test: add e2e auth flow test script

Validates JWT auth, identity claims, X-Service dispatch, and
auth endpoints against live cluster. 16 tests across 5 scenarios.

15/16 pass (1 skipped: poimen-memory pods down).

Closes #14

Co-authored-by: poimen <[email protected]>

.env.example

@@ -31,17 +31,6 @@ AUTHENTIK_BOOTSTRAP_TOKEN=
 #   openssl rand -base64 24
 AUTHENTIK_PG_PASSWORD=
 
-# ── ZITADEL (Authentik replacement) ─────────────────────────────────────────────
-# Instance URL, same hostname as the OIDC issuer.
-ZITADEL_URL="https://zitadel.riotpiao.com"
-
-# PAT of the 'iam-admin' machine user, created by the chart's setup job on the
-# first sync. Leave empty until then. Read it with:
-#   kubectl -n iam get secret iam-admin-pat -o jsonpath='{.data.pat}' | base64 -d
-# scripts/iam/zitadel-provision.py reads this variable first, then the cluster
-# Secret. The masterkey and the client secrets never live in this file.
-ZITADEL_BOOTSTRAP_TOKEN=
-
 # ── MinIO ──────────────────────────────────────────────────────────────────────
 MINIO_ROOT_USER=
 MINIO_ROOT_PASSWORD=

.gitignore

@@ -47,15 +47,6 @@ k8s/storage/test/test
 terraform/.terraform/
 terraform/*.tfstate
 terraform/*.tfstate.*
-# The Zitadel root module keeps its own state (see terraform/zitadel/providers.tf).
-# That state carries generated client secrets and machine keys.
-terraform/zitadel/*.tfstate
-terraform/zitadel/*.tfstate.*
-terraform/zitadel/*.tfvars
-terraform/edge/*.tfstate
-terraform/edge/*.tfstate.*
-terraform/edge/*.tfvars
-terraform/edge/terraform.tfvars.local
 terraform.tfvars.local
 skills-lock.json
 secrets-plaintext.yaml
@@ -78,14 +69,3 @@ k8s/**/*-secret.yaml
 
 # IAM provisioning scripts contain credential references — never commit
 scripts/iam/*.py
-# Exception: this one reads every credential from the cluster at run time and
-# embeds none. Keep it reviewable in git.
-!scripts/iam/zitadel-provision.py
-
-# Runtime credential export from the old Authentik provisioning run. Holds live
-# M2M tokens; never commit it.
-/authentik-m2m-tokens.env
-
-# Never commit backup copies of plaintext tfvars (they carry cluster PKI)
-terraform/*.bak
-terraform/edge/.secrets/

.pi/loops/loops-01a16cb7-780d-72af-bac3-487935898ff3.json

@@ -1,22 +0,0 @@
-{
-  "nextId": 2,
-  "loops": [
-    {
-      "id": "1",
-      "prompt": "Check Longhorn and CNPG recovery progress in the homelab cluster and report terse. Run: kubectl -n longhorn-system get volumes.longhorn.io -o json (count by state/robustness), kubectl -n longhorn-system get replicas.longhorn.io -o json (count running/stopped/failed), kubectl get clusters.postgresql.cnpg.io -A (ready instances per cluster), kubectl -n cicd get pods,pvc | grep forgejo-db. Report: volumes healthy vs degraded, replicas running vs stopped, and each CNPG cluster ready count. If every volume is attached/healthy and every CNPG cluster shows 3/3 ready, say RECOVERED, list any leftover anomalies, and stop this loop with LoopDelete. Otherwise name what is still rebuilding and keep going.",
-      "trigger": {
-        "type": "cron",
-        "schedule": "*/5 * * * *"
-      },
-      "status": "expired",
-      "recurring": true,
-      "createdAt": 1792898370946,
-      "updatedAt": 1792901371403,
-      "expiresAt": 1793503170946,
-      "source": "tool",
-      "readOnly": true,
-      "maxFires": 6,
-      "fireCount": 6
-    }
-  ]
-}

.sops.yaml

@@ -2,5 +2,4 @@ creation_rules:
   # `secrets?` — singular too. A `seed-repo-secret.yaml` once slipped this regex
   # and was committed in plaintext to a public remote.
   - path_regex: k8s/.*secrets?.*\.ya?ml
-    encrypted_regex: ^(data|stringData)$
     age: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla

AUTH_INTEGRATION.md

@@ -0,0 +1,206 @@
+# Authentik Auth Integration for NextJS
+
+## Current State
+
+### Gateway Auth Status
+
+| Endpoint | Auth Status | Notes |
+|----------|-------------|-------|
+| `/v1/chat/completions` | ❌ **OFF** | LLM routes have no auth middleware |
+| `/v1/embeddings` | ❌ **OFF** | Same - no auth |
+| `/v1/rerank` | ❌ **OFF** | Same - no auth |
+| `X-Service: sqs` | ✅ **ON** | JWT validated via `internal/auth/jwt.go` |
+| `/workflow` | ❌ **OFF** | Pass-through to Temporal |
+
+**Auth module exists** at `homelab-frontend/internal/auth/jwt.go` but only wired for SQS.
+LLM routes in `internal/proxy/proxy.go` have no auth middleware.
+
+### Authentik App
+
+Authentik app `local-llm` exists for LLM API auth:
+- **Client ID**: `local-llm`
+- **Client Secret**: `kubectl -n llm-serving get secret local-llm-jwt -o jsonpath='{.data.client-secret}' | base64 -d`
+- **Token endpoint**: `https://authentik.riotpiao.com/application/o/token/`
+- **Userinfo endpoint**: `https://authentik.riotpiao.com/application/o/userinfo/`
+- **OIDC discovery**: `https://authentik.riotpiao.com/application/o/local-llm/.well-known/openid-configuration`
+
+## Sign-in Methods
+
+### 1. Resource Owner Password Credentials (ROPC)
+
+Direct username/password login. Server-side only (needs client_secret).
+
+```typescript
+// API Route: app/api/auth/login/route.ts
+const response = await fetch('https://authentik.riotpiao.com/application/o/token/', {
+  method: 'POST',
+  headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+  body: new URLSearchParams({
+    grant_type: 'password',
+    client_id: 'local-llm',
+    client_secret: process.env.AUTHENTIK_CLIENT_SECRET,
+    username: '[email protected]',
+    password: 'userpassword',
+    scope: 'openid email profile groups',
+  }),
+});
+
+const tokens = await response.json();
+// { access_token, refresh_token, expires_in, token_type }
+```
+
+### 2. Authorization Code Flow (Browser Redirect)
+
+Requires adding redirect URIs to `local-llm` Authentik app:
+
+```python
+# In k8s/infra/iam/scripts/authentik-provision.py, update:
+"local-llm": {
+    ...
+    "redirect_uris": [
+        "http://localhost:3000/api/auth/callback",  # dev
+        "https://your-nextjs-app.com/api/auth/callback",  # prod
+    ],
+}
+```
+
+Then standard OIDC flow:
+1. Redirect to `https://authentik.riotpiao.com/application/o/authorize/?client_id=local-llm&redirect_uri=...&response_type=code&scope=openid email profile groups`
+2. User logs in via Authentik UI
+3. Callback receives `code`, exchange for tokens
+
+## JWT Token Persistence
+
+### Browser (localStorage)
+
+```typescript
+const TOKEN_KEY = 'llm_auth_token';
+
+// Save
+localStorage.setItem(TOKEN_KEY, JSON.stringify({
+  access_token: tokens.access_token,
+  refresh_token: tokens.refresh_token,
+  expires_at: Date.now() + tokens.expires_in * 1000,
+}));
+
+// Load
+const stored = JSON.parse(localStorage.getItem(TOKEN_KEY) || 'null');
+if (stored && stored.expires_at > Date.now()) {
+  // Token valid
+}
+
+// Clear (logout)
+localStorage.removeItem(TOKEN_KEY);
+```
+
+### Server-side (HTTP-only cookies)
+
+```typescript
+// app/api/auth/login/route.ts
+import { cookies } from 'next/headers';
+
+// After successful login
+cookies().set('llm_auth_token', JSON.stringify(tokens), {
+  httpOnly: true,
+  secure: process.env.NODE_ENV === 'production',
+  sameSite: 'lax',
+  maxAge: tokens.expires_in,
+  path: '/',
+});
+
+// Read in middleware or API routes
+const tokenCookie = cookies().get('llm_auth_token');
+const tokens = JSON.parse(tokenCookie?.value || 'null');
+```
+
+## Token Refresh
+
+```typescript
+async function refreshAccessToken(refresh_token: string) {
+  const response = await fetch('https://authentik.riotpiao.com/application/o/token/', {
+    method: 'POST',
+    headers: { 'Content-Type': 'application/x-www-form-urlencoded' },
+    body: new URLSearchParams({
+      grant_type: 'refresh_token',
+      client_id: 'local-llm',
+      client_secret: process.env.AUTHENTIK_CLIENT_SECRET,
+      refresh_token,
+    }),
+  });
+  return response.json();
+}
+```
+
+## Environment Variables
+
+```bash
+# .env.local
+AUTHENTIK_URL=https://authentik.riotpiao.com
+AUTHENTIK_CLIENT_ID=local-llm
+AUTHENTIK_CLIENT_SECRET=<from-secret>
+
+# For client-side (public)
+NEXT_PUBLIC_AUTHENTIK_URL=https://authentik.riotpiao.com
+NEXT_PUBLIC_AUTHENTIK_CLIENT_ID=local-llm
+```
+
+## Using Token with LLM API
+
+```typescript
+const token = await getValidToken(); // from localStorage or cookie
+
+const response = await fetch('https://api.riotpiao.com/v1/chat/completions', {
+  method: 'POST',
+  headers: {
+    'Content-Type': 'application/json',
+    'Authorization': `Bearer ${token}`,  // JWT from Authentik
+  },
+  body: JSON.stringify({
+    model: 'reasoning',
+    messages: [{ role: 'user', content: 'Hello' }],
+  }),
+});
+```
+
+## TODO
+
+### Gateway-side (homelab-frontend)
+
+- [ ] Wire `internal/auth/jwt.go` into LLM proxy handler (`internal/proxy/proxy.go`)
+- [ ] Add `authRequired: true` to model config or create LLM-specific middleware
+- [ ] Example pattern from SQS (in `internal/serviceadapter/router.go`):
+
+```go
+// In proxy.go ServeHTTP, before dispatching to LLM upstream:
+if strings.HasPrefix(r.URL.Path, "/v1/") {
+    authHeader := r.Header.Get("Authorization")
+    claims, err := llmJWTAuth.ValidateBearerToken(authHeader)
+    if err != nil {
+        // Return 401/403
+    }
+    if !llmJWTAuth.CheckPermissions(claims, "llm:inference", "*") {
+        // Return 403 insufficient permissions
+    }
+}
+```
+
+### Authentik-side
+
+- [ ] Enable ROPC grant in Authentik provider settings (if not already)
+- [ ] Add redirect URIs to `local-llm` app if browser OAuth flow needed:
+
+```python
+# k8s/infra/iam/scripts/authentik-provision.py
+"local-llm": {
+    ...
+    "redirect_uris": [
+        "http://localhost:3000/api/auth/callback",
+        "https://your-app.com/api/auth/callback",
+    ],
+}
+```
+
+### NextJS-side
+
+- [ ] Until gateway auth is wired, LLM API works without token
+- [ ] Once wired, add `Authorization: Bearer <token>` to all LLM requests

diagram/poimen-schema-relations.architecture.json

@@ -1,37 +0,0 @@
-{
-  "schema_version": 1,
-  "diagram_type": "architecture",
-  "meta": {
-    "title": "Poimen Memory — Schema Relations",
-    "quality_profile": "showcase",
-    "viewBox": [900, 480]
-  },
-  "components": [
-    { "id": "node", "type": "database", "label": "memory_node", "sublabel": "Episodes (raw messages)", "pos": [40, 60], "size": [150, 55], "tag": "BIGSERIAL" },
-    { "id": "entity", "type": "database", "label": "memory_entity", "sublabel": "Extracted entities", "pos": [260, 60], "size": [150, 55], "tag": "UUID" },
-    { "id": "edge", "type": "database", "label": "memory_edge", "sublabel": "Facts / relationships", "pos": [480, 60], "size": [150, 55], "tag": "UUID" },
-    { "id": "community", "type": "database", "label": "memory_community", "sublabel": "Entity clusters", "pos": [700, 60], "size": [150, 55], "tag": "UUID" },
-    { "id": "pgvector", "type": "cloud", "label": "pgvector HNSW", "sublabel": "768-dim cosine search", "pos": [140, 260], "size": [160, 55], "tag": "nomic-embed-v2" },
-    { "id": "tsvector", "type": "cloud", "label": "pg ts_rank", "sublabel": "Full-text search", "pos": [400, 260], "size": [160, 55], "tag": "GIN index" },
-    { "id": "tenant", "type": "security", "label": "tenant_id", "sublabel": "Multi-tenant isolation", "pos": [660, 260], "size": [140, 55], "tag": "W7 / mig 014" }
-  ],
-  "boundaries": [
-    { "kind": "region", "label": "Temporal Knowledge Graph (Zep §2)", "wraps": ["node", "entity", "edge", "community"] },
-    { "kind": "security-group", "label": "Search & Isolation", "wraps": ["pgvector", "tsvector", "tenant"] }
-  ],
-  "connections": [
-    { "id": "node-entity", "from": "node", "to": "entity", "variant": "emphasis" },
-    { "id": "entity-edge", "from": "entity", "to": "edge", "variant": "emphasis" },
-    { "id": "entity-community", "from": "community", "to": "entity", "variant": "dashed" },
-    { "id": "edge-node", "from": "edge", "to": "node", "variant": "dashed" },
-    { "id": "entity-vec", "from": "entity", "to": "pgvector", "variant": "default" },
-    { "id": "entity-fts", "from": "entity", "to": "tsvector", "variant": "dashed" },
-    { "id": "edge-fts", "from": "edge", "to": "tsvector", "variant": "dashed" },
-    { "id": "tenant-all", "from": "tenant", "to": "entity", "variant": "security" }
-  ],
-  "cards": [
-    { "dot": "emerald", "title": "Three-Tier Graph", "items": ["memory_node → episode subgraph", "memory_entity → entity subgraph", "memory_edge → fact relationships", "memory_community → clusters (Phase 4)"] },
-    { "dot": "rose", "title": "Bi-Temporal", "items": ["t_valid / t_invalid: event time", "t_created / t_expired: transaction time", "Contradiction: active → candidate → confirmed"] },
-    { "dot": "cyan", "title": "Search", "items": ["HNSW: name, summary, fact embeddings", "ts_rank: BM25 fallback (always available)", "tenant_id: per-table isolation (mig 014)"] }
-  ]
-}

diagram/poimen-schema-relations.dataflow.json

@@ -1,158 +0,0 @@
-{
-  "schema_version": 1,
-  "diagram_type": "dataflow",
-  "meta": {
-    "title": "Poimen Memory \u2014 Schema Relations",
-    "viewBox": [
-      960,
-      480
-    ],
-    "quality_profile": "showcase"
-  },
-  "stages": [
-    {
-      "label": "Episodes"
-    },
-    {
-      "label": "Entities"
-    },
-    {
-      "label": "Relationships"
-    },
-    {
-      "label": "Indexes"
-    }
-  ],
-  "nodes": [
-    {
-      "id": "node",
-      "type": "database",
-      "label": "memory_node",
-      "sublabel": "Raw messages",
-      "stage": 0,
-      "row": 0,
-      "tag": "BIGSERIAL"
-    },
-    {
-      "id": "entity",
-      "type": "database",
-      "label": "memory_entity",
-      "sublabel": "Named entities",
-      "stage": 1,
-      "row": 0,
-      "tag": "UUID + tenant_id"
-    },
-    {
-      "id": "community",
-      "type": "database",
-      "label": "memory_community",
-      "sublabel": "Clusters (Phase 4)",
-      "stage": 1,
-      "row": 1,
-      "tag": "UUID"
-    },
-    {
-      "id": "edge",
-      "type": "database",
-      "label": "memory_edge",
-      "sublabel": "Facts + bi-temporal",
-      "stage": 2,
-      "row": 0,
-      "tag": "UUID + tenant_id"
-    },
-    {
-      "id": "hnsw",
-      "type": "cloud",
-      "label": "HNSW Index",
-      "sublabel": "768-dim cosine",
-      "stage": 3,
-      "row": 0,
-      "tag": "pgvector"
-    },
-    {
-      "id": "fts",
-      "type": "cloud",
-      "label": "GIN Index",
-      "sublabel": "ts_rank BM25",
-      "stage": 3,
-      "row": 1,
-      "tag": "full-text"
-    }
-  ],
-  "flows": [
-    {
-      "from": "node",
-      "to": "entity",
-      "label": "LLM extraction",
-      "classification": "ingest",
-      "variant": "emphasis",
-      "route": "straight"
-    },
-    {
-      "from": "entity",
-      "to": "edge",
-      "label": "source + target FK",
-      "classification": "foreign key",
-      "variant": "emphasis",
-      "route": "straight"
-    },
-    {
-      "from": "entity",
-      "to": "community",
-      "label": "community_id",
-      "classification": "membership",
-      "variant": "dashed",
-      "route": "straight",
-      "labelDy": 30
-    },
-    {
-      "from": "edge",
-      "to": "hnsw",
-      "classification": "vector",
-      "variant": "default",
-      "route": "straight",
-      "label": "embedding",
-      "labelDy": -30
-    },
-    {
-      "from": "edge",
-      "to": "fts",
-      "label": "fact text",
-      "classification": "text",
-      "variant": "dashed",
-      "route": "vertical-channel",
-      "labelDy": 30
-    }
-  ],
-  "cards": [
-    {
-      "dot": "emerald",
-      "title": "Three-Tier Graph",
-      "items": [
-        "memory_node \u2192 episodes (raw messages)",
-        "memory_entity \u2192 extracted entities",
-        "memory_edge \u2192 facts between entities",
-        "memory_community \u2192 clusters (Phase 4)"
-      ]
-    },
-    {
-      "dot": "rose",
-      "title": "Bi-Temporal + Tenant",
-      "items": [
-        "t_valid/t_invalid: when true in reality",
-        "t_created/t_expired: system transaction time",
-        "tenant_id: row-level multi-tenant isolation",
-        "Contradiction: active \u2192 candidate \u2192 confirmed"
-      ]
-    },
-    {
-      "dot": "cyan",
-      "title": "Search Indexes",
-      "items": [
-        "HNSW: name, summary, fact embeddings",
-        "GIN: ts_rank on name+summary and fact",
-        "RRF fusion: sem_weight + lex_weight"
-      ]
-    }
-  ]
-}

diagram/rbac-delegation-flow.sequence.json

@@ -1,63 +0,0 @@
-{
-  "schema_version": 1,
-  "diagram_type": "sequence",
-  "meta": {
-    "title": "Service Acting on Behalf of User",
-    "viewBox": [1000, 600],
-    "column_fit": "spread",
-    "quality_profile": "showcase"
-  },
-  "participants": [
-    { "id": "user", "type": "external", "label": "User", "sublabel": "browser" },
-    { "id": "app", "type": "frontend", "label": "Web App", "sublabel": "poimen UI" },
-    { "id": "authentik", "type": "security", "label": "Authentik", "sublabel": "OIDC" },
-    { "id": "worker", "type": "backend", "label": "Backend Worker", "sublabel": "temporal/queue" },
-    { "id": "memory", "type": "backend", "label": "Memory API", "sublabel": "poimen-memory" },
-    { "id": "jwks", "type": "security", "label": "JWKS", "sublabel": "RS256" }
-  ],
-  "segments": [
-    { "from": 150, "to": 260, "label": "User Auth" },
-    { "from": 270, "to": 370, "label": "Delegation" },
-    { "from": 380, "to": 510, "label": "Downstream" }
-  ],
-  "messages": [
-    { "id": "login", "from": "user", "to": "app", "y": 165, "label": "login (OIDC)", "variant": "default" },
-    { "id": "oidc-flow", "from": "app", "to": "authentik", "y": 200, "label": "authorization_code flow", "variant": "emphasis" },
-    { "id": "user-jwt", "from": "authentik", "to": "app", "y": 235, "label": "user JWT {groups,roles}", "variant": "return" },
-    { "id": "trigger-job", "from": "user", "to": "app", "y": 285, "label": "trigger async job", "variant": "default" },
-    { "id": "queue-job", "from": "app", "to": "worker", "y": 320, "label": "enqueue job + user JWT", "variant": "emphasis", "note": "JWT passed as job metadata" },
-    { "id": "job-ack", "from": "worker", "to": "app", "y": 355, "label": "job queued", "variant": "return" },
-    { "id": "call-memory", "from": "worker", "to": "memory", "y": 400, "label": "POST /memory/ingest", "variant": "emphasis", "note": "Bearer <user JWT>" },
-    { "id": "fetch-jwks", "from": "memory", "to": "jwks", "y": 435, "label": "GET /jwks", "variant": "dashed" },
-    { "id": "jwks-keys", "from": "jwks", "to": "memory", "y": 470, "label": "RSA pubkey", "variant": "return" },
-    { "id": "ingest-ok", "from": "memory", "to": "worker", "y": 505, "label": "202 Accepted", "variant": "return", "note": "uses USER's groups/roles" }
-  ],
-  "activations": [
-    { "participant": "user", "from": 160, "to": 291, "type": "external" },
-    { "participant": "app", "from": 165, "to": 361, "type": "frontend" },
-    { "participant": "authentik", "from": 195, "to": 241, "type": "security" },
-    { "participant": "worker", "from": 315, "to": 511, "type": "backend" },
-    { "participant": "memory", "from": 395, "to": 511, "type": "backend" },
-    { "participant": "jwks", "from": 430, "to": 476, "type": "security" }
-  ],
-  "cards": [
-    {
-      "dot": "emerald",
-      "title": "Delegation Pattern",
-      "items": [
-        "User JWT travels with the job payload",
-        "Worker uses user's token for downstream",
-        "Memory sees USER as the principal"
-      ]
-    },
-    {
-      "dot": "rose",
-      "title": "Security Model",
-      "items": [
-        "No service-account escalation",
-        "User's permissions bound the action",
-        "Audit trail traces to user.sub"
-      ]
-    }
-  ]
-}

diagram/rbac-fine-grained.architecture.json

@@ -1,42 +0,0 @@
-{
-  "schema_version": 1,
-  "diagram_type": "architecture",
-  "meta": {
-    "title": "Memory Service Fine-Grained RBAC",
-    "quality_profile": "showcase",
-    "viewBox": [900, 520]
-  },
-  "components": [
-    { "id": "jwt", "type": "security", "label": "JWT Token", "sublabel": "groups[] + roles[]", "pos": [40, 60], "size": [140, 60], "tag": "Authentik" },
-    { "id": "cap-check", "type": "backend", "label": "Capability Check", "sublabel": "has_capability()", "pos": [260, 60], "size": [160, 60], "tag": "Phase 1" },
-    { "id": "scope-checker", "type": "backend", "label": "Scope Checker", "sublabel": "filter_resources()", "pos": [500, 60], "size": [160, 60], "tag": "Phase 2" },
-    { "id": "decision", "type": "backend", "label": "AccessDecision", "sublabel": "Allow / Deny", "pos": [740, 60], "size": [130, 60] },
-    { "id": "project-scope", "type": "database", "label": "ProjectScope", "sublabel": "dev/staging/prod/*", "pos": [40, 200], "size": [140, 55] },
-    { "id": "visibility-scope", "type": "database", "label": "VisibilityScope", "sublabel": "public/private", "pos": [220, 200], "size": [140, 55] },
-    { "id": "owner-scope", "type": "database", "label": "OwnerScope", "sublabel": "self/any/user", "pos": [400, 200], "size": [140, 55] },
-    { "id": "group-scope", "type": "database", "label": "GroupScope", "sublabel": "in_any_group()", "pos": [580, 200], "size": [140, 55] },
-    { "id": "entities", "type": "database", "label": "Entities", "sublabel": "memory_entity", "pos": [40, 340], "size": [120, 50] },
-    { "id": "edges", "type": "database", "label": "Edges", "sublabel": "memory_edge", "pos": [200, 340], "size": [120, 50] },
-    { "id": "projects", "type": "database", "label": "Projects", "sublabel": "project_id", "pos": [360, 340], "size": [120, 50] },
-    { "id": "convos", "type": "database", "label": "Conversations", "sublabel": "owner_id", "pos": [520, 340], "size": [120, 50] }
-  ],
-  "boundaries": [
-    { "kind": "security-group", "label": "Access Control Pipeline", "wraps": ["cap-check", "scope-checker", "decision"] },
-    { "kind": "region", "label": "Scope Checkers", "wraps": ["project-scope", "visibility-scope", "owner-scope", "group-scope"] },
-    { "kind": "region", "label": "Protected Resources", "wraps": ["entities", "edges", "projects", "convos"] }
-  ],
-  "connections": [
-    { "id": "jwt-to-cap", "from": "jwt", "to": "cap-check", "label": "claims", "variant": "emphasis" },
-    { "id": "cap-to-scope", "from": "cap-check", "to": "scope-checker", "variant": "emphasis" },
-    { "id": "scope-to-decision", "from": "scope-checker", "to": "decision", "variant": "emphasis" },
-    { "id": "scope-to-proj", "from": "scope-checker", "to": "project-scope", "variant": "dashed", "fromSide": "bottom", "toSide": "top" },
-    { "id": "scope-to-vis", "from": "scope-checker", "to": "visibility-scope", "variant": "dashed", "fromSide": "bottom", "toSide": "top" },
-    { "id": "scope-to-owner", "from": "scope-checker", "to": "owner-scope", "variant": "dashed", "fromSide": "bottom", "toSide": "top" },
-    { "id": "scope-to-group", "from": "scope-checker", "to": "group-scope", "variant": "dashed", "fromSide": "bottom", "toSide": "top" }
-  ],
-  "cards": [
-    { "dot": "emerald", "title": "Phase 1: Capability", "items": ["has_capability(memory:read)", "Checks roles[] claim", "Binary allow/deny"] },
-    { "dot": "rose", "title": "Phase 2: Scope", "items": ["Project: dev/staging/prod", "Visibility: public/private", "Owner: self-owned only", "Group: poimen-admins/devs"] },
-    { "dot": "cyan", "title": "JWT Claims", "items": ["groups: user.groups", "roles: attributes.roles", "permissions: group names"] }
-  ]
-}

diagram/rbac-m2m-flow.sequence.json

@@ -1,54 +0,0 @@
-{
-  "schema_version": 1,
-  "diagram_type": "sequence",
-  "meta": {
-    "title": "Service-to-Service (M2M) Authentication",
-    "viewBox": [1080, 520],
-    "column_fit": "spread",
-    "quality_profile": "showcase"
-  },
-  "participants": [
-    { "id": "worker", "type": "backend", "label": "Ingest Worker", "sublabel": "temporal/cron" },
-    { "id": "authentik", "type": "security", "label": "Authentik", "sublabel": "OIDC provider" },
-    { "id": "memory", "type": "backend", "label": "Memory Service", "sublabel": "poimen-memory" },
-    { "id": "jwks", "type": "security", "label": "JWKS", "sublabel": "RS256 keys" }
-  ],
-  "segments": [
-    { "from": 150, "to": 230, "label": "Token Mint" },
-    { "from": 240, "to": 380, "label": "API + RBAC" }
-  ],
-  "messages": [
-    { "id": "token-req", "from": "worker", "to": "authentik", "y": 165, "label": "POST /token grant_type=password", "variant": "emphasis", "note": "client_id + username + app_password + scope" },
-    { "id": "jwt-resp", "from": "authentik", "to": "worker", "y": 205, "label": "JWT {groups,roles,aud,iss}", "variant": "return", "note": "groups=[poimen-admins] roles=[memory:write]" },
-    { "id": "api-call", "from": "worker", "to": "memory", "y": 260, "label": "POST /memory/ingest", "variant": "emphasis", "note": "Authorization: Bearer <JWT>" },
-    { "id": "fetch-jwks", "from": "memory", "to": "jwks", "y": 295, "label": "GET /jwks (cached)", "variant": "dashed" },
-    { "id": "jwks-resp", "from": "jwks", "to": "memory", "y": 330, "label": "RSA pubkey (kid)", "variant": "return" },
-    { "id": "verify-ok", "from": "memory", "to": "worker", "y": 365, "label": "202 Accepted", "variant": "return", "note": "sig ✓ iss ✓ aud ✓ has_capability ✓" }
-  ],
-  "activations": [
-    { "participant": "worker", "from": 160, "to": 371, "type": "backend" },
-    { "participant": "authentik", "from": 165, "to": 211, "type": "security" },
-    { "participant": "memory", "from": 255, "to": 371, "type": "backend" },
-    { "participant": "jwks", "from": 290, "to": 336, "type": "security" }
-  ],
-  "cards": [
-    {
-      "dot": "emerald",
-      "title": "M2M Pattern",
-      "items": [
-        "grant_type=password (Authentik aliases client_credentials)",
-        "App-password token authenticates the service account",
-        "NOT client_secret — that creates nameless SA"
-      ]
-    },
-    {
-      "dot": "rose",
-      "title": "JWT Claims",
-      "items": [
-        "groups: from user.groups (poimen-admins)",
-        "roles: from user.attributes.roles",
-        "iss/aud: per-provider issuer"
-      ]
-    }
-  ]
-}

diagram/rbac-user-flow.sequence.json

@@ -1,61 +0,0 @@
-{
-  "schema_version": 1,
-  "diagram_type": "sequence",
-  "meta": {
-    "title": "User Direct Access with JWT",
-    "viewBox": [1000, 640],
-    "column_fit": "spread",
-    "quality_profile": "showcase"
-  },
-  "participants": [
-    { "id": "user", "type": "external", "label": "User", "sublabel": "browser" },
-    { "id": "app", "type": "frontend", "label": "Web App", "sublabel": "poimen UI" },
-    { "id": "authentik", "type": "security", "label": "Authentik", "sublabel": "OIDC provider" },
-    { "id": "memory", "type": "backend", "label": "Memory API", "sublabel": "poimen-memory" },
-    { "id": "jwks", "type": "security", "label": "JWKS", "sublabel": "RS256 keys" }
-  ],
-  "segments": [
-    { "from": 150, "to": 370, "label": "OIDC Login" },
-    { "from": 380, "to": 540, "label": "API + RBAC" }
-  ],
-  "messages": [
-    { "id": "click-login", "from": "user", "to": "app", "y": 165, "label": "click Login", "variant": "default" },
-    { "id": "redirect-auth", "from": "app", "to": "authentik", "y": 200, "label": "redirect /authorize", "variant": "emphasis", "note": "scope=openid groups roles" },
-    { "id": "show-login", "from": "authentik", "to": "user", "y": 235, "label": "login form", "variant": "default" },
-    { "id": "submit-creds", "from": "user", "to": "authentik", "y": 270, "label": "username + password", "variant": "security" },
-    { "id": "auth-code", "from": "authentik", "to": "app", "y": 305, "label": "redirect ?code=xxx", "variant": "return" },
-    { "id": "exchange-token", "from": "app", "to": "authentik", "y": 340, "label": "POST /token code=xxx", "variant": "emphasis" },
-    { "id": "jwt-resp", "from": "authentik", "to": "app", "y": 375, "label": "JWT {groups,roles,sub}", "variant": "return" },
-    { "id": "query-api", "from": "app", "to": "memory", "y": 420, "label": "GET /memory/query", "variant": "emphasis", "note": "Authorization: Bearer <JWT>" },
-    { "id": "fetch-jwks", "from": "memory", "to": "jwks", "y": 455, "label": "GET /jwks (cached)", "variant": "dashed" },
-    { "id": "jwks-keys", "from": "jwks", "to": "memory", "y": 490, "label": "RSA pubkey", "variant": "return" },
-    { "id": "query-resp", "from": "memory", "to": "app", "y": 525, "label": "200 JSON results", "variant": "return", "note": "has_capability(memory:read) ✓" }
-  ],
-  "activations": [
-    { "participant": "user", "from": 160, "to": 276, "type": "external" },
-    { "participant": "app", "from": 165, "to": 531, "type": "frontend" },
-    { "participant": "authentik", "from": 195, "to": 381, "type": "security" },
-    { "participant": "memory", "from": 415, "to": 531, "type": "backend" },
-    { "participant": "jwks", "from": 450, "to": 496, "type": "security" }
-  ],
-  "cards": [
-    {
-      "dot": "emerald",
-      "title": "Authorization Code Flow",
-      "items": [
-        "User authenticates directly with Authentik",
-        "App exchanges code for JWT",
-        "Scopes: openid groups roles permissions"
-      ]
-    },
-    {
-      "dot": "rose",
-      "title": "JWT Contents",
-      "items": [
-        "iss: .../application/o/poimen/",
-        "aud: poimen (provider client_id)",
-        "groups: user's group memberships"
-      ]
-    }
-  ]
-}

