docs: immich ML v2 is done (#39 )

2026-11-15 14:29:09 +01:00 · 2026-10-26 23:06:15 +01:00
51 changed files with 39 additions and 1277 deletions
@@ -18,7 +18,7 @@ concurrency:
 jobs:
  validate:
-    runs-on: ubuntu-26.04
+    runs-on: ubuntu-24.04
    timeout-minutes: 20
    steps:
      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -12,7 +12,7 @@ spec:
  project: default
  source:
    repoURL: https://community-charts.github.io/helm-charts
-    targetRevision: 1.9.5
+    targetRevision: 1.8.9
    chart: actualbudget
    helm:
      values: |
@@ -55,29 +55,3 @@ spec:
              - 169.254.0.0/16
              - 172.16.0.0/12
              - 192.168.0.0/16
 ---
 # cert-manager's HTTP-01 solver, which runs only while a certificate
 # renews: Let's Encrypt and cert-manager's own self check reach it on 8089
 # through Envoy. The policies above let Envoy reach the app's port only,
 # which left the solver unreachable (found 2026-10-26, when ynab's renewal
 # hung).
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
  name: acme-http01-solver
 spec:
  podSelector:
    matchLabels:
      acme.cert-manager.io/http01-solver: "true"
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: envoy-gateway-system
          podSelector:
            matchLabels:
              app.kubernetes.io/name: envoy
      ports:
        - port: 8089
@@ -103,8 +103,6 @@ spec:
              requests:
                cpu: 70m
                memory: 560Mi
              limits:
                memory: 1536Mi
            volumes:
              - name: patched-ca-bundle
                configMap:
@@ -194,8 +192,6 @@ spec:
              requests:
                cpu: 100m
                memory: 336Mi
              limits:
                memory: 1Gi
            volumes:
              - name: patched-ca-bundle
                configMap:
@@ -38,22 +38,16 @@ spec:
          requests:
            cpu: 10m
            memory: 48Mi
          limits:
            memory: 128Mi
        cainjector:
          resources:
            requests:
              cpu: 10m
              memory: 80Mi
            limits:
              memory: 256Mi
        webhook:
          resources:
            requests:
              cpu: 10m
              memory: 32Mi
            limits:
              memory: 128Mi
  syncPolicy:
    syncOptions:
    - CreateNamespace=true
@@ -1,19 +0,0 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
  name: cloudnative-pg-folder
  namespace: argocd
  finalizers:
  - resources-finalizer.argocd.argoproj.io
 spec:
  project: default
  source:
    repoURL: https://github.com/rubenhensen/k8scd.git
    targetRevision: HEAD
    path: cloudnative-pg
  destination:
    server: https://kubernetes.default.svc
    namespace: cnpg-system
  syncPolicy:
    automated:
      selfHeal: true
@@ -28,8 +28,6 @@ spec:
          requests:
            cpu: 10m
            memory: 48Mi
          limits:
            memory: 128Mi
  destination:
    server: https://kubernetes.default.svc
    namespace: cnpg-system
@@ -1,19 +0,0 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
  name: default-folder
  namespace: argocd
  finalizers:
  - resources-finalizer.argocd.argoproj.io
 spec:
  project: default
  source:
    repoURL: https://github.com/rubenhensen/k8scd.git
    targetRevision: HEAD
    path: default
  destination:
    server: https://kubernetes.default.svc
    namespace: default
  syncPolicy:
    automated:
      selfHeal: true
@@ -12,7 +12,7 @@ spec:
    repoURL: docker.io/envoyproxy
    chart: gateway-helm
    # v1.9 supports Kubernetes 1.33 to 1.36
-    targetRevision: 1.9.3
+    targetRevision: v1.9.2
    helm:
      values: |
        config:
@@ -1,19 +0,0 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
  name: external-secrets-folder
  namespace: argocd
  finalizers:
  - resources-finalizer.argocd.argoproj.io
 spec:
  project: default
  source:
    repoURL: https://github.com/rubenhensen/k8scd.git
    targetRevision: HEAD
    path: external-secrets
  destination:
    server: https://kubernetes.default.svc
    namespace: external-secrets
  syncPolicy:
    automated:
      selfHeal: true
@@ -24,22 +24,16 @@ spec:
            requests:
              cpu: 20m
              memory: 64Mi
            limits:
              memory: 128Mi
          certController:
            resources:
              requests:
                cpu: 10m
                memory: 64Mi
              limits:
                memory: 128Mi
          webhook:
            resources:
              requests:
                cpu: 10m
                memory: 32Mi
              limits:
                memory: 128Mi
  destination:
    server: https://kubernetes.default.svc
    namespace: external-secrets
@@ -1,34 +0,0 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
  name: plugin-barman-cloud
  namespace: argocd
  finalizers:
  - resources-finalizer.argocd.argoproj.io
 spec:
  project: default
  source:
    chart: plugin-barman-cloud
    repoURL: https://cloudnative-pg.github.io/charts
    targetRevision: 0.8.1
    helm:
      values: |
        # CNPG's barman cloud plugin, which backs the PostgreSQL clusters
        # up to Garage on the NAS (authentik/postgresql-backup.yaml,
        # immich/postgresql-backup.yaml). It has to run in the operator's
        # namespace; the chart gets its TLS certificates from cert-manager.
        resources:
          requests:
            cpu: 10m
            memory: 64Mi
          limits:
            memory: 128Mi
  destination:
    server: https://kubernetes.default.svc
    namespace: cnpg-system
  syncPolicy:
    syncOptions:
    - ServerSideApply=true
    automated:
      prune: true
      selfHeal: true
@@ -1,6 +1,6 @@
 # Requests from what the components used on 2026-10-25 (kubectl top every
-# 5 minutes; highest value plus 10%). Memory limits at about twice the
+# 5 minutes; highest value plus 10%). No limits until there are daytime
-# highest value seen then or on 2026-10-27, rounded up; no CPU limits.
+# numbers, see docs/roadmap.md.
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
@@ -14,8 +14,6 @@ spec:
            requests:
              cpu: 150m
              memory: 704Mi
            limits:
              memory: 2560Mi
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -30,8 +28,6 @@ spec:
            requests:
              cpu: 100m
              memory: 128Mi
            limits:
              memory: 512Mi
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -46,8 +42,6 @@ spec:
            requests:
              cpu: 10m
              memory: 64Mi
            limits:
              memory: 256Mi
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -62,8 +56,6 @@ spec:
            requests:
              cpu: 20m
              memory: 96Mi
            limits:
              memory: 256Mi
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -78,8 +70,6 @@ spec:
            requests:
              cpu: 10m
              memory: 48Mi
            limits:
              memory: 128Mi
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -94,8 +84,6 @@ spec:
            requests:
              cpu: 10m
              memory: 48Mi
            limits:
              memory: 128Mi
 ---
 apiVersion: apps/v1
 kind: Deployment
@@ -110,5 +98,3 @@ spec:
            requests:
              cpu: 10m
              memory: 32Mi
            limits:
              memory: 128Mi
@@ -108,8 +108,7 @@ spec:
 ---
 # The CNPG operator checks each instance on its status port and connects to
 # PostgreSQL; the instance manager inside each pod watches its Cluster
-# through the API server. The barman cloud sidecar sends the WAL and the
+# through the API server.
 # base backups to Garage on the NAS (postgresql-backup.yaml).
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
@@ -136,34 +135,3 @@ spec:
            cidr: 192.168.1.204/32
      ports:
        - port: 16443
    - to:
        - ipBlock:
            cidr: 192.168.1.99/32
      ports:
        - port: 3900
 ---
 # cert-manager's HTTP-01 solver, which runs only while a certificate
 # renews: Let's Encrypt and cert-manager's own self check reach it on 8089
 # through Envoy. The policies above let Envoy reach the app's port only,
 # which left the solver unreachable (found 2026-10-26, when ynab's renewal
 # hung).
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
  name: acme-http01-solver
 spec:
  podSelector:
    matchLabels:
      acme.cert-manager.io/http01-solver: "true"
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: envoy-gateway-system
          podSelector:
            matchLabels:
              app.kubernetes.io/name: envoy
      ports:
        - port: 8089
@@ -1,94 +0,0 @@
 # Backups of authentik's database by CNPG itself, through the barman cloud
 # plugin (apps/templates/plugin-barman-cloud-helm.yaml): a base backup every
 # night, and every WAL segment as soon as it is full or 5 minutes old
 # (archive_timeout). Both go to the bucket cnpg-authentik in Garage on the
 # NAS (nas/garage), so the database can be restored to any moment of the
 # last 30 days. Velero copies the data directory while PostgreSQL runs,
 # which is not a consistent copy.
 # The key is Garage's cnpg-authentik, in Vault as kv/cnpg-authentik-s3; it
 # can only reach this bucket.
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: authentik-postgres-s3
 spec:
  secretStoreRef:
    name: vault-backend
    kind: ClusterSecretStore
  refreshInterval: 15m
  target:
    name: authentik-postgres-s3
    creationPolicy: Owner
    template:
      engineVersion: v2
      data:
        ACCESS_KEY_ID: "{{ .access_key_id }}"
        ACCESS_SECRET_KEY: "{{ .secret_access_key }}"
        # Garage rejects requests signed for another region
        REGION: garage
  data:
    - secretKey: access_key_id
      remoteRef:
        key: kv/cnpg-authentik-s3
        property: access_key_id
    - secretKey: secret_access_key
      remoteRef:
        key: kv/cnpg-authentik-s3
        property: secret_access_key
 ---
 apiVersion: barmancloud.cnpg.io/v1
 kind: ObjectStore
 metadata:
  name: authentik-postgres
  annotations:
    # The CRD comes with the plugin's own app
    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
 spec:
  retentionPolicy: 30d
  configuration:
    destinationPath: s3://cnpg-authentik/
    endpointURL: http://192.168.1.99:3900
    s3Credentials:
      accessKeyId:
        name: authentik-postgres-s3
        key: ACCESS_KEY_ID
      secretAccessKey:
        name: authentik-postgres-s3
        key: ACCESS_SECRET_KEY
      region:
        name: authentik-postgres-s3
        key: REGION
    wal:
      compression: gzip
    data:
      compression: gzip
  instanceSidecarConfiguration:
    resources:
      requests:
        cpu: 10m
        memory: 64Mi
      limits:
        memory: 512Mi
    env:
      # Newer boto3 adds checksums that S3-compatible stores can reject;
      # the plugin's docs suggest sending them only when required.
      - name: AWS_REQUEST_CHECKSUM_CALCULATION
        value: when_required
      - name: AWS_RESPONSE_CHECKSUM_VALIDATION
        value: when_required
 ---
 apiVersion: postgresql.cnpg.io/v1
 kind: ScheduledBackup
 metadata:
  name: authentik-postgres-daily
 spec:
  cluster:
    name: authentik-postgres
  # 03:00 UTC, after Longhorn's and Velero's backups; immediate: one right
  # away, so WAL archiving has a base backup to start from.
  schedule: "0 0 3 * * *"
  immediate: true
  backupOwnerReference: self
  method: plugin
  pluginConfiguration:
    name: barman-cloud.cloudnative-pg.io
@@ -6,20 +6,12 @@ spec:
  instances: 1
  # Pinned so a new operator default (PostgreSQL 18 since CNPG 1.26.3) can't
  # start an in-place major upgrade. CNPG filled this in at creation.
-  imageName: ghcr.io/cloudnative-pg/postgresql:17.11
+  imageName: ghcr.io/cloudnative-pg/postgresql:17.4
  primaryUpdateStrategy: unsupervised
  # WAL archiving and base backups to Garage, see postgresql-backup.yaml
  plugins:
    - name: barman-cloud.cloudnative-pg.io
      isWALArchiver: true
      parameters:
        barmanObjectName: authentik-postgres
  resources:
    requests:
      cpu: 50m
      memory: 256Mi
    limits:
      memory: 1Gi
  bootstrap:
    initdb:
      database: authentik
@@ -54,29 +54,3 @@ spec:
              - 169.254.0.0/16
              - 172.16.0.0/12
              - 192.168.0.0/16
 ---
 # cert-manager's HTTP-01 solver, which runs only while a certificate
 # renews: Let's Encrypt and cert-manager's own self check reach it on 8089
 # through Envoy. The policies above let Envoy reach the app's port only,
 # which left the solver unreachable (found 2026-10-26, when ynab's renewal
 # hung).
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
  name: acme-http01-solver
 spec:
  podSelector:
    matchLabels:
      acme.cert-manager.io/http01-solver: "true"
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: envoy-gateway-system
          podSelector:
            matchLabels:
              app.kubernetes.io/name: envoy
      ports:
        - port: 8089
@@ -1,73 +0,0 @@
 # cert-manager's three pods reach each other, DNS and the API server (the
 # node, port 16443), and take connections only from each other and the
 # node: the API server calls the webhook from there and the kubelet probes
 # come from there too (10.1.7.64 is the node's Calico VXLAN address,
 # projectcalico.org/IPv4VXLANTunnelAddr). Nothing scrapes the metrics on
 # 9402. The HTTP-01 solver pods run in each Certificate's own namespace
 # (acme-http01-solver in <namespace>/networkpolicy.yaml), not here.
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
  name: default
 spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - podSelector: {}
    - from:
        - ipBlock:
            cidr: 192.168.1.204/32
        - ipBlock:
            cidr: 10.1.7.64/32
  egress:
    - to:
        - podSelector: {}
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53
    - to:
        - ipBlock:
            cidr: 192.168.1.204/32
      ports:
        - port: 16443
 ---
 # The controller talks to Let's Encrypt (443), and before it lets Let's
 # Encrypt check a challenge it fetches http://<host>/.well-known/... itself
 # (80). Every certificate's host has a public address, node001's or the
 # home router's (checked 2026-10-26), so the LAN stays out.
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
  name: controller-to-internet
 spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: cert-manager
      app.kubernetes.io/component: controller
  policyTypes:
    - Egress
  egress:
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
              - 10.0.0.0/8
              - 100.64.0.0/10
              - 169.254.0.0/16
              - 172.16.0.0/12
              - 192.168.0.0/16
      ports:
        - port: 80
        - port: 443
@@ -1,56 +0,0 @@
 # The CloudNativePG operator reaches DNS, the API server (the node, port
 # 16443) and the PostgreSQL instances it runs in other namespaces: the
 # instance manager's status port (8000) and PostgreSQL (5432), which the
 # instances' own policies let in (postgres-cnpg in authentik and immich).
 # Besides its own namespace it takes connections only from the node: the
 # API server calls its webhook (9443) from there and the kubelet probes
 # come from there too (10.1.7.64 is the node's Calico VXLAN address,
 # projectcalico.org/IPv4VXLANTunnelAddr). The chart's Application
 # (apps/templates/cloudnativepg-helm.yaml) only installs the chart, so
 # this folder gets an Application of its own, cloudnative-pg-folder.
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
  name: default
 spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - podSelector: {}
    - from:
        - ipBlock:
            cidr: 192.168.1.204/32
        - ipBlock:
            cidr: 10.1.7.64/32
  egress:
    - to:
        - podSelector: {}
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53
    - to:
        - ipBlock:
            cidr: 192.168.1.204/32
      ports:
        - port: 16443
    - to:
        - namespaceSelector: {}
          podSelector:
            matchExpressions:
              - key: cnpg.io/cluster
                operator: Exists
      ports:
        - port: 8000
        - port: 5432
@@ -1,14 +0,0 @@
 # Nothing runs in default (2026-10-26: only the kubernetes Service, whose
 # endpoint is the API server on the node, which this doesn't touch). A pod
 # started here, by `kubectl run` or a manifest without a namespace, gets
 # no network at all, instead of reaching the LAN, Vault and every app.
 # Anything that needs a network gets a namespace and a policy of its own.
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
  name: default-deny
 spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
@@ -13,7 +13,7 @@ spec:
      restartPolicy: Never
      containers:
        - name: sync
-          image: python:3.15-alpine
+          image: python:3.12-alpine
          command:
            - sh
            - -c
@@ -7,7 +7,6 @@ resources:
  - external-secret.yaml
  - rbac.yaml
  - cronjob.yaml
  - networkpolicy.yaml
 configMapGenerator:
  - name: dns-sync-script
@@ -1,37 +0,0 @@
 # The only pod here is the dns-sync Job (a PostSync hook): it installs its
 # Python packages from PyPI and pushes domains/ to TransIP's API, so it
 # reaches DNS and the internet (not the LAN, the API server or other
 # namespaces). Nothing connects to it.
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
  name: default
 spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
              - 10.0.0.0/8
              - 100.64.0.0/10
              - 169.254.0.0/16
              - 172.16.0.0/12
              - 192.168.0.0/16
      ports:
        - port: 443
@@ -38,8 +38,8 @@ docs/longhorn-second-ssd.md:
  2026-10-25). The snap is held, so microk8s gets no updates at all until
  someone refreshes it
 - [ ] Second SSD, docs/longhorn-second-ssd.md
- [x] `MACHINE_LEARNING_MODEL_REVISION=v2` for immich ML (PR #39,
+- [x] `MACHINE_LEARNING_MODEL_REVISION=v2` for immich ML (PR #39, 2026-10-25;
-  2026-10-25; the models are cached on a volume)
+  the models are cached on a volume)
 ## Next, in order
@@ -83,9 +83,7 @@ friend.
  certificate; the admin API stays on the LAN. The cluster side (DNS,
  node001 tunnel, Certificate, HTTPRoute) goes in git. Needed: how much
  space he wants, free space on the NAS
- [x] Which copy of the immich library goes off-site: Velero's, with the
+- [ ] Decide which copy of the immich library goes off-site (see 5)
  rest of the bucket (decided 2026-10-26). It is most of the ~190 GB, so
  ask him for room for it
 - [ ] A restore test that runs on a schedule. `backup-testing/` predates
  Envoy Gateway and still rewrites `*.hensen.io` and bypasses sol-auth.
  Planned on 2026-10-25, not run: a second Velero on the real bucket is
@@ -205,22 +203,9 @@ Findings from 2026-10-25:
  maintenance job pods) was fixed that afternoon by
  `velero/skip-emptydir-policy.yaml`.
- [x] Whether the immich library stays in Velero: it stays, since
+- [ ] Whether the immich library stays in Velero. It stays for now
-  Velero's bucket is what goes off-site (2; decided 2026-10-26)
+  (2026-10-25); decide again with the off-site copy (2)
- [x] CNPG backups through the barman cloud plugin (PR #56, merged
+- [ ] CNPG backups through the barman cloud plugin
  2026-10-26 22:43 UTC): authentik's and immich's PostgreSQL 17 back up
  to their own bucket in Garage (`cnpg-authentik`, `cnpg-immich`), a base
  backup at 03:00 UTC and the WAL every 5 minutes, kept 30 days. Adding
  the sidecar restarted both instances; authentik was down from 22:44 to
  22:48, since the old pod waited for its connections to close. The first
  base backups: 46 MB in 29 s and 776 MB in 3.5 minutes. immich's
  `immediate` backup ran before the plugin was up and failed; a manual one
  (`immich-postgres-17-first`) went through
 - [ ] Restore one of them into a new Cluster (`bootstrap.recovery` from
  the ObjectStore, to a point in time) to see that it works. After that,
  decide whether Velero still needs to copy the CNPG data directories
 - [ ] Take `cnpg-authentik` and `cnpg-immich` along in the off-site copy
  (2)
 - [x] Velero's target, MinIO on the NAS, is no longer maintained: no
  community images since October 2025, maintenance mode since December
  2025, and the repository is archived. Since 2026-10-26 Velero backs up
@@ -314,23 +299,10 @@ Counted 2026-10-25 over the 73 running containers:
  OIDC logins of Vault and FreshRSS reach authentik, all 24
  ExternalSecrets refresh, raft intact; Gitea no longer reaches the NAS
  or Vault, and a pod in `default` no longer reaches Vault or Gitea
- [ ] Certificates couldn't renew in those 11 namespaces: Envoy may only
+- [ ] The infrastructure namespaces (cert-manager, cnpg-system,
  reach each app's own port, and cert-manager's HTTP-01 solver listens on
  8089. ynab's renewal hung from 2026-10-26 17:35 UTC; a policy for the
  solver pods, applied by hand in actual-budget that evening, let it
  through within 20 seconds (now valid until 2027-01-24). PR #51 adds it
  to all 11. Without it the next renewals hang too: gitea on 11-15,
  bolletjestrui on 11-18, the rest from 12-03
 - [x] The infrastructure namespaces (cert-manager, cnpg-system,
  external-secrets, envoy-gateway-system, velero, mariadb-system, dns,
-  default), merged 2026-10-26: PR #54 for envoy-gateway-system (22:31
+  default) still have none; `default` can reach the LAN and everything
-  UTC), PR #53 for the rest (22:42 UTC; one commit per namespace, and
+  without a policy
  `default` denies everything). Checked afterwards: all 16 public hosts
  answer as before; server-side dry runs reach the CNPG, ESO,
  cert-manager and MariaDB webhooks (all fail closed); Velero's location
  Available, every ExternalSecret synced, the dns-sync job ran, no errors
  from the operators after the barman plugin had started. Velero's policy
  only lets it reach Garage, not MinIO's port 9000
 - [x] Requests: PR #33, merged 2026-10-25 11:23 UTC, for everything that
  had none except the Vault server, from `kubectl top` every 5 minutes
  from 03:13 to 08:40 UTC (highest memory plus 10%, CPU at p95, 10m
@@ -341,13 +313,8 @@ Counted 2026-10-25 over the 73 running containers:
  requested. Still without requests: Longhorn (22 containers, its chart),
  the Vault servers, the LDAP outpost, immich's PG14 cluster and three in
  kube-system
- [x] Memory limits: PR #58, for everything that got requests in #33.
+- [ ] Memory limits, once there are daytime numbers: the night ones miss
-  About twice the highest memory from `kubectl top` every 5 minutes from
+  immich's machine learning at work (it idles at 234Mi)
  2026-10-26 22:29 to 2026-10-27 21:55 UTC or the night of #33, rounded
  up; no CPU limits. No OOM kills that day. immich's machine learning
  sat idle all day (240Mi), so on 2026-10-28 a test image went through
  CLIP, face recognition and OCR inside the container: 884Mi with all
  three loaded, limit 2Gi
 - [x] WordPress (scoutingmbg.nl) was OOMKilled at 08:27:59 UTC on
  2026-10-25, its third restart: a crawler asked for 88 pages and assets
  within a few seconds (normally ~6 a minute), Apache started a PHP worker
@@ -368,14 +335,10 @@ Counted 2026-10-25 over the 73 running containers:
  `litespeed-cache` only caches pages on a LiteSpeed server, so it does
  little here, `wordpress-importer` is usually for a one-off import, and
  `code-snippets` runs PHP from the dashboard
- [ ] Rate limiting per visitor in Envoy, on hold. Since PR #50
+- [ ] Rate limiting per visitor in Envoy needs the client's address, which
-  (2026-10-26) node001 passes the visitor's address on with the PROXY
+  node001 loses: it passes TLS through, so every request arrives from
-  protocol, and the apps see it: authentik logs it, Apache logs it for
+  46.224.26.65. That needs the PROXY protocol from node001's nginx to Envoy
-  WordPress, so Wordfence's lockout after 20 failed logins now hits one
+  (ClientTrafficPolicy `enableProxyProtocol`)
  visitor instead of everyone. Envoy Gateway's local rate limit can't
  count per address (no `Distinct`); that takes its global rate limit,
  with a Redis and a ratelimit service next to it. Not worth two more
  components on the one node while the apps' own limits work
 - [x] Probes for gitea (`/api/healthz`), freshrss (TCP, since
  mod_auth_openidc answers 401 to non-browsers) and serpbear (`/login`)
  (2026-10-25). Liveness only after 5 failures 30s apart, to ride out the
@@ -413,10 +376,7 @@ every PR.
  fail the run; tested with a planted Secret and an untagged image), plus
  PR annotations for containers without requests or probes. freshrss's
  `alpine/git` init container had no tag; now `v2.52.0`
- [ ] Automerge patch versions of low-risk apps now that CI runs: PR #52
+- [ ] Automerge patch versions of low-risk apps now that CI runs
  (ntfy, gatus, freshrss, serpbear, actual-budget and CI's own tools;
  three days after the release, only on weekday evenings and at the
  weekend, when the cluster can be reached)
 - [x] Renovate listed external-snapshotter twice (#15 and #24): its
  `argocd` manager and a custom `github-tags` regex both matched. The
  regex is gone; Renovate should close #15 by itself
@@ -473,10 +433,11 @@ step after that, if downtime starts to matter.
  there and the volumes hold nothing (0 bytes in every backup). Drop both
  mounts and the two PVCs, or make them ConfigMap files if custom config
  is wanted
- [x] The namespace `secrets` was already gone on 2026-10-26
+- [ ] `kubectl delete namespace secrets`, empty since its app went
- [x] The Failed Velero backups (the dailies from 2026-09-26 to 10-21 and
+- [ ] 41 Failed Velero backups: the dailies from 2026-09-26 to 10-21 and
-  the weeklies since 08-02; 40 by then, one had expired), deleted through
+  the weeklies since 08-02. Velero doesn't restore from a Failed backup;
-  Velero on 2026-10-26. Left: 13 Completed, 3 PartiallyFailed
+  left alone they expire by 2027-01-16.
  `kubectl -n velero exec deploy/velero -c velero -- /velero backup delete $(kubectl -n velero get backups.velero.io -o json | jq -r '.items[] | select(.status.phase=="Failed") | .metadata.name' | xargs) --confirm`
 - [ ] The mariadb-operator Backup `mbgwp-pre-migration-backup`, a dump
  from 2026-02-22 on its own 10 GiB volume (which has a Longhorn backup
  from 2026-10-22). The PVC has no owner, so it goes separately:
@@ -1,68 +0,0 @@
 # External Secrets' three pods reach each other, DNS and the API server
 # (the node, port 16443); the controller also reads Vault
 # (vault-active.vault.svc:8200, which vault/networkpolicy.yaml lets it
 # into). Besides their own namespace they take connections only from the
 # node: the API server calls the webhook from there and the kubelet probes
 # come from there too (10.1.7.64 is the node's Calico VXLAN address,
 # projectcalico.org/IPv4VXLANTunnelAddr). The Password generator behind
 # gatus/backup-check-token needs no network. The chart's Application
 # (apps/templates/external-secrets-helm.yaml) only installs the chart, so
 # this folder gets an Application of its own, external-secrets-folder.
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
  name: default
 spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - podSelector: {}
    - from:
        - ipBlock:
            cidr: 192.168.1.204/32
        - ipBlock:
            cidr: 10.1.7.64/32
  egress:
    - to:
        - podSelector: {}
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53
    - to:
        - ipBlock:
            cidr: 192.168.1.204/32
      ports:
        - port: 16443
 ---
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
  name: controller-to-vault
 spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: external-secrets
  policyTypes:
    - Egress
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: vault
          podSelector:
            matchLabels:
              app.kubernetes.io/name: vault
      ports:
        - port: 8200
@@ -23,7 +23,7 @@ spec:
        io.kompose.service: freshrss
    spec:
      initContainers:
-        - image: alpine/git:v2.54.0
+        - image: alpine/git:v2.52.0
          name: git
          command:
          - git
@@ -74,7 +74,7 @@ spec:
              value: Europe/Amsterdam
          # 1.30.3 ships PHP 8.4.27, which fixes CVE-2026-109618 and
          # CVE-2026-109619.
-          image: freshrss/freshrss:1.30.4
+          image: freshrss/freshrss:1.30.3
          name: freshrss
          ports:
            - containerPort: 80
@@ -83,8 +83,6 @@ spec:
            requests:
              cpu: 50m
              memory: 176Mi
            limits:
              memory: 512Mi
          # TCP, because mod_auth_openidc answers 401 to anything that isn't a
          # browser.
          readinessProbe:
@@ -56,29 +56,3 @@ spec:
              - 169.254.0.0/16
              - 172.16.0.0/12
              - 192.168.0.0/16
 ---
 # cert-manager's HTTP-01 solver, which runs only while a certificate
 # renews: Let's Encrypt and cert-manager's own self check reach it on 8089
 # through Envoy. The policies above let Envoy reach the app's port only,
 # which left the solver unreachable (found 2026-10-26, when ynab's renewal
 # hung).
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
  name: acme-http01-solver
 spec:
  podSelector:
    matchLabels:
      acme.cert-manager.io/http01-solver: "true"
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: envoy-gateway-system
          podSelector:
            matchLabels:
              app.kubernetes.io/name: envoy
      ports:
        - port: 8089
@@ -1,120 +0,0 @@
 # Envoy Gateway: the controller and the proxy it runs (envoyproxy.yaml).
 # Both reach each other (the proxy gets its config from the controller on
 # 18000) and DNS, and take connections from each other and the node: the
 # API server calls the controller's topology webhook (9443) from there and
 # the kubelet probes come from there too (10.1.7.64 is the node's Calico
 # VXLAN address, projectcalico.org/IPv4VXLANTunnelAddr). Nothing scrapes
 # the metrics on 19001.
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
  name: default
  namespace: envoy-gateway-system
 spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - podSelector: {}
    - from:
        - ipBlock:
            cidr: 192.168.1.204/32
        - ipBlock:
            cidr: 10.1.7.64/32
  egress:
    - to:
        - podSelector: {}
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53
 ---
 # The proxy holds the node's ports 80 and 443 (10080 and 10443 inside) and
 # takes connections there from anywhere: the internet through node001 and
 # the router, the LAN, and pods that call a public hostname. It reaches
 # every app it routes to (pods in any namespace; their own policies decide
 # which port), Home Assistant on 192.168.1.202:8123 (outside the cluster,
 # home-assistant/), and the internet on 443 for Longhorn's OIDC login
 # (authentik's token endpoint, at its public address).
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
  name: proxy
  namespace: envoy-gateway-system
 spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/name: envoy
      app.kubernetes.io/component: proxy
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - ports:
        - port: 10080
        - port: 10443
  egress:
    - to:
        - namespaceSelector: {}
    - to:
        - ipBlock:
            cidr: 192.168.1.202/32
      ports:
        - port: 8123
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
              - 10.0.0.0/8
              - 100.64.0.0/10
              - 169.254.0.0/16
              - 172.16.0.0/12
              - 192.168.0.0/16
      ports:
        - port: 443
 ---
 # Everything but the proxy (the controller, and the chart's certgen job on
 # upgrades) reaches the API server (the node, port 16443). The controller
 # also fetches the OIDC discovery document of Longhorn's SecurityPolicy
 # from authentik's public address.
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
  name: control-plane
  namespace: envoy-gateway-system
 spec:
  podSelector:
    matchExpressions:
      - key: app.kubernetes.io/name
        operator: NotIn
        values:
          - envoy
  policyTypes:
    - Egress
  egress:
    - to:
        - ipBlock:
            cidr: 192.168.1.204/32
      ports:
        - port: 16443
    - to:
        - ipBlock:
            cidr: 0.0.0.0/0
            except:
              - 10.0.0.0/8
              - 100.64.0.0/10
              - 169.254.0.0/16
              - 172.16.0.0/12
              - 192.168.0.0/16
      ports:
        - port: 443
@@ -1,23 +0,0 @@
 # node001 passes TLS for the tunneled hosts through without opening it, so
 # without this every request arrives from 46.224.26.65. Wordfence locks that
 # address out after 20 failed logins (2026-10-26), and with it everyone who
 # logs in to scoutingmbg.nl. node001 puts a PROXY header with the visitor's
 # address in front of each connection; Envoy takes the address from there
 # and adds it to X-Forwarded-For.
 #
 # Optional, because s2 and ntfy2 point straight at home and their clients
 # send no header, and neither does node001's proxy on port 80. The price:
 # whoever connects to the home address directly can send a header of their
 # own and claim any address.
 apiVersion: gateway.envoyproxy.io/v1alpha1
 kind: ClientTrafficPolicy
 metadata:
  name: proxy-protocol
  namespace: envoy-gateway-system
 spec:
  targetRefs:
  - group: gateway.networking.k8s.io
    kind: Gateway
    name: homelab
  proxyProtocol:
    optional: true
@@ -83,29 +83,3 @@ spec:
            cidr: 192.168.1.204/32
      ports:
        - port: 16443
 ---
 # cert-manager's HTTP-01 solver, which runs only while a certificate
 # renews: Let's Encrypt and cert-manager's own self check reach it on 8089
 # through Envoy. The policies above let Envoy reach the app's port only,
 # which left the solver unreachable (found 2026-10-26, when ynab's renewal
 # hung).
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
  name: acme-http01-solver
 spec:
  podSelector:
    matchLabels:
      acme.cert-manager.io/http01-solver: "true"
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: envoy-gateway-system
          podSelector:
            matchLabels:
              app.kubernetes.io/name: envoy
      ports:
        - port: 8089
@@ -54,8 +54,6 @@ spec:
            requests:
              cpu: 20m
              memory: 336Mi
            limits:
              memory: 1Gi
          # /api/healthz checks the database and the cache.
          readinessProbe:
            httpGet:
@@ -55,29 +55,3 @@ spec:
              - 169.254.0.0/16
              - 172.16.0.0/12
              - 192.168.0.0/16
 ---
 # cert-manager's HTTP-01 solver, which runs only while a certificate
 # renews: Let's Encrypt and cert-manager's own self check reach it on 8089
 # through Envoy. The policies above let Envoy reach the app's port only,
 # which left the solver unreachable (found 2026-10-26, when ynab's renewal
 # hung).
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
  name: acme-http01-solver
 spec:
  podSelector:
    matchLabels:
      acme.cert-manager.io/http01-solver: "true"
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: envoy-gateway-system
          podSelector:
            matchLabels:
              app.kubernetes.io/name: envoy
      ports:
        - port: 8089
@@ -67,8 +67,6 @@ spec:
                      requests:
                        cpu: 10m
                        memory: 64Mi
                      limits:
                        memory: 256Mi
                    image:
                      repository: docker.io/valkey/valkey
                      tag: 9.1.2-alpine@sha256:48332870af354a799964c0012ae1194a0bf2bf894eb508f945810596dc2d8d11
@@ -95,8 +93,6 @@ spec:
                      requests:
                        cpu: 100m
                        memory: 1280Mi
                      limits:
                        memory: 3Gi
                    # Node trusts its built-in roots, which still include the
                    # ones above the compromised eMudhra intermediates. Use
                    # patched-ca-bundle through OpenSSL until Node ships a fix.
@@ -121,14 +117,12 @@ spec:
                    image:
                      repository: ghcr.io/immich-app/immich-machine-learning
                      pullPolicy: IfNotPresent
-                    # Idle at 240Mi; 884Mi with CLIP, face recognition and
+                    # Idle at night (234Mi); the models take over a GiB when
-                    # OCR loaded (2026-10-28, a test image through each).
+                    # it works.
                    resources:
                      requests:
                        cpu: 50m
                        memory: 1Gi
                      limits:
                        memory: 2Gi
                    env:
                      TRANSFORMERS_CACHE: /cache
                      HF_XET_CACHE: /cache/huggingface-xet
@@ -73,9 +73,7 @@ spec:
 ---
 # The CNPG operator checks each instance on its status port and connects to
 # PostgreSQL; the instance manager inside each pod watches its Cluster
-# through the API server (the node, port 16443). The barman cloud sidecar
+# through the API server (the node, port 16443).
 # sends the WAL and the base backups to Garage on the NAS
 # (postgresql-backup.yaml).
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
@@ -102,34 +100,3 @@ spec:
            cidr: 192.168.1.204/32
      ports:
        - port: 16443
    - to:
        - ipBlock:
            cidr: 192.168.1.99/32
      ports:
        - port: 3900
 ---
 # cert-manager's HTTP-01 solver, which runs only while a certificate
 # renews: Let's Encrypt and cert-manager's own self check reach it on 8089
 # through Envoy. The policies above let Envoy reach the app's port only,
 # which left the solver unreachable (found 2026-10-26, when ynab's renewal
 # hung).
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
  name: acme-http01-solver
 spec:
  podSelector:
    matchLabels:
      acme.cert-manager.io/http01-solver: "true"
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: envoy-gateway-system
          podSelector:
            matchLabels:
              app.kubernetes.io/name: envoy
      ports:
        - port: 8089
@@ -1,99 +0,0 @@
 # Backups of immich's database (albums, faces, the photos' metadata; the
 # photos themselves are files on immich-claim) by CNPG itself, through the
 # barman cloud plugin (apps/templates/plugin-barman-cloud-helm.yaml): a base
 # backup every night, and every WAL segment as soon as it is full or 5
 # minutes old (archive_timeout). Both go to the bucket cnpg-immich in Garage
 # on the NAS (nas/garage), so the database can be restored to any moment of
 # the last 30 days. Velero copies the data directory while PostgreSQL runs,
 # which is not a consistent copy. Only the PostgreSQL 17 cluster; the 14
 # one is about to go.
 # The key is Garage's cnpg-immich, in Vault as kv/cnpg-immich-s3; it can
 # only reach this bucket.
 apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
  name: immich-postgres-17-s3
  namespace: immich
 spec:
  secretStoreRef:
    name: vault-backend
    kind: ClusterSecretStore
  refreshInterval: 15m
  target:
    name: immich-postgres-17-s3
    creationPolicy: Owner
    template:
      engineVersion: v2
      data:
        ACCESS_KEY_ID: "{{ .access_key_id }}"
        ACCESS_SECRET_KEY: "{{ .secret_access_key }}"
        # Garage rejects requests signed for another region
        REGION: garage
  data:
    - secretKey: access_key_id
      remoteRef:
        key: kv/cnpg-immich-s3
        property: access_key_id
    - secretKey: secret_access_key
      remoteRef:
        key: kv/cnpg-immich-s3
        property: secret_access_key
 ---
 apiVersion: barmancloud.cnpg.io/v1
 kind: ObjectStore
 metadata:
  name: immich-postgres-17
  namespace: immich
  annotations:
    # The CRD comes with the plugin's own app
    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
 spec:
  retentionPolicy: 30d
  configuration:
    destinationPath: s3://cnpg-immich/
    endpointURL: http://192.168.1.99:3900
    s3Credentials:
      accessKeyId:
        name: immich-postgres-17-s3
        key: ACCESS_KEY_ID
      secretAccessKey:
        name: immich-postgres-17-s3
        key: ACCESS_SECRET_KEY
      region:
        name: immich-postgres-17-s3
        key: REGION
    wal:
      compression: gzip
    data:
      compression: gzip
  instanceSidecarConfiguration:
    resources:
      requests:
        cpu: 10m
        memory: 64Mi
      limits:
        memory: 512Mi
    env:
      # Newer boto3 adds checksums that S3-compatible stores can reject;
      # the plugin's docs suggest sending them only when required.
      - name: AWS_REQUEST_CHECKSUM_CALCULATION
        value: when_required
      - name: AWS_RESPONSE_CHECKSUM_VALIDATION
        value: when_required
 ---
 apiVersion: postgresql.cnpg.io/v1
 kind: ScheduledBackup
 metadata:
  name: immich-postgres-17-daily
  namespace: immich
 spec:
  cluster:
    name: immich-postgres-17
  # 03:00 UTC, after Longhorn's and Velero's backups; immediate: one right
  # away, so WAL archiving has a base backup to start from.
  schedule: "0 0 3 * * *"
  immediate: true
  backupOwnerReference: self
  method: plugin
  pluginConfiguration:
    name: barman-cloud.cloudnative-pg.io
@@ -13,20 +13,11 @@ spec:
    requests:
      cpu: 20m
      memory: 320Mi
    limits:
      memory: 1Gi
  postgresql:
    shared_preload_libraries:
      - "vchord.so"
  # WAL archiving and base backups to Garage, see postgresql-backup.yaml
  plugins:
    - name: barman-cloud.cloudnative-pg.io
      isWALArchiver: true
      parameters:
        barmanObjectName: immich-postgres-17
  # Filled once from the PostgreSQL 14 cluster (immich-postgres) after its
  # embedding columns were turned into real[] and pgvecto.rs was dropped,
  # see docs/upgrade-k8s-1.33.md.
@@ -3,4 +3,3 @@ kind: Kustomization
 resources:
  - operator-crds-helm.yaml
  - operator-helm.yaml
  - networkpolicy.yaml
@@ -1,54 +0,0 @@
 # The mariadb-operator's three pods reach each other, DNS and the API
 # server (the node, port 16443); the operator also connects to MariaDB on
 # 3306 for the databases, users and grants it manages (mbgwp's
 # mariadb-from-operator lets it in). Besides their own namespace they take
 # connections only from the node: the API server calls the webhook from
 # there and the kubelet probes come from there too (10.1.7.64 is the node's
 # Calico VXLAN address, projectcalico.org/IPv4VXLANTunnelAddr). This
 # folder's Application deploys into argocd (the operator's own
 # Applications), hence the namespace here.
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
  name: default
  namespace: mariadb-system
 spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - podSelector: {}
    - from:
        - ipBlock:
            cidr: 192.168.1.204/32
        - ipBlock:
            cidr: 10.1.7.64/32
  egress:
    - to:
        - podSelector: {}
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53
    - to:
        - ipBlock:
            cidr: 192.168.1.204/32
      ports:
        - port: 16443
    - to:
        - namespaceSelector: {}
          podSelector:
            matchLabels:
              app.kubernetes.io/name: mariadb
      ports:
        - port: 3306
@@ -13,7 +13,7 @@ spec:
  source:
    chart: mariadb-operator-crds
    repoURL: https://mariadb-operator.github.io/mariadb-operator
-    targetRevision: 26.10.2
+    targetRevision: 25.10.4
  syncPolicy:
    automated:
      prune: true
@@ -13,15 +13,13 @@ spec:
  source:
    chart: mariadb-operator
    repoURL: https://mariadb-operator.github.io/mariadb-operator
-    targetRevision: 26.10.2
+    targetRevision: 25.10.4
    helm:
      values: |
        resources:
          requests:
            cpu: 10m
            memory: 48Mi
          limits:
            memory: 128Mi
        metrics:
          enabled: true
          serviceMonitor:
@@ -31,8 +29,6 @@ spec:
            requests:
              cpu: 10m
              memory: 32Mi
            limits:
              memory: 128Mi
          serviceMonitor:
            enabled: false
        certController:
@@ -40,8 +36,6 @@ spec:
            requests:
              cpu: 10m
              memory: 32Mi
            limits:
              memory: 128Mi
          serviceMonitor:
            enabled: false
  syncPolicy:
@@ -85,29 +85,3 @@ spec:
              kubernetes.io/metadata.name: mariadb-system
      ports:
        - port: 3306
 ---
 # cert-manager's HTTP-01 solver, which runs only while a certificate
 # renews: Let's Encrypt and cert-manager's own self check reach it on 8089
 # through Envoy. The policies above let Envoy reach the app's port only,
 # which left the solver unreachable (found 2026-10-26, when ynab's renewal
 # hung).
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
  name: acme-http01-solver
 spec:
  podSelector:
    matchLabels:
      acme.cert-manager.io/http01-solver: "true"
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: envoy-gateway-system
          podSelector:
            matchLabels:
              app.kubernetes.io/name: envoy
      ports:
        - port: 8089
@@ -31,12 +31,5 @@ Velero's key is in Vault as `kv/velero-s3` (`access_key_id`,
 `velero/external-secret.yaml`. Without the cluster, `$g key info velero
 --show-secret` on the NAS shows it again.
 CNPG's backups (`authentik/postgresql-backup.yaml`,
 `immich/postgresql-backup.yaml`) have a bucket and a key per cluster, so
 neither database can touch the other's backups. Made on 2026-10-26 the
 same way as Velero's, with `cnpg-authentik` and `cnpg-immich` as both
 bucket and key name; the keys are in Vault as `kv/cnpg-authentik-s3` and
 `kv/cnpg-immich-s3`.
 Renovate updates the image tag in `compose.yaml`, but nothing deploys it:
 after merging, `docker compose pull && docker compose up -d` on the NAS.
@@ -173,18 +173,12 @@ in
    #   - mail.rubenhensen.nl (and anything else) → local stalwart on 8443
    #   - tunneled hosts → home cluster ingress on 443
    #   - s1 / ntfy1.rubenhensen.nl → local nginx on 8444 (Gatus, ntfy)
    #
    # Each connection starts with a PROXY header that carries the visitor's
    # address, so the home cluster sees who is asking instead of this box
    # (gateway/proxy-protocol.yaml in k8scd). nginx sends the header to
    # every upstream or none, so the local ones go through a hop on
    # 8445/8446 that takes it off again.
    streamConfig = ''
      map $ssl_preread_server_name $tunnel_upstream {
 ${sniMapEntries}
-        s1.rubenhensen.nl 127.0.0.1:8446;
+        s1.rubenhensen.nl 127.0.0.1:8444;
-        ntfy1.rubenhensen.nl 127.0.0.1:8446;
+        ntfy1.rubenhensen.nl 127.0.0.1:8444;
-        default 127.0.0.1:8445;
+        default 127.0.0.1:8443;
      }
      server {
@@ -192,17 +186,6 @@ ${sniMapEntries}
        listen [::]:443;
        proxy_pass $tunnel_upstream;
        ssl_preread on;
        proxy_protocol on;
      }
      server {
        listen 127.0.0.1:8445 proxy_protocol;
        proxy_pass 127.0.0.1:8443;
      }
      server {
        listen 127.0.0.1:8446 proxy_protocol;
        proxy_pass 127.0.0.1:8444;
      }
    '';
@@ -65,29 +65,3 @@ spec:
              - 169.254.0.0/16
              - 172.16.0.0/12
              - 192.168.0.0/16
 ---
 # cert-manager's HTTP-01 solver, which runs only while a certificate
 # renews: Let's Encrypt and cert-manager's own self check reach it on 8089
 # through Envoy. The policies above let Envoy reach the app's port only,
 # which left the solver unreachable (found 2026-10-26, when ynab's renewal
 # hung).
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
  name: acme-http01-solver
 spec:
  podSelector:
    matchLabels:
      acme.cert-manager.io/http01-solver: "true"
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: envoy-gateway-system
          podSelector:
            matchLabels:
              app.kubernetes.io/name: envoy
      ports:
        - port: 8089
@@ -4,7 +4,6 @@
    "config:recommended",
    "customManagers:githubActionsVersions"
  ],
  "timezone": "Europe/Amsterdam",
  "argocd": {
    "description": "Every app folder; Renovate's regexes are RE2, which has no lookahead, so the other folders are skipped through ignorePaths",
    "managerFilePatterns": [
@@ -89,27 +88,6 @@
        "major"
      ],
      "enabled": false
    },
    {
      "description": "Patch updates of apps that hold little state and are easy to roll back, and of CI's tools, merge themselves once CI passes: three days after the release, in the evening or at the weekend, when the cluster can be reached. Not the databases, operators, Vault, authentik, Longhorn, Velero, immich, Gitea or WordPress. Renovate merges itself; the repo has no branch protection for GitHub's auto-merge to wait on",
      "matchFileNames": [
        "ntfy/**",
        "gatus/**",
        "freshrss/**",
        "serpbear/**",
        "actual-budget/**",
        ".github/workflows/**"
      ],
      "matchUpdateTypes": [
        "patch"
      ],
      "minimumReleaseAge": "3 days",
      "automerge": true,
      "platformAutomerge": false,
      "automergeSchedule": [
        "* 17-21 * * 1-5",
        "* 10-21 * * 0,6"
      ]
    }
  ]
 }
@@ -54,29 +54,3 @@ spec:
              - 169.254.0.0/16
              - 172.16.0.0/12
              - 192.168.0.0/16
 ---
 # cert-manager's HTTP-01 solver, which runs only while a certificate
 # renews: Let's Encrypt and cert-manager's own self check reach it on 8089
 # through Envoy. The policies above let Envoy reach the app's port only,
 # which left the solver unreachable (found 2026-10-26, when ynab's renewal
 # hung).
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
  name: acme-http01-solver
 spec:
  podSelector:
    matchLabels:
      acme.cert-manager.io/http01-solver: "true"
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: envoy-gateway-system
          podSelector:
            matchLabels:
              app.kubernetes.io/name: envoy
      ports:
        - port: 8089
@@ -60,8 +60,6 @@ spec:
            requests:
              cpu: 10m
              memory: 160Mi
            limits:
              memory: 512Mi
          readinessProbe:
            httpGet:
              path: /login
@@ -66,29 +66,3 @@ spec:
              - 169.254.0.0/16
              - 172.16.0.0/12
              - 192.168.0.0/16
 ---
 # cert-manager's HTTP-01 solver, which runs only while a certificate
 # renews: Let's Encrypt and cert-manager's own self check reach it on 8089
 # through Envoy. The policies above let Envoy reach the app's port only,
 # which left the solver unreachable (found 2026-10-26, when ynab's renewal
 # hung).
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
  name: acme-http01-solver
 spec:
  podSelector:
    matchLabels:
      acme.cert-manager.io/http01-solver: "true"
  policyTypes:
    - Ingress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: envoy-gateway-system
          podSelector:
            matchLabels:
              app.kubernetes.io/name: envoy
      ports:
        - port: 8089
@@ -7,8 +7,6 @@ injector:
      requests:
         cpu: 10m
         memory: 32Mi
      limits:
         memory: 128Mi
   # The chart's default anti-affinity forbids two injector pods on one
   # node, so on this single node a rolling update can never start the new
   # pod while the old one runs. Recreate removes the old pod first, which
@@ -1,52 +0,0 @@
 # Velero, its node agent, and the pods it starts here (the data movers of
 # each pod volume backup or restore, kopia's maintenance jobs, the chart's
 # CRD upgrade job) reach each other, DNS, the API server (the node, port
 # 16443) and Garage on the NAS (192.168.1.99:3900, nas/garage). The node
 # agent reads volumes through its hostPath mount, not the network. Besides
 # their own namespace they take connections only from the node (kubelet
 # probes; 10.1.7.64 is the node's Calico VXLAN address,
 # projectcalico.org/IPv4VXLANTunnelAddr); nothing scrapes the metrics on
 # 8085. MinIO (the NAS, port 9000) is not allowed: going back to it means
 # adding its port here as well.
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
  name: default
 spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - podSelector: {}
    - from:
        - ipBlock:
            cidr: 192.168.1.204/32
        - ipBlock:
            cidr: 10.1.7.64/32
  egress:
    - to:
        - podSelector: {}
    - to:
        - namespaceSelector:
            matchLabels:
              kubernetes.io/metadata.name: kube-system
          podSelector:
            matchLabels:
              k8s-app: kube-dns
      ports:
        - protocol: UDP
          port: 53
        - protocol: TCP
          port: 53
    - to:
        - ipBlock:
            cidr: 192.168.1.204/32
      ports:
        - port: 16443
    - to:
        - ipBlock:
            cidr: 192.168.1.99/32
      ports:
        - port: 3900
@@ -71,8 +71,6 @@ spec:
            requests:
              cpu: 10m
              memory: 64Mi
            limits:
              memory: 128Mi
        # 512Mi got the server OOMKilled 314 times, including halfway
        # through a backup of ~14.7k items.
        resources: