more stuff

Rewrite2

.github/workflows/main.yml

@@ -71,9 +71,23 @@ jobs:
     environment: release
     runs-on: ubuntu-latest
     steps:
-      - uses: release-drafter/release-drafter@v6
+      - id: create-release
+        uses: release-drafter/release-drafter@v6
         with:
           config-name: release-drafter-config.yml
           publish: true
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - uses: actions/checkout@v4
+
+      - name: Upload Release Asset
+        id: upload-release-asset 
+        uses: actions/upload-release-asset@v1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          upload_url: ${{ steps.create-release.outputs.upload_url }}
+          asset_path: ./operator.yaml
+          asset_name: operator.yaml
+          asset_content_type: application/yaml

.gitignore

@@ -33,4 +33,6 @@ report.[0-9]_.[0-9]_.[0-9]_.[0-9]_.json
 # Finder (MacOS) folder config
 .DS_Store
 
-/data/
+/data/
+
+/cloudflare.yaml

.python-version

@@ -0,0 +1 @@
+3.13

Dockerfile

@@ -1,6 +1,6 @@
-FROM node:23-alpine
+FROM node:23-slim
 RUN corepack enable
 COPY package.json pnpm-lock.yaml ./
 RUN pnpm install --frozen-lockfile --prod
 COPY . .
-CMD ["node", "src/index.ts"]
+CMD ["node", "src/index.ts"]

Makefile

@@ -1,15 +1,14 @@
-.PHONY: setup dev-recreate dev-create dev-destroy
-
-setup:
-	./scripts/setup-server.sh
+.PHONY: dev-recreate dev-destroy server-install
 
 dev-destroy:
 	colima delete -f
 
-dev-create:
-	colima start --network-address --kubernetes -m 8 --mount ${PWD}/data:/data:w --k3s-arg="--disable=helm-controller,local-storage"
+dev-recreate: dev-destroy
+	colima start --network-address --kubernetes -m 8 --k3s-arg="--disable helm-controller,local-storage,traefik --docker" # --mount ${PWD}/data:/data:w 
+	flux install --components="source-controller,helm-controller"
 
-dev-recreate: dev-destroy dev-create setup
+setup-flux:
+	flux install --components="source-controller,helm-controller"
 
 server-install:
 	curl -sfL https://get.k3s.io | sh -s - --disable traefik,local-storage,helm-controller

README.md

@@ -1,6 +0,0 @@
-## Bootstrap repo
-
-```
-brew install fluxcd/tap/flux
-make setup-server
-```

TODO.md

@@ -1 +0,0 @@
-- Fix issue with incompatible spec breaking the server

cert-issuer.yaml

@@ -1,19 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: letsencrypt-prod
-  annotations:
-    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
-spec:
-  acme:
-    server: https://acme-v02.api.letsencrypt.org/directory
-    email: alice@alice.com
-    privateKeySecretRef:
-      name: letsencrypt-prod-account-key
-    solvers:
-      - dns01:
-          cloudflare:
-            email: alice@alice.com
-            apiTokenSecretRef:
-              name: cloudflare-api-token
-              key: api-token

chart/templates/clusterrole.yaml

@@ -1,14 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: {{ include "homelab-operator.fullname" . }}
-rules:
-- apiGroups: [""]
-  resources: ["secrets"]
-  verbs: ["create", "get", "watch", "list"]
-- apiGroups: ["*"]
-  resources: ["*"]
-  verbs: ["get", "watch", "list", "patch"]
-- apiGroups: ["apiextensions.k8s.io"]
-  resources: ["customresourcedefinitions"]
-  verbs: ["get", "create", "replace"]

chart/templates/deployment.yaml

@@ -1,108 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ include "homelab-operator.fullname" . }}
-  labels:
-    {{- include "homelab-operator.labels" . | nindent 4 }}
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      {{- include "homelab-operator.selectorLabels" . | nindent 6 }}
-  template:
-    metadata:
-      {{- with .Values.podAnnotations }}
-      annotations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      labels:
-        {{- include "homelab-operator.selectorLabels" . | nindent 8 }}
-    spec:
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      serviceAccountName: {{ include "homelab-operator.serviceAccountName" . }}
-      securityContext:
-        {{- toYaml .Values.podSecurityContext | nindent 8 }}
-      containers:
-        - name: {{ .Chart.Name }}
-          securityContext:
-            {{- toYaml .Values.securityContext | nindent 12 }}
-          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
-          imagePullPolicy: {{ .Values.image.pullPolicy }}
-          env:
-            # PostgreSQL Host
-            - name: POSTGRES_HOST
-              {{- if .Values.config.postgres.host.fromSecret.enabled }}
-              valueFrom:
-                secretKeyRef:
-                  name: {{ .Values.config.postgres.host.fromSecret.secretName }}
-                  key: {{ .Values.config.postgres.host.fromSecret.key }}
-              {{- else }}
-              value: {{ .Values.config.postgres.host.value | quote }}
-              {{- end }}
-            # PostgreSQL Port
-            - name: POSTGRES_PORT
-              {{- if .Values.config.postgres.port.fromSecret.enabled }}
-              valueFrom:
-                secretKeyRef:
-                  name: {{ .Values.config.postgres.port.fromSecret.secretName }}
-                  key: {{ .Values.config.postgres.port.fromSecret.key }}
-              {{- else }}
-              value: {{ .Values.config.postgres.port.value | quote }}
-              {{- end }}
-            # PostgreSQL User
-            - name: POSTGRES_USER
-              {{- if .Values.config.postgres.user.fromSecret.enabled }}
-              valueFrom:
-                secretKeyRef:
-                  name: {{ .Values.config.postgres.user.fromSecret.secretName }}
-                  key: {{ .Values.config.postgres.user.fromSecret.key }}
-              {{- else }}
-              value: {{ .Values.config.postgres.user.value | quote }}
-              {{- end }}
-            # PostgreSQL Password
-            - name: POSTGRES_PASSWORD
-              {{- if .Values.config.postgres.password.fromSecret.enabled }}
-              valueFrom:
-                secretKeyRef:
-                  name: {{ .Values.config.postgres.password.fromSecret.secretName }}
-                  key: {{ .Values.config.postgres.password.fromSecret.key }}
-              {{- else }}
-              value: {{ .Values.config.postgres.password.value | quote }}
-              {{- end }}
-            # Certificate Manager
-            - name: CERT_MANAGER
-              {{- if .Values.config.certManager.fromSecret.enabled }}
-              valueFrom:
-                secretKeyRef:
-                  name: {{ .Values.config.certManager.fromSecret.secretName }}
-                  key: {{ .Values.config.certManager.fromSecret.key }}
-              {{- else }}
-              value: {{ .Values.config.certManager.value | quote }}
-              {{- end }}
-            # Istio Gateway
-            - name: ISTIO_GATEWAY
-              {{- if .Values.config.istioGateway.fromSecret.enabled }}
-              valueFrom:
-                secretKeyRef:
-                  name: {{ .Values.config.istioGateway.fromSecret.secretName }}
-                  key: {{ .Values.config.istioGateway.fromSecret.key }}
-              {{- else }}
-              value: {{ .Values.config.istioGateway.value | quote }}
-              {{- end }}
-          resources:
-            {{- toYaml .Values.resources | nindent 12 }}
-      {{- with .Values.nodeSelector }}
-      nodeSelector:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.tolerations }}
-      tolerations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}

charts/apps/bytestash/Chart.yaml

@@ -0,0 +1,3 @@
+apiVersion: v2
+version: 1.0.0
+name: ByteStash

charts/apps/bytestash/templates/_http-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: HttpService
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.environment }}'
+  subdomain: '{{ .Values.subdomain }}'
+  destination:
+    host: '{{ .Release.Name }}'
+    port:
+      number: 80

charts/apps/bytestash/templates/client.yaml

@@ -0,0 +1,10 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: OidcClient
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.environment }}'
+  redirectUris:
+    - path: /api/auth/oidc/callback
+      subdomain: bytestash
+      matchingMode: strict

charts/apps/bytestash/templates/external-http-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: ExternalHttpService
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.environment }}'
+  subdomain: '{{ .Values.subdomain }}'
+  destination:
+    host: '{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local'
+    port:
+      number: 80

charts/apps/bytestash/templates/headless-service.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: '{{ .Release.Name }}-headless'
+  labels:
+    app: '{{ .Release.Name }}'
+spec:
+  clusterIP: None
+  ports:
+    - port: 5000
+      name: http
+  selector:
+    app: '{{ .Release.Name }}'

charts/apps/bytestash/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: '{{ .Release.Name }}'
+  labels:
+    app: '{{ .Release.Name }}'
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 5000
+      protocol: TCP
+      name: http
+  selector:
+    app: '{{ .Release.Name }}'

charts/apps/bytestash/templates/stateful-set.yaml

@@ -0,0 +1,63 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: '{{ .Release.Name }}'
+  labels:
+    app: '{{ .Release.Name }}'
+spec:
+  serviceName: '{{ .Release.Name }}-headless'
+  replicas: 1
+  selector:
+    matchLabels:
+      app: '{{ .Release.Name }}'
+  template:
+    metadata:
+      labels:
+        app: '{{ .Release.Name }}'
+    spec:
+      containers:
+        - name: '{{ .Release.Name }}'
+          image: ghcr.io/jordan-dalby/bytestash:latest
+          ports:
+            - containerPort: 5000
+              name: http
+          env:
+            - name: OIDC_ENABLED
+              value: 'true'
+            - name: OIDC_DISPLAY_NAME
+              value: OIDC
+            - name: OIDC_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: '{{ .Release.Name }}-client'
+                  key: clientId
+            - name: OIDC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: '{{ .Release.Name }}-client'
+                  key: clientSecret
+            - name: OIDC_ISSUER_URL
+              valueFrom:
+                secretKeyRef:
+                  name: '{{ .Release.Name }}-client'
+                  key: configuration
+
+          volumeMounts:
+            - mountPath: /data/snippets
+              name: bytestash-data
+
+      # Defines security context for the pod to avoid running as root.
+      # securityContext:
+      #   runAsUser: 1000
+      #   runAsGroup: 1000
+      #   fsGroup: 1000
+
+  volumeClaimTemplates:
+    - metadata:
+        name: bytestash-data
+      spec:
+        accessModes: ['ReadWriteOnce']
+        storageClassName: '{{ .Values.environment }}'
+        resources:
+          requests:
+            storage: 5Gi

charts/apps/bytestash/values.yaml

@@ -0,0 +1,2 @@
+environment: prod
+subdomain: bytestash

charts/apps/jellyfin/Chart.yaml

@@ -0,0 +1,3 @@
+apiVersion: v2
+version: 1.0.0
+name: Jellyfin

charts/apps/jellyfin/notes.md

@@ -0,0 +1 @@
+https://www.authelia.com/integration/openid-connect/clients/jellyfin/

charts/apps/jellyfin/templates/client.yaml

@@ -0,0 +1,10 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: OidcClient
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.environment }}'
+  redirectUris:
+    - path: /sso/OID/redirect/Authentik
+      subdomain: '{{ .Values.subdomain }}'
+      matchingMode: strict

charts/apps/jellyfin/templates/config-pvc.yaml

@@ -0,0 +1,11 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: '{{ .Release.Name }}-config'
+spec:
+  accessModes:
+    - 'ReadWriteOnce'
+  resources:
+    requests:
+      storage: '1Gi'
+  storageClassName: '{{ .Values.environment }}'

charts/apps/jellyfin/templates/deployment.yaml

@@ -0,0 +1,52 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  strategy:
+    type: Recreate
+    replicas: 1
+  selector:
+    matchLabels:
+      app: '{{ .Release.Name }}'
+  template:
+    metadata:
+      labels:
+        app: '{{ .Release.Name }}'
+    spec:
+      containers:
+        - name: '{{ .Release.Name }}'
+          image: '{{ .Values.image.repository }}:{{ .Values.image.tag }}'
+          imagePullPolicy: '{{ .Values.image.pullPolicy }}'
+          ports:
+            - name: http
+              containerPort: 8096
+              protocol: TCP
+          livenessProbe:
+            tcpSocket:
+              port: http
+          readinessProbe:
+            tcpSocket:
+              port: http
+          volumeMounts:
+            - mountPath: /config
+              name: config
+            - mountPath: /media/movies
+              name: movies
+            - mountPath: /media/tv-shows
+              name: tvshows
+            - mountPath: /media/music
+              name: music
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: '{{ .Release.Name }}-config'
+        - name: movies
+          persistentVolumeClaim:
+            claimName: movies
+        - name: tvshows
+          persistentVolumeClaim:
+            claimName: tvshows
+        - name: music
+          persistentVolumeClaim:
+            claimName: music

charts/apps/jellyfin/templates/external-http-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: ExternalHttpService
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.environment }}'
+  subdomain: '{{ .Values.subdomain }}'
+  destination:
+    host: '{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local'
+    port:
+      number: 80

charts/apps/jellyfin/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: '{{ .Release.Name }}'
+  labels:
+    app: '{{ .Release.Name }}'
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 8096
+      protocol: TCP
+      name: http
+  selector:
+    app: '{{ .Release.Name }}'

charts/apps/jellyfin/values.yaml

@@ -0,0 +1,6 @@
+image:
+  repository: docker.io/jellyfin/jellyfin
+  tag: latest
+  pullPolicy: IfNotPresent
+environment: prod
+subdomain: jellyfin

charts/apps/ollama/Chart.yaml

@@ -0,0 +1,3 @@
+apiVersion: v2
+version: 1.0.0
+name: Ollama

charts/apps/ollama/templates/deployment.yaml

@@ -0,0 +1,52 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: '{{ .Release.Name }}'
+  labels:
+    app: '{{ .Release.Name }}'
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: '{{ .Release.Name }}'
+  template:
+    metadata:
+      labels:
+        app: '{{ .Release.Name }}'
+    spec:
+      containers:
+        - name: ollama
+          image: ghcr.io/ollama/ollama:latest # Official image
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 11434
+              name: http
+          volumeMounts:
+            - name: ollama-data
+              mountPath: /root/.ollama
+          env:
+            # If you want to pre‑start a model, set this env var to the
+            # model name (e.g., "gpt-4o-mini").  The container will download
+            # it automatically at startup.
+            # - name: OLLAMA_MODEL
+            #   value: "gpt-4o-mini"
+          readinessProbe:
+            httpGet:
+              scheme: HTTP
+              path: /api/status
+              port: 11434
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            successThreshold: 1
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 500m
+              memory: 1Gi
+            limits:
+              cpu: 2000m
+              memory: 4Gi
+      volumes:
+        - name: ollama-data
+          persistentVolumeClaim:
+            claimName: '{{ .Release.Name }}-data'

charts/apps/ollama/templates/pvc.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: '{{ .Release.Name }}-data'
+spec:
+  storageClassName: '{{ .Values.environment }}'
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 20Gi

charts/apps/ollama/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: '{{ .Release.Name }}'
+  labels:
+    app: '{{ .Release.Name }}'
+spec:
+  type: LoadBalancer # Set to NodePort/ClusterIP if you prefer
+  ports:
+    - name: http
+      port: 11434
+      targetPort: http
+      protocol: TCP
+  selector:
+    app: '{{ .Release.Name }}'

charts/apps/ollama/values.yaml

@@ -0,0 +1,2 @@
+environment: dev
+subdomain: bytestash

charts/operator/templates/_storageclass.yaml

@@ -0,0 +1,12 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: {{ include "homelab-operator.fullname" . }}-local-path
+  labels:
+    {{- include "homelab-operator.labels" . | nindent 4 }}
+provisioner: reuse-local-path-provisioner
+parameters:
+  # Add any provisioner-specific parameters here
+reclaimPolicy: {{ .Values.storage.reclaimPolicy | default "Retain" }}
+allowVolumeExpansion: {{ .Values.storage.allowVolumeExpansion | default false }}
+volumeBindingMode: {{ .Values.storage.volumeBindingMode | default "WaitForFirstConsumer" }}

charts/operator/templates/clusterrole.yaml

@@ -0,0 +1,32 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: {{ include "homelab-operator.fullname" . }}
+rules:
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["create", "get", "watch", "list"]
+- apiGroups: [""]
+  resources: ["namespaces"]
+  verbs: ["get", "list", "watch", "create", "update", "patch"]
+- apiGroups: [""]
+  resources: ["persistentvolumes"]
+  verbs: ["get", "list", "watch", "create", "delete", "patch", "update"]
+- apiGroups: [""]
+  resources: ["persistentvolumeclaims"]
+  verbs: ["get", "list", "watch", "update", "patch"]
+- apiGroups: [""]
+  resources: ["persistentvolumeclaims/status"]
+  verbs: ["update", "patch"]
+- apiGroups: [""]
+  resources: ["events"]
+  verbs: ["create", "patch"]
+- apiGroups: ["storage.k8s.io"]
+  resources: ["storageclasses"]
+  verbs: ["get", "list", "watch"]
+- apiGroups: ["*"]
+  resources: ["*"]
+  verbs: ["get", "watch", "list", "patch", "create", "update", "replace"]
+- apiGroups: ["apiextensions.k8s.io"]
+  resources: ["customresourcedefinitions"]
+  verbs: ["get", "create", "update", "replace", "patch"]

charts/operator/templates/deployment.yaml

@@ -0,0 +1,55 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "homelab-operator.fullname" . }}
+  labels:
+    {{- include "homelab-operator.labels" . | nindent 4 }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      {{- include "homelab-operator.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "homelab-operator.selectorLabels" . | nindent 8 }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "homelab-operator.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        - name: {{ .Chart.Name }}
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          volumeMounts:
+            - name: data-volumes
+              mountPath: {{ .Values.storage.path }}
+      volumes:
+        - name: data-volumes
+          hostPath:
+            path: {{ .Values.storage.path }}
+            type: DirectoryOrCreate
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}

charts/operator/values.yaml

@@ -4,13 +4,19 @@
 
 image:
   repository: ghcr.io/morten-olsen/homelab-operator
-  pullPolicy: Always
+  pullPolicy: IfNotPresent
   # Overrides the image tag whose default is the chart appVersion.
   tag: main
 
 imagePullSecrets: []
-nameOverride: ""
-fullnameOverride: ""
+nameOverride: ''
+fullnameOverride: ''
+
+storage:
+  path: /data/volumes
+  reclaimPolicy: Retain
+  allowVolumeExpansion: false
+  volumeBindingMode: WaitForFirstConsumer
 
 serviceAccount:
   # Specifies whether a service account should be created
@@ -19,7 +25,7 @@ serviceAccount:
   annotations: {}
   # The name of the service account to use.
   # If not set and create is true, a name is generated using the fullname template
-  name: ""
+  name: ''
 
 podAnnotations: {}
 
@@ -51,53 +57,3 @@ nodeSelector: {}
 tolerations: []
 
 affinity: {}
-
-# Configuration for the homelab operator
-config:
-  # PostgreSQL database configuration
-  postgres:
-    host:
-      # Direct value (used when fromSecret.enabled is false)
-      value: "127.0.0.1"
-      # Secret reference (used when fromSecret.enabled is true)
-      fromSecret:
-        enabled: false
-        secretName: ""
-        key: "POSTGRES_HOST"
-    
-    port:
-      value: "5432"
-      fromSecret:
-        enabled: false
-        secretName: ""
-        key: "POSTGRES_PORT"
-    
-    user:
-      value: "postgres"
-      fromSecret:
-        enabled: false
-        secretName: ""
-        key: "POSTGRES_USER"
-    
-    password:
-      value: ""
-      fromSecret:
-        enabled: true  # Default to secret for sensitive data
-        secretName: "postgres-secret"
-        key: "POSTGRES_PASSWORD"
-  
-  # Certificate manager configuration
-  certManager:
-    value: "letsencrypt-prod"
-    fromSecret:
-      enabled: false
-      secretName: ""
-      key: "CERT_MANAGER"
-  
-  # Istio gateway configuration
-  istioGateway:
-    value: "istio-ingress"
-    fromSecret:
-      enabled: false
-      secretName: ""
-      key: "ISTIO_GATEWAY"

charts/volumes/Chart.yaml

@@ -0,0 +1,3 @@
+apiVersion: v2
+version: 1.0.0
+name: Resources

charts/volumes/templates/books-pvc.yaml

@@ -0,0 +1,30 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: books
+  labels:
+    type: nfs
+spec:
+  capacity:
+    storage: 10Gi
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: manual
+  hostPath: null
+  nfs:
+    path: '{{ .Values.books.path }}'
+    server: '{{ .Values.host }}'
+    readOnly: true
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: books
+spec:
+  storageClassName: manual
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 10Gi

charts/volumes/templates/movies-pvc.yaml

@@ -0,0 +1,30 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: movies
+  labels:
+    type: nfs
+spec:
+  capacity:
+    storage: 10Gi
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: manual
+  hostPath: null
+  nfs:
+    path: '{{ .Values.movies.path }}'
+    server: '{{ .Values.host }}'
+    readOnly: true
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: movies
+spec:
+  storageClassName: manual
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 10Gi

charts/volumes/templates/music-pvc.yaml

@@ -0,0 +1,30 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: music
+  labels:
+    type: nfs
+spec:
+  capacity:
+    storage: 10Gi
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: manual
+  hostPath: null
+  nfs:
+    path: '{{ .Values.music.path }}'
+    server: '{{ .Values.host }}'
+    readOnly: true
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: music
+spec:
+  storageClassName: manual
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 10Gi

charts/volumes/templates/podcasts-pvc.yaml

@@ -0,0 +1,30 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: podcasts
+  labels:
+    type: nfs
+spec:
+  capacity:
+    storage: 10Gi
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: manual
+  hostPath: null
+  nfs:
+    path: '{{ .Values.podcasts.path }}'
+    server: '{{ .Values.host }}'
+    readOnly: true
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: podcasts
+spec:
+  storageClassName: manual
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 10Gi

charts/volumes/templates/tv-pvc.yaml

@@ -0,0 +1,30 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: tvshows
+  labels:
+    type: nfs
+spec:
+  capacity:
+    storage: 10Gi
+  accessModes:
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: manual
+  hostPath: null
+  nfs:
+    path: '{{ .Values.tvshows.path }}'
+    server: '{{ .Values.host }}'
+    readOnly: true
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: tvshows
+spec:
+  storageClassName: manual
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 10Gi

charts/volumes/values.yaml

@@ -0,0 +1,11 @@
+host: 192.168.20.106
+movies:
+  path: /mnt/HDD/Movies
+tvshows:
+  path: /mnt/HDD/TV-Shows
+music:
+  path: /mnt/HDD/Music2
+books:
+  path: /mnt/HDD/Books
+podcasts:
+  path: /mnt/HDD/Podcasts

docker-compose.dev.yaml

@@ -1,12 +0,0 @@
-name: homelab
-services:
-  postgres:
-    image: postgres:17
-    ports:
-      - 5432:5432
-    environment:
-      POSTGRES_USER: $POSTGRES_USER
-      POSTGRES_PASSWORD: $POSTGRES_PASSWORD
-      POSTGRES_DB: ${POSTGRES_DB:-postgres}
-    volumes:
-      - $PWD/.data/local/postgres:/var/lib/postgresql/data

docs/writing-custom-resources.md

@@ -1,901 +0,0 @@
-# Writing Custom Resources
-
-This guide explains how to create and implement custom resources in the
-homelab-operator.
-
-## Overview
-
-Custom resources in this operator follow a structured pattern that includes:
-
-- **Specification schemas** using Zod for runtime validation
-- **Resource implementations** that extend the base `CustomResource` class
-- **Manifest creation** helpers for generating Kubernetes resources
-- **Reconciliation logic** to manage the desired state
-
-## Project Structure
-
-Each custom resource should be organized in its own directory under
-`src/custom-resouces/` with the following structure:
-
-```
-src/custom-resouces/{resource-name}/
-├── {resource-name}.ts              # Main definition file
-├── {resource-name}.schemas.ts      # Zod validation schemas
-├── {resource-name}.resource.ts     # Resource implementation
-└── {resource-name}.create-manifests.ts # Manifest generation helpers
-```
-
-## Quick Start
-
-This section walks through creating a complete custom resource from scratch.
-We'll build a `MyResource` that manages a web application with a deployment and
-service.
-
-### 1. Define Your Resource
-
-The main definition file registers your custom resource with the operator
-framework. This file serves as the entry point that ties together your schemas,
-implementation, and Kubernetes CRD definition.
-
-Create the main definition file (`{resource-name}.ts`):
-
-```typescript
-import { createCustomResourceDefinition } from "../../services/custom-resources/custom-resources.ts";
-import { GROUP } from "../../utils/consts.ts";
-
-import { MyResourceResource } from "./my-resource.resource.ts";
-import { myResourceSpecSchema } from "./my-resource.schemas.ts";
-
-const myResourceDefinition = createCustomResourceDefinition({
-  group: GROUP, // Uses your operator's API group (homelab.mortenolsen.pro)
-  version: "v1", // API version for this resource
-  kind: "MyResource", // The Kubernetes kind name (PascalCase)
-  names: {
-    plural: "myresources", // Plural name for kubectl (lowercase)
-    singular: "myresource", // Singular name for kubectl (lowercase)
-  },
-  spec: myResourceSpecSchema, // Zod schema for validation
-  create: (options) => new MyResourceResource(options), // Factory function
-});
-
-export { myResourceDefinition };
-```
-
-**Key Points:**
-
-- The `group` should always use the `GROUP` constant to maintain consistency
-- `kind` should be descriptive and follow Kubernetes naming conventions
-  (PascalCase)
-- `names.plural` is used in kubectl commands (`kubectl get myresources`)
-- The `create` function instantiates your resource implementation when a CR is
-  detected
-
-### 2. Create Validation Schemas
-
-Schemas define the structure and validation rules for your custom resource's
-specification. Using Zod provides runtime type safety and automatic validation
-of user input.
-
-Define your spec schema (`{resource-name}.schemas.ts`):
-
-```typescript
-import { z } from "zod";
-
-const myResourceSpecSchema = z.object({
-  // Required fields - these must be provided by users
-  hostname: z.string(), // Base hostname for the application
-  port: z.number().min(1).max(65535), // Container port (validated range)
-
-  // Optional fields with defaults - provide sensible fallbacks
-  replicas: z.number().min(1).default(1), // Number of pod replicas
-
-  // Enums - restrict to specific values with defaults
-  protocol: z.enum(["http", "https"]).default("https"),
-
-  // Nested objects - for complex configuration
-  database: z.object({
-    host: z.string(), // Database hostname
-    port: z.number(), // Database port
-    name: z.string(), // Database name
-  }).optional(), // Entire database config is optional
-});
-
-// Additional schemas for secrets, status, etc.
-// Separate schemas help organize different data types
-const myResourceSecretSchema = z.object({
-  apiKey: z.string(), // API key for external services
-  password: z.string(), // Database or service password
-});
-
-export { myResourceSecretSchema, myResourceSpecSchema };
-```
-
-**Schema Design Best Practices:**
-
-- **Required vs Optional**: Make fields required only when absolutely necessary
-- **Defaults**: Provide sensible defaults to reduce user configuration burden
-- **Validation**: Use Zod's built-in validators (`.min()`, `.max()`, `.email()`,
-  etc.)
-- **Enums**: Restrict values to prevent invalid configurations
-- **Nested Objects**: Group related configuration together
-- **Separate Schemas**: Create different schemas for different purposes (spec,
-  secrets, status)
-
-### 3. Implement the Resource
-
-The resource implementation is the core of your custom resource. It contains the
-business logic for managing Kubernetes resources and maintains the desired
-state. This class extends `CustomResource` and implements the reconciliation
-logic.
-
-Create the resource implementation (`{resource-name}.resource.ts`):
-
-```typescript
-import type { KubernetesObject } from "@kubernetes/client-node";
-import deepEqual from "deep-equal";
-
-import {
-  CustomResource,
-  type CustomResourceOptions,
-  type SubresourceResult,
-} from "../../services/custom-resources/custom-resources.custom-resource.ts";
-import {
-  ResourceReference,
-  ResourceService,
-} from "../../services/resources/resources.ts";
-
-import type { myResourceSpecSchema } from "./my-resource.schemas.ts";
-import {
-  createDeploymentManifest,
-  createServiceManifest,
-} from "./my-resource.create-manifests.ts";
-
-class MyResourceResource extends CustomResource<typeof myResourceSpecSchema> {
-  #deploymentResource = new ResourceReference();
-  #serviceResource = new ResourceReference();
-
-  constructor(options: CustomResourceOptions<typeof myResourceSpecSchema>) {
-    super(options);
-    const resourceService = this.services.get(ResourceService);
-
-    // Initialize resource references
-    this.#deploymentResource.current = resourceService.get({
-      apiVersion: "apps/v1",
-      kind: "Deployment",
-      name: this.name,
-      namespace: this.namespace,
-    });
-
-    this.#serviceResource.current = resourceService.get({
-      apiVersion: "v1",
-      kind: "Service",
-      name: this.name,
-      namespace: this.namespace,
-    });
-
-    // Set up event handlers for reconciliation
-    this.#deploymentResource.on("changed", this.queueReconcile);
-    this.#serviceResource.on("changed", this.queueReconcile);
-  }
-
-  #reconcileDeployment = async (): Promise<SubresourceResult> => {
-    const manifest = createDeploymentManifest({
-      name: this.name,
-      namespace: this.namespace,
-      ref: this.ref,
-      spec: this.spec,
-    });
-
-    if (!this.#deploymentResource.current?.exists) {
-      await this.#deploymentResource.current?.patch(manifest);
-      return {
-        ready: false,
-        syncing: true,
-        reason: "Creating",
-        message: "Creating deployment",
-      };
-    }
-
-    if (!deepEqual(this.#deploymentResource.current.spec, manifest.spec)) {
-      await this.#deploymentResource.current.patch(manifest);
-      return {
-        ready: false,
-        syncing: true,
-        reason: "Updating",
-        message: "Deployment needs updates",
-      };
-    }
-
-    // Check if deployment is ready
-    const deployment = this.#deploymentResource.current;
-    const isReady =
-      deployment.status?.readyReplicas === deployment.status?.replicas;
-
-    return {
-      ready: isReady,
-      reason: isReady ? "Ready" : "Pending",
-      message: isReady ? "Deployment is ready" : "Waiting for pods to be ready",
-    };
-  };
-
-  #reconcileService = async (): Promise<SubresourceResult> => {
-    const manifest = createServiceManifest({
-      name: this.name,
-      namespace: this.namespace,
-      ref: this.ref,
-      spec: this.spec,
-    });
-
-    if (!deepEqual(this.#serviceResource.current?.spec, manifest.spec)) {
-      await this.#serviceResource.current?.patch(manifest);
-      return {
-        ready: false,
-        syncing: true,
-        reason: "Updating",
-        message: "Service needs updates",
-      };
-    }
-
-    return { ready: true };
-  };
-
-  public reconcile = async () => {
-    if (!this.exists || this.metadata.deletionTimestamp) {
-      return;
-    }
-
-    // Reconcile subresources
-    await this.reconcileSubresource("Deployment", this.#reconcileDeployment);
-    await this.reconcileSubresource("Service", this.#reconcileService);
-
-    // Update overall ready condition
-    const deploymentReady =
-      this.conditions.get("Deployment")?.status === "True";
-    const serviceReady = this.conditions.get("Service")?.status === "True";
-
-    await this.conditions.set("Ready", {
-      status: deploymentReady && serviceReady ? "True" : "False",
-      reason: deploymentReady && serviceReady ? "Ready" : "Pending",
-      message: deploymentReady && serviceReady
-        ? "All resources are ready"
-        : "Waiting for resources to be ready",
-    });
-  };
-}
-
-export { MyResourceResource };
-```
-
-**Resource Implementation Breakdown:**
-
-**Constructor Setup:**
-
-- **Resource References**: Create `ResourceReference` objects to track managed
-  Kubernetes resources
-- **Service Access**: Use dependency injection to access operator services
-  (`ResourceService`)
-- **Event Handlers**: Listen for changes in managed resources to trigger
-  reconciliation
-- **Resource Registration**: Register references for Deployment and Service that
-  will be managed
-
-**Reconciliation Methods:**
-
-- **`#reconcileDeployment`**: Manages the application's Deployment resource
-  - Creates manifests using helper functions
-  - Checks if resource exists and creates/updates as needed
-  - Uses `deepEqual` to avoid unnecessary updates
-  - Returns status indicating readiness state
-- **`#reconcileService`**: Manages the Service resource for network access
-  - Similar pattern to deployment but typically simpler
-  - Services are usually ready immediately after creation
-
-**Main Reconcile Loop:**
-
-- **Deletion Check**: Early return if resource is being deleted
-- **Subresource Management**: Calls individual reconciliation methods
-- **Condition Updates**: Aggregates status from all subresources
-- **Status Reporting**: Updates the overall "Ready" condition
-
-**Key Design Patterns:**
-
-- **Private Methods**: Use `#` for private reconciliation methods
-- **Async/Await**: All reconciliation is asynchronous
-- **Resource References**: Track external resources with type safety
-- **Condition Management**: Provide clear status through Kubernetes conditions
-- **Event-Driven**: React to changes in managed resources automatically
-
-### 4. Create Manifest Helpers
-
-Manifest helpers are pure functions that generate Kubernetes resource
-definitions. They transform your custom resource's specification into standard
-Kubernetes objects. This separation keeps your reconciliation logic clean and
-makes manifests easy to test and modify.
-
-Define manifest creation functions (`{resource-name}.create-manifests.ts`):
-
-```typescript
-type CreateDeploymentManifestOptions = {
-  name: string;
-  namespace: string;
-  ref: any; // Owner reference
-  spec: {
-    hostname: string;
-    port: number;
-    replicas: number;
-  };
-};
-
-const createDeploymentManifest = (
-  options: CreateDeploymentManifestOptions,
-) => ({
-  apiVersion: "apps/v1",
-  kind: "Deployment",
-  metadata: {
-    name: options.name,
-    namespace: options.namespace,
-    ownerReferences: [options.ref],
-  },
-  spec: {
-    replicas: options.spec.replicas,
-    selector: {
-      matchLabels: {
-        app: options.name,
-      },
-    },
-    template: {
-      metadata: {
-        labels: {
-          app: options.name,
-        },
-      },
-      spec: {
-        containers: [
-          {
-            name: options.name,
-            image: "nginx:latest",
-            ports: [
-              {
-                containerPort: options.spec.port,
-              },
-            ],
-            env: [
-              {
-                name: "HOSTNAME",
-                value: options.spec.hostname,
-              },
-            ],
-          },
-        ],
-      },
-    },
-  },
-});
-
-type CreateServiceManifestOptions = {
-  name: string;
-  namespace: string;
-  ref: any;
-  spec: {
-    port: number;
-  };
-};
-
-const createServiceManifest = (options: CreateServiceManifestOptions) => ({
-  apiVersion: "v1",
-  kind: "Service",
-  metadata: {
-    name: options.name,
-    namespace: options.namespace,
-    ownerReferences: [options.ref],
-  },
-  spec: {
-    selector: {
-      app: options.name,
-    },
-    ports: [
-      {
-        port: 80,
-        targetPort: options.spec.port,
-      },
-    ],
-  },
-});
-
-export { createDeploymentManifest, createServiceManifest };
-```
-
-**Manifest Helper Patterns:**
-
-**Type Definitions:**
-
-- **Options Types**: Define clear interfaces for function parameters
-- **Structured Input**: Group related parameters in nested objects
-- **Type Safety**: Leverage TypeScript to catch configuration errors at compile
-  time
-
-**Deployment Manifest:**
-
-- **Owner References**: Ensures garbage collection when parent resource is
-  deleted
-- **Labels & Selectors**: Consistent labeling for pod selection and organization
-- **Container Configuration**: Maps custom resource spec to container settings
-- **Environment Variables**: Passes configuration from spec to running
-  containers
-- **Port Configuration**: Exposes application ports based on spec
-
-**Service Manifest:**
-
-- **Service Discovery**: Creates stable network endpoint for the deployment
-- **Port Mapping**: Routes external traffic to container ports
-- **Selector Matching**: Uses same labels as deployment for proper routing
-- **Owner References**: Links service lifecycle to custom resource
-
-**Best Practices for Manifest Helpers:**
-
-- **Pure Functions**: No side effects, same input always produces same output
-- **Immutable Objects**: Return new objects rather than modifying inputs
-- **Validation**: Let TypeScript catch type mismatches
-- **Consistent Naming**: Use predictable patterns for resource names
-- **Owner References**: Always set for proper cleanup
-- **Documentation**: Comment non-obvious configuration choices
-
-### 5. Register Your Resource
-
-Add your resource to `src/custom-resouces/custom-resources.ts`:
-
-```typescript
-import { myResourceDefinition } from "./my-resource/my-resource.ts";
-
-const customResources = [
-  // ... existing resources
-  myResourceDefinition,
-];
-```
-
-## Core Concepts
-
-These fundamental patterns are used throughout the operator framework.
-Understanding them is essential for building robust custom resources.
-
-### Resource References
-
-`ResourceReference` objects provide a strongly-typed way to track and manage
-Kubernetes resources that your custom resource creates or depends on. They
-automatically handle resource watching, caching, and change notifications.
-
-Use `ResourceReference` to manage related Kubernetes resources:
-
-```typescript
-import {
-  ResourceReference,
-  ResourceService,
-} from "../../services/resources/resources.ts";
-
-class MyResource extends CustomResource<typeof myResourceSpecSchema> {
-  #deploymentResource = new ResourceReference();
-
-  constructor(options: CustomResourceOptions<typeof myResourceSpecSchema>) {
-    super(options);
-    const resourceService = this.services.get(ResourceService);
-
-    this.#deploymentResource.current = resourceService.get({
-      apiVersion: "apps/v1",
-      kind: "Deployment",
-      name: this.name,
-      namespace: this.namespace,
-    });
-
-    // Listen for changes
-    this.#deploymentResource.on("changed", this.queueReconcile);
-  }
-}
-```
-
-**Why Resource References Matter:**
-
-- **Automatic Watching**: Changes to referenced resources trigger reconciliation
-- **Type Safety**: Get compile-time checking for resource properties
-- **Lifecycle Management**: Easily check if resources exist and their current
-  state
-- **Event Handling**: React to external changes without polling
-- **Caching**: Avoid repeated API calls for the same resource data
-
-### Conditions
-
-Kubernetes conditions provide a standardized way to communicate resource status.
-They follow the Kubernetes convention of expressing current state, reasons for
-that state, and human-readable messages. Conditions are crucial for operators
-and users to understand what's happening with resources.
-
-Use conditions to track the status of your resource:
-
-```typescript
-// Set a condition
-await this.conditions.set("Ready", {
-  status: "True",
-  reason: "AllResourcesReady",
-  message: "All subresources are ready",
-});
-
-// Get a condition
-const isReady = this.conditions.get("Ready")?.status === "True";
-```
-
-**Condition Best Practices:**
-
-- **Standard Names**: Use common condition types like "Ready", "Available",
-  "Progressing"
-- **Clear Status**: Use "True", "False", or "Unknown" following Kubernetes
-  conventions
-- **Descriptive Reasons**: Provide specific reason codes for troubleshooting
-- **Helpful Messages**: Include actionable information for users
-- **Consistent Updates**: Always update conditions during reconciliation
-
-### Subresource Reconciliation
-
-The `reconcileSubresource` method provides a standardized way to manage
-individual components of your custom resource. It automatically handles
-condition updates, error management, and status aggregation. This pattern keeps
-your main reconciliation loop clean and ensures consistent error handling.
-
-Use `reconcileSubresource` to manage individual components:
-
-```typescript
-public reconcile = async () => {
-  // This automatically manages conditions and error handling
-  await this.reconcileSubresource("Deployment", this.#reconcileDeployment);
-  await this.reconcileSubresource("Service", this.#reconcileService);
-};
-```
-
-**Subresource Reconciliation Benefits:**
-
-- **Automatic Condition Management**: Sets conditions based on reconciliation
-  results
-- **Error Isolation**: Failures in one subresource don't stop others
-- **Status Aggregation**: Combines individual component status into overall
-  status
-- **Consistent Patterns**: Same error handling and retry logic across all
-  components
-- **Observability**: Clear visibility into which components are having issues
-
-### Deep Equality Checks
-
-Deep equality checks prevent unnecessary API calls and resource churn.
-Kubernetes resources should only be updated when their desired state actually
-differs from their current state. This improves performance and reduces cluster
-load.
-
-Use `deepEqual` to avoid unnecessary updates:
-
-```typescript
-import deepEqual from "deep-equal";
-
-if (!deepEqual(currentResource.spec, desiredManifest.spec)) {
-  await currentResource.patch(desiredManifest);
-}
-```
-
-**Deep Equality Benefits:**
-
-- **Performance**: Avoids unnecessary API calls to Kubernetes
-- **Reduced Churn**: Prevents resource version conflicts and unnecessary events
-- **Stability**: Reduces reconciliation loops and system noise
-- **Efficiency**: Lets you focus compute on actual changes
-- **Observability**: Cleaner audit logs with only meaningful changes
-
-**When to Use Deep Equality:**
-
-- **Spec Comparisons**: Before updating any Kubernetes resource
-- **Status Updates**: Only update status when values actually change
-- **Metadata Updates**: Check labels and annotations before patching
-- **Complex Objects**: Especially useful for nested configuration objects
-
-## Advanced Patterns
-
-These patterns handle more complex scenarios like secret management, resource
-dependencies, and sophisticated error handling. Use these when building
-production-ready operators that need to handle real-world complexity.
-
-### Working with Secrets
-
-Many resources need to manage secrets. Here's a pattern for secret management:
-
-```typescript
-import { SecretService } from "../../services/secrets/secrets.ts";
-
-class MyResource extends CustomResource<typeof myResourceSpecSchema> {
-  constructor(options: CustomResourceOptions<typeof myResourceSpecSchema>) {
-    super(options);
-    const secretService = this.services.get(SecretService);
-
-    // Get or create a secret
-    this.secretRef = secretService.get({
-      name: `${this.name}-secret`,
-      namespace: this.namespace,
-    });
-  }
-
-  #ensureSecret = async () => {
-    const secretData = {
-      apiKey: generateApiKey(),
-      password: generatePassword(),
-    };
-
-    if (!this.secretRef.current?.exists) {
-      await this.secretRef.current?.patch({
-        apiVersion: "v1",
-        kind: "Secret",
-        metadata: {
-          name: this.secretRef.current.name,
-          namespace: this.secretRef.current.namespace,
-          ownerReferences: [this.ref],
-        },
-        data: secretData,
-      });
-    }
-  };
-}
-```
-
-### Cross-Resource Dependencies
-
-When your resource depends on other custom resources:
-
-```typescript
-class MyResource extends CustomResource<typeof myResourceSpecSchema> {
-  #dependentResource = new ResourceReference();
-
-  constructor(options: CustomResourceOptions<typeof myResourceSpecSchema>) {
-    super(options);
-    const resourceService = this.services.get(ResourceService);
-
-    // Reference another custom resource
-    this.#dependentResource.current = resourceService.get({
-      apiVersion: "homelab.mortenolsen.pro/v1",
-      kind: "PostgresDatabase",
-      name: this.spec.database,
-      namespace: this.namespace,
-    });
-
-    this.#dependentResource.on("changed", this.queueReconcile);
-  }
-
-  #reconcileApp = async (): Promise<SubresourceResult> => {
-    // Check if dependency is ready
-    const dependency = this.#dependentResource.current;
-    if (!dependency?.exists) {
-      return {
-        ready: false,
-        failed: true,
-        reason: "MissingDependency",
-        message: `PostgresDatabase ${this.spec.database} not found`,
-      };
-    }
-
-    const dependencyReady = dependency.status?.conditions?.find(
-      (c) => c.type === "Ready" && c.status === "True",
-    );
-
-    if (!dependencyReady) {
-      return {
-        ready: false,
-        reason: "WaitingForDependency",
-        message:
-          `Waiting for PostgresDatabase ${this.spec.database} to be ready`,
-      };
-    }
-
-    // Continue with reconciliation...
-  };
-}
-```
-
-### Error Handling
-
-Proper error handling in reconciliation:
-
-```typescript
-#reconcileDeployment = async (): Promise<SubresourceResult> => {
-  try {
-    // Reconciliation logic...
-    return { ready: true };
-  } catch (error) {
-    return {
-      ready: false,
-      failed: true,
-      reason: 'ReconciliationError',
-      message: `Failed to reconcile deployment: ${error.message}`,
-    };
-  }
-};
-```
-
-## Example Usage
-
-Once your custom resource is implemented and registered, users can create
-instances using standard Kubernetes manifests. The operator will automatically
-detect new resources and begin reconciliation based on your implementation
-logic.
-
-```yaml
-apiVersion: homelab.mortenolsen.pro/v1
-kind: MyResource
-metadata:
-  name: my-app
-  namespace: default
-spec:
-  hostname: my-app.example.com
-  port: 8080
-  replicas: 3
-  protocol: https
-  database:
-    host: postgres.default.svc.cluster.local
-    port: 5432
-    name: myapp
-```
-
-**What happens when this resource is created:**
-
-1. **Validation**: The operator validates the spec against your Zod schema
-2. **Resource Creation**: Your `MyResourceResource` class is instantiated
-3. **Reconciliation**: The operator creates a Deployment with 3 replicas and a
-   Service
-4. **Status Updates**: Conditions are set to track deployment and service
-   readiness
-5. **Event Handling**: The operator watches for changes and re-reconciles as
-   needed
-
-Users can then monitor the resource status with:
-
-```bash
-kubectl get myresources my-app -o yaml
-kubectl describe myresource my-app
-```
-
-## Real Examples
-
-These examples show how the patterns described above are used in practice within
-the homelab-operator.
-
-### Simple Resource: Domain
-
-The `Domain` resource demonstrates a straightforward custom resource that
-manages external dependencies. It creates and manages TLS certificates through
-cert-manager and configures Istio gateways for HTTPS traffic routing.
-
-**What it does:**
-
-- Creates a cert-manager Certificate for TLS termination
-- Configures an Istio Gateway for traffic routing
-- Manages the lifecycle of both resources through owner references
-- Provides wildcard certificate support for subdomains
-
-```yaml
-apiVersion: homelab.mortenolsen.pro/v1
-kind: Domain
-metadata:
-  name: homelab
-  namespace: homelab
-spec:
-  hostname: local.olsen.cloud # Domain for certificate and gateway
-  issuer: letsencrypt-prod # cert-manager ClusterIssuer to use
-```
-
-**Key Implementation Features:**
-
-- **CRD Dependency Checking**: Validates that cert-manager and Istio CRDs exist
-- **Cross-Namespace Resources**: Certificate is created in the istio-ingress
-  namespace
-- **Status Aggregation**: Combines certificate and gateway readiness into
-  overall status
-- **Wildcard Support**: Automatically configures `*.hostname` for subdomains
-
-### Complex Resource: AuthentikServer
-
-The `AuthentikServer` resource showcases a complex custom resource with multiple
-dependencies and sophisticated reconciliation logic. It deploys a complete
-identity provider solution with database and Redis dependencies.
-
-**What it does:**
-
-- Deploys Authentik identity provider with proper configuration
-- Manages database schema and user creation
-- Configures Redis connection for session storage
-- Sets up domain integration for SSO endpoints
-- Handles secret generation and rotation
-
-```yaml
-apiVersion: homelab.mortenolsen.pro/v1
-kind: AuthentikServer
-metadata:
-  name: homelab
-  namespace: homelab
-spec:
-  domain: homelab # References a Domain resource
-  database: test2 # References a PostgresDatabase resource
-  redis: redis # References a Redis connection
-```
-
-**Key Implementation Features:**
-
-- **Resource Dependencies**: Waits for Domain, PostgresDatabase, and Redis
-  resources
-- **Secret Management**: Generates and manages API keys, passwords, and tokens
-- **Service Configuration**: Creates comprehensive Kubernetes manifests
-  (Deployment, Service, Ingress)
-- **Health Checking**: Monitors application readiness and database connectivity
-- **Cross-Resource Communication**: Uses other custom resources' status and
-  outputs
-
-### Database Resource: PostgresDatabase
-
-The `PostgresDatabase` resource illustrates how to manage stateful resources and
-external system integration. It creates databases within an existing PostgreSQL
-instance and manages user permissions.
-
-**What it does:**
-
-- Creates a new database in an existing PostgreSQL server
-- Generates dedicated database user with appropriate permissions
-- Manages connection secrets for applications
-- Handles database cleanup and user removal
-
-```yaml
-apiVersion: homelab.mortenolsen.pro/v1
-kind: PostgresDatabase
-metadata:
-  name: test2
-  namespace: homelab
-spec:
-  connection: homelab/db # References PostgreSQL connection (namespace/name)
-```
-
-**Key Implementation Features:**
-
-- **External System Integration**: Connects to existing PostgreSQL instances
-- **User Management**: Creates database-specific users with minimal required
-  permissions
-- **Secret Generation**: Provides connection details to consuming applications
-- **Cleanup Handling**: Safely removes databases and users when resource is
-  deleted
-- **Connection Validation**: Verifies connectivity before marking as ready
-
-**Common Patterns Across Examples:**
-
-- **Owner References**: All managed resources have proper ownership for garbage
-  collection
-- **Condition Management**: Consistent status reporting through Kubernetes
-  conditions
-- **Resource Dependencies**: Graceful handling of missing or unready
-  dependencies
-- **Secret Management**: Secure generation and storage of credentials
-- **Cross-Resource Integration**: Resources reference and depend on each other
-  appropriately
-
-## Best Practices
-
-1. **Validation**: Always use Zod schemas for comprehensive spec validation
-2. **Idempotency**: Use `deepEqual` checks to avoid unnecessary updates
-3. **Conditions**: Provide clear status information through conditions
-4. **Owner References**: Always set owner references for created resources
-5. **Error Handling**: Provide meaningful error messages and failure reasons
-6. **Dependencies**: Handle missing dependencies gracefully
-7. **Cleanup**: Leverage Kubernetes garbage collection through owner references
-8. **Testing**: Create test manifests in `test-manifests/` for your resources
-
-## Troubleshooting
-
-- **Resource not reconciling**: Check if the resource is properly registered in
-  `custom-resources.ts`
-- **Validation errors**: Ensure your Zod schema matches the expected spec
-  structure
-- **Missing dependencies**: Verify that referenced resources exist and are ready
-- **Owner reference issues**: Make sure `ownerReferences` are set correctly for
-  garbage collection
-- **Condition not updating**: Ensure you're calling `this.conditions.set()` with
-  proper status values
-
-For more examples, refer to the existing custom resources in
-`src/custom-resouces/`.

istio-test.yaml

@@ -0,0 +1,22 @@
+apiVersion: networking.istio.io/v1beta1
+kind: ServiceEntry
+metadata:
+  name: dev-authentik-override
+  namespace: dev
+spec:
+  hosts:
+    - authentik.mortenolsen.nett
+  ports:
+    - number: 443
+      name: https
+      protocol: HTTPS
+    - number: 80
+      name: http
+      protocol: HTTP
+  location: MESH_EXTERNAL
+  resolution: STATIC
+  endpoints:
+    - address: 1.1.1.1
+      ports:
+        https: 443
+        http: 80

manifests/client.yaml

@@ -0,0 +1,9 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: OidcClient
+metadata:
+  name: test-client
+spec:
+  environment: dev
+  redirectUris:
+    - url: https://localhost:3000/api/v1/authentik/oauth2/callback
+      matchingMode: strict

manifests/environment.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: dev
+---
+apiVersion: homelab.mortenolsen.pro/v1
+kind: Environment
+metadata:
+  name: prod
+spec:
+  domain: olsen.cloud
+  networkIp: 192.168.20.180
+  tls:
+    issuer: lets-encrypt-prod

manifests/example-pvc.yaml

@@ -0,0 +1,39 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: example-pvc
+  namespace: default
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: homelab-operator-local-path
+
+---
+
+apiVersion: v1
+kind: Pod
+metadata:
+  name: example-pod
+  namespace: default
+spec:
+  containers:
+    - name: example-container
+      image: alpine
+      command: ["/bin/sh", "-c", "sleep infinity"]
+      volumeMounts:
+        - name: example-volume
+          mountPath: /data
+      resources:
+        limits:
+          memory: 100Mi
+          cpu: "0.1"
+        requests:
+          memory: 50Mi
+          cpu: "0.05"
+  volumes:
+    - name: example-volume
+      persistentVolumeClaim:
+        claimName: example-pvc

manifests/test-service.yaml

@@ -0,0 +1,14 @@
+apiVersion: networking.istio.io/v1alpha3
+kind: ServiceEntry
+metadata:
+  name: test-example-com
+  namespace: dev
+spec:
+  hosts:
+    - authentik.one.dev.olsen.cloud
+      # (the address field is optional if you use 'resolution: DNS')
+  ports:
+    - number: 80
+      name: https
+      protocol: HTTPS
+  resolution: DNS

operator.yaml

@@ -0,0 +1,35 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: homelab
+
+---
+
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: homelab
+  namespace: homelab
+spec:
+  interval: 60m
+  url: https://github.com/morten-olsen/homelab-operator
+  ref:
+    branch: main
+
+---
+
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: operator
+  namespace: homelab
+spec:
+  releaseName: operator
+  interval: 60m
+  chart:
+    spec:
+      chart: charts/operator
+      sourceRef:
+        kind: GitRepository
+        name: homelab
+        namespace: homelab

package.json

@@ -22,6 +22,8 @@
   "dependencies": {
     "@goauthentik/api": "2025.6.3-1751754396",
     "@kubernetes/client-node": "^1.3.0",
+    "cloudflare": "^4.5.0",
+    "cron": "^4.3.3",
     "debounce": "^2.2.0",
     "deep-equal": "^2.2.3",
     "dotenv": "^17.2.1",
@@ -35,6 +37,12 @@
     "yaml": "^2.8.0",
     "zod": "^4.0.14"
   },
+  "imports": {
+    "#services/*": "./src/services/*",
+    "#resources/*": "./src/resources/*",
+    "#bootstrap/*": "./src/bootstrap/*",
+    "#utils/*": "./src/utils/*"
+  },
   "packageManager": "pnpm@10.6.0",
   "pnpm": {
     "onlyBuiltDependencies": [

pnpm-lock.yaml

@@ -14,6 +14,12 @@ importers:
       '@kubernetes/client-node':
         specifier: ^1.3.0
         version: 1.3.0(encoding@0.1.13)
+      cloudflare:
+        specifier: ^4.5.0
+        version: 4.5.0(encoding@0.1.13)
+      cron:
+        specifier: ^4.3.3
+        version: 4.3.3
       debounce:
         specifier: ^2.2.0
         version: 2.2.0
@@ -229,9 +235,15 @@ packages:
   '@types/lodash@4.17.20':
     resolution: {integrity: sha512-H3MHACvFUEiujabxhaI/ImO6gUrd8oOurg7LQtS7mbwIXA/cUqWrvBsaeJ23aZEPk1TAYkurjfMbSELfoCXlGA==}
 
+  '@types/luxon@3.7.1':
+    resolution: {integrity: sha512-H3iskjFIAn5SlJU7OuxUmTEpebK6TKB8rxZShDslBMZJ5u9S//KM1sbdAisiSrqwLQncVjnpi2OK2J51h+4lsg==}
+
   '@types/node-fetch@2.6.12':
     resolution: {integrity: sha512-8nneRWKCg3rMtF69nLQJnOYUcbafYeFSjqkw3jCRLsqkWFlHaoQrr5mXmofFGOx3DKn7UfmBMyov8ySvLRVldA==}
 
+  '@types/node@18.19.123':
+    resolution: {integrity: sha512-K7DIaHnh0mzVxreCR9qwgNxp3MH9dltPNIEddW9MYUlcKAzm+3grKNSTe2vCJHI1FaLpvpL5JGJrz1UZDKYvDg==}
+
   '@types/node@22.16.5':
     resolution: {integrity: sha512-bJFoMATwIGaxxx8VJPeM8TonI8t579oRvgAuT8zFugJsJZgzqv0Fu8Mhp68iecjzG7cnN3mO2dJQ5uUM2EFrgQ==}
 
@@ -303,6 +315,10 @@ packages:
   abbrev@1.1.1:
     resolution: {integrity: sha512-nne9/IiQ/hzIhY6pdDnbBtz7DjPTKrY00P/zvPSm5pOFkl6xuGrGnXn/VtTNNfNtAfZ9/1RtehkszU9qcTii0Q==}
 
+  abort-controller@3.0.0:
+    resolution: {integrity: sha512-h8lQ8tacZYnR3vNQTgibj+tODHI5/+l06Au2Pcriv/Gmet0eaj4TwWH41sO9wnHDiQsEj19q0drzdWdeAHtweg==}
+    engines: {node: '>=6.5'}
+
   acorn-jsx@5.3.2:
     resolution: {integrity: sha512-rq9s+JNhf0IChjtDXxllJ7g41oZk5SlXtp0LHwyA5cejwn7vKmKp4pPri6YEePv2PU65sAsegbXtIinmDFDXgQ==}
     peerDependencies:
@@ -479,6 +495,9 @@ packages:
     resolution: {integrity: sha512-4diC9HaTE+KRAMWhDhrGOECgWZxoevMc5TlkObMqNSsVU62PYzXZ/SMTjzyGAFF1YusgxGcSWTEXBhp0CPwQ1A==}
     engines: {node: '>=6'}
 
+  cloudflare@4.5.0:
+    resolution: {integrity: sha512-fPcbPKx4zF45jBvQ0z7PCdgejVAPBBCZxwqk1k7krQNfpM07Cfj97/Q6wBzvYqlWXx/zt1S9+m8vnfCe06umbQ==}
+
   color-convert@2.0.1:
     resolution: {integrity: sha512-RRECPsj7iu/xb5oKYcsFHSppFNnsj/52OVTRKb4zP5onXwVF3zVmmToNcOfGC+CRDpfK/U584fMg38ZHCaElKQ==}
     engines: {node: '>=7.0.0'}
@@ -507,6 +526,10 @@ packages:
   console-control-strings@1.1.0:
     resolution: {integrity: sha512-ty/fTekppD2fIwRvnZAVdeOiGd1c7YXEixbgJTNzqcxJWKQnjJ/V1bNEEE6hygpM3WjwHFUVK6HTjWSzV4a8sQ==}
 
+  cron@4.3.3:
+    resolution: {integrity: sha512-B/CJj5yL3sjtlun6RtYHvoSB26EmQ2NUmhq9ZiJSyKIM4K/fqfh9aelDFlIayD2YMeFZqWLi9hHV+c+pq2Djkw==}
+    engines: {node: '>=18.x'}
+
   cross-spawn@7.0.6:
     resolution: {integrity: sha512-uV2QOWP2nWzsy2aMp8aRibhi9dlzF5Hgh5SHaB9OiTGEyDTiJJyx0uy51QXdyWbtAHNua4XJzUKca3OzKUd3vA==}
     engines: {node: '>= 8'}
@@ -754,6 +777,10 @@ packages:
     resolution: {integrity: sha512-kVscqXk4OCp68SZ0dkgEKVi6/8ij300KBWTJq32P/dYeWTSwK41WyTxalN1eRmA5Z9UU/LX9D7FWSmV9SAYx6g==}
     engines: {node: '>=0.10.0'}
 
+  event-target-shim@5.0.1:
+    resolution: {integrity: sha512-i/2XbnSz/uxRCU6+NdVJgKWDTM427+MqYbkQzD321DuCQJUqOuJKIA0IM2+W2xtYHdKOmZ4dR6fExsd4SXL+WQ==}
+    engines: {node: '>=6'}
+
   eventemitter3@5.0.1:
     resolution: {integrity: sha512-GWkBvjiSZK87ELrYOSESUYeVIc9mvLLf/nXalMOS5dYrgZq9o5OVkbZAVM06CVxYsCwH9BDZFPlQTlPA1j4ahA==}
 
@@ -825,10 +852,17 @@ packages:
     resolution: {integrity: sha512-dKx12eRCVIzqCxFGplyFKJMPvLEWgmNtUrpTiJIR5u97zEhRG8ySrtboPHZXx7daLxQVrl643cTzbab2tkQjxg==}
     engines: {node: '>= 0.4'}
 
+  form-data-encoder@1.7.2:
+    resolution: {integrity: sha512-qfqtYan3rxrnCk1VYaA4H+Ms9xdpPqvLZa6xmMgFvhO32x7/3J/ExcTd6qpxM0vH2GdMI+poehyBZvqfMTto8A==}
+
   form-data@4.0.4:
     resolution: {integrity: sha512-KrGhL9Q4zjj0kiUt5OO4Mr/A/jlI2jDYs5eHBpYHPcBEVSiipAvn2Ko2HnPe20rmcuuvMHNdZFp+4IlGTMF0Ow==}
     engines: {node: '>= 6'}
 
+  formdata-node@4.4.1:
+    resolution: {integrity: sha512-0iirZp3uVDjVGt9p49aTaqjk84TrglENEDuqfdlZQ1roC9CWlPk6Avf8EEnZNcAqPonwkG35x4n3ww/1THYAeQ==}
+    engines: {node: '>= 12.20'}
+
   fs-constants@1.0.0:
     resolution: {integrity: sha512-y6OAwoSIf7FyjMIv94u+b5rdheZEjzR63GTyZJm5qh4Bi+2YgwLCcI/fPFZkL5PSixOt6ZNKm+w+Hfp/Bciwow==}
 
@@ -1238,6 +1272,10 @@ packages:
     resolution: {integrity: sha512-Jo6dJ04CmSjuznwJSS3pUeWmd/H0ffTlkXXgwZi+eq1UCmqQwCh+eLsYOYCwY991i2Fah4h1BEMCx4qThGbsiA==}
     engines: {node: '>=10'}
 
+  luxon@3.7.1:
+    resolution: {integrity: sha512-RkRWjA926cTvz5rAb1BqyWkKbbjzCGchDUIKMCUvNi17j6f6j8uHGDV82Aqcqtzd+icoYpELmG3ksgGiFNNcNg==}
+    engines: {node: '>=12'}
+
   make-fetch-happen@9.1.0:
     resolution: {integrity: sha512-+zopwDy7DNknmwPQplem5lAZX/eCOzSvSNNcSKm5eVwTkOBzoktEfXsa9L23J/GIRhxRsaxzkPEhrJEpE2F4Gg==}
     engines: {node: '>= 10'}
@@ -1339,6 +1377,11 @@ packages:
   node-addon-api@7.1.1:
     resolution: {integrity: sha512-5m3bsyrjFWE1xf7nz7YXdN4udnVtXK6/Yfgn5qnahL6bCkf2yKt4k3nuTKAtT4r3IG8JNR2ncsIMdZuAzJjHQQ==}
 
+  node-domexception@1.0.0:
+    resolution: {integrity: sha512-/jKZoMpw0F8GRwl4/eLROPA3cfcXtLApP0QzLmUT/HuPCZWyB7IY9ZrMeKw2O/nFIqPQB3PVM9aYm0F312AXDQ==}
+    engines: {node: '>=10.5.0'}
+    deprecated: Use your platform's native DOMException instead
+
   node-fetch@2.7.0:
     resolution: {integrity: sha512-c4FRfUm/dbcWZ7U+1Wq0AwCyFL+3nt2bEw05wfxSz+DWpWsitgmSgYmy2dQdWyKC1694ELPqMs/YzUSNozLt8A==}
     engines: {node: 4.x || >=6.0.0}
@@ -1886,6 +1929,9 @@ packages:
     resolution: {integrity: sha512-nWJ91DjeOkej/TA8pXQ3myruKpKEYgqvpw9lz4OPHj/NWFNluYrjbz9j01CJ8yKQd2g4jFoOkINCTW2I5LEEyw==}
     engines: {node: '>= 0.4'}
 
+  undici-types@5.26.5:
+    resolution: {integrity: sha512-JlCMO+ehdEIKqlFxk6IfVoAUVmgz7cU7zD/h9XZ0qzeosSHmUJVOzSQvvYSYWXkFXC+IfLKSIffhv0sVZup6pA==}
+
   undici-types@6.21.0:
     resolution: {integrity: sha512-iwDZqg0QAGrg9Rav5H4n0M64c3mkR59cJ6wQp+7C4nI0gsmExaedaYLNO44eT4AtBBwjbTiGPMlt2Md0T9H9JQ==}
 
@@ -1905,6 +1951,10 @@ packages:
   util-deprecate@1.0.2:
     resolution: {integrity: sha512-EPD5q1uXyFxJpCrLnCc1nHnq3gOa6DZBocAIiI2TaSCA7VCJ1UJDMagCzIkXNsUYfD1daK//LTEQ8xiIbrHtcw==}
 
+  web-streams-polyfill@4.0.0-beta.3:
+    resolution: {integrity: sha512-QW95TCTaHmsYfHDybGMwO5IJIM93I/6vTRk+daHTWFPhwh+C8Cg7j7XyKrwrj8Ib6vYXe0ocYNrmzY4xAAN6ug==}
+    engines: {node: '>= 14'}
+
   webidl-conversions@3.0.1:
     resolution: {integrity: sha512-2JAn3z8AR6rjK8Sm8orRC0h/bcl/DqL7tRPdGZ4I1CjdF+EaMLmYxBHyXuKL849eucPFhvBoxMsflfOb8kxaeQ==}
 
@@ -2129,11 +2179,17 @@ snapshots:
 
   '@types/lodash@4.17.20': {}
 
+  '@types/luxon@3.7.1': {}
+
   '@types/node-fetch@2.6.12':
     dependencies:
       '@types/node': 22.16.5
       form-data: 4.0.4
 
+  '@types/node@18.19.123':
+    dependencies:
+      undici-types: 5.26.5
+
   '@types/node@22.16.5':
     dependencies:
       undici-types: 6.21.0
@@ -2240,6 +2296,10 @@ snapshots:
   abbrev@1.1.1:
     optional: true
 
+  abort-controller@3.0.0:
+    dependencies:
+      event-target-shim: 5.0.1
+
   acorn-jsx@5.3.2(acorn@8.15.0):
     dependencies:
       acorn: 8.15.0
@@ -2258,7 +2318,6 @@ snapshots:
   agentkeepalive@4.6.0:
     dependencies:
       humanize-ms: 1.2.1
-    optional: true
 
   aggregate-error@3.1.0:
     dependencies:
@@ -2463,6 +2522,18 @@ snapshots:
   clean-stack@2.2.0:
     optional: true
 
+  cloudflare@4.5.0(encoding@0.1.13):
+    dependencies:
+      '@types/node': 18.19.123
+      '@types/node-fetch': 2.6.12
+      abort-controller: 3.0.0
+      agentkeepalive: 4.6.0
+      form-data-encoder: 1.7.2
+      formdata-node: 4.4.1
+      node-fetch: 2.7.0(encoding@0.1.13)
+    transitivePeerDependencies:
+      - encoding
+
   color-convert@2.0.1:
     dependencies:
       color-name: 1.1.4
@@ -2485,6 +2556,11 @@ snapshots:
   console-control-strings@1.1.0:
     optional: true
 
+  cron@4.3.3:
+    dependencies:
+      '@types/luxon': 3.7.1
+      luxon: 3.7.1
+
   cross-spawn@7.0.6:
     dependencies:
       path-key: 3.1.1
@@ -2828,6 +2904,8 @@ snapshots:
 
   esutils@2.0.3: {}
 
+  event-target-shim@5.0.1: {}
+
   eventemitter3@5.0.1: {}
 
   execa@9.6.0:
@@ -2903,6 +2981,8 @@ snapshots:
     dependencies:
       is-callable: 1.2.7
 
+  form-data-encoder@1.7.2: {}
+
   form-data@4.0.4:
     dependencies:
       asynckit: 0.4.0
@@ -2911,6 +2991,11 @@ snapshots:
       hasown: 2.0.2
       mime-types: 2.1.35
 
+  formdata-node@4.4.1:
+    dependencies:
+      node-domexception: 1.0.0
+      web-streams-polyfill: 4.0.0-beta.3
+
   fs-constants@1.0.0: {}
 
   fs-minipass@2.1.0:
@@ -3064,7 +3149,6 @@ snapshots:
   humanize-ms@1.2.1:
     dependencies:
       ms: 2.1.3
-    optional: true
 
   iconv-lite@0.6.3:
     dependencies:
@@ -3329,6 +3413,8 @@ snapshots:
       yallist: 4.0.0
     optional: true
 
+  luxon@3.7.1: {}
+
   make-fetch-happen@9.1.0:
     dependencies:
       agentkeepalive: 4.6.0
@@ -3440,6 +3526,8 @@ snapshots:
 
   node-addon-api@7.1.1: {}
 
+  node-domexception@1.0.0: {}
+
   node-fetch@2.7.0(encoding@0.1.13):
     dependencies:
       whatwg-url: 5.0.0
@@ -4098,6 +4186,8 @@ snapshots:
       has-symbols: 1.1.0
       which-boxed-primitive: 1.1.1
 
+  undici-types@5.26.5: {}
+
   undici-types@6.21.0: {}
 
   unicorn-magic@0.3.0: {}
@@ -4118,6 +4208,8 @@ snapshots:
 
   util-deprecate@1.0.2: {}
 
+  web-streams-polyfill@4.0.0-beta.3: {}
+
   webidl-conversions@3.0.1: {}
 
   whatwg-url@5.0.0:

pyproject.toml

@@ -0,0 +1,9 @@
+[project]
+name = "homelab-operator"
+version = "0.1.0"
+description = "Add your description here"
+readme = "README.md"
+requires-python = ">=3.13"
+dependencies = [
+    "kubediagrams>=0.5.0",
+]

scripts/apply-test.sh

@@ -1,4 +0,0 @@
-for f in "./test-manifests/"*; do
-  echo "Applying $f"
-  kubectl apply -f "$f"
-done

scripts/create-secrets.sh

@@ -1,20 +0,0 @@
-#!/bin/bash
-
-# Load environment variables from .env file
-if [ -f .env ]; then
-  export $(cat .env | grep -v '#' | awk '/=/ {print $1}')
-fi
-
-# Check if CLOUDFLARE_API_KEY is set
-if [ -z "${CLOUDFLARE_API_KEY}" ]; then
-  echo "Error: CLOUDFLARE_API_KEY is not set. Please add it to your .env file."
-  exit 1
-fi
-
-# Create the postgres namespace if it doesn't exist
-kubectl get namespace postgres > /dev/null 2>&1 || kubectl create namespace postgres
-
-# Create the secret
-kubectl create secret generic cloudflare-api-token \
-  --namespace cert-manager \
-  --from-literal=api-token="${CLOUDFLARE_API_KEY}"

scripts/setup-server.sh

@@ -1,3 +0,0 @@
-#!/bin/bash
-flux install --components="source-controller,helm-controller"
-kubectl create namespace homelab

skaffold.yaml

@@ -0,0 +1,25 @@
+apiVersion: skaffold/v4beta7
+kind: Config
+metadata:
+  name: homelab-operator
+
+build:
+  cluster: {}
+  artifacts:
+    - image: homelaboperator
+      context: .
+      docker:
+        dockerfile: Dockerfile
+
+manifests:
+  helm:
+    releases:
+      - name: homelab-operator
+        chartPath: charts/operator
+        setValueTemplates:
+          image.repository: '{{.IMAGE_REPO_homelaboperator}}'
+          image.tag: '{{.IMAGE_TAG_homelaboperator}}'
+
+deploy:
+  # Use kubectl to apply the manifests.
+  kubectl: {}

src/bootstrap/bootstrap.ts

@@ -0,0 +1,42 @@
+import { CloudflareTunnel } from '#resources/homelab/cloudflare-tunnel/cloudflare-tunnel.ts';
+import { ResourceService } from '#services/resources/resources.ts';
+import type { Services } from '../utils/service.ts';
+
+import { NamespaceService } from './namespaces/namespaces.ts';
+import { ReleaseService } from './releases/releases.ts';
+import { RepoService } from './repos/repos.ts';
+
+class BootstrapService {
+  #services: Services;
+
+  constructor(services: Services) {
+    this.#services = services;
+  }
+  public get namespaces() {
+    return this.#services.get(NamespaceService);
+  }
+
+  public get repos() {
+    return this.#services.get(RepoService);
+  }
+
+  public get releases() {
+    return this.#services.get(ReleaseService);
+  }
+
+  public get cloudflareTunnel() {
+    const resourceService = this.#services.get(ResourceService);
+    return resourceService.get(CloudflareTunnel, 'cloudflare-tunnel', this.namespaces.homelab.name);
+  }
+
+  public ensure = async () => {
+    await this.namespaces.ensure();
+    await this.repos.ensure();
+    await this.releases.ensure();
+    await this.cloudflareTunnel.ensure({
+      spec: {},
+    });
+  };
+}
+
+export { BootstrapService };

src/bootstrap/namespaces/namespaces.ts

@@ -0,0 +1,45 @@
+import type { Services } from '../../utils/service.ts';
+import { ResourceService } from '../../services/resources/resources.ts';
+
+import { Namespace } from '#resources/core/namespace/namespace.ts';
+
+class NamespaceService {
+  #homelab: Namespace;
+  #istioSystem: Namespace;
+  #certManager: Namespace;
+
+  constructor(services: Services) {
+    const resourceService = services.get(ResourceService);
+    this.#homelab = resourceService.get(Namespace, 'homelab');
+    this.#istioSystem = resourceService.get(Namespace, 'istio-system');
+    this.#certManager = resourceService.get(Namespace, 'cert-manager');
+
+    this.#homelab.on('changed', this.ensure);
+    this.#istioSystem.on('changed', this.ensure);
+    this.#certManager.on('changed', this.ensure);
+  }
+
+  public get homelab() {
+    return this.#homelab;
+  }
+  public get istioSystem() {
+    return this.#istioSystem;
+  }
+  public get certManager() {
+    return this.#certManager;
+  }
+
+  public ensure = async () => {
+    await this.#homelab.ensure({
+      metadata: {
+        labels: {
+          'istio-injection': 'enabled',
+        },
+      },
+    });
+    await this.#istioSystem.ensure({});
+    await this.#certManager.ensure({});
+  };
+}
+
+export { NamespaceService };

src/bootstrap/releases/releases.ts

@@ -0,0 +1,141 @@
+import { ResourceService } from '../../services/resources/resources.ts';
+import { NAMESPACE } from '../../utils/consts.ts';
+import { Services } from '../../utils/service.ts';
+import { NamespaceService } from '../namespaces/namespaces.ts';
+import { RepoService } from '../repos/repos.ts';
+
+import { HelmRelease } from '#resources/flux/helm-release/helm-release.ts';
+
+class ReleaseService {
+  #services: Services;
+  #certManager: HelmRelease;
+  #istioBase: HelmRelease;
+  #istiod: HelmRelease;
+  #istioGateway: HelmRelease;
+
+  constructor(services: Services) {
+    this.#services = services;
+    const resourceService = services.get(ResourceService);
+    this.#certManager = resourceService.get(HelmRelease, 'cert-manager', NAMESPACE);
+    this.#istioBase = resourceService.get(HelmRelease, 'istio-base', NAMESPACE);
+    this.#istiod = resourceService.get(HelmRelease, 'istiod', NAMESPACE);
+    this.#istioGateway = resourceService.get(HelmRelease, 'istio-gateway', NAMESPACE);
+
+    this.#certManager.on('changed', this.ensure);
+    this.#istioBase.on('changed', this.ensure);
+    this.#istiod.on('changed', this.ensure);
+    this.#istioGateway.on('changed', this.ensure);
+  }
+
+  public get certManager() {
+    return this.#certManager;
+  }
+  public get istioBase() {
+    return this.#istioBase;
+  }
+  public get istiod() {
+    return this.#istiod;
+  }
+
+  public ensure = async () => {
+    const namespaceService = this.#services.get(NamespaceService);
+    const repoService = this.#services.get(RepoService);
+    await this.#certManager.ensure({
+      spec: {
+        targetNamespace: namespaceService.certManager.name,
+        interval: '1h',
+        values: {
+          installCRDs: true,
+        },
+        chart: {
+          spec: {
+            chart: 'cert-manager',
+            version: 'v1.18.2',
+            sourceRef: {
+              apiVersion: 'source.toolkit.fluxcd.io/v1',
+              kind: 'HelmRepository',
+              name: repoService.jetstack.name,
+              namespace: repoService.jetstack.namespace,
+            },
+          },
+        },
+      },
+    });
+    await this.#istioBase.ensure({
+      spec: {
+        targetNamespace: namespaceService.istioSystem.name,
+        interval: '1h',
+        values: {
+          defaultRevision: 'default',
+          profile: 'ambient',
+        },
+        chart: {
+          spec: {
+            chart: 'base',
+            version: '1.24.3',
+            sourceRef: {
+              apiVersion: 'source.toolkit.fluxcd.io/v1',
+              kind: 'HelmRepository',
+              name: repoService.istio.name,
+              namespace: repoService.istio.namespace,
+            },
+          },
+        },
+      },
+    });
+    await this.#istiod.ensure({
+      spec: {
+        targetNamespace: namespaceService.istioSystem.name,
+        interval: '1h',
+        dependsOn: [
+          {
+            name: this.#istioBase.name,
+            namespace: this.#istioBase.namespace,
+          },
+        ],
+        chart: {
+          spec: {
+            chart: 'istiod',
+            version: '1.24.3',
+            sourceRef: {
+              apiVersion: 'source.toolkit.fluxcd.io/v1',
+              kind: 'HelmRepository',
+              name: repoService.istio.name,
+              namespace: repoService.istio.namespace,
+            },
+          },
+        },
+      },
+    });
+    await this.#istioGateway.ensure({
+      spec: {
+        targetNamespace: NAMESPACE,
+        interval: '1h',
+        dependsOn: [
+          {
+            name: this.#istioBase.name,
+            namespace: this.#istioBase.namespace,
+          },
+          {
+            name: this.#istiod.name,
+            namespace: this.#istiod.namespace,
+          },
+        ],
+        chart: {
+          spec: {
+            chart: 'gateway',
+            version: '1.24.3',
+            sourceRef: {
+              apiVersion: 'source.toolkit.fluxcd.io/v1',
+              kind: 'HelmRepository',
+              name: repoService.istio.name,
+              namespace: repoService.istio.namespace,
+            },
+          },
+        },
+      },
+    });
+  };
+}
+
+export { ReleaseService };

src/bootstrap/repos/repos.ts

@@ -0,0 +1,72 @@
+import type { Services } from '../../utils/service.ts';
+import { ResourceService } from '../../services/resources/resources.ts';
+import { NAMESPACE } from '../../utils/consts.ts';
+
+import { HelmRepo } from '#resources/flux/helm-repo/helm-repo.ts';
+
+class RepoService {
+  #jetstack: HelmRepo;
+  #istio: HelmRepo;
+  #authentik: HelmRepo;
+  #cloudflare: HelmRepo;
+  #argo: HelmRepo;
+
+  constructor(services: Services) {
+    const resourceService = services.get(ResourceService);
+    this.#jetstack = resourceService.get(HelmRepo, 'jetstack', NAMESPACE);
+    this.#istio = resourceService.get(HelmRepo, 'istio', NAMESPACE);
+    this.#authentik = resourceService.get(HelmRepo, 'authentik', NAMESPACE);
+    this.#cloudflare = resourceService.get(HelmRepo, 'cloudflare', NAMESPACE);
+    this.#argo = resourceService.get(HelmRepo, 'argo', NAMESPACE);
+
+    this.#jetstack.on('changed', this.ensure);
+    this.#istio.on('changed', this.ensure);
+    this.#authentik.on('changed', this.ensure);
+    this.#cloudflare.on('changed', this.ensure);
+    this.#argo.on('changed', this.ensure);
+  }
+
+  public get jetstack() {
+    return this.#jetstack;
+  }
+
+  public get istio() {
+    return this.#istio;
+  }
+
+  public get authentik() {
+    return this.#authentik;
+  }
+
+  public get cloudflare() {
+    return this.#cloudflare;
+  }
+
+  public get argo() {
+    return this.#argo;
+  }
+
+  public ensure = async () => {
+    await this.#jetstack.set({
+      url: 'https://charts.jetstack.io',
+    });
+
+    await this.#istio.set({
+      url: 'https://istio-release.storage.googleapis.com/charts',
+    });
+
+    await this.#authentik.set({
+      url: 'https://charts.goauthentik.io',
+    });
+
+    await this.#cloudflare.set({
+      url: 'https://cloudflare.github.io/helm-charts',
+    });
+
+    await this.#argo.set({
+      url: 'https://argoproj.github.io/argo-helm',
+    });
+  };
+}
+
+export { RepoService };

src/custom-resouces/authentik-client/authentik-client.resource.ts

@@ -1,192 +0,0 @@
-import type { V1Secret } from '@kubernetes/client-node';
-import type { z } from 'zod';
-import deepEqual from 'deep-equal';
-
-import {
-  CustomResource,
-  type CustomResourceObject,
-  type CustomResourceOptions,
-  type SubresourceResult,
-} from '../../services/custom-resources/custom-resources.custom-resource.ts';
-import { ResourceReference } from '../../services/resources/resources.ref.ts';
-import { ResourceService, type Resource } from '../../services/resources/resources.ts';
-import { getWithNamespace } from '../../utils/naming.ts';
-import type { authentikServerSpecSchema } from '../authentik-server/authentik-server.scemas.ts';
-import type { domainSpecSchema } from '../domain/domain.schemas.ts';
-import { decodeSecret, encodeSecret } from '../../utils/secrets.ts';
-import { API_VERSION, CONTROLLED_LABEL } from '../../utils/consts.ts';
-
-import { authentikClientSecretSchema, type authentikClientSpecSchema } from './authentik-client.schemas.ts';
-
-class AuthentikClientResource extends CustomResource<typeof authentikClientSpecSchema> {
-  #serverResource: ResourceReference<CustomResourceObject<typeof authentikServerSpecSchema>>;
-  #serverSecretResource: ResourceReference<V1Secret>;
-  #domainResource: ResourceReference<CustomResourceObject<typeof domainSpecSchema>>;
-  #clientSecretResource: Resource<V1Secret>;
-
-  constructor(options: CustomResourceOptions<typeof authentikClientSpecSchema>) {
-    super(options);
-    const resourceService = this.services.get(ResourceService);
-
-    this.#serverResource = new ResourceReference();
-    this.#serverSecretResource = new ResourceReference();
-    this.#domainResource = new ResourceReference();
-    this.#clientSecretResource = resourceService.get({
-      apiVersion: 'v1',
-      kind: 'Secret',
-      name: `authentik-client-${this.name}`,
-      namespace: this.namespace,
-    });
-
-    this.#updateResouces();
-
-    this.#serverResource.on('changed', this.queueReconcile);
-    this.#serverSecretResource.on('changed', this.queueReconcile);
-    this.#domainResource.on('changed', this.queueReconcile);
-    this.#clientSecretResource.on('changed', this.queueReconcile);
-  }
-
-  get server() {
-    return this.#serverResource.current;
-  }
-
-  get serverSecret() {
-    return this.#serverSecretResource.current;
-  }
-
-  get serverSecretValue() {
-    return decodeSecret(this.#serverSecretResource.current?.data);
-  }
-
-  get domain() {
-    return this.#domainResource.current;
-  }
-
-  get clientSecret() {
-    return this.#clientSecretResource;
-  }
-
-  get clientSecretValue() {
-    const values = decodeSecret(this.#clientSecretResource.data);
-    const parsed = authentikClientSecretSchema.safeParse(values);
-    if (!parsed.success) {
-      return undefined;
-    }
-    return parsed.data;
-  }
-
-  #updateResouces = () => {
-    const serverNames = getWithNamespace(this.spec.server, this.namespace);
-    const resourceService = this.services.get(ResourceService);
-    this.#serverResource.current = resourceService.get({
-      apiVersion: API_VERSION,
-      kind: 'AuthentikServer',
-      name: serverNames.name,
-      namespace: serverNames.namespace,
-    });
-    this.#serverSecretResource.current = resourceService.get({
-      apiVersion: 'v1',
-      kind: 'Secret',
-      name: `authentik-server-${serverNames.name}`,
-      namespace: serverNames.namespace,
-    });
-    const server = this.#serverResource.current;
-    if (server && server.spec) {
-      const domainNames = getWithNamespace(server.spec.domain, server.namespace);
-      this.#domainResource.current = resourceService.get({
-        apiVersion: API_VERSION,
-        kind: 'Domain',
-        name: domainNames.name,
-        namespace: domainNames.namespace,
-      });
-    } else {
-      this.#domainResource.current = undefined;
-    }
-  };
-
-  #reconcileClientSecret = async (): Promise<SubresourceResult> => {
-    const domain = this.domain;
-    const server = this.server;
-    const serverSecret = this.serverSecret;
-    if (!server?.exists || !server?.spec || !serverSecret?.exists || !serverSecret.data) {
-      return {
-        ready: false,
-        failed: true,
-        message: 'Server or server secret not found',
-      };
-    }
-    if (!domain?.exists || !domain?.spec) {
-      return {
-        ready: false,
-        failed: true,
-        message: 'Domain not found',
-      };
-    }
-    const url = `https://authentik.${domain.spec?.hostname}`;
-    const appName = this.name;
-    const values = this.clientSecretValue;
-    const expectedValues: Omit<z.infer<typeof authentikClientSecretSchema>, 'clientSecret'> = {
-      clientId: this.name,
-      configuration: new URL(`/application/o/${appName}/.well-known/openid-configuration`, url).toString(),
-      configurationIssuer: new URL(`/application/o/${appName}/`, url).toString(),
-      authorization: new URL(`/application/o/${appName}/authorize/`, url).toString(),
-      token: new URL(`/application/o/${appName}/token/`, url).toString(),
-      userinfo: new URL(`/application/o/${appName}/userinfo/`, url).toString(),
-      endSession: new URL(`/application/o/${appName}/end-session/`, url).toString(),
-      jwks: new URL(`/application/o/${appName}/jwks/`, url).toString(),
-    };
-    if (!values) {
-      await this.clientSecret.patch({
-        metadata: {
-          ownerReferences: [this.ref],
-          labels: {
-            ...CONTROLLED_LABEL,
-          },
-        },
-        data: encodeSecret({
-          ...expectedValues,
-          clientSecret: crypto.randomUUID(),
-        }),
-      });
-      return {
-        ready: false,
-        syncing: true,
-        message: 'UpdatingManifest',
-      };
-    }
-    const compareData = {
-      ...values,
-      clientSecret: undefined,
-    };
-    if (!deepEqual(compareData, expectedValues)) {
-      await this.clientSecret.patch({
-        metadata: {
-          ownerReferences: [this.ref],
-          labels: {
-            ...CONTROLLED_LABEL,
-          },
-        },
-        data: encodeSecret(expectedValues),
-      });
-    }
-    return {
-      ready: true,
-    };
-  };
-
-  public reconcile = async () => {
-    if (!this.exists || this.metadata.deletionTimestamp) {
-      return;
-    }
-    this.#updateResouces();
-    await Promise.all([this.reconcileSubresource('Secret', this.#reconcileClientSecret)]);
-
-    const secretReady = this.conditions.get('Secret')?.status === 'True';
-
-    await this.conditions.set('Ready', {
-      status: secretReady ? 'True' : 'False',
-    });
-  };
-}
-
-export { AuthentikClientResource };

src/custom-resouces/authentik-client/authentik-client.schemas.ts

@@ -1,28 +0,0 @@
-import { ClientTypeEnum, MatchingModeEnum, SubModeEnum } from '@goauthentik/api';
-import { z } from 'zod';
-
-const authentikClientSpecSchema = z.object({
-  server: z.string(),
-  subMode: z.enum(SubModeEnum).optional(),
-  clientType: z.enum(ClientTypeEnum).optional(),
-  redirectUris: z.array(
-    z.object({
-      url: z.string(),
-      matchingMode: z.enum(MatchingModeEnum).optional(),
-    }),
-  ),
-});
-
-const authentikClientSecretSchema = z.object({
-  clientId: z.string(),
-  clientSecret: z.string().optional(),
-  configuration: z.string(),
-  configurationIssuer: z.string(),
-  authorization: z.string(),
-  token: z.string(),
-  userinfo: z.string(),
-  endSession: z.string(),
-  jwks: z.string(),
-});
-
-export { authentikClientSpecSchema, authentikClientSecretSchema };

src/custom-resouces/authentik-client/authentik-client.ts

@@ -1,19 +0,0 @@
-import { createCustomResourceDefinition } from '../../services/custom-resources/custom-resources.ts';
-import { GROUP } from '../../utils/consts.ts';
-
-import { AuthentikClientResource } from './authentik-client.resource.ts';
-import { authentikClientSpecSchema } from './authentik-client.schemas.ts';
-
-const authentikClientDefinition = createCustomResourceDefinition({
-  group: GROUP,
-  version: 'v1',
-  kind: 'AuthentikClient',
-  names: {
-    plural: 'authentikclients',
-    singular: 'authentikclient',
-  },
-  create: (options) => new AuthentikClientResource(options),
-  spec: authentikClientSpecSchema,
-});
-
-export { authentikClientDefinition };

src/custom-resouces/authentik-server/authentik-server.create-manifests.ts

@@ -1,176 +0,0 @@
-import type { CustomResourceObject } from '../../services/custom-resources/custom-resources.custom-resource.ts';
-import { API_VERSION, CONTROLLED_LABEL } from '../../utils/consts.ts';
-import type { domainServiceSpecSchema } from '../domain-service/domain-service.schemas.ts';
-
-type CreateContainerManifestOptions = {
-  name: string;
-  namespace: string;
-  command: string;
-  owner: ExpectedAny;
-  secret: string;
-  bootstrap: {
-    email: string;
-    password: string;
-    token: string;
-  };
-  posgtres: {
-    host: string;
-    port: string;
-    name: string;
-    user: string;
-    password: string;
-  };
-  redis: {
-    host: string;
-    port: string;
-  };
-};
-const createManifest = (options: CreateContainerManifestOptions) => ({
-  apiVersion: 'apps/v1',
-  kind: 'Deployment',
-  metadata: {
-    name: options.name,
-    namespace: options.namespace,
-    labels: {
-      'app.kubernetes.io/name': options.name,
-      ...CONTROLLED_LABEL,
-    },
-    ownerReferences: [options.owner],
-  },
-  spec: {
-    replicas: 1,
-    selector: {
-      matchLabels: {
-        'app.kubernetes.io/name': options.name,
-      },
-    },
-    template: {
-      metadata: {
-        labels: {
-          'app.kubernetes.io/name': options.name,
-        },
-      },
-      spec: {
-        containers: [
-          {
-            name: options.name,
-            image: 'ghcr.io/goauthentik/server:2025.6.4',
-            args: [options.command],
-            env: [
-              { name: 'AUTHENTIK_SECRET_KEY', value: options.secret },
-              { name: 'AUTHENTIK_POSTGRESQL__HOST', value: options.posgtres.host },
-              {
-                name: 'AUTHENTIK_POSTGRESQL__PORT',
-                value: '5432',
-              },
-              {
-                name: 'AUTHENTIK_POSTGRESQL__NAME',
-                value: options.posgtres.name,
-              },
-              {
-                name: 'AUTHENTIK_POSTGRESQL__USER',
-                value: options.posgtres.user,
-              },
-              {
-                name: 'AUTHENTIK_POSTGRESQL__PASSWORD',
-                value: options.posgtres.password,
-              },
-              {
-                name: 'AUTHENTIK_REDIS__HOST',
-                value: options.redis.host,
-              },
-              {
-                name: 'AUTHENTIK_REDIS__PORT',
-                value: options.redis.port,
-              },
-              {
-                name: 'AUTHENTIK_BOOTSTRAP_PASSWORD',
-                value: options.bootstrap.password,
-              },
-              {
-                name: 'AUTHENTIK_BOOTSTRAP_TOKEN',
-                value: options.bootstrap.token,
-              },
-              {
-                name: 'AUTHENTIK_BOOTSTRAP_EMAIL',
-                value: options.bootstrap.email,
-              },
-            ],
-            ports: [
-              {
-                name: 'http',
-                containerPort: 9000,
-                protocol: 'TCP',
-              },
-            ],
-          },
-        ],
-      },
-    },
-  },
-});
-
-type CreateServiceManifestOptions = {
-  name: string;
-  namespace: string;
-  owner: ExpectedAny;
-  appName: string;
-};
-const createServiceManifest = (options: CreateServiceManifestOptions) => ({
-  apiVersion: 'v1',
-  kind: 'Service',
-  metadata: {
-    name: options.name,
-    namespace: options.namespace,
-    labels: {
-      ...CONTROLLED_LABEL,
-    },
-    ownerReferences: [options.owner],
-  },
-  spec: {
-    type: 'ClusterIP',
-    ports: [
-      {
-        port: 9000,
-        targetPort: 9000,
-        protocol: 'TCP',
-        name: 'http',
-      },
-    ],
-    selector: {
-      'app.kubernetes.io/name': options.appName,
-    },
-  },
-});
-
-type CreateDomainServiceOptions = {
-  name: string;
-  namespace: string;
-  owner: ExpectedAny;
-  subdomain: string;
-  host: string;
-  domain: string;
-};
-const createDomainService = (
-  options: CreateDomainServiceOptions,
-): Omit<CustomResourceObject<typeof domainServiceSpecSchema>, 'status'> => ({
-  apiVersion: API_VERSION,
-  kind: 'DomainService',
-  metadata: {
-    name: options.name,
-    namespace: options.namespace,
-    ownerReferences: [options.owner],
-  },
-  spec: {
-    domain: options.domain,
-    subdomain: options.subdomain,
-    destination: {
-      host: options.host,
-      port: {
-        number: 9000,
-      },
-    },
-  },
-});
-
-export { createManifest, createServiceManifest, createDomainService };

src/custom-resouces/authentik-server/authentik-server.resource.ts

@@ -1,382 +0,0 @@
-import type { V1Service, V1Deployment, V1Secret } from '@kubernetes/client-node';
-import { z } from 'zod';
-
-import {
-  CustomResource,
-  type CustomResourceObject,
-  type CustomResourceOptions,
-  type SubresourceResult,
-} from '../../services/custom-resources/custom-resources.custom-resource.ts';
-import { ResourceReference } from '../../services/resources/resources.ref.ts';
-import { ResourceService, type Resource } from '../../services/resources/resources.ts';
-import type { domainSpecSchema } from '../domain/domain.schemas.ts';
-import type { domainServiceSpecSchema } from '../domain-service/domain-service.schemas.ts';
-import type { EnsuredSecret } from '../../services/secrets/secrets.secret.ts';
-import { getWithNamespace } from '../../utils/naming.ts';
-import { API_VERSION } from '../../utils/consts.ts';
-import { SecretService } from '../../services/secrets/secrets.ts';
-import { decodeSecret } from '../../utils/secrets.ts';
-import type { postgresDatabaseSecretSchema } from '../postgres-database/postgres-database.resource.ts';
-import type { redisConnectionSpecSchema } from '../redis-connection/redis-connection.schemas.ts';
-import { isDeepSubset } from '../../utils/objects.ts';
-
-import { authentikServerSecretSchema, type authentikServerSpecSchema } from './authentik-server.scemas.ts';
-import { createDomainService, createManifest, createServiceManifest } from './authentik-server.create-manifests.ts';
-
-class AuthentikServerResource extends CustomResource<typeof authentikServerSpecSchema> {
-  #domainResource: ResourceReference<CustomResourceObject<typeof domainSpecSchema>>;
-  #databaseSecretResource: ResourceReference<V1Secret>;
-  #redisResource: ResourceReference<CustomResourceObject<typeof redisConnectionSpecSchema>>;
-  #redisSecretResource: ResourceReference<V1Secret>;
-  #deploymentServerResource: Resource<V1Deployment>;
-  #deploymentWorkerResource: Resource<V1Deployment>;
-  #service: Resource<V1Service>;
-  #domainServiceResource: Resource<CustomResourceObject<typeof domainServiceSpecSchema>>;
-  #secret: EnsuredSecret<typeof authentikServerSecretSchema>;
-
-  constructor(options: CustomResourceOptions<typeof authentikServerSpecSchema>) {
-    super(options);
-    const resourceService = this.services.get(ResourceService);
-    const secretService = this.services.get(SecretService);
-
-    this.#domainResource = new ResourceReference();
-    this.#databaseSecretResource = new ResourceReference();
-    this.#redisResource = new ResourceReference();
-    this.#redisSecretResource = new ResourceReference();
-
-    this.#deploymentServerResource = resourceService.get({
-      apiVersion: 'apps/v1',
-      kind: 'Deployment',
-      name: this.#serverName,
-      namespace: this.namespace,
-    });
-
-    this.#deploymentWorkerResource = resourceService.get({
-      apiVersion: 'apps/v1',
-      kind: 'Deployment',
-      name: this.#workerName,
-      namespace: this.namespace,
-    });
-
-    this.#domainServiceResource = resourceService.get({
-      apiVersion: API_VERSION,
-      kind: 'DomainService',
-      name: this.name,
-      namespace: this.namespace,
-    });
-
-    this.#service = resourceService.get({
-      apiVersion: 'v1',
-      kind: 'Service',
-      name: this.name,
-      namespace: this.namespace,
-    });
-
-    this.#secret = secretService.ensure({
-      name: `authentik-server-${this.name}`,
-      namespace: this.namespace,
-      schema: authentikServerSecretSchema,
-      generator: () => ({
-        secret: crypto.randomUUID(),
-        token: crypto.randomUUID(),
-        password: crypto.randomUUID(),
-      }),
-    });
-
-    this.#domainServiceResource = resourceService.get({
-      apiVersion: API_VERSION,
-      kind: 'DomainService',
-      name: this.name,
-      namespace: this.namespace,
-    });
-
-    this.#updateResources();
-
-    this.#domainResource.on('changed', this.queueReconcile);
-    this.#databaseSecretResource.on('changed', this.queueReconcile);
-    this.#redisResource.on('changed', this.queueReconcile);
-    this.#redisSecretResource.on('changed', this.queueReconcile);
-    this.#deploymentServerResource.on('changed', this.queueReconcile);
-    this.#deploymentWorkerResource.on('changed', this.queueReconcile);
-    this.#domainServiceResource.on('changed', this.queueReconcile);
-    this.#service.on('changed', this.queueReconcile);
-    this.#secret.resouce.on('changed', this.queueReconcile);
-  }
-
-  get #databaseSecretName() {
-    const { name } = getWithNamespace(this.spec.database);
-    return `postgres-database-${name}`;
-  }
-
-  get #workerName() {
-    return `${this.name}-worker`;
-  }
-
-  get #serverName() {
-    return `${this.name}-server`;
-  }
-
-  #updateResources = () => {
-    if (!this.isValidSpec) {
-      return;
-    }
-    const resourceService = this.services.get(ResourceService);
-    const redisNames = getWithNamespace(this.spec.redis, this.namespace);
-    const redisResource = resourceService.get<CustomResourceObject<typeof redisConnectionSpecSchema>>({
-      apiVersion: API_VERSION,
-      kind: 'RedisConnection',
-      name: redisNames.name,
-      namespace: redisNames.namespace,
-    });
-    this.#redisResource.current = redisResource;
-    const redis = this.#redisResource.current;
-
-    if (redis.exists && redis.spec) {
-      const redisSecretNames = getWithNamespace(redis.spec.secret, redis.namespace);
-      this.#redisSecretResource.current = resourceService.get({
-        apiVersion: 'v1',
-        kind: 'Secret',
-        name: redisSecretNames.name,
-        namespace: redisSecretNames.namespace,
-      });
-    } else {
-      this.#redisSecretResource.current = undefined;
-    }
-
-    const domainNames = getWithNamespace(this.spec.domain, this.namespace);
-    const databaseNames = getWithNamespace(this.spec.database, this.namespace);
-
-    this.#domainResource.current = resourceService.get({
-      apiVersion: API_VERSION,
-      kind: 'Domain',
-      name: domainNames.name,
-      namespace: domainNames.namespace,
-    });
-
-    this.#databaseSecretResource.current = resourceService.get({
-      apiVersion: 'v1',
-      kind: 'Secret',
-      name: this.#databaseSecretName,
-      namespace: databaseNames.namespace,
-    });
-  };
-
-  #reconcileWorkerDeployment = async (): Promise<SubresourceResult> => {
-    const domainService = this.#domainResource.current;
-    if (!domainService?.exists || !domainService.spec) {
-      return {
-        ready: false,
-        failed: true,
-        reason: 'MissingDomain',
-      };
-    }
-    const databaseSecret = decodeSecret<z.infer<typeof postgresDatabaseSecretSchema>>(
-      this.#databaseSecretResource.current?.data,
-    );
-    if (!databaseSecret) {
-      return {
-        ready: false,
-        failed: true,
-        reason: 'MissingDatabase',
-      };
-    }
-    const secret = this.#secret.value;
-    if (!this.#secret.isValid || !secret) {
-      return {
-        ready: false,
-        syncing: true,
-        reason: 'WaitingForSecret',
-      };
-    }
-
-    const redisSecret = decodeSecret(this.#redisSecretResource.current?.data);
-    if (!redisSecret || !redisSecret.host) {
-      return {
-        ready: false,
-        failed: true,
-        reason: 'MissingRedisSecret',
-      };
-    }
-
-    const email = `admin@${domainService.spec.hostname}`;
-    const manifest = createManifest({
-      name: this.#workerName,
-      namespace: this.namespace,
-      secret: secret.secret,
-      command: 'worker',
-      owner: this.ref,
-      bootstrap: {
-        email,
-        token: secret.token,
-        password: secret.password,
-      },
-      redis: {
-        host: redisSecret.host,
-        port: redisSecret.port ?? '6379',
-      },
-      posgtres: {
-        host: databaseSecret.host,
-        port: databaseSecret.port || '5432',
-        name: databaseSecret.database,
-        user: databaseSecret.user,
-        password: databaseSecret.password,
-      },
-    });
-    if (!isDeepSubset(this.#deploymentWorkerResource.spec, manifest.spec)) {
-      await this.#deploymentWorkerResource.patch(manifest);
-      return {
-        ready: false,
-        syncing: true,
-        reason: 'ManifestNeedsPatching',
-      };
-    }
-    return {
-      ready: true,
-    };
-  };
-
-  #reconcileServerDeployment = async (): Promise<SubresourceResult> => {
-    const domainService = this.#domainResource.current;
-    if (!domainService?.exists || !domainService.spec) {
-      return {
-        ready: false,
-        failed: true,
-        reason: 'MissingDomain',
-      };
-    }
-    const databaseSecret = decodeSecret<z.infer<typeof postgresDatabaseSecretSchema>>(
-      this.#databaseSecretResource.current?.data,
-    );
-    if (!databaseSecret) {
-      return {
-        ready: false,
-        failed: true,
-        reason: 'MissingDatabase',
-      };
-    }
-    const secret = this.#secret.value;
-    if (!this.#secret.isValid || !secret) {
-      return {
-        ready: false,
-        syncing: true,
-        reason: 'WaitingForSecret',
-      };
-    }
-
-    const redisSecret = decodeSecret(this.#redisSecretResource.current?.data);
-    if (!redisSecret || !redisSecret.host) {
-      return {
-        ready: false,
-        failed: true,
-        reason: 'MissingRedisSecret',
-      };
-    }
-
-    const email = `admin@${domainService.spec.hostname}`;
-    const manifest = createManifest({
-      name: this.#serverName,
-      namespace: this.namespace,
-      secret: secret.secret,
-      command: 'server',
-      owner: this.ref,
-      bootstrap: {
-        email,
-        token: secret.token,
-        password: secret.password,
-      },
-      redis: {
-        host: redisSecret.host,
-        port: redisSecret.port ?? '6379',
-      },
-      posgtres: {
-        host: databaseSecret.host,
-        port: databaseSecret.port || '5432',
-        name: databaseSecret.database,
-        user: databaseSecret.user,
-        password: databaseSecret.password,
-      },
-    });
-    if (!isDeepSubset(this.#deploymentServerResource.spec, manifest.spec)) {
-      await this.#deploymentServerResource.patch(manifest);
-      return {
-        ready: false,
-        syncing: true,
-        reason: 'ManifestNeedsPatching',
-      };
-    }
-    return {
-      ready: true,
-    };
-  };
-
-  #reconcileService = async (): Promise<SubresourceResult> => {
-    const manifest = createServiceManifest({
-      name: this.name,
-      namespace: this.namespace,
-      owner: this.ref,
-      appName: this.#serverName,
-    });
-
-    if (!isDeepSubset(manifest.spec, this.#service.manifest)) {
-      await this.#service.patch(manifest);
-      return {
-        ready: false,
-        syncing: true,
-        reason: 'UpdatingManifest',
-      };
-    }
-    return {
-      ready: true,
-    };
-  };
-
-  #reconcileDomainService = async (): Promise<SubresourceResult> => {
-    const manifest = createDomainService({
-      name: this.name,
-      namespace: this.namespace,
-      owner: this.ref,
-      domain: this.spec.domain,
-      host: `${this.name}.${this.namespace}.svc.cluster.local`,
-      subdomain: this.spec.subdomain,
-    });
-    if (!isDeepSubset(manifest.spec, this.#domainServiceResource.spec)) {
-      await this.#domainServiceResource.patch(manifest);
-      return {
-        ready: false,
-        syncing: true,
-        reason: 'UpdatingManifest',
-      };
-    }
-    return {
-      ready: true,
-    };
-  };
-
-  public reconcile = async () => {
-    if (!this.isValidSpec) {
-      await this.conditions.set('Ready', {
-        status: 'False',
-        reason: 'Invalid spec',
-      });
-    }
-    this.#updateResources();
-
-    await Promise.allSettled([
-      this.reconcileSubresource('Worker', this.#reconcileWorkerDeployment),
-      this.reconcileSubresource('Server', this.#reconcileServerDeployment),
-      this.reconcileSubresource('Service', this.#reconcileService),
-      this.reconcileSubresource('DomainService', this.#reconcileDomainService),
-    ]);
-
-    const workerReady = this.conditions.get('Worker')?.status === 'True';
-    const serverReady = this.conditions.get('Server')?.status === 'True';
-    const serviceReady = this.conditions.get('Service')?.status === 'True';
-    const domainServiceReady = this.conditions.get('DomainService')?.status === 'True';
-
-    await this.conditions.set('Ready', {
-      status: workerReady && serverReady && serviceReady && domainServiceReady ? 'True' : 'False',
-    });
-  };
-}
-
-export { AuthentikServerResource };

src/custom-resouces/authentik-server/authentik-server.scemas.ts

@@ -1,16 +0,0 @@
-import { z } from 'zod';
-
-const authentikServerSpecSchema = z.object({
-  domain: z.string(),
-  subdomain: z.string(),
-  database: z.string(),
-  redis: z.string(),
-});
-
-const authentikServerSecretSchema = z.object({
-  secret: z.string(),
-  password: z.string(),
-  token: z.string(),
-});
-
-export { authentikServerSpecSchema, authentikServerSecretSchema };

src/custom-resouces/authentik-server/authentik-server.ts

@@ -1,19 +0,0 @@
-import { createCustomResourceDefinition } from '../../services/custom-resources/custom-resources.ts';
-import { GROUP } from '../../utils/consts.ts';
-
-import { AuthentikServerResource } from './authentik-server.resource.ts';
-import { authentikServerSpecSchema } from './authentik-server.scemas.ts';
-
-const authentikServerDefinition = createCustomResourceDefinition({
-  group: GROUP,
-  version: 'v1',
-  kind: 'AuthentikServer',
-  names: {
-    plural: 'authentikservers',
-    singular: 'authentikserver',
-  },
-  spec: authentikServerSpecSchema,
-  create: (options) => new AuthentikServerResource(options),
-});
-
-export { authentikServerDefinition };

src/custom-resouces/custom-resources.ts

@@ -1,25 +0,0 @@
-import { authentikServerDefinition } from './authentik-server/authentik-server.ts';
-import { authentikClientDefinition } from './authentik-client/authentik-client.ts';
-import { domainServiceDefinition } from './domain-service/domain-service.ts';
-import { domainDefinition } from './domain/domain.ts';
-import { postgresConnectionDefinition } from './postgres-connection/postgres-connection.ts';
-import { postgresDatabaseDefinition } from './postgres-database/postgres-database.ts';
-import { redisConnectionDefinition } from './redis-connection/redis-connection.ts';
-import { homelabDefinition } from './homelab/homelab.ts';
-import { postgresClusterDefinition } from './postgres-cluster/postgres-cluster.ts';
-import { redisServerDefinition } from './redis-server/redis-server.ts';
-
-const customResources = [
-  homelabDefinition,
-  domainDefinition,
-  domainServiceDefinition,
-  postgresClusterDefinition,
-  postgresConnectionDefinition,
-  postgresDatabaseDefinition,
-  redisServerDefinition,
-  redisConnectionDefinition,
-  authentikServerDefinition,
-  authentikClientDefinition,
-];
-
-export { customResources };

src/custom-resouces/domain-service/domain-service.create-manifests.ts

@@ -1,86 +0,0 @@
-import type { KubernetesObject } from '@kubernetes/client-node';
-
-import type { K8SVirtualServiceV1 } from '../../__generated__/resources/K8SVirtualServiceV1.ts';
-import type { K8SDestinationRuleV1 } from '../../__generated__/resources/K8SDestinationRuleV1.ts';
-import { CONTROLLED_LABEL } from '../../utils/consts.ts';
-
-type CreateVirtualServiceManifestOptions = {
-  name: string;
-  namespace: string;
-  owner: ExpectedAny;
-  host: string;
-  gateway: string;
-  destination: {
-    host: string;
-    port: {
-      number?: number;
-      name?: string;
-    };
-  };
-};
-const createVirtualServiceManifest = (
-  options: CreateVirtualServiceManifestOptions,
-): KubernetesObject & K8SVirtualServiceV1 => ({
-  apiVersion: 'networking.istio.io/v1',
-  kind: 'VirtualService',
-  metadata: {
-    name: options.name,
-    namespace: options.namespace,
-    ownerReferences: [options.owner],
-    labels: {
-      ...CONTROLLED_LABEL,
-    },
-  },
-  spec: {
-    hosts: [options.host],
-    gateways: [options.gateway],
-    http: [
-      {
-        match: [
-          {
-            uri: {
-              prefix: '/',
-            },
-          },
-        ],
-        route: [
-          {
-            destination: {
-              host: options.destination.host,
-              port: options.destination.port,
-            },
-          },
-        ],
-      },
-    ],
-  },
-});
-
-type CreateDestinationRuleManifestOptions = {
-  name: string;
-  namespace: string;
-  host: string;
-};
-const createDestinationRuleManifest = (
-  options: CreateDestinationRuleManifestOptions,
-): KubernetesObject & K8SDestinationRuleV1 => ({
-  apiVersion: 'networking.istio.io/v1',
-  kind: 'DestinationRule',
-  metadata: {
-    name: options.name,
-    namespace: options.namespace,
-    labels: {
-      ...CONTROLLED_LABEL,
-    },
-  },
-  spec: {
-    host: options.host,
-    trafficPolicy: {
-      tls: {
-        mode: 'DISABLE',
-      },
-    },
-  },
-});
-
-export { createVirtualServiceManifest, createDestinationRuleManifest };

src/custom-resouces/domain-service/domain-service.resource.ts

@@ -1,169 +0,0 @@
-import type { KubernetesObject } from '@kubernetes/client-node';
-import deepEqual from 'deep-equal';
-
-import type { K8SVirtualServiceV1 } from '../../__generated__/resources/K8SVirtualServiceV1.ts';
-import {
-  CustomResource,
-  type CustomResourceObject,
-  type CustomResourceOptions,
-  type SubresourceResult,
-} from '../../services/custom-resources/custom-resources.custom-resource.ts';
-import { ResourceReference, ResourceService, type Resource } from '../../services/resources/resources.ts';
-import type { K8SDestinationRuleV1 } from '../../__generated__/resources/K8SDestinationRuleV1.ts';
-import type { domainSpecSchema } from '../domain/domain.schemas.ts';
-import { getWithNamespace } from '../../utils/naming.ts';
-import { GROUP } from '../../utils/consts.ts';
-
-import type { domainServiceSpecSchema } from './domain-service.schemas.ts';
-import { createDestinationRuleManifest, createVirtualServiceManifest } from './domain-service.create-manifests.ts';
-
-const VIRTUAL_SERVICE_CONDITION = 'VirtualService';
-const DESTINAION_RULE_CONDITION = 'DestinationRule';
-
-class DomainServiceResource extends CustomResource<typeof domainServiceSpecSchema> {
-  #virtualServiceResource: Resource<KubernetesObject & K8SVirtualServiceV1>;
-  #virtualServiceCRDResource: Resource<KubernetesObject>;
-  #destinationRuleResource: Resource<KubernetesObject & K8SDestinationRuleV1>;
-  #destinationRuleCRDResource: Resource<KubernetesObject>;
-  #domainResource: ResourceReference<CustomResourceObject<typeof domainSpecSchema>>;
-
-  constructor(options: CustomResourceOptions<typeof domainServiceSpecSchema>) {
-    super(options);
-    const resourceService = this.services.get(ResourceService);
-    this.#virtualServiceResource = resourceService.get({
-      apiVersion: 'networking.istio.io/v1',
-      kind: 'VirtualService',
-      name: this.name,
-      namespace: this.namespace,
-    });
-
-    this.#virtualServiceCRDResource = resourceService.get({
-      apiVersion: 'apiextensions.k8s.io/v1',
-      kind: 'CustomResourceDefinition',
-      name: 'virtualservices.networking.istio.io',
-    });
-
-    this.#destinationRuleResource = resourceService.get({
-      apiVersion: 'networking.istio.io/v1',
-      kind: 'DestinationRule',
-      name: this.name,
-      namespace: this.namespace,
-    });
-
-    this.#destinationRuleCRDResource = resourceService.get({
-      apiVersion: 'apiextensions.k8s.io/v1',
-      kind: 'CustomResourceDefinition',
-      name: 'destinationrules.networking.istio.io',
-    });
-
-    const gatewayNames = getWithNamespace(this.spec.domain);
-    this.#domainResource = new ResourceReference(
-      resourceService.get({
-        apiVersion: `${GROUP}/v1`,
-        kind: 'Domain',
-        name: gatewayNames.name,
-        namespace: gatewayNames.namespace,
-      }),
-    );
-
-    this.#virtualServiceResource.on('changed', this.queueReconcile);
-    this.#virtualServiceCRDResource.on('changed', this.queueReconcile);
-    this.#destinationRuleResource.on('changed', this.queueReconcile);
-    this.#destinationRuleCRDResource.on('changed', this.queueReconcile);
-    this.#domainResource.on('changed', this.queueReconcile);
-  }
-
-  #reconcileVirtualService = async (): Promise<SubresourceResult> => {
-    if (!this.#virtualServiceCRDResource.exists) {
-      return {
-        ready: false,
-        failed: true,
-        reason: 'MissingCRD',
-      };
-    }
-    const domain = this.#domainResource.current;
-    if (!domain?.exists || !domain.spec) {
-      return {
-        ready: false,
-        failed: true,
-        reason: 'MissingDomain',
-      };
-    }
-    const manifest = createVirtualServiceManifest({
-      name: this.name,
-      namespace: this.namespace,
-      gateway: `${domain.namespace}/${domain.name}`,
-      owner: this.ref,
-      host: `${this.spec.subdomain}.${domain.spec.hostname}`,
-      destination: this.spec.destination,
-    });
-
-    if (!deepEqual(this.#virtualServiceResource.spec, manifest.spec)) {
-      await this.#virtualServiceResource.patch(manifest);
-      return {
-        ready: false,
-        syncing: true,
-        reason: 'ManifestNeedsPatching',
-      };
-    }
-
-    return {
-      ready: true,
-    };
-  };
-
-  #reconcileDestinationRule = async (): Promise<SubresourceResult> => {
-    if (!this.#destinationRuleCRDResource.exists) {
-      return {
-        ready: false,
-        failed: true,
-        reason: 'MissingCRD',
-      };
-    }
-    const manifest = createDestinationRuleManifest({
-      name: this.name,
-      namespace: this.namespace,
-      host: this.spec.destination.host,
-    });
-
-    if (!deepEqual(this.#destinationRuleResource.spec, manifest.spec)) {
-      await this.#destinationRuleResource.patch(manifest);
-      return {
-        ready: false,
-        syncing: true,
-        reason: 'ManifestNeedsPatching',
-      };
-    }
-
-    return {
-      ready: true,
-    };
-  };
-
-  public reconcile = async () => {
-    if (!this.exists || this.metadata.deletionTimestamp) {
-      return;
-    }
-    const resourceService = this.services.get(ResourceService);
-    const gatewayNames = getWithNamespace(this.spec.domain, this.namespace);
-
-    this.#domainResource.current = resourceService.get({
-      apiVersion: `${GROUP}/v1`,
-      kind: 'Domain',
-      name: gatewayNames.name,
-      namespace: gatewayNames.namespace,
-    });
-
-    await this.reconcileSubresource(VIRTUAL_SERVICE_CONDITION, this.#reconcileVirtualService);
-    await this.reconcileSubresource(DESTINAION_RULE_CONDITION, this.#reconcileDestinationRule);
-
-    const virtualServiceReady = this.conditions.get(VIRTUAL_SERVICE_CONDITION)?.status === 'True';
-    const destinationruleReady = this.conditions.get(DESTINAION_RULE_CONDITION)?.status === 'True';
-
-    await this.conditions.set('Ready', {
-      status: virtualServiceReady && destinationruleReady ? 'True' : 'False',
-    });
-  };
-}
-
-export { DomainServiceResource };

src/custom-resouces/domain-service/domain-service.schemas.ts

@@ -1,15 +0,0 @@
-import { z } from 'zod';
-
-const domainServiceSpecSchema = z.object({
-  domain: z.string(),
-  subdomain: z.string(),
-  destination: z.object({
-    host: z.string(),
-    port: z.object({
-      number: z.number().optional(),
-      name: z.string().optional(),
-    }),
-  }),
-});
-
-export { domainServiceSpecSchema };

src/custom-resouces/domain-service/domain-service.ts

@@ -1,19 +0,0 @@
-import { createCustomResourceDefinition } from '../../services/custom-resources/custom-resources.ts';
-import { GROUP } from '../../utils/consts.ts';
-
-import { DomainServiceResource } from './domain-service.resource.ts';
-import { domainServiceSpecSchema } from './domain-service.schemas.ts';
-
-const domainServiceDefinition = createCustomResourceDefinition({
-  group: GROUP,
-  kind: 'DomainService',
-  version: 'v1',
-  spec: domainServiceSpecSchema,
-  names: {
-    plural: 'domainservices',
-    singular: 'domainservice',
-  },
-  create: (options) => new DomainServiceResource(options),
-});
-
-export { domainServiceDefinition };

src/custom-resouces/domain/domain.create-manifests.ts

@@ -1,73 +0,0 @@
-type CreateGatewayManifestOptions = {
-  name: string;
-  namespace: string;
-  ref: ExpectedAny;
-  gateway: string;
-  domain: string;
-  secretName: string;
-};
-const createGatewayManifest = (options: CreateGatewayManifestOptions) => ({
-  apiVersion: 'networking.istio.io/v1alpha3',
-  kind: 'Gateway',
-  metadata: {
-    name: options.name,
-    namespace: options.namespace,
-    ownerReferences: [options.ref],
-  },
-  spec: {
-    selector: {
-      istio: options.gateway,
-    },
-    servers: [
-      {
-        port: {
-          number: 80,
-          name: 'http',
-          protocol: 'HTTP',
-        },
-        hosts: [`*.${options.domain}`],
-        tls: {
-          httpsRedirect: true,
-        },
-      },
-      {
-        port: {
-          number: 443,
-          name: 'https',
-          protocol: 'HTTPS',
-        },
-        hosts: [`*.${options.domain}`],
-        tls: {
-          mode: 'SIMPLE' as const,
-          credentialName: options.secretName,
-        },
-      },
-    ],
-  },
-});
-
-type CreateCertificateManifestOptions = {
-  name: string;
-  namespace: string;
-  domain: string;
-  secretName: string;
-  issuer: string;
-};
-const createCertificateManifest = (options: CreateCertificateManifestOptions) => ({
-  apiVersion: 'cert-manager.io/v1',
-  kind: 'Certificate',
-  metadata: {
-    name: options.name,
-    namespace: 'homelab', // TODO: use namespace of gateway controller
-  },
-  spec: {
-    secretName: options.secretName,
-    dnsNames: [`*.${options.domain}`],
-    issuerRef: {
-      name: options.issuer,
-      kind: 'ClusterIssuer',
-    },
-  },
-});
-
-export { createGatewayManifest, createCertificateManifest };

src/custom-resouces/domain/domain.resource.ts

@@ -1,174 +0,0 @@
-import type { KubernetesObject } from '@kubernetes/client-node';
-import deepEqual from 'deep-equal';
-
-import type { K8SGatewayV1 } from '../../__generated__/resources/K8SGatewayV1.ts';
-import {
-  CustomResource,
-  type CustomResourceOptions,
-  type SubresourceResult,
-} from '../../services/custom-resources/custom-resources.custom-resource.ts';
-import { ResourceReference, ResourceService } from '../../services/resources/resources.ts';
-import type { K8SCertificateV1 } from '../../__generated__/resources/K8SCertificateV1.ts';
-import { IstioService } from '../../services/istio/istio.ts';
-
-import type { domainSpecSchema } from './domain.schemas.ts';
-import { createCertificateManifest, createGatewayManifest } from './domain.create-manifests.ts';
-
-class DomainResource extends CustomResource<typeof domainSpecSchema> {
-  #gatewayCrdResource = new ResourceReference();
-  #gatewayResource = new ResourceReference<KubernetesObject & K8SGatewayV1>();
-  #certificateCrdResource = new ResourceReference();
-  #certificateResource = new ResourceReference<KubernetesObject & K8SCertificateV1>();
-
-  constructor(options: CustomResourceOptions<typeof domainSpecSchema>) {
-    super(options);
-    const resourceService = this.services.get(ResourceService);
-    const istioService = this.services.get(IstioService);
-
-    this.#gatewayCrdResource.current = resourceService.get({
-      apiVersion: 'apiextensions.k8s.io/v1',
-      kind: 'CustomResourceDefinition',
-      name: 'gateways.networking.istio.io',
-    });
-    this.#gatewayResource.current = resourceService.get({
-      apiVersion: 'networking.istio.io/v1',
-      kind: 'Gateway',
-      name: this.name,
-      namespace: this.namespace,
-    });
-
-    this.#certificateCrdResource.current = resourceService.get({
-      apiVersion: 'apiextensions.k8s.io/v1',
-      kind: 'CustomResourceDefinition',
-      name: 'certificates.cert-manager.io',
-    });
-
-    this.#certificateResource.current = resourceService.get({
-      apiVersion: 'cert-manager.io/v1',
-      kind: 'Certificate',
-      name: `domain-${this.name}`,
-      namespace: 'homelab',
-    });
-
-    this.#gatewayResource.on('changed', this.queueReconcile);
-    this.#certificateResource.on('changed', this.queueReconcile);
-    this.#gatewayCrdResource.on('changed', this.queueReconcile);
-    this.#certificateCrdResource.on('changed', this.queueReconcile);
-
-    istioService.gateway.on('changed', this.queueReconcile);
-  }
-
-  get #certSecret() {
-    return `cert-secret-${this.namespace}-${this.name}`;
-  }
-
-  #reconcileGateway = async (): Promise<SubresourceResult> => {
-    if (!this.#gatewayCrdResource.current?.exists) {
-      return {
-        ready: false,
-        failed: true,
-        reason: 'MissingCRD',
-        message: 'Missing Gateway CRD',
-      };
-    }
-    const istioService = this.services.get(IstioService);
-    if (!istioService.gateway.current) {
-      return {
-        ready: false,
-        failed: true,
-        reason: 'MissingGatewayController',
-        message: 'No istio gateway controller could be found',
-      };
-    }
-    const manifest = createGatewayManifest({
-      name: this.name,
-      namespace: this.name,
-      domain: this.spec.hostname,
-      ref: this.ref,
-      gateway: istioService.gateway.current.metadata?.labels?.istio || 'gateway-controller',
-      secretName: this.#certSecret,
-    });
-    if (!deepEqual(this.#gatewayResource.current?.spec, manifest.spec)) {
-      await this.#gatewayResource.current?.patch(manifest);
-      return {
-        ready: false,
-        syncing: true,
-        reason: 'ChangingGateway',
-        message: 'Gateway need changes',
-      };
-    }
-    return {
-      ready: true,
-    };
-  };
-
-  #reconcileCertificate = async (): Promise<SubresourceResult> => {
-    if (!this.#certificateCrdResource.current?.exists) {
-      return {
-        ready: false,
-        syncing: false,
-        failed: true,
-        reason: 'MissingCRD',
-        message: 'Missing Certificate CRD',
-      };
-    }
-    const current = this.#certificateResource.current;
-    if (!current || !current.namespace) {
-      throw new Error('Missing certificate resource');
-    }
-    const istioService = this.services.get(IstioService);
-    if (!istioService.gateway.current) {
-      return {
-        ready: false,
-        syncing: false,
-        failed: true,
-        reason: 'MissingGatewayController',
-        message: 'No istio gateway controller could be found',
-      };
-    }
-    const manifest = createCertificateManifest({
-      name: current.name,
-      namespace: istioService.gateway.current.namespace || 'default',
-      domain: this.spec.hostname,
-      secretName: this.#certSecret,
-      issuer: this.spec.issuer,
-    });
-    if (!this.#certificateResource.current?.exists) {
-      await current.patch(manifest);
-      return {
-        ready: false,
-        syncing: true,
-        reason: 'Creating',
-        message: 'Creating certificate resource',
-      };
-    }
-    if (!deepEqual(current.spec, manifest.spec)) {
-      await this.conditions.set('CertificateReady', {
-        status: 'False',
-        reason: 'Changing',
-        message: 'Certificate need changes',
-      });
-      await current.patch(manifest);
-    }
-    return {
-      ready: true,
-    };
-  };
-
-  public reconcile = async () => {
-    if (!this.exists || this.metadata.deletionTimestamp) {
-      return;
-    }
-    await this.reconcileSubresource('Gateway', this.#reconcileGateway);
-    await this.reconcileSubresource('Certificate', this.#reconcileCertificate);
-
-    const gatewayReady = this.conditions.get('Gateway')?.status === 'True';
-    const certificateReady = this.conditions.get('Certificate')?.status === 'True';
-
-    await this.conditions.set('Ready', {
-      status: gatewayReady && certificateReady ? 'True' : 'False',
-    });
-  };
-}
-
-export { DomainResource };

src/custom-resouces/domain/domain.schemas.ts

@@ -1,8 +0,0 @@
-import { z } from 'zod';
-
-const domainSpecSchema = z.object({
-  hostname: z.string(),
-  issuer: z.string(),
-});
-
-export { domainSpecSchema };

src/custom-resouces/domain/domain.ts

@@ -1,19 +0,0 @@
-import { createCustomResourceDefinition } from '../../services/custom-resources/custom-resources.ts';
-import { GROUP } from '../../utils/consts.ts';
-
-import { DomainResource } from './domain.resource.ts';
-import { domainSpecSchema } from './domain.schemas.ts';
-
-const domainDefinition = createCustomResourceDefinition({
-  version: 'v1',
-  kind: 'Domain',
-  group: GROUP,
-  names: {
-    plural: 'domains',
-    singular: 'domain',
-  },
-  spec: domainSpecSchema,
-  create: (options) => new DomainResource(options),
-});
-
-export { domainDefinition };

src/custom-resouces/homelab/homelab.manifests.ts

@@ -1,297 +0,0 @@
-import type { KubernetesObject } from '@kubernetes/client-node';
-
-import type { K8SHelmRepositoryV1 } from '../../__generated__/resources/K8SHelmRepositoryV1.ts';
-import type { K8SHelmReleaseV2 } from '../../__generated__/resources/K8SHelmReleaseV2.ts';
-
-type IstioRepoManifestOptions = {
-  owner: ExpectedAny;
-};
-const istioRepoManifest = (options: IstioRepoManifestOptions): KubernetesObject & K8SHelmRepositoryV1 => {
-  return {
-    apiVersion: 'source.toolkit.fluxcd.io/v1beta1',
-    kind: 'HelmRepository',
-    metadata: {
-      ownerReferences: [options.owner],
-    },
-    spec: {
-      interval: '1h',
-      url: 'https://istio-release.storage.googleapis.com/charts',
-    },
-  };
-};
-
-type CertManagerRepoManifestOptions = {
-  owner: ExpectedAny;
-};
-const certManagerRepoManifest = (options: CertManagerRepoManifestOptions): KubernetesObject & K8SHelmRepositoryV1 => {
-  return {
-    apiVersion: 'source.toolkit.fluxcd.io/v1',
-    kind: 'HelmRepository',
-    metadata: {
-      ownerReferences: [options.owner],
-    },
-    spec: {
-      interval: '1h',
-      url: 'https://charts.jetstack.io',
-    },
-  };
-};
-
-type RanchRepoManifestOptions = {
-  owner: ExpectedAny;
-};
-const ranchRepoManifest = (options: RanchRepoManifestOptions): KubernetesObject & K8SHelmRepositoryV1 => {
-  return {
-    apiVersion: 'source.toolkit.fluxcd.io/v1',
-    kind: 'HelmRepository',
-    metadata: {
-      ownerReferences: [options.owner],
-    },
-    spec: {
-      interval: '1h',
-      url: 'https://charts.containeroo.ch',
-    },
-  };
-};
-
-type IstioBaseManifestOptions = {
-  owner: ExpectedAny;
-};
-const istioBaseManifest = (options: IstioBaseManifestOptions): KubernetesObject & K8SHelmReleaseV2 => {
-  return {
-    apiVersion: 'helm.toolkit.fluxcd.io/v2',
-    kind: 'HelmRelease',
-    metadata: {
-      ownerReferences: [options.owner],
-    },
-    spec: {
-      interval: '1h',
-      targetNamespace: 'istio-system',
-      install: {
-        createNamespace: true,
-      },
-      values: {
-        defaultRevision: 'default',
-      },
-      chart: {
-        spec: {
-          chart: 'base',
-          sourceRef: {
-            apiVersion: 'source.toolkit.fluxcd.io/v1',
-            kind: 'HelmRepository',
-            name: 'homelab-istio',
-          },
-          reconcileStrategy: 'ChartVersion',
-          version: '1.24.3',
-        },
-      },
-    },
-  };
-};
-
-type IstiodManifestOptions = {
-  owner: ExpectedAny;
-  namespace: string;
-};
-const istiodManifest = (options: IstiodManifestOptions): KubernetesObject & K8SHelmReleaseV2 => {
-  return {
-    apiVersion: 'helm.toolkit.fluxcd.io/v2',
-    kind: 'HelmRelease',
-    metadata: {
-      ownerReferences: [options.owner],
-    },
-    spec: {
-      targetNamespace: 'istio-system',
-      interval: '1h',
-      install: {
-        createNamespace: true,
-      },
-      dependsOn: [
-        {
-          name: 'istio',
-          namespace: options.namespace,
-        },
-      ],
-      chart: {
-        spec: {
-          chart: 'istiod',
-          sourceRef: {
-            apiVersion: 'source.toolkit.fluxcd.io/v1',
-            kind: 'HelmRepository',
-            name: 'homelab-istio',
-          },
-          reconcileStrategy: 'ChartVersion',
-          version: '1.24.3',
-        },
-      },
-    },
-  };
-};
-
-type IstioGatewayControllerManifestOptions = {
-  owner: ExpectedAny;
-  namespace: string;
-};
-const istioGatewayControllerManifest = (
-  options: IstioGatewayControllerManifestOptions,
-): KubernetesObject & K8SHelmReleaseV2 => {
-  return {
-    apiVersion: 'helm.toolkit.fluxcd.io/v2',
-    kind: 'HelmRelease',
-    metadata: {
-      ownerReferences: [options.owner],
-    },
-    spec: {
-      interval: '1h',
-      install: {
-        createNamespace: true,
-      },
-      dependsOn: [
-        {
-          name: 'istio',
-          namespace: options.namespace,
-        },
-        {
-          name: 'istiod',
-          namespace: options.namespace,
-        },
-      ],
-      values: {
-        service: {
-          ports: [
-            {
-              name: 'status-port',
-              port: 15021,
-            },
-            {
-              name: 'tls-istiod',
-              port: 15012,
-            },
-            {
-              name: 'tls',
-              port: 15443,
-              nodePort: 31371,
-            },
-            {
-              name: 'http2',
-              port: 80,
-              nodePort: 31381,
-              targetPort: 8280,
-            },
-            {
-              name: 'https',
-              port: 443,
-              nodePort: 31391,
-              targetPort: 8243,
-            },
-          ],
-        },
-      },
-      chart: {
-        spec: {
-          chart: 'gateway',
-          sourceRef: {
-            apiVersion: 'source.toolkit.fluxcd.io/v1',
-            kind: 'HelmRepository',
-            name: 'homelab-istio',
-          },
-          reconcileStrategy: 'ChartVersion',
-          version: '1.24.3',
-        },
-      },
-    },
-  };
-};
-
-type CertManagerManifestOptions = {
-  owner: ExpectedAny;
-};
-const certManagerManifest = (options: CertManagerManifestOptions): KubernetesObject & K8SHelmReleaseV2 => {
-  return {
-    apiVersion: 'helm.toolkit.fluxcd.io/v2',
-    kind: 'HelmRelease',
-    metadata: {
-      ownerReferences: [options.owner],
-    },
-    spec: {
-      targetNamespace: 'cert-manager',
-      interval: '1h',
-      install: {
-        createNamespace: true,
-      },
-      values: {
-        installCRDs: true,
-      },
-      chart: {
-        spec: {
-          chart: 'cert-manager',
-          sourceRef: {
-            apiVersion: 'source.toolkit.fluxcd.io/v1',
-            kind: 'HelmRepository',
-            name: 'cert-manager',
-          },
-          version: 'v1.18.2',
-        },
-      },
-    },
-  };
-};
-
-type LocalStorageManifestOptions = {
-  owner: ExpectedAny;
-  storagePath: string;
-};
-const localStorageManifest = (options: LocalStorageManifestOptions): KubernetesObject & K8SHelmReleaseV2 => {
-  return {
-    apiVersion: 'helm.toolkit.fluxcd.io/v2',
-    kind: 'HelmRelease',
-    metadata: {
-      ownerReferences: [options.owner],
-    },
-    spec: {
-      targetNamespace: 'local-path-storage',
-      interval: '1h',
-      install: {
-        createNamespace: true,
-      },
-      values: {
-        storageClass: {
-          name: 'local-path',
-          provisionerName: 'rancher.io/local-path',
-          defaultClass: true,
-        },
-        nodePathMap: [
-          {
-            node: 'DEFAULT_PATH_FOR_NON_LISTED_NODES',
-            paths: [options.storagePath],
-          },
-        ],
-        helper: {
-          reclaimPolicy: 'Retain',
-        },
-      },
-      chart: {
-        spec: {
-          chart: 'local-path-provisioner',
-          sourceRef: {
-            apiVersion: 'source.toolkit.fluxcd.io/v1',
-            kind: 'HelmRepository',
-            name: 'rancher',
-          },
-          version: '0.0.32',
-        },
-      },
-    },
-  };
-};
-
-export {
-  istioRepoManifest,
-  istioBaseManifest,
-  istiodManifest,
-  istioGatewayControllerManifest,
-  certManagerRepoManifest,
-  certManagerManifest,
-  ranchRepoManifest,
-  localStorageManifest,
-};

src/custom-resouces/homelab/homelab.resource.ts

@@ -1,263 +0,0 @@
-import { type KubernetesObject } from '@kubernetes/client-node';
-
-import {
-  CustomResource,
-  type CustomResourceOptions,
-  type SubresourceResult,
-} from '../../services/custom-resources/custom-resources.custom-resource.ts';
-import { Resource, ResourceService } from '../../services/resources/resources.ts';
-import type { K8SHelmRepositoryV1 } from '../../__generated__/resources/K8SHelmRepositoryV1.ts';
-import type { K8SHelmReleaseV2 } from '../../__generated__/resources/K8SHelmReleaseV2.ts';
-import { isDeepSubset } from '../../utils/objects.ts';
-
-import type { homelabSpecSchema } from './homelab.schemas.ts';
-import {
-  certManagerRepoManifest,
-  istioBaseManifest,
-  istiodManifest,
-  istioGatewayControllerManifest,
-  istioRepoManifest,
-  certManagerManifest,
-  ranchRepoManifest,
-  localStorageManifest,
-} from './homelab.manifests.ts';
-
-class HomelabResource extends CustomResource<typeof homelabSpecSchema> {
-  #resources: {
-    istioRepo: Resource<KubernetesObject & K8SHelmRepositoryV1>;
-    istioBase: Resource<KubernetesObject & K8SHelmReleaseV2>;
-    istiod: Resource<KubernetesObject & K8SHelmReleaseV2>;
-    istioGatewayController: Resource<KubernetesObject & K8SHelmReleaseV2>;
-    certManagerRepo: Resource<KubernetesObject & K8SHelmRepositoryV1>;
-    certManager: Resource<KubernetesObject & K8SHelmReleaseV2>;
-    ranchRepo: Resource<KubernetesObject & K8SHelmRepositoryV1>;
-    localStorage: Resource<KubernetesObject & K8SHelmReleaseV2>;
-  };
-
-  constructor(options: CustomResourceOptions<typeof homelabSpecSchema>) {
-    super(options);
-    const resourceService = this.services.get(ResourceService);
-    this.#resources = {
-      istioRepo: resourceService.get({
-        apiVersion: 'source.toolkit.fluxcd.io/v1',
-        kind: 'HelmRepository',
-        name: 'homelab-istio',
-        namespace: this.namespace,
-      }),
-      istioBase: resourceService.get({
-        apiVersion: 'helm.toolkit.fluxcd.io/v2',
-        kind: 'HelmRelease',
-        name: 'istio',
-        namespace: this.namespace,
-      }),
-      istiod: resourceService.get({
-        apiVersion: 'helm.toolkit.fluxcd.io/v2',
-        kind: 'HelmRelease',
-        name: 'istiod',
-        namespace: this.namespace,
-      }),
-      istioGatewayController: resourceService.get({
-        apiVersion: 'helm.toolkit.fluxcd.io/v2',
-        kind: 'HelmRelease',
-        name: 'istio-gateway-controller',
-        namespace: this.namespace,
-      }),
-      certManagerRepo: resourceService.get({
-        apiVersion: 'source.toolkit.fluxcd.io/v1',
-        kind: 'HelmRepository',
-        name: 'cert-manager',
-        namespace: this.namespace,
-      }),
-      certManager: resourceService.get({
-        apiVersion: 'helm.toolkit.fluxcd.io/v2',
-        kind: 'HelmRelease',
-        name: 'cert-manager',
-        namespace: this.namespace,
-      }),
-      ranchRepo: resourceService.get({
-        apiVersion: 'source.toolkit.fluxcd.io/v1',
-        kind: 'HelmRepository',
-        name: 'rancher',
-        namespace: this.namespace,
-      }),
-      localStorage: resourceService.get({
-        apiVersion: 'helm.toolkit.fluxcd.io/v2',
-        kind: 'HelmRelease',
-        name: 'local-storage',
-        namespace: this.namespace,
-      }),
-    };
-
-    for (const resource of Object.values(this.#resources)) {
-      resource.on('changed', this.queueReconcile);
-    }
-  }
-
-  #reconcileIstioRepo = async (): Promise<SubresourceResult> => {
-    const istioRepo = this.#resources.istioRepo;
-    const manifest = istioRepoManifest({
-      owner: this.ref,
-    });
-    if (!isDeepSubset(istioRepo.spec, manifest.spec)) {
-      await istioRepo.patch(manifest);
-      return {
-        ready: false,
-        syncing: true,
-        reason: 'UpdatingManifest',
-      };
-    }
-    return {
-      ready: true,
-    };
-  };
-
-  #reconcileCertManagerRepo = async (): Promise<SubresourceResult> => {
-    const certManagerRepo = this.#resources.certManagerRepo;
-    const manifest = certManagerRepoManifest({
-      owner: this.ref,
-    });
-    if (!isDeepSubset(certManagerRepo.spec, manifest.spec)) {
-      await certManagerRepo.patch(manifest);
-      return {
-        ready: false,
-        syncing: true,
-        reason: 'UpdatingManifest',
-      };
-    }
-    return {
-      ready: true,
-    };
-  };
-
-  #reconcileRanchRepo = async (): Promise<SubresourceResult> => {
-    const ranchRepo = this.#resources.ranchRepo;
-    const manifest = ranchRepoManifest({
-      owner: this.ref,
-    });
-    if (!isDeepSubset(ranchRepo.spec, manifest.spec)) {
-      await ranchRepo.patch(manifest);
-      return {
-        ready: false,
-        syncing: true,
-        reason: 'UpdatingManifest',
-      };
-    }
-    return {
-      ready: true,
-    };
-  };
-
-  #reconcileIstioBase = async (): Promise<SubresourceResult> => {
-    const istioBase = this.#resources.istioBase;
-    const manifest = istioBaseManifest({
-      owner: this.ref,
-    });
-    if (!isDeepSubset(istioBase.spec, manifest.spec)) {
-      await istioBase.patch(manifest);
-      return {
-        ready: false,
-        syncing: true,
-        reason: 'UpdatingManifest',
-      };
-    }
-    return {
-      ready: true,
-    };
-  };
-
-  #reconcileIstiod = async (): Promise<SubresourceResult> => {
-    const istiod = this.#resources.istiod;
-    const manifest = istiodManifest({
-      owner: this.ref,
-      namespace: this.namespace,
-    });
-    if (!isDeepSubset(istiod.spec, manifest.spec)) {
-      await istiod.patch(manifest);
-      return {
-        ready: false,
-        syncing: true,
-        reason: 'UpdatingManifest',
-      };
-    }
-    return {
-      ready: true,
-    };
-  };
-
-  #reconcileIstioGatewayController = async (): Promise<SubresourceResult> => {
-    const istioGatewayController = this.#resources.istioGatewayController;
-    const manifest = istioGatewayControllerManifest({
-      owner: this.ref,
-      namespace: this.namespace,
-    });
-    if (!isDeepSubset(istioGatewayController.spec, manifest.spec)) {
-      await istioGatewayController.patch(manifest);
-      return {
-        ready: false,
-        syncing: true,
-        reason: 'UpdatingManifest',
-      };
-    }
-    return {
-      ready: true,
-    };
-  };
-
-  #reconcileCertManager = async (): Promise<SubresourceResult> => {
-    const certManager = this.#resources.certManager;
-    const manifest = certManagerManifest({
-      owner: this.ref,
-    });
-    if (!isDeepSubset(certManager.spec, manifest.spec)) {
-      await certManager.patch(manifest);
-      return {
-        ready: false,
-        syncing: true,
-        reason: 'UpdatingManifest',
-      };
-    }
-    return {
-      ready: true,
-    };
-  };
-
-  #reconcileLocalStorage = async (): Promise<SubresourceResult> => {
-    const storage = this.spec.storage;
-    if (!storage || !storage.enabled) {
-      return {
-        ready: true,
-      };
-    }
-    const localStorage = this.#resources.localStorage;
-    const manifest = localStorageManifest({
-      owner: this.ref,
-      storagePath: storage.path,
-    });
-    if (!isDeepSubset(localStorage.spec, manifest.spec)) {
-      await localStorage.patch(manifest);
-      return {
-        ready: false,
-        syncing: true,
-        reason: 'UpdatingManifest',
-      };
-    }
-    return {
-      ready: true,
-    };
-  };
-
-  public reconcile = async () => {
-    await Promise.allSettled([
-      this.reconcileSubresource('IstioRepo', this.#reconcileIstioRepo),
-      this.reconcileSubresource('CertManagerRepo', this.#reconcileCertManagerRepo),
-      this.reconcileSubresource('IstioBase', this.#reconcileIstioBase),
-      this.reconcileSubresource('Istiod', this.#reconcileIstiod),
-      this.reconcileSubresource('IstioGatewayController', this.#reconcileIstioGatewayController),
-      this.reconcileSubresource('CertManager', this.#reconcileCertManager),
-      this.reconcileSubresource('RanchRepo', this.#reconcileRanchRepo),
-      this.reconcileSubresource('LocalStorage', this.#reconcileLocalStorage),
-    ]);
-  };
-}
-
-export { HomelabResource };

src/custom-resouces/homelab/homelab.schemas.ts

@@ -1,17 +0,0 @@
-import { z } from 'zod';
-
-const homelabSpecSchema = z.object({
-  storage: z
-    .object({
-      enabled: z.boolean(),
-      path: z.string(),
-    })
-    .optional(),
-});
-
-const homelabSecretSchema = z.object({
-  postgresPassword: z.string(),
-  redisPassword: z.string(),
-});
-
-export { homelabSpecSchema, homelabSecretSchema };

src/custom-resouces/homelab/homelab.ts

@@ -1,19 +0,0 @@
-import { createCustomResourceDefinition } from '../../services/custom-resources/custom-resources.ts';
-import { GROUP } from '../../utils/consts.ts';
-
-import { HomelabResource } from './homelab.resource.ts';
-import { homelabSpecSchema } from './homelab.schemas.ts';
-
-const homelabDefinition = createCustomResourceDefinition({
-  group: GROUP,
-  version: 'v1',
-  kind: 'Homelab',
-  names: {
-    plural: 'homelabs',
-    singular: 'homelab',
-  },
-  spec: homelabSpecSchema,
-  create: (options) => new HomelabResource(options),
-});
-
-export { homelabDefinition };

src/custom-resouces/postgres-cluster/postgres-cluster.manifests.ts

@@ -1,124 +0,0 @@
-import type { V1Deployment, V1PersistentVolumeClaim, V1Service } from '@kubernetes/client-node';
-
-import type { CustomResourceObject } from '../../services/custom-resources/custom-resources.custom-resource.ts';
-import type { postgresConnectionSpecSchema } from '../postgres-connection/posgtres-connection.schemas.ts';
-import { API_VERSION } from '../../utils/consts.ts';
-
-type PvcOptions = {
-  name: string;
-  owner: ExpectedAny;
-};
-const pvcManifest = (options: PvcOptions): V1PersistentVolumeClaim => {
-  return {
-    apiVersion: 'v1',
-    kind: 'PersistentVolumeClaim',
-    metadata: {
-      ownerReferences: [options.owner],
-      name: options.name,
-      labels: {
-        app: options.name,
-      },
-      annotations: {
-        'volume.kubernetes.io/storage-class': 'local-path',
-      },
-    },
-    spec: {
-      accessModes: ['ReadWriteOnce'],
-      resources: {
-        requests: {
-          storage: '10Gi',
-        },
-      },
-    },
-  };
-};
-
-type DeploymentManifetOptions = {
-  name: string;
-  owner: ExpectedAny;
-  user: string;
-  password: string;
-};
-const deploymentManifest = (options: DeploymentManifetOptions): V1Deployment => {
-  return {
-    apiVersion: 'apps/v1',
-    kind: 'Deployment',
-    metadata: {
-      ownerReferences: [options.owner],
-    },
-    spec: {
-      replicas: 1,
-      selector: {
-        matchLabels: {
-          app: options.name,
-        },
-      },
-      template: {
-        metadata: {
-          labels: {
-            app: options.name,
-          },
-        },
-        spec: {
-          volumes: [{ name: options.name, persistentVolumeClaim: { claimName: options.name } }],
-          containers: [
-            {
-              name: options.name,
-              image: 'postgres:17',
-              ports: [{ containerPort: 5432 }],
-              volumeMounts: [{ mountPath: '/var/lib/postgresql/data', name: options.name }],
-              env: [
-                { name: 'POSTGRES_USER', value: options.user },
-                { name: 'POSTGRES_PASSWORD', value: options.password },
-              ],
-            },
-          ],
-        },
-      },
-    },
-  };
-};
-
-type ServiceManifestOptions = {
-  name: string;
-  owner: ExpectedAny;
-};
-const serviceManifest = (options: ServiceManifestOptions): V1Service => {
-  return {
-    apiVersion: 'v1',
-    kind: 'Service',
-    metadata: {
-      ownerReferences: [options.owner],
-      name: options.name,
-      labels: {
-        app: options.name,
-      },
-    },
-    spec: {
-      type: 'ClusterIP',
-      ports: [{ port: 5432, targetPort: 5432 }],
-      selector: {
-        app: options.name,
-      },
-    },
-  };
-};
-
-type ConnectionManifestOptions = {
-  name: string;
-  owner: ExpectedAny;
-};
-const connectionManifest = (
-  options: ConnectionManifestOptions,
-): CustomResourceObject<typeof postgresConnectionSpecSchema> => ({
-  apiVersion: API_VERSION,
-  kind: 'PostgresConnection',
-  metadata: {
-    ownerReferences: [options.owner],
-  },
-  spec: {
-    secret: `${options.name}-secret`,
-  },
-});
-
-export { pvcManifest, deploymentManifest, serviceManifest, connectionManifest };

src/custom-resouces/postgres-cluster/postgres-cluster.resource.ts

@@ -1,170 +0,0 @@
-import type { V1Deployment, V1PersistentVolumeClaim, V1Service } from '@kubernetes/client-node';
-
-import {
-  CustomResource,
-  type CustomResourceObject,
-  type CustomResourceOptions,
-  type SubresourceResult,
-} from '../../services/custom-resources/custom-resources.custom-resource.ts';
-import { ResourceService, type Resource } from '../../services/resources/resources.ts';
-import {
-  postgresConnectionSecretDataSchema,
-  type postgresConnectionSpecSchema,
-} from '../postgres-connection/posgtres-connection.schemas.ts';
-import { API_VERSION } from '../../utils/consts.ts';
-import { isDeepSubset } from '../../utils/objects.ts';
-import type { EnsuredSecret } from '../../services/secrets/secrets.secret.ts';
-import { SecretService } from '../../services/secrets/secrets.ts';
-
-import type { postgresClusterSpecSchema } from './postgres-cluster.schemas.ts';
-import { connectionManifest, deploymentManifest, pvcManifest, serviceManifest } from './postgres-cluster.manifests.ts';
-
-class PostgresClusterResource extends CustomResource<typeof postgresClusterSpecSchema> {
-  #resources: {
-    pvc: Resource<V1PersistentVolumeClaim>;
-    deployment: Resource<V1Deployment>;
-    service: Resource<V1Service>;
-    connection: Resource<CustomResourceObject<typeof postgresConnectionSpecSchema>>;
-    secret: EnsuredSecret<typeof postgresConnectionSecretDataSchema>;
-  };
-
-  constructor(options: CustomResourceOptions<typeof postgresClusterSpecSchema>) {
-    super(options);
-    const resourceService = this.services.get(ResourceService);
-    const secretService = this.services.get(SecretService);
-    this.#resources = {
-      pvc: resourceService.get({
-        apiVersion: 'v1',
-        kind: 'PersistentVolumeClaim',
-        name: this.name,
-        namespace: this.namespace,
-      }),
-      deployment: resourceService.get({
-        apiVersion: 'apps/v1',
-        kind: 'Deployment',
-        name: this.name,
-        namespace: this.namespace,
-      }),
-      service: resourceService.get({
-        apiVersion: 'v1',
-        kind: 'Service',
-        name: this.name,
-        namespace: this.namespace,
-      }),
-      connection: resourceService.get({
-        apiVersion: API_VERSION,
-        kind: 'PostgresConnection',
-        name: this.name,
-        namespace: this.namespace,
-      }),
-      secret: secretService.ensure({
-        name: `${this.name}-secret`,
-        namespace: this.namespace,
-        schema: postgresConnectionSecretDataSchema,
-        generator: () => ({
-          host: `${this.name}.${this.namespace}.svc.cluster.local`,
-          port: '5432',
-          user: 'postgres',
-          password: Buffer.from(crypto.getRandomValues(new Uint8Array(16))).toString('hex'),
-        }),
-      }),
-    };
-  }
-
-  #reconcilePvc = async (): Promise<SubresourceResult> => {
-    const pvc = this.#resources.pvc;
-    const manifest = pvcManifest({
-      name: this.name,
-      owner: this.ref,
-    });
-    if (!isDeepSubset(pvc.spec, manifest.spec)) {
-      await pvc.patch(manifest);
-      return {
-        ready: false,
-        syncing: true,
-        reason: 'UpdatingManifest',
-      };
-    }
-    return {
-      ready: true,
-    };
-  };
-
-  #reconcileDeployment = async (): Promise<SubresourceResult> => {
-    const secret = this.#resources.secret;
-    if (!secret.isValid || !secret.value) {
-      return {
-        ready: false,
-        syncing: true,
-        reason: 'SecretNotReady',
-      };
-    }
-    const deployment = this.#resources.deployment;
-    const manifest = deploymentManifest({
-      name: this.name,
-      owner: this.ref,
-      user: secret.value.user,
-      password: secret.value.password,
-    });
-    if (!isDeepSubset(deployment.spec, manifest.spec)) {
-      await deployment.patch(manifest);
-      return {
-        ready: false,
-        syncing: true,
-        reason: 'UpdatingManifest',
-      };
-    }
-    return {
-      ready: true,
-    };
-  };
-
-  #reconcileService = async (): Promise<SubresourceResult> => {
-    const service = this.#resources.service;
-    const manifest = serviceManifest({
-      name: this.name,
-      owner: this.ref,
-    });
-    if (!isDeepSubset(service.spec, manifest.spec)) {
-      await service.patch(manifest);
-      return {
-        ready: false,
-        syncing: true,
-        reason: 'UpdatingManifest',
-      };
-    }
-    return {
-      ready: true,
-    };
-  };
-
-  #reconcileConnection = async (): Promise<SubresourceResult> => {
-    const connection = this.#resources.connection;
-    const manifest = connectionManifest({
-      name: this.name,
-      owner: this.ref,
-    });
-    if (!isDeepSubset(connection.spec, manifest.spec)) {
-      await connection.patch(manifest);
-      return {
-        ready: false,
-        syncing: true,
-        reason: 'UpdatingManifest',
-      };
-    }
-    return {
-      ready: true,
-    };
-  };
-
-  public reconcile = async () => {
-    await Promise.allSettled([
-      this.reconcileSubresource('PVC', this.#reconcilePvc),
-      this.reconcileSubresource('Deployment', this.#reconcileDeployment),
-      this.reconcileSubresource('Service', this.#reconcileService),
-      this.reconcileSubresource('Connection', this.#reconcileConnection),
-    ]);
-  };
-}
-
-export { PostgresClusterResource };

src/custom-resouces/postgres-cluster/postgres-cluster.schemas.ts

@@ -1,5 +0,0 @@
-import { z } from 'zod';
-
-const postgresClusterSpecSchema = z.object({});
-
-export { postgresClusterSpecSchema };

src/custom-resouces/postgres-cluster/postgres-cluster.ts

@@ -1,19 +0,0 @@
-import { createCustomResourceDefinition } from '../../services/custom-resources/custom-resources.ts';
-import { GROUP } from '../../utils/consts.ts';
-
-import { postgresClusterSpecSchema } from './postgres-cluster.schemas.ts';
-import { PostgresClusterResource } from './postgres-cluster.resource.ts';
-
-const postgresClusterDefinition = createCustomResourceDefinition({
-  group: GROUP,
-  version: 'v1',
-  kind: 'PostgresCluster',
-  names: {
-    plural: 'postgresclusters',
-    singular: 'postgrescluster',
-  },
-  spec: postgresClusterSpecSchema,
-  create: (options) => new PostgresClusterResource(options),
-});
-
-export { postgresClusterDefinition };

src/custom-resouces/postgres-connection/posgtres-connection.schemas.ts

@@ -1,14 +0,0 @@
-import { z } from 'zod';
-
-const postgresConnectionSpecSchema = z.object({
-  secret: z.string(),
-});
-
-const postgresConnectionSecretDataSchema = z.object({
-  host: z.string(),
-  port: z.string().optional(),
-  user: z.string(),
-  password: z.string(),
-});
-
-export { postgresConnectionSpecSchema, postgresConnectionSecretDataSchema };

src/custom-resouces/postgres-connection/postgres-connection.resource.ts

@@ -1,94 +0,0 @@
-import type { V1Secret } from '@kubernetes/client-node';
-import type { z } from 'zod';
-
-import {
-  CustomResource,
-  type CustomResourceOptions,
-} from '../../services/custom-resources/custom-resources.custom-resource.ts';
-import { ResourceReference } from '../../services/resources/resources.ref.ts';
-import { ResourceService } from '../../services/resources/resources.ts';
-import { getWithNamespace } from '../../utils/naming.ts';
-import { PostgresService } from '../../services/postgres/postgres.service.ts';
-import { decodeSecret } from '../../utils/secrets.ts';
-
-import type {
-  postgresConnectionSecretDataSchema,
-  postgresConnectionSpecSchema,
-} from './posgtres-connection.schemas.ts';
-
-class PostgresConnectionResource extends CustomResource<typeof postgresConnectionSpecSchema> {
-  #secret: ResourceReference<V1Secret>;
-
-  constructor(options: CustomResourceOptions<typeof postgresConnectionSpecSchema>) {
-    super(options);
-    const resourceService = this.services.get(ResourceService);
-    const secretNames = getWithNamespace(this.spec.secret, this.namespace);
-    this.#secret = new ResourceReference<V1Secret>(
-      resourceService.get({
-        apiVersion: 'v1',
-        kind: 'Secret',
-        name: secretNames.name,
-        namespace: secretNames.namespace,
-      }),
-    );
-    this.#secret.on('changed', this.queueReconcile);
-  }
-
-  public reconcile = async () => {
-    const resourceService = this.services.get(ResourceService);
-    const secretNames = getWithNamespace(this.spec.secret, this.namespace);
-    this.#secret.current = resourceService.get({
-      apiVersion: 'v1',
-      kind: 'Secret',
-      name: secretNames.name,
-      namespace: secretNames.namespace,
-    });
-
-    const current = this.#secret.current;
-    if (!current?.exists || !current.data) {
-      return this.conditions.set('Ready', {
-        status: 'False',
-        reason: 'MissingSecret',
-      });
-    }
-    const { host, user, password, port } = decodeSecret<z.infer<typeof postgresConnectionSecretDataSchema>>(
-      current.data,
-    )!;
-    if (!host) {
-      return this.conditions.set('Ready', {
-        status: 'False',
-        reason: 'MissingHost',
-      });
-    }
-    if (!user) {
-      return this.conditions.set('Ready', {
-        status: 'False',
-        reason: 'MissingUser',
-      });
-    }
-    if (!password) {
-      return this.conditions.set('Ready', {
-        status: 'False',
-        reason: 'MissingPassword',
-      });
-    }
-    const postgresService = this.services.get(PostgresService);
-    const database = postgresService.get({
-      host,
-      user,
-      port: port ? Number(port) : 5432,
-      password,
-    });
-    if (!(await database.ping())) {
-      return this.conditions.set('Ready', {
-        status: 'False',
-        reason: 'CanNotConnectToDatabase',
-      });
-    }
-    await this.conditions.set('Ready', {
-      status: 'True',
-    });
-  };
-}
-
-export { PostgresConnectionResource };

src/custom-resouces/postgres-connection/postgres-connection.ts

@@ -1,19 +0,0 @@
-import { createCustomResourceDefinition } from '../../services/custom-resources/custom-resources.ts';
-import { GROUP } from '../../utils/consts.ts';
-
-import { postgresConnectionSpecSchema } from './posgtres-connection.schemas.ts';
-import { PostgresConnectionResource } from './postgres-connection.resource.ts';
-
-const postgresConnectionDefinition = createCustomResourceDefinition({
-  group: GROUP,
-  version: 'v1',
-  kind: 'PostgresConnection',
-  names: {
-    plural: 'postgresconnections',
-    singular: 'postgresconnection',
-  },
-  spec: postgresConnectionSpecSchema,
-  create: (options) => new PostgresConnectionResource(options),
-});
-
-export { postgresConnectionDefinition };

src/custom-resouces/postgres-database/portgres-database.schemas.ts

@@ -1,7 +0,0 @@
-import { z } from 'zod';
-
-const postgresDatabaseSpecSchema = z.object({
-  connection: z.string(),
-});
-
-export { postgresDatabaseSpecSchema };

src/custom-resouces/postgres-database/postgres-database.resource.ts

@@ -1,206 +0,0 @@
-import { z } from 'zod';
-import type { V1Secret } from '@kubernetes/client-node';
-
-import {
-  CustomResource,
-  type CustomResourceObject,
-  type CustomResourceOptions,
-  type SubresourceResult,
-} from '../../services/custom-resources/custom-resources.custom-resource.ts';
-import { PostgresService } from '../../services/postgres/postgres.service.ts';
-import {
-  postgresConnectionSecretDataSchema,
-  type postgresConnectionSpecSchema,
-} from '../postgres-connection/posgtres-connection.schemas.ts';
-import { ResourceReference } from '../../services/resources/resources.ref.ts';
-import { Resource, ResourceService } from '../../services/resources/resources.ts';
-import { getWithNamespace } from '../../utils/naming.ts';
-import { API_VERSION } from '../../utils/consts.ts';
-import { decodeSecret } from '../../utils/secrets.ts';
-
-import type { postgresDatabaseSpecSchema } from './portgres-database.schemas.ts';
-
-const SECRET_READY_CONDITION = 'Secret';
-const DATABASE_READY_CONDITION = 'Database';
-
-const secretDataSchema = z.object({
-  host: z.string(),
-  port: z.string().optional(),
-  database: z.string(),
-  user: z.string(),
-  password: z.string(),
-});
-
-class PostgresDatabaseResource extends CustomResource<typeof postgresDatabaseSpecSchema> {
-  #secret: Resource<V1Secret>;
-  #secretName: string;
-  #connection: ResourceReference<CustomResourceObject<typeof postgresConnectionSpecSchema>>;
-  #connectionSecret: ResourceReference<V1Secret>;
-
-  constructor(options: CustomResourceOptions<typeof postgresDatabaseSpecSchema>) {
-    super(options);
-    const resouceService = this.services.get(ResourceService);
-
-    this.#secretName = `postgres-database-${this.name}`;
-    this.#secret = resouceService.get({
-      apiVersion: 'v1',
-      kind: 'Secret',
-      name: this.#secretName,
-      namespace: this.namespace,
-    });
-
-    this.#connection = new ResourceReference();
-    this.#connectionSecret = new ResourceReference();
-
-    this.#updateSecret();
-
-    this.#secret.on('changed', this.queueReconcile);
-    this.#connection.on('changed', this.queueReconcile);
-    this.#connectionSecret.on('changed', this.queueReconcile);
-  }
-
-  get #dbName() {
-    return `${this.namespace}_${this.name}`;
-  }
-
-  get #userName() {
-    return `${this.namespace}_${this.name}`;
-  }
-
-  #updateSecret = () => {
-    const resouceService = this.services.get(ResourceService);
-    const connectionNames = getWithNamespace(this.spec.connection, this.namespace);
-    this.#connection.current = resouceService.get({
-      apiVersion: API_VERSION,
-      kind: 'PostgresConnection',
-      name: connectionNames.name,
-      namespace: connectionNames.namespace,
-    });
-    if (this.#connection.current?.exists && this.#connection.current.spec) {
-      const connectionSecretNames = getWithNamespace(
-        this.#connection.current.spec.secret,
-        this.#connection.current.namespace,
-      );
-      this.#connectionSecret.current = resouceService.get({
-        apiVersion: 'v1',
-        kind: 'Secret',
-        name: connectionSecretNames.name,
-        namespace: connectionSecretNames.namespace,
-      });
-    }
-  };
-
-  #reconcileSecret = async (): Promise<SubresourceResult> => {
-    const connectionSecret = this.#connectionSecret.current;
-    if (!connectionSecret?.exists || !connectionSecret.data) {
-      return {
-        ready: false,
-        failed: true,
-        reason: 'MissingConnectionSecret',
-      };
-    }
-
-    const connectionSecretData = decodeSecret(connectionSecret.data);
-
-    const secret = this.#secret;
-    const parsed = secretDataSchema.safeParse(decodeSecret(secret.data));
-
-    if (!parsed.success) {
-      this.#secret.patch({
-        data: {
-          host: Buffer.from(connectionSecretData?.host || '').toString('base64'),
-          port: connectionSecretData?.port ? Buffer.from(connectionSecretData.port).toString('base64') : undefined,
-          user: Buffer.from(this.#userName).toString('base64'),
-          database: Buffer.from(this.#dbName).toString('base64'),
-          password: Buffer.from(Buffer.from(crypto.randomUUID()).toString('hex')).toString('base64'),
-        },
-      });
-      return {
-        ready: false,
-        syncing: true,
-      };
-    }
-    if (parsed.data?.host !== connectionSecretData?.host || parsed.data?.port !== connectionSecretData?.port) {
-      this.#secret.patch({
-        data: {
-          host: Buffer.from(connectionSecretData?.host || '').toString('base64'),
-          port: connectionSecretData?.port ? Buffer.from(connectionSecretData.port).toString('base64') : undefined,
-        },
-      });
-      return {
-        ready: false,
-        syncing: true,
-      };
-    }
-
-    return {
-      ready: true,
-    };
-  };
-
-  #reconcileDatabase = async (): Promise<SubresourceResult> => {
-    const connectionSecret = this.#connectionSecret.current;
-    if (!connectionSecret?.exists || !connectionSecret.data) {
-      return {
-        ready: false,
-        failed: true,
-        reason: 'MissingConnectionSecret',
-      };
-    }
-
-    const connectionSecretData = postgresConnectionSecretDataSchema.safeParse(decodeSecret(connectionSecret.data));
-    if (!connectionSecretData.success || !connectionSecretData.data) {
-      return {
-        ready: false,
-        syncing: true,
-        reason: 'ConnectionSecretMissing',
-      };
-    }
-
-    const secretData = secretDataSchema.safeParse(decodeSecret(this.#secret.data));
-    if (!secretData.success || !secretData.data) {
-      return {
-        ready: false,
-        syncing: true,
-        reason: 'SecretMissing',
-      };
-    }
-
-    const postgresService = this.services.get(PostgresService);
-    const database = postgresService.get({
-      ...connectionSecretData.data,
-      port: connectionSecretData.data.port ? Number(connectionSecretData.data.port) : 5432,
-    });
-    await database.upsertRole({
-      name: secretData.data.user,
-      password: secretData.data.password,
-    });
-    await database.upsertDatabase({
-      name: secretData.data.database,
-      owner: secretData.data.user,
-    });
-
-    return {
-      ready: true,
-    };
-  };
-
-  public reconcile = async () => {
-    if (!this.exists || this.metadata.deletionTimestamp) {
-      return;
-    }
-    this.#updateSecret();
-    await Promise.allSettled([
-      await this.reconcileSubresource(DATABASE_READY_CONDITION, this.#reconcileDatabase),
-      await this.reconcileSubresource(SECRET_READY_CONDITION, this.#reconcileSecret),
-    ]);
-
-    const secretReady = this.conditions.get(SECRET_READY_CONDITION)?.status === 'True';
-    const databaseReady = this.conditions.get(DATABASE_READY_CONDITION)?.status === 'True';
-    await this.conditions.set('Ready', {
-      status: secretReady && databaseReady ? 'True' : 'False',
-    });
-  };
-}
-
-export { PostgresDatabaseResource, secretDataSchema as postgresDatabaseSecretSchema };

src/custom-resouces/postgres-database/postgres-database.ts

@@ -1,19 +0,0 @@
-import { createCustomResourceDefinition } from '../../services/custom-resources/custom-resources.ts';
-import { GROUP } from '../../utils/consts.ts';
-
-import { postgresDatabaseSpecSchema } from './portgres-database.schemas.ts';
-import { PostgresDatabaseResource } from './postgres-database.resource.ts';
-
-const postgresDatabaseDefinition = createCustomResourceDefinition({
-  group: GROUP,
-  version: 'v1',
-  kind: 'PostgresDatabase',
-  names: {
-    plural: 'postgresdatabases',
-    singular: 'postgresdatabase',
-  },
-  spec: postgresDatabaseSpecSchema,
-  create: (options) => new PostgresDatabaseResource(options),
-});
-
-export { postgresDatabaseDefinition };

src/custom-resouces/redis-connection/redis-connection.resource.ts

@@ -1,61 +0,0 @@
-import type { V1Secret } from '@kubernetes/client-node';
-
-import {
-  CustomResource,
-  type CustomResourceOptions,
-} from '../../services/custom-resources/custom-resources.custom-resource.ts';
-import { ResourceReference } from '../../services/resources/resources.ref.ts';
-import { ResourceService } from '../../services/resources/resources.ts';
-import { getWithNamespace } from '../../utils/naming.ts';
-
-import type { redisConnectionSpecSchema } from './redis-connection.schemas.ts';
-
-class RedisConnectionResource extends CustomResource<typeof redisConnectionSpecSchema> {
-  #secret: ResourceReference<V1Secret>;
-
-  constructor(options: CustomResourceOptions<typeof redisConnectionSpecSchema>) {
-    super(options);
-    const resourceService = this.services.get(ResourceService);
-    const secretNames = getWithNamespace(this.spec.secret, this.namespace);
-    this.#secret = new ResourceReference<V1Secret>(
-      resourceService.get({
-        apiVersion: 'v1',
-        kind: 'Secret',
-        name: secretNames.name,
-        namespace: secretNames.namespace,
-      }),
-    );
-    this.#secret.on('changed', this.queueReconcile);
-  }
-
-  public reconcile = async () => {
-    const resourceService = this.services.get(ResourceService);
-    const secretNames = getWithNamespace(this.spec.secret, this.namespace);
-    this.#secret.current = resourceService.get({
-      apiVersion: 'v1',
-      kind: 'Secret',
-      name: secretNames.name,
-      namespace: secretNames.namespace,
-    });
-
-    const current = this.#secret.current;
-    if (!current?.exists || !current.data) {
-      return this.conditions.set('Ready', {
-        status: 'False',
-        reason: 'MissingSecret',
-      });
-    }
-    const { host } = current.data;
-    if (!host) {
-      return this.conditions.set('Ready', {
-        status: 'False',
-        reason: 'MissingHost',
-      });
-    }
-    await this.conditions.set('Ready', {
-      status: 'True',
-    });
-  };
-}
-
-export { RedisConnectionResource };

src/custom-resouces/redis-connection/redis-connection.schemas.ts

@@ -1,14 +0,0 @@
-import { z } from 'zod';
-
-const redisConnectionSpecSchema = z.object({
-  secret: z.string(),
-});
-
-const redisConnectionSecretDataSchema = z.object({
-  host: z.string(),
-  port: z.string().optional(),
-  user: z.string().optional(),
-  password: z.string().optional(),
-});
-
-export { redisConnectionSpecSchema, redisConnectionSecretDataSchema };

src/custom-resouces/redis-connection/redis-connection.ts

@@ -1,19 +0,0 @@
-import { createCustomResourceDefinition } from '../../services/custom-resources/custom-resources.ts';
-import { GROUP } from '../../utils/consts.ts';
-
-import { redisConnectionSpecSchema } from './redis-connection.schemas.ts';
-import { RedisConnectionResource } from './redis-connection.resource.ts';
-
-const redisConnectionDefinition = createCustomResourceDefinition({
-  group: GROUP,
-  version: 'v1',
-  kind: 'RedisConnection',
-  names: {
-    plural: 'redisconnections',
-    singular: 'redisconnection',
-  },
-  spec: redisConnectionSpecSchema,
-  create: (options) => new RedisConnectionResource(options),
-});
-
-export { redisConnectionDefinition };