⬆️ Update ghcr.io/crutonjohn/lidarr-plugins ( 2.14.1.4735 → 2.14.2.4768 )

| datasource | package                           | from        | to          |
| ---------- | --------------------------------- | ----------- | ----------- |
| docker     | ghcr.io/crutonjohn/lidarr-plugins | 2.14.1.4735 | 2.14.2.4768 |

.archive/.taskfiles/bootstrap/Taskfile.yaml

@@ -0,0 +1,16 @@
+---
+# yaml-language-server: $schema=https://taskfile.dev/schema.json
+version: '3'
+
+vars:
+  BOOTSTRAP_SCRIPT: '{{.SCRIPTS_DIR}}/bootstrap-talos.sh'
+
+tasks:
+
+  default:
+    desc: Bootstrap Talos and Kubernetes cluster
+    cmd: bash {{.BOOTSTRAP_SCRIPT}}
+    preconditions:
+      - find --version | grep -q GNU
+      - test -f {{.BOOTSTRAP_SCRIPT}}
+      - which gum helm helmfile kubectl op talosctl yq

.archive/.taskfiles/volsync/Taskfile.yaml

@@ -157,7 +157,7 @@ tasks:
   .suspend:
     internal: true
     cmds:
-      - flux -n flux-system suspend kustomization {{.app}}
+      - flux -n {{.ns}} suspend kustomization {{.app}}
       - flux -n {{.ns}} suspend helmrelease {{.app}}
       - kubectl -n {{.ns}} scale {{.controller}} --replicas 0
       - kubectl -n {{.ns}} wait pod --for delete --selector="app.kubernetes.io/name={{.app}}" --timeout=2m
@@ -189,5 +189,5 @@ tasks:
     internal: true
     cmds:
       - flux -n {{.ns}} resume helmrelease {{.app}}
-      - flux -n flux-system resume kustomization {{.app}}
+      - flux -n {{.ns}} resume kustomization {{.app}}
     env: *env

.archive/kubernetes/actions-runner-controller/runners/helmrelease.yaml

@@ -48,7 +48,7 @@ spec:
       spec:
         containers:
           - name: runner
-            image: ghcr.io/actions/actions-runner:2.323.0@sha256:831a2607a2618e4b79d9323b4c72330f3861768a061c2b92a845e9d214d80e5b
+            image: ghcr.io/actions/actions-runner:2.325.0@sha256:deb54a88ead0a86beedec6ac949e8b28f77478835b9c6434ccc237390a6e3e4f
             command: ["/home/runner/run.sh"]
     controllerServiceAccount:
       name: actions-runner-controller-gha-rs-controller

.archive/kubernetes/calibre/app/helmrelease.yaml

@@ -9,7 +9,6 @@ spec:
   chartRef:
     kind: OCIRepository
     name: app-template
-    namespace: flux-system
   install:
     remediation:
       retries: 3
@@ -25,7 +24,7 @@ spec:
           app:
             image:
               repository: ghcr.io/linuxserver/calibre
-              tag: version-v8.3.0@sha256:e37f35451c6f8ab2cec48c38dd332e86f6abf0935b1c720854eac7498b39cb69
+              tag: version-v8.8.0@sha256:4ab09dbeaa4d658289c7e7edf61c1f9224a316df48d38be7f8c70d0745082930
             env:
               TZ: "${TIMEZONE}"
               PUID: "1026"
@@ -52,7 +51,6 @@ spec:
           nginx.ingress.kubernetes.io/auth-signin: https://auth.${SECRET_EXTERNAL_DOMAIN}?rm=$request_method
           nginx.ingress.kubernetes.io/auth-response-headers: Remote-User,Remote-Name,Remote-Groups,Remote-Email
           nginx.ingress.kubernetes.io/auth-snippet: proxy_set_header X-Forwarded-Method $request_method;
-          hajimari.io/icon: mdi:bookshelf
           gethomepage.dev/enabled: "true"
           gethomepage.dev/group: Media
           gethomepage.dev/name: Calibre

.archive/kubernetes/calibre/ks.yaml

@@ -29,7 +29,7 @@ spec:
   retryInterval: 2m
   sourceRef:
     kind: GitRepository
-    name: home-ops-kubernetes
+    name: flux-system
     namespace: flux-system
   targetNamespace: *namespace
   timeout: 5m

.archive/kubernetes/cilium/gateway/external.yaml

@@ -0,0 +1,35 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/gateway.networking.k8s.io/gateway_v1.json
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: external
+  annotations:
+    external-dns.alpha.kubernetes.io/target: &hostname external.${SECRET_EXTERNAL_DOMAIN}
+spec:
+  gatewayClassName: cilium
+  addresses:
+    - type: IPAddress
+      value: 192.168.169.122
+  infrastructure:
+    annotations:
+      external-dns.alpha.kubernetes.io/hostname: *hostname
+  listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.${SECRET_EXTERNAL_DOMAIN}"
+      allowedRoutes:
+        namespaces:
+          from: Same
+    - name: https
+      protocol: HTTPS
+      port: 443
+      hostname: "*.${SECRET_EXTERNAL_DOMAIN}"
+      allowedRoutes:
+        namespaces:
+          from: All
+      tls:
+        certificateRefs:
+          - kind: Secret
+            name: ${SECRET_EXTERNAL_DOMAIN//./-}-tls

.archive/kubernetes/cilium/gateway/gatewayclass.yaml

@@ -0,0 +1,7 @@
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/gateway.networking.k8s.io/gatewayclass_v1.json
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  name: cilium
+spec:
+  controllerName: io.cilium/gateway-controller

.archive/kubernetes/cilium/gateway/internal.yaml

@@ -0,0 +1,35 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/gateway.networking.k8s.io/gateway_v1.json
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: internal
+  annotations:
+    external-dns.alpha.kubernetes.io/target: &hostname internal.${SECRET_EXTERNAL_DOMAIN}
+spec:
+  gatewayClassName: cilium
+  addresses:
+    - type: IPAddress
+      value: 192.168.169.121
+  infrastructure:
+    annotations:
+      external-dns.alpha.kubernetes.io/hostname: *hostname
+  listeners:
+    - name: http
+      protocol: HTTP
+      port: 80
+      hostname: "*.${SECRET_EXTERNAL_DOMAIN}"
+      allowedRoutes:
+        namespaces:
+          from: Same
+    - name: https
+      protocol: HTTPS
+      port: 443
+      hostname: "*.${SECRET_EXTERNAL_DOMAIN}"
+      allowedRoutes:
+        namespaces:
+          from: All
+      tls:
+        certificateRefs:
+          - kind: Secret
+            name: ${SECRET_EXTERNAL_DOMAIN//./-}-tls

.archive/kubernetes/cilium/gateway/kustomization.yaml

@@ -3,5 +3,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ./alertmanager
-  - ./github-status
+  - ./external.yaml
+  - ./internal.yaml
+  - ./gatewayclass.yaml
+  - ./redirect.yaml

.archive/kubernetes/cilium/gateway/redirect.yaml

@@ -0,0 +1,22 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/gateway.networking.k8s.io/httproute_v1.json
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: httpsredirect
+  annotations:
+    external-dns.alpha.kubernetes.io/controller: none
+spec:
+  parentRefs:
+    - name: internal
+      namespace: kube-system
+      sectionName: http
+    - name: external
+      namespace: kube-system
+      sectionName: http
+  rules:
+    - filters:
+        - requestRedirect:
+            scheme: https
+            statusCode: 301
+          type: RequestRedirect

.archive/kubernetes/external-dns/cloudflare/helmrelease.yaml

@@ -1,4 +1,13 @@
 ---
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: external-dns
+  namespace: dns
+spec:
+  interval: 1h
+  url: https://kubernetes-sigs.github.io/external-dns/
+---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
@@ -13,7 +22,6 @@ spec:
       sourceRef:
         kind: HelmRepository
         name: external-dns
-        namespace: flux-system
   install:
     crds: CreateReplace
     remediation:

.archive/kubernetes/external-dns/ks.yaml

@@ -18,7 +18,7 @@ spec:
   retryInterval: 2m
   sourceRef:
     kind: GitRepository
-    name: home-ops-kubernetes
+    name: flux-system
     namespace: flux-system
   targetNamespace: *namespace
   timeout: 5m

.archive/kubernetes/ghostfolio/app/helmrelease.yaml

@@ -9,7 +9,6 @@ spec:
   chartRef:
     kind: OCIRepository
     name: app-template
-    namespace: flux-system
   install:
     remediation:
       retries: 3
@@ -29,7 +28,7 @@ spec:
           app:
             image:
               repository: docker.io/ghostfolio/ghostfolio
-              tag: 2.152.1@sha256:80d9b9ff5e00b1d34c276c81a27a21eee3bc380c3f21d62ea50451f4164448eb
+              tag: 2.175.0@sha256:1344c505b05346625d1217877f0e2abc30534e5eaa7bb39d589443dc99fcdf58
             env:
               NODE_ENV: production
               REDIS_HOST: dragonfly.database.svc.cluster.local.
@@ -69,7 +68,6 @@ spec:
         enabled: true
         className: internal
         annotations:
-          hajimari.io/icon: mdi:cash-multiple
           gethomepage.dev/enabled: "true"
           gethomepage.dev/name: Ghostfolio
           gethomepage.dev/description: Open Source Wealth Management Software

.archive/kubernetes/ghostfolio/ks.yaml

@@ -27,7 +27,7 @@ spec:
   retryInterval: 2m
   sourceRef:
     kind: GitRepository
-    name: home-ops-kubernetes
+    name: flux-system
     namespace: flux-system
   targetNamespace: *namespace
   timeout: 5m

