chore(deps): update renovate/renovate docker tag to v44.132.5

.gitea/tests/deploy-validation.sh

@@ -1,80 +0,0 @@
-#!/usr/bin/env bash
-# Local regressions only: kubectl is mocked and Docker is used for config parsing.
-set -euo pipefail
-repo="$(cd "$(dirname "${BASH_SOURCE[0]}")/../.." && pwd)"
-scratch="$(mktemp -d)"
-trap 'rm -rf "$scratch"' EXIT
-
-mkdir -p "$scratch/repo/app" "$scratch/repo/postgres" "$scratch/repo/netbird" "$scratch/repo/renovate"
-git -C "$scratch/repo" init -q
-for file in app/compose.yaml postgres/shared-compose.yaml netbird/client.compose.yaml renovate/renovate-compose.yaml; do
-  touch "$scratch/repo/$file"
-done
-git -C "$scratch/repo" add .
-# shellcheck source=../workflows/compose-lint.sh
-source "$repo/.gitea/workflows/compose-lint.sh"
-actual="$(cd "$scratch/repo" && compose_files)"
-expected=$'app/compose.yaml\nnetbird/client.compose.yaml\npostgres/shared-compose.yaml\nrenovate/renovate-compose.yaml'
-[ "$actual" = "$expected" ] || { echo 'Compose discovery missed a file' >&2; exit 1; }
-
-cat >"$scratch/compose.yaml" <<'YAML'
-services:
-  example:
-    image: busybox:1.37.0
-    environment:
-      REQUIRED: ${HOMELAB_TEST_REQUIRED:?required for this regression}
-YAML
-unset HOMELAB_TEST_REQUIRED
-if validate_compose_file "$scratch/compose.yaml" >"$scratch/config.log" 2>&1; then
-  echo 'Full Compose validation accepted a missing variable' >&2
-  exit 1
-fi
-grep -q 'required for this regression' "$scratch/config.log"
-HOMELAB_TEST_REQUIRED=present validate_compose_file "$scratch/compose.yaml"
-
-cat >"$scratch/resources.json" <<'JSON'
-{"kind":"List","items":[
-  {"kind":"Deployment","metadata":{"namespace":"app"},"spec":{"template":{"spec":{
-    "containers":[{"envFrom":[{"secretRef":{"name":"credentials"}},{"secretRef":{"name":"optional","optional":true}}],"env":[{"valueFrom":{"secretKeyRef":{"name":"credentials","key":"password"}}}]}],
-    "initContainers":[{"envFrom":[{"secretRef":{"name":"init"}}]}],
-    "imagePullSecrets":[{"name":"registry"}],
-    "volumes":[{"secret":{"secretName":"mounted"}},{"projected":{"sources":[{"secret":{"name":"projected"}},{"secret":{"name":"optional-projected","optional":true}}]}}]
-  }}}},
-  {"kind":"CronJob","metadata":{},"spec":{"jobTemplate":{"spec":{"template":{"spec":{"containers":[{"envFrom":[{"secretRef":{"name":"cron"}}]}]}}}}}},
-  {"kind":"IngressRoute","metadata":{"namespace":"app"},"spec":{"tls":{"secretName":"controller-issued-tls"}}}
-]}
-JSON
-actual="$(jq -r -f "$repo/.gitea/workflows/secret-references.jq" "$scratch/resources.json" | sort)"
-expected=$'app credentials\napp init\napp mounted\napp projected\napp registry\ndefault cron'
-[ "$actual" = "$expected" ] || { echo "Unexpected Secret references: $actual" >&2; exit 1; }
-
-REPO="$repo"
-# shellcheck source=../workflows/deploy-lib.sh
-source "$repo/.gitea/workflows/deploy-lib.sh"
-K8S_MANIFESTS=("$scratch/resources.json")
-KUSTOMIZE_APPS=()
-# No live cluster access. Reject credentials in app even if they exist elsewhere.
-kubectl() {
-  case "$1" in
-    create) cat "$scratch/resources.json" ;;
-    get)
-      if [ "$3" = credentials ] && [ "$5" = app ]; then
-        return 1
-      fi
-      return 0
-      ;;
-    *) echo "Unexpected kubectl invocation: $*" >&2; return 1 ;;
-  esac
-}
-if check_referenced_secrets >"$scratch/secrets.log"; then
-  echo 'Namespace-scoped Secret check accepted a missing Secret' >&2
-  exit 1
-fi
-grep -q 'MISSING OR UNREADABLE: app/credentials' "$scratch/secrets.log"
-# API/rendering errors must not produce an empty reference list and pass.
-kubectl() { return 1; }
-if check_referenced_secrets >"$scratch/secrets.log"; then
-  echo 'Secret check accepted a failed manifest render' >&2
-  exit 1
-fi
-printf '%s\n' 'Deploy validation regressions passed.'

.gitea/workflows/ci.yaml

@@ -3,7 +3,7 @@ name: ci
 on:
   push:
     branches:
-      - main
+      - "**"
   pull_request:
   workflow_dispatch:
 
@@ -88,7 +88,7 @@ jobs:
         shell: bash
         run: |
           set -euo pipefail
-          tools_dir="$(bash .gitea/workflows/install-ci-tools.sh shellcheck jq)"
+          tools_dir="$(bash .gitea/workflows/install-ci-tools.sh shellcheck)"
           export PATH="$tools_dir:$PATH"
           mapfile -t scripts < <(
             git ls-files '*.sh' ':(glob)**/*.bash'
@@ -98,7 +98,6 @@ jobs:
             exit 0
           fi
           shellcheck --external-sources --source-path=SCRIPTDIR --severity=style "${scripts[@]}"
-          bash .gitea/tests/deploy-validation.sh
 
   lint-prettier:
     runs-on: [self-hosted, linux, arch, homelab]
@@ -142,7 +141,6 @@ jobs:
           export PATH="$tools_dir:$PATH"
           ruff check .
           ruff format --check .
-          python3 -m unittest discover -s tests -v
 
   lint-yaml:
     runs-on: [self-hosted, linux, arch, homelab]

.gitea/workflows/compose-lint.sh

@@ -21,7 +21,8 @@
 # All committed Compose files, including the ones deploy never starts.
 compose_files() {
   git ls-files \
-    '*compose.yaml' '*compose.yml'
+    '*/compose.yaml' '*/compose.yml' 'compose.yaml' 'compose.yml' \
+    '*/docker-compose.yaml' '*/docker-compose.yml'
 }
 
 # Prints the flags that turn `docker compose config` into the general check.

.gitea/workflows/deploy-lib.sh

@@ -31,16 +31,6 @@ warn() {
   echo "WARNING: $*" >&2
 }
 
-# Prune needs the complete desired set in one invocation. Per-file pruning
-# treats resources from the other files as absent and can delete them.
-check_prune_mode() {
-  if [ "$APPLY_PRUNE" = "true" ]; then
-    echo "ERROR: APPLY_PRUNE=true is unsupported by the per-file deploy loop." >&2
-    echo "Disable it; remove obsolete resources explicitly after review." >&2
-    return 1
-  fi
-}
-
 collect_k8s() {
   git -C "$REPO" ls-files -- "$1" \
     | grep -E '\.ya?ml$' \
@@ -696,53 +686,27 @@ stage_preflight() {
   git -C "$REPO" reset --hard "$target"
 }
 
-# Required pod Secrets, scoped to the resource namespace. TLS route Secrets are
-# created by cert-manager and are not prerequisites for applying a Certificate.
-check_referenced_secrets() {
-  local m k objects refs extracted ns name
-  local missing=()
-  refs=""
-  for m in ${K8S_MANIFESTS[@]+"${K8S_MANIFESTS[@]}"}; do
-    objects="$(kubectl create --dry-run=client --validate=false -f "$m" -o json)" || return 1
-    extracted="$(printf '%s' "$objects" | jq -r -f "$REPO/.gitea/workflows/secret-references.jq")" || return 1
-    refs+="$extracted"$'\n'
-  done
-  for k in ${KUSTOMIZE_APPS[@]+"${KUSTOMIZE_APPS[@]}"}; do
-    objects="$(kubectl kustomize "$k" | kubectl create --dry-run=client --validate=false -f - -o json)" || return 1
-    extracted="$(printf '%s' "$objects" | jq -r -f "$REPO/.gitea/workflows/secret-references.jq")" || return 1
-    refs+="$extracted"$'\n'
-  done
-  while read -r ns name; do
-    [ -n "${name:-}" ] || continue
-    if kubectl get secret "$name" -n "$ns" -o name >/dev/null 2>&1; then
-      echo "  ok: $ns/$name"
-    else
-      echo "  MISSING OR UNREADABLE: $ns/$name"
-      missing+=("$ns/$name")
-    fi
-  done < <(printf '%s' "$refs" | sort -u)
-  if [ "${#missing[@]}" -gt 0 ]; then
-    echo "ERROR: required pod Secrets are missing or unreadable:"
-    printf '  - %s\n' "${missing[@]}"
-    echo "Create them in the listed namespaces from the service's secret example."
-    return 1
-  fi
-}
-
 stage_validate() {
-  check_prune_mode || return 1
   cd "$REPO"
   select_manifests
   local m k cf
-  # The deploy host has the local .env and secret files. Resolve them here so
+  # Compose .env files and secret files are gitignored by design, so the
-  # missing configuration fails before either apply job changes workloads.
+  # workstation never has real values for the inactive stacks. This stage only
-  # CI keeps the structure-only check for inactive stacks.
+  # runs the full check on active stacks; the general structure check for every
+  # committed Compose file (active or not) lives in the ci workflow, which has no
+  # .env at all.
+  #
+  # Active stacks are still validated with interpolation and env-file resolution
+  # off, so required-variable guards (:?) and missing local files do not fail the
+  # deploy. Normalization and consistency checks stay enabled.
   # shellcheck source=compose-lint.sh
   source "$REPO/.gitea/workflows/compose-lint.sh"
+  local compose_validate_flags=()
+  mapfile -t compose_validate_flags < <(compose_safe_flags)
   log "Validate compose stacks"
   for cf in ${COMPOSE_STACKS[@]+"${COMPOSE_STACKS[@]}"}; do
     echo "  config: $cf"
-    validate_compose_file "$cf"
+    validate_compose_file "$cf" ${compose_validate_flags[@]+"${compose_validate_flags[@]}"}
   done
   log "Validate k8s manifests (kubectl dry-run=client)"
   for m in ${K8S_MANIFESTS[@]+"${K8S_MANIFESTS[@]}"}; do
@@ -760,20 +724,48 @@ stage_validate() {
   done
   log "Checking referenced Secrets exist"
   echo "  (deploy never applies *secret*.yaml; create missing ones manually)"
-  check_referenced_secrets
+  local ref_secrets=() missing_secrets=() all_secrets s
+  if [ "${#K8S_MANIFESTS[@]}" -gt 0 ]; then
+    while IFS= read -r s; do
+      [ -n "$s" ] && ref_secrets+=("$s")
+    done < <(
+      {
+        grep -h -A1 -E 'secretRef:|secretKeyRef:' "${K8S_MANIFESTS[@]}" 2>/dev/null || true
+        grep -h -E 'secretName:' "${K8S_MANIFESTS[@]}" 2>/dev/null || true
+      } | grep -E 'name:' | sed -E 's/.*name:[[:space:]]*//' | tr -d '"'"'"' "'"'" | sed -E 's/[[:space:]]*#.*//' | awk 'NF' | sort -u || true
+    )
+  fi
+  all_secrets="$(kubectl get secrets -A --no-headers -o custom-columns=:metadata.name 2>/dev/null || true)"
+  for s in ${ref_secrets[@]+"${ref_secrets[@]}"}; do
+    if printf '%s\n' "$all_secrets" | grep -qx "$s"; then
+      echo "  ok: $s"
+    else
+      echo "  MISSING: $s"
+      missing_secrets+=("$s")
+    fi
+  done
+  if [ "${#missing_secrets[@]}" -gt 0 ]; then
+    echo "ERROR: ${#missing_secrets[@]} referenced Secret(s) not found in the cluster:"
+    printf '  - %s\n' "${missing_secrets[@]}"
+    echo "Create them manually from the laptop, e.g.:"
+    echo "  kubectl apply -f SERVICE/k8s/secrets.yaml  # see SERVICE/k8s/secrets.yaml.example"
+    exit 1
+  fi
 }
 
 stage_apply_k8s() {
-  check_prune_mode || return 1
   cd "$REPO"
   select_manifests >/dev/null
-  local ns_files=() other_files=() m k
+  local ns_files=() other_files=() m k prune_opts=()
   for m in ${K8S_MANIFESTS[@]+"${K8S_MANIFESTS[@]}"}; do
     case "$m" in
       */namespace.y?ml) ns_files+=("$m") ;;
       *) other_files+=("$m") ;;
     esac
   done
+  if [ "$APPLY_PRUNE" = "true" ]; then
+    prune_opts=(--prune -l app.kubernetes.io/managed-by=homelab-deploy)
+  fi
 
   # Record what is about to change, and publish it for the verify job, before
   # the first apply. Both are fatal on failure: see snapshot_dir.
@@ -798,7 +790,7 @@ stage_apply_k8s() {
   if [ "${#other_files[@]}" -gt 0 ]; then
     log "Applying resources (${#other_files[@]} files, our images pinned to digests)"
     for m in "${other_files[@]}"; do
-      if ! render_pinned <"$m" | kubectl apply -f -; then
+      if ! render_pinned <"$m" | kubectl apply "${prune_opts[@]}" -f -; then
         echo "ERROR: apply failed for ${m#"$REPO"/}" >&2
         exit 1
       fi

.gitea/workflows/deploy.yaml

@@ -5,7 +5,6 @@ on:
   # workflow_dispatch so a red lint/validate run can never reach the cluster.
   workflow_run:
     workflows: [ci]
-    branches: [main]
     types: [completed]
   workflow_dispatch:
 

.gitea/workflows/install-ci-tools.sh

@@ -120,15 +120,6 @@ install_shellcheck() {
   rm -rf "$tmp"
 }
 
-install_jq() {
-  if at_version jq "${JQ_VERSION}"; then
-    return 0
-  fi
-  fetch "https://github.com/jqlang/jq/releases/download/jq-${JQ_VERSION}/jq-linux-${goarch}" \
-    "$BIN_DIR/jq"
-  chmod 0755 "$BIN_DIR/jq"
-}
-
 install_uv() {
   if at_version uv "${UV_VERSION}"; then
     return 0
@@ -245,7 +236,6 @@ for tool in "${wanted[@]}"; do
   case "$tool" in
     kubeconform) install_kubeconform ;;
     shellcheck) install_shellcheck ;;
-    jq) install_jq ;;
     actionlint) install_actionlint ;;
     prettier) install_prettier ;;
     ruff) install_ruff ;;

.gitea/workflows/renovate-ci.yaml

@@ -2,23 +2,9 @@ name: renovate-ci
 
 on:
   pull_request:
-    paths:
-      - "renovate/**"
-      - ".gitea/workflows/renovate-ci.yaml"
-      - ".gitea/workflows/sync-renovate-configmap.sh"
-      - ".gitea/workflows/compose-lint.sh"
-      - ".gitea/workflows/install-ci-tools.sh"
-      - ".gitea/workflows/tool-versions.env"
   push:
     branches:
       - main
-    paths:
-      - "renovate/**"
-      - ".gitea/workflows/renovate-ci.yaml"
-      - ".gitea/workflows/sync-renovate-configmap.sh"
-      - ".gitea/workflows/compose-lint.sh"
-      - ".gitea/workflows/install-ci-tools.sh"
-      - ".gitea/workflows/tool-versions.env"
   workflow_dispatch:
 
 permissions:

.gitea/workflows/renovate-run.yaml

@@ -81,7 +81,7 @@ jobs:
           docker run --rm \
             -v "$PWD/renovate/renovate.json:/opt/renovate/renovate.json:ro" \
             -e RENOVATE_PLATFORM=gitea \
-            -e RENOVATE_ENDPOINT=https://git.forust.xyz/api/v1 \
+            -e RENOVATE_ENDPOINT=https://gitea.forust.xyz/api/v1 \
             -e RENOVATE_TOKEN="$RENOVATE_TOKEN" \
             -e RENOVATE_GITHUB_COM_TOKEN="${RENOVATE_GITHUB_COM_TOKEN:-}" \
             -e RENOVATE_REPOSITORIES="${RENOVATE_REPOSITORIES:-forust/homelab}" \

.gitea/workflows/secret-references.jq

@@ -1,13 +0,0 @@
-# kubectl emits a List for files containing multiple resources.
-(if .kind == "List" then .items[] else . end)
-| (.metadata.namespace // "default") as $ns
-| [
-    (.. | objects
-      | (.secretRef? // empty), (.secretKeyRef? // empty), (.secret? // empty)
-      | select(.optional != true)
-      | .name // .secretName // empty),
-    (.. | objects | .imagePullSecrets[]?.name)
-  ]
-| unique[]
-| select(. != null and . != "")
-| "\($ns) \(.)"

.gitea/workflows/tool-versions.env

@@ -31,6 +31,3 @@ UV_VERSION="0.12.17"
 # so the tree that gets tested is the tree that gets built. Renovate keeps this
 # in step with the Dockerfile's node: tag via the "node runtime" group.
 NODE_VERSION="22.23.3"
-
-# Secret-reference regression tests parse rendered Kubernetes objects.
-JQ_VERSION="1.8.1"

adguardhome/k8s/adguard.yaml

@@ -51,8 +51,6 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    reloader.stakater.com/auto: "true"
   name: adguard-deployment
   namespace: adguard
 spec:
@@ -66,8 +64,39 @@ spec:
     metadata:
       labels:
         app: adguard
+      annotations:
+        reloader.stakater.com/auto: "true"
     spec:
       containers:
+        - name: netbird
+          image: netbirdio/netbird:0.80.0
+          envFrom:
+            - configMapRef:
+                name: adguard-config
+          env:
+            - name: NB_SETUP_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: adguard-netbird-secrets
+                  key: NB_SETUP_KEY
+          securityContext:
+            capabilities:
+              add:
+                - NET_ADMIN
+                - SYS_ADMIN
+                - SYS_RESOURCE
+          resources:
+            requests:
+              memory: "64Mi"
+              cpu: "50m"
+            limits:
+              memory: "256Mi"
+              cpu: "200m"
+          volumeMounts:
+            - name: netbird-state
+              mountPath: /var/lib/netbird
+            - name: dev-tun
+              mountPath: /dev/net/tun
         - name: adguard
           image: adguard/adguardhome:v0.107.79
           resources:
@@ -84,13 +113,6 @@ spec:
               name: dns
             - containerPort: 853
               name: dot
-          readinessProbe:
-            tcpSocket:
-              port: dns
-            initialDelaySeconds: 5
-            periodSeconds: 5
-            successThreshold: 1
-            failureThreshold: 3
           volumeMounts:
             - name: adguard-data
               mountPath: /opt/adguardhome/work
@@ -102,6 +124,12 @@ spec:
               mountPath: /certs
               readOnly: true
       volumes:
+        - name: netbird-state
+          emptyDir: {}
+        - name: dev-tun
+          hostPath:
+            path: /dev/net/tun
+            type: CharDevice
         - name: adguard-data
           persistentVolumeClaim:
             claimName: adguard-pvc

adguardhome/k8s/config.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: adguard-config
+  namespace: adguard
+data:
+  NB_MANAGEMENT_URL: "https://nb.forust.xyz"
+  NB_HOSTNAME: "adguard"
+  NB_LOG_LEVEL: "info"
+  NB_DISABLE_DNS: "true"

adguardhome/k8s/netbird-secrets.yaml.example

@@ -0,0 +1,8 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: adguard-netbird-secrets
+  namespace: adguard
+type: Opaque
+stringData:
+  NB_SETUP_KEY: "REPLACE_ME"

authentik/k8s/authentik.yaml

@@ -27,8 +27,6 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    reloader.stakater.com/auto: "true"
   name: authentik-server-deployment
   namespace: authentik
 spec:
@@ -65,8 +63,6 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    reloader.stakater.com/auto: "true"
   name: authentik-worker-deployment
   namespace: authentik
 spec:

cfddns/k8s/deployment.yaml

@@ -1,8 +1,6 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    reloader.stakater.com/auto: "true"
   name: cfddns
   labels:
     app: cfddns

checkmk/k8s/checkmk.yaml

@@ -17,8 +17,6 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    reloader.stakater.com/auto: "true"
   name: checkmk-deployment
   namespace: checkmk
 spec:

cloudflared/k8s/deployment.yaml

@@ -1,8 +1,6 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    reloader.stakater.com/auto: "true"
   name: cloudflared
   labels:
     app: cloudflared

converters/k8s/convertx.yaml

@@ -13,8 +13,6 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    reloader.stakater.com/auto: "true"
   name: convertx-deployment
   namespace: converters
 spec:

edu_master/k8s/session-keeper.yaml

@@ -1,8 +1,6 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    reloader.stakater.com/auto: "true"
   name: session-keeper
   namespace: edu-master
   labels:

edu_master/k8s/webinar-checker.yaml

@@ -1,8 +1,6 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    reloader.stakater.com/auto: "true"
   name: webinar-checker
   namespace: edu-master
   labels:

gitea/compose.yaml

@@ -13,12 +13,9 @@ services:
       - GITEA__database__PASSWD=gitea
       - GITEA__database__NAME=gitea
       # Server
-      - GITEA__server__ROOT_URL=https://git.forust.xyz
+      - GITEA__server__ROOT_URL=https://gitea.forust.xyz
       - GITEA__server__SSH_DOMAIN=gitssh.forust.xyz
       - GITEA__server__SSH_PORT=2221
-      # Pin 28.0 defaults explicitly (see k8s/config.yaml for rationale)
-      - GITEA__service__DISABLE_REGISTRATION=true
-      - GITEA__actions__RUN_RETENTION_DAYS=90
       # Mailer
       - GITEA__mailer__ENABLED=true
       - GITEA__mailer__FROM=${SERVICE_EMAIL}
@@ -37,7 +34,7 @@ services:
       - "traefik.http.services.gitea.loadbalancer.server.port=3000"
 
       # Prod Router
-      - "traefik.http.routers.gitea.rule=Host(`git.forust.xyz`) || Host(`gitea.forust.xyz`)"
+      - "traefik.http.routers.gitea.rule=Host(`gitea.forust.xyz`)"
       - "traefik.http.routers.gitea.entrypoints=websecure"
       - "traefik.http.routers.gitea.tls.certresolver"
       # Local Router

gitea/k8s/config.yaml

@@ -4,14 +4,11 @@ metadata:
   name: gitea-config
   namespace: gitea
 data:
-  GITEA__server__ROOT_URL: "https://git.forust.xyz"
+  GITEA__server__DOMAIN: "gitea.forust.xyz"
+  GITEA__server__ROOT_URL: "https://gitea.forust.xyz"
   GITEA__server__SSH_DOMAIN: "gitssh.forust.xyz"
   GITEA__server__SSH_PORT: "2221"
 
-  GITEA__service__DISABLE_REGISTRATION: "true"
-
-  GITEA__actions__RUN_RETENTION_DAYS: "90"
-
   GITEA__database__DB_TYPE: "postgres"
   GITEA__database__HOST: "postgres.database.svc.cluster.local:5432"
   GITEA__database__NAME: "gitea"

gitea/k8s/gitea.yaml

@@ -17,8 +17,6 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    reloader.stakater.com/auto: "true"
   name: gitea-deployment
   namespace: gitea
 spec:

glance/k8s/glance-config.yaml

@@ -177,8 +177,8 @@ data:
                   # url: https://gitssh.forust.xyz
                 # - title: gcr.forust.xyz
                   # url: https://gcr.forust.xyz/v2/
-                - title: git.forust.xyz
+                - title: gitea.forust.xyz
-                  url: https://git.forust.xyz
+                  url: https://gitea.forust.xyz
                 - title: nextcloud.forust.xyz
                   url: https://nextcloud.forust.xyz
                 - title: mc.forust.xyz

glance/k8s/glance.yaml

@@ -13,8 +13,6 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    reloader.stakater.com/auto: "true"
   name: glance-deployment
   namespace: glance
 spec:

homarr/.env.example

@@ -1,4 +0,0 @@
-SECRET_ENCRYPTION_KEY="REPLACE_ME"
-TZ="Europe/Bratislava"
-PUID="1000"
-PGID="1000"

homarr/compose.yaml

@@ -1,38 +0,0 @@
-services:
-  homarr:
-    container_name: homarr
-    image: ghcr.io/homarr-labs/homarr:v2.1.2
-    restart: unless-stopped
-    volumes:
-      - ./appdata:/appdata
-      - /var/run/docker.sock:/var/run/docker.sock:ro
-      - ./kubeconfig:/app/config/kubeconfig:ro
-    env_file: .env
-    ports:
-      - 80:7575
-      - 81:3000
-    environment:
-      - TZ=${TZ:-Europe/Bratislava}
-      - TURBO_TELEMETRY_DISABLED=1
-      - KUBECONFIG=/app/config/kubeconfig
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.services.homarr.loadbalancer.server.port=7575"
-
-      # Prod Router
-      - "traefik.http.routers.homarr.rule=Host(`homarr.forust.xyz`)"
-      - "traefik.http.routers.homarr.entrypoints=websecure"
-      - "traefik.http.routers.homarr.tls.certresolver=letsencrypt"
-      # Local Router
-      - "traefik.http.routers.homarr-local.rule=Host(`homarr.workstation.internal`)"
-      - "traefik.http.routers.homarr-local.entrypoints=websecure"
-      - "traefik.http.routers.homarr-local.tls=true"
-      # Dev Router
-      - "traefik.http.routers.homarr-dev.rule=Host(`homarr.gigaforust.internal`)"
-      - "traefik.http.routers.homarr-dev.entrypoints=websecure"
-      - "traefik.http.routers.homarr-dev.tls=true"
-    networks:
-      - proxy
-networks:
-  proxy:
-    external: true

homarr/k8s/certificates.yaml

@@ -1,28 +0,0 @@
-# apiVersion: cert-manager.io/v1
-# kind: Certificate
-# metadata:
-#   name: home-prod-tls
-#   namespace: homarr
-# spec:
-#   secretName: home-prod-tls
-#   dnsNames:
-#     - home.forust.xyz
-#   issuerRef:
-#     name: letsencrypt-prod
-#     kind: ClusterIssuer
-# ---
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: internal-wildcard-tls
-  namespace: homarr
-spec:
-  secretName: internal-wildcard-tls
-  dnsNames:
-    - "*.workstation.internal"
-    - "*.gigaforust.internal"
-    - workstation.internal
-    - gigaforust.internal
-  issuerRef:
-    name: internal-ca
-    kind: ClusterIssuer

homarr/k8s/config.yaml

@@ -1,9 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: homarr-config
-  namespace: homarr
-data:
-  TZ: "Europe/Bratislava"
-  TURBO_TELEMETRY_DISABLED: "1"
-  ENABLE_KUBERNETES: "true"

homarr/k8s/homarr.yaml

@@ -1,83 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: homarr-service
-  namespace: homarr
-spec:
-  selector:
-    app: homarr
-  ports:
-    - port: 7575
-      targetPort: 7575
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  annotations:
-    reloader.stakater.com/auto: "true"
-  name: homarr-deployment
-  namespace: homarr
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: homarr
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        app: homarr
-    spec:
-      serviceAccountName: homarr
-      containers:
-        - name: homarr
-          image: ghcr.io/homarr-labs/homarr:v2.1.2
-          envFrom:
-            - configMapRef:
-                name: homarr-config
-            - secretRef:
-                name: homarr-secrets
-          ports:
-            - containerPort: 7575
-          readinessProbe:
-            httpGet:
-              path: /
-              port: 7575
-            initialDelaySeconds: 30
-            periodSeconds: 10
-            failureThreshold: 6
-          livenessProbe:
-            httpGet:
-              path: /
-              port: 7575
-            initialDelaySeconds: 60
-            periodSeconds: 30
-            failureThreshold: 3
-          volumeMounts:
-            - name: homarr-data
-              mountPath: /appdata
-          resources:
-            requests:
-              cpu: "250m"
-              memory: "350Mi"
-            limits:
-              cpu: "500m"
-              memory: "700Mi"
-      volumes:
-        - name: homarr-data
-          persistentVolumeClaim:
-            claimName: homarr-pvc
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: homarr-pvc
-  namespace: homarr
-spec:
-  resources:
-    requests:
-      storage: 2Gi
-  volumeMode: Filesystem
-  accessModes:
-    - ReadWriteOnce

homarr/k8s/ingress.yaml

@@ -1,33 +0,0 @@
-# apiVersion: traefik.io/v1alpha1
-# kind: IngressRoute
-# metadata:
-#   name: homarr-prod
-#   namespace: homarr
-# spec:
-#   entryPoints:
-#     - websecure
-#   routes:
-#     - match: Host(`home.forust.xyz`)
-#       kind: Rule
-#       services:
-#         - name: homarr-service
-#           port: 7575
-#   tls:
-#     secretName: home-prod-tls
-# ---
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: homarr-local
-  namespace: homarr
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`home.workstation.internal`) || Host(`home.gigaforust.internal`)
-      kind: Rule
-      services:
-        - name: homarr-service
-          port: 7575
-  tls:
-    secretName: internal-wildcard-tls

homarr/k8s/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: homarr

homarr/k8s/rbac.yaml

@@ -1,58 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: homarr
-  namespace: homarr
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: homarr-readonly
-rules:
-  - apiGroups: [""]
-    resources:
-      - pods
-      - services
-      - endpoints
-      - namespaces
-      - nodes
-      - configmaps
-      - persistentvolumeclaims
-      - events
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["apps"]
-    resources:
-      - deployments
-      - statefulsets
-      - daemonsets
-      - replicasets
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["networking.k8s.io"]
-    resources:
-      - ingresses
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["traefik.io"]
-    resources:
-      - ingressroutes
-      - ingressroutetcps
-      - ingressrouteudps
-      - middlewares
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["metrics.k8s.io"]
-    resources:
-      - pods
-      - nodes
-    verbs: ["get", "list"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: homarr-readonly
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: homarr-readonly
-subjects:
-  - kind: ServiceAccount
-    name: homarr
-    namespace: homarr

homarr/k8s/secrets.yaml.example

@@ -1,9 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: homarr-secrets
-  namespace: homarr
-type: Opaque
-stringData:
-  # openssl rand -hex 32
-  SECRET_ENCRYPTION_KEY: "REPLACE_ME"

homepages/forust_files/index.html

@@ -174,7 +174,7 @@
         <h2>./projects</h2>
         <ul class="repo-list">
           <li>
-            <a href="https://git.forust.xyz/forust/gosleep" target="_blank">forust/gosleep</a>
+            <a href="https://gitea.forust.xyz/forust/gosleep" target="_blank">forust/gosleep</a>
             <span class="comment">// linux sleep timer written in rust (originally in go)</span>
           </li>
         </ul>

immich/k8s/immich.yaml

@@ -14,8 +14,6 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    reloader.stakater.com/auto: "true"
   name: immich-deployment
   namespace: immich
   labels:

immich/k8s/machine-learning.yaml

@@ -14,8 +14,6 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    reloader.stakater.com/auto: "true"
   name: immich-machine-learning-deployment
   namespace: immich
   labels:

immich/k8s/valkey.yaml

@@ -17,8 +17,6 @@ spec:
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
-  annotations:
-    reloader.stakater.com/auto: "true"
   name: immich-valkey
   namespace: immich
   labels:

kener/k8s/kener.yaml

@@ -13,8 +13,6 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    reloader.stakater.com/auto: "true"
   name: kener-deployment
   namespace: kener
 spec:

metube/k8s/metube.yaml

@@ -13,8 +13,6 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    reloader.stakater.com/auto: "true"
   name: metube-deployment
   namespace: metube
 spec:

n8n/compose.yaml

@@ -1,6 +1,6 @@
 services:
   n8n:
-    image: docker.n8n.io/n8nio/n8n:2.42.3
+    image: docker.n8n.io/n8nio/n8n:2.42.2
     container_name: n8n
     restart: unless-stopped
     environment:

n8n/k8s/n8n.yaml

@@ -13,8 +13,6 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    reloader.stakater.com/auto: "true"
   name: n8n-deployment
   namespace: n8n
 spec:
@@ -31,7 +29,7 @@ spec:
     spec:
       containers:
         - name: n8n
-          image: docker.n8n.io/n8nio/n8n:2.42.3
+          image: docker.n8n.io/n8nio/n8n:2.42.2
           envFrom:
             - configMapRef:
                 name: n8n-config

netbird/entrypoint.sh

@@ -1,109 +0,0 @@
-#!/bin/sh
-set -eu
-
-umask 077
-
-TEMPLATE_PATH=/opt/netbird/config.template.yaml
-RENDERED_PATH=/run/netbird/config.yaml
-RELAY_SECRET_PATH=/run/secrets/relay_auth_secret
-ENCRYPTION_KEY_PATH=/run/secrets/datastore_encryption_key
-
-is_valid_proxy_subnet() {
-  candidate="$1"
-  case "$candidate" in
-    0.0.0.0/0)
-      return 1
-      ;;
-    */*)
-      address="${candidate%%/*}"
-      prefix="${candidate#*/}"
-      ;;
-    *)
-      return 1
-      ;;
-  esac
-
-  case "$prefix" in
-    0|[1-9]|[1-2][0-9]|3[0-2]) ;;
-    *)
-      return 1
-      ;;
-  esac
-
-  old_ifs="$IFS"
-  IFS=.
-  # shellcheck disable=SC2086
-  set -- $address
-  IFS="$old_ifs"
-  [ "$#" -eq 4 ] || return 1
-
-  for octet do
-    case "$octet" in
-      0|[1-9]|[1-9][0-9]|1[0-9][0-9]|2[0-4][0-9]|25[0-5]) ;;
-      *)
-        return 1
-        ;;
-    esac
-  done
-}
-
-read_secret() {
-  secret_path="$1"
-
-  if [ ! -r "$secret_path" ]; then
-    echo "Required secret is not readable: $secret_path" >&2
-    exit 1
-  fi
-
-  secret_value="$(cat "$secret_path")"
-  if [ -z "$secret_value" ]; then
-    echo "Required secret is empty: $secret_path" >&2
-    exit 1
-  fi
-
-  printf '%s' "$secret_value"
-}
-
-if [ -z "${NETBIRD_DOMAIN:-}" ]; then
-  echo "NETBIRD_DOMAIN must be set" >&2
-  exit 1
-fi
-
-case "$NETBIRD_DOMAIN" in
-  *[!A-Za-z0-9.-]*)
-    echo "NETBIRD_DOMAIN contains unsupported characters" >&2
-    exit 1
-    ;;
-esac
-
-if [ -z "${NETBIRD_PROXY_SUBNET:-}" ] || [ "$NETBIRD_PROXY_SUBNET" = "auto" ]; then
-  echo "NETBIRD_PROXY_SUBNET must be an explicit IPv4 CIDR; run netbird/setup.sh first" >&2
-  exit 1
-fi
-if ! is_valid_proxy_subnet "$NETBIRD_PROXY_SUBNET"; then
-  echo "NETBIRD_PROXY_SUBNET must be a non-default IPv4 CIDR, for example 172.20.0.0/16" >&2
-  exit 1
-fi
-
-if [ "$#" -ne 2 ] || [ "$1" != "--config" ] || [ "$2" != "$RENDERED_PATH" ]; then
-  echo "Expected: --config $RENDERED_PATH" >&2
-  exit 1
-fi
-
-relay_secret="$(read_secret "$RELAY_SECRET_PATH")"
-encryption_key="$(read_secret "$ENCRYPTION_KEY_PATH")"
-
-mkdir -p "$(dirname "$RENDERED_PATH")"
-sed \
-  -e "s|__NETBIRD_DOMAIN__|${NETBIRD_DOMAIN}|g" \
-  -e "s|__NETBIRD_AUTH_SECRET__|${relay_secret}|g" \
-  -e "s|__NETBIRD_ENCRYPTION_KEY__|${encryption_key}|g" \
-  -e "s|__NETBIRD_PROXY_SUBNET__|${NETBIRD_PROXY_SUBNET}|g" \
-  "$TEMPLATE_PATH" >"$RENDERED_PATH"
-
-if grep -q '__NETBIRD_' "$RENDERED_PATH"; then
-  echo "Rendered NetBird configuration still contains unresolved placeholders" >&2
-  exit 1
-fi
-
-exec /go/bin/netbird-server "$@"

netbird/k8s/netbird.yaml

@@ -32,8 +32,6 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    reloader.stakater.com/auto: "true"
   name: netbird-server-deployment
   namespace: netbird
 spec:
@@ -128,8 +126,6 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    reloader.stakater.com/auto: "true"
   name: netbird-dashboard-deployment
   namespace: netbird
 spec:

netbird/setup.sh

@@ -1,38 +0,0 @@
-#!/usr/bin/env bash
-# Prepare local Compose configuration without replacing existing credentials.
-set -euo pipefail
-cd "$(dirname "${BASH_SOURCE[0]}")"
-umask 077
-if [ ! -f .env ]; then
-  cp .env.example .env
-fi
-
-if grep -q '^NETBIRD_PROXY_SUBNET=auto$' .env; then
-  subnet="$(docker network inspect proxy --format '{{range .IPAM.Config}}{{println .Subnet}}{{end}}' | awk '/^[0-9]+\./ { print; exit }')"
-  if [ -z "$subnet" ]; then
-    echo "No IPv4 subnet found on the Docker proxy network. Set NETBIRD_PROXY_SUBNET in .env." >&2
-    exit 1
-  fi
-  # The detected value must be safe to substitute into the env file.
-  if [[ ! "$subnet" =~ ^[0-9.]+/[0-9]+$ ]]; then
-    echo "Unexpected Docker network subnet: $subnet" >&2
-    exit 1
-  fi
-  sed -i "s|^NETBIRD_PROXY_SUBNET=auto$|NETBIRD_PROXY_SUBNET=$subnet|" .env
-fi
-
-mkdir -p secrets
-chmod 700 secrets
-for name in relay-auth-secret datastore-encryption-key; do
-  path="secrets/$name"
-  if [ -e "$path" ]; then
-    if [ ! -s "$path" ]; then
-      echo "Existing secret is empty: $path. Restore it before continuing." >&2
-      exit 1
-    fi
-  else
-    openssl rand -base64 32 >"$path"
-  fi
-  chmod 600 "$path"
-done
-printf '%s\n' 'Local files are ready. Review .env, then run docker compose config --quiet.'

netbox/k8s/netbox.yaml

@@ -14,8 +14,6 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    reloader.stakater.com/auto: "true"
   name: netbox-deployment
   namespace: netbox
   labels:
@@ -120,8 +118,6 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    reloader.stakater.com/auto: "true"
   name: netbox-worker-deployment
   namespace: netbox
   labels:

netbox/k8s/valkey.yaml

@@ -17,8 +17,6 @@ spec:
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
-  annotations:
-    reloader.stakater.com/auto: "true"
   name: netbox-valkey
   namespace: netbox
   labels:

netronome/k8s/netronome.yaml

@@ -14,8 +14,6 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    reloader.stakater.com/auto: "true"
   name: netronome-deployment
   namespace: netronome
   labels:

reloader/k8s/reloader-values.yaml

@@ -1,17 +1,11 @@
 # Pinned chart: stakater/reloader 2.2.17 (app v1.4.22).
 # Deployed by the deploy workflow, namespace reloader.
 # Restarts pods when a ConfigMap or Secret they consume changes. Opt-in per workload
-# via the reloader.stakater.com/auto: "true" workload annotation; watchGlobally because
+# via the reloader.stakater.com/auto: "true" pod annotation; watchGlobally because
 # the workloads that need it are spread across a few dozen namespaces.
 
 reloader:
   watchGlobally: true
-  # Only opted-in workloads are restarted. Keep scheduled jobs on their schedule.
-  autoReloadAll: false
-  ignoreJobs: true
-  ignoreCronJobs: true
-  # Change pod-template annotations rather than injecting STAKATER_* env vars.
-  reloadStrategy: annotations
 
   deployment:
     replicas: 1

renovate/.env.example

@@ -1,4 +1,4 @@
-RENOVATE_ENDPOINT=https://git.forust.xyz/api/v1
+RENOVATE_ENDPOINT=https://gitea.forust.xyz/api/v1
 RENOVATE_TOKEN=
 RENOVATE_REPOSITORIES=forust/homelab
 LOG_LEVEL=info

renovate/k8s/configmap.yaml

@@ -218,34 +218,6 @@ data:
           "matchUpdateTypes": ["patch"],
           "groupName": "all patch updates",
           "groupSlug": "all-patch"
-        },
-        {
-          "description": "Python Y-bumps break compat (3.11->3.12->3.13->3.14) - keep the base image out of the shared minor/patch groups, review every bump separately. Placed last so its groupName wins.",
-          "matchDatasources": ["docker"],
-          "matchPackageNames": ["python"],
-          "groupName": "python base image",
-          "groupSlug": "python",
-          "automerge": false
-        },
-        {
-          "description": "Rolling/floating tags (streaming stack, nextcloud beta, kubectl latest) - never automerge, every bump is a manual review. Placed last so automerge:false wins over the shared digest/patch rule.",
-          "matchDatasources": ["docker"],
-          "matchPackageNames": [
-            "lscr.io/linuxserver/jellyfin",
-            "lscr.io/linuxserver/qbittorrent",
-            "lscr.io/linuxserver/sonarr",
-            "lscr.io/linuxserver/radarr",
-            "lscr.io/linuxserver/prowlarr",
-            "lscr.io/linuxserver/bazarr",
-            "ghcr.io/seerr-team/seerr",
-            "fallenbagel/jellyseerr",
-            "ghcr.io/lampac-nextgen/lampac",
-            "ghcr.io/nextcloud-releases/all-in-one",
-            "alpine/kubectl"
-          ],
-          "groupName": "floating images - manual",
-          "groupSlug": "floating-manual",
-          "automerge": false
         }
       ]
     }

renovate/k8s/cronjob.yaml

@@ -19,7 +19,7 @@ spec:
           restartPolicy: Never
           containers:
             - name: renovate
-              image: renovate/renovate:44.136.0
+              image: renovate/renovate:44.132.5
               env:
                 - name: RENOVATE_PLATFORM
                   value: gitea

renovate/k8s/secrets.yaml.example

@@ -6,6 +6,6 @@ metadata:
 type: Opaque
 stringData:
   RENOVATE_TOKEN: ""
-  RENOVATE_ENDPOINT: "https://git.forust.xyz/api/v1"
+  RENOVATE_ENDPOINT: "https://gitea.forust.xyz/api/v1"
   RENOVATE_REPOSITORIES: "forust/homelab"
   RENOVATE_GITHUB_COM_TOKEN: ""

renovate/renovate.json

@@ -207,34 +207,6 @@
       "matchUpdateTypes": ["patch"],
       "groupName": "all patch updates",
       "groupSlug": "all-patch"
-    },
-    {
-      "description": "Python Y-bumps break compat (3.11->3.12->3.13->3.14) - keep the base image out of the shared minor/patch groups, review every bump separately. Placed last so its groupName wins.",
-      "matchDatasources": ["docker"],
-      "matchPackageNames": ["python"],
-      "groupName": "python base image",
-      "groupSlug": "python",
-      "automerge": false
-    },
-    {
-      "description": "Rolling/floating tags (streaming stack, nextcloud beta, kubectl latest) - never automerge, every bump is a manual review. Placed last so automerge:false wins over the shared digest/patch rule.",
-      "matchDatasources": ["docker"],
-      "matchPackageNames": [
-        "lscr.io/linuxserver/jellyfin",
-        "lscr.io/linuxserver/qbittorrent",
-        "lscr.io/linuxserver/sonarr",
-        "lscr.io/linuxserver/radarr",
-        "lscr.io/linuxserver/prowlarr",
-        "lscr.io/linuxserver/bazarr",
-        "ghcr.io/seerr-team/seerr",
-        "fallenbagel/jellyseerr",
-        "ghcr.io/lampac-nextgen/lampac",
-        "ghcr.io/nextcloud-releases/all-in-one",
-        "alpine/kubectl"
-      ],
-      "groupName": "floating images - manual",
-      "groupSlug": "floating-manual",
-      "automerge": false
     }
   ]
 }

searxng/k8s/searxng.yaml

@@ -13,8 +13,6 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    reloader.stakater.com/auto: "true"
   name: searxng-deployment
   namespace: searxng
 spec:

streaming/.env.example

@@ -1,3 +0,0 @@
-PUID=1000
-PGID=1000
-TZ=Europe/Berlin

streaming/compose.yaml

@@ -1,133 +0,0 @@
-services:
-  jellyfin:
-    image: lscr.io/linuxserver/jellyfin:version-12.1ubu2604
-    container_name: jellyfin
-    restart: unless-stopped
-    environment:
-      - PUID=${PUID:-1000}
-      - PGID=${PGID:-1000}
-      - TZ=${TZ:-Europe/Berlin}
-    volumes:
-      - jellyfin-cfg:/config
-      - movies:/media/movies
-      - tv:/media/tv
-    devices:
-      - /dev/dri:/dev/dri
-    ports:
-      - "18096:8096"
-    networks:
-      - streaming
-
-  qbittorrent:
-    image: lscr.io/linuxserver/qbittorrent:5.2.4
-    container_name: qbittorrent
-    restart: unless-stopped
-    environment:
-      - PUID=${PUID:-1000}
-      - PGID=${PGID:-1000}
-      - TZ=${TZ:-Europe/Berlin}
-      - WEBUI_PORT=8080
-    volumes:
-      - qbittorrent-cfg:/config
-      - downloads:/downloads
-    ports:
-      - "18180:8080"
-      - "6881:6881"
-      - "6881:6881/udp"
-    networks:
-      - streaming
-
-  sonarr:
-    image: lscr.io/linuxserver/sonarr:4.0.20
-    container_name: sonarr
-    restart: unless-stopped
-    environment:
-      - PUID=${PUID:-1000}
-      - PGID=${PGID:-1000}
-      - TZ=${TZ:-Europe/Berlin}
-    volumes:
-      - sonarr-cfg:/config
-      - downloads:/downloads
-      - tv:/tv
-    ports:
-      - "18989:8989"
-    networks:
-      - streaming
-
-  radarr:
-    image: lscr.io/linuxserver/radarr:6.4.4
-    container_name: radarr
-    restart: unless-stopped
-    environment:
-      - PUID=${PUID:-1000}
-      - PGID=${PGID:-1000}
-      - TZ=${TZ:-Europe/Berlin}
-    volumes:
-      - radarr-cfg:/config
-      - downloads:/downloads
-      - movies:/movies
-    ports:
-      - "17878:7878"
-    networks:
-      - streaming
-
-  prowlarr:
-    image: lscr.io/linuxserver/prowlarr:2.6.5
-    container_name: prowlarr
-    restart: unless-stopped
-    environment:
-      - PUID=${PUID:-1000}
-      - PGID=${PGID:-1000}
-      - TZ=${TZ:-Europe/Berlin}
-    volumes:
-      - prowlarr-cfg:/config
-    ports:
-      - "19696:9696"
-    networks:
-      - streaming
-
-  jellyseerr:
-    image: fallenbagel/jellyseerr:latest
-    container_name: jellyseerr
-    restart: unless-stopped
-    environment:
-      - TZ=${TZ:-Europe/Berlin}
-    volumes:
-      - jellyseerr-cfg:/app/config
-    ports:
-      - "15055:5055"
-    networks:
-      - streaming
-
-  bazarr:
-    image: lscr.io/linuxserver/bazarr:1.6.2
-    container_name: bazarr
-    restart: unless-stopped
-    environment:
-      - PUID=${PUID:-1000}
-      - PGID=${PGID:-1000}
-      - TZ=${TZ:-Europe/Berlin}
-    volumes:
-      - bazarr-cfg:/config
-      - movies:/movies
-      - tv:/tv
-    ports:
-      - "16767:6767"
-    networks:
-      - streaming
-
-volumes:
-  jellyfin-cfg:
-  qbittorrent-cfg:
-  sonarr-cfg:
-  radarr-cfg:
-  prowlarr-cfg:
-  jellyseerr-cfg:
-  bazarr-cfg:
-  downloads:
-  movies:
-  tv:
-
-networks:
-  streaming:
-    name: streaming

streaming/k8s/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: streaming

streaming/k8s/routing/certificates.yaml

@@ -1,93 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: internal-wildcard-tls
-  namespace: streaming
-spec:
-  secretName: internal-wildcard-tls
-  dnsNames:
-    - "*.workstation.internal"
-    - "*.gigaforust.internal"
-    - workstation.internal
-    - gigaforust.internal
-  issuerRef:
-    name: internal-ca
-    kind: ClusterIssuer
-# ---
-# apiVersion: cert-manager.io/v1
-# kind: Certificate
-# metadata:
-#   name: jellyfin-prod-tls
-#   namespace: streaming
-# spec:
-#   secretName: jellyfin-prod-tls
-#   dnsNames:
-#     - jellyfin.forust.xyz
-#   issuerRef:
-#     name: letsencrypt-prod
-#     kind: ClusterIssuer
-# ---
-# apiVersion: cert-manager.io/v1
-# kind: Certificate
-# metadata:
-#   name: qbittorrent-prod-tls
-#   namespace: streaming
-# spec:
-#   secretName: qbittorrent-prod-tls
-#   dnsNames:
-#     - qbittorrent.forust.xyz
-#   issuerRef:
-#     name: letsencrypt-prod
-#     kind: ClusterIssuer
-# ---
-# apiVersion: cert-manager.io/v1
-# kind: Certificate
-# metadata:
-#   name: sonarr-prod-tls
-#   namespace: streaming
-# spec:
-#   secretName: sonarr-prod-tls
-#   dnsNames:
-#     - sonarr.forust.xyz
-#   issuerRef:
-#     name: letsencrypt-prod
-#     kind: ClusterIssuer
-# ---
-# apiVersion: cert-manager.io/v1
-# kind: Certificate
-# metadata:
-#   name: radarr-prod-tls
-#   namespace: streaming
-# spec:
-#   secretName: radarr-prod-tls
-#   dnsNames:
-#     - radarr.forust.xyz
-#   issuerRef:
-#     name: letsencrypt-prod
-#     kind: ClusterIssuer
-# ---
-# apiVersion: cert-manager.io/v1
-# kind: Certificate
-# metadata:
-#   name: prowlarr-prod-tls
-#   namespace: streaming
-# spec:
-#   secretName: prowlarr-prod-tls
-#   dnsNames:
-#     - prowlarr.forust.xyz
-#   issuerRef:
-#     name: letsencrypt-prod
-#     kind: ClusterIssuer
-# ---
-# apiVersion: cert-manager.io/v1
-# kind: Certificate
-# metadata:
-#   name: jellyseerr-prod-tls
-#   namespace: streaming
-# spec:
-#   secretName: jellyseerr-prod-tls
-#   dnsNames:
-#     - jellyseerr.forust.xyz
-#   issuerRef:
-#     name: letsencrypt-prod
-#     kind: ClusterIssuer

streaming/k8s/routing/external-service.yaml

@@ -1,188 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: jellyfin
-  namespace: streaming
-spec:
-  ports:
-    - port: 18096
-      targetPort: 18096
----
-apiVersion: discovery.k8s.io/v1
-kind: EndpointSlice
-metadata:
-  name: jellyfin
-  namespace: streaming
-  labels:
-    kubernetes.io/service-name: jellyfin
-addressType: IPv4
-ports:
-  - port: 18096
-    protocol: TCP
-endpoints:
-  - addresses:
-      - "192.168.88.100"
-    conditions:
-      ready: true
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: qbittorrent
-  namespace: streaming
-spec:
-  ports:
-    - port: 18180
-      targetPort: 18180
----
-apiVersion: discovery.k8s.io/v1
-kind: EndpointSlice
-metadata:
-  name: qbittorrent
-  namespace: streaming
-  labels:
-    kubernetes.io/service-name: qbittorrent
-addressType: IPv4
-ports:
-  - port: 18180
-    protocol: TCP
-endpoints:
-  - addresses:
-      - "192.168.88.100"
-    conditions:
-      ready: true
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: sonarr
-  namespace: streaming
-spec:
-  ports:
-    - port: 18989
-      targetPort: 18989
----
-apiVersion: discovery.k8s.io/v1
-kind: EndpointSlice
-metadata:
-  name: sonarr
-  namespace: streaming
-  labels:
-    kubernetes.io/service-name: sonarr
-addressType: IPv4
-ports:
-  - port: 18989
-    protocol: TCP
-endpoints:
-  - addresses:
-      - "192.168.88.100"
-    conditions:
-      ready: true
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: radarr
-  namespace: streaming
-spec:
-  ports:
-    - port: 17878
-      targetPort: 17878
----
-apiVersion: discovery.k8s.io/v1
-kind: EndpointSlice
-metadata:
-  name: radarr
-  namespace: streaming
-  labels:
-    kubernetes.io/service-name: radarr
-addressType: IPv4
-ports:
-  - port: 17878
-    protocol: TCP
-endpoints:
-  - addresses:
-      - "192.168.88.100"
-    conditions:
-      ready: true
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: prowlarr
-  namespace: streaming
-spec:
-  ports:
-    - port: 19696
-      targetPort: 19696
----
-apiVersion: discovery.k8s.io/v1
-kind: EndpointSlice
-metadata:
-  name: prowlarr
-  namespace: streaming
-  labels:
-    kubernetes.io/service-name: prowlarr
-addressType: IPv4
-ports:
-  - port: 19696
-    protocol: TCP
-endpoints:
-  - addresses:
-      - "192.168.88.100"
-    conditions:
-      ready: true
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: jellyseerr
-  namespace: streaming
-spec:
-  ports:
-    - port: 15055
-      targetPort: 15055
----
-apiVersion: discovery.k8s.io/v1
-kind: EndpointSlice
-metadata:
-  name: jellyseerr
-  namespace: streaming
-  labels:
-    kubernetes.io/service-name: jellyseerr
-addressType: IPv4
-ports:
-  - port: 15055
-    protocol: TCP
-endpoints:
-  - addresses:
-      - "192.168.88.100"
-    conditions:
-      ready: true
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: bazarr
-  namespace: streaming
-spec:
-  ports:
-    - port: 16767
-      targetPort: 16767
----
-apiVersion: discovery.k8s.io/v1
-kind: EndpointSlice
-metadata:
-  name: bazarr
-  namespace: streaming
-  labels:
-    kubernetes.io/service-name: bazarr
-addressType: IPv4
-ports:
-  - port: 16767
-    protocol: TCP
-endpoints:
-  - addresses:
-      - "192.168.88.100"
-    conditions:
-      ready: true

streaming/k8s/routing/ingress.yaml

@@ -1,118 +0,0 @@
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: jellyfin-local
-  namespace: streaming
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`jellyfin.workstation.internal`)
-      kind: Rule
-      services:
-        - name: jellyfin
-          port: 18096
-  tls:
-    secretName: internal-wildcard-tls
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: qbittorrent-local
-  namespace: streaming
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`qbittorrent.workstation.internal`)
-      kind: Rule
-      services:
-        - name: qbittorrent
-          port: 18180
-  tls:
-    secretName: internal-wildcard-tls
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: sonarr-local
-  namespace: streaming
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`sonarr.workstation.internal`)
-      kind: Rule
-      services:
-        - name: sonarr
-          port: 18989
-  tls:
-    secretName: internal-wildcard-tls
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: radarr-local
-  namespace: streaming
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`radarr.workstation.internal`)
-      kind: Rule
-      services:
-        - name: radarr
-          port: 17878
-  tls:
-    secretName: internal-wildcard-tls
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: prowlarr-local
-  namespace: streaming
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`prowlarr.workstation.internal`)
-      kind: Rule
-      services:
-        - name: prowlarr
-          port: 19696
-  tls:
-    secretName: internal-wildcard-tls
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: jellyseerr-local
-  namespace: streaming
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`jellyseerr.workstation.internal`)
-      kind: Rule
-      services:
-        - name: jellyseerr
-          port: 15055
-  tls:
-    secretName: internal-wildcard-tls
----
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: bazarr-local
-  namespace: streaming
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`bazarr.workstation.internal`)
-      kind: Rule
-      services:
-        - name: bazarr
-          port: 16767
-  tls:
-    secretName: internal-wildcard-tls

termix/compose.yaml

@@ -1,6 +1,6 @@
 services:
   termix:
-    image: ghcr.io/lukegus/termix:2.9.1
+    image: ghcr.io/lukegus/termix:2.9.0
     container_name: termix
     restart: unless-stopped
     # ports:

termix/k8s/termix.yaml

@@ -13,8 +13,6 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    reloader.stakater.com/auto: "true"
   name: termix-deployment
   namespace: termix
 spec:
@@ -31,7 +29,7 @@ spec:
     spec:
       containers:
         - name: termix
-          image: ghcr.io/lukegus/termix:2.9.1
+          image: ghcr.io/lukegus/termix:2.9.0
           envFrom:
             - configMapRef:
                 name: termix-config

tests/test_netbird_runtime.py

@@ -1,87 +0,0 @@
-"""Exercise local setup and config rendering without a Docker daemon."""
-
-import os
-import shutil
-import subprocess
-import tempfile
-import unittest
-from pathlib import Path
-
-ROOT = Path(__file__).resolve().parents[1]
-
-
-class NetbirdRuntimeTests(unittest.TestCase):
-    def setUp(self):
-        self.temp = tempfile.TemporaryDirectory()
-        self.addCleanup(self.temp.cleanup)
-        self.root = Path(self.temp.name)
-        self.stack = self.root / 'netbird'
-        self.stack.mkdir()
-        for name in ('setup.sh', '.env.example', 'config.template.yaml'):
-            shutil.copy(ROOT / 'netbird' / name, self.stack / name)
-        binary = self.root / 'bin'
-        binary.mkdir()
-        docker = binary / 'docker'
-        docker.write_text('#!/bin/sh\nprintf "%s\\n" 172.20.0.0/16\n')
-        docker.chmod(0o755)
-        self.env = dict(os.environ, PATH=f'{binary}:{os.environ["PATH"]}')
-
-    def setup(self):
-        return subprocess.run(  # noqa: S603 - executes the repository script copied into this test's temp dir
-            ['/bin/bash', str(self.stack / 'setup.sh')], env=self.env, capture_output=True, check=False
-        )
-
-    def test_setup_preserves_existing_secrets_and_env(self):
-        self.assertEqual(self.setup().returncode, 0)
-        paths = [self.stack / '.env', *sorted((self.stack / 'secrets').iterdir())]
-        before = [p.read_bytes() for p in paths]
-        self.assertIn(b'NETBIRD_PROXY_SUBNET=172.20.0.0/16', before[0])
-        self.assertEqual(self.setup().returncode, 0)
-        self.assertEqual(before, [p.read_bytes() for p in paths])
-        for p in paths[1:]:
-            self.assertEqual(p.stat().st_mode & 0o777, 0o600)
-
-    def test_setup_rejects_empty_existing_secret(self):
-        (self.stack / 'secrets').mkdir()
-        secret = self.stack / 'secrets/datastore-encryption-key'
-        secret.touch()
-        self.assertNotEqual(self.setup().returncode, 0)
-        self.assertEqual(secret.read_bytes(), b'')
-
-    def render(self, subnet):
-        self.assertEqual(self.setup().returncode, 0)
-        rendered = self.root / 'run/config.yaml'
-        script = (ROOT / 'netbird/entrypoint.sh').read_text()
-        replacements = {
-            '/opt/netbird/config.template.yaml': str(self.stack / 'config.template.yaml'),
-            '/run/netbird/config.yaml': str(rendered),
-            '/run/secrets/relay_auth_secret': str(self.stack / 'secrets/relay-auth-secret'),
-            '/run/secrets/datastore_encryption_key': str(self.stack / 'secrets/datastore-encryption-key'),
-            '/go/bin/netbird-server': '/bin/true',
-        }
-        for original, local in replacements.items():
-            script = script.replace(original, local)
-        result = subprocess.run(  # noqa: S603 - repository renderer, with test-local paths
-            ['/bin/sh', '-c', script, 'entrypoint', '--config', str(rendered)],
-            env=dict(self.env, NETBIRD_DOMAIN='nb.example.com', NETBIRD_PROXY_SUBNET=subnet),
-            capture_output=True,
-            check=False,
-        )
-        return result, rendered
-
-    def test_renderer_replaces_placeholders_and_restricts_file_permissions(self):
-        result, rendered = self.render('172.20.0.0/16')
-        self.assertEqual(result.returncode, 0, result.stderr)
-        self.assertNotIn('__NETBIRD_', rendered.read_text())
-        self.assertIn('nb.example.com', rendered.read_text())
-        self.assertEqual(rendered.stat().st_mode & 0o777, 0o600)
-
-    def test_renderer_rejects_auto_and_default_route(self):
-        for subnet in ('auto', '0.0.0.0/0', '999.1.1.1/24'):
-            with self.subTest(subnet=subnet):
-                result, _ = self.render(subnet)
-                self.assertNotEqual(result.returncode, 0)
-
-
-if __name__ == '__main__':
-    unittest.main()

traefik/k8s/ingress.yaml

@@ -10,8 +10,6 @@ spec:
   routes:
     - match: Host(`traefik.forust.xyz`)
       kind: Rule
-      middlewares:
-        - name: security-chain@file
       services:
         - name: api@internal
           kind: TraefikService

traefik/k8s/traefik-values.yaml

@@ -94,7 +94,7 @@ ports:
     exposedPort: 8080
     protocol: TCP
     expose:
-      default: true
+      default: false
     http:
       aliasHeadersStrategy: delete
   ssh:

uptime-kuma/k8s/alerts.yaml

@@ -1,40 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: PrometheusRule
-metadata:
-  name: uptime-kuma
-  namespace: uptime-kuma
-  labels:
-    release: prometheus-stack
-spec:
-  groups:
-    - name: uptime_kuma.monitors
-      rules:
-        - alert: KumaMonitorDown
-          expr: |
-            monitor_status{monitor_type!="group"} == 0
-          for: 5m
-          labels:
-            severity: critical
-          annotations:
-            summary: "Uptime Kuma monitor down: {{ $labels.monitor_name }}"
-            description: "Uptime Kuma monitor {{ $labels.monitor_name }} ({{ $labels.monitor_url }}) is down for 5m. Check Uptime Kuma (https://uptime.forust.xyz) and the target service."
-
-        - alert: KumaScrapeDown
-          expr: |
-            absent(monitor_status) == 1
-          for: 10m
-          labels:
-            severity: critical
-          annotations:
-            summary: "Uptime Kuma metrics missing"
-            description: "uptime-kuma: no monitor_status series for 10m. Pod may be down, the uk1_ API key may have been rotated without updating uptime-kuma-secrets, or ServiceMonitor/Service broken. All Kuma monitors are unobserved."
-
-        - alert: KumaCertExpiring
-          expr: |
-            monitor_cert_days_remaining < 14
-          for: 1h
-          labels:
-            severity: warning
-          annotations:
-            summary: "TLS cert expiring: {{ $labels.monitor_name }} ({{ $value }}d left)"
-            description: "Uptime Kuma monitor {{ $labels.monitor_name }} ({{ $labels.monitor_url }}) reports a TLS certificate with {{ $value }} days remaining. Check cert-manager Certificate for this host."

uptime-kuma/k8s/secrets.yaml.example

@@ -1,9 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: uptime-kuma-secrets
-  namespace: uptime-kuma
-type: Opaque
-stringData:
-  metrics-username: "uptime-kuma"
-  metrics-password: "REPLACE_ME"

uptime-kuma/k8s/servicemonitor.yaml

@@ -1,23 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: uptime-kuma
-  namespace: uptime-kuma
-  labels:
-    release: prometheus-stack
-spec:
-  selector:
-    matchLabels:
-      app: uptime-kuma
-  endpoints:
-    - port: http
-      path: /metrics
-      interval: 60s
-      scrapeTimeout: 15s
-      basicAuth:
-        username:
-          name: uptime-kuma-secrets
-          key: metrics-username
-        password:
-          name: uptime-kuma-secrets
-          key: metrics-password

uptime-kuma/k8s/uptime-kuma.yaml

@@ -3,14 +3,11 @@ kind: Service
 metadata:
   name: uptime-kuma-service
   namespace: uptime-kuma
-  labels:
-    app: uptime-kuma
 spec:
   selector:
     app: uptime-kuma
   ports:
     - port: 3001
-      name: http
       targetPort: 3001
 ---
 apiVersion: apps/v1

vaultwarden/k8s/vaultwarden.yaml

@@ -13,8 +13,6 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    reloader.stakater.com/auto: "true"
   name: vaultwarden-deployment
   namespace: vaultwarden
 spec:

vpn/xui/k8s/xui.yaml

@@ -20,8 +20,6 @@ spec:
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  annotations:
-    reloader.stakater.com/auto: "true"
   name: xui-deployment
   namespace: xui
 spec: