wip: xactmon: docs

2024-08-17 11:01:31 -05:00
107 changed files with 1622 additions and 2162 deletions
--- a/20125/config.yml
+++ b/20125/config.yml
@@ -1,79 +0,0 @@
-alertmanager:
-  url: http://alertmanager.victoria-metrics:9093
-
-system_wide:
-  alerts:
-  - alertgoup: Active Directory
-  - alertgoup: Longhorn
-  - alertgoup: PostgreSQL
-  - alertgoup: Restic
-  - alertgoup: Temperature
-  - job: authelia
-  - job: blackbox
-  - job: dns_pyrocufflink
-  - job: dns_recursive
-  - job: kubelet
-  - job: kubernetes
-  - instance: db0.pyrocufflink.blue
-  - instance: gw1.pyrocufflink.blue
-  - instance: vmhost0.pyrocufflink.blue
-  - instance: vmhost1.pyrocufflink.blue
-
-applications:
- name: Home Assistant
-  url: https://homeassistant.pyrocufflink.blue/
-  icon:
-    url: icons/home-assistant.svg
-  alerts:
-  - alertgroup: Home Assistant
-  - alertgroup: Frigate
-  - job: homeassistant
-  - instance: homeassistant.pyrocufflink.blue
-
- name: Nextcloud
-  url: &url https://nextcloud.pyrocufflink.net/index.php
-  icon:
-    url: icons/nextcloud.png
-  alerts:
-  - instance: *url
-  - instance: cloud0.pyrocufflink.blue
-
- name: Invoice Ninja
-  url: &url https://invoiceninja.pyrocufflink.net/
-  icon:
-    url: icons/invoiceninja.svg
-    class: light-bg
-  alerts:
-  - instance: *url
-
- name: Jellyfin
-  url: &url https://jellyfin.pyrocufflink.net/
-  icon:
-    url: icons/jellyfin.svg
-  alerts:
-  - instance: *url
-
- name: Vaultwarden
-  url: &url https://bitwarden.pyrocufflink.net/
-  icon:
-    url: icons/vaultwarden.svg
-    class: light-bg
-  alerts:
-  - instance: *url
-  - alertgroup: Bitwarden
-
- name: Paperless-ngx
-  url: &url https://paperless.pyrocufflink.blue/
-  icon:
-    url: icons/paperless-ngx.svg
-  alerts:
-  - instance: *url
-  - alertgroup: Paperless-ngx
-  - job: paperless-ngx
-
- name: Firefly III
-  url: &url https://firefly.pyrocufflink.blue/
-  icon:
-    url: icons/firefly-iii.svg
-  alerts:
-  - instance: *url
--- a/20125/ingress.yaml
+++ b/20125/ingress.yaml
@@ -1,25 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
-    cert-manager.io/issuer: status-server-ca
-  labels: &labels
-    app.kubernetes.io/name: status-server
-  name: status-server
-spec:
-  tls:
-  - hosts:
-    - 20125.home
-    secretName: status-server-cert
-  rules:
-  - host: 20125.home
-    http:
-      paths:
-      - backend:
-          service:
-            name: status-server
-            port:
-              number: 80
-        path: /
-        pathType: Prefix
--- a/20125/kustomization.yaml
+++ b/20125/kustomization.yaml
@@ -1,26 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-namespace: '20125'
-
-labels:
- pairs:
-    app.kubernetes.io/instance: '20125'
-    app.kubernetes.io/part-of: '20125'
-  includeSelectors: true
-
-resources:
- namespace.yaml
- secrets.yaml
- status-server-ca.yaml
- status-server.yaml
- ingress.yaml
-
-configMapGenerator:
- name: 20125-config
-  files:
-  - config.yml
-
-images:
- name: git.pyrocufflink.net/packages/20125.home
-  newTag: dev
--- a/20125/namespace.yaml
+++ b/20125/namespace.yaml
@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: "20125"
-  labels:
-    app.kubernetes.io/name: '20125'
--- a/20125/secrets.yaml
+++ b/20125/secrets.yaml
@@ -1,13 +0,0 @@
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: imagepull-gitea
-  namespace: "20125"
-spec:
-  encryptedData:
-    .dockerconfigjson: AgAXY5XsnGF9E3RU9dnKXK9fWjqK0khCDf7n0vuJCLACrcM01aoWVSjl26+j7oSTTyc7t5C+EKPJnuKdlkNfh2Omw9Lh3dn8rPRYcBRmUEAyt0TvBVkxBIiP+49y39QEV1opYY+b1gLVJ5ZEC92u5uI9y8xovwx9wqtKLfQ+KCfc5m93AYaQJ9EcnV1DSEkv/HdtWNikQes2hO6pTLF/GHrh/s79eIeXMTm5oG/OyJWTOGQdy1SdoGWLLf31dsjhsJyGMYOtWx42Nou20lWqmdoy4Dd8OXuuhcfeDNzkH187mI4XpVjbS0M+P5teJsGiTwx+VyJlGQnEaquIiHy3KLt3YH/ltGeNeCNbFmSDa70A3IdP/t0cAXN20rlIFGVzqNrAOhMYtiTDEgaKOrL7mwM4i4NTCnLTA2nXU7gLEcLGPRqO7LKIhc1/6d1xWMT58SFjHAVklFt/lq1udY6zE8gXHp+RQ+7hIIEu500YiaKubvh2MsOKIqYOaX99Q4BW7PQhwjjwtFHFuwNjZn8wAbDq+3gsDSqgeFPgHAs7nPIImcBne/fTobsHhUVvxEnBNLCRtSqpkvOLzpgC+dRNsD6ZTcXPhFWTEOvjBMcUWqOTcRmd8DCsdxalM42x/ZQjlNlubZeuaNki+4pA80bYlsLWt3A2nWtcVbO/aAYrT1qiK/d8NZsPNidD0HE1rkUkCNv5KgXVWUfVU7ptX1YFpYXXuEIFeWzulH3gWmdW4q+t2nGHAqwkszZfijtpsexBttff1ym3rgBTGHFmQRkmSMbNHIAq29ehuVrxkH7uM8Q1cXXmMnGgre0ijtUfW9zMlx92jR86187xOLM3/hxANhfyt4eZVMwx8D42facMxxAngCi01vYTwqihA9mtBFkKlkQdKCH1NxgWQqwAJi87utgHoFivxeM+Pck7Zeottr0yzUEisdoBAdQR99hijR2C5SnC4iURnqfi9sloj0Uuo74SxiTGapA7pg77LmvpV9Wzu6QiEm944tftcZHwaMg=
-  template:
-    metadata:
-      name: imagepull-gitea
-      namespace: "20125"
-    type: kubernetes.io/dockerconfigjson
--- a/20125/status-server-ca.yaml
+++ b/20125/status-server-ca.yaml
@@ -1,32 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: Issuer
-metadata:
-  name: selfsigned-ca
-spec:
-  selfSigned: {}
-
---
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: status-server-ca
-spec:
-  isCA: true
-  commonName: 20125 CA
-  secretName: status-server-ca-secret
-  privateKey:
-    algorithm: ECDSA
-    size: 256
-  issuerRef:
-    name: selfsigned-ca
-    kind: Issuer
-    group: cert-manager.io
-
---
-apiVersion: cert-manager.io/v1
-kind: Issuer
-metadata:
-  name: status-server-ca
-spec:
-  ca:
-    secretName: status-server-ca-secret
--- a/20125/status-server.yaml
+++ b/20125/status-server.yaml
@@ -1,46 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  labels: &labels
-    app.kubernetes.io/name: status-server
-    app.kubernetes.io/component: status-server
-  name: status-server
-spec:
-  ports:
-  - port: 80
-    protocol: TCP
-    targetPort: 20125
-  selector: *labels
-  type: ClusterIP
-
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels: &labels
-    app.kubernetes.io/name: status-server
-    app.kubernetes.io/component: status-server
-  name: status-server
-spec:
-  replicas: 1
-  selector:
-    matchLabels: *labels
-  template:
-    metadata:
-      labels: *labels
-    spec:
-      containers:
-      - name: status-server
-        image: git.pyrocufflink.net/packages/20125.home
-        imagePullPolicy: Always
-        volumeMounts:
-        - mountPath: /usr/local/share/20125.home/config.yml
-          name: config
-          subPath: config.yml
-          readOnly: True
-      imagePullSecrets:
-      - name: imagepull-gitea
-      volumes:
-      - name: config
-        configMap:
-          name: 20125-config
--- a/argocd/applications/authelia.yaml
+++ b/argocd/applications/authelia.yaml
@@ -11,6 +11,3 @@ spec:
    path: authelia
    repoURL: https://git.pyrocufflink.blue/infra/kubernetes.git
    targetRevision: master
-  syncPolicy:
-    automated:
-      prune: true
--- a/argocd/applications/firefly-iii.yaml
+++ b/argocd/applications/firefly-iii.yaml
@@ -11,6 +11,3 @@ spec:
    path: firefly-iii
    repoURL: https://git.pyrocufflink.blue/infra/kubernetes.git
    targetRevision: master
-  syncPolicy:
-    automated:
-      prune: true
--- a/argocd/applications/home-assistant.yaml
+++ b/argocd/applications/home-assistant.yaml
@@ -11,6 +11,3 @@ spec:
    path: home-assistant
    repoURL: https://git.pyrocufflink.blue/infra/kubernetes.git
    targetRevision: master
-  syncPolicy:
-    automated:
-      prune: true
--- a/argocd/applications/ntfy.yaml
+++ b/argocd/applications/ntfy.yaml
@@ -11,6 +11,3 @@ spec:
    path: ntfy
    repoURL: https://git.pyrocufflink.blue/infra/kubernetes.git
    targetRevision: master
-  syncPolicy:
-    automated:
-      prune: true
--- a/argocd/applications/paperless-ngx.yaml
+++ b/argocd/applications/paperless-ngx.yaml
@@ -11,6 +11,3 @@ spec:
    path: paperless-ngx
    repoURL: https://git.pyrocufflink.blue/infra/kubernetes.git
    targetRevision: master
-  syncPolicy:
-    automated:
-      prune: true
--- a/argocd/applications/vaultwarden.yaml
+++ b/argocd/applications/vaultwarden.yaml
@@ -1,16 +1,13 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: vaultwarden
+  name: postgresql
  namespace: argocd
 spec:
  destination:
    server: https://kubernetes.default.svc
  project: default
  source:
-    path: vaultwarden
+    path: postgresql
    repoURL: https://git.pyrocufflink.blue/infra/kubernetes.git
    targetRevision: master
-  syncPolicy:
-    automated:
-      prune: true
--- a/authelia/configuration.yml
+++ b/authelia/configuration.yml
@@ -36,10 +36,6 @@ access_control:
    networks:
    - internal
    policy: bypass
-  - domain: metrics.pyrocufflink.blue
-    resources:
-    - '^/insert/.*'
-    policy: bypass
  - domain: metrics.pyrocufflink.blue
    networks:
    - internal
@@ -98,7 +94,6 @@ identity_providers:
        $pbkdf2-sha512$310000$TkQ1BwLrr.d8AVGWk2rLhA$z4euAPhkkZdjcxKFD3tZRtNQ/R78beW7epJ.BGFWSwQdAme5TugNj9Ba.aL5TEqrBDmXRW0xiI9EbxSszckG5A
      redirect_uris:
      - https://burp.pyrocufflink.blue:9090/oauth_callback
-      - https://minio.backups.pyrocufflink.blue/oauth_callback
    - id: step-ca
      description: step-ca
      public: true
--- a/authelia/kustomization.yaml
+++ b/authelia/kustomization.yaml
@@ -55,6 +55,3 @@ patches:
          - name: dch-root-ca
            configMap:
              name: dch-root-ca
-images:
- name: ghcr.io/authelia/authelia
-  newTag: 4.38.18
--- a/cert-manager/cert-exporter.config.yml
+++ b/cert-manager/cert-exporter.config.yml
@@ -1,41 +0,0 @@
-git_repo: gitea@git.pyrocufflink.blue:dustin/certs.git
-certs:
- name: pyrocufflink-cert
-  namespace: default
-  key: certificates/_.pyrocufflink.net.key
-  cert: certificates/_.pyrocufflink.net.crt
-  bundle: certificates/_.pyrocufflink.net.pem
- name: dustinhatchname-cert
-  namespace: default
-  key: acme.sh/dustin.hatch.name/dustin.hatch.name.key
-  cert: acme.sh/dustin.hatch.name/fullchain.cer
- name: hatchchat-cert
-  namespace: default
-  key: certificates/hatch.chat.key
-  cert: certificates/hatch.chat.crt
-  bundle: certificates/hatch.chat.pem
- name: tabitha-cert
-  namespace: default
-  key: certificates/tabitha.biz.key
-  cert: certificates/tabitha.biz.crt
-  bundle: certificates/tabitha.biz.pem
- name: chmod777-cert
-  namespace: default
-  key: certificates/chmod777.sh.key
-  cert: certificates/chmod777.sh.crt
-  bundle: certificates/chmod777.sh.pem
- name: dustinandtabitha-cert
-  namespace: default
-  key: certificates/dustinandtabitha.com.key
-  cert: certificates/dustinandtabitha.com.crt
-  bundle: certificates/dustinandtabitha.com.pem
- name: hlc-cert
-  namespace: default
-  key: certificates/hatchlearningcenter.org.key
-  cert: certificates/hatchlearningcenter.org.crt
-  bundle: certificates/hatchlearningcenter.org.pem
- name: appsxyz-cert
-  namespace: default
-  key: certificates/apps.du5t1n.xyz.key
-  cert: certificates/apps.du5t1n.xyz.crt
-  bundle: certificates/apps.du5t1n.xyz.pem
--- a/cert-manager/cert-exporter.yaml
+++ b/cert-manager/cert-exporter.yaml
@@ -4,6 +4,56 @@ metadata:
  name: cert-exporter
  namespace: cert-manager

+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cert-exporter
+  namespace: cert-manager
+data:
+  config.yml: |
+    git_repo: gitea@git.pyrocufflink.blue:dustin/certs.git
+    certs:
+    - name: pyrocufflink-cert
+      namespace: default
+      key: certificates/_.pyrocufflink.net.key
+      cert: certificates/_.pyrocufflink.net.crt
+      bundle: certificates/_.pyrocufflink.net.pem
+    - name: dustinhatchname-cert
+      namespace: default
+      key: acme.sh/dustin.hatch.name/dustin.hatch.name.key
+      cert: acme.sh/dustin.hatch.name/fullchain.cer
+    - name: hatchchat-cert
+      namespace: default
+      key: certificates/hatch.chat.key
+      cert: certificates/hatch.chat.crt
+      bundle: certificates/hatch.chat.pem
+    - name: tabitha-cert
+      namespace: default
+      key: certificates/tabitha.biz.key
+      cert: certificates/tabitha.biz.crt
+      bundle: certificates/tabitha.biz.pem
+    - name: dcow-cert
+      namespace: default
+      key: certificates/darkchestofwonders.us.key
+      cert: certificates/darkchestofwonders.us.crt
+      bundle: certificates/darkchestofwonders.us.pem
+    - name: chmod777-cert
+      namespace: default
+      key: certificates/chmod777.sh.key
+      cert: certificates/chmod777.sh.crt
+      bundle: certificates/chmod777.sh.pem
+    - name: dustinandtabitha-cert
+      namespace: default
+      key: certificates/dustinandtabitha.com.key
+      cert: certificates/dustinandtabitha.com.crt
+      bundle: certificates/dustinandtabitha.com.pem
+    - name: hlc-cert
+      namespace: default
+      key: certificates/hatchlearningcenter.org.key
+      cert: certificates/hatchlearningcenter.org.crt
+      bundle: certificates/hatchlearningcenter.org.pem
+
 ---
 apiVersion: rbac.authorization.k8s.io/v1
 kind: Role
@@ -21,10 +71,10 @@ rules:
  - dustinhatchname-cert
  - hatchchat-cert
  - tabitha-cert
+  - dcow-cert
  - chmod777-cert
  - dustinandtabitha-cert
  - hlc-cert
-  - appsxyz-cert

 ---
 apiVersion: rbac.authorization.k8s.io/v1
--- a/cert-manager/certificates.yaml
+++ b/cert-manager/certificates.yaml
@@ -71,6 +71,24 @@ spec:
    algorithm: ECDSA
    rotationPolicy: Always

+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: dcow-cert
+spec:
+  secretName: dcow-cert
+  dnsNames:
+  - darkchestofwonders.us
+  - '*.darkchestofwonders.us'
+  issuerRef:
+    group: cert-manager.io
+    kind: ClusterIssuer
+    name: zerossl
+  privateKey:
+    algorithm: ECDSA
+    rotationPolicy: Always
+
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
@@ -136,20 +154,3 @@ spec:
  privateKey:
    algorithm: ECDSA
    rotationPolicy: Always
-
---
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: appsxyz-cert
-spec:
-  secretName: appsxyz-cert
-  dnsNames:
-  - apps.du5t1n.xyz
-  issuerRef:
-    group: cert-manager.io
-    kind: ClusterIssuer
-    name: zerossl
-  privateKey:
-    algorithm: ECDSA
-    rotationPolicy: Always
--- a/cert-manager/dch-ca-issuer.yaml
+++ b/cert-manager/dch-ca-issuer.yaml
@@ -12,18 +12,6 @@ spec:
      LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJ4RENDQVdxZ0F3SUJBZ0lVYkh6MnRzc2EwOXpzSGsrRWRHRDNRS3ByTUtRd0NnWUlLb1pJemowRUF3UXcKUURFTE1Ba0dBMVVFQmhNQ1ZWTXhHREFXQmdOVkJBb01EMFIxYzNScGJpQkRMaUJJWVhSamFERVhNQlVHQTFVRQpBd3dPUkVOSUlGSnZiM1FnUTBFZ1VqSXdIaGNOTWpNd09USTBNakExTXpBNVdoY05ORE13T1RFNU1qQTFNekE1CldqQkFNUXN3Q1FZRFZRUUdFd0pWVXpFWU1CWUdBMVVFQ2d3UFJIVnpkR2x1SUVNdUlFaGhkR05vTVJjd0ZRWUQKVlFRRERBNUVRMGdnVW05dmRDQkRRU0JTTWpCWk1CTUdCeXFHU000OUFnRUdDQ3FHU000OUF3RUhBMElBQkUyRApOSkhSY2p1QTE5Wm9wckJLYXhJZlV4QWJ6NkxpZ003ZGd0TzYraXNhTWx4UkFWSm1zSVRBRElFLzIyUnJVRGdECk9ma3QyaVpUVWpNcnozQXhYaFdqUWpCQU1CMEdBMVVkRGdRV0JCVE0rZDhrYjFrb0dtS1J0SnM0Z045ellhKzYKb1RBU0JnTlZIUk1CQWY4RUNEQUdBUUgvQWdFQk1Bc0dBMVVkRHdRRUF3SUJCakFLQmdncWhrak9QUVFEQkFOSQpBREJGQWlFQTJLYThtTWlBRkxtckZXdDBkQW1sMjQ3cmUyK2k0VVBoeUhjT0JmTksrZ29DSUh2K3ZFdzdDSFpRCmlySWE2OTduZmU0S2lYSU13SGxBTVMxKzFRWm9oRkRDCi0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K

    solvers:
-    - dns01:
-        cnameStrategy: Follow
-        rfc2136:
-          nameserver: 172.30.0.1
-          tsigSecretSecretRef:
-            name: pyrocufflink-tsig
-            key: cert-manager.tsig.key
-          tsigKeyName: cert-manager
-          tsigAlgorithm: HMACSHA512
-      selector:
-        dnsNames:
-        - rabbitmq.pyrocufflink.blue
    - http01:
        ingress:
          ingressClassName: nginx
--- a/cert-manager/kustomization.yaml
+++ b/cert-manager/kustomization.yaml
@@ -7,15 +7,6 @@ resources:
 - certificates.yaml
 - cert-exporter.yaml
 - dch-ca-issuer.yaml
- secrets.yaml
-
-configMapGenerator:
- name: cert-exporter
-  namespace: cert-manager
-  files:
-  - config.yml=cert-exporter.config.yml
-  options:
-    disableNameSuffixHash: True

