Update redis and postgres internal routes

And add smtp-secrets file for apps namespace

charts/gpu-runtime.yaml

@@ -2,9 +2,15 @@ apiVersion: helm.cattle.io/v1
 kind: HelmChart
 metadata:
   name: nvidia-device-plugin
-  namespace: kube-system
+  namespace: charts
 spec:
   chart: nvidia-device-plugin
   repo: https://nvidia.github.io/k8s-device-plugin
   valuesContent: |-
     runtimeClassName: nvidia
+    namespaceOverride: kube-system
+    tolerations:
+      - key: "gpu"
+        value: "true"
+        operator:  "Equal"
+        effect: "NoSchedule"

kustomize/backups/batch.yaml

@@ -0,0 +1,48 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: backup
+spec:
+  schedule: "0 3 * * *"
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          restartPolicy: OnFailure
+          containers:
+            - name: backup
+              image: busybox
+              command:
+                - /bin/bash
+                - -c
+                - |
+                  echo $HEALTHCHECK_BASE_URL/${HEALTHCHECK_ID}
+                  # Start signal
+                  curl -fsS -m 10 --retry 5 ${HEALTHCHECK_BASE_URL}/${HEALTHCHECK_ID}/start
+
+                  # Perform backup
+                  if ! ${BACKUP_COMMAND} | gzip > /backup/${ROTATE_PREFIX}-$(date +%Y%m%d).sql.gz; then
+                    curl -fsS -m 10 --retry 5 ${HEALTHCHECK_BASE_URL}/${HEALTHCHECK_ID}/fail
+                    exit 1
+                  fi
+
+                  # list backups
+                  ls /backup
+                  # Rotate old backups
+                  find /backup -name "${ROTATE_PREFIX}-*.sql.gz" -mtime +7 -delete
+
+                  # Success signal
+                  curl -fsS -m 10 --retry 5 ${HEALTHCHECK_BASE_URL}/${HEALTHCHECK_ID}
+              envFrom:
+                - configMapRef:
+                    name: backup-config
+                - secretRef:
+                    name: core-secrets
+              volumeMounts:
+                - mountPath: /backup
+                  name: backup
+                  subPath: "data"
+          volumes:
+            - name: backup
+              persistentVolumeClaim:
+                claimName: backup-pvc

kustomize/backups/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - batch.yaml
+
+labels:
+  - includeSelectors: true
+    pairs:
+      app.kubernetes.io/managed-by: kustomize

kustomize/deployment/configmap.yaml

@@ -1,5 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: config
-data:

kustomize/deployment/kustomization.yaml

@@ -9,7 +9,6 @@ resources:
   - secret.yaml
   - httproute-http.yaml
   - httproute-https.yaml
-  # - configmap.yaml
 
 labels:
   - includeSelectors: true

kustomize/helmchart-noaddons/helmchart.yaml

@@ -0,0 +1,7 @@
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: chart
+  namespace: charts
+spec:
+  targetNamespace: default

kustomize/helmchart-noaddons/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - helmchart.yaml
+
+labels:
+  - includeSelectors: true
+    pairs:
+      app.kubernetes.io/managed-by: kustomize

kustomize/noservice/configmap.yaml

@@ -1,5 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: config
-data:

kustomize/noservice/kustomization.yaml

@@ -6,7 +6,6 @@ resources:
   - deployment.yaml
   - pvc.yaml
   - secret.yaml
-  # - configmap.yaml
 
 labels:
   - includeSelectors: true

kustomize/statefulset/httproute-http.yaml

@@ -11,10 +11,16 @@ spec:
   hostnames:
     - web.leechpepin.com
   rules:
-    - matches:
+    - filters:
-        - path:
+        - type: RequestHeaderModifier
-            type: PathPrefix
+          requestHeaderModifier:
-            value: /
+            set:
+              - name: "X-Forwarded-Proto"
+                value: "https"
       backendRefs:
         - name: web
           port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /

kustomize/statefulset/kustomization.yaml

@@ -0,0 +1,14 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - statefulset.yaml
+  - service.yaml
+  - httproute-http.yaml
+  - httproute-https.yaml
+  - secret.yaml
+
+labels:
+  - includeSelectors: true
+    pairs:
+      app.kubernetes.io/managed-by: kustomize

kustomize/statefulset/secret.yaml

@@ -0,0 +1,27 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: secrets
+  namespace: infisical
+  labels:
+    label-to-be-passed-to-managed-secret: homelab
+  annotations:
+    example.com/annotation-to-be-passed-to-managed-secret: "homelab"
+spec:
+  hostAPI: https://app.infisical.com/api
+  resyncInterval: 10
+  authentication:
+    # Universal Auth
+    universalAuth:
+      secretsScope:
+        projectSlug: homelab-n-f-yj
+        envSlug: prod
+        secretsPath: "/apps/appname" # Root is "/"
+        recursive: false # Whether or not to use recursive mode (Fetches all secrets in an environment from a given secret path, and all folders inside the path) / defaults to false
+      credentialsRef:
+        secretName: universal-auth-credentials
+        secretNamespace: infisical
+  managedSecretReference:
+    secretName: app-secrets
+    secretNamespace: ns
+    creationPolicy: "Orphan" ## Owner | Orphan

kustomize/statefulset/statefulset.yaml

@@ -0,0 +1,23 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: ss
+  namespace: core
+spec:
+  serviceName: ss-svc
+  replicas: 1
+  template:
+    spec:
+      restartPolicy: Always
+  volumeClaimTemplates:
+    - metadata:
+        name: ss-data
+        annotations:
+          name: ss-data
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        storageClassName: longhorn-private
+        resources:
+          requests:
+            storage: 5Gi

namespaces/ai/ollama/patches/deployment.yaml

@@ -13,7 +13,8 @@ spec:
           effect: "NoSchedule"
       containers:
         - name: ollama
-          image: ollama/ollama:latest
+          image: ollama/ollama:0.5.13
+          imagePullPolicy: IfNotPresent
           resources:
             limits:
               nvidia.com/gpu: 1

namespaces/ai/openwebui/patches/chart.yaml

@@ -12,7 +12,7 @@ spec:
       - https://ollama.leechpepin.com:11434
     websocket:
       enabled: true
-      url: redis://redis.core.svc.cluster.local:6379/0
+      url: redis://redis-svc.core.svc.cluster.local:6379/0
       redis:
         enabled: false
     persistence:
@@ -20,7 +20,7 @@ spec:
       subPath: "data"
       storageClass: longhorn-private
     image:
-      tag: 0.5.10
+      tag: 0.5.20
     extraEnvVars:
       - name: ENABLE_OAUTH_SIGNUP
         value: "true"

namespaces/ai/tabby/config.toml

@@ -13,5 +13,5 @@ api_endpoint = "http://ollama-svc:11434/v1"
 # Embedding model
 [model.embedding.http]
 kind = "ollama/embedding"
-model_name = "ordis/jina-embeddings-v2-base-code"
+model_name = "ordis/jina-embeddings-v2-base-code:latest"
 api_endpoint = "http://ollama-svc:11434"

namespaces/ai/tabby/patches/deployment.yaml

@@ -12,7 +12,8 @@ spec:
           effect: "NoSchedule"
       containers:
         - name: tabby
-          image: tabbyml/tabby:latest
+          image: tabbyml/tabby:0.25.2
+          imagePullPolicy: IfNotPresent
           ports:
             - name: tabby
               containerPort: 8080

namespaces/apps/dolibarr/kustomization.yaml

@@ -0,0 +1,94 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+transformers:
+  - |-
+    apiVersion: builtin
+    kind: NamespaceTransformer
+    metadata:
+      name: notImportantHere
+      namespace: apps
+    unsetOnly: true
+
+namePrefix: dolibarr-
+resources:
+  - ../../../kustomize/public-oidc/
+
+replacements:
+  - source:
+      kind: Service
+      name: svc
+    targets:
+      - select:
+          kind: HTTPRoute
+        options:
+          create: true
+        fieldPaths:
+          - spec.rules.0.backendRefs.0.name
+  - source:
+      kind: Deployment
+      fieldPath: metadata.labels.[app.kubernetes.io/appName]
+    targets:
+      - select:
+          kind: HTTPRoute
+        options:
+          create: true
+          delimiter: "."
+          index: 0
+        fieldPaths:
+          - spec.hostnames.0
+      - select:
+          kind: InfisicalSecret
+        options:
+          delimiter: "-"
+          index: 0
+        fieldPaths:
+          - spec.managedSecretReference.secretName
+      - select:
+          kind: InfisicalSecret
+        options:
+          delimiter: "/"
+          index: 2
+        fieldPaths:
+          - spec.authentication.universalAuth.secretsScope.secretsPath
+      - select:
+          kind: Service
+        fieldPaths:
+          - spec.ports.0.name
+          - spec.ports.0.targetPort
+  - source:
+      kind: Deployment
+      fieldPath: metadata.labels.[app.kubernetes.io/appNamespace]
+    targets:
+      - select:
+          kind: InfisicalSecret
+        fieldPaths:
+          - spec.managedSecretReference.secretNamespace
+
+patches:
+  - path: patches/deployment.yaml
+    target:
+      kind: Deployment
+  - path: patches/pvc.yaml
+    target:
+      kind: PersistentVolumeClaim
+
+labels:
+  - includeSelectors: true
+    pairs:
+      app.kubernetes.io/appName: dolibarr
+  - pairs:
+      app.kubernetes.io/appNamespace: apps
+
+configMapGenerator:
+  - name: config
+    literals:
+      - PHP_INI_DATE_TIMEZONE=America/New_York
+      - DOLI_INSTALL_AUTO=0
+      - DOLI_DB_TYPE=pgsql
+      - DOLI_DB_HOST=postgres-svc.core.svc.cluster.local
+      - DOLI_DB_HOST_PORT=5432
+      - DOLI_DB_USER=dolidbuser
+      - DOLI_COMPANY_NAME="JLP Tech Consulting, LLC"
+      - DOLI_COMPANY_COUNTRYCODE="US"
+      - DOLI_URL_ROOT=https://dolibarr.leechpepin.com

