Update k8s/apps/web-petting/deployment.yaml

2026-05-12 13:49:01 +00:00 · 2026-05-11 12:48:25 +00:00 · 2026-05-11 12:32:18 +00:00 · 2026-05-11 11:57:19 +00:00 · 2026-05-11 10:43:22 +00:00 · 2026-05-11 10:42:28 +00:00
112 changed files with 4200 additions and 85018 deletions
@@ -13,6 +13,7 @@ permissions:
 jobs:
  terraform:
    name: 'Terraform'
+    if: false
    runs-on: ubuntu-latest
    environment: production

@@ -25,7 +26,7 @@ jobs:
      uses: actions/checkout@v3

    - name: Setup Terraform
-      uses: hashicorp/setup-terraform@v2
+      uses: hashicorp/setup-terraform@v4.0.0
      with:
        cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}

@@ -45,7 +46,7 @@ jobs:
    - name: Terraform Apply
      env:
        TF_VAR_authentik_token: ${{ secrets.AUTHENTIK_TOKEN }}
-      run: terraform apply -var-file proxy-apps.tfvars -var-file oauth2-apps.tfvars -var-file terraform.tfvars -var-file groups.tfvars -input=false -auto-approve -parallelism=100
+      run: terraform apply -input=false -auto-approve -parallelism=100
      working-directory: ./terraform/authentik

    - name: Generate Wiki Content  
@@ -13,6 +13,7 @@ crash.*.log
 *.tfvars
 *.tfvars.json
 !*terraform.tfvars
+!*.auto.tfvars

 # claude ai
 .claude/
@@ -39,6 +39,7 @@ ArgoCD homelab project
 | Application | Status |
 | :--- | :---: |
 | **comfyui** | [![comfyui](https://ag.hexor.cy/api/badge?name=comfyui&revision=true)](https://ag.hexor.cy/applications/argocd/comfyui) |
+| **furumi-dev** | [![furumi-dev](https://ag.hexor.cy/api/badge?name=furumi-dev&revision=true)](https://ag.hexor.cy/applications/argocd/furumi-dev) |
 | **furumi-server** | [![furumi-server](https://ag.hexor.cy/api/badge?name=furumi-server&revision=true)](https://ag.hexor.cy/applications/argocd/furumi-server) |
 | **gitea** | [![gitea](https://ag.hexor.cy/api/badge?name=gitea&revision=true)](https://ag.hexor.cy/applications/argocd/gitea) |
 | **greece-notifier** | [![greece-notifier](https://ag.hexor.cy/api/badge?name=greece-notifier&revision=true)](https://ag.hexor.cy/applications/argocd/greece-notifier) |
@@ -49,6 +50,7 @@ ArgoCD homelab project
 | **k8s-secrets** | [![k8s-secrets](https://ag.hexor.cy/api/badge?name=k8s-secrets&revision=true)](https://ag.hexor.cy/applications/argocd/k8s-secrets) |
 | **khm** | [![khm](https://ag.hexor.cy/api/badge?name=khm&revision=true)](https://ag.hexor.cy/applications/argocd/khm) |
 | **lidarr** | [![lidarr](https://ag.hexor.cy/api/badge?name=lidarr&revision=true)](https://ag.hexor.cy/applications/argocd/lidarr) |
+| **matrix** | [![matrix](https://ag.hexor.cy/api/badge?name=matrix&revision=true)](https://ag.hexor.cy/applications/argocd/matrix) |
 | **mtproxy** | [![mtproxy](https://ag.hexor.cy/api/badge?name=mtproxy&revision=true)](https://ag.hexor.cy/applications/argocd/mtproxy) |
 | **n8n** | [![n8n](https://ag.hexor.cy/api/badge?name=n8n&revision=true)](https://ag.hexor.cy/applications/argocd/n8n) |
 | **ollama** | [![ollama](https://ag.hexor.cy/api/badge?name=ollama&revision=true)](https://ag.hexor.cy/applications/argocd/ollama) |
@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: furumi-dev
+  namespace: argocd
+spec:
+  project: apps
+  destination:
+    namespace: furumi-dev
+    server: https://kubernetes.default.svc
+  source:
+    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
+    targetRevision: HEAD
+    path: k8s/apps/furumi-dev
+  syncPolicy:
+    automated:
+      selfHeal: true
+      prune: true
+    syncOptions:
+      - CreateNamespace=true
@@ -0,0 +1,55 @@
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: furumi-ng-creds
+spec:
+  target:
+    name: furumi-ng-creds
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        OIDC_CLIENT_ID: |-
+          {{ .client_id }}
+        OIDC_CLIENT_SECRET: |-
+          {{ .client_secret }}
+        OIDC_ISSUER_URL: https://idm.hexor.cy/application/o/furumi-dev/
+        OIDC_REDIRECT_URL: https://music-dev.hexor.cy/auth/callback
+        OIDC_SESSION_SECRET: |-
+          {{ .session_secret }}
+        PG_STRING: |-
+          postgres://furumi_dev:{{ .pg_pass }}@psql.psql.svc:5432/furumi_dev
+  data:
+    - secretKey: client_id
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 960735e6-2cc9-4b68-9bd3-e6786e5a0cd6
+        property: fields[0].value
+    - secretKey: client_secret
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 960735e6-2cc9-4b68-9bd3-e6786e5a0cd6
+        property: fields[1].value
+    - secretKey: session_secret
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 960735e6-2cc9-4b68-9bd3-e6786e5a0cd6
+        property: fields[2].value
+    - secretKey: pg_pass
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 2a9deb39-ef22-433e-a1be-df1555625e22
+        property: fields[17].value
@@ -0,0 +1,66 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: admin-strip
+spec:
+  stripPrefix:
+    prefixes:
+      - /admin
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: furumi-tls-ingress
+  annotations:
+    ingressClassName: traefik
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
+    acme.cert-manager.io/http01-edit-in-place: "true"
+spec:
+  rules:
+    - host: music-dev.hexor.cy
+      http:
+        paths:
+          - path: /api
+            pathType: Prefix
+            backend:
+              service:
+                name: furumi-dev-web-player
+                port:
+                  number: 8080
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: furumi-dev-node-player
+                port:
+                  number: 3001
+  tls:
+    - secretName: furumi-tls
+      hosts:
+        - '*.hexor.cy'
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: furumi-dev-admin-ingress
+  annotations:
+    ingressClassName: traefik
+    traefik.ingress.kubernetes.io/router.middlewares: furumi-server-admin-strip@kubernetescrd,kube-system-https-redirect@kubernetescrd
+spec:
+  rules:
+    - host: music-dev.hexor.cy
+      http:
+        paths:
+          - path: /admin
+            pathType: Prefix
+            backend:
+              service:
+                name: furumi-dev-metadata-agent
+                port:
+                  number: 8090
+  tls:
+    - secretName: furumi-tls
+      hosts:
+        - '*.hexor.cy'
@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - app.yaml
+  - service.yaml
+  - external-secrets.yaml
+  - ingress.yaml
+  - web-player.yaml
+  - node-player.yaml
+  - metadata-agent.yaml
@@ -0,0 +1,59 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: furumi-dev-metadata-agent
+  labels:
+    app: furumi-dev-metadata-agent
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: furumi-dev-metadata-agent
+  template:
+    metadata:
+      labels:
+        app: furumi-dev-metadata-agent
+    spec:
+      nodeSelector:
+        kubernetes.io/hostname: master.tail2fe2d.ts.net
+      containers:
+        - name: furumi-dev-metadata-agent
+          image: ultradesu/furumi-metadata-agent:dev
+          imagePullPolicy: Always
+          env:
+            - name: FURUMI_AGENT_DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: PG_STRING
+            - name: FURUMI_AGENT_INBOX_DIR
+              value: "/inbox"
+            - name: FURUMI_AGENT_STORAGE_DIR
+              value: "/media"
+            - name: FURUMI_AGENT_OLLAMA_URL
+              value: "http://100.120.76.49:1234"
+            - name: FURUMI_AGENT_OLLAMA_MODEL
+              value: "qwen2.5-32b-instruct"
+            - name: FURUMI_AGENT_POLL_INTERVAL_SECS
+              value: "10"
+            - name: RUST_LOG
+              value: "info"
+          ports:
+            - name: admin-ui
+              containerPort: 8090
+              protocol: TCP
+          volumeMounts:
+            - name: library
+              mountPath: /media
+            - name: inbox
+              mountPath: /inbox
+      volumes:
+        - name: library
+          hostPath:
+            path: /k8s/furumi-dev/library
+            type: DirectoryOrCreate
+        - name: inbox
+          hostPath:
+            path: /k8s/furumi-dev/inbox
+            type: DirectoryOrCreate
+
@@ -0,0 +1,53 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: furumi-dev-node-player
+  labels:
+    app: furumi-dev-node-player
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: furumi-dev-node-player
+  template:
+    metadata:
+      labels:
+        app: furumi-dev-node-player
+    spec:
+      nodeSelector:
+        kubernetes.io/hostname: master.tail2fe2d.ts.net
+      containers:
+        - name: furumi-dev-node-player
+          image: ultradesu/furumi-node-player:dev
+          imagePullPolicy: Always
+          env:
+            - name: PORT
+              value: "3001"
+            - name: BASE_URL
+              value: "https://music-dev.hexor.cy"
+            - name: FRONTEND_ORIGIN
+              value: "https://music-dev.hexor.cy"
+            - name: SESSION_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_SESSION_SECRET
+            - name: OIDC_ISSUER_BASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_ISSUER_URL
+            - name: OIDC_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_CLIENT_ID
+            - name: OIDC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_CLIENT_SECRET
+          ports:
+            - name: http
+              containerPort: 3001
+              protocol: TCP
@@ -0,0 +1,48 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: furumi-dev-metadata-agent
+  labels:
+    app: furumi-dev-metadata-agent
+spec:
+  type: ClusterIP
+  selector:
+    app: furumi-dev-metadata-agent
+  ports:
+    - name: admin-ui
+      protocol: TCP
+      port: 8090
+      targetPort: 8090
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: furumi-dev-web-player
+  labels:
+    app: furumi-dev-web-player
+spec:
+  type: ClusterIP
+  selector:
+    app: furumi-dev-web-player
+  ports:
+    - name: http
+      protocol: TCP
+      port: 8080
+      targetPort: 8080
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: furumi-dev-node-player
+  labels:
+    app: furumi-dev-node-player
+spec:
+  type: ClusterIP
+  selector:
+    app: furumi-dev-node-player
+  ports:
+    - name: http
+      protocol: TCP
+      port: 3001
+      targetPort: 3001
@@ -0,0 +1,69 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: furumi-dev-web-player
+  labels:
+    app: furumi-dev-web-player
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: furumi-dev-web-player
+  template:
+    metadata:
+      labels:
+        app: furumi-dev-web-player
+    spec:
+      nodeSelector:
+        kubernetes.io/hostname: master.tail2fe2d.ts.net
+      containers:
+        - name: furumi-dev-web-player
+          image: ultradesu/furumi-web-player:dev
+          imagePullPolicy: Always
+          env:
+            - name: FURUMI_PLAYER_OIDC_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_CLIENT_ID
+            - name: FURUMI_PLAYER_OIDC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_CLIENT_SECRET
+            - name: FURUMI_PLAYER_OIDC_ISSUER_URL
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_ISSUER_URL
+            - name: FURUMI_PLAYER_OIDC_REDIRECT_URL
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_REDIRECT_URL
+            - name: FURUMI_PLAYER_OIDC_SESSION_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_SESSION_SECRET
+            - name: FURUMI_PLAYER_DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: PG_STRING
+            - name: FURUMI_PLAYER_STORAGE_DIR
+              value: "/media"
+            - name: RUST_LOG
+              value: "info"
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          volumeMounts:
+            - name: music
+              mountPath: /media
+      volumes:
+        - name: music
+          hostPath:
+            path: /k8s/furumi-dev/library
+            type: DirectoryOrCreate
@@ -18,13 +18,43 @@ spec:
        kubernetes.io/hostname: master.tail2fe2d.ts.net
      containers:
        - name: furumi-server
-          image: ultradesu/furumi-server:latest
+          image: ultradesu/furumi-server:trunk
          imagePullPolicy: Always
          env:
            - name: FURUMI_TOKEN
-              value: "f38387266e75effe891b7953eb9c06b4"
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: TOKEN
+            - name: FURUMI_OIDC_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_CLIENT_ID
+            - name: FURUMI_OIDC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_CLIENT_SECRET
+            - name: FURUMI_OIDC_ISSUER_URL
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_ISSUER_URL
+            - name: FURUMI_OIDC_REDIRECT_URL
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_REDIRECT_URL
+            - name: FURUMI_OIDC_SESSION_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_SESSION_SECRET
            - name: FURUMI_ROOT
              value: "/media"
+            - name: RUST_LOG
+              value: "info"
          ports:
            - name: grpc
              containerPort: 50051
@@ -32,6 +62,9 @@ spec:
            - name: metrics
              containerPort: 9090
              protocol: TCP
+            - name: web-ui
+              containerPort: 8080
+              protocol: TCP
          volumeMounts:
            - name: music
              mountPath: /media
@@ -0,0 +1,65 @@
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: furumi-ng-creds
+spec:
+  target:
+    name: furumi-ng-creds
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        TOKEN: |-
+          {{ .token }}
+        OIDC_CLIENT_ID: |-
+          {{ .client_id }}
+        OIDC_CLIENT_SECRET: |-
+          {{ .client_secret }}
+        OIDC_ISSUER_URL: https://idm.hexor.cy/application/o/furumi-ng-web/
+        OIDC_REDIRECT_URL: https://music.hexor.cy/auth/callback
+        OIDC_SESSION_SECRET: |-
+          {{ .session_secret }}
+        PG_STRING: |-
+          postgres://furumi:{{ .pg_pass }}@psql.psql.svc:5432/furumi
+  data:
+    - secretKey: token
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
+        property: fields[0].value
+    - secretKey: client_id
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
+        property: fields[1].value
+    - secretKey: client_secret
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
+        property: fields[2].value
+    - secretKey: session_secret
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
+        property: fields[3].value
+    - secretKey: pg_pass
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 2a9deb39-ef22-433e-a1be-df1555625e22
+        property: fields[16].value
@@ -0,0 +1,59 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: admin-strip
+spec:
+  stripPrefix:
+    prefixes:
+      - /admin
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: furumi-tls-ingress
+  annotations:
+    ingressClassName: traefik
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
+    acme.cert-manager.io/http01-edit-in-place: "true"
+spec:
+  rules:
+    - host: music.hexor.cy
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: furumi-web-player
+                port:
+                  number: 8080
+  tls:
+    - secretName: furumi-tls
+      hosts:
+        - '*.hexor.cy'
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: furumi-admin-ingress
+  annotations:
+    ingressClassName: traefik
+    traefik.ingress.kubernetes.io/router.middlewares: furumi-server-admin-strip@kubernetescrd,kube-system-https-redirect@kubernetescrd
+spec:
+  rules:
+    - host: music.hexor.cy
+      http:
+        paths:
+          - path: /admin
+            pathType: Prefix
+            backend:
+              service:
+                name: furumi-metadata-agent
+                port:
+                  number: 8090
+  tls:
+    - secretName: furumi-tls
+      hosts:
+        - '*.hexor.cy'
@@ -6,3 +6,7 @@ resources:
  - deployment.yaml
  - service.yaml
  - servicemonitor.yaml
+  - external-secrets.yaml
+  - ingress.yaml
+  - web-player.yaml
+  - metadata-agent.yaml
@@ -0,0 +1,59 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: furumi-metadata-agent
+  labels:
+    app: furumi-metadata-agent
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: furumi-metadata-agent
+  template:
+    metadata:
+      labels:
+        app: furumi-metadata-agent
+    spec:
+      nodeSelector:
+        kubernetes.io/hostname: master.tail2fe2d.ts.net
+      containers:
+        - name: furumi-metadata-agent
+          image: ultradesu/furumi-metadata-agent:trunk
+          imagePullPolicy: Always
+          env:
+            - name: FURUMI_AGENT_DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: PG_STRING
+            - name: FURUMI_AGENT_INBOX_DIR
+              value: "/inbox"
+            - name: FURUMI_AGENT_STORAGE_DIR
+              value: "/media"
+            - name: FURUMI_AGENT_OLLAMA_URL
+              value: "http://100.120.76.49:1234"
+            - name: FURUMI_AGENT_OLLAMA_MODEL
+              value: "google/gemma-4-26b-a4b"
+            - name: FURUMI_AGENT_POLL_INTERVAL_SECS
+              value: "10"
+            - name: RUST_LOG
+              value: "info"
+          ports:
+            - name: admin-ui
+              containerPort: 8090
+              protocol: TCP
+          volumeMounts:
+            - name: library
+              mountPath: /media
+            - name: inbox
+              mountPath: /inbox
+      volumes:
+        - name: library
+          hostPath:
+            path: /k8s/furumi/library
+            type: DirectoryOrCreate
+        - name: inbox
+          hostPath:
+            path: /k8s/furumi/inbox
+            type: DirectoryOrCreate
+
@@ -28,3 +28,35 @@ spec:
      protocol: TCP
      port: 9090
      targetPort: 9090
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: furumi-metadata-agent
+  labels:
+    app: furumi-metadata-agent
+spec:
+  type: ClusterIP
+  selector:
+    app: furumi-metadata-agent
+  ports:
+    - name: admin-ui
+      protocol: TCP
+      port: 8090
+      targetPort: 8090
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: furumi-web-player
+  labels:
+    app: furumi-web-player
+spec:
+  type: ClusterIP
+  selector:
+    app: furumi-web-player
+  ports:
+    - name: web-ui
+      protocol: TCP
+      port: 8080
+      targetPort: 8080
@@ -0,0 +1,70 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: furumi-web-player
+  labels:
+    app: furumi-web-player
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: furumi-web-player
+  template:
+    metadata:
+      labels:
+        app: furumi-web-player
+    spec:
+      nodeSelector:
+        kubernetes.io/hostname: master.tail2fe2d.ts.net
+      containers:
+        - name: furumi-web-player
+          image: ultradesu/furumi-web-player:trunk
+          imagePullPolicy: Always
+          env:
+            - name: FURUMI_PLAYER_OIDC_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_CLIENT_ID
+            - name: FURUMI_PLAYER_OIDC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_CLIENT_SECRET
+            - name: FURUMI_PLAYER_OIDC_ISSUER_URL
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_ISSUER_URL
+            - name: FURUMI_PLAYER_OIDC_REDIRECT_URL
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_REDIRECT_URL
+            - name: FURUMI_PLAYER_OIDC_SESSION_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_SESSION_SECRET
+            - name: FURUMI_PLAYER_DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: PG_STRING
+            - name: FURUMI_PLAYER_STORAGE_DIR
+              value: "/media"
+            - name: RUST_LOG
+              value: "info"
+          ports:
+            - name: web-ui
+              containerPort: 8080
+              protocol: TCP
+          volumeMounts:
+            - name: music
+              mountPath: /media
+      volumes:
+        - name: music
+          hostPath:
+            path: /k8s/furumi/library
+            type: DirectoryOrCreate
+
@@ -48,6 +48,8 @@ spec:
              value: "true"
            - name: GITEA__service__CAPTCHA_TYPE
              value: "hcaptcha"
+            - name: GITEA__webhook__ALLOWED_HOST_LIST
+              value: "*"
          envFrom:
          - secretRef:
              name: gitea-recapcha-creds
@@ -68,7 +70,7 @@ kind: Deployment
 metadata:
  name: gitea-runner
 spec:
-  replicas: 1
+  replicas: 2
  selector:
    matchLabels:
      app: gitea-runner
@@ -77,8 +79,19 @@ spec:
      labels:
        app: gitea-runner
    spec:
-      #nodeSelector:
-      #  kubernetes.io/hostname: home.homenet
+      dnsConfig:
+        options:
+          - name: ndots
+            value: "2"
+      tolerations:
+        - key: workload
+          operator: Equal
+          value: desktop
+          effect: NoSchedule
+        - key: workload
+          operator: Equal
+          value: ai
+          effect: NoSchedule
      volumes:
        - name: docker-sock
          hostPath:
@@ -88,55 +101,42 @@ spec:
          emptyDir:
            sizeLimit: 30Gi
      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchLabels:
+                  app: gitea-runner
+              topologyKey: kubernetes.io/hostname
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
-          - weight: 1
+          - weight: 100
+            preference:
+              matchExpressions:
+              - key: kubernetes.io/hostname
+                operator: In
+                values:
+                - uk-desktop.tail2fe2d.ts.net
+                - ai.tail2fe2d.ts.net
+          - weight: 50
            preference:
              matchExpressions:
              - key: kubernetes.io/hostname
                operator: In
                values:
                - home.homenet
-          - weight: 2
-            preference:
-              matchExpressions:
-              - key: kubernetes.io/hostname
-                operator: In
-                values:
-                - master.tail2fe2d.ts.net
-          - weight: 3
-            preference:
-              matchExpressions:
-              - key: kubernetes.io/hostname
-                operator: In
-                values:
                - it.tail2fe2d.ts.net
-                - ch.tail2fe2d.ts.net
-                - us.tail2fe2d.ts.net
-
-          requiredDuringSchedulingIgnoredDuringExecution:
-            nodeSelectorTerms:
-            - matchExpressions:
-              - key: kubernetes.io/hostname
-                operator: In
-                values:
-                - home.homenet
-                - it.tail2fe2d.ts.net
-                - ch.tail2fe2d.ts.net
-                - us.tail2fe2d.ts.net
-                - master.tail2fe2d.ts.net
      containers:
        - name: gitea-runner
          image: gitea/act_runner:nightly
          resources:
-            requests:
-              cpu: "100m"
-              memory: "256Mi"
-              ephemeral-storage: "1Gi"   # reserve ephemeral storage
-            limits:
-              cpu: "3000m"
-              memory: "4Gi"
-              ephemeral-storage: "28Gi"   # hard cap for /data usage
+            #requests:
+            #  cpu: "100m"
+            #  memory: "256Mi"
+            #  ephemeral-storage: "1Gi"
+            #limits:
+            #  cpu: "3000m"
+            #  memory: "4Gi"
+            #  ephemeral-storage: "28Gi"
          volumeMounts:
            - name: docker-sock
              mountPath: /var/run/docker.sock
@@ -144,13 +144,18 @@ spec:
              mountPath: /data
          env:
            - name: GITEA_INSTANCE_URL
+              #value: "http://gitea.gitea.svc.cluster.local"
              value: "https://gt.hexor.cy"
            - name: GITEA_RUNNER_REGISTRATION_TOKEN
              valueFrom:
                secretKeyRef:
                  name: gitea-runner-act-runner-secrets
                  key: token
+            - name: NODE_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
            - name: GITEA_RUNNER_NAME
-              value: "k8s-runner"
+              value: "$(NODE_NAME)"
            - name: GITEA_RUNNER_LABELS
              value: "ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-latest,ubuntu-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04,ubuntu-20.04:docker://ghcr.io/catthehacker/ubuntu:act-20.04"
@@ -0,0 +1,46 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: auth-proxy
+spec:
+  forwardAuth:
+    address: http://auth-proxy.auth-proxy.svc:80/auth
+    trustForwardHeader: true
+    authResponseHeaders:
+      - X-Auth-Request-User
+      - X-Auth-Request-Email
+      - X-Auth-Request-Groups
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: secret-reader
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`pass.hexor.cy`)
+      kind: Rule
+      middlewares:
+        - name: auth-proxy
+      services:
+        - name: secret-reader
+          port: 80
+  tls:
+    secretName: secret-reader-tls
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: secret-reader-tls
+spec:
+  secretName: secret-reader-tls
+  issuerRef:
+    name: letsencrypt
+    kind: ClusterIssuer
+  dnsNames:
+    - pass.hexor.cy
+
@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: matrix
+  namespace: argocd
+spec:
+  project: apps
+  destination:
+    namespace: matrix
+    server: https://kubernetes.default.svc
+  source:
+    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
+    targetRevision: HEAD
+    path: k8s/apps/matrix
+  syncPolicy:
+    automated:
+      selfHeal: true
+      prune: true
+    syncOptions:
+      - CreateNamespace=true
@@ -0,0 +1,95 @@
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: matrix-postgres-creds
+spec:
+  target:
+    name: matrix-postgres-creds
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        synapse_db_password: |-
+          {{ .synapse_db_password }}
+        mas_db_password: |-
+          {{ .mas_db_password }}
+  data:
+    - secretKey: synapse_db_password
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: 2a9deb39-ef22-433e-a1be-df1555625e22
+        property: fields[14].value
+    - secretKey: mas_db_password
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: 2a9deb39-ef22-433e-a1be-df1555625e22
+        property: fields[15].value
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: matrix-oidc-config
+spec:
+  target:
+    name: matrix-oidc-config
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        mas-oidc.yaml: |
+          upstream_oauth2:
+            providers:
+              - id: 001KKV4EKY7KG98W2M9T806K6A
+                human_name: Authentik
+                issuer: https://idm.hexor.cy/application/o/matrix/
+                client_id: "{{ .oauth_client_id }}"
+                client_secret: "{{ .oauth_client_secret }}"
+                token_endpoint_auth_method: client_secret_post
+                scope: "openid profile email"
+                claims_imports:
+                  localpart:
+                    action: suggest
+                    template: "{{ `{{ user.preferred_username | split(\"@\") | first }}` }}"
+                  displayname:
+                    action: suggest
+                    template: "{{ `{{ user.name }}` }}"
+                  email:
+                    action: suggest
+                    template: "{{ `{{ user.email }}` }}"
+                    set_email_verification: always
+  data:
+    - secretKey: oauth_client_id
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: ca76867f-49f3-4a30-9ef3-b05af35ee49a
+        property: fields[0].value
+    - secretKey: oauth_client_secret
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: ca76867f-49f3-4a30-9ef3-b05af35ee49a
+        property: fields[1].value
@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - app.yaml
+  - external-secrets.yaml
+
+helmCharts:
+  - name: matrix-stack
+    repo: oci://ghcr.io/element-hq/ess-helm
+    version: 26.2.3
+    releaseName: matrix-stack
+    namespace: matrix
+    valuesFile: matrix-stack-values.yaml
+    includeCRDs: true
@@ -0,0 +1,120 @@
+## Matrix server name - appears in @user:matrix.hexor.cy
+serverName: matrix.hexor.cy
+
+## Use letsencrypt cluster issuer for all ingresses
+certManager:
+  clusterIssuer: letsencrypt
+
+## Global ingress settings
+ingress:
+  className: traefik
+  annotations:
+    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
+
+## Disable built-in PostgreSQL - using external database
+postgres:
+  enabled: false
+
+## Disable components we don't need yet
+hookshot:
+  enabled: false
+
+## MatrixRTC - voice/video calls via LiveKit SFU
+matrixRTC:
+  enabled: true
+  ingress:
+    host: livekit.matrix.hexor.cy
+  sfu:
+    enabled: true
+    manualIP: "78.24.180.234"
+    nodeSelector:
+      kubernetes.io/hostname: spb.tail2fe2d.ts.net
+    exposedServices:
+      rtcTcp:
+        enabled: true
+        port: 30881
+      rtcMuxedUdp:
+        enabled: true
+        port: 30882
+      turnTLS:
+        enabled: true
+        port: 31443
+        domain: turn.matrix.hexor.cy
+        tlsTerminationOnPod: true
+
+## Synapse homeserver
+synapse:
+  enabled: true
+  additional:
+    0-search-config:
+      config: |
+        user_directory:
+          enabled: true
+          search_all_users: true
+          prefer_local_users: true
+        enable_room_list_search: true
+  ingress:
+    host: synapse.matrix.hexor.cy
+  postgres:
+    host: psql.psql.svc
+    port: 5432
+    user: synapse
+    database: synapse
+    sslMode: prefer
+    password:
+      secret: matrix-postgres-creds
+      secretKey: synapse_db_password
+  nodeSelector:
+    kubernetes.io/hostname: master.tail2fe2d.ts.net
+  media:
+    storage:
+      size: 20Gi
+    maxUploadSize: 100M
+
+## Matrix Authentication Service
+matrixAuthenticationService:
+  enabled: true
+  ingress:
+    host: auth.matrix.hexor.cy
+  postgres:
+    host: psql.psql.svc
+    port: 5432
+    user: mas
+    database: mas
+    sslMode: prefer
+    password:
+      secret: matrix-postgres-creds
+      secretKey: mas_db_password
+  ## Admin policy
+  additional:
+    0-admin-policy:
+      config: |
+        policy:
+          data:
+            admin_users:
+              - username: ultradesu
+    1-oidc:
+      configSecret: matrix-oidc-config
+      configSecretKey: mas-oidc.yaml
+  nodeSelector:
+    kubernetes.io/hostname: master.tail2fe2d.ts.net
+
+## Element Web client
+elementWeb:
+  enabled: true
+  ingress:
+    host: chat.matrix.hexor.cy
+  nodeSelector:
+    kubernetes.io/hostname: master.tail2fe2d.ts.net
+
+## Element Admin panel
+elementAdmin:
+  enabled: true
+  ingress:
+    host: admin.matrix.hexor.cy
+  nodeSelector:
+    kubernetes.io/hostname: master.tail2fe2d.ts.net
+
+## Well-known delegation on the base domain (host is derived from serverName)
+wellKnownDelegation:
+  enabled: true
@@ -5,7 +5,12 @@ resources:
  - ./app.yaml
  - ./rbac.yaml
  - ./daemonset.yaml
+  - ./telemt-daemonset.yaml
  - ./external-secrets.yaml
+  - ./telemt-external-secrets.yaml
+  - ./telemt-service.yaml
+  - ./telemt-servicemonitor.yaml
  - ./service.yaml
  - ./secret-reader.yaml
+  - ./secret-reader-ingress.yaml
 # - ./storage.yaml
@@ -0,0 +1,45 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: auth-proxy
+spec:
+  forwardAuth:
+    address: http://auth-proxy.auth-proxy.svc:80/auth
+    trustForwardHeader: true
+    authResponseHeaders:
+      - X-Auth-Request-User
+      - X-Auth-Request-Email
+      - X-Auth-Request-Groups
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: secret-reader
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`secret-reader.hexor.cy`)
+      kind: Rule
+      middlewares:
+        - name: auth-proxy
+      services:
+        - name: secret-reader
+          port: 80
+  tls:
+    secretName: secret-reader-tls
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: secret-reader-tls
+spec:
+  secretName: secret-reader-tls
+  issuerRef:
+    name: letsencrypt
+    kind: ClusterIssuer
+  dnsNames:
+    - secret-reader.hexor.cy
@@ -23,7 +23,7 @@ spec:
        imagePullPolicy: Always
        args:
          - "--secrets"
-          - "mtproxy-links"
+          - "mtproxy-links,telemt-links"
          - "--namespace"
          - "mtproxy"
          - "--port"
@@ -0,0 +1,115 @@
+---
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: telemt
+  labels:
+    app: telemt
+spec:
+  selector:
+    matchLabels:
+      app: telemt
+  updateStrategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: telemt
+    spec:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: mtproxy
+                    operator: Exists
+      serviceAccountName: mtproxy
+      hostNetwork: true
+      dnsPolicy: ClusterFirstWithHostNet
+      initContainers:
+        - name: register-proxy
+          image: bitnami/kubectl:latest
+          env:
+            - name: NODE_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: spec.nodeName
+            - name: SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: tgproxy-secret
+                  key: SECRET
+            - name: TELEMT_PORT
+              valueFrom:
+                secretKeyRef:
+                  name: telemt-secret
+                  key: PORT
+          command:
+            - /bin/bash
+            - -c
+            - |
+              set -e
+              NAMESPACE=$(cat /var/run/secrets/kubernetes.io/serviceaccount/namespace)
+              SERVER=$(kubectl get node "${NODE_NAME}" -o jsonpath='{.metadata.labels.mtproxy}')
+              if [ -z "${SERVER}" ]; then
+                echo "ERROR: node ${NODE_NAME} has no mtproxy label"
+                exit 1
+              fi
+              # Build ee-prefixed secret: ee + secret + hex(tls_domain)
+              # "ya.ru" = 79612e7275
+              EE_SECRET="ee${SECRET}79612e7275"
+              LINK="tg://proxy?server=${SERVER}&port=${TELEMT_PORT}&secret=${EE_SECRET}"
+              echo "Registering telemt: ${SERVER} -> ${LINK}"
+              if kubectl get secret telemt-links -n "${NAMESPACE}" &>/dev/null; then
+                kubectl patch secret telemt-links -n "${NAMESPACE}" \
+                  --type merge -p "{\"stringData\":{\"${SERVER}\":\"${LINK}\"}}"
+              else
+                kubectl create secret generic telemt-links -n "${NAMESPACE}" \
+                  --from-literal="${SERVER}=${LINK}"
+              fi
+              echo "Done"
+      containers:
+        - name: telemt
+          image: ghcr.io/telemt/telemt:latest
+          imagePullPolicy: Always
+          ports:
+            - name: proxy
+              containerPort: 30444
+              protocol: TCP
+            - name: api
+              containerPort: 9091
+              protocol: TCP
+          workingDir: /run/telemt
+          env:
+            - name: RUST_LOG
+              value: info
+          volumeMounts:
+            - name: workdir
+              mountPath: /run/telemt
+            - name: config
+              mountPath: /run/telemt/config.toml
+              subPath: config.toml
+              readOnly: true
+            - name: etcdir
+              mountPath: /etc/telemt
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+      volumes:
+        - name: config
+          secret:
+            secretName: telemt-secret
+            items:
+              - key: config.toml
+                path: config.toml
+        - name: workdir
+          emptyDir:
+            medium: Memory
+            sizeLimit: 1Mi
+        - name: etcdir
+          emptyDir:
+            medium: Memory
+            sizeLimit: 1Mi
@@ -0,0 +1,59 @@
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: telemt-secret
+spec:
+  target:
+    name: telemt-secret
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        SECRET: |-
+          {{ .secret }}
+        PORT: "30444"
+        config.toml: |
+          [general]
+          use_middle_proxy = true
+          log_level = "normal"
+
+          [general.modes]
+          classic = false
+          secure = false
+          tls = true
+
+          [general.links]
+          show = "*"
+          public_port = 30444
+
+          [server]
+          port = 30444
+          metrics_port = 9090
+          metrics_whitelist = ["0.0.0.0/0"]
+
+          [server.api]
+          enabled = true
+          listen = "0.0.0.0:9091"
+          whitelist = ["0.0.0.0/0"]
+
+          [[server.listeners]]
+          ip = "0.0.0.0"
+
+          [censorship]
+          tls_domain = "ya.ru"
+          mask = true
+          tls_emulation = true
+          tls_front_dir = "tlsfront"
+
+          [access.users]
+          user = "{{ .secret }}"
+  data:
+    - secretKey: secret
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 58a37daf-72d8-430d-86bd-6152aa8f888d
+        property: fields[0].value
@@ -0,0 +1,17 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: telemt-metrics
+  labels:
+    app: telemt
+spec:
+  type: ClusterIP
+  clusterIP: None
+  selector:
+    app: telemt
+  ports:
+    - port: 9090
+      targetPort: 9090
+      protocol: TCP
+      name: metrics
@@ -0,0 +1,24 @@
+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: telemt-metrics
+  labels:
+    app: telemt
+    release: prometheus
+spec:
+  selector:
+    matchLabels:
+      app: telemt
+  endpoints:
+    - port: metrics
+      path: /metrics
+      interval: 30s
+      scrapeTimeout: 10s
+      honorLabels: true
+      relabelings:
+        - sourceLabels: [__meta_kubernetes_pod_node_name]
+          targetLabel: node
+  namespaceSelector:
+    matchNames:
+      - mtproxy
@@ -4,6 +4,7 @@ kind: Kustomization
 resources:
  - external-secrets.yaml
  - local-pv.yaml
+  - open-terminal.yaml
  
 helmCharts:
  - name: ollama
@@ -15,7 +16,7 @@ helmCharts:
    includeCRDs: true
  - name: open-webui
    repo: https://helm.openwebui.com/
-    version: 12.8.1
+    version: 12.10.0
    releaseName: openweb-ui
    namespace: ollama
    valuesFile: openweb-ui-values.yaml
@@ -0,0 +1,53 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: open-terminal
+  labels:
+    app: open-terminal
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: open-terminal
+  template:
+    metadata:
+      labels:
+        app: open-terminal
+    spec:
+      nodeSelector:
+        kubernetes.io/hostname: uk-desktop.tail2fe2d.ts.net
+      tolerations:
+        - key: workload
+          operator: Equal
+          value: desktop
+          effect: NoSchedule
+      containers:
+        - name: open-terminal
+          image: ghcr.io/open-webui/open-terminal:latest
+          ports:
+            - containerPort: 8000
+          env:
+            - name: OPEN_TERMINAL_API_KEY
+              value: "LOCAL_ACCESS_TOKEN"
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: "2"
+              memory: 2Gi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: open-terminal
+  labels:
+    app: open-terminal
+spec:
+  selector:
+    app: open-terminal
+  ports:
+    - port: 8000
+      targetPort: 8000
+      protocol: TCP
@@ -1,71 +1,5 @@
 ---
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: pasarguard-node
-  labels:
-    app: pasarguard-node
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: pasarguard-node-configmap
-  labels:
-    app: pasarguard-node
-rules:
-  - apiGroups: [""]
-    resources: ["configmaps"]
-    verbs: ["get", "list", "create", "update", "patch"]
-  - apiGroups: ["cert-manager.io"]
-    resources: ["certificates"]
-    verbs: ["get", "list", "create", "update", "patch", "delete"]
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get", "list"]
-  - apiGroups: [""]
-    resources: ["services", "endpoints"]
-    verbs: ["get", "list", "create", "update", "patch", "delete"]
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: pasarguard-node-configmap
-  labels:
-    app: pasarguard-node
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: pasarguard-node-configmap
-subjects:
-  - kind: ServiceAccount
-    name: pasarguard-node
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: pasarguard-node-reader
-  labels:
-    app: pasarguard-node
-rules:
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["get", "list"]
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: pasarguard-node-reader
-  labels:
-    app: pasarguard-node
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: pasarguard-node-reader
-subjects:
-  - kind: ServiceAccount
-    name: pasarguard-node
-    namespace: pasarguard
---
+image: &image 'pasarguard/node:v0.4.0'
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
@@ -113,7 +47,7 @@ spec:
              mountPath: /scripts
      containers:
        - name: pasarguard-node
-          image: 'pasarguard/node:v0.2.1'
+          image: *image
          imagePullPolicy: Always
          command:
            - /bin/sh
@@ -219,3 +153,71 @@ spec:
          configMap:
            name: pasarguard-scripts
            defaultMode: 0755
+
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: pasarguard-node
+  labels:
+    app: pasarguard-node
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: pasarguard-node-configmap
+  labels:
+    app: pasarguard-node
+rules:
+  - apiGroups: [""]
+    resources: ["configmaps"]
+    verbs: ["get", "list", "create", "update", "patch"]
+  - apiGroups: ["cert-manager.io"]
+    resources: ["certificates"]
+    verbs: ["get", "list", "create", "update", "patch", "delete"]
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "list"]
+  - apiGroups: [""]
+    resources: ["services", "endpoints"]
+    verbs: ["get", "list", "create", "update", "patch", "delete"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: pasarguard-node-configmap
+  labels:
+    app: pasarguard-node
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: pasarguard-node-configmap
+subjects:
+  - kind: ServiceAccount
+    name: pasarguard-node
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: pasarguard-node-reader
+  labels:
+    app: pasarguard-node
+rules:
+  - apiGroups: [""]
+    resources: ["nodes"]
+    verbs: ["get", "list"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: pasarguard-node-reader
+  labels:
+    app: pasarguard-node
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: pasarguard-node-reader
+subjects:
+  - kind: ServiceAccount
+    name: pasarguard-node
+    namespace: pasarguard
@@ -1,4 +1,5 @@
 ---
+image: &image 'pasarguard/panel:v3.1.0'
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -34,7 +35,7 @@ spec:
              mountPath: /templates/subscription
      containers:
        - name: pasarguard-web
-          image: 'pasarguard/panel:latest'
+          image: *image
          imagePullPolicy: Always
          envFrom:
            - secretRef:
@@ -75,6 +76,9 @@ apiVersion: v1
 kind: Service
 metadata:
  name: pasarguard
+  annotations:
+    traefik.ingress.kubernetes.io/service.serversscheme: https
+    traefik.ingress.kubernetes.io/service.serverstransport: pasarguard-pasarguard-transport@kubernetescrd
 spec:
  selector:
    app: pasarguard
@@ -0,0 +1,31 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: ServersTransport
+metadata:
+  name: pasarguard-transport
+spec:
+  insecureSkipVerify: true
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: pasarguard-ingress
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: ps.hexor.cy
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: pasarguard
+                port:
+                  number: 80
+  tls:
+    - secretName: pasarguard-tls
+      hosts:
+        - ps.hexor.cy
@@ -9,3 +9,4 @@ resources:
  - ./certificate.yaml
  - ./configmap-scripts.yaml
  - ./servicemonitor.yaml
+  - ./ingress.yaml
@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: teamspeak
+  namespace: argocd
+spec:
+  project: apps
+  destination:
+    namespace: teamspeak
+    server: https://kubernetes.default.svc
+  source:
+    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
+    targetRevision: HEAD
+    path: k8s/apps/teamspeak
+  syncPolicy:
+    automated:
+      selfHeal: true
+      prune: true
+    syncOptions:
+      - CreateNamespace=true
@@ -0,0 +1,49 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: teamspeak
+  labels:
+    app: teamspeak
+spec:
+  selector:
+    matchLabels:
+      app: teamspeak
+  replicas: 1
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: teamspeak
+    spec:
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: teamspeak-data
+      containers:
+        - name: teamspeak
+          image: 'teamspeak:latest'
+          env:
+            - name: TS3SERVER_LICENSE
+              value: "accept"
+          resources:
+            requests:
+              memory: "256Mi"
+              cpu: "100m"
+            limits:
+              memory: "512Mi"
+              cpu: "1000m"
+          ports:
+            - name: voice
+              containerPort: 9987
+              protocol: UDP
+            - name: filetransfer
+              containerPort: 30033
+              protocol: TCP
+            - name: serverquery
+              containerPort: 10011
+              protocol: TCP
+          volumeMounts:
+            - name: data
+              mountPath: /var/ts3server
@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - app.yaml
+  - storage.yaml
+  - deployment.yaml
+  - service.yaml
@@ -0,0 +1,22 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: teamspeak
+spec:
+  type: LoadBalancer
+  selector:
+    app: teamspeak
+  ports:
+    - name: voice
+      protocol: UDP
+      port: 9987
+      targetPort: 9987
+    - name: filetransfer
+      protocol: TCP
+      port: 30033
+      targetPort: 30033
+    - name: serverquery
+      protocol: TCP
+      port: 10011
+      targetPort: 10011
@@ -0,0 +1,12 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: teamspeak-data
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 5Gi
@@ -0,0 +1,21 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: web-petting
+  namespace: argocd
+spec:
+  project: apps
+  destination:
+    namespace: web-petting
+    server: https://kubernetes.default.svc
+  source:
+    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
+    targetRevision: HEAD
+    path: k8s/apps/web-petting
+  syncPolicy:
+    automated:
+      selfHeal: true
+      prune: true
+    syncOptions:
+      - CreateNamespace=true
+
@@ -0,0 +1,49 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: web-petting
+  labels:
+    app: web-petting
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: web-petting
+  template:
+    metadata:
+      labels:
+        app: web-petting
+    spec:
+      nodeSelector:
+        kubernetes.io/os: linux
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: web-petting-data
+      containers:
+      - name: web-petting
+        image: ultradesu/web-petting:v0.1.5
+        imagePullPolicy: Always
+        args:
+#         - "tail"
+#         - "-F"
+#         - "/1"
+          - "web-petting"
+          - "-l"
+          - "0.0.0.0:3000"
+        ports:
+        - containerPort: 3000
+          name: http
+        volumeMounts:
+          - name: data
+            mountPath: /data
+        env:
+        - name: RUST_LOG
+          value: "info"
+        resources:
+          requests:
+            memory: "64Mi"
+            cpu: "50m"
+          limits:
+            memory: "128Mi"
+            cpu: "150m"
@@ -0,0 +1,27 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: web-petting-tls-ingress
+  annotations:
+    ingressClassName: traefik
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
+    acme.cert-manager.io/http01-edit-in-place: "true"
+spec:
+  rules:
+    - host: pet.hexor.cy
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: web-petting
+                port:
+                  number: 80
+  tls:
+    - secretName: web-petting-tls
+      hosts:
+        - pet.hexor.cy
+
@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - app.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml
+  - storage.yaml
+
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: web-petting
+  labels:
+    app: web-petting
+spec:
+  type: ClusterIP
+  selector:
+    app: web-petting
+  ports:
+  - port: 80
+    targetPort: 3000
+    protocol: TCP
+    name: http
@@ -0,0 +1,12 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: web-petting-data
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 10Gi
@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: wedding
+  namespace: argocd
+spec:
+  project: apps
+  destination:
+    namespace: wedding
+    server: https://kubernetes.default.svc
+  source:
+    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
+    targetRevision: HEAD
+    path: k8s/apps/wedding
+  syncPolicy:
+    automated:
+      selfHeal: true
+      prune: true
+    syncOptions:
+      - CreateNamespace=true
@@ -0,0 +1,69 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: wedding
+  labels:
+    app: wedding
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: wedding
+  template:
+    metadata:
+      labels:
+        app: wedding
+    spec:
+      nodeSelector:
+        kubernetes.io/hostname: spb.tail2fe2d.ts.net
+      initContainers:
+        - name: git-clone
+          image: alpine/git:latest
+          command:
+            - sh
+            - -c
+            - git clone --depth 1 https://gt.hexor.cy/ab/wedding.git /src
+          volumeMounts:
+            - name: source
+              mountPath: /src
+        - name: zola-build
+          image: ghcr.io/getzola/zola:v0.22.1
+          command:
+            - /bin/zola
+          args:
+            - --root
+            - /src
+            - build
+            - --base-url
+            - https://wedding.hexor.cy/
+            - --output-dir
+            - /public/html
+          volumeMounts:
+            - name: source
+              mountPath: /src
+            - name: public
+              mountPath: /public
+      containers:
+        - name: nginx
+          image: nginx:alpine
+          ports:
+            - containerPort: 80
+              protocol: TCP
+          volumeMounts:
+            - name: public
+              mountPath: /usr/share/nginx/html
+              subPath: html
+              readOnly: true
+          resources:
+            requests:
+              memory: 32Mi
+              cpu: 10m
+            limits:
+              memory: 64Mi
+              cpu: 100m
+      volumes:
+        - name: source
+          emptyDir: {}
+        - name: public
+          emptyDir: {}
@@ -0,0 +1,26 @@
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: wedding-tls-ingress
+  annotations:
+    ingressClassName: traefik
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
+    acme.cert-manager.io/http01-edit-in-place: "true"
+spec:
+  rules:
+    - host: wedding.hexor.cy
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: wedding
+                port:
+                  number: 80
+  tls:
+    - secretName: wedding-tls
+      hosts:
+        - wedding.hexor.cy
@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - app.yaml
+  - rbac.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml
+  - webhook.yaml
@@ -0,0 +1,42 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: wedding-deployer
+  namespace: wedding
+
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: wedding-deployer-token
+  namespace: wedding
+  annotations:
+    kubernetes.io/service-account.name: wedding-deployer
+type: kubernetes.io/service-account-token
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: wedding-restart
+  namespace: wedding
+rules:
+  - apiGroups: ["apps"]
+    resources: ["deployments"]
+    verbs: ["get", "patch"]
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: wedding-deployer-restart
+  namespace: wedding
+subjects:
+  - kind: ServiceAccount
+    name: wedding-deployer
+    namespace: wedding
+roleRef:
+  kind: Role
+  name: wedding-restart
+  apiGroup: rbac.authorization.k8s.io
@@ -0,0 +1,12 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: wedding
+spec:
+  selector:
+    app: wedding
+  ports:
+    - port: 80
+      targetPort: 80
+      protocol: TCP
@@ -0,0 +1,71 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: webhook-script
+data:
+  serve.sh: |
+    #!/bin/sh
+    echo "Webhook server listening on :8080"
+    while true; do
+      echo -e "HTTP/1.1 200 OK\r\nContent-Length: 2\r\nConnection: close\r\n\r\nok" \
+        | nc -l -p 8080 > /dev/null
+      echo "Received webhook, restarting deployment..."
+      kubectl rollout restart deployment/wedding
+    done
+
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: wedding-webhook
+  labels:
+    app: wedding-webhook
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: wedding-webhook
+  template:
+    metadata:
+      labels:
+        app: wedding-webhook
+    spec:
+      nodeSelector:
+        kubernetes.io/hostname: spb.tail2fe2d.ts.net
+      serviceAccountName: wedding-deployer
+      containers:
+        - name: webhook
+          image: alpine/k8s:1.32.3
+          command: ["sh", "/scripts/serve.sh"]
+          ports:
+            - containerPort: 8080
+              protocol: TCP
+          volumeMounts:
+            - name: script
+              mountPath: /scripts
+              readOnly: true
+          resources:
+            requests:
+              memory: 16Mi
+              cpu: 5m
+            limits:
+              memory: 32Mi
+              cpu: 50m
+      volumes:
+        - name: script
+          configMap:
+            name: webhook-script
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: wedding-webhook
+spec:
+  selector:
+    app: wedding-webhook
+  ports:
+    - port: 8080
+      targetPort: 8080
+      protocol: TCP
@@ -18,4 +18,5 @@ spec:
      prune: true
    syncOptions:
      - CreateNamespace=true
+      - ServerSideApply=true

@@ -23,6 +23,9 @@ spec:
          name: vaultwarden-login
          kind: ClusterSecretStore
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
        key: 1062e5b4-5380-49f1-97c3-340f26f3487e
        property: fields[0].value
    - secretKey: client_secret
@@ -31,6 +34,9 @@ spec:
          name: vaultwarden-login
          kind: ClusterSecretStore
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
        key: 1062e5b4-5380-49f1-97c3-340f26f3487e
        property: fields[1].value

@@ -24,30 +24,30 @@ configs:
    statusbadge.enabled: true
    timeout.reconciliation: 60s
    oidc.config: |
-      name: Authentik
-      issuer: https://idm.hexor.cy/application/o/argocd/
+      name: Keycloak
+      issuer: https://auth.hexor.cy/auth/realms/hexor
      clientID: $oidc-creds:id
      clientSecret: $oidc-creds:secret
-      requestedScopes: ["openid", "profile", "email", "groups"]
+      requestedScopes: ["openid", "profile", "email", "offline_access"]
      requestedIDTokenClaims: {"groups": {"essential": true}}
+      refreshTokenThreshold: 2m
  rbac:
    create: true
    policy.default: ""
    policy.csv: |
-      # Bound OIDC Group and internal role
-      g, Game Servers Managers, GameServersManagersRole
-      # Role permissions
-      p, GameServersManagersRole, applications, get, games/*, allow
-      p, GameServersManagersRole, applications, update, games/*, allow
-      p, GameServersManagersRole, applications, sync, games/*, allow
-      p, GameServersManagersRole, applications, override, games/*, allow
-      p, GameServersManagersRole, applications, action/*, games/*, allow
-      p, GameServersManagersRole, exec, create, games/*, allow
-      p, GameServersManagersRole, logs, get, games/*, allow
-      p, GameServersManagersRole, applications, delete, games/*, deny
-
-      # Admin policy
-      g, ArgoCD Admins, role:admin
+        g, game-servers-managers, GameServersManagersRole
+        # Role permissions
+        p, GameServersManagersRole, applications, get, games/*, allow
+        p, GameServersManagersRole, applications, update, games/*, allow
+        p, GameServersManagersRole, applications, sync, games/*, allow
+        p, GameServersManagersRole, applications, override, games/*, allow
+        p, GameServersManagersRole, applications, action/*, games/*, allow
+        p, GameServersManagersRole, exec, create, games/*, allow
+        p, GameServersManagersRole, logs, get, games/*, allow
+        p, GameServersManagersRole, applications, delete, games/*, deny
+    
+        # Admin policy
+        g, argocd-admins, role:admin

  secret:
    createSecret: true
@@ -0,0 +1,21 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: auth-proxy
+  namespace: argocd
+spec:
+  project: core
+  destination:
+    namespace: auth-proxy
+    server: https://kubernetes.default.svc
+  source:
+    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
+    targetRevision: HEAD
+    path: k8s/core/auth-proxy
+  syncPolicy:
+    automated:
+      selfHeal: true
+      prune: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
@@ -0,0 +1,79 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: auth-proxy
+  labels:
+    app: auth-proxy
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: auth-proxy
+  template:
+    metadata:
+      labels:
+        app: auth-proxy
+    spec:
+      containers:
+        - name: auth-proxy
+          image: ultradesu/rsauth2-proxy:latest
+          ports:
+            - containerPort: 8080
+              name: http
+              protocol: TCP
+          envFrom:
+            - secretRef:
+                name: auth-proxy-creds
+          env:
+            - name: AUTH_PROXY_OIDC_ISSUER
+              value: "https://auth.hexor.cy/auth/realms/hexor"
+            - name: AUTH_PROXY_COOKIE_DOMAIN
+              value: ".hexor.cy"
+            - name: AUTH_PROXY_CALLBACK_URL
+              value: "https://oauth.hexor.cy/callback"
+            - name: AUTH_PROXY_ROUTES_FILE
+              value: "/config/routes.yaml"
+            - name: AUTH_PROXY_LOG_LEVEL
+              value: "debug"
+          volumeMounts:
+            - name: routes
+              mountPath: /config
+              readOnly: true
+          resources:
+            requests:
+              cpu: 50m
+              memory: 32Mi
+            limits:
+              cpu: 200m
+              memory: 64Mi
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 8080
+            initialDelaySeconds: 3
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 8080
+            initialDelaySeconds: 5
+            periodSeconds: 30
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            runAsNonRoot: true
+            runAsUser: 1000
+            runAsGroup: 1000
+            capabilities:
+              drop:
+                - ALL
+      volumes:
+        - name: routes
+          configMap:
+            name: auth-proxy-routes
+      nodeSelector:
+        kubernetes.io/hostname: master.tail2fe2d.ts.net
+      tolerations:
+        - key: node-role.kubernetes.io/master
+          effect: NoSchedule
@@ -0,0 +1,40 @@
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: auth-proxy-creds
+spec:
+  target:
+    name: auth-proxy-creds
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        AUTH_PROXY_CLIENT_ID: rsauth2-proxy
+        AUTH_PROXY_CLIENT_SECRET: |-
+          {{ .client_secret }}
+        AUTH_PROXY_COOKIE_SECRET: |-
+          {{ .cookie_secret }}
+  data:
+    - secretKey: client_secret
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: e62e8c4d-d538-43b2-a682-9cdf2a5a1165
+        property: login.password
+    - secretKey: cookie_secret
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: e62e8c4d-d538-43b2-a682-9cdf2a5a1165
+        property: fields[0].value
@@ -0,0 +1,28 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: auth-proxy
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`oauth.hexor.cy`)
+      kind: Rule
+      services:
+        - name: auth-proxy
+          port: 80
+  tls:
+    secretName: auth-proxy-tls
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: auth-proxy-tls
+spec:
+  secretName: auth-proxy-tls
+  issuerRef:
+    name: letsencrypt
+    kind: ClusterIssuer
+  dnsNames:
+    - oauth.hexor.cy
@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - app.yaml
+  - external-secrets.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml
+  - servicemonitor.yaml
+# routes.yaml ConfigMap is managed by Terraform (kubernetes_config_map)
@@ -0,0 +1,15 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: auth-proxy
+  labels:
+    app: auth-proxy
+spec:
+  ports:
+    - name: http
+      port: 80
+      targetPort: 8080
+      protocol: TCP
+  selector:
+    app: auth-proxy
@@ -0,0 +1,21 @@
+---
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: auth-proxy-metrics
+  labels:
+    app: auth-proxy
+    release: prometheus
+spec:
+  selector:
+    matchLabels:
+      app: auth-proxy
+  endpoints:
+    - port: http
+      path: /metrics
+      interval: 30s
+      scrapeTimeout: 10s
+      honorLabels: true
+  namespaceSelector:
+    matchNames:
+      - auth-proxy
@@ -18,4 +18,4 @@ spec:
      prune: true
    syncOptions:
      - CreateNamespace=true
-
+      - ServerSideApply=true
@@ -34,6 +34,9 @@ spec:
          name: vaultwarden-login
          kind: ClusterSecretStore
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
        key: 279c2c1f-c147-4b6b-a511-36c3cd764f9d
        property: login.password
    - secretKey: username
@@ -42,6 +45,9 @@ spec:
          name: vaultwarden-login
          kind: ClusterSecretStore
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
        key: 279c2c1f-c147-4b6b-a511-36c3cd764f9d
        property: login.username
    - secretKey: secret_key
@@ -50,6 +56,9 @@ spec:
          name: vaultwarden-login
          kind: ClusterSecretStore
      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
        key: 279c2c1f-c147-4b6b-a511-36c3cd764f9d
        property: fields[0].value

@@ -5,12 +5,13 @@ resources:
  - app.yaml
  - external-secrets.yaml
  - https-middleware.yaml
+  - outpost-selector-fix.yaml
 # - worker-restart.yaml

 helmCharts:
  - name: authentik
    repo: https://charts.goauthentik.io
-    version: 2026.2.1
+    version: 2026.2.2
    releaseName: authentik
    namespace: authentik
    valuesFile: values.yaml
@@ -0,0 +1,81 @@
+## Workaround for authentik bug: embedded outpost controller creates
+## a Service with selectors that don't match the pod labels it sets.
+## Remove this after upgrading to a version with the fix.
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: outpost-selector-fix
+  namespace: authentik
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: outpost-selector-fix
+  namespace: authentik
+rules:
+  - apiGroups: [""]
+    resources: ["services"]
+    verbs: ["get", "patch"]
+  - apiGroups: [""]
+    resources: ["endpoints"]
+    verbs: ["get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: outpost-selector-fix
+  namespace: authentik
+subjects:
+  - kind: ServiceAccount
+    name: outpost-selector-fix
+    namespace: authentik
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: outpost-selector-fix
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: outpost-selector-fix
+  namespace: authentik
+spec:
+  schedule: "* * * * *"
+  successfulJobsHistoryLimit: 1
+  failedJobsHistoryLimit: 3
+  concurrencyPolicy: Replace
+  jobTemplate:
+    spec:
+      ttlSecondsAfterFinished: 300
+      template:
+        spec:
+          serviceAccountName: outpost-selector-fix
+          restartPolicy: OnFailure
+          containers:
+            - name: fix
+              image: bitnami/kubectl:latest
+              command:
+                - /bin/sh
+                - -c
+                - |
+                  SVC="ak-outpost-authentik-embedded-outpost"
+                  # check if endpoints are populated
+                  ADDRS=$(kubectl get endpoints "$SVC" -n authentik -o jsonpath='{.subsets[*].addresses[*].ip}' 2>/dev/null)
+                  if [ -n "$ADDRS" ]; then
+                    echo "Endpoints OK ($ADDRS), nothing to fix"
+                    exit 0
+                  fi
+                  echo "No endpoints for $SVC, patching selector..."
+                  kubectl patch svc "$SVC" -n authentik --type=json -p '[
+                    {"op":"remove","path":"/spec/selector/app.kubernetes.io~1component"},
+                    {"op":"replace","path":"/spec/selector/app.kubernetes.io~1name","value":"authentik-outpost-proxy"}
+                  ]'
+                  echo "Patched. Verifying..."
+                  sleep 2
+                  ADDRS=$(kubectl get endpoints "$SVC" -n authentik -o jsonpath='{.subsets[*].addresses[*].ip}' 2>/dev/null)
+                  if [ -n "$ADDRS" ]; then
+                    echo "Fix confirmed, endpoints: $ADDRS"
+                  else
+                    echo "WARNING: still no endpoints after patch"
+                    exit 1
+                  fi
@@ -1,8 +1,6 @@
 global:
-  #image:
-  #  tag: "2025.10.1"
-  nodeSelector:
-    kubernetes.io/hostname: master.tail2fe2d.ts.net
+  image:
+    tag: "2026.2.2"

 authentik:
    error_reporting:
@@ -15,14 +13,35 @@ worker:
  envFrom:
    - secretRef:
        name: authentik-creds
-  volumes:
-    - name: dshm
-      emptyDir:
-        medium: Memory
-        sizeLimit: 512Mi
-  volumeMounts:
-    - name: dshm
-      mountPath: /dev/shm
+# volumes:
+#   - name: dshm
+#     emptyDir:
+#       medium: Memory
+#       sizeLimit: 512Mi
+# volumeMounts:
+#   - name: dshm
+#     mountPath: /dev/shm
+# livenessProbe:
+#   exec:
+#     command: ["/bin/sh", "-c", "kill -0 1"]
+#   initialDelaySeconds: 5
+#   periodSeconds: 10
+#   failureThreshold: 3
+#   timeoutSeconds: 3
+# readinessProbe:
+#   exec:
+#     command: ["/bin/sh", "-c", "kill -0 1"]
+#   initialDelaySeconds: 5
+#   periodSeconds: 10
+#   failureThreshold: 3
+#   timeoutSeconds: 3
+# startupProbe:
+#   exec:
+#     command: ["/bin/sh", "-c", "kill -0 1"]
+#   initialDelaySeconds: 30
+#   periodSeconds: 10
+#   failureThreshold: 60
+#   timeoutSeconds: 3
 server:
  envFrom:
    - secretRef:
@@ -35,23 +54,10 @@ server:
        traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
      hosts:
        - idm.hexor.cy
-        - nas.hexor.cy       # TrueNAS Limassol
-        - nc.hexor.cy        # NaxtCloud
-        - of.hexor.cy        # Outfleet-v2
-        - k8s.hexor.cy       # k8s dashboard
-        - qbt.hexor.cy       # qBittorent for Jellyfin
-        - prom.hexor.cy      # Prometheus
-        - khm.hexor.cy       # Known Hosts keys Manager
-        - backup.hexor.cy    # Kopia Backup UI
-        - fm.hexor.cy        # Filemanager
-        - minecraft.hexor.cy # Minecraft UI and server
-        - pass.hexor.cy      # k8s-secret for openai
-        - ps.hexor.cy        # pasarguard UI
-#       - rw.hexor.cy        # RemnaWave UI
      tls:
        - secretName: idm-tls
          hosts:
            - '*.hexor.cy'
 redis:
-    enabled: true
+    enabled: false

@@ -18,11 +18,9 @@ spec:
              key: apiKey
        selector:
          dnsZones:
-            - "*.hexor.cy"
            - "*.hexor.ru"
            - "*.btwiusearch.net"
            - "hexor.ru"
-            - "hexor.cy"
            - "btwiusearch.net"
      - dns01:
          route53:
@@ -35,6 +33,6 @@ spec:
              key: secretKey
        selector:
          dnsZones:
-            - "ps.hexor.cy"
-            - "of.hexor.cy"
+            - "*.hexor.cy"
+            - "hexor.cy"

@@ -10,7 +10,7 @@ resources:
 helmCharts:
  - name: cert-manager
    repo: https://charts.jetstack.io
-    version: 1.19.1
+    version: 1.20.0
    releaseName: cert-manager
    namespace: cert-manager
    valuesFile: values.yaml
@@ -0,0 +1,21 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: kanidm
+  namespace: argocd
+spec:
+  project: core
+  destination:
+    namespace: kanidm
+    server: https://kubernetes.default.svc
+  source:
+    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
+    targetRevision: HEAD
+    path: k8s/core/kanidm
+  syncPolicy:
+    automated:
+      selfHeal: true
+      prune: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
@@ -0,0 +1,12 @@
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: kanidm-tls
+spec:
+  secretName: kanidm-tls
+  issuerRef:
+    name: letsencrypt
+    kind: ClusterIssuer
+  dnsNames:
+    - auth.hexor.cy
@@ -0,0 +1,19 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: kanidm-config
+data:
+  server.toml: |
+    bindaddress = "[::]:443"
+    db_path = "/data/kanidm.db"
+    tls_chain = "/certs/tls.crt"
+    tls_key = "/certs/tls.key"
+    domain = "auth.hexor.cy"
+    origin = "https://auth.hexor.cy"
+    log_level = "info"
+
+    [online_backup]
+    path = "/data/backups/"
+    schedule = "00 22 * * *"
+    versions = 7
@@ -0,0 +1,20 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: kanidm
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`auth.hexor.cy`)
+      kind: Rule
+      services:
+        - name: kanidm
+          port: 443
+          scheme: https
+          serversTransport: kanidm-transport
+  tls:
+    secretName: kanidm-ingress-tls
@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - app.yaml
+  - configmap.yaml
+  - certificate.yaml
+  - statefulset.yaml
+  - service.yaml
+  - ingress.yaml
+  - servers-transport.yaml
@@ -0,0 +1,7 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: ServersTransport
+metadata:
+  name: kanidm-transport
+spec:
+  insecureSkipVerify: true
@@ -0,0 +1,15 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: kanidm
+  labels:
+    app: kanidm
+spec:
+  ports:
+    - name: https
+      port: 443
+      targetPort: 443
+      protocol: TCP
+  selector:
+    app: kanidm
@@ -0,0 +1,86 @@
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: kanidm
+  labels:
+    app: kanidm
+spec:
+  serviceName: kanidm
+  replicas: 1
+  selector:
+    matchLabels:
+      app: kanidm
+  template:
+    metadata:
+      labels:
+        app: kanidm
+    spec:
+      securityContext:
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+      containers:
+        - name: kanidm
+          image: kanidm/server:1.9.3
+          ports:
+            - containerPort: 443
+              name: https
+              protocol: TCP
+          volumeMounts:
+            - name: kanidm-data
+              mountPath: /data
+            - name: kanidm-config
+              mountPath: /data/server.toml
+              subPath: server.toml
+              readOnly: true
+            - name: kanidm-tls
+              mountPath: /certs
+              readOnly: true
+          resources:
+            requests:
+              memory: "128Mi"
+              cpu: "100m"
+            limits:
+              memory: "512Mi"
+              cpu: "500m"
+          readinessProbe:
+            httpGet:
+              path: /status
+              port: 443
+              scheme: HTTPS
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /status
+              port: 443
+              scheme: HTTPS
+            initialDelaySeconds: 15
+            periodSeconds: 30
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: false
+            runAsUser: 1000
+            runAsGroup: 1000
+      volumes:
+        - name: kanidm-config
+          configMap:
+            name: kanidm-config
+        - name: kanidm-tls
+          secret:
+            secretName: kanidm-tls
+      nodeSelector:
+        kubernetes.io/hostname: master.tail2fe2d.ts.net
+      tolerations:
+        - key: node-role.kubernetes.io/master
+          effect: NoSchedule
+  volumeClaimTemplates:
+    - metadata:
+        name: kanidm-data
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        storageClassName: longhorn
+        resources:
+          requests:
+            storage: 1Gi
@@ -0,0 +1,21 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: keycloak
+  namespace: argocd
+spec:
+  project: core
+  destination:
+    namespace: keycloak
+    server: https://kubernetes.default.svc
+  source:
+    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
+    targetRevision: HEAD
+    path: k8s/core/keycloak
+  syncPolicy:
+    automated:
+      selfHeal: true
+      prune: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
@@ -0,0 +1,41 @@
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: keycloak-creds
+spec:
+  target:
+    name: keycloak-creds
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        KC_DB_USERNAME: keycloak
+        KC_DB_PASSWORD: |-
+          {{ .db_password }}
+        KC_BOOTSTRAP_ADMIN_USERNAME: admin
+        KC_BOOTSTRAP_ADMIN_PASSWORD: |-
+          {{ .admin_password }}
+  data:
+    - secretKey: db_password
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: 2a9deb39-ef22-433e-a1be-df1555625e22
+        property: fields[18].value
+    - secretKey: admin_password
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: 9422b636-a91d-40e4-bf98-925b2a3f831d
+        property: login.password
@@ -0,0 +1,14 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - app.yaml
+  - external-secrets.yaml
+
+helmCharts:
+  - name: keycloakx
+    repo: https://codecentric.github.io/helm-charts
+    version: 7.1.11
+    releaseName: keycloak
+    namespace: keycloak
+    valuesFile: values.yaml
@@ -0,0 +1,67 @@
+replicas: 1
+
+image:
+  repository: quay.io/keycloak/keycloak
+  tag: "26.5.6"
+
+command:
+  - "/opt/keycloak/bin/kc.sh"
+  - "start"
+  - "--http-port=8080"
+  - "--hostname-strict=false"
+  - "--proxy-headers=xforwarded"
+
+extraEnvFrom: |
+  - secretRef:
+      name: keycloak-creds
+
+extraEnv: |
+  - name: KC_HOSTNAME
+    value: auth.hexor.cy
+  - name: JAVA_OPTS_APPEND
+    value: "-Djgroups.dns.query=keycloak-headless.keycloak.svc"
+
+dbchecker:
+  enabled: true
+
+database:
+  vendor: postgres
+  hostname: psql.psql.svc
+  port: 5432
+  database: keycloak
+  existingSecret: keycloak-creds
+  existingSecretKey: KC_DB_PASSWORD
+
+service:
+  type: ClusterIP
+
+ingress:
+  enabled: true
+  ingressClassName: traefik
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
+  rules:
+    - host: auth.hexor.cy
+      paths:
+        - path: /
+          pathType: Prefix
+  tls:
+    - secretName: keycloak-tls
+      hosts:
+        - auth.hexor.cy
+
+resources:
+  requests:
+    cpu: 200m
+    memory: 512Mi
+  limits:
+    cpu: "1"
+    memory: 1Gi
+
+nodeSelector:
+  kubernetes.io/hostname: master.tail2fe2d.ts.net
+
+tolerations:
+  - key: node-role.kubernetes.io/master
+    effect: NoSchedule
@@ -127,6 +127,16 @@ spec:
          {{ .mmdl }}
        USER_n8n: |-
          {{ .n8n }}
+        USER_synapse: |-
+          {{ .synapse }}
+        USER_mas: |-
+          {{ .mas }}
+        USER_furumi: |-
+          {{ .furumi }}
+        USER_furumi_dev: |-
+          {{ .furumi_dev }}
+        USER_keycloak: |-
+          {{ .keycloak }}
  data:
    - secretKey: authentik
      sourceRef:
@@ -271,4 +281,58 @@ spec:
        metadataPolicy: None
        key: 2a9deb39-ef22-433e-a1be-df1555625e22
        property: fields[13].value
-
+    - secretKey: synapse
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: 2a9deb39-ef22-433e-a1be-df1555625e22
+        property: fields[14].value
+    - secretKey: mas
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: 2a9deb39-ef22-433e-a1be-df1555625e22
+        property: fields[15].value
+    - secretKey: furumi
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: 2a9deb39-ef22-433e-a1be-df1555625e22
+        property: fields[16].value
+    - secretKey: furumi_dev
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: 2a9deb39-ef22-433e-a1be-df1555625e22
+        property: fields[17].value
+    - secretKey: keycloak
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        conversionStrategy: Default
+        decodingStrategy: None
+        metadataPolicy: None
+        key: 2a9deb39-ef22-433e-a1be-df1555625e22
+        property: fields[18].value
@@ -0,0 +1,367 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: auth-proxy-dashboard
+  labels:
+    grafana_dashboard: "1"
+data:
+  auth-proxy.json: |-
+    {
+      "annotations": {
+        "list": [
+          {
+            "builtIn": 1,
+            "datasource": {
+              "type": "grafana",
+              "uid": "-- Grafana --"
+            },
+            "enable": true,
+            "hide": true,
+            "iconColor": "rgba(0, 211, 255, 1)",
+            "name": "Annotations & Alerts",
+            "type": "dashboard"
+          }
+        ]
+      },
+      "editable": true,
+      "fiscalYearStartMonth": 0,
+      "graphTooltip": 1,
+      "id": null,
+      "links": [],
+      "liveNow": false,
+      "panels": [
+        {
+          "gridPos": { "h": 4, "w": 6, "x": 0, "y": 0 },
+          "id": 1,
+          "options": {
+            "colorMode": "value",
+            "graphMode": "area",
+            "justifyMode": "auto",
+            "orientation": "auto",
+            "reduceOptions": { "calc": "lastNotNull", "fields": "", "values": false },
+            "textMode": "auto"
+          },
+          "pluginVersion": "10.0.0",
+          "targets": [
+            {
+              "datasource": { "type": "prometheus", "uid": "${datasource}" },
+              "expr": "routes_loaded_total",
+              "refId": "A"
+            }
+          ],
+          "title": "Loaded Routes",
+          "type": "stat"
+        },
+        {
+          "gridPos": { "h": 4, "w": 6, "x": 6, "y": 0 },
+          "id": 2,
+          "options": {
+            "colorMode": "value",
+            "graphMode": "area",
+            "justifyMode": "auto",
+            "orientation": "auto",
+            "reduceOptions": { "calc": "lastNotNull", "fields": "", "values": false },
+            "textMode": "auto"
+          },
+          "pluginVersion": "10.0.0",
+          "targets": [
+            {
+              "datasource": { "type": "prometheus", "uid": "${datasource}" },
+              "expr": "sum(increase(auth_requests_total[$__rate_interval]))",
+              "refId": "A"
+            }
+          ],
+          "title": "Auth Requests (total)",
+          "type": "stat",
+          "fieldConfig": {
+            "defaults": {
+              "color": { "mode": "thresholds" },
+              "mappings": [],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  { "color": "green", "value": null }
+                ]
+              }
+            },
+            "overrides": []
+          }
+        },
+        {
+          "gridPos": { "h": 4, "w": 6, "x": 12, "y": 0 },
+          "id": 3,
+          "options": {
+            "colorMode": "value",
+            "graphMode": "area",
+            "justifyMode": "auto",
+            "orientation": "auto",
+            "reduceOptions": { "calc": "lastNotNull", "fields": "", "values": false },
+            "textMode": "auto"
+          },
+          "pluginVersion": "10.0.0",
+          "targets": [
+            {
+              "datasource": { "type": "prometheus", "uid": "${datasource}" },
+              "expr": "sum(increase(auth_requests_total{status=\"403\"}[$__rate_interval]))",
+              "refId": "A"
+            }
+          ],
+          "title": "Forbidden (403)",
+          "type": "stat",
+          "fieldConfig": {
+            "defaults": {
+              "color": { "mode": "thresholds" },
+              "mappings": [],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  { "color": "green", "value": null },
+                  { "color": "red", "value": 1 }
+                ]
+              }
+            },
+            "overrides": []
+          }
+        },
+        {
+          "gridPos": { "h": 4, "w": 6, "x": 18, "y": 0 },
+          "id": 4,
+          "options": {
+            "colorMode": "value",
+            "graphMode": "area",
+            "justifyMode": "auto",
+            "orientation": "auto",
+            "reduceOptions": { "calc": "lastNotNull", "fields": "", "values": false },
+            "textMode": "auto"
+          },
+          "pluginVersion": "10.0.0",
+          "targets": [
+            {
+              "datasource": { "type": "prometheus", "uid": "${datasource}" },
+              "expr": "sum(increase(callback_requests_total{result=\"success\"}[$__rate_interval]))",
+              "refId": "A"
+            }
+          ],
+          "title": "Successful Logins",
+          "type": "stat",
+          "fieldConfig": {
+            "defaults": {
+              "color": { "mode": "thresholds" },
+              "mappings": [],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  { "color": "green", "value": null }
+                ]
+              }
+            },
+            "overrides": []
+          }
+        },
+        {
+          "gridPos": { "h": 8, "w": 12, "x": 0, "y": 4 },
+          "id": 5,
+          "options": {
+            "legend": { "calcs": [], "displayMode": "list", "placement": "bottom", "showLegend": true },
+            "tooltip": { "mode": "single", "sort": "none" }
+          },
+          "pluginVersion": "10.0.0",
+          "targets": [
+            {
+              "datasource": { "type": "prometheus", "uid": "${datasource}" },
+              "expr": "sum by (status) (rate(auth_requests_total[$__rate_interval]))",
+              "legendFormat": "{{status}}",
+              "refId": "A"
+            }
+          ],
+          "title": "Auth Request Rate by Status",
+          "type": "timeseries",
+          "fieldConfig": {
+            "defaults": {
+              "color": { "mode": "palette-classic" },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "drawStyle": "line",
+                "fillOpacity": 10,
+                "gradientMode": "none",
+                "hideFrom": { "legend": false, "tooltip": false, "viz": false },
+                "insertNulls": false,
+                "lineInterpolation": "linear",
+                "lineWidth": 2,
+                "pointSize": 5,
+                "scaleDistribution": { "type": "linear" },
+                "showPoints": "auto",
+                "spanNulls": false,
+                "stacking": { "group": "A", "mode": "none" },
+                "thresholdsStyle": { "mode": "off" }
+              },
+              "mappings": [],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [ { "color": "green", "value": null } ]
+              },
+              "unit": "reqps"
+            },
+            "overrides": []
+          }
+        },
+        {
+          "gridPos": { "h": 8, "w": 12, "x": 12, "y": 4 },
+          "id": 6,
+          "options": {
+            "legend": { "calcs": [], "displayMode": "list", "placement": "bottom", "showLegend": true },
+            "tooltip": { "mode": "single", "sort": "none" }
+          },
+          "pluginVersion": "10.0.0",
+          "targets": [
+            {
+              "datasource": { "type": "prometheus", "uid": "${datasource}" },
+              "expr": "auth_request_duration_seconds{quantile=\"0.5\"}",
+              "legendFormat": "p50",
+              "refId": "A"
+            },
+            {
+              "datasource": { "type": "prometheus", "uid": "${datasource}" },
+              "expr": "auth_request_duration_seconds{quantile=\"0.95\"}",
+              "legendFormat": "p95",
+              "refId": "B"
+            },
+            {
+              "datasource": { "type": "prometheus", "uid": "${datasource}" },
+              "expr": "auth_request_duration_seconds{quantile=\"0.99\"}",
+              "legendFormat": "p99",
+              "refId": "C"
+            }
+          ],
+          "title": "Auth Request Duration (p50, p95, p99)",
+          "type": "timeseries",
+          "fieldConfig": {
+            "defaults": {
+              "color": { "mode": "palette-classic" },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "drawStyle": "line",
+                "fillOpacity": 0,
+                "gradientMode": "none",
+                "hideFrom": { "legend": false, "tooltip": false, "viz": false },
+                "insertNulls": false,
+                "lineInterpolation": "linear",
+                "lineWidth": 2,
+                "pointSize": 5,
+                "scaleDistribution": { "type": "linear" },
+                "showPoints": "auto",
+                "spanNulls": false,
+                "stacking": { "group": "A", "mode": "none" },
+                "thresholdsStyle": { "mode": "off" }
+              },
+              "mappings": [],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [ { "color": "green", "value": null } ]
+              },
+              "unit": "s"
+            },
+            "overrides": []
+          }
+        },
+        {
+          "gridPos": { "h": 8, "w": 12, "x": 0, "y": 12 },
+          "id": 7,
+          "options": {
+            "legend": { "calcs": [], "displayMode": "list", "placement": "bottom", "showLegend": true },
+            "tooltip": { "mode": "single", "sort": "none" }
+          },
+          "pluginVersion": "10.0.0",
+          "targets": [
+            {
+              "datasource": { "type": "prometheus", "uid": "${datasource}" },
+              "expr": "sum by (result) (rate(callback_requests_total[$__rate_interval]))",
+              "legendFormat": "{{result}}",
+              "refId": "A"
+            }
+          ],
+          "title": "OIDC Callback Rate by Result",
+          "type": "timeseries",
+          "fieldConfig": {
+            "defaults": {
+              "color": { "mode": "palette-classic" },
+              "custom": {
+                "axisBorderShow": false,
+                "axisCenteredZero": false,
+                "axisColorMode": "text",
+                "axisLabel": "",
+                "axisPlacement": "auto",
+                "barAlignment": 0,
+                "drawStyle": "bars",
+                "fillOpacity": 50,
+                "gradientMode": "none",
+                "hideFrom": { "legend": false, "tooltip": false, "viz": false },
+                "insertNulls": false,
+                "lineInterpolation": "linear",
+                "lineWidth": 1,
+                "pointSize": 5,
+                "scaleDistribution": { "type": "linear" },
+                "showPoints": "auto",
+                "spanNulls": false,
+                "stacking": { "group": "A", "mode": "normal" },
+                "thresholdsStyle": { "mode": "off" }
+              },
+              "mappings": [],
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [ { "color": "green", "value": null } ]
+              },
+              "unit": "reqps"
+            },
+            "overrides": []
+          }
+        }
+      ],
+      "refresh": "30s",
+      "schemaVersion": 38,
+      "style": "dark",
+      "tags": [
+        "auth-proxy",
+        "rsauth2-proxy"
+      ],
+      "templating": {
+        "list": [
+          {
+            "current": {
+              "selected": false,
+              "text": "Prometheus",
+              "value": "Prometheus"
+            },
+            "hide": 0,
+            "includeAll": false,
+            "multi": false,
+            "name": "datasource",
+            "options": [],
+            "query": "prometheus",
+            "refresh": 1,
+            "regex": "",
+            "skipUrlSync": false,
+            "type": "datasource"
+          }
+        ]
+      },
+      "time": {
+        "from": "now-1h",
+        "to": "now"
+      },
+      "timepicker": {},
+      "timezone": "",
+      "title": "Auth Proxy (rsauth2-proxy)",
+      "uid": "auth-proxy-metrics",
+      "version": 1
+    }
@@ -449,7 +449,7 @@
            "type": "prometheus",
            "uid": "${datasource}"
          },
-          "expr": "process_resident_memory_bytes / 1024 / 1024",
+          "expr": "sum(process_resident_memory_bytes) / 1024 / 1024",
          "legendFormat": "Resident Memory",
          "refId": "A"
        },
@@ -458,7 +458,7 @@
            "type": "prometheus",
            "uid": "${datasource}"
          },
-          "expr": "process_virtual_memory_bytes / 1024 / 1024",
+          "expr": "sum(process_virtual_memory_bytes) / 1024 / 1024",
          "legendFormat": "Virtual Memory",
          "refId": "B"
        }
@@ -0,0 +1,409 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: telemt-dashboard
+  labels:
+    grafana_dashboard: "1"
+data:
+  telemt.json: |-
+    {
+      "annotations": { "list": [] },
+      "editable": true,
+      "fiscalYearStartMonth": 0,
+      "graphTooltip": 1,
+      "id": null,
+      "links": [],
+      "liveNow": false,
+      "panels": [
+        {
+          "title": "Nodes Overview",
+          "type": "table",
+          "gridPos": { "h": 8, "w": 24, "x": 0, "y": 0 },
+          "id": 1,
+          "fieldConfig": {
+            "defaults": {
+              "custom": {
+                "align": "auto",
+                "cellOptions": { "type": "auto" },
+                "inspect": false
+              },
+              "thresholds": {
+                "mode": "absolute",
+                "steps": [
+                  { "color": "green", "value": null }
+                ]
+              }
+            },
+            "overrides": [
+              {
+                "matcher": { "id": "byName", "options": "Uptime" },
+                "properties": [
+                  { "id": "unit", "value": "dtdurations" },
+                  { "id": "custom.width", "value": 140 }
+                ]
+              },
+              {
+                "matcher": { "id": "byName", "options": "Bad Conn" },
+                "properties": [
+                  { "id": "thresholds", "value": { "mode": "absolute", "steps": [{ "color": "green", "value": null }, { "color": "yellow", "value": 10 }, { "color": "red", "value": 100 }] } },
+                  { "id": "custom.cellOptions", "value": { "type": "color-background", "mode": "basic" } }
+                ]
+              },
+              {
+                "matcher": { "id": "byName", "options": "Writers" },
+                "properties": [
+                  { "id": "thresholds", "value": { "mode": "absolute", "steps": [{ "color": "red", "value": null }, { "color": "green", "value": 1 }] } },
+                  { "id": "custom.cellOptions", "value": { "type": "color-background", "mode": "basic" } }
+                ]
+              }
+            ]
+          },
+          "options": {
+            "showHeader": true,
+            "sortBy": [{ "displayName": "Node", "desc": false }],
+            "frameIndex": 0,
+            "footer": { "show": false }
+          },
+          "transformations": [
+            {
+              "id": "joinByField",
+              "options": { "byField": "node", "mode": "outer" }
+            },
+            {
+              "id": "filterFieldsByName",
+              "options": {
+                "include": { "pattern": "^(node|Value.*)$" }
+              }
+            },
+            {
+              "id": "organize",
+              "options": {
+                "renameByName": {
+                  "node": "Node",
+                  "Value #uptime": "Uptime",
+                  "Value #writers": "Writers",
+                  "Value #buffers": "Buffers In Use",
+                  "Value #connections": "Connections",
+                  "Value #bad": "Bad Conn",
+                  "Value #hs_timeout": "HS Timeouts"
+                }
+              }
+            }
+          ],
+          "targets": [
+            {
+              "expr": "telemt_uptime_seconds{node=~\"$node\"}",
+              "legendFormat": "",
+              "refId": "uptime",
+              "format": "table",
+              "instant": true
+            },
+            {
+              "expr": "telemt_me_writers_active_current{node=~\"$node\"}",
+              "legendFormat": "",
+              "refId": "writers",
+              "format": "table",
+              "instant": true
+            },
+            {
+              "expr": "telemt_buffer_pool_buffers_total{node=~\"$node\", kind=\"in_use\"}",
+              "legendFormat": "",
+              "refId": "buffers",
+              "format": "table",
+              "instant": true
+            },
+            {
+              "expr": "telemt_connections_total{node=~\"$node\"}",
+              "legendFormat": "",
+              "refId": "connections",
+              "format": "table",
+              "instant": true
+            },
+            {
+              "expr": "telemt_connections_bad_total{node=~\"$node\"}",
+              "legendFormat": "",
+              "refId": "bad",
+              "format": "table",
+              "instant": true
+            },
+            {
+              "expr": "telemt_handshake_timeouts_total{node=~\"$node\"}",
+              "legendFormat": "",
+              "refId": "hs_timeout",
+              "format": "table",
+              "instant": true
+            }
+          ],
+          "datasource": { "type": "prometheus", "uid": "${datasource}" }
+        },
+        {
+          "title": "Connections Rate",
+          "type": "timeseries",
+          "gridPos": { "h": 8, "w": 12, "x": 0, "y": 8 },
+          "id": 10,
+          "fieldConfig": {
+            "defaults": {
+              "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 15, "pointSize": 5, "showPoints": "auto" },
+              "unit": "cps",
+              "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }
+            },
+            "overrides": []
+          },
+          "options": {
+            "tooltip": { "mode": "multi", "sort": "desc" },
+            "legend": { "displayMode": "list", "placement": "bottom" }
+          },
+          "targets": [
+            { "expr": "rate(telemt_connections_total{node=~\"$node\"}[5m])", "legendFormat": "{{node}} accepted", "refId": "A" },
+            { "expr": "rate(telemt_connections_bad_total{node=~\"$node\"}[5m])", "legendFormat": "{{node}} bad", "refId": "B" },
+            { "expr": "rate(telemt_handshake_timeouts_total{node=~\"$node\"}[5m])", "legendFormat": "{{node}} hs timeout", "refId": "C" }
+          ],
+          "datasource": { "type": "prometheus", "uid": "${datasource}" }
+        },
+        {
+          "title": "Upstream Connect",
+          "type": "timeseries",
+          "gridPos": { "h": 8, "w": 12, "x": 12, "y": 8 },
+          "id": 11,
+          "fieldConfig": {
+            "defaults": {
+              "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 15, "pointSize": 5, "showPoints": "auto" },
+              "unit": "cps",
+              "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }
+            },
+            "overrides": []
+          },
+          "options": {
+            "tooltip": { "mode": "multi", "sort": "desc" },
+            "legend": { "displayMode": "list", "placement": "bottom" }
+          },
+          "targets": [
+            { "expr": "rate(telemt_upstream_connect_success_total{node=~\"$node\"}[5m])", "legendFormat": "{{node}} success", "refId": "A" },
+            { "expr": "rate(telemt_upstream_connect_fail_total{node=~\"$node\"}[5m])", "legendFormat": "{{node}} fail", "refId": "B" }
+          ],
+          "datasource": { "type": "prometheus", "uid": "${datasource}" }
+        },
+        {
+          "title": "Upstream Connect Duration (success)",
+          "type": "timeseries",
+          "gridPos": { "h": 8, "w": 12, "x": 0, "y": 16 },
+          "id": 12,
+          "fieldConfig": {
+            "defaults": {
+              "custom": { "drawStyle": "bars", "fillOpacity": 50, "stacking": { "mode": "normal" } },
+              "unit": "short",
+              "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }
+            },
+            "overrides": []
+          },
+          "options": {
+            "tooltip": { "mode": "multi", "sort": "desc" },
+            "legend": { "displayMode": "list", "placement": "bottom" }
+          },
+          "targets": [
+            { "expr": "increase(telemt_upstream_connect_duration_success_total{node=~\"$node\"}[5m])", "legendFormat": "{{node}} {{bucket}}", "refId": "A" }
+          ],
+          "datasource": { "type": "prometheus", "uid": "${datasource}" }
+        },
+        {
+          "title": "ME Writers & Pool",
+          "type": "timeseries",
+          "gridPos": { "h": 8, "w": 12, "x": 12, "y": 16 },
+          "id": 13,
+          "fieldConfig": {
+            "defaults": {
+              "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 15, "pointSize": 5, "showPoints": "auto" },
+              "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }
+            },
+            "overrides": []
+          },
+          "options": {
+            "tooltip": { "mode": "multi", "sort": "desc" },
+            "legend": { "displayMode": "list", "placement": "bottom" }
+          },
+          "targets": [
+            { "expr": "telemt_me_writers_active_current{node=~\"$node\"}", "legendFormat": "{{node}} active", "refId": "A" },
+            { "expr": "telemt_me_writers_warm_current{node=~\"$node\"}", "legendFormat": "{{node}} warm", "refId": "B" },
+            { "expr": "telemt_pool_drain_active{node=~\"$node\"}", "legendFormat": "{{node}} draining", "refId": "C" }
+          ],
+          "datasource": { "type": "prometheus", "uid": "${datasource}" }
+        },
+        {
+          "title": "Per-User Active Connections",
+          "type": "timeseries",
+          "gridPos": { "h": 8, "w": 12, "x": 0, "y": 24 },
+          "id": 20,
+          "fieldConfig": {
+            "defaults": {
+              "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 15, "pointSize": 5, "showPoints": "auto" },
+              "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }
+            },
+            "overrides": []
+          },
+          "options": {
+            "tooltip": { "mode": "multi", "sort": "desc" },
+            "legend": { "displayMode": "list", "placement": "bottom" }
+          },
+          "targets": [
+            { "expr": "telemt_user_connections_current{node=~\"$node\"}", "legendFormat": "{{node}} {{user}}", "refId": "A" }
+          ],
+          "datasource": { "type": "prometheus", "uid": "${datasource}" }
+        },
+        {
+          "title": "Per-User Traffic",
+          "type": "timeseries",
+          "gridPos": { "h": 8, "w": 12, "x": 12, "y": 24 },
+          "id": 21,
+          "fieldConfig": {
+            "defaults": {
+              "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 15, "pointSize": 5, "showPoints": "auto" },
+              "unit": "Bps",
+              "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }
+            },
+            "overrides": []
+          },
+          "options": {
+            "tooltip": { "mode": "multi", "sort": "desc" },
+            "legend": { "displayMode": "list", "placement": "bottom" }
+          },
+          "targets": [
+            { "expr": "rate(telemt_user_octets_from_client{node=~\"$node\"}[5m])", "legendFormat": "{{node}} {{user}} rx", "refId": "A" },
+            { "expr": "rate(telemt_user_octets_to_client{node=~\"$node\"}[5m])", "legendFormat": "{{node}} {{user}} tx", "refId": "B" }
+          ],
+          "datasource": { "type": "prometheus", "uid": "${datasource}" }
+        },
+        {
+          "title": "DC->Client Payload",
+          "type": "timeseries",
+          "gridPos": { "h": 8, "w": 12, "x": 0, "y": 32 },
+          "id": 30,
+          "fieldConfig": {
+            "defaults": {
+              "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 15, "pointSize": 5, "showPoints": "auto" },
+              "unit": "Bps",
+              "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }
+            },
+            "overrides": []
+          },
+          "options": {
+            "tooltip": { "mode": "multi", "sort": "desc" },
+            "legend": { "displayMode": "list", "placement": "bottom" }
+          },
+          "targets": [
+            { "expr": "rate(telemt_me_d2c_payload_bytes_total{node=~\"$node\"}[5m])", "legendFormat": "{{node}} payload", "refId": "A" }
+          ],
+          "datasource": { "type": "prometheus", "uid": "${datasource}" }
+        },
+        {
+          "title": "ME Errors & Anomalies",
+          "type": "timeseries",
+          "gridPos": { "h": 8, "w": 12, "x": 12, "y": 32 },
+          "id": 31,
+          "fieldConfig": {
+            "defaults": {
+              "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 15, "pointSize": 5, "showPoints": "auto" },
+              "unit": "cps",
+              "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }
+            },
+            "overrides": []
+          },
+          "options": {
+            "tooltip": { "mode": "multi", "sort": "desc" },
+            "legend": { "displayMode": "list", "placement": "bottom" }
+          },
+          "targets": [
+            { "expr": "rate(telemt_me_reconnect_attempts_total{node=~\"$node\"}[5m])", "legendFormat": "{{node}} reconnect", "refId": "A" },
+            { "expr": "rate(telemt_me_handshake_reject_total{node=~\"$node\"}[5m])", "legendFormat": "{{node}} hs reject", "refId": "B" },
+            { "expr": "rate(telemt_me_crc_mismatch_total{node=~\"$node\"}[5m])", "legendFormat": "{{node}} crc mismatch", "refId": "C" },
+            { "expr": "rate(telemt_desync_total{node=~\"$node\"}[5m])", "legendFormat": "{{node}} desync", "refId": "D" }
+          ],
+          "datasource": { "type": "prometheus", "uid": "${datasource}" }
+        },
+        {
+          "title": "Per-User Unique IPs",
+          "type": "timeseries",
+          "gridPos": { "h": 8, "w": 12, "x": 0, "y": 40 },
+          "id": 40,
+          "fieldConfig": {
+            "defaults": {
+              "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 15, "pointSize": 5, "showPoints": "auto" },
+              "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }
+            },
+            "overrides": []
+          },
+          "options": {
+            "tooltip": { "mode": "multi", "sort": "desc" },
+            "legend": { "displayMode": "list", "placement": "bottom" }
+          },
+          "targets": [
+            { "expr": "telemt_user_unique_ips_current{node=~\"$node\"}", "legendFormat": "{{node}} {{user}} active", "refId": "A" },
+            { "expr": "telemt_user_unique_ips_recent_window{node=~\"$node\"}", "legendFormat": "{{node}} {{user}} recent", "refId": "B" }
+          ],
+          "datasource": { "type": "prometheus", "uid": "${datasource}" }
+        },
+        {
+          "title": "Conntrack",
+          "type": "timeseries",
+          "gridPos": { "h": 8, "w": 12, "x": 12, "y": 40 },
+          "id": 41,
+          "fieldConfig": {
+            "defaults": {
+              "custom": { "drawStyle": "line", "lineInterpolation": "smooth", "fillOpacity": 15, "pointSize": 5, "showPoints": "auto" },
+              "unit": "cps",
+              "thresholds": { "mode": "absolute", "steps": [{ "color": "green", "value": null }] }
+            },
+            "overrides": []
+          },
+          "options": {
+            "tooltip": { "mode": "multi", "sort": "desc" },
+            "legend": { "displayMode": "list", "placement": "bottom" }
+          },
+          "targets": [
+            { "expr": "rate(telemt_conntrack_delete_total{node=~\"$node\", result=\"attempt\"}[5m])", "legendFormat": "{{node}} delete attempt", "refId": "A" },
+            { "expr": "rate(telemt_conntrack_delete_total{node=~\"$node\", result=\"error\"}[5m])", "legendFormat": "{{node}} delete error", "refId": "B" },
+            { "expr": "telemt_conntrack_event_queue_depth{node=~\"$node\"}", "legendFormat": "{{node}} queue depth", "refId": "C" }
+          ],
+          "datasource": { "type": "prometheus", "uid": "${datasource}" }
+        }
+      ],
+      "refresh": "30s",
+      "schemaVersion": 39,
+      "tags": ["telemt", "mtproxy", "telegram"],
+      "templating": {
+        "list": [
+          {
+            "current": {},
+            "hide": 0,
+            "includeAll": false,
+            "label": "Datasource",
+            "multi": false,
+            "name": "datasource",
+            "options": [],
+            "query": "prometheus",
+            "refresh": 1,
+            "regex": "",
+            "skipUrlSync": false,
+            "type": "datasource"
+          },
+          {
+            "current": {},
+            "datasource": { "type": "prometheus", "uid": "${datasource}" },
+            "definition": "label_values(telemt_uptime_seconds, node)",
+            "hide": 0,
+            "includeAll": true,
+            "label": "Node",
+            "multi": true,
+            "name": "node",
+            "query": "label_values(telemt_uptime_seconds, node)",
+            "refresh": 2,
+            "regex": "",
+            "skipUrlSync": false,
+            "sort": 1,
+            "type": "query"
+          }
+        ]
+      },
+      "time": { "from": "now-6h", "to": "now" },
+      "title": "Telemt MTProxy",
+      "uid": "telemt-mtproxy"
+    }
@@ -1,669 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: furumi-server-dashboard
-  labels:
-    grafana_dashboard: "1"
-data:
-  furumi-server.json: |-
-    {
-      "annotations": {
-        "list": [
-          {
-            "builtIn": 1,
-            "datasource": {
-              "type": "grafana",
-              "uid": "-- Grafana --"
-            },
-            "enable": true,
-            "hide": true,
-            "iconColor": "rgba(0, 211, 255, 1)",
-            "name": "Annotations & Alerts",
-            "type": "dashboard"
-          }
-        ]
-      },
-      "editable": true,
-      "fiscalYearStartMonth": 0,
-      "graphTooltip": 0,
-      "id": null,
-      "links": [],
-      "liveNow": false,
-      "panels": [
-        {
-          "gridPos": {
-            "h": 4,
-            "w": 6,
-            "x": 0,
-            "y": 0
-          },
-          "id": 1,
-          "options": {
-            "colorMode": "value",
-            "graphMode": "area",
-            "justifyMode": "auto",
-            "orientation": "auto",
-            "reduceOptions": {
-              "calc": "lastNotNull",
-              "fields": "",
-              "values": false
-            },
-            "textMode": "auto"
-          },
-          "pluginVersion": "10.0.0",
-          "targets": [
-            {
-              "datasource": {
-                "type": "prometheus",
-                "uid": "${datasource}"
-              },
-              "expr": "sum(furumi_active_streams)",
-              "refId": "A"
-            }
-          ],
-          "title": "Active Streams",
-          "type": "stat"
-        },
-        {
-          "gridPos": {
-            "h": 4,
-            "w": 6,
-            "x": 6,
-            "y": 0
-          },
-          "id": 2,
-          "options": {
-            "colorMode": "value",
-            "graphMode": "area",
-            "justifyMode": "auto",
-            "orientation": "auto",
-            "reduceOptions": {
-              "calc": "rate",
-              "fields": "",
-              "values": false
-            },
-            "textMode": "auto"
-          },
-          "pluginVersion": "10.0.0",
-          "targets": [
-            {
-              "datasource": {
-                "type": "prometheus",
-                "uid": "${datasource}"
-              },
-              "expr": "sum(rate(furumi_bytes_read_total[$__rate_interval]))",
-              "refId": "A"
-            }
-          ],
-          "title": "Bytes Read / Sec",
-          "type": "stat",
-          "fieldConfig": {
-            "defaults": {
-              "color": {
-                "mode": "palette-classic"
-              },
-              "custom": {
-                "axisBorderShow": false,
-                "axisCenteredZero": false,
-                "axisColorMode": "text",
-                "axisLabel": "",
-                "axisPlacement": "auto",
-                "barAlignment": 0,
-                "drawStyle": "line",
-                "fillOpacity": 0,
-                "gradientMode": "none",
-                "hideFrom": {
-                  "legend": false,
-                  "tooltip": false,
-                  "viz": false
-                },
-                "insertNulls": false,
-                "lineInterpolation": "linear",
-                "lineWidth": 1,
-                "pointSize": 5,
-                "scaleDistribution": {
-                  "type": "linear"
-                },
-                "showPoints": "auto",
-                "spanNulls": false,
-                "stacking": {
-                  "group": "A",
-                  "mode": "none"
-                },
-                "thresholdsStyle": {
-                  "mode": "off"
-                }
-              },
-              "mappings": [],
-              "thresholds": {
-                "mode": "absolute",
-                "steps": [
-                  {
-                    "color": "green",
-                    "value": null
-                  }
-                ]
-              },
-              "unit": "Bps"
-            },
-            "overrides": []
-          }
-        },
-        {
-          "gridPos": {
-            "h": 4,
-            "w": 6,
-            "x": 12,
-            "y": 0
-          },
-          "id": 3,
-          "options": {
-            "colorMode": "value",
-            "graphMode": "area",
-            "justifyMode": "auto",
-            "orientation": "auto",
-            "reduceOptions": {
-              "calc": "lastNotNull",
-              "fields": "",
-              "values": false
-            },
-            "textMode": "auto"
-          },
-          "pluginVersion": "10.0.0",
-          "targets": [
-            {
-              "datasource": {
-                "type": "prometheus",
-                "uid": "${datasource}"
-              },
-              "expr": "sum(increase(furumi_file_open_errors_total[$__rate_interval]))",
-              "refId": "A"
-            }
-          ],
-          "title": "File Open Errors (Rate)",
-          "type": "stat",
-           "fieldConfig": {
-            "defaults": {
-              "color": {
-                "mode": "thresholds"
-              },
-              "mappings": [],
-              "thresholds": {
-                 "mode": "absolute",
-                 "steps": [
-                   { "color": "green", "value": null },
-                   { "color": "red", "value": 1 }
-                 ]
-               }
-            },
-            "overrides": []
-          }
-        },
-        {
-          "gridPos": {
-            "h": 4,
-            "w": 6,
-            "x": 18,
-            "y": 0
-          },
-          "id": 4,
-          "options": {
-            "colorMode": "value",
-            "graphMode": "area",
-            "justifyMode": "auto",
-            "orientation": "auto",
-            "reduceOptions": {
-              "calc": "lastNotNull",
-              "fields": "",
-              "values": false
-            },
-            "textMode": "auto"
-          },
-          "pluginVersion": "10.0.0",
-          "targets": [
-            {
-              "datasource": {
-                "type": "prometheus",
-                "uid": "${datasource}"
-              },
-              "expr": "sum(increase(furumi_auth_failures_total[$__rate_interval]))",
-              "refId": "A"
-            }
-          ],
-          "title": "Auth Failures (Rate)",
-          "type": "stat",
-           "fieldConfig": {
-            "defaults": {
-              "color": {
-                "mode": "thresholds"
-              },
-              "mappings": [],
-              "thresholds": {
-                 "mode": "absolute",
-                 "steps": [
-                   { "color": "green", "value": null },
-                   { "color": "red", "value": 1 }
-                 ]
-               }
-            },
-            "overrides": []
-          }
-        },
-        {
-          "gridPos": {
-            "h": 8,
-            "w": 12,
-            "x": 0,
-            "y": 4
-          },
-          "id": 5,
-          "options": {
-            "legend": {
-              "calcs": [],
-              "displayMode": "list",
-              "placement": "bottom",
-              "showLegend": true
-            },
-            "tooltip": {
-              "mode": "single",
-              "sort": "none"
-            }
-          },
-          "pluginVersion": "10.0.0",
-          "targets": [
-            {
-              "datasource": {
-                "type": "prometheus",
-                "uid": "${datasource}"
-              },
-              "expr": "sum by (method, status) (rate(furumi_grpc_requests_total[$__rate_interval]))",
-              "legendFormat": "{{method}} - {{status}}",
-              "refId": "A"
-            }
-          ],
-          "title": "gRPC Request Rate by Method & Status",
-          "type": "timeseries",
-          "fieldConfig": {
-            "defaults": {
-              "color": {
-                "mode": "palette-classic"
-              },
-              "custom": {
-                "axisBorderShow": false,
-                "axisCenteredZero": false,
-                "axisColorMode": "text",
-                "axisLabel": "",
-                "axisPlacement": "auto",
-                "barAlignment": 0,
-                "drawStyle": "line",
-                "fillOpacity": 10,
-                "gradientMode": "none",
-                "hideFrom": {
-                  "legend": false,
-                  "tooltip": false,
-                  "viz": false
-                },
-                "insertNulls": false,
-                "lineInterpolation": "linear",
-                "lineWidth": 2,
-                "pointSize": 5,
-                "scaleDistribution": {
-                  "type": "linear"
-                },
-                "showPoints": "auto",
-                "spanNulls": false,
-                "stacking": {
-                  "group": "A",
-                  "mode": "none"
-                },
-                "thresholdsStyle": {
-                  "mode": "off"
-                }
-              },
-              "mappings": [],
-              "thresholds": {
-                "mode": "absolute",
-                "steps": [
-                  {
-                    "color": "green",
-                    "value": null
-                  }
-                ]
-              },
-              "unit": "reqps"
-            },
-            "overrides": []
-          }
-        },
-        {
-          "gridPos": {
-            "h": 8,
-            "w": 12,
-            "x": 12,
-            "y": 4
-          },
-          "id": 6,
-          "options": {
-            "legend": {
-              "calcs": [],
-              "displayMode": "list",
-              "placement": "bottom",
-              "showLegend": true
-            },
-            "tooltip": {
-              "mode": "single",
-              "sort": "none"
-            }
-          },
-          "pluginVersion": "10.0.0",
-          "targets": [
-            {
-              "datasource": {
-                "type": "prometheus",
-                "uid": "${datasource}"
-              },
-              "expr": "histogram_quantile(0.95, sum(rate(furumi_grpc_request_duration_seconds_bucket[$__rate_interval])) by (le, method))",
-              "legendFormat": "p95 {{method}}",
-              "refId": "A"
-            },
-             {
-              "datasource": {
-                "type": "prometheus",
-                "uid": "${datasource}"
-              },
-              "expr": "histogram_quantile(0.99, sum(rate(furumi_grpc_request_duration_seconds_bucket[$__rate_interval])) by (le, method))",
-              "legendFormat": "p99 {{method}}",
-              "refId": "B"
-            }
-          ],
-          "title": "gRPC Request Duration (p95, p99)",
-          "type": "timeseries",
-          "fieldConfig": {
-            "defaults": {
-              "color": {
-                "mode": "palette-classic"
-              },
-              "custom": {
-                "axisBorderShow": false,
-                "axisCenteredZero": false,
-                "axisColorMode": "text",
-                "axisLabel": "",
-                "axisPlacement": "auto",
-                "barAlignment": 0,
-                "drawStyle": "line",
-                "fillOpacity": 0,
-                "gradientMode": "none",
-                "hideFrom": {
-                  "legend": false,
-                  "tooltip": false,
-                  "viz": false
-                },
-                "insertNulls": false,
-                "lineInterpolation": "linear",
-                "lineWidth": 2,
-                "pointSize": 5,
-                "scaleDistribution": {
-                  "type": "linear"
-                },
-                "showPoints": "auto",
-                "spanNulls": false,
-                "stacking": {
-                  "group": "A",
-                  "mode": "none"
-                },
-                "thresholdsStyle": {
-                  "mode": "off"
-                }
-              },
-              "mappings": [],
-              "thresholds": {
-                "mode": "absolute",
-                "steps": [
-                  {
-                    "color": "green",
-                    "value": null
-                  }
-                ]
-              },
-              "unit": "s"
-            },
-            "overrides": []
-          }
-        },
-        {
-          "collapsed": true,
-          "gridPos": {
-            "h": 1,
-            "w": 24,
-            "x": 0,
-            "y": 12
-          },
-          "id": 99,
-          "panels": [
-            {
-              "gridPos": {
-                "h": 8,
-                "w": 12,
-                "x": 0,
-                "y": 13
-              },
-              "id": 7,
-              "options": {
-                "legend": {
-                  "calcs": [],
-                  "displayMode": "list",
-                  "placement": "bottom",
-                  "showLegend": true
-                },
-                "tooltip": {
-                  "mode": "single",
-                  "sort": "none"
-                }
-              },
-              "pluginVersion": "10.0.0",
-              "targets": [
-                {
-                  "datasource": {
-                    "type": "prometheus",
-                    "uid": "${datasource}"
-                  },
-                  "expr": "process_resident_memory_bytes / 1024 / 1024",
-                  "legendFormat": "Resident Memory",
-                  "refId": "A"
-                },
-                {
-                  "datasource": {
-                    "type": "prometheus",
-                    "uid": "${datasource}"
-                  },
-                  "expr": "process_virtual_memory_bytes / 1024 / 1024",
-                  "legendFormat": "Virtual Memory",
-                  "refId": "B"
-                }
-              ],
-              "title": "Process Memory Usage",
-              "type": "timeseries",
-               "fieldConfig": {
-                "defaults": {
-                  "color": {
-                    "mode": "palette-classic"
-                  },
-                  "custom": {
-                    "axisBorderShow": false,
-                    "axisCenteredZero": false,
-                    "axisColorMode": "text",
-                    "axisLabel": "",
-                    "axisPlacement": "auto",
-                    "barAlignment": 0,
-                    "drawStyle": "line",
-                    "fillOpacity": 15,
-                    "gradientMode": "none",
-                    "hideFrom": {
-                      "legend": false,
-                      "tooltip": false,
-                      "viz": false
-                    },
-                    "insertNulls": false,
-                    "lineInterpolation": "linear",
-                    "lineWidth": 2,
-                     "pointSize": 5,
-                    "scaleDistribution": {
-                      "type": "linear"
-                    },
-                    "showPoints": "auto",
-                    "spanNulls": false,
-                    "stacking": {
-                      "group": "A",
-                      "mode": "none"
-                    },
-                    "thresholdsStyle": {
-                      "mode": "off"
-                    }
-                  },
-                  "mappings": [],
-                  "thresholds": {
-                    "mode": "absolute",
-                    "steps": [
-                       { "color": "green", "value": null }
-                    ]
-                  },
-                  "unit": "megbytes"
-                },
-                "overrides": []
-              }
-            },
-            {
-              "gridPos": {
-                "h": 8,
-                "w": 12,
-                "x": 12,
-                "y": 13
-              },
-              "id": 8,
-              "options": {
-                "legend": {
-                  "calcs": [],
-                  "displayMode": "list",
-                  "placement": "bottom",
-                  "showLegend": true
-                },
-                "tooltip": {
-                  "mode": "single",
-                  "sort": "none"
-                }
-              },
-              "pluginVersion": "10.0.0",
-              "targets": [
-                {
-                  "datasource": {
-                    "type": "prometheus",
-                    "uid": "${datasource}"
-                  },
-                  "expr": "process_open_fds",
-                  "legendFormat": "Open FDs",
-                  "refId": "A"
-                },
-                {
-                   "datasource": {
-                    "type": "prometheus",
-                    "uid": "${datasource}"
-                  },
-                  "expr": "process_max_fds",
-                  "legendFormat": "Max FDs",
-                  "refId": "B"
-                }
-              ],
-              "title": "Process File Descriptors",
-              "type": "timeseries",
-               "fieldConfig": {
-                "defaults": {
-                  "color": {
-                    "mode": "palette-classic"
-                  },
-                  "custom": {
-                     "axisBorderShow": false,
-                    "axisCenteredZero": false,
-                    "axisColorMode": "text",
-                    "axisLabel": "",
-                    "axisPlacement": "auto",
-                    "barAlignment": 0,
-                    "drawStyle": "line",
-                    "fillOpacity": 10,
-                    "gradientMode": "none",
-                    "hideFrom": {
-                      "legend": false,
-                      "tooltip": false,
-                      "viz": false
-                    },
-                    "insertNulls": false,
-                    "lineInterpolation": "linear",
-                    "lineWidth": 2,
-                    "pointSize": 5,
-                    "scaleDistribution": {
-                       "type": "linear"
-                    },
-                    "showPoints": "auto",
-                    "spanNulls": false,
-                    "stacking": {
-                      "group": "A",
-                      "mode": "none"
-                    },
-                     "thresholdsStyle": {
-                      "mode": "off"
-                     }
-                  },
-                  "mappings": [],
-                  "thresholds": {
-                    "mode": "absolute",
-                    "steps": [
-                       { "color": "green", "value": null }
-                    ]
-                  },
-                  "unit": "short"
-                },
-                "overrides": []
-              }
-            }
-          ],
-          "title": "Process Metrics (Memory, FDs)",
-          "type": "row"
-        }
-      ],
-      "refresh": "10s",
-      "schemaVersion": 38,
-      "style": "dark",
-      "tags": [
-        "furumi-server",
-        "grpc"
-      ],
-      "templating": {
-        "list": [
-          {
-            "current": {
-              "selected": false,
-              "text": "Prometheus",
-              "value": "Prometheus"
-            },
-            "hide": 0,
-            "includeAll": false,
-            "multi": false,
-            "name": "datasource",
-            "options": [],
-            "query": "prometheus",
-            "refresh": 1,
-            "regex": "",
-            "skipUrlSync": false,
-            "type": "datasource"
-          }
-        ]
-      },
-      "time": {
-        "from": "now-1h",
-        "to": "now"
-      },
-      "timepicker": {},
-      "timezone": "",
-      "title": "Furumi Server Metrics",
-      "uid": "furumi-metrics",
-      "version": 1
-    }
@@ -20,7 +20,7 @@ data:
                relativeTimeRange:
                  from: 600
                  to: 0
-                datasourceUid: P76F38748CEC837F0
+                datasourceUid: prometheus
                model:
                  expr: 'rate(container_cpu_cfs_throttled_periods_total{container="pasarguard-node"}[5m])'
                  refId: A
@@ -73,7 +73,7 @@ data:
                relativeTimeRange:
                  from: 600
                  to: 0
-                datasourceUid: P76F38748CEC837F0
+                datasourceUid: prometheus
                model:
                  expr: 'kube_node_status_condition{condition="Ready",status="false"}'
                  refId: A
@@ -119,7 +119,7 @@ data:
                relativeTimeRange:
                  from: 300
                  to: 0
-                datasourceUid: P76F38748CEC837F0
+                datasourceUid: prometheus
                model:
                  expr: '(1 - (node_memory_MemAvailable_bytes / node_memory_MemTotal_bytes)) * 100'
                  refId: A
@@ -165,7 +165,7 @@ data:
                relativeTimeRange:
                  from: 300
                  to: 0
-                datasourceUid: P76F38748CEC837F0
+                datasourceUid: prometheus
                model:
                  expr: '100 - (avg by(instance) (rate(node_cpu_seconds_total{mode="idle"}[5m])) * 100)'
                  refId: A
@@ -211,7 +211,7 @@ data:
                relativeTimeRange:
                  from: 300
                  to: 0
-                datasourceUid: P76F38748CEC837F0
+                datasourceUid: prometheus
                model:
                  expr: '(1 - (node_filesystem_avail_bytes{fstype=~"ext[234]|xfs|zfs|btrfs"} / node_filesystem_size_bytes)) * 100'
                  refId: A
@@ -258,7 +258,7 @@ data:
                relativeTimeRange:
                  from: 300
                  to: 0
-                datasourceUid: P76F38748CEC837F0
+                datasourceUid: prometheus
                model:
                  expr: 'node_load15 / on(instance) group_left count by(instance)(node_cpu_seconds_total{mode="idle"})'
                  refId: A
@@ -304,7 +304,7 @@ data:
                relativeTimeRange:
                  from: 300
                  to: 0
-                datasourceUid: P76F38748CEC837F0
+                datasourceUid: prometheus
                model:
                  expr: 'up{job="node-exporter"}'
                  refId: A
@@ -6,12 +6,13 @@ resources:
  - external-secrets.yaml
  - grafana-alerting-configmap.yaml
  - alertmanager-config.yaml
-  - furumi-dashboard-cm.yaml
+  - dashboards/telemt-dashboard-cm.yaml
+  - dashboards/auth-proxy-dashboard-cm.yaml

 helmCharts:
  - name: kube-prometheus-stack
    repo: https://prometheus-community.github.io/helm-charts
-    version: 79.7.1
+    version: 84.3.0
    releaseName: prometheus
    namespace: prometheus
    valuesFile: prom-values.yaml
@@ -20,8 +20,12 @@ loki:
    filesystem:
      chunks_directory: /var/loki/chunks
      rules_directory: /var/loki/rules
+  compactor:
+    retention_enabled: true
+    delete_request_store: filesystem
  limits_config:
    reject_old_samples: false
+    retention_period: 1440h
    ingestion_rate_mb: 16
    ingestion_burst_size_mb: 32
    max_query_parallelism: 32
@@ -1,5 +1,4 @@

-
 alertmanager:
  config:
    global:
@@ -78,7 +77,7 @@ prometheus:
          - targets: ['prom-a2s-exporter.counter-strike.svc:9841']
            labels: {instance: master}

-    retention: "99999d"
+    retention: "380d"
    retentionSize: "0"
    nodeSelector:
      kubernetes.io/hostname: master.tail2fe2d.ts.net
@@ -109,18 +108,27 @@ grafana:

  grafana.ini:
    auth:
-      signout_redirect_url: https://idm.hexor.cy/application/o/grafana/end-session/
+      signout_redirect_url: https://auth.hexor.cy/auth/realms/hexor/protocol/openid-connect/logout?post_logout_redirect_uri=https%3A%2F%2Fgf.hexor.cy%2Flogin&client_id=Grafana
+      oauth_allow_insecure_email_lookup: true
    auth.generic_oauth:
-      name: authentik
+      name: Keycloak
      enabled: true
      scopes: "openid profile email"
-      auth_url: https://idm.hexor.cy/application/o/authorize/
-      token_url: https://idm.hexor.cy/application/o/token/
-      api_url: https://idm.hexor.cy/application/o/userinfo/
+      allow_sign_up: true
+      auth_url: https://auth.hexor.cy/auth/realms/hexor/protocol/openid-connect/auth
+      token_url: https://auth.hexor.cy/auth/realms/hexor/protocol/openid-connect/token
+      api_url: https://auth.hexor.cy/auth/realms/hexor/protocol/openid-connect/userinfo
+      email_attribute_path: email
+      login_attribute_path: preferred_username
+      name_attribute_path: name
      role_attribute_path: >-
-        contains(groups, 'Grafana Admin') && 'Admin' ||
-        contains(groups, 'Grafana Editors') && 'Editor' ||
-        contains(groups, 'Grafana Viewer') && 'Viewer'
+        contains(groups[*], 'hexor-admin') && 'Admin' ||
+        contains(groups[*], 'hexor-guest') && 'Viewer' ||
+        'Viewer'
+      role_attribute_strict: false
+    log:
+      level: debug
+      filters: "oauth.generic_oauth:debug"
    database:
      type: postgres
      host: psql.psql.svc:5432
@@ -7,6 +7,8 @@ metadata:
 spec:
  concurrency: 1
  cordon: true
+  tolerations:
+  - operator: Exists
  nodeSelector:
    matchExpressions:
    - key: node-role.kubernetes.io/control-plane
@@ -16,7 +18,7 @@ spec:
  serviceAccountName: system-upgrade
  upgrade:
    image: rancher/k3s-upgrade
-  version: v1.34.3+k3s1
+  version: v1.35.4+k3s1
 ---
 # Agent plan
 apiVersion: upgrade.cattle.io/v1
@@ -27,6 +29,8 @@ metadata:
 spec:
  concurrency: 1
  cordon: true
+  tolerations:
+  - operator: Exists
  nodeSelector:
    matchExpressions:
    - key: node-role.kubernetes.io/control-plane
@@ -39,5 +43,4 @@ spec:
  serviceAccountName: system-upgrade
  upgrade:
    image: rancher/k3s-upgrade
-  version: v1.34.3+k3s1
-
+  version: v1.35.4+k3s1
@@ -35,7 +35,7 @@ spec:
      terminationGracePeriodSeconds: 10
      containers:
        - name: minecraft
-          image: 'openjdk:8-jdk-alpine'
+          image: 'eclipse-temurin:8-jdk-ubi10-minimal'
          command: ["java"]
          args:
            - -Xms4G
@@ -1,16 +0,0 @@
-{
-  "permissions": {
-    "allow": [
-      "WebSearch",
-      "WebFetch(domain:registry.terraform.io)",
-      "Bash(C:UsersabAppDataLocalMicrosoftWinGetPackagesHashicorp.Terraform_Microsoft.Winget.Source_8wekyb3d8bbweterraform.exe apply -auto-approve)",
-      "Bash(\"C:\\Users\\ab\\AppData\\Local\\Microsoft\\WinGet\\Packages\\Hashicorp.Terraform_Microsoft.Winget.Source_8wekyb3d8bbwe\\terraform.exe\" apply -auto-approve)",
-      "Bash(\"C:\\Users\\ab\\AppData\\Local\\Microsoft\\WinGet\\Packages\\Hashicorp.Terraform_Microsoft.Winget.Source_8wekyb3d8bbwe\\terraform.exe\" apply -auto-approve -lock=false)",
-      "Bash(\"C:\\Users\\ab\\AppData\\Local\\Microsoft\\WinGet\\Packages\\Hashicorp.Terraform_Microsoft.Winget.Source_8wekyb3d8bbwe\\terraform.exe\" plan -lock=false)",
-      "Bash(\"C:\\Users\\ab\\AppData\\Local\\Microsoft\\WinGet\\Packages\\Hashicorp.Terraform_Microsoft.Winget.Source_8wekyb3d8bbwe\\terraform.exe\" apply -replace=\"authentik_outpost.outposts[\"\"kubernetes-outpost\"\"]\" -auto-approve -lock=false)",
-      "Bash(terraform plan:*)"
-    ],
-    "deny": [],
-    "ask": []
-  }
-}
@@ -2,43 +2,43 @@
 # Manual edits may be lost in future updates.

 provider "registry.terraform.io/goauthentik/authentik" {
-  version     = "2025.8.1"
-  constraints = ">= 2023.10.0, 2025.8.1"
+  version     = "2025.12.1"
+  constraints = ">= 2023.10.0, 2025.12.1"
  hashes = [
-    "h1:R3h8ADB0Kkv/aoY0AaHkBiX2/P4+GnW8sSgkN30kJfQ=",
-    "zh:0c3f1083fd48f20ed06959401ff1459fbb5d454d81c8175b5b6d321b308c0be3",
-    "zh:21c6d93f8d26e688da38a660d121b5624e3597c426c671289f31a17a9771abbf",
-    "zh:301b5763ffc4c5fe47aa7e851ce0b19f71bab4fae5c81003ad81b38775e85f78",
-    "zh:4f7ee6473f6a687340538ddac0ec4a0453664186b15fdb0bb2fb5fcd8fb3ad30",
-    "zh:7927f4f634c9e072d4aa6620d09e97dc83eeb1dbd0667102086779cd5fc495c1",
-    "zh:84e7c2a3f3de721a54abe4c971d9a163127f5e4af91d023260fea305ac74bcf4",
-    "zh:92af52aaac518c426164eb731d282f51a5825e64e6a02b0695952177a7af7d9c",
-    "zh:a6920a54d5df69342f4ea2d903676145b00e7375d2f2eecc0840858d83b3b4a8",
-    "zh:ac8a60801fc55fd05b3471778f908ed43072e046997c0082644c9602b84dafec",
-    "zh:b1cc29e2878aa94a3827fd5e1dd8cffb98397aa4093d6a4852c6e53157e9b35f",
-    "zh:c2d78f308c4d70a16ef4f6d1f4822a64f8f160d0a207f2121904cdd6f4942db4",
-    "zh:ca970e5776f408059a84b4e17f6ac257ec92afae956be74f3807c548e4567eaa",
-    "zh:eb2e3650ee0eec033207b6d72fcb938dc5846c6feb8a61ae30d61981ea411269",
-    "zh:fcb93e51c84ba592bc2b075d7342e475126e5029620959666999b5b1bd11cb98",
+    "h1:p9AGeRqK50wTHEIp7z7O4MUP83cs+lt7wPajZ9m9TB8=",
+    "zh:0e856d3b13614bc32346a236a8e84ba55ecd17238c2008d4b3e71aa8cb49f515",
+    "zh:2dcc44cd499c18ebbc4f763eff97a7b725763c8ac8fbb5d69c935413ccdc4962",
+    "zh:434100fc75ec7cd6b64cc9497e8273e79325fa8d285e9fd9d341c1a67421643b",
+    "zh:483484f66d2e8ce6fa4bfd91e824ceebf07d10acb5df5f366397c55227c4ae91",
+    "zh:596743a6f1c77a6f103b06ef8d932fe8f2376793b92478853dc84571d17c429f",
+    "zh:5ed2d5eb7db13229baaf042c725d5c64b58ffdcc641370175e0a88900af94bf1",
+    "zh:8aecd4cf782c82bee01098f72fe4ffff83707516007b32a01c7fcb19a9260338",
+    "zh:928c05ecac309287ff7d73ed6e478350fe3003557658ae5dc2be817a4268dba7",
+    "zh:9b9fd36dfb3e75da8b4478485272505ae9a3c67b10db173e1d2d76cfe2b637b8",
+    "zh:ab7cd8c61ab67a045854e32f0be1940a92746770dbf3c17bbe923e0259c4f897",
+    "zh:bb1360ec19a4fc1095d0ef1b7b6c5c3c1a91daac7cd1957d43a4cdbb7356a2e3",
+    "zh:d2186f4063aa1a547b52a53745d472e43f5343bc1674f2bbb91421c61b0fab50",
+    "zh:d74bbb67a77951b18ffd7b2863954e70ac03450ad2023cc305c66a5ff25d8d18",
+    "zh:f5970569ea0a479bbfbf2d452f5962e1c9bd472b82756db822d0e951363daa25",
  ]
 }

 provider "registry.terraform.io/hashicorp/random" {
-  version     = "3.7.2"
+  version     = "3.8.1"
  constraints = ">= 3.5.0"
  hashes = [
-    "h1:356j/3XnXEKr9nyicLUufzoF4Yr6hRy481KIxRVpK0c=",
-    "zh:14829603a32e4bc4d05062f059e545a91e27ff033756b48afbae6b3c835f508f",
-    "zh:1527fb07d9fea400d70e9e6eb4a2b918d5060d604749b6f1c361518e7da546dc",
-    "zh:1e86bcd7ebec85ba336b423ba1db046aeaa3c0e5f921039b3f1a6fc2f978feab",
-    "zh:24536dec8bde66753f4b4030b8f3ef43c196d69cccbea1c382d01b222478c7a3",
-    "zh:29f1786486759fad9b0ce4fdfbbfece9343ad47cd50119045075e05afe49d212",
-    "zh:4d701e978c2dd8604ba1ce962b047607701e65c078cb22e97171513e9e57491f",
+    "h1:u8AKlWVDTH5r9YLSeswoVEjiY72Rt4/ch7U+61ZDkiQ=",
+    "zh:08dd03b918c7b55713026037c5400c48af5b9f468f483463321bd18e17b907b4",
+    "zh:0eee654a5542dc1d41920bbf2419032d6f0d5625b03bd81339e5b33394a3e0ae",
+    "zh:229665ddf060aa0ed315597908483eee5b818a17d09b6417a0f52fd9405c4f57",
+    "zh:2469d2e48f28076254a2a3fc327f184914566d9e40c5780b8d96ebf7205f8bc0",
+    "zh:37d7eb334d9561f335e748280f5535a384a88675af9a9eac439d4cfd663bcb66",
+    "zh:741101426a2f2c52dee37122f0f4a2f2d6af6d852cb1db634480a86398fa3511",
    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
-    "zh:7b8434212eef0f8c83f5a90c6d76feaf850f6502b61b53c329e85b3b281cba34",
-    "zh:ac8a23c212258b7976e1621275e3af7099e7e4a3d4478cf8d5d2a27f3bc3e967",
-    "zh:b516ca74431f3df4c6cf90ddcdb4042c626e026317a33c53f0b445a3d93b720d",
-    "zh:dc76e4326aec2490c1600d6871a95e78f9050f9ce427c71707ea412a2f2f1a62",
-    "zh:eac7b63e86c749c7d48f527671c7aee5b4e26c10be6ad7232d6860167f99dbb0",
+    "zh:a902473f08ef8df62cfe6116bd6c157070a93f66622384300de235a533e9d4a9",
+    "zh:b85c511a23e57a2147355932b3b6dce2a11e856b941165793a0c3d7578d94d05",
+    "zh:c5172226d18eaac95b1daac80172287b69d4ce32750c82ad77fa0768be4ea4b8",
+    "zh:dab4434dba34aad569b0bc243c2d3f3ff86dd7740def373f2a49816bd2ff819b",
+    "zh:f49fd62aa8c5525a5c17abd51e27ca5e213881d58882fd42fec4a545b53c9699",
  ]
 }
@@ -1,55 +1,81 @@
-# Authentik Terraform Module
+# Authentik Terraform Configuration

-Terraform module for managing Authentik applications with OAuth2/OpenID and Proxy providers, including automatic Outpost assignment.
+Root Terraform configuration for managing Authentik SSO — applications (OAuth2/OIDC, Proxy, SAML), groups, outposts, flows, certificates, and property mappings.
+
+State is stored in Terraform Cloud (organization `ultradesu`, workspace `Authentik`).
+
+## Structure
+
+```
+.
+├── main.tf                      # Resources: groups, outposts, policy bindings, module calls
+├── variables.tf                 # Input variable definitions
+├── outputs.tf                   # Outputs (app details, groups, flows, wiki data)
+├── providers.tf                 # Authentik provider (goauthentik/authentik 2025.12.1)
+├── state.tf                     # Terraform Cloud backend
+├── terraform.tfvars             # General settings: authentik_url, outposts, flows, tags
+├── oauth2-apps.auto.tfvars      # OAuth2/OIDC application definitions
+├── proxy-apps.auto.tfvars       # Proxy application definitions
+├── groups.auto.tfvars           # Group definitions
+└── modules/
+    ├── oauth-provider/          # OAuth2/OIDC provider + application
+    ├── proxy-provider/          # Proxy provider + application
+    └── saml-provider/           # SAML provider + application
+```

 ## Usage

+```bash
+# Set the API token
+export TF_VAR_authentik_token="..."
+
+terraform init
+terraform plan
+terraform apply
+```
+
+All `*.auto.tfvars` files are loaded automatically — no `-var-file` flags needed.
+
+## Adding applications
+
+OAuth2/OIDC — add to `oauth2-apps.auto.tfvars`:
+
 ```hcl
-module "authentik" {
-  source = "./authentik"
-
-  authentik_url   = "https://auth.example.com"
-  authentik_token = var.authentik_token
-
-  oauth_applications = {
-    "gitlab" = {
-      name         = "GitLab OAuth"
-      slug         = "gitlab"
-      redirect_uris = ["https://gitlab.example.com/users/auth/openid_connect/callback"]
-    }
-  }
-
-  proxy_applications = {
-    "portainer" = {
-      name          = "Portainer"
-      slug          = "portainer"
-      external_host = "https://portainer.example.com"
-      internal_host = "http://portainer:9000"
-      outpost       = "k8s-outpost"
-    }
-  }
-
-  outposts = {
-    "k8s-outpost" = {
-      name = "Kubernetes Outpost"
-      type = "proxy"
-      service_connection = "k8s-local"
-    }
+oauth_applications = {
+  "my-app" = {
+    name          = "My App"
+    slug          = "my-app"
+    group         = "Tools"
+    redirect_uris = ["https://my-app.example.com/callback"]
+    create_group  = true
+    access_groups = ["admins"]
  }
 }
 ```

-## Structure
+Proxy — add to `proxy-apps.auto.tfvars`:

- `main.tf` - Main configuration
- `variables.tf` - Input variables  
- `outputs.tf` - Output values
- `modules/oauth-provider/` - OAuth2/OIDC provider module
- `modules/proxy-provider/` - Proxy provider module
- `terraform.tfvars.example` - Configuration example
+```hcl
+proxy_applications = {
+  "my-proxy" = {
+    name          = "My Proxy"
+    slug          = "my-proxy"
+    group         = "Tools"
+    external_host = "https://my-proxy.example.com"
+    internal_host = "http://my-service.namespace.svc:80"
+    outpost       = "kubernetes-outpost"
+    create_group  = true
+    access_groups = ["admins"]
+  }
+}
+```
+
+## CI/CD
+
+Managed via Gitea Actions (`.gitea/workflows/authentik-apps.yaml`). Runs `terraform apply` on push to `main` when files in `terraform/authentik/` change. Also generates a wiki page with the applications list.

 ## Requirements

 - Terraform >= 1.0
- Authentik provider >= 2023.10.0
- Authentik API token with admin permissions
+- goauthentik/authentik provider 2025.12.1
+- Authentik API token with admin permissions