diff --git a/kubernetes/app/media/networkpolicy.yaml b/kubernetes/app/media/networkpolicy.yaml index 0122090..06cccef 100644 --- a/kubernetes/app/media/networkpolicy.yaml +++ b/kubernetes/app/media/networkpolicy.yaml @@ -24,6 +24,7 @@ spec: - qbittorrent - sonarr - radarr + - seerr policyTypes: - Ingress ingress: @@ -95,7 +96,7 @@ spec: matchLabels: app: radarr --- -# Allow prowlarr to reach sonarr, radarr, and qbittorrent +# Allow prowlarr and seerr to reach sonarr, radarr, and qbittorrent apiVersion: networking.k8s.io/v1 kind: NetworkPolicy metadata: @@ -117,6 +118,9 @@ spec: - podSelector: matchLabels: app: prowlarr + - podSelector: + matchLabels: + app: seerr --- # Allow qbittorrent to receive connections from sonarr, radarr, and external BT traffic apiVersion: networking.k8s.io/v1 @@ -143,3 +147,42 @@ spec: protocol: TCP - port: 23312 protocol: UDP +--- +# Allow jellyfin to reach seerr (cross-namespace) +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: allow-jellyfin-to-seerr + namespace: media +spec: + podSelector: + matchLabels: + app: seerr + policyTypes: + - Ingress + ingress: + - from: + - namespaceSelector: + matchLabels: + kubernetes.io/metadata.name: jellyfin + podSelector: + matchLabels: + app: jellyfin +--- +# seerr-db: only reachable from seerr +apiVersion: networking.k8s.io/v1 +kind: NetworkPolicy +metadata: + name: seerr-db + namespace: media +spec: + podSelector: + matchLabels: + app: seerr-db + policyTypes: + - Ingress + ingress: + - from: + - podSelector: + matchLabels: + app: seerr diff --git a/kubernetes/app/media/pvc.yaml b/kubernetes/app/media/pvc.yaml index 0181065..9f994b8 100644 --- a/kubernetes/app/media/pvc.yaml +++ b/kubernetes/app/media/pvc.yaml @@ -95,3 +95,16 @@ spec: resources: requests: storage: 5Gi +--- +apiVersion: v1 +kind: PersistentVolumeClaim +metadata: + name: seerr-config + namespace: media +spec: + accessModes: + - ReadWriteOnce + storageClassName: nfs-synology-ssd + resources: + requests: + storage: 1Gi diff --git a/kubernetes/app/media/release-seerr.yaml b/kubernetes/app/media/release-seerr.yaml new file mode 100644 index 0000000..d42350a --- /dev/null +++ b/kubernetes/app/media/release-seerr.yaml @@ -0,0 +1,88 @@ +--- +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: seerr + namespace: flux-system +spec: + chart: + spec: + chart: seerr-chart + reconcileStrategy: ChartVersion + sourceRef: + kind: HelmRepository + name: seerr + namespace: flux-system + version: 3.3.0 + interval: 1m0s + targetNamespace: media + values: + image: + tag: v3.1.0 + podLabels: + app: seerr + extraEnv: + - name: DB_TYPE + value: postgres + - name: DB_HOST + value: seerr-db + - name: DB_PORT + value: "5432" + - name: DB_USER + valueFrom: + secretKeyRef: + name: seerr-credentials + key: SEERR_DB_USER + - name: DB_PASS + valueFrom: + secretKeyRef: + name: seerr-credentials + key: SEERR_DB_PASSWORD + - name: DB_NAME + valueFrom: + secretKeyRef: + name: seerr-credentials + key: SEERR_DB_NAME + - name: TZ + value: Europe/Kyiv + probes: + startupProbe: + tcpSocket: + port: http + initialDelaySeconds: 10 + periodSeconds: 5 + failureThreshold: 30 + livenessProbe: + httpGet: + port: http + path: /api/v1/status + periodSeconds: 30 + failureThreshold: 5 + readinessProbe: + httpGet: + port: http + path: /api/v1/status + periodSeconds: 10 + resources: + requests: + cpu: 50m + memory: 128Mi + limits: + memory: 512Mi + config: + persistence: + existingClaim: seerr-config + ingress: + enabled: true + annotations: + cert-manager.io/cluster-issuer: letsencrypt + traefik.ingress.kubernetes.io/router.middlewares: authelia-chain-authelia-authelia-auth@kubernetescrd + hosts: + - host: ${SEERR_HOST} + paths: + - path: / + pathType: Prefix + tls: + - hosts: + - ${SEERR_HOST} + secretName: seerr-tls diff --git a/kubernetes/app/media/renovate.json b/kubernetes/app/media/renovate.json index ac3d9d5..0b84ca0 100644 --- a/kubernetes/app/media/renovate.json +++ b/kubernetes/app/media/renovate.json @@ -2,14 +2,28 @@ "kubernetes": { "fileMatch": ["kubernetes/app/media/.+\\.yaml$"] }, + "customManagers": [ + { + "customType": "regex", + "fileMatch": ["kubernetes/app/media/release-seerr\\.yaml$"], + "matchStrings": ["tag:\\s*(?v[^\\s]+)"], + "depNameTemplate": "seerr-team/seerr", + "datasourceTemplate": "github-releases" + } + ], "packageRules": [ + { + "matchFileNames": ["kubernetes/app/media/**"], + "semanticCommitScope": "k8s/media" + }, { "matchFileNames": ["kubernetes/app/media/**"], "matchPackageNames": [ "lscr.io/linuxserver/sonarr", "lscr.io/linuxserver/radarr", "lscr.io/linuxserver/prowlarr", - "lscr.io/linuxserver/qbittorrent" + "lscr.io/linuxserver/qbittorrent", + "seerr-team/seerr" ], "matchUpdateTypes": ["patch", "minor"], "automerge": true @@ -20,7 +34,8 @@ "lscr.io/linuxserver/sonarr", "lscr.io/linuxserver/radarr", "lscr.io/linuxserver/prowlarr", - "lscr.io/linuxserver/qbittorrent" + "lscr.io/linuxserver/qbittorrent", + "seerr-team/seerr" ], "matchUpdateTypes": ["major"], "automerge": false diff --git a/kubernetes/app/media/repository-seerr.yaml b/kubernetes/app/media/repository-seerr.yaml new file mode 100644 index 0000000..ab1fdc8 --- /dev/null +++ b/kubernetes/app/media/repository-seerr.yaml @@ -0,0 +1,10 @@ +--- +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: seerr + namespace: flux-system +spec: + interval: 1m0s + type: oci + url: oci://ghcr.io/seerr-team/seerr diff --git a/kubernetes/app/media/secret-seerr.sops.yaml b/kubernetes/app/media/secret-seerr.sops.yaml new file mode 100644 index 0000000..749ad12 --- /dev/null +++ b/kubernetes/app/media/secret-seerr.sops.yaml @@ -0,0 +1,24 @@ +apiVersion: v1 +kind: Secret +metadata: + name: seerr-credentials + namespace: media +stringData: + SEERR_DB_USER: ENC[AES256_GCM,data:wZ6luT0=,iv:VraZZ4R5ovGiJ8MHB1rvQYGX6xQpuoHNjmMO/JrmBDw=,tag:Hm812MdDtIneMJvLYN8PdA==,type:str] + SEERR_DB_PASSWORD: ENC[AES256_GCM,data:X4RCN3xDaHvoHz2A9wjWK3I8lLeVGIhb9/my3HJthqvO9f8cJ0U3uNUvX9a4itlhVcNVwkQFrC5xWJUABQhjntRpvLoOnfyR6KhnkbjcFWh6d6oNA+Tit+XCdvKyZlq2vNGjSYB+TBET0Of5dToiYYY+BoHqqWFGQPWhehYHwEg=,iv:3C0o2ZVpy2xSVFxa7aHNSQA9RZXM/rpVTXo+DOm/IF0=,tag:l1j1mVd15q/I+DSdrfjdcQ==,type:str] + SEERR_DB_NAME: ENC[AES256_GCM,data:dpi/Bno=,iv:W2q/1w3RlfU4xi4x8OMU1VDBiHxLaY+69aKTPltl9bE=,tag:4DLGDY8gJynzyyT336TDSg==,type:str] +sops: + age: + - recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc + enc: | + -----BEGIN AGE ENCRYPTED FILE----- + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSA4N0Z4dy9EQ3VyN0xxNzVj + SDVsZC9sTUdKQWdPYjBYSmNvWVlORXJ4cVFrClFBSTkzWE9sZU1TeW02bmJiT1d6 + bVRydUxHbW83SHF0U0NEOVNCU296VUEKLS0tIDhxQ3IyekNva1VsWGhHakp2d1Ux + bzBCbm5hRUZ5bnh4eGhhVHB3MStkSXMKJwYKLl7o6rX+zf8X1MJwHjdusE942su4 + QLduOA3pdm11nV2D/ssbx2OIi4inLdRvoR2kmx1WE5e2j4JdlcOokw== + -----END AGE ENCRYPTED FILE----- + lastmodified: "2026-03-19T21:50:13Z" + mac: ENC[AES256_GCM,data:R3w8Vwrt9gMEvBvBxsBOtZ/4WRRtn82VYKrJY9s1bgq9ePrptp3IKTyOBj1U4k1qdb8zjCtOatGQmTPhY2R+QQMXfrNUiyM/PFPOx5NRkONAWlxzMZbr79Dz1Og2V0pnelTSL7O9KGpcNZi7pL6tjACaYhI7cIt0jRABLoY8+fA=,iv:EnKlJ+TbDwDQzjE1Vjcl7gW062bh9tpyShj7onoKypQ=,tag:bHKmBCDwkm3cP08SwFysqg==,type:str] + encrypted_regex: ^(data|stringData|email)$ + version: 3.12.1 diff --git a/kubernetes/app/media/service.yaml b/kubernetes/app/media/service.yaml index f91b086..ca0514f 100644 --- a/kubernetes/app/media/service.yaml +++ b/kubernetes/app/media/service.yaml @@ -122,3 +122,20 @@ spec: protocol: TCP selector: app: radarr-db +--- +apiVersion: v1 +kind: Service +metadata: + name: seerr-db + namespace: media + labels: + app: seerr-db +spec: + type: ClusterIP + ports: + - name: 5432-5432 + port: 5432 + targetPort: 5432 + protocol: TCP + selector: + app: seerr-db diff --git a/kubernetes/app/media/statefulset-seerr-db.yaml b/kubernetes/app/media/statefulset-seerr-db.yaml new file mode 100644 index 0000000..2a7fdc5 --- /dev/null +++ b/kubernetes/app/media/statefulset-seerr-db.yaml @@ -0,0 +1,70 @@ +apiVersion: apps/v1 +kind: StatefulSet +metadata: + name: seerr-db + namespace: media + labels: + app: seerr-db +spec: + replicas: 1 + serviceName: seerr-db + selector: + matchLabels: + app: seerr-db + template: + metadata: + labels: + app: seerr-db + spec: + securityContext: + runAsUser: 999 + runAsGroup: 999 + fsGroup: 999 + containers: + - name: postgres + image: postgres:14.21 + env: + - name: POSTGRES_DB + valueFrom: + secretKeyRef: + name: seerr-credentials + key: SEERR_DB_NAME + - name: POSTGRES_USER + valueFrom: + secretKeyRef: + name: seerr-credentials + key: SEERR_DB_USER + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: seerr-credentials + key: SEERR_DB_PASSWORD + - name: PGDATA + value: /var/lib/postgresql/data/pgdata + ports: + - containerPort: 5432 + name: postgres + protocol: TCP + livenessProbe: + tcpSocket: + port: 5432 + initialDelaySeconds: 30 + periodSeconds: 30 + failureThreshold: 5 + readinessProbe: + tcpSocket: + port: 5432 + initialDelaySeconds: 5 + periodSeconds: 10 + volumeMounts: + - name: data + mountPath: /var/lib/postgresql/data + volumeClaimTemplates: + - metadata: + name: data + spec: + accessModes: ["ReadWriteOnce"] + storageClassName: nfs-synology-ssd + resources: + requests: + storage: 5Gi diff --git a/kubernetes/config/cluster-vars.sops.yaml b/kubernetes/config/cluster-vars.sops.yaml index 7fb8ba3..40f5ffd 100644 --- a/kubernetes/config/cluster-vars.sops.yaml +++ b/kubernetes/config/cluster-vars.sops.yaml @@ -4,47 +4,48 @@ metadata: name: cluster-vars namespace: flux-system stringData: - LUBELOGGER_HOST: ENC[AES256_GCM,data:QuBDk9WJ7LTcdHb/bp88hikNcCtLO92eqNk=,iv:pqqc9NsnnTzhhQ5t83stJByNTROavNnmKSPthjBXexE=,tag:8lHy65UkfmSa7xmddyqYxw==,type:str] - LUBELOGGER_DATA_NFS_PATH: ENC[AES256_GCM,data:+WDbvq7eH39G93J/+x6K8c6wokU7qoyp7LH7h/RXdtbhKnla,iv:Hya9YrPOKEm/aJS0kxSWoJS9r+HTFQJUlyZs+HZJpzA=,tag:0e3JGlhbP4TPyOlXBTz+tA==,type:str] - AUTHELIA_DOMAIN: ENC[AES256_GCM,data:caSiQvcSS1LewjHfgCYs,iv:FPQKCaOR4uHUHhLfREHe6On1eei52G22IzpmM1NgEsI=,tag:ykET9qINerjhNeS7bnJe/A==,type:str] - QBITTORRENT_HOST: ENC[AES256_GCM,data:qN8gP/np3cjQoFVvIJdvo+1ebl1SskhO5DBK,iv:hY7i616K8palrLggUTzlL6BpSSZEBWh4WsGN1TRUpzA=,tag:iYsAKc1SBfcYqWEMMZm1gA==,type:str] - SONARR_HOST: ENC[AES256_GCM,data:YxisUk/Uy/Lf7cowWCqZsn8KJ/UpKw==,iv:UstF8GaxjmQm2Q5Rp1U9U0QI2Df7SN1DSPs7JOXRVBI=,tag:1jE3fWvbkr/L5PvYI0SxBg==,type:str] - RADARR_HOST: ENC[AES256_GCM,data:dUL+yqEePzXTbTlz4F6YLVkDsQIEig==,iv:VzCh2ogRGNIJC40CTi2dOhZdi9WxxWgzN+e8IDdPAEo=,tag:bJLtWZJlTxeN6m7zVAmtLA==,type:str] - MEDIA_NFS_PATH: ENC[AES256_GCM,data:drjxaZ7uaFiovkY7Mo0=,iv:rfqIjqMumFI7oePn+lA8CfG4vAhfxL32Uv2ZttTH038=,tag:LIver6FC7he5d5Bsi4PfXA==,type:str] - IMMICH_HOST: ENC[AES256_GCM,data:1LGD3YrmOO3/sIhR0149Q/suEHrLWA==,iv:mCz716bly6VtfKZBK+jLCr3oURAiqoXeECnsCw9mnPk=,tag:esKqHiz1pd9eUIk3jQYm7Q==,type:str] - IMMICH_UPLOAD_NFS_PATH: ENC[AES256_GCM,data:AvHp67fslvEzhk3IdxwN,iv:TQbwhfCma2+zeH+HMWGCI8GiX1uFCM4bc0XBr7K0ids=,tag:dXZFHpXFcZ04EvFkN2iIXg==,type:str] - JELLYFIN_HOST: ENC[AES256_GCM,data:VwDP7lAl4De7261TkxjhwrGDhjbPWnsw,iv:iiGkrhmrCaP0uJGIS86lHHpTvK9/LEbPDmUynbvb5Zc=,tag:dsaHhji6yqhoI+MHWbbSww==,type:str] - JELLYFIN_INTERNAL_HOST: ENC[AES256_GCM,data:GIPmFvSbmIPS2FRhBvjsmpljh+N+,iv:PZyyKY1HfxDGwDGBCVbRBgrR1t7viB7pOiv8C/XUGB4=,tag:LyPdXi47GgehLyT5AmieAQ==,type:str] - ARCHMIRROR_HOST: ENC[AES256_GCM,data:NearvWUsTMh6siTUOlBGZNn103eimkU=,iv:96e/phG8pIIsNZSrRQvh1FacbuUlWQ7kgsT8BEvCdo4=,tag:9WZQWF+gwzzMYSr/a9pssg==,type:str] - ARCHMIRROR_NFS_PATH: ENC[AES256_GCM,data:nrvDtUp/GPrwPESIG6JSiwNQ2A==,iv:8qouFgmfzrwl6FisfZM0S8Jn8640vJqQloR5IQ7GXA0=,tag:xBecYxsHS8hMs5MY7V7KKQ==,type:str] - ARCHMIRROR_MIRROR_URL: ENC[AES256_GCM,data:3Oi1H75txcHQIY/hhRD7gM/B3O9qTDLtBqVtI6oLbp6tQ6Yv+JIgaOccbD7L,iv:orVYaNKGbHVx5y57jrQIgJZOJFAfrnOwDdNSjNSNHjg=,tag:QeJTLHLFSZI/f1BfvZbPiw==,type:str] - PODSYNC_HOST: ENC[AES256_GCM,data:tA5u8V+eu1IwxJHsLYb8KxgL2MECKBU=,iv:TTyZNPXVyfL61kY6fylrGzFVL9EfmiGsvInUuowarII=,tag:FQJSmNQ2zKFrxc4/eORZag==,type:str] - PODSYNC_NFS_PATH: ENC[AES256_GCM,data:mKlv16ySwzdT9YENiok9i/xwBeBQ,iv:c6uSkGazodRjhH9WdRYHgI6YfolDrCpAlkKA2oVNj3k=,tag:ForwAcRFxP2UqViwufQcfQ==,type:str] - PIHOLE_HOST: ENC[AES256_GCM,data:mG/8qHvZ4J7Dsgji/RPLOsjPNx6mow==,iv:CQpWtnZ5XWlQ169RpfE/kaCxJ6eB5NgfL1CgBRHU8ow=,tag:gIwe34Hv4felrvn00nqQKg==,type:str] - PAPERLESS_HOST: ENC[AES256_GCM,data:NeaFxM3W1r15ZStzm9J2XCpFS3Ah4JhQ/Q==,iv:cqN1pjY99b8O++vCgjawfZxzPWG273bOjahWJEmqCP8=,tag:938T5rWu5jhuLyJuAPG/lA==,type:str] - PAPERLESS_MEDIA_NFS_PATH: ENC[AES256_GCM,data:CYa9GzWOKfAjarJHXtvENsNC,iv:cTha+yGPGP4B1mj57dypaNiOvJnXAVhm9er9CQWaTGo=,tag:49OytTJW2+e/+jgrB+J4Kw==,type:str] - PAPERLESS_CONSUME_NFS_PATH: ENC[AES256_GCM,data:VhWw5YmwjtwiEoCr5EzCBWWrN2uKgm4=,iv:W6fGL45hRRcU1rHiUU0IgbXEM1TGSSePeMrVCEWgG88=,tag:ELcOHsMItD6/9DqSpz6N+A==,type:str] - PAPERLESS_DATA_NFS_PATH: ENC[AES256_GCM,data:A6sZGcSFPmnPelq8bDL7mtfdDC9UM+7SSTbgKlZdxaa1gdQ=,iv:a737cuKoiUzO3YY6npDdf8ZEnO/9kYNqsx4mvv+scPA=,tag:Lia6JthxOZUxrvq9d1nvXw==,type:str] - HOMEPAGE_HOST: ENC[AES256_GCM,data:4XI+Sq5sznKiNxA5YCd6UE40JH4=,iv:eUAW0IqfBYf+bAZQ7KBRWsyrIECIt+yUcWWIKfmxOAg=,tag:Pxsx3y9fyv/AA98ISl0fzw==,type:str] - GROCY_HOST: ENC[AES256_GCM,data:w6D1mfF+OLfvIqVYSQEwp78HYMGI,iv:h5S6aGLzIb19BvnXx4UZ5I10ieZRKYB74Ndrzr6CBNc=,tag:YDy3zjoWO/83B6OR60DBUg==,type:str] - GROCY_NFS_PATH: ENC[AES256_GCM,data:A+cXeJJ4VYkSn1utXVFzk391bX3vpjedPZwnkuWvthpf,iv:+d9W861HZwwRWKZoxmGCxTPp3njjFC+jHDUTi+ummp8=,tag:U1zj0OJWFRtnMhWi4lJr7Q==,type:str] - CRYPTPAD_HOST: ENC[AES256_GCM,data:sbmFVAfakR6YsrjRxwNqDdK+dlW+B7EE,iv:vPXVGpCWaPUKJl6XsiVeFWhsFvl/fHamZrAegL3eddw=,tag:KcsSM6iZaja6OG6NtIPoBg==,type:str] - CRYPTPAD_SANDBOX_HOST: ENC[AES256_GCM,data:k0xDNM8Va173zT2z/tx03Qol/kp/Q8qTtDi/4MpNzC8=,iv:HVtPhrD6SAdk8tHb7DbLQ9XjsxIjSguFVukEmc21I0U=,tag:nHhy9qYMCUZThHmaBWKn6A==,type:str] - CRYPTPAD_DATA_NFS_PATH: ENC[AES256_GCM,data:XMxe5eTMz6i6IeoVvluq7VsitGlJr6nOtycLz1+ZKmusKg==,iv:UKVF/r+Xn4voxKoPgC4KIFrPXMStfA7AlQ8laYG3umw=,tag:Y6aBzCnpsfFYB98UeKOCcA==,type:str] - CRYPTPAD_CONFIG_NFS_PATH: ENC[AES256_GCM,data:TPnD5ASCOPa88yC/cIMEJGe7ANe1AQ2P8gWCNeflyTjFzdEC,iv:pUpCwXOH8phWRtXbZKieHtWRp+/SZfRltPUWe+9yM7Y=,tag:X0vgZ+zfKsb5a8lYzrEe5Q==,type:str] - BACKUP_LOCAL_HOST: ENC[AES256_GCM,data:Q6h+PiTmuoYNUgP1IhhGOGhSfmqay+y0Tp8=,iv:a+/TByPEf0XVQ9CVo+xMoEzVusayFFb2PlRohDBe4Qw=,tag:VYHLADu4lOL4S8390zi6KA==,type:str] + LUBELOGGER_HOST: ENC[AES256_GCM,data:+3I6i0EwNLX25J4FS8/pM7e89VkqEqGfgSg=,iv:7nulInaRiLgjGrQVrnP4ehc623OJPAEdY6vUjWUKSiM=,tag:Nr/5u1Hf6ErEK1oSZKfByQ==,type:str] + LUBELOGGER_DATA_NFS_PATH: ENC[AES256_GCM,data:ZLtvozf6AmHz9KaYm9k9dxJW+iMNm0Xdo7J44gntTG6JzSTt,iv:Br2a/5umPBEctI3TcJMXreJC93VskZ4oYCn/fhWWpNw=,tag:Cnusm51DmYCsTG9z40Un7Q==,type:str] + AUTHELIA_DOMAIN: ENC[AES256_GCM,data:kn5kVmjE8HXBkpbzQoqZ,iv:SMI58vnoeZeat+0UaBli/G+ZMAr2DgLq1YbkuRUWg40=,tag:gAzftLXO+L4IkxmbFBi+bQ==,type:str] + QBITTORRENT_HOST: ENC[AES256_GCM,data:k8gDDNaMnivL0wxJiwDJTJFXW7UzAt27/C7S,iv:JHYa92xhN7O7NGRM9Ubp3/xArxUBzxH9UvyrhTkB4gE=,tag:RAEbSAbZ5eEYN/mz0vaa8w==,type:str] + SONARR_HOST: ENC[AES256_GCM,data:WW2oG5Ge8Tfm0GfrbzEQwsfJ6CNyFA==,iv:qKQwoqjJIgj15ohSjFizFBD1Xaz/sgmJNwN0qx4oano=,tag:lHjZC3WUSzvw/dQAvp5XOg==,type:str] + RADARR_HOST: ENC[AES256_GCM,data:+hfEpkeFPsumvzJ3htbVVGpdqf0TVg==,iv:HXlnjNAKSPen/YKG0u63lg3i8oNxX4r5SYLoXBYebMg=,tag:XWp7gQAk6o03sAV7ZfwGHg==,type:str] + MEDIA_NFS_PATH: ENC[AES256_GCM,data:/22ZF2bS4OJkET5fap8=,iv:rp6e2hcHJmofmBNWLX46+tO0Z/CO7658+Rrkj+C3FaE=,tag:+YtwLSJ8nS0yuMvQiLD6wg==,type:str] + IMMICH_HOST: ENC[AES256_GCM,data:FUhW5dlQp0dAgs02PP2pglI4IWdRSQ==,iv:ngItoX4Yg0ORRO0JnMC3kyp3m6ALTozWPpmJkQ3mMb0=,tag:X9lMROC6EcrZxyMkIfgJAw==,type:str] + IMMICH_UPLOAD_NFS_PATH: ENC[AES256_GCM,data:AWu7nZm1u1tZ7OG/Y+C7,iv:89dUgBTL+Pw6n03yXJRtzPSiC0R/ma7fM8dWmFSRW8E=,tag:pETM1zw+TpnuFN14Wr2u8A==,type:str] + JELLYFIN_HOST: ENC[AES256_GCM,data:LCuz8fQ2Gehxsu8wKqTLoGWCWRlb3M6Z,iv:EEDM9iyhKW6LETARtFpKwCmNNZZdlDyCG2RimK3ybTE=,tag:moFp/deJaz/Kkj5nDKacWQ==,type:str] + JELLYFIN_INTERNAL_HOST: ENC[AES256_GCM,data:gwVKPi5Lim30G090/LVSE2+/M+UI,iv://2yET87s4AwS6dom3DcITqBUzJq5n7aM7963Eyt+y0=,tag:dz6sohtYmtBBrxfAMrN3MQ==,type:str] + ARCHMIRROR_HOST: ENC[AES256_GCM,data:KATP5naJIkO0nsa+YYXylMgL0ulvorc=,iv:nYP+RuMLDS7DKZCuxjD9cwliX6zfdepSY8q9cL6swH8=,tag:WBqdwRZSolhg+/Ps7oAP9w==,type:str] + ARCHMIRROR_NFS_PATH: ENC[AES256_GCM,data:bO+lUrn4b43FuNTOU90D1joLYw==,iv:e7CnoSTNsXBAFxQS4OBlxIzy75xyJUWJPPtT/26bF7M=,tag:aszIRhRhTGW0D1nxP8ZZGg==,type:str] + ARCHMIRROR_MIRROR_URL: ENC[AES256_GCM,data:k32tYfVA8a9AExM9yBjYrJ/zCS5pBilTFrGht+JHVjtobFzvJVN3F7m8Xglj,iv:qmsw343T+RBxn3Rit2bGlzwPwr/ZgulSyqPsnDXA1R0=,tag:Kw4Cb0KySulbaKx+jW+b1Q==,type:str] + PODSYNC_HOST: ENC[AES256_GCM,data:zUJ2xOF20hHsQo7AecMKksvoabNY3a0=,iv:1pmlxIiOMAOM2KDRSPgmhA2ootmgA/qLbkSeqbeo/VA=,tag:qB17GbSIj6VpgDHRZsaCqw==,type:str] + PODSYNC_NFS_PATH: ENC[AES256_GCM,data:/FcEFuZAUIWDlGKIhzz9xi4jErij,iv:SnWKb11HEjQ2L3Db3qXcDKGCd1bkCk2CRk+VQLfZPmU=,tag:BpOVZ7AflfosRczacZQZIQ==,type:str] + PIHOLE_HOST: ENC[AES256_GCM,data:DK1iW98H2g17q//ZQ7NyrdtspEhfuw==,iv:UDyv3c7vO42IokhPdFE5UBSyRUIv5xj/pZfYp0LITsk=,tag:fBxkFMIZ8wkkdM+leN9oXQ==,type:str] + PAPERLESS_HOST: ENC[AES256_GCM,data:hH1J5Bi2fGlQPgf0K146t4e1dwtzF4C3oA==,iv:3clCIYZtc90N85LLxjNge84fauSDiidomBk2gZaKiYY=,tag:17WIS7fXpwc1hEH+30P6MQ==,type:str] + PAPERLESS_MEDIA_NFS_PATH: ENC[AES256_GCM,data:RuQTjTGgQ1GD/PSDkfXzysPC,iv:GVXIv9zi43PG8uq2GTBOJka5Y0LsqnztqXAidTPWHw0=,tag:sq4oZVzHFdOs2FUdsDhcLg==,type:str] + PAPERLESS_CONSUME_NFS_PATH: ENC[AES256_GCM,data:pUres8hqvlE8InL/hM+RCMlGVulsIGc=,iv:WWtAlN9W9z19+btNMrFJq6DuU+gJ5ff4KIMKjp1Yg5Q=,tag:6tOtmyELDEXAkFcO8P+QcA==,type:str] + PAPERLESS_DATA_NFS_PATH: ENC[AES256_GCM,data:bjTpsnmlDwLLAHi4QeEFd2jabphhBperp8Aqwccmo/jX7gI=,iv:le84tRqtPvjyt/YCPZ4DIqNTOIQ1UI7NzKg/F405suY=,tag:qKBMVRQ6/jLWJvg5QmrmfA==,type:str] + HOMEPAGE_HOST: ENC[AES256_GCM,data:lctHEKeFiwq47QYApI2/6YetrDQ=,iv:uPmTrf0ftl0T9jyOCHBGzb4cgn3qtKyPunFBZGMTkpY=,tag:O5PWGpULOjXv+xJHbIeepA==,type:str] + GROCY_HOST: ENC[AES256_GCM,data:BE5AFwuZwG0TmzD3AeOcc1cT5CXf,iv:RIvwnpiLq0ICfbtlcMNAcbvSaQlm15ic8GYjCbm2Dg0=,tag:XUfN8hz6yrLZnkmo8ZLF0Q==,type:str] + GROCY_NFS_PATH: ENC[AES256_GCM,data:qXHalcb1biQLv0mIgC/Tl14vwYFQddq6vpxJF+q0RgTk,iv:dHO7icOCGKOyVJYpMCSOwaL1UNBaaSahXCqucBYc3jI=,tag:95jW9bSUbIAFLTBo5y6jnQ==,type:str] + CRYPTPAD_HOST: ENC[AES256_GCM,data:eIBnKk95IniY86Nu0VcwOInYLIb31wTG,iv:t4Mok6eHmVJXCR3mezjKOtLNUd0pHYAPFC+Hs+1wYLs=,tag:AbriiF/vCZgo1djxYBw+lQ==,type:str] + CRYPTPAD_SANDBOX_HOST: ENC[AES256_GCM,data:60pg2HsZmMlC+uVgxyJzWqPKHWv1mebSJArH9J4G0kg=,iv:eprm7ESoYlt2oVt/Em3MGHA+hAMSdW+zfoCIZMyL4tg=,tag:5pJ4I953A++7dIFW5B7dMg==,type:str] + CRYPTPAD_DATA_NFS_PATH: ENC[AES256_GCM,data:dNOxsmge//CgcBO0GIQUdcIBfaiGI1IVxXJ8IjmQl+Wh3A==,iv:hfuLuSWuSnbiItweWBSKxpxZJFgAWgUJCZNLcLZQVgw=,tag:7o353kHezQVRqb5BtC7rYw==,type:str] + CRYPTPAD_CONFIG_NFS_PATH: ENC[AES256_GCM,data:VJ4h7ADenNgFIiNIFK7pJKMrUBYc4e9c4MdVzqGoR4TDWGYL,iv:8ZhMHiZLh2C4J/vh/8L96R6VIkKoWc7ib/bUAQ5rZE0=,tag:HgvJjjYybCgxatUbcRFY7Q==,type:str] + SEERR_HOST: ENC[AES256_GCM,data:l64ttp+rLNU8GfwIE4fhJROSMDEb,iv:1vHOw0LyGN9OMhYemhtRq9GE2fc4J2EprZU3bp/h4kk=,tag:WNV0Jh7816ra7IIOBMspBg==,type:str] + BACKUP_LOCAL_HOST: ENC[AES256_GCM,data:ABaTI3NKkhF7K2FpPwvvrHA0l/tCxAi4Qek=,iv:34ixxSpKU1c12uoMdk4nz2Vo/+5A/npB7NWMsWFytIM=,tag:qjw2fQBebCKnqCnAPiBHaw==,type:str] sops: age: - recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc enc: | -----BEGIN AGE ENCRYPTED FILE----- - YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsUjRiRlhtRjlnT0hQb0Fw - Q3dkZlUvY0d2YnE2d3ZUa1krSGhmblFwaHpBCnVEZHVUNm9ncU5aQ1R6U0x6OHBR - QVhVa0JSU3ZpQUJNOGRPUC9lRFA0dWsKLS0tIE1idWlGeTRSd3dNWk83SEI2Q3E2 - Ky8wRHhmMWE0dE5PNjJsSWxDU251bmMKXV0Vszr6BhiPekFiE48+Kw2FKOGyPr6B - /x2AbGBwgLHuAp+ge9kAZd6xMTum+KOa2Zt6Ms892/lPqhp7at2e7A== + YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXekorS3lvckhHelE0NGVP + Z0JSSmtTRk1yZEoxTVU4MnhaN2VjajU2cmhnCkEyWU0yandxUnZGZm5yWXJmQlM4 + SjRKSmpDOEZ2MnpybjFOTHJ6dUxhWk0KLS0tIGw1eGFMVmZPVjZoMklHQUhxMjVq + MGJ6TFpwR0diNjlEN2syZkhNMFNwRDQK9pzmQGB0GQu6ogMIJW+kugvBNj3w+dxW + bfEF9GAznIM/N5rPytF4wNgqwfoAF7GwumgA+iD43wprKtUJn+6dqw== -----END AGE ENCRYPTED FILE----- - lastmodified: "2026-03-13T12:17:18Z" - mac: ENC[AES256_GCM,data:Q0QTTK476NLfk0zToVjVbXr8qiIE+PDRdsnCQRQJWqcJrbr8Gn8NghDVq8D4++FYamrudATTTxhbypaPh4Hm6PCeZaGgtnknPo+kwjIyhh6HMnqU3tyq4obBhC1W65HBQ6V57NyNnYrNIPMpG5afrZpsKMPeQuTxlnohcn9UHnE=,iv:43LluR5Lje9445jSlHC/ubIeNWpH6WmqP3pXerUxPxw=,tag:XuNHBpx4FY5YLgzAYVUZhQ==,type:str] + lastmodified: "2026-03-19T21:49:14Z" + mac: ENC[AES256_GCM,data:FG6XQHJ/k8Hm2d+kxMAdT/e03lZE8Xzk4hyNTaiKloffcwUONvzlWsb9oieDZEQQw5v23SgL9mVCIzcz2toNz5UnO2TE4VRZTppTT6PZ+/uU1qzxNYOySInRH0P2zwX3lS8JCD10klF9vWQ/6565/rwiZhECK4ofrJ3blrBaQ+k=,iv:TRr6TkJ0tNRHEZt6OMjo+SH/3FNIiXcPqwZW2n4pmvs=,tag:j5U+b90VJpk85CWoefKCEw==,type:str] encrypted_regex: ^(data|stringData|email)$ version: 3.12.1