chore(k8s/gitea): update gitea/gitea:1.26.1-rootless docker digest to 4c42564

README.md

@@ -26,7 +26,10 @@ homelab-v2/
     │   └── configs/        # ClusterIssuer, MetalLB config
     ├── app/
     │   ├── archmirror/
+    │   ├── blog/
     │   ├── external/       # External service vars (e.g. Home Assistant)
+    │   ├── firefly/
+    │   ├── gitea/
     │   ├── grocy/
     │   ├── homepage/
     │   ├── immich/
@@ -44,6 +47,8 @@ homelab-v2/
 
 | Service | Description |
 |---------|-------------|
+| **Gitea** | Self-hosted Git service |
+| **Firefly III** | Personal finance manager |
 | **Immich** | Photo and video management with face recognition |
 | **Jellyfin** | Media streaming with Intel GPU hardware transcoding |
 | **Media Stack** | Sonarr, Radarr, Prowlarr, qBittorrent — automated media acquisition |
@@ -54,6 +59,7 @@ homelab-v2/
 | **Homepage** | Dashboard aggregator |
 | **Podsync** | Podcast downloader |
 | **Archmirror** | Local Arch Linux package repository mirror |
+| **Blog** | Personal static blog served via git-sync + nginx (gh-pages branch) |
 
 ## Infrastructure Stack
 

kubernetes/app/archmirror/configmap-sync.yaml

@@ -22,13 +22,26 @@ data:
     fi
 
     mkdir -p "$TARGET_DIR"
+
+    do_rsync() {
+        rsync --timeout=600 \
+              -rltH --no-perms --chmod=D755,F664 --safe-links --delete-delay --delay-updates \
+              -v --info=progress2 \
+              "$@"
+    }
+
     for i in $(seq 1 $MAX_RETRIES); do
         log "Sync attempt $i/$MAX_RETRIES from $MIRROR_URL"
 
-        if rsync --timeout=600 \
-                 -rlptH --safe-links --delete-delay --delay-updates \
-                 -v --info=progress2 \
-                 "$MIRROR_URL/" "$TARGET_DIR/"; then
+        # Pass 1: sync packages, skip db/files indices so they are never updated
+        # before their referenced package files arrive (avoids 404s).
+        # Pass 2: sync everything including indices now that packages are present.
+        if do_rsync \
+                --exclude='*.db' --exclude='*.db.*' \
+                --exclude='*.files' --exclude='*.files.*' \
+                "$MIRROR_URL/" "$TARGET_DIR/" \
+            && do_rsync \
+                "$MIRROR_URL/" "$TARGET_DIR/"; then
             log "Sync completed successfully"
             exit 0
         fi

kubernetes/app/blog/configmap-nginx.yaml

@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: blog-nginx-config
+  namespace: blog
+data:
+  default.conf: |
+    server {
+        listen 8080;
+        server_name _;
+        root /git/current;
+        index index.html;
+
+        location /health {
+            access_log off;
+            return 200 "OK";
+            add_header Content-Type text/plain;
+        }
+
+        location ~ /\.git {
+            deny all;
+            return 404;
+        }
+
+        location / {
+            try_files $uri $uri/ =404;
+        }
+    }

kubernetes/app/blog/deployment.yaml

@@ -0,0 +1,149 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: blog
+  namespace: blog
+  labels:
+    app: blog
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: blog
+  template:
+    metadata:
+      labels:
+        app: blog
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        seccompProfile:
+          type: RuntimeDefault
+        # git-sync (uid 65533) writes files; fsGroup makes the emptyDir group-writable by that uid
+        fsGroup: 65533
+      initContainers:
+        - name: git-sync-init
+          image: registry.k8s.io/git-sync/git-sync:v4.5.1
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: GITSYNC_REPO
+              valueFrom:
+                secretKeyRef:
+                  name: blog-git-credentials
+                  key: GITSYNC_REPO
+            - name: GITSYNC_ROOT
+              value: "/git"
+            - name: GITSYNC_REF
+              value: "gh-pages"
+            - name: GITSYNC_LINK
+              value: "current"
+            - name: GITSYNC_DEPTH
+              value: "1"
+            - name: GITSYNC_ONE_TIME
+              value: "true"
+            - name: GITSYNC_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: blog-git-credentials
+                  key: GITSYNC_USERNAME
+            - name: GITSYNC_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: blog-git-credentials
+                  key: GITSYNC_PASSWORD
+          securityContext:
+            runAsUser: 65533
+            runAsGroup: 65533
+          volumeMounts:
+            - name: git-content
+              mountPath: /git
+          resources:
+            requests:
+              cpu: 10m
+              memory: 64Mi
+            limits:
+              memory: 128Mi
+      containers:
+        - name: nginx
+          image: nginxinc/nginx-unprivileged:1.30.0-alpine3.23
+          imagePullPolicy: IfNotPresent
+          ports:
+            - containerPort: 8080
+              name: http
+              protocol: TCP
+          securityContext:
+            runAsUser: 101
+            runAsGroup: 101
+          volumeMounts:
+            - name: git-content
+              mountPath: /git
+            - name: nginx-config
+              mountPath: /etc/nginx/conf.d/default.conf
+              subPath: default.conf
+          livenessProbe:
+            httpGet:
+              port: 8080
+              path: /health
+            initialDelaySeconds: 10
+            periodSeconds: 30
+          readinessProbe:
+            httpGet:
+              port: 8080
+              path: /health
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
+            limits:
+              memory: 64Mi
+        - name: git-sync
+          image: registry.k8s.io/git-sync/git-sync:v4.5.1
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: GITSYNC_REPO
+              valueFrom:
+                secretKeyRef:
+                  name: blog-git-credentials
+                  key: GITSYNC_REPO
+            - name: GITSYNC_ROOT
+              value: "/git"
+            - name: GITSYNC_REF
+              value: "gh-pages"
+            - name: GITSYNC_LINK
+              value: "current"
+            - name: GITSYNC_DEPTH
+              value: "1"
+            - name: GITSYNC_PERIOD
+              value: "30s"
+            - name: GITSYNC_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: blog-git-credentials
+                  key: GITSYNC_USERNAME
+            - name: GITSYNC_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: blog-git-credentials
+                  key: GITSYNC_PASSWORD
+          securityContext:
+            runAsUser: 65533
+            runAsGroup: 65533
+          volumeMounts:
+            - name: git-content
+              mountPath: /git
+          resources:
+            requests:
+              cpu: 5m
+              memory: 32Mi
+            limits:
+              memory: 64Mi
+      volumes:
+        - name: git-content
+          emptyDir: {}
+        - name: nginx-config
+          configMap:
+            name: blog-nginx-config

kubernetes/app/blog/ingress.yaml

@@ -0,0 +1,23 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: blog
+  namespace: blog
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt
+spec:
+  tls:
+    - hosts:
+        - ${BLOG_HOST}
+      secretName: blog-tls
+  rules:
+    - host: ${BLOG_HOST}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: blog
+                port:
+                  number: 8080

kubernetes/app/blog/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: blog

kubernetes/app/blog/networkpolicy.yaml

@@ -0,0 +1,26 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny-ingress
+  namespace: blog
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-ingress-controller
+  namespace: blog
+spec:
+  podSelector:
+    matchLabels:
+      app: blog
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik

kubernetes/app/blog/secret.sops.yaml

@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: blog-git-credentials
+    namespace: blog
+stringData:
+    GITSYNC_USERNAME: ENC[AES256_GCM,data:6cZnsgZ53xsU,iv:j2qvZr+odimHPnlMKz9xTe8q+zXvyRDF9spH8TkcmBw=,tag:ik6DJ4cMfcNc5UHY5vRy3A==,type:str]
+    GITSYNC_PASSWORD: ENC[AES256_GCM,data:mjQJuOuH2YQ1i1JVO+lFZ7WYLmy4RjCi2xZRErU5hRNi2SdgRo0fwg==,iv:9pl3nVmlnynJ4jMke1Hy4ACBuMyM+65vmGR2kS705I0=,tag:K1dQ9YwVN0sZjieAOU3KWw==,type:str]
+    GITSYNC_REPO: ENC[AES256_GCM,data:ETjdkCP/PSa6HSD9M6JdvWbci/lRwegzzyuPb/IQmX58sxwqT2gUjooVKtcylzsE,iv:kOpvSQYznyxfmLjrehdRuEtwevoceDo0h/vbXTuu/i8=,tag:x+DEmoZUxRN6OksDJ9mQIQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYR3FFRWdPajVzbjZGem1N
+            OXA2aVhtSWRxQUpGcDFxLzBFQWkyMlh5L2pvCkgvM25IVTBqSFZ3QmJDaGxqSTJ2
+            blQyOTQwaThRbkhzZ01uUmVoaXg5VHMKLS0tIHJJWlJoSmRXRi90M2VHSTlvdnBH
+            VjRWTHRSWUE0VFpqakwxUmx3aENqYUUK21JXxrt792sHoI2TCYU3aIQKKLL9f8oq
+            1o+qkueVYSYmVetrqcjSWqfGE496BYi+pd4a0mmRwaLpLCZIIgtlvA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
+    encrypted_regex: ^(data|stringData|email)$
+    lastmodified: "2026-05-11T19:25:53Z"
+    mac: ENC[AES256_GCM,data:jK/48Q7INbbcjZWASbS7ob1RrfDNm27jGnm1taL7hEMDC0k7n3igqlqSHmy7ZxCeUUe3Y+s7Jv9Ss1xITEPoUEYFphGrYeDUBVNtVfhBavTEaTPAuEv7WRA8xGpjXH0t9ernwwMyMQJRatazgX2jcc3rfzHMshs7cf5oeov15Zk=,iv:lg0ad1nDFDHBPv8Xvsn63V7SDPMo1p47gvSNFGJGw1I=,tag:fXatyOSOD/rCjEcpvDQpAw==,type:str]
+    version: 3.13.0

kubernetes/app/blog/service.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: blog
+  namespace: blog
+spec:
+  selector:
+    app: blog
+  ports:
+    - port: 8080
+      targetPort: 8080
+      name: http

