modified: services/monitoring/deploy/alloy/kube-scraper/helm-values.yaml

deleted:    services/monitoring/deploy/flux/flux-kustomization-prometheus.yaml
modified:   services/monitoring/deploy/flux/kustomization.yaml

.devcontainer/.zshrc

@@ -1,109 +0,0 @@
-# If you come from bash you might have to change your $PATH.
-# export PATH=$HOME/bin:$HOME/.local/bin:/usr/local/bin:$PATH
-
-# Path to your Oh My Zsh installation.
-export ZSH="$HOME/.oh-my-zsh"
-
-# Set name of the theme to load --- if set to "random", it will
-# load a random theme each time Oh My Zsh is loaded, in which case,
-# to know which specific one was loaded, run: echo $RANDOM_THEME
-# See https://github.com/ohmyzsh/ohmyzsh/wiki/Themes
-ZSH_THEME="gnzh"
-
-# Set list of themes to pick from when loading at random
-# Setting this variable when ZSH_THEME="devcontainers"
-# a theme from this variable instead of looking in $ZSH/themes/
-# If set to an empty array, this variable will have no effect.
-# ZSH_THEME_RANDOM_CANDIDATES=( "robbyrussell" "agnoster" )
-
-# Uncomment the following line to use case-sensitive completion.
-# CASE_SENSITIVE="true"
-
-# Uncomment the following line to use hyphen-insensitive completion.
-# Case-sensitive completion must be off. _ and - will be interchangeable.
-# HYPHEN_INSENSITIVE="true"
-
-# Uncomment one of the following lines to change the auto-update behavior
-# zstyle ':omz:update' mode disabled  # disable automatic updates
-# zstyle ':omz:update' mode auto      # update automatically without asking
-# zstyle ':omz:update' mode reminder  # just remind me to update when it's time
-
-# Uncomment the following line to change how often to auto-update (in days).
-# zstyle ':omz:update' frequency 13
-
-# Uncomment the following line if pasting URLs and other text is messed up.
-# DISABLE_MAGIC_FUNCTIONS="true"
-
-# Uncomment the following line to disable colors in ls.
-# DISABLE_LS_COLORS="true"
-
-# Uncomment the following line to disable auto-setting terminal title.
-# DISABLE_AUTO_TITLE="true"
-
-# Uncomment the following line to enable command auto-correction.
-# ENABLE_CORRECTION="true"
-
-# Uncomment the following line to display red dots whilst waiting for completion.
-# You can also set it to another string to have that shown instead of the default red dots.
-# e.g. COMPLETION_WAITING_DOTS="%F{yellow}waiting...%f"
-# Caution: this setting can cause issues with multiline prompts in zsh < 5.7.1 (see #5765)
-# COMPLETION_WAITING_DOTS="true"
-
-# Uncomment the following line if you want to disable marking untracked files
-# under VCS as dirty. This makes repository status check for large repositories
-# much, much faster.
-# DISABLE_UNTRACKED_FILES_DIRTY="true"
-
-# Uncomment the following line if you want to change the command execution time
-# stamp shown in the history command output.
-# You can set one of the optional three formats:
-# "mm/dd/yyyy"|"dd.mm.yyyy"|"yyyy-mm-dd"
-# or set a custom format using the strftime function format specifications,
-# see 'man strftime' for details.
-# HIST_STAMPS="mm/dd/yyyy"
-
-# Would you like to use another custom folder than $ZSH/custom?
-# ZSH_CUSTOM=/path/to/new-custom-folder
-
-# Which plugins would you like to load?
-# Standard plugins can be found in $ZSH/plugins/
-# Custom plugins may be added to $ZSH_CUSTOM/plugins/
-# Example format: plugins=(rails git textmate ruby lighthouse)
-# Add wisely, as too many plugins slow down shell startup.
-plugins=(git timer web-search ssh kubectl helm colorize zsh-autosuggestions rclone ansible)
-ZSH_COLORIZE_TOOL=chroma
-
-source $ZSH/oh-my-zsh.sh
-
-# User configuration
-
-# export MANPATH="/usr/local/man:$MANPATH"
-
-# You may need to manually set your language environment
-# export LANG=en_US.UTF-8
-
-# Preferred editor for local and remote sessions
-# if [[ -n $SSH_CONNECTION ]]; then
-#   export EDITOR='vim'
-# else
-#   export EDITOR='nvim'
-# fi
-
-# Compilation flags
-# export ARCHFLAGS="-arch $(uname -m)"
-
-# Set personal aliases, overriding those provided by Oh My Zsh libs,
-# plugins, and themes. Aliases can be placed here, though Oh My Zsh
-# users are encouraged to define aliases within a top-level file in
-# the $ZSH_CUSTOM folder, with .zsh extension. Examples:
-# - $ZSH_CUSTOM/aliases.zsh
-# - $ZSH_CUSTOM/macos.zsh
-# For a full list of active aliases, run `alias`.
-#
-# Example aliases
-# alias zshconfig="mate ~/.zshrc"
-# alias ohmyzsh="mate ~/.oh-my-zsh"
-DISABLE_AUTO_UPDATE=true
-DISABLE_UPDATE_PROMPT=true
-
-export PATH=$PATH:/home/vscode/lib

.devcontainer/devcontainer.json

@@ -1,32 +1,21 @@
-// For format details, see https://aka.ms/devcontainer.json. For config options, see the
-// README at: https://github.com/devcontainers/templates/tree/main/src/ubuntu
 {
 	"name": "casa-dev",
-	// Or use a Dockerfile or Docker Compose file. More info: https://containers.dev/guide/dockerfile
-	"image": "mcr.microsoft.com/devcontainers/base:jammy",
-	"features": {
-		"ghcr.io/devcontainers/features/kubectl-helm-minikube:1": {},
-		"ghcr.io/devcontainers-extra/features/ansible":  {},
-		"ghcr.io/devcontainers/features/docker-outside-of-docker":  {},
-	},
-	// "features": {},
-
-	// Use 'forwardPorts' to make a list of ports inside the container available locally.
-	// "forwardPorts": [],
-	// Configure tool-specific properties.
-	// "customizations": {},
-	
+	"image": "oci.limbosolutions.com/public/devcontainers/devops:latest",
+	"remoteUser": "vscode",
+	"runArgs": [
+		"--hostname=casa-dev"
+	],
 	"mounts": [
-		"source=${localWorkspaceFolder}/.devcontainer/.zshrc,target=/home/vscode/.zshrc,type=bind",
 		"source=${localWorkspaceFolder}/../lms,target=/workspaces/lms,type=bind",
 		"source=${localWorkspaceFolder}/../homeAssistant,target=/workspaces/homeAssistant,type=bind",
 		"source=${localWorkspaceFolder}/../mosquitto,target=/workspaces/mosquitto,type=bind",
+		"source=${localWorkspaceFolder}/../myLimbo.Jellyfin,target=/workspaces/myLimbo.Jellyfin,type=bind",
 		"source=${localWorkspaceFolder}/../kb,target=/workspaces/kb,type=bind",
+		"source=${localWorkspaceFolder}/../pi.bluetooth.speaker,target=/workspaces/pi.bluetooth.speaker,type=bind",
 		"source=${localWorkspaceFolder}/.env.d/kube,target=/home/vscode/.kube,type=bind",
 		"source=${localEnv:HOME}/.gitconfig,target=/home/vscode/.gitconfig,type=bind,consistency=cached",
   		"source=${localEnv:HOME}/.ssh,target=/home/vscode/.ssh,type=bind,consistency=cached"
 	],
-	"postCreateCommand": "bash .devcontainer/scripts/postCreate.sh",
 	"customizations": {
 		"vscode": {
 			"extensions": [
@@ -37,11 +26,14 @@
 				"yzhang.markdown-all-in-one",
 				"davidanson.vscode-markdownlint",
 				"eamodio.gitlens",
-				"m4ns0ur.base64"
-			],
-			"settings": {
-				"terminal.integrated.defaultProfile.linux": "zsh"
-			}
+				"m4ns0ur.base64",
+				"rogalmic.bash-debug",
+				"streetsidesoftware.code-spell-checker",
+				"ms-azuretools.vscode-containers",
+				"eamodio.gitlens",
+				"bierner.markdown-preview-github-styles",
+				"weaveworks.vscode-gitops-tools"
+			]
 		}
 	}
 }

.devcontainer/scripts/postCreate.sh

@@ -1,7 +0,0 @@
-#setup chroma for zsh colorize
-chmod +x /home/vscode/lib/chroma
-curl https://rclone.org/install.sh | sudo bash
-docker context create casa-prod --description "casa prod context" --docker host=ssh://admin@homesrv01.dev.lan
-docker context use casa-prod
-
-

.gitea/workflows/deploy-sync-certs-job.yml

@@ -1,21 +0,0 @@
-on: 
-  push:
-  schedule:
-    - cron: '0 16 * * *' # Every day at 16:00
-jobs:
-  deploy-to-homesrv01:
-    runs-on: "myLimbo-casa-gitea-act-runner"
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v2
-
-      # all certs and key are base64 encoded
-    - name: docker compose up
-      env:
-        KUBERNETES_SERVER: ${{ secrets.KUBERNETES_SERVER }}
-        KUBERNETES_CLIENT_CRT_DATA: ${{ secrets.KUBERNETES_CLIENT_CRT_DATA }}
-        KUBERNETES_CLIENT_KEY_DATA: ${{ secrets.KUBERNETES_CLIENT_KEY_DATA }}
-        KUBERNETES_CRT_AUTHORITY_DATA: ${{ secrets.KUBERNETES_CRT_AUTHORITY_DATA }}
-      run:  |
-          docker compose -f ./casa-limbosolutions-com/sync-certs-job/docker-compose.yaml up -d --pull always 
-

.gitea/workflows/deploy-wyoming.yml

@@ -1,13 +0,0 @@
-on: 
-  push:
-  schedule:
-    - cron: '0 5 * * SUN' # Every Sunday at 05:00
-jobs:
-  deploy-to-homesrv01:
-    runs-on: "myLimbo-casa-gitea-act-runner"
-    steps:
-    - name: Checkout code
-      uses: actions/checkout@v2
-    
-    - name: docker compose up
-      run: docker compose -f ./services/wyoming/docker-compose.yaml up -d --pull always 

.gitignore

@@ -11,3 +11,6 @@ gitignore/*
 .secrets
 ansible/inventory.yml
 .env.d/*
+.tmp/**
+storage-limbosolutions-com/deploy/helm/values.private.yaml
+**.dec.**

README.md

@@ -1,89 +1,38 @@
 # casa
 
-Welcome to my home server repository, where Home Assistant and other services are hosted.  
+Welcome to my casa repository, where Home Assistant and other services are hosted.  
 This repository is dedicated to documenting and maintaining the server configuration and workflows.
 
-The primary goal is to establish a Docker-based server capable of isolating services and communications related to home automation at the network level.  
-The server operates within its own VLAN (`homesrv`) but requires controlled communication with other VLANs, such as `IOT Vlan`
+The primary goal is to establish an k3s cluster capable of isolating services and communications related to home automation at the network level.  
+The server operates within its own VLAN (`casa`) but requires controlled communication with other VLANs, such as `IOT Vlan`
 
-<!-- omit in toc -->
-## Table of Contents
+For more information about k3s cluster/nodes setup check [readme](./nodes/README.md).
 
-- [Services](#services)
-  - [myInfra stack](#myinfra-stack)
-  - [docker](#docker)
-    - [rclone plugin](#rclone-plugin)
-  - [nginx](#nginx)
-  - [Home Assistant](#home-assistant)
-  - [Lyrion Music Server (LMS)](#lyrion-music-server-lms)
-  - [Mosquitto](#mosquitto)
-  - [Wyoming](#wyoming)
-  - [Zigbee2mqtt](#zigbee2mqtt)
-- [Host](#host)
-  - [Proxmox - container](#proxmox---container)
-  - [OS](#os)
-  - [logs](#logs)
-- [Development, Maintenance and Deployment](#development-maintenance-and-deployment)
-  - [Docker context](#docker-context)
+**Table of Contents:**
 
-## Services
+- [Home Assistant](#home-assistant)
+- [Lyrion Music Server (LMS)](#lyrion-music-server-lms)
+- [Mosquitto](#mosquitto)
+- [Wyoming](#wyoming)
+- [Zigbee2mqtt](#zigbee2mqtt)
+- [node-red](#node-red)
+- [core-dns](#core-dns)
 
-### myInfra stack
-
-docker, promtail and telegraf configuration [maintained on myInfra repo](/:root/marcio.fernandes/myInfrastructure).
-
-### docker
-
-#### rclone plugin
-
-[https://rclone.org/docker/](https://rclone.org/docker/)
-
-```bash
-# execute on server
-sudo apt-get -y install fuse
-docker plugin install rclone/docker-volume-rclone:amd64 args="-v" --alias rclone --grant-all-permissions
-docker plugin list
-```
-
-if error when enabling plugin.  
-*"rclone.sock: connect: no such file or directory"*  
-remove existing cache.  
-
-```bash
- rm -r /var/lib/docker-plugins/rclone/cache
- mkdir -p /var/lib/docker-plugins/rclone/cache
-```
-
-[ansible role for plugin configuration](./rclone.docker-plugin.playbook.yaml)
-
-### nginx
-
-[Docker Compose](./services/nginx/docker-compose.yaml)
-
-All sites configurations set during docker build.
-
-### Home Assistant
+## Home Assistant
 
 [Git Repo](/:root/marcio.fernandes/homeAssistant)
 
-### Lyrion Music Server (LMS)
+## Lyrion Music Server (LMS)
 
-For instructions on setting up the Lyrion Music Server Docker container, refer to the [LMS Git Repository](/:root/marcio.fernandes/lms).
+For instructions on setting up the Lyrion Music Server on kubernetes, refer to the [LMS Git Repository](/:root/marcio.fernandes/lms).
 
 For information on integrating Lyrion Music Server with Home Assistant, visit the [Home Assistant Git Repository](/:root/marcio.fernandes/homeassistant#squeezebox-lyrion-music-server).
 
-Using [Docker Rclone plugin](https://rclone.org/docker/) for accessing the bucket where music is stored. Configuration is managed via [Ansible playbook](./rclone.docker-plugin.playbook.yml).
-
-```sh
-#configure access to s3 bucket
-ansible-playbook ./rclone.docker-plugin.playbook.yml
-```
-
-### Mosquitto
+## Mosquitto
 
 [Git Repo](/:root/marcio.fernandes/mosquitto)
 
-### Wyoming
+## Wyoming
 
 A peer-to-peer protocol for voice assistants (basically JSONL + PCM audio)
 
@@ -99,11 +48,7 @@ This is an open standard of the Open Home Foundation.
 
 For more information about home assistant integration [check home assistant repo](/:root/marcio.fernandes/homeassistant#wyoming).
 
-[Docker compose file](./services/wyoming/docker-compose.yaml).
-
-Continuous deploy [gitea action](.gitea/workflows/deploy-wyoming.yml).
-
-Because of performance wyoming whisper is currently hosted on chimera kubernetes cluster [deployment](./services/wyoming/whisper.kubernetes-deployment.yaml)
+Deployments and scripts on services/wyoming repo folder.
 
 Links:
 
@@ -112,118 +57,39 @@ Links:
 - [https://exitcode0.net/posts/wyoming-whisper-docker-compose/](https://exitcode0.net/posts/wyoming-whisper-docker-compose/)
 - [https://exitcode0.net/posts/wyoming-piper-docker-compose/](https://exitcode0.net/posts/wyoming-piper-docker-compose/)
 
-### Zigbee2mqtt
+## Zigbee2mqtt
 
 Zigbee to MQTT bridge, get rid of your proprietary Zigbee bridges
 
-SONOFF Universal Zigbee 3.0 USB Dongle Plus attached on [proxmox host](#proxmox---lxc-container).
+Attached SONOFF Universal Zigbee 3.0 USB Dongle Plus to the Proxmox node and configure USB passthrough so the VM can use it.
 
-Patch security on [proxmox host](#proxmox---lxc-container).
-(usb passthrough to [lxc container](#proxmox---lxc-container))
+Deployments and scripts on services/Zigbee2mqtt repo folder.
+
+## node-red
+
+check [readme](./services/node-red/README.md) for more information on setup and configuration.
+
+## core-dns
+
+Remove warning from logs.
+
+```log
+[WARNING] No files matching import glob pattern: /etc/coredns/custom/*.server
+[WARNING] No files matching import glob pattern: /etc/coredns/custom/*.override
+```
+
+1. Apply on kubernetes
 
 ```yaml
-#on proxmox hosting server
-chown 100000:100020 /dev/ttyUSB0
-chown 100000:100020 /dev/serial/by-id/usb-ITead_Sonoff_Zigbee_3.0_USB_Dongle_Plus_c0e8eeb4b38ded118e7c06f6b86ce6f8-if00-port0
-```
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: coredns-custom
+  namespace: kube-system
+data:
+  log.override: |
+    #
+  stub.server: |
+    #
 
-[docker compose](./services/zigbee2mqtt/docker-compose.yaml)
-
-Links
-
-- [https://www.zigbee2mqtt.io/](https://www.zigbee2mqtt.io/)
-- [Home assistant integration](/:root/marcio.fernandes/homeassistant#Zigbee2mqtt)
-- [Continuos Deploy - git action](./.gitea/workflows/services.zigbee2mqtt.yml)
-
-## Host
-
-### Proxmox - container
-
-Currently hosted on a proxmox ubuntu container.
-
-```bash
-#   cat /etc/pve/lxc/105.conf
-arch: amd64
-cmode: shell
-cores: 2
-features: fuse=1,keyctl=1,nesting=1
-hostname: homesrv01
-memory: 1500
-net0: name=eth0,bridge=vmbr0,firewall=1,ip6=dhcp,...,type=veth
-onboot: 1
-ostype: ubuntu
-protection: 1
-rootfs: local-lvm:vm-105-disk-0,size=32G
-swap: 1500
-unprivileged: 1
-lxc.cgroup2.devices.allow: c 189:* rwm
-lxc.mount.entry: usb-ITead_Sonoff_Zigbee_3.0_USB_Dongle_Plus_c0e8eeb4b38ded118e7c06f6b86ce6f8-if00-port0 dev/serial/by-id/usb-ITead_Sonoff_Zigbee_3.0_USB_Dongle_Plus_c0e8eeb4b38ded118e7c06f6b86ce6f8-if00-port0 none bind,optional,create=file
-lxc.cgroup2.devices.allow: c 188:* rwm
-lxc.mount.entry: /dev/ttyUSB0 dev/ttyUSB0 none bind,optional,create=file
-```
-
-lxc.cgroup2.devices.allow and lxc.mount.entry identification
-
-```bash
-# identify usb pen
-lsusb 
-
-# example 
-# Bus 001 Device 008: ID 10c4:ea60 Silicon Labs CP210x UART Bridge
-
-
-#replace with bus and device id
-ls -l /dev/bus/usb/001/008
-
-#example result
-# crw-rw-r-- 1 root root 189, 7 May 17 15:56 /dev/bus/usb/001/008
-
-# so
-
-#lxc.cgroup2.devices.allow: c 189:* rwm
-#lxc.mount.entry: usb-ITead_Sonoff_Zigbee_3.0_USB_Dongle_Plus_c0e8eeb4b38ded118e7c06f6b86ce6f8-if00-port0 dev/serial/by-id/usb-ITead_Sonoff_Zigbee_3.0_USB_Dongle_Plus_c0e8eeb4b38ded118e7c06f6b86ce6f8-if00-port0 none bind,optional,create=file
-
-ls -l /dev/serial/by-id/
-# example result
-#lrwxrwxrwx 1 root root 13 May 17 15:56 usb-ITead_Sonoff_Zigbee_3.0_USB_Dongle_Plus_c0e8eeb4b38ded118e7c06f6b86ce6f8-if00-port0 -> ../../ttyUSB0
-
-ls -l /dev/ttyUSB0
-#example result
-#crw-rw---- 1 root dialout 188, 0 May 17 15:56 /dev/ttyUSB0
-
-#so
-
-#lxc.cgroup2.devices.allow: c 188:* rwm
-#lxc.mount.entry: /dev/ttyUSB0 dev/ttyUSB0 none bind,optional,create=file
-```
-
-### OS
-
-```bash
-# lsb_release -a
-Distributor ID: Ubuntu
-Description:    Ubuntu 24.04 LTS
-Release:        24.04
-Codename:       noble
-
-# uname -r
-6.8.4-3-pve
-```
-
-### logs
-
-```bash
-# check auto update scripts logs
-journalctl -r -t auto-update
-```
-
-## Development, Maintenance and Deployment
-
-Using visual studio code, docker, ansible and gitea actions.
-
-### Docker context
-
-```bash
-# create context to homesrv01 docker on development devices
-docker context create homesrv01 --docker host=ssh://admin@homesrv01.dev.lan
 ```

ansible.cfg

@@ -1,2 +1,3 @@
+# Roles path
 [defaults]
-inventory = ansible/inventory.yml
+inventory = ./nodes/ansible

casa-limbosolutions-com/README.md

@@ -0,0 +1,13 @@
+# casa-limbosolutions-com
+
+## sync cert
+
+``` bash
+kubectl annotate secret casa-limbosolutions-com-tls \
+  -n casa-limbosolutions-com \
+  replicator.v1.mittwald.de/replicate-to="home-assistant,node-red,lyrionmusicserver,jellyfin" --overwrite
+```
+
+``` bash
+kubectl kustomize deploy/flux | kubectl apply -f -
+```

casa-limbosolutions-com/deploy/flux/.env.d/.gitignore

@@ -0,0 +1,2 @@
+**
+!.gitignore

casa-limbosolutions-com/deploy/flux/git-repo.yaml

@@ -0,0 +1,11 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: casa
+spec:
+  interval: 1m0s
+  url: ssh://git@git.limbosolutions.com:2222/myLimbo/casa.git
+  ref:
+    branch: main
+  secretRef:
+    name: flux-repo-ssh-credentials

casa-limbosolutions-com/deploy/flux/kustomization.yaml

@@ -0,0 +1,18 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: casa-limbosolutions-com
+resources:
+ - git-repo.yaml
+secretGenerator:
+  - name: flux-repo-ssh-credentials
+    namespace: casa-limbosolutions-com
+    files:
+      - "identity=./.env.d/flux-repo-ssh-key"
+      - "known_hosts=./.env.d/flux-repo-ssh-known_hosts"
+      - "pubkey=./.env.d/flux-repo-ssh-key.pub"
+  - name: flux-sops-age
+    namespace: casa-limbosolutions-com
+    files:
+      - "age.agekey=./.env.d/age.agekey"
+generatorOptions:
+  disableNameSuffixHash: true

casa-limbosolutions-com/icarus/README.md

@@ -1,29 +0,0 @@
-# casa.limbosolutions.com at icarus
-
-Use icarus cluster context to all documentation and scrips on this folder. [Check Instructions](#icarus-cluster---access) for how to setup required user and roles on icurus and client kubeconfig.
-
-## certificates (wildcard)
-
-```bash
-kubectl apply -f ./certs.yaml
-```
-
-```bash
-#check certificates
-kubectl get cert -n casa-limbosolutions-com
-```
-
-## Icarus cluster - access
-
-On user computer.  
-*Access to k3s context not required.*
-
-```bash
-# create private key
-openssl genrsa -out ../../.env.d/kube/casa@icarus-user.key 2048
-
-# create csr
-openssl req -new -key ../../.env.d/kube/casa@icarus-user.key -out ../../.env.d/kube/casa@icarus-user.csr -subj "/CN=casa/O=limbosolutions"
-```
-
-Follow instructions to [setup user and roles on icarus k3s cluster](./k3s-admin.md), and setup kubectl config [kube config](./k3s-kubctl-config.md).

casa-limbosolutions-com/icarus/k3s-admin.md

@@ -1,95 +0,0 @@
-# casa on Icarus - admin
-
-Requires kubernetes admin user access to icarus. All documentation and scripts must be executed on icarus context with an admin account.
-
-Currently using an symbolic on icarus project on my dev device to this file.
-
-## kubernetes Namespace
-
-```bash
-# delete namespace
-kubectl create namespace casa-limbosolutions-com
-```
-
-```bash
-# delete namespace
-kubectl delete namespace casa-limbosolutions-com
-```
-
-## Roles and Bindings
-
-``` yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  namespace: casa-limbosolutions-com
-  name: casa-limbosolutions-com
-rules:
-  - apiGroups: 
-      - ""
-      - cert-manager.io # to access deployments certs from cert-manager
-      - apps # to access deployments
-      - networking.k8s.io # to access ingresses
-    resources: 
-      - pods
-      - services
-      - secrets
-      - certificates
-      - deployments
-      - configmaps
-      - ingresses
-      - persistentvolumeclaims
-    verbs: 
-      - get
-      - list
-      - watch
-      - create
-      - update
-      - patch
-      - delete
-      - deletecollection
-```
-
-``` yaml
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: casa-limbosolutions-com-rb  # Replace with your role binding name
-  namespace: casa-limbosolutions-com     # Replace with your namespace
-subjects:
-- kind: User                   # or "ServiceAccount" for service accounts
-  name: casa           # Replace with the username or service account name
-  apiGroup: rbac.authorization.k8s.io
-  namespace: casa-limbosolutions-com
-roleRef:
-  kind: ClusterRole
-  name: casa-limbosolutions-com          # The name of the role you created
-  apiGroup: rbac.authorization.k8s.io
-```
-
-### kubernetes User
-
-```bash
-#Deploy csr to k3s
-cat <<EOF | kubectl apply -f -
-apiVersion: certificates.k8s.io/v1
-kind: CertificateSigningRequest
-metadata:
-  name: casa-user-csr
-spec:
-  request: $(cat ../.env.d/.kube/casa@icarus-user.csr | base64 | tr -d '\n')
-  signerName: kubernetes.io/kube-apiserver-client
-  usages:
-  - client auth
-EOF
-```
-
-```bash
-# Approve csr
-kubectl certificate approve casa-user-csr
-```
-
-```bash
-# Download kubernet user crt
-kubectl get csr casa-user-csr -o jsonpath='{.status.certificate}' | base64 --decode > ./.env.d/casa@icarus-user.crt
-```

casa-limbosolutions-com/sync-certs-job/README.md

@@ -1 +0,0 @@
-

casa-limbosolutions-com/sync-certs-job/docker-compose.yaml

@@ -1,78 +0,0 @@
-
-configs:
-  sync-certs-sh:
-    content: |
-      #!/bin/bash
-      ##############################################################################################################################
-      # notes:
-      # --certificate-authority="$${KUBERNETES_CRT_AUTHORITY}" not working, dont hnow why, so using --insecure-skip-tls-verify
-      ##############################################################################################################################
-      
-      
-      set -e
-      mkdir -p /tmp/.kube
-
-      echo "Trace: Setup kube"
-   
-      echo "Trace: Processing KUBERNETES_CRT_AUTHORITY_DATA"
-      base64 -d <<< "${KUBERNETES_CRT_AUTHORITY_DATA}" > "$${KUBERNETES_CRT_AUTHORITY}"
-      echo "Trace: Processing KUBERNETES_CRT_AUTHORITY_DATA"
-      base64 -d <<< "${KUBERNETES_CLIENT_CRT_DATA}" > "$${KUBERNETES_CLIENT_CRT}"
-      echo "Trace: Processing KUBERNETES_CLIENT_KEY_DATA"
-      base64 -d <<< "${KUBERNETES_CLIENT_KEY_DATA}" > "$${KUBERNETES_CLIENT_KEY}"
-
-      # while true ; do
-      #   sleep 5
-      # done
-
-   
-      echo "Trace: Fetching secrets"
-      CERT_NAMES=$(kubectl get secrets \
-        -n casa-limbosolutions-com \
-        --server="$${KUBERNETES_SERVER}" \
-        --client-key="$${KUBERNETES_CLIENT_KEY}" \
-        --client-certificate="$${KUBERNETES_CLIENT_CRT}" \
-        --insecure-skip-tls-verify \
-        -o json | jq -r '.items[].metadata.name')
-
-      for CERT_NAME in $$CERT_NAMES; do
-        echo "Trace: Syncing certificate: $$CERT_NAME"
-        kubectl get secret "$$CERT_NAME" \
-          -n casa-limbosolutions-com \
-          --server="$${KUBERNETES_SERVER}" \
-          --client-key="$${KUBERNETES_CLIENT_KEY}" \
-          --client-certificate="$${KUBERNETES_CLIENT_CRT}" \
-          --insecure-skip-tls-verify \
-          -o json | \
-          jq -r '.data | to_entries[] | "\(.key) \(.value)"' | \
-          while IFS=' ' read -r KEY VALUE; do
-            echo "Processing key: $$KEY"
-            # Decode the base64 value and save it to the appropriate file
-            echo "Trace: Saving key: $$KEY"
-            echo "$$VALUE" | base64 -d > "/etc/ssl/certs/casa-limbosolutions-com-certs/$${CERT_NAME}_$${KEY}"
-          done
-      done
-     
-      echo "Info: Certificates synced successfully."  
-
-services:
-  kubectl:
-    image: bitnami/kubectl:latest
-    environment:
-      KUBERNETES_SERVER: ${KUBERNETES_SERVER}
-      KUBERNETES_CRT_AUTHORITY: /tmp/.kube/ca.crt
-      KUBERNETES_CLIENT_CRT: /tmp/.kube/client.crt
-      KUBERNETES_CLIENT_KEY: /tmp/.kube/client.key
-    container_name: sync-certs-job
-    entrypoint: bash -c /app/sync-certs.sh
-    configs:
-      - source: sync-certs-sh
-        target: /app/sync-certs.sh
-        mode: 0755
-    volumes:
-      - casa-certs:/etc/ssl/certs/casa-limbosolutions-com-certs:rw
-volumes:
-  casa-certs:
-    name: casa-limbosolutions-com-certs
-    external: true # Atention permission must be set to 1001:1001 (using chown on nginx container command)
-

casa.code-workspace

@@ -1,7 +1,7 @@
 {
     "folders": [
         {
-            "path": "../../homeAssistant"
+            "path": "."
         }
     ]
 }

casa.full-stack.code-workspace

@@ -3,7 +3,7 @@
 	"folders": [
 		{
 			"path": "./",
-			"name": "homesrv01"
+			"name": "casa"
 		},
 		{
 			"path": "../homeAssistant"
@@ -14,16 +14,18 @@
 		{
 			"path": "../mosquitto"
 		},
+	    {
+			"name": "Jellyfin",
+			"path": "../myLimbo.Jellyfin"
+		},
 		{
 			"name": "kb",
 			"path": "../kb"
 		},
-		// {
-		// 	"name": "kb/kb",
-		// 	"path": "../../kb/kb"
-		// }
-		
-		
+				{
+			"name": "pi.bluetooth.speaker",
+			"path": "../pi.bluetooth.speaker"
+		},
 	],
 	"settings": {
 		"files.exclude": {
@@ -34,16 +36,80 @@
 		"**/.DS_Store": true,
 		"**/Thumbs.db": true,
 		"kb": true,
+		"runme.taskProvider.enabled": false,
+		"runme.scanMode": "off"
 
 	},
 	
 	"ansible.python.interpreterPath": "/bin/python",
 	"cSpell.words": [
+		"davidanson",
+		"eamodio",
+		"envsubst",
+		"kubelet",
 		"lmscommunity",
 		"localtime",
+		"LOGLEVEL",
 		"lyrionmusicserver",
+		"mtxr",
+		"nvme",
 		"rclone",
-		"reverseproxy"
-	]
-}	
+		"reverseproxy",
+		"rogalmic",
+		"runme",
+		"sqltools",
+		"yzhang"
+	],
+	"githubLocalActions.workflowsDirectory": ".gitea/workflows"
+},
+"tasks": {
+  "version": "2.0.0",
+  "tasks": [
+    {
+      "label": "Run current shell file - relative",
+      "type": "shell",
+      "command": "bash",
+      "args": [
+        "${file}"
+      ],
+      "options": {
+        "cwd": "${fileDirname}"
+      },
+      "group": {
+      },
+      "presentation": {
+        "echo": true,
+        "reveal": "always",
+        "focus": false,
+        "panel": "shared"
+      }
+    },
+	{
+      "label": "Run current shell file",
+      "type": "shell",
+      "command": "bash",
+      "args": [
+        "${file}"
+      ],
+      "group": {
+        "kind": "build",
+        "isDefault": true
+      },
+      "presentation": {
+        "echo": true,
+        "reveal": "always",
+        "focus": false,
+        "panel": "shared"
+      }
+    },
+    {
+      "label": "Kustomize - Deploy - Selected File",
+      "type": "shell",
+      "command": "kubectl apply -k ${fileDirname}",
+      "problemMatcher": [],
+      "group": "build"
+    }
+
+  ]
+}
 }

ks-cilium.yaml

@@ -0,0 +1,83 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  annotations:
+    kubectl.kubernetes.io/last-applied-configuration: |
+      {"apiVersion":"kustomize.toolkit.fluxcd.io/v1","kind":"Kustomization","metadata":{"annotations":{},"name":"cilium","namespace":"casa-limbosolutions-com"},"spec":{"interval":"1m","path":"./services/cilium/deploy/app","prune":true,"sourceRef":{"kind":"GitRepository","name":"casa","namespace":"casa-limbosolutions-com"}}}
+  creationTimestamp: "2026-07-11T23:05:18Z"
+  finalizers:
+  - finalizers.fluxcd.io
+  generation: 1
+  name: cilium
+  namespace: casa-limbosolutions-com
+  resourceVersion: "55743107"
+  uid: 92b8e926-c008-4c28-8f11-43ceeec1ecd0
+spec:
+  force: false
+  interval: 1m
+  path: ./services/cilium/deploy/app
+  prune: false
+  sourceRef:
+    kind: GitRepository
+    name: casa
+    namespace: casa-limbosolutions-com
+status:
+  conditions:
+  - lastTransitionTime: "2026-08-29T19:58:40Z"
+    message: 'Applied revision: main@sha1:0361f5d3d0c8a867eea1d8bc1fb570665faaa9ba'
+    observedGeneration: 1
+    reason: ReconciliationSucceeded
+    status: "True"
+    type: Ready
+  history:
+  - digest: sha256:16d38a70278518c2adfd7517cf139607767c1b42513b0242ea4a7516185a64b4
+    firstReconciled: "2026-07-16T12:13:07Z"
+    lastReconciled: "2026-08-29T19:58:40Z"
+    lastReconciledDuration: 80.450572ms
+    lastReconciledStatus: ReconciliationSucceeded
+    metadata:
+      revision: main@sha1:0361f5d3d0c8a867eea1d8bc1fb570665faaa9ba
+    totalReconciliations: 63677
+  - digest: sha256:a5c2fa62ccbee967f13a48f4af93628f4a674753ce3da2ad8cfff9aba224e97a
+    firstReconciled: "2026-07-16T11:14:10Z"
+    lastReconciled: "2026-07-16T12:13:04Z"
+    lastReconciledDuration: 65.016149ms
+    lastReconciledStatus: ReconciliationSucceeded
+    metadata:
+      revision: main@sha1:f52cf91125d3ddc1b52593f9ac7b4a21d8b5fae3
+    totalReconciliations: 60
+  - digest: sha256:f3b4c7dc811a40c031d0c5d45b30f512a1d99dd46ced81f441383e7ef9ff100b
+    firstReconciled: "2026-07-12T13:59:54Z"
+    lastReconciled: "2026-07-16T11:13:48Z"
+    lastReconciledDuration: 65.594843ms
+    lastReconciledStatus: ReconciliationSucceeded
+    metadata:
+      revision: main@sha1:d0e0d6293fbc8ab190adefa380c9f8cfc6fc34d3
+    totalReconciliations: 5338
+  - digest: sha256:c968874ddd0859a7f031dae53abe4a4efaac0b6a2edab82111aa35327954f857
+    firstReconciled: "2026-07-12T13:34:53Z"
+    lastReconciled: "2026-07-12T13:59:51Z"
+    lastReconciledDuration: 80.654786ms
+    lastReconciledStatus: ReconciliationSucceeded
+    metadata:
+      revision: main@sha1:85982571dd573e701a599d29add61a6559d8320a
+    totalReconciliations: 26
+  - digest: sha256:acc2f075adc36298ee4b9acc679e1cbb05219b1a8fdcb4ed0850b800cb53490e
+    firstReconciled: "2026-07-12T12:49:09Z"
+    lastReconciled: "2026-07-12T13:34:16Z"
+    lastReconciledDuration: 92.426021ms
+    lastReconciledStatus: ReconciliationSucceeded
+    metadata:
+      revision: main@sha1:63591efc8f0ccee893b605b9e520786a14b39599
+    totalReconciliations: 43
+  inventory:
+    entries:
+    - id: cilium_cilium-helm-values__Secret
+      v: v1
+    - id: cilium_cilium_helm.toolkit.fluxcd.io_HelmRelease
+      v: v2
+    - id: cilium_cilium_source.toolkit.fluxcd.io_HelmRepository
+      v: v1
+  lastAppliedRevision: main@sha1:0361f5d3d0c8a867eea1d8bc1fb570665faaa9ba
+  lastAttemptedRevision: main@sha1:0361f5d3d0c8a867eea1d8bc1fb570665faaa9ba
+  observedGeneration: 1

nodes/README.md

@@ -0,0 +1,326 @@
+# Casa k3s cluster
+
+**k3s version:** v1.36.1+k3s1
+
+**Table of Contents:**
+
+- [Common](#common)
+  - [OCI Mirrors Cache](#oci-mirrors-cache)
+- [casa - control Plane](#casa---control-plane)
+  - [casa - control Plane - proxmox vm](#casa---control-plane---proxmox-vm)
+  - [casa - control Plane - network configuration](#casa---control-plane---network-configuration)
+  - [casa - control Plane - k3s setup](#casa---control-plane---k3s-setup)
+- [minion01 - worker node](#minion01---worker-node)
+  - [Minion01 - proxmox vm](#minion01---proxmox-vm)
+  - [casa-minion-01 - local path config](#casa-minion-01---local-path-config)
+  - [fstab](#fstab)
+- [casa-mini-minion-01 - worker node](#casa-mini-minion-01---worker-node)
+  - [casa-mini-minion-01 - proxmox vm](#casa-mini-minion-01---proxmox-vm)
+  - [casa-mini-minion-01 taints](#casa-mini-minion-01-taints)
+
+## Common
+
+**Disable swap:**
+
+``` bash
+swapoff -a
+Edit /etc/fstab and comment out any swap entries:
+# /swapfile none swap sw 0 0
+```
+
+**Other Packages:**
+
+``` bash
+sudo apt update -y && \
+sudo apt install -y \
+curl \
+btop
+
+```
+
+**Update system:**
+
+``` bash
+sudo apt update -y && \
+sudo apt upgrade -y && \
+sudo apt auto-remove -y
+```
+
+**name servers:**
+
+``` bash
+cat <<EOF > /etc/resolv.conf       
+domain dev.lan
+search dev.lan. lan.
+nameserver 192.168.14.254
+EOF
+```
+
+### OCI Mirrors Cache
+
+``` bash
+# /etc/rancher/k3s/registries.yaml
+
+mirrors:
+  # --- Docker Hub (all aliases → docker-mirror) ---
+  docker.io:
+    endpoint:
+      - https://oci.limbosolutions.com/v2/docker-mirror
+  registry-1.docker.io:
+    endpoint:
+      - https://oci.limbosolutions.com/v2/docker-mirror
+  index.docker.io:
+    endpoint:
+      - https://oci.limbosolutions.com/v2/docker-mirror
+
+  # --- GHCR ---
+  ghcr.io:
+    endpoint:
+      - https://oci.limbosolutions.com/v2/ghcr-mirror
+
+  # --- Quay.io ---
+  quay.io:
+    endpoint:
+      - https://oci.limbosolutions.com/v2/quay-mirror
+
+  # --- Kubernetes official registry ---
+  registry.k8s.io:
+    endpoint:
+      - https://oci.limbosolutions.com/v2/k8s-mirror
+
+  # --- Google Container Registry (your "grc-mirror") ---
+  gcr.io:
+    endpoint:
+      - https://oci.limbosolutions.com/v2/grc-mirror
+
+  # --- AWS Public ECR ---
+  public.ecr.aws:
+    endpoint:
+      - https://oci.limbosolutions.com/v2/aws-mirror
+
+  # --- Microsoft Container Registry ---
+  mcr.microsoft.com:
+    endpoint:
+      - https://oci.limbosolutions.com/v2/mcr-proxy
+
+  # --- GitLab Container Registry ---
+  registry.gitlab.com:
+    endpoint:
+      - https://oci.limbosolutions.com/v2/gitlab-mirror
+
+  # --- Bitnami (namespace under Docker Hub) ---
+  docker.io/bitnami:
+    endpoint:
+      - https://oci.limbosolutions.com/v2/bitnami-mirror
+
+  # --- Red Hat registry ---
+  registry.redhat.io:
+    endpoint:
+      - https://oci.limbosolutions.com/v2/readheat-mirror
+      
+
+configs:
+  oci.limbosolutions.com:
+    auth:
+      username: <username>
+      password: <password>
+    tls:
+      insecure_skip_verify: false
+```
+
+## casa - control Plane
+
+|  Name       |     Value                      |
+| ---         | ---                            |
+| **NAME**    | casa.dev.lan                   |
+| **VLAN**    | casa                           |
+| **IP**      | 192.168.14.9                   |
+| **OS**      | Debian GNU/Linux 12 (bookworm) |
+| **KERNEL**  | 6.1.0-44-amd64                 |
+
+``` bash
+cat /etc/os-release; uname -r
+```
+
+### casa - control Plane - proxmox vm
+
+*hosted on gaia.*
+
+``` yaml
+agent: 1
+balloon: 0
+boot: order=scsi0;ide2;net0
+cores: 2
+cpu: host
+ide2: none,media=cdrom
+memory: 2355
+meta: creation-qemu=10.1.2,ctime=1762626497
+name: casa
+net0: virtio=BXX:XX:XX:XX:XX:XX,bridge=vmbr0,tag=xx
+numa: 0
+onboot: 1
+ostype: l26
+scsi0: local-lvm:vm-XXX-disk-0,iothread=1,size=24G,ssd=1
+scsihw: virtio-scsi-single
+smbios1: uuid=cxxxx-xxxx-xxxx-xxxx-xxxx
+sockets: 1
+```
+
+### casa - control Plane - network configuration
+
+``` bash
+ip a # check ethernet name
+
+# removes automatic configuration as dhcp client
+sed -i '/ens18/d' /etc/network/interfaces
+
+cat <<EOF > /etc/network/interfaces.d/ens18
+# my network configuration
+auto ens18
+iface ens18 inet static
+  address 192.168.14.9/24
+  gateway 192.168.0.1
+EOF
+
+```
+
+### casa - control Plane - k3s setup
+
+**Taint NoSchedule on master node:**
+
+kubectl taint nodes <master-node-name> node-role.kubernetes.io/control-plane=:NoSchedule
+
+**Example of selector/tolerations for pods, deployments:**
+
+``` bash
+...
+nodeSelector:
+  kubernetes.io/hostname: casa
+
+tolerations:
+  - key: "node-role.kubernetes.io/control-plane"
+    operator: "Exists"
+    effect: "NoSchedule"
+...
+
+```
+
+``` bash
+kubectl taint nodes casa node-role.kubernetes.io/control-plane=:NoSchedule
+```
+
+## minion01 - worker node
+
+### Minion01 - proxmox vm
+
+*hosted on gaia.*
+
+```yaml
+agent: 1
+balloon: 0
+boot: order=scsi0;ide2;net0
+cores: 4
+cpu: host
+ide2: none,media=cdrom
+memory: 4096
+meta: creation-qemu=10.1.2,ctime=1763219351
+name: casa-minion-01
+net0: virtio=BXX:XX:XX:XX:XX:XX,bridge=vmbr0,tag=xx
+numa: 0
+onboot: 1
+ostype: l26
+scsi0: fastcore:vm-XXX-disk-0,iothread=1,size=8G,ssd=1
+scsi1: fluxcore:vm-xx-disk-0,iothread=1,size=32G,ssd=1 # used mainly by jellyfin cache
+scsi1: fastcore:vm-XXX-disk-2,iothread=1,size=32G,ssd=1 /dataDisk # k3s-data-dir /dataDisk/k3s
+scsihw: virtio-scsi-single
+smbios1: xxxx-xxxx-xxxx-xxxx-xxxx
+sockets: 1
+```
+
+|  Name       | Value                              |
+| ---         | ---                                |
+| **NAME**    | minion01                           |
+| **VLAN**    | casa                               |
+| **IP**      | 192.168.14.10                      |
+| **OS**      | Debian GNU/Linux 12 (bookworm)     |
+| **KERNEL**  | 6.1.0-44-amd64                     |
+
+### casa-minion-01 - local path config
+
+`kubectl -n kube-system edit configmap local-path-config on kube-system` to set path to provisioner.
+
+``` yaml
+   config.json: |-
+    {
+      "nodePathMap":[
+        "node":"DEFAULT_PATH_FOR_NON_LISTED_NODES",
+        "paths":["/var/lib/rancher/k3s/storage"]
+      },
+      {
+          "node":"casa-minion-01",
+          "paths":["/dataDisk/k3s/storage"]
+      }
+      ]
+    }
+ ```
+
+**Set node labels:**
+
+``` bash
+kubectl label node casa-minion-01 role=worker-node
+```
+
+### fstab
+
+```bash
+UUID=xxxx-xxxx-xxxx-xxxx-xxxx /                           ext4    errors=remount-ro 0       1
+UUID=xxxx-xxxx-xxxx-xxxx-xxxx /dataDisks/nvme00           ext4    errors=remount-ro 0       1
+UUID=xxxx-xxxx-xxxx-xxxx-xxxx /dataDisks/nvme01-ephemeral ext4    errors=remount-ro 0       1
+UUID=xxxx-xxxx-xxxx-xxxx-xxxx /dataDisks/ssd00            ext4    errors=remount-ro 0       1
+```
+
+``` bash
+# setup kubelet pods data to nvme01-ephemeral
+ln -s /dataDisks/nvme01-ephemeral/kubelet/pods /var/lib/kubelet/pods
+# setup k3s containerd  data to nvme01-ephemeral
+ln -s /dataDisks/nvme01-ephemeral/k3s/agent/containerd /dataDisks/nvme00/k3s/agent/containerd
+```
+
+## casa-mini-minion-01 - worker node
+
+### casa-mini-minion-01 - proxmox vm
+
+*hosted on gaia.
+
+``` yaml
+agent: 1
+balloon: 0
+boot: order=scsi0;ide2;net0
+cores: 4
+cpu: x86-64-v2-AES
+memory: 2048
+meta: creation-qemu=11.0.0,ctime=1782516417
+name: casa-mini-minion-01
+net0: virtio=xx:xx:xx:xx:xx:xx,bridge=vmbr0,tag=14
+numa: 0
+ostype: l26
+scsi0: fastcore:vm-112-disk-0,iothread=1,size=24G,ssd=1
+scsihw: virtio-scsi-single
+sockets: 1
+usb0: host=1-1.1
+```
+
+|  Name       | Value                              |
+| ---         | ---                                |
+| **NAME**    | casa-mini-minion-01                |
+| **VLAN**    | casa                               |
+| **IP**      | 192.168.14.11                      |
+| **OS**      | Debian GNU/Linux 12 (bookworm)     |
+| **KERNEL**  | 6.1.0-44-amd64                     |
+
+### casa-mini-minion-01 taints
+
+``` bash
+``` bash
+kubectl taint nodes casa-mini-minion-01 infra.limbosolutions.com/dedicated=casa-mini-minion-01:NoSchedule
+```

nodes/ansible/group_vars/all/.gitignore

@@ -0,0 +1 @@
+private.yaml

nodes/ansible/group_vars/all/public.yaml

@@ -0,0 +1,3 @@
+k3s_version: "v1.36.3+k3s1"
+# execute on server to get token
+# cat /var/lib/rancher/k3s/server/node-token

nodes/ansible/host_vars/.gitignore

@@ -0,0 +1 @@
+private.yaml

nodes/ansible/hosts

@@ -0,0 +1,4 @@
+[all]
+casa
+casa-mini-minion-01
+casa-minion-01

nodes/ansible/k3s-control-plane.playbook.yaml

@@ -0,0 +1,15 @@
+- name: K3s update instal control plane
+  hosts: 
+    - casa
+  become: true
+  tasks:
+    - name: setup k3s - control plane
+      ansible.builtin.shell: "curl -sfL https://get.k3s.io | sh -"
+      environment:
+        INSTALL_K3S_VERSION: "{{ k3s_version }}"
+        INSTALL_K3S_EXEC: "--flannel-backend=none --disable-network-policy --disable=traefik --disable=servicelb"
+      register: k3s_output
+
+    - name: Show output 
+      ansible.builtin.debug:
+        var: k3s_output.stdout_lines  

nodes/ansible/k3s-workers-mini-minion-01.playbook.yaml

@@ -0,0 +1,14 @@
+- name: K3s update instal k3s binaries on 
+  hosts: 
+    - casa-mini-minion-01
+  become: true
+  tasks:
+    - name: setup k3s - casa-mini-minion-01
+      ansible.builtin.shell: "curl -sfL https://get.k3s.io | sh -"
+      environment:
+        INSTALL_K3S_VERSION: "{{ k3s_version }}"
+        INSTALL_K3S_EXEC: "agent --server https://casa.dev.lan:6443 --token {{ k3s_node_token }}"
+      register: k3s_output
+    - name: Show output 
+      ansible.builtin.debug:
+        var: k3s_output.stdout_lines

nodes/ansible/k3s-workers-minion-01.playbook.yaml

@@ -0,0 +1,14 @@
+- name: K3s update instal k3s binaries on 
+  hosts: 
+    - casa-minion-01
+  become: true
+  tasks:
+    - name: setup k3s - casa-minion-01
+      ansible.builtin.shell: "curl -sfL https://get.k3s.io | sh -"
+      environment:
+        INSTALL_K3S_VERSION: "{{ k3s_version }}"
+        INSTALL_K3S_EXEC: "agent --data-dir /dataDisks/nvme00/k3s --server https://casa.dev.lan:6443 --token {{ k3s_node_token }}"
+      register: k3s_output
+    - name: Show output 
+      ansible.builtin.debug:
+        var: k3s_output.stdout_lines

nodes/ansible/new-node-pre-setup.playbook.yaml

@@ -0,0 +1,23 @@
+# requirements, on device running ansible 
+# ansible-galaxy collection install ansible.posix
+# python3 -m pip show passlib
+
+- name: Setup System  
+  hosts: 
+    - ???
+  become: true
+  tasks:
+    - name: Add ansible user 
+      ansible.builtin.user:
+        password: "{{ ansible_new_user_password | password_hash('sha512') }}"
+        name: "{{ ansible_new_user }}" 
+        groups: sudo
+        shell: /bin/bash
+        create_home: yes
+        state: present
+
+    - name: Add SSH authorized key
+      ansible.posix.authorized_key:
+        user:  "{{ ansible_new_user }}"
+        key: "{{ lookup('file', '~/.ssh/id_ed25519.pub') }}"
+        state: present

nodes/ansible/os-get-info.playbook.yaml

@@ -0,0 +1,12 @@
+- name: OS update playbook
+  hosts: 
+    - all
+  become: true
+  tasks:
+
+    - debug:
+        msg:
+        - "Distribution: {{ hostvars[inventory_hostname].ansible_distribution }}"
+        - "Major version: {{ hostvars[inventory_hostname].ansible_distribution_major_version }}"
+        - "Version: {{ hostvars[inventory_hostname].ansible_distribution_version }}"
+        - "kernel: {{ hostvars[inventory_hostname].ansible_kernel }}"

nodes/ansible/os-update.playbook.yaml

@@ -0,0 +1,44 @@
+- name: OS update playbook
+  hosts: 
+    - casa
+    - casa-minion-01
+    - casa-mini-minion-01
+  become: true
+  tasks:
+    - debug:
+        msg:
+        - "ansible_distribution {{ hostvars[inventory_hostname].ansible_distribution }}"
+        - "major version {{ hostvars[inventory_hostname].ansible_distribution_major_version }}"
+        - "version {{ hostvars[inventory_hostname].ansible_distribution_version }}"
+        - "version {{ hostvars[inventory_hostname].ansible_kernel }}"
+    
+    - name: Update all Packages to their latest version
+      ansible.builtin.apt:
+        update_cache: true
+        force_apt_get: true
+
+    - name: Upgrade all packages on servers
+      ansible.builtin.apt:
+        upgrade: dist 
+        force_apt_get: true
+
+    - name: Check if a reboot is needed
+      register: reboot_required_file
+      stat: path=/var/run/reboot-required
+
+    - name: Reboot server
+      reboot:
+        msg: "Reboot initiated by Ansible due to kernel updates"
+        connect_timeout: 5
+        reboot_timeout: 300
+        pre_reboot_delay: 0
+        post_reboot_delay: 30
+        test_command: uptime
+      when: reboot_required_file.stat.exists
+
+    - debug:
+        msg:
+        - "ansible_distribution {{ hostvars[inventory_hostname].ansible_distribution }}"
+        - "major version {{ hostvars[inventory_hostname].ansible_distribution_major_version }}"
+        - "version {{ hostvars[inventory_hostname].ansible_distribution_version }}"
+        - "version {{ hostvars[inventory_hostname].ansible_kernel }}"

nodes/ansible/requirements.yml

@@ -0,0 +1,4 @@
+collections:
+  - name: mylimbo.globals
+    source: ssh://git@git.limbosolutions.com:2222/myLimbo/ansible.collection.globals.git
+    type: git

rclone.docker-plugin.playbook.yaml

@@ -1,40 +0,0 @@
-- name: Setup rclone docker plugin
-  become: true
-  vars:
-    # rclone_docker_plugin_config: |
-    #   [s3-limbo-storage]
-    #   type = s3
-    #   provider = SeaweedFS
-    #   access_key_id = !!! SET ON INVENTORY !!!
-    #   secret_access_key = !!! SET ON INVENTORY !!!
-    #   endpoint = !!! SET ON INVENTORY !!!
-
-  hosts:
-    - homesrv01
-  tasks:
-
-    - name: Enforce folders
-      ansible.builtin.file:
-        path: /var/lib/docker-plugins/rclone/config
-        state: directory
-        owner: root
-        group: root
-        mode: u=rwx,g=r,o-rwx
-        recurse: true
-
-    - name: Enforce folders
-      ansible.builtin.file:
-        path: /var/lib/docker-plugins/rclone/cache
-        state: directory
-        owner: root
-        group: root
-        mode: u=rwx,g=r,o-rwx
-        recurse: true
-
-    - name: Setup rclone s3
-      ansible.builtin.copy:
-        dest: /var/lib/docker-plugins/rclone/config/rclone.conf
-        owner: root
-        group: root
-        mode: u=rwx,g-rwx,o-rwx
-        content: "{{ rclone_docker_plugin_config }}"

services/casa-vlan-cicd-runners/.sops.yaml

@@ -0,0 +1,11 @@
+creation_rules:
+  # encrypt all values from file
+  - path_regex: \.private\.dec\.yaml$
+    encrypted_regex: '^(.*)$'
+    age:
+      - age1f9e4pvp5y8gzuk8mz2s5xm85dd7znxhk56tcpuxqwn78qfjwja0qekwlju
+  # encrypt secrets files
+  - path_regex: .*.yaml
+    encrypted_regex: ^(data|stringData)$
+    age: 
+      - age1f9e4pvp5y8gzuk8mz2s5xm85dd7znxhk56tcpuxqwn78qfjwja0qekwlju

services/casa-vlan-cicd-runners/README.md

@@ -0,0 +1,15 @@
+# act-runners
+
+## Setup
+
+Using flux for reconciliation.
+
+``` bash
+./ops-scripts/apply-flux.sh
+```
+
+**Encrypt secrets:**
+
+``` bash
+sops -e deploy/app/secret.dec.yaml > deploy/app/secret.yaml
+```

services/casa-vlan-cicd-runners/deploy/app/configmap.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: act-runner
+data:
+  config.yaml: |
+    log:
+      level: info
+
+    runner:
+      capacity: 1
+      labels:
+        - kubectl
+        - linux
+        - casa-vlan
+
+    cache:
+      enabled: false

services/casa-vlan-cicd-runners/deploy/app/deployment.yaml

@@ -0,0 +1,89 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: casa-vlan-cicd-runners
+  labels:
+    app: casa-vlan-cicd-runners
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: casa-vlan-cicd-runners
+  template:
+    metadata:
+      labels:
+        app: casa-vlan-cicd-runners
+    spec:
+      nodeSelector:
+        role: worker-node
+      containers:
+        - name: mylimbo-casa-vlan-cicd-runner
+          image: oci.limbosolutions.com/public/gitea-act-runners/kubectl:3.0.2
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: GITEA_INSTANCE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: casa-vlan-cicd-runners
+                  key: GITEA_INSTANCE_URL
+            - name: GITEA_RUNNER_REGISTRATION_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: casa-vlan-cicd-runners
+                  key: GITEA_MYLIMBO_RUNNER_REGISTRATION_TOKEN
+            - name: GITEA_RUNNER_NAME
+              valueFrom:
+                secretKeyRef:
+                  name: casa-vlan-cicd-runners
+                  key: GITEA_MYLIMBO_RUNNER_NAME
+              
+          resources:
+            requests:
+              memory: "128Mi"
+              cpu: "100m"
+            limits:
+              memory: "512Mi"
+              cpu: "400m"
+          volumeMounts:
+            - name: config-map
+              mountPath: /etc/act_runner/config.yaml
+              subPath: config.yaml
+
+        - name: mf-casa-vlan-cicd-runner
+          image: oci.limbosolutions.com/public/gitea-act-runners/kubectl:3.0.2
+          imagePullPolicy: Always
+          env:
+            - name: GITEA_INSTANCE_URL
+              valueFrom:
+                secretKeyRef:
+                  name: casa-vlan-cicd-runners
+                  key: GITEA_INSTANCE_URL
+            - name: GITEA_RUNNER_REGISTRATION_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: casa-vlan-cicd-runners
+                  key: GITEA_MF_RUNNER_REGISTRATION_TOKEN
+            - name: GITEA_RUNNER_NAME
+              valueFrom:
+                secretKeyRef:
+                  name: casa-vlan-cicd-runners
+                  key: GITEA_MF_RUNNER_NAME
+
+            - name: GITEA_RUNNER_EPHEMERAL
+              value: "0"
+          resources:
+            requests:
+              memory: "128Mi"
+              cpu: "100m"
+            limits:
+              memory: " 512Mi"
+              cpu: "400m"
+          volumeMounts:
+            - name: config-map
+              mountPath: /etc/act_runner/config.yaml
+              subPath: config.yaml
+
+      volumes:
+      - name: config-map
+        configMap: 
+          name: act-runner

services/casa-vlan-cicd-runners/deploy/app/kustomization.yaml

@@ -0,0 +1,7 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: casa-vlan-cicd
+resources:
+  - configmap.yaml
+  - deployment.yaml
+  - secret.yaml

services/casa-vlan-cicd-runners/deploy/app/secret.yaml

@@ -0,0 +1,26 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: casa-vlan-cicd-runners
+type: Opaque
+data:
+    GITEA_INSTANCE_URL: ENC[AES256_GCM,data:hLBx+4IPLa+nKzh6pD3+QzGovKL/gVlCviP7fDFRd0W9INxzzPbg4w==,iv:NAAfQ68Zxver9/EjwLhI8FVWaFizNR6Zf6UfVvKc9ls=,tag:S2Jhg8A4JE+TZ8u5+GGzBg==,type:str]
+    GITEA_MYLIMBO_RUNNER_NAME: ENC[AES256_GCM,data:jYnpxF0S/fIrVlYhsj9N2ocL+Hc2Wzf6/V8j9g==,iv:RwugntwZ9BJ0Kb1vMVZzszgLPeIftIchuv5jN57CXDc=,tag:YZoyBpNCNOIE5fMSGNkFDw==,type:str]
+    GITEA_MYLIMBO_RUNNER_REGISTRATION_TOKEN: ENC[AES256_GCM,data:bCwCfcKo41KXe/t5IyccVoA897thPsApYmL0N9XHfNxkAnDJZLEdlcL5NYtdnukKSHyep04TckM=,iv:JfwLKBKOhEAPm03o/gLlT3LyofPs0oXq2dwaq8CmwHc=,tag:1rgxsK1H27+w0w33NWj+Ow==,type:str]
+    GITEA_MF_RUNNER_NAME: ENC[AES256_GCM,data:GJPv4aeaukypILywmLDuBbm8e78=,iv:1Etlpm4cgnlRyfzDjMQtpIY3nG9XIrsaWWzDq4kCjD4=,tag:5RvVxf5Mm49TjFAhKpfXyQ==,type:str]
+    GITEA_MF_RUNNER_REGISTRATION_TOKEN: ENC[AES256_GCM,data:ubx3PuK+Vs4reZyMBk60CmZiPHO0W8csCQSMxWy/TgfLdPUi+YxmuEigQZNtDzLPgyD9t3C/aNE=,iv:oEscOTjpKjV3YLjNqZpIpt/c2YfsX4CoKNEPkBi7p00=,tag:4CF9s4l1FULxDpKFt1jc8w==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBuQUpiV0thblB1T1Q3Umti
+            aWVSQkhnQXpwWFg3ZDdxcHZLREpIMU1jRUY4ClZKRUlEdzgxMVczakx3Mmpvck1n
+            eWdmWlkyRUNwMXBEek1BNk9SdkJnUVkKLS0tIFZMUDdpYnZlY3h3S0VyR3JrMzhJ
+            OGg4c0hIRUZaZGtFS1l0Um01enl2RkUKOSAaXSC5166lEMZVihmvTStQeVtqPLyN
+            VB0Hkihei9CGl6yZLdN9ATavzrC0a7Szmzwt1KCIaINJP4Dr229XhA==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1f9e4pvp5y8gzuk8mz2s5xm85dd7znxhk56tcpuxqwn78qfjwja0qekwlju
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-09-03T23:58:19Z"
+    mac: ENC[AES256_GCM,data:WeuZ+6A/uESLVx3bjLR9cdE4WazBmL1PxxAhaefq3n1dAsYCbJx0VFksP3IitVh4bc09hdpLcXMlzjVdbbCOQskMXaaY7Lg+AI2XaddLu1QkXWi7vgsM94lhRm/tV7EmEc2rEgZjzx6B1o47SOaXo0lzq/3MeUEUYO84P30VIbY=,iv:GsFEOokOATfS5LzHKMR+ogsW+d1ddrYurdIEs4rwsiA=,tag:mzytJ+FdaPeKUFeYc42HtQ==,type:str]
+    version: 3.13.1

services/casa-vlan-cicd-runners/deploy/flux/.env.d/.gitignore

@@ -0,0 +1,2 @@
+**
+!.gitignore

services/casa-vlan-cicd-runners/deploy/flux/app-sync.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: act-runners
+spec:
+  interval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: casa
+    namespace: casa-limbosolutions-com
+  path: services/casa-vlan-cicd-runners/deploy/app
+  prune: true
+  decryption:
+    provider: sops
+    secretRef:
+      name: flux-sops-age

services/casa-vlan-cicd-runners/deploy/flux/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: casa-vlan-cicd
+resources:
+ - app-sync.yaml
+secretGenerator:
+  - name: flux-sops-age
+    files:
+      - "age.agekey=./.env.d/age.agekey"
+generatorOptions:
+  disableNameSuffixHash: true

services/casa-vlan-cicd-runners/ops-scripts/apply-flux.sh

@@ -0,0 +1,2 @@
+#!/bin/bash
+kubectl kustomize deploy/flux | kubectl  apply -f -

services/cert-manager/.gitignore

@@ -0,0 +1,2 @@
+.env.d/**
+.env

services/cert-manager/README.md

@@ -0,0 +1,91 @@
+# cert-manager
+
+- [cloudflare](#cloudflare)
+- [api secrets](#api-secrets)
+- [Cluster Issuer](#cluster-issuer)
+  - [Staging](#staging)
+    - [Deploy](#deploy)
+    - [Describe](#describe)
+  - [Production](#production)
+    - [Deploy (Production)](#deploy-production)
+    - [Describe (Production)](#describe-production)
+- [helm chart](#helm-chart)
+
+## cloudflare
+
+## api secrets
+
+[cloudflare-api-token.yaml](./cloudflare-api-token.yaml).
+
+```bash
+set -a
+source ./.env
+set +a
+envsubst < ./cloudflare-api-token.yaml \
+| kubectl apply -n kube-system -f -
+```
+
+## Cluster Issuer
+
+### Staging
+
+#### Deploy
+
+[letsencrypt-clusterissuer-staging.yaml](./letsencrypt-clusterissuer-staging.yaml).
+
+```bash
+set -a
+source ./.env
+set +a
+envsubst < ./letsencrypt-clusterissuer-staging.yaml \
+| kubectl apply -n kube-system -f -
+```
+
+#### Describe
+
+```bash
+kubectl describe clusterissuer letsencrypt-staging
+```
+
+### Production
+
+#### Deploy (Production)
+
+[letsencrypt-clusterissuer-prod.yaml](./letsencrypt-clusterissuer-prod.yaml).
+
+```bash
+set -a
+source ./.env
+set +a
+envsubst < ./letsencrypt-clusterissuer-prod.yaml \
+| kubectl apply -n kube-system -f -
+```
+
+```bash
+set -a
+source ./.env
+set +a
+envsubst < ./letsencrypt-clusterissuer-staging.yaml \
+| kubectl apply -n kube-system -f -
+```
+
+#### Describe (Production)
+
+```bash
+kubectl describe clusterissuer letsencrypt-prod
+```
+
+**Force cert refresh:**
+
+``` bash
+kubectl delete certificaterequest -l cert-manager.io/certificate-name=monitoring-limbosolutions-com-tls
+kubectl delete order  -l cert-manager.io/certificate-name=monitoring-limbosolutions-com-tls
+```
+
+## helm chart
+
+Using flux for reconciliation.
+
+``` bash
+  kubectl kustomize deploy/flux | kubectl apply -f -
+```

services/cert-manager/cloudflare-api-token.yaml

@@ -0,0 +1,15 @@
+#########################################################################
+# requires ./.env
+# ./.env example:
+# EMAIL="myemail@example.com"
+# check README.md for more information
+##########################################################################
+
+apiVersion: v1
+kind: Secret
+metadata:
+  name: cloudflare-api-token
+  namespace: kube-system
+type: Opaque
+stringData:
+  api-token: ${CLOUDFLARE_API_TOKEN}

services/cert-manager/deploy/app/helm-release.yaml

@@ -0,0 +1,25 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cert-manager
+spec:
+  releaseName: cert-manager
+  interval: 40h
+  chart:
+    spec:
+      chart: cert-manager
+      version: 1.x.x
+      sourceRef:
+        kind: HelmRepository
+        name: cert-manager
+      interval: 40h
+  values:
+    crds:
+      enabled: true
+    nodeSelector:
+      kubernetes.io/hostname: casa-mini-minion-01
+    tolerations:
+    - key: "infra.limbosolutions.com/dedicated"
+      operator: "Equal"
+      value: "casa-mini-minion-01"
+      effect: "NoSchedule"

services/cert-manager/deploy/app/helm-repo.yaml

@@ -0,0 +1,7 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: cert-manager
+spec:
+  interval: 40h
+  url: https://charts.jetstack.io

services/cert-manager/deploy/app/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: kube-system
+resources:
+ - helm-repo.yaml 
+ - helm-release.yaml 

services/cert-manager/deploy/flux/app-sync.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cert-manager
+spec:
+  interval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: casa
+    namespace: casa-limbosolutions-com
+  path: services/cert-manager/deploy/app
+  prune: true

services/cert-manager/deploy/flux/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: kube-system
+resources:
+ - app-sync.yaml

services/cert-manager/letsencrypt-clusterissuer-prod.yaml

@@ -0,0 +1,28 @@
+#########################################################################
+# requires ./.env
+# ./.env example:
+# EMAIL="myemail@example.com"
+# check README.md for more information
+##########################################################################
+
+
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+  namespace: kube-system
+spec:
+  acme:
+    email: "${EMAIL}"
+    server: https://acme-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: letsencrypt-prod
+    solvers:
+    - selector:
+        dnsZones:
+        - "limbosolutions.com"
+      dns01:
+        cloudflare:
+          apiTokenSecretRef:
+            name: cloudflare-api-token
+            key: api-token

services/cert-manager/letsencrypt-clusterissuer-staging.yaml

@@ -0,0 +1,29 @@
+#########################################################################
+# requires ./.env
+# ./.env example:
+# EMAIL="myemail@example.com"
+# CLOUDFLARE_API_TOKEN="clouddlare api key"
+# check README.md for more information
+##########################################################################
+
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-staging
+  namespace: kube-system
+spec:
+  acme:
+    server: https://acme-staging-v02.api.letsencrypt.org/directory
+    # Replace with your domain email.
+    email: "${EMAIL}"
+    privateKeySecretRef:
+      name: letsencrypt-staging
+    solvers:
+       - dns01:
+          cloudflare:
+            email: ${EMAIL}
+            apiTokenSecretRef:
+              name: cloudflare-api-token
+              key:  api-token
+
+

services/cilium/deploy/README.md

@@ -0,0 +1,21 @@
+# Cilium
+
+<oci://quay.io/cilium/charts/cilium>
+<https://docs.cilium.io/en/stable/helm-reference/#helm-reference>
+<https://docs.cilium.io/en/stable/installation/k8s-install-helm/>
+
+## setup and deploy
+
+Using flux for reconciliation.
+
+``` bash
+POD_NAME=$(kubectl get pod -l 'app.kubernetes.io/name'=cilium-agent -n cilium -o jsonpath='{.items[0].metadata.name}')
+kubectl exec -n cilium  ${POD_NAME} -c cilium-agent -- cilium-dbg status
+```
+
+**list load balancers ip pools:**
+*Required after changes*
+
+```bash
+kubectl get CiliumLoadBalancerIPPool -A 
+```

services/cilium/deploy/app/helm-release.yaml

@@ -0,0 +1,23 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cilium
+  namespace: cilium
+spec:
+  releaseName: cilium
+  interval: 1m
+
+  chart:
+    spec:
+      chart: cilium
+      version: 1.19.5
+      sourceRef:
+        kind: HelmRepository
+        name: cilium
+        namespace: cilium
+      interval: 40h
+
+  valuesFrom:
+    - kind: Secret
+      name: cilium-helm-values
+      valuesKey: values.yaml

services/cilium/deploy/app/helm-repo.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: cilium
+  namespace: cilium
+spec:
+  interval: 40h
+  url: https://helm.cilium.io/

services/cilium/deploy/app/helm-values.yaml

@@ -0,0 +1,36 @@
+kubeProxyReplacement: true
+installCRDs: true
+routingMode: native
+enableIPv4Masquerade: true # required even if using bpf.masquerade: true
+autoDirectNodeRoutes: true
+ipv4NativeRoutingCIDR: "10.42.0.0/16"
+bpf:
+  masquerade: true
+  hostLegacyRouting: false # force use of bfp
+ipam:
+  operator:
+    clusterPoolIPv4PodCIDR: "10.42.0.0/16"
+    clusterPoolIPv4MaskSize: 24
+l2announcements:
+  enabled: true
+loadBalancer:
+  mode: hybrid
+
+operator:
+  replicas: 1
+
+
+# fix error="listen tcp :30913: bind: address already in use" in agent      
+nodePort:
+  enableHealthCheck: false
+  enableHealthCheckLoadBalancerIP: false
+
+advertisement:
+  loadBalancerIPs: true
+  externalIPs: true
+
+hubble:
+  relay:
+    enabled: true
+  ui:
+    enabled: true

services/cilium/deploy/app/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: cilium
+resources:
+ - helm-repo.yaml 
+ - helm-release.yaml
+secretGenerator:
+  - name: cilium-helm-values
+    files:
+      - values.yaml=helm-values.yaml
+generatorOptions:
+  disableNameSuffixHash: true

services/cilium/deploy/flux/app-sync.yaml

@@ -0,0 +1,13 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cilium
+  namespace: cilium
+spec:
+  interval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: casa
+    namespace: casa-limbosolutions-com
+  path: ./services/cilium/deploy/app
+  prune: true

services/cilium/deploy/policies/traefik-l2.yaml

@@ -0,0 +1,20 @@
+apiVersion: cilium.io/v2alpha1
+kind: CiliumL2AnnouncementPolicy
+metadata:
+  name: casa-l2
+spec:
+  serviceSelector:
+    matchLabels:
+     casa-lan-l2-expose: "true"
+  interfaces:
+    - ens18
+  externalIPs: true
+  loadBalancerIPs: true
+---
+apiVersion: cilium.io/v2
+kind: CiliumLoadBalancerIPPool
+metadata:
+  name: casa-l2
+spec:
+  blocks:
+    - cidr: 192.168.14.0/24

services/fluxcd/README.md

@@ -0,0 +1,2 @@
+# fluxcd-system
+

services/fluxcd/deploy/cluster/flux-system-sync.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: flux-operator
+spec:
+  interval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: casa
+    namespace: casa-limbosolutions-com
+  path: ./services/fluxcd/deploy/flux-operator
+  prune: true

services/fluxcd/deploy/cluster/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: flux-system
+resources:
+ - flux-system-sync.yaml
+

services/fluxcd/deploy/flux-operator/flux-helm-release.yaml

@@ -0,0 +1,20 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: flux-operator
+spec:
+  releaseName: flux-operator
+  interval: 1m
+  chart:
+    spec:
+      chart: flux-operator
+      version: 0.x.x
+      sourceRef:
+        kind: HelmRepository
+        name: controlplaneio-fluxcd
+      interval: 40h
+
+
+
+
+

services/fluxcd/deploy/flux-operator/flux-helm-repo.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: controlplaneio-fluxcd
+spec:
+  type: oci
+  interval: 24h
+  url: oci://ghcr.io/controlplaneio-fluxcd/charts
+  provider: generic
+  

services/fluxcd/deploy/flux-operator/flux-instance.yaml

@@ -0,0 +1,27 @@
+apiVersion: fluxcd.controlplane.io/v1
+kind: FluxInstance
+metadata:
+  name: flux
+  namespace: flux-system
+  annotations:
+    fluxcd.controlplane.io/reconcile: "enabled"
+    fluxcd.controlplane.io/reconcileEvery: "1h"
+    fluxcd.controlplane.io/reconcileTimeout: "10m"
+spec:
+  distribution:
+    version: "2.x"
+    registry: "ghcr.io/fluxcd"
+    artifact: "oci://ghcr.io/controlplaneio-fluxcd/flux-operator-manifests"
+  components:
+    - source-controller
+    - source-watcher
+    - kustomize-controller
+    - helm-controller
+    - notification-controller
+    - image-reflector-controller
+    - image-automation-controller
+  cluster:
+    type: kubernetes
+    size: medium
+    multitenant: false
+    networkPolicy: true 

services/fluxcd/deploy/flux-operator/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: flux-system
+resources:
+  - flux-helm-repo.yaml
+  - flux-helm-release.yaml
+  - flux-instance.yaml
+  - pod-monitor.yaml

services/fluxcd/deploy/flux-operator/pod-monitor.yaml

@@ -0,0 +1,26 @@
+apiVersion: monitoring.coreos.com/v1
+kind: PodMonitor
+metadata:
+  name: flux-system
+  namespace: flux-system
+  labels:
+    app.kubernetes.io/part-of: flux
+    app.kubernetes.io/component: monitoring
+    prometheus-monitoring: enabled
+spec:
+  namespaceSelector:
+    matchNames:
+      - flux-system
+  selector:
+    matchExpressions:
+      - key: app
+        operator: In
+        values:
+          - helm-controller
+          - source-controller
+          - kustomize-controller
+          - notification-controller
+          - image-automation-controller
+          - image-reflector-controller
+  podMetricsEndpoints:
+    - port: http-prom

services/monitoring/.sops.yaml

@@ -0,0 +1,11 @@
+creation_rules:
+  # encrypt all values from file
+  - path_regex: \.private\.dec\.yaml$
+    encrypted_regex: '^(.*)$'
+    age:
+      - age1f9e4pvp5y8gzuk8mz2s5xm85dd7znxhk56tcpuxqwn78qfjwja0qekwlju
+  # encrypt secrets files
+  - path_regex: .*.yaml
+    encrypted_regex: ^(data|stringData)$
+    age: 
+      - age1f9e4pvp5y8gzuk8mz2s5xm85dd7znxhk56tcpuxqwn78qfjwja0qekwlju

services/monitoring/README.md

@@ -0,0 +1,17 @@
+# monitoring
+
+## alloy
+
+**promtail Encrypt secrets:**
+
+``` bash
+sops -e deploy/alloy/global/secrets.dec.yaml > deploy/alloy/global/secrets.yaml 
+```
+
+**Check agent:**
+
+``` bash
+http://localhost:9090/agent
+```
+
+## prometheus - kube-state-metrics

services/monitoring/deploy/alloy/alloy-loki-examples copy.config

@@ -0,0 +1,144 @@
+      // ============================================
+      // LOKI WRITE TARGET
+      // ============================================
+      loki.write "loki_srv" {
+        endpoint {
+          url = env("LOKI_URL")
+        }
+      }
+
+      // ============================================
+      // POD LOGS: DISCOVERY + RELABEL
+      // ============================================
+
+      // Discover Kubernetes pods
+      discovery.kubernetes "pod_logs" {
+        role = "pod"
+      }
+
+      discovery.relabel "pod_logs" {
+        targets = discovery.kubernetes.pod_logs.targets
+
+        rule {
+          source_labels = ["__meta_kubernetes_namespace"]
+          target_label  = "namespace"
+        }
+
+        rule {
+          source_labels = ["__meta_kubernetes_pod_name"]
+          regex        = "^(.+?)-[0-9a-zA-Z]{4,16}(?:-[0-9a-zA-Z]{4,16})?$"
+          replacement  = "$1"
+          target_label = "pod"
+        }
+
+        rule {
+          source_labels = ["__meta_kubernetes_pod_container_name"]
+          target_label = "container"
+        }
+
+        rule {
+          source_labels = ["__meta_kubernetes_node_name"]
+          target_label  = "node_name"
+        }
+
+        rule {
+          source_labels = [
+            "__meta_kubernetes_pod_controller_name",
+          ]
+          regex        = "([0-9a-z-.]+?)(-[0-9a-f]{8,10})?"
+          target_label = "controller_name"
+        }
+
+        rule {
+          source_labels = [
+            "__meta_kubernetes_pod_label_app_kubernetes_io_name",
+            "__meta_kubernetes_pod_label_app",
+            "controller_name",
+            "__meta_kubernetes_pod_name",
+          ]
+          regex        = "^;*([^;]+)(;.*)?$"
+          target_label = "app"
+        }
+
+        rule {
+          source_labels = [
+            "__meta_kubernetes_pod_label_app_kubernetes_io_component",
+            "__meta_kubernetes_pod_label_component",
+          ]
+          regex        = "^;*([^;]+)(;.*)?$"
+          target_label = "component"
+        }
+
+        rule {
+          source_labels = ["namespace", "app"]
+          separator     = "/"
+          target_label  = "job"
+        }
+
+        rule {
+          source_labels = ["job", "container"]
+          separator     = ":"
+          target_label  = "instance"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_node_name"]
+          separator     = ":"
+          target_label  = "host"
+        }
+      }
+
+
+      // ============================================
+      // POD LOGS: SOURCE → PROCESS → WRITE
+      // ============================================
+
+      // Tail logs from Kubernetes pods
+      loki.source.kubernetes "pod_logs" {
+        // targets    = discovery.kubernetes.pod_logs.targets
+        targets    = discovery.relabel.pod_logs.output
+        forward_to = [loki.process.pod_logs.receiver]
+      }
+
+      // Add static labels and forward logs to Loki
+      loki.process "pod_logs" {
+
+        stage.static_labels {
+          values = {
+            cluster = env("CLUSTER_NAME"),
+            zone    = env("ZONE"),
+          }
+        }
+
+        forward_to = [loki.write.loki_srv.receiver]
+      }
+
+      // ============================================
+      // KUBERNETES EVENTS
+      // ============================================
+
+      // Tail Kubernetes events and convert them to log entries
+      loki.source.kubernetes_events "cluster_events" {
+        job_name   = "integrations/kubernetes/eventhandler"
+        log_format = "logfmt"
+        forward_to = [
+          loki.process.cluster_events.receiver,
+        ]
+      }
+
+      // Add static labels and forward events to Loki
+      loki.process "cluster_events" {
+        forward_to = [loki.write.loki_srv.receiver]
+
+        stage.static_labels {
+          values = {
+            cluster = env("CLUSTER_NAME"),
+            host    = "env("CLUSTER_NAME")",
+            job     = "cluster_events",
+            zone    = env("ZONE"),
+          }
+        }
+
+      }
+
+
+

services/monitoring/deploy/alloy/alloy-prometheus-examples.config

@@ -0,0 +1,146 @@
+      // ============================================
+      // Metrics: Discovery Kubernetes Services
+      // ============================================
+      
+      // discovery.kubernetes "k8s_services" {
+      //   role = "service"
+      // }
+
+      // ============================================
+      // Metrics: Kube State Metrics (k8s_services)
+      // ============================================
+
+      // prometheus.scrape "kube_state_metrics" {
+      //   job_name = "integrations/kubernetes/kube-state-metrics"
+      //   targets  = discovery.relabel.kube_state_metrics.output
+      // 
+      //   scheme = "http"
+      // 
+      //   forward_to = [prometheus.remote_write.prometheus_srv.receiver]
+      //  }
+      
+      // ============================================
+      // API Server discovery
+      // ============================================
+
+      // discovery.relabel "apiserver" {
+      //   targets = discovery.kubernetes.k8s_services.targets
+
+      //   rule {
+      //     source_labels = ["__meta_kubernetes_service_name"]
+      //     regex         = "kubernetes"
+      //     action        = "keep"
+      //   }
+      //   rule {
+      //     target_label = "cluster"
+      //     replacement  = env("CLUSTER_NAME")
+      //   }
+      // }
+
+      // prometheus.scrape "apiserver" {
+      //   job_name = "integrations/kubernetes/apiserver"
+      //   targets  = discovery.relabel.apiserver.output
+
+      //   scheme = "https"
+      //   metrics_path = "/metrics"
+
+      //   tls_config {
+      //     server_name          = "kubernetes"
+      //     ca_file              = "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
+      //     insecure_skip_verify = true
+      //   }
+
+      //   bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
+
+      //   forward_to = [prometheus.remote_write.prometheus_srv.receiver]
+      // }
+
+      // ============================================
+      // CoreDNS discovery
+      // ============================================
+      // discovery.relabel "coredns" {
+      //   targets = discovery.kubernetes.k8s_services.targets
+      // 
+      //  rule {
+      //    source_labels = ["__meta_kubernetes_pod_label_k8s_app"]
+      //    regex         = "kube-dns"
+      //    action        = "keep"
+      //  }
+      //  rule {
+      //     target_label = "cluster"
+      //    replacement  = env("CLUSTER_NAME")
+      //   }
+      // }
+
+      // prometheus.scrape "coredns" {
+      //   job_name = "integrations/kubernetes/coredns-pods"
+      //   targets  = discovery.relabel.coredns.output
+
+      //   scheme = "http"
+      //   metrics_path = "/metrics"
+      // 
+      //   forward_to = [prometheus.remote_write.prometheus_srv.receiver]
+      // }
+
+
+      // ============================================
+      // Prometheus: prometheus_srv
+      // ============================================
+
+      prometheus.remote_write "prometheus_srv" {
+  
+        endpoint {
+          url = env("PROMETHEUS_URL")
+        }
+
+        // global labels
+        external_labels = {
+          cluster = env("CLUSTER_NAME"),
+          zone    = env("ZONE"),
+        }
+
+      }
+
+      // ===============================================================================
+      // prometheus / Metrics - Node exporter
+      // Requirements: 
+      //  - discovery.relabel - node_exporter
+      // ===============================================================================
+      prometheus.scrape "node_exporter" {
+        job_name   = "integrations/kubernetes/node-exporter"
+        targets    = discovery.relabel.node_exporter.output
+        scheme     = "http"
+        forward_to = [prometheus.remote_write.prometheus_srv.receiver]
+      }
+
+
+      discovery.relabel "node_exporter" {
+        targets = discovery.kubernetes.kube_pods.targets
+
+        rule {
+          source_labels = ["__meta_kubernetes_pod_label_app_kubernetes_io_name"]
+          regex         = "node-exporter|prometheus-node-exporter"
+          action        = "keep"
+        }
+
+        rule {
+          source_labels = ["__meta_kubernetes_pod_container_port_number"]
+          regex         = "9100"
+          action        = "keep"
+        }
+
+        rule {
+          source_labels = ["__meta_kubernetes_pod_node_name"]
+          target_label  = "node"
+        }
+
+        rule {
+          source_labels = ["__meta_kubernetes_pod_node_name"]
+          target_label  = "nodename"
+        }
+
+        rule {
+          source_labels = ["__meta_kubernetes_pod_node_name"]
+          target_label  = "instance"
+        }
+      }

services/monitoring/deploy/alloy/global/grafana-helm-repo.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: grafana
+spec:
+  interval: 24h
+  url: https://grafana.github.io/helm-charts
+       

services/monitoring/deploy/alloy/global/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: monitoring
+resources:
+  - secrets.yaml
+  - grafana-helm-repo.yaml
+generatorOptions:
+  disableNameSuffixHash: true

services/monitoring/deploy/alloy/global/secrets.yaml

@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: Secret
+metadata:
+    name: alloy-global
+stringData:
+    loki_url: ENC[AES256_GCM,data:2DeZZ+7deDbojQ/+YNgT8KwDmjFFyAqMcTX8l6itlF15hilXKgYP1p/SNoyw1JGJ7x5VZqUl0VIVhVY=,iv:SlFiLvEeIqj+zQ/8Jspc9FL/ElneIlWBzGsM+6mGZLc=,tag:9tIl6fi+xfmF+TJpMXgbKg==,type:str]
+    prometheus_url: ENC[AES256_GCM,data:k8Z3lvZRxOmlw6Wx4aLAgV93hPcEawtoprWU2Kn6j/WIe/YDHM9iuB+pRy7ght4I6jxyNFLotN0BaHE1yg==,iv:EEnRoS287e9EV8+25NtlEO31zN0eyfRBOUe9GVBah18=,tag:2K/MnM1QlWPbceQBqCwylw==,type:str]
+sops:
+    age:
+        - enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBJYmx1dGJTSGZvbVdpV1di
+            Z3dKNUJPVGNkK1hBSnVoRXZrb0R4TmxnUjM4CmpyUXpGN2lneDViN3VPNC9Fa3d6
+            RURxZTFuV0o1SzF5ZEhzSVZyYkY5alkKLS0tIEF1T0tINnRUa0tDOGlaSVRJajF5
+            bTFTd0c4Z3p1aUNWWTZ0ZFVXQVdrMjAKku2YU048qf4E9vEPO19HNfAg78E3fSFQ
+            WBiUgiqtqG/T4cI5cf4CUWoUogtABawBG4z5G5+ud7sfVMzfqW+W1g==
+            -----END AGE ENCRYPTED FILE-----
+          recipient: age1f9e4pvp5y8gzuk8mz2s5xm85dd7znxhk56tcpuxqwn78qfjwja0qekwlju
+    encrypted_regex: ^(data|stringData)$
+    lastmodified: "2026-08-30T22:14:34Z"
+    mac: ENC[AES256_GCM,data:XQ2zRn6zGBONfBiyaip3DpwzIfDBN1mPI65fVfH3c7tsEeY1mV/ZRPD+5iJsiwxlnBa7Rq0iJNOr2f84JE+CiuqYz8UKuQMS02gsvqXuBSgUn5vDRcX/aBV3+1GSOzv3ilmwMkJI/jxfyyXL4YsxKl0fsFEOJRsa3VCCVF0OvrM=,iv:enk8h+TfYBIOFln3SlOw30arg2T/kSU3IMwusrm68Qc=,tag:yp9eQc56Ht6g3x3QnMqMZg==,type:str]
+    version: 3.13.1

services/monitoring/deploy/alloy/kube-scraper/helm-release.yaml

@@ -0,0 +1,24 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: alloy-kube-scraper
+spec:
+  releaseName: alloy-kube-scraper
+  interval: 1m
+  chart:
+    spec:
+      chart: alloy
+      version: 1.x.x
+      sourceRef:
+        kind: HelmRepository
+        name: grafana
+      interval: 40h
+  valuesFrom:
+    - kind: Secret
+      name: alloy-kube-scraper-helm-values
+      valuesKey: values.yaml
+
+
+
+
+

services/monitoring/deploy/alloy/kube-scraper/helm-values.yaml

@@ -0,0 +1,265 @@
+controller:
+  type: 'deployment'
+  nodeSelector:
+    kubernetes.io/hostname: casa-minion-01
+alloy:
+
+  # https://grafana.com/docs/alloy/latest/collect/logs-in-kubernetes/
+  configMap:
+    content: |
+      // ============================================
+      // Discovery: Kubernetes - Nodes
+      // used by:
+      // - prometheus - Kube_node_metrics - cAdvisor 
+      // ============================================
+      
+      discovery.kubernetes "kube_nodes" {
+        role = "node"
+      }
+
+      // ============================================
+      // Discovery: Kubernetes - pods
+      // used by:
+      // - loki kubernetes pod logs
+      // ============================================
+      
+      discovery.kubernetes "kube_pods" {
+        role = "pod"
+      }
+
+      
+      // ============================================
+      // Discovery: Kubernetes - endpoints
+      // used by:
+      // - loki kubernetes kube state metrics
+      // ============================================
+      discovery.kubernetes "kube_endpoints" {
+        role = "endpoint"
+      }
+
+      // ============================================
+      // Logs: Loki config
+      // ============================================
+
+      loki.write "loki_srv" {
+        endpoint {
+          url = env("LOKI_URL")
+        }
+      }
+
+      loki.process "loki_srv" {
+        stage.static_labels {
+          values = {
+            cluster = env("CLUSTER_NAME"),
+            zone    = env("ZONE"),
+          }
+        }
+        forward_to = [loki.write.loki_srv.receiver]
+      }
+
+
+      // ============================================
+      // Loki.source  kube_pod_logs
+      // Requirements: 
+      //  - discovery.relabel: kube_pod_logs
+      //  - discovery.process: loki_srv
+      // ============================================
+
+      loki.source.kubernetes "kube_pod_logs" {
+        targets    = discovery.relabel.kube_pod_logs.output
+        forward_to = [loki.process.loki_srv.receiver]
+      }
+
+
+      // ============================================
+      // Discovery:relabel: kube_pod_logs
+      // Requirements: 
+      //  - discovery.kubernetes.role.pod: kube_pods
+      // ============================================
+    
+      discovery.relabel "kube_pod_logs" {
+        targets = discovery.kubernetes.kube_pods.targets
+        rule {
+          source_labels = ["__meta_kubernetes_namespace"]
+          target_label  = "namespace"
+        }
+
+        rule {
+          source_labels = ["__meta_kubernetes_pod_name"]
+          regex        = "^(.+?)-[0-9a-zA-Z]{4,16}(?:-[0-9a-zA-Z]{4,16})?$"
+          replacement  = "$1"
+          target_label = "pod"
+        }
+
+        rule {
+          source_labels = ["__meta_kubernetes_pod_container_name"]
+          target_label = "container"
+        }
+
+        rule {
+          source_labels = ["__meta_kubernetes_node_name"]
+          target_label  = "node_name"
+        }
+
+        rule {
+          source_labels = [
+            "__meta_kubernetes_pod_controller_name",
+          ]
+          regex        = "([0-9a-z-.]+?)(-[0-9a-f]{8,10})?"
+          target_label = "controller_name"
+        }
+
+        rule {
+          source_labels = [
+            "__meta_kubernetes_pod_label_app_kubernetes_io_name",
+            "__meta_kubernetes_pod_label_app",
+            "controller_name",
+            "__meta_kubernetes_pod_name",
+          ]
+          regex        = "^;*([^;]+)(;.*)?$"
+          target_label = "app"
+        }
+
+        rule {
+          source_labels = [
+            "__meta_kubernetes_pod_label_app_kubernetes_io_component",
+            "__meta_kubernetes_pod_label_component",
+          ]
+          regex        = "^;*([^;]+)(;.*)?$"
+          target_label = "component"
+        }
+
+        rule {
+          source_labels = ["namespace", "app"]
+          separator     = "/"
+          target_label  = "job"
+        }
+
+        rule {
+          source_labels = ["job", "container"]
+          separator     = ":"
+          target_label  = "instance"
+        }
+        rule {
+          source_labels = ["__meta_kubernetes_pod_node_name"]
+          separator     = ":"
+          target_label  = "host"
+        }
+      }
+
+
+      // ===============================================================================
+      // prometheus / Metrics - Scrape kube_state_metrics
+      // Requirements: 
+      //  - discovery.relabel - kube_state_metrics
+      // ===============================================================================
+      prometheus.scrape "kube_state_metrics" {
+        job_name = "integrations/kubernetes/kube-state-metrics"
+        targets  = discovery.relabel.kube_state_metrics.output
+
+        scheme = "http"
+
+        forward_to = [prometheus.remote_write.prometheus_srv.receiver]
+      }
+
+      discovery.relabel "kube_state_metrics" {
+        targets = discovery.kubernetes.kube_endpoints.targets
+
+        rule {
+          source_labels = ["__meta_kubernetes_service_name"]
+          regex         = "kube-state-metrics"
+          action        = "keep"
+        }
+
+        rule {
+            source_labels = ["__meta_kubernetes_endpoint_node_name"]
+            target_label  = "node"
+        }
+        
+        rule {
+          source_labels = ["__meta_kubernetes_endpoint_node_name"]
+          target_label = "host"
+        }
+
+        rule {
+          source_labels = ["__meta_kubernetes_endpoint_node_name"]
+          target_label = "nodename"
+        }
+
+      }
+
+
+      // ===============================================================================
+      // Scrape Kubernetes pods containers metrics / cAdvisor
+      // Requirements: 
+      //  - discovery.relabel - kube_pods_metrics (cAdviser)
+      // ===============================================================================
+
+      prometheus.scrape "cadvisor" {
+        job_name = "integrations/kubernetes/cadvisor"
+        targets  = discovery.relabel.kube_pods_metrics.output
+        scheme   = "https"
+
+        tls_config {
+          server_name          = "kubernetes"
+          ca_file              = "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt"
+          insecure_skip_verify = true
+        }
+
+        bearer_token_file = "/var/run/secrets/kubernetes.io/serviceaccount/token"
+        forward_to        = [prometheus.remote_write.prometheus_srv.receiver]
+      }
+  
+
+
+
+      // ===========================================================
+      // Discovery:relabel: kube_pods_metrics (cAdviser)
+      // Requirements: 
+      //  - discovery.kubernetes.role.node: kube_nodes
+      // ===========================================================
+
+       discovery.relabel "kube_node_metrics" {
+        targets = discovery.kubernetes.kube_nodes.targets
+        rule {
+          action        = "replace"
+          source_labels = ["__meta_kubernetes_node_name"]
+          regex         = "(.+)"
+          target_label  = "node"
+        }
+
+        rule {
+          source_labels = ["node"]
+          target_label = "host"
+        }
+
+        // rule {
+        //   source_labels = ["host"]
+        //   target_label = "nodename"
+        // }
+
+        rule {
+          replacement  = "/metrics/cadvisor"
+          target_label = "__metrics_path__"
+        }
+      }   
+
+ 
+  extraEnv:
+
+    - name: CLUSTER_NAME
+      value: casa
+    - name: ZONE
+      value: casa-vlan
+
+    - name: LOKI_URL
+      valueFrom:
+        secretKeyRef:
+          name: alloy-global
+          key: loki_url
+
+    - name: PROMETHEUS_URL
+      valueFrom:
+        secretKeyRef:
+          name: alloy-global
+          key: prometheus_url

services/monitoring/deploy/alloy/kube-scraper/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: monitoring
+resources:
+  - helm-release.yaml
+secretGenerator:
+  - name: alloy-kube-scraper-helm-values
+    files:
+      - values.yaml=helm-values.yaml
+generatorOptions:
+  disableNameSuffixHash: true

services/monitoring/deploy/alloy/kustomization.yaml

@@ -0,0 +1,9 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: monitoring
+resources:
+  - global
+  - node-scraper
+  - kube-scraper   
+generatorOptions:
+  disableNameSuffixHash: true

services/monitoring/deploy/alloy/node-scraper/helm-release.yaml

@@ -0,0 +1,24 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: alloy-node-scraper
+spec:
+  releaseName: alloy-node-scraper
+  interval: 1m
+  chart:
+    spec:
+      chart: alloy
+      version: 1.x.x
+      sourceRef:
+        kind: HelmRepository
+        name: grafana
+      interval: 40h
+  valuesFrom:
+    - kind: Secret
+      name: alloy-node-scraper-helm-values
+      valuesKey: values.yaml
+
+
+
+
+

services/monitoring/deploy/alloy/node-scraper/helm-values.yaml

@@ -0,0 +1,231 @@
+controller:
+  nameOverride: "alloy-node-scrapper"
+  volumes:
+    extra:
+      # requires host journal configuration storage = volatile
+      - name: run-log-journal
+        hostPath:
+          path: /run/log/journal
+      # Log scrapers (e.g., Alloy/Loki) read this ID from the journal metadata and use it to separate log streams per machine.
+      - name: etc-machine-id
+        hostPath:
+          path: /etc/machine-id
+      - name: rootfs
+        hostPath:
+          path: /
+      - name: proc
+        hostPath:
+          path: /proc
+      - name: sys
+        hostPath:
+          path: /sys
+      - name: dev
+        hostPath:
+          path: /dev
+
+  tolerations:
+    - key: "node-role.kubernetes.io/control-plane"
+      operator: "Exists"
+      effect: "NoSchedule"
+    - key: "infra.limbosolutions.com/dedicated"
+      operator: "Exists"
+      effect: "NoSchedule"
+
+alloy:
+  mounts:
+    varlog: true  # Mounts /var/log from the host (persistent journal)
+    extra:
+      # requires host journal configuration storage = volatile
+      - name: run-log-journal
+        mountPath: /run/log/journal
+        readOnly: true
+      # required 
+      - name: etc-machine-id
+        mountPath: /etc/machine-id
+        readOnly: true
+      - name: rootfs
+        mountPath: /host
+        readOnly: true
+      - name: proc
+        mountPath: /host/proc
+        readOnly: true
+      - name: sys
+        mountPath: /host/sys
+        readOnly: true
+      - name: dev
+        mountPath: /host/dev
+        readOnly: true 
+  # https://grafana.com/docs/alloy/latest/collect/logs-in-kubernetes/
+  configMap:
+    content: |
+    
+      // ============================================
+      // LOKI WRITE TARGET
+      // ============================================
+      loki.write "loki_srv" {
+        endpoint {
+          url = env("LOKI_URL")
+        }
+      }
+
+      // ============================================
+      // HOST JOURNALD SOURCE
+      // ============================================
+
+      // Read journald logs from the host
+      loki.source.journal "journal" {
+        max_age   = "24h"
+        relabel_rules = discovery.relabel.host_journal.rules
+        forward_to    = [loki.process.host_journal.receiver]
+      }
+
+      // ============================================
+      // HOST JOURNALD RELABELING
+      // ============================================
+
+      // Convert journald metadata into Loki labels
+      discovery.relabel "host_journal" {
+        targets = []
+
+        // Systemd unit name
+        rule {
+          source_labels = ["__journal__systemd_unit"]
+          target_label  = "systemd_unit"
+        }
+
+        // Transport type (stdout, syslog, kernel, audit, etc.)
+        rule {
+          source_labels = ["__journal__transport"]
+          target_label  = "journal_transport"
+        }
+
+        // Priority (info, warning, error)
+        rule {
+          source_labels = ["__journal_priority_keyword"]
+          target_label  = "level"
+        }
+      }
+
+      // ============================================
+      // HOST JOURNALD PROCESSING
+      // ============================================
+
+      // Add static labels and forward journald logs to Loki
+      loki.process "host_journal" {
+        stage.static_labels {
+          values = {
+            cluster = env("CLUSTER_NAME"),
+            host    = env("HOSTNAME"),
+            zone    = env("ZONE"),
+            job     = "journald",
+            service_name = "journald",
+          }
+        }
+
+        forward_to = [loki.write.loki_srv.receiver]
+      }
+
+
+      // ============================================
+      // Metrics: Prometheus connection config
+      // ============================================
+
+      prometheus.remote_write "metrics_service" {
+        endpoint {
+          url = env("PROMETHEUS_URL")
+        }
+        
+        // global labels
+        external_labels = {
+          cluster     = env("CLUSTER_NAME"),
+          zone        = env("ZONE"),
+        }
+      }
+
+
+      // ============================================
+      // Metrics: Prometheus Unix Exporter
+      // ============================================
+
+      prometheus.exporter.unix "node_exporter" {
+        rootfs_path = "/host"
+        disable_collectors = ["ipvs", "btrfs", "infiniband", "xfs", "zfs"]
+        enable_collectors = [
+          "cpu",
+          "meminfo",
+          "vmstat",
+          "loadavg",
+          "filesystem",
+          "netdev",
+          "uname",
+        ]
+
+        filesystem {
+          mount_points_exclude = "^/(dev|proc|sys|run/containerd/.+|var/lib/docker/.+|var/lib/kubelet/.+)($|/)"
+          fs_types_exclude     = "^(autofs|binfmt_misc|bpf|cgroup2?|configfs|debugfs|devpts|devtmpfs|fusectl|hugetlbfs|iso9660|mqueue|nsfs|overlay|proc|procfs|pstore|rpc_pipefs|securityfs|selinuxfs|squashfs|sysfs|tracefs|erofs)$"
+          mount_timeout        = "5s"
+        }
+
+        netclass {
+          ignored_devices = "^(veth.*|cali.*|[a-f0-9]{15})$"
+        }
+
+        netdev {
+          device_exclude = "^(veth.*|cali.*|[a-f0-9]{15})$"
+        }
+      }
+
+      prometheus.scrape "node_exporter" {
+        targets         = prometheus.exporter.unix.node_exporter.targets
+        scrape_interval = "30s"
+
+        forward_to = [prometheus.relabel.node_exporter.receiver]
+      }
+  
+      prometheus.relabel "node_exporter" {
+        forward_to = [prometheus.remote_write.metrics_service.receiver]
+
+        rule {
+          action       = "replace"
+          replacement  = env("HOSTNAME")
+          target_label = "nodename"
+        }
+
+        rule {
+          action       = "replace"
+          replacement  = env("HOSTNAME")
+          target_label = "node"
+        }
+      }
+
+
+
+  extraEnv:
+    - name: NODE_IP
+      valueFrom:
+        fieldRef:
+          fieldPath: status.hostIP
+    - name: CLUSTER_NAME
+      value: casa
+    - name: JOB
+      value: node-exporter
+    - name: CONTAINER
+      value: node-exporter
+    - name: NS
+      value: monitoring
+    - name: POD
+      value: alloy-node-scraper
+    - name: SERVICE
+      value: alloy-node-scraper
+    - name: ZONE
+      value: casa-vlan
+    - name: LOKI_URL
+      valueFrom:
+        secretKeyRef:
+          name: alloy-global
+          key: loki_url
+    - name: PROMETHEUS_URL
+      valueFrom:
+        secretKeyRef:
+          name: alloy-global
+          key: prometheus_url

services/monitoring/deploy/alloy/node-scraper/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: monitoring
+resources:
+  - helm-release.yaml
+secretGenerator:
+  - name: alloy-node-scraper-helm-values
+    files:
+      - values.yaml=helm-values.yaml
+generatorOptions:
+  disableNameSuffixHash: true

services/monitoring/deploy/flux/.env.d/.gitignore

@@ -0,0 +1,2 @@
+**
+!.gitignore

services/monitoring/deploy/flux/flux-kustomization-alloy.yaml

@@ -0,0 +1,16 @@
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: alloy
+spec:
+  interval: 1m
+  sourceRef:
+    kind: GitRepository
+    name: casa
+    namespace: casa-limbosolutions-com
+  path: services/monitoring/deploy/alloy
+  prune: true
+  decryption:
+    provider: sops
+    secretRef:
+      name: flux-sops-age

services/monitoring/deploy/flux/kustomization.yaml

@@ -0,0 +1,11 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: monitoring
+resources:
+ - flux-kustomization-alloy.yaml 
+secretGenerator:
+  - name: flux-sops-age
+    files:
+      - "age.agekey=./.env.d/age.agekey"
+generatorOptions:
+  disableNameSuffixHash: true

services/monitoring/deploy/prometheus/helm-release.yaml

@@ -0,0 +1,15 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: kube-state-metrics
+spec:
+  releaseName: kube-state-metrics
+  interval: 1m
+  chart:
+    spec:
+      chart: kube-state-metrics
+      version: 8.x.x
+      sourceRef:
+        kind: HelmRepository
+        name: prometheus
+      interval: 40h

services/monitoring/deploy/prometheus/helm-repo.yaml

@@ -0,0 +1,7 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: prometheus
+spec:
+  interval: 40h
+  url: https://prometheus-community.github.io/helm-charts

services/monitoring/deploy/prometheus/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: monitoring
+resources:
+ - helm-repo.yaml 
+ - helm-release.yaml

services/myLimbo-casa-gitea-act-runner/docker-compose.yml

@@ -1,140 +0,0 @@
-services:
-  act-runner:
-    container_name: myLimbo-casa-gitea-act-runner
-    image: docker.io/gitea/act_runner:latest
-    restart: always
-    volumes:
-      - myLimbo-casa-gitea-act-runner-data:/data
-      - myLimbo-casa-gitea-act-runner-config:/config
-      - /var/run/docker.sock:/var/run/docker.sock
-
-    environment:
-      - GITEA_INSTANCE_URL=${GITEA_INSTANCE_URL}
-      # When using Docker Secrets, it's also possible to use
-      # GITEA_RUNNER_REGISTRATION_TOKEN_FILE to pass the location.
-      # The env var takes precedence.
-      # Needed only for the first start.
-      - CONFIG_FILE= /config/config.yaml
-      - GITEA_RUNNER_REGISTRATION_TOKEN=${GITEA_RUNNER_REGISTRATION_TOKEN}
-      - GITEA_RUNNER_NAME=myLimbo-casa-gitea-act-runner
-      #- GITEA_RUNNER_CONFIG_FILE="/config/config.yaml"
-
-
-    configs:
-        - source: act-runner-config
-          target: /config/config.yaml
-          mode: 0444
-
-volumes:
-  myLimbo-casa-gitea-act-runner-data:
-    name: myLimbo-casa-gitea-act-runner-data  
-  myLimbo-casa-gitea-act-runner-config:
-    name: myLimbo-casa-gitea-act-runner-config
-
-
-configs:
-  act-runner-config:
-    content: |
-      # Example configuration file, it's safe to copy this as the default config file without any modification.
-
-      # You don't have to copy this file to your instance,
-      # just run `./act_runner generate-config > config.yaml` to generate a config file.
-
-      log:
-        # The level of logging, can be trace, debug, info, warn, error, fatal
-        level: info
-
-      runner:
-        # Where to store the registration result.
-        file: .runner
-        # Execute how many tasks concurrently at the same time.
-        capacity: 1
-        # Extra environment variables to run jobs.
-        envs:
-          A_TEST_ENV_NAME_1: a_test_env_value_1
-          A_TEST_ENV_NAME_2: a_test_env_value_2
-        # Extra environment variables to run jobs from a file.
-        # It will be ignored if it's empty or the file doesn't exist.
-        env_file: .env
-        # The timeout for a job to be finished.
-        # Please note that the Gitea instance also has a timeout (3h by default) for the job.
-        # So the job could be stopped by the Gitea instance if it's timeout is shorter than this.
-        timeout: 3h
-        # The timeout for the runner to wait for running jobs to finish when shutting down.
-        # Any running jobs that haven't finished after this timeout will be cancelled.
-        shutdown_timeout: 0s
-        # Whether skip verifying the TLS certificate of the Gitea instance.
-        insecure: false
-        # The timeout for fetching the job from the Gitea instance.
-        fetch_timeout: 5s
-        # The interval for fetching the job from the Gitea instance.
-        fetch_interval: 2s
-        # The labels of a runner are used to determine which jobs the runner can run, and how to run them.
-        # Like: "macos-arm64:host" or "ubuntu-latest:docker://gitea/runner-images:ubuntu-latest"
-        # Find more images provided by Gitea at https://gitea.com/gitea/runner-images .
-        # If it's empty when registering, it will ask for inputting labels.
-        # If it's empty when execute `daemon`, will use labels in `.runner` file.
-        labels:
-          - "myLimbo-casa-gitea-act-runner:docker://gitea/runner-images:ubuntu-latest"
-          #- "ubuntu-latest:docker://gitea/runner-images:ubuntu-latest"
-          #- "ubuntu-22.04:docker://gitea/runner-images:ubuntu-22.04"
-          #- "ubuntu-20.04:docker://gitea/runner-images:ubuntu-20.04"
-
-      cache:
-        # Enable cache server to use actions/cache.
-        enabled: true
-        # The directory to store the cache data.
-        # If it's empty, the cache data will be stored in $HOME/.cache/actcache.
-        dir: ""
-        # The host of the cache server.
-        # It's not for the address to listen, but the address to connect from job containers.
-        # So 0.0.0.0 is a bad choice, leave it empty to detect automatically.
-        host: ""
-        # The port of the cache server.
-        # 0 means to use a random available port.
-        port: 0
-        # The external cache server URL. Valid only when enable is true.
-        # If it's specified, act_runner will use this URL as the ACTIONS_CACHE_URL rather than start a server by itself.
-        # The URL should generally end with "/".
-        external_server: ""
-
-      container:
-        # Specifies the network to which the container will connect.
-        # Could be host, bridge or the name of a custom network.
-        # If it's empty, act_runner will create a network automatically.
-        network: ""
-        # Whether to use privileged mode or not when launching task containers (privileged mode is required for Docker-in-Docker).
-        privileged: false
-        # And other options to be used when the container is started (eg, --add-host=my.gitea.url:host-gateway).
-        options:
-        # The parent directory of a job's working directory.
-        # NOTE: There is no need to add the first '/' of the path as act_runner will add it automatically. 
-        # If the path starts with '/', the '/' will be trimmed.
-        # For example, if the parent directory is /path/to/my/dir, workdir_parent should be path/to/my/dir
-        # If it's empty, /workspace will be used.
-        workdir_parent:
-        # Volumes (including bind mounts) can be mounted to containers. Glob syntax is supported, see https://github.com/gobwas/glob
-        # You can specify multiple volumes. If the sequence is empty, no volumes can be mounted.
-        # For example, if you only allow containers to mount the `data` volume and all the json files in `/src`, you should change the config to:
-        # valid_volumes:
-        #   - data
-        #   - /src/*.json
-        # If you want to allow any volume, please use the following configuration:
-        # valid_volumes:
-        #   - '**'
-        valid_volumes: []
-        # overrides the docker client host with the specified one.
-        # If it's empty, act_runner will find an available docker host automatically.
-        # If it's "-", act_runner will find an available docker host automatically, but the docker host won't be mounted to the job containers and service containers.
-        # If it's not empty or "-", the specified docker host will be used. An error will be returned if it doesn't work.
-        docker_host: ""
-        # Pull docker image(s) even if already present
-        force_pull: true
-        # Rebuild docker image(s) even if already present
-        force_rebuild: false
-
-      host:
-        # The parent directory of a job's working directory.
-        # If it's empty, $HOME/.cache/act/ will be used.
-        workdir_parent:
-

services/nginx/docker-compose.yaml

@@ -1,41 +0,0 @@
-configs:
-  run-sh:
-    content: |
-      #!/bin/sh
-      # patch security so kubctl on sync-certs-job can write to the mounted volume
-      chown -R 1001:1001 /etc/ssl/certs/casa-limbosolutions-com-certs
-      while :; do sleep 6h & wait $${!}; nginx -s reload; done & nginx -g "daemon off;"
-
-services:
-  nginx:
-    build:
-      context: ./docker
-    pull_policy: build
-    image: homesrv/nginx:latest
-    volumes:
-      - casa-limbosolutions-com-certs:/etc/ssl/certs/casa-limbosolutions-com-certs
-    ports:
-      - 443:443
-      - 80:80
-    networks:
-      - public
-    restart: unless-stopped
-    command: /bin/sh -c '/run.sh'
-    configs:
-      - source: run-sh
-        target: /run.sh
-        mode: 0755
-volumes:
-  nginx-conf.d:
-
-  casa-limbosolutions-com-certs:
-    name: casa-limbosolutions-com-certs
-    external: false     
-
-networks:
-  public:
-    name: reverseproxy_public
-    external: true
-
-
-    

services/nginx/docker/Dockerfile

@@ -1,4 +0,0 @@
-FROM nginx:latest
-
-COPY nginx.conf.d/* /etc/nginx/conf.d
-

services/nginx/docker/nginx.conf.d/has.conf

@@ -1,35 +0,0 @@
-map $http_upgrade $connection_upgrade {
-    default upgrade;
-    ''      close;
-}
-
-server {
-    listen 80;
-    server_name casa.limbosolutions.com *.casa.limbosolutions.com has.lan;
-    return 301 https://has.casa.limbosolutions.com$request_uri;
-}
-
-
-server {
-
-    listen 443 ssl;
-    ssl_certificate /etc/ssl/certs/casa-limbosolutions-com-certs/casa-limbosolutions-com-tls_tls.crt;
-    ssl_certificate_key /etc/ssl/certs/casa-limbosolutions-com-certs/casa-limbosolutions-com-tls_tls.key;
-    ssl_protocols TLSv1.2 TLSv1.3;
-    ssl_ciphers HIGH:!aNULL:!MD5;
-
-    location / {
-        proxy_pass http://homeassistant-app:80;
-        proxy_set_header Host $host;
-        proxy_http_version 1.1;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection $connection_upgrade;
-    }
-
-}
-
-
-
-
-

services/nginx/docker/nginx.conf.d/lms.lan.conf

@@ -1,32 +0,0 @@
-server {
-    server_name lms.casa.limbosolutions.com music.casa.limbosolutions.com;
-    listen 443 ssl;
-    ssl_certificate /etc/ssl/certs/casa-limbosolutions-com-certs/casa-limbosolutions-com-tls_tls.crt;
-    ssl_certificate_key /etc/ssl/certs/casa-limbosolutions-com-certs/casa-limbosolutions-com-tls_tls.key;
-    ssl_protocols TLSv1.2 TLSv1.3;
-    ssl_ciphers HIGH:!aNULL:!MD5;
-
-    location / {
-        set $upstream lms-lms-1;
-        #docker default resolver
-        resolver 127.0.0.11 ipv6=off;
-        proxy_pass http://$upstream:9002;
-        proxy_set_header Host $http_host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header X-Forwarded-Protocol $scheme;
-        proxy_set_header X-Url-Scheme $scheme;
-
-        # WebSocket support
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-    }
-}
-
-server {
-    listen 80;
-    server_name lms.casa.limbosolutions.com music.casa.limbosolutions.com lms.lan music.lan;
-    return 301 https://lms.casa.limbosolutions.com$request_uri;
-}

services/nginx/docker/nginx.conf.d/zigbee2mqtt.lan.conf

@@ -1,22 +0,0 @@
-server {
-    listen 80;
-    proxy_buffering off;
-    server_name zigbee2mqtt.lan;
-
-    location / {
-        proxy_pass http://zigbee2mqtt:8080/;
-        proxy_set_header Host $http_host;
-        proxy_set_header X-Real-IP $remote_addr;
-        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-        proxy_set_header X-Forwarded-Proto $scheme;
-        proxy_set_header X-Forwarded-Protocol $scheme;
-        proxy_set_header X-Url-Scheme $scheme;
-
-        # WebSocket support
-        proxy_http_version 1.1;
-        proxy_set_header Upgrade $http_upgrade;
-        proxy_set_header Connection "upgrade";
-    }
-}
-
-   

services/node-red/.sops.yaml

@@ -0,0 +1,11 @@
+creation_rules:
+  # encrypt all values from file
+  - path_regex: \.private\.dec\.yaml$
+    encrypted_regex: '^(.*)$'
+    age:
+      - age1f9e4pvp5y8gzuk8mz2s5xm85dd7znxhk56tcpuxqwn78qfjwja0qekwlju
+  # encrypt secrets files
+  - path_regex: .*.yaml
+    encrypted_regex: ^(data|stringData)$
+    age: 
+      - age1f9e4pvp5y8gzuk8mz2s5xm85dd7znxhk56tcpuxqwn78qfjwja0qekwlju

services/node-red/README.md

@@ -0,0 +1,21 @@
+# node-red
+
+``` bash
+#npm install bcryptjs
+node -e "console.log(require('bcryptjs').hashSync(process.argv[1], 8));" YOUR-PASSWORD
+```
+
+## Setup
+
+Using flux for reconciliation.
+
+``` bash
+./ops-scripts/apply-flux.sh
+```
+
+**Encrypt secrets:**
+
+``` bash
+sops -e deploy/app/limbomox-ssh-secret.dec.yaml > deploy/app/limbomox-ssh-secret.yaml
+sops -e deploy/app/node-red-settings-secret.dec.yaml > deploy/app/node-red-settings-secret.yaml
+```

services/node-red/deploy/app/deployment.yaml

@@ -0,0 +1,49 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: node-red
+  namespace: node-red
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: node-red
+  template:
+    metadata:
+      labels:
+        app: node-red
+    spec:
+      containers:
+      - name: node-red
+        ### Maintained by flux - Image Update Automation
+        image: nodered/node-red:latest@sha256:02a2b92a41b73d2bc388238b86e4fcaab7fb5466373adb24e1df6aa5845265ff # {"$imagepolicy": "node-red:node-red"}
+        ###
+        imagePullPolicy: Always
+        ports:
+        - containerPort: 1880
+        volumeMounts:
+        - name: node-red-data
+          mountPath: /data
+        - name: node-red-settings
+          mountPath: /data/settings.js
+          subPath: settings.js
+        - name: limbomox-ssh
+          mountPath: /.keys/limbomox-ssh-node-red/id_ed25519
+          subPath: id-ed25519
+        resources:
+          requests:
+            memory: "128Mi"
+            cpu: "100m"
+          limits:
+            memory: "256Mi"
+            cpu: "500m"
+      volumes:
+      - name: node-red-data
+        persistentVolumeClaim:
+          claimName: node-red
+      - name: node-red-settings
+        secret:
+          secretName: node-red-settings
+      - name: limbomox-ssh
+        secret:
+          secretName: limbomox-ssh

services/node-red/deploy/app/image-policy.yaml

@@ -0,0 +1,13 @@
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImagePolicy
+metadata:
+  name: node-red
+spec:
+  imageRepositoryRef:
+    name: node-red
+  filterTags:
+    pattern: '^latest$'
+  policy:
+    alphabetical: {}
+  digestReflectionPolicy: Always
+  interval: 24h

services/node-red/deploy/app/image-repo.yaml

@@ -0,0 +1,7 @@
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImageRepository
+metadata:
+  name: node-red
+spec:
+  image: nodered/node-red
+  interval: 72h

services/node-red/deploy/app/image-update-automation.yaml

@@ -0,0 +1,25 @@
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImageUpdateAutomation
+metadata:
+  name: node-red
+spec:
+  interval: 72h
+  sourceRef:
+    kind: GitRepository
+    name: casa
+    namespace: casa-limbosolutions-com
+  git:
+    checkout:
+      ref:
+        branch: main
+    commit:
+      author:
+        name: FluxCD
+        email: flux@local
+      messageTemplate: |
+        Update node-red image.
+    push:
+      branch: main
+  update:
+    path: ./services/node-red/deploy/app/deployment.yaml
+    strategy: Setters