feat: migrate values from sops, since they are not secret

kubernetes/main/apps/cert-manager/cert-manager/issuers/clusterissuer.yaml

@@ -7,18 +7,18 @@ metadata:
 spec:
   acme:
     server: https://acme-v02.api.letsencrypt.org/directory
-    email: "${SECRET_ACME_EMAIL}"
+    email: [email protected]
     privateKeySecretRef:
       name: letsencrypt-production
     solvers:
       - dns01:
           cloudflare:
-            email: "${SECRET_ACME_EMAIL}"
+            email: [email protected]
             apiTokenSecretRef:
               name: cloudflare-secret
               key: CLOUDFLARE_API_KEY
         selector:
-          dnsZones: ["${SECRET_DOMAIN}"]
+          dnsZones: ["jory.dev"]
 ---
 # yaml-language-server: $schema=https://kube-schemas.pages.dev/cert-manager.io/clusterissuer_v1.json
 apiVersion: cert-manager.io/v1
@@ -28,15 +28,15 @@ metadata:
 spec:
   acme:
     server: https://acme-staging-v02.api.letsencrypt.org/directory
-    email: "${SECRET_ACME_EMAIL}"
+    email: [email protected]
     privateKeySecretRef:
       name: letsencrypt-staging
     solvers:
       - dns01:
           cloudflare:
-            email: "${SECRET_ACME_EMAIL}"
+            email: [email protected]
             apiTokenSecretRef:
               name: cloudflare-secret
               key: CLOUDFLARE_API_KEY
         selector:
-          dnsZones: ["${SECRET_DOMAIN}"]
+          dnsZones: ["jory.dev"]

kubernetes/main/apps/cert-manager/cert-manager/tls/certificates.yaml

@@ -3,11 +3,11 @@
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
-  name: "${SECRET_DOMAIN}"
+  name: "jory.dev"
 spec:
-  secretName: "${SECRET_DOMAIN}-tls"
+  secretName: "jory.dev-tls"
   issuerRef:
     name: letsencrypt-production
     kind: ClusterIssuer
-  commonName: "${SECRET_DOMAIN}"
-  dnsNames: ["${SECRET_DOMAIN}", "*.${SECRET_DOMAIN}"]
+  commonName: "jory.dev"
+  dnsNames: ["jory.dev", "*.jory.dev"]

kubernetes/main/apps/cert-manager/cert-manager/tls/pushsecret.yaml

@@ -10,7 +10,7 @@ spec:
       kind: ClusterSecretStore
   selector:
     secret:
-      name: ${SECRET_DOMAIN}-tls
+      name: jory.dev-tls
   template:
     engineVersion: v2
     data:

kubernetes/main/apps/cert-manager/cert-manager/tls/staging.yaml

@@ -9,5 +9,5 @@ spec:
   issuerRef:
     name: letsencrypt-staging
     kind: ClusterIssuer
-  commonName: "${SECRET_DOMAIN}"
-  dnsNames: ["${SECRET_DOMAIN}", "*.${SECRET_DOMAIN}"]
+  commonName: "jory.dev"
+  dnsNames: ["jory.dev", "*.jory.dev"]

kubernetes/main/apps/database/crunchy-postgres/cluster/cluster.yaml

@@ -192,8 +192,8 @@ spec:
       service:
         metadata:
           annotations:
-            external-dns.alpha.kubernetes.io/hostname: cpgo.${SECRET_DOMAIN}
-            lbipam.cilium.io/ips: ${SVC_CPGO_ADDR:=temp}
+            external-dns.alpha.kubernetes.io/hostname: cpgo.jory.dev
+            lbipam.cilium.io/ips: 10.69.1.34
         type: LoadBalancer
       port: 5432
       replicas: *replicas

kubernetes/main/apps/database/crunchy-postgres/cluster/externalsecret.yaml

@@ -12,10 +12,11 @@ spec:
     name: *name
     template:
       data:
+        CLOUDFLARE_ACCOUNT_ID: "{{ .CLOUDFLARE_ACCOUNT_TAG }}"
         s3.conf: |
           [global]
-          repo1-s3-key={{ .AWS_ACCESS_KEY_ID }}
-          repo1-s3-key-secret={{ .AWS_SECRET_ACCESS_KEY }}
+          # repo1-s3-key={{ .AWS_ACCESS_KEY_ID }}
+          # repo1-s3-key-secret={{ .AWS_SECRET_ACCESS_KEY }}
           repo2-s3-key={{ .R2_ACCESS_KEY_ID }}
           repo2-s3-key-secret={{ .R2_SECRET_ACCESS_KEY }}
         encryption.conf: |
@@ -27,5 +28,5 @@ spec:
         key: cloudflare
     - extract:
         key: crunchy-pgo
-    - extract:
-        key: postgresql-bucket
+    # - extract:
+    #     key: postgresql-bucket

kubernetes/main/apps/database/crunchy-postgres/cluster/nfs-pvc.yaml

@@ -10,7 +10,7 @@ spec:
   storageClassName: nfs-slow #csi-driver-nfs
   nfs:
     server: voyager.internal
-    path: ${SECRET_NFS_POSTGRES:=temp}
+    path: /mnt/user/kubernetes/postgres
   mountOptions:
     - nfsvers=4.2
     - hard
@@ -20,16 +20,3 @@ spec:
     - wsize=131072
     - nconnect=8
   persistentVolumeReclaimPolicy: Delete
-# ---
-# apiVersion: v1
-# kind: PersistentVolumeClaim
-# metadata:
-#   name: postgres-nfs
-# spec:
-#   accessModes:
-#     - ReadWriteMany
-#   volumeName: postgres-nfs
-#   storageClassName: ""
-#   resources:
-#     requests:
-#       storage: 1Mi

kubernetes/main/apps/database/crunchy-postgres/ks.yaml

@@ -41,6 +41,10 @@ spec:
   wait: true
   interval: 30m
   timeout: 5m
+  postBuild:
+    substituteFrom:
+      - kind: Secret
+        name: cluster-secrets
 ---
 # yaml-language-server: $schema=https://kube-schemas.pages.dev/kustomize.toolkit.fluxcd.io/kustomization_v1.json
 apiVersion: kustomize.toolkit.fluxcd.io/v1

kubernetes/main/apps/downloads/bazarr/app/helmrelease.yaml

@@ -108,7 +108,7 @@ spec:
           gethomepage.dev/widget.url: http://bazarr.downloads:6767
           gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_BAZARR_TOKEN}}` }}"
         hosts:
-        - host: "{{ .Release.Name }}.${SECRET_DOMAIN}"
+        - host: "{{ .Release.Name }}.jory.dev"
           paths:
           - path: /
             service:
@@ -126,7 +126,7 @@ spec:
       data:
         type: nfs
         server: voyager.internal
-        path: ${SECRET_NFS_DATA:=temp}
+        path: /mnt/user/data
         globalMounts:
         - path: /data
       log:

kubernetes/main/apps/downloads/dashbrr/app/externalsecret.yaml

@@ -17,10 +17,10 @@ spec:
         DASHBRR_MAINTAINERR_API_KEY: "{{ .MAINTAINERR_API_KEY }}"
         DASHBRR_PLEX_API_KEY: "{{ .PLEX_API_KEY }}"
         # OIDC
-        OIDC_ISSUER: "https://sso.${SECRET_DOMAIN}/application/o/dashbrr/"
+        OIDC_ISSUER: "https://sso.jory.dev/application/o/dashbrr/"
         OIDC_CLIENT_ID: "{{ .DASHBRR_CLIENT_ID }}"
         OIDC_CLIENT_SECRET: "{{ .DASHBRR_CLIENT_SECRET }}"
-        OIDC_REDIRECT_URL: "https://dashbrr.${SECRET_DOMAIN}/api/auth/callback"
+        OIDC_REDIRECT_URL: "https://dashbrr.jory.dev/api/auth/callback"
         # Database
         DASHBRR__DB_TYPE: postgres
         DASHBRR__DB_NAME: '{{ .dbname }}'

kubernetes/main/apps/downloads/dashbrr/app/helmrelease.yaml

@@ -92,7 +92,7 @@ spec:
           # gethomepage.dev/widget.url: http://dashbrr.downloads
           # gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_DASHBRR_TOKEN}}` }}"
         hosts:
-        - host: "{{ .Release.Name }}.${SECRET_DOMAIN}"
+        - host: "{{ .Release.Name }}.jory.dev"
           paths:
           - path: /
             service:

kubernetes/main/apps/downloads/kapowarr/app/helmrelease.yaml

@@ -61,7 +61,7 @@ spec:
           gethomepage.dev/icon: calibre-web.png
           gethomepage.dev/description: Comic Downloads
         hosts:
-          - host: "{{ .Release.Name }}.${SECRET_DOMAIN}"
+          - host: "{{ .Release.Name }}.jory.dev"
             paths:
               - path: /
                 service:
@@ -75,6 +75,6 @@ spec:
       data:
         type: nfs
         server: voyager.internal
-        path: ${SECRET_NFS_DATA:=temp}
+        path: /mnt/user/data
         globalMounts:
           - path: /data

kubernetes/main/apps/downloads/metube/app/helmrelease.yaml

@@ -61,7 +61,7 @@ spec:
       app:
         className: internal
         hosts:
-        - host: "{{ .Release.Name }}.${SECRET_DOMAIN}"
+        - host: "{{ .Release.Name }}.jory.dev"
           paths:
           - path: /
             service:
@@ -73,7 +73,7 @@ spec:
       downloads:
         type: nfs
         server: voyager.internal
-        path: ${SECRET_NFS_DATA:=temp}
+        path: /mnt/user/data
         globalMounts:
         - path: /downloads
           subPath: metube

kubernetes/main/apps/downloads/mylar/app/helmrelease.yaml

@@ -74,7 +74,7 @@ spec:
           gethomepage.dev/widget.url: http://mylar.downloads:8090
           gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_MYLAR_TOKEN}}` }}"
         hosts:
-          - host: "{{ .Release.Name }}.${SECRET_DOMAIN}"
+          - host: "{{ .Release.Name }}.jory.dev"
             paths:
               - path: /
                 service:
@@ -86,6 +86,6 @@ spec:
       data:
         type: nfs
         server: voyager.internal
-        path: ${SECRET_NFS_DATA:=temp}
+        path: /mnt/user/data
         globalMounts:
           - path: /data

kubernetes/main/apps/downloads/prowlarr/app/helmrelease.yaml

@@ -81,7 +81,7 @@ spec:
           gethomepage.dev/widget.url: http://prowlarr.downloads
           gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_PROWLARR_TOKEN}}` }}"
         hosts:
-        - host: "{{ .Release.Name }}.${SECRET_DOMAIN}"
+        - host: "{{ .Release.Name }}.jory.dev"
           paths:
           - path: /
             pathType: Prefix

kubernetes/main/apps/downloads/qbittorrent/app/helmrelease.yaml

@@ -90,7 +90,7 @@ spec:
         controller: *app
         type: LoadBalancer
         annotations:
-          lbipam.cilium.io/ips: ${SVC_QBITTTORENT_ADDR:=temp}
+          lbipam.cilium.io/ips: 10.69.1.36
         ports:
           bittorrent:
             enabled: true
@@ -114,7 +114,7 @@ spec:
             proxy_hide_header "content-security-policy";
             proxy_hide_header "X-Frame-Options";
         hosts:
-          - host: "{{ .Release.Name }}.${SECRET_DOMAIN}"
+          - host: "{{ .Release.Name }}.jory.dev"
             paths:
               - path: /
                 service:
@@ -126,7 +126,7 @@ spec:
       downloads:
         type: nfs
         server: voyager.internal
-        path: ${SECRET_NFS_DATA:=temp}
+        path: /mnt/user/data
         globalMounts:
           - path: /downloads
             subPath: torrents

kubernetes/main/apps/downloads/radarr/app/helmrelease.yaml

@@ -101,7 +101,7 @@ spec:
           gethomepage.dev/widget.url: http://radarr.downloads
           gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_RADARR_TOKEN}}` }}"
         hosts:
-        - host: "{{ .Release.Name }}.${SECRET_DOMAIN}"
+        - host: "{{ .Release.Name }}.jory.dev"
           paths:
           - path: /
             service:
@@ -115,6 +115,6 @@ spec:
       data:
         type: nfs
         server: voyager.internal
-        path: ${SECRET_NFS_DATA:=temp}
+        path: /mnt/user/data
         globalMounts:
         - path: /data

kubernetes/main/apps/downloads/readarr/app/helmrelease.yaml

@@ -84,7 +84,7 @@ spec:
           gethomepage.dev/widget.url: http://readarr.downloads
           gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_READARR_TOKEN}}` }}"
         hosts:
-        - host: "{{ .Release.Name }}.${SECRET_DOMAIN}"
+        - host: "{{ .Release.Name }}.jory.dev"
           paths:
           - path: /
             service:
@@ -98,6 +98,6 @@ spec:
       data:
         type: nfs
         server: voyager.internal
-        path: ${SECRET_NFS_DATA:=temp}
+        path: /mnt/user/data
         globalMounts:
         - path: /data

kubernetes/main/apps/downloads/sabnzbd/app/helmrelease.yaml

@@ -42,7 +42,7 @@ spec:
               TZ: ${TIMEZONE}
               SABNZBD__PORT: &port 8080
               SABNZBD__HOST_WHITELIST_ENTRIES: >-
-                sabnzbd, sabnzbd.downloads, sabnzbd.downloads.svc, sabnzbd.downloads.svc.cluster, sabnzbd.downloads.svc.cluster.local, sabnzbd.${SECRET_DOMAIN}
+                sabnzbd, sabnzbd.downloads, sabnzbd.downloads.svc, sabnzbd.downloads.svc.cluster, sabnzbd.downloads.svc.cluster.local, sabnzbd.jory.dev
             envFrom:
             - secretRef:
                 name: sabnzbd-secret
@@ -105,7 +105,7 @@ spec:
           gethomepage.dev/widget.url: http://sabnzbd.downloads:8080
           gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_SABNZBD_TOKEN}}` }}"
         hosts:
-        - host: "{{ .Release.Name }}.${SECRET_DOMAIN}"
+        - host: "{{ .Release.Name }}.jory.dev"
           paths:
           - path: /
             service:
@@ -117,7 +117,7 @@ spec:
       downloads:
         type: nfs
         server: voyager.internal
-        path: ${SECRET_NFS_DATA:=temp}
+        path: /mnt/user/data
         globalMounts:
         - path: /downloads
           subPath: usenet

kubernetes/main/apps/downloads/sonarr/app/helmrelease.yaml

@@ -100,7 +100,7 @@ spec:
           gethomepage.dev/widget.url: http://sonarr.downloads
           gethomepage.dev/widget.key: "{{ `{{HOMEPAGE_VAR_SONARR_TOKEN}}` }}"
         hosts:
-        - host: "{{ .Release.Name }}.${SECRET_DOMAIN}"
+        - host: "{{ .Release.Name }}.jory.dev"
           paths:
           - path: /
             service:
@@ -125,6 +125,6 @@ spec:
       data:
         type: nfs
         server: voyager.internal
-        path: ${SECRET_NFS_DATA:=temp}
+        path: /mnt/user/data
         globalMounts:
         - path: /data

kubernetes/main/apps/flux-system/clickops/app/helmrelease.yaml

@@ -36,7 +36,7 @@ spec:
               TZ: ${TIMEZONE}
               # not used
               __PORT: &port 3000
-              __HOST: &host "clickops.${SECRET_DOMAIN}"
+              __HOST: &host "clickops.jory.dev"
             probes:
               liveness: &probe
                 enabled: true
@@ -82,7 +82,7 @@ spec:
       app:
         className: internal
         hosts:
-          - host: "{{ .Release.Name }}.${SECRET_DOMAIN}"
+          - host: "{{ .Release.Name }}.jory.dev"
             paths:
               - path: /
                 pathType: Prefix