kubernetes/app/firefly/cronjob-backup.yaml

@@ -0,0 +1,144 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: firefly-db-backup
+  namespace: firefly
+  labels:
+    app: firefly-backup
+spec:
+  schedule: "0 2 * * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      template:
+        metadata:
+          labels:
+            app: firefly-backup
+        spec:
+          restartPolicy: OnFailure
+          initContainers:
+            - name: pg-dump
+              image: postgres:17
+              imagePullPolicy: IfNotPresent
+              env:
+                - name: PGHOST
+                  value: firefly-db
+                - name: PGUSER
+                  valueFrom:
+                    secretKeyRef:
+                      name: firefly-credentials
+                      key: DB_USERNAME
+                - name: PGPASSWORD
+                  valueFrom:
+                    secretKeyRef:
+                      name: firefly-credentials
+                      key: DB_PASSWORD
+                - name: PGDATABASE
+                  valueFrom:
+                    secretKeyRef:
+                      name: firefly-credentials
+                      key: DB_DATABASE
+              command:
+                - sh
+                - -c
+                - pg_dump --clean --if-exists > /backup/dump.sql
+              volumeMounts:
+                - name: backup-tmp
+                  mountPath: /backup
+          containers:
+            - name: resticprofile
+              image: creativeprojects/resticprofile:0.32.0
+              imagePullPolicy: IfNotPresent
+              command:
+                - sh
+                - -c
+                - |
+                  resticprofile -c /secrets/profiles.yaml -n firefly-db backup
+                  resticprofile -c /secrets/profiles.yaml -n firefly-db copy
+              env:
+                - name: B2_ACCOUNT_ID
+                  valueFrom:
+                    secretKeyRef:
+                      name: firefly-backup-config
+                      key: B2_ACCOUNT_ID
+                - name: B2_ACCOUNT_KEY
+                  valueFrom:
+                    secretKeyRef:
+                      name: firefly-backup-config
+                      key: B2_ACCOUNT_KEY
+              volumeMounts:
+                - name: secrets
+                  mountPath: /secrets
+                  readOnly: true
+                - name: backup-tmp
+                  mountPath: /backup
+          volumes:
+            - name: secrets
+              secret:
+                secretName: firefly-backup-config
+            - name: backup-tmp
+              emptyDir: {}
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: firefly-uploads-backup
+  namespace: firefly
+  labels:
+    app: firefly-backup
+spec:
+  schedule: "0 3 * * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      template:
+        metadata:
+          labels:
+            app: firefly-backup
+        spec:
+          restartPolicy: OnFailure
+          containers:
+            - name: resticprofile
+              image: creativeprojects/resticprofile:0.32.0
+              imagePullPolicy: IfNotPresent
+              command:
+                - sh
+                - -c
+                - |
+                  resticprofile -c /secrets/profiles.yaml -n firefly-uploads backup
+                  resticprofile -c /secrets/profiles.yaml -n firefly-uploads copy
+              env:
+                - name: B2_ACCOUNT_ID
+                  valueFrom:
+                    secretKeyRef:
+                      name: firefly-backup-config
+                      key: B2_ACCOUNT_ID
+                - name: B2_ACCOUNT_KEY
+                  valueFrom:
+                    secretKeyRef:
+                      name: firefly-backup-config
+                      key: B2_ACCOUNT_KEY
+              volumeMounts:
+                - name: secrets
+                  mountPath: /secrets
+                  readOnly: true
+                - name: uploads
+                  mountPath: /uploads
+                  readOnly: true
+              resources:
+                requests:
+                  cpu: 100m
+                  memory: 256Mi
+                limits:
+                  memory: 1Gi
+          volumes:
+            - name: secrets
+              secret:
+                secretName: firefly-backup-config
+            - name: uploads
+              persistentVolumeClaim:
+                claimName: firefly-firefly-iii

kubernetes/app/firefly/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: firefly

kubernetes/app/firefly/networkpolicy.yaml

@@ -0,0 +1,95 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny-ingress
+  namespace: firefly
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-ingress-controller
+  namespace: firefly
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: firefly-iii
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-app-to-db
+  namespace: firefly
+spec:
+  podSelector:
+    matchLabels:
+      app: firefly-db
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: firefly-iii
+      ports:
+        - port: 5432
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-backup-to-db
+  namespace: firefly
+spec:
+  podSelector:
+    matchLabels:
+      app: firefly-db
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app: firefly-backup
+      ports:
+        - port: 5432
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-backup-egress
+  namespace: firefly
+spec:
+  podSelector:
+    matchLabels:
+      app: firefly-backup
+  policyTypes:
+    - Egress
+  egress:
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+    - ports:
+        - port: 8888
+          protocol: TCP
+    - ports:
+        - port: 443
+          protocol: TCP
+    - ports:
+        - port: 5432
+          protocol: TCP
+      to:
+        - podSelector:
+            matchLabels:
+              app: firefly-db

kubernetes/app/firefly/release.yaml

@@ -0,0 +1,79 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: firefly-iii
+  namespace: flux-system
+spec:
+  chart:
+    spec:
+      chart: firefly-iii
+      version: 1.9.13
+      reconcileStrategy: ChartVersion
+      sourceRef:
+        kind: HelmRepository
+        name: firefly-iii
+        namespace: flux-system
+  targetNamespace: firefly
+  interval: 1m0s
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  values:
+    deploymentStrategyType: Recreate
+
+    podSecurityContext:
+      seccompProfile:
+        type: RuntimeDefault
+
+    resources:
+      requests:
+        cpu: 50m
+        memory: 256Mi
+      limits:
+        memory: 512Mi
+
+    persistence:
+      enabled: true
+      storageClassName: nfs-synology-ssd
+      storage: 5Gi
+
+    config:
+      existingSecret: firefly-credentials
+      env:
+        DB_HOST: firefly-db
+        DB_CONNECTION: pgsql
+        DB_PORT: "5432"
+        DB_DATABASE: firefly
+        DB_USERNAME: firefly
+        TZ: Europe/Kyiv
+        TRUSTED_PROXIES: "10.244.0.0/24"
+        APP_URL: https://${FIREFLY_HOST}
+        AUTHENTICATION_GUARD: remote_user_guard
+        AUTHENTICATION_GUARD_HEADER: Remote-Email
+        AUTHENTICATION_GUARD_EMAIL: Remote-Email
+        MAIL_MAILER: smtp
+        MAIL_HOST: smtp.protonmail.ch
+        MAIL_PORT: "587"
+        MAIL_ENCRYPTION: tls
+
+    cronjob:
+      enabled: true
+      auth:
+        existingSecret: firefly-credentials
+        secretKey: STATIC_CRON_TOKEN
+      schedule: "0 3 * * *"
+
+    ingress:
+      enabled: true
+      annotations:
+        cert-manager.io/cluster-issuer: letsencrypt
+        traefik.ingress.kubernetes.io/router.middlewares: authelia-chain-authelia-authelia-auth@kubernetescrd
+      hosts:
+        - ${FIREFLY_HOST}
+      tls:
+        - secretName: firefly-tls
+          hosts:
+            - ${FIREFLY_HOST}

kubernetes/app/firefly/repository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: firefly-iii
+  namespace: flux-system
+spec:
+  interval: 1m0s
+  url: https://firefly-iii.github.io/kubernetes

kubernetes/app/firefly/secret-backup.sops.yaml

@@ -0,0 +1,26 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: firefly-backup-config
+    namespace: firefly
+stringData:
+    profiles.yaml: ENC[AES256_GCM,data:2IDoUurD5tw5uTUX/rWuhGZbaCcYcR/J2ClSdr61rq5w1jjZunnyqeY8Vrp2LSaiDhYd6nIHB0oeM8HVsvkzbLksXVzbS/4/098KEJtey3I7yxfvvlgu9ZKbw0wuLqeXjfEkl7cArTdjMKwA3/B5/Jmqw9Q0g5QUPP97MF12Hagg/kpKipXD/n5YoOtv7ZqfHnxrIIh6XXIpa98pJ58x+7ct7K7DeUUj1s/3WAI7idJ4kTexwOb/NVup9qpheuxqAZmF0z8YUC73W0qzQzgUAOJ4+O09xc15PFRq19a95W9SnSHn8Ao56S67s26d2Hbp4JCa8U6MxHDJ09IdHzpu/bmGAVL6LxDheegYOLZWJtNoAryyE6sQN2PJQxIwFngKaMvs6CHSrZWIbCfKzIhNrJPr/u/l5pDvCSMcvg2oX7Bkc2uJ4WY/yFXSHhaWIdJv0VSvcUH04li1inrZe9AYfnsajRVuzgXrnhonqy/2NXrH32leSVjEeU97+Ma1eOX/t3+SNBglL5kJxJIRJ/tSkPDe/9GpVr+2QNQUmRMuIpSsRNQgGODU/XCFrMyJ1Ikl+pKhHitOELfckJ3FuZPRJB6HEqfkE2fZLK5e2G0JRJ4FinYFo6HkXzk4IAzLDlN2E7kgyPyCqHJQt4C/X+OTwE6MErPEPgE5o9pwC8TGv+Q8AN6rRdYs7FPBR9jxqWxoSTCdz49sVf/kcgcWnicn8XmFEGdWTWk3MqKDe8YdN6fyqPha2lxpsz7FkZMcTV2ZrLvIR65lkmL9Vb1I7SwroYuTr+sj3jTAJLZXgRTXpKodc2zTQR9rQEKvA1C7YgchTJa4axDkMY37MDHZnHPW6MEmPlpPw8NMge6QfNYDTAWvrwThGWQ051RSm8KbYfm+qlMWqx+zCFRcypKwBUKVWuf7TYa0jnL9u4QrUvpLBAr6jErNRdRLgm79h80n/ucPEBLCHlzhPzHGW/evdWMDTCd0B5dYbP0zpPkGEmzfBfnH23ru48DotzPV/y0j+SNacgUXQPFkC5x50jOS2Fay+5qInOyA75aSiFD5EMZmf8gx1a3+rDtUt+6Qict8Umtb3ZzpTrWxvxbV5oxCXNwWShSLAFyfwoNE1sEq++xu+Jp0SzTuSg+Kxz+CmuCJ4bnbYkrhJxyKfw==,iv:WdIFJmhmZ8S+ma5l5SS7de2PrxZJgKK2njrPbLVQSuo=,tag:/mPn6QHatxQYwsZInrK30w==,type:str]
+    restic-password-nas: ENC[AES256_GCM,data:RIn57MOwyqVGR/GuVpIXi+p5jZ2UQm4VgioCgE1GXIk=,iv:DcF6cD+AVa0LoXY6+wACfQvoAtdndl0chmPcm463fEE=,tag:RK9FF1RMFsfHGmg+ZcBEVA==,type:str]
+    restic-password-b2: ENC[AES256_GCM,data:nIcy6uJY4fCjQH3aVggt3meckNAytAsw/ZNnGBBm7DM=,iv:zPf9YTDgT9dlq1nlyW6weMjZ0b3eVAuB15Lyx897xGU=,tag:+x0Sn3UQZEyhdMYrTK+Nqg==,type:str]
+    B2_ACCOUNT_ID: ENC[AES256_GCM,data:t4YqtZRIpLpP7QHGBTeZ8vCL2L+1BjbLug==,iv:TvsBorT7r5A1d1AjPbYZ2vnm0x7gCPe4qY2bXFoK66Y=,tag:zaRhrGV/4siiWiykPlF6Gw==,type:str]
+    B2_ACCOUNT_KEY: ENC[AES256_GCM,data:xZjFBj7oT2FcKHdwGBzyD1xR/bKtHGLEBsnAqblE+g==,iv:gtJfZvTZucbx6983OOk7WdD8KhJtrW6Wv0hnECYXQ8s=,tag:DCvHrL1Wv3NodzbH5aXylQ==,type:str]
+sops:
+    age:
+        - recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBRSVBheDRtOEd0T0RJeG5x
+            dnRtN2RTeEs1andrVk9XUTZtMklDdmx5aEhrCmlNR1puUHVGaFYrUHNHYU1hbnpz
+            Q2J2ditrY1FuTXg3MUsvWm05WFcrUVUKLS0tIHdqeGFvNnkvVkdPWUphSkhETUpi
+            R1RWWEpDVkdHamx3M1p5a2YwUkR2REEKp/sZFcCNeZnHCvpwcOu827HLg0wxLWJG
+            EXHzgm5lZgiA/pQgxOJCiaz9HoNn3ttVE8z3aCnShUqAoXzpnh1Rpw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-04-21T20:22:40Z"
+    mac: ENC[AES256_GCM,data:wlXAnMwySlqHadgeAtgC+QCceqSw+mODWzKrqOTb4JSqvK1aEbPDUJWn8ow+0ff5OcU/3XVBr6b9GVzD6DsPXhg/aLsM/d5h6BRFb/qmrusD5YRyScu/gokwiD52I3qDf7rHeLNsYmoO4I6KuwEQRXasJ6H+QIOTNUxbcd+TTnM=,iv:8dNbZg7oJODgdR7mT3XgKL7sXooNYAvr8GM2l0DK6ao=,tag:M2JPh6qkisTG+A+2DCgABA==,type:str]
+    encrypted_regex: ^(data|stringData|email)$
+    version: 3.12.2

kubernetes/app/firefly/secret.sops.yaml

@@ -0,0 +1,30 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: firefly-credentials
+    namespace: firefly
+stringData:
+    APP_KEY: ENC[AES256_GCM,data:OugBKeVQqUDf8rFrGxMYgNROPesgVLsoKuQmWVvW9Kg=,iv:hnASzIOuoLczCUf0Luq2d6YXz5sKoHHawSys29cCMaE=,tag:u3SeTEc0VIb/NOwnXTn9Vg==,type:str]
+    STATIC_CRON_TOKEN: ENC[AES256_GCM,data:YL+ghixRjb1t6K1Q09clyxlYeYSj3rsy82n78efFVAw=,iv:V2q7uKOpl3e/FROZFvH7YCXBSUnQm7QcwqFyZaBbx2I=,tag:dZ1XPxEOGgAvfyL426rDTw==,type:str]
+    DB_USERNAME: ENC[AES256_GCM,data:Vk4jFf4Znw==,iv:LpP9DqkC1IlAwFNak8MTLPLf75iEpDwEm9ReLZPxRJo=,tag:qMexrfvQONJjfG11xh07wA==,type:str]
+    DB_PASSWORD: ENC[AES256_GCM,data:SsGb3qXMiq7EqGyfU2E6xqku1HbmWM8C,iv:+3V3Fh76gim9wcrhYd6CX7smyz0Kc8Qywx5j0wrmVaw=,tag:UawliAt7zOD0rpxNe3KcPw==,type:str]
+    DB_DATABASE: ENC[AES256_GCM,data:tLd4MWLoqQ==,iv:sG65BMBOAaKqYgCZ/xpv7LYaDNAPX+9KAeOBvYfUbgw=,tag:tRKptDmGV3iwV6luVFv/wQ==,type:str]
+    MAIL_USERNAME: ENC[AES256_GCM,data:npTpeFJuH7rOmPN7+0tuAgSdK+OxIjHIOHFVhFGcwA==,iv:ugGlT9MfWedvLFb/iQTxSIB5pPQsKGS5utalEP0pyUs=,tag:iv1i73xuCs0svFIgysb9dA==,type:str]
+    SITE_OWNER: ENC[AES256_GCM,data:WhpJSSWjniUumYjtRLHbOc51tcZ84JBtWw==,iv:nfy/1lXXlQYQW49LQevRevbVee1DODvqFKLPm3nRmU0=,tag:3nMwbS06dxD8oTvURw3OWA==,type:str]
+    MAIL_FROM: ENC[AES256_GCM,data:JcZt/4D8pa6St+3Z5oX61Ez7I0PscCIDSJhVnDUyfQ==,iv:r8rSDEXjdWzpivA3QQQRiQScdv6rNK5VzAnlwl+13jQ=,tag:N55MPwZ6KGO9L18DTOJ/CA==,type:str]
+    MAIL_PASSWORD: ENC[AES256_GCM,data:YrqECSPI6I7aYdx+oUmgGA==,iv:rvggM+Chw0JIOqfifzH5Q5yw4JhAv5BZgJfKevfWm2c=,tag:c9Wmxy8iivL4DKwEQj8VPg==,type:str]
+sops:
+    age:
+        - recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBWdDRxUU1walNTNWY1VlVj
+            MVB3OFo2Nm03b3haTjFtV09TaWtuYnJXNEN3CmFFOUM4czgxWGFubUJrNDRpOTBq
+            eHB0ckJNZnltMC84S2NyQVRmUWNNMjQKLS0tIERUL0hwSzVmYlRHSVJwVnE0bkVt
+            Zm1kOVhMU0JOa1U1MzN2M2FhdlVYUG8KhOhnu/8FxuEJdW5O0HeYVCu5eLgeyqaN
+            Q88TjwbcwcIruXo/e0ATxWRp+yzwGB0nspQHZzAMP16uN6r3gZo3Zw==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-04-22T21:18:05Z"
+    mac: ENC[AES256_GCM,data:JszWTjBGpBSuldSp+k/ZhO9P6+v+6WhTddv56WSHkkh1JT0JnomgKYReMj5bDxYeA6hJPLgFmD0N4gjporu3n8oCvADJgpXnVTEmYPnIJJqhEn3z8pGCKjeuxEvJk1MV7XvLEhZZJuvvb04uquyxvl1M8h9BJSCuPk7wxcM5pLA=,iv:MlF48Pqoi4239h3NAFj0VMO6YXJSt88GqCT+cA0qqXY=,tag:/mgkPgXMX3iyTomvKikO8A==,type:str]
+    encrypted_regex: ^(data|stringData|email)$
+    version: 3.12.2

kubernetes/app/firefly/service-db.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: firefly-db
+  namespace: firefly
+spec:
+  clusterIP: None
+  selector:
+    app: firefly-db
+  ports:
+    - port: 5432
+      targetPort: 5432

kubernetes/app/firefly/statefulset-db.yaml

@@ -0,0 +1,80 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: firefly-db
+  namespace: firefly
+  labels:
+    app: firefly-db
+spec:
+  serviceName: firefly-db
+  replicas: 1
+  selector:
+    matchLabels:
+      app: firefly-db
+  template:
+    metadata:
+      labels:
+        app: firefly-db
+    spec:
+      securityContext:
+        runAsUser: 999
+        runAsGroup: 999
+        fsGroup: 999
+      containers:
+        - name: postgres
+          image: postgres:17
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: firefly-credentials
+                  key: DB_USERNAME
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: firefly-credentials
+                  key: DB_PASSWORD
+            - name: POSTGRES_DB
+              valueFrom:
+                secretKeyRef:
+                  name: firefly-credentials
+                  key: DB_DATABASE
+            - name: PGDATA
+              value: /var/lib/postgresql/data/pgdata
+          ports:
+            - containerPort: 5432
+          startupProbe:
+            tcpSocket:
+              port: 5432
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            failureThreshold: 30
+          livenessProbe:
+            tcpSocket:
+              port: 5432
+            periodSeconds: 30
+            failureThreshold: 5
+          readinessProbe:
+            tcpSocket:
+              port: 5432
+            periodSeconds: 10
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 50m
+              memory: 256Mi
+            limits:
+              memory: 1Gi
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/postgresql/data
+  volumeClaimTemplates:
+    - metadata:
+        name: data
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        storageClassName: nfs-synology-ssd
+        resources:
+          requests:
+            storage: 5Gi

kubernetes/app/gitea/cronjob-backup.yaml

@@ -0,0 +1,212 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: gitea-db-backup
+  namespace: gitea
+  labels:
+    app: gitea-backup
+spec:
+  schedule: "0 2 * * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      template:
+        metadata:
+          labels:
+            app: gitea-backup
+        spec:
+          restartPolicy: OnFailure
+          initContainers:
+            - name: pg-dump
+              image: postgres:17
+              imagePullPolicy: IfNotPresent
+              env:
+                - name: PGHOST
+                  value: gitea-db
+                - name: PGUSER
+                  valueFrom:
+                    secretKeyRef:
+                      name: gitea-credentials
+                      key: DB_USERNAME
+                - name: PGPASSWORD
+                  valueFrom:
+                    secretKeyRef:
+                      name: gitea-credentials
+                      key: DB_PASSWORD
+                - name: PGDATABASE
+                  valueFrom:
+                    secretKeyRef:
+                      name: gitea-credentials
+                      key: DB_DATABASE_NAME
+              command:
+                - sh
+                - -c
+                - pg_dump --clean --if-exists > /backup/dump.sql
+              volumeMounts:
+                - name: backup-tmp
+                  mountPath: /backup
+          containers:
+            - name: resticprofile
+              image: creativeprojects/resticprofile:0.32.0
+              imagePullPolicy: IfNotPresent
+              command:
+                - sh
+                - -c
+                - |
+                  resticprofile -c /secrets/profiles.yaml -n gitea-db backup
+                  resticprofile -c /secrets/profiles.yaml -n gitea-db copy
+              env:
+                - name: B2_ACCOUNT_ID
+                  valueFrom:
+                    secretKeyRef:
+                      name: gitea-backup-config
+                      key: B2_ACCOUNT_ID
+                - name: B2_ACCOUNT_KEY
+                  valueFrom:
+                    secretKeyRef:
+                      name: gitea-backup-config
+                      key: B2_ACCOUNT_KEY
+              resources:
+                requests:
+                  cpu: 100m
+                  memory: 256Mi
+                limits:
+                  memory: 1Gi
+              volumeMounts:
+                - name: secrets
+                  mountPath: /secrets
+                  readOnly: true
+                - name: backup-tmp
+                  mountPath: /backup
+          volumes:
+            - name: secrets
+              secret:
+                secretName: gitea-backup-config
+            - name: backup-tmp
+              emptyDir: {}
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: gitea-data-backup
+  namespace: gitea
+  labels:
+    app: gitea-backup
+spec:
+  schedule: "0 3 * * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      template:
+        metadata:
+          labels:
+            app: gitea-backup
+        spec:
+          restartPolicy: OnFailure
+          containers:
+            - name: resticprofile
+              image: creativeprojects/resticprofile:0.32.0
+              imagePullPolicy: IfNotPresent
+              command:
+                - sh
+                - -c
+                - |
+                  resticprofile -c /secrets/profiles.yaml -n gitea-data backup
+                  resticprofile -c /secrets/profiles.yaml -n gitea-data copy
+              env:
+                - name: B2_ACCOUNT_ID
+                  valueFrom:
+                    secretKeyRef:
+                      name: gitea-backup-config
+                      key: B2_ACCOUNT_ID
+                - name: B2_ACCOUNT_KEY
+                  valueFrom:
+                    secretKeyRef:
+                      name: gitea-backup-config
+                      key: B2_ACCOUNT_KEY
+              resources:
+                requests:
+                  cpu: 100m
+                  memory: 256Mi
+                limits:
+                  memory: 1Gi
+              volumeMounts:
+                - name: secrets
+                  mountPath: /secrets
+                  readOnly: true
+                - name: data
+                  mountPath: /data
+                  readOnly: true
+          volumes:
+            - name: secrets
+              secret:
+                secretName: gitea-backup-config
+            - name: data
+              persistentVolumeClaim:
+                claimName: gitea-data
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: gitea-extra-backup
+  namespace: gitea
+  labels:
+    app: gitea-backup
+spec:
+  schedule: "15 3 * * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 3
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      template:
+        metadata:
+          labels:
+            app: gitea-backup
+        spec:
+          restartPolicy: OnFailure
+          containers:
+            - name: resticprofile
+              image: creativeprojects/resticprofile:0.32.0
+              imagePullPolicy: IfNotPresent
+              command:
+                - sh
+                - -c
+                - |
+                  resticprofile -c /secrets/profiles.yaml -n gitea-extra backup
+                  resticprofile -c /secrets/profiles.yaml -n gitea-extra copy
+              env:
+                - name: B2_ACCOUNT_ID
+                  valueFrom:
+                    secretKeyRef:
+                      name: gitea-backup-config
+                      key: B2_ACCOUNT_ID
+                - name: B2_ACCOUNT_KEY
+                  valueFrom:
+                    secretKeyRef:
+                      name: gitea-backup-config
+                      key: B2_ACCOUNT_KEY
+              resources:
+                requests:
+                  cpu: 100m
+                  memory: 256Mi
+                limits:
+                  memory: 1Gi
+              volumeMounts:
+                - name: secrets
+                  mountPath: /secrets
+                  readOnly: true
+                - name: extra
+                  mountPath: /data-extra
+                  readOnly: true
+          volumes:
+            - name: secrets
+              secret:
+                secretName: gitea-backup-config
+            - name: extra
+              persistentVolumeClaim:
+                claimName: gitea-extra

kubernetes/app/gitea/namespace.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: gitea
+  labels:
+    # act_runner DinD sidecar requires privileged; relax PSA enforce for this ns
+    pod-security.kubernetes.io/enforce: privileged

kubernetes/app/gitea/networkpolicy.yaml

@@ -0,0 +1,131 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny-ingress
+  namespace: gitea
+spec:
+  podSelector: {}
+  policyTypes:
+    - Ingress
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-ingress-controller
+  namespace: gitea
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: gitea
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik
+---
+# NodePort 32022 routes to pod port 2222 (rootless SSH listen port)
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-ssh-from-outside
+  namespace: gitea
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: gitea
+  policyTypes:
+    - Ingress
+  ingress:
+    - ports:
+        - port: 2222
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-app-to-db
+  namespace: gitea
+spec:
+  podSelector:
+    matchLabels:
+      app: gitea-db
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: gitea
+      ports:
+        - port: 5432
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-backup-to-db
+  namespace: gitea
+spec:
+  podSelector:
+    matchLabels:
+      app: gitea-db
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app: gitea-backup
+      ports:
+        - port: 5432
+---
+# Allow act_runner pods to reach gitea-http (HelmRelease for Actions registers and polls jobs via cluster-internal Service)
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-runner-to-gitea
+  namespace: gitea
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/name: gitea
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              app.kubernetes.io/name: actions-act-runner
+      ports:
+        - port: 3000
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-backup-egress
+  namespace: gitea
+spec:
+  podSelector:
+    matchLabels:
+      app: gitea-backup
+  policyTypes:
+    - Egress
+  egress:
+    - ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+    - ports:
+        - port: 8888
+          protocol: TCP
+    - ports:
+        - port: 443
+          protocol: TCP
+    - ports:
+        - port: 5432
+          protocol: TCP
+      to:
+        - podSelector:
+            matchLabels:
+              app: gitea-db

kubernetes/app/gitea/pvc-extra.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: gitea-extra
+  namespace: gitea
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: nfs-synology-ssd
+  resources:
+    requests:
+      storage: 30Gi

kubernetes/app/gitea/release-actions.yaml

@@ -0,0 +1,69 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: gitea-actions
+  namespace: flux-system
+spec:
+  chart:
+    spec:
+      chart: actions
+      version: 0.1.0
+      reconcileStrategy: ChartVersion
+      sourceRef:
+        kind: HelmRepository
+        name: gitea
+        namespace: flux-system
+  targetNamespace: gitea
+  interval: 1m0s
+  install:
+    remediation:
+      retries: 3
+  upgrade:
+    remediation:
+      retries: 3
+  dependsOn:
+    - name: gitea
+  # chart 0.1.0 has a broken `global.storageClass` helper (extra newline breaks YAML),
+  # so we set storageClassName via a kustomize patch instead.
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              kind: StatefulSet
+              name: gitea-gitea-actions-act-runner
+            patch: |
+              - op: add
+                path: /spec/volumeClaimTemplates/0/spec/storageClassName
+                value: nfs-synology-ssd
+  values:
+    enabled: true
+    giteaRootURL: http://gitea-gitea-http.gitea.svc.cluster.local:3000
+    existingSecret: gitea-runner-token
+    existingSecretKey: token
+    statefulset:
+      replicas: 1
+      timezone: Europe/Kyiv
+      persistence:
+        size: 10Gi
+      resources:
+        requests:
+          cpu: 100m
+          memory: 256Mi
+        limits:
+          memory: 2Gi
+      actRunner:
+        config: |
+          log:
+            level: info
+          cache:
+            enabled: true
+          container:
+            require_docker: true
+            docker_timeout: 300s
+          runner:
+            labels:
+              - "ubuntu-latest:docker://docker.gitea.com/runner-images:ubuntu-latest"
+              - "ubuntu-24.04:docker://docker.gitea.com/runner-images:ubuntu-24.04"
+              - "ubuntu-22.04:docker://docker.gitea.com/runner-images:ubuntu-22.04"
+      dind:
+        rootless: false

kubernetes/app/gitea/renovate.json

@@ -0,0 +1,33 @@
+{
+  "customManagers": [
+    {
+      "customType": "regex",
+      "description": "Track gitea rootless image; chart appends -rootless to tag automatically",
+      "fileMatch": ["kubernetes/app/gitea/release\\.yaml$"],
+      "matchStrings": [
+        "(?<indentation>\\s+)# renovate: currentValue=(?<currentValue>[^\\s]+) currentDigest=(?<currentDigest>sha256:[a-f0-9]+)\\n\\s+tag: [^\\s]+\\n\\s+digest: [^\\s]+"
+      ],
+      "depNameTemplate": "gitea/gitea",
+      "datasourceTemplate": "docker",
+      "autoReplaceStringTemplate": "{{indentation}}# renovate: currentValue={{newValue}} currentDigest={{#if newDigest}}{{{newDigest}}}{{else}}{{{currentDigest}}}{{/if}}\n{{indentation}}tag: {{newMajor}}.{{newMinor}}.{{newPatch}}\n{{indentation}}digest: {{#if newDigest}}{{{newDigest}}}{{else}}{{{currentDigest}}}{{/if}}"
+    }
+  ],
+  "packageRules": [
+    {
+      "matchFileNames": ["kubernetes/app/gitea/**"],
+      "semanticCommitScope": "k8s/gitea"
+    },
+    {
+      "matchFileNames": ["kubernetes/app/gitea/**"],
+      "matchPackageNames": ["gitea/gitea"],
+      "matchUpdateTypes": ["patch", "minor"],
+      "automerge": true
+    },
+    {
+      "description": "Ignore infrastructure images",
+      "matchFileNames": ["kubernetes/app/gitea/**"],
+      "matchPackageNames": ["creativeprojects/resticprofile", "postgres"],
+      "enabled": false
+    }
+  ]
+}

kubernetes/app/gitea/repository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: gitea
+  namespace: flux-system
+spec:
+  interval: 1m0s
+  url: https://dl.gitea.com/charts/

