fixes

charts/apps/audiobookshelf/Chart.yaml

@@ -0,0 +1,3 @@
+apiVersion: v2
+version: 1.0.0
+name: audiobookshelf

charts/apps/audiobookshelf/templates/client.yaml

@@ -0,0 +1,13 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: OidcClient
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.globals.environment }}'
+  redirectUris:
+    - path: /audiobookshelf/auth/openid/callback
+      subdomain: '{{ .Values.subdomain }}'
+      matchingMode: strict
+    - path: /audiobookshelf/auth/openid/mobile-redirect
+      subdomain: '{{ .Values.subdomain }}'
+      matchingMode: strict

charts/apps/audiobookshelf/templates/deployment.yaml

@@ -0,0 +1,52 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  strategy:
+    type: Recreate
+  replicas: 1
+  selector:
+    matchLabels:
+      app: '{{ .Release.Name }}'
+  template:
+    metadata:
+      labels:
+        app: '{{ .Release.Name }}'
+    spec:
+      containers:
+        - name: '{{ .Release.Name }}'
+          image: '{{ .Values.image.repository }}:{{ .Values.image.tag }}'
+          imagePullPolicy: '{{ .Values.image.pullPolicy }}'
+          ports:
+            - name: http
+              containerPort: 80
+              protocol: TCP
+          livenessProbe:
+            tcpSocket:
+              port: http
+          readinessProbe:
+            tcpSocket:
+              port: http
+          volumeMounts:
+            - mountPath: /config
+              name: config
+            - mountPath: /metadata
+              name: metadata
+            - mountPath: /audiobooks
+              name: audiobooks
+            - mountPath: /podcasts
+              name: podcasts
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: '{{ .Release.Name }}-config'
+        - name: metadata
+          persistentVolumeClaim:
+            claimName: '{{ .Release.Name }}-metadata'
+        - name: audiobooks
+          persistentVolumeClaim:
+            claimName: books
+        - name: podcasts
+          persistentVolumeClaim:
+            claimName: podcasts

charts/apps/audiobookshelf/templates/external-http-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: ExternalHttpService
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.globals.environment }}'
+  subdomain: '{{ .Values.subdomain }}'
+  destination:
+    host: '{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local'
+    port:
+      number: 80

charts/apps/audiobookshelf/templates/pvc.yaml

@@ -0,0 +1,24 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: '{{ .Release.Name }}-config'
+spec:
+  accessModes:
+    - 'ReadWriteOnce'
+  resources:
+    requests:
+      storage: '1Gi'
+  storageClassName: '{{ .Values.globals.environment }}'
+
+---
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: '{{ .Release.Name }}-metadata'
+spec:
+  accessModes:
+    - 'ReadWriteOnce'
+  resources:
+    requests:
+      storage: '1Gi'
+  storageClassName: '{{ .Values.globals.environment }}'

charts/apps/audiobookshelf/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: '{{ .Release.Name }}'
+  labels:
+    app: '{{ .Release.Name }}'
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 80
+      protocol: TCP
+      name: http
+  selector:
+    app: '{{ .Release.Name }}'

charts/apps/audiobookshelf/values.yaml

@@ -0,0 +1,7 @@
+globals:
+  environment: prod
+image:
+  repository: ghcr.io/advplyr/audiobookshelf
+  tag: 2.26.1
+  pullPolicy: IfNotPresent
+subdomain: audiobookshelf

charts/apps/bytestash/templates/client.yaml

@@ -3,7 +3,7 @@ kind: OidcClient
 metadata:
   name: '{{ .Release.Name }}'
 spec:
-  environment: '{{ .Values.environment }}'
+  environment: '{{ .Values.globals.environment }}'
   redirectUris:
     - path: /api/auth/oidc/callback
       subdomain: bytestash

charts/apps/bytestash/templates/deployment.yaml

@@ -1,5 +1,5 @@
 apiVersion: apps/v1
-kind: StatefulSet
+kind: Deployment
 metadata:
   name: '{{ .Release.Name }}'
   labels:
@@ -22,6 +22,10 @@ spec:
             - containerPort: 5000
               name: http
           env:
+            - name: ALLOW_NEW_ACCOUNTS
+              value: 'true'
+            - name: DISABLE_INTERNAL_ACCOUNTS
+              value: 'true'
             - name: OIDC_ENABLED
               value: 'true'
             - name: OIDC_DISPLAY_NAME
@@ -44,20 +48,8 @@ spec:
 
           volumeMounts:
             - mountPath: /data/snippets
-              name: bytestash-data
+              name: data
-
+      volumes:
-      # Defines security context for the pod to avoid running as root.
+        - name: data
-      # securityContext:
+          persistentVolumeClaim:
-      #   runAsUser: 1000
+            claimName: '{{ .Release.Name }}-data'
-      #   runAsGroup: 1000
-      #   fsGroup: 1000
-
-  volumeClaimTemplates:
-    - metadata:
-        name: bytestash-data
-      spec:
-        accessModes: ['ReadWriteOnce']
-        storageClassName: '{{ .Values.environment }}'
-        resources:
-          requests:
-            storage: 5Gi

charts/apps/bytestash/templates/external-http-service.yaml

@@ -3,7 +3,7 @@ kind: ExternalHttpService
 metadata:
   name: '{{ .Release.Name }}'
 spec:
-  environment: '{{ .Values.environment }}'
+  environment: '{{ .Values.globals.environment }}'
   subdomain: '{{ .Values.subdomain }}'
   destination:
     host: '{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local'

charts/apps/bytestash/templates/pvc.yaml

@@ -0,0 +1,11 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: '{{ .Release.Name }}-data'
+spec:
+  accessModes:
+    - 'ReadWriteOnce'
+  resources:
+    requests:
+      storage: '1Gi'
+  storageClassName: '{{ .Values.globals.environment }}'

charts/apps/bytestash/values.yaml

@@ -1,2 +1,3 @@
-environment: prod
+globals:
+  environment: prod
 subdomain: bytestash

charts/apps/gitea/Chart.yaml

@@ -0,0 +1,3 @@
+apiVersion: v2
+version: 1.0.0
+name: gitea

charts/apps/gitea/templates/client.yaml

@@ -0,0 +1,10 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: OidcClient
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.globals.environment }}'
+  redirectUris:
+    - path: /user/oauth2/Authentik/callback
+      subdomain: '{{ .Values.subdomain }}'
+      matchingMode: strict

charts/apps/gitea/templates/database.yaml

@@ -0,0 +1,6 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: PostgresDatabase
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.globals.environment }}'

charts/apps/gitea/templates/deployment.yaml

@@ -0,0 +1,96 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  strategy:
+    type: Recreate
+  replicas: 1
+  selector:
+    matchLabels:
+      app: '{{ .Release.Name }}'
+  template:
+    metadata:
+      labels:
+        app: '{{ .Release.Name }}'
+    spec:
+      containers:
+        - name: '{{ .Release.Name }}'
+          image: '{{ .Values.image.repository }}:{{ .Values.image.tag }}'
+          imagePullPolicy: '{{ .Values.image.pullPolicy }}'
+          ports:
+            - name: http
+              containerPort: 3000
+              protocol: TCP
+          livenessProbe:
+            tcpSocket:
+              port: http
+          readinessProbe:
+            tcpSocket:
+              port: http
+          volumeMounts:
+            - mountPath: /data
+              name: data
+          env:
+            - name: TZ
+              value: '{{ .Values.globals.timezone }}'
+            - name: USER_UID
+              value: '1000'
+            - name: USER_GID
+              value: '1000'
+            - name: GITEA__service__REQUIRE_EXTERNAL_REGISTRATION_PASSWORD
+              value: 'true'
+            - name: GITEA__service__ENABLE_BASIC_AUTHENTICATION
+              value: 'true'
+            - name: GITEA__service__ENABLE_PASSWORD_SIGNIN_FORM
+              value: 'false'
+            - name: GITEA__service__DEFAULT_KEEP_EMAIL_PRIVATE
+              value: 'true'
+            - name: GITEA__service__DEFAULT_USER_IS_RESTRICTED
+              value: 'true'
+            - name: GITEA__service__DEFAULT_USER_VISIBILITY
+              value: 'private'
+            - name: GITEA__service__DEFAULT_ORG_VISIBILITY
+              value: 'private'
+            - name: GITEA__service__ALLOW_ONLY_EXTERNAL_REGISTRATION
+              value: 'true'
+            - name: GITEA__other__SHOW_FOOTER_POWERED_BY
+              value: 'false'
+            - name: GITEA__other__SHOW_FOOTER_TEMPLATE_LOAD_TIME
+              value: 'false'
+            - name: GITEA__other__SHOW_FOOTER_VERSION
+              value: 'false'
+            - name: GITEA__repository__ENABLE_PUSH_CREATE_USER
+              value: 'true'
+            - name: GITEA__repository__ENABLE_PUSH_CREATE_ORG
+              value: 'true'
+            - name: GITEA__openid__ENABLE_OPENID_SIGNIN
+              value: 'false'
+            - name: GITEA__openid__ENABLE_OPENID_SIGNUP
+              value: 'false'
+            - name: GITEA__database__DB_TYPE
+              value: postgres
+            - name: GITEA__database__NAME
+              valueFrom:
+                secretKeyRef:
+                  name: '{{ .Release.Name }}-pg-connection'
+                  key: database
+            - name: GITEA__database__HOST
+              valueFrom:
+                secretKeyRef:
+                  name: '{{ .Release.Name }}-pg-connection'
+                  key: host
+            - name: GITEA__database__USER
+              valueFrom:
+                secretKeyRef:
+                  name: '{{ .Release.Name }}-pg-connection'
+                  key: user
+            - name: GITEA__database__PASSWD
+              valueFrom:
+                secretKeyRef:
+                  name: '{{ .Release.Name }}-pg-connection'
+                  key: password
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: '{{ .Release.Name }}-data'

charts/apps/gitea/templates/external-http-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: ExternalHttpService
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.globals.environment }}'
+  subdomain: '{{ .Values.subdomain }}'
+  destination:
+    host: '{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local'
+    port:
+      number: 80

charts/apps/gitea/templates/pvc.yaml

@@ -0,0 +1,11 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: '{{ .Release.Name }}-data'
+spec:
+  accessModes:
+    - 'ReadWriteOnce'
+  resources:
+    requests:
+      storage: '1Gi'
+  storageClassName: '{{ .Values.globals.environment }}'

charts/apps/gitea/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: '{{ .Release.Name }}'
+  labels:
+    app: '{{ .Release.Name }}'
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 3000
+      protocol: TCP
+      name: http
+  selector:
+    app: '{{ .Release.Name }}'

charts/apps/gitea/values.yaml

@@ -0,0 +1,8 @@
+globals:
+  environment: prod
+  timezone: Europe/Amsterdam
+image:
+  repository: docker.gitea.com/gitea
+  tag: latest
+  pullPolicy: IfNotPresent
+subdomain: gitea

charts/apps/jellyfin/templates/client.yaml

@@ -6,5 +6,5 @@ spec:
   environment: '{{ .Values.environment }}'
   redirectUris:
     - path: /sso/OID/redirect/Authentik
-      subdomain: '{{ .Values.subdomain }}'
+      subdomain: '{{ .Values.globals.subdomain }}'
       matchingMode: strict

charts/apps/jellyfin/templates/deployment.yaml

@@ -5,7 +5,7 @@ metadata:
 spec:
   strategy:
     type: Recreate
-    replicas: 1
+  replicas: 1
   selector:
     matchLabels:
       app: '{{ .Release.Name }}'

charts/apps/jellyfin/templates/external-http-service.yaml

@@ -3,7 +3,7 @@ kind: ExternalHttpService
 metadata:
   name: '{{ .Release.Name }}'
 spec:
-  environment: '{{ .Values.environment }}'
+  environment: '{{ .Values.globals.environment }}'
   subdomain: '{{ .Values.subdomain }}'
   destination:
     host: '{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local'

charts/apps/jellyfin/values.yaml

@@ -1,6 +1,7 @@
+globals:
+  environment: prod
 image:
   repository: docker.io/jellyfin/jellyfin
   tag: latest
   pullPolicy: IfNotPresent
-environment: prod
 subdomain: jellyfin

charts/apps/metamcp/Chart.yaml

@@ -0,0 +1,3 @@
+apiVersion: v2
+version: 1.0.0
+name: metamcp

charts/apps/metamcp/templates/database.yaml

@@ -0,0 +1,6 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: PostgresDatabase
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.globals.environment }}'

charts/apps/metamcp/templates/deployment.yaml

@@ -0,0 +1,79 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  strategy:
+    type: Recreate
+  replicas: 1
+  selector:
+    matchLabels:
+      app: '{{ .Release.Name }}'
+  template:
+    metadata:
+      labels:
+        app: '{{ .Release.Name }}'
+    spec:
+      containers:
+        - name: '{{ .Release.Name }}'
+          image: '{{ .Values.image.repository }}:{{ .Values.image.tag }}'
+          imagePullPolicy: '{{ .Values.image.pullPolicy }}'
+          ports:
+            - name: http
+              containerPort: 12008
+              protocol: TCP
+          livenessProbe:
+            tcpSocket:
+              port: http
+          readinessProbe:
+            tcpSocket:
+              port: http
+          volumeMounts:
+            - mountPath: /data
+              name: data
+          env:
+            - name: TZ
+              value: '{{ .Values.globals.timezone }}'
+            - name: APP_URL
+              value: https://metamcp.olsen.cloud # TODO: Change
+            - name: NEXT_PUBLIC_APP_URL
+              value: https://metamcp.olsen.cloud # TODO: Change
+            - name: BETTER_AUTH_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: '{{ .Release.Name }}-secrets'
+                  key: betterauth
+            - name: DATABASE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: '{{ .Release.Name }}-pg-connection'
+                  key: url
+            - name: POSTGRES_DB
+              valueFrom:
+                secretKeyRef:
+                  name: '{{ .Release.Name }}-pg-connection'
+                  key: database
+            - name: POSTGRES_HOST
+              valueFrom:
+                secretKeyRef:
+                  name: '{{ .Release.Name }}-pg-connection'
+                  key: host
+            - name: POSTGRES_PORT
+              valueFrom:
+                secretKeyRef:
+                  name: '{{ .Release.Name }}-pg-connection'
+                  key: port
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: '{{ .Release.Name }}-pg-connection'
+                  key: user
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: '{{ .Release.Name }}-pg-connection'
+                  key: password
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: '{{ .Release.Name }}-data'

charts/apps/metamcp/templates/external-http-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: ExternalHttpService
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.globals.environment }}'
+  subdomain: '{{ .Values.subdomain }}'
+  destination:
+    host: '{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local'
+    port:
+      number: 80

charts/apps/metamcp/templates/pvc.yaml

@@ -0,0 +1,11 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: '{{ .Release.Name }}-data'
+spec:
+  accessModes:
+    - 'ReadWriteOnce'
+  resources:
+    requests:
+      storage: '1Gi'
+  storageClassName: '{{ .Values.globals.environment }}'

charts/apps/metamcp/templates/secret.yaml

@@ -0,0 +1,9 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: GenerateSecret
+metadata:
+  name: '{{ .Release.Name }}-secrets'
+spec:
+  fields:
+    - name: betterauth
+      encoding: base64
+      length: 64

charts/apps/metamcp/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: '{{ .Release.Name }}'
+  labels:
+    app: '{{ .Release.Name }}'
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 12008
+      protocol: TCP
+      name: http
+  selector:
+    app: '{{ .Release.Name }}'

charts/apps/metamcp/values.yaml

@@ -0,0 +1,8 @@
+globals:
+  environment: prod
+  timezone: Europe/Amsterdam
+image:
+  repository: ghcr.io/metatool-ai/metamcp
+  tag: latest
+  pullPolicy: IfNotPresent
+subdomain: metamcp

charts/apps/miniflux.disable/Chart.yaml

@@ -0,0 +1,3 @@
+apiVersion: v2
+version: 1.0.0
+name: ByteStash

charts/apps/miniflux.disable/templates/client.yaml

@@ -0,0 +1,10 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: OidcClient
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.globals.environment }}'
+  redirectUris:
+    - path: /api/auth/oidc/callback
+      subdomain: bytestash
+      matchingMode: strict

charts/apps/miniflux.disable/templates/deployment.yaml

@@ -0,0 +1,55 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: '{{ .Release.Name }}'
+  labels:
+    app: '{{ .Release.Name }}'
+spec:
+  serviceName: '{{ .Release.Name }}-headless'
+  replicas: 1
+  selector:
+    matchLabels:
+      app: '{{ .Release.Name }}'
+  template:
+    metadata:
+      labels:
+        app: '{{ .Release.Name }}'
+    spec:
+      containers:
+        - name: '{{ .Release.Name }}'
+          image: ghcr.io/miniflux/miniflux:latest
+          ports:
+            - containerPort: 8080
+              name: http
+          env:
+            - name: ALLOW_NEW_ACCOUNTS
+              value: 'true'
+            - name: DISABLE_INTERNAL_ACCOUNTS
+              value: 'true'
+            - name: OIDC_ENABLED
+              value: 'true'
+            - name: OIDC_DISPLAY_NAME
+              value: OIDC
+            - name: OIDC_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: '{{ .Release.Name }}-client'
+                  key: clientId
+            - name: OIDC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: '{{ .Release.Name }}-client'
+                  key: clientSecret
+            - name: OIDC_ISSUER_URL
+              valueFrom:
+                secretKeyRef:
+                  name: '{{ .Release.Name }}-client'
+                  key: configuration
+
+          volumeMounts:
+            - mountPath: /data/snippets
+              name: data
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: '{{ .Release.Name }}-data'

charts/apps/miniflux.disable/templates/external-http-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: ExternalHttpService
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.globals.environment }}'
+  subdomain: '{{ .Values.subdomain }}'
+  destination:
+    host: '{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local'
+    port:
+      number: 80

charts/apps/miniflux.disable/templates/pvc.yaml

@@ -0,0 +1,11 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: '{{ .Release.Name }}-data'
+spec:
+  accessModes:
+    - 'ReadWriteOnce'
+  resources:
+    requests:
+      storage: '1Gi'
+  storageClassName: '{{ .Values.globals.environment }}'

charts/apps/miniflux.disable/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: '{{ .Release.Name }}'
+  labels:
+    app: '{{ .Release.Name }}'
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 8080
+      protocol: TCP
+      name: http
+  selector:
+    app: '{{ .Release.Name }}'

charts/apps/miniflux.disable/values.yaml

@@ -0,0 +1,3 @@
+globals:
+  environment: prod
+subdomain: miniflux

charts/apps/n8n/Chart.yaml

@@ -0,0 +1,3 @@
+apiVersion: v2
+version: 1.0.0
+name: Jellyfin

charts/apps/n8n/templates/database.yaml

@@ -0,0 +1,6 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: PostgresDatabase
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.globals.environment }}'

charts/apps/n8n/templates/deployment.yaml

@@ -0,0 +1,73 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  strategy:
+    type: Recreate
+  replicas: 1
+  selector:
+    matchLabels:
+      app: '{{ .Release.Name }}'
+  template:
+    metadata:
+      labels:
+        app: '{{ .Release.Name }}'
+    spec:
+      containers:
+        - name: '{{ .Release.Name }}'
+          image: '{{ .Values.image.repository }}:{{ .Values.image.tag }}'
+          imagePullPolicy: '{{ .Values.image.pullPolicy }}'
+          ports:
+            - name: http
+              containerPort: 5678
+              protocol: TCP
+          livenessProbe:
+            tcpSocket:
+              port: http
+          readinessProbe:
+            tcpSocket:
+              port: http
+          volumeMounts:
+            - mountPath: /home/node/.n8n
+              name: data
+          env:
+            - name: TZ
+              value: '{{ .Values.globals.timezone }}'
+            - name: GENERIC_TIMEZONE
+              value: '{{ .Values.globals.timezone }}'
+            - name: N8N_ENFORCE_SETTINGS_FILE_PERMISSIONS
+              value: 'true'
+            - name: N8N_RUNNERS_ENABLED
+              value: 'true'
+            - name: DB_TYPE
+              value: postgresdb
+            - name: DB_POSTGRESDB_DATABASE
+              valueFrom:
+                secretKeyRef:
+                  name: '{{ .Release.Name }}-pg-connection'
+                  key: database
+            - name: DB_POSTGRESDB_HOST
+              valueFrom:
+                secretKeyRef:
+                  name: '{{ .Release.Name }}-pg-connection'
+                  key: host
+            - name: DB_POSTGRESDB_PORT
+              valueFrom:
+                secretKeyRef:
+                  name: '{{ .Release.Name }}-pg-connection'
+                  key: port
+            - name: DB_POSTGRESDB_USER
+              valueFrom:
+                secretKeyRef:
+                  name: '{{ .Release.Name }}-pg-connection'
+                  key: user
+            - name: DB_POSTGRESDB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: '{{ .Release.Name }}-pg-connection'
+                  key: password
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: '{{ .Release.Name }}-data'

charts/apps/n8n/templates/external-http-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: ExternalHttpService
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.globals.environment }}'
+  subdomain: '{{ .Values.subdomain }}'
+  destination:
+    host: '{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local'
+    port:
+      number: 80

charts/apps/n8n/templates/pvc.yaml

@@ -0,0 +1,11 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: '{{ .Release.Name }}-data'
+spec:
+  accessModes:
+    - 'ReadWriteOnce'
+  resources:
+    requests:
+      storage: '1Gi'
+  storageClassName: '{{ .Values.globals.environment }}'

charts/apps/n8n/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: '{{ .Release.Name }}'
+  labels:
+    app: '{{ .Release.Name }}'
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 5678
+      protocol: TCP
+      name: http
+  selector:
+    app: '{{ .Release.Name }}'

charts/apps/n8n/values.yaml

@@ -0,0 +1,8 @@
+globals:
+  environment: prod
+  timezone: Europe/Amsterdam
+image:
+  repository: docker.n8n.io/n8nio/n8n
+  tag: latest
+  pullPolicy: IfNotPresent
+subdomain: n8n

charts/apps/ollama/Chart.yaml

@@ -1,3 +1,3 @@
 apiVersion: v2
 version: 1.0.0
-name: Ollama
+name: ollama

charts/apps/ollama/templates/client.yaml

@@ -0,0 +1,10 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: OidcClient
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.globals.environment }}'
+  redirectUris:
+    - path: /oauth/oidc/callback
+      subdomain: '{{ .Values.subdomain }}'
+      matchingMode: strict

charts/apps/ollama/templates/deployment.yaml

@@ -2,9 +2,9 @@ apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: '{{ .Release.Name }}'
-  labels:
-    app: '{{ .Release.Name }}'
 spec:
+  strategy:
+    type: Recreate
   replicas: 1
   selector:
     matchLabels:
@@ -15,38 +15,24 @@ spec:
         app: '{{ .Release.Name }}'
     spec:
       containers:
-        - name: ollama
+        - name: '{{ .Release.Name }}'
-          image: ghcr.io/ollama/ollama:latest # Official image
+          image: '{{ .Values.image.repository }}:{{ .Values.image.tag }}'
-          imagePullPolicy: IfNotPresent
+          imagePullPolicy: '{{ .Values.image.pullPolicy }}'
           ports:
-            - containerPort: 11434
+            - name: http
-              name: http
+              containerPort: 11434
-          volumeMounts:
+              protocol: TCP
-            - name: ollama-data
+          livenessProbe:
-              mountPath: /root/.ollama
+            tcpSocket:
-          env:
+              port: http
-            # If you want to pre‑start a model, set this env var to the
-            # model name (e.g., "gpt-4o-mini").  The container will download
-            # it automatically at startup.
-            # - name: OLLAMA_MODEL
-            #   value: "gpt-4o-mini"
           readinessProbe:
-            httpGet:
+            tcpSocket:
-              scheme: HTTP
+              port: http
-              path: /api/status
+          volumeMounts:
-              port: 11434
+            - mountPath: /root/.ollama
-            initialDelaySeconds: 5
+              name: data
-            periodSeconds: 10
+
-            successThreshold: 1
-            failureThreshold: 3
-          resources:
-            requests:
-              cpu: 500m
-              memory: 1Gi
-            limits:
-              cpu: 2000m
-              memory: 4Gi
       volumes:
-        - name: ollama-data
+        - name: data
           persistentVolumeClaim:
             claimName: '{{ .Release.Name }}-data'

charts/apps/ollama/templates/pvc.yaml

@@ -1,11 +1,11 @@
-apiVersion: v1
 kind: PersistentVolumeClaim
+apiVersion: v1
 metadata:
   name: '{{ .Release.Name }}-data'
 spec:
-  storageClassName: '{{ .Values.environment }}'
   accessModes:
-    - ReadWriteOnce
+    - 'ReadWriteOnce'
   resources:
     requests:
-      storage: 20Gi
+      storage: '1Gi'
+  storageClassName: '{{ .Values.globals.environment }}'

charts/apps/ollama/templates/service.yaml

@@ -5,11 +5,11 @@ metadata:
   labels:
     app: '{{ .Release.Name }}'
 spec:
-  type: LoadBalancer # Set to NodePort/ClusterIP if you prefer
+  type: ClusterIP
   ports:
-    - name: http
+    - port: 80
-      port: 11434
+      targetPort: 11434
-      targetPort: http
       protocol: TCP
+      name: http
   selector:
     app: '{{ .Release.Name }}'

charts/apps/ollama/values.yaml

@@ -1,2 +1,7 @@
-environment: dev
+globals:
-subdomain: bytestash
+  environment: prod
+image:
+  repository: ollama/ollama
+  tag: 0.11.8
+  pullPolicy: IfNotPresent
+subdomain: openwebui

charts/apps/openwebui/Chart.yaml

@@ -0,0 +1,3 @@
+apiVersion: v2
+version: 1.0.0
+name: openwebui

charts/apps/openwebui/templates/client.yaml

@@ -0,0 +1,10 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: OidcClient
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.globals.environment }}'
+  redirectUris:
+    - path: /oauth/oidc/callback
+      subdomain: '{{ .Values.subdomain }}'
+      matchingMode: strict

charts/apps/openwebui/templates/deployment.yaml

@@ -0,0 +1,70 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  strategy:
+    type: Recreate
+  replicas: 1
+  selector:
+    matchLabels:
+      app: '{{ .Release.Name }}'
+  template:
+    metadata:
+      labels:
+        app: '{{ .Release.Name }}'
+    spec:
+      containers:
+        - name: '{{ .Release.Name }}'
+          image: '{{ .Values.image.repository }}:{{ .Values.image.tag }}'
+          imagePullPolicy: '{{ .Values.image.pullPolicy }}'
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          livenessProbe:
+            tcpSocket:
+              port: http
+          readinessProbe:
+            tcpSocket:
+              port: http
+          volumeMounts:
+            - mountPath: /app/backend/data
+              name: data
+          env:
+            - name: ENABLE_SIGNUP
+              value: 'false'
+            - name: WEBUI_URL # TODO: remove
+              value: https://openwebui.olsen.cloud
+            - name: ENABLE_OAUTH_PERSISTENT_CONFIG
+              value: 'false'
+            - name: ENABLE_OAUTH_SIGNUP
+              value: 'true'
+            - name: OAUTH_MERGE_ACCOUNTS_BY_EMAIL
+              value: 'true'
+            - name: OAUTH_PROVIDER_NAME
+              value: authentik
+            - name: OPENID_PROVIDER_URL
+              valueFrom:
+                secretKeyRef:
+                  name: '{{ .Release.Name }}-client'
+                  key: configuration
+            - name: OAUTH_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: '{{ .Release.Name }}-client'
+                  key: clientId
+            - name: OAUTH_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: '{{ .Release.Name }}-client'
+                  key: clientSecret
+            - name: ENABLE_LOGIN_FORM
+              value: 'false'
+            - name: OPENID_REDIRECT
+              value: https://openwebui.olsen.cloud/oauth/oidc/callback
+
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: '{{ .Release.Name }}-data'

charts/apps/openwebui/templates/external-http-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: ExternalHttpService
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.globals.environment }}'
+  subdomain: '{{ .Values.subdomain }}'
+  destination:
+    host: '{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local'
+    port:
+      number: 80

charts/apps/openwebui/templates/pvc.yaml

@@ -0,0 +1,11 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: '{{ .Release.Name }}-data'
+spec:
+  accessModes:
+    - 'ReadWriteOnce'
+  resources:
+    requests:
+      storage: '1Gi'
+  storageClassName: '{{ .Values.globals.environment }}'

charts/apps/openwebui/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: '{{ .Release.Name }}'
+  labels:
+    app: '{{ .Release.Name }}'
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 8080
+      protocol: TCP
+      name: http
+  selector:
+    app: '{{ .Release.Name }}'

charts/apps/openwebui/values.yaml

@@ -0,0 +1,7 @@
+globals:
+  environment: prod
+image:
+  repository: ghcr.io/open-webui/open-webui
+  tag: main
+  pullPolicy: IfNotPresent
+subdomain: openwebui

charts/root/Chart.yaml

@@ -0,0 +1,3 @@
+apiVersion: v2
+version: 1.0.0
+name: root

charts/root/templates/apps.yaml

@@ -0,0 +1,33 @@
+apiVersion: argoproj.io/v1alpha1
+kind: ApplicationSet
+metadata:
+  name: homelab-apps
+  namespace: '{{ .Values.env }}-argo'
+spec:
+  generators:
+    - git:
+      repoURL: '{{ .Values.repo }}'
+      revision: '{{ .Values.ref }}'
+      directories:
+        - path: charts/apps/*
+          include: '.*'
+          exclude: '.*.disabled'
+  template:
+    metadata:
+      name: '{{`{{path.basename}}`}}'
+    spec:
+      project: default
+      source:
+        repoURL: '{{ .Values.repo }}'
+        targetRevision: '{{ .Values.ref }}'
+        path: charts/apps/{{`{{path.basename}}`}}
+        helm:
+          values: |
+            globals: {{ .Values.globals | toYaml | nindent 14 }}
+      destination:
+        server: https://kubernetes.default.svc
+        namespace: '{{ .Values.globals.env }}'
+      syncPolicy:
+        automated:
+          prune: true
+          selfHeal: true

charts/root/templates/root.yaml

@@ -0,0 +1,21 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: homelab-root
+  namespace: '{{ .Values.globals.env }}-argo'
+spec:
+  project: default
+  source:
+    repoURL: '{{ .Values.repo }}'
+    targetRevision: '{{ .Values.ref }}'
+    path: charts/root
+    helm:
+      valueFiles:
+        - values.yaml
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: '{{ .Values.globals.env }}-argo'
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true

charts/root/values.yaml

@@ -0,0 +1,4 @@
+globals:
+  env: prod
+repo: https://github.com/morten-olsen/homelab-operator.git
+ref: HEAD

charts/volumes/templates/books-pvc.yaml

@@ -10,19 +10,17 @@ spec:
   accessModes:
     - ReadWriteMany
   persistentVolumeReclaimPolicy: Retain
-  storageClassName: manual
+  storageClassName: manual-books
-  hostPath: null
   nfs:
     path: '{{ .Values.books.path }}'
     server: '{{ .Values.host }}'
-    readOnly: true
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: books
 spec:
-  storageClassName: manual
+  storageClassName: manual-books
   accessModes:
     - ReadWriteMany
   resources:

charts/volumes/templates/movies-pvc.yaml

@@ -10,19 +10,17 @@ spec:
   accessModes:
     - ReadWriteMany
   persistentVolumeReclaimPolicy: Retain
-  storageClassName: manual
+  storageClassName: manual-movies
-  hostPath: null
   nfs:
     path: '{{ .Values.movies.path }}'
     server: '{{ .Values.host }}'
-    readOnly: true
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: movies
 spec:
-  storageClassName: manual
+  storageClassName: manual-movies
   accessModes:
     - ReadWriteMany
   resources:

charts/volumes/templates/music-pvc.yaml

@@ -10,19 +10,17 @@ spec:
   accessModes:
     - ReadWriteMany
   persistentVolumeReclaimPolicy: Retain
-  storageClassName: manual
+  storageClassName: manual-music
-  hostPath: null
   nfs:
     path: '{{ .Values.music.path }}'
     server: '{{ .Values.host }}'
-    readOnly: true
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: music
 spec:
-  storageClassName: manual
+  storageClassName: manual-music
   accessModes:
     - ReadWriteMany
   resources:

charts/volumes/templates/podcasts-pvc.yaml

@@ -10,19 +10,17 @@ spec:
   accessModes:
     - ReadWriteMany
   persistentVolumeReclaimPolicy: Retain
-  storageClassName: manual
+  storageClassName: manual-podcasts
-  hostPath: null
   nfs:
     path: '{{ .Values.podcasts.path }}'
     server: '{{ .Values.host }}'
-    readOnly: true
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: podcasts
 spec:
-  storageClassName: manual
+  storageClassName: manual-podcasts
   accessModes:
     - ReadWriteMany
   resources:

charts/volumes/templates/tv-pvc.yaml

@@ -10,19 +10,17 @@ spec:
   accessModes:
     - ReadWriteMany
   persistentVolumeReclaimPolicy: Retain
-  storageClassName: manual
+  storageClassName: manual-tvshows
-  hostPath: null
   nfs:
     path: '{{ .Values.tvshows.path }}'
     server: '{{ .Values.host }}'
-    readOnly: true
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
   name: tvshows
 spec:
-  storageClassName: manual
+  storageClassName: manual-tvshows
   accessModes:
     - ReadWriteMany
   resources:

src/resources/homelab/environment/environment.ts

@@ -204,7 +204,11 @@ class Environment extends CustomResource<typeof specSchema> {
       spec: {
         targetNamespace: this.#argoNamespace.name,
         interval: '1h',
-        values: {},
+        values: {
+          applicationset: {
+            enabled: true,
+          },
+        },
         chart: {
           spec: {
             chart: 'argo-cd',

src/resources/homelab/generate-secret/generate-secret.ts

@@ -40,7 +40,7 @@ class GenerateSecret extends CustomResource<typeof specSchema> {
       ...current,
     };
 
-    await this.#secret.ensure(expected);
+    await this.#secret.set(expected);
   };
 }
 

src/resources/homelab/postgres-database/postgres-database.ts

@@ -26,6 +26,7 @@ type SecretData = {
   database: string;
   host: string;
   port: string;
+  url: string;
 };
 
 const sanitizeName = (input: string) => {
@@ -87,15 +88,22 @@ class PostgresDatabase extends CustomResource<typeof specSchema> {
       throw new NotReadyError('MissingClusterSecret');
     }
 
+    const expected = {
+      password: generateRandomHexPass(),
+      user: this.username,
+      database: this.database,
+      ...this.#secret.value,
+      host: clusterSecret.host,
+      port: clusterSecret.port,
+    };
+
+    const url = `postgresql://${expected.user}:${expected.password}@${expected.host}:${expected.port}/${expected.database}`;
+
     await this.#secret.set(
-      (current) => ({
+      {
-        password: generateRandomHexPass(),
+        ...expected,
-        user: this.username,
+        url,
-        database: this.database,
+      },
-        ...current,
-        host: clusterSecret.host,
-        port: clusterSecret.port,
-      }),
       {
         metadata: {
           ownerReferences: [this.ref],