feat: Added kube-prometheus-stack

apps/artifacts.yaml

@@ -14,3 +14,13 @@ spec:
       copy:
         - from: "@foundation/apps/spegel/**"
           to: "@artifact/"
+    - name: lldap
+      originRevision: "@foundation"
+      copy:
+        - from: "@foundation/apps/lldap/**"
+          to: "@artifact/"
+    - name: authelia
+      originRevision: "@foundation"
+      copy:
+        - from: "@foundation/apps/authelia/**"
+          to: "@artifact/"

apps/authelia/authelia.yaml

@@ -0,0 +1,20 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: authelia
+  namespace: flux-system
+spec:
+  interval: 1h
+  retryInterval: 2m
+  timeout: 5m
+  dependsOn:
+    - name: cnpg
+    - name: lldap-controller
+    - name: dragonfly-operator
+    - name: authelia-controller
+  sourceRef:
+    kind: ExternalArtifact
+    name: authelia
+  path: ./${cluster_env}
+  prune: true
+  wait: true

apps/authelia/base/cluster-restore.yaml

@@ -0,0 +1,16 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: db
+spec:
+  bootstrap:
+    recovery:
+      source: source
+  externalClusters:
+    - name: source
+      plugin:
+        name: barman-cloud.cloudnative-pg.io
+        parameters:
+          barmanObjectName: garage-store
+          serverName: db
+  plugins: []

apps/authelia/base/cluster.yaml

@@ -0,0 +1,15 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: db
+  namespace: authelia
+  # TODO: Add labels?
+spec:
+  storage:
+    size: 8Gi
+    storageClass: local-path
+  plugins:
+    - name: barman-cloud.cloudnative-pg.io
+      isWALArchiver: true
+      parameters:
+        barmanObjectName: garage-store

apps/authelia/base/helm-release.yaml

@@ -0,0 +1,29 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: authelia
+  namespace: authelia
+spec:
+  interval: 12h
+  install:
+    strategy:
+      name: RetryOnFailure
+      retryInterval: 2m
+  upgrade:
+    strategy:
+      name: RetryOnFailure
+      retryInterval: 3m
+  chart:
+    spec:
+      chart: authelia
+      version: "0.10.x"
+      sourceRef:
+        kind: HelmRepository
+        name: authelia
+      interval: 24h
+  valuesFrom:
+    - kind: ConfigMap
+      name: values-base
+    - kind: ConfigMap
+      name: values-overlay
+      optional: true

apps/authelia/base/helm-repository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: authelia
+  namespace: authelia
+spec:
+  interval: 24h
+  url: https://charts.authelia.com

apps/authelia/base/kustomization.yaml

@@ -0,0 +1,25 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - cluster.yaml
+  - service-user.yaml
+  - helm-repository.yaml
+  - helm-release.yaml
+  - secret-s3-garage.yaml
+  - object-store.yaml
+
+configurations:
+  - name-reference.yaml
+
+configMapGenerator:
+  - name: values-base
+    namespace: authelia
+    files:
+      - values.yaml
+
+# Uncomment to restore database from backup
+# patches:
+#   - path: cluster-restore.yaml
+#     target:
+#       kind: Cluster

apps/authelia/base/name-reference.yaml

@@ -0,0 +1,6 @@
+nameReference:
+  - kind: ConfigMap
+    version: v1
+    fieldSpecs:
+      - path: spec/valuesFrom/name
+        kind: HelmRelease

apps/authelia/base/namespace.yaml

@@ -0,0 +1,5 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: authelia
+  namespace: authelia

apps/authelia/base/object-store.yaml

@@ -0,0 +1,20 @@
+apiVersion: barmancloud.cnpg.io/v1
+kind: ObjectStore
+metadata:
+  name: garage-store
+  namespace: authelia
+spec:
+  configuration:
+    destinationPath: s3://cnpg-backup/authelia
+    s3Credentials:
+      accessKeyId:
+        name: s3-garage
+        key: ACCESS_KEY_ID
+      secretAccessKey:
+        name: s3-garage
+        key: ACCESS_SECRET_KEY
+      region:
+        name: s3-garage
+        key: REGION
+    wal:
+      compression: gzip

apps/authelia/base/secret-s3-garage.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: s3-garage
+  namespace: authelia
+  annotations:
+    reflector.v1.k8s.emberstack.com/reflects: "cnpg-system/s3-garage"
+type: Opaque
+data: {}

apps/authelia/base/service-user.yaml

@@ -0,0 +1,6 @@
+apiVersion: lldap.huizinga.dev/v1
+kind: ServiceUser
+metadata:
+  name: authelia
+  namespace: authelia
+spec: {}

apps/authelia/base/values.yaml

@@ -0,0 +1,61 @@
+pod:
+  kind: Deployment
+  replicas: 2
+ingress:
+  enabled: true
+  gatewayAPI:
+    enabled: true
+    parentRefs:
+      - name: gateway
+        namespace: default
+
+secret:
+  additionalSecrets:
+    db-app:
+      key: db-app
+    authelia-lldap-credentials:
+      key: authelia-lldap-credentials
+
+configMap:
+  authentication_backend:
+    ldap:
+      enabled: true
+      implementation: lldap
+      address: ldap://lldap.lldap.svc.cluster.local:3890
+      base_dn: dc=huizinga,dc=dev
+      additional_users_dn: ou=people
+      users_filter: "(&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))"
+      additional_groups_dn: ou=groups
+      groups_filter: "(member={dn})"
+      attributes:
+        display_name: displayName
+        username: uid
+        group_name: cn
+        mail: mail
+      user: uid=authelia.authelia,ou=people,dc=huizinga,dc=dev
+      password:
+        secret_name: authelia-lldap-credentials
+        path: password
+
+  session:
+    redis:
+      enabled: true
+      host: dragonfly.authelia
+
+  storage:
+    postgres:
+      enabled: true
+      address: tcp://db-rw.authelia:5432
+      database: app
+      username: app
+      password:
+        secret_name: db-app
+        path: password
+
+  notifier:
+    filesystem:
+      enabled: true
+
+  access_control:
+    secret:
+      existingSecret: authelia-acl

apps/authelia/production/cluster.yaml

@@ -0,0 +1,6 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: db
+spec:
+  instances: 2

apps/authelia/production/dragonfly.yaml

@@ -0,0 +1,7 @@
+apiVersion: dragonflydb.io/v1alpha1
+kind: Dragonfly
+metadata:
+  name: dragonfly
+  namespace: authelia
+spec:
+  replicas: 2

apps/authelia/production/kustomization.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+  - dragonfly.yaml
+
+patches:
+  - path: cluster.yaml
+    target:
+      kind: Cluster
+
+configMapGenerator:
+  - name: values-overlay
+    namespace: authelia
+    files:
+      - values.yaml

apps/authelia/production/values.yaml

@@ -0,0 +1,8 @@
+pod:
+  replicas: 2
+
+configMap:
+  session:
+    cookies:
+      - subdomain: auth
+        domain: huizinga.dev

apps/authelia/staging/cluster.yaml

@@ -0,0 +1,6 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: db
+spec:
+  instances: 1

apps/authelia/staging/dragonfly.yaml

@@ -0,0 +1,7 @@
+apiVersion: dragonflydb.io/v1alpha1
+kind: Dragonfly
+metadata:
+  name: dragonfly
+  namespace: authelia
+spec:
+  replicas: 1

apps/authelia/staging/kustomization.yaml

@@ -0,0 +1,19 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+  - dragonfly.yaml
+
+patches:
+  - path: cluster.yaml
+    target:
+      kind: Cluster
+  - path: object-store.yaml
+    target:
+      kind: ObjectStore
+
+configMapGenerator:
+  - name: values-overlay
+    namespace: authelia
+    files:
+      - values.yaml

apps/authelia/staging/object-store.yaml

@@ -0,0 +1,8 @@
+apiVersion: barmancloud.cnpg.io/v1
+kind: ObjectStore
+metadata:
+  name: garage-store
+  namespace: lldap
+spec:
+  configuration:
+    endpointURL: http://192.168.1.1:3900

apps/authelia/staging/values.yaml

@@ -0,0 +1,11 @@
+pod:
+  replicas: 1
+
+configMap:
+  log:
+    level: debug
+
+  session:
+    cookies:
+      - subdomain: auth
+        domain: staging.huizinga.dev

apps/lldap/base/cluster-restore.yaml

@@ -0,0 +1,16 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: db
+spec:
+  bootstrap:
+    recovery:
+      source: source
+  externalClusters:
+    - name: source
+      plugin:
+        name: barman-cloud.cloudnative-pg.io
+        parameters:
+          barmanObjectName: garage-store
+          serverName: db
+  plugins: []

apps/lldap/base/cluster.yaml

@@ -0,0 +1,15 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: db
+  namespace: lldap
+  # TODO: Add labels?
+spec:
+  storage:
+    size: 8Gi
+    storageClass: local-path
+  plugins:
+    - name: barman-cloud.cloudnative-pg.io
+      isWALArchiver: true
+      parameters:
+        barmanObjectName: garage-store

apps/lldap/base/deployment.yaml

@@ -0,0 +1,80 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: lldap
+  namespace: lldap
+  labels:
+    app.kubernetes.io/name: lldap
+    app.kubernetes.io/instance: lldap
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: lldap
+      app.kubernetes.io/instance: lldap
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: lldap
+        app.kubernetes.io/instance: lldap
+    spec:
+      topologySpreadConstraints:
+        - maxSkew: 1
+          topologyKey: kubernetes.io/hostname
+          whenUnsatisfiable: DoNotSchedule
+          labelSelector:
+            matchLabels:
+              app.kubernetes.io/name: lldap
+              app.kubernetes.io/instance: lldap
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        runAsGroup: 1000
+        fsGroup: 1000
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: lldap
+          image: lldap/lldap:2025-12-12-alpine-rootless
+          env:
+            - name: LLDAP_LDAP_BASE_DN
+              value: dc=huizinga,dc=dev
+            - name: LLDAP_LDAP_USER_PASS
+              valueFrom:
+                secretKeyRef:
+                  name: credentials
+                  key: admin-pass
+            - name: LLDAP_KEY_SEED
+              valueFrom:
+                secretKeyRef:
+                  name: credentials
+                  key: key-seed
+            - name: LLDAP_JWT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: credentials
+                  key: jwt-secret
+            - name: LLDAP_DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: db-app
+                  key: uri
+            - name: TZ
+              value: CET
+          livenessProbe:
+            exec:
+              command:
+                - /app/lldap
+                - healthcheck
+            initialDelaySeconds: 5
+            periodSeconds: 30
+          ports:
+            - name: ldap
+              containerPort: 3890
+            - name: web
+              containerPort: 17170
+          securityContext:
+            allowPrivilegeEscalation: false
+            runAsNonRoot: true
+            capabilities:
+              drop:
+                - ALL

apps/lldap/base/http-route.yaml

@@ -0,0 +1,13 @@
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: HTTPRoute
+metadata:
+  name: lldap
+  namespace: lldap
+spec:
+  parentRefs:
+    - name: gateway
+      namespace: default
+  rules:
+    - backendRefs:
+        - name: lldap
+          port: 17170

apps/lldap/base/kustomization.yaml

@@ -0,0 +1,17 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - cluster.yaml
+  - schedule-backup.yaml
+  - deployment.yaml
+  - service.yaml
+  - http-route.yaml
+  - secret-s3-garage.yaml
+  - object-store.yaml
+
+# Uncomment to restore database from backup
+# patches:
+#   - path: cluster-restore.yaml
+#     target:
+#       kind: Cluster

apps/lldap/base/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: lldap

apps/lldap/base/object-store.yaml

@@ -0,0 +1,20 @@
+apiVersion: barmancloud.cnpg.io/v1
+kind: ObjectStore
+metadata:
+  name: garage-store
+  namespace: lldap
+spec:
+  configuration:
+    destinationPath: s3://cnpg-backup/lldap
+    s3Credentials:
+      accessKeyId:
+        name: s3-garage
+        key: ACCESS_KEY_ID
+      secretAccessKey:
+        name: s3-garage
+        key: ACCESS_SECRET_KEY
+      region:
+        name: s3-garage
+        key: REGION
+    wal:
+      compression: gzip

apps/lldap/base/schedule-backup.yaml

@@ -0,0 +1,13 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: ScheduledBackup
+metadata:
+  name: daily-backup
+  namespace: lldap
+spec:
+  schedule: "0 0 0 * * *"
+  backupOwnerReference: self
+  method: plugin
+  pluginConfiguration:
+    name: barman-cloud.cloudnative-pg.io
+  cluster:
+    name: db

apps/lldap/base/secret-s3-garage.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: s3-garage
+  namespace: lldap
+  annotations:
+    reflector.v1.k8s.emberstack.com/reflects: "cnpg-system/s3-garage"
+type: Opaque
+data: {}

apps/lldap/base/service.yaml

@@ -0,0 +1,19 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: lldap
+  namespace: lldap
+  labels:
+    app.kubernetes.io/name: lldap
+    app.kubernetes.io/instance: lldap
+spec:
+  selector:
+    app.kubernetes.io/name: lldap
+    app.kubernetes.io/instance: lldap
+  ports:
+    - name: ldap
+      port: 3890
+      targetPort: ldap
+    - name: web
+      port: 17170
+      targetPort: web

apps/lldap/lldap.yaml

@@ -0,0 +1,21 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: lldap
+  namespace: flux-system
+spec:
+  interval: 1h
+  retryInterval: 2m
+  timeout: 5m
+  dependsOn:
+    - name: cnpg
+  sourceRef:
+    kind: ExternalArtifact
+    name: lldap
+  decryption:
+    provider: sops
+    secretRef:
+      name: sops-gpg
+  path: ./${cluster_env}
+  prune: true
+  wait: true

apps/lldap/production/cluster.yaml

@@ -0,0 +1,6 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: db
+spec:
+  instances: 2

apps/lldap/production/deployment.yaml

@@ -0,0 +1,7 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: lldap
+  namespace: lldap
+spec:
+  replicas: 2

apps/lldap/production/http-route.yaml

@@ -0,0 +1,8 @@
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: HTTPRoute
+metadata:
+  name: lldap
+  namespace: lldap
+spec:
+  hostnames:
+    - "users.huizinga.dev"

apps/lldap/production/kustomization.yaml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+  - secret-credentials.enc.yaml
+patches:
+  - path: deployment.yaml
+    target:
+      kind: Deployment
+  - path: cluster.yaml
+    target:
+      kind: Cluster
+  - path: http-route.yaml
+    target:
+      kind: HTTPRoute

apps/lldap/production/secret-credentials.enc.yaml

@@ -0,0 +1,59 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: credentials
+    namespace: lldap
+    labels:
+        app.kubernetes.io/name: lldap
+        app.kubernetes.io/instance: lldap
+type: Opaque
+data:
+    jwt-secret: ENC[AES256_GCM,data:yUAsoCIEXH491Ko4wEAAevSETdMFuhypNzuU2th5zlLd9hbVKqsjclvCTLDD8aW0Y9Lv70pzzAADPwFCKNH/rXx0DzaGOP139kLRYDHafz3RYeuoJjgBGw==,iv:x3EmPbbL/aj9CbwF8lleDL+nhlidPU8R3hwXygtj7D8=,tag:XD4C/pwFLFmDryBW7NqsWg==,type:str]
+    key-seed: ENC[AES256_GCM,data:3jWLtfny+ahtSkkmUdbg+wFbSGIcCxOv9BxVr0oNLTetXrAx+OcZ6dKp1ktj0J9aYEppqVuANUlfqyVzhIQXOT5GomQ+9jPC4uLmIz9tu1LAcfv9zuGl/w==,iv:e3aAI6JWq16YaUZqvKulkHyhLb8eWy9t2ni/jGeNFow=,tag:sZEEvxlq145klFkEMsUOuA==,type:str]
+    #ENC[AES256_GCM,data:AnCuvbVM6M62wuWmpUx3u/5WdaCo1T7eCvbY30okKbmWnvM0HQT2gGDTuhIaOlc=,iv:Ho+/CAvs69VJ+uwAIH8LVL344qlDaK5z3AvzWh/Jgm0=,tag:uNfN1P7lmWKBuCY7eiywDw==,type:comment]
+    admin-pass: ENC[AES256_GCM,data:yWzQTjN8kuGroShan7NxAw==,iv:IHw237PAqNNZ7KXIy2D8XMCLWSi3kJpLEnILhGm/Xl4=,tag:N79GjKNZNh9qJO+dpa0InQ==,type:str]
+sops:
+    age:
+        - recipient: age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCdVFuM2xvazBXY3kwTXVD
+            ZXdOS0pJLzVTVGJBb3RqYlhUN2IvNDNRSzNzCm8zcmlIU2h3RityUWFkZXU1R2xp
+            VUlobGZuOG1wbGxIMXVVekRaYTNGQUkKLS0tIHlMWkI0Qk9nUys1Sm4yNnVsakho
+            ZXl2RDhNNFZORW5lOGphSVY5WVJycWMKvnGem7wolSKMa8lshD90bMohdLMgYiTq
+            gHRN22irgd4pA2CpTcY47T2zhtVHU36PCXn+QFN936uF0vLf8Srwow==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1hktythzvsnth6u5en2lvag0tftnj9r03w7rpnzfgzgf5w95qxycq2azufj
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkRHNUOXZFUGxEY0RRSGtz
+            OElnckFUVG1WOXhvZHhzczUxU3lZZlE5emo4Ck5qRnF6M1NCeGdkUVNuR0xzMWxs
+            SEdVL0lwOXJmWVdEZ0t3V2Jscy9lZG8KLS0tIGM0WC8vbEdHQ2puRVZIK3lXeUJJ
+            OVNqZnhRUEN5dTBBVXVlSDlidEU4K3cKhv2jSc+lJu+s3hbH6j1xrkaQSzds82rk
+            dlaisVQxQmxjKcyPHqudJZS6Qfq3kEn9cZOP4G8NYAh0zhzGvCKeqA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-17T02:58:02Z"
+    mac: ENC[AES256_GCM,data:yxmBIqS+KMr2Dp4eKslT1oNCcq2VEnGh4g3e7mkZzWjT6xPTdBEH8bT+c2XIFMWHJSUFoI7YyhvS1p5VgRBudaDyQCOk7tzyj0nkGiepZc1uYjSVO7VQ9CnfcdiD9AZ2srUjkcUoBaRfi2u6Qh2pPUUwMd4z8ms8v0CSk1qw0FE=,iv:V2rw624TN+pSGuq+JjVqM2bKozn7hGAykHV+638wo14=,tag:cdDascdYzzG33GztMd0Fdg==,type:str]
+    pgp:
+        - created_at: "2025-12-17T00:53:29Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA51kG++kLewoAQ/7BepX/31nKyUHnKC/7VnqTJk0x/gLmhko1/NukkApraXe
+            ctmZVk4TlG9N+DqEPHUYeMt7pu/1rvnWckh/OR2JU7AK8E33tnWITvr4AzQjk0zH
+            /V8n36ZA5/8Ppt9LJJSMVLaFEFjqiFy39Ggt6bx0SUX/CczTGkUYp+aJQfmDn+uR
+            GcJk9wR9/bu7+iOq8kuOA+renxGmdIcfMd6GKiHYScgv5tDN7pg7upXh1NPrVB8u
+            3GTor40B1Ncjqv3L1Zbw1AZYdsmFRkSx1N2JJkxPZYbvI6cwuFMcFkXuX6JfuL8T
+            pW5ddsK/DF0qXAXSc378juOh/tRdktFz2QPv9X5CJnQUk0c19Beqb4tG4cVR9sF3
+            SXTpaNmR4GG3ilY3ispzso7CQe+7RvLWGgsZAgPD1uC9SJGOBfvReJvQZUXyxUGo
+            /riTbUgFaBHmY6XWGy7Ecni333GtfGeN8qSIgPRhHg5f/BJX9Rp5ZG373S7iLuI4
+            GpM12knQCjxfsMXjMs6/TtAwYhnIFG3WcCzJFzn+pqBiW7XJvegJPQAID5LDo4GG
+            EzCZylto1WCgRhdq+CNuybQTsj4TbvxzfPYf+gCURbisH8A3TTWp4eyyXHg5KS4z
+            0TECkXpUXR/sD71HuBjxz1jfZiXFruDBldZDzZ2tZDdqQxAtk/DJGXcLmWF+HMbS
+            XgEvCI5gci7pYlsi60yitBcTPV2eEBh4zbRV53e12RGuhPwkxenX+6YRSCi0liOk
+            5BizeCkfSRCLQHG1okeb1RIdnSoyOJ+KlrR4Y+1xeZp9ruWn/tPN7L3jCx8SX+Y=
+            =j+fd
+            -----END PGP MESSAGE-----
+          fp: CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

apps/lldap/staging/cluster.yaml

@@ -0,0 +1,6 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: db
+spec:
+  instances: 1

apps/lldap/staging/deployment.yaml

@@ -0,0 +1,7 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: lldap
+  namespace: lldap
+spec:
+  replicas: 1

apps/lldap/staging/http-route.yaml

@@ -0,0 +1,8 @@
+apiVersion: gateway.networking.k8s.io/v1beta1
+kind: HTTPRoute
+metadata:
+  name: lldap
+  namespace: lldap
+spec:
+  hostnames:
+    - "users.staging.huizinga.dev"

apps/lldap/staging/kustomization.yaml

@@ -0,0 +1,18 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../base
+  - secret-credentials.enc.yaml
+patches:
+  - path: deployment.yaml
+    target:
+      kind: Deployment
+  - path: cluster.yaml
+    target:
+      kind: Cluster
+  - path: object-store.yaml
+    target:
+      kind: ObjectStore
+  - path: http-route.yaml
+    target:
+      kind: HTTPRoute

apps/lldap/staging/object-store.yaml

@@ -0,0 +1,8 @@
+apiVersion: barmancloud.cnpg.io/v1
+kind: ObjectStore
+metadata:
+  name: garage-store
+  namespace: lldap
+spec:
+  configuration:
+    endpointURL: http://192.168.1.1:3900

apps/lldap/staging/secret-credentials.enc.yaml

@@ -0,0 +1,58 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: credentials
+    namespace: lldap
+    labels:
+        app.kubernetes.io/name: lldap
+        app.kubernetes.io/instance: lldap
+type: Opaque
+data:
+    jwt-secret: ENC[AES256_GCM,data:cwKfSMzPPECNAba++x5ampK0pgCvOKRIEdPfLH5deDpnEASSlBjQZVo238YepBIAYu7Y0HCXCPppOtpX8zymD7Jxu1f5TrJoOJMwAlHYWT+IeBRVtpzgYA==,iv:bkNDqEriEnuSzvXxXAypGfwynPjYCVwN0NoAmcDftUc=,tag:DFkoIf92W8Ed60+azsfU+A==,type:str]
+    key-seed: ENC[AES256_GCM,data:bLpK9Tk5Eh2WBI5x94MssCyYEsMUMTJJymbdwsVeA6K/qBCxkPGkXf+kZZoaXkyLqW2lrPa8jIGv3LV6C4PqVJ+UOlgnvagQnCGnLylqX+3wkVhKLP5uYg==,iv:1RPLzof2Fwqm08Tfq7HR2esvPvkfBg0Uc+aM2SzpHhE=,tag:IsgLxUQriU9JUX2gEe/j8A==,type:str]
+    admin-pass: ENC[AES256_GCM,data:yWzQTjN8kuGroShan7NxAw==,iv:IHw237PAqNNZ7KXIy2D8XMCLWSi3kJpLEnILhGm/Xl4=,tag:N79GjKNZNh9qJO+dpa0InQ==,type:str]
+sops:
+    age:
+        - recipient: age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCdVFuM2xvazBXY3kwTXVD
+            ZXdOS0pJLzVTVGJBb3RqYlhUN2IvNDNRSzNzCm8zcmlIU2h3RityUWFkZXU1R2xp
+            VUlobGZuOG1wbGxIMXVVekRaYTNGQUkKLS0tIHlMWkI0Qk9nUys1Sm4yNnVsakho
+            ZXl2RDhNNFZORW5lOGphSVY5WVJycWMKvnGem7wolSKMa8lshD90bMohdLMgYiTq
+            gHRN22irgd4pA2CpTcY47T2zhtVHU36PCXn+QFN936uF0vLf8Srwow==
+            -----END AGE ENCRYPTED FILE-----
+        - recipient: age1hktythzvsnth6u5en2lvag0tftnj9r03w7rpnzfgzgf5w95qxycq2azufj
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkRHNUOXZFUGxEY0RRSGtz
+            OElnckFUVG1WOXhvZHhzczUxU3lZZlE5emo4Ck5qRnF6M1NCeGdkUVNuR0xzMWxs
+            SEdVL0lwOXJmWVdEZ0t3V2Jscy9lZG8KLS0tIGM0WC8vbEdHQ2puRVZIK3lXeUJJ
+            OVNqZnhRUEN5dTBBVXVlSDlidEU4K3cKhv2jSc+lJu+s3hbH6j1xrkaQSzds82rk
+            dlaisVQxQmxjKcyPHqudJZS6Qfq3kEn9cZOP4G8NYAh0zhzGvCKeqA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2025-12-17T00:53:29Z"
+    mac: ENC[AES256_GCM,data:6/I2J7u9fGUdz2SbAF7dL2j5XQMICx+AgEaUQ3HUN/RvlhMzn9J3EdcLFQ+d9YwbSpCzuGTQBfqsky2oaD6fQWWefCOXAVdElCp2rxHAGK9u2pqhPbgcvbHKAWfvK2kml8qhjjam346xpj2yeP8UdWq6+KZq8B5OBsKYtx4KuKM=,iv:EeLpcggrglMvpUdjvH6rOyNRj2EkuToIwc+uEPUnlvI=,tag:juTwo5RbhGnddB3MF3WirQ==,type:str]
+    pgp:
+        - created_at: "2025-12-17T00:53:29Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA51kG++kLewoAQ/7BepX/31nKyUHnKC/7VnqTJk0x/gLmhko1/NukkApraXe
+            ctmZVk4TlG9N+DqEPHUYeMt7pu/1rvnWckh/OR2JU7AK8E33tnWITvr4AzQjk0zH
+            /V8n36ZA5/8Ppt9LJJSMVLaFEFjqiFy39Ggt6bx0SUX/CczTGkUYp+aJQfmDn+uR
+            GcJk9wR9/bu7+iOq8kuOA+renxGmdIcfMd6GKiHYScgv5tDN7pg7upXh1NPrVB8u
+            3GTor40B1Ncjqv3L1Zbw1AZYdsmFRkSx1N2JJkxPZYbvI6cwuFMcFkXuX6JfuL8T
+            pW5ddsK/DF0qXAXSc378juOh/tRdktFz2QPv9X5CJnQUk0c19Beqb4tG4cVR9sF3
+            SXTpaNmR4GG3ilY3ispzso7CQe+7RvLWGgsZAgPD1uC9SJGOBfvReJvQZUXyxUGo
+            /riTbUgFaBHmY6XWGy7Ecni333GtfGeN8qSIgPRhHg5f/BJX9Rp5ZG373S7iLuI4
+            GpM12knQCjxfsMXjMs6/TtAwYhnIFG3WcCzJFzn+pqBiW7XJvegJPQAID5LDo4GG
+            EzCZylto1WCgRhdq+CNuybQTsj4TbvxzfPYf+gCURbisH8A3TTWp4eyyXHg5KS4z
+            0TECkXpUXR/sD71HuBjxz1jfZiXFruDBldZDzZ2tZDdqQxAtk/DJGXcLmWF+HMbS
+            XgEvCI5gci7pYlsi60yitBcTPV2eEBh4zbRV53e12RGuhPwkxenX+6YRSCi0liOk
+            5BizeCkfSRCLQHG1okeb1RIdnSoyOJ+KlrR4Y+1xeZp9ruWn/tPN7L3jCx8SX+Y=
+            =j+fd
+            -----END PGP MESSAGE-----
+          fp: CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9
+    encrypted_regex: ^(data|stringData)$
+    version: 3.11.0

clusters/testing/kustomization.yaml

@@ -10,6 +10,10 @@ resources:
   - ../../controllers/local-path-provisioner/local-path-provisioner.yaml
   - ../../controllers/cnpg/cnpg.yaml
   - ../../controllers/reflector/reflector.yaml
+  - ../../controllers/lldap-controller/lldap-controller.yaml
+  - ../../controllers/authelia-controller/authelia-controller.yaml
+  - ../../controllers/dragonfly-operator/dragonfly-operator.yaml
+  - ../../controllers/kube-prometheus-stack/kube-prometheus-stack.yaml
 
   - ../../configs/artifacts.yaml
   - ../../configs/cilium-config/cilium-config.yaml
@@ -19,3 +23,5 @@ resources:
 
   - ../../apps/artifacts.yaml
   - ../../apps/spegel/spegel.yaml
+  - ../../apps/lldap/lldap.yaml
+  - ../../apps/authelia/authelia.yaml

controllers/artifacts.yaml

@@ -44,3 +44,13 @@ spec:
       copy:
         - from: "@foundation/controllers/reflector/**"
           to: "@artifact/"
+    - name: dragonfly-operator
+      originRevision: "@foundation"
+      copy:
+        - from: "@foundation/controllers/dragonfly-operator/**"
+          to: "@artifact/"
+    - name: kube-prometheus-stack
+      originRevision: "@foundation"
+      copy:
+        - from: "@foundation/controllers/kube-prometheus-stack/**"
+          to: "@artifact/"

controllers/authelia-controller/authelia-controller.yaml

@@ -0,0 +1,26 @@
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: OCIRepository
+metadata:
+  name: authelia-controller
+  namespace: flux-system
+spec:
+  interval: 1m0s
+  url: oci://git.huizinga.dev/infra/authelia-controller/manifests
+  ref:
+    tag: edge
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: authelia-controller
+  namespace: flux-system
+spec:
+  interval: 1h
+  retryInterval: 2m
+  timeout: 5m
+  sourceRef:
+    kind: OCIRepository
+    name: authelia-controller
+  path: ./
+  prune: true
+  wait: true

controllers/cert-manager/helm-release.yaml

@@ -13,9 +13,14 @@ spec:
     strategy:
       name: RetryOnFailure
       retryInterval: 3m
-  chartRef:
+  chart:
-    kind: OCIRepository
+    spec:
-    name: cert-manager
+      chart: cert-manager
+      version: "1.19.x"
+      sourceRef:
+        kind: HelmRepository
+        name: cert-manager
+      interval: 24h
   values:
     crds:
       enabled: true

controllers/cert-manager/helm-repository.yaml

@@ -0,0 +1,9 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  type: "oci"
+  interval: 24h
+  url: oci://quay.io/jetstack/charts/

controllers/cert-manager/kustomization.yaml

@@ -1,6 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - ./namespace.yaml
+  - namespace.yaml
-  - ./oci-repository.yaml
+  - helm-repository.yaml
-  - ./helm-release.yaml
+  - helm-release.yaml

controllers/cert-manager/oci-repository.yaml

@@ -1,13 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: OCIRepository
-metadata:
-  name: cert-manager
-  namespace: cert-manager
-spec:
-  interval: 24h
-  url: oci://quay.io/jetstack/charts/cert-manager
-  layerSelector:
-    mediaType: "application/vnd.cncf.helm.chart.content.v1.tar+gzip"
-    operation: copy
-  ref:
-    semver: "1.19.x"

controllers/dragonfly-operator/dragonfly-operator.yaml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: dragonfly-operator
+  namespace: flux-system
+spec:
+  interval: 1h
+  retryInterval: 2m
+  timeout: 5m
+  sourceRef:
+    kind: ExternalArtifact
+    name: dragonfly-operator
+  path: .
+  prune: true
+  wait: true

controllers/dragonfly-operator/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - https://raw.githubusercontent.com/dragonflydb/dragonfly-operator/v1.3.1/manifests/dragonfly-operator.yaml

controllers/kube-prometheus-stack/cluster-restore.yaml

@@ -0,0 +1,16 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: db
+spec:
+  bootstrap:
+    recovery:
+      source: source
+  externalClusters:
+    - name: source
+      plugin:
+        name: barman-cloud.cloudnative-pg.io
+        parameters:
+          barmanObjectName: garage-store
+          serverName: db
+  plugins: []

controllers/kube-prometheus-stack/cluster.yaml

@@ -0,0 +1,15 @@
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: db
+  namespace: monitoring
+  # TODO: Add labels?
+spec:
+  storage:
+    size: 8Gi
+    storageClass: local-path
+  plugins:
+    - name: barman-cloud.cloudnative-pg.io
+      isWALArchiver: true
+      parameters:
+        barmanObjectName: garage-store

controllers/kube-prometheus-stack/dragonfly.yaml

@@ -0,0 +1,7 @@
+apiVersion: dragonflydb.io/v1alpha1
+kind: Dragonfly
+metadata:
+  name: dragonfly
+  namespace: monitoring
+spec:
+  replicas: 1

controllers/kube-prometheus-stack/grafana-ldap.toml

@@ -0,0 +1,53 @@
+# This is only the ldap config, you also need to enable ldap support in the main config file
+# of Grafana. See https://grafana.com/docs/grafana/latest/auth/ldap/#enable-ldap
+# You can test that it is working correctly by trying usernames at: https://<your grafana instance>/admin/ldap
+
+[[servers]]
+# Ldap server host (specify multiple hosts space separated)
+host = "lldap.lldap.svc.cluster.local"
+# Default port is 389 or 636 if use_ssl = true
+port = 3890
+# Set to true if LDAP server should use an encrypted TLS connection (either with STARTTLS or LDAPS)
+use_ssl = false
+# If set to true, use LDAP with STARTTLS instead of LDAPS
+start_tls = false
+# set to true if you want to skip SSL cert validation
+ssl_skip_verify = false
+# set to the path to your root CA certificate or leave unset to use system defaults
+# root_ca_cert = "/path/to/certificate.crt"
+# Authentication against LDAP servers requiring client certificates
+# client_cert = "/path/to/client.crt"
+# client_key = "/path/to/client.key"
+
+# Search user bind dn
+bind_dn = "${BIND_DN}"
+# Search user bind password
+# If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;"""
+bind_password = "${LDAP_PASSWORD}"
+
+# User search filter
+search_filter = "(&(|(uid=%s)(mail=%s))(objectClass=person))"
+# If you want to limit to only users of a specific group use this instead:
+# search_filter = "(&(uid=%s)(memberOf=cn=<your group>,ou=groups,dc=huizinga,dc=dev))"
+
+# An array of base dns to search through
+search_base_dns = ["dc=huizinga,dc=dev"]
+
+# Specify names of the LDAP attributes your LDAP uses
+[servers.attributes]
+member_of = "memberOf"
+email = "mail"
+name = "givenName"
+surname = "sn"
+username = "uid"
+
+# If you want to map your ldap groups to grafana's groups, see: https://grafana.com/docs/grafana/latest/auth/ldap/#group-mappings
+# As a quick example, here is how you would map lldap's admin group to grafana's admin
+[[servers.group_mappings]]
+group_dn = "cn=lldap_admin,ou=groups,dc=huizinga,dc=dev"
+org_role = "Admin"
+grafana_admin = true
+
+[[servers.group_mappings]]
+group_dn = "*"
+org_role = "Viewer"

controllers/kube-prometheus-stack/helm-release.yaml

@@ -0,0 +1,30 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: kube-prometheus-stack
+  namespace: monitoring
+spec:
+  interval: 12h
+  install:
+    strategy:
+      name: RetryOnFailure
+      retryInterval: 2m
+  upgrade:
+    strategy:
+      name: RetryOnFailure
+      retryInterval: 3m
+  chart:
+    spec:
+      chart: kube-prometheus-stack
+      version: "80.6.x"
+      sourceRef:
+        kind: HelmRepository
+        name: prometheus-community
+      interval: 24h
+  values:
+    grafana:
+      ldap:
+        existingSecret: grafana-ldap-toml
+  valuesFrom:
+    - kind: ConfigMap
+      name: values-base

controllers/kube-prometheus-stack/helm-repository.yaml

@@ -0,0 +1,9 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: prometheus-community
+  namespace: monitoring
+spec:
+  type: "oci"
+  interval: 24h
+  url: oci://ghcr.io/prometheus-community/charts/

controllers/kube-prometheus-stack/kube-prometheus-stack.yaml

@@ -0,0 +1,18 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: kube-prometheus-stack
+  namespace: flux-system
+spec:
+  interval: 1h
+  retryInterval: 2m
+  timeout: 5m
+  dependsOn:
+    - name: dragonfly-operator
+    - name: lldap-controller
+  sourceRef:
+    kind: ExternalArtifact
+    name: kube-prometheus-stack
+  path: ./
+  prune: true
+  wait: true

controllers/kube-prometheus-stack/kustomization.yaml

@@ -0,0 +1,32 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - helm-repository.yaml
+  - helm-release.yaml
+  - dragonfly.yaml
+  - cluster.yaml
+  - secret-s3-garage.yaml
+  - object-store.yaml
+  - service-user.yaml
+
+configurations:
+  - name-reference.yaml
+
+configMapGenerator:
+  - name: values-base
+    namespace: monitoring
+    files:
+      - values.yaml
+
+secretGenerator:
+  - name: grafana-ldap-toml
+    namespace: monitoring
+    files:
+      - ldap-toml=grafana-ldap.toml
+
+# Uncomment to restore database from backup
+# patches:
+#   - path: cluster-restore.yaml
+#     target:
+#       kind: Cluster

controllers/kube-prometheus-stack/name-reference.yaml

@@ -0,0 +1,11 @@
+nameReference:
+  - kind: ConfigMap
+    version: v1
+    fieldSpecs:
+      - path: spec/valuesFrom/name
+        kind: HelmRelease
+  - kind: Secret
+    version: v1
+    fieldSpecs:
+      - path: spec/values/grafana/ldap/existingSecret
+        kind: HelmRelease

controllers/kube-prometheus-stack/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: monitoring

controllers/kube-prometheus-stack/object-store.yaml

@@ -0,0 +1,20 @@
+apiVersion: barmancloud.cnpg.io/v1
+kind: ObjectStore
+metadata:
+  name: garage-store
+  namespace: monitoring
+spec:
+  configuration:
+    destinationPath: s3://cnpg-backup/authelia
+    s3Credentials:
+      accessKeyId:
+        name: s3-garage
+        key: ACCESS_KEY_ID
+      secretAccessKey:
+        name: s3-garage
+        key: ACCESS_SECRET_KEY
+      region:
+        name: s3-garage
+        key: REGION
+    wal:
+      compression: gzip

controllers/kube-prometheus-stack/secret-s3-garage.yaml

@@ -0,0 +1,9 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: s3-garage
+  namespace: monitoring
+  annotations:
+    reflector.v1.k8s.emberstack.com/reflects: "cnpg-system/s3-garage"
+type: Opaque
+data: {}

controllers/kube-prometheus-stack/service-user.yaml

@@ -0,0 +1,6 @@
+apiVersion: lldap.huizinga.dev/v1
+kind: ServiceUser
+metadata:
+  name: grafana
+  namespace: monitoring
+spec: {}

controllers/kube-prometheus-stack/values.yaml

@@ -0,0 +1,86 @@
+alertmanager:
+  alertsmanagerSpec:
+    replicas: 1
+  route:
+    main:
+      enabled: true
+      hostnames:
+        - "alerts.staging.huizinga.dev"
+      parentRefs:
+        - name: gateway
+          namespace: default
+
+prometheus:
+  prometheusSpec:
+    replicas: 1
+  route:
+    main:
+      enabled: true
+      hostnames:
+        - "prometheus.staging.huizinga.dev"
+      parentRefs:
+        - name: gateway
+          namespace: default
+
+grafana:
+  replicas: 1
+
+  # ingress:
+  #   enabled: true
+  #   hosts:
+  #     - grafana.${domain}
+  #   tls:
+  #     - secretName: ${domain//./-}-tls
+  #   annotations:
+  #     traefik.ingress.kubernetes.io/router.entryPoints: "websecure"
+  #     traefik.ingress.kubernetes.io/router.middlewares: "authelia-forwardauth-authelia@kubernetescrd"
+  #     traefik.ingress.kubernetes.io/router.tls: "true"
+
+  envValueFrom:
+    BIND_DN:
+      secretKeyRef:
+        name: grafana-lldap-credentials
+        key: bind_dn
+    LDAP_PASSWORD:
+      secretKeyRef:
+        name: grafana-lldap-credentials
+        key: password
+
+  grafana.ini:
+    auth.ldap:
+      enabled: true
+
+    # auth.proxy:
+    #   enabled: true
+    #   header_name: Remote-User
+    #   header_property: username
+    #   auto_sign_up: true
+    #   headers: Groups:Remote-Group
+    #   enable_login_token: false
+    #   sync_ttl: 0
+    #   signout_redirect_url: https://login.${domain}/logout?rd=https://grafana.${domain}
+
+    database:
+      type: postgres
+      host: $__file{/etc/secrets/db/host}
+      name: $__file{/etc/secrets/db/dbname}
+      user: $__file{/etc/secrets/db/user}
+      password: $__file{/etc/secrets/db/password}
+
+    remote_cache:
+      type: redis
+      connstr: addr=dragonflydb.monitoring:6379
+
+  ldap:
+    enabled: true
+
+  extraSecretMounts:
+    - name: db-app-mount
+      secretName: db-app
+      defaultMode: 0440
+      mountPath: /etc/secrets/db
+      readOnly: true
+
+# We are not running kube-proxy
+kubeProxy:
+  enabled: false

controllers/lldap-controller/lldap-controller.yaml

@@ -0,0 +1,28 @@
+apiVersion: source.toolkit.fluxcd.io/v1beta2
+kind: OCIRepository
+metadata:
+  name: lldap-controller
+  namespace: flux-system
+spec:
+  interval: 1m0s
+  url: oci://git.huizinga.dev/infra/lldap-controller/manifests
+  ref:
+    tag: edge
+---
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: lldap-controller
+  namespace: flux-system
+spec:
+  interval: 1h
+  retryInterval: 2m
+  timeout: 5m
+  dependsOn:
+    - name: lldap
+  sourceRef:
+    kind: OCIRepository
+    name: lldap-controller
+  path: ./
+  prune: true
+  wait: true