upgrading redis to latest

.bitwarden/device_identifier

@@ -0,0 +1 @@
+9fdbb94c-0fd5-4ce2-919f-1fbb596cd318

.bw-provider-state

@@ -0,0 +1 @@
+2.pYoQjnuN9ZB+IqEypWrFPw==|/nlBG5qPy/zIFwYjjNXMuNWLU8pSt3TLR1/q4L3AEzi5Semc2261DyelXIfVpOn21JOGOV7jiIV6P3CSuASCjvCH+lCZSbjHfcj/MIOl3IBZJWF3vnTBVl3yjYD+Jmf0/zaYXbUW881oiO3Pu5Obc2jiBKNlX2bx5H11Iyi/fOmvR+EgsdequGgRm0FiSkjkbyG8d9bR55XR9NtS5x9a8EOhKWu0yXFGAKkDGV/m+j45z20mVTlAuuNDtIOX/rDKdKJpzg6SF8EuRTGC5RWAHJ+V8BACe3xxHi43YFit5RjpQ83F6rUGc+hc7TTcKyLA0Go7vUnKQ2wljSihM+HgJbGI6Sgnc9/Ys9AyDI0Bfz4EntfUqSeMBoaatvGpe3LYZdGysUMtDUoQWAvEfKbnnTKQRJb6zTD0RjhJ1ZowrrUFXyU9s1kNu3Sx29Q6h926lIiZ7kNejLcBEIJm0NjifAT9E0dwWTC6/bM2NrQpAotQBQGKGOGGRPIQW8vM7EJ6pl3ZSM/RzRnvQEdmWLNTbLd5eUd0efTviQr4BTxhwj7m3UGBUI/ZQhd3UNTU2ZVpt93nY2QPW3EpNpPBdYMnAgqbc3iz9mGZKtUwYpCwEpHj2G0CxCjgoj8il3Ys+vpPbYqpx+/FbibQLsELAbvLtK/TnDT5tq2gCYIHNUYL+iO+rdm8uGVWcFeMUBvyC/sdHEJgnQ3Rf6Up8lhgP3NQu6QgWT5gkGRrJ4RoYYET9919FOas43imUfWLEAaL/iU+NliGj3B0gCnwi1Ljm4+k5MOVHJqgcBdh0LHhNgIQcBurV0Qk8ZkoVnkTBjTMduOGogn9+Ny7B5D28nk8VW4fHL9MsgvYTZXZmI0QKgS2YzTmkle916qGLWgo5hcp5V4MG1EBpchzu0JJUUdPrb06txBr+cCCYvGi1B2epw6nJAJ7OGB4vzcJM/kVQYRVQmV/kfWXxtROCkx3CAKG5oyKMiiPcUiiqIIYuhRUEZYPC9+w67nMANPG8VcyqylcEba/FMSn4ECj7ce2iHCnyAnk9wb78P/YZdNMGbgviJq1nZm+OaGmpMxEoZHpyOe3EmuEKNpuSgqXGygR6ltAqzFRNJJlHm1PLHWxp4n4n5E1VhbaFiN2urTn/Pt2hqh0YEHyRVYYDSJv5QL8Dqq7WVYD2V3waLwi5Q5o6jc2XkaGN3hLg0fH7yO9KMa+MGUIcx5TZX+QGwiB4n/rZijV2h9d7th/tn0+/Gxtz+JcZ9J+4j4/1MR89vGe1EFOl9ZpUYxQVTVNuLoPaql5dXJZf3LeLL3fq05yNyW38NzcT5fFjevSRyRyoTHTrePCr5Tk5D0BaNQDhgDvBtC1kdo72HKR0+y1x31TxzLmc3OMBj2iqMxt0V7snwUfuVYu43LY48YML3wxRe/EVDmP6h8H89JWkw1aCJsLInN7hDSpUJtGBIn30c5r2kSw/87iVskVnQAUsQFMPOzUmDm6E07fnysbPwuAECuha93aMljzQNF4mwd6Pey24Pkfl+K7wypOL94iK1GcM4FqsCpNfD/X1M3Z+AVQahXAtUt82wmaXfQUtQ6Dvt6mfwFnknmWpyI9Pbj3r8lh4M5rffMFucJac32eoq+KY9xdhyPyep0becLQxNog2LiWliSQlfKBoB3X9FSyDalwEasWagUvNdENqkL+GWCxlCZK7g+ibvO5keA0Baqt1ohRcBoigNfmcTsZUPRhq+dy2cvaiPaGRDgX2DKlJdC8LnPDb/qTvk+uP5yZaKSItjdFkYo7c+fbOXH+I93Kd9IK+LJVM+9cWnx6yKBW/TaaEuZCBholtxME8ZQDcnXIelp67IamsfuVb5QNouZuimzb9rP9vEDVTdyE3e5rYzl2AaljMdTIjB1ut5ZqGA8=|hem/6+QHhqSdcTgKycZLP9EDBT3JA8fLIUqETgTITNk=

external_manifests/bitwarden/bitwarden-identity-cert-password.secret.yml

@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: bitwarden-identity-cert-password
+  namespace: bitwarden
+type: Opaque

external_manifests/bitwarden/bitwarden-mssql-nodeport.svc.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: bitwarden-mssql-nodeport
+  namespace: bitwarden
+spec:
+  ports:
+  - name: 1433bitwarden-m
+    nodePort: 31433
+    port: 1433
+    protocol: TCP
+    targetPort: 1433
+  selector:
+    app: bitwarden-mssql
+  type: NodePort

external_manifests/bitwarden/bitwarden.backup_db.cronjob.yaml

@@ -0,0 +1,46 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: bitwarden-calendar-backup
+  namespace: bitwarden
+spec:
+  schedule: "0 0 * * *"
+  jobTemplate:
+    spec:
+      backoffLimit: 4
+      ttlSecondsAfterFinished: 100
+      template:
+        spec:
+          containers:
+          - name: bitwarden-database-backup
+            image: mcr.microsoft.com/mssql-tools
+            envFrom:
+            - secretRef:
+                name: bitwarden-mssql-db-terraform
+                optional: false
+            command: ["/bin/sh","-c"]
+            #args: ["mysqldump -h $DB_HOST -u $MYSQL_USER -p$MYSQL_ROOT_PASSWORD $MYSQL_DATABASE |gzip -9 > /backup/$(DB_DATABASE_NAME)-DB-$(date +%Y%m%d).sql.gz "]
+            args: ["sleep 3600"]
+            volumeMounts:
+            - name: backup
+              mountPath: /backup
+          volumes:
+          - name: backup
+            persistentVolumeClaim:
+              claimName: bitwarden-database-backup
+          restartPolicy: Never
+---
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: bitwarden-database-backup
+  namespace: bitwarden
+  annotations:
+    fileType: Backup
+spec:
+  storageClassName: nfs-storage-fastaccess
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 2Gi

external_manifests/bitwarden/config.configmap.yml

@@ -0,0 +1,11 @@
+apiVersion: v1
+data:
+  APP_URL: https://bookstack.tryton.geeraert.eu
+  LOCAL_GID: "1000"
+  LOCAL_UID: "1000"
+  TZ: Europe/London
+kind: ConfigMap
+metadata:
+  name: config
+  namespace: bitwarden
+

external_manifests/bitwarden/global.env.configmap.yml

@@ -0,0 +1,20 @@
+apiVersion: v1
+data:
+  ACCEPT_EULA: "Y"
+  ASPNETCORE_ENVIRONMENT: Production
+  globalSettings__baseServiceUri__vault: http://localhost
+  globalSettings__pushRelayBaseUri: https://push.bitwarden.com
+  globalSettings__selfHosted: "true"
+  globalSettings__baseServiceUri__internalNotifications: "http://bitwarden-notifications-svc:5000"
+  globalSettings__baseServiceUri__internalAdmin: "http://bitwarden-admin-svc:5000"
+  globalSettings__baseServiceUri__internalIdentity: "http://bitwarden-identity-svc:5000"
+  globalSettings__baseServiceUri__internalApi: "http://bitwarden-api-svc:5000"
+  globalSettings__baseServiceUri__internalVault: "http://bitwarden-web-svc:5000"
+  globalSettings__baseServiceUri__internalSso: "http://bitwarden-sso-svc:5000"
+  globalSettings__baseServiceUri__internalScim: "http://bitwarden-self-host-scim:5000"
+
+kind: ConfigMap
+metadata:
+  name: global.env
+  namespace: bitwarden
+

external_manifests/bitwarden/global.override.env.configmap.yml

@@ -0,0 +1,28 @@
+apiVersion: v1
+data:
+  ACCEPT_EULA: "Y"
+  adminSettings__admins: pierre@geeraert.eu
+  globalSettings__baseServiceUri__vault: http://bitwarden.tryton.geeraert.eu
+  globalSettings__disableUserRegistration: "false"
+  globalSettings__duo__aKey: p9jCHtnG4NZNZu4SThpVlCuOF1oePGhu53Wa4RJwuyeqRAWQ0aJN7GsKYrGbYIYO
+  globalSettings__hibpApiKey: REPLACE
+  globalSettings__identityServer__certificatePassword: test
+  globalSettings__installation__id: c36aded0-b0f1-4252-920b-ac4c008fc920
+  globalSettings__installation__key: CtQE5U1tMJE4Dzk7N9DU
+  globalSettings__internalIdentityKey: I5TMbqmEjhw9uBNmFZ9rU6s1KN5xqAKXh7RSPfgyj2XQ4sjlP22SCupFn4IVhYX7
+  globalSettings__mail__replyToEmail: no-reply@bitwarden.tryton.geeraert.eu
+  globalSettings__mail__smtp__host: smtp.gmail.com
+  globalSettings__mail__smtp__password: vmxkiidikqwirpuh
+  globalSettings__mail__smtp__port: "587"
+  globalSettings__mail__smtp__ssl: "false"
+  globalSettings__mail__smtp__username: p3jh6qa2@gmail.com
+  globalSettings__oidcIdentityClientKey: w47pWOkPa6mrTkiPuKizitsiRTR6NH8ufI01u77zbZt3LUcKWJ4wchMn6ouiwN7V
+  globalSettings__sqlServer__connectionString: Data Source=tcp:bitwarden-mssql-svc,1433;Initial
+    Catalog=bitwarden_vault;Persist Security Info=False;User ID=sa;Password=ChQKWDIW73eSHzX1UyvGDAv4pFw6DVKM;MultipleActiveResultSets=False;Connect
+    Timeout=30;Encrypt=True;TrustServerCertificate=True
+  globalSettings__yubico__clientId: REPLACE
+  globalSettings__yubico__key: REPLACE
+kind: ConfigMap
+metadata:
+  name: global.override.env
+  namespace: bitwarden

external_manifests/bitwarden/identity-svc.svc.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    deployment_method: manually
+  name: identity
+  namespace: bitwarden
+spec:
+  ports:
+  - name: 5000bitwarden-i
+    port: 5000
+    protocol: TCP
+    targetPort: 5000
+  selector:
+    app: bitwarden-identity
+  type: ClusterIP

external_manifests/bitwarden/mssql.env.configmap.yml

@@ -0,0 +1,9 @@
+apiVersion: v1
+data:
+  ACCEPT_EULA: "Y"
+  MSSQL_PID: Express
+  SA_PASSWORD: SECRET
+kind: ConfigMap
+metadata:
+  name: mssql.env
+  namespace: bitwarden

external_manifests/bitwarden/mssql.override.env.configmap.yml

@@ -0,0 +1,7 @@
+apiVersion: v1
+data:
+  SA_PASSWORD: ChQKWDIW73eSHzX1UyvGDAv4pFw6DVKM
+kind: ConfigMap
+metadata:
+  name: mssql.override.env
+  namespace: bitwarden

external_manifests/bitwarden/uid.env.configmap.yml

@@ -0,0 +1,8 @@
+apiVersion: v1
+data:
+  LOCAL_GID: "1001"
+  LOCAL_UID: "1001"
+kind: ConfigMap
+metadata:
+  name: uid.env
+  namespace: bitwarden

external_manifests/django/django-db.secret.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+data:
+  DB_DATABASE_NAME: ZGphbmdv
+  DB_HOST: ZGphbmdvLWRiLXN2Yw==
+  DB_PASSWORD: U3VmZnJhZ2UtTW9uZXliYWdzLUlsbHVzaW9uNw==
+  DB_USERNAME: ZGphbmdvX3VzZXJuYW1l
+kind: Secret
+metadata:
+  name: django-db-credentials
+  namespace: django

external_manifests/django/django-db.svc.yaml

@@ -0,0 +1,17 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: django-db-nodeport
+  namespace: django
+spec:
+  ports:
+  - name: http
+    nodePort: 32345
+    port: 5432
+    protocol: TCP
+    targetPort: 5432
+  selector:
+    app: django-db
+  type: NodePort
+

external_manifests/fail2ban/command.txt

@@ -0,0 +1 @@
+kubectl exec -it  -n reverse-proxy deploy/reverse-proxy -c reverse-proxy -- nginx -s reload

external_manifests/fail2ban/fail2ban-nginx-http-auth-jail.configmap.yaml

@@ -0,0 +1,23 @@
+apiVersion: v1
+data:
+  nginx-http-auth.local: |
+    ## Version 2022/08/06
+    # Fail2Ban jail configuration for nginx-http-auth
+
+    # To use more aggressive http-auth modes set filter parameter "mode" in jail.local:
+    # normal (default), aggressive (combines all), auth or fallback
+    # See "tests/files/logs/nginx-http-auth" or "filter.d/nginx-http-auth.conf" for usage example and details.
+
+    [nginx-http-auth]
+
+    enabled = false
+    port    = http,https
+    filter  = nginx-unauthorized
+    action = nginx-block-map
+    logpath = /var/log/nginx/backend_debug.log
+    maxretry = 5
+kind: ConfigMap
+metadata:
+  creationTimestamp: null
+  name: fail2ban-nginx-http-auth-jail
+  namespace: fail2ban

external_manifests/fail2ban/fail2ban-nginx-unauthorized-filter.configmap.yaml

@@ -0,0 +1,30 @@
+apiVersion: v1
+data:
+  nginx-unauthorized.local: |
+    ## Version 2022/08/06
+    # Fail2Ban filter configuration for nginx unauthorized
+
+    [INCLUDES]
+    before = common.conf
+
+    [Definition]
+
+    #original
+    #failregex = ^<HOST>.*"(GET|POST|HEAD).*" (401) .*$
+
+
+    #try this one
+    failregex = ^<HOST> - .* "(?:GET|POST|HEAD) [^"]+" 401
+                ^<HOST> - .* upstream_status=401
+                #for servarr
+                ^<HOST> -.*"GET /login\?returnUrl=/&loginFailed=true HTTP/.*" 200
+                ^<HOST> -.*"POST /login\?returnUrl=/&loginFailed=true HTTP/.*" 200
+                #for bitwarden
+                ^<HOST> -.*"POST /identity/accounts/prelogin *HTTP/.*" 200
+    #actionban = touch /tmp/<name>.ban
+    #actionunban = touch /tmp/<name>.unban
+kind: ConfigMap
+metadata:
+  creationTimestamp: null
+  name: fail2ban-nginx-unauthorized-filter
+  namespace: fail2ban

external_manifests/fail2ban/fail2ban.Role.yaml

@@ -0,0 +1,19 @@
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+  name: role:service-acc
+  namespace: reverse-proxy
+
+rules:         
+  - apiGroups: [""]
+    resources: 
+    - pods
+    - pods/exec
+    verbs: 
+    - create
+    - list
+  - apiGroups: ["apps"]
+    resources:
+    - deployments
+    verbs:
+    - get

external_manifests/fail2ban/fail2ban.RoleBinding.yaml

@@ -0,0 +1,15 @@
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+  name: rolebinding:service-acc
+  namespace: reverse-proxy
+
+roleRef:
+  apiGroup: rbac.authorization.k8s.io
+  kind: Role
+  name: role:service-acc
+subjects:
+  - kind: ServiceAccount
+    name: kubectl-service-account
+    namespace: fail2ban

external_manifests/fail2ban/fail2ban.ServiceAccount.yaml

@@ -0,0 +1,6 @@
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: kubectl-service-account
+  namespace: fail2ban

