platform: move postgres to infrastructure

Reviewed-on: #9

.gitignore

@@ -0,0 +1,8 @@
+*.md
+!README.md
+!knowledge/**/*.md
+!services/comms/knowledge/**/*.md
+__pycache__/
+*.py[cod]
+.pytest_cache
+.venv

README.md

@@ -0,0 +1,3 @@
+# titan-iac
+
+Flux-managed Kubernetes cluster for bstein.dev services.

clusters/atlas/applications/kustomization.yaml

@@ -0,0 +1,13 @@
+# clusters/atlas/applications/kustomization.yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../services/crypto
+  - ../../services/gitea
+  - ../../services/jellyfin
+  - ../../services/comms
+  - ../../services/monitoring
+  - ../../services/logging
+  - ../../services/pegasus
+  - ../../services/vault
+  - ../../services/bstein-dev-home

clusters/atlas/flux-system/applications/ai-llm/kustomization.yaml

@@ -1,22 +1,23 @@
-# infrastructure/flux-system/kustomization-core.yaml
+# clusters/atlas/flux-system/applications/ai-llm/kustomization.yaml
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: core
+  name: ai-llm
   namespace: flux-system
 spec:
   interval: 10m
-  path: ./infrastructure/core
+  path: ./services/ai-llm
+  targetNamespace: ai
   prune: true
   sourceRef:
     kind: GitRepository
     name: flux-system
     namespace: flux-system
   wait: true
-
-  # Only wait for the NVIDIA device-plugin DaemonSet on titan-22
   healthChecks:
     - apiVersion: apps/v1
-      kind: DaemonSet
-      name: nvidia-device-plugin-minipc
-      namespace: kube-system
+      kind: Deployment
+      name: ollama
+      namespace: ai
+  dependsOn:
+    - name: core

clusters/atlas/flux-system/applications/bstein-dev-home/image-automation.yaml

@@ -0,0 +1,26 @@
+# clusters/atlas/flux-system/applications/bstein-dev-home/image-automation.yaml
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImageUpdateAutomation
+metadata:
+  name: bstein-dev-home
+  namespace: flux-system
+spec:
+  interval: 1m0s
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  git:
+    checkout:
+      ref:
+        branch: main
+    commit:
+      author:
+        email: ops@bstein.dev
+        name: flux-bot
+      messageTemplate: "chore(bstein-dev-home): update images to {{range .Updated.Images}}{{.}}{{end}}"
+    push:
+      branch: main
+  update:
+    strategy: Setters
+    path: services/bstein-dev-home

clusters/atlas/flux-system/applications/bstein-dev-home/kustomization.yaml

@@ -0,0 +1,15 @@
+# clusters/atlas/flux-system/applications/bstein-dev-home/kustomization.yaml
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: bstein-dev-home
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: ./services/bstein-dev-home
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  targetNamespace: bstein-dev-home
+  wait: false

clusters/atlas/flux-system/applications/comms/kustomization.yaml

@@ -1,18 +1,17 @@
-# infrastructure/flux-system/kustomization-zot.yaml
+# clusters/atlas/flux-system/applications/communication/kustomization.yaml
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
-  name: zot
+  name: comms
   namespace: flux-system
 spec:
   interval: 10m
-  path: ./services/zot
-  targetNamespace: zot
-  prune: false
+  prune: true
   sourceRef:
     kind: GitRepository
     name: flux-system
-    namespace: flux-system
-  wait: true
+  path: ./services/comms
+  targetNamespace: comms
+  timeout: 2m
   dependsOn:
-    - name: core 
+    - name: traefik

clusters/atlas/flux-system/applications/crypto/kustomization.yaml

@@ -1,4 +1,4 @@
-# infrastructure/flux-system/kustomization-crypto.yaml
+# clusters/atlas/flux-system/applications/crypto/kustomization.yaml
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:

clusters/atlas/flux-system/applications/gitea/kustomization.yaml

@@ -1,4 +1,4 @@
-# infrastructure/flux-system/kustomization-gitea.yaml
+# clusters/atlas/flux-system/applications/gitea/kustomization.yaml
 apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
 kind: Kustomization
 metadata:

clusters/atlas/flux-system/applications/harbor/image-automation.yaml

@@ -0,0 +1,27 @@
+# clusters/atlas/flux-system/applications/harbor/image-automation.yaml
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImageUpdateAutomation
+metadata:
+  name: harbor
+  namespace: harbor
+spec:
+  suspend: true
+  interval: 5m0s
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  git:
+    checkout:
+      ref:
+        branch: feature/ci-gitops
+    commit:
+      author:
+        email: ops@bstein.dev
+        name: flux-bot
+      messageTemplate: "chore(harbor): apply image updates"
+    push:
+      branch: feature/ci-gitops
+  update:
+    strategy: Setters
+    path: ./services/harbor

clusters/atlas/flux-system/applications/harbor/kustomization.yaml

@@ -0,0 +1,23 @@
+# clusters/atlas/flux-system/applications/harbor/kustomization.yaml
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: harbor
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: ./services/harbor
+  targetNamespace: harbor
+  prune: false
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  healthChecks:
+    - apiVersion: helm.toolkit.fluxcd.io/v2
+      kind: HelmRelease
+      name: harbor
+      namespace: harbor
+  wait: false
+  dependsOn:
+    - name: core

clusters/atlas/flux-system/applications/jellyfin/kustomization.yaml

@@ -1,4 +1,4 @@
-# infrastructure/flux-system/kustomization-jellyfin.yaml
+# clusters/atlas/flux-system/applications/jellyfin/kustomization.yaml
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
@@ -15,5 +15,6 @@ spec:
     namespace: flux-system
   dependsOn:
     - name: core
+    - name: openldap
   wait: true
   timeout: 5m

