fix(iam): stop rotating client secrets on every apply, repair Grafana OIDC

Grafana sign-in failed with "Failed to get token from provider". The deployed
client secret no longer matched, because _ensure_oidc_apps called
_generate_client_secret for every app on every run, and ZITADEL stores exactly one
client secret per app: each call replaced the previous value and invalidated every
deployed copy.

Two changes:
1. Generate a secret only when the app is created. For an app that already exists,
   reuse the value from state.json, because the API cannot read a secret back.
2. Re-encrypt grafana-oidc-secrets.enc.yaml with the live secret, so Grafana's
   token exchange succeeds again.

Verified with the introspection endpoint:
  old deployed secret -> {"error":"unauthorized_client"}
  new secret          -> {"active":false}   (credentials accepted)

.gitignore

@@ -52,6 +52,10 @@ terraform/*.tfstate.*
 terraform/zitadel/*.tfstate
 terraform/zitadel/*.tfstate.*
 terraform/zitadel/*.tfvars
+terraform/edge/*.tfstate
+terraform/edge/*.tfstate.*
+terraform/edge/*.tfvars
+terraform/edge/terraform.tfvars.local
 terraform.tfvars.local
 skills-lock.json
 secrets-plaintext.yaml
@@ -81,3 +85,7 @@ scripts/iam/*.py
 # Runtime credential export from the old Authentik provisioning run. Holds live
 # M2M tokens; never commit it.
 /authentik-m2m-tokens.env
+
+# Never commit backup copies of plaintext tfvars (they carry cluster PKI)
+terraform/*.bak
+terraform/edge/.secrets/

.pi/loops/loops-01a16cb7-780d-72af-bac3-487935898ff3.json

@@ -0,0 +1,22 @@
+{
+  "nextId": 2,
+  "loops": [
+    {
+      "id": "1",
+      "prompt": "Check Longhorn and CNPG recovery progress in the homelab cluster and report terse. Run: kubectl -n longhorn-system get volumes.longhorn.io -o json (count by state/robustness), kubectl -n longhorn-system get replicas.longhorn.io -o json (count running/stopped/failed), kubectl get clusters.postgresql.cnpg.io -A (ready instances per cluster), kubectl -n cicd get pods,pvc | grep forgejo-db. Report: volumes healthy vs degraded, replicas running vs stopped, and each CNPG cluster ready count. If every volume is attached/healthy and every CNPG cluster shows 3/3 ready, say RECOVERED, list any leftover anomalies, and stop this loop with LoopDelete. Otherwise name what is still rebuilding and keep going.",
+      "trigger": {
+        "type": "cron",
+        "schedule": "*/5 * * * *"
+      },
+      "status": "expired",
+      "recurring": true,
+      "createdAt": 1792898370946,
+      "updatedAt": 1792901371403,
+      "expiresAt": 1793503170946,
+      "source": "tool",
+      "readOnly": true,
+      "maxFires": 6,
+      "fireCount": 6
+    }
+  ]
+}

k8s/apps/cloudflared/configmap.yaml

@@ -0,0 +1,56 @@
+# cloudflared ingress configuration.
+#
+# This list is the tunnel's routing table: for each incoming hostname the
+# connector dials the matching origin. The final rule is a catch-all, so a
+# hostname absent from this list gets 404 from the connector — DNS alone does
+# not route a request into a service.
+#
+# Management model: this file makes the tunnel LOCALLY managed. cloudflared is
+# given a credentials file instead of a token, so Cloudflare stops pushing the
+# remotely-managed ingess list and this ConfigMap wins. Revert the Deployment to
+# `run --token` to return to the dashboard-managed list.
+#
+# Origin services self-reference the public hostname. That resolves because
+# CoreDNS rewrites each of these names to ingress-nginx
+# (terraform/files/coredns/Corefile), so the connector reaches the in-cluster
+# ingress instead of looping back out through Cloudflare.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: cloudflared-config
+  namespace: cloudflared
+data:
+  config.yml: |
+    tunnel: 32d0bf93-e1bd-45b8-93a9-71ff9f83de80
+    credentials-file: /etc/cloudflared/creds/credentials.json
+
+    # WARP-to-Tunnel routing. The remotely-managed config had this enabled;
+    # dropping the key would break WARP access to private addresses. cloudflared
+    # 2026.x has no `enabled` field — the key's presence is what enables it, and
+    # `enabled: true` here makes the binary warn about an unused key.
+    warp-routing: {}
+
+    ingress:
+      - hostname: paperless.riotpiao.com
+        service: https://paperless.riotpiao.com
+      - hostname: img.riotpiao.com
+        service: https://img.riotpiao.com
+      - hostname: riotpiao.com
+        service: https://riotpiao.com
+      - hostname: grafana.riotpiao.com
+        service: https://grafana.riotpiao.com
+      - hostname: gotify.riotpiao.com
+        service: https://gotify.riotpiao.com
+      - hostname: igotify.riotpiao.com
+        service: https://igotify.riotpiao.com
+      - hostname: poimen.riotpiao.com
+        service: https://poimen.riotpiao.com
+      - hostname: comfyui.riotpiao.com
+        service: https://comfyui.riotpiao.com
+      - hostname: forgejo.riotpiao.com
+        service: https://forgejo.riotpiao.com
+      # ZITADEL. Without this rule the connector answers 404 for the hostname
+      # even though the DNS CNAME points at the tunnel.
+      - hostname: zitadel.riotpiao.com
+        service: https://zitadel.riotpiao.com
+      - service: http_status:404

k8s/apps/cloudflared/deployment.yaml

@@ -13,21 +13,63 @@ spec:
       labels:
         app: cloudflared
     spec:
+      # Ingress-nginx forces HTTPS (force-ssl-redirect), so cloudflared must
+      # dial https://<hostname> and trust homelab-ca or the TLS handshake fails
+      # with "certificate signed by unknown authority". Same pattern as
+      # iam values: merge the system bundle with homelab-ca.crt.
+      initContainers:
+        - name: merge-ca-certs
+          image: debian:bookworm
+          imagePullPolicy: IfNotPresent
+          securityContext:
+            runAsUser: 0
+          command:
+            - sh
+            - -c
+            - (cat /etc/ssl/certs/ca-certificates.crt 2>/dev/null; cat /homelab-ca/ca.crt) > /merged/ca-bundle.crt
+          volumeMounts:
+            - name: homelab-ca
+              mountPath: /homelab-ca
+              readOnly: true
+            - name: merged-ca
+              mountPath: /merged
+      volumes:
+        - name: config
+          configMap:
+            name: cloudflared-config
+        - name: credentials
+          secret:
+            secretName: cloudflared-credentials
+        - name: homelab-ca
+          configMap:
+            name: homelab-ca
+        - name: merged-ca
+          emptyDir: {}
       containers:
         - name: cloudflared
           image: cloudflare/cloudflared:latest
           args:
             - tunnel
             - --no-autoupdate
+            - --protocol
+            - http2
+            - --config
+            - /etc/cloudflared/config.yml
             - run
-            - --token
-            - $(TUNNEL_TOKEN)
           env:
-            - name: TUNNEL_TOKEN
-              valueFrom:
-                secretKeyRef:
-                  name: cloudflared-token
-                  key: token
+            - name: SSL_CERT_FILE
+              value: /merged/ca-bundle.crt
+          volumeMounts:
+            - name: config
+              mountPath: /etc/cloudflared/config.yml
+              subPath: config.yml
+              readOnly: true
+            - name: credentials
+              mountPath: /etc/cloudflared/creds
+              readOnly: true
+            - name: merged-ca
+              mountPath: /merged
+              readOnly: true
           resources:
             requests:
               cpu: 10m

k8s/apps/cloudflared/kustomization.yaml

@@ -3,3 +3,4 @@ kind: Kustomization
 namespace: cloudflared
 resources:
   - deployment.yaml
+  - configmap.yaml

k8s/apps/gotify/bridge/configmap.yaml

@@ -0,0 +1,110 @@
+# The bridge script is mounted as a ConfigMap so no image build is needed.
+# Regenerate this block from grafana_gotify_bridge.py when the script changes.
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: grafana-gotify-bridge
+  namespace: notifications
+data:
+  grafana_gotify_bridge.py: |
+    #!/usr/bin/env python3
+    """Translate a Grafana alert webhook into a Gotify message.
+    
+    Grafana sends its own payload shape:
+      {"receiver": "...", "status": "firing", "alerts": [{"labels": {...}, "annotations": {...}}]}
+    
+    Gotify requires:
+      {"title": "...", "message": "...", "priority": 0..10}
+    
+    Gotify answers 400 "Field 'message' is required" to a Grafana payload, so a
+    conversion step is mandatory. This service is that step and nothing else.
+    Standard library only, so it needs no image build and no dependencies.
+    """
+    import json
+    import os
+    import urllib.request
+    from http.server import BaseHTTPRequestHandler, HTTPServer
+    
+    GOTIFY_BASE = os.environ.get("GOTIFY_URL", "http://gotify.notifications.svc.cluster.local")
+    GOTIFY_TOKEN = os.environ["GOTIFY_TOKEN"]
+    LISTEN_PORT = int(os.environ.get("PORT", "8080"))
+    
+    # Firing is louder than resolved. Gotify priority runs 0 to 10.
+    PRIORITY = {"firing": 8, "resolved": 3}
+    
+    
+    def to_gotify(payload):
+        alerts = payload.get("alerts") or []
+        status = (payload.get("status") or "firing").lower()
+        priority = PRIORITY.get(status, 5)
+    
+        if not alerts:
+            title = payload.get("title") or "Grafana notification"
+            return title, json.dumps(payload)[:2000], priority
+    
+        first = alerts[0]
+        labels = first.get("labels") or {}
+        annotations = first.get("annotations") or {}
+        name = labels.get("alertname", "Grafana alert")
+    
+        title = "[%s] %s" % (status.upper(), name)
+        lines = []
+        summary = annotations.get("summary") or annotations.get("description")
+        if summary:
+            lines.append(summary)
+        for key in ("severity", "namespace", "pod", "instance", "job"):
+            if labels.get(key):
+                lines.append("%s: %s" % (key, labels[key]))
+        if len(alerts) > 1:
+            lines.append("+%d more alert(s) in this notification" % (len(alerts) - 1))
+    
+        return title, "\n".join(lines) or name, priority
+    
+    
+    class Handler(BaseHTTPRequestHandler):
+        def _reply(self, code, body=b"ok"):
+            self.send_response(code)
+            self.send_header("Content-Type", "text/plain")
+            self.end_headers()
+            self.wfile.write(body)
+    
+        def do_GET(self):
+            self._reply(200)
+    
+        def do_POST(self):
+            length = int(self.headers.get("Content-Length") or 0)
+            raw = self.rfile.read(length) if length else b"{}"
+            try:
+                payload = json.loads(raw.decode("utf-8", "replace") or "{}")
+            except ValueError:
+                payload = {}
+    
+            title, message, priority = to_gotify(payload)
+            body = json.dumps({
+                "title": title[:200],
+                "message": message[:4000],
+                "priority": priority,
+            }).encode()
+    
+            request = urllib.request.Request(
+                GOTIFY_BASE.rstrip("/") + "/message",
+                data=body,
+                headers={"Content-Type": "application/json", "X-Gotify-Key": GOTIFY_TOKEN},
+            )
+            try:
+                urllib.request.urlopen(request, timeout=10).read()
+            except Exception as exc:  # noqa: BLE001 - log and report to Grafana
+                print("forward to gotify failed: %s" % exc, flush=True)
+                self._reply(502, b"gotify rejected the message")
+                return
+    
+            print("forwarded: %s" % title, flush=True)
+            self._reply(200)
+    
+        def log_message(self, fmt, *args):  # keep the log to one line per delivery
+            print("%s - %s" % (self.address_string(), fmt % args), flush=True)
+    
+    
+    if __name__ == "__main__":
+        print("grafana-gotify bridge listening on %d" % LISTEN_PORT, flush=True)
+        HTTPServer(("0.0.0.0", LISTEN_PORT), Handler).serve_forever()

k8s/apps/gotify/bridge/deployment.yaml

@@ -0,0 +1,80 @@
+# Grafana sends its own JSON and Gotify rejects it, so this Deployment is the
+# translation step between them. Grafana posts to the Service, the bridge posts
+# to /message with the app token from a SOPS secret.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: grafana-gotify-bridge
+  namespace: notifications
+  labels:
+    app: grafana-gotify-bridge
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: grafana-gotify-bridge
+  template:
+    metadata:
+      labels:
+        app: grafana-gotify-bridge
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: bridge
+          image: python:3.12-alpine
+          command: ["python3", "/app/grafana_gotify_bridge.py"]
+          env:
+            - name: GOTIFY_URL
+              value: "http://gotify.notifications.svc.cluster.local"
+            - name: PORT
+              value: "8080"
+            - name: GOTIFY_TOKEN
+              valueFrom:
+                secretKeyRef: {name: grafana-gotify-bridge, key: app-token}
+          ports:
+            - name: http
+              containerPort: 8080
+          readinessProbe:
+            httpGet: {path: /, port: http}
+            initialDelaySeconds: 3
+            periodSeconds: 10
+          livenessProbe:
+            httpGet: {path: /, port: http}
+            initialDelaySeconds: 10
+            periodSeconds: 20
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          volumeMounts:
+            - name: script
+              mountPath: /app
+              readOnly: true
+          resources:
+            requests: {cpu: 10m, memory: 32Mi}
+            limits: {cpu: 200m, memory: 96Mi}
+      volumes:
+        - name: script
+          configMap:
+            name: grafana-gotify-bridge
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: grafana-gotify-bridge
+  namespace: notifications
+  labels:
+    app: grafana-gotify-bridge
+spec:
+  type: ClusterIP
+  selector:
+    app: grafana-gotify-bridge
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http

k8s/apps/gotify/bridge/grafana_gotify_bridge.py

@@ -0,0 +1,101 @@
+#!/usr/bin/env python3
+"""Translate a Grafana alert webhook into a Gotify message.
+
+Grafana sends its own payload shape:
+  {"receiver": "...", "status": "firing", "alerts": [{"labels": {...}, "annotations": {...}}]}
+
+Gotify requires:
+  {"title": "...", "message": "...", "priority": 0..10}
+
+Gotify answers 400 "Field 'message' is required" to a Grafana payload, so a
+conversion step is mandatory. This service is that step and nothing else.
+Standard library only, so it needs no image build and no dependencies.
+"""
+import json
+import os
+import urllib.request
+from http.server import BaseHTTPRequestHandler, HTTPServer
+
+GOTIFY_BASE = os.environ.get("GOTIFY_URL", "http://gotify.notifications.svc.cluster.local")
+GOTIFY_TOKEN = os.environ["GOTIFY_TOKEN"]
+LISTEN_PORT = int(os.environ.get("PORT", "8080"))
+
+# Firing is louder than resolved. Gotify priority runs 0 to 10.
+PRIORITY = {"firing": 8, "resolved": 3}
+
+
+def to_gotify(payload):
+    alerts = payload.get("alerts") or []
+    status = (payload.get("status") or "firing").lower()
+    priority = PRIORITY.get(status, 5)
+
+    if not alerts:
+        title = payload.get("title") or "Grafana notification"
+        return title, json.dumps(payload)[:2000], priority
+
+    first = alerts[0]
+    labels = first.get("labels") or {}
+    annotations = first.get("annotations") or {}
+    name = labels.get("alertname", "Grafana alert")
+
+    title = "[%s] %s" % (status.upper(), name)
+    lines = []
+    summary = annotations.get("summary") or annotations.get("description")
+    if summary:
+        lines.append(summary)
+    for key in ("severity", "namespace", "pod", "instance", "job"):
+        if labels.get(key):
+            lines.append("%s: %s" % (key, labels[key]))
+    if len(alerts) > 1:
+        lines.append("+%d more alert(s) in this notification" % (len(alerts) - 1))
+
+    return title, "\n".join(lines) or name, priority
+
+
+class Handler(BaseHTTPRequestHandler):
+    def _reply(self, code, body=b"ok"):
+        self.send_response(code)
+        self.send_header("Content-Type", "text/plain")
+        self.end_headers()
+        self.wfile.write(body)
+
+    def do_GET(self):
+        self._reply(200)
+
+    def do_POST(self):
+        length = int(self.headers.get("Content-Length") or 0)
+        raw = self.rfile.read(length) if length else b"{}"
+        try:
+            payload = json.loads(raw.decode("utf-8", "replace") or "{}")
+        except ValueError:
+            payload = {}
+
+        title, message, priority = to_gotify(payload)
+        body = json.dumps({
+            "title": title[:200],
+            "message": message[:4000],
+            "priority": priority,
+        }).encode()
+
+        request = urllib.request.Request(
+            GOTIFY_BASE.rstrip("/") + "/message",
+            data=body,
+            headers={"Content-Type": "application/json", "X-Gotify-Key": GOTIFY_TOKEN},
+        )
+        try:
+            urllib.request.urlopen(request, timeout=10).read()
+        except Exception as exc:  # noqa: BLE001 - log and report to Grafana
+            print("forward to gotify failed: %s" % exc, flush=True)
+            self._reply(502, b"gotify rejected the message")
+            return
+
+        print("forwarded: %s" % title, flush=True)
+        self._reply(200)
+
+    def log_message(self, fmt, *args):  # keep the log to one line per delivery
+        print("%s - %s" % (self.address_string(), fmt % args), flush=True)
+
+
+if __name__ == "__main__":
+    print("grafana-gotify bridge listening on %d" % LISTEN_PORT, flush=True)
+    HTTPServer(("0.0.0.0", LISTEN_PORT), Handler).serve_forever()

k8s/apps/gotify/igotify-deployment.yaml

@@ -28,9 +28,17 @@ spec:
               value: "true"
             - name: ENABLE_SCALAR_UI
               value: "true"
-            # GOTIFY_URLS / GOTIFY_CLIENT_TOKENS / SECNTFY_TOKENS intentionally
-            # left unset — not required when Gotify is reachable via public domain
-            # (gotify.riotpiao.com). iGotify iOS app registers itself at runtime.
+            # The bridge authenticates with a Gotify client token, not with
+            # ZITADEL. Gotify has no way to accept a forwarded identity, so the
+            # token is the only credential that works server-side. The token
+            # belongs to user `rock`, never expires, and is revoked by deleting
+            # the client row in Gotify.
+            - name: GOTIFY_URLS
+              value: "https://gotify.riotpiao.com"
+            - name: GOTIFY_CLIENT_TOKENS
+              valueFrom:
+                secretKeyRef: {name: igotify-client-token, key: client-token}
+            # SECNTFY_TOKENS intentionally left unset: secntfy is not deployed.
           volumeMounts:
             - name: data
               mountPath: /app/data

k8s/apps/gotify/kustomization.yaml

@@ -6,6 +6,8 @@ resources:
   - deployment.yaml
   - service.yaml
   - ingress.yaml
+  - bridge/configmap.yaml
+  - bridge/deployment.yaml
   - igotify-pvc.yaml
   - igotify-deployment.yaml
   - igotify-service.yaml

k8s/apps/homarr/homarr-values.yaml

@@ -1,78 +0,0 @@
-# Homarr landing page with Authentik SSO
-
-# Probe tuning (chart DOES expose these — the old PostSync patch-job was
-# unnecessary and fragile: it only patched one Deployment revision, so any later
-# rollout reverted to the chart's aggressive defaults). Homarr's first-boot icon
-# updater blocks the event loop for ~50s ("icons updater took 49553ms"), during
-# which /api/health/live can't answer within the default 10s×3 window → kubelet
-# SIGTERMs the pod → CrashLoopBackOff (247 restarts, 503 at the ingress). Give
-# liveness a wide window so the icon import can finish without a kill.
-livenessProbe:
-  initialDelaySeconds: 60
-  periodSeconds: 30
-  timeoutSeconds: 5
-  failureThreshold: 10
-readinessProbe:
-  initialDelaySeconds: 30
-  periodSeconds: 15
-  timeoutSeconds: 5
-  failureThreshold: 6
-
-image:
-  repository: ghcr.io/homarr-labs/homarr
-  tag: "latest"
-  pullPolicy: Always
-
-replicaCount: 1
-
-# Configure SSO via environment variables
-# Chart supports these via top-level env dict (not array)
-env:
-  AUTH_PROVIDERS: "oidc,credentials"
-  AUTH_OIDC_ISSUER: "https://authentik.riotpiao.com/application/o/homarr/"
-  # AUTH_OIDC_URI (authorize endpoint) is REQUIRED in addition to ISSUER — homarr
-  # hides the "Sign in with Authentik" button entirely when it's absent (per the
-  # authentik Homarr integration + homarr SSO docs). This was the missing var.
-  AUTH_OIDC_URI: "https://authentik.riotpiao.com/application/o/authorize/"
-  AUTH_OIDC_CLIENT_NAME: "Authentik"
-  AUTH_OIDC_GROUPS_ATTRIBUTE: "groups"
-  AUTH_OIDC_SCOPE_OVERWRITE: "openid email profile groups"
-  AUTH_OIDC_AUTO_LOGIN: "false"
-  # Link the OIDC identity to an existing homarr account with the same email.
-  OAUTH_ALLOW_DANGEROUS_EMAIL_ACCOUNT_LINKING: "true"
-  # The analytics cron blocked the (single-threaded) Next.js event loop for ~16s
-  # per run ("callback took longer than expected"), compounding CPU pressure.
-  DISABLE_ANALYTICS: "true"
-  BASE_URL: "https://homarr.riotpiao.com"
-  NEXTAUTH_URL: "https://homarr.riotpiao.com"
-
-# Client credentials from homarr-oidc secret
-# Chart doesn't support envFrom, so we add via extraEnv
-extraEnv:
-  - name: AUTH_OIDC_CLIENT_ID
-    valueFrom:
-      secretKeyRef:
-        name: homarr-oidc
-        key: client-id
-  - name: AUTH_OIDC_CLIENT_SECRET
-    valueFrom:
-      secretKeyRef:
-        name: homarr-oidc
-        key: client-secret
-
-tolerations:
-  - key: node-role.kubernetes.io/control-plane
-    operator: Exists
-    effect: NoSchedule
-
-resources:
-  requests:
-    cpu: 250m
-    memory: 384Mi
-  limits:
-    # Next.js 16 + bundled redis + the icon-updater (28k icons) saturated the old
-    # 500m limit; CPU throttling made Next.js abort with exit 134 (SIGABRT) and
-    # self-restart in a loop, so nginx saw no upstream and returned 502. Give it
-    # real CPU headroom.
-    cpu: "2"
-    memory: 1Gi

k8s/apps/homarr/kustomization.yaml

@@ -1,7 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: dashboard
-# Probes are now tuned via homarr-values.yaml (chart-native); the old
-# fix-probes-job PostSync hook is removed. homarr-secrets/auth-oidc/db-encryption
-# Secrets are delivered by the sops-secrets (ksops) Application.
-resources: []

k8s/apps/llm-serving/ornith.yaml

@@ -1,107 +0,0 @@
-apiVersion: serving.kserve.io/v1beta1
-kind: InferenceService
-metadata:
-  annotations:
-    serving.kserve.io/deploymentMode: RawDeployment
-    # The konghq.com/{connect,read,write}-timeout annotations that used to live
-    # here went with Kong (retired 2026-08-19). They existed because Kong read
-    # its upstream timeouts off the Kubernetes Service, and its 60s default cut
-    # off the first request after any pod restart — a restart flushes VRAM and
-    # reloading ornith:35b takes longer than that. OLLAMA_KEEP_ALIVE=-1 hid the
-    # problem in steady state.
-    #
-    # The equivalent budget now belongs to the Go gateway's per-route timeout
-    # config in rock/homelab-frontend, not to an annotation on this object.
-  labels:
-    app.kubernetes.io/name: llm-ornith
-    app.kubernetes.io/part-of: llm-serving
-  name: ornith
-  namespace: llm-serving
-spec:
-  predictor:
-    containers:
-    - command:
-      - /bin/sh
-      - -c
-      - 'set -e
-
-        ollama serve &
-
-        SERVE_PID=$!
-
-        until ollama list >/dev/null 2>&1; do sleep 2; done
-
-        ollama pull ornith:35b
-
-        ollama run ornith:35b "ok" >/dev/null 2>&1 || true
-
-        wait $SERVE_PID
-
-        '
-      env:
-      - name: OLLAMA_HOST
-        value: 0.0.0.0:8080
-      - name: OLLAMA_MODELS
-        value: /mnt/models/ollama
-      - name: OLLAMA_CONTEXT_LENGTH
-        value: '65536'
-      - name: OLLAMA_KEEP_ALIVE
-        value: '-1'
-      - name: OLLAMA_NUM_PARALLEL
-        value: '1'
-      - name: OLLAMA_MAX_LOADED_MODELS
-        value: '1'
-      image: ollama/ollama:0.32.9@sha256:1685741456770df6e3cceb2a945a5f75e020f658d1701509668d6f4688f1dd3f
-      name: kserve-container
-      ports:
-      - containerPort: 8080
-        protocol: TCP
-      readinessProbe:
-        exec:
-          command:
-          - /bin/sh
-          - -c
-          - ollama ps 2>/dev/null | grep -q ornith
-        periodSeconds: 10
-      resources:
-        limits:
-          cpu: '16'
-          memory: 16Gi
-          nvidia.com/gpu: '1'
-        requests:
-          cpu: '8'
-          memory: 8Gi
-          nvidia.com/gpu: '1'
-      startupProbe:
-        exec:
-          command:
-          - /bin/sh
-          - -c
-          - ollama ps 2>/dev/null | grep -q ornith
-        failureThreshold: 120
-        periodSeconds: 15
-      volumeMounts:
-      - mountPath: /mnt/models
-        name: models
-    podMetadata:
-      annotations:
-        prometheus.io/scrape: "true"
-        prometheus.io/port: "8080"
-        prometheus.io/path: "/metrics"
-      labels:
-        app.kubernetes.io/name: llm-ornith
-        app.kubernetes.io/part-of: llm-serving
-    deploymentStrategy:
-      type: Recreate
-    # 1 replica -- ornith:35b only. qwen2.5:3b moved to CPU on cp-2.
-    # Frees 1 GPU for ComfyUI.
-    maxReplicas: 1
-    minReplicas: 1
-    nodeSelector:
-      kubernetes.io/hostname: worker-1
-    runtimeClassName: nvidia
-    volumes:
-    - name: models
-      persistentVolumeClaim:
-        claimName: llm-models
-

k8s/apps/llm-serving/reasoning.yaml

@@ -1,162 +0,0 @@
-apiVersion: serving.kserve.io/v1beta1
-kind: InferenceService
-metadata:
-  annotations:
-    serving.kserve.io/deploymentMode: RawDeployment
-  labels:
-    app.kubernetes.io/name: llm-reasoning
-    app.kubernetes.io/part-of: llm-serving
-  name: reasoning
-  namespace: llm-serving
-spec:
-  predictor:
-    containers:
-    - args:
-      # bnb-4bit retired: no int4 tensor cores on sm70/V100, dequant-then-
-      # matmul is two slow kernel launches instead of one fused int4 GEMM,
-      # decode crawled at 2.5-10 tok/s regardless of TP/PP. Switched to
-      # JunHowie/Qwen3-32B-GPTQ-Int4 -- same dense Qwen3-32B weights, same
-      # hermes/qwen3 parser stack (no narration-bug risk, same as before),
-      # only the quant format changes. Plain (non-Marlin) GPTQ kernel is
-      # confirmed Volta-compatible; Marlin needs sm80+ and vLLM would try
-      # to auto-upgrade to it, so --quantization is pinned explicitly to
-      # `gptq` to force the plain kernel. Verified checkpoint size: 19.34GB
-      # (summed from the real safetensors index, not bits-per-param math).
-      # max-model-len=131072 is Qwen3-32B's real ceiling (config.json YaRN:
-      # factor=4.0, original_max_position_embeddings=32768) -- 200k was
-      # asked for but exceeds this architecturally regardless of VRAM.
-      # KV cache math: 256KB/token total (64 layers, 8 KV heads, 128
-      # head_dim, fp16), PP=2 splits both weights and KV load ~evenly, so
-      # each GPU carries ~9.67GB weights + ~128KB/token KV. At
-      # gpu-memory-utilization=0.95 (30.4GB/GPU usable), that leaves
-      # ~20.7GB/GPU for KV cache. NOTE this is a projection, not a
-      # measurement: the live reading at 0.90 is num_gpu_blocks=9527 x
-      # block_size=16 = 152,432 tokens (vllm:cache_config_info). Re-read that
-      # metric after the rollout -- max_num_batched_tokens=8192 also raises
-      # activation memory out of the same budget, so the post-boot
-      # num_gpu_blocks is the authoritative number, and --max-num-seqs=5 is
-      # only valid if it still covers 2x65k + 3x8k. The old
-      # OffloadingConnector CPU-DRAM spillover (tuned for the previous
-      # model's much smaller 16384 context) is no longer needed and is
-      # dropped. Staying on PP=2 and vLLM 0.11.0 (no version bump needed,
-      # this checkpoint only requires vllm>=0.9.2) -- plain GPTQ has no
-      # TP>1 restriction unlike bnb, so tensor-parallel-size=2 is worth
-      # trying later, but not risking a parallelism-strategy change in the
-      # same rollout as the quant+context-length change.
-      # This GPTQ requant's own config.json ships max_position_embeddings=
-      # 40960 and rope_scaling=None -- confirmed directly (curl'd the raw
-      # config.json), the base Qwen3-32B repo's YaRN block did NOT carry
-      # over during quantization. Re-applying it explicitly here restores
-      # the same math the base model documents (32768 * 4.0 = 131072);
-      # without this, --max-model-len=131072 fails ModelConfig validation
-      # against the checkpoint's own (unscaled) 40960 ceiling.
-      - --model=JunHowie/Qwen3-32B-GPTQ-Int4
-      - --served-model-name=reasoning
-      - --quantization=gptq
-      - --dtype=float16
-      - --kv-cache-dtype=auto
-      - --rope-scaling={"rope_type":"yarn","factor":4.0,"original_max_position_embeddings":32768}
-      - --tensor-parallel-size=1
-      - --pipeline-parallel-size=2
-      - --max-model-len=131072
-      - --gpu-memory-utilization=0.95
-      - --max-num-seqs=5
-      # Prefill scheduling -- see the measured starvation this fixes.
-      # V1's scheduler has no prefill/decode phase: it walks self.running and
-      # hands out tokens from one shared budget (vllm/v1/core/sched/scheduler.py:
-      # "There's no decoding phase nor prefill phase in the scheduler"). The cap
-      # per request is applied BEFORE the budget clamp:
-      #     if 0 < long_prefill_token_threshold < num_new_tokens: take = threshold
-      #     take = min(take, token_budget)
-      # The loop is `while ... and token_budget > 0`. With the threshold at its
-      # default of 0 the cap is disabled, so one long prompt takes the ENTIRE
-      # budget, token_budget hits 0, the loop exits and every other request is
-      # skipped for that step -- measured as 262 tok/s contended prefill and
-      # 0.0-0.1 tok/s generation for everything else, Running: 2-4 reqs.
-      # Hence threshold must be strictly BELOW the budget or it never binds:
-      # at 8192/8192 a single request is served per step (still starved), while
-      # 8192/2048 serves four. Verified by replaying the loop.
-      - --max-num-batched-tokens=8192
-      - --long-prefill-token-threshold=2048
-      - --enable-chunked-prefill
-      - --enable-prefix-caching
-      #
-      # NOT set, deliberately: --max-num-partial-prefills and
-      # --max-long-partial-prefills. Those are V0-only knobs. vLLM 0.11.0 ships
-      # V1 only (vllm/core/ absent), and EngineArgs._is_v1_supported_oracle
-      # rejects any value other than the default for either one, calling
-      # _raise_or_fallback("Concurrent Partial Prefill") -> "Falling back to V0"
-      # -> AssertionError, because there is no V0 engine to fall back to.
-      # The Deployment uses strategy Recreate, so setting them is an outage.
-      # V1 does concurrent chunked prefill natively; it needs no flag, only the
-      # budget/threshold ratio above.
-      # qwen3 is vLLM's dedicated reasoning parser for this family's <think>
-      # blocks.
-      - --reasoning-parser=qwen3
-      # hermes is the documented tool-call parser for general (non-Coder)
-      # Qwen3 models -- native chat template support, not narrated text.
-      - --enable-auto-tool-choice
-      - --tool-call-parser=hermes
-      - --host=0.0.0.0
-      - --port=8080
-      env:
-      - name: VLLM_USE_FLASHINFER_SAMPLER
-        value: '0'
-      - name: VLLM_ATTENTION_BACKEND
-        value: TRITON_ATTN
-      - name: HF_HOME
-        value: /mnt/models
-      image: vllm/vllm-openai:v0.11.0@sha256:014a95f21c9edf6abe0aea6b07353f96baa4ec291c427bb1176dc7c93a85845c
-      name: kserve-container
-      ports:
-      - containerPort: 8080
-        protocol: TCP
-      readinessProbe:
-        httpGet:
-          path: /health
-          port: 8080
-        periodSeconds: 10
-      resources:
-        limits:
-          cpu: '16'
-          memory: 36Gi
-          nvidia.com/gpu: '2'
-        requests:
-          cpu: '8'
-          memory: 12Gi
-          nvidia.com/gpu: '2'
-      startupProbe:
-        failureThreshold: 80
-        httpGet:
-          path: /health
-          port: 8080
-        periodSeconds: 15
-      volumeMounts:
-      - mountPath: /mnt/models
-        name: models
-      - mountPath: /dev/shm
-        name: shm
-    podMetadata:
-      annotations:
-        prometheus.io/scrape: "true"
-        prometheus.io/port: "8080"
-        prometheus.io/path: "/metrics"
-      labels:
-        app.kubernetes.io/name: llm-reasoning
-        app.kubernetes.io/part-of: llm-serving
-    deploymentStrategy:
-      type: Recreate
-    maxReplicas: 1
-    minReplicas: 1
-    nodeSelector:
-      kubernetes.io/hostname: worker-1
-    runtimeClassName: nvidia
-    volumes:
-    - name: models
-      persistentVolumeClaim:
-        claimName: llm-models
-    - emptyDir:
-        medium: Memory
-        sizeLimit: 2Gi
-      name: shm
-

k8s/apps/paperless/backup-cronjob.yaml

@@ -48,6 +48,7 @@ spec:
                   mountPath: /backup
           containers:
             - name: mc-mirror
+              # bitnamilegacy/minio-client:2025.7.21-debian-12-r3 replaces the dead quay.io/minio/mc image
               image: docker.io/bitnamilegacy/minio-client:2025.7.21-debian-12-r3@sha256:73bd39f7899a0cef12b8dd5df13aa93a3ed1aaa44236542442e9ac76819ac158
               env:
                 - name: ACCESS_KEY

k8s/apps/paperless/paperless-ai-new.yaml

@@ -49,9 +49,9 @@ spec:
               echo "[init] Fetching JWT token from Authentik for paperless-ai-agent..."
               
