Update helm chart external-secrets to v2

actual-budget/helm-actual-budget.yaml

@@ -12,14 +12,14 @@ spec:
   project: default
   source:
     repoURL: https://community-charts.github.io/helm-charts
-    targetRevision: 1.8.9
+    targetRevision: 1.8.7
     chart: actualbudget
     helm:
       values: |
         # Actual Budget configuration
 
         image:
-          tag: "26.6.0"
+          tag: "26.3.0"
 
         # Authentication configuration
         login:

apps/templates/authentik-helm.yaml

@@ -106,9 +106,6 @@ spec:
               - name: blueprint-actualbudget
                 configMap:
                   name: authentik-blueprint-actualbudget
-              - name: blueprint-session
-                configMap:
-                  name: authentik-blueprint-session
             volumeMounts:
               - name: blueprint-vault
                 mountPath: /blueprints/custom/vault-oidc.yaml
@@ -128,9 +125,6 @@ spec:
               - name: blueprint-actualbudget
                 mountPath: /blueprints/custom/actualbudget-proxy.yaml
                 subPath: actualbudget-proxy.yaml
-              - name: blueprint-session
-                mountPath: /blueprints/custom/session-duration.yaml
-                subPath: session-duration.yaml
             ingress:
               enabled: true
               ingressClassName: nginx
@@ -162,9 +156,6 @@ spec:
               - name: blueprint-actualbudget
                 configMap:
                   name: authentik-blueprint-actualbudget
-              - name: blueprint-session
-                configMap:
-                  name: authentik-blueprint-session
             volumeMounts:
               - name: blueprint-vault
                 mountPath: /blueprints/custom/vault-oidc.yaml
@@ -184,9 +175,6 @@ spec:
               - name: blueprint-actualbudget
                 mountPath: /blueprints/custom/actualbudget-proxy.yaml
                 subPath: actualbudget-proxy.yaml
-              - name: blueprint-session
-                mountPath: /blueprints/custom/session-duration.yaml
-                subPath: session-duration.yaml
           postgresql:
             enabled: false
           redis:

apps/templates/bolletjestrui-folder.yaml

@@ -1,21 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: bolletjestrui
-  namespace: argocd
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-  source:
-    repoURL: https://github.com/rubenhensen/k8scd.git
-    targetRevision: HEAD
-    path: bolletjestrui
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: bolletjestrui
-  syncPolicy:
-    syncOptions:
-      - CreateNamespace=true
-    automated:
-      selfHeal: true

apps/templates/cloudnativepg-helm.yaml

@@ -10,7 +10,7 @@ spec:
   source:
     chart: cloudnative-pg
     repoURL: https://cloudnative-pg.github.io/charts
-    targetRevision: 0.29.0
+    targetRevision: 0.23.2
     helm:
       values: |
         # Default values are fine

apps/templates/external-secrets-helm.yaml

@@ -15,7 +15,7 @@ spec:
   sources:
     - chart: external-secrets
       repoURL: https://charts.external-secrets.io
-      targetRevision: 0.10.7
+      targetRevision: 2.5.0
   destination:
     server: https://kubernetes.default.svc
     namespace: external-secrets

apps/templates/gitea-folder.yaml

@@ -1,21 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: gitea
-  namespace: argocd
-  finalizers:
-  - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-  source:
-    repoURL: https://github.com/rubenhensen/k8scd.git
-    targetRevision: HEAD
-    path: gitea
-  destination:
-    server: https://kubernetes.default.svc
-    namespace: gitea
-  syncPolicy:
-    syncOptions:
-    - CreateNamespace=true
-    automated:
-      selfHeal: true

apps/templates/mbgwp-official-helm.yaml

@@ -41,11 +41,6 @@ spec:
               secretKeyRef:
                 name: mbgwp-mariadb-credentials
                 key: password
-          - name: WF_ENCRYPTION_KEY
-            valueFrom:
-              secretKeyRef:
-                name: wordpress-credentials
-                key: wf-encryption-key
 
         # WordPress specific settings
         settings:

authentik/README.md

@@ -11,22 +11,6 @@ Authentik is deployed as the central identity provider, providing OIDC and LDAP
   - `blueprint-ldap.yaml` — LDAP provider (base DN: `DC=ldap,DC=goauthentik,DC=io`)
   - `blueprint-mail-oidc.yaml` — OAuth2/OIDC provider for Stalwart mail
   - `blueprint-vault-oidc.yaml` — OIDC provider for Vault
-  - `blueprint-argocd-oidc.yaml` — OIDC provider for ArgoCD
-  - `blueprint-freshrss-oidc.yaml` — OIDC provider for FreshRSS
-  - `blueprint-actualbudget-proxy.yaml` — Proxy provider for Actual Budget
-  - `blueprint-session-duration.yaml` — Session lifetime of the default authentication flow
-
-## Session lifetime
-
-Authentik ships the login stage of `default-authentication-flow` with
-`session_duration: seconds=0`, i.e. the SSO session dies when the browser closes.
-`blueprint-session-duration.yaml` raises this to 30 days for every app that uses
-that flow (FreshRSS, ArgoCD, Vault, Actual Budget, mail).
-
-The expiry is **absolute** — Authentik does not extend a session on activity. A
-sliding window has to come from the application itself; FreshRSS does this via
-`OIDC_SESSION_INACTIVITY_TIMEOUT` (see `freshrss/freshrss-deployment.yaml`), which
-Apache mod_auth_openidc refreshes on every request.
 
 ## LDAP Outpost
 

authentik/blueprint-session-duration.yaml

@@ -1,27 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: authentik-blueprint-session
-data:
-  session-duration.yaml: |
-    version: 1
-    metadata:
-      name: Session duration
-    entries:
-      # Overrides the login stage of the built-in `default-authentication-flow`,
-      # which every OIDC/proxy provider in this cluster authenticates against.
-      # authentik ships this stage with `session_duration: seconds=0`, which means
-      # "until the browser is closed" — that is why re-logins were so frequent.
-      #
-      # Note: authentik's session expiry is absolute (counted from login), it does
-      # not slide on activity. The sliding window lives in the applications, e.g.
-      # OIDC_SESSION_INACTIVITY_TIMEOUT in freshrss/freshrss-deployment.yaml.
-      - model: authentik_stages_user_login.userloginstage
-        state: present
-        identifiers:
-          name: default-authentication-login
-        attrs:
-          session_duration: days=30
-          # Uncomment to show a "Remember me on this device" checkbox that adds
-          # this offset on top of session_duration when ticked (0 = hidden).
-          # remember_me_offset: days=60

bolletjestrui/bolletjestrui-deployment.yaml

@@ -1,98 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app: bolletjestrui
-  name: bolletjestrui
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: bolletjestrui
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        app: bolletjestrui
-    spec:
-      containers:
-        - image: ghcr.io/rubenhensen/bolletjestrui:main-10268f1
-          name: bolletjestrui
-          ports:
-            - containerPort: 3000
-              protocol: TCP
-          env:
-            - name: DATABASE_URL
-              value: /app/data/bolletjestrui.db
-            - name: ORIGIN
-              value: https://vic.rubenhensen.nl
-            - name: PROTOCOL_HEADER
-              value: x-forwarded-proto
-            - name: HOST_HEADER
-              value: x-forwarded-host
-            # GPX routes and profile photos (up to 20 MB); raise adapter-node's 512K default
-            - name: BODY_SIZE_LIMIT
-              value: "25M"
-            - name: TZ
-              value: Europe/Amsterdam
-            - name: SITE_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: bolletjestrui-secrets
-                  key: site_password
-            - name: ADMIN_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: bolletjestrui-secrets
-                  key: admin_password
-            - name: KEY_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: bolletjestrui-secrets
-                  key: key_secret
-            # Push notifications. optional:true is load-bearing: without it a missing
-            # key leaves the pod in CreateContainerConfigError and the site is down,
-            # which would make deploying this depend on the Vault entries landing
-            # first. The app already treats absent VAPID keys as "send nothing".
-            - name: VAPID_PUBLIC_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: bolletjestrui-secrets
-                  key: vapid_public_key
-                  optional: true
-            - name: VAPID_PRIVATE_KEY
-              valueFrom:
-                secretKeyRef:
-                  name: bolletjestrui-secrets
-                  key: vapid_private_key
-                  optional: true
-            - name: VAPID_SUBJECT
-              value: mailto:ruben.hensen@protonmail.com
-          resources:
-            requests:
-              memory: "128Mi"
-              cpu: "50m"
-            limits:
-              memory: "512Mi"
-              cpu: "500m"
-          readinessProbe:
-            httpGet:
-              path: /login
-              port: 3000
-            initialDelaySeconds: 5
-            periodSeconds: 10
-          livenessProbe:
-            httpGet:
-              path: /login
-              port: 3000
-            initialDelaySeconds: 15
-            periodSeconds: 20
-          volumeMounts:
-            - mountPath: /app/data
-              name: data
-      restartPolicy: Always
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: bolletjestrui-data

bolletjestrui/bolletjestrui-service.yaml

@@ -1,13 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    app: bolletjestrui
-  name: bolletjestrui
-spec:
-  ports:
-    - name: "3000"
-      port: 3000
-      targetPort: 3000
-  selector:
-    app: bolletjestrui

bolletjestrui/data-persistentvolumeclaim.yaml

@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  labels:
-    app: bolletjestrui
-  name: bolletjestrui-data
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 2Gi

bolletjestrui/external-secret.yaml

@@ -1,36 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: bolletjestrui-secrets
-spec:
-  secretStoreRef:
-    name: vault-backend
-    kind: ClusterSecretStore
-  refreshInterval: 15m
-  target:
-    name: bolletjestrui-secrets
-    creationPolicy: Owner
-  data:
-    - secretKey: site_password
-      remoteRef:
-        key: kv/bolletjestrui
-        property: site_password
-    - secretKey: admin_password
-      remoteRef:
-        key: kv/bolletjestrui
-        property: admin_password
-    - secretKey: key_secret
-      remoteRef:
-        key: kv/bolletjestrui
-        property: key_secret
-    # web-push keypair for the "de route is gekozen" notification.
-    # Generate once with `npx web-push generate-vapid-keys` and never rotate it:
-    # a new key invalidates every subscription on everyone's phone.
-    - secretKey: vapid_public_key
-      remoteRef:
-        key: kv/bolletjestrui
-        property: vapid_public_key
-    - secretKey: vapid_private_key
-      remoteRef:
-        key: kv/bolletjestrui
-        property: vapid_private_key

bolletjestrui/ingress.yaml

@@ -1,27 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: bolletjestrui-ingress
-  annotations:
-    cert-manager.io/cluster-issuer: prod-cluster-issuer
-    nginx.ingress.kubernetes.io/backend-protocol: "HTTP"
-    nginx.ingress.kubernetes.io/ssl-passthrough: "false"
-    # matches the app's BODY_SIZE_LIMIT: a bulk route import posts every GPX at once
-    nginx.ingress.kubernetes.io/proxy-body-size: "25m"
-spec:
-  ingressClassName: nginx
-  rules:
-    - host: vic.rubenhensen.nl
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: bolletjestrui
-                port:
-                  number: 3000
-  tls:
-    - secretName: letsencrypt-prod
-      hosts:
-        - vic.rubenhensen.nl

dns/domains/rubenhensen.nl.yaml

@@ -10,59 +10,51 @@ records:
   - name: "phocaslustrum"
     expire: 300
     type: A
-    content: "62.41.86.27"
+    content: "62.41.87.114"
   - name: "ynab"
     expire: 300
     type: A
-    content: "46.224.26.65"
+    content: "62.41.87.114"
   - name: "authentik"
     expire: 300
     type: A
-    content: "46.224.26.65"
+    content: "62.41.87.114"
   - name: "ldap"
     expire: 300
     type: A
-    content: "62.41.86.27"
+    content: "62.41.87.114"
   - name: "argocd"
     expire: 300
     type: A
-    content: "46.224.26.65"
+    content: "62.41.87.114"
   - name: "vault"
     expire: 300
     type: A
-    content: "46.224.26.65"
+    content: "62.41.87.114"
   - name: "rss"
     expire: 300
     type: A
-    content: "46.224.26.65"
+    content: "62.41.87.114"
   - name: "ha"
     expire: 300
     type: A
-    content: "46.224.26.65"
+    content: "62.41.87.114"
   - name: "longhorn"
     expire: 300
     type: A
-    content: "46.224.26.65"
+    content: "62.41.87.114"
   - name: "lingo"
     expire: 300
     type: A
-    content: "46.224.26.65"
+    content: "62.41.87.114"
   - name: "blog"
     expire: 300
     type: A
-    content: "46.224.26.65"
+    content: "62.41.87.114"
   - name: "serpbear"
     expire: 300
     type: A
-    content: "46.224.26.65"
-  - name: "git"
-    expire: 300
-    type: A
-    content: "46.224.26.65"
-  - name: "vic"
-    expire: 300
-    type: A
-    content: "46.224.26.65"
+    content: "62.41.87.114"
   - name: "@"
     expire: 300
     type: MX

freshrss/freshrss-deployment.yaml

@@ -56,20 +56,6 @@ spec:
               value: "openid email profile"
             - name: OIDC_X_FORWARDED_HEADERS
               value: X-Forwarded-Port X-Forwarded-Proto X-Forwarded-Host
-            # Session handling for the Apache mod_auth_openidc layer that guards /i/.
-            # Defaults are 5 min inactivity / ~7.5 h max, which is what caused the
-            # constant bounces back to authentik.
-            # Sliding window: refreshed on every request, so any visit within the
-            # period extends it by another 30 days.
-            - name: OIDC_SESSION_INACTIVITY_TIMEOUT
-              value: "2592000" # 30 days
-            # Hard cap, counted from login and never extended.
-            - name: OIDC_SESSION_MAX_DURATION
-              value: "7776000" # 90 days
-            # ":persistent" makes the session cookie survive a browser restart
-            # (its expiry tracks OIDC_SESSION_INACTIVITY_TIMEOUT).
-            - name: OIDC_SESSION_TYPE
-              value: "server-cache:persistent"
             - name: TZ
               value: Europe/Amsterdam
           image: freshrss/freshrss:latest

gitea/gitea-data-persistentvolumeclaim.yaml

@@ -1,10 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: gitea-data
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 10Gi

gitea/gitea-deployment.yaml

@@ -1,60 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: gitea
-  labels:
-    app: gitea
-spec:
-  replicas: 1
-  strategy:
-    type: Recreate
-  selector:
-    matchLabels:
-      app: gitea
-  template:
-    metadata:
-      labels:
-        app: gitea
-    spec:
-      securityContext:
-        fsGroup: 1000
-      containers:
-        - name: gitea
-          image: gitea/gitea:1
-          env:
-            - name: USER_UID
-              value: "1000"
-            - name: USER_GID
-              value: "1000"
-            - name: TZ
-              value: Europe/Amsterdam
-            - name: GITEA__server__ROOT_URL
-              value: https://git.rubenhensen.nl/
-            - name: GITEA__server__DOMAIN
-              value: git.rubenhensen.nl
-            - name: GITEA__server__PROTOCOL
-              value: http
-            - name: GITEA__server__HTTP_PORT
-              value: "3000"
-            - name: GITEA__server__DISABLE_SSH
-              value: "true"
-            - name: GITEA__database__DB_TYPE
-              value: sqlite3
-            - name: GITEA__database__PATH
-              value: /data/gitea/gitea.db
-            - name: GITEA__security__INSTALL_LOCK
-              value: "true"
-            - name: GITEA__log__MODE
-              value: console
-          ports:
-            - containerPort: 3000
-              name: http
-              protocol: TCP
-          volumeMounts:
-            - mountPath: /data
-              name: data
-      restartPolicy: Always
-      volumes:
-        - name: data
-          persistentVolumeClaim:
-            claimName: gitea-data

gitea/gitea-service.yaml

@@ -1,13 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: gitea
-  labels:
-    app: gitea
-spec:
-  selector:
-    app: gitea
-  ports:
-    - name: http
-      port: 3000
-      targetPort: 3000

gitea/ingress.yaml

@@ -1,24 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: gitea-ingress
-  annotations:
-    cert-manager.io/cluster-issuer: prod-cluster-issuer
-    nginx.ingress.kubernetes.io/proxy-body-size: "1g"
-spec:
-  ingressClassName: nginx
-  rules:
-    - host: git.rubenhensen.nl
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: gitea
-                port:
-                  number: 3000
-  tls:
-    - secretName: letsencrypt-prod
-      hosts:
-        - git.rubenhensen.nl

mbgwp/default-pw-es.yaml

@@ -19,8 +19,4 @@ spec:
     - secretKey: smtp-password
       remoteRef:
         key: kv/mbgwp
-        property: smtp-password
-    - secretKey: wf-encryption-key
-      remoteRef:
-        key: kv/mbgwp
-        property: wf-encryption-key
+        property: smtp-password

nix-infra-machine/nodes/node001.nix

@@ -1,44 +1,4 @@
 { config, pkgs, lib, ... }:
-let
-  # Public IP of the home network where the k8s cluster ingress lives.
-  # Keep in sync with dns/domains/rubenhensen.nl.yaml.
-  homeIP = "62.41.86.27";
-
-  # Hosts tunneled to the home k8s cluster. Each entry gets:
-  #   * an SNI map entry for TCP passthrough on :443
-  #   * an HTTP vhost on :80 that reverse-proxies to the cluster
-  # The cluster's nginx-ingress terminates TLS with cert-manager.
-  tunneledHosts = [
-    "rss.rubenhensen.nl"
-    "authentik.rubenhensen.nl"
-    "vault.rubenhensen.nl"
-    "ynab.rubenhensen.nl"
-    "argocd.rubenhensen.nl"
-    "ha.rubenhensen.nl"
-    "longhorn.rubenhensen.nl"
-    "lingo.rubenhensen.nl"
-    "blog.rubenhensen.nl"
-    "serpbear.rubenhensen.nl"
-    "git.rubenhensen.nl"
-    "vic.rubenhensen.nl"
-  ];
-
-  sniMapEntries =
-    lib.concatMapStringsSep "\n"
-      (h: "        ${h} ${homeIP}:443;")
-      tunneledHosts;
-
-  tunneledVhosts = lib.listToAttrs (map (h: {
-    name = h;
-    value = {
-      listen = [
-        { addr = "0.0.0.0"; port = 80; }
-        { addr = "[::]"; port = 80; }
-      ];
-      locations."/".proxyPass = "http://${homeIP}";
-    };
-  }) tunneledHosts);
-in
 {
   # ──────────────────────────────────────────────
   # Firewall
@@ -75,67 +35,55 @@ in
     "d /var/lib/acme/acme-challenge 0755 acme acme -"
   ];
 
-  # Serve ACME challenges via nginx on port 80.
-  # Also reverse-proxy tunneled hosts to the home k8s cluster, and do
-  # SNI-based TCP passthrough on 443 so the cluster's cert-manager keeps
-  # owning the TLS certificate for those hosts.
+  # Serve ACME challenges via nginx on port 80
   services.nginx = {
     enable = true;
-    recommendedProxySettings = true;
-
-    # SNI passthrough on 443:
-    #   - mail.rubenhensen.nl (and anything else) → local stalwart on 8443
-    #   - tunneled hosts → home cluster ingress on 443
-    streamConfig = ''
-      map $ssl_preread_server_name $tunnel_upstream {
-${sniMapEntries}
-        default 127.0.0.1:8443;
-      }
-
-      server {
-        listen 443;
-        listen [::]:443;
-        proxy_pass $tunnel_upstream;
-        ssl_preread on;
-      }
-    '';
-
-    # Port 80: tunneled hosts reverse-proxy to the home cluster so its
-    # nginx-ingress handles HTTP→HTTPS redirects and cert-manager
-    # HTTP-01 ACME challenges. Mail-related hosts serve ACME challenges
-    # locally for stalwart's cert and redirect everything else to HTTPS.
-    virtualHosts = tunneledVhosts // {
-      "mail.rubenhensen.nl" = {
-        listen = [
-          { addr = "0.0.0.0"; port = 80; }
-          { addr = "[::]"; port = 80; }
-        ];
-        locations."/.well-known/acme-challenge/".root = "/var/lib/acme/acme-challenge";
-        locations."/".return = "301 https://$host$request_uri";
+    virtualHosts."mail.rubenhensen.nl" = {
+      listen = [
+        { addr = "0.0.0.0"; port = 80; }
+        { addr = "[::]"; port = 80; }
+      ];
+      locations."/.well-known/acme-challenge/" = {
+        root = "/var/lib/acme/acme-challenge";
       };
-      "autoconfig.rubenhensen.nl" = {
-        listen = [
-          { addr = "0.0.0.0"; port = 80; }
-          { addr = "[::]"; port = 80; }
-        ];
-        locations."/.well-known/acme-challenge/".root = "/var/lib/acme/acme-challenge";
-        locations."/".return = "301 https://$host$request_uri";
+      locations."/" = {
+        return = "301 https://$host$request_uri";
       };
-      "autodiscover.rubenhensen.nl" = {
-        listen = [
-          { addr = "0.0.0.0"; port = 80; }
-          { addr = "[::]"; port = 80; }
-        ];
-        locations."/.well-known/acme-challenge/".root = "/var/lib/acme/acme-challenge";
-        locations."/".return = "301 https://$host$request_uri";
+    };
+    virtualHosts."autoconfig.rubenhensen.nl" = {
+      listen = [
+        { addr = "0.0.0.0"; port = 80; }
+        { addr = "[::]"; port = 80; }
+      ];
+      locations."/.well-known/acme-challenge/" = {
+        root = "/var/lib/acme/acme-challenge";
       };
-      "rubenhensen.nl" = {
-        listen = [
-          { addr = "0.0.0.0"; port = 80; }
-          { addr = "[::]"; port = 80; }
-        ];
-        locations."/.well-known/acme-challenge/".root = "/var/lib/acme/acme-challenge";
-        locations."/".return = "301 https://$host$request_uri";
+      locations."/" = {
+        return = "301 https://$host$request_uri";
+      };
+    };
+    virtualHosts."autodiscover.rubenhensen.nl" = {
+      listen = [
+        { addr = "0.0.0.0"; port = 80; }
+        { addr = "[::]"; port = 80; }
+      ];
+      locations."/.well-known/acme-challenge/" = {
+        root = "/var/lib/acme/acme-challenge";
+      };
+      locations."/" = {
+        return = "301 https://$host$request_uri";
+      };
+    };
+    virtualHosts."rubenhensen.nl" = {
+      listen = [
+        { addr = "0.0.0.0"; port = 80; }
+        { addr = "[::]"; port = 80; }
+      ];
+      locations."/.well-known/acme-challenge/" = {
+        root = "/var/lib/acme/acme-challenge";
+      };
+      locations."/" = {
+        return = "301 https://$host$request_uri";
       };
     };
   };
@@ -172,9 +120,7 @@ ${sniMapEntries}
             protocol = "managesieve";
           };
           https = {
-            # nginx owns the public :443 and does SNI passthrough to here
-            # for the mail.rubenhensen.nl SNI. Stalwart still terminates TLS.
-            bind = "127.0.0.1:8443";
+            bind = "[::]:443";
             protocol = "http";
             tls.implicit = true;
           };

renovate.json

@@ -16,8 +16,7 @@
   "kubernetes": {
     "managerFilePatterns": [
       "/apps/templates/.+\\.yaml$/",
-      "/serpbear/.+\\.yaml$/",
-      "/bolletjestrui/.+\\.yaml$/"
+      "/serpbear/.+\\.yaml$/"
     ]
   },
   "customManagers": [