namespaces/apps/dolibarr/patches/deployment.yaml

@@ -0,0 +1,47 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app
+spec:
+  template:
+    spec:
+      containers:
+        - name: dolibarr
+          image: dolibarr/dolibarr:20.0.3
+          envFrom:
+            - configMapRef:
+                name: dolibarr-config
+          env:
+            - name: DOLI_DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: dolibarr-secrets
+                  key: DB_PASSWORD
+                  optional: false
+            - name: DOLI_ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: dolibarr-secrets
+                  key: ADMIN_PASSWORD
+                  optional: false
+            - name: DOLI_INSTANCE_UNIQUE_ID
+              valueFrom:
+                secretKeyRef:
+                  name: dolibarr-secrets
+                  key: SECRET_KEY
+                  optional: false
+          ports:
+            - containerPort: 80
+              protocol: TCP
+              name: dolibarr
+          volumeMounts:
+            - mountPath: /var/www/documents
+              name: dolibarr
+              subPath: "documents"
+            - mountPath: /var/www/html/custom
+              name: dolibarr
+              subPath: html_custom
+      volumes:
+        - name: dolibarr
+          persistentVolumeClaim:
+            claimName: dolibarr-pvc

namespaces/apps/dolibarr/patches/pvc.yaml

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: pvc
+spec:
+  resources:
+    requests:
+      storage: 10Gi

namespaces/apps/forgejo/kustomization.yaml

@@ -100,7 +100,7 @@ configMapGenerator:
       - USER_UID=1000
       - USER_GID=1000
       - FORGEJO__database__DB_TYPE=postgres
-      - FORGEJO__database__HOST=postgres.core.svc.cluster.local:5432
+      - FORGEJO__database__HOST=postgres-svc.core.svc.cluster.local:5432
       - FORGEJO__database__NAME=forgejo
       - FORGEJO__database__USER=forgejo
       - FORGEJO__mailer__ENABLED=true

namespaces/apps/linkwarden/kustomization.yaml

@@ -84,8 +84,8 @@ configMapGenerator:
   - name: config
     literals:
       - NEXTAUTH_URL="https://linkwarden.leechpepin.com/api/v1/auth"
-      - NEXT_PUBLIC_OLLAMA_ENDPOINT_URL="http://ollama.ai.svc.cluster.local:11434"
+      - NEXT_PUBLIC_OLLAMA_ENDPOINT_URL="https://ollama.leechpepin.com:11434"
-      - OLLAMA_MODEL="phi3:mini-4k"
+      - OLLAMA_MODEL="granite3.1-moe:3b"
       - NEXT_PUBLIC_AUTHENTIK_ENABLED="true"
       - AUTHENTIK_CUSTOM_NAME="Authentik"
       - AUTHENTIK_ISSUER="https://auth.leechpepin.com/application/o/linkwarden"

namespaces/apps/mealie/kustomization.yaml

@@ -88,7 +88,7 @@ configMapGenerator:
       # Database Settings
       - DB_ENGINE=postgres
       - POSTGRES_USER=mealie
-      - POSTGRES_SERVER=postgres.core.svc.cluster.local
+      - POSTGRES_SERVER=postgres-svc.core.svc.cluster.local
       - POSTGRES_PORT=5432
       - POSTGRES_DB=mealie
       # Use Ollama

namespaces/apps/paperless/kustomization.yaml

@@ -91,8 +91,8 @@ labels:
 configMapGenerator:
   - name: config
     literals:
-      - PAPERLESS_REDIS=redis://redis.core.svc.cluster.local
+      - PAPERLESS_REDIS=redis://redis-svc.core.svc.cluster.local
-      - PAPERLESS_DBHOST=postgres.core.svc.cluster.local
+      - PAPERLESS_DBHOST=postgres-svc.core.svc.cluster.local
       - PAPERLESS_DBUSER=paperless
       - PAPERLESS_DBNAME=paperlessdb
       - PAPERLESS_TIKA_ENABLED="1"

namespaces/apps/smtp-secrets.yaml

@@ -0,0 +1,28 @@
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: smtp-secrets
+  namespace: infisical
+  labels:
+    label-to-be-passed-to-managed-secret: homelab
+  annotations:
+    example.com/annotation-to-be-passed-to-managed-secret: "homelab"
+spec:
+  hostAPI: https://app.infisical.com/api
+  resyncInterval: 10
+  authentication:
+    # Universal Auth
+    universalAuth:
+      secretsScope:
+        projectSlug: homelab-n-f-yj
+        envSlug: prod
+        secretsPath: "/" # Root is "/"
+        recursive: false # Whether or not to use recursive mode (Fetches all secrets in an environment from a given secret path, and all folders inside the path) / defaults to false
+      credentialsRef:
+        secretName: universal-auth-credentials
+        secretNamespace: infisical
+  managedSecretReference:
+    secretName: smtp-secrets
+    secretNamespace: apps
+    creationPolicy: "Orphan" ## Owner | Orphan
+---

namespaces/apps/vaultwarden/kustomization.yaml

@@ -83,3 +83,10 @@ labels:
 configMapGenerator:
   - name: config
     literals:
+      - SIGNUPS_ALLOWED="false"
+      - PUSH_ENABLED="true"
+      - DOMAIN=https://vaultwarden.leechpepin.com
+      - SMTP_FROM=homelab@leechpepin.com
+      - SMTP_FROM_NAME="Vaultwarden"
+      - SMTP_USERNAME=homelab
+      - SMTP_HOST=blizzard.mxrouting.net

namespaces/apps/vaultwarden/patches/deployment.yaml

@@ -7,7 +7,8 @@ spec:
     spec:
       containers:
         - name: vaultwarden
-          image: vaultwarden/server:latest
+          image: vaultwarden/server:1.33.2
+          imagePullPolicy: IfNotPresent
           envFrom:
             - configMapRef:
                 name: vaultwarden-config

namespaces/cert-manager/cert-manager/kustomization.yaml

@@ -0,0 +1,29 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+transformers:
+  - |-
+    apiVersion: builtin
+    kind: NamespaceTransformer
+    metadata:
+      name: notImportantHere
+      namespace: cert-manager
+    unsetOnly: true
+
+namePrefix: cert-manager-
+resources:
+  - ../../../kustomize/helmchart-noaddons
+  - extras/cloudflare-token.yaml
+
+patches:
+  - path: patches/chart.yaml
+    target:
+      kind: HelmChart
+      name: chart
+
+labels:
+  - includeSelectors: true
+    pairs:
+      app.kubernetes.io/appName: cert-manager
+  - pairs:
+      app.kubernetes.io/appNamespace: cert-manager

namespaces/charts/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    homelab-access: "true"
+  name: charts

namespaces/core/backup-pvc.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: backup-pvc
+  namespace: core
+spec:
+  storageClassName: longhorn-private
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 20Gi

namespaces/core/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    homelab-access: "true"
+  name: core

namespaces/core/pgdump/kustomization.yaml

@@ -0,0 +1,51 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+transformers:
+  - |-
+    apiVersion: builtin
+    kind: NamespaceTransformer
+    metadata:
+      name: notImportantHere
+      namespace: core
+    unsetOnly: true
+
+namePrefix: pgdump-
+resources:
+  - ../../../kustomize/backups/
+
+labels:
+  - includeSelectors: true
+    pairs:
+      app.kubernetes.io/appName: pgdump
+  - pairs:
+      app.kubernetes.io/appNamespace: core
+
+configMapGenerator:
+  - name: config
+    literals:
+      - HEALTHCHECK_BASE_URL="https://healthchecks.leechpepin.com"
+      - HEALTHCHECK_ID="ping/7iBSS9akyokIWq-sbfEjHQ/pgdump"
+      - ROTATE_PREFIX="pgdump"
+      - BACKUP_COMMAND="pg_dumpall -U postgres -h postgres-svc.core -p 5432"
+
+patches:
+  - path: patches/batch.yaml
+    target:
+      kind: CronJob
+      name: backup
+
+replacements:
+  - source:
+      kind: CronJob
+      name: backup
+      fieldPath: metadata.labels.[app.kubernetes.io/appName]
+    targets:
+      - select:
+          kind: CronJob
+          name: backup
+        options:
+          delimiter: "-"
+          index: 0
+        fieldPaths:
+          - spec.jobTemplate.spec.template.spec.containers.0.envFrom.0.configMapRef.name

namespaces/core/pgdump/patches/batch.yaml

@@ -0,0 +1,13 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: backup
+spec:
+  schedule: "0 2 * * *"
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          containers:
+            - name: backup
+              image: cimg/postgres:17.4

namespaces/core/postgres/extras/tcproute.yaml

@@ -0,0 +1,16 @@
+apiVersion: gateway.networking.k8s.io/v1alpha2
+kind: TCPRoute
+metadata:
+  name: tcproute
+  namespace: core
+spec:
+  parentRefs:
+    - name: homelab-gateway
+      sectionName: postgres
+      kind: Gateway
+      namespace: homelab
+  rules:
+    - backendRefs:
+        - name: postgres-svc
+          namespace: core
+          port: 5432