external_manifests/fail2ban/nginx-block-map-action.configmap.yaml

@@ -0,0 +1,58 @@
+apiVersion: v1
+data:
+  nginx-block-map.local: "## Version 2022/08/06\n# Fail2Ban configuration file for
+    black-listing via nginx\n#\n# Author: Serg G. Brester (aka sebres)\n#\n# To use
+    'nginx-block-map' action you should define some special blocks in your nginx configuration,\n#
+    and use it hereafter in your locations (to notify fail2ban by failure, resp. nginx
+    by ban).\n#\n# Example (argument \"token_id\" resp. cookie \"session_id\" used
+    here as unique identifier for user):\n#\n#   http {\n#     ...\n#     # maps to
+    check user is blacklisted (banned in f2b):\n#     #map $arg_token_id      $blck_lst_tok
+    { include blacklisted-tokens.map; }\n#     map  $cookie_session_id $blck_lst_ses
+    { include blacklisted-sessions.map; }\n#     ...\n#     # special log-format to
+    notify fail2ban about failures:\n#     log_format f2b_session_errors '$msec failure
+    \"$cookie_session_id\" - $remote_addr - $remote_user '\n#      ;#                  '\"$request\"
+    $status $bytes_sent '\n#       #                  '\"$http_referer\" \"$http_user_agent\"';\n#\n#
+    \    # location checking blacklisted values:\n#     location ... {\n#       #
+    check banned sessionid:\n#       if ($blck_lst_ses != \"\") {\n#         try_files
+    \"\" @f2b-banned;\n#       }\n#       ...\n#       # notify fail2ban about a failure
+    inside nginx:\n#       error_page 401 = @notify-f2b;\n#       ...\n#     }\n#
+    \    ...\n#     # location for return with \"403 Forbidden\" if banned:\n#     location
+    @f2b-banned {\n#       default_type text/html;\n#       return 403 \"<br/><center>\n#
+    \        <b style=\\\"color:red; font-size:18pt; border:2pt solid black; padding:5pt;\\\">\n#
+    \        You are banned!</b></center>\";\n#     }\n#     ...\n#     # location
+    to notify fail2ban about a failure inside nginx:\n#     location @notify-f2b {\n#
+    \      access_log /var/log/nginx/f2b-auth-errors.log f2b_session_errors;\n#     }\n#
+    \  }\n#   ...\n#\n# Note that quote-character (and possibly other special characters)
+    are not allowed currently as session-id.\n# Thus please add any session-id validation
+    rule in your locations (or in the corresponding backend-service), \n# like in
+    example below:\n#\n#   location ... {\n#     if ($cookie_session_id !~ \"^[\\w\\-]+$\")
+    {\n#       return  403 \"Wrong session-id\"\n#     }\n#     ...\n#   }\n#\n# The
+    parameters for jail corresponding log-format (f2b_session_errors):\n#\n#   [nginx-blck-lst]\n#
+    \  filter =\n#   datepattern = ^Epoch\n#   failregex = ^ failure \"<F-ID>[^\"]+</F-ID>\"
+    - <ADDR>\n#   usedns = no\n#\n# The same log-file can be used for IP-related jail
+    (additionally to session-related, to ban very bad IPs):\n#\n#   [nginx-blck-ip]\n#
+    \  maxretry = 100\n#   filter =\n#   datepattern = ^Epoch\n#   failregex = ^ failure
+    \"[^\"]+\" - <ADDR>\n#   usedns = no\n#\n\n[Definition]\n\n# path to configuration
+    of nginx (used to target nginx-instance in multi-instance system,\n# and as path
+    for the blacklisted map):\n#srv_cfg_path = /etc/nginx/\n\nsrv_cfg_path = /blacklisted.d/\n\n#
+    cmd-line arguments to supply to test/reload nginx:\n#srv_cmd = nginx -c %(srv_cfg_path)s/nginx.conf\nsrv_cmd
+    = nginx\n\n# pid file (used to check nginx is running):\nsrv_pid = /run/nginx.pid\n\n#
+    command used to check whether nginx is running and configuration is valid:\nsrv_is_running
+    = [ -f \"%(srv_pid)s\" ]\nsrv_check_cmd = %(srv_is_running)s && %(srv_cmd)s -qt\n\n#
+    first test nginx is running and configuration is correct, hereafter send reload
+    signal:\n#blck_lst_reload = %(srv_check_cmd)s; if [ $? -eq 0 ]; then\n#                    %(srv_cmd)s
+    -s reload; if [ $? -ne 0 ]; then echo 'reload failed.'; fi;\n#                  fi;\n\nrestart_file
+    = /restart-signal/restart.txt\n\nblck_lst_reload = touch %(restart_file)s;sleep
+    20; rm %(restart_file)s;\n\n# map-file for nginx, can be redefined using `action
+    = nginx-block-map[blck_lst_file=\"/path/file.map\"]`:\nblck_lst_file = %(srv_cfg_path)s/blacklisted-sessions.conf\n\n#
+    Action definition:\n\nactionstart_on_demand = false\nactionstart = touch '%(blck_lst_file)s'\n\nactionflush
+    = truncate -s 0 '%(blck_lst_file)s'; %(blck_lst_reload)s\n\nactionstop = %(actionflush)s\n\nactioncheck
+    = \n\n_echo_blck_row = printf '\\%%s 1;\\n' \"<fid>\"\n\nactionban = echo <ip>
+    | awk -F. '{print \"deny \"$1\".\"$2\".\"$3\".\"$4\";\"}' >> '%(blck_lst_file)s';
+    %(blck_lst_reload)s\n\nactionunban = id=$(%(_echo_blck_row)s | sed -e 's/[]\\/$*.^|[]/\\\\&/g');
+    sed -i \"/^$id$/d\" %(blck_lst_file)s; %(blck_lst_reload)s\n"
+kind: ConfigMap
+metadata:
+  creationTimestamp: null
+  name: nginx-block-map-action
+  namespace: fail2ban

external_manifests/fail2ban/nginx-block-map.local

@@ -0,0 +1,124 @@
+## Version 2022/08/06
+# Fail2Ban configuration file for black-listing via nginx
+#
+# Author: Serg G. Brester (aka sebres)
+#
+# To use 'nginx-block-map' action you should define some special blocks in your nginx configuration,
+# and use it hereafter in your locations (to notify fail2ban by failure, resp. nginx by ban).
+#
+# Example (argument "token_id" resp. cookie "session_id" used here as unique identifier for user):
+#
+#   http {
+#     ...
+#     # maps to check user is blacklisted (banned in f2b):
+#     #map $arg_token_id      $blck_lst_tok { include blacklisted-tokens.map; }
+#     map  $cookie_session_id $blck_lst_ses { include blacklisted-sessions.map; }
+#     ...
+#     # special log-format to notify fail2ban about failures:
+#     log_format f2b_session_errors '$msec failure "$cookie_session_id" - $remote_addr - $remote_user '
+#      ;#                  '"$request" $status $bytes_sent '
+#       #                  '"$http_referer" "$http_user_agent"';
+#
+#     # location checking blacklisted values:
+#     location ... {
+#       # check banned sessionid:
+#       if ($blck_lst_ses != "") {
+#         try_files "" @f2b-banned;
+#       }
+#       ...
+#       # notify fail2ban about a failure inside nginx:
+#       error_page 401 = @notify-f2b;
+#       ...
+#     }
+#     ...
+#     # location for return with "403 Forbidden" if banned:
+#     location @f2b-banned {
+#       default_type text/html;
+#       return 403 "<br/><center>
+#         <b style=\"color:red; font-size:18pt; border:2pt solid black; padding:5pt;\">
+#         You are banned!</b></center>";
+#     }
+#     ...
+#     # location to notify fail2ban about a failure inside nginx:
+#     location @notify-f2b {
+#       access_log /var/log/nginx/f2b-auth-errors.log f2b_session_errors;
+#     }
+#   }
+#   ...
+#
+# Note that quote-character (and possibly other special characters) are not allowed currently as session-id.
+# Thus please add any session-id validation rule in your locations (or in the corresponding backend-service), 
+# like in example below:
+#
+#   location ... {
+#     if ($cookie_session_id !~ "^[\w\-]+$") {
+#       return  403 "Wrong session-id"
+#     }
+#     ...
+#   }
+#
+# The parameters for jail corresponding log-format (f2b_session_errors):
+#
+#   [nginx-blck-lst]
+#   filter =
+#   datepattern = ^Epoch
+#   failregex = ^ failure "<F-ID>[^"]+</F-ID>" - <ADDR>
+#   usedns = no
+#
+# The same log-file can be used for IP-related jail (additionally to session-related, to ban very bad IPs):
+#
+#   [nginx-blck-ip]
+#   maxretry = 100
+#   filter =
+#   datepattern = ^Epoch
+#   failregex = ^ failure "[^"]+" - <ADDR>
+#   usedns = no
+#
+
+[Definition]
+
+# path to configuration of nginx (used to target nginx-instance in multi-instance system,
+# and as path for the blacklisted map):
+#srv_cfg_path = /etc/nginx/
+
+srv_cfg_path = /blacklisted.d/
+
+# cmd-line arguments to supply to test/reload nginx:
+#srv_cmd = nginx -c %(srv_cfg_path)s/nginx.conf
+srv_cmd = nginx
+
+# pid file (used to check nginx is running):
+srv_pid = /run/nginx.pid
+
+# command used to check whether nginx is running and configuration is valid:
+srv_is_running = [ -f "%(srv_pid)s" ]
+srv_check_cmd = %(srv_is_running)s && %(srv_cmd)s -qt
+
+# first test nginx is running and configuration is correct, hereafter send reload signal:
+#blck_lst_reload = %(srv_check_cmd)s; if [ $? -eq 0 ]; then
+#                    %(srv_cmd)s -s reload; if [ $? -ne 0 ]; then echo 'reload failed.'; fi;
+#                  fi;
+
+restart_file = /restart-signal/restart.txt
+
+blck_lst_reload = kubectl exec -it  -n reverse-proxy deploy/reverse-proxy -c reverse-proxy -- nginx -s reload
+
+# map-file for nginx, can be redefined using `action = nginx-block-map[blck_lst_file="/path/file.map"]`:
+blck_lst_file = %(srv_cfg_path)s/blacklisted-sessions.conf
+
+# Action definition:
+
+actionstart_on_demand = false
+actionstart = touch '%(blck_lst_file)s'
+
+actionflush = truncate -s 0 '%(blck_lst_file)s'; %(blck_lst_reload)s
+
+actionstop = %(actionflush)s
+
+actioncheck = 
+
+_echo_blck_row = printf '\%%s 1;\n' "<fid>"
+
+actionban = kubectl exec -it  -n reverse-proxy deploy/reverse-proxy -c reverse-proxy -- sh -c "echo 'deny <ip>;' > /etc/nginx/blacklisted.d/blacklisted-sessions.conf"; %(blck_lst_reload)s
+
+actionunban = id=$(%(_echo_blck_row)s | sed -e 's/[]\/$*.^|[]/\\&/g'); sed -i "/^$id$/d" %(blck_lst_file)s; %(blck_lst_reload)s

external_manifests/gluetun/gluetun-secret-netherland.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+data:
+  VPN_DNS_IP: MTAuMi4wLjE=
+  VPN_ENDPOINT_IP: MjEyLjguMjUzLjEzNw==
+  VPN_ENDPOINT_PORT: NTE4MjA=
+  WIREGUARD_PRIVATE_KEY: Y0grY0hLd3FMeXV3UlVlZy8wRjFYWVlDQVM4bkQwWGsxNmVOQlVLc2tYbz0=
+  WIREGUARD_PUBLIC_KEY: VVJwZVp4dHlVWEFVVUEwTVdjRmRDU2E3RitNdmNoSjRlTlNKVWV0S0VHaz0=
+kind: Secret
+metadata:
+  creationTimestamp: null
+  name: gluetun-secret-netherland
+  namespace: gluetun

external_manifests/immich/immich-db.secret.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+data:
+  DB_DATABASE_NAME: aW1taWNo
+  DB_HOST: aW1taWNoLWRiLXN2Yw==
+  DB_PASSWORD: U3Bvb24tQm9yb3VnaC1CYXNpczg=
+  DB_USERNAME: aW1taWNo
+kind: Secret
+metadata:
+  name: immich-db-credentials
+  namespace: immich

external_manifests/paperless/Paperless.secret.yaml

@@ -5,9 +5,9 @@ data:
   POSTGRES_PASSWORD: cGFwZXJsZXNz
   PAPERLESS_ADMIN_USER: YWRtaW4=
   PAPERLESS_ADMIN_PASSWORD: YWRtaW4=
-  POSTGRES_HOST: cGFwZXItZGItc3Zj
+  POSTGRES_HOST: cGFwZXJsZXNzLWRiLXN2Yw==
 kind: Secret
 metadata:
   name: paperless-credentials
-  namespace: paper
+  namespace: paperless
 type: Opaque

external_manifests/paperless/emailproxy.config

@@ -0,0 +1,5 @@
+[IMAP-1993]
+documentation = *** note: this server will work for both Office 365 and personal Outlook/Hotmail accounts ***
+server_address = outlook.office365.com
+server_port = 993
+local_address = 127.0.0.1

external_manifests/paperless/emailproxyconfig.configmap.yml

@@ -0,0 +1,13 @@
+apiVersion: v1
+data:
+  emailproxy.config: |
+    [IMAP-1993]
+    documentation = *** note: this server will work for both Office 365 and personal Outlook/Hotmail accounts ***
+    server_address = outlook.office365.com
+    server_port = 993
+    local_address = 127.0.0.1
+kind: ConfigMap
+metadata:
+  creationTimestamp: null
+  name: emailproxyconfig
+  namespace: paperless

external_manifests/paperless/paperless_backup_db.cronjob.yaml

@@ -0,0 +1,45 @@
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: paperless-calendar-backup
+  namespace: paperless
+spec:
+  schedule: "0 0 * * *"
+  jobTemplate:
+    spec:
+      backoffLimit: 4
+      ttlSecondsAfterFinished: 100
+      template:
+        spec:
+          containers:
+          - name: paperless-database-backup
+            image: alpine/psql
+            envFrom:
+            - secretRef:
+                name: paperless-db-terraform
+                optional: false
+            command: ["/bin/sh","-c"]
+            args: ["pg_dump |gzip -9 > /backup/$(DB_DATABASE_NAME)-DB-$(date +%Y%m%d).sql.gz "]
+            volumeMounts:
+            - name: backup
+              mountPath: /backup
+          volumes:
+          - name: backup
+            persistentVolumeClaim:
+              claimName: paperless-database-backup
+          restartPolicy: Never
+---
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: paperless-database-backup
+  namespace: paperless
+  annotations:
+    fileType: Backup
+spec:
+  storageClassName: nfs-storage-fastaccess
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 2Gi

external_manifests/servarr/Bookstack.secret.yaml

@@ -0,0 +1,16 @@
+apiVersion: v1
+data:
+  DB_DATABASE: Ym9va3N0YWNrYXBw
+#  DB_HOST: ZGIuYm9va3N0YWNrLnN2Yw==
+  DB_HOST: Ym9va3N0YWNrLWRiLXN2Yw==
+  DB_PASS: VW5oYXBweS1Db21tZW5jZS1FdmVyeW9uZTQ=
+  DB_USER: Ym9va3N0YWNrX3VzZXJuYW1l
+  APP_KEY: "N3dvdmU3ZDQwbjlyNm90YW43ZGEyODQ5am10ajlqNHU="
+kind: Secret
+metadata:
+#  creationTimestamp: "2024-06-13T07:37:49Z"
+  name: bookstack-credentials
+  namespace: bookstack
+#  resourceVersion: "20756717"
+#  uid: 66d4cc7d-741a-49cc-979d-a8b95ffb983a
+type: Opaque

external_manifests/servarr/prowlarr-db.svc.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: database
+  namespace: servarr
+  annotations:
+spec:
+  ipFamilyPolicy: PreferDualStack
+  ports:
+    - name: tcp
+      port: 5432
+      targetPort: 5432
+      protocol: TCP
+
+  type: LoadBalancer
+  selector:
+    app: prowlarr-db

external_manifests/servarr/prowlarr.secret.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+data:
+  DB_DATABASE: cHJvd2xhcnItbWFpbg==
+  DB_HOST: cHJvd2xhcnItZGItc3Zj
+  DB_PASS: R29saWF0aC1EZWVwZW4tRGl2aWRpbmc3
+  DB_USER: cHJvd2xhcnJfdXNlcm5hbWU=
+kind: Secret
+metadata:
+  name: prowlarr-credentials
+  namespace: bookstack

external_manifests/servarr/servarr-db.secret.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+data:
+  DB_DATABASE: cHJvd2xhcnItbWFpbg==
+  DB_HOST: cHJvd2xhcnItZGItc3Zj
+  DB_PASS: R29saWF0aC1EZWVwZW4tRGl2aWRpbmc3
+  DB_USER: c2VydmFycl91c2VybmFtZQ==
+kind: Secret
+metadata:
+  name: servarr-db-credentials
+  namespace: servarr

external_manifests/stash/download.sh

@@ -0,0 +1,78 @@
+#!/bin/bash
+
+#install required packages
+apk add curl wget
+
+#named argument generation
+skip_searching_gallery="${skip_searching_gallery:-false}"
+
+
+while [ $# -gt 0 ]; do
+    if [[ $1 == "--"* ]]; then
+        v="${1/--/}"
+        declare "$v"="$2"
+        shift
+    fi
+    shift
+done
+
+#check if we will use a HTTP proxy or not
+
+if [[ -z $http_proxy ]]; then
+        echo "not using proxy"
+        curl_command="curl"
+else
+        echo "using proxy"
+        curl_command="curl -x $http_proxy"
+
+fi
+
+
+#dowload from https://www.pornpics.com/pornstars/eiby-shine/
+DESTINATION_FOLDER="/data"
+PROXY_HTTP="http://gluetun-svc.gluetun.svc:8888"
+
+#BASE_URL="https://www.pornpics.com/pornstars/eiby-shine/"
+#pornstars="eiby-shine"
+
+#BASE_URL="https://www.pornpics.com/pornstars/chloe-camilla/"
+#pornstars="chloe-camilla"
+
+#BASE_URL="https://www.pornpics.com/pornstars/becky-summer"
+#pornstars="becky-summer"
+
+
+#clear files beforehand
+
+echo "Pornstar: "$pornstars
+echo "URL: "$BASE_URL
+
+
+mkdir -p $DESTINATION_FOLDER/$pornstars
+
+if [[ $skip_searching_gallery == true ]]; then
+        echo "not looping through galleries"
+		echo "using existing file instead"
+		#because we need to keep the file $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt with the existing URL , in this condition, 
+		#no deletion of this file
+else
+        echo "looping through galleries"
+		#because we will re-generate this file, can be emptied
+		echo "" > $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt
+        $curl_command -s $BASE_URL |  grep -Eo "(http|https)://[a-zA-Z0-9./?=_%:-]*" | grep "https://www.pornpics.com/galleries/" |sort -u >> $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt
+fi
+
+echo "" > $DESTINATION_FOLDER/$pornstars-image_to_download.txt
+
+
+for f in $(cat $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt ); do
+	$curl_command $f | grep -Eo "(http|https)://[a-zA-Z0-9./?=_%:-]*" | grep "https://cdni.pornpics.com/" >> $DESTINATION_FOLDER/$pornstars-image_to_download.txt
+	echo $f
+done
+
+
+for g in $(cat $DESTINATION_FOLDER/$pornstars-image_to_download.txt ); do 
+	$curl_command -O --output-dir $DESTINATION_FOLDER/$pornstars $g
+#        wget -e use_proxy=yes -e http_proxy=$PROXY_HTTP $g -P $DESTINATION_FOLDER/$pornstars
+        echo $g 
+done

external_manifests/stash/download.sh_curl_error_20250808.sh

@@ -0,0 +1,85 @@
+#!/bin/bash
+
+#install required packages
+apk add curl wget
+
+#named argument generation
+skip_searching_gallery="${skip_searching_gallery:-false}"
+
+
+while [ $# -gt 0 ]; do
+    if [[ $1 == "--"* ]]; then
+        v="${1/--/}"
+        declare "$v"="$2"
+        shift
+    fi
+    shift
+done
+
+#check if we will use a HTTP proxy or not
+
+if [[ -z $http_proxy ]]; then
+        echo "not using proxy"
+        curl_command="curl"
+else
+        echo "using proxy"
+        echo $http_proxy
+        curl_command="curl -x $http_proxy"
+
+fi
+
+
+#dowload from https://www.pornpics.com/pornstars/eiby-shine/
+DESTINATION_FOLDER="/data"
+PROXY_HTTP="http://gluetun-svc.gluetun.svc:8888"
+
+#BASE_URL="https://www.pornpics.com/pornstars/eiby-shine/"
+#pornstars="eiby-shine"
+
+#BASE_URL="https://www.pornpics.com/?q=shy+imp"
+#pornstars="shy-imp"
+
+#BASE_URL="https://www.pornpics.com/pornstars/gloria-sol/"
+#pornstars="gloria-sol"
+
+
+#BASE_URL="https://www.pornpics.com/pornstars/becky-summer"
+#pornstars="becky-summer"
+
+
+#clear files beforehand
+
+echo "Pornstar: "$pornstars
+echo "URL: "$BASE_URL
+
+mkdir -p $DESTINATION_FOLDER/$pornstars
+
+if [[ $skip_searching_gallery == true ]]; then
+        echo "not looping through galleries"
+		echo "using existing file instead"
+		#because we need to keep the file $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt with the existing URL , in this condition, 
+		#no deletion of this file
+else
+        echo "looping through galleries"
+		#because we will re-generate this file, can be emptied
+		echo "" > $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt
+        $curl_command -s $BASE_URL |  grep -Eo "(http|https)://[a-zA-Z0-9./?=_%:-]*" | grep "https://www.pornpics.com/galleries/" |sort -u >> $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt
+fi
+
+echo "" > $DESTINATION_FOLDER/$pornstars-image_to_download.txt
+
+
+for f in $(cat $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt ); do
+        echo "$curl_command $f"
+        $curl_command "$f" 
+	$curl_command "$f" | grep -Eo "(http|https)://[a-zA-Z0-9./?=_%:-]*" | grep "https://cdni.pornpics.com/1280" >> $DESTINATION_FOLDER/$pornstars-image_to_download.txt
+	echo $f
+done
+
+
+for g in $(cat $DESTINATION_FOLDER/$pornstars-image_to_download.txt ); do 
+	$curl_command -O --output-dir $DESTINATION_FOLDER/$pornstars "$g"
+#        wget -e use_proxy=yes -e http_proxy=$PROXY_HTTP $g -P $DESTINATION_FOLDER/$pornstars
+        echo $g 
+done
+exit 0

external_manifests/stash/gluetun-secret-netherland.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+data:
+  VPN_DNS_IP: MTAuMi4wLjE=
+  VPN_ENDPOINT_IP: MjEyLjguMjUzLjEzNw==
+  VPN_ENDPOINT_PORT: NTE4MjA=
+  WIREGUARD_PRIVATE_KEY: Y0grY0hLd3FMeXV3UlVlZy8wRjFYWVlDQVM4bkQwWGsxNmVOQlVLc2tYbz0=
+  WIREGUARD_PUBLIC_KEY: VVJwZVp4dHlVWEFVVUEwTVdjRmRDU2E3RitNdmNoSjRlTlNKVWV0S0VHaz0=
+kind: Secret
+metadata:
+  creationTimestamp: null
+  name: gluetun-secret-netherland
+  namespace: stash

external_manifests/stash/stash-pornpics-dowloader.configmap.yml

@@ -0,0 +1,31 @@
+apiVersion: v1
+data:
+  download.sh: "#!/bin/bash\n\n#install required packages\napk add curl wget\n\n#named
+    argument generation\nskip_searching_gallery=\"${skip_searching_gallery:-false}\"\n\n\nwhile
+    [ $# -gt 0 ]; do\n    if [[ $1 == \"--\"* ]]; then\n        v=\"${1/--/}\"\n        declare
+    \"$v\"=\"$2\"\n        shift\n    fi\n    shift\ndone\n\n#check if we will use
+    a HTTP proxy or not\n\nif [[ -z $http_proxy ]]; then\n        echo \"not using
+    proxy\"\n        curl_command=\"curl\"\nelse\n        echo \"using proxy\"\n        curl_command=\"curl
+    -x $http_proxy\"\n\nfi\n\n\n#dowload from https://www.pornpics.com/pornstars/eiby-shine/\nDESTINATION_FOLDER=\"/data\"\nPROXY_HTTP=\"http://gluetun-svc.gluetun.svc:8888\"\n\n#BASE_URL=\"https://www.pornpics.com/pornstars/eiby-shine/\"\n#pornstars=\"eiby-shine\"\n\n#BASE_URL=\"https://www.pornpics.com/pornstars/chloe-camilla/\"\n#pornstars=\"chloe-camilla\"\n\n#BASE_URL=\"https://www.pornpics.com/pornstars/becky-summer\"\n#pornstars=\"becky-summer\"\n\n\n#clear
+    files beforehand\n\necho \"Pornstar: \"$pornstars\necho \"URL: \"$BASE_URL\n\n\nmkdir
+    -p $DESTINATION_FOLDER/$pornstars\n\nif [[ $skip_searching_gallery == true ]];
+    then\n        echo \"not looping through galleries\"\n\t\techo \"using existing
+    file instead\"\n\t\t#because we need to keep the file $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt
+    with the existing URL , in this condition, \n\t\t#no deletion of this file\nelse\n
+    \       echo \"looping through galleries\"\n\t\t#because we will re-generate this
+    file, can be emptied\n\t\techo \"\" > $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt\n
+    \       $curl_command -s $BASE_URL |  grep -Eo \"(http|https)://[a-zA-Z0-9./?=_%:-]*\"
+    | grep \"https://www.pornpics.com/galleries/\" |sort -u >> $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt\nfi\n\necho
+    \"\" > $DESTINATION_FOLDER/$pornstars-image_to_download.txt\n\n\nfor f in $(cat
+    $DESTINATION_FOLDER/$pornstars-urls_of_galleries.txt ); do\n\t$curl_command $f
+    | grep -Eo \"(http|https)://[a-zA-Z0-9./?=_%:-]*\" | grep \"https://cdni.pornpics.com/\"
+    >> $DESTINATION_FOLDER/$pornstars-image_to_download.txt\n\techo $f\ndone\n\n\nfor
+    g in $(cat $DESTINATION_FOLDER/$pornstars-image_to_download.txt ); do \n\t$curl_command
+    -O --output-dir $DESTINATION_FOLDER/$pornstars $g\n#        wget -e use_proxy=yes
+    -e http_proxy=$PROXY_HTTP $g -P $DESTINATION_FOLDER/$pornstars\n        echo $g
+    \ndone\n"
+kind: ConfigMap
+metadata:
+  creationTimestamp: null
+  name: pornpic-dowloader
+  namespace: stash

external_manifests/stash/stash-pornpics-dowloader.job.yml

@@ -0,0 +1,41 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: stash-pornpics-dowloader
+  namespace: stash
+spec:
+  template:
+    spec:
+      containers:
+      - name: stash-pornpics-dowloader
+        image: bash
+        imagePullPolicy: Always
+        volumeMounts:
+        - mountPath: /config
+          name: scripts
+        - mountPath: /data
+          mountPropagation: None
+          name: data-pvc
+        command:
+          - bash
+          - -c
+          - sleep 3600
+#          - bash
+          - /config/download.sh 
+          - --http_proxy 
+          - "http://gluetun-svc.gluetun.svc:8888"
+          - --BASE_URL 
+          - "https://www.pornpics.com/?q=bretona"
+          - --pornstars
+          - "bretona"
+      restartPolicy: Never
+      volumes:
+      - configMap:
+          defaultMode: 0744
+          name: pornpic-dowloader
+        name: scripts
+      - name: data-pvc
+        persistentVolumeClaim:
+          claimName: data-pvc
+  backoffLimit: 4
+

external_manifests/stash/test_named_arguments.sh

@@ -0,0 +1,36 @@
+#!/bin/sh
+
+skip_searching_gallery="${skip_searching_gallery:-false}"
+
+#echo "$skip_searching_gallery"
+
+
+while [ $# -gt 0 ]; do
+    if [[ $1 == "--"* ]]; then
+        v="${1/--/}"
+        #declare "$v"="$2"
+        "$v"="$2"
+
+        shift
+    fi
+    shift
+done
+
+#echo "$skip_searching_gallery"
+#if [[ -z $skip_searching_gallery ]]; then
+if [[ $skip_searching_gallery == true ]]; then
+	echo "not looping through galleries"
+else
+        echo "looping through galleries"
+fi
+
+if [[ -z $http_proxy ]]; then
+        echo "not using proxy"
+	curl_command="curl"
+else
+        echo "using proxy"
+        curl_command="curl -x $http_proxy"
+
+fi
+echo $curl_command
+$curl_command https://cdni.pornpics.com/460/7/424/83105958/83105958_010_388f.jpg -O 

external_manifests/tdarr/tdarr.svc.yaml

@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: tdarr-svc-ext
+  namespace: servarr
+spec:
+  ports:
+  - name: tdarr
+    nodePort: 30266
+    port: 8266
+    protocol: TCP
+    targetPort: 8266
+  selector:
+    app: tdarr
+  type: NodePort

external_manifests/wikijs/wikijs-db.secret.yaml

@@ -0,0 +1,10 @@
+apiVersion: v1
+data:
+  DB_DATABASE: d2lraQ==
+  DB_HOST: d2lraWpzLWRiLXN2Yw==
+  DB_PASS: VmVzdDctUHJvZHVjdC1VbnN0ZWFkeQ==
+  DB_USER: d2lraWpzX3VzZXJuYW1l
+kind: Secret
+metadata:
+  name: wikijs-db-credentials
+  namespace: wikijs

module.tf

@@ -1,5 +1,12 @@
 terraform {
   required_version = "> 0.8.0"
+  required_providers {
+    bitwarden-secrets = {
+      source  = "bitwarden/bitwarden-secrets"
+      version = "0.5.4-pre"
+    }
+  }
+
 }
 
 provider "kubernetes" {
@@ -7,6 +14,13 @@ provider "kubernetes" {
 }
 
 
+provider "bitwarden-secrets" {
+  api_url         = "https://bitwarden.tryton.geeraert.eu/api"
+  identity_url    = "https://bitwarden.tryton.geeraert.eu/identity"
+  access_token    = "0.9f4b7c5f-e6e7-4eff-929e-b474016a2b9c.bMRELajGGb7qMuXXvzgCCJdDfxfTCS:mFDT7tHSi43KJSnkwvTSYg=="
+  organization_id = "a6361589-badd-4bde-9cb4-af8901161c0d"
+}
+
 variable "kubernetes" {
   type = map(object({
     name  = optional(string)
@@ -15,10 +29,14 @@ variable "kubernetes" {
       name                 = string
       pvc                  = optional(bool, false)
       config_map           = optional(bool, false)
+      secret               = optional(bool, false)
       host_path            = optional(string)
       pvc_size             = optional(string)
       storage_class_name   = optional(string, "nfs-storage-intelligent")
+      annotations_fileType = optional(string)
+      existing_pvc         = optional(bool, false)
       mount_path           = string
+      sub_path             = optional(string)
     })))
     environment = optional(map(object({
       name  = optional(string)
@@ -33,19 +51,23 @@ variable "kubernetes" {
     replicas               = optional(number, 1)
     namespace              = optional(string)
     connected_namespace    = optional(string, "")
-    #    namespace           = optional(string,coalesce(connected_namespace,""))
+    command                = optional(list(string))
-    #block_namespace_creation = optional(bool, false)
     service_port           = optional(list(number))
     service_type           = optional(string, "ClusterIP")
     service_name           = optional(string)
+    domain_name            = optional(string)
     liveness_tcp_socket    = optional(number)
     liveness_http_get      = optional(string)
     liveness_http_get_path = optional(string)
     database               = optional(map(string))
+    database_command       = optional(list(string))
+    database_args          = optional(list(string))
     redis                  = optional(map(string))
     enabled                = optional(bool, true)
     secret_ref             = optional(list(string))
     config_map_ref         = optional(list(string))
+    config_map_import      = optional(list(string))
+    secret_import          = optional(list(string))
     extra_manifest         = optional(list(string))
     requirements           = optional(map(string))
     #    requirements = optional(map(string), {
@@ -55,25 +77,66 @@ variable "kubernetes" {
     #      requests-memory = "200Mi"
     #    })
     dns_nameservers       = optional(string)
+    service_account_name  = optional(string)
     environment_variables = optional(map(string), { name = "value" })
     security_context      = optional(bool, false)
   }))
 
 }
 
+variable "database_backup_info" {
+  type = map(object({
+    image   = optional(string)
+    command = optional(string)
+  }))
+  description = "based on DB engine, give the docker image and the command used to backup"
+  default = {
+    postgres = {
+      image   = "alpine/psql"
+      command = "pg_dump |gzip -9 > /backup/$(DB_DATABASE_NAME)-DB-$(date +%Y%m%d).sql.gz"
+    }
+    mysql = {
+      image   = "mysql"
+      command = "mysqldump -h $DB_HOST -u $MYSQL_USER -p$MYSQL_ROOT_PASSWORD $MYSQL_DATABASE |gzip -9 > /backup/$(DB_DATABASE_NAME)-DB-$(date +%Y%m%d).sql.gz"
+    }
+    sqlserver = {
+      image   = "mcr.microsoft.com/mssql-tools"
+      command = "/opt/mssql-tools/bin/sqlcmd -S $DB_HOST -U $DB_USERNAME -P $DB_PASSWORD -Q \"BACKUP DATABASE $DB_DATABASE_NAME TO DISK = '/backup/$DB_DATABASE_NAME-$(date +%Y%m%d).bak' WITH  COPY_ONLY, CHECKSUM,FORMAT, MEDIANAME = 'SQLServerBackups',NAME = 'Full Backup of SQLTestDB'\";exit"
+    }
+  }
+}
+
 locals {
-  pvc_details = flatten([
+  pvc_list = flatten([
     for key, value in var.kubernetes : [
       for index, pvc in value.pvc : {
+        key                  = "${coalesce(value.namespace, value.connected_namespace, key)}/${pvc.name}"
         index                = index
         pvc                  = pvc.pvc
         name                 = pvc.name
         pvc_size             = pvc.pvc_size
         mount_path           = pvc.mount_path
         storage_class_name   = pvc.storage_class_name
+        annotations_fileType = pvc.annotations_fileType
+        existing_pvc         = pvc.existing_pvc
+        sub_path             = pvc.sub_path
         namespace            = coalesce(value.namespace, value.connected_namespace, key)
     }] if value.enabled == true && value.pvc != null
   ])
+
+  # group duplicates instead of throwing an error
+  pvc_map_grouped = {
+    for p in local.pvc_list :
+    p.key => p...
+  }
+
+  # keep only one PVC per key (take the first)
+  pvc_map = {
+    for k, list in local.pvc_map_grouped :
+    k => list[0]
+  }
+
+  pvc_details = values(local.pvc_map)
 }
 
 locals {
@@ -89,7 +152,7 @@ locals {
 
 data "kubernetes_all_namespaces" "allns" {}
 
-resource "kubernetes_namespace" "automatic" {
+resource "kubernetes_namespace_v1" "automatic" {
   for_each = { for key, value in var.kubernetes : key => value if value.enabled == true && value.connected_namespace == "" }
   metadata {
     annotations = {
@@ -118,7 +181,7 @@ locals {
   ])
 }
 
-resource "kubernetes_manifest" "service" {
+resource "kubernetes_manifest" "manifest" {
   for_each = { for item in local.kubernetes_manifests : item.key => item }
 
   manifest = yamldecode(file(each.value.manifest))
@@ -127,15 +190,20 @@ resource "kubernetes_manifest" "service" {
 
 
 
-resource "kubernetes_persistent_volume_claim" "automatic-pvc" {
+resource "kubernetes_persistent_volume_claim_v1" "automatic-pvc" {
-  for_each = { for key, value in local.pvc_details : "${value.index}" => merge(value, { mew_key = value.index }) if value.pvc }
+  for_each = { for key, value in local.pvc_details : "${value.index}" => merge(value, { mew_key = value.index }) if value.pvc && value.existing_pvc != true }
   metadata {
     namespace = coalesce(each.value.namespace, each.key)
     name      = "${each.value.name}-pvc"
     labels = {
       deployment_method = "Terraform"
     }
+    annotations = {
+      fileType = try(each.value.annotations_fileType, "file")
     }
+
+  }
+
   spec {
     access_modes       = ["ReadWriteMany"]
     storage_class_name = each.value.storage_class_name
@@ -146,8 +214,8 @@ resource "kubernetes_persistent_volume_claim" "automatic-pvc" {
     }
   }
 }
-resource "kubernetes_persistent_volume_claim" "automatic-pvc-database" {
+resource "kubernetes_persistent_volume_claim_v1" "automatic-pvc-database" {
-  for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
+  for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && !(try(value.database.shunt, false)) }
   metadata {
     namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
     name      = "${each.key}-db-pvc"
@@ -166,7 +234,29 @@ resource "kubernetes_persistent_volume_claim" "automatic-pvc-database" {
   }
 }
 
-resource "kubernetes_persistent_volume_claim" "automatic-pvc-redis" {
+resource "kubernetes_persistent_volume_claim_v1" "backup-pvc-database" {
+  for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
+  metadata {
+    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
+    name      = "${each.key}-db-backup"
+    labels = {
+      deployment_method = "Terraform"
+    }
+    annotations = {
+    fileType = "Backup" }
+  }
+  spec {
+    access_modes       = ["ReadWriteMany"]
+    storage_class_name = "nfs-storage-fastaccess"
+    resources {
+      requests = {
+        storage = "1Gi"
+      }
+    }
+  }
+}
+
+resource "kubernetes_persistent_volume_claim_v1" "automatic-pvc-redis" {
   for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
   metadata {
     namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
@@ -186,7 +276,7 @@ resource "kubernetes_persistent_volume_claim" "automatic-pvc-redis" {
   }
 }
 
-resource "kubernetes_service" "automatic_service" {
+resource "kubernetes_service_v1" "automatic_service" {
   for_each = { for key, value in var.kubernetes : key => value if value.service_port != null && value.enabled == true }
   metadata {
     name      = "${each.key}-svc"
@@ -210,6 +300,7 @@ resource "kubernetes_service" "automatic_service" {
       content {
         port        = port.value
         target_port = port.value
+        name        = replace("${port.value}${each.key}", "/(.{0,15})(.*)/", "$1")
 
       }
     }
@@ -226,13 +317,14 @@ resource "kubernetes_service" "automatic_service" {
 
 }
 
-resource "kubernetes_service" "automatic_service_database" {
+resource "kubernetes_service_v1" "automatic_service_database" {
-  for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
+  for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && !(try(value.database.shunt, false)) }
   metadata {
     name      = "${each.key}-db-svc"
     namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
     labels = {
       deployment_method = "Terraform"
+      #username          = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_password[each.key].key}"
     }
   }
   spec {
@@ -251,7 +343,7 @@ resource "kubernetes_service" "automatic_service_database" {
 
 
 
-resource "kubernetes_service" "automatic_service_redis" {
+resource "kubernetes_service_v1" "automatic_service_redis" {
   for_each = { for key, value in var.kubernetes : key => value if value.redis != null && value.enabled == true }
   metadata {
     name      = "${each.key}-redis-svc"
@@ -310,7 +402,8 @@ resource "kubernetes_deployment_v1" "automatic" {
             for_each = each.value.service_port != null ? each.value.service_port : []
             content {
               container_port = port.value
-              name           = "${each.key}-${port.value}"
+              #              name           = "${each.key}-${port.value}"
+              name = replace("${port.value}${each.key}", "/(.{0,15})(.*)/", "$1")
             }
           }
 
@@ -320,12 +413,44 @@ resource "kubernetes_deployment_v1" "automatic" {
             content {
               mount_path = volume_mount.value.mount_path
               name       = "${volume_mount.value.name}-pvc"
+              sub_path   = volume_mount.value.sub_path != null ? volume_mount.value.sub_path : ""
             }
           }
 
+          dynamic "volume_mount" {
+            for_each = try(each.value.database.engine == "sqlserver", false) && try(each.value.database.shunt, false) ? [1] : []
+            content {
+              mount_path = "/backup"
+              name       = "${each.key}-db-backup"
+            }
+          }
 
           dynamic "env_from" {
             for_each = each.value.secret_ref != null ? each.value.secret_ref : []
+            content {
+              dynamic "secret_ref" {
+                for_each = [1]
+                content {
+                  name = env_from.value
+                }
+              }
+
+            }
+          }
+          dynamic "env_from" {
+            for_each = each.value.database != null && each.value.enabled == true && !(try(each.value.database.shunt, false)) ? ["${each.key}-db-terraform"] : []
+            #for_each = each.value.database != null && each.value.enabled == true  ? ["${each.key}-db-terraform"] : []
+            content {
+              dynamic "secret_ref" {
+                for_each = [1]
+                content {
+                  name = env_from.value
+                }
+              }
+            }
+          }
+          dynamic "env_from" {
+            for_each = each.value.database != null && each.value.enabled == true ? ["${each.key}-db-mapped-terraform"] : []
             content {
               dynamic "secret_ref" {
                 for_each = [1]
@@ -347,6 +472,8 @@ resource "kubernetes_deployment_v1" "automatic" {
             }
           }
 
+          command = each.value.command != null ? each.value.command : []
+
 
           dynamic "env" {
             for_each = each.value.environment != null ? each.value.environment : {}
@@ -361,7 +488,6 @@ resource "kubernetes_deployment_v1" "automatic" {
                     content {
                       name = env.value.value_from.secret_key_ref.name
                       key  = env.value.value_from.secret_key_ref.key
-                      #                      optional = true
                     }
                   }
                 }
@@ -384,16 +510,6 @@ resource "kubernetes_deployment_v1" "automatic" {
             }
           }
 
-          #          resources {
-          #            limits = {
-          #              cpu    = each.value.requirements.limits-cpu
-          #              memory = each.value.requirements.limits-memory
-          #            }
-          #            requests = {
-          #              cpu    = each.value.requirements.requests-cpu
-          #              memory = each.value.requirements.requests-memory
-          #            }
-          #          }
 
           dynamic "security_context" {
             for_each = each.value.security_context == true ? [1] : []
@@ -434,6 +550,7 @@ resource "kubernetes_deployment_v1" "automatic" {
           }
 
         }
+        service_account_name = each.value.service_account_name != null ? each.value.service_account_name : null
 
         dynamic "volume" {
           for_each = each.value.pvc != null ? each.value.pvc : {}
@@ -461,19 +578,36 @@ resource "kubernetes_deployment_v1" "automatic" {
               }
             }
 
+            dynamic "secret" {
+              for_each = volume.value.secret ? [1] : []
+              content {
+                secret_name = volume.value.name
+              }
+            }
 
           }
         }
+        dynamic "volume" {
+          for_each = try(each.value.database.engine == "sqlserver", false) && try(each.value.database.shunt, false) ? [1] : []
+          content {
+            name = "${each.key}-db-backup"
+
+            persistent_volume_claim {
+              claim_name = "${each.key}-db-backup"
+            }
+          }
+        }
 
       }
     }
   }
+  depends_on = [kubernetes_persistent_volume_claim_v1.automatic-pvc]
 }
 
 
 
 resource "kubernetes_deployment_v1" "database-automatic" {
-  for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
+  for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true && !(try(value.database.shunt, false)) }
 
 
   metadata {
@@ -516,13 +650,32 @@ resource "kubernetes_deployment_v1" "database-automatic" {
           }
 
           volume_mount {
-            mount_path = try(each.value.database.mountPath, "/var/lib/postgresql/data")
+            mount_path = try(each.value.database.mountPath, "/var/lib/postgresql/")
             name       = "${each.key}-db-pvc"
           }
 
+          dynamic "volume_mount" {
+            for_each = try(each.value.database.engine == "sqlserver", false) && !(try(each.value.database.shunt, false)) ? [1] : []
+            content {
+              mount_path = "/backup"
+              name       = "${each.key}-db-backup"
+            }
+          }
 
+          command = try([each.value.database.command], [])
+          args    = each.value.database_args != null ? each.value.database_args : []
 
-
+          dynamic "env_from" {
+            for_each = each.value.database != null && each.value.enabled == true && !(try(each.value.database.shunt, false)) ? ["${each.key}-db-terraform"] : []
+            content {
+              dynamic "secret_ref" {
+                for_each = [1]
+                content {
+                  name = env_from.value
+                }
+              }
+            }
+          }
 
           dynamic "env" {
             for_each = each.value.environment != null ? each.value.environment : {}
@@ -547,40 +700,6 @@ resource "kubernetes_deployment_v1" "database-automatic" {
           }
 
 
-          #          resources {
-          #            limits = {
-          #              cpu    = each.value.requirements.limits-cpu
-          #              memory = each.value.requirements.limits-memory
-          #            }
-          #            requests = {
-          #              cpu    = each.value.requirements.requests-cpu
-          #              memory = each.value.requirements.requests-memory
-          #            }
-          #          }
-
-          #          dynamic "liveness_probe" {
-          #            for_each = each.value.liveness_tcp_socket != null || each.value.liveness_http_get != null ? [""] : []
-          #           content {
-          #              dynamic "tcp_socket" {
-          #                for_each = each.value.liveness_tcp_socket != null ? [""] : []
-          #                content {
-          #                  port = each.value.liveness_tcp_socket
-          #                }
-          #              }
-
-
-          #              dynamic "http_get" {
-          #                for_each = each.value.liveness_http_get != null ? [""] : []
-          #                content {
-          #                  port = each.value.liveness_http_get
-          #                  path = coalesce(each.value.liveness_http_get_path, "/")
-          #                }
-          #              }
-
-          #              initial_delay_seconds = 3
-          #              period_seconds        = 3
-          #            }
-          #          }
         }
 
 
@@ -591,6 +710,70 @@ resource "kubernetes_deployment_v1" "database-automatic" {
           }
         }
 
+        dynamic "volume" {
+          for_each = try(each.value.database.engine == "sqlserver", false) && !(try(each.value.database.shunt, false)) ? [1] : []
+          content {
+            name = "${each.key}-db-backup"
+
+            persistent_volume_claim {
+              claim_name = "${each.key}-db-backup"
+            }
+          }
+        }
+
+      }
+    }
+  }
+}
+
+
+resource "kubernetes_cron_job_v1" "database-backup" {
+  for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
+  metadata {
+    name      = "${coalesce(each.value.namespace, each.key)}-db-backup"
+    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
+    labels = {
+      app               = each.key
+      deployment_method = "Terraform"
+      database          = "true"
+    }
+  }
+  spec {
+    failed_jobs_history_limit     = 5
+    schedule                      = "1 0 * * *"
+    timezone                      = "Etc/UTC"
+    successful_jobs_history_limit = 5
+    job_template {
+      metadata {}
+      spec {
+        backoff_limit              = 4
+        ttl_seconds_after_finished = 100
+        template {
+          metadata {}
+          spec {
+            container {
+              name    = "${coalesce(each.value.namespace, each.key)}-db-backup"
+              image   = try(var.database_backup_info[each.value.database.engine].image, var.database_backup_info.postgres.image)
+              command = ["/bin/sh", "-c"]
+              args    = [try(var.database_backup_info[each.value.database.engine].command, var.database_backup_info.postgres.command)]
+              env_from {
+                secret_ref {
+                  name = "${each.key}-db-terraform"
+                }
+              }
+              volume_mount {
+                mount_path = "/backup"
+                name       = "${each.key}-db-backup"
+              }
+            }
+            volume {
+              name = "${each.key}-db-backup"
+              persistent_volume_claim {
+                claim_name = "${each.key}-db-backup"
+              }
+            }
+          }
+        }
       }
     }
   }
@@ -720,3 +903,155 @@ resource "kubernetes_deployment_v1" "redis-automatic" {
     }
   }
 }
+
+resource "kubernetes_config_map_v1" "automatic-configmap" {
+  metadata {
+    name      = "extra-sites-terraform"
+    namespace = "reverse-proxy"
+    annotations = {
+      "reloader.stakater.com/match" : "true",
+    }
+  }
+
+  data = {
+    for key, value in var.kubernetes :
+    "${value.domain_name}.conf" => templatefile("nginx_config.tftpl", {
+      name_site    = value.domain_name
+      name_service = "${key}-svc.${coalesce(value.namespace, value.connected_namespace, key)}.svc:${value.service_port.0}"
+    }) if value.domain_name != null && value.enabled == true
+  }
+
+}
+
+data "bitwarden-secrets_secret" "configmap_import" {
+  for_each = {
+    for pair in flatten([
+      for k, v in var.kubernetes : [
+        for id in v.config_map_import : {
+          map_key   = k
+          secret_id = id
+        }
+      ] if v.config_map_import != null && v.enabled == true
+    ]) : "${pair.map_key}-${pair.secret_id}" => pair.secret_id
+  }
+  id = each.value
+}
+
+resource "kubernetes_config_map_v1" "configmap_import" {
+  for_each = { for key, value in data.bitwarden-secrets_secret.configmap_import : key => value }
+  metadata {
+    name      = each.value.note
+    namespace = split("__", each.value.key)[0]
+  }
+  data = yamldecode(each.value.value)
+}
+
+
+data "bitwarden-secrets_secret" "secret_import" {
+  for_each = {
+    for pair in flatten([
+      for k, v in var.kubernetes : [
+        for id in v.secret_import : {
+          map_key   = k
+          secret_id = id
+        }
+      ] if v.secret_import != null && v.enabled == true
+    ]) : "${pair.map_key}-${pair.secret_id}" => pair.secret_id
+  }
+  id = each.value
+}
+
+resource "kubernetes_secret_v1" "secret_import" {
+  for_each = { for key, value in data.bitwarden-secrets_secret.secret_import : key => value }
+  metadata {
+    name      = each.value.note
+    namespace = split("__", each.value.key)[0]
+  }
+  data = yamldecode(each.value.value)
+}
+
+
+resource "kubernetes_secret_v1" "automatic-database-secret" {
+  for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
+  metadata {
+    name      = "${each.key}-db-terraform"
+    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
+  }
+
+  data = {
+    DB_DATABASE_NAME    = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
+    DB_DATABASE         = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
+    POSTGRES_DB         = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
+    MYSQL_DATABASE      = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
+    PGDATABASE          = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
+    DB_HOST             = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
+    PGHOST              = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
+    POSTGRES_HOST       = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
+    DB_PASSWORD         = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
+    MYSQL_PASSWORD      = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
+    MYSQL_ROOT_PASSWORD = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
+    POSTGRES_PASSWORD   = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
+    PGPASSWORD          = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
+    DB_USERNAME         = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
+    POSTGRES_USER       = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
+    MYSQL_USER          = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
+    PGUSER              = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
+    DATABASE_URL        = "postgresql://${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}:${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}@${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}:${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_port[each.key].value}/${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
+  }
+
+}
+
+resource "kubernetes_secret_v1" "automatic-database-mapped-secret" {
+  for_each = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
+  metadata {
+    name      = "${each.key}-db-mapped-terraform"
+    namespace = coalesce(each.value.namespace, each.value.connected_namespace, each.key)
+  }
+
+  data = {
+    "${try(each.value.database.map_name, "DB_DATABASE_NAME")}"     = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_name[each.key].value}"
+    "${try(each.value.database.map_host, "DB_DATABASE_NAME")}"     = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_host[each.key].value}"
+    "${try(each.value.database.map_password, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_password[each.key].value}"
+    "${try(each.value.database.map_username, "DB_DATABASE_NAME")}" = "${resource.bitwarden-secrets_secret.automatic_bitwarden_secret_db_username[each.key].value}"
+  }
+}
+
+
+resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_username" {
+  for_each   = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
+  key        = "${each.key}__db__username"
+  value      = try(each.value.database.username, each.key)
+  project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
+}
+
+resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_password" {
+  for_each        = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
+  key             = "${each.key}__db__password"
+  project_id      = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
+  length          = 32
+  special         = true
+  min_special     = 5
+  avoid_ambiguous = true
+}
+
+resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_host" {
+  for_each   = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
+  key        = "${each.key}__db__host"
+  project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
+  value      = try(each.value.database.host, "${each.key}-db-svc.${coalesce(each.value.namespace, each.value.connected_namespace, each.key)}.svc")
+}
+
+resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_port" {
+  for_each   = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
+  key        = "${each.key}__db__port"
+  project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
+  value      = try(each.value.database.port, 5432)
+}
+
+resource "bitwarden-secrets_secret" "automatic_bitwarden_secret_db_name" {
+  for_each   = { for key, value in var.kubernetes : key => value if value.database != null && value.enabled == true }
+  key        = "${each.key}__db__name"
+  project_id = "b5fc4c48-e951-442f-97ca-b3e800c143cd"
+  value      = try(each.value.database.name, each.key)
+}
+

nginx_config.tftpl

@@ -0,0 +1,45 @@
+############################################
+#       config file for ${name_site}
+############################################
+
+upstream ${name_site}_backend {
+        server ${name_service};
+        server 1.1.1.1 backup;
+    }
+
+server {
+        server_name ${name_site}.tryton.geeraert.eu www.${name_site}.tryton.geeraert.eu;
+        location / {
+                proxy_pass http://${name_site}_backend;
+                proxy_set_header    Upgrade     $http_upgrade;
+		proxy_set_header Host $host;
+        }
+        location /.well-known/acme-challenge/ {
+                root /var/www/certbot;
+        }
+
+	access_log /var/log/nginx/access.log my_custom_format;
+        access_log /var/log/nginx/ip_audit.log ip_audit;
+
+        listen 443 ssl;
+
+        ssl_certificate /etc/nginx/ssl/live/tryton.geeraert.eu/fullchain.pem;
+        ssl_certificate_key /etc/nginx/ssl/live/tryton.geeraert.eu/privkey.pem;
+
+}
+
+server {
+        if ($host = www.${name_site}.tryton.geeraert.eu) {
+                return 301 https://$host$request_uri;
+        }
+
+
+        if ($host = ${name_site}.tryton.geeraert.eu) {
+                return 301 https://$host$request_uri;
+        }
+
+        server_name www.${name_site}.tryton.geeraert.eu ${name_site}.tryton.geeraert.eu;
+        listen 80;
+        return 404;
+
+}