obs livesync

.gitignore

@@ -1,4 +1,7 @@
 pvs/
 
 *.sql
-*.tar.gz
+*.sql.gz
+*.tar.gz
+*.secret.yaml
+ntwl.sublime-workspace

CLAUDE.md

@@ -9,12 +9,9 @@ This file provides guidance to Claude Code (claude.ai/code) when working with co
 
 ## Style Guidelines
 1. YAML Formatting:
-   - Use 2-space indentation
-   - Use snake_case for keys
-   - Keep line length under 100 characters
+   - Use 4-space indentation
 
 2. Kubernetes Resources:
-   - Include resource limits/requests in all deployments
    - Add appropriate labels and annotations
    - Group related resources in the same file
    - Use namespaces to organize resources by service

README.md

@@ -4,6 +4,7 @@
 
 ### Media
 
+[ ] move strix gmail to mnml
 [ ] sabnzbd ini config map
 [ ] tdarr
 [ ] subtitle extractor

crates/crates.cron.yaml

@@ -1,88 +1,67 @@
----
+# ---
 
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: crates-postgres-backup-pv
-spec:
-  storageClassName: ""
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  claimRef:
-    namespace: default
-    name: crates-postgres-backup-pvc
-  hostPath:
-    # Into homedir so we can scp it ez
-    path: "/home/ntr/archives/crates-postgres"
-    type: DirectoryOrCreate
+# kind: PersistentVolumeClaim
+# apiVersion: v1
+# metadata:
+#   name: crates-postgres-backup-pvc
+# spec:
+#   volumeName: crates-postgres-backup-pv
+#   accessModes:
+#     - ReadWriteOnce
+#   resources:
+#     requests:
+#       storage: 1Gi
 
----
+# ---
 
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: crates-postgres-backup-pvc
-spec:
-  volumeName: crates-postgres-backup-pv
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
+# apiVersion: batch/v1
+# kind: CronJob
+# metadata:
+#   name: crates-db-backup
+# spec:
+#   schedule: "20 4 * * *"
+#   jobTemplate:
+#     spec:
+#       template:
+#         metadata:
+#           labels:
+#             app: crates-postgres-backup
+#         spec:
+#           restartPolicy: Never
+#           containers:
+#             - name: crates-postgres-backup
+#               image: postgres:16
+#               command:
+#                 - "/bin/sh"
+#                 - "-c"
+#                 -
+#                   |
+#                     cd /mnt/dest/
+#                     TZ="Australia/Melbourne"
+#                     TIMESTAMP=$(date '+%Y-%m-%d-%H-%M-%S')
+#                     DEST=crates-$TIMESTAMP.sql.gz
 
----
+#                     echo "Backing up to $DEST"
+#                     pg_dump --dbname=$POSTGRES_URL | gzip > $DEST
+#                     echo "Backup Complete"
 
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: crates-db-backup
-spec:
-  schedule: "20 4 * * *"
-  jobTemplate:
-    spec:
-      template:
-        metadata:
-          labels:
-            app: crates-postgres-backup
-        spec:
-          restartPolicy: Never
-          containers:
-            - name: crates-postgres-backup
-              image: postgres:16
-              command:
-                - "/bin/sh"
-                - "-c"
-                -
-                  |
-                    cd /mnt/dest/
-                    TZ="Australia/Melbourne"
-                    TIMESTAMP=$(date '+%Y-%m-%d-%H-%M-%S')
-                    DEST=crates-$TIMESTAMP.sql.gz
+#                     echo "Removing old copies..."
+#                     find . -type f -name "*.sql.gz" -mtime 7  | xargs rm -v
 
-                    echo "Backing up to $DEST"
-                    pg_dump --dbname=$POSTGRES_URL | gzip > $DEST
-                    echo "Backup Complete"
+#                     echo "Setting latest link..."
+#                     ln -nfs $DEST latest.sql.gz
+#               env:
+#                 - name: POSTGRES_URL
+#                   valueFrom:
+#                     secretKeyRef:
+#                       name: crates
+#                       key: POSTGRES_URL
+#               volumeMounts:
+#                 - name: crates-postgres-backup-storage
+#                   mountPath: /mnt/dest
+#           volumes:
+#             - name: crates-postgres-backup-storage
+#               persistentVolumeClaim:
+#                 claimName: crates-postgres-backup-pvc
 
-                    echo "Removing old copies..."
-                    find . -type f -name "*.sql.gz" -mtime 7  | xargs rm -v
-
-                    echo "Setting latest link..."
-                    ln -nfs $DEST latest.sql.gz
-              env:
-                - name: POSTGRES_URL
-                  valueFrom:
-                    secretKeyRef:
-                      name: crates
-                      key: POSTGRES_URL
-              volumeMounts:
-                - name: crates-postgres-backup-storage
-                  mountPath: /mnt/dest
-          volumes:
-            - name: crates-postgres-backup-storage
-              persistentVolumeClaim:
-                claimName: crates-postgres-backup-pvc
-
----
+# ---

crates/crates.ingress.yaml

@@ -7,6 +7,7 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
+  namespace: crates
   name: crates-client
   annotations:
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
@@ -14,19 +15,9 @@ spec:
   ingressClassName: haproxy
   tls:
   - hosts:
-    - crates.strix.systems
-    secretName: crates-strix-systems-tls
+    - crates.ntwl.xyz
+    secretName: crates-ntwl-xyz-tls
   rules:
-  - host: crates.strix.systems
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: crates-client
-            port:
-              number: 8080
   - host: crates.ntwl.xyz
     http:
       paths:
@@ -43,28 +34,18 @@ spec:
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
+  name: crates-api
+  namespace: crates
   annotations:
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
     haproxy.org/path-rewrite: "/api(/)?(.*) /$2"
-  name: crates-api
-  namespace: default
 spec:
   ingressClassName: haproxy
   tls:
   - hosts:
-    - crates.strix.systems
-    secretName: crates-strix-systems-tls
+    - crates.ntwl.xyz
+    secretName: crates-ntwl-xyz-tls
   rules:
-  - host: crates.strix.systems
-    http:
-      paths:
-      - path: /api(/|$)(.*)
-        pathType: ImplementationSpecific
-        backend:
-          service:
-            name: crates-api
-            port:
-              number: 41337
   - host: crates.ntwl.xyz
     http:
       paths:

crates/crates.yaml

@@ -1,35 +1,37 @@
+---
+
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: crates
+
 # -----------------------------------------------------------------------
 # VOLUMES
 # -----------------------------------------------------------------------
 