.archive/kubernetes/hajimari/ks.yaml

@@ -21,7 +21,7 @@ spec:
   retryInterval: 2m
   sourceRef:
     kind: GitRepository
-    name: home-ops-kubernetes
+    name: flux-system
     namespace: flux-system
   targetNamespace: *namespace
   timeout: 5m

.archive/kubernetes/homepage/app/helmrelease.yaml

@@ -9,7 +9,6 @@ spec:
   chartRef:
     kind: OCIRepository
     name: app-template
-    namespace: flux-system
   install:
     remediation:
       retries: 3
@@ -29,7 +28,7 @@ spec:
           app:
             image:
               repository: ghcr.io/gethomepage/homepage
-              tag: v1.1.1@sha256:be49a60307fcce7909acdaf2f3b2f3d168a0468d62869bf72d380625dde91fb9
+              tag: v1.4.4@sha256:cd8da3c81ede2a072510930defdcf44c7a0473f72a6d5216beea3b13b3093afe
             env:
               TZ: ${TIMEZONE}
             envFrom:
@@ -55,20 +54,17 @@ spec:
     serviceAccount:
       create: true
       name: *app
-    ingress:
+    route:
       app:
-        enabled: true
-        className: internal
-        hosts:
-          - host: &host "{{ .Release.Name }}.${SECRET_EXTERNAL_DOMAIN}"
-            paths:
-              - path: /
-                service:
-                  identifier: app
-                  port: http
-        tls:
-          - hosts:
-              - *host
+        hostnames: ["{{ .Release.Name }}.${SECRET_EXTERNAL_DOMAIN}"]
+        parentRefs:
+          - name: internal
+            namespace: network
+            sectionName: https
+        rules:
+          - backendRefs:
+              - name: *app
+                port: *port
     persistence:
       config:
         type: configMap

.archive/kubernetes/homepage/ks.yaml

@@ -20,7 +20,7 @@ spec:
   retryInterval: 2m
   sourceRef:
     kind: GitRepository
-    name: home-ops-kubernetes
+    name: flux-system
     namespace: flux-system
   targetNamespace: *namespace
   timeout: 5m

.archive/kubernetes/nginx/external/helmrelease.yaml

@@ -9,11 +9,10 @@ spec:
   chart:
     spec:
       chart: ingress-nginx
-      version: 4.12.1
+      version: 4.13.0
       sourceRef:
         kind: HelmRepository
         name: ingress-nginx
-        namespace: flux-system
   install:
     remediation:
       retries: 3
@@ -64,6 +63,7 @@ spec:
           "http_user_agent": "$http_user_agent"}
         proxy-body-size: 0
         proxy-buffer-size: 16k
+        proxy-busy-buffers-size: 16k
         ssl-protocols: TLSv1.3 TLSv1.2
         use-forwarded-headers: "true"
       metrics:
@@ -88,7 +88,7 @@ spec:
       enabled: true
       image:
         repository: ghcr.io/tarampampam/error-pages
-        tag: 3.3.2@sha256:e7133e4faf97675c00ad9150c98ec1a867ae91ece5131a7eb218b868ce5a628d
+        tag: 3.3.3@sha256:df7d8d24740316f3918b8c280eff61c30c4055daeef2041d3f557bb54187133d
         pullPolicy: IfNotPresent
       extraEnvs:
         - name: TEMPLATE_NAME

.archive/kubernetes/nginx/internal/helmrelease.yaml

@@ -1,4 +1,14 @@
 ---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/helmrepository_v1.json
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: ingress-nginx
+spec:
+  interval: 2h
+  url: https://kubernetes.github.io/ingress-nginx
+  timeout: 3m
+---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
@@ -9,11 +19,10 @@ spec:
   chart:
     spec:
       chart: ingress-nginx
-      version: 4.12.1
+      version: 4.13.0
       sourceRef:
         kind: HelmRepository
         name: ingress-nginx
-        namespace: flux-system
   install:
     remediation:
       retries: 3
@@ -64,6 +73,7 @@ spec:
           "http_user_agent": "$http_user_agent"}
         proxy-body-size: 0
         proxy-buffer-size: 16k
+        proxy-busy-buffers-size: 16k
         ssl-protocols: TLSv1.3 TLSv1.2
       metrics:
         enabled: true
@@ -87,7 +97,7 @@ spec:
       enabled: true
       image:
         repository: ghcr.io/tarampampam/error-pages
-        tag: 3.3.2@sha256:e7133e4faf97675c00ad9150c98ec1a867ae91ece5131a7eb218b868ce5a628d
+        tag: 3.3.3@sha256:df7d8d24740316f3918b8c280eff61c30c4055daeef2041d3f557bb54187133d
         pullPolicy: IfNotPresent
       extraEnvs:
         - name: TEMPLATE_NAME

.archive/kubernetes/nginx/ks.yaml

@@ -2,34 +2,6 @@
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
-metadata:
-  name: &app nginx-certificates
-  namespace: &namespace network
-spec:
-  commonMetadata:
-    labels:
-      app.kubernetes.io/name: *app
-  dependsOn:
-    - name: cert-manager
-      namespace: cert-manager
-  interval: 1h
-  path: ./kubernetes/apps/network/nginx/certificates
-  postBuild:
-    substitute:
-      APP: *app
-  prune: true
-  retryInterval: 2m
-  sourceRef:
-    kind: GitRepository
-    name: home-ops-kubernetes
-    namespace: flux-system
-  targetNamespace: *namespace
-  timeout: 5m
-  wait: false
----
-# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
 metadata:
   name: &app nginx-external
   namespace: &namespace network
@@ -49,7 +21,7 @@ spec:
   retryInterval: 2m
   sourceRef:
     kind: GitRepository
-    name: home-ops-kubernetes
+    name: flux-system
     namespace: flux-system
   targetNamespace: *namespace
   timeout: 5m
@@ -77,7 +49,7 @@ spec:
   retryInterval: 2m
   sourceRef:
     kind: GitRepository
-    name: home-ops-kubernetes
+    name: flux-system
     namespace: flux-system
   targetNamespace: *namespace
   timeout: 5m

.archive/kubernetes/ngnode/kustomization.yaml

@@ -2,8 +2,8 @@
 # yaml-language-server: $schema=https://raw.githubusercontent.com/SchemaStore/schemastore/master/src/schemas/json/kustomization.json
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
-namespace: actions-runner-system
 components:
   - ../../components/common
 resources:
-  - ./actions-runner-controller/ks.yaml
+  - ./landing-page/ks.yaml
+

.archive/kubernetes/ngnode/landing-page/app-staging/helmrelease.yaml

@@ -9,7 +9,6 @@ spec:
   chartRef:
     kind: OCIRepository
     name: app-template
-    namespace: flux-system
   install:
     remediation:
       retries: 3

.archive/kubernetes/ngnode/landing-page/app/helmrelease.yaml

@@ -9,7 +9,6 @@ spec:
   chartRef:
     kind: OCIRepository
     name: app-template
-    namespace: flux-system
   install:
     remediation:
       retries: 3

.archive/kubernetes/ngnode/landing-page/ks.yaml

@@ -15,7 +15,7 @@ spec:
   prune: true
   sourceRef:
     kind: GitRepository
-    name: home-ops-kubernetes
+    name: flux-system
   wait: false
   interval: 30m
   retryInterval: 1m
@@ -40,7 +40,7 @@ spec:
   prune: true
   sourceRef:
     kind: GitRepository
-    name: home-ops-kubernetes
+    name: flux-system
   wait: false
   interval: 30m
   retryInterval: 1m

.archive/kubernetes/opnsense-dns/app/externalsecret.yaml

@@ -3,22 +3,18 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: freshrss
+  name: opnsense-dns
 spec:
   secretStoreRef:
     kind: ClusterSecretStore
     name: onepassword-connect
   target:
-    name: freshrss-secret
+    name: opnsense-dns-secret
     template:
-      engineVersion: v2
       data:
-        OIDC_CLIENT_SECRET: "{{ .FRESHRSS_OAUTH_CLIENT_SECRET }}"
-        FRESHRSS_OIDC_CLIENT_CRYPTO_KEY: "{{ .FRESHRSS_OIDC_CLIENT_CRYPTO_KEY}}"
+        OPNSENSE_API_KEY: "{{ .EXTERNAL_DNS_OPNSENSE_API_KEY }}"
+        OPNSENSE_API_SECRET: "{{ .EXTERNAL_DNS_OPNSENSE_API_SECRET }}"
+        OPNSENSE_HOST: "{{ .OPNSENSE_HOST }}"
   dataFrom:
     - extract:
-        key: authelia
-    - extract:
-        key: cloudnative-pg
-    - extract:
-        key: freshrss
+        key: opnsense