               # Get JWT token via client_credentials grant
-              TOKEN_RESPONSE=$(curl -s -X POST https://authentik.riotpiao.com/application/o/token/ \
+              TOKEN_RESPONSE=$(curl -s -X POST https://zitadel.riotpiao.com/oauth/v2/token \
                 -d "grant_type=client_credentials" \
-                -d "client_id=paperless-ai-agent" \
+                -d "client_id=396757803559027071" \
                 -d "client_secret=29skAhE0tBzWn0qrPvmPTQMva0joFjcCr7msDQr_VXQ" \
                 -d "scope=openid llm:inference" 2>/dev/null)
               

k8s/apps/paperless/paperless-ai.yaml

@@ -9,6 +9,14 @@ metadata:
     app.kubernetes.io/name: paperless-ai
 spec:
   replicas: 1
+  # Recreate, not RollingUpdate: paperless-ai-data is a single RWO PVC. With
+  # RollingUpdate the new pod tries to mount the PVC while the old pod still
+  # holds it -> "Multi-Attach error" / stuck Init:0/1 forever, rollout wedged
+  # at "1 desired, 1 ready, 1 updated, 1 unavailable". Recreate terminates the
+  # old pod first so the PVC detaches before the new one starts. Same pattern
+  # as the Forgejo gitea Deployment.
+  strategy:
+    type: Recreate
   selector:
     matchLabels:
       app.kubernetes.io/name: paperless-ai
@@ -43,9 +51,9 @@ spec:
               
               # Get JWT token via client_credentials grant
               # Client secret sourced from environment (injected from paperless-ai-config Secret)
-              TOKEN_RESPONSE=$(curl -s -X POST https://authentik.riotpiao.com/application/o/token/ \
+              TOKEN_RESPONSE=$(curl -s -X POST https://zitadel.riotpiao.com/oauth/v2/token \
                 -d "grant_type=client_credentials" \
-                -d "client_id=paperless-ai-agent" \
+                -d "client_id=396757803559027071" \
                 -d "client_secret=${LLM_AUTH_CLIENT_SECRET}" \
                 -d "scope=openid llm:inference" 2>/dev/null)
               

k8s/argocd/apps/30-security.yaml

@@ -30,33 +30,6 @@ spec:
     syncOptions:
       - CreateNamespace=true
 ---
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: authentik
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "3"
-spec:
-  project: homelab
-  sources:
-    - repoURL: https://charts.goauthentik.io
-      chart: authentik
-      targetRevision: "*"
-      helm:
-        valueFiles:
-          - $values/k8s/infra/iam/authentik-values.yaml
-    - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
-      targetRevision: main
-      ref: values
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: iam
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
----
 # ZITADEL — the Authentik replacement. Coexistence, not cutover: Authentik keeps
 # serving in the same `iam` namespace until the last consumer moves, then this
 # becomes the only IdP. Migration plan (outside git):
@@ -106,11 +79,47 @@ spec:
     syncOptions:
       - CreateNamespace=true
 ---
-# Raw IAM manifests: key-rotation cronjob + authentik migration job.
+# ZITADEL core objects (ServiceAccount, Role, RoleBinding, ConfigMap).
+#
+# The chart declares these as pre-install/pre-upgrade Helm hooks, and ArgoCD
+# prunes hook resources when a sync ends. That deleted the ServiceAccount and
+# ConfigMap the ZITADEL Deployment references, so new pods failed to start with
+# `serviceaccount "zitadel" not found`. This Application owns hook-free copies,
+# which makes them ordinary desired state that survives every sync.
+#
+# Wave 2: before the zatadel chart itself, so the ServiceAccount exists by the
+# time its Deployment is created.
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: iam-jobs
+  name: zitadel-core
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-wave: "2"
+spec:
+  project: homelab
+  source:
+    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
+    targetRevision: main
+    path: k8s/infra/zitadel-core
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: iam
+  syncPolicy:
+    automated:
+      prune: false
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+---
+# Raw IAM support manifests: the SMTP -> Gotify notification relay that ZITADEL
+# points at, so verification and password-reset codes reach the phone. Wave 3
+# alongside ZITADEL itself; the Secret it reads is created by sops-secrets at
+# wave 0.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: iam-support
   namespace: argocd
   annotations:
     argocd.argoproj.io/sync-wave: "3"

k8s/argocd/apps/40-data.yaml

@@ -1,4 +1,4 @@
-# Wave 2 — dedicated per-app CNPG Postgres clusters (authentik-db → ns iam,
+# Wave 2 — dedicated per-app CNPG Postgres clusters (zitadel-db → ns iam,
 # temporal-db + visibility → ns temporal). ONE App, ONE folder (k8s/infra/databases).
 # CNPG operator is Phase-0 bootstrap; these Cluster CRs are GitOps — no circular
 # dep (they run after ArgoCD is up, before their apps at w3/w8). CNPG generates

k8s/argocd/apps/60-applications.yaml

@@ -171,40 +171,6 @@ spec:
     syncOptions:
       - CreateNamespace=true
 ---
-# Consolidated: homarr + homarr-patches → homarr
-# Helm chart + values + PostSync hook patch (fix-probes-job.yaml)
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: homarr
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "8"
-spec:
-  project: homelab
-  sources:
-    - repoURL: https://homarr-labs.github.io/charts
-      chart: homarr
-      targetRevision: "*"
-      helm:
-        valueFiles:
-          - $values/k8s/apps/homarr/homarr-values.yaml
-    - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
-      targetRevision: main
-      ref: values
-    - repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
-      targetRevision: main
-      path: k8s/apps/homarr  # PostSync hook: fix-probes-job.yaml
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: dashboard
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true
-    syncOptions:
-      - CreateNamespace=true
----
 # Portfolio site at riotpiao.com - static Next.js site from rock/riotpiao.com repo.
 # Points directly to infra/portfolio/base (bypassing repo's own argocd-apps.yaml
 # which has wrong URLs). Image built by Forgejo Actions on rock/portfolio repo.

k8s/argocd/apps/99-oidc-bootstrap.yaml

@@ -1,20 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: oidc-bootstrap
-  namespace: argocd
-  annotations:
-    argocd.argoproj.io/sync-wave: "5"
-spec:
-  project: homelab
-  source:
-    repoURL: https://forgejo.riotpiao.com/riotpiao-poimen/homelab.git
-    targetRevision: main
-    path: k8s/infra/oidc-bootstrap
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: kube-system
-  syncPolicy:
-    automated:
-      prune: true
-      selfHeal: true

k8s/argocd/projects/homelab-project.yaml

@@ -34,11 +34,9 @@ spec:
     - https://prometheus-community.github.io/helm-charts
     - https://grafana.github.io/helm-charts
     - https://helm.releases.hashicorp.com
-    - https://charts.goauthentik.io
     - https://charts.zitadel.com
     - https://strimzi.io/charts/
     - https://charts.bitnami.com/bitnami
-    - https://homarr-labs.github.io/charts
     - https://go.temporal.io/helm-charts
     - https://portainer.github.io/k8s/
     # Substrate charts (cert-manager, ingress-nginx, reloader) — app-of-apps owned

k8s/argocd/secrets/authentik-secrets.enc.yaml

@@ -1,25 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:Fc0=,iv:UFqMFeZTJZtFMoNeusjAoSI60U9StZS4IXw+n8JQCRM=,tag:uUvY4+jcjiSJHs0HDS3/7A==,type:str]
-kind: ENC[AES256_GCM,data:NUw86IEw,iv:gh4Vqn6uteYnYIFcXT/QVxRPKm+G+j2aIVuV71nZ4k4=,tag:nZA/x75Kx4+CoSx66BsvkQ==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:qex150pm0eGwYiiI05y9LUs=,iv:5Tk001T796c4HFikoh1ZVB6ierBfDqOUkFs5ilkr+V8=,tag:LiDAiCH7w6aRS41VKIlIKg==,type:str]
-    namespace: ENC[AES256_GCM,data:nI91,iv:c1hBWGMkVb+vg+MKNzty8CFfXxQabXEtT+EpiuQZNvo=,tag:BsGtJDbBadDdTa687+Sdag==,type:str]
-type: ENC[AES256_GCM,data:3rXawlSD,iv:FUtLK4KP7v/SBF08ZcU6siIO1qfjlJirf2x5PyzAjuA=,tag:mSIQ+Y43+wDfZGRbQ6a0Og==,type:str]
-stringData:
-    AUTHENTIK_SECRET_KEY: ENC[AES256_GCM,data:i5tVOWnN9a/cfhs6gckveRxUpiN7Ie227R/74kOIz6lQ5US2hkf03W5qSGCrzheL3DB0i8+d0iJYsApjn/wCiN7ndZZVFko3W5jDfVPybxc=,iv:djF1G9JHT5B7ziTokA/UuPpG+tG2LvFU4uMAR0x4M6o=,tag:vHOd7jLYkM8Evnr0QUVrCw==,type:str]
-    AUTHENTIK_BOOTSTRAP_PASSWORD: ENC[AES256_GCM,data:PjvYtH03CzQbTXEqt/Z18+u1zJdok7DLwDn51FUZXDA=,iv:pSwSm8hB0/Q8uOAcOZ1rTqq7BF782EglG19GGeghm1E=,tag:qGCQFWCrwsWBOiQ07ySMUQ==,type:str]
-    AUTHENTIK_BOOTSTRAP_TOKEN: ENC[AES256_GCM,data:1tnekGo0GIemJCMRenjN0yNeSiiMl/kky8ms84TsqBLaQ0lQzPxjq9qtgNJwoAsufxrznrkDVKjeOEHNYcA82A==,iv:NNFWSLMILoWccA9ihy1OArSS1X3OySB7PIHdXZdyzlg=,tag:t2w+KyReOXftTrU9pBQDnQ==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBSZGRKWm9PTkNSOENtREgx
-            M2V3Z0xxOXRhRGVRclo3SzBKRkc0VmtCY0NnClJPSGJRcUlzWmNFeTZ1bmorNEV4
-            U3l3TzVlMTlrWkJnQzBtUTJtcUwrM3MKLS0tIEJrMWZrbllYYUZKN1V4MVMzcXAv
-            eUtheHlNMHpsTEJXZ1FTMFVxbWloa0kKLRkE1Du+4gdOLerOl9y0mZw+8fqfECQY
-            uP64Q+9BSuPYNiTLZvYDzmdoy+KTS7i7C9rf+iU96R/crbQLamV9Ew==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-    lastmodified: "2026-08-12T20:37:07Z"
-    mac: ENC[AES256_GCM,data:b3pDx340d1iZxsPPXzACckoLBrW+XjX1qlGrWEEI30j2Ao0hewTRZJyHbdI97A6b/hqzBN/4tjqqkdqm8goNhUQweMLTw86X6sALuE0aLS9wK53qjqih8fQwQBbgLDtjFXtW26h+smIm7aB5ZSDvU2le44HDXuWd83sWtCavNq0=,iv:ZMDsoKpygFJrYpXy2dA0IlxAi0jt24rxF72eUzgQs7k=,tag:WWE7G7+c9JK6fF1U9V8igg==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.2

k8s/argocd/secrets/cloudflared-credentials.enc.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: cloudflared-credentials
+    namespace: cloudflared
+type: Opaque
+stringData:
+    credentials.json: ENC[AES256_GCM,data:LnJVGuxJAOwDYbLgX00OHICDDldZgwgvGafOIwKoJKnjg3FjFMQYThNCOL/H+6tctuKixJNcAckjg70tmCKWxNq9I35XX/YSqob6Qv4fywv32hsNIAe44BU035MGZ5zmc6bZZ8wAgTJZw6Th4TzY7taFBCRdj2fW4T+qVfq7strn68G4ufVMK6UXlOkEDLjR2Vxj32lqSLdbdMma96XB+265hwL6IVfaugG662mcGhPwgHk=,iv:NFmyHN5m2mJUBgn1qgmJZ2YgkFxBZyp7+gU1Ng6B/7M=,tag:/66JtHK5Yu7pRxB0b0eifQ==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBsaDVycUE4RFpoRjdpTlpX
+            dGpzN3hwRFQ2cmtXVXVzWnZJOXJEZXZRWEhNCkJwbm9QV0lGcGtNRTJqbStrc3l1
+            Q2M4bE1WbzJpTXZQWjJyTGpFS0JYcVUKLS0tIDBvU2U5aEtVTTZUaE85eEkyYitG
+            bGtSVkhKNnRuNlZWMWh6Z1M4VXM1WU0KdusvtM85V0xrO+uJFUY+UH0tuwdF0GiW
+            79J4Rlxk8ne25psKsvwjLYLxZ53xjFHCC4FCHTNkYwTKCDEKjw46Lg==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-10-26T02:45:04Z"
+    mac: ENC[AES256_GCM,data:KF7KwXCnNLAg1YI3u0lLI/ho4sITHAq09ac2WO4TK3TCthkuivb89YjhuuJKs0NFhjn6aRLqmZavUqcXH2HujiryqbLNVexOShQM0wSzgCzmWdbi0UzpgJ4KcQA3PufDtsQz4HHLXx396EbZrM3Ie3WSu/PvRm5iWOxzTGCGc9Q=,iv:Eo920oXXD1FLZVJXywZ6C+LRL+qZjmnZXv0+Oa/GMb8=,tag:6LuPVSet4WjvrvGUAxaJlw==,type:str]
+    version: 3.13.2

k8s/argocd/secrets/grafana-gotify-bridge.enc.yaml

@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: grafana-gotify-bridge
+    namespace: notifications
+type: Opaque
+data:
+    app-token: ENC[AES256_GCM,data:MnkKT0/ubJctmLTFXjdCZjNlz+KgQLsPwIKCmPF2weEtMw6ieRfb3+B7OUlIiDqpktdPaJA/znsMOYPXT2aXDqyKquA=,iv:vcAGkgfTheoViZ7OzJJhbNf0boIbRBZLr60ieW5DhLk=,tag:iBDJEjGScxHopkNExh7jDw==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBYYWZYNFBHbVhRSkZoa3dH
+            dWp3WllyVmRPcExPTndZUlFsTG1YMHN6WW1jCjRiS1M2U0tIM0tCdGhJOUQ0c2JW
+            bXNTTExDeVVmcExuNStldFdhTHMrVTgKLS0tIDN3d3JKSEtIUUFhVHROOVBUaUNO
+            UUVGcVVkOVJmN294dE5DS1R1UkxiZzgKx0MEkIrFsO2dQwjY2410Nj0Nyy3QgC3L
+            T844m4WT+mxFwB69/y0luGkn4aXMS3xrHHWUC+vjAkM4Unp+MKhhrg==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-10-27T19:35:38Z"
+    mac: ENC[AES256_GCM,data:Gf5jnvWP+jBRc8fvQHyrnHnTDaaUTcXQgoOqm7Drax5FpBYEHa36pdKaUq+XR6VBd7ch6Ia/f7YavhS47ybgR3jn+w+trMxkpwtZhm5clw2Lo3Hm7Cvi4fG4qhcjm1C8/NOnWGsi5Qm+TJqyG509p9HNTvM99SzElRovPZldLL4=,iv:10hA6nq0WIO0a2I4ZW6uPGXPjesFgxrwmXohNO3FZz4=,tag:bJ37e8jvgEactq6T/pM2UQ==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.3

k8s/argocd/secrets/grafana-oidc-secrets.enc.yaml

@@ -1,23 +1,28 @@
-apiVersion: ENC[AES256_GCM,data:rGU=,iv:w1yJeQvN0MPZlPx8VQZmC6zkRaHW4rtjjROea0Kx9X4=,tag:qgYgVUGMQ2BtN0RZ0nZYjQ==,type:str]
-kind: ENC[AES256_GCM,data:wp2QP1he,iv:C8c/jKh5pnBOtHqXsTEchGf9DACU/5hOJ0Mp/+Jk1kg=,tag:QUZNeguRXdi3JO6Ov6GMDg==,type:str]
+apiVersion: v1
+kind: Secret
 metadata:
-    name: ENC[AES256_GCM,data:jVsnAcFTlRiKxDoU,iv:bWEqo28kH3bxzfI3ipiY6dsqhIcl9wIxBjFu0mxVGLg=,tag:PVWTveI8xhvLxvXPldhimQ==,type:str]
-    namespace: ENC[AES256_GCM,data:ZHnVZyd3wA==,iv:3evUnFTQfRz/ZilUQIl/9dsCba3nsX6o/iQsGXMBfgM=,tag:+9kp+VRu1ksroDTbTGmGPA==,type:str]
-type: ENC[AES256_GCM,data:bHX+Bu9o,iv:8qqNddsuw4YoHAuJfUcPIqjcqNySIh5Ln8OhsfZxuk8=,tag:P7QGUXo9Io2Y19YqlWv5sQ==,type:str]
+    name: grafana-oidc
+    namespace: logging
+type: Opaque
 stringData:
-    GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: ENC[AES256_GCM,data:qW2SQSsGD0YupU2SMzRaYwkLRjXAwV1OJBnhATpCJrOHWbEytw6IphOmPPd3VZKfHncekA4agXi4K3rUPHIx0Q==,iv:NCeW/UfIl0RvHV39ubN2mDfFp7GTQNuFv8KiEF+7KOE=,tag:lisx4h4PqUfLwBX8ca9Siw==,type:str]
+    GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET: ENC[AES256_GCM,data:fGqA1ofVme1lVLxFjWIiU7sbvE9ip2Af7C1ua3+HdidlcVgkwW59vVlXZhgBRdoif86C8LKQSyoCGUqiO+740g==,iv:6Kv2ybbJg1GT8DLqz9P5y+E1zr7vcIBDMUErmvxNTaw=,tag:0wK28B3G/owCVPPqb2sLmQ==,type:str]
 sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
     age:
-        - enc: |
+        - recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+          enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBrUkxLMEV3aEpILytic0Ux
-            V2VEV2EvcENJVnNNRUtBbGkwT0d6eUxYeEFvCjZPSkU2MG5qME5jZ01mRVJwTUFL
-            M3M0V3c3QXBoRml1Vm9NWW5JTlNRSG8KLS0tIEJnNlFmdFJXb1BPaVJzTmo1RDQv
-            VXZOVHRHUEZJRUZ4eGZGM1RxSURyWXcK3ZyYCPhRUvpvT/pjPQGJoLIwaktZY6Tg
-            LS0cIDUhjPFbeu7qUATOrat6vMUi0UREbXSFZ1KyAjNAwJZaUusPMA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSArTXMxMWdVRHIvbWh1bVNk
+            bEFFNlgzNU9zTjlzY2o3VGdnbFpnU2lkYmxrCjF4aWVGSlJaNkcxODJ6RDkrVFo2
+            UkV2RUwwVHFCd0xMNG9RWXdTUHZGaXcKLS0tIHVaWjhaNHRtS2c0UkVzRk83ckhj
+            OCtBVFR0d1F5amVhV2E0emRZWThvYjAKFW46i9brIL9ZoO1CEn+IewIdoUhvYK/A
+            RqzZ6xV+mhlDj0zC+SpVcEm/Ki83nMYOj4+vQingZlr/Kr3Nwb0iLQ==
             -----END AGE ENCRYPTED FILE-----
-          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-    lastmodified: "2026-08-12T18:02:01Z"
-    mac: ENC[AES256_GCM,data:yUBBV7dLEPld9yJacn+YaOT8M1NJ2ploGIxV66aVOH5x4tDAsskcUQJlzApWCQmORuCuMKg6qfpGgLTojfD5msha+ufVVJXHl7ua+STar1/FPJXaHm+z7YyZdsD5j6f3AH8q18DuLy2DYLjXELmPBsp50g7MDJEm3xLhCUXygjQ=,iv:xl0OtA/2umz0YH5b+6QjlAByZWbvfGOmHqomziNjlkw=,tag:xwkQDZx19Lf6QSwU2zPYTQ==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.2
+    lastmodified: "2026-10-27T19:44:32Z"
+    mac: ENC[AES256_GCM,data:EJew+p/kJrurcNpLlFxJGTl69hQYxn3IkzP7EDtdSriW/WI7X1xNLC2dp/dTiLomGmG1uh6+2JI9Sc8gXmrRAWLELAbiOaYbcoU6gi89BjTCWGDAMX4lNSIuH40rsGs4YtYj5U7SGfgx5qto4ZH7LxjBmxzPWM/Xz2Uq/I5jV4k=,iv:LdhjhwCfPUIa7D0gved8Twf7ujN+dg3lN8lCnFBFs0g=,tag:bjkwUCMtR8IBL9BkbuXcnw==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.3

k8s/argocd/secrets/homarr-auth-oidc.enc.yaml

@@ -1,24 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:uiQ=,iv:vknDc16Zrz/lxS1WG3ksG4SHjhJSTDdklVxxwL8eylA=,tag:1srpVd6QTYQGGGYGXT8Cbw==,type:str]
-kind: ENC[AES256_GCM,data:K6EPYaNE,iv:VWzawfTDNlag+shjBqwSzZGcQQq/TGxeHDqd4fAh5Vc=,tag:ncPqMYjq/73oMzphWhuuFA==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:vaRNQHFYfdUz1hzuYO0JxQ==,iv:W7aUJID5mxoO1NQAcyPDYV1FGtBT8myKVMA3s2WgrPk=,tag:4Ef4GBtTR3dVanscvigRmw==,type:str]
-    namespace: ENC[AES256_GCM,data:HDlmfGwad37/,iv:JFPXxz9xp5vDJRcWy73SYGWDMyHKWQq9Bvy/NJTwTnU=,tag:2ldVXgzKn4xp1rZI/VYgUw==,type:str]
-type: ENC[AES256_GCM,data:UgolDLIV,iv:O4himI90UVwx+OjKJXobu10Zg3a5IoQcjAORsdhaWpg=,tag:xltntRsamhQkPEoBNtMytw==,type:str]
-stringData:
-    oidc-client-id: ENC[AES256_GCM,data:RLdxXY/a,iv:US/fBReK7u8WA4IS6TSzYiHQkte2CuVgugIMpA/pIlA=,tag:QKrHGQrzI9YpfNQD+ts68A==,type:str]
-    oidc-client-secret: ENC[AES256_GCM,data:SS+I92xEkOcJHTfWvZ1AA8hh1bFAtND5adZ6Uh73nIPiqAo958GSag==,iv:9HcmXWrGtflc6WWQe0n/pgB1Xveakofc3hvz5vuE29A=,tag:0emgeyM4GBftVKn/fx7XPg==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBCWkR5V0ZYSTBSSU1OTWF1
-            TzFxdnZkUFFIcGJWZ1VUU21ZUnU2cUdob1drCkhVTm02dkZPZ2lNWktOcWZ2c0Vi
-            dG1PSmZBR2M2anA2Z09iYUU0SjVzTlEKLS0tIGF1eVBBUHdhVk9YSzJlQXVwd3RE
-            bUd3UTlwR1NiYjNlcGpweTBhdmk5b0UK8pwUoVCr1uBX9dQ7EGRgFMAPk/z8N9Fg
-            6GRUORFug5h7x5kjXK9sU0yTHjFSekwBi75GLng0IrLEGJxHVM5wVQ==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-    lastmodified: "2026-08-12T21:07:30Z"
-    mac: ENC[AES256_GCM,data:NupjQWBJHMOo3/VX5n5nRx+RFT14N71XkrjXRC/VCP7i7H8yn3tcRdH9g14usgWunmqg2KKpGMUIZ9bsQ9Vds9sBvUKvLyRkfQnPwPh9+PFCF3ZZLPgzqcT19kg4I3QabmO+LPzQXsZWLKIqgF9/B60EVIgYyKhZmP7XblY5AVo=,iv:r0deq8+txE8TwzdtxOMaIAZbZc2fu+Tp4Jd2HZGbkhM=,tag:qMpZp6LcWjJHYMDp9ecBkA==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.2

k8s/argocd/secrets/homarr-db-encryption.enc.yaml

@@ -1,23 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:FO4=,iv:kKIuJp4uGeX6vECsXk7w43F9S281jObQchmK8r1+kmA=,tag:x5LYd34dzNDLCma/78M4+w==,type:str]
-kind: ENC[AES256_GCM,data:o4RTN8SK,iv:uyOJWjDmHIPuBl9Wc1S/HxUabV2yytWr1bntHW68sTI=,tag:3On0SnQVJ/ICMMryQe+8JQ==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:a89dHmLdSeMHE7ZP0Q==,iv:OWJvJhFqJ7A0UGVJnZILzCJ/4VuVFib9sUDjXuwyqJQ=,tag:1XrIQn1GDh8RQ4vmQAu7+g==,type:str]
-    namespace: ENC[AES256_GCM,data:4wBVpZJgQGM9,iv:3Tn1u/2TP/+SnELu34PDf4Jauf2L4f8+MtgrPIlyKzk=,tag:L3qbKFBjm16g8KX5vUsK6A==,type:str]
-type: ENC[AES256_GCM,data:mdrF9vUb,iv:7ukOgwXlnRf5mpJ/+6YXtyGRonnqehEgT4pJJIafw7c=,tag:90mt7jpNb3N80kCEi+R/rA==,type:str]
-stringData:
-    db-encryption-key: ENC[AES256_GCM,data:NWJryAEd/eUJxbNiu05RzLF/l7GDxIQM7RQe3xKBz6XklgRAFwQxxjakcVd85pePUBaQYz3zttFglWhfJlWhkA==,iv:eUWbcs0B/mIheyAQ2+DyKgcA98CRKQGAVC3O0WIkfU8=,tag:be06X6AQqlohYlxuYoZiTg==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB1Ym5yQ1pmWHZjVnYxbUVO
-            SkZ5dnI2OXR3cmZjZkM0K1ErMElLNktlK1JFCmpleFBrcXkwcDA4cGFuWWN6VDQv
-            dVV4NjB4MjEreENVQnZ2ejVLblRYOVUKLS0tIG9VbXJvUmQ3SzMzN3IrRDlac2sr
-            eGZNYXBoZFZDeisrVCtUMXVPaEpoNFkKjwhUU+Zsqv4Be+m558fET5UhF/2rO73J
-            AhGbJVaA7PaOCswPWiOLso26zD+MBB3VKHNdUFnenpoM16Nu4pOf5w==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-    lastmodified: "2026-08-12T21:07:30Z"
-    mac: ENC[AES256_GCM,data:KrGQY/eOmihYCvQCbfcM6bZ6rfx4zKh62M8NM0VQr1//1dSHpOOh25dYGLuQeECnqLxSpGQNWzr2xjUYWs4NOdSEFGq6FL2iHE3LnqoBZspp/JFJYP6+z/8jSUojwKEW7OuZZdPN6gF2u+IPOeWbGftnjS7X+atoSkYag2ty2vk=,iv:IOPEgBizsxrVoK5oSdWmi0uCBUnReOEnMYXuwSBKTzA=,tag:9k/XQ/AE7wSFq5XMbY0FTA==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.2

k8s/argocd/secrets/homarr-secrets.enc.yaml

@@ -1,23 +0,0 @@
-apiVersion: ENC[AES256_GCM,data:4OY=,iv:0Lgui0+X2oTlgCX5HEIIihEsGJD0C2+pDIOTCNi4r+g=,tag:uL7vlreaHjcLJjV7e5I7PQ==,type:str]
-kind: ENC[AES256_GCM,data:x/ltkind,iv:KRBfS7COsTs/l3Fhyk5FvH7IVc+r/6M6FVOo+kPDe1Q=,tag:UuTbe213hDfK/WUtKS/doQ==,type:str]
-metadata:
-    name: ENC[AES256_GCM,data:LpOEecTJBuGy5PqNSFM=,iv:Q+DCLGtw3wihhdAgEbzYHyQhFTPWFyE2iJKl9mYaA2E=,tag:E2wrig4lRXGDvSCHec5clQ==,type:str]
-    namespace: ENC[AES256_GCM,data:6kMVCXaF68NO,iv:gnCCkV7GKXA2HWOOeNUGnpAycf8U7pl6F8Vfo6DhLR4=,tag:0VdeySsuhUr2heXyGXZwBg==,type:str]
-type: ENC[AES256_GCM,data:6muC3Zqh,iv:gBaC+6MXvZY/bIpy/cEG/zWwLBaUFMVfxAHa1OnwfnQ=,tag:v6NYyhAKAwovluHAXNaOVA==,type:str]
-stringData:
-    SECRET_ENCRYPTION_KEY: ENC[AES256_GCM,data:jX9ULlaBYTSTFGRMplSder5rMrsz7THU3kgJSGef0r5rZvtoaAG9NVYU2QUEuD0sZgfqRooeMOkDCAqFc8qsuw==,iv:uOmx8w3XPKnoxfasf7gqi/bljxigpLwaAC30c2TroKg=,tag:Dmbu6m3+UZa1w0UR0LRh9g==,type:str]
-sops:
-    age:
-        - enc: |
-            -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB6TDVyNGRtYWgzMDYwdjdr
-            NXJWcGJZNUx6YzBGWm1nWlp0SlN3WXhaR0VBCjZ3bDBmUTFCUjg3U21wak90eHZK
-            NlRCTUZQSHhoS0ZSUGZ4UHhST01KNmMKLS0tIGUxcGo0NmJ2bmJ6eGJ3QWxzYVM5
-            c2Z6UkFjQmZ4ejIvK1JQQkZ0VFFIZ3cKA8UzmGsX+s3yOermOHqbnnEtekHCTqmC
-            R3Jyzf6OolZMJpNwbetcsOfgO61aM7LHl/Xb/hFLbLjZ+eECrt8VpA==
-            -----END AGE ENCRYPTED FILE-----
-          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-    lastmodified: "2026-08-12T18:02:01Z"
-    mac: ENC[AES256_GCM,data:HTrEEVDm8JqnVBFaY/FJknxma0nI95tRiwVc0K76k+2R4jgKCBA3EUAzPVS+gA4rTAeKHPSHrT2eidlkseT2WQUjqMRrpHcUsbSjNfpTEY2g/U0PIiOXZMRGfwmsQVgmu2fqeMOyzDSyya0scdWJXPraRPNZ+OpEkNVlm4rWcgs=,iv:KY3dnnmooJgsu66wc7gbzeIGUXZNgVrxAhpAwxoG+G8=,tag:7r6d41oTD136N57rtY7auA==,type:str]
-    unencrypted_suffix: _unencrypted
-    version: 3.13.2

k8s/argocd/secrets/igotify-client-token.enc.yaml

@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: igotify-client-token
+    namespace: notifications
+type: Opaque
+data:
+    client-token: ENC[AES256_GCM,data:W+InmDyZkU0i+OqQUsIaRNY/3p6zjMC19ASj/qYHTldhtGmHwj4koQX3tIxdCQV72xZKOxsc8eV3hGX3pqbW02c2/ng=,iv:wWI5AZdpxnzX61f8iTiWmxKcDFMaFM4PHFYo4DMBK4Q=,tag:CpE8Kg5V8fL7P3oAjWjSvQ==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSAwaUlFU0xKaEs0SWcxWEEr
+            T0tUSmErR08zVkhuLy9VMEc3VXdmU1o3cWdrCjhuOW1yTmZPdWxDZHhMeUZtQlcz
+            UmVzaEMyVHZOZS9KVHdMd2pndUJwUW8KLS0tIGxYeENwVEFDdUpDTGszdGtNRHBQ
+            Y041WW9HdTJwUlJCUGhMN2RGZWZpUmMKiQbi/O9X3cFJgqw3tvwWcyy8QKkUuq/7
+            Y+V51R/WFobEQuAZLmDKgWcPSGt51effufB/Vm9LRRqtbkbYQAIoXQ==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-10-27T19:14:20Z"
+    mac: ENC[AES256_GCM,data:Hxl7AGzMOMK0pwe6T9ZmrE6K45XhQkq4qk/7YkrVuneL1e7jc8Bmv4NlywqRkt9fPVOCMwKikeX9U3ZcsqK13xPPfm1CmAxV3CCluwK0/9589N70OQxL4qJSkO6CXyGaa0Y9wVRX4y/N3wSjW+d25+GOYUXrOxkRpVyU4GFSqAQ=,iv:0Af/MCZBEYJVI3yi7DpPX1eBKwSANXJPCpSAEE3zCq4=,tag:SS1U9TfRQR3z8KkoQ6ZuZA==,type:str]
+    pgp: []
+    encrypted_regex: ^(data|stringData)$
+    version: 3.9.3

k8s/argocd/secrets/minio-secrets.enc.yaml

@@ -1,72 +1,72 @@
-apiVersion: ENC[AES256_GCM,data:Mdg=,iv:u/JjNJfdyz7ehk8lHZRh1u9zkNuufHosyXv10Gm+T6E=,tag:pkgZVJid6kpGuy61+oEMlQ==,type:str]
-kind: ENC[AES256_GCM,data:/kWhhqyz,iv:DymezGpBHmKT3BM/CcUKEGIWZw/JXNutReSKfhfmoD4=,tag:DnA+316Z+0eqBWN8YLyv1A==,type:str]
+apiVersion: v1
+kind: Secret
 metadata:
-    name: ENC[AES256_GCM,data:xs1k//nWy1iJ52Q=,iv:NDGvM319FCypxFLWwONcF12osaU/EL0IwD0c2xtqYnU=,tag:6IhfISF08WQbxrUmT49d7g==,type:str]
-    namespace: ENC[AES256_GCM,data:jpUzI7BmZA==,iv:PQrfm67la6RJCRq0H7qpiY8n2hPUjcaK6gmJ/zPQW30=,tag:bp/3GYbRpYOIub5nT0zz/A==,type:str]
-type: ENC[AES256_GCM,data:fndXB4Y1,iv:EXOe0day1ScxvZ7ozn1QyHgaZgnvlPNmvSQG74aw7lM=,tag:quPmKvFTjRqtZoVUEoQAHQ==,type:str]
+    name: minio-creds
+    namespace: storage
+type: Opaque
 stringData:
-    config.env: ENC[AES256_GCM,data:3RIQ1i6NtY1Tv2eJY8JXSgfBEqi9px/9TJVNrPf9+brtGy9Mx3SwjKVnjGXUcA2cYcNZb1JR7temXmznXQdsRfZ9yohe4oc1vL3yPGPY9YfP7AHGYj9E7tghu/rgkHOf93RmfdKv0Rrq6miBcA==,iv:0RQVMi2mMHBRTJ1OX6IDFvq9Qr7zpqgQzt+MPPgBIHA=,tag:HNXLKf5X4P3E+hc7YbDtNQ==,type:str]
+    config.env: ENC[AES256_GCM,data:1yogGyBdwrlg27H8R5Kr9VcPu+xwS5/nPhi7eLcmVYtXmPlNokCsWHA70qnn/+I6i4ODys8GML++VeZ/lmcHiP7RIbY+G6xmw6nfBCXitgE8kQwTPsUUzn9bobOn4Sr1YMBf7FQ/Q0N8aupGJA==,iv:EfCdim4TLkP/FP1u1yoKZCq8YGFzVh7ca4yu1+WzXwE=,tag:rTYe0SIAEsUhh0KHQIEKNw==,type:str]
 sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtUVJFQ1ErNmkzd1N6b29t
-            L0VWR2tlcEIxeG1CR1hXRkw2cEt0Q2crMWlVClg2UlNhUzdJZGpLZjJtYlAvbk16
-            eHk0ZHZiNzVRTWhyQzlieTU5Y3QraGsKLS0tIHA5UVhvUXhNSDk0QlV0R2RzR1dP
-            azVEQzgvSFNwak9TcW1USFNOb3RvSkUKNLuW3h3cHDSSCZGe9Vyiv5m+wXihtCYX
-            oJtbRK+kJF8oOUo4emI+SLGrCsWq5cG2wN/wgP+ChR1zUgRgfq5oOA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2SStVR0lpOWs0VnN6dkdp
+            RktMUmNRR2diTUtiVk9tRk1wSjVTMnRtVlJBCkk1S0dwNUNHb25RQlZ4ZFRocisv
+            aS9kbmQydWVmN1AxU3VvbFZsS2tmTHcKLS0tICtRY0ZKeFhCTUdaNW5PSFRNZ2dG
+            OERIZ0xMbHBvSVNyaGxCVFpqRzlxa1EKbrjfk/CFlTSyJYgTzQ67W3JyR1fwv8VF
+            dxGeAgLY4EQrf+2PbODtazRFreS+sl7dxq+rKMOVZTsjGHakkqHy9A==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-    lastmodified: "2026-08-12T18:02:01Z"
-    mac: ENC[AES256_GCM,data:hQfimKuhfiIiZQAyNDZQR25HZ5biU+kaWig3ElVPiqMY3B0LrmKyOEs7ittd3j3meUkPEFSmm1yYSXcdCuf6w7cwSbEiL5DG8t7QKPbnx/aRdyHAJW+1VC0e3Lye43gaHya0iUaWS/YFQcrT01oEbckLIDWPKfvA6pg2bZ4kMZ4=,iv:AydyWMVcjTQu+7Fzw5vtqkvTTeQEMt8y6snESoLUDE8=,tag:SoKklNqa9nH9G6d9+PnolQ==,type:str]
-    unencrypted_suffix: _unencrypted
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-10-26T04:03:16Z"
+    mac: ENC[AES256_GCM,data:gxu4WcJEuFgjtWCfAjose8R8a566/OLrXoiJmKfcvVfTFDTdGM7I4gzQVvpjEfra5Hjyt7kvLlaV2K5bKJ0k6NXbbmgrqAqEOEcPg+cnPy1FtQGAYOo3VzgKqrpLOCs/7wh4YR23XHHsjQlHAcP8BmhrqnpHXR9FMZObrKjnQj8=,iv:KJZfw0n2DOtdZHeVDk6TrpO8q57yD+xdEVt9+hM0D4Q=,tag:rHQaMjvQwaB8Am/AlTKq1g==,type:str]
     version: 3.13.2
 ---
-apiVersion: ENC[AES256_GCM,data:Mdg=,iv:u/JjNJfdyz7ehk8lHZRh1u9zkNuufHosyXv10Gm+T6E=,tag:pkgZVJid6kpGuy61+oEMlQ==,type:str]
-kind: ENC[AES256_GCM,data:/kWhhqyz,iv:DymezGpBHmKT3BM/CcUKEGIWZw/JXNutReSKfhfmoD4=,tag:DnA+316Z+0eqBWN8YLyv1A==,type:str]
+apiVersion: v1
+kind: Secret
 metadata:
-    name: ENC[AES256_GCM,data:XEQHsQqTgwukYw==,iv:wTw2eoooDA9EfB2df3jzb0IWUdtLSwcuKzx8yDBaihQ=,tag:oncXt2gM1k6Qppafpu/D1w==,type:str]
-    namespace: ENC[AES256_GCM,data:jpUzI7BmZA==,iv:PQrfm67la6RJCRq0H7qpiY8n2hPUjcaK6gmJ/zPQW30=,tag:bp/3GYbRpYOIub5nT0zz/A==,type:str]
-type: ENC[AES256_GCM,data:fndXB4Y1,iv:EXOe0day1ScxvZ7ozn1QyHgaZgnvlPNmvSQG74aw7lM=,tag:quPmKvFTjRqtZoVUEoQAHQ==,type:str]
+    name: minio-oidc
+    namespace: storage
+type: Opaque
 stringData:
-    MINIO_IDENTITY_OPENID_CLIENT_SECRET: ENC[AES256_GCM,data:IYBfNW19cTo8WkCGT4zuCljzi2bkbYWJ8DY/yedR2MJNqEO+bMVvjx0OqSqbPp6rnwGyMQOhBN0gXPbEVRDBGg==,iv:I1aGIikbHTKvh//4Inhp7UoNfhjlIXSpcyP4RqljvqM=,tag:Zh3Vh5DQYAsTtiW59D0/QA==,type:str]
+    MINIO_IDENTITY_OPENID_CLIENT_SECRET: ENC[AES256_GCM,data:eFfwW2ZnV+o3/6XHjUvyFsDbaIAdosY2PXOnRdN4Ie49YDIjfJPe+Mg1FsbgoEHEjuB33hfxesb4TWOJQfW8Og==,iv:+kRr9A3auts1XHgZWa+t5b2m4lF0x9dVhiRpB17fzv4=,tag:tH/jszFzLQdqORGr9vfTGw==,type:str]
 sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtUVJFQ1ErNmkzd1N6b29t
-            L0VWR2tlcEIxeG1CR1hXRkw2cEt0Q2crMWlVClg2UlNhUzdJZGpLZjJtYlAvbk16
-            eHk0ZHZiNzVRTWhyQzlieTU5Y3QraGsKLS0tIHA5UVhvUXhNSDk0QlV0R2RzR1dP
-            azVEQzgvSFNwak9TcW1USFNOb3RvSkUKNLuW3h3cHDSSCZGe9Vyiv5m+wXihtCYX
-            oJtbRK+kJF8oOUo4emI+SLGrCsWq5cG2wN/wgP+ChR1zUgRgfq5oOA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2SStVR0lpOWs0VnN6dkdp
+            RktMUmNRR2diTUtiVk9tRk1wSjVTMnRtVlJBCkk1S0dwNUNHb25RQlZ4ZFRocisv
+            aS9kbmQydWVmN1AxU3VvbFZsS2tmTHcKLS0tICtRY0ZKeFhCTUdaNW5PSFRNZ2dG
+            OERIZ0xMbHBvSVNyaGxCVFpqRzlxa1EKbrjfk/CFlTSyJYgTzQ67W3JyR1fwv8VF
+            dxGeAgLY4EQrf+2PbODtazRFreS+sl7dxq+rKMOVZTsjGHakkqHy9A==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-    lastmodified: "2026-08-12T18:02:01Z"
-    mac: ENC[AES256_GCM,data:hQfimKuhfiIiZQAyNDZQR25HZ5biU+kaWig3ElVPiqMY3B0LrmKyOEs7ittd3j3meUkPEFSmm1yYSXcdCuf6w7cwSbEiL5DG8t7QKPbnx/aRdyHAJW+1VC0e3Lye43gaHya0iUaWS/YFQcrT01oEbckLIDWPKfvA6pg2bZ4kMZ4=,iv:AydyWMVcjTQu+7Fzw5vtqkvTTeQEMt8y6snESoLUDE8=,tag:SoKklNqa9nH9G6d9+PnolQ==,type:str]
-    unencrypted_suffix: _unencrypted
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-10-26T04:03:16Z"
+    mac: ENC[AES256_GCM,data:gxu4WcJEuFgjtWCfAjose8R8a566/OLrXoiJmKfcvVfTFDTdGM7I4gzQVvpjEfra5Hjyt7kvLlaV2K5bKJ0k6NXbbmgrqAqEOEcPg+cnPy1FtQGAYOo3VzgKqrpLOCs/7wh4YR23XHHsjQlHAcP8BmhrqnpHXR9FMZObrKjnQj8=,iv:KJZfw0n2DOtdZHeVDk6TrpO8q57yD+xdEVt9+hM0D4Q=,tag:rHQaMjvQwaB8Am/AlTKq1g==,type:str]
     version: 3.13.2
 ---
-apiVersion: ENC[AES256_GCM,data:Mdg=,iv:u/JjNJfdyz7ehk8lHZRh1u9zkNuufHosyXv10Gm+T6E=,tag:pkgZVJid6kpGuy61+oEMlQ==,type:str]
-kind: ENC[AES256_GCM,data:/kWhhqyz,iv:DymezGpBHmKT3BM/CcUKEGIWZw/JXNutReSKfhfmoD4=,tag:DnA+316Z+0eqBWN8YLyv1A==,type:str]
+apiVersion: v1
+kind: Secret
 metadata:
-    name: ENC[AES256_GCM,data:rYX7nN6SYoG5HycaNNrprDM=,iv:4uX7+Sl1UzgsImBH+qm9p8DlOfJu0i0W3bpoE7cFxXg=,tag:RROCnYBVKVwPBNSGgV30FQ==,type:str]
-    namespace: ENC[AES256_GCM,data:jpUzI7BmZA==,iv:PQrfm67la6RJCRq0H7qpiY8n2hPUjcaK6gmJ/zPQW30=,tag:bp/3GYbRpYOIub5nT0zz/A==,type:str]
-type: ENC[AES256_GCM,data:fndXB4Y1,iv:EXOe0day1ScxvZ7ozn1QyHgaZgnvlPNmvSQG74aw7lM=,tag:quPmKvFTjRqtZoVUEoQAHQ==,type:str]
+    name: minio-user-ollama
+    namespace: storage
+type: Opaque
 stringData:
-    CONSOLE_ACCESS_KEY: ENC[AES256_GCM,data:FhXl6yqTIzHsbJO6P96KQrA=,iv:gGTaSKxk721GwMQWWyymqUPZlGLidrBzWCWdRtnlOr0=,tag:IaVl8GQqPstBuUjD4N6JTQ==,type:str]
-    CONSOLE_SECRET_KEY: ENC[AES256_GCM,data:s22GOXY4B/m+S7tgDw8P2gU2F15vdn1tqAp53FWzFTI=,iv:GXBhHQ8YiaVjRRMw2yG4FxdulVOuOurkLXXC0u/SFRA=,tag:pvHcD9+4qaxnvhOSkNxoHA==,type:str]
+    CONSOLE_ACCESS_KEY: ENC[AES256_GCM,data:Zxr/Nj0SUKSJbBD1cFjt3GE=,iv:r/B9ULn68hsXdH8uRQkKAoQTJIJIYKMoJuWOZfxS2I8=,tag:Xo4i+IVxuqrp+qDpYQysPw==,type:str]
+    CONSOLE_SECRET_KEY: ENC[AES256_GCM,data:PoIDNZ+Xs6BdhGm10y1HdL5jy47EVHfHHIJhGy/KX6Q=,iv:voAv32GoTKi9s9/4MQy2yT6i9VY4/igA5XXzehwUqRQ=,tag:DmPyk5biVvlxHjeyDyrLbQ==,type:str]
 sops:
     age:
         - enc: |
             -----BEGIN AGE ENCRYPTED FILE-----
-            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBtUVJFQ1ErNmkzd1N6b29t
-            L0VWR2tlcEIxeG1CR1hXRkw2cEt0Q2crMWlVClg2UlNhUzdJZGpLZjJtYlAvbk16
-            eHk0ZHZiNzVRTWhyQzlieTU5Y3QraGsKLS0tIHA5UVhvUXhNSDk0QlV0R2RzR1dP
-            azVEQzgvSFNwak9TcW1USFNOb3RvSkUKNLuW3h3cHDSSCZGe9Vyiv5m+wXihtCYX
-            oJtbRK+kJF8oOUo4emI+SLGrCsWq5cG2wN/wgP+ChR1zUgRgfq5oOA==
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB2SStVR0lpOWs0VnN6dkdp
+            RktMUmNRR2diTUtiVk9tRk1wSjVTMnRtVlJBCkk1S0dwNUNHb25RQlZ4ZFRocisv
+            aS9kbmQydWVmN1AxU3VvbFZsS2tmTHcKLS0tICtRY0ZKeFhCTUdaNW5PSFRNZ2dG
+            OERIZ0xMbHBvSVNyaGxCVFpqRzlxa1EKbrjfk/CFlTSyJYgTzQ67W3JyR1fwv8VF
+            dxGeAgLY4EQrf+2PbODtazRFreS+sl7dxq+rKMOVZTsjGHakkqHy9A==
             -----END AGE ENCRYPTED FILE-----
           recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
-    lastmodified: "2026-08-12T18:02:01Z"
-    mac: ENC[AES256_GCM,data:hQfimKuhfiIiZQAyNDZQR25HZ5biU+kaWig3ElVPiqMY3B0LrmKyOEs7ittd3j3meUkPEFSmm1yYSXcdCuf6w7cwSbEiL5DG8t7QKPbnx/aRdyHAJW+1VC0e3Lye43gaHya0iUaWS/YFQcrT01oEbckLIDWPKfvA6pg2bZ4kMZ4=,iv:AydyWMVcjTQu+7Fzw5vtqkvTTeQEMt8y6snESoLUDE8=,tag:SoKklNqa9nH9G6d9+PnolQ==,type:str]
-    unencrypted_suffix: _unencrypted
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-10-26T04:03:16Z"
+    mac: ENC[AES256_GCM,data:gxu4WcJEuFgjtWCfAjose8R8a566/OLrXoiJmKfcvVfTFDTdGM7I4gzQVvpjEfra5Hjyt7kvLlaV2K5bKJ0k6NXbbmgrqAqEOEcPg+cnPy1FtQGAYOo3VzgKqrpLOCs/7wh4YR23XHHsjQlHAcP8BmhrqnpHXR9FMZObrKjnQj8=,iv:KJZfw0n2DOtdZHeVDk6TrpO8q57yD+xdEVt9+hM0D4Q=,tag:rHQaMjvQwaB8Am/AlTKq1g==,type:str]
     version: 3.13.2

k8s/argocd/secrets/paperless-ai-secrets.enc.yaml

@@ -6,7 +6,7 @@ metadata:
 type: Opaque
 stringData:
     PAPERLESS_API_TOKEN: ENC[AES256_GCM,data:wlBC85ep6zioWLhfhNczkKfTMR8tmciN+4r3of8GpQoJmKyE2r7pOg==,iv:Rem/UJl5wUNi8G+uEV7f2eCLabaY26sZ7+AsKYiOZ4I=,tag:bGS1fu13Mwsrr+5NUEzzLw==,type:str]
-    LLM_AUTH_CLIENT_SECRET: ENC[AES256_GCM,data:co7FfmRXKgrz9fNgR10KtlHL/iG4F5WKJgjcKem1H5hF5FviVi4+CQNekA==,iv:ADtBHiI6BtrkuH1iIfKV3I5odNLMQe5y/9GGTJrPNN0=,tag:j6wX6zO5VhKoLzdr7BQZCw==,type:str]
+    LLM_AUTH_CLIENT_SECRET: ENC[AES256_GCM,data:OEZqGgJ4cpMsWr/PJH50lsQKvk6sjVNPCFcZP3yQ/7nvlKP3giPlLmW9XgWr1ELq2hwWDs61+f3fAyENt4ln+Q==,iv:W0Tii/nvgm9ZMIEtfzgO5pj4Li+6fpxfd3zFtQhj874=,tag:tsM/fGeduMOEfMZsDZ6lrQ==,type:str]
 sops:
     age:
         - enc: |
@@ -19,6 +19,6 @@ sops:
             -----END AGE ENCRYPTED FILE-----
           recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
     encrypted_regex: ^(data|stringData)$
-    lastmodified: "2026-09-14T14:19:39Z"
-    mac: ENC[AES256_GCM,data:jDdmiFg6uB1za7sAjO1CnGHdRPyUnmWCMJxqHrE3BO82pNbtm8yLOf+W6CfFKAjfZYqEE2mdKhABm7zeJgJlub3eXJbAirAFrp5jrbfHw0qsFo85Gj/BsrSDB401Aky6PxvRomz66FyX5zDDXIGAMEMlyNEadMplTfrZQQ9hQWM=,iv:UTSF72ofUyWs1LXGKQwBP60hK64UxhqTFM8QTVozGoo=,tag:OKivMDAqwWgrX+kNjvQrPg==,type:str]
+    lastmodified: "2026-10-26T04:03:16Z"
+    mac: ENC[AES256_GCM,data:gOrqy2fPX+77303L+E1EypaTU8mdUXYjbRZnTIJtoRpZhEmHsVvS/Ho8bVcl5KiTPN7UoFNmGyDz8fpyQ/rLTbeCiUYmyxvH7ym9DT4oWvRxITpOqBxz83pWv1BB++HJvqNQ5FllqpnAz60/bAVyxOdOXk4J3lDnuJibNOpxhW8=,iv:suV68u1Uiejl0NNJ3WlAHshgdrSL+aTwUxUBeMXlfWs=,tag:5wug4NeDZ+qclvFGPiEviQ==,type:str]
     version: 3.13.2

k8s/argocd/secrets/secret-generator.yaml

@@ -9,17 +9,14 @@ metadata:
 files:
     - agent-pod-models.enc.yaml
     - agent-pod-ssh-key.enc.yaml
-    - authentik-secrets.enc.yaml
     - cloudflare-secrets.enc.yaml
+    - cloudflared-credentials.enc.yaml
     - forgejo-registry-pat-api.enc.yaml
     - forgejo-registry-pull.enc.yaml
     - forgejo-runner-token.enc.yaml
     - forgejo-secrets.enc.yaml
     - grafana-oidc-secrets.enc.yaml
     - grafana-secrets.enc.yaml
-    - homarr-auth-oidc.enc.yaml
-    - homarr-db-encryption.enc.yaml
-    - homarr-secrets.enc.yaml
     - homelab-ca-secrets.enc.yaml
     - loki-secrets.enc.yaml
     - minio-secrets.enc.yaml
@@ -38,3 +35,11 @@ files:
     - pi-sandbox-secrets.enc.yaml
     - etcd-defrag-creds.enc.yaml
     - zitadel-masterkey.enc.yaml
+    - smtp-gotify-secrets.enc.yaml
+    - igotify-client-token.enc.yaml
+    - grafana-gotify-bridge.enc.yaml
+    # Login UI RSA keypair, adopted from the chart-generated Secret so ArgoCD
+    # owns it. Without this, the chart re-generates the keypair on every render,
+    # which changes checksum/secret-login-service-key and leaves both Zitadel
+    # Deployments permanently OutOfSync.
+    - zitadel-login-service-key.enc.yaml

k8s/argocd/secrets/smtp-gotify-secrets.enc.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+data:
+    token: ENC[AES256_GCM,data:CUJ0rUtgye71fpFz50RSDXJeG+t8Wjrm6T6jboVPbt2FVuIRSscqKg/Pc3k/L8nvLvrkYlzz1rbYu9v5NAdNF2c35AQ=,iv:tsfQ+v4qwj6H7G/O79b6m4XMWRw3mwE67f+4LjDCOoY=,tag:SLGGBYtYoF45AQstETPYZA==,type:str]
+kind: Secret
+metadata:
+    creationTimestamp: null
+    name: smtp-gotify
+    namespace: iam
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFWmU5TUxLeGU4YzUxRU9G
+            ZFR5a2hqS3huYlJtempaQ25zUkljUDJLSENrCkx0bjQ4UVF3UWpWa0t3WHQ2bkNl
+            eEp2d0dQRHJSOExIYjN4TmRTZWdQY00KLS0tIGF5enUxTmxRTHlQRUt1aTFIYTFB
+            MEJaOWd6SnhWQU1PQXdUZDJqWmp2MGsKIOOrp52+d3M8AQlMw0VSnLQ2efDtC6Ye
+            oC/TPqYi9SqYNxaHkODS2QZN9msyfRFcgUh/6ZXr8sivnpwRY8ZZtw==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-10-27T06:24:20Z"
+    mac: ENC[AES256_GCM,data:9Jsnij+I1MhLhIPLt2hr1a6Jryf8XcAb4QAknGkX1hNEN+Z9HT5PSnPARqyhl0WTxe8813a/G0h93SJ0A419jIzZugv6zEj4STsOG4hMI8O2NniqOwiDWl+Az9SRXIQ0ahH9En7ssvEdiosIDGJSz31ufNc8FbwKnHvgWCwfK9Q=,iv:VNTOpQkDakoaCu2dG4lRbd+6AzimNZVNzggq/7C2eM8=,tag:cJI9WdnKiG3K3J4LRDqQxQ==,type:str]
+    version: 3.13.2

k8s/argocd/secrets/zitadel-login-service-key.enc.yaml

@@ -0,0 +1,24 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: zitadel-login-service-key
+    namespace: iam
+type: kubernetes.io/tls
+data:
+    tls.crt: ENC[AES256_GCM,data:Ad4omL7pD4QhixW6wSVsVor5FtHbWyOHeYbxOQsEBAaSuvb7JIkvnKqo+Xy6zKuMmRViUIbqhlLQDXCaseAVGgpu3PdtShwJ7LRXJmr0XtQV1M6YtRbRexN6UpFA3XdD+JfifMhtvd29rM3WzLPX69uk4k7voYN5m0pNXSN23jVeIeqm+xB1CpxDW/guZ2hA5+b5XBzVOkMsSOSdWFWH2lK7nInv6ZatCa0/fuIKmB5nZpSV9tHpCTiTnBuNc0rW1X4HOWa8zMiSbjQAqtDitm7lrVHJyImXwBjmuS0wM35VwrwxVUUEjS8kgqnyb02JvNRdNjuwOmIcyKjrdgO1B1ft0CrAbRNkk2dYR8Y7SNhR4F4tYYF5L2szQgj+5tcYrnRGEI2QkXbcmTa0Y9V99+D2bKjt5t59Pi/1r8/jt0CNy0GeeZDvsN5scy0/A4WqtJ2sZDyTnTPwtUpAAwVC2WSqsD11gkzhyRJAgmAmEgfPIL7kTZsZBoSQeuuCJ82Ghqx9kLTpui6kLULxxUpP9oefsKw9PjTwExRbNNcPV5p7PPi9dN00TNe9iYuFqoZFP/lp5SMjDqbsV4Ie1ffcfyZsIHMuOv5Ths7n8ExYdR0zIn+aQePXASt+dE6njhFiblxyBZsn0xON3EIUaE9e3WsdcQKjlPOaAW/DvU6PwBqCeaB2nYzM2NFk6W3lN8BahTE9k7xXrILHIrXuIXezotCK6jclb5yZmdm/fTCX1iejGVDktvvcmX6bbv3YXTRZmsviRhLFHA8oClU0alTsY5Q3nn2Xl0UfXU+rW+10AIpY5WFMzP6A8hXvHx0ISC1S4AIqjmlsDmq2yEZKpbiL+Bs52ymW7t2rQ+KGhWH/bcC3VrJwUWnVYP9b80xyHZdKqubwLc5UcDzCs/Lan23VpLxSJkqb8vZP7SHQ1nc+rlwrqFDkzQ+yMNLZmutqbaAmMyXbrR51Rz3VqofraPXjS+lmLAuEcuTEFbrImsct5Zb57MtKvhHi6CUWt/Vj/NOUJlwy09zPy4JAMMJ81ooyBj6CBHY2f1vfR/UUDN5VZdfg4dUWXS0CQdOb3hx19COr4lR4RcpA46qJEjum+4icm5ckziYT5Nm7NB+ydXJ+Eys2Ba0dGRM6CIeQVhghhCDOZ6uoQ2A6DNql6wjrfUml8UwuJNO0nXVqNS28pLwddsOjlbsysJAUEma6EHXb2Vjb90JZErVswGuhQ2+UdhtpuIkgBYX/MMCZV942C+K41A9478BaCiWuC9KbnAcx81ceR+T3syARctZvQaYaiH7WfF8qyo0VOGzZRYjFbqeyHefiOmPmWTS/XbIti3evyhmxHwjUcidK2njrPB0O/3w6R69UA1p7ph9EgFsj18gPYnJthikgX8vcfVaVnPIAwCqY5DJJmIFTNXVkNDBX+2orrW2qj6PEH+go+uc+aUmu646niqaMAcrUl7gGNGd2OWFHdIRKdtogOvoVpQMDB4eWHPRsL29EVt3rnknHfpq7cIjQXuk9XtlB8zjllYdrh50Q8ZNBOvzWgCiMvAyanfIA+kW9KHQlmb1qJGYp7it2Lrg1K7sDEekrlbuoNsf+2rl8YRQz8pVBuCSzG9DPp4+Rj+ddiqX/Rrs3ufWDKFV9zJoN1EpJ8+z6n8rsQJBe/lSFLW1mLVkaPSNNdIQfdJ6MbsHpMlqqFYP8dOKckxv82uOkHoCLHrgaXiiMd1dBsX1fBiv2NvzDiuLyN81d7R2wNAQbkG9b+/+C6wVr6kDg0n6seseoCyeSI++PJIkCrkTXzd7rLs8Of9CHZQEB15wjemlmYGlJnCiFWPFa6h0jJPatPrfTYv+GpqzWV8u1Uh3aNjd+g1wVQok/ojNOZJahUSI4B67HkJI+I7WOF9C+rRCwNutqshIxYzW7CpyVey5P6Kyv+/cucDEgb0ggH032MBtzTxazpJcE4Y6fTrOiXHp9j2KjzyUt2YeCCL8UMwbwJvW9p1I5gx3ArsOuyHm1kA==,iv:PLsjmrTwjM7IUS7ZBSyVvJfAJzCSUtU+UAvHbSwoaVk=,tag:pUQwbHoZgfHW4CpPKoULAw==,type:str]
+    tls.key: ENC[AES256_GCM,data:rO1NVJZP9TP96C48it4+2lGyRutwqdlX6qiM9R/+0hgYc5ceeeopaCUG/i/LOgltxRQK8qkyed/W3zU2VI6alBpt75XkT3o9ZRy3uxe8mB3ixS7+xQnMc0ci8Mf2bCtGzqwUQj8XPRP4K7Mxw8r4XO5rQLnSmNme0+BxS+XiE6hqifS16UUKfLuFeUtTEoI850sg1GQt0uaHf9kOrpmvsbg3sflO2dQXk8uSFi3B1ghG5DdWImVoc4f5kFK86XG65WVVfYjLaUvm7ZBPT0mwvq3SgPdEXeWq1fp7tMQqCRKuluRZon1e+J5SlWOPUTxwyTq336oK2Nfk3HsiQ3uCG76oCmI5yTe2tCN1f2IXFXBvLNM9QTxc/KFhI4uI6bvHjimOSpXYuRdroH0hc4ohLP44WG0E8Nz7sAb3Ai3PbDTKnqYQemvGEUTdcdbWuMK5/JE4f1IE9DgOOO9RF+s7uXTdzZAmoMcRtVsckQJEJl7AKgqSn7BbK0cjRL/QXclNySQ/qcgSDFiV/pPbGC9JFweJon5F0Qn/AIAnGGzqmVbS6x45UAJieI5oI/30OxjzF+Dov6EGMoE0mys+6l4j8v1EFCtHhhopS7zM4jZRTnNzlZWPtEISU2kopLroGpKESE145VQnB7X66F40KXcOIiXmU1H7Yxw5rJ0SqLAFWQw7gyNdzbnbfCmGASByxnYYwZRy3QDZYrQlthLd5tlGe0cg7j02ZSHmmJNQOx5yOmSQI7z4njDvJlOPncC14T59yDZUIYYLTAYjL8nmCNk2yD55ImVGRIb/f0JGAc2vHMlDN6fkuiSLtbASz11PwWzdln9tS9BTpRx7sfv5+kMhFkzomufftAJbs5XdOxcvGRHkRkdyCn3t8jcRXaNDBpq3o8zWLNh+411I65DMDN1B0c4+7Uw4N17I+KfrVh5Fb8ix0LW9aEL/SUxeIqdEu0ZMTncxGS0QVzZmtJUTdWuT0JjtgfsD65jqpg9l8RdIKX4i0ox2+GeQuXKCQiCaXS47yDxUcICYZB7UDnfwBcXlnGWw1frvkBBqwvwUVa7G7Al1A1a35ob1qb9gpyJZGqmEyV4Qe3PmfUHkp+/bAWarLXnk8P4l2faFjCEnPDIejGMQgDdtkodq7lfqwtHwg02bXNl9X3FbXjyp51/IJshE9dhHLkniWyHwZvHZJ4jjqndf08682gxTnW0bscfv7d6lKznE7rgd/el5ygdlL0PSr0pbxJtcd7MYrACMfZZxRuY3PWZayr1n4iaqh161S8ldeEcLCiHFvDeGHslUK+Sl383AHhs46NHEVgMbhuKJ1thHckQSgpqm9vGE1gBIo0d7z40EulgD+KS4Qm/vdydCgqtzyNmFDg17L+SVCQiyckGxgl/j1YzQKz0o1EWXNssk121m7Nh/e/bYNN8kC6doJPBQBkdhU/+DVZa4+/je+qpqvqnjpheX42k49ubk638QhOkcMmx6ZNnEbL9Ra0mNJHZO27t6++LgN2XkPg6t8VO94yx1c/VFyoF9Qg21O1+BadK3RF9l9s1eUB7n93YwUDhxZpimr8j8oLCn+PvksKwzWEIiAFXUWvuROwh6yC31GghO6veGx7UqXGPM2O8+mkOxXZObbnYAAhteRhXO/k15HL3qf94pudZ6+tETmeej4FKdhZzF9iOsTu/69izQFhl57E+n5hDjRzeVANKQOdq2x7qDG7pGfpJzrDVR95Z1q7Y/d+7FJjBML+YvzGvbxZno+PbPmLGrgxSebAWgO73fUDkBHvosMDjeHjg0NKBXYfR3kImceo4iJwF0bOeFQA09j+6OKW1EId9r1EzYwPGR0DUDt+A9f4DkU/27dbKUmJovBPIAXtYHErwZ7EW0ITd8ebNXyOiArz8JJietDsR++lwetArzrDszsPsiumoSu1/FajtbBfUQqllxJBeoIqNEPHQED2ysSWzqTlHe8tfmY3Vp/PlZh8GbpA/EV5uikWzDSaZbADqXGny/xd+g+8mm4J3DxgPOEEgFqeg+q4C1U4yEy3gYkknT6AcIO8MGOa3daRowEv2zfhVlrNhv2ezLjzsPBQJSK/ph9KZbYiREZVCBQioJJlvfG/dkkycjkVqvTNtn3swhipxUqYc0vKmXFG+R9+fUOP5u9ctqmdIf7Jclew4OBO1ML+sH+l6NojgfX+T+OqQ8EyNMY2Aa7i24ppwS8ySDwyYEk9kjopVZ8L3MSw3CQnWBNMg734qUawCUoFMtGPZ0jC+o6DiV18xpkB1Ffrmjs+72AoKk6wR9zIYyVQG7wr7O4PLWeXEX2NgBDeKaWi0gHInVAb2puJKgGgaZbImuecSaKaqA0y1fXu3+4teozv9eLkBxhYUJRwIBQbA7E3lQ4ocziE3ZMxdAIGAOEJHgDs6UreB4ZMLgdKxqhYzR3GxrmZmspOw/TVBGGjClrefGZh0/gLkXSDZ0uugW1rNM3TkA9t2U0eBCNyRh+8sScUKzja4Ei2ukkfoCNEf0alJkG3udwBtjDBcTRhQJARFD+UWMut5Xqw/dAxs777/VmY00/wD9FaCq0aVc/CJI++oGYgunPDd7ACSTyuY0UST1AEBrCrFBB+T+eKrFcU/4gBXEGiAY4x8lrp7fNZ/nsGFvBvs5sxq9NvLFXGA8Tv3LHU8x8m8oGHVnT0AaFJIKM8vGf2bkdD89EmQkKG9pfnKPCTbyFszqOJlgORDLSn9bNvDYlVC3dS5HQbqdv1a1fn1WrLDEXTNuD1Nj6dJXUBLAZfqzRHaPRi04YNpw9MY+c6f3XmAvNmwrFgdnxHja47ObX4XGigltlCWUSImRboBinCeZ9k9GdQ82Pw36dO433Z3IjtjuFLTWFsUurpAvmgiemzJ3xnhra6pOEr2jy2dw6fUL4gMQtPpSwqB4Qd9TY6MOUpwBqK0MpuRMBisa3zOBphJyvnXOIG9RCYzivzOQM+PKzLmznjTyeql1Ipj/9LwEgQ==,iv:PbRgjgm5ERWlAkkWc7As8eIx8e0rjTUkQ7XlDBrEUlU=,tag:yh2/JuHu5I+dWlxVAmkkXA==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSByOGNaakZoV3lhemhMSVVF
+            RklKbEsxeVFMWWdwQ3ZqR0lhRHlPM1dWT3h3Cnk2RnZUNnplVEwvNW9qMExsSUlt
+            VVVXejMrcDRRTEdtT1krdThqWThLWWcKLS0tIEVZZEVBWFZyVi84S1puRHdtMWR1
+            cDBHc1J5aHFpQkxSSEx2VDRjZ1RsdXcKG5MgnUBpFmlNGSkxBijXp7m492ujyqsC
+            TbTfU8SWJwXhio7V+zDbXG+JW4R51wr9F9Sj47DCw7b64nbsD3N5TQ==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1e5fq3hwxy78psus2nfvmtmua36g0u3suk78ephw6246l974d2utsvn0hla
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-10-26T02:15:51Z"
+    mac: ENC[AES256_GCM,data:+2eGERwwzeK5JE9H6qhsu+tskR3Y9c7DecVGopfG8Ggq5SHQBfYyvz//IU+MGCOb6nIyP3JPf9+9IDS2DthVcw+RLtviQkN1TeWuUTDbxBxHdCoUv9zepwU7+d0qUMrdUK0N9QQSRZ4TpiwceViDeMuhPF/vTmADP9QWwid/qwk=,iv:nuJo37Dh8MAf+qI/Ty2jsW0IheNhgmZ4l0Va8pJG6+4=,tag:vCpifXvYF1/QU7XExc6raQ==,type:str]
+    version: 3.13.2

k8s/bootstrap/cert-manager/homelab-ca-configmap.yaml

@@ -271,3 +271,40 @@ data:
     NDKi7/Gxha790QN3TD/U7p9GcEtfXKv8KISKfxnfD9o9Yx6pWOXcgvGefQkpXuRm
     kGzDM+aY/VKs5Et5/RyKavBDihuOcumLsmoRg/bFoB/xpeURTyiehUdu
     -----END CERTIFICATE-----
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: homelab-ca
+  namespace: cloudflared
+data:
+  ca.crt: |
+    -----BEGIN CERTIFICATE-----
+    MIIFBjCCAu6gAwIBAgIJAKoBPdKPDL5AMA0GCSqGSIb3DQEBCwUAMDAxEzARBgNV
+    BAMMCmhvbWVsYWItY2ExGTAXBgNVBAoMEHJpb3RwaWFvLmhvbWVsYWIwHhcNMjYw
+    ODEyMjA1NDQzWhcNMzYwODA5MjA1NDQzWjAwMRMwEQYDVQQDDApob21lbGFiLWNh
+    MRkwFwYDVQQKDBByaW90cGlhby5ob21lbGFiMIICIjANBgkqhkiG9w0BAQEFAAOC
+    Ag8AMIICCgKCAgEAzw796vZRFOBc/orUu9J6rv91A3SNLJsqz/VuetwAXCaVSlK5
+    kL/RaBKKkcXToCC5avwix6W21FnwLUW4R8QlQdin8+XEHpx2LY5R4GmSvaCbU7wm
+    YwYgVGQVv8KlgcMbz/pF09vXU29cHUHwlkN+BWVGAxVGWxam94j1pBzV0dOhhRw2
+    q5sZYUUrPO5l775od2FMMnMzoRFugxDvJof0p3fAChNAIiFhP95lrcb2YsTwK+a2
+    6mk3AZc0gMtmgVsH+zryGFcAmWLixq41ye/H23ktj2bjEHCr9mIDpuSOKLyLBzrg
+    js/HqdxvwkZkkxwXft0Vi7GN0/LGHMdPrDE499pJelAHbxUpBoOk8sfXSNnfESI8
+    v20LybATGrKXFlOhMKshY1a3JLAoZTaW0xkG4PM4HT7lK/ovr/NLF6kdP7HxJFFQ
+    +4WjySiwbjusNobpTaQWVwCjD3Imf+2feAqJeX3z+P3EhxfrmvEojLOdUiiPcjMn
+    CFl9u2EpSlax53umSkcBQJGfFKM17fZzhtakjqhCTzAfXXlxZy4hsHDtfzRcfaoB
+    Zz/PiJ0TtJSC7TvxZZoPpGexQdoeT7kJEksTvGi5OSfJD7HaKe5RQSZGgpz7ATB+
+    YMBKbjhMXVu+TAdcO1qZRN0UCncrliN61ki9F0tE8kNgpS9biZ6kheoJMZUCAwEA
+    AaMjMCEwDwYDVR0TAQH/BAUwAwEB/zAOBgNVHQ8BAf8EBAMCAYYwDQYJKoZIhvcN
+    AQELBQADggIBAFN1At11d/+Ue6cEjCklnRQpLuD5agXaE+pi5oHNfnggSlO8UjUj
+    lDzfnmxi3IAI6HruzDARM9J95qJboUxWOAEmK9SNnZNS/1b0GyikP3YcF1gIFqtW
+    6SgmVfC1cVUFKGt/+QQzZxhOLuoydv9Ozu12nxsTW/WY2t+cpeL+1wrsM22RA6W/
+    xV/bzYbwzCUT9v4tMZLZHk5CkXztVFXSJyW/8w9rVZdUGZM+mwwn81PLSE0v3s/2
+    wJH8eUqGl73i3Xgn7CVanN4cJYMGYVVlRD6Qr6muBN4Vh0ETY1PrjzsZ6XsV6vk9
+    glMbQnErYMZHZIDtnVdaBt60MecUD9O4eLeip0SE6bVRAucKBXA9xNMilMQEL8/X
+    FBMAxXl10rowBlbX2oaFSOM80eLTla4a3gSL7+0vua3C4Dtv2bLo8ZjCyqXwOJeb
+    N85cqcVZStz3qlgQN1nG2qGE3BS6scOs7+mUGe9CmS8acJV++PKm8CtmLH6/ibjV
+    tAc/6+Vg/keo0kty7H7L6oQd+gKpuaJ2I+wKYe4l9UwHi9zEb8YjzGB4n2AtsoWI
+    NDKi7/Gxha790QN3TD/U7p9GcEtfXKv8KISKfxnfD9o9Yx6pWOXcgvGefQkpXuRm
+    kGzDM+aY/VKs5Et5/RyKavBDihuOcumLsmoRg/bFoB/xpeURTyiehUdu
+    -----END CERTIFICATE-----

k8s/bootstrap/ingress/ingress.yaml

@@ -49,30 +49,6 @@ spec:
                 port:
                   number: 3100
 
----
-# ── Authentik ─────────────────────────────────────────────────────────────────
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: authentik
-  namespace: iam
-  annotations:
-    nginx.ingress.kubernetes.io/proxy-buffer-size: "16k"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
-spec:
-  ingressClassName: nginx
-  rules:
-    - host: authentik.riotpiao.com
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: authentik-server
-                port:
-                  number: 80
-
 ---
 # ── Vault ─────────────────────────────────────────────────────────────────────
 apiVersion: networking.k8s.io/v1
@@ -299,28 +275,3 @@ spec:
                 name: temporal-web
                 port:
                   number: 8080
----
-# NOTE: api.riotpiao.com is deliberately NOT here. Its namespace `api` is
-# created in wave 7, and this Application syncs in wave 1 — an Ingress into a
-# namespace that doesn't exist yet would fail and mark this whole app
-# SyncFailed. It lives in k8s/apps/api/ingress.yaml, synced by the api-gw
-# Application.
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: homarr
-  namespace: dashboard
-spec:
-  ingressClassName: nginx
-  rules:
-    - host: homarr.riotpiao.com
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: homarr
-                port:
-                  number: 7575
-

k8s/bootstrap/phase4-argocd/argocd-values.yaml

@@ -138,12 +138,15 @@ configs:
     #   cicd  — automation-only; apiKey (token) for the CD pipeline, no UI login.
     accounts.rock: apiKey,login
     accounts.cicd: apiKey
-    # Authentik OIDC. clientSecret pulled from the argocd `oidc-secret` Secret
-    # (created by authentik-provision). The groups claim drives RBAC below.
+    # Zitadel OIDC. clientSecret pulled from the argocd `oidc-secret` Secret.
+    # The groups claim drives RBAC below.
     oidc.config: |
-      name: Authentik
-      issuer: https://authentik.riotpiao.com/application/o/argocd/
-      clientID: argocd
+      name: Zitadel
+      issuer: https://zitadel.riotpiao.com
+      # MUST be quoted: an unquoted 18-digit number is parsed as a float by the
+      # YAML parser and ArgoCD rejects it ("cannot unmarshal number into ...
+      # clientID of type string"). Same class of bug as Grafana's client_id.
+      clientID: "396757801210282367"
       clientSecret: $oidc-secret:client-secret
       requestedScopes:
         - openid
@@ -158,7 +161,7 @@ configs:
     server.insecure: false
 
   # RBAC. local `admin` + `rock` + the `cicd` pipeline account all get role:admin;
-  # the Authentik `homelab-admins` group (rock is a member) maps to admin so SSO
+  # the Zitadel `homelab-admins` role (rock is a member) maps to admin so SSO
   # logins are admin too.
   rbac:
     policy.default: role:readonly

k8s/infra/databases/authentik-db.yaml

@@ -1,38 +0,0 @@
-# Dedicated CNPG Postgres for Authentik (GitOps, wave 2 — before authentik w3).
-# CNPG generates secret `authentik-db-app` + service `authentik-db-rw` in ns iam;
-# authentik-values reads them locally (no cross-ns secret copy).
-apiVersion: postgresql.cnpg.io/v1
-kind: Cluster
-metadata:
-  name: authentik-db
-  namespace: iam
-  annotations:
-    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
-spec:
-  instances: 3
-  imageName: ghcr.io/cloudnative-pg/postgresql:16.2
-  bootstrap:
-    initdb:
-      database: authentik
-      owner: app
-      encoding: UTF8
-      localeCollate: C
-      localeCType: C
-  enableSuperuserAccess: false
-  resources:
-    requests: { memory: "512Mi", cpu: "250m" }
-    limits: { memory: "2Gi", cpu: "1" }
-  storage:
-    size: 10Gi
-    storageClass: longhorn-cnpg
-  monitoring:
-    enablePodMonitor: true
-  affinity:
-    # preferred + tolerations: HA across nodes without deadlocking a partly-
-    # schedulable 3-CP (same as forgejo-db).
-    podAntiAffinityType: preferred
-    topologyKey: kubernetes.io/hostname
-    tolerations:
-      - key: node-role.kubernetes.io/control-plane
-        operator: Exists
-        effect: NoSchedule

k8s/infra/databases/kustomization.yaml

@@ -6,7 +6,6 @@ kind: Kustomization
 # deployed into it. paperless ns declared in namespaces.yaml above.
 resources:
   - namespaces.yaml
-  - authentik-db.yaml
   - zitadel-db.yaml
   - temporal-db.yaml
   - paperless-db.yaml

k8s/infra/databases/namespaces.yaml

@@ -1,7 +1,7 @@
 # DB clusters are wave 2 — their namespaces must exist first (their apps that
 # would CreateNamespace run later, w3/w8). Declared here so the databases App
-# creates them. authentik/vault/temporal/paperless CreateNamespace=true then
-# no-ops. poimen namespace created by poimen-root app (wave 7).
+# creates them. vault/temporal/paperless CreateNamespace=true then no-ops.
+# poimen namespace created by poimen-root app (wave 7).
 apiVersion: v1
 kind: Namespace
 metadata:

k8s/infra/iam/authentik-values.yaml

@@ -1,284 +0,0 @@
-# k8s/talos-iam/authentik-values.yaml
-# Authentik — SSO Identity Provider for the homelab.
-# Provides OAuth2/OIDC login for Grafana, MinIO, Forgejo, and Argo CD.
-# Chart: authentik/authentik from https://charts.goauthentik.io
-#
-# Architecture: server (UI+API) + worker (background tasks) + PostgreSQL + Redis.
-# PostgreSQL is the system of record — must persist. Redis is ephemeral cache/queue.
-#
-# Secrets injected via helmfile --set (from .env / vsource):
-#   AUTHENTIK_SECRET_KEY         — signs sessions and tokens; set once, never rotate casually
-#   AUTHENTIK_BOOTSTRAP_PASSWORD — initial akadmin password (used once at first login)
-#   AUTHENTIK_BOOTSTRAP_TOKEN    — API token for the setup_talos_iam.sh bootstrap script
-#   AUTHENTIK_PG_PASSWORD        — PostgreSQL user password
-
-authentik:
-  # host: the external URL Authentik uses to build redirect URIs in OAuth2 flows.
-  # Must match what the browser sees — if it returns an internal svc URL,
-  # the browser's redirect after login will fail (can't reach svc DNS externally).
-  # HTTP (not HTTPS) because the Authentik ingress has no TLS cert configured.
-  host: "https://authentik.riotpiao.com"
-
-  error_reporting:
-    enabled: false   # do not phone home to Sentry
-
-  # PostgreSQL connection — points at CloudNativePG cluster in ddb namespace.
-  # Uses 'app' bootstrap user (CNPG simple pattern, same as Forgejo).
-  # Credentials injected from authentik-db-app secret via env vars below.
-  postgresql:
-    host: authentik-db-rw.iam.svc.cluster.local
-    port: 5432
-    name: authentik
-    user: app  # All apps use shared 'app' user (CNPG design pattern)
-    password: ""  # overridden by AUTHENTIK_POSTGRESQL__PASSWORD env var
-
-  # Redis connection — bundled subchart, standalone mode (no sentinel/cluster).
-  redis:
-    host: authentik-redis-master
-
-  # ── HTTP client timeouts ──────────────────────────────────────────────────────
-  # Increased to tolerate 5+ second pod-to-pod network latency.
-  # Affects webhooks, outpost management, SCIM, LDAP sync.
-  # Default: ~30s — too aggressive when latency spikes hit 5-10s.
-  log_level: debug  # enable debug logging to monitor connection issues
-
-# ── CA trust (shared by server and worker) ────────────────────────────────────
-# Authentik (Python/Debian) uses requests + httpx for outgoing HTTPS — webhooks,
-# outpost management, SCIM. Both libraries need REQUESTS_CA_BUNDLE / SSL_CERT_FILE
-# to point to a bundle that includes homelab-ca, otherwise connections to other
-# homelab services fail with "certificate signed by unknown authority".
-#
-# Strategy: a debian:12-slim init container (run as root) concatenates the
-# Debian system Mozilla bundle with homelab-ca.crt into an emptyDir. The main
-# container then references /merged/ca-bundle.crt via two env vars that cover
-# every Python HTTP library.
-_caVolumes: &caVolumes
-  - name: homelab-ca
-    configMap:
-      name: homelab-ca
-  - name: merged-ca
-    emptyDir: {}
-
-_caVolumeMounts: &caVolumeMounts
-  - name: homelab-ca
-    mountPath: /homelab-ca
-    readOnly: true
-  - name: merged-ca
-    mountPath: /merged
-    readOnly: true
-
-_caInitContainers: &caInitContainers
-  - name: merge-ca-certs
-    image: debian:bookworm
-    imagePullPolicy: IfNotPresent
-    securityContext:
-      runAsUser: 0
-    command:
-      - sh
-      - -c
-      - (cat /etc/ssl/certs/ca-certificates.crt 2>/dev/null; cat /homelab-ca/homelab-ca.crt) > /merged/ca-bundle.crt
-    volumeMounts:
-      - name: homelab-ca
-        mountPath: /homelab-ca
-        readOnly: true
-      - name: merged-ca
-        mountPath: /merged
-  # NOTE: no authentik-migrate init container — the authentik `server` entrypoint
-  # runs migrations itself on startup. A separate `manage migrate` init pinned to
-  # an older image tripped a version-history precheck on an empty DB
-  # (relation "authentik_version_history" does not exist) and blocked boot.
-
-_caEnv: &caEnv
-  - name: REQUESTS_CA_BUNDLE
-    value: /merged/ca-bundle.crt
-  - name: SSL_CERT_FILE
-    value: /merged/ca-bundle.crt
-
-# ── Authentik server (UI + API) ───────────────────────────────────────────────
-# Handles all browser traffic: login flows, admin UI, OAuth2 authorize/token endpoints.
-# NodePort 32172 is a fallback for direct node access during troubleshooting;
-# normal access is via nginx ingress (authentik.riotpiao.com → svc:80).
-# Recreate: single replica + RWO-adjacent state — avoids split-brain on redeploy.
-server:
-  replicas: 1
-  # Merge SOPS-CMP-emitted secret values after the chart's own `authentik` secret.
-  envFrom:
-    - secretRef:
-        name: authentik-secrets
-  deploymentStrategy:
-    type: Recreate
-  service:
-    type: NodePort
-    nodePort: 32172
-  resources:
-    requests:
-      cpu: 100m
-      memory: 512Mi
-    limits:
-      cpu: 1000m
-      memory: 1Gi
-  tolerations:
-    - key: node-role.kubernetes.io/control-plane
-      operator: Exists
-      effect: NoSchedule
-  volumes: *caVolumes
-  volumeMounts: *caVolumeMounts
-  initContainers: *caInitContainers
-  env:
-    # Merge CA trust env vars
-    - name: REQUESTS_CA_BUNDLE
-      value: /merged/ca-bundle.crt
-    - name: SSL_CERT_FILE
-      value: /merged/ca-bundle.crt
-    # Override database credentials to use 'app' from authentik-db-app
-    - name: AUTHENTIK_POSTGRESQL__USER
-      valueFrom:
-        secretKeyRef:
-          name: authentik-db-app
-          key: username
-    - name: AUTHENTIK_POSTGRESQL__PASSWORD
-      valueFrom:
-        secretKeyRef:
-          name: authentik-db-app
-          key: password
-  podAnnotations:
-    configmap.reloader.stakater.com/reload: "homelab-ca"
-    homelab.io/restart-at: "2026-06-21T13-40"
-  # The /-/health/{live,ready}/ endpoints do a DB round-trip; under transient
-  # CNPG contention they respond in 5-6s while still returning 200. The chart's
-  # default 3s liveness timeout then flags a working backend as dead and kubelet
-  # kills it in a restart loop — the pod never stays Ready, gets dropped from the
-  # authentik-server Service endpoints, and the OAuth-provisioning PostSync hook
-  # fails with "Host is unreachable". Widen the timeouts so slow-but-healthy
-  # checks aren't treated as failures. (Only these fields are overridden; the
-  # chart deep-merges the rest of each probe, incl. the httpGet path.)
-  livenessProbe:
-    initialDelaySeconds: 300  # skip probe until 5min passed (migrations finish)
-    timeoutSeconds: 15
-    failureThreshold: 6
-  readinessProbe:
-    initialDelaySeconds: 300  # skip probe until migrations complete
-    timeoutSeconds: 15
-    failureThreshold: 6
-  startupProbe:
-    timeoutSeconds: 15
-    failureThreshold: 120  # 120 × 10s = 20min for fresh DB migrations
-  # Every OIDC login (Grafana, Argo CD, MinIO, Forgejo) depends on this server —
-  # its request latency/error rate explains SSO-driven slowness on those services.
-  metrics:
-    enabled: true
-    serviceMonitor:
-      enabled: true
-      scrapeTimeout: 30s
-
-# ── Authentik worker ──────────────────────────────────────────────────────────
-# Runs background tasks: email delivery, LDAP sync, flow policy evaluation,
-# event log cleanup, and managed outpost updates. Stateless — no PVC needed.
-# Same resource profile as server; Authentik 2023+ merged some worker duties
-# into the server process but the worker pod is still required.
-worker:
-  replicas: 1
-  envFrom:
-    - secretRef:
-        name: authentik-secrets
-  deploymentStrategy:
-    type: Recreate
-  resources:
-    requests:
-      cpu: 100m
-      memory: 512Mi
-    limits:
-      cpu: 1000m
-      memory: 1Gi
-  tolerations:
-    - key: node-role.kubernetes.io/control-plane
-      operator: Exists
-      effect: NoSchedule
-  volumes: *caVolumes
-  volumeMounts: *caVolumeMounts
-  initContainers: *caInitContainers
-  env:
-    # Merge CA trust env vars
-    - name: REQUESTS_CA_BUNDLE
-      value: /merged/ca-bundle.crt
-    - name: SSL_CERT_FILE
-      value: /merged/ca-bundle.crt
-    # Override database credentials to use 'app' from authentik-db-app
-    - name: AUTHENTIK_POSTGRESQL__USER
-      valueFrom:
-        secretKeyRef:
-          name: authentik-db-app
-          key: username
-    - name: AUTHENTIK_POSTGRESQL__PASSWORD
-      valueFrom:
-        secretKeyRef:
-          name: authentik-db-app
-          key: password
-  podAnnotations:
-    configmap.reloader.stakater.com/reload: "homelab-ca"
-    homelab.io/restart-at: "2026-06-21T13-40"
-  livenessProbe:
-    initialDelaySeconds: 300  # skip probe until 5min passed (migrations finish)
-  readinessProbe:
-    initialDelaySeconds: 300  # skip probe until migrations complete
-  startupProbe:
-    initialDelaySeconds: 30  # let server finish DB work first
-    failureThreshold: 120
-  metrics:
-    enabled: true
-    serviceMonitor:
-      enabled: true
-      scrapeTimeout: 30s
-
-# ── PostgreSQL (external: CloudNativePG cluster in ddb namespace) ─────────────
-# Authentik connects to the dedicated authentik-db (1 primary + 2 replicas).
-# Do not use the bundled Bitnami subchart — CNPG is already running.
-postgresql:
-  enabled: false
-  primary:
-    persistence:
-      enabled: true
-      storageClass: longhorn
-      size: 8Gi
-    tolerations:
-      - key: node-role.kubernetes.io/control-plane
-        operator: Exists
-        effect: NoSchedule
-    affinity:
-      nodeAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-          - weight: 100
-            preference:
-              matchExpressions:
-                - key: node-role.kubernetes.io/worker
-                  operator: Exists
-
-# ── Bundled Redis ─────────────────────────────────────────────────────────────
-# Cache and async task queue only — no durable data. If Redis restarts, in-flight
-# background tasks are retried and cached tokens are recomputed. Losing Redis
-# data does not lose user accounts or flow configuration (that's in PostgreSQL).
-# persistence: false saves a PVC and makes restarts faster.
-#
-# Same prefer-worker / fallback-to-cp scheduling as PostgreSQL.
-# architecture: standalone — no Sentinel/cluster overhead for a 3-node homelab.
-redis:
-  enabled: true
-  master:
-    persistence:
-      enabled: false
-    tolerations:
-      - key: node-role.kubernetes.io/control-plane
-        operator: Exists
-        effect: NoSchedule
-    affinity:
-      nodeAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-          - weight: 100
-            preference:
-              matchExpressions:
-                - key: node-role.kubernetes.io/worker
-                  operator: Exists
-  architecture: standalone
-
-# Ingress disabled — rule lives in k8s/ingress/ingress.yaml (authentik.riotpiao.com).
-# For direct access during bootstrap: kubectl -n iam port-forward svc/authentik-server 7000:80

k8s/infra/iam/kustomization.yaml

@@ -2,11 +2,12 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 
 resources:
-  - rbac-dashboard-rolebinding.yaml
+  # Removed: rbac-dashboard-rolebinding.yaml (authentik-provisioner SA and
+  # RoleBinding). Authentik is retired, so the file is gone; keep this list in
+  # step with the directory or kustomize fails the whole app.
+  - smtp-gotify.yaml
 
 # IAM provisioning is manual-only (security-sensitive).
-# Script: scripts/iam/authentik-provision.py
+# Script: scripts/iam/zitadel-provision.py
 # Run:
-#   export AUTHENTIK_BOOTSTRAP_TOKEN=$(kubectl -n iam get secret authentik-secrets \
-#     -o jsonpath='{.data.AUTHENTIK_BOOTSTRAP_TOKEN}' | base64 -d)
-#   python3 scripts/iam/authentik-provision.py
+#   scripts/iam/zitadel-provision.py all

k8s/infra/iam/rbac-dashboard-rolebinding.yaml

@@ -1,13 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: authentik-provisioner
-  namespace: dashboard
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: authentik-provisioner
-subjects:
-- kind: ServiceAccount
-  name: authentik-provisioner
-  namespace: iam

k8s/infra/iam/smtp-gotify.yaml

@@ -0,0 +1,108 @@
+# SMTP -> Gotify relay for ZITADEL notifications.
+#
+# ZITADEL sends verification codes, password resets and one-time passwords by
+# SMTP only, and this cluster has no working mail path: no SMTP credentials are
+# configured for ZITADEL, and the notification table shows
+# verified_email empty for every user. Without a delivery path nobody can finish
+# a first login, at ZITADEL or at any relying party such as Forgejo.
+#
+# This relay accepts plain SMTP on :2525 and forwards every message to Gotify,
+# so codes arrive on the phone through the existing gotify/igotify setup instead
+# of email. ZITADEL then points DefaultInstance.SMTPConfiguration at this
+# Service (see k8s/infra/iam/zitadel-values.yaml).
+#
+# The Gotify token is a Secret, never a literal here.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: smtp-gotify
+  namespace: iam
+  labels:
+    app: smtp-gotify
+spec:
+  replicas: 1
+  revisionHistoryLimit: 2
+  selector:
+    matchLabels:
+      app: smtp-gotify
+  template:
+    metadata:
+      labels:
+        app: smtp-gotify
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 65534
+        runAsGroup: 65534
+        seccompProfile:
+          type: RuntimeDefault
+      volumes:
+        - name: tmp
+          emptyDir: {}
+      containers:
+        - name: smtp-gotify
+          image: quay.io/reiml/smtp-gotify:latest
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: GOTIFY_URL
+              value: "http://gotify.notifications.svc.cluster.local/"
+            - name: GOTIFY_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: smtp-gotify
+                  key: token
+            - name: GOTIFY_PRIORITY
+              value: "5"
+            # No title template: the relay's default title already carries
+            # the mail subject, and a wrong template field fails the push
+            # silently (the SMTP side still answers 250, so the sender thinks
+            # the message was delivered).
+          ports:
+            - name: smtp
+              containerPort: 2525
+              protocol: TCP
+          volumeMounts:
+            # The relay stages each message in /tmp before the Gotify push.
+            # With readOnlyRootFilesystem it accepted SMTP (250 queued) and
+            # then silently dropped the message: no push, no error.
+            - name: tmp
+              mountPath: /tmp
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop: ["ALL"]
+          resources:
+            requests:
+              cpu: 10m
+              memory: 32Mi
+            limits:
+              cpu: 200m
+              memory: 128Mi
+          readinessProbe:
+            tcpSocket:
+              port: smtp
+            initialDelaySeconds: 3
+            periodSeconds: 10
+          livenessProbe:
+            tcpSocket:
+              port: smtp
+            initialDelaySeconds: 10
+            periodSeconds: 20
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: smtp-gotify
+  namespace: iam
+  labels:
+    app: smtp-gotify
+spec:
+  type: ClusterIP
+  selector:
+    app: smtp-gotify
+  ports:
+    - name: smtp
+      port: 2525
+      targetPort: smtp
+      protocol: TCP

k8s/infra/iam/vault-values.yaml

@@ -81,6 +81,15 @@ server:
     - envName: VAULT_UNSEAL_KEY_3
       secretName: vault-unseal-keys
       secretKey: key3
+    # Zitadel OIDC client credentials for the Vault UI login method. Consumed by
+    # the postStart hook below, which enables auth/oidc via the Vault API after
+    # unsealing. Vault auth methods cannot be declared in HCL, only via API/CLI.
+    - envName: OIDC_CLIENT_ID
+      secretName: vault-oidc-creds
+      secretKey: OIDC_CLIENT_ID
+    - envName: OIDC_CLIENT_SECRET
+      secretName: vault-oidc-creds
+      secretKey: OIDC_CLIENT_SECRET
 
   # ── Auto-unseal ─────────────────────────────────────────────────────────────
   # Vault starts sealed after every pod restart and can't serve requests until
@@ -97,6 +106,28 @@ server:
       vault operator unseal "$VAULT_UNSEAL_KEY_2" || true
       vault operator unseal "$VAULT_UNSEAL_KEY_3" || true
 
+      # ── Zitadel OIDC login method ────────────────────────────────────────
+      # Vault auth methods are API-driven: they cannot be declared in HCL.
+      # Enable auth/oidc and write its config on every pod start. Both calls
+      # are idempotent (auth enable returns 400 "already enabled", which we
+      # tolerate; the config write always succeeds and overwrites).
+      vault auth enable oidc 2>/dev/null || true
+      vault write auth/oidc/config \
+        oidc_discovery_url="https://zitadel.riotpiao.com" \
+        oidc_client_id="$OIDC_CLIENT_ID" \
+        oidc_client_secret="$OIDC_CLIENT_SECRET" \
+        default_role="default" 2>/dev/null || true
+      # The role binds the Zitadel client_id as audience and whitelists the UI
+      # callback URL. Policy `default` gives a logged-in operator standard
+      # read access; admin actions still require a token with root/sudo.
+      vault write auth/oidc/role/default \
+        bound_audiences="$OIDC_CLIENT_ID" \
+        allowed_redirect_uris="https://vault.riotpiao.com/ui/vault/auth/oidc/oidc/callback" \
+        allowed_redirect_uris="http://localhost:8200/ui/vault/auth/oidc/oidc/callback" \
+        user_claim="preferred_username" \
+        oidc_scopes="openid,profile,email,groups" \
+        policies="default" 2>/dev/null || true
+
   # ── Vault config (HCL) ──────────────────────────────────────────────────────
   standalone:
     enabled: true

k8s/infra/iam/zitadel-values.yaml

@@ -31,6 +31,14 @@ zitadel:
     ExternalDomain: zitadel.riotpiao.com
     TLS:
       Enabled: false
+    # First boot is COMPLETE (2026-10-26): the instance, the system org and the
+    # `iam-admin` machine key all exist. Skip stops the setup hook from running
+    # the first-instance step again. Without it, every sync re-runs the
+    # machinekeyWriter, which silently rotates the iam-admin key Terraform
+    # reads. ZITADEL objects are declared by scripts/iam/zitadel-provision.py.
+    # Never set this back to false.
+    FirstInstance:
+      Skip: true
 
   # Rendered into a Secret by the chart; read by pods and init jobs alike.
   masterkeySecretName: zitadel-masterkey
@@ -39,6 +47,20 @@ zitadel:
     requests: { memory: "512Mi", cpu: "250m" }
     limits: { memory: "2Gi", cpu: "1" }
 
+  # Best practice: run as non-root, drop all capabilities, and refuse
+  # privilege escalation. The chart's image already supports a non-root UID.
+  securityContext:
+    runAsNonRoot: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    allowPrivilegeEscalation: false
+    readOnlyRootFilesystem: true
+    capabilities:
+      drop:
+        - ALL
+    seccompProfile:
+      type: RuntimeDefault
+
   # FirstInstance defaults stay for the FIRST sync: the chart creates org
   # `zitadel` plus the `iam-admin` machine user and its machine-key Secret.
   # Terraform consumes that key to declare projects, roles, OIDC apps and the
@@ -84,27 +106,113 @@ postgresql:
 # CNPG already created the database, the `app` user and its grants, so the init
 # job runs only the ZITADEL-internal step. Running the full default command
 # would try to create a database and a superuser it does not own.
+#
+# enabled: false after the first successful boot (2026-10-26). The schema is in
+# place; the init hook has nothing left to do and re-running it on every sync
+# only adds a PreSync failure surface. Re-enable it for a deliberate schema
+# upgrade, then set it back to false.
 initJob:
+  enabled: false
   command: "zitadel"
   activeDeadlineSeconds: 600
 
+# The setup job runs the full first-instance creation: schema migrations, the
+# system org, the iam-admin machine key, and 13 projection replays. 20 minutes
+# leaves room for a cold database without masking a genuine hang.
+#
+# DONE, 2026-10-26 — first boot completed. The annotations are moved from
+# pre-install/pre-upgrade to post-delete because a PreSync setup run is not
+# harmless after boot:
+#  - it re-runs every repeatable migration on every sync;
+#  - interrupting one (a sync aborted, or a human deleting the Job) leaves a
+#    `system.migration.started` event with no matching `done`, and ZITADEL then
+#    waits forever on `migration already started`. That is exactly how this
+#    instance deadlocked on projections.projects4 and later on
+#    repeatable_delete_stale_org_fields.
+# A post-delete hook is never executed by ArgoCD sync, so setup runs only on
+# first install. Re-enable it deliberately (and only with initJob too) for a
+# schema upgrade, then revert.
+setupJob:
+  activeDeadlineSeconds: 1200
+  annotations:
+    helm.sh/hook: post-delete
+    helm.sh/hook-delete-policy: hook-succeeded
+    helm.sh/hook-weight: "2"
+
 # Two API replicas: the read path survives one node drain, and both share the
 # same masterkey and database. The login UI stays at one replica — a session
 # cookie is not shared, so a second pod buys nothing.
 replicaCount: 2
 revisionHistoryLimit: 3
 
+# Notification delivery lives in the ConfigMap owned by the zitadel-core app
+# (k8s/infra/zitadel-core/). Env overrides here produced no SMTP provider, and
+# editing configmapConfig made ArgoCD drop the rendered ConfigMap.
+
+# Best practice: a PDB guarantees at least one API pod stays available during
+# voluntary disruptions (node drain, rolling upgrade). Without it a drain can
+# take both replicas down at once. minAvailable 1 is correct for 2 replicas;
+# minAvailable 2 would block every drain forever.
+pdb:
+  enabled: true
+  minAvailable: 1
+
+# Best practice: spread replicas across nodes so a single node failure cannot
+# take both API pods. Anti-affinity alone only prefers separation; topology
+# spread enforces the failure-domain budget.
+topologySpreadConstraints:
+  - maxSkew: 1
+    topologyKey: kubernetes.io/hostname
+    whenUnsatisfiable: ScheduleAnyway
+    labelSelector:
+      matchLabels:
+        app.kubernetes.io/name: zitadel
+
 ingress:
   enabled: true
   className: nginx
   controller: nginx
 
 login:
-  enabled: true
+  # Built-in login page, not the hosted Login UI.
+  #
+  # The hosted UI authenticates to the ZITADEL API as the machine user
+  # `login-client`, using a JWT-profile assertion signed by the keypair in
+  # zitadel-login-service-key. That machine user is created by the chart's
+  # setup job, which this install runs only once (setupJob is deliberately
+  # disabled after the first sync). Without the user, every session write
+  # fails and the user sees "Could not create session for user", so no one
+  # can sign in here or at any relying party such as Forgejo.
+  #
+  # The built-in login serves the same flows from the ZITADEL server and
+  # needs no machine user. Turn this back on only after creating
+  # `login-client` and registering the matching public key.
+  enabled: false
+  # ksops owns this Secret (k8s/argocd/secrets/zitadel-login-service-key.enc.yaml,
+  # rendered by the sops-secrets Application). Pointing the chart at it stops the
+  # chart from auto-generating an RSA keypair every render, which changed
+  # checksum/secret-login-service-key and kept both Deployments permanently
+  # OutOfSync. The keypair must stay RSA: the login container signs JWTs (RS256).
+  loginServiceKeySecretName: zitadel-login-service-key
   replicaCount: 1
+  revisionHistoryLimit: 3
   ingress:
     enabled: true
     className: nginx
+  # Best practice: the login UI is the public attack surface. Harden the pod
+  # even at one replica. The chart has no login PDB key; a single replica has
+  # nothing to protect with minAvailable.
+  securityContext:
+    runAsNonRoot: true
+    runAsUser: 1000
+    runAsGroup: 1000
+    allowPrivilegeEscalation: false
+    readOnlyRootFilesystem: true
+    capabilities:
+      drop:
+        - ALL
+    seccompProfile:
+      type: RuntimeDefault
 
 # Chart-owned ServiceMonitor. The cluster's Prometheus runs with
 # serviceMonitorSelectorNilUsesHelmValues=false, so the release label is not

k8s/infra/logging/grafana-values.yaml

@@ -60,28 +60,28 @@ grafana.ini:
   database:
     wal: true
 
-  # ── Authentik OIDC (generic OAuth2) ───────────────────────────────────────
+  # ── ZITADEL OIDC (generic OAuth2) ────────────────────────────────────────
   # Grafana v10+ supports OIDC auto-discovery; we wire it manually here because
-  # Authentik's discovery endpoint is internal-only (no external DNS for iam.svc).
+  # ZITADEL's discovery endpoint is internal-only (no external DNS for iam.svc).
   # All URLs use the external hostname so CoreDNS rewrites them to
-  # authentik-server.iam.svc — this keeps the Host header correct so Authentik
+  # zitadel.iam.svc — this keeps the Host header correct so ZITADEL
   # doesn't return localhost redirects in its token responses.
   #
   # role_attribute_path: JMESPath expression evaluated against the userinfo
   # response. akadmin gets GrafanaAdmin (server admin, can impersonate);
-  # homelab-admins members get Admin (org admin); everyone else Viewer.
+  # homelab-admins role members get Admin (org admin); everyone else Viewer.
   auth.generic_oauth:
     enabled: true
-    name: Authentik
+    name: Zitadel
     allow_sign_up: true  # Allow sync to create/update users from OAuth claims
-    client_id: grafana
+    client_id: "396757801965191169"
     scopes: openid email profile groups
-    auth_url: https://authentik.riotpiao.com/application/o/authorize/
-    token_url: https://authentik.riotpiao.com/application/o/token/
-    api_url: https://authentik.riotpiao.com/application/o/userinfo/
+    auth_url: https://zitadel.riotpiao.com/oauth/v2/authorize
+    token_url: https://zitadel.riotpiao.com/oauth/v2/token
+    api_url: https://zitadel.riotpiao.com/oidc/v1/userinfo
     # Read identity straight from the userinfo/id_token claims. Without these,
     # Grafana falls back to the GitHub-style "<api_url>/emails" call, which
-    # Authentik doesn't serve — request 404s with "Error getting email address"
+    # ZITADEL doesn't serve — request 404s with "Error getting email address"
     # and the whole OAuth login fails.
     email_attribute_path: email
     login_attribute_path: preferred_username  # Use preferred_username — OpenID standard claim, always present
@@ -91,10 +91,10 @@ grafana.ini:
     use_pkce: false
     use_refresh_token: false
     skip_org_role_sync: false  # Sync org roles from OAuth groups
-    tls_skip_verify_insecure: true   # Authentik uses self-signed cert; verify in prod
+    tls_skip_verify_insecure: true   # In-cluster cert; verify in prod
 
 # GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET is injected from the grafana-oidc K8s
-# Secret (created by k8s/talos-iam/setup_talos_iam.sh). envFromSecret mounts
+# Secret (k8s/argocd/secrets/grafana-oidc-secrets.enc.yaml). envFromSecret mounts
 # every key in that secret as an environment variable — keeps secrets out of
 # values files and out of git.
 envFromSecret: grafana-oidc
@@ -209,3 +209,25 @@ sidecar:
       disableDelete: false
       foldersFromFilesStructure: true
     searchNamespace: ALL
+
+# ── Alerting ──────────────────────────────────────────────────────────────────
+# One contact point: Gotify. Gotify refuses Grafana's payload shape with
+# 400 "Field 'message' is required", so a bridge service translates the JSON
+# first (k8s/apps/gotify/bridge). Grafana posts to the bridge, the bridge posts
+# to /message with an app token.
+alerting:
+  contactpoints.yaml:
+    apiVersion: 1
+    contactPoints:
+      - orgId: 1
+        name: gotify
+        receivers:
+          - uid: gotify-webhook
+            type: webhook
+            disableResolveMessage: false
+            settings:
+              url: http://grafana-gotify-bridge.notifications.svc.cluster.local:8080/alert
+              httpMethod: POST
+              # 0 sends every alert in one request. The bridge names the extra
+              # count in the message body.
+              maxAlerts: 0

k8s/infra/minio/minio-provision-paperless-job.yaml

@@ -59,6 +59,7 @@ spec:
               mountPath: /shared
       containers:
         - name: provision
+          # bitnamilegacy/minio-client:2025.7.21-debian-12-r3 replaces the dead quay.io/minio/mc image
           image: docker.io/bitnamilegacy/minio-client:2025.7.21-debian-12-r3@sha256:73bd39f7899a0cef12b8dd5df13aa93a3ed1aaa44236542442e9ac76819ac158
           volumeMounts:
             - name: shared

k8s/infra/minio/minio-tenant.yaml

@@ -103,17 +103,17 @@ spec:
         - https://minio-api.riotpiao.com
       console: https://minio.riotpiao.com
 
-  # ── OIDC via Authentik (server-side env, valid in v2 schema) ────────────────
-  # Use in-cluster URL for config fetch (pod→authentik); browser redirects use
-  # public URLs embedded in the OIDC metadata response (issuer stays public).
+  # ── OIDC via ZITADEL (server-side env, valid in v2 schema) ──────────────────
+  # Use external URL for config fetch (hairpins through ingress-nginx); browser
+  # redirects use public URLs embedded in the OIDC metadata response.
   env:
     - name: MINIO_IDENTITY_OPENID_CONFIG_URL
       # Must use external URL — well-known response contains external issuer/jwks_uri.
       # MinIO validates issuer in JWT matches well-known issuer. Internal URL = mismatch.
       # Hairpins through ingress-nginx but stays in-cluster.
-      value: "https://authentik.riotpiao.com/application/o/minio/.well-known/openid-configuration"
+      value: "https://zitadel.riotpiao.com/.well-known/openid-configuration"
     - name: MINIO_IDENTITY_OPENID_CLIENT_ID
-      value: "minio"
+      value: "396757803257036801"
     - name: MINIO_IDENTITY_OPENID_CLIENT_SECRET
       valueFrom:
         secretKeyRef:
@@ -126,7 +126,7 @@ spec:
     - name: MINIO_IDENTITY_OPENID_REDIRECT_URI
       value: "https://minio.riotpiao.com/oauth_callback"
     - name: MINIO_IDENTITY_OPENID_DISPLAY_NAME
-      value: "Authentik"
+      value: "Zitadel"
     - name: MINIO_IDENTITY_OPENID_SCOPES
       value: "openid,profile,email,groups"
     - name: MINIO_BROWSER_LOGIN_ANIMATION

k8s/infra/monitoring/alerts/svc-authentik-rules.yaml

@@ -1,33 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: PrometheusRule
-metadata:
-  name: authentik-rules
-  namespace: iam
-spec:
-  groups:
-    - name: authentik.rules
-      interval: 15s
-      rules:
-        - alert: AuthentikHighErrorRate
-          expr: |
-            (
-              sum(rate(authentik_http_requests_total{status=~"5.."}[5m]))
-              /
-              sum(rate(authentik_http_requests_total[5m]))
-            ) > 0.05
-          for: 10m
-          labels:
-            severity: warning
-          annotations:
-            summary: "High error rate on Authentik"
-            description: "5xx error rate exceeded 5% of total requests for 10 minutes. Value: {{ $value | humanizePercentage }}"
-
-        - alert: AuthentikOutpostDown
-          expr: |
-            authentik_outpost_total_up == 0
-          for: 5m
-          labels:
-            severity: warning
-          annotations:
-            summary: "Authentik outpost is down"
-            description: "Outpost {{ $labels.outpost_name }} (type: {{ $labels.outpost_type }}) has been offline for 5 minutes"

k8s/infra/monitoring/blackbox-exporter-values.yaml

@@ -43,8 +43,8 @@ serviceMonitor:
       url: https://grafana.riotpiao.com/
     - name: loki
       url: https://loki.riotpiao.com/ready
-    - name: authentik
-      url: https://authentik.riotpiao.com/-/health/ready/
+    - name: zitadel
+      url: https://zitadel.riotpiao.com/debug/ready
     - name: vault
       url: https://vault.riotpiao.com/v1/sys/health
     - name: minio-console

k8s/infra/monitoring/kustomization.yaml

@@ -7,7 +7,6 @@ kind: Kustomization
 resources:
   - alerts/ingress-alerts.yaml
   - alerts/svc-argocd-rules.yaml
-  - alerts/svc-authentik-rules.yaml
   - alerts/svc-zitadel-rules.yaml
   - alerts/svc-forgejo-rules.yaml
   - alerts/svc-grafana-rules.yaml
@@ -17,7 +16,6 @@ resources:
   - alerts/api-gateway-alerts.yaml
   - alerts/cag-kv-cache-rules.yaml
   - servicemonitors/argocd.yaml
-  - servicemonitors/authentik.yaml
   - servicemonitors/forgejo.yaml
   - servicemonitors/minio.yaml
   - servicemonitors/ingress-nginx.yaml

k8s/infra/monitoring/servicemonitors/authentik.yaml

@@ -1,18 +0,0 @@
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: authentik
-  namespace: monitoring
-  labels:
-    release: kube-prometheus-stack
-spec:
-  namespaceSelector:
-    matchNames:
-      - iam
-  selector:
-    matchLabels:
-      app.kubernetes.io/name: authentik
-  endpoints:
-    - port: metrics
-      interval: 30s
-      scrapeTimeout: 10s

k8s/infra/oidc-bootstrap/bootstrap.yaml

@@ -1,33 +0,0 @@
-# One-shot bootstrap: restart the control-plane apiservers ONCE so they pick up the
-# OIDC authenticator (they last started before the Authentik provider existed, so OIDC
-# tokens were never accepted -> every login got 401). Delete this whole directory after.
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: oidc-bootstrap
-  namespace: kube-system
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: oidc-bootstrap
-  namespace: kube-system
-rules:
-  - apiGroups: [""]
-    resources: ["pods"]
-    verbs: ["get", "list", "delete"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: oidc-bootstrap
-  namespace: kube-system
-subjects:
-  - kind: ServiceAccount
-    name: oidc-bootstrap
-    namespace: kube-system
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: Role
-  name: oidc-bootstrap

k8s/infra/rbac/homarr-operator-role.yaml

@@ -1,32 +0,0 @@
-# Scoped operator access for homarr-admins: the homarr Deployment + app
-# secrets only. homarr-oidc, auth-oidc-secret, db-encryption stay excluded
-# (security-managed, not app config). Inert until kube-apiserver's OIDC
-# wiring lands.
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-  name: homarr-operator
-  namespace: dashboard
-rules:
-  - apiGroups: ["apps"]
-    resources: ["deployments"]
-    resourceNames: ["homarr"]
-    verbs: ["get", "list", "watch", "update", "patch"]
-  - apiGroups: [""]
-    resources: ["secrets"]
-    resourceNames: ["homarr-secrets"]
-    verbs: ["get", "list", "watch", "update", "patch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-  name: homarr-admins-binding
-  namespace: dashboard
-subjects:
-  - kind: Group
-    name: "oidc:homarr-admins"
-    apiGroup: rbac.authorization.k8s.io
-roleRef:
-  kind: Role
-  name: homarr-operator
-  apiGroup: rbac.authorization.k8s.io

k8s/infra/rbac/kustomization.yaml

@@ -10,7 +10,6 @@ resources:
   - grafana-operator-role.yaml
   - minio-operator-role.yaml
   - forgejo-operator-role.yaml
-  - homarr-operator-role.yaml
   - portainer-operator-role.yaml
   - kmsvc-operator-role.yaml
   - temporal-operator-role.yaml

k8s/infra/zitadel-core/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - zitadel-core.yaml

k8s/infra/zitadel-core/zitadel-core.yaml

@@ -0,0 +1,133 @@
+# ZITADEL core objects, owned by this repository instead of the Helm chart.
+#
+# The zitadel chart marks four objects as Helm hooks:
+#
+#   kind: ServiceAccount   (also ConfigMap/zitadel-config-yaml, Role, RoleBinding)
+#   annotations:
+#     helm.sh/hook: pre-install,pre-upgrade
+#     helm.sh/hook-delete-policy: before-hook-creation
+#
+# ArgoCD maps pre-install/pre-upgrade to PreSync and prunes hook resources when
+# the sync ends. Every sync therefore deleted the ServiceAccount and the ConfigMap
+# that the ZITADEL Deployment references, which produced:
+#
+#   error creating: pods "zitadel-..." is forbidden:
+#     serviceaccount "zitadel" not found
+#
+# and left the IdP one restart away from failing.
+#
+# These copies carry no hook annotations, so they are ordinary desired state and
+# ArgoCD keeps them. The chart still renders its own hook versions during a sync;
+# these win because the sync no longer removes them.
+#
+# ConfigMap content mirrors what the chart renders from
+# k8s/infra/iam/zitadel-values.yaml, plus the notification settings the chart
+# cannot deliver through values (see the SMTP note below). When the chart values
+# change, update this file too; it is the authoritative copy at runtime.
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: zitadel
+  namespace: iam
+  labels:
+    app.kubernetes.io/name: zitadel
+    app.kubernetes.io/instance: zitadel
+    app.kubernetes.io/managed-by: gitops
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: zitadel
+  namespace: iam
+  labels:
+    app.kubernetes.io/name: zitadel
+    app.kubernetes.io/instance: zitadel
+    app.kubernetes.io/managed-by: gitops
+rules:
+  - apiGroups: [""]
+    resources: ["secrets"]
+    verbs: ["get", "create", "patch", "list", "delete"]
+  - apiGroups: [""]
+    resources: ["pods"]
+    verbs: ["get"]
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: zitadel
+  namespace: iam
+  labels:
+    app.kubernetes.io/name: zitadel
+    app.kubernetes.io/instance: zitadel
+    app.kubernetes.io/managed-by: gitops
+subjects:
+  - kind: ServiceAccount
+    name: zitadel
+roleRef:
+  kind: Role
+  name: zitadel
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: zitadel-config-yaml
+  namespace: iam
+  labels:
+    app.kubernetes.io/name: zitadel
+    app.kubernetes.io/instance: zitadel
+    app.kubernetes.io/managed-by: gitops
+data:
+  zitadel-config-yaml: |
+    ExternalDomain: zitadel.riotpiao.com
+    ExternalSecure: true
+    TLS:
+      Enabled: false
+    FirstInstance:
+      # First boot is COMPLETE. Skip stops the setup step from running again and
+      # silently rotating the iam-admin key that provisioning reads.
+      Skip: true
+      Org:
+        Skip: true
+        Machine:
+          Machine:
+            Name: Automatically Initialized IAM Admin
+            Username: iam-admin
+          MachineKey:
+            ExpirationDate: "2029-01-01T00:00:00Z"
+            Type: 1
+          Pat:
+            ExpirationDate: "2029-01-01T00:00:00Z"
+    Machine:
+      Identification:
+        Hostname:
+          Enabled: true
+        Webhook:
+          Enabled: false
+    # Notification delivery.
+    #
+    # ZITADEL sends verification codes and password resets by SMTP only. This
+    # cluster has no mail path, so without a provider every user stays at
+    # verified_email = empty and cannot finish a first login.
+    #
+    # The target is the in-cluster smtp-gotify relay, which forwards each message
+    # to Gotify so codes reach the phone.
+    #
+    # Why here and not in chart values: injecting the same keys as
+    # ZITADEL_DEFAULTINSTANCE_SMTPCONFIGURATION_* env vars produced no
+    # instance.smtp.config.added event, so ZITADEL never created the provider.
+    # Setting configmapConfig in chart values made ArgoCD stop managing this
+    # ConfigMap. Owning the file here avoids both problems.
+    DefaultInstance:
+      DomainPolicy:
+        # The sender is [email protected] while the instance domain is
+        # zitadel.riotpiao.com. Leave this true so the sender address is not
+        # rejected for not matching the domain.
+        SMTPSenderAddressMatchesInstanceDomain: false
+      SMTPConfiguration:
+        SMTP:
+          Host: smtp-gotify.iam.svc.cluster.local:2525
+        TLS: false
+        From: [email protected]
+        FromName: ZITADEL

scripts/iam/forgejo-oauth-source.sh

@@ -0,0 +1,38 @@
+#!/usr/bin/env bash
+# forgejo-oauth-source.sh — keep the Forgejo OAuth login source aligned with
+# ZITADEL.
+#
+# Forgejo stores login sources in its database, not in GitOps, and its REST API
+# does not expose them. `tea` has no auth-source command either (tea admin only
+# manages users), so the supported writer is the in-pod CLI:
+#   gitea admin auth update-oauth
+#
+# The source name is the label on the "Sign in with ..." button AND the callback
+# path (/user/oauth2/<name>/callback), so a rename changes the registered
+# redirect URI. Register both spellings in ZITADEL (zitadel-provision.py does)
+# before renaming.
+#
+# Usage:
+#   scripts/iam/forgejo-oauth-source.sh status
+#   scripts/iam/forgejo-oauth-source.sh rename zitadel
+set -euo pipefail
+
+NS="${FORGEJO_NAMESPACE:-cicd}"
+SEL="${FORGEJO_SELECTOR:-app.kubernetes.io/name=forgejo}"
+
+pod() {
+  kubectl -n "$NS" get pods -l "$SEL" -o jsonpath='{.items[0].metadata.name}' 2>/dev/null \
+    || kubectl -n "$NS" get pods -o name | grep -m1 forgejo-gitea | cut -d/ -f2
+}
+
+run() { kubectl -n "$NS" exec "$(pod)" -c gitea -- gitea admin auth "$@"; }
+
+case "${1:-status}" in
+  status) run list ;;
+  rename)
+    name="${2:?usage: $0 rename <name>}"
+    run update-oauth --id 1 --name "$name"
+    run list
+    ;;
+  *) echo "usage: $0 [status|rename <name>]" >&2; exit 2 ;;
+esac

scripts/iam/provision-rbac.py

@@ -1,669 +0,0 @@
-#!/usr/bin/env python3
-"""
-Provision RBAC groups, service account roles, fine-grained claims, and auth flows.
-
-Idempotent — safe to re-run. Provisions:
-  1. Global admin groups (homelab-admins)
-  2. Fine-grained service/bucket/project groups (minio-*, poimen-*, paperless-*, grafana-*, sqs-*)
-  3. Service account roles with custom claims (paperless-ai-agent, portfolio-agent, etc.)
-  4. JWT scope mappings for fine-grained claims (minio_buckets, paperless_doctypes, etc.)
-  5. OAuth2 providers with scopes (api-gw, minio, poimen, paperless, grafana)
-  6. Auth flows (password grant on api-gw provider)
-
-Usage:
-    source ~/.env
-    export AUTHENTIK_BOOTSTRAP_TOKEN=$(kubectl -n iam get secret authentik-secrets \
-        -o jsonpath='{.data.AUTHENTIK_BOOTSTRAP_TOKEN}' | base64 -d)
-    python3 scripts/iam/provision-rbac.py
-
-DO NOT commit this file to git — .gitignore covers scripts/iam/*.py.
-"""
-import json
-import os
-import sys
-import urllib.error
-import urllib.request
-from typing import Dict, List, Any
-from pathlib import Path
-
-# Load ~/.env for OAuth2 provider secrets
-env_file = Path.home() / ".env"
-if env_file.exists():
-    with open(env_file) as f:
-        for line in f:
-            line = line.strip()
-            if line.startswith("export ") and "=" in line:
-                key, _, value = line[7:].partition("=")
-                key = key.strip()
-                value = value.strip().strip('"').strip("'")
-                os.environ[key] = value
-
-AUTHENTIK_URL = "https://authentik.riotpiao.com"
-TOKEN = os.environ.get("AUTHENTIK_BOOTSTRAP_TOKEN")
-if not TOKEN:
-    print("Error: AUTHENTIK_BOOTSTRAP_TOKEN not set")
-    print("  source ~/.env")
-    print("  export AUTHENTIK_BOOTSTRAP_TOKEN=$(kubectl -n iam get secret authentik-secrets \\")
-    print("      -o jsonpath='{.data.AUTHENTIK_BOOTSTRAP_TOKEN}' | base64 -d)")
-    sys.exit(1)
-
-
-def api(method, path, data=None):
-    url = f"{AUTHENTIK_URL}{path}"
-    body = json.dumps(data).encode() if data is not None else None
-    req = urllib.request.Request(url, data=body, method=method, headers={
-        "Authorization": f"Bearer {TOKEN}",
-        "Content-Type": "application/json",
-    })
-    try:
-        with urllib.request.urlopen(req, timeout=30) as resp:
-            raw = resp.read()
-            return resp.status, json.loads(raw) if raw else {}
-    except urllib.error.HTTPError as e:
-        raw = e.read()
-        try:
-            parsed = json.loads(raw) if raw else {}
-        except json.JSONDecodeError:
-            parsed = {"raw": raw.decode(errors="replace")}
-        return e.code, parsed
-
-
-def die(msg):
-    print(f"FATAL: {msg}", file=sys.stderr)
-    sys.exit(1)
-
-
-# ===========================================================================
-# Group Definitions (DRY: single source of truth)
-# ===========================================================================
-GROUPS: Dict[str, Dict[str, Any]] = {
-    "homelab-admins": {
-        "description": "Cluster administrators with full access",
-        "is_superuser": True,
-    },
-    "minio-admins": {"description": "MinIO administrators", "is_superuser": False, "minio_buckets": ["*"]},
-    "minio-photos": {"description": "Photos bucket (Immich) access", "is_superuser": False, "minio_buckets": ["immich"]},
-    "minio-documents": {"description": "Documents bucket (Paperless) access", "is_superuser": False, "minio_buckets": ["paperless"]},
-    "minio-backups": {"description": "Backups bucket read-only access", "is_superuser": False, "minio_buckets": ["backups"]},
-    "poimen-admins": {"description": "Poimen memory administrators", "is_superuser": False, "memory_projects": ["*"], "memory_visibility": "private"},
-    "poimen-devs": {"description": "Dev and staging projects access", "is_superuser": False, "memory_projects": ["dev", "staging"], "memory_visibility": "internal"},
-    "poimen-prod-readonly": {"description": "Production projects read-only access", "is_superuser": False, "memory_projects": ["prod"], "memory_visibility": "public"},
-    "paperless-admins": {"description": "Paperless administrators", "is_superuser": False, "paperless_doctypes": ["*"]},
-    "paperless-finance": {"description": "Finance documents", "is_superuser": False, "paperless_doctypes": ["invoices", "receipts", "expenses"]},
-    "paperless-legal": {"description": "Legal documents", "is_superuser": False, "paperless_doctypes": ["contracts", "licenses", "agreements"]},
-    "paperless-hr": {"description": "HR documents", "is_superuser": False, "paperless_doctypes": ["employment", "benefits", "payroll"]},
-    "grafana-admins": {"description": "Grafana administrators", "is_superuser": False, "grafana_org_role": "Admin"},
-    "grafana-editors": {"description": "Grafana dashboard editors", "is_superuser": False, "grafana_org_role": "Editor"},
-    "grafana-viewers": {"description": "Grafana dashboard viewers", "is_superuser": False, "grafana_org_role": "Viewer"},
-    "sqs-users": {"description": "SQS/Temporal queue read access", "is_superuser": False, "sqs_queues": ["default"]},
-    "sqs-writers": {"description": "SQS/Temporal queue read/write access", "is_superuser": False, "sqs_queues": ["*"]},
-    "s3-users": {"description": "S3 read access", "is_superuser": False},
-    "s3-writers": {"description": "S3 read/write access", "is_superuser": False},
-}
-
-SERVICE_ACCOUNTS: Dict[str, Dict[str, Any]] = {
-    "paperless-ai-agent": {
-        "description": "Paperless AI plugin (auto-tagging, entity extraction)",
-        "roles": ["llm:inference", "memory:write", "paperless:admin"],
-        "claims": {
-            "minio_buckets": ["paperless"],
-            "paperless_doctypes": ["*"],
-            "memory_projects": ["*"],
-            "authorized_models": ["reasoning", "qwen2.5:3b"],
-        },
-    },
-    "portfolio-agent": {
-        "description": "Portfolio service agent",
-        "roles": ["llm:inference", "memory:read"],
-        "claims": {
-            "memory_projects": ["homelab", "portfolio"],
-            "memory_visibility": "public",
-            "authorized_models": ["ornith:35b"],
-            "minio_buckets": ["backups"],
-        },
-    },
-    "memory-agent": {
-        "description": "Memory service agent",
-        "roles": ["llm:inference", "memory:read", "memory:write"],
-        "claims": {
-            "memory_projects": ["*"],
-            "memory_visibility": "private",
-            "authorized_models": ["reasoning", "ornith:35b", "qwen2.5:3b"],
-        },
-    },
-    "temporal-worker-agent": {
-        "description": "Temporal workflow worker",
-        "roles": ["llm:inference", "workflow:execute", "memory:read", "memory:write", "queue:send"],
-        "claims": {
-            "memory_projects": ["*"],
-            "sqs_queues": ["*"],
-            "authorized_models": ["reasoning", "ornith:35b", "qwen2.5:3b"],
-        },
-    },
-}
-
-SCOPE_MAPPINGS: Dict[str, Dict[str, str]] = {
-    "roles": {"expression": 'return user.attributes.get("roles", [])'},
-    "permissions": {"expression": 'return ["*"] if any(user.groups.filter(is_superuser=True)) else list(user.groups.values_list("name", flat=True))'},
-    "groups": {"expression": 'return {"groups": list(user.groups.values_list("name", flat=True))}'},
-    "minio_buckets": {"expression": 'return user.attributes.get("minio_buckets", [])'},
-    "paperless_doctypes": {"expression": 'return user.attributes.get("paperless_doctypes", [])'},
-    "memory_projects": {"expression": 'return user.attributes.get("memory_projects", [])'},
-    "memory_visibility": {"expression": 'return user.attributes.get("memory_visibility", "public")'},
-    "authorized_models": {"expression": 'return user.attributes.get("authorized_models", [])'},
-    "sqs_queues": {"expression": 'return user.attributes.get("sqs_queues", [])'},
-    "grafana_org_role": {"expression": 'return user.attributes.get("grafana_org_role", "Viewer")'},
-}
-
-# ===========================================================================
-# Phase 1: Create/sync all groups
-# ===========================================================================
-print("[1/6] Ensuring groups exist...")
-
-status, res = api("GET", "/api/v3/core/groups/?page_size=100")
-if status != 200:
-    die(f"GET groups -> {status} {res}")
-existing_groups = {g["name"]: g for g in res["results"]}
-
-created_count = 0
-for group_name, group_spec in GROUPS.items():
-    if group_name in existing_groups:
-        print(f"  {group_name}: already exists")
-    else:
-        status, res = api("POST", "/api/v3/core/groups/", {
-            "name": group_name,
-            "is_superuser": group_spec.get("is_superuser", False),
-        })
-        if status in (200, 201):
-            print(f"  {group_name}: created")
-            created_count += 1
-        else:
-            print(f"  {group_name}: FAILED {status} {res}")
-
-print(f"  Total: {len(GROUPS)} groups, {created_count} new")
-
-# ===========================================================================
-# Phase 2: Create/sync service account users with custom claims
-# ===========================================================================
-print("\n[2/6] Creating/updating service account users...")
-
-status, res = api("GET", "/api/v3/core/users/?page_size=100")
-if status != 200:
-    die(f"GET users -> {status} {res}")
-existing_users = {u["username"]: u for u in res["results"]}
-
-service_pwd = os.environ.get("AUTHENTIK_SERVICE_ACCOUNT_PASSWORD", "DefaultPassword123!")
-
-for agent_name, agent_spec in SERVICE_ACCOUNTS.items():
-    if agent_name in existing_users:
-        user = existing_users[agent_name]
-        attrs = user.get("attributes", {})
-        attrs.update(agent_spec.get("claims", {}))
-        attrs["roles"] = agent_spec.get("roles", [])
-        status, res = api("PATCH", f"/api/v3/core/users/{user['pk']}/", {"attributes": attrs})
-        if status in (200, 201):
-            print(f"  {agent_name}: claims updated")
-        else:
-            print(f"  {agent_name}: FAILED {status} {res}")
-    else:
-        status, res = api("POST", "/api/v3/core/users/", {
-            "username": agent_name,
-            "name": agent_spec.get("description", agent_name),
-            "email": f"{agent_name}@homelab.local",
-            "is_active": True,
-            "is_superuser": False,
-            "password": service_pwd,
-            "attributes": {
-                **agent_spec.get("claims", {}),
-                "roles": agent_spec.get("roles", []),
-            },
-        })
-        if status in (200, 201):
-            print(f"  {agent_name}: created")
-        else:
-            print(f"  {agent_name}: FAILED {status} {res}")
-
-# ===========================================================================
-# Phase 3: Create scope mappings for fine-grained claims
-# ===========================================================================
-print("\n[3/6] Creating scope mappings for fine-grained claims...")
-
-status, res = api("GET", "/api/v3/propertymappings/provider/scope/?page_size=100")
-if status != 200:
-    die(f"GET scope mappings -> {status} {res}")
-existing_scopes = {m["scope_name"]: m for m in res["results"]}
-
-for scope_name, scope_spec in SCOPE_MAPPINGS.items():
-    if scope_name in existing_scopes:
-        print(f"  {scope_name}: already exists")
-    else:
-        status, res = api("POST", "/api/v3/propertymappings/provider/scope/", {
-            "name": scope_name,
-            "scope_name": scope_name,
-            "expression": scope_spec["expression"],
-        })
-        if status in (200, 201):
-            print(f"  {scope_name}: created")
-        else:
-            print(f"  {scope_name}: FAILED {status} {res}")
-
-# Fix built-in 'openid' scope to include preferred_username (needed by Grafana, Forgejo, etc.)
-# Note: sub MUST be a string, not int, for JSON compatibility with Go struct unmarshaling
-if "openid" in existing_scopes:
-    openid_scope = existing_scopes["openid"]
-    openid_pk = openid_scope["pk"]
-    openid_expression = 'return {"sub": str(user.pk), "preferred_username": user.username}'
-    if openid_expression not in openid_scope.get("expression", ""):
-        status, res = api("PUT", f"/api/v3/propertymappings/provider/scope/{openid_pk}/", {
-            "name": openid_scope["name"],
-            "scope_name": "openid",
-            "expression": openid_expression,
-        })
-        if status in (200, 201):
-            print(f"  openid: updated (sub as string + preferred_username)")
-        else:
-            print(f"  openid: UPDATE FAILED {status} {res}")
-    else:
-        print(f"  openid: already correct (sub as string)")
-
-# ===========================================================================
-# Phase 4: Get flow UUIDs (needed for providers)
-# ===========================================================================
-print("\n[4/6] Fetching flow UUIDs...")
-
-status, res = api("GET", "/api/v3/flows/instances/?page_size=100")
-if status != 200:
-    die(f"GET flows -> {status} {res}")
-
-flows = {f["slug"]: f["pk"] for f in res.get("results", [])}
-auth_flow = flows.get("default-provider-authorization-implicit-consent")
-inval_flow = flows.get("default-provider-invalidation-flow")
-
-if not auth_flow or not inval_flow:
-    die(f"Required flows not found. auth_flow={auth_flow}, inval_flow={inval_flow}")
-
-print(f"  authorization_flow: {auth_flow}")
-print(f"  invalidation_flow: {inval_flow}")
-
-# ===========================================================================
-# Phase 5: Create OAuth2 providers with scopes
-# ===========================================================================
-print("\n[5/6] Creating OAuth2 providers...")
-
-status, res = api("GET", "/api/v3/providers/oauth2/?page_size=100")
-if status != 200:
-    die(f"GET providers -> {status} {res}")
-existing_providers = {p["name"]: p for p in res.get("results", [])}
-
-# Fetch scope mapping PKs
-status, scopes_res = api("GET", "/api/v3/propertymappings/provider/scope/?page_size=100")
-if status != 200:
-    print("  WARNING: could not fetch scope mappings")
-    scope_pks = {}
-else:
-    scope_pks = {m["scope_name"]: m["pk"] for m in scopes_res.get("results", [])}
-
-# Include standard OpenID scopes (openid, email, profile) + custom claim scopes
-STANDARD_SCOPES = ["openid", "email", "profile"]
-scope_pks_list = [scope_pks[s] for s in STANDARD_SCOPES if s in scope_pks]
-scope_pks_list += [scope_pks[s] for s in SCOPE_MAPPINGS.keys() if s in scope_pks]
-
-# OAuth2 providers — client_secret sourced from SOPS-encrypted k8s secrets.
-# These are the real secrets the services use. Authentik must match.
-OAuth2_PROVIDERS = {
-    "api-gw": {
-        "client_id": "api-gw",
-        "client_secret_env": "AUTHENTIK_PROVIDER_API_GW_SECRET",
-        "redirect_uris": ["http://localhost:3000/callback", "https://api.riotpiao.com/callback"],
-    },
-    "minio": {
-        "client_id": "minio",
-        "client_secret": "9d2867fe08c3bf7fedd7e32bbaf4456fce3b0aaf788966d7559e1955947b0219",
-        "redirect_uris": ["http://localhost:9000/auth/sso/oauth2/code", "https://minio.riotpiao.com/auth/sso/oauth2/code"],
-    },
-    "poimen": {
-        "client_id": "poimen",
-        "client_secret_env": "AUTHENTIK_PROVIDER_POIMEN_SECRET",
-        "redirect_uris": ["http://localhost:3000/callback", "https://poimen.riotpiao.com/callback"],
-    },
-    "paperless": {
-        "client_id": "paperless",
-        "client_secret": "6hcxaaVgZlKgafl7BxeSEtPAcbNUJxi2PAZePxSFk4o=",
-        "redirect_uris": ["http://localhost:8000/accounts/oidc/authentik/login/callback/", "https://paperless.riotpiao.com/accounts/oidc/authentik/login/callback/"],
-    },
-    "grafana": {
-        "client_id": "grafana",
-        "client_secret": "966bad4fa43812100e7775b3c73fed2ce1d07217fa5a23fbb0f190e46d2f0fa4",
-        "redirect_uris": ["http://localhost:3000/login/generic_oauth", "https://grafana.riotpiao.com/login/generic_oauth"],
-    },
-    "queue": {
-        "client_id": "queue-sqs",
-        "client_secret_env": "AUTHENTIK_PROVIDER_QUEUE_SECRET",
-        "redirect_uris": ["http://localhost:8080/callback", "https://queue.riotpiao.com/callback"],
-    },
-    "forgejo": {
-        "client_id": "forgejo",
-        "client_secret": "G4klhs3JRfs5A7YnGs90WuOndBAvamWlZgaZRY8x",
-        "redirect_uris": ["http://localhost:3000/user/oauth2/authentik/callback", "https://forgejo.riotpiao.com/user/oauth2/authentik/callback"],
-    },
-    "immich": {
-        "client_id": "immich",
-        "client_secret": "QxyWfESXqTD55aUyh6miYnny1QTCEuEwyC4escw9",
-        "redirect_uris": ["app.immich:///oauth-callback", "https://img.riotpiao.com/auth/login", "https://img.riotpiao.com/user/oauth2/callback"],
-    },
-    "homarr": {
-        "client_id": "homarr",
-        "client_secret": "RMlDQAWdjT5YPPH0U7ztDoUFP7R7w95b2xqQ1pyS",
-        "redirect_uris": ["http://localhost:7575/auth/callback", "https://homarr.riotpiao.com/auth/callback"],
-    },
-    "argocd": {
-        "client_id": "argocd",
-        "client_secret_env": "AUTHENTIK_PROVIDER_ARGOCD_SECRET",
-        "redirect_uris": ["http://localhost:8080/auth/callback", "https://argocd.riotpiao.com/auth/callback"],
-    },
-    "vault": {
-        "client_id": "vault",
-        "client_secret_env": "AUTHENTIK_PROVIDER_VAULT_SECRET",
-        "redirect_uris": ["http://localhost:8200/ui/vault/auth/oidc/oidc/callback", "https://vault.riotpiao.com/ui/vault/auth/oidc/oidc/callback"],
-    },
-}
-
-import secrets as _secrets
-
-for provider_name, provider_spec in OAuth2_PROVIDERS.items():
-    # Resolve client_secret: explicit > env var > generate random
-    if "client_secret" in provider_spec:
-        client_secret = provider_spec["client_secret"]
-    elif "client_secret_env" in provider_spec:
-        client_secret = os.environ.get(provider_spec["client_secret_env"], _secrets.token_urlsafe(32))
-    else:
-        client_secret = _secrets.token_urlsafe(32)
-
-    redirect_uris_list = [{"url": uri, "matching_mode": "strict"} for uri in provider_spec["redirect_uris"]]
-
-    provider_payload = {
-        "name": provider_name,
-        "authorization_flow": auth_flow,
-        "invalidation_flow": inval_flow,
-        "grant_types": ["authorization_code", "implicit", "password"],
-        "client_id": provider_spec["client_id"],
-        "client_secret": client_secret,
-        "redirect_uris": redirect_uris_list,
-        "property_mappings": scope_pks_list,
-    }
-
-    if provider_name in existing_providers:
-        # UPDATE existing provider — sync secret + redirect_uris
-        provider_pk = existing_providers[provider_name]["pk"]
-        status, res = api("PATCH", f"/api/v3/providers/oauth2/{provider_pk}/", {
-            "client_id": provider_spec["client_id"],
-            "client_secret": client_secret,
-            "redirect_uris": redirect_uris_list,
-            "property_mappings": scope_pks_list,
-        })
-        if status in (200, 201):
-            print(f"  {provider_name}: updated (secret + redirect_uris synced)")
-        else:
-            print(f"  {provider_name}: UPDATE FAILED {status} {res}")
-    else:
-        # CREATE new provider
-        status, res = api("POST", "/api/v3/providers/oauth2/", provider_payload)
-        if status in (200, 201):
-            print(f"  {provider_name}: created")
-        else:
-            print(f"  {provider_name}: FAILED {status} {res}")
-
-# ===========================================================================
-# Phase 6: Create OAuth2 Applications (bind providers to public token endpoints)
-# ===========================================================================
-print("\n[6/7] Creating OAuth2 Applications...")
-print("     (binds providers to /application/o/token/ endpoints)")
-
-status, res = api("GET", "/api/v3/core/applications/?page_size=100")
-if status != 200:
-    die(f"GET applications -> {status} {res}")
-existing_apps = {a["slug"]: a for a in res.get("results", [])}
-
-for provider_name in OAuth2_PROVIDERS.keys():
-    # Get the provider PK
-    status, provider_res = api("GET", f"/api/v3/providers/oauth2/?name={provider_name}")
-    if status != 200 or not provider_res.get("results"):
-        print(f"  {provider_name}: provider not found, skip")
-        continue
-    provider_pk = provider_res["results"][0]["pk"]
-
-    if provider_name in existing_apps:
-        # Ensure app is linked to provider (fix orphaned apps)
-        app_data = existing_apps[provider_name]
-        if app_data.get("provider") != provider_pk:
-            app_uuid = app_data["pk"]
-            status, res = api("PATCH", f"/api/v3/core/applications/{app_uuid}/", {
-                "provider": provider_pk,
-            })
-            if status in (200, 201):
-                print(f"  {provider_name}: re-linked to provider")
-            else:
-                print(f"  {provider_name}: RE-LINK FAILED {status} {res}")
-        else:
-            print(f"  {provider_name}: ok")
-    else:
-        status, res = api("POST", "/api/v3/core/applications/", {
-            "name": provider_name,
-            "slug": provider_name,
-            "provider": provider_pk,
-        })
-        if status in (200, 201):
-            print(f"  {provider_name}: created")
-        else:
-            print(f"  {provider_name}: FAILED {status} {res}")
-
-# ===========================================================================
-# Phase 7: Create/update rock user → homelab-admins, matching Forgejo identity
-# ===========================================================================
-print("\n[7/10] Creating/updating rock user ([email protected])...")
-
-ROCK_EMAIL = "[email protected]"
-ROCK_PASSWORD = os.environ.get("ROCK_PASSWORD", "")
-
-status, res = api("GET", "/api/v3/core/users/?username=rock")
-if status == 200 and res.get("results"):
-    rock_user = res["results"][0]
-    # Ensure email matches Forgejo's rock user for OIDC linking
-    patch_data = {"email": ROCK_EMAIL, "name": "Rock"}
-    status, res = api("PATCH", f"/api/v3/core/users/{rock_user['pk']}/", patch_data)
-    if status in (200, 201):
-        print(f"  rock: updated email to {ROCK_EMAIL}")
-    else:
-        print(f"  rock: update FAILED {status} {res}")
-else:
-    if not ROCK_PASSWORD:
-        print("  rock: NOT FOUND and ROCK_PASSWORD not set, skipping creation")
-        print("    export ROCK_PASSWORD=<password> and re-run")
-        rock_user = None
-    else:
-        status, res = api("POST", "/api/v3/core/users/", {
-            "username": "rock",
-            "name": "Rock",
-            "email": ROCK_EMAIL,
-            "is_active": True,
-            "is_superuser": False,
-            "password": ROCK_PASSWORD,
-        })
-        if status in (200, 201):
-            rock_user = res
-            print(f"  rock: created with email {ROCK_EMAIL}")
-        else:
-            print(f"  rock: create FAILED {status} {res}")
-            rock_user = None
-
-if rock_user:
-    status, res = api("GET", "/api/v3/core/groups/?name=homelab-admins")
-    if status == 200 and res.get("results"):
-        admins_group = res["results"][0]
-        status, res = api("POST", f"/api/v3/core/groups/{admins_group['pk']}/users/add/", {"pk": rock_user["pk"]})
-        if status in (200, 201, 204):
-            print(f"  rock: added to homelab-admins")
-        else:
-            print(f"  rock: group add {status} {res}")
-
-# ===========================================================================
-# Phase 8: Email recovery flow (password reset via email)
-# ===========================================================================
-print("\n[8/10] Creating email recovery flow...")
-
-# Read SMTP config from gotify-smtp secret (same Gmail creds)
-SMTP_HOST = "smtp.gmail.com"
-SMTP_PORT = 587
-SMTP_USER = "[email protected]"
-SMTP_FROM = "[email protected]"
-# Password read from env at runtime: AUTHENTIK_EMAIL__PASSWORD
-
-# 8a. Create email stage for recovery
-status, res = api("GET", "/api/v3/stages/email/?name=email-recovery")
-if status == 200 and res.get("results"):
-    email_stage_pk = res["results"][0]["pk"]
-    print("  email-recovery stage: already exists")
-else:
-    status, res = api("POST", "/api/v3/stages/email/", {
-        "name": "email-recovery",
-        "use_global_settings": False,
-        "host": SMTP_HOST,
-        "port": SMTP_PORT,
-        "username": SMTP_USER,
-        "password": os.environ.get("AUTHENTIK_EMAIL_PASSWORD", ""),
-        "use_tls": True,
-        "use_ssl": False,
-        "timeout": 10,
-        "from_address": SMTP_FROM,
-        "template": "email/password_reset.html",
-        "activate_user_on_success": True,
-    })
-    if status in (200, 201):
-        email_stage_pk = res["pk"]
-        print("  email-recovery stage: created")
-    else:
-        email_stage_pk = None
-        print(f"  email-recovery stage: FAILED {status} {res}")
-
-# 8b. Create identification stage for recovery (email lookup)
-status, res = api("GET", "/api/v3/stages/identification/?name=recovery-identification")
-if status == 200 and res.get("results"):
-    ident_stage_pk = res["results"][0]["pk"]
-    print("  recovery-identification stage: already exists")
-else:
-    status, res = api("POST", "/api/v3/stages/identification/", {
-        "name": "recovery-identification",
-        "user_fields": ["email", "username"],
-    })
-    if status in (200, 201):
-        ident_stage_pk = res["pk"]
-        print("  recovery-identification stage: created")
-    else:
-        ident_stage_pk = None
-        print(f"  recovery-identification stage: FAILED {status} {res}")
-
-# 8c. Create password stage for new password entry
-status, res = api("GET", "/api/v3/stages/password/?name=recovery-password-change")
-if status == 200 and res.get("results"):
-    pw_stage_pk = res["results"][0]["pk"]
-    print("  recovery-password-change stage: already exists")
-else:
-    # Use prompt stage for password change instead
-    status, res = api("GET", "/api/v3/stages/user_write/?name=recovery-user-write")
-    if status == 200 and res.get("results"):
-        pw_stage_pk = res["results"][0]["pk"]
-        print("  recovery-user-write stage: already exists")
-    else:
-        status, res = api("POST", "/api/v3/stages/user_write/", {
-            "name": "recovery-user-write",
-        })
-        if status in (200, 201):
-            pw_stage_pk = res["pk"]
-            print("  recovery-user-write stage: created")
-        else:
-            pw_stage_pk = None
-            print(f"  recovery-user-write stage: FAILED {status} {res}")
-
-# 8d. Create recovery flow
-status, res = api("GET", "/api/v3/flows/instances/?slug=password-recovery")
-if status == 200 and res.get("results"):
-    recovery_flow_pk = res["results"][0]["pk"]
-    print("  password-recovery flow: already exists")
-else:
-    status, res = api("POST", "/api/v3/flows/instances/", {
-        "name": "Password Recovery",
-        "slug": "password-recovery",
-        "title": "Reset your password",
-        "designation": "recovery",
-    })
-    if status in (200, 201):
-        recovery_flow_pk = res["pk"]
-        print("  password-recovery flow: created")
-    else:
-        recovery_flow_pk = None
-        print(f"  password-recovery flow: FAILED {status} {res}")
-
-# 8e. Bind stages to flow in order
-if recovery_flow_pk and ident_stage_pk and email_stage_pk:
-    for order, stage_pk, label in [
-        (10, ident_stage_pk, "identification"),
-        (20, email_stage_pk, "email"),
-    ]:
-        status, res = api("POST", "/api/v3/flows/bindings/", {
-            "target": recovery_flow_pk,
-            "stage": stage_pk,
-            "order": order,
-        })
-        if status in (200, 201):
-            print(f"  bound {label} stage at order {order}")
-        elif status == 400 and "already exists" in str(res).lower():
-            print(f"  {label} stage: already bound")
-        else:
-            print(f"  bind {label}: {status} {res}")
-
-# ===========================================================================
-# Phase 9: Set recovery flow on brand
-# ===========================================================================
-print("\n[9/10] Setting recovery flow on brand...")
-
-if recovery_flow_pk:
-    status, res = api("GET", "/api/v3/brands/instances/")
-    if status == 200 and res.get("results"):
-        brand = res["results"][0]
-        status, res = api("PATCH", f"/api/v3/brands/instances/{brand['brand_uuid']}/", {
-            "flow_recovery": recovery_flow_pk,
-        })
-        if status in (200, 201):
-            print("  recovery flow set on brand")
-        else:
-            print(f"  FAILED {status} {res}")
-    else:
-        print("  no brand found")
-
-# ===========================================================================
-# Phase 10: Ensure Forgejo OAuth2 source uses matching email claim
-# ===========================================================================
-print("\n[10/10] Verifying Forgejo OIDC linkage...")
-print(f"  rock@Authentik email: {ROCK_EMAIL}")
-print("  Forgejo OIDC will match on email — ensure Forgejo's rock user")
-print(f"  has email {ROCK_EMAIL} in Forgejo settings → Profile")
-
-# ===========================================================================
-# Summary
-# ===========================================================================
-print("\n" + "="*70)
-print("AUTHENTIK PROVISIONING COMPLETE")
-print("="*70)
-print(f"\n  [1] Groups: {len(GROUPS)}")
-print(f"  [2] Service accounts: {len(SERVICE_ACCOUNTS)}")
-print(f"  [3] Scope mappings: {len(SCOPE_MAPPINGS)}")
-print(f"  [4] Flows resolved")
-print(f"  [5] OAuth2 providers: {len(OAuth2_PROVIDERS)}")
-print(f"  [6] OAuth2 applications bound")
-print(f"  [7] rock user ([email protected]) -> homelab-admins")
-print(f"  [8] Email recovery flow (smtp.gmail.com)")
-print(f"  [9] Recovery flow set on brand")
-print(f"  [10] Forgejo OIDC linkage verified")
-print("\nNEXT: Set Forgejo rock user email to [email protected] in Forgejo profile")
-print("TEST: https://authentik.riotpiao.com/if/flow/password-recovery/")
-print("="*70)

scripts/iam/rotate-secrets.sh

@@ -53,7 +53,7 @@ generate_secret() {
 
 declare -A NEW_SECRETS
 
-for svc in api-gw minio poimen paperless grafana argocd forgejo homarr immich vault portfolio-agent memory-agent local-llm; do
+for svc in api-gw minio poimen paperless grafana argocd forgejo immich vault portfolio-agent memory-agent local-llm; do
   NEW_SECRETS[$svc]=$(generate_secret)
   log "  $svc: ${NEW_SECRETS[$svc]:0:15}..."
 done
@@ -70,7 +70,6 @@ declare -A PROVIDER_PKS=(
   [grafana]=6
   [argocd]=7
   [forgejo]=8
-  [homarr]=9
   [immich]=10
   [vault]=11
 )
@@ -203,7 +202,7 @@ fi
 log ""
 log "=== Summary ==="
 log "Rotated 13 credentials:"
-log "  OAuth2 Providers: api-gw, minio, poimen, paperless, grafana, argocd, forgejo, homarr, immich, vault"
+log "  OAuth2 Providers: api-gw, minio, poimen, paperless, grafana, argocd, forgejo, immich, vault"
 log "  Service Accounts: portfolio-agent, memory-agent, local-llm"
 
 log ""

scripts/iam/zitadel-provision.py

@@ -6,7 +6,7 @@ One command replaces the manual sequence the Authentik script
 fixed order and every phase is safe to re-run:
 
   keys         extract the iam-admin machine key and PAT from namespace iam
-  apply        terraform apply terraform/zitadel (project, roles, apps, machines)
+  apply        create project, roles and OIDC apps through the ZITADEL API
   secrets      write generated client ids/secrets back into the SOPS files
   users        import one human user, converting the Django password hash
   verify       check discovery, client count and the groups-claim gate
@@ -43,12 +43,110 @@ from pathlib import Path
 import yaml
 
 REPO = Path(__file__).resolve().parents[2]
-TF_DIR = REPO / "terraform" / "zitadel"
 SOPS_DIR = REPO / "k8s" / "argocd" / "secrets"
 SOPS_CONFIG = REPO / ".sops.yaml"
 CONF_DIR = Path(os.environ.get("ZITADEL_CONF_DIR", Path.home() / ".config" / "zitadel"))
+STATE_FILE = CONF_DIR / "state.json"
 NAMESPACE = os.environ.get("ZITADEL_NAMESPACE", "iam")
 BASE_URL = os.environ.get("ZITADEL_BASE_URL", "https://zitadel.riotpiao.com")
+# Notification delivery target: the in-cluster SMTP -> Gotify relay.
+SMTP_HOST = os.environ.get("ZITADEL_SMTP_HOST", "smtp-gotify.iam.svc.cluster.local:2525")
+SMTP_FROM = os.environ.get("ZITADEL_SMTP_FROM", "[email protected]")
+SMTP_FROM_NAME = os.environ.get("ZITADEL_SMTP_FROM_NAME", "ZITADEL")
+
+# ── desired ZITADEL state ──────────────────────────────────────────────────
+# Declared here, applied through the API by the `apply` phase. This replaces the
+# retired terraform/zitadel root module: same objects, no state file to drift and
+# no second writer.
+PROJECT_NAME = os.environ.get("ZITADEL_PROJECT_NAME", "homelab")
+PROJECT_GROUP = "homelab"
+
+# Role keys EQUAL the Authentik group names, so the `groups` claim keeps working
+# for every consumer that maps on it (kube-apiserver RBAC, MinIO policies,
+# Grafana roles).
+ROLES = {
+    "homelab-admins": "Cluster administrators with full access",
+    "minio-admins": "MinIO administrators",
+    "minio-photos": "Photos bucket (Immich) access",
+    "minio-documents": "Documents bucket (Paperless) access",
+    "minio-backups": "Backups bucket read-only access",
+    "poimen-admins": "Poimen memory administrators",
+    "poimen-devs": "Dev and staging projects access",
+    "poimen-prod-readonly": "Production projects read-only access",
+    "paperless-admins": "Paperless administrators",
+    "paperless-finance": "Finance documents",
+    "paperless-legal": "Legal documents",
+    "paperless-hr": "HR documents",
+    "grafana-admins": "Grafana administrators",
+    "grafana-editors": "Grafana dashboard editors",
+    "grafana-viewers": "Grafana dashboard viewers",
+    "sqs-users": "SQS/Temporal queue read access",
+    "sqs-writers": "SQS/Temporal queue read/write access",
+    "s3-users": "S3 read access",
+    "s3-writers": "S3 read/write access",
+    # LLM gate for the api-gw. The colon form matches the Authentik-era
+    # permission string, so consumer manifests did not change.
+    "llm:inference": "LLM inference access (api-gw)",
+    "llm-inference": "LLM inference access (dash alias)",
+    # Per-service capabilities. The gateway derives the required capability from
+    # the verb: GET/HEAD/OPTIONS -> "<service>:read", anything else ->
+    # "<service>:write" (internal/serviceadapter/router.go:142). The role key
+    # must match that string exactly, colon included.
+    "memory:read": "Poimen memory read (api-gw)",
+    "memory:write": "Poimen memory write (api-gw)",
+    "workflow:read": "Temporal workflow read (api-gw)",
+    "workflow:execute": "Temporal workflow execute (api-gw)",
+    "s3:read": "Object store read (api-gw)",
+    "s3:write": "Object store write (api-gw)",
+    "iam:read": "Identity read (api-gw)",
+    "iam:write": "Identity write (api-gw)",
+    "sqs:read": "Queue read (api-gw)",
+    "sqs:write": "Queue write (api-gw)",
+}
+
+_WEB = {"app_type_id": "OIDC_APP_TYPE_WEB", "auth_method_id": "OIDC_AUTH_METHOD_TYPE_BASIC"}
+_NATIVE = {"app_type_id": "OIDC_APP_TYPE_NATIVE", "auth_method_id": "OIDC_AUTH_METHOD_TYPE_NONE"}
+_PKCE = {"app_type_id": "OIDC_APP_TYPE_USER_AGENT", "auth_method_id": "OIDC_AUTH_METHOD_TYPE_NONE"}
+
+OIDC_APPS = {
+    "api-gw": {**_WEB, "redirect_uris": [
+        "http://localhost:3000/callback", "https://api.riotpiao.com/callback"]},
+    "argocd": {**_WEB, "redirect_uris": [
+        "http://localhost:8080/auth/callback",
+        "https://argocd.riotpiao.com/auth/callback"]},
+    # Forgejo derives the callback path from the login-source NAME
+    # (/user/oauth2/<name>/callback). Both spellings are registered so a
+    # rename between authentik and zitadel never breaks sign-in.
+    "forgejo": {**_WEB, "redirect_uris": [
+        "http://localhost:3000/user/oauth2/zitadel/callback",
+        "https://forgejo.riotpiao.com/user/oauth2/zitadel/callback",
+        "http://localhost:3000/user/oauth2/authentik/callback",
+        "https://forgejo.riotpiao.com/user/oauth2/authentik/callback"]},
+    "grafana": {**_WEB, "redirect_uris": [
+        "http://localhost:3000/login/generic_oauth",
+        "https://grafana.riotpiao.com/login/generic_oauth"]},
+    "immich": {**_WEB, "app_type_id": "OIDC_APP_TYPE_NATIVE", "redirect_uris": [
+        "app.immich:///oauth-callback", "https://img.riotpiao.com/auth/login",
+        "https://img.riotpiao.com/user/oauth2/callback"]},
+    "kubernetes": {**_PKCE, "dev_mode": True, "redirect_uris": [
+        "http://localhost:8000", "http://localhost:18000"]},
+    "minio": {**_WEB, "redirect_uris": [
+        "http://localhost:9000/auth/sso/oauth2/code",
+        "https://minio.riotpiao.com/auth/sso/oauth2/code"]},
+    "paperless": {**_WEB, "redirect_uris": [
+        "http://localhost:8000/accounts/oidc/zitadel/login/callback/",
+        "https://paperless.riotpiao.com/accounts/oidc/zitadel/login/callback/",
+        "http://localhost:8000/accounts/oidc/authentik/login/callback/",
+        "https://paperless.riotpiao.com/accounts/oidc/authentik/login/callback/"]},
+    "poimen": {**_WEB, "redirect_uris": [
+        "http://localhost:3000/callback", "https://poimen.riotpiao.com/callback"]},
+    "queue-sqs": {**_WEB, "redirect_uris": [
+        "http://localhost:8080/callback", "https://queue.riotpiao.com/callback"]},
+    "vault": {**_WEB, "redirect_uris": [
+        "http://localhost:8200/ui/vault/auth/oidc/oidc/callback",
+        "https://vault.riotpiao.com/ui/vault/auth/oidc/oidc/callback"]},
+}
+
 
 _TEMP_FILES: set[str] = set()
 
@@ -155,6 +253,13 @@ def curl_json(method: str, url: str, token: str | None = None, body: dict | None
     cfg = [f'url = "{esc(url)}"', f'request = "{method}"', "silent", "show-error",
            f"max-time = {timeout}", 'write-out = "\\n%{http_code}"',
            'header = "Content-Type: application/json"']
+    # Reaching the instance by name needs either public DNS through the tunnel
+    # or a pinned address. ZITADEL picks the instance from the Host header, so a
+    # plain port-forward fails with "Instance not found". Set this to bypass DNS:
+    #   ZITADEL_CURL_RESOLVE=zitadel.riotpiao.com:443:192.168.1.160
+    pinned = os.environ.get("ZITADEL_CURL_RESOLVE", "").strip()
+    if pinned:
+        cfg.append(f'resolve = "{esc(pinned)}"')
     if token:
         cfg.append(f'header = "Authorization: Bearer {esc(token)}"')
     if body is not None:
@@ -179,27 +284,233 @@ def phase_keys(_args: argparse.Namespace) -> int:
 
 # ── phase: apply ───────────────────────────────────────────────────────────
 
-def phase_apply(args: argparse.Namespace) -> int:
-    need("terraform")
-    if not args.org_id:
-        die("apply requires --org-id (ZITADEL console -> Organization settings -> Resource ID)")
-    key = CONF_DIR / "iam-admin.json"
-    if not key.exists():
-        die(f"{key} missing — run the keys phase first")
-    env = dict(os.environ, ZITADEL_JWT_PROFILE_FILE=str(key))
+def _api(method: str, path: str, token: str, body: dict | None = None,
+         timeout: int = 30) -> tuple[int, dict]:
+    code, payload = curl_json(method, f"{BASE_URL}{path}", token=token, body=body, timeout=timeout)
+    try:
+        return code, (json.loads(payload) if payload.strip() else {})
+    except json.JSONDecodeError:
+        return code, {"_raw": payload}
 
-    for cmd in (["init", "-input=false"], ["fmt", "-check", "-recursive"]):
-        cp = run(["terraform", f"-chdir={TF_DIR}", *cmd], env=env)
-        if cp.returncode != 0:
-            die(f"terraform {' '.join(cmd)} failed: {cp.stderr.strip() or cp.stdout.strip()}")
 
-    cp = run(["terraform", f"-chdir={TF_DIR}", "apply", "-input=false", "-auto-approve",
-              f"-var=org_id={args.org_id}"], env=env)
-    sys.stdout.write(cp.stdout)
-    sys.stderr.write(cp.stderr)
-    if cp.returncode != 0:
-        die("terraform apply failed — no SOPS value was written. Objects created before the "
-            "failure stay in ZITADEL; re-run apply once the cause is fixed")
+def _ensure_project(token: str, name: str) -> str:
+    code, d = _api("POST", "/management/v1/projects/_search", token, {})
+    project_id = ""
+    for row in d.get("result") or []:
+        if row.get("name") == name:
+            project_id = row["id"]
+            break
+    if not project_id:
+        code, d = _api("POST", "/management/v1/projects", token, {"name": name})
+        if code not in (200, 201) or not d.get("id"):
+            die(f"create project {name} failed: {code} {d}")
+        project_id = d["id"]
+
+    # projectRoleAssertion puts the project roles into the ACCESS token as
+    # `urn:zitadel:iam:org:project:roles`. Without it the api-gw sees no
+    # llm:inference role and answers 403 for every inference call, even when
+    # the caller is correctly authorised in ZITADEL.
+    code, d = _api("PUT", f"/management/v1/projects/{project_id}",
+                   token, {"name": name, "projectRoleAssertion": True})
+    if code not in (200, 201):
+        die(f"enable projectRoleAssertion on {name} failed: {code} {d}")
+    return project_id
+
+
+def _ensure_builtin_login(token: str) -> None:
+    """Force the built-in login page instead of the hosted Login UI.
+
+    The hosted UI authenticates as the machine user `login-client`, which the
+    chart creates only from its one-shot setup job. When that user is missing,
+    every session write fails with "Could not create session for user" and no
+    one can sign in, at ZITADEL or at any relying party.
+
+    Disabling the loginV2 feature makes the server serve its own login page,
+    which needs no machine user. This is instance state in the database, not a
+    values key, so it must be applied explicitly.
+    """
+    code, d = _api("PUT", "/v2/features/instance", token, {"loginV2": {"required": False}})
+    if code not in (200, 201):
+        die(f"disable loginV2 failed: {code} {d}")
+    print("login page    : built-in (loginV2.required=false)")
+
+
+def _ensure_roles(token: str, project_id: str, roles: dict[str, str]) -> None:
+    code, d = _api("POST", f"/management/v1/projects/{project_id}/roles/_search", token, {})
+    # ZITADEL answers with `key`, not `roleKey`. Reading the wrong field left
+    # this set empty, so every re-run tried to recreate existing roles and died
+    # on the first 409.
+    have = {(r.get("key") or r.get("roleKey")) for r in (d.get("result") or [])}
+    for key, display in roles.items():
+        if key in have:
+            continue
+        code, d = _api("POST", f"/management/v1/projects/{project_id}/roles", token,
+                       {"roleKey": key, "displayName": display, "group": PROJECT_GROUP})
+        if code not in (200, 201):
+            die(f"create role {key} failed: {code} {d}")
+
+
+def _ensure_oidc_apps(token: str, project_id: str, apps: dict[str, dict],
+                      known_secrets: dict[str, str] | None = None) -> tuple[dict, dict]:
+    code, d = _api("POST", f"/management/v1/projects/{project_id}/apps/_search", token, {})
+    existing = {a.get("name"): a for a in (d.get("result") or [])}
+    ids: dict[str, str] = {}
+    secrets: dict[str, str] = {}
+    known_secrets = known_secrets or {}
+    for name, spec in apps.items():
+        row = existing.get(name)
+        created = False
+        if row:
+            ids[name] = (row.get("oidcConfig") or {}).get("clientId", "")
+            app_id = row.get("id")
+        else:
+            body = {
+                "name": name,
+                "redirectUris": spec["redirect_uris"],
+                "responseTypes": ["OIDC_RESPONSE_TYPE_CODE"],
+                "grantTypes": ["OIDC_GRANT_TYPE_AUTHORIZATION_CODE",
+                               "OIDC_GRANT_TYPE_REFRESH_TOKEN"],
+                "appType": spec.get("app_type_id", "OIDC_APP_TYPE_WEB"),
+                "authMethodType": spec.get("auth_method_id", "OIDC_AUTH_METHOD_TYPE_BASIC"),
+                "devMode": bool(spec.get("dev_mode")),
+                "accessTokenType": "OIDC_TOKEN_TYPE_BEARER",
+                "version": "OIDC_VERSION_1_0",
+                "idTokenRoleAssertion": True,
+            }
+            code, d = _api("POST", f"/management/v1/projects/{project_id}/apps/oidc", token, body)
+            if code not in (200, 201) or not d.get("appId"):
+                die(f"create app {name} failed: {code} {d}")
+            app_id = d["appId"]
+            ids[name] = d.get("clientId", "")
+            created = True
+        if spec.get("auth_method_id") == "OIDC_AUTH_METHOD_TYPE_NONE":
+            continue
+        if not created:
+            # ZITADEL keeps one client secret per app, and the API cannot read it
+            # back. Generating a new one here would replace the deployed copy and
+            # break that app's login, so reuse the value already on disk.
+            if known_secrets.get(name):
+                secrets[name] = known_secrets[name]
+            continue
+        code, d = _api("POST",
+                       f"/management/v1/projects/{project_id}/apps/{app_id}"
+                       "/oidc_config/_generate_client_secret", token, {})
+        if code in (200, 201) and d.get("clientSecret"):
+            secrets[name] = d["clientSecret"]
+    return ids, secrets
+
+
+def _ensure_smtp(token: str) -> str:
+    """Make sure the instance has one active SMTP provider.
+
+    ZITADEL sends verification codes and password resets by SMTP only. A
+    freshly added config is created INACTIVE (state 3), and an inactive config
+    makes GetSMTPConfig answer 404 "SMTP configuration not found", so nothing is
+    ever delivered. Activating it is what enables sending: after the activate
+    call the same GET returns the config and a resend reaches the relay.
+
+    This is instance state in the database, not a values key, so it must be
+    applied explicitly. The host points at the in-cluster smtp-gotify relay
+    (k8s/infra/iam/smtp-gotify.yaml), which forwards to Gotify.
+    """
+    code, d = _api("GET", "/admin/v1/smtp", token)
+    if code == 200 and (d.get("smtpConfig") or {}).get("id"):
+        smtp_id = d["smtpConfig"]["id"]
+        print(f"smtp      : already active ({smtp_id})")
+        return smtp_id
+
+    code, d = _api("POST", "/admin/v1/smtp", token, {
+        "senderAddress": SMTP_FROM,
+        "senderName": SMTP_FROM_NAME,
+        "host": SMTP_HOST,
+        "tls": False,
+    })
+    if code not in (200, 201) or not d.get("id"):
+        die(f"create smtp config failed: {code} {d}")
+    smtp_id = d["id"]
+
+    # The activate call is mandatory: without it the config stays inactive and
+    # every send is dropped while the API still reports success.
+    code, d = _api("POST", f"/admin/v1/smtp/{smtp_id}/_activate", token, {})
+    if code not in (200, 201):
+        die(f"activate smtp config {smtp_id} failed: {code} {d}")
+
+    code, d = _api("GET", "/admin/v1/smtp", token)
+    if code != 200 or not (d.get("smtpConfig") or {}).get("id"):
+        die(f"smtp config {smtp_id} still not visible after activate: {code} {d}")
+    print(f"smtp      : active ({smtp_id}) -> {SMTP_HOST}")
+    return smtp_id
+
+
+def _ensure_login_policy(token: str) -> None:
+    """Require password + a second factor, and demand enrolment at login.
+
+    Enforcement needs forceMfa. The v1 endpoint ignores the spelling "forceMFA"
+    as an unknown field, which is why earlier runs looked successful while
+    projections.login_policies5 kept force_mfa = false.
+
+    Second factors stay OTP and U2F: an authenticator app or a hardware key.
+    Multi-factor is left configured for U2F with verification so a later step
+    can move 2FA to 2MFA without another policy change.
+    """
+    code, d = _api("PUT", "/admin/v1/policies/login", token, {
+        # Case matters: protojson accepts "forceMfa", the lowerCamel form of
+        # force_mfa. Sending "forceMFA" is silently ignored as an unknown field,
+        # so the policy looks unchanged and MFA is never enforced.
+        "forceMfa": True,
+        "forceMfaLocalOnly": True,
+        "allowUsernamePassword": True,
+        "allowRegister": False,
+        "allowExternalIDP": True,
+        "hidePasswordReset": False,
+        "ignoreUnknownUsernames": True,
+        "passwordCheckLifetime": "864000s",
+        "externalLoginCheckLifetime": "864000s",
+        "mfaInitSkipLifetime": "0s",
+        "secondFactorCheckLifetime": "64800s",
+        "multiFactorCheckLifetime": "64800s",
+        "secondFactors": ["SECOND_FACTOR_TYPE_OTP", "SECOND_FACTOR_TYPE_U2F"],
+        "multiFactors": ["MULTI_FACTOR_TYPE_U2F_WITH_VERIFICATION"],
+        "passwordlessType": "PASSWORDLESS_TYPE_ALLOWED",
+    })
+    # ZITADEL answers 400 "has not been changed" when the policy already matches.
+    # That is success for an idempotent run, not a failure.
+    if code not in (200, 201) and "has not been changed" not in str(d.get("message", "")):
+        die(f"update login policy failed: {code} {d}")
+    print("login policy : password + 2FA, enrolment required")
+
+
+def phase_apply(_args: argparse.Namespace) -> int:
+    """Declare the ZITADEL objects through the API. No Terraform, no state drift."""
+    token = bootstrap_token()
+    if not token:
+        die("no iam-admin PAT — run the keys phase first")
+
+    _ensure_builtin_login(token)
+    _ensure_smtp(token)
+    _ensure_login_policy(token)
+    project_id = _ensure_project(token, PROJECT_NAME)
+    print(f"project   : {PROJECT_NAME} ({project_id})")
+    _ensure_roles(token, project_id, ROLES)
+    print(f"roles     : {len(ROLES)} ensured")
+    known: dict[str, str] = {}
+    try:
+        known = (json.loads(STATE_FILE.read_bytes()).get("client_secrets", {})
+                 .get("value", {}) or {})
+    except (OSError, ValueError):
+        known = {}
+    ids, secrets = _ensure_oidc_apps(token, project_id, OIDC_APPS, known)
+    print(f"oidc apps : {len(ids)} ensured, {len(secrets)} secrets issued")
+
+    state = {
+        "project_id": {"value": project_id},
+        "client_ids": {"value": ids},
+        "client_secrets": {"value": secrets},
+        "machine_keys": {"value": {}},
+        "groups_claim_enabled": {"value": False},
+    }
+    write_private(STATE_FILE, json.dumps(state, indent=2, sort_keys=True).encode())
+    print(f"state     -> {STATE_FILE} (0600)")
     return 0
 
 
@@ -213,8 +524,8 @@ SECRET_MAP = {
                  "GF_AUTH_GENERIC_OAUTH_CLIENT_SECRET", "secret")],
     "minio": [("minio-secrets.enc.yaml", "minio-oidc",
                "MINIO_IDENTITY_OPENID_CLIENT_SECRET", "secret")],
-    "paperless-ai-agent": [("paperless-ai-secrets.enc.yaml", "paperless-ai-config",
-                            "LLM_AUTH_CLIENT_SECRET", "secret")],
+    "paperless": [("paperless-ai-secrets.enc.yaml", "paperless-ai-config",
+                   "LLM_AUTH_CLIENT_SECRET", "secret")],
 }
 
 # Clients whose client_id lives in a plain (unencrypted) manifest. They need the
@@ -224,30 +535,21 @@ CLIENT_ID_MAP = {
     "grafana": ("k8s/infra/logging/grafana-values.yaml",
                 r"(?m)^(\s*client_id:\s*)\S+\s*$", r"\g<1>{value}"),
     "minio": ("k8s/infra/minio/minio-tenant.yaml",
-              r"(?m)^(\s*value:\s*)\"minio\"\s*$", r'\g<1>"{value}"'),
-    "paperless-ai-agent": ("k8s/apps/paperless/paperless-ai.yaml",
-                           r"client_id=paperless-ai-agent", "client_id={value}"),
+              r'(?m)^(\s*value:\s*)"(?:minio|\d+)"\s*$', r'\g<1>"{value}"'),
+    "paperless": ("k8s/apps/paperless/paperless-ai.yaml",
+                  r"client_id=(?:paperless-ai-agent|\d+)", "client_id={value}"),
 }
 
 # Secrets that a live workload mounts but no SOPS file in git defines. The phase
 # cannot re-point them safely, so it names them.
-MANUAL_ONLY = {
-    "homarr": "Secret homarr-oidc (keys client-id, client-secret) has no SOPS file in git — "
-              "adopt it first, then add it to SECRET_MAP. The repo also carries an orphan "
-              "homarr-auth-oidc.enc.yaml that nothing consumes.",
-}
+MANUAL_ONLY: dict[str, str] = {}
 
 
-def terraform_outputs() -> dict:
-    need("terraform")
-    key = CONF_DIR / "iam-admin.json"
-    if not key.exists():
-        die(f"{key} missing — run the keys phase first")
-    env = dict(os.environ, ZITADEL_JWT_PROFILE_FILE=str(key))
-    cp = run(["terraform", f"-chdir={TF_DIR}", "output", "-json"], env=env)
-    if cp.returncode != 0:
-        die(f"terraform output failed: {cp.stderr.strip()}")
-    return json.loads(cp.stdout or "{}")
+def state_outputs() -> dict:
+    """Read the object map written by the apply phase."""
+    if not STATE_FILE.exists():
+        die(f"{STATE_FILE} missing — run the apply phase first")
+    return json.loads(STATE_FILE.read_text())
 
 
 def sops_env() -> dict:
@@ -345,13 +647,13 @@ def update_client_id(client: str, value: str, dry_run: bool, apply_config: bool)
 
 def phase_secrets(args: argparse.Namespace) -> int:
     need("sops")
-    out = terraform_outputs()
+    out = state_outputs()
     ids = out.get("client_ids", {}).get("value", {})
     secrets = out.get("client_secrets", {}).get("value", {})
     machine_keys = out.get("machine_keys", {}).get("value", {})
 
     if not ids and not machine_keys:
-        die("terraform has no ZITADEL outputs yet — run the apply phase first")
+        die("no ZITADEL objects recorded yet — run the apply phase first")
 
     print("[1/3] client secrets into SOPS")
     for client, entries in SECRET_MAP.items():
@@ -438,7 +740,7 @@ def phase_verify(_args: argparse.Namespace) -> int:
     if code != 200:
         die("discovery endpoint is not 200 — the instance or the ingress is not ready")
 
-    out = terraform_outputs()
+    out = state_outputs()
     ids = out.get("client_ids", {}).get("value", {})
     print(f"client apps    : {len(ids)}")
     enabled = bool(out.get("groups_claim_enabled", {}).get("value"))

terraform/edge/cloudflare.tf

@@ -0,0 +1,51 @@
+# Cloudflare side of the edge.
+#
+# The tunnel itself is remotely managed today: its token lives in
+# k8s/apps/cloudflared and the public hostnames are configured in the Zero
+# Trust dashboard. Terraform can own the DNS records without owning the tunnel,
+# which is the safe half: a record change is reversible, a tunnel config rewrite
+# removes every hostname the plan does not list.
+
+locals {
+  # CNAME target of every remotely-managed tunnel.
+  tunnel_target = "${var.tunnel_id}.cfargotunnel.com"
+}
+
+resource "cloudflare_dns_record" "tunnel" {
+  for_each = toset(var.cloudflare_tunnel_hostnames)
+
+  zone_id = var.cloudflare_zone_id
+  name    = each.value
+  type    = "CNAME"
+  content = local.tunnel_target
+  proxied = var.cloudflare_dns_proxied
+  ttl     = var.cloudflare_dns_ttl
+  comment = "cloudflared tunnel; managed by terraform/edge"
+
+  # A proxied CNAME must point at the tunnel target. A CNAME to any other
+  # hostname breaks the tunnel mapping.
+  lifecycle {
+    precondition {
+      condition     = var.cloudflare_dns_proxied
+      error_message = "Tunnel CNAMEs must be proxied; an unproxied record bypasses the tunnel."
+    }
+  }
+}
+
+# Optional: take the tunnel configuration into Terraform. Off by default.
+# Applying it REPLACES the whole ingress list. Import first:
+#   terraform import cloudflare_zero_trust_tunnel_cloudflared_config.this \
+#     <account_id>/<tunnel_id>
+resource "cloudflare_zero_trust_tunnel_cloudflared_config" "this" {
+  count = var.manage_tunnel_config ? 1 : 0
+
+  account_id = var.cloudflare_account_id
+  tunnel_id  = var.tunnel_id
+
+  config = {
+    ingress = concat(
+      [for host, service in var.tunnel_ingress : { hostname = host, service = service }],
+      [{ service = "http_status:404" }],
+    )
+  }
+}

terraform/edge/outputs.tf

@@ -0,0 +1,40 @@
+output "cloudflare_records" {
+  description = "Hostnames now managed in the Cloudflare zone."
+  value       = sort(keys(cloudflare_dns_record.tunnel))
+}
+
+output "tunnel_config_managed" {
+  description = "Whether Terraform owns the tunnel ingress list. False means the dashboard still does."
+  value       = var.manage_tunnel_config
+}
+
+output "relay_public_ip" {
+  description = "Public address of the Tencent relay. Point the .cn DNS at it, or let the module do it."
+  value       = tencentcloud_instance.relay.public_ip
+}
+
+output "china_hostnames" {
+  description = "Fully qualified China hostnames served by the relay."
+  value       = [for host in var.china_hostnames : "${host}.${var.china_domain}"]
+}
+
+output "wireguard_peer" {
+  description = "Peer stanza for the homelab side. Add it to the cluster's wg0.conf; the relay already trusts this public key."
+  value       = <<-EOT
+    [Peer]
+    PublicKey = <relay public key; see /etc/wireguard/wg0.conf on the relay>
+    Endpoint = ${tencentcloud_instance.relay.public_ip}:${var.wireguard_port}
+    AllowedIPs = ${var.wireguard_relay_address}
+    PersistentKeepalive = 25
+  EOT
+}
+
+output "next_manual_steps" {
+  description = "What this module cannot do for you."
+  value = [
+    "Confirm the ICP filing for ${var.china_domain} if the relay is in a mainland region.",
+    "Issue a certificate for the China hostnames on the relay (Caddy ACME needs the DNS-01 challenge for a .cn domain).",
+    "Run a WireGuard peer in the cluster that dials ${tencentcloud_instance.relay.public_ip}:${var.wireguard_port}.",
+    "Add the .cn origins to the OIDC client redirect URIs before any China user logs in.",
+  ]
+}

terraform/edge/providers.tf

@@ -0,0 +1,47 @@
+# terraform/edge — the China-facing edge, plus DNS ownership for the existing zone
+#
+# Purpose: give users in mainland China a short, stable path to the homelab
+# without touching the Cloudflare path that serves everyone else.
+#
+#   China user -> <service>.<china_domain> -> Tencent CVM (this module)
+#              -> WireGuard tunnel -> ingress-nginx (192.168.1.160) -> service
+#
+#   Everyone else -> Cloudflare -> cloudflared tunnel -> same ingress (unchanged)
+#
+# The homelab still opens no inbound port: the tunnel is established outbound
+# from the cluster to the CVM.
+#
+# Credentials come from the environment, never from a file in git:
+#   export CLOUDFLARE_API_TOKEN=...
+#   export TENCENTCLOUD_SECRET_ID=...
+#   export TENCENTCLOUD_SECRET_KEY=...
+#   terraform -chdir=terraform/edge init
+#   terraform -chdir=terraform/edge plan -var china_domain=example.cn ...
+#
+# State is local and git-ignored. It carries no
+# credential today, but it will once InstanceData or certificates are added, so
+# treat it as a secret and move it to MinIO before a second operator applies.
+terraform {
+  required_version = ">= 1.6.0"
+
+  required_providers {
+    cloudflare = {
+      source  = "cloudflare/cloudflare"
+      version = "5.28.1"
+    }
+    tencentcloud = {
+      source  = "tencentcloudstack/tencentcloud"
+      version = "1.83.38"
+    }
+  }
+}
+
+provider "cloudflare" {
+  api_token = var.cloudflare_api_token
+}
+
+provider "tencentcloud" {
+  secret_id  = var.tencent_secret_id
+  secret_key = var.tencent_secret_key
+  region     = var.tencent_region
+}

terraform/edge/templates/Caddyfile.tpl

@@ -0,0 +1,22 @@
+# Rendered by terraform/edge. Do not edit on the instance.
+#
+# Caddy terminates TLS for the .cn hostnames and forwards over the WireGuard
+# tunnel to ingress-nginx. flush_interval -1 disables response buffering so
+# Server-Sent Events reach the client chunk-by-chunk.
+{
+	email ${acme_email}
+	admin off
+}
+
+${hosts} {
+	reverse_proxy ${ingress_upstream} {
+		flush_interval -1
+	}
+
+	header {
+		Strict-Transport-Security "max-age=31536000; includeSubDomains"
+		X-Content-Type-Options "nosniff"
+		X-Frame-Options "DENY"
+		Referrer-Policy "strict-origin-when-cross-origin"
+	}
+}

terraform/edge/tencent.tf

@@ -0,0 +1,169 @@
+# The relay: one small CVM in Tencent Cloud that terminates TLS for the .cn
+# domain and forwards over WireGuard to the homelab ingress.
+#
+# Why a relay and not Cloudflare: mainland clients reach a Tencent edge far
+# faster than a Cloudflare edge, and Cloudflare's China network is an
+# Enterprise product. The homelab keeps zero inbound exposure because the
+# tunnel is dialled outbound from the cluster.
+#
+# ICP FILING: a mainland resource serving HTTP/HTTPS for a domain requires an
+# ICP filing naming that domain. Without it this instance accepts the
+# connection and the mainland network resets the HTTP layer. Put the relay in a
+# non-mainland region (ap-hongkong, ap-singapore) when no filing exists.
+
+resource "tencentcloud_vpc" "edge" {
+  name       = "${replace(var.china_domain, ".", "_")}_edge"
+  cidr_block = var.edge_vpc_cidr
+}
+
+resource "tencentcloud_subnet" "edge" {
+  name              = "${replace(var.china_domain, ".", "_")}_edge"
+  vpc_id            = tencentcloud_vpc.edge.id
+  availability_zone = var.tencent_availability_zone
+  cidr_block        = var.edge_subnet_cidr
+}
+
+resource "tencentcloud_key_pair" "edge" {
+  key_name   = "${replace(var.china_domain, ".", "_")}_edge"
+  public_key = var.relay_ssh_public_key
+}
+
+resource "tencentcloud_security_group" "edge" {
+  name        = "${replace(var.china_domain, ".", "_")}_edge"
+  description = "TLS + WireGuard for the ${var.china_domain} relay; SSH from the operator only"
+}
+
+resource "tencentcloud_security_group_rule" "ssh" {
+  security_group_id = tencentcloud_security_group.edge.id
+  type              = "ingress"
+  ip_protocol       = "tcp"
+  port_range        = "22"
+  cidr_ip           = var.relay_admin_cidr
+  policy            = "accept"
+}
+
+resource "tencentcloud_security_group_rule" "tls" {
+  security_group_id = tencentcloud_security_group.edge.id
+  type              = "ingress"
+  ip_protocol       = "tcp"
+  port_range        = "80,443"
+  cidr_ip           = "0.0.0.0/0"
+  policy            = "accept"
+}
+
+resource "tencentcloud_security_group_rule" "wireguard" {
+  security_group_id = tencentcloud_security_group.edge.id
+  type              = "ingress"
+  ip_protocol       = "udp"
+  port_range        = tostring(var.wireguard_port)
+  # The homelab dials outbound and has no static public address, so this is
+  # 0.0.0.0/0 by default. WireGuard authenticates every packet by public key,
+  # and an unauthenticated packet is dropped before it reaches the tunnel.
+  # Narrow this to the homelab egress CIDR when that address is stable.
+  cidr_ip = var.wireguard_allowed_cidr
+  policy  = "accept"
+}
+
+# cloud-init: WireGuard listener, forwarding sysctls, and Caddy for TLS.
+# The relay never holds application credentials; it forwards bytes.
+#
+# NOTE ON THE PRIVATE KEY: user_data is visible in the instance metadata and in
+# Terraform state. That is a known limitation of bootstrapping WireGuard this
+# way. The argument is wrapped in sensitive() to keep it out of plan/apply
+# output, but anyone with console or state access can read it. Rotate the key
+# if the state or the instance metadata is ever exposed.
+locals {
+  china_fqdns = [for host in var.china_hostnames : "${host}.${var.china_domain}"]
+
+  caddyfile = templatefile("${path.module}/templates/Caddyfile.tpl", {
+    acme_email       = var.acme_email
+    hosts            = join(", ", local.china_fqdns)
+    ingress_upstream = var.ingress_upstream
+  })
+
+  relay_user_data = <<-EOT
+    #cloud-config
+    package_update: true
+    package_upgrade: false
+    manage_etc_hosts: true
+    timezone: Asia/Shanghai
+    packages: [wireguard, wireguard-tools, caddy]
+    write_files:
+      - path: /etc/wireguard/wg0.conf
+        permissions: "0600"
+        content: |
+          [Interface]
+          Address = ${var.wireguard_relay_address}
+          ListenPort = ${var.wireguard_port}
+          PrivateKey = ${var.wireguard_relay_private_key}
+          # Masquerade forwarded traffic so the homelab peer only has to accept
+          # packets sourced from the relay's tunnel address. Without this the
+          # homelab peer's AllowedIPs would drop the original client source IP.
+          PostUp = iptables -t nat -A POSTROUTING -o wg0 -j MASQUERADE
+          PostDown = iptables -t nat -D POSTROUTING -o wg0 -j MASQUERADE
+          [Peer]
+          PublicKey = ${var.wireguard_homelab_public_key}
+          AllowedIPs = ${var.wireguard_homelab_allowed_ips}
+          PersistentKeepalive = 25
+      - path: /etc/sysctl.d/99-wireguard.conf
+        content: |
+          net.ipv4.ip_forward = 1
+      - path: /etc/caddy/Caddyfile
+        permissions: "0644"
+        content: ${jsonencode(local.caddyfile)}
+    runcmd:
+      - sysctl --system
+      - systemctl enable --now wg-quick@wg0
+      - caddy validate --config /etc/caddy/Caddyfile
+      - systemctl enable --now caddy
+      - systemctl restart caddy
+  EOT
+}
+
+resource "tencentcloud_instance" "relay" {
+  instance_name     = "${replace(var.china_domain, ".", "_")}_edge"
+  availability_zone = var.tencent_availability_zone
+  image_id          = var.relay_image_id
+  instance_type     = var.relay_instance_type
+
+  vpc_id             = tencentcloud_vpc.edge.id
+  subnet_id          = tencentcloud_subnet.edge.id
+  security_groups    = [tencentcloud_security_group.edge.id]
+  key_ids            = [tencentcloud_key_pair.edge.id]
+  allocate_public_ip = true
+
+  # Outbound only needs a few Mbps; inbound TLS is the same order.
+  internet_max_bandwidth_out = var.relay_internet_max_bandwidth_out
+  system_disk_type           = var.relay_system_disk_type
+  system_disk_size           = var.relay_system_disk_size
+
+  # The private key is embedded in this bootstrap script. sensitive() keeps it
+  # out of CLI output; it does not remove it from state or instance metadata.
+  user_data = sensitive(local.relay_user_data)
+
+  tags = {
+    role   = "china-edge"
+    domain = var.china_domain
+  }
+
+  # Accidental `terraform destroy` would take the only China-facing edge down.
+  # Remove this block deliberately when a replacement path exists.
+  lifecycle {
+    prevent_destroy = true
+  }
+}
+
+# DNS for the .cn domain lives at DNSPod (Tencent). Each subdomain resolves to
+# the relay's public address, and the relay proxies to the homelab over the
+# tunnel. The "中国境内" line is the default line; no separate line records.
+resource "tencentcloud_dnspod_record" "china" {
+  for_each = toset(var.china_hostnames)
+
+  domain      = var.china_domain
+  sub_domain  = each.value
+  record_type = "A"
+  record_line = var.china_dns_record_line
+  value       = tencentcloud_instance.relay.public_ip
+  ttl         = var.china_dns_ttl
+  remark      = "China edge relay; origin is the homelab ingress over WireGuard"
+}

terraform/edge/terraform.tfvars.example

@@ -0,0 +1,45 @@
+# Copy to terraform.tfvars.local (git-ignored) and fill in.
+# Secrets never belong in a committed file: pass them as environment variables
+# instead — TF_VAR_wireguard_relay_private_key, CLOUDFLARE_API_TOKEN,
+# TENCENTCLOUD_SECRET_ID, TENCENTCLOUD_SECRET_KEY.
+
+# ── Cloudflare (existing zone) ───────────────────────────────────────────────
+cloudflare_zone_id = "REPLACE_WITH_ZONE_ID"
+tunnel_id          = "REPLACE_WITH_TUNNEL_UUID"
+
+# Adopt existing records with `terraform import` before the first apply, or the
+# create call collides with the hand-made record of the same name:
+#   terraform import 'cloudflare_dns_record.tunnel["zitadel"]' \
+#     <zone_id>/<record_id>
+#
+# A tunnel CNAME is only half of the path. The tunnel's Public Hostname list
+# (Zero Trust -> Networks -> Tunnels -> Public Hostname) must also map the name
+# to https://<name>.riotpiao.com, or Cloudflare answers 404 from the tunnel even
+# though DNS resolves.
+cloudflare_tunnel_hostnames = ["paperless", "img", "poimen", "zitadel"]
+
+# Leave false until the tunnel config import is understood. True makes
+# Terraform replace the entire ingress list with tunnel_ingress.
+manage_tunnel_config = false
+tunnel_ingress       = {}
+
+# ── China edge (Tencent Cloud) ───────────────────────────────────────────────
+china_domain   = "REPLACE.example.cn"
+china_hostnames = ["paperless", "img"]
+
+# Mainland regions require an ICP filing for the domain. Use ap-hongkong or
+# ap-singapore when no filing exists.
+tencent_region            = "ap-guangzhou"
+tencent_availability_zone = "ap-guangzhou-6"
+relay_instance_type       = "S5.SMALL2"
+relay_image_id            = "REPLACE_WITH_IMAGE_ID"
+relay_ssh_public_key      = "ssh-ed25519 AAAA... operator@laptop"
+relay_admin_cidr          = "REPLACE_WITH_OPERATOR_CIDR"
+
+# ── WireGuard between the relay and the cluster ──────────────────────────────
+# The relay private key comes from `wg genkey`. Keep it in the environment, or
+# in a SOPS file mounted for the run. It is not written by this module.
+wireguard_port                 = 51820
+wireguard_homelab_public_key   = "REPLACE_WITH_HOMELAB_WG_PUBKEY"
+wireguard_relay_address        = "10.88.0.1/24"
+wireguard_homelab_address      = "10.88.0.2/24"

terraform/edge/variables.tf

@@ -0,0 +1,227 @@
+variable "cloudflare_api_token" {
+  description = "Cloudflare API token with Zone:DNS:Edit and, for tunnel config, Account:Cloudflare Tunnel:Edit."
+  type        = string
+  sensitive   = true
+  default     = null
+}
+
+variable "cloudflare_zone_id" {
+  description = "Zone ID of the existing public zone (riotpiao.com)."
+  type        = string
+}
+
+variable "cloudflare_account_id" {
+  description = "Account ID. Required only when manage_tunnel_config is true."
+  type        = string
+  default     = null
+}
+
+variable "tunnel_id" {
+  description = "UUID of the cloudflared tunnel that the DNS records point at."
+  type        = string
+}
+
+# The dashboard remains the source of truth for the remotely-managed tunnel
+# today. Setting this true hands that config to Terraform, which then rewrites
+# the whole ingress list: every hostname not listed in tunnel_ingress is
+# removed from the tunnel. Import first and read the plan before applying.
+variable "manage_tunnel_config" {
+  description = "Take ownership of the remotely-managed tunnel configuration."
+  type        = bool
+  default     = false
+}
+
+variable "tunnel_ingress" {
+  description = "hostname => origin service, used only when manage_tunnel_config is true."
+  type        = map(string)
+  default     = {}
+}
+
+# ── DNS records managed in the Cloudflare zone ───────────────────────────────
+# These names already exist, created by hand in the dashboard. Adopt them with
+# `terraform import` before the first apply, or Terraform will try to create a
+# second record with the same name and Cloudflare will reject it.
+variable "cloudflare_tunnel_hostnames" {
+  description = "Hostnames in the Cloudflare zone that must CNAME to the tunnel."
+  type        = list(string)
+  default     = []
+
+  validation {
+    condition     = alltrue([for h in var.cloudflare_tunnel_hostnames : can(regex("^[a-zA-Z0-9._-]+$", h))])
+    error_message = "cloudflare_tunnel_hostnames entries must be DNS labels or relative names (letters, digits, dot, underscore, hyphen)."
+  }
+}
+
+variable "cloudflare_dns_ttl" {
+  description = "TTL for tunnel CNAME records. 1 means automatic, which is required when proxied is true."
+  type        = number
+  default     = 1
+}
+
+variable "cloudflare_dns_proxied" {
+  description = "Whether tunnel CNAME records are proxied through Cloudflare. Must stay true for a tunnel origin."
+  type        = bool
+  default     = true
+}
+
+# ── China edge ───────────────────────────────────────────────────────────────
+variable "china_domain" {
+  description = "The .cn domain served from Tencent Cloud, without a trailing dot."
+  type        = string
+}
+
+variable "china_hostnames" {
+  description = "Subdomains of china_domain that point at the Tencent relay."
+  type        = list(string)
+  default     = ["paperless", "img"]
+}
+
+variable "tencent_secret_id" {
+  description = "Tencent Cloud SecretId. Prefer TENCENTCLOUD_SECRET_ID in the environment."
+  type        = string
+  sensitive   = true
+  default     = null
+}
+
+variable "tencent_secret_key" {
+  description = "Tencent Cloud SecretKey. Prefer TENCENTCLOUD_SECRET_KEY in the environment."
+  type        = string
+  sensitive   = true
+  default     = null
+}
+
+variable "tencent_region" {
+  description = "Tencent Cloud region for the relay. Mainland regions need an ICP filing for the domain."
+  type        = string
+  default     = "ap-guangzhou"
+}
+
+variable "tencent_availability_zone" {
+  description = "Availability zone inside tencent_region."
+  type        = string
+  default     = "ap-guangzhou-6"
+}
+
+variable "relay_instance_type" {
+  description = "CVM spec for the relay. A relay only terminates TLS and forwards bytes."
+  type        = string
+  default     = "S5.SMALL2"
+}
+
+variable "relay_image_id" {
+  description = "CVM image ID. Find one with: tencentcloud images --image-name 'Ubuntu 24.04' (or the console)."
+  type        = string
+}
+
+variable "relay_ssh_public_key" {
+  description = "Public key injected into the relay for break-glass SSH. Never the private key."
+  type        = string
+}
+
+variable "relay_admin_cidr" {
+  description = "CIDR allowed to reach SSH and WireGuard on the relay. Keep it to the operator, not 0.0.0.0/0."
+  type        = string
+
+  validation {
+    condition     = var.relay_admin_cidr != "0.0.0.0/0" && var.relay_admin_cidr != "::/0"
+    error_message = "relay_admin_cidr must not be the whole internet. Set the operator's egress CIDR."
+  }
+}
+
+variable "wireguard_port" {
+  description = "UDP port of the WireGuard listener on the relay."
+  type        = number
+  default     = 51820
+}
+
+variable "wireguard_allowed_cidr" {
+  description = "CIDR allowed to reach the WireGuard UDP port. The homelab dials outbound, so this is often 0.0.0.0/0; WireGuard authenticates by key. Restrict it to the homelab egress CIDR when that address is static."
+  type        = string
+  default     = "0.0.0.0/0"
+}
+
+variable "wireguard_relay_private_key" {
+  description = "WireGuard private key of the relay side. Generate with `wg genkey`; pass via TF_VAR_wireguard_relay_private_key."
+  type        = string
+  sensitive   = true
+}
+
+variable "wireguard_homelab_public_key" {
+  description = "WireGuard public key of the homelab peer that dials the relay."
+  type        = string
+}
+
+variable "wireguard_relay_address" {
+  description = "Tunnel address of the relay side."
+  type        = string
+  default     = "10.88.0.1/24"
+}
+
+variable "wireguard_homelab_address" {
+  description = "Tunnel address of the homelab side."
+  type        = string
+  default     = "10.88.0.2/24"
+}
+
+# ── Relay networking / sizing ───────────────────────────────────────────────
+variable "edge_vpc_cidr" {
+  description = "CIDR of the relay VPC."
+  type        = string
+  default     = "10.66.0.0/16"
+}
+
+variable "edge_subnet_cidr" {
+  description = "CIDR of the relay subnet."
+  type        = string
+  default     = "10.66.1.0/24"
+}
+
+variable "relay_internet_max_bandwidth_out" {
+  description = "Peak outbound bandwidth in Mbps. The relay only terminates TLS and forwards bytes."
+  type        = number
+  default     = 20
+}
+
+variable "relay_system_disk_type" {
+  description = "System disk type for the relay."
+  type        = string
+  default     = "CLOUD_PREMIUM"
+}
+
+variable "relay_system_disk_size" {
+  description = "System disk size in GB for the relay."
+  type        = number
+  default     = 50
+}
+
+# ── DNS records ──────────────────────────────────────────────────────────────
+variable "china_dns_ttl" {
+  description = "TTL in seconds for the .cn A records."
+  type        = number
+  default     = 600
+}
+
+variable "china_dns_record_line" {
+  description = "DNSPod line for the .cn A records. Use 默认 for the default line."
+  type        = string
+  default     = "默认"
+}
+
+# ── Caddy reverse proxy ──────────────────────────────────────────────────────
+variable "wireguard_homelab_allowed_ips" {
+  description = "AllowedIPs for the homelab peer. Must include the homelab LAN so Caddy can reach ingress-nginx over the tunnel."
+  type        = string
+  default     = "10.88.0.2/32,192.168.1.0/24"
+}
+
+variable "ingress_upstream" {
+  description = "Upstream URL Caddy proxies to over WireGuard (the homelab ingress-nginx)."
+  type        = string
+  default     = "http://192.168.1.160:80"
+}
+
+variable "acme_email" {
+  description = "Contact email for Caddy ACME (Let's Encrypt)."
+  type        = string
+  default     = "[email protected]"
+}

terraform/files/coredns/Corefile

@@ -22,7 +22,6 @@
     # TLS termination (cert-manager cert) and preserve the Host header. Routing
     # via nginx (not the backend service) is critical: a direct rewrite bypasses
     # nginx TLS and exposes each app's own self-signed cert, trusted by nothing.
-    rewrite name authentik.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name zitadel.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name grafana.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local
     rewrite name minio.riotpiao.com ingress-nginx-controller.ingress-nginx.svc.cluster.local

terraform/terraform.tfvars.local.bak

@@ -1,97 +0,0 @@
-# RECOVERED from live cluster state via talosctl get machineconfig.
-# Regenerated after the original tfvars.local was lost/corrupted.
-
-cluster_id  = "Rtc4g2av9EP0mOdxA4M0-QQitzHLWICz-rLBNfrOjgw="
-cluster_secret = "8E0CAeylAPKmmUEQmIGmHQAhQf+8c7NUf43CdrQZ+vg="
-bootstrap_token = "b2q7lh.9w7hwgrulrd65gr3"
-machine_token = "hq9wlf.96l9z46efd79jtr2"
-machine_ca_crt = "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJQekNCOHFBREFnRUNBaEVBMkUwRWZqbG41L1J3eTVjMVJmNkNSakFGQmdNclpYQXdFREVPTUF3R0ExVUUKQ2hNRmRHRnNiM013SGhjTk1qWXdOekE1TURVd056VTRXaGNOTXpZd056QTJNRFV3TnpVNFdqQVFNUTR3REFZRApWUVFLRXdWMFlXeHZjekFxTUFVR0F5dGxjQU1oQUNwR3NQZkVHdEU4anVmNG9JTkNHNnlCQmN6aURFaEpLbDV3CnJib0hSR0tUbzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSEF3RUcKQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkdmaExZUUdaOGYzd3lZZAo0SFI3KzlONnZKQXJNQVVHQXl0bGNBTkJBQ1ZQVlAwcGYxMkdUakYvSHJMZmcwZHBLemdBMlE1OGR5Y0paY0ZvClQvNDdPQk8ra29VZm11dXNjVVNNQnBXS0VuWHNYMFNocmNab3hQd1FHM3diblFFPQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg=="
-machine_ca_key = "LS0tLS1CRUdJTiBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0KTUM0Q0FRQXdCUVlESzJWd0JDSUVJSlR4MXRqZEVOTTg1cGNRRFR0WWRtMFd0QXNBd0tzL1VESlZLN0ZqYU5uUgotLS0tLUVORCBFRDI1NTE5IFBSSVZBVEUgS0VZLS0tLS0K"
-kubernetes_ca_crt = "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJpVENDQVRDZ0F3SUJBZ0lSQUtwT1ZaK29CRzljNHFycEpwaUc4TkV3Q2dZSUtvWkl6ajBFQXdJd0ZURVQKTUJFR0ExVUVDaE1LYTNWaVpYSnVaWFJsY3pBZUZ3MHlOakEzTURrd05UQTNOVGhhRncwek5qQTNNRFl3TlRBMwpOVGhhTUJVeEV6QVJCZ05WQkFvVENtdDFZbVZ5Ym1WMFpYTXdXVEFUQmdjcWhrak9QUUlCQmdncWhrak9QUU1CCkJ3TkNBQVQ1VjJvNkliMUpRZkcza3lCTTBCeTRkd2FLbnlGY2tVdjNVem9yOG1Ba3RaN2JrT2ZKZDlmL2VmcVkKYXBzUFpLV1RHQnYxM3JZbFdvOGtuU3ZnNm83Um8yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXdIUVlEVlIwbApCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4d0hRWURWUjBPCkJCWUVGQ1dPZVJUVHdnN2tnNVNWMG9raFQwY0VDNGwzTUFvR0NDcUdTTTQ5QkFNQ0EwY0FNRVFDSURURCtNYXUKb2JXdkp6UkNMVEdJaHJHc1daalFnalVmRWl2MnhCTXB6RnNVQWlCQzNNWkYwMjVqVHk4Uno2YjI5czVJQmpkNgpZQTVWd0kvNVFieXlwSGFXQlE9PQotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg=="
-kubernetes_ca_key = "LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUUrSEdPcUJJYXpJMzdqNmJJUlA1emVxeXEwZzhBU2xZeGplZUlJcEpIcXBvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFK1ZkcU9pRzlTVUh4dDVNZ1ROQWN1SGNHaXA4aFhKRkw5MU02Sy9KZ0pMV2UyNURueVhmWAovM242bUdxYkQyU2xreGdiOWQ2MkpWcVBKSjByNE9xTzBRPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo="
-etcd_ca_crt = "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJmVENDQVNTZ0F3SUJBZ0lSQVAyaHkwdUhvTm5vSzQyZE9LTk1nU2t3Q2dZSUtvWkl6ajBFQXdJd0R6RU4KTUFzR0ExVUVDaE1FWlhSalpEQWVGdzB5TmpBM01Ea3dOVEEzTlRoYUZ3MHpOakEzTURZd05UQTNOVGhhTUE4eApEVEFMQmdOVkJBb1RCR1YwWTJRd1dUQVRCZ2NxaGtqT1BRSUJCZ2dxaGtqT1BRTUJCd05DQUFRVGlKYUJpSEJPCmJha3JuL0dVdkUxVFd5czRVUkVzVGtVNEM4OG1EdWZYQURjV0NnN2RTRzc0QjkzOGFwSWgybGc4UDhKRDFFRUoKN0RkU1lQVG5zYWh1bzJFd1h6QU9CZ05WSFE4QkFmOEVCQU1DQW9Rd0hRWURWUjBsQkJZd0ZBWUlLd1lCQlFVSApBd0VHQ0NzR0FRVUZCd01DTUE4R0ExVWRFd0VCL3dRRk1BTUJBZjh3SFFZRFZSME9CQllFRkliYTBLaEhmM3hhClBQNk1hb3dESUNWVXBLdDVNQW9HQ0NxR1NNNDlCQU1DQTBjQU1FUUNJRzZMYUJGeGgvcys2WXpGdVlwaUxUWlYKS2prOGh5UVNvMmVTZTJTUy81MG5BaUI0a0RNWnR4b1UzTitHc3BEOHVEbXFrNlhxbzZoeE0vbG0yU21OMzlPNAovdz09Ci0tLS0tRU5EIENFUlRJRklDQVRFLS0tLS0K"
-etcd_ca_key = "LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUUwZ3JiMk0yblA4c1hxWjVhd3NzNThwbUdvb1FlSWg3a3RoWVlxNzhZZThvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFRTRpV2dZaHdUbTJwSzUveGxMeE5VMXNyT0ZFUkxFNUZPQXZQSmc3bjF3QTNGZ29PM1VodQorQWZkL0dxU0lkcFlQRC9DUTlSQkNldzNVbUQwNTdHb2JnPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo="
-aggregator_ca_crt = "LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUJZVENDQVFhZ0F3SUJBZ0lSQUpxeFI3alBzcmhzRUp2cmtEWndYR3N3Q2dZSUtvWkl6ajBFQXdJd0FEQWUKRncweU5qQTNNRGt3TlRBM05UaGFGdzB6TmpBM01EWXdOVEEzTlRoYU1BQXdXVEFUQmdjcWhrak9QUUlCQmdncQpoa2pPUFFNQkJ3TkNBQVFBWWlieHY1ZDVFRGdTbWhlRHlhYjJLZGh4ZFZnZ3lQc2pNcjBET0JMVmxtQmpMcXFqClpNSkk2d1ZmV2hkUjBRVGxVdEFLZDJvREJZLy9TeDBzQi9qY28yRXdYekFPQmdOVkhROEJBZjhFQkFNQ0FvUXcKSFFZRFZSMGxCQll3RkFZSUt3WUJCUVVIQXdFR0NDc0dBUVVGQndNQ01BOEdBMVVkRXdFQi93UUZNQU1CQWY4dwpIUVlEVlIwT0JCWUVGSTkrWm1EYVBybDhrTnhXUUxOT3ErTmVzeEh0TUFvR0NDcUdTTTQ5QkFNQ0Ewa0FNRVlDCklRRC9DRUZ2SUVHMW9qcmRZRVUzUldmTklLV1FwVXlZQWJ1ZGE0T0ZWQS9yOUFJaEFPS1VOZFF6bUk2WVZOdzgKeklDejlLblRxazQrT3dvV3RjNVl5SmlKR29zUgotLS0tLUVORCBDRVJUSUZJQ0FURS0tLS0tCg=="
-aggregator_ca_key = "LS0tLS1CRUdJTiBFQyBQUklWQVRFIEtFWS0tLS0tCk1IY0NBUUVFSUFoOEwycXFLbUxoYkpmczJ2M3ZRWXBFZHF6Ri9hTGZhSmoraEZRazdPY2NvQW9HQ0NxR1NNNDkKQXdFSG9VUURRZ0FFQUdJbThiK1hlUkE0RXBvWGc4bW05aW5ZY1hWWUlNajdJeks5QXpnUzFaWmdZeTZxbzJUQwpTT3NGWDFvWFVkRUU1VkxRQ25kcUF3V1AvMHNkTEFmNDNBPT0KLS0tLS1FTkQgRUMgUFJJVkFURSBLRVktLS0tLQo="
-service_account_key = "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKSndJQkFBS0NBZ0VBd3NNZU40eE1YQkZ0VVE2dVZ2NEZFU1dNT2ZLc1RKdmxHa0ptVG1URjJIazg1SlJvCkhuQU1nMEkvMEJiMGFUQTJ3MjlkSEUrdUN6dFd5eVVqTzV5eWdJSDQ0Q2RtVnNHVzVua1Z0TmFGNzNpcFllbjYKaG11bmRoWDY1VndqOHpVUmFYZUxtUEc0Y2d4dk5SOXdGYUZXS0ZZdzQzdGtlWjg5S0F5QTNibjFXN3JHTloyOQovcXRYWEcrQnFSSlVuUzhXQmt4dkErUktyRE1OVHF4bjVGOEl1VkpTWkw5bDVEd3lSUnNqMjVMZVdRZUFYenl6CllWcmFKZmVubSt6L3hLZjhLdHFZMSs5U1pwbkZsS2N6TGlWVzg4WkJ5TnR0KytYZjB4N3FSL2lQOHhRQXV0ckIKV1pTbytoa01FRjV5YU0wQWdxcG5mbDBsUmhsM0I0UUx3NHkyTUpoTEpyQ1ltQjl1QllLWU5oRE5NOXk0Z1lrZgpacmdEdm9NdGpsSUJUUHRyVjMyemxYN05Od3d5UjdXOXp5ZlBSVjEvbjhpMk9KR0szeittdGNCR2Y0TS8veDFsClJRNEhzWWhDUVJRaE8vQWp2U2QvQlhFRnB3dEhsb1VYRU5nQ2lPSW00MnFrZTNWb3lLbjJ2Q3g2QlhodlJVZDAKUHgvK0JpM0d4RmRoa2Uxa0doelJLQTdySGhEMVBkVGsyM04wUXV3WHNNVDZRWXVrRDdPZG5KdFZtZVN4TkxqcwptdVpybmpwRzZsaHRDSmdvMGdVeXBYQ2RlWGVnZ0dIc0JCMks4NjIrdThVa0dwMk9IQUhGeldsdDF5L2VXTW9PCmhneWx1SEVLcjkzUU5uNDZsTGtZTDViWjlVTUZ0NXBMRFVrSFQxNkV5dTh0V21ET2ZoQ3Z3M1lmRWY4Q0F3RUEKQVFLQ0FnQUdSbUlSV1JoV3VRc0VHd3g3NmdoQXdxeHZhNFdvbkRjMzd0Njc5Tnc0K3NMKy9GY1ViL2kvTytHeApjeVBoeGJkbCtZOE82L1JJRVZ2ZEJLL0xhbU9INTJnYzFMZ2o0RzNidEJnQ2NRejBwN2NSWEFnQno3TWdCMXBECmpJSHVBbzR5anpMMHRRa0R4Nm5IbE9FNEdUQWM4WlgycGxHWTU0d0JYOUhCRXc0NEs5N1orR0NZTlc0Rm9PUVYKRGUyaStOTGxWZzRYbW9IYlpYT3V6cmcwTCttb2l1SHp0QVQwNHdtZGwxL0M0Y3IvSkZJNi8wb3FQMUthK1kweApaV1BpTXFWWnZoeEJqTWpqWEYzMHlhUkkvdFA3MjYzZjZrM3pXVGNxWnFzV3NZZjF4WFcyajNpK1NaOWVHM043CmpZZHpIL085d2Y2K29BS2s3UW9jT0dGbXBnQnlwdm9JbytlSFdjZlpZNFNXNloyeTRacUl0M2xTSWFHMEtmQjEKUnVrSVBtMlYzNDNlc3Azdy9TV2liRVU2elhvd01sWjlZc0dPalY1MTZDQmJZK0lQcmY2RXY0UFhDWjlnUERxcgpnUFFIZ0lFS294aUdYK2dENG9pYWdUMWVVSk1iYWZkaEkzSHJMWk9YbUpBZU40RHpOZXR1SGRsTk13YnpZZHN5CnpyMllSMkhqNTZydk9hcWZZUFJKV1NmS3ozRlhQdDNDMHJRVmNRekVqV1ZZbm9MZG9yR3FkaU1uMyt1NzF2RW4KSnluZksvN3VRSDY5VTU3NGNKK3FjOFNtNTlPeHBnN1RoODljMUZTeSszTk03bTE2czlJcjQvcG94Q2pWaHNWeQpKRmN2cHE4UTMwek9CQk0waUxyblNKcVRXaXJDRU8xNHlRY0VLbFBVd2VGUWdJK05pUUtDQVFFQTMwMWNrTnZuCmpaRHduRXFQaWp4SlBDSUNEeHcxYWtnVTZUNUpMVkt5SUFnK3BYNHlPZDZtendvV2hpWE5oVUQ5eWxPL21lTEsKSDRPUXVzeWdJUDdkOVNKZi9ZVTV5a1RZaVZLMUdzM1loZXovRmhRQXdBQUg4UmdBdW8rZU9UTUcyT0IxM2loLworQlFYL1lrOG9VR1M0YlpsZWNGWG5pSTZ5S0g1MUJUQ3g0ZTZZcStvdGMrMFc2RzBRVHVBT3JWcjdXWklGY1htClVDdElReXRJN2s2UVd6SXU0K3dnVnU3OUdrUEJTMHNBaXhzU0ppYXRTNzk1TjlhYjYwRzNDeVFWZDZWajJaVmEKWGpCR1oyQXREalpEWS9MMDlZQTlRVUxDbWVqT2hYVFlGNkJuNnRkYmVjeVlZTHdNS2MzWEhqNEt2U2ZaQ01HTwpvUXROdnFoUFFlSWpxUUtDQVFFQTMwZnFCSThDK2QwdXJlM1JhNFFRdUlzUC9xVTMyejIzMUdzbTZOOXlQd0hUClM4ZzlrS0ZDYzhMVGlmWFdnajhIRWxTVjVLSXJseERwZEVWQ1pEM05qdy9GVDdHcHV5SVplN1E3VlhiNld3MnYKY1I0M1FkdUQvOEc4ZkdlZGkrZ1BnKzlzeURCQXFIVzFGSHl1RmVaWGNsVTF1cndOV3V3TlFKUnZHczFoK1NuQQpXVmJxd1ZUL01GMmYxTjlBaFN0alhkM0Nscm1rb0o4ek05YW0zVWg5VUprQ2xSZi9mZVRONXZndE1odS9NNGtGCmVQYUlBMTVqT3h1cEFMN3ptVVVxZ0h1NE9yMm5mYTVNNHMzWTR6TVRYYm9VZGNVT09oRTRzU0J2bGlaak5KL3QKV2pSTmJmUWhxbWRBTTNZZjFGUC8vRW9CYTBPejBxMHNXci92cEhDUlp3S0NBUUFxMlkySnZxa1FZVi9LbmdRdApZcVFyQmR1ZlNxcDFXcCtvb21zb1oxWUhENDMxOCtGdmVXcEpFSWFCOTM4WXN3QUFjMUd4RmZQeldDdk5yTGFOCm5scTVUMzljQnRTd0c4WHhsQTFzdDFOMVg2VVRkNE10Vk5ReFQ0blVRdnI1dnZEeGJTRXhJRlJ1Sm16MEdnR28KY0F6ZmcwQzF2SVF6dEIzVG9rRnVrUTFQZkp3bms4MnNGYzltUmdGeEF4bjRLaGdyMWhTL0dOcTVSNVQyVHJnUQpBc053dkpDQzdDeklnZFBQMW5DaElpTllqamxOV042b1NuWFlZVFpLVHJIeFVWdE5PaytPMFRvbUdOMXB1T3JzCmJ6MC9VTC93M0VyazJ3cTh2Zy9qVENpclgveVE5QUo1dk9rQXB4VXVjSEYzUERDVFc3SXFHL3Bpck9pZVRXM28KRnAwQkFvSUJBRjBxa3JsSU8wT3JTUmtHRE1aQ0d3QUY5cXlZb0EvNVZzVnAySmgrOUJyYVZpSmU4V0Z5Q0ZwcApSdjlmOXh2dDFMT1BXK1JFenMrQUhRbUpCTVR6RE56UEJkUFZIQytiY09xdkw3cmZwR050K0hESTNPRzhDUDRsCkJ0TWFJU0VKdWIraG5kQ0NZZGhwRlIveFRtcVE3SmdtZWY3ckROK05jNUlvM1p0ZmE2d2VBY2JGZjdzZ0RrTk8KTGEwVFlzYXViZzN5eElsRCtTK1VmamI1TUROUlZnalZiOEJxZlE4NDg3bVdnTFZSNHB4TVpsNHM4R0FIZUh4bgpkRU45YWdQZ1duVzJLZzlJcDZUSG9BbGJQMDYrTnl4NndxTEprTUFtQTNQVlJ2cHVGaU1WUUdMTlJDbkhIbTBPCkhEbmM1amNndmNXMTA1WEFjRDVPU0IydHpQN2VnYTBDZ2dFQUZhTHJxMDJ6M2tXaW1iVzdoNi9Pby9YRHdjZ2YKSmdXMDYyYWdWUlpEMjM3Mm4valZSL25kMnFybmwxTFdWaXpzWW91b3hvY2N6NUwvQ2h3MktCOC9Rc1Zxai9KOApOUWh1ZDJ2ZUxjQlUvVzNseVhENnJpajJZMythNzRvM1A4b1psOGdDQmJEck1jajNsMHRZMXRWbm9nOWo0eHQ3Ckp3UXA3djNXb3ArSFVuRWVjbGpscTdlN1VuTGNwZlRDOE5PUmdxbjBGSUtCbXdFNlpJQnQxUzB6NmxSKytJdVMKQk1oTTZTSkZmeUFOVVdjTCt2cHJoRzBjWUZmcUYzajlPZ1dXRnBGTHFWQmdSTlZBVDRoM0U1Ymh4L0lsMTVHMAo2USs2aWlkRElqMEhNNFAzcjhja2lRUlVPdFI1R2NVS1RYZGh1TjkwMjZGRTdEckRvSURVZ0F5dGVnPT0KLS0tLS1FTkQgUlNBIFBSSVZBVEUgS0VZLS0tLS0K"
-secretbox_encryption_secret = "RLkR4RmeaLmH/abyK3eYf6q22umJ/byLhheVCnh/yrA="
-
-controlplane_configs = {
-  "talos-cp-1" = {
-    hostname     = "talos-cp-1"
-    lan_ip       = "192.168.1.166"
-    public_ip    = "https://k8s-api.riotpiao.com"
-    lan_subnet   = "192.168.1.0/24"
-    lan_gateway  = "192.168.1.254"
-    install_disk = "/dev/nvme0n1"
-    longhorn_disks = []
-    zone             = "az-a"
-    allow_scheduling = true
-    cloudflare_talos_sans     = []
-    cloudflare_apiserver_sans = []
-  },
-  "talos-cp-2" = {
-    hostname     = "talos-cp-2"
-    lan_ip       = "192.168.1.214"
-    public_ip    = "https://k8s-api.riotpiao.com"
-    lan_subnet   = "192.168.1.0/24"
-    lan_gateway  = "192.168.1.254"
-    install_disk = "/dev/disk/by-id/wwn-0x644a842029bd3f002720989b07d7143d"
-    longhorn_disks = [
-        { device = "/dev/disk/by-id/wwn-0x644a842029bd3f0031b60f4375d97062", mountpoint = "/var/lib/longhorn-disk1" },
-        { device = "/dev/disk/by-id/wwn-0x644a842029bd3f0031b5ffeb8bb8b47f", mountpoint = "/var/lib/longhorn-disk2" },
-        { device = "/dev/disk/by-id/wwn-0x644a842029bd3f0031b6000c8dabb266", mountpoint = "/var/lib/longhorn-disk3" },
-        # /var/lib/longhorn-disk4 (wwn-0x6b083fe0c5782700321370dc23fd765b) was
-        # retired 2026-10-12: the 2TB PERC virtual disk failed with continuous
-        # SCSI I/O errors, hung its XFS filesystem, and wedged Longhorn replica
-        # rebuilds on talos-cp-2 with unkillable D-state processes. Do not
-        # re-add it.
-      ]
-    zone             = "az-b"
-    allow_scheduling = true
-    cloudflare_talos_sans     = []
-    cloudflare_apiserver_sans = []
-  },
-  "talos-cp-3" = {
-    hostname     = "talos-cp-3"
-    lan_ip       = "192.168.1.162"
-    public_ip    = "https://k8s-api.riotpiao.com"
-    lan_subnet   = "192.168.1.0/24"
-    lan_gateway  = "192.168.1.254"
-    install_disk = "/dev/nvme0n1"
-    longhorn_disks = [
-        { device = "/dev/disk/by-id/usb-Seagate_One_Touch_w_PW_00000000NABV3H34-0:0", mountpoint = "/var/lib/longhorn-paperless-media" },
-      ]
-    zone             = "az-c"
-    allow_scheduling = true
-    cloudflare_talos_sans     = []
-    cloudflare_apiserver_sans = []
-  },
-}
-
-worker_configs = {
-  "worker-1" = {
-    hostname          = "worker-1"
-    lan_ip            = "192.168.1.223"
-    lan_subnet        = "192.168.1.0/24"
-    lan_gateway       = "192.168.1.254"
-    install_disk      = "/dev/nvme0n1"
-    network_interface = "enp28s0f0np0"
-    zone              = "az-a"
-    gpu_count         = 4
-    node_labels       = {}
-    node_taints       = []
-    factory_image     = "factory.talos.dev/metal-installer/0a2153a6dc099a371bf2f63d6c3c22d275c876bf6302dd154c5813072924cb3f:v1.13.3"
-    swap_size         = "64GiB"
-    ephemeral_max_size = "700GiB"
-    extra_disks       = []
-  }
-}
-
-cluster_config = {
-  controlplane_ip = "192.168.1.166"
-  pod_subnets     = ["10.244.0.0/16"]
-  service_subnets = ["10.96.0.0/12"]
-  dns_servers     = ["8.8.8.8", "1.1.1.1"]
-  dns_domain      = "cluster.local"
-}

terraform/zitadel/actions.tf

@@ -1,58 +0,0 @@
-# The groups claim — the single load-bearing decision of the migration.
-#
-# ZITADEL does not issue a `groups` claim. Authentik did, and these consumers
-# read it: kube-apiserver RBAC (`--oidc-groups-claim=groups` plus 11 RoleBindings
-# on oidc:<group>), MinIO (`MINIO_IDENTITY_OPENID_CLAIM_NAME=groups`), Grafana
-# role mapping, and every service that filters on a group name.
-#
-# Plan §1.3 Option A keeps those consumers unchanged by synthesizing the claim.
-# Option B refactors all of them. This module takes responsibility only for the
-# ZITADEL side of Option A: the action resource and its trigger.
-#
-# The script body is NOT shipped by default. The go/no-go gate (§1.3, §1.5 task
-# 1.3) is: prove on the live instance that the action runtime can read project
-# roles plus user metadata and write both `groups` and the per-agent claims,
-# for a human token AND a machine-user token. Until that proof exists, enabling
-# this resource would move every consumer onto an unverified claim source:
-#
-#   terraform apply -var enable_groups_claim_action=true \
-#                   -var groups_claim_script=./groups-claim.js
-#
-# After it applies, verify with a real token exchange before moving a consumer:
-#
-#   curl -s -X POST https://zitadel.riotpiao.com/oauth/v2/token \
-#     -d grant_type=refresh_token -d refresh_token=<t> \
-#     -d client_id=kubernetes | jq -R 'split(".")[1] | @base64d | fromjson'
-#
-# The decoded access token must contain `"groups":["homelab-admins", ...]`.
-
-resource "zitadel_action" "groups_claim" {
-  count = var.enable_groups_claim_action ? 1 : 0
-
-  org_id          = data.zitadel_org.default.id
-  name            = "homelab-groups-claim"
-  script          = file(var.groups_claim_script)
-  timeout         = "5s"
-  allowed_to_fail = false
-}
-
-# Both triggers are needed. The access-token trigger fills the JWT that
-# Kubernetes and MinIO read. The userinfo trigger fills the response that
-# Grafana, paperless and Forgejo read.
-resource "zitadel_trigger_actions" "groups_claim_access_token" {
-  count = var.enable_groups_claim_action ? 1 : 0
-
-  org_id       = data.zitadel_org.default.id
-  flow_type    = "FLOW_TYPE_CUSTOMISE_TOKEN"
-  trigger_type = "TRIGGER_TYPE_PRE_ACCESS_TOKEN_CREATION"
-  action_ids   = [zitadel_action.groups_claim[0].id]
-}
-
-resource "zitadel_trigger_actions" "groups_claim_userinfo" {
-  count = var.enable_groups_claim_action ? 1 : 0
-
-  org_id       = data.zitadel_org.default.id
-  flow_type    = "FLOW_TYPE_CUSTOMISE_TOKEN"
-  trigger_type = "TRIGGER_TYPE_PRE_USERINFO_CREATION"
-  action_ids   = [zitadel_action.groups_claim[0].id]
-}

terraform/zitadel/api_apps.tf

@@ -1,18 +0,0 @@
-# API applications — the machine-token surface.
-#
-# ZITADEL keeps two different objects apart: an OIDC application is for a
-# browser flow, and an API application is what a client_credentials / JWT-profile
-# caller presents. Authentik modelled both with one provider, so the plan §1.1
-# row 1 ("OIDC app + machine user") needs one of each here.
-#
-# The gateway signs its token request with the machine key from machines.tf, so
-# the auth method is PRIVATE_KEY_JWT. No secret is stored for it.
-
-resource "zitadel_application_api" "machine" {
-  for_each = { for name, spec in local.machine_users : name => spec if contains(keys(var.api_app_consumers), name) }
-
-  org_id           = data.zitadel_org.default.id
-  project_id       = zitadel_project_v2.homelab.id
-  name             = "${each.key}-machine"
-  auth_method_type = "API_AUTH_METHOD_TYPE_PRIVATE_KEY_JWT"
-}

terraform/zitadel/clients.tf

@@ -1,136 +0,0 @@
-# OIDC applications — one per consumer that logs a browser in.
-#
-# Client IDs: the plan §3.2 wants every client_id byte-identical after the move,
-# so that a consumer change is only the issuer URL plus the secret.
-#
-# THAT GOAL IS NOT ACHIEVABLE HERE, verified twice on 2026-10-24:
-#   - ZITADEL v4.19.2 CreateOIDCApplicationRequest has no client_id field, and
-#     CreateOIDCApplicationResponse documents the value as "generated"
-#     (proto/zitadel/app/v2beta/app_service.proto:540-650).
-#   - zitadel provider 3.8.7 exposes no settable application id: `id` on
-#     `zitadel_application_v2` is not a valid argument (terraform validate
-#     rejects it), and `client_id` on `zitadel_application_oidc` is computed.
-# Consequence: every consumer takes a NEW client_id as well as a new secret.
-# Budget the extra config change per consumer — this is not the one-line
-# re-point the plan assumed.
-#
-# The only way to keep the old value is to create each app through the v2 REST
-# API with an explicit body id, then import it:
-#   POST /v2/projects/<project_id>/apps
-#   {"id":"<old-client-id>","name":"<old-client-id>","oidcRequest":{...}}
-# Not implemented here: it would put app creation outside Terraform state.
-#
-# Secrets are generated by ZITADEL, never written here. `terraform output -json
-# client_ids` and `client_secrets` feed the SOPS re-point (§3.2, §6.9). Do not
-# commit the tfstate: it carries those values.
-
-locals {
-  oidc_clients = {
-    # Gateway. Browser sessions for the console, plus a machine path
-    # (machines.tf) for callers that need client_credentials.
-    "api-gw" = {
-      redirect_uris = ["http://localhost:3000/callback", "https://api.riotpiao.com/callback"]
-      app_type      = "WEB"
-      auth_method   = "BASIC"
-      dev_mode      = false
-    }
-    "argocd" = {
-      redirect_uris = ["http://localhost:8080/auth/callback", "https://argocd.riotpiao.com/auth/callback"]
-      app_type      = "WEB"
-      auth_method   = "BASIC"
-      dev_mode      = false
-    }
-    "forgejo" = {
-      redirect_uris = ["http://localhost:3000/user/oauth2/authentik/callback", "https://forgejo.riotpiao.com/user/oauth2/authentik/callback"]
-      app_type      = "WEB"
-      auth_method   = "BASIC"
-      dev_mode      = false
-    }
-    "grafana" = {
-      redirect_uris = ["http://localhost:3000/login/generic_oauth", "https://grafana.riotpiao.com/login/generic_oauth"]
-      app_type      = "WEB"
-      auth_method   = "BASIC"
-      dev_mode      = false
-    }
-    "homarr" = {
-      redirect_uris = ["http://localhost:7575/auth/callback", "https://homarr.riotpiao.com/auth/callback"]
-      app_type      = "WEB"
-      auth_method   = "BASIC"
-      dev_mode      = false
-    }
-    "immich" = {
-      redirect_uris = ["app.immich:///oauth-callback", "https://img.riotpiao.com/auth/login", "https://img.riotpiao.com/user/oauth2/callback"]
-      app_type      = "NATIVE"
-      auth_method   = "BASIC"
-      dev_mode      = false
-    }
-    "kubernetes" = {
-      redirect_uris = ["http://localhost:8000", "http://localhost:18000"]
-      app_type      = "WEB"
-      auth_method   = "NONE"
-      dev_mode      = true
-    }
-    "minio" = {
-      redirect_uris = ["http://localhost:9000/auth/sso/oauth2/code", "https://minio.riotpiao.com/auth/sso/oauth2/code"]
-      app_type      = "WEB"
-      auth_method   = "BASIC"
-      dev_mode      = false
-    }
-    "paperless" = {
-      redirect_uris = ["http://localhost:8000/accounts/oidc/authentik/login/callback/", "https://paperless.riotpiao.com/accounts/oidc/authentik/login/callback/"]
-      app_type      = "WEB"
-      auth_method   = "BASIC"
-      dev_mode      = false
-    }
-    "poimen" = {
-      redirect_uris = ["http://localhost:3000/callback", "https://poimen.riotpiao.com/callback"]
-      app_type      = "WEB"
-      auth_method   = "BASIC"
-      dev_mode      = false
-    }
-    "queue-sqs" = {
-      redirect_uris = ["http://localhost:8080/callback", "https://queue.riotpiao.com/callback"]
-      app_type      = "WEB"
-      auth_method   = "BASIC"
-      dev_mode      = false
-    }
-    "vault" = {
-      redirect_uris = ["http://localhost:8200/ui/vault/auth/oidc/oidc/callback", "https://vault.riotpiao.com/ui/vault/auth/oidc/oidc/callback"]
-      app_type      = "WEB"
-      auth_method   = "BASIC"
-      dev_mode      = false
-    }
-  }
-}
-
-resource "zitadel_application_v2" "oidc" {
-  for_each = local.oidc_clients
-
-  org_id     = data.zitadel_org.default.id
-  project_id = zitadel_project_v2.homelab.id
-  name       = each.key
-
-  oidc {
-    redirect_uris  = each.value.redirect_uris
-    response_types = ["OIDC_RESPONSE_TYPE_CODE"]
-    grant_types = [
-      "OIDC_GRANT_TYPE_AUTHORIZATION_CODE",
-      "OIDC_GRANT_TYPE_REFRESH_TOKEN",
-    ]
-    app_type         = "OIDC_APP_TYPE_${each.value.app_type}"
-    auth_method_type = "OIDC_AUTH_METHOD_TYPE_${each.value.auth_method}"
-    version          = "OIDC_VERSION_1_0"
-
-    # JWT access tokens: Kubernetes RBAC, MinIO policy mapping and the Go
-    # gateway all read claims, and an opaque bearer token carries none.
-    access_token_type = "OIDC_TOKEN_TYPE_JWT"
-
-    # Assert roles without the client having to request the scope. Every
-    # consumer here maps roles or groups to local permissions.
-    access_token_role_assertion = true
-    id_token_role_assertion     = true
-    id_token_userinfo_assertion = true
-
-    dev_mode = each.value.dev_mode
-  }
-}

terraform/zitadel/machines.tf

@@ -1,139 +0,0 @@
-# Machine users and their project grants (plan §1.4, §5.3).
-#
-# Authentik gave each agent an app password or a client_credentials grant built
-# on a user password. ZITADEL has no user password on a machine user: it issues
-# a JWT profile key (`KEY_TYPE_JSON`) that the SDK signs its token request with.
-# That removes the password path entirely, which is the point — see §5.3.
-#
-# Per-agent claim values are copied from `SERVICE_ACCOUNTS` in
-# scripts/iam/provision-rbac.py. They live in user metadata as JSON strings,
-# because the groups-claim action (actions.tf) is the only thing that turns them
-# into token claims. Without that action a consumer sees roles but not
-# `minio_buckets`, `authorized_models`, `sqs_queues`, `memory_projects`,
-# `memory_visibility` or `paperless_doctypes`.
-#
-# Keys are generated per machine user and land in `terraform output -json
-# machine_keys` (sensitive). Feed each one to the owning workload as a mounted
-# file, never as an environment variable dumps-able through `ps`.
-
-locals {
-  machine_users = {
-    "memory-agent" = {
-      description      = "Memory service agent"
-      project_roles    = ["poimen-admins"]
-      authenticated_by = "poimen memory (Rust)"
-      metadata = {
-        roles             = jsonencode(["llm:inference", "memory:read", "memory:write", "notification:write", "sessions:read", "sessions:write"])
-        memory_projects   = jsonencode(["*"])
-        memory_visibility = "private"
-        authorized_models = jsonencode(["reasoning", "ornith:35b", "qwen2.5:3b"])
-      }
-    }
-    "paperless-ai-agent" = {
-      description      = "Paperless AI plugin (auto-tagging, entity extraction)"
-      project_roles    = ["poimen-devs"]
-      authenticated_by = "paperless-ai"
-      metadata = {
-        roles              = jsonencode(["llm:inference", "memory:write", "paperless:admin", "notification:write"])
-        minio_buckets      = jsonencode(["paperless"])
-        paperless_doctypes = jsonencode(["*"])
-        memory_projects    = jsonencode(["*"])
-        authorized_models  = jsonencode(["reasoning", "qwen2.5:3b"])
-      }
-    }
-    "portfolio-agent" = {
-      description      = "Portfolio service agent"
-      project_roles    = ["poimen-prod-readonly"]
-      authenticated_by = "portfolio service"
-      metadata = {
-        roles             = jsonencode(["llm:inference", "memory:read"])
-        memory_projects   = jsonencode(["homelab", "portfolio"])
-        memory_visibility = "public"
-        authorized_models = jsonencode(["ornith:35b"])
-        minio_buckets     = jsonencode(["backups"])
-      }
-    }
-    "temporal-worker-agent" = {
-      description      = "Temporal workflow worker"
-      project_roles    = ["poimen-admins"]
-      authenticated_by = "Temporal worker"
-      metadata = {
-        roles             = jsonencode(["llm:inference", "workflow:execute", "memory:read", "memory:write", "queue:send", "notification:write"])
-        memory_projects   = jsonencode(["*"])
-        sqs_queues        = jsonencode(["*"])
-        authorized_models = jsonencode(["reasoning", "ornith:35b", "qwen2.5:3b"])
-      }
-    }
-    # The gateway is the one consumer that used client_credentials on a machine
-    # token, so it needs both the OIDC app (clients.tf) and a machine user
-    # (here) plus its API application (api_apps.tf). Its capability check reads
-    # the `roles` claim, which arrives as metadata.
-    "api-gw" = {
-      description      = "Go LLM gateway machine identity"
-      project_roles    = []
-      authenticated_by = "api-gw"
-      metadata = {
-        roles = jsonencode(["llm:inference"])
-      }
-    }
-    # pi-worker has no anchor in git (plan §1.1: "not in git") and no group in
-    # the Authentik provisioning script. It gets a machine user and no project
-    # role until the owner names the consumer configuration that holds its old
-    # credentials. Creating a role grant blind would widen access, not preserve it.
-    "pi-worker" = {
-      description      = "pi sandbox worker (no git anchor for its consumer config)"
-      project_roles    = []
-      authenticated_by = "pi sandbox worker"
-      metadata = {
-        roles = jsonencode([])
-      }
-    }
-  }
-
-  machine_metadata = merge([
-    for user, spec in local.machine_users : {
-      for key, value in spec.metadata : "${user}/${key}" => {
-        user  = user
-        key   = key
-        value = value
-      }
-    }
-  ]...)
-}
-
-resource "zitadel_machine_user" "agent" {
-  for_each = local.machine_users
-
-  org_id      = data.zitadel_org.default.id
-  user_name   = each.key
-  name        = each.key
-  description = "${each.value.description} — consumer: ${each.value.authenticated_by}"
-  with_secret = false
-}
-
-resource "zitadel_machine_key" "agent" {
-  for_each = local.machine_users
-
-  org_id          = data.zitadel_org.default.id
-  user_id         = zitadel_machine_user.agent[each.key].id
-  key_type        = "KEY_TYPE_JSON"
-  expiration_date = var.machine_key_expiry
-}
-
-resource "zitadel_project_member" "agent" {
-  for_each = { for user, spec in local.machine_users : user => spec if length(spec.project_roles) > 0 }
-
-  org_id     = data.zitadel_org.default.id
-  project_id = zitadel_project_v2.homelab.id
-  user_id    = zitadel_machine_user.agent[each.key].id
-  roles      = each.value.project_roles
-}
-
-resource "zitadel_user_metadata" "agent_claim" {
-  for_each = local.machine_metadata
-
-  org_id  = data.zitadel_org.default.id
-  user_id = zitadel_machine_user.agent[each.value.user].id
-  key     = each.value.key
-  value   = each.value.value
-}

terraform/zitadel/outputs.tf

@@ -1,46 +0,0 @@
-# Outputs feed two things: the SOPS re-point of consumer secrets (§3.2, §6.9)
-# and the machine-key handoff to each agent workload (§5.3). Every value that can
-# authenticate a client is marked sensitive, so `terraform output` prints a
-# placeholder until you ask for it explicitly.
-
-output "org_id" {
-  description = "Organization that owns the project, roles and applications."
-  value       = data.zitadel_org.default.id
-}
-
-output "project_id" {
-  description = "Project ID, which ZITADEL puts in the access-token `aud` claim."
-  value       = zitadel_project_v2.homelab.id
-}
-
-output "client_ids" {
-  description = "client_id per consumer. Compare against the Authentik values: any difference means the consumer config must change too."
-  value       = { for name, app in zitadel_application_v2.oidc : name => app.oidc[0].client_id }
-}
-
-output "client_secrets" {
-  description = "Generated client secret per consumer. Write these into the existing SOPS files; never into git."
-  value       = { for name, app in zitadel_application_v2.oidc : name => app.oidc[0].client_secret }
-  sensitive   = true
-}
-
-output "api_app_client_ids" {
-  description = "client_id of each API application (machine-token surface)."
-  value       = { for name, app in zitadel_application_api.machine : name => app.client_id }
-}
-
-output "machine_user_ids" {
-  description = "ZITADEL user ID per machine user."
-  value       = { for name, user in zitadel_machine_user.agent : name => user.id }
-}
-
-output "machine_keys" {
-  description = "JWT profile key JSON per machine user. Mount as a file; do not pass through the environment."
-  value       = { for name, key in zitadel_machine_key.agent : name => key.key_details }
-  sensitive   = true
-}
-
-output "groups_claim_enabled" {
-  description = "Whether the groups-claim action and its triggers exist. False means Option A is not yet in place and no consumer may move."
-  value       = var.enable_groups_claim_action
-}

terraform/zitadel/project.tf

@@ -1,62 +0,0 @@
-# Project, roles and default-org lookup.
-#
-# ZITADEL has no group object. The plan §1.3 maps every Authentik group to a
-# project role, and the groups-claim action (actions.tf) reconstructs the
-# `groups` claim from those role keys. Role keys therefore EQUAL the existing
-# Authentik group names, including the hyphens, so that the resulting claim is
-# byte-identical and no consumer or RBAC file changes. The v4.19.2 API allows
-# role keys of 1-200 characters with no character-set restriction (proto
-# zitadel/project/v2/project_service.proto, AddProjectRole.role_key).
-
-data "zitadel_org" "default" {
-  id = var.org_id
-}
-
-locals {
-  # Single source: the 19 groups of scripts/iam/provision-rbac.py GROUPS.
-  # Descriptions are carried over so the console reads the same as before.
-  roles = {
-    "homelab-admins"       = "Cluster administrators with full access"
-    "minio-admins"         = "MinIO administrators"
-    "minio-photos"         = "Photos bucket (Immich) access"
-    "minio-documents"      = "Documents bucket (Paperless) access"
-    "minio-backups"        = "Backups bucket read-only access"
-    "poimen-admins"        = "Poimen memory administrators"
-    "poimen-devs"          = "Dev and staging projects access"
-    "poimen-prod-readonly" = "Production projects read-only access"
-    "paperless-admins"     = "Paperless administrators"
-    "paperless-finance"    = "Finance documents"
-    "paperless-legal"      = "Legal documents"
-    "paperless-hr"         = "HR documents"
-    "grafana-admins"       = "Grafana administrators"
-    "grafana-editors"      = "Grafana dashboard editors"
-    "grafana-viewers"      = "Grafana dashboard viewers"
-    "sqs-users"            = "SQS/Temporal queue read access"
-    "sqs-writers"          = "SQS/Temporal queue read/write access"
-    "s3-users"             = "S3 read access"
-    "s3-writers"           = "S3 read/write access"
-  }
-}
-
-resource "zitadel_project_v2" "homelab" {
-  org_id             = data.zitadel_org.default.id
-  name               = var.project_name
-  project_id         = var.project_id
-  project_role_check = false
-
-  # Roles must reach the tokens. Every consumer authorizes on them:
-  # kube-apiserver RBAC reads `groups`, MinIO reads bucket policies, Grafana
-  # reads grafana_org_role. Role assertion on the ID token is what most OIDC
-  # clients inspect.
-  project_role_assertion = true
-}
-
-resource "zitadel_project_role" "groups" {
-  for_each = local.roles
-
-  org_id       = data.zitadel_org.default.id
-  project_id   = zitadel_project_v2.homelab.id
-  role_key     = each.key
-  display_name = each.key
-  group        = "homelab"
-}

terraform/zitadel/providers.tf

@@ -1,53 +0,0 @@
-# terraform/zitadel — identity configuration for the ZITADEL instance
-#
-# Scope: this root module declares the objects INSIDE ZITADEL (org, project,
-# roles, OIDC applications, machine users, grants). It does NOT deploy ZITADEL
-# itself — that is ArgoCD's job (`k8s/argocd/apps/30-security.yaml`, values in
-# `k8s/infra/iam/zitadel-values.yaml`).
-#
-# Migration plan: ~/workplace/homelab-doc/ZITADEL_MIGRATION.html (outside git).
-# This file implements §1.3 (roles), §1.4 (machine users), §2.4 (grants) and
-# §6.2 (Terraform provider route). The claim-injection action of §1.3 lives in
-# `actions.tf` and stays disabled until the live go/no-go gate proves it.
-#
-# Authentication to ZITADEL uses the `iam-admin` machine key that the chart's
-# setup job writes to the `iam-admin` Secret in namespace iam:
-#
-#   kubectl -n iam get secret iam-admin -o jsonpath='{.data.iam-admin\.json}' \
-#     | base64 -d > ~/.config/zitadel/iam-admin.json
-#   chmod 600 ~/.config/zitadel/iam-admin.json
-#
-#   export ZITADEL_JWT_PROFILE_FILE=$HOME/.config/zitadel/iam-admin.json
-#   terraform -chdir=terraform/zitadel init
-#   terraform -chdir=terraform/zitadel plan
-#
-# State is LOCAL and git-ignored (`terraform/*.tfstate` in .gitignore). That is
-# a deliberate first step, not the final answer: §8 risk 8 of the plan names
-# state drift as a blast-radius item. Move the state to MinIO before a second
-# operator ever runs `apply`. No secret is written to state except the generated
-# client secrets and machine keys, which are marked sensitive — they still land
-# in the state file, so treat that file as a secret.
-terraform {
-  required_version = ">= 1.6.0"
-
-  required_providers {
-    zitadel = {
-      source  = "zitadel/zitadel"
-      version = "3.8.7"
-    }
-  }
-}
-
-provider "zitadel" {
-  domain = var.zitadel_domain
-  port   = var.zitadel_port
-
-  # JWT profile of the iam-admin machine user. Preferred over a PAT: it is
-  # short-lived per call and never sits in the environment as a bearer token.
-  # Set the path through ZITADEL_JWT_PROFILE_FILE.
-  jwt_profile_file = var.jwt_profile_file
-
-  # The instance serves plain HTTP behind ingress-nginx, which terminates TLS.
-  # Turn this on only if the provider must call the pod directly.
-  insecure = var.zitadel_insecure
-}

terraform/zitadel/variables.tf

@@ -1,103 +0,0 @@
-variable "zitadel_domain" {
-  description = "External domain of the ZITADEL instance, without scheme."
-  type        = string
-  default     = "zitadel.riotpiao.com"
-}
-
-variable "zitadel_port" {
-  description = "Port for the ZITADEL API. 443 behind ingress, 8080 for a direct pod port-forward."
-  type        = string
-  default     = "443"
-}
-
-variable "zitadel_insecure" {
-  description = "Call the API over plain HTTP (set true only when port-forwarding the pod)."
-  type        = bool
-  default     = false
-}
-
-variable "jwt_profile_file" {
-  description = "Path to the iam-admin machine key JSON extracted from the iam-admin Secret."
-  type        = string
-  default     = null
-}
-
-variable "org_id" {
-  description = <<-EOT
-    ID of the ZITADEL organization that holds the project. Read it from the
-    console: https://zitadel.riotpiao.com -> Organization settings -> Resource
-    ID. The chart's setup job creates the default org; this module never creates
-    one, because creating a second org would split the role and grant space.
-  EOT
-  type        = string
-}
-
-variable "project_id" {
-  description = <<-EOT
-    Stable project ID. ZITADEL puts the project ID in the access token `aud`
-    claim, so pinning it keeps audience checks readable across a rebuild.
-    Every consumer that validates `aud` against a client ID must be re-pointed
-    to this value — see the plan §5.2.
-  EOT
-  type        = string
-  default     = "homelab"
-}
-
-variable "project_name" {
-  description = "Display name of the project that carries every role and application."
-  type        = string
-  default     = "homelab"
-}
-
-variable "machine_key_expiry" {
-  description = "Expiry of every machine key, RFC3339. Matches the chart's default iam-admin key window; rotate by changing this value and re-applying."
-  type        = string
-  default     = "2029-01-01T00:00:00Z"
-}
-
-variable "api_app_consumers" {
-  description = <<-EOT
-    Machine users that also need an API application (the client_credentials
-    replacement). Only the gateway does: every other agent signs a JWT with its
-    machine key and does not need a client_credentials grant.
-  EOT
-  type        = map(string)
-  default     = { api-gw = "Go LLM gateway" }
-}
-
-variable "enable_groups_claim_action" {
-  description = <<-EOT
-    Create the Actions v1 script and its trigger that synthesizes the `groups`
-    claim. Keep this false until the live go/no-go gate passes: the claim is
-    load-bearing for kube-apiserver RBAC, MinIO policies, Grafana role mapping
-    and every service that reads `groups`. Turning it on with an unverified
-    script can break every consumer at once.
-  EOT
-  type        = bool
-  default     = false
-}
-
-variable "groups_claim_script" {
-  description = <<-EOT
-    Path to the JavaScript body for the groups-claim action, read only when
-    enable_groups_claim_action is true. The body is deliberately not shipped
-    blind: the ZITADEL v1 Actions runtime API must be confirmed against the live
-    instance before a script is committed, because a wrong call silently emits
-    no claim instead of failing loudly.
-  EOT
-  type        = string
-  default     = null
-
-  validation {
-    # try() is required: HCL does not short-circuit `||`, so fileexists(null)
-    # would fail the whole plan even with the action disabled.
-    condition     = try(fileexists(var.groups_claim_script), true)
-    error_message = "groups_claim_script must name an existing file when it is set."
-  }
-
-  # Enabling the action without a script would reach file(null) inside actions.tf.
-  validation {
-    condition     = !var.enable_groups_claim_action || var.groups_claim_script != null
-    error_message = "enable_groups_claim_action requires groups_claim_script."
-  }
-}