 secretGenerator:
 - name: zerossl-eab
--- a/cert-manager/secrets.yaml
+++ b/cert-manager/secrets.yaml
@@ -1,13 +0,0 @@
---
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: pyrocufflink-tsig
-  namespace: cert-manager
-spec:
-  encryptedData:
-    cert-manager.tsig.key: AgAf1dVezJ0ytOdGI5rzCJ35rAVpY114pQJgIzqAKsKkRVE6kwWXjoFj94ZgDsjpOedAp1zdNB1UQnu0n10ayuz/NUYb74wkXcu0RRy6Ve06SJjI01f7lHP2/a4cnW+0et/Xzin0RQ/3hHmZUk5aCwV/FCLs0D5LdFixHf+sbMCzhyIYrQ64x0YH9YqBTRgXkEx94+PUuxi9ZyLuKiepd/K4UF+L5rF2zWt9DVKOmdbilzd5RqdQSgEyoOOpmcbDKHm1s17KHWSJb44rvxj7vg2fmXXwEvEW5SiQdrhmywOcqqhXEbE1ZEvBrVt3GgrjZHeTyL0Gx4jugiqSR/WulY7ak4+ZkDF80OS5RzciYeVMDdNxst48Xdkc2F7E93GGWCeIN5gig0oCFcB18BRF3aO4AB+fqh0IWBSiBCGinbjvX684TF9BGPuKMj01ORW3fFnRfbeE4gYTrdBKFi1ltG6VxJ6X9i5ztLIQBcH48btf7uMjQsC79GPq35CCWBprqnNBvi81lJtGVaVqY6hNIvyQIO+fEReMk/Mp0N+KxWlWVY/vK+ck2KWkgXaui3xkM4jbB6RiXWZXrUW4y+XyDs+sTziwYRRz03MU9NC58do9MBnOeM+fJqioMyQq81/mXKtcxIsvJadJ7WsYQKdqa/gVE5D/ybJ2qrtbEQqgCXnyowIIIOVvvWilhzh/zjQgtRiLHlsbLmvRX5aZm1Z048CMDFPh8CxcHlVwz7FUviJzbNoqENh1PE6HhKwFqpGxtjjR6X3LEi8iLvLNg05EUzLNJD1+SCi0imhQPGesJZtr/h1xqI9utB4NjA==
-  template:
-    metadata:
-      name: pyrocufflink-tsig
-      namespace: cert-manager
--- a/dynk8s-provisioner/.gitignore
+++ b/dynk8s-provisioner/.gitignore
@@ -1 +0,0 @@
-wireguard-config
--- a/dynk8s-provisioner/dynk8s-provisioner.yaml
+++ b/dynk8s-provisioner/dynk8s-provisioner.yaml
@@ -1,3 +1,179 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: dynk8s
+  labels:
+    kubernetes.io/metadata.name: dynk8s
+    app.kubernetes.io/instance: dynk8s-provisioner
+
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: dynk8s-provisioner
+  namespace: dynk8s
+  labels:
+    app.kubernetes.io/name: dynk8s-provisioner
+    app.kubernetes.io/instance: dynk8s-provisioner
+    app.kubernetes.io/component: http-api
+    app.kubernetes.io/part-of: dynk8s-provisioner
+automountServiceAccountToken: true
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: dynk8s-provisioner
+  namespace: dynk8s
+  labels:
+    app.kubernetes.io/name: dynk8s-provisioner
+    app.kubernetes.io/instance: dynk8s-provisioner
+    app.kubernetes.io/component: http-api
+    app.kubernetes.io/part-of: dynk8s-provisioner
+rules:
+- apiGroups:
+  - ''
+  resources:
+  - secrets
+  verbs:
+  - '*'
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: dynk8s-provisioner
+  namespace: kube-system
+  labels:
+    app.kubernetes.io/name: dynk8s-provisioner
+    app.kubernetes.io/instance: dynk8s-provisioner
+    app.kubernetes.io/component: http-api
+    app.kubernetes.io/part-of: dynk8s-provisioner
+rules:
+- apiGroups:
+  - ''
+  resources:
+  - secrets
+  verbs:
+  - '*'
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: dynk8s-provisioner
+  namespace: kube-public
+  labels:
+    app.kubernetes.io/name: dynk8s-provisioner
+    app.kubernetes.io/instance: dynk8s-provisioner
+    app.kubernetes.io/component: http-api
+    app.kubernetes.io/part-of: dynk8s-provisioner
+rules:
+- apiGroups:
+  - ''
+  resources:
+  - configmaps
+  resourceNames:
+  - cluster-info
+  verbs:
+  - get
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: dynk8s-provisioner
+  labels:
+    app.kubernetes.io/name: dynk8s-provisioner
+    app.kubernetes.io/instance: dynk8s-provisioner
+    app.kubernetes.io/component: http-api
+    app.kubernetes.io/part-of: dynk8s-provisioner
+rules:
+- apiGroups:
+  - ''
+  resources:
+  - nodes
+  verbs:
+  - list
+  - get
+  - delete
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: dynk8s-provisioner
+  namespace: dynk8s
+  labels:
+    app.kubernetes.io/name: dynk8s-provisioner
+    app.kubernetes.io/instance: dynk8s-provisioner
+    app.kubernetes.io/part-of: dynk8s-provisioner
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: dynk8s-provisioner
+subjects:
+- kind: ServiceAccount
+  name: dynk8s-provisioner
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: dynk8s-provisioner
+  namespace: kube-system
+  labels:
+    app.kubernetes.io/name: dynk8s-provisioner
+    app.kubernetes.io/instance: dynk8s-provisioner
+    app.kubernetes.io/part-of: dynk8s-provisioner
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: dynk8s-provisioner
+subjects:
+- kind: ServiceAccount
+  name: dynk8s-provisioner
+  namespace: dynk8s
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: dynk8s-provisioner
+  namespace: kube-public
+  labels:
+    app.kubernetes.io/name: dynk8s-provisioner
+    app.kubernetes.io/instance: dynk8s-provisioner
+    app.kubernetes.io/part-of: dynk8s-provisioner
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: dynk8s-provisioner
+subjects:
+- kind: ServiceAccount
+  name: dynk8s-provisioner
+  namespace: dynk8s
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: dynk8s-provisioner
+  labels:
+    app.kubernetes.io/name: dynk8s-provisioner
+    app.kubernetes.io/instance: dynk8s-provisioner
+    app.kubernetes.io/part-of: dynk8s-provisioner
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: dynk8s-provisioner
+subjects:
+- kind: ServiceAccount
+  name: dynk8s-provisioner
+  namespace: dynk8s
+
+---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
@@ -92,3 +268,54 @@ spec:
  ports:
  - port: 8000
    name: http
+
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: dynk8s-provisioner
+  namespace: dynk8s
+  labels:
+    app.kubernetes.io/name: dynk8s-provisioner
+    app.kubernetes.io/instance: dynk8s-provisioner
+    app.kubernetes.io/component: http-api
+    app.kubernetes.io/part-of: dynk8s-provisioner
+spec:
+  ingressClassName: nginx
+  tls:
+  - hosts:
+    - dynk8s-provisioner.pyrocufflink.net
+  rules:
+  - host: dynk8s-provisioner.pyrocufflink.net
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: dynk8s-provisioner
+            port:
+              name: http
+
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: wireguard-config-0
+  namespace: dynk8s
+  labels:
+    app.kubernetes.io/part-of: dynk8s-provisioner
+    dynk8s.du5t1n.me/ec2-instance-id: ''
+type: dynk8s.du5t1n.me/wireguard-config
+stringData:
+  wireguard-config: |+
+    [Interface]
+    Address = 172.30.0.178/28
+    DNS = 172.30.0.1
+    PrivateKey = gGieVWS8SUQxC7L0NKmHlpvBTANNNaucsm9K1ioHPXU=
+
+    [Peer]
+    PublicKey = 85BW2bagvhOZnvFD6gmjnT+uUj5NaF4z+YFBV/br9BA=
+    PresharedKey = bZgUN82zDW7Q+558omOyRrZ0rw3bUohmIjEaxgtZCv8=
+    Endpoint = vpn.pyrocufflink.net:19998
+    AllowedIPs = 172.30.0.0/26, 172.30.0.160/28, 172.31.1.0/24
--- a/dynk8s-provisioner/ingress.yaml
+++ b/dynk8s-provisioner/ingress.yaml
@@ -1,26 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: dynk8s-provisioner
-  namespace: dynk8s
-  labels:
-    app.kubernetes.io/name: dynk8s-provisioner
-    app.kubernetes.io/instance: dynk8s-provisioner
-    app.kubernetes.io/component: http-api
-    app.kubernetes.io/part-of: dynk8s-provisioner
-spec:
-  ingressClassName: nginx
-  tls:
-  - hosts:
-    - dynk8s-provisioner.pyrocufflink.net
-  rules:
-  - host: dynk8s-provisioner.pyrocufflink.net
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: dynk8s-provisioner
-            port:
-              name: http
--- a/dynk8s-provisioner/kustomization.yaml
+++ b/dynk8s-provisioner/kustomization.yaml
@@ -1,14 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-labels:
- pairs:
-    app.kubernetes.io/instance: dynk8s-provisioner
-    app.kubernetes.io/part-of: dynk8s-provisioner
-
-resources:
- namespace.yaml
- rbac.yaml
- dynk8s-provisioner.yaml
- ingress.yaml
- secrets.yaml
--- a/dynk8s-provisioner/namespace.yaml
+++ b/dynk8s-provisioner/namespace.yaml
@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: dynk8s
-  labels:
-    kubernetes.io/metadata.name: dynk8s
-    app.kubernetes.io/instance: dynk8s-provisioner
--- a/dynk8s-provisioner/rbac.yaml
+++ b/dynk8s-provisioner/rbac.yaml
@@ -1,164 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: dynk8s-provisioner
-  namespace: dynk8s
-  labels:
-    app.kubernetes.io/name: dynk8s-provisioner
-    app.kubernetes.io/instance: dynk8s-provisioner
-    app.kubernetes.io/component: http-api
-    app.kubernetes.io/part-of: dynk8s-provisioner
-automountServiceAccountToken: true
-
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: dynk8s-provisioner
-  namespace: dynk8s
-  labels:
-    app.kubernetes.io/name: dynk8s-provisioner
-    app.kubernetes.io/instance: dynk8s-provisioner
-    app.kubernetes.io/component: http-api
-    app.kubernetes.io/part-of: dynk8s-provisioner
-rules:
- apiGroups:
-  - ''
-  resources:
-  - secrets
-  verbs:
-  - '*'
-
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: dynk8s-provisioner
-  namespace: kube-system
-  labels:
-    app.kubernetes.io/name: dynk8s-provisioner
-    app.kubernetes.io/instance: dynk8s-provisioner
-    app.kubernetes.io/component: http-api
-    app.kubernetes.io/part-of: dynk8s-provisioner
-rules:
- apiGroups:
-  - ''
-  resources:
-  - secrets
-  verbs:
-  - '*'
-
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: dynk8s-provisioner
-  namespace: kube-public
-  labels:
-    app.kubernetes.io/name: dynk8s-provisioner
-    app.kubernetes.io/instance: dynk8s-provisioner
-    app.kubernetes.io/component: http-api
-    app.kubernetes.io/part-of: dynk8s-provisioner
-rules:
- apiGroups:
-  - ''
-  resources:
-  - configmaps
-  resourceNames:
-  - cluster-info
-  verbs:
-  - get
-
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: dynk8s-provisioner
-  labels:
-    app.kubernetes.io/name: dynk8s-provisioner
-    app.kubernetes.io/instance: dynk8s-provisioner
-    app.kubernetes.io/component: http-api
-    app.kubernetes.io/part-of: dynk8s-provisioner
-rules:
- apiGroups:
-  - ''
-  resources:
-  - nodes
-  verbs:
-  - list
-  - get
-  - delete
-
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: dynk8s-provisioner
-  namespace: dynk8s
-  labels:
-    app.kubernetes.io/name: dynk8s-provisioner
-    app.kubernetes.io/instance: dynk8s-provisioner
-    app.kubernetes.io/part-of: dynk8s-provisioner
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: dynk8s-provisioner
-subjects:
- kind: ServiceAccount
-  name: dynk8s-provisioner
-
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: dynk8s-provisioner
-  namespace: kube-system
-  labels:
-    app.kubernetes.io/name: dynk8s-provisioner
-    app.kubernetes.io/instance: dynk8s-provisioner
-    app.kubernetes.io/part-of: dynk8s-provisioner
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: dynk8s-provisioner
-subjects:
- kind: ServiceAccount
-  name: dynk8s-provisioner
-  namespace: dynk8s
-
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: dynk8s-provisioner
-  namespace: kube-public
-  labels:
-    app.kubernetes.io/name: dynk8s-provisioner
-    app.kubernetes.io/instance: dynk8s-provisioner
-    app.kubernetes.io/part-of: dynk8s-provisioner
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: dynk8s-provisioner
-subjects:
- kind: ServiceAccount
-  name: dynk8s-provisioner
-  namespace: dynk8s
-
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: dynk8s-provisioner
-  labels:
-    app.kubernetes.io/name: dynk8s-provisioner
-    app.kubernetes.io/instance: dynk8s-provisioner
-    app.kubernetes.io/part-of: dynk8s-provisioner
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: dynk8s-provisioner
-subjects:
- kind: ServiceAccount
-  name: dynk8s-provisioner
-  namespace: dynk8s
--- a/dynk8s-provisioner/secrets.yaml
+++ b/dynk8s-provisioner/secrets.yaml
@@ -1,16 +0,0 @@
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: wireguard-config-0
-  namespace: dynk8s
-spec:
-  encryptedData:
-    wireguard-config: AgCRjcXhRNtDg/LSmDKFxbSunGGNBu6GrHGYIPG+DMXCbAIiRnnjxpeu/7Vh0WrYcHCHoLdm0NAr7M9G7S8aS8XUDZ7ANphGk56t8Mrrv9ZzOwHyCnxm3QM6q7RNus2+PgKJ/zNe8j5M1u4v3wGk1XzXPtYQ4dRp6op5X+ILGUu16Y2/hcfHEtW9IupqCKgteo1GAyHY4I86ldsTSIvEtcriVhXrEIYYRwYzEpR06y15dbz4qC86nTDp0RuhO+eU4hEzu/c80IJIjTz5CbDundSYRLqafZgs+LwL2fo5wnVyDy1KfP5X2o2mbZFz/5fhwj3M27/g+4KLh08NY5DJTMN1CFrHYGcWUbpIqWYCEJd8c40jRzzDVhcHA3WJjOd0KZv0oRfwmjbBlf0mMxDcJhG/h8tngQBs6aNEpq69RbABbL0bBkIQBokmib4bSfppHTBYNhzbdLwDQJD072qqNGKbDufHkcK4bBwuvmeE00EKxqFoqz++6EQMRkuNN7UtpFDKyDxElOMlo09KKGMUqz/JkFPb4YRJhF31+CskWmU1AVFge7Z5sVe5lMiDpoH62Zg5sxRSaHbdYvsS1vxsTfdG3rmhOAMxxYc+Kvt3u3eNkzEV3lUosorspZhBnEzyHHcap1QUd19vVarjv77g9Br7PATOl3SmuK58JqW2dyOiMQvjLNUAZ27q3uEZGAzRZ8yg5RoejFpueFJjSjTnV1UFdH/OseHXgvFd60syg/mviIA9IGzaxCjoZfxL1GlfjGDYsetnnIDCcQR8K915Qh0PfMdwHKsPBmmDGAxP7k/DHEM3tYC66SQAD4mpMH4Ri8jDD3ijpq8ud93CZX5S32rU0yrXIWCM4ByXks32HACCEOIdfHuGuys6FRQTCPFJuYlpwsVTSJKLjy59rTz5B6nLKxtaOuRULh8MrDR7KlhMiE7gl5waiIlYaiecVn/sNfu4q9UfgwGUntKIovmrwcBPjMRmLgs3IQH4p02G4OemPaByXkPD1JROk2epNkLMwH+IsUxAveGy/hCmrLa9fRaJWSlfuAQtqOihf34YBudsfqwr0UGLI8VsVe+p+tF+AYftUGDf1trJTI8TJUB/91CwrC6c61EFbQCJc90w+lL+oJueDZdGXzoYvkCsDpfFMA==
-  template:
-    metadata:
-      name: wireguard-config-0
-      namespace: dynk8s
-      labels:
-        app.kubernetes.io/part-of: dynk8s-provisioner
-        dynk8s.du5t1n.me/ec2-instance-id: ''
-    type: dynk8s.du5t1n.me/wireguard-config
--- a/dynk8s-provisioner/wireguard-config.new
+++ b/dynk8s-provisioner/wireguard-config.new
@@ -1,11 +0,0 @@
-# vim: set ft=dosini :
-[Interface]
-Address = 172.30.0.194/29
-DNS = 172.30.0.1
-PrivateKey = WJb4G0EL5xc0VMHZeiqJE3G0OlFhe1Q5CEJkMg8hTkE=
-
-[Peer]
-PublicKey = 85BW2bagvhOZnvFD6gmjnT+uUj5NaF4z+YFBV/br9BA=
-PresharedKey = gVRSPVLZMx1maIfecFIcAeesrireopaKqs0jDj9muS0=
-Endpoint = vpn.pyrocufflink.net:19998
-AllowedIPs = 172.30.0.0/26, 172.30.0.160/28, 172.31.1.0/24
--- a/firefly-iii/firefly-iii-importer.env
+++ b/firefly-iii/firefly-iii-importer.env
@@ -1,6 +1,6 @@
 TZ=America/Chicago

-TRUSTED_PROXIES=10.149.0.0/16
+TRUSTED_PROXIES=172.30.0.160/28
 VANITY_URL=https://firefly.pyrocufflink.blue

 CAN_POST_FILES=true
--- a/firefly-iii/firefly-iii.env
+++ b/firefly-iii/firefly-iii.env
@@ -4,7 +4,7 @@ SITE_OWNER=dustin@hatch.name

 TZ=America/Chicago

-TRUSTED_PROXIES=10.149.0.0/16
+TRUSTED_PROXIES=172.30.0.160/28

 DB_CONNECTION=pgsql
 DB_HOST=postgresql.pyrocufflink.blue
--- a/firefly-iii/kustomization.yaml
+++ b/firefly-iii/kustomization.yaml
@@ -15,7 +15,7 @@ resources:
 - ingress.yaml
 - importer.yaml
 - importer-ingress.yaml
- ../dch-root-ca
+-  ../dch-root-ca

 configMapGenerator:
 - name: firefly-iii
@@ -53,6 +53,3 @@ patches:
            secret:
              secretName: postgres-client-cert
              defaultMode: 0640
-images:
- name: docker.io/fireflyiii/core
-  newTag: version-6.2.0
--- a/fleetlock/kustomization.yaml
+++ b/fleetlock/kustomization.yaml
@@ -19,8 +19,3 @@ patches:
      name: fleetlock
    spec:
      clusterIP: 10.96.1.15
-
-images:
- name: quay.io/poseidon/fleetlock
-  newName: git.pyrocufflink.net/containerimages/fleetlock
-  newTag: vadimberezniker-wait_evictions
--- a/home-assistant/.gitignore
+++ b/home-assistant/.gitignore
@@ -1,2 +1 @@
 mosquitto.passwd
-secrets.yaml.in
--- a/home-assistant/configuration.yaml
+++ b/home-assistant/configuration.yaml
@@ -12,6 +12,7 @@ input_number:
 input_select:
 input_text:
 logbook:
+map:
 media_source:
 mobile_app:
 person:
@@ -28,7 +29,7 @@ zone:

 http:
  trusted_proxies:
-  - 10.149.0.0/16
+  - 172.30.0.160/28
  use_x_forwarded_for: true

 recorder:
@@ -38,18 +39,6 @@ recorder:
  commit_interval: 0

 homeassistant:
-  auth_providers:
-  - type: trusted_networks
-    trusted_networks:
-    - 172.31.1.81/32
-    - 172.31.1.115/32
-    trusted_users:
-      172.31.1.81:
-      - 03a8b3528f1145ab908e20ed5687d893
-      172.31.1.115:
-      - 03a8b3528f1145ab908e20ed5687d893
-  - type: homeassistant
-    allow_bypass_login: true
  whitelist_external_dirs:
  - /config
  - /tmp
@@ -87,7 +76,25 @@ light:
  - light.light_6
  - light.light_7

+matrix:
+  homeserver: https://hatch.chat
+  username: '@homeassistant:hatch.chat'
+  password: !secret matrix_password
+  rooms:
+  - '!DdgnpVhlRqeTeNqSEM:hatch.chat'
+  - '!oyDXJxjUeJkEFshmAn:hatch.chat'
+  commands:
+  - word: snapshot
+    name: snapshot
+  - word: bunnies
+    name: bunnies
+  - expression: 'lights (?P<scene>.*)'
+    name: lights
+
 notify:
+- platform: matrix
+  name: matrix
+  default_room: '!DdgnpVhlRqeTeNqSEM:hatch.chat'
 - platform: group
  name: mobile_apps_group
  services:
@@ -114,8 +121,37 @@ sensor:
  max_age:
    hours: 24

