chore: refresh knowledge catalog headers

clusters/atlas/flux-system/applications/comms/kustomization.yaml

@@ -1,4 +1,4 @@
-# clusters/atlas/flux-system/applications/communication/kustomization.yaml
+# clusters/atlas/flux-system/applications/comms/kustomization.yaml
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:

clusters/atlas/flux-system/gotk-sync.yaml

@@ -1,3 +1,4 @@
+# clusters/atlas/flux-system/gotk-sync.yaml
 # This manifest was generated by flux. DO NOT EDIT.
 ---
 apiVersion: source.toolkit.fluxcd.io/v1

knowledge/catalog/atlas-summary.json

@@ -1,8 +1,8 @@
 {
   "counts": {
-    "helmrelease_host_hints": 7,
+    "helmrelease_host_hints": 17,
-    "http_endpoints": 35,
+    "http_endpoints": 37,
-    "services": 44,
+    "services": 43,
-    "workloads": 49
+    "workloads": 54
   }
 }

knowledge/catalog/atlas.json

@@ -12,12 +12,7 @@
       "targetNamespace": "bstein-dev-home"
     },
     {
-      "name": "ci-demo",
+      "name": "comms",
-      "path": "services/ci-demo",
-      "targetNamespace": null
-    },
-    {
-      "name": "communication",
       "path": "services/comms",
       "targetNamespace": "comms"
     },
@@ -71,6 +66,11 @@
       "path": "services/keycloak",
       "targetNamespace": "sso"
     },
+    {
+      "name": "logging",
+      "path": "services/logging",
+      "targetNamespace": null
+    },
     {
       "name": "longhorn-ui",
       "path": "infrastructure/longhorn/ui-ingress",
@@ -81,6 +81,11 @@
       "path": "services/mailu",
       "targetNamespace": "mailu-mailserver"
     },
+    {
+      "name": "maintenance",
+      "path": "services/maintenance",
+      "targetNamespace": null
+    },
     {
       "name": "metallb",
       "path": "infrastructure/metallb",
@@ -116,11 +121,26 @@
       "path": "services/openldap",
       "targetNamespace": "sso"
     },
+    {
+      "name": "outline",
+      "path": "services/outline",
+      "targetNamespace": "outline"
+    },
     {
       "name": "pegasus",
       "path": "services/pegasus",
       "targetNamespace": "jellyfin"
     },
+    {
+      "name": "planka",
+      "path": "services/planka",
+      "targetNamespace": "planka"
+    },
+    {
+      "name": "postgres",
+      "path": "infrastructure/postgres",
+      "targetNamespace": "postgres"
+    },
     {
       "name": "sui-metrics",
       "path": "services/sui-metrics/overlays/atlas",
@@ -163,7 +183,7 @@
       "serviceAccountName": null,
       "nodeSelector": {},
       "images": [
-        "ollama/ollama:latest"
+        "ollama/ollama@sha256:2c9595c555fd70a28363489ac03bd5bf9e7c5bdf2890373c3a830ffd7252ce6d"
       ]
     },
     {
@@ -179,7 +199,7 @@
         "node-role.kubernetes.io/worker": "true"
       },
       "images": [
-        "registry.bstein.dev/bstein/bstein-dev-home-backend:0.1.1-84"
+        "registry.bstein.dev/bstein/bstein-dev-home-backend:0.1.1-92"
       ]
     },
     {
@@ -195,7 +215,7 @@
         "node-role.kubernetes.io/worker": "true"
       },
       "images": [
-        "registry.bstein.dev/bstein/bstein-dev-home-frontend:0.1.1-84"
+        "registry.bstein.dev/bstein/bstein-dev-home-frontend:0.1.1-92"
       ]
     },
     {
@@ -214,21 +234,6 @@
         "python:3.11-slim"
       ]
     },
-    {
-      "kind": "Deployment",
-      "namespace": "ci-demo",
-      "name": "ci-demo",
-      "labels": {
-        "app.kubernetes.io/name": "ci-demo"
-      },
-      "serviceAccountName": null,
-      "nodeSelector": {
-        "hardware": "rpi4"
-      },
-      "images": [
-        "registry.bstein.dev/infra/ci-demo:v0.0.0-3"
-      ]
-    },
     {
       "kind": "Deployment",
       "namespace": "comms",
@@ -271,7 +276,7 @@
         "hardware": "rpi5"
       },
       "images": [
-        "ghcr.io/element-hq/element-call:latest"
+        "ghcr.io/element-hq/element-call@sha256:e6897c7818331714eae19d83ef8ea94a8b41115f0d8d3f62c2fed2d02c65c9bc"
       ]
     },
     {
@@ -345,56 +350,6 @@
         "nginx:1.27-alpine"
       ]
     },
-    {
-      "kind": "Deployment",
-      "namespace": "comms",
-      "name": "othrys-element-element-web",
-      "labels": {
-        "app.kubernetes.io/instance": "othrys-element",
-        "app.kubernetes.io/name": "element-web"
-      },
-      "serviceAccountName": "othrys-element-element-web",
-      "nodeSelector": {
-        "hardware": "rpi5"
-      },
-      "images": [
-        "ghcr.io/element-hq/element-web:v1.12.6"
-      ]
-    },
-    {
-      "kind": "Deployment",
-      "namespace": "comms",
-      "name": "othrys-synapse-matrix-synapse",
-      "labels": {
-        "app.kubernetes.io/component": "synapse",
-        "app.kubernetes.io/instance": "othrys-synapse",
-        "app.kubernetes.io/name": "matrix-synapse"
-      },
-      "serviceAccountName": "default",
-      "nodeSelector": {
-        "hardware": "rpi5"
-      },
-      "images": [
-        "ghcr.io/element-hq/synapse:v1.144.0"
-      ]
-    },
-    {
-      "kind": "Deployment",
-      "namespace": "comms",
-      "name": "othrys-synapse-redis-master",
-      "labels": {
-        "app.kubernetes.io/component": "master",
-        "app.kubernetes.io/instance": "othrys-synapse",
-        "app.kubernetes.io/managed-by": "Helm",
-        "app.kubernetes.io/name": "redis",
-        "helm.sh/chart": "redis-17.17.1"
-      },
-      "serviceAccountName": "othrys-synapse-redis",
-      "nodeSelector": {},
-      "images": [
-        "docker.io/bitnamilegacy/redis:7.0.12-debian-11-r34"
-      ]
-    },
     {
       "kind": "DaemonSet",
       "namespace": "crypto",
@@ -407,7 +362,7 @@
         "node-role.kubernetes.io/worker": "true"
       },
       "images": [
-        "ghcr.io/tari-project/xmrig:latest"
+        "ghcr.io/tari-project/xmrig@sha256:80defbfd0b640d604c91cb5101d3642db7928e1e68ee3c6b011289b3565a39d9"
       ]
     },
     {
@@ -681,6 +636,66 @@
         "hashicorp/vault-csi-provider:1.7.0"
       ]
     },
+    {
+      "kind": "DaemonSet",
+      "namespace": "logging",
+      "name": "node-image-gc-rpi4",
+      "labels": {
+        "app": "node-image-gc-rpi4"
+      },
+      "serviceAccountName": "node-image-gc-rpi4",
+      "nodeSelector": {
+        "hardware": "rpi4"
+      },
+      "images": [
+        "bitnami/kubectl@sha256:554ab88b1858e8424c55de37ad417b16f2a0e65d1607aa0f3fe3ce9b9f10b131"
+      ]
+    },
+    {
+      "kind": "DaemonSet",
+      "namespace": "logging",
+      "name": "node-image-prune-rpi5",
+      "labels": {
+        "app": "node-image-prune-rpi5"
+      },
+      "serviceAccountName": "node-image-prune-rpi5",
+      "nodeSelector": {
+        "hardware": "rpi5"
+      },
+      "images": [
+        "bitnami/kubectl@sha256:554ab88b1858e8424c55de37ad417b16f2a0e65d1607aa0f3fe3ce9b9f10b131"
+      ]
+    },
+    {
+      "kind": "DaemonSet",
+      "namespace": "logging",
+      "name": "node-log-rotation",
+      "labels": {
+        "app": "node-log-rotation"
+      },
+      "serviceAccountName": "node-log-rotation",
+      "nodeSelector": {
+        "hardware": "rpi5"
+      },
+      "images": [
+        "bitnami/kubectl@sha256:554ab88b1858e8424c55de37ad417b16f2a0e65d1607aa0f3fe3ce9b9f10b131"
+      ]
+    },
+    {
+      "kind": "Deployment",
+      "namespace": "logging",
+      "name": "oauth2-proxy-logs",
+      "labels": {
+        "app": "oauth2-proxy-logs"
+      },
+      "serviceAccountName": null,
+      "nodeSelector": {
+        "node-role.kubernetes.io/worker": "true"
+      },
+      "images": [
+        "quay.io/oauth2-proxy/oauth2-proxy:v7.6.0"
+      ]
+    },
     {
       "kind": "Deployment",
       "namespace": "longhorn-system",
@@ -708,7 +723,7 @@
         "mailu.bstein.dev/vip": "true"
       },
       "images": [
-        "lachlanevenson/k8s-kubectl:latest"
+        "registry.bstein.dev/bstein/kubectl:1.35.0"
       ]
     },
     {
@@ -726,37 +741,30 @@
     },
     {
       "kind": "DaemonSet",
-      "namespace": "metallb-system",
+      "namespace": "maintenance",
-      "name": "metallb-speaker",
+      "name": "node-image-sweeper",
       "labels": {
-        "app.kubernetes.io/component": "speaker",
+        "app": "node-image-sweeper"
-        "app.kubernetes.io/instance": "metallb",
-        "app.kubernetes.io/name": "metallb"
       },
-      "serviceAccountName": "metallb-speaker",
+      "serviceAccountName": "node-image-sweeper",
       "nodeSelector": {
         "kubernetes.io/os": "linux"
       },
       "images": [
-        "quay.io/frrouting/frr:10.4.1",
+        "python:3.12.9-alpine3.20"
-        "quay.io/metallb/speaker:v0.15.3"
       ]
     },
     {
-      "kind": "Deployment",
+      "kind": "DaemonSet",
-      "namespace": "metallb-system",
+      "namespace": "maintenance",
-      "name": "metallb-controller",
+      "name": "node-nofile",
       "labels": {
-        "app.kubernetes.io/component": "controller",
+        "app": "node-nofile"
-        "app.kubernetes.io/instance": "metallb",
-        "app.kubernetes.io/name": "metallb"
-      },
-      "serviceAccountName": "metallb-controller",
-      "nodeSelector": {
-        "kubernetes.io/os": "linux"
       },
+      "serviceAccountName": "node-nofile",
+      "nodeSelector": {},
       "images": [
-        "quay.io/metallb/controller:v0.15.3"
+        "bitnami/kubectl@sha256:554ab88b1858e8424c55de37ad417b16f2a0e65d1607aa0f3fe3ce9b9f10b131"
       ]
     },
     {
@@ -772,6 +780,21 @@
         "registry.bstein.dev/monitoring/dcgm-exporter:4.4.2-4.7.0-ubuntu22.04"
       ]
     },
+    {
+      "kind": "DaemonSet",
+      "namespace": "monitoring",
+      "name": "jetson-tegrastats-exporter",
+      "labels": {
+        "app": "jetson-tegrastats-exporter"
+      },
+      "serviceAccountName": "default",
+      "nodeSelector": {
+        "jetson": "true"
+      },
+      "images": [
+        "python:3.10-slim"
+      ]
+    },
     {
       "kind": "Deployment",
       "namespace": "monitoring",
@@ -797,7 +820,7 @@
         "hardware": "rpi5"
       },
       "images": [
-        "collabora/code:latest"
+        "collabora/code@sha256:3c58d0e9bae75e4647467d0c7d91cb66f261d3e814709aed590b5c334a04db26"
       ]
     },
     {
@@ -815,6 +838,66 @@
         "nextcloud:29-apache"
       ]
     },
+    {
+      "kind": "Deployment",
+      "namespace": "outline",
+      "name": "outline",
+      "labels": {
+        "app": "outline"
+      },
+      "serviceAccountName": null,
+      "nodeSelector": {
+        "node-role.kubernetes.io/worker": "true"
+      },
+      "images": [
+        "outlinewiki/outline:1.2.0"
+      ]
+    },
+    {
+      "kind": "Deployment",
+      "namespace": "outline",
+      "name": "outline-redis",
+      "labels": {
+        "app": "outline-redis"
+      },
+      "serviceAccountName": null,
+      "nodeSelector": {
+        "node-role.kubernetes.io/worker": "true"
+      },
+      "images": [
+        "redis:7.4.1-alpine"
+      ]
+    },
+    {
+      "kind": "Deployment",
+      "namespace": "planka",
+      "name": "planka",
+      "labels": {
+        "app": "planka"
+      },
+      "serviceAccountName": null,
+      "nodeSelector": {
+        "node-role.kubernetes.io/worker": "true"
+      },
+      "images": [
+        "ghcr.io/plankanban/planka:2.0.0-rc.4"
+      ]
+    },
+    {
+      "kind": "StatefulSet",
+      "namespace": "postgres",
+      "name": "postgres",
+      "labels": {
+        "app": "postgres"
+      },
+      "serviceAccountName": "postgres-vault",
+      "nodeSelector": {
+        "node-role.kubernetes.io/worker": "true"
+      },
+      "images": [
+        "postgres:15"
+      ]
+    },
     {
       "kind": "Deployment",
       "namespace": "sso",
@@ -984,22 +1067,6 @@
         }
       ]
     },
-    {
-      "namespace": "ci-demo",
-      "name": "ci-demo",
-      "type": "ClusterIP",
-      "selector": {
-        "app.kubernetes.io/name": "ci-demo"
-      },
-      "ports": [
-        {
-          "name": "http",
-          "port": 80,
-          "targetPort": "http",
-          "protocol": "TCP"
-        }
-      ]
-    },
     {
       "namespace": "comms",
       "name": "coturn",
@@ -1454,94 +1521,6 @@
         }
       ]
     },
-    {
-      "namespace": "comms",
-      "name": "othrys-element-element-web",
-      "type": "ClusterIP",
-      "selector": {
-        "app.kubernetes.io/instance": "othrys-element",
-        "app.kubernetes.io/name": "element-web"
-      },
-      "ports": [
-        {
-          "name": "http",
-          "port": 80,
-          "targetPort": "http",
-          "protocol": "TCP"
-        }
-      ]
-    },
-    {
-      "namespace": "comms",
-      "name": "othrys-synapse-matrix-synapse",
-      "type": "ClusterIP",
-      "selector": {
-        "app.kubernetes.io/component": "synapse",
-        "app.kubernetes.io/instance": "othrys-synapse",
-        "app.kubernetes.io/name": "matrix-synapse"
-      },
-      "ports": [
-        {
-          "name": "http",
-          "port": 8008,
-          "targetPort": "http",
-          "protocol": "TCP"
-        }
-      ]
-    },
-    {
-      "namespace": "comms",
-      "name": "othrys-synapse-redis-headless",
-      "type": "ClusterIP",
-      "selector": {
-        "app.kubernetes.io/instance": "othrys-synapse",
-        "app.kubernetes.io/name": "redis"
-      },
-      "ports": [
-        {
-          "name": "tcp-redis",
-          "port": 6379,
-          "targetPort": "redis",
-          "protocol": "TCP"
-        }
-      ]
-    },
-    {
-      "namespace": "comms",
-      "name": "othrys-synapse-redis-master",
-      "type": "ClusterIP",
-      "selector": {
-        "app.kubernetes.io/component": "master",
-        "app.kubernetes.io/instance": "othrys-synapse",
-        "app.kubernetes.io/name": "redis"
-      },
-      "ports": [
-        {
-          "name": "tcp-redis",
-          "port": 6379,
-          "targetPort": "redis",
-          "protocol": "TCP"
-        }
-      ]
-    },
-    {
-      "namespace": "comms",
-      "name": "othrys-synapse-replication",
-      "type": "ClusterIP",
-      "selector": {
-        "app.kubernetes.io/component": "synapse",
-        "app.kubernetes.io/instance": "othrys-synapse",
-        "app.kubernetes.io/name": "matrix-synapse"
-      },
-      "ports": [
-        {
-          "name": "replication",
-          "port": 9093,
-          "targetPort": "replication",
-          "protocol": "TCP"
-        }
-      ]
-    },
     {
       "namespace": "crypto",
       "name": "monerod",
@@ -1743,6 +1722,22 @@
         }
       ]
     },
+    {
+      "namespace": "logging",
+      "name": "oauth2-proxy-logs",
+      "type": "ClusterIP",
+      "selector": {
+        "app": "oauth2-proxy-logs"
+      },
+      "ports": [
+        {
+          "name": "http",
+          "port": 80,
+          "targetPort": 4180,
+          "protocol": "TCP"
+        }
+      ]
+    },
     {
       "namespace": "longhorn-system",
       "name": "oauth2-proxy-longhorn",
@@ -1823,24 +1818,6 @@
         }
       ]
     },
-    {
-      "namespace": "metallb-system",
-      "name": "metallb-webhook-service",
-      "type": "ClusterIP",
-      "selector": {
-        "app.kubernetes.io/component": "controller",
-        "app.kubernetes.io/instance": "metallb",
-        "app.kubernetes.io/name": "metallb"
-      },
-      "ports": [
-        {
-          "name": null,
-          "port": 443,
-          "targetPort": 9443,
-          "protocol": "TCP"
-        }
-      ]
-    },
     {
       "namespace": "monitoring",
       "name": "dcgm-exporter",
@@ -1857,6 +1834,22 @@
         }
       ]
     },
+    {
+      "namespace": "monitoring",
+      "name": "jetson-tegrastats-exporter",
+      "type": "ClusterIP",
+      "selector": {
+        "app": "jetson-tegrastats-exporter"
+      },
+      "ports": [
+        {
+          "name": "metrics",
+          "port": 9100,
+          "targetPort": "metrics",
+          "protocol": "TCP"
+        }
+      ]
+    },
     {
       "namespace": "monitoring",
       "name": "postmark-exporter",
@@ -1905,6 +1898,70 @@
         }
       ]
     },
+    {
+      "namespace": "outline",
+      "name": "outline",
+      "type": "ClusterIP",
+      "selector": {
+        "app": "outline"
+      },
+      "ports": [
+        {
+          "name": "http",
+          "port": 80,
+          "targetPort": "http",
+          "protocol": "TCP"
+        }
+      ]
+    },
+    {
+      "namespace": "outline",
+      "name": "outline-redis",
+      "type": "ClusterIP",
+      "selector": {
+        "app": "outline-redis"
+      },
+      "ports": [
+        {
+          "name": "redis",
+          "port": 6379,
+          "targetPort": "redis",
+          "protocol": "TCP"
+        }
+      ]
+    },
+    {
+      "namespace": "planka",
+      "name": "planka",
+      "type": "ClusterIP",
+      "selector": {
+        "app": "planka"
+      },
+      "ports": [
+        {
+          "name": "http",
+          "port": 80,
+          "targetPort": "http",
+          "protocol": "TCP"
+        }
+      ]
+    },
+    {
+      "namespace": "postgres",
+      "name": "postgres-service",
+      "type": "ClusterIP",
+      "selector": {
+        "app": "postgres"
+      },
+      "ports": [
+        {
+          "name": "postgres",
+          "port": 5432,
+          "targetPort": 5432,
+          "protocol": "TCP"
+        }
+      ]
+    },
     {
       "namespace": "sso",
       "name": "keycloak",
@@ -2110,7 +2167,7 @@
       "via": {
         "kind": "Ingress",
         "name": "matrix-wellknown-bstein-dev",
-        "source": "communication"
+        "source": "comms"
       }
     },
     {
@@ -2130,7 +2187,7 @@
       "via": {
         "kind": "Ingress",
         "name": "matrix-wellknown-bstein-dev",
-        "source": "communication"
+        "source": "comms"
       }
     },
     {
@@ -2170,7 +2227,7 @@
       "via": {
         "kind": "Ingress",
         "name": "element-call",
-        "source": "communication"
+        "source": "comms"
       }
     },
     {
@@ -2250,7 +2307,7 @@
       "via": {
         "kind": "Ingress",
         "name": "livekit-jwt-ingress",
-        "source": "communication"
+        "source": "comms"
       }
     },
     {
@@ -2270,27 +2327,7 @@
       "via": {
         "kind": "Ingress",
         "name": "livekit-ingress",
-        "source": "communication"
+        "source": "comms"
-      }
-    },
-    {
-      "host": "live.bstein.dev",
-      "path": "/",
-      "backend": {
-        "namespace": "comms",
-        "service": "othrys-element-element-web",
-        "port": 80,
-        "workloads": [
-          {
-            "kind": "Deployment",
-            "name": "othrys-element-element-web"
-          }
-        ]
-      },
-      "via": {
-        "kind": "Ingress",
-        "name": "othrys-element-element-web",
-        "source": "communication"
       }
     },
     {
@@ -2310,7 +2347,7 @@
       "via": {
         "kind": "Ingress",
         "name": "matrix-wellknown",
-        "source": "communication"
+        "source": "comms"
       }
     },
     {
@@ -2330,7 +2367,7 @@
       "via": {
         "kind": "Ingress",
         "name": "matrix-wellknown",
-        "source": "communication"
+        "source": "comms"
       }
     },
     {
@@ -2340,17 +2377,32 @@
         "namespace": "comms",
         "service": "othrys-synapse-matrix-synapse",
         "port": 8008,
+        "workloads": []
+      },
+      "via": {
+        "kind": "Ingress",
+        "name": "matrix-routing",
+        "source": "comms"
+      }
+    },
+    {
+      "host": "logs.bstein.dev",
+      "path": "/",
+      "backend": {
+        "namespace": "logging",
+        "service": "oauth2-proxy-logs",
+        "port": "http",
         "workloads": [
           {
             "kind": "Deployment",
-            "name": "othrys-synapse-matrix-synapse"
+            "name": "oauth2-proxy-logs"
           }
         ]
       },
       "via": {
         "kind": "Ingress",
-        "name": "matrix-routing",
+        "name": "logs",
-        "source": "communication"
+        "source": "logging"
       }
     },
     {
@@ -2405,7 +2457,7 @@
       "via": {
         "kind": "Ingress",
         "name": "matrix-routing",
-        "source": "communication"
+        "source": "comms"
       }
     },
     {
@@ -2425,7 +2477,7 @@
       "via": {
         "kind": "Ingress",
         "name": "matrix-wellknown-matrix-live",
-        "source": "communication"
+        "source": "comms"
       }
     },
     {
@@ -2445,7 +2497,7 @@
       "via": {
         "kind": "Ingress",
         "name": "matrix-wellknown-matrix-live",
-        "source": "communication"
+        "source": "comms"
       }
     },
     {
@@ -2455,17 +2507,12 @@
         "namespace": "comms",
         "service": "othrys-synapse-matrix-synapse",
         "port": 8008,
-        "workloads": [
+        "workloads": []
-          {
-            "kind": "Deployment",
-            "name": "othrys-synapse-matrix-synapse"
-          }
-        ]
       },
       "via": {
         "kind": "Ingress",
         "name": "matrix-routing",
-        "source": "communication"
+        "source": "comms"
       }
     },
     {
@@ -2485,7 +2532,7 @@
       "via": {
         "kind": "Ingress",
         "name": "matrix-routing",
-        "source": "communication"
+        "source": "comms"
       }
     },
     {
@@ -2505,7 +2552,7 @@
       "via": {
         "kind": "Ingress",
         "name": "matrix-routing",
-        "source": "communication"
+        "source": "comms"
       }
     },
     {
@@ -2525,7 +2572,7 @@
       "via": {
         "kind": "Ingress",
         "name": "matrix-routing",
-        "source": "communication"
+        "source": "comms"
       }
     },
     {
@@ -2545,7 +2592,7 @@
       "via": {
         "kind": "Ingress",
         "name": "matrix-routing",
-        "source": "communication"
+        "source": "comms"
       }
     },
     {
@@ -2565,7 +2612,7 @@
       "via": {
         "kind": "Ingress",
         "name": "matrix-routing",
-        "source": "communication"
+        "source": "comms"
       }
     },
     {
@@ -2575,17 +2622,12 @@
         "namespace": "comms",
         "service": "othrys-synapse-matrix-synapse",
         "port": 8008,
-        "workloads": [
+        "workloads": []
-          {
-            "kind": "Deployment",
-            "name": "othrys-synapse-matrix-synapse"
-          }
-        ]
       },
       "via": {
         "kind": "Ingress",
         "name": "matrix-routing",
-        "source": "communication"
+        "source": "comms"
       }
     },
     {
@@ -2608,6 +2650,26 @@
         "source": "monerod"
       }
     },
+    {
+      "host": "notes.bstein.dev",
+      "path": "/",
+      "backend": {
+        "namespace": "outline",
+        "service": "outline",
+        "port": 80,
+        "workloads": [
+          {
+            "kind": "Deployment",
+            "name": "outline"
+          }
+        ]
+      },
+      "via": {
+        "kind": "Ingress",
+        "name": "outline",
+        "source": "outline"
+      }
+    },
     {
       "host": "office.bstein.dev",
       "path": "/",
@@ -2728,6 +2790,26 @@
         "source": "jellyfin"
       }
     },
+    {
+      "host": "tasks.bstein.dev",
+      "path": "/",
+      "backend": {
+        "namespace": "planka",
+        "service": "planka",
+        "port": 80,
+        "workloads": [
+          {
+            "kind": "Deployment",
+            "name": "planka"
+          }
+        ]
+      },
+      "via": {
+        "kind": "Ingress",
+        "name": "planka",
+        "source": "planka"
+      }
+    },
     {
       "host": "vault.bstein.dev",
       "path": "/",
@@ -2750,12 +2832,27 @@
     }
   ],
   "helmrelease_host_hints": {
+    "comms:comms/othrys-element": [
+      "call.live.bstein.dev",
+      "live.bstein.dev",
+      "matrix.live.bstein.dev"
+    ],
+    "comms:comms/othrys-synapse": [
+      "bstein.dev",
+      "kit.live.bstein.dev",
+      "live.bstein.dev",
+      "matrix.live.bstein.dev",
+      "turn.live.bstein.dev"
+    ],
     "gitops-ui:flux-system/weave-gitops": [
       "cd.bstein.dev"
     ],
     "harbor:harbor/harbor": [
       "registry.bstein.dev"
     ],
+    "logging:logging/data-prepper": [
+      "registry.bstein.dev"
+    ],
     "mailu:mailu-mailserver/mailu": [
       "bstein.dev",
       "mail.bstein.dev"
@@ -2764,6 +2861,7 @@
       "alerts.bstein.dev"
     ],
     "monitoring:monitoring/grafana": [
+      "bstein.dev",
       "metrics.bstein.dev",
       "sso.bstein.dev"
     ]

