feat: rework blackbox-exporter

2025-09-30 23:45:25 +02:00 · 2022-07-03 11:58:53 +02:00
parent 1173ed1d7f
commit ef8f06f76c
19 changed files with 214 additions and 175 deletions
--- a/cluster/apps/data/joplin-server/helm-release.yaml
+++ b/cluster/apps/data/joplin-server/helm-release.yaml
@@ -43,7 +43,7 @@ spec:
        enabled: true
        ingressClassName: "nginx"
        annotations:
-          external-dns.alpha.kubernetes.io/target: "services.${SECRET_CLUSTER_DOMAIN_ROOT}."
+          external-dns.alpha.kubernetes.io/target: "services.${SECRET_DOMAIN}."
          external-dns/is-public: "true"
        hosts:
          - host: "joplin.${SECRET_CLUSTER_DOMAIN}"
--- a/cluster/apps/data/sharry/helm-release.yaml
+++ b/cluster/apps/data/sharry/helm-release.yaml
@@ -140,7 +140,7 @@ spec:
        enabled: true
        ingressClassName: "nginx"
        annotations:
-          external-dns.alpha.kubernetes.io/target: "services.${SECRET_CLUSTER_DOMAIN_ROOT}."
+          external-dns.alpha.kubernetes.io/target: "services.${SECRET_DOMAIN}."
          external-dns/is-public: "true"
          nginx.ingress.kubernetes.io/proxy-body-size: "0"
        hosts:
--- a/cluster/apps/data/vaultwarden/helm-release.yaml
+++ b/cluster/apps/data/vaultwarden/helm-release.yaml
@@ -31,7 +31,7 @@ spec:
      SIGNUPS_ALLOWED: "false"
      WEBSOCKET_ENABLED: "true"
      SMTP_HOST: smtp.fastmail.com
-      SMTP_FROM: vaultwarden@${SECRET_CLUSTER_DOMAIN_ROOT}
+      SMTP_FROM: vaultwarden@${SECRET_DOMAIN}
      SMTP_FROM_NAME: vaultwarden
      SMTP_PORT: 587
      SMTP_SSL: "true"
@@ -54,7 +54,7 @@ spec:
        enabled: true
        ingressClassName: "nginx"
        annotations:
-          external-dns.alpha.kubernetes.io/target: "services.${SECRET_CLUSTER_DOMAIN_ROOT}."
+          external-dns.alpha.kubernetes.io/target: "services.${SECRET_DOMAIN}."
          external-dns/is-public: "true"
        hosts:
          - host: "vaultwarden.${SECRET_CLUSTER_DOMAIN}"
--- a/cluster/apps/data/vikunja/helm-release.yaml
+++ b/cluster/apps/data/vikunja/helm-release.yaml
@@ -44,7 +44,7 @@ spec:
        enabled: true
        ingressClassName: "nginx"
        annotations:
-          external-dns.alpha.kubernetes.io/target: "services.${SECRET_CLUSTER_DOMAIN_ROOT}."
+          external-dns.alpha.kubernetes.io/target: "services.${SECRET_DOMAIN}."
          external-dns/is-public: "true"
        hosts:
          - host: "vikunja.${SECRET_CLUSTER_DOMAIN}"
--- a/cluster/apps/data/wallabag/helm-release.yaml
+++ b/cluster/apps/data/wallabag/helm-release.yaml
@@ -65,7 +65,7 @@ spec:
        enabled: true
        ingressClassName: "nginx"
        annotations:
-          external-dns.alpha.kubernetes.io/target: "services.${SECRET_CLUSTER_DOMAIN_ROOT}."
+          external-dns.alpha.kubernetes.io/target: "services.${SECRET_DOMAIN}."
          external-dns/is-public: "true"
        hosts:
          - host: "wallabag.${SECRET_CLUSTER_DOMAIN}"
--- a/cluster/apps/development/gitea/backup-job.yaml
+++ b/cluster/apps/development/gitea/backup-job.yaml
@@ -69,7 +69,7 @@ spec:
                            else
                                echo "INFO: clone $org/$repo..."
                                cd $WORK_DIR/$org
-                                git clone git@gitea.${SECRET_CLUSTER_DOMAIN_ROOT}:$org/$repo.git
+                                git clone git@gitea.${SECRET_DOMAIN}:$org/$repo.git
                                test $? -ne 0 && exit 1
                            fi
                        done
--- a/cluster/apps/development/gitea/helm-release.yaml
+++ b/cluster/apps/development/gitea/helm-release.yaml
@@ -46,7 +46,7 @@ spec:
        server:
          SSH_PORT: 22
          SSH_LISTEN_PORT: 30322
-          SSH_DOMAIN: gitea.${SECRET_CLUSTER_DOMAIN_ROOT}
+          SSH_DOMAIN: gitea.${SECRET_DOMAIN}
          ROOT_URL: https://gitea.${SECRET_CLUSTER_DOMAIN}
        respository:
          DEFAULT_PRIVATE: true
--- a/cluster/apps/media/jellyfin/helm-release.yaml
+++ b/cluster/apps/media/jellyfin/helm-release.yaml
@@ -56,7 +56,7 @@ spec:
        enabled: true
        ingressClassName: "nginx"
        annotations:
-          external-dns.alpha.kubernetes.io/target: "services.${SECRET_CLUSTER_DOMAIN_ROOT}."
+          external-dns.alpha.kubernetes.io/target: "services.${SECRET_DOMAIN}."
          external-dns/is-public: "true"
        hosts:
          - host: "jellyfin.${SECRET_CLUSTER_DOMAIN}"
--- a/cluster/apps/media/lychee/helm-release.yaml
+++ b/cluster/apps/media/lychee/helm-release.yaml
@@ -55,7 +55,7 @@ spec:
        enabled: true
        ingressClassName: "nginx"
        annotations:
-          external-dns.alpha.kubernetes.io/target: "services.${SECRET_CLUSTER_DOMAIN_ROOT}."
+          external-dns.alpha.kubernetes.io/target: "services.${SECRET_DOMAIN}."
          external-dns/is-public: "true"
        hosts:
          - host: "lychee.${SECRET_CLUSTER_DOMAIN}"
--- a/cluster/apps/media/navidrome/helm-release.yaml
+++ b/cluster/apps/media/navidrome/helm-release.yaml
@@ -44,7 +44,7 @@ spec:
        enabled: true
        ingressClassName: "nginx"
        annotations:
-          external-dns.alpha.kubernetes.io/target: "services.${SECRET_CLUSTER_DOMAIN_ROOT}."
+          external-dns.alpha.kubernetes.io/target: "services.${SECRET_DOMAIN}."
          external-dns/is-public: "true"
        hosts:
          - host: &host-release "{{ .Release.Name }}.${SECRET_CLUSTER_DOMAIN}"
--- a/cluster/apps/monitoring/blackbox-exporter/helm-release.yaml
+++ b/cluster/apps/monitoring/blackbox-exporter/helm-release.yaml
@@ -8,17 +8,30 @@ spec:
  interval: 5m
  chart:
    spec:
-      # renovate: registryUrl=https://prometheus-community.github.io/helm-charts
      chart: prometheus-blackbox-exporter
      version: 5.8.2
      sourceRef:
        kind: HelmRepository
        name: prometheus-community-charts
        namespace: flux-system
-      interval: 5m
+      interval: 15m
+  install:
+    createNamespace: true
+    remediation:
+      retries: 5
+  upgrade:
+    remediation:
+      retries: 5
  values:
+    fullnameOverride: blackbox-exporter
+
+    image:
+      repository: quay.io/prometheus/blackbox-exporter
    allowIcmp: true

+    podAnnotations:
+      configmap.reloader.stakater.com/reload: "blackbox-exporter"
+
    config:
      modules:
        icmp:
@@ -30,8 +43,8 @@ spec:
          prober: http
          timeout: 30s
          http:
-            valid_http_versions: ["HTTP/1.0", "HTTP/1.1", "HTTP/2.0"]
-            no_follow_redirects: false
+            valid_http_versions: ["HTTP/1.1", "HTTP/2.0"]
+            follow_redirects: true
            preferred_ip_protocol: "ip4"
        tcp_connect:
          prober: tcp
@@ -45,22 +58,37 @@ spec:
        interval: 2m
        scrapeTimeout: 30s
      targets:
-        - name: truenas
+        - module: http_2xx
+          name: opnsense-http
+          url: "https://opnsense.${SECRET_DOMAIN}"
+        - module: http_2xx
+          name: truenas-http
+          url: "https://truenas.${SECRET_DOMAIN}"
+        - module: http_2xx
+          name: truenas-remote-http
+          url: "https://truenas-remote.${SECRET_DOMAIN}"
+        - name: truenas-icmp
          url: "${LOCAL_LAN_TRUENAS}"
          module: icmp
-        # - name: truenas-remote
-        #   url: "${LOCAL_LAN_TRUENAS_REMOTE}"
-        #   module: icmp
-        - name: k3s-server
+        - name: truenas-remote-icmp
+          url: "${LOCAL_LAN_TRUENAS_REMOTE}"
+          module: icmp
+        - name: openmediavault-icmp
+          url: "${LOCAL_LAN_OPENMEDIAVAULT}"
+          module: icmp
+        - name: coreelec-icmp
+          url: "${LOCAL_LAN_COREELEC}"
+          module: icmp
+        - name: k3s-master-icmp
          url: "${LOCAL_LAN_K3SSERVER}"
          module: icmp
-        - name: k3s-worker1
+        - name: k3s-worker1-icmp
          url: "${LOCAL_LAN_K3SWORKER1}"
          module: icmp
-        - name: k3s-worker2
+        - name: k3s-worker2-icmp
          url: "${LOCAL_LAN_K3SWORKER2}"
          module: icmp
-        - name: k3s-worker3
+        - name: k3s-worker3-icmp
          url: "${LOCAL_LAN_K3SWORKER3}"
          module: icmp

@@ -70,13 +98,30 @@ spec:
        app: prometheus-operator
        release: prometheus
      rules:
-        - alert: HostDown
-          expr: probe_success == 0
-          for: 10m
+        - alert: BlackboxSslCertificateWillExpireSoon
+          expr: probe_ssl_earliest_cert_expiry - time() < 86400 * 3
+          for: 15m
          labels:
            severity: critical
          annotations:
-            message: The host {{"{{ $labels.target }}"}} is currently unreachable
+            description: |-
+              The SSL certificate for {{"{{ $labels.target }}"}} will expire in less than 3 days
+        - alert: BlackboxSslCertificateExpired
+          expr: probe_ssl_earliest_cert_expiry - time() <= 0
+          for: 15m
+          labels:
+            severity: critical
+          annotations:
+            description: |-
+              The SSL certificate for {{"{{ $labels.target }}"}} has expired
+        - alert: BlackboxProbeFailed
+          expr: probe_success == 0
+          for: 15m
+          labels:
+            severity: critical
+          annotations:
+            description: |-
+              The host {{"{{ $labels.target }}"}} is currently unreachable
        - alert: SlowResponseTime
          annotations:
            message: The response time for {{"{{ $labels.target }}"}} has been greater than 30 seconds for 5 minutes.
@@ -87,6 +132,7 @@ spec:

    ingress:
      enabled: true
+      className: nginx
      annotations:
        nginx.ingress.kubernetes.io/auth-url: "http://authelia.networking.svc.cluster.local/api/verify"
        nginx.ingress.kubernetes.io/auth-signin: "https://login.${SECRET_CLUSTER_DOMAIN}"
@@ -98,14 +144,3 @@ spec:
      tls:
        - hosts:
            - "blackbox.${SECRET_CLUSTER_DOMAIN}"
-
-  postRenderers:
-    - kustomize:
-        patchesJson6902:
-          - target:
-              kind: Ingress
-              name: blackbox-exporter-prometheus-blackbox-exporter
-            patch:
-              - op: add
-                path: /spec/ingressClassName
-                value: nginx
--- a/cluster/apps/monitoring/healthchecks/helm-release.yaml
+++ b/cluster/apps/monitoring/healthchecks/helm-release.yaml
@@ -56,7 +56,7 @@ spec:
        enabled: true
        ingressClassName: "nginx"
        annotations:
-          external-dns.alpha.kubernetes.io/target: "services.${SECRET_CLUSTER_DOMAIN_ROOT}."
+          external-dns.alpha.kubernetes.io/target: "services.${SECRET_DOMAIN}."
          external-dns/is-public: "true"
        hosts:
          - host: "healthchecks.${SECRET_CLUSTER_DOMAIN}"
--- a/cluster/apps/networking/authelia/helm-release.yaml
+++ b/cluster/apps/networking/authelia/helm-release.yaml
@@ -28,7 +28,7 @@ spec:
      enabled: true
      className: nginx
      annotations:
-        external-dns.alpha.kubernetes.io/target: "services.${SECRET_CLUSTER_DOMAIN_ROOT}."
+        external-dns.alpha.kubernetes.io/target: "services.${SECRET_DOMAIN}."
        external-dns/is-public: "true"
      subdomain: login

--- a/cluster/apps/networking/external-dns/helm-release.yaml
+++ b/cluster/apps/networking/external-dns/helm-release.yaml
@@ -49,7 +49,7 @@ spec:
      - ingress
    txtOwnerId: "default"
    domainFilters:
-      - "${SECRET_CLUSTER_DOMAIN_ROOT}"
+      - "${SECRET_DOMAIN}"
    serviceMonitor:
      enabled: true
    resources:
--- a/cluster/configuration/secrets/cluster-secrets.yaml
+++ b/cluster/configuration/secrets/cluster-secrets.yaml
@@ -1,137 +1,141 @@
 apiVersion: v1
 kind: Secret
 metadata:
-  name: cluster-secrets
-  namespace: flux-system
+    name: cluster-secrets
+    namespace: flux-system
 stringData:
-  SECRET_AUTHELIA_JWT_SECRET: ENC[AES256_GCM,data:gM6BOzML64dtVbxo0KytgE2mBn5h99OUWpGVqw==,iv:lYVaFvjBslRiDNZsSrvufrykN93gYp5RJ7p9kvpYo94=,tag:hAJYatxIgxanOO2CGuSA4A==,type:str]
-  SECRET_AUTHELIA_SESSION_SECRET: ENC[AES256_GCM,data:ooT2ZCaes9ZnRbXQH20KmDr/aGZGwtUBiofNGg==,iv:+hK2Y4Kca26uBCfJKTwfiXdn3bMdiCbLh5ny+DLcWHc=,tag:tMgG5MsqrrmeNVHSKJPOaQ==,type:str]
-  SECRET_AUTHELIA_POSTGRES_PASSWORD: ENC[AES256_GCM,data:sEAl2/oDdpy0j+xGX+o=,iv:meHcQtiS2MHchAo/c1OS4KQ8xHR5s26HM81krsF4r08=,tag:usxuVcfKhYpot5OsauIg6g==,type:str]
-  SECRET_AUTHELIA_SMTP_EMAIL: ENC[AES256_GCM,data:ZKpWHV5pH4SInK9ufcLFV/mGSuzyJag=,iv:193VLU+vaIg0khWAIsaxDyZifmj8HGhZY+3WNCrTrVo=,tag:66htStPaiHXMit86gBZfBw==,type:str]
-  SECRET_AUTHELIA_SMTP_PASSWORD: ENC[AES256_GCM,data:3oKp3SX26PdFBgxZUgQzmQ==,iv:U15uvT8TY4/7LMd3OEFoLvUAsJN+pmkkpk/NRF/mhPs=,tag:G5TyRIEWWkimsAFyHBBa1g==,type:str]
-  SECRET_AUTHELIA_STORAGE_ENCRYPTION_KEY: ENC[AES256_GCM,data:AtfCxA80Mzdw767KklkBy+tvwPLKZgQNJYQnGA==,iv:/EARDr0ZBPMDhpUqR3cdJfeapGiJJum+WZ3IVrG84to=,tag:Tc5ogeATjEPrTYHtfL3iaQ==,type:str]
-  SECRET_AUTHELIA_USER_CLAUDE_EMAIL: ENC[AES256_GCM,data:9y3d3jYExtjzGckHkOovix+vdT90C6c=,iv:QkNJfSHgTKoo7n+TeAoM0lkZwCdOBnP6svqj4g7Y4AM=,tag:3ocSW53znw5YzLkrB7H3KQ==,type:str]
-  SECRET_AUTHELIA_USER_CLAUDE_PASSWORD: ENC[AES256_GCM,data:LTqAllWGMeI8ne+T7lwAMQe9wYmktF740v6bUd5mmK3q3O/+J9e7uADhR9H4YvFI8t5jdZuzUsOcshp/C3gTG7d5dGnDVti+/AMHO4jBZq34w9QcAmoAEn9+ul+JqztS+GcA,iv:HZNvl28eqeKX1pv+pETCxfwdQY7JEJRpJTkBkONzQeM=,tag:YVXbnB0cDqGoUPREhXn3/g==,type:str]
-  SECRET_AUTHELIA_USER_HELENE_EMAIL: ENC[AES256_GCM,data:U1XsbJaerLG7hYDMMaGPtEijqJBRsaJT,iv:GZo92PQYAYl5wbPoj4i9EJ4lI4y89Z4jN77sOLzwvIU=,tag:6+gp0o5DP2urwA5gpRzTgw==,type:str]
-  SECRET_AUTHELIA_USER_HELENE_PASSWORD: ENC[AES256_GCM,data:dIV+8UnTXqTdd17OlULQsK/Sh+xjbYp+7vXRDhUHpFr5HLgmY1pXBTKDUUjvZWeOats1/hO6FaG0z4q0+jMpuNNQ6/g1H6WFGJZ7SoBSnPC2CUnXIkKIrq5HcJ2cFkp1RQko,iv:ENrB5JjmkGXsUtySXMhgsqM/lccvAavcO5HkXNbt6Ls=,tag:64iM/2kceVU7h5qmxgbflw==,type:str]
-  SECRET_AUTHELIA_USER_VISITOR_EMAIL: ENC[AES256_GCM,data:+9qhqqYl7uE2CnhMibjnqutcDkP5WQ==,iv:rx1RIaBaGlKRrvDF43OM4UrwdSMd0IwM1t+6OpNB+Tk=,tag:i0ZxfkuOxYDZH/anW4kjsA==,type:str]
-  SECRET_AUTHELIA_USER_VISITOR_PASSWORD: ENC[AES256_GCM,data:GdUNxFL899EyPdudAVBsgCPRyKhCG3W82M5eFOp0XPCLUtp25WRiptqNFs1N9cv0KbCxbPUGYeWAf21TFD5xpK733KwL+HOSPlIPZ7GJc3d4sDLNHYfYZOhzp5QWrM5MEv3L,iv:/HjzrV8EfxQ4cr/ZDfgKdafXm71+hR27vA25xefqHXI=,tag:GNj9GzhdM8Xxmmk35pb0/w==,type:str]
-  SECRET_BOOKSTACK_DB_PASSWORD: ENC[AES256_GCM,data:i9Ky7+e2UHfh14EP9wus8Q==,iv:6grPFBXTg+Oj/jShYgpM84k65r6bKvXFg5b9St3PeTE=,tag:kEab7xSmieYtdeg0zAEyXg==,type:str]
-  SECRET_BOOKSTACK_TOKEN_ID: ENC[AES256_GCM,data:loOHZy5NvxkiMwipNJDn1eE0T+fD1acxN4q6AvOH8Mk=,iv:PxHe8Yjtmc8pYs7+6J8q5SwCjCwT/WXMwLSAdCK0QCg=,tag:V7v9Pq67fxDFyQ/MFNDTug==,type:str]
-  SECRET_BOOKSTACK_TOKEN_SECRET: ENC[AES256_GCM,data:g2klUrzeAUm6U0v6T2ayqJJCbRC/Ri0eZtd3sb2iWvo=,iv:fKZX3b3VPWX0Krc8xI2B5huCKDkGxZYrvwuggk5JJ2k=,tag:lpebLylV/9NN8xJL9PXejA==,type:str]
-  SECRET_BOTKUBE_DISCORD_BOTID: ENC[AES256_GCM,data:bK1J9v+/Dajd9qrvz3lH49GY,iv:Hq6cY96Te1frwXVf3HC3qgOiaCZW2hHCqjVvvslUGFg=,tag:Dq0cUemHKfcdpx9hLkUekQ==,type:str]
-  SECRET_BOTKUBE_DISCORD_TOKEN: ENC[AES256_GCM,data:pDPm3TYITWApPZRMcSH6ijtPQQuHSd/PNT2Wy23tUp7uzluhHS5hvlujTkjk7oRb95kE6Gi2D8yDmNg=,iv:HQyMQiaRsjNIfPUTjLRVL/zchSdXFmevxaeruwGx3tk=,tag:l+po8014SaZd61DxE1T43A==,type:str]
-  SECRET_CLUSTER_CERTIFICATE_DEFAULT: ENC[AES256_GCM,data:NlCiFO/3sseKI3fVzQ4ajeMOrg==,iv:seSVdR5wkR8sf/PKSy7T3P5oCkbJI4sMNC8XWSJUnh0=,tag:jSjCQVDNPQ7c8Dlg8yozPg==,type:str]
-  SECRET_CLUSTER_DOMAIN_EMAIL: ENC[AES256_GCM,data:kiuNa+aDxNQwby0BorWtRylnjbWw,iv:0j20Vdux17muKzlO2Q3KzsZg9VrT411VoYxjqQC5xhQ=,tag:w7gCUgQFIlVdUFfHhB7pvQ==,type:str]
-  SECRET_CLUSTER_DOMAIN_ROOT: ENC[AES256_GCM,data:ho+ylXKrt7CZiOM=,iv:8873E4Td/82lWVwq/kXkEB8vgxEYha23/nbTkXfle/w=,tag:Yb/VInyUUOPhLUtq+Q+krQ==,type:str]
-  SECRET_CLUSTER_DOMAIN: ENC[AES256_GCM,data:mVPDuVpAXej8CQ0AO85o,iv:PF739I+LZMZaPpfCMZO62eMUbFqgtMszj2cOuIgfcfI=,tag:zEAjj33h/Ux53ctkCzapyw==,type:str]
-  SECRET_CLUSTER_OVH_APPLICATION_KEY: ENC[AES256_GCM,data:m7Eio9WPwEaP89uZCl/Kxw==,iv:wqMxUr4Xq37uXqejR5ppchOcvj9JeHAvn5txhaiJPnI=,tag:KT31Dj6AMbFJ6HjecuLRgA==,type:str]
-  SECRET_CLUSTER_OVH_APPLICATION_SECRET: ENC[AES256_GCM,data:5KsJw6S7Pq66pe+bxozGhnX/g8YqGfMWBhF4z4cfdI0=,iv:g2P2KhfFS/UXbAnzQPfyT1M5OAbNjCTdUU3nKh3SpMY=,tag:j8QHEcsprdngbHnjwFstkg==,type:str]
-  SECRET_CLUSTER_OVH_CONSUMER_KEY: ENC[AES256_GCM,data:jXzhrXo8cdSokLgNm21Rt2KMF9wHHMXWHDn1vQTZ+Z8=,iv:xK3T4TcwDCAVO9Ac5bkkAssFl2yyukG/jT9SqDpXTlE=,tag:lefwwx3BNW1bxKX6Lpr+mg==,type:str]
-  SECRET_DRONE_DATABASE_DATASOURCE: ENC[AES256_GCM,data:rMwhON/Pn9KKB7Zm3lLY+fgKyWlkMhq+MfTY1t0HGYuH5KjuXOB9nNRSrloZwELzbhRd/LNrWs8HSessI1aqnmSVuiMLh5lX/SW+YnHJuyuTgVKMCDHpvOZZmAkLo23TtCYcoQ==,iv:/xtHI89xoX3eSf2djUfwOTAxeh7ZhZ3vBRxB8BdJFtY=,tag:NvkUpzYKAk83iEzC8Yh/Cg==,type:str]
-  SECRET_DRONE_DATABASE_SECRET: ENC[AES256_GCM,data:qp8YlciBmug9oyWsANKLc0A4UAUrCV04afoCCM4XHR4=,iv:p9FONbA3uPPm0dbusB0dS6Z6xtsSl0EjXyadCOxUyxg=,tag:LTu7L/f2DOYPmoiZlgLj6w==,type:str]
-  SECRET_DRONE_GITEA_API_KEY: ENC[AES256_GCM,data:iFbxW4tii8Z9xnKp5lx9xqXY3aa3ES8kbwbeubZ5I+M23r5FJCrcHw==,iv:KzUKVQuRrPvVAD2GLsx+FDzTRe98STwuD8z6LUaruxo=,tag:Bl+5KfVsgSE0zkvWUYYJhQ==,type:str]
-  SECRET_DRONE_GITEA_CLIENT_ID: ENC[AES256_GCM,data:kBFH0XuS3F2iyz6ZyMxFC47iosSk8FV+91U+O83WDUHYo28Z,iv:wM7Rr8+GMcO+FLkkchWts72kYQ2ky2TReyzQhCQianE=,tag:+eNZCnqf5w9d0y9SBoOsdQ==,type:str]
-  SECRET_DRONE_GITEA_CLIENT_SECRET: ENC[AES256_GCM,data:pauYuTRK0o0tdsYZHtLL7cMiQ1UIg3Kn94IJgbrPG9yoWhUp5+u95Zflfr0=,iv:YI+eTpo7KUwTiwgUGa2wfRo3TZAR5TuYaoBGbkqvyJ8=,tag:t1iDyQTyb3k+2S/AvfcO3Q==,type:str]
-  SECRET_DRONE_PLUGIN_TOKEN: ENC[AES256_GCM,data:+WB1bbswUk7bUvcTFBIB939fT7mk+dGUEctN7g==,iv:W16Q6FC3xPnAKkQnuvwt1shpdclhcseGWzuutMKI1OE=,tag:iGcf+PVKGXETZF8NRNQ6kg==,type:str]
-  SECRET_DRONE_RPC_SECRET: ENC[AES256_GCM,data:o09RbdgITpO1wrE1gaxII2EDsf9MJraIDlm/vFoGCYQ=,iv:2a4GcQud79KlmZjkBBmatzZY2/Dd/81hkcs3trglR88=,tag:zcZQfEpIvdMFc4y/oIjz1A==,type:str]
-  SECRET_DOCKER_REGISTRY_HTPASSWD: ENC[AES256_GCM,data:c/JYGx8RZA58vzgi9txcljaojcP+KhIjuuktohbynYk6da4ykd/4t0QD69PcozxKEKbKDV51v8STtOsDZZka7edtz48=,iv:f2hX6F412cjwT8sEhWBKbowO7sj5w5mL8k62yPXSfXU=,tag:KGv/8cuKTxIdvo/sB/bqcw==,type:str]
-  SECRET_EMQX_ADMIN_PASSWORD: ENC[AES256_GCM,data:b0/u6/1y876hIoSfC8yZ1+Gi1A260sVW,iv:WN9hOX+S4fR9tAQlUnzmwjcwEthPL/dTk9vLD/K4nns=,tag:O3fBty7qDl2cO+L9viQ2YA==,type:str]
-  SECRET_GITEA_ADMIN_EMAIL: ENC[AES256_GCM,data:zAjKU2CZ2m4VpPg6R63LbCiEP9+j,iv:Oq9LzxojK1r5MTXCqa1KAyj0RyKsROhZqyM6I+V5f+8=,tag:h+BsjDLI3yHv+Uj6yyGMGA==,type:str]
-  SECRET_GITEA_ADMIN_PASSWORD: ENC[AES256_GCM,data:jaK0aOfEI0+bRLfgACg=,iv:aesMs89p3vFNJ8fgU9R+wrPXAE39W+g3Qm5NdpJyKzE=,tag:eN01mNN5lVMxra0F0UyooA==,type:str]
-  SECRET_GITEA_API_TOKEN: ENC[AES256_GCM,data:WOBap85BPAhELyUn3qa0eL08xoPDZqT+dIoQSRhKm1IMcDa8ajdjCg==,iv:xquX9qbMkOPIhrryy2lJOSjDMWiaC4blIkX1KNZCIEE=,tag:ZHBv5W2v+Gp+Hns7mFtUIA==,type:str]
-  SECRET_GITEA_DB_PASSWORD: ENC[AES256_GCM,data:+aqidk0Z2PiPwN09Ckc=,iv:AlFT8G1vMVW7h3CY0CkBD66ntS0NFNf96FLuBrkUkwI=,tag:fC1iqr/CKaGf9H2HcHOVSA==,type:str]
-  SECRET_HASS_DB_URL: ENC[AES256_GCM,data:qr821aPZG0T3HHO+V3Gkgqg9ZiRBVHz2YVtGg7wBGFFrbYUjxp+EWY2+KEjIevWvhXZPjIYZfJQkD5dQ5rdq7RMJpcHTP1sjqbrx7lL9bw==,iv:jtjLYgcyP1N80EQafy4df0jdfQyQ/iMqVLJc/LJAK/g=,tag:pVmzgdhui0hfPCHG/wijRg==,type:str]
-  SECRET_HASS_LATITUDE: ENC[AES256_GCM,data:ik+tndAS+JtYhQbddiWvkZc=,iv:mEuA19JFIHaJvQe5CWXS7krxIPYjcw+qh7gQJGaOTlQ=,tag:/u/QPonVyG8yqh01cIUr+A==,type:str]
-  SECRET_HASS_LONGITUDE: ENC[AES256_GCM,data:uMCRLH3w+9k+Gm+zNVfPot0=,iv:2RF8hDR9nIlMhVQqo2Yz1i/iJ6mAOpvsA0I2A/omLnc=,tag:toyVXFYVy65lFVJFX6U/Zg==,type:str]
-  SECRET_HASS_ELEVATION: ENC[AES256_GCM,data:fiI=,iv:Sy5NdLA7Ic8bGKEtN2Jjhmh4nnwV/KieTh0sHXvE5us=,tag:U5OzDIP70eA9JkLEEpeQWw==,type:str]
-  SECRET_HEALTHCHECKS_DB_PASSWORD: ENC[AES256_GCM,data:zyO/WDvr7IFobDE7s9X38g==,iv:pEaxCH0iwNfscKXnKZlGeGWcJcfMAxMTf4AbFGO8xLM=,tag:jTsRH7K/O9577xytS2uZpw==,type:str]
-  SECRET_HEALTHECKS_SECRET_KEY: ENC[AES256_GCM,data:ChWTKr7WxvvqOEQnZQIfUE2WXRyhnyPOW94m2f3SJ04=,iv:BV7nYDs3E/Fs1NSx233Qt0JzGCvcQgIyu7szSxPt2LQ=,tag:fKH4//rd1fPhMP7Jd/l+6A==,type:str]
-  SECRET_HEALTHCHECKS_SUPERUSER_EMAIL: ENC[AES256_GCM,data:iyo6ZDYI3FHewj0NlktZcwscKlKQ3FpJq9+n,iv:RwFX+UYaW4MpJwf9ehma3IPeWyOkXWLHBLoPIFmi+Jc=,tag:A2BbNIPOS6rfr+kJGtqarw==,type:str]
-  SECRET_HEALTHCHECKS_SUPERUSER_PASSWORD: ENC[AES256_GCM,data:hfsNJz7T4Bh+3IabIrpCkg==,iv:ZtLMrg2nkhORYfLxFs8cWNvqcg3ZBH40PVK/36nNbmg=,tag:GDSQ46O8UoyuCRpMK6T6sw==,type:str]
-  SECRET_HEALTHCHECKS_DISCORD_CLIENT_ID: ENC[AES256_GCM,data:aEXlJAz7wrNLu/RBVEyTf5s7,iv:6gpjKeGAeRYsaMg8rhsA9cTJ8ZhBKDC0totOdColRso=,tag:EyQCOF0DEcO79eF7VG8oSQ==,type:str]
-  SECRET_HEALTHCHECKS_DISCORD_CLIENT_SECRET: ENC[AES256_GCM,data:W4yi/MzApah+6QMuy8GMcKQLsOPsAiAh34ZRC19NNYc=,iv:jKyeIeoq6U+IaurALsj86hEjyz/s27+bGgYfj8PdDJw=,tag:2fFflZETGkzAF80rIsFZbQ==,type:str]
-  SECRET_JOPLIN_DB_PASSWORD: ENC[AES256_GCM,data:uvgI+o3aFFb8kgCj6Z1+CQ==,iv:YddVRpvap0mF41dI2EgKY9JEibp6xiLkQHKQhVvDpbc=,tag:rnAvL3XkzuMRZPStWxmnyQ==,type:str]
-  SECRET_K10_HTPASSWD: ENC[AES256_GCM,data:H2mV6qy417gLdsXYkU+mLbE+XSmMqaKh9xZ8dp8eoTtYI5QdH/W9PWW6aQ==,iv:qI2aFLo3GXCz9hpP+v1oy1VqwfY7/PwG6d2Hix7250E=,tag:tXnvroCBUyDtKjRRWL6M3Q==,type:str]
-  SECRET_KUBE_PROMETHEUS_STACK_ALERTMANAGER_PUSHOVER_USER_KEY: ENC[AES256_GCM,data:azyFfNtR086T7DA3EFli9u9Y52Qy5j2flq8Dubsj,iv:x/5UoQvIFa2u90TnUzX5c3KaMCp1dkNQgPuwSG7voEw=,tag:kG7ET5jNqWgQrd77VFs8Vw==,type:str]
-  SECRET_KUBE_PROMETHEUS_STACK_ALERTMANAGER_PUSHOVER_TOKEN: ENC[AES256_GCM,data:c0usK2LJ3omwhFDdLgR9+QjYh/uu9fiUU8pZIOa+,iv:Nwg9frmk3I3qK2oXMwWYKc+/9rALmy5kJpq4aXb7laI=,tag:wVHzq3aX0R8l9VixEwcJqA==,type:str]
-  SECRET_KUBE_PROMETHEUS_STACK_GRAFANA_ADMIN_PASSWORD: ENC[AES256_GCM,data:+ghl26QMqOW2rzryLhU=,iv:HNoaZGaFzBfhrD/+xgBqpGML4OBCxNbAmwWCoEngecw=,tag:qL2zYtMgzzjpba5k8cxoYg==,type:str]
-  SECRET_LYCHEE_DB_PASSWORD: ENC[AES256_GCM,data:qmYKRlqo+Pm5ug+TuEU=,iv:OPGmszHF4qtJ9Pz0mtxwa6IOKu14OZmOELgaFacpbog=,tag:gxaqfwAporp6lfoh5zcD0A==,type:str]
-  SECRET_MARIADB_ROOT_PASSWORD: ENC[AES256_GCM,data:MB6kRCnZH0DXWbUVSr8Izw==,iv:49hpx4SllnVALr0XeRqZnFnrP3rXCcup1MYvprjJzKQ=,tag:PrKIJFuxC/HyI6eOJq4gYQ==,type:str]
-  SECRET_MINIO_ACCESS_KEY: ENC[AES256_GCM,data:QHq4tb8=,iv:OP7QThklBqHxAYvdnVRBUOoj5RDvFmbQRl8HNK+ACSw=,tag:4xWWSCQfAVg8HZ232YnHbQ==,type:str]
-  SECRET_MINIO_SECRET_KEY: ENC[AES256_GCM,data:BPaiA5Y37VeV1aEjrdxI/ujhwt4=,iv:6bEYn4z5dAPMln8RDMsKaA6SVB48WhohIgUfai3AsUg=,tag:wBoefzlDxIygHAWCHma9Rw==,type:str]
-  SECRET_MINIO_ENDPOINT: ENC[AES256_GCM,data:jtuEFj1PyTZtbjJZsu/ntBGAuOChSV/m,iv:mnJJX+5FswjiCeUeKLXIBBvov2ap3eEw5LxxSDeBjzM=,tag:jxHCCvve5NkvSYr1gVC5Rg==,type:str]
-  SECRET_MQTT_USERNAME: ENC[AES256_GCM,data:Sw3dg2LQgNWZ6wJN/A==,iv:PSjlmpDdMekx2PahJbcpOgeecE7/rJqufOeCSvItVjo=,tag:RUeWs45akbTHKlRAcHgI/A==,type:str]
-  SECRET_MQTT_PASSWORD: ENC[AES256_GCM,data:Q+jlj+0z4BymdWnwScQg5E6urg==,iv:uztQpYBn4vEuKS7+jFB/ZPq3itl7pwQn3tON4cz1E90=,tag:CISfAZBUgzUSvJPOm6G3GQ==,type:str]
-  SECRET_PGADMIN_EMAIL: ENC[AES256_GCM,data:QXuCKeIR095bH+GfdnhXAodyqYUBuQ==,iv:9j+xs+3CkOXRcFyt18eBppCFGxNRR14ykaF1SWpt630=,tag:8sFXWDBDZjm2fA7TR+ZD1A==,type:str]
-  SECRET_PGADMIN_PASSWORD: ENC[AES256_GCM,data:Q+ao1cE+2GchlPXP9hs=,iv:/OBeN33pKEezzsiGnTqJeYDTauubN+c273oOpkKoI5k=,tag:wamO0Vb8L278ZU3epHaSxg==,type:str]
-  SECRET_POSTGRESQL_KUBE_POSTGRES_PASSWORD: ENC[AES256_GCM,data:bJQ5Ik5RC0JswMZaBl1v0Q==,iv:0E8ItfxxfIhKcibqcGaO74BAfWnMDfFQa7UR1QF2ey4=,tag:745yCT5dmr8IU96VrsUMSQ==,type:str]
-  SECRET_RADARR_API_KEY: ENC[AES256_GCM,data:pY+65fypm3mA7t+1Dm35Bj7R1ik+yYSGExYJmK4SvX8=,iv:yM0Q6VsCVEOb+aWEhMpPNFj+YonSmYz8fmSflmUkRDY=,tag:CLFUgJ07CrF2CyiyqTz81Q==,type:str]
-  SECRET_RECIPES_DB_PASSWORD: ENC[AES256_GCM,data:S/SoWf0wegipdDcm3XLGtQ==,iv:21g9BWrZpw3+03v+Kz590YMo2Rs7UeY08E1S24pE41U=,tag:hjnAST868QlUk4mPf2yukw==,type:str]
-  SECRET_RECIPES_SECRET_KEY: ENC[AES256_GCM,data:rRsg9f4YZ6CXgpAfLa7zRQ==,iv:0cUrJ50dq5H3Z2RKH22731xPGmv0m4JL01O/kTiMaZE=,tag:/Xghvp5dAOmSgQ2C+oPxKQ==,type:str]
-  SECRET_SONARR_API_KEY: ENC[AES256_GCM,data:qt5a63BOsUNHbLW63dK1kSyx+vTcu1LW7QkaL1H7AT8=,iv:T/xW2fL/PMWGbb7vmM+3xzeCWkSfrhVlx/L8E6/m2GE=,tag:9+Peq4IRCpd3SvQ3trWGTw==,type:str]
-  SECRET_SHARRY_DB_PASSWORD: ENC[AES256_GCM,data:UWBPEdnARHbITLgbSXo=,iv:ZMi4gIxb0FEDmBzODGxvZqyDeqjOqZnJI888uFhRf64=,tag:S+P+DqnfAN2BrxqAXiY4NQ==,type:str]
-  SECRET_SHARRY_JDBC_URL: ENC[AES256_GCM,data:Z9vlzRj0cTi7TS9o+Y6qU1gAcCPpG9bs5wfsQSnesvY18PcCQvft7SYtMC9UJTBIUGUVbX0nyVr39qopTCiKQ31qrWY7,iv:KaHrAdwvTD2r+y7ZKj6uBb9kYtWRG6BCohCSqrHaDLc=,tag:ZqOk4hDb/iHiYG/In2Fjpw==,type:str]
-  SECRET_SEARX_MORTY_KEY: ENC[AES256_GCM,data:UgvCIYVHVufp7FKsT7J4d+s1wr+PrVZ7y5haw3WaRdGwCJxdkCEor2e99W8=,iv:EvryXyd3wkyy5d9lUcf6WnY7OP3LfxPfgy3C7ahWv94=,tag:Wkcrs3MsEnJbKJia8mV3dg==,type:str]
-  SECRET_SMTP_USERNAME: ENC[AES256_GCM,data:aq9pkTbnjOm/howevEEksUcHZ89fnJ8=,iv:pMnRHW9ovGVaGZT3ZdUum/Bma1DIIfhJKAUAOAoGOxA=,tag:fh5VBDiGaBWftaD6CEjb5w==,type:str]
-  SECRET_TRAEFIK_PILOT_TOKEN: ENC[AES256_GCM,data:iXgpUK3dNRNgUXdPqmMHRTlcaGEo8lXzEalDD96O5xFz5PWs,iv:Q4S1dDNsrCOD+UIpeVl+jkyKopN3Wc9Nv5913+SwDdk=,tag:0YNwNz/wqdy0cHhucVFx9g==,type:str]
-  SECRET_QBITTORRENT_PASSWORD: ENC[AES256_GCM,data:QYPZQAfyCfFZDJ5rOzwwWyOFzss=,iv:ae8mdLGW+4KxI4ucsee0XSHfkHmwTK/mbtjsYpNICeo=,tag:h4xs4eCtzn0jax1Xag67Bg==,type:str]
-  SECRET_VAULTWARDEN_ADMIN_TOKEN: ENC[AES256_GCM,data:vtwpb77LDqlbDs9MY3jhaIzvgZewXPnHzyoHWvUvHH7YehP/bcuDMIc8cyOKOoTFQvRr7ELzLUcdFwbnqS3QWg==,iv:IWY80COdm4yktD2YuyjE7GZNLbEqbXTstHO3RQQwgJk=,tag:RwKJke7H4vIghb0v15wAxw==,type:str]
-  SECRET_VAULTWARDEN_DB_URL: ENC[AES256_GCM,data:jRWid42P/76nXkuFQjyyzNTUTVSTCafEcnp+7k01/vlj3hayfO8C0SbF61bOB7/xZmECHrfCEFvstQvbtsw19Ae98T4ZuWOk6Zic7tFE/j61eBo+OPK0MVDth60CT5ggPmKvxw==,iv:Wo8QyxwvyWu3SmDWg287nw0NiVER7c6wyLQLcOW3I/4=,tag:Og6XASh6g420fgZIS9uFXQ==,type:str]
-  SECRET_VAULTWARDEN_SMTP_PASSWORD: ENC[AES256_GCM,data:+ZK3meS6bJBLFSNB+096bg==,iv:d83Anz4puv4lUq8mCGStCDEewykx8S/ILSxkWRVo4MA=,tag:EVB5E6fBf31DA7f2SKP5UA==,type:str]
-  SECRET_VIKUNJA_JWT_SECRET: ENC[AES256_GCM,data:Qsw6AJgvfR+xdONRCRpY+I+rRi4Oj5/tymcvP/azPB4=,iv:SdV3T+Uh4f2wWSnRDB3pBanoZj72w+QcyIlOeBXtgrI=,tag:EF5YPvKECAmyYg6n0Rfowg==,type:str]
-  SECRET_VIKUNJA_PASSWORD: ENC[AES256_GCM,data:XNorUQ5VdEKVFIjmvhx0+Q==,iv:YQkWGIsg+tl7EK8nPbrB8zTZAaQbnHCKntA8QL+KnAI=,tag:Srzfdi7RsWwWlXbKu7ej1Q==,type:str]
-  SECRET_WALLABAG_DB_PASSWORD: ENC[AES256_GCM,data:892LbnEKK9J/wRUIJrA=,iv:7DiYyUvnZhe59P34DRQp6K37AwEKL+FEdXdraZr+L5E=,tag:LdvR3QVzpodByqIZT44JIQ==,type:str]
-  SECRET_WIFI_SSID: ENC[AES256_GCM,data:UsZH/1PCVZIU/w==,iv:+yMq81aASCIqyL0fnGhs5IabccciyTpT+zWbmFRcrbo=,tag:shX3sb2J0bsVkZLSs4NhSg==,type:str]
-  SECRET_WIFI_PASSWORD: ENC[AES256_GCM,data:T954g4XWNR9izNk5dvK1vjcgdYTAAoK27HgX5Zp7,iv:DyI3OBb84SMK1yqX2PjfXqTEIaH/QqbuaHhzYTYMO3o=,tag:GkVuOi1x1yQQ/DfSlQCZAg==,type:str]
+    SECRET_AUTHELIA_JWT_SECRET: ENC[AES256_GCM,data:IRNpIz9qOWxV7i32T0r+VgxgNVsMtlif/8MbZg==,iv:+UBy68Um0zz47t6piig4UPzxMicS4jZo6El1N9dFxyQ=,tag:yroEqqBPWtwBcadBYu/qeA==,type:str]
+    SECRET_AUTHELIA_SESSION_SECRET: ENC[AES256_GCM,data:MM4QbvniS1beSDItP7Rl6RK1Q0AC3cXowhpRVw==,iv:JH6DjoxhP320I8bEz2EGIkZN5YnE2fBBQiNRT3QU0Io=,tag:3tSV5fPpNRq7B954Ekg3Fg==,type:str]
+    SECRET_AUTHELIA_POSTGRES_PASSWORD: ENC[AES256_GCM,data:DeTJa/46cXpttKHv7lc=,iv:wfPxrT40BXyLrXbtpCVIO3V6TwwNC0vkj5o4wBXHREY=,tag:L+JAdBCqo9iruPYcAaxNhw==,type:str]
+    SECRET_AUTHELIA_SMTP_EMAIL: ENC[AES256_GCM,data:LYao1jIoWnPwCi/y7E8jhre4fUS8mus=,iv:AXZ/U/mnUorXQL5ZjsGF2pG0raGt6qqGtZeR9gszqxc=,tag:HRphgEocLVwPIDhv9PDKrw==,type:str]
+    SECRET_AUTHELIA_SMTP_PASSWORD: ENC[AES256_GCM,data:ECMn+cb0Elsn9Lw0/p+rjw==,iv:HfWcFvxWS/f2AVC84E/A/KvnPnbB0pAK57DBqBC0jCA=,tag:wIPN3KHzkmo/pxLm5bH8Dg==,type:str]
+    SECRET_AUTHELIA_STORAGE_ENCRYPTION_KEY: ENC[AES256_GCM,data:3PUJHgD89PVubKeWIm+KKk93rnx6d9aRbiL44A==,iv:0kEXwZhiu4Qh746EX4UoxmNlser2UmKg6H1FBgeLO38=,tag:fMkNIl3Sl0vwd8R0Ni/O/Q==,type:str]
+    SECRET_AUTHELIA_USER_CLAUDE_EMAIL: ENC[AES256_GCM,data:knvCmfHMtArGS1ZTeCyLh+GEaJJ0PEk=,iv:1FTHTLAJSlW1n9i4gJnYqMPRiopZ0ij638ErX60Ga2w=,tag:hSfudgcTWz6bT1viYXIMiw==,type:str]
+    SECRET_AUTHELIA_USER_CLAUDE_PASSWORD: ENC[AES256_GCM,data:I+K7hNZYOE8SdQvJi7g4d366QFjR47zTyS51rMpeONOebSGUgTtrysZFPcfU/7uVu171e6xRoAslUmzoaeFW7zT1kzvXWtsoeL3Kg4VJ6JYsdixHSppWdcLRLg5YEqq/F9GH,iv:NaCxrccqDZIYnLIwAreWzdv7HrE2FCLPfzht+i1BiKU=,tag:1CuHY5iHvbQdvTrj5+GHrA==,type:str]
+    SECRET_AUTHELIA_USER_HELENE_EMAIL: ENC[AES256_GCM,data:b6jDhf1dpi4XoulAY+O+LHfFnr9BL8rt,iv:ChbfUAsZdUvigGZWJPA2a4AZQWcUBwjDsxzymqo9OXs=,tag:VD1ioYwssccDq9W2/MAFtQ==,type:str]
+    SECRET_AUTHELIA_USER_HELENE_PASSWORD: ENC[AES256_GCM,data:3SmXt0GnbzW+aXmWCTjoQqTG3cqR0LbuvBrvsHnmgWWJ7hoGeDLG7x6BKIGmFNT0j3DbH8gjagB9poNJ73Yf9tWOwcXzpeH+8DwwcXHBnPDYkANAdqriyaO2kbbmXPmHmuaC,iv:9TT19sJ2E5ZPS6fNBpYPQ9telzWmMC8Kfbzg0oT3ZJg=,tag:3PeB/+rOS3VbIHuLklv/jQ==,type:str]
+    SECRET_AUTHELIA_USER_VISITOR_EMAIL: ENC[AES256_GCM,data:1EajzA5v2NQwBoKeKeKDtVVMsJLoAA==,iv:22Kc2zNlT2PpER76tXyfXEvBQH/6mphzcmM2ruWoy4A=,tag:mtELIYv/Hyj3KkMI1qJLtA==,type:str]
+    SECRET_AUTHELIA_USER_VISITOR_PASSWORD: ENC[AES256_GCM,data:YI8Mxfb5Wk/ImcxveGeSPpnESuFgnOpk+swvR9hZDPtCgaYSrk02LCo/iORMrooSCnxeq4MYnBwVxkKlOSswHyOUDDwuLoa3rKcppsQmXNiiqVySjG/ML/Gypp7JKTXqAEgr,iv:jmNczKy9zjKAE++LaCnsXKl/4JdpaACuolEXThn4TnU=,tag:su2Ygx7hRFS6o3k1KETp4w==,type:str]
+    SECRET_AUTHENTIK_POSTGRES_PASSWORD: ENC[AES256_GCM,data:9/ZXctbcunUhMPBJ3M3iTA==,iv:/RXn9/4N2z9KojCERzQ6JtL5nhvcym1TWkdGid3iBfA=,tag:VJStvEbAI5cfsrC2gwjhww==,type:str]
+    SECRET_AUTHENTIK_REDIS_PASSWORD: ENC[AES256_GCM,data:GNI1JaJrtyBE1qnnBSctog==,iv:yCMxmBWwk4CF135uv0b6jrQEj838SQxHDh2sX/i8Rq0=,tag:hrt7054Kh1YdUT1QIyyZaw==,type:str]
+    SECRET_AUTHENTIK_SECRET_KEY: ENC[AES256_GCM,data:TGG++vu0/qfBxi+rHM4LJ2xWo3xyju3OI3G7+YrNINaX/QvHtzR9Gw==,iv:yDAqbXmYcJJNWRJh7zLzy4RHRK2d3oaH8kdi9k6vzLw=,tag:TzDCXMKRTXfCce0SrQDs2g==,type:str]
+    SECRET_AUTHENTIK_SMTP_PASSWORD: ENC[AES256_GCM,data:Nxs003UgKqBejYryUoAetA==,iv:kpXxW75YXTL1lv4m1loaVJ68etNeYk6ObqTVdbkm/oI=,tag:05zeNjIzvnAT+2aBEB4Gjw==,type:str]
+    SECRET_BOOKSTACK_DB_PASSWORD: ENC[AES256_GCM,data:CEj/jUiLg3g5LNNT7raqew==,iv:zlpPWBTAxRpuU9UTn/bLjT47DCs9NCZuG3jwemnfwZI=,tag:vlffnqv+O64uvaad4mV1wA==,type:str]
+    SECRET_BOOKSTACK_TOKEN_ID: ENC[AES256_GCM,data:lNyl5khaHCneLTlmsIu8uCH9lo8E1+RC5KC9CqU/4Rg=,iv:hH3tho0Xl4kivMRXLTTXtzZ/KfVw+lYqJIIBazUNodc=,tag:FhFr3Ul9Cz7SbY9DevI4mA==,type:str]
+    SECRET_BOOKSTACK_TOKEN_SECRET: ENC[AES256_GCM,data:XmY+0wvh90wiRjjIEk9HneHTuaYRDtUv912SuAywQ7U=,iv:i0hwrKeK509v9uzmHJbLL4tX7sj38pDm5BY3P+guRCE=,tag:/7TJeMCho2OghzixULidUQ==,type:str]
+    SECRET_BOTKUBE_DISCORD_BOTID: ENC[AES256_GCM,data:4woCPg5S4rwHdCU7q+e9MLC9,iv:Bc3kokQe+uN+j8VtjJhE8SlPxuac7WJncY+12olrzqM=,tag:BAO0425EGxqTqO3trthCUQ==,type:str]
+    SECRET_BOTKUBE_DISCORD_TOKEN: ENC[AES256_GCM,data:JNZ738Ovj0TChAFkBINHHbvyzZXHOUFF2DeILLjdLWVJq7gAzKUupUo6wCupsNtuE/bdIYZVMFCXRrg=,iv:cBY3hlVECPHp6WIYOHMe4ncIWkBdbzBbTS4t8inl+fc=,tag:wpspuFVh24KY+VPPzeewjw==,type:str]
+    SECRET_CLUSTER_CERTIFICATE_DEFAULT: ENC[AES256_GCM,data:Ua4abZ3ZQsS6GSjoCqAkgAwFrw==,iv:NAPG6q9qOh5riRUH/yqBMfr2VDR5exOLkK2WGHUdzqE=,tag:9ZEkwBpVx75fknr0pGH/Zw==,type:str]
+    SECRET_CLUSTER_DOMAIN_EMAIL: ENC[AES256_GCM,data:W3/pbznkUTkxRaUop1Us4pTsIm4T,iv:pZEyNpuk3b8Pb0vGopUsm1mAX3aBkuNHx0UL07oOTHg=,tag:9NOewIGINBbSpcz1EBW/mQ==,type:str]
+    SECRET_DOMAIN: ENC[AES256_GCM,data:9M5byFCsOzFQB14=,iv:GokP3xMIY/BPT8QodI+cQNP2Zur+SAeXjOVLG0vZeBc=,tag:uor4rgQuqvpSptFEWg8m+A==,type:str]
+    SECRET_CLUSTER_DOMAIN: ENC[AES256_GCM,data:xlV2sk0wkze7+NDh86IY,iv:8aThmdkgTZOecUf+e0zSMOIZwPNgF0KsNfGGwkjxNdk=,tag:MeTDseBmR99DYxFDEohs8w==,type:str]
+    SECRET_CLUSTER_OVH_APPLICATION_KEY: ENC[AES256_GCM,data:6VXp1M0x53jsLWig6ioVmQ==,iv:zN6Qk9Db+ZeNkZrk1suzNMVAjFW2xm0La1rzfyeu674=,tag:aKUcYlcCbv89S0e6UH50SA==,type:str]
+    SECRET_CLUSTER_OVH_APPLICATION_SECRET: ENC[AES256_GCM,data:1ZGI5ssc1XCQZq5IxlLLKzqoAoyC9sY9QV/U/qmKgKQ=,iv:tcOkDoCVGhZ53HDW8QUt/N2kSuD2hWkdPK0KzVfssvA=,tag:BDA54Rw4Ly9OnGDpR60lKQ==,type:str]
+    SECRET_CLUSTER_OVH_CONSUMER_KEY: ENC[AES256_GCM,data:5Fkq/AxrFtFi8HiXbwCpC9Ads3jdsN93wBCpDVwspiI=,iv:ovWbjFk2I8mLWoc9hSqahWqtFVGkXTH5kiaZFDK52WU=,tag:gx7Zp24uh5LYQhXTf6arQg==,type:str]
+    SECRET_DRONE_DATABASE_DATASOURCE: ENC[AES256_GCM,data:KCBLMehk3svbN5BCzBwmTfeWcqOGBygePFKsRxdmYZWI7r/y4e23ovPWLB9pvdoa6u+J+d70tIzztZTaoXGrH77wSrDNPP4sfoT2F8nvX8zii8rE7C3H1DD1PuLBEFp5wkwxEQ==,iv:RM1bYThU/Racm+70XlF23gty299XjoZ+sw+dxwznxCE=,tag:qFOAmz9aDWoMmT7XORbkFw==,type:str]
+    SECRET_DRONE_DATABASE_SECRET: ENC[AES256_GCM,data:VDnH071B37ZzmlO0mEODxzxKa1pR2LTSwewOgEJB1QU=,iv:aOYWZ1W4/rdKV8teIEzuqy5zC2X0QHYKWaC9DfY476Q=,tag:5gwbR0CNueIl2MxgiJthRA==,type:str]
+    SECRET_DRONE_GITEA_API_KEY: ENC[AES256_GCM,data:z84ZAjBleBqJcA4OS3KBRCOFr6TwdtsHuLTT8f6RiBcoi716Z9WOqA==,iv:uNTWutINP/UHIzczMMg2pH+YWJS3fRViTdWauV8V+J0=,tag:ThP0pov1tu/r0UZbyYJdVQ==,type:str]
+    SECRET_DRONE_GITEA_CLIENT_ID: ENC[AES256_GCM,data:8V2nExG6QQcS/8PlnttrNm4/FTznYOWFTZjJXQU9W0AchTwY,iv:z9+xSyZVVscHDpWzeaM7plQkVZHUJJ5/un9R9dS9040=,tag:KG3oSYx7e5iinSNLZSabSg==,type:str]
+    SECRET_DRONE_GITEA_CLIENT_SECRET: ENC[AES256_GCM,data:X0HhHVI8J/nlfYaWvf1P7TVINXatbr+FZiQqDjOven/yPZSItWAMQh/XqRo=,iv:DEMd/Rsa8k/t2RjiDZGdnZcmJaJO6E+nFfl0Js4JLz4=,tag:rSm8AO2LGKJuYa8ErGzTUQ==,type:str]
+    SECRET_DRONE_PLUGIN_TOKEN: ENC[AES256_GCM,data:mXzPAfViPQxWpH814F/nN66vlnLk35Cc33HY6g==,iv:XLNkQr1BuQz/yjq5v3m1x7bXAtHJ8x4dusVITydkAG0=,tag:gHp8ySAIKsR8iG50ocuViw==,type:str]
+    SECRET_DRONE_RPC_SECRET: ENC[AES256_GCM,data:ib22K+Z32Xq+wt4zTwCFiNywupQy+Ze/ncbY5UKxp0M=,iv:9q0ffcEcWZ3Mm2UiO1zFo3nlY4usBQZlDe5O3d25PSY=,tag:6eiak9+lLqoVo+Q0TeClsw==,type:str]
+    SECRET_DOCKER_REGISTRY_HTPASSWD: ENC[AES256_GCM,data:ipfXjv8fa76Abi3I+5CGehBGc260rqFDCNFl1qkTwUH6W6zAcdzUNMLCI0+3WoiqO4b+Fz9fS2auqo8wZsx0NuRscQU=,iv:zWLM0IVQzc8d8gqvkrRyzrtD+8JzSe3QIMtFsI8RRFc=,tag:xYeWhSWlhIoamMCZNfU4VQ==,type:str]
+    SECRET_EMQX_ADMIN_PASSWORD: ENC[AES256_GCM,data:CoccfeM49hs6Nv15zy01iy5v7c6JPR+5,iv:iuRCUGANQJBOq2sZ/RWwbmT8WX4Y1TyXFDjORTWdmjY=,tag:i2WsMlnCjavk8vPN0fPjAg==,type:str]
+    SECRET_GITEA_ADMIN_EMAIL: ENC[AES256_GCM,data:EfkmLcBIZ0YBPDPbXTW/qtMKGNOy,iv:MTEas5mr4oi2hqkVnlxFP8VdYhvccogrgIXaVkyfLkU=,tag:/0vv4YjD6LUCAQw8FZFYOA==,type:str]
+    SECRET_GITEA_ADMIN_PASSWORD: ENC[AES256_GCM,data:X9SOGUxTFbOFxJiXmQY=,iv:QtzX8IjJ1QicGFwem5wp6plzE1Cs7t/3ggaaAu99UlM=,tag:lwmWJ8CC7Yt/slrs39D6Rg==,type:str]
+    SECRET_GITEA_API_TOKEN: ENC[AES256_GCM,data:G40oKgSVS0fo/PMzstQkDxX2PQNF+2pMWtcAxjkeYfPk8vSdP7Ku8g==,iv:LbzoKrN9D29D38q4FQ0rer+Y4Y4zZls4NCad8zQCXec=,tag:4SnX95QMCjL/kKsxubR/gA==,type:str]
+    SECRET_GITEA_DB_PASSWORD: ENC[AES256_GCM,data:oATkleJl4rrQS9rKuVk=,iv:OLp2TZ6RxGZLQm6sr0I7W1HJZeQ7MDrFVD2QKBIwUzs=,tag:3Qp9HkeHeepgOYXJxRNfrg==,type:str]
+    SECRET_HASS_DB_URL: ENC[AES256_GCM,data:8nvkhm+kgmbFCywZuSwqA1aC8dxgGr2n81aWLpjoJZRAm/wpaIwDN7HN0hdadOBZgX3oXlJatAldOKUw1CARzEky4YiTxJintJn1xXuTAQ==,iv:z5CEjBwufaT1uEph+aRvtn4mbMXfb+sTYfQ3TEcXw3Y=,tag:GmHUFg0/V6E2vhARayN5FA==,type:str]
+    SECRET_HASS_LATITUDE: ENC[AES256_GCM,data:W/Kn0QcRwKYYkt6/4SGKsSg=,iv:uuWzxB9UW/AIgH72pLVRwzSZwfJl1Pr4K/PlaYNnOcI=,tag:KtOgs9eC4FkjNSYtYybPsg==,type:str]
+    SECRET_HASS_LONGITUDE: ENC[AES256_GCM,data:lZHZvVNNqnincmkvxElCxhA=,iv:aSqGTbBk7+YV1frdFtD/nn4/xOg5C8vKxMAA7wRFMrM=,tag:qFhf9NeTs7AAnUd3Q4f5Vw==,type:str]
+    SECRET_HASS_ELEVATION: ENC[AES256_GCM,data:03A=,iv:KtdCMY4y82ZoYn3p5ds3Hoq2zVFNG9ERR1T9sX2tkTc=,tag:i3QwgfuTq1U9bZ6HaFrh7Q==,type:str]
+    SECRET_HEALTHCHECKS_DB_PASSWORD: ENC[AES256_GCM,data:kRiziJ853r7YZ7co0NXOsw==,iv:q0MCuMF3i7kL39G3u9cw/5vnHzpklocvWjf2nYmeapA=,tag:g3BsNNn+/+pzxGX3uLg14Q==,type:str]
+    SECRET_HEALTHECKS_SECRET_KEY: ENC[AES256_GCM,data:IERjUdOmfziEqoESdGId0yT2T5lM8vASoHbL2/0GZb4=,iv:CdSEQ/Pu6+krUGgnUEdxWGIBI0I5eOJ/pVxvzsL2OgM=,tag:GcnDruROjh/hEggpDImxCg==,type:str]
+    SECRET_HEALTHCHECKS_SUPERUSER_EMAIL: ENC[AES256_GCM,data:UAamQEzS1+6yn6K2xwnjUyGP7NLP31hKdddr,iv:ZTTpSu3EOcotzmi9H3XiGXYArj7te3ERnTsAscJCgTQ=,tag:TsJ22PVMsqPpVHzQnr/RvA==,type:str]
+    SECRET_HEALTHCHECKS_SUPERUSER_PASSWORD: ENC[AES256_GCM,data:egMJZ5iCJlpW617jsM0EOw==,iv:zFnYKuBGZ4U13C3Yy1xX6CxVS0x/gGTK09fQEsqaQZ8=,tag:S1xtjn2v1gfp3ct/p08PUg==,type:str]
+    SECRET_HEALTHCHECKS_DISCORD_CLIENT_ID: ENC[AES256_GCM,data:1fhciaZJhq682NZqrfuObpV+,iv:yPgFQ61z1Zz6aEwXgscuIMTrdKmvuP+iutp+Dc0+igg=,tag:+Wl1N8byzGX/x5wWETMlIQ==,type:str]
+    SECRET_HEALTHCHECKS_DISCORD_CLIENT_SECRET: ENC[AES256_GCM,data:X7eswfQYVyonbgIvZ2XnYv0CnujbSe2jG/jTZQ6zNCU=,iv:WcjBJYr1t44t0yvlxwKWkQVjiinOPKg/orSBwbg25HI=,tag:DuFNUyxqFRGYNP5Wq+zWSw==,type:str]
+    SECRET_JOPLIN_DB_PASSWORD: ENC[AES256_GCM,data:zgvbYH0CmePLVFnQMqABtg==,iv:k3vPge3zvXoCt5z3Y1MD7iPOR3y4lAcnDkiZWARAqXk=,tag:ewkvuh2sFevrLAlctT6b3w==,type:str]
+    SECRET_KUBE_PROMETHEUS_STACK_ALERTMANAGER_PUSHOVER_USER_KEY: ENC[AES256_GCM,data:vJWgnfPIYfFGma6LDq1hZEMRkB0DPBFQsQqmqU2f,iv:PeFdeHcA0bB5SPkZXH83GxDoWuGSsb7GPfC6/Mq7m1U=,tag:ChRciuJoS+YFSQvV+rT0Yg==,type:str]
+    SECRET_KUBE_PROMETHEUS_STACK_ALERTMANAGER_PUSHOVER_TOKEN: ENC[AES256_GCM,data:bjWq7HVvqLzSsbMLGUQEPr3T2+HkCDlS8vt+JZC5,iv:OR5CViMlWocHwq9ThWdJ+2kz/Acp0DNxdQHfQIlI+YQ=,tag:dyj51h4h8y6r1RrVzmAXAA==,type:str]
+    SECRET_KUBE_PROMETHEUS_STACK_GRAFANA_ADMIN_PASSWORD: ENC[AES256_GCM,data:vnDx2uLz/XaVvY0/eCs=,iv:9hySKMeLLLJd+1DOu4Q7Es1ntuuFhq0p6NklhMD/zM0=,tag:Ga6FBwzyDZ1a8nB1b/r6/A==,type:str]
+    SECRET_LYCHEE_DB_PASSWORD: ENC[AES256_GCM,data:SI29hE4SW3dlgnZEK9Y=,iv:+n5Ug0CRMjyhIQJtKOPI+PNGtoU7ynhpBvQ5Fm1BFAE=,tag:oJzkv3RTHF68ro46MpyQXQ==,type:str]
+    SECRET_MARIADB_ROOT_PASSWORD: ENC[AES256_GCM,data:gZoU/cVniyGP1Ji2bz6Dug==,iv:8iR2XK7EynCD3XPnjBI2bVaAH1h45T14wTcyDoW3O7s=,tag:quqbVYQN6piN7P9c4TBSZA==,type:str]
+    SECRET_MINIO_ACCESS_KEY: ENC[AES256_GCM,data:kIcERZk=,iv:9dDdNkPPE67XZpH7PIPE+zv0+d4xAx+QIHVMz/+FUU0=,tag:JVe+e4yxPq94nixXyZKlAg==,type:str]
+    SECRET_MINIO_SECRET_KEY: ENC[AES256_GCM,data:Df71Ne55eXRML+VWQ6LqKCjqhrQ=,iv:UWxbdhn0uLizu60ZGW1CLdKOp1EAazb5CqzTEh/aJ2I=,tag:h9UwPn+E3wm6jD85VsBntw==,type:str]
+    SECRET_MINIO_ENDPOINT: ENC[AES256_GCM,data:WRswUk2JeeFDP/aOlhNL/TW6pSDmq9jV,iv:Uo5dg7g0ce5dNaO3UG8ccFY0R0iyyRCpPTljdK6qqfA=,tag:rU1uHl6SW51Na++xPoBvhQ==,type:str]
+    SECRET_MQTT_USERNAME: ENC[AES256_GCM,data:wsKupqXH0xbTqzJIHA==,iv:kMr1pKC6HG8KISWZQEe8uRxBW7X60xuP3jgC78Sz2fM=,tag:FPuK5RR7fFl+gr8kB4R8xw==,type:str]
+    SECRET_MQTT_PASSWORD: ENC[AES256_GCM,data:iVaxnjF1RabeL5RzByEH8Ztvpg==,iv:EdyNxkYPLr+4ogwv7sBXtL3YbPjDgoPXp3FEQxWkV4M=,tag:b/Db4UW467axmX8/5uCOog==,type:str]
+    SECRET_PGADMIN_EMAIL: ENC[AES256_GCM,data:Tp8VhRGZ0/tfsu2RBlqklyzvt4ATZA==,iv:9vi668hhS0A3h+60SdNmLTUoexeHhPz97rNWLVxWcLw=,tag:yipydPqzTZxEhvY/LCNPew==,type:str]
+    SECRET_PGADMIN_PASSWORD: ENC[AES256_GCM,data:jFMRgQIC+R1vN4uIcKE=,iv:faPyXdZRTr0vuIB9LILdqTZawUpgMRHl3AlDK3RJlps=,tag:QQBgzJJTjBpnyD4y5ipI4A==,type:str]
+    SECRET_POSTGRESQL_KUBE_POSTGRES_PASSWORD: ENC[AES256_GCM,data:IlAGwP1TNkfiC/6+jdojnA==,iv:AiEPhwVp2g7JnDE8R6fyY62E00rqPjPMvodidMYLeLc=,tag:TESmmZ/IBpYPXPE8PyTJzQ==,type:str]
+    SECRET_RADARR_API_KEY: ENC[AES256_GCM,data:ke9IW5tjkSBPP1w/2VUeA2xOqYmU2/2NNkQo6OV6ZU0=,iv:5A87FM/sxEwES1KsHXasoMKsi1mt2wSgsCdJOyUVE98=,tag:0U3Nz3n3NiBMVITT0x6AMg==,type:str]
+    SECRET_RECIPES_DB_PASSWORD: ENC[AES256_GCM,data:dCqbXuQ9eL+c4PMFais6BA==,iv:HRDICY2HkZnT65N2OD/hfRukuaMZnUd7IgGzaJq/XiE=,tag:0iKix84KpHjJViP42/cZxQ==,type:str]
+    SECRET_RECIPES_SECRET_KEY: ENC[AES256_GCM,data:MSqPt+NPoc2YZiE/GO0ncA==,iv:+ZfEwsMyMKVSHcTl6a0i5CoWPkziiyUH2IN54SLO6F0=,tag:qp/PxUqd7eNfJv3E02KPZg==,type:str]
+    SECRET_REDIS_PASSWORD: ENC[AES256_GCM,data:HViUVrhLduBPMhsQRA2Xfoqx,iv:2GHGkXZFANSwC0YvANg+kLN0VPKa7dkrhqy1l2sE64w=,tag:XMHRzagfX6cCZ2PlN4tXVA==,type:str]
+    SECRET_SONARR_API_KEY: ENC[AES256_GCM,data:0mdfD4rVN0wxVL4+txN3QomQjo+nXMDi+2j6JHD2vWI=,iv:30k02poZUPjb8fS6hZT7XbVaAiljRV3+Cy6xl0BOop4=,tag:ltMzWaTh5jm5YorrUm/Ddw==,type:str]
+    SECRET_SHARRY_DB_PASSWORD: ENC[AES256_GCM,data:piI9+upBIus5r4EbJic=,iv:6a3zzz9himWbd/MwYY8R0YwJ7Ta2C2dkWE78qWPAXME=,tag:m2zuqFGMVaVMZHFX4f4jcw==,type:str]
+    SECRET_SHARRY_JDBC_URL: ENC[AES256_GCM,data:Nbas/agL7znOjIczTaQnk/iZ9zkXqN0NldFUEDdDHVGet6JcBFDVPrPD7OAazYSgfjgkdx3RyJQmFfmDRynDMlKxjzF1,iv:CfmSIYlNogZKeL6LVLEfUR31uX/aMqt9aTqgDpN57aI=,tag:4nTDugV7ziHPsYr9hRvxAA==,type:str]
+    SECRET_SEARX_MORTY_KEY: ENC[AES256_GCM,data:DIP8iXJ9gDnNnVCyx2GdA4zuU7JG5LU8LIwPAIQvAH9n1f0NDpsSDTuA4Bw=,iv:BYwDABwS22yUTBMDejISZJTmX9wb7X+FkPIE9raBNeU=,tag:7E1cyZ1MNIRJEs8OtElpSw==,type:str]
+    SECRET_SMTP_USERNAME: ENC[AES256_GCM,data:flczPcQ8IEYosnbQe1wR/cm/7jDKssY=,iv:iD4muFyoffq7wzWpag6lGG4nlGOsJgXt+nyqoqVL4r4=,tag:sZWAGv9AQ/tc2c+DIlA1rQ==,type:str]
+    SECRET_TRAEFIK_PILOT_TOKEN: ENC[AES256_GCM,data:RuxCpr1dvGXU1sX+8Xor6EeUBS4BYrLh/AQAGZ3UIBqun6AO,iv:vRxUyDXh6yMGqSwAZfgw1vTLX8pRCXs3n+keQL6D8ao=,tag:opzWeDXhYPqXKQSc8/uLKQ==,type:str]
+    SECRET_QBITTORRENT_PASSWORD: ENC[AES256_GCM,data:dQ4QEfdKBRM+kclIJ+T1EtfZ+Uc=,iv:2D3sBtcTkpWKfqHLqr1cBKgtbE6PtYPD0W7B+Gs5CWw=,tag:GvF38MMJg62Yo+JwE+HUaw==,type:str]
+    SECRET_VAULTWARDEN_ADMIN_TOKEN: ENC[AES256_GCM,data:csXCShLIfaRowze0GtmnPK76SQqfT6t6QXOETnsgTLwVmDTPKGaFicBljJ5Obrp1c9dPuu2IN6hxTBLXqU4I7g==,iv:hVFb/lA2y8eumF47jiy8kcl7PP0UsTSiLl9gQSOLvSE=,tag:Jfqw/L5i2UsJdR5bL0H/og==,type:str]
+    SECRET_VAULTWARDEN_DB_URL: ENC[AES256_GCM,data:atRgQHllhb2wJ+bKCoFbOT2B5cnFGNiKSYIpbiHO1TRDky4NAC3h3rK58l6rCTZ3b1J6Xv8QrLiYTXAGoTexQ7ja/iYNC3a/KXyzQqbDvR0a8tHnBmO8pJ2pIOgkArgScoVT0Q==,iv:IJ/KwlAdPUx/bDN7bVO2VQFU2Yie6ckg58PxN8zDkVQ=,tag:vS66IlKeznrR4fgCB1lyRw==,type:str]
+    SECRET_VAULTWARDEN_SMTP_PASSWORD: ENC[AES256_GCM,data:4l8WhoZo9Zn1lnoWW2oALA==,iv:Io+sJA91w/PtWKHCisnXdNVEWXg5WkuoMNcp4WccZow=,tag:iev1fCJq/OL9HgWb8tCLAQ==,type:str]
+    SECRET_VIKUNJA_JWT_SECRET: ENC[AES256_GCM,data:XXtNqaCWjpuUfWiZFEIocbEEUwOCDNwWy7c1HLo5p04=,iv:hTFnC3uz00dladVmVwX8YqhKe8LUvQg7v9SwQOhmNgw=,tag:08PMO0Ejd/d7yu1sJp64Jg==,type:str]
+    SECRET_VIKUNJA_PASSWORD: ENC[AES256_GCM,data:7Bg5hWqK7W8XlyGqS+4g9w==,iv:RLeLoBBERSonWQSJ/MDV/58sdEXjtVRZaa29ourO7kI=,tag:1g+vOEWArjQ1coVlAPHR+w==,type:str]
+    SECRET_WALLABAG_DB_PASSWORD: ENC[AES256_GCM,data:Cwa+LyNjnP/yuuARAL4=,iv:WQdBlr7MA6KE10Dy78lnAt3NFcY3XlDP6b+0UiairUs=,tag:HQntjvMsSSq+b4WC06d0+g==,type:str]
+    SECRET_WIFI_SSID: ENC[AES256_GCM,data:9DPsutvd3YmEtg==,iv:nU7Of0dl3tjwBp8fC6sTGTk1KspO7y7Az/FcWavModE=,tag:BwmIhl6nAegkA8GBzB7HkQ==,type:str]
+    SECRET_WIFI_PASSWORD: ENC[AES256_GCM,data:XckytMALPIRMM5RgimceioS5bKRhWR70o8ibK5ZE,iv:Mna1uNac0uhg/kZRHEbi6ggVXMS3rnLfv1YrxENfHRU=,tag:K8AqFcEXsw0Q2l/4E6HZzQ==,type:str]
 sops:
-  kms: []
-  gcp_kms: []
-  azure_kv: []
-  hc_vault: []
-  age: []
-  lastmodified: "2022-07-02T09:44:55Z"
-  mac: ENC[AES256_GCM,data:PxOorU5FaSsHafj0L3BIura4bW+ReJ9ixUicdX91RtsUnPqL6OpzVX2Ju777OF+SqCF6aaFC/JbzpYl9KsxGk2ljauuAAS7JJkg/ZyeuFdPnyy47uIHJ1G6+X7PXIW/F6LcV3lIZ2xv3/ijGLG4DV1x2rtIqTxOZMeo0KrO55JA=,iv:HMR47vinLyvhcstKP5H8KKwTwYUuyVaBNjh73CJDJKY=,tag:5YmIlVU3zmi7etphvpcMbw==,type:str]
-  pgp:
-    - created_at: "2021-07-17T21:14:34Z"
-      enc: |
-        -----BEGIN PGP MESSAGE-----
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age: []
+    lastmodified: "2022-07-03T09:39:32Z"
+    mac: ENC[AES256_GCM,data:PI4BF33mdUILTgc63gAJC88SJpooh6N9bsFKeI0vn0oePon7H6/02JNtC5JPI3DrjcWatIovyGgcptE0Os++LZdimlr8fDcmEFv/j8uE0IHAx8GrmNTuRaLHAu5EN6hbZpsx6YN7Yx+10VNyLDzvrFvbU9n3E6ykHjhVeo2k5Hc=,iv:F4hqraL8ZXr/e+9MvC9bm2WNr8M95Z+4NkZCpnahXoY=,tag:iWuoLSxn4LIWR/Qm6jEYrg==,type:str]
+    pgp:
+        - created_at: "2022-07-03T09:37:47Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----

-        hQIMA6nQR2zACjUjARAAmv6cJ2mfjThwCexy23kws2XqruuW9g6ng3CNMXGA5YcO
-        GNFQIdEO7Ztan0waKHVb53Hap/yzJidDBGqSWwqdMNWMfrx0k/tGeYerv1Tsk1dl
-        cNGL7PjAlQUWsTnwKFOk8N1Nsj4sHwJdefwY9pDOscKCTJC6t22DctHV3ao+cXAk
-        T9dgpJW2iEYkd8vd2Dn5PlcOz7iIzttvAG4sG4LhRKkf7kMuHy9IP4WtZN3MYGtn
-        yKe6lb1U6dOfaueDc2yYa4IixEZrGwHprf+Elb6aFeJbM/IdtcmKMV0HFp/m08B+
-        mdaskuQdmRS1uZG4UdvjECXXn8rok0PxJT1zuy0XpVKKrEd9B+kbQpf38+12qyjB
-        BwQDNL3fsF1dxANgF2bbyMtEMUIBL4LVFs7xg/TJg/RooCffcHfitveeWIFcZr1w
-        Ita7fKjuj+f6bW5NURpqKuCE7eSbfZmYEHYYl8ReRfiQye6xUT08xl+7EWpzmfae
-        YTtn9nWBGl5AXKJ2TBHKCfgreq9QppLxdCpwjv2S+jYvRVoYGpAVTCyq1NBU1vqt
-        PzuAV6/+HtgoDEt5uYMpMA2wad3dihTN1m+go5tJSaRFDq/dVNCS/gXghV77sMvM
-        vWOrN5RFFHtU54wypvk9+Wp805nv5i52BhfxXnjJBaFZmU5WfO98m6gpTuGWgvDS
-        XAEA3GpIb+FC7mkwXhhx7+/LMO5mRHeVvZIld8z0Jx3kFMniKxFir75/xaZCFc4G
-        LAYebEta/6/ZS3/suIAYAZ3hwNhDyJcu31pnyzJzYZ7rRj2QnSddOQytLltV
-        =EYie
-        -----END PGP MESSAGE-----
-      fp: 19B850FBA7685A526CF11E5F9BBE834259976EE8
-    - created_at: "2021-07-17T21:14:34Z"
-      enc: |
-        -----BEGIN PGP MESSAGE-----
+            hQIMAwAAAAAAAAAAAQ//QdCXBvyKQTSl31+zXmw+Aje45IRsAT1asq8NniQYJ8c1
+            HvC7C+goELIXFjNXWLcANAXGTkdPGM2z3PeuS7R1pIF3tSii/wgLHq4qbPkfcMNp
+            lfzOquOVAlH2zFM+3U/4jdQMk49KoyUKByJlqieur7+bq13M7pV1Wxqgekve5AGq
+            rWqD/4g9AvOBLEG0H871gdlkfsPHBzozv+YqNQTJKJLg91DdM9/+j0cTfzccdt19
+            kpK7MhjwbCstqEliH6UEg9uM3AHFpYcP9aRpfFdhvjfQHjgUVCLi6JktNkHhGeXP
+            y/ulHkouep8p4HpYzogVu4aprq01FZQtwrm8P47aJA3VtxFG9G9s23HsNaWip8pC
+            i6YScWN6EVGCo+RKvCeTZiXmShafzSVpTyY3HryCQrZe/ULWXzxkKQyRIy5lykuQ
+            iwrlei2myZshU+9U0jPKWJgClvUIlOvImHA5MJ58iwhYI6FnsW5QLhuG15S6JUAU
+            5nXaAhbVPGaXeGiWvMm1/TqaRms1jnGTkodXwf72Y5Gbi42sUjhwBu1ityrsrhKU
+            N9Yom1Mq7kJowLYM+RgtSltW3VVJcigERSbdcaXo4aw9HiEnb2REuh7nBvcfnKSL
+            yQdVD49o0Un2vHG30mTEI5VNdzw5SgnqANN0rk4RuB+Vgp2TZmGlBUWSVzMksAbS
+            XgHUncJPJlAod9WIt8b2Aou0hes73ojKjCMHolNbeT9/D8GWftPsxlATjVitq0Z9
+            lMfZnCZWd8xMNVihU/5M8dEAMaAsRob4CN9gSEgXkxnDHRnRJMean7CGUpFRXoU=
+            =ULhR
+            -----END PGP MESSAGE-----
+          fp: 19B850FBA7685A526CF11E5F9BBE834259976EE8
+        - created_at: "2022-07-03T09:37:47Z"
+          enc: |
+            -----BEGIN PGP MESSAGE-----

-        hQIMA98IrODHuiZ9AQ/+M5ZHATHXshQ8zr7hxTypwC4Ny2lAg+nFfgoW7ZmqRQID
-        HymySfDmJAcnDzR90m6SrLI5K+2hMmr1Jwrj+hyEvNGg8AfM8wzsX0LbJhWD0vzd
-        M4J/V3wDRg9Dpz8yZiWjenNNiKUlLZEr/4oUJx+H9jUgF34KHNv3wAMYIWRq2FK7
-        uID9y6jYAN4f2+p5CpdHSI698htYFVckimi9dUcmxIpEwRs3s74yovOUSM0SM1Ga
-        OwYK0tdaQrmovecaWb2jnKlrPlihvEPSWWKHXlnE1icbkad3ksD/U7dZrcp1noHQ
-        /DwfuYlIB28WNTIkmINQkMk7CkEEmLFQm/KxSMsVbkg1o0B7gR9OctE8CvXNRt2H
-        rsfeBmz1wJayRjRbGJJz5ymIOh0j1O4YzfoGSe4vm1Eh70VTakMZ5QICMmkJBg8a
-        K2Zy4Io3uxyaAReXO+3P1kvu9WvYVCmaFGtm1GeHPRC/bgjlOwCaTW9aSCGd+6f5
-        lwGUVReAs/yHyI2n6+3ut/h9HJxEQuZi3HI/1KrMeAXvCKia9yKXGzfs0SaNyg3w
-        J7aPH/riIXROeA2OJaVZthpqxfcfYQ8Zq8XL5dlOlfZ7Fngi+QecGBSdvyRJLolk
-        OTGPPlI3ghuJwM5Ng/lGNgsm/S4U3ity3tyGdE+dyvCf26SGuI66/6N2cGmN9qTS
-        XAFfr084F6esvsRVKiyhpnBdOERWHO/PGE5VttU0C5mNhuCzolABIFHWvjxADQXQ
-        6qVDFPNDGhWIFwGZOIRcD0xNdtA2lOMRHnd7GEefT9SBXo80eNc815tYbZB5
-        =MZia
-        -----END PGP MESSAGE-----
-      fp: 5749D0AE39445C1CCA6006DF8913091C690BDD69
-  encrypted_regex: ^(data|stringData)$
-  version: 3.7.3
+            hQIMAwAAAAAAAAAAARAAv5+IDdea1uxhMBRfqRWNNAvaqMWbuxvbzT7GjVDsi8Bx
+            1Rjsu0c8N6BqotZcDxQokxX3hXlyidYCOACffvxSe1BGF/UGNdBJqizzKGFptuQB
+            K912KN79fUviybkhbGqPIzCeD1QJ3L5af9vJn64XmL9ei92uBk7tSAX4JpgvaqfS
+            Le6sIN0l0YAwIN6rCexrhD9xsmuqjQ/r2Wtbg67HJzoVM4Ab9n88uJt5F+QEdRQD
+            Q/giO8M0+G5LmYTf8j4llSD2+x0DfmTqVeHFtMgRihUVrbBVPb99LpSjcVZAMeDG
+            1Y4AdMuD3zUXHlWNKTHU5TOcg2tW4FJyPuDK1YxWA0PmWD8XAxqul44IVItBEv0b
+            jg5ivJ13FrJHJMHDZraIhuFVSmem9Jvuwq5Jq4gw1tLHp/pm6PURWL9ulsyb/wnf
+            2tfXmb4/yZrPSgNAheK3HDNzLanLvB8fJQESfWbniHURPcl0AWE08GIAen46Iu7f
+            vk+0iR6r1Fq+KKNlQwayOjRY4dHpBCXztNFvi5OMU0ZWsr1zIEKNOLzJmzpQitAk
+            aUELnnzdytG2Nx0rT3rJBggNZlSKMdtv1CUWypAyjr3eZkiuZG3g35wOwsentVDG
+            L5ulYe3kCZ+Iey/kHYj7yt0esaiC1qJZccKzrFRKAYhE+bSuiVykPwq1d1JRF7rS
+            XgESbxZvJOe0SpKX4etiFiamzJyDXzM5shKSyZvvCpjfy2vYjesbCbqj1imoo9M4
+            ebKt+Mjts8sWEmJq1VxN36sONDqMACYMhKQyTuLWQtP7cXWQO44RzyUZ+t/4JcU=
+            =2OuL
+            -----END PGP MESSAGE-----
+          fp: 5749D0AE39445C1CCA6006DF8913091C690BDD69
+    encrypted_regex: ^(data|stringData)$
+    version: 3.7.3
--- a/cluster/configuration/settings/cluster-settings.yaml
+++ b/cluster/configuration/settings/cluster-settings.yaml
@@ -20,7 +20,7 @@ data:
  LOCAL_LAN_OPNSENSE: 192.168.8.1
  LOCAL_LAN_TRUENAS: 192.168.9.10
  LOCAL_LAN_TRUENAS_REMOTE: 10.10.0.2
-  LOCAL_LAN_BORGBACKUP: 192.168.9.20
+  LOCAL_LAN_COREELEC: 192.168.9.60
  LOCAL_LAN_K3SSERVER: 192.168.9.100
  LOCAL_LAN_K3SWORKER1: 192.168.9.105
  LOCAL_LAN_K3SWORKER2: 192.168.9.106
--- a/cluster/core/cert-manager/cert-manager-webhook-ovh-helm-release.yaml
+++ b/cluster/core/cert-manager/cert-manager-webhook-ovh-helm-release.yaml
@@ -17,4 +17,4 @@ spec:
        namespace: flux-system
      interval: 1440m
  values:
-    groupName: "${SECRET_CLUSTER_DOMAIN_ROOT}"
+    groupName: "${SECRET_DOMAIN}"
--- a/cluster/core/cert-manager/letsencrypt-production.yaml
+++ b/cluster/core/cert-manager/letsencrypt-production.yaml
@@ -12,7 +12,7 @@ spec:
    solvers:
      - dns01:
          webhook:
-            groupName: "${SECRET_CLUSTER_DOMAIN_ROOT}"
+            groupName: "${SECRET_DOMAIN}"
            solverName: ovh
            config:
              endpoint: ovh-eu
--- a/cluster/core/cert-manager/letsencrypt-staging.yaml
+++ b/cluster/core/cert-manager/letsencrypt-staging.yaml
@@ -12,7 +12,7 @@ spec:
    solvers:
      - dns01:
          webhook:
-            groupName: "${SECRET_CLUSTER_DOMAIN_ROOT}"
+            groupName: "${SECRET_DOMAIN}"
            solverName: ovh
            config:
              endpoint: ovh-eu