add before changes

.gitignore

@@ -39,3 +39,5 @@ terraform.rc
 module.tf.save*
 terraform.tfstate*
 .terraform.lock.hcl
+
+.bw-provider-state

cronjob.tf.20260813

@@ -0,0 +1,119 @@
+variable "cronjob" {
+  type = map(object({
+    name                = optional(string)
+    image               = string
+    enabled             = bool
+    namespace           = optional(string)
+    connected_namespace = optional(string, "")
+    schedule            = string
+    command             = optional(list(string))
+    args                = optional(list(string))
+
+
+  pvc = optional(map(object({
+      name                 = string
+      pvc                  = optional(bool, false)
+      config_map           = optional(bool, false)
+      secret               = optional(bool, false)
+      host_path            = optional(string)
+      pvc_size             = optional(string)
+      storage_class_name   = optional(string, "nfs-storage-intelligent")
+      annotations_fileType = optional(string)
+      existing_pvc         = optional(bool, false)
+      mount_path           = string
+      sub_path             = optional(string)
+    })))
+  }))
+
+}
+
+
+locals {
+  pvc_list = flatten([
+    for key, value in var.cronjob : [
+      for index, pvc in value.pvc : {
+        key                  = "${coalesce(value.namespace, value.connected_namespace, key)}/${pvc.name}"
+        index                = index
+        pvc                  = pvc.pvc
+        name                 = pvc.name
+        pvc_size             = pvc.pvc_size
+        mount_path           = pvc.mount_path
+        storage_class_name   = pvc.storage_class_name
+        annotations_fileType = pvc.annotations_fileType
+        existing_pvc         = pvc.existing_pvc
+        sub_path             = pvc.sub_path
+        namespace            = coalesce(value.namespace, value.connected_namespace, key)
+    }] if value.enabled == true && value.pvc != null
+  ])
+
+  # group duplicates instead of throwing an error
+  pvc_map_grouped = {
+    for p in local.pvc_list :
+    p.key => p...
+  }
+
+  # keep only one PVC per key (take the first)
+  pvc_map = {
+    for k, list in local.pvc_map_grouped :
+    k => list[0]
+  }
+
+  pvc_details = values(local.pvc_map)
+}
+
+resource "kubernetes_persistent_volume_claim_v1" "automatic-pvc-cronjob" {
+  for_each = { for key, value in local.pvc_details : "${value.index}" => merge(value, { mew_key = value.index }) if value.pvc && value.existing_pvc != true }
+  metadata {
+    namespace = coalesce(each.value.namespace, each.key)
+    name      = "${each.value.name}-pvc"
+    labels = {
+      deployment_method = "Terraform"
+    }
+    annotations = {
+      fileType = try(each.value.annotations_fileType, "file")
+    }
+
+  }
+
+  spec {
+    access_modes       = ["ReadWriteMany"]
+    storage_class_name = each.value.storage_class_name
+    resources {
+      requests = {
+        storage = each.value.pvc_size
+      }
+    }
+  }
+}
+
+resource "kubernetes_cron_job_v1" "automatic_cronjob" {
+  for_each = { for key, value in var.cronjob : key => value if value.enabled == true }
+  metadata {
+    name      = "${each.key}-cronjob"
+    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
+
+    labels = {
+      app               = each.key
+      deployment_method = "Terraform"
+    }
+  }
+  spec {
+    schedule = each.value.schedule
+    job_template {
+      metadata {}
+      spec {
+        template {
+          metadata {}
+          spec {
+            container {
+              name    = coalesce(each.value.name, each.key)
+              image   = each.value.image
+              command = each.value.command != null ? each.value.command : []
+              args    = each.value.args != null ? each.value.args : []
+            }
+          }
+        }
+      }
+    }
+  }
+}

external_manifests/bitwarden/bitwarden.backup_db.cronjob.yaml

@@ -0,0 +1,46 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: bitwarden-calendar-backup
+  namespace: bitwarden
+spec:
+  schedule: "0 0 * * *"
+  jobTemplate:
+    spec:
+      backoffLimit: 4
+      ttlSecondsAfterFinished: 100
+      template:
+        spec:
+          containers:
+          - name: bitwarden-database-backup
+            image: mcr.microsoft.com/mssql-tools
+            envFrom:
+            - secretRef:
+                name: bitwarden-mssql-db-terraform
+                optional: false
+            command: ["/bin/sh","-c"]
+            #args: ["mysqldump -h $DB_HOST -u $MYSQL_USER -p$MYSQL_ROOT_PASSWORD $MYSQL_DATABASE |gzip -9 > /backup/$(DB_DATABASE_NAME)-DB-$(date +%Y%m%d).sql.gz "]
+            args: ["sleep 3600"]
+            volumeMounts:
+            - name: backup
+              mountPath: /backup
+          volumes:
+          - name: backup
+            persistentVolumeClaim:
+              claimName: bitwarden-database-backup
+          restartPolicy: Never
+---
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: bitwarden-database-backup
+  namespace: bitwarden
+  annotations:
+    fileType: Backup
+spec:
+  storageClassName: nfs-storage-fastaccess
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 2Gi

external_manifests/django/django-db.secret.yaml

@@ -6,6 +6,5 @@ data:
   DB_USERNAME: ZGphbmdvX3VzZXJuYW1l
 kind: Secret
 metadata:
-  creationTimestamp: null
   name: django-db-credentials
   namespace: django

external_manifests/django/django-db.svc.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: django-db-nodeport
+  namespace: django
+spec:
+  ports:
+  - name: http
+    nodePort: 32345
+    port: 5432
+    protocol: TCP
+    targetPort: 5432
+  selector:
+    app: django-db
+  type: NodePort
+

external_manifests/fail2ban/command.txt

@@ -0,0 +1 @@
+kubectl exec -it  -n reverse-proxy deploy/reverse-proxy -c reverse-proxy -- nginx -s reload

external_manifests/fail2ban/fail2ban-nginx-http-auth-jail.configmap.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+data:
+  nginx-http-auth.local: |
+    ## Version 2022/08/06
+    # Fail2Ban jail configuration for nginx-http-auth
+
+    # To use more aggressive http-auth modes set filter parameter "mode" in jail.local:
+    # normal (default), aggressive (combines all), auth or fallback
+    # See "tests/files/logs/nginx-http-auth" or "filter.d/nginx-http-auth.conf" for usage example and details.
+
+    [nginx-http-auth]
+
+    enabled = false
+    port    = http,https
+    filter  = nginx-unauthorized
+    action = nginx-block-map
+    logpath = /var/log/nginx/backend_debug.log
+    maxretry = 5
+kind: ConfigMap
+metadata:
+  creationTimestamp: null
+  name: fail2ban-nginx-http-auth-jail
+  namespace: fail2ban

external_manifests/fail2ban/fail2ban-nginx-unauthorized-filter.configmap.yaml

@@ -0,0 +1,30 @@
+apiVersion: v1
+data:
+  nginx-unauthorized.local: |
+    ## Version 2022/08/06
+    # Fail2Ban filter configuration for nginx unauthorized
+
+    [INCLUDES]
+    before = common.conf
+
+    [Definition]
+
+    #original
+    #failregex = ^<HOST>.*"(GET|POST|HEAD).*" (401) .*$
+
+
+    #try this one
+    failregex = ^<HOST> - .* "(?:GET|POST|HEAD) [^"]+" 401
+                ^<HOST> - .* upstream_status=401
+                #for servarr
+                ^<HOST> -.*"GET /login\?returnUrl=/&loginFailed=true HTTP/.*" 200
+                ^<HOST> -.*"POST /login\?returnUrl=/&loginFailed=true HTTP/.*" 200
+                #for bitwarden
+                ^<HOST> -.*"POST /identity/accounts/prelogin *HTTP/.*" 200
+    #actionban = touch /tmp/<name>.ban
+    #actionunban = touch /tmp/<name>.unban
+kind: ConfigMap
+metadata:
+  creationTimestamp: null
+  name: fail2ban-nginx-unauthorized-filter
+  namespace: fail2ban

external_manifests/fail2ban/fail2ban.Role.yaml

@@ -0,0 +1,19 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: role:service-acc
+  namespace: reverse-proxy
+
+rules:         
+  - apiGroups: [""]
+    resources: 
+    - pods
+    - pods/exec
+    verbs: 
+    - create
+    - list
+  - apiGroups: ["apps"]
+    resources:
+    - deployments
+    verbs:
+    - get

external_manifests/fail2ban/fail2ban.RoleBinding.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: rolebinding:service-acc
+  namespace: reverse-proxy
+
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: role:service-acc
+subjects:
+  - kind: ServiceAccount
+    name: kubectl-service-account
+    namespace: fail2ban

external_manifests/fail2ban/fail2ban.ServiceAccount.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: kubectl-service-account
+  namespace: fail2ban

external_manifests/fail2ban/nginx-block-map-action.configmap.yaml

@@ -0,0 +1,58 @@
+apiVersion: v1
+data:
+  nginx-block-map.local: "## Version 2022/08/06\n# Fail2Ban configuration file for
+    black-listing via nginx\n#\n# Author: Serg G. Brester (aka sebres)\n#\n# To use
+    'nginx-block-map' action you should define some special blocks in your nginx configuration,\n#
+    and use it hereafter in your locations (to notify fail2ban by failure, resp. nginx
+    by ban).\n#\n# Example (argument \"token_id\" resp. cookie \"session_id\" used
+    here as unique identifier for user):\n#\n#   http {\n#     ...\n#     # maps to
+    check user is blacklisted (banned in f2b):\n#     #map $arg_token_id      $blck_lst_tok
+    { include blacklisted-tokens.map; }\n#     map  $cookie_session_id $blck_lst_ses
+    { include blacklisted-sessions.map; }\n#     ...\n#     # special log-format to
+    notify fail2ban about failures:\n#     log_format f2b_session_errors '$msec failure
+    \"$cookie_session_id\" - $remote_addr - $remote_user '\n#      ;#                  '\"$request\"
+    $status $bytes_sent '\n#       #                  '\"$http_referer\" \"$http_user_agent\"';\n#\n#
+    \    # location checking blacklisted values:\n#     location ... {\n#       #
+    check banned sessionid:\n#       if ($blck_lst_ses != \"\") {\n#         try_files
+    \"\" @f2b-banned;\n#       }\n#       ...\n#       # notify fail2ban about a failure
+    inside nginx:\n#       error_page 401 = @notify-f2b;\n#       ...\n#     }\n#
+    \    ...\n#     # location for return with \"403 Forbidden\" if banned:\n#     location
+    @f2b-banned {\n#       default_type text/html;\n#       return 403 \"<br/><center>\n#
+    \        <b style=\\\"color:red; font-size:18pt; border:2pt solid black; padding:5pt;\\\">\n#
+    \        You are banned!</b></center>\";\n#     }\n#     ...\n#     # location
+    to notify fail2ban about a failure inside nginx:\n#     location @notify-f2b {\n#
+    \      access_log /var/log/nginx/f2b-auth-errors.log f2b_session_errors;\n#     }\n#
+    \  }\n#   ...\n#\n# Note that quote-character (and possibly other special characters)
+    are not allowed currently as session-id.\n# Thus please add any session-id validation
+    rule in your locations (or in the corresponding backend-service), \n# like in
+    example below:\n#\n#   location ... {\n#     if ($cookie_session_id !~ \"^[\\w\\-]+$\")
+    {\n#       return  403 \"Wrong session-id\"\n#     }\n#     ...\n#   }\n#\n# The
+    parameters for jail corresponding log-format (f2b_session_errors):\n#\n#   [nginx-blck-lst]\n#
+    \  filter =\n#   datepattern = ^Epoch\n#   failregex = ^ failure \"<F-ID>[^\"]+</F-ID>\"
+    - <ADDR>\n#   usedns = no\n#\n# The same log-file can be used for IP-related jail
+    (additionally to session-related, to ban very bad IPs):\n#\n#   [nginx-blck-ip]\n#
+    \  maxretry = 100\n#   filter =\n#   datepattern = ^Epoch\n#   failregex = ^ failure
+    \"[^\"]+\" - <ADDR>\n#   usedns = no\n#\n\n[Definition]\n\n# path to configuration
+    of nginx (used to target nginx-instance in multi-instance system,\n# and as path
+    for the blacklisted map):\n#srv_cfg_path = /etc/nginx/\n\nsrv_cfg_path = /blacklisted.d/\n\n#
+    cmd-line arguments to supply to test/reload nginx:\n#srv_cmd = nginx -c %(srv_cfg_path)s/nginx.conf\nsrv_cmd
+    = nginx\n\n# pid file (used to check nginx is running):\nsrv_pid = /run/nginx.pid\n\n#
+    command used to check whether nginx is running and configuration is valid:\nsrv_is_running
+    = [ -f \"%(srv_pid)s\" ]\nsrv_check_cmd = %(srv_is_running)s && %(srv_cmd)s -qt\n\n#
+    first test nginx is running and configuration is correct, hereafter send reload
+    signal:\n#blck_lst_reload = %(srv_check_cmd)s; if [ $? -eq 0 ]; then\n#                    %(srv_cmd)s
+    -s reload; if [ $? -ne 0 ]; then echo 'reload failed.'; fi;\n#                  fi;\n\nrestart_file
+    = /restart-signal/restart.txt\n\nblck_lst_reload = touch %(restart_file)s;sleep
+    20; rm %(restart_file)s;\n\n# map-file for nginx, can be redefined using `action
+    = nginx-block-map[blck_lst_file=\"/path/file.map\"]`:\nblck_lst_file = %(srv_cfg_path)s/blacklisted-sessions.conf\n\n#
+    Action definition:\n\nactionstart_on_demand = false\nactionstart = touch '%(blck_lst_file)s'\n\nactionflush
+    = truncate -s 0 '%(blck_lst_file)s'; %(blck_lst_reload)s\n\nactionstop = %(actionflush)s\n\nactioncheck
+    = \n\n_echo_blck_row = printf '\\%%s 1;\\n' \"<fid>\"\n\nactionban = echo <ip>
+    | awk -F. '{print \"deny \"$1\".\"$2\".\"$3\".\"$4\";\"}' >> '%(blck_lst_file)s';
+    %(blck_lst_reload)s\n\nactionunban = id=$(%(_echo_blck_row)s | sed -e 's/[]\\/$*.^|[]/\\\\&/g');
+    sed -i \"/^$id$/d\" %(blck_lst_file)s; %(blck_lst_reload)s\n"
+kind: ConfigMap
+metadata:
+  creationTimestamp: null
+  name: nginx-block-map-action
+  namespace: fail2ban

external_manifests/fail2ban/nginx-block-map.local

@@ -0,0 +1,124 @@
+## Version 2022/08/06
+# Fail2Ban configuration file for black-listing via nginx
+#
+# Author: Serg G. Brester (aka sebres)
+#
+# To use 'nginx-block-map' action you should define some special blocks in your nginx configuration,
+# and use it hereafter in your locations (to notify fail2ban by failure, resp. nginx by ban).
+#
+# Example (argument "token_id" resp. cookie "session_id" used here as unique identifier for user):
+#
+#   http {
+#     ...
+#     # maps to check user is blacklisted (banned in f2b):
+#     #map $arg_token_id      $blck_lst_tok { include blacklisted-tokens.map; }
+#     map  $cookie_session_id $blck_lst_ses { include blacklisted-sessions.map; }
+#     ...
+#     # special log-format to notify fail2ban about failures:
+#     log_format f2b_session_errors '$msec failure "$cookie_session_id" - $remote_addr - $remote_user '
+#      ;#                  '"$request" $status $bytes_sent '
+#       #                  '"$http_referer" "$http_user_agent"';
+#
+#     # location checking blacklisted values:
+#     location ... {
+#       # check banned sessionid:
+#       if ($blck_lst_ses != "") {
+#         try_files "" @f2b-banned;
+#       }
+#       ...
+#       # notify fail2ban about a failure inside nginx:
+#       error_page 401 = @notify-f2b;
+#       ...
+#     }
+#     ...
+#     # location for return with "403 Forbidden" if banned:
+#     location @f2b-banned {
+#       default_type text/html;
+#       return 403 "<br/><center>
+#         <b style=\"color:red; font-size:18pt; border:2pt solid black; padding:5pt;\">
+#         You are banned!</b></center>";
+#     }
+#     ...
+#     # location to notify fail2ban about a failure inside nginx:
+#     location @notify-f2b {
+#       access_log /var/log/nginx/f2b-auth-errors.log f2b_session_errors;
+#     }
+#   }
+#   ...
+#
+# Note that quote-character (and possibly other special characters) are not allowed currently as session-id.
+# Thus please add any session-id validation rule in your locations (or in the corresponding backend-service), 
+# like in example below:
+#
+#   location ... {
+#     if ($cookie_session_id !~ "^[\w\-]+$") {
+#       return  403 "Wrong session-id"
+#     }
+#     ...
+#   }
+#
+# The parameters for jail corresponding log-format (f2b_session_errors):
+#
+#   [nginx-blck-lst]
+#   filter =
+#   datepattern = ^Epoch
+#   failregex = ^ failure "<F-ID>[^"]+</F-ID>" - <ADDR>
+#   usedns = no
+#
+# The same log-file can be used for IP-related jail (additionally to session-related, to ban very bad IPs):
+#
+#   [nginx-blck-ip]
+#   maxretry = 100
+#   filter =
+#   datepattern = ^Epoch
+#   failregex = ^ failure "[^"]+" - <ADDR>
+#   usedns = no
+#
+
+[Definition]
+
+# path to configuration of nginx (used to target nginx-instance in multi-instance system,
+# and as path for the blacklisted map):
+#srv_cfg_path = /etc/nginx/
+
+srv_cfg_path = /blacklisted.d/
+
+# cmd-line arguments to supply to test/reload nginx:
+#srv_cmd = nginx -c %(srv_cfg_path)s/nginx.conf
+srv_cmd = nginx
+
+# pid file (used to check nginx is running):
+srv_pid = /run/nginx.pid
+
+# command used to check whether nginx is running and configuration is valid:
+srv_is_running = [ -f "%(srv_pid)s" ]
+srv_check_cmd = %(srv_is_running)s && %(srv_cmd)s -qt
+
+# first test nginx is running and configuration is correct, hereafter send reload signal:
+#blck_lst_reload = %(srv_check_cmd)s; if [ $? -eq 0 ]; then
+#                    %(srv_cmd)s -s reload; if [ $? -ne 0 ]; then echo 'reload failed.'; fi;
+#                  fi;
+
+restart_file = /restart-signal/restart.txt
+
+blck_lst_reload = kubectl exec -it  -n reverse-proxy deploy/reverse-proxy -c reverse-proxy -- nginx -s reload
+
+# map-file for nginx, can be redefined using `action = nginx-block-map[blck_lst_file="/path/file.map"]`:
+blck_lst_file = %(srv_cfg_path)s/blacklisted-sessions.conf
+
+# Action definition:
+
+actionstart_on_demand = false
+actionstart = touch '%(blck_lst_file)s'
+
+actionflush = truncate -s 0 '%(blck_lst_file)s'; %(blck_lst_reload)s
+
+actionstop = %(actionflush)s
+
+actioncheck = 
+
+_echo_blck_row = printf '\%%s 1;\n' "<fid>"
+
+actionban = kubectl exec -it  -n reverse-proxy deploy/reverse-proxy -c reverse-proxy -- sh -c "echo 'deny <ip>;' > /etc/nginx/blacklisted.d/blacklisted-sessions.conf"; %(blck_lst_reload)s
+
+actionunban = id=$(%(_echo_blck_row)s | sed -e 's/[]\/$*.^|[]/\\&/g'); sed -i "/^$id$/d" %(blck_lst_file)s; %(blck_lst_reload)s

external_manifests/gluetun/gluetun-secret-netherlandNL-FREE-280.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+data:
+  VPN_DNS_IP: MTAuMi4wLjE=
+  VPN_ENDPOINT_IP: ODkuMTA1LjIxNC4xOTY=
+  VPN_ENDPOINT_PORT: NTE4MjA=
+  WIREGUARD_PRIVATE_KEY: Q0h3OHNkVUliaVRPbTgxTzZGOWRyMm9Nc2k1ZFl4SnZValo1Z2Jwd3UzWT0=
+  WIREGUARD_PUBLIC_KEY: WG4yQkwrdmhJZ2dsMnVKZ29HY2NqMG4wQ3Z3N09hZU5LMXdPZk91dElTUT0=
+kind: Secret
+metadata:
+  creationTimestamp: null
+  name: gluetun-secret-nl-free-280
+  namespace: gluetun

external_manifests/immich/immich-db.secret.yaml

@@ -1,11 +1,10 @@
 apiVersion: v1
 data:
   DB_DATABASE_NAME: aW1taWNo
-  DB_HOST: aW1taWNodC1kYi1zdmM=
+  DB_HOST: aW1taWNoLWRiLXN2Yw==
   DB_PASSWORD: U3Bvb24tQm9yb3VnaC1CYXNpczg=
-  DB_USERNAME: aW1taWNoX3VzZXJuYW1l
+  DB_USERNAME: aW1taWNo
 kind: Secret
 metadata:
-  creationTimestamp: null
   name: immich-db-credentials
-  namespace: immicht
+  namespace: immich

external_manifests/paperless/Paperless.secret.yaml

@@ -5,9 +5,9 @@ data:
   POSTGRES_PASSWORD: cGFwZXJsZXNz
   PAPERLESS_ADMIN_USER: YWRtaW4=
   PAPERLESS_ADMIN_PASSWORD: YWRtaW4=
-  POSTGRES_HOST: cGFwZXItZGItc3Zj
+  POSTGRES_HOST: cGFwZXJsZXNzLWRiLXN2Yw==
 kind: Secret
 metadata:
   name: paperless-credentials
-  namespace: paper
+  namespace: paperless
 type: Opaque

external_manifests/paperless/emailproxy.config

@@ -0,0 +1,5 @@
+[IMAP-1993]
+documentation = *** note: this server will work for both Office 365 and personal Outlook/Hotmail accounts ***
+server_address = outlook.office365.com
+server_port = 993
+local_address = 127.0.0.1

external_manifests/paperless/emailproxyconfig.configmap.yml

@@ -0,0 +1,13 @@
+apiVersion: v1
+data:
+  emailproxy.config: |
+    [IMAP-1993]
+    documentation = *** note: this server will work for both Office 365 and personal Outlook/Hotmail accounts ***
+    server_address = outlook.office365.com
+    server_port = 993
+    local_address = 127.0.0.1
+kind: ConfigMap
+metadata:
+  creationTimestamp: null
+  name: emailproxyconfig
+  namespace: paperless

external_manifests/paperless/paperless_backup_db.cronjob.yaml

@@ -0,0 +1,45 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: paperless-calendar-backup
+  namespace: paperless
+spec:
+  schedule: "0 0 * * *"
+  jobTemplate:
+    spec:
+      backoffLimit: 4
+      ttlSecondsAfterFinished: 100
+      template:
+        spec:
+          containers:
+          - name: paperless-database-backup
+            image: alpine/psql
+            envFrom:
+            - secretRef:
+                name: paperless-db-terraform
+                optional: false
+            command: ["/bin/sh","-c"]
+            args: ["pg_dump |gzip -9 > /backup/$(DB_DATABASE_NAME)-DB-$(date +%Y%m%d).sql.gz "]
+            volumeMounts:
+            - name: backup
+              mountPath: /backup
+          volumes:
+          - name: backup
+            persistentVolumeClaim:
+              claimName: paperless-database-backup
+          restartPolicy: Never
+---
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: paperless-database-backup
+  namespace: paperless
+  annotations:
+    fileType: Backup
+spec:
+  storageClassName: nfs-storage-fastaccess
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 2Gi

external_manifests/servarr/prowlarr.secret.yaml

@@ -6,6 +6,5 @@ data:
   DB_USER: cHJvd2xhcnJfdXNlcm5hbWU=
 kind: Secret
 metadata:
-  creationTimestamp: null
   name: prowlarr-credentials
   namespace: bookstack

external_manifests/servarr/servarr-db.secret.yaml

@@ -6,6 +6,5 @@ data:
   DB_USER: c2VydmFycl91c2VybmFtZQ==
 kind: Secret
 metadata:
-  creationTimestamp: null
   name: servarr-db-credentials
   namespace: servarr

external_manifests/stash/download.sh_curl_error_20250808.sh

@@ -0,0 +1,85 @@
+#!/bin/bash
+
+#install required packages
+apk add curl wget
+
+#named argument generation
+skip_searching_gallery="${skip_searching_gallery:-false}"
+
+
+while [ $# -gt 0 ]; do
+    if [[ $1 == "--"* ]]; then
+        v="${1/--/}"
+        declare "$v"="$2"
+        shift
+    fi
+    shift
+done
+
+#check if we will use a HTTP proxy or not
+
+if [[ -z $http_proxy ]]; then
+        echo "not using proxy"
+        curl_command="curl"
+else
+        echo "using proxy"
+        echo $http_proxy
+        curl_command="curl -x $http_proxy"
+
+fi
+
+
+#dowload from https://www.pornpics.com/pornstars/eiby-shine/
+DESTINATION_FOLDER="/data"
+PROXY_HTTP="http://gluetun-svc.gluetun.svc:8888"
+
+#BASE_URL="https://www.pornpics.com/pornstars/eiby-shine/"
+#pornstars="eiby-shine"
+
+#BASE_URL="https://www.pornpics.com/?q=shy+imp"
+#pornstars="shy-imp"
+
+#BASE_URL="https://www.pornpics.com/pornstars/gloria-sol/"
+#pornstars="gloria-sol"
+
+
+#BASE_URL="https://www.pornpics.com/pornstars/becky-summer"
+#pornstars="becky-summer"
+
+
+#clear files beforehand
+
+echo "Pornstar: "$pornstars
+echo "URL: "$BASE_URL
+
+mkdir -p $DESTINATION_FOLDER/$pornstars
+
+if [[ $skip_searching_gallery == true ]]; then
+        echo "not looping through galleries"
+		echo "using existing file instead"
+		#because we need to keep the file $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt with the existing URL , in this condition, 
+		#no deletion of this file
+else
+        echo "looping through galleries"
+		#because we will re-generate this file, can be emptied
+		echo "" > $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt
+        $curl_command -s $BASE_URL |  grep -Eo "(http|https)://[a-zA-Z0-9./?=_%:-]*" | grep "https://www.pornpics.com/galleries/" |sort -u >> $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt
+fi
+
+echo "" > $DESTINATION_FOLDER/$pornstars-image_to_download.txt
+
+
+for f in $(cat $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt ); do
+        echo "$curl_command $f"
+        $curl_command "$f" 
+	$curl_command "$f" | grep -Eo "(http|https)://[a-zA-Z0-9./?=_%:-]*" | grep "https://cdni.pornpics.com/1280" >> $DESTINATION_FOLDER/$pornstars-image_to_download.txt
+	echo $f
+done
+
+
+for g in $(cat $DESTINATION_FOLDER/$pornstars-image_to_download.txt ); do 
+	$curl_command -O --output-dir $DESTINATION_FOLDER/$pornstars "$g"
+#        wget -e use_proxy=yes -e http_proxy=$PROXY_HTTP $g -P $DESTINATION_FOLDER/$pornstars
+        echo $g 
+done
+exit 0

external_manifests/tdarr/tdarr.svc.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: tdarr-svc-ext
+  namespace: servarr
+spec:
+  ports:
+  - name: tdarr
+    nodePort: 30266
+    port: 8266
+    protocol: TCP
+    targetPort: 8266
+  selector:
+    app: tdarr
+  type: NodePort

external_manifests/wikijs/wikijs-db.secret.yaml

@@ -6,6 +6,5 @@ data:
   DB_USER: d2lraWpzX3VzZXJuYW1l
 kind: Secret
 metadata:
-  creationTimestamp: null
   name: wikijs-db-credentials
   namespace: wikijs

module.tf

@@ -17,7 +17,7 @@ provider "kubernetes" {
 provider "bitwarden-secrets" {
   api_url         = "https://bitwarden.tryton.geeraert.eu/api"
   identity_url    = "https://bitwarden.tryton.geeraert.eu/identity"
-  access_token    = "0.dd9b243a-b5f5-4b26-aaba-b3f70170088c.fjoaQEShPaEEZa7GmkTJXQYEmF5wVp:5B4jhLp5gRymNcwktMDyOg=="
+  access_token    = "0.9f4b7c5f-e6e7-4eff-929e-b474016a2b9c.bMRELajGGb7qMuXXvzgCCJdDfxfTCS:mFDT7tHSi43KJSnkwvTSYg=="
   organization_id = "a6361589-badd-4bde-9cb4-af8901161c0d"
 }
 
@@ -60,6 +60,8 @@ variable "kubernetes" {
     liveness_http_get      = optional(string)
     liveness_http_get_path = optional(string)
     database               = optional(map(string))
+    database_command       = optional(list(string))
+    database_args          = optional(list(string))
     redis                  = optional(map(string))
     enabled                = optional(bool, true)
     secret_ref             = optional(list(string))
@@ -95,12 +97,11 @@ variable "database_backup_info" {
     }
     mysql = {
       image   = "mysql"
-      command = "mariadb-dump -h $DB_HOST -u $MYSQL_USER -p$MYSQL_ROOT_PASSWORD $MYSQL_DATABASE |gzip -9 > /backup/$(DB_DATABASE_NAME)-DB-$(date +%Y%m%d).sql.gz"
+      command = "mysqldump -h $DB_HOST -u $MYSQL_USER -p$MYSQL_ROOT_PASSWORD $MYSQL_DATABASE |gzip -9 > /backup/$(DB_DATABASE_NAME)-DB-$(date +%Y%m%d).sql.gz"
     }
     sqlserver = {
-      image   = "sqlserver"
+      image   = "mcr.microsoft.com/mssql-tools"
-      command = "sqlserver backup"
+      command = "/opt/mssql-tools/bin/sqlcmd -S $DB_HOST -U $DB_USERNAME -P $DB_PASSWORD -Q \"BACKUP DATABASE $DB_DATABASE_NAME TO DISK = '/backup/$DB_DATABASE_NAME-$(date +%Y%m%d).bak' WITH  COPY_ONLY, CHECKSUM,FORMAT, MEDIANAME = 'SQLServerBackups',NAME = 'Full Backup of SQLTestDB'\";exit"
-
     }
   }
 }
@@ -416,6 +417,13 @@ resource "kubernetes_deployment_v1" "automatic" {
             }
           }
 
+          dynamic "volume_mount" {
+            for_each = try(each.value.database.engine == "sqlserver", false) && try(each.value.database.shunt, false) ? [1] : []
+            content {
+              mount_path = "/backup"
+              name       = "${each.key}-db-backup"
+            }
+          }
 
           dynamic "env_from" {
             for_each = each.value.secret_ref != null ? each.value.secret_ref : []
@@ -441,7 +449,17 @@ resource "kubernetes_deployment_v1" "automatic" {
               }
             }
           }
-
+          dynamic "env_from" {
+            for_each = each.value.database != null && each.value.enabled == true ? ["${each.key}-db-mapped-terraform"] : []
+            content {
+              dynamic "secret_ref" {
+                for_each = [1]
+                content {
+                  name = env_from.value
+                }
+              }
+            }
+          }
           dynamic "env_from" {
             for_each = each.value.config_map_ref != null ? each.value.config_map_ref : []
             content {
@@ -454,18 +472,6 @@ resource "kubernetes_deployment_v1" "automatic" {
             }
           }
 
-          #        dynamic "command" {
-          #          for_each = each.value.command != null ? [1] : []
-          #          content {
-          #            [each.value.command]
-          #          }
-
-          #        }
-          #    command = each.value.command != null ? {
-          #      [each.value.command]
-          #    } : {}
-
-
           command = each.value.command != null ? each.value.command : []
 
 
@@ -482,7 +488,6 @@ resource "kubernetes_deployment_v1" "automatic" {
                     content {
                       name = env.value.value_from.secret_key_ref.name
                       key  = env.value.value_from.secret_key_ref.key
-                      #                      optional = true
                     }
                   }
                 }
@@ -505,16 +510,6 @@ resource "kubernetes_deployment_v1" "automatic" {
             }
           }
 
-          #          resources {
-          #            limits = {
-          #              cpu    = each.value.requirements.limits-cpu
-          #              memory = each.value.requirements.limits-memory
-          #            }
-          #            requests = {
-          #              cpu    = each.value.requirements.requests-cpu
-          #              memory = each.value.requirements.requests-memory
-          #            }
-          #          }
 
           dynamic "security_context" {
             for_each = each.value.security_context == true ? [1] : []
@@ -592,10 +587,21 @@ resource "kubernetes_deployment_v1" "automatic" {
 
           }
         }
+        dynamic "volume" {
+          for_each = try(each.value.database.engine == "sqlserver", false) && try(each.value.database.shunt, false) ? [1] : []
+          content {
+            name = "${each.key}-db-backup"
+
+            persistent_volume_claim {
+              claim_name = "${each.key}-db-backup"
+            }
+          }
+        }
 
       }
     }
   }
+  depends_on = [kubernetes_persistent_volume_claim_v1.automatic-pvc]
 }
 
 
@@ -606,7 +612,7 @@ resource "kubernetes_deployment_v1" "database-automatic" {
 
   metadata {
     namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
-    name      = "${coalesce(each.value.namespace, each.key)}-db"
+    name      = "${coalesce(each.value.name, each.key)}-db"
     labels = {
       app               = each.key
       deployment_method = "Terraform"
@@ -644,12 +650,20 @@ resource "kubernetes_deployment_v1" "database-automatic" {
           }
 
           volume_mount {
-            mount_path = try(each.value.database.mountPath, "/var/lib/postgresql/data")
+            mount_path = try(each.value.database.mountPath, "/var/lib/postgresql/")
             name       = "${each.key}-db-pvc"
           }
 
+          dynamic "volume_mount" {
+            for_each = try(each.value.database.engine == "sqlserver", false) && !(try(each.value.database.shunt, false)) ? [1] : []
+            content {
+              mount_path = "/backup"
+              name       = "${each.key}-db-backup"
+            }
+          }
+
           command = try([each.value.database.command], [])
-          #command = [try(each.value.database.command,"")]
+          args    = each.value.database_args != null ? each.value.database_args : []
 
           dynamic "env_from" {
             for_each = each.value.database != null && each.value.enabled == true && !(try(each.value.database.shunt, false)) ? ["${each.key}-db-terraform"] : []
@@ -686,40 +700,6 @@ resource "kubernetes_deployment_v1" "database-automatic" {
           }
 
 
-          #          resources {
-          #            limits = {
-          #              cpu    = each.value.requirements.limits-cpu
-          #              memory = each.value.requirements.limits-memory
-          #            }
-          #            requests = {
-          #              cpu    = each.value.requirements.requests-cpu
-          #              memory = each.value.requirements.requests-memory
-          #            }
-          #          }
-
-          #          dynamic "liveness_probe" {
-          #            for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : []
-          #           content {
-          #              dynamic "tcp_socket" {
-          #                for_each = each.value.liveness_tcp_socket != null ? [""] : []
-          #                content {
-          #                  port = each.value.liveness_tcp_socket
-          #                }
-          #              }
-
-
-          #              dynamic "http_get" {
-          #                for_each = each.value.liveness_http_get != null ? [""] : []
-          #                content {
-          #                  port = each.value.liveness_http_get
-          #                  path = coalesce(each.value.liveness_http_get_path, "/")
-          #                }
-          #              }
-
-          #              initial_delay_seconds = 3
-          #              period_seconds        = 3
-          #            }
-          #          }
         }
 
 
@@ -730,6 +710,17 @@ resource "kubernetes_deployment_v1" "database-automatic" {
           }
         }
 
+        dynamic "volume" {
+          for_each = try(each.value.database.engine == "sqlserver", false) && !(try(each.value.database.shunt, false)) ? [1] : []
+          content {
+            name = "${each.key}-db-backup"
+
+            persistent_volume_claim {
+              claim_name = "${each.key}-db-backup"
+            }
+          }
+        }
+
       }
     }
   }
@@ -795,7 +786,7 @@ resource "kubernetes_deployment_v1" "redis-automatic" {
 
   metadata {
     namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
-    name      = "${coalesce(each.value.namespace, each.key)}-redis"
+    name      = "${coalesce(each.value.name, each.key)}-redis"
     labels = {
       app               = each.key
       deployment_method = "Terraform"
@@ -995,6 +986,7 @@ resource "kubernetes_secret_v1" "automatic-database-secret" {
     PGDATABASE          = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
     DB_HOST             = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
     PGHOST              = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
+    POSTGRES_HOST       = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
     DB_PASSWORD         = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
     MYSQL_PASSWORD      = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
     MYSQL_ROOT_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
@@ -1004,11 +996,27 @@ resource "kubernetes_secret_v1" "automatic-database-secret" {
     POSTGRES_USER       = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
     MYSQL_USER          = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
     PGUSER              = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
-
+    DATABASE_URL        = "postgresql://${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}:${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}@${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}:${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_port[each.key].value}/${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
   }
 
 }
 
+resource "kubernetes_secret_v1" "automatic-database-mapped-secret" {
+  for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
+  metadata {
+    name      = "${each.key}-db-mapped-terraform"
+    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
+  }
+
+  data = {
+    "${try(each.value.database.map_name, "DB_DATABASE_NAME")}"     = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
+    "${try(each.value.database.map_host, "DB_DATABASE_NAME")}"     = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
+    "${try(each.value.database.map_password, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
+    "${try(each.value.database.map_username, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
+  }
+}
+
+
 resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_username" {
   for_each   = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
   key        = "${each.key}__db__username"
@@ -1030,7 +1038,7 @@ resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_host" {
   for_each   = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
   key        = "${each.key}__db__host"
   project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
-  value      = "${each.key}-db-svc.${coalesce(each.value.namespace, each.value.connected_namespace, each.key)}.svc"
+  value      = try(each.value.database.host, "${each.key}-db-svc.${coalesce(each.value.namespace, each.value.connected_namespace, each.key)}.svc")
 }
 
 resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_port" {

module.tf.save

@@ -1,185 +0,0 @@
-terraform {
-  required_version = "> 0.8.0"
-}
-
-
-provider "kubernetes" {
-  config_path = "~/.kube/config"
-}
-
-
-resource "kubernetes_namespace" "screeps" {
-  metadata {
-    annotations = {
-      name = "screeps"
-    }
-    name = "screeps"
-  }
-}
-
-
-resource "kubernetes_persistent_volume_claim" "screeps-pvc" {
-  metadata {
-    namespace = "screeps"
-    name      = "screeps-pvc"
-  }
-  spec {
-    access_modes       = ["ReadWriteMany"]
-    storage_class_name = "nfs-storage-intelligent"
-    resources {
-      requests = {
-        storage = "1Gi"
-      }
-    }
-  }
-}
-
-
-resource "kubernetes_deployment_v1" "screeps" {
-  metadata {
-    namespace = "screeps"
-    name      = "screeps"
-    labels = {
-      app = "screepsserver"
-    }
-  }
-
-  spec {
-    replicas = 1
-
-    selector {
-      match_labels = {
-        app = "screepsserver"
-      }
-    }
-
-    template {
-      metadata {
-        labels = {
-          app = "screepsserver"
-        }
-      }
-
-      spec {
-        container {
-          image = "screepers/screeps-launcher"
-          name  = "screeps-launcher"
-          port {
-            container_port = 21025
-            name           = "screeps-port"
-          }
-          volume_mount {
-            mount_path = "/screeps"
-            name       = "screeps-volume"
-          }
-
-          resources {
-            limits = {
-              cpu    = "2"
-              memory = "2Gi"
-            }
-            requests = {
-              cpu    = "250m"
-              memory = "500Mi"
-            }
-          }
-
-
-
-        }
-        volume {
-          name = "screeps-volume"
-          persistent_volume_claim {
-            claim_name = "screeps-pvc"
-          }
-        }
-
-      }
-    }
-  }
-}
-
-resource "kubernetes_service" "screeps_service" {
-  metadata {
-    name      = "screeps"
-    namespace = "screeps"
-  }
-  spec {
-    selector = {
-      app = "screepsserver"
-    }
-    port {
-      port = 21025
-    }
-
-  }
-}
-
-
-variable "kubernetes" {
-  type = map(object({
-    service = string
-    #testingbool= bool
-    pvc_name                = optional(string)
-    namespace               = optional(string)
-    service_port            = optional(number)
-    LoadBalancerbool        = optional(string)
-    enabled                 = optional(bool, true)
-    proxy_cache             = optional(bool, false)
-    extra-value             = optional(string, "")
-    http2_bool              = optional(bool, false)
-    proxy_pass_https        = optional(bool, false)
-    authentication_required = optional(bool, false)
-  }))
-
-}
-
-resource "kubernetes_namespace" "automatic" {
-  for_each = { for key, value in var.kubernetes : key => value if value.enabled == true }
-  metadata {
-    annotations = {
-      name = coalesce(each.value.namespace, each.key)
-    }
-    name = coalesce(each.value.namespace, each.key)
-  }
-}
-
-
-resource "kubernetes_persistent_volume_claim" "automatic-pvc" {
-  for_each = { for key, value in var.kubernetes : key => value if value.pvc_name != null }
-  metadata {
-    namespace = coalesce(each.value.namespace, each.key)
-    name      = coalesce(each.value.namespace, each.key)
-  }
-  spec {
-    access_modes       = ["ReadWriteMany"]
-    storage_class_name = "nfs-storage-intelligent"
-    resources {
-      requests = {
-        storage = "1Gi"
-      }
-    }
-  }
-}
-
-
-resource "kubernetes_service" "automatic_service" {
-  for_each = { for key, value in var.kubernetes : key => value if value.service_port != null }
-  metadata {
-    name      = coalesce(each.value.namespace, each.key)
-    namespace = coalesce(each.value.namespace, each.key)
-  }
-  spec {
-    selector = {
-      app = "screepsserver"
-    }
-    port {
-      port = each.value.service_port
-    }
-
-if(each.value.LoadBalancerbool == "enabled" ? [type     = "LoadBalancer"] :[]
-
-    }
-
-  }
-}

nginx_config.tftpl

@@ -43,3 +43,48 @@ server {
         return 404;
 
 }
+############################################
+#       config file for ${name_site}
+############################################
+
+upstream ${name_site}_backend_root {
+        server ${name_service};
+        server 1.1.1.1 backup;
+    }
+
+server {
+        server_name ${name_site}.geeraert.eu www.${name_site}.geeraert.eu;
+        location / {
+                proxy_pass http://${name_site}_backend_root;
+                proxy_set_header    Upgrade     $http_upgrade;
+		proxy_set_header Host $host;
+        }
+        location /.well-known/acme-challenge/ {
+                root /var/www/certbot;
+        }
+
+	access_log /var/log/nginx/access.log my_custom_format;
+        access_log /var/log/nginx/ip_audit.log ip_audit;
+
+        listen 443 ssl;
+
+        ssl_certificate /etc/nginx/ssl/live/geeraert.eu/fullchain.pem;
+        ssl_certificate_key /etc/nginx/ssl/live/geeraert.eu/privkey.pem;
+
+}
+
+server {
+        if ($host = www.${name_site}.geeraert.eu) {
+                return 301 https://$host$request_uri;
+        }
+
+
+        if ($host = ${name_site}.geeraert.eu) {
+                return 301 https://$host$request_uri;
+        }
+
+        server_name www.${name_site}.geeraert.eu ${name_site}.geeraert.eu;
+        listen 80;
+        return 404;
+
+}

redis.tf

@@ -0,0 +1,56 @@
+resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_redis_host" {
+  for_each   = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
+  key        = "${each.key}__redis__host"
+  project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
+  value      = try(each.value.redis.host, "${each.key}-redis-svc.${coalesce(each.value.namespace, each.value.connected_namespace, each.key)}.svc")
+}
+
+resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_redis_port" {
+  for_each   = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
+  key        = "${each.key}__redis__port"
+  project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
+  value      = try(each.value.redis.port, 5432)
+}
+
+##
+## Commenting until I use the redis password option
+##
+#resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_redis_password" {
+#  for_each        = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
+#  key             = "${each.key}__redis__password"
+#  project_id      = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
+#  length          = 32
+#  special         = true
+#  min_special     = 5
+#  avoid_ambiguous = true
+#}
+
+resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_redis_REPLICATION_MODE" {
+  for_each   = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
+  key        = "${each.key}__redis__REPLICATION_MODE"
+  project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
+  value      = try(each.value.redis.REPLICATION_MODE, "master")
+}
+
+resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_redis_TLS_ENABLED" {
+  for_each   = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
+  key        = "${each.key}__redis__TLS_ENABLED"
+  project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
+  value      = try(each.value.redis.TLS_ENABLED, "no")
+}
+
+resource "kubernetes_secret_v1" "automatic-redis-secret" {
+  for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
+  metadata {
+    name      = "${each.key}-redis-terraform"
+    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
+  }
+
+  data = {
+    REDIS_HOSTNAME         = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_redis_host[each.key].value}"
+    REDIS_PORT             = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_redis_port[each.key].value}"
+    REDIS_REPLICATION_MODE = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_redis_REPLICATION_MODE[each.key].value}"
+    REDIS_TLS_ENABLED      = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_redis_TLS_ENABLED[each.key].value}"
+  }
+
+}

variables.auto.tfvars

@@ -4,6 +4,7 @@ kubernetes = {
     replicas     = 01
     image        = "linuxserver/bookstack:latest"
     service_port = [80, 443]
+    domain_name  = "bookstack"
     database = {
       "engine"    = "mysql"
       "image"     = "lscr.io/linuxserver/mariadb"
@@ -58,6 +59,42 @@ kubernetes = {
 
   }
 
+  minecraft = {
+    enabled      = false
+    image        = "itzg/minecraft-server"
+    service_port = [25565]
+    service_type = "LoadBalancer"
+
+    environment = {
+      EULA = {
+        value = "TRUE"
+      }
+      ONLINE_MODE = {
+        value = "FALSE"
+      }
+      VERSION = {
+        value = "1.21.8"
+      }
+    }
+
+
+    #requirements = {
+    #  limits-cpu      = "1000m"
+    #  limits-memory   = "1Gi"
+    #  requests-cpu    = "500m"
+    #  requests-memory = "400Mi"
+    #}
+    pvc = {
+      minecraft-volume = {
+        name       = "minecraft"
+        pvc_size   = "1Gi"
+        pvc        = true
+        mount_path = "/data"
+      }
+    }
+
+  }
+
 
   stirling = {
     enabled      = false
@@ -156,12 +193,12 @@ kubernetes = {
 
   gluetun = {
     #    enabled             = false
-    dns_nameservers = "10.2.0.1"
+    dns_nameservers = "1.1.1.1"
     replicas        = 01
     image           = "qmcgaw/gluetun:latest"
     service_port    = [8888]
-    #extra_manifest    = ["/opt/kubernetes/Terraform_kube/external_manifests/gluetun/gluetun-secret-netherland.yaml"]
+    #extra_manifest    = ["/opt/kubernetes/Terraform_kube/external_manifests/gluetun/gluetun-secret-netherlandNL-FREE-280.yaml"]
-    secret_import    = ["5527ba11-07e3-415b-8d1f-b3ee0154eb56"]
+    secret_import    = ["5527ba11-07e3-415b-8d1f-b3ee0154eb56", "b0d22160-d81a-4702-a3dd-b40e0168d617", "643dbe99-ace0-4ef5-8a2e-b44f014dccb0"]
     security_context = true
     #    requirements = {
     #      limits-cpu      = "800Mi"
@@ -170,78 +207,46 @@ kubernetes = {
     #      requests-memory = "800Mi"
     #    }
     environment = {
-      DNS_ADDRESS = {
-        value_from = {
-          secret_key_ref = {
-            name = "gluetun-secret-netherland"
-            key  = "VPN_DNS_IP"
-          }
-        }
-      }
-      WIREGUARD_ENDPOINT_IP = {
-        value_from = {
-          secret_key_ref = {
-            name = "gluetun-secret-netherland"
-            key  = "VPN_ENDPOINT_IP"
-          }
-        }
-      }
-      WIREGUARD_ENDPOINT_PORT = {
-        value_from = {
-          secret_key_ref = {
-            name = "gluetun-secret-netherland"
-            key  = "VPN_ENDPOINT_PORT"
-          }
-        }
-      }
       WIREGUARD_PRIVATE_KEY = {
         value_from = {
           secret_key_ref = {
-            name = "gluetun-secret-netherland"
+            name = "gluetun-secret-nl-free-280"
             key  = "WIREGUARD_PRIVATE_KEY"
           }
         }
       }
-      WIREGUARD_PUBLIC_KEY = {
-        value_from = {
-          secret_key_ref = {
-            name = "gluetun-secret-netherland"
-            key  = "WIREGUARD_PUBLIC_KEY"
-          }
-        }
-      }
-      #      SHADOWSOCKS = {
       HTTPPROXY = {
         value = "on"
       }
-      #SHADOWSOCKS_LOG = {
       HTTPPROXY_LOG = {
         value = "on"
       }
       HTTPPROXY_LISTENING_ADDRESS = {
-        #SHADOWSOCKS_LISTENING_ADDRESS = {
         value = "0.0.0.0:8888"
       }
-      #      HTTPPROXY_USER = {
+      #      DNS_KEEP_NAMESERVER = {
-      #        value = "user"
+      #        value = "on"
       #      }
-
-      #SHADOWSOCKS_PASSWORD = {
-      #      HTTPPROXY_PASSWORD = {
-      #  value = "user"
-      #}
-      DNS_KEEP_NAMESERVER = {
-        value = "off"
-      }
       VPN_SERVICE_PROVIDER = {
-        value = "custom"
+        value = "protonvpn"
       }
       VPN_TYPE = {
         value = "wireguard"
       }
-      WIREGUARD_ADDRESSES = {
+      SERVER_COUNTRIES = {
-        value = "10.2.0.2/32"
+        value = "Netherlands"
       }
+      HEALTH_TARGET_ADDRESS = {
+        value = "0.0.0.0:8888"
+      }
+
+      FREE_ONLY = {
+        value = "on"
+      }
+
+      #      WIREGUARD_ADDRESSES = {
+      #        value = "10.2.0.2/32"
+      #      }
       FIREWALL_INPUT_PORTS = {
         value = "8081,7878,9696,9091,51413,8080,6881,8989,8191,8888,8000"
       }
@@ -249,9 +254,11 @@ kubernetes = {
         value = "ip2location"
       }
 
-      HEALTH_TARGET_ADDRESS = {
+      #      HEALTH_TARGET_ADDRESS = {
-        value = "protonvpn.com"
+      #        value = "protonvpn.com:80"
-      }
+      #      }
+      #      FIREWALL_OUTBOUND_SUBNETS = {
+      #      value = "10.0.0.0/24" }
 
     }
 
@@ -423,7 +430,9 @@ kubernetes = {
     service_port = [8000]
     domain_name  = "paperless2"
     database = {
-    image = "postgres:15.6" }
+      image     = "postgres:15.6"
+      mountPath = "/var/lib/postgresql/data"
+    }
     redis = {
     image = "redis:7.4.1" }
     #requirements = {
@@ -461,7 +470,7 @@ kubernetes = {
         }
       }
       PAPERLESS_URL = {
-        value = "https://paperless.tryton.geeraert.eu"
+        value = "https://paperless.geeraert.eu"
       }
       PAPERLESS_TIKA_ENABLED = {
         value = "1"
@@ -663,72 +672,40 @@ kubernetes = {
 
 
 
-  next = {
+  nextcloud = {
     enabled        = false
     namespace = "next"
-    replicas       = 01
+    #replicas     = 0
     image        = "nextcloud:29.0.3-apache"
+    domain_name  = "next"
     service_port = [80]
-    extra_manifest = ["/opt/kubernetes/Nextcloud_kube/next.secret.yaml"]
+    #extra_manifest = ["/opt/kubernetes/Nextcloud_kube/next.secret.yaml"]
+    secret_ref    = ["nextcloud-credentials"]
+    secret_import = ["b207c4b6-0489-4ab2-a032-b4a400a708e0"]
     database = {
     image = "docker.io/library/postgres:14" }
     redis = {
     image = "docker.io/library/redis:7" }
-    requirements = {
+    #requirements = {
-      limits-cpu      = "800Mi"
+    #  limits-cpu      = "800Mi"
-      limits-memory   = "800Mi"
+    #  limits-memory   = "800Mi"
-      requests-cpu    = "800Mi"
+    #  requests-cpu    = "800Mi"
-      requests-memory = "800Mi"
+    #  requests-memory = "800Mi"
-    }
-    environment = {
-      POSTGRES_DB = {
-        value_from = {
-          secret_key_ref = {
-            name = "nextcloud-credentials"
-            key  = "POSTGRES_DB"
-          }
-        }
-      }
-      POSTGRES_USER = {
-        value_from = {
-          secret_key_ref = {
-            name = "nextcloud-credentials"
-            key  = "POSTGRES_USER"
-          }
-        }
-      }
-      POSTGRES_PASSWORD = {
-        value_from = {
-          secret_key_ref = {
-            name = "nextcloud-credentials"
-            key  = "POSTGRES_PASSWORD"
-          }
-        }
-      }
-      POSTGRES_HOST = {
-        value_from = {
-          secret_key_ref = {
-            name = "nextcloud-credentials"
-            key  = "POSTGRES_HOST"
-          }
-        }
-      }
-
-      #      REDIS_HOST = {
-      #        value = "redis://next-redis-svc:6379"
     #}
+    environment = {
+
       TRUSTED_PROXIES = {
         value = "192.168.88.50 192.168.88.52"
       }
       OVERWRITECLIURL = {
-        value = "https://nextcloud.tryton.geeraert.eu"
+        value = "https://next.geeraert.eu"
       }
       OVERWRITEPROTOCOL = {
         value = "https"
       }
 
       NEXTCLOUD_TRUSTED_DOMAINS = {
-        value = "nextcloud.tryton.geeraert.eu 192.168.88.52"
+        value = "next.geeraert.eu next.tryton.geeraert.eu 192.168.88.52"
       }
       NEXTCLOUD_ADMIN_USER = {
         value = "admin"
@@ -741,6 +718,7 @@ kubernetes = {
           }
         }
       }
+
     }
     pvc = {
       nextcloud-webserver = {
@@ -822,7 +800,7 @@ kubernetes = {
   }
 
   jellyfin = {
-    #  enabled      = false
+    enabled      = false
     replicas     = 0
     image        = "jellyfin/jellyfin:latest"
     service_port = [8096]
@@ -830,7 +808,7 @@ kubernetes = {
     environment = {
 
       JELLYFIN_PublishedServerUrl = {
-        value = "https://jellyfin.tryton.geeraert.eu"
+        value = "https://jellyfin.geeraert.eu"
       }
     }
     pvc = {
@@ -957,6 +935,7 @@ kubernetes = {
       "image"   = "docker.io/library/postgres:17.5"
       name      = "prowlarr-main"
       username  = "servarr_username"
+      mountPath = "/var/lib/postgresql/data"
     }
 
     environment = {
@@ -1254,7 +1233,11 @@ kubernetes = {
     #domain_name = "wikijs"
     extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/wikijs/wikijs-db.secret.yaml"]
     database = {
-    image = "postgres:17" }
+      image     = "postgres:17"
+      name      = "wiki"
+      username  = "wikijs_username"
+      mountPath = "/var/lib/postgresql/data"
+    }
 
     environment = {
       PUID = {
@@ -1337,14 +1320,15 @@ kubernetes = {
     #enabled = false
     #replicas     = 0
     connected_namespace = "immich"
-    image               = "ghcr.io/immich-app/immich-server:v2.5.6"
+    image               = "ghcr.io/immich-app/immich-server:v3.0.0"
     service_port        = [2283]
     database = {
-      image = "docker.io/tensorchord/pgvecto-rs:pg14-v0.2.0"
+      image     = "ghcr.io/immich-app/postgres:14-vectorchord0.4.3-pgvectors0.2.0"
+      mountPath = "/var/lib/postgresql/data"
     }
 
     redis = {
-    image = "docker.io/bitnami/redis:7.2.5-debian-12-r0" }
+    image = "docker.io/valkey/valkey:9@sha256:4963247afc4cd33c7d3b2d2816b9f7f8eeebab148d29056c2ca4d7cbc966f2d9" }
     requirements = {
       limits-cpu      = "800m"
       limits-memory   = "2Gi"
@@ -1524,10 +1508,11 @@ kubernetes = {
     database = {
       image     = "docker.io/tensorchord/pgvecto-rs:pg14-v0.2.0"
       username  = "django_username"
+      mountPath = "/var/lib/postgresql/data"
     }
-    redis = {}
+    #redis         = {}
-
+    secret_ref    = ["django-bitwarden-credentials"]
-
+    secret_import = ["9fc5a725-75f5-4bab-b595-b474017146c3"]
     requirements = {
       limits-cpu      = "800m"
       limits-memory   = "800Mi"
@@ -1537,6 +1522,18 @@ kubernetes = {
     extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/django/kubeconfig.secret.yaml", "/opt/kubernetes/Terraform_kube/external_manifests/django/django-db.secret.yaml"]
 
     environment = {
+      ALLOWED_HOSTS = {
+        value = "django.geeraert.eu,admin.geeraert.eu,redirect.geeraert.eu,streaming.geeraert.eu,stash.geeraert.eu,simpsons.geeraert.eu,kubernetes.geeraert.eu,cloudmanager.geeraert.eu,podcast.geeraert.eu"
+      }
+      DEBUG = {
+        value = "False"
+      }
+      ENVIRONMENT = {
+        value = "PRODUCTION"
+      }
+      #CELERY_BROKER_URL = {
+      #  value = "redis://django-redis-svc:6379"
+      #}
       #HTTP_PROXY = {
       #value = "http://gluetun-svc.gluetun.svc:8888" }
 
@@ -1601,10 +1598,11 @@ kubernetes = {
     }
   }
   celery-worker = {
-    #enabled             = false
+    enabled             = false
     connected_namespace = "django"
     image               = "gitea.tryton.geeraert.eu/pi-ux-ce/django-python:latest"
-    command             = ["celery", "--workdir=django_code/", "-A", "django_code", "worker"]
+    command             = ["celery", "--workdir=django_code/", "-A", "core", "worker"]
+    secret_ref          = ["django-bitwarden-credentials"]
     pvc = {
       #kubeconfig-secret = {
       #  secret     = true
@@ -1634,6 +1632,68 @@ kubernetes = {
     value = "/code/django_code/" }
   }
 
+  django-testing = {
+    #enabled      =false
+    image        = "gitea.tryton.geeraert.eu/pi-ux-ce/django-testing:latest"
+    service_port = [8000]
+    database     = {}
+    #redis        = {}
+    requirements = {
+      limits-cpu      = "800m"
+      limits-memory   = "800Mi"
+      requests-cpu    = "10m"
+      requests-memory = "300Mi"
+    }
+    extra_manifest = ["/opt/kubernetes/Terraform_kube/external_manifests/django/kubeconfig-testing.secret.yaml"]
+    secret_ref     = ["django-bitwarden-credentials"]
+    secret_import  = ["68dce7aa-8e5f-4483-9083-b474016e34fc"]
+    environment = {
+      ALLOWED_HOSTS = {
+        value = "django-testing.geeraert.eu,admin-testing.geeraert.eu,redirect-testing.geeraert.eu,streaming-testing.geeraert.eu,stash-testing.geeraert.eu,simpsons-testing.geeraert.eu,kubernetes-testing.geeraert.eu,cloudmanager-testing.geeraert.eu,podcast-testing.geeraert.eu"
+      }
+      CELERY_BROKER_URL = {
+        value = "redis://django-testing-redis-svc:6379"
+      }
+
+      DEBUG = {
+        value = "true"
+      }
+      DB_PORT = {
+        value = 5432
+      }
+      CUSTOM_DB_DATABASE = {
+      value = "cloudmanager" }
+    }
+    pvc = {
+      kubeconfig-secret = {
+        secret     = true
+        name       = "kubeconfig"
+        mount_path = "/kubeconfig"
+      }
+    }
+
+  }
+
+  celery-worker-testing = {
+    enabled             = false
+    connected_namespace = "django-testing"
+    image               = "gitea.tryton.geeraert.eu/pi-ux-ce/django-python:latest"
+    command             = ["celery", "--workdir=Django_kube/django_code/", "-A", "core", "worker"]
+    secret_ref          = ["django-bitwarden-credentials"]
+    environment = {
+      CELERY_BROKER_URL = {
+        value = "redis://django-testing-redis-svc:6379"
+      }
+      CELERY_IMPORTS = {
+      value = "stash_management.apps" }
+    }
+    HTTP_PROXY = {
+    value = "http://gluetun-svc.gluetun.svc:8888" }
+    PYTHONPATH = {
+    value = "/code/Django_kube/django_code/" }
+  }
+
+
   keycloak = {
     enabled      = false
     name         = "keycloak"
@@ -1750,7 +1810,7 @@ kubernetes = {
   }
 
   tdarr = {
-    #enabled             = false
+    enabled             = false
     image               = "ghcr.io/haveagitgat/tdarr"
     connected_namespace = "servarr"
     service_port        = [8265, 8266]
@@ -2285,8 +2345,11 @@ kubernetes = {
     config_map_ref      = ["mssql.env", "uid.env", "mssql.override.env"]
     environment         = {}
     database = {
-      "shunt"  = "true"
+      shunt    = "true"
-      "engine" = "sqlserver"
+      engine   = "sqlserver"
+      username = "sa"
+      host     = "bitwarden-mssql-svc"
+      name     = "bitwarden_vault"
     }
 
     pvc = {
@@ -2428,23 +2491,73 @@ kubernetes = {
       }
     }
   }
-  sharelatex = {
+  overleaf = {
     enabled = false
-    image        = "sharelatex/sharelatex"
+    #image    = "sharelatex/sharelatex:6.1.2"
+    image    = "tuetenk0pp/sharelatex-full:latest"
     replicas = 1
-    service_port = [8268]
+    environment = {
-    database = {
+      MONGO_URL = {
-      "image"     = "mongo:4.0"
+        value = "mongodb://overleaf-db-svc:27017/overleaf"
-      "port"      = 27017
-      "mountPath" = "/data/db"
-      "command"   = "--replSet overleaf"
       }
-    redis = {
+      REDIS_URL = {
-    image = "redis:5.0" }
+        value = "redis://overleaf-redis-svc:6379"
+      }
+      OVERLEAF_MONGO_URL = {
+        value = "mongodb://overleaf-db-svc:27017/overleaf"
+      }
+      OVERLEAF_REDIS_HOST = {
+        value = "overleaf-redis-svc"
+      }
+      REDIS_HOST = {
+        value = "overleaf-redis-svc"
+      }
+      REDIS_PORT = {
+        value = "6379"
       }
 
+      TZ = {
+        value = "Etc/UTC"
+      }
+
+      VERBOSITY = {
+      value = "-vv" }
+    }
+    service_port = [80]
+    database = {
+      "image"     = "mongo:8.0"
+      "port"      = 27017
+      "mountPath" = "/data/db"
+      #initialise the replicaset of the mongo DB 
+      #kubectl exec -it <mongo-pod-name> -- mongosh
+      #cfg = rs.conf()
+      #cfg.members[0].host = "mongodb:27017"  // ← your K8s Service name + port
+      #rs.reconfig(cfg, { force: true })
+      #rs.status()
+      #// members[0].name should now show "mongodb:27017"
+    }
+    database_args = ["--replSet", "overleaf"]
+    redis = {
+    image = "redis:7.4" }
+    pvc = {
+      overleaf-data = {
+        pvc        = true
+        pvc_size   = "2Mi"
+        mount_path = "/var/lib/overleaf"
+        name       = "overleaf-data"
+      }
+      overleaf-package = {
+        pvc        = true
+        pvc_size   = "2Mi"
+        mount_path = "/usr/local/texlive/"
+        name       = "overleaf-package"
+      }
+    }
+  }
+
+
   fail2ban = {
-    # enabled        = false
+    enabled = false
     #image                = "lscr.io/linuxserver/fail2ban:latest"
     image                = "gitea.tryton.geeraert.eu/pi-ux-ce/fail2ban:latest"
     extra_manifest       = ["/opt/kubernetes/Terraform_kube/external_manifests/fail2ban/fail2ban.RoleBinding.yaml", "/opt/kubernetes/Terraform_kube/external_manifests/fail2ban/fail2ban.Role.yaml", "/opt/kubernetes/Terraform_kube/external_manifests/fail2ban/fail2ban.ServiceAccount.yaml"]
@@ -2502,4 +2615,280 @@ kubernetes = {
     }
   }
 
+
+  reactive = {
+    #disabled because it needs AI to import a pdf and AI integration is not working
+    enabled      = false
+    replicas     = 01
+    domain_name  = "reactive"
+    image        = "ghcr.io/amruthpillai/reactive-resume:latest"
+    service_port = [3000]
+    environment = {
+      AUTH_SECRET = {
+        value = "change-me-to-a-secure-secret-key-in-production"
+      }
+      PRINTER_ENDPOINT = {
+        value = "ws://browserless:3000?token=change-me"
+      }
+      APP_URL = {
+        value = "https://reactive.tryton.geeraert.eu"
+      }
+      AI_ALLOWED_BASE_URLS = {
+        value = "api.openai.com,https://gateway.ai.vercel.com"
+      }
+    }
+    database = {}
+    pvc = {
+      reactive-resume-data = {
+        name       = "reactive-resume-data"
+        pvc        = true
+        pvc_size   = "2Gi"
+        mount_path = "/app/data"
+      }
+    }
+  }
+
+  opencloud = {
+    enabled      = false
+    replicas     = 01
+    image        = "opencloudeu/opencloud-rolling:latest"
+    service_port = [9200]
+    #domain_name  = "opencloud"
+
+    environment = {
+      #IDM_CREATE_DEMO_USERS = {
+      #  value = "false"
+      #}
+      OC_INSECURE = {
+        value = "true"
+      }
+      OC_DOMAIN = {
+        value = "https://opencloud.tryton.geeraert.eu"
+      }
+      OC_URL = {
+        value = "https://opencloud.tryton.geeraert.eu"
+      }
+
+      INITIAL_ADMIN_PASSWORD = {
+      value = "admin" }
+    }
+    pvc = {
+      opencloud-config = {
+        name       = "opencloud-config"
+        pvc        = true
+        pvc_size   = "2Gi"
+        mount_path = "/etc/opencloud/"
+      }
+      opencloud-data = {
+        name       = "opencloud-data"
+        pvc        = true
+        pvc_size   = "2Gi"
+        mount_path = "/var/lib/opencloud"
+      }
+
+    }
+  }
+
+  owncloud = {
+    enabled      = false
+    replicas     = 0
+    image        = "owncloud/server"
+    service_port = [8080]
+    domain_name  = "owncloud"
+    database = {
+      "engine"     = "mysql"
+      "image"      = "lscr.io/linuxserver/mariadb"
+      "port"       = 3306
+      "mountPath"  = "/config"
+      name         = "owncloud"
+      map_username = "OWNCLOUD_DB_USERNAME"
+      map_name     = "OWNCLOUD_DB_NAME"
+      map_password = "OWNCLOUD_DB_PASSWORD"
+      map_host     = "OWNCLOUD_DB_HOST"
+    }
+    redis = {
+    image = "redis" }
+    environment = {
+      OWNCLOUD_DOMAIN = {
+        value = "owncloud.tryton.geeraert.eu"
+      }
+      OWNCLOUD_TRUSTED_DOMAINS = {
+        value = "owncloud.tryton.geeraert.eu"
+      }
+      OWNCLOUD_DB_TYPE = {
+        value = "mysql"
+      }
+      OWNCLOUD_ADMIN_USERNAME = {
+        value = "admin"
+      }
+      OWNCLOUD_ADMIN_PASSWORD = {
+        value = "admin"
+      }
+      OWNCLOUD_MYSQL_UTF8MB4 = {
+        value = true
+      }
+      OWNCLOUD_REDIS_ENABLED = {
+        value = true
+      }
+      OWNCLOUD_REDIS_HOST = {
+        value = "owncloud-redis-svc"
+      }
+    }
+    pvc = {
+      owncloud-file = {
+        name       = "owncloud-file"
+        pvc        = true
+        pvc_size   = "2Gi"
+        mount_path = "/mnt/data"
+      }
+
+    }
+  }
+
+  netdatat = {
+    image            = "debian"
+    enabled          = false
+    service_port     = [19999]
+    domain_name      = "netdata"
+    command          = ["sleep", "3600"]
+    security_context = true
+
+    environment = {
+      NETDATA_CLAIM_TOKEN = {
+        value = "wN6wJV1M5jvLbcpQTT78s0WRWiCkxz-s4l9tzeIqwA86upIkVSTk6TbaPbA5L6h_5HH9LoemluBqSPAGzi8DnJ2LBp4e8JGRVuWwOv8EWcKfrV0winCPce4xXtuD780KUW5CR6k"
+      }
+      NETDATA_CLAIM_URL = {
+        value = "https://app.netdata.cloud"
+      }
+      NETDATA_CLAIM_ROOMS = {
+        value = "28654d7b-4767-4b8e-bddc-8d134624bb3b"
+      }
+    }
+
+    pvc = {
+      netdata-config = {
+        name       = "netdata-config"
+        pvc        = true
+        pvc_size   = "1Gi"
+        mount_path = "/etc/netdata"
+      }
+      netdata-lib = {
+        name       = "netdata-lib"
+        pvc        = true
+        pvc_size   = "1Gi"
+        mount_path = "/var/lib/netdata"
+      }
+      netdata-cache = {
+        name       = "netdata-cache"
+        pvc        = true
+        pvc_size   = "1Gi"
+        mount_path = "/var/cache/netdata"
+      }
+      netdata-host-root = {
+        host_path  = "/"
+        name       = "netdata-host-root"
+        mount_path = "/host/root"
+      }
+      netdata-host-passwd = {
+        host_path  = "/etc/passwd"
+        name       = "netdata-host-passwd"
+        mount_path = "/host/etc/passwd"
+      }
+      netdata-host-group = {
+        host_path  = "/etc/group"
+        name       = "netdata-host-group"
+        mount_path = "/host/etc/group"
+      }
+      netdata-host-localtime = {
+        host_path  = "/etc/localtime"
+        name       = "netdata-host-localtime"
+        mount_path = "/etc/localtime"
+      }
+      netdata-host-proc = {
+        host_path  = "/proc"
+        name       = "netdata-host-proc"
+        mount_path = "/host/proc"
+      }
+      netdata-host-sys = {
+        host_path  = "/sys"
+        name       = "netdata-host-sys"
+        mount_path = "/host/sys"
+      }
+      netdata-host-os-release = {
+        host_path  = "/etc/os-release"
+        name       = "netdata-host-os-release"
+        mount_path = "/host/etc/os-release"
+      }
+      netdata-host-var-log = {
+        host_path  = "/var/log"
+        name       = "netdata-host-var-log"
+        mount_path = "/host/var/log"
+      }
+      netdata-docker-sock = {
+        host_path  = "/var/run/docker.sock"
+        name       = "netdata-docker-sock"
+        mount_path = "/var/run/docker.sock"
+      }
+      netdata-host-dbus = {
+        host_path  = "/run/dbus"
+        name       = "netdata-host-dbus"
+        mount_path = "/run/dbus"
+      }
+    }
+  }
+
+
+
+  kopia = {
+    enabled      = false
+    replicas     = 01
+    image        = "kopia/kopia"
+    service_port = [51515]
+    domain_name  = "kopia"
+    command      = ["start", "--disable-csrf-token-checks", "--insecure", "--address=0.0.0.0:51515", "--server-username=USERNAME", "--server-password=SECRET_PASSWORD"]
+    environment = {
+      KOPIA_PASSWORD = {
+        value = "123456789"
+      }
+      USER = {
+      value = "user" }
+    }
+    pvc = {
+      kopia-storage = {
+        name       = "kopia-storage"
+        pvc        = true
+        pvc_size   = "2Gi"
+        mount_path = "/app"
+      }
+    }
+    kopia-data = {
+      name               = "kopia-data"
+      pvc_size           = "100Mi"
+      pvc                = true
+      mount_path         = "/data"
+      storage_class_name = "nfs-storage-fastaccess"
+    }
+  }
+
+  degoog = {
+    enabled      = false
+    replicas     = 01
+    image        = "ghcr.io/degoog-org/degoog:latest"
+    service_port = [4444]
+    domain_name  = "degoog"
+    environment = {
+      DEGOOG_SETTINGS_PASSWORDS = {
+        value = "Crease1-City-Canned"
+      }
+    }
+    pvc = {
+      degoog-data = {
+        name       = "degoog-data"
+        pvc        = true
+        pvc_size   = "2Gi"
+        mount_path = "/app/data"
+      }
+    }
+  }
+
 }