 ---
 
+kind: PersistentVolumeClaim
 apiVersion: v1
-kind: PersistentVolume
 metadata:
-  name: crates-postgres-pv
+  name: crates-postgres-data
+  namespace: crates
 spec:
-  storageClassName: ""
-  capacity:
-    storage: 1Gi
+  storageClassName: zfs-fast
   accessModes:
     - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  claimRef:
-    namespace: default
-    name: crates-postgres-pvc
-  hostPath:
-    path: "/var/lib/rancher/k3s/storage/crates-postgres-pv"
-    type: DirectoryOrCreate
+  resources:
+    requests:
+      storage: 2Gi
 
 ---
 
 kind: PersistentVolumeClaim
 apiVersion: v1
 metadata:
-  name: crates-postgres-pvc
+  name: crates-postgres-bootstrap
+  namespace: crates
 spec:
-  volumeName: crates-postgres-pv
   accessModes:
     - ReadWriteOnce
   resources:
@@ -46,6 +48,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: crates-postgres
+  namespace: crates
 spec:
   replicas: 1
   selector:
@@ -80,17 +83,23 @@ spec:
           volumeMounts:
             - name: crates-postgres-storage
               mountPath: /var/lib/postgresql/data
+            - name: crates-postgres-bootstrap
+              mountPath: /docker-entrypoint-initdb.d
 
       volumes:
         - name: crates-postgres-storage
           persistentVolumeClaim:
-            claimName: crates-postgres-pvc
+            claimName: crates-postgres-data
+        - name: crates-postgres-bootstrap
+          persistentVolumeClaim:
+            claimName: crates-postgres-bootstrap
 
 ---
 
 apiVersion: apps/v1
 kind: Deployment
 metadata:
+  namespace: crates
   name: crates-api
 spec:
   replicas: 1
@@ -104,7 +113,7 @@ spec:
     spec:
       containers:
         - name: crates-api
-          image: registry.strix.systems/crates-api
+          image: registry.ntwl.xyz/crates-api
           imagePullPolicy: Always
           ports:
             - containerPort: 80
@@ -133,38 +142,32 @@ spec:
 
 ---
 
-apiVersion: apps/v1
-kind: Deployment
+apiVersion: v1
+kind: Pod
 metadata:
+  namespace: crates
   name: crates-migrate
 spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: crates-migrate
-  template:
-    metadata:
-      labels:
-        app: crates-migrate
-    spec:
-      containers:
-        - name: crates-migrate
-          image: registry.strix.systems/crates-api
-          imagePullPolicy: IfNotPresent
-          command: ["npx"]
-          args: ["prisma", "migrate", "deploy"]
-          env:
-            - name: DATABASE_URL
-              valueFrom:
-                secretKeyRef:
-                  name: crates
-                  key: DATABASE_URL
+  restartPolicy: OnFailure
+  containers:
+    - name: crates-migrate
+      image: registry.ntwl.xyz/crates-api
+      imagePullPolicy: IfNotPresent
+      command: ["npx"]
+      args: ["prisma", "migrate", "deploy"]
+      env:
+        - name: DATABASE_URL
+          valueFrom:
+            secretKeyRef:
+              name: crates
+              key: DATABASE_URL
 
 ---
 
 apiVersion: apps/v1
 kind: Deployment
 metadata:
+  namespace: crates
   name: crates-client
 spec:
   replicas: 1
@@ -178,7 +181,7 @@ spec:
     spec:
       containers:
         - name: crates-client
-          image: registry.strix.systems/crates-client
+          image: registry.ntwl.xyz/crates-client
           imagePullPolicy: Always
           ports:
             - containerPort: 8080
@@ -192,6 +195,7 @@ spec:
 apiVersion: v1
 kind: Service
 metadata:
+  namespace: crates
   name: crates-api
 spec:
   selector:
@@ -204,6 +208,7 @@ spec:
 apiVersion: v1
 kind: Service
 metadata:
+  namespace: crates
   name: crates-postgres
 spec:
   selector:
@@ -216,6 +221,7 @@ spec:
 apiVersion: v1
 kind: Service
 metadata:
+  namespace: crates
   name: crates-client
 spec:
   selector:

media/jellyfin.yaml

@@ -33,6 +33,10 @@ spec:
               value: '1000'
             - name: UMASK
               value: '002'
+            - name: NVIDIA_VISIBLE_DEVICES
+              value: all
+            - name: NVIDIA_DRIVER_CAPABILITIES
+              value: all
           ports:
             - containerPort: 8096
               protocol: TCP

memestream/memestream.client.yaml

@@ -8,6 +8,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: memestream-client
+  namespace: memestream
 spec:
   replicas: 1
   selector:
@@ -20,7 +21,7 @@ spec:
     spec:
       containers:
         - name: memestream-client
-          image: registry.strix.systems/memestream-client
+          image: registry.ntwl.xyz/memestream-client
           imagePullPolicy: Always
           ports:
             - containerPort: 8080
@@ -37,6 +38,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: memestream-client
+  namespace: memestream
 spec:
   selector:
     app: memestream-client

memestream/memestream.ingress.yaml

@@ -1,29 +1,23 @@
+---
+
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: memestream-client
+  name: memestream
+  namespace: memestream
   annotations:
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
 spec:
   ingressClassName: haproxy
   tls:
-  - hosts:
-    - memestream.strix.systems
-    - search.memestream.strix.systems
-    - memestream.ntwl.xyz
-    - search.memestream.ntwl.xyz
-    secretName: memestream-strix-systems-tls
+    - secretName: memestream-ntwl-xyz-tls
+      hosts:
+        - memestream.ntwl.xyz
+        - search.memestream.ntwl.xyz
+        - storage.memestream.ntwl.xyz
+        - minio.memestream.ntwl.xyz
+
   rules:
-  - host: search.memestream.strix.systems
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: memestream-meili
-            port:
-              number: 7700
   - host: search.memestream.ntwl.xyz
     http:
       paths:
@@ -34,16 +28,7 @@ spec:
             name: memestream-meili
             port:
               number: 7700
-  - host: memestream.strix.systems
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: memestream-client
-            port:
-              number: 8080
+
   - host: memestream.ntwl.xyz
     http:
       paths:
@@ -53,4 +38,26 @@ spec:
           service:
             name: memestream-client
             port:
-              number: 8080
+              number: 8080
+
+  - host: storage.memestream.ntwl.xyz
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: memestream-minio
+            port:
+              number: 9000
+
+  - host: minio.memestream.ntwl.xyz
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: memestream-minio
+            port:
+              number: 9090

memestream/memestream.minio.yaml

@@ -0,0 +1,115 @@
+# -----------------------------------------------------------------------
+# VOLUMES
+# -----------------------------------------------------------------------
+
+---
+
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: memestream-minio-pvc
+  namespace: memestream
+spec:
+  storageClassName: fast
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 20Gi
+
+---
+
+# -----------------------------------------------------------------------
+# DEPLOYMENTS
+# -----------------------------------------------------------------------
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: memestream-minio
+  namespace: memestream
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: minio
+  template:
+    metadata:
+      labels:
+        app: minio
+
+    spec:
+      containers:
+        - name: minio
+          image: docker.io/minio/minio:latest
+          command: ['minio']
+          args: ['server', '/data']
+          env:
+          - name: MINIO_PROMETHEUS_AUTH_TYPE
+            value: public
+          - name: MINIO_CONSOLE_ADDRESS
+            value: :9090
+          - name: MINIO_ROOT_USER
+            valueFrom:
+              secretKeyRef:
+                name: memestream-minio
+                key: MINIO_ROOT_USER
+          - name: MINIO_ROOT_PASSWORD
+            valueFrom:
+              secretKeyRef:
+                name: memestream-minio
+                key: MINIO_ROOT_PASSWORD
+          resources:
+            limits:
+              memory: "1Gi"
+          ports:
+          - name: console
+            containerPort: 9090
+            protocol: TCP
+          - name: api
+            containerPort: 9000
+            protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /minio/health/live
+              port: 9000
+            initialDelaySeconds: 120
+            periodSeconds: 20
+          readinessProbe:
+            httpGet:
+              path: /minio/health/ready
+              port: 9000
+            initialDelaySeconds: 10
+            periodSeconds: 20
+            successThreshold: 2
+          volumeMounts:
+          - mountPath: /data
+            name: memestream-minio-storage
+
+      volumes:
+        - name: memestream-minio-storage
+          persistentVolumeClaim:
+            claimName: memestream-minio-pvc
+
+
+---
+
+apiVersion: v1
+kind: Service
+metadata:
+  name: memestream-minio
+  namespace: memestream
+  labels:
+    app: minio
+spec:
+  ports:
+  - name: api
+    port: 9000
+    protocol: TCP
+    targetPort: 9000
+  - name: console
+    port: 9090
+    protocol: TCP
+    targetPort: 9090
+  selector:
+    app: minio

memestream/memestream.yaml

@@ -1,26 +1,13 @@
-# -----------------------------------------------------------------------
-# VOLUMES
-# -----------------------------------------------------------------------
-
 ---
 
 apiVersion: v1
-kind: PersistentVolume
+kind: Namespace
 metadata:
-  name: memestream-postgres-pv
-spec:
-  storageClassName: ""
-  capacity:
-    storage: 2Gi
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  claimRef:
-    namespace: default
-    name: memestream-postgres-pvc
-  hostPath:
-    path: "/var/lib/rancher/k3s/storage/memestream-postgres-pv"
-    type: DirectoryOrCreate
+  name: memestream
+
+# -----------------------------------------------------------------------
+# VOLUMES
+# -----------------------------------------------------------------------
 
 ---
 
@@ -28,8 +15,9 @@ kind: PersistentVolumeClaim
 apiVersion: v1
 metadata:
   name: memestream-postgres-pvc
+  namespace: memestream
 spec:
-  volumeName: memestream-postgres-pv
+  storageClassName: fast
   accessModes:
     - ReadWriteOnce
   resources:
@@ -38,32 +26,13 @@ spec:
 
 ---
 
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: memestream-meili-pv
-spec:
-  storageClassName: ""
-  capacity:
-    storage: 5Gi
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  claimRef:
-    namespace: default
-    name: memestream-meili-pvc
-  hostPath:
-    path: "/var/lib/rancher/k3s/storage/memestream-meili-pv"
-    type: DirectoryOrCreate
-
----
-
 kind: PersistentVolumeClaim
 apiVersion: v1
 metadata:
   name: memestream-meili-pvc
+  namespace: memestream
 spec:
-  volumeName: memestream-meili-pv
+  storageClassName: zfs-fast
   accessModes:
     - ReadWriteOnce
   resources:
@@ -80,6 +49,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: memestream-archiver
+  namespace: memestream
 spec:
   replicas: 1
   selector:
@@ -92,7 +62,7 @@ spec:
     spec:
       containers:
         - name: memestream-archiver
-          image: registry.strix.systems/memestream-archiver
+          image: registry.ntwl.xyz/memestream-archiver
           imagePullPolicy: Always
           envFrom:
           - secretRef:
@@ -104,6 +74,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: memestream-postgres
+  namespace: memestream
 spec:
   replicas: 1
   selector:
@@ -150,6 +121,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: memestream-meili
+  namespace: memestream
 spec:
   replicas: 1
   selector:
@@ -176,8 +148,8 @@ spec:
               mountPath: /meili_data
           resources:
             limits:
-              memory: "1Gi"
-              cpu: "1000m"
+              memory: "2Gi"
+              cpu: "2000m"
 
       volumes:
         - name: memestream-meili-storage
@@ -195,6 +167,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: memestream-postgres
+  namespace: memestream
 spec:
   selector:
     app: memestream-postgres
@@ -207,8 +180,9 @@ apiVersion: v1
 kind: Service
 metadata:
   name: memestream-meili
+  namespace: memestream
 spec:
   selector:
     app: memestream-meili
   ports:
-    - port: 7700
+    - port: 7700

mnml/mnml.ingress.yaml

@@ -1,84 +1,45 @@
 ---
 # -----------------------------------------------------------------------
-# INGRESS
+# COMBINED INGRESS
 # -----------------------------------------------------------------------
 
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: mnml-client
-  annotations:
-    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    name: mnml
+    namespace: mnml
+    annotations:
+        cert-manager.io/cluster-issuer: "letsencrypt-prod"
+        haproxy.org/websocket-support: "true"
+        haproxy.org/timeout-tunnel: "3600s"
 spec:
-  ingressClassName: haproxy
-  tls:
-  - hosts:
-    - mnml.gg
-    secretName: mnml-tls
-  rules:
-  - host: mnml.gg
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: mnml-client
-            port:
-              number: 8080
-
----
-
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: mnml-api
-  namespace: default
-  annotations:
-    cert-manager.io/cluster-issuer: "letsencrypt-prod"
-    haproxy.org/websocket-support: "true"
-spec:
-  ingressClassName: haproxy
-  tls:
-  - hosts:
-    - mnml.gg
-    secretName: mnml-tls
-  rules:
-  - host: mnml.gg
-    http:
-      paths:
-      - path: /api
-        pathType: Prefix
-        backend:
-          service:
-            name: mnml-api
-            port:
-              number: 40000
-
----
-
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: mnml-ws
-  annotations:
-    cert-manager.io/cluster-issuer: "letsencrypt-prod"
-    haproxy.org/websocket-support: "true"
-    haproxy.org/timeout-tunnel: "3600s"
-spec:
-  ingressClassName: haproxy
-  tls:
-  - hosts:
-    - mnml.gg
-    secretName: mnml-tls
-  rules:
-  - host: mnml.gg
-    http:
-      paths:
-      - path: /api/ws
-        pathType: Exact
-        backend:
-          service:
-            name: mnml-ws
-            port:
-              number: 40055
+    ingressClassName: haproxy
+    tls:
+    - hosts:
+        - mnml.gg
+      secretName: mnml-tls
+    rules:
+    - host: mnml.gg
+      http:
+        paths:
+        - path: /
+          pathType: Prefix
+          backend:
+            service:
+              name: mnml-client
+              port:
+                number: 8080
+        - path: /api
+          pathType: Prefix
+          backend:
+            service:
+              name: mnml-api
+              port:
+                number: 40000
+        - path: /api/ws
+          pathType: Exact
+          backend:
+            service:
+              name: mnml-ws
+              port:
+                number: 40055