+- platform: seventeentrack
+  username: gyrfalcon@ebonfire.com
+  password: !secret seventeentrack_password
+
 template:
 - sensor:
+  - name: 'Thermostat Temperature'
+    device_class: temperature
+    unit_of_measurement: °C
+    state: >-
+      {% if is_state('sensor.season', 'winter') %}
+      {{ states('sensor.living_room_temperature') }}
+      {% else %}
+      {{ states('sensor.bedroom_temperature') }}
+      {% endif %}
+
+  - name: "Tonight's Forecast"
+    device_class: temperature
+    unit_of_measurement: °C
+    state: >-
+      {{ state_attr('weather.kojc_daynight', 'forecast')
+         | rejectattr('is_daytime')
+         | map(attribute='temperature')
+         | first }}
+
+  - name: Cost per Mow
+    device_class: monetary
+    unit_of_measurement: USD
+    state: >-
+      {{  3072.21 / states('counter.mow_count')|int }}
+
  - name: Apc1500 Load
    device_class: power
    unit_of_measurement: W
--- a/home-assistant/kustomization.yaml
+++ b/home-assistant/kustomization.yaml
@@ -19,7 +19,7 @@ resources:
 - piper.yaml
 - whisper.yaml
 - ingress.yaml
- ../dch-root-ca
+-  ../dch-root-ca

 configMapGenerator:
 - name: home-assistant
@@ -28,10 +28,7 @@ configMapGenerator:
  - event-snapshot.sh
  - groups.yaml
  - restart-diddy-mopidy.sh
-  - restart-kitchen-mqttmarionette.sh
  - shell-command.yaml
-  - shutdown-kiosk.sh
-  - ssh_known_hosts
  - rest-command.yaml
  options:
    disableNameSuffixHash: true
@@ -116,16 +113,3 @@ patches:
          - name: dch-root-ca
            configMap:
              name: dch-root-ca
-images:
- name: ghcr.io/home-assistant/home-assistant
-  newTag: 2025.1.4
- name: docker.io/rhasspy/wyoming-whisper
-  newTag: 2.4.0
- name: docker.io/rhasspy/wyoming-piper
-  newTag: 1.5.0
- name: docker.io/koenkk/zigbee2mqtt
-  newTag: 2.0.0
- name: docker.io/zwavejs/zwave-js-ui
-  newTag: 9.29.1
- name: docker.io/library/eclipse-mosquitto
-  newTag: 2.0.20
--- a/home-assistant/mosquitto.yaml
+++ b/home-assistant/mosquitto.yaml
@@ -26,12 +26,11 @@ spec:
  ports:
  - port: 8883
    name: mqtt
+    nodePort: 30783
  selector:
    app.kubernetes.io/component: mosquitto
    app.kubernetes.io/name: mosquitto
-  type: ClusterIP
-  externalIPs:
-  - 172.30.0.148
+  type: NodePort

 ---
 apiVersion: apps/v1
--- a/home-assistant/restart-kitchen-mqttmarionette.sh
+++ b/home-assistant/restart-kitchen-mqttmarionette.sh
@@ -1 +0,0 @@
-ssh -i /run/secrets/home-assistant/sshkey.pem -oUserKnownHostsFile=/run/config/ssh_known_hosts -oBatchMode=yes kitchen@kitchen.pyrocufflink.red restart-mqttmarionette
--- a/home-assistant/shell-command.yaml
+++ b/home-assistant/shell-command.yaml
@@ -3,9 +3,3 @@ event_snapshot: >-

 restart_diddy_mopidy: >-
  sh /run/config/restart-diddy-mopidy.sh
-
-restart_kitchen_mqttmarionette: >-
-  sh /run/config/restart-kitchen-mqttmarionette.sh
-
-shutdown_kiosk: >-
-  sh /run/config/shutdown-kiosk.sh
--- a/home-assistant/shutdown-kiosk.sh
+++ b/home-assistant/shutdown-kiosk.sh
@@ -1,4 +0,0 @@
-#!/bin/sh
-
-set -e
-ssh -i /run/secrets/home-assistant/sshkey.pem -oUserKnownHostsFile=/run/config/ssh_known_hosts -oBatchMode=yes kiosk@deskpanel.pyrocufflink.red doas systemctl poweroff
--- a/home-assistant/ssh_known_hosts
+++ b/home-assistant/ssh_known_hosts
@@ -1,3 +0,0 @@
-diddy.pyrocufflink.red ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAILx6gRqlVnvdqTIJTH16NBLJ4ORfTsBaUIEpt5ZMkkNW
-kitchen.pyrocufflink.red ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBLzMLOlFXPiovBwYLmXCVV8Md/xR36zwPj6egT9V3O7
-deskpanel.pyrocufflink.red ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEcvO0jsZ8U2mw/HHs0BHbbEI48W0fxti8f5DuNyFS2L
--- a/home-assistant/whisper.yaml
+++ b/home-assistant/whisper.yaml
@@ -62,17 +62,12 @@ spec:
          runAsUser: 300
          runAsGroup: 300
        volumeMounts:
-        - mountPath: /tmp
-          name: tmp
-          subPath: tmp
        - name: whisper-data
          mountPath: /data
          subPath: data
      securityContext:
        fsGroup: 300
      volumes:
-      - name: tmp
-        emptyDir: {}
      - name: whisper-data
        ephemeral:
          volumeClaimTemplate:
--- a/home-assistant/zigbee2mqtt.yaml
+++ b/home-assistant/zigbee2mqtt.yaml
@@ -93,8 +93,6 @@ spec:
          name: zigbee-device
      securityContext:
        fsGroup: 302
-        supplementalGroups:
-        - 18
      volumes:
      - name: zigbee2mqtt-data
        persistentVolumeClaim:
--- a/ingress/ingress-nginx.yaml
+++ b/ingress/ingress-nginx.yaml
@@ -0,0 +1,650 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    app.kubernetes.io/instance: ingress-nginx
+    app.kubernetes.io/name: ingress-nginx
+  name: ingress-nginx
+---
+apiVersion: v1
+automountServiceAccountToken: true
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/instance: ingress-nginx
+    app.kubernetes.io/name: ingress-nginx
+    app.kubernetes.io/part-of: ingress-nginx
+    app.kubernetes.io/version: 1.3.0
+  name: ingress-nginx
+  namespace: ingress-nginx
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  labels:
+    app.kubernetes.io/component: admission-webhook
+    app.kubernetes.io/instance: ingress-nginx
+    app.kubernetes.io/name: ingress-nginx
+    app.kubernetes.io/part-of: ingress-nginx
+    app.kubernetes.io/version: 1.3.0
+  name: ingress-nginx-admission
+  namespace: ingress-nginx
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  labels:
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/instance: ingress-nginx
+    app.kubernetes.io/name: ingress-nginx
+    app.kubernetes.io/part-of: ingress-nginx
+    app.kubernetes.io/version: 1.3.0
+  name: ingress-nginx
+  namespace: ingress-nginx
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - namespaces
+  verbs:
+  - get
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - pods
+  - secrets
+  - endpoints
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - services
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - ingresses
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - ingresses/status
+  verbs:
+  - update
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - ingressclasses
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resourceNames:
+  - ingress-controller-leader
+  resources:
+  - configmaps
+  verbs:
+  - get
+  - update
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  verbs:
+  - create
+- apiGroups:
+  - coordination.k8s.io
+  resourceNames:
+  - ingress-controller-leader
+  resources:
+  - leases
+  verbs:
+  - get
+  - update
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - create
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  labels:
+    app.kubernetes.io/component: admission-webhook
+    app.kubernetes.io/instance: ingress-nginx
+    app.kubernetes.io/name: ingress-nginx
+    app.kubernetes.io/part-of: ingress-nginx
+    app.kubernetes.io/version: 1.3.0
+  name: ingress-nginx-admission
+  namespace: ingress-nginx
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - secrets
+  verbs:
+  - get
+  - create
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/instance: ingress-nginx
+    app.kubernetes.io/name: ingress-nginx
+    app.kubernetes.io/part-of: ingress-nginx
+    app.kubernetes.io/version: 1.3.0
+  name: ingress-nginx
+rules:
+- apiGroups:
+  - ""
+  resources:
+  - configmaps
+  - endpoints
+  - nodes
+  - pods
+  - secrets
+  - namespaces
+  verbs:
+  - list
+  - watch
+- apiGroups:
+  - coordination.k8s.io
+  resources:
+  - leases
+  verbs:
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - nodes
+  verbs:
+  - get
+- apiGroups:
+  - ""
+  resources:
+  - services
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - ingresses
+  verbs:
+  - get
+  - list
+  - watch
+- apiGroups:
+  - ""
+  resources:
+  - events
+  verbs:
+  - create
+  - patch
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - ingresses/status
+  verbs:
+  - update
+- apiGroups:
+  - networking.k8s.io
+  resources:
+  - ingressclasses
+  verbs:
+  - get
+  - list
+  - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  labels:
+    app.kubernetes.io/component: admission-webhook
+    app.kubernetes.io/instance: ingress-nginx
+    app.kubernetes.io/name: ingress-nginx
+    app.kubernetes.io/part-of: ingress-nginx
+    app.kubernetes.io/version: 1.3.0
+  name: ingress-nginx-admission
+rules:
+- apiGroups:
+  - admissionregistration.k8s.io
+  resources:
+  - validatingwebhookconfigurations
+  verbs:
+  - get
+  - update
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/instance: ingress-nginx
+    app.kubernetes.io/name: ingress-nginx
+    app.kubernetes.io/part-of: ingress-nginx
+    app.kubernetes.io/version: 1.3.0
+  name: ingress-nginx
+  namespace: ingress-nginx
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: ingress-nginx
+subjects:
+- kind: ServiceAccount
+  name: ingress-nginx
+  namespace: ingress-nginx
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/component: admission-webhook
+    app.kubernetes.io/instance: ingress-nginx
+    app.kubernetes.io/name: ingress-nginx
+    app.kubernetes.io/part-of: ingress-nginx
+    app.kubernetes.io/version: 1.3.0
+  name: ingress-nginx-admission
+  namespace: ingress-nginx
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: ingress-nginx-admission
+subjects:
+- kind: ServiceAccount
+  name: ingress-nginx-admission
+  namespace: ingress-nginx
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/instance: ingress-nginx
+    app.kubernetes.io/name: ingress-nginx
+    app.kubernetes.io/part-of: ingress-nginx
+    app.kubernetes.io/version: 1.3.0
+  name: ingress-nginx
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: ingress-nginx
+subjects:
+- kind: ServiceAccount
+  name: ingress-nginx
+  namespace: ingress-nginx
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  labels:
+    app.kubernetes.io/component: admission-webhook
+    app.kubernetes.io/instance: ingress-nginx
+    app.kubernetes.io/name: ingress-nginx
+    app.kubernetes.io/part-of: ingress-nginx
+    app.kubernetes.io/version: 1.3.0
+  name: ingress-nginx-admission
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: ingress-nginx-admission
+subjects:
+- kind: ServiceAccount
+  name: ingress-nginx-admission
+  namespace: ingress-nginx
+---
+apiVersion: v1
+data:
+  allow-snippet-annotations: "true"
+kind: ConfigMap
+metadata:
+  labels:
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/instance: ingress-nginx
+    app.kubernetes.io/name: ingress-nginx
+    app.kubernetes.io/part-of: ingress-nginx
+    app.kubernetes.io/version: 1.3.0
+  name: ingress-nginx-controller
+  namespace: ingress-nginx
+# We will be using `hostNetwork: true` for nginx ingress controller
+# pods, so no Service object is required.  All nodes run a copy of the
+# ingress controller (it is configured as a DaemonSet); traffic from
+# outside the cluster is sent to an arbitrary node and routed from
+# there to the appropriate Service.
+# ---
+# apiVersion: v1
+# kind: Service
+# metadata:
+#   labels:
+#     app.kubernetes.io/component: controller
+#     app.kubernetes.io/instance: ingress-nginx
+#     app.kubernetes.io/name: ingress-nginx
+#     app.kubernetes.io/part-of: ingress-nginx
+#     app.kubernetes.io/version: 1.3.0
+#   name: ingress-nginx-controller
+#   namespace: ingress-nginx
+# spec:
+#   ports:
+#   - appProtocol: http
+#     name: http
+#     port: 80
+#     protocol: TCP
+#     targetPort: http
+#   - appProtocol: https
+#     name: https
+#     port: 443
+#     protocol: TCP
+#     targetPort: https
+#   selector:
+#     app.kubernetes.io/component: controller
+#     app.kubernetes.io/instance: ingress-nginx
+#     app.kubernetes.io/name: ingress-nginx
+#   type: NodePort
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/instance: ingress-nginx
+    app.kubernetes.io/name: ingress-nginx
+    app.kubernetes.io/part-of: ingress-nginx
+    app.kubernetes.io/version: 1.3.0
+  name: ingress-nginx-controller-admission
+  namespace: ingress-nginx
+spec:
+  ports:
+  - appProtocol: https
+    name: https-webhook
+    port: 443
+    targetPort: webhook
+  selector:
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/instance: ingress-nginx
+    app.kubernetes.io/name: ingress-nginx
+  type: ClusterIP
+---
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  labels:
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/instance: ingress-nginx
+    app.kubernetes.io/name: ingress-nginx
+    app.kubernetes.io/part-of: ingress-nginx
+    app.kubernetes.io/version: 1.3.0
+  name: ingress-nginx-controller
+  namespace: ingress-nginx
+spec:
+  minReadySeconds: 0
+  revisionHistoryLimit: 10
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: controller
+      app.kubernetes.io/instance: ingress-nginx
+      app.kubernetes.io/name: ingress-nginx
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: controller
+        app.kubernetes.io/instance: ingress-nginx
+        app.kubernetes.io/name: ingress-nginx
+    spec:
+      # nginx ingress controller listens on the "real" IP address of
+      # the node.
+      hostNetwork: true
+      containers:
+      - args:
+        - /nginx-ingress-controller
+        - --election-id=ingress-controller-leader
+        - --controller-class=k8s.io/ingress-nginx
+        - --ingress-class=nginx
+        - --configmap=$(POD_NAMESPACE)/ingress-nginx-controller
+        - --validating-webhook=:8443
+        - --validating-webhook-certificate=/usr/local/certificates/cert
+        - --validating-webhook-key=/usr/local/certificates/key
+        # Publish the node's IP address as the ingress External IP
+        - --report-node-internal-ip-address
+        - --default-ssl-certificate=default/pyrocufflink-cert
+        - --tcp-services-configmap=ingress-nginx/tcp-services
+        env:
+        - name: POD_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.name
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        - name: LD_PRELOAD
+          value: /usr/local/lib/libmimalloc.so
+        image: registry.k8s.io/ingress-nginx/controller:v1.3.0@sha256:d1707ca76d3b044ab8a28277a2466a02100ee9f58a86af1535a3edf9323ea1b5
+        imagePullPolicy: IfNotPresent
+        lifecycle:
+          preStop:
+            exec:
+              command:
+              - /wait-shutdown
+        livenessProbe:
+          failureThreshold: 5
+          httpGet:
+            path: /healthz
+            port: 10254
+            scheme: HTTP
+          initialDelaySeconds: 10
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        name: controller
+        ports:
+        - containerPort: 80
+          name: http
+          protocol: TCP
+        - containerPort: 443
+          name: https
+          protocol: TCP
+        - containerPort: 8443
+          name: webhook
+          protocol: TCP
+        readinessProbe:
+          failureThreshold: 3
+          httpGet:
+            path: /healthz
+            port: 10254
+            scheme: HTTP
+          initialDelaySeconds: 10
+          periodSeconds: 10
+          successThreshold: 1
+          timeoutSeconds: 1
+        resources:
+          requests:
+            cpu: 100m
+            memory: 90Mi
+        securityContext:
+          allowPrivilegeEscalation: true
+          capabilities:
+            add:
+            - NET_BIND_SERVICE
+            drop:
+            - ALL
+          runAsUser: 101
+        volumeMounts:
+        - mountPath: /usr/local/certificates/
+          name: webhook-cert
+          readOnly: true
+      dnsPolicy: ClusterFirstWithHostNet
+      nodeSelector:
+        kubernetes.io/os: linux
+        kubernetes.io/role: ingress
+      serviceAccountName: ingress-nginx
+      terminationGracePeriodSeconds: 300
+      volumes:
+      - name: webhook-cert
+        secret:
+          secretName: ingress-nginx-admission
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  labels:
+    app.kubernetes.io/component: admission-webhook
+    app.kubernetes.io/instance: ingress-nginx
+    app.kubernetes.io/name: ingress-nginx
+    app.kubernetes.io/part-of: ingress-nginx
+    app.kubernetes.io/version: 1.3.0
+  name: ingress-nginx-admission-create
+  namespace: ingress-nginx
+spec:
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: admission-webhook
+        app.kubernetes.io/instance: ingress-nginx
+        app.kubernetes.io/name: ingress-nginx
+        app.kubernetes.io/part-of: ingress-nginx
+        app.kubernetes.io/version: 1.3.0
+      name: ingress-nginx-admission-create
+    spec:
+      containers:
+      - args:
+        - create
+        - --host=ingress-nginx-controller-admission,ingress-nginx-controller-admission.$(POD_NAMESPACE).svc
+        - --namespace=$(POD_NAMESPACE)
+        - --secret-name=ingress-nginx-admission
+        env:
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.1.1@sha256:64d8c73dca984af206adf9d6d7e46aa550362b1d7a01f3a0a91b20cc67868660
+        imagePullPolicy: IfNotPresent
+        name: create
+        securityContext:
+          allowPrivilegeEscalation: false
+      nodeSelector:
+        kubernetes.io/os: linux
+      restartPolicy: OnFailure
+      securityContext:
+        fsGroup: 2000
+        runAsNonRoot: true
+        runAsUser: 2000
+      serviceAccountName: ingress-nginx-admission
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  labels:
+    app.kubernetes.io/component: admission-webhook
+    app.kubernetes.io/instance: ingress-nginx
+    app.kubernetes.io/name: ingress-nginx
+    app.kubernetes.io/part-of: ingress-nginx
+    app.kubernetes.io/version: 1.3.0
+  name: ingress-nginx-admission-patch
+  namespace: ingress-nginx
+spec:
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: admission-webhook
+        app.kubernetes.io/instance: ingress-nginx
+        app.kubernetes.io/name: ingress-nginx
+        app.kubernetes.io/part-of: ingress-nginx
+        app.kubernetes.io/version: 1.3.0
+      name: ingress-nginx-admission-patch
+    spec:
+      containers:
+      - args:
+        - patch
+        - --webhook-name=ingress-nginx-admission
+        - --namespace=$(POD_NAMESPACE)
+        - --patch-mutating=false
+        - --secret-name=ingress-nginx-admission
+        - --patch-failure-policy=Fail
+        env:
+        - name: POD_NAMESPACE
+          valueFrom:
+            fieldRef:
+              fieldPath: metadata.namespace
+        image: registry.k8s.io/ingress-nginx/kube-webhook-certgen:v1.1.1@sha256:64d8c73dca984af206adf9d6d7e46aa550362b1d7a01f3a0a91b20cc67868660
+        imagePullPolicy: IfNotPresent
+        name: patch
+        securityContext:
+          allowPrivilegeEscalation: false
+      nodeSelector:
+        kubernetes.io/os: linux
+      restartPolicy: OnFailure
+      securityContext:
+        fsGroup: 2000
+        runAsNonRoot: true
+        runAsUser: 2000
+      serviceAccountName: ingress-nginx-admission
+---
+apiVersion: networking.k8s.io/v1
+kind: IngressClass
+metadata:
+  labels:
+    app.kubernetes.io/component: controller
+    app.kubernetes.io/instance: ingress-nginx
+    app.kubernetes.io/name: ingress-nginx
+    app.kubernetes.io/part-of: ingress-nginx
+    app.kubernetes.io/version: 1.3.0
+  name: nginx
+spec:
+  controller: k8s.io/ingress-nginx
+---
+apiVersion: admissionregistration.k8s.io/v1
+kind: ValidatingWebhookConfiguration
+metadata:
+  labels:
+    app.kubernetes.io/component: admission-webhook
+    app.kubernetes.io/instance: ingress-nginx
+    app.kubernetes.io/name: ingress-nginx
+    app.kubernetes.io/part-of: ingress-nginx
+    app.kubernetes.io/version: 1.3.0
+  name: ingress-nginx-admission
+webhooks:
+- admissionReviewVersions:
+  - v1
+  clientConfig:
+    service:
+      name: ingress-nginx-controller-admission
+      namespace: ingress-nginx
+      path: /networking/v1/ingresses
+  failurePolicy: Fail
+  matchPolicy: Equivalent
+  name: validate.nginx.ingress.kubernetes.io
+  rules:
+  - apiGroups:
+    - networking.k8s.io
+    apiVersions:
+    - v1
+    operations:
+    - CREATE
+    - UPDATE
+    resources:
+    - ingresses
+  sideEffects: None
--- a/ingress/kustomization.yaml
+++ b/ingress/kustomization.yaml
@@ -4,39 +4,5 @@ kind: Kustomization
 namespace: ingress-nginx

 resources:
- https://raw.githubusercontent.com/kubernetes/ingress-nginx/controller-v1.3.0/deploy/static/provider/cloud/deploy.yaml
-
-replicas:
- name: ingress-nginx-controller
-  count: 2
-
-patches:
- patch: |-
-    apiVersion: v1
-    kind: Service
-    metadata:
-      name: ingress-nginx-controller
-      namespace: ingress-nginx
-    spec:
-      externalIPs:
-      - 172.30.0.147
-      externalTrafficPolicy: Local
-
- patch: |-
-    - op: add
-      path: /spec/template/spec/containers/0/args/-
-      value: >-
-        --default-ssl-certificate=default/pyrocufflink-cert
-  target:
-    group: apps
-    kind: Deployment
-    name: ingress-nginx-controller
-    version: v1
-
- patch: |-
-    apiVersion: networking.k8s.io/v1
-    kind: IngressClass
-    metadata:
-      name: nginx
-      annotations:
-        ingressclass.kubernetes.io/is-default-class: "true"
+- ingress-nginx.yaml
+- tcp-services.yaml
--- a/ingress/tcp-services.yaml
+++ b/ingress/tcp-services.yaml
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: tcp-services
+data:
+  '8883': home-assistant/mosquitto:8883
+  '5671': rabbitmq/rabbitmq:5671
--- a/invoice-ninja/ingress.yaml
+++ b/invoice-ninja/ingress.yaml
@@ -9,7 +9,7 @@ metadata:
    nginx.ingress.kubernetes.io/proxy-body-size: 40m
 spec:
  rules:
-  - host: invoiceninja.pyrocufflink.net
+  - host: invoiceninja.pyrocufflink.blue
    http:
      paths:
      - path: /
@@ -46,17 +46,3 @@ spec:
            name: invoice-ninja
            port:
              name: http
-
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: invoice-ninja-redirect
-  labels:
-    app.kubernetes.io/name: invoice-ninja-redirect
-    app.kubernetes.io/component: invoice-ninja
-  annotations:
-    nginx.ingress.kubernetes.io/permanent-redirect: https://invoiceninja.pyrocufflink.net
-spec:
-  rules:
-  - host: invoiceninja.pyrocufflink.blue
--- a/invoice-ninja/invoice-ninja.env
+++ b/invoice-ninja/invoice-ninja.env
@@ -1,6 +1,6 @@
-APP_LOGO=https://invoiceninja.pyrocufflink.net/images/logo.png
-APP_URL=https://invoiceninja.pyrocufflink.net
-TRUSTED_PROXIES=10.149.0.0/16
+APP_LOGO=https://invoiceninja.pyrocufflink.blue/images/logo.png
+APP_URL=https://invoiceninja.pyrocufflink.blue
+TRUSTED_PROXIES=172.30.0.171,172.30.0.172,172.30.0.173

 MAIL_MAILER=smtp
 MAIL_HOST=mail.pyrocufflink.blue
--- a/invoice-ninja/kustomization.yaml
+++ b/invoice-ninja/kustomization.yaml
@@ -19,6 +19,7 @@ resources:
 configMapGenerator:
 - name: invoice-ninja-init
  files:
+  - init.sh
  - start.sh

 - name: invoice-ninja
--- a/invoice-ninja/network-policy.yaml
+++ b/invoice-ninja/network-policy.yaml
@@ -29,9 +29,8 @@ spec:
    ports:
    - port: 25
  - to:
-    - namespaceSelector:
-        matchLabels:
-          kubernetes.io/metadata.name: ingress-nginx
+    - ipBlock:
+        cidr: 172.30.0.160/28
    ports:
    - port: 80
    - port: 443
--- a/jenkins/gentoo-storage.yaml
+++ b/jenkins/gentoo-storage.yaml
@@ -1,170 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: portage
-  namespace: jenkins-jobs
-  labels:
-    app.kubernetes.io/name: portage
-    app.kubernetes.io/component: gentoo
-spec:
-  accessModes:
-  - ReadWriteMany
-  resources:
-    requests:
-      storage: 4Gi
-
---
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: binpkgs
-  namespace: jenkins-jobs
-  labels:
-    app.kubernetes.io/name: binpkgs
-    app.kubernetes.io/component: gentoo
-spec:
-  accessModes:
-  - ReadWriteMany
-  resources:
-    requests:
-      storage: 10Gi
-
---
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: gentoo-dist
-  namespace: jenkins-jobs
-  labels:
-    app.kubernetes.io/name: gentoo-dist
-    app.kubernetes.io/component: gentoo
-data:
-  rsyncd.conf: |+
-    [gentoo-portage]
-    path = /var/db/repos/gentoo
-
-    [binpkgs]
-    path = /var/cache/binpkgs
-
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: gentoo-dist
-  namespace: jenkins-jobs
-spec:
-  selector:
-    app.kubernetes.io/name: gentoo-dist
-    app.kubernetes.io/component: gentoo
-  ports:
-  - name: rsync
-    port: 873
-    targetPort: rsync
-  type: NodePort
-
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: gentoo-dist
-  namespace: jenkins-jobs
-  labels: &labels
-    app.kubernetes.io/name: gentoo-dist
-    app.kubernetes.io/component: gentoo
-spec:
-  selector:
-    matchLabels: *labels
-  template:
-    metadata:
-      labels: *labels
-    spec:
-      containers:
-      - name: rsync
-        image: docker.io/gentoo/stage3
-        command:
-        - /usr/bin/rsync
-        - --daemon
-        - --no-detach
-        - --port=8873
-        - --log-file=/dev/stderr
-        ports:
-        - name: rsync
-          containerPort: 8873
-        securityContext:
-          readOnlyRootFilesystem: true
-          runAsUser: 250
-          runAsGroup: 250
-        volumeMounts:
-        - mountPath: /etc/rsyncd.conf
-          name: config
-          subPath: rsyncd.conf
-        - mountPath: /var/db/repos/gentoo
-          name: portage
-        - mountPath: /var/cache/binpkgs
-          name: binpkgs
-      volumes:
-      - name: binpkgs
-        persistentVolumeClaim:
-          claimName: binpkgs
-      - name: config
-        configMap:
-          name: gentoo-dist
-      - name: portage
-        persistentVolumeClaim:
-          claimName: portage
-
---
-apiVersion: batch/v1
-kind: Job
-metadata:
-  name: emerge-webrsync
-  namespace: jenkins-jobs
-  labels:
-    app.kubernetes.io/name: emerge-webrsync
-    app.kubernetes.io/component: gentoo
-spec:
-  template:
-    spec:
-      containers:
-      - name: sync
-        image: docker.io/gentoo/stage3
-        command:
-        - emerge-webrsync
-        volumeMounts:
-        - mountPath: /var/db/repos/gentoo
-          name: portage
-      restartPolicy: OnFailure
-      volumes:
-      - name: portage
-        persistentVolumeClaim:
-          claimName: portage
-
---
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: sync-portage
-  namespace: jenkins-jobs
-  labels:
-    app.kubernetes.io/name: sync-portage
-    app.kubernetes.io/component: gentoo
-spec:
-  schedule: 4 19 * * *
-  jobTemplate:
-    spec:
-      template:
-        spec:
-          containers:
-          - name: sync
-            image: docker.io/gentoo/stage3
-            command:
-            - emaint
-            - sync
-            volumeMounts:
-            - mountPath: /var/db/repos/gentoo
-              name: portage
-          restartPolicy: OnFailure
-          volumes:
-          - name: portage
-            persistentVolumeClaim:
-              claimName: portage
--- a/jenkins/kustomization.yaml
+++ b/jenkins/kustomization.yaml
@@ -9,7 +9,6 @@ resources:
 - jenkins.yaml
 - secrets.yaml
 - iscsi.yaml
- gentoo-storage.yaml

 configMapGenerator:
 - name: ssh-known-hosts
--- a/jenkins/ssh_known_hosts
+++ b/jenkins/ssh_known_hosts
@@ -1,5 +1,4 @@
@cert-authority *.pyrocufflink.blue ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII24CZGosLMTny0a2eDB6KOG47FhlwVkTEFQNAYzKV0t
-@cert-authority *.pyrocufflink.black ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAII24CZGosLMTny0a2eDB6KOG47FhlwVkTEFQNAYzKV0t
 files.pyrocufflink.blue ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBH+S6aTqXJ15DV3NczbPXVQKXxbvMVtaHToShsrhxps1GGWcJU/pbZtpAQcN4OGth7DQ1Q/1RvrFS+Fd/5U4wv4=
 files.pyrocufflink.blue ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIFzOkLdjAJDPyja2o4+Km52VNM4t7jeYTyMVYl4gtudq
 files.pyrocufflink.blue ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDbgN04bblL95EStM+wpGF1asvEOL6vmH/oNTIBRd0HbTz8jRa3CMOGWWG7/xGIRjrXglAGURGZ/EOqkyGIsciVtC53lwLuyZT18sqHrmp8S5uq/rNaY3rSVfc7kW/fXsNksjtwnQ/sNtawSZ6UFv+p/X47qOGv0XPAwAzoXDwDpQ27wOz1YnbBa+5itThLh6QvxgM1DKnb78uZ1TBpaCCdtL2iH1IVo3FLmah9bNWvUU1QECKyOUDw3IiwIS6owtHIrpdCiZTlPSJhBLPvv7P/L9V0bTfREP+MMDBT1hhj2NUgmDxC4sDd8k1Qy/qxeyU/FA+7dn7K8YVIEe9rNbs/
--- a/keepalived/keepalived.conf
+++ b/keepalived/keepalived.conf
@@ -1,60 +0,0 @@
-# vim: set sw=4 ts=4 sts=4 et:
-includea /run/keepalived.interface
-
-global_defs {
-    max_auto_priority 79
-}
-
-vrrp_track_process ingress-nginx {
-    process nginx-ingress-c
-    weight 90
-}
-
-vrrp_track_process mosquitto {
-    process mosquitto
-    weight 90
-}
-
-vrrp_track_process rabbitmq {
-    process rabbitmq-server
-    weight 90
-}
-
-vrrp_instance ingress-nginx {
-    state BACKUP
-    priority 100
-    interface ${INTERFACE}
-    virtual_router_id 51
-    virtual_ipaddress {
-        172.30.0.147/28
-    }
-    track_process {
-        ingress-nginx
-    }
-}
-
-vrrp_instance mosquitto {
-    state BACKUP
-    priority 100
-    interface ${INTERFACE}
-    virtual_router_id 52
-    virtual_ipaddress {
-        172.30.0.148/28
-    }
-    track_process {
-        mosquitto
-    }
-}
-
-vrrp_instance rabbitmq {
-    state BACKUP
-    priority 100
-    interface ${INTERFACE}
-    virtual_router_id 53
-    virtual_ipaddress {
-        172.30.0.149/28
-    }
-    track_process {
-        rabbitmq
-    }
-}
--- a/keepalived/keepalived.yaml
+++ b/keepalived/keepalived.yaml
@@ -1,54 +0,0 @@
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: keepalived
-  labels: &labels
-    app.kubernetes.io/name: keepalived
-spec:
-  selector:
-    matchLabels: *labels
-  minReadySeconds: 10
-  template:
-    metadata:
-      labels: *labels
-    spec:
-      initContainers:
-      - name: init
-        image: docker.io/library/busybox
-        command:
-        - sh
-        - -c
-        - |
-          printf '$INTERFACE=%s\n' \
-            $(ip route | awk '/^default via/{print $5}') \
-            > /run/keepalived.interface
-        volumeMounts:
-        - mountPath: /run
-          name: tmp
-          subPath: run
-      containers:
-      - name: keepalived
-        image: git.pyrocufflink.net/containerimages/keepalived:dev
-        imagePullPolicy: Always
-        command:
-        - keepalived
-        - -nGlD
-        securityContext:
-          privileged: true
-          readOnlyRootFilesystem: true
-        volumeMounts:
-        - mountPath: /etc/keepalived
-          name: config
-          readOnly: true
-        - mountPath: /run
-          name: tmp
-          subPath: run
-      hostNetwork: true
-      hostPID: true
-      volumes:
-      - name: config
-        configMap:
-          name: keepalived
-      - name: tmp
-        emptyDir:
-          medium: Memory
--- a/keepalived/kustomization.yaml
+++ b/keepalived/kustomization.yaml
@@ -1,24 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-labels:
- pairs:
-    app.kubernetes.io/component: keepalived
-    app.kubernetes.io/instance: keepalived
-  includeSelectors: true
-  includeTemplates: true
- pairs:
-    app.kubernetes.io/part-of: keepalived
-
-namespace: keepalived
-
-resources:
- keepalived.yaml
-
-configMapGenerator:
- name: keepalived
-  files:
-  - keepalived.conf
-  options:
-    labels:
-      app.kubernetes.io/name: keepalived
--- a/keepalived/namespace.yaml
+++ b/keepalived/namespace.yaml
@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: keepalived
-  labels:
-    app.kubernetes.io/name: keepalived
--- a/ntfy/kustomization.yaml
+++ b/ntfy/kustomization.yaml
@@ -1,23 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-namespace: ntfy
-
-resources:
- ntfy.yaml
-
-configMapGenerator:
- name: ntfy
-  namespace: ntfy
-  files:
-  - server.yml
-  options:
-    labels:
-      app.kubernetes.io/name: ntfy
-      app.kubernetes.io/component: ntfy
-      app.kubernetes.io/instance: ntfy
-      app.kubernetes.io/part-of: ntfy
-
-images:
- name: docker.io/binwiederhier/ntfy
-  newTag: v2.11.0
--- a/ntfy/ntfy.yaml
+++ b/ntfy/ntfy.yaml
@@ -5,6 +5,25 @@ metadata:
  labels:
    app.kubernetes.io/instance: ntfy

+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: ntfy
+  namespace: ntfy
+  labels:
+    app.kubernetes.io/name: ntfy
+    app.kubernetes.io/component: ntfy
+    app.kubernetes.io/instance: ntfy
+    app.kubernetes.io/part-of: ntfy
+data:
+  server.yml: |+
+    base-url: https://ntfy.pyrocufflink.net
+    behind-proxy: true
+    listen-http: '[::]:2586'
+    attachment-cache-dir: /var/cache/ntfy/attachments
+    attachment-file-size-limit: 100M
+
 ---
 apiVersion: v1
 kind: Service
@@ -110,7 +129,7 @@ spec:
  ingressClassName: nginx
  rules:
  - host: ntfy.pyrocufflink.blue
-    http: &http
+    http:
      paths:
      - path: /
        pathType: Prefix
@@ -119,9 +138,6 @@ spec:
            name: ntfy
            port:
              name: http
-  - host: ntfy.pyrocufflink.net
-    http: *http
  tls:
  - hosts:
    - ntfy.pyrocufflink.blue
-    - ntfy.pyrocufflink.net
--- a/ntfy/server.yml
+++ b/ntfy/server.yml
@@ -1,6 +0,0 @@
-base-url: https://ntfy.pyrocufflink.net
-behind-proxy: true
-listen-http: '[::]:2586'
-attachment-cache-dir: /var/cache/ntfy/attachments
-attachment-file-size-limit: 100M
-enable-metrics: true
--- a/paperless-ngx/gotenberg.yaml
+++ b/paperless-ngx/gotenberg.yaml
@@ -1,69 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app.kubernetes.io/name: gotenberg
-    app.kubernetes.io/component: gotenberg
-    app.kubernetes.io/instance: paperless-ngx
-    app.kubernetes.io/part-of: paperless-ngx
-  name: gotenberg
-  namespace: paperless-ngx
-spec:
-  ports:
-  - name: gotenberg
-    port: 3000
-  selector:
-    app.kubernetes.io/name: gotenberg
-    app.kubernetes.io/component: gotenberg
-    app.kubernetes.io/instance: paperless-ngx
-  type: ClusterIP
-
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: gotenberg
-  namespace: paperless-ngx
-  labels:
-    app.kubernetes.io/name: gotenberg
-    app.kubernetes.io/component: gotenberg
-    app.kubernetes.io/instance: paperless-ngx
-    app.kubernetes.io/part-of: paperless-ngx
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: gotenberg
-      app.kubernetes.io/component: gotenberg
-      app.kubernetes.io/instance: paperless-ngx
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: gotenberg
-        app.kubernetes.io/component: gotenberg
-        app.kubernetes.io/instance: paperless-ngx
-    spec:
-      containers:
-      - name: gotenberg
-        image: docker.io/gotenberg/gotenberg:7.5.4
-        imagePullPolicy: IfNotPresent
-        command:
-        - gotenberg
-        - --chromium-disable-javascript=true
-        - --chromium-allow-list=file:///tmp/.*
-        securityContext:
-          runAsNonRoot: true
-          readOnlyRootFilesystem: true
-          runAsUser: 1001
-          runAsGroup: 1001
-        volumeMounts:
-        - mountPath: /home/gotenberg
-          name: tmp
-          subPath: home
-        - mountPath: /tmp
-          name: tmp
-          subPath: tmp
-      securityContext:
-        fsGroup: 1001
-      volumes:
-      - name: tmp
-        emptyDir:
--- a/paperless-ngx/kustomization.yaml
+++ b/paperless-ngx/kustomization.yaml
@@ -1,31 +1,10 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization

-namespace: paperless-ngx
-
-labels:
- pairs:
-    app.kubernetes.io/instance: paperless-ngx
-
 resources:
- namespace.yaml
- redis.yaml
- gotenberg.yaml
- tika.yaml
 - paperless-ngx.yaml
 - ingress.yaml

-configMapGenerator:
- name: paperless-cmd
-  files:
-  - paperless_cmd.sh
-  options:
-    labels:
-      app.kubernetes.io/name: paperless_cmd.sh
-      app.kubernetes.io/component: paperless-ngx
-      app.kubernetes.io/part-of: paperless-ngx
-    disableNameSuffixHash: true
-
 patches:
 - target:
    kind: StatefulSet
@@ -43,10 +22,3 @@ patches:
            - name: PAPERLESS_URL
              value: https://paperless.pyrocufflink.blue

-images:
- name: ghcr.io/paperless-ngx/paperless-ngx
-  newTag: 2.14.5
- name: docker.io/gotenberg/gotenberg
-  newTag: 8.15.3
- name: docker.io/apache/tika
-  newTag: 3.0.0.0
--- a/paperless-ngx/namespace.yaml
+++ b/paperless-ngx/namespace.yaml
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: paperless-ngx
--- a/paperless-ngx/paperless-ngx.yaml
+++ b/paperless-ngx/paperless-ngx.yaml
@@ -1,4 +1,29 @@
 apiVersion: v1
+kind: Namespace
+metadata:
+  name: paperless-ngx
+  labels:
+    app.kubernetes.io/instance: paperless-ngx
+
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: paperless-cmd
+  namespace: paperless-ngx
+  labels:
+    app.kubernetes.io/name: paperless_cmd.sh
+    app.kubernetes.io/component: paperless-ngx
+    app.kubernetes.io/instance: paperless-ngx
+    app.kubernetes.io/part-of: paperless-ngx
+data:
+  paperless_cmd.sh: |+
+    #!/bin/sh
+
+    exec /usr/local/bin/supervisord -c /etc/supervisord.conf --user paperless
+
+---
+apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
  name: paperless-ngx
@@ -15,6 +40,27 @@ spec:
    requests:
      storage: 20Gi

+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/name: redis
+    app.kubernetes.io/component: redis
+    app.kubernetes.io/instance: paperless-ngx
+    app.kubernetes.io/part-of: paperless-ngx
+  name: redis
+  namespace: paperless-ngx
+spec:
+  ports:
+  - name: redis
+    port: 6379
+  selector:
+    app.kubernetes.io/name: redis
+    app.kubernetes.io/component: redis
+    app.kubernetes.io/instance: paperless-ngx
+  type: ClusterIP
+
 ---
 apiVersion: v1
 kind: Service
@@ -36,6 +82,113 @@ spec:
    app.kubernetes.io/instance: paperless-ngx
  type: ClusterIP