kubernetes/app/gitea/secret-backup.sops.yaml

@@ -0,0 +1,26 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: gitea-backup-config
+    namespace: gitea
+stringData:
+    profiles.yaml: ENC[AES256_GCM,data:qtegwOuO6px5lTrzgy3XWky/HV77Z/e6Oqx7Jwdieg2y4KKN0zelC74SpACsOZTd4/irGmdHrtkP2PNVnNB8ylPLv1mKPNi5fvTl4JsHSOZlHfIxmTxgljtsXh4N8o02RIPi5pYKGj/UDIF2yin7HdgtAZfsEhDcXbxENc8iyM1DYMGLVaHo3Z2SoEtILjqz8+fOmm+Pj/snaMZ6qst+a8Fyr5/wdc4S2WjsLyeZ1UDbzy549nBCpszp5Ncy4mGqyFBvQzgCT75cmAxtwYjfEh+Abc65EjB6CNmf9ciIAjlMJ8olQe6k8xTpGhzcT0jaWZfHw3VV454fMhCF9f20PLoGg3UCPgSanSy9OCjLT310ezMaO9ukWJ4dNzJKD/x2xsOCkGRG4Zm2kmJFoDsFILpLToGyfNxHr38M/otZxS9UiuZ7aLSWJW0UubhsPJ1niLnZB/XSd2bTrIbzunm/pgDCOI2wusrT6Qo/iVzMxAt9CKgFzdmvfsThdFflSKb5pK1fA8SRit3B4YTuXX6NiSUUAiAy+PfPGUgixneRJ6DiYKzIAC6X4dZLf8yS04gVPPOL5BaGq7Vh+5RawqEogsnJuNFCpcbVtUmZd4BnydNptueqZKHoxdgNV8ZYlsbWdwF2yhnC99tdXsYp+5CDD4Zm9qBtOjIIW1e/yGQ6Tjsq9qk0yRTYkFjM9awETgKnE+/6mieg5yY3uSIwwP4ZegUW92KH+SrnOs3QrcrTTJY/wlRs4SWQWw7aEUS4yuPZXtPmhYjccl3dWNN3lT1LbOMVTqekoQlJptefbfKLiXy+A6iEYJuORxH1hcjfvqlpk722kJqwWpgqFDP6f0x/wPJxHm3XpzBVo+6qclJ0sFU+OgDReDrgh+qH1IBGuz5A39rvfx6MLuaLOVwWswqArACWe2p9lg0yPTc51nDhloeNwOVMVZ5+StYBMIydYU9wU3SDT1cox7Sd6ahz23XHzSDq30m0uIWpZZNJm5P6KQHk4XEVIk3g9K6GMf1NgafWAFePgTHBt3/A2yXAXwYVK3dyBN6Rwl3F4Neq2n0OJRN6es89rrrf0VhdJJTPW7WjIzmrMyKi8qX7KnN5oI8316N+899CahwL/e1NdD16V7DxWNMjeG74j3lxSmzXWnPn5k0y0POcIkegLdksTNEtqLQgmMzI4gn5Avn/G5CIiz7cexno+4cUeTMVRwx6YH0KxAmxHXJXp9yuqGNoo0pIACTmwpOqvMACrKEPRanxVWbCD/ZQLSiwFzfmUoexH8iUiqcFe01WQh09rXSf87Yhsf/QP/xHZS+a21f0pAtC1ZeNc0wwad5ycI5RgkcokQNcDzCEvPAKt8IKuGvk7Ti6GXXBPhMcIW0yJtuxTL1DAxfYBte/lqvGIGfl3/7b9E+FR/vgnZUl5ykQnwiHTAAmZ0ySEWyyVs93rFt5UecPEUZRyn6tNYrCjJ7hqL4NgwmGEmlLH0V/aBRSZgGNafRfXQi6w2m6Pbdo86Pn55H4fH2HCIXNPBWzFWhzohBFjLTSC4EqjYUvT72r4IimOCqOGUKYuF0giAHvkVWM0GF48x1fiUI11p+N+bDM3Coi0m4mLkof/d+yk1sOcvt1h5XOn5NbmLz/X6HhJrEo8APPhJvu4qzF4KTujafP7KF5dDWBjp5GlooyE74gRj4tLEN0vfcaezS0IwMefmkCPFrpTB/wnDavic1EJ9lYRREggdCVPJLlU9omLhvRTCBRDF62GbQVtgUqVAHqVM0EkdVzeCoSDo3TWUSFi6Dv/ivWuXGJKChM5n4cDVenatbzi4htAXR1bW3zIRXVmQy8HkgLrj42Kg==,iv:PGm23iUxhuDcnKqJeF8/kAwFJ1646ufstWCGSH+0yKA=,tag:2J/E98gHS9N0Agt+nfMTug==,type:str]
+    restic-password-nas: ENC[AES256_GCM,data:fMbuwG48Wc2YScNDYO+V2LjmOsjadatzHYSz0m8kvVfe7tw7lCChZanTSuldX9++E8NSxSGh6cvyRXFoX7ISCw==,iv:zSk8hk9+blNC7AZD2iEMly+t/anLzxjsJrqJzdLlqgE=,tag:C2aRaBHR8m6fRoBI/AMm6Q==,type:str]
+    restic-password-b2: ENC[AES256_GCM,data:7/Os6960fd0HF8FHgI/UIRS2XahEcu39VJne5usDznIqQgnp1338mZ3S/9Wf4ZBKgGe0bieE/OKOWddSn2UbZA==,iv:WrMvh6++E+ENqg1r8K/q8qgOEBYBziBhIW+3FqtUH8Q=,tag:or+eTDz9QLI//IQgulGJFg==,type:str]
+    B2_ACCOUNT_ID: ENC[AES256_GCM,data:4hEA1VTpo5OKyBhB7TfwC0tMS9thhls3aA==,iv:zfueemMDGJBHVMo5XZkuBlczB0SR51ygG5FCx15kZ5s=,tag:oe0Uvy8xHpOrRFPa4eIkww==,type:str]
+    B2_ACCOUNT_KEY: ENC[AES256_GCM,data:ypKpSJtPrdiJXbjNHPIblw2vH3MxlnXoG9p6UJODsw==,iv:g3QCmZI5Z2fmcYuGQZKaydJkrnzSOABFZvARhbzYM/E=,tag:hn/7CnjvQlTekQI3MbiAKQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2RXRnQTIvc3pBZUYxUXZo
+            VElZVkdNcE95bEdKVGxUdTZuMThvRDdETkdnCmxucXJvYWxHVGZCM0xEMkFDK0I2
+            WjJ2QnY1Y09tU3lyOVVXcWIweGt5R28KLS0tIGNvMS8ydDhaaXVrdEpWUnNySEtI
+            MTllRmtEZVdKcElMK3crOUlLQmJ4TEEKXzZkkRdGq/O+0jVB3930QD9ryczL3B7m
+            Mgw9+KXlp3jfOv7xEP2JFjGve4FOP/saJ0OXX8i2gIhNMFUZYoCBHQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
+    encrypted_regex: ^(data|stringData|email)$
+    lastmodified: "2026-05-11T18:13:47Z"
+    mac: ENC[AES256_GCM,data:pwrzvtizBP/GRW0gu3aQ6r9YgW6e+s689g4nlePs6Qzs+BljFMlb00Ko+LnX3XGgoynbJFHcsmhQBEDQ/8BYV7BaXPMtYW6V59ShaLUviSnhM47x2QbEoJkNqxBA1YL6fWDz4RL39L9vVeV9uhVJk2xc/+qsXqU3sHieIjjL2UI=,iv:qyLRgnXMKuW6GAuiK5Xn5pDVcHOpBgOfJ7TUOL5HHR4=,tag:lTPrHqKeveXo85yuS6CslQ==,type:str]
+    version: 3.13.0

kubernetes/app/gitea/secret-runner.sops.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: gitea-runner-token
+    namespace: gitea
+stringData:
+    token: ENC[AES256_GCM,data:FyNROq6IY5SYfhiFTV5FoXcFrhyYaDh7x5alZw+J7KRNw4sUQEni2g==,iv:aEFhinL9lsD/Cja3ZIa70AguBtba1qUXC2JOGsSU+Nc=,tag:6Z6HPZQAUgVa6+bQ3weM/g==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJaXZiU2RRZU9XbjY3S3Mz
+            anpQV1c4SDJuUEUyYjJldEE1RG9YdTMyMlg4CkFuU3NtMk9nbDEvWWlhUWtzNklI
+            bjBBMjdlQlNqK0dpeU9VdTkvZ3lCdFUKLS0tIE4yWWpsM3B3MSsxdjd0V3hoeUgy
+            UW5pcm01ZXk5cE8rZzR4K1RzcUdxYVEKWxiIA3KFYxXAx803x9GayNi3Sv9DkeC0
+            zbedDZCevB5xiQ5tFekmgu8A6FIMB/lF1IqSqYcUVa6YYcUVfIZmaw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
+    encrypted_regex: ^(data|stringData|email)$
+    lastmodified: "2026-05-11T18:04:32Z"
+    mac: ENC[AES256_GCM,data:a2l+uFG4HRJRqk7Gj0UsAzexaLwwv5ffNMjs6Oz7esCcAZf/941Yn13evk3hWOsqMTO3AWj5B9blgtakYYO5y5dmI8mD8GdoXiCZF69NCLSGvGuLL6HH3mvp/ZjQQypHQF0W1O4vntdbra4FJp1Nm9iulWeFG/DAO5F8eiv87tU=,iv:Z47KwItcBzBDA1lTZNB9UUGlFUV3jHDrrGyF6AaH+9Q=,tag:0h1dB/WL2MRThvnuj4VT+w==,type:str]
+    version: 3.13.0

kubernetes/app/gitea/secret.sops.yaml

@@ -0,0 +1,73 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: gitea-credentials
+    namespace: gitea
+stringData:
+    DB_USERNAME: ENC[AES256_GCM,data:3cbes9s=,iv:E+zSCE93AVTPiWtQKW15+fHp/6nKtEY0RFWkC9K95w4=,tag:bpM84tAY0TJlJHkvCYl4tQ==,type:str]
+    DB_PASSWORD: ENC[AES256_GCM,data:PziUZ2Yg+kk6qvqs16k3gl2+gFT/MeE7DTzsfD+21bvLa8cvjPywNTTBS2gDB5h6H6+bn3f3X6tN+KYg2fNUYA==,iv:Ego7tQnpe8LcDd+XAG3ThtQUGR5cyjRnkCjppOtcW3M=,tag:zwrew+a4j78kNpgr2yfW6w==,type:str]
+    DB_DATABASE_NAME: ENC[AES256_GCM,data:wevUgjE=,iv:2VMHHmp4rI3EE8lmKL+88VDwtIy8RoHbxZM5dsln6Q0=,tag:Vinwbtci+UkGoyzGEEF/5A==,type:str]
+sops:
+    age:
+        - recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtWWhqdVVJNmhUT0FBWFVk
+            V1V4R0wyV1V3WnpHZ1JGWm1iTnQ5TmsyeGk4ClpKSlJyMjYxNmQvUWlNbHY0cU0y
+            ZkJuTHd0K1k2cGhLTG1ncXBhMWk3ZzgKLS0tIEtXNXJQa2txMFovSnZkeDM1R2tk
+            TWwxTXBRUkJWcG1sMUl3REFtMkI2WG8KyvuPr8iwuiVC9j5wXLaok5AeJhXXq8CI
+            H7HCBU4mVjwd0IrtlwSCLx5vUDKTpc2e5SumJp4nSy1D5R+uOjEWBA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-04-29T19:32:53Z"
+    mac: ENC[AES256_GCM,data:ngT9hUeIQM+NL3v/WApSBGsdWJw7CZvAMfqb/4d80DwV0cF14WjMVupc0d6mD7ykhJGM5ptwf1zR8QPSkErCRXSHxFoLXGAJVN4h+MOy48yZ61RK/p+dip5CkPojTfb5i6rU0dIOFVpjm7z6JbPLz8UTxMTikwzo/w931AKa9PE=,iv:wXZQRvt6pImnxVIfyOhRJWQl+ytrlmDxd8odDra16XQ=,tag:/6Fixh2urHAgUfQx+h6Dsg==,type:str]
+    encrypted_regex: ^(data|stringData|email)$
+    version: 3.12.2
+---
+apiVersion: v1
+kind: Secret
+metadata:
+    name: gitea-admin
+    namespace: gitea
+stringData:
+    username: ENC[AES256_GCM,data:w6EdTuF/JRY3QuU=,iv:DaPA4FbTz44m99OafT7rYGAuSNY1+Kd0fqoH3nl/8vQ=,tag:QZU+4g/k5Ft4w06uh/kzZw==,type:str]
+    password: ENC[AES256_GCM,data:tl8bLeTQfsa3NHg2WJrHzBe5LXaGd+9btVyZFgPc0Mp3hDkPZh6pAZDd1n96pO9oNYe2elmKfdaJZGhX6Xknow==,iv:boQQm3XRAg9ZrLC2yP2TBqDH6JtCneoS3y4RCBpTTMw=,tag:uKLU0mUQvCLs3FhEv3aFYQ==,type:str]
+    email: ENC[AES256_GCM,data:WekZNlut9EhIyIJF6Z5yZevVeBWUggeDbFYQx2A=,iv:125s6eI55SckKFvFvZ78G2MCdoiUqdXaKGNu7vtFOpw=,tag:ZVToNfQ5K11Z3QUJ0FrWPg==,type:str]
+sops:
+    age:
+        - recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtWWhqdVVJNmhUT0FBWFVk
+            V1V4R0wyV1V3WnpHZ1JGWm1iTnQ5TmsyeGk4ClpKSlJyMjYxNmQvUWlNbHY0cU0y
+            ZkJuTHd0K1k2cGhLTG1ncXBhMWk3ZzgKLS0tIEtXNXJQa2txMFovSnZkeDM1R2tk
+            TWwxTXBRUkJWcG1sMUl3REFtMkI2WG8KyvuPr8iwuiVC9j5wXLaok5AeJhXXq8CI
+            H7HCBU4mVjwd0IrtlwSCLx5vUDKTpc2e5SumJp4nSy1D5R+uOjEWBA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-04-29T19:32:53Z"
+    mac: ENC[AES256_GCM,data:ngT9hUeIQM+NL3v/WApSBGsdWJw7CZvAMfqb/4d80DwV0cF14WjMVupc0d6mD7ykhJGM5ptwf1zR8QPSkErCRXSHxFoLXGAJVN4h+MOy48yZ61RK/p+dip5CkPojTfb5i6rU0dIOFVpjm7z6JbPLz8UTxMTikwzo/w931AKa9PE=,iv:wXZQRvt6pImnxVIfyOhRJWQl+ytrlmDxd8odDra16XQ=,tag:/6Fixh2urHAgUfQx+h6Dsg==,type:str]
+    encrypted_regex: ^(data|stringData|email)$
+    version: 3.12.2
+---
+apiVersion: v1
+kind: Secret
+metadata:
+    name: gitea-oauth-authelia
+    namespace: gitea
+stringData:
+    key: ENC[AES256_GCM,data:6gbsmUI=,iv:rLq6rHHqyJ158JxbmFGkko6rPt2aJkQKCDGY/kOil5E=,tag:qz/2riJi00AkEdtOtQTJdA==,type:str]
+    secret: ENC[AES256_GCM,data:z8zuEZ9xgiIiSCDOtXn4yXU5n5TggMpc+5y8Vv21ja8PTXXf1l3krnc55qaJPuo85+fYqzW+NDPbTWPAIkVqtvr260N++d7z,iv:hh91ss/nbBIvxosNLQ5zy6G593Vxn92q+8f0APjiORk=,tag:FzvjgjCyEyvzmZ4J/muPlg==,type:str]
+sops:
+    age:
+        - recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtWWhqdVVJNmhUT0FBWFVk
+            V1V4R0wyV1V3WnpHZ1JGWm1iTnQ5TmsyeGk4ClpKSlJyMjYxNmQvUWlNbHY0cU0y
+            ZkJuTHd0K1k2cGhLTG1ncXBhMWk3ZzgKLS0tIEtXNXJQa2txMFovSnZkeDM1R2tk
+            TWwxTXBRUkJWcG1sMUl3REFtMkI2WG8KyvuPr8iwuiVC9j5wXLaok5AeJhXXq8CI
+            H7HCBU4mVjwd0IrtlwSCLx5vUDKTpc2e5SumJp4nSy1D5R+uOjEWBA==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-04-29T19:32:53Z"
+    mac: ENC[AES256_GCM,data:ngT9hUeIQM+NL3v/WApSBGsdWJw7CZvAMfqb/4d80DwV0cF14WjMVupc0d6mD7ykhJGM5ptwf1zR8QPSkErCRXSHxFoLXGAJVN4h+MOy48yZ61RK/p+dip5CkPojTfb5i6rU0dIOFVpjm7z6JbPLz8UTxMTikwzo/w931AKa9PE=,iv:wXZQRvt6pImnxVIfyOhRJWQl+ytrlmDxd8odDra16XQ=,tag:/6Fixh2urHAgUfQx+h6Dsg==,type:str]
+    encrypted_regex: ^(data|stringData|email)$
+    version: 3.12.2

kubernetes/app/gitea/service-db.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitea-db
+  namespace: gitea
+spec:
+  clusterIP: None
+  selector:
+    app: gitea-db
+  ports:
+    - port: 5432
+      targetPort: 5432

kubernetes/app/gitea/statefulset-db.yaml

@@ -0,0 +1,80 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: gitea-db
+  namespace: gitea
+  labels:
+    app: gitea-db
+spec:
+  serviceName: gitea-db
+  replicas: 1
+  selector:
+    matchLabels:
+      app: gitea-db
+  template:
+    metadata:
+      labels:
+        app: gitea-db
+    spec:
+      securityContext:
+        runAsUser: 999
+        runAsGroup: 999
+        fsGroup: 999
+      containers:
+        - name: postgres
+          image: postgres:17
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-credentials
+                  key: DB_USERNAME
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-credentials
+                  key: DB_PASSWORD
+            - name: POSTGRES_DB
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-credentials
+                  key: DB_DATABASE_NAME
+            - name: PGDATA
+              value: /var/lib/postgresql/data/pgdata
+          ports:
+            - containerPort: 5432
+          startupProbe:
+            tcpSocket:
+              port: 5432
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            failureThreshold: 30
+          livenessProbe:
+            tcpSocket:
+              port: 5432
+            periodSeconds: 30
+            failureThreshold: 5
+          readinessProbe:
+            tcpSocket:
+              port: 5432
+            periodSeconds: 10
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 50m
+              memory: 256Mi
+            limits:
+              memory: 1Gi
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/postgresql/data
+  volumeClaimTemplates:
+    - metadata:
+        name: data
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        storageClassName: nfs-synology-ssd
+        resources:
+          requests:
+            storage: 5Gi

kubernetes/app/immich/cronjob-backup.yaml

@@ -1,3 +1,15 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: immich-backup-cache
+  namespace: immich
+spec:
+  accessModes: ["ReadWriteOnce"]
+  storageClassName: nfs-synology-ssd
+  resources:
+    requests:
+      storage: 1Gi
+---
 apiVersion: batch/v1
 kind: CronJob
 metadata:
@@ -119,6 +131,8 @@ spec:
                     secretKeyRef:
                       name: immich-backup-config
                       key: B2_ACCOUNT_KEY
+                - name: RESTIC_CACHE_DIR
+                  value: /cache
               volumeMounts:
                 - name: secrets
                   mountPath: /secrets
@@ -126,6 +140,8 @@ spec:
                 - name: library
                   mountPath: /data
                   readOnly: true
+                - name: cache
+                  mountPath: /cache
               resources:
                 requests:
                   cpu: 100m
@@ -139,3 +155,6 @@ spec:
             - name: library
               persistentVolumeClaim:
                 claimName: immich-library
+            - name: cache
+              persistentVolumeClaim:
+                claimName: immich-backup-cache

kubernetes/app/immich/release.yaml

@@ -28,7 +28,7 @@ spec:
           main:
             image:
               repository: ghcr.io/immich-app/immich-server
-              tag: v2.7.3
+              tag: v2.7.5
             resources:
               requests:
                 cpu: 100m

kubernetes/app/immich/secret-backup.sops.yaml

@@ -4,7 +4,7 @@ metadata:
     name: immich-backup-config
     namespace: immich
 stringData:
-    profiles.yaml: ENC[AES256_GCM,data:8xHz7OVSV5yTzjK+a+3QJp6fKoNSYjYMSytSxbl6gwSH9vhC/n/H5AkCeoRQeMbv8XxvBcW7AE8SRNRbGUGdpVa7bbGfc64NMReH15Jly/krVRYXKwuwxPwLyDLu3BJkkUMVR8WOLqcin8GL0CMxsPYw7u9pexOm8029C6OUJNkgeoZfxkw2p84duOPvJiSB4zgTK4MBUAXXk9ntaD+DyMyskjwH/wIbxhVeeqIji0BixSUPhYhiz7zpvxtoAYUaDkgQZZkIMVYayb4ors11W9Hl1pq/mQ8P8GFleaqabYJeerRCGSZbjpo67HHcAdAHlYlPD09eReDi8Lc786+0LVVstUII09kSDqz3So3NSKzo7N86s0PUTTFaBYSWz1Nc9NVvYxb5vpPLNuLjrPDHy9yRlLw53wKtX6CzioPXG96NKfTU7d6tR8ocaCk38/tXkVQxf2MTWJaj2lL3u5gGftPYTXagNHF6IQYI9hIyrznUP4FezErfZmAunaIKvRnQ+AYli7AtbNkeOUeqJ3GYIlKR7eZTxeKFhK54iOvivm7OZiSfi20ItjruAO6kpYl0zfoJGEOGO1sNFmkgRb00VMxVIjBxjszb6er1TdKx5MPW3IY3tXLXGoLe0J/MNb0C9eDWD9EgR70BVz+0dFYmrC5mgMugpMMEi9yZjD1c517NyNzREVSrrKkdqrjyD2kzNSpNZEniIMP0n0MPEZ/vIp1oKzZQ3eMev+zHxvhGp98TjQ/oWhu5tXOc/g/mWUiASaB8611Doa2laVPCXTcMQCxFo8/b2CkmfToFmGwWmzQNmp0coRK4Zjr7bUIa1Ki1SmeAd0n2/yBQuX+081+NO+no8+GhR2/FS+SlYqh5PweCeAtM7GYeCoRXYUTTxafCS5JJ912fDUbaJixLbg1F3zficPAQ1XBSsB14pHO2rGVRcRS1pEruAXwTsMSpNiTIRLghxU/ES6zCwfxwL83PRcfSgep/G+GAfdijtVawH+c+QBTHI/5bLS5rmid8qR0TYrH89UbnOMFa0evDFuNgh5qtBi938gKKqdCtPAY7kkU8l8+fT9bLied0S6jE5q7jNXmBJH3qmc47MYwNSOeouiJ2aXar9KVn/xbBlaIuHd5Go97PtU09XZK2hcAGEXGiQT6iI8MXUucl/dfvtFMmlkD0wMMytQ8q9AFt7RwodVTWLv/mMxxBg3HrWKqvM3vBOzEjCTTWctOVmjCr/qq/sLBr/mxYFg==,iv:5P67BQp0lLdEqdUx2r2PLjYlUJiUIU1A+O2rFQQP4CM=,tag:4yRRV1Cuy5O31X/++QCD0Q==,type:str]
+    profiles.yaml: ENC[AES256_GCM,data:u6/Xt5Vez8Wd78omhpoACJXZcYYqcAoGudik5djNGK9jd5VUOk7/Mxq3IEloKcgaxXtN5NXtRc89GwZNYXeQJkY++aKpmDBvQb/usXyHoYW+fn1NbzRjuShTxrnFgEIPoxT/j55Kjr9v+AmRXfH7TVHkJObVPBJ+RZw8bzAGzRxpQ20EeQuVPY9sl6TbYb0RoPr3r9uYslWXHIAbvP24AU3kTTtzK+i8aJkpIm2o1Kkl+d8Iht6V0q9rET76zR/A2W8qz2lJ+C/0mSqdxez7kwLZiQLFKlJ/GRBp1erReOh3AThwhBWH9o4clJr+qtNyyiu0wXPOtX4KqwWvv13hPOAlVxBISX+EIKQMGVMrKYdmS4CnRt/LgUh8bjJn1nfdXG18Rrcm5X3fh/cAhFCrzWlGYHaJbAQ0dEqHx3n/9npHsxstbCY7qYm/QDXA7AosEa/vp0B1aX8J4VFZEd/AH7AwW4lOvzuRSNo0SUxcGQEZqArTyEbVXlgZg2xQrCaH8DFjF5OQ5ElaP17dGYu/zyfIFxlMVVtV9snW+SeeV5A9dJsj3KSmfGpMwcHfYhaTQieaS5Crv+19Ax/MQfQYdZwfX6yjsUQEAK4dLwPHMLbu1H97djLuC/ZPYB8thO2+fEPA/g6wgCUnyKga+97B0jt6GSXRg9oYC9wfl+P2ucUrlzBDhClabygFfYRZZ+P6YK1jjodYhttRkD5+L7WwYElgxVBCxBzOZIO4aPxz1TXSPsGIE1/v6GASbvn2h7S4e2fP5YgqefDJPOxDy+iET4+N0wy5TcYd8wZqV0NJUtRvNoA6Y2a3VktAH4ZkzeIsnjdItfFNuOXMkvdhE8uF32zShHR/UVvnNBsJZdC1+hacEur1Lo7CHvnPdvbjn3e+2z+PPWts0akU+oPg06901bU1m5aiPDf55CVAoG8nD8fdOnea3cgXsoCC+uIUd7y0/CQS7EkBSaBi0ewcL8IGh2Yy4CXAnPBhSSEmiZpwJK7fe+kk+kAHllFHDme02osU70qxsBVux3dLYjStQSu7EWeQYzkeknlGPMD90GISOQSVX9BCjZOJTL5LcGVHolRNuX0/isL4xpeb7LchkgGGHjSNEp9zirjMS4eDecHQgDxv0uTXYEnVq67fBLTzeAHVlZyCvTzpOEec9cnSTvC+KLKlAIcsmkFVQduu1G0VyTb3kujGKjNvo7A7OriWQfhffse9qo/1moJUzlOFlpZzX9GtGlI4vEb81m78YE3I7aEAQ1+F/w8hzspQFBmdwTfOc5d+mm6+ogtk6BpaO6RYw4ooMcy/D4pQxwgO/gUM,iv:YZaQwbYkKOuL3XShnOB5VblbN5EEEcD3CfPyauezqyA=,tag:m0QQiuR0DfCc+o4ILSlfgg==,type:str]
     restic-password-nas: ENC[AES256_GCM,data:lXtgvRD9ov1llpAWnK7RwYulfp0umpcZw7qHhjCWHc1ag0dEeMKOveehqz+kIUfqLe+L3ETXOoyeDgYlXMCzkw==,iv:Bve8VOl42fTVZ5QNxKuVwGzLnkKihjm5vRHW8A0J+R0=,tag:q7QnJsJtSF6oo9DoHCwL4Q==,type:str]
     restic-password-b2: ENC[AES256_GCM,data:th+gQw51kZDy0zGsqiUSUfBwOBOGaQxqgIj4aJV706OQ2IPmL5Z7JX4r8d30O5ezZ3Cyxniw7PFx+UgNUmg0pg==,iv:HxHsvvHkwjef3/E3/Ix+e8PgyK+uCd8Yl8qZPhhsnjw=,tag:bKRTdd88Mo53/wmf4aQEiA==,type:str]
     B2_ACCOUNT_ID: ENC[AES256_GCM,data:2GCe4rtcCdz0iaNWnEf3rFzd3Qh9CNMqaA==,iv:aiHojCbIisaUfDh5GIR6tY0IW6MVZEII6apW6KV0r90=,tag:FER2E8ZzIML0/0ZeaAwHsA==,type:str]
@@ -20,7 +20,7 @@ sops:
             U2ZxL2VvbUF1Wk93TmxseHcvVWNOc2sKNmTJhYwOuV2gE/PGFodfxsQS6Okwv+Yq
             a0V7VAhKutBT+b+1lmdCvQy/wOTzHRo4tJ6wDReu9bwT8pj8ya/hkw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-03-11T19:58:21Z"
-    mac: ENC[AES256_GCM,data:nJFnd5587Vv1+EzBnBMm8sEy+8jINWS2Fm8oW0lcOkeUbuBmBvQXpOSZf6IMvcPCIHdIwBRk8etI2kvH2GB8XtkhKJtGodRmRjfYnwBMWMdAjrYpK7eazHLQdsp1lyYZ5YaqS6oSaZtc4nJAhfO7Z9rpOZC0oTrZSnF+HEmsEds=,iv:Kn56EjcCZk1UNg4tFtogucNlNx9Xoh0SNDa9+hApMJE=,tag:ITbEbv5Q4HkbLVueOcl5GQ==,type:str]
+    lastmodified: "2026-04-15T11:37:07Z"
+    mac: ENC[AES256_GCM,data:wpm26S/DoAybezV0oIkUwLkpl8KJAaBqHIMhitErCYEKamy6ysJrNbXPQVbFLRspFZpXSx8XY981+yJ4puE72Vf43MrjcUBAJb373fWvWtiw/3UrGGCZIHTM478efemkErkip2nxRprTc/vMAdWyGezXIUnTJunuovcBuf1Ogwo=,iv:kLxrIJTtRotsovidkFshOK1irOcL546uiy+DRNXoTNQ=,tag:/q5NGIjiR+mRW8YVuYyeHg==,type:str]
     encrypted_regex: ^(data|stringData|email)$
-    version: 3.12.1
+    version: 3.12.2

kubernetes/app/media/deployment-qbittorrent.yaml

@@ -29,7 +29,7 @@ spec:
               mountPath: /media
       containers:
         - name: qbittorrent
-          image: lscr.io/linuxserver/qbittorrent:5.1.4
+          image: lscr.io/linuxserver/qbittorrent:5.2.0
           envFrom:
             - configMapRef:
                 name: media-common-env

kubernetes/app/media/release-seerr.yaml

@@ -18,7 +18,7 @@ spec:
   targetNamespace: media
   values:
     image:
-      tag: v3.1.0
+      tag: v3.2.0
     podLabels:
       app: seerr
     extraEnv:

kubernetes/config/cluster-vars.sops.yaml

@@ -33,11 +33,13 @@ stringData:
     CRYPTPAD_DATA_NFS_PATH: ENC[AES256_GCM,data:dNOxsmge//CgcBO0GIQUdcIBfaiGI1IVxXJ8IjmQl+Wh3A==,iv:hfuLuSWuSnbiItweWBSKxpxZJFgAWgUJCZNLcLZQVgw=,tag:7o353kHezQVRqb5BtC7rYw==,type:str]
     CRYPTPAD_CONFIG_NFS_PATH: ENC[AES256_GCM,data:VJ4h7ADenNgFIiNIFK7pJKMrUBYc4e9c4MdVzqGoR4TDWGYL,iv:8ZhMHiZLh2C4J/vh/8L96R6VIkKoWc7ib/bUAQ5rZE0=,tag:HgvJjjYybCgxatUbcRFY7Q==,type:str]
     SEERR_HOST: ENC[AES256_GCM,data:l64ttp+rLNU8GfwIE4fhJROSMDEb,iv:1vHOw0LyGN9OMhYemhtRq9GE2fc4J2EprZU3bp/h4kk=,tag:WNV0Jh7816ra7IIOBMspBg==,type:str]
+    FIREFLY_HOST: ENC[AES256_GCM,data:EQdrW33PVlD/brZCqh/sTkqLdPWW/bo=,iv:zbNnjsT1J6lpCEWtvNyL4A3bjWsusCjI5goWcZ8hajk=,tag:VwA6YA056bsyYIKB+X59bw==,type:str]
+    GITEA_HOST: ENC[AES256_GCM,data:Ky3tXS9E9iadabpVzoK5zEbigmtn,iv:t6OdQeQ7Kxzb7qbi+KeoOkJd0XE2Dse5P1fFyiHM6tg=,tag:GpmHtVDr0IQVbpbALVx40g==,type:str]
+    BLOG_HOST: ENC[AES256_GCM,data:eADRFTla/PPFLVCoP9uKvPZ1YhY=,iv://xbCGLkZ6guGMDU0MnVtGR0adgMqNbe0zrCerj7w8k=,tag:HHXvN6y3YvJ4U4TkENkYVA==,type:str]
     BACKUP_LOCAL_HOST: ENC[AES256_GCM,data:ABaTI3NKkhF7K2FpPwvvrHA0l/tCxAi4Qek=,iv:34ixxSpKU1c12uoMdk4nz2Vo/+5A/npB7NWMsWFytIM=,tag:qjw2fQBebCKnqCnAPiBHaw==,type:str]
 sops:
     age:
-        - recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
-          enc: |
+        - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
             YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBXekorS3lvckhHelE0NGVP
             Z0JSSmtTRk1yZEoxTVU4MnhaN2VjajU2cmhnCkEyWU0yandxUnZGZm5yWXJmQlM4
@@ -45,7 +47,8 @@ sops:
             MGJ6TFpwR0diNjlEN2syZkhNMFNwRDQK9pzmQGB0GQu6ogMIJW+kugvBNj3w+dxW
             bfEF9GAznIM/N5rPytF4wNgqwfoAF7GwumgA+iD43wprKtUJn+6dqw==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-03-24T07:43:54Z"
-    mac: ENC[AES256_GCM,data:HDM/kZW9TxuIN6FBpE2kIdac2IU3yam807hfOAMRmX5l9DgaItPHmW6s/mSV2Mb9jDmWB1LjPipVcgPGdU/Lr4V6QcVPsaf+/KA73kAw4BBgiBOPFwBS0gdqGKfXbHS9uh3BTtjenvFnDD+tTnBsEOHSYjvfYFucE4A1GQc2EzU=,iv:lBEz0ayGP7dyNZ6YMIjpHMg2c11YdCWGpC7QLfTxy+8=,tag:nWCffX0iISgld7uGcdN9EQ==,type:str]
+          recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
     encrypted_regex: ^(data|stringData|email)$
-    version: 3.12.1
+    lastmodified: "2026-05-11T19:20:10Z"
+    mac: ENC[AES256_GCM,data:eA4MCmIA7iuC6gelQqWfIWPBb5w+93BLfU2ZhqLMbIna+OIk0tOjogcVz89H+x72ryMB+39a1vD+cYzLcF16Zl0uVHB5UiK9UDssJ26nbt8SK18F9Ew0a0WLp+gCj2qNAB2Od8+rLOKccfmHm1x+C5RuvYnRE4A1U1VNu6sPx3Q=,iv:epN8ZWNF0taoWm94eR+Unx9TUvjSIlKMgacLfbyj94w=,tag:a9f+8K7SOQmFJaZZ2PjnMQ==,type:str]
+    version: 3.13.0

kubernetes/infrastructure/controllers/authelia/redis-release.yaml

@@ -20,7 +20,9 @@ spec:
     architecture: standalone
     auth:
       enabled: false
+    commonConfiguration: |-
+      appendonly no
+      save ""
     master:
       persistence:
-        storageClass: nfs-synology-ssd
-        size: 256Mi
+        enabled: false

kubernetes/infrastructure/controllers/renovate/cronjob.yaml

@@ -23,14 +23,21 @@ spec:
               image: renovate/renovate:39
               env:
                 - name: RENOVATE_PLATFORM
-                  value: github
+                  value: gitea
+                - name: RENOVATE_ENDPOINT
+                  value: https://gitea.berezovskyi.dev/api/v1
                 - name: RENOVATE_REPOSITORIES
-                  value: '["berezovskyi-oleksandr/homelab"]'
+                  value: '["oleksandr/homelab"]'
                 - name: RENOVATE_TOKEN
                   valueFrom:
                     secretKeyRef:
                       name: renovate
-                      key: github-token
+                      key: gitea-token
+                - name: RENOVATE_GITHUB_COM_TOKEN
+                  valueFrom:
+                    secretKeyRef:
+                      name: renovate
+                      key: github-com-token
                 - name: LOG_LEVEL
                   value: info
               resources:

kubernetes/infrastructure/controllers/renovate/secret.sops.yaml

@@ -4,7 +4,8 @@ metadata:
     name: renovate
     namespace: renovate
 stringData:
-    github-token: ENC[AES256_GCM,data:6SjztGjm1T0hNzgj3wpuqa31mdJdZItX0iZUA8l8v/4NhBmxDfMpu2YR8CyikZNcaTMhW4ty/nAYTPIBa8btGClArRV6p+aKrb9E35/LZmy5LIgg5ElZ5gaX+zIY,iv:Jx6Vwn6uaWTPw+fIsYOLJ68WSdZeHfEyq1nNYEidBZo=,tag:KTv6eABellIh9Putw2zSRw==,type:str]
+    gitea-token: ENC[AES256_GCM,data:rgJUYnLvlnha1q5VCU99OGXvAEME3t2RdyAtMVnzTTvVf2ux5nxWMg==,iv:5i+D8kM8P0HKOHkq3TDSkC6xzNz1juZWWGdC/uHcmZI=,tag:YkqTcBvFAozpkgl9sPeWxA==,type:str]
+    github-com-token: ENC[AES256_GCM,data:OGYg/7LKtx2FTsKEUvrMf81VUTc9nRAvZN9YKwCiAwWQhc2IgAUdWQ==,iv:/2d3Kvu45L6a3BXxrClOY5376S3n28Sw1lyZ9QGsEjM=,tag:Wjp2+J53vRbqKmlQAe9Dvg==,type:str]
 sops:
     age:
         - recipient: age1zffnskvuezntkk703a0pyxsd5m8vx2hm33dr47wdfy8mn4fdw4sqgw0jgc
@@ -16,7 +17,7 @@ sops:
             WFpEUzFtWkcyZ0ExSno5cTBIaU5ENmsKkGzvTtT0chu+B9XfDI2vRl5FXd46NWoh
             uADvff8Y3s0zwco7d4KiKQ3RNUnCQdThLBw/kJJSLf2012KgcGtwFA==
             -----END AGE ENCRYPTED FILE-----
-    lastmodified: "2026-03-19T19:19:10Z"
-    mac: ENC[AES256_GCM,data:obHqpPjipCJXzO+uO6JzaaGyzKaZwsTQx0UcipJmaXHrxveUZSWNkzFlQG11Zebi9owLSZxMigz172EIV2TUiNf03/G39HrajqRDMN/rQXH335ReBLZepzqhQekSJcQ8dT7GONpIYUmfsbm/mG31yg7RYJkmaUPfZyCAnNk1EJ0=,iv:/EDy+trJqPoEuxLgiNJBeoLkP87boxWtGHu7jmo/f8g=,tag:5LkSH5eTviNIS5Q/SU46Iw==,type:str]
+    lastmodified: "2026-05-09T09:04:27Z"
+    mac: ENC[AES256_GCM,data:YENWAnnhT/cGliy1iQ6zVW1FM0TW1nsujstvl5seqO1VwiOXwj/oPkVBxg1E8r8tIV9/af6vY/yo05RkNUuSgB2jYfA/dPYL1knGzfDPPqo2hrDYWKnO3Mpnjpe5u263gIGB4elE/MM61cXLucb7NbW7G6n3vTkbTXxtjakJOOY=,iv:kHpYTrOGVG1lP7KhXrnf/bXKmes+SAIkwLfFxJR/zq0=,tag:lsiER37cfgFcgt1utUGAww==,type:str]
     encrypted_regex: ^(data|stringData|email)$
-    version: 3.12.1
+    version: 3.12.2

renovate.json

@@ -3,12 +3,14 @@
   "extends": [
     "config:recommended",
     ":semanticCommits",
-    "local>berezovskyi-oleksandr/homelab//kubernetes/app/jellyfin/renovate.json",
-    "local>berezovskyi-oleksandr/homelab//kubernetes/app/media/renovate.json",
-    "local>berezovskyi-oleksandr/homelab//kubernetes/app/immich/renovate.json"
+    "local>oleksandr/homelab//kubernetes/app/jellyfin/renovate.json",
+    "local>oleksandr/homelab//kubernetes/app/media/renovate.json",
+    "local>oleksandr/homelab//kubernetes/app/immich/renovate.json",
+    "local>oleksandr/homelab//kubernetes/app/gitea/renovate.json"
   ],
   "enabledManagers": ["kubernetes", "custom.regex"],
   "automergeType": "branch",
   "ignoreTests": true,
-  "assignees": ["berezovskyi-oleksandr"]
+  "assignees": ["oleksandr"],
+  "gitAuthor": "Renovate Bot <renovate@whitesourcesoftware.com>"
 }