knowledge/catalog/atlas.yaml

@@ -1,3 +1,4 @@
+# knowledge/catalog/atlas.yaml
 # Generated by scripts/knowledge_render_atlas.py (do not edit by hand)
 cluster: atlas
 sources:
@@ -7,7 +8,7 @@ sources:
 - name: bstein-dev-home
   path: services/bstein-dev-home
   targetNamespace: bstein-dev-home
-- name: communication
+- name: comms
   path: services/comms
   targetNamespace: comms
 - name: core
@@ -40,12 +41,18 @@ sources:
 - name: keycloak
   path: services/keycloak
   targetNamespace: sso
+- name: logging
+  path: services/logging
+  targetNamespace: null
 - name: longhorn-ui
   path: infrastructure/longhorn/ui-ingress
   targetNamespace: longhorn-system
 - name: mailu
   path: services/mailu
   targetNamespace: mailu-mailserver
+- name: maintenance
+  path: services/maintenance
+  targetNamespace: null
 - name: metallb
   path: infrastructure/metallb
   targetNamespace: metallb-system
@@ -67,9 +74,18 @@ sources:
 - name: openldap
   path: services/openldap
   targetNamespace: sso
+- name: outline
+  path: services/outline
+  targetNamespace: outline
 - name: pegasus
   path: services/pegasus
   targetNamespace: jellyfin
+- name: planka
+  path: services/planka
+  targetNamespace: planka
+- name: postgres
+  path: infrastructure/postgres
+  targetNamespace: postgres
 - name: sui-metrics
   path: services/sui-metrics/overlays/atlas
   targetNamespace: sui-metrics
@@ -97,7 +113,7 @@ workloads:
   serviceAccountName: null
   nodeSelector: {}
   images:
-  - ollama/ollama:latest
+  - ollama/ollama@sha256:2c9595c555fd70a28363489ac03bd5bf9e7c5bdf2890373c3a830ffd7252ce6d
 - kind: Deployment
   namespace: bstein-dev-home
   name: bstein-dev-home-backend
@@ -108,7 +124,7 @@ workloads:
     kubernetes.io/arch: arm64
     node-role.kubernetes.io/worker: 'true'
   images:
-  - registry.bstein.dev/bstein/bstein-dev-home-backend:0.1.1-84
+  - registry.bstein.dev/bstein/bstein-dev-home-backend:0.1.1-92
 - kind: Deployment
   namespace: bstein-dev-home
   name: bstein-dev-home-frontend
@@ -119,7 +135,7 @@ workloads:
     kubernetes.io/arch: arm64
     node-role.kubernetes.io/worker: 'true'
   images:
-  - registry.bstein.dev/bstein/bstein-dev-home-frontend:0.1.1-84
+  - registry.bstein.dev/bstein/bstein-dev-home-frontend:0.1.1-92
 - kind: Deployment
   namespace: bstein-dev-home
   name: chat-ai-gateway
@@ -160,7 +176,7 @@ workloads:
   nodeSelector:
     hardware: rpi5
   images:
-  - ghcr.io/element-hq/element-call:latest
+  - ghcr.io/element-hq/element-call@sha256:e6897c7818331714eae19d83ef8ea94a8b41115f0d8d3f62c2fed2d02c65c9bc
 - kind: Deployment
   namespace: comms
   name: livekit
@@ -209,42 +225,6 @@ workloads:
   nodeSelector: {}
   images:
   - nginx:1.27-alpine
-- kind: Deployment
-  namespace: comms
-  name: othrys-element-element-web
-  labels:
-    app.kubernetes.io/instance: othrys-element
-    app.kubernetes.io/name: element-web
-  serviceAccountName: othrys-element-element-web
-  nodeSelector:
-    hardware: rpi5
-  images:
-  - ghcr.io/element-hq/element-web:v1.12.6
-- kind: Deployment
-  namespace: comms
-  name: othrys-synapse-matrix-synapse
-  labels:
-    app.kubernetes.io/component: synapse
-    app.kubernetes.io/instance: othrys-synapse
-    app.kubernetes.io/name: matrix-synapse
-  serviceAccountName: default
-  nodeSelector:
-    hardware: rpi5
-  images:
-  - ghcr.io/element-hq/synapse:v1.144.0
-- kind: Deployment
-  namespace: comms
-  name: othrys-synapse-redis-master
-  labels:
-    app.kubernetes.io/component: master
-    app.kubernetes.io/instance: othrys-synapse
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: redis
-    helm.sh/chart: redis-17.17.1
-  serviceAccountName: othrys-synapse-redis
-  nodeSelector: {}
-  images:
-  - docker.io/bitnamilegacy/redis:7.0.12-debian-11-r34
 - kind: DaemonSet
   namespace: crypto
   name: monero-xmrig
@@ -254,7 +234,7 @@ workloads:
   nodeSelector:
     node-role.kubernetes.io/worker: 'true'
   images:
-  - ghcr.io/tari-project/xmrig:latest
+  - ghcr.io/tari-project/xmrig@sha256:80defbfd0b640d604c91cb5101d3642db7928e1e68ee3c6b011289b3565a39d9
 - kind: Deployment
   namespace: crypto
   name: monero-p2pool
@@ -447,6 +427,46 @@ workloads:
     kubernetes.io/os: linux
   images:
   - hashicorp/vault-csi-provider:1.7.0
+- kind: DaemonSet
+  namespace: logging
+  name: node-image-gc-rpi4
+  labels:
+    app: node-image-gc-rpi4
+  serviceAccountName: node-image-gc-rpi4
+  nodeSelector:
+    hardware: rpi4
+  images:
+  - bitnami/kubectl@sha256:554ab88b1858e8424c55de37ad417b16f2a0e65d1607aa0f3fe3ce9b9f10b131
+- kind: DaemonSet
+  namespace: logging
+  name: node-image-prune-rpi5
+  labels:
+    app: node-image-prune-rpi5
+  serviceAccountName: node-image-prune-rpi5
+  nodeSelector:
+    hardware: rpi5
+  images:
+  - bitnami/kubectl@sha256:554ab88b1858e8424c55de37ad417b16f2a0e65d1607aa0f3fe3ce9b9f10b131
+- kind: DaemonSet
+  namespace: logging
+  name: node-log-rotation
+  labels:
+    app: node-log-rotation
+  serviceAccountName: node-log-rotation
+  nodeSelector:
+    hardware: rpi5
+  images:
+  - bitnami/kubectl@sha256:554ab88b1858e8424c55de37ad417b16f2a0e65d1607aa0f3fe3ce9b9f10b131
+- kind: Deployment
+  namespace: logging
+  name: oauth2-proxy-logs
+  labels:
+    app: oauth2-proxy-logs
+  serviceAccountName: null
+  nodeSelector:
+    node-role.kubernetes.io/worker: 'true'
+  images:
+  - quay.io/oauth2-proxy/oauth2-proxy:v7.6.0
 - kind: Deployment
   namespace: longhorn-system
   name: oauth2-proxy-longhorn
@@ -466,7 +486,7 @@ workloads:
   nodeSelector:
     mailu.bstein.dev/vip: 'true'
   images:
-  - lachlanevenson/k8s-kubectl:latest
+  - registry.bstein.dev/bstein/kubectl:1.35.0
 - kind: Deployment
   namespace: mailu-mailserver
   name: mailu-sync-listener
@@ -477,30 +497,24 @@ workloads:
   images:
   - python:3.11-alpine
 - kind: DaemonSet
-  namespace: metallb-system
+  namespace: maintenance
-  name: metallb-speaker
+  name: node-image-sweeper
   labels:
-    app.kubernetes.io/component: speaker
+    app: node-image-sweeper
-    app.kubernetes.io/instance: metallb
+  serviceAccountName: node-image-sweeper
-    app.kubernetes.io/name: metallb
-  serviceAccountName: metallb-speaker
   nodeSelector:
     kubernetes.io/os: linux
   images:
-  - quay.io/frrouting/frr:10.4.1
+  - python:3.12.9-alpine3.20
-  - quay.io/metallb/speaker:v0.15.3
+- kind: DaemonSet
-- kind: Deployment
+  namespace: maintenance
-  namespace: metallb-system
+  name: node-nofile
-  name: metallb-controller
   labels:
-    app.kubernetes.io/component: controller
+    app: node-nofile
-    app.kubernetes.io/instance: metallb
+  serviceAccountName: node-nofile
-    app.kubernetes.io/name: metallb
+  nodeSelector: {}
-  serviceAccountName: metallb-controller
-  nodeSelector:
-    kubernetes.io/os: linux
   images:
-  - quay.io/metallb/controller:v0.15.3
+  - bitnami/kubectl@sha256:554ab88b1858e8424c55de37ad417b16f2a0e65d1607aa0f3fe3ce9b9f10b131
 - kind: DaemonSet
   namespace: monitoring
   name: dcgm-exporter
@@ -510,6 +524,16 @@ workloads:
   nodeSelector: {}
   images:
   - registry.bstein.dev/monitoring/dcgm-exporter:4.4.2-4.7.0-ubuntu22.04
+- kind: DaemonSet
+  namespace: monitoring
+  name: jetson-tegrastats-exporter
+  labels:
+    app: jetson-tegrastats-exporter
+  serviceAccountName: default
+  nodeSelector:
+    jetson: 'true'
+  images:
+  - python:3.10-slim
 - kind: Deployment
   namespace: monitoring
   name: postmark-exporter
@@ -528,7 +552,7 @@ workloads:
   nodeSelector:
     hardware: rpi5
   images:
-  - collabora/code:latest
+  - collabora/code@sha256:3c58d0e9bae75e4647467d0c7d91cb66f261d3e814709aed590b5c334a04db26
 - kind: Deployment
   namespace: nextcloud
   name: nextcloud
@@ -539,6 +563,46 @@ workloads:
     hardware: rpi5
   images:
   - nextcloud:29-apache
+- kind: Deployment
+  namespace: outline
+  name: outline
+  labels:
+    app: outline
+  serviceAccountName: null
+  nodeSelector:
+    node-role.kubernetes.io/worker: 'true'
+  images:
+  - outlinewiki/outline:1.2.0
+- kind: Deployment
+  namespace: outline
+  name: outline-redis
+  labels:
+    app: outline-redis
+  serviceAccountName: null
+  nodeSelector:
+    node-role.kubernetes.io/worker: 'true'
+  images:
+  - redis:7.4.1-alpine
+- kind: Deployment
+  namespace: planka
+  name: planka
+  labels:
+    app: planka
+  serviceAccountName: null
+  nodeSelector:
+    node-role.kubernetes.io/worker: 'true'
+  images:
+  - ghcr.io/plankanban/planka:2.0.0-rc.4
+- kind: StatefulSet
+  namespace: postgres
+  name: postgres
+  labels:
+    app: postgres
+  serviceAccountName: postgres-vault
+  nodeSelector:
+    node-role.kubernetes.io/worker: 'true'
+  images:
+  - postgres:15
 - kind: Deployment
   namespace: sso
   name: keycloak
@@ -650,16 +714,6 @@ services:
     port: 80
     targetPort: 8080
     protocol: TCP
-- namespace: ci-demo
-  name: ci-demo
-  type: ClusterIP
-  selector:
-    app.kubernetes.io/name: ci-demo
-  ports:
-  - name: http
-    port: 80
-    targetPort: http
-    protocol: TCP
 - namespace: comms
   name: coturn
   type: LoadBalancer
@@ -958,64 +1012,6 @@ services:
     port: 80
     targetPort: 80
     protocol: TCP
-- namespace: comms
-  name: othrys-element-element-web
-  type: ClusterIP
-  selector:
-    app.kubernetes.io/instance: othrys-element
-    app.kubernetes.io/name: element-web
-  ports:
-  - name: http
-    port: 80
-    targetPort: http
-    protocol: TCP
-- namespace: comms
-  name: othrys-synapse-matrix-synapse
-  type: ClusterIP
-  selector:
-    app.kubernetes.io/component: synapse
-    app.kubernetes.io/instance: othrys-synapse
-    app.kubernetes.io/name: matrix-synapse
-  ports:
-  - name: http
-    port: 8008
-    targetPort: http
-    protocol: TCP
-- namespace: comms
-  name: othrys-synapse-redis-headless
-  type: ClusterIP
-  selector:
-    app.kubernetes.io/instance: othrys-synapse
-    app.kubernetes.io/name: redis
-  ports:
-  - name: tcp-redis
-    port: 6379
-    targetPort: redis
-    protocol: TCP
-- namespace: comms
-  name: othrys-synapse-redis-master
-  type: ClusterIP
-  selector:
-    app.kubernetes.io/component: master
-    app.kubernetes.io/instance: othrys-synapse
-    app.kubernetes.io/name: redis
-  ports:
-  - name: tcp-redis
-    port: 6379
-    targetPort: redis
-    protocol: TCP
-- namespace: comms
-  name: othrys-synapse-replication
-  type: ClusterIP
-  selector:
-    app.kubernetes.io/component: synapse
-    app.kubernetes.io/instance: othrys-synapse
-    app.kubernetes.io/name: matrix-synapse
-  ports:
-  - name: replication
-    port: 9093
-    targetPort: replication
-    protocol: TCP
 - namespace: crypto
   name: monerod
   type: ClusterIP
@@ -1143,6 +1139,16 @@ services:
     port: 443
     targetPort: websecure
     protocol: TCP
+- namespace: logging
+  name: oauth2-proxy-logs
+  type: ClusterIP
+  selector:
+    app: oauth2-proxy-logs
+  ports:
+  - name: http
+    port: 80
+    targetPort: 4180
+    protocol: TCP
 - namespace: longhorn-system
   name: oauth2-proxy-longhorn
   type: ClusterIP
@@ -1195,18 +1201,6 @@ services:
     port: 8080
     targetPort: 8080
     protocol: TCP
-- namespace: metallb-system
-  name: metallb-webhook-service
-  type: ClusterIP
-  selector:
-    app.kubernetes.io/component: controller
-    app.kubernetes.io/instance: metallb
-    app.kubernetes.io/name: metallb
-  ports:
-  - name: null
-    port: 443
-    targetPort: 9443
-    protocol: TCP
 - namespace: monitoring
   name: dcgm-exporter
   type: ClusterIP
@@ -1217,6 +1211,16 @@ services:
     port: 9400
     targetPort: metrics
     protocol: TCP
+- namespace: monitoring
+  name: jetson-tegrastats-exporter
+  type: ClusterIP
+  selector:
+    app: jetson-tegrastats-exporter
+  ports:
+  - name: metrics
+    port: 9100
+    targetPort: metrics
+    protocol: TCP
 - namespace: monitoring
   name: postmark-exporter
   type: ClusterIP
@@ -1247,6 +1251,46 @@ services:
     port: 80
     targetPort: http
     protocol: TCP
+- namespace: outline
+  name: outline
+  type: ClusterIP
+  selector:
+    app: outline
+  ports:
+  - name: http
+    port: 80
+    targetPort: http
+    protocol: TCP
+- namespace: outline
+  name: outline-redis
+  type: ClusterIP
+  selector:
+    app: outline-redis
+  ports:
+  - name: redis
+    port: 6379
+    targetPort: redis
+    protocol: TCP
+- namespace: planka
+  name: planka
+  type: ClusterIP
+  selector:
+    app: planka
+  ports:
+  - name: http
+    port: 80
+    targetPort: http
+    protocol: TCP
+- namespace: postgres
+  name: postgres-service
+  type: ClusterIP
+  selector:
+    app: postgres
+  ports:
+  - name: postgres
+    port: 5432
+    targetPort: 5432
+    protocol: TCP
 - namespace: sso
   name: keycloak
   type: ClusterIP
@@ -1378,7 +1422,7 @@ http_endpoints:
   via:
     kind: Ingress
     name: matrix-wellknown-bstein-dev
-    source: communication
+    source: comms
 - host: bstein.dev
   path: /.well-known/matrix/server
   backend:
@@ -1389,7 +1433,7 @@ http_endpoints:
   via:
     kind: Ingress
     name: matrix-wellknown-bstein-dev
-    source: communication
+    source: comms
 - host: bstein.dev
   path: /api
   backend:
@@ -1415,7 +1459,7 @@ http_endpoints:
   via:
     kind: Ingress
     name: element-call
-    source: communication
+    source: comms
 - host: chat.ai.bstein.dev
   path: /
   backend:
@@ -1467,7 +1511,7 @@ http_endpoints:
   via:
     kind: Ingress
     name: livekit-jwt-ingress
-    source: communication
+    source: comms
 - host: kit.live.bstein.dev
   path: /livekit/sfu
   backend:
@@ -1480,20 +1524,7 @@ http_endpoints:
   via:
     kind: Ingress
     name: livekit-ingress
-    source: communication
+    source: comms
-- host: live.bstein.dev
-  path: /
-  backend:
-    namespace: comms
-    service: othrys-element-element-web
-    port: 80
-    workloads:
-    - kind: Deployment
-      name: othrys-element-element-web
-  via:
-    kind: Ingress
-    name: othrys-element-element-web
-    source: communication
 - host: live.bstein.dev
   path: /.well-known/matrix/client
   backend:
@@ -1504,7 +1535,7 @@ http_endpoints:
   via:
     kind: Ingress
     name: matrix-wellknown
-    source: communication
+    source: comms
 - host: live.bstein.dev
   path: /.well-known/matrix/server
   backend:
@@ -1515,20 +1546,31 @@ http_endpoints:
   via:
     kind: Ingress
     name: matrix-wellknown
-    source: communication
+    source: comms
 - host: live.bstein.dev
   path: /_matrix
   backend:
     namespace: comms
     service: othrys-synapse-matrix-synapse
     port: 8008
-    workloads: &id002
+    workloads: []
-    - kind: Deployment
-      name: othrys-synapse-matrix-synapse
   via:
     kind: Ingress
     name: matrix-routing
-    source: communication
+    source: comms
+- host: logs.bstein.dev
+  path: /
+  backend:
+    namespace: logging
+    service: oauth2-proxy-logs
+    port: http
+    workloads:
+    - kind: Deployment
+      name: oauth2-proxy-logs
+  via:
+    kind: Ingress
+    name: logs
+    source: logging
 - host: longhorn.bstein.dev
   path: /
   backend:
@@ -1559,13 +1601,13 @@ http_endpoints:
     namespace: comms
     service: matrix-authentication-service
     port: 8080
-    workloads: &id003
+    workloads: &id002
     - kind: Deployment
       name: matrix-authentication-service
   via:
     kind: Ingress
     name: matrix-routing
-    source: communication
+    source: comms
 - host: matrix.live.bstein.dev
   path: /.well-known/matrix/client
   backend:
@@ -1576,7 +1618,7 @@ http_endpoints:
   via:
     kind: Ingress
     name: matrix-wellknown-matrix-live
-    source: communication
+    source: comms
 - host: matrix.live.bstein.dev
   path: /.well-known/matrix/server
   backend:
@@ -1587,86 +1629,86 @@ http_endpoints:
   via:
     kind: Ingress
     name: matrix-wellknown-matrix-live
-    source: communication
+    source: comms
 - host: matrix.live.bstein.dev
   path: /_matrix
   backend:
     namespace: comms
     service: othrys-synapse-matrix-synapse
     port: 8008
-    workloads: *id002
+    workloads: []
   via:
     kind: Ingress
     name: matrix-routing
-    source: communication
+    source: comms
 - host: matrix.live.bstein.dev
   path: /_matrix/client/r0/register
   backend:
     namespace: comms
     service: matrix-guest-register
     port: 8080
-    workloads: &id004
+    workloads: &id003
     - kind: Deployment
       name: matrix-guest-register
   via:
     kind: Ingress
     name: matrix-routing
-    source: communication
+    source: comms
 - host: matrix.live.bstein.dev
   path: /_matrix/client/v3/login
   backend:
     namespace: comms
     service: matrix-authentication-service
     port: 8080
-    workloads: *id003
+    workloads: *id002
   via:
     kind: Ingress
     name: matrix-routing
-    source: communication
+    source: comms
 - host: matrix.live.bstein.dev
   path: /_matrix/client/v3/logout
   backend:
     namespace: comms
     service: matrix-authentication-service
     port: 8080
-    workloads: *id003
+    workloads: *id002
   via:
     kind: Ingress
     name: matrix-routing
-    source: communication
+    source: comms
 - host: matrix.live.bstein.dev
   path: /_matrix/client/v3/refresh
   backend:
     namespace: comms
     service: matrix-authentication-service
     port: 8080
-    workloads: *id003
+    workloads: *id002
   via:
     kind: Ingress
     name: matrix-routing
-    source: communication
+    source: comms
 - host: matrix.live.bstein.dev
   path: /_matrix/client/v3/register
   backend:
     namespace: comms
     service: matrix-guest-register
     port: 8080
-    workloads: *id004
+    workloads: *id003
   via:
     kind: Ingress
     name: matrix-routing
-    source: communication
+    source: comms
 - host: matrix.live.bstein.dev
   path: /_synapse
   backend:
     namespace: comms
     service: othrys-synapse-matrix-synapse
     port: 8008
-    workloads: *id002
+    workloads: []
   via:
     kind: Ingress
     name: matrix-routing
-    source: communication
+    source: comms
 - host: monero.bstein.dev
   path: /
   backend:
@@ -1680,6 +1722,19 @@ http_endpoints:
     kind: Ingress
     name: monerod
     source: monerod
+- host: notes.bstein.dev
+  path: /
+  backend:
+    namespace: outline
+    service: outline
+    port: 80
+    workloads:
+    - kind: Deployment
+      name: outline
+  via:
+    kind: Ingress
+    name: outline
+    source: outline
 - host: office.bstein.dev
   path: /
   backend:
@@ -1758,6 +1813,19 @@ http_endpoints:
     kind: Ingress
     name: jellyfin
     source: jellyfin
+- host: tasks.bstein.dev
+  path: /
+  backend:
+    namespace: planka
+    service: planka
+    port: 80
+    workloads:
+    - kind: Deployment
+      name: planka
+  via:
+    kind: Ingress
+    name: planka
+    source: planka
 - host: vault.bstein.dev
   path: /
   backend:
@@ -1772,15 +1840,28 @@ http_endpoints:
     name: vaultwarden-ingress
     source: vaultwarden
 helmrelease_host_hints:
+  comms:comms/othrys-element:
+  - call.live.bstein.dev
+  - live.bstein.dev
+  - matrix.live.bstein.dev
+  comms:comms/othrys-synapse:
+  - bstein.dev
+  - kit.live.bstein.dev
+  - live.bstein.dev
+  - matrix.live.bstein.dev
+  - turn.live.bstein.dev
   gitops-ui:flux-system/weave-gitops:
   - cd.bstein.dev
   harbor:harbor/harbor:
   - registry.bstein.dev
+  logging:logging/data-prepper:
+  - registry.bstein.dev
   mailu:mailu-mailserver/mailu:
   - bstein.dev
   - mail.bstein.dev
   monitoring:monitoring/alertmanager:
   - alerts.bstein.dev
   monitoring:monitoring/grafana:
+  - bstein.dev
   - metrics.bstein.dev
   - sso.bstein.dev

knowledge/diagrams/atlas-http.mmd

@@ -47,15 +47,14 @@ flowchart LR
   wl_comms_livekit["comms/livekit (Deployment)"]
   svc_comms_livekit --> wl_comms_livekit
   host_live_bstein_dev["live.bstein.dev"]
-  svc_comms_othrys_element_element_web["comms/othrys-element-element-web (Service)"]
-  host_live_bstein_dev --> svc_comms_othrys_element_element_web
-  wl_comms_othrys_element_element_web["comms/othrys-element-element-web (Deployment)"]
-  svc_comms_othrys_element_element_web --> wl_comms_othrys_element_element_web
   host_live_bstein_dev --> svc_comms_matrix_wellknown
   svc_comms_othrys_synapse_matrix_synapse["comms/othrys-synapse-matrix-synapse (Service)"]
   host_live_bstein_dev --> svc_comms_othrys_synapse_matrix_synapse
-  wl_comms_othrys_synapse_matrix_synapse["comms/othrys-synapse-matrix-synapse (Deployment)"]
+  host_logs_bstein_dev["logs.bstein.dev"]
-  svc_comms_othrys_synapse_matrix_synapse --> wl_comms_othrys_synapse_matrix_synapse
+  svc_logging_oauth2_proxy_logs["logging/oauth2-proxy-logs (Service)"]
+  host_logs_bstein_dev --> svc_logging_oauth2_proxy_logs
+  wl_logging_oauth2_proxy_logs["logging/oauth2-proxy-logs (Deployment)"]
+  svc_logging_oauth2_proxy_logs --> wl_logging_oauth2_proxy_logs
   host_longhorn_bstein_dev["longhorn.bstein.dev"]
   svc_longhorn_system_oauth2_proxy_longhorn["longhorn-system/oauth2-proxy-longhorn (Service)"]
   host_longhorn_bstein_dev --> svc_longhorn_system_oauth2_proxy_longhorn
@@ -80,6 +79,11 @@ flowchart LR
   host_monero_bstein_dev --> svc_crypto_monerod
   wl_crypto_monerod["crypto/monerod (Deployment)"]
   svc_crypto_monerod --> wl_crypto_monerod
+  host_notes_bstein_dev["notes.bstein.dev"]
+  svc_outline_outline["outline/outline (Service)"]
+  host_notes_bstein_dev --> svc_outline_outline
+  wl_outline_outline["outline/outline (Deployment)"]
+  svc_outline_outline --> wl_outline_outline
   host_office_bstein_dev["office.bstein.dev"]
   svc_nextcloud_collabora["nextcloud/collabora (Service)"]
   host_office_bstein_dev --> svc_nextcloud_collabora
@@ -110,6 +114,11 @@ flowchart LR
   host_stream_bstein_dev --> svc_jellyfin_jellyfin
   wl_jellyfin_jellyfin["jellyfin/jellyfin (Deployment)"]
   svc_jellyfin_jellyfin --> wl_jellyfin_jellyfin
+  host_tasks_bstein_dev["tasks.bstein.dev"]
+  svc_planka_planka["planka/planka (Service)"]
+  host_tasks_bstein_dev --> svc_planka_planka
+  wl_planka_planka["planka/planka (Deployment)"]
+  svc_planka_planka --> wl_planka_planka
   host_vault_bstein_dev["vault.bstein.dev"]
   svc_vaultwarden_vaultwarden_service["vaultwarden/vaultwarden-service (Service)"]
   host_vault_bstein_dev --> svc_vaultwarden_vaultwarden_service
@@ -133,10 +142,7 @@ flowchart LR
     wl_comms_livekit_token_service
     svc_comms_livekit
     wl_comms_livekit
-    svc_comms_othrys_element_element_web
-    wl_comms_othrys_element_element_web
     svc_comms_othrys_synapse_matrix_synapse
-    wl_comms_othrys_synapse_matrix_synapse
     svc_comms_matrix_authentication_service
     wl_comms_matrix_authentication_service
     svc_comms_matrix_guest_register
@@ -160,6 +166,10 @@ flowchart LR
     svc_jenkins_jenkins
     wl_jenkins_jenkins
   end
+  subgraph logging[logging]
+    svc_logging_oauth2_proxy_logs
+    wl_logging_oauth2_proxy_logs
+  end
   subgraph longhorn_system[longhorn-system]
     svc_longhorn_system_oauth2_proxy_longhorn
     wl_longhorn_system_oauth2_proxy_longhorn
@@ -173,6 +183,14 @@ flowchart LR
     svc_nextcloud_collabora
     wl_nextcloud_collabora
   end
+  subgraph outline[outline]
+    svc_outline_outline
+    wl_outline_outline
+  end
+  subgraph planka[planka]
+    svc_planka_planka
+    wl_planka_planka
+  end
   subgraph sso[sso]
     svc_sso_oauth2_proxy
     wl_sso_oauth2_proxy

scripts/knowledge_render_atlas.py

@@ -505,7 +505,9 @@ def main() -> int:
     diagram_path = out_dir / "diagrams" / "atlas-http.mmd"
     runbooks_json_path = out_dir / "catalog" / "runbooks.json"
 
+    catalog_rel = catalog_path.relative_to(REPO_ROOT).as_posix()
     catalog_path.write_text(
+        f"# {catalog_rel}\n"
         "# Generated by scripts/knowledge_render_atlas.py (do not edit by hand)\n"
         + yaml.safe_dump(catalog, sort_keys=False),
         encoding="utf-8",

services/comms/knowledge/catalog/atlas-summary.json

@@ -1,6 +1,6 @@
 {
   "counts": {
-    "helmrelease_host_hints": 18,
+    "helmrelease_host_hints": 17,
     "http_endpoints": 37,
     "services": 43,
     "workloads": 54

services/comms/knowledge/catalog/atlas.json

@@ -199,7 +199,7 @@
         "node-role.kubernetes.io/worker": "true"
       },
       "images": [
-        "registry.bstein.dev/bstein/bstein-dev-home-backend:registry.bstein.dev/bstein/bstein-dev-home-backend:0.1.1-92"
+        "registry.bstein.dev/bstein/bstein-dev-home-backend:0.1.1-92"
       ]
     },
     {
@@ -215,7 +215,7 @@
         "node-role.kubernetes.io/worker": "true"
       },
       "images": [
-        "registry.bstein.dev/bstein/bstein-dev-home-frontend:registry.bstein.dev/bstein/bstein-dev-home-frontend:0.1.1-92"
+        "registry.bstein.dev/bstein/bstein-dev-home-frontend:0.1.1-92"
       ]
     },
     {
@@ -2842,8 +2842,7 @@
       "kit.live.bstein.dev",
       "live.bstein.dev",
       "matrix.live.bstein.dev",
-      "registry.bstein.dev",
+      "turn.live.bstein.dev"
-      "sso.bstein.dev"
     ],
     "gitops-ui:flux-system/weave-gitops": [
       "cd.bstein.dev"

services/comms/knowledge/catalog/atlas.yaml

@@ -1,3 +1,4 @@
+# services/comms/knowledge/catalog/atlas.yaml
 # Generated by scripts/knowledge_render_atlas.py (do not edit by hand)
 cluster: atlas
 sources:
@@ -123,7 +124,7 @@ workloads:
     kubernetes.io/arch: arm64
     node-role.kubernetes.io/worker: 'true'
   images:
-  - registry.bstein.dev/bstein/bstein-dev-home-backend:registry.bstein.dev/bstein/bstein-dev-home-backend:0.1.1-92
+  - registry.bstein.dev/bstein/bstein-dev-home-backend:0.1.1-92
 - kind: Deployment
   namespace: bstein-dev-home
   name: bstein-dev-home-frontend
@@ -134,7 +135,7 @@ workloads:
     kubernetes.io/arch: arm64
     node-role.kubernetes.io/worker: 'true'
   images:
-  - registry.bstein.dev/bstein/bstein-dev-home-frontend:registry.bstein.dev/bstein/bstein-dev-home-frontend:0.1.1-92
+  - registry.bstein.dev/bstein/bstein-dev-home-frontend:0.1.1-92
 - kind: Deployment
   namespace: bstein-dev-home
   name: chat-ai-gateway
@@ -1848,8 +1849,7 @@ helmrelease_host_hints:
   - kit.live.bstein.dev
   - live.bstein.dev
   - matrix.live.bstein.dev
-  - registry.bstein.dev
+  - turn.live.bstein.dev
-  - sso.bstein.dev
   gitops-ui:flux-system/weave-gitops:
   - cd.bstein.dev
   harbor:harbor/harbor:

services/crypto/monerod/deployment.yaml

@@ -1,4 +1,4 @@
-# services/crypto/monerod
+# services/crypto/monerod/deployment.yaml
 apiVersion: apps/v1
 kind: Deployment
 metadata:

services/crypto/xmr-miner/kustomization.yaml

@@ -1,4 +1,4 @@
-# services/crypto/xmr-miner/kustomization/yaml
+# services/crypto/xmr-miner/kustomization.yaml
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:

services/harbor/helmrelease.yaml

@@ -117,21 +117,14 @@ spec:
       existingSecret: harbor-core
       existingXsrfSecret: harbor-core
       existingXsrfSecretKey: CSRF_KEY
-      # OIDC config; client secret is stored out-of-band.
+      # OIDC config is injected via CONFIG_OVERWRITE_JSON from the harbor-oidc secret.
-      configureUserSettings: |
+      extraEnvVars:
-        {
+        - name: CONFIG_OVERWRITE_JSON
-          "auth_mode": "oidc_auth",
+          valueFrom:
-          "oidc_name": "Keycloak",
+            secretKeyRef:
-          "oidc_endpoint": "https://sso.bstein.dev/realms/atlas",
+              name: harbor-oidc
-          "oidc_client_id": "harbor",
+              key: CONFIG_OVERWRITE_JSON
-          "oidc_verify_cert": true,
+              optional: true
-          "oidc_auto_onboard": true,
-          "oidc_scope": "openid,profile,email,groups",
-          "oidc_groups_claim": "groups",
-          "oidc_user_claim": "preferred_username",
-          "oidc_admin_group": "admin",
-          "oidc_logout": true
-        }
       affinity:
         nodeAffinity:
           requiredDuringSchedulingIgnoredDuringExecution:

services/keycloak/harbor-oidc-secret-ensure-job.yaml

@@ -0,0 +1,142 @@
+# services/keycloak/harbor-oidc-secret-ensure-job.yaml
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: harbor-oidc-secret-ensure-1
+  namespace: sso
+spec:
+  backoffLimit: 0
+  ttlSecondsAfterFinished: 3600
+  template:
+    spec:
+      serviceAccountName: mas-secrets-ensure
+      restartPolicy: Never
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: kubernetes.io/arch
+                    operator: In
+                    values: ["arm64"]
+                  - key: node-role.kubernetes.io/worker
+                    operator: Exists
+      containers:
+        - name: apply
+          image: alpine:3.20
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              set -euo pipefail
+              apk add --no-cache curl jq kubectl >/dev/null
+
+              KC_URL="http://keycloak.sso.svc.cluster.local"
+              ACCESS_TOKEN=""
+              for attempt in 1 2 3 4 5; do
+                TOKEN_JSON="$(curl -sS -X POST "$KC_URL/realms/master/protocol/openid-connect/token" \
+                  -H 'Content-Type: application/x-www-form-urlencoded' \
+                  -d "grant_type=password" \
+                  -d "client_id=admin-cli" \
+                  -d "username=${KEYCLOAK_ADMIN}" \
+                  -d "password=${KEYCLOAK_ADMIN_PASSWORD}" || true)"
+                ACCESS_TOKEN="$(echo "$TOKEN_JSON" | jq -r '.access_token' 2>/dev/null || true)"
+                if [ -n "$ACCESS_TOKEN" ] && [ "$ACCESS_TOKEN" != "null" ]; then
+                  break
+                fi
+                echo "Keycloak token request failed (attempt ${attempt})" >&2
+                sleep $((attempt * 2))
+              done
+              if [ -z "$ACCESS_TOKEN" ] || [ "$ACCESS_TOKEN" = "null" ]; then
+                echo "Failed to fetch Keycloak admin token" >&2
+                exit 1
+              fi
+
+              CLIENT_QUERY="$(curl -sS -H "Authorization: Bearer ${ACCESS_TOKEN}" \
+                "$KC_URL/admin/realms/atlas/clients?clientId=harbor" || true)"
+              CLIENT_ID="$(echo "$CLIENT_QUERY" | jq -r '.[0].id' 2>/dev/null || true)"
+
+              if [ -z "$CLIENT_ID" ] || [ "$CLIENT_ID" = "null" ]; then
+                create_payload='{"clientId":"harbor","enabled":true,"protocol":"openid-connect","publicClient":false,"standardFlowEnabled":true,"implicitFlowEnabled":false,"directAccessGrantsEnabled":false,"serviceAccountsEnabled":false,"redirectUris":["https://registry.bstein.dev/c/oidc/callback"],"webOrigins":["https://registry.bstein.dev"],"rootUrl":"https://registry.bstein.dev","baseUrl":"/"}'
+                status="$(curl -sS -o /dev/null -w "%{http_code}" -X POST \
+                  -H "Authorization: Bearer ${ACCESS_TOKEN}" \
+                  -H 'Content-Type: application/json' \
+                  -d "${create_payload}" \
+                  "$KC_URL/admin/realms/atlas/clients")"
+                if [ "$status" != "201" ] && [ "$status" != "204" ]; then
+                  echo "Keycloak client create failed (status ${status})" >&2
+                  exit 1
+                fi
+                CLIENT_QUERY="$(curl -sS -H "Authorization: Bearer ${ACCESS_TOKEN}" \
+                  "$KC_URL/admin/realms/atlas/clients?clientId=harbor" || true)"
+                CLIENT_ID="$(echo "$CLIENT_QUERY" | jq -r '.[0].id' 2>/dev/null || true)"
+              fi
+
+              if [ -z "$CLIENT_ID" ] || [ "$CLIENT_ID" = "null" ]; then
+                echo "Keycloak client harbor not found" >&2
+                exit 1
+              fi
+
+              SCOPE_ID="$(curl -sS -H "Authorization: Bearer ${ACCESS_TOKEN}" \
+                "$KC_URL/admin/realms/atlas/client-scopes?search=groups" | jq -r '.[] | select(.name=="groups") | .id' 2>/dev/null | head -n1 || true)"
+              if [ -z "$SCOPE_ID" ] || [ "$SCOPE_ID" = "null" ]; then
+                echo "Keycloak client scope groups not found" >&2
+                exit 1
+              fi
+
+              DEFAULT_SCOPES="$(curl -sS -H "Authorization: Bearer ${ACCESS_TOKEN}" \
+                "$KC_URL/admin/realms/atlas/clients/${CLIENT_ID}/default-client-scopes" || true)"
+              OPTIONAL_SCOPES="$(curl -sS -H "Authorization: Bearer ${ACCESS_TOKEN}" \
+                "$KC_URL/admin/realms/atlas/clients/${CLIENT_ID}/optional-client-scopes" || true)"
+
+              if ! echo "$DEFAULT_SCOPES" | jq -e '.[] | select(.name=="groups")' >/dev/null 2>&1 \
+                && ! echo "$OPTIONAL_SCOPES" | jq -e '.[] | select(.name=="groups")' >/dev/null 2>&1; then
+                status="$(curl -sS -o /dev/null -w "%{http_code}" -X PUT \
+                  -H "Authorization: Bearer ${ACCESS_TOKEN}" \
+                  "$KC_URL/admin/realms/atlas/clients/${CLIENT_ID}/optional-client-scopes/${SCOPE_ID}")"
+                if [ "$status" != "200" ] && [ "$status" != "201" ] && [ "$status" != "204" ]; then
+                  status="$(curl -sS -o /dev/null -w "%{http_code}" -X POST \
+                    -H "Authorization: Bearer ${ACCESS_TOKEN}" \
+                    "$KC_URL/admin/realms/atlas/clients/${CLIENT_ID}/optional-client-scopes/${SCOPE_ID}")"
+                  if [ "$status" != "200" ] && [ "$status" != "201" ] && [ "$status" != "204" ]; then
+                    echo "Failed to attach groups client scope to harbor (status ${status})" >&2
+                    exit 1
+                  fi
+                fi
+              fi
+
+              CLIENT_SECRET="$(curl -sS -H "Authorization: Bearer ${ACCESS_TOKEN}" \
+                "$KC_URL/admin/realms/atlas/clients/${CLIENT_ID}/client-secret" | jq -r '.value' 2>/dev/null || true)"
+              if [ -z "$CLIENT_SECRET" ] || [ "$CLIENT_SECRET" = "null" ]; then
+                echo "Keycloak client secret not found" >&2
+                exit 1
+              fi
+
+              CONFIG_OVERWRITE_JSON="$(jq -nc \
+                --arg auth_mode "oidc_auth" \
+                --arg oidc_name "Keycloak" \
+                --arg oidc_client_id "harbor" \
+                --arg oidc_client_secret "${CLIENT_SECRET}" \
+                --arg oidc_endpoint "https://sso.bstein.dev/realms/atlas" \
+                --arg oidc_scope "openid,profile,email,groups" \
+                --arg oidc_user_claim "preferred_username" \
+                --arg oidc_groups_claim "groups" \
+                --arg oidc_admin_group "admin" \
+                --argjson oidc_auto_onboard true \
+                --argjson oidc_verify_cert true \
+                --argjson oidc_logout true \
+                '{\n                  auth_mode: $auth_mode,\n                  oidc_name: $oidc_name,\n                  oidc_client_id: $oidc_client_id,\n                  oidc_client_secret: $oidc_client_secret,\n                  oidc_endpoint: $oidc_endpoint,\n                  oidc_scope: $oidc_scope,\n                  oidc_user_claim: $oidc_user_claim,\n                  oidc_groups_claim: $oidc_groups_claim,\n                  oidc_admin_group: $oidc_admin_group,\n                  oidc_auto_onboard: $oidc_auto_onboard,\n                  oidc_verify_cert: $oidc_verify_cert,\n                  oidc_logout: $oidc_logout\n                }')"
+
+              kubectl -n harbor create secret generic harbor-oidc \
+                --from-literal=CONFIG_OVERWRITE_JSON="${CONFIG_OVERWRITE_JSON}" \
+                --dry-run=client -o yaml | kubectl -n harbor apply -f - >/dev/null
+          env:
+            - name: KEYCLOAK_ADMIN
+              valueFrom:
+                secretKeyRef:
+                  name: keycloak-admin
+                  key: username
+            - name: KEYCLOAK_ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: keycloak-admin
+                  key: password

services/keycloak/kustomization.yaml

@@ -19,6 +19,7 @@ resources:
   - mas-secrets-ensure-job.yaml
   - synapse-oidc-secret-ensure-job.yaml
   - logs-oidc-secret-ensure-job.yaml
+  - harbor-oidc-secret-ensure-job.yaml
   - service.yaml
   - ingress.yaml
 generatorOptions:

services/monitoring/helmrelease.yaml

@@ -1,4 +1,4 @@
-# services/monitoring/kube-state-metrics-helmrelease.yaml
+# services/monitoring/helmrelease.yaml
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:

services/vault/kustomization.yaml

@@ -8,7 +8,14 @@ resources:
   - rbac.yaml
   - configmap.yaml
   - statefulset.yaml
+  - oidc-config-cronjob.yaml
   - service.yaml
   - ingress.yaml
   - certificate.yaml
   - serverstransport.yaml
+generatorOptions:
+  disableNameSuffixHash: true
+configMapGenerator:
+  - name: vault-oidc-config-script
+    files:
+      - vault_oidc_configure.sh=scripts/vault_oidc_configure.sh

services/vault/oidc-config-cronjob.yaml

@@ -0,0 +1,114 @@
+# services/vault/oidc-config-cronjob.yaml
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: vault-oidc-config
+  namespace: vault
+spec:
+  schedule: "*/15 * * * *"
+  concurrencyPolicy: Forbid
+  successfulJobsHistoryLimit: 1
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      backoffLimit: 1
+      template:
+        spec:
+          serviceAccountName: vault
+          restartPolicy: Never
+          nodeSelector:
+            kubernetes.io/arch: arm64
+            node-role.kubernetes.io/worker: "true"
+          containers:
+            - name: configure-oidc
+              image: hashicorp/vault:1.17.6
+              imagePullPolicy: IfNotPresent
+              command:
+                - bash
+                - /scripts/vault_oidc_configure.sh
+              env:
+                - name: VAULT_ADDR
+                  value: http://vault.vault.svc.cluster.local:8200
+                - name: VAULT_TOKEN
+                  valueFrom:
+                    secretKeyRef:
+                      name: vault-oidc-admin-token
+                      key: token
+                - name: VAULT_OIDC_DISCOVERY_URL
+                  valueFrom:
+                    secretKeyRef:
+                      name: vault-oidc-config
+                      key: discovery_url
+                - name: VAULT_OIDC_CLIENT_ID
+                  valueFrom:
+                    secretKeyRef:
+                      name: vault-oidc-config
+                      key: client_id
+                - name: VAULT_OIDC_CLIENT_SECRET
+                  valueFrom:
+                    secretKeyRef:
+                      name: vault-oidc-config
+                      key: client_secret
+                - name: VAULT_OIDC_DEFAULT_ROLE
+                  valueFrom:
+                    secretKeyRef:
+                      name: vault-oidc-config
+                      key: default_role
+                      optional: true
+                - name: VAULT_OIDC_SCOPES
+                  valueFrom:
+                    secretKeyRef:
+                      name: vault-oidc-config
+                      key: scopes
+                      optional: true
+                - name: VAULT_OIDC_USER_CLAIM
+                  valueFrom:
+                    secretKeyRef:
+                      name: vault-oidc-config
+                      key: user_claim
+                      optional: true
+                - name: VAULT_OIDC_GROUPS_CLAIM
+                  valueFrom:
+                    secretKeyRef:
+                      name: vault-oidc-config
+                      key: groups_claim
+                      optional: true
+                - name: VAULT_OIDC_TOKEN_POLICIES
+                  valueFrom:
+                    secretKeyRef:
+                      name: vault-oidc-config
+                      key: token_policies
+                      optional: true
+                - name: VAULT_OIDC_REDIRECT_URIS
+                  valueFrom:
+                    secretKeyRef:
+                      name: vault-oidc-config
+                      key: redirect_uris
+                      optional: true
+                - name: VAULT_OIDC_BOUND_AUDIENCES
+                  valueFrom:
+                    secretKeyRef:
+                      name: vault-oidc-config
+                      key: bound_audiences
+                      optional: true
+                - name: VAULT_OIDC_BOUND_CLAIMS
+                  valueFrom:
+                    secretKeyRef:
+                      name: vault-oidc-config
+                      key: bound_claims
+                      optional: true
+                - name: VAULT_OIDC_BOUND_CLAIMS_TYPE
+                  valueFrom:
+                    secretKeyRef:
+                      name: vault-oidc-config
+                      key: bound_claims_type
+                      optional: true
+              volumeMounts:
+                - name: oidc-config-script
+                  mountPath: /scripts
+                  readOnly: true
+          volumes:
+            - name: oidc-config-script
+              configMap:
+                name: vault-oidc-config-script
+                defaultMode: 0555

services/vault/scripts/vault_oidc_configure.sh

@@ -0,0 +1,77 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+log() { echo "[vault-oidc] $*"; }
+
+status_json="$(vault status -format=json || true)"
+if [[ -z "${status_json}" ]]; then
+  log "vault status failed; check VAULT_ADDR and VAULT_TOKEN"
+  exit 1
+fi
+
+if ! grep -q '"initialized":true' <<<"${status_json}"; then
+  log "vault not initialized; skipping"
+  exit 0
+fi
+
+if grep -q '"sealed":true' <<<"${status_json}"; then
+  log "vault sealed; skipping"
+  exit 0
+fi
+
+: "${VAULT_OIDC_DISCOVERY_URL:?set VAULT_OIDC_DISCOVERY_URL}"
+: "${VAULT_OIDC_CLIENT_ID:?set VAULT_OIDC_CLIENT_ID}"
+: "${VAULT_OIDC_CLIENT_SECRET:?set VAULT_OIDC_CLIENT_SECRET}"
+
+role="${VAULT_OIDC_DEFAULT_ROLE:-atlas}"
+scopes="${VAULT_OIDC_SCOPES:-openid profile email groups}"
+user_claim="${VAULT_OIDC_USER_CLAIM:-preferred_username}"
+groups_claim="${VAULT_OIDC_GROUPS_CLAIM:-groups}"
+token_policies="${VAULT_OIDC_TOKEN_POLICIES:-default}"
+redirect_uris="${VAULT_OIDC_REDIRECT_URIS:-https://secret.bstein.dev/ui/vault/auth/oidc/oidc/callback}"
+bound_audiences="${VAULT_OIDC_BOUND_AUDIENCES:-${VAULT_OIDC_CLIENT_ID}}"
+bound_claims="${VAULT_OIDC_BOUND_CLAIMS:-}"
+bound_claims_type="${VAULT_OIDC_BOUND_CLAIMS_TYPE:-}"
+
+if ! vault auth list -format=json | grep -q '"oidc/"'; then
+  log "enabling oidc auth method"
+  vault auth enable oidc
+fi
+
+log "configuring oidc auth"
+vault write auth/oidc/config \
+  oidc_discovery_url="${VAULT_OIDC_DISCOVERY_URL}" \
+  oidc_client_id="${VAULT_OIDC_CLIENT_ID}" \
+  oidc_client_secret="${VAULT_OIDC_CLIENT_SECRET}" \
+  default_role="${role}"
+
+vault auth tune -listing-visibility=unauth oidc >/dev/null
+
+role_args=(
+  "user_claim=${user_claim}"
+  "oidc_scopes=${scopes}"
+  "token_policies=${token_policies}"
+  "bound_audiences=${bound_audiences}"
+)
+
+if [[ -n "${groups_claim}" ]]; then
+  role_args+=("groups_claim=${groups_claim}")
+fi
+if [[ -n "${bound_claims}" ]]; then
+  role_args+=("bound_claims=${bound_claims}")
+fi
+if [[ -n "${bound_claims_type}" ]]; then
+  role_args+=("bound_claims_type=${bound_claims_type}")
+fi
+
+IFS=',' read -r -a redirect_items <<<"${redirect_uris}"
+for uri in "${redirect_items[@]}"; do
+  trimmed="${uri#"${uri%%[![:space:]]*}"}"
+  trimmed="${trimmed%"${trimmed##*[![:space:]]}"}"
+  if [[ -n "${trimmed}" ]]; then
+    role_args+=("allowed_redirect_uris=${trimmed}")
+  fi
+done
+
+log "configuring oidc role ${role}"
+vault write "auth/oidc/role/${role}" "${role_args[@]}"