+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/name: gotenberg
+    app.kubernetes.io/component: gotenberg
+    app.kubernetes.io/instance: paperless-ngx
+    app.kubernetes.io/part-of: paperless-ngx
+  name: gotenberg
+  namespace: paperless-ngx
+spec:
+  ports:
+  - name: gotenberg
+    port: 3000
+  selector:
+    app.kubernetes.io/name: gotenberg
+    app.kubernetes.io/component: gotenberg
+    app.kubernetes.io/instance: paperless-ngx
+  type: ClusterIP
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    app.kubernetes.io/name: tika
+    app.kubernetes.io/component: tika
+    app.kubernetes.io/instance: paperless-ngx
+    app.kubernetes.io/part-of: paperless-ngx
+  name: tika
+  namespace: paperless-ngx
+spec:
+  ports:
+  - name: tika
+    port: 9998
+  selector:
+    app.kubernetes.io/name: tika
+    app.kubernetes.io/component: tika
+    app.kubernetes.io/instance: paperless-ngx
+  type: ClusterIP
+
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: redis
+  namespace: paperless-ngx
+  labels:
+    app.kubernetes.io/name: redis
+    app.kubernetes.io/component: redis
+    app.kubernetes.io/instance: paperless-ngx
+    app.kubernetes.io/part-of: paperless-ngx
+spec:
+  serviceName: redis
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: redis
+      app.kubernetes.io/component: redis
+      app.kubernetes.io/instance: paperless-ngx
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: redis
+        app.kubernetes.io/component: redis
+        app.kubernetes.io/instance: paperless-ngx
+    spec:
+      containers:
+      - name: redis
+        image: docker.io/library/redis:7
+        imagePullPolicy: IfNotPresent
+        ports:
+        - name: redis
+          containerPort: 6379
+        securityContext:
+          runAsNonRoot: true
+          readOnlyRootFilesystem: true
+          runAsUser: 1000
+          runAsGroup: 1000
+        volumeMounts:
+        - name: data
+          mountPath: /data
+          subPath: data
+        - name: tmp
+          mountPath: /tmp
+      securityContext:
+        fsGroup: 1000
+      volumes:
+      - name: tmp
+        emptyDir:
+  volumeClaimTemplates:
+  - apiVersion: v1
+    kind: PersistentVolumeClaim
+    metadata:
+      name: data
+      labels:
+        app.kubernetes.io/name: redis
+        app.kubernetes.io/component: redis
+        app.kubernetes.io/part-of: paperless-ngx
+    spec:
+      accessModes:
+      - ReadWriteOnce
+      resources:
+        requests:
+          storage: 2Gi
+
+
 ---
 apiVersion: apps/v1
 kind: StatefulSet
@@ -146,3 +299,91 @@ spec:
      - name: run
        emptyDir:
          medium: Memory
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gotenberg
+  namespace: paperless-ngx
+  labels:
+    app.kubernetes.io/name: gotenberg
+    app.kubernetes.io/component: gotenberg
+    app.kubernetes.io/instance: paperless-ngx
+    app.kubernetes.io/part-of: paperless-ngx
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: gotenberg
+      app.kubernetes.io/component: gotenberg
+      app.kubernetes.io/instance: paperless-ngx
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: gotenberg
+        app.kubernetes.io/component: gotenberg
+        app.kubernetes.io/instance: paperless-ngx
+    spec:
+      containers:
+      - name: gotenberg
+        image: docker.io/gotenberg/gotenberg:7.5.4
+        imagePullPolicy: IfNotPresent
+        command:
+        - gotenberg
+        - --chromium-disable-javascript=true
+        - --chromium-allow-list=file:///tmp/.*
+        securityContext:
+          runAsNonRoot: true
+          readOnlyRootFilesystem: true
+          runAsUser: 1000
+          runAsGroup: 1000
+        volumeMounts:
+        - name: tmp
+          mountPath: /tmp
+      securityContext:
+        fsGroup: 1000
+      volumes:
+      - name: tmp
+        emptyDir:
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: tika
+  namespace: paperless-ngx
+  labels:
+    app.kubernetes.io/name: tika
+    app.kubernetes.io/component: tika
+    app.kubernetes.io/instance: paperless-ngx
+    app.kubernetes.io/part-of: paperless-ngx
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: tika
+      app.kubernetes.io/component: tika
+      app.kubernetes.io/instance: paperless-ngx
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: tika
+        app.kubernetes.io/component: tika
+        app.kubernetes.io/instance: paperless-ngx
+    spec:
+      containers:
+      - name: tika
+        image: ghcr.io/paperless-ngx/tika:2.5.0-minimal
+        imagePullPolicy: IfNotPresent
+        securityContext:
+          runAsNonRoot: true
+          readOnlyRootFilesystem: true
+          runAsUser: 1000
+          runAsGroup: 1000
+        volumeMounts:
+        - name: tmp
+          mountPath: /tmp
+      securityContext:
+        fsGroup: 1000
+      volumes:
+      - name: tmp
+        emptyDir:
--- a/paperless-ngx/paperless_cmd.sh
+++ b/paperless-ngx/paperless_cmd.sh
@@ -1,4 +0,0 @@
-#!/bin/sh
-
-exec /usr/local/bin/supervisord -c /etc/supervisord.conf --user paperless
-
--- a/paperless-ngx/redis.yaml
+++ b/paperless-ngx/redis.yaml
@@ -1,83 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app.kubernetes.io/name: redis
-    app.kubernetes.io/component: redis
-    app.kubernetes.io/instance: paperless-ngx
-    app.kubernetes.io/part-of: paperless-ngx
-  name: redis
-  namespace: paperless-ngx
-spec:
-  ports:
-  - name: redis
-    port: 6379
-  selector:
-    app.kubernetes.io/name: redis
-    app.kubernetes.io/component: redis
-    app.kubernetes.io/instance: paperless-ngx
-  type: ClusterIP
-
---
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: redis
-  namespace: paperless-ngx
-  labels:
-    app.kubernetes.io/name: redis
-    app.kubernetes.io/component: redis
-    app.kubernetes.io/instance: paperless-ngx
-    app.kubernetes.io/part-of: paperless-ngx
-spec:
-  serviceName: redis
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: redis
-      app.kubernetes.io/component: redis
-      app.kubernetes.io/instance: paperless-ngx
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: redis
-        app.kubernetes.io/component: redis
-        app.kubernetes.io/instance: paperless-ngx
-    spec:
-      containers:
-      - name: redis
-        image: docker.io/library/redis:7
-        imagePullPolicy: IfNotPresent
-        ports:
-        - name: redis
-          containerPort: 6379
-        securityContext:
-          runAsNonRoot: true
-          readOnlyRootFilesystem: true
-          runAsUser: 1000
-          runAsGroup: 1000
-        volumeMounts:
-        - name: data
-          mountPath: /data
-          subPath: data
-        - name: tmp
-          mountPath: /tmp
-      securityContext:
-        fsGroup: 1000
-      volumes:
-      - name: tmp
-        emptyDir:
-  volumeClaimTemplates:
-  - apiVersion: v1
-    kind: PersistentVolumeClaim
-    metadata:
-      name: data
-      labels:
-        app.kubernetes.io/name: redis
-        app.kubernetes.io/component: redis
-        app.kubernetes.io/part-of: paperless-ngx
-    spec:
-      accessModes:
-      - ReadWriteOnce
-      resources:
-        requests:
-          storage: 2Gi
--- a/paperless-ngx/tika.yaml
+++ b/paperless-ngx/tika.yaml
@@ -1,61 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app.kubernetes.io/name: tika
-    app.kubernetes.io/component: tika
-    app.kubernetes.io/instance: paperless-ngx
-    app.kubernetes.io/part-of: paperless-ngx
-  name: tika
-  namespace: paperless-ngx
-spec:
-  ports:
-  - name: tika
-    port: 9998
-  selector:
-    app.kubernetes.io/name: tika
-    app.kubernetes.io/component: tika
-    app.kubernetes.io/instance: paperless-ngx
-  type: ClusterIP
-
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: tika
-  namespace: paperless-ngx
-  labels:
-    app.kubernetes.io/name: tika
-    app.kubernetes.io/component: tika
-    app.kubernetes.io/instance: paperless-ngx
-    app.kubernetes.io/part-of: paperless-ngx
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: tika
-      app.kubernetes.io/component: tika
-      app.kubernetes.io/instance: paperless-ngx
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: tika
-        app.kubernetes.io/component: tika
-        app.kubernetes.io/instance: paperless-ngx
-    spec:
-      containers:
-      - name: tika
-        image: docker.io/apache/tika:2.5.0
-        imagePullPolicy: IfNotPresent
-        securityContext:
-          runAsNonRoot: true
-          readOnlyRootFilesystem: true
-          runAsUser: 1000
-          runAsGroup: 1000
-        volumeMounts:
-        - name: tmp
-          mountPath: /tmp
-      securityContext:
-        fsGroup: 1000
-      volumes:
-      - name: tmp
-        emptyDir:
--- a/rabbitmq/rabbitmq.yaml
+++ b/rabbitmq/rabbitmq.yaml
@@ -1,4 +1,19 @@
 apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: rabbitmq
+  labels:
+    app.kubernetes.io/name: rabbitmq
+    app.kubernetes.io/component: rabbitmq
+spec:
+  accessModes:
+  - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+
+---
+apiVersion: v1
 kind: Service
 metadata:
  labels:
@@ -13,9 +28,6 @@ spec:
    app.kubernetes.io/name: rabbitmq
    app.kubernetes.io/component: rabbitmq
  type: ClusterIP
-  externalIPs:
-  - 172.30.0.149
-  externalTrafficPolicy: Local

 ---
 apiVersion: apps/v1
@@ -39,7 +51,7 @@ spec:
    spec:
      containers:
      - name: rabbitmq
-        image: docker.io/library/rabbitmq:4.0-alpine
+        image: docker.io/library/rabbitmq:3.13-alpine
        ports:
        - name: amqps
          containerPort: 5671
@@ -70,7 +82,7 @@ spec:
          name: tmp
          subPath: tmp
        - mountPath: /var/lib/rabbitmq
-          name: data
+          name: rabbitmq-data
          subPath: data
      securityContext:
        runAsNonRoot: true
@@ -86,20 +98,10 @@ spec:
      - name: rabbitmq-config
        configMap:
          name: rabbitmq
+      - name: rabbitmq-data
+        persistentVolumeClaim:
+          claimName: rabbitmq
      - name: tmp
        emptyDir:
          medium: Memory
-  volumeClaimTemplates:
-  - apiVersion: v1
-    kind: PersistentVolumeClaim
-    metadata:
-      name: data
-      labels:
-        app.kubernetes.io/name: rabbitmq
-        app.kubernetes.io/component: rabbitmq
-    spec:
-      accessModes:
-      - ReadWriteOnce
-      resources:
-        requests:
-          storage: 1Gi
+
--- a/restic-exporter/kustomization.yaml
+++ b/restic-exporter/kustomization.yaml
@@ -12,7 +12,6 @@ resources:
 - network-policy.yaml
 - restic-exporter.yaml
 - secrets.yaml
- ../dch-root-ca

 configMapGenerator:
 - name: restic-exporter
@@ -30,19 +29,8 @@ patches:
        spec:
          containers:
          - name: restic-exporter
-            env:
-            - name: RESTIC_CACERT
-              value: /run/dch-ca/dch-root-ca.crt
            envFrom:
            - secretRef:
                name: restic-s3
            - configMapRef:
                name: restic-exporter
-            volumeMounts:
-            - mountPath: /run/dch-ca
-              name: dch-ca
-              readOnly: true
-          volumes:
-          - name: dch-ca
-            configMap:
-              name: dch-root-ca
--- a/restic-exporter/network-policy.yaml
+++ b/restic-exporter/network-policy.yaml
@@ -21,9 +21,9 @@ spec:
      protocol: TCP
  - to:
    - ipBlock:
-        cidr: 172.30.0.15/32
+        cidr: 172.30.0.30/32
    ports:
-    - port: 443
+    - port: 9000
  ingress:
  - from:
    - namespaceSelector:
--- a/restic-exporter/restic-exporter.env
+++ b/restic-exporter/restic-exporter.env
@@ -1,4 +1,4 @@
 TZ=America/Chicago
-RESTIC_REPOSITORY=s3:s3.backups.pyrocufflink.blue/restic
+RESTIC_REPOSITORY=s3:https://burp.pyrocufflink.blue:9000/restic
 INCLUDE_PATHS=True
 REFRESH_INTERVAL=3600
--- a/restic-exporter/secrets.yaml
+++ b/restic-exporter/secrets.yaml
@@ -31,8 +31,8 @@ metadata:
    app.kubernetes.io/part-of: restic-exporter
 spec:
  encryptedData:
-    AWS_ACCESS_KEY_ID: AgAhNzhHnjDoEopNvdZaVxe84VhtxMiwxzYbwrFNvBkWMTF3aHbVjB2/qsWMjNU+a/jFFgFJZQzzfGK6Y9o0G3xFZaMwiBvBKBxRAOS6c2J8ClB7enCPD8HkAW/6BeuY3KsUW9wSEbGBlx8oW9tRWEOVFsRv6KHZwwh/vNfvSCiCXsZgBFAPorFy0Bh9FX+3PyZhANH6AAugWzGnxZGlRcNEgYx8ZnQovlFhhSxZsmUnSwyKzpZP2h+A48N3q+aUooFQlWuq6zGMEJqrFpMwiYg0M4A+60LBXneZGzc13FibWpbWpwEoX7YljnYYVnsat002U1qgkxSCoU75EKn3nay3vO6jT8lV5CUMGzbhxdNnaKbKevpaZgRZlUirrh+KGvG6pU8JghsiCKsP+HAuFRPTVfUYM2L13v5WDqOyVvLFT7S1Z1fl+LDwm1u7SPr8HYkEdgI/7ALD+vEBDUKmSCiQ8/sR3HGz9roDu8Lh0+HFZyUeuW27mEaDtSI5c/jKpWR8exN6ltClRS7vNyWuNGe1Jq3v7qyWrLEziTwxd2vunmvE/0bS6U4VgrkAvct0e6OUycuKP2Aaik/3tJA5OGYcw6x9hymc0y+XHszrIrkxJ6n4dtYP1Ymsf8OiqMTj3SOrP3+zUaFlSLi3474KlxmBR3GN/9W3wJx0nFhceXvoZVETtjdJXsfgXgMJ874WxC3YGld3weYqVSrIIs2BdjjTAc2j5g==
-    AWS_SECRET_ACCESS_KEY: AgC26kXxZxlGlIUTFVu1aG/4c+UhCnudcOmHfmqXqwDqkY4OSEuFkdpp2uTdziT3oGGLlNxcjYUJRD1Jkn+d8TAuqMfKqaosILne6SwRzAFFn1+hYyntwuV4gvCjNn6dpI5uaweX2tpwqS8RG+aGhesugLD2XpRqh+iLrqEf6vJrfJHuURmrnHmU+zl3+3RrsjFf3BaUBOHBJRA/b/QoyBsrZ/ABbp9MVP8b7g7N7+2WVE4XMvlaVfax8J49XekMISKvqnw4oEV/UB471q6wODlQC+uSzepcFX+kBrwpkGGDrtYdPISeVtYdPQ1QDRX7XVw35s1wA67hh8UuNkp2CxMJ8VUz/uVIoMPv9EdnLiWZC2/OO84jLWcFPz/w7/LyBiicmWgaCd+A9HtODBW6Gdg8s6+8mmD3u4YQW3PgYVuI1tTWccn1FCLd3O5U3V8pS88aNRqg2c9FdQ853SNv6CJwm5CjeHW7go6KaJlbElVpqy3Vi3WY+/76HVBrfo6T6RtDc18wcBLpfDh1DiVwpVHqiVwNTPMLgalnX+VuohU6LsnRzQo0jvzx9OfwhdNA+pHGgfQt2nrKHr8pSqnPsaJBlXzm4N2Su2MeXVn962RYU1KtcciClKG70WdRxUxZ/EGKqCgleUS+1kSC488XYWSwg44zCEHqfzJxgF1ykCAF6oG5FT+rKpB4845OHsFKEn2X9gDb3UExNSuyzdQeyxSQSVo1EivjQbh2jK3vtdGckkmfJ8Nlxmoi
+    AWS_ACCESS_KEY_ID: AgCiUz6l8sPPSxh8lmtH4HEiQEu2EWN8zpS3Farh4/CxWVn01HufAU7n7xxPjMTkkoCfa42ux/WNLl3Gl539CgAoyaudlAfuzl+Uq5w3S1XesL/lTwBqYr3mF0ZeGxeHBh2h+S9IaTPef9SWFTV/F+X3rDOKw6OfMLSI3TZAarVuvNJ9GnK8vTu5MoE+4IhHfJRBor4qI9TGKOQQDtoQP9xcwWrOQJOKvyXGtOmz/u+H4K5VVsGvPpIWYDHS3V1HIzCaVLDEulL13dyNofXKmQB7mW7yPhRIn/MJGfuAvUXAE5Or1bgamftCujtl1nR8/K5Gq6h5212hVCtY2F8YMBZSt5G+GmitTSz7PJrjTB6OzXy1Uu+bNGWgjtck6bxzm/pkO44bC5/ZvhB0AESDSBIkpBSm1o7LMl6rCF+mUybsGNmRq9mcMvtMwAbUgzEewlMbdA+zN/YqEJFMZWcE9fYHms9pil3O+mDB1LilBMUczPD/zzpP88b2m36XmT3nSRBCTcfx8nqaqB6dvYK2AYjmM9iDPM0jRxZOaA6WZy3PsTUeJvfzxNapfE72lWREtaTVP3wfhwt2BcoiIxWqc7i/9LplcEOl62S2WhMtP0wJGXMSWmzxOPHno98u1aA4r/2K3LBk+9gSzA9grwi3VpK9NsADf1vFbLmd25eDqSe6zQl5YNk+Ty20uHqK53fdqwkM2WlvOmakXlw9dBr1CWGr
+    AWS_SECRET_ACCESS_KEY: AgCJ3K0gt8GqI3go1fQ/pMjFjpW0Z+j/YElaPqTUp8dpuhEdRS3MybCOjLhKwfpQN/nufRXbk0hLZYgloGznjEpdJvP4EEb3uwwdfZ2oP+h8YVyHpHsh7DlnuHUk7RwGJiL+wb+Xnh6ChsYKQQ2HfWnIQ+JZMGKDMQqaq0CwaQAde8MUZlJyqu7tZjD5wP3PFf6WxG2lwQiwD7vMi+M/r8h0a5Sf4TVdXIrRSPE9nvVmuaN7+4eAmOmzRmVqUxXqHhSL0/yMichOFGXXOCWryQlM/gm0BETEj8g9RdhqyJ6iXvgR8/ObZUQ4zoOeonaQQNZYOjgcZ+oWD+8n0gayziCIQz1Czf3HeGyXFpmVRCcQKOFb+Pz/U308zefDT/sCg4ggH8Le/7VVBYqKjUZWPFrJrhVju1IU3BZDs8PZhjaFWDIHvL7IuI9QLLKhhHHNWQ1IQSZgSyQUNYGK0lLbOWpID14w1FgIBI9+JhLSGtue+KwKgZxgrmE9QUI1CEhEPVXCZDCSmjY629QNLiVmNG/SiEL9uJAj2BlXkMpPtZuI4b9iINcw+vS8yYifdiRxcBpCZQTD9DiEf9NRh8pvC4YuwTkFVN8++vQyDtPiJPigJpZo3Uuz2S7dEcsRD28Y2sSiLMOdzTzRwovUigkUUSONCecNWhWeMWneFx7u97PvNMK1ogDOAzjDxvM13I8dw/eK6uXB9XNKZh3NkC/18RsIqdHhLhZKeAzx3VOtbvTOIw==
  template:
    metadata:
      name: restic-s3
--- a/sshca/secrets.yaml
+++ b/sshca/secrets.yaml
@@ -11,6 +11,7 @@ spec:
    metadata:
      name: sshca-host-key
      namespace: sshca
+
 ---
 apiVersion: bitnami.com/v1alpha1
 kind: SealedSecret
@@ -24,6 +25,7 @@ spec:
    metadata:
      name: sshca-host-passphrase
      namespace: sshca
+
 ---
 apiVersion: bitnami.com/v1alpha1
 kind: SealedSecret
@@ -37,6 +39,7 @@ spec:
    metadata:
      name: sshca-libvirt-sshkey
      namespace: sshca
+
 ---
 apiVersion: bitnami.com/v1alpha1
 kind: SealedSecret
@@ -51,6 +54,7 @@ spec:
      name: imagepull-gitea
      namespace: sshca
    type: kubernetes.io/dockerconfigjson
+
 ---
 apiVersion: bitnami.com/v1alpha1
 kind: SealedSecret
@@ -59,11 +63,12 @@ metadata:
  namespace: sshca
 spec:
  encryptedData:
-    machine-ids.json: AgA/rGsQ4sYYCgFyurPMa8GW5NnuekLpB6F4NGuAjEJkmEROFIpgZpPMuSvH+oMW4g4YCrSf03ou4c0jwV6f1/EXWu/qwDe+yJCuT2zknMdGduQEJjrBt+f3zskkHFRqp2inAZCPmObJOPQMwu53JhwN602MC8Tl9VGpg1a/lTmjNELotlkXEwJUmL80Q/pJ/1AK4eUR0BwL8asHKtH5Zt9Nq8X7YV/aL68Tf1u7UvZEX/P0ySBnfqCfQDyW7UjjTiZJlTYzl6Q8+oFd40E8BCNmF2lp8Swp0H/Ac+lNtMIwLdIi0I+E1AtRULnOULmCqmZGjzcMt/ZR9jQUlVRr+osfvUmS+Ed7E83/VIJhvWVTlhh/rEg+DNvpwX5gmg4Pag2SZ//fgAdWwqzIk5H+reSx7apX+eUh+eW9CpkDWNEXlvI8vQ3KneZjwvgTbt0YMSMLpF5jwGeo68Q1i03X65QwlZT2QhUTs6sho3wsO1g+9EMfg3iMwMpb2ui3jJNhK8Eelm5jqmSmvw+lFzSB9DPc9ADnNghUMPoGZIqG9lfjnMWbeION9EqMYjhJsN8Z9r4U/nB/OVLSsSAG4mLA/Rf5n0ih9kFOYcerrrvFWa63ruJpDzctQOoHvH6G9SnWqMppRcS47p6MTuhJL3NNsR3KgHw8Co4/SxJk2wYSAojgLIojICjxFC3EnuYrNNoD1lg+4GvyKyL3sFO8tL2HZ9Nm3q93dLvileL1nfMbvD8j560wfBcjjQ7ewl+9VIcp8KEgq00ofFEeO3MdMGpi/1vYQc5ordzE0+J2ErDlKGZuJv2addjlQ2LY78tw5VVwE85JUosL7KB8nEutJzL+mxGcCPPo/BGTp3GlSCydqNDcmVElvHWzLDjh8LjkydsEIMW1VQWW++OiXJMebadcUrPm9E/lTXAUuExhpnXq72Tt4RMDJZCDq0538DcVeIEKf3LoMM7xGnp/0Zg1MKCKLft8LA7PsBUh7ohIZFqKfHmca9zHEo1C+b9k6QQ3F0qK+0yJS3XIFLASHIxgmeCj3zKlz+bsApgG++OGGjt0Ga6rX/2O7nsGVV16b+cZgDhIDV7IdULtAhiQ0YdGunifNQ6Vo7HFawOfTiGrpHCZSslINLCEDpzAyANxaB65VwuL6pUJoGjRes8vWx3lp5Fimeo9jP9cb/vzrWswOVx0uPIxl8P4UENT1J8yNa9toG5CmGdPeHTNOOWOqWtcJoO8FZ/szRRzPfXCEo9dhh7USNw/bbwYxpBha5LScp3tBw3zHiIvf7n07iZjnzsipC/Fj4/7s3vnxwotgW6HluZho/ZEhl88tRNxmjgTAcQiYVLOc18XB+bKQQGmTstYVkLwAhkBPkArLg4q/HV6XpqByfc3i3Lp2mnS9QRf0lVwXo28RHBYKhy2E1oRDawCtc1K5u3RZuiHtRbifphwA34dZZ6JxUP9Ytorv6LS2BC+ev4b6QCuLWzFaJXZyzfmJ0FJo2wsvGPO/1vJ06Ic5WC2PlLerBI9d20iw0YcQKPJ9pG+LvfQ8X7JUnYj5Uos1MbOfZM9WBZUg6pPTH9bLWrp1fxS6sxqqBDzSHfthskSa/g8zbGUzf8KwSoqRky+EkVZ2loeYbIpIWOv2Q/50R2UwBrFsdfWvcoukSY772+gX04ISGY/ombcbZTC4dWkWWlaRhe/A3XW9LsR0BEZrM08MCkW/FSLkQj0zm2+GOVM/LX87dXl/y12lRIicqcNe1huwfrXyd2DMl5qrTR46P9qiHt222SggiLNN3ZdM9qWffZrFZI20RhkXnM/dWX13BcsKsquAya3pjPht6A4geayenC7riA3XmHGUlSEonH37pwviak=
+    machine-ids.json: AgB1dg6pf6q5I9530RYOp0RPL3H2q6iQvRTNrBjtNfDTJItt3eC7+YMscqV9YUMghjztm9j2XYXWmv267rputamlJv3zvWp2C6u56KURlQrgGv7nK9QsNUBVwZVProod3IiRSE+rEEu8slqB2Lcqev74z26MA6/4EG7Bbhzr/XRpVGV14H1+I1+M81D4Qq+zJKhml0K2H0hAoy0hhor3mtIJY/pjTgZadUFgJWScZnLhCE84Y56yZCnpUOOqu+Ipg573TWEvUgJILUKAx0u464lK8ZMuyjH72wObNl0jxAdm7QWt4bVeInUswqTxi/rNcMjTgeOR0h0EJOzZfP3OiACt7lLbcbZsfeM1F0aR3ttxN288Fi6c/+FbFJGQ/Vvjx9aSm+c5PvCtKHXWJ79k7PNJsXD0XK/eK1lq/03H9HfQ4Ath58PRNdR3bzz3lBctI6wrbaS8V3ref/O3O0aYp6+YidhkDXNxBXNnctKZc2kKoZ9WCA+2nnWezGdVAUq3Na5W5DVx6pwJrIWG6zQ+Dj8caPs2XUSxQPhAvq2uUinlDxkaSg5FrOvyPVq3Ee2pXHQMprGdwcT0wBobRiveg0O9hsrOmRtzH38AJfE6nUT2I4+ej4i1xlO0vufcTeuUpheIhEm3+Gvtp4GgeMVvuuqfU42DZN2i+SSKFvysMxkz+fDVfig41R2KCkgwLbgofkZLcoXk892gfCcF+4yg5XB5Rk1yCMsNuU7ZIkllMLHsYlq9ERmrE0f61FmOEw0KknBDiGnoGZrDapQTZ0J52HrcLeUmi8C+pWacJnczBrEsi1eGNFaE7tTCBEjWT3KegJ1cwO/YnfYMuE1DFpQJEkOVW/mxWqLTKw1I8Bwi5g/pj4H5MhbIHhPUsOuS6Nz9W6cW/9h7lCHf12zt+bAcH/OabioIjmF4ZcMQ04u9yTumYtmTVt8/0snq9YLMOLOvaTAJTFlJW3wgXf8c0UkTKp9ZpAZfROTJ42GNUXvtwKL3rP/tbQ8UGl80wKWtMgCm1uG3K/U51rFLcDCIAxHXjrwOuMhj8D8A9RSEnoy9CZRnTATa+bgSQZQtouzy+NQO/ikHkSgJxQ5rs/ISmK5ngOPV+rU9qO3hE8/90FtotEmW0P7tPI9vcxzy3s+q3xiuz0ErPmqQqGoUjhmUvSC3GhHGeOflF4Q3oJhFiAP51r+PlTRBv303mi1PRvsO6xekPHl5qoqjPbPI+ujvbvDupDjyqTxV3CGENLoBZbxTPAKmBZpoLeYsdyC/N2m0pUtDqYj5GqxQYrultkGt4lGbSr/WaACsC6JTgo5Cyw+jr+NIJUEUzzCYjeGjBZGQm/hVcXgw4RlKelq3p5YEVj6/Fxr8xY9rff/dKxG/ceg2+AomtvkOvSNgO/IBWtZWqQKRz+V2F4p3WkqnVowr93ikyUeTsjbZAcvOsijywvS22ojq7evodATK
  template:
    metadata:
      name: sshca-data
      namespace: sshca
+
 ---
 apiVersion: bitnami.com/v1alpha1
 kind: SealedSecret
@@ -77,6 +82,7 @@ spec:
    metadata:
      name: sshca-user-passphrase
      namespace: sshca
+
 ---
 apiVersion: bitnami.com/v1alpha1
 kind: SealedSecret
--- a/storage/.gitignore
+++ b/storage/.gitignore
@@ -1 +0,0 @@
-minio-backups-credentials.in.yaml
--- a/storage/longhorn-settings.yaml
+++ b/storage/longhorn-settings.yaml
@@ -3,4 +3,4 @@ kind: Setting
 metadata:
  name: taint-toleration
  namespace: longhorn-system
-value: du5t1n.me/machine=raspberrypi:NoExecute;node-role.kubernetes.io/longhorn:NoSchedule
+value: du5t1n.me/machine=raspberrypi:NoExecute
--- a/storage/longhorn.yaml
+++ b/storage/longhorn.yaml
@@ -63,7 +63,7 @@ data:
    reclaimPolicy: "Delete"
    volumeBindingMode: Immediate
    parameters:
-      numberOfReplicas: "2"
+      numberOfReplicas: "3"
      staleReplicaTimeout: "30"
      fromBackup: ""
      fsType: "ext4"
@@ -3877,9 +3877,6 @@ spec:
      - key: du5t1n.me/machine
        operator: Exists
        effect: NoExecute
-      - key: node-role.kubernetes.io/longhorn
-        operator: Exists
-        effect: NoSchedule
      initContainers:
      - name: wait-longhorn-admission-webhook
        image: longhornio/longhorn-manager:v1.4.1
@@ -4020,15 +4017,9 @@ spec:
            value: "longhornio/csi-snapshotter:v5.0.1"
          - name: CSI_LIVENESS_PROBE_IMAGE
            value: "longhornio/livenessprobe:v2.8.0"
-      nodeSelector:
-        node-role.kubernetes.io/longhorn: ''
      serviceAccountName: longhorn-service-account
      securityContext:
        runAsUser: 0
-      tolerations:
-      - key: node-role.kubernetes.io/longhorn
-        operator: Exists
-        effect: NoSchedule
 ---
 # Source: longhorn/templates/deployment-recovery-backend.yaml
 apiVersion: apps/v1
@@ -4094,13 +4085,7 @@ spec:
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
-      nodeSelector:
-        node-role.kubernetes.io/longhorn: ''
      serviceAccountName: longhorn-service-account
-      tolerations:
-      - key: node-role.kubernetes.io/longhorn
-        operator: Exists
-        effect: NoSchedule
 ---
 # Source: longhorn/templates/deployment-ui.yaml
 apiVersion: apps/v1
@@ -4114,7 +4099,7 @@ metadata:
  name: longhorn-ui
  namespace: longhorn-system
 spec:
-  replicas: 2
+  replicas: 1
  selector:
    matchLabels:
      app: longhorn-ui
@@ -4157,12 +4142,6 @@ spec:
            value: "http://longhorn-backend:9500"
          - name: LONGHORN_UI_PORT
            value: "8000"
-      nodeSelector:
-        node-role.kubernetes.io/longhorn: ''
-      tolerations:
-      - key: node-role.kubernetes.io/longhorn
-        operator: Exists
-        effect: NoSchedule
      volumes:
      - emptyDir: {}
        name: nginx-cache
@@ -4229,13 +4208,7 @@ spec:
          valueFrom:
            fieldRef:
              fieldPath: metadata.namespace
-      nodeSelector:
-        node-role.kubernetes.io/longhorn: ''
      serviceAccountName: longhorn-service-account
-      tolerations:
-      - key: node-role.kubernetes.io/longhorn
-        operator: Exists
-        effect: NoSchedule
 ---
 # Source: longhorn/templates/deployment-webhook.yaml
 apiVersion: apps/v1
@@ -4306,13 +4279,7 @@ spec:
          valueFrom:
            fieldRef:
              fieldPath: spec.nodeName
-      nodeSelector:
-        node-role.kubernetes.io/longhorn: ''
      serviceAccountName: longhorn-service-account
-      tolerations:
-      - key: node-role.kubernetes.io/longhorn
-        operator: Exists
-        effect: NoSchedule
 ---
 # Source: longhorn/templates/validate-psp-install.yaml
 #
--- a/storage/minio-backups-credentials.yaml
+++ b/storage/minio-backups-credentials.yaml
@@ -1,17 +0,0 @@
---
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: minio-backups-credentials
-  namespace: longhorn-system
-spec:
-  encryptedData:
-    AWS_ACCESS_KEY_ID: AgAldMdcn4+SlYCqSKtXDB530WOUBU7HTp/9n4/aPKnsRW4BnXtxlub37i3MTTcavSG2MsoDem+tU+B1hZ6YdawDXmXt1xKqrfoF2bhJCV7iGHD7rGqORK4EKhwphRPG37a6IH7T01Pz7od3ThIv5luOOrd8ttTIhT4mBGlI1i2EWfYT8UnsEyAblSA3t0KStTVrKzwl7x+SDqaxZJ/kBFfk82ceO5KPbgns5cqJhlRMeZWdl32m0mx1QOn091rtoGsIEXG6CB3mtLdpVbbXdFo8gOtG/c/sG6SaOw1MnPlqin4zkVx9pbTHUD8iaykgiBan1klGj8Y/9PLBg9Hpk1Szc757kbW2BPYJeTkVuA5SrTe9FGdfkR5djDJx8QYTgqJirWhj/KhJQ7uOcJcvWnquTO/nqGK+vKcH8rs4cYSfnxbEx/P0/bQp7JyT3ehT7txKyTzpLXC4AlL1VIp33gOOlY+sQjFrqSR5aS6Y+dkAMTup8enVJDL9x33C3xM7JHHs5/X+O6zXbxJxYhGQmk4EgqySo6hrOXOJ2pJ2cc1CU/WK2lzQEpAn9ZBm8pYmQZNeZsCpMf3IRAVKpu8eZOLQeekgiv+C77Yzq2mKBEt6eYnI0C6TgiyKDZeCeHP1j3GRqEwO7DMy/QRUILOf+L+bBJ34QOqjFqZQd/HB053aPm3pw06i7oThcjrv1Gtfc/wHNxT2zC+A6X+Ixu6I1ryzQK1Efg==
-    AWS_CERT: AgCl5sY+yThW58Vnxk/XEBOQy9DDyoVPVvWnxsu4oL5M78g/J0+WaCTq3yadGE0+OnmgF/Iq6Smj/yONMkvvOe77x9aT5bS9VUR1JLo7CawX+b0HlytU9w5j5wSFb8EQ3rC/2AABCUfZAsavM/vUZRzPoX1h9FxmQWweFOVLySFXJbSHPxiNJ69Wk5MiuGpab+XMaU9saCMEvIC0mZ02Sw+73xMVt2nqi77JxR6SncjjjYHJHaJMOIlOtfUyKnsrDlxYaHaP9OQmFfnXEQgfsmAx1zbZFtsMhEfr9FVlNzEJ5kqOzX8OH1n58Rkmfad3XfRAAwgzpR9lAsDZVNhYBFNfzTFaQ0mlZ2xhyHIhzMZfOzUrAfVeoS42BWghdMwsgNj7+boiGyl0A9LcxekvmrDmKrwYgjzpYw1J8vml6OlN+8EKI+0IkDa9d6y3fKB9t5m1BbdsEXfapcglCFxTTKeo597BI2zn4KHxuhQyG/MU2YNrdoftUDibscJlXXbEmg/4qZEr4vDtvETzA5JsPPeCK3R43kIOqBffu2c3SVZCE/bBxY3OodSmsLIlwqolRJexlIbhZ6YG4UGZk/y08XBpB4227+SPtWrFBYD50pxbaB2ApR0wPyUgI8ARaRhouLkAds4kkkQ01rpZ4KD7c5aiT9LTk6BhulVI1dLuoKlxl/fL9zNOwh/b6lou1jGX/VRVulwATY8kfGJcDAzUJpq4ps88Yqu3T4qz1WrlG8bsTV58fDTp/wm5Z67wipwtAhvLySn6g5e7u1graEQAOa45DXb/znarVAHkWl06hXSOBF4yXvC8pdJJgzvxXdCD0kVCR2zTRs0g8hBNt8e1spVzU8FAAZMM0fPvLl0OaF+v4WQE45CM5p93OCsZKRVce0wcCNL+c/zVJmLqGdmKwModYpMFwT/zUsj352TIjLOLe96z+cj/iOaHL1+YHtI1gJvXx2reaOv4bfORQ/znI8SvCOqkB1paq1ZOf3j0g5FQm+CUqFbSxTO7qU/0SB+xz3gURfEpCXiCf5N14WUnHe40SbrnI/h3yiA4aZP0rYoprvvQRPY2uC54FHZgDqdzdwYdrM64bz2hu40kUXxZxIXY9iwQPEBbyHxCEsgFRfDTleAal8terh/9p/NQue6hvTSoP0hgIWvUc/XMaFFlbxQps2aSBmuReNH37eWRxink1bqk4X09AP+53uR2R645+ttt/uR5MBK7cGOdDDSau7eV+0eNcJ3npCnsvW/btwFJaGpqHlEqs/eCobE3v7cg19wYe0bwsdQ8d8YIZXIAvvcTOIcBUvBN+4+2FWSJYB2fG+vgEXN6NOgpeHYqQ0rRDo+BHYSTu8T7cgF8ytuc8oNdF8jhgAQRCfRZiYgbdePySoFq1432828wuTwk6W16For/plyoMIWdaxcR7fR5jnS+HffDRNgHLNVGaoHwWsQ3jCfNjrLyPoAA/wmihHir9/nSpn1qUj4Q58Wwok7VCFrr1LisSJl7/gkVhltL62CaSS+fEtXhQdrrlRfqDvjzjyeHvnm6dh2LQK+gNMvoySP0G6atBxzFFwhQWsC1Ic35Ff2fRzJH0TgOvuBsgD3bjw==
-    AWS_ENDPOINTS: AgBLYIgZp/KFxBG16tQmF2sMQuZOpU4hrdEFMFThFUoXGx8IA1wJvayFEwelA1K8h1z8NTwnotS5M6VmKdLzVc+fUM6S+4DUukDgMvO99qtFa4xd+0hoz0nkCLySgWm3NqC+RzukQIC6tqp5RHCMFhhr3wxsPxckJdUmA4MDIlcI7/gHVNkrKoKBsjuIVq1h0gkr3KJUOUShMTjffBMNPTHLyy2dm2nQ+dF74GAZZqYKsWk3hV3V5bPOKi5J8Q5vifA8r0my2JRjEqg7kndvITUfgOguneyhqB8jc4olWAojeQ30oBYucM+ddsXgyaNbrVy8iZoceEjiNhzfLnuJXKhjJStenK2X7ZNGTaZqEx4qpRI35tDD6Iuhbo+fttcjoH96oChDnagTq8+bD1Qo/Kn3T6PESorVIN9GTwuyfOP7BjO32fMCEnIaIySybL+CCShlRDEiVIkRwy01hEQZabpjwwOH015wrt+7V7A+x2I3PhoXL2E71/SIWiAk4BWU0gWhp7z4/FdH6LRMB6qIr7u7/PH6aRo4DWEQWWRASUeS6Im+0TGiSnQnVMNchxI+oZAYVWV/f/zDTq2G2yjqvqymUqgY7H+6G+hiZbM1kAPK4A440mgmBhcsgWOBv6vri/8JGMWDQkRYiX63jroNBR2EZFXg4ypYh7FMQXc3G+vBz3f2VwN+UYOB8aHJHwAlnYAo6fZjnWg4J+pr3vef6AMqMRuQPHF2ZhLX9ioTwIFymGQNaxY=
-    AWS_SECRET_ACCESS_KEY: AgCe7F3hSmolBOLyh/98v9sl/hmCgSq2U1X40F/LPHjZmSGlvExNv62yuw8fMU/aQnJwG8xvC0gLcBKyc8UljzsAXTa5+XI5S6e2AMP/q3NTe0JmaLN8/aBJbj+P78k7I79nyQxwT+vgGJ+0TgtVJCMHLAhQtJhijCcZ6tMVozkbqQClHhKXx3FWVEGICJlAe5N6sGuZBqf65//MYwK59QkEqEtVm9+P/9BYk8VS6gdtMnH9HVt1axSJ4JvjZXYIxMdGmyGHd7V7xLIDPQo12dAOnRI4w4TtZqtjt736g6MKSjSpiQ4s5H2Ojt8yxONnYEy4JajKeWhhsABu6YKpRXJy/VrZeJbcvqFl7+0DRYeUU0/wtKW5qbtusLoaqOUhEDs2sz7O/dGWbIB6r0MPWjrllGu2i4pHl4et+GpB+/N3xZ+M6wQNcKGiVAEJPQlPtTQem5lbdByOQYrpDuJUs2n6u2A8eAFoJIn1/Sr5ZFS5Pu2znh3c2Zat9O1Z7N/HbC7EofHnL6zpZRS5LJZxx2mFI9ssmkpzqLdqwPCFyXvCrBfiDa/0a4NQRwMDnG6HmyyEI6wVzYWpl2ZOHiI5wVAlHVBho/QwTmLfrb7mC8apMVEmDiHawyTFp8Ze5IQ1BiPmR2jtpfnri2oWu1FDmGvzQXwbI7hBhmasz7l5CpIKcTcQEf4P9k2ODEpQa+5fr/RlqQrXiITksH9mSUsMGXCGz/ATzsv5ZyV7zHk3Y4+mxHd904kbEdE9
-    VIRTUAL_HOSTED_STYLE: AgA3k1kkLajEaw59NpJXs8UctwKUEIG2vJ6Mq/SZ3bMxLHy4hsDhNijy2EbMSpjYMnARd9f4hnopYrQLOW0EkhKwcfzR3zpKEZoaLLEo2itdfZkgmGqU27SVR4bnJM3+mZYDFuCVTVnr4spXkoCOIYmJZOSGKELr8h/VY0dUruzapP/410O2DIM2n/8BnwT4dSXDNuBMSAe0NBiXUjSI4Be715G8SQfKxhZCrXJ5x4Nvwudq45a5VAcVZoJgfvyOPL3LkUsvAzon3tKoGwzOdkwPOY+SQclVHyg3C2CYyp9P2B6XvIb9FOE4C0F0tAF/H/oRznJefIKydkJiZ0mWKqzYuQXVbZaTkJzBDkjEv4BPsUYVE24iao0D8OXijJnz5NKZ7nagE9ucHyTGCX0HPahD8/wdjtRC5Tqj5Kk8XwIJx2Wv4OpTl9eRLWxCuGRoQBkhnRTB0jhHSvciiVP5q/PEN6cHnz6TrVJLFwJmplATlKpe4nImZHICK0c6jnUaPYQ9KlFB6U10npdKAM0Gm/hN1lOBiBomckOcv0cSef896URDs7C/0xC/+3ghi8Aji/dZ/zRCf77YUn/8QWqzIv/tomkzjIjhrzPdOJeLefxqeUx+u+/AAL+cv4VGtIkn5Gc5felf9A5SDWroD8cjm9ZyWXA3teeVU8Uatep3llwf71ROBYpSXS5h+6TWhDDKiYgpqao0
-  template:
-    metadata:
-      name: minio-backups-credentials
-      namespace: longhorn-system
--- a/updatebot/.gitignore
+++ b/updatebot/.gitignore
@@ -1,2 +0,0 @@
-gitea.token
-sshkey
--- a/updatebot/config.yml
+++ b/updatebot/config.yml
@@ -1,108 +0,0 @@
-repo:
-  url: https://git.pyrocufflink.net/infra/kubernetes
-  token_file: /run/secrets/updatebot/gitea.token
-
-projects:
- name: home-assistant
-  kind: kustomize
-  images:
-  - name: home-assistant
-    image: ghcr.io/home-assistant/home-assistant
-    source:
-      kind: github
-      organization: home-assistant
-      repo: core
-  - name: whisper
-    image: docker.io/rhasspy/wyoming-whisper
-    source:
-      kind: docker
-      namespace: rhasspy
-      repository: wyoming-whisper
-  - name: piper
-    image: docker.io/rhasspy/wyoming-piper
-    source:
-      kind: docker
-      namespace: rhasspy
-      repository: wyoming-piper
-  - name: zigbee2mqtt
-    image: docker.io/koenkk/zigbee2mqtt
-    source:
-      kind: github
-      organization: Koenkk
-      repo: zigbee2mqtt
-  - name: zwavejs2mqtt
-    image: docker.io/zwavejs/zwave-js-ui
-    source:
-      kind: github
-      organization: zwave-js
-      repo: zwave-js-ui
-  - name: mosquitto
-    image: docker.io/library/eclipse-mosquitto
-    source:
-      kind: docker
-      namespace: library
-      repository: eclipse-mosquitto
-
- name: firefly-iii
-  kind: kustomize
-  images:
-  - name: firefly-iii
-    image: docker.io/fireflyiii/core
-    tag_format: version-{version}
-    source:
-      kind: github
-      organization: firefly-iii
-      repo: firefly-iii
-
- name: paperless-ngx
-  kind: kustomize
-  images:
-  - name: paperless-ngx
-    image: ghcr.io/paperless-ngx/paperless-ngx
-    source:
-      kind: github
-      organization: paperless-ngx
-      repo: paperless-ngx
-  - name: gotenberg
-    image: docker.io/gotenberg/gotenberg
-    source:
-      kind: github
-      organization: gotenberg
-      repo: gotenberg
-  - name: tika
-    image: docker.io/apache/tika
-    source:
-      kind: docker
-      namespace: apache
-      repository: tika
-
- name: ntfy
-  kind: kustomize
-  images:
-  - name: ntfy
-    image: docker.io/binwiederhier/ntfy
-    tag_format: v{version}
-    source:
-      kind: github
-      organization: binwiederhier
-      repo: ntfy
-
- name: authelia
-  kind: kustomize
-  images:
-  - name: authelia
-    image: ghcr.io/authelia/authelia
-    source:
-      kind: github
-      organization: authelia
-      repo: authelia
-
- name: vaultwarden
-  kind: kustomize
-  images:
-  - name: authelia
-    image: ghcr.io/dani-garcia/vaultwarden
-    source:
-      kind: github
-      organization: dani-garcia
-      repo: vaultwarden
--- a/updatebot/kustomization.yaml
+++ b/updatebot/kustomization.yaml
@@ -1,34 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-namespace: updatebot
-
-labels:
- pairs:
-    app.kubernetes.io/component: updatebot
-    app.kubernetes.io/instance: updatebot
-    app.kubernetes.io/part-of: updatebot
-  includeTemplates: true
-
-resources:
- namespace.yaml
- rbac.yaml
- updatebot.yaml
- secrets.yaml
-
-configMapGenerator:
- name: updatebot-projects
-  files:
-  - config.yml
-  options:
-    disableNameSuffixHash: true
-    labels:
-      app.kubernetes.io/name: updatebot-projects
-
- name: ssh-known-hosts
-  files:
-  - ssh_known_hosts
-  options:
-    disableNameSuffixHash: true
-    labels:
-      app.kubernetes.io/name: ssh-known-hosts
--- a/updatebot/namespace.yaml
+++ b/updatebot/namespace.yaml
@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: updatebot
-  labels:
-    app.kubernetes.io/name: updatebot
--- a/updatebot/rbac.yaml
+++ b/updatebot/rbac.yaml
@@ -1,37 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: updatebot
-  labels:
-    app.kubernetes.io/name: updatebot
-
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: updatebot
-  labels:
-    app.kubernetes.io/name: updatebot
-rules:
- apiGroups:
-  - '*'
-  resources:
-  - '*'
-  verbs:
-  - get
-  - patch
-
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: updatebot
-  labels:
-    app.kubernetes.io/name: updatebot
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: updatebot
-subjects:
- kind: ServiceAccount
-  name: updatebot
--- a/updatebot/secrets.yaml
+++ b/updatebot/secrets.yaml
@@ -1,34 +0,0 @@
---
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: updatebot-ssh
-  namespace: updatebot
-  labels: &labels
-    app.kubernetes.io/name: updatebot-ssh
-spec:
-  encryptedData:
-    id_ed25519: AgBtJeOutVpyMyvzIQfAatNqomOXTwPJ6hRwE8r7pAR3UNQdgKoaz+i6f4IIWeLnGDWCveUTFFGp5O6uvuKCqZzo5J8706CV4Y1Cba+nGKbGyObNF5gF7qD2Jz8n4z99SKLA7ZPBRBj4rgtmKz68cJyi4PfDla2/csjONV+PMsMYLquDX8I+7G7YYzdhzt0V89XwzDl4PhegyPTLH0AaQysXfj2/OnmQINiIwwPcbhXv8AiRVFsqWRpsWTCs4nCcNAHIxmSVgzgwqDNZRym31FbLbNpYTD4KhL6zhBpp3GAX/q2Dk5tJtVsUc6v/cvD0+pgcKvgRFMOcH9Z6MgcmotTdpwSINZe4mUY4VHONAt8WNvqUCo+Y80eHDpV5OVfAnMARowwnF8CRV9v19Q6hWnnVvV214IUJuqEgV1IDDIpRl3jmtFBjEQ+s0A0HtYyhgoEZoK7ZeypgIyQJucGjaBh6QArD1hjQtzPsFji52VWdkf/ocqPmg6H4ZL38MRQFhOnvrucJandqQihS0XCMLe5WdLTNzjbTS2skYw/9LqPUZ05pHPPGZQseLcgTclfuNKxYHTS5RNA3xWSWnNUt53VHEjPUMWRQNf1tfqA/EeK52fTM5iqRiI8chtHNUTwX+ZegONJtwwBoxWwfgjEJWBTwiGxjAXkIQoCNfaIqZI6wdHWQs3cXjgsIw8h8H7NIdN/O59CxbpLaU1YgxoKFvfhRQoO8F8RhMuX691o/lIzjFTkE5uZmsQWUCZGQu1M/OiqepmibbFguwIk9hNI41vwcd4nPdxTmQazD0rO72ZsJlUWdoK+psGFiv3Haeua1SXF3XbD0FO/tHu1HW+QDrtThlShP/ozebceEApYmdVHZkcuKYxIbDwL5lgax9L6mFSPpENX7M06uHGMqGLjOBHPXiSacVK6GuNj9ZdNmux6kOrSL9CYdcru/eeWyv64vZxwFavNqK7K/Pu7sgOOe3N+be73awtB7qhfMNaVMP/kK0kF74pHpZLI8qotTkcPv30N9q+yBoSm/nmuYG6Mv1FONSSRUPdBmeeSTpVAIviePvl0C0BApQG6zvBimVEDcWQ/VYnqgwo769lvMjlAVCcOXOqQt4CQ/1lxVtOXHpMt/+ZH+6RoyYu1sGzlPP/yXi5AMVPdYRDvEhUQ/qkpDDL3Up/MiSIKVeQxLTBc+FCz8mj08b+AgyVk1Rl0TfSzaL05Yiv17uvjYrkozTWXk/Yk=
-    id_ed25519.pub: AgALz9mR5yjRcR+LRllzY/+x75tubtbD0+rfdky0+LbwxsVfDirxB4x3vWKzlDMQiB+vtj3DyZz3K+k85MYrEbpZvwMePJ8HM/VW09fImW99+RcD6593bE5jOqAAujNhReopIJpJ3fTqMcNSOHs0eU1bogFJiY+ErsXKuY30EEM2wn53o73jRFThVVNfrS4QG85mFATrkAkS5CBTbUqzzoixhtqbtC+Wnlu4JnAU+c5aUcRdm05G/n0Eh5rKwtvN1SoWF0x4YG6jspzfZuKlhtgaLEK8gYHlMtZfEmUeUy/hpt5nHP3yc/hONUtz0TTYMmtxaMfqZZgGQlM2zTfvWAlxfqDr8U6rANB8HN64LQ2OQ3MGpkYEpMC37hkgVjSL+awttE2h49XuvS6zYg8ia/HTEm0lyE/8eBoVvmZgPzpl7QCcxs0YucrEyV5X1vOwiIO0bueumxsld5rGR5Gn4ReCayuU0Erq5MjXSbOEZf3r/9LbL90KJYLCUFdhSxfbNqSZjorco4ZXHLlhsBFqDFGxjkWDCH9aA7ZFQLH2oUaY4txYl1VmBtTTlIcGMTsBXrvlgdCz4bI9mt1lPFi3WgwYyCWwT0AitYl/FL/1mwlrs0yH9w1Y7AVwJoEp729w8DQ1Qm+wkzMtjVxsgu4bEHQym+5DaDF2XifcT/T/GEBFcqoqrl6e0x25tybI3GnzGcaZ/TY1b5FBW41wl5inwBzwilnlc70nykiCq2Pg/+EQlUFWzh/6el70xlnVatIln3/Lz/sJ2qZjvEugfiESnOy/6JhbP3KSWjoJM5u3K6I6moQeWOH1g7ZDoJb6
-  template:
-    metadata:
-      name: updatebot-ssh
-      namespace: updatebot
-      labels: *labels
-
---
-apiVersion: bitnami.com/v1alpha1
-kind: SealedSecret
-metadata:
-  name: updatebot
-  namespace: updatebot
-  labels: &labels
-    app.kubernetes.io/name: updatebot
-spec:
-  encryptedData:
-    gitea.token: AgCsTbakH+a911jC4w2VAMxNCec0DSVg3PufcwVMvLp8N1mZs4g7Btg33FhSDv4GnG6tluhNrvjNm9CwA9Hb6DX+lAlGM20ntBr7whC4x3XQqVYVVkk9loQTsNkVYbuUye3cnlTVi1RIku5qtKA4iiopc0naaAFYPAJZXd/oUP6Ghs9ttsPoYRAK3QeKkGUDsDoe7EpRFrvmdmV71R7OxSsCQBR9EoWJiKRJYNzZ6RyjrdLA5tJT/oVkpRzBVqp92Ujgbz731KtGuBesWWbXYI7sjQFYfc+KCg3taOyhpOTAxF74JETxOyyMkdg3memcPaZKXGIn1fm8/pTOXOZYdn5I65wwIJa91GT7xZ7jMT+EvgQkEDXenQia71sgcInngFcVGdHtWH8+a2HkTTHaRibQW6EivgafO+61Ukc/HL1ULwVT6lAHMs1h+/JhLrdPcqXIfZxrD6k1cWk9H5AbzTUtA43M0jCcdlk0LuKdSyq6Mi85OSs1aU+fBdRiAzXnMUgL3Gcku94E2SPKgZ/2i5W6gpBig5Q1m8qZKXQiopZelqIQt9IkORBp+ge9E2SB+6H84q59csuUVxqn7BNAT24eOrdZSNCT8I9oxnO9YyXqrty58/WD206eloVejtGXwWjtCBWWEg3T7DTVheEeRJgCUwFzaGYtw8VuPr0VOXFXNkF0VcQ83XGqOUTlMEsUtHEEuk3btD5AjFKK+q3+jp1qCoafYgoxV1FZA3GxxWhalIh9yVz+RLla
-  template:
-    metadata:
-      name: updatebot
-      namespace: updatebot
-      labels: *labels
--- a/updatebot/ssh_known_hosts
+++ b/updatebot/ssh_known_hosts
@@ -1,3 +0,0 @@
-git.pyrocufflink.blue ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDF1tB0KeyMStHKbnuminTQ2xwjjxyES/DBSlZZH0c7F25Lu6TfvxEEs/7YUtZKAnwFGLfuqW5gaS3eWV1eA3w7WtEGYoBAD6VFZUjN0vfmhNYWC85DMcY+gqkOkBQy1/SvyYSPHrtkgTJRPMG/MdWGaYEN+w/znr1HETPnj4qm7bFC8yxXKU2PXzKlUeY+ynY3hhlzAVwG4Ay7hgH+nO071eoAQtYq9zBdYTifXxoTzatLgU8ib3EYuC3/LDNXkFhYhxDhfp9iwPCNZRi49AccMlL323/Vp8x/Jy/iY5A60Fk8cIYtneEihRkIpzpyTudEK0MXyJ+FJ0vmjiEX5ZY9
-git.pyrocufflink.blue ecdsa-sha2-nistp256 AAAAE2VjZHNhLXNoYTItbmlzdHAyNTYAAAAIbmlzdHAyNTYAAABBBJPLXOT4j+jYAIGfuGbtG8ea3oBZwtvOEYNzUHpsQBF9VO9E9nTQBswSRzc+otPzZhr5lJ+BlGo439hHGkbOIo8=
-git.pyrocufflink.blue ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIHEF/IXycjT/sSIpFLRDEVZUu95QA3i7d5LZvB/RncHN
--- a/updatebot/sshkey.pub
+++ b/updatebot/sshkey.pub
@@ -1 +0,0 @@
-ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDw5BwoaF5bHI+VDT7vDCRu62FjdBNX4B/NcAtcgd/Qs updatebot
--- a/updatebot/updatebot.yaml
+++ b/updatebot/updatebot.yaml
@@ -1,78 +0,0 @@
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: updatebot
-  labels: &labels
-    app.kubernetes.io/name: updatebot
-spec:
-  schedule: 32 6 * * 6
-  timeZone: America/Chicago
-  concurrencyPolicy: Forbid
-  jobTemplate:
-    spec:
-      template:
-        metadata:
-          labels: *labels
-        spec:
-          restartPolicy: Never
-          containers:
-          - name: updatebot
-            image: git.pyrocufflink.net/infra/updatebot
-            imagePullPolicy: Always
-            securityContext:
-              readOnlyRootFilesystem: true
-            volumeMounts:
-            - mountPath: /etc/ssh/ssh_known_hosts
-              name: ssh-known-hosts
-              readOnly: true
-              subPath: ssh_known_hosts
-            - mountPath: /home/bot/.config/updatebot
-              name: updatebot-config
-              readOnly: true
-            - mountPath: /home/bot/.ssh
-              name: updatebot-ssh
-              readOnly: true
-            - mountPath: /run/secrets/updatebot
-              name: updatebot-secrets
-              readOnly: true
-            - mountPath: /tmp
-              name: tmp
-              subPath: tmp
-            - mountPath: /usr/bin/diff
-              name: diff
-              readOnly: true
-            - mountPath: /usr/bin/kubectl
-              name: kubectl
-              readOnly: true
-          nodeSelector:
-            kubernetes.io/arch: amd64
-          securityContext:
-            runAsNonRoot: true
-            fsGroup: 25167
-          serviceAccountName: updatebot
-          volumes:
-          - name: diff
-            hostPath:
-              path: /usr/bin/diff
-              type: File
-          - name: kubectl
-            hostPath:
-              path: /usr/bin/kubectl
-              type: File
-          - name: ssh-known-hosts
-            configMap:
-              name: ssh-known-hosts
-          - name: tmp
-            emptyDir:
-              medium: Memory
-          - name: updatebot-config
-            configMap:
-              name: updatebot-projects
-          - name: updatebot-secrets
-            secret:
-              secretName: updatebot
-              defaultMode: 0640
-          - name: updatebot-ssh
-            secret:
-              secretName: updatebot-ssh
-              defaultMode: 0640
--- a/vaultwarden/README.md
+++ b/vaultwarden/README.md
@@ -1,15 +0,0 @@
-# Vaultwarden (Bitwarden-rs)
-
-## Migration
-
-```sh
-kubectl scale statefulset -n vaultwarden vaultwarden --replicas 0
-kubectl create -f vaultwarden/migrate.yaml
-kubectl exec -n vaultwarden vaultwarden-migration -- find /data -mindepth 1 -delete
-ssh bw0 sudo systemctl stop vaultwarden
-ssh bw0 sudo tar -C /var/lib/vaultwarden/data -c . \
-    | pv \
-    | kubectl exec -n vaultwarden -i vaultwarden-migration -- tar -C /data -x
-kubectl delete pod -n vaultwarden vaultwarden-migration
-kubectl scale statefulset -n vaultwarden vaultwarden --replicas 1
-```
--- a/vaultwarden/ingress.yaml
+++ b/vaultwarden/ingress.yaml
@@ -1,20 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: vaultwarden
-  labels:
-    app.kubernetes.io/name: vaultwarden
-    app.kubernetes.io/component: vaultwarden
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: bitwarden.pyrocufflink.net
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: vaultwarden
-            port:
-              name: http
--- a/vaultwarden/kustomization.yaml
+++ b/vaultwarden/kustomization.yaml
@@ -1,30 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-namespace: vaultwarden
-
-labels:
- pairs:
-    app.kubernetes.io/instance: vaultwarden
-  includeSelectors: true
- pairs:
-    app.kubernetes.io/part-of: vaultwarden
-  includeTemplates: true
-
-resources:
- namespace.yaml
- vaultwarden.yaml
- ingress.yaml
-
-configMapGenerator:
- name: vaultwarden
-  envs:
-  - vaultwarden.env
-  options:
-    labels:
-      app.kubernetes.io/name: vaultwarden
-      app.kubernetes.io/component: vaultwarden
-
-images:
- name: ghcr.io/dani-garcia/vaultwarden
-  newTag: 1.32.7-alpine
--- a/vaultwarden/migrate.yaml
+++ b/vaultwarden/migrate.yaml
@@ -1,34 +0,0 @@
-apiVersion: v1
-kind: Pod
-metadata:
-  name: vaultwarden-migration
-  namespace: vaultwarden
-  labels: &labels
-    app.kubernetes.io/name: vaultwarden
-    app.kubernetes.io/component: migration
-spec:
-  containers:
-  - name: migration
-    image: busybox
-    command:
-    - sh
-    - -c
-    - |
-      trap 'kill $!' TERM
-      sleep 99999 &
-      wait
-    securityContext:
-      readOnlyRootFilesystem: true
-    volumeMounts:
-    - mountPath: /data
-      name: data
-      subPath: data
-  securityContext:
-    runAsUser: 266
-    runAsGroup: 266
-    fsGroup: 266
-    fsGroupChangePolicy: OnRootMismatch
-  volumes:
-  - name: data
-    persistentVolumeClaim:
-      claimName: vaultwarden
--- a/vaultwarden/namespace.yaml
+++ b/vaultwarden/namespace.yaml
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: vaultwarden
--- a/vaultwarden/vaultwarden.env
+++ b/vaultwarden/vaultwarden.env
@@ -1 +0,0 @@
-DOMAIN=https://bitwarden.pyrocufflink.net
--- a/vaultwarden/vaultwarden.yaml
+++ b/vaultwarden/vaultwarden.yaml
@@ -1,95 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: vaultwarden
-  labels:
-    app.kubernetes.io/name: vaultwarden
-    app.kubernetes.io/component: vaultwarden
-spec:
-  accessModes:
-  - ReadWriteOnce
-  resources:
-    requests:
-      storage: 4Gi
-
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: vaultwarden
-  labels: &labels
-    app.kubernetes.io/name: vaultwarden
-    app.kubernetes.io/component: vaultwarden
-spec:
-  selector: *labels
-  ports:
-  - port: 8080
-    targetPort: http
-    name: http
-
---
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: vaultwarden
-  labels: &labels
-    app.kubernetes.io/name: vaultwarden
-    app.kubernetes.io/component: vaultwarden
-spec:
-  serviceName: vaultwarden
-  selector:
-    matchLabels: *labels
-  template:
-    metadata:
-      labels: *labels
-    spec:
-      containers:
-      - name: vaultwarden
-        image: ghcr.io/dani-garcia/vaultwarden
-        env:
-        - name: ROCKET_PORT
-          value: '8080'
-        envFrom:
-        - configMapRef:
-            name: vaultwarden
-            optional: true
-        - secretRef:
-            name: vaultwarden
-            optional: true
-        ports:
-        - name: http
-          containerPort: 8080
-        readinessProbe: &probe
-          httpGet:
-            port: http
-            path: /alive
-          failureThreshold: 1
-          periodSeconds: 60
-          timeoutSeconds: 5
-        startupProbe:
-          <<: *probe
-          failureThreshold: 60
-          initialDelaySeconds: 2
-          periodSeconds: 1
-          timeoutSeconds: 1
-        securityContext:
-          readOnlyRootFilesystem: true
-        volumeMounts:
-        - mountPath: /data
-          name: data
-          subPath: data
-        - mountPath: /tmp
-          name: tmp
-          subPath: tmp
-      securityContext:
-        runAsUser: 266
-        runAsGroup: 266
-        fsGroup: 266
-        fsGroupChangePolicy: OnRootMismatch
-      volumes:
-      - name: data
-        persistentVolumeClaim:
-          claimName: vaultwarden
-      - name: tmp
-        emptyDir:
-          medium: Memory
--- a/victoria-metrics/alertmanager.config.yml
+++ b/victoria-metrics/alertmanager.config.yml
@@ -11,16 +11,12 @@ receivers:
 - name: ntfy
  webhook_configs:
  - url: http://alertmanager-ntfy:8000/hook
- name: none

