Auto-update README with current k8s applications

Generated by CI/CD workflow on 2026-05-11 10:43:51

This PR updates the README.md file with the current list of applications found in the k8s/ directory structure.

.gitea/workflows/authentik-apps.yaml

@@ -1,10 +1,10 @@
-name: 'Keycloak Terraform'
+name: 'Terraform'
 
 on:
   push:
     branches: [ "main" ]
     paths:
-      - 'terraform/keycloak/**'
+      - 'terraform/authentik/**'
   pull_request:
 
 permissions:
@@ -13,6 +13,7 @@ permissions:
 jobs:
   terraform:
     name: 'Terraform'
+    if: false
     runs-on: ubuntu-latest
     environment: production
 
@@ -29,25 +30,119 @@ jobs:
       with:
         cli_config_credentials_token: ${{ secrets.TF_API_TOKEN }}
 
-    - name: Setup kubeconfig
-      run: |
-        mkdir -p ~/.kube
-        echo "${{ secrets.KUBECONFIG }}" > ~/.kube/config
-        chmod 600 ~/.kube/config
-
     - name: Terraform Init
+      env:
+        TF_VAR_authentik_token: ${{ secrets.AUTHENTIK_TOKEN }}
       run: terraform init
-      working-directory: ./terraform/keycloak
+      working-directory: ./terraform/authentik
 
     - name: Terraform Format
+      env:
+        TF_VAR_authentik_token: ${{ secrets.AUTHENTIK_TOKEN }}
       run: terraform fmt -check
       continue-on-error: true
-      working-directory: ./terraform/keycloak
+      working-directory: ./terraform/authentik
 
     - name: Terraform Apply
       env:
-        TF_VAR_keycloak_client_secret: ${{ secrets.KEYCLOAK_CLIENT_SECRET }}
-        TF_VAR_google_client_id: ${{ secrets.GOOGLE_CLIENT_ID }}
-        TF_VAR_google_client_secret: ${{ secrets.GOOGLE_CLIENT_SECRET }}
+        TF_VAR_authentik_token: ${{ secrets.AUTHENTIK_TOKEN }}
       run: terraform apply -input=false -auto-approve -parallelism=100
-      working-directory: ./terraform/keycloak
+      working-directory: ./terraform/authentik
+
+    - name: Generate Wiki Content  
+      if: success()
+      continue-on-error: true
+      env:
+        TF_VAR_authentik_token: ${{ secrets.AUTHENTIK_TOKEN }}
+      run: |
+        echo "📋 Starting Wiki generation..."
+        cd ./terraform/authentik
+        
+        # Get terraform output
+        echo "🔍 Generating Terraform output..."
+        terraform output -json applications_for_wiki > terraform-raw-output.json 2>&1
+        
+        # Process output to extract clean JSON
+        echo "📤 Processing Terraform output..."
+        python3 ../../.gitea/scripts/process-terraform-output.py terraform-raw-output.json terraform-output.json
+        
+        # Run wiki generation
+        echo "📊 Running wiki generation script..."
+        if python3 ../../.gitea/scripts/generate-apps-wiki.py terraform-output.json; then
+          echo "✅ Wiki content generated successfully"
+        else
+          echo "⚠️ Wiki generation failed, retrying with debug..."
+          python3 ../../.gitea/scripts/generate-apps-wiki.py terraform-output.json --debug || echo "⚠️ Wiki generation failed"
+        fi
+        
+        # Check results
+        if [ -f "Applications.md" ]; then
+          echo "✅ Wiki file created: $(wc -l < Applications.md) lines"
+        else
+          echo "⚠️ Wiki content not generated"
+          exit 0
+        fi
+      working-directory: ./
+
+    - name: Upload Wiki to Gitea
+      if: success()  
+      continue-on-error: true
+      run: |
+        cd ./terraform/authentik
+        
+        # Set variables
+        GITEA_URL="${{ secrets.GT_URL }}"
+        GITEA_TOKEN="${{ secrets.GT_WIKI_TOKEN }}"
+        GITEA_OWNER="${{ secrets.GT_OWNER }}"
+        GITEA_REPO="${{ secrets.GT_REPO }}"
+        
+        # Debug variables (without exposing token)
+        echo "🔍 Checking variables..."
+        echo "GITEA_URL: ${GITEA_URL:-NOT SET}"
+        echo "GITEA_OWNER: ${GITEA_OWNER:-NOT SET}"
+        echo "GITEA_REPO: ${GITEA_REPO:-NOT SET}"
+        echo "GITEA_TOKEN: $(if [ -n "$GITEA_TOKEN" ]; then echo "SET"; else echo "NOT SET"; fi)"
+        
+        # Check if file exists
+        if [ ! -f "Applications.md" ]; then
+          echo "⚠️ Applications.md not found, skipping wiki update"
+          exit 0
+        fi
+        
+        echo "📤 Uploading to Gitea Wiki..."
+        
+        # Encode content to base64
+        CONTENT=$(base64 -w 0 Applications.md)
+        
+        # Check if wiki page exists
+        WIKI_PAGE_EXISTS=$(curl -s -o /dev/null -w "%{http_code}" \
+          -H "Authorization: token $GITEA_TOKEN" \
+          "$GITEA_URL/api/v1/repos/$GITEA_OWNER/$GITEA_REPO/wiki/page/Applications" || echo "000")
+        
+        if [ "$WIKI_PAGE_EXISTS" = "200" ]; then
+          echo "📝 Updating existing wiki page..."
+          curl -X PATCH \
+            -H "Authorization: token $GITEA_TOKEN" \
+            -H "Content-Type: application/json" \
+            -d "{
+              \"title\": \"Applications\",
+              \"content_base64\": \"$CONTENT\",
+              \"message\": \"Update applications list from CI/CD [$(date)]\"
+            }" \
+            "$GITEA_URL/api/v1/repos/$GITEA_OWNER/$GITEA_REPO/wiki/page/Applications" || echo "⚠️ Wiki update failed"
+        else
+          echo "📄 Creating new wiki page..."
+          curl -X POST \
+            -H "Authorization: token $GITEA_TOKEN" \
+            -H "Content-Type: application/json" \
+            -d "{
+              \"title\": \"Applications\", 
+              \"content_base64\": \"$CONTENT\",
+              \"message\": \"Create applications list from CI/CD [$(date)]\"
+            }" \
+            "$GITEA_URL/api/v1/repos/$GITEA_OWNER/$GITEA_REPO/wiki/new" || echo "⚠️ Wiki creation failed"
+        fi
+        
+        echo "✅ Wiki update process completed"
+      working-directory: ./
+

README.md

@@ -42,7 +42,8 @@ ArgoCD homelab project
 | Application | Status |
 | :--- | :---: |
 | **comfyui** | [![comfyui](https://ag.hexor.cy/api/badge?name=comfyui&revision=true)](https://ag.hexor.cy/applications/argocd/comfyui) |
-| **furumi** | [![furumi](https://ag.hexor.cy/api/badge?name=furumi&revision=true)](https://ag.hexor.cy/applications/argocd/furumi) |
+| **furumi-dev** | [![furumi-dev](https://ag.hexor.cy/api/badge?name=furumi-dev&revision=true)](https://ag.hexor.cy/applications/argocd/furumi-dev) |
+| **furumi-server** | [![furumi-server](https://ag.hexor.cy/api/badge?name=furumi-server&revision=true)](https://ag.hexor.cy/applications/argocd/furumi-server) |
 | **gitea** | [![gitea](https://ag.hexor.cy/api/badge?name=gitea&revision=true)](https://ag.hexor.cy/applications/argocd/gitea) |
 | **greece-notifier** | [![greece-notifier](https://ag.hexor.cy/api/badge?name=greece-notifier&revision=true)](https://ag.hexor.cy/applications/argocd/greece-notifier) |
 | **hexound** | [![hexound](https://ag.hexor.cy/api/badge?name=hexound&revision=true)](https://ag.hexor.cy/applications/argocd/hexound) |

k8s/apps/furumi-dev/app.yaml

@@ -1,17 +1,17 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: furumi
+  name: furumi-dev
   namespace: argocd
 spec:
   project: apps
   destination:
-    namespace: furumi
+    namespace: furumi-dev
     server: https://kubernetes.default.svc
   source:
     repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
     targetRevision: HEAD
-    path: k8s/apps/furumi
+    path: k8s/apps/furumi-dev
   syncPolicy:
     automated:
       selfHeal: true

k8s/apps/furumi-dev/external-secrets.yaml

@@ -0,0 +1,55 @@
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: furumi-ng-creds
+spec:
+  target:
+    name: furumi-ng-creds
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        OIDC_CLIENT_ID: |-
+          {{ .client_id }}
+        OIDC_CLIENT_SECRET: |-
+          {{ .client_secret }}
+        OIDC_ISSUER_URL: https://idm.hexor.cy/application/o/furumi-dev/
+        OIDC_REDIRECT_URL: https://music-dev.hexor.cy/auth/callback
+        OIDC_SESSION_SECRET: |-
+          {{ .session_secret }}
+        PG_STRING: |-
+          postgres://furumi_dev:{{ .pg_pass }}@psql.psql.svc:5432/furumi_dev
+  data:
+    - secretKey: client_id
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 960735e6-2cc9-4b68-9bd3-e6786e5a0cd6
+        property: fields[0].value
+    - secretKey: client_secret
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 960735e6-2cc9-4b68-9bd3-e6786e5a0cd6
+        property: fields[1].value
+    - secretKey: session_secret
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 960735e6-2cc9-4b68-9bd3-e6786e5a0cd6
+        property: fields[2].value
+    - secretKey: pg_pass
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 2a9deb39-ef22-433e-a1be-df1555625e22
+        property: fields[17].value

k8s/apps/furumi-dev/ingress.yaml

@@ -0,0 +1,66 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: admin-strip
+spec:
+  stripPrefix:
+    prefixes:
+      - /admin
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: furumi-tls-ingress
+  annotations:
+    ingressClassName: traefik
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
+    acme.cert-manager.io/http01-edit-in-place: "true"
+spec:
+  rules:
+    - host: music-dev.hexor.cy
+      http:
+        paths:
+          - path: /api
+            pathType: Prefix
+            backend:
+              service:
+                name: furumi-dev-web-player
+                port:
+                  number: 8080
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: furumi-dev-node-player
+                port:
+                  number: 3001
+  tls:
+    - secretName: furumi-tls
+      hosts:
+        - '*.hexor.cy'
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: furumi-dev-admin-ingress
+  annotations:
+    ingressClassName: traefik
+    traefik.ingress.kubernetes.io/router.middlewares: furumi-server-admin-strip@kubernetescrd,kube-system-https-redirect@kubernetescrd
+spec:
+  rules:
+    - host: music-dev.hexor.cy
+      http:
+        paths:
+          - path: /admin
+            pathType: Prefix
+            backend:
+              service:
+                name: furumi-dev-metadata-agent
+                port:
+                  number: 8090
+  tls:
+    - secretName: furumi-tls
+      hosts:
+        - '*.hexor.cy'

k8s/apps/furumi-dev/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - app.yaml
+  - service.yaml
+  - external-secrets.yaml
+  - ingress.yaml
+  - web-player.yaml
+  - node-player.yaml
+  - metadata-agent.yaml

k8s/apps/furumi-dev/metadata-agent.yaml

@@ -0,0 +1,59 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: furumi-dev-metadata-agent
+  labels:
+    app: furumi-dev-metadata-agent
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: furumi-dev-metadata-agent
+  template:
+    metadata:
+      labels:
+        app: furumi-dev-metadata-agent
+    spec:
+      nodeSelector:
+        kubernetes.io/hostname: master.tail2fe2d.ts.net
+      containers:
+        - name: furumi-dev-metadata-agent
+          image: ultradesu/furumi-metadata-agent:dev
+          imagePullPolicy: Always
+          env:
+            - name: FURUMI_AGENT_DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: PG_STRING
+            - name: FURUMI_AGENT_INBOX_DIR
+              value: "/inbox"
+            - name: FURUMI_AGENT_STORAGE_DIR
+              value: "/media"
+            - name: FURUMI_AGENT_OLLAMA_URL
+              value: "http://100.120.76.49:1234"
+            - name: FURUMI_AGENT_OLLAMA_MODEL
+              value: "qwen2.5-32b-instruct"
+            - name: FURUMI_AGENT_POLL_INTERVAL_SECS
+              value: "10"
+            - name: RUST_LOG
+              value: "info"
+          ports:
+            - name: admin-ui
+              containerPort: 8090
+              protocol: TCP
+          volumeMounts:
+            - name: library
+              mountPath: /media
+            - name: inbox
+              mountPath: /inbox
+      volumes:
+        - name: library
+          hostPath:
+            path: /k8s/furumi-dev/library
+            type: DirectoryOrCreate
+        - name: inbox
+          hostPath:
+            path: /k8s/furumi-dev/inbox
+            type: DirectoryOrCreate
+

k8s/apps/furumi-dev/node-player.yaml

@@ -0,0 +1,53 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: furumi-dev-node-player
+  labels:
+    app: furumi-dev-node-player
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: furumi-dev-node-player
+  template:
+    metadata:
+      labels:
+        app: furumi-dev-node-player
+    spec:
+      nodeSelector:
+        kubernetes.io/hostname: master.tail2fe2d.ts.net
+      containers:
+        - name: furumi-dev-node-player
+          image: ultradesu/furumi-node-player:dev
+          imagePullPolicy: Always
+          env:
+            - name: PORT
+              value: "3001"
+            - name: BASE_URL
+              value: "https://music-dev.hexor.cy"
+            - name: FRONTEND_ORIGIN
+              value: "https://music-dev.hexor.cy"
+            - name: SESSION_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_SESSION_SECRET
+            - name: OIDC_ISSUER_BASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_ISSUER_URL
+            - name: OIDC_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_CLIENT_ID
+            - name: OIDC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_CLIENT_SECRET
+          ports:
+            - name: http
+              containerPort: 3001
+              protocol: TCP

k8s/apps/furumi-dev/service.yaml

@@ -0,0 +1,48 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: furumi-dev-metadata-agent
+  labels:
+    app: furumi-dev-metadata-agent
+spec:
+  type: ClusterIP
+  selector:
+    app: furumi-dev-metadata-agent
+  ports:
+    - name: admin-ui
+      protocol: TCP
+      port: 8090
+      targetPort: 8090
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: furumi-dev-web-player
+  labels:
+    app: furumi-dev-web-player
+spec:
+  type: ClusterIP
+  selector:
+    app: furumi-dev-web-player
+  ports:
+    - name: http
+      protocol: TCP
+      port: 8080
+      targetPort: 8080
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: furumi-dev-node-player
+  labels:
+    app: furumi-dev-node-player
+spec:
+  type: ClusterIP
+  selector:
+    app: furumi-dev-node-player
+  ports:
+    - name: http
+      protocol: TCP
+      port: 3001
+      targetPort: 3001

k8s/apps/furumi-dev/web-player.yaml

@@ -0,0 +1,69 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: furumi-dev-web-player
+  labels:
+    app: furumi-dev-web-player
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: furumi-dev-web-player
+  template:
+    metadata:
+      labels:
+        app: furumi-dev-web-player
+    spec:
+      nodeSelector:
+        kubernetes.io/hostname: master.tail2fe2d.ts.net
+      containers:
+        - name: furumi-dev-web-player
+          image: ultradesu/furumi-web-player:dev
+          imagePullPolicy: Always
+          env:
+            - name: FURUMI_PLAYER_OIDC_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_CLIENT_ID
+            - name: FURUMI_PLAYER_OIDC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_CLIENT_SECRET
+            - name: FURUMI_PLAYER_OIDC_ISSUER_URL
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_ISSUER_URL
+            - name: FURUMI_PLAYER_OIDC_REDIRECT_URL
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_REDIRECT_URL
+            - name: FURUMI_PLAYER_OIDC_SESSION_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_SESSION_SECRET
+            - name: FURUMI_PLAYER_DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: PG_STRING
+            - name: FURUMI_PLAYER_STORAGE_DIR
+              value: "/media"
+            - name: RUST_LOG
+              value: "info"
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          volumeMounts:
+            - name: music
+              mountPath: /media
+      volumes:
+        - name: music
+          hostPath:
+            path: /k8s/furumi-dev/library
+            type: DirectoryOrCreate

k8s/apps/furumi-server/app.yaml

@@ -0,0 +1,20 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: furumi-server
+  namespace: argocd
+spec:
+  project: apps
+  destination:
+    namespace: furumi-server
+    server: https://kubernetes.default.svc
+  source:
+    repoURL: ssh://git@gt.hexor.cy:30022/ab/homelab.git
+    targetRevision: HEAD
+    path: k8s/apps/furumi-server
+  syncPolicy:
+    automated:
+      selfHeal: true
+      prune: true
+    syncOptions:
+      - CreateNamespace=true

k8s/apps/furumi-server/deployment.yaml

@@ -0,0 +1,75 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: furumi-server
+  labels:
+    app: furumi-server
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: furumi-server
+  template:
+    metadata:
+      labels:
+        app: furumi-server
+    spec:
+      nodeSelector:
+        kubernetes.io/hostname: master.tail2fe2d.ts.net
+      containers:
+        - name: furumi-server
+          image: ultradesu/furumi-server:trunk
+          imagePullPolicy: Always
+          env:
+            - name: FURUMI_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: TOKEN
+            - name: FURUMI_OIDC_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_CLIENT_ID
+            - name: FURUMI_OIDC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_CLIENT_SECRET
+            - name: FURUMI_OIDC_ISSUER_URL
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_ISSUER_URL
+            - name: FURUMI_OIDC_REDIRECT_URL
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_REDIRECT_URL
+            - name: FURUMI_OIDC_SESSION_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_SESSION_SECRET
+            - name: FURUMI_ROOT
+              value: "/media"
+            - name: RUST_LOG
+              value: "info"
+          ports:
+            - name: grpc
+              containerPort: 50051
+              protocol: TCP
+            - name: metrics
+              containerPort: 9090
+              protocol: TCP
+            - name: web-ui
+              containerPort: 8080
+              protocol: TCP
+          volumeMounts:
+            - name: music
+              mountPath: /media
+      volumes:
+        - name: music
+          hostPath:
+            path: /k8s/media/downloads/Lidarr_Music
+            type: DirectoryOrCreate

k8s/apps/furumi-server/external-secrets.yaml

@@ -0,0 +1,65 @@
+---
+apiVersion: external-secrets.io/v1
+kind: ExternalSecret
+metadata:
+  name: furumi-ng-creds
+spec:
+  target:
+    name: furumi-ng-creds
+    deletionPolicy: Delete
+    template:
+      type: Opaque
+      data:
+        TOKEN: |-
+          {{ .token }}
+        OIDC_CLIENT_ID: |-
+          {{ .client_id }}
+        OIDC_CLIENT_SECRET: |-
+          {{ .client_secret }}
+        OIDC_ISSUER_URL: https://idm.hexor.cy/application/o/furumi-ng-web/
+        OIDC_REDIRECT_URL: https://music.hexor.cy/auth/callback
+        OIDC_SESSION_SECRET: |-
+          {{ .session_secret }}
+        PG_STRING: |-
+          postgres://furumi:{{ .pg_pass }}@psql.psql.svc:5432/furumi
+  data:
+    - secretKey: token
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
+        property: fields[0].value
+    - secretKey: client_id
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
+        property: fields[1].value
+    - secretKey: client_secret
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
+        property: fields[2].value
+    - secretKey: session_secret
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: b8b8c3a2-c3fe-42d3-9402-0ae305e1455f
+        property: fields[3].value
+    - secretKey: pg_pass
+      sourceRef:
+        storeRef:
+          name: vaultwarden-login
+          kind: ClusterSecretStore
+      remoteRef:
+        key: 2a9deb39-ef22-433e-a1be-df1555625e22
+        property: fields[16].value

k8s/apps/furumi-server/ingress.yaml

@@ -0,0 +1,59 @@
+---
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: admin-strip
+spec:
+  stripPrefix:
+    prefixes:
+      - /admin
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: furumi-tls-ingress
+  annotations:
+    ingressClassName: traefik
+    cert-manager.io/cluster-issuer: letsencrypt
+    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
+    acme.cert-manager.io/http01-edit-in-place: "true"
+spec:
+  rules:
+    - host: music.hexor.cy
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: furumi-web-player
+                port:
+                  number: 8080
+  tls:
+    - secretName: furumi-tls
+      hosts:
+        - '*.hexor.cy'
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: furumi-admin-ingress
+  annotations:
+    ingressClassName: traefik
+    traefik.ingress.kubernetes.io/router.middlewares: furumi-server-admin-strip@kubernetescrd,kube-system-https-redirect@kubernetescrd
+spec:
+  rules:
+    - host: music.hexor.cy
+      http:
+        paths:
+          - path: /admin
+            pathType: Prefix
+            backend:
+              service:
+                name: furumi-metadata-agent
+                port:
+                  number: 8090
+  tls:
+    - secretName: furumi-tls
+      hosts:
+        - '*.hexor.cy'

k8s/apps/furumi-server/kustomization.yaml

@@ -3,8 +3,10 @@ kind: Kustomization
 
 resources:
   - app.yaml
+  - deployment.yaml
   - service.yaml
+  - servicemonitor.yaml
   - external-secrets.yaml
   - ingress.yaml
-  - deployment.yaml
-  - servicemonitor.yaml
+  - web-player.yaml
+  - metadata-agent.yaml

k8s/apps/furumi-server/metadata-agent.yaml

@@ -0,0 +1,59 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: furumi-metadata-agent
+  labels:
+    app: furumi-metadata-agent
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: furumi-metadata-agent
+  template:
+    metadata:
+      labels:
+        app: furumi-metadata-agent
+    spec:
+      nodeSelector:
+        kubernetes.io/hostname: master.tail2fe2d.ts.net
+      containers:
+        - name: furumi-metadata-agent
+          image: ultradesu/furumi-metadata-agent:trunk
+          imagePullPolicy: Always
+          env:
+            - name: FURUMI_AGENT_DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: PG_STRING
+            - name: FURUMI_AGENT_INBOX_DIR
+              value: "/inbox"
+            - name: FURUMI_AGENT_STORAGE_DIR
+              value: "/media"
+            - name: FURUMI_AGENT_OLLAMA_URL
+              value: "http://100.120.76.49:1234"
+            - name: FURUMI_AGENT_OLLAMA_MODEL
+              value: "google/gemma-4-26b-a4b"
+            - name: FURUMI_AGENT_POLL_INTERVAL_SECS
+              value: "10"
+            - name: RUST_LOG
+              value: "info"
+          ports:
+            - name: admin-ui
+              containerPort: 8090
+              protocol: TCP
+          volumeMounts:
+            - name: library
+              mountPath: /media
+            - name: inbox
+              mountPath: /inbox
+      volumes:
+        - name: library
+          hostPath:
+            path: /k8s/furumi/library
+            type: DirectoryOrCreate
+        - name: inbox
+          hostPath:
+            path: /k8s/furumi/inbox
+            type: DirectoryOrCreate
+

k8s/apps/furumi-server/service.yaml

@@ -0,0 +1,62 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: furumi-server-grpc
+spec:
+  type: LoadBalancer
+  selector:
+    app: furumi-server
+  ports:
+    - name: grpc
+      protocol: TCP
+      port: 50051
+      targetPort: 50051
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: furumi-server-metrics
+  labels:
+    app: furumi-server
+spec:
+  type: ClusterIP
+  selector:
+    app: furumi-server
+  ports:
+    - name: metrics
+      protocol: TCP
+      port: 9090
+      targetPort: 9090
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: furumi-metadata-agent
+  labels:
+    app: furumi-metadata-agent
+spec:
+  type: ClusterIP
+  selector:
+    app: furumi-metadata-agent
+  ports:
+    - name: admin-ui
+      protocol: TCP
+      port: 8090
+      targetPort: 8090
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: furumi-web-player
+  labels:
+    app: furumi-web-player
+spec:
+  type: ClusterIP
+  selector:
+    app: furumi-web-player
+  ports:
+    - name: web-ui
+      protocol: TCP
+      port: 8080
+      targetPort: 8080

k8s/apps/furumi-server/servicemonitor.yaml

@@ -2,20 +2,20 @@
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
-  name: furumi-player-metrics
+  name: furumi-server-metrics
   labels:
-    app: furumi-player
+    app: furumi-server
     release: prometheus
 spec:
   selector:
     matchLabels:
-      app: furumi-player
+      app: furumi-server
   endpoints:
-    - port: http
+    - port: metrics
       path: /metrics
       interval: 30s
       scrapeTimeout: 10s
       honorLabels: true
   namespaceSelector:
     matchNames:
-      - furumi
+      - furumi-server

k8s/apps/furumi-server/web-player.yaml

@@ -0,0 +1,70 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: furumi-web-player
+  labels:
+    app: furumi-web-player
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: furumi-web-player
+  template:
+    metadata:
+      labels:
+        app: furumi-web-player
+    spec:
+      nodeSelector:
+        kubernetes.io/hostname: master.tail2fe2d.ts.net
+      containers:
+        - name: furumi-web-player
+          image: ultradesu/furumi-web-player:trunk
+          imagePullPolicy: Always
+          env:
+            - name: FURUMI_PLAYER_OIDC_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_CLIENT_ID
+            - name: FURUMI_PLAYER_OIDC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_CLIENT_SECRET
+            - name: FURUMI_PLAYER_OIDC_ISSUER_URL
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_ISSUER_URL
+            - name: FURUMI_PLAYER_OIDC_REDIRECT_URL
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_REDIRECT_URL
+            - name: FURUMI_PLAYER_OIDC_SESSION_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: OIDC_SESSION_SECRET
+            - name: FURUMI_PLAYER_DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: furumi-ng-creds
+                  key: PG_STRING
+            - name: FURUMI_PLAYER_STORAGE_DIR
+              value: "/media"
+            - name: RUST_LOG
+              value: "info"
+          ports:
+            - name: web-ui
+              containerPort: 8080
+              protocol: TCP
+          volumeMounts:
+            - name: music
+              mountPath: /media
+      volumes:
+        - name: music
+          hostPath:
+            path: /k8s/furumi/library
+            type: DirectoryOrCreate
+

k8s/apps/furumi/deployment.yaml

@@ -1,46 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: furumi-player
-  labels:
-    app: furumi-player
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: furumi-player
-  template:
-    metadata:
-      labels:
-        app: furumi-player
-    spec:
-      nodeSelector:
-        kubernetes.io/hostname: music.tail2fe2d.ts.net
-      containers:
-        - name: furumi-player
-          image: ultradesu/furumusic:latest
-          imagePullPolicy: Always
-          env:
-            - name: FURU_DATABASE_URL
-              valueFrom:
-                secretKeyRef:
-                  name: furumi-creds
-                  key: PG_STRING
-          ports:
-          - containerPort: 8000
-            name: http
-          volumeMounts:
-            - name: library
-              mountPath: /media
-            - name: inbox
-              mountPath: /inbox
-      volumes:
-        - name: library
-          hostPath:
-            path: /data/furumi/library
-            type: DirectoryOrCreate
-        - name: inbox
-          hostPath:
-            path: /data/furumi/inbox
-            type: DirectoryOrCreate
-

k8s/apps/furumi/external-secrets.yaml

@@ -1,55 +0,0 @@
----
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: furumi-ng-creds
-spec:
-  target:
-    name: furumi-creds
-    deletionPolicy: Delete
-    template:
-      type: Opaque
-      data:
-       #OIDC_CLIENT_ID: |-
-       #  {{ .client_id }}
-       #OIDC_CLIENT_SECRET: |-
-       #  {{ .client_secret }}
-       #OIDC_ISSUER_URL: https://idm.hexor.cy/application/o/furumi/
-       #OIDC_REDIRECT_URL: https://music.hexor.cy/auth/callback
-       #OIDC_SESSION_SECRET: |-
-       #  {{ .session_secret }}
-        PG_STRING: |-
-          postgresql://furumi_dev:{{ .pg_pass }}@psql.psql.svc/furumi_dev
-  data:
-  # - secretKey: client_id
-  #   sourceRef:
-  #     storeRef:
-  #       name: vaultwarden-login
-  #       kind: ClusterSecretStore
-  #   remoteRef:
-  #     key: 960735e6-2cc9-4b68-9bd3-e6786e5a0cd6
-  #     property: fields[0].value
-  # - secretKey: client_secret
-  #   sourceRef:
-  #     storeRef:
-  #       name: vaultwarden-login
-  #       kind: ClusterSecretStore
-  #   remoteRef:
-  #     key: 960735e6-2cc9-4b68-9bd3-e6786e5a0cd6
-  #     property: fields[1].value
-  # - secretKey: session_secret
-  #   sourceRef:
-  #     storeRef:
-  #       name: vaultwarden-login
-  #       kind: ClusterSecretStore
-  #   remoteRef:
-  #     key: 960735e6-2cc9-4b68-9bd3-e6786e5a0cd6
-  #     property: fields[2].value
-    - secretKey: pg_pass
-      sourceRef:
-        storeRef:
-          name: vaultwarden-login
-          kind: ClusterSecretStore
-      remoteRef:
-        key: 2a9deb39-ef22-433e-a1be-df1555625e22
-        property: fields[17].value

k8s/apps/furumi/ingress.yaml

@@ -1,27 +0,0 @@
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: furumi-tls-ingress
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt
-    traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
-    acme.cert-manager.io/http01-edit-in-place: "true"
-spec:
-  ingressClassName: traefik
-  rules:
-    - host: music.hexor.cy
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: furumi-player
-                port:
-                  number: 8000
-  tls:
-    - secretName: furumi-tls
-      hosts:
-        - music.hexor.cy
-

k8s/apps/furumi/service.yaml

@@ -1,16 +0,0 @@
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: furumi-player
-  labels:
-    app: furumi-player
-spec:
-  type: ClusterIP
-  selector:
-    app: furumi-player
-  ports:
-    - name: http
-      protocol: TCP
-      port: 8000
-      targetPort: 8000

k8s/apps/gitea/deployment.yaml

@@ -70,7 +70,7 @@ kind: Deployment
 metadata:
   name: gitea-runner
 spec:
-  replicas: 1
+  replicas: 2
   selector:
     matchLabels:
       app: gitea-runner
@@ -115,7 +115,7 @@ spec:
               - key: kubernetes.io/hostname
                 operator: In
                 values:
-                #- uk-desktop.tail2fe2d.ts.net
+                - uk-desktop.tail2fe2d.ts.net
                 - ai.tail2fe2d.ts.net
           - weight: 50
             preference:

k8s/apps/gitea/ingress.yaml

@@ -4,11 +4,11 @@ kind: Ingress
 metadata:
   name: gitea-tls-ingress
   annotations:
+    ingressClassName: traefik
     cert-manager.io/cluster-issuer: letsencrypt
     traefik.ingress.kubernetes.io/router.middlewares: kube-system-https-redirect@kubernetescrd
     acme.cert-manager.io/http01-edit-in-place: "true"
 spec:
-  ingressClassName: traefik
   rules:
     - host: gt.hexor.cy
       http:

k8s/apps/pasarguard/daemonset.yaml

@@ -1,4 +1,5 @@
 ---
+image: &image 'pasarguard/node:v0.4.0'
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
@@ -46,7 +47,7 @@ spec:
               mountPath: /scripts
       containers:
         - name: pasarguard-node
-          image: pasarguard/node:v0.4.0
+          image: *image
           imagePullPolicy: Always
           command:
             - /bin/sh
@@ -219,4 +220,4 @@ roleRef:
 subjects:
   - kind: ServiceAccount
     name: pasarguard-node
-    namespace: pasarguard
+    namespace: pasarguard

k8s/apps/pasarguard/deployment.yaml

@@ -1,4 +1,5 @@
 ---
+image: &image 'pasarguard/panel:v3.1.0'
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -34,7 +35,7 @@ spec:
               mountPath: /templates/subscription
       containers:
         - name: pasarguard-web
-          image: pasarguard/panel:v4.0.2
+          image: *image
           imagePullPolicy: Always
           envFrom:
             - secretRef:
@@ -75,6 +76,9 @@ apiVersion: v1
 kind: Service
 metadata:
   name: pasarguard
+  annotations:
+    traefik.ingress.kubernetes.io/service.serversscheme: https
+    traefik.ingress.kubernetes.io/service.serverstransport: pasarguard-pasarguard-transport@kubernetescrd
 spec:
   selector:
     app: pasarguard

k8s/apps/pasarguard/ingress.yaml

@@ -4,23 +4,28 @@ kind: ServersTransport
 metadata:
   name: pasarguard-transport
 spec:
-  serverName: ps.hexor.cy
   insecureSkipVerify: true
 ---
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
+apiVersion: networking.k8s.io/v1
+kind: Ingress
 metadata:
-  name: pasarguard
+  name: pasarguard-ingress
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
 spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`ps.hexor.cy`)
-      kind: Rule
-      services:
-        - name: pasarguard
-          port: 80
-          scheme: https
-          serversTransport: pasarguard-transport
+  ingressClassName: traefik
+  rules:
+    - host: ps.hexor.cy
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: pasarguard
+                port:
+                  number: 80
   tls:
-    secretName: pasarguard-tls
+    - secretName: pasarguard-tls
+      hosts:
+        - ps.hexor.cy

k8s/apps/web-petting/deployment.yaml

@@ -6,8 +6,6 @@ metadata:
     app: web-petting
 spec:
   replicas: 1
-  strategy:
-    type: Recreate
   selector:
     matchLabels:
       app: web-petting
@@ -18,14 +16,13 @@ spec:
     spec:
       nodeSelector:
         kubernetes.io/os: linux
-        kubernetes.io/hostname: master.tail2fe2d.ts.net
       volumes:
         - name: data
           persistentVolumeClaim:
             claimName: web-petting-data
       containers:
       - name: web-petting
-        image: ultradesu/web-petting:latest
+        image: ultradesu/web-petting:v0.1.1
         imagePullPolicy: Always
         args:
 #         - "tail"

k8s/apps/web-petting/ingress.yaml

@@ -20,21 +20,8 @@ spec:
                 name: web-petting
                 port:
                   number: 80
-    - host: xn--l1acako8eb.xn--p1ai
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: web-petting
-                port:
-                  number: 80
   tls:
     - secretName: web-petting-tls
       hosts:
         - pet.hexor.cy
-    - secretName: web-petting-murnyanya-tls
-      hosts:
-        - xn--l1acako8eb.xn--p1ai
 

k8s/core/argocd/values.yaml

@@ -23,22 +23,14 @@ configs:
     admin.enabled: false
     statusbadge.enabled: true
     timeout.reconciliation: 60s
-    dex.config: |
-      connectors:
-      - type: oidc
-        id: keycloak
-        name: Keycloak
-        config:
-          issuer: https://auth.hexor.cy/auth/realms/hexor
-          clientID: $oidc-creds:id
-          clientSecret: $oidc-creds:secret
-          insecureEnableGroups: true
-          scopes:
-            - openid
-            - profile
-            - email
-            - offline_access
-          getUserInfo: true
+    oidc.config: |
+      name: Keycloak
+      issuer: https://auth.hexor.cy/auth/realms/hexor
+      clientID: $oidc-creds:id
+      clientSecret: $oidc-creds:secret
+      requestedScopes: ["openid", "profile", "email", "offline_access"]
+      requestedIDTokenClaims: {"groups": {"essential": true}}
+      refreshTokenThreshold: 2m
   rbac:
     create: true
     policy.default: ""
@@ -72,7 +64,7 @@ dex:
   replicas: 1
   nodeSelector:
     <<: *nodeSelector
-  enabled: true
+  enabled: false
 
 # Standard Redis disabled because Redis HA is enabled
 redis:

k8s/core/authentik/kustomization.yaml

@@ -4,6 +4,7 @@ kind: Kustomization
 resources:
   - app.yaml
   - external-secrets.yaml
+  - https-middleware.yaml
   - outpost-selector-fix.yaml
 # - worker-restart.yaml
 

k8s/core/cert-manager/issuer.yaml

@@ -35,6 +35,4 @@ spec:
           dnsZones:
             - "*.hexor.cy"
             - "hexor.cy"
-            - "*.xn--l1acako8eb.xn--p1ai"
-            - "xn--l1acako8eb.xn--p1ai"
 

k8s/core/keycloak/hacker-theme-configmap.yaml

@@ -1,366 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: keycloak-hacker-theme
-  namespace: keycloak
-data:
-  theme.properties: |
-    parent=keycloak.v2
-    import=common/keycloak
-
-    styles=css/hacker.css
-
-  hacker.css: |
-    /* ============================================================
-       HEXOR — Hacker Terminal Theme for Keycloak
-       ============================================================ */
-
-    @import url('https://fonts.googleapis.com/css2?family=Fira+Code:wght@400;600&display=swap');
-
-    :root {
-      --hk-bg: #0a0a0a;
-      --hk-panel: #0d0d0d;
-      --hk-border: #00ff4180;
-      --hk-green: #00ff41;
-      --hk-green-dim: #00cc33;
-      --hk-green-glow: rgba(0, 255, 65, 0.15);
-      --hk-green-glow-strong: rgba(0, 255, 65, 0.35);
-      --hk-cyan: #00e5ff;
-      --hk-red: #ff3333;
-      --hk-text: #b0ffb0;
-      --hk-text-dim: #5a8a5a;
-      --hk-input-bg: #050505;
-      --hk-font: 'Fira Code', 'Cascadia Code', 'JetBrains Mono', monospace;
-    }
-
-    /* -- Force dark always --------------------------------------------------- */
-    html.login-pf,
-    html.login-pf.pf-v5-theme-dark {
-      color-scheme: dark;
-    }
-
-    /* -- Background: scanlines + CRT ---------------------------------------- */
-    body#keycloak-bg {
-      font-family: var(--hk-font) !important;
-      background: var(--hk-bg) !important;
-      color: var(--hk-text) !important;
-      min-height: 100vh;
-      position: relative;
-    }
-
-    body#keycloak-bg::before {
-      content: '';
-      position: fixed;
-      inset: 0;
-      background: repeating-linear-gradient(
-        0deg,
-        transparent,
-        transparent 2px,
-        rgba(0, 255, 65, 0.03) 2px,
-        rgba(0, 255, 65, 0.03) 4px
-      );
-      pointer-events: none;
-      z-index: 9999;
-    }
-
-    /* -- Login container ----------------------------------------------------- */
-    .pf-v5-c-login {
-      background: transparent !important;
-    }
-
-    .pf-v5-c-login__container {
-      max-width: 480px !important;
-    }
-
-    /* -- Header / Brand ------------------------------------------------------ */
-    #kc-header-wrapper {
-      font-family: var(--hk-font) !important;
-      color: var(--hk-green) !important;
-      text-shadow: 0 0 10px var(--hk-green), 0 0 30px var(--hk-green-glow);
-      font-size: 1.5rem !important;
-      letter-spacing: 0.15em;
-      text-transform: uppercase;
-    }
-
-    #kc-header-wrapper .kc-logo-text span::before {
-      content: '> ';
-      opacity: 0.6;
-    }
-
-    /* -- Main card ----------------------------------------------------------- */
-    .pf-v5-c-login__main {
-      background: var(--hk-panel) !important;
-      border: 1px solid var(--hk-border) !important;
-      border-radius: 0 !important;
-      box-shadow:
-        0 0 15px var(--hk-green-glow),
-        inset 0 0 30px rgba(0, 0, 0, 0.5) !important;
-    }
-
-    /* -- Title --------------------------------------------------------------- */
-    h1#kc-page-title,
-    .pf-v5-c-title {
-      font-family: var(--hk-font) !important;
-      color: var(--hk-green) !important;
-      text-shadow: 0 0 8px var(--hk-green-glow);
-      font-weight: 600 !important;
-      font-size: 1.25rem !important;
-      letter-spacing: 0.05em;
-    }
-
-    /* -- Labels -------------------------------------------------------------- */
-    .pf-v5-c-form__label-text {
-      font-family: var(--hk-font) !important;
-      color: var(--hk-green-dim) !important;
-      font-size: 0.85rem !important;
-      text-transform: uppercase;
-      letter-spacing: 0.08em;
-    }
-
-    /* -- Input fields -------------------------------------------------------- */
-    .pf-v5-c-form-control {
-      background-color: var(--hk-input-bg) !important;
-      border: 1px solid var(--hk-border) !important;
-      border-radius: 0 !important;
-      color: var(--hk-green) !important;
-      font-family: var(--hk-font) !important;
-      font-size: 0.9rem !important;
-      caret-color: var(--hk-green);
-      transition: border-color 0.2s, box-shadow 0.2s;
-    }
-
-    .pf-v5-c-form-control:focus-within,
-    .pf-v5-c-form-control:focus {
-      border-color: var(--hk-green) !important;
-      box-shadow: 0 0 8px var(--hk-green-glow), inset 0 0 4px var(--hk-green-glow) !important;
-      outline: none !important;
-    }
-
-    .pf-v5-c-form-control input {
-      color: var(--hk-green) !important;
-      font-family: var(--hk-font) !important;
-    }
-
-    .pf-v5-c-form-control input::placeholder {
-      color: var(--hk-text-dim) !important;
-    }
-
-    /* -- Primary button (Sign In) -------------------------------------------- */
-    .pf-v5-c-button.pf-m-primary {
-      background: transparent !important;
-      border: 1px solid var(--hk-green) !important;
-      border-radius: 0 !important;
-      color: var(--hk-green) !important;
-      font-family: var(--hk-font) !important;
-      font-weight: 600 !important;
-      text-transform: uppercase;
-      letter-spacing: 0.12em;
-      font-size: 0.9rem !important;
-      transition: all 0.2s;
-      position: relative;
-      overflow: hidden;
-    }
-
-    .pf-v5-c-button.pf-m-primary:hover {
-      background: var(--hk-green-glow) !important;
-      box-shadow: 0 0 15px var(--hk-green-glow-strong), inset 0 0 15px var(--hk-green-glow) !important;
-      color: #fff !important;
-      text-shadow: 0 0 5px var(--hk-green);
-    }
-
-    /* -- Secondary button (Try Another Way, Passkey) ------------------------- */
-    .pf-v5-c-button.pf-m-secondary {
-      background: transparent !important;
-      border: 1px solid var(--hk-cyan) !important;
-      border-radius: 0 !important;
-      color: var(--hk-cyan) !important;
-      font-family: var(--hk-font) !important;
-      text-transform: uppercase;
-      letter-spacing: 0.1em;
-      font-size: 0.85rem !important;
-      transition: all 0.2s;
-    }
-
-    .pf-v5-c-button.pf-m-secondary:hover {
-      background: rgba(0, 229, 255, 0.1) !important;
-      box-shadow: 0 0 12px rgba(0, 229, 255, 0.3) !important;
-      color: #fff !important;
-    }
-
-    /* -- Passkey authenticate button ----------------------------------------- */
-    #authenticateWebAuthnButton {
-      background: transparent !important;
-      border: 1px solid var(--hk-cyan) !important;
-      border-radius: 0 !important;
-      color: var(--hk-cyan) !important;
-      font-family: var(--hk-font) !important;
-      text-transform: uppercase;
-      letter-spacing: 0.1em;
-      font-size: 0.85rem !important;
-      padding: 0.75rem 1rem;
-      display: block;
-      width: 100%;
-      text-align: center;
-      text-decoration: none;
-      transition: all 0.2s;
-      margin-top: 1rem;
-    }
-
-    #authenticateWebAuthnButton::before {
-      content: '\f084  ';
-      font-family: 'Font Awesome 6 Free', 'FontAwesome';
-      font-weight: 900;
-    }
-
-    #authenticateWebAuthnButton:hover {
-      background: rgba(0, 229, 255, 0.1) !important;
-      box-shadow: 0 0 15px rgba(0, 229, 255, 0.3), inset 0 0 10px rgba(0, 229, 255, 0.1) !important;
-      color: #fff !important;
-      text-shadow: 0 0 5px var(--hk-cyan);
-    }
-
-    /* -- Show password button ------------------------------------------------ */
-    .pf-v5-c-button.pf-m-control {
-      background: var(--hk-input-bg) !important;
-      border: 1px solid var(--hk-border) !important;
-      border-left: none !important;
-      border-radius: 0 !important;
-      color: var(--hk-text-dim) !important;
-    }
-
-    .pf-v5-c-button.pf-m-control:hover {
-      color: var(--hk-green) !important;
-    }
-
-    /* -- Social providers (Google, etc) -------------------------------------- */
-    .pf-v5-c-login__main-footer {
-      border-top: 1px solid var(--hk-border) !important;
-    }
-
-    .kc-social-section .pf-v5-c-button.pf-m-secondary {
-      border-color: var(--hk-text-dim) !important;
-      color: var(--hk-text) !important;
-    }
-
-    .kc-social-section .pf-v5-c-button.pf-m-secondary:hover {
-      border-color: var(--hk-green) !important;
-      color: var(--hk-green) !important;
-      box-shadow: 0 0 10px var(--hk-green-glow) !important;
-    }
-
-    /* -- Try another way link ------------------------------------------------ */
-    #try-another-way {
-      color: var(--hk-cyan) !important;
-      text-decoration: none !important;
-      font-family: var(--hk-font) !important;
-    }
-
-    #try-another-way:hover {
-      text-shadow: 0 0 8px rgba(0, 229, 255, 0.5);
-    }
-
-    /* -- Links --------------------------------------------------------------- */
-    a {
-      color: var(--hk-cyan) !important;
-      text-decoration: none;
-      transition: text-shadow 0.2s;
-    }
-
-    a:hover {
-      text-shadow: 0 0 6px rgba(0, 229, 255, 0.4);
-    }
-
-    /* -- Alerts / messages --------------------------------------------------- */
-    .pf-v5-c-alert {
-      background: rgba(0, 255, 65, 0.05) !important;
-      border: 1px solid var(--hk-border) !important;
-      border-radius: 0 !important;
-      font-family: var(--hk-font) !important;
-    }
-
-    .pf-v5-c-alert.pf-m-danger {
-      border-color: var(--hk-red) !important;
-      background: rgba(255, 51, 51, 0.05) !important;
-    }
-
-    .pf-v5-c-alert__title {
-      color: var(--hk-text) !important;
-      font-family: var(--hk-font) !important;
-    }
-
-    /* -- Checkbox (Remember me) ---------------------------------------------- */
-    .pf-v5-c-check__label {
-      color: var(--hk-text-dim) !important;
-      font-family: var(--hk-font) !important;
-      font-size: 0.8rem !important;
-    }
-
-    /* -- Helper text (Forgot password, etc.) --------------------------------- */
-    .pf-v5-c-helper-text .pf-v5-c-button.pf-m-link {
-      color: var(--hk-cyan) !important;
-      font-family: var(--hk-font) !important;
-      font-size: 0.8rem !important;
-    }
-
-    /* -- Select auth list (Try another way options) -------------------------- */
-    .select-auth-container {
-      background: var(--hk-panel) !important;
-      font-family: var(--hk-font) !important;
-    }
-
-    .pf-v5-c-data-list__item {
-      border-color: var(--hk-border) !important;
-      background: transparent !important;
-    }
-
-    .pf-v5-c-data-list__item:hover {
-      background: var(--hk-green-glow) !important;
-    }
-
-    .select-auth-box-headline {
-      color: var(--hk-green) !important;
-    }
-
-    .select-auth-box-desc {
-      color: var(--hk-text-dim) !important;
-    }
-
-    /* -- Footer -------------------------------------------------------------- */
-    .pf-v5-c-login__main-footer-band {
-      background: transparent !important;
-      border-top: 1px solid var(--hk-border) !important;
-    }
-
-    /* -- Language selector --------------------------------------------------- */
-    select#login-select-toggle {
-      background: var(--hk-input-bg) !important;
-      color: var(--hk-green) !important;
-      border-color: var(--hk-border) !important;
-      font-family: var(--hk-font) !important;
-    }
-
-    /* -- Blinking cursor animation for header -------------------------------- */
-    @keyframes blink {
-      0%, 100% { opacity: 1; }
-      50% { opacity: 0; }
-    }
-
-    #kc-header-wrapper::after {
-      content: '_';
-      animation: blink 1s step-end infinite;
-      color: var(--hk-green);
-    }
-
-    /* -- Subtle CRT flicker ------------------------------------------------- */
-    @keyframes flicker {
-      0% { opacity: 0.97; }
-      5% { opacity: 0.95; }
-      10% { opacity: 0.98; }
-      15% { opacity: 0.96; }
-      20% { opacity: 0.99; }
-      100% { opacity: 0.98; }
-    }
-
-    .pf-v5-c-login__main {
-      animation: flicker 4s infinite;
-    }

k8s/core/keycloak/kustomization.yaml

@@ -4,7 +4,6 @@ kind: Kustomization
 resources:
   - app.yaml
   - external-secrets.yaml
-  - hacker-theme-configmap.yaml
 
 helmCharts:
   - name: keycloakx

k8s/core/keycloak/theme/login/css/hacker.css

@@ -1,353 +0,0 @@
-/* ============================================================
-   HEXOR — Hacker Terminal Theme for Keycloak
-   ============================================================ */
-
-@import url('https://fonts.googleapis.com/css2?family=Fira+Code:wght@400;600&display=swap');
-
-:root {
-  --hk-bg: #0a0a0a;
-  --hk-panel: #0d0d0d;
-  --hk-border: #00ff4180;
-  --hk-green: #00ff41;
-  --hk-green-dim: #00cc33;
-  --hk-green-glow: rgba(0, 255, 65, 0.15);
-  --hk-green-glow-strong: rgba(0, 255, 65, 0.35);
-  --hk-cyan: #00e5ff;
-  --hk-red: #ff3333;
-  --hk-text: #b0ffb0;
-  --hk-text-dim: #5a8a5a;
-  --hk-input-bg: #050505;
-  --hk-font: 'Fira Code', 'Cascadia Code', 'JetBrains Mono', monospace;
-}
-
-/* -- Force dark always --------------------------------------------------- */
-html.login-pf,
-html.login-pf.pf-v5-theme-dark {
-  color-scheme: dark;
-}
-
-/* -- Background: scanlines + CRT ---------------------------------------- */
-body#keycloak-bg {
-  font-family: var(--hk-font) !important;
-  background: var(--hk-bg) !important;
-  color: var(--hk-text) !important;
-  min-height: 100vh;
-  position: relative;
-}
-
-body#keycloak-bg::before {
-  content: '';
-  position: fixed;
-  inset: 0;
-  background: repeating-linear-gradient(
-    0deg,
-    transparent,
-    transparent 2px,
-    rgba(0, 255, 65, 0.03) 2px,
-    rgba(0, 255, 65, 0.03) 4px
-  );
-  pointer-events: none;
-  z-index: 9999;
-}
-
-/* -- Login container ----------------------------------------------------- */
-.pf-v5-c-login {
-  background: transparent !important;
-}
-
-.pf-v5-c-login__container {
-  max-width: 480px !important;
-}
-
-/* -- Header / Brand ------------------------------------------------------ */
-#kc-header-wrapper {
-  font-family: var(--hk-font) !important;
-  color: var(--hk-green) !important;
-  text-shadow: 0 0 10px var(--hk-green), 0 0 30px var(--hk-green-glow);
-  font-size: 1.5rem !important;
-  letter-spacing: 0.15em;
-  text-transform: uppercase;
-}
-
-#kc-header-wrapper .kc-logo-text span::before {
-  content: '> ';
-  opacity: 0.6;
-}
-
-/* -- Main card ----------------------------------------------------------- */
-.pf-v5-c-login__main {
-  background: var(--hk-panel) !important;
-  border: 1px solid var(--hk-border) !important;
-  border-radius: 0 !important;
-  box-shadow:
-    0 0 15px var(--hk-green-glow),
-    inset 0 0 30px rgba(0, 0, 0, 0.5) !important;
-}
-
-/* -- Title --------------------------------------------------------------- */
-h1#kc-page-title,
-.pf-v5-c-title {
-  font-family: var(--hk-font) !important;
-  color: var(--hk-green) !important;
-  text-shadow: 0 0 8px var(--hk-green-glow);
-  font-weight: 600 !important;
-  font-size: 1.25rem !important;
-  letter-spacing: 0.05em;
-}
-
-/* -- Labels -------------------------------------------------------------- */
-.pf-v5-c-form__label-text {
-  font-family: var(--hk-font) !important;
-  color: var(--hk-green-dim) !important;
-  font-size: 0.85rem !important;
-  text-transform: uppercase;
-  letter-spacing: 0.08em;
-}
-
-/* -- Input fields -------------------------------------------------------- */
-.pf-v5-c-form-control {
-  background-color: var(--hk-input-bg) !important;
-  border: 1px solid var(--hk-border) !important;
-  border-radius: 0 !important;
-  color: var(--hk-green) !important;
-  font-family: var(--hk-font) !important;
-  font-size: 0.9rem !important;
-  caret-color: var(--hk-green);
-  transition: border-color 0.2s, box-shadow 0.2s;
-}
-
-.pf-v5-c-form-control:focus-within,
-.pf-v5-c-form-control:focus {
-  border-color: var(--hk-green) !important;
-  box-shadow: 0 0 8px var(--hk-green-glow), inset 0 0 4px var(--hk-green-glow) !important;
-  outline: none !important;
-}
-
-.pf-v5-c-form-control input {
-  color: var(--hk-green) !important;
-  font-family: var(--hk-font) !important;
-}
-
-.pf-v5-c-form-control input::placeholder {
-  color: var(--hk-text-dim) !important;
-}
-
-/* -- Primary button (Sign In) -------------------------------------------- */
-.pf-v5-c-button.pf-m-primary {
-  background: transparent !important;
-  border: 1px solid var(--hk-green) !important;
-  border-radius: 0 !important;
-  color: var(--hk-green) !important;
-  font-family: var(--hk-font) !important;
-  font-weight: 600 !important;
-  text-transform: uppercase;
-  letter-spacing: 0.12em;
-  font-size: 0.9rem !important;
-  transition: all 0.2s;
-  position: relative;
-  overflow: hidden;
-}
-
-.pf-v5-c-button.pf-m-primary:hover {
-  background: var(--hk-green-glow) !important;
-  box-shadow: 0 0 15px var(--hk-green-glow-strong), inset 0 0 15px var(--hk-green-glow) !important;
-  color: #fff !important;
-  text-shadow: 0 0 5px var(--hk-green);
-}
-
-/* -- Secondary button (Try Another Way, Passkey) ------------------------- */
-.pf-v5-c-button.pf-m-secondary {
-  background: transparent !important;
-  border: 1px solid var(--hk-cyan) !important;
-  border-radius: 0 !important;
-  color: var(--hk-cyan) !important;
-  font-family: var(--hk-font) !important;
-  text-transform: uppercase;
-  letter-spacing: 0.1em;
-  font-size: 0.85rem !important;
-  transition: all 0.2s;
-}
-
-.pf-v5-c-button.pf-m-secondary:hover {
-  background: rgba(0, 229, 255, 0.1) !important;
-  box-shadow: 0 0 12px rgba(0, 229, 255, 0.3) !important;
-  color: #fff !important;
-}
-
-/* -- Passkey authenticate button ----------------------------------------- */
-#authenticateWebAuthnButton {
-  background: transparent !important;
-  border: 1px solid var(--hk-cyan) !important;
-  border-radius: 0 !important;
-  color: var(--hk-cyan) !important;
-  font-family: var(--hk-font) !important;
-  text-transform: uppercase;
-  letter-spacing: 0.1em;
-  font-size: 0.85rem !important;
-  padding: 0.75rem 1rem;
-  display: block;
-  width: 100%;
-  text-align: center;
-  text-decoration: none;
-  transition: all 0.2s;
-  margin-top: 1rem;
-}
-
-#authenticateWebAuthnButton::before {
-  content: '\f084  ';
-  font-family: 'Font Awesome 6 Free', 'FontAwesome';
-  font-weight: 900;
-}
-
-#authenticateWebAuthnButton:hover {
-  background: rgba(0, 229, 255, 0.1) !important;
-  box-shadow: 0 0 15px rgba(0, 229, 255, 0.3), inset 0 0 10px rgba(0, 229, 255, 0.1) !important;
-  color: #fff !important;
-  text-shadow: 0 0 5px var(--hk-cyan);
-}
-
-/* -- Show password button ------------------------------------------------ */
-.pf-v5-c-button.pf-m-control {
-  background: var(--hk-input-bg) !important;
-  border: 1px solid var(--hk-border) !important;
-  border-left: none !important;
-  border-radius: 0 !important;
-  color: var(--hk-text-dim) !important;
-}
-
-.pf-v5-c-button.pf-m-control:hover {
-  color: var(--hk-green) !important;
-}
-
-/* -- Social providers (Google, etc) -------------------------------------- */
-.pf-v5-c-login__main-footer {
-  border-top: 1px solid var(--hk-border) !important;
-}
-
-.kc-social-section .pf-v5-c-button.pf-m-secondary {
-  border-color: var(--hk-text-dim) !important;
-  color: var(--hk-text) !important;
-}
-
-.kc-social-section .pf-v5-c-button.pf-m-secondary:hover {
-  border-color: var(--hk-green) !important;
-  color: var(--hk-green) !important;
-  box-shadow: 0 0 10px var(--hk-green-glow) !important;
-}
-
-/* -- Try another way link ------------------------------------------------ */
-#try-another-way {
-  color: var(--hk-cyan) !important;
-  text-decoration: none !important;
-  font-family: var(--hk-font) !important;
-}
-
-#try-another-way:hover {
-  text-shadow: 0 0 8px rgba(0, 229, 255, 0.5);
-}
-
-/* -- Links --------------------------------------------------------------- */
-a {
-  color: var(--hk-cyan) !important;
-  text-decoration: none;
-  transition: text-shadow 0.2s;
-}
-
-a:hover {
-  text-shadow: 0 0 6px rgba(0, 229, 255, 0.4);
-}
-
-/* -- Alerts / messages --------------------------------------------------- */
-.pf-v5-c-alert {
-  background: rgba(0, 255, 65, 0.05) !important;
-  border: 1px solid var(--hk-border) !important;
-  border-radius: 0 !important;
-  font-family: var(--hk-font) !important;
-}
-
-.pf-v5-c-alert.pf-m-danger {
-  border-color: var(--hk-red) !important;
-  background: rgba(255, 51, 51, 0.05) !important;
-}
-
-.pf-v5-c-alert__title {
-  color: var(--hk-text) !important;
-  font-family: var(--hk-font) !important;
-}
-
-/* -- Checkbox (Remember me) ---------------------------------------------- */
-.pf-v5-c-check__label {
-  color: var(--hk-text-dim) !important;
-  font-family: var(--hk-font) !important;
-  font-size: 0.8rem !important;
-}
-
-/* -- Helper text (Forgot password, etc.) --------------------------------- */
-.pf-v5-c-helper-text .pf-v5-c-button.pf-m-link {
-  color: var(--hk-cyan) !important;
-  font-family: var(--hk-font) !important;
-  font-size: 0.8rem !important;
-}
-
-/* -- Select auth list (Try another way options) -------------------------- */
-.select-auth-container {
-  background: var(--hk-panel) !important;
-  font-family: var(--hk-font) !important;
-}
-
-.pf-v5-c-data-list__item {
-  border-color: var(--hk-border) !important;
-  background: transparent !important;
-}
-
-.pf-v5-c-data-list__item:hover {
-  background: var(--hk-green-glow) !important;
-}
-
-.select-auth-box-headline {
-  color: var(--hk-green) !important;
-}
-
-.select-auth-box-desc {
-  color: var(--hk-text-dim) !important;
-}
-
-/* -- Footer -------------------------------------------------------------- */
-.pf-v5-c-login__main-footer-band {
-  background: transparent !important;
-  border-top: 1px solid var(--hk-border) !important;
-}
-
-/* -- Language selector --------------------------------------------------- */
-select#login-select-toggle {
-  background: var(--hk-input-bg) !important;
-  color: var(--hk-green) !important;
-  border-color: var(--hk-border) !important;
-  font-family: var(--hk-font) !important;
-}
-
-/* -- Blinking cursor animation for header -------------------------------- */
-@keyframes blink {
-  0%, 100% { opacity: 1; }
-  50% { opacity: 0; }
-}
-
-#kc-header-wrapper::after {
-  content: '_';
-  animation: blink 1s step-end infinite;
-  color: var(--hk-green);
-}
-
-/* -- Subtle CRT flicker ------------------------------------------------- */
-@keyframes flicker {
-  0% { opacity: 0.97; }
-  5% { opacity: 0.95; }
-  10% { opacity: 0.98; }
-  15% { opacity: 0.96; }
-  20% { opacity: 0.99; }
-  100% { opacity: 0.98; }
-}
-
-.pf-v5-c-login__main {
-  animation: flicker 4s infinite;
-}

k8s/core/keycloak/theme/login/theme.properties

@@ -1,4 +0,0 @@
-parent=keycloak.v2
-import=common/keycloak
-
-styles=css/hacker.css

k8s/core/keycloak/values.yaml

@@ -21,19 +21,6 @@ extraEnv: |
   - name: JAVA_OPTS_APPEND
     value: "-Djgroups.dns.query=keycloak-headless.keycloak.svc"
 
-extraVolumes: |
-  - name: hacker-theme
-    configMap:
-      name: keycloak-hacker-theme
-
-extraVolumeMounts: |
-  - name: hacker-theme
-    mountPath: /opt/keycloak/themes/hacker/login/theme.properties
-    subPath: theme.properties
-  - name: hacker-theme
-    mountPath: /opt/keycloak/themes/hacker/login/css/hacker.css
-    subPath: hacker.css
-
 dbchecker:
   enabled: true
 

k8s/core/kube-system-custom/https-middleware.yaml

@@ -1,10 +0,0 @@
----
-apiVersion: traefik.io/v1alpha1
-kind: Middleware
-metadata:
-  name: https-redirect
-  namespace: kube-system
-spec:
-  redirectScheme:
-    scheme: https
-    permanent: true

k8s/core/kube-system-custom/kustomization.yaml

@@ -5,7 +5,6 @@ resources:
   - app.yaml
   - nfs-storage.yaml
   - coredns-internal-resolve.yaml
-  - https-middleware.yaml
 
 helmCharts:
   - name: csi-driver-nfs

k8s/core/postgresql/external-secrets.yaml

@@ -17,23 +17,20 @@ spec:
         PGADMIN_CONFIG_OAUTH2_CONFIG: |-
           [
             {
-                'OAUTH2_NAME': 'Keycloak',
-                'OAUTH2_DISPLAY_NAME': 'Keycloak',
-                'OAUTH2_CLIENT_ID': '{{ .client_id }}',
-                'OAUTH2_CLIENT_SECRET': '{{ .client_secret }}',
-                
-                'OAUTH2_TOKEN_URL': '{{ .keycloak_url }}/auth/realms/hexor/protocol/openid-connect/token',
-                'OAUTH2_AUTHORIZATION_URL': '{{ .keycloak_url }}/auth/realms/hexor/protocol/openid-connect/auth',
-                'OAUTH2_SERVER_METADATA_URL': '{{ .keycloak_url }}/auth/realms/hexor/.well-known/openid-configuration',
-                'OAUTH2_API_BASE_URL': '{{ .keycloak_url }}',
-                'OAUTH2_USERINFO_ENDPOINT': '{{ .keycloak_url }}/auth/realms/hexor/protocol/openid-connect/userinfo',
-                
-                'OAUTH2_SCOPE': 'openid profile email',
-                'OAUTH2_USERNAME_CLAIM': 'email',
-                'OAUTH2_BUTTON_COLOR': '#000000',
-                'OAUTH2_SSL_CERT_VERIFICATION': False,
-                
-                'OAUTH2_LOGOUT_URL': '{{ .keycloak_url }}/auth/realms/hexor/protocol/openid-connect/logout',
+              'OAUTH2_NAME': 'Authentik',
+              'OAUTH2_DISPLAY_NAME': 'Authentik',
+              'OAUTH2_CLIENT_ID': '{{ .client_id }}',
+              'OAUTH2_CLIENT_SECRET': '{{ .client_secret }}',
+              'OAUTH2_TOKEN_URL': '{{ .pgadmin_url }}/application/o/token/',
+              'OAUTH2_AUTHORIZATION_URL': '{{ .pgadmin_url }}/application/o/authorize/',
+              'OAUTH2_SERVER_METADATA_URL': '{{ .pgadmin_url }}/application/o/pgadmin/.well-known/openid-configuration',
+              'OAUTH2_API_BASE_URL': '{{ .pgadmin_url }}',
+              'OAUTH2_USERINFO_ENDPOINT': '{{ .pgadmin_url }}/application/o/userinfo/',
+              'OAUTH2_SCOPE': 'openid profile email',
+              'OAUTH2_USERNAME_CLAIM': 'email',
+              'OAUTH2_BUTTON_COLOR': '#000000',
+              'OAUTH2_SSL_CERT_VERIFICATION': False,
+              'OAUTH2_LOGOUT_URL': '{{ .pgadmin_url }}/application/o/pgadmin/end-session/'
             }
           ]
   data:
@@ -81,7 +78,7 @@ spec:
         metadataPolicy: None
         key: 832042b9-7edb-4f4c-9254-3c8884ba9733
         property: fields[1].value
-    - secretKey: keycloak_url
+    - secretKey: pgadmin_url
       sourceRef:
         storeRef:
           name: vaultwarden-login

k8s/core/prom-stack/dashboards/furumi-dashboard-cm.yaml

@@ -1,491 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: furumi-dashboard
-  labels:
-    grafana_dashboard: "1"
-data:
-  furumi.json: |-
-    {
-      "annotations": {
-        "list": [
-          {
-            "builtIn": 1,
-            "datasource": { "type": "grafana", "uid": "-- Grafana --" },
-            "enable": true,
-            "hide": true,
-            "iconColor": "rgba(0, 211, 255, 1)",
-            "name": "Annotations & Alerts",
-            "type": "dashboard"
-          }
-        ]
-      },
-      "editable": true,
-      "fiscalYearStartMonth": 0,
-      "graphTooltip": 1,
-      "id": null,
-      "links": [],
-      "liveNow": false,
-      "panels": [
-        {
-          "id": 1,
-          "title": "Build Version",
-          "type": "stat",
-          "gridPos": { "h": 4, "w": 4, "x": 0, "y": 0 },
-          "targets": [
-            {
-              "datasource": { "type": "prometheus", "uid": "${datasource}" },
-              "expr": "max by (version) (furumusic_build_info{namespace=~\"$namespace\"})",
-              "legendFormat": "{{version}}",
-              "refId": "A"
-            }
-          ],
-          "options": { "colorMode": "none", "graphMode": "none", "justifyMode": "auto", "orientation": "auto", "reduceOptions": { "calc": "lastNotNull", "fields": "", "values": false }, "textMode": "name" }
-        },
-        {
-          "id": 2,
-          "title": "HTTP RPS",
-          "type": "stat",
-          "gridPos": { "h": 4, "w": 4, "x": 4, "y": 0 },
-          "fieldConfig": { "defaults": { "unit": "reqps", "decimals": 2 }, "overrides": [] },
-          "targets": [
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum(rate(furumusic_http_requests_total{namespace=~\"$namespace\"}[$__rate_interval]))", "refId": "A" }
-          ],
-          "options": { "colorMode": "value", "graphMode": "area", "justifyMode": "auto", "orientation": "auto", "reduceOptions": { "calc": "lastNotNull", "fields": "", "values": false }, "textMode": "auto" }
-        },
-        {
-          "id": 3,
-          "title": "5xx Error Ratio",
-          "type": "stat",
-          "gridPos": { "h": 4, "w": 4, "x": 8, "y": 0 },
-          "fieldConfig": { "defaults": { "unit": "percentunit", "decimals": 2, "thresholds": { "mode": "absolute", "steps": [ { "color": "green", "value": null }, { "color": "yellow", "value": 0.01 }, { "color": "red", "value": 0.05 } ] } }, "overrides": [] },
-          "targets": [
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum(rate(furumusic_http_requests_total{namespace=~\"$namespace\",status=~\"5..\"}[$__rate_interval])) / clamp_min(sum(rate(furumusic_http_requests_total{namespace=~\"$namespace\"}[$__rate_interval])), 0.001)", "refId": "A" }
-          ],
-          "options": { "colorMode": "value", "graphMode": "area", "justifyMode": "auto", "orientation": "auto", "reduceOptions": { "calc": "lastNotNull", "fields": "", "values": false }, "textMode": "auto" }
-        },
-        {
-          "id": 4,
-          "title": "HTTP p95 Latency",
-          "type": "stat",
-          "gridPos": { "h": 4, "w": 4, "x": 12, "y": 0 },
-          "fieldConfig": { "defaults": { "unit": "s", "decimals": 3 }, "overrides": [] },
-          "targets": [
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "histogram_quantile(0.95, sum by (le) (rate(furumusic_http_request_duration_seconds_bucket{namespace=~\"$namespace\"}[$__rate_interval])))", "refId": "A" }
-          ],
-          "options": { "colorMode": "value", "graphMode": "area", "justifyMode": "auto", "orientation": "auto", "reduceOptions": { "calc": "lastNotNull", "fields": "", "values": false }, "textMode": "auto" }
-        },
-        {
-          "id": 5,
-          "title": "Active Users 15m",
-          "type": "stat",
-          "gridPos": { "h": 4, "w": 4, "x": 16, "y": 0 },
-          "fieldConfig": { "defaults": { "unit": "short", "decimals": 0 }, "overrides": [] },
-          "targets": [
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum(furumusic_active_users{namespace=~\"$namespace\",window=\"15m\"})", "refId": "A" }
-          ],
-          "options": { "colorMode": "value", "graphMode": "area", "justifyMode": "auto", "orientation": "auto", "reduceOptions": { "calc": "lastNotNull", "fields": "", "values": false }, "textMode": "auto" }
-        },
-        {
-          "id": 6,
-          "title": "Stream Throughput",
-          "type": "stat",
-          "gridPos": { "h": 4, "w": 4, "x": 20, "y": 0 },
-          "fieldConfig": { "defaults": { "unit": "Bps", "decimals": 1 }, "overrides": [] },
-          "targets": [
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum(rate(furumusic_stream_bytes_total{namespace=~\"$namespace\"}[$__rate_interval]))", "refId": "A" }
-          ],
-          "options": { "colorMode": "value", "graphMode": "area", "justifyMode": "auto", "orientation": "auto", "reduceOptions": { "calc": "lastNotNull", "fields": "", "values": false }, "textMode": "auto" }
-        },
-        { "id": 10, "title": "HTTP", "type": "row", "gridPos": { "h": 1, "w": 24, "x": 0, "y": 4 }, "collapsed": false, "panels": [] },
-        {
-          "id": 11,
-          "title": "Request Rate by Route and Status",
-          "type": "timeseries",
-          "gridPos": { "h": 8, "w": 12, "x": 0, "y": 5 },
-          "fieldConfig": { "defaults": { "unit": "reqps" }, "overrides": [] },
-          "targets": [
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum by (route, status) (rate(furumusic_http_requests_total{namespace=~\"$namespace\",route=~\"$route\"}[$__rate_interval]))", "legendFormat": "{{route}} {{status}}", "refId": "A" }
-          ],
-          "options": { "legend": { "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "mode": "multi", "sort": "desc" } }
-        },
-        {
-          "id": 12,
-          "title": "Request Duration Quantiles",
-          "type": "timeseries",
-          "gridPos": { "h": 8, "w": 12, "x": 12, "y": 5 },
-          "fieldConfig": { "defaults": { "unit": "s", "decimals": 3 }, "overrides": [] },
-          "targets": [
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "histogram_quantile(0.50, sum by (le) (rate(furumusic_http_request_duration_seconds_bucket{namespace=~\"$namespace\",route=~\"$route\"}[$__rate_interval])))", "legendFormat": "p50", "refId": "A" },
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "histogram_quantile(0.95, sum by (le) (rate(furumusic_http_request_duration_seconds_bucket{namespace=~\"$namespace\",route=~\"$route\"}[$__rate_interval])))", "legendFormat": "p95", "refId": "B" },
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "histogram_quantile(0.99, sum by (le) (rate(furumusic_http_request_duration_seconds_bucket{namespace=~\"$namespace\",route=~\"$route\"}[$__rate_interval])))", "legendFormat": "p99", "refId": "C" }
-          ],
-          "options": { "legend": { "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "mode": "multi", "sort": "desc" } }
-        },
-        {
-          "id": 13,
-          "title": "In-flight Requests",
-          "type": "timeseries",
-          "gridPos": { "h": 7, "w": 8, "x": 0, "y": 13 },
-          "fieldConfig": { "defaults": { "unit": "short" }, "overrides": [] },
-          "targets": [
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum by (route) (furumusic_http_in_flight_requests{namespace=~\"$namespace\",route=~\"$route\"})", "legendFormat": "{{route}}", "refId": "A" }
-          ],
-          "options": { "legend": { "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "mode": "multi", "sort": "desc" } }
-        },
-        {
-          "id": 14,
-          "title": "HTTP Body Throughput",
-          "type": "timeseries",
-          "gridPos": { "h": 7, "w": 8, "x": 8, "y": 13 },
-          "fieldConfig": { "defaults": { "unit": "Bps" }, "overrides": [] },
-          "targets": [
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum(rate(furumusic_http_request_body_bytes_total{namespace=~\"$namespace\",route=~\"$route\"}[$__rate_interval]))", "legendFormat": "request", "refId": "A" },
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum(rate(furumusic_http_response_body_bytes_total{namespace=~\"$namespace\",route=~\"$route\"}[$__rate_interval]))", "legendFormat": "response", "refId": "B" }
-          ],
-          "options": { "legend": { "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "mode": "multi", "sort": "desc" } }
-        },
-        {
-          "id": 15,
-          "title": "Status Code Mix",
-          "type": "timeseries",
-          "gridPos": { "h": 7, "w": 8, "x": 16, "y": 13 },
-          "fieldConfig": { "defaults": { "unit": "reqps" }, "overrides": [] },
-          "targets": [
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum by (status) (rate(furumusic_http_requests_total{namespace=~\"$namespace\"}[$__rate_interval]))", "legendFormat": "{{status}}", "refId": "A" }
-          ],
-          "options": { "legend": { "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "mode": "multi", "sort": "desc" } }
-        },
-        { "id": 20, "title": "Auth and Users", "type": "row", "gridPos": { "h": 1, "w": 24, "x": 0, "y": 20 }, "collapsed": false, "panels": [] },
-        {
-          "id": 21,
-          "title": "Users by Role",
-          "type": "bargauge",
-          "gridPos": { "h": 7, "w": 8, "x": 0, "y": 21 },
-          "fieldConfig": { "defaults": { "unit": "short", "decimals": 0 }, "overrides": [] },
-          "targets": [
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum by (role) (furumusic_users_total{namespace=~\"$namespace\"})", "legendFormat": "{{role}}", "refId": "A" }
-          ],
-          "options": { "displayMode": "gradient", "orientation": "horizontal", "reduceOptions": { "calc": "lastNotNull", "fields": "", "values": false }, "showUnfilled": true }
-        },
-        {
-          "id": 22,
-          "title": "Active Users",
-          "type": "timeseries",
-          "gridPos": { "h": 7, "w": 8, "x": 8, "y": 21 },
-          "fieldConfig": { "defaults": { "unit": "short", "decimals": 0 }, "overrides": [] },
-          "targets": [
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum by (window) (furumusic_active_users{namespace=~\"$namespace\"})", "legendFormat": "{{window}}", "refId": "A" }
-          ],
-          "options": { "legend": { "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "mode": "multi", "sort": "desc" } }
-        },
-        {
-          "id": 23,
-          "title": "Auth Events",
-          "type": "timeseries",
-          "gridPos": { "h": 7, "w": 8, "x": 16, "y": 21 },
-          "fieldConfig": { "defaults": { "unit": "ops" }, "overrides": [] },
-          "targets": [
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum by (method, outcome, reason) (rate(furumusic_auth_login_attempts_total{namespace=~\"$namespace\"}[$__rate_interval]))", "legendFormat": "login {{method}} {{outcome}} {{reason}}", "refId": "A" },
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum by (method) (rate(furumusic_auth_sessions_created_total{namespace=~\"$namespace\"}[$__rate_interval]))", "legendFormat": "session {{method}}", "refId": "B" },
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum by (kind) (rate(furumusic_auth_denied_total{namespace=~\"$namespace\"}[$__rate_interval]))", "legendFormat": "denied {{kind}}", "refId": "C" }
-          ],
-          "options": { "legend": { "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "mode": "multi", "sort": "desc" } }
-        },
-        { "id": 30, "title": "Playback and Streaming", "type": "row", "gridPos": { "h": 1, "w": 24, "x": 0, "y": 28 }, "collapsed": false, "panels": [] },
-        {
-          "id": 31,
-          "title": "Listens Rate",
-          "type": "timeseries",
-          "gridPos": { "h": 7, "w": 8, "x": 0, "y": 29 },
-          "fieldConfig": { "defaults": { "unit": "ops" }, "overrides": [] },
-          "targets": [
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum by (completed) (rate(furumusic_listens_total{namespace=~\"$namespace\"}[$__rate_interval]))", "legendFormat": "completed={{completed}}", "refId": "A" }
-          ],
-          "options": { "legend": { "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "mode": "multi", "sort": "desc" } }
-        },
-        {
-          "id": 32,
-          "title": "Listen Quality",
-          "type": "timeseries",
-          "gridPos": { "h": 7, "w": 8, "x": 8, "y": 29 },
-          "fieldConfig": { "defaults": { "unit": "percentunit", "decimals": 2 }, "overrides": [] },
-          "targets": [
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum(rate(furumusic_listens_total{namespace=~\"$namespace\",completed=\"true\"}[$__rate_interval])) / clamp_min(sum(rate(furumusic_listens_total{namespace=~\"$namespace\"}[$__rate_interval])), 0.001)", "legendFormat": "completion ratio", "refId": "A" }
-          ],
-          "options": { "legend": { "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "mode": "multi", "sort": "desc" } }
-        },
-        {
-          "id": 33,
-          "title": "Streaming",
-          "type": "timeseries",
-          "gridPos": { "h": 7, "w": 8, "x": 16, "y": 29 },
-          "fieldConfig": { "defaults": { "unit": "Bps" }, "overrides": [] },
-          "targets": [
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum(rate(furumusic_stream_bytes_total{namespace=~\"$namespace\"}[$__rate_interval]))", "legendFormat": "bytes", "refId": "A" },
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum by (range) (rate(furumusic_stream_requests_total{namespace=~\"$namespace\"}[$__rate_interval]))", "legendFormat": "requests range={{range}}", "refId": "B" }
-          ],
-          "options": { "legend": { "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "mode": "multi", "sort": "desc" } }
-        },
-        {
-          "id": 34,
-          "title": "Listened Hours and History",
-          "type": "timeseries",
-          "gridPos": { "h": 7, "w": 12, "x": 0, "y": 36 },
-          "fieldConfig": { "defaults": { "unit": "short" }, "overrides": [] },
-          "targets": [
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum(increase(furumusic_listened_seconds_total{namespace=~\"$namespace\"}[$__range])) / 3600", "legendFormat": "listened hours in range", "refId": "A" },
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum(furumusic_play_history_total{namespace=~\"$namespace\"})", "legendFormat": "history rows", "refId": "B" }
-          ],
-          "options": { "legend": { "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "mode": "multi", "sort": "desc" } }
-        },
-        { "id": 40, "title": "Library and Storage", "type": "row", "gridPos": { "h": 1, "w": 24, "x": 0, "y": 43 }, "collapsed": false, "panels": [] },
-        {
-          "id": 41,
-          "title": "Library Inventory",
-          "type": "timeseries",
-          "gridPos": { "h": 7, "w": 8, "x": 0, "y": 44 },
-          "fieldConfig": { "defaults": { "unit": "short", "decimals": 0 }, "overrides": [] },
-          "targets": [
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum(furumusic_library_tracks_total{namespace=~\"$namespace\"})", "legendFormat": "tracks", "refId": "A" },
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum(furumusic_library_releases_total{namespace=~\"$namespace\"})", "legendFormat": "releases", "refId": "B" },
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum(furumusic_library_artists_total{namespace=~\"$namespace\"})", "legendFormat": "artists", "refId": "C" },
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum(furumusic_library_playlists_total{namespace=~\"$namespace\"})", "legendFormat": "playlists", "refId": "D" }
-          ],
-          "options": { "legend": { "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "mode": "multi", "sort": "desc" } }
-        },
-        {
-          "id": 42,
-          "title": "Media Files and Bytes by Type",
-          "type": "timeseries",
-          "gridPos": { "h": 7, "w": 8, "x": 8, "y": 44 },
-          "fieldConfig": { "defaults": { "unit": "short" }, "overrides": [] },
-          "targets": [
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum by (type) (furumusic_media_files_total{namespace=~\"$namespace\"})", "legendFormat": "files {{type}}", "refId": "A" },
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum by (type) (furumusic_media_file_bytes_total{namespace=~\"$namespace\"})", "legendFormat": "bytes {{type}}", "refId": "B" }
-          ],
-          "options": { "legend": { "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "mode": "multi", "sort": "desc" } }
-        },
-        {
-          "id": 43,
-          "title": "Storage Used Ratio",
-          "type": "timeseries",
-          "gridPos": { "h": 7, "w": 8, "x": 16, "y": 44 },
-          "fieldConfig": { "defaults": { "unit": "percentunit", "decimals": 2, "min": 0, "max": 1 }, "overrides": [] },
-          "targets": [
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "1 - (sum by (path_kind) (furumusic_storage_free_bytes{namespace=~\"$namespace\"}) / sum by (path_kind) (furumusic_storage_total_bytes{namespace=~\"$namespace\"}))", "legendFormat": "{{path_kind}}", "refId": "A" }
-          ],
-          "options": { "legend": { "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "mode": "multi", "sort": "desc" } }
-        },
-        { "id": 50, "title": "AI Agent", "type": "row", "gridPos": { "h": 1, "w": 24, "x": 0, "y": 51 }, "collapsed": false, "panels": [] },
-        {
-          "id": 51,
-          "title": "Agent Queue and Reviews",
-          "type": "timeseries",
-          "gridPos": { "h": 7, "w": 8, "x": 0, "y": 52 },
-          "fieldConfig": { "defaults": { "unit": "short", "decimals": 0 }, "overrides": [] },
-          "targets": [
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum by (status) (furumusic_agent_queue_depth{namespace=~\"$namespace\"})", "legendFormat": "queue {{status}}", "refId": "A" },
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum by (status) (furumusic_agent_reviews_total{namespace=~\"$namespace\"})", "legendFormat": "reviews {{status}}", "refId": "B" }
-          ],
-          "options": { "legend": { "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "mode": "multi", "sort": "desc" } }
-        },
-        {
-          "id": 52,
-          "title": "Agent Processing and Failures",
-          "type": "timeseries",
-          "gridPos": { "h": 7, "w": 8, "x": 8, "y": 52 },
-          "fieldConfig": { "defaults": { "unit": "ops" }, "overrides": [] },
-          "targets": [
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum by (outcome, decision) (rate(furumusic_agent_files_processed_total{namespace=~\"$namespace\"}[$__rate_interval]))", "legendFormat": "processed {{outcome}} {{decision}}", "refId": "A" },
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum by (stage) (rate(furumusic_agent_failed_total{namespace=~\"$namespace\"}[$__rate_interval]))", "legendFormat": "failed {{stage}}", "refId": "B" }
-          ],
-          "options": { "legend": { "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "mode": "multi", "sort": "desc" } }
-        },
-        {
-          "id": 53,
-          "title": "Agent Confidence",
-          "type": "timeseries",
-          "gridPos": { "h": 7, "w": 8, "x": 16, "y": 52 },
-          "fieldConfig": { "defaults": { "unit": "percentunit", "decimals": 2, "min": 0, "max": 1 }, "overrides": [] },
-          "targets": [
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "histogram_quantile(0.50, sum by (le) (rate(furumusic_agent_confidence_bucket{namespace=~\"$namespace\"}[$__rate_interval])))", "legendFormat": "p50", "refId": "A" },
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "histogram_quantile(0.95, sum by (le) (rate(furumusic_agent_confidence_bucket{namespace=~\"$namespace\"}[$__rate_interval])))", "legendFormat": "p95", "refId": "B" }
-          ],
-          "options": { "legend": { "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "mode": "multi", "sort": "desc" } }
-        },
-        {
-          "id": 54,
-          "title": "Discover Runs and Duration",
-          "type": "timeseries",
-          "gridPos": { "h": 7, "w": 12, "x": 0, "y": 59 },
-          "fieldConfig": { "defaults": { "unit": "ops" }, "overrides": [] },
-          "targets": [
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum by (outcome) (rate(furumusic_agent_discover_runs_total{namespace=~\"$namespace\"}[$__rate_interval]))", "legendFormat": "runs {{outcome}}", "refId": "A" },
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "histogram_quantile(0.95, sum by (le, outcome) (rate(furumusic_agent_discover_duration_seconds_bucket{namespace=~\"$namespace\"}[$__rate_interval])))", "legendFormat": "p95 {{outcome}}", "refId": "B" }
-          ],
-          "options": { "legend": { "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "mode": "multi", "sort": "desc" } }
-        },
-        {
-          "id": 55,
-          "title": "Discover File Flow",
-          "type": "timeseries",
-          "gridPos": { "h": 7, "w": 12, "x": 12, "y": 59 },
-          "fieldConfig": { "defaults": { "unit": "ops" }, "overrides": [] },
-          "targets": [
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum(rate(furumusic_agent_discover_files_seen_total{namespace=~\"$namespace\"}[$__rate_interval]))", "legendFormat": "seen", "refId": "A" },
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum(rate(furumusic_agent_discover_files_queued_total{namespace=~\"$namespace\"}[$__rate_interval]))", "legendFormat": "queued", "refId": "B" },
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum by (reason) (rate(furumusic_agent_discover_files_skipped_total{namespace=~\"$namespace\"}[$__rate_interval]))", "legendFormat": "skipped {{reason}}", "refId": "C" }
-          ],
-          "options": { "legend": { "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "mode": "multi", "sort": "desc" } }
-        },
-        {
-          "id": 56,
-          "title": "RAG and LLM Requests",
-          "type": "timeseries",
-          "gridPos": { "h": 7, "w": 8, "x": 0, "y": 66 },
-          "fieldConfig": { "defaults": { "unit": "ops" }, "overrides": [] },
-          "targets": [
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum by (kind, outcome) (rate(furumusic_agent_rag_queries_total{namespace=~\"$namespace\"}[$__rate_interval]))", "legendFormat": "rag {{kind}} {{outcome}}", "refId": "A" },
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum by (model, outcome) (rate(furumusic_agent_llm_requests_total{namespace=~\"$namespace\"}[$__rate_interval]))", "legendFormat": "llm {{model}} {{outcome}}", "refId": "B" }
-          ],
-          "options": { "legend": { "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "mode": "multi", "sort": "desc" } }
-        },
-        {
-          "id": 57,
-          "title": "RAG and LLM Latency p95",
-          "type": "timeseries",
-          "gridPos": { "h": 7, "w": 8, "x": 8, "y": 66 },
-          "fieldConfig": { "defaults": { "unit": "s", "decimals": 2 }, "overrides": [] },
-          "targets": [
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "histogram_quantile(0.95, sum by (le, kind, outcome) (rate(furumusic_agent_rag_duration_seconds_bucket{namespace=~\"$namespace\"}[$__rate_interval])))", "legendFormat": "rag {{kind}} {{outcome}}", "refId": "A" },
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "histogram_quantile(0.95, sum by (le, model, outcome) (rate(furumusic_agent_llm_duration_seconds_bucket{namespace=~\"$namespace\"}[$__rate_interval])))", "legendFormat": "llm {{model}} {{outcome}}", "refId": "B" }
-          ],
-          "options": { "legend": { "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "mode": "multi", "sort": "desc" } }
-        },
-        {
-          "id": 58,
-          "title": "LLM Tokens and Batch Pressure",
-          "type": "timeseries",
-          "gridPos": { "h": 7, "w": 8, "x": 16, "y": 66 },
-          "fieldConfig": { "defaults": { "unit": "ops" }, "overrides": [] },
-          "targets": [
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum by (model, type) (rate(furumusic_agent_llm_tokens_total{namespace=~\"$namespace\"}[$__rate_interval]))", "legendFormat": "tokens {{model}} {{type}}", "refId": "A" },
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum by (reason) (rate(furumusic_agent_llm_batch_splits_total{namespace=~\"$namespace\"}[$__rate_interval]))", "legendFormat": "splits {{reason}}", "refId": "B" },
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum by (model) (rate(furumusic_agent_llm_parse_failures_total{namespace=~\"$namespace\"}[$__rate_interval]))", "legendFormat": "parse failures {{model}}", "refId": "C" }
-          ],
-          "options": { "legend": { "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "mode": "multi", "sort": "desc" } }
-        },
-        {
-          "id": 59,
-          "title": "Cover Pipeline",
-          "type": "timeseries",
-          "gridPos": { "h": 7, "w": 12, "x": 0, "y": 73 },
-          "fieldConfig": { "defaults": { "unit": "ops" }, "overrides": [] },
-          "targets": [
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum by (source, outcome) (rate(furumusic_agent_cover_lookup_total{namespace=~\"$namespace\"}[$__rate_interval]))", "legendFormat": "lookup {{source}} {{outcome}}", "refId": "A" },
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum by (variant, outcome) (rate(furumusic_agent_cover_variant_generation_total{namespace=~\"$namespace\"}[$__rate_interval]))", "legendFormat": "variant {{variant}} {{outcome}}", "refId": "B" }
-          ],
-          "options": { "legend": { "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "mode": "multi", "sort": "desc" } }
-        },
-        { "id": 70, "title": "Scheduler and Torrents", "type": "row", "gridPos": { "h": 1, "w": 24, "x": 0, "y": 80 }, "collapsed": false, "panels": [] },
-        {
-          "id": 71,
-          "title": "Scheduler Jobs",
-          "type": "timeseries",
-          "gridPos": { "h": 7, "w": 8, "x": 0, "y": 81 },
-          "fieldConfig": { "defaults": { "unit": "short" }, "overrides": [] },
-          "targets": [
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum by (job) (furumusic_scheduler_job_running{namespace=~\"$namespace\"})", "legendFormat": "running {{job}}", "refId": "A" },
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum by (job) (furumusic_scheduler_job_enabled{namespace=~\"$namespace\"})", "legendFormat": "enabled {{job}}", "refId": "B" }
-          ],
-          "options": { "legend": { "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "mode": "multi", "sort": "desc" } }
-        },
-        {
-          "id": 72,
-          "title": "Scheduler Runs and Duration p95",
-          "type": "timeseries",
-          "gridPos": { "h": 7, "w": 8, "x": 8, "y": 81 },
-          "fieldConfig": { "defaults": { "unit": "ops" }, "overrides": [] },
-          "targets": [
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum by (job, trigger, outcome) (rate(furumusic_scheduler_job_runs_total{namespace=~\"$namespace\"}[$__rate_interval]))", "legendFormat": "{{job}} {{trigger}} {{outcome}}", "refId": "A" },
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "histogram_quantile(0.95, sum by (le, job, trigger, outcome) (rate(furumusic_scheduler_job_duration_seconds_bucket{namespace=~\"$namespace\"}[$__rate_interval])))", "legendFormat": "p95 {{job}} {{outcome}}", "refId": "B" }
-          ],
-          "options": { "legend": { "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "mode": "multi", "sort": "desc" } }
-        },
-        {
-          "id": 73,
-          "title": "Torrents",
-          "type": "timeseries",
-          "gridPos": { "h": 7, "w": 8, "x": 16, "y": 81 },
-          "fieldConfig": { "defaults": { "unit": "short" }, "overrides": [] },
-          "targets": [
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum by (status) (furumusic_torrent_sessions_total{namespace=~\"$namespace\"})", "legendFormat": "sessions {{status}}", "refId": "A" },
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum by (outcome) (rate(furumusic_torrent_downloads_total{namespace=~\"$namespace\"}[$__rate_interval]))", "legendFormat": "downloads {{outcome}}", "refId": "B" },
-            { "datasource": { "type": "prometheus", "uid": "${datasource}" }, "expr": "sum by (outcome) (rate(furumusic_torrent_selected_bytes_total{namespace=~\"$namespace\"}[$__rate_interval]))", "legendFormat": "bytes {{outcome}}", "refId": "C" }
-          ],
-          "options": { "legend": { "displayMode": "list", "placement": "bottom", "showLegend": true }, "tooltip": { "mode": "multi", "sort": "desc" } }
-        }
-      ],
-      "refresh": "30s",
-      "schemaVersion": 38,
-      "style": "dark",
-      "tags": [ "furumi", "furumusic", "music" ],
-      "templating": {
-        "list": [
-          {
-            "current": { "selected": false, "text": "Prometheus", "value": "Prometheus" },
-            "hide": 0,
-            "includeAll": false,
-            "multi": false,
-            "name": "datasource",
-            "options": [],
-            "query": "prometheus",
-            "refresh": 1,
-            "regex": "",
-            "skipUrlSync": false,
-            "type": "datasource"
-          },
-          {
-            "allValue": ".*",
-            "current": { "selected": true, "text": "All", "value": "$__all" },
-            "datasource": { "type": "prometheus", "uid": "${datasource}" },
-            "definition": "label_values(furumusic_build_info, namespace)",
-            "hide": 0,
-            "includeAll": true,
-            "multi": true,
-            "name": "namespace",
-            "options": [],
-            "query": { "query": "label_values(furumusic_build_info, namespace)", "refId": "PrometheusVariableQueryEditor-VariableQuery" },
-            "refresh": 1,
-            "regex": "",
-            "skipUrlSync": false,
-            "sort": 1,
-            "type": "query"
-          },
-          {
-            "allValue": ".*",
-            "current": { "selected": true, "text": "All", "value": "$__all" },
-            "datasource": { "type": "prometheus", "uid": "${datasource}" },
-            "definition": "label_values(furumusic_http_requests_total{namespace=~\"$namespace\"}, route)",
-            "hide": 0,
-            "includeAll": true,
-            "multi": true,
-            "name": "route",
-            "options": [],
-            "query": { "query": "label_values(furumusic_http_requests_total{namespace=~\"$namespace\"}, route)", "refId": "PrometheusVariableQueryEditor-VariableQuery" },
-            "refresh": 1,
-            "regex": "",
-            "skipUrlSync": false,
-            "sort": 1,
-            "type": "query"
-          }
-        ]
-      },
-      "time": { "from": "now-6h", "to": "now" },
-      "timepicker": {},
-      "timezone": "",
-      "title": "Furumi Music",
-      "uid": "furumi-music",
-      "version": 1
-    }

k8s/core/prom-stack/kustomization.yaml

@@ -8,7 +8,6 @@ resources:
   - alertmanager-config.yaml
   - dashboards/telemt-dashboard-cm.yaml
   - dashboards/auth-proxy-dashboard-cm.yaml
-  - dashboards/furumi-dashboard-cm.yaml
 
 helmCharts:
   - name: kube-prometheus-stack

k8s/core/system-upgrade/plan.yaml

@@ -18,7 +18,7 @@ spec:
   serviceAccountName: system-upgrade
   upgrade:
     image: rancher/k3s-upgrade
-  version: v1.36.1+k3s1
+  version: v1.35.4+k3s1
 ---
 # Agent plan
 apiVersion: upgrade.cattle.io/v1
@@ -43,4 +43,4 @@ spec:
   serviceAccountName: system-upgrade
   upgrade:
     image: rancher/k3s-upgrade
-  version: v1.36.1+k3s1
+  version: v1.35.4+k3s1

terraform/keycloak/.terraform.lock.hcl

@@ -6,7 +6,6 @@ provider "registry.terraform.io/hashicorp/kubernetes" {
   constraints = ">= 2.0.0"
   hashes = [
     "h1:G9QqKNpcztBRqrywtlNylFJSpGzDfRFtO8hcWLdkvRY=",
-    "h1:iDIPyL9K9FXc8ievR5vRmXsgT1/I9Vq9CFDKm1Zo8bQ=",
     "zh:0215c5c60be62028c09a2f22458e89cda3ef5830a632299f1d401eb3538874b0",
     "zh:09ebb9f442431e278a310a9423f32caf467cb4b3cad3fe59573ca71fa7b14e20",
     "zh:0c4e5912f83bb35846ae0a9ae54fc320706ee61894cd21cc6b4181b1c5a2fa5c",
@@ -27,7 +26,6 @@ provider "registry.terraform.io/keycloak/keycloak" {
   constraints = ">= 5.0.0"
   hashes = [
     "h1:3DuKdVeOxwULh7l6bvJKWZvsgSZo92rtnrdvyp+X2Lc=",
-    "h1:reFEBcuBZf2SVqDa1YIaNLuIW72uEVsOu5hHhQgfHi0=",
     "zh:19be4505b17e4818db121a82917cb6723019cf379cfb82b720eaa2886f15bede",
     "zh:2bd1565ed22db6a9fb50d60626e22c277f3b034a71f65e6c0011e42f56cad2bb",
     "zh:34a9e2dfb06331dc6146491c4a0721001195c6a769cdc2d4546edb2acf2b39bd",

terraform/keycloak/main.tf

@@ -8,7 +8,7 @@ resource "keycloak_realm" "hexor" {
 
   display_name = "Hexor"
 
-  login_theme   = "keycloak.v2"
+  login_theme   = "keycloak"
   account_theme = "keycloak.v3"
 
   registration_allowed     = false
@@ -19,119 +19,6 @@ resource "keycloak_realm" "hexor" {
   duplicate_emails_allowed = false
 
   ssl_required = "external"
-
-  web_authn_passwordless_policy {
-    relying_party_entity_name         = "Hexor"
-    relying_party_id                  = "hexor.cy"
-    signature_algorithms              = ["ES256", "RS256"]
-    user_verification_requirement     = "required"
-    require_resident_key              = "Yes"
-    attestation_conveyance_preference = "none"
-  }
-}
-
-# =============================================================================
-# Passkey (WebAuthn Passwordless) — required action
-# =============================================================================
-
-resource "keycloak_required_action" "webauthn_register_passwordless" {
-  realm_id       = keycloak_realm.hexor.id
-  alias          = "webauthn-register-passwordless"
-  name           = "Webauthn Register Passwordless"
-  enabled        = true
-  default_action = false
-}
-
-# =============================================================================
-# Browser flow with Passkey support
-# =============================================================================
-
-resource "keycloak_authentication_flow" "browser_with_passkey" {
-  realm_id    = keycloak_realm.hexor.id
-  alias       = "browser-with-passkey"
-  description = "Browser flow with passkey/password alternatives"
-  provider_id = "basic-flow"
-}
-
-# --- Cookie (re-use existing session) ---
-
-resource "keycloak_authentication_execution" "cookie" {
-  realm_id          = keycloak_realm.hexor.id
-  parent_flow_alias = keycloak_authentication_flow.browser_with_passkey.alias
-  authenticator     = "auth-cookie"
-  requirement       = "ALTERNATIVE"
-  priority          = 10
-}
-
-# --- Identity Provider Redirector ---
-
-resource "keycloak_authentication_execution" "idp_redirector" {
-  realm_id          = keycloak_realm.hexor.id
-  parent_flow_alias = keycloak_authentication_flow.browser_with_passkey.alias
-  authenticator     = "identity-provider-redirector"
-  requirement       = "ALTERNATIVE"
-  priority          = 20
-}
-
-# --- Passkey (WebAuthn Passwordless) ---
-
-resource "keycloak_authentication_execution" "passkey" {
-  realm_id          = keycloak_realm.hexor.id
-  parent_flow_alias = keycloak_authentication_flow.browser_with_passkey.alias
-  authenticator     = "webauthn-authenticator-passwordless"
-  requirement       = "ALTERNATIVE"
-  priority          = 30
-}
-
-# --- Username/Password + optional 2FA subflow ---
-
-resource "keycloak_authentication_subflow" "forms" {
-  realm_id          = keycloak_realm.hexor.id
-  parent_flow_alias = keycloak_authentication_flow.browser_with_passkey.alias
-  alias             = "browser-with-passkey-forms"
-  provider_id       = "basic-flow"
-  requirement       = "ALTERNATIVE"
-  priority          = 40
-}
-
-resource "keycloak_authentication_execution" "username_password" {
-  realm_id          = keycloak_realm.hexor.id
-  parent_flow_alias = keycloak_authentication_subflow.forms.alias
-  authenticator     = "auth-username-password-form"
-  requirement       = "REQUIRED"
-  priority          = 10
-}
-
-resource "keycloak_authentication_subflow" "conditional_2fa" {
-  realm_id          = keycloak_realm.hexor.id
-  parent_flow_alias = keycloak_authentication_subflow.forms.alias
-  alias             = "browser-with-passkey-conditional-2fa"
-  provider_id       = "basic-flow"
-  requirement       = "CONDITIONAL"
-  priority          = 20
-}
-
-resource "keycloak_authentication_execution" "condition_user_configured" {
-  realm_id          = keycloak_realm.hexor.id
-  parent_flow_alias = keycloak_authentication_subflow.conditional_2fa.alias
-  authenticator     = "conditional-user-configured"
-  requirement       = "REQUIRED"
-  priority          = 10
-}
-
-resource "keycloak_authentication_execution" "otp_form" {
-  realm_id          = keycloak_realm.hexor.id
-  parent_flow_alias = keycloak_authentication_subflow.conditional_2fa.alias
-  authenticator     = "auth-otp-form"
-  requirement       = "ALTERNATIVE"
-  priority          = 20
-}
-
-# --- Bind the new flow as the browser flow ---
-
-resource "keycloak_authentication_bindings" "browser" {
-  realm_id     = keycloak_realm.hexor.id
-  browser_flow = keycloak_authentication_flow.browser_with_passkey.alias
 }
 
 # =============================================================================
@@ -199,6 +86,7 @@ resource "keycloak_openid_client_default_scopes" "rsauth2_proxy" {
   client_id = keycloak_openid_client.rsauth2_proxy.id
 
   default_scopes = [
+    "openid",
     "profile",
     "email",
   ]
@@ -262,7 +150,7 @@ resource "keycloak_openid_client_default_scopes" "oauth2_app" {
   client_id = keycloak_openid_client.oauth2_app[each.key].id
 
   default_scopes = concat(
-    ["profile", "email"],
+    ["openid", "profile", "email"],
     each.value.extra_default_scopes
   )
 }
@@ -279,7 +167,9 @@ resource "keycloak_openid_client_optional_scopes" "oauth2_app" {
 }
 
 resource "keycloak_group" "oauth2_app" {
-  for_each = var.oauth2_applications
+  for_each = {
+    for k, v in var.oauth2_applications : k => v if length(v.allowed_groups) > 0
+  }
 
   realm_id = keycloak_realm.hexor.id
   name     = "app-${each.key}"

terraform/keycloak/terraform.tfvars

@@ -3,8 +3,6 @@ groups = [
   "hexor-guest",
   "game-servers-managers",
   "argocd-admins",
-  "web-petting",
-  "Furumusic-Admins"
 ]
 
 proxy_applications = {
@@ -25,35 +23,15 @@ oauth2_applications = {
     post_logout_redirect_uris = ["https://gt.hexor.cy/*"]
   }
   ArgoCD = {
-    redirect_uris             = ["https://ag.hexor.cy/api/dex/callback"]
+    redirect_uris             = ["https://ag.hexor.cy/auth/callback"]
     web_origins               = ["https://ag.hexor.cy"]
     post_logout_redirect_uris = ["https://ag.hexor.cy/*"]
     extra_optional_scopes     = ["offline_access"]
   }
-  PGAdmin = {
-    redirect_uris             = ["https://pg.hexor.cy/oauth2/authorize"]
-    web_origins               = ["https://pg.hexor.cy"]
-    post_logout_redirect_uris = ["https://pg.hexor.cy/*"]
-  }
   Grafana = {
     redirect_uris             = ["https://gf.hexor.cy/login/generic_oauth"]
     web_origins               = ["https://gf.hexor.cy"]
     post_logout_redirect_uris = ["https://gf.hexor.cy/*"]
   }
-  FuruMusic = {
-    redirect_uris             = ["https://music.hexor.cy/auth/oidc/callback"]
-    web_origins               = ["https://music.hexor.cy"]
-    post_logout_redirect_uris = ["https://music.hexor.cy/*"]
-  }
-  FuruMusic-dev = {
-    redirect_uris             = ["https://music-dev.hexor.cy/auth/oidc/callback", "http://127.0.0.1:3000/auth/oidc/callback", "http://10.0.5.103:3000/auth/oidc/callback"]
-    web_origins               = ["https://music-dev.hexor.cy", "http://127.0.0.1:3000", "http://10.0.5.103:3000"]
-    post_logout_redirect_uris = ["https://music-dev.hexor.cy/*", "http://127.0.0.1:3000/*", "http://10.0.5.103:3000/*"]
-  }
-  Web-Petting = {
-    redirect_uris             = ["https://pet.hexor.cy/admin/oidc/callback", "https://xn--l1acako8eb.xn--p1ai/admin/oidc/callback", "https://мурняня.рф/admin/oidc/callback"]
-    web_origins               = ["https://pet.hexor.cy", "https://xn--l1acako8eb.xn--p1ai", "https://мурняня.рф", ]
-    post_logout_redirect_uris = ["https://pet.hexor.cy/*", "https://xn--l1acako8eb.xn--p1ai/*", "https://мурняня.рф/*"]
-  }
 }