add before changes

.gitignore

@@ -39,3 +39,5 @@ terraform.rc
 module.tf.save*
 terraform.tfstate*
 .terraform.lock.hcl
+
+.bw-provider-state

cronjob.tf.20260813

@@ -0,0 +1,119 @@
+variable "cronjob" {
+  type = map(object({
+    name                = optional(string)
+    image               = string
+    enabled             = bool
+    namespace           = optional(string)
+    connected_namespace = optional(string, "")
+    schedule            = string
+    command             = optional(list(string))
+    args                = optional(list(string))
+
+
+  pvc = optional(map(object({
+      name                 = string
+      pvc                  = optional(bool, false)
+      config_map           = optional(bool, false)
+      secret               = optional(bool, false)
+      host_path            = optional(string)
+      pvc_size             = optional(string)
+      storage_class_name   = optional(string, "nfs-storage-intelligent")
+      annotations_fileType = optional(string)
+      existing_pvc         = optional(bool, false)
+      mount_path           = string
+      sub_path             = optional(string)
+    })))
+  }))
+
+}
+
+
+locals {
+  pvc_list = flatten([
+    for key, value in var.cronjob : [
+      for index, pvc in value.pvc : {
+        key                  = "${coalesce(value.namespace, value.connected_namespace, key)}/${pvc.name}"
+        index                = index
+        pvc                  = pvc.pvc
+        name                 = pvc.name
+        pvc_size             = pvc.pvc_size
+        mount_path           = pvc.mount_path
+        storage_class_name   = pvc.storage_class_name
+        annotations_fileType = pvc.annotations_fileType
+        existing_pvc         = pvc.existing_pvc
+        sub_path             = pvc.sub_path
+        namespace            = coalesce(value.namespace, value.connected_namespace, key)
+    }] if value.enabled == true && value.pvc != null
+  ])
+
+  # group duplicates instead of throwing an error
+  pvc_map_grouped = {
+    for p in local.pvc_list :
+    p.key => p...
+  }
+
+  # keep only one PVC per key (take the first)
+  pvc_map = {
+    for k, list in local.pvc_map_grouped :
+    k => list[0]
+  }
+
+  pvc_details = values(local.pvc_map)
+}
+
+resource "kubernetes_persistent_volume_claim_v1" "automatic-pvc-cronjob" {
+  for_each = { for key, value in local.pvc_details : "${value.index}" => merge(value, { mew_key = value.index }) if value.pvc && value.existing_pvc != true }
+  metadata {
+    namespace = coalesce(each.value.namespace, each.key)
+    name      = "${each.value.name}-pvc"
+    labels = {
+      deployment_method = "Terraform"
+    }
+    annotations = {
+      fileType = try(each.value.annotations_fileType, "file")
+    }
+
+  }
+
+  spec {
+    access_modes       = ["ReadWriteMany"]
+    storage_class_name = each.value.storage_class_name
+    resources {
+      requests = {
+        storage = each.value.pvc_size
+      }
+    }
+  }
+}
+
+resource "kubernetes_cron_job_v1" "automatic_cronjob" {
+  for_each = { for key, value in var.cronjob : key => value if value.enabled == true }
+  metadata {
+    name      = "${each.key}-cronjob"
+    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
+
+    labels = {
+      app               = each.key
+      deployment_method = "Terraform"
+    }
+  }
+  spec {
+    schedule = each.value.schedule
+    job_template {
+      metadata {}
+      spec {
+        template {
+          metadata {}
+          spec {
+            container {
+              name    = coalesce(each.value.name, each.key)
+              image   = each.value.image
+              command = each.value.command != null ? each.value.command : []
+              args    = each.value.args != null ? each.value.args : []
+            }
+          }
+        }
+      }
+    }
+  }
+}

external_manifests/gluetun/gluetun-secret-netherlandNL-FREE-280.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+data:
+  VPN_DNS_IP: MTAuMi4wLjE=
+  VPN_ENDPOINT_IP: ODkuMTA1LjIxNC4xOTY=
+  VPN_ENDPOINT_PORT: NTE4MjA=
+  WIREGUARD_PRIVATE_KEY: Q0h3OHNkVUliaVRPbTgxTzZGOWRyMm9Nc2k1ZFl4SnZValo1Z2Jwd3UzWT0=
+  WIREGUARD_PUBLIC_KEY: WG4yQkwrdmhJZ2dsMnVKZ29HY2NqMG4wQ3Z3N09hZU5LMXdPZk91dElTUT0=
+kind: Secret
+metadata:
+  creationTimestamp: null
+  name: gluetun-secret-nl-free-280
+  namespace: gluetun

module.tf

@@ -612,7 +612,7 @@ resource "kubernetes_deployment_v1" "database-automatic" {
 
   metadata {
     namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
-    name      = "${coalesce(each.value.namespace, each.key)}-db"
+    name      = "${coalesce(each.value.name, each.key)}-db"
     labels = {
       app               = each.key
       deployment_method = "Terraform"
@@ -786,7 +786,7 @@ resource "kubernetes_deployment_v1" "redis-automatic" {
 
   metadata {
     namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
-    name      = "${coalesce(each.value.namespace, each.key)}-redis"
+    name      = "${coalesce(each.value.name, each.key)}-redis"
     labels = {
       app               = each.key
       deployment_method = "Terraform"

module.tf.save

@@ -1,185 +0,0 @@
-terraform {
-  required_version = "> 0.8.0"
-}
-
-
-provider "kubernetes" {
-  config_path = "~/.kube/config"
-}
-
-
-resource "kubernetes_namespace" "screeps" {
-  metadata {
-    annotations = {
-      name = "screeps"
-    }
-    name = "screeps"
-  }
-}
-
-
-resource "kubernetes_persistent_volume_claim" "screeps-pvc" {
-  metadata {
-    namespace = "screeps"
-    name      = "screeps-pvc"
-  }
-  spec {
-    access_modes       = ["ReadWriteMany"]
-    storage_class_name = "nfs-storage-intelligent"
-    resources {
-      requests = {
-        storage = "1Gi"
-      }
-    }
-  }
-}
-
-
-resource "kubernetes_deployment_v1" "screeps" {
-  metadata {
-    namespace = "screeps"
-    name      = "screeps"
-    labels = {
-      app = "screepsserver"
-    }
-  }
-
-  spec {
-    replicas = 1
-
-    selector {
-      match_labels = {
-        app = "screepsserver"
-      }
-    }
-
-    template {
-      metadata {
-        labels = {
-          app = "screepsserver"
-        }
-      }
-
-      spec {
-        container {
-          image = "screepers/screeps-launcher"
-          name  = "screeps-launcher"
-          port {
-            container_port = 21025
-            name           = "screeps-port"
-          }
-          volume_mount {
-            mount_path = "/screeps"
-            name       = "screeps-volume"
-          }
-
-          resources {
-            limits = {
-              cpu    = "2"
-              memory = "2Gi"
-            }
-            requests = {
-              cpu    = "250m"
-              memory = "500Mi"
-            }
-          }
-
-
-
-        }
-        volume {
-          name = "screeps-volume"
-          persistent_volume_claim {
-            claim_name = "screeps-pvc"
-          }
-        }
-
-      }
-    }
-  }
-}
-
-resource "kubernetes_service" "screeps_service" {
-  metadata {
-    name      = "screeps"
-    namespace = "screeps"
-  }
-  spec {
-    selector = {
-      app = "screepsserver"
-    }
-    port {
-      port = 21025
-    }
-
-  }
-}
-
-
-variable "kubernetes" {
-  type = map(object({
-    service = string
-    #testingbool= bool
-    pvc_name                = optional(string)
-    namespace               = optional(string)
-    service_port            = optional(number)
-    LoadBalancerbool        = optional(string)
-    enabled                 = optional(bool, true)
-    proxy_cache             = optional(bool, false)
-    extra-value             = optional(string, "")
-    http2_bool              = optional(bool, false)
-    proxy_pass_https        = optional(bool, false)
-    authentication_required = optional(bool, false)
-  }))
-
-}
-
-resource "kubernetes_namespace" "automatic" {
-  for_each = { for key, value in var.kubernetes : key => value if value.enabled == true }
-  metadata {
-    annotations = {
-      name = coalesce(each.value.namespace, each.key)
-    }
-    name = coalesce(each.value.namespace, each.key)
-  }
-}
-
-
-resource "kubernetes_persistent_volume_claim" "automatic-pvc" {
-  for_each = { for key, value in var.kubernetes : key => value if value.pvc_name != null }
-  metadata {
-    namespace = coalesce(each.value.namespace, each.key)
-    name      = coalesce(each.value.namespace, each.key)
-  }
-  spec {
-    access_modes       = ["ReadWriteMany"]
-    storage_class_name = "nfs-storage-intelligent"
-    resources {
-      requests = {
-        storage = "1Gi"
-      }
-    }
-  }
-}
-
-
-resource "kubernetes_service" "automatic_service" {
-  for_each = { for key, value in var.kubernetes : key => value if value.service_port != null }
-  metadata {
-    name      = coalesce(each.value.namespace, each.key)
-    namespace = coalesce(each.value.namespace, each.key)
-  }
-  spec {
-    selector = {
-      app = "screepsserver"
-    }
-    port {
-      port = each.value.service_port
-    }
-
-if(each.value.LoadBalancerbool == "enabled" ? [type     = "LoadBalancer"] :[]
-
-    }
-
-  }
-}

nginx_config.tftpl

@@ -43,3 +43,48 @@ server {
         return 404;
 
 }
+############################################
+#       config file for ${name_site}
+############################################
+
+upstream ${name_site}_backend_root {
+        server ${name_service};
+        server 1.1.1.1 backup;
+    }
+
+server {
+        server_name ${name_site}.geeraert.eu www.${name_site}.geeraert.eu;
+        location / {
+                proxy_pass http://${name_site}_backend_root;
+                proxy_set_header    Upgrade     $http_upgrade;
+		proxy_set_header Host $host;
+        }
+        location /.well-known/acme-challenge/ {
+                root /var/www/certbot;
+        }
+
+	access_log /var/log/nginx/access.log my_custom_format;
+        access_log /var/log/nginx/ip_audit.log ip_audit;
+
+        listen 443 ssl;
+
+        ssl_certificate /etc/nginx/ssl/live/geeraert.eu/fullchain.pem;
+        ssl_certificate_key /etc/nginx/ssl/live/geeraert.eu/privkey.pem;
+
+}
+
+server {
+        if ($host = www.${name_site}.geeraert.eu) {
+                return 301 https://$host$request_uri;
+        }
+
+
+        if ($host = ${name_site}.geeraert.eu) {
+                return 301 https://$host$request_uri;
+        }
+
+        server_name www.${name_site}.geeraert.eu ${name_site}.geeraert.eu;
+        listen 80;
+        return 404;
+
+}

redis.tf

@@ -0,0 +1,56 @@
+resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_redis_host" {
+  for_each   = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
+  key        = "${each.key}__redis__host"
+  project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
+  value      = try(each.value.redis.host, "${each.key}-redis-svc.${coalesce(each.value.namespace, each.value.connected_namespace, each.key)}.svc")
+}
+
+resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_redis_port" {
+  for_each   = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
+  key        = "${each.key}__redis__port"
+  project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
+  value      = try(each.value.redis.port, 5432)
+}
+
+##
+## Commenting until I use the redis password option
+##
+#resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_redis_password" {
+#  for_each        = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
+#  key             = "${each.key}__redis__password"
+#  project_id      = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
+#  length          = 32
+#  special         = true
+#  min_special     = 5
+#  avoid_ambiguous = true
+#}
+
+resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_redis_REPLICATION_MODE" {
+  for_each   = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
+  key        = "${each.key}__redis__REPLICATION_MODE"
+  project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
+  value      = try(each.value.redis.REPLICATION_MODE, "master")
+}
+
+resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_redis_TLS_ENABLED" {
+  for_each   = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
+  key        = "${each.key}__redis__TLS_ENABLED"
+  project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
+  value      = try(each.value.redis.TLS_ENABLED, "no")
+}
+
+resource "kubernetes_secret_v1" "automatic-redis-secret" {
+  for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
+  metadata {
+    name      = "${each.key}-redis-terraform"
+    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
+  }
+
+  data = {
+    REDIS_HOSTNAME         = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_redis_host[each.key].value}"
+    REDIS_PORT             = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_redis_port[each.key].value}"
+    REDIS_REPLICATION_MODE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_redis_REPLICATION_MODE[each.key].value}"
+    REDIS_TLS_ENABLED      = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_redis_TLS_ENABLED[each.key].value}"
+  }
+
+}

variables.auto.tfvars

@@ -1,9 +1,10 @@
 kubernetes = {
   bookstack = {
-    #enabled = false
+    #enabled      = false
     replicas     = 01
     image        = "linuxserver/bookstack:latest"
     service_port = [80, 443]
+    domain_name  = "bookstack"
     database = {
       "engine"    = "mysql"
       "image"     = "lscr.io/linuxserver/mariadb"
@@ -469,7 +470,7 @@ kubernetes = {
         }
       }
       PAPERLESS_URL = {
-        value = "https://paperless.tryton.geeraert.eu"
+        value = "https://paperless.geeraert.eu"
       }
       PAPERLESS_TIKA_ENABLED = {
         value = "1"
@@ -671,72 +672,40 @@ kubernetes = {
 
 
 
-  next = {
+  nextcloud = {
     enabled        = false
-    namespace      = "next"
-    replicas       = 01
-    image          = "nextcloud:29.0.3-apache"
-    service_port   = [80]
-    extra_manifest = ["/opt/kubernetes/Nextcloud_kube/next.secret.yaml"]
+    namespace = "next"
+    #replicas     = 0
+    image        = "nextcloud:29.0.3-apache"
+    domain_name  = "next"
+    service_port = [80]
+    #extra_manifest = ["/opt/kubernetes/Nextcloud_kube/next.secret.yaml"]
+    secret_ref    = ["nextcloud-credentials"]
+    secret_import = ["b207c4b6-0489-4ab2-a032-b4a400a708e0"]
     database = {
     image = "docker.io/library/postgres:14" }
     redis = {
     image = "docker.io/library/redis:7" }
-    requirements = {
-      limits-cpu      = "800Mi"
-      limits-memory   = "800Mi"
-      requests-cpu    = "800Mi"
-      requests-memory = "800Mi"
-    }
+    #requirements = {
+    #  limits-cpu      = "800Mi"
+    #  limits-memory   = "800Mi"
+    #  requests-cpu    = "800Mi"
+    #  requests-memory = "800Mi"
+    #}
     environment = {
-      POSTGRES_DB = {
-        value_from = {
-          secret_key_ref = {
-            name = "nextcloud-credentials"
-            key  = "POSTGRES_DB"
-          }
-        }
-      }
-      POSTGRES_USER = {
-        value_from = {
-          secret_key_ref = {
-            name = "nextcloud-credentials"
-            key  = "POSTGRES_USER"
-          }
-        }
-      }
-      POSTGRES_PASSWORD = {
-        value_from = {
-          secret_key_ref = {
-            name = "nextcloud-credentials"
-            key  = "POSTGRES_PASSWORD"
-          }
-        }
-      }
-      POSTGRES_HOST = {
-        value_from = {
-          secret_key_ref = {
-            name = "nextcloud-credentials"
-            key  = "POSTGRES_HOST"
-          }
-        }
-      }
 
-      #      REDIS_HOST = {
-      #        value = "redis://next-redis-svc:6379"
-      #      }
       TRUSTED_PROXIES = {
         value = "192.168.88.50 192.168.88.52"
       }
       OVERWRITECLIURL = {
-        value = "https://nextcloud.tryton.geeraert.eu"
+        value = "https://next.geeraert.eu"
       }
       OVERWRITEPROTOCOL = {
         value = "https"
       }
 
       NEXTCLOUD_TRUSTED_DOMAINS = {
-        value = "nextcloud.tryton.geeraert.eu 192.168.88.52"
+        value = "next.geeraert.eu next.tryton.geeraert.eu 192.168.88.52"
       }
       NEXTCLOUD_ADMIN_USER = {
         value = "admin"
@@ -749,6 +718,7 @@ kubernetes = {
           }
         }
       }
+
     }
     pvc = {
       nextcloud-webserver = {
@@ -830,7 +800,7 @@ kubernetes = {
   }
 
   jellyfin = {
-    #  enabled      = false
+    enabled      = false
     replicas     = 0
     image        = "jellyfin/jellyfin:latest"
     service_port = [8096]
@@ -838,7 +808,7 @@ kubernetes = {
     environment = {
 
       JELLYFIN_PublishedServerUrl = {
-        value = "https://jellyfin.tryton.geeraert.eu"
+        value = "https://jellyfin.geeraert.eu"
       }
     }
     pvc = {
@@ -1145,7 +1115,7 @@ kubernetes = {
 
   }
   qbittorrent = {
-    enabled             = false
+    #enabled             = false
     image               = "lscr.io/linuxserver/qbittorrent:latest"
     connected_namespace = "servarr"
     service_port        = [8080]
@@ -1350,15 +1320,15 @@ kubernetes = {
     #enabled = false
     #replicas     = 0
     connected_namespace = "immich"
-    image               = "ghcr.io/immich-app/immich-server:v2.5.6"
+    image               = "ghcr.io/immich-app/immich-server:v3.0.0"
     service_port        = [2283]
     database = {
-      image     = "docker.io/tensorchord/pgvecto-rs:pg14-v0.2.0"
+      image     = "ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0"
       mountPath = "/var/lib/postgresql/data"
     }
 
     redis = {
-    image = "docker.io/bitnami/redis:7.2.5-debian-12-r0" }
+    image = "docker.io/valkey/valkey:9@sha256:4963247afc4cd33c7d3b2d2816b9f7f8eeebab148d29056c2ca4d7cbc966f2d9" }
     requirements = {
       limits-cpu      = "800m"
       limits-memory   = "2Gi"
@@ -1540,7 +1510,7 @@ kubernetes = {
       username  = "django_username"
       mountPath = "/var/lib/postgresql/data"
     }
-    redis         = {}
+    #redis         = {}
     secret_ref    = ["django-bitwarden-credentials"]
     secret_import = ["9fc5a725-75f5-4bab-b595-b474017146c3"]
     requirements = {
@@ -1553,14 +1523,17 @@ kubernetes = {
 
     environment = {
       ALLOWED_HOSTS = {
-        value = "django.tryton.geeraert.eu,redirect.tryton.geeraert.eu"
+        value = "django.geeraert.eu,admin.geeraert.eu,redirect.geeraert.eu,streaming.geeraert.eu,stash.geeraert.eu,simpsons.geeraert.eu,kubernetes.geeraert.eu,cloudmanager.geeraert.eu,podcast.geeraert.eu"
       }
       DEBUG = {
         value = "False"
       }
-      CELERY_BROKER_URL = {
-        value = "redis://django-redis-svc:6379"
+      ENVIRONMENT = {
+        value = "PRODUCTION"
       }
+      #CELERY_BROKER_URL = {
+      #  value = "redis://django-redis-svc:6379"
+      #}
       #HTTP_PROXY = {
       #value = "http://gluetun-svc.gluetun.svc:8888" }
 
@@ -1625,7 +1598,7 @@ kubernetes = {
     }
   }
   celery-worker = {
-    #enabled             = false
+    enabled             = false
     connected_namespace = "django"
     image               = "gitea.tryton.geeraert.eu/pi-ux-ce/django-python:latest"
     command             = ["celery", "--workdir=django_code/", "-A", "core", "worker"]
@@ -1676,7 +1649,7 @@ kubernetes = {
     secret_import  = ["68dce7aa-8e5f-4483-9083-b474016e34fc"]
     environment = {
       ALLOWED_HOSTS = {
-        value = "django-testing.tryton.geeraert.eu,redirect.tryton.geeraert.eu,redirect-testing.tryton.geeraert.eu,job-testing.tryton.geeraert.eu"
+        value = "django-testing.geeraert.eu,admin-testing.geeraert.eu,redirect-testing.geeraert.eu,streaming-testing.geeraert.eu,stash-testing.geeraert.eu,simpsons-testing.geeraert.eu,kubernetes-testing.geeraert.eu,cloudmanager-testing.geeraert.eu,podcast-testing.geeraert.eu"
       }
       CELERY_BROKER_URL = {
         value = "redis://django-testing-redis-svc:6379"
@@ -1837,7 +1810,7 @@ kubernetes = {
   }
 
   tdarr = {
-    #enabled             = false
+    enabled             = false
     image               = "ghcr.io/haveagitgat/tdarr"
     connected_namespace = "servarr"
     service_port        = [8265, 8266]
@@ -2643,24 +2616,6 @@ kubernetes = {
   }
 
 
-  nextcloudt = {
-    enabled      = false
-    replicas     = 1
-    image        = "nextcloud:29.0.3-apache"
-    service_port = [80]
-    domain_name  = "nextcloudnew"
-    database = {
-    image = "docker.io/library/postgres:14" }
-
-    pvc = {
-      nextcloud-webserver = {
-        name       = "nextcloud-webserver"
-        pvc        = true
-        pvc_size   = "2Gi"
-        mount_path = "/var/www/html"
-      }
-    }
-  }
   reactive = {
     #disabled because it needs AI to import a pdf and AI integration is not working
     enabled      = false
@@ -2735,7 +2690,7 @@ kubernetes = {
   }
 
   owncloud = {
-    enabled        = false
+    enabled      = false
     replicas     = 0
     image        = "owncloud/server"
     service_port = [8080]
@@ -2789,4 +2744,151 @@ kubernetes = {
 
     }
   }
+
+  netdatat = {
+    image            = "debian"
+    enabled          = false
+    service_port     = [19999]
+    domain_name      = "netdata"
+    command          = ["sleep", "3600"]
+    security_context = true
+
+    environment = {
+      NETDATA_CLAIM_TOKEN = {
+        value = "wN6wJV1M5jvLbcpQTT78s0WRWiCkxz-s4l9tzeIqwA86upIkVSTk6TbaPbA5L6h_5HH9LoemluBqSPAGzi8DnJ2LBp4e8JGRVuWwOv8EWcKfrV0winCPce4xXtuD780KUW5CR6k"
+      }
+      NETDATA_CLAIM_URL = {
+        value = "https://app.netdata.cloud"
+      }
+      NETDATA_CLAIM_ROOMS = {
+        value = "28654d7b-4767-4b8e-bddc-8d134624bb3b"
+      }
+    }
+
+    pvc = {
+      netdata-config = {
+        name       = "netdata-config"
+        pvc        = true
+        pvc_size   = "1Gi"
+        mount_path = "/etc/netdata"
+      }
+      netdata-lib = {
+        name       = "netdata-lib"
+        pvc        = true
+        pvc_size   = "1Gi"
+        mount_path = "/var/lib/netdata"
+      }
+      netdata-cache = {
+        name       = "netdata-cache"
+        pvc        = true
+        pvc_size   = "1Gi"
+        mount_path = "/var/cache/netdata"
+      }
+      netdata-host-root = {
+        host_path  = "/"
+        name       = "netdata-host-root"
+        mount_path = "/host/root"
+      }
+      netdata-host-passwd = {
+        host_path  = "/etc/passwd"
+        name       = "netdata-host-passwd"
+        mount_path = "/host/etc/passwd"
+      }
+      netdata-host-group = {
+        host_path  = "/etc/group"
+        name       = "netdata-host-group"
+        mount_path = "/host/etc/group"
+      }
+      netdata-host-localtime = {
+        host_path  = "/etc/localtime"
+        name       = "netdata-host-localtime"
+        mount_path = "/etc/localtime"
+      }
+      netdata-host-proc = {
+        host_path  = "/proc"
+        name       = "netdata-host-proc"
+        mount_path = "/host/proc"
+      }
+      netdata-host-sys = {
+        host_path  = "/sys"
+        name       = "netdata-host-sys"
+        mount_path = "/host/sys"
+      }
+      netdata-host-os-release = {
+        host_path  = "/etc/os-release"
+        name       = "netdata-host-os-release"
+        mount_path = "/host/etc/os-release"
+      }
+      netdata-host-var-log = {
+        host_path  = "/var/log"
+        name       = "netdata-host-var-log"
+        mount_path = "/host/var/log"
+      }
+      netdata-docker-sock = {
+        host_path  = "/var/run/docker.sock"
+        name       = "netdata-docker-sock"
+        mount_path = "/var/run/docker.sock"
+      }
+      netdata-host-dbus = {
+        host_path  = "/run/dbus"
+        name       = "netdata-host-dbus"
+        mount_path = "/run/dbus"
+      }
+    }
+  }
+
+
+
+  kopia = {
+    enabled      = false
+    replicas     = 01
+    image        = "kopia/kopia"
+    service_port = [51515]
+    domain_name  = "kopia"
+    command      = ["start", "--disable-csrf-token-checks", "--insecure", "--address=0.0.0.0:51515", "--server-username=USERNAME", "--server-password=SECRET_PASSWORD"]
+    environment = {
+      KOPIA_PASSWORD = {
+        value = "123456789"
+      }
+      USER = {
+      value = "user" }
+    }
+    pvc = {
+      kopia-storage = {
+        name       = "kopia-storage"
+        pvc        = true
+        pvc_size   = "2Gi"
+        mount_path = "/app"
+      }
+    }
+    kopia-data = {
+      name               = "kopia-data"
+      pvc_size           = "100Mi"
+      pvc                = true
+      mount_path         = "/data"
+      storage_class_name = "nfs-storage-fastaccess"
+    }
+  }
+
+  degoog = {
+    enabled      = false
+    replicas     = 01
+    image        = "ghcr.io/degoog-org/degoog:latest"
+    service_port = [4444]
+    domain_name  = "degoog"
+    environment = {
+      DEGOOG_SETTINGS_PASSWORDS = {
+        value = "Crease1-City-Canned"
+      }
+    }
+    pvc = {
+      degoog-data = {
+        name       = "degoog-data"
+        pvc        = true
+        pvc_size   = "2Gi"
+        mount_path = "/app/data"
+      }
+    }
+  }
+
 }