 route:
  group_by:
  - '...'
  receiver: ntfy
  routes:
-  - receiver: none
-    matchers:
-    - alertname=Battery Low
  - receiver: ntfy
    matchers:
    - alertname=DiskUsage
@@ -31,12 +27,3 @@ route:
    - alertgroup=Frigate
    group_by:
    - alertname
-
-inhibit_rules:
- source_matchers:
-  - alertname=Free disk space is very low
-  target_matchers:
-  - alertname=Free disk space is low
-  equal:
-  - instance
-  - df
--- a/victoria-metrics/alerts.yml
+++ b/victoria-metrics/alerts.yml
@@ -1,35 +1,12 @@
 groups:
 - name: default alert
  rules:
-  - alert: Free disk space is low
+  - alert: DiskUsage
    expr: >-
-      (
-      filesystem:usage:percent{
-        kubernetes_io_arch!="arm64",
-        df!="mmcblk0p3",
-        df!="var-lib-frigate",
-        df!="var-log",
-      }
-      or
-      filesystem:usage:percent{
-        kubernetes_io_arch="arm64",
-        df!="boot",
-      }
-      or
-      filesystem:usage:percent{
-        df="mmcblk0p3",
-        instance!="nut0.pyrocufflink.blue",
-      }
-      ) > .75
+      sum(collectd_df_df_complex{type!="free"}) by (instance, df) / sum(collectd_df_df_complex{df!="var-log", df!="var-lib-frigate"}) by (instance, df) > .75
+      or sum(collectd_df_df_complex{type!="free"}) by (instance, df) / sum(collectd_df_df_complex{df="var-log"}) by (instance, df) > .95
+      or sum(collectd_df_df_complex{type!="free"}) by (instance, df) / sum(collectd_df_df_complex{df="var-lib-frigate"}) by (instance, df) > .95
    for: 2h
-    annotations:
-      severity: minor
-  - alert: Free disk space is very low
-    expr: >-
-      filesystem:usage:percent > 0.9
-    for: 2h
-    annotations:
-      severity: minor
  - alert: TheWebsiteIsDown
    expr: >-
      probe_success{job="websites"} == 0
@@ -60,24 +37,43 @@ groups:
 - name: mdraid
  rules:
  - alert: mdraid missing disk
-    expr: collectd_md_md_disks{type="missing", instance!="chromie.pyrocufflink.blue"} != 0
+    expr: collectd_md_md_disks{type="missing", instance!~"burp.*"} != 0
  - alert: mdraid failed disk
    expr: collectd_md_md_disks{type="failed"} != 0

- name: Backups
+- name: BURP
  rules:
+  - alert: no recent backups
+    expr: absent(burp_client_last_backup_timestamp)
+    for: 8h
+    annotations:
+      summary: No clients have been backed up recently
+      description: >-
+        This alert indicates that NO clients have been backed up within the
+        last day.  There is likely a problem with the BURP server.
+  - alert: missed client backup
+    expr:
+      time() - (burp_client_last_backup_timestamp > now() - 86400 * 90) > 86400 * 2
+    for: 3h
+    annotations:
+      summary: A client has not backed up today
+      description: >-
+        A client has not been backed up for more than a day.  This may be
+        because the client is offline, or because the backup process has
+        failed.  Clients that have not been backed up for more than 90 days
+        will not trigger this alert.
  - alert: disks need swapped
    expr:
      time() - tlast_change_over_time(
        (
-          collectd_md_md_disks{instance="chromie.pyrocufflink.blue", type="active"}
-          or last_over_time(collectd_md_md_disks{instance="chromie.pyrocufflink.blue", type="active"})[1d]
+          collectd_md_md_disks{instance="burp1.pyrocufflink.blue", type="active"}
+          or last_over_time(collectd_md_md_disks{instance="burp1.pyrocufflink.blue", type="active"})[1d]
        )[90d]
      ) > 86400 * 30
    annotations:
-      summary: The disks in the backup array need swapped
+      summary: The disks in the BURP array need swapped
      description: >-
-        The disks in the backup RAID-1 (mirror) array should be swapped
+        The disks in the BURP RAID-1 (mirror) array should be swapped
        periodically. One disk should be online and mounted while the other
        is stored in the fireproof safe.  Switching them ensures that even if
        something happens to the active disk, such as hardware failure, power
@@ -86,12 +82,12 @@ groups:
  - alert: disk needs archived
    expr:
      sum(
-        collectd_md_md_disks{instance="chromie.pyrocufflink.blue", type=~"missing|spare"}
+        collectd_md_md_disks{instance="burp1.pyrocufflink.blue", type=~"missing|spare"}
      ) < 1
    annotations:
-      summary: One of the disks in the backup array should be archived
+      summary: One of the disks in the BURP array should be archived
      description: >-
-        The disks in the backup RAID-1 (mirror) array should be swapped
+        The disks in the BURP RAID-1 (mirror) array should be swapped
        periodically.  One disk should be online and mounted while the other
        is stored in the fireproof safe.  All of the disks are currently
        online; one needs to be disconnected and moved to the safe as soon as
@@ -124,48 +120,18 @@ groups:
  rules:
  - alert: Frigate is Unavailable
    expr:
-      absent(frigate_service_info)
-      or irate(frigate_service_last_updated_timestamp) < 1
-      or irate(frigate_service_uptime_seconds) < 1
+      homeassistant_entity_available{entity=~".*frigate_(server|status)"} != 1
    for: 10m
  - alert: Camera unavailable
    expr:
      homeassistant_entity_available{domain="camera"} != 1
    for: 10m

- name: Home Assistant
+- name: Sensors
  rules:
  - alert: Battery Low
    expr:
      homeassistant_sensor_battery_percent{entity!~"sensor\\.(pixel_|sm_p610).*"} < 10
-    annotations:
-      summary: >-
-        Low battery: {{ $labels.friendly_name }}
-      severity: minor
-  - alert: Z-Wave Network is Offline
-    expr:
-      sum(
-        homeassistant_entity_available{entity="sensor.usb_controller_status"}
-      ) without (
-        friendly_name
-      ) < 1
-    annotations:
-      summary: The Z-Wave network controller is offline
-      description: >-
-        Home Assistant is not able to communicate with ZWaveJS, or ZWaveJS is
-        not able to connect to the Z-Wave USB controller.  Z-Wave devices like
-        light switches, door sensors, and smart plugs will not work until the
-        Z-Wave network is operational again.
-  - alert: Zigbee Network is Offline
-    expr:
-      homeassistant_binary_sensor_state{entity="binary_sensor.zigbee2mqtt_bridge_connection_state"} == 0
-    annotations:
-      summary: The Zigbee network bridge is offline
-      description: >-
-        Home Assistant is not able to communicate with Zigbee2MQTT, or
-        Zigbee2MQTT is not able to connect to the Z-Wave USB controller.
-        Zigbee devices like smart bulbs and buttons will not work until the
-        Zigbee network is operational again.

 - name: PostgreSQL
  rules:
@@ -175,24 +141,6 @@ groups:
      - ignoring (instance) group_right (scope) (patroni_xlog_replayed_location != 0)
      > 10240
    for: 10m
-  - alert: WAL archive process failed
-    expr: >-
-      pg_stat_archiver_failed_count > 0
-    annotations:
-      summary: The archiver process failed for one or more WAL segments
-      description: >-
-        Check the WAL segment archiver configuration and confirm that WAL
-        segments are being backed up correctly.
-  - alert: No recent WAL archives
-    expr: >-
-      pg_stat_archiver_last_archive_age > 3600
-    annotations:
-      summary: The last successful WAL segment backup was over 1h ago
-      description: >-
-        The WAL archiver process has not run successfully for over an hour.
-        Ensure the WAL backup process is configured correctly and the backup
-        target is online and healthy.
-

 - name: Temperature
  rules:
@@ -211,61 +159,3 @@ groups:
    expr: >-
      count(longhorn_volume_robustness==3) > 0
    for: 5m
-
- name: Restic
-  rules:
-  - alert: Repository Check Failed
-    expr: >-
-      min(restic_check_success) by (job) < 1
-    annotations:
-      summary: Errors found in restic repository data
-      description: >-
-        The Restic repository has one or more problems that may result in data
-        loss.  Check the restic-exporter log for more information and correct
-        the issue as soon as possible.
-  - alert: Last Backup Age
-    expr: >-
-      time() - restic_backup_timestamp{
-        client_hostname!="luma.pyrocufflink.blue",
-        client_hostname!="toad.pyrocufflink.blue",
-      }> 604800
-    annotations:
-      summary: A Restic client has not backed up recently
-      description: >-
-        Clients are scheduled to back up every day, but at least one has not
-        been backed up in at least 7 days.  Check the Restic configuration on
-        that system to ensure backups are running properly.
-
- name: Paperless-ngx
-  rules:
-  - alert: Celery tasks failed
-    expr: >-
-      max_over_time(
-        increase(
-          flower_events_total{
-            job="paperless-ngx",
-            type="task-failed",
-            task!="documents.tasks.consume_file",
-          }
-        )[24h]
-      ) > 0
-    annotations:
-      summary: Paperless-ngx Celery task failed
-      description: >-
-        Failing Celery tasks may indicate a problem with the Paperless-ngx
-        deployment and can result in data loss.  Check the Paperless-ngx logs
-        for details about the task failures.
-  - alert: Paperless email task not running
-    expr: >-
-      absent_over_time(
-        flower_events_total{
-          type="task-started",
-          task="paperless_mail.tasks.process_mail_accounts"
-        }[12h]
-      )
-    annotations:
-      summary: Paperless task to process mail accounts has not run recently
-      description: >-
-        Paperless-ngx uses a scheduled Celery task to periodically poll email
-        mailboxes for new messages.  If this task does not start, new email
-        messages will not be downloaded and imported into the document library.
--- a/victoria-metrics/blackbox.yml
+++ b/victoria-metrics/blackbox.yml
@@ -10,7 +10,7 @@ modules:
    timeout: 2s
  dns_recursive:
    dns:
-      query_name: github.com
+      query_name: news.ycombinator.com
      query_type: A
    prober: dns
    timeout: 5s
--- a/victoria-metrics/kustomization.yaml
+++ b/victoria-metrics/kustomization.yaml
@@ -38,7 +38,6 @@ configMapGenerator:
 - name: vmalert-rules
  files:
  - alerts.yml
-  - recording.yml
  options:
    disableNameSuffixHash: true
    labels:
--- a/victoria-metrics/recording.yml
+++ b/victoria-metrics/recording.yml
@@ -1,8 +0,0 @@
-groups:
- name: collectd
-  rules:
-  - record: filesystem:usage:percent
-    expr: >-
-      sum without (type) (collectd_df_df_complex{type!="free"})
-      / sum without (type) (collectd_df_df_complex)
-
--- a/victoria-metrics/scrape.yml
+++ b/victoria-metrics/scrape.yml
@@ -34,7 +34,10 @@ scrape_configs:
    - icmp
  static_configs:
  - targets:
-    - 23.29.47.1
+    - github.com
+    - cloudflare.com
+    - amazonaws.com
+    - azure.com
  relabel_configs:
  - source_labels: [__address__]
    target_label: __param_target
@@ -57,9 +60,10 @@ scrape_configs:
    - http://pyrocufflink.net/
    - http://ebonfire.com/
    - http://chmod777.sh/
-    - https://nextcloud.pyrocufflink.net/index.php
+    - https://nextcloud.pyrocufflink.net/
    - https://bitwarden.pyrocufflink.blue/
    - https://git.pyrocufflink.blue/
+    - https://jenkins.pyrocufflink.blue/login
    - https://tabitha.biz/
    - https://dustinandtabitha.com/
    - https://hatchlearningcenter.org/
@@ -76,8 +80,12 @@ scrape_configs:
  static_configs:
  - targets:
    - gw1.pyrocufflink.blue
+    - loki0.pyrocufflink.blue
+    - nut0.pyrocufflink.blue
    - nvr2.pyrocufflink.blue
    - unifi3.pyrocufflink.blue
+    - vmhost0.pyrocufflink.blue
+    - vmhost1.pyrocufflink.blue
  file_sd_configs:
  - files:
    - /scrape/collectd/scrape-collectd.yml
@@ -87,9 +95,6 @@ scrape_configs:
  kubernetes_sd_configs:
  - role: node
  relabel_configs:
-  - source_labels: [__meta_kubernetes_node_name]
-    regex: .*\.compute\.internal$
-    action: drop
  - action: labelmap
    regex: __meta_kubernetes_node_label_(.+)
  - source_labels:
@@ -196,6 +201,18 @@ scrape_configs:
  - targets:
    - git.pyrocufflink.blue

+- job_name: synapse
+  metrics_path: /_synapse/metrics
+  static_configs:
+  - targets:
+    - matrix0.pyrocufflink.blue
+  relabel_configs:
+  - source_labels: [__address__]
+    target_label: instance
+  - source_labels: [__address__]
+    target_label: __address__
+    replacement: '$1:9000'
+
 - job_name: jenkins
  metrics_path: /prometheus/
  scheme: https
@@ -203,6 +220,20 @@ scrape_configs:
  - targets:
    - jenkins.pyrocufflink.blue

+- job_name: burp
+  scrape_interval: 270s
+  scrape_timeout: 30s
+  static_configs:
+  - targets:
+    - burp.pyrocufflink.blue:9645
+
+- job_name: minio-backups
+  metrics_path: /minio/v2/metrics/cluster
+  scheme: https
+  static_configs:
+  - targets:
+    - burp.pyrocufflink.blue:9000
+
 - job_name: kubernetes
  scheme: https
  tls_config:
@@ -252,6 +283,8 @@ scrape_configs:
  metrics_path: /bridge?selector=zincati
  static_configs:
  - targets:
+    - loki0.pyrocufflink.blue
+    - nut0.pyrocufflink.blue
    - unifi3.pyrocufflink.blue
  kubernetes_sd_configs:
  - role: node
@@ -259,9 +292,6 @@ scrape_configs:
  - source_labels: [__meta_kubernetes_node_name]
    regex: k8s-ctrl0.pyrocufflink.blue
    action: drop
-  - source_labels: [__meta_kubernetes_node_name]
-    regex: .*\.compute\.internal$
-    action: drop
  - source_labels: [__meta_kubernetes_node_name]
    regex: '(.+)'
    target_label: __address__
@@ -281,21 +311,15 @@ scrape_configs:
  scheme: https
  tls_config:
    ca_file: /run/dch-ca/dch-root-ca.crt
-  dns_sd_configs:
-  - names:
+  static_configs:
+  - targets:
    - loki.pyrocufflink.blue
-    type: A
-    port: 443
-  relabel_configs:
-  - source_labels: [__meta_dns_name, __meta_dns_srv_record_port]
-    separator: ':'
-    target_label: __address__
-  - source_labels: [__address__]
-    target_label: instance

 - job_name: promtail
  static_configs:
  - targets:
+    - loki0.pyrocufflink.blue
+    - nut0.pyrocufflink.blue
    - nvr2.pyrocufflink.blue
    - unifi3.pyrocufflink.blue
  kubernetes_sd_configs:
@@ -307,9 +331,6 @@ scrape_configs:
    - role: pod
      label: app.kubernetes.io/name=promtail
  relabel_configs:
-  - source_labels: [__meta_kubernetes_node_name]
-    regex: .*\.compute\.internal$
-    action: drop
  - source_labels: [__address__]
    target_label: instance
  - source_labels: [__meta_kubernetes_pod_node_name]
@@ -425,17 +446,6 @@ scrape_configs:
    target_label: __address__
    replacement: '$1:9187'

- job_name: wal-g
-  static_configs:
-  - targets:
-    - db0.pyrocufflink.blue
-  relabel_configs:
-  - source_labels: [__address__]
-    target_label: instance
-  - source_labels: [__address__]
-    target_label: __address__
-    replacement: '$1:9102'
-
 - job_name: rabbitmq
  kubernetes_sd_configs:
  - role: pod
@@ -453,58 +463,3 @@ scrape_configs:
  - source_labels:
    - __meta_kubernetes_pod_name
    target_label: instance
-
- job_name: ntfy
-  kubernetes_sd_configs:
-  - role: pod
-    namespaces:
-      names:
-      - ntfy
-    selectors:
-    - role: pod
-      label: app.kubernetes.io/name=ntfy
-  relabel_configs:
-  - source_labels:
-    - __meta_kubernetes_pod_name
-    target_label: instance
-
- job_name: frigate
-  dns_sd_configs:
-  - names:
-    - frigate.pyrocufflink.blue
-    type: A
-    port: 9100
-  relabel_configs:
-  - source_labels: [__meta_dns_name, __meta_dns_srv_record_port]
-    separator: ':'
-    target_label: __address__
-  - source_labels: [__address__]
-    target_label: instance
-
- job_name: haproxy
-  static_configs:
-  - targets:
-    - haproxy0.pyrocufflink.blue
-  relabel_configs:
-  - source_labels: [__address__]
-    target_label: instance
-  - source_labels: [__address__]
-    target_label: __address__
-    replacement: '$1:8118'
-
- job_name: jellyfin
-  scheme: https
-  dns_sd_configs:
-  - names:
-    - jellyfin.pyrocufflink.blue
-    type: A
-    port: 443
-  relabel_configs:
-  - source_labels:
-    - __meta_dns_name
-    - __meta_dns_srv_record_port
-    separator: ':'
-    target_label: __address__
-  - source_labels:
-    - __meta_dns_name
-    target_label: instance
--- a/websites/darkchestofwonders.us/ingress.yaml
+++ b/websites/darkchestofwonders.us/ingress.yaml
@@ -8,17 +8,10 @@ metadata:
    app.kubernetes.io/component: darkchestofwonders.us
    app.kubernetes.io/part-of: darkchestofwonders.us
  annotations:
-    cert-manager.io/cluster-issuer: zerossl
-    cert-manager.io/private-key-algorithm: ECDSA
    nginx.ingress.kubernetes.io/ssl-redirect: "false"
    nginx.ingress.kubernetes.io/proxy-body-size: 100m
 spec:
  ingressClassName: nginx
-  tls:
-  - hosts:
-    - '*.darkchestofwonders.us'
-    - darkchestofwonders.us
-    secretName: dcow-cert
  rules:
  - host: darkchestofwonders.us
    http:
--- a/Show More
+++ b/Show More
				`@@ -1 +0,0 @@`
				`ssh -i /run/secrets/home-assistant/sshkey.pem -oUserKnownHostsFile=/run/config/ssh_known_hosts -oBatchMode=yes kitchen@kitchen.pyrocufflink.red restart-mqttmarionette`
				`@@ -1 +0,0 @@`
				`ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDw5BwoaF5bHI+VDT7vDCRu62FjdBNX4B/NcAtcgd/Qs updatebot`