add homarr

.github/workflows/main.yml

@@ -55,12 +55,12 @@ jobs:
 
       - name: Install dependencies
         run: pnpm install
-        working-directory: operator
+        working-directory: images/operator
         env:
           NODE_AUTH_TOKEN: ${{ secrets.NPM_TOKEN }}
 
       - name: Run tests
-        working-directory: operator
+        working-directory: images/operator
         run: pnpm test
 
   update-release-draft:

.github/workflows/publish-backup-tag.yml

@@ -0,0 +1,65 @@
+name: Publish tag
+
+on:
+  push:
+    branches:
+      - "main"
+    tags:
+      - "v*"
+
+env:
+  environment: test
+  release_channel: latest
+  DO_NOT_TRACK: "1"
+  NODE_VERSION: "23.x"
+  DOCKER_REGISTRY: ghcr.io
+  IMAGE_NAME: ${{ github.repository }}-backup
+  PNPM_VERSION: 10.6.0
+
+permissions:
+  contents: read
+  packages: read
+
+jobs:
+  release:
+    permissions:
+      contents: read
+      packages: write
+      attestations: write
+      id-token: write
+      pages: write
+    name: Release
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Log in to the Container registry
+        uses: docker/login-action@65b78e6e13532edd9afa3aa52ac7964289d1a9c1
+        with:
+          registry: ${{ env.DOCKER_REGISTRY }}
+          username: ${{ github.actor }}
+          password: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Extract metadata (tags, labels) for Docker
+        id: meta
+        uses: docker/metadata-action@9ec57ed1fcdbf14dcef7dfbe97b2010124a938b7
+        with:
+          images: ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME }}
+
+      - name: Build and push Docker image
+        id: push
+        uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
+        with:
+          context: ./images/backup
+          push: true
+          tags: ${{ steps.meta.outputs.tags }}
+          labels: ${{ steps.meta.outputs.labels }}
+
+      - name: Generate artifact attestation
+        uses: actions/attest-build-provenance@v2
+        with:
+          subject-name: ${{ env.DOCKER_REGISTRY }}/${{ env.IMAGE_NAME}}
+          subject-digest: ${{ steps.push.outputs.digest }}
+          push-to-registry: true

.github/workflows/publish-tag.yml

@@ -52,7 +52,7 @@ jobs:
         id: push
         uses: docker/build-push-action@f2a1d5e99d037542a71f64918e516c093c6f3fc4
         with:
-          context: ./operator
+          context: ./images/operator
           push: true
           tags: ${{ steps.meta.outputs.tags }}
           labels: ${{ steps.meta.outputs.labels }}

charts/apps/AGENT.md

@@ -0,0 +1,136 @@
+# Agent Documentation
+
+This document describes how to create a new application chart for the homelab operator.
+
+## Chart Structure
+
+Each application has its own chart located in a directory under `charts/apps`. The chart should contain the following files:
+
+- `Chart.yaml`: The chart metadata.
+- `values.yaml`: The default values for the chart.
+- `templates/`: A directory containing the Kubernetes resource templates.
+
+## Custom Resources
+
+The homelab operator uses several custom resources to manage applications. These resources are defined in the `templates` directory of the chart.
+
+### `PostgresDatabase`
+
+If the application requires a PostgreSQL database, you can create a `PostgresDatabase` resource. The operator will automatically create a database and a secret containing the connection details. The secret will have the same name as the release with a `-pg-connection` postfix.
+
+Example:
+
+```yaml
+# templates/database.yaml
+apiVersion: homelab.mortenolsen.pro/v1
+kind: PostgresDatabase
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  environment: "{{ .Values.globals.environment }}"
+```
+
+The secret has the following values:
+
+- `database`: name of the created database
+- `host`: the hostname of the postgres server
+- `port`: the port of the postgres server
+- `url`: combined url in the format `postgresql://{user}:{password}@{host}:{port}/{database}`
+
+### `OidcClient`
+
+If the application requires OIDC authentication, you can create an `OidcClient` resource. The operator will automatically create an OIDC client and a secret containing the client ID and secret. The secret will have the same name as the release with a `-client` postfix.
+
+You need to specify the redirect URIs for the OIDC client. The subdomain is taken from the `values.yaml` file.
+
+Example:
+
+```yaml
+# templates/client.yaml
+apiVersion: homelab.mortenolsen.pro/v1
+kind: OidcClient
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  environment: "{{ .Values.globals.environment }}"
+  redirectUris:
+    - path: /user/oauth2/Authentik/callback
+      subdomain: "{{ .Values.subdomain }}"
+      matchingMode: strict
+```
+
+The secret has the following value:
+
+- `authorization`: Authorization endpoint
+- `clientId`
+- `clientSecret`
+- `configuration`: autodiscovery endpoint
+- `configurationIssuer`: issuer url
+- `endSession`: end session endpoint
+- `jwks`: jwks endpoint
+- `token`: token endpoint
+- `userinfo`: user info endpoint
+
+### `HttpService` and `ExternalHttpService`
+
+To expose the application, you can use either an `HttpService` or an `ExternalHttpService` resource.
+
+- `HttpService`: This will expose the application through the Istio gateway. This is for internal access only.
+- `ExternalHttpService`: This will expose the application through a CloudFlare tunnel. This is for external access.
+
+Both resources take a `subdomain` and a `destination` as parameters. The `destination` is the Kubernetes service to route traffic to.
+
+Example of `HttpService`:
+
+```yaml
+# templates/http-service.yaml
+apiVersion: homelab.mortenolsen.pro/v1
+kind: HttpService
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  environment: "{{ .Values.globals.environment }}"
+  subdomain: "{{ .Values.subdomain }}"
+  destination:
+    host: "{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local"
+    port:
+      number: 80
+```
+
+Example of `ExternalHttpService`:
+
+```yaml
+# templates/external-http-service.yaml
+apiVersion: homelab.mortenolsen.pro/v1
+kind: ExternalHttpService
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  environment: "{{ .Values.globals.environment }}"
+  subdomain: "{{ .Values.subdomain }}"
+  destination:
+    host: "{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local"
+    port:
+      number: 80
+```
+
+## `values.yaml`
+
+The `values.yaml` file should contain the following values:
+
+- `globals.environment`: The environment the application is running in (e.g., `prod`, `dev`).
+- `image.repository`: The Docker image repository.
+- `image.tag`: The Docker image tag.
+- `subdomain`: The subdomain for the application.
+
+Example:
+
+```yaml
+# values.yaml
+globals:
+  environment: prod
+image:
+  repository: docker.gitea.com/gitea
+  tag: latest
+subdomain: gitea
+```

charts/apps/gitea/templates/deployment.yaml

@@ -1,23 +1,23 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
-  name: '{{ .Release.Name }}'
+  name: "{{ .Release.Name }}"
 spec:
   strategy:
     type: Recreate
   replicas: 1
   selector:
     matchLabels:
-      app: '{{ .Release.Name }}'
+      app: "{{ .Release.Name }}"
   template:
     metadata:
       labels:
-        app: '{{ .Release.Name }}'
+        app: "{{ .Release.Name }}"
     spec:
       containers:
-        - name: '{{ .Release.Name }}'
-          image: '{{ .Values.image.repository }}:{{ .Values.image.tag }}'
-          imagePullPolicy: '{{ .Values.image.pullPolicy }}'
+        - name: "{{ .Release.Name }}"
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: "{{ .Values.image.pullPolicy }}"
           ports:
             - name: http
               containerPort: 3000
@@ -36,64 +36,66 @@ spec:
               name: data
           env:
             - name: TZ
-              value: '{{ .Values.globals.timezone }}'
+              value: "{{ .Values.globals.timezone }}"
             - name: USER_UID
-              value: '1000'
+              value: "1000"
             - name: USER_GID
-              value: '1000'
+              value: "1000"
+            - name: GITEA__server__SSH_DOMAIN
+              value: gitea-ssh.olsen.cloud
             - name: GITEA__service__REQUIRE_EXTERNAL_REGISTRATION_PASSWORD
-              value: 'true'
+              value: "true"
             #- name: GITEA__service__ENABLE_BASIC_AUTHENTICATION
             #  value: 'true'
             - name: GITEA__service__ENABLE_PASSWORD_SIGNIN_FORM
-              value: 'false'
+              value: "false"
             - name: GITEA__service__DEFAULT_KEEP_EMAIL_PRIVATE
-              value: 'true'
+              value: "true"
             - name: GITEA__service__DEFAULT_USER_IS_RESTRICTED
-              value: 'true'
+              value: "true"
             - name: GITEA__service__DEFAULT_USER_VISIBILITY
-              value: 'private'
+              value: "private"
             - name: GITEA__service__DEFAULT_ORG_VISIBILITY
-              value: 'private'
+              value: "private"
             - name: GITEA__service__ALLOW_ONLY_EXTERNAL_REGISTRATION
-              value: 'true'
+              value: "true"
             - name: GITEA__other__SHOW_FOOTER_POWERED_BY
-              value: 'false'
+              value: "false"
             - name: GITEA__other__SHOW_FOOTER_TEMPLATE_LOAD_TIME
-              value: 'false'
+              value: "false"
             - name: GITEA__other__SHOW_FOOTER_VERSION
-              value: 'false'
+              value: "false"
             - name: GITEA__repository__ENABLE_PUSH_CREATE_USER
-              value: 'true'
+              value: "true"
             - name: GITEA__repository__ENABLE_PUSH_CREATE_ORG
-              value: 'true'
+              value: "true"
             - name: GITEA__openid__ENABLE_OPENID_SIGNIN
-              value: 'false'
+              value: "false"
             - name: GITEA__openid__ENABLE_OPENID_SIGNUP
-              value: 'false'
+              value: "false"
             - name: GITEA__database__DB_TYPE
               value: postgres
             - name: GITEA__database__NAME
               valueFrom:
                 secretKeyRef:
-                  name: '{{ .Release.Name }}-pg-connection'
+                  name: "{{ .Release.Name }}-pg-connection"
                   key: database
             - name: GITEA__database__HOST
               valueFrom:
                 secretKeyRef:
-                  name: '{{ .Release.Name }}-pg-connection'
+                  name: "{{ .Release.Name }}-pg-connection"
                   key: host
             - name: GITEA__database__USER
               valueFrom:
                 secretKeyRef:
-                  name: '{{ .Release.Name }}-pg-connection'
+                  name: "{{ .Release.Name }}-pg-connection"
                   key: user
             - name: GITEA__database__PASSWD
               valueFrom:
                 secretKeyRef:
-                  name: '{{ .Release.Name }}-pg-connection'
+                  name: "{{ .Release.Name }}-pg-connection"
                   key: password
       volumes:
         - name: data
           persistentVolumeClaim:
-            claimName: '{{ .Release.Name }}-data'
+            claimName: "{{ .Release.Name }}-data"

charts/apps/homarr/Chart.yaml

@@ -0,0 +1,3 @@
+apiVersion: v2
+version: 1.0.0
+name: openwebui

charts/apps/homarr/templates/client.yaml

@@ -0,0 +1,10 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: OidcClient
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  environment: "{{ .Values.globals.environment }}"
+  redirectUris:
+    - path: /api/auth/callback/oidc
+      subdomain: "{{ .Values.subdomain }}"
+      matchingMode: strict

charts/apps/homarr/templates/deployment.yaml

@@ -0,0 +1,83 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  strategy:
+    type: Recreate
+  replicas: 1
+  selector:
+    matchLabels:
+      app: "{{ .Release.Name }}"
+  template:
+    metadata:
+      labels:
+        app: "{{ .Release.Name }}"
+    spec:
+      containers:
+        - name: "{{ .Release.Name }}"
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: "{{ .Values.image.pullPolicy }}"
+          ports:
+            - name: http
+              containerPort: 7575
+              protocol: TCP
+          livenessProbe:
+            tcpSocket:
+              port: http
+          readinessProbe:
+            tcpSocket:
+              port: http
+          volumeMounts:
+            - mountPath: /appdata
+              name: data
+          env:
+            - name: BASE_URL
+              value: https://homarr.olsen.cloud # TODO
+
+            - name: NEXTAUTH_URL
+              value: https://homarr.olsen.cloud
+
+            - name: AUTH_PROVIDERS
+              value: oidc
+
+            - name: AUTH_OIDC_CLIENT_NAME
+              value: Authentik
+
+            - name: AUTH_OIDC_SCOPE_OVERWRITE
+              value: openid email profile
+
+            - name: AUTH_OIDC_GROUPS_ATTRIBUTE
+              value: groups
+
+            - name: AUTH_OIDC_AUTO_LOGIN
+              value: "true"
+
+            - name: SECRET_ENCRYPTION_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-secrets"
+                  key: encryptionkey
+
+            - name: AUTH_OIDC_ISSUER
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-client"
+                  key: configurationIssuer
+
+            - name: AUTH_OIDC_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-client"
+                  key: clientId
+
+            - name: AUTH_OIDC_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-client"
+                  key: clientSecret
+
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: "{{ .Release.Name }}-data"

charts/apps/homarr/templates/external-http-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: ExternalHttpService
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.globals.environment }}'
+  subdomain: '{{ .Values.subdomain }}'
+  destination:
+    host: '{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local'
+    port:
+      number: 80

charts/apps/homarr/templates/http-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: HttpService
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  environment: "{{ .Values.globals.environment }}"
+  subdomain: "{{ .Values.subdomain }}"
+  destination:
+    host: "{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local"
+    port:
+      number: 80

charts/apps/homarr/templates/pvc.yaml

@@ -0,0 +1,11 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: '{{ .Release.Name }}-data'
+spec:
+  accessModes:
+    - 'ReadWriteOnce'
+  resources:
+    requests:
+      storage: '1Gi'
+  storageClassName: '{{ .Values.globals.environment }}'

charts/apps/homarr/templates/secret.yaml

@@ -0,0 +1,9 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: GenerateSecret
+metadata:
+  name: "{{ .Release.Name }}-secrets"
+spec:
+  fields:
+    - name: encryptionkey
+      encoding: hex
+      length: 64

charts/apps/homarr/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: "{{ .Release.Name }}"
+  labels:
+    app: "{{ .Release.Name }}"
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 7575
+      protocol: TCP
+      name: http
+  selector:
+    app: "{{ .Release.Name }}"

charts/apps/homarr/values.yaml

@@ -0,0 +1,7 @@
+globals:
+  environment: prod
+image:
+  repository: ghcr.io/homarr-labs/homarr
+  tag: latest
+  pullPolicy: IfNotPresent
+subdomain: homarr

charts/apps/home-assistant/Chart.yaml

@@ -0,0 +1,3 @@
+apiVersion: v2
+version: 1.0.0
+name: home-assistant

charts/apps/home-assistant/templates/deployment.yaml

@@ -0,0 +1,44 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  strategy:
+    type: Recreate
+  replicas: 1
+  selector:
+    matchLabels:
+      app: "{{ .Release.Name }}"
+  template:
+    metadata:
+      labels:
+        app: "{{ .Release.Name }}"
+    spec:
+      hostNetwork: true
+
+      containers:
+        - name: "{{ .Release.Name }}"
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: "{{ .Values.image.pullPolicy }}"
+          env:
+            - name: TZ
+              value: "{{ .Values.globals.timezone }}"
+          ports:
+            - name: http
+              containerPort: 8123
+              protocol: TCP
+          livenessProbe:
+            tcpSocket:
+              port: http
+          readinessProbe:
+            tcpSocket:
+              port: http
+          volumeMounts:
+            - mountPath: /config
+              name: config
+          securityContext:
+            privileged: true
+      volumes:
+        - name: config
+          persistentVolumeClaim:
+            claimName: "{{ .Release.Name }}-config"

charts/apps/home-assistant/templates/http-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: HttpService
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  environment: "{{ .Values.globals.environment }}"
+  subdomain: "{{ .Values.subdomain }}"
+  destination:
+    host: "{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local"
+    port:
+      number: 80

charts/apps/home-assistant/templates/pvc.yaml

@@ -0,0 +1,11 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: "{{ .Release.Name }}-config"
+spec:
+  accessModes:
+    - "ReadWriteOnce"
+  resources:
+    requests:
+      storage: "1Gi"
+  storageClassName: "{{ .Values.globals.environment }}"

charts/apps/home-assistant/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: "{{ .Release.Name }}"
+  labels:
+    app: "{{ .Release.Name }}"
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 8123
+      protocol: TCP
+      name: http
+  selector:
+    app: "{{ .Release.Name }}"

charts/apps/home-assistant/values.yaml

@@ -0,0 +1,8 @@
+globals:
+  environment: prod
+  timezone: Europe/Amsterdam
+image:
+  repository: ghcr.io/home-assistant/home-assistant
+  tag: stable
+  pullPolicy: IfNotPresent
+subdomain: home-assistant

charts/apps/music-assistant/Chart.yaml

@@ -0,0 +1,3 @@
+apiVersion: v2
+version: 1.0.0
+name: music-assistant

charts/apps/music-assistant/templates/deployment.yaml

@@ -0,0 +1,44 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  strategy:
+    type: Recreate
+  replicas: 1
+  selector:
+    matchLabels:
+      app: "{{ .Release.Name }}"
+  template:
+    metadata:
+      labels:
+        app: "{{ .Release.Name }}"
+    spec:
+      hostNetwork: true
+
+      containers:
+        - name: "{{ .Release.Name }}"
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: "{{ .Values.image.pullPolicy }}"
+          ports:
+            - name: http
+              containerPort: 8095
+              protocol: TCP
+          livenessProbe:
+            tcpSocket:
+              port: http
+          readinessProbe:
+            tcpSocket:
+              port: http
+          volumeMounts:
+            - mountPath: /data
+              name: data
+          securityContext:
+            capabilities:
+              add:
+                - SYS_ADMIN
+                - DAC_READ_SEARCH
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: "{{ .Release.Name }}-data"

charts/apps/music-assistant/templates/http-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: HttpService
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  environment: "{{ .Values.globals.environment }}"
+  subdomain: "{{ .Values.subdomain }}"
+  destination:
+    host: "{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local"
+    port:
+      number: 80

charts/apps/music-assistant/templates/pvc.yaml

@@ -0,0 +1,11 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: "{{ .Release.Name }}-data"
+spec:
+  accessModes:
+    - "ReadWriteOnce"
+  resources:
+    requests:
+      storage: "1Gi"
+  storageClassName: "{{ .Values.globals.environment }}"

charts/apps/music-assistant/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: "{{ .Release.Name }}"
+  labels:
+    app: "{{ .Release.Name }}"
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 8095
+      protocol: TCP
+      name: http
+  selector:
+    app: "{{ .Release.Name }}"

charts/apps/music-assistant/values.yaml

@@ -0,0 +1,7 @@
+globals:
+  environment: prod
+image:
+  repository: ghcr.io/music-assistant/server
+  tag: latest
+  pullPolicy: IfNotPresent
+subdomain: music-assistant

charts/apps/photoprism/Chart.yaml

@@ -0,0 +1,3 @@
+apiVersion: v2
+version: 1.0.0
+name: photoprism

charts/apps/photoprism/templates/client.yaml

@@ -0,0 +1,10 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: OidcClient
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  environment: "{{ .Values.globals.environment }}"
+  redirectUris:
+    - path: /api/v1/oidc/redirect
+      subdomain: "{{ .Values.subdomain }}"
+      matchingMode: strict

charts/apps/photoprism/templates/deployment.yaml

@@ -0,0 +1,92 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  strategy:
+    type: Recreate
+  replicas: 1
+  selector:
+    matchLabels:
+      app: "{{ .Release.Name }}"
+  template:
+    metadata:
+      labels:
+        app: "{{ .Release.Name }}"
+    spec:
+      containers:
+        - name: "{{ .Release.Name }}"
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag }}"
+          imagePullPolicy: "{{ .Values.image.pullPolicy }}"
+          env:
+            - name: PHOTOPRISM_UPLOAD_NSFW
+              value: "true"
+            - name: PHOTOPRISM_SITE_URL
+              value: "https://{{ .Values.subdomain }}.olsen.cloud" #TODO
+            # - name: PHOTOPRISM_UID
+            #   value: "1000"
+            # - name: PHOTOPRISM_GID
+            #   value: "1000"
+            # - name: PHOTOPRISM_DISABLE_CHOWN
+            #   value: "true"
+            - name: PHOTOPRISM_AUTH_MODE
+              value: password
+            - name: PHOTOPRISM_DISABLE_TLS
+              value: "false"
+            - name: PHOTOPRISM_READONLY
+              value: "false"
+            - name: PHOTOPRISM_HTTP_COMPRESSION
+              value: "gzip"
+
+            - name: PHOTOPRISM_ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-secrets"
+                  key: password
+            - name: PHOTOPRISM_OIDC_SCOPES
+              value: "openid email profile offline_access"
+            - name: PHOTOPRISM_OIDC_PROVIDER
+              value: Authentik
+            - name: PHOTOPRISM_OIDC_ICON
+              value: https://cdn.jsdelivr.net/gh/selfhst/icons/png/authentik.png
+            - name: PHOTOPRISM_OIDC_REGISTER
+              value: "true"
+            - name: PHOTOPRISM_OIDC_REDIRECT
+              value: "false"
+            - name: PHOTOPRISM_OIDC_CLIENT
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-client"
+                  key: clientId
+            - name: PHOTOPRISM_OIDC_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-client"
+                  key: clientSecret
+            - name: PHOTOPRISM_OIDC_URI
+              valueFrom:
+                secretKeyRef:
+                  name: "{{ .Release.Name }}-client"
+                  key: configurationIssuer
+          ports:
+            - name: http
+              containerPort: 2342
+              protocol: TCP
+          livenessProbe:
+            tcpSocket:
+              port: http
+          readinessProbe:
+            tcpSocket:
+              port: http
+          volumeMounts:
+            - mountPath: /photoprism/storage
+              name: data
+            - mountPath: /photoprism/originals
+              name: originals
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: "{{ .Release.Name }}-data"
+        - name: originals
+          persistentVolumeClaim:
+            claimName: pictures

charts/apps/photoprism/templates/external-http-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: ExternalHttpService
+metadata:
+  name: '{{ .Release.Name }}'
+spec:
+  environment: '{{ .Values.globals.environment }}'
+  subdomain: '{{ .Values.subdomain }}'
+  destination:
+    host: '{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local'
+    port:
+      number: 80

charts/apps/photoprism/templates/http-service.yaml

@@ -0,0 +1,11 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: HttpService
+metadata:
+  name: "{{ .Release.Name }}"
+spec:
+  environment: "{{ .Values.globals.environment }}"
+  subdomain: "{{ .Values.subdomain }}"
+  destination:
+    host: "{{ .Release.Name }}.{{ .Release.Namespace }}.svc.cluster.local"
+    port:
+      number: 80

charts/apps/photoprism/templates/pvc.yaml

@@ -0,0 +1,11 @@
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: "{{ .Release.Name }}-data"
+spec:
+  accessModes:
+    - "ReadWriteOnce"
+  resources:
+    requests:
+      storage: "1Gi"
+  storageClassName: "{{ .Values.globals.environment }}"

charts/apps/photoprism/templates/secret.yaml

@@ -0,0 +1,9 @@
+apiVersion: homelab.mortenolsen.pro/v1
+kind: GenerateSecret
+metadata:
+  name: "{{ .Release.Name }}-secrets"
+spec:
+  fields:
+    - name: password
+      encoding: base64
+      length: 64

charts/apps/photoprism/templates/service.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: "{{ .Release.Name }}"
+  labels:
+    app: "{{ .Release.Name }}"
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: 2342
+      protocol: TCP
+      name: http
+  selector:
+    app: "{{ .Release.Name }}"

charts/apps/photoprism/values.yaml

@@ -0,0 +1,7 @@
+globals:
+  environment: prod
+image:
+  repository: photoprism/photoprism
+  tag: latest
+  pullPolicy: IfNotPresent
+subdomain: photoprism

charts/apps/volumes/templates/movies-pvc.yaml

@@ -1,28 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: movies
-  labels:
-    type: nfs
-spec:
-  capacity:
-    storage: 10Gi
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: manual-movies
-  nfs:
-    path: '{{ .Values.movies.path }}'
-    server: '{{ .Values.host }}'
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: movies
-spec:
-  storageClassName: manual-movies
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 10Gi

charts/apps/volumes/templates/music-pvc.yaml

@@ -1,28 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: music
-  labels:
-    type: nfs
-spec:
-  capacity:
-    storage: 10Gi
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: manual-music
-  nfs:
-    path: '{{ .Values.music.path }}'
-    server: '{{ .Values.host }}'
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: music
-spec:
-  storageClassName: manual-music
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 10Gi

charts/apps/volumes/templates/pictures-pvc.yaml

@@ -1,28 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: pictures
-  labels:
-    type: nfs
-spec:
-  capacity:
-    storage: 10Gi
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: manual-pictures
-  nfs:
-    path: '{{ .Values.pictures.path }}'
-    server: '{{ .Values.host }}'
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: pictures
-spec:
-  storageClassName: manual-pictures
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 10Gi

charts/apps/volumes/templates/podcasts-pvc.yaml

@@ -1,28 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: podcasts
-  labels:
-    type: nfs
-spec:
-  capacity:
-    storage: 10Gi
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: manual-podcasts
-  nfs:
-    path: '{{ .Values.podcasts.path }}'
-    server: '{{ .Values.host }}'
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: podcasts
-spec:
-  storageClassName: manual-podcasts
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 10Gi

charts/apps/volumes/templates/pvc.yaml

@@ -1,7 +1,12 @@
+{{- $values := .Values -}}
+{{- $release := .Release -}}
+
+---
+{{- range $key, $value := $values.shares }}
 apiVersion: v1
 kind: PersistentVolume
 metadata:
-  name: books
+  name: "{{$key}}"
   labels:
     type: nfs
 spec:
@@ -10,19 +15,22 @@ spec:
   accessModes:
     - ReadWriteMany
   persistentVolumeReclaimPolicy: Retain
-  storageClassName: manual-books
+  storageClassName: "manual-{{$key}}"
   nfs:
-    path: '{{ .Values.books.path }}'
-    server: '{{ .Values.host }}'
+    path: "{{ $value.path }}"
+    server: "{{ $values.host }}"
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
-  name: books
+  name: "{{ $key }}"
 spec:
-  storageClassName: manual-books
+  storageClassName: "manual-{{ $key }}"
   accessModes:
     - ReadWriteMany
   resources:
     requests:
       storage: 10Gi
+---
+{{- end }}
+

charts/apps/volumes/templates/tv-pvc.yaml

@@ -1,28 +0,0 @@
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: tvshows
-  labels:
-    type: nfs
-spec:
-  capacity:
-    storage: 10Gi
-  accessModes:
-    - ReadWriteMany
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: manual-tvshows
-  nfs:
-    path: '{{ .Values.tvshows.path }}'
-    server: '{{ .Values.host }}'
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: tvshows
-spec:
-  storageClassName: manual-tvshows
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 10Gi

charts/apps/volumes/values.yaml

@@ -1,13 +1,16 @@
 host: 192.168.20.106
-movies:
-  path: /mnt/HDD/Movies
-tvshows:
-  path: /mnt/HDD/TV-Shows
-music:
-  path: /mnt/HDD/Music2
-books:
-  path: /mnt/HDD/Books
-podcasts:
-  path: /mnt/HDD/Podcasts
-pictures:
-  path: /mnt/HDD/Pictures
+shares:
+  movies:
+    path: /mnt/HDD/Movies
+  tvshows:
+    path: /mnt/HDD/TV-Shows
+  music:
+    path: /mnt/HDD/Music2
+  books:
+    path: /mnt/HDD/Books
+  podcasts:
+    path: /mnt/HDD/Podcasts
+  pictures:
+    path: /mnt/HDD/Pictures
+  backups:
+    path: /mnt/HDD/Backups

charts/backup/Chart.yaml

@@ -0,0 +1,3 @@
+apiVersion: v2
+version: 1.0.0
+name: backup

charts/backup/templates/cron-job-backup.yaml

@@ -0,0 +1,48 @@
+{{- $values := .Values -}}
+{{- $release := .Release -}}
+
+---
+{{- range $key, $value := $values.jobs}}
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: "{{ $release.Name }}-{{ $key }}-backup"
+spec:
+  schedule: "{{ $value.cron.backup }}"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 1
+  jobTemplate:
+    spec:
+      template:
+        metadata:
+          annotations:
+            sidecar.istio.io/inject: "false"
+        spec:
+          containers:
+            - name: "{{ $release.Name }}-{{ $key }}-backup"
+              image: ghcr.io/morten-olsen/homelab-operator-backup:main
+              imagePullPolicy: Always
+              command: ["/app/backup.sh"]
+              env:
+                - name: RESTIC_PASSWORD
+                  valueFrom:
+                    secretKeyRef:
+                      name: "{{ $values.password.name }}"
+                      key: "{{ $values.password.key }}"
+              volumeMounts:
+                - name: source
+                  mountPath: "/mnt/source"
+                - name: target
+                  mountPath: "/mnt/backup"
+                  subPath: "{{ $release.Name }}-{{ $key }}"
+          volumes:
+            - name: source
+              persistentVolumeClaim:
+                claimName: "{{ $value.source }}"
+            - name: target
+              persistentVolumeClaim:
+                claimName: "{{ $values.target }}"
+          restartPolicy: OnFailure
+---
+{{- end }}

charts/backup/templates/cron-job-cleanup.yaml

@@ -0,0 +1,43 @@
+{{- $values := .Values -}}
+{{- $release := .Release -}}
+
+---
+{{- range $key, $value := $values.jobs}}
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: "{{ $release.Name }}-{{ $key }}-cleanup"
+spec:
+  schedule: "{{ $value.cron.cleanup }}"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 1
+  jobTemplate:
+    spec:
+      template:
+        metadata:
+          annotations:
+            sidecar.istio.io/inject: "false"
+        spec:
+          containers:
+            - name: "{{ $release.Name }}-{{ $key }}-cleanup"
+              image: ghcr.io/morten-olsen/homelab-operator-backup:main
+              imagePullPolicy: Always
+              command: ["/app/cleanup.sh"]
+              env:
+                - name: RESTIC_PASSWORD
+                  valueFrom:
+                    secretKeyRef:
+                      name: "{{ $values.password.name }}"
+                      key: "{{ $values.password.key }}"
+              volumeMounts:
+                - name: target
+                  mountPath: "/mnt/backup"
+                  subPath: "{{ $release.Name }}-{{ $key }}"
+          volumes:
+            - name: target
+              persistentVolumeClaim:
+                claimName: "{{ $values.target }}"
+          restartPolicy: OnFailure
+---
+{{- end }}

charts/backup/values.yaml

@@ -0,0 +1,10 @@
+password:
+  name: backup
+  key: password
+jobs:
+  pictures:
+    cron:
+      backup: "0 2 * * *"
+      cleanup: "0 4 * * SUN"
+    source: pictures
+target: backups

images/backup/Dockerfile

@@ -0,0 +1,10 @@
+FROM alpine/git:latest
+# or a more specific image like a Debian slim or Ubuntu base image.
+RUN apk add --no-cache restic fuse-overlayfs
+WORKDIR /app
+
+COPY backup.sh /app/backup.sh
+COPY cleanup.sh /app/cleanup.sh
+
+# Make scripts executable
+RUN chmod +x /app/backup.sh /app/cleanup.sh

images/backup/backup.sh

@@ -0,0 +1,35 @@
+#!/bin/sh
+
+set -e
+
+if [ -z "$RESTIC_PASSWORD" ]; then
+  echo "Error: RESTIC_PASSWORD environment variable is not set." >&2
+  exit 1
+fi
+
+RESTIC_REPOSITORY="/mnt/backup"
+SOURCE_DIR="/mnt/source"
+
+mkdir -p "$SOURCE_DIR"
+mkdir -p "/mnt/backup"
+
+echo "Starting Restic backup from $SOURCE_DIR to $RESTIC_REPOSITORY"
+
+echo "Checking/Initializing Restic repository..."
+restic init --repo "$RESTIC_REPOSITORY" || true
+
+echo "Running Restic backup..."
+restic backup \
+  -r "$RESTIC_REPOSITORY" \
+  "$SOURCE_DIR" \
+  --verbose \
+  --tag "daily"
+
+if [ $? -eq 0 ]; then
+  echo "Restic backup completed successfully!"
+else
+  echo "Restic backup failed!"
+  exit 1
+fi
+
+echo "Backup finished."

images/backup/cleanup.sh

@@ -0,0 +1,42 @@
+#!/bin/sh
+
+set -e
+
+if [ -z "$RESTIC_PASSWORD" ]; then
+  echo "Error: RESTIC_PASSWORD environment variable is not set." >&2
+  exit 1
+fi
+RESTIC_REPOSITORY="/mnt/backup"
+
+echo "Starting Restic cleanup for repository $RESTIC_REPOSITORY"
+
+echo "Checking Restic repository existence..."
+restic snapshots --repository "$RESTIC_REPOSITORY"
+
+# Restic forget and prune strategy
+# --keep-daily 7: Keep 7 most recent daily backups
+# --keep-weekly 4: Keep 4 most recent weekly backups
+# --keep-monthly 6: Keep 6 most recent monthly backups
+# --keep-yearly 1: Keep 1 most recent yearly backup
+# --prune: Actually delete data that's no longer referenced
+# --group-by host,paths: Group snapshots for retention by host and path.
+echo "Running Restic forget and prune..."
+restic forget \
+  --group-by host,paths \
+  --tag "daily" \
+  --keep-daily 7 \
+  --keep-weekly 4 \
+  --keep-monthly 6 \
+  --keep-yearly 1 \
+  --prune \
+  --verbose \
+  --repository "$RESTIC_REPOSITORY"
+
+if [ $? -eq 0 ]; then
+  echo "Restic cleanup completed successfully!"
+else
+  echo "Restic cleanup failed!"
+  exit 1
+fi
+
+echo "Cleanup finished."