Update terraform/authentik/proxy-apps.tfvars

2025-12-10 13:47:16 +00:00 · 2025-12-10 13:46:17 +00:00 · 2025-12-09 22:00:00 +00:00 · 2025-12-09 21:17:38 +00:00 · 2025-12-09 15:42:24 +00:00 · 2025-12-09 04:36:31 +00:00
71 changed files with 1223 additions and 121 deletions
--- a/.gitea/workflows/authentik-apps.yaml
+++ b/.gitea/workflows/authentik-apps.yaml
@@ -30,21 +30,29 @@ jobs:
        cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}

    - name: Terraform Init
+      env:
+        TF_VAR_authentik_token: ${{ secrets.AUTHENTIK_TOKEN }}
      run: terraform init
      working-directory: ./terraform/authentik

    - name: Terraform Format
+      env:
+        TF_VAR_authentik_token: ${{ secrets.AUTHENTIK_TOKEN }}
      run: terraform fmt -check
      continue-on-error: true
      working-directory: ./terraform/authentik

    - name: Terraform Apply
+      env:
+        TF_VAR_authentik_token: ${{ secrets.AUTHENTIK_TOKEN }}
      run: terraform apply -var-file proxy-apps.tfvars -var-file oauth2-apps.tfvars -var-file terraform.tfvars -var-file groups.tfvars -input=false -auto-approve -parallelism=100
      working-directory: ./terraform/authentik

    - name: Generate Wiki Content  
      if: success()
      continue-on-error: true
+      env:
+        TF_VAR_authentik_token: ${{ secrets.AUTHENTIK_TOKEN }}
      run: |
        echo "📋 Starting Wiki generation..."
        cd ./terraform/authentik
--- a/README.md
+++ b/README.md
@@ -40,6 +40,7 @@ ArgoCD homelab project
 | **greece-notifier** | [![greece-notifier](https://ag.hexor.cy/api/badge?name=greece-notifier&revision=true)](https://ag.hexor.cy/applications/argocd/greece-notifier) |
 | **hexound** | [![hexound](https://ag.hexor.cy/api/badge?name=hexound&revision=true)](https://ag.hexor.cy/applications/argocd/hexound) |
 | **immich** | [![immich](https://ag.hexor.cy/api/badge?name=immich&revision=true)](https://ag.hexor.cy/applications/argocd/immich) |
+| **iperf3** | [![iperf3](https://ag.hexor.cy/api/badge?name=iperf3&revision=true)](https://ag.hexor.cy/applications/argocd/iperf3) |
 | **jellyfin** | [![jellyfin](https://ag.hexor.cy/api/badge?name=jellyfin&revision=true)](https://ag.hexor.cy/applications/argocd/jellyfin) |
 | **k8s-secrets** | [![k8s-secrets](https://ag.hexor.cy/api/badge?name=k8s-secrets&revision=true)](https://ag.hexor.cy/applications/argocd/k8s-secrets) |
 | **khm** | [![khm](https://ag.hexor.cy/api/badge?name=khm&revision=true)](https://ag.hexor.cy/applications/argocd/khm) |
@@ -47,6 +48,7 @@ ArgoCD homelab project
 | **paperless** | [![paperless](https://ag.hexor.cy/api/badge?name=paperless&revision=true)](https://ag.hexor.cy/applications/argocd/paperless) |
 | **pasarguard** | [![pasarguard](https://ag.hexor.cy/api/badge?name=pasarguard&revision=true)](https://ag.hexor.cy/applications/argocd/pasarguard) |
 | **qbittorent-nas** | [![qbittorent-nas](https://ag.hexor.cy/api/badge?name=qbittorent-nas&revision=true)](https://ag.hexor.cy/applications/argocd/qbittorent-nas) |
+| **remnawave** | [![remnawave](https://ag.hexor.cy/api/badge?name=remnawave&revision=true)](https://ag.hexor.cy/applications/argocd/remnawave) |
 | **rustdesk** | [![rustdesk](https://ag.hexor.cy/api/badge?name=rustdesk&revision=true)](https://ag.hexor.cy/applications/argocd/rustdesk) |
 | **sonarr-stack** | [![sonarr-stack](https://ag.hexor.cy/api/badge?name=sonarr-stack&revision=true)](https://ag.hexor.cy/applications/argocd/sonarr-stack) |
 | **stirling-pdf** | [![stirling-pdf](https://ag.hexor.cy/api/badge?name=stirling-pdf&revision=true)](https://ag.hexor.cy/applications/argocd/stirling-pdf) |
--- a/k8s/apps/gitea/deployment.yaml
+++ b/k8s/apps/gitea/deployment.yaml
@@ -36,7 +36,7 @@ spec:
              cpu: "200m"
            limits:
              memory: "2Gi"
-              cpu: "1000m"
+              cpu: "1500m"
          env:
            - name: GITEA__service__REGISTER_MANUAL_CONFIRM
              value: "true"
@@ -129,7 +129,7 @@ spec:
              memory: "256Mi"
              ephemeral-storage: "1Gi"   # reserve ephemeral storage
            limits:
-              cpu: "2000m"
+              cpu: "3000m"
              memory: "4Gi"
              ephemeral-storage: "28Gi"   # hard cap for /data usage
          volumeMounts:
--- a/k8s/apps/gitea/external-secrets.yaml
+++ b/k8s/apps/gitea/external-secrets.yaml
@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: gitea-runner-token
@@ -24,7 +24,7 @@ spec:
        property: login.password

 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: gitea-recapcha-creds
--- a/k8s/apps/greece-notifier/deployment.yaml
+++ b/k8s/apps/greece-notifier/deployment.yaml
@@ -30,7 +30,7 @@ spec:
              cpu: "100m"
              memory: "256Mi"
            limits:
-              cpu: "2000m"
+              cpu: "3000m"
              memory: "1Gi"
          volumeMounts:
            - name: data
--- a/k8s/apps/greece-notifier/external-secrets.yaml
+++ b/k8s/apps/greece-notifier/external-secrets.yaml
@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: greece-notifier-creds
--- a/k8s/apps/hexound/deployment.yaml
+++ b/k8s/apps/hexound/deployment.yaml
@@ -30,7 +30,7 @@ spec:
              cpu: "50m"
            limits:
              memory: "128Mi"
-              cpu: "200m"
+              cpu: "300m"
          command:
            - git
            - clone
@@ -49,7 +49,7 @@ spec:
              cpu: "50m"
            limits:
              memory: "256Mi"
-              cpu: "200m"
+              cpu: "300m"
          volumeMounts:
            - name: hexound-repo
              mountPath: /var/www/html
--- a/k8s/apps/immich/deployments.yaml
+++ b/k8s/apps/immich/deployments.yaml
@@ -23,7 +23,7 @@ spec:
            cpu: "500m"
          limits:
            memory: "4Gi"
-            cpu: "2000m"
+            cpu: "3000m"
        ports:
        - containerPort: 2283
        env:
@@ -160,7 +160,7 @@ spec:
            cpu: "1000m"
          limits:
            memory: "8Gi"
-            cpu: "4000m"
+            cpu: "6000m"
        env:
        - name: TZ
          value: Asia/Nicosia
@@ -201,7 +201,7 @@ spec:
              cpu: "100m"
            limits:
              memory: "512Mi"
-              cpu: "500m"
+              cpu: "750m"
          readinessProbe:
            exec:
              command: ["redis-cli", "ping"]
--- a/k8s/apps/iperf3/daemonset.yaml
+++ b/k8s/apps/iperf3/daemonset.yaml
@@ -84,7 +84,7 @@ spec:
            cpu: "100m"
          limits:
            memory: "256Mi"
-            cpu: "500m"
+            cpu: "750m"
      tolerations:
      - effect: NoSchedule
        operator: Exists
--- a/k8s/apps/iperf3/iperf3-exporter-daemonset.yaml
+++ b/k8s/apps/iperf3/iperf3-exporter-daemonset.yaml
@@ -14,6 +14,58 @@ spec:
      labels:
        app: iperf3-exporter
    spec:
+      serviceAccountName: iperf3-server
+      initContainers:
+      - name: create-exporter-service
+        image: bitnami/kubectl:latest
+        env:
+        - name: NODE_NAME
+          valueFrom:
+            fieldRef:
+              fieldPath: spec.nodeName
+        - name: POD_IP
+          valueFrom:
+            fieldRef:
+              fieldPath: status.podIP
+        command:
+          - /bin/bash
+          - -c
+          - |
+            NODE_CLEAN=$(echo "$NODE_NAME" | cut -d'.' -f1 | tr '[:upper:]' '[:lower:]' | tr '_' '-')
+            SERVICE_NAME="iperf3-exporter-${NODE_CLEAN}"
+            
+            kubectl apply -f - <<EOF
+            apiVersion: v1
+            kind: Service
+            metadata:
+              name: ${SERVICE_NAME}
+              namespace: iperf3
+              labels:
+                app: iperf3-exporter-service
+                target-node: "${NODE_NAME}"
+            spec:
+              type: ClusterIP
+              ports:
+                - name: metrics
+                  port: 9579
+                  protocol: TCP
+            ---
+            apiVersion: v1
+            kind: Endpoints
+            metadata:
+              name: ${SERVICE_NAME}
+              namespace: iperf3
+              labels:
+                app: iperf3-exporter-service
+                target-node: "${NODE_NAME}"
+            subsets:
+              - addresses:
+                  - ip: ${POD_IP}
+                ports:
+                  - name: metrics
+                    port: 9579
+                    protocol: TCP
+            EOF
      containers:
      - name: iperf3-exporter
        image: ghcr.io/edgard/iperf3_exporter:1.2.2
@@ -27,7 +79,7 @@ spec:
            cpu: "50m"
          limits:
            memory: "128Mi"
-            cpu: "200m"
+            cpu: "300m"
        env:
        - name: NODE_NAME
          valueFrom:
--- a/k8s/apps/iperf3/servicemonitor.yaml
+++ b/k8s/apps/iperf3/servicemonitor.yaml
@@ -23,7 +23,7 @@ spec:
        - sourceLabels: [__param_target]
          targetLabel: instance
        - targetLabel: __address__
-          replacement: iperf3-exporter.iperf3.svc.cluster.local:9579
+          replacement: iperf3-exporter-ch.iperf3.svc:9579
    - port: metrics
      path: /probe
      interval: 5m
@@ -36,7 +36,7 @@ spec:
        - sourceLabels: [__param_target]
          targetLabel: instance
        - targetLabel: __address__
-          replacement: iperf3-exporter.iperf3.svc.cluster.local:9579
+          replacement: iperf3-exporter-us.iperf3.svc:9579
    - port: metrics
      path: /probe
      interval: 5m
@@ -49,7 +49,7 @@ spec:
        - sourceLabels: [__param_target]
          targetLabel: instance
        - targetLabel: __address__
-          replacement: iperf3-exporter.iperf3.svc.cluster.local:9579
+          replacement: iperf3-exporter-iris.iperf3.svc:9579
    - port: metrics
      path: /probe
      interval: 5m
@@ -62,7 +62,7 @@ spec:
        - sourceLabels: [__param_target]
          targetLabel: instance
        - targetLabel: __address__
-          replacement: iperf3-exporter.iperf3.svc.cluster.local:9579
+          replacement: iperf3-exporter-home.iperf3.svc:9579
    - port: metrics
      path: /probe
      interval: 5m
@@ -75,7 +75,7 @@ spec:
        - sourceLabels: [__param_target]
          targetLabel: instance
        - targetLabel: __address__
-          replacement: iperf3-exporter.iperf3.svc.cluster.local:9579
+          replacement: iperf3-exporter-master.iperf3.svc:9579
    - port: metrics
      path: /probe
      interval: 5m
@@ -88,7 +88,7 @@ spec:
        - sourceLabels: [__param_target]
          targetLabel: instance
        - targetLabel: __address__
-          replacement: iperf3-exporter.iperf3.svc.cluster.local:9579
+          replacement: iperf3-exporter-it.iperf3.svc:9579
    - port: metrics
      path: /probe
      interval: 5m
@@ -101,7 +101,7 @@ spec:
        - sourceLabels: [__param_target]
          targetLabel: instance
        - targetLabel: __address__
-          replacement: iperf3-exporter.iperf3.svc.cluster.local:9579
+          replacement: iperf3-exporter-nas.iperf3.svc:9579
    - port: metrics
      path: /probe
      interval: 5m
@@ -114,7 +114,7 @@ spec:
        - sourceLabels: [__param_target]
          targetLabel: instance
        - targetLabel: __address__
-          replacement: iperf3-exporter.iperf3.svc.cluster.local:9579
+          replacement: iperf3-exporter-spb.iperf3.svc:9579
      metricRelabelings:
        - sourceLabels: [__name__]
          regex: iperf3_(.+)
--- a/k8s/apps/jellyfin/qbittorent.yaml
+++ b/k8s/apps/jellyfin/qbittorent.yaml
@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: vpn-creds
@@ -76,11 +76,14 @@ spec:
                secretKeyRef:
                  name: vpn-creds
                  key: ss_link
-          command: ["/bin/bash", "-c", "rm /etc/shadowsocks-rust/config.json && sslocal  --online-config-url $SS_LINK --local-addr 127.0.0.1:8081 -U --protocol http"]
+          command: ["/bin/bash", "-c", "rm /etc/shadowsocks-rust/config.json && sslocal --server-url $SS_LINK --local-addr 127.0.0.1:8081 -U --protocol http"]
          resources:
            requests:
              memory: "64Mi"
-              cpu: "200m"
+              cpu: "300m"
+            limits:
+              memory: "128Mi"
+              cpu: "300m"
 ---
 apiVersion: v1
 kind: Service
--- a/k8s/apps/jellyfin/values.yaml
+++ b/k8s/apps/jellyfin/values.yaml
@@ -1,12 +1,12 @@
 image:
-  tag: 10.10.7
+  tag: 10.11.4
 resources:
  requests:
    memory: "2Gi"
    cpu: "1000m"
  limits:
    memory: "8Gi"
-    cpu: "4000m"
+    cpu: "6000m"
 nodeSelector:
  kubernetes.io/hostname: master.tail2fe2d.ts.net
 persistence:
@@ -36,8 +36,40 @@ ingress:
        paths:
          - path: /
            pathType: Prefix
+      - host: us.hexor.cy
+        paths:
+          - path: /
+            pathType: Prefix
+      - host: ch.hexor.cy
+        paths:
+          - path: /
+            pathType: Prefix
+      - host: jp.hexor.cy
+        paths:
+          - path: /
+            pathType: Prefix
+      - host: spb.hexor.cy
+        paths:
+          - path: /
+            pathType: Prefix
+      - host: cy.hexor.cy
+        paths:
+          - path: /
+            pathType: Prefix
+      - host: am.hexor.cy
+        paths:
+          - path: /
+            pathType: Prefix
+      - host: de.hexor.cy
+        paths:
+          - path: /
+            pathType: Prefix
+      - host: it.hexor.cy
+        paths:
+          - path: /
+            pathType: Prefix
    tls:
      - secretName: jellyfin-tls
        hosts:
-          - 'jf.hexor.cy'
+          - '*.hexor.cy'

--- a/k8s/apps/k8s-secrets/deployment.yaml
+++ b/k8s/apps/k8s-secrets/deployment.yaml
@@ -40,7 +40,7 @@ spec:
            cpu: "50m"
          limits:
            memory: "128Mi"
-            cpu: "100m"
+            cpu: "150m"
        livenessProbe:
          httpGet:
            path: /health
--- a/k8s/apps/k8s-secrets/external-secret.yaml
+++ b/k8s/apps/k8s-secrets/external-secret.yaml
@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: openai-creds
--- a/k8s/apps/khm/deployment.yaml
+++ b/k8s/apps/khm/deployment.yaml
@@ -29,7 +29,7 @@ spec:
              cpu: "100m"
            limits:
              memory: "1Gi"
-              cpu: "500m"
+              cpu: "750m"
          command:
            - /bin/sh
            - -c
--- a/k8s/apps/khm/external-secrets.yaml
+++ b/k8s/apps/khm/external-secrets.yaml
@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: khm-pg-creds
--- a/k8s/apps/ollama/external-secrets.yaml
+++ b/k8s/apps/ollama/external-secrets.yaml
@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: oidc-secret
--- a/k8s/apps/paperless/external-secrets.yaml
+++ b/k8s/apps/paperless/external-secrets.yaml
@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: postgres-and-oauth-creds
--- a/k8s/apps/paperless/gotenberg-values.yaml
+++ b/k8s/apps/paperless/gotenberg-values.yaml
@@ -13,7 +13,7 @@ resources:
    cpu: "200m"
  limits:
    memory: "2Gi"
-    cpu: "1000m"
+    cpu: "1500m"

 service:
  type: ClusterIP
--- a/k8s/apps/paperless/paperless-values.yaml
+++ b/k8s/apps/paperless/paperless-values.yaml
@@ -6,7 +6,7 @@ resources:
    cpu: "500m"
  limits:
    memory: "4Gi"
-    cpu: "2000m"
+    cpu: "3000m"
 initContainers:
  install-tesseract-langs:
    image: ghcr.io/paperless-ngx/paperless-ngx:2.18.2
@@ -16,7 +16,7 @@ initContainers:
        cpu: "100m"
      limits:
        memory: "1Gi"
-        cpu: "500m"
+        cpu: "750m"
    command: ["/bin/sh", "-c"]
    args:
      - apt-get update && apt-get install -y --reinstall tesseract-ocr-rus tesseract-ocr-jpn tesseract-ocr-chi-sim tesseract-ocr-eng tesseract-ocr-ell && cp -v -r /usr/share/tesseract-ocr/5/tessdata/* /custom-tessdata/
--- a/k8s/apps/paperless/tika-values.yaml
+++ b/k8s/apps/paperless/tika-values.yaml
@@ -13,7 +13,7 @@ resources:
    cpu: "100m"
  limits:
    memory: "1Gi"
-    cpu: "500m"
+    cpu: "750m"

 service:
  type: ClusterIP
--- a/k8s/apps/pasarguard/configmap-scripts-ingress.yaml
+++ b/k8s/apps/pasarguard/configmap-scripts-ingress.yaml
@@ -0,0 +1,212 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: pasarguard-scripts-ingress
+  labels:
+    app: pasarguard-node-ingress
+data:
+  init-uuid-ingress.sh: |
+    #!/bin/bash
+    set -e
+    echo "Started"
+    # NODE_NAME is already set via environment variable
+    NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)
+
+    # Get DNS name from node label xray-public-address
+    DNS_NAME=$(kubectl get node "${NODE_NAME}" -o jsonpath='{.metadata.labels.xray-public-address}')
+
+    if [ -z "${DNS_NAME}" ]; then
+      echo "ERROR: Node ${NODE_NAME} does not have label 'xray-public-address'"
+      exit 1
+    fi
+
+    echo "Node: ${NODE_NAME}"
+    echo "DNS Name from label: ${DNS_NAME}"
+
+    # Use DNS name for ConfigMap name to ensure uniqueness
+    CONFIGMAP_NAME="node-uuid-ingress-${DNS_NAME//./-}"
+
+    echo "Checking ConfigMap: ${CONFIGMAP_NAME}"
+
+    # Check if ConfigMap exists and get UUID
+    if kubectl get configmap "${CONFIGMAP_NAME}" -n "${NAMESPACE}" &>/dev/null; then
+      echo "ConfigMap exists, reading UUID..."
+      API_KEY=$(kubectl get configmap "${CONFIGMAP_NAME}" -n "${NAMESPACE}" -o jsonpath='{.data.API_KEY}')
+
+      if [ -z "${API_KEY}" ]; then
+        echo "UUID not found in ConfigMap, generating new one..."
+        API_KEY=$(cat /proc/sys/kernel/random/uuid)
+        kubectl patch configmap "${CONFIGMAP_NAME}" -n "${NAMESPACE}" --type merge -p "{\"data\":{\"API_KEY\":\"${API_KEY}\"}}"
+      else
+        echo "Using existing UUID from ConfigMap"
+      fi
+    else
+      echo "ConfigMap does not exist, creating new one..."
+      API_KEY=$(cat /proc/sys/kernel/random/uuid)
+      kubectl create configmap "${CONFIGMAP_NAME}" -n "${NAMESPACE}" \
+        --from-literal=API_KEY="${API_KEY}" \
+        --from-literal=NODE_NAME="${NODE_NAME}"
+    fi
+
+    # Save UUID and node info to shared volume for the main container
+    echo -n "${API_KEY}" > /shared/api-key
+    echo -n "${NODE_NAME}" > /shared/node-name
+    echo -n "${CONFIGMAP_NAME}" > /shared/configmap-name
+    echo "UUID initialized: ${API_KEY}"
+    echo "Node name: ${NODE_NAME}"
+    echo "ConfigMap: ${CONFIGMAP_NAME}"
+
+    # Create Certificate for this node using DNS name from label
+    CERT_NAME="pasarguard-node-ingress-${DNS_NAME//./-}"
+
+    echo "Creating Certificate: ${CERT_NAME} for ${DNS_NAME}"
+
+    # Check if Certificate already exists
+    if ! kubectl get certificate "${CERT_NAME}" -n "${NAMESPACE}" &>/dev/null; then
+      echo "Certificate does not exist, creating..."
+      cat <<EOF | kubectl apply -f -
+    apiVersion: cert-manager.io/v1
+    kind: Certificate
+    metadata:
+      name: ${CERT_NAME}
+      namespace: ${NAMESPACE}
+    spec:
+      secretName: ${CERT_NAME}-tls
+      issuerRef:
+        name: letsencrypt
+        kind: ClusterIssuer
+      dnsNames:
+        - ${DNS_NAME}
+    EOF
+    else
+      echo "Certificate already exists"
+    fi
+
+    # Wait for certificate to be ready
+    
+    echo "Waiting for certificate to be ready..."
+    for i in {1..600}; do
+      if kubectl get secret "${CERT_NAME}-tls" -n "${NAMESPACE}" &>/dev/null; then
+        echo "Certificate secret is ready!"
+        break
+      fi
+      echo "Waiting for certificate... ($i/600)"
+      sleep 1
+    done
+
+    if ! kubectl get secret "${CERT_NAME}-tls" -n "${NAMESPACE}" &>/dev/null; then
+      echo "WARNING: Certificate secret not ready after 600 seconds"
+    else
+      # Extract certificate and key from secret to shared volume
+      echo "Extracting certificate and key..."
+      kubectl get secret "${CERT_NAME}-tls" -n "${NAMESPACE}" -o jsonpath='{.data.tls\.crt}' | base64 -d > /shared/tls.crt
+      kubectl get secret "${CERT_NAME}-tls" -n "${NAMESPACE}" -o jsonpath='{.data.tls\.key}' | base64 -d > /shared/tls.key
+      echo "Certificate and key extracted successfully."
+      cat /shared/tls.crt
+    fi
+
+    # Create ClusterIP Service for this node (pod selector based)
+    NODE_SHORT_NAME="${NODE_NAME%%.*}"
+    SERVICE_NAME="${NODE_SHORT_NAME}-ingress"
+
+    echo "Creating Service: ${SERVICE_NAME} for node ${NODE_NAME} (short: ${NODE_SHORT_NAME})"
+
+    # Create Service with pod selector including node name
+    cat <<EOF | kubectl apply -f -
+    apiVersion: v1
+    kind: Service
+    metadata:
+      name: ${SERVICE_NAME}
+      namespace: ${NAMESPACE}
+      labels:
+        app: pasarguard-node-ingress
+        node: ${NODE_NAME}
+    spec:
+      type: ClusterIP
+      selector:
+        app: pasarguard-node-ingress
+        node-name: ${NODE_SHORT_NAME}
+      ports:
+        - name: proxy
+          port: 443
+          protocol: TCP
+          targetPort: 443
+        - name: api
+          port: 62050
+          protocol: TCP
+          targetPort: 62050
+    EOF
+
+    echo "Service created: ${SERVICE_NAME}.${NAMESPACE}.svc.cluster.local"
+
+    # Create IngressRouteTCP for this DNS name with TLS passthrough
+    INGRESS_NAME="pasarguard-tcp-${DNS_NAME//./-}"
+
+    echo "Creating IngressRouteTCP: ${INGRESS_NAME} for ${DNS_NAME}"
+
+    cat <<EOF | kubectl apply -f -
+    apiVersion: traefik.io/v1alpha1
+    kind: IngressRouteTCP
+    metadata:
+      name: ${INGRESS_NAME}
+      namespace: ${NAMESPACE}
+      labels:
+        app: pasarguard-node-ingress
+        node: ${NODE_NAME}
+    spec:
+      entryPoints:
+        - websecure
+      routes:
+        - match: HostSNI(\`${DNS_NAME}\`)
+          services:
+            - name: ${SERVICE_NAME}
+              port: 443
+      tls:
+        passthrough: true
+    EOF
+
+    echo "IngressRouteTCP created: ${INGRESS_NAME}"
+    echo "Traffic to ${DNS_NAME}:443 will be routed to ${SERVICE_NAME}:443"
+
+    # Create second IngressRouteTCP for API port 62051
+    INGRESS_API_NAME="pasarguard-api-${DNS_NAME//./-}"
+
+    echo "Creating IngressRouteTCP for API: ${INGRESS_API_NAME} for ${DNS_NAME}:62051"
+
+    cat <<EOF | kubectl apply -f -
+    apiVersion: traefik.io/v1alpha1
+    kind: IngressRouteTCP
+    metadata:
+      name: ${INGRESS_API_NAME}
+      namespace: ${NAMESPACE}
+      labels:
+        app: pasarguard-node-ingress
+        node: ${NODE_NAME}
+    spec:
+      entryPoints:
+        - pasarguard-api
+      routes:
+        - match: HostSNI(\`${DNS_NAME}\`)
+          services:
+            - name: ${SERVICE_NAME}
+              port: 62050
+      tls:
+        passthrough: true
+    EOF
+
+    echo "IngressRouteTCP API created: ${INGRESS_API_NAME}"
+    echo "Traffic to ${DNS_NAME}:62051 will be routed to ${SERVICE_NAME}:62050"
+
+  pasarguard-start.sh: |
+    #!/bin/sh
+    # Read API_KEY from shared volume created by init container
+    if [ -f /shared/api-key ]; then
+      export API_KEY=$(cat /shared/api-key)
+      echo "Loaded API_KEY from shared volume"
+    else
+      echo "WARNING: API_KEY file not found, using default"
+    fi
+
+    cd /app
+    exec ./main
--- a/k8s/apps/pasarguard/daemonset-ingress.yaml
+++ b/k8s/apps/pasarguard/daemonset-ingress.yaml
@@ -0,0 +1,211 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: pasarguard-node-ingress
+  labels:
+    app: pasarguard-node-ingress
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: pasarguard-node-ingress-configmap
+  labels:
+    app: pasarguard-node-ingress
+rules:
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["get", "list", "create", "update", "patch"]
+  - apiGroups: ["cert-manager.io"]
+    resources: ["certificates"]
+    verbs: ["get", "list", "create", "update", "patch", "delete"]
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "list"]
+  - apiGroups: [""]
+    resources: ["services", "endpoints"]
+    verbs: ["get", "list", "create", "update", "patch", "delete"]
+  - apiGroups: ["traefik.io", "traefik.containo.us"]
+    resources: ["ingressroutetcps"]
+    verbs: ["get", "list", "create", "update", "patch", "delete"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get", "list", "patch", "update"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: pasarguard-node-ingress-configmap
+  labels:
+    app: pasarguard-node-ingress
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: pasarguard-node-ingress-configmap
+subjects:
+  - kind: ServiceAccount
+    name: pasarguard-node-ingress
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: pasarguard-node-ingress-reader
+  labels:
+    app: pasarguard-node-ingress
+rules:
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: pasarguard-node-ingress-reader
+  labels:
+    app: pasarguard-node-ingress
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: pasarguard-node-ingress-reader
+subjects:
+  - kind: ServiceAccount
+    name: pasarguard-node-ingress
+    namespace: pasarguard
+---
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: pasarguard-node-ingress
+  labels:
+    app: pasarguard-node-ingress
+spec:
+  selector:
+    matchLabels:
+      app: pasarguard-node-ingress
+  revisionHistoryLimit: 3
+  updateStrategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: pasarguard-node-ingress
+    spec:
+      serviceAccountName: pasarguard-node-ingress
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+            - matchExpressions:
+              - key: xray-public-address
+                operator: Exists
+      initContainers:
+        - name: label-pod
+          image: bitnami/kubectl:latest
+          env:
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+            - name: POD_NAMESPACE
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.namespace
+            - name: NODE_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+          command:
+            - /bin/bash
+            - -c
+            - |
+              # Add node label to pod
+              NODE_SHORT=$(echo ${NODE_NAME} | cut -d. -f1)
+              kubectl label pod ${POD_NAME} -n ${POD_NAMESPACE} node-name=${NODE_SHORT} --overwrite
+        - name: init-uuid
+          image: bitnami/kubectl:latest
+          env:
+            - name: GODEBUG
+              value: "x509sha1=1"
+            - name: NODE_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+          command:
+            - /bin/bash
+            - /scripts/init-uuid-ingress.sh
+          volumeMounts:
+            - name: shared-data
+              mountPath: /shared
+            - name: scripts
+              mountPath: /scripts
+      containers:
+        - name: pasarguard-node
+          image: 'pasarguard/node:v0.1.3'
+          imagePullPolicy: Always
+          command:
+            - /bin/sh
+            - /scripts/pasarguard-start.sh
+          ports:
+            - name: api
+              containerPort: 62050
+              protocol: TCP
+            - name: proxy
+              containerPort: 443
+              protocol: TCP
+          env:
+            - name: NODE_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+            - name: NODE_HOST
+              value: "0.0.0.0"
+            - name: SERVICE_PORT
+              value: "62050"
+            - name: SERVICE_PROTOCOL
+              value: "grpc"
+            - name: DEBUG
+              value: "true"
+            - name: SSL_CERT_FILE
+              value: "/shared/tls.crt"
+            - name: SSL_KEY_FILE
+              value: "/shared/tls.key"
+            - name: XRAY_EXECUTABLE_PATH
+              value: "/usr/local/bin/xray"
+            - name: XRAY_ASSETS_PATH
+              value: "/usr/local/share/xray"
+            - name: API_KEY
+              value: "change-this-to-a-secure-uuid"
+          livenessProbe:
+            tcpSocket:
+              port: 62050
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            tcpSocket:
+              port: 62050
+            initialDelaySeconds: 10
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 3
+          resources:
+            requests:
+              memory: "128Mi"
+              cpu: "100m"
+            limits:
+              memory: "512Mi"
+              cpu: "750m"
+          volumeMounts:
+            - name: shared-data
+              mountPath: /shared
+              readOnly: false
+            - name: scripts
+              mountPath: /scripts
+      volumes:
+        - name: shared-data
+          emptyDir: {}
+        - name: scripts
+          configMap:
+            name: pasarguard-scripts-ingress
+            defaultMode: 0755
--- a/k8s/apps/pasarguard/daemonset.yaml
+++ b/k8s/apps/pasarguard/daemonset.yaml
@@ -112,47 +112,8 @@ spec:
            - name: scripts
              mountPath: /scripts
      containers:
-        - name: xray-exporter
-          image: alpine:3.18
-          imagePullPolicy: IfNotPresent
-          command:
-            - /bin/sh
-            - /scripts/exporter-start.sh
-          ports:
-            - name: metrics
-              containerPort: 9550
-              protocol: TCP
-          livenessProbe:
-            httpGet:
-              path: /scrape
-              port: metrics
-            initialDelaySeconds: 60
-            periodSeconds: 30
-            timeoutSeconds: 10
-            failureThreshold: 3
-          readinessProbe:
-            httpGet:
-              path: /scrape
-              port: metrics
-            initialDelaySeconds: 45
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
-          resources:
-            requests:
-              memory: "64Mi"
-              cpu: "50m"
-            limits:
-              memory: "128Mi"
-              cpu: "100m"
-          volumeMounts:
-            - name: shared-data
-              mountPath: /shared
-              readOnly: true
-            - name: scripts
-              mountPath: /scripts
        - name: pasarguard-node
-          image: 'pasarguard/node:v0.1.1'
+          image: 'pasarguard/node:v0.1.3'
          imagePullPolicy: Always
          command:
            - /bin/sh
@@ -204,13 +165,53 @@ spec:
              cpu: "100m"
            limits:
              memory: "512Mi"
-              cpu: "500m"
+              cpu: "750m"
          volumeMounts:
            - name: shared-data
              mountPath: /shared
              readOnly: false
            - name: scripts
              mountPath: /scripts
+
+        - name: xray-exporter
+          image: alpine:3.18
+          imagePullPolicy: IfNotPresent
+          command:
+            - /bin/sh
+            - /scripts/exporter-start.sh
+          ports:
+            - name: metrics
+              containerPort: 9550
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /scrape
+              port: metrics
+            initialDelaySeconds: 60
+            periodSeconds: 30
+            timeoutSeconds: 10
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /scrape
+              port: metrics
+            initialDelaySeconds: 45
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          resources:
+            requests:
+              memory: "64Mi"
+              cpu: "50m"
+            limits:
+              memory: "128Mi"
+              cpu: "150m"
+          volumeMounts:
+            - name: shared-data
+              mountPath: /shared
+              readOnly: true
+            - name: scripts
+              mountPath: /scripts
      volumes:
        - name: shared-data
          emptyDir: {}
--- a/k8s/apps/pasarguard/deployment.yaml
+++ b/k8s/apps/pasarguard/deployment.yaml
@@ -34,7 +34,7 @@ spec:
              mountPath: /templates/subscription
      containers:
        - name: pasarguard-web
-          image: 'pasarguard/panel:v1.7.2'
+          image: 'pasarguard/panel:latest'
          imagePullPolicy: Always
          envFrom:
            - secretRef:
--- a/k8s/apps/pasarguard/external-secrets.yaml
+++ b/k8s/apps/pasarguard/external-secrets.yaml
@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: pasarguard-secrets
--- a/k8s/apps/pasarguard/kustomization.yaml
+++ b/k8s/apps/pasarguard/kustomization.yaml
@@ -9,3 +9,6 @@ resources:
  - ./certificate.yaml
  - ./configmap-scripts.yaml
  - ./servicemonitor.yaml
+  - ./configmap-scripts-ingress.yaml
+# - ./daemonset-ingress.yaml
+# - ./traefik-pasarguard-entrypoint.yaml
--- a/k8s/apps/pasarguard/traefik-pasarguard-entrypoint.yaml
+++ b/k8s/apps/pasarguard/traefik-pasarguard-entrypoint.yaml
@@ -0,0 +1,66 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: traefik
+  namespace: kube-system
+spec:
+  template:
+    spec:
+      containers:
+      - name: traefik
+        args:
+        - --entryPoints.metrics.address=:9100/tcp
+        - --entryPoints.traefik.address=:8080/tcp
+        - --entryPoints.web.address=:8000/tcp
+        - --entryPoints.websecure.address=:8443/tcp
+        - --entryPoints.pasarguard-api.address=:62051/tcp
+        - --api.dashboard=true
+        - --ping=true
+        - --metrics.prometheus=true
+        - --metrics.prometheus.entrypoint=metrics
+        - --providers.kubernetescrd
+        - --providers.kubernetescrd.allowEmptyServices=true
+        - --providers.kubernetesingress
+        - --providers.kubernetesingress.allowEmptyServices=true
+        - --providers.kubernetesingress.ingressendpoint.publishedservice=kube-system/traefik
+        - --entryPoints.websecure.http.tls=true
+        - --log.level=INFO
+        - --entryPoints.web.transport.respondingTimeouts.readTimeout=0s
+        - --entryPoints.websecure.transport.respondingTimeouts.readTimeout=0s
+        ports:
+        - containerPort: 9100
+          name: metrics
+          protocol: TCP
+        - containerPort: 8080
+          name: traefik
+          protocol: TCP
+        - containerPort: 8000
+          name: web
+          protocol: TCP
+        - containerPort: 8443
+          name: websecure
+          protocol: TCP
+        - containerPort: 62051
+          name: pasarguard-api
+          protocol: TCP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: traefik
+  namespace: kube-system
+spec:
+  ports:
+  - name: web
+    port: 80
+    protocol: TCP
+    targetPort: web
+  - name: websecure
+    port: 443
+    protocol: TCP
+    targetPort: websecure
+  - name: pasarguard-api
+    port: 62051
+    protocol: TCP
+    targetPort: pasarguard-api
--- a/k8s/apps/remnawave/app.yaml
+++ b/k8s/apps/remnawave/app.yaml
@@ -0,0 +1,21 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: remnawave
+  namespace: argocd
+spec:
+  project: apps
+  destination:
+    namespace: remnawave
+    server: https://kubernetes.default.svc
+  source:
+    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
+    targetRevision: HEAD
+    path: k8s/apps/remnawave
+  syncPolicy:
+    automated:
+      selfHeal: true
+      prune: true
+    syncOptions:
+      - CreateNamespace=true
+
--- a/k8s/apps/remnawave/deployment.yaml
+++ b/k8s/apps/remnawave/deployment.yaml
@@ -0,0 +1,71 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: remnawave
+  labels:
+    app: remnawave
+  annotations:
+    reloader.stakater.com/auto: "true"
+spec:
+  selector:
+    matchLabels:
+      app: remnawave
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: remnawave
+    spec:
+      containers:
+        - name: remnawave
+          image: 'remnawave/backend:2'
+          imagePullPolicy: Always
+          envFrom:
+            - secretRef:
+                name: remnawave-secrets
+          env:
+            - name: REDIS_URL
+              value: "redis://remnawave-redis:6379"
+          ports:
+            - name: http
+              containerPort: 3000
+              protocol: TCP
+            - name: metrics
+              containerPort: 3001
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 3001
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 3001
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: remnawave
+spec:
+  selector:
+    app: remnawave
+  ports:
+    - name: http
+      protocol: TCP
+      port: 3000
+      targetPort: 3000
+    - name: metrics
+      protocol: TCP
+      port: 3001
+      targetPort: 3001
--- a/k8s/apps/remnawave/external-secrets.yaml
+++ b/k8s/apps/remnawave/external-secrets.yaml
@@ -0,0 +1,70 @@
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: remnawave-secrets
+spec:
+  target:
+    name: remnawave-secrets
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        METRICS_USER: admin
+        FRONT_END_DOMAIN: rw.hexor.cy
+        SUB_PUBLIC_DOMAIN: sub.hexor.cy
+        REDIS_HOST: remnawave-redis
+        REDIS_PORT: "6379"
+
+        DATABASE_URL: |-
+          postgresql://remnawave:{{ .pg_pass }}@psql.psql.svc:5432/remnawave
+        JWT_AUTH_SECRET: |-
+          {{ .jwt_auth_secret }}
+        JWT_API_TOKENS_SECRET: |-
+          {{ .jwt_api_tokens_secret }}
+        METRICS_PASS: |-
+          {{ .metrics_pass }}
+        WEBHOOK_SECRET_HEADER: |-
+          {{ .webhook_secret }}
+
+  data:
+    - secretKey: pg_pass
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 2a9deb39-ef22-433e-a1be-df1555625e22
+        property: fields[10].value
+    - secretKey: jwt_auth_secret
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 0d090436-5e82-453a-914c-19cec2abded1
+        property: fields[0].value
+    - secretKey: jwt_api_tokens_secret
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 0d090436-5e82-453a-914c-19cec2abded1
+        property: fields[1].value
+    - secretKey: metrics_pass
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 0d090436-5e82-453a-914c-19cec2abded1
+        property: fields[2].value
+    - secretKey: webhook_secret
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 0d090436-5e82-453a-914c-19cec2abded1
+        property: fields[3].value
--- a/k8s/apps/remnawave/kustomization.yaml
+++ b/k8s/apps/remnawave/kustomization.yaml
@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - ./external-secrets.yaml
+  - ./deployment.yaml
+  - ./redis-deployment.yaml
+  - ./subscription-page-configmap.yaml
+  - ./subscription-page-deployment.yaml
+  - ./servicemonitor.yaml
+  - ./user-ui-ingress.yaml
+  - ./panel-ingress.yaml
--- a/k8s/apps/remnawave/panel-ingress.yaml
+++ b/k8s/apps/remnawave/panel-ingress.yaml
@@ -0,0 +1,37 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: panel-ui
+  annotations:
+    ingressClassName: traefik
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
+    acme.cert-manager.io/http01-edit-in-place: "true"
+spec:
+  rules:
+    - host: rw.hexor.cy
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: remnawave
+                port:
+                  number: 3000
+    - host: rw.hexor.ru
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: remnawave
+                port:
+                  number: 3000
+  tls:
+    - secretName: remnawave-panel-tls
+      hosts:
+        - rw.hexor.cy
+        - rw.hexor.ru
--- a/k8s/apps/remnawave/redis-deployment.yaml
+++ b/k8s/apps/remnawave/redis-deployment.yaml
@@ -0,0 +1,71 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: remnawave-redis
+  labels:
+    app: remnawave-redis
+spec:
+  selector:
+    matchLabels:
+      app: remnawave-redis
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: remnawave-redis
+    spec:
+      containers:
+        - name: redis
+          image: 'valkey/valkey:8.1-alpine'
+          imagePullPolicy: Always
+          ports:
+            - name: redis
+              containerPort: 6379
+              protocol: TCP
+          livenessProbe:
+            exec:
+              command:
+                - valkey-cli
+                - ping
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            exec:
+              command:
+                - valkey-cli
+                - ping
+            initialDelaySeconds: 5
+            periodSeconds: 5
+            timeoutSeconds: 3
+            failureThreshold: 3
+          volumeMounts:
+            - name: redis-data
+              mountPath: /data
+          resources:
+            requests:
+              memory: "64Mi"
+              cpu: "50m"
+            limits:
+              memory: "256Mi"
+              cpu: "200m"
+      volumes:
+        - name: redis-data
+          emptyDir: {}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: remnawave-redis
+spec:
+  selector:
+    app: remnawave-redis
+  ports:
+    - name: redis
+      protocol: TCP
+      port: 6379
+      targetPort: 6379
--- a/k8s/apps/remnawave/servicemonitor.yaml
+++ b/k8s/apps/remnawave/servicemonitor.yaml
@@ -0,0 +1,21 @@
+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: remnawave-metrics
+  labels:
+    app: remnawave
+    release: prometheus
+spec:
+  selector:
+    matchLabels:
+      app: remnawave
+  endpoints:
+    - port: metrics
+      path: /metrics
+      interval: 30s
+      scrapeTimeout: 10s
+      honorLabels: true
+  namespaceSelector:
+    matchNames:
+      - remnawave
--- a/k8s/apps/remnawave/subscription-page-configmap.yaml
+++ b/k8s/apps/remnawave/subscription-page-configmap.yaml
@@ -0,0 +1,27 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: remnawave-subscription-page-config
+  labels:
+    app: remnawave-subscription-page
+data:
+  APP_PORT: "3010"
+  REMNAWAVE_PANEL_URL: "https://rw.hexor.cy"
+  META_TITLE: "RemnaWave Subscription"
+  META_DESCRIPTION: "Your VPN subscription portal"
+  META_KEYWORDS: "vpn,subscription,remnawave"
+  META_AUTHOR: "RemnaWave"
+  ENABLE_ANALYTICS: "false"
+  ANALYTICS_MEASUREMENT_ID: ""
+  CUSTOM_SUB_PREFIX: ""
+  THEME: "dark"
+  CUSTOM_LOGO_URL: ""
+  SHOW_SUBSCRIPTION_INFO: "true"
+  SHOW_CONNECTION_INFO: "true"
+  SHOW_QR_CODE: "true"
+  QR_CODE_SIZE: "256"
+  REFRESH_INTERVAL: "30000"
+  SUBSCRIPTION_TEXT_COLOR: "#ffffff"
+  BACKGROUND_COLOR: "#1a1a1a"
+  ACCENT_COLOR: "#007bff"
--- a/k8s/apps/remnawave/subscription-page-deployment.yaml
+++ b/k8s/apps/remnawave/subscription-page-deployment.yaml
@@ -0,0 +1,52 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: remnawave-subscription-page
+  labels:
+    app: remnawave-subscription-page
+spec:
+  selector:
+    matchLabels:
+      app: remnawave-subscription-page
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: remnawave-subscription-page
+    spec:
+      containers:
+        - name: subscription-page
+          image: 'remnawave/subscription-page:latest'
+          imagePullPolicy: Always
+          envFrom:
+            - configMapRef:
+                name: remnawave-subscription-page-config
+          ports:
+            - name: http
+              containerPort: 3010
+              protocol: TCP
+          resources:
+            requests:
+              memory: "64Mi"
+              cpu: "50m"
+            limits:
+              memory: "256Mi"
+              cpu: "200m"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: remnawave-subscription-page
+  labels:
+    app: remnawave-subscription-page
+spec:
+  selector:
+    app: remnawave-subscription-page
+  ports:
+    - name: http
+      protocol: TCP
+      port: 3010
+      targetPort: 3010
--- a/k8s/apps/remnawave/user-ui-ingress.yaml
+++ b/k8s/apps/remnawave/user-ui-ingress.yaml
@@ -0,0 +1,37 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: user-ui
+  annotations:
+    ingressClassName: traefik
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
+    acme.cert-manager.io/http01-edit-in-place: "true"
+spec:
+  rules:
+    - host: sub.hexor.cy
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: remnawave-subscription-page
+                port:
+                  number: 3010
+    - host: sub.hexor.ru
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: remnawave-subscription-page
+                port:
+                  number: 3010
+  tls:
+    - secretName: remnawave-user-ui-tls
+      hosts:
+        - sub.hexor.cy
+        - sub.hexor.ru
--- a/k8s/apps/rustdesk/deployment.yaml
+++ b/k8s/apps/rustdesk/deployment.yaml
@@ -27,7 +27,7 @@ spec:
            cpu: "100m"
          limits:
            memory: "512Mi"
-            cpu: "500m"
+            cpu: "750m"
        command: ["hbbs"]
        args:
          - "--relay-servers"
@@ -98,7 +98,7 @@ spec:
            cpu: "100m"
          limits:
            memory: "512Mi"
-            cpu: "500m"
+            cpu: "750m"
        command: ["hbbr"]
        args:
          - "--port"
--- a/k8s/apps/rustdesk/external-secrets.yaml
+++ b/k8s/apps/rustdesk/external-secrets.yaml
@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: rustdesk-keys
--- a/k8s/apps/sonarr-stack/bazarr-values.yaml
+++ b/k8s/apps/sonarr-stack/bazarr-values.yaml
@@ -4,7 +4,7 @@ resources:
    cpu: "100m"
  limits:
    memory: "1Gi"
-    cpu: "500m"
+    cpu: "750m"
 nodeSelector:
  kubernetes.io/hostname: master.tail2fe2d.ts.net

--- a/k8s/apps/sonarr-stack/prowlarr-values.yaml
+++ b/k8s/apps/sonarr-stack/prowlarr-values.yaml
@@ -6,7 +6,7 @@ resources:
    cpu: "100m"
  limits:
    memory: "1Gi"
-    cpu: "500m"
+    cpu: "750m"
 nodeSelector:
  kubernetes.io/hostname: master.tail2fe2d.ts.net

--- a/k8s/apps/sonarr-stack/sonarr-values.yaml
+++ b/k8s/apps/sonarr-stack/sonarr-values.yaml
@@ -6,7 +6,7 @@ resources:
    cpu: "200m"
  limits:
    memory: "2Gi"
-    cpu: "1000m"
+    cpu: "1500m"
 nodeSelector:
  kubernetes.io/hostname: master.tail2fe2d.ts.net

--- a/k8s/apps/stirling-pdf/values.yaml
+++ b/k8s/apps/stirling-pdf/values.yaml
@@ -33,7 +33,7 @@ resources:
    cpu: "200m"
  limits:
    memory: "2Gi"
-    cpu: "1000m"
+    cpu: "1500m"

 probes:
  liveness:
--- a/k8s/apps/tg-bots/external-secrets.yaml
+++ b/k8s/apps/tg-bots/external-secrets.yaml
@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: get-id-bot
@@ -24,7 +24,7 @@ spec:
        property: fields[0].value

 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: desubot
--- a/k8s/apps/tg-bots/get-id-bot.yaml
+++ b/k8s/apps/tg-bots/get-id-bot.yaml
@@ -30,7 +30,7 @@ spec:
                name: get-id-bot
          env:
            - name: RUST_LOG
-              value: "info"
+              value: "info,teloxide::error_handlers=off"



--- a/k8s/apps/tg-bots/kustomization.yaml
+++ b/k8s/apps/tg-bots/kustomization.yaml
@@ -7,3 +7,4 @@ resources:
  - get-id-bot.yaml
  - external-secrets.yaml
  - desubot.yaml
+  - restart-job.yaml
--- a/k8s/apps/tg-bots/restart-job.yaml
+++ b/k8s/apps/tg-bots/restart-job.yaml
@@ -0,0 +1,56 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: tg-bots-restart-sa
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: tg-bots-restart-role
+rules:
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
+    verbs: ["get", "patch"]
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: tg-bots-restart-rb
+subjects:
+  - kind: ServiceAccount
+    name: tg-bots-restart-sa
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: tg-bots-restart-role
+
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: tg-bots-daily-restart
+spec:
+  schedule: "0 4 * * *" # every day at 04:00
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          serviceAccountName: tg-bots-restart-sa
+          restartPolicy: OnFailure
+          containers:
+            - name: kubectl
+              image: bitnami/kubectl:latest
+              env:
+                - name: POD_NAMESPACE
+                  valueFrom:
+                    fieldRef:
+                      fieldPath: metadata.namespace
+              command:
+                - /bin/sh
+                - -c
+                - |
+                  kubectl -n "$POD_NAMESPACE" rollout restart deployment/desubot
+                  kubectl -n "$POD_NAMESPACE" rollout restart deployment/get-id-bot
--- a/k8s/apps/vaultwarden/deployment.yaml
+++ b/k8s/apps/vaultwarden/deployment.yaml
@@ -37,7 +37,7 @@ spec:
              cpu: "100m"
            limits:
              memory: "1Gi"
-              cpu: "500m"
+              cpu: "750m"
          env:
            - name: DOMAIN
              value: https://vw.hexor.cy
--- a/k8s/apps/vaultwarden/external-secrets.yaml
+++ b/k8s/apps/vaultwarden/external-secrets.yaml
@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: admin-token
--- a/k8s/apps/vpn/external-secrets.yaml
+++ b/k8s/apps/vpn/external-secrets.yaml
@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: outfleet-secrets
@@ -51,7 +51,7 @@ spec:
        property: fields[1].value

 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: outline-config
--- a/k8s/apps/vpn/xray.yaml
+++ b/k8s/apps/vpn/xray.yaml
@@ -174,7 +174,7 @@ spec:
        resources:
          limits:
            memory: "512Mi"
-            cpu: "500m"
+            cpu: "750m"
          requests:
            memory: "256Mi"
            cpu: "250m"
--- a/k8s/core/argocd/external-secrets.yaml
+++ b/k8s/core/argocd/external-secrets.yaml
@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: oidc-creds
--- a/k8s/core/argocd/kustomization.yaml
+++ b/k8s/core/argocd/kustomization.yaml
@@ -10,7 +10,7 @@ resources:
 helmCharts:
  - name: argo-cd
    repo: https://argoproj.github.io/argo-helm
-    version: 8.1.3
+    version: 9.1.4
    releaseName: argocd
    namespace: argocd
    valuesFile: values.yaml
--- a/k8s/core/authentik/external-secrets.yaml
+++ b/k8s/core/authentik/external-secrets.yaml
@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: authentik-creds
--- a/k8s/core/authentik/values.yaml
+++ b/k8s/core/authentik/values.yaml
@@ -47,6 +47,7 @@ server:
        - minecraft.hexor.cy # Minecraft UI and server
        - pass.hexor.cy      # k8s-secret for openai
        - ps.hexor.cy        # pasarguard UI
+#       - rw.hexor.cy        # RemnaWave UI
      tls:
        - secretName: idm-tls
          hosts:
--- a/k8s/core/cert-manager/external-secrets.yaml
+++ b/k8s/core/cert-manager/external-secrets.yaml
@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: cloudflare-creds
@@ -22,7 +22,7 @@ spec:
        key: 8ae1dcb1-1182-48a1-8733-ca1144ea754b
        property: fields[0].value
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: aws-creds
--- a/k8s/core/cert-manager/kustomization.yaml
+++ b/k8s/core/cert-manager/kustomization.yaml
@@ -10,7 +10,7 @@ resources:
 helmCharts:
  - name: cert-manager
    repo: https://charts.jetstack.io
-    version: 1.17.1
+    version: 1.19.1
    releaseName: cert-manager
    namespace: cert-manager
    valuesFile: values.yaml
--- a/k8s/core/cert-manager/values.yaml
+++ b/k8s/core/cert-manager/values.yaml
@@ -1,2 +1,6 @@
 crds:
  enabled: true
+prometheus:
+  enabled: true
+  servicemonitor:
+    enabled: true
--- a/k8s/core/external-secrets/app.yaml
+++ b/k8s/core/external-secrets/app.yaml
@@ -18,4 +18,4 @@ spec:
      prune: true
    syncOptions:
      - CreateNamespace=true
-
+      - ServerSideApply=true
--- a/k8s/core/external-secrets/bitwarden-store.yaml
+++ b/k8s/core/external-secrets/bitwarden-store.yaml
@@ -128,7 +128,7 @@ spec:
              app.kubernetes.io/name: external-secrets

 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ClusterSecretStore
 metadata:
  name: vaultwarden-login
@@ -141,7 +141,7 @@ spec:
      result:
        jsonPath: "$.data.{{ .remoteRef.property }}"
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ClusterSecretStore
 metadata:
  name: vaultwarden-fields
--- a/k8s/core/external-secrets/kustomization.yaml
+++ b/k8s/core/external-secrets/kustomization.yaml
@@ -2,13 +2,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization

 resources:
-  - app.yaml
  - bitwarden-store.yaml

 helmCharts:
  - name: external-secrets
    repo: https://charts.external-secrets.io
-    version: 0.16.2
+    version: 1.1.0
    releaseName: external-secrets
    namespace: external-secrets
    valuesFile: values.yaml
--- a/k8s/core/postgresql/external-secrets.yaml
+++ b/k8s/core/postgresql/external-secrets.yaml
@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: postgres-creds
@@ -90,7 +90,7 @@ spec:
        key: 832042b9-7edb-4f4c-9254-3c8884ba9733
        property: fields[2].value
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: postgres-users
@@ -119,6 +119,10 @@ spec:
          {{ .outfleet_rs }}
        USER_pasarguard: |-
          {{ .pasarguard }}
+        USER_remnawave: |-
+          {{ .remnawave }}
+        USER_umami: |-
+          {{ .umami }}
  data:
    - secretKey: authentik
      sourceRef:
@@ -219,3 +223,25 @@ spec:
        metadataPolicy: None
        key: 2a9deb39-ef22-433e-a1be-df1555625e22
        property: fields[9].value
+    - secretKey: remnawave
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: 2a9deb39-ef22-433e-a1be-df1555625e22
+        property: fields[10].value
+    - secretKey: umami
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: 2a9deb39-ef22-433e-a1be-df1555625e22
+        property: fields[11].value
--- a/k8s/core/postgresql/pgadmin4-values.yaml
+++ b/k8s/core/postgresql/pgadmin4-values.yaml
@@ -1,5 +1,5 @@
 image:
-  tag: "9.9"
+  tag: "latest"
  pullPolicy: Always
 env:
  email: "postgres@hexor.cy"
--- a/k8s/core/prom-stack/external-secrets.yaml
+++ b/k8s/core/prom-stack/external-secrets.yaml
@@ -1,5 +1,5 @@
 ---
-apiVersion: external-secrets.io/v1beta1
+apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: grafana-admin
--- a/k8s/core/prom-stack/kustomization.yaml
+++ b/k8s/core/prom-stack/kustomization.yaml
@@ -9,7 +9,7 @@ resources:
 helmCharts:
  - name: kube-prometheus-stack
    repo: https://prometheus-community.github.io/helm-charts
-    version: 70.4.2
+    version: 79.7.1
    releaseName: prometheus
    namespace: prometheus
    valuesFile: prom-values.yaml
@@ -17,7 +17,7 @@ helmCharts:

  - name: grafana
    repo: https://grafana.github.io/helm-charts
-    version: 8.11.4
+    version: 10.2.0
    releaseName: grafana
    namespace: prometheus
    valuesFile: grafana-values.yaml
--- a/k8s/core/system-upgrade/plan.yaml
+++ b/k8s/core/system-upgrade/plan.yaml
@@ -16,7 +16,7 @@ spec:
  serviceAccountName: system-upgrade
  upgrade:
    image: rancher/k3s-upgrade
-  version: v1.34.1+k3s1
+  version: v1.34.2+k3s1
 ---
 # Agent plan
 apiVersion: upgrade.cattle.io/v1
@@ -39,5 +39,5 @@ spec:
  serviceAccountName: system-upgrade
  upgrade:
    image: rancher/k3s-upgrade
-  version: v1.34.1+k3s1
+  version: v1.34.2+k3s1

--- a/terraform/authentik/providers.tf
+++ b/terraform/authentik/providers.tf
@@ -8,6 +8,6 @@ terraform {
 }

 provider "authentik" {
-  url   = "https://idm.hexor.cy"
-  token = "qXcuoCg77JaRgqnU6rqIIBa8MBJ4UNyLPTL89dZI8zeC2jfaWqQ7k56BJs8F"
+  url   = var.authentik_url
+  token = var.authentik_token
 }
--- a/terraform/authentik/proxy-apps.tfvars
+++ b/terraform/authentik/proxy-apps.tfvars
@@ -129,12 +129,12 @@ EOT
    access_groups                = ["admins"]
  }

-  "syncthing-master" = {
-    name                         = "Syncthing-master"
-    slug                         = "syncthing-master"
+  "syncthing-router" = {
+    name                         = "Syncthing"
+    slug                         = "syncthing"
    group                        = "Media and Storage"
    external_host                = "https://ss.hexor.cy"
-    internal_host                = "https://syncthing-master.syncthing.svc:8384"
+    internal_host                = "http://syncthing-router.syncthing.svc:80"
    internal_host_ssl_validation = false
    meta_description             = ""
    meta_icon                    = "https://img.icons8.com/?size=100&id=Id4NcEcXcYzF&format=png&color=000000"
@@ -198,7 +198,7 @@ EOT
    skip_path_regex              = <<-EOT
 /sub/
 /dashboard/
-/
+/api/
 EOT
    meta_icon                    = "https://img.icons8.com/?size=100&id=fqAD3lAB6zTe&format=png&color=000000"
    mode                         = "proxy"
--- a/terraform/authentik/variables.tf
+++ b/terraform/authentik/variables.tf
@@ -166,3 +166,9 @@ variable "authentik_url" {
  type        = string
  default     = "https://idm.hexor.cy"
 }
+
+variable "authentik_token" {
+  description = "Authentik API token (set via TF_VAR_authentik_token env var)"
+  type        = string
+  sensitive   = true
+}