.archive/kubernetes/opnsense-dns/app/helmrelease.yaml

@@ -0,0 +1,90 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/ocirepository_v1.json
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: opnsense-dns
+spec:
+  interval: 5m
+  layerSelector:
+    mediaType: application/vnd.cncf.helm.chart.content.v1.tar+gzip
+    operation: copy
+  ref:
+    tag: 1.18.0
+  url: oci://ghcr.io/home-operations/charts-mirror/external-dns
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/helm.toolkit.fluxcd.io/helmrelease_v2.json
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: &app opnsense-dns
+spec:
+  interval: 1h
+  chartRef:
+    kind: OCIRepository
+    name: opnsense-dns
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    cleanupOnFail: true
+    remediation:
+      strategy: rollback
+      retries: 3
+  values:
+    fullnameOverride: *app
+    logLevel: debug
+    deploymentAnnotations:
+      reloader.stakater.com/auto: "true"
+    provider:
+      name: webhook
+      webhook:
+        image:
+          repository: ghcr.io/crutonjohn/external-dns-opnsense-webhook
+          tag: v0.1.0@sha256:72d4f5c79e515b8a70bb2e48f6472c746671a3ae3d8ad224aa686dd7192e1609
+        env:
+          - name: LOG_LEVEL
+            value: debug
+          - name: OPNSENSE_API_KEY
+            valueFrom:
+              secretKeyRef:
+                name: &secret opnsense-dns-secret
+                key: OPNSENSE_API_KEY
+          - name: OPNSENSE_API_SECRET
+            valueFrom:
+              secretKeyRef:
+                name: *secret
+                key: OPNSENSE_API_SECRET
+          - name: OPNSENSE_HOST
+            valueFrom:
+              secretKeyRef:
+                name: *secret
+                key: OPNSENSE_HOST
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: 8080
+          initialDelaySeconds: 10
+          timeoutSeconds: 5
+        readinessProbe:
+          httpGet:
+            path: /readyz
+            port: 8080
+          initialDelaySeconds: 10
+          timeoutSeconds: 5
+        resources:
+          requests:
+            memory: 20Mi
+            cpu: 10m
+          limits:
+            memory: 100Mi
+    extraArgs:
+      - --managed-record-types=A,AAAA
+    policy: upsert-only
+    registry: noop
+    sources: ["gateway-httproute", "service"]
+    domainFilters: ["${SECRET_EXTERNAL_DOMAIN}"]
+    serviceMonitor:
+      enabled: true
+    podAnnotations:
+      secret.reloader.stakater.com/reload: *secret

.archive/kubernetes/opnsense-dns/app/kustomization.yaml

@@ -3,5 +3,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ./helm
-  - ./oci
+  - ./externalsecret.yaml
+  - ./helmrelease.yaml

.archive/kubernetes/opnsense-dns/ks.yaml

@@ -0,0 +1,24 @@
+---
+# yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: &app opnsense-dns
+  namespace: &namespace network
+spec:
+  commonMetadata:
+    labels:
+      app.kubernetes.io/name: *app
+  dependsOn:
+    - name: external-secrets-stores
+      namespace: external-secrets
+  interval: 1h
+  path: ./kubernetes/apps/network/opnsense-dns/app
+  prune: true
+  retryInterval: 2m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  targetNamespace: *namespace
+  timeout: 5m

.archive/kubernetes/zwave-js-ui/app/helmrelease.yaml

@@ -9,7 +9,6 @@ spec:
   chartRef:
     kind: OCIRepository
     name: app-template
-    namespace: flux-system
   install:
     remediation:
       retries: 3
@@ -30,7 +29,7 @@ spec:
           app:
             image:
               repository: ghcr.io/zwave-js/zwave-js-ui
-              tag: 10.2.0@sha256:fde63d4a761c56874ae05b5d26e78c0465c1562789941a9fd62b1768de54e4fb
+              tag: 11.1.0@sha256:2fd09e11fe0b12db55f356ecf04b1cd5925f1c015accedaf6a37fc19d9e53acd
             env:
               TZ: ${TIMEZONE}
             probes:
@@ -84,7 +83,6 @@ spec:
           nginx.ingress.kubernetes.io/auth-signin: https://auth.${SECRET_EXTERNAL_DOMAIN}?rm=$request_method
           nginx.ingress.kubernetes.io/auth-response-headers: Remote-User,Remote-Name,Remote-Groups,Remote-Email
           nginx.ingress.kubernetes.io/auth-snippet: proxy_set_header X-Forwarded-Method $request_method;
-          hajimari.io/icon: mdi:z-wave
           gethomepage.dev/enabled: "true"
           gethomepage.dev/name: Zwave-js-ui
           gethomepage.dev/description: Bridge for connecting Zwave devices to MQTT networks.

.archive/kubernetes/zwave-js-ui/ks.yaml

@@ -30,7 +30,7 @@ spec:
   retryInterval: 2m
   sourceRef:
     kind: GitRepository
-    name: home-ops-kubernetes
+    name: flux-system
     namespace: flux-system
   targetNamespace: *namespace
   timeout: 5m

.github/workflows/flux-diff.yaml

@@ -1,96 +0,0 @@
----
-# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
-name: Flux Diff
-
-on:
-  pull_request:
-    branches: [main]
-    paths: [kubernetes/**]
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  flux-diff:
-    name: Flux Diff
-    runs-on: ubuntu-latest
-    permissions:
-      pull-requests: write
-    strategy:
-      matrix:
-        resources: [helmrelease, kustomization]
-      max-parallel: 4
-      fail-fast: false
-    steps:
-      - name: Generate Token
-        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2
-        id: app-token
-        with:
-          app-id: "${{ secrets.BOT_APP_ID }}"
-          private-key: "${{ secrets.BOT_APP_PRIVATE_KEY }}"
-
-      - name: Setup System Tools
-        shell: bash
-        run: sudo apt-get -qq update && sudo apt-get -qq install --no-install-recommends -y curl git
-
-      - name: Checkout Default Branch
-        uses: actions/checkout@v4
-        with:
-          token: "${{ steps.app-token.outputs.token }}"
-          ref: "${{ github.event.repository.default_branch }}"
-          path: default
-
-      - name: Checkout Pull Request Branch
-        uses: actions/checkout@v4
-        with:
-          token: "${{ steps.app-token.outputs.token }}"
-          path: pull
-
-      - name: Diff Resources
-        uses: docker://ghcr.io/allenporter/flux-local:v7.5.0@sha256:2111f5e96e65bfdb7cee71f3384cdfae0de1a6a2ce5b95d0fa6de8142c3314d1
-        with:
-          args: >-
-            diff ${{ matrix.resources }}
-            --unified 6
-            --path /github/workspace/pull/kubernetes/flux
-            --path-orig /github/workspace/default/kubernetes/flux
-            --strip-attrs "helm.sh/chart,checksum/config,app.kubernetes.io/version,chart"
-            --limit-bytes 10000
-            --all-namespaces
-            --sources "home-ops-kubernetes"
-            --output-file diff.patch
-
-      - name: Generate Diff
-        id: diff
-        run: |
-          echo "diff<<EOF" >> $GITHUB_OUTPUT
-          cat diff.patch >> $GITHUB_OUTPUT
-          echo "EOF" >> $GITHUB_OUTPUT
-          echo "### Diff" >> $GITHUB_STEP_SUMMARY
-          echo '```diff' >> $GITHUB_STEP_SUMMARY
-          cat diff.patch >> $GITHUB_STEP_SUMMARY
-          echo '```' >> $GITHUB_STEP_SUMMARY
-
-      - if: ${{ steps.diff.outputs.diff != '' }}
-        name: Add comment
-        uses: mshick/add-pr-comment@v2
-        with:
-          repo-token: "${{ steps.app-token.outputs.token }}"
-          message-id: "${{ github.event.pull_request.number }}/${{ matrix.paths }}/${{ matrix.resources }}"
-          message-failure: Diff was not successful
-          message: |
-            ```diff
-            ${{ steps.diff.outputs.diff }}
-            ```
-
-  # Summarize matrix https://github.community/t/status-check-for-a-matrix-jobs/127354/7
-  flux-diff-success:
-    if: ${{ always() }}
-    needs: ["flux-diff"]
-    name: Flux Diff Successful
-    runs-on: ubuntu-latest
-    steps:
-      - if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
-        name: Check matrix status
-        run: exit 1

.github/workflows/flux-image-test.yaml

@@ -1,115 +0,0 @@
----
-# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
-name: Flux Image Test
-
-on:
-  pull_request:
-    branches: [main]
-    paths: [kubernetes/**]
-
-concurrency:
-  group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
-  cancel-in-progress: true
-
-jobs:
-  extract-images:
-    name: Extract Images
-    runs-on: ubuntu-latest
-    permissions:
-      pull-requests: write
-    outputs:
-      matrix: ${{ steps.extract-images.outputs.images }}
-    steps:
-      - name: Generate Token
-        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2
-        id: app-token
-        with:
-          app-id: "${{ secrets.BOT_APP_ID }}"
-          private-key: "${{ secrets.BOT_APP_PRIVATE_KEY }}"
-
-      - name: Setup Homebrew
-        uses: Homebrew/actions/setup-homebrew@master
-
-      - name: Setup Workflow Tools
-        shell: bash
-        run: brew install jo yq
-
-      - name: Checkout Default Branch
-        uses: actions/checkout@v4
-        with:
-          token: "${{ steps.app-token.outputs.token }}"
-          ref: "${{ github.event.repository.default_branch }}"
-          path: default
-
-      - name: Checkout Pull Request Branch
-        uses: actions/checkout@v4
-        with:
-          token: "${{ steps.app-token.outputs.token }}"
-          path: pull
-
-      - name: Gather Images in Default Branch
-        uses: docker://ghcr.io/allenporter/flux-local:v7.5.0@sha256:2111f5e96e65bfdb7cee71f3384cdfae0de1a6a2ce5b95d0fa6de8142c3314d1
-        with:
-          args: >-
-            get cluster
-            --path /github/workspace/default/kubernetes/flux
-            --enable-images
-            --output yaml
-            --output-file default.yaml
-
-      - name: Gather Images in Pull Request Branch
-        uses: docker://ghcr.io/allenporter/flux-local:v7.5.0@sha256:2111f5e96e65bfdb7cee71f3384cdfae0de1a6a2ce5b95d0fa6de8142c3314d1
-        with:
-          args: >-
-            get cluster
-            --path /github/workspace/pull/kubernetes/flux
-            --enable-images
-            --output yaml
-            --output-file pull.yaml
-
-      - name: Filter Default Branch Results
-        shell: bash
-        run: |
-          yq -r '[.. | .images? | select(. != null)] | flatten | sort | unique | .[]' \
-              default.yaml > default.txt
-
-      - name: Filter Pull Request Branch Results
-        shell: bash
-        run: |
-          yq -r '[.. | .images? | select(. != null)] | flatten | sort | unique | .[]' \
-              pull.yaml > pull.txt
-
-      - name: Compare Default and Pull Request Images
-        id: extract-images
-        shell: bash
-        run: |
-          images=$(jo -a $(grep -vf default.txt pull.txt))
-          echo "images=${images}" >> $GITHUB_OUTPUT
-          echo "${images}"
-          echo "### Images" >> $GITHUB_STEP_SUMMARY
-          echo "${images}" | jq -r 'to_entries[] | "* \(.value)"' >> $GITHUB_STEP_SUMMARY
-
-  test-images:
-    if: ${{ needs.extract-images.outputs.matrix != '[]' }}
-    name: Test images
-    runs-on: ubuntu-latest
-    needs: [extract-images]
-    strategy:
-      matrix:
-        images: ${{ fromJSON(needs.extract-images.outputs.matrix) }}
-      max-parallel: 4
-      fail-fast: false
-    steps:
-      - name: Test Images
-        run: docker buildx imagetools inspect ${{ matrix.images }}
-
-  # Summarize matrix https://github.community/t/status-check-for-a-matrix-jobs/127354/7
-  test-images-success:
-    if: ${{ always() }}
-    needs: [test-images]
-    name: Test Images Successful
-    runs-on: ubuntu-latest
-    steps:
-      - if: ${{ contains(needs.*.result, 'failure') || contains(needs.*.result, 'cancelled') }}
-        name: Check matrix status
-        run: exit 1

