chore(deps): update docker.io/curlimages/curl docker tag to v8.13.0

2025-05-27 15:00:18 +00:00
72 changed files with 608 additions and 1744 deletions
--- a/.gitignore
+++ b/.gitignore
@@ -1,3 +1 @@
 *-testing/
 Chart.lock
 charts/
--- a/README.md
+++ b/README.md
@@ -1,29 +0,0 @@
 # Core Apps
 **Production-grade application deployments for my Kubernetes homelab**  
 This repository contains the core applications deployed to my Kubernetes homelab. Applications are deployed using either Kubernetes manifests or Helm charts (with upstream subcharts and custom values).
 **Why Helm?** I prefer Helm charts when upstream versions exist because Renovate can automatically track new chart versions, whereas image tags in raw manifests aren't always semantically versioned.
 **GitOps Workflow:** This repository is monitored by ArgoCD and serves as the source of truth for deployments. Each top-level directory is its own ArgoCD Application, with subdirectories representing components within that application.
 **Automated Commits:** Apps that I wrote/maintain directly (such as yt-dlp-bot and zap2xml) get their manifests automatically updated via an Actions workflow in their respective repositories
 - `arr-stack/` - Arr Stack (manifests)
    - `flaresolverr/` - Flaresolverr (captcha processor)
    - `prowlarr/` - Prowlarr (indexer manager)
    - `radarr/` - Radarr (movie media manager)
    - `sonarr/` - Sonarr (TV series media manager)
    - `tunnel/` - Custom SSH tunnel to my seedbox to securely communicate with Deluge
 - `attic/` - Attic NixOS cache server (manifests)
 - `authentik/` - [Authentik](https://auth.dubyatp.xyz) SSO server (Helm chart)
 - `gitea/` - [Gitea](https://git.dubyatp.xyz) Git Server (Helm chart)
 - `gitea-runner/` - Gitea Runner (manifests)
    - `buildkitd/` - Docker Buildkitd build environment
 - `grafana/` - [Grafana](https://grafana.dubyatp.xyz) observability dashboard (Helm chart)
 - `jellyfin/` - [Jellyfin](https://jellyfin.dubyatp.xyz) media server (Helm chart)
 - `renovate/` - [Renovate](https://git.dubyatp.xyz/renovate-bot) automated dependency manager (manifests)
 - `vaultwarden/` - [Vaultwarden](https://vaultwarden.dubyatp.xyz) password manager (manifests)
 - `whatismyip/` - [Simple "what is my IP" HTTP service](https://whatismyip.dubyatp.xyz) (manifests)
 - `yt-dlp-bot/` - [yt-dlp bot](https://git.dubyatp.xyz/williamp/yt-dlp-bot) (manifests); a custom Discord bot i created for downloading and storing YouTube videos ad-hoc
 - `zap2xml/` - [kube-zap2xml](https://git.dubyatp.xyz/williamp/kube-zap2xml) (manifests); modified version of zap2xml (zap2it TV listings scraper) designed for use as Kubernetes jobs and sends the result XMLTV format to a Rook-Ceph S3 bucket
--- a/arr-stack/flaresolverr/deployment.yaml
+++ b/arr-stack/flaresolverr/deployment.yaml
@@ -1,21 +0,0 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: flaresolverr
 spec:
  replicas: 1
  selector:
    matchLabels:
      app: flaresolverr
  template:
    metadata:
      labels:
        app: flaresolverr
    spec:
      containers:
      - name: flaresolverr
        image: ghcr.io/flaresolverr/flaresolverr:v3.4.1
        resources:
          requests:
            memory: "2Gi"
            cpu: "0.5"
--- a/arr-stack/flaresolverr/svc.yaml
+++ b/arr-stack/flaresolverr/svc.yaml
@@ -1,10 +0,0 @@
 apiVersion: v1
 kind: Service
 metadata:
  name: flaresolverr
 spec:
  selector:
    app: flaresolverr
  ports:
  - port: 8191
    targetPort: 8191
--- a/arr-stack/prowlarr/deployment.yaml
+++ b/arr-stack/prowlarr/deployment.yaml
@@ -1,33 +0,0 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: prowlarr
 spec:
  replicas: 1
  selector:
    matchLabels:
      app: prowlarr
  template:
    metadata:
      labels:
        app: prowlarr
      annotations:
        backup.velero.io/backup-volumes: config
    spec:
      containers:
      - name: prowlarr
        image: linuxserver/prowlarr:version-2.0.5.5160
        volumeMounts:
          - name: config
            mountPath: /config
        resources:
          limits:
            memory: "1Gi"
            cpu: "1"
          requests:
            memory: "512Mi"
            cpu: "0.5"
      volumes:
        - name: config
          persistentVolumeClaim:
            claimName: prowlarr-config
--- a/arr-stack/prowlarr/svc.yaml
+++ b/arr-stack/prowlarr/svc.yaml
@@ -1,10 +0,0 @@
 apiVersion: v1
 kind: Service
 metadata:
  name: prowlarr
 spec:
  selector:
    app: prowlarr
  ports:
  - port: 9696
    targetPort: 9696
--- a/arr-stack/radarr/deployment.yaml
+++ b/arr-stack/radarr/deployment.yaml
@@ -1,45 +0,0 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: radarr
 spec:
  replicas: 1
  selector:
    matchLabels:
      app: radarr
  template:
    metadata:
      labels:
        app: radarr
      annotations:
        backup.velero.io/backup-volumes: config
    spec:
      containers:
      - name: radarr
        image: linuxserver/radarr:version-5.27.5.10198
        volumeMounts:
          - name: config
            mountPath: /config
          - name: downloads
            mountPath: /mnt/Downloads
          - name: movies
            mountPath: /mnt/movies
        resources:
          limits:
            memory: "1Gi"
            cpu: "1"
          requests:
            memory: "512Mi"
            cpu: "0.5"
      volumes:
        - name: config
          persistentVolumeClaim:
            claimName: radarr-config
        - name: movies
          nfs:
            server: 10.105.15.20
            path: /mnt/hdd-pool/movies
        - name: downloads
          nfs:
            server: 10.105.15.20
            path: /mnt/hdd-pool/syncthing-downloads
--- a/arr-stack/radarr/svc.yaml
+++ b/arr-stack/radarr/svc.yaml
@@ -1,10 +0,0 @@
 apiVersion: v1
 kind: Service
 metadata:
  name: radarr
 spec:
  selector:
    app: radarr
  ports:
  - port: 7878
    targetPort: 7878
--- a/arr-stack/sonarr/deployment.yaml
+++ b/arr-stack/sonarr/deployment.yaml
@@ -1,45 +0,0 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: sonarr
 spec:
  replicas: 1
  selector:
    matchLabels:
      app: sonarr
  template:
    metadata:
      labels:
        app: sonarr
      annotations:
        backup.velero.io/backup-volumes: config
    spec:
      containers:
      - name: sonarr
        image: linuxserver/sonarr:4.0.15
        volumeMounts:
          - name: config
            mountPath: /config
          - name: downloads
            mountPath: /mnt/Downloads
          - name: tv-shows
            mountPath: /mnt/tv-shows
        resources:
          limits:
            memory: "1Gi"
            cpu: "1"
          requests:
            memory: "512Mi"
            cpu: "0.5"
      volumes:
        - name: config
          persistentVolumeClaim:
            claimName: sonarr-config
        - name: tv-shows
          nfs:
            server: 10.105.15.20
            path: /mnt/hdd-pool/tv-shows
        - name: downloads
          nfs:
            server: 10.105.15.20
            path: /mnt/hdd-pool/syncthing-downloads
--- a/arr-stack/sonarr/svc.yaml
+++ b/arr-stack/sonarr/svc.yaml
@@ -1,10 +0,0 @@
 apiVersion: v1
 kind: Service
 metadata:
  name: sonarr
 spec:
  selector:
    app: sonarr
  ports:
  - port: 8989
    targetPort: 8989
--- a/arr-stack/tunnel/deployment.yaml
+++ b/arr-stack/tunnel/deployment.yaml
@@ -1,33 +0,0 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: deluge-tunnel
 spec:
  selector:
    matchLabels:
      app: deluge-tunnel
  template:
    metadata:
      labels:
        app: deluge-tunnel
    spec:
      containers:
      - name: deluge-tunnel
        image: kroniak/ssh-client:3.21
        command: ["/bin/sh", "-c", "ssh -o StrictHostKeyChecking=no weyma-talos@45.152.211.243 -p 2222 -L 0.0.0.0:58846:127.0.0.1:58846 -L 0.0.0.0:8112:127.0.0.1:8112 -N"]
        volumeMounts:
          - name: ssh-keys
            mountPath: /root/.ssh
        resources:
          limits:
            memory: "512Mi"
            cpu: "500m"
          requests:
            memory: "128Mi"
            cpu: "200m"
      volumes:
        - name: ssh-keys
          secret:
            defaultMode: 0400
            secretName: ssh-keys
--- a/arr-stack/tunnel/ssh-keys.yaml
+++ b/arr-stack/tunnel/ssh-keys.yaml
@@ -1,28 +0,0 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: ssh-keys
 spec:
  data:
  - remoteRef:
      conversionStrategy: Default
      decodingStrategy: None
      key: deluge-ssh
      metadataPolicy: None
      property: private
    secretKey: id_ed25519
  - remoteRef:
      conversionStrategy: Default
      decodingStrategy: None
      key: deluge-ssh
      metadataPolicy: None
      property: public
    secretKey: id_ed25519.pub
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: weyma-vault
  target:
    creationPolicy: Owner
    deletionPolicy: Retain
    name: ssh-keys
--- a/arr-stack/tunnel/svc.yaml
+++ b/arr-stack/tunnel/svc.yaml
@@ -1,14 +0,0 @@
 apiVersion: v1
 kind: Service
 metadata:
  name: deluge
 spec:
  selector:
    app: deluge-tunnel
  ports:
  - port: 58846
    targetPort: 58846
    name: deluge
  - port: 8112
    targetPort: 8112
    name: web
--- a/attic/bucket.yaml
+++ b/attic/bucket.yaml
@@ -1,10 +0,0 @@
 apiVersion: objectbucket.io/v1alpha1
 kind: ObjectBucketClaim
 metadata:
  name: attic-bucket
  namespace: attic
 spec:
  additionalConfig:
    maxSize: 100Gi
  bucketName: attic-bucket
  storageClassName: weyma-s3-bucket
--- a/attic/config.yaml
+++ b/attic/config.yaml
@@ -1,36 +0,0 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: attic-config
 data:
  server.toml: |
    listen = "[::]:8080"
    allowed-hosts = []
    #api-endpoint = "https://nix-cache.dubyatp.xyz/"
    [database]
    url = "sqlite:///var/empty/.local/share/attic/server.db"
    [storage]
    path = "/data/.local/share/attic/storage"
    type = "local"
    #region = "us-east-1"
    #bucket = "attic-bucket"
    #endpoint = "https://weyma-s3.infra.dubyatp.xyz"
    [chunking]
    nar-size-threshold = 65536
    min-size = 16384
    avg-size = 65536
    max-size = 262144
    [compression]
    type = "zstd"
    [garbage-collection]
    interval = "12 hours"
    [jwt]
    [jwt.signing]
--- a/attic/deployment.yaml
+++ b/attic/deployment.yaml
@@ -3,7 +3,6 @@ kind: Deployment
 metadata:
  name: attic
 spec:
  replicas: 1
  selector:
    matchLabels:
      app: attic
@@ -14,24 +13,17 @@ spec:
    spec:
      containers:
      - name: attic
-        image: ghcr.io/zhaofengli/attic:c4ffb5e86e928572e867bd3f81545293313e0a08
+        image: ghcr.io/zhaofengli/attic:ff8a897d1f4408ebbf4d45fa9049c06b3e1e3f4e
        envFrom:
        - secretRef:
            name: attic-secret
        - secretRef:
            name: attic-bucket
        volumeMounts:
        - name: attic-pvc
-          mountPath: /var/empty/
+          mountPath: /var/empty
        resources:
          limits:
            memory: "2Gi"
            cpu: "500m"
      - name: multitool
        image: wbitt/network-multitool
        volumeMounts:
        - name: attic-pvc
          mountPath: /var/empty/
      volumes:
      - name: attic-pvc
        persistentVolumeClaim:
--- a/authentik/Chart.yaml
+++ b/authentik/Chart.yaml
@@ -24,5 +24,5 @@ appVersion: "1.0"
 dependencies:
 - name: authentik
-  version: 2026.2.0
+  version: 2025.4.1
  repository: https://charts.goauthentik.io
--- a/authentik/values.yaml
+++ b/authentik/values.yaml
@@ -15,35 +15,6 @@ authentik:
      service:
        labels:
          metrics_enabled: "true"
    livenessProbe:
      failureThreshold: 3      
      initialDelaySeconds: 5
      periodSeconds: 10
      successThreshold: 1
      timeoutSeconds: 10       
      httpGet:
        path: "{{ .Values.authentik.web.path }}-/health/live/"
        port: http
    readinessProbe:
      failureThreshold: 3      
      initialDelaySeconds: 5
      periodSeconds: 10
      successThreshold: 1
      timeoutSeconds: 10       
      httpGet:
        path: "{{ .Values.authentik.web.path }}-/health/ready/"
        port: http
    startupProbe:
      failureThreshold: 60     
      initialDelaySeconds: 5
      periodSeconds: 10
      successThreshold: 1
      timeoutSeconds: 10       
      httpGet:
        path: "{{ .Values.authentik.web.path }}-/health/live/"
        port: http
  worker:
    replicas: 3
    volumeMounts:
@@ -54,6 +25,59 @@ authentik:
      - name: cert-dubyatp-xyz
        secret:
          secretName: cert-dubyatp-xyz
  postgresql:
    enabled: true
    image:
      repository: bitnami/postgresql
      tag: 15.8.0-debian-12-r18
    auth:
      username: authentik
      database: authentik
      existingSecret: "authentik-credentials"
      secretKeys:
        adminPasswordKey: "admin-password"
        userPasswordKey: "user-password"
        replicationPasswordKey: "replication-password"
    primary:
      podAnnotations:
        backup.velero.io/backup-volumes: data
      extendedConfiguration: |
        max_connections = 500
      resourcesPreset: "none"
      persistence:
        enabled: true
        storageClass: weyma-shared
        accessModes:
          - ReadWriteOnce
      readReplicas:
        resourcesPreset: "none"
      backup:
        resourcesPreset: "none"
      passwordUpdateJob:
        resourcesPreset: "none"
      volumePermissions:
        resourcesPreset: "none"
      metrics:
        resourcesPreset: "none"
  redis:
    enabled: true
    architecture: standalone
    auth:
      enabled: false
    master:
      resourcesPreset: "none"
      podAnnotations:
        backup.velero.io/backup-volumes: redis-data
    replica:
      resourcesPreset: "none"
    sentinel:
      resourcesPreset: "none"
    metrics:
      resourcesPreset: "none"
    volumePermissions:
      resourcesPreset: "none"
    sysctl:
      resourcesPreset: "none"
  global:
    env:
      - name: AUTHENTIK_SECRET_KEY
@@ -61,50 +85,11 @@ authentik:
          secretKeyRef:
            name: authentik-credentials
            key: authentik-secret-key
      - name: AUTHENTIK_POSTGRESQL__DISABLE_SERVER_SIDE_CURSORS
        value: "true"
      - name: AUTHENTIK_POSTGRESQL__HOST
        value: pooler-weyma-rw-authentik.cloudnativepg.svc.cluster.local
      - name: AUTHENTIK_POSTGRESQL__NAME
        value: authentik
      - name: AUTHENTIK_POSTGRESQL__USER
        value: authentik
      - name: AUTHENTIK_POSTGRESQL__PASSWORD
        valueFrom:
          secretKeyRef:
            name: authentik-db-auth
            key: password
      - name: AUTHENTIK_EMAIL__FROM
        value: authentik_dubyatp@em924671.dubyatp.xyz
      - name: AUTHENTIK_EMAIL__HOST
        value: mail.smtp2go.com
      - name: AUTHENTIK_EMAIL__USE_TLS
        value: "true"
      - name: AUTHENTIK_EMAIL__USERNAME
        value: authentik_dubyatp
      - name: AUTHENTIK_EMAIL__PASSWORD
        valueFrom:
          secretKeyRef:
            name: authentik-credentials
-            key: smtp-password
+            key: user-password
      - name: AUTHENTIK_EMAIL__TIMEOUT
        value: "30"
      - name: AUTHENTIK_STORAGE__BACKEND
        value: "s3"
      - name: AUTHENTIK_STORAGE__S3__ENDPOINT
        value: "https://weyma-s3.infra.dubyatp.xyz"
      - name: AUTHENTIK_STORAGE__S3__BUCKET_NAME
        value: "authentik-files"
      - name: AUTHENTIK_STORAGE__S3__ACCESS_KEY
        valueFrom:
          secretKeyRef:
            name: authentik-files
            key: AWS_ACCESS_KEY_ID
      - name: AUTHENTIK_STORAGE__S3__SECRET_KEY
        valueFrom:
          secretKeyRef:
            name: authentik-files
            key: AWS_SECRET_ACCESS_KEY      
  additionalObjects:
    - apiVersion: networking.k8s.io/v1
      kind: Ingress
@@ -168,37 +153,3 @@ authentik:
            remoteRef:
              key: authentik
              property: user-password
          - secretKey: smtp-password
            remoteRef:
              key: authentik
              property: smtp-password
    - apiVersion: external-secrets.io/v1
      kind: ExternalSecret
      metadata:
        name: authentik-db-auth
      spec:
        data:
        - remoteRef:
            conversionStrategy: Default
            decodingStrategy: None
            key: cloudnativepg
            metadataPolicy: None
            property: authentik_pw
          secretKey: password
        refreshInterval: 1h
        secretStoreRef:
          kind: ClusterSecretStore
          name: weyma-vault
        target:
          creationPolicy: Owner
          deletionPolicy: Retain
          name: authentik-db-auth
    - apiVersion: objectbucket.io/v1alpha1
      kind: ObjectBucketClaim
      metadata:
        name: authentik-files
      spec:
        additionalConfig:
          maxSize: 20Gi
        bucketName: authentik-files
        storageClassName: weyma-s3-bucket
--- a/emby/cert-dubyatp-xyz.yaml
+++ b/emby/cert-dubyatp-xyz.yaml
@@ -0,0 +1,10 @@
 apiVersion: v1
 kind: Secret
 metadata:
  name: cert-dubyatp-xyz
  annotations:
    replicator.v1.mittwald.de/replicate-from: "cert-manager/cert-dubyatp-xyz"
    replicator.v1.mittwald.de/replicated-keys: "tls.crt,tls.key"
 data:
  tls.crt: ""
  tls.key: ""
--- a/emby/deployment.yaml
+++ b/emby/deployment.yaml
@@ -0,0 +1,79 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: emby
 spec:
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: emby
  template:
    metadata:
      annotations:
        backup.velero.io/backup-volumes: emby-config
      labels:
        app: emby
    spec:
      volumes:
        - name: tv-shows
          nfs:
            server: 10.105.15.20
            path: /mnt/hdd-pool/tv-shows
        - name: movies
          nfs:
            server: 10.105.15.20
            path: /mnt/hdd-pool/movies
        - name: emby-config
          persistentVolumeClaim:
            claimName: emby-config
        - name: transcode-temp
          emptyDir:
            sizeLimit: 8Gi
            medium: Memory
        - name: dev-dri
          hostPath:
            path: /dev/dri
      containers:
      - name: emby
        image: emby/embyserver:4.8.11.0
        volumeMounts:
          - name: tv-shows
            mountPath: /mnt/tv-shows
          - name: movies
            mountPath: /mnt/movies
          - name: emby-config
            mountPath: /config
          - name: transcode-temp
            mountPath: /tmp/transcode
          - name: dev-dri
            mountPath: /dev/dri
        env:
        - name: UID
          value: "1000"
        - name: GID
          value: "1000"
        - name: GIDLIST
          value: "100"
        livenessProbe:
          httpGet:
            path: /
            port: http
        securityContext:
          privileged: true
        resources:
          limits:
            memory: 8Gi
            cpu: '1'
          requests:
            memory: 4Gi
            cpu: "500m"
      nodeSelector:
        kubernetes.io/hostname: weyma-talos-testw04
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: extensions.talos.dev/i915
                operator: Exists
--- a/emby/ingress.yaml
+++ b/emby/ingress.yaml
@@ -0,0 +1,22 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  name: emby-ingress
  annotations:
    traefik.ingress.kubernetes.io/router.middlewares: cloudflarewarp@file
 spec:
  rules:
  - host: emby.dubyatp.xyz
    http:
      paths:
      - pathType: Prefix
        path: "/"
        backend:
          service:
            name: emby-http-svc
            port: 
              number: 8096
  tls:
  - hosts:
    - emby.dubyatp.xyz
    secretName: cert-dubyatp-xyz
--- a/arr-stack/prowlarr/pvc.yaml
+++ b/arr-stack/prowlarr/pvc.yaml
@@ -1,11 +1,12 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: prowlarr-config
+  name: emby-config
 spec:
  storageClassName: weyma-shared
  resources:
    requests:
      storage: 10Gi
  volumeMode: Filesystem
  accessModes:
-    - ReadWriteMany
+    - ReadWriteOnce
--- a/arr-stack/radarr/pvc.yaml
+++ b/arr-stack/radarr/pvc.yaml
@@ -1,11 +1,12 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: radarr-config
+  name: resilio-pvc
 spec:
  storageClassName: weyma-shared
  resources:
    requests:
      storage: 10Gi
  volumeMode: Filesystem
  accessModes:
-    - ReadWriteMany
+    - ReadWriteOnce
--- a/emby/resilio-sync.yaml
+++ b/emby/resilio-sync.yaml
@@ -0,0 +1,39 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: resilio-sync
 spec:
  selector:
    matchLabels:
      app: resilio-sync
  template:
    metadata:
      labels:
        app: resilio-sync
    spec:
      containers:
      - name: resilio-sync
        image: lscr.io/linuxserver/resilio-sync:3.0.0
        volumeMounts:
        - name: config
          mountPath: /config
        - name: tv-shows
          mountPath: /sync/tv-shows
        - name: movies
          mountPath: /sync/movies
        resources:
          limits:
            memory: "700Mi"
            cpu: "500m"
      volumes:
        - name: config
          persistentVolumeClaim:
            claimName: resilio-pvc
        - name: tv-shows
          nfs:
            server: 10.105.15.20
            path: /mnt/hdd-pool/tv-shows
        - name: movies
          nfs:
            server: 10.105.15.20
            path: /mnt/hdd-pool/movies
--- a/emby/svc.yaml
+++ b/emby/svc.yaml
@@ -0,0 +1,23 @@
 apiVersion: v1
 kind: Service
 metadata:
  name: emby-http-svc
 spec:
  type: ClusterIP
  selector:
    app: emby
  ports:
  - port: 8096
    targetPort: 8096
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: emby-https-svc
 spec:
  type: ClusterIP
  selector:
    app: emby
  ports:
  - port: 8920
    targetPort: 8920
--- a/gitea-runner/buildkitd/deployment.yaml
+++ b/gitea-runner/buildkitd/deployment.yaml
@@ -1,40 +0,0 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: buildkitd
  namespace: gitea-runner
 spec:
  progressDeadlineSeconds: 600
  replicas: 3
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: buildkitd
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: buildkitd
    spec:
      containers:
      - args:
        - --addr
        - tcp://0.0.0.0:1234
        image: moby/buildkit:v0.27.1
        imagePullPolicy: Always
        name: buildkitd
        ports:
        - containerPort: 1234
          protocol: TCP
        securityContext:
          privileged: true
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      schedulerName: default-scheduler
      terminationGracePeriodSeconds: 30
--- a/gitea-runner/buildkitd/svc.yaml
+++ b/gitea-runner/buildkitd/svc.yaml
@@ -1,14 +0,0 @@
 apiVersion: v1
 kind: Service
 metadata:
  name: buildkitd
  namespace: gitea-runner
 spec:
  internalTrafficPolicy: Cluster
  ipFamilies:
  - IPv4
  ipFamilyPolicy: SingleStack
  ports:
  - port: 1234
  selector:
    app: buildkitd
--- a/gitea-runner/config.yaml
+++ b/gitea-runner/config.yaml
@@ -1,41 +0,0 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: runner-config
 data:
  config.yaml: |-
    log:
      level: info
    runner:
      file: /data/.runner
      capacity: 1
      env_file: .env
      timeout: 3h
      shutdown_timeout: 0s
      insecure: false
      fetch_timeout: 5s
      fetch_interval: 2s
      labels:
        - "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
        - "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
        - "ubuntu-20.04:docker://docker.gitea.com/runner-images:ubuntu-20.04"
    cache:
      enabled: true
      dir: ""
      host: ""
      port: 0
      external_server: ""
    container:
      network: "host"
      privileged: false
      options:
      workdir_parent: /scratch
      valid_volumes:
        - /scratch/**
      docker_host: ""
      force_pull: true
      force_rebuild: false
      require_docker: false
      docker_timeout: 0s
    host:
      workdir_parent:
--- a/gitea-runner/deployment.yaml
+++ b/gitea-runner/deployment.yaml
@@ -0,0 +1,56 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: gitea-runner
 spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: gitea-runner
  template:
    metadata:
      labels:
        app: gitea-runner
    spec:
      restartPolicy: Always
      volumes:
      - name: docker-certs
        emptyDir: {}
      - name: runner-data
        persistentVolumeClaim:
          claimName: gitea-runner-pvc
      containers:
      - name: runner
        image: gitea/act_runner:nightly
        command: ["sh", "-c", "while ! nc -z localhost 2376 </dev/null; do echo 'waiting for docker daemon...'; sleep 5; done; /sbin/tini -- run.sh"]
        env:
        - name: DOCKER_HOST
          value: tcp://127.0.0.1:2376
        - name: DOCKER_CERT_PATH
          value: /certs/client
        - name: DOCKER_TLS_VERIFY
          value: "1"
        - name: GITEA_INSTANCE_URL
          value: https://git.dubyatp.xyz
        - name: GITEA_RUNNER_REGISTRATION_TOKEN
          valueFrom:
            secretKeyRef:
              name: gitea-runner-token
              key: registration-token
        volumeMounts:
        - name: docker-certs
          mountPath: /certs
        - name: runner-data
          mountPath: /data
      - name: daemon
        image: docker:23.0.6-dind
        env:
        - name: DOCKER_TLS_CERTDIR
          value: /certs
        securityContext:
          privileged: true
        volumeMounts:
        - name: docker-certs
          mountPath: /certs
--- a/netmaker/mosquitto/certs-pvc.yaml
+++ b/netmaker/mosquitto/certs-pvc.yaml
@@ -1,11 +1,12 @@
 kind: PersistentVolumeClaim
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: shared-certs-pvc
+  name: gitea-runner-pvc
 spec:
  storageClassName: weyma-shared
  accessModes:
    - ReadWriteMany
  resources:
    requests:
-      storage: 100Mi
+      storage: 1Gi
  volumeMode: Filesystem
  accessModes:
    - ReadWriteOnce
  storageClassName: weyma-shared
--- a/gitea-runner/statefulset.yaml
+++ b/gitea-runner/statefulset.yaml
@@ -1,86 +0,0 @@
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
  name: act-runner
  namespace: gitea-runner
  labels:
    app: act-runner
 spec:
  serviceName: ""
  selector:
    matchLabels:
      app: act-runner
  replicas: 3
  template:
    metadata:
      labels:
        app: act-runner
    spec:
      initContainers:
      - name: sysctl
        image: busybox
        securityContext:
          privileged: true
        command:
          - sh
          - -c
          - echo 28633 > /proc/sys/user/max_user_namespaces
      - name: chown-data
        image: busybox
        securityContext:
          runAsUser: 0
        command:
          - sh
          - -c
          - chown -R 1000:1000 /data
        volumeMounts:
        - name: runner-data
          mountPath: /data
      containers:
      - name: runner
        image: gitea/act_runner:nightly-dind-rootless
        imagePullPolicy: Always
        env:
          - name: CONFIG_FILE
            value: /config/config.yaml
          - name: DOCKER_HOST
            value: unix:///run/user/1000/docker.sock
          - name: GITEA_INSTANCE_URL
            value: https://git.dubyatp.xyz
          - name: GITEA_RUNNER_REGISTRATION_TOKEN
            valueFrom:
              secretKeyRef:
                key: registration-token
                name: gitea-runner-token
        securityContext:
          privileged: true
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - name: runner-config
          mountPath: /config
        - name: runner-data
          mountPath: /data
        - name: runner-scratch
          mountPath: /scratch
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      schedulerName: default-scheduler
      terminationGracePeriodSeconds: 30
      volumes:
        - name: runner-scratch
          emptyDir:
            medium: Memory
            sizeLimit: 5Gi
        - name: runner-config
          configMap:
            name: runner-config
  volumeClaimTemplates:
  - metadata:
      name: runner-data
    spec:
      accessModes: [ "ReadWriteOnce" ]
      storageClassName: weyma-shared
      resources:
        requests:
          storage: 32Gi
--- a/gitea/Chart.yaml
+++ b/gitea/Chart.yaml
@@ -1,28 +0,0 @@
 apiVersion: v2
 name: gitea
 description: A Helm chart for Kubernetes
 # A chart can be either an 'application' or a 'library' chart.
 #
 # Application charts are a collection of templates that can be packaged into versioned archives
 # to be deployed.
 #
 # Library charts provide useful utilities or functions for the chart developer. They're included as
 # a dependency of application charts to inject those utilities and functions into the rendering
 # pipeline. Library charts do not define any templates and therefore cannot be deployed.
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
 version: 0.1.0
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 appVersion: "1.0"
 dependencies:
 - name: gitea
  version: 12.5.6
  repository: https://weyma-s3.infra.dubyatp.xyz/helm-bucket-ea34bc44-ef19-480d-a16a-1e583991f123/charts/
--- a/gitea/values.yaml
+++ b/gitea/values.yaml
@@ -1,193 +0,0 @@
 gitea:
  replicaCount: 3
  ingress:
    enabled: true
    hosts:
      - host: git.dubyatp.xyz
        paths:
          - path: /
    tls:
      - secretName: cert-dubyatp-xyz
        hosts:
          - git.dubyatp.xyz
  persistence:
    enabled: true
    create: true
    mount: true
    claimName: gitea-shared-storage
    size: 50Gi
    accessModes:
      - ReadWriteMany
    storageClass: weyma-shared
  deployment:
    annotations:
      backup.velero.io/backup-volumes: data
    env:
      - name: GITEA__database__PASSWD
        valueFrom:
          secretKeyRef:
            key: password
            name: gitea-db-auth
      - name: GITEA__mailer__PASSWD
        valueFrom:
          secretKeyRef:
            key: smtp_smtp2go
            name: gitea-secrets
      - name: GITEA__security__INTERNAL_TOKEN
        valueFrom:
          secretKeyRef:
            key: internal_token
            name: gitea-secrets
      - name: GITEA__security__SECRET_KEY
        valueFrom:
          secretKeyRef:
            key: secret_key
            name: gitea-secrets
      - name: GITEA__oauth2__JWT_SECRET
        valueFrom:
          secretKeyRef:
            key: oauth2_jwt
            name: gitea-secrets
  gitea:
    admin:
      passwordMode: initialOnlyNoReset
    podAnnotations:
      backup.velero.io/backup-volumes: data
    config:
      database:
        DB_TYPE: postgres
        HOST: pooler-weyma-rw.cloudnativepg.svc.cluster.local
        NAME: gitea
        USER: gitea
      server:
        DISABLE_SSH: false
        DOMAIN: git.dubyatp.xyz
        ENABLE_PPROF: false
        ROOT_URL: https://git.dubyatp.xyz
        SSH_DOMAIN: git-ssh.dubyatp.xyz
        SSH_LISTEN_PORT: 22
        SSH_PORT: 22
        START_SSH_SERVER: true
        OFFLINE_MODE: false
      service:
        DISABLE_REGISTRATION: true
      webhook:
        ALLOWED_HOST_LIST: "drone.infra.dubyatp.xyz,argocd.infra.dubyatp.xyz,discord.com,10.0.0.0/8"
      mailer:
        ENABLED: true
        FROM: gitea@em924671.dubyatp.xyz
        PROTOCOL: smtps
        SMTP_ADDR: mail.smtp2go.com
        SMTP_PORT: 465
        USER: gitea_dubyatp
      security:
        INSTALL_LOCK: true
    metrics:
      enabled: true
      serviceMonitor:
        enabled: true
    livenessProbe:
      enabled: true
      httpGet:
        path: /api/healthz
        port: 3000
  extraDeploy:
    - apiVersion: traefik.io/v1alpha1
      kind: IngressRouteTCP
      metadata:
        name: gitea-ssh
      spec:
        entryPoints:
        - gitssh
        routes:
        - match: HostSNI(`*`)
          priority: 1
          services:
          - name: gitea-ssh
            port: 22
    - apiVersion: v1
      kind: Secret
      metadata:
        name: cert-dubyatp-xyz
        annotations:
          replicator.v1.mittwald.de/replicate-from: "cert-manager/cert-dubyatp-xyz"
          replicator.v1.mittwald.de/replicated-keys: "tls.crt,tls.key"
      data:
        tls.crt: ""
        tls.key: ""
    - apiVersion: external-secrets.io/v1
      kind: ExternalSecret
      metadata:
        name: gitea-db-auth
      spec:
        data:
        - remoteRef:
            conversionStrategy: Default
            decodingStrategy: None
            key: cloudnativepg
            metadataPolicy: None
            property: gitea_pw
          secretKey: password
        refreshInterval: 1h
        secretStoreRef:
          kind: ClusterSecretStore
          name: weyma-vault
        target:
          creationPolicy: Owner
          deletionPolicy: Retain
          name: gitea-db-auth
    - apiVersion: external-secrets.io/v1
      kind: ExternalSecret
      metadata:
        name: gitea-secrets
      spec:
        data:
        - remoteRef:
            conversionStrategy: Default
            decodingStrategy: None
            key: gitea
            metadataPolicy: None
            property: internal_token
          secretKey: internal_token
        - remoteRef:
            conversionStrategy: Default
            decodingStrategy: None
            key: gitea
            metadataPolicy: None
            property: oauth2_jwt
          secretKey: oauth2_jwt
        - remoteRef:
            conversionStrategy: Default
            decodingStrategy: None
            key: gitea
            metadataPolicy: None
            property: secret_key
          secretKey: secret_key
        - remoteRef:
            conversionStrategy: Default
            decodingStrategy: None
            key: gitea
            metadataPolicy: None
            property: smtp_smtp2go
          secretKey: smtp_smtp2go
        - remoteRef:
            conversionStrategy: Default
            decodingStrategy: None
            key: gitea
            metadataPolicy: None
            property: gitea_admin
          secretKey: gitea_admin
        refreshInterval: 1h
        secretStoreRef:
          kind: ClusterSecretStore
          name: weyma-vault
        target:
          creationPolicy: Owner
          deletionPolicy: Retain
          name: gitea-secrets
  postgresql-ha:
    enabled: false
  valkey-cluster:
    enabled: true
    valkey:
      resourcesPreset: "small"
--- a/grafana/Chart.yaml
+++ b/grafana/Chart.yaml
@@ -24,5 +24,5 @@ appVersion: "1.0"
 dependencies:
 - name: grafana
-  version: 10.5.15
+  version: 9.2.1
  repository: https://grafana.github.io/helm-charts
--- a/grafana/values.yaml
+++ b/grafana/values.yaml
@@ -16,6 +16,11 @@ grafana:
  defaultCurlOptions: -skf
  deploymentStrategy:
    type: Recreate
  downloadDashboardsImage:
    pullPolicy: IfNotPresent
    registry: docker.io
    repository: curlimages/curl
    tag: 8.13.0
  enableServiceLinks: true
  envFromConfigMaps:
  - name: grafana-env
@@ -134,6 +139,11 @@ grafana:
      secretName: cert-dubyatp-xyz
  initChownData:
    enabled: true
    image:
      pullPolicy: IfNotPresent
      registry: docker.io
      repository: library/busybox
      tag: 1.31.1
    securityContext:
      capabilities:
        add:
@@ -191,6 +201,6 @@ grafana:
    image:
      registry: docker.io
      repository: bats/bats
-      tag: 1.13.0
+      tag: 1.12.0
    imagePullPolicy: IfNotPresent
  useStatefulSet: false
--- a/immich/immich-config.yaml
+++ b/immich/immich-config.yaml
@@ -0,0 +1,9 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: immich-config
 data:
  immich-config.yaml: |
    trash:
      enabled: true
      days: 30    
--- a/netmaker/mosquitto/ingress.yaml
+++ b/netmaker/mosquitto/ingress.yaml
@@ -1,18 +1,22 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: mosquitto-ingress
+  name: immich
  labels:
-    app.kubernetes.io/name: mosquitto-ingress
+    name: immich
 spec:
  rules:
-  - host: broker.netmaker.infra.dubyatp.xyz
+  - host: immich.dubyatp.xyz
    http:
      paths:
      - pathType: Prefix
        path: "/"
        backend:
          service:
-            name: mq
+            name: immich
            port: 
-              number: 8883
+              number: 2283
  tls:
    - secretName: cert-dubyatp-xyz
      hosts:
        - immich.dubyatp.xyz
--- a/immich/immich-library-pvc.yaml
+++ b/immich/immich-library-pvc.yaml
@@ -1,11 +1,11 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: sonarr-config
+  name: immich-library
 spec:
  resources:
    requests:
-      storage: 10Gi
+      storage: 50Gi
  volumeMode: Filesystem
  accessModes:
    - ReadWriteMany
--- a/immich/immich-ml-deployment.yaml
+++ b/immich/immich-ml-deployment.yaml
@@ -0,0 +1,94 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: immich-ml
 spec:
  selector:
    matchLabels:
      app: immich-ml
  template:
    metadata:
      labels:
        app: immich-ml
    spec:
      containers:
      - name: immich-ml
        image: ghcr.io/immich-app/immich-machine-learning:v1.132.3
        volumeMounts:
          - name: model-cache
            mountPath: /cache
          - name: config
            mountPath: /config/immich-config.yaml
          - name: dev-dri
            mountPath: /dev/dri
        env:
          - name: DB_HOSTNAME
            value: "weyma-pgsql-rw.cloudnativepg.svc.cluster.local"
          - name: DB_DATABASE_NAME
            value: "immich"
          - name: DB_USERNAME
            valueFrom:
              secretKeyRef:
                key: username
                name: postgres-credentials
          - name: DB_PASSWORD
            valueFrom:
              secretKeyRef:
                key: password
                name: postgres-credentials
          - name: REDIS_HOSTNAME
            value: redis
          - name: REDIS_PORT
            value: "6379"
          - name: IMMICH_PORT
            value: "3003"
        livenessProbe:
          httpGet:
            path: /ping
            port: 3003
          initialDelaySeconds: 0
          periodSeconds: 10
          timeoutSeconds: 1
          failureThreshold: 3
        readinessProbe:
          httpGet:
            path: /ping
            port: 3003
          initialDelaySeconds: 0
          periodSeconds: 10
          timeoutSeconds: 1
          failureThreshold: 3
        startupProbe:
          httpGet:
            path: /ping
            port: 3003
          initialDelaySeconds: 0
          periodSeconds: 10
          timeoutSeconds: 1
          failureThreshold: 30
        securityContext:
          privileged: true
        resources:
          limits:
            memory: "8Gi"
            cpu: "2"
          requests:
            memory: "2Gi"
            cpu: "500m"
      volumes:
        - name: model-cache
          emptyDir:
            sizeLimit: 10Gi
        - name: config
          configMap:
            name: immich-config
        - name: dev-dri
          hostPath:
            path: /dev/dri
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: extensions.talos.dev/i915
                operator: Exists
--- a/immich/immich-postgres-credentials.yaml
+++ b/immich/immich-postgres-credentials.yaml
@@ -1,7 +1,7 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
-  name: postgres-pw
+  name: postgres-credentials
 spec:
  data:
  - remoteRef:
@@ -9,13 +9,17 @@ spec:
      decodingStrategy: None
      key: cloudnativepg
      metadataPolicy: None
-      property: netmaker_pw
+      property: immich_pw
    secretKey: password
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: weyma-vault
  target:
    template:
      data:
        username: immich
        password: "{{ .password }}"
    creationPolicy: Owner
    deletionPolicy: Retain
-    name: postgres-pw
+    name: postgres-credentials
--- a/immich/immich-server_deployment.yaml
+++ b/immich/immich-server_deployment.yaml
@@ -0,0 +1,94 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: immich-server
 spec:
  selector:
    matchLabels:
      app: immich-server
  template:
    metadata:
      labels:
        app: immich-server
    spec:
      containers:
      - name: immich-server
        image: ghcr.io/immich-app/immich-server:v1.132.3
        volumeMounts:
          - name: library
            mountPath: /usr/src/app/upload
          - name: config
            mountPath: /config/immich-config.yaml
          - name: dev-dri
            mountPath: /dev/dri
        env:
          - name: DB_HOSTNAME
            value: "weyma-pgsql-rw.cloudnativepg.svc.cluster.local"
          - name: DB_DATABASE_NAME
            value: "immich"
          - name: DB_USERNAME
            valueFrom:
              secretKeyRef:
                key: username
                name: postgres-credentials
          - name: DB_PASSWORD
            valueFrom:
              secretKeyRef:
                key: password
                name: postgres-credentials
          - name: REDIS_HOSTNAME
            value: redis
          - name: REDIS_PORT
            value: "6379"
          - name: IMMICH_PORT
            value: "2283"
        livenessProbe:
          httpGet:
            path: /api/server/ping
            port: 2283
          initialDelaySeconds: 0
          periodSeconds: 10
          timeoutSeconds: 1
          failureThreshold: 3
        readinessProbe:
          httpGet:
            path: /api/server/ping
            port: 2283
          initialDelaySeconds: 0
          periodSeconds: 10
          timeoutSeconds: 1
          failureThreshold: 3
        startupProbe:
          httpGet:
            path: /api/server/ping
            port: 2283
          initialDelaySeconds: 0
          periodSeconds: 10
          timeoutSeconds: 1
          failureThreshold: 30
        securityContext:
          privileged: true
        resources:
          limits:
            memory: "8Gi"
            cpu: "2"
          requests:
            memory: "2Gi"
            cpu: "500m"
      volumes:
        - name: library
          persistentVolumeClaim:
            claimName: immich-library
        - name: config
          configMap:
            name: immich-config
        - name: dev-dri
          hostPath:
            path: /dev/dri
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
              - key: extensions.talos.dev/i915
                operator: Exists
--- a/immich/immich-svc.yaml
+++ b/immich/immich-svc.yaml
@@ -0,0 +1,23 @@
 apiVersion: v1
 kind: Service
 metadata:
  name: immich
 spec:
  selector:
    app: immich-server
  ports:
  - port: 2283
    targetPort: 2283
    name: http
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: immich-ml
 spec:
  selector:
    app: immich-ml
  ports:
  - port: 3003
    targetPort: 3003
    name: http
--- a/immich/redis/redis-statefulset.yaml
+++ b/immich/redis/redis-statefulset.yaml
@@ -0,0 +1,38 @@
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
  name: redis
 spec:
  selector:
    matchLabels:
      app: redis
  serviceName: redis
  replicas: 1
  template:
    metadata:
      labels:
        app: redis
    spec:
      containers:
      - name: redis
        image: redis:latest
        command: ["redis-server"]
        args:
          - "--port"
          - "6379"
          - "--dir"
          - "/data"
          - "--appendonly"
          - "yes"
        volumeMounts:
        - name: data
          mountPath: /data
  volumeClaimTemplates:
  - spec:
      accessModes: [ "ReadWriteOnce" ]
      storageClassName: rook-ceph-block
      resources:
        requests:
          storage: 10Gi
    metadata:
      name: data
--- a/immich/redis/redis-svc.yaml
+++ b/immich/redis/redis-svc.yaml
@@ -0,0 +1,10 @@
 apiVersion: v1
 kind: Service
 metadata:
  name: redis
 spec:
  selector:
    app: redis
  ports:
  - port: 6379
    targetPort: 6379
--- a/jellyfin/Chart.yaml
+++ b/jellyfin/Chart.yaml
@@ -1,28 +0,0 @@
 apiVersion: v2
 name: jellyfin
 description: A Helm chart for Kubernetes
 # A chart can be either an 'application' or a 'library' chart.
 #
 # Application charts are a collection of templates that can be packaged into versioned archives
 # to be deployed.
 #
 # Library charts provide useful utilities or functions for the chart developer. They're included as
 # a dependency of application charts to inject those utilities and functions into the rendering
 # pipeline. Library charts do not define any templates and therefore cannot be deployed.
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
 version: 0.1.0
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 appVersion: "1.0"
 dependencies:
 - name: jellyfin
  version: 2.7.0
  repository: https://jellyfin.github.io/jellyfin-helm
--- a/jellyfin/templates/metrics-block.yaml
+++ b/jellyfin/templates/metrics-block.yaml
@@ -1,33 +0,0 @@
 {{- if and (.Values.jellyfin.metrics.enabled) (.Values.jellyfin.ingress.enabled) -}}
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: dummy-svc
  namespace: {{ .Release.Namespace }}
 spec:
  selector:
    app: dummy-svc
  ports:
    - protocol: TCP
      port: 6767
      targetPort: 6767
 ---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  name: block-metrics
  namespace: {{ .Release.Namespace }}
 spec:
  rules:
  - host: {{ (index .Values.jellyfin.ingress.hosts 0).host }}
    http:
      paths:
      - pathType: Prefix
        path: "/metrics"
        backend:
          service:
            name: dummy-svc
            port: 
              number: 6767
 {{- end }}
--- a/jellyfin/templates/redirect-regex.yaml
+++ b/jellyfin/templates/redirect-regex.yaml
@@ -1,26 +0,0 @@
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
  name: emby-redirect
 spec:
  redirectRegex:
    regex: ^https?://emby\.dubyatp\.xyz/(.*)$
    replacement: https://jellyfin.dubyatp.xyz/${1}
    permanent: true
 ---
 apiVersion: traefik.io/v1alpha1
 kind: IngressRoute
 metadata:
  name: emby-redirect
 spec:
  entryPoints:
  - websecure
  - web
  routes:
  - kind: Rule
    match: Host(`emby.dubyatp.xyz`)
    middlewares:
        - name: emby-redirect
    services:
      - name: noop@internal
        kind: TraefikService
--- a/jellyfin/templates/ssl-cert.yaml
+++ b/jellyfin/templates/ssl-cert.yaml
@@ -1,11 +0,0 @@
 apiVersion: v1
 data:
  tls.crt:
  tls.key:
 kind: Secret
 metadata:
  annotations:
    replicator.v1.mittwald.de/replicate-from: cert-manager/cert-dubyatp-xyz
    replicator.v1.mittwald.de/replicated-keys: tls.crt,tls.key
  name: cert-dubyatp-xyz
 type: Opaque
--- a/jellyfin/values.yaml
+++ b/jellyfin/values.yaml
@@ -1,73 +0,0 @@
 jellyfin:
  deploymentStrategy:
    type: Recreate
  ingress:
    enabled: true
    hosts:
      - host: jellyfin.dubyatp.xyz
        paths:
          - path: /
            pathType: ImplementationSpecific
    tls:
      - secretName: cert-dubyatp.xyz
        hosts:
          - jellyfin.dubyatp.xyz
  persistence:
    config:
      size: 25Gi
    media:
      enabled: false
  volumes:
    - name: tv-shows
      nfs:
        server: 10.105.15.20
        path: /mnt/hdd-pool/tv-shows
    - name: movies
      nfs:
        server: 10.105.15.20
        path: /mnt/hdd-pool/movies
    - name: dvr
      nfs:
        server: 10.105.15.20
        path: /mnt/hdd-pool/DVR
    - name: youtube-vids
      nfs:
        server: 10.105.15.20
        path: /mnt/hdd-pool/youtube-vids
    - name: transcode-temp
      emptyDir:
        sizeLimit: 8Gi
        medium: Memory
    - name: dev-dri
      hostPath:
        path: /dev/dri
  metrics:
    enabled: true
    serviceMonitor:
      enabled: true
  volumeMounts:
    - name: tv-shows
      mountPath: /mnt/tv-shows
    - name: movies
      mountPath: /mnt/movies
    - name: dvr
      mountPath: /mnt/dvr
    - name: youtube-vids
      mountPath: /mnt/youtube-vids
    - name: transcode-temp
      mountPath: /tmp/transcode
    - name: dev-dri
      mountPath: /dev/dri
  podAnnotations:
    backup.velero.io/backup-volumes: config
  securityContext:
    privileged: true
  nodeSelector:
    kubernetes.io/hostname: weyma-talos-testw04
  affinity:
    nodeAffinity:
      requiredDuringSchedulingIgnoredDuringExecution:
        nodeSelectorTerms:
          - matchExpressions:
            - key: extensions.talos.dev/i915
              operator: Exists
--- a/netmaker/config.yaml
+++ b/netmaker/config.yaml
@@ -1,25 +0,0 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: netmaker-config 
 data:
  SERVER_NAME: netmaker.infra.dubyatp.xyz
  SERVER_API_CONN_STRING: api.netmaker.infra.dubyatp.xyz:443
  SERVER_HTTP_HOST: api.netmaker.infra.dubyatp.xyz
  API_PORT: "8081"
  WG_QUICK_USERSPACE_IMPLEMENTATION: wireguard-go
  DNS_MODE: "off"
  DISPLAY_KEYS: "on"
  DATABASE: postgres
  SQL_HOST: "pooler-weyma-rw.cloudnativepg.svc.cluster.local"
  SQL_PORT: "5432"
  SQL_DB: "netmaker"
  SQL_USER: "netmaker"
  MQ_USERNAME: netmaker
  CORS_ALLOWED_ORIGIN: '*'
  SERVER_BROKER_ENDPOINT: "ws://mq:1883"
  BROKER_ENDPOINT: "wss://broker.netmaker.infra.dubyatp.xyz"
  PLATFORM: "Kubernetes"
  VERBOSITY: "3"
  K8s: "true"
  CACHING_ENABLED: "false"
--- a/netmaker/ingress.yaml
+++ b/netmaker/ingress.yaml
@@ -1,16 +0,0 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  name: netmaker-api-ingress
 spec:
  rules:
  - host: api.netmaker.infra.dubyatp.xyz
    http:
      paths:
      - pathType: Prefix
        path: "/"
        backend:
          service:
            name: netmaker-rest
            port: 
              number: 8081
--- a/netmaker/mosquitto/config.yaml
+++ b/netmaker/mosquitto/config.yaml
@@ -1,38 +0,0 @@
 apiVersion: v1
 data:
  mosquitto.conf: |
    per_listener_settings false
    listener 8883
    protocol websockets
    allow_anonymous false
    listener 1883
    protocol websockets
    allow_anonymous false
    password_file /mosquitto/temp/password.txt
  wait.sh: |
    #!/bin/ash
    encrypt_password() {
      echo "${MQ_USERNAME}:${MQ_PASSWORD}" > /mosquitto/temp/password.txt
      mosquitto_passwd -U /mosquitto/temp/password.txt
      chmod 0700 /mosquitto/temp/password.txt
    }
    main(){
     encrypt_password
     echo "Starting MQ..."
     # Run the main container command.
     /docker-entrypoint.sh
     /usr/sbin/mosquitto -c /mosquitto/config/mosquitto.conf
    }
    main "${@}"
 kind: ConfigMap
 metadata:
  labels:
    app.kubernetes.io/instance: mosquitto
    app.kubernetes.io/name: mosquitto
  name: mosquitto-config
  namespace: netmaker
--- a/netmaker/mosquitto/deployment.yaml
+++ b/netmaker/mosquitto/deployment.yaml
@@ -1,83 +0,0 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: mosquitto
 spec:
  progressDeadlineSeconds: 600
  replicas: 1
  selector:
    matchLabels:
      app.kubernetes.io/instance: mosquitto
      app.kubernetes.io/name: mosquitto
  strategy:
    type: Recreate
  template:
    metadata:
      labels:
        app.kubernetes.io/instance: mosquitto
        app.kubernetes.io/name: mosquitto
    spec:
      containers:
      - image: eclipse-mosquitto:2.0.22-openssl
        imagePullPolicy: IfNotPresent
        command: ["/mosquitto/config/wait.sh"]
        livenessProbe:
          failureThreshold: 3
          periodSeconds: 10
          successThreshold: 1
          tcpSocket:
            port: 8883
          timeoutSeconds: 1
        name: mosquitto
        env:
          - name: MQ_USERNAME
            value: netmaker
          - name: MQ_PASSWORD
            valueFrom:
              secretKeyRef:
                key: mq_password
                name: netmaker-secrets
        ports:
        - containerPort: 1883        
          name: mqtt
          protocol: TCP
        - containerPort: 8883        
          name: mqtt2
          protocol: TCP
        readinessProbe:
          failureThreshold: 3
          periodSeconds: 10
          successThreshold: 1
          tcpSocket:
            port: 8883
          timeoutSeconds: 1
        resources: {}
        startupProbe:
          failureThreshold: 30
          periodSeconds: 5
          successThreshold: 1
          tcpSocket:
            port: 8883
          timeoutSeconds: 1
        terminationMessagePath: /dev/termination-log
        terminationMessagePolicy: File
        volumeMounts:
        - mountPath: /mosquitto/config
          name: mosquitto-config
        - mountPath: /mosquitto/certs
          name: shared-certs
        - mountPath: /mosquitto/temp
          name: mosquitto-temp
      dnsPolicy: ClusterFirst
      restartPolicy: Always
      terminationGracePeriodSeconds: 30
      volumes:
      - configMap:
          name: mosquitto-config
          defaultMode: 0755
        name: mosquitto-config
      - name: mosquitto-temp
        emptyDir:
      - name: shared-certs
        persistentVolumeClaim:
          claimName: shared-certs-pvc
--- a/netmaker/mosquitto/svc.yaml
+++ b/netmaker/mosquitto/svc.yaml
@@ -1,36 +0,0 @@
 apiVersion: v1
 kind: Service
 metadata:
  name: mq
  namespace: netmaker
 spec:
  ports:
  - name: mqtt
    port: 1883
    protocol: TCP
    targetPort: mqtt
  - name: mqtt2
    port: 8883
    protocol: TCP
    targetPort: mqtt2    
  selector:
    app.kubernetes.io/instance: mosquitto
    app.kubernetes.io/name: mosquitto
  sessionAffinity: None
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: 'netmaker-mqtt'
 spec:
  externalTrafficPolicy: Cluster
  type: NodePort
  selector:
    app.kubernetes.io/instance: mosquitto
    app.kubernetes.io/name: mosquitto
  ports:
  - port: 31883
    nodePort: 31883
    protocol: TCP
    targetPort: 8883
    name: nm-mqtt
--- a/netmaker/secrets.yaml
+++ b/netmaker/secrets.yaml
@@ -1,35 +0,0 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: netmaker-secrets
 spec:
  data:
  - remoteRef:
      conversionStrategy: Default
      decodingStrategy: None
      key: netmaker
      metadataPolicy: None
      property: master_key
    secretKey: master_key
  - remoteRef:
      conversionStrategy: Default
      decodingStrategy: None
      key: netmaker
      metadataPolicy: None
      property: mq_password
    secretKey: mq_password
  - remoteRef:
      conversionStrategy: Default
      decodingStrategy: None
      key: netmaker
      metadataPolicy: None
      property: turn_password
    secretKey: turn_password
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: weyma-vault
  target:
    creationPolicy: Owner
    deletionPolicy: Retain
    name: netmaker-secrets
--- a/netmaker/statefulset.yaml
+++ b/netmaker/statefulset.yaml
@@ -1,95 +0,0 @@
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
  labels:
    app: netmaker
  name: netmaker
 spec:
  replicas: 3
  serviceName: netmaker-headless
  selector:
    matchLabels:
      app: netmaker
  template:
    metadata:
      labels:
        app: netmaker
    spec:
      initContainers:
      - name: init-sysctl
        image: busybox
        imagePullPolicy: IfNotPresent
        command: ["/bin/sh", "-c"]
        args: ["sysctl -w net.ipv4.ip_forward=1 && sysctl -w net.ipv4.conf.all.src_valid_mark=1 && sysctl -w net.ipv6.conf.all.disable_ipv6=0 && sysctl -w net.ipv6.conf.all.forwarding=1"]
        securityContext:
          privileged: true
      dnsPolicy: ClusterFirstWithHostNet
      containers:
      - env:
        - name: NODE_ID
          valueFrom:
            fieldRef:
              apiVersion: v1
              fieldPath: metadata.name
        - name: SQL_PASS
          valueFrom:
            secretKeyRef:
              key: password
              name: postgres-pw
        - name: MASTER_KEY
          valueFrom:
            secretKeyRef:
              key: master_key
              name: netmaker-secrets
        - name: MQ_PASSWORD
          valueFrom:
            secretKeyRef:
              key: mq_password
              name: netmaker-secrets
        - name: TURN_SERVER_PASSWORD
          valueFrom:
            secretKeyRef:
              key: turn_password
              name: netmaker-secrets
        envFrom:
          - configMapRef:
              name: netmaker-config
        image: gravitl/netmaker:v1.4.0
        imagePullPolicy: Always
        name: netmaker
        ports:
        - containerPort: 8081
          protocol: TCP
        - containerPort: 31821
          protocol: UDP
        - containerPort: 31822
          protocol: UDP
        - containerPort: 31823
          protocol: UDP
        - containerPort: 31824
          protocol: UDP
        - containerPort: 31825
          protocol: UDP
        - containerPort: 31826
          protocol: UDP
        - containerPort: 31827
          protocol: UDP
        - containerPort: 31828
          protocol: UDP
        - containerPort: 31829
          protocol: UDP
        - containerPort: 31830
          protocol: UDP
        resources: {}
        securityContext:
          capabilities:
            add:
            - NET_ADMIN
            - NET_RAW
        volumeMounts:
        - mountPath: /etc/netmaker/
          name: shared-certs
      volumes:
      - name: shared-certs
        persistentVolumeClaim:
          claimName: shared-certs-pvc
--- a/netmaker/svc.yaml
+++ b/netmaker/svc.yaml
@@ -1,14 +0,0 @@
 apiVersion: v1
 kind: Service
 metadata:
  name: 'netmaker-rest'
 spec:
  ports:
  - name: rest
    port: 8081
    protocol: TCP
    targetPort: 8081
  selector:
    app: 'netmaker'
  sessionAffinity: None
  type: ClusterIP
--- a/netmaker/ui/deployment.yaml
+++ b/netmaker/ui/deployment.yaml
@@ -1,21 +0,0 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: netmaker-ui
 spec:
  replicas: 2
  selector:
    matchLabels:
      app: netmaker-ui
  template:
    metadata:
      labels:
        app: netmaker-ui
    spec:
      containers:
      - name: netmaker-ui
        image: gravitl/netmaker-ui:v1.1.0
        env:
        - name: BACKEND_URL
          value: 'https://api.netmaker.infra.dubyatp.xyz'
      terminationGracePeriodSeconds: 15
--- a/netmaker/ui/ingress.yaml
+++ b/netmaker/ui/ingress.yaml
@@ -1,16 +0,0 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  name: netmaker-ui-ingress
 spec:
  rules:
  - host: dashboard.netmaker.infra.dubyatp.xyz
    http:
      paths:
      - pathType: Prefix
        path: "/"
        backend:
          service:
            name: netmaker-ui
            port: 
              number: 80
--- a/netmaker/ui/svc.yaml
+++ b/netmaker/ui/svc.yaml
@@ -1,13 +0,0 @@
 apiVersion: v1
 kind: Service
 metadata:
  name: 'netmaker-ui'
 spec:
  ports:
  - port: 80
    protocol: TCP
    targetPort: 80
  selector:
    app: 'netmaker-ui'
  sessionAffinity: None
  type: 'ClusterIP'
--- a/renovate.json
+++ b/renovate.json
@@ -1,6 +1,3 @@
 {
-  "$schema": "https://docs.renovatebot.com/renovate-schema.json",
+  "$schema": "https://docs.renovatebot.com/renovate-schema.json"
  "kubernetes": {
    "managerFilePatterns": ["deployment.yaml", "statefulset.yaml", "cron.yaml", "cronjob.yaml"]
  }
 }
--- a/renovate/renovate-config.yaml
+++ b/renovate/renovate-config.yaml
@@ -5,12 +5,5 @@ metadata:
 data:
  config.json: |-
    {
-      "repositories": [
+      "repositories": ["infrastructure/core-apps","infrastructure/db-operators","infrastructure/weyma-talos"]
        "infrastructure/core-apps",
        "infrastructure/db-operators",
        "infrastructure/weyma-talos",
        "williamp/dubyatp.xyz",
        "williamp/yt-dlp-bot",
        "williamp/helm-gitea"
      ]
    }
--- a/renovate/renovate-cronjob.yaml
+++ b/renovate/renovate-cronjob.yaml
@@ -27,11 +27,6 @@ spec:
                    secretKeyRef:
                      key: github-com-pat
                      name: renovate-github-com-token
                - name: RENOVATE_GIT_PRIVATE_KEY
                  valueFrom:
                    secretKeyRef:
                      key: ssh-key
                      name: renovate-ssh-key
                - name: RENOVATE_AUTODISCOVER
                  value: 'false'
                - name: RENOVATE_BASE_DIR
--- a/renovate/renovate-ssh-key.yaml
+++ b/renovate/renovate-ssh-key.yaml
@@ -1,17 +0,0 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: renovate-ssh-key
 spec:
  refreshInterval: 1h
  secretStoreRef:
    name: weyma-vault
    kind: ClusterSecretStore
  target:
    name: renovate-ssh-key
    creationPolicy: Owner
  data:
    - secretKey: ssh-key
      remoteRef:
        key: renovate
        property: ssh-key
--- a/vaultwarden/configmap.yaml
+++ b/vaultwarden/configmap.yaml
@@ -6,10 +6,10 @@ data:
  DATA_FOLDER: config
  DOMAIN: https://vaultwarden.dubyatp.xyz
  SIGNUPS_ALLOWED: "false"
-  SMTP_FROM: vaultwarden@em924671.dubyatp.xyz
+  SMTP_FROM: bitwarden@em3532.williamtpeebles.com
  SMTP_FROM_NAME: Vaultwarden
-  SMTP_HOST: mail.smtp2go.com
+  SMTP_HOST: smtp.sendgrid.net
-  SMTP_PORT: "2525"
+  SMTP_PORT: "587"
-  SMTP_SECURITY: "off"
+  SMTP_SECURITY: starttls
  SMTP_TIMEOUT: "15"
-  SMTP_USERNAME: vaultwarden_dubyatp
+  SMTP_USERNAME: apikey
--- a/vaultwarden/deployment.yaml
+++ b/vaultwarden/deployment.yaml
@@ -17,7 +17,7 @@ spec:
    spec:
      containers:
      - name: vaultwarden
-        image: vaultwarden/server:1.35.2-alpine
+        image: vaultwarden/server:1.33.2-alpine
        livenessProbe:
          exec:
            command:
--- a/vaultwarden/secret.yaml
+++ b/vaultwarden/secret.yaml
@@ -19,11 +19,7 @@ spec:
      remoteRef:
        key: vaultwarden
        property: hibp_api_key
    - secretKey: SMTP_PASSWORD_OLD
      remoteRef:
        key: vaultwarden
        property: smtp_password
    - secretKey: SMTP_PASSWORD
      remoteRef:
        key: vaultwarden
-        property: smtp_password_smtp2go
+        property: smtp_password
--- a/yt-dlp-bot/deployment.yaml
+++ b/yt-dlp-bot/deployment.yaml
@@ -1,44 +0,0 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: yt-dlp-bot
 spec:
  replicas: 1
  selector:
    matchLabels:
      app: yt-dlp-bot
  template:
    metadata:
      labels:
        app: yt-dlp-bot
    spec:
      containers:
        - name: yt-dlp-bot
          image: 'git.dubyatp.xyz/williamp/yt-dlp-bot:6e7fc73'
          env:
            - name: OUT_PATH
              value: /data/youtube-vids
            - name: TEMP_PATH
              value: /tmp/ytdlp-temp
          envFrom:
            - secretRef:
                name: yt-dlp-discord-token
          volumeMounts:
            - name: youtube-vids
              mountPath: /data/youtube-vids
            - name: temp
              mountPath: /tmp/ytdlp-temp
          resources:
            limits:
              memory: "3Gi"
              cpu: "1"
      volumes:
        - name: youtube-vids
          nfs:
            server: 10.105.15.20
            path: /mnt/hdd-pool/youtube-vids
        - name: temp
          emptyDir:
            medium: Memory
  strategy:
    type: Recreate
--- a/yt-dlp-bot/secret.yaml
+++ b/yt-dlp-bot/secret.yaml
@@ -1,21 +0,0 @@
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: yt-dlp-discord-token
 spec:
  data:
  - remoteRef:
      conversionStrategy: Default
      decodingStrategy: None
      key: yt-dlp-bot
      metadataPolicy: None
      property: DISCORD_TOKEN
    secretKey: DISCORD_TOKEN
  refreshInterval: 1h
  secretStoreRef:
    kind: ClusterSecretStore
    name: weyma-vault
  target:
    creationPolicy: Owner
    deletionPolicy: Retain
    name: yt-dlp-discord-token
--- a/zap2xml/bucket.yaml
+++ b/zap2xml/bucket.yaml
@@ -1,10 +0,0 @@
 apiVersion: objectbucket.io/v1alpha1
 kind: ObjectBucketClaim
 metadata:
  name: zap2xml-bucket
  namespace: zap2xml
 spec:
  generateBucketName: zap2xml
  storageClassName: weyma-s3-bucket
  additionalConfig:
    maxSize: "1Gi"
--- a/zap2xml/config.yaml
+++ b/zap2xml/config.yaml
@@ -1,98 +0,0 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: zap2xml-s3config
 data:
  .s3cfg: |
   [default]
   access_key =
   access_token = 
   add_encoding_exts = 
   add_headers = 
   bucket_location = US
   ca_certs_file = 
   cache_file = 
   check_ssl_certificate = True
   check_ssl_hostname = True
   cloudfront_host = cloudfront.amazonaws.com
   connection_max_age = 5
   connection_pooling = True
   content_disposition = 
   content_type = 
   default_mime_type = binary/octet-stream
   delay_updates = False
   delete_after = False
   delete_after_fetch = False
   delete_removed = False
   dry_run = False
   enable_multipart = True
   encoding = UTF-8
   encrypt = False
   expiry_date = 
   expiry_days = 
   expiry_prefix = 
   follow_symlinks = False
   force = False
   get_continue = False
   gpg_command = /usr/bin/gpg
   gpg_decrypt = %(gpg_command)s -d --verbose --no-use-agent --batch --yes --passphrase-fd %(passphrase_fd)s -o %(output_file)s %(input_file)s
   gpg_encrypt = %(gpg_command)s -c --verbose --no-use-agent --batch --yes --passphrase-fd %(passphrase_fd)s -o %(output_file)s %(input_file)s
   gpg_passphrase = 
   guess_mime_type = True
   host_base = https://weyma-s3.infra.dubyatp.xyz
   host_bucket =
   human_readable_sizes = False
   invalidate_default_index_on_cf = False
   invalidate_default_index_root_on_cf = True
   invalidate_on_cf = False
   keep_dirs = False
   kms_key = 
   limit = -1
   limitrate = 0
   list_allow_unordered = False
   list_md5 = False
   log_target_prefix = 
   long_listing = False
   max_delete = -1
   max_retries = 5
   mime_type = 
   multipart_chunk_size_mb = 15
   multipart_copy_chunk_size_mb = 1024
   multipart_max_chunks = 10000
   preserve_attrs = True
   progress_meter = True
   proxy_host = 
   proxy_port = 0
   public_url_use_https = False
   put_continue = False
   recursive = False
   recv_chunk = 65536
   reduced_redundancy = False
   requester_pays = False
   restore_days = 1
   restore_priority = Standard
   secret_key =
   send_chunk = 65536
   server_side_encryption = False
   signature_v2 = False
   signurl_use_https = False
   simpledb_host = sdb.amazonaws.com
   skip_destination_validation = False
   skip_existing = False
   socket_timeout = 300
   ssl_client_cert_file = 
   ssl_client_key_file = 
   stats = False
   stop_on_error = False
   storage_class = 
   throttle_max = 100
   upload_id = 
   urlencoding_mode = normal
   use_http_expect = False
   use_https = True
   use_mime_magic = True
   verbosity = WARNING
   website_endpoint = http://%(bucket)s.s3-website-%(location)s.amazonaws.com/
   website_error = 
   website_index = index.html
--- a/zap2xml/cron.yaml
+++ b/zap2xml/cron.yaml
@@ -1,87 +0,0 @@
 apiVersion: batch/v1
 kind: CronJob
 metadata:
  name: zap2xml-dtv-02191
 spec:
  schedule: "0 */12 * * *"
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: zap2xml
            image: git.dubyatp.xyz/williamp/kube-zap2xml:c075fec
            envFrom:
              - secretRef:
                 name: zap2xml-bucket
            env:
              - name: LINEUP_ID
                value: USA-DITV506-X
              - name: POSTAL_CODE
                value: "02191"
              - name: TIMESPAN
                value: "120"
              - name: OUTPUT_FILE
                value: /tmp/xmltv.xml
              - name: PUBLIC_FILENAME
                value: xmltv-directv-02191.xml
              - name: S3_URL
                value: s3://zap2xml-c134c9a7-a7a0-4113-997e-78e72ec3f576
            volumeMounts:
              - name: s3-config
                mountPath: /root
              - name: temp
                mountPath: /tmp
          restartPolicy: Never
          volumes:
            - name: s3-config
              configMap:
                name: zap2xml-s3config
            - name: temp
              emptyDir:
               sizeLimit: 1Gi
               medium: Memory
 ---
 apiVersion: batch/v1
 kind: CronJob
 metadata:
  name: zap2xml-ota-02191
 spec:
  schedule: "30 */12 * * *"
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: zap2xml
            image: git.dubyatp.xyz/williamp/kube-zap2xml:c075fec
            envFrom:
              - secretRef:
                 name: zap2xml-bucket
            env:
              - name: LINEUP_ID
                value: USA-OTA02191
              - name: POSTAL_CODE
                value: "02191"
              - name: TIMESPAN
                value: "120"
              - name: OUTPUT_FILE
                value: /tmp/xmltv.xml
              - name: PUBLIC_FILENAME
                value: xmltv-ota-02191.xml
              - name: S3_URL
                value: s3://zap2xml-c134c9a7-a7a0-4113-997e-78e72ec3f576
            volumeMounts:
              - name: s3-config
                mountPath: /root
              - name: temp
                mountPath: /tmp
          restartPolicy: Never
          volumes:
            - name: s3-config
              configMap:
                name: zap2xml-s3config
            - name: temp
              emptyDir:
               sizeLimit: 1Gi
               medium: Memory