Auto-update README with current k8s applications

Generated by CI/CD workflow on 2026-03-07 22:23:18 This PR updates the README.md file with the current list of applications found in the k8s/ directory structure.
2026-03-07 22:23:18 +00:00
112 changed files with 580 additions and 5392 deletions
@@ -1,10 +1,10 @@
-name: 'Keycloak Terraform'
+name: 'Terraform'

 on:
  push:
    branches: [ "main" ]
    paths:
-      - 'terraform/keycloak/**'
+      - 'terraform/authentik/**'
  pull_request:

 permissions:
@@ -25,29 +25,123 @@ jobs:
      uses: actions/checkout@v3

    - name: Setup Terraform
-      uses: hashicorp/setup-terraform@v4.0.0
+      uses: hashicorp/setup-terraform@v2
      with:
        cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}

-    - name: Setup kubeconfig
-      run: |
-        mkdir -p ~/.kube
-        echo "${{ secrets.KUBECONFIG }}" > ~/.kube/config
-        chmod 600 ~/.kube/config
-
    - name: Terraform Init
+      env:
+        TF_VAR_authentik_token: ${{ secrets.AUTHENTIK_TOKEN }}
      run: terraform init
-      working-directory: ./terraform/keycloak
+      working-directory: ./terraform/authentik

    - name: Terraform Format
+      env:
+        TF_VAR_authentik_token: ${{ secrets.AUTHENTIK_TOKEN }}
      run: terraform fmt -check
      continue-on-error: true
-      working-directory: ./terraform/keycloak
+      working-directory: ./terraform/authentik

    - name: Terraform Apply
      env:
-        TF_VAR_keycloak_client_secret: ${{ secrets.KEYCLOAK_CLIENT_SECRET }}
-        TF_VAR_google_client_id: ${{ secrets.GOOGLE_CLIENT_ID }}
-        TF_VAR_google_client_secret: ${{ secrets.GOOGLE_CLIENT_SECRET }}
-      run: terraform apply -input=false -auto-approve -parallelism=100
-      working-directory: ./terraform/keycloak
+        TF_VAR_authentik_token: ${{ secrets.AUTHENTIK_TOKEN }}
+      run: terraform apply -var-file proxy-apps.tfvars -var-file oauth2-apps.tfvars -var-file terraform.tfvars -var-file groups.tfvars -input=false -auto-approve -parallelism=100
+      working-directory: ./terraform/authentik
+
+    - name: Generate Wiki Content  
+      if: success()
+      continue-on-error: true
+      env:
+        TF_VAR_authentik_token: ${{ secrets.AUTHENTIK_TOKEN }}
+      run: |
+        echo "📋 Starting Wiki generation..."
+        cd ./terraform/authentik
+        
+        # Get terraform output
+        echo "🔍 Generating Terraform output..."
+        terraform output -json applications_for_wiki > terraform-raw-output.json 2>&1
+        
+        # Process output to extract clean JSON
+        echo "📤 Processing Terraform output..."
+        python3 ../../.gitea/scripts/process-terraform-output.py terraform-raw-output.json terraform-output.json
+        
+        # Run wiki generation
+        echo "📊 Running wiki generation script..."
+        if python3 ../../.gitea/scripts/generate-apps-wiki.py terraform-output.json; then
+          echo "✅ Wiki content generated successfully"
+        else
+          echo "⚠️ Wiki generation failed, retrying with debug..."
+          python3 ../../.gitea/scripts/generate-apps-wiki.py terraform-output.json --debug || echo "⚠️ Wiki generation failed"
+        fi
+        
+        # Check results
+        if [ -f "Applications.md" ]; then
+          echo "✅ Wiki file created: $(wc -l < Applications.md) lines"
+        else
+          echo "⚠️ Wiki content not generated"
+          exit 0
+        fi
+      working-directory: ./
+
+    - name: Upload Wiki to Gitea
+      if: success()  
+      continue-on-error: true
+      run: |
+        cd ./terraform/authentik
+        
+        # Set variables
+        GITEA_URL="${{ secrets.GT_URL }}"
+        GITEA_TOKEN="${{ secrets.GT_WIKI_TOKEN }}"
+        GITEA_OWNER="${{ secrets.GT_OWNER }}"
+        GITEA_REPO="${{ secrets.GT_REPO }}"
+        
+        # Debug variables (without exposing token)
+        echo "🔍 Checking variables..."
+        echo "GITEA_URL: ${GITEA_URL:-NOT SET}"
+        echo "GITEA_OWNER: ${GITEA_OWNER:-NOT SET}"
+        echo "GITEA_REPO: ${GITEA_REPO:-NOT SET}"
+        echo "GITEA_TOKEN: $(if [ -n "$GITEA_TOKEN" ]; then echo "SET"; else echo "NOT SET"; fi)"
+        
+        # Check if file exists
+        if [ ! -f "Applications.md" ]; then
+          echo "⚠️ Applications.md not found, skipping wiki update"
+          exit 0
+        fi
+        
+        echo "📤 Uploading to Gitea Wiki..."
+        
+        # Encode content to base64
+        CONTENT=$(base64 -w 0 Applications.md)
+        
+        # Check if wiki page exists
+        WIKI_PAGE_EXISTS=$(curl -s -o /dev/null -w "%{http_code}" \
+          -H "Authorization: token $GITEA_TOKEN" \
+          "$GITEA_URL/api/v1/repos/$GITEA_OWNER/$GITEA_REPO/wiki/page/Applications" || echo "000")
+        
+        if [ "$WIKI_PAGE_EXISTS" = "200" ]; then
+          echo "📝 Updating existing wiki page..."
+          curl -X PATCH \
+            -H "Authorization: token $GITEA_TOKEN" \
+            -H "Content-Type: application/json" \
+            -d "{
+              \"title\": \"Applications\",
+              \"content_base64\": \"$CONTENT\",
+              \"message\": \"Update applications list from CI/CD [$(date)]\"
+            }" \
+            "$GITEA_URL/api/v1/repos/$GITEA_OWNER/$GITEA_REPO/wiki/page/Applications" || echo "⚠️ Wiki update failed"
+        else
+          echo "📄 Creating new wiki page..."
+          curl -X POST \
+            -H "Authorization: token $GITEA_TOKEN" \
+            -H "Content-Type: application/json" \
+            -d "{
+              \"title\": \"Applications\", 
+              \"content_base64\": \"$CONTENT\",
+              \"message\": \"Create applications list from CI/CD [$(date)]\"
+            }" \
+            "$GITEA_URL/api/v1/repos/$GITEA_OWNER/$GITEA_REPO/wiki/new" || echo "⚠️ Wiki creation failed"
+        fi
+        
+        echo "✅ Wiki update process completed"
+      working-directory: ./
+
@@ -13,7 +13,6 @@ crash.*.log
 *.tfvars
 *.tfvars.json
 !*terraform.tfvars
-!*.auto.tfvars

 # claude ai
 .claude/
@@ -39,8 +39,6 @@ ArgoCD homelab project
 | Application | Status |
 | :--- | :---: |
 | **comfyui** | [![comfyui](https://ag.hexor.cy/api/badge?name=comfyui&revision=true)](https://ag.hexor.cy/applications/argocd/comfyui) |
-| **furumi-dev** | [![furumi-dev](https://ag.hexor.cy/api/badge?name=furumi-dev&revision=true)](https://ag.hexor.cy/applications/argocd/furumi-dev) |
-| **furumi-server** | [![furumi-server](https://ag.hexor.cy/api/badge?name=furumi-server&revision=true)](https://ag.hexor.cy/applications/argocd/furumi-server) |
 | **gitea** | [![gitea](https://ag.hexor.cy/api/badge?name=gitea&revision=true)](https://ag.hexor.cy/applications/argocd/gitea) |
 | **greece-notifier** | [![greece-notifier](https://ag.hexor.cy/api/badge?name=greece-notifier&revision=true)](https://ag.hexor.cy/applications/argocd/greece-notifier) |
 | **hexound** | [![hexound](https://ag.hexor.cy/api/badge?name=hexound&revision=true)](https://ag.hexor.cy/applications/argocd/hexound) |
@@ -49,8 +47,6 @@ ArgoCD homelab project
 | **jellyfin** | [![jellyfin](https://ag.hexor.cy/api/badge?name=jellyfin&revision=true)](https://ag.hexor.cy/applications/argocd/jellyfin) |
 | **k8s-secrets** | [![k8s-secrets](https://ag.hexor.cy/api/badge?name=k8s-secrets&revision=true)](https://ag.hexor.cy/applications/argocd/k8s-secrets) |
 | **khm** | [![khm](https://ag.hexor.cy/api/badge?name=khm&revision=true)](https://ag.hexor.cy/applications/argocd/khm) |
-| **lidarr** | [![lidarr](https://ag.hexor.cy/api/badge?name=lidarr&revision=true)](https://ag.hexor.cy/applications/argocd/lidarr) |
-| **matrix** | [![matrix](https://ag.hexor.cy/api/badge?name=matrix&revision=true)](https://ag.hexor.cy/applications/argocd/matrix) |
 | **mtproxy** | [![mtproxy](https://ag.hexor.cy/api/badge?name=mtproxy&revision=true)](https://ag.hexor.cy/applications/argocd/mtproxy) |
 | **n8n** | [![n8n](https://ag.hexor.cy/api/badge?name=n8n&revision=true)](https://ag.hexor.cy/applications/argocd/n8n) |
 | **ollama** | [![ollama](https://ag.hexor.cy/api/badge?name=ollama&revision=true)](https://ag.hexor.cy/applications/argocd/ollama) |
@@ -1,20 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: furumi
-  namespace: argocd
-spec:
-  project: apps
-  destination:
-    namespace: furumi
-    server: https://kubernetes.default.svc
-  source:
-    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
-    targetRevision: HEAD
-    path: k8s/apps/furumi
-  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: true
-    syncOptions:
-      - CreateNamespace=true
@@ -1,46 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: furumi-player
-  labels:
-    app: furumi-player
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: furumi-player
-  template:
-    metadata:
-      labels:
-        app: furumi-player
-    spec:
-      nodeSelector:
-        kubernetes.io/hostname: music.tail2fe2d.ts.net
-      containers:
-        - name: furumi-player
-          image: ultradesu/furumusic:latest
-          imagePullPolicy: Always
-          env:
-            - name: FURU_DATABASE_URL
-              valueFrom:
-                secretKeyRef:
-                  name: furumi-creds
-                  key: PG_STRING
-          ports:
-          - containerPort: 8000
-            name: http
-          volumeMounts:
-            - name: library
-              mountPath: /media
-            - name: inbox
-              mountPath: /inbox
-      volumes:
-        - name: library
-          hostPath:
-            path: /data/furumi/library
-            type: DirectoryOrCreate
-        - name: inbox
-          hostPath:
-            path: /data/furumi/inbox
-            type: DirectoryOrCreate
-
@@ -1,55 +0,0 @@
---
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: furumi-ng-creds
-spec:
-  target:
-    name: furumi-creds
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-       #OIDC_CLIENT_ID: |-
-       #  {{ .client_id }}
-       #OIDC_CLIENT_SECRET: |-
-       #  {{ .client_secret }}
-       #OIDC_ISSUER_URL: https://idm.hexor.cy/application/o/furumi/
-       #OIDC_REDIRECT_URL: https://music.hexor.cy/auth/callback
-       #OIDC_SESSION_SECRET: |-
-       #  {{ .session_secret }}
-        PG_STRING: |-
-          postgresql://furumi_dev:{{ .pg_pass }}@psql.psql.svc/furumi_dev
-  data:
-  # - secretKey: client_id
-  #   sourceRef:
-  #     storeRef:
-  #       name: vaultwarden-login
-  #       kind: ClusterSecretStore
-  #   remoteRef:
-  #     key: 960735e6-2cc9-4b68-9bd3-e6786e5a0cd6
-  #     property: fields[0].value
-  # - secretKey: client_secret
-  #   sourceRef:
-  #     storeRef:
-  #       name: vaultwarden-login
-  #       kind: ClusterSecretStore
-  #   remoteRef:
-  #     key: 960735e6-2cc9-4b68-9bd3-e6786e5a0cd6
-  #     property: fields[1].value
-  # - secretKey: session_secret
-  #   sourceRef:
-  #     storeRef:
-  #       name: vaultwarden-login
-  #       kind: ClusterSecretStore
-  #   remoteRef:
-  #     key: 960735e6-2cc9-4b68-9bd3-e6786e5a0cd6
-  #     property: fields[2].value
-    - secretKey: pg_pass
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: 2a9deb39-ef22-433e-a1be-df1555625e22
-        property: fields[17].value
@@ -1,27 +0,0 @@
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: furumi-tls-ingress
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
-    acme.cert-manager.io/http01-edit-in-place: "true"
-spec:
-  ingressClassName: traefik
-  rules:
-    - host: music.hexor.cy
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: furumi-player
-                port:
-                  number: 8000
-  tls:
-    - secretName: furumi-tls
-      hosts:
-        - music.hexor.cy
-
@@ -1,9 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - app.yaml
-  - service.yaml
-  - external-secrets.yaml
-  - ingress.yaml
-  - deployment.yaml
@@ -1,16 +0,0 @@
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: furumi-player
-  labels:
-    app: furumi-player
-spec:
-  type: ClusterIP
-  selector:
-    app: furumi-player
-  ports:
-    - name: http
-      protocol: TCP
-      port: 8000
-      targetPort: 8000
@@ -48,8 +48,6 @@ spec:
              value: "true"
            - name: GITEA__service__CAPTCHA_TYPE
              value: "hcaptcha"
-            - name: GITEA__webhook__ALLOWED_HOST_LIST
-              value: "*"
          envFrom:
          - secretRef:
              name: gitea-recapcha-creds
@@ -79,19 +77,8 @@ spec:
      labels:
        app: gitea-runner
    spec:
-      dnsConfig:
-        options:
-          - name: ndots
-            value: "2"
-      tolerations:
-        - key: workload
-          operator: Equal
-          value: desktop
-          effect: NoSchedule
-        - key: workload
-          operator: Equal
-          value: ai
-          effect: NoSchedule
+      #nodeSelector:
+      #  kubernetes.io/hostname: home.homenet
      volumes:
        - name: docker-sock
          hostPath:
@@ -101,42 +88,55 @@ spec:
          emptyDir:
            sizeLimit: 30Gi
      affinity:
-        podAntiAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            - labelSelector:
-                matchLabels:
-                  app: gitea-runner
-              topologyKey: kubernetes.io/hostname
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
-          - weight: 100
-            preference:
-              matchExpressions:
-              - key: kubernetes.io/hostname
-                operator: In
-                values:
-                #- uk-desktop.tail2fe2d.ts.net
-                - ai.tail2fe2d.ts.net
-          - weight: 50
+          - weight: 1
            preference:
              matchExpressions:
              - key: kubernetes.io/hostname
                operator: In
                values:
                - home.homenet
+          - weight: 2
+            preference:
+              matchExpressions:
+              - key: kubernetes.io/hostname
+                operator: In
+                values:
+                - master.tail2fe2d.ts.net
+          - weight: 3
+            preference:
+              matchExpressions:
+              - key: kubernetes.io/hostname
+                operator: In
+                values:
                - it.tail2fe2d.ts.net
+                - ch.tail2fe2d.ts.net
+                - us.tail2fe2d.ts.net
+
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: kubernetes.io/hostname
+                operator: In
+                values:
+                - home.homenet
+                - it.tail2fe2d.ts.net
+                - ch.tail2fe2d.ts.net
+                - us.tail2fe2d.ts.net
+                - master.tail2fe2d.ts.net
      containers:
        - name: gitea-runner
          image: gitea/act_runner:nightly
          resources:
-            #requests:
-            #  cpu: "100m"
-            #  memory: "256Mi"
-            #  ephemeral-storage: "1Gi"
-            #limits:
-            #  cpu: "3000m"
-            #  memory: "4Gi"
-            #  ephemeral-storage: "28Gi"
+            requests:
+              cpu: "100m"
+              memory: "256Mi"
+              ephemeral-storage: "1Gi"   # reserve ephemeral storage
+            limits:
+              cpu: "3000m"
+              memory: "4Gi"
+              ephemeral-storage: "28Gi"   # hard cap for /data usage
          volumeMounts:
            - name: docker-sock
              mountPath: /var/run/docker.sock
@@ -144,18 +144,13 @@ spec:
              mountPath: /data
          env:
            - name: GITEA_INSTANCE_URL
-              #value: "http://gitea.gitea.svc.cluster.local"
              value: "https://gt.hexor.cy"
            - name: GITEA_RUNNER_REGISTRATION_TOKEN
              valueFrom:
                secretKeyRef:
                  name: gitea-runner-act-runner-secrets
                  key: token
-            - name: NODE_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: spec.nodeName
            - name: GITEA_RUNNER_NAME
-              value: "$(NODE_NAME)"
+              value: "k8s-runner"
            - name: GITEA_RUNNER_LABELS
              value: "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest,ubuntu-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04,ubuntu-20.04:docker://ghcr.io/catthehacker/ubuntu:act-20.04"
@@ -4,11 +4,11 @@ kind: Ingress
 metadata:
  name: gitea-tls-ingress
  annotations:
+    ingressClassName: traefik
    cert-manager.io/cluster-issuer: letsencrypt
    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
    acme.cert-manager.io/http01-edit-in-place: "true"
 spec:
-  ingressClassName: traefik
  rules:
    - host: gt.hexor.cy
      http:
@@ -1,46 +0,0 @@
---
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: auth-proxy
-spec:
-  forwardAuth:
-    address: http://auth-proxy.auth-proxy.svc:80/auth
-    trustForwardHeader: true
-    authResponseHeaders:
-      - X-Auth-Request-User
-      - X-Auth-Request-Email
-      - X-Auth-Request-Groups
---
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: secret-reader
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`pass.hexor.cy`)
-      kind: Rule
-      middlewares:
-        - name: auth-proxy
-      services:
-        - name: secret-reader
-          port: 80
-  tls:
-    secretName: secret-reader-tls
---
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: secret-reader-tls
-spec:
-  secretName: secret-reader-tls
-  issuerRef:
-    name: letsencrypt
-    kind: ClusterIssuer
-  dnsNames:
-    - pass.hexor.cy
-
@@ -1,20 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: lidarr
-  namespace: argocd
-spec:
-  project: apps
-  destination:
-    namespace: lidarr
-    server: https://kubernetes.default.svc
-  source:
-    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
-    targetRevision: HEAD
-    path: k8s/apps/lidarr
-  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: true
-    syncOptions:
-      - CreateNamespace=true
@@ -1,14 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - app.yaml
-
-helmCharts:
-  - name: lidarr
-    repo: https://k8s-home-lab.github.io/helm-charts/
-    version: 15.3.0
-    releaseName: lidarr
-    namespace: lidarr
-    valuesFile: lidarr-values.yaml
-    includeCRDs: true
@@ -1,27 +0,0 @@
-env:
-  TZ: Asia/Nicosia
-
-resources:
-  requests:
-    memory: "512Mi"
-    cpu: "200m"
-  limits:
-    memory: "2Gi"
-    cpu: "1500m"
-
-nodeSelector:
-  kubernetes.io/hostname: master.tail2fe2d.ts.net
-
-persistence:
-  config:
-    enabled: true
-    type: hostPath
-    hostPath: /k8s/lidarr
-    mountPath: /config
-
-  downloads:
-    enabled: true
-    type: hostPath
-    hostPath: /k8s/media/downloads
-    mountPath: /downloads
-    accessMode: ReadWriteOnce
@@ -1,20 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: matrix
-  namespace: argocd
-spec:
-  project: apps
-  destination:
-    namespace: matrix
-    server: https://kubernetes.default.svc
-  source:
-    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
-    targetRevision: HEAD
-    path: k8s/apps/matrix
-  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: true
-    syncOptions:
-      - CreateNamespace=true
@@ -1,95 +0,0 @@
---
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: matrix-postgres-creds
-spec:
-  target:
-    name: matrix-postgres-creds
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        synapse_db_password: |-
-          {{ .synapse_db_password }}
-        mas_db_password: |-
-          {{ .mas_db_password }}
-  data:
-    - secretKey: synapse_db_password
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        metadataPolicy: None
-        key: 2a9deb39-ef22-433e-a1be-df1555625e22
-        property: fields[14].value
-    - secretKey: mas_db_password
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        metadataPolicy: None
-        key: 2a9deb39-ef22-433e-a1be-df1555625e22
-        property: fields[15].value
---
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: matrix-oidc-config
-spec:
-  target:
-    name: matrix-oidc-config
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        mas-oidc.yaml: |
-          upstream_oauth2:
-            providers:
-              - id: 001KKV4EKY7KG98W2M9T806K6A
-                human_name: Authentik
-                issuer: https://idm.hexor.cy/application/o/matrix/
-                client_id: "{{ .oauth_client_id }}"
-                client_secret: "{{ .oauth_client_secret }}"
-                token_endpoint_auth_method: client_secret_post
-                scope: "openid profile email"
-                claims_imports:
-                  localpart:
-                    action: suggest
-                    template: "{{ `{{ user.preferred_username | split(\"@\") | first }}` }}"
-                  displayname:
-                    action: suggest
-                    template: "{{ `{{ user.name }}` }}"
-                  email:
-                    action: suggest
-                    template: "{{ `{{ user.email }}` }}"
-                    set_email_verification: always
-  data:
-    - secretKey: oauth_client_id
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        metadataPolicy: None
-        key: ca76867f-49f3-4a30-9ef3-b05af35ee49a
-        property: fields[0].value
-    - secretKey: oauth_client_secret
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        metadataPolicy: None
-        key: ca76867f-49f3-4a30-9ef3-b05af35ee49a
-        property: fields[1].value
@@ -1,15 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - app.yaml
-  - external-secrets.yaml
-
-helmCharts:
-  - name: matrix-stack
-    repo: oci://ghcr.io/element-hq/ess-helm
-    version: 26.2.3
-    releaseName: matrix-stack
-    namespace: matrix
-    valuesFile: matrix-stack-values.yaml
-    includeCRDs: true
@@ -1,120 +0,0 @@
-## Matrix server name - appears in @user:matrix.hexor.cy
-serverName: matrix.hexor.cy
-
-## Use letsencrypt cluster issuer for all ingresses
-certManager:
-  clusterIssuer: letsencrypt
-
-## Global ingress settings
-ingress:
-  className: traefik
-  annotations:
-    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
-
-## Disable built-in PostgreSQL - using external database
-postgres:
-  enabled: false
-
-## Disable components we don't need yet
-hookshot:
-  enabled: false
-
-## MatrixRTC - voice/video calls via LiveKit SFU
-matrixRTC:
-  enabled: true
-  ingress:
-    host: livekit.matrix.hexor.cy
-  sfu:
-    enabled: true
-    manualIP: "78.24.180.234"
-    nodeSelector:
-      kubernetes.io/hostname: spb.tail2fe2d.ts.net
-    exposedServices:
-      rtcTcp:
-        enabled: true
-        port: 30881
-      rtcMuxedUdp:
-        enabled: true
-        port: 30882
-      turnTLS:
-        enabled: true
-        port: 31443
-        domain: turn.matrix.hexor.cy
-        tlsTerminationOnPod: true
-
-## Synapse homeserver
-synapse:
-  enabled: true
-  additional:
-    0-search-config:
-      config: |
-        user_directory:
-          enabled: true
-          search_all_users: true
-          prefer_local_users: true
-        enable_room_list_search: true
-  ingress:
-    host: synapse.matrix.hexor.cy
-  postgres:
-    host: psql.psql.svc
-    port: 5432
-    user: synapse
-    database: synapse
-    sslMode: prefer
-    password:
-      secret: matrix-postgres-creds
-      secretKey: synapse_db_password
-  nodeSelector:
-    kubernetes.io/hostname: master.tail2fe2d.ts.net
-  media:
-    storage:
-      size: 20Gi
-    maxUploadSize: 100M
-
-## Matrix Authentication Service
-matrixAuthenticationService:
-  enabled: true
-  ingress:
-    host: auth.matrix.hexor.cy
-  postgres:
-    host: psql.psql.svc
-    port: 5432
-    user: mas
-    database: mas
-    sslMode: prefer
-    password:
-      secret: matrix-postgres-creds
-      secretKey: mas_db_password
-  ## Admin policy
-  additional:
-    0-admin-policy:
-      config: |
-        policy:
-          data:
-            admin_users:
-              - username: ultradesu
-    1-oidc:
-      configSecret: matrix-oidc-config
-      configSecretKey: mas-oidc.yaml
-  nodeSelector:
-    kubernetes.io/hostname: master.tail2fe2d.ts.net
-
-## Element Web client
-elementWeb:
-  enabled: true
-  ingress:
-    host: chat.matrix.hexor.cy
-  nodeSelector:
-    kubernetes.io/hostname: master.tail2fe2d.ts.net
-
-## Element Admin panel
-elementAdmin:
-  enabled: true
-  ingress:
-    host: admin.matrix.hexor.cy
-  nodeSelector:
-    kubernetes.io/hostname: master.tail2fe2d.ts.net
-
-## Well-known delegation on the base domain (host is derived from serverName)
-wellKnownDelegation:
-  enabled: true
@@ -5,12 +5,7 @@ resources:
  - ./app.yaml
  - ./rbac.yaml
  - ./daemonset.yaml
-  - ./telemt-daemonset.yaml
  - ./external-secrets.yaml
-  - ./telemt-external-secrets.yaml
-  - ./telemt-service.yaml
-  - ./telemt-servicemonitor.yaml
  - ./service.yaml
  - ./secret-reader.yaml
-  - ./secret-reader-ingress.yaml
 # - ./storage.yaml
@@ -1,45 +0,0 @@
---
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: auth-proxy
-spec:
-  forwardAuth:
-    address: http://auth-proxy.auth-proxy.svc:80/auth
-    trustForwardHeader: true
-    authResponseHeaders:
-      - X-Auth-Request-User
-      - X-Auth-Request-Email
-      - X-Auth-Request-Groups
---
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: secret-reader
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`secret-reader.hexor.cy`)
-      kind: Rule
-      middlewares:
-        - name: auth-proxy
-      services:
-        - name: secret-reader
-          port: 80
-  tls:
-    secretName: secret-reader-tls
---
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: secret-reader-tls
-spec:
-  secretName: secret-reader-tls
-  issuerRef:
-    name: letsencrypt
-    kind: ClusterIssuer
-  dnsNames:
-    - secret-reader.hexor.cy
@@ -23,7 +23,7 @@ spec:
        imagePullPolicy: Always
        args:
          - "--secrets"
-          - "mtproxy-links,telemt-links"
+          - "mtproxy-links"
          - "--namespace"
          - "mtproxy"
          - "--port"
@@ -1,115 +0,0 @@
---
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: telemt
-  labels:
-    app: telemt
-spec:
-  selector:
-    matchLabels:
-      app: telemt
-  updateStrategy:
-    type: RollingUpdate
-  template:
-    metadata:
-      labels:
-        app: telemt
-    spec:
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-              - matchExpressions:
-                  - key: mtproxy
-                    operator: Exists
-      serviceAccountName: mtproxy
-      hostNetwork: true
-      dnsPolicy: ClusterFirstWithHostNet
-      initContainers:
-        - name: register-proxy
-          image: bitnami/kubectl:latest
-          env:
-            - name: NODE_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: spec.nodeName
-            - name: SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: tgproxy-secret
-                  key: SECRET
-            - name: TELEMT_PORT
-              valueFrom:
-                secretKeyRef:
-                  name: telemt-secret
-                  key: PORT
-          command:
-            - /bin/bash
-            - -c
-            - |
-              set -e
-              NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)
-              SERVER=$(kubectl get node "${NODE_NAME}" -o jsonpath='{.metadata.labels.mtproxy}')
-              if [ -z "${SERVER}" ]; then
-                echo "ERROR: node ${NODE_NAME} has no mtproxy label"
-                exit 1
-              fi
-              # Build ee-prefixed secret: ee + secret + hex(tls_domain)
-              # "ya.ru" = 79612e7275
-              EE_SECRET="ee${SECRET}79612e7275"
-              LINK="tg://proxy?server=${SERVER}&port=${TELEMT_PORT}&secret=${EE_SECRET}"
-              echo "Registering telemt: ${SERVER} -> ${LINK}"
-              if kubectl get secret telemt-links -n "${NAMESPACE}" &>/dev/null; then
-                kubectl patch secret telemt-links -n "${NAMESPACE}" \
-                  --type merge -p "{\"stringData\":{\"${SERVER}\":\"${LINK}\"}}"
-              else
-                kubectl create secret generic telemt-links -n "${NAMESPACE}" \
-                  --from-literal="${SERVER}=${LINK}"
-              fi
-              echo "Done"
-      containers:
-        - name: telemt
-          image: ghcr.io/telemt/telemt:latest
-          imagePullPolicy: Always
-          ports:
-            - name: proxy
-              containerPort: 30444
-              protocol: TCP
-            - name: api
-              containerPort: 9091
-              protocol: TCP
-          workingDir: /run/telemt
-          env:
-            - name: RUST_LOG
-              value: info
-          volumeMounts:
-            - name: workdir
-              mountPath: /run/telemt
-            - name: config
-              mountPath: /run/telemt/config.toml
-              subPath: config.toml
-              readOnly: true
-            - name: etcdir
-              mountPath: /etc/telemt
-          securityContext:
-            readOnlyRootFilesystem: true
-            allowPrivilegeEscalation: false
-            capabilities:
-              drop:
-                - ALL
-      volumes:
-        - name: config
-          secret:
-            secretName: telemt-secret
-            items:
-              - key: config.toml
-                path: config.toml
-        - name: workdir
-          emptyDir:
-            medium: Memory
-            sizeLimit: 1Mi
-        - name: etcdir
-          emptyDir:
-            medium: Memory
-            sizeLimit: 1Mi
@@ -1,59 +0,0 @@
---
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: telemt-secret
-spec:
-  target:
-    name: telemt-secret
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        SECRET: |-
-          {{ .secret }}
-        PORT: "30444"
-        config.toml: |
-          [general]
-          use_middle_proxy = true
-          log_level = "normal"
-
-          [general.modes]
-          classic = false
-          secure = false
-          tls = true
-
-          [general.links]
-          show = "*"
-          public_port = 30444
-
-          [server]
-          port = 30444
-          metrics_port = 9090
-          metrics_whitelist = ["0.0.0.0/0"]
-
-          [server.api]
-          enabled = true
-          listen = "0.0.0.0:9091"
-          whitelist = ["0.0.0.0/0"]
-
-          [[server.listeners]]
-          ip = "0.0.0.0"
-
-          [censorship]
-          tls_domain = "ya.ru"
-          mask = true
-          tls_emulation = true
-          tls_front_dir = "tlsfront"
-
-          [access.users]
-          user = "{{ .secret }}"
-  data:
-    - secretKey: secret
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: 58a37daf-72d8-430d-86bd-6152aa8f888d
-        property: fields[0].value
@@ -1,17 +0,0 @@
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: telemt-metrics
-  labels:
-    app: telemt
-spec:
-  type: ClusterIP
-  clusterIP: None
-  selector:
-    app: telemt
-  ports:
-    - port: 9090
-      targetPort: 9090
-      protocol: TCP
-      name: metrics
@@ -1,24 +0,0 @@
---
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: telemt-metrics
-  labels:
-    app: telemt
-    release: prometheus
-spec:
-  selector:
-    matchLabels:
-      app: telemt
-  endpoints:
-    - port: metrics
-      path: /metrics
-      interval: 30s
-      scrapeTimeout: 10s
-      honorLabels: true
-      relabelings:
-        - sourceLabels: [__meta_kubernetes_pod_node_name]
-          targetLabel: node
-  namespaceSelector:
-    matchNames:
-      - mtproxy
@@ -4,7 +4,6 @@ kind: Kustomization
 resources:
  - external-secrets.yaml
  - local-pv.yaml
-  - open-terminal.yaml
  
 helmCharts:
  - name: ollama
@@ -16,7 +15,7 @@ helmCharts:
    includeCRDs: true
  - name: open-webui
    repo: https://helm.openwebui.com/
-    version: 12.10.0
+    version: 12.8.1
    releaseName: openweb-ui
    namespace: ollama
    valuesFile: openweb-ui-values.yaml
@@ -1,53 +0,0 @@
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: open-terminal
-  labels:
-    app: open-terminal
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: open-terminal
-  template:
-    metadata:
-      labels:
-        app: open-terminal
-    spec:
-      nodeSelector:
-        kubernetes.io/hostname: uk-desktop.tail2fe2d.ts.net
-      tolerations:
-        - key: workload
-          operator: Equal
-          value: desktop
-          effect: NoSchedule
-      containers:
-        - name: open-terminal
-          image: ghcr.io/open-webui/open-terminal:latest
-          ports:
-            - containerPort: 8000
-          env:
-            - name: OPEN_TERMINAL_API_KEY
-              value: "LOCAL_ACCESS_TOKEN"
-          resources:
-            requests:
-              cpu: 100m
-              memory: 256Mi
-            limits:
-              cpu: "2"
-              memory: 2Gi
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: open-terminal
-  labels:
-    app: open-terminal
-spec:
-  selector:
-    app: open-terminal
-  ports:
-    - port: 8000
-      targetPort: 8000
-      protocol: TCP
@@ -1,4 +1,71 @@
 ---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: pasarguard-node
+  labels:
+    app: pasarguard-node
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: pasarguard-node-configmap
+  labels:
+    app: pasarguard-node
+rules:
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["get", "list", "create", "update", "patch"]
+  - apiGroups: ["cert-manager.io"]
+    resources: ["certificates"]
+    verbs: ["get", "list", "create", "update", "patch", "delete"]
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "list"]
+  - apiGroups: [""]
+    resources: ["services", "endpoints"]
+    verbs: ["get", "list", "create", "update", "patch", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: pasarguard-node-configmap
+  labels:
+    app: pasarguard-node
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: pasarguard-node-configmap
+subjects:
+  - kind: ServiceAccount
+    name: pasarguard-node
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: pasarguard-node-reader
+  labels:
+    app: pasarguard-node
+rules:
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: pasarguard-node-reader
+  labels:
+    app: pasarguard-node
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: pasarguard-node-reader
+subjects:
+  - kind: ServiceAccount
+    name: pasarguard-node
+    namespace: pasarguard
+---
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
@@ -46,7 +113,7 @@ spec:
              mountPath: /scripts
      containers:
        - name: pasarguard-node
-          image: pasarguard/node:v0.4.0
+          image: 'pasarguard/node:v0.2.1'
          imagePullPolicy: Always
          command:
            - /bin/sh
@@ -152,71 +219,3 @@ spec:
          configMap:
            name: pasarguard-scripts
            defaultMode: 0755
-
---
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: pasarguard-node
-  labels:
-    app: pasarguard-node
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: pasarguard-node-configmap
-  labels:
-    app: pasarguard-node
-rules:
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["get", "list", "create", "update", "patch"]
-  - apiGroups: ["cert-manager.io"]
-    resources: ["certificates"]
-    verbs: ["get", "list", "create", "update", "patch", "delete"]
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get", "list"]
-  - apiGroups: [""]
-    resources: ["services", "endpoints"]
-    verbs: ["get", "list", "create", "update", "patch", "delete"]
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: pasarguard-node-configmap
-  labels:
-    app: pasarguard-node
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: pasarguard-node-configmap
-subjects:
-  - kind: ServiceAccount
-    name: pasarguard-node
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: pasarguard-node-reader
-  labels:
-    app: pasarguard-node
-rules:
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["get", "list"]
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: pasarguard-node-reader
-  labels:
-    app: pasarguard-node
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: pasarguard-node-reader
-subjects:
-  - kind: ServiceAccount
-    name: pasarguard-node
-    namespace: pasarguard
@@ -34,7 +34,7 @@ spec:
              mountPath: /templates/subscription
      containers:
        - name: pasarguard-web
-          image: pasarguard/panel:v4.0.2
+          image: 'pasarguard/panel:latest'
          imagePullPolicy: Always
          envFrom:
            - secretRef:
@@ -1,26 +0,0 @@
---
-apiVersion: traefik.io/v1alpha1
-kind: ServersTransport
-metadata:
-  name: pasarguard-transport
-spec:
-  serverName: ps.hexor.cy
-  insecureSkipVerify: true
---
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: pasarguard
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`ps.hexor.cy`)
-      kind: Rule
-      services:
-        - name: pasarguard
-          port: 80
-          scheme: https
-          serversTransport: pasarguard-transport
-  tls:
-    secretName: pasarguard-tls
@@ -9,4 +9,3 @@ resources:
  - ./certificate.yaml
  - ./configmap-scripts.yaml
  - ./servicemonitor.yaml
-  - ./ingress.yaml
@@ -1,20 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: teamspeak
-  namespace: argocd
-spec:
-  project: apps
-  destination:
-    namespace: teamspeak
-    server: https://kubernetes.default.svc
-  source:
-    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
-    targetRevision: HEAD
-    path: k8s/apps/teamspeak
-  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: true
-    syncOptions:
-      - CreateNamespace=true
@@ -1,49 +0,0 @@
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: teamspeak
-  labels:
-    app: teamspeak
-spec:
-  selector:
-    matchLabels:
-      app: teamspeak
-  replicas: 1
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        app: teamspeak
-    spec:
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: teamspeak-data
-      containers:
-        - name: teamspeak
-          image: 'teamspeak:latest'
-          env:
-            - name: TS3SERVER_LICENSE
-              value: "accept"
-          resources:
-            requests:
-              memory: "256Mi"
-              cpu: "100m"
-            limits:
-              memory: "512Mi"
-              cpu: "1000m"
-          ports:
-            - name: voice
-              containerPort: 9987
-              protocol: UDP
-            - name: filetransfer
-              containerPort: 30033
-              protocol: TCP
-            - name: serverquery
-              containerPort: 10011
-              protocol: TCP
-          volumeMounts:
-            - name: data
-              mountPath: /var/ts3server
@@ -1,8 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - app.yaml
-  - storage.yaml
-  - deployment.yaml
-  - service.yaml
@@ -1,22 +0,0 @@
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: teamspeak
-spec:
-  type: LoadBalancer
-  selector:
-    app: teamspeak
-  ports:
-    - name: voice
-      protocol: UDP
-      port: 9987
-      targetPort: 9987
-    - name: filetransfer
-      protocol: TCP
-      port: 30033
-      targetPort: 30033
-    - name: serverquery
-      protocol: TCP
-      port: 10011
-      targetPort: 10011
@@ -1,12 +0,0 @@
---
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: teamspeak-data
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 5Gi
@@ -1,21 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: web-petting
-  namespace: argocd
-spec:
-  project: apps
-  destination:
-    namespace: web-petting
-    server: https://kubernetes.default.svc
-  source:
-    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
-    targetRevision: HEAD
-    path: k8s/apps/web-petting
-  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: true
-    syncOptions:
-      - CreateNamespace=true
-
@@ -1,52 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: web-petting
-  labels:
-    app: web-petting
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: web-petting
-  template:
-    metadata:
-      labels:
-        app: web-petting
-    spec:
-      nodeSelector:
-        kubernetes.io/os: linux
-        kubernetes.io/hostname: master.tail2fe2d.ts.net
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: web-petting-data
-      containers:
-      - name: web-petting
-        image: ultradesu/web-petting:latest
-        imagePullPolicy: Always
-        args:
-#         - "tail"
-#         - "-F"
-#         - "/1"
-          - "web-petting"
-          - "-l"
-          - "0.0.0.0:3000"
-        ports:
-        - containerPort: 3000
-          name: http
-        volumeMounts:
-          - name: data
-            mountPath: /data
-        env:
-        - name: RUST_LOG
-          value: "info"
-        resources:
-          requests:
-            memory: "64Mi"
-            cpu: "50m"
-          limits:
-            memory: "128Mi"
-            cpu: "150m"
@@ -1,40 +0,0 @@
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: web-petting-tls-ingress
-  annotations:
-    ingressClassName: traefik
-    cert-manager.io/cluster-issuer: letsencrypt
-    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
-    acme.cert-manager.io/http01-edit-in-place: "true"
-spec:
-  rules:
-    - host: pet.hexor.cy
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: web-petting
-                port:
-                  number: 80
-    - host: xn--l1acako8eb.xn--p1ai
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: web-petting
-                port:
-                  number: 80
-  tls:
-    - secretName: web-petting-tls
-      hosts:
-        - pet.hexor.cy
-    - secretName: web-petting-murnyanya-tls
-      hosts:
-        - xn--l1acako8eb.xn--p1ai
-
@@ -1,10 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - app.yaml
-  - deployment.yaml
-  - service.yaml
-  - ingress.yaml
-  - storage.yaml
-
@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: web-petting
-  labels:
-    app: web-petting
-spec:
-  type: ClusterIP
-  selector:
-    app: web-petting
-  ports:
-  - port: 80
-    targetPort: 3000
-    protocol: TCP
-    name: http
@@ -1,12 +0,0 @@
---
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: web-petting-data
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 10Gi
@@ -1,20 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: wedding
-  namespace: argocd
-spec:
-  project: apps
-  destination:
-    namespace: wedding
-    server: https://kubernetes.default.svc
-  source:
-    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
-    targetRevision: HEAD
-    path: k8s/apps/wedding
-  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: true
-    syncOptions:
-      - CreateNamespace=true
@@ -1,69 +0,0 @@
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: wedding
-  labels:
-    app: wedding
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: wedding
-  template:
-    metadata:
-      labels:
-        app: wedding
-    spec:
-      nodeSelector:
-        kubernetes.io/hostname: spb.tail2fe2d.ts.net
-      initContainers:
-        - name: git-clone
-          image: alpine/git:latest
-          command:
-            - sh
-            - -c
-            - git clone --depth 1 https://gt.hexor.cy/ab/wedding.git /src
-          volumeMounts:
-            - name: source
-              mountPath: /src
-        - name: zola-build
-          image: ghcr.io/getzola/zola:v0.22.1
-          command:
-            - /bin/zola
-          args:
-            - --root
-            - /src
-            - build
-            - --base-url
-            - https://wedding.hexor.cy/
-            - --output-dir
-            - /public/html
-          volumeMounts:
-            - name: source
-              mountPath: /src
-            - name: public
-              mountPath: /public
-      containers:
-        - name: nginx
-          image: nginx:alpine
-          ports:
-            - containerPort: 80
-              protocol: TCP
-          volumeMounts:
-            - name: public
-              mountPath: /usr/share/nginx/html
-              subPath: html
-              readOnly: true
-          resources:
-            requests:
-              memory: 32Mi
-              cpu: 10m
-            limits:
-              memory: 64Mi
-              cpu: 100m
-      volumes:
-        - name: source
-          emptyDir: {}
-        - name: public
-          emptyDir: {}
@@ -1,26 +0,0 @@
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: wedding-tls-ingress
-  annotations:
-    ingressClassName: traefik
-    cert-manager.io/cluster-issuer: letsencrypt
-    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
-    acme.cert-manager.io/http01-edit-in-place: "true"
-spec:
-  rules:
-    - host: wedding.hexor.cy
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: wedding
-                port:
-                  number: 80
-  tls:
-    - secretName: wedding-tls
-      hosts:
-        - wedding.hexor.cy
@@ -1,10 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - app.yaml
-  - rbac.yaml
-  - deployment.yaml
-  - service.yaml
-  - ingress.yaml
-  - webhook.yaml
@@ -1,42 +0,0 @@
---
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: wedding-deployer
-  namespace: wedding
-
---
-apiVersion: v1
-kind: Secret
-metadata:
-  name: wedding-deployer-token
-  namespace: wedding
-  annotations:
-    kubernetes.io/service-account.name: wedding-deployer
-type: kubernetes.io/service-account-token
-
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: wedding-restart
-  namespace: wedding
-rules:
-  - apiGroups: ["apps"]
-    resources: ["deployments"]
-    verbs: ["get", "patch"]
-
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: wedding-deployer-restart
-  namespace: wedding
-subjects:
-  - kind: ServiceAccount
-    name: wedding-deployer
-    namespace: wedding
-roleRef:
-  kind: Role
-  name: wedding-restart
-  apiGroup: rbac.authorization.k8s.io
@@ -1,12 +0,0 @@
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: wedding
-spec:
-  selector:
-    app: wedding
-  ports:
-    - port: 80
-      targetPort: 80
-      protocol: TCP
@@ -1,71 +0,0 @@
---
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: webhook-script
-data:
-  serve.sh: |
-    #!/bin/sh
-    echo "Webhook server listening on :8080"
-    while true; do
-      echo -e "HTTP/1.1 200 OK\r\nContent-Length: 2\r\nConnection: close\r\n\r\nok" \
-        | nc -l -p 8080 > /dev/null
-      echo "Received webhook, restarting deployment..."
-      kubectl rollout restart deployment/wedding
-    done
-
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: wedding-webhook
-  labels:
-    app: wedding-webhook
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: wedding-webhook
-  template:
-    metadata:
-      labels:
-        app: wedding-webhook
-    spec:
-      nodeSelector:
-        kubernetes.io/hostname: spb.tail2fe2d.ts.net
-      serviceAccountName: wedding-deployer
-      containers:
-        - name: webhook
-          image: alpine/k8s:1.32.3
-          command: ["sh", "/scripts/serve.sh"]
-          ports:
-            - containerPort: 8080
-              protocol: TCP
-          volumeMounts:
-            - name: script
-              mountPath: /scripts
-              readOnly: true
-          resources:
-            requests:
-              memory: 16Mi
-              cpu: 5m
-            limits:
-              memory: 32Mi
-              cpu: 50m
-      volumes:
-        - name: script
-          configMap:
-            name: webhook-script
-
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: wedding-webhook
-spec:
-  selector:
-    app: wedding-webhook
-  ports:
-    - port: 8080
-      targetPort: 8080
-      protocol: TCP
@@ -18,5 +18,4 @@ spec:
      prune: true
    syncOptions:
      - CreateNamespace=true
-      - ServerSideApply=true

@@ -23,9 +23,6 @@ spec:
          name: vaultwarden-login
          kind: ClusterSecretStore
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        metadataPolicy: None
        key: 1062e5b4-5380-49f1-97c3-340f26f3487e
        property: fields[0].value
    - secretKey: client_secret
@@ -34,9 +31,6 @@ spec:
          name: vaultwarden-login
          kind: ClusterSecretStore
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        metadataPolicy: None
        key: 1062e5b4-5380-49f1-97c3-340f26f3487e
        property: fields[1].value

@@ -10,7 +10,7 @@ resources:
 helmCharts:
  - name: argo-cd
    repo: https://argoproj.github.io/argo-helm
-    version: 9.4.10
+    version: 9.1.4
    releaseName: argocd
    namespace: argocd
    valuesFile: values.yaml
@@ -23,39 +23,31 @@ configs:
    admin.enabled: false
    statusbadge.enabled: true
    timeout.reconciliation: 60s
-    dex.config: |
-      connectors:
-      - type: oidc
-        id: keycloak
-        name: Keycloak
-        config:
-          issuer: https://auth.hexor.cy/auth/realms/hexor
-          clientID: $oidc-creds:id
-          clientSecret: $oidc-creds:secret
-          insecureEnableGroups: true
-          scopes:
-            - openid
-            - profile
-            - email
-            - offline_access
-          getUserInfo: true
+    oidc.config: |
+      name: Authentik
+      issuer: https://idm.hexor.cy/application/o/argocd/
+      clientID: $oidc-creds:id
+      clientSecret: $oidc-creds:secret
+      requestedScopes: ["openid", "profile", "email", "groups"]
+      requestedIDTokenClaims: {"groups": {"essential": true}}
  rbac:
    create: true
    policy.default: ""
    policy.csv: |
-        g, game-servers-managers, GameServersManagersRole
-        # Role permissions
-        p, GameServersManagersRole, applications, get, games/*, allow
-        p, GameServersManagersRole, applications, update, games/*, allow
-        p, GameServersManagersRole, applications, sync, games/*, allow
-        p, GameServersManagersRole, applications, override, games/*, allow
-        p, GameServersManagersRole, applications, action/*, games/*, allow
-        p, GameServersManagersRole, exec, create, games/*, allow
-        p, GameServersManagersRole, logs, get, games/*, allow
-        p, GameServersManagersRole, applications, delete, games/*, deny
-    
-        # Admin policy
-        g, argocd-admins, role:admin
+      # Bound OIDC Group and internal role
+      g, Game Servers Managers, GameServersManagersRole
+      # Role permissions
+      p, GameServersManagersRole, applications, get, games/*, allow
+      p, GameServersManagersRole, applications, update, games/*, allow
+      p, GameServersManagersRole, applications, sync, games/*, allow
+      p, GameServersManagersRole, applications, override, games/*, allow
+      p, GameServersManagersRole, applications, action/*, games/*, allow
+      p, GameServersManagersRole, exec, create, games/*, allow
+      p, GameServersManagersRole, logs, get, games/*, allow
+      p, GameServersManagersRole, applications, delete, games/*, deny
+
+      # Admin policy
+      g, ArgoCD Admins, role:admin

  secret:
    createSecret: true
@@ -72,7 +64,7 @@ dex:
  replicas: 1
  nodeSelector:
    <<: *nodeSelector
-  enabled: true
+  enabled: false

 # Standard Redis disabled because Redis HA is enabled
 redis:
@@ -1,21 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: auth-proxy
-  namespace: argocd
-spec:
-  project: core
-  destination:
-    namespace: auth-proxy
-    server: https://kubernetes.default.svc
-  source:
-    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
-    targetRevision: HEAD
-    path: k8s/core/auth-proxy
-  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true
@@ -1,79 +0,0 @@
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: auth-proxy
-  labels:
-    app: auth-proxy
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: auth-proxy
-  template:
-    metadata:
-      labels:
-        app: auth-proxy
-    spec:
-      containers:
-        - name: auth-proxy
-          image: ultradesu/rsauth2-proxy:latest
-          ports:
-            - containerPort: 8080
-              name: http
-              protocol: TCP
-          envFrom:
-            - secretRef:
-                name: auth-proxy-creds
-          env:
-            - name: AUTH_PROXY_OIDC_ISSUER
-              value: "https://auth.hexor.cy/auth/realms/hexor"
-            - name: AUTH_PROXY_COOKIE_DOMAIN
-              value: ".hexor.cy"
-            - name: AUTH_PROXY_CALLBACK_URL
-              value: "https://oauth.hexor.cy/callback"
-            - name: AUTH_PROXY_ROUTES_FILE
-              value: "/config/routes.yaml"
-            - name: AUTH_PROXY_LOG_LEVEL
-              value: "debug"
-          volumeMounts:
-            - name: routes
-              mountPath: /config
-              readOnly: true
-          resources:
-            requests:
-              cpu: 50m
-              memory: 32Mi
-            limits:
-              cpu: 200m
-              memory: 64Mi
-          readinessProbe:
-            httpGet:
-              path: /health
-              port: 8080
-            initialDelaySeconds: 3
-            periodSeconds: 10
-          livenessProbe:
-            httpGet:
-              path: /health
-              port: 8080
-            initialDelaySeconds: 5
-            periodSeconds: 30
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            runAsNonRoot: true
-            runAsUser: 1000
-            runAsGroup: 1000
-            capabilities:
-              drop:
-                - ALL
-      volumes:
-        - name: routes
-          configMap:
-            name: auth-proxy-routes
-      nodeSelector:
-        kubernetes.io/hostname: master.tail2fe2d.ts.net
-      tolerations:
-        - key: node-role.kubernetes.io/master
-          effect: NoSchedule
@@ -1,40 +0,0 @@
---
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: auth-proxy-creds
-spec:
-  target:
-    name: auth-proxy-creds
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        AUTH_PROXY_CLIENT_ID: rsauth2-proxy
-        AUTH_PROXY_CLIENT_SECRET: |-
-          {{ .client_secret }}
-        AUTH_PROXY_COOKIE_SECRET: |-
-          {{ .cookie_secret }}
-  data:
-    - secretKey: client_secret
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        metadataPolicy: None
-        key: e62e8c4d-d538-43b2-a682-9cdf2a5a1165
-        property: login.password
-    - secretKey: cookie_secret
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        metadataPolicy: None
-        key: e62e8c4d-d538-43b2-a682-9cdf2a5a1165
-        property: fields[0].value
@@ -1,28 +0,0 @@
---
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: auth-proxy
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`oauth.hexor.cy`)
-      kind: Rule
-      services:
-        - name: auth-proxy
-          port: 80
-  tls:
-    secretName: auth-proxy-tls
---
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: auth-proxy-tls
-spec:
-  secretName: auth-proxy-tls
-  issuerRef:
-    name: letsencrypt
-    kind: ClusterIssuer
-  dnsNames:
-    - oauth.hexor.cy
@@ -1,11 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - app.yaml
-  - external-secrets.yaml
-  - deployment.yaml
-  - service.yaml
-  - ingress.yaml
-  - servicemonitor.yaml
-# routes.yaml ConfigMap is managed by Terraform (kubernetes_config_map)
@@ -1,15 +0,0 @@
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: auth-proxy
-  labels:
-    app: auth-proxy
-spec:
-  ports:
-    - name: http
-      port: 80
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: auth-proxy
@@ -1,21 +0,0 @@
---
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: auth-proxy-metrics
-  labels:
-    app: auth-proxy
-    release: prometheus
-spec:
-  selector:
-    matchLabels:
-      app: auth-proxy
-  endpoints:
-    - port: http
-      path: /metrics
-      interval: 30s
-      scrapeTimeout: 10s
-      honorLabels: true
-  namespaceSelector:
-    matchNames:
-      - auth-proxy
@@ -18,4 +18,4 @@ spec:
      prune: true
    syncOptions:
      - CreateNamespace=true
-      - ServerSideApply=true
+
@@ -34,9 +34,6 @@ spec:
          name: vaultwarden-login
          kind: ClusterSecretStore
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        metadataPolicy: None
        key: 279c2c1f-c147-4b6b-a511-36c3cd764f9d
        property: login.password
    - secretKey: username
@@ -45,9 +42,6 @@ spec:
          name: vaultwarden-login
          kind: ClusterSecretStore
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        metadataPolicy: None
        key: 279c2c1f-c147-4b6b-a511-36c3cd764f9d
        property: login.username
    - secretKey: secret_key
@@ -56,9 +50,6 @@ spec:
          name: vaultwarden-login
          kind: ClusterSecretStore
      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        metadataPolicy: None
        key: 279c2c1f-c147-4b6b-a511-36c3cd764f9d
        property: fields[0].value

@@ -4,13 +4,13 @@ kind: Kustomization
 resources:
  - app.yaml
  - external-secrets.yaml
-  - outpost-selector-fix.yaml
+  - https-middleware.yaml
 # - worker-restart.yaml

 helmCharts:
  - name: authentik
    repo: https://charts.goauthentik.io
-    version: 2026.2.2
+    version: 2026.2.0
    releaseName: authentik
    namespace: authentik
    valuesFile: values.yaml
@@ -1,81 +0,0 @@
-## Workaround for authentik bug: embedded outpost controller creates
-## a Service with selectors that don't match the pod labels it sets.
-## Remove this after upgrading to a version with the fix.
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: outpost-selector-fix
-  namespace: authentik
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: outpost-selector-fix
-  namespace: authentik
-rules:
-  - apiGroups: [""]
-    resources: ["services"]
-    verbs: ["get", "patch"]
-  - apiGroups: [""]
-    resources: ["endpoints"]
-    verbs: ["get"]
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: outpost-selector-fix
-  namespace: authentik
-subjects:
-  - kind: ServiceAccount
-    name: outpost-selector-fix
-    namespace: authentik
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: outpost-selector-fix
---
-apiVersion: batch/v1
-kind: CronJob
-metadata:
-  name: outpost-selector-fix
-  namespace: authentik
-spec:
-  schedule: "* * * * *"
-  successfulJobsHistoryLimit: 1
-  failedJobsHistoryLimit: 3
-  concurrencyPolicy: Replace
-  jobTemplate:
-    spec:
-      ttlSecondsAfterFinished: 300
-      template:
-        spec:
-          serviceAccountName: outpost-selector-fix
-          restartPolicy: OnFailure
-          containers:
-            - name: fix
-              image: bitnami/kubectl:latest
-              command:
-                - /bin/sh
-                - -c
-                - |
-                  SVC="ak-outpost-authentik-embedded-outpost"
-                  # check if endpoints are populated
-                  ADDRS=$(kubectl get endpoints "$SVC" -n authentik -o jsonpath='{.subsets[*].addresses[*].ip}' 2>/dev/null)
-                  if [ -n "$ADDRS" ]; then
-                    echo "Endpoints OK ($ADDRS), nothing to fix"
-                    exit 0
-                  fi
-                  echo "No endpoints for $SVC, patching selector..."
-                  kubectl patch svc "$SVC" -n authentik --type=json -p '[
-                    {"op":"remove","path":"/spec/selector/app.kubernetes.io~1component"},
-                    {"op":"replace","path":"/spec/selector/app.kubernetes.io~1name","value":"authentik-outpost-proxy"}
-                  ]'
-                  echo "Patched. Verifying..."
-                  sleep 2
-                  ADDRS=$(kubectl get endpoints "$SVC" -n authentik -o jsonpath='{.subsets[*].addresses[*].ip}' 2>/dev/null)
-                  if [ -n "$ADDRS" ]; then
-                    echo "Fix confirmed, endpoints: $ADDRS"
-                  else
-                    echo "WARNING: still no endpoints after patch"
-                    exit 1
-                  fi
@@ -1,6 +1,8 @@
 global:
  image:
-    tag: "2026.2.2"
+    tag: "2025.10.1"
+  nodeSelector:
+    kubernetes.io/hostname: master.tail2fe2d.ts.net

 authentik:
    error_reporting:
@@ -13,35 +15,14 @@ worker:
  envFrom:
    - secretRef:
        name: authentik-creds
-# volumes:
-#   - name: dshm
-#     emptyDir:
-#       medium: Memory
-#       sizeLimit: 512Mi
-# volumeMounts:
-#   - name: dshm
-#     mountPath: /dev/shm
-# livenessProbe:
-#   exec:
-#     command: ["/bin/sh", "-c", "kill -0 1"]
-#   initialDelaySeconds: 5
-#   periodSeconds: 10
-#   failureThreshold: 3
-#   timeoutSeconds: 3
-# readinessProbe:
-#   exec:
-#     command: ["/bin/sh", "-c", "kill -0 1"]
-#   initialDelaySeconds: 5
-#   periodSeconds: 10
-#   failureThreshold: 3
-#   timeoutSeconds: 3
-# startupProbe:
-#   exec:
-#     command: ["/bin/sh", "-c", "kill -0 1"]
-#   initialDelaySeconds: 30
-#   periodSeconds: 10
-#   failureThreshold: 60
-#   timeoutSeconds: 3
+  volumes:
+    - name: dshm
+      emptyDir:
+        medium: Memory
+        sizeLimit: 512Mi
+  volumeMounts:
+    - name: dshm
+      mountPath: /dev/shm
 server:
  envFrom:
    - secretRef:
@@ -54,10 +35,23 @@ server:
        traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
      hosts:
        - idm.hexor.cy
+        - nas.hexor.cy       # TrueNAS Limassol
+        - nc.hexor.cy        # NaxtCloud
+        - of.hexor.cy        # Outfleet-v2
+        - k8s.hexor.cy       # k8s dashboard
+        - qbt.hexor.cy       # qBittorent for Jellyfin
+        - prom.hexor.cy      # Prometheus
+        - khm.hexor.cy       # Known Hosts keys Manager
+        - backup.hexor.cy    # Kopia Backup UI
+        - fm.hexor.cy        # Filemanager
+        - minecraft.hexor.cy # Minecraft UI and server
+        - pass.hexor.cy      # k8s-secret for openai
+        - ps.hexor.cy        # pasarguard UI
+#       - rw.hexor.cy        # RemnaWave UI
      tls:
        - secretName: idm-tls
          hosts:
            - '*.hexor.cy'
 redis:
-    enabled: false
+    enabled: true

@@ -18,9 +18,11 @@ spec:
              key: apiKey
        selector:
          dnsZones:
+            - "*.hexor.cy"
            - "*.hexor.ru"
            - "*.btwiusearch.net"
            - "hexor.ru"
+            - "hexor.cy"
            - "btwiusearch.net"
      - dns01:
          route53:
@@ -33,8 +35,6 @@ spec:
              key: secretKey
        selector:
          dnsZones:
-            - "*.hexor.cy"
-            - "hexor.cy"
-            - "*.xn--l1acako8eb.xn--p1ai"
-            - "xn--l1acako8eb.xn--p1ai"
+            - "ps.hexor.cy"
+            - "of.hexor.cy"

@@ -10,7 +10,7 @@ resources:
 helmCharts:
  - name: cert-manager
    repo: https://charts.jetstack.io
-    version: 1.20.0
+    version: 1.19.1
    releaseName: cert-manager
    namespace: cert-manager
    valuesFile: values.yaml
@@ -1,21 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: kanidm
-  namespace: argocd
-spec:
-  project: core
-  destination:
-    namespace: kanidm
-    server: https://kubernetes.default.svc
-  source:
-    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
-    targetRevision: HEAD
-    path: k8s/core/kanidm
-  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true
@@ -1,12 +0,0 @@
---
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: kanidm-tls
-spec:
-  secretName: kanidm-tls
-  issuerRef:
-    name: letsencrypt
-    kind: ClusterIssuer
-  dnsNames:
-    - auth.hexor.cy
@@ -1,19 +0,0 @@
---
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: kanidm-config
-data:
-  server.toml: |
-    bindaddress = "[::]:443"
-    db_path = "/data/kanidm.db"
-    tls_chain = "/certs/tls.crt"
-    tls_key = "/certs/tls.key"
-    domain = "auth.hexor.cy"
-    origin = "https://auth.hexor.cy"
-    log_level = "info"
-
-    [online_backup]
-    path = "/data/backups/"
-    schedule = "00 22 * * *"
-    versions = 7
@@ -1,20 +0,0 @@
---
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: kanidm
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`auth.hexor.cy`)
-      kind: Rule
-      services:
-        - name: kanidm
-          port: 443
-          scheme: https
-          serversTransport: kanidm-transport
-  tls:
-    secretName: kanidm-ingress-tls
@@ -1,11 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - app.yaml
-  - configmap.yaml
-  - certificate.yaml
-  - statefulset.yaml
-  - service.yaml
-  - ingress.yaml
-  - servers-transport.yaml
@@ -1,7 +0,0 @@
---
-apiVersion: traefik.io/v1alpha1
-kind: ServersTransport
-metadata:
-  name: kanidm-transport
-spec:
-  insecureSkipVerify: true
@@ -1,15 +0,0 @@
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: kanidm
-  labels:
-    app: kanidm
-spec:
-  ports:
-    - name: https
-      port: 443
-      targetPort: 443
-      protocol: TCP
-  selector:
-    app: kanidm
@@ -1,86 +0,0 @@
---
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: kanidm
-  labels:
-    app: kanidm
-spec:
-  serviceName: kanidm
-  replicas: 1
-  selector:
-    matchLabels:
-      app: kanidm
-  template:
-    metadata:
-      labels:
-        app: kanidm
-    spec:
-      securityContext:
-        runAsUser: 1000
-        runAsGroup: 1000
-        fsGroup: 1000
-      containers:
-        - name: kanidm
-          image: kanidm/server:1.9.3
-          ports:
-            - containerPort: 443
-              name: https
-              protocol: TCP
-          volumeMounts:
-            - name: kanidm-data
-              mountPath: /data
-            - name: kanidm-config
-              mountPath: /data/server.toml
-              subPath: server.toml
-              readOnly: true
-            - name: kanidm-tls
-              mountPath: /certs
-              readOnly: true
-          resources:
-            requests:
-              memory: "128Mi"
-              cpu: "100m"
-            limits:
-              memory: "512Mi"
-              cpu: "500m"
-          readinessProbe:
-            httpGet:
-              path: /status
-              port: 443
-              scheme: HTTPS
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          livenessProbe:
-            httpGet:
-              path: /status
-              port: 443
-              scheme: HTTPS
-            initialDelaySeconds: 15
-            periodSeconds: 30
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: false
-            runAsUser: 1000
-            runAsGroup: 1000
-      volumes:
-        - name: kanidm-config
-          configMap:
-            name: kanidm-config
-        - name: kanidm-tls
-          secret:
-            secretName: kanidm-tls
-      nodeSelector:
-        kubernetes.io/hostname: master.tail2fe2d.ts.net
-      tolerations:
-        - key: node-role.kubernetes.io/master
-          effect: NoSchedule
-  volumeClaimTemplates:
-    - metadata:
-        name: kanidm-data
-      spec:
-        accessModes: ["ReadWriteOnce"]
-        storageClassName: longhorn
-        resources:
-          requests:
-            storage: 1Gi
@@ -1,21 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: keycloak
-  namespace: argocd
-spec:
-  project: core
-  destination:
-    namespace: keycloak
-    server: https://kubernetes.default.svc
-  source:
-    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
-    targetRevision: HEAD
-    path: k8s/core/keycloak
-  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: true
-    syncOptions:
-      - CreateNamespace=true
-      - ServerSideApply=true
@@ -1,41 +0,0 @@
---
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: keycloak-creds
-spec:
-  target:
-    name: keycloak-creds
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-        KC_DB_USERNAME: keycloak
-        KC_DB_PASSWORD: |-
-          {{ .db_password }}
-        KC_BOOTSTRAP_ADMIN_USERNAME: admin
-        KC_BOOTSTRAP_ADMIN_PASSWORD: |-
-          {{ .admin_password }}
-  data:
-    - secretKey: db_password
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        metadataPolicy: None
-        key: 2a9deb39-ef22-433e-a1be-df1555625e22
-        property: fields[18].value
-    - secretKey: admin_password
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        metadataPolicy: None
-        key: 9422b636-a91d-40e4-bf98-925b2a3f831d
-        property: login.password
@@ -1,366 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: keycloak-hacker-theme
-  namespace: keycloak
-data:
-  theme.properties: |
-    parent=keycloak.v2
-    import=common/keycloak
-
-    styles=css/hacker.css
-
-  hacker.css: |
-    /* ============================================================
-       HEXOR — Hacker Terminal Theme for Keycloak
-       ============================================================ */
-
-    @import url('https://fonts.googleapis.com/css2?family=Fira+Code:wght@400;600&display=swap');
-
-    :root {
-      --hk-bg: #0a0a0a;
-      --hk-panel: #0d0d0d;
-      --hk-border: #00ff4180;
-      --hk-green: #00ff41;
-      --hk-green-dim: #00cc33;
-      --hk-green-glow: rgba(0, 255, 65, 0.15);
-      --hk-green-glow-strong: rgba(0, 255, 65, 0.35);
-      --hk-cyan: #00e5ff;
-      --hk-red: #ff3333;
-      --hk-text: #b0ffb0;
-      --hk-text-dim: #5a8a5a;
-      --hk-input-bg: #050505;
-      --hk-font: 'Fira Code', 'Cascadia Code', 'JetBrains Mono', monospace;
-    }
-
-    /* -- Force dark always --------------------------------------------------- */
-    html.login-pf,
-    html.login-pf.pf-v5-theme-dark {
-      color-scheme: dark;
-    }
-
-    /* -- Background: scanlines + CRT ---------------------------------------- */
-    body#keycloak-bg {
-      font-family: var(--hk-font) !important;
-      background: var(--hk-bg) !important;
-      color: var(--hk-text) !important;
-      min-height: 100vh;
-      position: relative;
-    }
-
-    body#keycloak-bg::before {
-      content: '';
-      position: fixed;
-      inset: 0;
-      background: repeating-linear-gradient(
-        0deg,
-        transparent,
-        transparent 2px,
-        rgba(0, 255, 65, 0.03) 2px,
-        rgba(0, 255, 65, 0.03) 4px
-      );
-      pointer-events: none;
-      z-index: 9999;
-    }
-
-    /* -- Login container ----------------------------------------------------- */
-    .pf-v5-c-login {
-      background: transparent !important;
-    }
-
-    .pf-v5-c-login__container {
-      max-width: 480px !important;
-    }
-
-    /* -- Header / Brand ------------------------------------------------------ */
-    #kc-header-wrapper {
-      font-family: var(--hk-font) !important;
-      color: var(--hk-green) !important;
-      text-shadow: 0 0 10px var(--hk-green), 0 0 30px var(--hk-green-glow);
-      font-size: 1.5rem !important;
-      letter-spacing: 0.15em;
-      text-transform: uppercase;
-    }
-
-    #kc-header-wrapper .kc-logo-text span::before {
-      content: '> ';
-      opacity: 0.6;
-    }
-
-    /* -- Main card ----------------------------------------------------------- */
-    .pf-v5-c-login__main {
-      background: var(--hk-panel) !important;
-      border: 1px solid var(--hk-border) !important;
-      border-radius: 0 !important;
-      box-shadow:
-        0 0 15px var(--hk-green-glow),
-        inset 0 0 30px rgba(0, 0, 0, 0.5) !important;
-    }
-
-    /* -- Title --------------------------------------------------------------- */
-    h1#kc-page-title,
-    .pf-v5-c-title {
-      font-family: var(--hk-font) !important;
-      color: var(--hk-green) !important;
-      text-shadow: 0 0 8px var(--hk-green-glow);
-      font-weight: 600 !important;
-      font-size: 1.25rem !important;
-      letter-spacing: 0.05em;
-    }
-
-    /* -- Labels -------------------------------------------------------------- */
-    .pf-v5-c-form__label-text {
-      font-family: var(--hk-font) !important;
-      color: var(--hk-green-dim) !important;
-      font-size: 0.85rem !important;
-      text-transform: uppercase;
-      letter-spacing: 0.08em;
-    }
-
-    /* -- Input fields -------------------------------------------------------- */
-    .pf-v5-c-form-control {
-      background-color: var(--hk-input-bg) !important;
-      border: 1px solid var(--hk-border) !important;
-      border-radius: 0 !important;
-      color: var(--hk-green) !important;
-      font-family: var(--hk-font) !important;
-      font-size: 0.9rem !important;
-      caret-color: var(--hk-green);
-      transition: border-color 0.2s, box-shadow 0.2s;
-    }
-
-    .pf-v5-c-form-control:focus-within,
-    .pf-v5-c-form-control:focus {
-      border-color: var(--hk-green) !important;
-      box-shadow: 0 0 8px var(--hk-green-glow), inset 0 0 4px var(--hk-green-glow) !important;
-      outline: none !important;
-    }
-
-    .pf-v5-c-form-control input {
-      color: var(--hk-green) !important;
-      font-family: var(--hk-font) !important;
-    }
-
-    .pf-v5-c-form-control input::placeholder {
-      color: var(--hk-text-dim) !important;
-    }
-
-    /* -- Primary button (Sign In) -------------------------------------------- */
-    .pf-v5-c-button.pf-m-primary {
-      background: transparent !important;
-      border: 1px solid var(--hk-green) !important;
-      border-radius: 0 !important;
-      color: var(--hk-green) !important;
-      font-family: var(--hk-font) !important;
-      font-weight: 600 !important;
-      text-transform: uppercase;
-      letter-spacing: 0.12em;
-      font-size: 0.9rem !important;
-      transition: all 0.2s;
-      position: relative;
-      overflow: hidden;
-    }
-
-    .pf-v5-c-button.pf-m-primary:hover {
-      background: var(--hk-green-glow) !important;
-      box-shadow: 0 0 15px var(--hk-green-glow-strong), inset 0 0 15px var(--hk-green-glow) !important;
-      color: #fff !important;
-      text-shadow: 0 0 5px var(--hk-green);
-    }
-
-    /* -- Secondary button (Try Another Way, Passkey) ------------------------- */
-    .pf-v5-c-button.pf-m-secondary {
-      background: transparent !important;
-      border: 1px solid var(--hk-cyan) !important;
-      border-radius: 0 !important;
-      color: var(--hk-cyan) !important;
-      font-family: var(--hk-font) !important;
-      text-transform: uppercase;
-      letter-spacing: 0.1em;
-      font-size: 0.85rem !important;
-      transition: all 0.2s;
-    }
-
-    .pf-v5-c-button.pf-m-secondary:hover {
-      background: rgba(0, 229, 255, 0.1) !important;
-      box-shadow: 0 0 12px rgba(0, 229, 255, 0.3) !important;
-      color: #fff !important;
-    }
-
-    /* -- Passkey authenticate button ----------------------------------------- */
-    #authenticateWebAuthnButton {
-      background: transparent !important;
-      border: 1px solid var(--hk-cyan) !important;
-      border-radius: 0 !important;
-      color: var(--hk-cyan) !important;
-      font-family: var(--hk-font) !important;
-      text-transform: uppercase;
-      letter-spacing: 0.1em;
-      font-size: 0.85rem !important;
-      padding: 0.75rem 1rem;
-      display: block;
-      width: 100%;
-      text-align: center;
-      text-decoration: none;
-      transition: all 0.2s;
-      margin-top: 1rem;
-    }
-
-    #authenticateWebAuthnButton::before {
-      content: '\f084  ';
-      font-family: 'Font Awesome 6 Free', 'FontAwesome';
-      font-weight: 900;
-    }
-
-    #authenticateWebAuthnButton:hover {
-      background: rgba(0, 229, 255, 0.1) !important;
-      box-shadow: 0 0 15px rgba(0, 229, 255, 0.3), inset 0 0 10px rgba(0, 229, 255, 0.1) !important;
-      color: #fff !important;
-      text-shadow: 0 0 5px var(--hk-cyan);
-    }
-
-    /* -- Show password button ------------------------------------------------ */
-    .pf-v5-c-button.pf-m-control {
-      background: var(--hk-input-bg) !important;
-      border: 1px solid var(--hk-border) !important;
-      border-left: none !important;
-      border-radius: 0 !important;
-      color: var(--hk-text-dim) !important;
-    }
-
-    .pf-v5-c-button.pf-m-control:hover {
-      color: var(--hk-green) !important;
-    }
-
-    /* -- Social providers (Google, etc) -------------------------------------- */
-    .pf-v5-c-login__main-footer {
-      border-top: 1px solid var(--hk-border) !important;
-    }
-
-    .kc-social-section .pf-v5-c-button.pf-m-secondary {
-      border-color: var(--hk-text-dim) !important;
-      color: var(--hk-text) !important;
-    }
-
-    .kc-social-section .pf-v5-c-button.pf-m-secondary:hover {
-      border-color: var(--hk-green) !important;
-      color: var(--hk-green) !important;
-      box-shadow: 0 0 10px var(--hk-green-glow) !important;
-    }
-
-    /* -- Try another way link ------------------------------------------------ */
-    #try-another-way {
-      color: var(--hk-cyan) !important;
-      text-decoration: none !important;
-      font-family: var(--hk-font) !important;
-    }
-
-    #try-another-way:hover {
-      text-shadow: 0 0 8px rgba(0, 229, 255, 0.5);
-    }
-
-    /* -- Links --------------------------------------------------------------- */
-    a {
-      color: var(--hk-cyan) !important;
-      text-decoration: none;
-      transition: text-shadow 0.2s;
-    }
-
-    a:hover {
-      text-shadow: 0 0 6px rgba(0, 229, 255, 0.4);
-    }
-
-    /* -- Alerts / messages --------------------------------------------------- */
-    .pf-v5-c-alert {
-      background: rgba(0, 255, 65, 0.05) !important;
-      border: 1px solid var(--hk-border) !important;
-      border-radius: 0 !important;
-      font-family: var(--hk-font) !important;
-    }
-
-    .pf-v5-c-alert.pf-m-danger {
-      border-color: var(--hk-red) !important;
-      background: rgba(255, 51, 51, 0.05) !important;
-    }
-
-    .pf-v5-c-alert__title {
-      color: var(--hk-text) !important;
-      font-family: var(--hk-font) !important;
-    }
-
-    /* -- Checkbox (Remember me) ---------------------------------------------- */
-    .pf-v5-c-check__label {
-      color: var(--hk-text-dim) !important;
-      font-family: var(--hk-font) !important;
-      font-size: 0.8rem !important;
-    }
-
-    /* -- Helper text (Forgot password, etc.) --------------------------------- */
-    .pf-v5-c-helper-text .pf-v5-c-button.pf-m-link {
-      color: var(--hk-cyan) !important;
-      font-family: var(--hk-font) !important;
-      font-size: 0.8rem !important;
-    }
-
-    /* -- Select auth list (Try another way options) -------------------------- */
-    .select-auth-container {
-      background: var(--hk-panel) !important;
-      font-family: var(--hk-font) !important;
-    }
-
-    .pf-v5-c-data-list__item {
-      border-color: var(--hk-border) !important;
-      background: transparent !important;
-    }
-
-    .pf-v5-c-data-list__item:hover {
-      background: var(--hk-green-glow) !important;
-    }
-
-    .select-auth-box-headline {
-      color: var(--hk-green) !important;
-    }
-
-    .select-auth-box-desc {
-      color: var(--hk-text-dim) !important;
-    }
-
-    /* -- Footer -------------------------------------------------------------- */
-    .pf-v5-c-login__main-footer-band {
-      background: transparent !important;
-      border-top: 1px solid var(--hk-border) !important;
-    }
-
-    /* -- Language selector --------------------------------------------------- */
-    select#login-select-toggle {
-      background: var(--hk-input-bg) !important;
-      color: var(--hk-green) !important;
-      border-color: var(--hk-border) !important;
-      font-family: var(--hk-font) !important;
-    }
-
-    /* -- Blinking cursor animation for header -------------------------------- */
-    @keyframes blink {
-      0%, 100% { opacity: 1; }
-      50% { opacity: 0; }
-    }
-
-    #kc-header-wrapper::after {
-      content: '_';
-      animation: blink 1s step-end infinite;
-      color: var(--hk-green);
-    }
-
-    /* -- Subtle CRT flicker ------------------------------------------------- */
-    @keyframes flicker {
-      0% { opacity: 0.97; }
-      5% { opacity: 0.95; }
-      10% { opacity: 0.98; }
-      15% { opacity: 0.96; }
-      20% { opacity: 0.99; }
-      100% { opacity: 0.98; }
-    }
-
-    .pf-v5-c-login__main {
-      animation: flicker 4s infinite;
-    }
@@ -1,15 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - app.yaml
-  - external-secrets.yaml
-  - hacker-theme-configmap.yaml
-
-helmCharts:
-  - name: keycloakx
-    repo: https://codecentric.github.io/helm-charts
-    version: 7.1.11
-    releaseName: keycloak
-    namespace: keycloak
-    valuesFile: values.yaml
@@ -1,353 +0,0 @@
-/* ============================================================
-   HEXOR — Hacker Terminal Theme for Keycloak
-   ============================================================ */
-
-@import url('https://fonts.googleapis.com/css2?family=Fira+Code:wght@400;600&display=swap');
-
-:root {
-  --hk-bg: #0a0a0a;
-  --hk-panel: #0d0d0d;
-  --hk-border: #00ff4180;
-  --hk-green: #00ff41;
-  --hk-green-dim: #00cc33;
-  --hk-green-glow: rgba(0, 255, 65, 0.15);
-  --hk-green-glow-strong: rgba(0, 255, 65, 0.35);
-  --hk-cyan: #00e5ff;
-  --hk-red: #ff3333;
-  --hk-text: #b0ffb0;
-  --hk-text-dim: #5a8a5a;
-  --hk-input-bg: #050505;
-  --hk-font: 'Fira Code', 'Cascadia Code', 'JetBrains Mono', monospace;
-}
-
-/* -- Force dark always --------------------------------------------------- */
-html.login-pf,
-html.login-pf.pf-v5-theme-dark {
-  color-scheme: dark;
-}
-
-/* -- Background: scanlines + CRT ---------------------------------------- */
-body#keycloak-bg {
-  font-family: var(--hk-font) !important;
-  background: var(--hk-bg) !important;
-  color: var(--hk-text) !important;
-  min-height: 100vh;
-  position: relative;
-}
-
-body#keycloak-bg::before {
-  content: '';
-  position: fixed;
-  inset: 0;
-  background: repeating-linear-gradient(
-    0deg,
-    transparent,
-    transparent 2px,
-    rgba(0, 255, 65, 0.03) 2px,
-    rgba(0, 255, 65, 0.03) 4px
-  );
-  pointer-events: none;
-  z-index: 9999;
-}
-
-/* -- Login container ----------------------------------------------------- */
-.pf-v5-c-login {
-  background: transparent !important;
-}
-
-.pf-v5-c-login__container {
-  max-width: 480px !important;
-}
-
-/* -- Header / Brand ------------------------------------------------------ */
-#kc-header-wrapper {
-  font-family: var(--hk-font) !important;
-  color: var(--hk-green) !important;
-  text-shadow: 0 0 10px var(--hk-green), 0 0 30px var(--hk-green-glow);
-  font-size: 1.5rem !important;
-  letter-spacing: 0.15em;
-  text-transform: uppercase;
-}
-
-#kc-header-wrapper .kc-logo-text span::before {
-  content: '> ';
-  opacity: 0.6;
-}
-
-/* -- Main card ----------------------------------------------------------- */
-.pf-v5-c-login__main {
-  background: var(--hk-panel) !important;
-  border: 1px solid var(--hk-border) !important;
-  border-radius: 0 !important;
-  box-shadow:
-    0 0 15px var(--hk-green-glow),
-    inset 0 0 30px rgba(0, 0, 0, 0.5) !important;
-}
-
-/* -- Title --------------------------------------------------------------- */
-h1#kc-page-title,
-.pf-v5-c-title {
-  font-family: var(--hk-font) !important;
-  color: var(--hk-green) !important;
-  text-shadow: 0 0 8px var(--hk-green-glow);
-  font-weight: 600 !important;
-  font-size: 1.25rem !important;
-  letter-spacing: 0.05em;
-}
-
-/* -- Labels -------------------------------------------------------------- */
-.pf-v5-c-form__label-text {
-  font-family: var(--hk-font) !important;
-  color: var(--hk-green-dim) !important;
-  font-size: 0.85rem !important;
-  text-transform: uppercase;
-  letter-spacing: 0.08em;
-}
-
-/* -- Input fields -------------------------------------------------------- */
-.pf-v5-c-form-control {
-  background-color: var(--hk-input-bg) !important;
-  border: 1px solid var(--hk-border) !important;
-  border-radius: 0 !important;
-  color: var(--hk-green) !important;
-  font-family: var(--hk-font) !important;
-  font-size: 0.9rem !important;
-  caret-color: var(--hk-green);
-  transition: border-color 0.2s, box-shadow 0.2s;
-}
-
-.pf-v5-c-form-control:focus-within,
-.pf-v5-c-form-control:focus {
-  border-color: var(--hk-green) !important;
-  box-shadow: 0 0 8px var(--hk-green-glow), inset 0 0 4px var(--hk-green-glow) !important;
-  outline: none !important;
-}
-
-.pf-v5-c-form-control input {
-  color: var(--hk-green) !important;
-  font-family: var(--hk-font) !important;
-}
-
-.pf-v5-c-form-control input::placeholder {
-  color: var(--hk-text-dim) !important;
-}
-
-/* -- Primary button (Sign In) -------------------------------------------- */
-.pf-v5-c-button.pf-m-primary {
-  background: transparent !important;
-  border: 1px solid var(--hk-green) !important;
-  border-radius: 0 !important;
-  color: var(--hk-green) !important;
-  font-family: var(--hk-font) !important;
-  font-weight: 600 !important;
-  text-transform: uppercase;
-  letter-spacing: 0.12em;
-  font-size: 0.9rem !important;
-  transition: all 0.2s;
-  position: relative;
-  overflow: hidden;
-}
-
-.pf-v5-c-button.pf-m-primary:hover {
-  background: var(--hk-green-glow) !important;
-  box-shadow: 0 0 15px var(--hk-green-glow-strong), inset 0 0 15px var(--hk-green-glow) !important;
-  color: #fff !important;
-  text-shadow: 0 0 5px var(--hk-green);
-}
-
-/* -- Secondary button (Try Another Way, Passkey) ------------------------- */
-.pf-v5-c-button.pf-m-secondary {
-  background: transparent !important;
-  border: 1px solid var(--hk-cyan) !important;
-  border-radius: 0 !important;
-  color: var(--hk-cyan) !important;
-  font-family: var(--hk-font) !important;
-  text-transform: uppercase;
-  letter-spacing: 0.1em;
-  font-size: 0.85rem !important;
-  transition: all 0.2s;
-}
-
-.pf-v5-c-button.pf-m-secondary:hover {
-  background: rgba(0, 229, 255, 0.1) !important;
-  box-shadow: 0 0 12px rgba(0, 229, 255, 0.3) !important;
-  color: #fff !important;
-}
-
-/* -- Passkey authenticate button ----------------------------------------- */
-#authenticateWebAuthnButton {
-  background: transparent !important;
-  border: 1px solid var(--hk-cyan) !important;
-  border-radius: 0 !important;
-  color: var(--hk-cyan) !important;
-  font-family: var(--hk-font) !important;
-  text-transform: uppercase;
-  letter-spacing: 0.1em;
-  font-size: 0.85rem !important;
-  padding: 0.75rem 1rem;
-  display: block;
-  width: 100%;
-  text-align: center;
-  text-decoration: none;
-  transition: all 0.2s;
-  margin-top: 1rem;
-}
-
-#authenticateWebAuthnButton::before {
-  content: '\f084  ';
-  font-family: 'Font Awesome 6 Free', 'FontAwesome';
-  font-weight: 900;
-}
-
-#authenticateWebAuthnButton:hover {
-  background: rgba(0, 229, 255, 0.1) !important;
-  box-shadow: 0 0 15px rgba(0, 229, 255, 0.3), inset 0 0 10px rgba(0, 229, 255, 0.1) !important;
-  color: #fff !important;
-  text-shadow: 0 0 5px var(--hk-cyan);
-}
-
-/* -- Show password button ------------------------------------------------ */
-.pf-v5-c-button.pf-m-control {
-  background: var(--hk-input-bg) !important;
-  border: 1px solid var(--hk-border) !important;
-  border-left: none !important;
-  border-radius: 0 !important;
-  color: var(--hk-text-dim) !important;
-}
-
-.pf-v5-c-button.pf-m-control:hover {
-  color: var(--hk-green) !important;
-}
-
-/* -- Social providers (Google, etc) -------------------------------------- */
-.pf-v5-c-login__main-footer {
-  border-top: 1px solid var(--hk-border) !important;
-}
-
-.kc-social-section .pf-v5-c-button.pf-m-secondary {
-  border-color: var(--hk-text-dim) !important;
-  color: var(--hk-text) !important;
-}
-
-.kc-social-section .pf-v5-c-button.pf-m-secondary:hover {
-  border-color: var(--hk-green) !important;
-  color: var(--hk-green) !important;
-  box-shadow: 0 0 10px var(--hk-green-glow) !important;
-}
-
-/* -- Try another way link ------------------------------------------------ */
-#try-another-way {
-  color: var(--hk-cyan) !important;
-  text-decoration: none !important;
-  font-family: var(--hk-font) !important;
-}
-
-#try-another-way:hover {
-  text-shadow: 0 0 8px rgba(0, 229, 255, 0.5);
-}
-
-/* -- Links --------------------------------------------------------------- */
-a {
-  color: var(--hk-cyan) !important;
-  text-decoration: none;
-  transition: text-shadow 0.2s;
-}
-
-a:hover {
-  text-shadow: 0 0 6px rgba(0, 229, 255, 0.4);
-}
-
-/* -- Alerts / messages --------------------------------------------------- */
-.pf-v5-c-alert {
-  background: rgba(0, 255, 65, 0.05) !important;
-  border: 1px solid var(--hk-border) !important;
-  border-radius: 0 !important;
-  font-family: var(--hk-font) !important;
-}
-
-.pf-v5-c-alert.pf-m-danger {
-  border-color: var(--hk-red) !important;
-  background: rgba(255, 51, 51, 0.05) !important;
-}
-
-.pf-v5-c-alert__title {
-  color: var(--hk-text) !important;
-  font-family: var(--hk-font) !important;
-}
-
-/* -- Checkbox (Remember me) ---------------------------------------------- */
-.pf-v5-c-check__label {
-  color: var(--hk-text-dim) !important;
-  font-family: var(--hk-font) !important;
-  font-size: 0.8rem !important;
-}
-
-/* -- Helper text (Forgot password, etc.) --------------------------------- */
-.pf-v5-c-helper-text .pf-v5-c-button.pf-m-link {
-  color: var(--hk-cyan) !important;
-  font-family: var(--hk-font) !important;
-  font-size: 0.8rem !important;
-}
-
-/* -- Select auth list (Try another way options) -------------------------- */
-.select-auth-container {
-  background: var(--hk-panel) !important;
-  font-family: var(--hk-font) !important;
-}
-
-.pf-v5-c-data-list__item {
-  border-color: var(--hk-border) !important;
-  background: transparent !important;
-}
-
-.pf-v5-c-data-list__item:hover {
-  background: var(--hk-green-glow) !important;
-}
-
-.select-auth-box-headline {
-  color: var(--hk-green) !important;
-}
-
-.select-auth-box-desc {
-  color: var(--hk-text-dim) !important;
-}
-
-/* -- Footer -------------------------------------------------------------- */
-.pf-v5-c-login__main-footer-band {
-  background: transparent !important;
-  border-top: 1px solid var(--hk-border) !important;
-}
-
-/* -- Language selector --------------------------------------------------- */
-select#login-select-toggle {
-  background: var(--hk-input-bg) !important;
-  color: var(--hk-green) !important;
-  border-color: var(--hk-border) !important;
-  font-family: var(--hk-font) !important;
-}
-
-/* -- Blinking cursor animation for header -------------------------------- */
-@keyframes blink {
-  0%, 100% { opacity: 1; }
-  50% { opacity: 0; }
-}
-
-#kc-header-wrapper::after {
-  content: '_';
-  animation: blink 1s step-end infinite;
-  color: var(--hk-green);
-}
-
-/* -- Subtle CRT flicker ------------------------------------------------- */
-@keyframes flicker {
-  0% { opacity: 0.97; }
-  5% { opacity: 0.95; }
-  10% { opacity: 0.98; }
-  15% { opacity: 0.96; }
-  20% { opacity: 0.99; }
-  100% { opacity: 0.98; }
-}
-
-.pf-v5-c-login__main {
-  animation: flicker 4s infinite;
-}
@@ -1,4 +0,0 @@
-parent=keycloak.v2
-import=common/keycloak
-
-styles=css/hacker.css
@@ -1,80 +0,0 @@
-replicas: 1
-
-image:
-  repository: quay.io/keycloak/keycloak
-  tag: "26.5.6"
-
-command:
-  - "/opt/keycloak/bin/kc.sh"
-  - "start"
-  - "--http-port=8080"
-  - "--hostname-strict=false"
-  - "--proxy-headers=xforwarded"
-
-extraEnvFrom: |
-  - secretRef:
-      name: keycloak-creds
-
-extraEnv: |
-  - name: KC_HOSTNAME
-    value: auth.hexor.cy
-  - name: JAVA_OPTS_APPEND
-    value: "-Djgroups.dns.query=keycloak-headless.keycloak.svc"
-
-extraVolumes: |
-  - name: hacker-theme
-    configMap:
-      name: keycloak-hacker-theme
-
-extraVolumeMounts: |
-  - name: hacker-theme
-    mountPath: /opt/keycloak/themes/hacker/login/theme.properties
-    subPath: theme.properties
-  - name: hacker-theme
-    mountPath: /opt/keycloak/themes/hacker/login/css/hacker.css
-    subPath: hacker.css
-
-dbchecker:
-  enabled: true
-
-database:
-  vendor: postgres
-  hostname: psql.psql.svc
-  port: 5432
-  database: keycloak
-  existingSecret: keycloak-creds
-  existingSecretKey: KC_DB_PASSWORD
-
-service:
-  type: ClusterIP
-
-ingress:
-  enabled: true
-  ingressClassName: traefik
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
-  rules:
-    - host: auth.hexor.cy
-      paths:
-        - path: /
-          pathType: Prefix
-  tls:
-    - secretName: keycloak-tls
-      hosts:
-        - auth.hexor.cy
-
-resources:
-  requests:
-    cpu: 200m
-    memory: 512Mi
-  limits:
-    cpu: "1"
-    memory: 1Gi
-
-nodeSelector:
-  kubernetes.io/hostname: master.tail2fe2d.ts.net
-
-tolerations:
-  - key: node-role.kubernetes.io/master
-    effect: NoSchedule
@@ -1,10 +0,0 @@
---
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: https-redirect
-  namespace: kube-system
-spec:
-  redirectScheme:
-    scheme: https
-    permanent: true
@@ -5,7 +5,6 @@ resources:
  - app.yaml
  - nfs-storage.yaml
  - coredns-internal-resolve.yaml
-  - https-middleware.yaml

 helmCharts:
  - name: csi-driver-nfs
@@ -17,23 +17,20 @@ spec:
        PGADMIN_CONFIG_OAUTH2_CONFIG: |-
          [
            {
-                'OAUTH2_NAME': 'Keycloak',
-                'OAUTH2_DISPLAY_NAME': 'Keycloak',
-                'OAUTH2_CLIENT_ID': '{{ .client_id }}',
-                'OAUTH2_CLIENT_SECRET': '{{ .client_secret }}',
-                
-                'OAUTH2_TOKEN_URL': '{{ .keycloak_url }}/auth/realms/hexor/protocol/openid-connect/token',
-                'OAUTH2_AUTHORIZATION_URL': '{{ .keycloak_url }}/auth/realms/hexor/protocol/openid-connect/auth',
-                'OAUTH2_SERVER_METADATA_URL': '{{ .keycloak_url }}/auth/realms/hexor/.well-known/openid-configuration',
-                'OAUTH2_API_BASE_URL': '{{ .keycloak_url }}',
-                'OAUTH2_USERINFO_ENDPOINT': '{{ .keycloak_url }}/auth/realms/hexor/protocol/openid-connect/userinfo',
-                
-                'OAUTH2_SCOPE': 'openid profile email',
-                'OAUTH2_USERNAME_CLAIM': 'email',
-                'OAUTH2_BUTTON_COLOR': '#000000',
-                'OAUTH2_SSL_CERT_VERIFICATION': False,
-                
-                'OAUTH2_LOGOUT_URL': '{{ .keycloak_url }}/auth/realms/hexor/protocol/openid-connect/logout',
+              'OAUTH2_NAME': 'Authentik',
+              'OAUTH2_DISPLAY_NAME': 'Authentik',
+              'OAUTH2_CLIENT_ID': '{{ .client_id }}',
+              'OAUTH2_CLIENT_SECRET': '{{ .client_secret }}',
+              'OAUTH2_TOKEN_URL': '{{ .pgadmin_url }}/application/o/token/',
+              'OAUTH2_AUTHORIZATION_URL': '{{ .pgadmin_url }}/application/o/authorize/',
+              'OAUTH2_SERVER_METADATA_URL': '{{ .pgadmin_url }}/application/o/pgadmin/.well-known/openid-configuration',
+              'OAUTH2_API_BASE_URL': '{{ .pgadmin_url }}',
+              'OAUTH2_USERINFO_ENDPOINT': '{{ .pgadmin_url }}/application/o/userinfo/',
+              'OAUTH2_SCOPE': 'openid profile email',
+              'OAUTH2_USERNAME_CLAIM': 'email',
+              'OAUTH2_BUTTON_COLOR': '#000000',
+              'OAUTH2_SSL_CERT_VERIFICATION': False,
+              'OAUTH2_LOGOUT_URL': '{{ .pgadmin_url }}/application/o/pgadmin/end-session/'
            }
          ]
  data:
@@ -81,7 +78,7 @@ spec:
        metadataPolicy: None
        key: 832042b9-7edb-4f4c-9254-3c8884ba9733
        property: fields[1].value
-    - secretKey: keycloak_url
+    - secretKey: pgadmin_url
      sourceRef:
        storeRef:
          name: vaultwarden-login
@@ -130,16 +127,6 @@ spec:
          {{ .mmdl }}
        USER_n8n: |-
          {{ .n8n }}
-        USER_synapse: |-
-          {{ .synapse }}
-        USER_mas: |-
-          {{ .mas }}
-        USER_furumi: |-
-          {{ .furumi }}
-        USER_furumi_dev: |-
-          {{ .furumi_dev }}
-        USER_keycloak: |-
-          {{ .keycloak }}
  data:
    - secretKey: authentik
      sourceRef:
@@ -284,58 +271,4 @@ spec:
        metadataPolicy: None
        key: 2a9deb39-ef22-433e-a1be-df1555625e22
        property: fields[13].value
-    - secretKey: synapse
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        metadataPolicy: None
-        key: 2a9deb39-ef22-433e-a1be-df1555625e22
-        property: fields[14].value
-    - secretKey: mas
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        metadataPolicy: None
-        key: 2a9deb39-ef22-433e-a1be-df1555625e22
-        property: fields[15].value
-    - secretKey: furumi
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        metadataPolicy: None
-        key: 2a9deb39-ef22-433e-a1be-df1555625e22
-        property: fields[16].value
-    - secretKey: furumi_dev
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        metadataPolicy: None
-        key: 2a9deb39-ef22-433e-a1be-df1555625e22
-        property: fields[17].value
-    - secretKey: keycloak
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        conversionStrategy: Default
-        decodingStrategy: None
-        metadataPolicy: None
-        key: 2a9deb39-ef22-433e-a1be-df1555625e22
-        property: fields[18].value
+
@@ -1,367 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: auth-proxy-dashboard
-  labels:
-    grafana_dashboard: "1"
-data:
-  auth-proxy.json: |-
-    {
-      "annotations": {
-        "list": [
-          {
-            "builtIn": 1,
-            "datasource": {
-              "type": "grafana",
-              "uid": "-- Grafana --"
-            },
-            "enable": true,
-            "hide": true,
-            "iconColor": "rgba(0, 211, 255, 1)",
-            "name": "Annotations & Alerts",
-            "type": "dashboard"
-          }
-        ]
-      },
-      "editable": true,
-      "fiscalYearStartMonth": 0,
-      "graphTooltip": 1,
-      "id": null,
-      "links": [],
-      "liveNow": false,
-      "panels": [
-        {
-          "gridPos": { "h": 4, "w": 6, "x": 0, "y": 0 },
-          "id": 1,
-          "options": {
-            "colorMode": "value",
-            "graphMode": "area",
-            "justifyMode": "auto",
-            "orientation": "auto",
-            "reduceOptions": { "calc": "lastNotNull", "fields": "", "values": false },
-            "textMode": "auto"
-          },
-          "pluginVersion": "10.0.0",
-          "targets": [
-            {
-              "datasource": { "type": "prometheus", "uid": "${datasource}" },
-              "expr": "routes_loaded_total",
-              "refId": "A"
-            }
-          ],
-          "title": "Loaded Routes",
-          "type": "stat"
-        },
-        {
-          "gridPos": { "h": 4, "w": 6, "x": 6, "y": 0 },
-          "id": 2,
-          "options": {
-            "colorMode": "value",
-            "graphMode": "area",
-            "justifyMode": "auto",
-            "orientation": "auto",
-            "reduceOptions": { "calc": "lastNotNull", "fields": "", "values": false },
-            "textMode": "auto"
-          },
-          "pluginVersion": "10.0.0",
-          "targets": [
-            {
-              "datasource": { "type": "prometheus", "uid": "${datasource}" },
-              "expr": "sum(increase(auth_requests_total[$__rate_interval]))",
-              "refId": "A"
-            }
-          ],
-          "title": "Auth Requests (total)",
-          "type": "stat",
-          "fieldConfig": {
-            "defaults": {
-              "color": { "mode": "thresholds" },
-              "mappings": [],
-              "thresholds": {
-                "mode": "absolute",
-                "steps": [
-                  { "color": "green", "value": null }
-                ]
-              }
-            },
-            "overrides": []
-          }
-        },
-        {
-          "gridPos": { "h": 4, "w": 6, "x": 12, "y": 0 },
-          "id": 3,
-          "options": {
-            "colorMode": "value",
-            "graphMode": "area",
-            "justifyMode": "auto",
-            "orientation": "auto",
-            "reduceOptions": { "calc": "lastNotNull", "fields": "", "values": false },
-            "textMode": "auto"
-          },
-          "pluginVersion": "10.0.0",
-          "targets": [
-            {
-              "datasource": { "type": "prometheus", "uid": "${datasource}" },
-              "expr": "sum(increase(auth_requests_total{status=\"403\"}[$__rate_interval]))",
-              "refId": "A"
-            }
-          ],
-          "title": "Forbidden (403)",
-          "type": "stat",
-          "fieldConfig": {
-            "defaults": {
-              "color": { "mode": "thresholds" },
-              "mappings": [],
-              "thresholds": {
-                "mode": "absolute",
-                "steps": [
-                  { "color": "green", "value": null },
-                  { "color": "red", "value": 1 }
-                ]
-              }
-            },
-            "overrides": []
-          }
-        },
-        {
-          "gridPos": { "h": 4, "w": 6, "x": 18, "y": 0 },
-          "id": 4,
-          "options": {
-            "colorMode": "value",
-            "graphMode": "area",
-            "justifyMode": "auto",
-            "orientation": "auto",
-            "reduceOptions": { "calc": "lastNotNull", "fields": "", "values": false },
-            "textMode": "auto"
-          },
-          "pluginVersion": "10.0.0",
-          "targets": [
-            {
-              "datasource": { "type": "prometheus", "uid": "${datasource}" },
-              "expr": "sum(increase(callback_requests_total{result=\"success\"}[$__rate_interval]))",
-              "refId": "A"
-            }
-          ],
-          "title": "Successful Logins",
-          "type": "stat",
-          "fieldConfig": {
-            "defaults": {
-              "color": { "mode": "thresholds" },
-              "mappings": [],
-              "thresholds": {
-                "mode": "absolute",
-                "steps": [
-                  { "color": "green", "value": null }
-                ]
-              }
-            },
-            "overrides": []
-          }
-        },
-        {
-          "gridPos": { "h": 8, "w": 12, "x": 0, "y": 4 },
-          "id": 5,
-          "options": {
-            "legend": { "calcs": [], "displayMode": "list", "placement": "bottom", "showLegend": true },
-            "tooltip": { "mode": "single", "sort": "none" }
-          },
-          "pluginVersion": "10.0.0",
-          "targets": [
-            {
-              "datasource": { "type": "prometheus", "uid": "${datasource}" },
-              "expr": "sum by (status) (rate(auth_requests_total[$__rate_interval]))",
-              "legendFormat": "{{status}}",
-              "refId": "A"
-            }
-          ],
-          "title": "Auth Request Rate by Status",
-          "type": "timeseries",
-          "fieldConfig": {
-            "defaults": {
-              "color": { "mode": "palette-classic" },
-              "custom": {
-                "axisBorderShow": false,
-                "axisCenteredZero": false,
-                "axisColorMode": "text",
-                "axisLabel": "",
-                "axisPlacement": "auto",
-                "barAlignment": 0,
-                "drawStyle": "line",
-                "fillOpacity": 10,
-                "gradientMode": "none",
-                "hideFrom": { "legend": false, "tooltip": false, "viz": false },
-                "insertNulls": false,
-                "lineInterpolation": "linear",
-                "lineWidth": 2,
-                "pointSize": 5,
-                "scaleDistribution": { "type": "linear" },
-                "showPoints": "auto",
-                "spanNulls": false,
-                "stacking": { "group": "A", "mode": "none" },
-                "thresholdsStyle": { "mode": "off" }
-              },
-              "mappings": [],
-              "thresholds": {
-                "mode": "absolute",
-                "steps": [ { "color": "green", "value": null } ]
-              },
-              "unit": "reqps"
-            },
-            "overrides": []
-          }
-        },
-        {
-          "gridPos": { "h": 8, "w": 12, "x": 12, "y": 4 },
-          "id": 6,
-          "options": {
-            "legend": { "calcs": [], "displayMode": "list", "placement": "bottom", "showLegend": true },
-            "tooltip": { "mode": "single", "sort": "none" }
-          },
-          "pluginVersion": "10.0.0",
-          "targets": [
-            {
-              "datasource": { "type": "prometheus", "uid": "${datasource}" },
-              "expr": "auth_request_duration_seconds{quantile=\"0.5\"}",
-              "legendFormat": "p50",
-              "refId": "A"
-            },
-            {
-              "datasource": { "type": "prometheus", "uid": "${datasource}" },
-              "expr": "auth_request_duration_seconds{quantile=\"0.95\"}",
-              "legendFormat": "p95",
-              "refId": "B"
-            },
-            {
-              "datasource": { "type": "prometheus", "uid": "${datasource}" },
-              "expr": "auth_request_duration_seconds{quantile=\"0.99\"}",
-              "legendFormat": "p99",
-              "refId": "C"
-            }
-          ],
-          "title": "Auth Request Duration (p50, p95, p99)",
-          "type": "timeseries",
-          "fieldConfig": {
-            "defaults": {
-              "color": { "mode": "palette-classic" },
-              "custom": {
-                "axisBorderShow": false,
-                "axisCenteredZero": false,
-                "axisColorMode": "text",
-                "axisLabel": "",
-                "axisPlacement": "auto",
-                "barAlignment": 0,
-                "drawStyle": "line",
-                "fillOpacity": 0,
-                "gradientMode": "none",
-                "hideFrom": { "legend": false, "tooltip": false, "viz": false },
-                "insertNulls": false,
-                "lineInterpolation": "linear",
-                "lineWidth": 2,
-                "pointSize": 5,
-                "scaleDistribution": { "type": "linear" },
-                "showPoints": "auto",
-                "spanNulls": false,
-                "stacking": { "group": "A", "mode": "none" },
-                "thresholdsStyle": { "mode": "off" }
-              },
-              "mappings": [],
-              "thresholds": {
-                "mode": "absolute",
-                "steps": [ { "color": "green", "value": null } ]
-              },
-              "unit": "s"
-            },
-            "overrides": []
-          }
-        },
-        {
-          "gridPos": { "h": 8, "w": 12, "x": 0, "y": 12 },
-          "id": 7,
-          "options": {
-            "legend": { "calcs": [], "displayMode": "list", "placement": "bottom", "showLegend": true },
-            "tooltip": { "mode": "single", "sort": "none" }
-          },
-          "pluginVersion": "10.0.0",
-          "targets": [
-            {
-              "datasource": { "type": "prometheus", "uid": "${datasource}" },
-              "expr": "sum by (result) (rate(callback_requests_total[$__rate_interval]))",
-              "legendFormat": "{{result}}",
-              "refId": "A"
-            }
-          ],
-          "title": "OIDC Callback Rate by Result",
-          "type": "timeseries",
-          "fieldConfig": {
-            "defaults": {
-              "color": { "mode": "palette-classic" },
-              "custom": {
-                "axisBorderShow": false,
-                "axisCenteredZero": false,
-                "axisColorMode": "text",
-                "axisLabel": "",
-                "axisPlacement": "auto",
-                "barAlignment": 0,
-                "drawStyle": "bars",
-                "fillOpacity": 50,
-                "gradientMode": "none",
-                "hideFrom": { "legend": false, "tooltip": false, "viz": false },
-                "insertNulls": false,
-                "lineInterpolation": "linear",
-                "lineWidth": 1,
-                "pointSize": 5,
-                "scaleDistribution": { "type": "linear" },
-                "showPoints": "auto",
-                "spanNulls": false,
-                "stacking": { "group": "A", "mode": "normal" },
-                "thresholdsStyle": { "mode": "off" }
-              },
-              "mappings": [],
-              "thresholds": {
-                "mode": "absolute",
-                "steps": [ { "color": "green", "value": null } ]
-              },
-              "unit": "reqps"
-            },
-            "overrides": []
-          }
-        }
-      ],
-      "refresh": "30s",
-      "schemaVersion": 38,
-      "style": "dark",
-      "tags": [
-        "auth-proxy",
-        "rsauth2-proxy"
-      ],
-      "templating": {
-        "list": [
-          {
-            "current": {
-              "selected": false,
-              "text": "Prometheus",
-              "value": "Prometheus"
-            },
-            "hide": 0,
-            "includeAll": false,
-            "multi": false,
-            "name": "datasource",
-            "options": [],
-            "query": "prometheus",
-            "refresh": 1,
-            "regex": "",
-            "skipUrlSync": false,
-            "type": "datasource"
-          }
-        ]
-      },
-      "time": {
-        "from": "now-1h",
-        "to": "now"
-      },
-      "timepicker": {},
-      "timezone": "",
-      "title": "Auth Proxy (rsauth2-proxy)",
-      "uid": "auth-proxy-metrics",
-      "version": 1
-    }
@@ -1,647 +0,0 @@
-{
-  "annotations": {
-    "list": [
-      {
-        "builtIn": 1,
-        "datasource": {
-          "type": "grafana",
-          "uid": "-- Grafana --"
-        },
-        "enable": true,
-        "hide": true,
-        "iconColor": "rgba(0, 211, 255, 1)",
-        "name": "Annotations & Alerts",
-        "type": "dashboard"
-      }
-    ]
-  },
-  "editable": true,
-  "fiscalYearStartMonth": 0,
-  "graphTooltip": 0,
-  "id": null,
-  "links": [],
-  "liveNow": false,
-  "panels": [
-    {
-      "gridPos": {
-        "h": 4,
-        "w": 6,
-        "x": 0,
-        "y": 0
-      },
-      "id": 1,
-      "options": {
-        "colorMode": "value",
-        "graphMode": "area",
-        "justifyMode": "auto",
-        "orientation": "auto",
-        "reduceOptions": {
-          "calc": "lastNotNull",
-          "fields": "",
-          "values": false
-        },
-        "textMode": "auto"
-      },
-      "pluginVersion": "10.0.0",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${datasource}"
-          },
-          "expr": "furumi_active_streams",
-          "refId": "A"
-        }
-      ],
-      "title": "Active Streams",
-      "type": "stat"
-    },
-    {
-      "gridPos": {
-        "h": 4,
-        "w": 6,
-        "x": 6,
-        "y": 0
-      },
-      "id": 2,
-      "options": {
-        "colorMode": "value",
-        "graphMode": "area",
-        "justifyMode": "auto",
-        "orientation": "auto",
-        "reduceOptions": {
-          "calc": "rate",
-          "fields": "",
-          "values": false
-        },
-        "textMode": "auto"
-      },
-      "pluginVersion": "10.0.0",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${datasource}"
-          },
-          "expr": "rate(furumi_bytes_read_total[$__rate_interval])",
-          "refId": "A"
-        }
-      ],
-      "title": "Bytes Read / Sec",
-      "type": "stat",
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "custom": {
-            "axisBorderShow": false,
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "drawStyle": "line",
-            "fillOpacity": 0,
-            "gradientMode": "none",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
-            "lineInterpolation": "linear",
-            "lineWidth": 1,
-            "pointSize": 5,
-            "scaleDistribution": {
-              "type": "linear"
-            },
-            "showPoints": "auto",
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-            "thresholdsStyle": {
-              "mode": "off"
-            }
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              }
-            ]
-          },
-          "unit": "Bps"
-        },
-        "overrides": []
-      }
-    },
-    {
-      "gridPos": {
-        "h": 4,
-        "w": 6,
-        "x": 12,
-        "y": 0
-      },
-      "id": 3,
-      "options": {
-        "colorMode": "value",
-        "graphMode": "area",
-        "justifyMode": "auto",
-        "orientation": "auto",
-        "reduceOptions": {
-          "calc": "lastNotNull",
-          "fields": "",
-          "values": false
-        },
-        "textMode": "auto"
-      },
-      "pluginVersion": "10.0.0",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${datasource}"
-          },
-          "expr": "sum(increase(furumi_file_open_errors_total[$__rate_interval]))",
-          "refId": "A"
-        }
-      ],
-      "title": "File Open Errors (Rate)",
-      "type": "stat",
-       "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "thresholds"
-          },
-          "mappings": [],
-          "thresholds": {
-             "mode": "absolute",
-             "steps": [
-               { "color": "green", "value": null },
-               { "color": "red", "value": 1 }
-             ]
-           }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "gridPos": {
-        "h": 4,
-        "w": 6,
-        "x": 18,
-        "y": 0
-      },
-      "id": 4,
-      "options": {
-        "colorMode": "value",
-        "graphMode": "area",
-        "justifyMode": "auto",
-        "orientation": "auto",
-        "reduceOptions": {
-          "calc": "lastNotNull",
-          "fields": "",
-          "values": false
-        },
-        "textMode": "auto"
-      },
-      "pluginVersion": "10.0.0",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${datasource}"
-          },
-          "expr": "sum(increase(furumi_auth_failures_total[$__rate_interval]))",
-          "refId": "A"
-        }
-      ],
-      "title": "Auth Failures (Rate)",
-      "type": "stat",
-       "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "thresholds"
-          },
-          "mappings": [],
-          "thresholds": {
-             "mode": "absolute",
-             "steps": [
-               { "color": "green", "value": null },
-               { "color": "red", "value": 1 }
-             ]
-           }
-        },
-        "overrides": []
-      }
-    },
-    {
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 4
-      },
-      "id": 5,
-      "options": {
-        "legend": {
-          "calcs": [],
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": true
-        },
-        "tooltip": {
-          "mode": "single",
-          "sort": "none"
-        }
-      },
-      "pluginVersion": "10.0.0",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${datasource}"
-          },
-          "expr": "sum by (method, status) (rate(furumi_grpc_requests_total[$__rate_interval]))",
-          "legendFormat": "{{method}} - {{status}}",
-          "refId": "A"
-        }
-      ],
-      "title": "gRPC Request Rate by Method & Status",
-      "type": "timeseries",
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "custom": {
-            "axisBorderShow": false,
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "drawStyle": "line",
-            "fillOpacity": 10,
-            "gradientMode": "none",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
-            "lineInterpolation": "linear",
-            "lineWidth": 2,
-            "pointSize": 5,
-            "scaleDistribution": {
-              "type": "linear"
-            },
-            "showPoints": "auto",
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-            "thresholdsStyle": {
-              "mode": "off"
-            }
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              }
-            ]
-          },
-          "unit": "reqps"
-        },
-        "overrides": []
-      }
-    },
-    {
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 4
-      },
-      "id": 6,
-      "options": {
-        "legend": {
-          "calcs": [],
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": true
-        },
-        "tooltip": {
-          "mode": "single",
-          "sort": "none"
-        }
-      },
-      "pluginVersion": "10.0.0",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${datasource}"
-          },
-          "expr": "histogram_quantile(0.95, sum(rate(furumi_grpc_request_duration_seconds_bucket[$__rate_interval])) by (le, method))",
-          "legendFormat": "p95 {{method}}",
-          "refId": "A"
-        },
-         {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${datasource}"
-          },
-          "expr": "histogram_quantile(0.99, sum(rate(furumi_grpc_request_duration_seconds_bucket[$__rate_interval])) by (le, method))",
-          "legendFormat": "p99 {{method}}",
-          "refId": "B"
-        }
-      ],
-      "title": "gRPC Request Duration (p95, p99)",
-      "type": "timeseries",
-      "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "custom": {
-            "axisBorderShow": false,
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "drawStyle": "line",
-            "fillOpacity": 0,
-            "gradientMode": "none",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
-            "lineInterpolation": "linear",
-            "lineWidth": 2,
-            "pointSize": 5,
-            "scaleDistribution": {
-              "type": "linear"
-            },
-            "showPoints": "auto",
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-            "thresholdsStyle": {
-              "mode": "off"
-            }
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-              {
-                "color": "green",
-                "value": null
-              }
-            ]
-          },
-          "unit": "s"
-        },
-        "overrides": []
-      }
-    },
-    {
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 0,
-        "y": 12
-      },
-      "id": 7,
-      "options": {
-        "legend": {
-          "calcs": [],
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": true
-        },
-        "tooltip": {
-          "mode": "single",
-          "sort": "none"
-        }
-      },
-      "pluginVersion": "10.0.0",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${datasource}"
-          },
-          "expr": "sum(process_resident_memory_bytes) / 1024 / 1024",
-          "legendFormat": "Resident Memory",
-          "refId": "A"
-        },
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${datasource}"
-          },
-          "expr": "sum(process_virtual_memory_bytes) / 1024 / 1024",
-          "legendFormat": "Virtual Memory",
-          "refId": "B"
-        }
-      ],
-      "title": "Process Memory Usage",
-      "type": "timeseries",
-       "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "custom": {
-            "axisBorderShow": false,
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "drawStyle": "line",
-            "fillOpacity": 15,
-            "gradientMode": "none",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
-            "lineInterpolation": "linear",
-            "lineWidth": 2,
-             "pointSize": 5,
-            "scaleDistribution": {
-              "type": "linear"
-            },
-            "showPoints": "auto",
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-            "thresholdsStyle": {
-              "mode": "off"
-            }
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-               { "color": "green", "value": null }
-            ]
-          },
-          "unit": "megbytes"
-        },
-        "overrides": []
-      }
-    },
-    {
-      "gridPos": {
-        "h": 8,
-        "w": 12,
-        "x": 12,
-        "y": 12
-      },
-      "id": 8,
-      "options": {
-        "legend": {
-          "calcs": [],
-          "displayMode": "list",
-          "placement": "bottom",
-          "showLegend": true
-        },
-        "tooltip": {
-          "mode": "single",
-          "sort": "none"
-        }
-      },
-      "pluginVersion": "10.0.0",
-      "targets": [
-        {
-          "datasource": {
-            "type": "prometheus",
-            "uid": "${datasource}"
-          },
-          "expr": "process_open_fds",
-          "legendFormat": "Open FDs",
-          "refId": "A"
-        },
-        {
-           "datasource": {
-            "type": "prometheus",
-            "uid": "${datasource}"
-          },
-          "expr": "process_max_fds",
-          "legendFormat": "Max FDs",
-          "refId": "B"
-        }
-      ],
-      "title": "Process File Descriptors",
-      "type": "timeseries",
-       "fieldConfig": {
-        "defaults": {
-          "color": {
-            "mode": "palette-classic"
-          },
-          "custom": {
-             "axisBorderShow": false,
-            "axisCenteredZero": false,
-            "axisColorMode": "text",
-            "axisLabel": "",
-            "axisPlacement": "auto",
-            "barAlignment": 0,
-            "drawStyle": "line",
-            "fillOpacity": 10,
-            "gradientMode": "none",
-            "hideFrom": {
-              "legend": false,
-              "tooltip": false,
-              "viz": false
-            },
-            "insertNulls": false,
-            "lineInterpolation": "linear",
-            "lineWidth": 2,
-            "pointSize": 5,
-            "scaleDistribution": {
-               "type": "linear"
-            },
-            "showPoints": "auto",
-            "spanNulls": false,
-            "stacking": {
-              "group": "A",
-              "mode": "none"
-            },
-             "thresholdsStyle": {
-              "mode": "off"
-             }
-          },
-          "mappings": [],
-          "thresholds": {
-            "mode": "absolute",
-            "steps": [
-               { "color": "green", "value": null }
-            ]
-          },
-          "unit": "short"
-        },
-        "overrides": []
-      }
-    }
-  ],
-  "refresh": "10s",
-  "schemaVersion": 38,
-  "style": "dark",
-  "tags": [
-    "furumi-server",
-    "grpc"
-  ],
-  "templating": {
-    "list": [
-      {
-        "current": {
-          "selected": false,
-          "text": "Prometheus",
-          "value": "Prometheus"
-        },
-        "hide": 0,
-        "includeAll": false,
-        "multi": false,
-        "name": "datasource",
-        "options": [],
-        "query": "prometheus",
-        "refresh": 1,
-        "regex": "",
-        "skipUrlSync": false,
-        "type": "datasource"
-      }
-    ]
-  },
-  "time": {
-    "from": "now-1h",
-    "to": "now"
-  },
-  "timepicker": {},
-  "timezone": "",
-  "title": "Furumi Server Metrics",
-  "uid": "furumi-metrics",
-  "version": 1
-}
@@ -1,409 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: telemt-dashboard
-  labels:
-    grafana_dashboard: "1"
-data:
-  telemt.json: |-
-    {
-      "annotations": { "list": [] },
-      "editable": true,
-      "fiscalYearStartMonth": 0,
-      "graphTooltip": 1,
-      "id": null,
-      "links": [],
-      "liveNow": false,
-      "panels": [
-        {
-          "title": "Nodes Overview",
-          "type": "table",
-          "gridPos": { "h": 8, "w": 24, "x": 0, "y": 0 },
-          "id": 1,
-          "fieldConfig": {
-            "defaults": {
-              "custom": {
-                "align": "auto",
-                "cellOptions": { "type": "auto" },
-                "inspect": false
-              },
-              "thresholds": {
-                "mode": "absolute",
-                "steps": [
-                  { "color": "green", "value": null }
-                ]
-              }
-            },
-            "overrides": [
-              {
-                "matcher": { "id": "byName", "options": "Uptime" },
-                "properties": [
-                  { "id": "unit", "value": "dtdurations" },
-                  { "id": "custom.width", "value": 140 }
-                ]
-              },
-              {
-                "matcher": { "id": "byName", "options": "Bad Conn" },
-                "properties": [
-                  { "id": "thresholds", "value": { "mode": "absolute", "steps": [{ "color": "green", "value": null }, { "color": "yellow", "value": 10 }, { "color": "red", "value": 100 }] } },
-                  { "id": "custom.cellOptions", "value": { "type": "color-background", "mode": "basic" } }
-                ]
-              },
-              {
-                "matcher": { "id": "byName", "options": "Writers" },
-                "properties": [
-                  { "id": "thresholds", "value": { "mode": "absolute", "steps": [{ "color": "red", "value": null }, { "color": "green", "value": 1 }] } },
-                  { "id": "custom.cellOptions", "value": { "type": "color-background", "mode": "basic" } }
-                ]
-              }
-            ]
-          },
-          "options": {
-            "showHeader": true,
-            "sortBy": [{ "displayName": "Node", "desc": false }],
-            "frameIndex": 0,
-            "footer": { "show": false }
-          },
-          "transformations": [
-            {
-              "id": "joinByField",
-              "options": { "byField": "node", "mode": "outer" }
-            },
-            {
-              "id": "filterFieldsByName",
-              "options": {
-                "include": { "pattern": "^(node|Value.*)$" }
-              }
-            },
-            {
-              "id": "organize",
-              "options": {
-                "renameByName": {
-                  "node": "Node",
-                  "Value #uptime": "Uptime",
-                  "Value #writers": "Writers",
-                  "Value #buffers": "Buffers In Use",
-                  "Value #connections": "Connections",
-                  "Value #bad": "Bad Conn",
-                  "Value #hs_timeout": "HS Timeouts"
-                }
-              }
-            }
-          ],
-          "targets": [
-            {
-              "expr": "telemt_uptime_seconds{node=~\"$node\"}",
-              "legendFormat": "",
-              "refId": "uptime",
-              "format": "table",
-              "instant": true
-            },
-            {
-              "expr": "telemt_me_writers_active_current{node=~\"$node\"}",
-              "legendFormat": "",
-              "refId": "writers",
-              "format": "table",
-              "instant": true
-            },
-            {
-              "expr": "telemt_buffer_pool_buffers_total{node=~\"$node\", kind=\"in_use\"}",
-              "legendFormat": "",
-              "refId": "buffers",
-              "format": "table",
-              "instant": true
-            },
-            {
-              "expr": "telemt_connections_total{node=~\"$node\"}",
-              "legendFormat": "",
-              "refId": "connections",
-              "format": "table",
-              "instant": true
-            },
-            {
-              "expr": "telemt_connections_bad_total{node=~\"$node\"}",
-              "legendFormat": "",
-              "refId": "bad",
-              "format": "table",
-              "instant": true
-            },
-            {
-              "expr": "telemt_handshake_timeouts_total{node=~\"$node\"}",
-              "legendFormat": "",
-              "refId": "hs_timeout",
-              "format": "table",
-              "instant": true
-            }
-          ],
-          "datasource": { "type": "prometheus", "uid": "${datasource}" }
-        },
-        {
-          "title": "Connections Rate",
-          "type": "timeseries",
-          "gridPos": { "h": 8, "w": 12, "x": 0, "y": 8 },
-          "id": 10,
-          "fieldConfig": {
-            "defaults": {
-              "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 15, "pointSize": 5, "showPoints": "auto" },
-              "unit": "cps",
-              "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }
-            },
-            "overrides": []
-          },
-          "options": {
-            "tooltip": { "mode": "multi", "sort": "desc" },
-            "legend": { "displayMode": "list", "placement": "bottom" }
-          },
-          "targets": [
-            { "expr": "rate(telemt_connections_total{node=~\"$node\"}[5m])", "legendFormat": "{{node}} accepted", "refId": "A" },
-            { "expr": "rate(telemt_connections_bad_total{node=~\"$node\"}[5m])", "legendFormat": "{{node}} bad", "refId": "B" },
-            { "expr": "rate(telemt_handshake_timeouts_total{node=~\"$node\"}[5m])", "legendFormat": "{{node}} hs timeout", "refId": "C" }
-          ],
-          "datasource": { "type": "prometheus", "uid": "${datasource}" }
-        },
-        {
-          "title": "Upstream Connect",
-          "type": "timeseries",
-          "gridPos": { "h": 8, "w": 12, "x": 12, "y": 8 },
-          "id": 11,
-          "fieldConfig": {
-            "defaults": {
-              "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 15, "pointSize": 5, "showPoints": "auto" },
-              "unit": "cps",
-              "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }
-            },
-            "overrides": []
-          },
-          "options": {
-            "tooltip": { "mode": "multi", "sort": "desc" },
-            "legend": { "displayMode": "list", "placement": "bottom" }
-          },
-          "targets": [
-            { "expr": "rate(telemt_upstream_connect_success_total{node=~\"$node\"}[5m])", "legendFormat": "{{node}} success", "refId": "A" },
-            { "expr": "rate(telemt_upstream_connect_fail_total{node=~\"$node\"}[5m])", "legendFormat": "{{node}} fail", "refId": "B" }
-          ],
-          "datasource": { "type": "prometheus", "uid": "${datasource}" }
-        },
-        {
-          "title": "Upstream Connect Duration (success)",
-          "type": "timeseries",
-          "gridPos": { "h": 8, "w": 12, "x": 0, "y": 16 },
-          "id": 12,
-          "fieldConfig": {
-            "defaults": {
-              "custom": { "drawStyle": "bars", "fillOpacity": 50, "stacking": { "mode": "normal" } },
-              "unit": "short",
-              "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }
-            },
-            "overrides": []
-          },
-          "options": {
-            "tooltip": { "mode": "multi", "sort": "desc" },
-            "legend": { "displayMode": "list", "placement": "bottom" }
-          },
-          "targets": [
-            { "expr": "increase(telemt_upstream_connect_duration_success_total{node=~\"$node\"}[5m])", "legendFormat": "{{node}} {{bucket}}", "refId": "A" }
-          ],
-          "datasource": { "type": "prometheus", "uid": "${datasource}" }
-        },
-        {
-          "title": "ME Writers & Pool",
-          "type": "timeseries",
-          "gridPos": { "h": 8, "w": 12, "x": 12, "y": 16 },
-          "id": 13,
-          "fieldConfig": {
-            "defaults": {
-              "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 15, "pointSize": 5, "showPoints": "auto" },
-              "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }
-            },
-            "overrides": []
-          },
-          "options": {
-            "tooltip": { "mode": "multi", "sort": "desc" },
-            "legend": { "displayMode": "list", "placement": "bottom" }
-          },
-          "targets": [
-            { "expr": "telemt_me_writers_active_current{node=~\"$node\"}", "legendFormat": "{{node}} active", "refId": "A" },
-            { "expr": "telemt_me_writers_warm_current{node=~\"$node\"}", "legendFormat": "{{node}} warm", "refId": "B" },
-            { "expr": "telemt_pool_drain_active{node=~\"$node\"}", "legendFormat": "{{node}} draining", "refId": "C" }
-          ],
-          "datasource": { "type": "prometheus", "uid": "${datasource}" }
-        },
-        {
-          "title": "Per-User Active Connections",
-          "type": "timeseries",
-          "gridPos": { "h": 8, "w": 12, "x": 0, "y": 24 },
-          "id": 20,
-          "fieldConfig": {
-            "defaults": {
-              "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 15, "pointSize": 5, "showPoints": "auto" },
-              "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }
-            },
-            "overrides": []
-          },
-          "options": {
-            "tooltip": { "mode": "multi", "sort": "desc" },
-            "legend": { "displayMode": "list", "placement": "bottom" }
-          },
-          "targets": [
-            { "expr": "telemt_user_connections_current{node=~\"$node\"}", "legendFormat": "{{node}} {{user}}", "refId": "A" }
-          ],
-          "datasource": { "type": "prometheus", "uid": "${datasource}" }
-        },
-        {
-          "title": "Per-User Traffic",
-          "type": "timeseries",
-          "gridPos": { "h": 8, "w": 12, "x": 12, "y": 24 },
-          "id": 21,
-          "fieldConfig": {
-            "defaults": {
-              "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 15, "pointSize": 5, "showPoints": "auto" },
-              "unit": "Bps",
-              "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }
-            },
-            "overrides": []
-          },
-          "options": {
-            "tooltip": { "mode": "multi", "sort": "desc" },
-            "legend": { "displayMode": "list", "placement": "bottom" }
-          },
-          "targets": [
-            { "expr": "rate(telemt_user_octets_from_client{node=~\"$node\"}[5m])", "legendFormat": "{{node}} {{user}} rx", "refId": "A" },
-            { "expr": "rate(telemt_user_octets_to_client{node=~\"$node\"}[5m])", "legendFormat": "{{node}} {{user}} tx", "refId": "B" }
-          ],
-          "datasource": { "type": "prometheus", "uid": "${datasource}" }
-        },
-        {
-          "title": "DC->Client Payload",
-          "type": "timeseries",
-          "gridPos": { "h": 8, "w": 12, "x": 0, "y": 32 },
-          "id": 30,
-          "fieldConfig": {
-            "defaults": {
-              "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 15, "pointSize": 5, "showPoints": "auto" },
-              "unit": "Bps",
-              "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }
-            },
-            "overrides": []
-          },
-          "options": {
-            "tooltip": { "mode": "multi", "sort": "desc" },
-            "legend": { "displayMode": "list", "placement": "bottom" }
-          },
-          "targets": [
-            { "expr": "rate(telemt_me_d2c_payload_bytes_total{node=~\"$node\"}[5m])", "legendFormat": "{{node}} payload", "refId": "A" }
-          ],
-          "datasource": { "type": "prometheus", "uid": "${datasource}" }
-        },
-        {
-          "title": "ME Errors & Anomalies",
-          "type": "timeseries",
-          "gridPos": { "h": 8, "w": 12, "x": 12, "y": 32 },
-          "id": 31,
-          "fieldConfig": {
-            "defaults": {
-              "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 15, "pointSize": 5, "showPoints": "auto" },
-              "unit": "cps",
-              "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }
-            },
-            "overrides": []
-          },
-          "options": {
-            "tooltip": { "mode": "multi", "sort": "desc" },
-            "legend": { "displayMode": "list", "placement": "bottom" }
-          },
-          "targets": [
-            { "expr": "rate(telemt_me_reconnect_attempts_total{node=~\"$node\"}[5m])", "legendFormat": "{{node}} reconnect", "refId": "A" },
-            { "expr": "rate(telemt_me_handshake_reject_total{node=~\"$node\"}[5m])", "legendFormat": "{{node}} hs reject", "refId": "B" },
-            { "expr": "rate(telemt_me_crc_mismatch_total{node=~\"$node\"}[5m])", "legendFormat": "{{node}} crc mismatch", "refId": "C" },
-            { "expr": "rate(telemt_desync_total{node=~\"$node\"}[5m])", "legendFormat": "{{node}} desync", "refId": "D" }
-          ],
-          "datasource": { "type": "prometheus", "uid": "${datasource}" }
-        },
-        {
-          "title": "Per-User Unique IPs",
-          "type": "timeseries",
-          "gridPos": { "h": 8, "w": 12, "x": 0, "y": 40 },
-          "id": 40,
-          "fieldConfig": {
-            "defaults": {
-              "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 15, "pointSize": 5, "showPoints": "auto" },
-              "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }
-            },
-            "overrides": []
-          },
-          "options": {
-            "tooltip": { "mode": "multi", "sort": "desc" },
-            "legend": { "displayMode": "list", "placement": "bottom" }
-          },
-          "targets": [
-            { "expr": "telemt_user_unique_ips_current{node=~\"$node\"}", "legendFormat": "{{node}} {{user}} active", "refId": "A" },
-            { "expr": "telemt_user_unique_ips_recent_window{node=~\"$node\"}", "legendFormat": "{{node}} {{user}} recent", "refId": "B" }
-          ],
-          "datasource": { "type": "prometheus", "uid": "${datasource}" }
-        },
-        {
-          "title": "Conntrack",
-          "type": "timeseries",
-          "gridPos": { "h": 8, "w": 12, "x": 12, "y": 40 },
-          "id": 41,
-          "fieldConfig": {
-            "defaults": {
-              "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 15, "pointSize": 5, "showPoints": "auto" },
-              "unit": "cps",
-              "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }
-            },
-            "overrides": []
-          },
-          "options": {
-            "tooltip": { "mode": "multi", "sort": "desc" },
-            "legend": { "displayMode": "list", "placement": "bottom" }
-          },
-          "targets": [
-            { "expr": "rate(telemt_conntrack_delete_total{node=~\"$node\", result=\"attempt\"}[5m])", "legendFormat": "{{node}} delete attempt", "refId": "A" },
-            { "expr": "rate(telemt_conntrack_delete_total{node=~\"$node\", result=\"error\"}[5m])", "legendFormat": "{{node}} delete error", "refId": "B" },
-            { "expr": "telemt_conntrack_event_queue_depth{node=~\"$node\"}", "legendFormat": "{{node}} queue depth", "refId": "C" }
-          ],
-          "datasource": { "type": "prometheus", "uid": "${datasource}" }
-        }
-      ],
-      "refresh": "30s",
-      "schemaVersion": 39,
-      "tags": ["telemt", "mtproxy", "telegram"],
-      "templating": {
-        "list": [
-          {
-            "current": {},
-            "hide": 0,
-            "includeAll": false,
-            "label": "Datasource",
-            "multi": false,
-            "name": "datasource",
-            "options": [],
-            "query": "prometheus",
-            "refresh": 1,
-            "regex": "",
-            "skipUrlSync": false,
-            "type": "datasource"
-          },
-          {
-            "current": {},
-            "datasource": { "type": "prometheus", "uid": "${datasource}" },
-            "definition": "label_values(telemt_uptime_seconds, node)",
-            "hide": 0,
-            "includeAll": true,
-            "label": "Node",
-            "multi": true,
-            "name": "node",
-            "query": "label_values(telemt_uptime_seconds, node)",
-            "refresh": 2,
-            "regex": "",
-            "skipUrlSync": false,
-            "sort": 1,
-            "type": "query"
-          }
-        ]
-      },
-      "time": { "from": "now-6h", "to": "now" },
-      "title": "Telemt MTProxy",
-      "uid": "telemt-mtproxy"
-    }
@@ -20,7 +20,7 @@ data:
                relativeTimeRange:
                  from: 600
                  to: 0
-                datasourceUid: prometheus
+                datasourceUid: P76F38748CEC837F0
                model:
                  expr: 'rate(container_cpu_cfs_throttled_periods_total{container="pasarguard-node"}[5m])'
                  refId: A
@@ -73,7 +73,7 @@ data:
                relativeTimeRange:
                  from: 600
                  to: 0
-                datasourceUid: prometheus
+                datasourceUid: P76F38748CEC837F0
                model:
                  expr: 'kube_node_status_condition{condition="Ready",status="false"}'
                  refId: A
@@ -119,7 +119,7 @@ data:
                relativeTimeRange:
                  from: 300
                  to: 0
-                datasourceUid: prometheus
+                datasourceUid: P76F38748CEC837F0
                model:
                  expr: '(1 - (node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes)) * 100'
                  refId: A
@@ -165,7 +165,7 @@ data:
                relativeTimeRange:
                  from: 300
                  to: 0
-                datasourceUid: prometheus
+                datasourceUid: P76F38748CEC837F0
                model:
                  expr: '100 - (avg by(instance) (rate(node_cpu_seconds_total{mode="idle"}[5m])) * 100)'
                  refId: A
@@ -211,7 +211,7 @@ data:
                relativeTimeRange:
                  from: 300
                  to: 0
-                datasourceUid: prometheus
+                datasourceUid: P76F38748CEC837F0
                model:
                  expr: '(1 - (node_filesystem_avail_bytes{fstype=~"ext[234]|xfs|zfs|btrfs"} / node_filesystem_size_bytes)) * 100'
                  refId: A
@@ -258,9 +258,9 @@ data:
                relativeTimeRange:
                  from: 300
                  to: 0
-                datasourceUid: prometheus
+                datasourceUid: P76F38748CEC837F0
                model:
-                  expr: 'node_load15 / on(instance) group_left count by(instance)(node_cpu_seconds_total{mode="idle"})'
+                  expr: 'node_load5 / on(instance) group_left count by(instance)(node_cpu_seconds_total{mode="idle"})'
                  refId: A
                  intervalMs: 1000
                  maxDataPoints: 43200
@@ -273,7 +273,7 @@ data:
                  conditions:
                    - evaluator:
                        params:
-                          - 2
+                          - 0.8
                        type: gt
                      operator:
                        type: and
@@ -283,16 +283,16 @@ data:
                    type: __expr__
                    uid: __expr__
                  expression: A
-                  reducer: last
+                  reducer: max
                  refId: B
                  type: reduce
            noDataState: NoData
            execErrState: Alerting
-            for: 15m
+            for: 5m
            annotations:
              node: '{{ $labels.instance }}'
              load_average: '{{ printf "%.2f" $values.A }}'
-              summary: 'Node load average is critically high relative to CPU count'
+              summary: 'Node load average is high relative to CPU count'
            labels:
              severity: warning

@@ -304,7 +304,7 @@ data:
                relativeTimeRange:
                  from: 300
                  to: 0
-                datasourceUid: prometheus
+                datasourceUid: P76F38748CEC837F0
                model:
                  expr: 'up{job="node-exporter"}'
                  refId: A
@@ -0,0 +1,85 @@
+envFromSecret: grafana-admin
+nodeSelector:
+  kubernetes.io/hostname: master.tail2fe2d.ts.net
+
+admin:
+  existingSecret: grafana-admin
+  userKey: username
+  passwordKey: password
+
+grafana.ini:
+  auth:
+    signout_redirect_url: https://idm.hexor.cy/application/o/grafana/end-session/
+    # oauth_auto_login: true
+  auth.generic_oauth:
+    name: authentik
+    enabled: true
+    scopes: "openid profile email"
+    auth_url: https://idm.hexor.cy/application/o/authorize/
+    token_url: https://idm.hexor.cy/application/o/token/
+    api_url: https://idm.hexor.cy/application/o/userinfo/
+    role_attribute_path: >-
+      contains(groups, 'Grafana Admin') && 'Admin' ||
+      contains(groups, 'Grafana Editors') && 'Editor' ||
+      contains(groups, 'Grafana Viewer') && 'Viewer'
+  database:
+    type: postgres
+    host: psql.psql.svc:5432
+    name: grafana
+    user: grafana
+    ssl_mode: disable
+
+datasources:
+  datasources.yaml:
+    apiVersion: 1
+    datasources:
+      - name: Prometheus Local
+        type: prometheus
+        url: http://prometheus-kube-prometheus-prometheus.prometheus.svc:9090
+        access: proxy
+        isDefault: true
+      - name: Loki
+        type: loki
+        url: http://loki-gateway.prometheus.svc:80
+        access: proxy
+
+ingress:
+  enabled: true
+  ingressClassName: traefik
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
+  hosts:
+    - gf.hexor.cy
+  tls:
+    - secretName: grafana-tls
+      hosts:
+        - '*.hexor.cy'
+
+extraConfigmapMounts:
+  - name: grafana-alerting-rules
+    mountPath: /etc/grafana/provisioning/alerting/rules.yaml
+    configMap: grafana-alerting
+    subPath: rules.yaml
+    readOnly: true
+  - name: grafana-alerting-contactpoints
+    mountPath: /etc/grafana/provisioning/alerting/contactpoints.yaml
+    configMap: grafana-alerting
+    subPath: contactpoints.yaml
+    readOnly: true
+  - name: grafana-alerting-policies
+    mountPath: /etc/grafana/provisioning/alerting/policies.yaml
+    configMap: grafana-alerting
+    subPath: policies.yaml
+    readOnly: true
+
+envValueFrom:
+  TELEGRAM_BOT_TOKEN:
+    secretKeyRef:
+      name: grafana-telegram
+      key: bot-token
+  TELEGRAM_CHAT_ID:
+    secretKeyRef:
+      name: grafana-telegram
+      key: chat-id
+
@@ -6,18 +6,24 @@ resources:
  - external-secrets.yaml
  - grafana-alerting-configmap.yaml
  - alertmanager-config.yaml
-  - dashboards/telemt-dashboard-cm.yaml
-  - dashboards/auth-proxy-dashboard-cm.yaml

 helmCharts:
  - name: kube-prometheus-stack
    repo: https://prometheus-community.github.io/helm-charts
-    version: 84.3.0
+    version: 79.7.1
    releaseName: prometheus
    namespace: prometheus
    valuesFile: prom-values.yaml
    includeCRDs: true

+  - name: grafana
+    repo: https://grafana.github.io/helm-charts
+    version: 10.2.0
+    releaseName: grafana
+    namespace: prometheus
+    valuesFile: grafana-values.yaml
+    includeCRDs: true
+
  - name: loki
    repo: https://grafana.github.io/helm-charts
    version: 6.29.0
@@ -20,12 +20,8 @@ loki:
    filesystem:
      chunks_directory: /var/loki/chunks
      rules_directory: /var/loki/rules
-  compactor:
-    retention_enabled: true
-    delete_request_store: filesystem
  limits_config:
    reject_old_samples: false
-    retention_period: 1440h
    ingestion_rate_mb: 16
    ingestion_burst_size_mb: 32
    max_query_parallelism: 32
@@ -1,3 +1,5 @@
+grafana:
+  enabled: false

 alertmanager:
  config:
@@ -77,7 +79,7 @@ prometheus:
          - targets: ['prom-a2s-exporter.counter-strike.svc:9841']
            labels: {instance: master}

-    retention: "380d"
+    retention: "99999d"
    retentionSize: "0"
    nodeSelector:
      kubernetes.io/hostname: master.tail2fe2d.ts.net
@@ -90,97 +92,3 @@ prometheus:
            requests:
              storage: 400Gi

-grafana:
-  enabled: true
-  
-  serviceAccount:
-    create: true
-    name: "prom-grafana-sa"
-
-  envFromSecret: grafana-admin
-  nodeSelector:
-    kubernetes.io/hostname: master.tail2fe2d.ts.net
-
-  admin:
-    existingSecret: grafana-admin
-    userKey: username
-    passwordKey: password
-
-  grafana.ini:
-    auth:
-      signout_redirect_url: https://auth.hexor.cy/auth/realms/hexor/protocol/openid-connect/logout?post_logout_redirect_uri=https%3A%2F%2Fgf.hexor.cy%2Flogin&client_id=Grafana
-      oauth_allow_insecure_email_lookup: true
-    auth.generic_oauth:
-      name: Keycloak
-      enabled: true
-      scopes: "openid profile email"
-      allow_sign_up: true
-      auth_url: https://auth.hexor.cy/auth/realms/hexor/protocol/openid-connect/auth
-      token_url: https://auth.hexor.cy/auth/realms/hexor/protocol/openid-connect/token
-      api_url: https://auth.hexor.cy/auth/realms/hexor/protocol/openid-connect/userinfo
-      email_attribute_path: email
-      login_attribute_path: preferred_username
-      name_attribute_path: name
-      role_attribute_path: >-
-        contains(groups[*], 'hexor-admin') && 'Admin' ||
-        contains(groups[*], 'hexor-guest') && 'Viewer' ||
-        'Viewer'
-      role_attribute_strict: false
-    log:
-      level: debug
-      filters: "oauth.generic_oauth:debug"
-    database:
-      type: postgres
-      host: psql.psql.svc:5432
-      name: grafana
-      user: grafana
-      ssl_mode: disable
-
-  # The Loki datasource config needs to be preserved, 
-  # but instead of "datasources.datasources.yaml", we define it like this for the prometheus-stack chart:
-  additionalDataSources:
-    - name: Loki
-      type: loki
-      url: http://loki-gateway.prometheus.svc:80
-      access: proxy
-      orgId: 1
-
-  ingress:
-    enabled: true
-    ingressClassName: traefik
-    annotations:
-      cert-manager.io/cluster-issuer: letsencrypt
-      traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
-    hosts:
-      - gf.hexor.cy
-    tls:
-      - secretName: grafana-tls
-        hosts:
-          - '*.hexor.cy'
-
-  extraConfigmapMounts:
-    - name: grafana-alerting-rules
-      mountPath: /etc/grafana/provisioning/alerting/rules.yaml
-      configMap: grafana-alerting
-      subPath: rules.yaml
-      readOnly: true
-    - name: grafana-alerting-contactpoints
-      mountPath: /etc/grafana/provisioning/alerting/contactpoints.yaml
-      configMap: grafana-alerting
-      subPath: contactpoints.yaml
-      readOnly: true
-    - name: grafana-alerting-policies
-      mountPath: /etc/grafana/provisioning/alerting/policies.yaml
-      configMap: grafana-alerting
-      subPath: policies.yaml
-      readOnly: true
-
-  envValueFrom:
-    TELEGRAM_BOT_TOKEN:
-      secretKeyRef:
-        name: grafana-telegram
-        key: bot-token
-    TELEGRAM_CHAT_ID:
-      secretKeyRef:
-        name: grafana-telegram
-        key: chat-id
@@ -7,8 +7,6 @@ metadata:
 spec:
  concurrency: 1
  cordon: true
-  tolerations:
-  - operator: Exists
  nodeSelector:
    matchExpressions:
    - key: node-role.kubernetes.io/control-plane
@@ -18,7 +16,7 @@ spec:
  serviceAccountName: system-upgrade
  upgrade:
    image: rancher/k3s-upgrade
-  version: v1.36.1+k3s1
+  version: v1.34.3+k3s1
 ---
 # Agent plan
 apiVersion: upgrade.cattle.io/v1
@@ -29,8 +27,6 @@ metadata:
 spec:
  concurrency: 1
  cordon: true
-  tolerations:
-  - operator: Exists
  nodeSelector:
    matchExpressions:
    - key: node-role.kubernetes.io/control-plane
@@ -43,4 +39,5 @@ spec:
  serviceAccountName: system-upgrade
  upgrade:
    image: rancher/k3s-upgrade
-  version: v1.36.1+k3s1
+  version: v1.34.3+k3s1
+
@@ -35,7 +35,7 @@ spec:
      terminationGracePeriodSeconds: 10
      containers:
        - name: minecraft
-          image: 'eclipse-temurin:8-jdk-ubi10-minimal'
+          image: 'openjdk:8-jdk-alpine'
          command: ["java"]
          args:
            - -Xms4G
@@ -0,0 +1,16 @@
+{
+  "permissions": {
+    "allow": [
+      "WebSearch",
+      "WebFetch(domain:registry.terraform.io)",
+      "Bash(C:UsersabAppDataLocalMicrosoftWinGetPackagesHashicorp.Terraform_Microsoft.Winget.Source_8wekyb3d8bbweterraform.exe apply -auto-approve)",
+      "Bash(\"C:\\Users\\ab\\AppData\\Local\\Microsoft\\WinGet\\Packages\\Hashicorp.Terraform_Microsoft.Winget.Source_8wekyb3d8bbwe\\terraform.exe\" apply -auto-approve)",
+      "Bash(\"C:\\Users\\ab\\AppData\\Local\\Microsoft\\WinGet\\Packages\\Hashicorp.Terraform_Microsoft.Winget.Source_8wekyb3d8bbwe\\terraform.exe\" apply -auto-approve -lock=false)",
+      "Bash(\"C:\\Users\\ab\\AppData\\Local\\Microsoft\\WinGet\\Packages\\Hashicorp.Terraform_Microsoft.Winget.Source_8wekyb3d8bbwe\\terraform.exe\" plan -lock=false)",
+      "Bash(\"C:\\Users\\ab\\AppData\\Local\\Microsoft\\WinGet\\Packages\\Hashicorp.Terraform_Microsoft.Winget.Source_8wekyb3d8bbwe\\terraform.exe\" apply -replace=\"authentik_outpost.outposts[\"\"kubernetes-outpost\"\"]\" -auto-approve -lock=false)",
+      "Bash(terraform plan:*)"
+    ],
+    "deny": [],
+    "ask": []
+  }
+}
@@ -2,43 +2,43 @@
 # Manual edits may be lost in future updates.

 provider "registry.terraform.io/goauthentik/authentik" {
-  version     = "2025.12.1"
-  constraints = ">= 2023.10.0, 2025.12.1"
+  version     = "2025.8.1"
+  constraints = ">= 2023.10.0, 2025.8.1"
  hashes = [
-    "h1:p9AGeRqK50wTHEIp7z7O4MUP83cs+lt7wPajZ9m9TB8=",
-    "zh:0e856d3b13614bc32346a236a8e84ba55ecd17238c2008d4b3e71aa8cb49f515",
-    "zh:2dcc44cd499c18ebbc4f763eff97a7b725763c8ac8fbb5d69c935413ccdc4962",
-    "zh:434100fc75ec7cd6b64cc9497e8273e79325fa8d285e9fd9d341c1a67421643b",
-    "zh:483484f66d2e8ce6fa4bfd91e824ceebf07d10acb5df5f366397c55227c4ae91",
-    "zh:596743a6f1c77a6f103b06ef8d932fe8f2376793b92478853dc84571d17c429f",
-    "zh:5ed2d5eb7db13229baaf042c725d5c64b58ffdcc641370175e0a88900af94bf1",
-    "zh:8aecd4cf782c82bee01098f72fe4ffff83707516007b32a01c7fcb19a9260338",
-    "zh:928c05ecac309287ff7d73ed6e478350fe3003557658ae5dc2be817a4268dba7",
-    "zh:9b9fd36dfb3e75da8b4478485272505ae9a3c67b10db173e1d2d76cfe2b637b8",
-    "zh:ab7cd8c61ab67a045854e32f0be1940a92746770dbf3c17bbe923e0259c4f897",
-    "zh:bb1360ec19a4fc1095d0ef1b7b6c5c3c1a91daac7cd1957d43a4cdbb7356a2e3",
-    "zh:d2186f4063aa1a547b52a53745d472e43f5343bc1674f2bbb91421c61b0fab50",
-    "zh:d74bbb67a77951b18ffd7b2863954e70ac03450ad2023cc305c66a5ff25d8d18",
-    "zh:f5970569ea0a479bbfbf2d452f5962e1c9bd472b82756db822d0e951363daa25",
+    "h1:R3h8ADB0Kkv/aoY0AaHkBiX2/P4+GnW8sSgkN30kJfQ=",
+    "zh:0c3f1083fd48f20ed06959401ff1459fbb5d454d81c8175b5b6d321b308c0be3",
+    "zh:21c6d93f8d26e688da38a660d121b5624e3597c426c671289f31a17a9771abbf",
+    "zh:301b5763ffc4c5fe47aa7e851ce0b19f71bab4fae5c81003ad81b38775e85f78",
+    "zh:4f7ee6473f6a687340538ddac0ec4a0453664186b15fdb0bb2fb5fcd8fb3ad30",
+    "zh:7927f4f634c9e072d4aa6620d09e97dc83eeb1dbd0667102086779cd5fc495c1",
+    "zh:84e7c2a3f3de721a54abe4c971d9a163127f5e4af91d023260fea305ac74bcf4",
+    "zh:92af52aaac518c426164eb731d282f51a5825e64e6a02b0695952177a7af7d9c",
+    "zh:a6920a54d5df69342f4ea2d903676145b00e7375d2f2eecc0840858d83b3b4a8",
+    "zh:ac8a60801fc55fd05b3471778f908ed43072e046997c0082644c9602b84dafec",
+    "zh:b1cc29e2878aa94a3827fd5e1dd8cffb98397aa4093d6a4852c6e53157e9b35f",
+    "zh:c2d78f308c4d70a16ef4f6d1f4822a64f8f160d0a207f2121904cdd6f4942db4",
+    "zh:ca970e5776f408059a84b4e17f6ac257ec92afae956be74f3807c548e4567eaa",
+    "zh:eb2e3650ee0eec033207b6d72fcb938dc5846c6feb8a61ae30d61981ea411269",
+    "zh:fcb93e51c84ba592bc2b075d7342e475126e5029620959666999b5b1bd11cb98",
  ]
 }

 provider "registry.terraform.io/hashicorp/random" {
-  version     = "3.8.1"
+  version     = "3.7.2"
  constraints = ">= 3.5.0"
  hashes = [
-    "h1:u8AKlWVDTH5r9YLSeswoVEjiY72Rt4/ch7U+61ZDkiQ=",
-    "zh:08dd03b918c7b55713026037c5400c48af5b9f468f483463321bd18e17b907b4",
-    "zh:0eee654a5542dc1d41920bbf2419032d6f0d5625b03bd81339e5b33394a3e0ae",
-    "zh:229665ddf060aa0ed315597908483eee5b818a17d09b6417a0f52fd9405c4f57",
-    "zh:2469d2e48f28076254a2a3fc327f184914566d9e40c5780b8d96ebf7205f8bc0",
-    "zh:37d7eb334d9561f335e748280f5535a384a88675af9a9eac439d4cfd663bcb66",
-    "zh:741101426a2f2c52dee37122f0f4a2f2d6af6d852cb1db634480a86398fa3511",
+    "h1:356j/3XnXEKr9nyicLUufzoF4Yr6hRy481KIxRVpK0c=",
+    "zh:14829603a32e4bc4d05062f059e545a91e27ff033756b48afbae6b3c835f508f",
+    "zh:1527fb07d9fea400d70e9e6eb4a2b918d5060d604749b6f1c361518e7da546dc",
+    "zh:1e86bcd7ebec85ba336b423ba1db046aeaa3c0e5f921039b3f1a6fc2f978feab",
+    "zh:24536dec8bde66753f4b4030b8f3ef43c196d69cccbea1c382d01b222478c7a3",
+    "zh:29f1786486759fad9b0ce4fdfbbfece9343ad47cd50119045075e05afe49d212",
+    "zh:4d701e978c2dd8604ba1ce962b047607701e65c078cb22e97171513e9e57491f",
    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
-    "zh:a902473f08ef8df62cfe6116bd6c157070a93f66622384300de235a533e9d4a9",
-    "zh:b85c511a23e57a2147355932b3b6dce2a11e856b941165793a0c3d7578d94d05",
-    "zh:c5172226d18eaac95b1daac80172287b69d4ce32750c82ad77fa0768be4ea4b8",
-    "zh:dab4434dba34aad569b0bc243c2d3f3ff86dd7740def373f2a49816bd2ff819b",
-    "zh:f49fd62aa8c5525a5c17abd51e27ca5e213881d58882fd42fec4a545b53c9699",
+    "zh:7b8434212eef0f8c83f5a90c6d76feaf850f6502b61b53c329e85b3b281cba34",
+    "zh:ac8a23c212258b7976e1621275e3af7099e7e4a3d4478cf8d5d2a27f3bc3e967",
+    "zh:b516ca74431f3df4c6cf90ddcdb4042c626e026317a33c53f0b445a3d93b720d",
+    "zh:dc76e4326aec2490c1600d6871a95e78f9050f9ce427c71707ea412a2f2f1a62",
+    "zh:eac7b63e86c749c7d48f527671c7aee5b4e26c10be6ad7232d6860167f99dbb0",
  ]
 }
@@ -1,81 +1,55 @@
-# Authentik Terraform Configuration
+# Authentik Terraform Module

-Root Terraform configuration for managing Authentik SSO — applications (OAuth2/OIDC, Proxy, SAML), groups, outposts, flows, certificates, and property mappings.
-
-State is stored in Terraform Cloud (organization `ultradesu`, workspace `Authentik`).
-
-## Structure
-
-```
-.
-├── main.tf                      # Resources: groups, outposts, policy bindings, module calls
-├── variables.tf                 # Input variable definitions
-├── outputs.tf                   # Outputs (app details, groups, flows, wiki data)
-├── providers.tf                 # Authentik provider (goauthentik/authentik 2025.12.1)
-├── state.tf                     # Terraform Cloud backend
-├── terraform.tfvars             # General settings: authentik_url, outposts, flows, tags
-├── oauth2-apps.auto.tfvars      # OAuth2/OIDC application definitions
-├── proxy-apps.auto.tfvars       # Proxy application definitions
-├── groups.auto.tfvars           # Group definitions
-└── modules/
-    ├── oauth-provider/          # OAuth2/OIDC provider + application
-    ├── proxy-provider/          # Proxy provider + application
-    └── saml-provider/           # SAML provider + application
-```
+Terraform module for managing Authentik applications with OAuth2/OpenID and Proxy providers, including automatic Outpost assignment.

 ## Usage

-```bash
-# Set the API token
-export TF_VAR_authentik_token="..."
-
-terraform init
-terraform plan
-terraform apply
-```
-
-All `*.auto.tfvars` files are loaded automatically — no `-var-file` flags needed.
-
-## Adding applications
-
-OAuth2/OIDC — add to `oauth2-apps.auto.tfvars`:
-
 ```hcl
-oauth_applications = {
-  "my-app" = {
-    name          = "My App"
-    slug          = "my-app"
-    group         = "Tools"
-    redirect_uris = ["https://my-app.example.com/callback"]
-    create_group  = true
-    access_groups = ["admins"]
+module "authentik" {
+  source = "./authentik"
+
+  authentik_url   = "https://auth.example.com"
+  authentik_token = var.authentik_token
+
+  oauth_applications = {
+    "gitlab" = {
+      name         = "GitLab OAuth"
+      slug         = "gitlab"
+      redirect_uris = ["https://gitlab.example.com/users/auth/openid_connect/callback"]
+    }
+  }
+
+  proxy_applications = {
+    "portainer" = {
+      name          = "Portainer"
+      slug          = "portainer"
+      external_host = "https://portainer.example.com"
+      internal_host = "http://portainer:9000"
+      outpost       = "k8s-outpost"
+    }
+  }
+
+  outposts = {
+    "k8s-outpost" = {
+      name = "Kubernetes Outpost"
+      type = "proxy"
+      service_connection = "k8s-local"
+    }
  }
 }
 ```

-Proxy — add to `proxy-apps.auto.tfvars`:
+## Structure

-```hcl
-proxy_applications = {
-  "my-proxy" = {
-    name          = "My Proxy"
-    slug          = "my-proxy"
-    group         = "Tools"
-    external_host = "https://my-proxy.example.com"
-    internal_host = "http://my-service.namespace.svc:80"
-    outpost       = "kubernetes-outpost"
-    create_group  = true
-    access_groups = ["admins"]
-  }
-}
-```
-
-## CI/CD
-
-Managed via Gitea Actions (`.gitea/workflows/authentik-apps.yaml`). Runs `terraform apply` on push to `main` when files in `terraform/authentik/` change. Also generates a wiki page with the applications list.
+- `main.tf` - Main configuration
+- `variables.tf` - Input variables  
+- `outputs.tf` - Output values
+- `modules/oauth-provider/` - OAuth2/OIDC provider module
+- `modules/proxy-provider/` - Proxy provider module
+- `terraform.tfvars.example` - Configuration example

 ## Requirements

 - Terraform >= 1.0
- goauthentik/authentik provider 2025.12.1
- Authentik API token with admin permissions
+- Authentik provider >= 2023.10.0
+- Authentik API token with admin permissions