feat: Configure barman object store

feat: Added barman cloud plugin
feat: Added cnpg
2025-12-15 04:54:12 +01:00 · 2025-12-15 04:41:07 +01:00 · 2025-12-15 04:41:07 +01:00 · 2025-12-15 04:41:07 +01:00 · 2025-12-15 04:41:07 +01:00 · 2025-12-15 04:41:07 +01:00
48 changed files with 471 additions and 62 deletions
--- a/.git-crypt/.gitattributes
+++ b/.git-crypt/.gitattributes
@@ -0,0 +1,4 @@
+# Do not edit this file.  To specify the files to encrypt, create your own
+# .gitattributes file in the directory where your files are.
+* !filter !diff
+*.gpg binary
--- a/.git-crypt/keys/default/0/CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9.gpg
+++ b/.git-crypt/keys/default/0/CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9.gpg
--- a/README.md
+++ b/README.md
@@ -0,0 +1,7 @@
+# SSH Key issues
+
+Here are some things to check when running into ssh key issues:
+
+- Make sure that known hosts only contains a key of type ecdsa-sha2-nistp256 otherwise flux will fail to connect to the repository over ssh.
+
+- Make sure the deploy key is read/write.
--- a/bootstrap.sh
+++ b/bootstrap.sh
@@ -4,6 +4,7 @@ root=$(git rev-parse --show-toplevel)

 tools=(talosctl cilium-cli yq helm)
 cilium_version=1.18.4
+flux_version=2.7.5

 for tool in "${tools[@]}"; do
 	command -v ${tool} > /dev/null || (echo "Missing: ${tool}" && exit -1)
@@ -129,4 +130,5 @@ flux bootstrap git \
 	--branch=main \
 	--private-key-file=clusters/${cluster_name}/deploy.key -s \
 	--path=clusters/${cluster_name} \
-	--components-extra=source-watcher
+	--components-extra=source-watcher \
+	--version v${flux_version}
--- a/clusters/testing/flux-system/gotk-components.yaml
+++ b/clusters/testing/flux-system/gotk-components.yaml
@@ -1,6 +1,6 @@
 ---
 # This manifest was generated by flux. DO NOT EDIT.
-# Flux Version: v2.7.3
+# Flux Version: v2.7.5
 # Components: source-controller,kustomize-controller,helm-controller,notification-controller,source-watcher
 apiVersion: v1
 kind: Namespace
@@ -8,7 +8,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
    pod-security.kubernetes.io/warn: restricted
    pod-security.kubernetes.io/warn-version: latest
  name: flux-system
@@ -19,7 +19,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: allow-egress
  namespace: flux-system
 spec:
@@ -39,7 +39,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: allow-scraping
  namespace: flux-system
 spec:
@@ -59,7 +59,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: allow-webhooks
  namespace: flux-system
 spec:
@@ -78,7 +78,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: critical-pods-flux-system
  namespace: flux-system
 spec:
@@ -98,7 +98,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: crd-controller-flux-system
 rules:
 - apiGroups:
@@ -204,7 +204,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
    rbac.authorization.k8s.io/aggregate-to-admin: "true"
    rbac.authorization.k8s.io/aggregate-to-edit: "true"
  name: flux-edit-flux-system
@@ -212,6 +212,7 @@ rules:
 - apiGroups:
  - notification.toolkit.fluxcd.io
  - source.toolkit.fluxcd.io
+  - source.extensions.fluxcd.io
  - helm.toolkit.fluxcd.io
  - image.toolkit.fluxcd.io
  - kustomize.toolkit.fluxcd.io
@@ -230,7 +231,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
    rbac.authorization.k8s.io/aggregate-to-admin: "true"
    rbac.authorization.k8s.io/aggregate-to-edit: "true"
    rbac.authorization.k8s.io/aggregate-to-view: "true"
@@ -239,6 +240,7 @@ rules:
 - apiGroups:
  - notification.toolkit.fluxcd.io
  - source.toolkit.fluxcd.io
+  - source.extensions.fluxcd.io
  - helm.toolkit.fluxcd.io
  - image.toolkit.fluxcd.io
  - kustomize.toolkit.fluxcd.io
@@ -255,7 +257,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: cluster-reconciler-flux-system
 roleRef:
  apiGroup: rbac.authorization.k8s.io
@@ -275,7 +277,7 @@ metadata:
  labels:
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: crd-controller-flux-system
 roleRef:
  apiGroup: rbac.authorization.k8s.io
@@ -313,7 +315,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: buckets.source.toolkit.fluxcd.io
 spec:
  group: source.toolkit.fluxcd.io
@@ -1084,7 +1086,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: externalartifacts.source.toolkit.fluxcd.io
 spec:
  group: source.toolkit.fluxcd.io
@@ -1280,7 +1282,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: gitrepositories.source.toolkit.fluxcd.io
 spec:
  group: source.toolkit.fluxcd.io
@@ -2234,7 +2236,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: helmcharts.source.toolkit.fluxcd.io
 spec:
  group: source.toolkit.fluxcd.io
@@ -2960,7 +2962,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: helmrepositories.source.toolkit.fluxcd.io
 spec:
  group: source.toolkit.fluxcd.io
@@ -3591,7 +3593,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: ocirepositories.source.toolkit.fluxcd.io
 spec:
  group: source.toolkit.fluxcd.io
@@ -4417,7 +4419,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: source-controller
  namespace: flux-system
 ---
@@ -4428,7 +4430,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
    control-plane: controller
  name: source-controller
  namespace: flux-system
@@ -4449,7 +4451,7 @@ metadata:
    app.kubernetes.io/component: source-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
    control-plane: controller
  name: source-controller
  namespace: flux-system
@@ -4470,7 +4472,7 @@ spec:
        app.kubernetes.io/component: source-controller
        app.kubernetes.io/instance: flux-system
        app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.7.3
+        app.kubernetes.io/version: v2.7.5
    spec:
      containers:
      - args:
@@ -4493,7 +4495,7 @@ spec:
            resourceFieldRef:
              containerName: manager
              resource: limits.memory
-        image: ghcr.io/fluxcd/source-controller:v1.7.3
+        image: ghcr.io/fluxcd/source-controller:v1.7.4
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
@@ -4557,7 +4559,7 @@ metadata:
    app.kubernetes.io/component: kustomize-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: kustomizations.kustomize.toolkit.fluxcd.io
 spec:
  group: kustomize.toolkit.fluxcd.io
@@ -5927,7 +5929,7 @@ metadata:
    app.kubernetes.io/component: kustomize-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: kustomize-controller
  namespace: flux-system
 ---
@@ -5938,7 +5940,7 @@ metadata:
    app.kubernetes.io/component: kustomize-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
    control-plane: controller
  name: kustomize-controller
  namespace: flux-system
@@ -5957,7 +5959,7 @@ spec:
        app.kubernetes.io/component: kustomize-controller
        app.kubernetes.io/instance: flux-system
        app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.7.3
+        app.kubernetes.io/version: v2.7.5
    spec:
      containers:
      - args:
@@ -5977,7 +5979,7 @@ spec:
            resourceFieldRef:
              containerName: manager
              resource: limits.memory
-        image: ghcr.io/fluxcd/kustomize-controller:v1.7.2
+        image: ghcr.io/fluxcd/kustomize-controller:v1.7.3
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
@@ -6034,7 +6036,7 @@ metadata:
    app.kubernetes.io/component: helm-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: helmreleases.helm.toolkit.fluxcd.io
 spec:
  group: helm.toolkit.fluxcd.io
@@ -8665,7 +8667,7 @@ metadata:
    app.kubernetes.io/component: helm-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: helm-controller
  namespace: flux-system
 ---
@@ -8676,7 +8678,7 @@ metadata:
    app.kubernetes.io/component: helm-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
    control-plane: controller
  name: helm-controller
  namespace: flux-system
@@ -8695,7 +8697,7 @@ spec:
        app.kubernetes.io/component: helm-controller
        app.kubernetes.io/instance: flux-system
        app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.7.3
+        app.kubernetes.io/version: v2.7.5
    spec:
      containers:
      - args:
@@ -8715,7 +8717,7 @@ spec:
            resourceFieldRef:
              containerName: manager
              resource: limits.memory
-        image: ghcr.io/fluxcd/helm-controller:v1.4.3
+        image: ghcr.io/fluxcd/helm-controller:v1.4.5
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
@@ -8772,7 +8774,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: alerts.notification.toolkit.fluxcd.io
 spec:
  group: notification.toolkit.fluxcd.io
@@ -9162,7 +9164,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: providers.notification.toolkit.fluxcd.io
 spec:
  group: notification.toolkit.fluxcd.io
@@ -9574,7 +9576,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: receivers.notification.toolkit.fluxcd.io
 spec:
  group: notification.toolkit.fluxcd.io
@@ -10051,7 +10053,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: notification-controller
  namespace: flux-system
 ---
@@ -10062,7 +10064,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
    control-plane: controller
  name: notification-controller
  namespace: flux-system
@@ -10083,7 +10085,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
    control-plane: controller
  name: webhook-receiver
  namespace: flux-system
@@ -10104,7 +10106,7 @@ metadata:
    app.kubernetes.io/component: notification-controller
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
    control-plane: controller
  name: notification-controller
  namespace: flux-system
@@ -10123,7 +10125,7 @@ spec:
        app.kubernetes.io/component: notification-controller
        app.kubernetes.io/instance: flux-system
        app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.7.3
+        app.kubernetes.io/version: v2.7.5
    spec:
      containers:
      - args:
@@ -10141,7 +10143,7 @@ spec:
            resourceFieldRef:
              containerName: manager
              resource: limits.memory
-        image: ghcr.io/fluxcd/notification-controller:v1.7.4
+        image: ghcr.io/fluxcd/notification-controller:v1.7.5
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
@@ -10203,7 +10205,7 @@ metadata:
    app.kubernetes.io/component: source-watcher
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: artifactgenerators.source.extensions.fluxcd.io
 spec:
  group: source.extensions.fluxcd.io
@@ -10496,7 +10498,7 @@ metadata:
    app.kubernetes.io/component: source-watcher
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
  name: source-watcher
  namespace: flux-system
 ---
@@ -10507,7 +10509,7 @@ metadata:
    app.kubernetes.io/component: source-watcher
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
    control-plane: source-watcher
  name: source-watcher
  namespace: flux-system
@@ -10528,7 +10530,7 @@ metadata:
    app.kubernetes.io/component: source-watcher
    app.kubernetes.io/instance: flux-system
    app.kubernetes.io/part-of: flux
-    app.kubernetes.io/version: v2.7.3
+    app.kubernetes.io/version: v2.7.5
    control-plane: controller
  name: source-watcher
  namespace: flux-system
@@ -10549,7 +10551,7 @@ spec:
        app.kubernetes.io/component: source-watcher
        app.kubernetes.io/instance: flux-system
        app.kubernetes.io/part-of: flux
-        app.kubernetes.io/version: v2.7.3
+        app.kubernetes.io/version: v2.7.5
    spec:
      containers:
      - args:
@@ -10570,7 +10572,7 @@ spec:
            resourceFieldRef:
              containerName: manager
              resource: limits.memory
-        image: ghcr.io/fluxcd/source-watcher:v2.0.2
+        image: ghcr.io/fluxcd/source-watcher:v2.0.3
        imagePullPolicy: IfNotPresent
        livenessProbe:
          httpGet:
--- a/clusters/testing/kustomization.yaml
+++ b/clusters/testing/kustomization.yaml
@@ -9,8 +9,12 @@ resources:
  - ../../controllers/spegel/spegel.yaml
  - ../../controllers/longhorn/longhorn.yaml
  - ../../controllers/local-path-provisioner/local-path-provisioner.yaml
+  - ../../controllers/cnpg/cnpg.yaml
+  - ../../controllers/barman-cloud-plugin/barman-cloud-plugin.yaml

  - ../../configs/artifacts.yaml
  - ../../configs/letsencrypt/letsencrypt.yaml
  - ../../configs/certificates/certificates.yaml
-  - ../../configs/telegram-alerts/telegram-alerts.yaml
+  - ../../configs/alerts/alerts.yaml
+  - ../../configs/longhorn-jobs/longhorn-jobs.yaml
+  - ../../configs/barman-config/barman-config.yaml
--- a/configs/telegram-alerts/telegram-alerts.yaml
+++ b/configs/telegram-alerts/telegram-alerts.yaml
@@ -1,7 +1,7 @@
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: telegram-alerts
+  name: alerts
  namespace: flux-system
 spec:
  interval: 1h
@@ -9,7 +9,7 @@ spec:
  timeout: 5m
  sourceRef:
    kind: ExternalArtifact
-    name: telegram-alerts
+    name: alerts
  decryption:
    provider: sops
    secretRef:
--- a/configs/alerts/kustomization.yaml
+++ b/configs/alerts/kustomization.yaml
@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - telegram
+  - repo
--- a/configs/alerts/repo/alert.yaml
+++ b/configs/alerts/repo/alert.yaml
@@ -0,0 +1,12 @@
+apiVersion: notification.toolkit.fluxcd.io/v1beta3
+kind: Alert
+metadata:
+  name: repo
+  namespace: flux-system
+spec:
+  providerRef:
+    name: repo
+  eventSeverity: info
+  eventSources:
+    - kind: Kustomization
+      name: "*"
--- a/configs/telegram-alerts/kustomization.yaml
+++ b/configs/telegram-alerts/kustomization.yaml
@@ -1,6 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - secret-telegram.yaml
+  - secret-repo.enc.yaml
  - provider.yaml
  - alert.yaml
--- a/configs/alerts/repo/provider.yaml
+++ b/configs/alerts/repo/provider.yaml
@@ -0,0 +1,10 @@
+apiVersion: notification.toolkit.fluxcd.io/v1beta3
+kind: Provider
+metadata:
+  name: repo
+  namespace: flux-system
+spec:
+  type: gitea
+  address: https://git.huizinga.dev/infra/foundation
+  secretRef:
+    name: repo
--- a/configs/telegram-alerts/secret-telegram.enc.yaml
+++ b/configs/telegram-alerts/secret-telegram.enc.yaml
@@ -1,9 +1,9 @@
 apiVersion: v1
 stringData:
-    token: ENC[AES256_GCM,data:azBE1dVSbYNZzpagsQrmEoYGIGFn/URQ3VrksQRhUKuJyCrc6o6360u/k38NKg==,iv:iYpqz6Ndh5QESa8yGPU1nKD8/sb3dgloNLa3HFDihnU=,tag:2w0eslkZQOIb+qPYgNmHIQ==,type:str]
+    token: ENC[AES256_GCM,data:RZLFgmuin4hjJ1gSOFZLFeLpF/KjIr6vBGgovhyfLD9PQKSQq6eg5g==,iv:VUTnjgcoqfVcZrDM1S2VqBdSCYXC6hj4lHx/mI8bw8s=,tag:QSj3c5OX6JqJxt6WnglAIw==,type:str]
 kind: Secret
 metadata:
-    name: telegram
+    name: repo
    namespace: flux-system
 sops:
    age:
@@ -25,8 +25,8 @@ sops:
            RE5SSzI4MmdOWGhBTGNzR2NPeHArSHcK8sOiSL6tfAT6KFLkFy0NpRuiVbFayJPR
            vtki2eku7b0MKsQKCv/JPwSdOa7q/8Mxngiajxqwae0nObETSR+2TA==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-12-09T02:34:49Z"
-    mac: ENC[AES256_GCM,data:dwt7iU5FQjd3Hn/ynE+hAv6L6/EwGgJ9KR/98RsGL+ZoDOXrcnPu8I1Zp4HIuwxzLQetYPeeZy0qGl452eWnbI8kJ2MySGGpqdYeJVWplyfx3pSMT5ms7gbHYTAS7Kp8VLPtzynyKA14fJZNiECd/onVJehxE5bEtKEuiE7ZRvE=,iv:nc59zZeHLtwjsrCOI/WgQc7ZXKXI+5/Q2QcIdBVI+RQ=,tag:xdrCwPDVA1im+cNwPgU6Lg==,type:str]
+    lastmodified: "2025-12-15T00:11:25Z"
+    mac: ENC[AES256_GCM,data:xXPnZ5DP90FtT7yDUOPAMHl7vXgFM8JEnm/mpozB5/I4f3xxGP9b3RVfK3zESgqHREVUoD/hIQaTCwYHeqqWKwB7yQxc4ZuMKlTJ11iw0R8vsbj0Lk/a8v0kzCx5CDoTcvZE78go8LtIfYVxBKvcwP9ZN0Q9RuR235RVMW5Rz5M=,iv:oS9OUiyhliHzl1NEgfFr+eEfmgXlMX7VeeOcE382p1k=,tag:w6t9lNHqUYAFcEI3E4UBcQ==,type:str]
    pgp:
        - created_at: "2025-12-09T02:34:13Z"
          enc: |-
--- a/configs/alerts/telegram/alert.yaml
+++ b/configs/alerts/telegram/alert.yaml
--- a/configs/alerts/telegram/kustomization.yaml
+++ b/configs/alerts/telegram/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - secret-telegram.enc.yaml
+  - provider.yaml
+  - alert.yaml
--- a/configs/alerts/telegram/provider.yaml
+++ b/configs/alerts/telegram/provider.yaml
--- a/configs/alerts/telegram/secret-telegram.enc.yaml
+++ b/configs/alerts/telegram/secret-telegram.enc.yaml
--- a/configs/artifacts.yaml
+++ b/configs/artifacts.yaml
@@ -19,8 +19,18 @@ spec:
      copy:
        - from: "@foundation/configs/certificates/**"
          to: "@artifact/"
-    - name: telegram-alerts
+    - name: alerts
      originRevision: "@foundation"
      copy:
-        - from: "@foundation/configs/telegram-alerts/**"
+        - from: "@foundation/configs/alerts/**"
+          to: "@artifact/"
+    - name: longhorn-jobs
+      originRevision: "@foundation"
+      copy:
+        - from: "@foundation/configs/longhorn-jobs/**"
+          to: "@artifact/"
+    - name: barman-config
+      originRevision: "@foundation"
+      copy:
+        - from: "@foundation/configs/barman-config/**"
          to: "@artifact/"
--- a/configs/barman-config/barman-config.yaml
+++ b/configs/barman-config/barman-config.yaml
@@ -0,0 +1,17 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: barman-config
+  namespace: flux-system
+spec:
+  interval: 1h
+  retryInterval: 2m
+  timeout: 5m
+  dependsOn:
+    - name: barman-cloud-plugin
+  sourceRef:
+    kind: ExternalArtifact
+    name: barman-config
+  path: .
+  prune: true
+  wait: true
--- a/configs/barman-config/kustomization.yaml
+++ b/configs/barman-config/kustomization.yaml
@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - object-store.yaml
+  - secret-s3-garage.enc.yaml
--- a/configs/barman-config/object-store.yaml
+++ b/configs/barman-config/object-store.yaml
@@ -0,0 +1,18 @@
+apiVersion: barmancloud.cnpg.io/v1
+kind: ObjectStore
+metadata:
+  name: garage-store
+  namespace: cnpg-system
+spec:
+  configuration:
+    destinationPath: s3://cnpg-backup/
+    endpointURL: http://192.178.1.1:3900
+    s3Credentials:
+      accessKeyId:
+        name: s3-garage
+        key: ACCESS_KEY_ID
+      secretAccessKey:
+        name: s3-garage
+        key: ACCESS_SECRET_KEY
+    wal:
+      compression: gzip
--- a/configs/barman-config/secret-s3-garage.enc.yaml
+++ b/configs/barman-config/secret-s3-garage.enc.yaml
@@ -0,0 +1,54 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: s3-garage
+    namespace: cnpg-system
+type: Opaque
+stringData:
+    ACCESS_KEY_ID: ENC[AES256_GCM,data:TOEQMG/kHs5XUk77ijyV089ZTq1dKsoZUas=,iv:mVDOkl5qOxGdvCvdcXUuUjX85oKqbd+n5maHsKwCiFg=,tag:pho0oWPTwtM6lGQ2vA1d5A==,type:str]
+    SECRET_ACCESS_KEY: ENC[AES256_GCM,data:mc42T/AQ8NRi32SzvwGJA6LEq1x0Yz3Tu+CPDYPf+E2+C00zQcGRk6tACPvRoMxRzU4ZZpK346e2K/8ajU77hg==,iv:Isxe81aQEbI5xd1dRjXDKj/2Jp9eTHdv0/XVBBHoRyE=,tag:gtcmKmfUIfIy977Df11P4g==,type:str]
+sops:
+    age:
+        - recipient: age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3cmd2NkxFOVB0a1R3MHVN
+            RWRwbFVVaHF6Mlo4UElIZ1ROd1pyV1czSEYwCmFQMGM3Nkw0U0hzcWdyQVpnZTZL
+            eFNLWW5iNWpZVU9BQm9KakV4dEJzaGsKLS0tIGZ0ajdRZjZIUnNRSElzeENYRG4r
+            eUJHQVAzeWJSUDZTYy8zbTJIQ3pscjAKERe7k/VVNqMhqe2rLLRA9dO71bjieffX
+            YMIzJ0/UNMo2el4bcefwRnqwl0oyPG+pMXZ3F6UXyEoZw3ZIc4Nzvg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1hktythzvsnth6u5en2lvag0tftnj9r03w7rpnzfgzgf5w95qxycq2azufj
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhakxrQ1Zrd3FRekZwZkU4
+            MVBpdloxeTJWQm1GZjA4M2NFVk1IYWtrTG1RCnpaRGh1WDZ4dCtzeFhkK1YzczYz
+            dmFNSWQ1bXgwQjJ1VlkrQnFhMXJ3bGcKLS0tIDhpcWx0MklNazJ0SjUzRmlyV0Er
+            K09tZGI0Z2w0eXh5eHcvcEttMy82aU0K2fnCDfYIShzw2Zipof+C8zf9pcOmiDg9
+            2SCiIfAJs9MB3n078P068z77KpvdlJYOi9pUTKSBhNw+mBI24y6X6A==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-15T03:46:42Z"
+    mac: ENC[AES256_GCM,data:UG9rSQ4ep7Ln4g5QCtvD6U90Oc8iWpni+kypMpJ+AQM8LC0TTs9zFQgcxmo2wjZn38Fp+br/5KC172SqBNG4Q1yXhlRiqiIeyx9ynrZeceRSqHaaruB1hj83/0FwahqjB/t6yutWIfnp00UC92mMKGlef48UNZ8IW17e5uHE0m4=,iv:LvR4BEkgAr6PJ8fYATFois4j8/rgztn/Jggj/mFgCIk=,tag:W38qDd1RkCdK3bVMqOVnjA==,type:str]
+    pgp:
+        - created_at: "2025-12-11T23:56:15Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA51kG++kLewoARAA2+TLPMKYQFUjyuER+HZgY5Zl4qcF94sYcZuTdcvl/Pam
+            l//PcgU80DLb/3IZ1K12EYyuZ+QVdJxmUQt1OvBUWv2p0/5mU7zbkxc8YJ/vc46b
+            yMX7mmDnzuyU2Lss0hUl5dDDk3pdC4SgjrBz15g9TvS2jOWDTOwKCb1DEghfzB07
+            /9Yfj6Rfds2gqsUgfyxVCzHXzC0SNpuqqPLmnzNmjYiQGNFOCOdyxP6c2ehCI6Bq
+            Lu38n6rjTj2QWJZvtr57a2IVqmFVcD9wcy7ITUk8u9+ncYemLmx1LTQKD6n0WDHm
+            DwjRjziqdJRpHo70Q6TUanFppqTB2q1CReS4yk9sc3CINq9fRJrKtOeJxW8x81yZ
+            o3X++3gYbsRIrApVAFECJyKA4H6eK1gp4djNV7K0MmbQcR/7wSqaYrE6vTPml7jG
+            Ribd7eGvF2FnH5P/z3ckh6HH2Ln+i+iVy+ZeY+lgWuIrVNDWwR8mDH8AkjXuGTu4
+            K6ra+kCna6v7CAKwlGd31rk9i0CTNTqyHEQeqYuto/HTEC0Jj/lRyFPq+KuuvoAq
+            vxQlmP6VnYR0gTfkneBAny4neu3zrbYMuIMWoA9pAhZBNOLPuPXZtUwhAStHBS1V
+            Sdc6AI9CXSPFIP2WDn6iwjwXElkG5+iYyngf3tXrJUVXs0SQeFH05j3r5zVNT0zS
+            XgFAiWuLAOyWWvP+Jlre5dgKnbiaSs3wIVL9Qw9MuHIWdlXmTyuQ5SQKErQLSQ2j
+            b5ogtCcgcbVd+OsZCHWQbPtLI2yk/n0afA9D6cRvLHbNZGrWRZjdTYUHU2Drp0w=
+            =/yAN
+            -----END PGP MESSAGE-----
+          fp: CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0
--- a/configs/longhorn-jobs/kustomization.yaml
+++ b/configs/longhorn-jobs/kustomization.yaml
@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - recurring-job-backup.yaml
+  - recurring-job-snapshot.yaml
+  - recurring-job-trim.yaml
--- a/configs/longhorn-jobs/longhorn-jobs.yaml
+++ b/configs/longhorn-jobs/longhorn-jobs.yaml
@@ -0,0 +1,16 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: longhorn-jobs
+  namespace: flux-system
+spec:
+  interval: 1h
+  retryInterval: 2m
+  timeout: 5m
+  dependsOn:
+    - name: longhorn
+  sourceRef:
+    kind: ExternalArtifact
+    name: longhorn-jobs
+  prune: true
+  wait: true
--- a/configs/longhorn-jobs/recurring-job-backup.yaml
+++ b/configs/longhorn-jobs/recurring-job-backup.yaml
@@ -0,0 +1,14 @@
+apiVersion: longhorn.io/v1beta2
+kind: RecurringJob
+metadata:
+  name: backup
+  namespace: longhorn-system
+spec:
+  cron: "0 5 * * *"
+  task: "backup"
+  retain: 14
+  concurrency: 1
+  groups:
+    - default
+  parameters:
+    full-backup-interval: "7"
--- a/configs/longhorn-jobs/recurring-job-snapshot.yaml
+++ b/configs/longhorn-jobs/recurring-job-snapshot.yaml
@@ -0,0 +1,12 @@
+apiVersion: longhorn.io/v1beta2
+kind: RecurringJob
+metadata:
+  name: snapshot
+  namespace: longhorn-system
+spec:
+  cron: "0 */12 * * *"
+  task: "snapshot"
+  retain: 14
+  concurrency: 1
+  groups:
+    - default
--- a/configs/longhorn-jobs/recurring-job-trim.yaml
+++ b/configs/longhorn-jobs/recurring-job-trim.yaml
@@ -0,0 +1,11 @@
+apiVersion: longhorn.io/v1beta2
+kind: RecurringJob
+metadata:
+  name: trim
+  namespace: longhorn-system
+spec:
+  cron: "0 0 7 * *"
+  task: "filesystem-trim"
+  concurrency: 1
+  groups:
+    - default
--- a/controllers/artifacts.yaml
+++ b/controllers/artifacts.yaml
@@ -37,5 +37,15 @@ spec:
    - name: local-path-provisioner
      originRevision: "@foundation"
      copy:
-        - from: "@foundation/controllers/local-path-provisioner/**"
+        - from: "@foundation/controllers/local-path-provisioner**"
+          to: "@artifact/"
+    - name: cnpg
+      originRevision: "@foundation"
+      copy:
+        - from: "@foundation/controllers/cnpg/**"
+          to: "@artifact/"
+    - name: barman-cloud-plugin
+      originRevision: "@foundation"
+      copy:
+        - from: "@foundation/controllers/barman-cloud-plugin/**"
          to: "@artifact/"
--- a/controllers/barman-cloud-plugin/barman-cloud-plugin.yaml
+++ b/controllers/barman-cloud-plugin/barman-cloud-plugin.yaml
@@ -0,0 +1,17 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: barman-cloud-plugin
+  namespace: flux-system
+spec:
+  interval: 1h
+  retryInterval: 2m
+  timeout: 5m
+  dependsOn:
+    - name: cnpg
+  sourceRef:
+    kind: ExternalArtifact
+    name: barman-cloud-plugin
+  path: .
+  prune: true
+  wait: true
--- a/controllers/barman-cloud-plugin/kustomization.yaml
+++ b/controllers/barman-cloud-plugin/kustomization.yaml
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - https://github.com/cloudnative-pg/plugin-barman-cloud/releases/download/v0.9.0/manifest.yaml
--- a/controllers/cert-manager/oci-repository.yaml
+++ b/controllers/cert-manager/oci-repository.yaml
@@ -10,4 +10,4 @@ spec:
    mediaType: "application/vnd.cncf.helm.chart.content.v1.tar+gzip"
    operation: copy
  ref:
-    semver: "1.x"
+    semver: "1.19.x"
--- a/controllers/cilium/base/helm-release.yaml
+++ b/controllers/cilium/base/helm-release.yaml
@@ -17,7 +17,7 @@ spec:
  chart:
    spec:
      chart: cilium
-      version: "1.x"
+      version: "1.18.x"
      sourceRef:
        kind: HelmRepository
        name: cilium
--- a/controllers/cnpg/base/helm-release.yaml
+++ b/controllers/cnpg/base/helm-release.yaml
@@ -0,0 +1,29 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cnpg
+  namespace: cnpg-system
+spec:
+  interval: 12h
+  install:
+    strategy:
+      name: RetryOnFailure
+      retryInterval: 2m
+  upgrade:
+    strategy:
+      name: RetryOnFailure
+      retryInterval: 3m
+  chart:
+    spec:
+      chart: cloudnative-pg
+      version: "0.27.x"
+      sourceRef:
+        kind: HelmRepository
+        name: cnpg
+      interval: 24h
+  valuesFrom:
+    - kind: ConfigMap
+      name: values-base
+    - kind: ConfigMap
+      name: values-overlay
+      optional: true
--- a/controllers/cnpg/base/helm-repository.yaml
+++ b/controllers/cnpg/base/helm-repository.yaml
@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: cnpg
+  namespace: cnpg-system
+spec:
+  interval: 24h
+  url: https://cloudnative-pg.github.io/charts
--- a/controllers/cnpg/base/kustomization.yaml
+++ b/controllers/cnpg/base/kustomization.yaml
@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - helm-repository.yaml
+  - helm-release.yaml
+
+configurations:
+  - name-reference.yaml
+
+configMapGenerator:
+  - name: values-base
+    namespace: cnpg-system
+    files:
+      - values.yaml
--- a/controllers/cnpg/base/name-reference.yaml
+++ b/controllers/cnpg/base/name-reference.yaml
@@ -0,0 +1,6 @@
+nameReference:
+  - kind: ConfigMap
+    version: v1
+    fieldSpecs:
+      - path: spec/valuesFrom/name
+        kind: HelmRelease
--- a/controllers/cnpg/base/namespace.yaml
+++ b/controllers/cnpg/base/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: cnpg-system
--- a/controllers/cnpg/base/values.yaml
+++ b/controllers/cnpg/base/values.yaml
--- a/controllers/cnpg/cnpg.yaml
+++ b/controllers/cnpg/cnpg.yaml
@@ -0,0 +1,15 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cnpg
+  namespace: flux-system
+spec:
+  interval: 1h
+  retryInterval: 2m
+  timeout: 5m
+  sourceRef:
+    kind: ExternalArtifact
+    name: cnpg
+  path: ./${cluster_env}
+  prune: true
+  wait: true
--- a/controllers/cnpg/production/kustomization.yaml
+++ b/controllers/cnpg/production/kustomization.yaml
@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+
+configMapGenerator:
+  - name: values-overlay
+    namespace: cnpg-system
+    files:
+      - values.yaml
--- a/controllers/cnpg/production/values.yaml
+++ b/controllers/cnpg/production/values.yaml
@@ -0,0 +1 @@
+replicaCount: 2
--- a/controllers/cnpg/staging/kustomization.yaml
+++ b/controllers/cnpg/staging/kustomization.yaml
@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+
+configMapGenerator:
+  - name: values-overlay
+    namespace: cnpg-system
+    files:
+      - values.yaml
--- a/controllers/cnpg/staging/values.yaml
+++ b/controllers/cnpg/staging/values.yaml
@@ -0,0 +1 @@
+replicaCount: 1
--- a/controllers/longhorn/base/helm-release.yaml
+++ b/controllers/longhorn/base/helm-release.yaml
@@ -16,7 +16,6 @@ spec:
  chart:
    spec:
      chart: longhorn
-      # TODO: Is it safe to upgrade automatically to 1.x?
      version: "1.10.x"
      sourceRef:
        kind: HelmRepository
--- a/controllers/longhorn/base/values.yaml
+++ b/controllers/longhorn/base/values.yaml
@@ -8,3 +8,6 @@ defaultSettings:
  storageOverProvisioningPercentage: 25
 persistence:
  defaultDataLocality: best-effort
+defaultBackupStore:
+  backupTarget: s3://longhorn-backup/
+  backupTargetCredentialSecret: s3-garage
--- a/controllers/longhorn/longhorn.yaml
+++ b/controllers/longhorn/longhorn.yaml
@@ -10,6 +10,10 @@ spec:
  sourceRef:
    kind: ExternalArtifact
    name: longhorn
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
  path: ./${cluster_env}
  prune: true
  wait: true
--- a/controllers/longhorn/staging/kustomization.yaml
+++ b/controllers/longhorn/staging/kustomization.yaml
@@ -2,6 +2,7 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - ../base
+  - secret-s3-garage.yaml

 configMapGenerator:
  - name: values-overlay
--- a/controllers/longhorn/staging/secret-s3-garage.yaml
+++ b/controllers/longhorn/staging/secret-s3-garage.yaml
@@ -0,0 +1,56 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: s3-garage
+    namespace: longhorn-system
+type: Opaque
+stringData:
+    AWS_ACCESS_KEY_ID: ENC[AES256_GCM,data:Z61V0zZ0sApVz8gP+Yc6LTKQcW0jdRaWXa4=,iv:SpLgdgI4Yc48NYNb9wE3C28ixBg8vu5tTf7bUENMfrE=,tag:DDbqGvSbcpDxzPUpHbhLKA==,type:str]
+    AWS_SECRET_ACCESS_KEY: ENC[AES256_GCM,data:FK/BS+rXAD2sXND6zHJ2G/GIcFIe01kL/1WP1RJNX86Jc9aCra26+FQQ4zU0Uanh8tQqSzf2qMwK1uMkr/SI4A==,iv:36UsdtiRN3fPr+HtRHSad7oEetiJh56sq+Ypyq/W5FA=,tag:rYHPuCOCHA+YoEKdfN8P0g==,type:str]
+    AWS_ENDPOINTS: ENC[AES256_GCM,data:2iB2cf1E4ucxJEDGRpe2wiX9yMCZA1A=,iv:c+izWJ+i7lHybZlU9yKS5Q+Zj9lOGysCbewz9iRud3M=,tag:UX4zr9dguSAUBqm1xJnNJQ==,type:str]
+    AWS_DEFAULT_REGION: ENC[AES256_GCM,data:x8oa5+m6,iv:w7Ko7PithIEtO6UoW063hxpqcctD4kBw3dCGKYlmQxU=,tag:HskDJefMh4EGKVp8gf9eCw==,type:str]
+sops:
+    age:
+        - recipient: age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA3cmd2NkxFOVB0a1R3MHVN
+            RWRwbFVVaHF6Mlo4UElIZ1ROd1pyV1czSEYwCmFQMGM3Nkw0U0hzcWdyQVpnZTZL
+            eFNLWW5iNWpZVU9BQm9KakV4dEJzaGsKLS0tIGZ0ajdRZjZIUnNRSElzeENYRG4r
+            eUJHQVAzeWJSUDZTYy8zbTJIQ3pscjAKERe7k/VVNqMhqe2rLLRA9dO71bjieffX
+            YMIzJ0/UNMo2el4bcefwRnqwl0oyPG+pMXZ3F6UXyEoZw3ZIc4Nzvg==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1hktythzvsnth6u5en2lvag0tftnj9r03w7rpnzfgzgf5w95qxycq2azufj
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBhakxrQ1Zrd3FRekZwZkU4
+            MVBpdloxeTJWQm1GZjA4M2NFVk1IYWtrTG1RCnpaRGh1WDZ4dCtzeFhkK1YzczYz
+            dmFNSWQ1bXgwQjJ1VlkrQnFhMXJ3bGcKLS0tIDhpcWx0MklNazJ0SjUzRmlyV0Er
+            K09tZGI0Z2w0eXh5eHcvcEttMy82aU0K2fnCDfYIShzw2Zipof+C8zf9pcOmiDg9
+            2SCiIfAJs9MB3n078P068z77KpvdlJYOi9pUTKSBhNw+mBI24y6X6A==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-13T00:39:37Z"
+    mac: ENC[AES256_GCM,data:H63bqddFd/4v4mGtam/wLa2PX6gn6xeHJMiETdbbrtUjPvspo8soHtFrtMjp1OoU4wYQbYs/0Dr4MRvSeEwVCrkYsOZeHkn8GecnrmqYqmn8eeL6fNSjoshO+eil6lBr0oWW9OPuzjN+avg/+Ucsl9HtnM+VbSIeDeO+7kGc6EI=,iv:DA7fugq5zibsHhbdKuepwHggmsqSmi9w4MIAOZnILvA=,tag:jsJxtFhSFzpZq9KZXCYN4A==,type:str]
+    pgp:
+        - created_at: "2025-12-11T23:56:15Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA51kG++kLewoARAA2+TLPMKYQFUjyuER+HZgY5Zl4qcF94sYcZuTdcvl/Pam
+            l//PcgU80DLb/3IZ1K12EYyuZ+QVdJxmUQt1OvBUWv2p0/5mU7zbkxc8YJ/vc46b
+            yMX7mmDnzuyU2Lss0hUl5dDDk3pdC4SgjrBz15g9TvS2jOWDTOwKCb1DEghfzB07
+            /9Yfj6Rfds2gqsUgfyxVCzHXzC0SNpuqqPLmnzNmjYiQGNFOCOdyxP6c2ehCI6Bq
+            Lu38n6rjTj2QWJZvtr57a2IVqmFVcD9wcy7ITUk8u9+ncYemLmx1LTQKD6n0WDHm
+            DwjRjziqdJRpHo70Q6TUanFppqTB2q1CReS4yk9sc3CINq9fRJrKtOeJxW8x81yZ
+            o3X++3gYbsRIrApVAFECJyKA4H6eK1gp4djNV7K0MmbQcR/7wSqaYrE6vTPml7jG
+            Ribd7eGvF2FnH5P/z3ckh6HH2Ln+i+iVy+ZeY+lgWuIrVNDWwR8mDH8AkjXuGTu4
+            K6ra+kCna6v7CAKwlGd31rk9i0CTNTqyHEQeqYuto/HTEC0Jj/lRyFPq+KuuvoAq
+            vxQlmP6VnYR0gTfkneBAny4neu3zrbYMuIMWoA9pAhZBNOLPuPXZtUwhAStHBS1V
+            Sdc6AI9CXSPFIP2WDn6iwjwXElkG5+iYyngf3tXrJUVXs0SQeFH05j3r5zVNT0zS
+            XgFAiWuLAOyWWvP+Jlre5dgKnbiaSs3wIVL9Qw9MuHIWdlXmTyuQ5SQKErQLSQ2j
+            b5ogtCcgcbVd+OsZCHWQbPtLI2yk/n0afA9D6cRvLHbNZGrWRZjdTYUHU2Drp0w=
+            =/yAN
+            -----END PGP MESSAGE-----
+          fp: CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0
--- a/controllers/spegel/helm-release.yaml
+++ b/controllers/spegel/helm-release.yaml
@@ -16,6 +16,7 @@ spec:
  chart:
    spec:
      chart: spegel
+      version: "0.5.x"
      sourceRef:
        kind: HelmRepository
        name: spegel
Author	SHA1	Message	Date
Dreaded_X	d7cccd591c	feat: Configure barman object store All checks were successful kustomization/barman-config/1b69816f reconciliation succeeded kustomization/flux-system/1b69816f reconciliation succeeded kustomization/barman-cloud-plugin/1b69816f reconciliation succeeded	2025-12-15 04:54:12 +01:00
Dreaded_X	9f06da25c4	feat: Added barman cloud plugin All checks were successful kustomization/flux-system/1b69816f reconciliation succeeded kustomization/longhorn/1b69816f reconciliation succeeded	2025-12-15 04:41:07 +01:00
Dreaded_X	d27d77b903	feat: Added cnpg	2025-12-15 04:41:07 +01:00
Dreaded_X	e941c99d9f	chore: Set minor version for all controllers	2025-12-15 04:41:07 +01:00
Dreaded_X	52fc40e8c2	feat: Use single kustomization for all alerts	2025-12-15 04:41:07 +01:00
Dreaded_X	d2eed574ac	feat: Added flux status to gitea commits	2025-12-15 04:41:07 +01:00
Dreaded_X	4cab79df1e	chore: Moved telegram alerts config	2025-12-15 04:41:06 +01:00
Dreaded_X	1594476052	feat: Add longhorn backup job	2025-12-15 04:41:06 +01:00
Dreaded_X	9ddd2c155d	feat: Pin flux version in bootstrap script	2025-12-15 04:41:06 +01:00
Dreaded_X	3e8be0572f	chore: Added README with common issues	2025-12-15 04:41:06 +01:00
Flux	9aef0dbadb	Add Flux v2.7.5 component manifests	2025-12-15 04:41:06 +01:00
Dreaded_X	5479fbc5fc	chore: Add 1 git-crypt collaborator New collaborators: CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9 Tim Huizinga <tim@huizinga.dev>	2025-12-15 04:41:06 +01:00
Dreaded_X	44f57ddcf4	feat: Added garage as default backup target	2025-12-15 04:41:06 +01:00