Auto-update README with current k8s applications

Generated by CI/CD workflow on 2026-02-04 00:01:16 This PR updates the README.md file with the current list of applications found in the k8s/ directory structure.
Fixed n8n permissions
2026-02-04 00:01:16 +00:00 · 2026-02-04 02:00:54 +02:00 · 2026-02-04 01:54:44 +02:00 · 2026-02-04 01:52:16 +02:00 · 2026-02-04 01:49:56 +02:00 · 2026-02-03 23:44:31 +00:00
70 changed files with 1686 additions and 204 deletions
--- a/.gitea/workflows/authentik-apps.yaml
+++ b/.gitea/workflows/authentik-apps.yaml
@@ -30,21 +30,29 @@ jobs:
        cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}

    - name: Terraform Init
+      env:
+        TF_VAR_authentik_token: ${{ secrets.AUTHENTIK_TOKEN }}
      run: terraform init
      working-directory: ./terraform/authentik

    - name: Terraform Format
+      env:
+        TF_VAR_authentik_token: ${{ secrets.AUTHENTIK_TOKEN }}
      run: terraform fmt -check
      continue-on-error: true
      working-directory: ./terraform/authentik

    - name: Terraform Apply
+      env:
+        TF_VAR_authentik_token: ${{ secrets.AUTHENTIK_TOKEN }}
      run: terraform apply -var-file proxy-apps.tfvars -var-file oauth2-apps.tfvars -var-file terraform.tfvars -var-file groups.tfvars -input=false -auto-approve -parallelism=100
      working-directory: ./terraform/authentik

    - name: Generate Wiki Content  
      if: success()
      continue-on-error: true
+      env:
+        TF_VAR_authentik_token: ${{ secrets.AUTHENTIK_TOKEN }}
      run: |
        echo "📋 Starting Wiki generation..."
        cd ./terraform/authentik
--- a/.gitea/workflows/k8s-wiki.yaml
+++ b/.gitea/workflows/k8s-wiki.yaml
@@ -22,12 +22,13 @@ jobs:

    - name: Install Python dependencies
      run: |
-        pip install pyyaml
+        python3 -m venv .venv
+        .venv/bin/pip install pyyaml

    - name: Generate K8s Services Wiki
      run: |
        echo "📋 Starting K8s wiki generation..."
-        python3 .gitea/scripts/generate-k8s-wiki.py k8s/ Kubernetes-Services.md
+        .venv/bin/python .gitea/scripts/generate-k8s-wiki.py k8s/ Kubernetes-Services.md
        
        if [ -f "Kubernetes-Services.md" ]; then
          echo "✅ Wiki content generated successfully"
--- a/README.md
+++ b/README.md
@@ -44,10 +44,12 @@ ArgoCD homelab project
 | **jellyfin** | [![jellyfin](https://ag.hexor.cy/api/badge?name=jellyfin&revision=true)](https://ag.hexor.cy/applications/argocd/jellyfin) |
 | **k8s-secrets** | [![k8s-secrets](https://ag.hexor.cy/api/badge?name=k8s-secrets&revision=true)](https://ag.hexor.cy/applications/argocd/k8s-secrets) |
 | **khm** | [![khm](https://ag.hexor.cy/api/badge?name=khm&revision=true)](https://ag.hexor.cy/applications/argocd/khm) |
+| **n8n** | [![n8n](https://ag.hexor.cy/api/badge?name=n8n&revision=true)](https://ag.hexor.cy/applications/argocd/n8n) |
 | **ollama** | [![ollama](https://ag.hexor.cy/api/badge?name=ollama&revision=true)](https://ag.hexor.cy/applications/argocd/ollama) |
 | **paperless** | [![paperless](https://ag.hexor.cy/api/badge?name=paperless&revision=true)](https://ag.hexor.cy/applications/argocd/paperless) |
 | **pasarguard** | [![pasarguard](https://ag.hexor.cy/api/badge?name=pasarguard&revision=true)](https://ag.hexor.cy/applications/argocd/pasarguard) |
 | **qbittorent-nas** | [![qbittorent-nas](https://ag.hexor.cy/api/badge?name=qbittorent-nas&revision=true)](https://ag.hexor.cy/applications/argocd/qbittorent-nas) |
+| **remnawave** | [![remnawave](https://ag.hexor.cy/api/badge?name=remnawave&revision=true)](https://ag.hexor.cy/applications/argocd/remnawave) |
 | **rustdesk** | [![rustdesk](https://ag.hexor.cy/api/badge?name=rustdesk&revision=true)](https://ag.hexor.cy/applications/argocd/rustdesk) |
 | **sonarr-stack** | [![sonarr-stack](https://ag.hexor.cy/api/badge?name=sonarr-stack&revision=true)](https://ag.hexor.cy/applications/argocd/sonarr-stack) |
 | **stirling-pdf** | [![stirling-pdf](https://ag.hexor.cy/api/badge?name=stirling-pdf&revision=true)](https://ag.hexor.cy/applications/argocd/stirling-pdf) |
@@ -55,6 +57,7 @@ ArgoCD homelab project
 | **tg-bots** | [![tg-bots](https://ag.hexor.cy/api/badge?name=tg-bots&revision=true)](https://ag.hexor.cy/applications/argocd/tg-bots) |
 | **vaultwarden** | [![vaultwarden](https://ag.hexor.cy/api/badge?name=vaultwarden&revision=true)](https://ag.hexor.cy/applications/argocd/vaultwarden) |
 | **vpn** | [![vpn](https://ag.hexor.cy/api/badge?name=vpn&revision=true)](https://ag.hexor.cy/applications/argocd/vpn) |
+| **xandikos** | [![xandikos](https://ag.hexor.cy/api/badge?name=xandikos&revision=true)](https://ag.hexor.cy/applications/argocd/xandikos) |

 </td>
 </tr>
--- a/k8s/apps/gitea/deployment.yaml
+++ b/k8s/apps/gitea/deployment.yaml
@@ -77,8 +77,8 @@ spec:
      labels:
        app: gitea-runner
    spec:
-      nodeSelector:
-        kubernetes.io/hostname: home.homenet
+      #nodeSelector:
+      #  kubernetes.io/hostname: home.homenet
      volumes:
        - name: docker-sock
          hostPath:
@@ -90,27 +90,30 @@ spec:
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
-          - weight: 3
-            preference:
-              matchExpressions:
-              - key: kubernetes.io/hostname
-                operator: In
-                values:
-                - home.homenet
          - weight: 1
            preference:
              matchExpressions:
              - key: kubernetes.io/hostname
                operator: In
                values:
-                - master.tail2fe2d.ts.net
+                - home.homenet
          - weight: 2
            preference:
              matchExpressions:
              - key: kubernetes.io/hostname
                operator: In
                values:
-                - nas.homenet
+                - master.tail2fe2d.ts.net
+          - weight: 3
+            preference:
+              matchExpressions:
+              - key: kubernetes.io/hostname
+                operator: In
+                values:
+                - it.tail2fe2d.ts.net
+                - ch.tail2fe2d.ts.net
+                - us.tail2fe2d.ts.net
+
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
            - matchExpressions:
@@ -118,7 +121,9 @@ spec:
                operator: In
                values:
                - home.homenet
-                - nas.homenet
+                - it.tail2fe2d.ts.net
+                - ch.tail2fe2d.ts.net
+                - us.tail2fe2d.ts.net
                - master.tail2fe2d.ts.net
      containers:
        - name: gitea-runner
--- a/k8s/apps/immich/deployments.yaml
+++ b/k8s/apps/immich/deployments.yaml
@@ -74,19 +74,14 @@ spec:
                - nas.homenet
      volumes:
      - name: upload-storage
-        nfs:
-          server: nas.homenet
-          path: /mnt/storage/Storage/k8s/immich/library/
-          readOnly: false
+        persistentVolumeClaim:
+          claimName: immich-upload-pvc
      - name: gphoto-storage
-        nfs:
-          server: nas.homenet
-          path: /mnt/storage/Storage/k8s/immich/GPHOTO/
-          readOnly: false
+        persistentVolumeClaim:
+          claimName: immich-gphoto-pvc
      - name: camera
-        nfs:
-          server: nas.homenet
-          path: /mnt/storage/Storage/Syncthing-repos/PhoneCamera/
+        persistentVolumeClaim:
+          claimName: immich-camera-pvc
          readOnly: true
      - name: localtime
        hostPath:
--- a/k8s/apps/immich/volumes.yaml
+++ b/k8s/apps/immich/volumes.yaml
@@ -1,79 +1,52 @@
 ---
 apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: immich-upload-pv
-spec:
-  capacity:
-    storage: 500Gi
-  accessModes:
-    - ReadWriteOnce
-  hostPath:
-    path: /mnt/storage/Storage/k8s/immich/library
---
-apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
  name: immich-upload-pvc
  namespace: immich
 spec:
-  storageClassName: ""
  accessModes:
-    - ReadWriteOnce
-  volumeName: immich-upload-pv
+    - ReadWriteMany
+  storageClassName: nfs-csi
  resources:
    requests:
      storage: 500Gi
 ---
 apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: immich-gphoto-pv
-spec:
-  capacity:
-    storage: 500Gi
-  accessModes:
-    - ReadWriteOnce
-  hostPath:
-    path: /mnt/storage/Storage/k8s/immich/GPHOTO
---
-apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
  name: immich-gphoto-pvc
  namespace: immich
 spec:
-  storageClassName: ""
  accessModes:
-    - ReadWriteOnce
-  volumeName: immich-gphoto-pv
+    - ReadWriteMany
+  storageClassName: nfs-csi
  resources:
    requests:
      storage: 500Gi
 ---
 apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: immich-db-pv
-spec:
-  capacity:
-    storage: 10Gi
-  accessModes:
-    - ReadWriteOnce
-  hostPath:
-    path: /mnt/storage/Storage/k8s/immich/db
---
-apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
  name: immich-db-pvc
  namespace: immich
 spec:
-  storageClassName: ""
  accessModes:
-    - ReadWriteOnce
-  volumeName: immich-db-pv
+    - ReadWriteMany
+  storageClassName: nfs-csi
  resources:
    requests:
      storage: 10Gi
-
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: immich-camera-pvc
+  namespace: immich
+spec:
+  accessModes:
+    - ReadOnlyMany
+  storageClassName: nfs-csi
+  resources:
+    requests:
+      storage: 100Gi
--- a/k8s/apps/jellyfin/values.yaml
+++ b/k8s/apps/jellyfin/values.yaml
@@ -1,5 +1,5 @@
 image:
-  tag: 10.10.7
+  tag: 10.11.4
 resources:
  requests:
    memory: "2Gi"
@@ -36,8 +36,40 @@ ingress:
        paths:
          - path: /
            pathType: Prefix
+      - host: us.hexor.cy
+        paths:
+          - path: /
+            pathType: Prefix
+      - host: ch.hexor.cy
+        paths:
+          - path: /
+            pathType: Prefix
+      - host: jp.hexor.cy
+        paths:
+          - path: /
+            pathType: Prefix
+      - host: spb.hexor.cy
+        paths:
+          - path: /
+            pathType: Prefix
+      - host: cy.hexor.cy
+        paths:
+          - path: /
+            pathType: Prefix
+      - host: am.hexor.cy
+        paths:
+          - path: /
+            pathType: Prefix
+      - host: de.hexor.cy
+        paths:
+          - path: /
+            pathType: Prefix
+      - host: it.hexor.cy
+        paths:
+          - path: /
+            pathType: Prefix
    tls:
      - secretName: jellyfin-tls
        hosts:
-          - 'jf.hexor.cy'
+          - '*.hexor.cy'

--- a/k8s/apps/k8s-secrets/deployment.yaml
+++ b/k8s/apps/k8s-secrets/deployment.yaml
@@ -19,7 +19,7 @@ spec:
        kubernetes.io/os: linux
      containers:
      - name: secret-reader
-        image: ultradesu/k8s-secrets:0.1.1
+        image: ultradesu/k8s-secrets:0.2.1
        imagePullPolicy: Always
        args:
          - "--secrets"
@@ -28,6 +28,7 @@ spec:
          - "k8s-secret"
          - "--port"
          - "3000"
+          - "--webhook"
        ports:
        - containerPort: 3000
          name: http
--- a/k8s/apps/n8n/app.yaml
+++ b/k8s/apps/n8n/app.yaml
@@ -0,0 +1,21 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: n8n
+  namespace: argocd
+spec:
+  project: apps
+  destination:
+    namespace: n8n
+    server: https://kubernetes.default.svc
+  source:
+    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
+    targetRevision: HEAD
+    path: k8s/apps/n8n
+  syncPolicy:
+    automated:
+      selfHeal: true
+      prune: true
+    syncOptions:
+      - CreateNamespace=true
+
--- a/k8s/apps/n8n/external-secrets.yaml
+++ b/k8s/apps/n8n/external-secrets.yaml
@@ -0,0 +1,39 @@
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: credentials
+spec:
+  target:
+    name: credentials
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        postgres-password: |-
+          {{ .psql }}
+        N8N_ENCRYPTION_KEY: |-
+          {{ .enc_pass }}
+  data:
+    - secretKey: psql
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: 2a9deb39-ef22-433e-a1be-df1555625e22
+        property: fields[13].value
+    - secretKey: enc_pass
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: 18c92d73-9637-4419-8642-7f7b308460cb
+        property: fields[0].value
--- a/k8s/apps/n8n/kustomization.yaml
+++ b/k8s/apps/n8n/kustomization.yaml
@@ -0,0 +1,22 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - external-secrets.yaml
+  - storage.yaml
+
+helmCharts:
+  - name: n8n
+    repo: https://community-charts.github.io/helm-charts
+    version: 1.16.28
+    releaseName: n8n
+    namespace: n8n
+    valuesFile: values-n8n.yaml
+    includeCRDs: true
+  - name: searxng
+    repo: https://unknowniq.github.io/helm-charts/
+    version: 0.1.3
+    releaseName: searxng
+    namespace: n8n
+    valuesFile: values-searxng.yaml
+    includeCRDs: true
--- a/k8s/apps/n8n/storage.yaml
+++ b/k8s/apps/n8n/storage.yaml
@@ -0,0 +1,12 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: n8n-home
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: nfs-csi
+  resources:
+    requests:
+      storage: 10Gi
--- a/k8s/apps/n8n/values-n8n.yaml
+++ b/k8s/apps/n8n/values-n8n.yaml
@@ -0,0 +1,65 @@
+nodeSelector:
+  kubernetes.io/hostname: master.tail2fe2d.ts.net
+
+db:
+  type: postgresdb
+
+main:
+  podSecurityContext:
+    fsGroup: 1000
+    fsGroupChangePolicy: "OnRootMismatch"
+  securityContext:
+    runAsUser: 1000
+    runAsGroup: 1000
+  resources:
+    requests:
+      cpu: 100m
+      memory: 128Mi
+    limits:
+      cpu: 512m
+      memory: 512Mi
+  persistence:
+    enabled: true
+    existingClaim: n8n-home
+    mountPath: /home/node/.n8n
+
+worker:
+  mode: queue
+# persistence:
+#   enabled: true
+#   existingClaim: n8n-home
+#   mountPath: /home/node/.n8n
+
+webhook:
+  url: https://n8n.hexor.cy
+# persistence:
+#   enabled: true
+#   existingClaim: n8n-home
+#   mountPath: /home/node/.n8n
+
+redis:
+  enabled: true
+
+externalPostgresql:
+  existingSecret: postgres-password
+  host: "psql.psql.svc"
+  username: "n8n"
+  database: "n8n"
+
+ingress:
+  enabled: true
+  className: traefik
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
+
+  hosts:
+    - host: n8n.hexor.cy
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - secretName: n8n-tls
+      hosts:
+        - '*.hexor.cy'
+
--- a/k8s/apps/n8n/values-searxng.yaml
+++ b/k8s/apps/n8n/values-searxng.yaml
@@ -0,0 +1,8 @@
+config:
+  general:
+    instance_name: "HexorSearXNG"
+
+valkey:
+  enabled: true
+nodeSelector:
+  kubernetes.io/hostname: master.tail2fe2d.ts.net
--- a/k8s/apps/paperless/kustomization.yaml
+++ b/k8s/apps/paperless/kustomization.yaml
@@ -4,6 +4,7 @@ kind: Kustomization
 resources:
  - app.yaml
  - external-secrets.yaml
+  - paperless-ai.yaml

 helmCharts:
  - name: paperless-ngx
@@ -27,4 +28,11 @@ helmCharts:
    namespace: paperless
    valuesFile: gotenberg-values.yaml
    includeCRDs: true
+  #- name: redis
+  #  repo: oci://registry-1.docker.io/bitnamicharts/redis
+  #  version: 24.1.0
+  #  releaseName: redis
+  #  namespace: paperless
+  #  includeCRDs: true
+  #  valuesFile: bazarr-values.yaml

--- a/k8s/apps/paperless/paperless-ai.yaml
+++ b/k8s/apps/paperless/paperless-ai.yaml
@@ -0,0 +1,101 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: paperless-ai
+  labels:
+    app: paperless-ai
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: paperless-ai
+  template:
+    metadata:
+      labels:
+        app: paperless-ai
+    spec:
+      nodeSelector:
+        kubernetes.io/hostname: nas.homenet
+      containers:
+        - name: paperless-ai
+          image: clusterzx/paperless-ai:latest
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 3000
+              name: http
+          env:
+            - name: NODE_ENV
+              value: production
+            - name: PAPERLESS_AI_PORT
+              value: "3000"
+          resources:
+            requests:
+              memory: 512Mi
+              cpu: 500m
+            limits:
+              memory: 1024Mi
+              cpu: 2000m
+         #livenessProbe:
+         #  httpGet:
+         #    path: /
+         #    port: 8000
+         #  initialDelaySeconds: 30
+         #  periodSeconds: 10
+         #readinessProbe:
+         #  httpGet:
+         #    path: /
+         #    port: 8000
+         #  initialDelaySeconds: 5
+         #  periodSeconds: 5
+          volumeMounts:
+            - name: data
+              mountPath: /app/data
+      volumes:
+        - name: data
+          hostPath:
+            path: /mnt/storage/Storage/k8s/paperless/ai-data
+            type: DirectoryOrCreate
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: paperless-ai
+  namespace: paperless
+  labels:
+    app: paperless-ai
+spec:
+  type: ClusterIP
+  ports:
+    - port: 3000
+      targetPort: 3000
+      protocol: TCP
+      name: http
+  selector:
+    app: paperless-ai
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: paperless-ai-ingress
+  annotations:
+    ingressClassName: traefik
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
+    acme.cert-manager.io/http01-edit-in-place: "true"
+spec:
+  rules:
+    - host: ai-docs.hexor.cy
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: paperless-ai
+                port:
+                  number: 3000
+  tls:
+    - secretName: docs-tls
+      hosts:
+        - '*.hexor.cy'
--- a/k8s/apps/paperless/paperless-values.yaml
+++ b/k8s/apps/paperless/paperless-values.yaml
@@ -1,5 +1,5 @@
 image:
-  tag: 2.19.3
+  tag: 2.20.3
 resources:
  requests:
    memory: "1Gi"
@@ -107,6 +107,8 @@ persistence:
      - path: /usr/src/paperless/consume
 redis:
  enabled: true
+  image:
+    tag: latest
  master:
    nodeSelector:
      kubernetes.io/hostname: nas.homenet
--- a/k8s/apps/pasarguard/daemonset.yaml
+++ b/k8s/apps/pasarguard/daemonset.yaml
@@ -112,47 +112,8 @@ spec:
            - name: scripts
              mountPath: /scripts
      containers:
-        - name: xray-exporter
-          image: alpine:3.18
-          imagePullPolicy: IfNotPresent
-          command:
-            - /bin/sh
-            - /scripts/exporter-start.sh
-          ports:
-            - name: metrics
-              containerPort: 9550
-              protocol: TCP
-          livenessProbe:
-            httpGet:
-              path: /scrape
-              port: metrics
-            initialDelaySeconds: 60
-            periodSeconds: 30
-            timeoutSeconds: 10
-            failureThreshold: 3
-          readinessProbe:
-            httpGet:
-              path: /scrape
-              port: metrics
-            initialDelaySeconds: 45
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
-          resources:
-            requests:
-              memory: "64Mi"
-              cpu: "50m"
-            limits:
-              memory: "128Mi"
-              cpu: "150m"
-          volumeMounts:
-            - name: shared-data
-              mountPath: /shared
-              readOnly: true
-            - name: scripts
-              mountPath: /scripts
        - name: pasarguard-node
-          image: 'pasarguard/node:v0.1.1'
+          image: 'pasarguard/node:v0.2.1'
          imagePullPolicy: Always
          command:
            - /bin/sh
@@ -201,16 +162,56 @@ spec:
          resources:
            requests:
              memory: "128Mi"
-              cpu: "100m"
+              #cpu: "500m"
            limits:
              memory: "512Mi"
-              cpu: "750m"
+              #cpu: "1200m"
          volumeMounts:
            - name: shared-data
              mountPath: /shared
              readOnly: false
            - name: scripts
              mountPath: /scripts
+
+        - name: xray-exporter
+          image: alpine:3.18
+          imagePullPolicy: IfNotPresent
+          command:
+            - /bin/sh
+            - /scripts/exporter-start.sh
+          ports:
+            - name: metrics
+              containerPort: 9550
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /scrape
+              port: metrics
+            initialDelaySeconds: 60
+            periodSeconds: 30
+            timeoutSeconds: 10
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /scrape
+              port: metrics
+            initialDelaySeconds: 45
+            periodSeconds: 10
+            timeoutSeconds: 5
+            failureThreshold: 3
+          resources:
+            requests:
+              memory: "64Mi"
+              cpu: "50m"
+            limits:
+              memory: "128Mi"
+              cpu: "500m"
+          volumeMounts:
+            - name: shared-data
+              mountPath: /shared
+              readOnly: true
+            - name: scripts
+              mountPath: /scripts
      volumes:
        - name: shared-data
          emptyDir: {}
--- a/k8s/apps/pasarguard/deployment.yaml
+++ b/k8s/apps/pasarguard/deployment.yaml
@@ -34,7 +34,7 @@ spec:
              mountPath: /templates/subscription
      containers:
        - name: pasarguard-web
-          image: 'pasarguard/panel:v1.7.2'
+          image: 'pasarguard/panel:latest'
          imagePullPolicy: Always
          envFrom:
            - secretRef:
--- a/k8s/apps/remnawave/kustomization.yaml
+++ b/k8s/apps/remnawave/kustomization.yaml
@@ -8,3 +8,5 @@ resources:
  - ./subscription-page-configmap.yaml
  - ./subscription-page-deployment.yaml
  - ./servicemonitor.yaml
+  - ./user-ui-ingress.yaml
+  - ./panel-ingress.yaml
--- a/k8s/apps/remnawave/panel-ingress.yaml
+++ b/k8s/apps/remnawave/panel-ingress.yaml
@@ -0,0 +1,37 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: panel-ui
+  annotations:
+    ingressClassName: traefik
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
+    acme.cert-manager.io/http01-edit-in-place: "true"
+spec:
+  rules:
+    - host: rw.hexor.cy
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: remnawave
+                port:
+                  number: 3000
+    - host: rw.hexor.ru
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: remnawave
+                port:
+                  number: 3000
+  tls:
+    - secretName: remnawave-panel-tls
+      hosts:
+        - rw.hexor.cy
+        - rw.hexor.ru
--- a/k8s/apps/remnawave/subscription-page-configmap.yaml
+++ b/k8s/apps/remnawave/subscription-page-configmap.yaml
@@ -7,7 +7,7 @@ metadata:
    app: remnawave-subscription-page
 data:
  APP_PORT: "3010"
-  REMNAWAVE_PANEL_URL: "http://remnawave.remnawave.svc:3000"
+  REMNAWAVE_PANEL_URL: "https://rw.hexor.cy"
  META_TITLE: "RemnaWave Subscription"
  META_DESCRIPTION: "Your VPN subscription portal"
  META_KEYWORDS: "vpn,subscription,remnawave"
--- a/k8s/apps/remnawave/subscription-page-deployment.yaml
+++ b/k8s/apps/remnawave/subscription-page-deployment.yaml
@@ -28,22 +28,6 @@ spec:
            - name: http
              containerPort: 3010
              protocol: TCP
-          livenessProbe:
-            httpGet:
-              path: /
-              port: 3010
-            initialDelaySeconds: 30
-            periodSeconds: 30
-            timeoutSeconds: 5
-            failureThreshold: 3
-          readinessProbe:
-            httpGet:
-              path: /
-              port: 3010
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            timeoutSeconds: 3
-            failureThreshold: 3
          resources:
            requests:
              memory: "64Mi"
--- a/k8s/apps/remnawave/user-ui-ingress.yaml
+++ b/k8s/apps/remnawave/user-ui-ingress.yaml
@@ -2,7 +2,7 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
-  name: remnawave-tls-ingress
+  name: user-ui
  annotations:
    ingressClassName: traefik
    cert-manager.io/cluster-issuer: letsencrypt
@@ -31,7 +31,7 @@ spec:
                port:
                  number: 3010
  tls:
-    - secretName: remnawave-tls
+    - secretName: remnawave-user-ui-tls
      hosts:
        - sub.hexor.cy
        - sub.hexor.ru
--- a/k8s/apps/syncthing/kustomization.yaml
+++ b/k8s/apps/syncthing/kustomization.yaml
@@ -16,18 +16,18 @@ helmCharts:
    valuesFile: syncthing-master.yaml
    includeCRDs: true

-  - name: syncthing
-    repo: https://k8s-home-lab.github.io/helm-charts
-    version: 4.0.0
-    releaseName: syncthing-khv
-    namespace: syncthing
-    valuesFile: syncthing-khv.yaml
-    includeCRDs: true
-
  - name: syncthing
    repo: https://k8s-home-lab.github.io/helm-charts
    version: 4.0.0
    releaseName: syncthing-nas
    namespace: syncthing
    valuesFile: syncthing-nas.yaml
-    includeCRDs: true
+    includeCRDs: true
+
+#  - name: syncthing
+#    repo: https://k8s-home-lab.github.io/helm-charts
+#    version: 4.0.0
+#    releaseName: syncthing-khv
+#    namespace: syncthing
+#    valuesFile: syncthing-khv.yaml
+#    includeCRDs: true
--- a/k8s/apps/tg-bots/desubot.yaml
+++ b/k8s/apps/tg-bots/desubot.yaml
@@ -1,4 +1,3 @@
---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -23,7 +22,7 @@ spec:
        kubernetes.io/hostname: home.homenet
      containers:
        - name: desubot
-          image: 'ultradesu/desubot:latest'
+          image: "ultradesu/desubot:latest"
          imagePullPolicy: Always
          envFrom:
            - secretRef:
@@ -32,11 +31,11 @@ spec:
            - name: RUST_LOG
              value: "info"
          volumeMounts:
-          - mountPath: /storage
-            name: storage
+            - mountPath: /storage
+              name: storage
      volumes:
        - name: storage
-          nfs:
-            server: nas.homenet
-            path: /mnt/storage/Storage/k8s/desubot/
-            readOnly: false
+          persistentVolumeClaim:
+            claimName: desubot-storage
+            readOnly: false
+
--- a/k8s/apps/tg-bots/get-id-bot.yaml
+++ b/k8s/apps/tg-bots/get-id-bot.yaml
@@ -30,7 +30,7 @@ spec:
                name: get-id-bot
          env:
            - name: RUST_LOG
-              value: "info"
+              value: "info,teloxide::error_handlers=off"



--- a/k8s/apps/tg-bots/kustomization.yaml
+++ b/k8s/apps/tg-bots/kustomization.yaml
@@ -7,3 +7,6 @@ resources:
  - get-id-bot.yaml
  - external-secrets.yaml
  - desubot.yaml
+  - restart-job.yaml
+  - storage.yaml
+
--- a/k8s/apps/tg-bots/restart-job.yaml
+++ b/k8s/apps/tg-bots/restart-job.yaml
@@ -0,0 +1,56 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: tg-bots-restart-sa
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: tg-bots-restart-role
+rules:
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
+    verbs: ["get", "patch"]
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: tg-bots-restart-rb
+subjects:
+  - kind: ServiceAccount
+    name: tg-bots-restart-sa
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: tg-bots-restart-role
+
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: tg-bots-daily-restart
+spec:
+  schedule: "0 4 * * *" # every day at 04:00
+  jobTemplate:
+    spec:
+      template:
+        spec:
+          serviceAccountName: tg-bots-restart-sa
+          restartPolicy: OnFailure
+          containers:
+            - name: kubectl
+              image: bitnami/kubectl:latest
+              env:
+                - name: POD_NAMESPACE
+                  valueFrom:
+                    fieldRef:
+                      fieldPath: metadata.namespace
+              command:
+                - /bin/sh
+                - -c
+                - |
+                  kubectl -n "$POD_NAMESPACE" rollout restart deployment/desubot
+                  kubectl -n "$POD_NAMESPACE" rollout restart deployment/get-id-bot
--- a/k8s/apps/tg-bots/storage.yaml
+++ b/k8s/apps/tg-bots/storage.yaml
@@ -0,0 +1,12 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: desubot-storage
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: nfs-csi
+  resources:
+    requests:
+      storage: 200Gi
--- a/k8s/apps/xandikos/app.yaml
+++ b/k8s/apps/xandikos/app.yaml
@@ -0,0 +1,21 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: xandikos
+  namespace: argocd
+spec:
+  project: apps
+  destination:
+    namespace: xandikos
+    server: https://kubernetes.default.svc
+  source:
+    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
+    targetRevision: HEAD
+    path: k8s/apps/xandikos
+  syncPolicy:
+    automated:
+      selfHeal: true
+      prune: true
+    syncOptions:
+      - CreateNamespace=true
+
--- a/k8s/apps/xandikos/deployment.yaml
+++ b/k8s/apps/xandikos/deployment.yaml
@@ -0,0 +1,70 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: xandikos
+  labels:
+    app: xandikos
+spec:
+  selector:
+    matchLabels:
+      app: xandikos
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+  template:
+    metadata:
+      labels:
+        app: xandikos
+    spec:
+      nodeSelector:
+        kubernetes.io/hostname: master.tail2fe2d.ts.net
+      volumes:
+        - name: storage
+          hostPath:
+            path: /k8s/xandikos
+            type: Directory
+      containers:
+        - name: xandikos
+          image: ghcr.io/jelmer/xandikos:latest
+          imagePullPolicy: Always
+          command:
+            - "python3"
+            - "-m"
+            - "xandikos.web"
+            - "--port=8081"
+            - "-d/data"
+            - "--defaults"
+            - "--listen-address=0.0.0.0"
+            - "--route-prefix=/dav"
+          resources:
+            requests:
+              memory: "64Mi"
+              cpu: "100m"
+            limits:
+              memory: "512Mi"
+              cpu: "1000m"
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 8081
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 5
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 8081
+            initialDelaySeconds: 10
+            periodSeconds: 5
+            timeoutSeconds: 3
+          ports:
+            - name: http
+              containerPort: 8081
+              protocol: TCP
+          volumeMounts:
+            - name: storage
+              mountPath: /data
--- a/k8s/apps/xandikos/external-secrets.yaml
+++ b/k8s/apps/xandikos/external-secrets.yaml
@@ -0,0 +1,31 @@
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: mmdl-secrets
+spec:
+  target:
+    name: mmdl-secrets
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        DB_DIALECT: 'postgres'
+        DB_HOST: psql.psql.svc
+        DB_USER: mmdl
+        DB_NAME: mmdl
+        DB_PORT: "5432"
+        DB_PASS: |-
+          {{ .pg_pass }}
+        AES_PASSWORD: |-
+          {{ .pg_pass }}
+
+  data:
+    - secretKey: pg_pass
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 2a9deb39-ef22-433e-a1be-df1555625e22
+        property: fields[12].value
--- a/k8s/apps/xandikos/ingress.yaml
+++ b/k8s/apps/xandikos/ingress.yaml
@@ -0,0 +1,47 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: xandikos
+  annotations:
+    ingressClassName: traefik
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
+    acme.cert-manager.io/http01-edit-in-place: "true"
+spec:
+  rules:
+    - host: cal.hexor.cy
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: mmdl
+                port:
+                  number: 3000
+          - path: /dav
+            pathType: Prefix
+            backend:
+              service:
+                name: xandikos
+                port:
+                  number: 8081
+          - path: /.well-known/carddav
+            pathType: Exact
+            backend:
+              service:
+                name: xandikos
+                port:
+                  number: 8081
+          - path: /.well-known/caldav
+            pathType: Exact
+            backend:
+              service:
+                name: xandikos
+                port:
+                  number: 8081
+  tls:
+    - secretName: xandikos-tls
+      hosts:
+        - cal.hexor.cy
--- a/k8s/apps/xandikos/kustomization.yaml
+++ b/k8s/apps/xandikos/kustomization.yaml
@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - deployment.yaml
+  - service.yaml
+  - mmdl-deployment.yaml
+  - mmdl-service.yaml
+  - ingress.yaml
+  - external-secrets.yaml
+
--- a/k8s/apps/xandikos/mmdl-deployment.yaml
+++ b/k8s/apps/xandikos/mmdl-deployment.yaml
@@ -0,0 +1,61 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mmdl
+  labels:
+    app: mmdl
+spec:
+  selector:
+    matchLabels:
+      app: mmdl
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+  template:
+    metadata:
+      labels:
+        app: mmdl
+    spec:
+      nodeSelector:
+        kubernetes.io/hostname: master.tail2fe2d.ts.net
+      containers:
+        - name: mmdl
+          image: intriin/mmdl:latest
+          imagePullPolicy: Always
+          envFrom:
+            - secretRef:
+                name: mmdl-secrets
+          env:
+            - name: NEXTAUTH_URL
+              value: "https://cal.hexor.cy"
+            - name: CALDAV_SERVER_URL
+              value: "https://cal.hexor.cy/dav"
+          resources:
+            requests:
+              memory: "128Mi"
+              cpu: "100m"
+            limits:
+              memory: "512Mi"
+              cpu: "1000m"
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 3000
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 5
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 3000
+            initialDelaySeconds: 10
+            periodSeconds: 5
+            timeoutSeconds: 3
+          ports:
+            - name: http
+              containerPort: 3000
+              protocol: TCP
--- a/k8s/apps/xandikos/mmdl-service.yaml
+++ b/k8s/apps/xandikos/mmdl-service.yaml
@@ -0,0 +1,14 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: mmdl
+spec:
+  selector:
+    app: mmdl
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 3000
+      protocol: TCP
+      targetPort: 3000
--- a/k8s/apps/xandikos/service.yaml
+++ b/k8s/apps/xandikos/service.yaml
@@ -0,0 +1,16 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: xandikos
+  labels:
+    app: xandikos
+spec:
+  selector:
+    app: xandikos
+  ports:
+    - protocol: TCP
+      port: 8081
+      targetPort: 8081
+      name: http
+  type: ClusterIP
--- a/k8s/core/argocd/appprojects.yaml
+++ b/k8s/core/argocd/appprojects.yaml
@@ -47,3 +47,20 @@ spec:
    server: https://kubernetes.default.svc
  sourceRepos:
  - ssh://git@gt.hexor.cy:30022/ab/homelab.git
+
+---
+apiVersion: argoproj.io/v1alpha1
+kind: AppProject
+metadata:
+  name: desktop
+  namespace: argocd
+spec:
+  clusterResourceWhitelist:
+  - group: '*'
+    kind: '*'
+  description: Hexor Home Lab Desktop Apps
+  destinations:
+  - namespace: '*'
+    server: https://kubernetes.default.svc
+  sourceRepos:
+  - ssh://git@gt.hexor.cy:30022/ab/homelab.git
--- a/k8s/core/argocd/values.yaml
+++ b/k8s/core/argocd/values.yaml
@@ -2,7 +2,7 @@

 global:
  domain: ag.hexor.cy
-  nodeSelector:
+  nodeSelector: &nodeSelector
    kubernetes.io/hostname: master.tail2fe2d.ts.net
  logging:
    format: text
@@ -55,15 +55,15 @@ configs:

 controller:
  replicas: 1
-  nodeSelector:
-    kubernetes.io/hostname: master.tail2fe2d.ts.net
+  nodeSelector: 
+    <<: *nodeSelector
  # Add resources (requests/limits), PDB etc. if needed

 # Dex OIDC provider
 dex:
  replicas: 1
  nodeSelector:
-    kubernetes.io/hostname: master.tail2fe2d.ts.net
+    <<: *nodeSelector
  enabled: false

 # Standard Redis disabled because Redis HA is enabled
@@ -86,7 +86,7 @@ redis-ha:
 server:
  replicas: 1
  nodeSelector:
-    kubernetes.io/hostname: master.tail2fe2d.ts.net
+    <<: *nodeSelector
  ingress:
    enabled: false

@@ -99,8 +99,11 @@ server:
 # Repository Server
 repoServer:
  replicas: 1
+  livenessProbe:
+    timeoutSeconds: 10
+    periodSeconds: 60
  nodeSelector:
-    kubernetes.io/hostname: master.tail2fe2d.ts.net
+    <<: *nodeSelector
  # Add resources (requests/limits), PDB etc. if needed

 # ApplicationSet Controller
@@ -108,7 +111,7 @@ applicationSet:
  enabled: true # Enabled by default
  replicas: 1
  nodeSelector:
-    kubernetes.io/hostname: master.tail2fe2d.ts.net
+    <<: *nodeSelector
  # Add resources (requests/limits), PDB etc. if needed

 # Notifications Controller
@@ -116,5 +119,5 @@ notifications:
  enabled: true # Enabled by default
  replicas: 1
  nodeSelector:
-    kubernetes.io/hostname: master.tail2fe2d.ts.net
+    <<: *nodeSelector
  # Add notifiers, triggers, templates configurations if needed
--- a/k8s/core/cert-manager/issuer.yaml
+++ b/k8s/core/cert-manager/issuer.yaml
@@ -35,5 +35,6 @@ spec:
              key: secretKey
        selector:
          dnsZones:
+            - "ps.hexor.cy"
            - "of.hexor.cy"

--- a/k8s/core/external-secrets/Dockerfile-bitwarden-cli
+++ b/k8s/core/external-secrets/Dockerfile-bitwarden-cli
@@ -1,6 +1,6 @@
 FROM debian:sid

-ENV BW_CLI_VERSION=2025.5.0
+ENV BW_CLI_VERSION=2025.12.1

 RUN apt update && \
    apt install -y wget unzip && \
--- a/k8s/core/external-secrets/bitwarden-store.yaml
+++ b/k8s/core/external-secrets/bitwarden-store.yaml
@@ -37,15 +37,15 @@ spec:
        kubernetes.io/hostname: master.tail2fe2d.ts.net
      containers:
        - name: bitwarden-cli
-          image: ultradesu/bitwarden-client:2025.5.0
+          image: ultradesu/bitwarden-client:2025.12.1
          imagePullPolicy: Always
          resources:
            requests:
              memory: "128Mi"
-              cpu: "100m"
+              cpu: "300m"
            limits:
              memory: "512Mi"
-              cpu: "500m"
+              cpu: "1000m"
          env:
            - name: BW_HOST
              valueFrom:
--- a/k8s/core/kube-system-custom/kustomization.yaml
+++ b/k8s/core/kube-system-custom/kustomization.yaml
@@ -3,5 +3,15 @@ kind: Kustomization

 resources:
  - app.yaml
+  - nfs-storage.yaml
  - coredns-internal-resolve.yaml

+helmCharts:
+  - name: csi-driver-nfs
+    repo: https://raw.githubusercontent.com/kubernetes-csi/csi-driver-nfs/master/charts
+    version: 4.12.0
+    releaseName: csi-driver-nfs
+    namespace: kube-system
+    #valuesFile: values.yaml
+    includeCRDs: true
+
--- a/k8s/core/kube-system-custom/nfs-storage.yaml
+++ b/k8s/core/kube-system-custom/nfs-storage.yaml
@@ -0,0 +1,14 @@
+---
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: nfs-csi
+provisioner: nfs.csi.k8s.io
+parameters:
+  server: nas.homenet
+  share: /mnt/storage/Storage/PVC
+reclaimPolicy: Retain
+volumeBindingMode: Immediate
+mountOptions:
+  - vers=4
+  - hard
--- a/k8s/core/postgresql/external-secrets.yaml
+++ b/k8s/core/postgresql/external-secrets.yaml
@@ -121,6 +121,12 @@ spec:
          {{ .pasarguard }}
        USER_remnawave: |-
          {{ .remnawave }}
+        USER_umami: |-
+          {{ .umami }}
+        USER_mmdl: |-
+          {{ .mmdl }}
+        USER_n8n: |-
+          {{ .n8n }}
  data:
    - secretKey: authentik
      sourceRef:
@@ -232,3 +238,37 @@ spec:
        metadataPolicy: None
        key: 2a9deb39-ef22-433e-a1be-df1555625e22
        property: fields[10].value
+    - secretKey: umami
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: 2a9deb39-ef22-433e-a1be-df1555625e22
+        property: fields[11].value
+    - secretKey: mmdl
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: 2a9deb39-ef22-433e-a1be-df1555625e22
+        property: fields[12].value
+    - secretKey: n8n
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: 2a9deb39-ef22-433e-a1be-df1555625e22
+        property: fields[13].value
+
--- a/k8s/core/postgresql/main-db.yaml
+++ b/k8s/core/postgresql/main-db.yaml
@@ -28,7 +28,7 @@ spec:
            type: DirectoryOrCreate
      containers:
        - name: psql
-          image: 'bitnami/postgresql:17'
+          image: 'bitnamilegacy/postgresql:17'
          env:
            - name: POSTGRESQL_PASSWORD
              valueFrom:
@@ -63,7 +63,7 @@ spec:
              containerPort: 9187
              protocol: TCP
        - name: user-creation
-          image: 'bitnami/postgresql:17'
+          image: 'bitnamilegacy/postgresql:17'
          command:
            - /bin/bash
            - -c
--- a/k8s/core/postgresql/nas-db.yaml
+++ b/k8s/core/postgresql/nas-db.yaml
@@ -28,7 +28,7 @@ spec:
            type: DirectoryOrCreate
      containers:
        - name: psql
-          image: 'bitnami/postgresql:17'
+          image: 'bitnamilegacy/postgresql:17'
          env:
            - name: POSTGRESQL_PASSWORD
              valueFrom:
@@ -60,7 +60,7 @@ spec:
              containerPort: 9187
              protocol: TCP
        - name: user-creation
-          image: 'bitnami/postgresql:17'
+          image: 'bitnamilegacy/postgresql:17'
          command:
            - /bin/bash
            - -c
--- a/k8s/core/postgresql/pgadmin4-values.yaml
+++ b/k8s/core/postgresql/pgadmin4-values.yaml
@@ -1,5 +1,5 @@
 image:
-  tag: "9.9"
+  tag: "latest"
  pullPolicy: Always
 env:
  email: "postgres@hexor.cy"
--- a/k8s/core/prom-stack/app.yaml
+++ b/k8s/core/prom-stack/app.yaml
@@ -13,9 +13,6 @@ spec:
    targetRevision: HEAD
    path: k8s/core/prom-stack
  syncPolicy:
-    automated:
-      selfHeal: true
-      prune: true
    syncOptions:
      - CreateNamespace=true
      - ServerSideApply=true
--- a/k8s/core/prom-stack/external-secrets.yaml
+++ b/k8s/core/prom-stack/external-secrets.yaml
@@ -79,3 +79,83 @@ spec:
        key: 2a9deb39-ef22-433e-a1be-df1555625e22
        property: fields[2].value

+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: alertmanager-telegram
+spec:
+  target:
+    name: alertmanager-telegram-secret
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        TELEGRAM_BOT_TOKEN: |-
+          {{ .bot_token }}
+        TELEGRAM_CHAT_ID: |-
+          {{ .chat_id }}
+  data:
+    - secretKey: bot_token
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: eca0fb0b-3939-40a8-890a-6294863e5a65
+        property: fields[0].value
+    - secretKey: chat_id
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: eca0fb0b-3939-40a8-890a-6294863e5a65
+        property: fields[1].value
+
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: grafana-telegram
+spec:
+  target:
+    name: grafana-telegram
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        bot-token: |-
+          {{ .bot_token }}
+        chat-id: |-
+          {{ .chat_id }}
+  data:
+    - secretKey: bot_token
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: eca0fb0b-3939-40a8-890a-6294863e5a65
+        property: fields[0].value
+    - secretKey: chat_id
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: eca0fb0b-3939-40a8-890a-6294863e5a65
+        property: fields[1].value
+
--- a/k8s/core/prom-stack/grafana-alerting-configmap.yaml
+++ b/k8s/core/prom-stack/grafana-alerting-configmap.yaml
@@ -0,0 +1,152 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: grafana-alerting
+  namespace: prometheus
+data:
+  rules.yaml: |
+    apiVersion: 1
+    groups:
+      - orgId: 1
+        name: pasarguard_alerts
+        folder: Kubernetes
+        interval: 1m
+        rules:
+          - uid: pasarguard_cpu_throttling
+            title: VPN CPU Throttle
+            condition: B
+            data:
+              - refId: A
+                relativeTimeRange:
+                  from: 600
+                  to: 0
+                datasourceUid: P76F38748CEC837F0
+                model:
+                  expr: 'rate(container_cpu_cfs_throttled_periods_total{container="pasarguard-node"}[5m])'
+                  refId: A
+                  intervalMs: 1000
+                  maxDataPoints: 43200
+              - refId: B
+                relativeTimeRange:
+                  from: 600
+                  to: 0
+                datasourceUid: __expr__
+                model:
+                  conditions:
+                    - evaluator:
+                        params:
+                          - 0.1
+                        type: gt
+                      operator:
+                        type: and
+                      query:
+                        params: []
+                  datasource:
+                    type: __expr__
+                    uid: __expr__
+                  expression: A
+                  reducer: last
+                  refId: B
+                  type: reduce
+            noDataState: NoData
+            execErrState: Alerting
+            for: 5m
+            annotations:
+              pod: '{{ $labels.pod }}'
+              node: '{{ $labels.node }}'
+              namespace: '{{ $labels.namespace }}'
+              throttle_rate: '{{ printf "%.2f" $values.A }}'
+              summary: 'VPN node throttling CPU'
+            labels:
+              severity: warning
+      
+      - orgId: 1
+        name: kubernetes_alerts
+        folder: Kubernetes
+        interval: 30s
+        rules:
+          - uid: node_not_ready
+            title: Kubernetes Node Not Ready
+            condition: B
+            data:
+              - refId: A
+                relativeTimeRange:
+                  from: 300
+                  to: 0
+                datasourceUid: P76F38748CEC837F0
+                model:
+                  expr: 'kube_node_status_condition{condition="Ready",status="true"} == 0'
+                  refId: A
+                  intervalMs: 1000
+                  maxDataPoints: 43200
+              - refId: B
+                relativeTimeRange:
+                  from: 300
+                  to: 0
+                datasourceUid: __expr__
+                model:
+                  conditions:
+                    - evaluator:
+                        params:
+                          - 0
+                        type: gt
+                      operator:
+                        type: and
+                      query:
+                        params: []
+                  datasource:
+                    type: __expr__
+                    uid: __expr__
+                  expression: A
+                  reducer: last
+                  refId: B
+                  type: reduce
+            noDataState: Alerting
+            execErrState: Alerting
+            for: 0s
+            annotations:
+              node: '{{ $labels.node }}'
+              condition: '{{ $labels.condition }}'
+              summary: 'Kubernetes node is not ready'
+            labels:
+              severity: critical
+  
+  contactpoints.yaml: |
+    apiVersion: 1
+    contactPoints:
+      - orgId: 1
+        name: telegram
+        receivers:
+          - uid: telegram_default
+            type: telegram
+            disableResolveMessage: false
+            settings:
+              bottoken: $TELEGRAM_BOT_TOKEN
+              chatid: "124317807"
+              message: |
+                {{ if eq .Status "firing" }}🔥 FIRING{{ else }}✅ RESOLVED{{ end }}
+                
+                {{ range .Alerts }}
+                📊 <b>{{ .Labels.alertname }}</b>
+                {{ .Annotations.summary }}
+                
+                {{ if .Annotations.node }}🖥 <b>Node:</b> <code>{{ .Annotations.node }}</code>{{ end }}
+                {{ if .Annotations.pod }}📦 <b>Pod:</b> <code>{{ .Annotations.pod }}</code>{{ end }}
+                {{ if .Annotations.namespace }}📁 <b>Namespace:</b> <code>{{ .Annotations.namespace }}</code>{{ end }}
+                {{ if .Annotations.throttle_rate }}⚠️ <b>Throttling rate:</b> {{ .Annotations.throttle_rate }}{{ end }}
+                
+                🔗 <a href="{{ .GeneratorURL }}">View in Grafana</a>
+                {{ end }}
+              parse_mode: HTML
+  
+  policies.yaml: |
+    apiVersion: 1
+    policies:
+      - orgId: 1
+        receiver: telegram
+        group_by:
+          - grafana_folder
+          - alertname
+        group_wait: 10s
+        group_interval: 5m
+        repeat_interval: 4h
--- a/k8s/core/prom-stack/grafana-values.yaml
+++ b/k8s/core/prom-stack/grafana-values.yaml
@@ -38,6 +38,10 @@ datasources:
        url: http://prometheus-kube-prometheus-prometheus.prometheus.svc:9090
        access: proxy
        isDefault: true
+      - name: Loki
+        type: loki
+        url: http://loki-gateway.prometheus.svc:80
+        access: proxy

 ingress:
  enabled: true
@@ -52,3 +56,30 @@ ingress:
      hosts:
        - '*.hexor.cy'

+extraConfigmapMounts:
+  - name: grafana-alerting-rules
+    mountPath: /etc/grafana/provisioning/alerting/rules.yaml
+    configMap: grafana-alerting
+    subPath: rules.yaml
+    readOnly: true
+  - name: grafana-alerting-contactpoints
+    mountPath: /etc/grafana/provisioning/alerting/contactpoints.yaml
+    configMap: grafana-alerting
+    subPath: contactpoints.yaml
+    readOnly: true
+  - name: grafana-alerting-policies
+    mountPath: /etc/grafana/provisioning/alerting/policies.yaml
+    configMap: grafana-alerting
+    subPath: policies.yaml
+    readOnly: true
+
+envValueFrom:
+  TELEGRAM_BOT_TOKEN:
+    secretKeyRef:
+      name: grafana-telegram
+      key: bot-token
+  TELEGRAM_CHAT_ID:
+    secretKeyRef:
+      name: grafana-telegram
+      key: chat-id
+
--- a/k8s/core/prom-stack/kustomization.yaml
+++ b/k8s/core/prom-stack/kustomization.yaml
@@ -2,9 +2,9 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization

 resources:
-  - app.yaml
  - persistentVolume.yaml
  - external-secrets.yaml
+  - grafana-alerting-configmap.yaml

 helmCharts:
  - name: kube-prometheus-stack
@@ -23,3 +23,18 @@ helmCharts:
    valuesFile: grafana-values.yaml
    includeCRDs: true

+  - name: loki
+    repo: https://grafana.github.io/helm-charts
+    version: 6.29.0
+    releaseName: loki
+    namespace: prometheus
+    valuesFile: loki-values.yaml
+    includeCRDs: true
+
+  - name: promtail
+    repo: https://grafana.github.io/helm-charts
+    version: 6.16.6
+    releaseName: promtail
+    namespace: prometheus
+    valuesFile: promtail-values.yaml
+
--- a/k8s/core/prom-stack/loki-values.yaml
+++ b/k8s/core/prom-stack/loki-values.yaml
@@ -0,0 +1,75 @@
+# Loki SingleBinary mode - optimal for homelab
+deploymentMode: SingleBinary
+
+loki:
+  auth_enabled: false
+  commonConfig:
+    replication_factor: 1
+    path_prefix: /var/loki
+  schemaConfig:
+    configs:
+      - from: 2024-01-01
+        store: tsdb
+        object_store: filesystem
+        schema: v13
+        index:
+          prefix: index_
+          period: 24h
+  storage:
+    type: filesystem
+    filesystem:
+      chunks_directory: /var/loki/chunks
+      rules_directory: /var/loki/rules
+  limits_config:
+    reject_old_samples: false
+    ingestion_rate_mb: 16
+    ingestion_burst_size_mb: 32
+    max_query_parallelism: 32
+    volume_enabled: true
+
+singleBinary:
+  replicas: 1
+  nodeSelector:
+    kubernetes.io/hostname: master.tail2fe2d.ts.net
+  persistence:
+    enabled: true
+    size: 50Gi
+    storageClass: ""
+
+# Disable distributed mode components
+read:
+  replicas: 0
+write:
+  replicas: 0
+backend:
+  replicas: 0
+
+# Disable memcached (not needed for SingleBinary)
+chunksCache:
+  enabled: false
+resultsCache:
+  enabled: false
+
+# Gateway for Loki access
+gateway:
+  enabled: true
+  replicas: 1
+  service:
+    type: ClusterIP
+
+# Disable tests and canary
+test:
+  enabled: false
+lokiCanary:
+  enabled: false
+
+# Monitoring
+monitoring:
+  dashboards:
+    enabled: false
+  rules:
+    enabled: false
+  serviceMonitor:
+    enabled: false
+  selfMonitoring:
+    enabled: false
--- a/k8s/core/prom-stack/prom-values.yaml
+++ b/k8s/core/prom-stack/prom-values.yaml
@@ -1,5 +1,35 @@
 grafana:
  enabled: false
+
+alertmanager:
+  config:
+    global:
+      telegram_api_url: "https://api.telegram.org"
+    route:
+      group_by: ['alertname', 'cluster', 'service']
+      group_wait: 10s
+      group_interval: 10s
+      repeat_interval: 12h
+      receiver: 'telegram'
+    receivers:
+      - name: 'telegram'
+        telegram_configs:
+          - bot_token: '${TELEGRAM_BOT_TOKEN}'
+            chat_id: ${TELEGRAM_CHAT_ID}
+            parse_mode: 'HTML'
+            message: |
+              {{ range .Alerts }}
+              <b>{{ .Labels.alertname }}</b>
+              {{ if .Labels.severity }}<b>Severity:</b> {{ .Labels.severity }}{{ end }}
+              <b>Status:</b> {{ .Status }}
+              {{ if .Annotations.summary }}<b>Summary:</b> {{ .Annotations.summary }}{{ end }}
+              {{ if .Annotations.description }}<b>Description:</b> {{ .Annotations.description }}{{ end }}
+              {{ end }}
+
+  alertmanagerSpec:
+    secrets:
+      - alertmanager-telegram-secret
+
 prometheus:
  prometheusSpec:
    enableRemoteWriteReceiver: true
--- a/k8s/core/prom-stack/promtail-values.yaml
+++ b/k8s/core/prom-stack/promtail-values.yaml
@@ -0,0 +1,37 @@
+# Promtail - log collection agent for all cluster pods
+config:
+  clients:
+    - url: http://loki-gateway.prometheus.svc:80/loki/api/v1/push
+
+# DaemonSet - runs on every node
+daemonset:
+  enabled: true
+
+# Tolerations for master/control-plane nodes
+tolerations:
+  - key: node-role.kubernetes.io/master
+    operator: Exists
+    effect: NoSchedule
+  - key: node-role.kubernetes.io/control-plane
+    operator: Exists
+    effect: NoSchedule
+
+# Init container to increase inotify limits
+initContainer:
+  - name: init-inotify
+    image: docker.io/busybox:1.36
+    imagePullPolicy: IfNotPresent
+    command:
+      - sh
+      - -c
+      - sysctl -w fs.inotify.max_user_instances=512
+    securityContext:
+      privileged: true
+
+resources:
+  requests:
+    cpu: 50m
+    memory: 64Mi
+  limits:
+    cpu: 200m
+    memory: 128Mi
--- a/k8s/core/system-upgrade/plan.yaml
+++ b/k8s/core/system-upgrade/plan.yaml
@@ -16,7 +16,7 @@ spec:
  serviceAccountName: system-upgrade
  upgrade:
    image: rancher/k3s-upgrade
-  version: v1.34.1+k3s1
+  version: v1.34.3+k3s1
 ---
 # Agent plan
 apiVersion: upgrade.cattle.io/v1
@@ -39,5 +39,5 @@ spec:
  serviceAccountName: system-upgrade
  upgrade:
    image: rancher/k3s-upgrade
-  version: v1.34.1+k3s1
+  version: v1.34.3+k3s1

--- a/k8s/desktop/jellyfin/app.yaml
+++ b/k8s/desktop/jellyfin/app.yaml
@@ -0,0 +1,21 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: jellyfin-uk
+  namespace: argocd
+spec:
+  project: apps
+  destination:
+    namespace: jellyfin-uk
+    server: https://kubernetes.default.svc
+  source:
+    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
+    targetRevision: HEAD
+    path: k8s/desktop/jellyfin
+  syncPolicy:
+    automated:
+      selfHeal: true
+      prune: true
+    syncOptions:
+      - CreateNamespace=true
+
--- a/k8s/desktop/jellyfin/kustomization.yaml
+++ b/k8s/desktop/jellyfin/kustomization.yaml
@@ -0,0 +1,16 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - app.yaml
+  - qbittorent.yaml
+
+helmCharts:
+  - name: jellyfin
+    repo: https://utkuozdemir.org/helm-charts
+    version: 2.0.0
+    releaseName: jellyfin
+    namespace: jellyfin
+    valuesFile: values.yaml
+    includeCRDs: true
+
--- a/k8s/desktop/jellyfin/qbittorent.yaml
+++ b/k8s/desktop/jellyfin/qbittorent.yaml
@@ -0,0 +1,123 @@
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: vpn-creds
+spec:
+  target:
+    name: vpn-creds
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        ss_link: |-
+          {{ .ss_link }}
+  data:
+    - secretKey: ss_link
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: cfee6f62-fb06-4a4c-b6d8-92da4908c65a
+        property: fields[0].value
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: qbittorrent
+  labels:
+    app: qbittorrent
+  annotations:
+    reloader.stakater.com/auto: "true"
+spec:
+  selector:
+    matchLabels:
+      app: qbittorrent
+  replicas: 1
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 1
+      maxUnavailable: 0
+  template:
+    metadata:
+      labels:
+        app: qbittorrent
+    spec:
+      nodeSelector:
+        kubernetes.io/hostname: uk-desktop.tail2fe2d.ts.net
+      tolerations:
+        - key: workload
+          operator: Equal
+          value: desktop
+          effect: NoSchedule
+      volumes:
+        - name: config
+          hostPath:
+            path: /k8s/qbt-config
+            type: DirectoryOrCreate
+        - name: media
+          hostPath:
+            path: /k8s/media/downloads
+            type: DirectoryOrCreate
+      containers:
+        - name: qbittorrent
+          image: 'linuxserver/qbittorrent:latest'
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          volumeMounts:
+            - name: config
+              mountPath: /config
+            - name: media
+              mountPath: /downloads
+        - name: shadowsocks-proxy
+          image: teddysun/shadowsocks-rust:latest
+          env:
+            - name: SS_LINK
+              valueFrom:
+                secretKeyRef:
+                  name: vpn-creds
+                  key: ss_link
+          command: ["/bin/bash", "-c", "rm /etc/shadowsocks-rust/config.json && sslocal --server-url $SS_LINK --local-addr 127.0.0.1:8081 -U --protocol http"]
+          resources:
+            requests:
+              memory: "64Mi"
+              cpu: "300m"
+            limits:
+              memory: "128Mi"
+              cpu: "300m"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: qbittorrent
+spec:
+  selector:
+    app: qbittorrent
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: 8080
+
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: jf-local-ingress
+  annotations:
+    ingressClassName: traefik
+spec:
+  rules:
+    - host: tr.uk
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: qbittorrent
+                port:
+                  number: 80
--- a/k8s/desktop/jellyfin/values.yaml
+++ b/k8s/desktop/jellyfin/values.yaml
@@ -0,0 +1,41 @@
+image:
+  tag: 10.11.4
+resources:
+  requests:
+    memory: "2Gi"
+    cpu: "1000m"
+  limits:
+    memory: "8Gi"
+    cpu: "6000m"
+nodeSelector:
+  kubernetes.io/hostname: uk-desktop.tail2fe2d.ts.net
+tolerations:
+  - key: workload
+    operator: Equal
+    value: desktop
+    effect: NoSchedule
+persistence:
+  config:
+    enabled: true
+    isPvc: false
+    customVolume:
+      hostPath:
+        path: /k8s/jellyfin
+        type: DirectoryOrCreate
+  data:
+    enabled: true
+    isPvc: false
+    customVolume:
+      hostPath:
+        path: /k8s/media/downloads
+        type: DirectoryOrCreate
+
+ingress:
+    enabled: true
+    className: traefik
+    hosts:
+      - host: jf.uk
+        paths:
+          - path: /
+            pathType: Prefix
+
--- a/k8s/desktop/khm/app.yaml
+++ b/k8s/desktop/khm/app.yaml
@@ -0,0 +1,18 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: khm-client
+  namespace: argocd
+spec:
+  project: desktop
+  destination:
+    namespace: khm
+    server: https://kubernetes.default.svc
+  source:
+    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
+    targetRevision: HEAD
+    path: k8s/desktop/khm
+  syncPolicy:
+    automated:
+      selfHeal: true
+      prune: true
--- a/k8s/desktop/khm/external-secrets.yaml
+++ b/k8s/desktop/khm/external-secrets.yaml
@@ -0,0 +1,33 @@
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: khm-client-creds
+spec:
+  target:
+    name: khm-client-creds
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        USERNAME: |-
+          {{ .username }}
+        PASSWORD: |-
+          {{ .password }}
+  data:
+    - secretKey: username
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 19c06480-0814-4d1f-aa80-710105989188
+        property: login.username
+    - secretKey: password
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 19c06480-0814-4d1f-aa80-710105989188
+        property: login.password
--- a/k8s/desktop/khm/khm-client-cronjob.yaml
+++ b/k8s/desktop/khm/khm-client-cronjob.yaml
@@ -0,0 +1,69 @@
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: khm-client
+  labels:
+    app: khm-client
+spec:
+  schedule: "15 * * * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      template:
+        metadata:
+          labels:
+            app: khm-client
+        spec:
+          restartPolicy: OnFailure
+          hostNetwork: true
+          nodeSelector:
+            node-role.kubernetes.io/desktop: ""
+          tolerations:
+            - key: workload
+              operator: Equal
+              value: desktop
+              effect: NoSchedule
+          containers:
+            - name: khm-client
+              image: 'ultradesu/khm:latest'
+              imagePullPolicy: Always
+              securityContext:
+                privileged: false
+              resources:
+                requests:
+                  memory: "64Mi"
+                  cpu: "50m"
+                limits:
+                  memory: "256Mi"
+                  cpu: "200m"
+              command:
+                - /bin/sh
+                - -c
+                - |
+                  /usr/local/bin/khm \
+                    --known-hosts /host-ssh/known_hosts \
+                    --host https://khm.hexor.cy \
+                    --flow=private \
+                    --basic-auth="${USERNAME}:${PASSWORD}" \
+                    --in-place
+              env:
+                - name: USERNAME
+                  valueFrom:
+                    secretKeyRef:
+                      name: khm-client-creds
+                      key: USERNAME
+                - name: PASSWORD
+                  valueFrom:
+                    secretKeyRef:
+                      name: khm-client-creds
+                      key: PASSWORD
+              volumeMounts:
+                - name: known-hosts
+                  mountPath: /host-ssh/known_hosts
+          volumes:
+            - name: known-hosts
+              hostPath:
+                path: /home/ab/.ssh/known_hosts
--- a/k8s/desktop/khm/kustomization.yaml
+++ b/k8s/desktop/khm/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - external-secrets.yaml
+  - khm-client-cronjob.yaml
--- a/terraform/authentik/main.tf
+++ b/terraform/authentik/main.tf
@@ -1,4 +1,3 @@
-
 data "authentik_flow" "default_authorization_flow" {
  slug = var.default_authorization_flow
 }
@@ -299,7 +298,7 @@ resource "authentik_outpost" "outposts" {
    kubernetes_ingress_class_name  = null
    kubernetes_disabled_components = []
    kubernetes_ingress_annotations = {}
-    kubernetes_ingress_secret_name = "authentik-outpost-tls"
+    kubernetes_ingress_secret_name = "idm-tls"
  })

  depends_on = [
--- a/terraform/authentik/providers.tf
+++ b/terraform/authentik/providers.tf
@@ -8,6 +8,6 @@ terraform {
 }

 provider "authentik" {
-  url   = "https://idm.hexor.cy"
-  token = "qXcuoCg77JaRgqnU6rqIIBa8MBJ4UNyLPTL89dZI8zeC2jfaWqQ7k56BJs8F"
+  url   = var.authentik_url
+  token = var.authentik_token
 }
--- a/terraform/authentik/proxy-apps.tfvars
+++ b/terraform/authentik/proxy-apps.tfvars
@@ -51,6 +51,9 @@ proxy_applications = {
    internal_host                = "http://secret-reader.k8s-secret.svc:80"
    internal_host_ssl_validation = false
    meta_description             = ""
+    skip_path_regex              = <<-EOT
+/webhook
+EOT
    meta_icon                    = "https://img.icons8.com/ios-filled/50/password.png"
    mode                         = "proxy"
    outpost                      = "kubernetes-outpost"
@@ -129,12 +132,12 @@ EOT
    access_groups                = ["admins"]
  }

-  "syncthing-master" = {
-    name                         = "Syncthing-master"
-    slug                         = "syncthing-master"
+  "syncthing-router" = {
+    name                         = "Syncthing"
+    slug                         = "syncthing"
    group                        = "Media and Storage"
    external_host                = "https://ss.hexor.cy"
-    internal_host                = "https://syncthing-master.syncthing.svc:8384"
+    internal_host                = "http://syncthing-router.syncthing.svc:80"
    internal_host_ssl_validation = false
    meta_description             = ""
    meta_icon                    = "https://img.icons8.com/?size=100&id=Id4NcEcXcYzF&format=png&color=000000"
@@ -196,9 +199,10 @@ EOT
    internal_host_ssl_validation = false
    meta_description             = ""
    skip_path_regex              = <<-EOT
+/
 /sub/
 /dashboard/
-/
+/api/
 EOT
    meta_icon                    = "https://img.icons8.com/?size=100&id=fqAD3lAB6zTe&format=png&color=000000"
    mode                         = "proxy"
@@ -206,22 +210,5 @@ EOT
    create_group                 = true
    access_groups                = ["admins"]
  }
-  "remnawave" = {
-    name                         = "RemnaWave"
-    slug                         = "remnawave"
-    group                        = "Tools"
-    external_host                = "https://rw.hexor.cy"
-    internal_host                = "http://remnawave.remnawave.svc:3000"
-    internal_host_ssl_validation = false
-    meta_description             = ""
-    skip_path_regex              = <<-EOT
-/api/sub/
-EOT
-    meta_icon                    = "https://camo.githubusercontent.com/0fbcff9dfaebb0363774139d00ef58d7f128eed3ddabaaf2bf7d18b68fd296a1/68747470733a2f2f63646e2e72656d6e612e73742f6c6f676f732f6c6f676f2e737667"
-    mode                         = "proxy"
-    outpost                      = "kubernetes-outpost"
-    create_group                 = true
-    access_groups                = ["admins"]
-  }
 }

--- a/terraform/authentik/variables.tf
+++ b/terraform/authentik/variables.tf
@@ -166,3 +166,9 @@ variable "authentik_url" {
  type        = string
  default     = "https://idm.hexor.cy"
 }
+
+variable "authentik_token" {
+  description = "Authentik API token (set via TF_VAR_authentik_token env var)"
+  type        = string
+  sensitive   = true
+}