charts/gpu-runtime.yaml

@@ -2,15 +2,9 @@ apiVersion: helm.cattle.io/v1
 kind: HelmChart
 metadata:
   name: nvidia-device-plugin
-  namespace: charts
+  namespace: kube-system
 spec:
   chart: nvidia-device-plugin
   repo: https://nvidia.github.io/k8s-device-plugin
   valuesContent: |-
     runtimeClassName: nvidia
-    namespaceOverride: kube-system
-    tolerations:
-      - key: "gpu"
-        value: "true"
-        operator:  "Equal"
-        effect: "NoSchedule"

charts/infisical.yaml

@@ -7,6 +7,7 @@ metadata:
     - wrangler.cattle.io/on-helm-chart-remove
   generation: 1
   name: infisical-install
+  namespace: default
 spec:
   chart: secrets-operator
   repo: https://dl.cloudsmith.io/public/infisical/helm-charts/helm/charts/

charts/longhorn.yaml

@@ -7,6 +7,7 @@ metadata:
     - wrangler.cattle.io/on-helm-chart-remove
   generation: 1
   name: longhorn-install
+  namespace: default # This should be elsewhere but changing it would delete
 spec:
   version: v1.7.2
   chart: longhorn

charts/traefik.yaml

@@ -34,12 +34,6 @@ spec:
           default: true
         port: 2222
         exposedPort: 2222
-    service:
-      annotations:
-        svccontroller.k3s.cattle.io/tolerations: |
-          - effect: NoSchedule
-            key: public
-            operator: Exists
     tolerations:
       - key: "public"
         value: "true"

kustomize/backups/batch.yaml

@@ -1,48 +0,0 @@
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: backup
-spec:
-  schedule: "0 3 * * *"
-  jobTemplate:
-    spec:
-      template:
-        spec:
-          restartPolicy: OnFailure
-          containers:
-            - name: backup
-              image: busybox
-              command:
-                - /bin/bash
-                - -c
-                - |
-                  echo $HEALTHCHECK_BASE_URL/${HEALTHCHECK_ID}
-                  # Start signal
-                  curl -fsS -m 10 --retry 5 ${HEALTHCHECK_BASE_URL}/${HEALTHCHECK_ID}/start
-
-                  # Perform backup
-                  if ! ${BACKUP_COMMAND} | gzip > /backup/${ROTATE_PREFIX}-$(date +%Y%m%d).sql.gz; then
-                    curl -fsS -m 10 --retry 5 ${HEALTHCHECK_BASE_URL}/${HEALTHCHECK_ID}/fail
-                    exit 1
-                  fi
-
-                  # list backups
-                  ls /backup
-                  # Rotate old backups
-                  find /backup -name "${ROTATE_PREFIX}-*.sql.gz" -mtime +7 -delete
-
-                  # Success signal
-                  curl -fsS -m 10 --retry 5 ${HEALTHCHECK_BASE_URL}/${HEALTHCHECK_ID}
-              envFrom:
-                - configMapRef:
-                    name: backup-config
-                - secretRef:
-                    name: core-secrets
-              volumeMounts:
-                - mountPath: /backup
-                  name: backup
-                  subPath: "data"
-          volumes:
-            - name: backup
-              persistentVolumeClaim:
-                claimName: backup-pvc

kustomize/backups/kustomization.yaml

@@ -1,9 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - batch.yaml
-
-labels:
-  - includeSelectors: true
-    pairs:
-      app.kubernetes.io/managed-by: kustomize

kustomize/deployment/configmap.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: config
+data:

kustomize/deployment/kustomization.yaml

@@ -9,6 +9,7 @@ resources:
   - secret.yaml
   - httproute-http.yaml
   - httproute-https.yaml
+  # - configmap.yaml
 
 labels:
   - includeSelectors: true

kustomize/helmchart-noaddons/helmchart.yaml

@@ -1,7 +0,0 @@
-apiVersion: helm.cattle.io/v1
-kind: HelmChart
-metadata:
-  name: chart
-  namespace: charts
-spec:
-  targetNamespace: default

kustomize/helmchart-noaddons/kustomization.yaml

@@ -1,10 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - helmchart.yaml
-
-labels:
-  - includeSelectors: true
-    pairs:
-      app.kubernetes.io/managed-by: kustomize

kustomize/noservice/configmap.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: config
+data:

kustomize/noservice/httproute-http.yaml

@@ -11,16 +11,10 @@ spec:
   hostnames:
     - web.leechpepin.com
   rules:
-    - filters:
+    - matches:
-        - type: RequestHeaderModifier
-          requestHeaderModifier:
-            set:
-              - name: "X-Forwarded-Proto"
-                value: "https"
-      backendRefs:
-        - name: web
-          port: 80
-      matches:
         - path:
             type: PathPrefix
             value: /
+      backendRefs:
+        - name: web
+          port: 80

kustomize/noservice/kustomization.yaml

@@ -6,6 +6,7 @@ resources:
   - deployment.yaml
   - pvc.yaml
   - secret.yaml
+  # - configmap.yaml
 
 labels:
   - includeSelectors: true

kustomize/statefulset/kustomization.yaml

@@ -1,14 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - statefulset.yaml
-  - service.yaml
-  - httproute-http.yaml
-  - httproute-https.yaml
-  - secret.yaml
-
-labels:
-  - includeSelectors: true
-    pairs:
-      app.kubernetes.io/managed-by: kustomize

kustomize/statefulset/secret.yaml

@@ -1,27 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: secrets
-  namespace: infisical
-  labels:
-    label-to-be-passed-to-managed-secret: homelab
-  annotations:
-    example.com/annotation-to-be-passed-to-managed-secret: "homelab"
-spec:
-  hostAPI: https://app.infisical.com/api
-  resyncInterval: 10
-  authentication:
-    # Universal Auth
-    universalAuth:
-      secretsScope:
-        projectSlug: homelab-n-f-yj
-        envSlug: prod
-        secretsPath: "/apps/appname" # Root is "/"
-        recursive: false # Whether or not to use recursive mode (Fetches all secrets in an environment from a given secret path, and all folders inside the path) / defaults to false
-      credentialsRef:
-        secretName: universal-auth-credentials
-        secretNamespace: infisical
-  managedSecretReference:
-    secretName: app-secrets
-    secretNamespace: ns
-    creationPolicy: "Orphan" ## Owner | Orphan

kustomize/statefulset/statefulset.yaml

@@ -1,23 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: ss
-  namespace: core
-spec:
-  serviceName: ss-svc
-  replicas: 1
-  template:
-    spec:
-      restartPolicy: Always
-  volumeClaimTemplates:
-    - metadata:
-        name: ss-data
-        annotations:
-          name: ss-data
-      spec:
-        accessModes:
-          - ReadWriteOnce
-        storageClassName: longhorn-private
-        resources:
-          requests:
-            storage: 5Gi

namespaces/ai/ollama/patches/deployment.yaml

@@ -13,8 +13,7 @@ spec:
           effect: "NoSchedule"
       containers:
         - name: ollama
-          image: ollama/ollama:0.5.13
+          image: ollama/ollama:latest
-          imagePullPolicy: IfNotPresent
           resources:
             limits:
               nvidia.com/gpu: 1

namespaces/ai/openwebui/patches/chart.yaml

@@ -12,7 +12,7 @@ spec:
       - https://ollama.leechpepin.com:11434
     websocket:
       enabled: true
-      url: redis://redis-svc.core.svc.cluster.local:6379/0
+      url: redis://redis.core.svc.cluster.local:6379/0
       redis:
         enabled: false
     persistence:
@@ -20,7 +20,7 @@ spec:
       subPath: "data"
       storageClass: longhorn-private
     image:
-      tag: 0.5.20
+      tag: 0.5.10
     extraEnvVars:
       - name: ENABLE_OAUTH_SIGNUP
         value: "true"

namespaces/ai/tabby/config.toml

@@ -13,5 +13,5 @@ api_endpoint = "http://ollama-svc:11434/v1"
 # Embedding model
 [model.embedding.http]
 kind = "ollama/embedding"
-model_name = "ordis/jina-embeddings-v2-base-code:latest"
+model_name = "ordis/jina-embeddings-v2-base-code"
 api_endpoint = "http://ollama-svc:11434"

namespaces/ai/tabby/patches/deployment.yaml

@@ -12,8 +12,7 @@ spec:
           effect: "NoSchedule"
       containers:
         - name: tabby
-          image: tabbyml/tabby:0.25.2
+          image: tabbyml/tabby:latest
-          imagePullPolicy: IfNotPresent
           ports:
             - name: tabby
               containerPort: 8080

namespaces/apps/dolibarr/kustomization.yaml

@@ -1,94 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-transformers:
-  - |-
-    apiVersion: builtin
-    kind: NamespaceTransformer
-    metadata:
-      name: notImportantHere
-      namespace: apps
-    unsetOnly: true
-
-namePrefix: dolibarr-
-resources:
-  - ../../../kustomize/public-oidc/
-
-replacements:
-  - source:
-      kind: Service
-      name: svc
-    targets:
-      - select:
-          kind: HTTPRoute
-        options:
-          create: true
-        fieldPaths:
-          - spec.rules.0.backendRefs.0.name
-  - source:
-      kind: Deployment
-      fieldPath: metadata.labels.[app.kubernetes.io/appName]
-    targets:
-      - select:
-          kind: HTTPRoute
-        options:
-          create: true
-          delimiter: "."
-          index: 0
-        fieldPaths:
-          - spec.hostnames.0
-      - select:
-          kind: InfisicalSecret
-        options:
-          delimiter: "-"
-          index: 0
-        fieldPaths:
-          - spec.managedSecretReference.secretName
-      - select:
-          kind: InfisicalSecret
-        options:
-          delimiter: "/"
-          index: 2
-        fieldPaths:
-          - spec.authentication.universalAuth.secretsScope.secretsPath
-      - select:
-          kind: Service
-        fieldPaths:
-          - spec.ports.0.name
-          - spec.ports.0.targetPort
-  - source:
-      kind: Deployment
-      fieldPath: metadata.labels.[app.kubernetes.io/appNamespace]
-    targets:
-      - select:
-          kind: InfisicalSecret
-        fieldPaths:
-          - spec.managedSecretReference.secretNamespace
-
-patches:
-  - path: patches/deployment.yaml
-    target:
-      kind: Deployment
-  - path: patches/pvc.yaml
-    target:
-      kind: PersistentVolumeClaim
-
-labels:
-  - includeSelectors: true
-    pairs:
-      app.kubernetes.io/appName: dolibarr
-  - pairs:
-      app.kubernetes.io/appNamespace: apps
-
-configMapGenerator:
-  - name: config
-    literals:
-      - PHP_INI_DATE_TIMEZONE=America/New_York
-      - DOLI_INSTALL_AUTO=0
-      - DOLI_DB_TYPE=pgsql
-      - DOLI_DB_HOST=postgres-svc.core.svc.cluster.local
-      - DOLI_DB_HOST_PORT=5432
-      - DOLI_DB_USER=dolidbuser
-      - DOLI_COMPANY_NAME="JLP Tech Consulting, LLC"
-      - DOLI_COMPANY_COUNTRYCODE="US"
-      - DOLI_URL_ROOT=https://dolibarr.leechpepin.com

namespaces/apps/dolibarr/patches/deployment.yaml

@@ -1,47 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: app
-spec:
-  template:
-    spec:
-      containers:
-        - name: dolibarr
-          image: dolibarr/dolibarr:20.0.3
-          envFrom:
-            - configMapRef:
-                name: dolibarr-config
-          env:
-            - name: DOLI_DB_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: dolibarr-secrets
-                  key: DB_PASSWORD
-                  optional: false
-            - name: DOLI_ADMIN_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: dolibarr-secrets
-                  key: ADMIN_PASSWORD
-                  optional: false
-            - name: DOLI_INSTANCE_UNIQUE_ID
-              valueFrom:
-                secretKeyRef:
-                  name: dolibarr-secrets
-                  key: SECRET_KEY
-                  optional: false
-          ports:
-            - containerPort: 80
-              protocol: TCP
-              name: dolibarr
-          volumeMounts:
-            - mountPath: /var/www/documents
-              name: dolibarr
-              subPath: "documents"
-            - mountPath: /var/www/html/custom
-              name: dolibarr
-              subPath: html_custom
-      volumes:
-        - name: dolibarr
-          persistentVolumeClaim:
-            claimName: dolibarr-pvc

namespaces/apps/dolibarr/patches/pvc.yaml

@@ -1,8 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: pvc
-spec:
-  resources:
-    requests:
-      storage: 10Gi

namespaces/apps/forgejo/kustomization.yaml

@@ -100,7 +100,7 @@ configMapGenerator:
       - USER_UID=1000
       - USER_GID=1000
       - FORGEJO__database__DB_TYPE=postgres
-      - FORGEJO__database__HOST=postgres-svc.core.svc.cluster.local:5432
+      - FORGEJO__database__HOST=postgres.core.svc.cluster.local:5432
       - FORGEJO__database__NAME=forgejo
       - FORGEJO__database__USER=forgejo
       - FORGEJO__mailer__ENABLED=true

namespaces/apps/linkwarden/kustomization.yaml

@@ -84,8 +84,8 @@ configMapGenerator:
   - name: config
     literals:
       - NEXTAUTH_URL="https://linkwarden.leechpepin.com/api/v1/auth"
-      - NEXT_PUBLIC_OLLAMA_ENDPOINT_URL="https://ollama.leechpepin.com:11434"
+      - NEXT_PUBLIC_OLLAMA_ENDPOINT_URL="http://ollama.ai.svc.cluster.local:11434"
-      - OLLAMA_MODEL="granite3.1-moe:3b"
+      - OLLAMA_MODEL="phi3:mini-4k"
       - NEXT_PUBLIC_AUTHENTIK_ENABLED="true"
       - AUTHENTIK_CUSTOM_NAME="Authentik"
       - AUTHENTIK_ISSUER="https://auth.leechpepin.com/application/o/linkwarden"

namespaces/apps/mealie/kustomization.yaml

@@ -88,7 +88,7 @@ configMapGenerator:
       # Database Settings
       - DB_ENGINE=postgres
       - POSTGRES_USER=mealie
-      - POSTGRES_SERVER=postgres-svc.core.svc.cluster.local
+      - POSTGRES_SERVER=postgres.core.svc.cluster.local
       - POSTGRES_PORT=5432
       - POSTGRES_DB=mealie
       # Use Ollama

namespaces/apps/paperless/kustomization.yaml

@@ -91,8 +91,8 @@ labels:
 configMapGenerator:
   - name: config
     literals:
-      - PAPERLESS_REDIS=redis://redis-svc.core.svc.cluster.local
+      - PAPERLESS_REDIS=redis://redis.core.svc.cluster.local
-      - PAPERLESS_DBHOST=postgres-svc.core.svc.cluster.local
+      - PAPERLESS_DBHOST=postgres.core.svc.cluster.local
       - PAPERLESS_DBUSER=paperless
       - PAPERLESS_DBNAME=paperlessdb
       - PAPERLESS_TIKA_ENABLED="1"

namespaces/apps/smtp-secrets.yaml

@@ -1,28 +0,0 @@
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: smtp-secrets
-  namespace: infisical
-  labels:
-    label-to-be-passed-to-managed-secret: homelab
-  annotations:
-    example.com/annotation-to-be-passed-to-managed-secret: "homelab"
-spec:
-  hostAPI: https://app.infisical.com/api
-  resyncInterval: 10
-  authentication:
-    # Universal Auth
-    universalAuth:
-      secretsScope:
-        projectSlug: homelab-n-f-yj
-        envSlug: prod
-        secretsPath: "/" # Root is "/"
-        recursive: false # Whether or not to use recursive mode (Fetches all secrets in an environment from a given secret path, and all folders inside the path) / defaults to false
-      credentialsRef:
-        secretName: universal-auth-credentials
-        secretNamespace: infisical
-  managedSecretReference:
-    secretName: smtp-secrets
-    secretNamespace: apps
-    creationPolicy: "Orphan" ## Owner | Orphan
----

namespaces/apps/vaultwarden/kustomization.yaml

@@ -83,10 +83,3 @@ labels:
 configMapGenerator:
   - name: config
     literals:
-      - SIGNUPS_ALLOWED="false"
-      - PUSH_ENABLED="true"
-      - DOMAIN=https://vaultwarden.leechpepin.com
-      - SMTP_FROM=homelab@leechpepin.com
-      - SMTP_FROM_NAME="Vaultwarden"
-      - SMTP_USERNAME=homelab
-      - SMTP_HOST=blizzard.mxrouting.net

namespaces/apps/vaultwarden/patches/deployment.yaml

@@ -7,8 +7,7 @@ spec:
     spec:
       containers:
         - name: vaultwarden
-          image: vaultwarden/server:1.33.2
+          image: vaultwarden/server:latest
-          imagePullPolicy: IfNotPresent
           envFrom:
             - configMapRef:
                 name: vaultwarden-config

namespaces/cert-manager/cert-manager/kustomization.yaml

@@ -1,29 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-transformers:
-  - |-
-    apiVersion: builtin
-    kind: NamespaceTransformer
-    metadata:
-      name: notImportantHere
-      namespace: cert-manager
-    unsetOnly: true
-
-namePrefix: cert-manager-
-resources:
-  - ../../../kustomize/helmchart-noaddons
-  - extras/cloudflare-token.yaml
-
-patches:
-  - path: patches/chart.yaml
-    target:
-      kind: HelmChart
-      name: chart
-
-labels:
-  - includeSelectors: true
-    pairs:
-      app.kubernetes.io/appName: cert-manager
-  - pairs:
-      app.kubernetes.io/appNamespace: cert-manager

namespaces/charts/namespace.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  labels:
-    homelab-access: "true"
-  name: charts

namespaces/core/backup-pvc.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: backup-pvc
-  namespace: core
-spec:
-  storageClassName: longhorn-private
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 20Gi

namespaces/core/namespace.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  labels:
-    homelab-access: "true"
-  name: core

namespaces/core/pgdump/kustomization.yaml

@@ -1,51 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-transformers:
-  - |-
-    apiVersion: builtin
-    kind: NamespaceTransformer
-    metadata:
-      name: notImportantHere
-      namespace: core
-    unsetOnly: true
-
-namePrefix: pgdump-
-resources:
-  - ../../../kustomize/backups/
-
-labels:
-  - includeSelectors: true
-    pairs:
-      app.kubernetes.io/appName: pgdump
-  - pairs:
-      app.kubernetes.io/appNamespace: core
-
-configMapGenerator:
-  - name: config
-    literals:
-      - HEALTHCHECK_BASE_URL="https://healthchecks.leechpepin.com"
-      - HEALTHCHECK_ID="ping/7iBSS9akyokIWq-sbfEjHQ/pgdump"
-      - ROTATE_PREFIX="pgdump"
-      - BACKUP_COMMAND="pg_dumpall -U postgres -h postgres-svc.core -p 5432"
-
-patches:
-  - path: patches/batch.yaml
-    target:
-      kind: CronJob
-      name: backup
-
-replacements:
-  - source:
-      kind: CronJob
-      name: backup
-      fieldPath: metadata.labels.[app.kubernetes.io/appName]
-    targets:
-      - select:
-          kind: CronJob
-          name: backup
-        options:
-          delimiter: "-"
-          index: 0
-        fieldPaths:
-          - spec.jobTemplate.spec.template.spec.containers.0.envFrom.0.configMapRef.name

namespaces/core/pgdump/patches/batch.yaml

@@ -1,13 +0,0 @@
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: backup
-spec:
-  schedule: "0 2 * * *"
-  jobTemplate:
-    spec:
-      template:
-        spec:
-          containers:
-            - name: backup
-              image: cimg/postgres:17.4

namespaces/core/postgres/extras/tcproute.yaml

@@ -1,16 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1alpha2
-kind: TCPRoute
-metadata:
-  name: tcproute
-  namespace: core
-spec:
-  parentRefs:
-    - name: homelab-gateway
-      sectionName: postgres
-      kind: Gateway
-      namespace: homelab
-  rules:
-    - backendRefs:
-        - name: postgres-svc
-          namespace: core
-          port: 5432

namespaces/core/postgres/kustomization.yaml

@@ -1,97 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-transformers:
-  - |-
-    apiVersion: builtin
-    kind: NamespaceTransformer
-    metadata:
-      name: notImportantHere
-      namespace: core
-    unsetOnly: true
-
-namePrefix: postgres-
-resources:
-  - ../../../kustomize/statefulset/
-  - extras/tcproute.yaml
-
-labels:
-  - includeSelectors: true
-    pairs:
-      app.kubernetes.io/appName: postgres
-  - pairs:
-      app.kubernetes.io/appNamespace: core
-
-patches:
-  - path: patches/statefulset.yaml
-    target:
-      kind: StatefulSet
-      name: ss
-  - path: patches/httproutes-delete.yaml
-    target:
-      kind: HTTPRoute
-
-replacements:
-  - source:
-      kind: StatefulSet
-      name: ss
-      fieldPath: metadata.labels.[app.kubernetes.io/appNamespace]
-    targets:
-      - select:
-          kind: InfisicalSecret
-        fieldPaths:
-          - spec.managedSecretReference.secretNamespace
-      - select:
-          kind: InfisicalSecret
-        options:
-          delimiter: "/"
-          index: 1
-        fieldPaths:
-          - spec.authentication.universalAuth.secretsScope.secretsPath
-  - source:
-      kind: StatefulSet
-      name: ss
-      fieldPath: metadata.labels.[app.kubernetes.io/appName]
-    targets:
-      - select:
-          kind: StatefulSet
-        options:
-          delimiter: "-"
-          index: 0
-        fieldPaths:
-          - spec.volumeClaimTemplates.0.metadata.annotations.name
-          - spec.volumeClaimTemplates.0.metadata.name
-          - spec.serviceName
-      - select:
-          kind: InfisicalSecret
-        options:
-          delimiter: "-"
-          index: 0
-        fieldPaths:
-          - spec.managedSecretReference.secretName
-      - select:
-          kind: InfisicalSecret
-        options:
-          delimiter: "/"
-          index: 2
-        fieldPaths:
-          - spec.authentication.universalAuth.secretsScope.secretsPath
-  - source:
-      kind: StatefulSet
-      name: ss
-      fieldPath: spec.template.spec.containers.0.ports.0.name
-    targets:
-      - select:
-          kind: Service
-        fieldPaths:
-          - spec.ports.0.name
-          - spec.ports.0.targetPort
-  - source:
-      kind: StatefulSet
-      name: ss
-      fieldPath: spec.template.spec.containers.0.ports.0.containerPort
-    targets:
-      - select:
-          kind: Service
-        fieldPaths:
-          - spec.ports.0.port

namespaces/core/postgres/patches/httproutes-delete.yaml

@@ -1,5 +0,0 @@
-$patch: delete
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: https

namespaces/core/postgres/patches/statefulset.yaml

@@ -1,46 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: app
-spec:
-  template:
-    spec:
-      securityContext:
-        fsGroup: 999
-      containers:
-        - name: postgres
-          image: postgres:17.4
-          ports:
-            - name: postgres
-              containerPort: 5432
-              protocol: TCP
-          volumeMounts:
-            - mountPath: /var/lib/postgresql/data
-              name: postgres-data
-              subPath: "data"
-          env:
-            - name: POSTGRES_USER
-              value: postgres
-            - name: POSTGRES_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  key: ROOT_PASSWORD
-                  name: postgres-secrets
-          startupProbe:
-            exec:
-              command:
-                - /bin/sh
-                - -c
-                - exec pg_isready -U ${POSTGRES_USER}
-          livenessProbe:
-            exec:
-              command:
-                - /bin/sh
-                - -c
-                - exec pg_isready -U ${POSTGRES_USER}
-          readinessProbe:
-            exec:
-              command:
-                - /bin/sh
-                - -c
-                - exec pg_isready -U ${POSTGRES_USER}

namespaces/core/redis/kustomization.yaml

@@ -1,112 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-transformers:
-  - |-
-    apiVersion: builtin
-    kind: NamespaceTransformer
-    metadata:
-      name: notImportantHere
-      namespace: core
-    unsetOnly: true
-
-namePrefix: redis-
-resources:
-  - ../../../kustomize/statefulset/
-
-labels:
-  - includeSelectors: true
-    pairs:
-      app.kubernetes.io/appName: redis
-  - pairs:
-      app.kubernetes.io/appNamespace: core
-
-patches:
-  - path: patches/statefulset.yaml
-    target:
-      kind: StatefulSet
-      name: ss
-
-replacements:
-  - source:
-      kind: StatefulSet
-      name: ss
-      fieldPath: metadata.labels.[app.kubernetes.io/appNamespace]
-    targets:
-      - select:
-          kind: InfisicalSecret
-        fieldPaths:
-          - spec.managedSecretReference.secretNamespace
-      - select:
-          kind: InfisicalSecret
-        options:
-          delimiter: "/"
-          index: 1
-        fieldPaths:
-          - spec.authentication.universalAuth.secretsScope.secretsPath
-  - source:
-      kind: StatefulSet
-      name: ss
-      fieldPath: metadata.labels.[app.kubernetes.io/appName]
-    targets:
-      - select:
-          kind: StatefulSet
-        options:
-          delimiter: "-"
-          index: 0
-        fieldPaths:
-          - spec.volumeClaimTemplates.0.metadata.annotations.name
-          - spec.volumeClaimTemplates.0.metadata.name
-          - spec.serviceName
-      - select:
-          kind: InfisicalSecret
-        options:
-          delimiter: "-"
-          index: 0
-        fieldPaths:
-          - spec.managedSecretReference.secretName
-      - select:
-          kind: InfisicalSecret
-        options:
-          delimiter: "/"
-          index: 2
-        fieldPaths:
-          - spec.authentication.universalAuth.secretsScope.secretsPath
-      - select:
-          kind: HTTPRoute
-        options:
-          create: true
-          delimiter: "."
-          index: 0
-        fieldPaths:
-          - spec.hostnames.0
-  - source:
-      kind: StatefulSet
-      name: ss
-      fieldPath: spec.template.spec.containers.0.ports.0.name
-    targets:
-      - select:
-          kind: Service
-        fieldPaths:
-          - spec.ports.0.name
-          - spec.ports.0.targetPort
-  - source:
-      kind: Service
-    targets:
-      - select:
-          kind: HTTPRoute
-        fieldPaths:
-          - spec.rules.0.backendRefs.0.name
-  - source:
-      kind: StatefulSet
-      name: ss
-      fieldPath: spec.template.spec.containers.0.ports.0.containerPort
-    targets:
-      - select:
-          kind: Service
-        fieldPaths:
-          - spec.ports.0.port
-      - select:
-          kind: HTTPRoute
-        fieldPaths:
-          - spec.rules.0.backendRefs.0.port

namespaces/core/redis/patches/statefulset.yaml

@@ -1,19 +0,0 @@
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: app
-spec:
-  template:
-    spec:
-      restartPolicy: Always
-      containers:
-        - name: redis
-          image: redis:7.4.2-alpine3.21
-          ports:
-            - name: redis
-              containerPort: 6379
-              protocol: TCP
-          volumeMounts:
-            - mountPath: /data
-              name: redis-data
-              subPath: "data"

namespaces/core/syncthing.yaml

@@ -1,91 +0,0 @@
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: syncthing
-  namespace: core
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      name: syncthing
-  template:
-    metadata:
-      labels:
-        name: syncthing
-    spec:
-      restartPolicy: Always
-      containers:
-        - name: syncthing
-          image: syncthing/syncthing:latest
-          ports:
-            - name: http
-              containerPort: 8384
-              protocol: TCP
-          volumeMounts:
-            - mountPath: /var/syncthing
-              name: syncthing-data
-              subPath: "data"
-          env:
-            - name: PUID
-              value: "976"
-            - name: PGID
-              value: "976"
-      volumes:
-        - name: syncthing-data
-          persistentVolumeClaim:
-            claimName: syncthing-data
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: syncthing-data
-  namespace: core
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn-private
-  resources:
-    requests:
-      storage: 50Gi
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: syncthing
-  namespace: core
-spec:
-  type: ClusterIP
-  selector:
-    name: syncthing
-  ports:
-    - port: 8384
-      name: http
-      targetPort: http
-      protocol: TCP
----
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: syncthing
-  namespace: core
-spec:
-  parentRefs:
-    - name: homelab-gateway
-      sectionName: web
-      kind: Gateway
-      namespace: homelab
-
-  hostnames:
-    - syncthing.leechpepin.local
-
-  rules:
-    - matches:
-        - path:
-            type: PathPrefix
-            value: /
-
-      backendRefs:
-        - name: syncthing
-          namespace: core
-          port: 8384

namespaces/homelab/secrets.yaml

@@ -1,7 +1,8 @@
+---
 apiVersion: secrets.infisical.com/v1alpha1
 kind: InfisicalSecret
 metadata:
-  name: core-postgres-secrets
+  name: homelab-sslcert-secrets
   namespace: infisical
   labels:
     label-to-be-passed-to-managed-secret: homelab
@@ -16,12 +17,17 @@ spec:
       secretsScope:
         projectSlug: homelab-n-f-yj
         envSlug: prod
-        secretsPath: "/core/postgres" # Root is "/"
+        secretsPath: "/homelab" # Root is "/"
         recursive: true # Whether or not to use recursive mode (Fetches all secrets in an environment from a given secret path, and all folders inside the path) / defaults to false
       credentialsRef:
         secretName: universal-auth-credentials
         secretNamespace: infisical
   managedSecretReference:
-    secretName: postgres-secrets
+    secretName: infisical-self-signed-cert
-    secretNamespace: core
+    secretNamespace: homelab
     creationPolicy: "Orphan" ## Owner | Orphan
+    secretType: kubernetes.io/tls
+    template:
+      data:
+        tls.crt: "{{ .TLS_CERT.Value }}"
+        tls.key: "{{ .TLS_KEY.Value }}"

namespaces/infisical/infisical/kustomization.yaml

@@ -1,28 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-transformers:
-  - |-
-    apiVersion: builtin
-    kind: NamespaceTransformer
-    metadata:
-      name: notImportantHere
-      namespace: infisical
-    unsetOnly: true
-
-namePrefix: infisical-
-resources:
-  - ../../../kustomize/helmchart-noaddons
-
-patches:
-  - path: patches/chart.yaml
-    target:
-      kind: HelmChart
-      name: chart
-
-labels:
-  - includeSelectors: true
-    pairs:
-      app.kubernetes.io/appName: infisical
-  - pairs:
-      app.kubernetes.io/appNamespace: infisical

namespaces/infisical/namespace.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  labels:
-    homelab-access: "false"
-  name: infisical

namespaces/longhorn-system/longhorn-gateway.yaml

@@ -0,0 +1,39 @@
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: ReferenceGrant
+metadata:
+  name: allow-routes-to-services
+  namespace: longhorn-system
+spec:
+  from:
+    - group: gateway.networking.k8s.io
+      kind: HTTPRoute
+      namespace: traefik
+  to:
+    - group: ""
+      kind: Service
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: longhorn-ui
+  namespace: traefik
+spec:
+  parentRefs:
+    - name: traefik-gateway
+      sectionName: web
+      kind: Gateway
+      namespace: traefik
+
+  hostnames:
+    - longhorn.leechpepin.local
+
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+
+      backendRefs:
+        - name: longhorn-frontend
+          namespace: longhorn-system
+          port: 80

namespaces/longhorn-system/storageclasses.yaml

@@ -0,0 +1,23 @@
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: longhorn-private
+provisioner: driver.longhorn.io
+allowVolumeExpansion: true
+parameters:
+  numberOfReplicas: "2"
+  dataLocality: "best-effort"
+  diskSelector: "private"
+  nodeSelector: "private"
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: longhorn-public
+provisioner: driver.longhorn.io
+allowVolumeExpansion: true
+parameters:
+  numberOfReplicas: "2"
+  dataLocality: "best-effort"
+  diskSelector: "public"

namespaces/longhorn/longhorn/extras/longhorn-private-storageclass.yaml

@@ -1,12 +0,0 @@
----
-apiVersion: storage.k8s.io/v1
-kind: StorageClass
-metadata:
-  name: private
-provisioner: driver.longhorn.io
-allowVolumeExpansion: true
-parameters:
-  numberOfReplicas: "2"
-  dataLocality: "best-effort"
-  diskSelector: "private"
-  nodeSelector: "private"

namespaces/longhorn/longhorn/extras/longhorn-public-storageclass.yaml

@@ -1,11 +0,0 @@
----
-apiVersion: storage.k8s.io/v1
-kind: StorageClass
-metadata:
-  name: public
-provisioner: driver.longhorn.io
-allowVolumeExpansion: true
-parameters:
-  numberOfReplicas: "2"
-  dataLocality: "best-effort"
-  diskSelector: "public"

namespaces/longhorn/longhorn/kustomization.yaml

@@ -1,99 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-transformers:
-  - |-
-    apiVersion: builtin
-    kind: NamespaceTransformer
-    metadata:
-      name: notImportantHere
-      namespace: longhorn
-    unsetOnly: true
-
-namePrefix: longhorn-
-resources:
-  - ../../../kustomize/helmchart
-  - extras/longhorn-public-storageclass.yaml
-  - extras/longhorn-private-storageclass.yaml
-
-patches:
-  - path: patches/chart.yaml
-    target:
-      kind: HelmChart
-      name: chart
-  - path: patches/secrets.yaml
-    target:
-      kind: InfisicalSecret
-      name: secrets
-
-labels:
-  - includeSelectors: true
-    pairs:
-      app.kubernetes.io/appName: longhorn
-  - pairs:
-      app.kubernetes.io/appNamespace: longhorn
-  - pairs:
-      app.kubernetes.io/chartServiceName: longhorn-frontend
-
-replacements:
-  - source:
-      kind: HTTPRoute
-      name: http
-      fieldPath: metadata.labels.[app.kubernetes.io/chartServiceName]
-    targets:
-      - select:
-          kind: HTTPRoute
-        options:
-          create: true
-          delimiter: "."
-          index: 0
-        fieldPaths:
-          - spec.rules.0.backendRefs.0.name
-  - source:
-      kind: HTTPRoute
-      name: http
-      fieldPath: metadata.labels.[app.kubernetes.io/appName]
-    targets:
-      - select:
-          kind: HTTPRoute
-        options:
-          create: true
-          delimiter: "."
-          index: 0
-        fieldPaths:
-          - spec.hostnames.0
-      - select:
-          kind: InfisicalSecret
-        options:
-          delimiter: "-"
-          index: 0
-        fieldPaths:
-          - spec.managedSecretReference.secretName
-      - select:
-          kind: InfisicalSecret
-        options:
-          delimiter: "/"
-          index: 2
-        fieldPaths:
-          - spec.authentication.universalAuth.secretsScope.secretsPath
-  - source:
-      kind: HTTPRoute
-      name: http
-      fieldPath: metadata.labels.[app.kubernetes.io/appNamespace]
-    targets:
-      - select:
-          kind: HelmChart
-          name: chart
-        fieldPaths:
-          - spec.targetNamespace
-      - select:
-          kind: InfisicalSecret
-        options:
-          delimiter: "/"
-          index: 1
-        fieldPaths:
-          - spec.authentication.universalAuth.secretsScope.secretsPath
-      - select:
-          kind: InfisicalSecret
-        fieldPaths:
-          - spec.managedSecretReference.secretNamespace

namespaces/longhorn/longhorn/patches/secrets.yaml

@@ -1,5 +0,0 @@
-$patch: delete
-apiVersion: secrets.infisical.com/v1alpha1
-kind: InfisicalSecret
-metadata:
-  name: secrets

namespaces/longhorn/namespace.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  labels:
-    homelab-access: "true"
-  name: longhorn

namespaces/monitoring/healthchecks/kustomization.yaml

@@ -96,7 +96,7 @@ configMapGenerator:
     literals:
       - ADMINS=jonathan@leechpepin.com
       - DB=postgres
-      - DB_HOST=postgres-svc.core.svc.cluster.local
+      - DB_HOST=postgres.core.svc.cluster.local
       - DB_NAME=hc
       - DB_PORT=5432
       - DB_USER=hc

namespaces/monitoring/umami/kustomization.yaml

@@ -1,97 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-transformers:
-  - |-
-    apiVersion: builtin
-    kind: NamespaceTransformer
-    metadata:
-      name: notImportantHere
-      namespace: monitoring
-    unsetOnly: true
-
-namePrefix: umami-
-resources:
-  - ../../../kustomize/public-oidc/
-
-replacements:
-  - source:
-      kind: Service
-      name: svc
-    targets:
-      - select:
-          kind: HTTPRoute
-        options:
-          create: true
-        fieldPaths:
-          - spec.rules.0.backendRefs.0.name
-  - source:
-      kind: Deployment
-      name: app
-      fieldPath: metadata.labels.[app.kubernetes.io/appName]
-    targets:
-      - select:
-          kind: HTTPRoute
-        options:
-          create: true
-          delimiter: "."
-          index: 0
-        fieldPaths:
-          - spec.hostnames.0
-      - select:
-          kind: InfisicalSecret
-        options:
-          delimiter: "-"
-          index: 0
-        fieldPaths:
-          - spec.managedSecretReference.secretName
-      - select:
-          kind: InfisicalSecret
-        options:
-          delimiter: "/"
-          index: 2
-        fieldPaths:
-          - spec.authentication.universalAuth.secretsScope.secretsPath
-      - select:
-          kind: Service
-        fieldPaths:
-          - spec.ports.0.name
-          - spec.ports.0.targetPort
-  - source:
-      kind: Deployment
-      name: app
-      fieldPath: metadata.labels.[app.kubernetes.io/appNamespace]
-    targets:
-      - select:
-          kind: InfisicalSecret
-        fieldPaths:
-          - spec.managedSecretReference.secretNamespace
-      - select:
-          kind: InfisicalSecret
-        options:
-          delimiter: "/"
-          index: 1
-        fieldPaths:
-          - spec.authentication.universalAuth.secretsScope.secretsPath
-
-patches:
-  - path: patches/deployment.yaml
-    target:
-      kind: Deployment
-      name: app
-  - path: patches/delete-pvc.yaml
-    target:
-      kind: PersistentVolumeClaim
-      name: pvc
-
-labels:
-  - includeSelectors: true
-    pairs:
-      app.kubernetes.io/appName: umami
-  - pairs:
-      app.kubernetes.io/appNamespace: monitoring
-
-configMapGenerator:
-  - name: config
-    literals:
-      - DATABASE_TYPE=postgresql

namespaces/monitoring/umami/patches/delete-pvc.yaml

@@ -1,5 +0,0 @@
-$patch: delete
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: pvc

namespaces/monitoring/umami/patches/deployment.yaml

@@ -1,42 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: app
-spec:
-  template:
-    spec:
-      tolerations:
-        - key: "public"
-          operator: "Equal"
-          value: "true"
-          effect: "NoSchedule"
-      affinity:
-        nodeAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-            - weight: 100
-              preference:
-                matchExpressions:
-                  - key: public
-                    operator: In
-                    values:
-                      - "true"
-      containers:
-        - name: umami
-          image: ghcr.io/umami-software/umami:postgresql-v2.17.0
-          envFrom:
-            - configMapRef:
-                name: umami-config
-          env:
-            - name: SECRET_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: umami-secrets
-                  key: UMAMI_APP_SECRET
-            - name: DATABASE_URL
-              valueFrom:
-                secretKeyRef:
-                  name: umami-secrets
-                  key: UMAMI_POSTGRESQL_CONNECTION
-          ports:
-            - containerPort: 3000
-              name: umami

namespaces/public/namespace.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  labels:
-    homelab-access: "true"
-  name: public

namespaces/traefik/namespace.yaml

@@ -1,7 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  labels:
-    homelab-access: "true"
-  name: traefik

namespaces/traefik/traefik/kustomization.yaml

@@ -1,28 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-transformers:
-  - |-
-    apiVersion: builtin
-    kind: NamespaceTransformer
-    metadata:
-      name: notImportantHere
-      namespace: traefik
-    unsetOnly: true
-
-namePrefix: traefik-lb
-resources:
-  - ../../../kustomize/helmchart-noaddons/
-
-patches:
-  - path: patches/chart.yaml
-    target:
-      kind: HelmChart
-      name: chart
-
-labels:
-  - includeSelectors: true
-    pairs:
-      app.kubernetes.io/appName: traefik-lb
-  - pairs:
-      app.kubernetes.io/appNamespace: traefik