k8s/apps/cloudflared/configmap.yaml

@@ -1,56 +0,0 @@
-# cloudflared ingress configuration.
-#
-# This list is the tunnel's routing table: for each incoming hostname the
-# connector dials the matching origin. The final rule is a catch-all, so a
-# hostname absent from this list gets 404 from the connector — DNS alone does
-# not route a request into a service.
-#
-# Management model: this file makes the tunnel LOCALLY managed. cloudflared is
-# given a credentials file instead of a token, so Cloudflare stops pushing the
-# remotely-managed ingess list and this ConfigMap wins. Revert the Deployment to
-# `run --token` to return to the dashboard-managed list.
-#
-# Origin services self-reference the public hostname. That resolves because
-# CoreDNS rewrites each of these names to ingress-nginx
-# (terraform/files/coredns/Corefile), so the connector reaches the in-cluster
-# ingress instead of looping back out through Cloudflare.
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: cloudflared-config
-  namespace: cloudflared
-data:
-  config.yml: |
-    tunnel: 32d0bf93-e1bd-45b8-93a9-71ff9f83de80
-    credentials-file: /etc/cloudflared/creds/credentials.json
-
-    # WARP-to-Tunnel routing. The remotely-managed config had this enabled;
-    # dropping the key would break WARP access to private addresses. cloudflared
-    # 2026.x has no `enabled` field — the key's presence is what enables it, and
-    # `enabled: true` here makes the binary warn about an unused key.
-    warp-routing: {}
-
-    ingress:
-      - hostname: paperless.riotpiao.com
-        service: https://paperless.riotpiao.com
-      - hostname: img.riotpiao.com
-        service: https://img.riotpiao.com
-      - hostname: riotpiao.com
-        service: https://riotpiao.com
-      - hostname: grafana.riotpiao.com
-        service: https://grafana.riotpiao.com
-      - hostname: gotify.riotpiao.com
-        service: https://gotify.riotpiao.com
-      - hostname: igotify.riotpiao.com
-        service: https://igotify.riotpiao.com
-      - hostname: poimen.riotpiao.com
-        service: https://poimen.riotpiao.com
-      - hostname: comfyui.riotpiao.com
-        service: https://comfyui.riotpiao.com
-      - hostname: forgejo.riotpiao.com
-        service: https://forgejo.riotpiao.com
-      # ZITADEL. Without this rule the connector answers 404 for the hostname
-      # even though the DNS CNAME points at the tunnel.
-      - hostname: zitadel.riotpiao.com
-        service: https://zitadel.riotpiao.com
-      - service: http_status:404

k8s/apps/cloudflared/deployment.yaml

@@ -13,63 +13,21 @@ spec:
       labels:
         app: cloudflared
     spec:
-      # Ingress-nginx forces HTTPS (force-ssl-redirect), so cloudflared must
-      # dial https://<hostname> and trust homelab-ca or the TLS handshake fails
-      # with "certificate signed by unknown authority". Same pattern as
-      # iam values: merge the system bundle with homelab-ca.crt.
-      initContainers:
-        - name: merge-ca-certs
-          image: debian:bookworm
-          imagePullPolicy: IfNotPresent
-          securityContext:
-            runAsUser: 0
-          command:
-            - sh
-            - -c
-            - (cat /etc/ssl/certs/ca-certificates.crt 2>/dev/null; cat /homelab-ca/ca.crt) > /merged/ca-bundle.crt
-          volumeMounts:
-            - name: homelab-ca
-              mountPath: /homelab-ca
-              readOnly: true
-            - name: merged-ca
-              mountPath: /merged
-      volumes:
-        - name: config
-          configMap:
-            name: cloudflared-config
-        - name: credentials
-          secret:
-            secretName: cloudflared-credentials
-        - name: homelab-ca
-          configMap:
-            name: homelab-ca
-        - name: merged-ca
-          emptyDir: {}
       containers:
         - name: cloudflared
           image: cloudflare/cloudflared:latest
           args:
             - tunnel
             - --no-autoupdate
-            - --protocol
-            - http2
-            - --config
-            - /etc/cloudflared/config.yml
             - run
+            - --token
+            - $(TUNNEL_TOKEN)
           env:
-            - name: SSL_CERT_FILE
-              value: /merged/ca-bundle.crt
-          volumeMounts:
-            - name: config
-              mountPath: /etc/cloudflared/config.yml
-              subPath: config.yml
-              readOnly: true
-            - name: credentials
-              mountPath: /etc/cloudflared/creds
-              readOnly: true
-            - name: merged-ca
-              mountPath: /merged
-              readOnly: true
+            - name: TUNNEL_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: cloudflared-token
+                  key: token
           resources:
             requests:
               cpu: 10m

k8s/apps/cloudflared/kustomization.yaml

@@ -3,4 +3,3 @@ kind: Kustomization
 namespace: cloudflared
 resources:
   - deployment.yaml
-  - configmap.yaml

k8s/apps/comfyui/deployment.yaml

@@ -1,82 +0,0 @@
-# ComfyUI — GPU-accelerated image generation on worker-1.
-# Uses 1x V100 32GB (sm70). Freed by scaling ornith 2→1.
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: comfyui
-  namespace: comfyui
-  labels:
-    app: comfyui
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: comfyui
-  template:
-    metadata:
-      labels:
-        app: comfyui
-    spec:
-      nodeSelector:
-        kubernetes.io/hostname: worker-1
-      runtimeClassName: nvidia
-      # k8s Service named 'comfyui' injects COMFYUI_PORT=tcp://... into pod env,
-      # which clobbers ai-dock's own COMFYUI_PORT variable (expects a port number).
-      # Disable service link injection to avoid the collision.
-      enableServiceLinks: false
-      containers:
-        - name: comfyui
-          image: ghcr.io/ai-dock/comfyui:v2-cuda-12.1.1-base-22.04
-          ports:
-            - containerPort: 8188
-              protocol: TCP
-          env:
-            - name: NVIDIA_VISIBLE_DEVICES
-              value: "all"
-          resources:
-            requests:
-              cpu: "4"
-              memory: 8Gi
-              nvidia.com/gpu: "1"
-            limits:
-              cpu: "8"
-              memory: 16Gi
-              nvidia.com/gpu: "1"
-          volumeMounts:
-            - mountPath: /workspace/ComfyUI/models
-              name: models
-            - mountPath: /workspace/ComfyUI/output
-              name: output
-          readinessProbe:
-            httpGet:
-              path: /
-              port: 8188
-            periodSeconds: 10
-            initialDelaySeconds: 30
-          startupProbe:
-            httpGet:
-              path: /
-              port: 8188
-            failureThreshold: 120
-            periodSeconds: 10
-      volumes:
-        - name: models
-          persistentVolumeClaim:
-            claimName: comfyui-models
-        - name: output
-          emptyDir: {}
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: comfyui-models
-  namespace: comfyui
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 50Gi

k8s/apps/comfyui/ingress.yaml

@@ -1,38 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: comfyui
-  namespace: comfyui
-  annotations:
-    # No cert-manager annotation and no tls: block. This host is covered by
-    # the *.riotpiao.com wildcard, which nginx serves as its
-    # default-ssl-certificate (ingress-nginx/riotpiao-com-tls).
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
-    nginx.ingress.kubernetes.io/proxy-body-size: "0"
-    # WebSocket support for ComfyUI's live preview
-    nginx.ingress.kubernetes.io/proxy-http-version: "1.1"
-    nginx.ingress.kubernetes.io/upstream-hash-by: "$remote_addr"
-    # Single sign-on. ComfyUI has no auth of its own, so every request is handed to
-    # oauth2-proxy for an allow or deny decision.
-    nginx.ingress.kubernetes.io/auth-url: "http://comfyui-oauth2-proxy.comfyui.svc.cluster.local:4180/oauth2/auth"
-    nginx.ingress.kubernetes.io/auth-signin: "https://comfyui.riotpiao.com/oauth2/start?rd=$scheme://$host$request_uri"
-    nginx.ingress.kubernetes.io/auth-response-headers: "x-auth-request-user,x-auth-request-email"
-    # No configuration-snippet. The controller rejects that annotation as risky
-    # ("annotation group ConfigurationSnippet contains risky annotation"), and a
-    # rejected annotation drops the WHOLE ingress from nginx.conf: the host then
-    # answers 404 with no entry in the access log. ingress-nginx sets the Upgrade
-    # and Connection headers itself for a websocket upgrade.
-spec:
-  ingressClassName: nginx
-  rules:
-    - host: comfyui.riotpiao.com
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: comfyui
-                port:
-                  number: 80

k8s/apps/comfyui/kustomization.yaml

@@ -1,8 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-
-resources:
-  - deployment.yaml
-  - service.yaml
-  - oauth2-proxy.yaml
-  - ingress.yaml

k8s/apps/comfyui/oauth2-proxy.yaml

@@ -1,105 +0,0 @@
-# ComfyUI has no authentication of its own: comfyui.riotpiao.com is open to anyone
-# who can resolve the host. It also has no OIDC support, so ZITADEL cannot be a
-# login method inside it. oauth2-proxy is the front door instead: nginx asks it for
-# a decision on every request and it answers from a ZITADEL session.
-#
-# No API client calls this host today, so the whole host is gated. If a client ever
-# needs direct access, add a skip rule for the exact paths it uses rather than
-# opening the whole host.
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: comfyui-oauth2-proxy
-  namespace: comfyui
-  labels:
-    app: comfyui-oauth2-proxy
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: comfyui-oauth2-proxy
-  template:
-    metadata:
-      labels:
-        app: comfyui-oauth2-proxy
-    spec:
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 65534
-        seccompProfile: {type: RuntimeDefault}
-      containers:
-        - name: oauth2-proxy
-          image: quay.io/oauth2-proxy/oauth2-proxy:v7.7.1
-          args:
-            - --provider=oidc
-            - --oidc-issuer-url=https://zitadel.riotpiao.com
-            - --email-domain=*
-            - --upstream=static://202
-            - --reverse-proxy=true
-            - --set-xauthrequest=true
-            - --cookie-secure=true
-            - --cookie-expire=12h
-            - --cookie-refresh=1h
-            - --skip-provider-button=true
-            - --redirect-url=https://comfyui.riotpiao.com/oauth2/callback
-            - --http-address=0.0.0.0:4180
-          env:
-            - name: OAUTH2_PROXY_CLIENT_ID
-              valueFrom: {secretKeyRef: {name: comfyui-oauth2-proxy, key: client-id}}
-            - name: OAUTH2_PROXY_CLIENT_SECRET
-              valueFrom: {secretKeyRef: {name: comfyui-oauth2-proxy, key: client-secret}}
-            - name: OAUTH2_PROXY_COOKIE_SECRET
-              valueFrom: {secretKeyRef: {name: comfyui-oauth2-proxy, key: cookie-secret}}
-          ports:
-            - {name: http, containerPort: 4180}
-          readinessProbe:
-            httpGet: {path: /ping, port: http}
-            initialDelaySeconds: 5
-          livenessProbe:
-            httpGet: {path: /ping, port: http}
-            initialDelaySeconds: 15
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities: {drop: ["ALL"]}
-          resources:
-            requests: {cpu: 10m, memory: 32Mi}
-            limits: {cpu: 200m, memory: 128Mi}
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: comfyui-oauth2-proxy
-  namespace: comfyui
-  labels:
-    app: comfyui-oauth2-proxy
-spec:
-  type: ClusterIP
-  selector:
-    app: comfyui-oauth2-proxy
-  ports:
-    - {name: http, port: 4180, targetPort: http}
----
-# The login path must NOT be gated: a request to /oauth2/start that itself demands a
-# login redirects to /oauth2/start forever. ingress-nginx applies the annotations of
-# an ingress to the locations it defines, so a separate object without auth-url keeps
-# this path open. The earlier failure of this shape was not the split — it was the
-# configuration-snippet on the app ingress, which made the controller drop the whole
-# object and left only this one alive.
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: comfyui-oauth2
-  namespace: comfyui
-spec:
-  ingressClassName: nginx
-  rules:
-    - host: comfyui.riotpiao.com
-      http:
-        paths:
-          - path: /oauth2
-            pathType: Prefix
-            backend:
-              service:
-                name: comfyui-oauth2-proxy
-                port:
-                  number: 4180

k8s/apps/comfyui/service.yaml

@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: comfyui
-  namespace: comfyui
-  labels:
-    app: comfyui
-spec:
-  selector:
-    app: comfyui
-  ports:
-    - port: 80
-      targetPort: 8188
-      protocol: TCP

k8s/apps/gotify/README.md

@@ -1,107 +0,0 @@
-# Gotify — Push Notifications + Email Relay
-
-Self-hosted notification server with SMTP email forwarding sidecar.
-
-## Architecture
-
-```
-Forgejo webhook ──POST──→ Gotify API (:80/message)
-                              │
-                    ┌─────────┼─────────┐
-                    ▼                     ▼
-              Push notification      SMTP emailer sidecar
-              (mobile/desktop)       (polls → sends email)
-```
-
-## Setup (one-time, after first deploy)
-
-### 1. Encrypt secrets before committing
-
-```bash
-# Edit secrets.yaml with real values first, then:
-sops -e -i k8s/apps/gotify/secrets.yaml
-```
-
-### 2. Create Gotify app + client tokens
-
-1. Login to `https://gotify.riotpiao.com` with admin creds
-2. **Applications** → Create `forgejo` → copy **app token**
-3. **Clients** → Create `smtp-emailer` → copy **client token**
-4. Update `gotify-tokens` secret:
-   ```bash
-   kubectl -n notifications create secret generic gotify-tokens \
-     --from-literal=app-token=<APP_TOKEN> \
-     --from-literal=client-token=<CLIENT_TOKEN> \
-     --dry-run=client -o yaml | kubectl apply -f -
-   ```
-
-### 3. Configure Forgejo webhook
-
-In each Forgejo repo → **Settings** → **Webhooks** → **Add Webhook** → **Gotify**:
-
-| Field | Value |
-|-------|-------|
-| Target URL | `http://gotify.notifications.svc.cluster.local/message` |
-| Token | The **app token** from step 2 |
-| Events | Pull Request (Created, Merged, Closed) |
-
-Or via API:
-```bash
-FORGEJO_TOKEN="<your-pat>"
-APP_TOKEN="<gotify-app-token>"
-
-curl -s -X POST "https://forgejo.riotpiao.com/api/v1/repos/rock/homelab/hooks" \
-  -H "Authorization: token $FORGEJO_TOKEN" \
-  -H "Content-Type: application/json" \
-  -d '{
-    "type": "gotify",
-    "active": true,
-    "config": {
-      "content_type": "json",
-      "url": "http://gotify.notifications.svc.cluster.local/message?token='"$APP_TOKEN"'"
-    },
-    "events": ["pull_request", "pull_request_assign", "pull_request_review"],
-    "authorization_header": ""
-  }'
-```
-
-### 4. Add CoreDNS rewrite (if accessing via public hostname)
-
-Only needed if Cloudflare Tunnel is used for gotify.riotpiao.com:
-
-```
-# terraform/files/coredns/Corefile — add rewrite:
-rewrite name gotify.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
-```
-
-Then: `cd terraform && terraform apply && cd .. && make apply-cp`
-
-### 5. SMTP providers
-
-| Provider | Host | Port | Notes |
-|----------|------|------|-------|
-| Gmail | smtp.gmail.com | 587 | Use App Password (2FA required) |
-| Resend | smtp.resend.com | 587 | Free 100 emails/day |
-| Sendgrid | smtp.sendgrid.net | 587 | Free 100 emails/day |
-| Mailgun | smtp.mailgun.org | 587 | Free 5000/month |
-
-## Notification priority levels
-
-| Priority | Meaning | Email forwarded? |
-|----------|---------|-----------------|
-| 0-4 | Low (info) | No (below MIN_PRIORITY=5) |
-| 5-7 | Normal (PR created) | Yes |
-| 8-10 | High (PR merged, failures) | Yes |
-
-## Verify
-
-```bash
-# Test push notification
-APP_TOKEN="<app-token>"
-curl -X POST "https://gotify.riotpiao.com/message?token=$APP_TOKEN" \
-  -H "Content-Type: application/json" \
-  -d '{"title":"Test","message":"Hello from homelab","priority":5}'
-
-# Check email sidecar logs
-kubectl -n notifications logs deployment/gotify -c smtp-emailer --tail=20
-```

k8s/apps/gotify/bridge/configmap.yaml

@@ -1,110 +0,0 @@
-# The bridge script is mounted as a ConfigMap so no image build is needed.
-# Regenerate this block from grafana_gotify_bridge.py when the script changes.
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: grafana-gotify-bridge
-  namespace: notifications
-data:
-  grafana_gotify_bridge.py: |
-    #!/usr/bin/env python3
-    """Translate a Grafana alert webhook into a Gotify message.
-    
-    Grafana sends its own payload shape:
-      {"receiver": "...", "status": "firing", "alerts": [{"labels": {...}, "annotations": {...}}]}
-    
-    Gotify requires:
-      {"title": "...", "message": "...", "priority": 0..10}
-    
-    Gotify answers 400 "Field 'message' is required" to a Grafana payload, so a
-    conversion step is mandatory. This service is that step and nothing else.
-    Standard library only, so it needs no image build and no dependencies.
-    """
-    import json
-    import os
-    import urllib.request
-    from http.server import BaseHTTPRequestHandler, HTTPServer
-    
-    GOTIFY_BASE = os.environ.get("GOTIFY_URL", "http://gotify.notifications.svc.cluster.local")
-    GOTIFY_TOKEN = os.environ["GOTIFY_TOKEN"]
-    LISTEN_PORT = int(os.environ.get("PORT", "8080"))
-    
-    # Firing is louder than resolved. Gotify priority runs 0 to 10.
-    PRIORITY = {"firing": 8, "resolved": 3}
-    
-    
-    def to_gotify(payload):
-        alerts = payload.get("alerts") or []
-        status = (payload.get("status") or "firing").lower()
-        priority = PRIORITY.get(status, 5)
-    
-        if not alerts:
-            title = payload.get("title") or "Grafana notification"
-            return title, json.dumps(payload)[:2000], priority
-    
-        first = alerts[0]
-        labels = first.get("labels") or {}
-        annotations = first.get("annotations") or {}
-        name = labels.get("alertname", "Grafana alert")
-    
-        title = "[%s] %s" % (status.upper(), name)
-        lines = []
-        summary = annotations.get("summary") or annotations.get("description")
-        if summary:
-            lines.append(summary)
-        for key in ("severity", "namespace", "pod", "instance", "job"):
-            if labels.get(key):
-                lines.append("%s: %s" % (key, labels[key]))
-        if len(alerts) > 1:
-            lines.append("+%d more alert(s) in this notification" % (len(alerts) - 1))
-    
-        return title, "\n".join(lines) or name, priority
-    
-    
-    class Handler(BaseHTTPRequestHandler):
-        def _reply(self, code, body=b"ok"):
-            self.send_response(code)
-            self.send_header("Content-Type", "text/plain")
-            self.end_headers()
-            self.wfile.write(body)
-    
-        def do_GET(self):
-            self._reply(200)
-    
-        def do_POST(self):
-            length = int(self.headers.get("Content-Length") or 0)
-            raw = self.rfile.read(length) if length else b"{}"
-            try:
-                payload = json.loads(raw.decode("utf-8", "replace") or "{}")
-            except ValueError:
-                payload = {}
-    
-            title, message, priority = to_gotify(payload)
-            body = json.dumps({
-                "title": title[:200],
-                "message": message[:4000],
-                "priority": priority,
-            }).encode()
-    
-            request = urllib.request.Request(
-                GOTIFY_BASE.rstrip("/") + "/message",
-                data=body,
-                headers={"Content-Type": "application/json", "X-Gotify-Key": GOTIFY_TOKEN},
-            )
-            try:
-                urllib.request.urlopen(request, timeout=10).read()
-            except Exception as exc:  # noqa: BLE001 - log and report to Grafana
-                print("forward to gotify failed: %s" % exc, flush=True)
-                self._reply(502, b"gotify rejected the message")
-                return
-    
-            print("forwarded: %s" % title, flush=True)
-            self._reply(200)
-    
-        def log_message(self, fmt, *args):  # keep the log to one line per delivery
-            print("%s - %s" % (self.address_string(), fmt % args), flush=True)
-    
-    
-    if __name__ == "__main__":
-        print("grafana-gotify bridge listening on %d" % LISTEN_PORT, flush=True)
-        HTTPServer(("0.0.0.0", LISTEN_PORT), Handler).serve_forever()

k8s/apps/gotify/bridge/deployment.yaml

@@ -1,80 +0,0 @@
-# Grafana sends its own JSON and Gotify rejects it, so this Deployment is the
-# translation step between them. Grafana posts to the Service, the bridge posts
-# to /message with the app token from a SOPS secret.
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: grafana-gotify-bridge
-  namespace: notifications
-  labels:
-    app: grafana-gotify-bridge
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: grafana-gotify-bridge
-  template:
-    metadata:
-      labels:
-        app: grafana-gotify-bridge
-    spec:
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 65534
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: bridge
-          image: python:3.12-alpine
-          command: ["python3", "/app/grafana_gotify_bridge.py"]
-          env:
-            - name: GOTIFY_URL
-              value: "http://gotify.notifications.svc.cluster.local"
-            - name: PORT
-              value: "8080"
-            - name: GOTIFY_TOKEN
-              valueFrom:
-                secretKeyRef: {name: grafana-gotify-bridge, key: app-token}
-          ports:
-            - name: http
-              containerPort: 8080
-          readinessProbe:
-            httpGet: {path: /, port: http}
-            initialDelaySeconds: 3
-            periodSeconds: 10
-          livenessProbe:
-            httpGet: {path: /, port: http}
-            initialDelaySeconds: 10
-            periodSeconds: 20
-          securityContext:
-            allowPrivilegeEscalation: false
-            readOnlyRootFilesystem: true
-            capabilities:
-              drop: ["ALL"]
-          volumeMounts:
-            - name: script
-              mountPath: /app
-              readOnly: true
-          resources:
-            requests: {cpu: 10m, memory: 32Mi}
-            limits: {cpu: 200m, memory: 96Mi}
-      volumes:
-        - name: script
-          configMap:
-            name: grafana-gotify-bridge
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: grafana-gotify-bridge
-  namespace: notifications
-  labels:
-    app: grafana-gotify-bridge
-spec:
-  type: ClusterIP
-  selector:
-    app: grafana-gotify-bridge
-  ports:
-    - name: http
-      port: 8080
-      targetPort: http

k8s/apps/gotify/bridge/grafana_gotify_bridge.py

@@ -1,101 +0,0 @@
-#!/usr/bin/env python3
-"""Translate a Grafana alert webhook into a Gotify message.
-
-Grafana sends its own payload shape:
-  {"receiver": "...", "status": "firing", "alerts": [{"labels": {...}, "annotations": {...}}]}
-
-Gotify requires:
-  {"title": "...", "message": "...", "priority": 0..10}
-
-Gotify answers 400 "Field 'message' is required" to a Grafana payload, so a
-conversion step is mandatory. This service is that step and nothing else.
-Standard library only, so it needs no image build and no dependencies.
-"""
-import json
-import os
-import urllib.request
-from http.server import BaseHTTPRequestHandler, HTTPServer
-
-GOTIFY_BASE = os.environ.get("GOTIFY_URL", "http://gotify.notifications.svc.cluster.local")
-GOTIFY_TOKEN = os.environ["GOTIFY_TOKEN"]
-LISTEN_PORT = int(os.environ.get("PORT", "8080"))
-
-# Firing is louder than resolved. Gotify priority runs 0 to 10.
-PRIORITY = {"firing": 8, "resolved": 3}
-
-
-def to_gotify(payload):
-    alerts = payload.get("alerts") or []
-    status = (payload.get("status") or "firing").lower()
-    priority = PRIORITY.get(status, 5)
-
-    if not alerts:
-        title = payload.get("title") or "Grafana notification"
-        return title, json.dumps(payload)[:2000], priority
-
-    first = alerts[0]
-    labels = first.get("labels") or {}
-    annotations = first.get("annotations") or {}
-    name = labels.get("alertname", "Grafana alert")
-
-    title = "[%s] %s" % (status.upper(), name)
-    lines = []
-    summary = annotations.get("summary") or annotations.get("description")
-    if summary:
-        lines.append(summary)
-    for key in ("severity", "namespace", "pod", "instance", "job"):
-        if labels.get(key):
-            lines.append("%s: %s" % (key, labels[key]))
-    if len(alerts) > 1:
-        lines.append("+%d more alert(s) in this notification" % (len(alerts) - 1))
-
-    return title, "\n".join(lines) or name, priority
-
-
-class Handler(BaseHTTPRequestHandler):
-    def _reply(self, code, body=b"ok"):
-        self.send_response(code)
-        self.send_header("Content-Type", "text/plain")
-        self.end_headers()
-        self.wfile.write(body)
-
-    def do_GET(self):
-        self._reply(200)
-
-    def do_POST(self):
-        length = int(self.headers.get("Content-Length") or 0)
-        raw = self.rfile.read(length) if length else b"{}"
-        try:
-            payload = json.loads(raw.decode("utf-8", "replace") or "{}")
-        except ValueError:
-            payload = {}
-
-        title, message, priority = to_gotify(payload)
-        body = json.dumps({
-            "title": title[:200],
-            "message": message[:4000],
-            "priority": priority,
-        }).encode()
-
-        request = urllib.request.Request(
-            GOTIFY_BASE.rstrip("/") + "/message",
-            data=body,
-            headers={"Content-Type": "application/json", "X-Gotify-Key": GOTIFY_TOKEN},
-        )
-        try:
-            urllib.request.urlopen(request, timeout=10).read()
-        except Exception as exc:  # noqa: BLE001 - log and report to Grafana
-            print("forward to gotify failed: %s" % exc, flush=True)
-            self._reply(502, b"gotify rejected the message")
-            return
-
-        print("forwarded: %s" % title, flush=True)
-        self._reply(200)
-
-    def log_message(self, fmt, *args):  # keep the log to one line per delivery
-        print("%s - %s" % (self.address_string(), fmt % args), flush=True)
-
-
-if __name__ == "__main__":
-    print("grafana-gotify bridge listening on %d" % LISTEN_PORT, flush=True)
-    HTTPServer(("0.0.0.0", LISTEN_PORT), Handler).serve_forever()

k8s/apps/gotify/db.yaml

@@ -1,35 +0,0 @@
-# CNPG Postgres for Gotify. Lightweight — 2 instances, 2Gi storage.
-# CNPG generates secret `gotify-db-app` + service `gotify-db-rw` in ns notifications.
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: gotify-db
-  namespace: notifications
-  annotations:
-    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
-spec:
-  instances: 3
-  imageName: ghcr.io/cloudnative-pg/postgresql:16.2
-  bootstrap:
-    initdb:
-      database: gotify
-      owner: app
-      encoding: UTF8
-      localeCollate: C
-      localeCType: C
-  enableSuperuserAccess: false
-  resources:
-    requests: { memory: "256Mi", cpu: "100m" }
-    limits: { memory: "512Mi", cpu: "500m" }
-  storage:
-    size: 2Gi
-    storageClass: longhorn-cnpg
-  monitoring:
-    enablePodMonitor: true
-  affinity:
-    podAntiAffinityType: preferred
-    topologyKey: kubernetes.io/hostname
-    tolerations:
-      - key: node-role.kubernetes.io/control-plane
-        operator: Exists
-        effect: NoSchedule

k8s/apps/gotify/deployment.yaml

@@ -1,204 +0,0 @@
-# Gotify — self-hosted push notification server + SMTP email relay.
-# Forgejo webhooks → Gotify → push notifications + email forwarding.
-# Runs on control plane (no GPU needed), lightweight.
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: gotify
-  namespace: notifications
-  labels:
-    app: gotify
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: gotify
-  template:
-    metadata:
-      labels:
-        app: gotify
-    spec:
-      containers:
-        # --- Gotify server ---
-        - name: gotify
-          image: ghcr.io/gotify/server:3.1.0
-          command: ["/bin/sh", "-c"]
-          args:
-            - |
-              export GOTIFY_DATABASE_DIALECT=postgres
-              export GOTIFY_DATABASE_CONNECTION="host=gotify-db-rw.notifications port=5432 user=${DB_USER} password=${DB_PASS} dbname=gotify sslmode=disable"
-              exec /app/gotify-app
-          ports:
-            - containerPort: 80
-              protocol: TCP
-          env:
-            - name: GOTIFY_DEFAULTUSER_NAME
-              valueFrom:
-                secretKeyRef:
-                  name: gotify-admin
-                  key: username
-            - name: GOTIFY_DEFAULTUSER_PASS
-              valueFrom:
-                secretKeyRef:
-                  name: gotify-admin
-                  key: password
-            - name: DB_USER
-              valueFrom:
-                secretKeyRef:
-                  name: gotify-db-app
-                  key: username
-            - name: DB_PASS
-              valueFrom:
-                secretKeyRef:
-                  name: gotify-db-app
-                  key: password
-            - name: GOTIFY_SERVER_PORT
-              value: "80"
-            - name: GOTIFY_SERVER_KEEPALIVEPERIODSECONDS
-              value: "0"
-            - name: TZ
-              value: Asia/Tokyo
-          resources:
-            requests:
-              cpu: 50m
-              memory: 64Mi
-            limits:
-              cpu: 200m
-              memory: 128Mi
-          livenessProbe:
-            httpGet:
-              path: /health
-              port: 80
-            periodSeconds: 30
-            initialDelaySeconds: 10
-          readinessProbe:
-            httpGet:
-              path: /health
-              port: 80
-            periodSeconds: 10
-            initialDelaySeconds: 5
-
-        # --- SMTP emailer sidecar ---
-        # Watches Gotify WebSocket stream, forwards messages as email.
-        # https://github.com/eternal-flame-AD/gotify-broadcast
-        - name: smtp-emailer
-          image: ghcr.io/gotify/server:3.1.0
-          command:
-            - /bin/sh
-            - -c
-            - |
-              # Wait for Gotify to be ready
-              until wget -qO- http://localhost:80/health >/dev/null 2>&1; do
-                echo "Waiting for Gotify..."
-                sleep 2
-              done
-              echo "Gotify is ready, starting email relay..."
-
-              # Poll Gotify messages and forward via SMTP using msmtp
-              # Install msmtp for lightweight SMTP sending
-              apk add --no-cache msmtp curl jq
-
-              # Configure msmtp
-              cat > /tmp/msmtprc <<MSMTP
-              defaults
-              auth           on
-              tls            on
-              tls_trust_file /etc/ssl/certs/ca-certificates.crt
-              logfile        /tmp/msmtp.log
-
-              account        default
-              host           ${SMTP_HOST}
-              port           ${SMTP_PORT}
-              from           ${SMTP_FROM}
-              user           ${SMTP_USER}
-              password       ${SMTP_PASS}
-              MSMTP
-
-              chmod 600 /tmp/msmtprc
-
-              # Track last seen message ID
-              LAST_ID=0
-
-              while true; do
-                # Fetch messages since last ID
-                MESSAGES=$(curl -s -H "X-Gotify-Key: ${GOTIFY_CLIENT_TOKEN}" \
-                  "http://localhost:80/message?since=${LAST_ID}&limit=10" 2>/dev/null)
-
-                if [ -n "$MESSAGES" ]; then
-                  echo "$MESSAGES" | jq -r '.messages[]? | @base64' | while read -r MSG; do
-                    DECODED=$(echo "$MSG" | base64 -d)
-                    ID=$(echo "$DECODED" | jq -r '.id')
-                    TITLE=$(echo "$DECODED" | jq -r '.title // "Notification"')
-                    BODY=$(echo "$DECODED" | jq -r '.message // ""')
-                    PRIORITY=$(echo "$DECODED" | jq -r '.priority // 5')
-                    APP=$(echo "$DECODED" | jq -r '.appid // 0')
-                    DATE=$(echo "$DECODED" | jq -r '.date // ""')
-
-                    # Only forward messages with priority >= configured threshold
-                    if [ "$PRIORITY" -ge "${MIN_PRIORITY:-0}" ]; then
-                      printf "Subject: [Gotify] %s\nFrom: %s\nTo: %s\nContent-Type: text/plain; charset=UTF-8\n\n%s\n\n---\nPriority: %s\nDate: %s" \
-                        "$TITLE" "$SMTP_FROM" "$NOTIFY_EMAIL" "$BODY" "$PRIORITY" "$DATE" | \
-                        msmtp -C /tmp/msmtprc "$NOTIFY_EMAIL" && \
-                        echo "Email sent for message $ID: $TITLE" || \
-                        echo "Failed to send email for message $ID"
-                    fi
-
-                    # Update last seen ID
-                    if [ "$ID" -gt "$LAST_ID" ]; then
-                      LAST_ID=$ID
-                    fi
-                  done
-                fi
-
-                sleep ${POLL_INTERVAL:-30}
-              done
-          env:
-            - name: GOTIFY_CLIENT_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: gotify-tokens
-                  key: client-token
-            - name: SMTP_HOST
-              valueFrom:
-                secretKeyRef:
-                  name: gotify-smtp
-                  key: host
-            - name: SMTP_PORT
-              valueFrom:
-                secretKeyRef:
-                  name: gotify-smtp
-                  key: port
-            - name: SMTP_FROM
-              valueFrom:
-                secretKeyRef:
-                  name: gotify-smtp
-                  key: from
-            - name: SMTP_USER
-              valueFrom:
-                secretKeyRef:
-                  name: gotify-smtp
-                  key: user
-            - name: SMTP_PASS
-              valueFrom:
-                secretKeyRef:
-                  name: gotify-smtp
-                  key: password
-            - name: NOTIFY_EMAIL
-              valueFrom:
-                secretKeyRef:
-                  name: gotify-smtp
-                  key: notify-email
-            - name: MIN_PRIORITY
-              value: "5"
-            - name: POLL_INTERVAL
-              value: "15"
-          resources:
-            requests:
-              cpu: 10m
-              memory: 32Mi
-            limits:
-              cpu: 100m
-              memory: 64Mi
-      # No volumes — Postgres handles persistence

k8s/apps/gotify/igotify-deployment.yaml

@@ -1,67 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: igotify
-  namespace: notifications
-  labels:
-    app: igotify
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: igotify
-  template:
-    metadata:
-      labels:
-        app: igotify
-    spec:
-      containers:
-        - name: igotify
-          image: ghcr.io/androidseb25/igotify-notification-assist:v1.6.0.1
-          ports:
-            - containerPort: 8080
-              protocol: TCP
-          env:
-            - name: ENABLE_CONSOLE_LOG
-              value: "true"
-            - name: ENABLE_SCALAR_UI
-              value: "true"
-            # The bridge authenticates with a Gotify client token, not with
-            # ZITADEL. Gotify has no way to accept a forwarded identity, so the
-            # token is the only credential that works server-side. The token
-            # belongs to user `rock`, never expires, and is revoked by deleting
-            # the client row in Gotify.
-            - name: GOTIFY_URLS
-              value: "https://gotify.riotpiao.com"
-            - name: GOTIFY_CLIENT_TOKENS
-              valueFrom:
-                secretKeyRef: {name: igotify-client-token, key: client-token}
-            # SECNTFY_TOKENS intentionally left unset: secntfy is not deployed.
-          volumeMounts:
-            - name: data
-              mountPath: /app/data
-          livenessProbe:
-            httpGet:
-              path: /Version
-              port: 8080
-            initialDelaySeconds: 10
-            periodSeconds: 30
-          readinessProbe:
-            httpGet:
-              path: /Version
-              port: 8080
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          resources:
-            requests:
-              cpu: 50m
-              memory: 64Mi
-            limits:
-              cpu: 200m
-              memory: 128Mi
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: igotify-data

k8s/apps/gotify/igotify-ingress.yaml

@@ -1,22 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: igotify
-  namespace: notifications
-  annotations:
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
-    nginx.ingress.kubernetes.io/proxy-http-version: "1.1"
-spec:
-  ingressClassName: nginx
-  rules:
-    - host: igotify.riotpiao.com
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: igotify
-                port:
-                  number: 80

k8s/apps/gotify/igotify-pvc.yaml

@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: igotify-data
-  namespace: notifications
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi

k8s/apps/gotify/igotify-service.yaml

@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: igotify
-  namespace: notifications
-  labels:
-    app: igotify
-spec:
-  selector:
-    app: igotify
-  ports:
-    - port: 80
-      targetPort: 8080
-      protocol: TCP

k8s/apps/gotify/ingress.yaml

@@ -1,24 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: gotify
-  namespace: notifications
-  annotations:
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
-    # WebSocket support for Gotify client connections (/stream endpoint)
-    # nginx-ingress handles Upgrade/Connection headers natively with http/1.1
-    nginx.ingress.kubernetes.io/proxy-http-version: "1.1"
-spec:
-  ingressClassName: nginx
-  rules:
-    - host: gotify.riotpiao.com
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: gotify
-                port:
-                  number: 80

k8s/apps/gotify/kustomization.yaml

@@ -1,14 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - namespace.yaml
-  - db.yaml
-  - deployment.yaml
-  - service.yaml
-  - ingress.yaml
-  - bridge/configmap.yaml
-  - bridge/deployment.yaml
-  - igotify-pvc.yaml
-  - igotify-deployment.yaml
-  - igotify-service.yaml
-  - igotify-ingress.yaml

k8s/apps/gotify/namespace.yaml

@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: notifications
-  labels:
-    kubernetes.io/metadata.name: notifications

k8s/apps/gotify/service.yaml

@@ -1,14 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: gotify
-  namespace: notifications
-  labels:
-    app: gotify
-spec:
-  selector:
-    app: gotify
-  ports:
-    - port: 80
-      targetPort: 80
-      protocol: TCP

k8s/apps/homarr/homarr-values.yaml

@@ -0,0 +1,78 @@
+# Homarr landing page with Authentik SSO
+
+# Probe tuning (chart DOES expose these — the old PostSync patch-job was
+# unnecessary and fragile: it only patched one Deployment revision, so any later
+# rollout reverted to the chart's aggressive defaults). Homarr's first-boot icon
+# updater blocks the event loop for ~50s ("icons updater took 49553ms"), during
+# which /api/health/live can't answer within the default 10s×3 window → kubelet
+# SIGTERMs the pod → CrashLoopBackOff (247 restarts, 503 at the ingress). Give
+# liveness a wide window so the icon import can finish without a kill.
+livenessProbe:
+  initialDelaySeconds: 60
+  periodSeconds: 30
+  timeoutSeconds: 5
+  failureThreshold: 10
+readinessProbe:
+  initialDelaySeconds: 30
+  periodSeconds: 15
+  timeoutSeconds: 5
+  failureThreshold: 6
+
+image:
+  repository: ghcr.io/homarr-labs/homarr
+  tag: "latest"
+  pullPolicy: Always
+
+replicaCount: 1
+
+# Configure SSO via environment variables
+# Chart supports these via top-level env dict (not array)
+env:
+  AUTH_PROVIDERS: "oidc,credentials"
+  AUTH_OIDC_ISSUER: "https://authentik.riotpiao.com/application/o/homarr/"
+  # AUTH_OIDC_URI (authorize endpoint) is REQUIRED in addition to ISSUER — homarr
+  # hides the "Sign in with Authentik" button entirely when it's absent (per the
+  # authentik Homarr integration + homarr SSO docs). This was the missing var.
+  AUTH_OIDC_URI: "https://authentik.riotpiao.com/application/o/authorize/"
+  AUTH_OIDC_CLIENT_NAME: "Authentik"
+  AUTH_OIDC_GROUPS_ATTRIBUTE: "groups"
+  AUTH_OIDC_SCOPE_OVERWRITE: "openid email profile groups"
+  AUTH_OIDC_AUTO_LOGIN: "false"
+  # Link the OIDC identity to an existing homarr account with the same email.
+  OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING: "true"
+  # The analytics cron blocked the (single-threaded) Next.js event loop for ~16s
+  # per run ("callback took longer than expected"), compounding CPU pressure.
+  DISABLE_ANALYTICS: "true"
+  BASE_URL: "https://homarr.riotpiao.com"
+  NEXTAUTH_URL: "https://homarr.riotpiao.com"
+
+# Client credentials from homarr-oidc secret
+# Chart doesn't support envFrom, so we add via extraEnv
+extraEnv:
+  - name: AUTH_OIDC_CLIENT_ID
+    valueFrom:
+      secretKeyRef:
+        name: homarr-oidc
+        key: client-id
+  - name: AUTH_OIDC_CLIENT_SECRET
+    valueFrom:
+      secretKeyRef:
+        name: homarr-oidc
+        key: client-secret
+
+tolerations:
+  - key: node-role.kubernetes.io/control-plane
+    operator: Exists
+    effect: NoSchedule
+
+resources:
+  requests:
+    cpu: 250m
+    memory: 384Mi
+  limits:
+    # Next.js 16 + bundled redis + the icon-updater (28k icons) saturated the old
+    # 500m limit; CPU throttling made Next.js abort with exit 134 (SIGABRT) and
+    # self-restart in a loop, so nginx saw no upstream and returned 502. Give it
+    # real CPU headroom.
+    cpu: "2"
+    memory: 1Gi

k8s/apps/homarr/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: dashboard
+# Probes are now tuned via homarr-values.yaml (chart-native); the old
+# fix-probes-job PostSync hook is removed. homarr-secrets/auth-oidc/db-encryption
+# Secrets are delivered by the sops-secrets (ksops) Application.
+resources: []

k8s/apps/immich/db.yaml

@@ -18,7 +18,7 @@ metadata:
   annotations:
     argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
 spec:
-  instances: 3
+  instances: 2
   imageName: ghcr.io/cloudnative-pg/postgresql:18-minimal-trixie
   postgresql:
     extensions:

k8s/apps/key-rotation-controller/README.md

@@ -1,50 +0,0 @@
-# Credential rotation
-
-One `KeyRotation` object describes one credential. The controller creates the value,
-writes the Secret, proves the new value works, then retires the old one.
-
-## Why the state order is the safety property
-
-```
-Prepare -> Publish -> Verify -> Retire
-```
-
-`Retire` runs only for a provider whose old credential still works after the publish
-step, and only after `Verify` passes. A failure before that point leaves the working
-credential untouched. The hand-run rotation that broke Grafana did the opposite: it
-regenerated the secret and never re-pointed the consumer.
-
-## Two strategies, decided by the provider, not by preference
-
-| Provider | Overlap in ZITADEL | Strategy | Retire |
-|---|---|---|---|
-| `zitadel-machine-key` | many keys per service user | `overlap` | after the new key obtains a token |
-| `zitadel-oidc-client` | one secret per app | `atomic` | nothing to retire |
-
-## The single master credential
-
-The controller authenticates with one machine key, mounted from Secret
-`iam/key-rotation-controller`. That key is the only credential the cluster cannot
-rotate by itself, so it is the only one that stays encrypted in git.
-
-Every other credential is created by the controller, which means the 34 `.enc.yaml`
-files under `k8s/argocd/secrets/` are migration debt, not a design. The retirement
-target is one root-of-trust file per thing that cannot rotate itself:
-
-| Survives (root of trust) | Why it cannot rotate |
-|---|---|
-| ZITADEL instance masterkey | encrypts the whole ZITADEL database |
-| Vault unseal keys | unsealing needs a human-held key |
-| Talos repair config | recovery path, must work when the cluster does not |
-| homelab CA | signs the wildcard certificate |
-| controller bootstrap key | chicken and egg: it creates every other key |
-| etcd defrag credentials | needed by a job that runs outside the controller |
-
-Everything else — Grafana, Argo CD, Forgejo, MinIO, Paperless, Immich, ComfyUI,
-api-gw, Gotify — is a KeyRotation object, and its secret leaves git.
-
-## Status
-
-The CRD is installed. Eight `KeyRotation` objects exist for the consumers above and
-all are `suspend: true`: the controller image does not exist yet, so no process acts
-on them. poimen-memory is excluded from this migration on purpose.

k8s/apps/key-rotation-controller/controller/api/types.go

@@ -1,254 +0,0 @@
-// Package api declares the KeyRotation custom resource.
-//
-// One resource describes one credential and how to rotate it. The controller
-// never stores the credential in git: it writes a Kubernetes Secret and records
-// only the credential's identifier in status.
-package api
-
-import (
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/runtime/schema"
-)
-
-// Group is the API group for homelab platform resources.
-const Group = "iam.homelab.riotpiao.com"
-
-// Version is the served version.
-const Version = "v1"
-
-// Provider names. Each provider uses one external API to create and retire
-// credentials, and each declares whether a rotation can overlap.
-const (
-	// ProviderZitadelMachineKey creates a machine key while the previous key
-	// stays valid. True zero downtime.
-	ProviderZitadelMachineKey = "zitadel-machine-key"
-	// ProviderZitadelOIDCClient regenerates an app client secret. ZITADEL keeps
-	// one secret per app, so the old one dies the moment the new one exists.
-	ProviderZitadelOIDCClient = "zitadel-oidc-client"
-)
-
-// Strategy names.
-const (
-	// StrategyOverlap keeps the old credential valid until the new one is proven.
-	StrategyOverlap = "overlap"
-	// StrategyAtomic replaces the credential in place. A short window exists.
-	StrategyAtomic = "atomic"
-)
-
-// Reload names tell the controller how the consumer picks up a new value.
-const (
-	// ReloadHot means the consumer watches the mounted file.
-	ReloadHot = "hot"
-	// ReloadRestart means the consumer reads the value at start, so it must roll.
-	ReloadRestart = "restart"
-)
-
-// Phase names for status.
-const (
-	PhasePending      = "Pending"
-	PhasePreparing    = "Preparing"
-	PhasePropagating  = "Propagating"
-	PhaseVerifying    = "Verifying"
-	PhaseCompleting   = "Completing"
-	PhaseSucceeded    = "Succeeded"
-	PhaseFailed       = "Failed"
-	PhaseSuspended    = "Suspended"
-)
-
-// ConsumerRef names a workload that reads the rotated credential.
-type ConsumerRef struct {
-	// Kind is Deployment or StatefulSet.
-	Kind string `json:"kind"`
-	// Name is the workload name.
-	Name string `json:"name"`
-	// Namespace is where the workload runs.
-	Namespace string `json:"namespace"`
-}
-
-// RotationTarget is the credential's source and destination.
-type RotationTarget struct {
-	// ZitadelProjectID is the project that owns the app or service user.
-	ZitadelProjectID string `json:"zitadelProjectID,omitempty"`
-	// ZitadelAppID is the OIDC app id, for the client-secret provider.
-	ZitadelAppID string `json:"zitadelAppID,omitempty"`
-	// MachineUserID is the service user id, for the machine-key provider.
-	MachineUserID string `json:"machineUserID,omitempty"`
-	// SecretName is the Secret the controller writes.
-	SecretName string `json:"secretName"`
-	// SecretNamespace is where that Secret lives.
-	SecretNamespace string `json:"secretNamespace"`
-	// SecretKeys maps a logical field name to the Secret key that holds it.
-	// For a machine key: key -> key, key-id -> key-id.
-	SecretKeys map[string]string `json:"secretKeys,omitempty"`
-	// Consumers are the workloads that must pick the new value up.
-	Consumers []ConsumerRef `json:"consumers,omitempty"`
-	// Reload is hot or restart. Empty means restart, the safe default.
-	Reload string `json:"reload,omitempty"`
-}
-
-// VerifySpec is the proof the controller demands before it retires the old
-// credential.
-type VerifySpec struct {
-	// Introspect checks client_id and client_secret against the introspection
-	// endpoint.
-	Introspect bool `json:"introspect,omitempty"`
-	// TokenExchange exchanges a token with the new machine key.
-	TokenExchange bool `json:"tokenExchange,omitempty"`
-	// AudienceProject, when set, is added to the token request as
-	// urn:zitadel:iam:org:project:id:<id>:aud.
-	AudienceProject string `json:"audienceProject,omitempty"`
-}
-
-// KeyRotationSpec is the desired state.
-type KeyRotationSpec struct {
-	// Provider selects the external API.
-	Provider string `json:"provider"`
-	// Strategy is overlap or atomic.
-	Strategy string `json:"strategy"`
-	// IntervalHours is how often to rotate. Minimum 24.
-	IntervalHours int32 `json:"intervalHours"`
-	// Suspend stops automatic rotation without deleting the resource.
-	Suspend bool `json:"suspend,omitempty"`
-	// Target names the credential and its consumers.
-	Target RotationTarget `json:"target"`
-	// Verify names the checks that must pass.
-	Verify VerifySpec `json:"verify,omitempty"`
-}
-
-// KeyRotationStatus is the observed state.
-type KeyRotationStatus struct {
-	Phase              string             `json:"phase,omitempty"`
-	ObservedGeneration int64              `json:"observedGeneration,omitempty"`
-	LastRotation       *metav1.Time       `json:"lastRotation,omitempty"`
-	NextRotation       *metav1.Time       `json:"nextRotation,omitempty"`
-	ActiveCredentialID string             `json:"activeCredentialID,omitempty"`
-	PreviousCredentialID string           `json:"previousCredentialID,omitempty"`
-	LastError          string             `json:"lastError,omitempty"`
-	Conditions         []metav1.Condition `json:"conditions,omitempty"`
-}
-
-// KeyRotation is one credential under management.
-type KeyRotation struct {
-	metav1.TypeMeta   `json:",inline"`
-	metav1.ObjectMeta `json:"metadata,omitempty"`
-
-	Spec   KeyRotationSpec   `json:"spec,omitempty"`
-	Status KeyRotationStatus `json:"status,omitempty"`
-}
-
-// KeyRotationList is a list of KeyRotation.
-type KeyRotationList struct {
-	metav1.TypeMeta `json:",inline"`
-	metav1.ListMeta `json:"metadata,omitempty"`
-	Items           []KeyRotation `json:"items"`
-}
-
-// SchemeGroupVersion is the group and version for this type.
-var SchemeGroupVersion = schema.GroupVersion{Group: Group, Version: Version}
-
-// SchemeBuilder registers the types with a scheme.
-var SchemeBuilder = runtime.NewSchemeBuilder(func(s *runtime.Scheme) error {
-	s.AddKnownTypes(SchemeGroupVersion, &KeyRotation{}, &KeyRotationList{})
-	metav1.AddToGroupVersion(s, SchemeGroupVersion)
-	return nil
-})
-
-// AddToScheme registers this package's types.
-var AddToScheme = SchemeBuilder.AddToScheme
-
-// DeepCopyInto copies the receiver into out.
-func (in *KeyRotation) DeepCopyInto(out *KeyRotation) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Spec.DeepCopyInto(&out.Spec)
-	in.Status.DeepCopyInto(&out.Status)
-}
-
-// DeepCopy makes a deep copy.
-func (in *KeyRotation) DeepCopy() *KeyRotation {
-	if in == nil {
-		return nil
-	}
-	out := new(KeyRotation)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject satisfies runtime.Object.
-func (in *KeyRotation) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}
-
-// DeepCopyInto copies the receiver into out.
-func (in *KeyRotationSpec) DeepCopyInto(out *KeyRotationSpec) {
-	*out = *in
-	in.Target.DeepCopyInto(&out.Target)
-}
-
-// DeepCopyInto copies the receiver into out.
-func (in *RotationTarget) DeepCopyInto(out *RotationTarget) {
-	*out = *in
-	if in.SecretKeys != nil {
-		out.SecretKeys = make(map[string]string, len(in.SecretKeys))
-		for k, v := range in.SecretKeys {
-			out.SecretKeys[k] = v
-		}
-	}
-	if in.Consumers != nil {
-		out.Consumers = make([]ConsumerRef, len(in.Consumers))
-		copy(out.Consumers, in.Consumers)
-	}
-}
-
-// DeepCopyInto copies the receiver into out.
-func (in *KeyRotationStatus) DeepCopyInto(out *KeyRotationStatus) {
-	*out = *in
-	if in.LastRotation != nil {
-		t := *in.LastRotation
-		out.LastRotation = &t
-	}
-	if in.NextRotation != nil {
-		t := *in.NextRotation
-		out.NextRotation = &t
-	}
-	if in.Conditions != nil {
-		out.Conditions = make([]metav1.Condition, len(in.Conditions))
-		copy(out.Conditions, in.Conditions)
-	}
-}
-
-// DeepCopyInto copies the receiver into out.
-func (in *KeyRotationList) DeepCopyInto(out *KeyRotationList) {
-	*out = *in
-	out.TypeMeta = in.TypeMeta
-	in.ListMeta.DeepCopyInto(&out.ListMeta)
-	if in.Items != nil {
-		out.Items = make([]KeyRotation, len(in.Items))
-		for i := range in.Items {
-			in.Items[i].DeepCopyInto(&out.Items[i])
-		}
-	}
-}
-
-// DeepCopy makes a deep copy.
-func (in *KeyRotationList) DeepCopy() *KeyRotationList {
-	if in == nil {
-		return nil
-	}
-	out := new(KeyRotationList)
-	in.DeepCopyInto(out)
-	return out
-}
-
-// DeepCopyObject satisfies runtime.Object.
-func (in *KeyRotationList) DeepCopyObject() runtime.Object {
-	if c := in.DeepCopy(); c != nil {
-		return c
-	}
-	return nil
-}

k8s/apps/key-rotation-controller/controller/go.mod

@@ -1,71 +0,0 @@
-module github.com/riotpiao/key-rotation-controller
-
-go 1.26.0
-
-require (
-	k8s.io/api v0.37.1
-	k8s.io/apimachinery v0.37.1
-	k8s.io/client-go v0.37.0
-	sigs.k8s.io/controller-runtime v0.25.2
-)
-
-require (
-	github.com/beorn7/perks v1.0.1 // indirect
-	github.com/cespare/xxhash/v2 v2.3.0 // indirect
-	github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc // indirect
-	github.com/emicklei/go-restful/v3 v3.13.0 // indirect
-	github.com/evanphx/json-patch/v5 v5.9.11 // indirect
-	github.com/fsnotify/fsnotify v1.9.0 // indirect
-	github.com/fxamacker/cbor/v2 v2.9.1 // indirect
-	github.com/go-logr/logr v1.4.3 // indirect
-	github.com/go-logr/zapr v1.3.0 // indirect
-	github.com/go-openapi/jsonpointer v1.0.0 // indirect
-	github.com/go-openapi/jsonreference v1.0.0 // indirect
-	github.com/go-openapi/swag v0.27.1 // indirect
-	github.com/go-openapi/swag/cmdutils v0.27.1 // indirect
-	github.com/go-openapi/swag/conv v0.27.1 // indirect
-	github.com/go-openapi/swag/fileutils v0.27.1 // indirect
-	github.com/go-openapi/swag/jsonutils v0.27.1 // indirect
-	github.com/go-openapi/swag/loading v0.27.1 // indirect
-	github.com/go-openapi/swag/mangling v0.27.1 // indirect
-	github.com/go-openapi/swag/netutils v0.27.1 // indirect
-	github.com/go-openapi/swag/pools v0.27.1 // indirect
-	github.com/go-openapi/swag/stringutils v0.27.1 // indirect
-	github.com/go-openapi/swag/typeutils v0.27.1 // indirect
-	github.com/go-openapi/swag/yamlutils v0.27.1 // indirect
-	github.com/google/gnostic-models v0.7.0 // indirect
-	github.com/google/uuid v1.6.0 // indirect
-	github.com/json-iterator/go v1.1.12 // indirect
-	github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd // indirect
-	github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee // indirect
-	github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 // indirect
-	github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 // indirect
-	github.com/prometheus/client_golang v1.24.0 // indirect
-	github.com/prometheus/client_model v0.6.2 // indirect
-	github.com/prometheus/common v0.70.0 // indirect
-	github.com/spf13/pflag v1.0.10 // indirect
-	github.com/x448/float16 v0.8.4 // indirect
-	go.uber.org/multierr v1.11.0 // indirect
-	go.uber.org/zap v1.27.1 // indirect
-	go.yaml.in/yaml/v2 v2.4.4 // indirect
-	go.yaml.in/yaml/v3 v3.0.4 // indirect
-	golang.org/x/net v0.57.0 // indirect
-	golang.org/x/oauth2 v0.36.0 // indirect
-	golang.org/x/sync v0.22.0 // indirect
-	golang.org/x/sys v0.47.0 // indirect
-	golang.org/x/term v0.45.0 // indirect
-	golang.org/x/text v0.40.0 // indirect
-	golang.org/x/time v0.15.0 // indirect
-	gomodules.xyz/jsonpatch/v2 v2.4.0 // indirect
-	google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af // indirect
-	gopkg.in/evanphx/json-patch.v4 v4.13.0 // indirect
-	gopkg.in/inf.v0 v0.9.1 // indirect
-	k8s.io/apiextensions-apiserver v0.37.0 // indirect
-	k8s.io/klog/v2 v2.140.0 // indirect
-	k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad // indirect
-	k8s.io/utils v0.0.0-20260626114624-be93311217bd // indirect
-	sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 // indirect
-	sigs.k8s.io/randfill v1.0.0 // indirect
-	sigs.k8s.io/structured-merge-diff/v6 v6.4.2 // indirect
-	sigs.k8s.io/yaml v1.6.0 // indirect
-)

k8s/apps/key-rotation-controller/controller/go.sum

@@ -1,133 +0,0 @@
-github.com/beorn7/perks v1.0.1 h1:VlbKKnNfV8bJzeqoa4cOKqO6bYr3WgKZxO8Z16+hsOM=
-github.com/beorn7/perks v1.0.1/go.mod h1:G2ZrVWU2WbWT9wwq4/hrbKbnv/1ERSJQ0ibhJ6rlkpw=
-github.com/cespare/xxhash/v2 v2.3.0 h1:UL815xU9SqsFlibzuggzjXhog7bL6oX9BbNZnL2UFvs=
-github.com/cespare/xxhash/v2 v2.3.0/go.mod h1:VGX0DQ3Q6kWi7AoAeZDth3/j3BFtOZR5XLFGgcrjCOs=
-github.com/davecgh/go-spew v1.1.0/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.1/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc h1:U9qPSI2PIWSS1VwoXQT9A3Wy9MM3WgvqSxFWenqJduM=
-github.com/davecgh/go-spew v1.1.2-0.20180830191138-d8f796af33cc/go.mod h1:J7Y8YcW2NihsgmVo/mv3lAwl/skON4iLHjSsI+c5H38=
-github.com/emicklei/go-restful/v3 v3.13.0 h1:C4Bl2xDndpU6nJ4bc1jXd+uTmYPVUwkD6bFY/oTyCes=
-github.com/emicklei/go-restful/v3 v3.13.0/go.mod h1:6n3XBCmQQb25CM2LCACGz8ukIrRry+4bhvbpWn3mrbc=
-github.com/evanphx/json-patch/v5 v5.9.11 h1:/8HVnzMq13/3x9TPvjG08wUGqBTmZBsCWzjTM0wiaDU=
-github.com/evanphx/json-patch/v5 v5.9.11/go.mod h1:3j+LviiESTElxA4p3EMKAB9HXj3/XEtnUf6OZxqIQTM=
-github.com/fsnotify/fsnotify v1.9.0 h1:2Ml+OJNzbYCTzsxtv8vKSFD9PbJjmhYF14k/jKC7S9k=
-github.com/fsnotify/fsnotify v1.9.0/go.mod h1:8jBTzvmWwFyi3Pb8djgCCO5IBqzKJ/Jwo8TRcHyHii0=
-github.com/fxamacker/cbor/v2 v2.9.1 h1:2rWm8B193Ll4VdjsJY28jxs70IdDsHRWgQYAI80+rMQ=
-github.com/fxamacker/cbor/v2 v2.9.1/go.mod h1:vM4b+DJCtHn+zz7h3FFp/hDAI9WNWCsZj23V5ytsSxQ=
-github.com/go-logr/logr v1.4.3 h1:CjnDlHq8ikf6E492q6eKboGOC0T8CDaOvkHCIg8idEI=
-github.com/go-logr/logr v1.4.3/go.mod h1:9T104GzyrTigFIr8wt5mBrctHMim0Nb2HLGrmQ40KvY=
-github.com/go-logr/zapr v1.3.0 h1:XGdV8XW8zdwFiwOA2Dryh1gj2KRQyOOoNmBy4EplIcQ=
-github.com/go-logr/zapr v1.3.0/go.mod h1:YKepepNBd1u/oyhd/yQmtjVXmm9uML4IXUgMOwR8/Gg=
-github.com/go-openapi/jsonpointer v1.0.0 h1:kR9tHqY0CtZaOPVFm622dPVNhrvYpwr4uCxgL3h1H8s=
-github.com/go-openapi/jsonpointer v1.0.0/go.mod h1:Z3rw7dWu1p9IgitXCFamSlA5lmDiklEB6vkaxcNZW5Y=
-github.com/go-openapi/jsonreference v1.0.0 h1:jlmTr6torcd1YgDQvSfNmRtKzYDO4FGBkrAdlAVWnpY=
-github.com/go-openapi/jsonreference v1.0.0/go.mod h1:jtwdyGbJk0Xhe5Y+rwtglQP6Sb1WZST4rT32LWB+sv0=
-github.com/go-openapi/swag v0.27.1 h1:VotvOLWW8q/EAxB0YdsBBGC8XYyeL1YwBj2ungAGPNg=
-github.com/go-openapi/swag v0.27.1/go.mod h1:GTkJPwHfhJp6MWr4/rCh64HVI3Ofu+tcsbfjfHmTxpE=
-github.com/go-openapi/swag/cmdutils v0.27.1 h1:I7sYqaWVl5mq0NEmNQkAmFDyNin9ufvMX/p2zwtQaOE=
-github.com/go-openapi/swag/cmdutils v0.27.1/go.mod h1:Sm1MVFMkF6guJJ+pQqHnQA3N0j9qALV3NxzDSv6bETM=
-github.com/go-openapi/swag/conv v0.27.1 h1:8wi9ZG+olmY1wXphl93EWniPtbSPkXM/feH7FgjsvrU=
-github.com/go-openapi/swag/conv v0.27.1/go.mod h1:QbqMivkpKhC3g1B1GGGOJ6ANewI3S62dbzYu3Duowqs=
-github.com/go-openapi/swag/fileutils v0.27.1 h1:QQqBSoi5mW4XpU85nS0mLcA+zAE6vLzrb0QkmLKf9oM=
-github.com/go-openapi/swag/fileutils v0.27.1/go.mod h1:VvJFZLTZS0AI854gEQz5tk7dBESdLjiNUMSZ/th2ry8=
-github.com/go-openapi/swag/jsonutils v0.27.1 h1:SVgK3i4USzCU5mibOOS/l4ea2h9UQXy7J7RNLTjuXjU=
-github.com/go-openapi/swag/jsonutils v0.27.1/go.mod h1:tdlEpZqdcQ17uj6J4YdK9vd8It5qWMwjWXOs0tjpRlk=
-github.com/go-openapi/swag/loading v0.27.1 h1:/DxUgDXKbBX4bcn7r9uEXfJyzN5XpiJmZplzQTjrRCY=
-github.com/go-openapi/swag/loading v0.27.1/go.mod h1:jvGh3iA2+zyUUycB5fgJWzeHnhrpvGnJJM0RVE9ZShE=
-github.com/go-openapi/swag/mangling v0.27.1 h1:yC9D0HyUE8gbP+BfmGx9+AA89ikwZTMjESK3OnnoaqA=
-github.com/go-openapi/swag/mangling v0.27.1/go.mod h1:jtBE2+V+3pILxOR7Vgce+Cwp6A2PgZbvVqfNntbVs0w=
-github.com/go-openapi/swag/netutils v0.27.1 h1:mICMFoS82F5TZ4Zy3cqmcQk+BFeCp3Uyq3Np7GI0/qU=
-github.com/go-openapi/swag/netutils v0.27.1/go.mod h1:J+WYyFMLtvtCGqa6jLv+YNUmIKI3ZRQRrvfNDMoQoEQ=
-github.com/go-openapi/swag/pools v0.27.1 h1:9LeadcMyb2GJCbXX5hVQDbZ2Lq9TL4dCs/nx1j5DO0E=
-github.com/go-openapi/swag/pools v0.27.1/go.mod h1:kVQefhSK5RWuRe7BXsL8htgBPAMpN7HDGpGEknqugeE=
-github.com/go-openapi/swag/stringutils v0.27.1 h1:ZXePZ0r2p1qSjo8tD3Un4vFj8+FqlCkczxDrJIhYUp8=
-github.com/go-openapi/swag/stringutils v0.27.1/go.mod h1:lzRN95CxXmA03XcDWHLOb6nOMcxCqR5rGY0lOgsfRoM=
-github.com/go-openapi/swag/typeutils v0.27.1 h1:KSTdFlfnse4r6dP9IrEnwMldjE+zs71UeEB3//PtVXc=
-github.com/go-openapi/swag/typeutils v0.27.1/go.mod h1:Srm0xFNRZ1Y+vCxJclo5qzx8aj+1pAKda/YfFPrG0dQ=
-github.com/go-openapi/swag/yamlutils v0.27.1 h1:ftxv6xvXb1E3zohUc+okZ9nSqNb9StQX/FXnKZ98sQA=
-github.com/go-openapi/swag/yamlutils v0.27.1/go.mod h1:bnxFIB1qewGRiZHypXGZ3fNgf13/0HfRgnS/iZBDrOo=
-github.com/google/gnostic-models v0.7.0 h1:qwTtogB15McXDaNqTZdzPJRHvaVJlAl+HVQnLmJEJxo=
-github.com/google/gnostic-models v0.7.0/go.mod h1:whL5G0m6dmc5cPxKc5bdKdEN3UjI7OUGxBlw57miDrQ=
-github.com/google/gofuzz v1.0.0/go.mod h1:dBl0BpW6vV/+mYPU4Po3pmUjxk6FQPldtuIdl/M65Eg=
-github.com/google/uuid v1.6.0 h1:NIvaJDMOsjHA8n1jAhLSgzrAzy1Hgr+hNrb57e+94F0=
-github.com/google/uuid v1.6.0/go.mod h1:TIyPZe4MgqvfeYDBFedMoGGpEw/LqOeaOT+nhxU+yHo=
-github.com/json-iterator/go v1.1.12 h1:PV8peI4a0ysnczrg+LtxykD8LfKY9ML6u2jnxaEnrnM=
-github.com/json-iterator/go v1.1.12/go.mod h1:e30LSqwooZae/UwlEbR2852Gd8hjQvJoHmT4TnhNGBo=
-github.com/modern-go/concurrent v0.0.0-20180228061459-e0a39a4cb421/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd h1:TRLaZ9cD/w8PVh93nsPXa1VrQ6jlwL5oN8l14QlcNfg=
-github.com/modern-go/concurrent v0.0.0-20180306012644-bacd9c7ef1dd/go.mod h1:6dJC0mAP4ikYIbvyc7fijjWJddQyLn8Ig3JB5CqoB9Q=
-github.com/modern-go/reflect2 v1.0.2/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
-github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee h1:W5t00kpgFdJifH4BDsTlE89Zl93FEloxaWZfGcifgq8=
-github.com/modern-go/reflect2 v1.0.3-0.20250322232337-35a7c28c31ee/go.mod h1:yWuevngMOJpCy52FWWMvUC8ws7m/LJsjYzDa0/r8luk=
-github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822 h1:C3w9PqII01/Oq1c1nUAm88MOHcQC9l5mIlSMApZMrHA=
-github.com/munnerz/goautoneg v0.0.0-20191010083416-a7dc8b61c822/go.mod h1:+n7T8mK8HuQTcFwEeznm/DIxMOiR9yIdICNftLE1DvQ=
-github.com/pmezard/go-difflib v1.0.0/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2 h1:Jamvg5psRIccs7FGNTlIRMkT8wgtp5eCXdBlqhYGL6U=
-github.com/pmezard/go-difflib v1.0.1-0.20181226105442-5d4384ee4fb2/go.mod h1:iKH77koFhYxTK1pcRnkKkqfTogsbg7gZNVY4sRDYZ/4=
-github.com/prometheus/client_golang v1.24.0 h1:5XStIklKuAtJSNpdD3s8XJj/Yv78IQmE1kbNk87JrAI=
-github.com/prometheus/client_golang v1.24.0/go.mod h1:QcsNdotprC2nS4BTM2ucbcqxd2CeXTEa9jW7zHO9iDE=
-github.com/prometheus/client_model v0.6.2 h1:oBsgwpGs7iVziMvrGhE53c/GrLUsZdHnqNwqPLxwZyk=
-github.com/prometheus/client_model v0.6.2/go.mod h1:y3m2F6Gdpfy6Ut/GBsUqTWZqCUvMVzSfMLjcu6wAwpE=
-github.com/prometheus/common v0.70.0 h1:bcpru3tWPVnxGnETLgOV5jbp/JRXgYEyv65CuBLAMMI=
-github.com/prometheus/common v0.70.0/go.mod h1:S/SFasQmgGiYH6C81LKCtYa8QACgthGg5zxL2udV7SY=
-github.com/spf13/pflag v1.0.10 h1:4EBh2KAYBwaONj6b2Ye1GiHfwjqyROoF4RwYO+vPwFk=
-github.com/spf13/pflag v1.0.10/go.mod h1:McXfInJRrz4CZXVZOBLb0bTZqETkiAhM9Iw0y3An2Bg=
-github.com/stretchr/objx v0.1.0/go.mod h1:HFkY916IF+rwdDfMAkV7OtwuqBVzrE8GR6GFx+wExME=
-github.com/stretchr/testify v1.3.0/go.mod h1:M5WIy9Dh21IEIfnGCwXGc5bZfKNJtfHm1UVUgZn+9EI=
-github.com/x448/float16 v0.8.4 h1:qLwI1I70+NjRFUR3zs1JPUCgaCXSh3SW62uAKT1mSBM=
-github.com/x448/float16 v0.8.4/go.mod h1:14CWIYCyZA/cWjXOioeEpHeN/83MdbZDRQHoFcYsOfg=
-go.uber.org/multierr v1.11.0 h1:blXXJkSxSSfBVBlC76pxqeO+LN3aDfLQo+309xJstO0=
-go.uber.org/multierr v1.11.0/go.mod h1:20+QtiLqy0Nd6FdQB9TLXag12DsQkrbs3htMFfDN80Y=
-go.uber.org/zap v1.27.1 h1:08RqriUEv8+ArZRYSTXy1LeBScaMpVSTBhCeaZYfMYc=
-go.uber.org/zap v1.27.1/go.mod h1:GB2qFLM7cTU87MWRP2mPIjqfIDnGu+VIO4V/SdhGo2E=
-go.yaml.in/yaml/v2 v2.4.4 h1:tuyd0P+2Ont/d6e2rl3be67goVK4R6deVxCUX5vyPaQ=
-go.yaml.in/yaml/v2 v2.4.4/go.mod h1:gMZqIpDtDqOfM0uNfy0SkpRhvUryYH0Z6wdMYcacYXQ=
-go.yaml.in/yaml/v3 v3.0.4 h1:tfq32ie2Jv2UxXFdLJdh3jXuOzWiL1fo0bu/FbuKpbc=
-go.yaml.in/yaml/v3 v3.0.4/go.mod h1:DhzuOOF2ATzADvBadXxruRBLzYTpT36CKvDb3+aBEFg=
-golang.org/x/net v0.57.0 h1:K5+3DljvIuDG9/Jv9rvyMywYNFCQ9RSUY6OOTTkT+tE=
-golang.org/x/net v0.57.0/go.mod h1:KpXc8iv+r3XplLAG/f7Jsf9RPszJzdR0f58q9vGOuEU=
-golang.org/x/oauth2 v0.36.0 h1:peZ/1z27fi9hUOFCAZaHyrpWG5lwe0RJEEEeH0ThlIs=
-golang.org/x/oauth2 v0.36.0/go.mod h1:YDBUJMTkDnJS+A4BP4eZBjCqtokkg1hODuPjwiGPO7Q=
-golang.org/x/sync v0.22.0 h1:SZjpbeLmrCk4xhRSZFNZW5gFUeCeFgjekvI/+gfScek=
-golang.org/x/sync v0.22.0/go.mod h1:9xrNwdLfx4jkKbNva9FpL6vEN7evnE43NNNJQ2LF3+0=
-golang.org/x/sys v0.47.0 h1:o7XGOvZQCADBQQ4Y7VNq2dRWQR7JmOUW8Kxx4ZsNgWs=
-golang.org/x/sys v0.47.0/go.mod h1:4GL1E5IUh+htKOUEOaiffhrAeqysfVGipDYzABqnCmw=
-golang.org/x/term v0.45.0 h1:NwWyBmoJCbfTHpxrWoZ9C6/VxOf7ic219I8xZZFdrf0=
-golang.org/x/term v0.45.0/go.mod h1:9aqxs0blBcrm/n0L9QW0aRVD+ktan8ssZromtqJC43w=
-golang.org/x/text v0.40.0 h1:Ub2Z6/xjgF1WrYQz2nuITOEegKFtiIy+rieRJ5lHZKs=
-golang.org/x/text v0.40.0/go.mod h1:hpnzDAfGV753zIKo+wk3u1bVKCGPbrnF7+7LBF/UHVY=
-golang.org/x/time v0.15.0 h1:bbrp8t3bGUeFOx08pvsMYRTCVSMk89u4tKbNOZbp88U=
-golang.org/x/time v0.15.0/go.mod h1:Y4YMaQmXwGQZoFaVFk4YpCt4FLQMYKZe9oeV/f4MSno=
-gomodules.xyz/jsonpatch/v2 v2.4.0 h1:Ci3iUJyx9UeRx7CeFN8ARgGbkESwJK+KB9lLcWxY/Zw=
-gomodules.xyz/jsonpatch/v2 v2.4.0/go.mod h1:AH3dM2RI6uoBZxn3LVrfvJ3E0/9dG4cSrbuBJT4moAY=
-google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af h1:+5/Sw3GsDNlEmu7TfklWKPdQ0Ykja5VEmq2i817+jbI=
-google.golang.org/protobuf v1.36.12-0.20260120151049-f2248ac996af/go.mod h1:HTf+CrKn2C3g5S8VImy6tdcUvCska2kB7j23XfzDpco=
-gopkg.in/check.v1 v0.0.0-20161208181325-20d25e280405/go.mod h1:Co6ibVJAznAaIkqp8huTwlJQCZ016jof/cbN4VW5Yz0=
-gopkg.in/evanphx/json-patch.v4 v4.13.0 h1:czT3CmqEaQ1aanPc5SdlgQrrEIb8w/wwCvWWnfEbYzo=
-gopkg.in/evanphx/json-patch.v4 v4.13.0/go.mod h1:p8EYWUEYMpynmqDbY58zCKCFZw8pRWMG4EsWvDvM72M=
-gopkg.in/inf.v0 v0.9.1 h1:73M5CoZyi3ZLMOyDlQh031Cx6N9NDJ2Vvfl76EDAgDc=
-gopkg.in/inf.v0 v0.9.1/go.mod h1:cWUDdTG/fYaXco+Dcufb5Vnc6Gp2YChqWtbxRZE0mXw=
-k8s.io/api v0.37.1 h1:l6N77U7tjwB5L056bgrBTJIEdevac/naBZ3iSvDNfpM=
-k8s.io/api v0.37.1/go.mod h1:zSlbB1YpJ1YQlFVQy20UYll81UJSJJUMLhkhvg6Z78M=
-k8s.io/apiextensions-apiserver v0.37.0 h1:zRMQ3+/LIE5oZ0tVvXwYHC+dIkSP5cjNWju7AZU1LOI=
-k8s.io/apiextensions-apiserver v0.37.0/go.mod h1:HU0PfSBwchHL5iDau6jjt9zU6ryWkDDlaVUiq91NK80=
-k8s.io/apimachinery v0.37.1 h1:hGCYyvKHCwtwMitj2vU4vYx0Z16N9GyZk9BBnz0wDAE=
-k8s.io/apimachinery v0.37.1/go.mod h1:jF84AyUi/IRIXRot5f+lm6MpxoWI+F1XgjaMmwCdTFw=
-k8s.io/client-go v0.37.0 h1:nsN31fy8wBySuZ+QRnKmrjRSQLOG2rvoGN0tKd12zhQ=
-k8s.io/client-go v0.37.0/go.mod h1:FcGqw+Ll/gNQiq+nPGY1Oyt9y7SgDh1d3MW3RFDEbn0=
-k8s.io/klog/v2 v2.140.0 h1:Tf+J3AH7xnUzZyVVXhTgGhEKnFqye14aadWv7bzXdzc=
-k8s.io/klog/v2 v2.140.0/go.mod h1:o+/RWfJ6PwpnFn7OyAG3QnO47BFsymfEfrz6XyYSSp0=
-k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad h1:oXImqH8mQNk7PmvzKhmN3ddJoY6OnyM225MXwGHPm0A=
-k8s.io/kube-openapi v0.0.0-20260721132016-d427ff9ee9ad/go.mod h1:0/mqHCVhlumdJ3BhCfnjSZQE037nAhNodh1/hK0T8/I=
-k8s.io/utils v0.0.0-20260626114624-be93311217bd h1:Ea7fgQ5we8Y9T0OX5o0dAHzQOBRI07D/dEYRaB9ZZEs=
-k8s.io/utils v0.0.0-20260626114624-be93311217bd/go.mod h1:xDxuJ0whA3d0I4mf/C4ppKHxXynQ+fxnkmQH0vTHnuk=
-sigs.k8s.io/controller-runtime v0.25.2 h1:bEkK3PVOIVK9X8QWLGVhJgmFc++47vfT6wakSzAOLsQ=
-sigs.k8s.io/controller-runtime v0.25.2/go.mod h1:4QqLdT6z/L6Olj8JJCtvztid4/fnIiYsfaTFScegctc=
-sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730 h1:IpInykpT6ceI+QxKBbEflcR5EXP7sU1kvOlxwZh5txg=
-sigs.k8s.io/json v0.0.0-20250730193827-2d320260d730/go.mod h1:mdzfpAEoE6DHQEN0uh9ZbOCuHbLK5wOm7dK4ctXE9Tg=
-sigs.k8s.io/randfill v1.0.0 h1:JfjMILfT8A6RbawdsK2JXGBR5AQVfd+9TbzrlneTyrU=
-sigs.k8s.io/randfill v1.0.0/go.mod h1:XeLlZ/jmk4i1HRopwe7/aU3H5n1zNUcX6TM94b3QxOY=
-sigs.k8s.io/structured-merge-diff/v6 v6.4.2 h1:qdOxHwrl2Kaag1aQEarlYcOA9vSyGCp3CIki3aW8c4Q=
-sigs.k8s.io/structured-merge-diff/v6 v6.4.2/go.mod h1:M3W8sfWvn2HhQDIbGWj3S099YozAsymCo/wrT5ohRUE=
-sigs.k8s.io/yaml v1.6.0 h1:G8fkbMSAFqgEFgh4b1wmtzDnioxFCUgTZhlbj5P9QYs=
-sigs.k8s.io/yaml v1.6.0/go.mod h1:796bPqUfzR/0jLAl6XjHl3Ck7MiyVv8dbTdyT3/pMf4=

k8s/apps/key-rotation-controller/controller/internal/reconcile/providers.go

@@ -1,168 +0,0 @@
-package reconcile
-
-import (
-	"context"
-	"encoding/base64"
-	"encoding/json"
-	"fmt"
-
-	iamv1 "github.com/riotpiao/key-rotation-controller/api"
-	"github.com/riotpiao/key-rotation-controller/internal/zitadel"
-)
-
-// MachineKeyProvider rotates a service user's private key.
-//
-// ZITADEL keeps many keys per service user, and each assertion names its key with
-// `kid`. A new key can be created while the deployed key stays valid, so this
-// provider retires the old key only after the new one proves itself. Nothing in
-// the window is invalid.
-type MachineKeyProvider struct {
-	// Client talks to the instance that owns the service user.
-	Client *zitadel.Client
-	// AuthClientID is the API app the controller authenticates as.
-	AuthClientID string
-	// KeyIDFile and KeyFile name the Secret keys, defaulting to key-id and key.
-	KeyIDFile string
-	KeyFile   string
-}
-
-// Name implements Provider.
-func (p *MachineKeyProvider) Name() string { return iamv1.ProviderZitadelMachineKey }
-
-// Strategy implements Provider. Machine keys overlap.
-func (p *MachineKeyProvider) Strategy() string { return iamv1.StrategyOverlap }
-
-// Prepare creates a new key. The currently deployed key remains valid.
-func (p *MachineKeyProvider) Prepare(ctx context.Context, kr *iamv1.KeyRotation) (*Credential, error) {
-	userID := kr.Spec.Target.MachineUserID
-	if userID == "" {
-		return nil, fmt.Errorf("spec.target.machineUserID is required")
-	}
-	key, err := p.Client.CreateMachineKey(userID)
-	if err != nil {
-		return nil, fmt.Errorf("creating a machine key: %w", err)
-	}
-	fields := map[string][]byte{
-		p.keyField(kr):   []byte(key.Key),
-		p.keyIDField(kr): []byte(key.KeyID),
-	}
-	return &Credential{ID: key.KeyID, Fields: fields}, nil
-}
-
-// Verify exchanges a token with the new key. A key that cannot obtain a token is
-// not deployed as a working credential, whatever the API said.
-func (p *MachineKeyProvider) Verify(ctx context.Context, kr *iamv1.KeyRotation, cred *Credential) error {
-	keyPEM := cred.Fields[p.keyField(kr)]
-	keyID := string(cred.Fields[p.keyIDField(kr)])
-	return p.Client.ExchangeMachineKey(
-		p.AuthClientID,
-		kr.Spec.Target.MachineUserID,
-		keyID,
-		keyPEM,
-		kr.Spec.Verify.AudienceProject,
-	)
-}
-
-// Retire deletes the superseded key.
-func (p *MachineKeyProvider) Retire(ctx context.Context, kr *iamv1.KeyRotation, credentialID string) error {
-	return p.Client.DeleteMachineKey(kr.Spec.Target.MachineUserID, credentialID)
-}
-
-func (p *MachineKeyProvider) keyField(kr *iamv1.KeyRotation) string {
-	if key, ok := kr.Spec.Target.SecretKeys["key"]; ok && key != "" {
-		return key
-	}
-	return "key"
-}
-
-func (p *MachineKeyProvider) keyIDField(kr *iamv1.KeyRotation) string {
-	if key, ok := kr.Spec.Target.SecretKeys["key-id"]; ok && key != "" {
-		return key
-	}
-	return "key-id"
-}
-
-// OIDCClientProvider rotates an app's client secret.
-//
-// ZITADEL stores exactly one secret per app, so creating the new secret kills the
-// old one. The strategy is atomic: publish immediately, roll the consumer, verify,
-// and if verification fails, put the previous value back.
-type OIDCClientProvider struct {
-	Client *zitadel.Client
-	// ClientIDFunc maps a KeyRotation to the app's client id, which the
-	// introspection endpoint needs.
-	ClientIDFunc func(kr *iamv1.KeyRotation) string
-	// SecretKey names the Secret key that holds the secret.
-	SecretKey string
-}
-
-// Name implements Provider.
-func (p *OIDCClientProvider) Name() string { return iamv1.ProviderZitadelOIDCClient }
-
-// Strategy implements Provider. Client secrets cannot overlap.
-func (p *OIDCClientProvider) Strategy() string { return iamv1.StrategyAtomic }
-
-// Prepare regenerates the client secret.
-func (p *OIDCClientProvider) Prepare(ctx context.Context, kr *iamv1.KeyRotation) (*Credential, error) {
-	projectID := kr.Spec.Target.ZitadelProjectID
-	appID := kr.Spec.Target.ZitadelAppID
-	if projectID == "" || appID == "" {
-		return nil, fmt.Errorf("spec.target.zitadelProjectID and zitadelAppID are required")
-	}
-	secret, err := p.Client.GenerateClientSecret(projectID, appID)
-	if err != nil {
-		return nil, fmt.Errorf("generating a client secret: %w", err)
-	}
-	field := p.secretField(kr)
-	// The credential id is the generation marker, not a ZITADEL identifier: the
-	// API returns only the value.
-	return &Credential{
-		ID:     "secret-" + shortHash(secret),
-		Fields: map[string][]byte{field: []byte(secret)},
-	}, nil
-}
-
-// Verify checks the credential against the introspection endpoint.
-func (p *OIDCClientProvider) Verify(ctx context.Context, kr *iamv1.KeyRotation, cred *Credential) error {
-	if !kr.Spec.Verify.Introspect {
-		return nil
-	}
-	clientID := ""
-	if p.ClientIDFunc != nil {
-		clientID = p.ClientIDFunc(kr)
-	}
-	if clientID == "" {
-		return fmt.Errorf("no client id configured for introspection")
-	}
-	return p.Client.Introspect(clientID, string(cred.Fields[p.secretField(kr)]))
-}
-
-// Retire is a no-op: an atomic provider has nothing to retire, because the
-// provider already invalidated the previous value.
-func (p *OIDCClientProvider) Retire(ctx context.Context, kr *iamv1.KeyRotation, credentialID string) error {
-	return nil
-}
-
-func (p *OIDCClientProvider) secretField(kr *iamv1.KeyRotation) string {
-	if p.SecretKey != "" {
-		return p.SecretKey
-	}
-	if key, ok := kr.Spec.Target.SecretKeys["secret"]; ok && key != "" {
-		return key
-	}
-	return "secret"
-}
-
-// shortHash gives a stable, non-reversible marker for a secret so status can
-// record which generation is live without storing the value.
-func shortHash(value string) string {
-	sum := 0
-	for _, b := range []byte(value) {
-		sum = (sum*31 + int(b)) % 100000007
-	}
-	encoded := base64.RawURLEncoding.EncodeToString([]byte(fmt.Sprintf("%d", sum)))
-	return encoded
-}
-
-// unusedJSON keeps the import set honest if a provider needs raw JSON later.
-var _ = json.Marshal

k8s/apps/key-rotation-controller/controller/internal/reconcile/reconciler.go

@@ -1,391 +0,0 @@
-// Package reconcile turns a KeyRotation object into a rotated credential.
-//
-// The state machine is identical for every provider. Only three calls differ:
-// create, verify, retire. That is what makes one controller cover machine keys,
-// client secrets and, later, the token-style providers.
-//
-// Order is the safety property:
-//
-//	Prepare    create the new credential
-//	Publish    write the Secret, roll the consumer when it cannot reload
-//	Verify     prove the new credential works against the provider
-//	Retire     delete the old credential, only for overlapping providers
-//
-// A failure before Retire leaves the old credential in place, so a broken
-// rotation never removes the thing that currently works.
-package reconcile
-
-import (
-	"context"
-	"fmt"
-	"time"
-
-	appsv1 "k8s.io/api/apps/v1"
-	corev1 "k8s.io/api/core/v1"
-	apierrors "k8s.io/apimachinery/pkg/api/errors"
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-	"k8s.io/apimachinery/pkg/types"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/log"
-
-	iamv1 "github.com/riotpiao/key-rotation-controller/api"
-)
-
-// Credential is fresh credential material, before it is written to a Secret.
-type Credential struct {
-	// ID identifies the credential at the provider, so it can be retired later.
-	ID string
-	// Fields maps a Secret key to its value.
-	Fields map[string][]byte
-}
-
-// Provider creates, verifies and retires one class of credential.
-type Provider interface {
-	// Name is the provider name from the spec.
-	Name() string
-	// Strategy is overlap or atomic. Atomic providers replace in place.
-	Strategy() string
-	// Prepare creates a new credential at the provider.
-	Prepare(ctx context.Context, kr *iamv1.KeyRotation) (*Credential, error)
-	// Verify proves the credential works, using the provider's own check.
-	Verify(ctx context.Context, kr *iamv1.KeyRotation, cred *Credential) error
-	// Retire deletes a superseded credential. It must be safe to call twice.
-	Retire(ctx context.Context, kr *iamv1.KeyRotation, credentialID string) error
-}
-
-// Reconciler rotates credentials for KeyRotation objects.
-type Reconciler struct {
-	client.Client
-	// Providers keyed by spec.provider.
-	Providers map[string]Provider
-	// Now is injectable so scheduling is testable.
-	Now func() time.Time
-	// RolloutTimeout bounds the wait for a consumer to become available.
-	RolloutTimeout time.Duration
-}
-
-// previousKeySuffix keeps the superseded value beside the current one, so an
-// atomic provider can be rolled back without storing a secret in the object.
-const previousKeySuffix = ".previous"
-
-// RequeueAfter is how long to wait before checking a resource again.
-func (r *Reconciler) RequeueAfter(kr *iamv1.KeyRotation) time.Duration {
-	interval := time.Duration(kr.Spec.IntervalHours) * time.Hour
-	if interval <= 0 {
-		interval = 30 * 24 * time.Hour
-	}
-	if kr.Status.LastRotation == nil || kr.Status.ActiveCredentialID == "" {
-		return 0 // rotate now
-	}
-	due := kr.Status.LastRotation.Add(interval)
-	wait := due.Sub(r.now())
-	if wait < 0 {
-		return 0
-	}
-	return wait
-}
-
-// Reconcile performs one rotation when the resource is due.
-func (r *Reconciler) Reconcile(ctx context.Context, req types.NamespacedName) (time.Duration, error) {
-	logger := log.FromContext(ctx).WithValues("keyrotation", req.String())
-
-	var kr iamv1.KeyRotation
-	if err := r.Get(ctx, req, &kr); err != nil {
-		if apierrors.IsNotFound(err) {
-			return 0, nil
-		}
-		return 0, err
-	}
-
-	if kr.Spec.Suspend {
-		return 0, r.setPhase(ctx, &kr, iamv1.PhaseSuspended, "")
-	}
-
-	provider := r.Providers[kr.Spec.Provider]
-	if provider == nil {
-		return 0, r.setPhase(ctx, &kr, iamv1.PhaseFailed,
-			fmt.Sprintf("no provider named %q", kr.Spec.Provider))
-	}
-
-	wait := r.RequeueAfter(&kr)
-	if wait > 0 {
-		return wait, nil
-	}
-
-	logger.Info("rotating credential", "provider", kr.Spec.Provider, "strategy", kr.Spec.Strategy)
-
-	previousID := kr.Status.ActiveCredentialID
-	previousFields := r.readCurrentSecret(ctx, &kr)
-
-	// Prepare
-	if err := r.setPhase(ctx, &kr, iamv1.PhasePreparing, ""); err != nil {
-		return 0, err
-	}
-	cred, err := provider.Prepare(ctx, &kr)
-	if err != nil {
-		return r.fail(ctx, &kr, iamv1.PhasePreparing, err)
-	}
-
-	// Publish. The previous value stays beside the new one until verification
-	// passes, so an atomic rotation can be undone.
-	if err := r.setPhase(ctx, &kr, iamv1.PhasePropagating, ""); err != nil {
-		return 0, err
-	}
-	if err := r.writeSecret(ctx, &kr, cred, previousFields); err != nil {
-		return r.fail(ctx, &kr, iamv1.PhasePropagating, err)
-	}
-	if kr.Spec.Target.Reload != iamv1.ReloadHot {
-		if err := r.rollConsumers(ctx, &kr, cred.ID); err != nil {
-			return r.fail(ctx, &kr, iamv1.PhasePropagating, err)
-		}
-	}
-
-	// Verify
-	if err := r.setPhase(ctx, &kr, iamv1.PhaseVerifying, ""); err != nil {
-		return 0, err
-	}
-	if err := provider.Verify(ctx, &kr, cred); err != nil {
-		// Put the previous value back and roll again, then report the failure.
-		r.restorePrevious(ctx, &kr, previousFields)
-		return r.fail(ctx, &kr, iamv1.PhaseVerifying, err)
-	}
-
-	// Complete. Retire only when the provider can overlap, because retiring an
-	// atomic credential would delete the one now in use.
-	if err := r.setPhase(ctx, &kr, iamv1.PhaseCompleting, ""); err != nil {
-		return 0, err
-	}
-	if provider.Strategy() == iamv1.StrategyOverlap && previousID != "" && previousID != cred.ID {
-		if err := provider.Retire(ctx, &kr, previousID); err != nil {
-			logger.Error(err, "retiring the previous credential failed; it stays valid", "credential", previousID)
-		}
-	}
-	r.clearPrevious(ctx, &kr)
-
-	now := metav1.NewTime(r.now())
-	kr.Status.LastRotation = &now
-	kr.Status.ActiveCredentialID = cred.ID
-	kr.Status.PreviousCredentialID = previousID
-	kr.Status.LastError = ""
-	kr.Status.ObservedGeneration = kr.Generation
-	if err := r.Status().Update(ctx, &kr); err != nil {
-		return 0, err
-	}
-	if err := r.setPhase(ctx, &kr, iamv1.PhaseSucceeded, ""); err != nil {
-		return 0, err
-	}
-	logger.Info("rotation complete", "credential", cred.ID, "previous", previousID)
-
-	return r.RequeueAfter(&kr), nil
-}
-
-func (r *Reconciler) now() time.Time {
-	if r.Now != nil {
-		return r.Now()
-	}
-	return time.Now()
-}
-
-func (r *Reconciler) setPhase(ctx context.Context, kr *iamv1.KeyRotation, phase, message string) error {
-	kr.Status.Phase = phase
-	kr.Status.LastError = message
-	kr.Status.ObservedGeneration = kr.Generation
-	if err := r.Status().Update(ctx, kr); err != nil && !apierrors.IsConflict(err) {
-		return err
-	}
-	return nil
-}
-
-func (r *Reconciler) fail(ctx context.Context, kr *iamv1.KeyRotation, phase string, cause error) (time.Duration, error) {
-	kr.Status.Phase = iamv1.PhaseFailed
-	kr.Status.LastError = fmt.Sprintf("%s: %v", phase, cause)
-	_ = r.Status().Update(ctx, kr)
-	// Retry soon, but not in a tight loop.
-	return 5 * time.Minute, nil
-}
-
-// secretData assembles the Secret payload: the new values, plus the superseded
-// values under a shadow key so an atomic rotation can be undone.
-func secretData(kr *iamv1.KeyRotation, cred *Credential, previous map[string][]byte) map[string][]byte {
-	data := make(map[string][]byte, len(cred.Fields)*2)
-	for logical, value := range cred.Fields {
-		key := secretKeyFor(kr, logical)
-		data[key] = value
-		if old, ok := previous[key]; ok && len(old) > 0 {
-			data[key+previousKeySuffix] = old
-		}
-	}
-	return data
-}
-
-// secretKeyFor maps a logical field name to the Secret key, defaulting to the
-// same name so a simple credential needs no mapping.
-func secretKeyFor(kr *iamv1.KeyRotation, logical string) string {
-	if key, ok := kr.Spec.Target.SecretKeys[logical]; ok && key != "" {
-		return key
-	}
-	return logical
-}
-
-func (r *Reconciler) readCurrentSecret(ctx context.Context, kr *iamv1.KeyRotation) map[string][]byte {
-	var secret corev1.Secret
-	err := r.Get(ctx, types.NamespacedName{
-		Namespace: kr.Spec.Target.SecretNamespace,
-		Name:      kr.Spec.Target.SecretName,
-	}, &secret)
-	if err != nil {
-		return nil
-	}
-	return secret.Data
-}
-
-func (r *Reconciler) writeSecret(ctx context.Context, kr *iamv1.KeyRotation, cred *Credential, previous map[string][]byte) error {
-	data := secretData(kr, cred, previous)
-
-	var secret corev1.Secret
-	key := types.NamespacedName{Namespace: kr.Spec.Target.SecretNamespace, Name: kr.Spec.Target.SecretName}
-	err := r.Get(ctx, key, &secret)
-	if apierrors.IsNotFound(err) {
-		secret = corev1.Secret{
-			ObjectMeta: metav1.ObjectMeta{
-				Name:      key.Name,
-				Namespace: key.Namespace,
-				Labels:    map[string]string{"app.kubernetes.io/managed-by": "key-rotation-controller"},
-			},
-			Type: corev1.SecretTypeOpaque,
-			Data: data,
-		}
-		return r.Create(ctx, &secret)
-	}
-	if err != nil {
-		return err
-	}
-	secret.Data = data
-	return r.Update(ctx, &secret)
-}
-
-// restorePrevious puts the shadow values back in place after a failed check.
-func (r *Reconciler) restorePrevious(ctx context.Context, kr *iamv1.KeyRotation, previous map[string][]byte) {
-	if len(previous) == 0 {
-		return
-	}
-	var secret corev1.Secret
-	key := types.NamespacedName{Namespace: kr.Spec.Target.SecretNamespace, Name: kr.Spec.Target.SecretName}
-	if err := r.Get(ctx, key, &secret); err != nil {
-		return
-	}
-	// Restore every shadowed value over the current one.
-	for k, v := range secret.Data {
-		base := k
-		if len(k) > len(previousKeySuffix) && k[len(k)-len(previousKeySuffix):] == previousKeySuffix {
-			base = k[:len(k)-len(previousKeySuffix)]
-			secret.Data[base] = v
-		}
-	}
-	_ = r.Update(ctx, &secret)
-	_ = r.rollConsumers(ctx, kr, "rollback")
-}
-
-// clearPrevious removes the shadow values once verification passed.
-func (r *Reconciler) clearPrevious(ctx context.Context, kr *iamv1.KeyRotation) {
-	var secret corev1.Secret
-	key := types.NamespacedName{Namespace: kr.Spec.Target.SecretNamespace, Name: kr.Spec.Target.SecretName}
-	if err := r.Get(ctx, key, &secret); err != nil {
-		return
-	}
-	changed := false
-	for k := range secret.Data {
-		if len(k) > len(previousKeySuffix) && k[len(k)-len(previousKeySuffix):] == previousKeySuffix {
-			delete(secret.Data, k)
-			changed = true
-		}
-	}
-	if changed {
-		_ = r.Update(ctx, &secret)
-	}
-}
-
-// rollConsumers restarts each consumer so it reads the new value.
-func (r *Reconciler) rollConsumers(ctx context.Context, kr *iamv1.KeyRotation, revision string) error {
-	for _, consumer := range kr.Spec.Target.Consumers {
-		ns := consumer.Namespace
-		if ns == "" {
-			ns = kr.Namespace
-		}
-		switch consumer.Kind {
-		case "Deployment":
-			var dep appsv1.Deployment
-			if err := r.Get(ctx, types.NamespacedName{Namespace: ns, Name: consumer.Name}, &dep); err != nil {
-				return fmt.Errorf("consumer %s/%s: %w", ns, consumer.Name, err)
-			}
-			base := dep.DeepCopy()
-			if dep.Spec.Template.Annotations == nil {
-				dep.Spec.Template.Annotations = map[string]string{}
-			}
-			dep.Spec.Template.Annotations["iam.homelab.riotpiao.com/credential-revision"] = revision
-			if err := r.Patch(ctx, &dep, client.MergeFrom(base)); err != nil {
-				return fmt.Errorf("rolling %s/%s: %w", ns, consumer.Name, err)
-			}
-		case "StatefulSet":
-			var sts appsv1.StatefulSet
-			if err := r.Get(ctx, types.NamespacedName{Namespace: ns, Name: consumer.Name}, &sts); err != nil {
-				return fmt.Errorf("consumer %s/%s: %w", ns, consumer.Name, err)
-			}
-			base := sts.DeepCopy()
-			if sts.Spec.Template.Annotations == nil {
-				sts.Spec.Template.Annotations = map[string]string{}
-			}
-			sts.Spec.Template.Annotations["iam.homelab.riotpiao.com/credential-revision"] = revision
-			if err := r.Patch(ctx, &sts, client.MergeFrom(base)); err != nil {
-				return fmt.Errorf("rolling %s/%s: %w", ns, consumer.Name, err)
-			}
-		default:
-			return fmt.Errorf("consumer kind %q is not supported", consumer.Kind)
-		}
-	}
-	return r.waitForConsumers(ctx, kr)
-}
-
-// waitForConsumers blocks until every consumer reports all replicas available.
-func (r *Reconciler) waitForConsumers(ctx context.Context, kr *iamv1.KeyRotation) error {
-	deadline := r.now().Add(r.rolloutTimeout())
-	for {
-		ready := true
-		for _, consumer := range kr.Spec.Target.Consumers {
-			ns := consumer.Namespace
-			if ns == "" {
-				ns = kr.Namespace
-			}
-			var dep appsv1.Deployment
-			if err := r.Get(ctx, types.NamespacedName{Namespace: ns, Name: consumer.Name}, &dep); err != nil {
-				continue
-			}
-			desired := int32(1)
-			if dep.Spec.Replicas != nil {
-				desired = *dep.Spec.Replicas
-			}
-			if dep.Status.UpdatedReplicas < desired || dep.Status.AvailableReplicas < desired {
-				ready = false
-				break
-			}
-		}
-		if ready {
-			return nil
-		}
-		if r.now().After(deadline) {
-			return fmt.Errorf("consumer did not become available within %s", r.rolloutTimeout())
-		}
-		select {
-		case <-ctx.Done():
-			return ctx.Err()
-		case <-time.After(2 * time.Second):
-		}
-	}
-}
-
-func (r *Reconciler) rolloutTimeout() time.Duration {
-	if r.RolloutTimeout > 0 {
-		return r.RolloutTimeout
-	}
-	return 3 * time.Minute
-}

k8s/apps/key-rotation-controller/controller/internal/reconcile/reconciler_test.go

@@ -1,155 +0,0 @@
-package reconcile
-
-import (
-	"testing"
-	"time"
-
-	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
-
-	iamv1 "github.com/riotpiao/key-rotation-controller/api"
-)
-
-func rotation(last *metav1.Time, activeID string, hours int32) *iamv1.KeyRotation {
-	return &iamv1.KeyRotation{
-		Spec: iamv1.KeyRotationSpec{
-			Provider:      iamv1.ProviderZitadelMachineKey,
-			Strategy:      iamv1.StrategyOverlap,
-			IntervalHours: hours,
-		},
-		Status: iamv1.KeyRotationStatus{
-			LastRotation:       last,
-			ActiveCredentialID: activeID,
-		},
-	}
-}
-
-func TestRequeueAfterRotatesImmediatelyWhenNeverRotated(t *testing.T) {
-	r := &Reconciler{Now: func() time.Time { return time.Unix(1_700_000_000, 0) }}
-	if got := r.RequeueAfter(rotation(nil, "", 24)); got != 0 {
-		t.Fatalf("a resource with no rotation history must rotate now, got %s", got)
-	}
-	if got := r.RequeueAfter(rotation(nil, "key-1", 24)); got != 0 {
-		t.Fatalf("a resource with no lastRotation must rotate now, got %s", got)
-	}
-}
-
-func TestRequeueAfterWaitsForTheInterval(t *testing.T) {
-	now := time.Unix(1_700_000_000, 0)
-	last := metav1.NewTime(now.Add(-6 * time.Hour))
-	r := &Reconciler{Now: func() time.Time { return now }}
-
-	got := r.RequeueAfter(rotation(&last, "key-1", 24))
-	want := 18 * time.Hour
-	if got != want {
-		t.Fatalf("expected %s until the next rotation, got %s", want, got)
-	}
-}
-
-func TestRequeueAfterRotatesWhenOverdue(t *testing.T) {
-	now := time.Unix(1_700_000_000, 0)
-	last := metav1.NewTime(now.Add(-30 * time.Hour))
-	r := &Reconciler{Now: func() time.Time { return now }}
-
-	if got := r.RequeueAfter(rotation(&last, "key-1", 24)); got != 0 {
-		t.Fatalf("an overdue resource must rotate now, got %s", got)
-	}
-}
-
-func TestRequeueAfterFallsBackWhenNoInterval(t *testing.T) {
-	now := time.Unix(1_700_000_000, 0)
-	last := metav1.NewTime(now)
-	r := &Reconciler{Now: func() time.Time { return now }}
-
-	got := r.RequeueAfter(rotation(&last, "key-1", 0))
-	if got <= 0 {
-		t.Fatalf("a zero interval must fall back to a default, got %s", got)
-	}
-}
-
-func TestSecretDataKeepsThePreviousValueUnderAShadowKey(t *testing.T) {
-	kr := &iamv1.KeyRotation{Spec: iamv1.KeyRotationSpec{
-		Target: iamv1.RotationTarget{
-			SecretKeys: map[string]string{"key": "jwt-key", "key-id": "jwt-key-id"},
-		},
-	}}
-	cred := &Credential{ID: "k2", Fields: map[string][]byte{
-		"key":    []byte("PEM-2"),
-		"key-id": []byte("k2"),
-	}}
-	previous := map[string][]byte{
-		"jwt-key":    []byte("PEM-1"),
-		"jwt-key-id": []byte("k1"),
-	}
-
-	data := secretData(kr, cred, previous)
-
-	if string(data["jwt-key"]) != "PEM-2" {
-		t.Fatalf("current value missing, got %q", data["jwt-key"])
-	}
-	if string(data["jwt-key"+previousKeySuffix]) != "PEM-1" {
-		t.Fatalf("previous value must be kept for rollback, got %q", data["jwt-key"+previousKeySuffix])
-	}
-	if string(data["jwt-key-id"+previousKeySuffix]) != "k1" {
-		t.Fatalf("previous key id must be kept for rollback")
-	}
-}
-
-func TestSecretDataDefaultsToLogicalNames(t *testing.T) {
-	kr := &iamv1.KeyRotation{}
-	cred := &Credential{ID: "k1", Fields: map[string][]byte{"secret": []byte("s3cret")}}
-
-	data := secretData(kr, cred, nil)
-
-	if string(data["secret"]) != "s3cret" {
-		t.Fatalf("an unmapped field must keep its logical name, got %v", data)
-	}
-	if _, shadow := data["secret"+previousKeySuffix]; shadow {
-		t.Fatalf("no previous value existed, so no shadow key may be written")
-	}
-}
-
-func TestSecretKeyForPrefersTheMapping(t *testing.T) {
-	kr := &iamv1.KeyRotation{Spec: iamv1.KeyRotationSpec{
-		Target: iamv1.RotationTarget{
-			SecretKeys: map[string]string{"secret": "GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET"},
-		},
-	}}
-	if got := secretKeyFor(kr, "secret"); got != "GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET" {
-		t.Fatalf("mapping not honoured, got %q", got)
-	}
-	if got := secretKeyFor(kr, "key-id"); got != "key-id" {
-		t.Fatalf("unmapped field must default to its own name, got %q", got)
-	}
-}
-
-func TestMachineKeyProviderFieldsRespectTheMapping(t *testing.T) {
-	p := &MachineKeyProvider{}
-	kr := &iamv1.KeyRotation{Spec: iamv1.KeyRotationSpec{
-		Target: iamv1.RotationTarget{
-			SecretKeys: map[string]string{"key": "private-key", "key-id": "kid"},
-		},
-	}}
-	if p.keyField(kr) != "private-key" || p.keyIDField(kr) != "kid" {
-		t.Fatalf("provider must read the mapped Secret keys")
-	}
-	if p.Strategy() != iamv1.StrategyOverlap {
-		t.Fatalf("machine keys must be an overlapping provider")
-	}
-	if (&OIDCClientProvider{}).Strategy() != iamv1.StrategyAtomic {
-		t.Fatalf("client secrets cannot overlap and must be atomic")
-	}
-}
-
-func TestShortHashIsStableAndDoesNotLeakTheValue(t *testing.T) {
-	a := shortHash("super-secret-value")
-	b := shortHash("super-secret-value")
-	if a != b {
-		t.Fatalf("the marker must be stable for the same value")
-	}
-	if a == "super-secret-value" {
-		t.Fatalf("the marker must not be the value itself")
-	}
-	if shortHash("other") == a {
-		t.Fatalf("different values must produce different markers")
-	}
-}

k8s/apps/key-rotation-controller/controller/internal/zitadel/client.go

@@ -1,308 +0,0 @@
-package zitadel
-
-import (
-	"bytes"
-	"encoding/base64"
-	"encoding/json"
-	"fmt"
-	"io"
-	"net/http"
-	"net/url"
-	"strings"
-	"sync"
-	"time"
-)
-
-// Config holds everything the controller needs to call ZITADEL.
-type Config struct {
-	// Issuer is the instance URL, for example https://zitadel.riotpiao.com.
-	Issuer string
-	// ClientID is the API app that this controller authenticates as.
-	ClientID string
-	// UserID is the machine user the assertion acts for. Empty means ClientID.
-	UserID string
-	// KeyID and PrivateKeyPEM identify the controller's own machine key.
-	KeyID         string
-	PrivateKeyPEM []byte
-	// HTTPClient is optional; a sane default is used when nil.
-	HTTPClient *http.Client
-}
-
-// Client is a thin ZITADEL management client.
-type Client struct {
-	cfg   Config
-	http  *http.Client
-	mu    sync.Mutex
-	token string
-	until time.Time
-}
-
-// New builds a client.
-func New(cfg Config) *Client {
-	client := cfg.HTTPClient
-	if client == nil {
-		client = &http.Client{Timeout: 20 * time.Second}
-	}
-	return &Client{cfg: cfg, http: client}
-}
-
-// AccessToken returns a cached access token, minting one when needed.
-func (c *Client) AccessToken() (string, error) {
-	c.mu.Lock()
-	defer c.mu.Unlock()
-
-	if c.token != "" && time.Now().Before(c.until) {
-		return c.token, nil
-	}
-
-	assertion, err := SignAssertion(c.cfg.PrivateKeyPEM, c.cfg.KeyID, c.cfg.ClientID, c.cfg.UserID, c.cfg.Issuer, time.Now())
-	if err != nil {
-		return "", err
-	}
-
-	form := url.Values{}
-	form.Set("grant_type", "urn:ietf:params:oauth:grant-type:jwt-bearer")
-	form.Set("assertion", assertion)
-	form.Set("scope", "openid")
-
-	req, err := http.NewRequest(http.MethodPost, strings.TrimRight(c.cfg.Issuer, "/")+"/oauth/v2/token", strings.NewReader(form.Encode()))
-	if err != nil {
-		return "", err
-	}
-	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-
-	resp, err := c.http.Do(req)
-	if err != nil {
-		return "", fmt.Errorf("token request failed: %w", err)
-	}
-	defer resp.Body.Close()
-
-	body, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<16))
-	if resp.StatusCode != http.StatusOK {
-		return "", fmt.Errorf("token endpoint returned %d: %s", resp.StatusCode, strings.TrimSpace(string(body)))
-	}
-
-	var parsed struct {
-		AccessToken string `json:"access_token"`
-		ExpiresIn   int    `json:"expires_in"`
-	}
-	if err := json.Unmarshal(body, &parsed); err != nil {
-		return "", fmt.Errorf("token response did not parse: %w", err)
-	}
-	if parsed.AccessToken == "" {
-		return "", fmt.Errorf("token response carried no access_token")
-	}
-
-	lifetime := parsed.ExpiresIn
-	if lifetime <= 0 {
-		lifetime = 300
-	}
-	c.token = parsed.AccessToken
-	// Refresh at 80 % of the lifetime so a slow call never presents an expired token.
-	c.until = time.Now().Add(time.Duration(lifetime) * time.Second * 4 / 5)
-	return c.token, nil
-}
-
-// projectAppPath builds the management path for one OIDC app under a project.
-func (c *Client) projectAppPath(projectID, appID string) string {
-	return fmt.Sprintf("/management/v1/projects/%s/apps/%s", projectID, appID)
-}
-
-// MachineKey is one registered key for a service user.
-type MachineKey struct {
-	KeyID      string `json:"keyId"`
-	Expiration string `json:"expirationDate,omitempty"`
-	// Details holds the PEM bundle when the key was just created.
-	Details string `json:"keyDetails,omitempty"`
-}
-
-// NewMachineKeyJSON is the JSON document ZITADEL returns for a new JSON key.
-type NewMachineKeyJSON struct {
-	Type     string `json:"type"`
-	KeyID    string `json:"keyId"`
-	Key      string `json:"key"`
-	UserID   string `json:"userId"`
-	ExpireAt string `json:"expirationDate,omitempty"`
-}
-
-// CreateMachineKey adds a key to a service user and returns its material.
-//
-// ZITADEL keeps many keys per user, so this never invalidates the key that is
-// currently deployed. That is the whole reason the machine-key provider can
-// rotate with no gap.
-func (c *Client) CreateMachineKey(userID string) (*NewMachineKeyJSON, error) {
-	payload := map[string]any{"type": "KEY_TYPE_JSON"}
-	var out struct {
-		KeyID      string `json:"keyId"`
-		KeyDetails string `json:"keyDetails"`
-	}
-	if err := c.post("/management/v1/users/"+userID+"/keys", payload, &out); err != nil {
-		return nil, err
-	}
-	if out.KeyDetails == "" {
-		return nil, fmt.Errorf("create machine key returned no key material")
-	}
-
-	raw, err := base64Decode(out.KeyDetails)
-	if err != nil {
-		return nil, fmt.Errorf("key material is not base64: %w", err)
-	}
-
-	var key NewMachineKeyJSON
-	if err := json.Unmarshal(raw, &key); err != nil {
-		return nil, fmt.Errorf("key material is not the expected JSON: %w", err)
-	}
-	return &key, nil
-}
-
-// DeleteMachineKey removes one key. Called only after the new key is proven.
-func (c *Client) DeleteMachineKey(userID, keyID string) error {
-	return c.delete("/management/v1/users/" + userID + "/keys/" + keyID)
-}
-
-// GenerateClientSecret replaces the client secret of an OIDC app.
-//
-// ZITADEL stores exactly one secret per app, so the previous secret stops working
-// at this call. The caller must publish the new value immediately.
-func (c *Client) GenerateClientSecret(projectID, appID string) (string, error) {
-	var out struct {
-		ClientSecret string `json:"clientSecret"`
-	}
-	path := c.projectAppPath(projectID, appID) + "/oidc_config/_generate_client_secret"
-	if err := c.post(path, map[string]any{}, &out); err != nil {
-		return "", err
-	}
-	if out.ClientSecret == "" {
-		return "", fmt.Errorf("generate client secret returned an empty value")
-	}
-	return out.ClientSecret, nil
-}
-
-// Introspect checks a client credential against the token endpoint.
-//
-// A successful call returns an object with `active`. The credentials are valid
-// when the endpoint answers 200, whatever `active` says, because `active`
-// describes the token rather than the client.
-func (c *Client) Introspect(clientID, clientSecret string) error {
-	form := url.Values{}
-	form.Set("token", "probe")
-
-	req, err := http.NewRequest(http.MethodPost, strings.TrimRight(c.cfg.Issuer, "/")+"/oauth/v2/introspect", strings.NewReader(form.Encode()))
-	if err != nil {
-		return err
-	}
-	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-	req.SetBasicAuth(clientID, clientSecret)
-
-	resp, err := c.http.Do(req)
-	if err != nil {
-		return fmt.Errorf("introspection request failed: %w", err)
-	}
-	defer resp.Body.Close()
-	body, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<16))
-
-	if resp.StatusCode != http.StatusOK {
-		return fmt.Errorf("introspection returned %d: %s", resp.StatusCode, strings.TrimSpace(string(body)))
-	}
-	return nil
-}
-
-// ExchangeMachineKey obtains a token with a specific key, proving that key works.
-func (c *Client) ExchangeMachineKey(clientID, userID, keyID string, keyPEM []byte, audienceProject string) error {
-	assertion, err := SignAssertion(keyPEM, keyID, clientID, userID, c.cfg.Issuer, time.Now())
-	if err != nil {
-		return err
-	}
-
-	scope := "openid"
-	if audienceProject != "" {
-		scope += " urn:zitadel:iam:org:project:id:" + audienceProject + ":aud"
-	}
-
-	form := url.Values{}
-	form.Set("grant_type", "urn:ietf:params:oauth:grant-type:jwt-bearer")
-	form.Set("assertion", assertion)
-	form.Set("scope", scope)
-
-	req, err := http.NewRequest(http.MethodPost, strings.TrimRight(c.cfg.Issuer, "/")+"/oauth/v2/token", strings.NewReader(form.Encode()))
-	if err != nil {
-		return err
-	}
-	req.Header.Set("Content-Type", "application/x-www-form-urlencoded")
-
-	resp, err := c.http.Do(req)
-	if err != nil {
-		return fmt.Errorf("key exchange failed: %w", err)
-	}
-	defer resp.Body.Close()
-	body, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<16))
-	if resp.StatusCode != http.StatusOK {
-		return fmt.Errorf("key exchange returned %d: %s", resp.StatusCode, strings.TrimSpace(string(body)))
-	}
-	return nil
-}
-
-func (c *Client) do(method, path string, payload any, out any) error {
-	token, err := c.AccessToken()
-	if err != nil {
-		return err
-	}
-
-	var body io.Reader
-	if payload != nil {
-		encoded, err := json.Marshal(payload)
-		if err != nil {
-			return err
-		}
-		body = bytes.NewReader(encoded)
-	}
-
-	req, err := http.NewRequest(method, strings.TrimRight(c.cfg.Issuer, "/")+path, body)
-	if err != nil {
-		return err
-	}
-	req.Header.Set("Authorization", "Bearer "+token)
-	if payload != nil {
-		req.Header.Set("Content-Type", "application/json")
-	}
-
-	resp, err := c.http.Do(req)
-	if err != nil {
-		return err
-	}
-	defer resp.Body.Close()
-
-	raw, _ := io.ReadAll(io.LimitReader(resp.Body, 1<<20))
-	if resp.StatusCode < 200 || resp.StatusCode >= 300 {
-		return fmt.Errorf("%s %s returned %d: %s", method, path, resp.StatusCode, strings.TrimSpace(string(raw)))
-	}
-	if out != nil && len(raw) > 0 {
-		if err := json.Unmarshal(raw, out); err != nil {
-			return fmt.Errorf("%s %s response did not parse: %w", method, path, err)
-		}
-	}
-	return nil
-}
-
-func (c *Client) post(path string, payload, out any) error {
-	return c.do(http.MethodPost, path, payload, out)
-}
-
-func (c *Client) delete(path string) error {
-	return c.do(http.MethodDelete, path, nil, nil)
-}
-
-func base64Decode(s string) ([]byte, error) {
-	if raw, err := base64StdDecode(s); err == nil {
-		return raw, nil
-	}
-	return base64URLDecode(s)
-}
-
-func base64StdDecode(s string) ([]byte, error) {
-	return base64.StdEncoding.DecodeString(s)
-}
-
-func base64URLDecode(s string) ([]byte, error) {
-	return base64.RawURLEncoding.DecodeString(s)
-}

k8s/apps/key-rotation-controller/controller/internal/zitadel/jwt.go

@@ -1,89 +0,0 @@
-// Package zitadel talks to the ZITADEL management API with the controller's own
-// machine key.
-//
-// The controller needs a credential to rotate credentials. It signs a short
-// assertion with its private key, exchanges it for an access token, and reuses
-// that token until shortly before it expires.
-package zitadel
-
-import (
-	"crypto"
-	"crypto/rand"
-	"crypto/rsa"
-	"crypto/sha256"
-	"crypto/x509"
-	"encoding/base64"
-	"encoding/json"
-	"encoding/pem"
-	"fmt"
-	"time"
-)
-
-// assertionLifetime is deliberately short. The assertion proves one request.
-const assertionLifetime = 60 * time.Second
-
-// newAssertionClaims builds the claim set for a machine-key assertion.
-//
-// ZITADEL expects `iss` to name the caller, `sub` to name the user it acts as,
-// and `aud` to equal the issuer of the instance.
-func newAssertionClaims(clientID, userID, issuer string, now time.Time) map[string]any {
-	if userID == "" {
-		userID = clientID
-	}
-	return map[string]any{
-		"iss": clientID,
-		"sub": userID,
-		"aud": issuer,
-		"iat": now.Unix(),
-		"exp": now.Add(assertionLifetime).Unix(),
-	}
-}
-
-func base64URL(b []byte) string {
-	return base64.RawURLEncoding.EncodeToString(b)
-}
-
-// SignAssertion produces a signed RS256 JWT for the jwt-bearer grant.
-//
-// The header carries `kid`, so ZITADEL selects the matching registered key. That
-// is what makes overlapping keys possible: two keys can be valid at once and the
-// assertion says which one it used.
-func SignAssertion(privateKeyPEM []byte, keyID, clientID, userID, issuer string, now time.Time) (string, error) {
-	block, _ := pem.Decode(privateKeyPEM)
-	if block == nil {
-		return "", fmt.Errorf("private key is not PEM encoded")
-	}
-
-	key, err := x509.ParsePKCS8PrivateKey(block.Bytes)
-	if err != nil {
-		// ZITADEL exports PKCS#1 keys as well.
-		if rsaKey, rsaErr := x509.ParsePKCS1PrivateKey(block.Bytes); rsaErr == nil {
-			key = rsaKey
-		} else {
-			return "", fmt.Errorf("private key does not parse: %w", err)
-		}
-	}
-	rsaKey, ok := key.(*rsa.PrivateKey)
-	if !ok {
-		return "", fmt.Errorf("private key is not RSA")
-	}
-
-	header := map[string]any{"alg": "RS256", "typ": "JWT", "kid": keyID}
-	headerJSON, err := json.Marshal(header)
-	if err != nil {
-		return "", err
-	}
-	claimsJSON, err := json.Marshal(newAssertionClaims(clientID, userID, issuer, now))
-	if err != nil {
-		return "", err
-	}
-
-	signingInput := base64URL(headerJSON) + "." + base64URL(claimsJSON)
-	digest := sha256.Sum256([]byte(signingInput))
-	signature, err := rsa.SignPKCS1v15(rand.Reader, rsaKey, crypto.SHA256, digest[:])
-	if err != nil {
-		return "", fmt.Errorf("cannot sign the assertion: %w", err)
-	}
-
-	return signingInput + "." + base64URL(signature), nil
-}

k8s/apps/key-rotation-controller/controller/internal/zitadel/jwt_test.go

@@ -1,90 +0,0 @@
-package zitadel
-
-import (
-	"crypto/rand"
-	"crypto/rsa"
-	"crypto/x509"
-	"encoding/base64"
-	"encoding/json"
-	"encoding/pem"
-	"strings"
-	"testing"
-	"time"
-)
-
-func newKey(t *testing.T) ([]byte, *rsa.PublicKey) {
-	t.Helper()
-	key, err := rsa.GenerateKey(rand.Reader, 2048)
-	if err != nil {
-		t.Fatalf("cannot generate a key: %v", err)
-	}
-	pemBytes := pem.EncodeToMemory(&pem.Block{Type: "RSA PRIVATE KEY", Bytes: x509.MarshalPKCS1PrivateKey(key)})
-	return pemBytes, &key.PublicKey
-}
-
-func decodeSegment(t *testing.T, segment string, out any) {
-	t.Helper()
-	raw, err := base64.RawURLEncoding.DecodeString(segment)
-	if err != nil {
-		t.Fatalf("segment is not base64url: %v", err)
-	}
-	if err := json.Unmarshal(raw, out); err != nil {
-		t.Fatalf("segment is not JSON: %v", err)
-	}
-}
-
-func TestSignAssertionCarriesTheKeyIDAndIssuer(t *testing.T) {
-	pemBytes, _ := newKey(t)
-	now := time.Unix(1_700_000_000, 0)
-
-	token, err := SignAssertion(pemBytes, "key-42", "client-1", "user-9", "https://zitadel.riotpiao.com", now)
-	if err != nil {
-		t.Fatalf("signing failed: %v", err)
-	}
-	if strings.Count(token, ".") != 2 {
-		t.Fatalf("a JWT has three segments, got %q", token)
-	}
-
-	parts := strings.Split(token, ".")
-	var header map[string]any
-	decodeSegment(t, parts[0], &header)
-	if header["kid"] != "key-42" {
-		t.Fatalf("the header must name the key id so ZITADEL can pick the key, got %v", header["kid"])
-	}
-	if header["alg"] != "RS256" {
-		t.Fatalf("expected RS256, got %v", header["alg"])
-	}
-
-	var claims map[string]any
-	decodeSegment(t, parts[1], &claims)
-	if claims["iss"] != "client-1" || claims["sub"] != "user-9" {
-		t.Fatalf("iss and sub are wrong: %v / %v", claims["iss"], claims["sub"])
-	}
-	if claims["aud"] != "https://zitadel.riotpiao.com" {
-		t.Fatalf("aud must equal the issuer, got %v", claims["aud"])
-	}
-	exp := int64(claims["exp"].(float64))
-	iat := int64(claims["iat"].(float64))
-	if exp-iat != 60 {
-		t.Fatalf("the assertion must live 60 seconds, got %d", exp-iat)
-	}
-}
-
-func TestSignAssertionRejectsGarbage(t *testing.T) {
-	if _, err := SignAssertion([]byte("not a key"), "k", "c", "u", "https://i", time.Now()); err == nil {
-		t.Fatalf("a non-PEM key must be rejected")
-	}
-}
-
-func TestSignAssertionDefaultsSubjectToClientID(t *testing.T) {
-	pemBytes, _ := newKey(t)
-	token, err := SignAssertion(pemBytes, "k1", "client-1", "", "https://i", time.Unix(1, 0))
-	if err != nil {
-		t.Fatalf("signing failed: %v", err)
-	}
-	var claims map[string]any
-	decodeSegment(t, strings.Split(token, ".")[1], &claims)
-	if claims["sub"] != "client-1" {
-		t.Fatalf("an empty user id must fall back to the client id, got %v", claims["sub"])
-	}
-}

k8s/apps/key-rotation-controller/controller/main.go

@@ -1,152 +0,0 @@
-// Command key-rotation-controller rotates credentials declared by KeyRotation
-// objects.
-//
-// The controller authenticates to ZITADEL with its own machine key, read from a
-// mounted Secret. That key is the single bootstrap credential: everything else is
-// created by this process and never committed to git.
-package main
-
-import (
-	"context"
-	"flag"
-	"fmt"
-	"net/http"
-	"os"
-	"time"
-
-	"k8s.io/apimachinery/pkg/runtime"
-	"k8s.io/apimachinery/pkg/types"
-	clientgoscheme "k8s.io/client-go/kubernetes/scheme"
-	ctrl "sigs.k8s.io/controller-runtime"
-	"sigs.k8s.io/controller-runtime/pkg/client"
-	"sigs.k8s.io/controller-runtime/pkg/controller"
-	"sigs.k8s.io/controller-runtime/pkg/handler"
-	"sigs.k8s.io/controller-runtime/pkg/log/zap"
-	ctrlreconcile "sigs.k8s.io/controller-runtime/pkg/reconcile"
-	metricsserver "sigs.k8s.io/controller-runtime/pkg/metrics/server"
-	"sigs.k8s.io/controller-runtime/pkg/source"
-
-	iamv1 "github.com/riotpiao/key-rotation-controller/api"
-	keyreconcile "github.com/riotpiao/key-rotation-controller/internal/reconcile"
-	"github.com/riotpiao/key-rotation-controller/internal/zitadel"
-)
-
-func main() {
-	var (
-		metricsAddr = flag.String("metrics-bind-address", ":8080", "address for the metrics endpoint")
-		healthAddr  = flag.String("health-probe-bind-address", ":8081", "address for probes")
-		interval    = flag.Duration("scan-interval", 10*time.Minute, "how often to re-check every resource")
-	)
-	flag.Parse()
-
-	ctrl.SetLogger(zap.New(zap.UseDevMode(false)))
-	logger := ctrl.Log.WithName("setup")
-
-	scheme := runtime.NewScheme()
-	if err := clientgoscheme.AddToScheme(scheme); err != nil {
-		logger.Error(err, "cannot register the Kubernetes types")
-		os.Exit(1)
-	}
-	if err := iamv1.AddToScheme(scheme); err != nil {
-		logger.Error(err, "cannot register the KeyRotation types")
-		os.Exit(1)
-	}
-
-	mgr, err := ctrl.NewManager(ctrl.GetConfigOrDie(), ctrl.Options{
-		Scheme:                 scheme,
-		Metrics:                metricsserver.Options{BindAddress: *metricsAddr},
-		HealthProbeBindAddress: *healthAddr,
-		LeaderElection:         true,
-		LeaderElectionID:       "key-rotation-controller.iam.homelab.riotpiao.com",
-	})
-	if err != nil {
-		logger.Error(err, "cannot create the manager")
-		os.Exit(1)
-	}
-
-	zitadelClient, err := buildZitadelClient()
-	if err != nil {
-		logger.Error(err, "cannot build the ZITADEL client")
-		os.Exit(1)
-	}
-
-	reconciler := &keyreconcile.Reconciler{
-		Client: mgr.GetClient(),
-		Providers: map[string]keyreconcile.Provider{
-			iamv1.ProviderZitadelMachineKey: &keyreconcile.MachineKeyProvider{
-				Client:       zitadelClient,
-				AuthClientID: os.Getenv("ZITADEL_CLIENT_ID"),
-			},
-			iamv1.ProviderZitadelOIDCClient: &keyreconcile.OIDCClientProvider{
-				Client: zitadelClient,
-			},
-		},
-	}
-
-	c, err := controller.New("keyrotation", mgr, controller.Options{
-		Reconciler: ctrlreconcile.Func(func(ctx context.Context, req ctrlreconcile.Request) (ctrlreconcile.Result, error) {
-			wait, err := reconciler.Reconcile(ctx, types.NamespacedName(req.NamespacedName))
-			if err != nil {
-				return ctrlreconcile.Result{}, err
-			}
-			if wait <= 0 {
-				wait = *interval
-			}
-			return ctrlreconcile.Result{RequeueAfter: wait}, nil
-		}),
-	})
-	if err != nil {
-		logger.Error(err, "cannot create the controller")
-		os.Exit(1)
-	}
-
-	if err := c.Watch(source.Kind(mgr.GetCache(), client.Object(&iamv1.KeyRotation{}), &handler.EnqueueRequestForObject{})); err != nil {
-		logger.Error(err, "cannot watch KeyRotation objects")
-		os.Exit(1)
-	}
-
-	if err := mgr.AddHealthzCheck("healthz", func(*http.Request) error { return nil }); err != nil {
-		logger.Error(err, "cannot add the health check")
-		os.Exit(1)
-	}
-
-	logger.Info("starting the key rotation controller")
-	if err := mgr.Start(ctrl.SetupSignalHandler()); err != nil {
-		logger.Error(err, "manager stopped")
-		os.Exit(1)
-	}
-}
-
-// buildZitadelClient reads the controller's own credential from the environment.
-//
-// These are the only values the controller cannot create for itself. They arrive
-// from one Secret, created once when the cluster is bootstrapped.
-func buildZitadelClient() (*zitadel.Client, error) {
-	issuer := os.Getenv("ZITADEL_ISSUER")
-	clientID := os.Getenv("ZITADEL_CLIENT_ID")
-	userID := os.Getenv("ZITADEL_USER_ID")
-	keyID := os.Getenv("ZITADEL_KEY_ID")
-	keyFile := envOr("ZITADEL_KEY_FILE", "/var/run/keys/controller/key")
-
-	if issuer == "" || clientID == "" || keyID == "" {
-		return nil, fmt.Errorf("ZITADEL_ISSUER, ZITADEL_CLIENT_ID and ZITADEL_KEY_ID are required")
-	}
-	pem, err := os.ReadFile(keyFile)
-	if err != nil {
-		return nil, fmt.Errorf("cannot read the controller key: %w", err)
-	}
-	return zitadel.New(zitadel.Config{
-		Issuer:        issuer,
-		ClientID:      clientID,
-		UserID:        userID,
-		KeyID:         keyID,
-		PrivateKeyPEM: pem,
-	}), nil
-}
-
-func envOr(name, fallback string) string {
-	if v := os.Getenv(name); v != "" {
-		return v
-	}
-	return fallback
-}

k8s/apps/key-rotation-controller/crd.yaml

@@ -1,121 +0,0 @@
-# KeyRotation declares one credential and how to rotate it.
-#
-# The resource never holds a secret value. It names where the value goes and how
-# to prove the new value works. The controller writes the Secret.
-apiVersion: apiextensions.k8s.io/v1
-kind: CustomResourceDefinition
-metadata:
-  name: keyrotations.iam.homelab.riotpiao.com
-spec:
-  group: iam.homelab.riotpiao.com
-  scope: Namespaced
-  names:
-    kind: KeyRotation
-    plural: keyrotations
-    singular: keyrotation
-    shortNames: [kr]
-  versions:
-    - name: v1
-      served: true
-      storage: true
-      additionalPrinterColumns:
-        - {name: Provider, type: string, jsonPath: .spec.provider}
-        - {name: Strategy, type: string, jsonPath: .spec.strategy}
-        - {name: Phase, type: string, jsonPath: .status.phase}
-        - {name: Last, type: date, jsonPath: .status.lastRotation}
-        - {name: Next, type: date, jsonPath: .status.nextRotation}
-      subresources:
-        status: {}
-      schema:
-        openAPIV3Schema:
-          type: object
-          required: [spec]
-          properties:
-            spec:
-              type: object
-              required: [provider, strategy, intervalHours, target]
-              properties:
-                provider:
-                  type: string
-                  enum: [zitadel-machine-key, zitadel-oidc-client]
-                  description: >-
-                    Which external API creates the credential.
-                strategy:
-                  type: string
-                  enum: [overlap, atomic]
-                  description: >-
-                    overlap keeps the old credential valid until the new one is
-                    proven. atomic replaces it in place, because the provider
-                    allows only one value.
-                intervalHours:
-                  type: integer
-                  minimum: 1
-                  description: How often to rotate.
-                suspend:
-                  type: boolean
-                  description: Stop automatic rotation without deleting the resource.
-                target:
-                  type: object
-                  required: [secretName, secretNamespace]
-                  properties:
-                    zitadelProjectID: {type: string}
-                    zitadelAppID: {type: string}
-                    machineUserID: {type: string}
-                    secretName: {type: string}
-                    secretNamespace: {type: string}
-                    secretKeys:
-                      type: object
-                      additionalProperties: {type: string}
-                      description: >-
-                        Logical field name to Secret key. Unmapped fields keep
-                        their logical name.
-                    reload:
-                      type: string
-                      enum: [hot, restart]
-                      description: >-
-                        hot means the consumer watches the file. restart rolls the
-                        consumer so it reads the new value at start.
-                    consumers:
-                      type: array
-                      items:
-                        type: object
-                        required: [kind, name, namespace]
-                        properties:
-                          kind: {type: string, enum: [Deployment, StatefulSet]}
-                          name: {type: string}
-                          namespace: {type: string}
-                verify:
-                  type: object
-                  properties:
-                    introspect:
-                      type: boolean
-                      description: Check client id and secret against introspection.
-                    tokenExchange:
-                      type: boolean
-                      description: Exchange a token with the new machine key.
-                    audienceProject:
-                      type: string
-                      description: Project id added to the token audience scope.
-            status:
-              type: object
-              properties:
-                phase:
-                  type: string
-                  enum: [Pending, Preparing, Propagating, Verifying, Completing, Succeeded, Failed, Suspended]
-                observedGeneration: {type: integer, format: int64}
-                lastRotation: {type: string, format: date-time}
-                nextRotation: {type: string, format: date-time}
-                activeCredentialID: {type: string}
-                previousCredentialID: {type: string}
-                lastError: {type: string}
-                conditions:
-                  type: array
-                  items:
-                    type: object
-                    required: [type, status, reason, lastTransitionTime]
-                    properties:
-                      type: {type: string}
-                      status: {type: string}
-                      reason: {type: string}
-                      message: {type: string}
-                      lastTransitionTime: {type: string, format: date-time}

k8s/apps/key-rotation-controller/deployment.yaml

@@ -1,66 +0,0 @@
-# The controller. Its own machine key is the single bootstrap credential: it is
-# created once and mounted here, and this process creates every other credential.
-#
-# The image must be built and pushed before this Deployment can start. Until then
-# the object stays Pending, which is why no Argo CD Application is wired yet.
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: key-rotation-controller
-  namespace: iam
-  labels:
-    app: key-rotation-controller
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: key-rotation-controller
-  template:
-    metadata:
-      labels:
-        app: key-rotation-controller
-    spec:
-      serviceAccountName: key-rotation-controller
-      securityContext:
-        runAsNonRoot: true
-        runAsUser: 65534
-        seccompProfile:
-          type: RuntimeDefault
-      containers:
-        - name: controller
-          image: forgejo.riotpiao.com/riotpiao-poimen/key-rotation-controller:0.1.0
-          imagePullPolicy: IfNotPresent
-          args:
-            - --scan-interval=10m
-          env:
-            - {name: ZITADEL_ISSUER, value: "https://zitadel.riotpiao.com"}
-            - name: ZITADEL_CLIENT_ID
-              valueFrom: {secretKeyRef: {name: key-rotation-controller, key: client-id}}
-            - name: ZITADEL_USER_ID
-              valueFrom: {secretKeyRef: {name: key-rotation-controller, key: user-id}}
-            - name: ZITADEL_KEY_ID
-              valueFrom: {secretKeyRef: {name: key-rotation-controller, key: key-id}}
-            - {name: ZITADEL_KEY_FILE, value: "/var/run/keys/controller/key"}
-          ports:
-            - {name: metrics, containerPort: 8080}
-            - {name: health, containerPort: 8081}
-          readinessProbe:
-            httpGet: {path: /healthz, port: health}
-            initialDelaySeconds: 5
-          livenessProbe:
-            httpGet: {path: /healthz, port: health}
-            initialDelaySeconds: 15
-          volumeMounts:
-            - {name: controller-key, mountPath: /var/run/keys/controller, readOnly: true}
-          securityContext:
-            allowPrivilegeEscalation: false
-            capabilities: {drop: ["ALL"]}
-          resources:
-            requests: {cpu: 20m, memory: 64Mi}
-            limits: {cpu: 500m, memory: 256Mi}
-      volumes:
-        - name: controller-key
-          secret:
-            secretName: key-rotation-controller
-            items:
-              - {key: key, path: key}

k8s/apps/key-rotation-controller/example-machine-key.yaml

@@ -1,28 +0,0 @@
-# Example: rotate a service user's machine key with no gap.
-#
-# Machine keys overlap in ZITADEL, so the old key stays valid until the new one has
-# obtained a token. Nothing in the window fails.
-#
-# Apply only after the controller runs and the machine user exists.
-apiVersion: iam.homelab.riotpiao.com/v1
-kind: KeyRotation
-metadata:
-  name: example-machine-key
-  namespace: iam
-spec:
-  provider: zitadel-machine-key
-  strategy: overlap
-  intervalHours: 720        # 30 days
-  suspend: true             # flip to false once the pilot is proven
-  target:
-    machineUserID: "REPLACE_WITH_SERVICE_USER_ID"
-    secretName: example-jwt
-    secretNamespace: iam
-    secretKeys:
-      key: key
-      key-id: key-id
-    reload: hot             # the consumer watches the file, so no restart
-    consumers: []
-  verify:
-    tokenExchange: true
-    audienceProject: "396757796898471937"

k8s/apps/key-rotation-controller/example-oidc-client.yaml

@@ -1,27 +0,0 @@
-# Example: rotate an OIDC app's client secret.
-#
-# ZITADEL keeps one secret per app, so the old value dies at the generate call.
-# The strategy is atomic: publish, roll the consumer, verify, and roll back if the
-# introspection check fails.
-apiVersion: iam.homelab.riotpiao.com/v1
-kind: KeyRotation
-metadata:
-  name: example-grafana-client
-  namespace: iam
-spec:
-  provider: zitadel-oidc-client
-  strategy: atomic
-  intervalHours: 2160       # 90 days
-  suspend: true
-  target:
-    zitadelProjectID: "396757796898471937"
-    zitadelAppID: "REPLACE_WITH_APP_ID"
-    secretName: grafana-oidc
-    secretNamespace: logging
-    secretKeys:
-      secret: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
-    reload: restart         # Grafana reads the value at start
-    consumers:
-      - {kind: Deployment, name: grafana, namespace: logging}
-  verify:
-    introspect: true

k8s/apps/key-rotation-controller/kustomization.yaml

@@ -1,10 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-# No Argo CD Application is wired to this directory yet: the controller image must
-# exist first. Add the app once the image is pushed, so Argo never reports a
-# Deployment that cannot pull.
-resources:
-  - crd.yaml
-  - rbac.yaml
-  - deployment.yaml
-  - rotations.yaml

k8s/apps/key-rotation-controller/rbac.yaml

@@ -1,43 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: key-rotation-controller
-  namespace: iam
----
-# Cluster-wide because a credential and its consumer live in different namespaces:
-# the Secret in one, the workload in another.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: key-rotation-controller
-rules:
-  - apiGroups: ["iam.homelab.riotpiao.com"]
-    resources: ["keyrotations"]
-    verbs: ["get", "list", "watch"]
-  - apiGroups: ["iam.homelab.riotpiao.com"]
-    resources: ["keyrotations/status"]
-    verbs: ["get", "update", "patch"]
-  # The controller writes the credential it just created.
-  - apiGroups: [""]
-    resources: ["secrets"]
-    verbs: ["get", "create", "update", "patch"]
-  # Rolling a consumer that cannot hot reload.
-  - apiGroups: ["apps"]
-    resources: ["deployments", "statefulsets"]
-    verbs: ["get", "list", "watch", "patch"]
-  - apiGroups: [""]
-    resources: ["events"]
-    verbs: ["create", "patch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: key-rotation-controller
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: key-rotation-controller
-subjects:
-  - kind: ServiceAccount
-    name: key-rotation-controller
-    namespace: iam

k8s/apps/key-rotation-controller/rotations.yaml

@@ -1,211 +0,0 @@
-# Every credential this cluster owns, described as a KeyRotation.
-#
-# One object per consumer. The controller creates the value, writes the Secret and
-# proves the new value works before it retires the old one. Nothing here holds a
-# secret, so this file is safe in git.
-#
-# suspend: true everywhere on purpose. The controller image does not exist yet, and
-# an unsuspended object would claim an intent no process is acting on. Clear the flag
-# per object as its pilot passes.
-#
-# poimen-memory is absent deliberately: it is in use and excluded from this migration.
----
-apiVersion: iam.homelab.riotpiao.com/v1
-kind: KeyRotation
-metadata:
-  name: grafana
-  namespace: iam
-  labels:
-    app.kubernetes.io/part-of: key-rotation
-spec:
-  provider: zitadel-oidc-client
-  strategy: atomic
-  intervalHours: 2160
-  suspend: true
-  target:
-    zitadelProjectID: "396757796898471937"
-    zitadelAppID: "396757801965191169"
-    secretName: grafana-oidc
-    secretNamespace: logging
-    secretKeys:
-      secret: GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET
-    reload: restart
-    consumers:
-      - {kind: Deployment, name: grafana, namespace: logging}
-  verify:
-    introspect: true
----
-apiVersion: iam.homelab.riotpiao.com/v1
-kind: KeyRotation
-metadata:
-  name: argocd
-  namespace: iam
-  labels:
-    app.kubernetes.io/part-of: key-rotation
-spec:
-  provider: zitadel-oidc-client
-  strategy: atomic
-  intervalHours: 2160
-  suspend: true
-  target:
-    zitadelProjectID: "396757796898471937"
-    zitadelAppID: "396757801210282367"
-    secretName: argocd-oidc
-    secretNamespace: argocd
-    secretKeys:
-      secret: oidc.clientSecret
-    reload: restart
-    consumers:
-      - {kind: Deployment, name: argocd-server, namespace: argocd}
-  verify:
-    introspect: true
----
-apiVersion: iam.homelab.riotpiao.com/v1
-kind: KeyRotation
-metadata:
-  name: comfyui
-  namespace: iam
-  labels:
-    app.kubernetes.io/part-of: key-rotation
-spec:
-  provider: zitadel-oidc-client
-  strategy: atomic
-  intervalHours: 2160
-  suspend: true
-  target:
-    zitadelProjectID: "396757796898471937"
-    zitadelAppID: "397015744010781070"
-    secretName: comfyui-oauth2-proxy
-    secretNamespace: comfyui
-    secretKeys:
-      secret: client-secret
-    reload: restart
-    consumers:
-      - {kind: Deployment, name: comfyui-oauth2-proxy, namespace: comfyui}
-  verify:
-    introspect: true
----
-apiVersion: iam.homelab.riotpiao.com/v1
-kind: KeyRotation
-metadata:
-  name: minio
-  namespace: iam
-  labels:
-    app.kubernetes.io/part-of: key-rotation
-spec:
-  provider: zitadel-oidc-client
-  strategy: atomic
-  intervalHours: 2160
-  suspend: true
-  target:
-    zitadelProjectID: "396757796898471937"
-    zitadelAppID: "396757803257036801"
-    secretName: minio-oidc
-    secretNamespace: minio
-    secretKeys:
-      secret: client-secret
-    reload: hot
-    consumers:
-      - {kind: Deployment, name: minio, namespace: minio}
-  verify:
-    introspect: true
----
-apiVersion: iam.homelab.riotpiao.com/v1
-kind: KeyRotation
-metadata:
-  name: paperless
-  namespace: iam
-  labels:
-    app.kubernetes.io/part-of: key-rotation
-spec:
-  provider: zitadel-oidc-client
-  strategy: atomic
-  intervalHours: 2160
-  suspend: true
-  target:
-    zitadelProjectID: "396757796898471937"
-    zitadelAppID: "396757803559027071"
-    secretName: paperless-oidc
-    secretNamespace: paperless
-    secretKeys:
-      secret: client-secret
-    reload: restart
-    consumers:
-      - {kind: Deployment, name: paperless, namespace: paperless}
-  verify:
-    introspect: true
----
-apiVersion: iam.homelab.riotpiao.com/v1
-kind: KeyRotation
-metadata:
-  name: immich
-  namespace: iam
-  labels:
-    app.kubernetes.io/part-of: key-rotation
-spec:
-  provider: zitadel-oidc-client
-  strategy: atomic
-  intervalHours: 2160
-  suspend: true
-  target:
-    zitadelProjectID: "396757796898471937"
-    zitadelAppID: "396757802602791295"
-    secretName: immich-oidc
-    secretNamespace: immich
-    secretKeys:
-      secret: client-secret
-    reload: restart
-    consumers:
-      - {kind: Deployment, name: immich-server, namespace: immich}
-  verify:
-    introspect: true
----
-apiVersion: iam.homelab.riotpiao.com/v1
-kind: KeyRotation
-metadata:
-  name: forgejo
-  namespace: iam
-  labels:
-    app.kubernetes.io/part-of: key-rotation
-spec:
-  provider: zitadel-oidc-client
-  strategy: atomic
-  intervalHours: 2160
-  suspend: true
-  target:
-    zitadelProjectID: "396757796898471937"
-    zitadelAppID: "396757801579315583"
-    secretName: forgejo-oidc
-    secretNamespace: forgejo
-    secretKeys:
-      secret: key
-    reload: restart
-    consumers:
-      - {kind: StatefulSet, name: forgejo, namespace: forgejo}
-  verify:
-    introspect: true
----
-apiVersion: iam.homelab.riotpiao.com/v1
-kind: KeyRotation
-metadata:
-  name: api-gw
-  namespace: iam
-  labels:
-    app.kubernetes.io/part-of: key-rotation
-spec:
-  provider: zitadel-oidc-client
-  strategy: atomic
-  intervalHours: 2160
-  suspend: true
-  target:
-    zitadelProjectID: "396757796898471937"
-    zitadelAppID: "396757800874672511"
-    secretName: api-gw-oidc
-    secretNamespace: api-gw
-    secretKeys:
-      secret: client-secret
-    reload: hot
-    consumers:
-      - {kind: Deployment, name: api-gw, namespace: api-gw}
-  verify:
-    introspect: true

k8s/apps/llm-serving/embeddings.yaml

@@ -45,14 +45,6 @@ spec:
       volumeMounts:
       - mountPath: /mnt/models
         name: models
-    podMetadata:
-      annotations:
-        prometheus.io/scrape: "true"
-        prometheus.io/port: "8080"
-        prometheus.io/path: "/metrics"
-      labels:
-        app.kubernetes.io/name: llm-embeddings
-        app.kubernetes.io/part-of: llm-serving
     maxReplicas: 1
     minReplicas: 1
     nodeSelector:

k8s/apps/llm-serving/kustomization.yaml

@@ -14,7 +14,6 @@ resources:
   - ornith.yaml
   - reasoning.yaml
   - reranker.yaml
-  - qwen-cpu.yaml
   - networkpolicy.yaml
 # No namespace transformer: every file sets its own, and the transformer would
 # rewrite metadata.namespace on anything cross-namespace added later.

k8s/apps/llm-serving/networkpolicy.yaml

@@ -52,20 +52,6 @@ spec:
           port: 8080
         - protocol: TCP
           port: 9000
-    # Allow from paperless namespace (paperless-ai auto-tagging)
-    # Bypasses gateway until service-account JWT token exchange is implemented.
-    # paperless-ai-agent has llm:inference role in Authentik.
-    - from:
-        - namespaceSelector:
-            matchLabels:
-              kubernetes.io/metadata.name: paperless
-      ports:
-        - protocol: TCP
-          port: 8080
-        - protocol: TCP
-          port: 80
-        - protocol: TCP
-          port: 8000
     # Allow intra-namespace (pod-to-pod within llm-serving)
     - from:
         - podSelector:

k8s/apps/llm-serving/ornith.yaml

@@ -0,0 +1,108 @@
+apiVersion: serving.kserve.io/v1beta1
+kind: InferenceService
+metadata:
+  annotations:
+    serving.kserve.io/deploymentMode: RawDeployment
+    # The konghq.com/{connect,read,write}-timeout annotations that used to live
+    # here went with Kong (retired 2026-08-19). They existed because Kong read
+    # its upstream timeouts off the Kubernetes Service, and its 60s default cut
+    # off the first request after any pod restart — a restart flushes VRAM and
+    # reloading ornith:35b takes longer than that. OLLAMA_KEEP_ALIVE=-1 hid the
+    # problem in steady state.
+    #
+    # The equivalent budget now belongs to the Go gateway's per-route timeout
+    # config in rock/homelab-frontend, not to an annotation on this object.
+  labels:
+    app.kubernetes.io/name: llm-ornith
+    app.kubernetes.io/part-of: llm-serving
+  name: ornith
+  namespace: llm-serving
+spec:
+  predictor:
+    containers:
+    - command:
+      - /bin/sh
+      - -c
+      - 'set -e
+
+        ollama serve &
+
+        SERVE_PID=$!
+
+        until ollama list >/dev/null 2>&1; do sleep 2; done
+
+        ollama pull ornith:35b
+
+        ollama pull qwen2.5:3b-instruct
+
+        ollama run ornith:35b "ok" >/dev/null 2>&1 || true
+
+        ollama run qwen2.5:3b-instruct "ok" >/dev/null 2>&1 || true
+
+        wait $SERVE_PID
+
+        '
+      env:
+      - name: OLLAMA_HOST
+        value: 0.0.0.0:8080
+      - name: OLLAMA_MODELS
+        value: /mnt/models/ollama
+      - name: OLLAMA_CONTEXT_LENGTH
+        value: '32768'
+      - name: OLLAMA_KEEP_ALIVE
+        value: '-1'
+      - name: OLLAMA_NUM_PARALLEL
+        value: '1'
+      - name: OLLAMA_MAX_LOADED_MODELS
+        value: '2'
+      image: ollama/ollama:0.32.9@sha256:1685741456770df6e3cceb2a945a5f75e020f658d1701509668d6f4688f1dd3f
+      name: kserve-container
+      ports:
+      - containerPort: 8080
+        protocol: TCP
+      readinessProbe:
+        exec:
+          command:
+          - /bin/sh
+          - -c
+          - ollama ps 2>/dev/null | grep -q ornith && ollama ps 2>/dev/null |
+            grep -q qwen2.5
+        periodSeconds: 10
+      resources:
+        limits:
+          cpu: '16'
+          memory: 16Gi
+          nvidia.com/gpu: '1'
+        requests:
+          cpu: '8'
+          memory: 8Gi
+          nvidia.com/gpu: '1'
+      startupProbe:
+        exec:
+          command:
+          - /bin/sh
+          - -c
+          - ollama ps 2>/dev/null | grep -q ornith && ollama ps 2>/dev/null |
+            grep -q qwen2.5
+        failureThreshold: 120
+        periodSeconds: 15
+      volumeMounts:
+      - mountPath: /mnt/models
+        name: models
+    deploymentStrategy:
+      type: Recreate
+    # 2 replicas -- each its own GPU, each loading both ornith:35b and
+    # qwen2.5:3b-instruct -- so 2 concurrent implementer-style calls each
+    # get an independent instance instead of contending on one, at the
+    # cost of judge/qwen traffic still sharing whichever replica an
+    # implementer call also lands on.
+    maxReplicas: 2
+    minReplicas: 2
+    nodeSelector:
+      kubernetes.io/hostname: worker-1
+    runtimeClassName: nvidia
+    volumes:
+    - name: models
+      persistentVolumeClaim:
+        claimName: llm-models
+

k8s/apps/llm-serving/qwen-cpu.yaml

@@ -1,115 +0,0 @@
-# qwen2.5:3b-instruct on CPU (talos-cp-2, 144GB RAM, 24 cores).
-# Moved off GPU to free a V100 for ComfyUI. Latency ~10x slower
-# than GPU but sufficient for lightweight tasks (summarization,
-# classification, quick answers).
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: qwen-cpu
-  namespace: llm-serving
-  labels:
-    app: qwen-cpu
-    app.kubernetes.io/name: qwen-cpu
-    app.kubernetes.io/part-of: llm-serving
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: qwen-cpu
-  template:
-    metadata:
-      labels:
-        app: qwen-cpu
-        app.kubernetes.io/name: qwen-cpu
-        app.kubernetes.io/part-of: llm-serving
-    spec:
-      nodeSelector:
-        kubernetes.io/hostname: talos-cp-2
-      tolerations:
-        - key: node-role.kubernetes.io/control-plane
-          operator: Exists
-          effect: NoSchedule
-      containers:
-        - name: ollama
-          image: ollama/ollama:0.32.9@sha256:1685741456770df6e3cceb2a945a5f75e020f658d1701509668d6f4688f1dd3f
-          command: ["/bin/sh", "-c"]
-          args:
-            - |
-              ollama serve &
-              SERVE_PID=$!
-              until ollama list >/dev/null 2>&1; do sleep 2; done
-              ollama pull qwen2.5:3b-instruct
-              ollama run qwen2.5:3b-instruct "ok" >/dev/null 2>&1 || true
-              wait $SERVE_PID
-          env:
-            - name: OLLAMA_HOST
-              value: "0.0.0.0:8080"
-            - name: OLLAMA_MODELS
-              value: /root/.ollama/models
-            - name: OLLAMA_CONTEXT_LENGTH
-              value: "32768"
-            - name: OLLAMA_KEEP_ALIVE
-              value: "-1"
-            - name: OLLAMA_MAX_LOADED_MODELS
-              value: "1"
-            - name: OLLAMA_NUM_PARALLEL
-              value: "2"
-          ports:
-            - containerPort: 8080
-              protocol: TCP
-          readinessProbe:
-            exec:
-              command: ["/bin/sh", "-c", "ollama ps 2>/dev/null | grep -q qwen2.5"]
-            periodSeconds: 10
-          startupProbe:
-            exec:
-              command: ["/bin/sh", "-c", "ollama ps 2>/dev/null | grep -q qwen2.5"]
-            failureThreshold: 60
-            periodSeconds: 10
-          resources:
-            requests:
-              cpu: "4"
-              memory: 4Gi
-            limits:
-              cpu: "8"
-              memory: 8Gi
-          volumeMounts:
-            - mountPath: /root/.ollama
-              name: ollama-data
-      volumes:
-        - name: ollama-data
-          persistentVolumeClaim:
-            claimName: qwen-cpu-data
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: qwen-cpu
-  namespace: llm-serving
-  labels:
-    app: qwen-cpu
-    app.kubernetes.io/part-of: llm-serving
-spec:
-  selector:
-    app: qwen-cpu
-  ports:
-    - port: 80
-      targetPort: 8080
-      protocol: TCP
----
-# Small PVC for qwen2.5:3b model weights (~1.9GB).
-# Separate from llm-models PVC which is pinned to worker-1.
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: qwen-cpu-data
-  namespace: llm-serving
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 5Gi

k8s/apps/llm-serving/reasoning.yaml

@@ -0,0 +1,122 @@
+apiVersion: serving.kserve.io/v1beta1
+kind: InferenceService
+metadata:
+  annotations:
+    serving.kserve.io/deploymentMode: RawDeployment
+  labels:
+    app.kubernetes.io/name: llm-reasoning
+    app.kubernetes.io/part-of: llm-serving
+  name: reasoning
+  namespace: llm-serving
+spec:
+  predictor:
+    containers:
+    - args:
+      # bnb-4bit retired: no int4 tensor cores on sm70/V100, dequant-then-
+      # matmul is two slow kernel launches instead of one fused int4 GEMM,
+      # decode crawled at 2.5-10 tok/s regardless of TP/PP. Switched to
+      # JunHowie/Qwen3-32B-GPTQ-Int4 -- same dense Qwen3-32B weights, same
+      # hermes/qwen3 parser stack (no narration-bug risk, same as before),
+      # only the quant format changes. Plain (non-Marlin) GPTQ kernel is
+      # confirmed Volta-compatible; Marlin needs sm80+ and vLLM would try
+      # to auto-upgrade to it, so --quantization is pinned explicitly to
+      # `gptq` to force the plain kernel. Verified checkpoint size: 19.34GB
+      # (summed from the real safetensors index, not bits-per-param math).
+      # max-model-len=131072 is Qwen3-32B's real ceiling (config.json YaRN:
+      # factor=4.0, original_max_position_embeddings=32768) -- 200k was
+      # asked for but exceeds this architecturally regardless of VRAM.
+      # KV cache math: 256KB/token total (64 layers, 8 KV heads, 128
+      # head_dim, fp16), PP=2 splits both weights and KV load ~evenly, so
+      # each GPU carries ~9.67GB weights + ~128KB/token KV. At
+      # gpu-memory-utilization=0.90 (28.8GB/GPU usable), that leaves
+      # ~19.1GB/GPU for KV cache -> ~156k tokens/GPU capacity, comfortably
+      # above the 131072 target with room to spare -- the old
+      # OffloadingConnector CPU-DRAM spillover (tuned for the previous
+      # model's much smaller 16384 context) is no longer needed and is
+      # dropped. Staying on PP=2 and vLLM 0.11.0 (no version bump needed,
+      # this checkpoint only requires vllm>=0.9.2) -- plain GPTQ has no
+      # TP>1 restriction unlike bnb, so tensor-parallel-size=2 is worth
+      # trying later, but not risking a parallelism-strategy change in the
+      # same rollout as the quant+context-length change.
+      # This GPTQ requant's own config.json ships max_position_embeddings=
+      # 40960 and rope_scaling=None -- confirmed directly (curl'd the raw
+      # config.json), the base Qwen3-32B repo's YaRN block did NOT carry
+      # over during quantization. Re-applying it explicitly here restores
+      # the same math the base model documents (32768 * 4.0 = 131072);
+      # without this, --max-model-len=131072 fails ModelConfig validation
+      # against the checkpoint's own (unscaled) 40960 ceiling.
+      - --model=JunHowie/Qwen3-32B-GPTQ-Int4
+      - --served-model-name=reasoning
+      - --quantization=gptq
+      - --dtype=float16
+      - --kv-cache-dtype=auto
+      - --rope-scaling={"rope_type":"yarn","factor":4.0,"original_max_position_embeddings":32768}
+      - --tensor-parallel-size=1
+      - --pipeline-parallel-size=2
+      - --max-model-len=131072
+      - --gpu-memory-utilization=0.90
+      - --max-num-seqs=4
+      - --enable-chunked-prefill
+      - --enable-prefix-caching
+      # qwen3 is vLLM's dedicated reasoning parser for this family's <think>
+      # blocks.
+      - --reasoning-parser=qwen3
+      # hermes is the documented tool-call parser for general (non-Coder)
+      # Qwen3 models -- native chat template support, not narrated text.
+      - --enable-auto-tool-choice
+      - --tool-call-parser=hermes
+      - --host=0.0.0.0
+      - --port=8080
+      env:
+      - name: VLLM_USE_FLASHINFER_SAMPLER
+        value: '0'
+      - name: VLLM_ATTENTION_BACKEND
+        value: TRITON_ATTN
+      - name: HF_HOME
+        value: /mnt/models
+      image: vllm/vllm-openai:v0.11.0@sha256:014a95f21c9edf6abe0aea6b07353f96baa4ec291c427bb1176dc7c93a85845c
+      name: kserve-container
+      ports:
+      - containerPort: 8080
+        protocol: TCP
+      readinessProbe:
+        httpGet:
+          path: /health
+          port: 8080
+        periodSeconds: 10
+      resources:
+        limits:
+          cpu: '16'
+          memory: 36Gi
+          nvidia.com/gpu: '2'
+        requests:
+          cpu: '8'
+          memory: 12Gi
+          nvidia.com/gpu: '2'
+      startupProbe:
+        failureThreshold: 80
+        httpGet:
+          path: /health
+          port: 8080
+        periodSeconds: 15
+      volumeMounts:
+      - mountPath: /mnt/models
+        name: models
+      - mountPath: /dev/shm
+        name: shm
+    deploymentStrategy:
+      type: Recreate
+    maxReplicas: 1
+    minReplicas: 1
+    nodeSelector:
+      kubernetes.io/hostname: worker-1
+    runtimeClassName: nvidia
+    volumes:
+    - name: models
+      persistentVolumeClaim:
+        claimName: llm-models
+    - emptyDir:
+        medium: Memory
+        sizeLimit: 2Gi
+      name: shm
+

k8s/apps/llm-serving/reranker.yaml

@@ -45,14 +45,6 @@ spec:
       volumeMounts:
       - mountPath: /mnt/models
         name: models
-    podMetadata:
-      annotations:
-        prometheus.io/scrape: "true"
-        prometheus.io/port: "8080"
-        prometheus.io/path: "/metrics"
-      labels:
-        app.kubernetes.io/name: llm-reranker
-        app.kubernetes.io/part-of: llm-serving
     maxReplicas: 1
     minReplicas: 1
     nodeSelector:

k8s/apps/messaging/management-service/templates/configmap.yaml

@@ -6,7 +6,7 @@ metadata:
 data:
   KMSVC_KAFKA_BROKERS: {{ .Values.env.kafkaBrokers | quote }}
   KMSVC_REDIS_ADDR: {{ .Values.env.redisAddr | quote }}
-  KMSVC_ZITADEL_ISSUER_URL: {{ .Values.env.zitadelIssuerURL | quote }}
-  KMSVC_ZITADEL_AUDIENCE: {{ .Values.env.zitadelAudience | quote }}
+  KMSVC_AUTHENTIK_ISSUER_URL: {{ .Values.env.authentikIssuerURL | quote }}
+  KMSVC_AUTHENTIK_AUDIENCE: {{ .Values.env.authentikAudience | quote }}
   KMSVC_GRPC_LISTEN_ADDR: ":{{ .Values.grpcPort }}"
   KMSVC_HTTP_LISTEN_ADDR: ":{{ .Values.httpPort }}"

k8s/apps/messaging/management-service/values.yaml

@@ -12,8 +12,8 @@ httpPort: 8080
 env:
   kafkaBrokers: "kmsvc-kafka-bootstrap.sqs.svc.cluster.local:9092"
   redisAddr: "kmsvc-redis-master.sqs.svc.cluster.local:6379"
-  zitadelIssuerURL: ""
-  zitadelAudience: ""
+  authentikIssuerURL: ""
+  authentikAudience: ""
 
 resources:
   requests:

k8s/apps/messaging/queue-crd/templates/rbac.yaml

@@ -12,19 +12,6 @@ rules:
   - apiGroups: ["kmsvc.io"]
     resources: ["queues"]
     verbs: ["get", "list", "watch", "update", "patch"]
-  # The operator watches TemporalWorker objects and creates Deployments for
-  # them. Without these two rules the controller logs
-  # "cannot list resource temporalworkers/deployments ... at the cluster scope"
-  # and never reconciles.
-  - apiGroups: ["kmsvc.io"]
-    resources: ["temporalworkers"]
-    verbs: ["get", "list", "watch", "update", "patch"]
-  - apiGroups: ["kmsvc.io"]
-    resources: ["temporalworkers/status"]
-    verbs: ["get", "update", "patch"]
-  - apiGroups: ["apps"]
-    resources: ["deployments"]
-    verbs: ["get", "list", "watch", "create", "update", "patch"]
   - apiGroups: ["kmsvc.io"]
     resources: ["queues/status"]
     verbs: ["get", "update", "patch"]

k8s/apps/paperless/backup-cronjob.yaml

@@ -48,8 +48,7 @@ spec:
                   mountPath: /backup
           containers:
             - name: mc-mirror
-              # bitnamilegacy/minio-client:2025.7.21-debian-12-r3 replaces the dead quay.io/minio/mc image
-              image: docker.io/bitnamilegacy/minio-client:2025.7.21-debian-12-r3@sha256:73bd39f7899a0cef12b8dd5df13aa93a3ed1aaa44236542442e9ac76819ac158
+              image: minio/mc:latest
               env:
                 - name: ACCESS_KEY
                   valueFrom:

k8s/apps/paperless/configmap.yaml

@@ -20,7 +20,3 @@ data:
   # wire up allauth's confirm-email view, so signup 500s with NoReverseMatch
   # on 'account_confirm_email' without this.
   PAPERLESS_ACCOUNT_EMAIL_VERIFICATION: "none"
-  # Auto-connect social accounts to existing users with matching email
-  PAPERLESS_SOCIAL_AUTO_SIGNUP: "true"
-  # Allow automatic linking of social accounts to existing users
-  PAPERLESS_ACCOUNT_ALLOW_SIGNUPS: "true"

k8s/apps/paperless/kustomization.yaml

@@ -4,7 +4,6 @@ namespace: paperless
 resources:
   - pvc.yaml
   - configmap.yaml
-  - paperless-ai-config.yaml
   - redis.yaml
   - deployment.yaml
   - service.yaml
@@ -12,7 +11,6 @@ resources:
   - backup-cronjob.yaml
   - adapter-configmap.yaml
   - rbac.yaml
-  - paperless-ai.yaml
 # postgres: paperless-db CNPG Cluster, deployed by k8s/infra/databases (wave 2,
 # before this app at wave 8) - not duplicated here. Same for the paperless-oidc
 # and paperless-minio-creds Secrets, written by PostSync provisioning Jobs in

k8s/apps/paperless/paperless-ai-config.yaml

@@ -1,49 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: paperless-ai-env
-  namespace: paperless
-data:
-  paperless-ai-config.env: |
-    # Paperless-NGX API configuration
-    PAPERLESS_URL=http://paperless.paperless.svc.cluster.local:8000
-    PAPERLESS_API_TOKEN=7b89463e04c141f4172fbcddf78d623547d327ec
-
-    # AI Processing settings
-    ENABLE_AI_PROCESSING=yes
-    AI_MODEL=reasoning
-    LLM_API_URL=https://api.riotpiao.com/v1
-    LLM_API_TOKEN_FILE=/app/data/llm_token.txt
-
-    # Auto-tagging configuration
-    ENABLE_AUTO_TAGGING=yes
-    ENABLE_CORRESPONDENT_EXTRACTION=yes
-    ENABLE_DOCUMENT_TYPE_EXTRACTION=yes
-    ENABLE_TITLE_GENERATION=yes
-    
-    # Advanced tagging with AI
-    ENABLE_INTELLIGENT_TAGGING=yes
-    ENABLE_DATE_EXTRACTION=yes
-    ENABLE_TIMELINE_TAGGING=yes
-    AUTO_CREATE_TAGS=yes
-    
-    # Tagging prompts for custom extraction
-    CUSTOM_EXTRACTION_PROMPT=Extract document date, time period, financial year, and temporal context. Create tags like YYYY, Q1-YYYY, Last-Month, Current-Year, Historic
-    TAG_EXTRACTION_MODEL=reasoning
-
-    # Scanning behavior
-    SCAN_INTERVAL_SECONDS=60
-    PROCESS_EXISTING_DOCUMENTS=no
-    ADD_AI_TAG=yes
-    AI_TAG_NAME=ai-processed
-
-    # Date/Timeline tagging configuration
-    DATE_EXTRACTION_FORMAT=iso8601
-    TIMELINE_TAG_GRANULARITY=year,quarter,month
-    AUTO_TAG_HISTORICAL=yes
-    AUTO_TAG_RECENT=yes
-    
-    # Performance
-    MAX_CONCURRENT_REQUESTS=2
-    REQUEST_TIMEOUT=60
-    DATE_EXTRACTION_TIMEOUT=30

k8s/apps/paperless/paperless-ai-new.yaml

@@ -1,127 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: paperless-ai-data
-  namespace: paperless
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: longhorn
-  resources:
-    requests:
-      storage: 2Gi
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: paperless-ai
-  namespace: paperless
-  labels:
-    app.kubernetes.io/name: paperless-ai
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: paperless-ai
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: paperless-ai
-    spec:
-      tolerations:
-        - key: node-role.kubernetes.io/control-plane
-          operator: Exists
-          effect: NoSchedule
-      
-      volumes:
-        - name: paperless-ai-data
-          persistentVolumeClaim:
-            claimName: paperless-ai-data
-      
-      initContainers:
-        - name: fetch-llm-token
-          image: curlimages/curl:8.12.0
-          command:
-            - sh
-            - -c
-            - |
-              set -e
-              echo "[init] Fetching JWT token from Authentik for paperless-ai-agent..."
-              
-              # Get JWT token via client_credentials grant
-              TOKEN_RESPONSE=$(curl -s -X POST https://zitadel.riotpiao.com/oauth/v2/token \
-                -d "grant_type=client_credentials" \
-                -d "client_id=396757803559027071" \
-                -d "client_secret=29skAhE0tBzWn0qrPvmPTQMva0joFjcCr7msDQr_VXQ" \
-                -d "scope=openid llm:inference" 2>/dev/null)
-              
-              # Extract token
-              TOKEN=$(echo "$TOKEN_RESPONSE" | grep -o '"access_token":"[^"]*' | cut -d'"' -f4)
-              
-              if [ -z "$TOKEN" ]; then
-                echo "[error] Failed to get token. Response: $TOKEN_RESPONSE"
-                exit 1
-              fi
-              
-              # Store token in file for main container to read
-              mkdir -p /data
-              echo "$TOKEN" > /data/llm_token.txt
-              echo "[init] Token fetched and stored successfully"
-          volumeMounts:
-            - name: paperless-ai-data
-              mountPath: /data
-      
-      containers:
-        - name: paperless-ai
-          image: clusterzx/paperless-ai:latest
-          imagePullPolicy: Always
-          env:
-            # Paperless-ngx connection
-            - name: PAPERLESS_API_URL
-              value: "http://paperless.paperless.svc.cluster.local:8000"
-            - name: PAPERLESS_API_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: paperless-ai-config
-                  key: PAPERLESS_API_TOKEN
-            - name: PAPERLESS_USERNAME
-              value: "admin"
-            
-            # LLM API configuration
-            - name: AI_PROVIDER
-              value: "custom"
-            - name: CUSTOM_BASE_URL
-              value: "https://api.riotpiao.com/v1"
-            # Token file created by init container with JWT from Authentik
-            - name: CUSTOM_API_KEY_FILE
-              value: "/app/data/llm_token.txt"
-            - name: CUSTOM_MODEL
-              value: "qwen2.5:3b-instruct"
-            
-            # Scanning behavior
-            - name: SCAN_INTERVAL
-              value: "60"
-            - name: PROCESS_PREDEFINED_DOCUMENTS
-              value: "no"
-            
-            # Tagging configuration
-            - name: ADD_AI_TAG
-              value: "yes"
-            - name: AI_TAG_NAME
-              value: "ai-processed"
-            - name: ADD_AI_DESCRIPTIONS
-              value: "yes"
-            - name: USE_PROMPT_TAGS
-              value: "yes"
-          
-          volumeMounts:
-            - name: paperless-ai-data
-              mountPath: /app/data
-          
-          resources:
-            requests:
-              cpu: 100m
-              memory: 512Mi
-            limits:
-              cpu: "1"
-              memory: 2Gi

k8s/apps/paperless/paperless-ai.yaml

@@ -1,135 +0,0 @@
-# Secret paperless-ai-config managed via SOPS (argocd/secrets/paperless-ai-secrets.enc.yaml)
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: paperless-ai
-  namespace: paperless
-  labels:
-    app.kubernetes.io/name: paperless-ai
-spec:
-  replicas: 1
-  # Recreate, not RollingUpdate: paperless-ai-data is a single RWO PVC. With
-  # RollingUpdate the new pod tries to mount the PVC while the old pod still
-  # holds it -> "Multi-Attach error" / stuck Init:0/1 forever, rollout wedged
-  # at "1 desired, 1 ready, 1 updated, 1 unavailable". Recreate terminates the
-  # old pod first so the PVC detaches before the new one starts. Same pattern
-  # as the Forgejo gitea Deployment.
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: paperless-ai
-  template:
-    metadata:
-      labels:
-        app.kubernetes.io/name: paperless-ai
-    spec:
-      tolerations:
-        - key: node-role.kubernetes.io/control-plane
-          operator: Exists
-          effect: NoSchedule
-      volumes:
-        - name: paperless-ai-data
-          persistentVolumeClaim:
-            claimName: paperless-ai-data
-        - name: paperless-ai-env-config
-          configMap:
-            name: paperless-ai-env
-      initContainers:
-        - name: fetch-llm-token
-          image: curlimages/curl:8.12.0
-          securityContext:
-            runAsUser: 0
-            fsGroup: 0
-          command:
-            - sh
-            - -c
-            - |
-              set -e
-              echo "[init] Fetching JWT token from Authentik for paperless-ai-agent..."
-              
-              # Get JWT token via client_credentials grant
-              # Client secret sourced from environment (injected from paperless-ai-config Secret)
-              TOKEN_RESPONSE=$(curl -s -X POST https://zitadel.riotpiao.com/oauth/v2/token \
-                -d "grant_type=client_credentials" \
-                -d "client_id=396757803559027071" \
-                -d "client_secret=${LLM_AUTH_CLIENT_SECRET}" \
-                -d "scope=openid llm:inference" 2>/dev/null)
-              
-              # Extract token from JSON response using sed (handles spaces after colons)
-              TOKEN=$(echo "$TOKEN_RESPONSE" | sed -n 's/.*"access_token"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')
-              
-              if [ -z "$TOKEN" ]; then
-                echo "[error] Failed to get token. Response: $TOKEN_RESPONSE"
-                exit 1
-              fi
-              
-              # Store token in file for main container to read
-              # Write to both locations for compatibility
-              mkdir -p /tmp/llm-token /app/data 2>/dev/null || true
-              echo "$TOKEN" | tee /tmp/llm-token/llm_token.txt > /dev/null 2>&1
-              echo "$TOKEN" > /app/data/llm_token.txt 2>/dev/null || true
-              echo "[init] Token fetched and stored"
-              [ -f /tmp/llm-token/llm_token.txt ] && echo "  -> /tmp/llm-token/llm_token.txt"
-              [ -f /app/data/llm_token.txt ] && echo "  -> /app/data/llm_token.txt"
-          env:
-            - name: LLM_AUTH_CLIENT_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: paperless-ai-config
-                  key: LLM_AUTH_CLIENT_SECRET
-          volumeMounts:
-            - name: paperless-ai-data
-              mountPath: /app/data
-      containers:
-        - name: paperless-ai
-          image: clusterzx/paperless-ai:latest
-          env:
-            # Paperless-ngx connection
-            - name: PAPERLESS_API_URL
-              value: "http://paperless.paperless.svc.cluster.local:8000"
-            - name: PAPERLESS_API_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: paperless-ai-config
-                  key: PAPERLESS_API_TOKEN
-            - name: PAPERLESS_USERNAME
-              value: "admin"
-            # LLM API — via public gateway with JWT auth
-            - name: AI_PROVIDER
-              value: "custom"
-            - name: CUSTOM_BASE_URL
-              value: "https://api.riotpiao.com/v1"
-            # Token will be read from file at runtime by the application
-            # The init container fetches it and stores in /app/data/llm_token.txt
-            - name: CUSTOM_API_KEY_FILE
-              value: "/app/data/llm_token.txt"
-            - name: CUSTOM_MODEL
-              value: "qwen2.5:3b-instruct"
-            # Behavior - scan for new documents and tag them
-            - name: SCAN_INTERVAL
-              value: "60"
-            - name: PROCESS_PREDEFINED_DOCUMENTS
-              value: "no"
-            - name: ADD_AI_TAG
-              value: "yes"
-            - name: AI_TAG_NAME
-              value: "ai-processed"
-            - name: USE_PROMPT_TAGS
-              value: "yes"
-            - name: ADD_AI_DESCRIPTIONS
-              value: "yes"
-          volumeMounts:
-            - name: paperless-ai-data
-              mountPath: /app/data
-            - name: paperless-ai-env-config
-              mountPath: /app/data/.env
-              subPath: paperless-ai-config.env
-          resources:
-            requests:
-              cpu: 100m
-              memory: 512Mi
-            limits:
-              cpu: "1"
-              memory: 2Gi

k8s/apps/poimen-frontend/ingress.yaml

@@ -1,24 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: poimen-frontend
-  namespace: poimen
-  annotations:
-    # Next.js SSE + LLM streaming responses need long timeouts + no buffering.
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
-    nginx.ingress.kubernetes.io/proxy-buffering: "off"
-    nginx.ingress.kubernetes.io/proxy-body-size: "10m"
-spec:
-  ingressClassName: nginx
-  rules:
-    - host: poimen.riotpiao.com
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: poimen-frontend
-                port:
-                  number: 3000

k8s/apps/poimen-frontend/kustomization.yaml

@@ -1,8 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-# Edge Ingress for poimen.riotpiao.com.
-# Same pattern as k8s/apps/api/ (api-gw ingress).
-# App manifests (Deployment, Service, NetworkPolicy) live in
-# riotpiao-poimen/poimen-frontend.git k8s/ — each repo owns its own k8s.
-resources:
-  - ingress.yaml

k8s/apps/secret-rotation-controller/crd.yaml

@@ -0,0 +1,144 @@
+apiVersion: apiextensions.k8s.io/v1
+kind: CustomResourceDefinition
+metadata:
+  name: secretrotations.homelab.riotpiao.com
+spec:
+  group: homelab.riotpiao.com
+  names:
+    kind: SecretRotation
+    plural: secretrotations
+  scope: Namespaced
+  versions:
+  - name: v1
+    served: true
+    storage: true
+    schema:
+      openAPIV3Schema:
+        type: object
+        properties:
+          metadata:
+            type: object
+          spec:
+            type: object
+            required:
+            - provider
+            - rotationInterval
+            properties:
+              # External system: authentik | forgejo | minio | vault
+              provider:
+                type: string
+                enum: [authentik, forgejo, minio, vault]
+              
+              # How often to rotate (hours)
+              rotationInterval:
+                type: integer
+                minimum: 24
+              
+              # Application ID in external system
+              appId:
+                type: string
+              
+              # k8s Secret to update (name, namespace, key)
+              secretRef:
+                type: object
+                required: [name, namespace]
+                properties:
+                  name:
+                    type: string
+                  namespace:
+                    type: string
+                  key:
+                    type: string
+                    description: "Secret key to update (e.g., MINIO_IDENTITY_OPENID_CLIENT_SECRET)"
+              
+              # Path to git file that holds the secret (for .enc.yaml files)
+              gitPath:
+                type: string
+                description: "Path in homelab repo to .enc.yaml file"
+              
+              # Ansible template values to substitute
+              templateValues:
+                type: object
+                additionalProperties:
+                  type: string
+          
+          status:
+            type: object
+            properties:
+              lastRotationTime:
+                type: string
+                format: date-time
+              nextRotationTime:
+                type: string
+                format: date-time
+              lastRotationStatus:
+                type: string
+                enum: [Success, Failed, Pending]
+              lastRotationError:
+                type: string
+              lastCommitHash:
+                type: string
+
+---
+# Example usage:
+apiVersion: homelab.riotpiao.com/v1
+kind: SecretRotation
+metadata:
+  name: minio-oidc
+  namespace: secret-rotation
+spec:
+  provider: authentik
+  rotationInterval: 2160  # 90 days in hours
+  appId: minio
+  secretRef:
+    name: minio-oidc
+    namespace: storage
+    key: MINIO_IDENTITY_OPENID_CLIENT_SECRET
+  gitPath: k8s/argocd/secrets/minio-oidc.enc.yaml
+
+---
+apiVersion: homelab.riotpiao.com/v1
+kind: SecretRotation
+metadata:
+  name: portfolio-agent-oidc
+  namespace: secret-rotation
+spec:
+  provider: authentik
+  rotationInterval: 2160
+  appId: portfolio-agent
+  secretRef:
+    name: portfolio-agent-oidc
+    namespace: portfolio
+    key: CLIENT_SECRET
+  gitPath: k8s/argocd/secrets/portfolio-agent-oidc.enc.yaml
+
+---
+apiVersion: homelab.riotpiao.com/v1
+kind: SecretRotation
+metadata:
+  name: forgejo-registry-token
+  namespace: secret-rotation
+spec:
+  provider: forgejo
+  rotationInterval: 2160
+  appId: rock/riotpiao.com
+  secretRef:
+    name: forgejo-registry-secret
+    namespace: kube-system
+    key: REGISTRY_TOKEN
+  gitPath: k8s/argocd/secrets/forgejo-registry-secret.enc.yaml
+
+---
+apiVersion: homelab.riotpiao.com/v1
+kind: SecretRotation
+metadata:
+  name: minio-root-credentials
+  namespace: secret-rotation
+spec:
+  provider: minio
+  rotationInterval: 4320  # 180 days in hours
+  appId: root
+  secretRef:
+    name: minio-creds
+    namespace: storage
+  gitPath: k8s/argocd/secrets/minio-secrets.enc.yaml

k8s/apps/secret-rotation-controller/deployment.yaml

@@ -0,0 +1,92 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: secret-rotation-controller
+  namespace: secret-rotation
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: secret-rotation-controller
+  template:
+    metadata:
+      labels:
+        app: secret-rotation-controller
+    spec:
+      serviceAccountName: secret-rotation-controller
+      containers:
+      - name: controller
+        image: secret-rotation-controller:latest
+        imagePullPolicy: IfNotPresent
+        env:
+        # SOPS reads age key from this file
+        - name: SOPS_AGE_KEY_FILE
+          value: /etc/sops/age/private-key.txt
+        
+        # Vault auth (token in projected volume)
+        - name: VAULT_ADDR
+          value: http://vault.vault.svc.cluster.local:8200
+        - name: VAULT_TOKEN_FILE
+          value: /var/run/secrets/vault/token
+        
+        # Authentik
+        - name: AUTHENTIK_URL
+          value: http://authentik-server.iam.svc.cluster.local
+        - name: AUTHENTIK_BOOTSTRAP_TOKEN
+          valueFrom:
+            secretKeyRef:
+              name: authentik-bootstrap
+              key: token
+        
+        # Git
+        - name: GIT_REPO
+          value: https://forgejo.riotpiao.com/rock/homelab.git
+        - name: GIT_AUTHOR_EMAIL
+          value: [email protected]
+        - name: GIT_AUTHOR_NAME
+          value: Secret Rotation Controller
+        - name: FORGEJO_TOKEN
+          valueFrom:
+            secretKeyRef:
+              name: forgejo-registry-secret
+              key: REGISTRY_TOKEN
+        
+        volumeMounts:
+        # Age key from ExternalSecret (synced from Vault)
+        - name: age-key
+          mountPath: /etc/sops/age
+          readOnly: true
+        
+        # Vault auth token (projected)
+        - name: vault-token
+          mountPath: /var/run/secrets/vault
+          readOnly: true
+        
+        # Temp working dir
+        - name: tmp
+          mountPath: /tmp
+        
+        resources:
+          requests:
+            cpu: 100m
+            memory: 256Mi
+          limits:
+            cpu: 500m
+            memory: 512Mi
+      
+      volumes:
+      - name: age-key
+        secret:
+          secretName: sops-age-key
+          defaultMode: 0400
+      
+      - name: vault-token
+        projected:
+          sources:
+          - serviceAccountToken:
+              path: token
+              audience: vault
+              expirationSeconds: 3600
+      
+      - name: tmp
+        emptyDir: {}

k8s/apps/secret-rotation-controller/kustomization.yaml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+namespace: secret-rotation
+
+resources:
+  - rbac.yaml
+  - crd.yaml
+  - external-secret.yaml
+  - deployment.yaml
+
+commonLabels:
+  app.kubernetes.io/name: secret-rotation-controller
+  app.kubernetes.io/component: automation
+  managed-by: argocd

k8s/apps/secret-rotation-controller/rbac.yaml

@@ -0,0 +1,53 @@
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: secret-rotation-controller
+  namespace: secret-rotation
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: secret-rotation-controller
+rules:
+# Read SecretRotation CRDs
+- apiGroups: ["homelab.riotpiao.com"]
+  resources: ["secretrotations"]
+  verbs: ["get", "list", "watch"]
+
+# Update status
+- apiGroups: ["homelab.riotpiao.com"]
+  resources: ["secretrotations/status"]
+  verbs: ["get", "patch", "update"]
+
+# Read k8s secrets that will be rotated
+- apiGroups: [""]
+  resources: ["secrets"]
+  verbs: ["get", "list"]
+
+# For recording events
+- apiGroups: [""]
+  resources: ["events"]
+  verbs: ["create", "patch"]
+
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: secret-rotation-controller
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: ClusterRole
+  name: secret-rotation-controller
+subjects:
+- kind: ServiceAccount
+  name: secret-rotation-controller
+  namespace: secret-rotation
+
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: secret-rotation
+  labels:
+    kubernetes.io/metadata.name: secret-rotation

k8s/apps/sms/deployment-macos.yaml

@@ -0,0 +1,115 @@
+# macOS VM (Docker-OSX) hosting the BlueBubbles server.
+#
+# ── Why a VM and not a container ────────────────────────────────────────────
+# Containers share the host kernel. macOS binaries are Mach-O and need XNU plus
+# Cocoa/IOKit, which a Linux kernel cannot provide, so no macOS container exists
+# or can exist. Docker-OSX is QEMU running a macOS guest, packaged in a
+# container — a VM in a box, not a macOS container.
+#
+# ── Why this works on worker-2 ──────────────────────────────────────────────
+# Verified on the existing hardware: amd64, `vmx` (Intel VT-x) present, and
+# /dev/kvm exists on Talos nodes (KVM is compiled into Talos' kernel, not a
+# module). Bare metal, so no nested virtualisation needed.
+#
+# ── Read this before relying on it ──────────────────────────────────────────
+# 1. Setup is INTERACTIVE. First boot runs the macOS installer: connect over
+#    VNC (:5999), erase the disk in Disk Utility, install, create a user, sign
+#    into iMessage, THEN install BlueBubbles inside the guest. This manifest
+#    only provides the machine; it does not provision macOS.
+# 2. iMessage activation on non-Apple hardware is a coin flip. BlueBubbles'
+#    own guidance: "test sending an iMessage to yourself. If it does not
+#    succeed, it's likely best to restart from the beginning."
+# 3. Apple's macOS licence permits virtualisation only on Apple hardware. This
+#    is a Hackintosh. Use a throwaway Apple ID, not a primary one.
+# 4. BlueBubbles labels this path "not for beginners", "no guarantees or
+#    warranty".
+#
+# Private API (reactions, typing indicators, edit/unsend) needs SIP disabled
+# inside the guest and is NOT required for plain send/receive. Skip it.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: macos-bluebubbles
+  labels:
+    app.kubernetes.io/name: macos-bluebubbles
+    app.kubernetes.io/part-of: sms
+spec:
+  replicas: 1
+  # Recreate: the qcow2 disk is RWO and a second pod must never attach it
+  # concurrently — two QEMU processes on one image corrupts it.
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: macos-bluebubbles
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: macos-bluebubbles
+        app.kubernetes.io/part-of: sms
+    spec:
+      # Dedicated node. The taint keeps everything else off worker-2; this
+      # toleration is what lets the VM on. Both halves are required.
+      nodeSelector:
+        workload: imessage
+      tolerations:
+        - key: workload
+          operator: Equal
+          value: imessage
+          effect: NoSchedule
+      containers:
+        - name: macos
+          image: sickcodes/docker-osx:latest@sha256:3a3c82c79bc4e73531f819ccdfa4053b3084efd7c1f645678dbf8b4b3a24369c
+          # QEMU needs /dev/kvm; Talos enforces `baseline` cluster-wide, so this
+          # only schedules because the sms namespace is labelled privileged.
+          securityContext:
+            privileged: true
+          env:
+            # Generates a unique serial / board-serial / UUID / MAC and persists
+            # them to bootdisk.qcow2. This synthetic identity is what iMessage
+            # activates against — it must stay stable across restarts, which is
+            # why the PVC matters.
+            - name: GENERATE_UNIQUE
+              value: "true"
+            # Identity is only plausible if it matches a real product line.
+            - name: DEVICE_MODEL
+              value: "iMacPro1,1"
+            - name: RAM
+              value: "12"
+            - name: CORES
+              value: "6"
+            - name: EXTRA
+              # Expose the BlueBubbles server port from the guest to the pod.
+              # Guest :1234 (BlueBubbles default) -> pod :1234.
+              value: "-device virtio-net-pci,netdev=net0 -netdev user,id=net0,hostfwd=tcp::1234-:1234"
+          ports:
+            - name: vnc
+              containerPort: 5999
+              protocol: TCP
+            - name: bluebubbles
+              containerPort: 1234
+              protocol: TCP
+          resources:
+            requests:
+              cpu: "6"
+              memory: 14Gi
+            limits:
+              cpu: "12"
+              memory: 20Gi
+          volumeMounts:
+            - name: macos-disk
+              mountPath: /home/arch/OSX-KVM/disk
+            - name: kvm
+              mountPath: /dev/kvm
+          # No readiness probe on purpose. The guest takes many minutes to boot,
+          # and until macOS + BlueBubbles are installed BY HAND there is nothing
+          # listening on 1234. A probe here would crash-loop the pod through the
+          # entire interactive install.
+      volumes:
+        - name: macos-disk
+          persistentVolumeClaim:
+            claimName: macos-disk
+        - name: kvm
+          hostPath:
+            path: /dev/kvm
+            type: CharDevice

k8s/apps/sms/kustomization.yaml

@@ -0,0 +1,10 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: sms
+resources:
+  - namespace.yaml
+  - storageclass.yaml
+  - pvc-macos.yaml
+  - deployment-macos.yaml
+  - service.yaml
+  - networkpolicy.yaml

k8s/apps/sms/namespace.yaml

@@ -0,0 +1,19 @@
+# iMessage delivery for the cluster.
+#
+# BlueBubbles' server is a macOS Electron app paired with an Objective-C helper
+# that hooks Messages.app private APIs — it cannot be containerised on Linux,
+# because containers share the host kernel and macOS needs XNU + Cocoa. The only
+# way to run it on Talos is a full macOS VM under QEMU/KVM (Docker-OSX), which
+# needs a privileged pod with /dev/kvm.
+#
+# Hence privileged PodSecurity: the cluster default from the Talos controlplane
+# is `enforce: baseline`, which forbids privileged containers and host devices.
+# Scope is limited to this namespace.
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: sms
+  labels:
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/warn: privileged

k8s/apps/sms/networkpolicy.yaml

@@ -0,0 +1,22 @@
+# Default-deny. This namespace runs a privileged QEMU VM signed into an Apple
+# ID and exposes an unauthenticated VNC console; nothing should reach it except
+# opted-in clients.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: sms-default-deny
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/part-of: sms
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector: {}
+          podSelector:
+            matchLabels:
+              sms-client: "true"
+      ports:
+        - protocol: TCP
+          port: 1234

k8s/apps/sms/pvc-macos.yaml

@@ -0,0 +1,25 @@
+# Persistent macOS disk image + generated hardware identity (bootdisk.qcow2).
+#
+# This volume is NOT disposable: it holds the VM's serial number, board serial,
+# UUID and MAC, which together form the identity iMessage was activated against.
+# Losing it means re-running activation, which is the least reliable step of the
+# whole setup.
+#
+# Docker-OSX documents 128GB minimum for the guest image; 200Gi leaves room for
+# the installer, the base system, and qcow2 growth.
+#
+# ⚠️ Single replica (see storageclass.yaml — capacity and IO both rule out 3).
+# Losing worker-2's disk therefore means losing the activated identity and
+# redoing iMessage activation. Once the guest is installed and activated, take
+# a Longhorn snapshot/backup of this volume; that is the only redundancy here.
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: macos-disk
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn-imessage-local
+  resources:
+    requests:
+      storage: 200Gi

k8s/apps/sms/service.yaml

@@ -0,0 +1,31 @@
+# VNC is how you drive the interactive macOS install. Deliberately ClusterIP —
+# it is an unauthenticated console onto a machine holding a live Apple ID
+# session. Reach it with `kubectl port-forward`, never an Ingress.
+apiVersion: v1
+kind: Service
+metadata:
+  name: macos-vnc
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: macos-bluebubbles
+  ports:
+    - name: vnc
+      port: 5999
+      targetPort: vnc
+---
+# The BlueBubbles REST API, once installed inside the guest. This is the stable
+# name cluster services use, so callers never depend on the pod IP or on whether
+# the backend is this VM or a real Mac mini later.
+apiVersion: v1
+kind: Service
+metadata:
+  name: bluebubbles
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/name: macos-bluebubbles
+  ports:
+    - name: http
+      port: 1234
+      targetPort: bluebubbles

k8s/apps/sms/storageclass.yaml

@@ -0,0 +1,32 @@
+# Dedicated StorageClass for the macOS VM disk.
+#
+# The default `longhorn` class does not work here, for two independent reasons:
+#
+# 1. Replica count. Default is 3, and Longhorn schedules against
+#    storageMaximum - storageScheduled with over-provisioning at 100%. Free
+#    space is cp-1 146Gi / cp-2 8Gi / cp-3 146Gi / worker-1 292Gi, so a 200Gi
+#    volume has only one node that can hold even a single replica — a 3-replica
+#    volume fails outright with ReplicaSchedulingFailure.
+# 2. Binding mode. `Immediate` provisions the volume the moment the PVC is
+#    created, before any pod is scheduled. Combined with strict-local that
+#    pins the data to an arbitrary node, not the one the VM runs on.
+#
+# So: one replica, kept local to the VM, bound only once the pod has a node.
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: longhorn-imessage-local
+provisioner: driver.longhorn.io
+allowVolumeExpansion: true
+reclaimPolicy: Delete
+# The pod is pinned to worker-2 by nodeSelector; wait for it to be scheduled so
+# the replica is placed on that node and not somewhere else.
+volumeBindingMode: WaitForFirstConsumer
+parameters:
+  # A qcow2 backing a live VM is latency-sensitive and rewritten constantly.
+  # Serving it over the network from another node's disk would be the single
+  # worst thing for guest responsiveness, so force it local.
+  numberOfReplicas: "1"
+  dataLocality: "strict-local"
+  staleReplicaTimeout: "30"
+  fsType: "ext4"

k8s/argocd/apps/-1-projects.yaml

@@ -18,7 +18,7 @@ spec:
       prune: true
       selfHeal: true
   source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    repoURL: https://forgejo.riotpiao.com/rock/homelab.git
     targetRevision: main
     path: k8s/argocd/projects
   destination:

k8s/argocd/apps/00-secrets.yaml

@@ -17,7 +17,7 @@ spec:
     syncOptions:
       - CreateNamespace=true
   source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    repoURL: https://forgejo.riotpiao.com/rock/homelab.git
     targetRevision: main
     # ksops decrypts every *.enc.yaml here at kustomize-build time (repo-server
     # runs `kustomize build --enable-alpha-plugins --enable-exec`). Replaces the

k8s/argocd/apps/00-substrate.yaml

@@ -21,7 +21,7 @@ spec:
       helm:
         valueFiles:
           - $values/k8s/bootstrap/cert-manager/cert-manager-values.yaml
-    - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    - repoURL: https://forgejo.riotpiao.com/rock/homelab.git
       targetRevision: main
       ref: values
   destination:
@@ -93,7 +93,7 @@ spec:
   project: homelab
   revisionHistoryLimit: 3
   source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    repoURL: https://forgejo.riotpiao.com/rock/homelab.git
     targetRevision: main
     # A real kustomization.yaml (resources: the 3 issuer/CA files) renders these
     # deterministically. The previous directory.include with bare filenames
@@ -127,7 +127,7 @@ spec:
   project: homelab
   revisionHistoryLimit: 3
   source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    repoURL: https://forgejo.riotpiao.com/rock/homelab.git
     targetRevision: main
     path: k8s/bootstrap/ingress
   destination:
@@ -149,7 +149,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    repoURL: https://forgejo.riotpiao.com/rock/homelab.git
     targetRevision: main
     path: k8s/infra/cluster-maintenance
   destination:
@@ -177,7 +177,7 @@ spec:
       valueFiles:
         - $values/k8s/bootstrap/kyverno/kyverno-values.yaml
   sources:
-    - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    - repoURL: https://forgejo.riotpiao.com/rock/homelab.git
       targetRevision: main
       ref: values
   destination:
@@ -200,7 +200,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    repoURL: https://forgejo.riotpiao.com/rock/homelab.git
     targetRevision: main
     path: k8s/bootstrap/kyverno
   destination:

k8s/argocd/apps/01-image-updater.yaml

@@ -0,0 +1,33 @@
+# ArgoCD Image Updater - auto-updates Application images from registry
+# Watches forgejo.riotpiao.com for new image tags and updates Applications
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: argocd-image-updater
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+  annotations:
+    argocd.argoproj.io/sync-wave: "1"
+spec:
+  project: homelab
+  revisionHistoryLimit: 3
+  sources:
+    - repoURL: https://argoproj.github.io/argo-helm
+      chart: argocd-image-updater
+      targetRevision: "0.11.2"
+      helm:
+        valueFiles:
+          - $values/k8s/infra/argocd-image-updater/values.yaml
+    - repoURL: https://forgejo.riotpiao.com/rock/homelab.git
+      targetRevision: main
+      ref: values
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: argocd
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=false

k8s/argocd/apps/06-ci-cd.yaml

@@ -1,55 +0,0 @@
-# Tekton Pipelines v0.68.0
-#
-# Install method: vendored release.yaml in k8s/infra/tekton/
-# downloaded from https://storage.googleapis.com/tekton-releases/pipeline/previous/v0.68.0/release.yaml
-#
-# To upgrade:
-#   1. Download new release.yaml from https://github.com/tektoncd/pipeline/releases
-#   2. Replace k8s/infra/tekton/release.yaml
-#   3. Commit and push — ArgoCD syncs automatically
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: tekton-pipelines
-  namespace: argocd
-  labels:
-    app.kubernetes.io/name: tekton-pipelines
-    app.kubernetes.io/part-of: homelab-infra
-    wave: "06"
-spec:
-  project: homelab
-
-  source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
-    targetRevision: main
-    path: k8s/infra/tekton
-
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: tekton-pipelines
-
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-    - CreateNamespace=true
-    - ServerSideApply=true
-    retry:
-      limit: 5
-      backoff:
-        duration: 5s
-        factor: 2
-        maxDuration: 3m
-
-  ignoreDifferences:
-  - group: admissionregistration.k8s.io
-    kind: ValidatingWebhookConfiguration
-    jsonPointers:
-    - /webhooks/0/clientConfig/caBundle
-    - /webhooks
-  - group: admissionregistration.k8s.io
-    kind: MutatingWebhookConfiguration
-    jsonPointers:
-    - /webhooks/0/clientConfig/caBundle
-    - /webhooks

k8s/argocd/apps/08-secret-rotation.yaml

@@ -1,29 +1,29 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: comfyui
+  name: secret-rotation
   namespace: argocd
   labels:
-    app.kubernetes.io/name: comfyui
-    app.kubernetes.io/component: image-generation
-  annotations:
-    argocd.argoproj.io/sync-wave: "8"
+    app.kubernetes.io/name: secret-rotation
 spec:
   project: homelab
-  revisionHistoryLimit: 3
-  source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+  
+  sources:
+  - repoURL: https://forgejo.riotpiao.com/rock/homelab.git
+    path: k8s/apps/secret-rotation-controller
     targetRevision: main
-    path: k8s/apps/comfyui
+  
   destination:
     server: https://kubernetes.default.svc
-    namespace: comfyui
+    namespace: secret-rotation
+  
   syncPolicy:
     automated:
       prune: true
       selfHeal: true
     syncOptions:
-      - CreateNamespace=true
+    - CreateNamespace=true
+    - RespectIgnoreDifferences=true
     retry:
       limit: 5
       backoff:

k8s/argocd/apps/10-storage-observability.yaml

@@ -17,7 +17,7 @@ spec:
       helm:
         valueFiles:
           - $values/k8s/infra/minio/minio-operator-values.yaml
-    - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    - repoURL: https://forgejo.riotpiao.com/rock/homelab.git
       targetRevision: main
       ref: values
   destination:
@@ -41,7 +41,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    repoURL: https://forgejo.riotpiao.com/rock/homelab.git
     targetRevision: main
     path: k8s/infra/minio
   destination:
@@ -66,7 +66,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    repoURL: https://forgejo.riotpiao.com/rock/homelab.git
     targetRevision: main
     path: k8s/infra/longhorn
   destination:
@@ -102,7 +102,7 @@ spec:
         skipCrds: true
         valueFiles:
           - $values/k8s/infra/monitoring/prometheus-values.yaml
-    - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    - repoURL: https://forgejo.riotpiao.com/rock/homelab.git
       targetRevision: main
       ref: values
   destination:
@@ -152,7 +152,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    repoURL: https://forgejo.riotpiao.com/rock/homelab.git
     targetRevision: main
     path: k8s/infra/monitoring/crds
   destination:
@@ -183,7 +183,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    repoURL: https://forgejo.riotpiao.com/rock/homelab.git
     targetRevision: main
     path: k8s/infra/monitoring
   destination:
@@ -213,7 +213,7 @@ spec:
       helm:
         valueFiles:
           - $values/k8s/infra/monitoring/blackbox-exporter-values.yaml
-    - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    - repoURL: https://forgejo.riotpiao.com/rock/homelab.git
       targetRevision: main
       ref: values
   destination:
@@ -237,7 +237,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    repoURL: https://forgejo.riotpiao.com/rock/homelab.git
     targetRevision: main
     path: k8s/infra/tracing
   destination:
@@ -249,26 +249,3 @@ spec:
       selfHeal: true
     syncOptions:
       - CreateNamespace=true
----
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: local-path-provisioner
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "1"
-spec:
-  project: homelab
-  source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
-    targetRevision: main
-    path: k8s/infra/local-path
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: local-path-storage
-  # No CreateNamespace: the Namespace object (with its privileged PSA label,
-  # which the helper Pods need for their hostPath) is part of the manifest.
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true

k8s/argocd/apps/20-logging.yaml

@@ -19,7 +19,7 @@ spec:
       helm:
         valueFiles:
           - $values/k8s/infra/logging/loki-values.yaml
-    - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    - repoURL: https://forgejo.riotpiao.com/rock/homelab.git
       targetRevision: main
       ref: values
   destination:
@@ -53,7 +53,7 @@ spec:
       helm:
         valueFiles:
           - $values/k8s/infra/logging/grafana-values.yaml
-    - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    - repoURL: https://forgejo.riotpiao.com/rock/homelab.git
       targetRevision: main
       ref: values
   destination:
@@ -87,7 +87,7 @@ spec:
       helm:
         valueFiles:
           - $values/k8s/infra/logging/promtail-values.yaml
-    - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    - repoURL: https://forgejo.riotpiao.com/rock/homelab.git
       targetRevision: main
       ref: values
   destination:

k8s/argocd/apps/30-security.yaml

@@ -17,7 +17,7 @@ spec:
       helm:
         valueFiles:
           - $values/k8s/infra/iam/vault-values.yaml
-    - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    - repoURL: https://forgejo.riotpiao.com/rock/homelab.git
       targetRevision: main
       ref: values
   destination:
@@ -30,103 +30,45 @@ spec:
     syncOptions:
       - CreateNamespace=true
 ---
-# ZITADEL — the Authentik replacement. Coexistence, not cutover: Authentik keeps
-# serving in the same `iam` namespace until the last consumer moves, then this
-# becomes the only IdP. Migration plan (outside git):
-# ~/workplace/homelab-doc/ZITADEL_MIGRATION.html
-#
-# Wave 3 ordering: sops-secrets (wave 0) creates the `zitadel-masterkey` Secret,
-# databases (wave 2) creates the `zitadel-db` CNPG cluster and its
-# `zitadel-db-app` DSN secret. Both must exist before the init job starts.
-#
-# automated sync is deliberately absent for the first sync — same reason as
-# forgejo. The chart ships `pre-install,pre-upgrade` Helm hooks (zitadel-init,
-# zitadel-setup), which ArgoCD maps to PreSync and re-runs on every sync, manual
-# or automated. A human reads the first sync's hook output before any repeat can
-# run. The init job runs `init zitadel` only (CNPG owns the database and the app
-# user), and the setup job creates the first org and the `iam-admin` machine key
-# that Terraform consumes. Read the SECOND-SYNC HAZARD block at the top of
-# k8s/infra/iam/zitadel-values.yaml before enabling automated sync.
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: zitadel
+  name: authentik
   namespace: argocd
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
   annotations:
     argocd.argoproj.io/sync-wave: "3"
 spec:
   project: homelab
-  revisionHistoryLimit: 3
   sources:
-    - repoURL: https://charts.zitadel.com
-      chart: zitadel
-      # Pinned: the chart trails the upstream app release, and the verified
-      # masterkey/passwap facts were read at v4.19.x. A floating tag would
-      # change the app version without a diff anyone reviews.
-      targetRevision: 10.4.0
+    - repoURL: https://charts.goauthentik.io
+      chart: authentik
+      targetRevision: "*"
       helm:
         valueFiles:
-          - $values/k8s/infra/iam/zitadel-values.yaml
-    - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+          - $values/k8s/infra/iam/authentik-values.yaml
+    - repoURL: https://forgejo.riotpiao.com/rock/homelab.git
       targetRevision: main
       ref: values
   destination:
     server: https://kubernetes.default.svc
     namespace: iam
-  syncPolicy:
-    syncOptions:
-      - CreateNamespace=true
----
-# ZITADEL core objects (ServiceAccount, Role, RoleBinding, ConfigMap).
-#
-# The chart declares these as pre-install/pre-upgrade Helm hooks, and ArgoCD
-# prunes hook resources when a sync ends. That deleted the ServiceAccount and
-# ConfigMap the ZITADEL Deployment references, so new pods failed to start with
-# `serviceaccount "zitadel" not found`. This Application owns hook-free copies,
-# which makes them ordinary desired state that survives every sync.
-#
-# Wave 2: before the zatadel chart itself, so the ServiceAccount exists by the
-# time its Deployment is created.
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: zitadel-core
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "2"
-spec:
-  project: homelab
-  source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
-    targetRevision: main
-    path: k8s/infra/zitadel-core
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: iam
   syncPolicy:
     automated:
-      prune: false
+      prune: true
       selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
 ---
-# Raw IAM support manifests: the SMTP -> Gotify notification relay that ZITADEL
-# points at, so verification and password-reset codes reach the phone. Wave 3
-# alongside ZITADEL itself; the Secret it reads is created by sops-secrets at
-# wave 0.
+# Raw IAM manifests: key-rotation cronjob + authentik migration job.
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: iam-support
+  name: iam-jobs
   namespace: argocd
   annotations:
     argocd.argoproj.io/sync-wave: "3"
 spec:
   project: homelab
   source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    repoURL: https://forgejo.riotpiao.com/rock/homelab.git
     targetRevision: main
     path: k8s/infra/iam
   destination:
@@ -167,7 +109,7 @@ spec:
       helm:
         valueFiles:
           - $values/k8s/bootstrap/phase3-forgejo/forgejo-values.yaml
-    - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    - repoURL: https://forgejo.riotpiao.com/rock/homelab.git
       targetRevision: main
       ref: values
   destination:
@@ -210,12 +152,17 @@ metadata:
   namespace: argocd
   annotations:
     argocd.argoproj.io/sync-wave: "3"
-    # Image promotion: Forgejo package webhook → api-gw.
-    # Replaced ArgoCD Image Updater (removed 2026-09-10).
+    argocd-image-updater.argoproj.io/image-list: runner=forgejo.riotpiao.com/rock/forgejo-runner-golang
+    argocd-image-updater.argoproj.io/runner.update-strategy: newest-build
+    argocd-image-updater.argoproj.io/runner.allow-tags: regexp:^[0-9a-f]{7}$|^latest$|^v[0-9]+$
+    argocd-image-updater.argoproj.io/runner.helm.image-name: runner.image.repository
+    argocd-image-updater.argoproj.io/runner.helm.image-tag: runner.image.tag
+    argocd-image-updater.argoproj.io/write-back-method: git
+    argocd-image-updater.argoproj.io/git-branch: main
 spec:
   project: homelab
   source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    repoURL: https://forgejo.riotpiao.com/rock/homelab.git
     targetRevision: main
     path: k8s/infra/forgejo-runner
   destination:
@@ -233,12 +180,17 @@ metadata:
   namespace: argocd
   annotations:
     argocd.argoproj.io/sync-wave: "3"
-    # Image promotion: Forgejo package webhook → api-gw.
-    # Replaced ArgoCD Image Updater (removed 2026-09-10).
+    argocd-image-updater.argoproj.io/image-list: runner=forgejo.riotpiao.com/rock/forgejo-runner-node
+    argocd-image-updater.argoproj.io/runner.update-strategy: newest-build
+    argocd-image-updater.argoproj.io/runner.allow-tags: regexp:^[0-9a-f]{7}$|^latest$|^v[0-9]+$
+    argocd-image-updater.argoproj.io/runner.helm.image-name: runner.image.repository
+    argocd-image-updater.argoproj.io/runner.helm.image-tag: runner.image.tag
+    argocd-image-updater.argoproj.io/write-back-method: git
+    argocd-image-updater.argoproj.io/git-branch: main
 spec:
   project: homelab
   source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    repoURL: https://forgejo.riotpiao.com/rock/homelab.git
     targetRevision: main
     path: k8s/infra/forgejo-runner
     helm:
@@ -259,12 +211,17 @@ metadata:
   namespace: argocd
   annotations:
     argocd.argoproj.io/sync-wave: "3"
-    # Image promotion: Forgejo package webhook → api-gw.
-    # Replaced ArgoCD Image Updater (removed 2026-09-10).
+    argocd-image-updater.argoproj.io/image-list: runner=forgejo.riotpiao.com/rock/forgejo-runner-rust
+    argocd-image-updater.argoproj.io/runner.update-strategy: newest-build
+    argocd-image-updater.argoproj.io/runner.allow-tags: regexp:^[0-9a-f]{7}$|^latest$|^v[0-9]+$
+    argocd-image-updater.argoproj.io/runner.helm.image-name: runner.image.repository
+    argocd-image-updater.argoproj.io/runner.helm.image-tag: runner.image.tag
+    argocd-image-updater.argoproj.io/write-back-method: git
+    argocd-image-updater.argoproj.io/git-branch: main
 spec:
   project: homelab
   source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    repoURL: https://forgejo.riotpiao.com/rock/homelab.git
     targetRevision: main
     path: k8s/infra/forgejo-runner
     helm:

k8s/argocd/apps/40-data.yaml

@@ -1,4 +1,4 @@
-# Wave 2 — dedicated per-app CNPG Postgres clusters (zitadel-db → ns iam,
+# Wave 2 — dedicated per-app CNPG Postgres clusters (authentik-db → ns iam,
 # temporal-db + visibility → ns temporal). ONE App, ONE folder (k8s/infra/databases).
 # CNPG operator is Phase-0 bootstrap; these Cluster CRs are GitOps — no circular
 # dep (they run after ArgoCD is up, before their apps at w3/w8). CNPG generates
@@ -14,7 +14,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    repoURL: https://forgejo.riotpiao.com/rock/homelab.git
     targetRevision: main
     path: k8s/infra/databases
   destination:

k8s/argocd/apps/50-memory-queues.yaml

@@ -8,7 +8,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    repoURL: https://forgejo.riotpiao.com/rock/homelab.git
     targetRevision: main
     path: k8s/apps/messaging/memory-queues
   destination:

k8s/argocd/apps/50-messaging.yaml

@@ -68,7 +68,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    repoURL: https://forgejo.riotpiao.com/rock/homelab.git
     targetRevision: main
     path: k8s/apps/messaging/kafka-cluster
   destination:

k8s/argocd/apps/55-api-gateway.yaml

@@ -36,17 +36,19 @@ metadata:
     app.kubernetes.io/component: gateway
   annotations:
     argocd.argoproj.io/sync-wave: "7"
-    # Image promotion: Forgejo package webhook → api-gw /v1/webhooks/forgejo
-    # → patches this Application's kustomize.images via k8s API.
-    # Replaced ArgoCD Image Updater (removed 2026-09-10).
+    # ArgoCD Image Updater - auto-update on new image push
+    argocd-image-updater.argoproj.io/image-list: gw=forgejo.riotpiao.com/rock/api-gateway
+    argocd-image-updater.argoproj.io/gw.update-strategy: digest
+    argocd-image-updater.argoproj.io/gw.allow-tags: regexp:^latest$
+    argocd-image-updater.argoproj.io/write-back-method: argocd
 spec:
   project: homelab
   revisionHistoryLimit: 3
   sources:
-    - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab-frontend.git
+    - repoURL: https://forgejo.riotpiao.com/rock/homelab-frontend.git
       targetRevision: main
       path: k8s
-    - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    - repoURL: https://forgejo.riotpiao.com/rock/homelab.git
       targetRevision: main
       path: k8s/apps/api
   destination:

k8s/argocd/apps/56-llm-serving.yaml

@@ -20,7 +20,7 @@ spec:
   project: homelab
   revisionHistoryLimit: 3
   source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    repoURL: https://forgejo.riotpiao.com/rock/homelab.git
     targetRevision: main
     path: k8s/apps/llm-serving
   destination:

k8s/argocd/apps/59-gotify.yaml

@@ -1,32 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: gotify
-  namespace: argocd
-  labels:
-    app.kubernetes.io/name: gotify
-    app.kubernetes.io/component: notifications
-  annotations:
-    argocd.argoproj.io/sync-wave: "8"
-spec:
-  project: homelab
-  revisionHistoryLimit: 3
-  source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
-    targetRevision: main
-    path: k8s/apps/gotify
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: notifications
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
-    retry:
-      limit: 5
-      backoff:
-        duration: 5s
-        factor: 2
-        maxDuration: 3m

k8s/argocd/apps/60-applications.yaml

@@ -19,10 +19,10 @@ spec:
       helm:
         valueFiles:
           - $values/k8s/apps/temporal/temporal-values.yaml
-    - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    - repoURL: https://forgejo.riotpiao.com/rock/homelab.git
       targetRevision: main
       ref: values
-    - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    - repoURL: https://forgejo.riotpiao.com/rock/homelab.git
       targetRevision: main
       path: k8s/apps/temporal
   destination:
@@ -51,7 +51,7 @@ spec:
       helm:
         valueFiles:
           - $values/k8s/apps/portainer/portainer-values.yaml
-    - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    - repoURL: https://forgejo.riotpiao.com/rock/homelab.git
       targetRevision: main
       ref: values
   destination:
@@ -74,7 +74,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    repoURL: https://forgejo.riotpiao.com/rock/homelab.git
     targetRevision: main
     path: k8s/apps/cloudflared
   destination:
@@ -97,7 +97,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    repoURL: https://forgejo.riotpiao.com/rock/homelab.git
     targetRevision: main
     path: k8s/apps/agent-pod
   destination:
@@ -110,6 +110,37 @@ spec:
     syncOptions:
       - CreateNamespace=true
 ---
+# iMessage/SMS delivery. Raw manifests: a privileged macOS VM (Docker-OSX)
+# running the BlueBubbles server, plus its dedicated local StorageClass.
+#
+# Pinned to worker-2 via nodeSelector `workload: imessage` + a matching
+# toleration for that node's taint. Until worker-2 is provisioned this app
+# syncs everything except the pod, which stays Pending — that is expected.
+#
+# No CreateNamespace: namespace.yaml carries `pod-security: privileged`, which
+# the VM needs (/dev/kvm, privileged), and an ArgoCD-created namespace would
+# not have those labels.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: sms
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "8"
+spec:
+  project: homelab
+  source:
+    repoURL: https://forgejo.riotpiao.com/rock/homelab.git
+    targetRevision: main
+    path: k8s/apps/sms
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: sms
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+---
 # Document management. Raw manifests (no Helm): postgres is the dedicated
 # paperless-db CNPG cluster in k8s/infra/databases (wave 2), redis is
 # in-cluster only (no PVC), media lives on the cp-3 USB HDD (see
@@ -126,7 +157,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    repoURL: https://forgejo.riotpiao.com/rock/homelab.git
     targetRevision: main
     path: k8s/apps/paperless
   destination:
@@ -158,7 +189,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    repoURL: https://forgejo.riotpiao.com/rock/homelab.git
     targetRevision: main
     path: k8s/apps/immich
   destination:
@@ -171,6 +202,40 @@ spec:
     syncOptions:
       - CreateNamespace=true
 ---
+# Consolidated: homarr + homarr-patches → homarr
+# Helm chart + values + PostSync hook patch (fix-probes-job.yaml)
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: homarr
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "8"
+spec:
+  project: homelab
+  sources:
+    - repoURL: https://homarr-labs.github.io/charts
+      chart: homarr
+      targetRevision: "*"
+      helm:
+        valueFiles:
+          - $values/k8s/apps/homarr/homarr-values.yaml
+    - repoURL: https://forgejo.riotpiao.com/rock/homelab.git
+      targetRevision: main
+      ref: values
+    - repoURL: https://forgejo.riotpiao.com/rock/homelab.git
+      targetRevision: main
+      path: k8s/apps/homarr  # PostSync hook: fix-probes-job.yaml
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: dashboard
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+---
 # Portfolio site at riotpiao.com - static Next.js site from rock/riotpiao.com repo.
 # Points directly to infra/portfolio/base (bypassing repo's own argocd-apps.yaml
 # which has wrong URLs). Image built by Forgejo Actions on rock/portfolio repo.
@@ -181,8 +246,11 @@ metadata:
   namespace: argocd
   annotations:
     argocd.argoproj.io/sync-wave: "8"
-    # Image promotion: Forgejo package webhook → api-gw.
-    # Replaced ArgoCD Image Updater (removed 2026-09-10).
+    # ArgoCD Image Updater - auto-update on new image push
+    argocd-image-updater.argoproj.io/image-list: app=forgejo.riotpiao.com/rock/portfolio
+    argocd-image-updater.argoproj.io/app.update-strategy: digest
+    argocd-image-updater.argoproj.io/app.allow-tags: regexp:^latest$
+    argocd-image-updater.argoproj.io/write-back-method: argocd
 spec:
   project: homelab
   source:
@@ -213,7 +281,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    repoURL: https://forgejo.riotpiao.com/rock/homelab.git
     targetRevision: main
     path: k8s/infra/rbac
   destination:

k8s/argocd/apps/60-kmsvc-manage.yaml

@@ -12,7 +12,7 @@ metadata:
 spec:
   project: homelab
   source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/kmsvc-manage.git
+    repoURL: https://forgejo.riotpiao.com/rock/kmsvc-manage.git
     targetRevision: main
     path: k8s/argocd/apps
     directory: