Auto-update README with current k8s applications

Generated by CI/CD workflow on 2026-03-10 22:50:32 This PR updates the README.md file with the current list of applications found in the k8s/ directory structure.
added lidarr
2026-03-10 22:50:32 +00:00 · 2026-03-10 22:50:04 +00:00 · 2026-03-09 17:30:10 +00:00 · 2026-03-09 17:20:39 +00:00 · 2026-03-09 17:15:19 +00:00 · 2026-03-09 17:15:19 +00:00
43 changed files with 966 additions and 215 deletions
--- a/README.md
+++ b/README.md
@@ -16,6 +16,7 @@ ArgoCD homelab project
 | **authentik** | [![authentik](https://ag.hexor.cy/api/badge?name=authentik&revision=true)](https://ag.hexor.cy/applications/argocd/authentik) |
 | **cert-manager** | [![cert-manager](https://ag.hexor.cy/api/badge?name=cert-manager&revision=true)](https://ag.hexor.cy/applications/argocd/cert-manager) |
 | **external-secrets** | [![external-secrets](https://ag.hexor.cy/api/badge?name=external-secrets&revision=true)](https://ag.hexor.cy/applications/argocd/external-secrets) |
+| **gpu** | [![gpu](https://ag.hexor.cy/api/badge?name=gpu&revision=true)](https://ag.hexor.cy/applications/argocd/gpu) |
 | **kube-system-custom** | [![kube-system-custom](https://ag.hexor.cy/api/badge?name=kube-system-custom&revision=true)](https://ag.hexor.cy/applications/argocd/kube-system-custom) |
 | **kubernetes-dashboard** | [![kubernetes-dashboard](https://ag.hexor.cy/api/badge?name=kubernetes-dashboard&revision=true)](https://ag.hexor.cy/applications/argocd/kubernetes-dashboard) |
 | **longhorn** | [![longhorn](https://ag.hexor.cy/api/badge?name=longhorn&revision=true)](https://ag.hexor.cy/applications/argocd/longhorn) |
@@ -37,6 +38,7 @@ ArgoCD homelab project

 | Application | Status |
 | :--- | :---: |
+| **comfyui** | [![comfyui](https://ag.hexor.cy/api/badge?name=comfyui&revision=true)](https://ag.hexor.cy/applications/argocd/comfyui) |
 | **gitea** | [![gitea](https://ag.hexor.cy/api/badge?name=gitea&revision=true)](https://ag.hexor.cy/applications/argocd/gitea) |
 | **greece-notifier** | [![greece-notifier](https://ag.hexor.cy/api/badge?name=greece-notifier&revision=true)](https://ag.hexor.cy/applications/argocd/greece-notifier) |
 | **hexound** | [![hexound](https://ag.hexor.cy/api/badge?name=hexound&revision=true)](https://ag.hexor.cy/applications/argocd/hexound) |
@@ -45,6 +47,8 @@ ArgoCD homelab project
 | **jellyfin** | [![jellyfin](https://ag.hexor.cy/api/badge?name=jellyfin&revision=true)](https://ag.hexor.cy/applications/argocd/jellyfin) |
 | **k8s-secrets** | [![k8s-secrets](https://ag.hexor.cy/api/badge?name=k8s-secrets&revision=true)](https://ag.hexor.cy/applications/argocd/k8s-secrets) |
 | **khm** | [![khm](https://ag.hexor.cy/api/badge?name=khm&revision=true)](https://ag.hexor.cy/applications/argocd/khm) |
+| **lidarr** | [![lidarr](https://ag.hexor.cy/api/badge?name=lidarr&revision=true)](https://ag.hexor.cy/applications/argocd/lidarr) |
+| **mtproxy** | [![mtproxy](https://ag.hexor.cy/api/badge?name=mtproxy&revision=true)](https://ag.hexor.cy/applications/argocd/mtproxy) |
 | **n8n** | [![n8n](https://ag.hexor.cy/api/badge?name=n8n&revision=true)](https://ag.hexor.cy/applications/argocd/n8n) |
 | **ollama** | [![ollama](https://ag.hexor.cy/api/badge?name=ollama&revision=true)](https://ag.hexor.cy/applications/argocd/ollama) |
 | **paperless** | [![paperless](https://ag.hexor.cy/api/badge?name=paperless&revision=true)](https://ag.hexor.cy/applications/argocd/paperless) |
--- a/k8s/apps/comfyui/app.yaml
+++ b/k8s/apps/comfyui/app.yaml
@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: comfyui
+  namespace: argocd
+spec:
+  project: apps
+  destination:
+    namespace: comfyui
+    server: https://kubernetes.default.svc
+  source:
+    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
+    targetRevision: HEAD
+    path: k8s/apps/comfyui
+  syncPolicy:
+    automated:
+      selfHeal: true
+      prune: true
+    syncOptions:
+      - CreateNamespace=true
--- a/k8s/apps/comfyui/deployment.yaml
+++ b/k8s/apps/comfyui/deployment.yaml
@@ -0,0 +1,57 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: comfyui
+  namespace: comfyui
+  labels:
+    app: comfyui
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: comfyui
+  template:
+    metadata:
+      labels:
+        app: comfyui
+    spec:
+      runtimeClassName: nvidia
+      tolerations:
+        - key: workload
+          operator: Equal
+          value: desktop
+          effect: NoSchedule
+      nodeSelector:
+        kubernetes.io/hostname: uk-desktop.tail2fe2d.ts.net
+      # Fix permissions mismatch usually happening when mapping host paths
+      securityContext:
+        runAsUser: 0
+      initContainers:
+        - name: create-data-dir
+          image: busybox
+          command: ["sh", "-c", "mkdir -p /host.data && chown -R 1000:1000 /host.data"]
+          volumeMounts:
+            - name: data
+              mountPath: /host.data
+      containers:
+        - name: comfyui
+          image: runpod/comfyui:latest-5090
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: COMFYUI_PORT
+              value: "8188"
+          ports:
+            - containerPort: 8188
+              name: http
+              protocol: TCP
+          resources:
+            limits:
+              nvidia.com/gpu: 1
+          volumeMounts:
+            - name: data
+              # For ai-dock images, /workspace is the persistent user directory
+              mountPath: /workspace
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: comfyui-data-pvc
--- a/k8s/apps/comfyui/kustomization.yaml
+++ b/k8s/apps/comfyui/kustomization.yaml
@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - local-pv.yaml
+  - pvc.yaml
+  - deployment.yaml
+  - service.yaml
--- a/k8s/apps/comfyui/local-pv.yaml
+++ b/k8s/apps/comfyui/local-pv.yaml
@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: comfyui-data-pv
+spec:
+  capacity:
+    storage: 200Gi
+  volumeMode: Filesystem
+  accessModes:
+  - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: local-path
+  local:
+    path: /data/comfyui
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+      - matchExpressions:
+        - key: kubernetes.io/hostname
+          operator: In
+          values:
+          - uk-desktop.tail2fe2d.ts.net
--- a/k8s/apps/comfyui/namespace.yaml
+++ b/k8s/apps/comfyui/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: comfyui
--- a/k8s/apps/comfyui/pvc.yaml
+++ b/k8s/apps/comfyui/pvc.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: comfyui-data-pvc
+  namespace: comfyui
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: local-path
+  resources:
+    requests:
+      storage: 200Gi
--- a/k8s/apps/comfyui/service.yaml
+++ b/k8s/apps/comfyui/service.yaml
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: comfyui
+  namespace: comfyui
+  labels:
+    app: comfyui
+spec:
+  ports:
+    - name: http
+      port: 8188
+      targetPort: 8188
+      protocol: TCP
+  selector:
+    app: comfyui
--- a/k8s/apps/lidarr/app.yaml
+++ b/k8s/apps/lidarr/app.yaml
@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: lidarr
+  namespace: argocd
+spec:
+  project: apps
+  destination:
+    namespace: lidarr
+    server: https://kubernetes.default.svc
+  source:
+    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
+    targetRevision: HEAD
+    path: k8s/apps/lidarr
+  syncPolicy:
+    automated:
+      selfHeal: true
+      prune: true
+    syncOptions:
+      - CreateNamespace=true
--- a/k8s/apps/lidarr/kustomization.yaml
+++ b/k8s/apps/lidarr/kustomization.yaml
@@ -0,0 +1,14 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - app.yaml
+
+helmCharts:
+  - name: lidarr
+    repo: https://k8s-home-lab.github.io/helm-charts/
+    version: 15.3.0
+    releaseName: lidarr
+    namespace: lidarr
+    valuesFile: lidarr-values.yaml
+    includeCRDs: true
--- a/k8s/apps/lidarr/lidarr-values.yaml
+++ b/k8s/apps/lidarr/lidarr-values.yaml
@@ -0,0 +1,27 @@
+env:
+  TZ: Asia/Nicosia
+
+resources:
+  requests:
+    memory: "512Mi"
+    cpu: "200m"
+  limits:
+    memory: "2Gi"
+    cpu: "1500m"
+
+nodeSelector:
+  kubernetes.io/hostname: master.tail2fe2d.ts.net
+
+persistence:
+  config:
+    enabled: true
+    type: hostPath
+    hostPath: /k8s/lidarr
+    mountPath: /config
+
+  downloads:
+    enabled: true
+    type: hostPath
+    hostPath: /k8s/media/downloads
+    mountPath: /downloads
+    accessMode: ReadWriteOnce
--- a/k8s/apps/mtproxy/Dockerfile
+++ b/k8s/apps/mtproxy/Dockerfile
@@ -0,0 +1,53 @@
+FROM --platform=$BUILDPLATFORM debian:bookworm-slim AS builder
+
+ARG TARGETARCH
+
+RUN apt-get update && apt-get install -y \
+    git curl make gcc libssl-dev zlib1g-dev \
+    && rm -rf /var/lib/apt/lists/*
+
+RUN if [ "$(dpkg --print-architecture)" != "$TARGETARCH" ]; then \
+      dpkg --add-architecture $TARGETARCH && \
+      apt-get update && \
+      case "$TARGETARCH" in \
+        arm64) apt-get install -y gcc-aarch64-linux-gnu libssl-dev:arm64 zlib1g-dev:arm64 ;; \
+        amd64) apt-get install -y gcc-x86-64-linux-gnu libssl-dev:amd64 zlib1g-dev:amd64 ;; \
+      esac && \
+      rm -rf /var/lib/apt/lists/*; \
+    fi
+
+RUN git clone https://github.com/TelegramMessenger/MTProxy.git /src
+WORKDIR /src
+
+RUN NATIVE=$(dpkg --print-architecture) && \
+    if [ "$NATIVE" != "$TARGETARCH" ]; then \
+      case "$TARGETARCH" in \
+        arm64) export CC=aarch64-linux-gnu-gcc ;; \
+        amd64) export CC=x86_64-linux-gnu-gcc ;; \
+      esac; \
+    fi && \
+    make -j$(nproc)
+
+FROM debian:bookworm-slim
+
+ENV PROXY_PORT=30443
+ENV STATS_PORT=8888
+ENV WORKERS=1
+ENV RUN_USER=nobody
+
+RUN apt-get update && apt-get install -y \
+    curl libssl3 zlib1g xxd \
+    && rm -rf /var/lib/apt/lists/*
+
+COPY --from=builder /src/objs/bin/mtproto-proxy /usr/local/bin/mtproto-proxy
+
+RUN curl -s https://core.telegram.org/getProxySecret -o /etc/mtproxy/proxy-secret --create-dirs && \
+    curl -s https://core.telegram.org/getProxyConfig -o /etc/mtproxy/proxy-multi.conf
+
+ENTRYPOINT mtproto-proxy \
+    -u ${RUN_USER} \
+    -p ${STATS_PORT} \
+    -H ${PROXY_PORT} \
+    -M ${WORKERS} \
+    --aes-pwd /etc/mtproxy/proxy-secret \
+    /etc/mtproxy/proxy-multi.conf
--- a/k8s/apps/mtproxy/daemonset.yaml
+++ b/k8s/apps/mtproxy/daemonset.yaml
@@ -0,0 +1,117 @@
+---
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: mtproxy
+  labels:
+    app: mtproxy
+spec:
+  selector:
+    matchLabels:
+      app: mtproxy
+  updateStrategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: mtproxy
+    spec:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: mtproxy
+                    operator: Exists
+      serviceAccountName: mtproxy
+      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+      initContainers:
+        - name: register-proxy
+          image: bitnami/kubectl:latest
+          env:
+            - name: NODE_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+            - name: SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: tgproxy-secret
+                  key: SECRET
+            - name: PORT
+              valueFrom:
+                secretKeyRef:
+                  name: tgproxy-secret
+                  key: PORT
+          volumeMounts:
+            - name: data
+              mountPath: /data
+          command:
+            - /bin/bash
+            - -c
+            - |
+              set -e
+              curl -s https://core.telegram.org/getProxySecret -o /data/proxy-secret
+              curl -s https://core.telegram.org/getProxyConfig -o /data/proxy-multi.conf
+              NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)
+              SERVER=$(kubectl get node "${NODE_NAME}" -o jsonpath='{.metadata.labels.mtproxy}')
+              if [ -z "${SERVER}" ]; then
+                echo "ERROR: node ${NODE_NAME} has no mtproxy label"
+                exit 1
+              fi
+              LINK="tg://proxy?server=${SERVER}&port=${PORT}&secret=${SECRET}"
+              echo "Registering: ${SERVER} -> ${LINK}"
+              if kubectl get secret mtproxy-links -n "${NAMESPACE}" &>/dev/null; then
+                kubectl patch secret mtproxy-links -n "${NAMESPACE}" \
+                  --type merge -p "{\"stringData\":{\"${SERVER}\":\"${LINK}\"}}"
+              else
+                kubectl create secret generic mtproxy-links -n "${NAMESPACE}" \
+                  --from-literal="${SERVER}=${LINK}"
+              fi
+              echo "Done"
+      containers:
+        - name: mtproxy
+          image: telegrammessenger/proxy:latest
+          # image: ultradesu/mtproxy:v0.02
+          imagePullPolicy: Always
+          ports:
+            - name: proxy
+              containerPort: 30443
+              protocol: TCP
+          command:
+            - /bin/sh
+            - -c
+            - >-
+              mtproto-proxy
+              -u nobody
+              -p 8888
+              -H $(PORT)
+              -M 1
+              -S $(SECRET)
+              --aes-pwd /data/proxy-secret
+              /data/proxy-multi.conf
+          env:
+            - name: SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: tgproxy-secret
+                  key: SECRET
+            - name: PORT
+              valueFrom:
+                secretKeyRef:
+                  name: tgproxy-secret
+                  key: PORT
+          volumeMounts:
+            - name: data
+              mountPath: /data
+         #resources:
+         #  requests:
+         #    memory: "128Mi"
+         #    cpu: "100m"
+         #  limits:
+         #    memory: "256Mi"
+         #    cpu: "500m"
+      volumes:
+        - name: data
+          emptyDir: {}
--- a/k8s/apps/mtproxy/deployment.yaml
+++ b/k8s/apps/mtproxy/deployment.yaml
@@ -1,49 +0,0 @@
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: mtproxy
-  labels:
-    app: mtproxy
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: mtproxy
-  template:
-    metadata:
-      labels:
-        app: mtproxy
-    spec:
-      affinity:
-        nodeAffinity:
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-              - matchExpressions:
-                  - key: xray-node-address
-                    operator: Exists
-      containers:
-        - name: mtproxy
-          image: telegrammessenger/proxy:latest
-          imagePullPolicy: Always
-          ports:
-            - name: proxy
-              containerPort: 443
-              protocol: TCP
-          env:
-            - name: SECRET
-              value: "00baadf00d15abad1deaa51abaadcafe"
-          volumeMounts:
-            - name: data
-              mountPath: /data
-          resources:
-            requests:
-              memory: "128Mi"
-              cpu: "100m"
-            limits:
-              memory: "256Mi"
-              cpu: "500m"
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: mtproxy-data
--- a/k8s/apps/mtproxy/external-secrets.yaml
+++ b/k8s/apps/mtproxy/external-secrets.yaml
@@ -0,0 +1,25 @@
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: tgproxy-secret
+spec:
+  target:
+    name: tgproxy-secret
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        SECRET: |-
+          {{ .secret }}
+        PORT: "30443"
+  data:
+    - secretKey: secret
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 58a37daf-72d8-430d-86bd-6152aa8f888d
+        property: fields[0].value
+
--- a/k8s/apps/mtproxy/kustomization.yaml
+++ b/k8s/apps/mtproxy/kustomization.yaml
@@ -3,6 +3,9 @@ kind: Kustomization

 resources:
  - ./app.yaml
-  - ./deployment.yaml
+  - ./rbac.yaml
+  - ./daemonset.yaml
+  - ./external-secrets.yaml
  - ./service.yaml
-  - ./storage.yaml
+  - ./secret-reader.yaml
+# - ./storage.yaml
--- a/k8s/apps/mtproxy/rbac.yaml
+++ b/k8s/apps/mtproxy/rbac.yaml
@@ -0,0 +1,58 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: mtproxy
+  labels:
+    app: mtproxy
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: mtproxy-node-reader
+  labels:
+    app: mtproxy
+rules:
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: mtproxy-node-reader
+  labels:
+    app: mtproxy
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: mtproxy-node-reader
+subjects:
+  - kind: ServiceAccount
+    name: mtproxy
+    namespace: mtproxy
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: mtproxy-secret-manager
+  labels:
+    app: mtproxy
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "create", "patch"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: mtproxy-secret-manager
+  labels:
+    app: mtproxy
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: mtproxy-secret-manager
+subjects:
+  - kind: ServiceAccount
+    name: mtproxy
--- a/k8s/apps/mtproxy/secret-reader.yaml
+++ b/k8s/apps/mtproxy/secret-reader.yaml
@@ -0,0 +1,63 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: secret-reader
+  labels:
+    app: secret-reader
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: secret-reader
+  template:
+    metadata:
+      labels:
+        app: secret-reader
+    spec:
+      serviceAccountName: mtproxy
+      nodeSelector:
+        kubernetes.io/os: linux
+      containers:
+      - name: secret-reader
+        image: ultradesu/k8s-secrets:0.2.1
+        imagePullPolicy: Always
+        args:
+          - "--secrets"
+          - "mtproxy-links"
+          - "--namespace"
+          - "mtproxy"
+          - "--port"
+          - "3000"
+        ports:
+        - containerPort: 3000
+          name: http
+        env:
+        - name: RUST_LOG
+          value: "info"
+        resources:
+          requests:
+            memory: "64Mi"
+            cpu: "50m"
+          limits:
+            memory: "128Mi"
+            cpu: "150m"
+        livenessProbe:
+          httpGet:
+            path: /health
+            port: http
+          initialDelaySeconds: 10
+          periodSeconds: 10
+        readinessProbe:
+          httpGet:
+            path: /health
+            port: http
+          initialDelaySeconds: 5
+          periodSeconds: 5
+        securityContext:
+          runAsNonRoot: true
+          runAsUser: 1000
+          allowPrivilegeEscalation: false
+          readOnlyRootFilesystem: true
+          capabilities:
+            drop:
+            - ALL
--- a/k8s/apps/mtproxy/service.yaml
+++ b/k8s/apps/mtproxy/service.yaml
@@ -2,12 +2,15 @@
 apiVersion: v1
 kind: Service
 metadata:
-  name: mtproxy
+  name: secret-reader
+  labels:
+    app: secret-reader
 spec:
-  type: LoadBalancer
+  type: ClusterIP
  selector:
-    app: mtproxy
+    app: secret-reader
  ports:
-    - name: proxy
-      port: 30443
-      targetPort: 443
+  - port: 80
+    targetPort: 3000
+    protocol: TCP
+    name: http
--- a/k8s/apps/n8n/deployment-main.yaml
+++ b/k8s/apps/n8n/deployment-main.yaml
@@ -50,10 +50,12 @@ spec:
          runAsNonRoot: true
      containers:
      - name: n8n
-        image: docker.n8n.io/n8nio/n8n:latest
+        image: n8nio/n8n:latest
        ports:
        - containerPort: 5678
          name: http
+        - containerPort: 5679
+          name: task-broker
        env:
        - name: PATH
          value: "/opt/tools:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
@@ -73,14 +75,24 @@ spec:
          value: "true"
        - name: N8N_RUNNERS_MODE
          value: "external"
+        - name: N8N_RUNNERS_BROKER_LISTEN_ADDRESS
+          value: "0.0.0.0"
+        - name: N8N_LISTEN_ADDRESS
+          value: "0.0.0.0"
+        - name: N8N_RUNNERS_BROKER_PORT
+          value: "5679"
        - name: EXECUTIONS_MODE
          value: "queue"
        - name: QUEUE_BULL_REDIS_HOST
          value: "n8n-redis"
+        - name: QUEUE_BULL_REDIS_PORT
+          value: "6379"
        - name: NODE_ENV
          value: "production"
        - name: WEBHOOK_URL
          value: "https://n8n.hexor.cy/"
+        - name: N8N_PROXY_HOPS
+          value: "1"
        - name: GENERIC_TIMEZONE
          value: "Europe/Moscow"
        - name: TZ
@@ -122,23 +134,23 @@ spec:
            memory: 512Mi
          limits:
            cpu: 4000m
-            memory: 2048Gi
+            memory: 2048Mi
        livenessProbe:
          httpGet:
            path: /healthz
            port: http
-          initialDelaySeconds: 120
+          initialDelaySeconds: 240
          periodSeconds: 30
-          timeoutSeconds: 10
-          failureThreshold: 6
+          timeoutSeconds: 20
+          failureThreshold: 10
        readinessProbe:
          httpGet:
            path: /healthz/readiness
            port: http
-          initialDelaySeconds: 60
+          initialDelaySeconds: 120
          periodSeconds: 10
          timeoutSeconds: 5
-          failureThreshold: 10
+          failureThreshold: 15
      volumes:
      - name: n8n-data
        persistentVolumeClaim:
--- a/k8s/apps/n8n/deployment-runner.yaml
+++ b/k8s/apps/n8n/deployment-runner.yaml
@@ -0,0 +1,87 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: n8n-runner
+  labels:
+    app: n8n
+    component: runner
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: n8n
+      component: runner
+  template:
+    metadata:
+      labels:
+        app: n8n
+        component: runner
+    spec:
+      serviceAccountName: n8n
+      containers:
+      - name: n8n-runner
+        image: n8nio/runners:latest
+        ports:
+        - containerPort: 5680
+          name: health
+        env:
+        - name: PATH
+          value: "/opt/tools:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
+        - name: HOME
+          value: "/home/node"
+        - name: N8N_RUNNERS_TASK_BROKER_URI
+          value: "http://n8n:5679"
+        - name: N8N_RUNNERS_LAUNCHER_LOG_LEVEL
+          value: "info"
+        - name: N8N_RUNNERS_MAX_CONCURRENCY
+          value: "10"
+        - name: GENERIC_TIMEZONE
+          value: "Europe/Moscow"
+        - name: TZ
+          value: "Europe/Moscow"
+        - name: N8N_RUNNERS_AUTH_TOKEN
+          valueFrom:
+            secretKeyRef:
+              name: credentials
+              key: runnertoken
+        volumeMounts:
+        - name: n8n-data
+          mountPath: /home/node/.n8n
+        - name: tools
+          mountPath: /opt/tools
+        resources:
+          requests:
+            cpu: 500m
+            memory: 512Mi
+          limits:
+            cpu: 2000m
+            memory: 2048Mi
+        livenessProbe:
+          httpGet:
+            path: /healthz
+            port: 5680
+          initialDelaySeconds: 30
+          periodSeconds: 30
+          timeoutSeconds: 5
+          failureThreshold: 3
+        readinessProbe:
+          httpGet:
+            path: /healthz
+            port: 5680
+          initialDelaySeconds: 15
+          periodSeconds: 10
+          timeoutSeconds: 5
+          failureThreshold: 3
+      volumes:
+      - name: n8n-data
+        persistentVolumeClaim:
+          claimName: n8n-data
+      - name: tools
+        persistentVolumeClaim:
+          claimName: n8n-tools
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+        runAsNonRoot: true
+        fsGroup: 1000
--- a/k8s/apps/n8n/deployment-worker.yaml
+++ b/k8s/apps/n8n/deployment-worker.yaml
@@ -21,29 +21,21 @@ spec:
      serviceAccountName: n8n
      containers:
      - name: n8n-worker
-        image: docker.n8n.io/n8nio/n8n:latest
-        command: ["n8n", "worker"]
+        image: n8nio/n8n:latest
+        command:
+        - n8n
+        - worker
        env:
-        - name: PATH
-          value: "/opt/tools:/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin"
        - name: HOME
          value: "/home/node"
-        - name: NODES_EXCLUDE
-          value: "[]"
        - name: N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS
          value: "true"
-        - name: N8N_RUNNERS_ENABLED
-          value: "true"
-        - name: N8N_RUNNERS_MODE
-          value: "external"
-        - name: N8N_PORT
-          value: "80"
        - name: EXECUTIONS_MODE
          value: "queue"
        - name: QUEUE_BULL_REDIS_HOST
          value: "n8n-redis"
-        - name: N8N_RUNNERS_TASK_BROKER_URI
-          value: "http://n8n:80"
+        - name: QUEUE_BULL_REDIS_PORT
+          value: "6379"
        - name: NODE_ENV
          value: "production"
        - name: GENERIC_TIMEZONE
@@ -71,40 +63,20 @@ spec:
            secretKeyRef:
              name: credentials
              key: encryptionkey
-        - name: N8N_RUNNERS_AUTH_TOKEN
-          valueFrom:
-            secretKeyRef:
-              name: credentials
-              key: runnertoken
        volumeMounts:
        - name: n8n-data
          mountPath: /home/node/.n8n
-        - name: tools
-          mountPath: /opt/tools
        resources:
          requests:
-            cpu: 2000m
+            cpu: 500m
            memory: 512Mi
          limits:
-            cpu: 4000m
-            memory: 2048Gi
-        livenessProbe:
-          exec:
-            command:
-            - /bin/sh
-            - -c
-            - "ps aux | grep '[n]8n worker' || exit 1"
-          initialDelaySeconds: 30
-          periodSeconds: 30
-          timeoutSeconds: 5
-          failureThreshold: 3
+            cpu: 2000m
+            memory: 2048Mi
      volumes:
      - name: n8n-data
        persistentVolumeClaim:
          claimName: n8n-data
-      - name: tools
-        persistentVolumeClaim:
-          claimName: n8n-tools
      securityContext:
        runAsUser: 1000
        runAsGroup: 1000
--- a/k8s/apps/n8n/kustomization.yaml
+++ b/k8s/apps/n8n/kustomization.yaml
@@ -7,8 +7,11 @@ resources:
  - rbac.yaml
  - redis-deployment.yaml
  - redis-service.yaml
+  - paddleocr-deployment.yaml
+  - paddleocr-service.yaml
  - deployment-main.yaml
  - deployment-worker.yaml
+  - deployment-runner.yaml
  - service.yaml
  - ingress.yaml

--- a/k8s/apps/n8n/paddleocr-deployment.yaml
+++ b/k8s/apps/n8n/paddleocr-deployment.yaml
@@ -0,0 +1,43 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: paddleocr
+  labels:
+    app: paddleocr
+    component: n8n
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: paddleocr
+      component: n8n
+  template:
+    metadata:
+      labels:
+        app: paddleocr
+        component: n8n
+    spec:
+      containers:
+      - name: paddleocr
+        image: c403/paddleocr
+        ports:
+        - containerPort: 5000
+          name: http
+        resources:
+          requests:
+            cpu: 200m
+            memory: 512Mi
+          limits:
+            cpu: 1000m
+            memory: 2Gi
+        livenessProbe:
+          tcpSocket:
+            port: 5000
+          initialDelaySeconds: 60
+          periodSeconds: 30
+        readinessProbe:
+          tcpSocket:
+            port: 5000
+          initialDelaySeconds: 30
+          periodSeconds: 10
--- a/k8s/apps/n8n/paddleocr-service.yaml
+++ b/k8s/apps/n8n/paddleocr-service.yaml
@@ -0,0 +1,18 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: paddleocr
+  labels:
+    app: paddleocr
+    component: n8n
+spec:
+  selector:
+    app: paddleocr
+    component: n8n
+  ports:
+  - name: http
+    port: 80
+    targetPort: 5000
+    protocol: TCP
+  type: ClusterIP
--- a/k8s/apps/n8n/service.yaml
+++ b/k8s/apps/n8n/service.yaml
@@ -14,4 +14,8 @@ spec:
    port: 80
    targetPort: 5678
    protocol: TCP
+  - name: task-broker
+    port: 5679
+    targetPort: 5679
+    protocol: TCP
  type: ClusterIP
--- a/k8s/apps/ollama/kustomization.yaml
+++ b/k8s/apps/ollama/kustomization.yaml
@@ -3,19 +3,23 @@ kind: Kustomization

 resources:
  - external-secrets.yaml
+  - local-pv.yaml
  
 helmCharts:
  - name: ollama
    repo: https://otwld.github.io/ollama-helm/
-    version: 0.4.0
+    version: 1.49.0
    releaseName: ollama
    namespace: ollama
    valuesFile: ollama-values.yaml
    includeCRDs: true
  - name: open-webui
    repo: https://helm.openwebui.com/
-    version: 8.14.0
+    version: 12.8.1
    releaseName: openweb-ui
    namespace: ollama
    valuesFile: openweb-ui-values.yaml
-    includeCRDs: true
+    includeCRDs: true
+
+patches:
+  - path: patch-runtimeclass.yaml
--- a/k8s/apps/ollama/local-pv.yaml
+++ b/k8s/apps/ollama/local-pv.yaml
@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: ollama-local-pv
+spec:
+  capacity:
+    storage: 100Gi
+  volumeMode: Filesystem
+  accessModes:
+  - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: local-path
+  local:
+    path: /var/lib/ollama
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+      - matchExpressions:
+        - key: kubernetes.io/hostname
+          operator: In
+          values:
+          - uk-desktop.tail2fe2d.ts.net
--- a/k8s/apps/ollama/ollama-values.yaml
+++ b/k8s/apps/ollama/ollama-values.yaml
@@ -3,6 +3,20 @@ image:
  pullPolicy: Always
  tag: "latest"
 nodeSelector:
-  kubernetes.io/hostname: master.tail2fe2d.ts.net
+  kubernetes.io/hostname: uk-desktop.tail2fe2d.ts.net
+tolerations:
+  - key: workload
+    operator: Equal
+    value: desktop
+    effect: NoSchedule
 ingress:
    enabled: false
+ollama:
+  gpu:
+    enabled: true
+    type: 'nvidia'
+    number: 1
+persistentVolume:
+  enabled: true
+  size: 100Gi
+  storageClass: "local-path"
--- a/k8s/apps/ollama/openweb-ui-values.yaml
+++ b/k8s/apps/ollama/openweb-ui-values.yaml
@@ -1,4 +1,4 @@
-clusterDomain: ai.hexor.cy
+clusterDomain: cluster.local

 extraEnvVars:
  GLOBAL_LOG_LEVEL: debug
@@ -32,12 +32,22 @@ ollama:
        
 pipelines:
  enabled: true
+  nodeSelector:
+    kubernetes.io/hostname: master.tail2fe2d.ts.net
  
 tika:
  enabled: true
+  nodeSelector:
+    kubernetes.io/hostname: master.tail2fe2d.ts.net
  
 websocket:
  enabled: true
+  nodeSelector:
+    kubernetes.io/hostname: master.tail2fe2d.ts.net
+  redis:
+    master:
+      nodeSelector:
+        kubernetes.io/hostname: master.tail2fe2d.ts.net

 ingress:
    enabled: true
@@ -46,7 +56,5 @@ ingress:
      cert-manager.io/cluster-issuer: letsencrypt
      traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
    host: "ai.hexor.cy"
-    tls:
-      - hosts:
-          - '*.hexor.cy'
-        secretName: ollama-tls
+    tls: true
+    existingSecret: ollama-tls
--- a/k8s/apps/ollama/patch-runtimeclass.yaml
+++ b/k8s/apps/ollama/patch-runtimeclass.yaml
@@ -0,0 +1,9 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ollama
+  namespace: ollama
+spec:
+  template:
+    spec:
+      runtimeClassName: nvidia
--- a/k8s/apps/paperless/paperless-values.yaml
+++ b/k8s/apps/paperless/paperless-values.yaml
@@ -1,5 +1,5 @@
 image:
-  tag: 2.20.3
+  tag: latest
 resources:
  requests:
    memory: "1Gi"
@@ -9,7 +9,7 @@ resources:
    cpu: "3000m"
 initContainers:
  install-tesseract-langs:
-    image: ghcr.io/paperless-ngx/paperless-ngx:2.18.2
+    image: ghcr.io/paperless-ngx/paperless-ngx:latest
    resources:
      requests:
        memory: "256Mi"
--- a/k8s/core/authentik/external-secrets.yaml
+++ b/k8s/core/authentik/external-secrets.yaml
@@ -19,6 +19,14 @@ spec:
          {{ .password }}
        AUTHENTIK_SECRET_KEY: |-
          {{ .secret_key }}
+        POSTGRES_PASSWORD: |-
+          {{ .password }}
+        POSTGRES_USER: |-
+          {{ .username }}
+        username: |-
+          {{ .password }}
+        password: |-
+          {{ .username }}
  data:
    - secretKey: password
      sourceRef:
--- a/k8s/core/authentik/kustomization.yaml
+++ b/k8s/core/authentik/kustomization.yaml
@@ -5,12 +5,12 @@ resources:
  - app.yaml
  - external-secrets.yaml
  - https-middleware.yaml
-  - worker-restart.yaml
+# - worker-restart.yaml

 helmCharts:
  - name: authentik
    repo: https://charts.goauthentik.io
-    version: 2025.10.1
+    version: 2026.2.0
    releaseName: authentik
    namespace: authentik
    valuesFile: values.yaml
--- a/k8s/core/gpu/app.yaml
+++ b/k8s/core/gpu/app.yaml
@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: gpu-system
+  namespace: argocd
+spec:
+  project: core
+  destination:
+    namespace: gpu-system
+    server: https://kubernetes.default.svc
+  source:
+    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
+    targetRevision: HEAD
+    path: k8s/core/gpu
+  syncPolicy:
+    automated:
+      selfHeal: true
+      prune: true
+    syncOptions:
+      - CreateNamespace=true
--- a/k8s/core/gpu/kustomization.yaml
+++ b/k8s/core/gpu/kustomization.yaml
@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - app.yaml
+  - runtime-class.yaml
+
+helmCharts:
+  - name: nvidia-device-plugin
+    repo: https://nvidia.github.io/k8s-device-plugin
+    version: 0.17.0
+    releaseName: nvidia-device-plugin
+    namespace: gpu-system
+    valuesFile: values.yaml
+    includeCRDs: true
--- a/k8s/core/gpu/runtime-class.yaml
+++ b/k8s/core/gpu/runtime-class.yaml
@@ -0,0 +1,5 @@
+apiVersion: node.k8s.io/v1
+kind: RuntimeClass
+metadata:
+  name: nvidia
+handler: nvidia
--- a/k8s/core/gpu/values.yaml
+++ b/k8s/core/gpu/values.yaml
@@ -0,0 +1,23 @@
+nodeSelector:
+  kubernetes.io/hostname: uk-desktop.tail2fe2d.ts.net
+
+tolerations:
+  - key: workload
+    operator: Equal
+    value: desktop
+    effect: NoSchedule
+
+runtimeClassName: nvidia
+
+setAsDefault: false
+
+config:
+  default: any
+  map:
+    any: |-
+      version: v1
+      sharing:
+        timeSlicing:
+          resources:
+          - name: nvidia.com/gpu
+            replicas: 4
--- a/k8s/core/prom-stack/grafana-alerting-configmap.yaml
+++ b/k8s/core/prom-stack/grafana-alerting-configmap.yaml
@@ -260,7 +260,7 @@ data:
                  to: 0
                datasourceUid: P76F38748CEC837F0
                model:
-                  expr: 'node_load5 / on(instance) group_left count by(instance)(node_cpu_seconds_total{mode="idle"})'
+                  expr: 'node_load15 / on(instance) group_left count by(instance)(node_cpu_seconds_total{mode="idle"})'
                  refId: A
                  intervalMs: 1000
                  maxDataPoints: 43200
@@ -273,7 +273,7 @@ data:
                  conditions:
                    - evaluator:
                        params:
-                          - 0.8
+                          - 2
                        type: gt
                      operator:
                        type: and
@@ -283,16 +283,16 @@ data:
                    type: __expr__
                    uid: __expr__
                  expression: A
-                  reducer: max
+                  reducer: last
                  refId: B
                  type: reduce
            noDataState: NoData
            execErrState: Alerting
-            for: 5m
+            for: 15m
            annotations:
              node: '{{ $labels.instance }}'
              load_average: '{{ printf "%.2f" $values.A }}'
-              summary: 'Node load average is high relative to CPU count'
+              summary: 'Node load average is critically high relative to CPU count'
            labels:
              severity: warning

--- a/k8s/core/prom-stack/grafana-values.yaml
+++ b/k8s/core/prom-stack/grafana-values.yaml
@@ -1,85 +0,0 @@
-envFromSecret: grafana-admin
-nodeSelector:
-  kubernetes.io/hostname: master.tail2fe2d.ts.net
-
-admin:
-  existingSecret: grafana-admin
-  userKey: username
-  passwordKey: password
-
-grafana.ini:
-  auth:
-    signout_redirect_url: https://idm.hexor.cy/application/o/grafana/end-session/
-    # oauth_auto_login: true
-  auth.generic_oauth:
-    name: authentik
-    enabled: true
-    scopes: "openid profile email"
-    auth_url: https://idm.hexor.cy/application/o/authorize/
-    token_url: https://idm.hexor.cy/application/o/token/
-    api_url: https://idm.hexor.cy/application/o/userinfo/
-    role_attribute_path: >-
-      contains(groups, 'Grafana Admin') && 'Admin' ||
-      contains(groups, 'Grafana Editors') && 'Editor' ||
-      contains(groups, 'Grafana Viewer') && 'Viewer'
-  database:
-    type: postgres
-    host: psql.psql.svc:5432
-    name: grafana
-    user: grafana
-    ssl_mode: disable
-
-datasources:
-  datasources.yaml:
-    apiVersion: 1
-    datasources:
-      - name: Prometheus Local
-        type: prometheus
-        url: http://prometheus-kube-prometheus-prometheus.prometheus.svc:9090
-        access: proxy
-        isDefault: true
-      - name: Loki
-        type: loki
-        url: http://loki-gateway.prometheus.svc:80
-        access: proxy
-
-ingress:
-  enabled: true
-  ingressClassName: traefik
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
-  hosts:
-    - gf.hexor.cy
-  tls:
-    - secretName: grafana-tls
-      hosts:
-        - '*.hexor.cy'
-
-extraConfigmapMounts:
-  - name: grafana-alerting-rules
-    mountPath: /etc/grafana/provisioning/alerting/rules.yaml
-    configMap: grafana-alerting
-    subPath: rules.yaml
-    readOnly: true
-  - name: grafana-alerting-contactpoints
-    mountPath: /etc/grafana/provisioning/alerting/contactpoints.yaml
-    configMap: grafana-alerting
-    subPath: contactpoints.yaml
-    readOnly: true
-  - name: grafana-alerting-policies
-    mountPath: /etc/grafana/provisioning/alerting/policies.yaml
-    configMap: grafana-alerting
-    subPath: policies.yaml
-    readOnly: true
-
-envValueFrom:
-  TELEGRAM_BOT_TOKEN:
-    secretKeyRef:
-      name: grafana-telegram
-      key: bot-token
-  TELEGRAM_CHAT_ID:
-    secretKeyRef:
-      name: grafana-telegram
-      key: chat-id
-
--- a/k8s/core/prom-stack/kustomization.yaml
+++ b/k8s/core/prom-stack/kustomization.yaml
@@ -16,14 +16,6 @@ helmCharts:
    valuesFile: prom-values.yaml
    includeCRDs: true

-  - name: grafana
-    repo: https://grafana.github.io/helm-charts
-    version: 10.2.0
-    releaseName: grafana
-    namespace: prometheus
-    valuesFile: grafana-values.yaml
-    includeCRDs: true
-
  - name: loki
    repo: https://grafana.github.io/helm-charts
    version: 6.29.0
--- a/k8s/core/prom-stack/prom-values.yaml
+++ b/k8s/core/prom-stack/prom-values.yaml
@@ -1,5 +1,4 @@
-grafana:
-  enabled: false
+

 alertmanager:
  config:
@@ -92,3 +91,88 @@ prometheus:
            requests:
              storage: 400Gi

+grafana:
+  enabled: true
+  
+  serviceAccount:
+    create: true
+    name: "prom-grafana-sa"
+
+  envFromSecret: grafana-admin
+  nodeSelector:
+    kubernetes.io/hostname: master.tail2fe2d.ts.net
+
+  admin:
+    existingSecret: grafana-admin
+    userKey: username
+    passwordKey: password
+
+  grafana.ini:
+    auth:
+      signout_redirect_url: https://idm.hexor.cy/application/o/grafana/end-session/
+    auth.generic_oauth:
+      name: authentik
+      enabled: true
+      scopes: "openid profile email"
+      auth_url: https://idm.hexor.cy/application/o/authorize/
+      token_url: https://idm.hexor.cy/application/o/token/
+      api_url: https://idm.hexor.cy/application/o/userinfo/
+      role_attribute_path: >-
+        contains(groups, 'Grafana Admin') && 'Admin' ||
+        contains(groups, 'Grafana Editors') && 'Editor' ||
+        contains(groups, 'Grafana Viewer') && 'Viewer'
+    database:
+      type: postgres
+      host: psql.psql.svc:5432
+      name: grafana
+      user: grafana
+      ssl_mode: disable
+
+  # The Loki datasource config needs to be preserved, 
+  # but instead of "datasources.datasources.yaml", we define it like this for the prometheus-stack chart:
+  additionalDataSources:
+    - name: Loki
+      type: loki
+      url: http://loki-gateway.prometheus.svc:80
+      access: proxy
+      orgId: 1
+
+  ingress:
+    enabled: true
+    ingressClassName: traefik
+    annotations:
+      cert-manager.io/cluster-issuer: letsencrypt
+      traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
+    hosts:
+      - gf.hexor.cy
+    tls:
+      - secretName: grafana-tls
+        hosts:
+          - '*.hexor.cy'
+
+  extraConfigmapMounts:
+    - name: grafana-alerting-rules
+      mountPath: /etc/grafana/provisioning/alerting/rules.yaml
+      configMap: grafana-alerting
+      subPath: rules.yaml
+      readOnly: true
+    - name: grafana-alerting-contactpoints
+      mountPath: /etc/grafana/provisioning/alerting/contactpoints.yaml
+      configMap: grafana-alerting
+      subPath: contactpoints.yaml
+      readOnly: true
+    - name: grafana-alerting-policies
+      mountPath: /etc/grafana/provisioning/alerting/policies.yaml
+      configMap: grafana-alerting
+      subPath: policies.yaml
+      readOnly: true
+
+  envValueFrom:
+    TELEGRAM_BOT_TOKEN:
+      secretKeyRef:
+        name: grafana-telegram
+        key: bot-token
+    TELEGRAM_CHAT_ID:
+      secretKeyRef:
+        name: grafana-telegram
+        key: chat-id
--- a/terraform/authentik/proxy-apps.tfvars
+++ b/terraform/authentik/proxy-apps.tfvars
@@ -60,7 +60,23 @@ EOT
    create_group                 = true
    access_groups                = ["admins"]
  }
-
+  "mtproxy-links" = {
+    name                         = "mtproxy-links"
+    slug                         = "mtproxy-links"
+    group                        = "Core"
+    external_host                = "https://proxy.hexor.cy"
+    internal_host                = "http://secret-reader.mtproxy.svc:80"
+    internal_host_ssl_validation = false
+    meta_description             = ""
+    skip_path_regex              = <<-EOT
+/webhook
+EOT
+    meta_icon                    = "https://img.icons8.com/ios-filled/50/password.png"
+    mode                         = "proxy"
+    outpost                      = "kubernetes-outpost"
+    create_group                 = true
+    access_groups                = ["admins"]
+  }
  # Tools applications
  "vpn" = {
    name                         = "VPN"