mnml/mnml.yaml

@@ -1,35 +1,24 @@
+---
+
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: mnml
+
 # -----------------------------------------------------------------------
 # VOLUMES
 # -----------------------------------------------------------------------
 
 ---
 
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: mnml-postgres-pv
-spec:
-  storageClassName: local-path
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  claimRef:
-    namespace: default
-    name: mnml-postgres-pvc
-  hostPath:
-    path: "/var/lib/rancher/k3s/storage/mnml-postgres-pv"
-    type: DirectoryOrCreate
-
----
-
 kind: PersistentVolumeClaim
 apiVersion: v1
+
 metadata:
+  namespace: mnml
   name: mnml-postgres-pvc
 spec:
-  volumeName: mnml-postgres-pv
+  storageClassName: fast
   accessModes:
     - ReadWriteOnce
   resources:
@@ -38,38 +27,19 @@ spec:
 
 ---
 
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: mnml-imgs-pv
-spec:
-  storageClassName: local-path
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  claimRef:
-    namespace: default
-    name: mnml-imgs-pvc
-  hostPath:
-    path: "/var/lib/rancher/k3s/storage/mnml-imgs-pv"
-    type: DirectoryOrCreate
-
-
----
-
 kind: PersistentVolumeClaim
 apiVersion: v1
+
 metadata:
+  namespace: mnml
   name: mnml-imgs-pvc
 spec:
-  volumeName: mnml-imgs-pv
+  storageClassName: fast
   accessModes:
     - ReadWriteOnce
   resources:
     requests:
-      storage: 1Gi
+      storage: 2Gi
 
 ---
 
@@ -80,7 +50,9 @@ spec:
 
 apiVersion: apps/v1
 kind: Deployment
+
 metadata:
+  namespace: mnml
   name: mnml-postgres
 spec:
   replicas: 1
@@ -94,7 +66,7 @@ spec:
     spec:
       containers:
         - name: postgres
-          image: postgres:latest
+          image: postgres:16
           ports:
             - containerPort: 5432
           env:
@@ -126,7 +98,9 @@ spec:
 
 apiVersion: apps/v1
 kind: Deployment
+
 metadata:
+  namespace: mnml
   name: mnml-api
 spec:
   replicas: 1
@@ -140,7 +114,7 @@ spec:
     spec:
       containers:
         - name: mnml-api
-          image: registry.strix.systems/mnml-api
+          image: registry.ntwl.xyz/mnml-api
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 40000
@@ -191,7 +165,9 @@ spec:
 
 apiVersion: apps/v1
 kind: Deployment
+
 metadata:
+  namespace: mnml
   name: mnml-client
 spec:
   replicas: 1
@@ -205,7 +181,7 @@ spec:
     spec:
       containers:
         - name: mnml-client
-          image: registry.strix.systems/mnml-client
+          image: registry.ntwl.xyz/mnml-client
           imagePullPolicy: IfNotPresent
           ports:
             - containerPort: 8080
@@ -225,7 +201,9 @@ spec:
 
 apiVersion: v1
 kind: Service
+
 metadata:
+  namespace: mnml
   name: mnml-api
 spec:
   selector:
@@ -238,7 +216,9 @@ spec:
 
 apiVersion: v1
 kind: Service
+
 metadata:
+  namespace: mnml
   name: mnml-ws
 spec:
   selector:
@@ -251,7 +231,9 @@ spec:
 
 apiVersion: v1
 kind: Service
+
 metadata:
+  namespace: mnml
   name: mnml-postgres
 spec:
   selector:
@@ -263,7 +245,9 @@ spec:
 
 apiVersion: v1
 kind: Service
+
 metadata:
+  namespace: mnml
   name: mnml-client
 spec:
   selector:

monitor/kube-prometheus.yaml

@@ -0,0 +1,12 @@
+---
+
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: lgtm
+  namespace: monitor
+spec:
+  repo: https://grafana.github.io/helm-charts
+  chart: lgtm-distributed
+  targetNamespace: monitor
+  # valuesContent: |-

monitor/monitor.yaml

@@ -0,0 +1,6 @@
+---
+
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: monitor

networking/pihole.yaml

@@ -1,168 +1,168 @@
----
+# ---
 
-# -----------------------------------------------------------------------
-# DEPLOYMENTS
-# -----------------------------------------------------------------------
+# # -----------------------------------------------------------------------
+# # DEPLOYMENTS
+# # -----------------------------------------------------------------------
 
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: pihole
-  namespace: networking
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: pihole
-  template:
-    metadata:
-      labels:
-        app: pihole
-    spec:
-      containers:
-        - name: pihole
-          image: pihole/pihole:latest
-          imagePullPolicy: IfNotPresent
-          env:
-            - name: TZ
-              value: "Australia/Melbourne"
-            - name: FTLCONF_webserver_api_password
-              value: grepgrepgrep
-            # allow it to respond to devices outside cluster
-            - name: FTLCONF_dns_listeningMode
-              value: single
+# apiVersion: apps/v1
+# kind: Deployment
+# metadata:
+#   name: pihole
+#   namespace: networking
+# spec:
+#   replicas: 1
+#   selector:
+#     matchLabels:
+#       app: pihole
+#   template:
+#     metadata:
+#       labels:
+#         app: pihole
+#     spec:
+#       containers:
+#         - name: pihole
+#           image: pihole/pihole:latest
+#           imagePullPolicy: IfNotPresent
+#           env:
+#             - name: TZ
+#               value: "Australia/Melbourne"
+#             - name: FTLCONF_webserver_api_password
+#               value: grepgrepgrep
+#             # allow it to respond to devices outside cluster
+#             - name: FTLCONF_dns_listeningMode
+#               value: single
 