clusters/atlas/flux-system/applications/jenkins/kustomization.yaml

@@ -0,0 +1,27 @@
+# clusters/atlas/flux-system/applications/jenkins/kustomization.yaml
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: jenkins
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: ./services/jenkins
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  targetNamespace: jenkins
+  dependsOn:
+    - name: helm
+    - name: traefik
+  healthChecks:
+    - apiVersion: apps/v1
+      kind: Deployment
+      name: jenkins
+      namespace: jenkins
+    - apiVersion: v1
+      kind: Service
+      name: jenkins
+      namespace: jenkins
+  wait: false

clusters/atlas/flux-system/applications/keycloak/kustomization.yaml

@@ -0,0 +1,15 @@
+# clusters/atlas/flux-system/applications/keycloak/kustomization.yaml
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: keycloak
+  namespace: flux-system
+spec:
+  interval: 10m
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./services/keycloak
+  targetNamespace: sso
+  timeout: 2m

clusters/atlas/flux-system/applications/kustomization.yaml

@@ -0,0 +1,29 @@
+# clusters/atlas/flux-system/applications/kustomization.yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - gitea/kustomization.yaml
+  - vault/kustomization.yaml
+  - vaultwarden/kustomization.yaml
+  - comms/kustomization.yaml
+  - crypto/kustomization.yaml
+  - monerod/kustomization.yaml
+  - pegasus/kustomization.yaml
+  - pegasus/image-automation.yaml
+  - bstein-dev-home/kustomization.yaml
+  - bstein-dev-home/image-automation.yaml
+  - harbor/kustomization.yaml
+  - harbor/image-automation.yaml
+  - jellyfin/kustomization.yaml
+  - xmr-miner/kustomization.yaml
+  - sui-metrics/kustomization.yaml
+  - openldap/kustomization.yaml
+  - keycloak/kustomization.yaml
+  - oauth2-proxy/kustomization.yaml
+  - mailu/kustomization.yaml
+  - jenkins/kustomization.yaml
+  - ai-llm/kustomization.yaml
+  - nextcloud/kustomization.yaml
+  - nextcloud-mail-sync/kustomization.yaml
+  - outline/kustomization.yaml
+  - planka/kustomization.yaml

clusters/atlas/flux-system/applications/mailu/kustomization.yaml

@@ -0,0 +1,18 @@
+# clusters/atlas/flux-system/applications/mailu/kustomization.yaml
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: mailu
+  namespace: flux-system
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  path: ./services/mailu
+  targetNamespace: mailu-mailserver
+  prune: true
+  wait: true
+  dependsOn:
+    - name: helm

clusters/atlas/flux-system/applications/monerod/kustomization.yaml

@@ -1,4 +1,4 @@
-# infrastructure/flux-system/kustomization-monerod.yaml
+# clusters/atlas/flux-system/applications/monerod/kustomization.yaml
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:

clusters/atlas/flux-system/applications/nextcloud-mail-sync/kustomization.yaml

@@ -0,0 +1,17 @@
+# clusters/atlas/flux-system/applications/nextcloud-mail-sync/kustomization.yaml
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: nextcloud-mail-sync
+  namespace: flux-system
+spec:
+  interval: 10m
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./services/nextcloud-mail-sync
+  targetNamespace: nextcloud
+  timeout: 2m
+  dependsOn:
+    - name: keycloak

clusters/atlas/flux-system/applications/nextcloud/kustomization.yaml

@@ -0,0 +1,16 @@
+# clusters/atlas/flux-system/applications/nextcloud/kustomization.yaml
+apiVersion: kustomize.toolkit.fluxcd.io/v1beta2
+kind: Kustomization
+metadata:
+  name: nextcloud
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: ./services/nextcloud
+  targetNamespace: nextcloud
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  wait: true

clusters/atlas/flux-system/applications/oauth2-proxy/kustomization.yaml

@@ -0,0 +1,15 @@
+# clusters/atlas/flux-system/applications/oauth2-proxy/kustomization.yaml
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: oauth2-proxy
+  namespace: flux-system
+spec:
+  interval: 10m
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  path: ./services/oauth2-proxy
+  targetNamespace: sso
+  timeout: 2m

clusters/atlas/flux-system/applications/openldap/kustomization.yaml

@@ -0,0 +1,19 @@
+# clusters/atlas/flux-system/applications/openldap/kustomization.yaml
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: openldap
+  namespace: flux-system
+spec:
+  interval: 10m
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  path: ./services/openldap
+  targetNamespace: sso
+  dependsOn:
+    - name: core
+  wait: true
+  timeout: 5m

clusters/atlas/flux-system/applications/outline/kustomization.yaml

@@ -0,0 +1,28 @@
+# clusters/atlas/flux-system/applications/outline/kustomization.yaml
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: outline
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: ./services/outline
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  targetNamespace: outline
+  dependsOn:
+    - name: keycloak
+    - name: mailu
+    - name: traefik
+  healthChecks:
+    - apiVersion: apps/v1
+      kind: Deployment
+      name: outline
+      namespace: outline
+    - apiVersion: v1
+      kind: Service
+      name: outline
+      namespace: outline
+  wait: false

clusters/atlas/flux-system/applications/pegasus/image-automation.yaml

@@ -0,0 +1,26 @@
+# clusters/atlas/flux-system/applications/pegasus/image-automation.yaml
+apiVersion: image.toolkit.fluxcd.io/v1
+kind: ImageUpdateAutomation
+metadata:
+  name: pegasus
+  namespace: flux-system
+spec:
+  interval: 1m0s
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  git:
+    checkout:
+      ref:
+        branch: feature/ci-gitops
+    commit:
+      author:
+        email: ops@bstein.dev
+        name: flux-bot
+      messageTemplate: "chore(pegasus): apply image updates"
+    push:
+      branch: feature/ci-gitops
+  update:
+    strategy: Setters
+    path: services/pegasus

clusters/atlas/flux-system/applications/pegasus/kustomization.yaml

@@ -0,0 +1,19 @@
+# clusters/atlas/flux-system/applications/pegasus/kustomization.yaml
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: pegasus
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: ./services/pegasus
+  targetNamespace: jellyfin
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  dependsOn:
+    - name: core
+  wait: true
+  timeout: 5m

clusters/atlas/flux-system/applications/planka/kustomization.yaml

@@ -0,0 +1,28 @@
+# clusters/atlas/flux-system/applications/planka/kustomization.yaml
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: planka
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: ./services/planka
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  targetNamespace: planka
+  dependsOn:
+    - name: keycloak
+    - name: mailu
+    - name: traefik
+  healthChecks:
+    - apiVersion: apps/v1
+      kind: Deployment
+      name: planka
+      namespace: planka
+    - apiVersion: v1
+      kind: Service
+      name: planka
+      namespace: planka
+  wait: false

clusters/atlas/flux-system/applications/sui-metrics/kustomization.yaml

@@ -0,0 +1,19 @@
+# clusters/atlas/flux-system/applications/sui-metrics/kustomization.yaml
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: sui-metrics
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: ./services/sui-metrics/overlays/atlas
+  prune: true
+  dependsOn:
+    - name: monitoring
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  wait: true
+  timeout: 5m
+  targetNamespace: sui-metrics

clusters/atlas/flux-system/applications/vault/kustomization.yaml

@@ -1,4 +1,4 @@
-# infrastructure/flux-system/kustomization-vault.yaml
+# clusters/atlas/flux-system/applications/vault/kustomization.yaml
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:

clusters/atlas/flux-system/applications/vaultwarden/kustomization.yaml

@@ -0,0 +1,20 @@
+# clusters/atlas/flux-system/applications/vaultwarden/kustomization.yaml
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: vaultwarden
+  namespace: flux-system
+spec:
+  interval: 10m
+  suspend: false
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  path: ./services/vaultwarden
+  targetNamespace: vaultwarden
+  prune: true
+  wait: true
+  dependsOn:
+    - name: helm
+    - name: traefik

clusters/atlas/flux-system/applications/xmr-miner/kustomization.yaml

@@ -1,4 +1,4 @@
-# infrastructure/flux-system/kustomization-core.yaml
+# clusters/atlas/flux-system/applications/xmr-miner/kustomization.yaml
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:

clusters/atlas/flux-system/gotk-sync.yaml

@@ -8,7 +8,7 @@ metadata:
 spec:
   interval: 1m0s
   ref:
-    branch: main
+    branch: feature/sso-hardening
   secretRef:
     name: flux-system-gitea
   url: ssh://git@scm.bstein.dev:2242/bstein/titan-iac.git
@@ -20,7 +20,7 @@ metadata:
   namespace: flux-system
 spec:
   interval: 10m0s
-  path: ./
+  path: ./clusters/atlas/flux-system
   prune: true
   sourceRef:
     kind: GitRepository

clusters/atlas/flux-system/kustomization.yaml

@@ -0,0 +1,8 @@
+# clusters/atlas/flux-system/kustomization.yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - gotk-components.yaml
+  - gotk-sync.yaml
+  - platform
+  - applications

clusters/atlas/flux-system/platform/core/kustomization.yaml

@@ -0,0 +1,15 @@
+# clusters/atlas/flux-system/platform/core/kustomization.yaml
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: core
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: ./infrastructure/core
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  wait: false

clusters/atlas/flux-system/platform/gitops-ui/kustomization.yaml

@@ -0,0 +1,20 @@
+# clusters/atlas/flux-system/platform/gitops-ui/kustomization.yaml
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: gitops-ui
+  namespace: flux-system
+spec:
+  interval: 10m
+  timeout: 10m
+  path: ./services/gitops-ui
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  targetNamespace: flux-system
+  dependsOn:
+    - name: helm
+    - name: traefik
+  wait: true

clusters/atlas/flux-system/platform/helm/kustomization.yaml

@@ -1,4 +1,4 @@
-# infrastructure/flux-system/kustomization-helm.yaml
+# clusters/atlas/flux-system/platform/helm/kustomization.yaml
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:

clusters/atlas/flux-system/platform/kustomization.yaml

@@ -0,0 +1,15 @@
+# clusters/atlas/flux-system/platform/kustomization.yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - core/kustomization.yaml
+  - helm/kustomization.yaml
+  - metallb/kustomization.yaml
+  - traefik/kustomization.yaml
+  - gitops-ui/kustomization.yaml
+  - monitoring/kustomization.yaml
+  - logging/kustomization.yaml
+  - maintenance/kustomization.yaml
+  - longhorn-ui/kustomization.yaml
+  - postgres/kustomization.yaml
+  - ../platform/vault-csi/kustomization.yaml

clusters/atlas/flux-system/platform/logging/kustomization.yaml

@@ -0,0 +1,14 @@
+# clusters/atlas/flux-system/platform/logging/kustomization.yaml
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: logging
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: ./services/logging
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  wait: false

clusters/atlas/flux-system/platform/longhorn-ui/kustomization.yaml

@@ -1,3 +1,4 @@
+# clusters/atlas/flux-system/platform/longhorn-ui/kustomization.yaml
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:

clusters/atlas/flux-system/platform/maintenance/kustomization.yaml

@@ -0,0 +1,14 @@
+# clusters/atlas/flux-system/platform/maintenance/kustomization.yaml
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: maintenance
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: ./services/maintenance
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  wait: false

clusters/atlas/flux-system/platform/metallb/kustomization.yaml

@@ -0,0 +1,16 @@
+# clusters/atlas/flux-system/platform/metallb/kustomization.yaml
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: metallb
+  namespace: flux-system
+spec:
+  interval: 30m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  path: ./infrastructure/metallb
+  prune: true
+  wait: true
+  targetNamespace: metallb-system

clusters/atlas/flux-system/platform/monitoring/kustomization.yaml

@@ -0,0 +1,14 @@
+# clusters/atlas/flux-system/platform/monitoring/kustomization.yaml
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: monitoring
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: ./services/monitoring
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  wait: false

clusters/atlas/flux-system/platform/postgres/kustomization.yaml

@@ -0,0 +1,24 @@
+# clusters/atlas/flux-system/platform/postgres/kustomization.yaml
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: postgres
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: ./infrastructure/postgres
+  prune: true
+  force: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+  targetNamespace: postgres
+  dependsOn:
+    - name: vault
+    - name: vault-csi
+  healthChecks:
+    - apiVersion: apps/v1
+      kind: StatefulSet
+      name: postgres
+      namespace: postgres
+  wait: true

clusters/atlas/flux-system/platform/traefik/kustomization.yaml

@@ -0,0 +1,19 @@
+# clusters/atlas/flux-system/platform/traefik/kustomization.yaml
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: traefik
+  namespace: flux-system
+spec:
+  interval: 10m
+  path: ./infrastructure/traefik
+  targetNamespace: traefik
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  dependsOn:
+    - name: core
+    - name: metallb
+  wait: true

clusters/atlas/flux-system/platform/vault-csi/kustomization.yaml

@@ -0,0 +1,16 @@
+# clusters/atlas/flux-system/platform/vault-csi/kustomization.yaml
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: vault-csi
+  namespace: flux-system
+spec:
+  interval: 30m
+  sourceRef:
+    kind: GitRepository
+    name: flux-system
+    namespace: flux-system
+  path: ./infrastructure/vault-csi
+  prune: true
+  wait: true
+  targetNamespace: kube-system

clusters/atlas/platform/kustomization.yaml

@@ -0,0 +1,8 @@
+# clusters/atlas/platform/kustomization.yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../../infrastructure/modules/base
+  - ../../../infrastructure/modules/profiles/atlas-ha
+  - ../../../infrastructure/sources/cert-manager/letsencrypt.yaml
+  - ../../../infrastructure/metallb

clusters/oceanus/applications/kustomization.yaml

@@ -0,0 +1,4 @@
+# clusters/oceanus/applications/kustomization.yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources: []

clusters/oceanus/flux-system/kustomization.yaml

@@ -0,0 +1,9 @@
+# clusters/oceanus/flux-system/kustomization.yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  # Populate when oceanus cluster is bootstrapped with Flux.
+  # - gotk-components.yaml
+  # - gotk-sync.yaml
+  - ../platform
+  - ../applications

clusters/oceanus/platform/kustomization.yaml

@@ -0,0 +1,6 @@
+# clusters/oceanus/platform/kustomization.yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../../infrastructure/modules/base
+  - ../../infrastructure/modules/profiles/oceanus-validator

dockerfiles/Dockerfile.data-prepper

@@ -0,0 +1,16 @@
+FROM --platform=$BUILDPLATFORM opensearchproject/data-prepper:2.8.0 AS source
+
+FROM --platform=$TARGETPLATFORM eclipse-temurin:17-jre
+
+ENV DATA_PREPPER_PATH=/usr/share/data-prepper
+
+RUN useradd -u 10001 -M -U -d / -s /usr/sbin/nologin data_prepper \
+  && mkdir -p /var/log/data-prepper
+
+COPY --from=source /usr/share/data-prepper /usr/share/data-prepper
+
+RUN chown -R 10001:10001 /usr/share/data-prepper /var/log/data-prepper
+
+USER 10001
+WORKDIR /usr/share/data-prepper
+CMD ["bin/data-prepper"]

hosts/group_vars/all.yaml

@@ -0,0 +1,2 @@
+# hosts/group_vars/all.yaml
+validator_version: latest

hosts/host_vars/titan-24.yaml

@@ -0,0 +1,2 @@
+# hosts/host_vars/titan-24.yaml
+validator_compose_path: /opt/sui-validator

hosts/inventory/lab.yaml

@@ -0,0 +1,28 @@
+# hosts/inventory/lab.yaml
+# Replace ansible_host and ansible_user values with real connectivity details.
+all:
+  children:
+    atlas:
+      hosts:
+        titan-24:
+          ansible_host: REPLACE_ME
+          ansible_user: ubuntu
+          roleset: tethys_hybrid
+        titan-22:
+          ansible_host: REPLACE_ME
+          ansible_user: debian
+          roleset: minipc_gpu
+    baremetal:
+      hosts:
+        titan-db:
+          ansible_host: REPLACE_ME
+          ansible_user: postgres
+          roleset: database
+        titan-jh:
+          ansible_host: REPLACE_ME
+          ansible_user: jump
+          roleset: jumphost
+        oceanus:
+          ansible_host: REPLACE_ME
+          ansible_user: validator
+          roleset: validator

hosts/playbooks/site.yaml

@@ -0,0 +1,29 @@
+# hosts/playbooks/site.yaml
+---
+- name: Configure titan-db
+  hosts: titan-db
+  gather_facts: true
+  roles:
+    - common
+    - titan_db
+
+- name: Configure titan-jh
+  hosts: titan-jh
+  gather_facts: true
+  roles:
+    - common
+    - titan_jh
+
+- name: Configure oceanus validator host
+  hosts: oceanus
+  gather_facts: true
+  roles:
+    - common
+    - oceanus_base
+
+- name: Prepare hybrid tethys node
+  hosts: titan-24
+  gather_facts: true
+  roles:
+    - common
+    - tethys_canary

hosts/roles/common/tasks/main.yaml

@@ -0,0 +1,9 @@
+# hosts/roles/common/tasks/main.yaml
+---
+- name: Ensure base packages present
+  ansible.builtin.package:
+    name:
+      - curl
+      - vim
+    state: present
+  tags: ['common', 'packages']

hosts/roles/oceanus_base/tasks/main.yaml

@@ -0,0 +1,6 @@
+# hosts/roles/oceanus_base/tasks/main.yaml
+---
+- name: Placeholder for oceanus base configuration
+  ansible.builtin.debug:
+    msg: "Install validator prerequisites and monitoring exporters here."
+  tags: ['oceanus']

hosts/roles/tethys_canary/tasks/main.yaml

@@ -0,0 +1,6 @@
+# hosts/roles/tethys_canary/tasks/main.yaml
+---
+- name: Placeholder for SUI validator container runtime setup
+  ansible.builtin.debug:
+    msg: "Configure container runtime and validator compose stack here."
+  tags: ['tethys', 'validator']

hosts/roles/titan_db/tasks/main.yaml

@@ -0,0 +1,6 @@
+# hosts/roles/titan_db/tasks/main.yaml
+---
+- name: Placeholder for titan-db provisioning
+  ansible.builtin.debug:
+    msg: "Install database packages, configure backups, and manage users here."
+  tags: ['titan_db']

hosts/roles/titan_jh/tasks/main.yaml

@@ -0,0 +1,19 @@
+# hosts/roles/titan_jh/tasks/main.yaml
+---
+- name: Install node exporter
+  ansible.builtin.package:
+    name: prometheus-node-exporter
+    state: present
+  tags: ['jumphost', 'monitoring']
+
+- name: Enable node exporter
+  ansible.builtin.service:
+    name: prometheus-node-exporter
+    enabled: true
+    state: started
+  tags: ['jumphost', 'monitoring']
+
+- name: Placeholder for jumphost hardening
+  ansible.builtin.debug:
+    msg: "Harden SSH, manage bastion tooling, and configure audit logging here."
+  tags: ['jumphost']

infrastructure/core/gpu/profiles/jetson-only/kustomization.yaml

@@ -1,5 +0,0 @@
-# infrastructure/core/gpu/daemonsets/profiles/jetson-only/kustomization.yaml
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../../device-plugin-jetson

infrastructure/core/gpu/profiles/minipc-and-jetson/kustomization.yaml

@@ -1,6 +0,0 @@
-# infrastructure/core/gpu/daemonsets/profiles/minipc-and-jetson/kustomization.yaml
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - ../../device-plugin-minipc
-  - ../../device-plugin-jetson

infrastructure/core/kustomization.yaml

@@ -2,7 +2,7 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-  - base
-  # - gpu/profiles/jetson-only 
-  # - gpu/profiles/minipc-and-jetson
-  - gpu/profiles/minipc-only 
+  - ../modules/base
+  - ../modules/profiles/atlas-ha
+  - ../sources/cert-manager/letsencrypt.yaml
+  - ../sources/cert-manager/letsencrypt-prod.yaml

infrastructure/flux-system/kustomization.yaml

@@ -2,15 +2,4 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
-- gotk-components.yaml
-- gotk-sync.yaml
-- kustomization-zot.yaml
-- kustomization-core.yaml
-- kustomization-helm.yaml
-- kustomization-gitea.yaml
-- kustomization-vault.yaml
-- kustomization-crypto.yaml
-- kustomization-monerod.yaml
-- kustomization-jellyfin.yaml
-- kustomization-xmr-miner.yaml
-- kustomization-longhorn-ui.yaml
+  - ../clusters/atlas/flux-system

infrastructure/longhorn/ui-ingress/ingress.yaml

@@ -7,7 +7,7 @@ metadata:
   annotations:
     traefik.ingress.kubernetes.io/router.entrypoints: websecure
     traefik.ingress.kubernetes.io/router.tls: "true"
-    traefik.ingress.kubernetes.io/router.middlewares: longhorn-system-longhorn-basicauth@kubernetescrd,longhorn-system-longhorn-headers@kubernetescrd
+    traefik.ingress.kubernetes.io/router.middlewares: ""
 spec:
   ingressClassName: traefik
   tls:
@@ -21,6 +21,6 @@ spec:
             pathType: Prefix
             backend:
               service:
-                name: longhorn-frontend
+                name: oauth2-proxy-longhorn
                 port:
                   number: 80

infrastructure/longhorn/ui-ingress/kustomization.yaml

@@ -4,3 +4,4 @@ kind: Kustomization
 resources:
   - middleware.yaml
   - ingress.yaml
+  - oauth2-proxy-longhorn.yaml

infrastructure/longhorn/ui-ingress/middleware.yaml

@@ -20,3 +20,20 @@ spec:
   headers:
     customRequestHeaders:
       X-Forwarded-Proto: "https"
+
+---
+
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: longhorn-forward-auth
+  namespace: longhorn-system
+spec:
+  forwardAuth:
+    address: https://auth.bstein.dev/oauth2/auth
+    trustForwardHeader: true
+    authResponseHeaders:
+      - Authorization
+      - X-Auth-Request-Email
+      - X-Auth-Request-User
+      - X-Auth-Request-Groups

infrastructure/longhorn/ui-ingress/oauth2-proxy-longhorn.yaml

@@ -0,0 +1,102 @@
+# infrastructure/longhorn/ui-ingress/oauth2-proxy-longhorn.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: oauth2-proxy-longhorn
+  namespace: longhorn-system
+  labels:
+    app: oauth2-proxy-longhorn
+spec:
+  ports:
+    - name: http
+      port: 80
+      targetPort: 4180
+  selector:
+    app: oauth2-proxy-longhorn
+
+---
+
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: oauth2-proxy-longhorn
+  namespace: longhorn-system
+  labels:
+    app: oauth2-proxy-longhorn
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: oauth2-proxy-longhorn
+  template:
+    metadata:
+      labels:
+        app: oauth2-proxy-longhorn
+    spec:
+      nodeSelector:
+        node-role.kubernetes.io/worker: "true"
+      affinity:
+        nodeAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 90
+              preference:
+                matchExpressions:
+                  - key: hardware
+                    operator: In
+                    values: ["rpi5","rpi4"]
+      containers:
+        - name: oauth2-proxy
+          image: quay.io/oauth2-proxy/oauth2-proxy:v7.6.0
+          imagePullPolicy: IfNotPresent
+          args:
+            - --provider=oidc
+            - --redirect-url=https://longhorn.bstein.dev/oauth2/callback
+            - --oidc-issuer-url=https://sso.bstein.dev/realms/atlas
+            - --scope=openid profile email groups
+            - --email-domain=*
+            - --allowed-group=admin
+            - --set-xauthrequest=true
+            - --pass-access-token=true
+            - --set-authorization-header=true
+            - --cookie-secure=true
+            - --cookie-samesite=lax
+            - --cookie-refresh=20m
+            - --cookie-expire=168h
+            - --insecure-oidc-allow-unverified-email=true
+            - --upstream=http://longhorn-frontend.longhorn-system.svc.cluster.local
+            - --http-address=0.0.0.0:4180
+            - --skip-provider-button=true
+            - --skip-jwt-bearer-tokens=true
+            - --oidc-groups-claim=groups
+            - --cookie-domain=longhorn.bstein.dev
+          env:
+            - name: OAUTH2_PROXY_CLIENT_ID
+              valueFrom:
+                secretKeyRef:
+                  name: oauth2-proxy-longhorn-oidc
+                  key: client_id
+            - name: OAUTH2_PROXY_CLIENT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: oauth2-proxy-longhorn-oidc
+                  key: client_secret
+            - name: OAUTH2_PROXY_COOKIE_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: oauth2-proxy-longhorn-oidc
+                  key: cookie_secret
+          ports:
+            - containerPort: 4180
+              name: http
+          readinessProbe:
+            httpGet:
+              path: /ping
+              port: 4180
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /ping
+              port: 4180
+            initialDelaySeconds: 20
+            periodSeconds: 20

infrastructure/metallb/ippool.yaml

@@ -0,0 +1,20 @@
+# infrastructure/metallb/ippool.yaml
+apiVersion: metallb.io/v1beta1
+kind: IPAddressPool
+metadata:
+  name: communication-pool
+  namespace: metallb-system
+spec:
+  addresses:
+    - 192.168.22.4-192.168.22.6
+    - 192.168.22.9-192.168.22.9
+  autoAssign: true
+---
+apiVersion: metallb.io/v1beta1
+kind: L2Advertisement
+metadata:
+  name: communication-adv
+  namespace: metallb-system
+spec:
+  ipAddressPools:
+    - communication-pool

infrastructure/metallb/kustomization.yaml

@@ -0,0 +1,10 @@
+# infrastructure/metallb/kustomization.yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - metallb-rendered.yaml
+  - ippool.yaml
+patchesStrategicMerge:
+  - patches/node-placement.yaml
+  - patches/speaker-loglevel.yaml

infrastructure/metallb/namespace.yaml

@@ -0,0 +1,5 @@
+# infrastructure/metallb/namespace.yaml
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: metallb-system

infrastructure/metallb/patches/node-placement.yaml

@@ -0,0 +1,27 @@
+# infrastructure/metallb/patches/node-placement.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: metallb-controller
+  namespace: metallb-system
+spec:
+  template:
+    spec:
+      containers:
+        - name: controller
+          args:
+            - --port=7472
+            - --log-level=info
+            - --webhook-mode=enabled
+            - --tls-min-version=VersionTLS12
+            - --lb-class=metallb
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: hardware
+                    operator: In
+                    values:
+                      - rpi4
+                      - rpi5

infrastructure/metallb/patches/speaker-loglevel.yaml

@@ -0,0 +1,15 @@
+# infrastructure/metallb/patches/speaker-loglevel.yaml
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: metallb-speaker
+  namespace: metallb-system
+spec:
+  template:
+    spec:
+      containers:
+        - name: speaker
+          args:
+            - --port=7472
+            - --log-level=info
+            - --lb-class=metallb

infrastructure/modules/base/kustomization.yaml

@@ -1,4 +1,4 @@
-# infrastructure/core/base/kustomization.yaml
+# infrastructure/modules/base/kustomization.yaml
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:

infrastructure/modules/base/priorityclass/kustomization.yaml

@@ -1,4 +1,4 @@
-# infrastructure/core/base/priorityclass/kustomization.yaml
+# infrastructure/modules/base/priorityclass/kustomization.yaml
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:

infrastructure/modules/base/priorityclass/scavenger.yaml

@@ -1,4 +1,4 @@
-# infrastructure/core/base/priorityclass/scavenger.yaml
+# infrastructure/modules/base/priorityclass/scavenger.yaml
 apiVersion: scheduling.k8s.io/v1
 kind: PriorityClass
 metadata:

infrastructure/modules/base/runtimeclass/kustomization.yaml

@@ -1,4 +1,4 @@
-# infrastructure/core/base/storageclass/kustomization.yaml
+# infrastructure/modules/base/runtimeclass/kustomization.yaml
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:

infrastructure/modules/base/runtimeclass/runtimeclass.yaml

@@ -1,4 +1,4 @@
-# services/jellyfin/runtimeclass.yaml
+# infrastructure/modules/base/runtimeclass/runtimeclass.yaml
 apiVersion: node.k8s.io/v1
 kind: RuntimeClass
 metadata:

infrastructure/modules/base/storageclass/asteria.yaml

@@ -1,4 +1,4 @@
-# infrastructure/core/base/storageclass/asteria.yaml
+# infrastructure/modules/base/storageclass/asteria.yaml
 apiVersion: storage.k8s.io/v1
 kind: StorageClass
 metadata:
@@ -8,6 +8,9 @@ parameters:
   fromBackup: ""
   numberOfReplicas: "2"
   staleReplicaTimeout: "30"
+  fsType: "ext4"
+  replicaAutoBalance: "least-effort"
+  dataLocality: "disabled"
 provisioner: driver.longhorn.io
 reclaimPolicy: Retain
 allowVolumeExpansion: true

infrastructure/modules/base/storageclass/astreae.yaml

@@ -1,4 +1,4 @@
-# infrastructure/core/base/storageclass/astreae.yaml
+# infrastructure/modules/base/storageclass/astreae.yaml
 apiVersion: storage.k8s.io/v1
 kind: StorageClass
 metadata:

infrastructure/modules/base/storageclass/kustomization.yaml

@@ -1,4 +1,4 @@
-# infrastructure/core/base/storageclass/kustomization.yaml
+# infrastructure/modules/base/storageclass/kustomization.yaml
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:

infrastructure/modules/profiles/atlas-ha/kustomization.yaml

@@ -0,0 +1,8 @@
+# infrastructure/modules/profiles/atlas-ha/kustomization.yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../components/device-plugin-config
+  - ../components/device-plugin-jetson
+  - ../components/device-plugin-minipc
+  - ../components/device-plugin-tethys

infrastructure/modules/profiles/components/device-plugin-config/configmap.yaml

@@ -0,0 +1,15 @@
+# infrastructure/modules/profiles/components/device-plugin-config/configmap.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nvidia-device-plugin-config
+  namespace: kube-system
+data:
+  config.yaml: |
+    version: v1
+    sharing:
+      timeSlicing:
+        renameByDefault: true
+        resources:
+          - name: nvidia.com/gpu
+            replicas: 4

infrastructure/modules/profiles/components/device-plugin-config/kustomization.yaml

@@ -0,0 +1,5 @@
+# infrastructure/modules/profiles/components/device-plugin-config/kustomization.yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - configmap.yaml

infrastructure/modules/profiles/components/device-plugin-jetson/daemonset.yaml

@@ -1,4 +1,4 @@
-# infrastructure/core/gpu/daemonsets/device-plugin-jetson/daemonset.yaml
+# infrastructure/modules/profiles/components/device-plugin-jetson/daemonset.yaml
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
@@ -30,7 +30,8 @@ spec:
           imagePullPolicy: IfNotPresent
           args:
             - "--fail-on-init-error=false"
-            - "--device-list-strategy=envvar,cdi"
+            - "--device-list-strategy=envvar"
+            - "--config-file=/config/config.yaml"
           securityContext:
             privileged: true
           env:
@@ -41,7 +42,12 @@ spec:
           volumeMounts:
             - name: device-plugin
               mountPath: /var/lib/kubelet/device-plugins
+            - name: config
+              mountPath: /config
       volumes:
         - name: device-plugin
           hostPath:
             path: /var/lib/kubelet/device-plugins
+        - name: config
+          configMap:
+            name: nvidia-device-plugin-config

infrastructure/modules/profiles/components/device-plugin-jetson/kustomization.yaml

@@ -1,4 +1,4 @@
-# infrastructure/core/gpu/daemonsets/device-plugin-jetson/kustomization.yaml
+# infrastructure/modules/profiles/components/device-plugin-jetson/kustomization.yaml
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources: 

infrastructure/modules/profiles/components/device-plugin-minipc/daemonset.yaml

@@ -1,4 +1,4 @@
-# infrastructure/core/gpu/daemonsets/device-plugin-minipc/daemonset.yaml
+# infrastructure/modules/profiles/components/device-plugin-minipc/daemonset.yaml
 apiVersion: apps/v1
 kind: DaemonSet
 metadata:
@@ -24,7 +24,6 @@ spec:
       tolerations:
         - operator: Exists
       priorityClassName: system-node-critical
-      runtimeClassName: nvidia
       containers:
         - name: nvidia-device-plugin-ctr
           image: nvcr.io/nvidia/k8s-device-plugin:v0.16.2
@@ -33,6 +32,7 @@ spec:
             - "--fail-on-init-error=false"
             - "--device-list-strategy=envvar"
             - "--mig-strategy=none"
+            - "--config-file=/config/config.yaml"
           securityContext:
             privileged: true
           env:
@@ -43,7 +43,12 @@ spec:
           volumeMounts:
             - name: device-plugin
               mountPath: /var/lib/kubelet/device-plugins
+            - name: config
+              mountPath: /config
       volumes:
         - name: device-plugin
           hostPath:
             path: /var/lib/kubelet/device-plugins
+        - name: config
+          configMap:
+            name: nvidia-device-plugin-config

infrastructure/modules/profiles/components/device-plugin-minipc/kustomization.yaml

@@ -1,4 +1,4 @@
-# infrastructure/core/gpu/daemonsets/device-plugin-minipc/kustomization.yaml
+# infrastructure/modules/profiles/components/device-plugin-minipc/kustomization.yaml
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources: 

infrastructure/modules/profiles/components/device-plugin-tethys/daemonset.yaml

@@ -0,0 +1,55 @@
+# infrastructure/modules/profiles/components/device-plugin-tethys/daemonset.yaml
+apiVersion: apps/v1
+kind: DaemonSet
+metadata:
+  name: nvidia-device-plugin-tethys
+  namespace: kube-system
+  labels:
+    app.kubernetes.io/name: nvidia-device-plugin
+    app.kubernetes.io/instance: titan24
+spec:
+  selector:
+    matchLabels:
+      app.kubernetes.io/name: nvidia-device-plugin
+      app.kubernetes.io/instance: titan24
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/name: nvidia-device-plugin
+        app.kubernetes.io/instance: titan24
+    spec:
+      nodeSelector:
+        kubernetes.io/hostname: titan-24
+        kubernetes.io/arch: amd64
+      tolerations:
+        - operator: Exists
+      priorityClassName: system-node-critical
+      runtimeClassName: nvidia
+      containers:
+        - name: nvidia-device-plugin-ctr
+          image: nvcr.io/nvidia/k8s-device-plugin:v0.16.2
+          imagePullPolicy: IfNotPresent
+          args:
+            - "--fail-on-init-error=false"
+            - "--device-list-strategy=envvar"
+            - "--mig-strategy=none"
+            - "--config-file=/config/config.yaml"
+          securityContext:
+            privileged: true
+          env:
+            - name: NVIDIA_VISIBLE_DEVICES
+              value: "all"
+            - name: NVIDIA_DRIVER_CAPABILITIES
+              value: "compute,video,utility"
+          volumeMounts:
+            - name: device-plugin
+              mountPath: /var/lib/kubelet/device-plugins
+            - name: config
+              mountPath: /config
+      volumes:
+        - name: device-plugin
+          hostPath:
+            path: /var/lib/kubelet/device-plugins
+        - name: config
+          configMap:
+            name: nvidia-device-plugin-config

infrastructure/modules/profiles/components/device-plugin-tethys/kustomization.yaml

@@ -0,0 +1,5 @@
+# infrastructure/modules/profiles/components/device-plugin-tethys/kustomization.yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - daemonset.yaml

infrastructure/modules/profiles/oceanus-validator/kustomization.yaml

@@ -0,0 +1,4 @@
+# infrastructure/modules/profiles/oceanus-validator/kustomization.yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources: []

infrastructure/modules/profiles/tethys-hybrid/kustomization.yaml

@@ -0,0 +1,6 @@
+# infrastructure/modules/profiles/tethys-hybrid/kustomization.yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - ../components/device-plugin-config
+  - ../components/device-plugin-tethys

infrastructure/postgres/kustomization.yaml

@@ -0,0 +1,10 @@
+# infrastructure/postgres/kustomization.yaml
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: postgres
+resources:
+  - namespace.yaml
+  - serviceaccount.yaml
+  - secretproviderclass.yaml
+  - service.yaml
+  - statefulset.yaml

infrastructure/postgres/namespace.yaml

@@ -0,0 +1,5 @@
+# infrastructure/postgres/namespace.yaml
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: postgres

infrastructure/postgres/secretproviderclass.yaml

@@ -0,0 +1,15 @@
+# infrastructure/postgres/secretproviderclass.yaml
+apiVersion: secrets-store.csi.x-k8s.io/v1
+kind: SecretProviderClass
+metadata:
+  name: postgres-vault
+  namespace: postgres
+spec:
+  provider: vault
+  parameters:
+    vaultAddress: "http://vault.vault.svc.cluster.local:8200"
+    roleName: "postgres"
+    objects: |
+      - objectName: "postgres_password"
+        secretPath: "kv/data/postgres"
+        secretKey: "POSTGRES_PASSWORD"

infrastructure/postgres/service.yaml

@@ -0,0 +1,15 @@
+# infrastructure/postgres/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: postgres-service
+  namespace: postgres
+spec:
+  clusterIP: None
+  ports:
+    - name: postgres
+      port: 5432
+      protocol: TCP
+      targetPort: 5432
+  selector:
+    app: postgres

infrastructure/postgres/serviceaccount.yaml

@@ -0,0 +1,6 @@
+# infrastructure/postgres/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: postgres-vault
+  namespace: postgres

infrastructure/postgres/statefulset.yaml

@@ -0,0 +1,76 @@
+# infrastructure/postgres/statefulset.yaml
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: postgres
+  namespace: postgres
+  labels:
+    app: postgres
+spec:
+  serviceName: postgres-service
+  replicas: 1
+  selector:
+    matchLabels:
+      app: postgres
+  persistentVolumeClaimRetentionPolicy:
+    whenDeleted: Retain
+    whenScaled: Retain
+  updateStrategy:
+    type: RollingUpdate
+  template:
+    metadata:
+      labels:
+        app: postgres
+    spec:
+      serviceAccountName: postgres-vault
+      nodeSelector:
+        node-role.kubernetes.io/worker: "true"
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: node-role.kubernetes.io/worker
+                    operator: In
+                    values: ["true"]
+                  - key: hardware
+                    operator: In
+                    values: ["rpi4", "rpi5"]
+      containers:
+        - name: postgres
+          image: postgres:15
+          ports:
+            - name: postgres
+              containerPort: 5432
+              protocol: TCP
+          env:
+            - name: PGDATA
+              value: /var/lib/postgresql/data/pgdata
+            - name: POSTGRES_USER
+              value: postgres
+            - name: POSTGRES_PASSWORD_FILE
+              value: /mnt/vault/postgres_password
+            - name: POSTGRES_DB
+              value: postgres
+          volumeMounts:
+            - name: postgres-data
+              mountPath: /var/lib/postgresql/data
+            - name: vault-secrets
+              mountPath: /mnt/vault
+              readOnly: true
+      volumes:
+        - name: vault-secrets
+          csi:
+            driver: secrets-store.csi.k8s.io
+            readOnly: true
+            volumeAttributes:
+              secretProviderClass: postgres-vault
+  volumeClaimTemplates:
+    - metadata:
+        name: postgres-data
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        storageClassName: astreae
+        resources:
+          requests:
+            storage: 100Gi

infrastructure/sources/cert-manager/letsencrypt-prod.yaml

@@ -0,0 +1,14 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    email: brad.stein@gmail.com
+    server: https://acme-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: letsencrypt-prod-account-key
+    solvers:
+      - http01:
+          ingress:
+            class: traefik

infrastructure/sources/cert-manager/letsencrypt.yaml

@@ -4,7 +4,7 @@ metadata:
   name: letsencrypt
 spec:
   acme:
-    email: you@bstein.dev
+    email: brad.stein@gmail.com
     server: https://acme-v02.api.letsencrypt.org/directory
     privateKeySecretRef:
       name: letsencrypt-account-key