namespaces/core/postgres/kustomization.yaml

@@ -0,0 +1,97 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+transformers:
+  - |-
+    apiVersion: builtin
+    kind: NamespaceTransformer
+    metadata:
+      name: notImportantHere
+      namespace: core
+    unsetOnly: true
+
+namePrefix: postgres-
+resources:
+  - ../../../kustomize/statefulset/
+  - extras/tcproute.yaml
+
+labels:
+  - includeSelectors: true
+    pairs:
+      app.kubernetes.io/appName: postgres
+  - pairs:
+      app.kubernetes.io/appNamespace: core
+
+patches:
+  - path: patches/statefulset.yaml
+    target:
+      kind: StatefulSet
+      name: ss
+  - path: patches/httproutes-delete.yaml
+    target:
+      kind: HTTPRoute
+
+replacements:
+  - source:
+      kind: StatefulSet
+      name: ss
+      fieldPath: metadata.labels.[app.kubernetes.io/appNamespace]
+    targets:
+      - select:
+          kind: InfisicalSecret
+        fieldPaths:
+          - spec.managedSecretReference.secretNamespace
+      - select:
+          kind: InfisicalSecret
+        options:
+          delimiter: "/"
+          index: 1
+        fieldPaths:
+          - spec.authentication.universalAuth.secretsScope.secretsPath
+  - source:
+      kind: StatefulSet
+      name: ss
+      fieldPath: metadata.labels.[app.kubernetes.io/appName]
+    targets:
+      - select:
+          kind: StatefulSet
+        options:
+          delimiter: "-"
+          index: 0
+        fieldPaths:
+          - spec.volumeClaimTemplates.0.metadata.annotations.name
+          - spec.volumeClaimTemplates.0.metadata.name
+          - spec.serviceName
+      - select:
+          kind: InfisicalSecret
+        options:
+          delimiter: "-"
+          index: 0
+        fieldPaths:
+          - spec.managedSecretReference.secretName
+      - select:
+          kind: InfisicalSecret
+        options:
+          delimiter: "/"
+          index: 2
+        fieldPaths:
+          - spec.authentication.universalAuth.secretsScope.secretsPath
+  - source:
+      kind: StatefulSet
+      name: ss
+      fieldPath: spec.template.spec.containers.0.ports.0.name
+    targets:
+      - select:
+          kind: Service
+        fieldPaths:
+          - spec.ports.0.name
+          - spec.ports.0.targetPort
+  - source:
+      kind: StatefulSet
+      name: ss
+      fieldPath: spec.template.spec.containers.0.ports.0.containerPort
+    targets:
+      - select:
+          kind: Service
+        fieldPaths:
+          - spec.ports.0.port

namespaces/core/postgres/patches/httproutes-delete.yaml

@@ -0,0 +1,5 @@
+$patch: delete
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: https

namespaces/core/postgres/patches/statefulset.yaml

@@ -0,0 +1,46 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: app
+spec:
+  template:
+    spec:
+      securityContext:
+        fsGroup: 999
+      containers:
+        - name: postgres
+          image: postgres:17.4
+          ports:
+            - name: postgres
+              containerPort: 5432
+              protocol: TCP
+          volumeMounts:
+            - mountPath: /var/lib/postgresql/data
+              name: postgres-data
+              subPath: "data"
+          env:
+            - name: POSTGRES_USER
+              value: postgres
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  key: ROOT_PASSWORD
+                  name: postgres-secrets
+          startupProbe:
+            exec:
+              command:
+                - /bin/sh
+                - -c
+                - exec pg_isready -U ${POSTGRES_USER}
+          livenessProbe:
+            exec:
+              command:
+                - /bin/sh
+                - -c
+                - exec pg_isready -U ${POSTGRES_USER}
+          readinessProbe:
+            exec:
+              command:
+                - /bin/sh
+                - -c
+                - exec pg_isready -U ${POSTGRES_USER}

namespaces/core/redis/kustomization.yaml

@@ -0,0 +1,112 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+transformers:
+  - |-
+    apiVersion: builtin
+    kind: NamespaceTransformer
+    metadata:
+      name: notImportantHere
+      namespace: core
+    unsetOnly: true
+
+namePrefix: redis-
+resources:
+  - ../../../kustomize/statefulset/
+
+labels:
+  - includeSelectors: true
+    pairs:
+      app.kubernetes.io/appName: redis
+  - pairs:
+      app.kubernetes.io/appNamespace: core
+
+patches:
+  - path: patches/statefulset.yaml
+    target:
+      kind: StatefulSet
+      name: ss
+
+replacements:
+  - source:
+      kind: StatefulSet
+      name: ss
+      fieldPath: metadata.labels.[app.kubernetes.io/appNamespace]
+    targets:
+      - select:
+          kind: InfisicalSecret
+        fieldPaths:
+          - spec.managedSecretReference.secretNamespace
+      - select:
+          kind: InfisicalSecret
+        options:
+          delimiter: "/"
+          index: 1
+        fieldPaths:
+          - spec.authentication.universalAuth.secretsScope.secretsPath
+  - source:
+      kind: StatefulSet
+      name: ss
+      fieldPath: metadata.labels.[app.kubernetes.io/appName]
+    targets:
+      - select:
+          kind: StatefulSet
+        options:
+          delimiter: "-"
+          index: 0
+        fieldPaths:
+          - spec.volumeClaimTemplates.0.metadata.annotations.name
+          - spec.volumeClaimTemplates.0.metadata.name
+          - spec.serviceName
+      - select:
+          kind: InfisicalSecret
+        options:
+          delimiter: "-"
+          index: 0
+        fieldPaths:
+          - spec.managedSecretReference.secretName
+      - select:
+          kind: InfisicalSecret
+        options:
+          delimiter: "/"
+          index: 2
+        fieldPaths:
+          - spec.authentication.universalAuth.secretsScope.secretsPath
+      - select:
+          kind: HTTPRoute
+        options:
+          create: true
+          delimiter: "."
+          index: 0
+        fieldPaths:
+          - spec.hostnames.0
+  - source:
+      kind: StatefulSet
+      name: ss
+      fieldPath: spec.template.spec.containers.0.ports.0.name
+    targets:
+      - select:
+          kind: Service
+        fieldPaths:
+          - spec.ports.0.name
+          - spec.ports.0.targetPort
+  - source:
+      kind: Service
+    targets:
+      - select:
+          kind: HTTPRoute
+        fieldPaths:
+          - spec.rules.0.backendRefs.0.name
+  - source:
+      kind: StatefulSet
+      name: ss
+      fieldPath: spec.template.spec.containers.0.ports.0.containerPort
+    targets:
+      - select:
+          kind: Service
+        fieldPaths:
+          - spec.ports.0.port
+      - select:
+          kind: HTTPRoute
+        fieldPaths:
+          - spec.rules.0.backendRefs.0.port

namespaces/core/redis/patches/statefulset.yaml

@@ -0,0 +1,19 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: app
+spec:
+  template:
+    spec:
+      restartPolicy: Always
+      containers:
+        - name: redis
+          image: redis:7.4.2-alpine3.21
+          ports:
+            - name: redis
+              containerPort: 6379
+              protocol: TCP
+          volumeMounts:
+            - mountPath: /data
+              name: redis-data
+              subPath: "data"

namespaces/core/secrets.yaml

@@ -1,8 +1,7 @@
----
 apiVersion: secrets.infisical.com/v1alpha1
 kind: InfisicalSecret
 metadata:
-  name: homelab-sslcert-secrets
+  name: core-postgres-secrets
   namespace: infisical
   labels:
     label-to-be-passed-to-managed-secret: homelab
@@ -17,17 +16,12 @@ spec:
       secretsScope:
         projectSlug: homelab-n-f-yj
         envSlug: prod
-        secretsPath: "/homelab" # Root is "/"
+        secretsPath: "/core/postgres" # Root is "/"
         recursive: true # Whether or not to use recursive mode (Fetches all secrets in an environment from a given secret path, and all folders inside the path) / defaults to false
       credentialsRef:
         secretName: universal-auth-credentials
         secretNamespace: infisical
   managedSecretReference:
-    secretName: infisical-self-signed-cert
+    secretName: postgres-secrets
-    secretNamespace: homelab
+    secretNamespace: core
     creationPolicy: "Orphan" ## Owner | Orphan
-    secretType: kubernetes.io/tls
-    template:
-      data:
-        tls.crt: "{{ .TLS_CERT.Value }}"
-        tls.key: "{{ .TLS_KEY.Value }}"

namespaces/core/syncthing.yaml

@@ -0,0 +1,91 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: syncthing
+  namespace: core
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      name: syncthing
+  template:
+    metadata:
+      labels:
+        name: syncthing
+    spec:
+      restartPolicy: Always
+      containers:
+        - name: syncthing
+          image: syncthing/syncthing:latest
+          ports:
+            - name: http
+              containerPort: 8384
+              protocol: TCP
+          volumeMounts:
+            - mountPath: /var/syncthing
+              name: syncthing-data
+              subPath: "data"
+          env:
+            - name: PUID
+              value: "976"
+            - name: PGID
+              value: "976"
+      volumes:
+        - name: syncthing-data
+          persistentVolumeClaim:
+            claimName: syncthing-data
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: syncthing-data
+  namespace: core
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn-private
+  resources:
+    requests:
+      storage: 50Gi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: syncthing
+  namespace: core
+spec:
+  type: ClusterIP
+  selector:
+    name: syncthing
+  ports:
+    - port: 8384
+      name: http
+      targetPort: http
+      protocol: TCP
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: syncthing
+  namespace: core
+spec:
+  parentRefs:
+    - name: homelab-gateway
+      sectionName: web
+      kind: Gateway
+      namespace: homelab
+
+  hostnames:
+    - syncthing.leechpepin.local
+
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+
+      backendRefs:
+        - name: syncthing
+          namespace: core
+          port: 8384

namespaces/infisical/infisical/kustomization.yaml

@@ -0,0 +1,28 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+transformers:
+  - |-
+    apiVersion: builtin
+    kind: NamespaceTransformer
+    metadata:
+      name: notImportantHere
+      namespace: infisical
+    unsetOnly: true
+
+namePrefix: infisical-
+resources:
+  - ../../../kustomize/helmchart-noaddons
+
+patches:
+  - path: patches/chart.yaml
+    target:
+      kind: HelmChart
+      name: chart
+
+labels:
+  - includeSelectors: true
+    pairs:
+      app.kubernetes.io/appName: infisical
+  - pairs:
+      app.kubernetes.io/appNamespace: infisical

namespaces/infisical/infisical/patches/chart.yaml

@@ -7,7 +7,6 @@ metadata:
     - wrangler.cattle.io/on-helm-chart-remove
   generation: 1
   name: infisical-install
-  namespace: default
 spec:
   chart: secrets-operator
   repo: https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/

namespaces/infisical/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    homelab-access: "false"
+  name: infisical

namespaces/longhorn-system/longhorn-gateway.yaml

@@ -1,39 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1beta1
-kind: ReferenceGrant
-metadata:
-  name: allow-routes-to-services
-  namespace: longhorn-system
-spec:
-  from:
-    - group: gateway.networking.k8s.io
-      kind: HTTPRoute
-      namespace: traefik
-  to:
-    - group: ""
-      kind: Service
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: longhorn-ui
-  namespace: traefik
-spec:
-  parentRefs:
-    - name: traefik-gateway
-      sectionName: web
-      kind: Gateway
-      namespace: traefik
-
-  hostnames:
-    - longhorn.leechpepin.local
-
-  rules:
-    - matches:
-        - path:
-            type: PathPrefix
-            value: /
-
-      backendRefs:
-        - name: longhorn-frontend
-          namespace: longhorn-system
-          port: 80

namespaces/longhorn-system/storageclasses.yaml

@@ -1,23 +0,0 @@
----
-apiVersion: storage.k8s.io/v1
-kind: StorageClass
-metadata:
-  name: longhorn-private
-provisioner: driver.longhorn.io
-allowVolumeExpansion: true
-parameters:
-  numberOfReplicas: "2"
-  dataLocality: "best-effort"
-  diskSelector: "private"
-  nodeSelector: "private"
----
-apiVersion: storage.k8s.io/v1
-kind: StorageClass
-metadata:
-  name: longhorn-public
-provisioner: driver.longhorn.io
-allowVolumeExpansion: true
-parameters:
-  numberOfReplicas: "2"
-  dataLocality: "best-effort"
-  diskSelector: "public"

namespaces/longhorn/longhorn/extras/longhorn-private-storageclass.yaml

@@ -0,0 +1,12 @@
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: private
+provisioner: driver.longhorn.io
+allowVolumeExpansion: true
+parameters:
+  numberOfReplicas: "2"
+  dataLocality: "best-effort"
+  diskSelector: "private"
+  nodeSelector: "private"

namespaces/longhorn/longhorn/extras/longhorn-public-storageclass.yaml

@@ -0,0 +1,11 @@
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: public
+provisioner: driver.longhorn.io
+allowVolumeExpansion: true
+parameters:
+  numberOfReplicas: "2"
+  dataLocality: "best-effort"
+  diskSelector: "public"

namespaces/longhorn/longhorn/kustomization.yaml

@@ -0,0 +1,99 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+transformers:
+  - |-
+    apiVersion: builtin
+    kind: NamespaceTransformer
+    metadata:
+      name: notImportantHere
+      namespace: longhorn
+    unsetOnly: true
+
+namePrefix: longhorn-
+resources:
+  - ../../../kustomize/helmchart
+  - extras/longhorn-public-storageclass.yaml
+  - extras/longhorn-private-storageclass.yaml
+
+patches:
+  - path: patches/chart.yaml
+    target:
+      kind: HelmChart
+      name: chart
+  - path: patches/secrets.yaml
+    target:
+      kind: InfisicalSecret
+      name: secrets
+
+labels:
+  - includeSelectors: true
+    pairs:
+      app.kubernetes.io/appName: longhorn
+  - pairs:
+      app.kubernetes.io/appNamespace: longhorn
+  - pairs:
+      app.kubernetes.io/chartServiceName: longhorn-frontend
+
+replacements:
+  - source:
+      kind: HTTPRoute
+      name: http
+      fieldPath: metadata.labels.[app.kubernetes.io/chartServiceName]
+    targets:
+      - select:
+          kind: HTTPRoute
+        options:
+          create: true
+          delimiter: "."
+          index: 0
+        fieldPaths:
+          - spec.rules.0.backendRefs.0.name
+  - source:
+      kind: HTTPRoute
+      name: http
+      fieldPath: metadata.labels.[app.kubernetes.io/appName]
+    targets:
+      - select:
+          kind: HTTPRoute
+        options:
+          create: true
+          delimiter: "."
+          index: 0
+        fieldPaths:
+          - spec.hostnames.0
+      - select:
+          kind: InfisicalSecret
+        options:
+          delimiter: "-"
+          index: 0
+        fieldPaths:
+          - spec.managedSecretReference.secretName
+      - select:
+          kind: InfisicalSecret
+        options:
+          delimiter: "/"
+          index: 2
+        fieldPaths:
+          - spec.authentication.universalAuth.secretsScope.secretsPath
+  - source:
+      kind: HTTPRoute
+      name: http
+      fieldPath: metadata.labels.[app.kubernetes.io/appNamespace]
+    targets:
+      - select:
+          kind: HelmChart
+          name: chart
+        fieldPaths:
+          - spec.targetNamespace
+      - select:
+          kind: InfisicalSecret
+        options:
+          delimiter: "/"
+          index: 1
+        fieldPaths:
+          - spec.authentication.universalAuth.secretsScope.secretsPath
+      - select:
+          kind: InfisicalSecret
+        fieldPaths:
+          - spec.managedSecretReference.secretNamespace

namespaces/longhorn/longhorn/patches/chart.yaml

@@ -7,7 +7,6 @@ metadata:
     - wrangler.cattle.io/on-helm-chart-remove
   generation: 1
   name: longhorn-install
-  namespace: default # This should be elsewhere but changing it would delete
 spec:
   version: v1.7.2
   chart: longhorn

namespaces/longhorn/longhorn/patches/secrets.yaml

@@ -0,0 +1,5 @@
+$patch: delete
+apiVersion: secrets.infisical.com/v1alpha1
+kind: InfisicalSecret
+metadata:
+  name: secrets

namespaces/longhorn/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    homelab-access: "true"
+  name: longhorn

namespaces/monitoring/healthchecks/kustomization.yaml

@@ -96,7 +96,7 @@ configMapGenerator:
     literals:
       - ADMINS=jonathan@leechpepin.com
       - DB=postgres
-      - DB_HOST=postgres.core.svc.cluster.local
+      - DB_HOST=postgres-svc.core.svc.cluster.local
       - DB_NAME=hc
       - DB_PORT=5432
       - DB_USER=hc

namespaces/monitoring/umami/kustomization.yaml

@@ -0,0 +1,97 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+transformers:
+  - |-
+    apiVersion: builtin
+    kind: NamespaceTransformer
+    metadata:
+      name: notImportantHere
+      namespace: monitoring
+    unsetOnly: true
+
+namePrefix: umami-
+resources:
+  - ../../../kustomize/public-oidc/
+
+replacements:
+  - source:
+      kind: Service
+      name: svc
+    targets:
+      - select:
+          kind: HTTPRoute
+        options:
+          create: true
+        fieldPaths:
+          - spec.rules.0.backendRefs.0.name
+  - source:
+      kind: Deployment
+      name: app
+      fieldPath: metadata.labels.[app.kubernetes.io/appName]
+    targets:
+      - select:
+          kind: HTTPRoute
+        options:
+          create: true
+          delimiter: "."
+          index: 0
+        fieldPaths:
+          - spec.hostnames.0
+      - select:
+          kind: InfisicalSecret
+        options:
+          delimiter: "-"
+          index: 0
+        fieldPaths:
+          - spec.managedSecretReference.secretName
+      - select:
+          kind: InfisicalSecret
+        options:
+          delimiter: "/"
+          index: 2
+        fieldPaths:
+          - spec.authentication.universalAuth.secretsScope.secretsPath
+      - select:
+          kind: Service
+        fieldPaths:
+          - spec.ports.0.name
+          - spec.ports.0.targetPort
+  - source:
+      kind: Deployment
+      name: app
+      fieldPath: metadata.labels.[app.kubernetes.io/appNamespace]
+    targets:
+      - select:
+          kind: InfisicalSecret
+        fieldPaths:
+          - spec.managedSecretReference.secretNamespace
+      - select:
+          kind: InfisicalSecret
+        options:
+          delimiter: "/"
+          index: 1
+        fieldPaths:
+          - spec.authentication.universalAuth.secretsScope.secretsPath
+
+patches:
+  - path: patches/deployment.yaml
+    target:
+      kind: Deployment
+      name: app
+  - path: patches/delete-pvc.yaml
+    target:
+      kind: PersistentVolumeClaim
+      name: pvc
+
+labels:
+  - includeSelectors: true
+    pairs:
+      app.kubernetes.io/appName: umami
+  - pairs:
+      app.kubernetes.io/appNamespace: monitoring
+
+configMapGenerator:
+  - name: config
+    literals:
+      - DATABASE_TYPE=postgresql

namespaces/monitoring/umami/patches/delete-pvc.yaml

@@ -0,0 +1,5 @@
+$patch: delete
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: pvc

namespaces/monitoring/umami/patches/deployment.yaml

@@ -0,0 +1,42 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: app
+spec:
+  template:
+    spec:
+      tolerations:
+        - key: "public"
+          operator: "Equal"
+          value: "true"
+          effect: "NoSchedule"
+      affinity:
+        nodeAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                  - key: public
+                    operator: In
+                    values:
+                      - "true"
+      containers:
+        - name: umami
+          image: ghcr.io/umami-software/umami:postgresql-v2.17.0
+          envFrom:
+            - configMapRef:
+                name: umami-config
+          env:
+            - name: SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: umami-secrets
+                  key: UMAMI_APP_SECRET
+            - name: DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: umami-secrets
+                  key: UMAMI_POSTGRESQL_CONNECTION
+          ports:
+            - containerPort: 3000
+              name: umami

namespaces/public/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    homelab-access: "true"
+  name: public

namespaces/traefik/namespace.yaml

@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    homelab-access: "true"
+  name: traefik

namespaces/traefik/traefik/kustomization.yaml

@@ -0,0 +1,28 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+transformers:
+  - |-
+    apiVersion: builtin
+    kind: NamespaceTransformer
+    metadata:
+      name: notImportantHere
+      namespace: traefik
+    unsetOnly: true
+
+namePrefix: traefik-lb
+resources:
+  - ../../../kustomize/helmchart-noaddons/
+
+patches:
+  - path: patches/chart.yaml
+    target:
+      kind: HelmChart
+      name: chart
+
+labels:
+  - includeSelectors: true
+    pairs:
+      app.kubernetes.io/appName: traefik-lb
+  - pairs:
+      app.kubernetes.io/appNamespace: traefik

namespaces/traefik/traefik/patches/chart.yaml

@@ -34,6 +34,12 @@ spec:
           default: true
         port: 2222
         exposedPort: 2222
+    service:
+      annotations:
+        svccontroller.k3s.cattle.io/tolerations: |
+          - effect: NoSchedule
+            key: public
+            operator: Exists
     tolerations:
       - key: "public"
         value: "true"