.github/workflows/flux-local.yaml

@@ -0,0 +1,127 @@
+---
+name: Flux Local
+
+on:
+  pull_request:
+    branches: ["main"]
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.event.number || github.ref }}
+  cancel-in-progress: true
+
+permissions:
+  contents: read
+
+jobs:
+  filter:
+    name: Flux Local - Filter
+    runs-on: ubuntu-latest
+    outputs:
+      changed-files: ${{ steps.changed-files.outputs.changed_files }}
+    steps:
+      - name: Get Changed Files
+        id: changed-files
+        uses: bjw-s-labs/action-changed-files@930cef8463348e168cab7235c47fe95a7a235f65 # v0.3.3
+        with:
+          patterns: kubernetes/**/*
+
+  test:
+    if: ${{ needs.filter.outputs.changed-files != '[]' }}
+    needs: filter
+    name: Flux Local - Test
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          persist-credentials: false
+
+      - name: Run flux-local test
+        uses: docker://ghcr.io/allenporter/flux-local:v7.9.0
+        with:
+          args: >-
+            test
+            --all-namespaces
+            --enable-helm
+            --path /github/workspace/kubernetes/flux
+            --verbose
+
+  diff:
+    if: ${{ needs.filter.outputs.changed-files != '[]' }}
+    needs: filter
+    name: Flux Local - Diff
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      pull-requests: write
+    strategy:
+      matrix:
+        resource: ["helmrelease", "kustomization"]
+      fail-fast: false
+    steps:
+      - name: Checkout Pull Request Branch
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          path: pull
+          persist-credentials: false
+
+      - name: Checkout Default Branch
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          path: default
+          persist-credentials: false
+          ref: "${{ github.event.repository.default_branch }}"
+
+      - name: Run flux-local diff
+        uses: docker://ghcr.io/allenporter/flux-local:v7.9.0
+        with:
+          args: >-
+            diff ${{ matrix.resource }}
+            --unified 6
+            --path /github/workspace/pull/kubernetes/flux
+            --path-orig /github/workspace/default/kubernetes/flux
+            --strip-attrs "helm.sh/chart,checksum/config,app.kubernetes.io/version,chart"
+            --limit-bytes 10000
+            --all-namespaces
+            --sources "flux-system"
+            --output-file diff.patch
+
+      - name: Generate Diff
+        id: diff
+        run: |
+          echo 'diff<<EOF' >> $GITHUB_OUTPUT
+          cat diff.patch >> $GITHUB_OUTPUT
+          echo 'EOF' >> $GITHUB_OUTPUT
+
+      - if: ${{ steps.diff.outputs.diff != '' }}
+        name: Generate Token
+        uses: actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b # v2.1.1
+        id: app-token
+        with:
+          app-id: ${{ secrets.BOT_APP_ID }}
+          private-key: ${{ secrets.BOT_APP_PRIVATE_KEY }}
+
+      - if: ${{ steps.diff.outputs.diff != '' }}
+        name: Add Comment
+        uses: marocchino/sticky-pull-request-comment@773744901bac0e8cbb5a0dc842800d45e9b2b405 # v2.9.4
+        with:
+          GITHUB_TOKEN: ${{ steps.app-token.outputs.token }}
+          header: ${{ github.event.pull_request.number }}/kubernetes/${{ matrix.resource }}
+          message: |
+            ```diff
+            ${{ steps.diff.outputs.diff }}
+            ```
+
+  success:
+    if: ${{ !cancelled() }}
+    needs: ["test", "diff"]
+    name: Flux Local - Success
+    runs-on: ubuntu-latest
+    steps:
+      - name: Any jobs failed?
+        if: ${{ contains(needs.*.result, 'failure') }}
+        run: exit 1
+
+      - name: All jobs passed or skipped?
+        if: ${{ !(contains(needs.*.result, 'failure')) }}
+        run: echo "All jobs passed or skipped" && echo "${{ toJSON(needs.*.result) }}"

.github/workflows/labeler.yml

@@ -16,14 +16,14 @@ jobs:
       pull-requests: write
     steps:
       - name: Generate Token
-        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2
+        uses: actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b # v2
         id: app-token
         with:
           app-id: "${{ secrets.BOT_APP_ID }}"
           private-key: "${{ secrets.BOT_APP_PRIVATE_KEY }}"
 
       - name: Labeler
-        uses: actions/labeler@v5
+        uses: actions/labeler@v6
         with:
           repo-token: "${{ steps.app-token.outputs.token }}"
           configuration-path: .github/labeler.yaml

.github/workflows/labels-sync.yaml

@@ -16,14 +16,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Generate Token
-        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2
+        uses: actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b # v2
         id: app-token
         with:
           app-id: "${{ secrets.BOT_APP_ID }}"
           private-key: "${{ secrets.BOT_APP_PRIVATE_KEY }}"
 
       - name: Checkout Default Branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           token: "${{ steps.app-token.outputs.token }}"
 

.github/workflows/lychee.yaml

@@ -1,63 +0,0 @@
----
-# yaml-language-server: $schema=https://json.schemastore.org/github-workflow.json
-name: "Lychee"
-
-on:
-  workflow_dispatch:
-  push:
-    branches: ["main"]
-    paths: [".github/workflows/lychee.yaml"]
-  schedule:
-    - cron: "0 0 * * *"
-
-env:
-  WORKFLOW_ISSUE_TITLE: "Link Checker Dashboard 🔗"
-
-jobs:
-  lychee:
-    name: Lychee
-    runs-on: ubuntu-latest
-    steps:
-      - name: Generate Token
-        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2
-        id: app-token
-        with:
-          app-id: "${{ secrets.BOT_APP_ID }}"
-          private-key: "${{ secrets.BOT_APP_PRIVATE_KEY }}"
-
-      - name: Checkout Default Branch
-        uses: actions/checkout@v4
-        with:
-          token: "${{ steps.app-token.outputs.token }}"
-
-      - name: Scan For Broken Links
-        uses: lycheeverse/lychee-action@82202e5e9c2f4ef1a55a3d02563e1cb6041e5332 # v2
-        env:
-          GITHUB_TOKEN: "${{ steps.app-token.outputs.token }}"
-        with:
-          args: --verbose --no-progress --exclude-mail './**/*.md'
-          output: /tmp/results.md
-
-      - name: Find Link Checker Issue
-        id: find-issue
-        shell: bash
-        env:
-          GH_TOKEN: "${{ steps.app-token.outputs.token }}"
-        run: |
-          issue_number=$( \
-              gh issue list \
-                  --search "in:title ${{ env.WORKFLOW_ISSUE_TITLE }}" \
-                  --state open \
-                  --json number \
-                  | jq --raw-output '.[0].number' \
-          )
-          echo "issue-number=${issue_number}" >> $GITHUB_OUTPUT
-          echo "${issue_number}"
-
-      - name: Create or Update Issue
-        uses: peter-evans/create-issue-from-file@e8ef132d6df98ed982188e460ebb3b5d4ef3a9cd # v5
-        with:
-          token: "${{ steps.app-token.outputs.token }}"
-          title: "${{ env.WORKFLOW_ISSUE_TITLE }}"
-          issue-number: "${{ steps.find-issue.outputs.issue-number || '' }}"
-          content-filepath: /tmp/results.md

.github/workflows/renovate.yaml

@@ -41,14 +41,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: Generate Token
-        uses: actions/create-github-app-token@df432ceedc7162793a195dd1713ff69aefc7379e # v2
+        uses: actions/create-github-app-token@a8d616148505b5069dccd32f177bb87d7f39123b # v2
         id: app-token
         with:
           app-id: "${{ secrets.BOT_APP_ID }}"
           private-key: "${{ secrets.BOT_APP_PRIVATE_KEY }}"
 
       - name: Checkout Default Branch
-        uses: actions/checkout@v4
+        uses: actions/checkout@v5
         with:
           token: "${{ steps.app-token.outputs.token }}"
 
@@ -59,7 +59,7 @@ jobs:
           echo "LOG_LEVEL=${{ github.event.inputs.logLevel || env.WORKFLOW_RENOVATE_LOG_LEVEL }}" >> "${GITHUB_ENV}"
 
       - name: Renovate
-        uses: renovatebot/github-action@8ac70de2fe55752c573155866e30735411e3b61c # v41.0.22
+        uses: renovatebot/github-action@7876d7a812254599d262d62b6b2c2706018258a2 # v43.0.10
         with:
           configurationFile: "${{ env.RENOVATE_ONBOARDING_CONFIG_FILE_NAME }}"
           token: "${{ steps.app-token.outputs.token }}"

.just/bootstrap.just

@@ -0,0 +1,89 @@
+set quiet
+set shell := ['bash', '-eu', '-o', 'pipefail', '-c']
+
+bootstrap_dir := justfile_dir() + '/bootstrap'
+kubernetes_dir := justfile_dir() + '/kubernetes'
+
+controller := `talosctl config info -o yaml | yq -e '.endpoints[0]'`
+nodes := `talosctl config info -o yaml | yq -e '.nodes | join (" ")'`
+
+[doc('Bootstrap Cluster')]
+default: talos kubernetes kubeconfig wait namespaces resources crds apps
+
+[doc('Install Talos')]
+talos: (with-banner "Installing Talos")
+    for node in {{nodes}}; do \
+        if ! output=$(just talos apply-node "${node}" --insecure 2>&1); then \
+            if [[ "${output}" == *"certificate required"* ]]; then \
+                just log info "Talos node is already configured, skipping apply of config" "node" "${node}"; \
+                continue; \
+            fi; \
+            just log fatal "Failed to apply Talos node configuration" "node" "${node}" "output" "${output}"; \
+        fi; \
+    done
+
+[doc('Install Kubernetes')]
+kubernetes: (with-banner "Installing Kubernetes")
+    until output=$(talosctl -n "{{controller}}" bootstrap 2>&1 || true) && [[ "${output}" == *"AlreadyExists"* ]]; do \
+        just log info "Talos bootstrap in progress, waiting 5 seconds..."; \
+        sleep 5; \
+    done
+
+[doc('Fetch Kubeconfig')]
+kubeconfig: (with-banner "Fetching kubeconfig")
+    if ! talosctl -n "{{controller}}" kubeconfig -f --force-context-name main "{{justfile_dir()}}" &>/dev/null; then \
+        just log fatal "Failed to fetch kubeconfig"; \
+    fi
+
+[doc('Wait for nodes to be not-ready')]
+wait: (with-banner "Waiting for nodes to be not-ready")
+    if ! kubectl wait nodes --for=condition=Ready=True --all --timeout=10s &>/dev/null; then \
+        until kubectl wait nodes --for=condition=Ready=False --all --timeout=10s &>/dev/null; do \
+            just log info "Nodes are not available, waiting for nodes to be available. Retrying in 5 seconds..."; \
+            sleep 5; \
+        done \
+    fi
+
+[doc('Apply Namespaces')]
+namespaces: (with-banner "Applying Namespaces")
+    find "{{kubernetes_dir}}/apps" -mindepth 1 -maxdepth 1 -type d -printf "%f\n" | while IFS= read -r namespace; do \
+        if kubectl get namespace "${namespace}" &>/dev/null; then \
+            continue; \
+        fi; \
+        if ! kubectl create namespace "${namespace}" --dry-run=client -o yaml | kubectl apply --server-side -f - &>/dev/null; then \
+            just log error "Failed to apply namespace" "namespace" "${namespace}"; \
+        fi; \
+        just log info "Namespace applied successfully" "namespace" "${namespace}"; \
+    done
+
+[doc('Apply Resources')]
+resources: (with-banner "Applying Resources")
+    if ! resources=$(op inject -i "{{bootstrap_dir}}/resources.yaml") || [[ -z "${resources}" ]]; then \
+        just log fatal "Failed to render resources"; \
+    fi; \
+    if ! echo "${resources}" | kubectl diff -f - &>/dev/null; then \
+        if ! echo "${resources}" | kubectl apply --server-side -f - &>/dev/null; then \
+            just log fatal "Failed to apply resources"; \
+        fi \
+    fi
+
+[doc('Apply CRDs')]
+crds: (with-banner "Applying CRDs")
+    if ! crds=$(helmfile --file "{{bootstrap_dir}}/helmfile.d/00-crds.yaml" template -q | yq ea -e 'select(.kind == "CustomResourceDefinition")') || [[ -z "${crds}" ]]; then \
+        just log fatal "Failed to render CRDs from Helmfile"; \
+    fi; \
+    if ! echo "${crds}" | kubectl diff --filename - &>/dev/null; then \
+        if ! echo "${crds}" | kubectl apply --server-side --filename - &>/dev/null; then \
+            just log fatal "Failed to apply crds from Helmfile"; \
+        fi; \
+    fi
+
+[doc('Apply Apps')]
+apps: (with-banner "Applying Apps")
+    if ! helmfile --file "{{bootstrap_dir}}/helmfile.d/01-apps.yaml" sync --hide-notes; then \
+        just log fatal "Failed to apply apps from Helmfile"; \
+    fi
+
+[private]
+with-banner msg:
+    just log info "{{msg}}"

.just/kube.just

@@ -0,0 +1,16 @@
+set quiet
+set shell := ['bash', '-eu', '-o', 'pipefail', '-c']
+
+[private]
+default:
+    just --list kube
+
+[doc('Spawn a shell on a node')]
+node-shell node:
+    kubectl node-shell -n kube-system -x {{node}}
+
+[doc('Prune all unused Pods')]
+prune-pods:
+    for phase in Failed Pending Succeeded; do \
+        kubectl delete pods -A --field-selector status.phase="${phase}" --ignore-not-found=true; \
+    done

.just/sync.just

@@ -0,0 +1,36 @@
+set quiet
+set shell := ['bash', '-eu', '-o', 'pipefail', '-c']
+
+[private]
+default:
+    just --list sync
+
+[doc('Sync ExternalSecrets')]
+es:
+    kubectl get es -A --no-headers | while read -r ns name _; do \
+        kubectl -n "${ns}" annotate --field-manager flux-client-side-apply --overwrite es "${name}" force-sync="$(date +%s)"; \
+    done
+
+[doc('Sync GitRepositories')]
+git:
+    kubectl get gitrepo -A --no-headers | while read -r ns name _; do \
+        kubectl -n "${ns}" annotate --field-manager flux-client-side-apply --overwrite gitrepo "${name}" reconcile.fluxcd.io/requestedAt="$(date +%s)"; \
+    done
+
+[doc('Sync HelmReleases')]
+hr:
+    kubectl get hr -A --no-headers | while read -r ns name _; do \
+        kubectl -n "${ns}" annotate --field-manager flux-client-side-apply --overwrite hr "${name}" reconcile.fluxcd.io/requestedAt="$(date +%s)" reconcile.fluxcd.io/forceAt="$(date +%s)"; \
+    done
+
+[doc('Sync Kustomizations')]
+ks:
+    kubectl get ks -A --no-headers | while read -r ns name _; do \
+        kubectl -n "${ns}" annotate --field-manager flux-client-side-apply --overwrite ks "${name}" reconcile.fluxcd.io/requestedAt="$(date +%s)"; \
+    done
+
+[doc('Sync OCIRepositories')]
+oci:
+    kubectl get ocirepo -A --no-headers | while read -r ns name _; do \
+        kubectl -n "${ns}" annotate --field-manager flux-client-side-apply --overwrite ocirepo "${name}" reconcile.fluxcd.io/requestedAt="$(date +%s)"; \
+    done

.just/talos.just

@@ -0,0 +1,70 @@
+set quiet
+set shell := ['bash', '-eu', '-o', 'pipefail', '-c']
+
+scripts_dir := justfile_dir() + '/scripts'
+talos_dir := justfile_dir() + '/talos'
+temp_dir := `mktemp -d`
+
+controller := `talosctl config info -o yaml | yq -e '.endpoints[0]'`
+
+[private]
+default:
+    just --list talos
+
+[doc('Apply Node')]
+apply-node node *args:
+    just talos render-config "{{node}}" | talosctl -n "{{node}}" apply-config -f /dev/stdin {{args}}
+
+[doc('Download Image')]
+download-image version schematic:
+    gum spin -s line --title "Downloading Talos {{version}} ..." -- \
+    curl -sfL --remove-on-error --retry 5 --retry-delay 5 --retry-all-errors \
+        -o "{{talos_dir}}/talos-{{version}}-{{replace_regex(schematic, '^(.{8}).*', '$1')}}.iso" \
+        "https://factory.talos.dev/image/{{schematic}}/{{version}}/metal-amd64.iso"
+    just log info "Downloaded Talos" version "{{version}}" schematic "{{schematic}}"
+
+[doc('Generate Kubeconfig')]
+generate-kubeconfig:
+    talosctl kubeconfig -n "{{controller}}" -f --force-context-name main {{justfile_dir()}}
+
+[doc('Generate Schematic Id')]
+generate-schematic-id:
+    curl -sX POST --data-binary "@{{talos_dir}}/schematic.yaml" \
+        "https://factory.talos.dev/schematics" | jq -r '.id'
+
+[doc('Reboot Node')]
+reboot-node node:
+    talosctl -n {{node}} reboot -m powercycle
+
+[doc('Render Config')]
+render-config node:
+    minijinja-cli -D "machinetype=$(just talos machine-type {{node}})" \
+        "{{talos_dir}}/machineconfig.yaml.j2" | op inject >"{{temp_dir}}/base.yaml"
+    minijinja-cli -D "machinetype=$(just talos machine-type {{node}})" \
+        "{{talos_dir}}/nodes/{{node}}.yaml.j2" | op inject >"{{temp_dir}}/patch.yaml"
+    talosctl machineconfig patch "{{temp_dir}}/base.yaml" -p "{{temp_dir}}/patch.yaml"
+
+[doc('Reset Node')]
+[confirm]
+reset-node node:
+    talosctl -n "{{node}}" reset --graceful=false
+
+[doc('Shutdown Node')]
+shutdown-node node:
+    talosctl -n "{{node}}" shutdown --force
+
+[doc('Upgrade Kubernetes')]
+upgrade-k8s version:
+    talosctl -n "{{controller}}" upgrade-k8s --to {{version}}
+
+[doc('Upgrade Node')]
+upgrade-node node:
+    talosctl -n "{{node}}" upgrade -i "$(just talos machine-image)" -m powercycle --timeout=10m
+
+[private]
+machine-type node:
+    minijinja-cli "{{talos_dir}}/nodes/{{node}}.yaml.j2" | yq -e '.machine.type // ""'
+
+[private]
+machine-image:
+    minijinja-cli "{{talos_dir}}/machineconfig.yaml.j2" | yq -e '.machine.install.image // ""'

.just/volsync.just

@@ -0,0 +1,231 @@
+set quiet
+set shell := ['bash', '-eu', '-o', 'pipefail', '-c']
+
+# This justfile is used to manage certain VolSync tasks for a given application, limitations are described below.
+#   1. Fluxtomization, HelmRelease, PVC, ReplicationSource all have the same name (e.g. plex)
+#   2. ReplicationSource and ReplicationDestination are a Restic repository
+#   3. Applications are deployed as either a Kubernetes Deployment or StatefulSet
+#   4. Each application only has one PVC that is being replicated
+
+scripts_dir := justfile_directory() + '/.just/volsync/scripts'
+templates_dir := justfile_directory() + '/.just/volsync/templates'
+
+[private]
+default:
+    just --list volsync
+
+[doc('List snapshots for an application')]
+list app ns="default":
+    #!/usr/bin/env bash
+    set -euo pipefail
+
+    # Check preconditions
+    if [[ ! -f "{{scripts_dir}}/wait.sh" ]]; then
+        echo "Wait script not found"
+        exit 1
+    fi
+    if [[ ! -f "{{templates_dir}}/list.tmpl.yaml" ]]; then
+        echo "List template not found"
+        exit 1
+    fi
+
+    ts=$(date +%H%M%S)
+    export app="{{app}}"
+    export controller=""
+    export claim=""
+    export puid=""
+    export pgid=""
+    export ns="{{ns}}"
+    export previous=""
+    export ts="${ts}"
+
+    envsubst < <(cat {{templates_dir}}/list.tmpl.yaml) | kubectl apply -f -
+    bash {{scripts_dir}}/wait.sh list-{{app}}-${ts} {{ns}}
+    kubectl -n {{ns}} wait job/list-{{app}}-${ts} --for condition=complete --timeout=1m
+    kubectl -n {{ns}} logs job/list-{{app}}-${ts} --container list
+    kubectl -n {{ns}} delete job list-{{app}}-${ts}
+
+[doc('Unlock a Restic repository for an application')]
+unlock app ns="default":
+    #!/usr/bin/env bash
+    set -euo pipefail
+
+    # Check preconditions
+    if [[ ! -f "{{scripts_dir}}/wait.sh" ]]; then
+        echo "Wait script not found"
+        exit 1
+    fi
+    if [[ ! -f "{{templates_dir}}/unlock.tmpl.yaml" ]]; then
+        echo "Unlock template not found"
+        exit 1
+    fi
+
+    ts=$(date +%H%M%S)
+    export app="{{app}}"
+    export controller=""
+    export claim=""
+    export puid=""
+    export pgid=""
+    export ns="{{ns}}"
+    export previous=""
+    export ts="${ts}"
+
+    envsubst < <(cat {{templates_dir}}/unlock.tmpl.yaml) | kubectl apply -f -
+    bash {{scripts_dir}}/wait.sh unlock-{{app}}-${ts} {{ns}}
+    kubectl -n {{ns}} wait job/unlock-{{app}}-${ts} --for condition=complete --timeout=1m
+    kubectl -n {{ns}} logs job/{{app}}-unlock-snapshots-${ts} --container unlock-minio
+    kubectl -n {{ns}} logs job/{{app}}-unlock-snapshots-${ts} --container unlock-r2
+    kubectl -n {{ns}} delete job unlock-{{app}}-${ts}
+
+[doc('Snapshot a PVC for an application')]
+snapshot app ns="default":
+    #!/usr/bin/env bash
+    set -euo pipefail
+
+    # Check preconditions
+    if [[ ! -f "{{scripts_dir}}/controller.sh" ]]; then
+        echo "Controller script not found"
+        exit 1
+    fi
+    if [[ ! -f "{{scripts_dir}}/wait.sh" ]]; then
+        echo "Wait script not found"
+        exit 1
+    fi
+    if ! kubectl -n {{ns}} get replicationsources {{app}} &>/dev/null; then
+        echo "RepositorySource not found"
+        exit 1
+    fi
+
+    ts=$(date +%H%M%S)
+    controller=$({{scripts_dir}}/controller.sh {{app}} {{ns}})
+    export app="{{app}}"
+    export controller="${controller}"
+    export claim=""
+    export puid=""
+    export pgid=""
+    export ns="{{ns}}"
+    export previous=""
+    export ts="${ts}"
+
+    kubectl -n {{ns}} patch replicationsources {{app}} --type merge -p '{"spec":{"trigger":{"manual":"'${ts}'"}}}'
+    bash {{scripts_dir}}/wait.sh volsync-src-{{app}} {{ns}}
+    kubectl -n {{ns}} wait job/volsync-src-{{app}} --for condition=complete --timeout=120m
+
+[doc('Restore a PVC for an application')]
+restore app ns="default" previous="2":
+    #!/usr/bin/env bash
+    set -euo pipefail
+
+    # Check preconditions
+    if [[ ! -f "{{scripts_dir}}/controller.sh" ]]; then
+        echo "Controller script not found"
+        exit 1
+    fi
+    if [[ ! -f "{{scripts_dir}}/wait.sh" ]]; then
+        echo "Wait script not found"
+        exit 1
+    fi
+    if [[ ! -f "{{templates_dir}}/replicationdestination.tmpl.yaml" ]]; then
+        echo "ReplicationDestination script not found"
+        exit 1
+    fi
+    if [[ ! -f "{{templates_dir}}/wipe.tmpl.yaml" ]]; then
+        echo "Wipe template not found"
+        exit 1
+    fi
+
+    ts=$(date +%H%M%S)
+    controller=$({{scripts_dir}}/controller.sh {{app}} {{ns}})
+    claim=$(kubectl -n {{ns}} get replicationsources/{{app}} -o jsonpath="{.spec.sourcePVC}")
+    puid=$(kubectl -n {{ns}} get replicationsources/{{app}} -o jsonpath="{.spec.restic.moverSecurityContext.runAsUser}")
+    pgid=$(kubectl -n {{ns}} get replicationsources/{{app}} -o jsonpath="{.spec.restic.moverSecurityContext.runAsGroup}")
+
+    export app="{{app}}"
+    export controller="${controller}"
+    export claim="${claim}"
+    export puid="${puid}"
+    export pgid="${pgid}"
+    export ns="{{ns}}"
+    export previous="{{previous}}"
+    export ts="${ts}"
+
+    just volsync suspend {{app}} {{ns}} "${controller}"
+    just volsync wipe {{app}} {{ns}} "${claim}" "${puid}" "${pgid}" "${ts}"
+    just volsync restore-internal {{app}} {{ns}} "${claim}" "${puid}" "${pgid}" "${ts}"
+    just volsync resume {{app}} {{ns}}
+
+[doc('Delete volume populator PVCs in all namespaces')]
+cleanup:
+    #!/usr/bin/env bash
+    set -euo pipefail
+
+    # Delete destination PVCs
+    kubectl get pvc --all-namespaces --no-headers | grep "dst-dest" | awk '{print $1 "/" $2}' | while IFS='/' read -r namespace pvc; do
+        kubectl delete pvc -n "${namespace}" "${pvc}"
+    done
+
+    # Delete cache PVCs
+    kubectl get pvc --all-namespaces --no-headers | grep "dst-cache" | awk '{print $1 "/" $2}' | while IFS='/' read -r namespace pvc; do
+        kubectl delete pvc -n "${namespace}" "${pvc}"
+    done
+
+[private]
+[doc('Suspend the Flux ks and hr')]
+suspend app ns controller:
+    #!/usr/bin/env bash
+    set -euo pipefail
+
+    flux -n {{ns}} suspend kustomization {{app}}
+    flux -n {{ns}} suspend helmrelease {{app}}
+    kubectl -n {{ns}} scale {{controller}} --replicas 0
+    kubectl -n {{ns}} wait pod --for delete --selector="app.kubernetes.io/name={{app}}" --timeout=2m
+
+[private]
+[doc('Wipe the PVC of all data')]
+wipe app ns claim puid pgid ts:
+    #!/usr/bin/env bash
+    set -euo pipefail
+
+    export app="{{app}}"
+    export controller=""
+    export claim="{{claim}}"
+    export puid="{{puid}}"
+    export pgid="{{pgid}}"
+    export ns="{{ns}}"
+    export previous=""
+    export ts="{{ts}}"
+
+    envsubst < <(cat {{templates_dir}}/wipe.tmpl.yaml) | kubectl apply -f -
+    bash {{scripts_dir}}/wait.sh wipe-{{app}}-{{ts}} {{ns}}
+    kubectl -n {{ns}} wait job/wipe-{{app}}-{{ts}} --for condition=complete --timeout=120m
+    kubectl -n {{ns}} logs job/wipe-{{app}}-{{ts}} --container wipe
+    kubectl -n {{ns}} delete job wipe-{{app}}-{{ts}}
+
+[private]
+[doc('Create VolSync replicationdestination CR to restore data')]
+restore-internal app ns claim puid pgid ts:
+    #!/usr/bin/env bash
+    set -euo pipefail
+
+    export app="{{app}}"
+    export controller=""
+    export claim="{{claim}}"
+    export puid="{{puid}}"
+    export pgid="{{pgid}}"
+    export ns="{{ns}}"
+    export previous=""
+    export ts="{{ts}}"
+
+    envsubst < <(cat {{templates_dir}}/replicationdestination.tmpl.yaml) | kubectl apply -f -
+    bash {{scripts_dir}}/wait.sh volsync-dst-{{app}}-{{ts}} {{ns}}
+    kubectl -n {{ns}} wait job/volsync-dst-{{app}}-{{ts}} --for condition=complete --timeout=120m
+    kubectl -n {{ns}} delete replicationdestination {{app}}-{{ts}}
+
+[private]
+[doc('Resume Flux ks and hr')]
+resume app ns:
+    #!/usr/bin/env bash
+    set -euo pipefail
+
+    flux -n {{ns}} resume helmrelease {{app}}
+    flux -n {{ns}} resume kustomization {{app}}

.just/volsync/scripts/controller.sh

@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+
+APP=$1
+NAMESPACE="${2:-default}"
+
+is_deployment() {
+    kubectl -n "${NAMESPACE}" get deployment "${APP}" >/dev/null 2>&1
+}
+
+is_statefulset() {
+    kubectl -n "${NAMESPACE}" get statefulset "${APP}" >/dev/null 2>&1
+}
+
+if is_deployment; then
+    echo "deployment.apps/${APP}"
+elif is_statefulset; then
+    echo "statefulset.apps/${APP}"
+else
+    echo "No deployment or statefulset found for ${APP}"
+    exit 1
+fi

.just/volsync/scripts/wait.sh

@@ -0,0 +1,14 @@
+#!/usr/bin/env bash
+
+JOB=$1
+NAMESPACE="${2:-default}"
+CLUSTER="${3:-main}"
+
+[[ -z "${JOB}" ]] && echo "Job name not specified" && exit 1
+while true; do
+    STATUS="$(kubectl -n "${NAMESPACE}" get pod -l job-name="${JOB}" -o jsonpath='{.items[*].status.phase}')"
+    if [ "${STATUS}" == "Pending" ]; then
+        break
+    fi
+    sleep 1
+done

.just/volsync/templates/list.tmpl.yaml

@@ -0,0 +1,19 @@
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: "list-${app}-${ts}"
+  namespace: "${ns}"
+spec:
+  ttlSecondsAfterFinished: 3600
+  template:
+    spec:
+      automountServiceAccountToken: false
+      restartPolicy: OnFailure
+      containers:
+        - name: list
+          image: docker.io/restic/restic:0.18.0@sha256:4cf4a61ef9786f4de53e9de8c8f5c040f33830eb0a10bf3d614410ee2fcb6120
+          args: ["snapshots"]
+          envFrom:
+            - secretRef:
+                name: "${app}-volsync-secret"

.just/volsync/templates/replicationdestination.tmpl.yaml

@@ -0,0 +1,31 @@
+---
+apiVersion: volsync.backube/v1alpha1
+kind: ReplicationDestination
+metadata:
+  name: "${app}-${ts}"
+  namespace: "${ns}"
+spec:
+  trigger:
+    manual: restore-once
+  restic:
+    repository: "${app}-volsync-secret"
+    destinationPVC: "${claim}"
+    copyMethod: Direct
+    storageClassName: rook-ceph-block
+    # storageClassName: ceph-filesystem
+    # accessModes: ["ReadWriteMany"]
+    # IMPORTANT NOTE:
+    #   Set to the last X number of snapshots to restore from
+    previous: ${previous}
+    # OR;
+    # IMPORTANT NOTE:
+    #   On bootstrap set `restoreAsOf` to the time the old cluster was destroyed.
+    #   This will essentially prevent volsync from trying to restore a backup
+    #   from a application that started with default data in the PVC.
+    #   Do not restore snapshots made after the following RFC3339 Timestamp.
+    #   date --rfc-3339=seconds (--utc)
+    # restoreAsOf: "2022-12-10T16:00:00-05:00"
+    moverSecurityContext:
+      runAsUser: ${puid}
+      runAsGroup: ${pgid}
+      fsGroup: ${pgid}

.just/volsync/templates/unlock.tmpl.yaml

@@ -0,0 +1,25 @@
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: "unlock-${app}-${ts}"
+  namespace: "${ns}"
+spec:
+  ttlSecondsAfterFinished: 3600
+  template:
+    spec:
+      automountServiceAccountToken: false
+      restartPolicy: OnFailure
+      containers:
+        - name: unlock-minio
+          image: docker.io/restic/restic:0.18.0@sha256:4cf4a61ef9786f4de53e9de8c8f5c040f33830eb0a10bf3d614410ee2fcb6120
+          args: ["unlock", "--remove-all"]
+          envFrom:
+            - secretRef:
+                name: "${app}-volsync-secret"
+        - name: unlock-r2
+          image: docker.io/restic/restic:0.18.0@sha256:4cf4a61ef9786f4de53e9de8c8f5c040f33830eb0a10bf3d614410ee2fcb6120
+          args: ["unlock", "--remove-all"]
+          envFrom:
+            - secretRef:
+                name: "${app}-volsync-r2-secret"

.just/volsync/templates/wipe.tmpl.yaml

@@ -0,0 +1,25 @@
+---
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: "wipe-${app}-${ts}"
+  namespace: "${ns}"
+spec:
+  ttlSecondsAfterFinished: 3600
+  template:
+    spec:
+      automountServiceAccountToken: false
+      restartPolicy: OnFailure
+      containers:
+        - name: wipe
+          image: docker.io/library/busybox:latest
+          command: ["/bin/sh", "-c", "cd /config; find . -delete"]
+          volumeMounts:
+            - name: config
+              mountPath: /config
+          securityContext:
+            privileged: true
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: "${claim}"

.justfile

@@ -0,0 +1,27 @@
+#!/usr/bin/env -S just --justfile
+
+set quiet
+set shell := ['bash', '-eu', '-o', 'pipefail', '-c']
+
+[doc('Bootstrap Recipes')]
+mod bootstrap '.just/bootstrap.just'
+
+[doc('Kubernetes Recipes')]
+mod kube '.just/kube.just'
+
+[doc('Sync Recipes')]
+mod sync '.just/sync.just'
+
+[doc('Talos Recipes')]
+mod talos '.just/talos.just'
+
+[doc('Volsync')]
+mod volsync '.just/volsync.just'
+
+[private]
+default:
+    just --list
+
+[positional-arguments, private]
+log lvl msg *args:
+    gum log -t rfc3339 -s -l "{{lvl}}" "{{msg}}" {{args}}

.taskfiles/bootstrap/Taskfile.yaml

@@ -1,51 +0,0 @@
----
-# yaml-language-server: $schema=https://taskfile.dev/schema.json
-version: '3'
-
-vars:
-  BOOTSTRAP_RESOURCES_DIR: '{{.ROOT_DIR}}/.taskfiles/bootstrap/resources'
-  CLUSTER_DIR: '{{.ROOT_DIR}}/kubernetes'
-
-tasks:
-
-  base:
-    desc: Bootstrap Base Apps
-    cmds:
-      - until kubectl wait nodes --for=condition=Ready=False --all --timeout=10m; do sleep 5; done
-      - helmfile --quiet --file {{.CLUSTER_DIR}}/bootstrap/apps/helmfile.yaml apply --skip-diff-on-install --suppress-diff
-      - until kubectl wait nodes --for=condition=Ready --all --timeout=10m; do sleep 5; done
-    preconditions:
-      - talosctl config info
-      # - test -f {{.CLUSTER_DIR}}/talos/cluster-0/talosconfig
-      - test -f {{.CLUSTER_DIR}}/bootstrap/apps/helmfile.yaml
-      - which helmfile kubectl
-
-  # NOTE: Nodes must all be part of the Ceph cluster and Ceph disks must share the same disk model
-  rook:
-    desc: Bootstrap Rook-Ceph
-    cmds:
-      - minijinja-cli {{.BOOTSTRAP_RESOURCES_DIR}}/wipe-rook.yaml.j2 | kubectl apply --server-side --filename -
-      - until kubectl --namespace default get job/wipe-rook &>/dev/null; do sleep 5; done
-      - kubectl --namespace default wait job/wipe-rook --for=condition=complete --timeout=5m
-      - stern --namespace default job/wipe-rook --no-follow
-      - kubectl --namespace default delete job wipe-rook
-    env:
-      NODE_COUNT:
-        sh: talosctl config info --output json | jq --raw-output '.nodes | length'
-    preconditions:
-      - test -f {{.BOOTSTRAP_RESOURCES_DIR}}/wipe-rook.yaml.j2
-      - which jq kubectl minijinja-cli stern talosctl
-
-  flux:
-    desc: Bootstrap Flux
-    cmds:
-      - kubectl create namespace flux-system --dry-run=client -o yaml | kubectl apply --filename -
-      - cat {{.SOPS_AGE_KEY}} | kubectl --namespace flux-system create secret generic sops-age --from-file=age.agekey=/dev/stdin
-      - kubectl apply --server-side --kustomize {{.CLUSTER_DIR}}/bootstrap/flux
-      - SOPS_AGE_KEY_FILE={{.SOPS_AGE_KEY}} sops exec-file {{.CLUSTER_DIR}}/bootstrap/flux/github-deploy-key.sops.yaml "kubectl apply --server-side --filename {}"
-      - SOPS_AGE_KEY_FILE={{.SOPS_AGE_KEY}} sops exec-file {{.CLUSTER_DIR}}/flux/vars/cluster-secrets.sops.yaml "kubectl apply --server-side --filename {}"
-      - kubectl apply --server-side --filename ./flux/vars/cluster-settings.yaml
-
-  apps:
-    desc: Bootstrap Flux
-      - kubectl apply --server-side --kustomize {{.CLUSTER_DIR}}/flux/config

ansible/devbox.json

@@ -1,4 +1,4 @@
 {
   "$schema": "https://raw.githubusercontent.com/jetify-com/devbox/0.12.0/.schema/devbox.schema.json",
-  "packages": ["ansible@2.18.4", "sshpass@latest"]
+  "packages": ["ansible@2.18.7", "sshpass@latest"]
 }

ansible/devbox.lock

@@ -1,67 +1,67 @@
 {
   "lockfile_version": "1",
   "packages": {
-    "ansible@latest": {
-      "last_modified": "2024-07-07T07:43:47Z",
-      "resolved": "github:NixOS/nixpkgs/b60793b86201040d9dee019a05089a9150d08b5b#ansible",
+    "ansible@2.18.7": {
+      "last_modified": "2025-07-24T15:00:16Z",
+      "resolved": "github:NixOS/nixpkgs/b74a30dbc0a72e20df07d43109339f780b439291#ansible",
       "source": "devbox-search",
-      "version": "2.16.5",
+      "version": "2.18.7",
       "systems": {
         "aarch64-darwin": {
           "outputs": [
             {
               "name": "out",
-              "path": "/nix/store/iib6zk86p80bnhp0yshswrlb4n7jwa27-python3.12-ansible-core-2.16.5",
+              "path": "/nix/store/qmar5zgs9lxar7b7mriazvrka20hcslx-python3.13-ansible-core-2.18.7",
               "default": true
             },
             {
               "name": "dist",
-              "path": "/nix/store/9parf4f1ysgrxnv627b42q4i3g43y6xn-python3.12-ansible-core-2.16.5-dist"
+              "path": "/nix/store/1vwgkixmh7bm5qj8v03db8b5dnmp65q3-python3.13-ansible-core-2.18.7-dist"
             }
           ],
-          "store_path": "/nix/store/iib6zk86p80bnhp0yshswrlb4n7jwa27-python3.12-ansible-core-2.16.5"
+          "store_path": "/nix/store/qmar5zgs9lxar7b7mriazvrka20hcslx-python3.13-ansible-core-2.18.7"
         },
         "aarch64-linux": {
           "outputs": [
             {
               "name": "out",
-              "path": "/nix/store/karakqxirk7fzqcqrk76q908gxrhqbdj-python3.12-ansible-core-2.16.5",
+              "path": "/nix/store/zi2xpjjb9d6l2blr95pxdvwcjw9jjaxd-python3.13-ansible-core-2.18.7",
               "default": true
             },
             {
               "name": "dist",
-              "path": "/nix/store/2yja52manchr4pl09xpz5xc7f0717n8g-python3.12-ansible-core-2.16.5-dist"
+              "path": "/nix/store/6car8i7dyqcmr0x2n7z4p3d12rim2k0j-python3.13-ansible-core-2.18.7-dist"
             }
           ],
-          "store_path": "/nix/store/karakqxirk7fzqcqrk76q908gxrhqbdj-python3.12-ansible-core-2.16.5"
+          "store_path": "/nix/store/zi2xpjjb9d6l2blr95pxdvwcjw9jjaxd-python3.13-ansible-core-2.18.7"
         },
         "x86_64-darwin": {
           "outputs": [
             {
               "name": "out",
-              "path": "/nix/store/rda1qbxlmz6djni83pndqw9gxbbr85cg-python3.12-ansible-core-2.16.5",
+              "path": "/nix/store/w8kipz2an728f5cjys6bpmkk42p6mmhf-python3.13-ansible-core-2.18.7",
               "default": true
             },
             {
               "name": "dist",
-              "path": "/nix/store/mc7l7avn2za2rl6hv69jzs31ybi4m7dc-python3.12-ansible-core-2.16.5-dist"
+              "path": "/nix/store/cq7k1xwcl1z6g76qf0cdyw46dsi4c9s5-python3.13-ansible-core-2.18.7-dist"
             }
           ],
-          "store_path": "/nix/store/rda1qbxlmz6djni83pndqw9gxbbr85cg-python3.12-ansible-core-2.16.5"
+          "store_path": "/nix/store/w8kipz2an728f5cjys6bpmkk42p6mmhf-python3.13-ansible-core-2.18.7"
         },
         "x86_64-linux": {
           "outputs": [
             {
               "name": "out",
-              "path": "/nix/store/whq5kfbhx2ci4hrm6bl8z98fpi33mvkd-python3.12-ansible-core-2.16.5",
+              "path": "/nix/store/2q4k547d89dnvxpyw7qql77bwpc34dby-python3.13-ansible-core-2.18.7",
               "default": true
             },
             {
               "name": "dist",
-              "path": "/nix/store/ih4c11ss3d96ljawj0ywyfyia70g8v2j-python3.12-ansible-core-2.16.5-dist"
+              "path": "/nix/store/sp5myxai1h56n8q4d6hjpz0n7raxp7yx-python3.13-ansible-core-2.18.7-dist"
             }
           ],
-          "store_path": "/nix/store/whq5kfbhx2ci4hrm6bl8z98fpi33mvkd-python3.12-ansible-core-2.16.5"
+          "store_path": "/nix/store/2q4k547d89dnvxpyw7qql77bwpc34dby-python3.13-ansible-core-2.18.7"
         }
       }
     },

docs/README.md

@@ -0,0 +1,11 @@
+# 📚 Documentation Index
+
+Welcome to the home-ops documentation! This directory contains guides and references for various infrastructure components.
+
+## 🗄️ Storage Server
+
+### [STORAGE.md](./STORAGE.md)
+
+📋 **Complete guide for deploying a custom storage server**
+
+This document provides step-by-step instructions for creating a bootable ISO that automatically installs and configures a dedicated storage server using **bootc-image-builder**

docs/STORAGE.md

@@ -0,0 +1,67 @@
+# 🗄️ Storage Installation Guide
+
+> 📋 **Overview**: This guide walks you through creating a custom bootable ISO for deploying storage.feisar.ovh server using bootc-image-builder.
+
+## ⚙️ Step 1: Create Configuration File
+
+Create a `config.toml` file with the following content:
+
+```toml
+[customizations.installer.kickstart]
+contents = """
+text
+zerombr
+clearpart --all --initlabel --disklabel=gpt
+autopart --type=lvm --fstype=xfs --noswap
+network --hostname storage.${SECRET_INTERNAL_DOMAIN} --bootproto=dhcp --device=link --activate --onboot=on
+timezone UTC
+rootpw --lock
+user --name=core --homedir=/var/home/core --password="password" --plaintext --groups=wheel
+bootloader --append="console=tty0 console=ttyS0,115200"
+"""
+
+[customizations.installer.modules]
+enable = [
+  "org.fedoraproject.Anaconda.Modules.Localization",
+  "org.fedoraproject.Anaconda.Modules.Storage",
+  "org.fedoraproject.Anaconda.Modules.Timezone",
+  "org.fedoraproject.Anaconda.Modules.Users",
+  "org.fedoraproject.Anaconda.Modules.Network",
+]
+disable = [
+  "org.fedoraproject.Anaconda.Modules.Security",
+  "org.fedoraproject.Anaconda.Modules.Services",
+  "org.fedoraproject.Anaconda.Modules.Subscription"
+]
+```
+
+## 🚀 Step 2: Build the ISO
+
+Run the bootc-image-builder using [bootc-image-builder](https://github.com/osbuild/bootc-image-builder):
+```bash
+sudo podman pull ghcr.io/ublue-os/cayo:centos10
+mkdir output
+sudo podman run \
+    --rm \
+    -it \
+    --privileged \
+    --security-opt label=type:unconfined_t \
+    -v ./config.toml:/config.toml:ro \
+    -v ./output:/output \
+    -v /var/lib/containers/storage:/var/lib/containers/storage \
+    quay.io/centos-bootc/bootc-image-builder:latest \
+    --type anaconda-iso \
+    --use-librepo=True \
+    ghcr.io/ublue-os/cayo:centos10
+```
+
+## 📍 Step 3: Locate Your ISO
+
+After successful completion, look for the `.iso` file in `./output` directory
+
+---
+
+📚 **References**:
+- [Kickstart Documentation](https://pykickstart.readthedocs.io/en/latest/kickstart-docs.html)
+- [bootc-image-builder GitHub](https://github.com/osbuild/bootc-image-builder)
+- [Universal Blue Cayo](https://github.com/ublue-os/cayo)

kubernetes/apps/cert-manager/cert-manager/app/helmrelease.yaml

@@ -1,6 +1,6 @@
 ---
 # yaml-language-server: $schema=https://kubernetes-schemas.pages.dev/source.toolkit.fluxcd.io/ocirepository_v1beta2.json
-apiVersion: source.toolkit.fluxcd.io/v1beta2
+apiVersion: source.toolkit.fluxcd.io/v1
 kind: OCIRepository
 metadata:
   name: cert-manager

kubernetes/apps/cert-manager/cert-manager/ks.yaml

@@ -25,7 +25,7 @@ spec:
   retryInterval: 2m
   sourceRef:
     kind: GitRepository
-    name: home-ops-kubernetes
+    name: flux-system
     namespace: flux-system
   targetNamespace: *namespace
   timeout: 5m