHk3Y4
-            UF9JIZsxLgPGGpAxzYka+Rlibv1FlPpyWQJZet6NGD/VbinhosIVv9vSZA3PqbyB
-            1x31PxGbKac/b7yeo2AfncpKPm0A33VENv1btRbbBGc2LRkYyLnlTDGmHbBrFE0s
-            HNnh4Gfc5EU6+GQo9UO7WIex5AQLvje91js895StVeh52ziyCBdjUwy6hhlSERPS
-            XAHgjHq0JXu8+cZrgjWyPlLcDYbMelW8RWsiGvvyZqUJn5YfVLBkMpSYVRanC0ib
-            3jBdLOaHKZvi9na0Tuf6QcWHep8J4hj1u80yUmIIzk0Xyv5WFYcypJ+g7KqC
-            =MmP5
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
-    mac_only_encrypted: true
-    version: 3.10.2

kubernetes/dev/renovate/kustomization.yaml

@@ -1,14 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: renovate
-resources:
-  - namespace.yaml
-  - repository.yaml
-  - release.yaml
-  - token-secret.yaml
-secretGenerator:
-  - name: renovate-values
-    files:
-      - values.yaml=values.yaml
-configurations:
-  - kustomizeconfig.yaml

kubernetes/dev/renovate/kustomizeconfig.yaml

@@ -1,6 +0,0 @@
-nameReference:
-  - kind: Secret
-    version: v1
-    fieldSpecs:
-      - path: spec/valuesFrom/name
-        kind: HelmRelease

kubernetes/dev/renovate/release.yaml

@@ -1,19 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: renovate
-  namespace: renovate
-spec:
-  interval: 1m
-  chart:
-    spec:
-      sourceRef:
-        kind: HelmRepository
-        name: renovate
-        namespace: renovate
-      chart: renovate
-      version: "46.260.4"
-      interval: 1m
-  valuesFrom:
-    - kind: Secret
-      name: renovate-values

kubernetes/dev/renovate/repository.yaml

@@ -1,11 +0,0 @@
-# Upstream publishes the chart to OCI only; the legacy HTTP repo
-# (docs.renovatebot.com/helm-charts) is stale and lags behind releases.
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: renovate
-  namespace: renovate
-spec:
-  interval: 1h
-  type: oci
-  url: oci://ghcr.io/renovatebot/charts

kubernetes/dev/renovate/token-secret.yaml

@@ -1,43 +0,0 @@
-# GitHub Personal Access Token used by the Renovate CronJob.
-# The chart injects this Secret's keys as container env vars (envFrom), and
-# Renovate picks up RENOVATE_TOKEN automatically.
-#
-# Required scopes (fine-grained PAT, restricted to vhaudiquet/homeprod):
-#   - Contents: Read & write   (push update branches)
-#   - Pull requests: Read & write
-#   - Workflows: Read & write  (repo has .github/, lets Renovate manage
-#                               action-related files if configured later)
-apiVersion: v1
-kind: Secret
-metadata:
-    name: renovate-token
-    namespace: renovate
-type: Opaque
-stringData:
-    RENOVATE_TOKEN: ENC[AES256_GCM,data:XgCD6ppqguo6MMv0OScXUkqhn07Mo31F8o4yf9Hd51wHjpmh/DHBSREqBzYpETrB4vDjec9AVyylOTz5qEITFdme+K8qg4L6Ti/JPIm5WOPNsXD84k3ZFIr6PWvQ,iv:ovQhFt2XlyHYzadYlQnQQ/X/NFV+9CeacZ40B1WYjqw=,tag:NTWOBN0ceJ7evKGq+y+cFg==,type:str]
-sops:
-    lastmodified: "2026-08-26T19:31:53Z"
-    mac: ENC[AES256_GCM,data:1EsEQ1JmB0pTgoA062k48hKAa4IUNKm55E/9bbmHPRcI5CUC7IBC2npT2yn0+6eQ7gTSqdrbqZw+xu0LAF5IrEjIIscKE7yZizkFAIy5VuCdZdAOBlvLtc1GXg7PE6ACXn8wHDcWBcAoq12HEAtpdXS1dNhdZBFxkB27RD7UvYw=,iv:hPeTFZlrqXyVNuy3D00VeLqecKDEKKGe/AhuFwSxPYs=,tag:O6+OYfJU3QeL58f5/tUQkg==,type:str]
-    pgp:
-        - created_at: "2026-08-26T19:31:53Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiARAAvkrhQ3QLbfF4xTCjmLnY4BzudBMrx4j1+zjG7S8MZ/oL
-            Vx4ji8gAxRIvv6DZ/eSwybeTijtY4ROUQRAm+2Ut5r2yKVGZiokTUE3js/SgQ4Nx
-            uSMcEdn5GOilgM/c30GXsWzCo3yiGWWCNISwxOLvdRC2FEw0OYxTRSEvtBnck22q
-            FExVE6fvH/ks7nak3ry9Bo4OEVZZrLmr8MR/RL/l6Z8AyOLCp7yss+a0OvTb+NRq
-            PVQXmoLlRYqEdbkW8lbyt32oJ451ukMH3l6yscC0ZxHIC6XvKUwUa9uhcUPLZq97
-            o73fmYqCSKmfLc8CMTDX97d9yuApOepZZtVaJGxLhxd/pNIZNwbojoo6pCKh8bdY
-            2CdSf/FA+EqjG1B6CtzHCE35FgiYuDxFsOM7WbPROvT8n7QYVnZGI/QoFawWAFsw
-            heFi9sDGBcqM+bZDo7NTV0Nd25Q/+GfCHpK1BAug4n3K61OuJhJfHw1kadbH81y0
-            vWN9AAQTYfu5FjqMjSbyASbTYNX28a776ojYrR6HGgD2A5PyC1vBAR+VZwSernfm
-            N+wJ8YAK/2hPKVReEhYFcJiSm/MuNW9QD49/gbj7Y/NFs5NEJlV33cAEo6hyduR+
-            Z+Aw2M9xOsz+qFop86oRGSXNCZh/TG/G5/7rjS2zNG0vQAsgQ+xVXmDJPsmZnPnS
-            XgFuPLMkIN+DFl3PaX9LwkqgROXA3KGG4jZsZ4qzQ0+fZOCAvoU7FNXKnyQ/i2qv
-            NPSRW2WLDAAbqwjj3jNxdd3JFRbDq6XQ+V175fYN8sTFuOYLq59d8YD7Z8e9+aU=
-            =xVRA
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(data|stringData|.*key|.*crt)$
-    version: 3.10.2

kubernetes/dev/renovate/values.yaml

@@ -1,70 +0,0 @@
-# Official Renovate chart (https://github.com/renovatebot/helm-charts).
-# Runs Renovate as a CronJob against github.com/vhaudiquet/homeprod.
-#
-# The GitHub token is NOT stored here: it lives in token-secret.yaml and is
-# injected as env (top-level existingSecret -> envFrom), picked up by Renovate
-# as RENOVATE_TOKEN.
-cronjob:
-    # Aligns with the "every weekend" schedule in the repo's renovate.json:
-    # one run every Saturday morning is enough to open the weekly PRs.
-    schedule: 0 6 * * 6
-    timeZone: Europe/Paris
-    concurrencyPolicy: Forbid
-    successfulJobsHistoryLimit: 1
-    failedJobsHistoryLimit: 2
-# Top-level chart key: wires the `renovate-token` Secret's keys as container
-# env vars via envFrom.
-existingSecret: ENC[AES256_GCM,data:tt9OJ41wHayCWgQYd+Y=,iv:jBqe+K1hL36ViFntV4cU3qh9jdnG6W8e4LiE99rIFIA=,tag:Kj8/qKd689iIatQgUc+9iA==,type:str]
-renovate:
-    # Self-hosted config (https://docs.renovatebot.com/self-hosted-configuration).
-    # Repo-level update policy lives in renovate.json at the repo root; this only
-    # tells the bot WHERE to run and WHO to authenticate as.
-    config: |
-        {
-          "platform": "github",
-          "repositories": ["vhaudiquet/homeprod"],
-          "gitAuthor": "renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",
-          "onboarding": false,
-          "persistRepoData": true
-        }
-    persistence:
-        cache:
-            # Persist the repo cache + SQLite between runs: much faster clones and
-            # fewer GitHub API calls on a weekly schedule.
-            enabled: true
-            storageClass: longhorn
-            storageSize: 1Gi
-resources:
-    requests:
-        cpu: 50m
-        memory: 512Mi
-    limits:
-        cpu: "1"
-        memory: 2Gi
-sops:
-    lastmodified: "2026-08-26T19:31:53Z"
-    mac: ENC[AES256_GCM,data:fA2nukiGOWK5UVQRbBagOLdqSBjYYG2VysxXfQ3TuRtFYhN8bd16j5xIfy2aDrlLEVw19uhInggQMu2vJg7xT6V6Z9w5YsHwcSQWSGCMjTk764/ChT3QGA0nhVG2ktgsZgaiU/MrCAPN/XQP3dG6Y25vkcptFcXnn7Ig5D+V2eQ=,iv:3fKfVaDJ7RjjAI0n4I+6na9pKLB07yGgjvRXjh7I3Iw=,tag:cyclZ/i2rfKeAof15J4ufA==,type:str]
-    pgp:
-        - created_at: "2026-08-26T19:31:53Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiARAAi9efDDL8A1RFxx50RBFjLi3G2OG8XQfo/UF3O7gd65vH
-            tu+3b9KtiRvWurOVqapAxUwapiiwx4Gsem5F1Q9FoX+5HfQ3APQ91kxfGjQTjx00
-            2lt+pl4JyeKj0+ilGMP5xaUyOvZGNB33v4ls14Uljzg3tqQQPGUvYMJ6f5svXXOo
-            ugagStCSx9jh0j++Y9gCFZXYSn3C1IblGeUxkh7fUJQjveqp8R5Ofntdg7sbV5Au
-            Xeah95zdQxdJ/zb6GW7t0dWY5KEYi4Tg1gNybvMIKDdWZ8NND7kaFOSx5Bg8aGJa
-            +6nh21MHs7oNmzpxLXNa9rTk1ncE2HcLcTIXl+NHf10dPcR6R32w8Bc5e1UtBKI9
-            mUeHgH2zphG4Xihcchbeeb6RAxBvl2EWLglxB/HKKw8ouC3EmlOj63QS7o8ES8CZ
-            z+/uq4uOP65Q9k0xa9YHl4nGVXlOYqxFkiB71UYIqwUxyw/Th0IEZhBrd2GFf2wl
-            CUj9DDDejWBvGyIwp1MIRLhQkMrL4KczHLAdMEC/OcvylZHxESOpMEIq+CUXi0wr
-            GyjnwLS3F1ZPB0+Xbpy8OfTKAT1jI6Z65G6138p6c8xJsh+lBwBd4QFTJ0VfR+fd
-            /edCwMKalySDK0Li9OIphj1or90l/ZURdlZpIrgnYrYeBg7HibuN2E0u0cMur/DS
-            XgExhwYtGznQThvIySwqAa2YMLm5tz5PJ1mUGkJ2AUaJuQX9SfhFYJSCGjpv8Fbf
-            04FCKZ7B8eG9j9ae0Wfn07SeN9xSZEMuCtE0KLjAR0v5ACAF5Lb6Ee5tc+5K2sk=
-            =zZdk
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
-    mac_only_encrypted: true
-    version: 3.10.2

kubernetes/home/home-assisant/values.yaml

@@ -0,0 +1,42 @@
+persistence:
+    enabled: true
+ingress:
+    enabled: true
+    external: false
+    hosts:
+        - host: homeassistant.lan
+          paths:
+            - path: /
+              pathType: Prefix
+configurations:
+    trusted_proxies:
+        - 10.0.0.0/8
+        - 172.16.0.0/12
+        - 192.168.0.0/16
+        - 127.0.0.0/8
+sops:
+    lastmodified: "2025-12-04T18:23:43Z"
+    mac: ENC[AES256_GCM,data:JSaTCBXqpiP0R3rIEa/EZaDPbBInY2a6UMhFD9Gcw/mJVq/wF72KsFRfJl2hZ3d1FtsQ6Z0l3GrbiV41348jxzWM4XnE0e0hywdc2Ryqw0B3GS0EoNk1IoPR8ieZtxWNtFvglR2gVWWUnN7caYf/acE04NnzIDxl0tPEFckS+Nc=,iv:C784uqYb7KGhn2wGWZnCA7rhGocJWP6mfBhjNLWbimE=,tag:A7JLOmSVJ+ZrNA36DJfRCw==,type:str]
+    pgp:
+        - created_at: "2025-12-04T18:23:43Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ/+J1e3KfHaAkFS+lYz9jKzPAffkiDVCeecEf31Lk9DJxFd
+            7agtTWvcXtIsiJwF4sv4NzxY3pQrNRKwiq8pd3iXWHSqflIaQ2M9+dUGHykkjA5W
+            R+y/wgM+K0MBaFMxQU/xC0lM7YFwypV1JBp4jmpNn3McGba2yZAoKo1uAQ9LMP4L
+            Fd5wqNUrLNfwbh5Ts1rBVAGwStVlkRUvdUVCXjngdWVmE5xB3IBypdrFX2oclkl8
+            0zSNJwknC4bi4FeKBxWC90HT0n8zSMybdZOltcl8J3YVCL6l0F9hw6Ub5j1ej7qN
+            Igyll2/T4FEOExdo9oRXbEjC6GSZZBD6NMlrgJqVVUWoqDm4WQlKc7JRYAjtRgbS
+            Us8qCD8CMb57E6AZHD+GRZDK48OeevM21YxRvpSQlQfyeGbMrxF05zzw5InHSMhw
+            VslHQRmUMQqEzTsSeFbNxTeqy1YGGDYlnBpEjl8TPIZXE+mjwHm9QJbKwQFUK4Rh
+            YuEZDlUONdaKQpNX9OS6kwiV493sSruC2yWNwYIlgERrkcjBggKYPiV7lDiFnl1W
+            RVcsqOGnsrrwFHT7m6/MTIzH0k4fDt6Vv/FCToaoadvLPYNZb7xoKMahzT1z3SP9
+            FMuGus2r8h6ShEZVyLAt6o+BuuYyzOrVo10k1yTKDqEDD662rbRvTrBZlOk1vUPS
+            XgEtw6w6fFkESJKetHiN6TxG2+WyJw5PILm2sjak5AcR3qWiux/ENPb8kE0BIB0S
+            1Z/YTHYNP2mtEegDsp1DoT9tOSTWfrllL+p3kccvizEB5hq9+oMEzPGBstjWRjg=
+            =5PDx
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    version: 3.10.2

kubernetes/home/home-assistant/values.yaml

@@ -1,62 +0,0 @@
-persistence:
-    enabled: true
-ingress:
-    enabled: true
-    external: false
-    hosts:
-        - host: homeassistant.lan
-          paths:
-            - path: /
-              pathType: Prefix
-configurations:
-    trusted_proxies:
-        - 10.0.0.0/8
-        - 172.16.0.0/12
-        - 192.168.0.0/16
-        - 127.0.0.0/8
-# Failover tolerations + affinity — allow scheduling on p330 during r740 outage
-tolerations:
-    - key: ENC[AES256_GCM,data:5+QTI95qM5mc,iv:FS4FVgDoOOpaDSArV8o/RkpkpJxx+VHJhuExKZn1Vgo=,tag:f/7b4p2Yzc2fQpZrJNB0EA==,type:str]
-      operator: Equal
-      value: ENC[AES256_GCM,data:p9l+vJ81qoA=,iv:x44SAzdRxMGCGdnS1EQxU5rG/7BQ0gWJAqZHohii8W4=,tag:wzVAvTzbcJFD0Rl+8uS4Sw==,type:str]
-      effect: NoSchedule
-    - key: ENC[AES256_GCM,data:2RIXb5x6dsNEV241NTXFGYL030lRupkjWcPUHsueK4a6bn8DBg==,iv:2RVpm3L1RXXc6nN3L4UqkBxuNe/pfeNBzprwLDp6ank=,tag:jgyvyNdcurQVuih3YvaBiQ==,type:str]
-      operator: Exists
-      effect: NoSchedule
-affinity:
-    nodeAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-            - weight: 100
-              preference:
-                matchExpressions:
-                    - key: ENC[AES256_GCM,data:I6Z6SR2x8z6grjUUv3PBHLDc58E=,iv:smfPq81TGWdkPyao+pJCoZidgUFhPTdFdXBRMPeJ+p0=,tag:035Zf3xHRZL0wmbt9e7pUw==,type:str]
-                      operator: NotIn
-                      values:
-                        - "true"
-sops:
-    lastmodified: "2026-08-26T19:28:03Z"
-    mac: ENC[AES256_GCM,data:qQWuHn260xF3a0+H06TZD5fdVkj7/yff2W+klPjFFPTq9x+roBXQsHaulnSVO966djEvprPJQHIHUN5pgx2Re1rgyQ6MSI8J8H+iO010Gw+k7w6Ya/gMN157qxusY9gwyKG56eciE/4FTocfAsjxcOkTuk+nX+N/MkSjbv1mAIM=,iv:ddhMEsQIHNqWJB2gMOMd6N5WZneeeFNOAnFoPfVUE/s=,tag:QziO35kTfqj7JOFPqC431A==,type:str]
-    pgp:
-        - created_at: "2026-08-26T19:28:03Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiARAAmUXgE37uXgmjh0BbCsX+hqX0yLGtzWm0LfAF72lhU74X
-            899VsY3OsCGAOndSH0T4vH27/ayoNE5wTZMahfxa02IdWZXMo3nD6F4k6nai6Dkn
-            7m52RRBqNM66NhF4TAaTKg/j60XJKw0aoVSlgkUq/JVvs4JSyZPpwCp2TVz4/TwD
-            Dn8jC6Wfs9YQKWa7FWKW8d4vz9SNOpPSsiT5hIF93XVs9GdcsCtCsPB4Cr71whZj
-            q0RYWi21dnFzf5qCEH/5Mmz235JudMYESwJ79yrIM9r1Cj3QPPc1oEy2qjbBpN78
-            ulobKXMdclkCpNNgqaNr86v6weT0HpjqR/lleUO1EMzyTOKaIZ1uGS5xPYHlqF4M
-            8u6Gj8S6kGCLDsAQlnUbt+cycg1NOPNPJq5E/htio+sdoUeEmO+Y3+y54ccqR622
-            eyIZhp4RJukNLnq1y+6LiIUmimTSRlApwLbBouY24D/JPaO1oWL+Q2dcvm2qpZ9w
-            /o2bdXyr0vNUnpq4Yc1uU8rBSeElOIRHcTZVdtsUZuJp72tXo7/oJqJmsnrAih4i
-            /7+rsOpRRQDQPIyEveBXcwEp/baSVsYdeINufmXiM57ie+B135+5tsYYucF3pXzc
-            elJLdKSif1Kt8w6Ch+O2M3NqsCp+yp6IihUOt9vyZ7pYLZvWLo/e5JUmvy9S5snS
-            XAFFVhnrgNL+dBuzZXa6vfglwvBNl9iEogYWtcX4/Sr7X30Dv2RfkcNYi55sq7ji
-            A9Y8/cyL7d0m/ksgpcFcmRQvPCOpM/KPKZ2KbLLdeuXOhP/WXG+2auhJtwzF
-            =BS4A
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
-    mac_only_encrypted: true
-    version: 3.10.2

kubernetes/home/zigbee2mqtt/values.yaml

@@ -35,8 +35,8 @@ zigbee2mqtt:
     external_converters: []
     mqtt:
         server: mqtt://mqtt.lan:1883
-        user: ENC[AES256_GCM,data:Sl/k+A==,iv:d1LIy5ny5jS5yEWtWfVntN4R8uQCoRwSiYkUb1JG/yo=,tag:dkNv+GqyD8geimnuJHgAFg==,type:str]
+        user: ENC[AES256_GCM,data:8chGUA==,iv:SOAuBYShpWbza3idtyqFoVIFstZFM34OPDN4uhAer0Y=,tag:WPoH80VcUGLy5Uq/z8EtaQ==,type:str]
-        password: ENC[AES256_GCM,data:vwap+JwtgOpLAA==,iv:PC2f6Lg0EpmaJKd9M2yeQGejvXTNmhRPjAkFw1M4zwc=,tag:zp0sgA2uzLmOBNNH6yY95Q==,type:str]
+        password: ENC[AES256_GCM,data:XVcTzQ3pDvPKbw==,iv:TK5qHq2yMTWgzcOPvj0GO7tOOD4PHvKMWfd3p4T8LuM=,tag:GJpKQWpVhwrewX4+9NITfQ==,type:str]
         base_topic: z2m
     serial:
         port: tcp://10.1.1.159:6638
@@ -44,29 +44,28 @@ zigbee2mqtt:
         rtscts: false
         adapter: ember
 sops:
-    lastmodified: "2026-08-26T19:28:03Z"
+    lastmodified: "2026-05-02T10:26:20Z"
-    mac: ENC[AES256_GCM,data:RUcA16mUHxIwToAQBR5UCbi/cEcDXms5r1cXYS7drYfvcPI1r84oX9/PHsXrRHcMsqIwyQbiK72CDLhQFXDW/YIugpy9OEFPAP88oqkfXrZFA5NfoU/9U0bfI5U8GmJEHx56DJtsqfSy1VMotC8sd0wj21YBcnmRhYIMoXLl/G8=,iv:tcjXHh0DvXheMlQIifVVY2TJryFmgZchbVfLKFpnLf8=,tag:KjpEK92QTFtzl6ml/Yw/VA==,type:str]
+    mac: ENC[AES256_GCM,data:32zZ0bYrgn+zTz8DEOU1N8MgDrihzWyMsV9q2m5RhFHRvXFuq3Z2GTORlUTeuK5qZIUrZt22VskigGAQiKC2CdzsJTcO3cGPshu5E6gWGBRNob02bXXsMu3TfCKxic/Ek7jE2p9R++a5AKczFZY8SxL7Sv1BZDxozkginDdYR4Q=,iv:VcDKwoPgYxZc8KXYv9oEH2GBqDRAJJxphj6MFLLI8ok=,tag:vPWqcEHoBVvfCoKoN5UiLA==,type:str]
     pgp:
-        - created_at: "2026-08-26T19:28:03Z"
+        - created_at: "2026-05-02T10:26:20Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiARAAptsMCNyzKNo3EtUeF1rdkRPPPg3yfjd4UjZD6ZkIFExw
+            hQIMA7uy4qQr71wiAQ//fl1m3T6TnQvQ+yG0plOZaRXIGRI/YHiyP9KsK6I6l4c9
-            IhqPSUqQl9tdjqNQaY3Amyo5rwvk62Reep6Zqz3+ig2DulwQN1lyJj+CPdNNAZ7O
+            Y7lUjVcgADbjZYAMv08LFOEyN0/dtTFx2kV1vC5sF4CjxXKfddazKrQFjZQygc56
-            81n1E1NcIoQWjVkDoh5MN9UEZkCfsr+2zE7fTiR2Zt5WOQm/p6eGB/WxFytirN6N
+            Yn3wiYX2ZMTsc3AnOoUF/evXyDHYMu0l8FwZEupi0cjmgKjVZZsLYScMjLi6h9oO
-            cgOt7ZNDZi2UW4ffyqt9ayU1s5C8o9epQecfhtGWxchM1GeBz/vyT/FHJsh6Jq3I
+            agDUxqZX8d3ikj3LPF1dk/XGP75fHBg7Jfim1RMMrOcpAbRi0H3XU82cr2s9fTS8
-            K2a/wz5vQAq1GMMAybzB2xNnM882YuclyfTLOJaAAYBovY9bzEV5SXOxpyUq5gXk
+            UtylTk1x3F253YTC0JdvU0UskvzCvVl0Sf8TlkVb2tTJgwf/XnXMTmMeCvbhIj5u
-            hJVN1xtzjBJOHySY2Nk8blX4md49W0CTmQptsKsIBQZ2+RtZg6MK5R4UeCrO8u1X
+            bgqIs0y6F0xm8NjhPGV2CtsQuQtLMLb5SxVFj7P4ad/Ekf9TizAJlcPt2u1/25zu
-            UkBYS4tbfBQtijoUMAlqUpSdvYGWEHg72dX1u7LQRW5adKCB+JHtIXYHQ4f5DSjA
+            x9v/kFnI5XMDIr3eWBJlFUwtImQJ+bO3GTauqwpULIHSa+y3Ux2XMNarKfN1jH3Y
-            HBHwZmMjf4yEMOmbV/E8cvGCCDHX3pOPx3F2I5RYcp+mES5SvkX/6SQUMVmypeyf
+            RG86rLQSioSA+HdZuZdEvo2ACc5DotC835cnMGMeIuO1Ad/RjvUaptN/p5hvTFMf
-            wp2zcx1JMh44HDd63vIEntQ4FALNHB7INqSytZjiV2DBphUimPMAOKSz6GLQ8Ye8
+            5t6SoE8gLXH7FZF7IomY0Xs/feztPOvPK76zpKV1Tqqgb7i0GaTFcKKBUxMPklZw
-            NLTkZOFVmyCLNRj/Z8iy1m74LHL4a58arZ+D5OrXlhRlE6SyK95QzRs0xyvPS58A
+            XwqOQl36HWz1BSvtYtYYX6/HyuknH4T6tk//J6MrNttnTQ/ZqjrBvl4FEVxTgf1h
-            PudcPKf0BrXCKWJfd87Kqurf7r64F22UYge7nyM2U/jhRLWtcBmG+tIy5U+U65vS
+            pFc8fTzNak+VB4MSdALg6Eo5xR57eGHhKgdUMgDAv1JMEP9ikk4/p8/1WHKhpTvS
-            UQFbkLECKQZUbk9FJW9nR6dXbFuK0dhZFsR2c0lsEGSsl9N5exosNbuH/43jjzXo
+            XAG3QSahHWoc9L5A73xFmD66TRUhm8CVKRCAQebB7rXjsxaqgEOl70taQpucrckD
-            LEn+CGVci15x7+2yBtA59ZMzohu78K8riLGbtlDUaeouSQ==
+            624SYxJwG9Uuk4odCQJ6g7T2KCKxsS/NKy6jOqgprkerR6pCfuXg8LDxBkHP
-            =Zbi6
+            =cZ3t
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
-    mac_only_encrypted: true
     version: 3.10.2

kubernetes/infrastructure/authentik/values.yaml

@@ -1,14 +1,14 @@
 authentik:
-    secret_key: ENC[AES256_GCM,data:QjhY+442U44K3EJuXqSb42eyWt2znf1KAG0DeQ7JQw2qGA4tMaZKVaBKP9jHkF0yR2G8gZpYIofxBJFfl82kYsqvrixcxgH11H+ctZxVI6Q=,iv:HjPjBzFkmBYahpKjSXA8qUS1a6c4/solENAB7noaIxE=,tag:qpW50kV2bVoduM92UNKVxA==,type:str]
+    secret_key: ENC[AES256_GCM,data:wnDvn9EdX2SYDoWn9tTrbKvBx11fGfGlTk+9MSz8cBzwMDaY5W1bCwjtH7TmAnwYhbUQxXdVIxgPpj7k0FVqM5fuMHZwcb2AgtDMGbxRXtM=,iv:jwUq7dbl+V1t+Ek7vyBEfwX1B/fVmE0TIFMVGj40kVI=,tag:G1bDdR9OUqOtZQmvUcAfRA==,type:str]
     postgresql:
-        password: ENC[AES256_GCM,data:Prv+e2pcLAyVyA==,iv:y36fhvpI2qm4nRnJzPXvLi1Sopn1g4YhdFVs+5fVeaI=,tag:z+HhXLN57qryvLdqtByO9g==,type:str]
+        password: ENC[AES256_GCM,data:G0KPHz7zZ5ivtA==,iv:w4m21LqGEtvEGAp7NlsoV9bwRkE/Mga4Nxp5mqBIJHs=,tag:kKHC3yXqJKZX9jiYuYXt9Q==,type:str]
     email:
         from: webbot@vhaudiquet.fr
         host: mail.vhaudiquet.fr
         port: 587
-        username: ENC[AES256_GCM,data:iZeZ2IgJH0iJWLYWCh22ogOuEzE=,iv:Un1P3ra/ziVZdPJFVnHBGs6zZwTA1elODRuKHaMEHYA=,tag:KdFfmfF553e9BeG4Ypt0tA==,type:str]
+        username: ENC[AES256_GCM,data:s0L1fCp8aObv5j6jlBiGDfj0aIM=,iv:cbvXxI3DIjnhnfHmUpeDF5KKRxUC2+YdvwU5FPcEe0s=,tag:rR8HpXUEabNZ36xabVkSIA==,type:str]
         use_tls: true
-        password: ENC[AES256_GCM,data:Vvs0ibOmTCo5f5P8JQ8=,iv:uiT2+qK+KxS0TQqw4Tda+CA2h9mlhcf62WjKH61LP4U=,tag:6tRDtEWmHpiSjZz1xchHxQ==,type:str]
+        password: ENC[AES256_GCM,data:rb6o5MGQWK7LIT7gass=,iv:NjI0iqRk2usrqcH6kSo72T337y6avHz5whg9bLfAYDA=,tag:DnRJaixjmNY31V1h9Et5PA==,type:str]
 postgresql:
     enabled: true
     volumePermissions:
@@ -17,30 +17,12 @@ postgresql:
             repository: bitnamilegacy/os-shell
             tag: 12-debian-12-r51
     auth:
-        password: ENC[AES256_GCM,data:eQj7A0VNaObUag==,iv:19JuGpdcwc+aJRiINaIu8015gODcDZO4pMO/uc3n+Yk=,tag:WUJAw2X6NLLDmqlIydyuoA==,type:str]
+        password: ENC[AES256_GCM,data:9PI//cgxRlmjNw==,iv:q0SLpmaTIC3OUulPDxiDWie0+oI7w17V2fPmJ52o8ao=,tag:2lwG95Remzqt1dj8H4CG0w==,type:str]
     image:
         repository: bitnamilegacy/postgresql
         tag: 15.9.0
     primary:
         args: []
-        tolerations:
-            - key: ENC[AES256_GCM,data:NZUuKYSOkot6,iv:wwDpZ18Q2OAj6Va5nWWKyrYK6/DqxjMKnvTRNMDkLCA=,tag:I8Na3EpJfAgCzUVSxFn8JQ==,type:str]
-              operator: Equal
-              value: ENC[AES256_GCM,data:XJw93s+tOis=,iv:svIxr795xD/Hz3yaHc4aiZ14hExVgmEDGfCOJoAK7Do=,tag:jdb0UgIOyXVmegHq3TvOJA==,type:str]
-              effect: NoSchedule
-            - key: ENC[AES256_GCM,data:kzg1pA8p8cBUgcKw6VfQuVPPmUmXR8uMAgxklAcJB/hVjGuxHQ==,iv:sFvOylmUNsfC9+XwwGPsFiua+/OMEDXlb/ICSQ6KNVk=,tag:ybJIKFMS3wtk/ESidcbEeA==,type:str]
-              operator: Exists
-              effect: NoSchedule
-        affinity:
-            nodeAffinity:
-                preferredDuringSchedulingIgnoredDuringExecution:
-                    - weight: 100
-                      preference:
-                        matchExpressions:
-                            - key: ENC[AES256_GCM,data:A7lJZoDqSfcwF+W3aweIxGmiVIE=,iv:ZFC9gAM0wVhGpFsfzHfBI3fUPNwGo2/stpZk9FTlu4k=,tag:8HzGLiqZ/Fp8AvGjDLeBVQ==,type:str]
-                              operator: NotIn
-                              values:
-                                - "true"
         livenessProbe:
             enabled: true
             initialDelaySeconds: 30
@@ -62,51 +44,29 @@ server:
         enabled: true
         hosts:
             - authentik.vhaudiquet.fr
-# Failover tolerations + affinity — allow scheduling on p330 during r740 outage.
-# The authentik chart reads global.tolerations (applied to server + worker)
-# and global.affinity.nodeAffinity (preset system with type + matchExpressions).
-global:
-    tolerations:
-        - key: ENC[AES256_GCM,data:FR3QHEd6FFk9,iv:fmWDfiL122FdaZT9SpwqCCiJDXtFRLR31+SjbI7+HbI=,tag:++WE+3RwdDbXTyV2xu2UIA==,type:str]
-          operator: Equal
-          value: ENC[AES256_GCM,data:/BSFTcoWqMk=,iv:gNvCYESHtDwF/2ZeUwFj2h3LjpHbCaO97YK/HvYl9t0=,tag:HAZPhDedb5E0D5SlHEoZwg==,type:str]
-          effect: NoSchedule
-        - key: ENC[AES256_GCM,data:/Qrec35ekNu97Vt5uezNfI+siytofle4uTm/YXt5KihmcTerPQ==,iv:/+hLpM20CFSVjG4KEpjv7vvem4XlAYt5RM2mAykaG1g=,tag:GfXvuHlBsWGAlpvSjaHMWQ==,type:str]
-          operator: Exists
-          effect: NoSchedule
-    affinity:
-        nodeAffinity:
-            type: soft
-            matchExpressions:
-                - key: ENC[AES256_GCM,data:8IL59mlYJP3mmE7F9MoKdztW/Vo=,iv:e6rBLp5lXnktdY9wHN7sMTteDQcUZoPuKW2rx7fuSlM=,tag:u7McVTzQIfW6oXILHuhFvw==,type:str]
-                  operator: NotIn
-                  values:
-                    - "true"
-# (postgresql tolerations are set in the postgresql block above)
 sops:
-    lastmodified: "2026-08-26T19:28:03Z"
+    lastmodified: "2026-06-05T20:13:55Z"
-    mac: ENC[AES256_GCM,data:XucjlNYeRTBXcSqA8Tmnl/Oy7MtdVM6ZrYnv50S5nytSx2wjKxdoJtGzvVIrRTNPdt86J+jNhIJKRAlBoEamDWy2+qh38suXx0JSzpoePuqd6mGxvXLXtVje7OynAq742q7rrHiJqffpD8ck+U3xN8Y1rNrAwnEoucFTlreCN/c=,iv:DBY6fMt6cSfvoOrOmFoYWN5DUUMV+I+3zCltZPcGF44=,tag:iz9TMhxLLBsTmwgDYfnIvA==,type:str]
+    mac: ENC[AES256_GCM,data:rtrnY4XXaovFr/oXuZWJQa17Ihlgb9W7WMKYeN10qqx8REf6a3zqlUUGGSndYhjAZwpUjo3qixqAjW6kItBDgeF3DLpQ2T6acyOgXmbYNN+dWK4zb7jE0yZz69XIkUirabBWTkLqDACvw3iW5x4EAjg6/VYRVt4g5eugET5F/IU=,iv:eM+Z4SEJ6/y6gHzlYjLxcbqRn4dP4gbkaQqN2EGL4BY=,tag:EXklnS8lNeQErKcdP0XD6Q==,type:str]
     pgp:
-        - created_at: "2026-08-26T19:28:03Z"
+        - created_at: "2026-06-05T20:13:55Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ/9GZ0NMlA2Vyh4RtFbvJvZBZkSHg0L5w7K9txYAcyKr017
+            hQIMA7uy4qQr71wiARAAsreeLsc0Qhc/RDFP3GmusT0PCFq0XTnin9THWE+7YC/5
-            uZm/UCgp9ohQK5DKg472EzevniIdGmA907ypV5BAtsXJt6KIkmA7RLTdIw8FwTeL
+            +kPcfKfyQGQGImzkl6niBxzl4jjxiyOyhdDWzwFw34Ets+1wXLlur9mo0v8GLfZG
-            kJaN0jvijShaV5c1Wt5HlRHl/zVjil7Hokq6Q8fp4iz+MJ7H3U+5c6ElT2xE7YWf
+            DEO+1VEzFheZzjM6pVNOWCJdGKR8WEuadjmMMCsux463JiEPtatRJgcAim3ux6uV
-            H2FYKsQlgHAjd3KlQvECsn4fOO7wKhIs9qNhvA5c503gyOtRq2cR5IiFQiwzKJLq
+            TbtDNNF9yc9yp7GN8p0/kF3tnD40zaszM8+UznrWbDIFJOrixyVTZ3O9tKcjl55S
-            5tzN4SROfWUrO7FfqXlkqsFNSn51SAOtkzqc2osbXmZH6s84ZJzgAow3SVZ7/ZQb
+            m5upCrrbc4rcp+uRiYrsiMZoEg3KvlqtxUw9mHoeVce83l7bziobixzBhnGRtAar
-            NqK1CfLauhL/RBb3sgKZBOX8zhC0gdRb0NKlothMx4sjo0Ao1fMlzgc/FpDlnf8U
+            zYUKsuu5PPpljV+ghDSIkcTrwLGQnInhlbOxKwDNVb0LiL/1c6dP4zPfZNh+Nvne
-            CSVbE2u3K2Q4tUKEKCmIOdLzT+uthnQSvumXbt5d7Hj73wBM56P2sZGs244+SF11
+            XhUDx90WnGCFOI2t5tXelAymCBDgak2qCX4IxkxddBhL9lONwYIM8zmszjPQf7r1
-            SStk9yiYkQSwoCDS/0MHS9cP7p2Jx0dtcqrM1g94ACGJFLbplOuqQh/UYDofi7XA
+            Gx4vFrUTqceEXI+JLiPog4/+gGHX1qzifdHBZR0ZtTi/XJfnhdH3fkJndLA65Pkg
-            8UOePz6KRevU7tJZ0bV44j3BMPiSHLwJA8Xlld38pTVxx4hbWeffW3DcjZpLXJqW
+            K4vY6KfomQLEmHurMVzEkoeXH95qSWmfmai4SJmKWqm33VFPZRFoVonnx4dP27SM
-            Dyz3EtGv9mHB0MoGzj1Djlhb01wNj1g/VHqDonugp0h8DDx4uwZHXiiF8c5qOdTy
+            vZGmfgjOl5eeRk/jdrApJNTkCi/dkGUfNRDffwcYQgjCJaWOs1agchBSC/RLZVWN
-            z/q7lljNT3FxiwYEmAs3yo+RmxbVSLMzSUu/p37VtCOJigB0+1WPbg1wFWwd67HS
+            3FPmohgmGa/MBOX3qS1r/5G3XBdKuUxd/NJ2Bw8L0wodteGSEClEiMEXGGZLkOzS
-            XAF1CpLZiCr1ZaCRbNBT6CXuyUwjYeSd+OXq3MTOGZD81xvYKxbs4mRdzSlpxCQ9
+            XAFSk/qmO3tJGViwOVtnb0ZXyTRritW9uR13N+LcaKJhC0PB/m/lXR6IlrfLJXnu
-            tObUsjTWMf/0q3zPU0mN74hNLrz7Z5ywol/j1IMKpy1B4Q8CuQmfL0zjyMY6
+            AMD7w42wKMeBgGuQQ/Xm/iOVlS2H0kvbm1b1WEZMQUJlEleKSyQKbmQPujoi
-            =3su6
+            =KjtC
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
-    mac_only_encrypted: true
     version: 3.10.2

kubernetes/infrastructure/caddy-certificates/kustomization.yaml

@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - certificates.yaml

kubernetes/infrastructure/caddy/values.yaml

@@ -1,149 +0,0 @@
-# Caddy Edge Proxy
-replicaCount: 2
-# Listen on standard HTTP port
-listenPort: 80
-# Enable HTTPS
-https:
-    enabled: true
-    port: 443
-image:
-    repository: caddy
-    pullPolicy: IfNotPresent
-    tagSuffix: ""
-    tag: 2.11.4
-service:
-    type: LoadBalancer
-    # Cluster (not Local) so any node can forward to pods on any other node.
-    externalTrafficPolicy: Cluster
-# Disable ingress - Caddy IS the edge proxy
-ingress:
-    enabled: false
-resources:
-    requests:
-        cpu: 100m
-        memory: 128Mi
-    limits:
-        cpu: 500m
-        memory: 256Mi
-# Caddy needs root to bind to ports 80/443 and write runtime data
-# Using restrictive security context causes "operation not permitted"
-podSecurityContext: {}
-securityContext: {}
-health:
-    path: /
-    port: 9999
-# Extra volumes: TLS certificates from cert-manager + external routes ConfigMap
-volumes:
-    - name: vhaudiquet-fr-tls
-      secret:
-        secretName: ENC[AES256_GCM,data:HYQb37rKxMqxFTsCz5kw6qY=,iv:dI9uqUVLLqPv3a5vwz1vowTvO9WduQaXqj7XZREd7oA=,tag:mz257AC3pvubgzOMxbHfrg==,type:str]
-        optional: ENC[AES256_GCM,data:k9FVxw==,iv:XMAGop2PvSGD1R1cy6qqE39bsIAOFIqGzTnwDmYRhHM=,tag:7zZAwSzRWWiT9Y2iMWkI6w==,type:bool]
-    - name: wildcard-vhaudiquet-fr-tls
-      secret:
-        secretName: ENC[AES256_GCM,data:2OUkq/AMuv2wQyIlLPS3bSRrnV1mvDR6vd0=,iv:1e9HC8FFC4vo7GjCnJyNjF05R+Js41ONy2in5a+/doI=,tag:icKdtLhvQ40YI+KCE+6fXg==,type:str]
-        optional: ENC[AES256_GCM,data:b+zvMw==,iv:QyU+T1BGZenO/nO8wq6R+KkrT/I6ZXIIhAnf5npFhvw=,tag:4UPyop81BQu4zxhZmK2n+Q==,type:bool]
-    # semery.fr certs from cert-manager (OVH DNS-01)
-    - name: semery-fr-tls
-      secret:
-        secretName: ENC[AES256_GCM,data:cLzhXgUhrwgIMACU1Q==,iv:DJ+6mjtjYmWxNcHl1gzeoifpcFCJsXiOXeyxEWnRU3g=,tag:7yc2bt6fBWwBuefPY48xyA==,type:str]
-        optional: ENC[AES256_GCM,data:DTfxaQ==,iv:K7TJjSI/vF3x34SWmwmivYo+mSsUAg9nB94Ui85nHCI=,tag:1/JRBMlb07+aHKEulIYpQQ==,type:bool]
-    - name: wildcard-semery-fr-tls
-      secret:
-        secretName: ENC[AES256_GCM,data:Qq+ybi1kSVdVn9RP/kTkTcw0lkao3Q==,iv:vFmV3YvSNhLizgJVBnq1ZERqDP70onuZDvy/I3joPtI=,tag:AiEW+yh51Dexz3Vha4MPgg==,type:str]
-        optional: ENC[AES256_GCM,data:0o4ODw==,iv:VwnCs2C1MVUJEfBvNJT1rkDV7m60sNZPdtERo9wWPJk=,tag:oo+liLatrjqEtlrKQyjhyg==,type:bool]
-    - name: buildpath-win-tls
-      secret:
-        secretName: ENC[AES256_GCM,data:SejgJvZY/B7DDgf3YJcxcFA=,iv:bDZWhie17exL+9r9A7Ea/a8Rgpex7nuabVtW60LotJQ=,tag:WxqFbzulxxPgsynqfo5hzQ==,type:str]
-        optional: ENC[AES256_GCM,data:nBNRkw==,iv:JEvsFzMli7AzUj6GXJlHXOnANm45gnFE/kXrSbBotPQ=,tag:Puss6mCkoC7SGCb86guI2w==,type:bool]
-    - name: routes
-      configMap:
-        name: caddy-routes
-# Extra volume mounts - each secret mounted as a directory with tls.crt/tls.key
-volumeMounts:
-    - name: vhaudiquet-fr-tls
-      mountPath: /etc/caddy/certs/vhaudiquet-fr
-      readOnly: true
-    - name: wildcard-vhaudiquet-fr-tls
-      mountPath: /etc/caddy/certs/wildcard-vhaudiquet-fr
-      readOnly: true
-    - name: semery-fr-tls
-      mountPath: /etc/caddy/certs/semery-fr
-      readOnly: true
-    - name: wildcard-semery-fr-tls
-      mountPath: /etc/caddy/certs/wildcard-semery-fr
-      readOnly: true
-    - name: buildpath-win-tls
-      mountPath: /etc/caddy/certs/buildpath-win
-      readOnly: true
-    - name: routes
-      mountPath: /etc/caddy/routes
-      readOnly: true
-# Caddy configuration
-config:
-    debug: false
-    # Global options (goes inside the global {} block)
-    global: |
-        auto_https off
-    # The main Caddyfile content - imports routes from external ConfigMap
-    # This keeps routes in a separate, easily editable file
-    caddyFile: |
-        :80 {
-            redir https://{host}{uri} permanent
-        }
-
-        import /etc/caddy/routes/Caddyfile
-affinity:
-    # Prefer non-failover nodes in normal operation
-    nodeAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-            - weight: 100
-              preference:
-                matchExpressions:
-                    - key: ENC[AES256_GCM,data:oCV218wXg+k2L/edhWv6qpiyiaY=,iv:Y+O2of2NCOvcjSwr0EenGns0BtpT+P6pjCzEZUIMpm0=,tag:kY/WyHJ4Jr5ZLMe6ZcT/Tw==,type:str]
-                      operator: NotIn
-                      values:
-                        - "true"
-    podAntiAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-            - weight: 100
-              podAffinityTerm:
-                labelSelector:
-                    matchLabels:
-                        app.kubernetes.io/name: caddy
-                topologyKey: kubernetes.io/hostname
-tolerations:
-    # Tolerate the failover taint so caddy CAN schedule on p330 (small-node-1).
-    - key: ENC[AES256_GCM,data:K6vJkO2dpKRi,iv:b7NIPKTMYOxNao6KcSJUhsxKNRJ2J3ksEtmXkI8b0So=,tag:pMRmz17upWMTEZjwBRNyZQ==,type:str]
-      operator: Equal
-      value: ENC[AES256_GCM,data:4ULPtEoUhgs=,iv:ikqWRqRR9ki35QQ6VnMEzOgT0/e+5DggGP8w60BhW/Q=,tag:MW9lX8miIWb9nnbc0woZTg==,type:str]
-      effect: NoSchedule
-    - key: ENC[AES256_GCM,data:l7abu6ywKFevJdJod2Af2bj7XSfBJATL7UnfiUHrRJoCjBsl9A==,iv:xnUvzVX8z4doC+mQs1r0rNCSqaZ8KlXxr5Ee9FOFPjI=,tag:mnqCx9NSMSyeYwz57QFQIQ==,type:str]
-      operator: Exists
-      effect: NoSchedule
-sops:
-    lastmodified: "2026-08-26T19:28:03Z"
-    mac: ENC[AES256_GCM,data:gn90e5Gjq5/CraT7Cl43DVMIQukD798faKGbVO5IJlbpAuTwDrhvqnnojFq4R7LEEETtedpR3MRyqcnbfSWVruHoysebycL7EZJkiy7H36JmzQAOWKusshMF9kOyZIV6+AFfz8As/Mu4pF1p5+3jmgy6oOJn7Ewm0C930Gpa3gs=,iv:cf1UC/2NGBHtQgx6h8vRpMjeJRaAvG7ZznhErn2b+cE=,tag:3Ule+pq7pZHWA7NqhlgfPg==,type:str]
-    pgp:
-        - created_at: "2026-08-26T19:28:03Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ/9FKZhqwE2RZcfsIeMOtAkOTf/4aEbrSzsHbEO8DP8V3Ct
-            rQBu/v8y1Hcu3fVU/OjVk/7QbEBjPNu1AJST55DBIWktnYUgSo4fIujvG54/hqwM
-            9u0iuA1EcqVzGDa+vLSqgmi4Oxbujs0Ytn7uQrefqkdAOjltKqvknebI9EBdSRUi
-            GjVFwysR6jHmIVf9S64vu4VsjfC7ju9MBYZniaKsJ1GOBhIjUZ6ogkYs5S2E5PJ/
-            zE8cn79x61YLX74H+BAqnFcxbprtsCwMJPgyerfgijV6d+JpwT/6mp1VUrLe9Zz7
-            WEd/lVMlIcwnYCtIDAvuURvMP2OebWplr95d5V1Vb5Yywnl3M0pwkqL4dRiJISvk
-            N2rBQYvDfXBtJA7yTAkJ3PymrECKoFs6nspEBie/kDJmdRGv8s2aajzTTQ1qLAkP
-            FeJe0TcowjCCWMxk4W5DEoCh+PUA1HVo+/KmHjnIVgzdgxaeqT90VXwN8H7MPPeu
-            LKE01+Guue821h7GykkIhe9sf3nMGbI5rOiCcsVtgu5bODkRk8jXpXh1qdRAliuq
-            uddjy1mWEfdUHNBj8YxvZ8WOU7h9FyZjsYZB96n9du1vqcuuP5eTJDVuvjjtDuTK
-            fbXYQbxwA5j4akyI4AKJYLA0Y/lcSXc84r6q8IA52nZz6uQZExbkoc7PPX7Q/ufS
-            XgE0CWRS+0tk2oVANMVU31UrCvitttezjR6sUSAINh122a5kcmOfJzLlB2OqVKc5
-            wMAyvOYccrQMrPDX1WJE7agDOaqGUQcwuFnvqpHhe8q9Yg1uOUU4sK1R8A1Qs0Q=
-            =wlYf
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
-    mac_only_encrypted: true
-    version: 3.10.2

kubernetes/infrastructure/cert-manager-issuer/ovh-credentials-secret.yaml

@@ -1,50 +0,0 @@
-# OVH API Credentials for DNS-01 Challenges
-#
-# OVH API credentials with the following permissions:
-#   - GET, POST, PUT, DELETE on /domain/zone/*
-#
-# The secret MUST live in the cert-manager-webhook-ovh namespace (cert-manager),
-# because for a ClusterIssuer cert-manager sets the webhook's ResourceNamespace
-# to the webhook's own namespace, and the webhook looks up credential secrets
-# there (see ch.ResourceNamespace in the webhook's ovhClient() function).
-#
-# SOPS will encrypt the stringData fields on pre-commit.
-apiVersion: v1
-kind: Secret
-metadata:
-    name: ovh-credentials
-    namespace: cert-manager
-    labels:
-        app.kubernetes.io/name: cert-manager-webhook-ovh
-        app.kubernetes.io/component: ovh-credentials
-type: Opaque
-stringData:
-    applicationKey: ENC[AES256_GCM,data:qOGxuFHguxe7e7pVfd1eiw==,iv:CC5CMc+VTL8aW4injRN2GxQvWf4nobGuQYhuUytHDfQ=,tag:3l8srdCgAtnz/fWqn+VrdA==,type:str]
-    applicationSecret: ENC[AES256_GCM,data:tvj/Km80zHBLA+gLqjCA0wKh9y/+g20O+kE2zZzEDVM=,iv:SKfeoThkwFbNGjNdQQByqAk/+dbyCLyzft1eXVh3a3o=,tag:qHoR2ZqEkfulKzdE/GvZrw==,type:str]
-    consumerKey: ENC[AES256_GCM,data:gGTsvDEy0DZvTiHP2mdghBrDbwE5hmkNDJtDf4CJEPc=,iv:EgvG8TmZuY4hWs3YD4y9zpJv/Ndu5tnGLs+hIMWvZU4=,tag:R4tSbVvJjkyXe/N93CRSSw==,type:str]
-sops:
-    lastmodified: "2026-08-26T19:28:03Z"
-    mac: ENC[AES256_GCM,data:xNUZ8stxMx7Y2ggmjBaF5FX0NtC18JJcaDgU52V4b+pnG72t8+P83DkYY3Xr6gWJfmS9wFNs3vZ8TJ+nvVP0C62zoN9cmC0BolJrTOyQ2rpoUu/0Xj+Tbfiwnmbm76yZ+SdQJLYg3n7fNG/g6fh88/BUERi0NAVil228ExFFliE=,iv:2Nu2LaqVYqM5WchoPqoHkCJcXypGHskDjLHFYRC4eTk=,tag:2H9FSAQ3UNGSxSx3WhUD1Q==,type:str]
-    pgp:
-        - created_at: "2026-08-26T19:28:03Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ//XxGw3gzr7UtuMakZqWGp6uZ5mZ42KscvHpQCZchh0wZb
-            01Dq6HLl6EMwu+fpnfkOU05SxozkaKvLw+xzTX4TExbfE3GBTjpJ5R4e/aj5B24M
-            iw32oy+y2jCIzMS0PKxIkhIJrClv5hRSZt5dVDzln5sOapXapE5iLpM/glerIwXk
-            i4EfntjzNhOUFCbwnH2F/s1ZKmwZWw88GNff26aAIDOhNiEyB7kz0s6Gr575cKvw
-            CdZrHDtfl7ZoP4JiozNXzXF65+YnIiG5kli1A0GVF/9XUeqgXTUHYJKvdGcHFAqs
-            NysLbdsoppDJUUpqWvU1gS0X6PifZWkd3Sv0LDaoV7TIa8UWHZMbyV9W/1NiGSjt
-            VVBO+ezQgpSFbEVixz1WEDyD9MPBAvWq+PS2QQcUc0aep8xRqoWAe1pojjs2k0DJ
-            2vcFkWmdj0RVngNvw3rBAxrYY8DtqrNOjc0B9s+2ZqIN9TT+9IWaS65Xh0wRMZoy
-            Ntxr7oyG3wicA8YFRH3WxLJiTqOOeYYgc+Qltds7fb79hJScdXNxbC8mFjo9zOUV
-            bnHSQrjj/Se6tzSpZt7yF/+3aBTAUsOfOXHO1md/ydjCBpO6eUYU+T6m+buIJ6F8
-            M7kov+/x5on8k9dcNjkwdVuOztIuIXGUaJ41idrGKOSvtAjW0CGO3VU67e76NwnS
-            XgGVAwNds2Bfs8mQfmKdhvCrJnPxqtN29z5fguTMGTPqMncsx62mhdwI6tgAgEdD
-            qEX+tRkjpgoa8yO3gkvu7J3+oQ2HQ5mOZaSyl/Xz4ALP4+MOEHEiMNWcDmotq/Q=
-            =BT71
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(data|stringData|.*key|.*crt)$
-    version: 3.10.2

kubernetes/infrastructure/cert-manager-issuer/ovh-secret-reader-rbac.yaml

@@ -1,41 +0,0 @@
-# RBAC granting the cert-manager-webhook-ovh service account read access to the
-# OVH credentials secret.
-#
-# The cert-manager-webhook-ovh chart only auto-creates this secret-reader Role
-# when using its built-in `issuers[]` mechanism. Since we manage the
-# ClusterIssuer and the credentials secret manually, we declare the RBAC here.
-#
-# The webhook runs in the cert-manager namespace under the
-# `cert-manager-webhook-ovh` service account (created by the Helm release).
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-    name: cert-manager-webhook-ovh:ovh-secret-reader
-    namespace: cert-manager
-    labels:
-        app.kubernetes.io/name: cert-manager-webhook-ovh
-        app.kubernetes.io/component: ovh-secret-reader
-rules:
-    - apiGroups: [""]
-      resources: ["secrets"]
-      verbs: ["get", "watch"]
-      resourceNames:
-          - ovh-credentials
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-    name: cert-manager-webhook-ovh:ovh-secret-reader
-    namespace: cert-manager
-    labels:
-        app.kubernetes.io/name: cert-manager-webhook-ovh
-        app.kubernetes.io/component: ovh-secret-reader
-roleRef:
-    apiGroup: rbac.authorization.k8s.io
-    kind: Role
-    name: cert-manager-webhook-ovh:ovh-secret-reader
-subjects:
-    - apiGroup: ""
-      kind: ServiceAccount
-      name: cert-manager-webhook-ovh
-      namespace: cert-manager

kubernetes/infrastructure/cert-manager-webhook-ovh/kustomization.yaml

@@ -1,12 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: cert-manager
-resources:
-  - repository.yaml
-  - release.yaml
-secretGenerator:
-  - name: cert-manager-webhook-ovh-values
-    files:
-      - values.yaml=values.yaml
-configurations:
-  - kustomizeconfig.yaml

kubernetes/infrastructure/cert-manager-webhook-ovh/release.yaml

@@ -1,19 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: cert-manager-webhook-ovh
-  namespace: cert-manager
-spec:
-  interval: 1m
-  chart:
-    spec:
-      sourceRef:
-        kind: HelmRepository
-        name: cert-manager-webhook-ovh
-        namespace: cert-manager
-      chart: cert-manager-webhook-ovh
-      version: "0.9.16"
-      interval: 1m
-  valuesFrom:
-    - kind: Secret
-      name: cert-manager-webhook-ovh-values

kubernetes/infrastructure/cert-manager-webhook-ovh/repository.yaml

@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: cert-manager-webhook-ovh
-  namespace: cert-manager
-spec:
-  interval: 1m
-  url: https://aureq.github.io/cert-manager-webhook-ovh

kubernetes/infrastructure/cert-manager-webhook-ovh/values.yaml

@@ -1,46 +0,0 @@
-# cert-manager-webhook-ovh Values
-# groupName must match the ClusterIssuer webhook stanza
-groupName: acme.aureq.com
-# cert-manager deployment configuration for RBAC
-# The webhook creates ClusterRole/RoleBinding so cert-manager's
-# service account can create the "ovh" ChallengePayload resources
-certManager:
-    namespace: cert-manager
-    serviceAccountName: cert-manager
-# Pod configuration
-pod:
-    replicas: 1
-    resources:
-        requests:
-            cpu: 10m
-            memory: 32Mi
-        limits:
-            cpu: 100m
-            memory: 128Mi
-sops:
-    lastmodified: "2026-08-26T19:28:03Z"
-    mac: ENC[AES256_GCM,data:jzaxMCQB6eTssTai71HIAzLwCktDSllQagk6dnz6KI509kZeM1mUyL/Mti25R1XpsTZv2aGWzG968CivR2q35wiP7CoRptHx2xPku63ljLihojp2Z2aklcM5uwcZRJIkSsZeVk2m2rWHE1hz6SiLIGbtmY8HMz7fBeLryni8SgI=,iv:yglyVdWx6Zy+GiD/guAWexolRwQXTAkKslI6zn0RUcA=,tag:6XvZb4RJCY+UtZGvOPxzNw==,type:str]
-    pgp:
-        - created_at: "2026-08-26T19:28:03Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiARAAl7HETp1m0KX0RwxpIW1kBIjhWCpDp2ynTTC1+Q/95A8t
-            JHYNTaeymQQLubEl1lB3EzgAnrvFIOlOW6aX9Vbrv9UPhnoEabVH0W6VWF7JFFcf
-            ZvKnkYJrPtlAu5dyN606ifXlZw5ZE1wP7hASgano96H8Irfxi+8JE5k0gwTNFlUu
-            cLDhjhwcnlxCIxf/akQpw4ic+aHvj2bp2ilaxBuo8YtVZUX21My55rjZpWxf4ekn
-            oq7kh7UD/dt3lZ8qWi9Lk7aGXrzjdErqIt3ESefKUQtqQEGVrOeZ4mnkU4KONa6R
-            FcLGTjuXl5Mily4U6cQJwkkyxJZyZLAVp2Phw86LeytZtFgtj/YsEk5NiTSl2a+3
-            qzbMySigD8q6lVAu/WO6r+KXitZaMNodekJh54xgxer2ZUBekOpzafHawbAXO47e
-            ZVKnNW/aYs51Vt8NeDGqF0KiUIGPqLN2ffT1t0SfNqZF9MYPc5rKX18/cfom0Lo2
-            80Qwb1l47DiZbht6AQ0oMzFdK3SJp1jnXPMd6ZNOSMj3TfRq9WZydNlEeBPiFG+i
-            0ASkPHuERyiogaZlsGgi8gKA4iM55wULCBXIsPdVc4cIbU7MpNpP0icsQN5WRV8L
-            vOUKjAntXik2ZHY4bhHd3Ty7/FVVIgi2M0Wi5/6mTn4ftb2DMyoqVKBYHwm5iqfS
-            XgEt7iRIfcYwAy9WKnHayTfk3Is/dnBTaMp/PKSCUwEELqnAgmpbLcZ/8lNm6wEi
-            Azo8CgLer0P7YHU+GbbONeQV29VrkjqHkA0imPFCHaAWxfSNE+55IctMgk+oclk=
-            =Ko1N
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
-    mac_only_encrypted: true
-    version: 3.10.2

kubernetes/infrastructure/cert-manager/cloudflare-api-token-secret.yaml

@@ -1,47 +0,0 @@
-# Cloudflare API Token for DNS-01 Challenges
-#
-# A Cloudflare API token with the following permissions:
-#   - Zone > DNS > Edit
-#   - Zone > Zone > Read
-#
-# Base64-encoded:
-#   echo -n "api-token" | base64
-#
-# This file will be SOPS-encrypted on pre-commit
-apiVersion: v1
-kind: Secret
-metadata:
-    name: cloudflare-api-token
-    namespace: cert-manager
-    labels:
-        app.kubernetes.io/name: cert-manager
-        app.kubernetes.io/component: cloudflare-api-token
-type: Opaque
-data:
-    api-token: ENC[AES256_GCM,data:YdjAxeCqpOuRapujdleSZ4mcqWtnIDOiT4ttohorOX4/pzI1DdytmXSYpISiTpnh73i/+CEr5OpWXeHr5yOZ5lJMf0gN9usR,iv:pNZNxVnWvvMfcOxo0fXyefiI6vW6nIjdFsP/0+el0p0=,tag:V4Zc6zW0PGP5YX8Edd407g==,type:str]
-sops:
-    lastmodified: "2026-08-26T19:28:03Z"
-    mac: ENC[AES256_GCM,data:ovnp+gcpIuMHG3MC4Y9SWpZtj4ilWM3XvJOyuyoecm4DIytQgSAW+lUrqREeOh6MleKF1dT2u3cO8pnqjqn4YaMeHD8dXAV57iBM1d070ySDP8EG+O/eLEjzd/NINglf3PEaBSK9yzemhPkTUlUqVdBn+kHNLX1y+WC+GU0tcaI=,iv:RQUcZ7RU75itmhuZW1NmpH17MHhtd0HI8isSRIKqzCA=,tag:qEm0euMGQOvRjtBS9Sra1A==,type:str]
-    pgp:
-        - created_at: "2026-08-26T19:28:03Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiARAAi83x7L6cxjIV0HETlf3e9oXOQErINQ+VQPJ8Q3VrdoLR
-            Q5t2CVMRRKz6dF+D2NvV4+dxCi4NNNf8qRteSmUeQpfhsonSlOW4ArpgzgFjc5M+
-            HO1jD61C++8ISSTssd6HaifLUeCmvIBJyAtr8BWuXDFuVyRCB2EEQ2wcs9X+HGLz
-            5ertIJQe/rvn3HQVojNwpjVmHR68hiFrF4b4yxNHz7kTY9JRKBzeqflQ4OCz5mdD
-            uXOxR2RukPoxTwjWLcxm791J3iTo9TQxMjI3JaJcmNXiPCy161a3ZDUGVBA1bY+w
-            apa7K8wKobjhVYjZ9ScxA6qS4dQ2Iktchxw/BUZLI8Vv2LT8UrJcUqQS2MoRZCa6
-            XpN7gKAnSDE0RoPJxHlX/2kV3bsVABLlaTS0Fx399iYvHJt3MyNLBIQfr2nMUzLJ
-            0pP/3nBqEo1iUMGfKJhOWIQK8lG0dieVkxInXrM8K75dNqm/gBsPGLwJIdT4GVaX
-            +vkzud5uZNExq1ajXHi1JMG4oCRdXDINoUVLsU2RWHzm41M1vU1UQDUGxPuc4lkb
-            OUl/4yCJ9UQ0wqLdw0O/q2ooay48sH08nNRMsfVIKL+us+ymrBC55VoHIDBwluUd
-            ztVPDJ6He1oNTcKnF2cxaCTrbWPODVTYnAy58DprjXxSRF+3bcb2Ky8loG3ESzDS
-            XAGUpWuWTvFtdvfTe1fmM5jeCtjZNpw6B79akcQuCbnQkKsqg9JRGwIfV048pYTR
-            BWN6UY+oFVUp4arpHbVdi283VsNtFIKr8ibs9t089Q0Yd/K4F9GPU5vTI6q4
-            =emCy
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(data|stringData|.*key|.*crt)$
-    version: 3.10.2

kubernetes/infrastructure/cert-manager/kustomizeconfig.yaml

@@ -1,11 +0,0 @@
-nameReference:
-  - kind: HelmRepository
-    version: v1
-    fieldSpecs:
-      - path: spec/chart/spec/sourceRef/name
-        kind: HelmRelease
-  - kind: Secret
-    version: v1
-    fieldSpecs:
-      - path: spec/valuesFrom/name
-        kind: HelmRelease

kubernetes/infrastructure/cert-manager/values.yaml

@@ -1,92 +0,0 @@
-# Cert-Manager Values
-# Install CRDs as part of the Helm release
-crds:
-    enabled: true
-    keep: true
-# Enable DNS01 challenge providers
-extraArgs:
-    - ENC[AES256_GCM,data:WklAooZiEmMv0a4HuSkzUryQQcZxBMw+EQ5CohnkZVcLOs0e0yTSDA1ZWMzzcFN8+lJv,iv:dCML/TDEhl5iUfF4wHlpsdBiAxUETyvDAsQl3G+45Gc=,tag:tARyDDKB5sNuLOYcWfxEkQ==,type:str]
-# Resource settings
-resources:
-    requests:
-        cpu: 10m
-        memory: 32Mi
-    limits:
-        cpu: 100m
-        memory: 128Mi
-# Tolerate failover nodes
-tolerations:
-    - key: ENC[AES256_GCM,data:SCjKoTipNgof,iv:nvp9VrxZsJWbunDoIzExh40P9e/FIQqBsbPbH8LkooI=,tag:/zF3Vf42U5Pdg4d3akd0xg==,type:str]
-      operator: Equal
-      value: ENC[AES256_GCM,data:hkez1UBYhjA=,iv:KIko5RclWRZHxRG3Er3u7IflHX5ybrcOgBpOTCEGw2M=,tag:Ms7+y3q7Pjawo6L3N3PvlA==,type:str]
-      effect: NoSchedule
-    - key: ENC[AES256_GCM,data:jwng5gCK5pG/bVnybci4V6pWxhegwclLt6jFv5hAP5AonwYeTQ==,iv:E55c6dKHf3ixsBjJhRaz2lqpFRuI3CqjYKSJ0baMIDs=,tag:kE+hKUtHG9T3rgeU/aCbcQ==,type:str]
-      operator: Exists
-      effect: NoSchedule
-webhook:
-    resources:
-        requests:
-            cpu: 10m
-            memory: 32Mi
-        limits:
-            cpu: 100m
-            memory: 128Mi
-    tolerations:
-        - key: ENC[AES256_GCM,data:T6EcMGNo6uJB,iv:slnPrxrfTn2NDZ4nd3bpKl+G3aQEmPIq0/FtcHsy6iE=,tag:8GkbKn2ZA0zKOiDvo/X7FQ==,type:str]
-          operator: Equal
-          value: ENC[AES256_GCM,data:ARfB33JtZvw=,iv:BLlUEDenivmTr/dFddReGwCDZp9yyVRMln68F+AqGyo=,tag:Q7aJUz9TIzntGJhN6KG32g==,type:str]
-          effect: NoSchedule
-        - key: ENC[AES256_GCM,data:pXbWnDdllf4mhbc9E1FpG9SmI2iXjszjTdOm56K4QMkpHlZbcw==,iv:UNVYfOnIu0LeDKq9etRTwn3nCa8u9GdZ40etEYMICMc=,tag:mFRkt3YtmMwF1bRo0SWuLQ==,type:str]
-          operator: Exists
-          effect: NoSchedule
-cainjector:
-    resources:
-        requests:
-            cpu: 10m
-            memory: 32Mi
-        limits:
-            cpu: 100m
-            memory: 128Mi
-    tolerations:
-        - key: ENC[AES256_GCM,data:nENalnOT52oI,iv:Q//78lGQhi74smaqzPLD5rQoIo3/1UaoSHhaenym4do=,tag:keej4Md40ilDQw/ogZ8VXA==,type:str]
-          operator: Equal
-          value: ENC[AES256_GCM,data:P87X+3Q4pIs=,iv:HvJ0o/rvCeEzEunH7cYKSQwrVhE4g6mk3JVifZff6Hs=,tag:UzbzzoK1LIx6Thuw65zLlw==,type:str]
-          effect: NoSchedule
-        - key: ENC[AES256_GCM,data:2QkmTBIHIoKZ9E2paPOE9xjm84QkEhj7at+yV3muPALoiKDVWg==,iv:T1YgyxogBbf2k3GBsQ8Zax3kUtqnmk1aqIjoWz2yC74=,tag:aVri3xZ8PZeFBaG7+YQCXw==,type:str]
-          operator: Exists
-          effect: NoSchedule
-startupapicheck:
-    resources:
-        requests:
-            cpu: 10m
-            memory: 32Mi
-        limits:
-            cpu: 100m
-            memory: 128Mi
-sops:
-    lastmodified: "2026-08-26T19:28:03Z"
-    mac: ENC[AES256_GCM,data:+wrZiehApZjOfmDBophPBkMy6BXaOspsLeWbGDJ4cde20QrLrM1CkPfNM+1E4Wg0+gRw2M8nPOP5HVzAPEkdDSn+RLZQwshCPMjQJweEQz4c/8bIy2KCsKAKbwDKRYaHkgGY344QVASsY9mKgeoYssKmKQ+BxE+vSeHhTqAIOjo=,iv:vsQhlx+g6B9lkDfPiCWNdZb3/zN2vh9C5tICdmMSpq4=,tag:f8Q8tReFgmqlKR8FlOZTcQ==,type:str]
-    pgp:
-        - created_at: "2026-08-26T19:28:03Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ//cnoE4ALPvnSzdhSweCbII9A/D8HeP+AM0Pd6AbXxTCOZ
-            ZOwpBmFUDmA5+RaUheJYbYYEiy31JTjUTlIi3/r5A/42DtmN9EZlUh0B41nMVtwV
-            w9xX937BdPSBEPqpYkA24kBuk4N2p2zHfylCS50z0LH08w5+M9lFAce5GIlHzitn
-            QoBwCvTCV/D9X2hbQ1aqPmGKl739TOSO1QYfwEhWjfZj/fOr0FCwvrSPssL0v2l6
-            1M6KssKp0CaV4JOOPVCeeNYRDroo2KqmGaHbsKTUNWtMoN8fx1w+GiEwPd90UBMM
-            uk/etwdDbUw0QMXuPaRucyTVOjXuGmIDFZsCPkwL2xDEppZUVuY+hnbIw6Mfih11
-            gI+IlQiSByWAICSdJa2usSTtx10Ck01hoOKblE84rq9xzyf/JgnakpPNsS2iJtFr
-            8AJLsLyCLdov6th8O3bCvTYvpYGBBREEz5xlFdohhpWMNd9YXjZ/PglyAyUBhsUi
-            eMvPFguwH7UQc2sZLmXbgrN6vyvnYdqPVhNXZvJqpXbsw/v2evlvZX06J3Tv4xjp
-            XA8+MRrHKnznSgtgZM37fM8KfJRA7u8AWD7rbBeow/hXBF8CaplLhbiTSy0vSnYq
-            bXoxw7x1LfzE3WPm5CcBeENFbVi8f2Hjxd1Vz26E2yaFqD0afFpB9bDjisXzK6vS
-            XgG+x5v87myoWx/uC9hXfEAsmB2Oe7EI+04qCpZIDo7ZGfDO+dj23oU/c6K7P3aU
-            JjkNYSpVlHVvzSqbkFVgYV/+8XhVvDVCC16cFA3VoGYk3EvZqMXT52dP77EyW/U=
-            =io2w
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
-    mac_only_encrypted: true
-    version: 3.10.2

kubernetes/infrastructure/mail/stalwart/kustomization.yaml

@@ -1,14 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: stalwart
-resources:
-  - namespace.yaml
-  - repository.yaml
-  - recovery-admin-secret.yaml
-  - release.yaml
-secretGenerator:
-  - name: stalwart-values
-    files:
-      - values.yaml=values.yaml
-configurations:
-  - kustomizeconfig.yaml

kubernetes/infrastructure/mail/stalwart/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: stalwart

kubernetes/infrastructure/mail/stalwart/recovery-admin-secret.yaml

@@ -1,47 +0,0 @@
-# Recovery / bootstrap administrator credential for Stalwart.
-#
-# This Secret is referenced by:
-#   - recoveryAdmin.existingSecret in the HelmRelease, which injects it into the
-#     Stalwart pod (and the tls-sync sidecar) so the cert-manager certificate can
-#     be pushed to Stalwart via JMAP. Keep it present for the lifetime of the
-#     deployment; the tls-sync sidecar needs it on every cert renewal.
-#
-# The username/password here are ONLY the recovery account.
-apiVersion: v1
-kind: Secret
-metadata:
-    name: stalwart-recovery-admin
-    namespace: stalwart
-    labels:
-        app.kubernetes.io/name: stalwart
-        app.kubernetes.io/component: recovery-admin
-type: Opaque
-stringData:
-    username: ENC[AES256_GCM,data:AB2zGZo=,iv:DShjxCtBagfnqm3oXLj3EVkV/bNEqnYXGJVSN4Jwd+M=,tag:++ig5p1ec7WZU3G6SvOnsg==,type:str]
-    password: ENC[AES256_GCM,data:v0HBWQEiGkpslw==,iv:OUEKmtKJVnXuJwMTyST8ycz6cZ6qvipWPfmxDyCQ+cw=,tag:whNSOquceAh0LxzH77cQdw==,type:str]
-sops:
-    lastmodified: "2026-08-26T19:28:03Z"
-    mac: ENC[AES256_GCM,data:4ts11OGRul28LVfQT6g6tnLmpSaMchaO06j3iYecak7yRqXnzsYyWu/LYweybCgQ20zeyZOnFU7rM/VUpkafueu+KmVrw+HsE1WOzjI4g911BGNEz6DOK8MliFtaYitFwRzJfZE4Fh/M8Wos+aGEs59IR1FsiB0DHbdd57pUYT0=,iv:XkiIh3vRCkKzQ3LNYsTa6HkBYOhblK6hWqiw0O9ufVc=,tag:QMS69yIJDfvM/BnMFvUk4g==,type:str]
-    pgp:
-        - created_at: "2026-08-26T19:28:03Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ//VOfCE4MQxdlmnzN8BYlmlouOePL7E51T4ERhLpTrCpZF
-            5rLhni/YdGDyKtPOm/9nIeF6zr5FCateZdArJx9QVT7xXIs0Tvl2xZpRvDRxHwyt
-            o+zFTUUaUUj8b0V6ZR0jnjPJmhK/iwpTbG4aCBe1rWl+bUwHt25KWtgAfyMtdJ0j
-            SUcuOyjcc/hEUuZeoDNEwxbbWsInA54/hfUjCJU9iLUzC3zc7k+5PpsZfKh4ABIA
-            qSj/+p98a3VrcZLc5VG89z9T0SunBfCX0AmIf2O/xUhUT08IBfGti9XyE2TC7vMQ
-            WxX+sYB4cK+tIDcWAMWipq46iRVhWNS2qjdRS8tUpwoVsVLZSrQiUdIxBtzlJqrm
-            toN36T1b8Vl3XS+LD53oWDJ54YnnSV9oxmBjwNaZ5dGVkz+FoBNqLab8FZ8GZQS4
-            bFJLjbuq4hxvgD6U74PG/feLnxWXjJ6w7t66VqJndo+yqTMSzedM31iNqqp1norm
-            LGjT5QhFkR5NwHdAN1S9AlmMm9tGxIE2GAHKHzPyrvus47PfgaidtA7KyiNtC88X
-            SnSIF9uT0VYR0MjD9nGlW+VAP08KU+9+vqpVDoqE0CbI8hCl7lMOg5Eyzh44Zp42
-            YyRLDqib/IeUKxob3/L4Ia+TWXOp/dEFbfOoKw+CreYUrP8ltrVk5qozlMy9TZfS
-            XgEJztLQbB1pqJEoBL7bA0HOU4VXEyOddAj9BW7hZcV/xk2DwUJjDhcozAjVY0dQ
-            W68Oc/Fm8/c/UHwpBRSfmxofR2kDIygYS3AQavyXfogLWfdulEbDpulqsmu0VLM=
-            =oe+v
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(data|stringData|.*key|.*crt)$
-    version: 3.10.2

kubernetes/infrastructure/mail/stalwart/release.yaml

@@ -1,21 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: stalwart
-  namespace: stalwart
-  annotations:
-    homeprod.io/essential: "true"
-spec:
-  interval: 1m
-  chart:
-    spec:
-      sourceRef:
-        kind: HelmRepository
-        name: stalwart-helm
-        namespace: stalwart
-      chart: stalwart
-      version: "0.7.16"
-      interval: 1m
-  valuesFrom:
-    - kind: Secret
-      name: stalwart-values

kubernetes/infrastructure/mail/stalwart/repository.yaml

@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: stalwart-helm
-  namespace: stalwart
-spec:
-  interval: 1m
-  url: https://kgrubb.github.io/stalwart-helm-chart

kubernetes/infrastructure/mail/stalwart/values.yaml

@@ -1,148 +0,0 @@
-# Stalwart Mail Server - Helm values
-#
-# TLS for the mail listeners is sourced from cert-manager: the
-# mail-vhaudiquet-fr-tls Secret (see certificate.yaml) is mounted into the pod
-# and pushed to Stalwart by the chart's tls-sync sidecar over JMAP, which also
-# calls ReloadTlsCertificates on every cert-manager renewal.
-# Container image
-image:
-    repository: stalwartlabs/stalwart
-    tag: v0.16.20
-    pullPolicy: IfNotPresent
-# Single-node RocksDB deployment.
-replicaCount: 1
-role: ""
-pushShard: ""
-# Recovery / bootstrap administrator.
-# The Secret (stalwart-recovery-admin) is required for the lifetime of the
-# deployment because the tls-sync sidecar authenticates to Stalwart's JMAP API
-# with these credentials on every cert-manager renewal.
-recoveryAdmin:
-    enabled: true
-    username: ENC[AES256_GCM,data:/BGEPaI=,iv:QTV3fDckhrdxI0k43vUY/6Hr15pCcEQostuxcAHEF+g=,tag:nSGTlZJuclizN2AKtfGG0A==,type:str]
-    password: ""
-    existingSecret: ENC[AES256_GCM,data:P/5gC7128OrelglEo5iTGTva45BOI3E=,iv:W0QngumMdOo/LFXdUrMN236CIHaOh8N9cj1wMEtfr3Q=,tag:5QLyu1Yd31YCZfRRYyK+2g==,type:str]
-    usernameKey: username
-    passwordKey: password
-# Recovery mode suspends mail services and exposes only the management listener.
-# Ship production values with this OFF.
-recoveryMode:
-    enabled: false
-    port: 8080
-    logLevel: info
-extraEnv: {}
-extraSecretEnv: {}
-# The bootstrap hook Job provisions a *fresh* domain/accounts/OIDC directory.
-bootstrap:
-    enabled: false
-# cert-manager TLS integration for the mail (SMTP/IMAP/POP3 STARTTLS + implicit
-# TLS) listeners. The Secret below is produced by the Certificate in
-# certificate.yaml (letsencrypt-production, Cloudflare DNS-01).
-mailTls:
-    enabled: true
-    existingSecret: ENC[AES256_GCM,data:Mi40TeV+sRmZaEBMsOI0qgXWkMyNmQ==,iv:ExlgVMe+CONDWLmZY4uze+jhVvXN92zb2ptcLCor3Dw=,tag:4VQ38SxY28yR7kp1u69auw==,type:str]
-    certKey: tls.crt
-    privateKeyKey: tls.key
-    mountPath: /etc/stalwart/tls/ingress
-    hostname: mail.vhaudiquet.fr
-    domain: vhaudiquet.fr
-    # How often the sidecar re-checks the mounted cert for changes.
-    reloadIntervalSeconds: 300
-# config.json contents - ONLY the DataStore object. All other settings
-# (listeners, storage backends, domains, accounts, certs) live in the database
-# and are managed via JMAP/WebUI.
-config:
-    '@type': RocksDb
-    path: /var/lib/stalwart
-# Main Service: ClusterIP. Used by the Ingress for the management WebUI (mgmt)
-# and for in-cluster access. Mail L4 ports are exposed separately via mailService.
-service:
-    type: ClusterIP
-    ports:
-        smtp: 25
-        smtps: 465
-        submission: 587
-        imap: 143
-        imaps: 993
-        pop3: 110
-        pop3s: 995
-        sieve: 4190
-        http: 80
-        https: 443
-        mgmt: 8080
-# Dedicated LoadBalancer for SMTP/IMAP/POP3/Sieve (L4). HTTP/HTTPS/mgmt are NOT
-# exposed here - the WebUI is reached via the Ingress (Traefik) below.
-# The WAN router NAT for 25/465/587/993/995/4190 must be repointed to this IP.
-mailService:
-    enabled: true
-    name: stalwart-mail
-    type: LoadBalancer
-    loadBalancerIP: 10.2.2.5
-    annotations: {}
-# WebUI ingress. TLS is terminated by Caddy at the edge (wildcard cert), so the
-# path is: public -> Caddy (TLS) -> Traefik (HTTP) -> this Ingress -> mgmt:8080.
-# No TLS block here.
-ingress:
-    enabled: true
-    annotations: {}
-    hosts:
-        - host: mail.vhaudiquet.fr
-          paths:
-            - path: /
-              pathType: Prefix
-              portName: mgmt
-    tls: []
-# Persistent volume for the RocksDB data directory.
-persistence:
-    enabled: true
-    accessMode: ReadWriteOnce
-    storageClass: longhorn
-    size: 50Gi
-resources:
-    requests:
-        cpu: 250m
-        memory: 256Mi
-    limits:
-        cpu: "1"
-        memory: 1Gi
-# Override chart defaults to add fsGroupChangePolicy: OnRootMismatch.
-# Without this, kubelet recursively chowns every file in the NFS-backed PVC
-# on every pod start (15k+ RocksDB files), causing multi-minute delays.
-# OnRootMismatch skips the recursive chown if the volume root already
-# has the correct owner (UID 2000).
-podSecurityContext:
-    fsGroup: 2000
-    fsGroupChangePolicy: OnRootMismatch
-    runAsUser: 2000
-    runAsGroup: 2000
-    runAsNonRoot: true
-    seccompProfile:
-        type: RuntimeDefault
-containerSecurityContext: {}
-sops:
-    lastmodified: "2026-08-26T19:28:03Z"
-    mac: ENC[AES256_GCM,data:Fh5vxhnPiSRaC/xMV06GwoNAqfiZYJHFj3xKrWzMwau2aC62JTDkEpmm/UN7w4ILQk05xjUkcoSJF5IcKT6+gjkLRVt8qwiarJDZ3SbwM11x7rm4m0wBTJIMeytq1h68l5mQ9i5yW5bxnBNDpUqaAAmq/Ev0/+6lspXw/kfJTUw=,iv:Tg5ZYPd2bpTN/gu99oJEcl0aKiNtX5xca0MUfzCXILo=,tag:2IKyAEuTjp8QhhUaNb1+5A==,type:str]
-    pgp:
-        - created_at: "2026-08-26T19:28:03Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ/9FX7SR8uKEyIvQYbNb8JdhsMCjbioQc/JMvx9EWjqhIwE
-            WTsntkuZ0874eXO4c/WicYNHtxNmeqHfyt6ByVq7F8qIsHb19u33qkc67tjGG7rh
-            svebMITMYgfqdHOmblLMCAHVoB0tI21nyPbf4POUHUtsP0IogUogY70x2a1wefdS
-            RpH28+VIcKQjK2l7JKIkQ81+CHy4RV50/CzVUOojSOeNPDGtsT+5I3sf7dHuj2jF
-            Ab5MhqXICRDlTj5AXLNfGuymILVjKWytRe5dR02EpuvlLUkHH1hztZQN9TaV92sj
-            kcEz6Qfft/PudcG4iZj6yqbjAoZjoSGEOwH/gRONa5dAamG/QGXFpaf7z6pPKHal
-            TQPidrFADuI7upnb+1xK0rF87FQON+p4py57/H5E+0FueSqXs0MiHgc4mL06IdqR
-            uoOODfpp4G66uxAqBxs6YvEPYxT9yib/keUQli7gFPwRjsZixm2hiwCnDPNR11gZ
-            HjgH3XN9Ba+uELuNIRtU96uWc6HZACrq0PmCvLKgvamDd0LbK7yD1cX7OiD4XCP4
-            G7dllNeAgEUY2ha3xE93cMBDirSlN0LbV+NYFm2MR2IluI1DkaVDqLa3ajoP/7Qp
-            2zop6Mp3QEKWjZrS27eEjHHIcjGqbfvaOI1qXCHGw3elM0XkbKtaMmqV4rwjwjLS
-            XgG9T3aqe9VCK1wyHAdsHsSgjVz+44YgoOXT2HnC4nSNej5xRZBEIfF8YNnCBiY8
-            sLfjNlnSVe6+x1H8VZn4NrXGOz/kwiWpMEMEQuCIbqPJt45GM+GtC1f/gj8eMyo=
-            =IbSO
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
-    mac_only_encrypted: true
-    version: 3.10.2

kubernetes/infrastructure/observability/alloy-config.yaml

@@ -1,68 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: alloy-config
-  namespace: observability
-  labels:
-    app.kubernetes.io/name: alloy
-    app.kubernetes.io/component: log-collector
-data:
-  config.river: |
-    // -----------------------------------------------------------------------------
-    // Grafana Alloy — log collection only (metrics cluster+host collection is
-    // handled by vmagent/node-exporter/cAdvisor elsewhere).
-    // Forwards pod logs to the in-cluster Loki single-binary.
-    // River config produced by `alloy convert -f promtail` from an equivalent
-    // Promtail YAML (so component names and argument shapes are guaranteed
-    // correct for Alloy v1.18).
-    // -----------------------------------------------------------------------------
-
-    discovery.kubernetes "kubernetes_pods" {
-      role = "pod"
-
-      selectors {
-        role  = "pod"
-        field = "spec.nodeName=" + coalesce(sys.env("HOSTNAME"), constants.hostname)
-      }
-    }
-
-    loki.process "kubernetes_pods" {
-      forward_to = [loki.write.default.receiver]
-
-      // CRI-style log lines on the host: {"log":"...","stream":"stdout","time":"..."}
-      stage.cri { }
-    }
-
-    discovery.relabel "kubernetes_pods" {
-      targets = discovery.kubernetes.kubernetes_pods.targets
-
-      rule {
-        source_labels = ["__meta_kubernetes_namespace"]
-        target_label  = "namespace"
-      }
-      rule {
-        source_labels = ["__meta_kubernetes_pod_name"]
-        target_label  = "pod"
-      }
-      rule {
-        source_labels = ["__meta_kubernetes_pod_container_name"]
-        target_label  = "container"
-      }
-    }
-
-    loki.source.file "kubernetes_pods" {
-      targets    = discovery.relabel.kubernetes_pods.output
-      forward_to = [loki.process.kubernetes_pods.receiver]
-
-      file_match {
-        enabled = true
-      }
-      legacy_positions_file = "/tmp/positions.yaml"
-    }
-
-    loki.write "default" {
-      endpoint {
-        url = "http://loki.observability.svc.cluster.local:3100/loki/api/v1/push"
-      }
-      external_labels = {}
-    }

kubernetes/infrastructure/observability/alloy-release.yaml

@@ -1,19 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: alloy
-  namespace: observability
-spec:
-  interval: 1m
-  chart:
-    spec:
-      sourceRef:
-        kind: HelmRepository
-        name: grafana
-        namespace: observability
-      chart: alloy
-      version: "1.11.0"
-      interval: 1m
-  valuesFrom:
-    - kind: Secret
-      name: alloy-values

kubernetes/infrastructure/observability/alloy-values.yaml

@@ -1,58 +0,0 @@
-# Grafana Alloy
-# Runs as a DaemonSet on every node (tolerates the failover taint).
-# Tails pod logs from /var/log/pods, attaches K8s labels (pod, namespace,
-# service, container, image), and pushes them to Loki at
-# http://loki.observability.svc.cluster.local:3100 (in-cluster, no auth).
-# Use the externally provisioned ConfigMap (alloy-config) carrying config.river.
-alloy:
-    configMap:
-        create: false
-        name: alloy-config
-        key: ENC[AES256_GCM,data:RlUaIarJ9nfEU4ou,iv:Fu/T7W9gWVLUQ+/Ts4Lc1VLkmQapRiLyrKp1ph+P8mA=,tag:OFroKnEFq/Q6gXhbU/Bw0w==,type:str]
-    # Mount host log paths so the DaemonSet can tail pod/container logs.
-    mounts:
-        varlog: true
-        dockercontainers: false
-    stabilityLevel: generally-available
-    tolerations:
-        - key: ENC[AES256_GCM,data:M3Vyi8mZ9N/V,iv:SScQdHgTcTKZN7Wq3pGFHU3UE0zO3hIG8dKpRtsj6iY=,tag:QpJjorykGH4i6PCuH/XGRg==,type:str]
-          value: ENC[AES256_GCM,data:BBn840i3iUU=,iv:t3dSOH7Z5DenpqFVbtWZZvjt9sRcff1HiRlRyGKXs2E=,tag:N5VsZN2ZFE9jTqIZ1rYtDA==,type:str]
-          operator: Equal
-          effect: NoSchedule
-        - key: ENC[AES256_GCM,data:jMLashg6LfKAhJBTNbkoGHJhn7okuyHu/itGSOc7z3fBzS+u1g==,iv:pGMyTOP/h6p90mcjYLIHYvZdPdyknWeh8+FlHzd405w=,tag:54qWJeB2qsjnlDqh9iKBOA==,type:str]
-          operator: Exists
-          effect: NoSchedule
-    resources:
-        requests:
-            cpu: 50m
-            memory: 64Mi
-        limits:
-            cpu: 200m
-            memory: 256Mi
-sops:
-    lastmodified: "2026-08-26T19:28:04Z"
-    mac: ENC[AES256_GCM,data:9sMkdDmbNDssQ5kqiRrx+rWCHQx4ZdwTFuA7fvUgKpuIGN39Lg+fCunfRXeZ3uRQRq9gnwOvS3lET9/NyXjRZtv89Il1XZX66AXn3+jlp3L/t420qdGt/jb/m+lAWoB4sFKO2G+y85WVW3lKOerciOS/8uknuTX3Zdo6Z1rsJew=,iv:pHEK9Wj6NRkJaMBvc2/cgUnKT3oBvXAux2OLTFbhT6w=,tag:ww01aBQiNqlTRbwaQr+A/g==,type:str]
-    pgp:
-        - created_at: "2026-08-26T19:28:04Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiARAAvcjaDA3Rf0PYKELD1RJx5PwfZUdLpLDlGML66GsJGtYg
-            GlnhjSHxAmvJOhvCkrSpD2EGSCzAOHzkLdd2pEmhm5sDIpLl82bJm3vEMGCI6iWs
-            pKJmHFlxxVoswnuvHdj5pymvz5sv3m+Z7QtjX50IsTUiSkMA8kLb+KaeEs9/509g
-            Ond815msz4rfv4FmfjFluzxn19IdPSHB9+S2vMUuZ8iccvJ472RQGTzsOcstSk76
-            Do50+pNBV9TAsHT0j09fasSAHEEjU/xvQvFkgctqIfN0L5NiZu5MuJkEtqFUf0DA
-            ccZCmadZRlwsbF3AZw4026ZvHGpg01MNAhBYQyJsZ97U0/droaTbLSgrrkatShcy
-            rGIdn8WamYflzyr/5yAXYotmUroS1K9bWk7lcLsjD5IFKYTJH7k82AwxYETbOb2p
-            k0WxHZ0utfVm6BlKgJkl3NCtyKExXPnpMFXG8yX0PwHLVhtJoKnoRo+J7DYzrT3n
-            YCVF0xm+y5tZc9Uw9986GoctqAslR0SY3UNU+pJefAXIBLo+nw4VTqLDwB5uzPQ8
-            U4cqx6P48pBaP+wGem9Tem+sh+M4z/71hagPFOOLvD2FxLgY5rRYZxzx9yPi2lCl
-            5wU98CFB76r12lcnlreGyGYrQvLM6ZYHbsai8NxP9X3OKeTb36jC3iNpQktGVqTS
-            XgGj/hGBQZb9GfIS7ll+TRVWvDrHsNpymuPCyz56WRc7ZwhPzllSDZqFUCcG3Axz
-            +9lkm0CozmxBgL4GW/UJBv0xftdWyoT0T3PjrNfhnU8Zz+uyyhNnK/ztThZmwr8=
-            =9sVv
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
-    mac_only_encrypted: true
-    version: 3.10.2