feat: poimen-toolkit ArgoCD app + sourceRepo

- k8s/argocd/apps/71-poimen-toolkit.yaml: Application wave-7, points to
  poimen-toolkit repo k8s/ path, ServerSideApply for CRD schema size,
  image-updater for controller:latest digest
- k8s/argocd/projects/homelab-project.yaml: add poimen-toolkit.git to sourceRepos

k8s/apps/gotify/deployment.yaml

@@ -23,7 +23,7 @@ spec:
       containers:
         # --- Gotify server ---
         - name: gotify
-          image: ghcr.io/gotify/server:2.6.1
+          image: ghcr.io/gotify/server:3.1.0
           command: ["/bin/sh", "-c"]
           args:
             - |
@@ -84,7 +84,7 @@ spec:
         # Watches Gotify WebSocket stream, forwards messages as email.
         # https://github.com/eternal-flame-AD/gotify-broadcast
         - name: smtp-emailer
-          image: ghcr.io/gotify/server:2.6.1
+          image: ghcr.io/gotify/server:3.1.0
           command:
             - /bin/sh
             - -c

k8s/apps/gotify/igotify-deployment.yaml

@@ -0,0 +1,59 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: igotify
+  namespace: notifications
+  labels:
+    app: igotify
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: igotify
+  template:
+    metadata:
+      labels:
+        app: igotify
+    spec:
+      containers:
+        - name: igotify
+          image: ghcr.io/androidseb25/igotify-notification-assist:v1.6.0.1
+          ports:
+            - containerPort: 8080
+              protocol: TCP
+          env:
+            - name: ENABLE_CONSOLE_LOG
+              value: "true"
+            - name: ENABLE_SCALAR_UI
+              value: "true"
+            # GOTIFY_URLS / GOTIFY_CLIENT_TOKENS / SECNTFY_TOKENS intentionally
+            # left unset — not required when Gotify is reachable via public domain
+            # (gotify.riotpiao.com). iGotify iOS app registers itself at runtime.
+          volumeMounts:
+            - name: data
+              mountPath: /app/data
+          livenessProbe:
+            httpGet:
+              path: /Version
+              port: 8080
+            initialDelaySeconds: 10
+            periodSeconds: 30
+          readinessProbe:
+            httpGet:
+              path: /Version
+              port: 8080
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          resources:
+            requests:
+              cpu: 50m
+              memory: 64Mi
+            limits:
+              cpu: 200m
+              memory: 128Mi
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: igotify-data

k8s/apps/gotify/igotify-ingress.yaml

@@ -0,0 +1,22 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: igotify
+  namespace: notifications
+  annotations:
+    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
+    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
+    nginx.ingress.kubernetes.io/proxy-http-version: "1.1"
+spec:
+  ingressClassName: nginx
+  rules:
+    - host: igotify.riotpiao.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: igotify
+                port:
+                  number: 80

k8s/apps/gotify/igotify-pvc.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: igotify-data
+  namespace: notifications
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi

k8s/apps/gotify/igotify-service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: igotify
+  namespace: notifications
+  labels:
+    app: igotify
+spec:
+  selector:
+    app: igotify
+  ports:
+    - port: 80
+      targetPort: 8080
+      protocol: TCP

k8s/apps/gotify/ingress.yaml

@@ -6,11 +6,9 @@ metadata:
   annotations:
     nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
     nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
-    # WebSocket support for Gotify client connections
+    # WebSocket support for Gotify client connections (/stream endpoint)
+    # nginx-ingress handles Upgrade/Connection headers natively with http/1.1
     nginx.ingress.kubernetes.io/proxy-http-version: "1.1"
-    nginx.ingress.kubernetes.io/configuration-snippet: |
-      proxy_set_header Upgrade $http_upgrade;
-      proxy_set_header Connection "upgrade";
 spec:
   ingressClassName: nginx
   rules:

k8s/apps/gotify/kustomization.yaml

@@ -6,3 +6,7 @@ resources:
   - deployment.yaml
   - service.yaml
   - ingress.yaml
+  - igotify-pvc.yaml
+  - igotify-deployment.yaml
+  - igotify-service.yaml
+  - igotify-ingress.yaml

k8s/apps/llm-serving/networkpolicy.yaml

@@ -52,6 +52,20 @@ spec:
           port: 8080
         - protocol: TCP
           port: 9000
+    # Allow from paperless namespace (paperless-ai auto-tagging)
+    # Bypasses gateway until service-account JWT token exchange is implemented.
+    # paperless-ai-agent has llm:inference role in Authentik.
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: paperless
+      ports:
+        - protocol: TCP
+          port: 8080
+        - protocol: TCP
+          port: 80
+        - protocol: TCP
+          port: 8000
     # Allow intra-namespace (pod-to-pod within llm-serving)
     - from:
         - podSelector:

k8s/apps/llm-serving/ornith.yaml

@@ -44,7 +44,7 @@ spec:
       - name: OLLAMA_MODELS
         value: /mnt/models/ollama
       - name: OLLAMA_CONTEXT_LENGTH
-        value: '32768'
+        value: '65536'
       - name: OLLAMA_KEEP_ALIVE
         value: '-1'
       - name: OLLAMA_NUM_PARALLEL

k8s/apps/paperless/configmap.yaml

@@ -20,3 +20,7 @@ data:
   # wire up allauth's confirm-email view, so signup 500s with NoReverseMatch
   # on 'account_confirm_email' without this.
   PAPERLESS_ACCOUNT_EMAIL_VERIFICATION: "none"
+  # Auto-connect social accounts to existing users with matching email
+  PAPERLESS_SOCIAL_AUTO_SIGNUP: "true"
+  # Allow automatic linking of social accounts to existing users
+  PAPERLESS_ACCOUNT_ALLOW_SIGNUPS: "true"

k8s/apps/paperless/kustomization.yaml

@@ -4,6 +4,7 @@ namespace: paperless
 resources:
   - pvc.yaml
   - configmap.yaml
+  - paperless-ai-config.yaml
   - redis.yaml
   - deployment.yaml
   - service.yaml

k8s/apps/paperless/paperless-ai-config.yaml

@@ -0,0 +1,49 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: paperless-ai-env
+  namespace: paperless
+data:
+  paperless-ai-config.env: |
+    # Paperless-NGX API configuration
+    PAPERLESS_URL=http://paperless.paperless.svc.cluster.local:8000
+    PAPERLESS_API_TOKEN=7b89463e04c141f4172fbcddf78d623547d327ec
+
+    # AI Processing settings
+    ENABLE_AI_PROCESSING=yes
+    AI_MODEL=reasoning
+    LLM_API_URL=https://api.riotpiao.com/v1
+    LLM_API_TOKEN_FILE=/app/data/llm_token.txt
+
+    # Auto-tagging configuration
+    ENABLE_AUTO_TAGGING=yes
+    ENABLE_CORRESPONDENT_EXTRACTION=yes
+    ENABLE_DOCUMENT_TYPE_EXTRACTION=yes
+    ENABLE_TITLE_GENERATION=yes
+    
+    # Advanced tagging with AI
+    ENABLE_INTELLIGENT_TAGGING=yes
+    ENABLE_DATE_EXTRACTION=yes
+    ENABLE_TIMELINE_TAGGING=yes
+    AUTO_CREATE_TAGS=yes
+    
+    # Tagging prompts for custom extraction
+    CUSTOM_EXTRACTION_PROMPT=Extract document date, time period, financial year, and temporal context. Create tags like YYYY, Q1-YYYY, Last-Month, Current-Year, Historic
+    TAG_EXTRACTION_MODEL=reasoning
+
+    # Scanning behavior
+    SCAN_INTERVAL_SECONDS=60
+    PROCESS_EXISTING_DOCUMENTS=no
+    ADD_AI_TAG=yes
+    AI_TAG_NAME=ai-processed
+
+    # Date/Timeline tagging configuration
+    DATE_EXTRACTION_FORMAT=iso8601
+    TIMELINE_TAG_GRANULARITY=year,quarter,month
+    AUTO_TAG_HISTORICAL=yes
+    AUTO_TAG_RECENT=yes
+    
+    # Performance
+    MAX_CONCURRENT_REQUESTS=2
+    REQUEST_TIMEOUT=60
+    DATE_EXTRACTION_TIMEOUT=30

k8s/apps/paperless/paperless-ai-new.yaml

@@ -0,0 +1,127 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: paperless-ai-data
+  namespace: paperless
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: 2Gi
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: paperless-ai
+  namespace: paperless
+  labels:
+    app.kubernetes.io/name: paperless-ai
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: paperless-ai
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: paperless-ai
+    spec:
+      tolerations:
+        - key: node-role.kubernetes.io/control-plane
+          operator: Exists
+          effect: NoSchedule
+      
+      volumes:
+        - name: paperless-ai-data
+          persistentVolumeClaim:
+            claimName: paperless-ai-data
+      
+      initContainers:
+        - name: fetch-llm-token
+          image: curlimages/curl:8.12.0
+          command:
+            - sh
+            - -c
+            - |
+              set -e
+              echo "[init] Fetching JWT token from Authentik for paperless-ai-agent..."
+              
+              # Get JWT token via client_credentials grant
+              TOKEN_RESPONSE=$(curl -s -X POST https://authentik.riotpiao.com/application/o/token/ \
+                -d "grant_type=client_credentials" \
+                -d "client_id=paperless-ai-agent" \
+                -d "client_secret=29skAhE0tBzWn0qrPvmPTQMva0joFjcCr7msDQr_VXQ" \
+                -d "scope=openid llm:inference" 2>/dev/null)
+              
+              # Extract token
+              TOKEN=$(echo "$TOKEN_RESPONSE" | grep -o '"access_token":"[^"]*' | cut -d'"' -f4)
+              
+              if [ -z "$TOKEN" ]; then
+                echo "[error] Failed to get token. Response: $TOKEN_RESPONSE"
+                exit 1
+              fi
+              
+              # Store token in file for main container to read
+              mkdir -p /data
+              echo "$TOKEN" > /data/llm_token.txt
+              echo "[init] Token fetched and stored successfully"
+          volumeMounts:
+            - name: paperless-ai-data
+              mountPath: /data
+      
+      containers:
+        - name: paperless-ai
+          image: clusterzx/paperless-ai:latest
+          imagePullPolicy: Always
+          env:
+            # Paperless-ngx connection
+            - name: PAPERLESS_API_URL
+              value: "http://paperless.paperless.svc.cluster.local:8000"
+            - name: PAPERLESS_API_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: paperless-ai-config
+                  key: PAPERLESS_API_TOKEN
+            - name: PAPERLESS_USERNAME
+              value: "admin"
+            
+            # LLM API configuration
+            - name: AI_PROVIDER
+              value: "custom"
+            - name: CUSTOM_BASE_URL
+              value: "https://api.riotpiao.com/v1"
+            # Token file created by init container with JWT from Authentik
+            - name: CUSTOM_API_KEY_FILE
+              value: "/app/data/llm_token.txt"
+            - name: CUSTOM_MODEL
+              value: "qwen2.5:3b-instruct"
+            
+            # Scanning behavior
+            - name: SCAN_INTERVAL
+              value: "60"
+            - name: PROCESS_PREDEFINED_DOCUMENTS
+              value: "no"
+            
+            # Tagging configuration
+            - name: ADD_AI_TAG
+              value: "yes"
+            - name: AI_TAG_NAME
+              value: "ai-processed"
+            - name: ADD_AI_DESCRIPTIONS
+              value: "yes"
+            - name: USE_PROMPT_TAGS
+              value: "yes"
+          
+          volumeMounts:
+            - name: paperless-ai-data
+              mountPath: /app/data
+          
+          resources:
+            requests:
+              cpu: 100m
+              memory: 512Mi
+            limits:
+              cpu: "1"
+              memory: 2Gi

k8s/apps/paperless/paperless-ai.yaml

@@ -21,6 +21,59 @@ spec:
         - key: node-role.kubernetes.io/control-plane
           operator: Exists
           effect: NoSchedule
+      volumes:
+        - name: paperless-ai-data
+          persistentVolumeClaim:
+            claimName: paperless-ai-data
+        - name: paperless-ai-env-config
+          configMap:
+            name: paperless-ai-env
+      initContainers:
+        - name: fetch-llm-token
+          image: curlimages/curl:8.12.0
+          securityContext:
+            runAsUser: 0
+            fsGroup: 0
+          command:
+            - sh
+            - -c
+            - |
+              set -e
+              echo "[init] Fetching JWT token from Authentik for paperless-ai-agent..."
+              
+              # Get JWT token via client_credentials grant
+              # Client secret sourced from environment (injected from paperless-ai-config Secret)
+              TOKEN_RESPONSE=$(curl -s -X POST https://authentik.riotpiao.com/application/o/token/ \
+                -d "grant_type=client_credentials" \
+                -d "client_id=paperless-ai-agent" \
+                -d "client_secret=${LLM_AUTH_CLIENT_SECRET}" \
+                -d "scope=openid llm:inference" 2>/dev/null)
+              
+              # Extract token from JSON response using sed (handles spaces after colons)
+              TOKEN=$(echo "$TOKEN_RESPONSE" | sed -n 's/.*"access_token"[[:space:]]*:[[:space:]]*"\([^"]*\)".*/\1/p')
+              
+              if [ -z "$TOKEN" ]; then
+                echo "[error] Failed to get token. Response: $TOKEN_RESPONSE"
+                exit 1
+              fi
+              
+              # Store token in file for main container to read
+              # Write to both locations for compatibility
+              mkdir -p /tmp/llm-token /app/data 2>/dev/null || true
+              echo "$TOKEN" | tee /tmp/llm-token/llm_token.txt > /dev/null 2>&1
+              echo "$TOKEN" > /app/data/llm_token.txt 2>/dev/null || true
+              echo "[init] Token fetched and stored"
+              [ -f /tmp/llm-token/llm_token.txt ] && echo "  -> /tmp/llm-token/llm_token.txt"
+              [ -f /app/data/llm_token.txt ] && echo "  -> /app/data/llm_token.txt"
+          env:
+            - name: LLM_AUTH_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: paperless-ai-config
+                  key: LLM_AUTH_CLIENT_SECRET
+          volumeMounts:
+            - name: paperless-ai-data
+              mountPath: /app/data
       containers:
         - name: paperless-ai
           image: clusterzx/paperless-ai:latest
@@ -35,18 +88,20 @@ spec:
                   key: PAPERLESS_API_TOKEN
             - name: PAPERLESS_USERNAME
               value: "admin"
-            # LLM API — local gateway, no auth required (phase 3 not built yet)
+            # LLM API — via public gateway with JWT auth
             - name: AI_PROVIDER
               value: "custom"
             - name: CUSTOM_BASE_URL
-              value: "http://api-gateway.api.svc.cluster.local:8080/v1"
-            - name: CUSTOM_API_KEY
-              value: "not-required"
+              value: "https://api.riotpiao.com/v1"
+            # Token will be read from file at runtime by the application
+            # The init container fetches it and stores in /app/data/llm_token.txt
+            - name: CUSTOM_API_KEY_FILE
+              value: "/app/data/llm_token.txt"
             - name: CUSTOM_MODEL
-              value: "reasoning"
-            # Behavior
+              value: "qwen2.5:3b-instruct"
+            # Behavior - scan for new documents and tag them
             - name: SCAN_INTERVAL
-              value: "300"
+              value: "60"
             - name: PROCESS_PREDEFINED_DOCUMENTS
               value: "no"
             - name: ADD_AI_TAG
@@ -55,6 +110,14 @@ spec:
               value: "ai-processed"
             - name: USE_PROMPT_TAGS
               value: "yes"
+            - name: ADD_AI_DESCRIPTIONS
+              value: "yes"
+          volumeMounts:
+            - name: paperless-ai-data
+              mountPath: /app/data
+            - name: paperless-ai-env-config
+              mountPath: /app/data/.env
+              subPath: paperless-ai-config.env
           resources:
             requests:
               cpu: 100m

k8s/argocd/apps/71-poimen-toolkit.yaml

@@ -0,0 +1,34 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: poimen-toolkit
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "7"
+    argocd-image-updater.argoproj.io/image-list: |
+      controller=ghcr.io/riotpiao-poimen/poimen-toolkit-controller
+    argocd-image-updater.argoproj.io/controller.update-strategy: digest
+    argocd-image-updater.argoproj.io/controller.allow-tags: regexp:^latest$
+    argocd-image-updater.argoproj.io/write-back-method: argocd
+spec:
+  project: homelab
+  source:
+    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/poimen-toolkit.git
+    targetRevision: main
+    path: k8s
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: poimen
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+      - ServerSideApply=true
+    retry:
+      limit: 5
+      backoff:
+        duration: 5s
+        factor: 2
+        maxDuration: 3m

k8s/argocd/projects/homelab-project.yaml

@@ -24,6 +24,7 @@ spec:
     - https://forgejo.riotpiao.com/riotpiao-poimen/poimen-memory.git
     - https://forgejo.riotpiao.com/riotpiao-poimen/poimen-workflows.git
     - https://forgejo.riotpiao.com/riotpiao-poimen/poimen-frontend.git
+    - https://forgejo.riotpiao.com/riotpiao-poimen/poimen-toolkit.git
     - https://forgejo.riotpiao.com/rock/riotpiao.com.git
     # Public Helm chart repos referenced by k8s/argocd/apps/* and bootstrap/*
     - https://cloudnative-pg.github.io/charts

k8s/argocd/secrets/paperless-ai-secrets.enc.yaml

@@ -1,23 +1,24 @@
-apiVersion: ENC[AES256_GCM,data:l7I=,iv:NZY7r3JVW3zVwxeiScvWKpAQUDa9+nckHd0qWVrGU88=,tag:qpowp5OILdYKtTux/nlWpg==,type:str]
-kind: ENC[AES256_GCM,data:6oeEbuIk,iv:5flI9TtcYQ961wOYPBPhvQpitHFYAf8yMdNBXqytbJs=,tag:WNhlbKmSeZEqZ9ZgiB/BYg==,type:str]
+apiVersion: v1
+kind: Secret
 metadata:
-    name: ENC[AES256_GCM,data:fvJMsgy+wPZqMCdxm9hoV3n/+Q==,iv:I3rVtHIJBOME+bxhPws58Zjhj5i+KT5UtB9o7Vus5EU=,tag:6h4FnUu7PGxlQPIQxPYCRg==,type:str]
-    namespace: ENC[AES256_GCM,data:CDriLoLovROW,iv:rHXcN1xm5+t2D/Tq/2sx9lQFF8anD5jH24ZntPuBA8U=,tag:XstJAz6S8IM1c/pp9Cg0Ww==,type:str]
-type: ENC[AES256_GCM,data:JdTwBbag,iv:9Ys15Ketl0ghNK0u0N8IOpUt7+KoloutiG5M9zHPXxw=,tag:teau/udf41Ty34A5wLAm6Q==,type:str]
+    name: paperless-ai-config
+    namespace: paperless
+type: Opaque
 stringData:
-    PAPERLESS_API_TOKEN: ENC[AES256_GCM,data:TuQeDx8po3h4loTRABlItVYQJ7gFjnmIn3zQQGtUcoNFMKpkqLK/GQ==,iv:TDg0stpca5pDtatqu8DFU7R0Bm/S/BI9ZoiG4K8mCT4=,tag:BfjX25V5gL7AeIsscClRAg==,type:str]
+    PAPERLESS_API_TOKEN: ENC[AES256_GCM,data:wlBC85ep6zioWLhfhNczkKfTMR8tmciN+4r3of8GpQoJmKyE2r7pOg==,iv:Rem/UJl5wUNi8G+uEV7f2eCLabaY26sZ7+AsKYiOZ4I=,tag:bGS1fu13Mwsrr+5NUEzzLw==,type:str]
+    LLM_AUTH_CLIENT_SECRET: ENC[AES256_GCM,data:co7FfmRXKgrz9fNgR10KtlHL/iG4F5WKJgjcKem1H5hF5FviVi4+CQNekA==,iv:ADtBHiI6BtrkuH1iIfKV3I5odNLMQe5y/9GGTJrPNN0=,tag:j6wX6zO5VhKoLzdr7BQZCw==,type:str]
 sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBKVDN3aFVqVmFXY1VQVXZP
-            OUsrNHdNdlRvRFgvTDQrNE5uL2xaazVENTBjCkNPbGR5Vk16RXNDOW15OGNTRmFR
-            U0JOeTllaWU1dzNVY3lBbEVyVG5tOEkKLS0tIEZvajlvcUtJdFNNUkkzV3FKOFRj
-            UUE2TDBzT0xVc2E1NlUvQXAyZytMZEUKBv+ChaoQCstA742L3Bq5mBJlW/UC4Pyw
-            ZvFAyYbs1NaEqhjtHq+4T62jTWcH/St/vKgUuFQ9LCUQhYd8DUzAow==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJWDZwTE1haUY5ZkgybnBx
+            WEFVSzQvNjlGaDlvaHhuSTVCY2dYb0s1NW4wCmhkM0N6YlNIRTYrVkdxaHJaVHVG
+            bUEzTVV3WFQ0OWwrdEZnanJJa09Nb3MKLS0tIGduNEFtT2hCUDlkZWpWZmliZy83
+            cUoxcXp1NFF3SFpBVVdSZE5GY1VIWmsKH+cMqasOVxgCnGedaM2IAsgwOzEsOMct
+            0XjmInpppWNe+t7leEb6MqEY2cPQHL+l2L5jkZzAOfImwaIwMQnghw==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-    lastmodified: "2026-09-12T21:04:26Z"
-    mac: ENC[AES256_GCM,data:0ks96xQzOa8ygNDDYfKV8EJ8dWLBaC0PCnLG73NinMByF/KoWkCdwMDPC34W9xxVoTD2NiF1i/3pgCG4QFezTE7tPHPPKdYcQfwda9fkooiXW4Nh2M/sgbq/xgsy9N3qpHD/O5iILgpehb9y0DuErOyxcn2AIYizynU7m8e63pc=,iv:fvPWBsfE6YHskKzdlxJidp14dUgRR0XdMkEu6IxMMSo=,tag:5FiuIrFOg/GXvlQVy7drJQ==,type:str]
-    unencrypted_suffix: _unencrypted
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-09-14T14:19:39Z"
+    mac: ENC[AES256_GCM,data:jDdmiFg6uB1za7sAjO1CnGHdRPyUnmWCMJxqHrE3BO82pNbtm8yLOf+W6CfFKAjfZYqEE2mdKhABm7zeJgJlub3eXJbAirAFrp5jrbfHw0qsFo85Gj/BsrSDB401Aky6PxvRomz66FyX5zDDXIGAMEMlyNEadMplTfrZQQ9hQWM=,iv:UTSF72ofUyWs1LXGKQwBP60hK64UxhqTFM8QTVozGoo=,tag:OKivMDAqwWgrX+kNjvQrPg==,type:str]
     version: 3.13.2

k8s/infra/cluster-maintenance/stale-job-cleanup.yaml

@@ -1,12 +1,12 @@
 # Cluster-wide cleanup of stale failed/completed Jobs and Pods.
-# Runs daily at 04:00 UTC. Deletes:
-#   - Failed Jobs older than 24h (any namespace)
-#   - Completed Jobs older than 72h with no owning CronJob
-#   - Orphan pods in Error/Failed/Evicted state older than 1h
+# Runs every 2 minutes. Deletes:
+#   - Failed Jobs older than 2m (any namespace)
+#   - Completed standalone Jobs older than 2m with no owning CronJob
+#   - Orphan pods in Error/Failed/Evicted/Completed state older than 2m
 #
 # CronJob-owned Jobs are managed by failedJobsHistoryLimit/successfulJobsHistoryLimit,
-# but standalone Jobs (helm hooks, one-off runs, longhorn maintenance) have no TTL
-# and linger forever.
+# but standalone Jobs (helm hooks, one-off runs, CI TaskRuns) have no TTL
+# and linger forever. Aggressive schedule keeps the cluster clean.
 
 apiVersion: v1
 kind: ServiceAccount
@@ -47,7 +47,7 @@ metadata:
   labels:
     app: stale-job-cleanup
 spec:
-  schedule: "0 4 * * *"
+  schedule: "*/2 * * * *"
   concurrencyPolicy: Forbid
   successfulJobsHistoryLimit: 3
   failedJobsHistoryLimit: 3
@@ -74,7 +74,9 @@ spec:
                   set -e
                   NOW=$(date +%s)
 
-                  echo "=== Cleaning failed Jobs older than 24h ==="
+                  TTL=120  # 2 minutes in seconds
+
+                  echo "=== Cleaning failed Jobs older than 2m ==="
                   kubectl get jobs --all-namespaces -o json | \
                     jq -r '.items[] |
                       select(.status.conditions[]?.type == "Failed") |
@@ -82,15 +84,15 @@ spec:
                       "\(.metadata.namespace) \(.metadata.name) \(.status.startTime // .status.completionTime // .metadata.creationTimestamp)"' | \
                   while read -r NS NAME TS; do
                     JOB_EPOCH=$(date -d "$TS" +%s 2>/dev/null || echo 0)
-                    AGE_H=$(( (NOW - JOB_EPOCH) / 3600 ))
-                    if [ "$AGE_H" -ge 24 ]; then
-                      echo "[delete] $NS/$NAME (failed ${AGE_H}h ago)"
+                    AGE=$(( NOW - JOB_EPOCH ))
+                    if [ "$AGE" -ge "$TTL" ]; then
+                      echo "[delete] $NS/$NAME (failed ${AGE}s ago)"
                       kubectl delete job "$NAME" -n "$NS" --cascade=foreground 2>/dev/null || true
                     fi
                   done
 
                   echo ""
-                  echo "=== Cleaning completed standalone Jobs older than 72h ==="
+                  echo "=== Cleaning completed standalone Jobs older than 2m ==="
                   kubectl get jobs --all-namespaces -o json | \
                     jq -r '.items[] |
                       select(.status.succeeded >= 1) |
@@ -98,20 +100,20 @@ spec:
                       "\(.metadata.namespace) \(.metadata.name) \(.status.completionTime // .metadata.creationTimestamp)"' | \
                   while read -r NS NAME TS; do
                     JOB_EPOCH=$(date -d "$TS" +%s 2>/dev/null || echo 0)
-                    AGE_H=$(( (NOW - JOB_EPOCH) / 3600 ))
-                    if [ "$AGE_H" -ge 72 ]; then
-                      echo "[delete] $NS/$NAME (completed ${AGE_H}h ago, no owner)"
+                    AGE=$(( NOW - JOB_EPOCH ))
+                    if [ "$AGE" -ge "$TTL" ]; then
+                      echo "[delete] $NS/$NAME (completed ${AGE}s ago, no owner)"
                       kubectl delete job "$NAME" -n "$NS" --cascade=foreground 2>/dev/null || true
                     fi
                   done
 
                   echo ""
-                  echo "=== Cleaning orphan Error/Failed/Evicted pods older than 1h ==="
-                  # Evicted pods show as Failed with reason Evicted
+                  echo "=== Cleaning orphan Error/Failed/Evicted/Completed pods older than 2m ==="
                   kubectl get pods --all-namespaces -o json | \
                     jq -r '.items[] |
                       select(
                         .status.phase == "Failed" or
+                        .status.phase == "Succeeded" or
                         (.status.reason // "") == "Evicted" or
                         (.status.containerStatuses // [] | any(.state.terminated.reason == "Error"))
                       ) |
@@ -119,9 +121,9 @@ spec:
                       "\(.metadata.namespace) \(.metadata.name) \(.metadata.creationTimestamp)"' | \
                   while read -r NS NAME TS; do
                     POD_EPOCH=$(date -d "$TS" +%s 2>/dev/null || echo 0)
-                    AGE_H=$(( (NOW - POD_EPOCH) / 3600 ))
-                    if [ "$AGE_H" -ge 1 ]; then
-                      echo "[delete] $NS/$NAME (error/evicted ${AGE_H}h ago)"
+                    AGE=$(( NOW - POD_EPOCH ))
+                    if [ "$AGE" -ge "$TTL" ]; then
+                      echo "[delete] $NS/$NAME (stale ${AGE}s ago)"
                       kubectl delete pod "$NAME" -n "$NS" --force 2>/dev/null || true
                     fi
                   done

k8s/infra/forgejo-runner/templates/cilium-apiserver-egress.yaml

@@ -0,0 +1,25 @@
+# CiliumNetworkPolicy for kube-apiserver access.
+#
+# Standard K8s NetworkPolicy ipBlock rules don't work for the API server
+# under Cilium — the except clause on 192.168.1.0/24 blocks the post-DNAT
+# destination even when a separate rule re-allows a /32 or subnet.
+#
+# Cilium's native `kube-apiserver` entity resolves this correctly: it
+# tracks the API server endpoints regardless of ClusterIP vs node-IP
+# routing, so the policy stays valid across node changes and NAT paths.
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: {{ .Release.Name }}-apiserver
+  namespace: {{ .Release.Namespace }}
+spec:
+  endpointSelector:
+    matchLabels:
+      app: {{ .Release.Name }}
+  egress:
+  - toEntities:
+    - kube-apiserver
+    toPorts:
+    - ports:
+      - port: "6443"
+        protocol: TCP

k8s/infra/logging/grafana-values.yaml

@@ -73,7 +73,7 @@ grafana.ini:
   auth.generic_oauth:
     enabled: true
     name: Authentik
-    allow_sign_up: true
+    allow_sign_up: true  # Allow sync to create/update users from OAuth claims
     client_id: grafana
     scopes: openid email profile groups
     auth_url: https://authentik.riotpiao.com/application/o/authorize/
@@ -84,13 +84,13 @@ grafana.ini:
     # Authentik doesn't serve — request 404s with "Error getting email address"
     # and the whole OAuth login fails.
     email_attribute_path: email
-    login_attribute_path: preferred_username
+    login_attribute_path: preferred_username  # Use preferred_username — OpenID standard claim, always present
     name_attribute_path: name
     role_attribute_path: "preferred_username == 'akadmin' && 'GrafanaAdmin' || contains(groups[*], 'homelab-admins') && 'Admin' || 'Viewer'"
     allow_assign_grafana_admin: true
     use_pkce: false
     use_refresh_token: false
-    skip_org_role_sync: false
+    skip_org_role_sync: false  # Sync org roles from OAuth groups
     tls_skip_verify_insecure: true   # Authentik uses self-signed cert; verify in prod
 
 # GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET is injected from the grafana-oidc K8s

k8s/infra/minio/minio-tenant.yaml

@@ -112,10 +112,16 @@ spec:
           name: minio-oidc
           key: MINIO_IDENTITY_OPENID_CLIENT_SECRET
     - name: MINIO_IDENTITY_OPENID_CLAIM_NAME
-      value: "policy"
+      value: "groups"
+    - name: MINIO_IDENTITY_OPENID_CLAIM_PREFIX
+      value: ""
     - name: MINIO_IDENTITY_OPENID_REDIRECT_URI
       value: "https://minio.riotpiao.com/oauth_callback"
     - name: MINIO_IDENTITY_OPENID_DISPLAY_NAME
       value: "Authentik"
     - name: MINIO_IDENTITY_OPENID_SCOPES
-      value: "openid,profile,email,minio"
+      value: "openid,profile,email,groups"
+    - name: MINIO_BROWSER_LOGIN_ANIMATION
+      value: "off"
+    - name: MINIO_BROWSER_REDIRECT_URL
+      value: "https://minio.riotpiao.com"

k8s/infra/monitoring/prometheus-values.yaml

@@ -54,8 +54,8 @@ alertmanager:
 # ── Prometheus ────────────────────────────────────────────────────────────────
 prometheus:
   prometheusSpec:
-    retention: 15d
-    retentionSize: "18GB"
+    retention: 30d
+    retentionSize: "95GB"
 
     # scrapeTimeout MUST be <= scrapeInterval or the operator refuses to generate
     # the Prometheus config ("scrapeTimeout greater than scrapeInterval") and no
@@ -64,10 +64,9 @@ prometheus:
     scrapeTimeout: 60s
     evaluationInterval: 30s
 
-    # Pin to az-a (talos-cp-1) — sole Longhorn node; else the RWO PVC can't
-    # attach on cp-2/cp-3 (CSINode lacks driver.longhorn.io).
+    # Pin to worker-1 for more storage capacity
     nodeSelector:
-      topology.kubernetes.io/zone: az-a
+      kubernetes.io/hostname: worker-1
 
     # Persistent storage — metrics survive node reboots and pod restarts.
     # Uses the default `longhorn` StorageClass; nodeSelector above already pins
@@ -79,7 +78,7 @@ prometheus:
           accessModes: ["ReadWriteOnce"]
           resources:
             requests:
-              storage: 20Gi
+              storage: 100Gi
 
     resources:
       requests:

scripts/iam/provision-rbac.py

@@ -145,6 +145,7 @@ SERVICE_ACCOUNTS: Dict[str, Dict[str, Any]] = {
 SCOPE_MAPPINGS: Dict[str, Dict[str, str]] = {
     "roles": {"expression": 'return user.attributes.get("roles", [])'},
     "permissions": {"expression": 'return ["*"] if any(user.groups.filter(is_superuser=True)) else list(user.groups.values_list("name", flat=True))'},
+    "groups": {"expression": 'return {"groups": list(user.groups.values_list("name", flat=True))}'},
     "minio_buckets": {"expression": 'return user.attributes.get("minio_buckets", [])'},
     "paperless_doctypes": {"expression": 'return user.attributes.get("paperless_doctypes", [])'},
     "memory_projects": {"expression": 'return user.attributes.get("memory_projects", [])'},
@@ -246,6 +247,25 @@ for scope_name, scope_spec in SCOPE_MAPPINGS.items():
         else:
             print(f"  {scope_name}: FAILED {status} {res}")
 
+# Fix built-in 'openid' scope to include preferred_username (needed by Grafana, Forgejo, etc.)
+# Note: sub MUST be a string, not int, for JSON compatibility with Go struct unmarshaling
+if "openid" in existing_scopes:
+    openid_scope = existing_scopes["openid"]
+    openid_pk = openid_scope["pk"]
+    openid_expression = 'return {"sub": str(user.pk), "preferred_username": user.username}'
+    if openid_expression not in openid_scope.get("expression", ""):
+        status, res = api("PUT", f"/api/v3/propertymappings/provider/scope/{openid_pk}/", {
+            "name": openid_scope["name"],
+            "scope_name": "openid",
+            "expression": openid_expression,
+        })
+        if status in (200, 201):
+            print(f"  openid: updated (sub as string + preferred_username)")
+        else:
+            print(f"  openid: UPDATE FAILED {status} {res}")
+    else:
+        print(f"  openid: already correct (sub as string)")
+
 # ===========================================================================
 # Phase 4: Get flow UUIDs (needed for providers)
 # ===========================================================================

terraform/files/coredns/Corefile

@@ -38,6 +38,8 @@
     rewrite name api.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name comfy.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name comfyui.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
+    rewrite name gotify.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
+    rewrite name igotify.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
 
     kubernetes cluster.local in-addr.arpa ip6.arpa {