feat: Put ClusterIssuer under certificates

feat: Added barman cloud plugin
2025-12-17 00:30:24 +01:00 · 2025-12-17 00:30:24 +01:00
95 changed files with 38 additions and 1346 deletions
--- a/apps/artifacts.yaml
+++ b/apps/artifacts.yaml
@@ -1,26 +0,0 @@
-apiVersion: source.extensions.fluxcd.io/v1beta1
-kind: ArtifactGenerator
-metadata:
-  name: apps
-  namespace: flux-system
-spec:
-  sources:
-    - alias: foundation
-      kind: GitRepository
-      name: flux-system
-  artifacts:
-    - name: spegel
-      originRevision: "@foundation"
-      copy:
-        - from: "@foundation/apps/spegel/**"
-          to: "@artifact/"
-    - name: lldap
-      originRevision: "@foundation"
-      copy:
-        - from: "@foundation/apps/lldap/**"
-          to: "@artifact/"
-    - name: authelia
-      originRevision: "@foundation"
-      copy:
-        - from: "@foundation/apps/authelia/**"
-          to: "@artifact/"
--- a/apps/authelia/authelia.yaml
+++ b/apps/authelia/authelia.yaml
@@ -1,20 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: authelia
-  namespace: flux-system
-spec:
-  interval: 1h
-  retryInterval: 2m
-  timeout: 5m
-  dependsOn:
-    - name: cnpg
-    - name: lldap-controller
-    - name: dragonfly-operator
-    - name: authelia-controller
-  sourceRef:
-    kind: ExternalArtifact
-    name: authelia
-  path: ./${cluster_env}
-  prune: true
-  wait: true
--- a/apps/authelia/base/cluster-restore.yaml
+++ b/apps/authelia/base/cluster-restore.yaml
@@ -1,16 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: db
-spec:
-  bootstrap:
-    recovery:
-      source: source
-  externalClusters:
-    - name: source
-      plugin:
-        name: barman-cloud.cloudnative-pg.io
-        parameters:
-          barmanObjectName: garage-store
-          serverName: db
-  plugins: []
--- a/apps/authelia/base/cluster.yaml
+++ b/apps/authelia/base/cluster.yaml
@@ -1,15 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: db
-  namespace: authelia
-  # TODO: Add labels?
-spec:
-  storage:
-    size: 8Gi
-    storageClass: local-path
-  plugins:
-    - name: barman-cloud.cloudnative-pg.io
-      isWALArchiver: true
-      parameters:
-        barmanObjectName: garage-store
--- a/apps/authelia/base/helm-release.yaml
+++ b/apps/authelia/base/helm-release.yaml
@@ -1,29 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: authelia
-  namespace: authelia
-spec:
-  interval: 12h
-  install:
-    strategy:
-      name: RetryOnFailure
-      retryInterval: 2m
-  upgrade:
-    strategy:
-      name: RetryOnFailure
-      retryInterval: 3m
-  chart:
-    spec:
-      chart: authelia
-      version: "0.10.x"
-      sourceRef:
-        kind: HelmRepository
-        name: authelia
-      interval: 24h
-  valuesFrom:
-    - kind: ConfigMap
-      name: values-base
-    - kind: ConfigMap
-      name: values-overlay
-      optional: true
--- a/apps/authelia/base/helm-repository.yaml
+++ b/apps/authelia/base/helm-repository.yaml
@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: authelia
-  namespace: authelia
-spec:
-  interval: 24h
-  url: https://charts.authelia.com
--- a/apps/authelia/base/kustomization.yaml
+++ b/apps/authelia/base/kustomization.yaml
@@ -1,25 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - namespace.yaml
-  - cluster.yaml
-  - service-user.yaml
-  - helm-repository.yaml
-  - helm-release.yaml
-  - secret-s3-garage.yaml
-  - object-store.yaml
-
-configurations:
-  - name-reference.yaml
-
-configMapGenerator:
-  - name: values-base
-    namespace: authelia
-    files:
-      - values.yaml
-
-# Uncomment to restore database from backup
-# patches:
-#   - path: cluster-restore.yaml
-#     target:
-#       kind: Cluster
--- a/apps/authelia/base/name-reference.yaml
+++ b/apps/authelia/base/name-reference.yaml
@@ -1,6 +0,0 @@
-nameReference:
-  - kind: ConfigMap
-    version: v1
-    fieldSpecs:
-      - path: spec/valuesFrom/name
-        kind: HelmRelease
--- a/apps/authelia/base/namespace.yaml
+++ b/apps/authelia/base/namespace.yaml
@@ -1,5 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: authelia
-  namespace: authelia
--- a/apps/authelia/base/object-store.yaml
+++ b/apps/authelia/base/object-store.yaml
@@ -1,20 +0,0 @@
-apiVersion: barmancloud.cnpg.io/v1
-kind: ObjectStore
-metadata:
-  name: garage-store
-  namespace: authelia
-spec:
-  configuration:
-    destinationPath: s3://cnpg-backup/authelia
-    s3Credentials:
-      accessKeyId:
-        name: s3-garage
-        key: ACCESS_KEY_ID
-      secretAccessKey:
-        name: s3-garage
-        key: ACCESS_SECRET_KEY
-      region:
-        name: s3-garage
-        key: REGION
-    wal:
-      compression: gzip
--- a/apps/authelia/base/secret-s3-garage.yaml
+++ b/apps/authelia/base/secret-s3-garage.yaml
@@ -1,9 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: s3-garage
-  namespace: authelia
-  annotations:
-    reflector.v1.k8s.emberstack.com/reflects: "cnpg-system/s3-garage"
-type: Opaque
-data: {}
--- a/apps/authelia/base/service-user.yaml
+++ b/apps/authelia/base/service-user.yaml
@@ -1,6 +0,0 @@
-apiVersion: lldap.huizinga.dev/v1
-kind: ServiceUser
-metadata:
-  name: authelia
-  namespace: authelia
-spec: {}
--- a/apps/authelia/base/values.yaml
+++ b/apps/authelia/base/values.yaml
@@ -1,61 +0,0 @@
-pod:
-  kind: Deployment
-  replicas: 2
-ingress:
-  enabled: true
-  gatewayAPI:
-    enabled: true
-    parentRefs:
-      - name: gateway
-        namespace: default
-
-secret:
-  additionalSecrets:
-    db-app:
-      key: db-app
-    authelia-lldap-credentials:
-      key: authelia-lldap-credentials
-
-configMap:
-  authentication_backend:
-    ldap:
-      enabled: true
-      implementation: lldap
-      address: ldap://lldap.lldap.svc.cluster.local:3890
-      base_dn: dc=huizinga,dc=dev
-      additional_users_dn: ou=people
-      users_filter: "(&(|({username_attribute}={input})({mail_attribute}={input}))(objectClass=person))"
-      additional_groups_dn: ou=groups
-      groups_filter: "(member={dn})"
-      attributes:
-        display_name: displayName
-        username: uid
-        group_name: cn
-        mail: mail
-      user: uid=authelia.authelia,ou=people,dc=huizinga,dc=dev
-      password:
-        secret_name: authelia-lldap-credentials
-        path: password
-
-  session:
-    redis:
-      enabled: true
-      host: dragonfly.authelia
-
-  storage:
-    postgres:
-      enabled: true
-      address: tcp://db-rw.authelia:5432
-      database: app
-      username: app
-      password:
-        secret_name: db-app
-        path: password
-
-  notifier:
-    filesystem:
-      enabled: true
-
-  access_control:
-    secret:
-      existingSecret: authelia-acl
--- a/apps/authelia/production/cluster.yaml
+++ b/apps/authelia/production/cluster.yaml
@@ -1,6 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: db
-spec:
-  instances: 2
--- a/apps/authelia/production/dragonfly.yaml
+++ b/apps/authelia/production/dragonfly.yaml
@@ -1,7 +0,0 @@
-apiVersion: dragonflydb.io/v1alpha1
-kind: Dragonfly
-metadata:
-  name: dragonfly
-  namespace: authelia
-spec:
-  replicas: 2
--- a/apps/authelia/production/kustomization.yaml
+++ b/apps/authelia/production/kustomization.yaml
@@ -1,16 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-  - dragonfly.yaml
-
-patches:
-  - path: cluster.yaml
-    target:
-      kind: Cluster
-
-configMapGenerator:
-  - name: values-overlay
-    namespace: authelia
-    files:
-      - values.yaml
--- a/apps/authelia/production/values.yaml
+++ b/apps/authelia/production/values.yaml
@@ -1,8 +0,0 @@
-pod:
-  replicas: 2
-
-configMap:
-  session:
-    cookies:
-      - subdomain: auth
-        domain: huizinga.dev
--- a/apps/authelia/staging/cluster.yaml
+++ b/apps/authelia/staging/cluster.yaml
@@ -1,6 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: db
-spec:
-  instances: 1
--- a/apps/authelia/staging/dragonfly.yaml
+++ b/apps/authelia/staging/dragonfly.yaml
@@ -1,7 +0,0 @@
-apiVersion: dragonflydb.io/v1alpha1
-kind: Dragonfly
-metadata:
-  name: dragonfly
-  namespace: authelia
-spec:
-  replicas: 1
--- a/apps/authelia/staging/kustomization.yaml
+++ b/apps/authelia/staging/kustomization.yaml
@@ -1,19 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-  - dragonfly.yaml
-
-patches:
-  - path: cluster.yaml
-    target:
-      kind: Cluster
-  - path: object-store.yaml
-    target:
-      kind: ObjectStore
-
-configMapGenerator:
-  - name: values-overlay
-    namespace: authelia
-    files:
-      - values.yaml
--- a/apps/authelia/staging/object-store.yaml
+++ b/apps/authelia/staging/object-store.yaml
@@ -1,8 +0,0 @@
-apiVersion: barmancloud.cnpg.io/v1
-kind: ObjectStore
-metadata:
-  name: garage-store
-  namespace: lldap
-spec:
-  configuration:
-    endpointURL: http://192.168.1.1:3900
--- a/apps/authelia/staging/values.yaml
+++ b/apps/authelia/staging/values.yaml
@@ -1,11 +0,0 @@
-pod:
-  replicas: 1
-
-configMap:
-  log:
-    level: debug
-
-  session:
-    cookies:
-      - subdomain: auth
-        domain: staging.huizinga.dev
--- a/apps/lldap/base/cluster-restore.yaml
+++ b/apps/lldap/base/cluster-restore.yaml
@@ -1,16 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: db
-spec:
-  bootstrap:
-    recovery:
-      source: source
-  externalClusters:
-    - name: source
-      plugin:
-        name: barman-cloud.cloudnative-pg.io
-        parameters:
-          barmanObjectName: garage-store
-          serverName: db
-  plugins: []
--- a/apps/lldap/base/cluster.yaml
+++ b/apps/lldap/base/cluster.yaml
@@ -1,15 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: db
-  namespace: lldap
-  # TODO: Add labels?
-spec:
-  storage:
-    size: 8Gi
-    storageClass: local-path
-  plugins:
-    - name: barman-cloud.cloudnative-pg.io
-      isWALArchiver: true
-      parameters:
-        barmanObjectName: garage-store
--- a/apps/lldap/base/deployment.yaml
+++ b/apps/lldap/base/deployment.yaml
@@ -1,80 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: lldap
-  namespace: lldap
-  labels:
-    app.kubernetes.io/name: lldap
-    app.kubernetes.io/instance: lldap
-spec:
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: lldap
-      app.kubernetes.io/instance: lldap
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: lldap
-        app.kubernetes.io/instance: lldap
-    spec:
-      topologySpreadConstraints:
-        - maxSkew: 1
-          topologyKey: kubernetes.io/hostname
-          whenUnsatisfiable: DoNotSchedule
-          labelSelector:
-            matchLabels:
-              app.kubernetes.io/name: lldap
-              app.kubernetes.io/instance: lldap
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 1000
-        runAsGroup: 1000
-        fsGroup: 1000
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: lldap
-          image: lldap/lldap:2025-12-12-alpine-rootless
-          env:
-            - name: LLDAP_LDAP_BASE_DN
-              value: dc=huizinga,dc=dev
-            - name: LLDAP_LDAP_USER_PASS
-              valueFrom:
-                secretKeyRef:
-                  name: credentials
-                  key: admin-pass
-            - name: LLDAP_KEY_SEED
-              valueFrom:
-                secretKeyRef:
-                  name: credentials
-                  key: key-seed
-            - name: LLDAP_JWT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: credentials
-                  key: jwt-secret
-            - name: LLDAP_DATABASE_URL
-              valueFrom:
-                secretKeyRef:
-                  name: db-app
-                  key: uri
-            - name: TZ
-              value: CET
-          livenessProbe:
-            exec:
-              command:
-                - /app/lldap
-                - healthcheck
-            initialDelaySeconds: 5
-            periodSeconds: 30
-          ports:
-            - name: ldap
-              containerPort: 3890
-            - name: web
-              containerPort: 17170
-          securityContext:
-            allowPrivilegeEscalation: false
-            runAsNonRoot: true
-            capabilities:
-              drop:
-                - ALL
--- a/apps/lldap/base/http-route.yaml
+++ b/apps/lldap/base/http-route.yaml
@@ -1,13 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1beta1
-kind: HTTPRoute
-metadata:
-  name: lldap
-  namespace: lldap
-spec:
-  parentRefs:
-    - name: gateway
-      namespace: default
-  rules:
-    - backendRefs:
-        - name: lldap
-          port: 17170
--- a/apps/lldap/base/kustomization.yaml
+++ b/apps/lldap/base/kustomization.yaml
@@ -1,17 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - namespace.yaml
-  - cluster.yaml
-  - schedule-backup.yaml
-  - deployment.yaml
-  - service.yaml
-  - http-route.yaml
-  - secret-s3-garage.yaml
-  - object-store.yaml
-
-# Uncomment to restore database from backup
-# patches:
-#   - path: cluster-restore.yaml
-#     target:
-#       kind: Cluster
--- a/apps/lldap/base/schedule-backup.yaml
+++ b/apps/lldap/base/schedule-backup.yaml
@@ -1,13 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: ScheduledBackup
-metadata:
-  name: daily-backup
-  namespace: lldap
-spec:
-  schedule: "0 0 0 * * *"
-  backupOwnerReference: self
-  method: plugin
-  pluginConfiguration:
-    name: barman-cloud.cloudnative-pg.io
-  cluster:
-    name: db
--- a/apps/lldap/base/secret-s3-garage.yaml
+++ b/apps/lldap/base/secret-s3-garage.yaml
@@ -1,9 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: s3-garage
-  namespace: lldap
-  annotations:
-    reflector.v1.k8s.emberstack.com/reflects: "cnpg-system/s3-garage"
-type: Opaque
-data: {}
--- a/apps/lldap/base/service.yaml
+++ b/apps/lldap/base/service.yaml
@@ -1,19 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: lldap
-  namespace: lldap
-  labels:
-    app.kubernetes.io/name: lldap
-    app.kubernetes.io/instance: lldap
-spec:
-  selector:
-    app.kubernetes.io/name: lldap
-    app.kubernetes.io/instance: lldap
-  ports:
-    - name: ldap
-      port: 3890
-      targetPort: ldap
-    - name: web
-      port: 17170
-      targetPort: web
--- a/apps/lldap/lldap.yaml
+++ b/apps/lldap/lldap.yaml
@@ -1,21 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: lldap
-  namespace: flux-system
-spec:
-  interval: 1h
-  retryInterval: 2m
-  timeout: 5m
-  dependsOn:
-    - name: cnpg
-  sourceRef:
-    kind: ExternalArtifact
-    name: lldap
-  decryption:
-    provider: sops
-    secretRef:
-      name: sops-gpg
-  path: ./${cluster_env}
-  prune: true
-  wait: true
--- a/apps/lldap/production/cluster.yaml
+++ b/apps/lldap/production/cluster.yaml
@@ -1,6 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: db
-spec:
-  instances: 2
--- a/apps/lldap/production/deployment.yaml
+++ b/apps/lldap/production/deployment.yaml
@@ -1,7 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: lldap
-  namespace: lldap
-spec:
-  replicas: 2
--- a/apps/lldap/production/http-route.yaml
+++ b/apps/lldap/production/http-route.yaml
@@ -1,8 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1beta1
-kind: HTTPRoute
-metadata:
-  name: lldap
-  namespace: lldap
-spec:
-  hostnames:
-    - "users.huizinga.dev"
--- a/apps/lldap/production/kustomization.yaml
+++ b/apps/lldap/production/kustomization.yaml
@@ -1,15 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-  - secret-credentials.enc.yaml
-patches:
-  - path: deployment.yaml
-    target:
-      kind: Deployment
-  - path: cluster.yaml
-    target:
-      kind: Cluster
-  - path: http-route.yaml
-    target:
-      kind: HTTPRoute
--- a/apps/lldap/production/secret-credentials.enc.yaml
+++ b/apps/lldap/production/secret-credentials.enc.yaml
@@ -1,59 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: credentials
-    namespace: lldap
-    labels:
-        app.kubernetes.io/name: lldap
-        app.kubernetes.io/instance: lldap
-type: Opaque
-data:
-    jwt-secret: ENC[AES256_GCM,data:yUAsoCIEXH491Ko4wEAAevSETdMFuhypNzuU2th5zlLd9hbVKqsjclvCTLDD8aW0Y9Lv70pzzAADPwFCKNH/rXx0DzaGOP139kLRYDHafz3RYeuoJjgBGw==,iv:x3EmPbbL/aj9CbwF8lleDL+nhlidPU8R3hwXygtj7D8=,tag:XD4C/pwFLFmDryBW7NqsWg==,type:str]
-    key-seed: ENC[AES256_GCM,data:3jWLtfny+ahtSkkmUdbg+wFbSGIcCxOv9BxVr0oNLTetXrAx+OcZ6dKp1ktj0J9aYEppqVuANUlfqyVzhIQXOT5GomQ+9jPC4uLmIz9tu1LAcfv9zuGl/w==,iv:e3aAI6JWq16YaUZqvKulkHyhLb8eWy9t2ni/jGeNFow=,tag:sZEEvxlq145klFkEMsUOuA==,type:str]
-    #ENC[AES256_GCM,data:AnCuvbVM6M62wuWmpUx3u/5WdaCo1T7eCvbY30okKbmWnvM0HQT2gGDTuhIaOlc=,iv:Ho+/CAvs69VJ+uwAIH8LVL344qlDaK5z3AvzWh/Jgm0=,tag:uNfN1P7lmWKBuCY7eiywDw==,type:comment]
-    admin-pass: ENC[AES256_GCM,data:yWzQTjN8kuGroShan7NxAw==,iv:IHw237PAqNNZ7KXIy2D8XMCLWSi3kJpLEnILhGm/Xl4=,tag:N79GjKNZNh9qJO+dpa0InQ==,type:str]
-sops:
-    age:
-        - recipient: age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCdVFuM2xvazBXY3kwTXVD
-            ZXdOS0pJLzVTVGJBb3RqYlhUN2IvNDNRSzNzCm8zcmlIU2h3RityUWFkZXU1R2xp
-            VUlobGZuOG1wbGxIMXVVekRaYTNGQUkKLS0tIHlMWkI0Qk9nUys1Sm4yNnVsakho
-            ZXl2RDhNNFZORW5lOGphSVY5WVJycWMKvnGem7wolSKMa8lshD90bMohdLMgYiTq
-            gHRN22irgd4pA2CpTcY47T2zhtVHU36PCXn+QFN936uF0vLf8Srwow==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1hktythzvsnth6u5en2lvag0tftnj9r03w7rpnzfgzgf5w95qxycq2azufj
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkRHNUOXZFUGxEY0RRSGtz
-            OElnckFUVG1WOXhvZHhzczUxU3lZZlE5emo4Ck5qRnF6M1NCeGdkUVNuR0xzMWxs
-            SEdVL0lwOXJmWVdEZ0t3V2Jscy9lZG8KLS0tIGM0WC8vbEdHQ2puRVZIK3lXeUJJ
-            OVNqZnhRUEN5dTBBVXVlSDlidEU4K3cKhv2jSc+lJu+s3hbH6j1xrkaQSzds82rk
-            dlaisVQxQmxjKcyPHqudJZS6Qfq3kEn9cZOP4G8NYAh0zhzGvCKeqA==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-12-17T02:58:02Z"
-    mac: ENC[AES256_GCM,data:yxmBIqS+KMr2Dp4eKslT1oNCcq2VEnGh4g3e7mkZzWjT6xPTdBEH8bT+c2XIFMWHJSUFoI7YyhvS1p5VgRBudaDyQCOk7tzyj0nkGiepZc1uYjSVO7VQ9CnfcdiD9AZ2srUjkcUoBaRfi2u6Qh2pPUUwMd4z8ms8v0CSk1qw0FE=,iv:V2rw624TN+pSGuq+JjVqM2bKozn7hGAykHV+638wo14=,tag:cdDascdYzzG33GztMd0Fdg==,type:str]
-    pgp:
-        - created_at: "2025-12-17T00:53:29Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA51kG++kLewoAQ/7BepX/31nKyUHnKC/7VnqTJk0x/gLmhko1/NukkApraXe
-            ctmZVk4TlG9N+DqEPHUYeMt7pu/1rvnWckh/OR2JU7AK8E33tnWITvr4AzQjk0zH
-            /V8n36ZA5/8Ppt9LJJSMVLaFEFjqiFy39Ggt6bx0SUX/CczTGkUYp+aJQfmDn+uR
-            GcJk9wR9/bu7+iOq8kuOA+renxGmdIcfMd6GKiHYScgv5tDN7pg7upXh1NPrVB8u
-            3GTor40B1Ncjqv3L1Zbw1AZYdsmFRkSx1N2JJkxPZYbvI6cwuFMcFkXuX6JfuL8T
-            pW5ddsK/DF0qXAXSc378juOh/tRdktFz2QPv9X5CJnQUk0c19Beqb4tG4cVR9sF3
-            SXTpaNmR4GG3ilY3ispzso7CQe+7RvLWGgsZAgPD1uC9SJGOBfvReJvQZUXyxUGo
-            /riTbUgFaBHmY6XWGy7Ecni333GtfGeN8qSIgPRhHg5f/BJX9Rp5ZG373S7iLuI4
-            GpM12knQCjxfsMXjMs6/TtAwYhnIFG3WcCzJFzn+pqBiW7XJvegJPQAID5LDo4GG
-            EzCZylto1WCgRhdq+CNuybQTsj4TbvxzfPYf+gCURbisH8A3TTWp4eyyXHg5KS4z
-            0TECkXpUXR/sD71HuBjxz1jfZiXFruDBldZDzZ2tZDdqQxAtk/DJGXcLmWF+HMbS
-            XgEvCI5gci7pYlsi60yitBcTPV2eEBh4zbRV53e12RGuhPwkxenX+6YRSCi0liOk
-            5BizeCkfSRCLQHG1okeb1RIdnSoyOJ+KlrR4Y+1xeZp9ruWn/tPN7L3jCx8SX+Y=
-            =j+fd
-            -----END PGP MESSAGE-----
-          fp: CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9
-    encrypted_regex: ^(data|stringData)$
-    version: 3.11.0
--- a/apps/lldap/staging/cluster.yaml
+++ b/apps/lldap/staging/cluster.yaml
@@ -1,6 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: db
-spec:
-  instances: 1
--- a/apps/lldap/staging/deployment.yaml
+++ b/apps/lldap/staging/deployment.yaml
@@ -1,7 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: lldap
-  namespace: lldap
-spec:
-  replicas: 1
--- a/apps/lldap/staging/http-route.yaml
+++ b/apps/lldap/staging/http-route.yaml
@@ -1,8 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1beta1
-kind: HTTPRoute
-metadata:
-  name: lldap
-  namespace: lldap
-spec:
-  hostnames:
-    - "users.staging.huizinga.dev"
--- a/apps/lldap/staging/kustomization.yaml
+++ b/apps/lldap/staging/kustomization.yaml
@@ -1,18 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-  - secret-credentials.enc.yaml
-patches:
-  - path: deployment.yaml
-    target:
-      kind: Deployment
-  - path: cluster.yaml
-    target:
-      kind: Cluster
-  - path: object-store.yaml
-    target:
-      kind: ObjectStore
-  - path: http-route.yaml
-    target:
-      kind: HTTPRoute
--- a/apps/lldap/staging/object-store.yaml
+++ b/apps/lldap/staging/object-store.yaml
@@ -1,8 +0,0 @@
-apiVersion: barmancloud.cnpg.io/v1
-kind: ObjectStore
-metadata:
-  name: garage-store
-  namespace: lldap
-spec:
-  configuration:
-    endpointURL: http://192.168.1.1:3900
--- a/apps/lldap/staging/secret-credentials.enc.yaml
+++ b/apps/lldap/staging/secret-credentials.enc.yaml
@@ -1,58 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-    name: credentials
-    namespace: lldap
-    labels:
-        app.kubernetes.io/name: lldap
-        app.kubernetes.io/instance: lldap
-type: Opaque
-data:
-    jwt-secret: ENC[AES256_GCM,data:cwKfSMzPPECNAba++x5ampK0pgCvOKRIEdPfLH5deDpnEASSlBjQZVo238YepBIAYu7Y0HCXCPppOtpX8zymD7Jxu1f5TrJoOJMwAlHYWT+IeBRVtpzgYA==,iv:bkNDqEriEnuSzvXxXAypGfwynPjYCVwN0NoAmcDftUc=,tag:DFkoIf92W8Ed60+azsfU+A==,type:str]
-    key-seed: ENC[AES256_GCM,data:bLpK9Tk5Eh2WBI5x94MssCyYEsMUMTJJymbdwsVeA6K/qBCxkPGkXf+kZZoaXkyLqW2lrPa8jIGv3LV6C4PqVJ+UOlgnvagQnCGnLylqX+3wkVhKLP5uYg==,iv:1RPLzof2Fwqm08Tfq7HR2esvPvkfBg0Uc+aM2SzpHhE=,tag:IsgLxUQriU9JUX2gEe/j8A==,type:str]
-    admin-pass: ENC[AES256_GCM,data:yWzQTjN8kuGroShan7NxAw==,iv:IHw237PAqNNZ7KXIy2D8XMCLWSi3kJpLEnILhGm/Xl4=,tag:N79GjKNZNh9qJO+dpa0InQ==,type:str]
-sops:
-    age:
-        - recipient: age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCdVFuM2xvazBXY3kwTXVD
-            ZXdOS0pJLzVTVGJBb3RqYlhUN2IvNDNRSzNzCm8zcmlIU2h3RityUWFkZXU1R2xp
-            VUlobGZuOG1wbGxIMXVVekRaYTNGQUkKLS0tIHlMWkI0Qk9nUys1Sm4yNnVsakho
-            ZXl2RDhNNFZORW5lOGphSVY5WVJycWMKvnGem7wolSKMa8lshD90bMohdLMgYiTq
-            gHRN22irgd4pA2CpTcY47T2zhtVHU36PCXn+QFN936uF0vLf8Srwow==
-            -----END AGE ENCRYPTED FILE-----
-        - recipient: age1hktythzvsnth6u5en2lvag0tftnj9r03w7rpnzfgzgf5w95qxycq2azufj
-          enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBkRHNUOXZFUGxEY0RRSGtz
-            OElnckFUVG1WOXhvZHhzczUxU3lZZlE5emo4Ck5qRnF6M1NCeGdkUVNuR0xzMWxs
-            SEdVL0lwOXJmWVdEZ0t3V2Jscy9lZG8KLS0tIGM0WC8vbEdHQ2puRVZIK3lXeUJJ
-            OVNqZnhRUEN5dTBBVXVlSDlidEU4K3cKhv2jSc+lJu+s3hbH6j1xrkaQSzds82rk
-            dlaisVQxQmxjKcyPHqudJZS6Qfq3kEn9cZOP4G8NYAh0zhzGvCKeqA==
-            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-12-17T00:53:29Z"
-    mac: ENC[AES256_GCM,data:6/I2J7u9fGUdz2SbAF7dL2j5XQMICx+AgEaUQ3HUN/RvlhMzn9J3EdcLFQ+d9YwbSpCzuGTQBfqsky2oaD6fQWWefCOXAVdElCp2rxHAGK9u2pqhPbgcvbHKAWfvK2kml8qhjjam346xpj2yeP8UdWq6+KZq8B5OBsKYtx4KuKM=,iv:EeLpcggrglMvpUdjvH6rOyNRj2EkuToIwc+uEPUnlvI=,tag:juTwo5RbhGnddB3MF3WirQ==,type:str]
-    pgp:
-        - created_at: "2025-12-17T00:53:29Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA51kG++kLewoAQ/7BepX/31nKyUHnKC/7VnqTJk0x/gLmhko1/NukkApraXe
-            ctmZVk4TlG9N+DqEPHUYeMt7pu/1rvnWckh/OR2JU7AK8E33tnWITvr4AzQjk0zH
-            /V8n36ZA5/8Ppt9LJJSMVLaFEFjqiFy39Ggt6bx0SUX/CczTGkUYp+aJQfmDn+uR
-            GcJk9wR9/bu7+iOq8kuOA+renxGmdIcfMd6GKiHYScgv5tDN7pg7upXh1NPrVB8u
-            3GTor40B1Ncjqv3L1Zbw1AZYdsmFRkSx1N2JJkxPZYbvI6cwuFMcFkXuX6JfuL8T
-            pW5ddsK/DF0qXAXSc378juOh/tRdktFz2QPv9X5CJnQUk0c19Beqb4tG4cVR9sF3
-            SXTpaNmR4GG3ilY3ispzso7CQe+7RvLWGgsZAgPD1uC9SJGOBfvReJvQZUXyxUGo
-            /riTbUgFaBHmY6XWGy7Ecni333GtfGeN8qSIgPRhHg5f/BJX9Rp5ZG373S7iLuI4
-            GpM12knQCjxfsMXjMs6/TtAwYhnIFG3WcCzJFzn+pqBiW7XJvegJPQAID5LDo4GG
-            EzCZylto1WCgRhdq+CNuybQTsj4TbvxzfPYf+gCURbisH8A3TTWp4eyyXHg5KS4z
-            0TECkXpUXR/sD71HuBjxz1jfZiXFruDBldZDzZ2tZDdqQxAtk/DJGXcLmWF+HMbS
-            XgEvCI5gci7pYlsi60yitBcTPV2eEBh4zbRV53e12RGuhPwkxenX+6YRSCi0liOk
-            5BizeCkfSRCLQHG1okeb1RIdnSoyOJ+KlrR4Y+1xeZp9ruWn/tPN7L3jCx8SX+Y=
-            =j+fd
-            -----END PGP MESSAGE-----
-          fp: CD17A34CBFB21DE9A73D47EB76BDEC4E165D8AD9
-    encrypted_regex: ^(data|stringData)$
-    version: 3.11.0
--- a/clusters/testing/kustomization.yaml
+++ b/clusters/testing/kustomization.yaml
@@ -6,22 +6,12 @@ resources:
  - ../../controllers/artifacts.yaml
  - ../../controllers/cilium/cilium.yaml
  - ../../controllers/cert-manager/cert-manager.yaml
+  - ../../controllers/spegel/spegel.yaml
  - ../../controllers/longhorn/longhorn.yaml
  - ../../controllers/local-path-provisioner/local-path-provisioner.yaml
  - ../../controllers/cnpg/cnpg.yaml
-  - ../../controllers/reflector/reflector.yaml
-  - ../../controllers/lldap-controller/lldap-controller.yaml
-  - ../../controllers/authelia-controller/authelia-controller.yaml
-  - ../../controllers/dragonfly-operator/dragonfly-operator.yaml
-  - ../../controllers/kube-prometheus-stack/kube-prometheus-stack.yaml

  - ../../configs/artifacts.yaml
-  - ../../configs/cilium-config/cilium-config.yaml
  - ../../configs/certificates/certificates.yaml
  - ../../configs/alerts/alerts.yaml
  - ../../configs/longhorn-jobs/longhorn-jobs.yaml
-
-  - ../../apps/artifacts.yaml
-  - ../../apps/spegel/spegel.yaml
-  - ../../apps/lldap/lldap.yaml
-  - ../../apps/authelia/authelia.yaml
--- a/configs/artifacts.yaml
+++ b/configs/artifacts.yaml
@@ -9,11 +9,6 @@ spec:
      kind: GitRepository
      name: flux-system
  artifacts:
-    - name: cilium-config
-      originRevision: "@foundation"
-      copy:
-        - from: "@foundation/configs/cilium-config/**"
-          to: "@artifact/"
    - name: certificates
      originRevision: "@foundation"
      copy:
--- a/configs/certificates/base/certificate-huizinga-dev.yaml
+++ b/configs/certificates/base/certificate-huizinga-dev.yaml
@@ -2,7 +2,7 @@ apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: huizinga-dev
-  namespace: default
+  namespace: certificates
 spec:
  secretName: huizinga-dev-tls
  issuerRef:
--- a/configs/certificates/base/kustomization.yaml
+++ b/configs/certificates/base/kustomization.yaml
@@ -1,6 +1,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
+  - namespace.yaml
  - certificate-huizinga-dev.yaml
  - secret-cloudflare-token.enc.yaml
  - cluster-issuer.yaml
--- a/configs/certificates/base/namespace.yaml
+++ b/configs/certificates/base/namespace.yaml
@@ -1,4 +1,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: lldap
+  name: certificates
--- a/configs/certificates/production/certificate-huizinga-dev.yaml
+++ b/configs/certificates/production/certificate-huizinga-dev.yaml
@@ -2,7 +2,7 @@ apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: huizinga-dev
-  namespace: default
+  namespace: certificates
 spec:
  commonName: "huizinga.dev"
  dnsNames:
--- a/configs/certificates/staging/certificate-huizinga-dev.yaml
+++ b/configs/certificates/staging/certificate-huizinga-dev.yaml
@@ -2,7 +2,7 @@ apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: huizinga-dev
-  namespace: default
+  namespace: certificates
 spec:
  commonName: "staging.huizinga.dev"
  dnsNames:
--- a/configs/cilium-config/base/cilium-l2-announcement-policy.yaml
+++ b/configs/cilium-config/base/cilium-l2-announcement-policy.yaml
@@ -1,9 +0,0 @@
-apiVersion: cilium.io/v2alpha1
-kind: CiliumL2AnnouncementPolicy
-metadata:
-  name: default-policy
-spec:
-  interfaces:
-    - ^eth[0-9]+
-  externalIPs: true
-  loadBalancerIPs: true
--- a/configs/cilium-config/base/gateway.yaml
+++ b/configs/cilium-config/base/gateway.yaml
@@ -1,24 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: Gateway
-metadata:
-  name: gateway
-  namespace: default
-spec:
-  gatewayClassName: cilium
-  listeners:
-    - name: http
-      protocol: HTTP
-      port: 80
-      allowedRoutes:
-        namespaces:
-          from: Same
-    - name: https
-      protocol: HTTPS
-      port: 443
-      tls:
-        certificateRefs:
-          - kind: Secret
-            name: huizinga-dev-tls
-      allowedRoutes:
-        namespaces:
-          from: All
--- a/configs/cilium-config/base/http-route-http-filter-redirect.yaml
+++ b/configs/cilium-config/base/http-route-http-filter-redirect.yaml
@@ -1,15 +0,0 @@
-apiVersion: gateway.networking.k8s.io/v1
-kind: HTTPRoute
-metadata:
-  name: http-filter-redirect
-  namespace: default
-spec:
-  parentRefs:
-    - name: gateway
-      sectionName: http
-  rules:
-    - filters:
-        - type: RequestRedirect
-          requestRedirect:
-            scheme: https
-            statusCode: 301
--- a/configs/cilium-config/base/kustomization.yaml
+++ b/configs/cilium-config/base/kustomization.yaml
@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - cilium-l2-announcement-policy.yaml
-  - gateway.yaml
-  - http-route-http-filter-redirect.yaml
--- a/configs/cilium-config/cilium-config.yaml
+++ b/configs/cilium-config/cilium-config.yaml
@@ -1,17 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: cilium-config
-  namespace: flux-system
-spec:
-  interval: 1h
-  retryInterval: 2m
-  timeout: 15m
-  dependsOn:
-    - name: cilium
-  sourceRef:
-    kind: ExternalArtifact
-    name: cilium-config
-  path: ./${cluster_env}
-  prune: true
-  wait: true
--- a/configs/cilium-config/production/cilium-load-balancer-ip-pool.yaml
+++ b/configs/cilium-config/production/cilium-load-balancer-ip-pool.yaml
@@ -1,7 +0,0 @@
-apiVersion: cilium.io/v2alpha1
-kind: CiliumLoadBalancerIPPool
-metadata:
-  name: default-pool
-spec:
-  blocks:
-    - cidr: 10.0.2.100/24
--- a/configs/cilium-config/production/kustomization.yaml
+++ b/configs/cilium-config/production/kustomization.yaml
@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-  - cilium-load-balancer-ip-pool.yaml
--- a/configs/cilium-config/staging/cilium-load-balancer-ip-pool.yaml
+++ b/configs/cilium-config/staging/cilium-load-balancer-ip-pool.yaml
@@ -1,8 +0,0 @@
-apiVersion: cilium.io/v2alpha1
-kind: CiliumLoadBalancerIPPool
-metadata:
-  name: default-pool
-spec:
-  blocks:
-    - start: 192.168.1.100
-      stop: 192.168.1.200
--- a/configs/cilium-config/staging/kustomization.yaml
+++ b/configs/cilium-config/staging/kustomization.yaml
@@ -1,5 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../base
-  - cilium-load-balancer-ip-pool.yaml
--- a/controllers/artifacts.yaml
+++ b/controllers/artifacts.yaml
@@ -19,6 +19,11 @@ spec:
      copy:
        - from: "@foundation/controllers/cert-manager/**"
          to: "@artifact/"
+    - name: spegel
+      originRevision: "@foundation"
+      copy:
+        - from: "@foundation/controllers/spegel/**"
+          to: "@artifact/"
    - name: openebs
      originRevision: "@foundation"
      copy:
@@ -39,18 +44,3 @@ spec:
      copy:
        - from: "@foundation/controllers/cnpg/**"
          to: "@artifact/"
-    - name: reflector
-      originRevision: "@foundation"
-      copy:
-        - from: "@foundation/controllers/reflector/**"
-          to: "@artifact/"
-    - name: dragonfly-operator
-      originRevision: "@foundation"
-      copy:
-        - from: "@foundation/controllers/dragonfly-operator/**"
-          to: "@artifact/"
-    - name: kube-prometheus-stack
-      originRevision: "@foundation"
-      copy:
-        - from: "@foundation/controllers/kube-prometheus-stack/**"
-          to: "@artifact/"
--- a/controllers/authelia-controller/authelia-controller.yaml
+++ b/controllers/authelia-controller/authelia-controller.yaml
@@ -1,26 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: OCIRepository
-metadata:
-  name: authelia-controller
-  namespace: flux-system
-spec:
-  interval: 1m0s
-  url: oci://git.huizinga.dev/infra/authelia-controller/manifests
-  ref:
-    tag: edge
---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: authelia-controller
-  namespace: flux-system
-spec:
-  interval: 1h
-  retryInterval: 2m
-  timeout: 5m
-  sourceRef:
-    kind: OCIRepository
-    name: authelia-controller
-  path: ./
-  prune: true
-  wait: true
--- a/controllers/cert-manager/helm-release.yaml
+++ b/controllers/cert-manager/helm-release.yaml
@@ -13,14 +13,9 @@ spec:
    strategy:
      name: RetryOnFailure
      retryInterval: 3m
-  chart:
-    spec:
-      chart: cert-manager
-      version: "1.19.x"
-      sourceRef:
-        kind: HelmRepository
-        name: cert-manager
-      interval: 24h
+  chartRef:
+    kind: OCIRepository
+    name: cert-manager
  values:
    crds:
      enabled: true
--- a/controllers/cert-manager/helm-repository.yaml
+++ b/controllers/cert-manager/helm-repository.yaml
@@ -1,9 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: cert-manager
-  namespace: cert-manager
-spec:
-  type: "oci"
-  interval: 24h
-  url: oci://quay.io/jetstack/charts/
--- a/controllers/cert-manager/kustomization.yaml
+++ b/controllers/cert-manager/kustomization.yaml
@@ -1,6 +1,6 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - namespace.yaml
-  - helm-repository.yaml
-  - helm-release.yaml
+  - ./namespace.yaml
+  - ./oci-repository.yaml
+  - ./helm-release.yaml
--- a/controllers/cert-manager/oci-repository.yaml
+++ b/controllers/cert-manager/oci-repository.yaml
@@ -0,0 +1,13 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: OCIRepository
+metadata:
+  name: cert-manager
+  namespace: cert-manager
+spec:
+  interval: 24h
+  url: oci://quay.io/jetstack/charts/cert-manager
+  layerSelector:
+    mediaType: "application/vnd.cncf.helm.chart.content.v1.tar+gzip"
+    operation: copy
+  ref:
+    semver: "1.19.x"
--- a/controllers/cnpg/cnpg.yaml
+++ b/controllers/cnpg/cnpg.yaml
@@ -12,7 +12,7 @@ spec:
    secretRef:
      name: sops-gpg
  dependsOn:
-    - name: cert-manager
+    - cert-manager
  sourceRef:
    kind: ExternalArtifact
    name: cnpg
--- a/controllers/cnpg/staging/kustomization.yaml
+++ b/controllers/cnpg/staging/kustomization.yaml
@@ -3,6 +3,7 @@ kind: Kustomization
 resources:
  - ../base
  - secret-s3-garage.enc.yaml
+  - object-store.yaml

 configMapGenerator:
  - name: values-overlay
--- a/controllers/cnpg/staging/object-store.yaml
+++ b/controllers/cnpg/staging/object-store.yaml
@@ -2,10 +2,11 @@ apiVersion: barmancloud.cnpg.io/v1
 kind: ObjectStore
 metadata:
  name: garage-store
-  namespace: lldap
+  namespace: cnpg-system
 spec:
  configuration:
-    destinationPath: s3://cnpg-backup/lldap
+    destinationPath: s3://cnpg-backup/
+    endpointURL: http://192.178.1.1:3900
    s3Credentials:
      accessKeyId:
        name: s3-garage
@@ -13,8 +14,5 @@ spec:
      secretAccessKey:
        name: s3-garage
        key: ACCESS_SECRET_KEY
-      region:
-        name: s3-garage
-        key: REGION
    wal:
      compression: gzip
--- a/controllers/cnpg/staging/secret-s3-garage.enc.yaml
+++ b/controllers/cnpg/staging/secret-s3-garage.enc.yaml
@@ -3,13 +3,10 @@ kind: Secret
 metadata:
    name: s3-garage
    namespace: cnpg-system
-    annotations:
-        reflector.v1.k8s.emberstack.com/reflection-allowed: "true"
 type: Opaque
 stringData:
    ACCESS_KEY_ID: ENC[AES256_GCM,data:TOEQMG/kHs5XUk77ijyV089ZTq1dKsoZUas=,iv:mVDOkl5qOxGdvCvdcXUuUjX85oKqbd+n5maHsKwCiFg=,tag:pho0oWPTwtM6lGQ2vA1d5A==,type:str]
-    ACCESS_SECRET_KEY: ENC[AES256_GCM,data:INipEOcpPSij6TDu+bCuMOdsGm58nEBC4UJfEGRqeMmXZ9A+EBrMiRL6z3s29uz4qdqwZ3C8E4PVz01/41bMEA==,iv:x+gku8q7efHaaMpD/dc19IrwmK2gDp04bjH8WN/xhkc=,tag:QiSF6B8IqMrCsOUCe8c0bw==,type:str]
-    REGION: ENC[AES256_GCM,data:WIGPWwii,iv:ZdP5uNYqa8CZxa/xyrYXxGvE9fzt95slzwpzSzRy9DY=,tag:yANYtLzJCL/1pcvBXY7X7g==,type:str]
+    SECRET_ACCESS_KEY: ENC[AES256_GCM,data:mc42T/AQ8NRi32SzvwGJA6LEq1x0Yz3Tu+CPDYPf+E2+C00zQcGRk6tACPvRoMxRzU4ZZpK346e2K/8ajU77hg==,iv:Isxe81aQEbI5xd1dRjXDKj/2Jp9eTHdv0/XVBBHoRyE=,tag:gtcmKmfUIfIy977Df11P4g==,type:str]
 sops:
    age:
        - recipient: age1860txadrlqrjwnqh0g466re2nt8jk7xhj640pq9gpsddpg23uynqsp2hul
@@ -30,8 +27,8 @@ sops:
            K09tZGI0Z2w0eXh5eHcvcEttMy82aU0K2fnCDfYIShzw2Zipof+C8zf9pcOmiDg9
            2SCiIfAJs9MB3n078P068z77KpvdlJYOi9pUTKSBhNw+mBI24y6X6A==
            -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2025-12-18T02:50:50Z"
-    mac: ENC[AES256_GCM,data:+kfs0EDnnZNnHMf91P6rAN52lugHFO4XcNJiKLpXt7bfTSMbiwgVbvRElXGTbLXLVSz70uZyzV/mt0ZcfEfPbwE/Pdh6SmFiWwQwLT1M50MdrxAWWYvSCS9r4h1Cow3N3K2/dXH7N/4AVHTg3ohXlP92fxVh1wL0cVnke/lcQgY=,iv:M5n9+lgq0fBx5Yg1e0N6v0obbnmarvVwIHAjCr5XmM4=,tag:NBA01MtG40T3nST7b00tiw==,type:str]
+    lastmodified: "2025-12-15T03:46:42Z"
+    mac: ENC[AES256_GCM,data:UG9rSQ4ep7Ln4g5QCtvD6U90Oc8iWpni+kypMpJ+AQM8LC0TTs9zFQgcxmo2wjZn38Fp+br/5KC172SqBNG4Q1yXhlRiqiIeyx9ynrZeceRSqHaaruB1hj83/0FwahqjB/t6yutWIfnp00UC92mMKGlef48UNZ8IW17e5uHE0m4=,iv:LvR4BEkgAr6PJ8fYATFois4j8/rgztn/Jggj/mFgCIk=,tag:W38qDd1RkCdK3bVMqOVnjA==,type:str]
    pgp:
        - created_at: "2025-12-11T23:56:15Z"
          enc: |-
--- a/controllers/dragonfly-operator/dragonfly-operator.yaml
+++ b/controllers/dragonfly-operator/dragonfly-operator.yaml
@@ -1,15 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: dragonfly-operator
-  namespace: flux-system
-spec:
-  interval: 1h
-  retryInterval: 2m
-  timeout: 5m
-  sourceRef:
-    kind: ExternalArtifact
-    name: dragonfly-operator
-  path: .
-  prune: true
-  wait: true
--- a/controllers/dragonfly-operator/kustomization.yaml
+++ b/controllers/dragonfly-operator/kustomization.yaml
@@ -1,4 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - https://raw.githubusercontent.com/dragonflydb/dragonfly-operator/v1.3.1/manifests/dragonfly-operator.yaml
--- a/controllers/kube-prometheus-stack/cluster-restore.yaml
+++ b/controllers/kube-prometheus-stack/cluster-restore.yaml
@@ -1,16 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: db
-spec:
-  bootstrap:
-    recovery:
-      source: source
-  externalClusters:
-    - name: source
-      plugin:
-        name: barman-cloud.cloudnative-pg.io
-        parameters:
-          barmanObjectName: garage-store
-          serverName: db
-  plugins: []
--- a/controllers/kube-prometheus-stack/cluster.yaml
+++ b/controllers/kube-prometheus-stack/cluster.yaml
@@ -1,15 +0,0 @@
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: db
-  namespace: monitoring
-  # TODO: Add labels?
-spec:
-  storage:
-    size: 8Gi
-    storageClass: local-path
-  plugins:
-    - name: barman-cloud.cloudnative-pg.io
-      isWALArchiver: true
-      parameters:
-        barmanObjectName: garage-store
--- a/controllers/kube-prometheus-stack/dragonfly.yaml
+++ b/controllers/kube-prometheus-stack/dragonfly.yaml
@@ -1,7 +0,0 @@
-apiVersion: dragonflydb.io/v1alpha1
-kind: Dragonfly
-metadata:
-  name: dragonfly
-  namespace: monitoring
-spec:
-  replicas: 1
--- a/controllers/kube-prometheus-stack/grafana-ldap.toml
+++ b/controllers/kube-prometheus-stack/grafana-ldap.toml
@@ -1,53 +0,0 @@
-# This is only the ldap config, you also need to enable ldap support in the main config file
-# of Grafana. See https://grafana.com/docs/grafana/latest/auth/ldap/#enable-ldap
-# You can test that it is working correctly by trying usernames at: https://<your grafana instance>/admin/ldap
-
-[[servers]]
-# Ldap server host (specify multiple hosts space separated)
-host = "lldap.lldap.svc.cluster.local"
-# Default port is 389 or 636 if use_ssl = true
-port = 3890
-# Set to true if LDAP server should use an encrypted TLS connection (either with STARTTLS or LDAPS)
-use_ssl = false
-# If set to true, use LDAP with STARTTLS instead of LDAPS
-start_tls = false
-# set to true if you want to skip SSL cert validation
-ssl_skip_verify = false
-# set to the path to your root CA certificate or leave unset to use system defaults
-# root_ca_cert = "/path/to/certificate.crt"
-# Authentication against LDAP servers requiring client certificates
-# client_cert = "/path/to/client.crt"
-# client_key = "/path/to/client.key"
-
-# Search user bind dn
-bind_dn = "${BIND_DN}"
-# Search user bind password
-# If the password contains # or ; you have to wrap it with triple quotes. Ex """#password;"""
-bind_password = "${LDAP_PASSWORD}"
-
-# User search filter
-search_filter = "(&(|(uid=%s)(mail=%s))(objectClass=person))"
-# If you want to limit to only users of a specific group use this instead:
-# search_filter = "(&(uid=%s)(memberOf=cn=<your group>,ou=groups,dc=huizinga,dc=dev))"
-
-# An array of base dns to search through
-search_base_dns = ["dc=huizinga,dc=dev"]
-
-# Specify names of the LDAP attributes your LDAP uses
-[servers.attributes]
-member_of = "memberOf"
-email = "mail"
-name = "givenName"
-surname = "sn"
-username = "uid"
-
-# If you want to map your ldap groups to grafana's groups, see: https://grafana.com/docs/grafana/latest/auth/ldap/#group-mappings
-# As a quick example, here is how you would map lldap's admin group to grafana's admin
-[[servers.group_mappings]]
-group_dn = "cn=lldap_admin,ou=groups,dc=huizinga,dc=dev"
-org_role = "Admin"
-grafana_admin = true
-
-[[servers.group_mappings]]
-group_dn = "*"
-org_role = "Viewer"
--- a/controllers/kube-prometheus-stack/helm-release.yaml
+++ b/controllers/kube-prometheus-stack/helm-release.yaml
@@ -1,30 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: kube-prometheus-stack
-  namespace: monitoring
-spec:
-  interval: 12h
-  install:
-    strategy:
-      name: RetryOnFailure
-      retryInterval: 2m
-  upgrade:
-    strategy:
-      name: RetryOnFailure
-      retryInterval: 3m
-  chart:
-    spec:
-      chart: kube-prometheus-stack
-      version: "80.6.x"
-      sourceRef:
-        kind: HelmRepository
-        name: prometheus-community
-      interval: 24h
-  values:
-    grafana:
-      ldap:
-        existingSecret: grafana-ldap-toml
-  valuesFrom:
-    - kind: ConfigMap
-      name: values-base
--- a/controllers/kube-prometheus-stack/helm-repository.yaml
+++ b/controllers/kube-prometheus-stack/helm-repository.yaml
@@ -1,9 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: prometheus-community
-  namespace: monitoring
-spec:
-  type: "oci"
-  interval: 24h
-  url: oci://ghcr.io/prometheus-community/charts/
--- a/controllers/kube-prometheus-stack/kube-prometheus-stack.yaml
+++ b/controllers/kube-prometheus-stack/kube-prometheus-stack.yaml
@@ -1,18 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: kube-prometheus-stack
-  namespace: flux-system
-spec:
-  interval: 1h
-  retryInterval: 2m
-  timeout: 5m
-  dependsOn:
-    - name: dragonfly-operator
-    - name: lldap-controller
-  sourceRef:
-    kind: ExternalArtifact
-    name: kube-prometheus-stack
-  path: ./
-  prune: true
-  wait: true
--- a/controllers/kube-prometheus-stack/kustomization.yaml
+++ b/controllers/kube-prometheus-stack/kustomization.yaml
@@ -1,32 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - namespace.yaml
-  - helm-repository.yaml
-  - helm-release.yaml
-  - dragonfly.yaml
-  - cluster.yaml
-  - secret-s3-garage.yaml
-  - object-store.yaml
-  - service-user.yaml
-
-configurations:
-  - name-reference.yaml
-
-configMapGenerator:
-  - name: values-base
-    namespace: monitoring
-    files:
-      - values.yaml
-
-secretGenerator:
-  - name: grafana-ldap-toml
-    namespace: monitoring
-    files:
-      - ldap-toml=grafana-ldap.toml
-
-# Uncomment to restore database from backup
-# patches:
-#   - path: cluster-restore.yaml
-#     target:
-#       kind: Cluster
--- a/controllers/kube-prometheus-stack/name-reference.yaml
+++ b/controllers/kube-prometheus-stack/name-reference.yaml
@@ -1,11 +0,0 @@
-nameReference:
-  - kind: ConfigMap
-    version: v1
-    fieldSpecs:
-      - path: spec/valuesFrom/name
-        kind: HelmRelease
-  - kind: Secret
-    version: v1
-    fieldSpecs:
-      - path: spec/values/grafana/ldap/existingSecret
-        kind: HelmRelease
--- a/controllers/kube-prometheus-stack/namespace.yaml
+++ b/controllers/kube-prometheus-stack/namespace.yaml
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: monitoring
--- a/controllers/kube-prometheus-stack/object-store.yaml
+++ b/controllers/kube-prometheus-stack/object-store.yaml
@@ -1,20 +0,0 @@
-apiVersion: barmancloud.cnpg.io/v1
-kind: ObjectStore
-metadata:
-  name: garage-store
-  namespace: monitoring
-spec:
-  configuration:
-    destinationPath: s3://cnpg-backup/authelia
-    s3Credentials:
-      accessKeyId:
-        name: s3-garage
-        key: ACCESS_KEY_ID
-      secretAccessKey:
-        name: s3-garage
-        key: ACCESS_SECRET_KEY
-      region:
-        name: s3-garage
-        key: REGION
-    wal:
-      compression: gzip
--- a/controllers/kube-prometheus-stack/secret-s3-garage.yaml
+++ b/controllers/kube-prometheus-stack/secret-s3-garage.yaml
@@ -1,9 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: s3-garage
-  namespace: monitoring
-  annotations:
-    reflector.v1.k8s.emberstack.com/reflects: "cnpg-system/s3-garage"
-type: Opaque
-data: {}
--- a/controllers/kube-prometheus-stack/service-user.yaml
+++ b/controllers/kube-prometheus-stack/service-user.yaml
@@ -1,6 +0,0 @@
-apiVersion: lldap.huizinga.dev/v1
-kind: ServiceUser
-metadata:
-  name: grafana
-  namespace: monitoring
-spec: {}
--- a/controllers/kube-prometheus-stack/values.yaml
+++ b/controllers/kube-prometheus-stack/values.yaml
@@ -1,86 +0,0 @@
-alertmanager:
-  alertsmanagerSpec:
-    replicas: 1
-  route:
-    main:
-      enabled: true
-      hostnames:
-        - "alerts.staging.huizinga.dev"
-      parentRefs:
-        - name: gateway
-          namespace: default
-
-prometheus:
-  prometheusSpec:
-    replicas: 1
-  route:
-    main:
-      enabled: true
-      hostnames:
-        - "prometheus.staging.huizinga.dev"
-      parentRefs:
-        - name: gateway
-          namespace: default
-
-grafana:
-  replicas: 1
-
-  # ingress:
-  #   enabled: true
-  #   hosts:
-  #     - grafana.${domain}
-  #   tls:
-  #     - secretName: ${domain//./-}-tls
-  #   annotations:
-  #     traefik.ingress.kubernetes.io/router.entryPoints: "websecure"
-  #     traefik.ingress.kubernetes.io/router.middlewares: "authelia-forwardauth-authelia@kubernetescrd"
-  #     traefik.ingress.kubernetes.io/router.tls: "true"
-
-  envValueFrom:
-    BIND_DN:
-      secretKeyRef:
-        name: grafana-lldap-credentials
-        key: bind_dn
-    LDAP_PASSWORD:
-      secretKeyRef:
-        name: grafana-lldap-credentials
-        key: password
-
-  grafana.ini:
-    auth.ldap:
-      enabled: true
-
-    # auth.proxy:
-    #   enabled: true
-    #   header_name: Remote-User
-    #   header_property: username
-    #   auto_sign_up: true
-    #   headers: Groups:Remote-Group
-    #   enable_login_token: false
-    #   sync_ttl: 0
-    #   signout_redirect_url: https://login.${domain}/logout?rd=https://grafana.${domain}
-
-    database:
-      type: postgres
-      host: $__file{/etc/secrets/db/host}
-      name: $__file{/etc/secrets/db/dbname}
-      user: $__file{/etc/secrets/db/user}
-      password: $__file{/etc/secrets/db/password}
-
-    remote_cache:
-      type: redis
-      connstr: addr=dragonflydb.monitoring:6379
-
-  ldap:
-    enabled: true
-
-  extraSecretMounts:
-    - name: db-app-mount
-      secretName: db-app
-      defaultMode: 0440
-      mountPath: /etc/secrets/db
-      readOnly: true
-
-# We are not running kube-proxy
-kubeProxy:
-  enabled: false
--- a/controllers/lldap-controller/lldap-controller.yaml
+++ b/controllers/lldap-controller/lldap-controller.yaml
@@ -1,28 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: OCIRepository
-metadata:
-  name: lldap-controller
-  namespace: flux-system
-spec:
-  interval: 1m0s
-  url: oci://git.huizinga.dev/infra/lldap-controller/manifests
-  ref:
-    tag: edge
---
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: lldap-controller
-  namespace: flux-system
-spec:
-  interval: 1h
-  retryInterval: 2m
-  timeout: 5m
-  dependsOn:
-    - name: lldap
-  sourceRef:
-    kind: OCIRepository
-    name: lldap-controller
-  path: ./
-  prune: true
-  wait: true
--- a/controllers/reflector/helm-release.yaml
+++ b/controllers/reflector/helm-release.yaml
@@ -1,23 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: reflector
-  namespace: reflector
-spec:
-  interval: 12h
-  install:
-    strategy:
-      name: RetryOnFailure
-      retryInterval: 2m
-  upgrade:
-    strategy:
-      name: RetryOnFailure
-      retryInterval: 3m
-  chart:
-    spec:
-      chart: reflector
-      version: "9.1.x"
-      sourceRef:
-        kind: HelmRepository
-        name: reflector
-      interval: 24h
--- a/controllers/reflector/helm-repository.yaml
+++ b/controllers/reflector/helm-repository.yaml
@@ -1,9 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: reflector
-  namespace: reflector
-spec:
-  type: "oci"
-  interval: 24h
-  url: oci://ghcr.io/emberstack/helm-charts
--- a/controllers/reflector/kustomization.yaml
+++ b/controllers/reflector/kustomization.yaml
@@ -1,6 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - namespace.yaml
-  - helm-repository.yaml
-  - helm-release.yaml
--- a/controllers/reflector/namespace.yaml
+++ b/controllers/reflector/namespace.yaml
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: reflector
--- a/controllers/reflector/reflector.yaml
+++ b/controllers/reflector/reflector.yaml
@@ -1,15 +0,0 @@
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: reflector
-  namespace: flux-system
-spec:
-  interval: 1h
-  retryInterval: 2m
-  timeout: 5m
-  sourceRef:
-    kind: ExternalArtifact
-    name: reflector
-  path: ./
-  prune: true
-  wait: true
--- a/controllers/spegel/helm-release.yaml
+++ b/controllers/spegel/helm-release.yaml
--- a/controllers/spegel/helm-repository.yaml
+++ b/controllers/spegel/helm-repository.yaml
--- a/controllers/spegel/kustomization.yaml
+++ b/controllers/spegel/kustomization.yaml
--- a/controllers/spegel/namespace.yaml
+++ b/controllers/spegel/namespace.yaml
--- a/controllers/spegel/spegel.yaml
+++ b/controllers/spegel/spegel.yaml
Author	SHA1	Message	Date
Dreaded_X	cda4fab71d	feat: Put ClusterIssuer under certificates	2025-12-17 00:30:24 +01:00
Dreaded_X	957d0ae996	feat: Added barman cloud plugin	2025-12-17 00:30:24 +01:00