diff --git a/applications/variables.auto.tfvars b/applications/variables.auto.tfvars
new file mode 100644
index 0000000..727550d
--- /dev/null
+++ b/applications/variables.auto.tfvars
@@ -0,0 +1,2115 @@
+kubernetes = {
+  bookstack = {
+    #enabled      = false
+    replicas     = 01
+    image        = "linuxserver/bookstack:latest"
+    service_port = [80, 443]
+    domain_name  = "bookstack"
+    database = {
+      "engine"    = "mysql"
+      "image"     = "lscr.io/linuxserver/mariadb"
+      "port"      = 3306
+      "mountPath" = "/config"
+      username    = "bookstack_username"
+      name        = "bookstackapp"
+    }
+    config_map_ref    = ["config"]
+    secret_ref        = ["bookstack-credentials"]
+    config_map_import = ["bb9a8965-994a-4fea-9411-b4020182fa78"]
+    secret_import     = ["d1c2b8c9-71a0-4e47-9d9d-b402018376b6"]
+
+    pvc = {
+      bookstack-webserver = {
+        name       = "bookstack-webserver"
+        pvc        = true
+        pvc_size   = "2Gi"
+        mount_path = "/config"
+      }
+    }
+  }
+
+
+
+  screeps = {
+    enabled      = false
+    name         = "screeps-server"
+    image        = "screepers/screeps-launcher"
+    service_port = [21025]
+    service_type = "LoadBalancer"
+
+    environment = {
+      STEAM_KEY = {
+        value = "F2B37945342AD0DBD6DCAF3440E77C4E"
+      }
+    }
+    requirements = {
+      limits-cpu      = "1000m"
+      limits-memory   = "1Gi"
+      requests-cpu    = "500m"
+      requests-memory = "400Mi"
+    }
+    pvc = {
+      screeps-volume = {
+        name       = "screeps"
+        pvc_size   = "1Gi"
+        pvc        = true
+        mount_path = "/screeps"
+      }
+    }
+
+  }
+
+  minecraft = {
+    enabled      = false
+    image        = "itzg/minecraft-server"
+    service_port = [25565]
+    service_type = "LoadBalancer"
+
+    environment = {
+      EULA = {
+        value = "TRUE"
+      }
+      ONLINE_MODE = {
+        value = "FALSE"
+      }
+      VERSION = {
+        value = "1.21.8"
+      }
+    }
+
+
+    #requirements = {
+    #  limits-cpu      = "1000m"
+    #  limits-memory   = "1Gi"
+    #  requests-cpu    = "500m"
+    #  requests-memory = "400Mi"
+    #}
+    pvc = {
+      minecraft-volume = {
+        name       = "minecraft"
+        pvc_size   = "1Gi"
+        pvc        = true
+        mount_path = "/data"
+      }
+    }
+
+  }
+
+
+  stirling = {
+    enabled      = false
+    name         = "stirling-pdf"
+    image        = "stirlingtools/stirling-pdf:2.0.0"
+    domain_name  = "stirling"
+    service_port = [8080]
+
+    environment = {
+      LANGS = {
+        value = "en_GB"
+      }
+      SECURITY_ENABLELOGIN = {
+        value = "false"
+      }
+    }
+    #    requirements = {
+    #      limits-cpu      = "100m"
+    #      limits-memory   = "300Mi"
+    #      requests-cpu    = "50m"
+    #      requests-memory = "150Mi"
+    #    }
+    pvc = {
+      stirling-volume = {
+        name       = "stirling-pdf"
+        pvc_size   = "100Mi"
+        pvc        = true
+        mount_path = "/configs"
+      }
+    }
+
+  }
+
+
+
+  stash = {
+    #  enabled      = false
+    replicas = 0
+    name     = "stash"
+    #image        = "stashapp/stash:latest"
+    image        = "stashapp/stash:v0.30.1"
+    service_port = [9999]
+    #extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/stash/stash-reddit-dowloader.configmap.yml"]
+    environment = {
+      STASH_STASH = {
+        value = "/data/"
+      }
+      STASH_GENERATED = {
+        value = "/generated/"
+      }
+      STASH_METADATA = {
+        value = "/metadata/"
+      }
+      STASH_CACHE = {
+        value = "/cache/"
+      }
+      STASH_PORT = {
+        value = "9999"
+      }
+    }
+    requirements = {
+      limits-cpu      = "1000m"
+      limits-memory   = "3000Mi"
+      requests-cpu    = "50m"
+      requests-memory = "150Mi"
+    }
+    pvc = {
+      data = {
+        name               = "data"
+        pvc_size           = "100Mi"
+        pvc                = true
+        mount_path         = "/data"
+        storage_class_name = "nfs-storage-fastaccess"
+      }
+      metadata = {
+        name       = "metadata"
+        pvc_size   = "100Mi"
+        pvc        = true
+        mount_path = "/metadata"
+      }
+      generated = {
+        name       = "generated"
+        pvc_size   = "100Mi"
+        pvc        = true
+        mount_path = "/generated"
+      }
+      config = {
+        name       = "config"
+        pvc_size   = "100Mi"
+        pvc        = true
+        mount_path = "/root/.stash"
+      }
+    }
+
+  }
+
+
+  onitama = {
+    enabled      = false
+    namespace    = "onitama"
+    domain_name  = "onitama"
+    image        = "ghcr.io/jackadamson/onitama:latest"
+    service_port = [8080]
+    requirements = {
+      limits-cpu      = "50m"
+      limits-memory   = "50Mi"
+      requests-cpu    = "25m"
+      requests-memory = "25Mi"
+    }
+    environment = {
+      PORT = {
+        value = "80"
+      }
+    }
+
+  }
+
+
+
+  nginx = {
+    enabled   = false
+    namespace = "testnginx"
+    image     = "nginx:latest"
+    #pvc_size     = "10Mi"
+    #    mount_path        = "/code"
+    #    service_port      = 80
+    #    liveness_http_get = 80
+    #    requirements = {
+    #      limits-cpu      = "200m"
+    #      limits-memory   = "200Mi"
+    #      requests-cpu    = "50m"
+    #      requests-memory = "50Mi"
+    #    }
+    #    environment_variables = [{
+    #      "name" : "NGINX_PORT",
+    #      "value" : "80"
+    #      name  = "NGINX-second_PORT" ,     value = "81"
+    #    }]
+    environment_variables = { t1est = "tset", a2nother = "rehtona" }
+    #    environment_variables = { t1est = "tset" }
+    #    environment_variables = {
+    #      name  = "NGINX_PORT" ,     value = "80"
+    #      name  = "NGINX-second_PORT" ,     value = "81"
+    #    }
+    pvc = {
+      first = {
+        name       = "nginx"
+        pvc_size   = "1Mi"
+        mount_path = "/code"
+      }
+    }
+  }
+
+  redis = {
+    enabled             = false
+    image               = "redis"
+    service_port        = [6379]
+    liveness_tcp_socket = 6379
+    #   environment_variables = [{
+    #     "name" : "redis_PORT",
+    #     "value" : "6379"
+    #   }]
+  }
+
+  vulcan = {
+    enabled      = false
+    image        = "localhost:31795/vulcan-frontend:latest"
+    service_port = [80]
+    requirements = {
+      limits-cpu      = "50m"
+      limits-memory   = "50Mi"
+      requests-cpu    = "50m"
+      requests-memory = "50Mi"
+    }
+  }
+  bwdownload = {
+    enabled   = false
+    namespace = "backup-bitwarden"
+    image     = "alpine"
+    requirements = {
+      limits-cpu      = "50m"
+      limits-memory   = "50Mi"
+      requests-cpu    = "50m"
+      requests-memory = "50Mi"
+    }
+  }
+  gogs = {
+    enabled = false
+    image   = "gogs/gogs"
+    requirements = {
+      limits-cpu      = "50m"
+      limits-memory   = "50Mi"
+      requests-cpu    = "50m"
+      requests-memory = "50Mi"
+    }
+    service_port = [3000]
+    pvc_size     = "1Gi"
+    mount_path   = "/data"
+  }
+
+
+  notmuch = {
+    enabled      = false
+    image        = "kalbasit/notmuch"
+    service_port = [80]
+  }
+
+  spider = {
+    #needs to create a secret.key on the pvc
+    enabled = false
+    image   = "iredmail/spider:latest"
+    requirements = {
+      limits-cpu      = "200m"
+      limits-memory   = "500Mi"
+      requests-cpu    = "50m"
+      requests-memory = "50Mi"
+    }
+    service_port = [8080]
+    pvc = {
+      spider-data = {
+        pvc        = true
+        name       = "spider-data"
+        pvc_size   = "100Mi"
+        mount_path = "/opt/spider"
+      }
+    }
+  }
+
+  piler = {
+    enabled = false
+    image   = "sutoj/piler:1.4.5"
+    requirements = {
+      limits-cpu      = "200m"
+      limits-memory   = "500Mi"
+      requests-cpu    = "50m"
+      requests-memory = "50Mi"
+    }
+    service_port = [80]
+  }
+
+
+  paperless = {
+    #enabled   = false
+    #namespace = "paper"
+    #replicas       = 0
+    image        = "ghcr.io/paperless-ngx/paperless-ngx:2.18.4"
+    service_port = [8000]
+    domain_name  = "paperless2"
+    database = {
+      image     = "postgres:15.6"
+      mountPath = "/var/lib/postgresql/data"
+    }
+    redis = {
+    image = "redis:7.4.1" }
+    #requirements = {
+    #  limits-cpu      = "800m"
+    #  limits-memory   = "800Mi"
+    #  requests-cpu    = "10m"
+    #  requests-memory = "300Mi"
+    #}
+    extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/paperless/Paperless.secret.yaml"]
+    #config_map_ref = ["config"]
+
+    environment = {
+      POSTGRES_DB = {
+        value_from = {
+          secret_key_ref = {
+            name = "paperless-credentials"
+            key  = "POSTGRES_DB"
+          }
+        }
+      }
+      POSTGRES_USER = {
+        value_from = {
+          secret_key_ref = {
+            name = "paperless-credentials"
+            key  = "POSTGRES_USER"
+          }
+        }
+      }
+      POSTGRES_PASSWORD = {
+        value_from = {
+          secret_key_ref = {
+            name = "paperless-credentials"
+            key  = "POSTGRES_PASSWORD"
+          }
+        }
+      }
+      PAPERLESS_URL = {
+        value = "https://paperless.geeraert.eu"
+      }
+      PAPERLESS_TIKA_ENABLED = {
+        value = "1"
+      }
+      PAPERLESS_TIKA_GOTENBERG_ENDPOINT = {
+        value = "http://gotenberg-svc.paperless.svc:3000"
+      }
+      PAPERLESS_TIKA_ENDPOINT = {
+        value = "http://tika-svc.paperless.svc:9998"
+      }
+
+
+      PAPERLESS_DBHOST = {
+        value_from = {
+          secret_key_ref = {
+            name = "paperless-credentials"
+            key  = "POSTGRES_HOST"
+          }
+        }
+      }
+
+      PAPERLESS_REDIS = {
+        value = "redis://paperless-redis-svc:6379"
+      }
+
+      PAPERLESS_ADMIN_USER = {
+        value_from = {
+          secret_key_ref = {
+            name = "paperless-credentials"
+            key  = "POSTGRES_USER"
+          }
+        }
+      }
+      PAPERLESS_ADMIN_PASSWORD = {
+        value_from = {
+          secret_key_ref = {
+            name = "paperless-credentials"
+            key  = "POSTGRES_PASSWORD"
+          }
+        }
+      }
+
+      #      PAPERLESS_ADMIN_USER = {
+      #        value = "admin"
+      #      }
+      #      PAPERLESS_ADMIN_PASSWORD = {
+      #        value = "admin"
+      #      }
+
+      PAPERLESS_OCR_USER_ARGS = {
+        value = "{'invalidate_digital_signatures': true}"
+      }
+    }
+    pvc = {
+      paperless-data = {
+        pvc        = true
+        name       = "paperless-data"
+        pvc_size   = "2Mi"
+        mount_path = "/usr/src/paperless/data"
+      }
+      paperless-media = {
+        pvc        = true
+        name       = "paperless-media"
+        pvc_size   = "2Mi"
+        mount_path = "/usr/src/paperless/media"
+      }
+      #    export = {
+      #      host_path  = "/tmp"
+      #      name       = "export"
+      #      pvc_size   = "2Mi"
+      #      mount_path = "/usr/src/paperless/export"
+      #    }
+      consume = {
+        pvc        = true
+        name       = "consume"
+        pvc_size   = "2Mi"
+        mount_path = "/usr/src/paperless/consume"
+      }
+    }
+  }
+  gotenberg = {
+    #enabled             = false
+    name                = "gotenberg"
+    command             = ["gotenberg", "--chromium-disable-javascript=true", "--chromium-allow-list=file:///tmp/.*", "--chromium-auto-start"]
+    connected_namespace = "paperless"
+    image               = "gotenberg/gotenberg:8"
+    #image        = "gotenberg/gotenberg:7.4.3"
+    service_port = [3000]
+    environment = {
+      CHROMIUM_PAPER_WIDTH = {
+        value = "595"
+      }
+
+      CHROMIUM_PAPER_HEIGHT = {
+        value = "842"
+      }
+
+      CHROMIUM_MARGIN_TOP = {
+        value = "7.2"
+      }
+
+      CHROMIUM_MARGIN_BOTTOM = {
+        value = "7.2"
+      }
+
+      CHROMIUM_MARGIN_LEFT = {
+        value = "7.2"
+      }
+
+      CHROMIUM_MARGIN_RIGHT = {
+        value = "7.2"
+      }
+      GOTENBERG_CHROMIUM_STARTUP_TIMEOUT = {
+        value = "60s"
+      }
+      GOTENBERG_BUILD_DEBUG_DATA = {
+        value = "false"
+      }
+      GOTENBERG_CHROMIUM_ARGS = {
+        value = "--no-sandbox,--disable-dev-shm-usage,--no-zygote"
+      }
+    }
+
+    pvc = {
+      devshm = {
+        host_path  = "/tmp"
+        name       = "devshm"
+        pvc_size   = "2Mi"
+        mount_path = "/dev/shm"
+      }
+    }
+    requirements = {
+      limits-cpu      = "1"
+      limits-memory   = "1000Mi"
+      requests-cpu    = "500m"
+      requests-memory = "512Mi"
+    }
+
+
+  }
+  tika = {
+    #enabled             = false
+    name                = "tika"
+    connected_namespace = "paperless"
+    image               = "docker.io/apache/tika:latest"
+    service_port        = [9998]
+    requirements = {
+      limits-cpu      = "1"
+      limits-memory   = "1000Mi"
+      requests-cpu    = "500m"
+      requests-memory = "512Mi"
+    }
+
+
+  }
+
+  emailproxy = {
+    enabled             = false
+    name                = "email-oauth2-proxy"
+    connected_namespace = "paper"
+    dns_nameservers     = "1.1.1.1"
+    image               = "blacktirion/email-oauth2-proxy-docker"
+    #command             = ["python", "emailproxy.py", "--no-gui", "--external-auth", "--debug", "--cache-store", "/config/credstore.config", "--config-file", "/config/emailproxy.config", "--log-file", "/config/emailproxy.log"]
+    #extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/paperless/emailproxyconfig.configmap.yml"]
+    service_port = [80, 1993, 1995]
+    requirements = {
+      limits-cpu      = "1"
+      limits-memory   = "1000Mi"
+      requests-cpu    = "500m"
+      requests-memory = "512Mi"
+    }
+    environment = {
+      LOGFILE = {
+        value = true
+      }
+      DEBUG = {
+        value = true
+      }
+      CACHE_STORE = {
+        value = "/config/credstore.config"
+      }
+      LOCAL_SERVER_AUTH = { value = true }
+    }
+    pvc = {
+      emailproxy-config = {
+        #config_map = true
+        pvc      = true
+        name     = "emailproxyconfig"
+        pvc_size = "2Mi"
+        #mount_path = "/config/emailproxy.config"
+        mount_path = "/config/"
+      }
+
+    }
+
+
+  }
+
+
+
+
+  nextcloud = {
+    enabled   = false
+    namespace = "next"
+    #replicas     = 0
+    image        = "nextcloud:29.0.3-apache"
+    domain_name  = "next"
+    service_port = [80]
+    #extra_manifest = ["/opt/kubernetes/Nextcloud_kube/next.secret.yaml"]
+    secret_ref    = ["nextcloud-credentials"]
+    secret_import = ["b207c4b6-0489-4ab2-a032-b4a400a708e0"]
+    database = {
+    image = "docker.io/library/postgres:14" }
+    redis = {
+    image = "docker.io/library/redis:7" }
+    #requirements = {
+    #  limits-cpu      = "800Mi"
+    #  limits-memory   = "800Mi"
+    #  requests-cpu    = "800Mi"
+    #  requests-memory = "800Mi"
+    #}
+    environment = {
+
+      TRUSTED_PROXIES = {
+        value = "192.168.88.50 192.168.88.52"
+      }
+      OVERWRITECLIURL = {
+        value = "https://next.geeraert.eu"
+      }
+      OVERWRITEPROTOCOL = {
+        value = "https"
+      }
+
+      NEXTCLOUD_TRUSTED_DOMAINS = {
+        value = "next.geeraert.eu next.tryton.geeraert.eu 192.168.88.52"
+      }
+      NEXTCLOUD_ADMIN_USER = {
+        value = "admin"
+      }
+      NEXTCLOUD_ADMIN_PASSWORD = {
+        value_from = {
+          secret_key_ref = {
+            name = "nextcloud-credentials"
+            key  = "PI_USER_PASSWORD"
+          }
+        }
+      }
+
+    }
+    pvc = {
+      nextcloud-webserver = {
+        name       = "nextcloud-webserver"
+        pvc_size   = "2Mi"
+        pvc        = true
+        mount_path = "/var/www/html"
+      }
+    }
+
+
+
+  }
+
+
+  neko = {
+    enabled      = false
+    name         = "neko"
+    image        = "ghcr.io/m1k1o/neko/firefox:latest"
+    service_port = [8080]
+
+    environment = {
+
+      NEKO_WEBRTC_EPR = {
+        value = "56000-56100"
+      }
+      NEKO_WEBRTC_NAT1TO1 = {
+        value = "127.0.0.1"
+      }
+
+      NEKO_MEMBER_MULTIUSER_USER_PASSWORD = {
+        value = "neko"
+      }
+      NEKO_MEMBER_MULTIUSER_ADMIN_PASSWORD = {
+        value = "admin"
+      }
+    }
+    requirements = {
+      limits-cpu      = "900m"
+      limits-memory   = "600Mi"
+      requests-cpu    = "300m"
+      requests-memory = "400Mi"
+    }
+
+  }
+
+  homeassistant = {
+    enabled      = false
+    image        = "ghcr.io/home-assistant/home-assistant:stable"
+    service_port = [8123]
+
+    environment = {
+
+      PORT = {
+        value = "80"
+      }
+    }
+    pvc = {
+      homeassistant-config = {
+        pvc        = true
+        name       = "homeassistant-config"
+        pvc_size   = "2Mi"
+        mount_path = "/config"
+      }
+      etc_localtime = {
+        host_path  = "/etc/localtime"
+        name       = "export"
+        pvc_size   = "2Mi"
+        mount_path = "/etc/localtime"
+      }
+    }
+    requirements = {
+      limits-cpu      = "900m"
+      limits-memory   = "600Mi"
+      requests-cpu    = "300m"
+      requests-memory = "400Mi"
+    }
+
+  }
+
+  jellyfin = {
+    enabled      = false
+    replicas     = 0
+    image        = "jellyfin/jellyfin:latest"
+    service_port = [8096]
+
+    environment = {
+
+      JELLYFIN_PublishedServerUrl = {
+        value = "https://jellyfin.geeraert.eu"
+      }
+    }
+    pvc = {
+      jellyfin-config = {
+        pvc        = true
+        name       = "jellyfin-config"
+        pvc_size   = "2Mi"
+        mount_path = "/config"
+      }
+      jellyfin-cache = {
+        pvc        = true
+        name       = "jellyfin-cache"
+        pvc_size   = "2Mi"
+        mount_path = "/cache"
+      }
+      jellyfin-date = {
+        host_path  = "/data"
+        name       = "export"
+        pvc_size   = "2Mi"
+        mount_path = "/data"
+      }
+    }
+    #    requirements = {
+    #      limits-cpu      = "900m"
+    #      limits-memory   = "600Mi"
+    #      requests-cpu    = "300m"
+    #      requests-memory = "400Mi"
+    #    }
+
+  }
+  dupeguru = {
+    enabled      = false
+    image        = "jlesage/dupeguru"
+    service_port = [5800]
+
+    pvc = {
+      dupeguru-config = {
+        pvc        = true
+        name       = "dupeguru-config"
+        pvc_size   = "2Mi"
+        mount_path = "/config"
+      }
+      dupeguru-storage = {
+        pvc        = true
+        name       = "dupeguru-storage"
+        pvc_size   = "2Mi"
+        mount_path = "/storage"
+      }
+      dupeguru-duplicate = {
+        host_path  = "/data"
+        name       = "dupeguru-duplicate"
+        pvc_size   = "2Mi"
+        mount_path = "/duplicate"
+      }
+    }
+    requirements = {
+      limits-cpu      = "900m"
+      limits-memory   = "600Mi"
+      requests-cpu    = "300m"
+      requests-memory = "400Mi"
+    }
+
+  }
+  pinchflat = {
+    enabled             = false
+    connected_namespace = "screeps"
+    image               = "ghcr.io/kieraneglin/pinchflat:latest"
+    service_port        = [8945]
+
+    pvc = {
+      pinchflat-config = {
+        pvc        = true
+        name       = "pinchflat-config"
+        pvc_size   = "2Mi"
+        mount_path = "/config"
+      }
+      pinchflat-storage = {
+        pvc        = true
+        name       = "pinchflat-storage"
+        pvc_size   = "2Mi"
+        mount_path = "/downloads"
+      }
+    }
+    requirements = {
+      limits-cpu      = "900m"
+      limits-memory   = "600Mi"
+      requests-cpu    = "300m"
+      requests-memory = "400Mi"
+    }
+
+  }
+  jobspy = {
+    enabled             = false
+    connected_namespace = "stash"
+    image               = "rainmanjam/jobspy-api:latest"
+    service_port        = [8000]
+    environment = {
+      ENABLE_API_KEY_AUTH = {
+        value = "true"
+      }
+      API_KEYS = {
+        value = "true"
+      }
+    }
+    requirements = {
+      limits-cpu      = "900m"
+      limits-memory   = "600Mi"
+      requests-cpu    = "300m"
+      requests-memory = "400Mi"
+    }
+
+  }
+
+
+  prowlarr = {
+    #    enabled             = false
+    image     = "linuxserver/prowlarr:latest"
+    namespace = "servarr"
+    #replicas       = 0
+    #    dns_nameservers     = "10.2.0.1"
+    service_port   = [9696]
+    extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/servarr/servarr-db.secret.yaml"]
+    database = {
+      "image"   = "docker.io/library/postgres:17.5"
+      name      = "prowlarr-main"
+      username  = "servarr_username"
+      mountPath = "/var/lib/postgresql/data"
+    }
+
+    environment = {
+      PUID = {
+        value = "1000"
+      }
+      PGID = {
+        value = "1000"
+      }
+      TZ = {
+        value = "Etc/UTC"
+      }
+
+
+
+      POSTGRES_DB = {
+        value_from = {
+          secret_key_ref = {
+            name = "servarr-db-credentials"
+            key  = "DB_DATABASE"
+          }
+        }
+      }
+      POSTGRES_USER = {
+        value_from = {
+          secret_key_ref = {
+            name = "servarr-db-credentials"
+            key  = "DB_USER"
+          }
+        }
+      }
+      POSTGRES_PASSWORD = {
+        value_from = {
+          secret_key_ref = {
+            name = "servarr-db-credentials"
+            key  = "DB_PASS"
+          }
+        }
+      }
+
+
+    }
+    pvc = {
+      prowlarr-config = {
+        name       = "prowlarr-config"
+        pvc_size   = "10Mi"
+        pvc        = true
+        mount_path = "/config"
+      }
+      servarr-data = {
+        name       = "servarr-data"
+        pvc_size   = "10Mi"
+        pvc        = false
+        host_path  = "/data"
+        mount_path = "/disk"
+      }
+    }
+
+  }
+
+  radarr = {
+    #enabled             = false
+    image               = "lscr.io/linuxserver/radarr:latest"
+    connected_namespace = "servarr"
+    #replicas       = 0
+    service_port = [7878]
+
+    environment = {
+      PUID = {
+        value = "1000"
+      }
+      PGID = {
+        value = "1000"
+      }
+      TZ = {
+        value = "Etc/UTC"
+      }
+    }
+    #    requirements = {
+    #      limits-cpu      = "1000m"
+    #      limits-memory   = "1Gi"
+    #      requests-cpu    = "500m"
+    #      requests-memory = "400Mi"
+    #    }
+    pvc = {
+      radarr-config = {
+        name       = "radarr-config"
+        pvc_size   = "10Mi"
+        pvc        = true
+        mount_path = "/config"
+      }
+      servarr-data = {
+        name       = "servarr-data"
+        pvc_size   = "10Mi"
+        pvc        = false
+        host_path  = "/data"
+        mount_path = "/disk"
+      }
+    }
+
+  }
+
+
+  sonarr = {
+    #enabled             = false
+    image               = "lscr.io/linuxserver/sonarr:latest"
+    connected_namespace = "servarr"
+    #replicas       = 0
+    service_port = [8989]
+
+    environment = {
+      PUID = {
+        value = "1000"
+      }
+      PGID = {
+        value = "1000"
+      }
+      TZ = {
+        value = "Etc/UTC"
+      }
+    }
+    #    requirements = {
+    #      limits-cpu      = "1000m"
+    #      limits-memory   = "1Gi"
+    #      requests-cpu    = "500m"
+    #      requests-memory = "400Mi"
+    #    }
+    pvc = {
+      sonarr-config = {
+        name       = "sonarr-config"
+        pvc_size   = "10Mi"
+        pvc        = true
+        mount_path = "/config"
+      }
+      servarr-data = {
+        name       = "servarr-data"
+        pvc_size   = "10Mi"
+        pvc        = false
+        host_path  = "/data"
+        mount_path = "/disk"
+      }
+    }
+
+  }
+  recommendarr = {
+    enabled             = false
+    image               = "tannermiddleton/recommendarr:latest"
+    connected_namespace = "servarr"
+    #replicas       = 0
+    service_port = [3000]
+
+    environment = {
+      PUID = {
+        value = "1000"
+      }
+      PGID = {
+        value = "1000"
+      }
+      TZ = {
+        value = "Etc/UTC"
+      }
+    }
+    #    requirements = {
+    #      limits-cpu      = "1000m"
+    #      limits-memory   = "1Gi"
+    #      requests-cpu    = "500m"
+    #      requests-memory = "400Mi"
+    #    }
+    pvc = {
+      recommendarr-config = {
+        name       = "recommendarr-config"
+        pvc_size   = "10Mi"
+        pvc        = true
+        mount_path = "/app/server/data"
+      }
+    }
+
+  }
+  qbittorrent = {
+    #enabled             = false
+    image               = "lscr.io/linuxserver/qbittorrent:latest"
+    connected_namespace = "servarr"
+    service_port        = [8080]
+
+    environment = {
+      PUID = {
+        value = "1000"
+      }
+      PGID = {
+        value = "1000"
+      }
+      TZ = {
+        value = "Etc/UTC"
+      }
+      WEBUI_PORT = {
+        value = "8080"
+      }
+
+    }
+    requirements = {
+      limits-cpu      = "200m"
+      limits-memory   = "250Mi"
+      requests-cpu    = "100m"
+      requests-memory = "100Mi"
+    }
+    pvc = {
+      qbittorrent-config = {
+        name       = "qbittorrent-config"
+        pvc_size   = "10Mi"
+        pvc        = true
+        mount_path = "/config"
+      }
+      servarr-data = {
+        name       = "servarr-data"
+        pvc_size   = "10Mi"
+        pvc        = false
+        host_path  = "/data"
+        mount_path = "/disk"
+      }
+    }
+
+  }
+
+
+  flaresolverr = {
+    #image               = "ghcr.io/flaresolverr/flaresolverr:latest"
+    image = "alexfozor/flaresolverr:pr-1300-experimental"
+
+    connected_namespace = "servarr"
+    #enabled             = false
+    image        = "ghcr.io/flaresolverr/flaresolverr:latest"
+    service_port = [8191]
+
+    environment = {
+      PUID = {
+        value = "1000"
+      }
+      PGID = {
+        value = "1000"
+      }
+      TZ = {
+        value = "Etc/UTC"
+      }
+      CAPTCHA_SOLVER = { value = "hcaptcha-solver"
+      }
+
+    }
+    #    requirements = {
+    #      limits-cpu      = "1000m"
+    #      limits-memory   = "1Gi"
+    #      requests-cpu    = "500m"
+    #      requests-memory = "400Mi"
+    #    }
+
+  }
+
+  poste = {
+    enabled      = false
+    image        = "analogic/poste.io:latest"
+    service_port = [25, 80, 110, 143, 443, 465, 587, 993, 995, 4190]
+
+    environment = {
+      PUID = {
+        value = "1000"
+      }
+      PGID = {
+        value = "1000"
+      }
+      TZ = {
+        value = "Etc/UTC"
+      }
+    }
+    #    requirements = {
+    #      limits-cpu      = "1000m"
+    #      limits-memory   = "1Gi"
+    #      requests-cpu    = "500m"
+    #      requests-memory = "400Mi"
+    #    }
+
+    pvc = {
+      poste-data = {
+        name       = "poste-data"
+        pvc_size   = "10Mi"
+        pvc        = true
+        mount_path = "/data"
+      }
+    }
+
+  }
+
+  wikijs = {
+    #enabled        = false
+    image        = "ghcr.io/requarks/wiki:2.5"
+    service_port = [3000]
+    #domain_name = "wikijs"
+    extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/wikijs/wikijs-db.secret.yaml"]
+    database = {
+      image     = "postgres:17"
+      name      = "wiki"
+      username  = "wikijs_username"
+      mountPath = "/var/lib/postgresql/data"
+    }
+
+    environment = {
+      PUID = {
+        value = "1000"
+      }
+      PGID = {
+        value = "1000"
+      }
+      TZ = {
+        value = "Etc/UTC"
+      }
+      DB_TYPE = { value = "postgres" }
+      DB_PORT = { value = "5432" }
+
+      POSTGRES_DB = {
+        value_from = {
+          secret_key_ref = {
+            name = "wikijs-db-credentials"
+            key  = "DB_DATABASE"
+          }
+        }
+      }
+      POSTGRES_USER = {
+        value_from = {
+          secret_key_ref = {
+            name = "wikijs-db-credentials"
+            key  = "DB_USER"
+          }
+        }
+      }
+      POSTGRES_PASSWORD = {
+        value_from = {
+          secret_key_ref = {
+            name = "wikijs-db-credentials"
+            key  = "DB_PASS"
+          }
+        }
+      }
+
+      DB_NAME = {
+        value_from = {
+          secret_key_ref = {
+            name = "wikijs-db-credentials"
+            key  = "DB_DATABASE"
+          }
+        }
+      }
+      DB_USER = {
+        value_from = {
+          secret_key_ref = {
+            name = "wikijs-db-credentials"
+            key  = "DB_USER"
+          }
+        }
+      }
+      DB_PASS = {
+        value_from = {
+          secret_key_ref = {
+            name = "wikijs-db-credentials"
+            key  = "DB_PASS"
+          }
+        }
+      }
+      DB_HOST = {
+        value_from = {
+          secret_key_ref = {
+            name = "wikijs-db-credentials"
+            key  = "DB_HOST"
+          }
+        }
+      }
+
+
+    }
+
+
+  }
+
+  immich = {
+    #enabled = false
+    #replicas     = 0
+    connected_namespace = "immich"
+    image               = "ghcr.io/immich-app/immich-server:v3.0.0"
+    service_port        = [2283]
+    database = {
+      image     = "ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0"
+      mountPath = "/var/lib/postgresql/data"
+    }
+
+    redis = {
+    image = "docker.io/valkey/valkey:9@sha256:4963247afc4cd33c7d3b2d2816b9f7f8eeebab148d29056c2ca4d7cbc966f2d9" }
+    requirements = {
+      limits-cpu      = "800m"
+      limits-memory   = "2Gi"
+      requests-cpu    = "10m"
+      requests-memory = "300Mi"
+    }
+    extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/immich/immich-db.secret.yaml"]
+
+    environment = {
+      DB_DATABASE_NAME = {
+        value_from = {
+          secret_key_ref = {
+            name = "immich-db-credentials"
+            key  = "DB_DATABASE_NAME"
+          }
+        }
+      }
+      DB_USERNAME = {
+        value_from = {
+          secret_key_ref = {
+            name = "immich-db-credentials"
+            key  = "DB_USERNAME"
+          }
+        }
+      }
+      DB_PASSWORD = {
+        value_from = {
+          secret_key_ref = {
+            name = "immich-db-credentials"
+            key  = "DB_PASSWORD"
+          }
+        }
+      }
+      POSTGRES_DATABASE = {
+        value_from = {
+          secret_key_ref = {
+            name = "immich-db-credentials"
+            key  = "DB_DATABASE_NAME"
+          }
+        }
+      }
+      POSTGRES_USER = {
+        value_from = {
+          secret_key_ref = {
+            name = "immich-db-credentials"
+            key  = "DB_USERNAME"
+          }
+        }
+      }
+      POSTGRES_PASSWORD = {
+        value_from = {
+          secret_key_ref = {
+            name = "immich-db-credentials"
+            key  = "DB_PASSWORD"
+          }
+        }
+      }
+
+      POSTGRES_POSTGRES_PASSWORD = {
+        value_from = {
+          secret_key_ref = {
+            name = "immich-db-credentials"
+            key  = "DB_PASSWORD"
+          }
+        }
+      }
+
+
+      DB_HOSTNAME = {
+        value_from = {
+          secret_key_ref = {
+            name = "immich-db-credentials"
+            key  = "DB_HOST"
+          }
+        }
+      }
+
+      IMMICH_MACHINE_LEARNING_URL         = { value = "http://machinelearning-svc:3003" }
+      REDIS_HOSTNAME                      = { value = "immich-redis-svc" }
+      UPLOAD_LOCATION                     = { value = "/tmp" }
+      POSTGRESQL_ENABLE_LDAP              = { value = "no" }
+      POSTGRESQL_ENABLE_TLS               = { value = "no" }
+      POSTGRESQL_LOG_HOSTNAME             = { value = "false" }
+      POSTGRESQL_LOG_CONNECTIONS          = { value = "false" }
+      POSTGRESQL_LOG_DISCONNECTIONS       = { value = "false" }
+      POSTGRESQL_PGAUDIT_LOG_CATALOG      = { value = "off" }
+      POSTGRESQL_CLIENT_MIN_MESSAGES      = { value = "error" }
+      POSTGRESQL_SHARED_PRELOAD_LIBRARIES = { value = "pgaudit" }
+      POSTGRES_INITDB_ARGS                = { value = "--data-checksums" }
+
+      BITNAMI_DEBUG          = { value = "false" }
+      REDIS_REPLICATION_MODE = { value = "master" }
+      ALLOW_EMPTY_PASSWORD   = { value = "yes" }
+      REDIS_TLS_ENABLED      = { value = "no" }
+      REDIS_PORT             = { value = "6379" }
+
+    }
+    pvc = {
+      immich-data = {
+        name       = "immich-data"
+        pvc_size   = "10Mi"
+        pvc        = false
+        host_path  = "/ssd/Image/immich/immich-storage-fastaccess"
+        mount_path = "/usr/src/app/upload"
+      }
+      stash-data = {
+        name       = "stash-data"
+        pvc_size   = "10Mi"
+        pvc        = false
+        host_path  = "/ssd/stash/data-pvc"
+        mount_path = "/stash/"
+      }
+
+    }
+  }
+  machinelearning = {
+    #enabled = false
+    #replicas = 0
+    connected_namespace = "immich"
+    image               = "ghcr.io/immich-app/immich-machine-learning:v2.5.6"
+    service_port        = [3003]
+    environment = {
+      DB_DATABASE_NAME = {
+        value_from = {
+          secret_key_ref = {
+            name = "immich-db-credentials"
+            key  = "DB_DATABASE_NAME"
+          }
+        }
+      }
+      DB_USERNAME = {
+        value_from = {
+          secret_key_ref = {
+            name = "immich-db-credentials"
+            key  = "DB_USERNAME"
+          }
+        }
+      }
+      DB_PASSWORD = {
+        value_from = {
+          secret_key_ref = {
+            name = "immich-db-credentials"
+            key  = "DB_PASSWORD"
+          }
+        }
+      }
+      DB_HOSTNAME = {
+        value_from = {
+          secret_key_ref = {
+            name = "immich-db-credentials"
+            key  = "DB_HOST"
+          }
+        }
+      }
+
+      IMMICH_MACHINE_LEARNING_URL = {
+        value = "http://machinelearning-svc:3003"
+      }
+
+      REDIS_HOSTNAME = {
+        value = "immich-redis-svc"
+      }
+
+      TRANSFORMERS_CACHE = {
+        value = "/cache"
+      }
+
+    }
+
+  }
+
+  keycloak = {
+    enabled      = false
+    name         = "keycloak"
+    image        = "quay.io/keycloak/keycloak:25.0.1"
+    service_port = [8080]
+    command      = ["/opt/keycloak/bin/kc.sh", "start-dev"]
+    environment = {
+      KEYCLOAK_ADMIN = {
+        value = "admin"
+      }
+      KEYCLOAK_ADMIN_PASSWORD = {
+        value = "admin"
+      }
+      #KC_DB = {
+      #  value = "dev-mem"
+      #}
+      KC_HTTP_ENABLED = {
+        value = "true"
+      }
+      KC_PROXY_HEADERS = {
+        value = "xforwarded"
+      }
+      KC_HOSTNAME_STRICT = {
+        value = "false"
+      }
+
+      KC_HOSTNAME = {
+        value = "https://keycloak.tryton.geeraert.eu"
+      }
+      KC_HOSTNAME_ADMIN = {
+        value = "https://keycloak.tryton.geeraert.eu"
+      }
+    }
+    requirements = {
+      limits-cpu      = "1000m"
+      limits-memory   = "1Gi"
+      requests-cpu    = "500m"
+      requests-memory = "400Mi"
+    }
+
+  }
+
+
+  echo = {
+    enabled      = false
+    image        = "ealen/echo-server:latest"
+    service_port = [80]
+    #    command      = ["-text=Hello authenticated world!"]
+    pvc = {
+      echo-config = {
+        name       = "echo-config"
+        pvc_size   = "10Mi"
+        pvc        = true
+        mount_path = "/app/configs"
+      }
+    }
+  }
+
+  echo2 = {
+    enabled             = false
+    connected_namespace = "echo"
+    image               = "ealen/echo-server:latest"
+    service_port        = [80]
+    #    command      = ["-text=Hello authenticated world!"]
+    pvc = {
+      echo-config = {
+        name         = "echo-config"
+        pvc_size     = "10Mi"
+        pvc          = true
+        mount_path   = "/app/configs"
+        existing_pvc = true
+      }
+    }
+  }
+
+  oauth2-proxy = {
+    enabled      = false
+    image        = "quay.io/oauth2-proxy/oauth2-proxy:latest"
+    service_port = [4180]
+
+    environment = {
+      OAUTH2_PROXY_PROVIDER = {
+        value = "oidc"
+      }
+      OAUTH2_PROXY_CLIENT_ID = {
+        value = "my-client"
+      }
+      OAUTH2_PROXY_CLIENT_SECRET = {
+        value = "el7RU2DKXhjxhF1wasyz1KhTppvw2lF4"
+      }
+      OAUTH2_PROXY_COOKIE_SECRET = {
+        value = "K70xBsslOnUFh9ehCggywlfb0c8OTzRRiOzdIuDz168="
+      }
+      OAUTH2_PROXY_COOKIE_DOMAIN = {
+        value = "oauthn.tryton.geeraert.eu"
+        #value = "*.tryton.geeraert.eu"
+      }
+
+      OAUTH2_PROXY_OIDC_ISSUER_URL = {
+        value = "https://keycloak.tryton.geeraert.eu/realms/customer"
+      }
+      OAUTH2_PROXY_REDIRECT_URL = {
+        value = "https://echo.tryton.geeraert.eu/oauth2/callback"
+      }
+      OAUTH2_PROXY_EMAIL_DOMAINS = {
+        value = "*"
+      }
+      OAUTH2_PROXY_HTTP_ADDRESS = {
+        value = "0.0.0.0:4180"
+      }
+    }
+
+
+  }
+
+  tdarr = {
+    enabled             = false
+    image               = "ghcr.io/haveagitgat/tdarr"
+    connected_namespace = "servarr"
+    service_port        = [8265, 8266]
+    pvc = {
+      tdarr-config = {
+        name       = "tdarr-config"
+        pvc_size   = "10Mi"
+        pvc        = true
+        mount_path = "/app/configs"
+      }
+      tdarr-server = {
+        name       = "tdarr-server"
+        pvc_size   = "10Mi"
+        pvc        = true
+        mount_path = "/app/server"
+      }
+      tdarr-log = {
+        name       = "tdarr-log"
+        pvc_size   = "10Mi"
+        pvc        = true
+        mount_path = "/app/logs"
+      }
+      servarr-data = {
+        name       = "servarr-data"
+        pvc_size   = "10Mi"
+        pvc        = false
+        host_path  = "/data"
+        mount_path = "/media"
+      }
+      stash-data = {
+        name       = "stash-data"
+        pvc_size   = "10Mi"
+        pvc        = false
+        host_path  = "/ssd/stash/data-pvc/"
+        mount_path = "/stash"
+      }
+
+      tdarr-dri = {
+        name       = "tdarr-dri"
+        pvc_size   = "10Mi"
+        pvc        = false
+        host_path  = "/dev/dri"
+        mount_path = "/dev/dri"
+      }
+      tdarr-transcode-cache = {
+        name       = "tdarr-transcode-cache"
+        pvc_size   = "10Mi"
+        pvc        = true
+        mount_path = "/transcode-cache"
+      }
+
+    }
+
+    environment = {
+      serverIP = {
+        value = "0.0.0.0"
+      }
+      serverPort = {
+        value = "8266"
+      }
+      webUIPort = {
+        value = "8265"
+      }
+      internalNode = {
+        value = "true"
+      }
+      inContainer = {
+        value = "true"
+      }
+      ffmpegVersion = {
+        value = "7"
+      }
+      nodeName = {
+        value = "MyInternalNode"
+      }
+      auth = {
+        value = "false"
+      }
+      openBrowser = {
+        value = "true"
+      }
+      maxLogSizeMB = {
+        value = "10"
+      }
+      cronPluginUpdate = {
+        value = ""
+      }
+      TZ = {
+        value = "Europe/London"
+      }
+      PUID = {
+        value = "1000"
+      }
+      PGID = {
+        value = "1000"
+      }
+      NVIDIA_DRIVER_CAPABILITIES = {
+        value = "all"
+      }
+      NVIDIA_VISIBLE_DEVICES = {
+        value = "all"
+      }
+    }
+
+
+  }
+  tdarr-node = {
+    enabled             = false
+    image               = "ghcr.io/haveagitgat/tdarr_node"
+    connected_namespace = "servarr"
+    replicas            = 2
+    service_port        = [8268]
+    pvc = {
+      tdarrnode-config = {
+        name       = "tdarrnode-config"
+        pvc_size   = "10Mi"
+        pvc        = false
+        host_path  = "/data/kubernetes/servarr/tdarr-config-pvc"
+        mount_path = "/app/configs"
+      }
+      tdarrnode-log = {
+        name       = "tdarrnode-log"
+        pvc_size   = "10Mi"
+        pvc        = true
+        mount_path = "/app/logs"
+      }
+      servarr-data = {
+        name       = "servarr-data"
+        pvc_size   = "10Mi"
+        pvc        = false
+        host_path  = "/data"
+        mount_path = "/media"
+      }
+      tdarrnode-dri = {
+        name       = "tdarrnode-dri"
+        pvc_size   = "10Mi"
+        pvc        = false
+        host_path  = "/dev/dri"
+        mount_path = "/dev/dri"
+      }
+      tdarrnode-transcode-cache = {
+        name       = "tdarrnode-transcode-cache"
+        pvc_size   = "10Mi"
+        pvc        = false
+        host_path  = "/data/kubernetes/servarr/tdarr-transcode-cache-pvc"
+        mount_path = "/transcode-cache"
+      }
+
+    }
+
+    environment = {
+      serverIP = {
+        value = "tdarr-svc"
+      }
+      serverPort = {
+        value = "8266"
+      }
+      nodeType = {
+        value = "mapped"
+      }
+      priority = {
+        value = "-1"
+      }
+      inContainer = {
+        value = "true"
+      }
+      ffmpegVersion = {
+        value = "7"
+      }
+      #      nodeName = {
+      #        value = "MyExternalNode"
+      #      }
+      maxLogSizeMB = {
+        value = "10"
+      }
+      cronPluginUpdate = {
+        value = ""
+      }
+      TZ = {
+        value = "Europe/London"
+      }
+      apikey = {
+        value = ""
+      }
+      pollInterval = {
+        value = "2000"
+      }
+      PUID = {
+        value = "1000"
+      }
+      PGID = {
+        value = "1000"
+      }
+      NVIDIA_DRIVER_CAPABILITIES = {
+        value = "all"
+      }
+      NVIDIA_VISIBLE_DEVICES = {
+        value = "all"
+      }
+      startPaused = {
+        value = "false"
+      }
+      transcodegpuWorkers = {
+        value = "0"
+      }
+      transcodecpuWorkers = {
+        value = "2"
+      }
+      healthcheckgpuWorkers = {
+        value = "0"
+      }
+      healthcheckcpuWorkers = {
+        value = "1"
+      }
+    }
+
+  }
+  tdarr-node2 = {
+    enabled             = false
+    image               = "ghcr.io/haveagitgat/tdarr_node"
+    connected_namespace = "servarr"
+    replicas            = 1
+    service_port        = [8268]
+    pvc = {
+      tdarrnode2-config = {
+        name       = "tdarrnode2-config"
+        pvc_size   = "10Mi"
+        pvc        = false
+        host_path  = "/data/kubernetes/servarr/tdarr-config-pvc"
+        mount_path = "/app/configs"
+      }
+      tdarrnode2-log = {
+        name       = "tdarrnode2-log"
+        pvc_size   = "10Mi"
+        pvc        = true
+        mount_path = "/app/logs"
+      }
+      nfs-data = {
+        name       = "nfs-data"
+        pvc_size   = "10Mi"
+        pvc        = false
+        host_path  = "/mnt/serie"
+        mount_path = "/mnt/serie"
+      }
+      tdarrnode2-dri = {
+        name       = "tdarrnode2-dri"
+        pvc_size   = "10Mi"
+        pvc        = false
+        host_path  = "/dev/dri"
+        mount_path = "/dev/dri"
+      }
+      tdarrnode2-transcode-cache = {
+        name       = "tdarrnode2-transcode-cache"
+        pvc_size   = "10Mi"
+        pvc        = false
+        host_path  = "/mnt/cache"
+        mount_path = "/mnt/cache"
+      }
+
+    }
+
+    environment = {
+      serverIP = {
+        #value = "tdarr-svc"
+        value = "192.168.88.34"
+      }
+      serverPort = {
+        value = "8266"
+      }
+      nodeType = {
+        value = "mapped"
+      }
+      priority = {
+        value = "-1"
+      }
+      inContainer = {
+        value = "true"
+      }
+      ffmpegVersion = {
+        value = "7"
+      }
+      #nodeName = {
+      #  value = "MyExternalNode2"
+      #}
+      maxLogSizeMB = {
+        value = "10"
+      }
+      pathTranslators = {
+        value = "W3sic2VydmVyIjoiWjoiLCJub2RlIjoiL21udC9zZXJpZSJ9LHsic2VydmVyIjogIlk6Iiwibm9kZSI6ICIvbW50L2NhY2hlL3RkYXJyLWNhY2hlIn1dCg=="
+      }
+
+
+      cronPluginUpdate = {
+        value = ""
+      }
+      TZ = {
+        value = "Europe/London"
+      }
+      apikey = {
+        value = ""
+      }
+      pollInterval = {
+        value = "2000"
+      }
+      PUID = {
+        value = "1000"
+      }
+      PGID = {
+        value = "1000"
+      }
+      NVIDIA_DRIVER_CAPABILITIES = {
+        value = "all"
+      }
+      NVIDIA_VISIBLE_DEVICES = {
+        value = "all"
+      }
+      startPaused = {
+        value = "false"
+      }
+      transcodegpuWorkers = {
+        value = "0"
+      }
+      transcodecpuWorkers = {
+        value = "2"
+      }
+      healthcheckgpuWorkers = {
+        value = "0"
+      }
+      healthcheckcpuWorkers = {
+        value = "1"
+      }
+    }
+
+  }
+
+  overleaf = {
+    enabled = false
+    #image    = "sharelatex/sharelatex:6.1.2"
+    image    = "tuetenk0pp/sharelatex-full:latest"
+    replicas = 1
+    environment = {
+      MONGO_URL = {
+        value = "mongodb://overleaf-db-svc:27017/overleaf"
+      }
+      REDIS_URL = {
+        value = "redis://overleaf-redis-svc:6379"
+      }
+      OVERLEAF_MONGO_URL = {
+        value = "mongodb://overleaf-db-svc:27017/overleaf"
+      }
+      OVERLEAF_REDIS_HOST = {
+        value = "overleaf-redis-svc"
+      }
+      REDIS_HOST = {
+        value = "overleaf-redis-svc"
+      }
+      REDIS_PORT = {
+        value = "6379"
+      }
+
+      TZ = {
+        value = "Etc/UTC"
+      }
+
+      VERBOSITY = {
+      value = "-vv" }
+    }
+    service_port = [80]
+    database = {
+      "image"     = "mongo:8.0"
+      "port"      = 27017
+      "mountPath" = "/data/db"
+      #initialise the replicaset of the mongo DB 
+      #kubectl exec -it <mongo-pod-name> -- mongosh
+      #cfg = rs.conf()
+      #cfg.members[0].host = "mongodb:27017"  // ← your K8s Service name + port
+      #rs.reconfig(cfg, { force: true })
+      #rs.status()
+      #// members[0].name should now show "mongodb:27017"
+    }
+    database_args = ["--replSet", "overleaf"]
+    redis = {
+    image = "redis:7.4" }
+    pvc = {
+      overleaf-data = {
+        pvc        = true
+        pvc_size   = "2Mi"
+        mount_path = "/var/lib/overleaf"
+        name       = "overleaf-data"
+      }
+      overleaf-package = {
+        pvc        = true
+        pvc_size   = "2Mi"
+        mount_path = "/usr/local/texlive/"
+        name       = "overleaf-package"
+      }
+    }
+  }
+
+
+  reactive = {
+    #disabled because it needs AI to import a pdf and AI integration is not working
+    enabled      = false
+    replicas     = 01
+    domain_name  = "reactive"
+    image        = "ghcr.io/amruthpillai/reactive-resume:latest"
+    service_port = [3000]
+    environment = {
+      AUTH_SECRET = {
+        value = "change-me-to-a-secure-secret-key-in-production"
+      }
+      PRINTER_ENDPOINT = {
+        value = "ws://browserless:3000?token=change-me"
+      }
+      APP_URL = {
+        value = "https://reactive.tryton.geeraert.eu"
+      }
+      AI_ALLOWED_BASE_URLS = {
+        value = "api.openai.com,https://gateway.ai.vercel.com"
+      }
+    }
+    database = {}
+    pvc = {
+      reactive-resume-data = {
+        name       = "reactive-resume-data"
+        pvc        = true
+        pvc_size   = "2Gi"
+        mount_path = "/app/data"
+      }
+    }
+  }
+
+  opencloud = {
+    enabled      = false
+    replicas     = 01
+    image        = "opencloudeu/opencloud-rolling:latest"
+    service_port = [9200]
+    #domain_name  = "opencloud"
+
+    environment = {
+      #IDM_CREATE_DEMO_USERS = {
+      #  value = "false"
+      #}
+      OC_INSECURE = {
+        value = "true"
+      }
+      OC_DOMAIN = {
+        value = "https://opencloud.tryton.geeraert.eu"
+      }
+      OC_URL = {
+        value = "https://opencloud.tryton.geeraert.eu"
+      }
+
+      INITIAL_ADMIN_PASSWORD = {
+      value = "admin" }
+    }
+    pvc = {
+      opencloud-config = {
+        name       = "opencloud-config"
+        pvc        = true
+        pvc_size   = "2Gi"
+        mount_path = "/etc/opencloud/"
+      }
+      opencloud-data = {
+        name       = "opencloud-data"
+        pvc        = true
+        pvc_size   = "2Gi"
+        mount_path = "/var/lib/opencloud"
+      }
+
+    }
+  }
+
+  owncloud = {
+    enabled      = false
+    replicas     = 0
+    image        = "owncloud/server"
+    service_port = [8080]
+    domain_name  = "owncloud"
+    database = {
+      "engine"     = "mysql"
+      "image"      = "lscr.io/linuxserver/mariadb"
+      "port"       = 3306
+      "mountPath"  = "/config"
+      name         = "owncloud"
+      map_username = "OWNCLOUD_DB_USERNAME"
+      map_name     = "OWNCLOUD_DB_NAME"
+      map_password = "OWNCLOUD_DB_PASSWORD"
+      map_host     = "OWNCLOUD_DB_HOST"
+    }
+    redis = {
+    image = "redis" }
+    environment = {
+      OWNCLOUD_DOMAIN = {
+        value = "owncloud.tryton.geeraert.eu"
+      }
+      OWNCLOUD_TRUSTED_DOMAINS = {
+        value = "owncloud.tryton.geeraert.eu"
+      }
+      OWNCLOUD_DB_TYPE = {
+        value = "mysql"
+      }
+      OWNCLOUD_ADMIN_USERNAME = {
+        value = "admin"
+      }
+      OWNCLOUD_ADMIN_PASSWORD = {
+        value = "admin"
+      }
+      OWNCLOUD_MYSQL_UTF8MB4 = {
+        value = true
+      }
+      OWNCLOUD_REDIS_ENABLED = {
+        value = true
+      }
+      OWNCLOUD_REDIS_HOST = {
+        value = "owncloud-redis-svc"
+      }
+    }
+    pvc = {
+      owncloud-file = {
+        name       = "owncloud-file"
+        pvc        = true
+        pvc_size   = "2Gi"
+        mount_path = "/mnt/data"
+      }
+
+    }
+  }
+
+  kopia = {
+    enabled      = false
+    replicas     = 01
+    image        = "kopia/kopia"
+    service_port = [51515]
+    domain_name  = "kopia"
+    command      = ["start", "--disable-csrf-token-checks", "--insecure", "--address=0.0.0.0:51515", "--server-username=USERNAME", "--server-password=SECRET_PASSWORD"]
+    environment = {
+      KOPIA_PASSWORD = {
+        value = "123456789"
+      }
+      USER = {
+      value = "user" }
+    }
+    pvc = {
+      kopia-storage = {
+        name       = "kopia-storage"
+        pvc        = true
+        pvc_size   = "2Gi"
+        mount_path = "/app"
+      }
+    }
+    kopia-data = {
+      name               = "kopia-data"
+      pvc_size           = "100Mi"
+      pvc                = true
+      mount_path         = "/data"
+      storage_class_name = "nfs-storage-fastaccess"
+    }
+  }
+
+  degoog = {
+    enabled      = false
+    replicas     = 01
+    image        = "ghcr.io/degoog-org/degoog:latest"
+    service_port = [4444]
+    domain_name  = "degoog"
+    environment = {
+      DEGOOG_SETTINGS_PASSWORDS = {
+        value = "Crease1-City-Canned"
+      }
+    }
+    pvc = {
+      degoog-data = {
+        name       = "degoog-data"
+        pvc        = true
+        pvc_size   = "2Gi"
+        mount_path = "/app/data"
+      }
+    }
+  }
+
+}
diff --git a/core/variables.auto.tfvars b/core/variables.auto.tfvars
new file mode 100644
index 0000000..6e16d3a
--- /dev/null
+++ b/core/variables.auto.tfvars
@@ -0,0 +1,471 @@
+kubernetes = {
+  reverse-proxy = {
+    #enabled      = false
+    docker        = true
+    image         = "nginx:latest"
+    service_port  = [80, 443]
+    external_port = true
+    pvc = {
+      nginx-sites-terraform = {
+        name       = "nginx-sites-terraform"
+        mount_path = "/etc/nginx/conf.d/"
+        host_path  = "/data/kubernetes/reverse-proxy/reverse-proxy-sites"
+      }
+
+      reverse-proxy-log = {
+        name       = "reverse-proxy-log"
+        mount_path = "/var/log/nginx/"
+        host_path  = "/data/kubernetes/reverse-proxy/reverse-proxy-log"
+
+      }
+
+      reverse-proxy-ssl = {
+        name       = "reverse-proxy-ssl"
+        mount_path = "/etc/nginx/ssl/"
+        host_path  = "/data/kubernetes/reverse-proxy/reverse-proxy-ssl"
+
+      }
+      nginx-configfile = {
+        name       = "nginx-configfile"
+        mount_path = "/etc/nginx/nginx.conf"
+        host_path  = "/data/kubernetes/reverse-proxy/reverse-proxy-configfile/nginx.conf"
+
+      }
+    }
+  }
+
+
+  gitea = {
+    #enabled = false
+    docker = true
+    image  = "gitea/gitea:1.27.0"
+    # no service_port: nginx reaches http://gitea:3000 over deployment_network
+    database = {
+      image     = "postgres:17"
+      mountPath = "/var/lib/postgresql/data"
+      host_path = "/data/kubernetes/gitea/gitea-db-data"
+    }
+    # shared by the gitea and gitea-db containers (the db ignores GITEA__*, gitea ignores POSTGRES_*)
+    environment = {
+      POSTGRES_USER     = { value = "gitea-KY56Q" }
+      POSTGRES_PASSWORD = { value = "Modulator-Yearning-Gills3" }
+      POSTGRES_DB       = { value = "gitea-database" }
+
+      GITEA__database__DB_TYPE = { value = "postgres" }
+      GITEA__database__HOST    = { value = "gitea-db:5432" }
+      GITEA__database__USER    = { value = "gitea-KY56Q" }
+      GITEA__database__PASSWD  = { value = "Modulator-Yearning-Gills3" }
+      GITEA__database__NAME    = { value = "gitea-database" }
+    }
+    pvc = {
+      gitea-data = {
+        name       = "gitea-data"
+        mount_path = "/data"
+        host_path  = "/data/kubernetes/gitea/gitea-data"
+      }
+      gitea-documents-backup = {
+        name       = "gitea-documents-backup"
+        mount_path = "/backup"
+        host_path  = "/data/kubernetes/gitea/gitea-documents-backup"
+      }
+    }
+  }
+
+  gitea-runner = {
+    #enabled = false
+    docker = true
+    image  = "gitea/act_runner:latest"
+    environment = {
+      GITEA_INSTANCE_URL              = { value = "https://gitea.geeraert.eu/" }
+      GITEA_RUNNER_REGISTRATION_TOKEN = { value = "rqi4mFW8LXoc5MhIrUD1rjzdmKVY8n9X14BP6sWd" }
+      GITEA_RUNNER_NAME               = { value = "runner" }
+      GITEA_RUNNER_LABELS             = { value = "label" }
+    }
+    pvc = {
+      gitea-runner-data = {
+        name       = "gitea-runner-data"
+        mount_path = "/data"
+        host_path  = "/data/kubernetes/gitea/gitea-runner-data"
+      }
+      docker-sock = {
+        name       = "docker-sock"
+        mount_path = "/var/run/docker.sock"
+        host_path  = "/var/run/docker.sock"
+      }
+    }
+  }
+
+
+  echo = {
+    #enabled      = false
+    docker        = true
+    image         = "ealen/echo-server:latest"
+    service_port  = [4580]
+    external_port = true
+    command       = ["-text=Hello authenticated world!"]
+    pvc = {
+      echo-config = {
+        name       = "echo-config"
+        host_path  = "/tmp/data/kubernetes/echo/"
+        mount_path = "/app/configs"
+      }
+    }
+    environment = {
+      PAPERLESS_REDIS = {
+        value = "redis://paperless-redis-svc:6379"
+      }
+      database = {
+        value = "datgg"
+      }
+    }
+
+  }
+
+
+  bitwarden-admin = {
+    enabled        = false
+    namespace      = "bitwarden"
+    replicas       = 1
+    name           = "bitwarden-admin"
+    image          = "ghcr.io/bitwarden/admin:2026.1.0"
+    extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/config.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/global.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/global.override.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/mssql.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/mssql.override.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/uid.env.configmap.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/bitwarden-identity-cert-password.secret.yml", "/opt/kubernetes/Terraform_kube/external_manifests/bitwarden/identity-svc.svc.yaml"]
+    service_port   = [5000]
+    config_map_ref = ["global.env", "uid.env", "global.override.env"]
+    environment    = {}
+
+    pvc = {
+      bitwarden-ca-certificates = {
+        pvc        = true
+        pvc_size   = "2Mi"
+        mount_path = "/etc/bitwarden/ca-certificates"
+        name       = "bitwarden-ca-certificates"
+      }
+
+      bitwarden-core = {
+        pvc        = true
+        pvc_size   = "2Mi"
+        mount_path = "/etc/bitwarden/core"
+        name       = "bitwarden-core"
+      }
+      bitwarden-logs = {
+        pvc        = true
+        pvc_size   = "2Mi"
+        mount_path = "/etc/bitwarden/logs"
+        name       = "bitwarden-logs"
+        sub_path   = "admin"
+      }
+
+
+    }
+
+  }
+
+  bitwarden-api = {
+    enabled             = false
+    connected_namespace = "bitwarden"
+    replicas            = 1
+    name                = "bitwarden-api"
+    image               = "gitea.tryton.geeraert.eu/pi-ux-ce/bitbetter_api:2026.1.0"
+    service_port        = [5000]
+    config_map_ref      = ["global.env", "uid.env", "global.override.env"]
+    environment         = {}
+
+    pvc = {
+      bitwarden-ca-certificates = {
+        pvc        = true
+        pvc_size   = "2Mi"
+        mount_path = "/etc/bitwarden/ca-certificates"
+        name       = "bitwarden-ca-certificates"
+      }
+
+      bitwarden-core = {
+        pvc        = true
+        pvc_size   = "2Mi"
+        mount_path = "/etc/bitwarden/core"
+        name       = "bitwarden-core"
+      }
+      bitwarden-logs = {
+        pvc        = true
+        pvc_size   = "2Mi"
+        mount_path = "/etc/bitwarden/logs"
+        name       = "bitwarden-logs"
+        sub_path   = "api"
+      }
+
+
+    }
+
+  }
+  bitwarden-attachments = {
+    enabled             = false
+    connected_namespace = "bitwarden"
+    replicas            = 1
+    name                = "bitwarden-attachments"
+    image               = "ghcr.io/bitwarden/attachments:2026.1.0"
+    service_port        = [5000]
+    config_map_ref      = ["global.env", "uid.env"]
+    environment         = {}
+
+    pvc = {
+      bitwarden-core = {
+        pvc        = true
+        pvc_size   = "2Mi"
+        mount_path = "/etc/bitwarden/core/attachments"
+        name       = "bitwarden-core"
+        sub_path   = "attachments"
+      }
+
+    }
+  }
+  bitwarden-events = {
+    enabled             = false
+    connected_namespace = "bitwarden"
+    replicas            = 1
+    name                = "bitwarden-events"
+    image               = "ghcr.io/bitwarden/events:2026.1.0"
+    service_port        = [5000]
+    config_map_ref      = ["global.env", "uid.env", "global.override.env"]
+    environment         = {}
+
+    pvc = {
+      bitwarden-ca-certificates = {
+        pvc        = true
+        pvc_size   = "2Mi"
+        mount_path = "/etc/bitwarden/ca-certificates"
+        name       = "bitwarden-ca-certificates"
+      }
+      bitwarden-logs = {
+        pvc        = true
+        pvc_size   = "2Mi"
+        mount_path = "/etc/bitwarden/logs"
+        name       = "bitwarden-logs"
+        sub_path   = "events"
+      }
+
+    }
+
+  }
+  bitwarden-icons = {
+    enabled             = false
+    connected_namespace = "bitwarden"
+    replicas            = 1
+    name                = "bitwarden-icons"
+    image               = "ghcr.io/bitwarden/icons:2026.1.0"
+    service_port        = [5000]
+    config_map_ref      = ["global.env", "uid.env"]
+    environment         = {}
+
+    pvc = {
+      bitwarden-ca-certificates = {
+        pvc        = true
+        pvc_size   = "2Mi"
+        mount_path = "/etc/bitwarden/ca-certificates"
+        name       = "bitwarden-ca-certificates"
+      }
+      bitwarden-logs = {
+        pvc        = true
+        pvc_size   = "2Mi"
+        mount_path = "/etc/bitwarden/logs"
+        name       = "bitwarden-logs"
+        sub_path   = "icons"
+      }
+    }
+  }
+
+  bitwarden-identity = {
+    enabled             = false
+    connected_namespace = "bitwarden"
+    replicas            = 1
+    name                = "bitwarden-identity"
+    image               = "gitea.tryton.geeraert.eu/pi-ux-ce/bitbetter_identity:2026.1.0"
+    service_port        = [5000]
+    config_map_ref      = ["global.env", "uid.env", "global.override.env"]
+    environment         = {}
+
+    pvc = {
+      bitwarden-identity = {
+        pvc        = true
+        pvc_size   = "2Mi"
+        mount_path = "/etc/bitwarden/identity"
+        name       = "bitwarden-identity"
+      }
+      bitwarden-ca-certificates = {
+        pvc        = true
+        pvc_size   = "2Mi"
+        mount_path = "/etc/bitwarden/ca-certificates"
+        name       = "bitwarden-ca-certificates"
+      }
+
+      bitwarden-core = {
+        pvc        = true
+        pvc_size   = "2Mi"
+        mount_path = "/etc/bitwarden/core"
+        name       = "bitwarden-core"
+      }
+      bitwarden-logs = {
+        pvc        = true
+        pvc_size   = "2Mi"
+        mount_path = "/etc/bitwarden/logs"
+        name       = "bitwarden-logs"
+        sub_path   = "identity"
+      }
+    }
+  }
+  bitwarden-mssql = {
+    enabled             = false
+    connected_namespace = "bitwarden"
+    replicas            = 1
+    name                = "bitwarden-mssql"
+    image               = "ghcr.io/bitwarden/mssql:2026.1.0"
+    service_port        = [1433, 5000]
+    config_map_ref      = ["mssql.env", "uid.env", "mssql.override.env"]
+    environment         = {}
+    database = {
+      shunt    = "true"
+      engine   = "sqlserver"
+      username = "sa"
+      host     = "bitwarden-mssql-svc"
+      name     = "bitwarden_vault"
+    }
+
+    pvc = {
+      bitwarden-mssql = {
+        pvc        = true
+        pvc_size   = "2Mi"
+        mount_path = "/var/opt/mssql/data"
+        name       = "bitwarden-mssql"
+        sub_path   = "data"
+      }
+      bitwarden-logs = {
+        pvc        = true
+        pvc_size   = "2Mi"
+        mount_path = "/etc/bitwarden/logs"
+        name       = "bitwarden-logs"
+        sub_path   = "mssql"
+      }
+    }
+  }
+  bitwarden-nginx = {
+    enabled             = false
+    connected_namespace = "bitwarden"
+    replicas            = 1
+    name                = "bitwarden-nginx"
+    image               = "ghcr.io/bitwarden/nginx:2026.1.0"
+    service_port        = [5000, 8080, 8443]
+    config_map_ref      = ["uid.env"]
+    environment         = {}
+
+    pvc = {
+      bitwarden-nginx = {
+        pvc        = true
+        pvc_size   = "2Mi"
+        mount_path = "/etc/bitwarden/nginx"
+        name       = "bitwarden-nginx"
+      }
+      bitwarden-letsencrypt = {
+        pvc        = true
+        pvc_size   = "2Mi"
+        mount_path = "/etc/letsencrypt"
+        name       = "bitwarden-letsencrypt"
+      }
+
+      bitwarden-ssl = {
+        pvc        = true
+        pvc_size   = "2Mi"
+        mount_path = "/etc/ssl"
+        name       = "bitwarden-ssl"
+      }
+      bitwarden-logs = {
+        pvc        = true
+        pvc_size   = "2Mi"
+        mount_path = "/var/log/nginx"
+        name       = "bitwarden-logs"
+        sub_path   = "nginx"
+      }
+    }
+  }
+  bitwarden-notifications = {
+    enabled             = false
+    connected_namespace = "bitwarden"
+    replicas            = 1
+    name                = "bitwarden-notifications"
+    image               = "ghcr.io/bitwarden/notifications:2026.1.0"
+    service_port        = [5000]
+    config_map_ref      = ["global.env", "uid.env", "global.override.env"]
+    environment         = {}
+
+    pvc = {
+      bitwarden-ca-certificates = {
+        pvc        = true
+        pvc_size   = "2Mi"
+        mount_path = "/etc/bitwarden/ca-certificates"
+        name       = "bitwarden-ca-certificates"
+      }
+      bitwarden-logs = {
+        pvc        = true
+        pvc_size   = "2Mi"
+        mount_path = "/etc/bitwarden/logs"
+        name       = "bitwarden-logs"
+        sub_path   = "notifications"
+      }
+    }
+  }
+  bitwarden-sso = {
+    enabled             = false
+    connected_namespace = "bitwarden"
+    replicas            = 1
+    name                = "bitwarden-sso"
+    image               = "ghcr.io/bitwarden/sso:2026.1.0"
+    service_port        = [5000]
+    config_map_ref      = ["global.env", "uid.env", "global.override.env"]
+    environment         = {}
+
+    pvc = {
+      bitwarden-identity = {
+        pvc        = true
+        pvc_size   = "2Mi"
+        mount_path = "/etc/bitwarden/identity"
+        name       = "bitwarden-identity"
+      }
+      bitwarden-core = {
+        pvc        = true
+        pvc_size   = "2Mi"
+        mount_path = "/etc/bitwarden/core"
+        name       = "bitwarden-core"
+      }
+      bitwarden-ca-certificates = {
+        pvc        = true
+        pvc_size   = "2Mi"
+        mount_path = "/etc/bitwarden/ca-certificates"
+        name       = "bitwarden-ca-certificates"
+      }
+      bitwarden-logs = {
+        pvc        = true
+        pvc_size   = "2Mi"
+        mount_path = "/etc/bitwarden/logs"
+        name       = "bitwarden-logs"
+        sub_path   = "sso"
+      }
+    }
+  }
+  bitwarden-web = {
+    enabled             = false
+    connected_namespace = "bitwarden"
+    replicas            = 1
+    name                = "bitwarden-web"
+    image               = "ghcr.io/bitwarden/web:2026.1.0"
+    service_port        = [5000]
+    config_map_ref      = ["global.env", "uid.env"]
+    environment         = {}
+
+    pvc = {
+      bitwarden-web = {
+        pvc        = true
+        pvc_size   = "2Mi"
+        mount_path = "/etc/bitwarden/web"
+        name       = "bitwarden-web"
+      }
+    }
+  }
+
+}
diff --git a/infrastructure/variables.auto.tfvars b/infrastructure/variables.auto.tfvars
new file mode 100644
index 0000000..aaf4968
--- /dev/null
+++ b/infrastructure/variables.auto.tfvars
@@ -0,0 +1,372 @@
+kubernetes = {
+
+  gluetun = {
+    #    enabled             = false
+    dns_nameservers = "1.1.1.1"
+    replicas        = 01
+    image           = "qmcgaw/gluetun:latest"
+    service_port    = [8888]
+    #extra_manifest    = ["/opt/kubernetes/Terraform_kube/external_manifests/gluetun/gluetun-secret-netherlandNL-FREE-280.yaml"]
+    secret_import    = ["5527ba11-07e3-415b-8d1f-b3ee0154eb56", "b0d22160-d81a-4702-a3dd-b40e0168d617", "643dbe99-ace0-4ef5-8a2e-b44f014dccb0"]
+    security_context = true
+    #    requirements = {
+    #      limits-cpu      = "800Mi"
+    #      limits-memory   = "800Mi"
+    #      requests-cpu    = "800Mi"
+    #      requests-memory = "800Mi"
+    #    }
+    environment = {
+      WIREGUARD_PRIVATE_KEY = {
+        value_from = {
+          secret_key_ref = {
+            name = "gluetun-secret-nl-free-280"
+            key  = "WIREGUARD_PRIVATE_KEY"
+          }
+        }
+      }
+      HTTPPROXY = {
+        value = "on"
+      }
+      HTTPPROXY_LOG = {
+        value = "on"
+      }
+      HTTPPROXY_LISTENING_ADDRESS = {
+        value = "0.0.0.0:8888"
+      }
+      #      DNS_KEEP_NAMESERVER = {
+      #        value = "on"
+      #      }
+      VPN_SERVICE_PROVIDER = {
+        value = "protonvpn"
+      }
+      VPN_TYPE = {
+        value = "wireguard"
+      }
+      SERVER_COUNTRIES = {
+        value = "Netherlands"
+      }
+      HEALTH_TARGET_ADDRESS = {
+        value = "0.0.0.0:8888"
+      }
+
+      FREE_ONLY = {
+        value = "on"
+      }
+
+      #      WIREGUARD_ADDRESSES = {
+      #        value = "10.2.0.2/32"
+      #      }
+      FIREWALL_INPUT_PORTS = {
+        value = "8081,7878,9696,9091,51413,8080,6881,8989,8191,8888,8000"
+      }
+      PUBLICIP_API = {
+        value = "ip2location"
+      }
+
+      #      HEALTH_TARGET_ADDRESS = {
+      #        value = "protonvpn.com:80"
+      #      }
+      #      FIREWALL_OUTBOUND_SUBNETS = {
+      #      value = "10.0.0.0/24" }
+
+    }
+
+  }
+
+
+  django = {
+    #enabled      =false
+    namespace    = "django"
+    image        = "gitea.tryton.geeraert.eu/pi-ux-ce/django-python:latest"
+    service_port = [8000]
+    database = {
+      image     = "docker.io/tensorchord/pgvecto-rs:pg14-v0.2.0"
+      username  = "django_username"
+      mountPath = "/var/lib/postgresql/data"
+    }
+    #redis         = {}
+    secret_ref    = ["django-bitwarden-credentials"]
+    secret_import = ["9fc5a725-75f5-4bab-b595-b474017146c3"]
+    requirements = {
+      limits-cpu      = "800m"
+      limits-memory   = "800Mi"
+      requests-cpu    = "10m"
+      requests-memory = "300Mi"
+    }
+    extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/django/kubeconfig.secret.yaml", "/opt/kubernetes/Terraform_kube/external_manifests/django/django-db.secret.yaml"]
+
+    environment = {
+      ALLOWED_HOSTS = {
+        value = "django.geeraert.eu,admin.geeraert.eu,redirect.geeraert.eu,streaming.geeraert.eu,stash.geeraert.eu,simpsons.geeraert.eu,kubernetes.geeraert.eu,cloudmanager.geeraert.eu,podcast.geeraert.eu"
+      }
+      DEBUG = {
+        value = "False"
+      }
+      ENVIRONMENT = {
+        value = "PRODUCTION"
+      }
+      #CELERY_BROKER_URL = {
+      #  value = "redis://django-redis-svc:6379"
+      #}
+      #HTTP_PROXY = {
+      #value = "http://gluetun-svc.gluetun.svc:8888" }
+
+      DB_PASSWORD = {
+        value_from = {
+          secret_key_ref = {
+            name = "django-db-credentials"
+            key  = "DB_PASSWORD"
+          }
+        }
+      }
+      POSTGRES_DB = {
+        value_from = {
+          secret_key_ref = {
+            name = "django-db-credentials"
+            key  = "DB_DATABASE_NAME"
+          }
+        }
+      }
+      POSTGRES_USER = {
+        value_from = {
+          secret_key_ref = {
+            name = "django-db-credentials"
+            key  = "DB_USERNAME"
+          }
+        }
+      }
+      POSTGRES_PASSWORD = {
+        value_from = {
+          secret_key_ref = {
+            name = "django-db-credentials"
+            key  = "DB_PASSWORD"
+          }
+        }
+      }
+
+
+      DB_HOSTNAME = {
+        value_from = {
+          secret_key_ref = {
+            name = "django-db-credentials"
+            key  = "DB_HOST"
+          }
+        }
+      }
+
+
+    }
+    pvc = {
+      kubeconfig-secret = {
+        secret     = true
+        name       = "kubeconfig"
+        mount_path = "/kubeconfig"
+      }
+
+      stash-django-pvc = {
+        host_path  = "/ssd/stash/data-pvc/"
+        name       = "stash-django-pvc"
+        pvc_size   = "2Mi"
+        mount_path = "/stash"
+      }
+    }
+  }
+
+  django-testing = {
+    #enabled      =false
+    image        = "gitea.tryton.geeraert.eu/pi-ux-ce/django-testing:latest"
+    service_port = [8000]
+    database     = {}
+    #redis        = {}
+    requirements = {
+      limits-cpu      = "800m"
+      limits-memory   = "800Mi"
+      requests-cpu    = "10m"
+      requests-memory = "300Mi"
+    }
+    extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/django/kubeconfig-testing.secret.yaml"]
+    secret_ref     = ["django-bitwarden-credentials"]
+    secret_import  = ["68dce7aa-8e5f-4483-9083-b474016e34fc"]
+    environment = {
+      ALLOWED_HOSTS = {
+        value = "django-testing.geeraert.eu,admin-testing.geeraert.eu,redirect-testing.geeraert.eu,streaming-testing.geeraert.eu,stash-testing.geeraert.eu,simpsons-testing.geeraert.eu,kubernetes-testing.geeraert.eu,cloudmanager-testing.geeraert.eu,podcast-testing.geeraert.eu"
+      }
+      CELERY_BROKER_URL = {
+        value = "redis://django-testing-redis-svc:6379"
+      }
+
+      DEBUG = {
+        value = "true"
+      }
+      DB_PORT = {
+        value = 5432
+      }
+      CUSTOM_DB_DATABASE = {
+      value = "cloudmanager" }
+    }
+    pvc = {
+      kubeconfig-secret = {
+        secret     = true
+        name       = "kubeconfig"
+        mount_path = "/kubeconfig"
+      }
+    }
+
+  }
+
+
+
+  fail2ban = {
+    enabled = false
+    #image                = "lscr.io/linuxserver/fail2ban:latest"
+    image                = "gitea.tryton.geeraert.eu/pi-ux-ce/fail2ban:latest"
+    extra_manifest       = ["/opt/kubernetes/Terraform_kube/external_manifests/fail2ban/fail2ban.RoleBinding.yaml", "/opt/kubernetes/Terraform_kube/external_manifests/fail2ban/fail2ban.Role.yaml", "/opt/kubernetes/Terraform_kube/external_manifests/fail2ban/fail2ban.ServiceAccount.yaml"]
+    service_account_name = "kubectl-service-account"
+    config_map_import    = ["9d8ef71a-de74-478b-aa86-b3ee0160dc43", "50814edb-d190-41cb-8950-b3ee01622dcf", "fb11452e-fec1-489f-9144-b3ee0162ccda"]
+    environment = {
+      PUID = {
+        value = "1000"
+      }
+      PGID = {
+        value = "1000"
+      }
+      TZ = {
+        value = "Etc/UTC"
+      }
+
+      VERBOSITY = {
+      value = "-vv" }
+    }
+
+    security_context = true
+    pvc = {
+      fail2ban-config = {
+        pvc        = true
+        pvc_size   = "2Mi"
+        mount_path = "/config"
+        name       = "fail2ban-config"
+      }
+      fail2ban-log = {
+        pvc        = true
+        pvc_size   = "2Mi"
+        mount_path = "/var/log"
+        name       = "fail2ban-log"
+      }
+      nginx-fail2ban-logs = {
+        host_path  = "/data/kubernetes/reverse-proxy/reverse-proxy-log/"
+        name       = "nginx-fail2ban-logs"
+        pvc_size   = "2Mi"
+        mount_path = "/remotelogs/nginx/"
+      }
+      fail2ban-nginx-http-auth-jail = {
+        config_map = true
+        name       = "fail2ban-nginx-http-auth-jail"
+        pvc_size   = "2Mi"
+        mount_path = "/config/fail2ban/jail.d/"
+      }
+      fail2ban-nginx-unauthorized-filter = {
+        config_map = true
+        name       = "fail2ban-nginx-unauthorized-filter"
+        pvc_size   = "2Mi"
+        mount_path = "/config/fail2ban/filter.d/"
+      }
+
+
+    }
+  }
+
+
+  netdatat = {
+    image            = "debian"
+    enabled          = false
+    service_port     = [19999]
+    domain_name      = "netdata"
+    command          = ["sleep", "3600"]
+    security_context = true
+
+    environment = {
+      NETDATA_CLAIM_TOKEN = {
+        value = "wN6wJV1M5jvLbcpQTT78s0WRWiCkxz-s4l9tzeIqwA86upIkVSTk6TbaPbA5L6h_5HH9LoemluBqSPAGzi8DnJ2LBp4e8JGRVuWwOv8EWcKfrV0winCPce4xXtuD780KUW5CR6k"
+      }
+      NETDATA_CLAIM_URL = {
+        value = "https://app.netdata.cloud"
+      }
+      NETDATA_CLAIM_ROOMS = {
+        value = "28654d7b-4767-4b8e-bddc-8d134624bb3b"
+      }
+    }
+
+    pvc = {
+      netdata-config = {
+        name       = "netdata-config"
+        pvc        = true
+        pvc_size   = "1Gi"
+        mount_path = "/etc/netdata"
+      }
+      netdata-lib = {
+        name       = "netdata-lib"
+        pvc        = true
+        pvc_size   = "1Gi"
+        mount_path = "/var/lib/netdata"
+      }
+      netdata-cache = {
+        name       = "netdata-cache"
+        pvc        = true
+        pvc_size   = "1Gi"
+        mount_path = "/var/cache/netdata"
+      }
+      netdata-host-root = {
+        host_path  = "/"
+        name       = "netdata-host-root"
+        mount_path = "/host/root"
+      }
+      netdata-host-passwd = {
+        host_path  = "/etc/passwd"
+        name       = "netdata-host-passwd"
+        mount_path = "/host/etc/passwd"
+      }
+      netdata-host-group = {
+        host_path  = "/etc/group"
+        name       = "netdata-host-group"
+        mount_path = "/host/etc/group"
+      }
+      netdata-host-localtime = {
+        host_path  = "/etc/localtime"
+        name       = "netdata-host-localtime"
+        mount_path = "/etc/localtime"
+      }
+      netdata-host-proc = {
+        host_path  = "/proc"
+        name       = "netdata-host-proc"
+        mount_path = "/host/proc"
+      }
+      netdata-host-sys = {
+        host_path  = "/sys"
+        name       = "netdata-host-sys"
+        mount_path = "/host/sys"
+      }
+      netdata-host-os-release = {
+        host_path  = "/etc/os-release"
+        name       = "netdata-host-os-release"
+        mount_path = "/host/etc/os-release"
+      }
+      netdata-host-var-log = {
+        host_path  = "/var/log"
+        name       = "netdata-host-var-log"
+        mount_path = "/host/var/log"
+      }
+      netdata-docker-sock = {
+        host_path  = "/var/run/docker.sock"
+        name       = "netdata-docker-sock"
+        mount_path = "/var/run/docker.sock"
+      }
+      netdata-host-dbus = {
+        host_path  = "/run/dbus"
+        name       = "netdata-host-dbus"
+        mount_path = "/run/dbus"
+      }
+    }
+  }
+
+
+}
diff --git a/reverse-proxy/variables.auto.tfvars b/reverse-proxy/variables.auto.tfvars
new file mode 100644
index 0000000..a82c7e8
--- /dev/null
+++ b/reverse-proxy/variables.auto.tfvars
@@ -0,0 +1,600 @@
+nginx_sites = {
+  bitwarden = {
+    #service = "nginx.bitwarden.svc:8080"
+    #extra-value-location = <<EOT
+    #proxy_set_header      Host $host;
+    #proxy_set_header      X-Real-IP $remote_addr;
+    #proxy_set_header      X-Forwarded-For $proxy_add_x_forwarded_for;
+    #proxy_set_header      Proxy "";
+    #            EOT
+    service                 = "bitwarden-nginx-svc.bitwarden.svc:8080"
+    http2_bool              = true
+    redirect_to_root_domain = false
+  }
+
+  bookstack = {
+    enabled = false
+    #    service     = "webserver.bookstack.svc"
+    service     = "bookstack-svc.bookstack.svc"
+    proxy_cache = false
+  }
+
+
+  django = {
+    service     = "django-svc.django:8000"
+    proxy_cache = true
+    http2_bool  = true
+
+  }
+  admin = {
+    service     = "django-svc.django:8000"
+    proxy_cache = true
+    http2_bool  = true
+
+  }
+  redirect = {
+    service     = "django-svc.django:8000"
+    proxy_cache = true
+    http2_bool  = true
+
+  }
+  streaming = {
+    service     = "django-svc.django:8000"
+    proxy_cache = true
+    http2_bool  = true
+
+  }
+  stash = {
+    service     = "django-svc.django:8000"
+    proxy_cache = true
+    http2_bool  = true
+
+  }
+  simpsons = {
+    service     = "django-svc.django:8000"
+    proxy_cache = true
+    http2_bool  = true
+
+  }
+  kubernetes = {
+    service     = "django-svc.django:8000"
+    proxy_cache = true
+    http2_bool  = true
+
+  }
+  cloudmanager = {
+    service     = "django-svc.django:8000"
+    proxy_cache = true
+    http2_bool  = true
+
+  }
+  podcast = {
+    service     = "django-svc.django:8000"
+    proxy_cache = true
+    http2_bool  = true
+
+  }
+  django-testing = {
+    service     = "django-testing-svc.django-testing.svc:8000"
+    proxy_cache = true
+    http2_bool  = true
+  }
+
+  admin-testing = {
+    service     = "django-testing-svc.django-testing.svc:8000"
+    proxy_cache = true
+    http2_bool  = true
+  }
+
+  redirect-testing = {
+    service     = "django-testing-svc.django-testing.svc:8000"
+    proxy_cache = true
+    http2_bool  = true
+  }
+
+  streaming-testing = {
+    service     = "django-testing-svc.django-testing.svc:8000"
+    proxy_cache = true
+    http2_bool  = true
+  }
+
+  stash-testing = {
+    service     = "django-testing-svc.django-testing.svc:8000"
+    proxy_cache = true
+    http2_bool  = true
+  }
+
+  simpsons-testing = {
+    service     = "django-testing-svc.django-testing.svc:8000"
+    proxy_cache = true
+    http2_bool  = true
+  }
+
+  kubernetes-testing = {
+    service     = "django-testing-svc.django-testing.svc:8000"
+    proxy_cache = true
+    http2_bool  = true
+  }
+
+  cloudmanager-testing = {
+    service     = "django-testing-svc.django-testing.svc:8000"
+    proxy_cache = true
+    http2_bool  = true
+  }
+  podcast-testing = {
+    service     = "django-testing-svc.django-testing.svc:8000"
+    proxy_cache = true
+    http2_bool  = true
+  }
+  echo = {
+    enabled = true
+    #    service     = "echo-server.echo-server.svc:80"
+    service        = "echo-svc.echo.svc"
+    docker_service = "echo"
+    proxy_cache    = true
+    http2_bool     = true
+
+    #extra-value-location = <<EOT
+    #  auth_request /oauth2/auth;
+    #  error_page 401 = @oauth2_signin;
+    #  proxy_set_header X-Auth-Request-Redirect $request_uri;
+    #            EOT
+
+    #extra-value = <<EOT
+    #  location = /oauth2/auth {
+    #  internal;
+    #proxy_pass http://oauthn_backend;
+    ##        proxy_pass https://oauthn.tryton.geeraert.eu/oauth2/auth;
+    # proxy_pass_request_body off;
+    #  proxy_set_header Content-Length "";
+    #  proxy_set_header X-Original-URI $request_uri;
+    #  proxy_set_header X-Real-IP $remote_addr;
+    #  proxy_set_header X-Scheme $scheme;
+    #}
+
+    #location @oauth2_signin {
+    #  return 302 https://$host/oauth2/start?rd=https://$host$request_uri;
+    #  #return 302 https://oauthn.tryton.geeraert.eu/oauth2/start?rd=https://$host$request_uri;
+    #}
+
+    #location /oauth2/ {
+    #proxy_pass http://oauthn_backend;
+    #proxy_set_header Host $host;
+    #proxy_set_header X-Real-IP $remote_addr;
+    #proxy_set_header X-Scheme $scheme;
+    #proxy_set_header X-Auth-Request-Redirect $request_uri;
+    #}
+
+    #            EOT
+
+
+  }
+  gitlab = {
+    service          = "webserver.gitlab.svc:443"
+    proxy_cache      = true
+    extra_value_bool = true
+    enabled          = false
+    extra-value      = <<EOT
+client_max_body_size 20m;
+	proxy_request_buffering off;
+                EOT
+    http2_bool       = true
+    proxy_pass_https = true
+  }
+  sonarr = {
+    service     = "sonarr-svc.servarr.svc:8989"
+    geoip_allow = ["FR", "GB", "NL"]
+
+  }
+
+  keycloak = {
+    service     = "keycloak.keycloak.svc:8080"
+    enabled     = false
+    extra-value = <<EOT
+
+        set_real_ip_from 0.0.0.0/0;
+        real_ip_header X-Real-IP;
+        real_ip_recursive on;
+                        EOT
+  }
+  nextcloud = {
+    redirect_to_root_domain = false
+    service                 = "webserver.nextcloud.svc"
+    #service     = "nextcloud-svc.next.svc"
+    proxy_cache = true
+    http2_bool  = true
+    extra-value = <<EOT
+
+
+        location /.well-known/carddav {
+                return 301 $scheme://$host/remote.php/dav;
+        }
+
+        location /.well-known/caldav {
+                return 301 $scheme://$host/remote.php/dav;
+        }
+
+        location = /health {
+                default_type text/html;
+                return 200 "<!DOCTYPE html><h2>health check</h2>\n";
+        }
+                        EOT
+  }
+
+
+
+  router = {
+    service                 = "192.168.88.1"
+    authentication_required = true
+  }
+  homeassistant = {
+    enabled = false
+    service = "homeassistant-svc.homeassistant.svc:8123"
+  }
+  octoprint = {
+    service              = "192.168.0.32:5000"
+    extra-value-location = <<EOT
+    proxy_set_header Host $http_host;
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme; # Crucial for HTTPS to HTTP matching
+    
+    # Required for OctoPrint WebSockets to function properly
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade $http_upgrade;
+    proxy_set_header Connection "upgrade";
+    
+    client_max_body_size 0;    # Allows large file uploads like gcode
+                EOT
+
+  }
+  onitama = {
+    service = "onitama-svc.onitama.svc:8080"
+    enabled = false
+  }
+
+  opentrashmail = {
+    #                service = "opentrashmail.opentrashmail.svc"
+    service = "1.1.1.1"
+    enabled = false
+  }
+  paperless = {
+    #service = "webserver.paperless.svc:8000"
+    service = "paperless-svc.paperless.svc:8000"
+  }
+  pihole = {
+    service = "172.16.0.60:8081"
+    enabled = false
+  }
+  portainer = {
+    service = "portainer.portainer.svc"
+  }
+  prowlarr = {
+    service     = "prowlarr-svc.servarr.svc:9696"
+    geoip_allow = ["FR", "GB", "NL"]
+
+  }
+  proxmox = {
+    service = "192.168.6.2:8006"
+    enabled = false
+  }
+  qbittorrent = {
+    #enabled     = false
+    service     = "qbittorrent-svc.servarr.svc:8080"
+    geoip_allow = ["FR", "GB", "NL"]
+
+  }
+  radarr = {
+    service     = "radarr-svc.servarr.svc:7878"
+    geoip_allow = ["FR", "GB", "NL"]
+
+  }
+  recommendarr = {
+    service = "recommendarr-svc.servarr.svc:3000"
+    enabled = false
+  }
+  #reverse = {
+  #  service = "192.168.88.50:8888"
+  #  enabled = false
+  #}
+  sickchill = {
+    service = "sickchill.servarr.svc"
+    enabled = false
+  }
+  transmission = {
+    service = "192.168.88.52:31091"
+    enabled = false
+  }
+  unifi = {
+    #    service = "unifi.unifi.svc:8443"
+    service          = "192.168.88.244:8443"
+    proxy_pass_https = true
+  }
+  unifi-inform = {
+    service = "192.168.88.50:8082"
+  }
+  dupeguru = {
+    service                 = "dupeguru.dupeguru.svc:5800"
+    enabled                 = false
+    authentication_required = true
+  }
+
+  immich = {
+    #service = "immich-server.immich.svc:2283"
+    service              = "immich-svc.immich.svc:2283"
+    geoip_allow          = ["FR", "GB", "NL"]
+    extra-value-location = <<EOT
+       proxy_set_header Connection "upgrade";
+       proxy_set_header X-Real-IP $remote_addr;
+       proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+       proxy_set_header X-Forwarded-Proto $scheme;
+       proxy_read_timeout 60000s;
+
+
+    #adding websocket , usefull for reverse proxy
+       proxy_set_header Connection "upgrade";
+       proxy_set_header X-Real-IP $remote_addr;
+       proxy_cache_bypass $http_upgrade;
+    #end of working
+                EOT  
+  }
+  immicht = {
+    service = "immicht-svc.immicht.svc:2283"
+    enabled = false
+  }
+
+  netdata = {
+    enabled = false
+    service = "netdata-agent.netdata.svc:19999"
+  }
+  screeps = {
+    enabled                = false
+    redirect_to_https_bool = false
+    listen_port_80_bool    = true
+    service                = "screeps-svc.screeps.svc:25565"
+  }
+  minecraft = {
+    enabled                = false
+    redirect_to_https_bool = false
+    listen_port_80_bool    = true
+    service                = "minecraft-svc.minecraft.svc:21025"
+  }
+  stirling = {
+    enabled              = false
+    service              = "stirling-svc.stirling.svc:8080"
+    extra-value-location = <<EOT
+    proxy_set_header Connection "upgrade";
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_read_timeout 60000s;
+#working
+proxy_set_header Connection "upgrade";
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_cache_bypass $http_upgrade;
+#end of working
+
+
+
+                EOT
+  }
+  vulcan = {
+    service = "vulcan.vulcan.svc:80"
+    enabled = false
+  }
+
+  nginx = {
+    enabled = false
+    service = "nginx-svc.nginx.svc"
+  }
+  openmediavault = {
+    service = "192.168.88.29"
+    #    service = "192.168.88.42"
+  }
+  pihole = {
+    service = "web.piholenew.svc"
+  }
+  jellyfin = {
+    enabled = false
+    service = "jellyfin-svc.jellyfin.svc:8096"
+  }
+  gogs = {
+    enabled = false
+    service = "gogs-svc.gogs.svc:3000"
+  }
+  synology = {
+    enabled = true
+    service = "192.168.88.39:5000"
+  }
+
+  gitea = {
+    enabled                 = true
+    service                 = "webserver.gitea.svc:3000"
+    docker_service = "gitea:3000"
+    redirect_to_root_domain = false
+  }
+
+  spider = {
+    enabled = false
+    service = "spider-svc.spider.svc:8080"
+  }
+  nextcloud-terraform = {
+    enabled = false
+    service = "nextcloud-web-svc.nextcloud-terraform.svc:80"
+
+  }
+  paper = {
+    enabled = false
+    service = "paper-svc.paper.svc:8000"
+
+  }
+  next = {
+    enabled     = false
+    service     = "next-svc.next.svc"
+    proxy_cache = true
+    http2_bool  = true
+    extra-value = <<EOT
+
+
+        location /.well-known/carddav {
+                return 301 $scheme://$host/remote.php/dav;
+        }
+
+        location /.well-known/caldav {
+                return 301 $scheme://$host/remote.php/dav;
+        }
+
+        location = /health {
+                default_type text/html;
+                return 200 "<!DOCTYPE html><h2>health check</h2>\n";
+        }
+                        EOT
+  }
+
+  bookstack-terraform = {
+    enabled = false
+    service = "bookstack-svc.bookstack-terraform.svc"
+  }
+  stash = {
+    #  enabled              = false
+    service = "stash-svc.stash.svc:9999"
+    #geoip_blocking = false
+    #extra-value= <<EOT
+    #   proxy_protocol on;
+    #EOT
+    extra-value-location = <<EOT
+    #don't use this as this needs to be run as root or have the CAP_NET_RAW capability) to bind to a non-local IP address.
+    #Because the backend thinks the request is coming directly from the client, it will try to send the response directly back to that client IP. To prevent this (which would break the connection), you must force the response back through the NGINX server.
+    #proxy_bind $remote_addr transparent;
+
+##used to be working
+    proxy_set_header Connection "upgrade";
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_read_timeout 60000s;
+    #working
+    proxy_set_header Connection "upgrade";
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_cache_bypass $http_upgrade;
+    #end of working
+    EOT
+
+    geoip_allow = ["FR", "GB", "NL"]
+  }
+  neko = {
+    enabled              = false
+    service              = "neko-svc.neko.svc:8080"
+    http2_bool           = true
+    extra-value-location = <<EOT
+proxy_set_header Connection "upgrade";
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_cache_bypass $http_upgrade;
+
+                EOT
+
+  }
+  pinchflat = {
+    enabled = false
+    service = "pinchflat-svc.pinchflat.svc:8945"
+  }
+
+  jobspy = {
+    enabled = false
+    service = "jobspy-svc.jobspy.svc:8000"
+  }
+  poste = {
+    enabled              = false
+    service              = "poste-svc.poste.svc:443"
+    proxy_pass_https     = true
+    extra-value-location = <<EOT
+    proxy_set_header Connection "upgrade";
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_read_timeout 60000s;
+#working
+proxy_set_header Connection "upgrade";
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_cache_bypass $http_upgrade;
+#end of working
+
+
+
+                EOT
+  }
+  wikijs = {
+    #enabled     = false
+    geoip_blocking = false
+    service        = "wikijs-svc.wikijs.svc:3000"
+    extra-value    = <<EOT
+client_max_body_size 20m;
+        proxy_request_buffering off;
+                EOT
+  }
+
+  keycloak = {
+    enabled     = false
+    service     = "keycloak-svc.keycloak.svc:8080"
+    extra-value = <<EOT
+
+        set_real_ip_from 0.0.0.0/0;
+        real_ip_header X-Real-IP;
+        real_ip_recursive on;
+                        EOT
+  }
+  oauthn = {
+    enabled = false
+    service = "oauth2-proxy-svc.oauth2-proxy.svc:4180"
+
+    # extra-value = <<EOT
+    # location /oauth2/ {
+    #	proxy_pass http://oauthn_backend;
+    #	proxy_set_header Host $host;
+    #	proxy_set_header X-Real-IP $remote_addr;
+    #	proxy_set_header X-Scheme $scheme;
+    #   }
+    #              EOT
+
+
+  }
+  emailproxy = {
+    enabled = false
+    service = "emailproxy-svc.paper.svc:80"
+  }
+  tdarr = {
+    enabled              = false
+    service              = "tdarr-svc.servarr.svc:8265"
+    extra-value-location = <<EOT
+    proxy_set_header Connection "upgrade";
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto $scheme;
+    proxy_read_timeout 60000s;
+#working
+proxy_set_header Connection "upgrade";
+    proxy_set_header X-Real-IP $remote_addr;
+    proxy_cache_bypass $http_upgrade;
+#end of working
+
+
+
+                EOT
+
+  }
+  opencloud = {
+    enabled          = false
+    service          = "opencloud-svc.opencloud.svc:9200"
+    proxy_pass_https = true
+
+  }
+  owncloud = {
+    enabled = false
+    service = "owncloud-svc.owncloud.svc:8080"
+  }
+
+  #overleaf = {
+  #  service = "overleaf-svc.overleaf.svc:80"
+  #}
+}
+deny_ip = ["1.2.3.4"]