-            # resolve wildcards
-            - name: FTLCONF_misc_dnsmasq_lines
-              value: address=/nightowl.strix.systems/192.168.1.88
-          ports:
-            - containerPort: 53
-              protocol: TCP
-            - containerPort: 53
-              protocol: UDP
-            - containerPort: 67
-              protocol: UDP
-            - containerPort: 80
-              protocol: TCP
-            - containerPort: 443
-              protocol: TCP
-          # volumeMounts:
-          #   - name: etc
-          #     mountPath: /etc/pihole
-          #   - name: dnsmasq
-          #     mountPath: /etc/dnsmasq.d
-          resources:
-            requests:
-              memory: 128Mi
-              cpu: 100m
-            limits:
-              memory: 2Gi
-              cpu: 1
-      # volumes:
-      #   - name: etc
-      #     hostPath:
-      #       path: /data/pihole/etc
-      #       type: Directory
-      #   - name: dnsmasq
-      #     hostPath:
-      #       path: /data/pihole/dnsmasq.d
-      #       type: Directory
+#             # resolve wildcards
+#             - name: FTLCONF_misc_dnsmasq_lines
+#               value: address=/nightowl.strix.systems/192.168.1.88
+#           ports:
+#             - containerPort: 53
+#               protocol: TCP
+#             - containerPort: 53
+#               protocol: UDP
+#             - containerPort: 67
+#               protocol: UDP
+#             - containerPort: 80
+#               protocol: TCP
+#             - containerPort: 443
+#               protocol: TCP
+#           # volumeMounts:
+#           #   - name: etc
+#           #     mountPath: /etc/pihole
+#           #   - name: dnsmasq
+#           #     mountPath: /etc/dnsmasq.d
+#           resources:
+#             requests:
+#               memory: 128Mi
+#               cpu: 100m
+#             limits:
+#               memory: 2Gi
+#               cpu: 1
+#       # volumes:
+#       #   - name: etc
+#       #     hostPath:
+#       #       path: /data/pihole/etc
+#       #       type: Directory
+#       #   - name: dnsmasq
+#       #     hostPath:
+#       #       path: /data/pihole/dnsmasq.d
+#       #       type: Directory
 
-# -----------------------------------------------------------------------
-# SERVICES
-# -----------------------------------------------------------------------
+# # -----------------------------------------------------------------------
+# # SERVICES
+# # -----------------------------------------------------------------------
 
----
+# ---
 
-kind: Service
-apiVersion: v1
-metadata:
-  name: pihole
-  namespace: networking
-spec:
-  selector:
-    app: pihole
-  ports:
-    - name: web
-      port: 80
-      targetPort: 80
-    - name: dns-tcp
-      port: 53
-      targetPort: 53
-      protocol: TCP
-    - name: dns-udp
-      port: 53
-      targetPort: 53
-      protocol: UDP
+# kind: Service
+# apiVersion: v1
+# metadata:
+#   name: pihole
+#   namespace: networking
+# spec:
+#   selector:
+#     app: pihole
+#   ports:
+#     - name: web
+#       port: 80
+#       targetPort: 80
+#     - name: dns-tcp
+#       port: 53
+#       targetPort: 53
+#       protocol: TCP
+#     - name: dns-udp
+#       port: 53
+#       targetPort: 53
+#       protocol: UDP
 
----
+# ---
 
-apiVersion: v1
-kind: Service
-metadata:
-  name: pihole-dns-udp
-  namespace: networking
-spec:
-  selector:
-    app: pihole
-  ports:
-    - name: dns-udp
-      port: 53
-      protocol: UDP
-  externalTrafficPolicy: Local
-  type: LoadBalancer
+# apiVersion: v1
+# kind: Service
+# metadata:
+#   name: pihole-dns-udp
+#   namespace: networking
+# spec:
+#   selector:
+#     app: pihole
+#   ports:
+#     - name: dns-udp
+#       port: 53
+#       protocol: UDP
+#   externalTrafficPolicy: Local
+#   type: LoadBalancer
 
----
+# ---
 
-apiVersion: v1
-kind: Service
-metadata:
-  name: pihole-dns-tcp
-  namespace: networking
-spec:
-  selector:
-    app: pihole
-  ports:
-    - name: dns-tcp
-      port: 53
-      protocol: TCP
-  externalTrafficPolicy: Local
-  type: LoadBalancer
+# apiVersion: v1
+# kind: Service
+# metadata:
+#   name: pihole-dns-tcp
+#   namespace: networking
+# spec:
+#   selector:
+#     app: pihole
+#   ports:
+#     - name: dns-tcp
+#       port: 53
+#       protocol: TCP
+#   externalTrafficPolicy: Local
+#   type: LoadBalancer
 
----
+# ---
 
-apiVersion: v1
-kind: Service
-metadata:
-  name: pihole-web-debug
-  namespace: networking
-spec:
-  selector:
-    app: pihole
-  ports:
-    - name: dns-tcp
-      port: 9980
-      targetPort: 80
-      protocol: TCP
-  externalTrafficPolicy: Local
-  type: LoadBalancer
+# apiVersion: v1
+# kind: Service
+# metadata:
+#   name: pihole-web-debug
+#   namespace: networking
+# spec:
+#   selector:
+#     app: pihole
+#   ports:
+#     - name: dns-tcp
+#       port: 9980
+#       targetPort: 80
+#       protocol: TCP
+#   externalTrafficPolicy: Local
+#   type: LoadBalancer
 
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: pihole
-  namespace: networking
-spec:
-  ingressClassName: haproxy
-  rules:
-    - host: "pihole.nightowl.strix.systems"
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: pihole
-                port:
-                  name: web
+# ---
+# apiVersion: networking.k8s.io/v1
+# kind: Ingress
+# metadata:
+#   name: pihole
+#   namespace: networking
+# spec:
+#   ingressClassName: haproxy
+#   rules:
+#     - host: "pihole.nightowl.strix.systems"
+#       http:
+#         paths:
+#           - path: /
+#             pathType: Prefix
+#             backend:
+#               service:
+#                 name: pihole
+#                 port:
+#                   name: web

ntr-cv/ntr-cv.ingress.yaml

@@ -4,27 +4,17 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: ntr-cv
+  namespace: ntr-cv
   annotations:
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
 spec:
   ingressClassName: haproxy
   tls:
   - hosts:
-    - strix.systems
-    - ntr.ntwl.xyz
+    - ntwl.xyz
     secretName: strix-systems-tls
   rules:
-  - host: strix.systems
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: ntr-cv
-            port:
-              number: 8080
-  - host: ntr.ntwl.xyz
+  - host: ntwl.xyz
     http:
       paths:
       - path: /

