can create new entries with random password not erased after new excution

.gitignore

@@ -35,3 +35,7 @@ override.tf.json
 # Ignore CLI configuration files
 .terraformrc
 terraform.rc
+
+module.tf.save*
+terraform.tfstate*
+.terraform.lock.hcl

README.md

@@ -14,10 +14,11 @@ Define the image tag
 ### pvc = 
 ***optional***
 specifiy the pvc details 
-####     name       = string
+##     name       = string
 Name of the PVC
 
-####     pvc        = optional(bool, false)
+
+##     pvc        = optional(bool, false)
 ***PVC - Hostpath - Configmap shouldn't be specifiy at the same time***
 Boolean to specify if it is a PVC 
 [Example](https://gitea.tryton.geeraert.eu/pi-ux-ce/Terraform_kube#volume-as-pvc)
@@ -29,6 +30,8 @@ Boolean to specify if it is a hostpath
 [Example](https://gitea.tryton.geeraert.eu/pi-ux-ce/Terraform_kube#volume-as-hostpath)
 ####     pvc_size   = optional(string)
 ####     mount_path = string
+####     storage_class_name = optional(string, "nfs-storage-intelligent")
+This is the storage class, by default it will use nfs-storage-intelligent but it can be changed to something more suitable
 ### environment = optional(map(object({
 ###     name  = optional(string)
 ###     value = optional(string)
@@ -63,7 +66,100 @@ Not required , the object name will be used if not specified
 
 
 
-## example
+## examples
+
+### enabled
+
+Disable the whole object , including PVC , secrets , deployments and services 
+If you just want to remove the pod , you should consider set the replica option to 0 
+
+```
+        enabled   = false
+```
+
+### replicas
+
+Set the number of replicas , can be used tyo keep the ressources and only remove the pods
+
+```
+replicas     = 0
+```
+
+
+### namespace
+
+Specify a different namespace , by default it will take the name of the object otherwise
+
+```
+    namespace = "testnginx"
+```
+
+### image
+
+Specify the image to use , mandatory
+
+```
+    image = "nginx:latest"
+```
+
+### Database
+
+Specifying the object (even empty) will automatically create all the objects related to the database (service,deployment,...)
+
+```
+ database = {}
+```
+#### Custom images version
+
+You can select a custom image, by default it will use postgresql , if you do change the image , check if teh port is the same , otgherwise it will use postgresql defaut port 
+
+```
+    database = {
+      "image"     = "lscr.io/linuxserver/mariadb"
+      
+    }
+```
+
+#### Custom database port
+
+You can select a custom database port , by default it will use postgresql , remember to update the secret for that 
+The database service will be automatically updated to reflect this port as well 
+
+```
+    database = {
+      "image"     = "lscr.io/linuxserver/mariadb"
+      "port"      = 3306
+      
+    }
+```
+
+#### Custom mountpath 
+
+You can select a custom mount path, by default it will use postgresql data folder (/var/lib/postgresql/data)
+
+```
+    database = {
+      "mountPath" = "/config"
+    }
+```
+### redis 
+
+Specifying the object (even empty) will automatically create all the objects related to Redis (service,deployment,...)
+
+```
+ redis = {}
+```
+#### Custom images version
+
+You can select a custom image, by default it will use redis version 7 (docker.io/library/redis:7) 
+
+```
+redis = {
+    image = "docker.io/library/redis:7" 
+    }
+```
+
+
 
 
 ### Extra manifest
@@ -72,6 +168,39 @@ You can add some extra manifest using this command
 ```
     extra_manifest = ["/opt/kubernetes/Bookstack_kube/Bookstack.configmap.yaml","/opt/kubernetes/Bookstack_kube/Bookstack.secret.yaml"]
 ```
+
+### environment 
+
+#### Simple environment variables
+
+You can specifiy a variable through the environment object 
+```
+    environment = {
+      PORT = {
+        value = "80"
+      }
+    }
+```
+#### environment_variables from a secret
+
+```
+    environment = {
+      MYSQL_ROOT_PASSWORD = {
+        value_from = {
+          secret_key_ref = {
+            name = "bookstack-credentials"
+            key  = "DB_PASS"
+          }
+        }
+      }
+    }
+```
+
+### Secret reference
+
+You can have your secret fully mounted instead of specifiying all the variables
+    secret_ref = ["secret1"]
+
 ### Volumes
 #### Volume as PVC
 

external_manifests/gluetun/gluetun-secret-netherland.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+data:
+  VPN_DNS_IP: MTAuMi4wLjE=
+  VPN_ENDPOINT_IP: MjEyLjguMjUzLjEzNw==
+  VPN_ENDPOINT_PORT: NTE4MjA=
+  WIREGUARD_PRIVATE_KEY: Y0grY0hLd3FMeXV3UlVlZy8wRjFYWVlDQVM4bkQwWGsxNmVOQlVLc2tYbz0=
+  WIREGUARD_PUBLIC_KEY: VVJwZVp4dHlVWEFVVUEwTVdjRmRDU2E3RitNdmNoSjRlTlNKVWV0S0VHaz0=
+kind: Secret
+metadata:
+  creationTimestamp: null
+  name: gluetun-secret-netherland
+  namespace: gluetun

external_manifests/paperless/Paperless.secret.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+data:
+  POSTGRES_DB: cGFwZXJsZXNz
+  POSTGRES_USER: cGFwZXJsZXNz
+  POSTGRES_PASSWORD: cGFwZXJsZXNz
+  PAPERLESS_ADMIN_USER: YWRtaW4=
+  PAPERLESS_ADMIN_PASSWORD: YWRtaW4=
+  POSTGRES_HOST: cGFwZXItZGItc3Zj
+kind: Secret
+metadata:
+  name: paperless-credentials
+  namespace: paper
+type: Opaque

external_manifests/servarr/Bookstack.secret.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+data:
+  DB_DATABASE: Ym9va3N0YWNrYXBw
+#  DB_HOST: ZGIuYm9va3N0YWNrLnN2Yw==
+  DB_HOST: Ym9va3N0YWNrLWRiLXN2Yw==
+  DB_PASS: VW5oYXBweS1Db21tZW5jZS1FdmVyeW9uZTQ=
+  DB_USER: Ym9va3N0YWNrX3VzZXJuYW1l
+  APP_KEY: "N3dvdmU3ZDQwbjlyNm90YW43ZGEyODQ5am10ajlqNHU="
+kind: Secret
+metadata:
+#  creationTimestamp: "2024-06-13T07:37:49Z"
+  name: bookstack-credentials
+  namespace: bookstack
+#  resourceVersion: "20756717"
+#  uid: 66d4cc7d-741a-49cc-979d-a8b95ffb983a
+type: Opaque

external_manifests/servarr/gluetun-secret-netherland.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+data:
+  VPN_DNS_IP: MTAuMi4wLjE=
+  VPN_ENDPOINT_IP: MjEyLjguMjUzLjEzNw==
+  VPN_ENDPOINT_PORT: NTE4MjA=
+  WIREGUARD_PRIVATE_KEY: Y0grY0hLd3FMeXV3UlVlZy8wRjFYWVlDQVM4bkQwWGsxNmVOQlVLc2tYbz0=
+  WIREGUARD_PUBLIC_KEY: VVJwZVp4dHlVWEFVVUEwTVdjRmRDU2E3RitNdmNoSjRlTlNKVWV0S0VHaz0=
+kind: Secret
+metadata:
+  creationTimestamp: null
+  name: gluetun-secret-netherland
+  namespace: tservarr

external_manifests/servarr/prowlarr-db.svc.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: database
+  namespace: servarr
+  annotations:
+spec:
+  ipFamilyPolicy: PreferDualStack
+  ports:
+    - name: tcp
+      port: 5432
+      targetPort: 5432
+      protocol: TCP
+
+  type: LoadBalancer
+  selector:
+    app: prowlarr-db

external_manifests/servarr/prowlarr.secret.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+data:
+  DB_DATABASE: cHJvd2xhcnItbWFpbg==
+  DB_HOST: cHJvd2xhcnItZGItc3Zj
+  DB_PASS: R29saWF0aC1EZWVwZW4tRGl2aWRpbmc3
+  DB_USER: cHJvd2xhcnJfdXNlcm5hbWU=
+kind: Secret
+metadata:
+  creationTimestamp: null
+  name: prowlarr-credentials
+  namespace: bookstack

external_manifests/servarr/prowlarr_add_bulk_indexer.configmap.yml

@@ -0,0 +1,47 @@
+apiVersion: v1
+data:
+  prowlarr_add_bulk_indexer.sh: |
+    #!/bin/sh
+
+    # install package with apk
+    apk add curl jq
+    # Base URL and API key
+    BASE_URL="https://tprowlarr.tryton.geeraert.eu"
+    API_KEY="c5655e0b915d46dbb68d80f40a2daae4"
+
+    APP_PROFILE_ID=1  # Set this to a valid App Profile Id
+
+    # Get the list of all available indexers
+    available_indexers=$(curl -s -X GET "$BASE_URL/api/v1/indexer/schema" \
+        -H "accept: application/json" \
+        -H "X-Api-Key: $API_KEY")
+
+    # Loop through each indexer and add it to Prowlarr
+    echo "$available_indexers" | jq -c '.[]' | while read -r indexer; do
+        indexer_name=$(echo "$indexer" | jq -r '.name')
+        indexer_settings=$(echo "$indexer" | jq -c '.')
+
+        # Add the AppProfileId to the indexer settings
+        indexer_settings=$(echo "$indexer_settings" | jq --argjson appProfileId "$APP_PROFILE_ID" '. + {AppProfileId: $appProfileId}')
+
+        echo "Adding indexer: $indexer_name"
+
+        curl -s -X POST "$BASE_URL/api/v1/indexer" \
+            -H "accept: application/json" \
+            -H "X-Api-Key: $API_KEY" \
+            -H "Content-Type: application/json" \
+            -d "$indexer_settings"
+
+        echo "Indexer $indexer_name added."
+    done
+    return 0
+kind: ConfigMap
+metadata:
+  annotations:
+    kubectl.kubernetes.io/last-applied-configuration: |
+      {"apiVersion":"v1","data":{"prowlarr_add_bulk_indexer.sh":"#!/bin/bash\n\n# Base URL and API key\nBASE_URL=\"https://prowlarr.tryton.geeraert.eu\"\nAPI_KEY=\"0cb77d794ab74f158daaae044ab850ee\"\n\nAPP_PROFILE_ID=1  # Set this to a valid App Profile Id\n\n# Get the list of all available indexers\navailable_indexers=$(curl -s -X GET \"$BASE_URL/api/v1/indexer/schema\" \\\n    -H \"accept: application/json\" \\\n    -H \"X-Api-Key: $API_KEY\")\n\n# Loop through each indexer and add it to Prowlarr\necho \"$available_indexers\" | jq -c '.[]' | while read -r indexer; do\n    indexer_name=$(echo \"$indexer\" | jq -r '.name')\n    indexer_settings=$(echo \"$indexer\" | jq -c '.')\n\n    # Add the AppProfileId to the indexer settings\n    indexer_settings=$(echo \"$indexer_settings\" | jq --argjson appProfileId \"$APP_PROFILE_ID\" '. + {AppProfileId: $appProfileId}')\n\n    echo \"Adding indexer: $indexer_name\"\n\n    curl -s -X POST \"$BASE_URL/api/v1/indexer\" \\\n        -H \"accept: application/json\" \\\n        -H \"X-Api-Key: $API_KEY\" \\\n        -H \"Content-Type: application/json\" \\\n        -d \"$indexer_settings\"\n\n    echo \"Indexer $indexer_name added.\"\ndone\n"},"kind":"ConfigMap","metadata":{"annotations":{},"creationTimestamp":null,"name":"prowlarr-add-bulk-indexer","namespace":"servarr"}}
+  creationTimestamp: "2025-02-24T14:53:38Z"
+  name: prowlarr-add-bulk-indexer
+  namespace: tservarr
+  resourceVersion: "101531049"
+  uid: daa8c869-779c-49f2-a2ca-bad2d6d77035

external_manifests/servarr/prowlarr_indexers.job.yaml

@@ -0,0 +1,28 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: prowlarr-bulk-add-indexers
+  namespace: tservarr
+spec:
+  template:
+    spec:
+      containers:
+      - name: prowlarr-bulk-add-indexers
+        image: alpine
+        imagePullPolicy: Always
+        volumeMounts:
+        - mountPath: /config
+          name: scripts
+        command:
+          - /bin/sh
+          - -c
+          - /config/prowlarr_add_bulk_indexer.sh
+#        command: ["chmod","+x","/config/prowlarr_add_bulk_indexer.sh",";","./config/prowlarr_add_bulk_indexer.sh"]
+      restartPolicy: Never
+      volumes:
+      - configMap:
+          defaultMode: 365
+          name: prowlarr-add-bulk-indexer
+        name: scripts
+  backoffLimit: 4
+

external_manifests/servarr/servarr-db.secret.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+data:
+  DB_DATABASE: cHJvd2xhcnItbWFpbg==
+  DB_HOST: cHJvd2xhcnItZGItc3Zj
+  DB_PASS: R29saWF0aC1EZWVwZW4tRGl2aWRpbmc3
+  DB_USER: c2VydmFycl91c2VybmFtZQ==
+kind: Secret
+metadata:
+  creationTimestamp: null
+  name: servarr-db-credentials
+  namespace: servarr

external_manifests/stash/download.sh

@@ -0,0 +1,76 @@
+#!/bin/bash
+
+#install required packages
+apk add curl wget
+
+#named argument generation
+skip_searching_gallery="${skip_searching_gallery:-false}"
+
+
+while [ $# -gt 0 ]; do
+    if [[ $1 == "--"* ]]; then
+        v="${1/--/}"
+        declare "$v"="$2"
+        shift
+    fi
+    shift
+done
+
+#check if we will use a HTTP proxy or not
+
+if [[ -z $http_proxy ]]; then
+        echo "not using proxy"
+        curl_command="curl"
+else
+        echo "using proxy"
+        curl_command="curl -x $http_proxy"
+
+fi
+
+
+#dowload from https://www.pornpics.com/pornstars/eiby-shine/
+DESTINATION_FOLDER="/data"
+PROXY_HTTP="http://gluetun-svc.gluetun.svc:8888"
+
+#BASE_URL="https://www.pornpics.com/pornstars/eiby-shine/"
+#pornstars="eiby-shine"
+
+BASE_URL="https://www.pornpics.com/?q=shy+imp"
+pornstars="shy-imp"
+
+#BASE_URL="https://www.pornpics.com/pornstars/becky-summer"
+#pornstars="becky-summer"
+
+
+#clear files beforehand
+
+
+mkdir -p $DESTINATION_FOLDER/$pornstars
+
+if [[ $skip_searching_gallery == true ]]; then
+        echo "not looping through galleries"
+		echo "using existing file instead"
+		#because we need to keep the file $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt with the existing URL , in this condition, 
+		#no deletion of this file
+else
+        echo "looping through galleries"
+		#because we will re-generate this file, can be emptied
+		echo "" > $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt
+        $curl_command -s $BASE_URL |  grep -Eo "(http|https)://[a-zA-Z0-9./?=_%:-]*" | grep "https://www.pornpics.com/galleries/" |sort -u >> $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt
+fi
+
+echo "" > $DESTINATION_FOLDER/$pornstars-image_to_download.txt
+
+
+for f in $(cat $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt ); do
+	$curl_command $f | grep -Eo "(http|https)://[a-zA-Z0-9./?=_%:-]*" | grep "https://cdni.pornpics.com/1280" >> $DESTINATION_FOLDER/$pornstars-image_to_download.txt
+	echo $f
+done
+
+
+for g in $(cat $DESTINATION_FOLDER/$pornstars-image_to_download.txt ); do 
+	$curl_command -O --output-dir $DESTINATION_FOLDER/$pornstars $g
+#        wget -e use_proxy=yes -e http_proxy=$PROXY_HTTP $g -P $DESTINATION_FOLDER/$pornstars
+        echo $g 
+done
+exit 0

external_manifests/stash/gluetun-secret-netherland.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+data:
+  VPN_DNS_IP: MTAuMi4wLjE=
+  VPN_ENDPOINT_IP: MjEyLjguMjUzLjEzNw==
+  VPN_ENDPOINT_PORT: NTE4MjA=
+  WIREGUARD_PRIVATE_KEY: Y0grY0hLd3FMeXV3UlVlZy8wRjFYWVlDQVM4bkQwWGsxNmVOQlVLc2tYbz0=
+  WIREGUARD_PUBLIC_KEY: VVJwZVp4dHlVWEFVVUEwTVdjRmRDU2E3RitNdmNoSjRlTlNKVWV0S0VHaz0=
+kind: Secret
+metadata:
+  creationTimestamp: null
+  name: gluetun-secret-netherland
+  namespace: stash

external_manifests/stash/reddit_downloader.sh

@@ -0,0 +1,65 @@
+#!/bin/bash
+
+# Check if username is provided
+if [ -z "$1" ]; then
+    echo "Usage: $0 <reddit_username> <destination_folder>"
+    exit 1
+fi
+
+USER="$1"
+DEST_FOLDER="${2:-./${USER}_images}"
+USER_AGENT="Mozilla/5.0 (compatible; RedditImageDownloader/1.0)"
+
+mkdir -p "$DEST_FOLDER"
+
+AFTER=""
+BASE_URL="https://www.reddit.com/user/$USER/submitted/.json"
+
+echo "Fetching all image posts from user $USER..."
+
+while true; do
+    # Build URL with pagination
+    if [ -z "$AFTER" ]; then
+        URL="${BASE_URL}?limit=100"
+    else
+        URL="${BASE_URL}?limit=100&after=${AFTER}"
+    fi
+
+    # Fetch posts
+    RESPONSE=$(curl -s -A "$USER_AGENT" "$URL")
+
+    # Validate JSON
+    if ! echo "$RESPONSE" | jq empty 2>/dev/null; then
+        echo "Error: Failed to fetch or parse JSON. Exiting."
+        break
+    fi
+
+    # Extract image URLs
+    IMAGE_URLS=$(echo "$RESPONSE" | jq -r '.data.children[] | select(.data.url | test("\\.(jpg|jpeg|png|gif)$")) | .data.url')
+
+    # Exit if no more images found
+    if [ -z "$IMAGE_URLS" ]; then
+        echo "No more images found on this page."
+    fi
+
+    # Download images
+    echo "$IMAGE_URLS" | while read -r image_url; do
+        [ -z "$image_url" ] && continue
+        FILENAME=$(basename "$image_url")
+        if [ ! -f "$DEST_FOLDER/$FILENAME" ]; then
+            echo "Downloading $FILENAME..."
+            curl -s -A "$USER_AGENT" -o "$DEST_FOLDER/$FILENAME" "$image_url"
+        else
+            echo "Skipping existing file $FILENAME"
+        fi
+    done
+
+    # Get 'after' token for pagination
+    AFTER=$(echo "$RESPONSE" | jq -r '.data.after')
+    if [ "$AFTER" == "null" ] || [ -z "$AFTER" ]; then
+        echo "Reached end of posts."
+        break
+    fi
+done
+
+echo "Download complete. Images saved to $DEST_FOLDER"

external_manifests/stash/stash-pornpics-dowloader.configmap.yml

@@ -0,0 +1,32 @@
+apiVersion: v1
+data:
+  download.sh: "#!/bin/bash\n\n#install required packages\napk add curl wget\n\n#named
+    argument generation\nskip_searching_gallery=\"${skip_searching_gallery:-false}\"\n\n\nwhile
+    [ $# -gt 0 ]; do\n    if [[ $1 == \"--\"* ]]; then\n        v=\"${1/--/}\"\n        declare
+    \"$v\"=\"$2\"\n        shift\n    fi\n    shift\ndone\n\n#check if we will use
+    a HTTP proxy or not\n\nif [[ -z $http_proxy ]]; then\n        echo \"not using
+    proxy\"\n        curl_command=\"curl\"\nelse\n        echo \"using proxy\"\n        curl_command=\"curl
+    -x $http_proxy\"\n\nfi\n\n\n#dowload from https://www.pornpics.com/pornstars/eiby-shine/\nDESTINATION_FOLDER=\"/data\"\nPROXY_HTTP=\"http://gluetun-svc.gluetun.svc:8888\"\n\n#BASE_URL=\"https://www.pornpics.com/pornstars/eiby-shine/\"\n#pornstars=\"eiby-shine\"\n\nBASE_URL=\"https://www.pornpics.com/?q=shy+imp\"\npornstars=\"shy-imp\"\n\n#BASE_URL=\"https://www.pornpics.com/pornstars/becky-summer\"\n#pornstars=\"becky-summer\"\n\n\n#clear
+    files beforehand\n\n\nmkdir -p $DESTINATION_FOLDER/$pornstars\n\nif [[ $skip_searching_gallery
+    == true ]]; then\n        echo \"not looping through galleries\"\n\t\techo \"using
+    existing file instead\"\n\t\t#because we need to keep the file $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt
+    with the existing URL , in this condition, \n\t\t#no deletion of this file\necho
+    \"https://www.pornpics.com/galleries/onlyfans-shy-imp-starring-shy-imp-naked-porn-pics-90263490/\nhttps://www.pornpics.com/galleries/onlyfans-shy-imp-featuring-shy-imp-xxx-porn-pics-15741579/\nhttps://www.pornpics.com/galleries/onlyfans-shy-imp-starring-shy-imp-naked-photos-68925414/\nhttps://www.pornpics.com/galleries/onlyfans-shy-imp-shy-imp-20862921/\nhttps://www.pornpics.com/galleries/skinny-girl-with-pink-hair-shy-imp-shows-her-small-tits-during-a-solo-show-50988369/\nhttps://www.pornpics.com/galleries/onlyfans-shy-imp-featuring-shy-imp-hot-gallery-86312934/\"
+    >> $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt\n\nelse\n        echo
+    \"looping through galleries\"\n\t\t#because we will re-generate this file, can
+    be emptied\n\t\techo \"\" > $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt\n
+    \       $curl_command -s $BASE_URL |  grep -Eo \"(http|https)://[a-zA-Z0-9./?=_%:-]*\"
+    | grep \"https://www.pornpics.com/galleries/\" |sort -u >> $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt\nfi\n\necho
+    \"\" > $DESTINATION_FOLDER/$pornstars-image_to_download.txt\n\n\nfor f in $(cat
+    $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt ); do\n\t$curl_command $f
+    | grep -Eo \"(http|https)://[a-zA-Z0-9./?=_%:-]*\" | grep \"https://cdni.pornpics.com/1280\"
+    >> $DESTINATION_FOLDER/$pornstars-image_to_download.txt\n\techo $f\ndone\n\n\nfor
+    g in $(cat $DESTINATION_FOLDER/$pornstars-image_to_download.txt ); do \n\t$curl_command
+    -O --output-dir $DESTINATION_FOLDER/$pornstars $g\n#        wget -e use_proxy=yes
+    -e http_proxy=$PROXY_HTTP $g -P $DESTINATION_FOLDER/$pornstars\n        echo $g
+    \ndone\nexit 0\n"
+kind: ConfigMap
+metadata:
+  creationTimestamp: null
+  name: pornpic-dowloader
+  namespace: stash

external_manifests/stash/stash-pornpics-dowloader.job.yml

@@ -0,0 +1,37 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: stash-pornpics-dowloader
+  namespace: stash
+spec:
+  template:
+    spec:
+      containers:
+      - name: stash-pornpics-dowloader
+        image: bash
+        imagePullPolicy: Always
+        volumeMounts:
+        - mountPath: /config
+          name: scripts
+        - mountPath: /data
+          mountPropagation: None
+          name: data-pvc
+        command:
+#          - /bin/bash
+#          - -c
+#          - sleep 3600
+          - bash
+          - /config/download.sh 
+          - --http_proxy 
+          - "http://gluetun-svc.gluetun.svc:8888"
+      restartPolicy: Never
+      volumes:
+      - configMap:
+          defaultMode: 0744
+          name: pornpic-dowloader
+        name: scripts
+      - name: data-pvc
+        persistentVolumeClaim:
+          claimName: data-pvc
+  backoffLimit: 4
+

external_manifests/stash/stash-reddit-dowloader.configmap.yml

@@ -0,0 +1,73 @@
+apiVersion: v1
+data:
+  reddit_downloader.sh: |
+    #!/bin/bash
+
+    # Check if username is provided
+    if [ -z "$1" ]; then
+        echo "Usage: $0 <reddit_username> <destination_folder>"
+        exit 1
+    fi
+
+    USER="$1"
+    DEST_FOLDER="${2:-./${USER}_images}"
+    USER_AGENT="Mozilla/5.0 (compatible; RedditImageDownloader/1.0)"
+
+    mkdir -p "$DEST_FOLDER"
+
+    AFTER=""
+    BASE_URL="https://www.reddit.com/user/$USER/submitted/.json"
+
+    echo "Fetching all image posts from user $USER..."
+
+    while true; do
+        # Build URL with pagination
+        if [ -z "$AFTER" ]; then
+            URL="${BASE_URL}?limit=100"
+        else
+            URL="${BASE_URL}?limit=100&after=${AFTER}"
+        fi
+
+        # Fetch posts
+        RESPONSE=$(curl -s -A "$USER_AGENT" "$URL")
+
+        # Validate JSON
+        if ! echo "$RESPONSE" | jq empty 2>/dev/null; then
+            echo "Error: Failed to fetch or parse JSON. Exiting."
+            break
+        fi
+
+        # Extract image URLs
+        IMAGE_URLS=$(echo "$RESPONSE" | jq -r '.data.children[] | select(.data.url | test("\\.(jpg|jpeg|png|gif)$")) | .data.url')
+
+        # Exit if no more images found
+        if [ -z "$IMAGE_URLS" ]; then
+            echo "No more images found on this page."
+        fi
+
+        # Download images
+        echo "$IMAGE_URLS" | while read -r image_url; do
+            [ -z "$image_url" ] && continue
+            FILENAME=$(basename "$image_url")
+            if [ ! -f "$DEST_FOLDER/$FILENAME" ]; then
+                echo "Downloading $FILENAME..."
+                curl -s -A "$USER_AGENT" -o "$DEST_FOLDER/$FILENAME" "$image_url"
+            else
+                echo "Skipping existing file $FILENAME"
+            fi
+        done
+
+        # Get 'after' token for pagination
+        AFTER=$(echo "$RESPONSE" | jq -r '.data.after')
+        if [ "$AFTER" == "null" ] || [ -z "$AFTER" ]; then
+            echo "Reached end of posts."
+            break
+        fi
+    done
+
+    echo "Download complete. Images saved to $DEST_FOLDER"
+kind: ConfigMap
+metadata:
+  creationTimestamp: null
+  name: stash-reddit-dowloader
+  namespace: stash

external_manifests/stash/stash-reddit-dowloader.job.yml

@@ -0,0 +1,34 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: stash-reddit-dowloader
+  namespace: stash
+spec:
+  template:
+    spec:
+      containers:
+      - name: stash-reddit-dowloader
+        image: alpine
+        imagePullPolicy: Always
+        volumeMounts:
+        - mountPath: /config
+          name: scripts
+        - mountPath: /data
+          mountPropagation: None
+          name: data-pvc
+        command:
+          - /bin/sh
+          - -c
+          - sleep 3600
+#          - /config/reddit_downloader.sh Countem1a /data
+      restartPolicy: Never
+      volumes:
+      - configMap:
+          defaultMode: 365
+          name: stash-reddit-dowloader
+        name: scripts
+      - name: data-pvc
+        persistentVolumeClaim:
+          claimName: data-pvc
+  backoffLimit: 4
+

external_manifests/stash/test_named_arguments.sh

@@ -0,0 +1,36 @@
+#!/bin/sh
+
+skip_searching_gallery="${skip_searching_gallery:-false}"
+
+#echo "$skip_searching_gallery"
+
+
+while [ $# -gt 0 ]; do
+    if [[ $1 == "--"* ]]; then
+        v="${1/--/}"
+        #declare "$v"="$2"
+        "$v"="$2"
+
+        shift
+    fi
+    shift
+done
+
+#echo "$skip_searching_gallery"
+#if [[ -z $skip_searching_gallery ]]; then
+if [[ $skip_searching_gallery == true ]]; then
+	echo "not looping through galleries"
+else
+        echo "looping through galleries"
+fi
+
+if [[ -z $http_proxy ]]; then
+        echo "not using proxy"
+	curl_command="curl"
+else
+        echo "using proxy"
+        curl_command="curl -x $http_proxy"
+
+fi
+echo $curl_command
+$curl_command https://cdni.pornpics.com/460/7/424/83105958/83105958_010_388f.jpg -O 

external_manifests/wikijs/wikijs-db.secret.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+data:
+  DB_DATABASE: d2lraQ==
+  DB_HOST: d2lraWpzLWRiLXN2Yw==
+  DB_PASS: VmVzdDctUHJvZHVjdC1VbnN0ZWFkeQ==
+  DB_USER: d2lraWpzX3VzZXJuYW1l
+kind: Secret
+metadata:
+  creationTimestamp: null
+  name: wikijs-db-credentials
+  namespace: wikijs

module.tf

@@ -1,11 +1,59 @@
 terraform {
   required_version = "> 0.8.0"
+  required_providers {
+    bitwarden = {
+      source  = "maxlaverse/bitwarden"
+      version = ">= 0.13.6"
+    }
+  }
 }
 
 provider "kubernetes" {
   config_path = "~/.kube/config"
 }
 
+provider "bitwarden" {
+  email           = "pierre@geeraert.eu"
+  master_password = ""
+  server          = "https://bitwarden.tryton.geeraert.eu"
+  experimental {
+    embedded_client = true
+  }
+}
+#https://stackoverflow.com/questions/66670949/how-to-tell-terraform-to-skip-the-secret-manager-resource-if-it-exists
+#for the secret not overwritten (not tested)
+data "bitwarden_item_login" "example" {
+  search = "bookstack.zeus.geeraert.eu"
+}
+
+data "bitwarden_item_secure_note" "vpn_preshared_key" {
+  search = "terraform testing"
+}
+output "pgpin" {
+  value     = nonsensitive(coalesce(data.bitwarden_item_secure_note.vpn_preshared_key.field.1.hidden,1234))
+  sensitive = true
+}
+
+resource "random_password" "password" {
+  length           = 16
+  special          = true
+  override_special = "!#$%&*()-_=+[]{}<>:?"
+}
+
+resource "bitwarden_item_secure_note" "terraform_upload_testing" {
+  name            = "terraform upload testing"
+#  notes           = <<EOT
+#[global]
+#secret = "<something sensitive>"
+#EOT
+  organization_id = "a6361589-badd-4bde-9cb4-af8901161c0d"
+  collection_ids  = ["3fa902cd-8244-46bc-a4ea-af8901262d94"]
+
+  field {
+    name = "category"
+    hidden = random_password.password.result
+  }
+}
 
 variable "kubernetes" {
   type = map(object({
@@ -17,6 +65,7 @@ variable "kubernetes" {
       config_map         = optional(bool, false)
       host_path          = optional(string)
       pvc_size           = optional(string)
+      storage_class_name = optional(string, "nfs-storage-intelligent")
       mount_path         = string
     })))
     environment = optional(map(object({
@@ -31,7 +80,11 @@ variable "kubernetes" {
     })))
     replicas            = optional(number, 1)
     namespace           = optional(string)
-    service_port           = optional(number)
+    connected_namespace = optional(string, "")
+    #    namespace           = optional(string,coalesce(connected_namespace,""))
+    #block_namespace_creation = optional(bool, false)
+    service_port           = optional(list(number))
+    service_type           = optional(string, "ClusterIP")
     service_name           = optional(string)
     liveness_tcp_socket    = optional(number)
     liveness_http_get      = optional(string)
@@ -42,13 +95,16 @@ variable "kubernetes" {
     secret_ref             = optional(list(string))
     config_map_ref         = optional(list(string))
     extra_manifest         = optional(list(string))
-    requirements = optional(map(string), {
+    requirements           = optional(map(string))
-      limits-cpu      = "800m"
+    #    requirements = optional(map(string), {
-      limits-memory   = "500Mi"
+    #      limits-cpu      = "800m"
-      requests-cpu    = "200m"
+    #      limits-memory   = "500Mi"
-      requests-memory = "200Mi"
+    #      requests-cpu    = "200m"
-    })
+    #      requests-memory = "200Mi"
+    #    })
+    dns_nameservers       = optional(string)
     environment_variables = optional(map(string), { name = "value" })
+    security_context      = optional(bool, false)
   }))
 
 }
@@ -62,7 +118,8 @@ locals {
         name               = pvc.name
         pvc_size           = pvc.pvc_size
         mount_path         = pvc.mount_path
-        namespace = coalesce(value.namespace, key)
+        storage_class_name = pvc.storage_class_name
+        namespace          = coalesce(value.namespace, value.connected_namespace, key)
     }] if value.enabled == true && value.pvc != null
   ])
 }
@@ -81,7 +138,7 @@ locals {
 data "kubernetes_all_namespaces" "allns" {}
 
 resource "kubernetes_namespace" "automatic" {
-  for_each = { for key, value in var.kubernetes : key => value if value.enabled == true }
+  for_each = { for key, value in var.kubernetes : key => value if value.enabled == true && value.connected_namespace == "" }
   metadata {
     annotations = {
       name = coalesce(each.value.namespace, each.key)
@@ -109,7 +166,7 @@ locals {
   ])
 }
 
-resource "kubernetes_manifest" "service" {
+resource "kubernetes_manifest" "manifest" {
   for_each = { for item in local.kubernetes_manifests : item.key => item }
 
   manifest = yamldecode(file(each.value.manifest))
@@ -121,7 +178,7 @@ resource "kubernetes_manifest" "service" {
 resource "kubernetes_persistent_volume_claim" "automatic-pvc" {
   for_each = { for key, value in local.pvc_details : "${value.index}" => merge(value, { mew_key = value.index }) if value.pvc }
   metadata {
-    namespace = each.value.namespace
+    namespace = coalesce(each.value.namespace, each.key)
     name      = "${each.value.name}-pvc"
     labels = {
       deployment_method = "Terraform"
@@ -129,7 +186,7 @@ resource "kubernetes_persistent_volume_claim" "automatic-pvc" {
   }
   spec {
     access_modes       = ["ReadWriteMany"]
-    storage_class_name = "nfs-storage-intelligent"
+    storage_class_name = each.value.storage_class_name
     resources {
       requests = {
         storage = each.value.pvc_size
@@ -140,7 +197,7 @@ resource "kubernetes_persistent_volume_claim" "automatic-pvc" {
 resource "kubernetes_persistent_volume_claim" "automatic-pvc-database" {
   for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
   metadata {
-    namespace = each.value.namespace
+    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
     name      = "${each.key}-db-pvc"
     labels = {
       deployment_method = "Terraform"
@@ -160,7 +217,7 @@ resource "kubernetes_persistent_volume_claim" "automatic-pvc-database" {
 resource "kubernetes_persistent_volume_claim" "automatic-pvc-redis" {
   for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
   metadata {
-    namespace = each.value.namespace
+    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
     name      = "${each.key}-redis-pvc"
     labels = {
       deployment_method = "Terraform"
@@ -181,19 +238,36 @@ resource "kubernetes_service" "automatic_service" {
   for_each = { for key, value in var.kubernetes : key => value if value.service_port != null && value.enabled == true }
   metadata {
     name      = "${each.key}-svc"
-    namespace = coalesce(each.value.namespace, each.key)
+    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
     labels = {
       deployment_method = "Terraform"
     }
+    annotations = each.value.service_type == "LoadBalancer" ? {
+      "metallb.universe.tf/ip-allocated-from-pool" = "first-pool"
+    } : {}
+
+
+
   }
   spec {
     selector = {
       app = each.key
     }
-    port {
+    dynamic "port" {
-      port        = each.value.service_port
+      for_each = each.value.service_port != null ? each.value.service_port : []
-      target_port = each.value.service_port
+      content {
+        port        = port.value
+        target_port = port.value
+        name        = replace("${each.key}${port.value}", "/(.{0,15})(.*)/", "$1")
+
       }
+    }
+
+    #    port {
+    #      port        = each.value.service_port
+    #      target_port = each.value.service_port
+    #    }
+    type = each.value.service_type
 
 
   }
@@ -205,7 +279,7 @@ resource "kubernetes_service" "automatic_service_database" {
   for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
   metadata {
     name      = "${each.key}-db-svc"
-    namespace = coalesce(each.value.namespace, each.key)
+    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
     labels = {
       deployment_method = "Terraform"
     }
@@ -219,7 +293,6 @@ resource "kubernetes_service" "automatic_service_database" {
       target_port = try(each.value.database.port, 5432)
     }
 
-
   }
 
 
@@ -231,7 +304,7 @@ resource "kubernetes_service" "automatic_service_redis" {
   for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
   metadata {
     name      = "${each.key}-redis-svc"
-    namespace = coalesce(each.value.namespace, each.key)
+    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
     labels = {
       deployment_method = "Terraform"
     }
@@ -252,8 +325,9 @@ resource "kubernetes_service" "automatic_service_redis" {
 resource "kubernetes_deployment_v1" "automatic" {
   for_each = { for key, value in var.kubernetes : key => value if value.enabled == true }
   metadata {
-    namespace = coalesce(each.value.namespace, each.key)
+    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
-    name      = coalesce(each.value.namespace, each.key)
+    name      = coalesce(each.value.name, each.key)
+
     labels = {
       app               = each.key
       deployment_method = "Terraform"
@@ -282,10 +356,11 @@ resource "kubernetes_deployment_v1" "automatic" {
           image = each.value.image
           name  = coalesce(each.value.name, each.key)
           dynamic "port" {
-            for_each = each.value.service_port != null ? [""] : []
+            for_each = each.value.service_port != null ? each.value.service_port : []
             content {
-              container_port = each.value.service_port
+              container_port = port.value
-              name           = each.key
+              #              name           = "${each.key}-${port.value}"
+              name = replace("${each.key}${port.value}", "/(.{0,15})(.*)/", "$1")
             }
           }
 
@@ -344,7 +419,20 @@ resource "kubernetes_deployment_v1" "automatic" {
 
             }
           }
+          dynamic "resources" {
+            for_each = each.value.requirements != null ? [1] : []
+            content {
+              limits = {
+                cpu    = each.value.requirements.limits-cpu
+                memory = each.value.requirements.limits-memory
+              }
+              requests = {
+                cpu    = each.value.requirements.requests-cpu
+                memory = each.value.requirements.requests-memory
+              }
 
+            }
+          }
 
           #          resources {
           #            limits = {
@@ -357,6 +445,15 @@ resource "kubernetes_deployment_v1" "automatic" {
           #            }
           #          }
 
+          dynamic "security_context" {
+            for_each = each.value.security_context == true ? [1] : []
+            content {
+              privileged = true
+              #capabilities = {
+              #  add : ["NET_ADMIN", "NET_RAW"]
+              #}
+            }
+          }
           dynamic "liveness_probe" {
             for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : []
             content {
@@ -367,7 +464,6 @@ resource "kubernetes_deployment_v1" "automatic" {
                 }
               }
 
-
               dynamic "http_get" {
                 for_each = each.value.liveness_http_get != null ? [""] : []
                 content {
@@ -381,7 +477,13 @@ resource "kubernetes_deployment_v1" "automatic" {
             }
           }
         }
+        dynamic "dns_config" {
+          for_each = each.value.dns_nameservers != null ? [1] : []
+          content {
+            nameservers = [each.value.dns_nameservers]
+          }
 
+        }
 
         dynamic "volume" {
           for_each = each.value.pvc != null ? each.value.pvc : {}
@@ -425,7 +527,7 @@ resource "kubernetes_deployment_v1" "database-automatic" {
 
 
   metadata {
-    namespace = coalesce(each.value.namespace, each.key)
+    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
     name      = "${coalesce(each.value.namespace, each.key)}-db"
     labels = {
       app               = each.key
@@ -550,7 +652,7 @@ resource "kubernetes_deployment_v1" "redis-automatic" {
 
 
   metadata {
-    namespace = coalesce(each.value.namespace, each.key)
+    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
     name      = "${coalesce(each.value.namespace, each.key)}-redis"
     labels = {
       app               = each.key

onitama_secret.yaml

@@ -1,10 +0,0 @@
-apiVersion: v1
-data:
-  POSTGRES_DB: dGVzdA==
-  POSTGRES_USER: dGVzdA==
-  POSTGRES_PASSWORD: dGVzdA==
-kind: Secret
-metadata:
-  name: mysecret
-  namespace: onitama
-type: Opaque