ntr-cv/ntr-cv.yaml

@@ -1,5 +1,12 @@
 ---
 
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: ntr-cv
+
+---
+
 # -----------------------------------------------------------------------
 # DEPLOYMENTS
 # -----------------------------------------------------------------------
@@ -8,6 +15,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: ntr-cv
+  namespace: ntr-cv
 spec:
   replicas: 1
   selector:
@@ -20,7 +28,7 @@ spec:
     spec:
       containers:
         - name: ntr-cv
-          image: registry.strix.systems/ntr-cv
+          image: registry.ntwl.xyz/ntr-cv
           imagePullPolicy: Always
           ports:
             - containerPort: 8080
@@ -37,6 +45,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: ntr-cv
+  namespace: ntr-cv
 spec:
   selector:
     app: ntr-cv

ntwl.sublime-project

@@ -0,0 +1,8 @@
+{
+	"folders":
+	[
+		{
+			"path": "."
+		}
+	]
+}

ops/grafana.yaml

@@ -1,30 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: grafana-pv
-spec:
-  storageClassName: ""
-  capacity:
-    storage: 1Gi
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  claimRef:
-    namespace: monitor
-    name: grafana-pvc
-  hostPath:
-    path: "/var/lib/rancher/k3s/storage/grafana-pv"
-    type: DirectoryOrCreate
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: grafana-pvc
-  namespace: monitor
-spec:
-  volumeName: grafana-pv
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi

ops/kubeseal.yaml

@@ -0,0 +1,14 @@
+---
+
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+  name: sealed-secrets
+  namespace: ops
+spec:
+  repo: https://bitnami-labs.github.io/sealed-secrets
+  chart: sealed-secrets
+  version: 2.17.3
+  targetNamespace: kube-system
+  valuesContent: |-
+    fullnameOverride: sealed-secrets-controller

ops/minio.ingress.yaml

@@ -0,0 +1,39 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: storage
+  namespace: ops
+  labels:
+    app: minio
+  annotations:
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    haproxy.org/proxy-body-size-limit: "1g"
+spec:
+  ingressClassName: haproxy
+  tls:
+  - hosts:
+      - minio.ntwl.xyz
+      - storage.ntwl.xyz
+    secretName: minio-tls
+  rules:
+  - host: minio.ntwl.xyz
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: minio
+            port:
+              number: 9090
+
+  - host: storage.ntwl.xyz
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: minio
+            port:
+              number: 9000

ops/minio.yaml

@@ -4,37 +4,18 @@
 
 ---
 
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: minio-pv
-spec:
-  storageClassName: ""
-  capacity:
-    storage: 20Gi
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  claimRef:
-    namespace: default
-    name: minio-pvc
-  hostPath:
-    path: "/var/lib/rancher/k3s/storage/minio-pv"
-    type: DirectoryOrCreate
-
----
-
 kind: PersistentVolumeClaim
 apiVersion: v1
 metadata:
-  name: minio-pvc
+  name: minio-storage
+  namespace: ops
 spec:
-  volumeName: minio-pv
+  storageClassName: zfs-fast
   accessModes:
     - ReadWriteOnce
   resources:
     requests:
-      storage: 20Gi
+      storage: 100Gi
 
 ---
 
@@ -46,6 +27,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: minio
+  namespace: ops
 spec:
   replicas: 1
   selector:
@@ -107,7 +89,7 @@ spec:
       volumes:
         - name: minio-storage
           persistentVolumeClaim:
-            claimName: minio-pvc
+            claimName: minio-storage
 
 
 ---
@@ -115,7 +97,8 @@ spec:
 apiVersion: v1
 kind: Service
 metadata:
-  name: minio-service
+  name: minio
+  namespace: ops
   labels:
     app: minio
 spec:

ops/monitor.ingress.yaml

@@ -11,20 +11,9 @@ spec:
   ingressClassName: haproxy
   tls:
   - hosts:
-    - monitor.strix.systems
     - monitor.ntwl.xyz
     secretName: monitor-strix-systems-tls
   rules:
-  - host: monitor.strix.systems
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: kube-prometheus-stack-grafana
-            port:
-              number: 80
   - host: monitor.ntwl.xyz
     http:
       paths:

ops/registry.ingress.yaml

@@ -4,6 +4,7 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: registry
+  namespace: ops
   annotations:
     haproxy.org/proxy-body-size-limit: "2g"
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
@@ -11,7 +12,6 @@ spec:
   ingressClassName: haproxy
   tls:
   - hosts:
-    - registry.strix.systems
     - registry.ntwl.xyz
     secretName: registry-strix-systems-tls
   rules:

ops/values.yaml

@@ -1,20 +0,0 @@
-grafana:
-  persistence:
-    type: pvc
-    enabled: true
-    # annotations: {}
-    finalizers:
-      - kubernetes.io/pvc-protection
-    existingClaim: grafana-pvc
-
-alertmanager:
-  enabled: false
-
-loki:
-  auth_enabled: false
-  commonConfig:
-    replication_factor: 1
-  storage:
-    type: 'filesystem'
-singleBinary:
-  replicas: 1

ops/vlt.seal.json

@@ -0,0 +1,29 @@
+{
+  "kind": "SealedSecret",
+  "apiVersion": "bitnami.com/v1alpha1",
+  "metadata": {
+    "name": "couchdb-couchdb",
+    "namespace": "ops",
+    "creationTimestamp": null
+  },
+  "spec": {
+    "template": {
+      "metadata": {
+        "name": "couchdb-couchdb",
+        "namespace": "ops",
+        "creationTimestamp": null,
+        "labels": {
+          "app": "couchdb",
+          "service": "obsidian-livesync"
+        }
+      },
+      "type": "Opaque"
+    },
+    "encryptedData": {
+      "adminPassword": "AgAv+nUY0+WeMJ2Kz0DX9F2l3BvdRrtqbWIowaiIcbWOEjBh3CAFNj4YqUBcUSKn0RsTqYcStDuM1bHBdoWvUj+bfjuoZcYXlXck0QYoGH6PkVfP67GvTgAgQpD7D3D1Q/su16lVBQ671jIxjBi6J38Aiq7Iqkg70vqTE3fclxW6rD6uuPSuYcpaUEUr98/ZYwKgdOZdYLbPAtdwFY6iD2u7HmhZN8Io7N77ofd8GcVREjsOl/5f9y29OBEyAgRzb0glj10z4cdnR/fhVQeGMFKlFU/ld3lVMqncpmC+/hi2JiNYa31S8Uld4oJp/w74fkWBsV+1rsDIrch1uXjRmdpVfpZ5EYBew/t/5G6PtaTGvI9I00zlbrRflYeSMSe4qNIPP4B77LP78FjuHo+NCqLP5pvJ+e3jJJppy9fuhnoy+1rDo1wl/8l4YcQTL77idgvSwCYmaOXi4BApbebZBKwHdKVEnO+yEHEG9VomVcfSEo8NZeXT6aa8BlmTuQLDOZf1vEfGeYnKNz2t5m4uy5tYZ76i5NM37w2vLv+TU/mG9LbKzFBSJ+CHnnv+pmfoXSd1co7vS2vbi1CRkeB0t1RuB7i/YYtpPCtVTnk8s6eZ315pQkLR7M0/0yi2RyJiYB3UEvaZlDF4y8DstbKDWzqPslmLq5VumxMZEQDYvzPbsdYQaEiX90hDnMfKHt48rnO1htOC5NwaqKWWMWs6",
+      "adminUsername": "AgAe33Ip20GvP1XRkon2XNBwsfTa0YVVlH+jg8NqKKEkRy4Xa6+Nwzl3OAcTxCxrLECxx0OCafCZXTU/dxbaoTO8izrtOGcmlb0fxjucf/5vwJFjTuhdk4AehpUSYXqIw76ZkJLJcqFSHewv7BvbCBRwef7gR/xnpFWak2r2Hhi1po6AmRzhJlp/Z3ndLfpywl1Jnqfsz9H54R5lDz3BXUXxW5zYTS8jsXJS60Cp7oFuNO8UQoYYJ+a1C6kXIvqVuEf1NuFwfx6hjTfm56MjSLTKr7G8rIX4bEpGtjHcAiuNXGlk2of5Uw/PgaUvsIfymoz+tnIsLbHEBOK0v1MRBkvsOz1M/D9C+lu2XX0CrtOX3Ww2Z5L542V8SqL5QBR2PBf0J0IvaDSioh4mgdcHZUhvduUZJ3FLbxVptWMQvRKvhsiR6U5/XXXLIMIQDUQ4kDpgsb7rPYmeqbeJOxY0SZ5XO4OY+kreBP1pylza/mr+DuzSWxzDyDV+VM+XfwkzgeBW8hv9dfuWJnD6Z0T4cYOQ+4VGrTwK5K6hNV84aK+zXDlMiijdX5Gxe3oS7Vdl3pAKz40v/7YZ5UWBHHk+TAu5DKU7mAF6MvICwTFj4M0s85jnI/uUGjEZ0y0BlX9W6cZF5wusczTUyhDv1WvSPpNBv4Htk+NZq50Y/v8PPyQUspLEngfoVEBZUL2z6hLtneITFhI=",
+      "cookieAuthSecret": "AgCIstQYGlgIvZMgx0obHFxz+vpefo9f5ZSiBmdxOm3HiU7saVS2s2Yc1YYhXO4ANvOOz5aRBdTp9l53c735htcq5vIhc9kERsxSLyxsGKfaq7ZtYt8fcHn00cmGwJDfIBzG5u1mBPe+mp+WZaBjXFEbBdISD1cndom7x6JdEljdZ5v19+z3TuAhHo2/kWMK7mVucIn1vglo51SSSz2F1HfgxfdPo7mDPybJYkOV1DOe8xzRvOWcAV7DhPxdkjFlLejTSiwFixkSy8QtnD96gjQXXZfOJsxdaYOXn3QMqNHBOq7qwhdHtJ3ugKHlrlJyGtlYFNhh9+i/MaWCEXvRZmCdZqee7un6KCPlL3vhFR0ABvXqgAWtIHPDgrDihqPHBv+CHvJs8Tu5d2ryKWTUkndMwTs+7BaZFS8KfIUtMrxec7+McEO2SyJOMjMJkDZMzcIz+gfu/9/0LYQ9IGjQ4P4m+/ZxM+VyBQjIRM/TjwmF8pXdB0Zs7HBL3KrWHELoe25lMa0iYOkI0tmZKhR43yCO+NOt93c6LS/QrVcJHnK5aY3GqwG9sjB5MEmR4eycYMNU/EjlYhRHrIMZnRvPb9TF8tD55nc8Eulc9DYZ9uFOG+OFlNRr4XHRvy1cmzS6z8lHntlzGyCMO9lkWGPGHC81llKG9uYpHa/eg0askHa7yjYLU1DfxDPAlIvgOqOLLvODOpoyDqAds/HUxZTpeak=",
+      "erlangCookie": "AgCTickThp91F/3kKWGpsYTKnGKrG7LWN9dbF1vL/gN/4nZ6thW28bQNNSdfKOYLp05U9oRvso4ja3dOpGBGmCS5NnSQY8UA2lGJuGloi49rgeuc34XW/+99RnCG2pwvjLJGhUJ3Zprb5J2Ky6CH4vUVd5Q0/zjGM5MEpaSxqkHriZj33gNy1cink/ZlkSMLpDGktjjHV4k7QHocT06Cu1Gg/ixrF3C2k8kQ9evoJTsOGAXH94E+vdtq/YvH0Be+AKCMc5MldROBEx69qI6uVKh9aM6YKPNfsgoh9A76ialeCYfYxPV/0oSx7YH86tg1yQ3V1Law3Y02tPjfyTsScuLnGbfoDXdcaShyfxxIaUtbEagohpofEZj6xQfO18wwpObZVVny72T9PEt5z5Fbkvv/wHGi0G9BZJ/E6/0T2Onap4WsJlC8I9CwzmcZMhBuECheRxxJ5z20k4bVq99e/iX5Ays90yZeHoJJwVC0e5zxwvdMZ775OSR9I2ibuKZx8UGLw/ZLrFNjdHvt3yAVKNAsdvOg1g7l0zS0i2CW46PcoUaqeFyX5NVda6upc0bEvVDCQV8TKzAv3Kk+rdaIbUM6ovDaClH80oY6lBpVSdGDtJ7Tf5sn5d/jwnm3TJtFyt5B1YXboQL9KWCdYgsUAcWQp9DuCd57sR0BG7oGUuGXwvxLnhAdCe3JkZRrpi7YXr708PXno3dx8wH3K7+j1/zC"
+    }
+  }
+}

ops/vlt.yaml

@@ -0,0 +1,62 @@
+---
+
+apiVersion: helm.cattle.io/v1
+kind: HelmChart
+metadata:
+    name: couchdb
+    namespace: ops
+    labels:
+        app: couchdb
+        service: vlt
+spec:
+    repo: https://apache.github.io/couchdb-helm
+    chart: couchdb
+    version: 4.6.1
+    targetNamespace: ops
+    valuesContent: |-
+        clusterSize: 1
+        createAdminSecret: false
+
+        couchdbConfig:
+            couchdb:
+                single_node: true
+                uuid: 1723f780-f9df-4efb-84dc2e5a691207d8
+                max_document_size: 50000000
+                max_http_request_size: 4294967296
+            chttpd:
+                require_valid_user: true
+                enable_cors: true
+            httpd:
+                enable_cors: true
+                WWW-Authenticate: "Basic realm=\"couchdb\""
+            cors:
+                origins: "*"
+                credentials: true
+                methods: "GET, PUT, POST, HEAD, DELETE"
+                headers: "accept, authorization, content-type, origin, referer, x-csrf-token"
+        
+        persistentVolume:
+            enabled: true
+            storageClass: "zfs-fast"
+            size: 10Gi
+        
+        service:
+            type: ClusterIP
+            port: 5984
+        
+        ingress:
+            enabled: true
+            className: haproxy
+            hosts:
+                - vlt.ntwl.xyz
+            tls:
+                - hosts:
+                      - vlt.ntwl.xyz
+                  secretName: couchdb-tls
+
+            annotations:
+                cert-manager.io/cluster-issuer: "letsencrypt-prod"
+                haproxy.org/ssl-redirect: "true"
+                haproxy.org/proxy-body-size: "100m"
+                haproxy.org/timeout-client: "600s"
+                haproxy.org/timeout-server: "600s"

spacerace/spacerace.ingress.yaml

@@ -3,6 +3,7 @@ apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
   name: spacerace-api
+  namespace: spacerace
   annotations:
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
     haproxy.org/path-rewrite: "/api(/)?(.*) /$2"
@@ -10,10 +11,10 @@ spec:
   ingressClassName: haproxy
   tls:
   - hosts:
-    - spacerace.strix.systems
-    secretName: spacerace-strix-systems-tls
+    - spacerace.ntwl.xyz
+    secretName: spacerace-ntwl-xyz-tls
   rules:
-  - host: spacerace.strix.systems
+  - host: spacerace.ntwl.xyz
     http:
       paths:
       - path: /api(/|$)(.*)

spacerace/spacerace.yaml

@@ -1,35 +1,38 @@
+---
+
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: spacerace
+
+
 # -----------------------------------------------------------------------
 # VOLUMES
 # -----------------------------------------------------------------------
 
 ---
 
+kind: PersistentVolumeClaim
 apiVersion: v1
-kind: PersistentVolume
 metadata:
-  name: spacerace-postgres-pv
+  name: spacerace-postgres-data
+  namespace: spacerace
 spec:
-  storageClassName: ""
-  capacity:
-    storage: 1Gi
+  storageClassName: zfs-fast
   accessModes:
     - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  claimRef:
-    namespace: default
-    name: spacerace-postgres-pvc
-  hostPath:
-    path: "/var/lib/rancher/k3s/storage/spacerace-postgres-pv"
-    type: DirectoryOrCreate
+  resources:
+    requests:
+      storage: 1Gi
 
 ---
 
 kind: PersistentVolumeClaim
 apiVersion: v1
 metadata:
-  name: spacerace-postgres-pvc
+  name: spacerace-postgres-bootstrap
+  namespace: spacerace
 spec:
-  volumeName: spacerace-postgres-pv
   accessModes:
     - ReadWriteOnce
   resources:
@@ -46,6 +49,7 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: spacerace-postgres
+  namespace: spacerace
 spec:
   replicas: 1
   selector:
@@ -80,40 +84,46 @@ spec:
           volumeMounts:
             - name: spacerace-postgres-storage
               mountPath: /var/lib/postgresql/data
+            - name: spacerace-postgres-bootstrap
+              mountPath: /docker-entrypoint-initdb.d
 
       volumes:
         - name: spacerace-postgres-storage
           persistentVolumeClaim:
-            claimName: spacerace-postgres-pvc
+            claimName: spacerace-postgres-data
+        - name: spacerace-postgres-bootstrap
+          persistentVolumeClaim:
+            claimName: spacerace-postgres-bootstrap
 
 ---
 
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: spacerace-api
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: spacerace-api
-  template:
-    metadata:
-      labels:
-        app: spacerace-api
-    spec:
-      containers:
-        - name: spacerace-api
-          image: registry.strix.systems/spacerace-api
-          imagePullPolicy: IfNotPresent
-          ports:
-            - containerPort: 80
-          env:
-            - name: CONNECTIONSTRINGS__SPACERACE
-              valueFrom:
-                secretKeyRef:
-                  name: spacerace
-                  key: CONNECTIONSTRINGS__SPACERACE
+# apiVersion: apps/v1
+# kind: Deployment
+# metadata:
+#   name: spacerace-api
+#   namespace: spacerace
+# spec:
+#   replicas: 1
+#   selector:
+#     matchLabels:
+#       app: spacerace-api
+#   template:
+#     metadata:
+#       labels:
+#         app: spacerace-api
+#     spec:
+#       containers:
+#         - name: spacerace-api
+#           image: registry.ntwl.xyz/spacerace-api
+#           imagePullPolicy: IfNotPresent
+#           ports:
+#             - containerPort: 80
+#           env:
+#             - name: CONNECTIONSTRINGS__SPACERACE
+#               valueFrom:
+#                 secretKeyRef:
+#                   name: spacerace
+#                   key: CONNECTIONSTRINGS__SPACERACE
 ---
 
 # -----------------------------------------------------------------------
@@ -124,6 +134,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: spacerace-api
+  namespace: spacerace
 spec:
   selector:
     app: spacerace-api
@@ -135,6 +146,7 @@ spec:
 apiVersion: v1
 kind: Service
 metadata:
+  namespace: spacerace
   name: spacerace-postgres
 spec:
   selector:

storage/minio.ingress.yaml

@@ -10,7 +10,6 @@ spec:
   ingressClassName: haproxy
   tls:
   - hosts:
-    - minio.strix.systems
     - minio.ntwl.xyz
     secretName: minio.strix.systems
   rules:
@@ -50,20 +49,9 @@ spec:
   ingressClassName: haproxy
   tls:
   - hosts:
-    - storage.strix.systems
     - storage.ntwl.xyz
-    secretName: storage.strix.systems
+    secretName: storage.ntwl.xyz
   rules:
-  - host: storage.strix.systems
-    http:
-      paths:
-      - path: /
-        pathType: Prefix
-        backend:
-          service:
-            name: minio-service
-            port:
-              number: 9000
   - host: storage.ntwl.xyz
     http:
       paths: