Update Helm release kube-prometheus-stack to v86

ci(prod): deploy docs v0.0.1
ci(staging): deploy docs 4bec2e8e-debug
2026-06-13 16:54:14 +00:00 · 2026-06-13 16:08:05 +00:00 · 2026-06-13 16:07:58 +00:00 · 2026-06-13 18:00:54 +02:00 · 2026-06-13 16:00:18 +00:00 · 2026-06-13 17:50:59 +02:00
149 changed files with 2583 additions and 556 deletions
@@ -1,13 +1,6 @@
-/* Oceanbox Keycloak Login Theme
- *
- * Branding aligned with oceanbox.io:
- *   Primary teal:    #0bb4aa
- *   Dark teal:       #37746F
- *   Deep blue:       #031275
- *   Background:      #f9fafd
- *   Text:            #101010
- */
+/* Oceanbox Keycloak Login Theme */

+/* Brand colours */
 :root {
    --pf-v5-global--primary-color--100: #0bb4aa;
    --pf-v5-global--primary-color--200: #099e95;
@@ -15,17 +8,10 @@
    --pf-v5-global--link--Color--hover: #031275;
 }

+/* Background */
 .login-pf body {
    background: #f9fafd url("../img/oceanbox-bg.png") no-repeat center bottom fixed;
    background-size: cover;
-    height: 100%;
-}
-
-/* Login container layout */
-.pf-v5-c-login__container {
-    grid-template-columns: 34rem;
-    grid-template-areas: "header"
-                         "main";
 }

 /* Logo */
@@ -43,67 +29,19 @@ div.kc-logo-text span {
    display: none;
 }

-/* Header */
-#kc-header-wrapper {
-    font-size: 29px;
-    text-transform: uppercase;
-    letter-spacing: 3px;
-    line-height: 1.2em;
-    white-space: normal;
-    color: #37746F !important;
-    text-align: center;
-}
-
-/* Login card */
-.pf-v5-c-login__main {
-    border-radius: 8px;
-    box-shadow: 0 4px 24px rgba(0, 0, 0, 0.08);
-}
-
 /* Primary button */
 .pf-v5-c-button.pf-m-primary {
    --pf-v5-c-button--m-primary--BackgroundColor: #0bb4aa;
    --pf-v5-c-button--m-primary--hover--BackgroundColor: #099e95;
    --pf-v5-c-button--m-primary--active--BackgroundColor: #37746F;
    --pf-v5-c-button--m-primary--focus--BackgroundColor: #099e95;
-    border-radius: 4px;
 }

 /* Links */
-.pf-v5-c-button.pf-m-link {
-    --pf-v5-c-button--m-link--Color: #0bb4aa;
-    --pf-v5-c-button--m-link--hover--Color: #031275;
-}
-
-a {
+a, .pf-v5-c-button.pf-m-link {
    color: #0bb4aa;
 }

-a:hover {
+a:hover, .pf-v5-c-button.pf-m-link:hover {
    color: #031275;
 }
-
-/* Form inputs */
-.pf-v5-c-form-control > input,
-.pf-v5-c-form-control > textarea {
-    border-radius: 4px;
-}
-
-#kc-recovery-codes-list {
-    columns: 2;
-}
-
-#certificate_subjectDN {
-    overflow-wrap: break-word;
-}
-
-hr {
-    margin-top: var(--pf-v5-global--spacer--sm);
-    margin-bottom: var(--pf-v5-global--spacer--md);
-}
-
-@media (min-width: 768px) {
-    div.pf-v5-c-login__main-header {
-        grid-template-columns: 70% 30%;
-    }
-}
@@ -13,7 +13,7 @@ applications:
      server: https://kubernetes.default.svc
    project: sys
    sources:
-      - repoURL: https://gitlab.com/oceanbox//manifests.git
+      - repoURL: https://git.oceanbox.io/platform/manifests.git
        targetRevision: HEAD
        path: helmfile.d
        plugin:
@@ -4,10 +4,10 @@ description: Atlantis map and simulation service
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v1.42.18
+version: v1.42.27
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v1.42.18
+appVersion: v1.42.27
 dependencies:
  - name: diagrid-dashboard
    version: "0.1.0"
@@ -4,7 +4,7 @@
 replicaCount: 1
 image:
  repository: git.oceanbox.io/oceanbox/poseidon/atlantis
-  tag: v1.42.18
+  tag: v1.42.27
  pullPolicy: IfNotPresent
 init:
  enabled: false
@@ -13,9 +13,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: v1.42.18
+version: v1.42.27
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "v1.42.18"
+appVersion: "v1.42.27"
@@ -10,7 +10,7 @@ image:
  # This sets the pull policy for images.
  pullPolicy: IfNotPresent
  # Overrides the image tag whose default is the chart appVersion.
-  tag: v1.42.18
+  tag: v1.42.27
 # This is for the secrets for pulling an image from a private repository more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
 imagePullSecrets:
  - name: gitlab-pull-secret
@@ -12,7 +12,7 @@ description: Oceanbox Documentation
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v0.1.0
+version: v0.0.1
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v0.1.0
+appVersion: v0.0.1
@@ -4,7 +4,7 @@
 replicaCount: 1
 image:
  repository: git.oceanbox.io/oceanbox/documentation/docs
-  tag: v0.1.0
+  tag: v0.0.1
  pullPolicy: IfNotPresent
 init:
  enabled: false
@@ -21,8 +21,9 @@ env:
    valueFrom:
      fieldRef:
        fieldPath: metadata.namespace
-# imagePullSecrets:
-  # - name: gitea-pull-secret
+        # imagePullSecrets:
+# - name: gitea-pull-secret
+
 nameOverride: ""
 fullnameOverride: ""
 serviceAccount:
@@ -47,7 +48,7 @@ service:
  port: 8080
 ingress:
  enabled: true
-  className: nginx
+  className: haproxy
 persistence:
  enabled: false
  size: 1G
@@ -0,0 +1,6 @@
+apiVersion: v2
+name: fapr
+description: A Helm chart for Fapr (F# Dapr workflow orchestrator)
+type: application
+version: v0.1.0
+appVersion: v0.1.0
@@ -0,0 +1,61 @@
+{{/* vim: set filetype=mustache: */}}
+{{/*
+Expand the name of the chart.
+*/}}
+{{- define "fapr.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Create a default fully qualified app name.
+*/}}
+{{- define "fapr.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{/*
+Create chart name and version as used by the chart label.
+*/}}
+{{- define "fapr.chart" -}}
+{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{/*
+Common labels
+*/}}
+{{- define "fapr.labels" -}}
+helm.sh/chart: {{ include "fapr.chart" . }}
+{{ include "fapr.selectorLabels" . }}
+{{- if .Chart.AppVersion }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+{{- end }}
+
+{{/*
+Selector labels
+*/}}
+{{- define "fapr.selectorLabels" -}}
+app.kubernetes.io/name: {{ include "fapr.name" . }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+{{- end }}
+
+{{/*
+Create the name of the service account to use
+*/}}
+{{- define "fapr.serviceAccountName" -}}
+{{- if .Values.serviceAccount.create -}}
+    {{ default (include "fapr.fullname" .) .Values.serviceAccount.name }}
+{{- else -}}
+    {{ default "default" .Values.serviceAccount.name }}
+{{- end -}}
+{{- end -}}
@@ -0,0 +1,85 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ include "fapr.fullname" . }}
+  labels:
+    {{- include "fapr.labels" . | nindent 4 }}
+spec:
+  {{- if not .Values.autoscaling.enabled }}
+  replicas: {{ .Values.replicaCount }}
+  {{- end }}
+  selector:
+    matchLabels:
+      {{- include "fapr.selectorLabels" . | nindent 6 }}
+  template:
+    metadata:
+      {{- with .Values.podAnnotations }}
+      annotations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      labels:
+        {{- include "fapr.selectorLabels" . | nindent 8 }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      serviceAccountName: {{ include "fapr.serviceAccountName" . }}
+      securityContext:
+        {{- toYaml .Values.podSecurityContext | nindent 8 }}
+      containers:
+        - name: {{ .Chart.Name }}
+          securityContext:
+            {{- toYaml .Values.securityContext | nindent 12 }}
+          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
+          imagePullPolicy: {{ .Values.image.pullPolicy }}
+          ports:
+            - name: http
+              containerPort: {{ .Values.service.port }}
+              protocol: TCP
+          env:
+            {{- toYaml .Values.env | nindent 12 }}
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 5
+            periodSeconds: 15
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: http
+            initialDelaySeconds: 3
+            periodSeconds: 10
+          resources:
+            {{- toYaml .Values.resources | nindent 12 }}
+          volumeMounts:
+            - name: data
+              mountPath: /data
+            - name: appsettings
+              mountPath: /app/appsettings.json
+              subPath: appsettings.json
+              readOnly: true
+      volumes:
+        - name: data
+        {{- if .Values.persistence.enabled }}
+          persistentVolumeClaim:
+            claimName: {{ .Values.persistence.existingClaim | default (include "fapr.fullname" .) }}
+        {{- else }}
+          emptyDir: {}
+        {{- end }}
+        - name: appsettings
+          configMap:
+            name: {{ include "fapr.fullname" . }}-appsettings
+      {{- with .Values.nodeSelector }}
+      nodeSelector:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.affinity }}
+      affinity:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.tolerations }}
+      tolerations:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
@@ -0,0 +1,21 @@
+{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: {{ include "fapr.fullname" . }}
+  labels:
+{{ include "fapr.labels" . | indent 4 }}
+spec:
+  accessModes:
+    - {{ .Values.persistence.accessMode | quote }}
+  resources:
+    requests:
+      storage: {{ .Values.persistence.size | quote }}
+{{- if .Values.persistence.storageClass }}
+{{- if (eq "-" .Values.persistence.storageClass) }}
+  storageClassName: ""
+{{- else }}
+  storageClassName: "{{ .Values.persistence.storageClass }}"
+{{- end }}
+{{- end }}
+{{- end }}
@@ -0,0 +1,49 @@
+{{- if .Values.redis.enabled -}}
+apiVersion: dragonflydb.io/v1alpha1
+kind: Dragonfly
+metadata:
+  name: {{ include "fapr.fullname" . }}-redis
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    linkerd.io/inject: disabled
+  labels:
+    app.kubernetes.io/created-by: dragonfly-operator
+    {{- include "fapr.labels" . | nindent 4 }}
+spec:
+  args:
+    - --dbfilename=dump
+    - --maxmemory=$(MAX_MEMORY)Mi
+    - --proactor_threads=1
+    - --logtostderr
+    - --save_schedule=
+  env:
+    - name: MAX_MEMORY
+      valueFrom:
+        resourceFieldRef:
+          resource: limits.memory
+          divisor: 1Mi
+  replicas: {{ .Values.redis.replicas | default "1" }}
+  resources:
+    requests:
+      cpu: {{ .Values.redis.resources.cpu | default "100m" }}
+      memory: {{ .Values.redis.resources.memory | default "128Mi" }}
+    limits:
+      memory: {{ .Values.redis.resources.memory | default "128Mi" }}
+  authentication:
+    passwordFromSecret:
+      name: {{ .Values.redis.secret.name | default (printf "%s-redis" (include "fapr.fullname" .)) | quote }}
+      key: {{ .Values.redis.secret.key | quote }}
+  {{- if .Values.redis.backup.enabled }}
+  snapshot:
+    dir: /data
+    cron: "0 3 * * *"
+    enableOnMasterOnly: false
+    persistentVolumeClaimSpec:
+      storageClassName: {{ .Values.redis.storageClass | default "managed-nfs-storage" }}
+      accessModes:
+        - ReadWriteOnce
+      resources:
+        requests:
+          storage: {{ .Values.redis.size | default "1Gi" }}
+  {{- end }}
+{{- end }}
@@ -0,0 +1,15 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ include "fapr.fullname" . }}
+  labels:
+    {{- include "fapr.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.service.type }}
+  ports:
+    - port: {{ .Values.service.port }}
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    {{- include "fapr.selectorLabels" . | nindent 4 }}
@@ -0,0 +1,12 @@
+{{- if .Values.serviceAccount.create -}}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ include "fapr.serviceAccountName" . }}
+  labels:
+    {{- include "fapr.labels" . | nindent 4 }}
+  {{- with .Values.serviceAccount.annotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}
@@ -0,0 +1,67 @@
+# Default values for fapr.
+
+replicaCount: 1
+image:
+  repository: git.oceanbox.io/oceanbox/fapr/fapr
+  tag: v0.1.0
+  pullPolicy: IfNotPresent
+env:
+  - name: APP_NAME
+    valueFrom:
+      fieldRef:
+        fieldPath: metadata.name
+  - name: APP_NAMESPACE
+    valueFrom:
+      fieldRef:
+        fieldPath: metadata.namespace
+imagePullSecrets:
+  - name: gitlab-pull-secret
+nameOverride: ""
+fullnameOverride: ""
+serviceAccount:
+  create: true
+  annotations: {}
+  name: ""
+podAnnotations: {}
+podSecurityContext:
+  fsGroup: 0
+securityContext:
+  capabilities:
+    drop:
+      - ALL
+  readOnlyRootFilesystem: false
+  runAsNonRoot: false
+  runAsUser: 0
+service:
+  type: ClusterIP
+  port: 8080
+persistence:
+  enabled: true
+  existingClaim: ""
+  size: 1Gi
+  storageClass: "ceph-rbd"
+  accessMode: ReadWriteMany
+redis:
+  enabled: true
+  replicas: 1
+  backup:
+    enabled: false
+  size: 1Gi
+  storageClass: "ceph-rbd"
+  secret:
+    name: ""
+    key: "redis-password"
+  resources:
+    cpu: 100m
+    memory: 128Mi
+resources: {}
+autoscaling:
+  enabled: false
+  minReplicas: 1
+  maxReplicas: 3
+  targetCPUUtilizationPercentage: 80
+serviceMonitor:
+  enabled: false
+nodeSelector: {}
+tolerations: []
+affinity: {}
@@ -47,7 +47,7 @@ service:
  port: 8080
 ingress:
  enabled: true
-  className: nginx
+  className: haproxy
 persistence:
  enabled: false
  size: 1G
@@ -4,10 +4,10 @@ description: A Helm chart for Kubernetes
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v1.42.18
+version: v1.42.27
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v1.42.18
+appVersion: v1.42.27
 dependencies:
  - name: diagrid-dashboard
    version: "0.1.0"
@@ -5,7 +5,7 @@
 replicaCount: 1
 image:
  repository: git.oceanbox.io/oceanbox/poseidon/sorcerer
-  tag: v1.42.18
+  tag: v1.42.27
  pullPolicy: IfNotPresent
 init:
  enabled: false
@@ -15,7 +15,7 @@ releases:
 - name: argocd
  namespace: argocd
  chart: argo/argo-cd
-  version: 9.4.17
+  version: 9.5.17
  condition: argo.enabled
  values:
  - ../values/argo/values/argocd.yaml.gotmpl
@@ -27,7 +27,7 @@ releases:
 - name: argocd-apps
  namespace: argocd
  chart: argo/argocd-apps
-  version: 2.0.4
+  version: 2.0.5
  condition: argo.apps.enabled
  values:
  - ../values/argo/values/apps.yaml.gotmpl
@@ -35,7 +35,7 @@ releases:
 - name: argo-rollouts
  namespace: argocd
  chart: argo/argo-rollouts
-  version: 2.40.9
+  version: 2.40.10
  condition: argo.rollouts.enabled
  values:
  - ../values/argo/values/rollouts.yaml.gotmpl
@@ -43,7 +43,7 @@ releases:
 - name: argo-workflows
  namespace: argocd
  chart: argo/argo-workflows
-  version: 1.0.10
+  version: 1.0.14
  condition: argo.workflows.enabled
  missingFileHandler: Info
 - name: manifests
@@ -0,0 +1,39 @@
+bases:
+ - ../envs/environments.yaml.gotmpl
+
+commonLabels:
+  tier: oceanbox
+
+releases:
+- name: {{ .Environment.Name }}-fapr
+  namespace: {{ .Environment.Name }}-fapr
+  chart: ../charts/fapr
+  condition: fapr.enabled
+  values:
+  - ../values/fapr/values/values.yaml
+  - ../values/fapr/values/values-{{ .Environment.Name }}.yaml
+  - ../values/fapr/values/values-{{ .Environment.Name }}-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
+  postRenderer: ../bin/kustomizer
+  postRendererArgs:
+  - ../values/fapr/kustomize/{{ .Environment.Name }}-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}
+  missingFileHandler: Info
+- name: manifests
+  namespace: {{ .Environment.Name }}-fapr
+  chart: manifests
+  condition: fapr.enabled
+  missingFileHandler: Info
+  values:
+  - ../values/env.yaml
+  - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
+  - ../values/fapr/env.yaml.gotmpl
+  - ../values/fapr/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
+  hooks:
+  - events: [ prepare, cleanup ]
+    showlogs: true
+    command: ../bin/helmify
+    args:
+    - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
+    - '{{`{{ .Release.Chart }}`}}'
+    - '{{`{{ .Environment.Name }}`}}'
+    - ../values/fapr/manifests
+    - manifests
@@ -13,7 +13,7 @@ releases:
 - name: gitea
  namespace: gitea
  chart: gitea/gitea
-  version: 12.5.3
+  version: 12.6.0
  condition: gitea.enabled
  values:
  - ../values/gitea/values/values.yaml
@@ -0,0 +1,44 @@
+bases:
+ - ../envs/environments.yaml.gotmpl
+
+repositories:
+- name: haproxytech
+  oci: true
+  url: 'ghcr.io/haproxytech/helm-charts'
+
+commonLabels:
+  tier: system
+
+releases:
+- name: ingress-haproxy
+  namespace: ingress-haproxy
+  chart: haproxytech/kubernetes-ingress
+  version: 1.49.0
+  condition: haproxy.enabled
+  values:
+  - ../values/ingress-haproxy/values/ingress-haproxy.yaml.gotmpl
+  - ../values/ingress-haproxy/values/ingress-haproxy-{{ .Environment.Name }}.yaml.gotmpl
+  postRenderer: ../bin/kustomizer
+  postRendererArgs:
+  - ../values/ingress-haproxy/kustomize/{{ .Environment.Name }}
+  missingFileHandler: Info
+- name: manifests
+  namespace: ingress-haproxy
+  chart: manifests
+  condition: haproxy.enabled
+  missingFileHandler: Info
+  values:
+  - ../values/env.yaml
+  - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
+  - ../values/ingress-haproxy/env.yaml.gotmpl
+  - ../values/ingress-haproxy/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
+  hooks:
+  - events: [ prepare, cleanup ]
+    showlogs: true
+    command: ../bin/helmify
+    args:
+    - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
+    - '{{`{{ .Release.Chart }}`}}'
+    - '{{`{{ .Environment.Name }}`}}'
+    - ../values/ingress-haproxy/manifests
+    - manifests
@@ -8,7 +8,7 @@ releases:
 - name: kueue
  namespace: kueue-system
  chart: oci://registry.k8s.io/kueue/charts/kueue
-  version: 0.17.1
+  version: 0.17.3
  condition: kueue.enabled
  values:
  - ../values/kueue/values/values.yaml
@@ -15,7 +15,7 @@ releases:
 - name: kyverno
  namespace: kyverno
  chart: kyverno/kyverno
-  version: 3.7.1
+  version: 3.8.1
  condition: kyverno.enabled
  values:
  - ../values/kyverno/values/kyverno.yaml.gotmpl
@@ -12,7 +12,7 @@ releases:
 - name: loki
  namespace: loki
  chart: loki/loki
-  version: 6.55.0
+  version: 7.0.0
  condition: loki.enabled
  values:
  - ../values/loki/values/loki.yaml.gotmpl
@@ -0,0 +1,27 @@
+bases:
+ - ../envs/environments.yaml.gotmpl
+
+commonLabels:
+  tier: system
+
+releases:
+- name: manifests
+  namespace: niks3
+  chart: manifests
+  condition: niks3.enabled
+  missingFileHandler: Info
+  values:
+  - ../values/env.yaml
+  - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
+  - ../values/niks3/env.yaml.gotmpl
+  - ../values/niks3/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
+  hooks:
+  - events: [ prepare, cleanup ]
+    showlogs: true
+    command: ../bin/helmify
+    args:
+    - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
+    - '{{`{{ .Release.Chart }}`}}'
+    - '{{`{{ .Environment.Name }}`}}'
+    - ../values/niks3/manifests
+    - manifests
@@ -16,7 +16,7 @@ releases:
  namespace: {{ .Environment.Name }}-openfga
  {{- end }}
  chart: openfga/openfga
-  version: 0.3.2
+  version: 0.3.6
  condition: openfga.enabled
  values:
  - ../values/openfga/values/values.yaml
@@ -12,7 +12,7 @@ releases:
 - name: opentelemetry-collector
  namespace: otel
  chart: open-telemetry/opentelemetry-collector
-  version: 0.150.1
+  version: 0.158.0
  condition: otel.enabled
  values:
  - ../values/opentelemetry-collector/values/values.yaml
@@ -15,7 +15,7 @@ releases:
 - name: postgres-operator
  namespace: cnpg
  chart: cloudnative-pg/cloudnative-pg
-  version: 0.27.0
+  version: 0.28.2
  condition: postgres_operator.enabled
  values:
  - ../values/postgres-operator/values/postgres-operator.yaml.gotmpl
@@ -27,7 +27,7 @@ releases:
 - name: plugin-barman-cloud
  namespace: cnpg
  chart: cloudnative-pg/plugin-barman-cloud
-  version: 0.5.0
+  version: 0.6.0
  condition: postgres_operator.enabled
  values:
  - ../values/postgres-operator/values/plugin-barman-cloud.yaml.gotmpl
@@ -15,7 +15,7 @@ releases:
 - name: prometheus
  namespace: prometheus
  chart: prometheus/kube-prometheus-stack
-  version: 82.15.1
+  version: 86.2.0
  condition: prometheus.enabled
  values:
  - ../values/prometheus/values/prometheus.yaml.gotmpl
@@ -14,7 +14,7 @@ releases:
 - name: umami
  namespace: analytics
  chart: umami/umami
-  version: 7.7.20
+  version: 7.9.4
  condition: umami.enabled
  values:
  - ../values/umami/values/values.yaml
@@ -15,7 +15,7 @@ releases:
 - name: velero
  namespace: velero
  chart: velero/velero
-  version: 12.0.0
+  version: 12.0.2
  condition: velero.enabled
  values:
  - ../values/velero/values/velero.yaml.gotmpl
@@ -3,7 +3,8 @@ bases:

 repositories:
  - name: x509-exporter
-    url: 'https://charts.enix.io'
+    oci: true
+    url: 'quay.io/enix/charts'

 commonLabels:
  tier: sys
@@ -12,7 +13,7 @@ releases:
 - name: x509-exporter
  namespace: x509-exporter
  chart: x509-exporter/x509-certificate-exporter
-  version: 3.20.1
+  version: 4.1.0
  condition: x509_exporter.enabled
  values:
  - ../values/x509-exporter/values/x509-exporter.yaml.gotmpl
@@ -3,8 +3,8 @@
    "nixpkgs": {
      "type": "Channel",
      "name": "nixpkgs-unstable",
-      "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre961788.75690239f08f/nixexprs.tar.xz",
-      "hash": "sha256-p0h/nSeqzIkbn/2uFC4keoIPwmqXGHsX0gkCXM7km00="
+      "url": "https://releases.nixos.org/nixpkgs/nixpkgs-26.05pre981196.b86751bc4085/nixexprs.tar.xz",
+      "hash": "sha256-mBqzkn7oJti2hqeO8iTbDxKw+1ifxpP53feQ0CEXies="
    },
    "treefmt-nix": {
      "type": "Git",
@@ -15,9 +15,9 @@
      },
      "branch": "main",
      "submodules": false,
-      "revision": "71b125cd05fbfd78cab3e070b73544abe24c5016",
-      "url": "https://github.com/numtide/treefmt-nix/archive/71b125cd05fbfd78cab3e070b73544abe24c5016.tar.gz",
-      "hash": "sha256-6E/yhXP7Oy/NbXtf1ktzmU8SdVqJQ09HC/48ebEGBpk="
+      "revision": "790751ff7fd3801feeaf96d7dc416a8d581265ba",
+      "url": "https://github.com/numtide/treefmt-nix/archive/790751ff7fd3801feeaf96d7dc416a8d581265ba.tar.gz",
+      "hash": "sha256-pc20NRoMdiar8oPQceQT47UUZMBTiMdUuWrYu2obUP0="
    }
  },
  "version": 7
@@ -0,0 +1,151 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: arome-script
+  namespace: cron
+data:
+  download.py: |
+    import os
+    import sys
+    from netCDF4 import Dataset
+    import re
+    from datetime import datetime, timedelta
+
+    fname ="https://thredds.met.no/thredds/dodsC/meps25epsarchive/YEAR/MONTH/DAY/meps_det_sfc_YEARMONTHDAYT00Z.ncml"
+    outdir = "/data/hdd/data/AROME"
+
+
+    def generate_thredds_names(start, stop):
+        start_date = datetime(int(start.split("-")[0]),
+                              int(start.split("-")[1]),
+                              int(start.split("-")[2]))
+        end_date = datetime(int(stop.split("-")[0]),
+                            int(stop.split("-")[1]),
+                            int(stop.split("-")[2]))
+
+        date_list = []
+        while start_date <= end_date:
+            date_list.append(start_date)
+            start_date += timedelta(days=1)
+
+        fileList = []
+        for date in date_list:
+            y = str(date.year)
+            m = (str(date.month)).zfill(2)
+            d = (str(date.day)).zfill(2)
+
+            f = re.sub("YEAR", y, fname)
+            f = re.sub("MONTH", m, f)
+            f = re.sub("DAY", d, f)
+            fileList.append(f)
+
+        return fileList
+
+    def copy_thredds_file(threddsFile, savename):
+        dsin = Dataset(threddsFile)
+
+        dsout = Dataset(savename, "w")
+
+        for dname, the_dim in dsin.dimensions.items():
+            dsout.createDimension(dname, len(the_dim) if not the_dim.isunlimited() else None)
+
+        aromeNames = ["time",
+                      "longitude",
+                      "latitude",
+                      "land_area_fraction",
+                      "air_temperature_2m",
+                      "precipitation_amount_acc",
+                      "water_evaporation_amount",
+                      "relative_humidity_2m",
+                      "integral_of_surface_downwelling_longwave_flux_in_air_wrt_time",
+                      "integral_of_surface_net_downward_shortwave_flux_wrt_time",
+                      "air_pressure_at_sea_level",
+                      "x_wind_10m",
+                      "y_wind_10m"]
+
+        for v_name, varin in dsin.variables.items():
+            if v_name in aromeNames:
+                fill_value = None
+
+                if hasattr(varin, "_FillValue"):
+                    fill_value = varin._FillValue
+
+                outVar = dsout.createVariable(v_name, varin.datatype, varin.dimensions, fill_value=fill_value)
+
+                outVar.setncatts({k: varin.getncattr(k) for k in varin.ncattrs() if k not in ["_FillValue"]})
+
+                outVar[:] = varin[:]
+        dsout.close()
+
+
+    os.makedirs(outdir, exist_ok=True)
+
+    fList = generate_thredds_names("2026-04-24", datetime.today().strftime("%Y-%m-%d"))
+    failed = False
+    for fname in fList:
+        savename = os.path.join(outdir, fname.split("/")[-1].split(".")[0] + ".nc")
+        if os.path.exists(savename):
+            print(f"Skipping {savename}, already exists")
+            continue
+        print(savename)
+        try:
+            try:
+                copy_thredds_file(fname, savename)
+            except:
+                alt_fname = re.sub("sfc", "2_5km", fname)
+                alt_fname = re.sub("ncml", "nc", alt_fname)
+                copy_thredds_file(alt_fname, savename)
+        except Exception as e:
+            print(f"File not found: {fname} ({e})")
+            failed = True
+
+    if failed:
+        sys.exit(1)
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: arome
+  namespace: cron
+spec:
+  schedule: 0 6 * * * # Everyday at 06:00, use https://crontab.guru
+  concurrencyPolicy: "Forbid" # If only one at at time set to Allow else Forbid
+  successfulJobsHistoryLimit: 10
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      backoffLimit: 3
+      template:
+        spec:
+          restartPolicy: "Never"
+          containers:
+            - name: cronpod
+              image: juselius/busynix:1.1
+              imagePullPolicy: IfNotPresent
+              command:
+                - /bin/sh
+                - -c
+                - |
+                  if nix-shell -p 'python3.withPackages(ps: [ps.netcdf4])' --run 'python3 /scripts/download.py'; then
+                    chown -R 5000:5000 /data/hdd/data/AROME
+                    chmod -R g+w /data/hdd/data/AROME
+                  else
+                    echo "Job failed, sleeping 30 minutes before retry..."
+                    sleep 1800
+                    exit 1
+                  fi
+              resources: {}
+              volumeMounts:
+              - name: data
+                mountPath: /data
+              - name: script
+                mountPath: /scripts
+              securityContext: {}
+          volumes:
+          - name: data
+            persistentVolumeClaim:
+              claimName: ekman-data
+          - name: script
+            configMap:
+              name: arome-script
+              defaultMode: 0755
@@ -0,0 +1,178 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: mur-script
+  namespace: cron
+data:
+  download.py: |
+    import argparse
+    import os
+    import sys
+    import requests
+    from datetime import datetime
+
+    parser = argparse.ArgumentParser(description="Download MUR SST files from NASA Earthdata")
+    parser.add_argument("-sd", "--start_date", required=True, help="Start date (YYYY-MM-DD)")
+    parser.add_argument("-ed", "--end_date", required=True, help="End date (YYYY-MM-DD)")
+    parser.add_argument("-o", "--out_dir", default="MUR_SST_nc", help="Output directory")
+    parser.add_argument("-v", "--verbose", action="store_true", help="Verbose output")
+    args = parser.parse_args()
+
+
+    def create_session():
+        session = requests.Session()
+        session.headers.update({
+            "User-Agent": "mur-sst-downloader",
+            "Accept-Encoding": "identity"
+        })
+        return session
+
+
+    def get_download_urls(startdate, enddate, verbose=False):
+        url = (
+            "https://cmr.earthdata.nasa.gov/search/granules.umm_json"
+            f"?collection_concept_id=C1996881146-POCLOUD"
+            f"&temporal={startdate}T00:00:00Z,{enddate}T00:00:00Z"
+            "&pageSize=365"
+        )
+
+        r = requests.get(url)
+        r.raise_for_status()
+        data = r.json()
+
+        urls = []
+        for item in data["items"]:
+            for link in item["umm"]["RelatedUrls"]:
+                # Prefer direct HTTPS download links
+                if link.get("Type") == "GET DATA":
+                    urls.append(link["URL"])
+
+        if verbose:
+            print(f"Found {len(urls)} files")
+
+        return urls
+
+
+    def download_file(session, url, out_dir, verbose=False):
+        filename = os.path.basename(url)
+        local_path = os.path.join(out_dir, filename)
+
+        if os.path.exists(local_path):
+            if verbose:
+                print(f"Skipping existing: {filename}")
+            return True
+
+        if verbose:
+            print(f"Downloading: {filename}")
+
+        try:
+            with session.get(url, stream=True, allow_redirects=True, timeout=60) as r:
+                if r.status_code == 401:
+                    raise Exception("Unauthorized (check .netrc credentials)")
+
+                r.raise_for_status()
+
+                with open(local_path, "wb") as f:
+                    for chunk in r.iter_content(chunk_size=8192):
+                        if chunk:
+                            f.write(chunk)
+
+            if verbose:
+                print(f"Saved: {filename}")
+            return True
+
+        except Exception as e:
+            print(f"Failed: {filename} -> {e}")
+            return False
+
+
+    def validate_dates(start, end):
+        try:
+            datetime.strptime(start, "%Y-%m-%d")
+            datetime.strptime(end, "%Y-%m-%d")
+        except ValueError:
+            print("Error: Dates must be in YYYY-MM-DD format")
+            sys.exit(1)
+
+
+    def main():
+        validate_dates(args.start_date, args.end_date)
+
+        # os.makedirs(args.out_dir, exist_ok=True)
+
+        session = create_session()
+
+        urls = get_download_urls(args.start_date, args.end_date, args.verbose)
+
+        failed = False
+        for url in urls:
+            if not download_file(session, url, args.out_dir, args.verbose):
+                failed = True
+
+        if failed:
+            sys.exit(1)
+        print(f"\nDone. Downloaded files to: {args.out_dir}")
+
+
+    if __name__ == "__main__":
+        main()
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: mur
+  namespace: cron
+spec:
+  schedule: "0 6 * * *" # Everyday at 06:00, use https://crontab.guru
+  concurrencyPolicy: "Forbid"
+  successfulJobsHistoryLimit: 10
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      backoffLimit: 3
+      template:
+        spec:
+          restartPolicy: "Never"
+          containers:
+            - name: cronpod
+              image: juselius/busynix:1.1
+              imagePullPolicy: IfNotPresent
+              command:
+                - /bin/sh
+                - -c
+                - |
+                  nix-shell -p 'python3.withPackages(ps: [ps.requests])' coreutils --run '
+                    python3 /scripts/download.py \
+                      -sd $(date -d "3 days ago" +%Y-%m-%d) \
+                      -ed $(date +%Y-%m-%d) \
+                      -o /data/hdd/data/river-data/MUR/MUR_SST_nc \
+                      -v &&
+                    chown -R 5000:5000 /data/hdd/data/river-data/MUR/MUR_SST_nc &&
+                    chmod -R g+w /data/hdd/data/river-data/MUR/MUR_SST_nc
+                  ' || {
+                    echo "Job failed, sleeping 30 minutes before retry..."
+                    sleep 1800
+                    exit 1
+                  }
+              resources: {}
+              volumeMounts:
+                - name: data
+                  mountPath: /data
+                - name: script
+                  mountPath: /scripts
+                - name: netrc
+                  mountPath: /root/.netrc
+                  subPath: .netrc
+                  readOnly: true
+              securityContext: {}
+          volumes:
+            - name: data
+              persistentVolumeClaim:
+                claimName: ekman-data
+            - name: script
+              configMap:
+                name: mur-script
+                defaultMode: 0755
+            - name: netrc
+              secret:
+                secretName: mur-netrc
@@ -0,0 +1,245 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nemo-script
+  namespace: cron
+data:
+  download.sh: |
+    #!/usr/bin/env bash
+
+    # this script downloads files from
+    # https://data.marine.copernicus.eu/product/NWSHELF_ANALYSISFORECAST_PHY_004_013
+
+    set -euf -o pipefail
+
+    START_DATE="$1"
+    END_DATE="$2"
+
+    current_date="$START_DATE"
+
+    while [[ "$current_date" < "$END_DATE" ]]; do
+      next_date=$(date -I -d "$current_date + 1 day")
+      echo "Running subset for $current_date to $next_date"
+
+      outfile="cmems_mod_nws_phy-sal_anfc_1.5km-3D_PT1H-i_${current_date}--${next_date}.nc"
+      if [[ -f "/data/hdd/data/NEMO/$outfile" ]]; then
+        echo "Skipping salt (already exists)"
+      else
+        copernicusmarine subset \
+          --dataset-id cmems_mod_nws_phy-sal_anfc_1.5km-3D_PT1H-i \
+          -t "$current_date" \
+          -T "$next_date" \
+          -f "$outfile" \
+          -o /data/hdd/data/NEMO/
+        echo "Downloaded salt"
+      fi
+
+      outfile="cmems_mod_nws_phy-cur_anfc_1.5km-3D_PT1H-i_${current_date}--${next_date}.nc"
+      if [[ -f "/data/hdd/data/NEMO/$outfile" ]]; then
+        echo "Skipping currents (already exists)"
+      else
+        copernicusmarine subset \
+          --dataset-id cmems_mod_nws_phy-cur_anfc_1.5km-3D_PT1H-i \
+          -t "$current_date" \
+          -T "$next_date" \
+          -f "$outfile" \
+          -o /data/hdd/data/NEMO/
+        echo "Downloaded currents"
+      fi
+
+      outfile="cmems_mod_nws_phy-tem_anfc_1.5km-3D_PT1H-i_${current_date}--${next_date}.nc"
+      if [[ -f "/data/hdd/data/NEMO/$outfile" ]]; then
+        echo "Skipping temperature (already exists)"
+      else
+        copernicusmarine subset \
+          --dataset-id cmems_mod_nws_phy-tem_anfc_1.5km-3D_PT1H-i \
+          -t "$current_date" \
+          -T "$next_date" \
+          -f "$outfile" \
+          -o /data/hdd/data/NEMO/
+        echo "Downloaded temperature"
+      fi
+
+      outfile="cmems_mod_nws_phy-ssh_anfc_1.5km-2D_PT15M-i_${current_date}--${next_date}.nc"
+      if [[ -f "/data/hdd/data/NEMO/$outfile" ]]; then
+        echo "Skipping ssh (already exists)"
+      else
+        copernicusmarine subset \
+          --dataset-id cmems_mod_nws_phy-ssh_anfc_1.5km-2D_PT15M-i \
+          -t "$current_date" \
+          -T "$next_date" \
+          -f "$outfile" \
+          -o /data/hdd/data/NEMO/
+        echo "Downloaded ssh"
+      fi
+
+      current_date="$next_date"
+    done
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nemo-nix
+  namespace: cron
+data:
+  shell.nix: |
+    let
+      nixpkgs = builtins.fetchTarball {
+        url = "https://releases.nixos.org/nixos/25.11/nixos-25.11.9586.10e7ad5bbcb4/nixexprs.tar.xz";
+        sha256 = "sha256-wjAIDqQxE+kWV2lbykQCcS+F0ArQwmN8iNw0kcj4iaA=";
+      };
+      pkgs = import nixpkgs { overlays = [ (import ./default.nix) ]; };
+    in pkgs.mkShell {
+      buildInputs = [
+        (pkgs.python3.withPackages (ps: [ pkgs.copernicusmarine ]))
+        pkgs.coreutils
+        pkgs.bash
+      ];
+    }
+  default.nix: |
+    final: prev: {
+      arcosparse = prev.callPackage ./arcosparse.nix { };
+      copernicusmarine = prev.callPackage ./copernicusmarine.nix {
+        arcosparse = final.arcosparse;
+      };
+    }
+  copernicusmarine.nix: |
+    {
+      fetchPypi,
+      python3Packages,
+      arcosparse,
+    }:
+    python3Packages.buildPythonPackage rec {
+      pname = "copernicusmarine";
+      version = "2.2.2";
+      format = "pyproject";
+
+      src = fetchPypi {
+        inherit version;
+        pname = "copernicusmarine";
+        sha256 = "sha256-5T3iH4Hh08wIao2MMveb/bVnVz0pK0PoN4CRk811P0g=";
+      };
+
+      pythonRelaxDeps = true;
+
+      nativeBuildInputs = [ python3Packages.poetry-core ];
+      propagatedBuildInputs = with python3Packages; [
+        boto3
+        click
+        dask
+        h5netcdf
+        arcosparse
+        lxml
+        numpy
+        pydantic
+        pystac
+        requests
+        semver
+        setuptools
+        tqdm
+        xarray
+        zarr
+      ];
+    }
+  arcosparse.nix: |
+    {
+      fetchPypi,
+      python3Packages,
+    }:
+    python3Packages.buildPythonPackage rec {
+      pname = "arcosparse";
+      version = "0.4.2";
+      format = "pyproject";
+
+      src = fetchPypi {
+        inherit version;
+        pname = "arcosparse";
+        sha256 = "sha256-Z8NW+dsC3uXk101kr8tzsgjAoFb4KNdGkxyFkJ5UhFA=";
+      };
+
+      pythonRelaxDeps = true;
+
+      nativeBuildInputs = [ python3Packages.poetry-core ];
+      propagatedBuildInputs = with python3Packages; [
+        pyarrow
+        pandas
+        pystac
+        tqdm
+        requests
+      ];
+    }
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: nemo
+  namespace: cron
+spec:
+  schedule: "0 13 * * *" # Everyday at 13:00, use https://crontab.guru
+  concurrencyPolicy: "Forbid"
+  successfulJobsHistoryLimit: 10
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      backoffLimit: 3
+      template:
+        spec:
+          restartPolicy: "Never"
+          containers:
+            - name: cronpod
+              image: ghcr.io/lix-project/lix:latest
+              imagePullPolicy: IfNotPresent
+              command:
+                - /bin/sh
+                - -c
+                - |
+                  nix-shell /nix-overlay/shell.nix \
+                    --keep COPERNICUSMARINE_SERVICE_USERNAME \
+                    --keep COPERNICUSMARINE_SERVICE_PASSWORD \
+                    --run '
+                    copernicusmarine login \
+                      --username "$COPERNICUSMARINE_SERVICE_USERNAME" \
+                      --password "$COPERNICUSMARINE_SERVICE_PASSWORD" \
+                      --force-overwrite &&
+                    bash /scripts/download.sh \
+                      $(date -d "2 days ago" +%Y-%m-%d) \
+                      $(date +%Y-%m-%d) &&
+                    chown -R 5000:5000 /data/hdd/data/NEMO &&
+                    chmod -R g+w /data/hdd/data/NEMO
+                  ' || {
+                    echo "Job failed, sleeping 30 minutes before retry..."
+                    sleep 1800
+                    exit 1
+                  }
+              env:
+                - name: COPERNICUSMARINE_SERVICE_USERNAME
+                  valueFrom:
+                    secretKeyRef:
+                      name: nemo-credentials
+                      key: username
+                - name: COPERNICUSMARINE_SERVICE_PASSWORD
+                  valueFrom:
+                    secretKeyRef:
+                      name: nemo-credentials
+                      key: password
+              resources: {}
+              volumeMounts:
+                - name: data
+                  mountPath: /data
+                - name: script
+                  mountPath: /scripts
+                - name: nix
+                  mountPath: /nix-overlay
+              securityContext: {}
+          volumes:
+            - name: data
+              persistentVolumeClaim:
+                claimName: ekman-data
+            - name: script
+              configMap:
+                name: nemo-script
+                defaultMode: 0755
+            - name: nix
+              configMap:
+                name: nemo-nix
+                defaultMode: 0644
@@ -0,0 +1,113 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: norkyst-script
+  namespace: cron
+data:
+  download.sh: |
+    #!/usr/bin/env bash
+
+    # this script downloads files from:
+    # https://thredds.met.no/thredds/catalog/fou-hi/new_norkyst800m/norkyst_v3_test/his/catalog.html
+
+    # safe bash settings
+    set -euf -o pipefail
+
+    JOBS=8  # parallel downloads
+
+    # define start and end dates (YYYY-MM-DD)
+    start_date=$(date -d "yesterday" +%Y-%m-%d)
+    end_date=$(date -d "yesterday" +%Y-%m-%d)
+
+    # check if thredds is reachable before attempting any downloads
+    if ! wget --spider --quiet "https://thredds.met.no/thredds/catalog/fou-hi/new_norkyst800m/norkyst_v3_test/his/catalog.html"; then
+        echo "thredds.met.no is unreachable, aborting"
+        exit 1
+    fi
+
+    # function to print stuff in red
+    red() {
+        printf "\e[31m%s\e[0m" "$1"
+    }
+
+    download_day() {
+        local current_date="$1"
+        local year month day file_name target_file_name url
+        year=$(date -d "${current_date}" +%Y)
+        month=$(date -d "${current_date}" +%m)
+        day=$(date -d "${current_date}" +%d)
+
+        mkdir -p "/data/hdd/data/norkyst/${year}/${month}"
+
+        file_name="norkyst800_his_sdepth_${year}${month}${day}T00Z_m00_AN.nc"
+        target_file_name="/data/hdd/data/norkyst/${year}/${month}/${file_name}"
+        url="https://thredds.met.no/thredds/fileServer/fou-hi/new_norkyst800m/norkyst_v3_test/his/${year}/${month}/${day}/${file_name}"
+
+        if [[ ! -f "${target_file_name}" ]]; then
+            if wget --spider --quiet "${url}"; then
+                echo "downloading ${url}"
+                wget --tries=5 --waitretry=60 -O "${target_file_name}" "${url}"
+            else
+                echo "${target_file_name} $(red 'not found on server')"
+            fi
+        else
+            echo "${target_file_name} already exists locally"
+        fi
+    }
+
+    export -f download_day red
+
+    current_date=$(date -d "${start_date}" +%Y-%m-%d)
+    while [[ "${current_date}" < "${end_date}" || "${current_date}" == "${end_date}" ]]; do
+        echo "${current_date}"
+        current_date=$(date -d "${current_date} + 1 day" +%Y-%m-%d)
+    done | parallel -j "${JOBS}" download_day
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: norkyst
+  namespace: cron
+spec:
+  schedule: 0 13 * * * # Everyday at 13:00, use https://crontab.guru
+  concurrencyPolicy: "Allow"
+  successfulJobsHistoryLimit: 10
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      backoffLimit: 3
+      template:
+        spec:
+          restartPolicy: "Never"
+          containers:
+            - name: cronpod
+              image: juselius/busynix:1.1
+              imagePullPolicy: IfNotPresent
+              command:
+                - /bin/sh
+                - -c
+                - |
+                  nix-env -iA nixpkgs.wget nixpkgs.coreutils nixpkgs.bash nixpkgs.parallel
+                  if bash /scripts/download.sh; then
+                    chown -R 10000:10000 /data/hdd/data/norkyst
+                    chmod -R g+w /data/hdd/data/norkyst
+                  else
+                    echo "Job failed, sleeping 30 minutes before retry..."
+                    sleep 1800
+                    exit 1
+                  fi
+              resources: {}
+              volumeMounts:
+              - name: data
+                mountPath: /data
+              - name: script
+                mountPath: /scripts
+              securityContext: {}
+          volumes:
+          - name: data
+            persistentVolumeClaim:
+              claimName: ekman-data
+          - name: script
+            configMap:
+              name: norkyst-script
+              defaultMode: 0755
@@ -0,0 +1,153 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: norshelf-script
+  namespace: cron
+data:
+  download.sh: |
+    #!/usr/bin/env bash
+
+    # this script downloads files from:
+    # https://thredds.met.no/thredds/catalog/sea_norshelf_files/YYYY/catalog.html
+
+    # safe bash settings
+    set -euf -o pipefail
+
+    # define start and end dates (YYYY-MM-DD)
+    start_date="2026-03-01"
+    end_date=$(date +%Y-%m-%d)
+
+    # check if thredds is reachable before attempting any downloads
+    if ! wget --spider --quiet "https://thredds.met.no/thredds/catalog/sea_norshelf_files/catalog.html"; then
+        echo "thredds.met.no is unreachable, aborting"
+        exit 1
+    fi
+
+    # function to print stuff in red
+    red() {
+        printf "\e[31m%s\e[0m" "$1"
+    }
+
+    current_date=$(date -d "${start_date}" +%Y-%m-%d)
+    while [[ "${current_date}" < "${end_date}" || "${current_date}" == "${end_date}" ]]; do
+        year=$(date -d "${current_date}" +%Y)
+        month=$(date -d "${current_date}" +%m)
+        day=$(date -d "${current_date}" +%d)
+
+        mkdir -p "/data/hdd/data/norshelf/sea_norshelf_files/${year}/${month}"
+
+        file_name="norshelf_qck_an_${year}${month}${day}T00Z.nc"
+        target_file_name="/data/hdd/data/norshelf/sea_norshelf_files/${year}/${month}/${file_name}"
+        url="https://thredds.met.no/thredds/fileServer/sea_norshelf_files/${year}/${month}/${file_name}"
+
+        if [[ ! -f "${target_file_name}" ]]; then
+            if wget --spider --quiet "${url}"; then
+                echo "downloading ${url}"
+                wget --tries=5 --waitretry=60 -O "${target_file_name}" "${url}"
+            else
+                echo "${target_file_name} $(red 'not found on server')"
+            fi
+        else
+            echo "${target_file_name} already exists locally"
+        fi
+
+        # move to next day
+        current_date=$(date -d "${current_date} + 1 day" +%Y-%m-%d)
+    done
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: norshelf
+  namespace: cron
+spec:
+  schedule: 0 13 * * * # Everyday at 13:00, use https://crontab.guru
+  concurrencyPolicy: "Forbid" # If only one at at time set to Allow else Forbid
+  successfulJobsHistoryLimit: 10
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      backoffLimit: 3
+      template:
+        spec:
+          restartPolicy: "Never"
+          containers:
+            - name: cronpod
+              image: juselius/busynix:1.1
+              imagePullPolicy: IfNotPresent
+              command:
+                - /bin/sh
+                - -c
+                - |
+                  nix-env -iA nixpkgs.wget nixpkgs.coreutils nixpkgs.bash
+                  if bash /scripts/download.sh; then
+                    chown -R 5000:5000 /data/hdd/data/norshelf
+                    chmod -R g+w /data/hdd/data/norshelf
+                  else
+                    echo "Job failed, sleeping 30 minutes before retry..."
+                    sleep 1800
+                    exit 1
+                  fi
+              resources: {}
+              volumeMounts:
+              - name: data
+                mountPath: /data
+              - name: script
+                mountPath: /scripts
+              securityContext: {}
+          volumes:
+          - name: data
+            persistentVolumeClaim:
+              claimName: ekman-data
+          - name: script
+            configMap:
+              name: norshelf-script
+              defaultMode: 0755
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: ekman-data
+  namespace: cron
+spec:
+  accessModes:
+  - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: ""
+  volumeMode: Filesystem
+  volumeName: pv-ekman-data
+status:
+  accessModes:
+  - ReadWriteMany
+  capacity:
+    storage: 1Gi
+---
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: pv-ekman-data
+spec:
+  accessModes:
+  - ReadWriteMany
+  claimRef:
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    name: ekman-data
+    namespace: cron
+  capacity:
+    storage: 1Gi
+  csi:
+    driver: rook-ceph.cephfs.csi.ceph.com
+    nodeStageSecretRef:
+      name: rook-csi-cephfs-node
+      namespace: rook-ceph
+    volumeAttributes:
+      clusterID: rook-ceph
+      fsName: data
+      rootPath: /
+      staticVolume: "true"
+    volumeHandle: pv-ekman-data
+  persistentVolumeReclaimPolicy: Retain
+  volumeMode: Filesystem
@@ -0,0 +1,60 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: nve-config
+  namespace: cron
+data:
+  appsettings.json: |
+    {
+        "NveUrl":  "https://chartserver.nve.no/ShowData.aspx?req=getchart&ver=1.0",
+        "DataDir": "/data/hdd/data/river-data"
+    }
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  name: nve
+  namespace: cron
+spec:
+  schedule: "0 8 * * *" # Everyday at 08:00, use https://crontab.guru
+  concurrencyPolicy: "Forbid"
+  successfulJobsHistoryLimit: 10
+  failedJobsHistoryLimit: 3
+  jobTemplate:
+    spec:
+      backoffLimit: 3
+      template:
+        spec:
+          restartPolicy: "Never"
+          containers:
+            - name: cronpod
+              image: git.oceanbox.io/oceanbox/churn/riverrun:24a8bbbc-debug
+              imagePullPolicy: IfNotPresent
+              command:
+                - /bin/sh
+                - -c
+                - |
+                  if riverrun data --download --ndays 5000; then
+                    chown -R 5000:5000 /data/hdd/data/river-data/Data
+                    chmod -R g+w /data/hdd/data/river-data/Data
+                  else
+                    echo "Job failed, sleeping 30 minutes before retry..."
+                    sleep 1800
+                    exit 1
+                  fi
+              resources: {}
+              volumeMounts:
+                - name: data
+                  mountPath: /data
+                - name: config
+                  mountPath: /app/appsettings.json
+                  subPath: appsettings.json
+                  readOnly: true
+              securityContext: {}
+          volumes:
+            - name: data
+              persistentVolumeClaim:
+                claimName: ekman-data
+            - name: config
+              configMap:
+                name: nve-config
@@ -3,10 +3,12 @@
  "extends": [
    "config:recommended"
  ],
+  "minimumReleaseAge": "7 days",
  "dependencyDashboard": true,
  "semanticCommits": "disabled",
  "ignorePaths": [
-    "**/bootstrap/**"
+    "**/bootstrap/**",
+    "**/attic/**"
  ],
  "helmfile": {
    "managerFilePatterns": [
@@ -94,18 +94,22 @@ spec:
    server: https://kubernetes.default.svc
  - namespace: jobset-system
    server: https://kubernetes.default.svc
+  - namespace: ingress-haproxy
+    server: https://kubernetes.default.svc
  - namespace: dex
    server: https://kubernetes.default.svc
  - namespace: cra-agent
    server: https://kubernetes.default.svc
  - namespace: catalyst
    server: https://kubernetes.default.svc
+  - namespace: niks3
+    server: https://kubernetes.default.svc
  sourceRepos:
  - https://argoproj.github.io/argo-helm
  - https://kubernetes-sigs.github.io/metrics-server/
  - https://git.oceanbox.io/platform/manifests.git
  - https://git.oceanbox.io/platform/manifests
-  - https://gitlab.com/oceanbox/manifests.git
+  - https://git.oceanbox.io/oceanbox/manifests.git
  - https://kubernetes.github.io/ingress-nginx
  - https://cloudnative-pg.github.io/charts
  - https://charts.jetstack.io
@@ -139,6 +143,7 @@ spec:
  - ghcr.io/spegel-org/helm-charts
  - quay.io/cilium/charts
  - quay.io/jetstack/charts
+  - quay.io/enix/charts
  - registry.k8s.io/jobset/charts/jobset
  - ghcr.io/dragonflydb/dragonfly-operator/helm/dragonfly-operator
  - docker.gitea.com
@@ -148,3 +153,4 @@ spec:
  - https://twin.github.io/helm-charts
  - https://charts.dexidp.io
  - public.ecr.aws/diagrid/catalyst
+  - ghcr.io/haproxytech/helm-charts
@@ -3,7 +3,8 @@ kind: ConfigMap
 metadata:
  name: beta-atlantis-actor-config
 data:
-  XTRACT_IMAGE: "git.oceanbox.io/oceanbox/katamari/excavator:v1.2.8"
+  KUEUE_NAMESPACE: "prod-queue"
+  XTRACT_IMAGE: "git.oceanbox.io/oceanbox/katamari/excavator:v1.2.14"
  XTRACT_QUEUE: "prod-queue"
-  PLUME_IMAGE: "git.oceanbox.io/oceanbox/katamari/plume:v1.2.8"
+  PLUME_IMAGE: "git.oceanbox.io/oceanbox/katamari/plume:v1.2.14"
  PLUME_QUEUE: "prod-queue"
@@ -76,7 +76,7 @@
        "https://maps.beta.oceanbox.io"
    ],
    "appName": "atlantis",
-    "appEnv": "prod",
+    "appEnv": "preprod",
    "appNamespace": "atlantis",
    "appVersion": "2.95.1",
    "otelCollector": "http://opentelemetry-collector.otel.svc:4317",
@@ -3,6 +3,7 @@ kind: ConfigMap
 metadata:
  name: prod-atlantis-actor-config
 data:
+  KUEUE_NAMESPACE: "prod-queue"
  XTRACT_IMAGE: "git.oceanbox.io/oceanbox/katamari/excavator:v1.2.8"
  XTRACT_QUEUE: "prod-queue"
  PLUME_IMAGE: "git.oceanbox.io/oceanbox/katamari/plume:v1.2.8"
@@ -3,7 +3,7 @@ kind: ConfigMap
 metadata:
  name: staging-atlantis-actor-config
 data:
-  XTRACT_IMAGE: "git.oceanbox.io/oceanbox/katamari/excavator:v1.2.8"
+  XTRACT_IMAGE: "git.oceanbox.io/oceanbox/katamari/excavator:v1.4.0"
  XTRACT_QUEUE: "dev-queue"
-  PLUME_IMAGE: "git.oceanbox.io/oceanbox/katamari/plume:v1.2.8"
+  PLUME_IMAGE: "git.oceanbox.io/oceanbox/katamari/plume:v1.4.0"
  PLUME_QUEUE: "dev-queue"
@@ -2,7 +2,7 @@ replicaCount: 1

 image:
  repository: git.oceanbox.io/oceanbox/poseidon/atlantis
-  tag: v1.48.1
+  tag: v2.13.1

 podAnnotations:
  dapr.io/app-id: "beta-atlantis"
@@ -11,7 +11,7 @@ env:
  - name: APP_NAMESPACE
    value: beta-atlantis
  - name: APP_VERSION
-    value: "2.97.4-beta"
+    value: "2.13.1-beta"
  - name: LOG_LEVEL
    value: "1"
  - name: ANALYTICS_WEB_ID
@@ -1,7 +1,7 @@
 replicaCount: 1
 image:
  repository: git.oceanbox.io/oceanbox/poseidon/atlantis
-  tag: d83c8790-debug
+  tag: 4733e529-debug
 podAnnotations:
  dapr.io/app-id: "staging-atlantis"
 env:
@@ -1,2 +0,0 @@
-attic:
-  enabled: false
@@ -1,27 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: attic
-  namespace: argocd
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-spec:
-  destination:
-    namespace: attic
-    server: "https://kubernetes.default.svc"
-  sources:
-    - repoURL: https://git.oceanbox.io/oceanbox/manifests.git
-      targetRevision: HEAD
-      path: values/attic/manifests
-  project: aux
-  syncPolicy:
-    managedNamespaceMetadata:
-      labels:
-        component: aux
-    syncOptions:
-      - CreateNamespace=true
-      - ApplyOutOfSyncOnly=true
-      # - ServerSideApply=true
-    automated:
-      prune: true
-      # selfHeal: false
@@ -1,167 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  labels:
-    app.kubernetes.io/name: attic
-  name: attic-config
-  namespace: attic
-data:
-  config.toml: |
-    # src: https://github.com/zhaofengli/attic/blob/main/server/src/config-template.toml
-
-    # Socket address to listen on
-    listen = "[::]:8080"
-
-    # Allowed `Host` headers
-    #
-    # This _must_ be configured for production use. If unconfigured or the
-    # list is empty, all `Host` headers are allowed.
-    allowed-hosts = []
-
-    # The canonical API endpoint of this server
-    #
-    # This is the endpoint exposed to clients in `cache-config` responses.
-    #
-    # This _must_ be configured for production use. If not configured, the
-    # API endpoint is synthesized from the client's `Host` header which may
-    # be insecure.
-    #
-    # The API endpoint _must_ end with a slash (e.g., `https://domain.tld/attic/`
-    # not `https://domain.tld/attic`).
-    api-endpoint = "https://attic.srv.oceanbox.io/"
-
-    # Whether to soft-delete caches
-    #
-    # If this is enabled, caches are soft-deleted instead of actually
-    # removed from the database. Note that soft-deleted caches cannot
-    # have their names reused as long as the original database records
-    # are there.
-    #soft-delete-caches = false
-
-    # Whether to require fully uploading a NAR if it exists in the global cache.
-    #
-    # If set to false, simply knowing the NAR hash is enough for
-    # an uploader to gain access to an existing NAR in the global
-    # cache.
-    #require-proof-of-possession = true
-
-    # Database connection
-    [database]
-    # Connection URL
-    #
-    # For production use it's recommended to use PostgreSQL.
-    url = "postgresql://app:mZP1BnmnpDU33B7UZvomYKOSS1laRJ4bvUR7jNDZ1AJqPdNxH2rLXykghczg7Bgy@attic-db-rw:5432/app"
-
-    # Whether to enable sending on periodic heartbeat queries
-    #
-    # If enabled, a heartbeat query will be sent every minute
-    #heartbeat = false
-
-    # File storage configuration
-    [storage]
-    # Storage type
-    #
-    # Can be "local" or "s3".
-    type = "local"
-
-    # ## Local storage
-
-    # The directory to store all files under
-    path = "/attic"
-
-    # ## S3 Storage (set type to "s3" and uncomment below)
-
-    # The AWS region
-    #region = "us-east-1"
-
-    # The name of the bucket
-    #bucket = "some-bucket"
-
-    # Custom S3 endpoint
-    #
-    # Set this if you are using an S3-compatible object storage (e.g., Minio).
-    #endpoint = "https://xxx.r2.cloudflarestorage.com"
-
-    # Credentials
-    #
-    # If unset, the credentials are read from the `AWS_ACCESS_KEY_ID` and
-    # `AWS_SECRET_ACCESS_KEY` environment variables.
-    #[storage.credentials]
-    #  access_key_id = ""
-    #  secret_access_key = ""
-
-    # Data chunking
-    #
-    # Warning: If you change any of the values here, it will be
-    # difficult to reuse existing chunks for newly-uploaded NARs
-    # since the cutpoints will be different. As a result, the
-    # deduplication ratio will suffer for a while after the change.
-    [chunking]
-    # The minimum NAR size to trigger chunking
-    #
-    # If 0, chunking is disabled entirely for newly-uploaded NARs.
-    # If 1, all NARs are chunked.
-    nar-size-threshold = 65536 # chunk files that are 64 KiB or larger
-
-    # The preferred minimum size of a chunk, in bytes
-    min-size = 16384            # 16 KiB
-
-    # The preferred average size of a chunk, in bytes
-    avg-size = 65536            # 64 KiB
-
-    # The preferred maximum size of a chunk, in bytes
-    max-size = 262144           # 256 KiB
-
-    # Compression
-    [compression]
-    # Compression type
-    #
-    # Can be "none", "brotli", "zstd", or "xz"
-    type = "zstd"
-
-    # Compression level
-    #level = 8
-
-    # Garbage collection
-    [garbage-collection]
-    # The frequency to run garbage collection at
-    #
-    # By default it's 12 hours. You can use natural language
-    # to specify the interval, like "1 day".
-    #
-    # If zero, automatic garbage collection is disabled, but
-    # it can still be run manually with `atticd --mode garbage-collector-once`.
-    interval = "1 week"
-
-    # Default retention period
-    #
-    # Zero (default) means time-based garbage-collection is
-    # disabled by default. You can enable it on a per-cache basis.
-    default-retention-period = "6 months"
-
-    [jwt]
-    # WARNING: Changing _anything_ in this section will break any existing
-    # tokens. If you need to regenerate them, ensure that you use the the
-    # correct secret and include the `iss` and `aud` claims.
-
-    # JWT `iss` claim
-    #
-    # Set this to the JWT issuer that you want to validate.
-    # If this is set, all received JWTs will validate that the `iss` claim
-    # matches this value.
-    #token-bound-issuer = "some-issuer"
-
-    # JWT `aud` claim
-    #
-    # Set this to the JWT audience(s) that you want to validate.
-    # If this is set, all received JWTs will validate that the `aud` claim
-    # contains at least one of these values.
-    #token-bound-audiences = ["some-audience1", "some-audience2"]
-
-    [jwt.signing]
-    # JWT RS256 secret key
-    #
-    # Set this to the base64-encoded private half of an RSA PEM PKCS1 key.
-    # You can also set it via the `ATTIC_SERVER_TOKEN_RS256_SECRET_BASE64`
-    # environment variable.
-    token-rs256-secret-base64 = "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS2dJQkFBS0NBZ0VBdlZrMHQyZUtvdjhpV3prVFFtQzJtRklvd0gxc2liNlVpUFhUaGVwcURiWHMyaERFCnFYa1pKUXRjTnY0T2RtcldmZ2tsbjVyblJNQk5yL1B5dE05OFFMVVJnbzFSU2VTeUVjcmxSU1N4MElVRlhkM3YKV0U0aTJJTktsSzgxblJoY0o4czRUM09iYUpvSUQweEpqS2IzMkhxZmpOSU1vcVdBRk1ES2YyMUM5OWxQeTRXSgpVUUVnYTRzbHo5RzZHVi8wZW5qbFNMa2RRNjEvdEwyRE1ISHgvV2VRUEtpWkF4c2Fwczd3ZVJiNVBrS3J0MVlGClRxa1lJSjY3eDFiNDR1N0NmdWdVbHhMM2JCQ1lqVXVXNnoxdGU3T2ZQUUhoM1FPU2lFZTczQ3I4dU1lSkplV0wKN2VKc1hWSG9uVzBMZWl0aDk5WmJTUTF3YlhieDVPZzNTQ3ZWYnkyZE90Y3Rud2Y2aDN5YlJ3SUNoc24xbk4zMwowRkMyOXlFY0ExQ2VFVzRsMVVHNmxoMGw5cEpiWEhRNlFJS1paempaTlgxZTRGRW5TdytGNGhXd3R1Z2JtKzZnCnVPdEE5QVJxYndJOTFLeEtoT204Q0RJQlRwWThSZG1SaElicWUrc3czT3p3dGk0eTVkU3FMREsrT3Y5b05ucngKQW9TN21TaXNQeDVJS3JwaFhMT3JvVmI2L1puSmNOK3ljaExuenptMDY2Zk5RaTBLNHhzaitvWkphaXVjZnBacAphSElHZGpaY1U3aE5FUzdJNVliVEFqUDdkaDRzdXJnMk1xTUtxbUxsa2ZPcGFoRTlMQTZVVFZRZHZLVFVGNWZwCkdYSnhaT1RKWlpiOGNQTFYxZFdXbnBMaEZNV2h2OUZQTCtDVGZQVUFvQmtmOTE3TzFLdkE3bGsvcTJzQ0F3RUEKQVFLQ0FnQU9WZ3k1dmlzdkFDWTN4ZkNCWEJVM0h6RmFzYVJnSVgvWmh0TkhGbUtGT3pyOW43dGtJWGtYNXU1SwpjNTNndFdJY0ZORTJibUlJUUk4aFBWVW8vM1NtNlk2ejFjTkwxdmJzaGZJcDlBZEtoR2ZOblpvYmszN3I2YlRoCjRRb3NKTVlGZFV1RUtIcWh4dGZKWUx0STNQTnkvb1hLQWJWWE16U3BYWmQzWW14cG01aUJEbEZCUXRhVGpldUUKK3BvZWhiZGE5b0JWcXo1ZCsycnA0bGRtZVpvYTE1YUNJVG5FbEc3R0puRHFtaVN3NUJkZ1FERVNyWmJZRVd5aQpRU0dDL1JUWXl2V1VJcWw5RXh5WnhobGRJaitCMkMyOFRzSXRHN0lpZzF2ajVaVlE0RHF3RmRzc1hiSmF0bkxvClNITlFBcXplT09xY2Mxb0p6N0dzNVRBYVZNZEtEQXZCZm1JMFBMcDNqNmVFOFFIYlduMHk2NzVYbnlqWllLUUcKaWx5R0pUNVRzMWZHWHlPSXBrNG4yQjM1V3dHcjIyTkxnYUd5cnZjRkgxN3JoZGVnaGlrZFJRd1FOcXRsZjBIZApMWDVRQWVwcUt3SE9uR1BGVy9XU2xGU0lEdkt1VFZSVGtvQmFSMTA3OFpiS2JXckZBbEdqYTFvbnNXQUh1YW5UClh5dFE4dWoxUEFFeWFMZUJEaUJxRVJ2am1VVFQ1ZktCOTdaVnRJenVBZ0lyWWZ6YjIyVEk2VFJ6OVZiQ2VyWG8KdTc0cnoxMjM2TXMrbmg5Y2xYd3VtQlBOU1d1eE9OdldOWEZ6VWdIOURzdlFRMWRsMFRJWEFQMGhFYkRHRkNBQwowUlg2M0lpcXFzUG1ZZUZNTGR5K2tVWjViNzI1TlhXWFRHbDRnQ1Y3NFVRU01ya0xrUUtDQVFFQStobXIwYjdnClVYcWRKaGtLRXVsa29IVzVuYzZ4QmhobCtuTkFucVFSTm5tQWpiaDlCeDVpLzQ2WUwxcHFYQUY5cTNIRlowSDIKZEJRZXN2Q0pxbmtSTHVwTi95VE1KSlo0ZE5kMHZqRzZ0UGhMUjZuRmRabHU0TFBRMXRKcU5XZkhZeCtwQ3N2SQo4Wkx3VG8rRGFxSjArZDk3WWF0b0dWNUZHOWtUSjhBYWFXb0Q1R1AyOGtOd0djKzI0b2VNYnJtU0ppQ2I2UlJoCjA5WWJaMGpXdkFHaXJyMzFOTW5nR0dtVmRPMThoOXVMUStLNzFUQWt1eFEzZEhpUzh6UVd6YythRnM1THgyUnIKeXppcEJhR3VySmFJQ05XNklFQm5ndFcvZEZaYXpMbjhQcDVrQlJzQ1NyN1JpQkNFSFZmeHBYVFNoS3cwVWp4NQo2a0gwc01YZnFoOFpMUUtDQVFFQXdkQ3BPUXBRa1RhK0t6Z0VrWGdMVnk2QmZJKzRWdC9BYjRtK2pFSm85aUIzCnN4dEtKNU5tNXltNldXcmFWS25zekxNZy85Mi9vSVZreUlNSklrOWNYdEpuaEU5ak1aVzc2ZjhYbW5CUnJIMnAKVHVmNWtYWWdVUHZLQ2g1U1g5Q2w0UHJENHNSb3cwNHJjbHVxSE1MT2g1MncxUmJPalRrb05tNXBHWlFoVkhxeApaUzh3aVk3bzhLNFZJQXZOVlZOdGlIZFNOY2Y0cDMxL0F6SU5aQjJWdlczeWJHTWNIdDByekQ5TkpZLzhTekc3CktEME5mRTgzeng2OWxHTlhUcURGSnBTV2ZNVlFwSGVCM0FTRTV1YVhVM1c5S3EwN2NDOEJWSHRaK3B5a1B0RTYKOHgrZE9NYWh6UElaMjRqbkIzZkVsaWc0Rk5zd01LZm9aeDdKYUJLRjl3S0NBUUVBdWJUTUgwOWpVenovYVdXWQpWRmlYVG9wN3pGRElvNlVFUEFiT1NiMjd4ajVNRlcrUzd2RkNRMDZIZEVubnhlK1pkKzlmeS85djE5dUV2QXZkCnZRWnVtdTZDQWQwNTlFVUNwb2ZCZU9TR0paQmtuWTdUUHpJeDRZbkRuVy9hUzFPRyt2UnNXY2JkcTNzWEVzNS8KbjNPSDltNWFPRGpGY0dqT1doSkNwZlovNWh4QlRacG9xSlVvclJIT1U4Q2dweXNGK1dlblBWZlVHQzdZWkVYeQpwT0YyQWRpdE5ZaGM3T09oaFpRK0xzYjNUdTRSMlFnSmpoeEIzU3NXdXAzSC9RU1UvekFwbHFIYlpLZnE0WEtmCnVDbUNVMFVZRXBDZ0M4ZFpoVElGOUJSNTE2bFd6Vyt6c1BxbHJTbk9YOWVJWi9vcHd6ZjNGY1V3SmFEWjUxVFcKY29UcTlRS0NBUUVBckhtVTdpYkl0Y0Zpa0RGa2wxT2R1L0t0MW54TFRqd0dFdndnYnM3MmV2ay9yRXEvdmVKRgpzN2NGbDJjb2JpbGRpbmhxQ0doOGpFdkkrVXJxeVBhWXUrVS9xNVcrTHpVUnFkV1JXcVZUZVUzR2FtcXpSQWc4CkQvVlJ3WmxrTXRJSm0rRnNpcFBBcXZVWVlzZEI1aUJTREl0Ky90SXg4NmtHcVJHdVE4MzNyeWNVVUhnakdIYnQKd3FrWU1aRnZJOXgvWCs3WFlQYll4Nnc5YUVtVmN4K0V6ck5XQmJCWktQb25iTFowWDlYM2JhOE8zMnNkWWg5WgpDZDlRVkFubmV4aEUrZVZHMmpmNVlMTGRCRCtkU2FHd3p0dTdBSXh5bFkydkFGQlpMVlZTTUhpZm5oWG5Jc3hZCjFub29HcDZGQWJkS1lWbmZObWdzUlZCVzE5V2s1QkYvMXdLQ0FRRUFqVnR1RXdYZzU5NERIaVN4UjlWbGRBaHYKcXF5dlpieVhPT2pnNHNKZjFLUlpxZkkzV28yL05IQWN0MlZlREE1bnlEM001YndHWEwrdVZGaUlMVk1ZMUp0WQp6MmlHWHgwZVdlbFJya2tRZHFncTI1TE9BQ2dxYTFMNW9tQS9tMGcwQWljWVdYa1FYSXpXRkhwb0ZqcU9KZHpTCnZ0MHhLV2lpWHUxVk5YeDJibFR1dXBCa1JUZUlQNTVxdWdyOUh0ZmY1MHc5MHhwTllaMFR3d0lDMG1neVVMMWEKRkdVdHlPUTlqVFBUUUdGM3h6REJCQ2U2MW5uZUV0TThRMEJ1MXh3Rm90aWFYSE9NaGhiMFBndVkzNHhiekNHYgpHcTlsWjVaN2lRVXByUWNNYjhrUzZ1WFk3VHBDTmUzaDBiTTM5dVlKeHNYNXUzcmVNRWsyZlBNT3dnTlFjdz09Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg=="
@@ -1,63 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: attic
-spec:
-  selector:
-    matchLabels:
-      app: attic
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        app: attic
-    spec:
-      containers:
-        - name: attic
-          image: ghcr.io/zhaofengli/attic:latest
-          args:
-           - -f
-           - /config.toml
-          ports:
-            - name: http
-              containerPort: 8080
-              protocol: TCP
-          livenessProbe:
-            httpGet:
-              path: /
-              port: http
-          readinessProbe:
-            httpGet:
-              path: /
-              port: http
-          env:
-            - name: ATTIC_SERVER_TOKEN_HS256_SECRET_BASE64
-              value: "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS2dJQkFBS0NBZ0VBdlZrMHQyZUtvdjhpV3prVFFtQzJtRklvd0gxc2liNlVpUFhUaGVwcURiWHMyaERFCnFYa1pKUXRjTnY0T2RtcldmZ2tsbjVyblJNQk5yL1B5dE05OFFMVVJnbzFSU2VTeUVjcmxSU1N4MElVRlhkM3YKV0U0aTJJTktsSzgxblJoY0o4czRUM09iYUpvSUQweEpqS2IzMkhxZmpOSU1vcVdBRk1ES2YyMUM5OWxQeTRXSgpVUUVnYTRzbHo5RzZHVi8wZW5qbFNMa2RRNjEvdEwyRE1ISHgvV2VRUEtpWkF4c2Fwczd3ZVJiNVBrS3J0MVlGClRxa1lJSjY3eDFiNDR1N0NmdWdVbHhMM2JCQ1lqVXVXNnoxdGU3T2ZQUUhoM1FPU2lFZTczQ3I4dU1lSkplV0wKN2VKc1hWSG9uVzBMZWl0aDk5WmJTUTF3YlhieDVPZzNTQ3ZWYnkyZE90Y3Rud2Y2aDN5YlJ3SUNoc24xbk4zMwowRkMyOXlFY0ExQ2VFVzRsMVVHNmxoMGw5cEpiWEhRNlFJS1paempaTlgxZTRGRW5TdytGNGhXd3R1Z2JtKzZnCnVPdEE5QVJxYndJOTFLeEtoT204Q0RJQlRwWThSZG1SaElicWUrc3czT3p3dGk0eTVkU3FMREsrT3Y5b05ucngKQW9TN21TaXNQeDVJS3JwaFhMT3JvVmI2L1puSmNOK3ljaExuenptMDY2Zk5RaTBLNHhzaitvWkphaXVjZnBacAphSElHZGpaY1U3aE5FUzdJNVliVEFqUDdkaDRzdXJnMk1xTUtxbUxsa2ZPcGFoRTlMQTZVVFZRZHZLVFVGNWZwCkdYSnhaT1RKWlpiOGNQTFYxZFdXbnBMaEZNV2h2OUZQTCtDVGZQVUFvQmtmOTE3TzFLdkE3bGsvcTJzQ0F3RUEKQVFLQ0FnQU9WZ3k1dmlzdkFDWTN4ZkNCWEJVM0h6RmFzYVJnSVgvWmh0TkhGbUtGT3pyOW43dGtJWGtYNXU1SwpjNTNndFdJY0ZORTJibUlJUUk4aFBWVW8vM1NtNlk2ejFjTkwxdmJzaGZJcDlBZEtoR2ZOblpvYmszN3I2YlRoCjRRb3NKTVlGZFV1RUtIcWh4dGZKWUx0STNQTnkvb1hLQWJWWE16U3BYWmQzWW14cG01aUJEbEZCUXRhVGpldUUKK3BvZWhiZGE5b0JWcXo1ZCsycnA0bGRtZVpvYTE1YUNJVG5FbEc3R0puRHFtaVN3NUJkZ1FERVNyWmJZRVd5aQpRU0dDL1JUWXl2V1VJcWw5RXh5WnhobGRJaitCMkMyOFRzSXRHN0lpZzF2ajVaVlE0RHF3RmRzc1hiSmF0bkxvClNITlFBcXplT09xY2Mxb0p6N0dzNVRBYVZNZEtEQXZCZm1JMFBMcDNqNmVFOFFIYlduMHk2NzVYbnlqWllLUUcKaWx5R0pUNVRzMWZHWHlPSXBrNG4yQjM1V3dHcjIyTkxnYUd5cnZjRkgxN3JoZGVnaGlrZFJRd1FOcXRsZjBIZApMWDVRQWVwcUt3SE9uR1BGVy9XU2xGU0lEdkt1VFZSVGtvQmFSMTA3OFpiS2JXckZBbEdqYTFvbnNXQUh1YW5UClh5dFE4dWoxUEFFeWFMZUJEaUJxRVJ2am1VVFQ1ZktCOTdaVnRJenVBZ0lyWWZ6YjIyVEk2VFJ6OVZiQ2VyWG8KdTc0cnoxMjM2TXMrbmg5Y2xYd3VtQlBOU1d1eE9OdldOWEZ6VWdIOURzdlFRMWRsMFRJWEFQMGhFYkRHRkNBQwowUlg2M0lpcXFzUG1ZZUZNTGR5K2tVWjViNzI1TlhXWFRHbDRnQ1Y3NFVRU01ya0xrUUtDQVFFQStobXIwYjdnClVYcWRKaGtLRXVsa29IVzVuYzZ4QmhobCtuTkFucVFSTm5tQWpiaDlCeDVpLzQ2WUwxcHFYQUY5cTNIRlowSDIKZEJRZXN2Q0pxbmtSTHVwTi95VE1KSlo0ZE5kMHZqRzZ0UGhMUjZuRmRabHU0TFBRMXRKcU5XZkhZeCtwQ3N2SQo4Wkx3VG8rRGFxSjArZDk3WWF0b0dWNUZHOWtUSjhBYWFXb0Q1R1AyOGtOd0djKzI0b2VNYnJtU0ppQ2I2UlJoCjA5WWJaMGpXdkFHaXJyMzFOTW5nR0dtVmRPMThoOXVMUStLNzFUQWt1eFEzZEhpUzh6UVd6YythRnM1THgyUnIKeXppcEJhR3VySmFJQ05XNklFQm5ndFcvZEZaYXpMbjhQcDVrQlJzQ1NyN1JpQkNFSFZmeHBYVFNoS3cwVWp4NQo2a0gwc01YZnFoOFpMUUtDQVFFQXdkQ3BPUXBRa1RhK0t6Z0VrWGdMVnk2QmZJKzRWdC9BYjRtK2pFSm85aUIzCnN4dEtKNU5tNXltNldXcmFWS25zekxNZy85Mi9vSVZreUlNSklrOWNYdEpuaEU5ak1aVzc2ZjhYbW5CUnJIMnAKVHVmNWtYWWdVUHZLQ2g1U1g5Q2w0UHJENHNSb3cwNHJjbHVxSE1MT2g1MncxUmJPalRrb05tNXBHWlFoVkhxeApaUzh3aVk3bzhLNFZJQXZOVlZOdGlIZFNOY2Y0cDMxL0F6SU5aQjJWdlczeWJHTWNIdDByekQ5TkpZLzhTekc3CktEME5mRTgzeng2OWxHTlhUcURGSnBTV2ZNVlFwSGVCM0FTRTV1YVhVM1c5S3EwN2NDOEJWSHRaK3B5a1B0RTYKOHgrZE9NYWh6UElaMjRqbkIzZkVsaWc0Rk5zd01LZm9aeDdKYUJLRjl3S0NBUUVBdWJUTUgwOWpVenovYVdXWQpWRmlYVG9wN3pGRElvNlVFUEFiT1NiMjd4ajVNRlcrUzd2RkNRMDZIZEVubnhlK1pkKzlmeS85djE5dUV2QXZkCnZRWnVtdTZDQWQwNTlFVUNwb2ZCZU9TR0paQmtuWTdUUHpJeDRZbkRuVy9hUzFPRyt2UnNXY2JkcTNzWEVzNS8KbjNPSDltNWFPRGpGY0dqT1doSkNwZlovNWh4QlRacG9xSlVvclJIT1U4Q2dweXNGK1dlblBWZlVHQzdZWkVYeQpwT0YyQWRpdE5ZaGM3T09oaFpRK0xzYjNUdTRSMlFnSmpoeEIzU3NXdXAzSC9RU1UvekFwbHFIYlpLZnE0WEtmCnVDbUNVMFVZRXBDZ0M4ZFpoVElGOUJSNTE2bFd6Vyt6c1BxbHJTbk9YOWVJWi9vcHd6ZjNGY1V3SmFEWjUxVFcKY29UcTlRS0NBUUVBckhtVTdpYkl0Y0Zpa0RGa2wxT2R1L0t0MW54TFRqd0dFdndnYnM3MmV2ay9yRXEvdmVKRgpzN2NGbDJjb2JpbGRpbmhxQ0doOGpFdkkrVXJxeVBhWXUrVS9xNVcrTHpVUnFkV1JXcVZUZVUzR2FtcXpSQWc4CkQvVlJ3WmxrTXRJSm0rRnNpcFBBcXZVWVlzZEI1aUJTREl0Ky90SXg4NmtHcVJHdVE4MzNyeWNVVUhnakdIYnQKd3FrWU1aRnZJOXgvWCs3WFlQYll4Nnc5YUVtVmN4K0V6ck5XQmJCWktQb25iTFowWDlYM2JhOE8zMnNkWWg5WgpDZDlRVkFubmV4aEUrZVZHMmpmNVlMTGRCRCtkU2FHd3p0dTdBSXh5bFkydkFGQlpMVlZTTUhpZm5oWG5Jc3hZCjFub29HcDZGQWJkS1lWbmZObWdzUlZCVzE5V2s1QkYvMXdLQ0FRRUFqVnR1RXdYZzU5NERIaVN4UjlWbGRBaHYKcXF5dlpieVhPT2pnNHNKZjFLUlpxZkkzV28yL05IQWN0MlZlREE1bnlEM001YndHWEwrdVZGaUlMVk1ZMUp0WQp6MmlHWHgwZVdlbFJya2tRZHFncTI1TE9BQ2dxYTFMNW9tQS9tMGcwQWljWVdYa1FYSXpXRkhwb0ZqcU9KZHpTCnZ0MHhLV2lpWHUxVk5YeDJibFR1dXBCa1JUZUlQNTVxdWdyOUh0ZmY1MHc5MHhwTllaMFR3d0lDMG1neVVMMWEKRkdVdHlPUTlqVFBUUUdGM3h6REJCQ2U2MW5uZUV0TThRMEJ1MXh3Rm90aWFYSE9NaGhiMFBndVkzNHhiekNHYgpHcTlsWjVaN2lRVXByUWNNYjhrUzZ1WFk3VHBDTmUzaDBiTTM5dVlKeHNYNXUzcmVNRWsyZlBNT3dnTlFjdz09Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg=="
-              # valueFrom:
-              #   secretKeyRef:
-              #     name: server
-              #     key: token
-            - name: ATTIC_SERVER_DATABASE_URL
-              value: "postgresql://app:mZP1BnmnpDU33B7UZvomYKOSS1laRJ4bvUR7jNDZ1AJqPdNxH2rLXykghczg7Bgy@attic-db-rw:5432/app"
-              # valueFrom:
-                # secretKeyRef:
-                  # name: database
-                  # key: url
-          volumeMounts:
-          - name: data
-            mountPath: /attic
-          - name: attic-config
-            mountPath: /config.toml
-            subPath: config.toml
-      volumes:
-        - name: server
-          secret:
-            secretName: server
-        - name: attic-config
-          configMap:
-            defaultMode: 420
-            name: attic-config
-        - name: data
-          persistentVolumeClaim:
-            claimName: attic
@@ -1,31 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production
-    nginx.ingress.kubernetes.io/backend-protocol: HTTP
-    nginx.ingress.kubernetes.io/proxy-body-size: "0"
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
-    nginx.ingress.kubernetes.io/proxy-send-timeout: "600"
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-  labels:
-    app.kubernetes.io/component: attic
-  name: attic
-  namespace: attic
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: attic.srv.oceanbox.io
-    http:
-      paths:
-      - backend:
-          service:
-            name: attic
-            port:
-              name: http
-        path: /
-        pathType: Prefix
-  tls:
-  - hosts:
-    - attic.srv.oceanbox.io
-    secretName: attic.srv.oceanbox.io-tls
@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-cache-nixos
-  namespace: ncps
-spec:
-  egress:
-    - toFQDNs:
-        - matchPattern: 'cache.nixos.org'
-        - matchPattern: 'nix-community.cachix.org'
-  endpointSelector:
-    matchLabels:
-      app: nix-cache
@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: attic
-  labels:
-    app: attic
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 20Gi
@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: server
-stringData:
-  token: "ref+sops://secrets.yml#attic/jwtToken"
@@ -1,3 +1,3 @@
 catalyst:
-  enabled: true
+  enabled: false
  autosync: false
@@ -9,14 +9,6 @@ metadata:
  name: shared-gateway
  namespace: kube-system
 spec:
-  infrastructure:
-    annotations:
-      load-balancer.hetzner.cloud/location: hel1
-      load-balancer.hetzner.cloud/type: lb11
-      load-balancer.hetzner.cloud/name: load-balancer-2
-      load-balancer.hetzner.cloud/use-private-ip: "true"
-      load-balancer.hetzner.cloud/uses-proxyprotocol: "true"
-      load-balancer.hetzner.cloud/http-redirect-https: "false"
  gatewayClassName: cilium
  listeners:
    - name: http
@@ -38,4 +38,4 @@ volumeMounts:
    readOnly: true
    subPath: appsettings.json
 image:
-  tag: 74ed3e11-debug
+  tag: 4704e4f1-debug
@@ -1,8 +1,8 @@
-{{ if .Values.clusterConfig.argo.enabled }}
+{{- if .Values.clusterConfig.argo.enabled }}
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: docs
+  name: {{ .Values.docs.env }}-docs
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
@@ -11,7 +11,11 @@ metadata:
  - resources-finalizer.argocd.argoproj.io
 spec:
  destination:
+    {{- if eq .Values.docs.env "prod" }}
    namespace: docs
+    {{- else }}
+    namespace: {{ .Values.docs.env }}-docs
+    {{- end }}
    server: https://kubernetes.default.svc
  project: default
  sources:
@@ -24,7 +28,7 @@ spec:
      - name: CLUSTER_NAME
        value: {{ .Values.clusterConfig.cluster }}
      - name: HELMFILE_ENVIRONMENT
-        value: default
+        value: {{ .Values.docs.env }}
      - name: HELMFILE_FILE_PATH
        value: docs.yaml.gotmpl
  syncPolicy:
@@ -0,0 +1,19 @@
+fullnameOverride: prod-docs
+
+ingress:
+  enabled: true
+  className: "haproxy"
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-production
+    haproxy.org/backend-protocol: h1
+    haproxy.org/cors-enable: "true"
+    oceanbox.io/expose: internal
+  hosts:
+    - host: docs.oceanbox.io
+      paths:
+        - path: /
+          pathType: ImplementationSpecific
+  tls:
+    - hosts:
+        - docs.oceanbox.io
+      secretName: prod-docs-tls
@@ -0,0 +1,20 @@
+fullnameOverride: staging-docs
+image:
+  tag: "4bec2e8e-debug"
+ingress:
+  enabled: true
+  className: "haproxy"
+  annotations:
+    cert-manager.io/cluster-issuer: ca-issuer
+    haproxy.org/backend-protocol: h1
+    haproxy.org/cors-enable: "true"
+    oceanbox.io/expose: internal
+  hosts:
+    - host: docs.dev.hel1.obx
+      paths:
+        - path: /
+          pathType: ImplementationSpecific
+  tls:
+    - hosts:
+        - docs.dev.hel1.obx
+      secretName: default-docs-tls
@@ -1,27 +1,6 @@
 replicaCount: 1
-image:
-  tag: "6960aed0-debug"
 env:
  - name: APP_VERSION
    value: "0.0.0"
  - name: LOG_LEVEL
    value: "1"
-ingress:
-  enabled: true
-  className: "nginx"
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production
-    nginx.ingress.kubernetes.io/backend-protocol: HTTP
-    nginx.ingress.kubernetes.io/enable-cors: "true"
-    nginx.ingress.kubernetes.io/proxy-buffer-size: 128k
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    oceanbox.io/expose: internal
-  hosts:
-    - host: docs.oceanbox.io
-      paths:
-        - path: /
-          pathType: ImplementationSpecific
-  tls:
-    - hosts:
-        - docs.oceanbox.io
-      secretName: docs-tls
@@ -1,5 +1,5 @@
 clusterConfig:
-  manifests: https://gitlab.com/oceanbox/manifests.git
+  manifests: https://git.oceanbox.io/platform/manifests.git
  env: "" #[dev, test, staging, prod]
  initca: ""
  domain: ".local"
@@ -0,0 +1,2 @@
+fapr:
+  enabled: true
@@ -0,0 +1,4 @@
+fapr:
+  enabled: true
+  autosync: {{ if or (eq .Environment.Name "prod") (eq .Environment.Name "beta") }}false{{ else }}true{{ end }}
+  env: {{ .Environment.Name }}
@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - _manifest.yaml
@@ -0,0 +1,20 @@
+{
+  "appName": "fapr",
+  "appEnv": "prod",
+  "logLevel": "Information",
+  "aromeOutputDir": "/data/hdd/data/AROME",
+  "aromeStartDate": "2026-04-24",
+  "nveOutputDir": "/data/hdd/data/river-data/Data",
+  "nveNdays": 5000,
+  "nveApiUrl": "https://chartserver.nve.no/ShowData.aspx?req=getchart&ver=1.0",
+  "riverrunBinary": "/app/riverrun",
+  "norshelfOutputDir": "/data/hdd/data/norshelf/sea_norshelf_files",
+  "norshelfStartDate": "2026-03-01",
+  "nemoOutputDir": "/data/hdd/data/NEMO",
+  "copernicusmarineBinary": "/usr/local/bin/copernicusmarine",
+  "copernicusUsername": "",
+  "copernicusPassword": "",
+  "murOutputDir": "/data/hdd/data/river-data/MUR/MUR_SST_nc",
+  "netrcPath": "/root/.netrc",
+  "norkystOutputDir": "/data/hdd/data/norkyst"
+}
@@ -0,0 +1,77 @@
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: cron-arome
+spec:
+  type: bindings.cron
+  version: v1
+  metadata:
+    - name: schedule
+      value: "0 6 * * *"
+scopes:
+  - prod-fapr
+---
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: cron-nve
+spec:
+  type: bindings.cron
+  version: v1
+  metadata:
+    - name: schedule
+      value: "0 8 * * *"
+scopes:
+  - prod-fapr
+---
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: cron-norshelf
+spec:
+  type: bindings.cron
+  version: v1
+  metadata:
+    - name: schedule
+      value: "0 13 * * *"
+scopes:
+  - prod-fapr
+---
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: cron-nemo
+spec:
+  type: bindings.cron
+  version: v1
+  metadata:
+    - name: schedule
+      value: "0 13 * * *"
+scopes:
+  - prod-fapr
+---
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: cron-mur
+spec:
+  type: bindings.cron
+  version: v1
+  metadata:
+    - name: schedule
+      value: "0 6 * * *"
+scopes:
+  - prod-fapr
+---
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: cron-norkyst
+spec:
+  type: bindings.cron
+  version: v1
+  metadata:
+    - name: schedule
+      value: "0 13 * * *"
+scopes:
+  - prod-fapr
@@ -0,0 +1,3 @@
+- op: add
+  path: /spec/template/spec/containers/0/envFrom
+  value: []
@@ -0,0 +1,21 @@
+generatorOptions:
+  disableNameSuffixHash: true
+configMapGenerator:
+  - name: prod-fapr-appsettings
+    files:
+      - appsettings.json
+patches:
+  - target:
+      group: apps
+      version: v1
+      kind: Deployment
+    path: deployment_patch.yaml
+resources:
+  - ../base
+  - pv.yaml
+  - pvc.yaml
+  - secrets.yaml
+  - secretstore.yaml
+  - statestore.yaml
+  - tracing.yaml
+  - cron-bindings.yaml
@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: pv-prod-fapr-ceph-data
+spec:
+  accessModes:
+    - ReadWriteMany
+  capacity:
+    storage: 1Gi
+  csi:
+    driver: rook-ceph.cephfs.csi.ceph.com
+    nodeStageSecretRef:
+      name: rook-csi-cephfs-node
+      namespace: rook-ceph
+    volumeAttributes:
+      clusterID: rook-ceph
+      fsName: data
+      rootPath: /
+      staticVolume: "true"
+    volumeHandle: pv-prod-fapr-ceph-data
+  persistentVolumeReclaimPolicy: Retain
+  volumeMode: Filesystem
@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: prod-fapr-ceph-data
+spec:
+  accessModes:
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: ""
+  volumeMode: Filesystem
+  volumeName: pv-prod-fapr-ceph-data
@@ -0,0 +1,6 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: prod-fapr-redis
+type: Opaque
+data:
@@ -0,0 +1,12 @@
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: secretstore
+spec:
+  type: secretstores.kubernetes
+  version: v1
+  metadata:
+    - name: defaultNamespace
+      value: prod-fapr
+scopes:
+  - prod-fapr
@@ -0,0 +1,22 @@
+apiVersion: dapr.io/v1alpha1
+kind: Component
+metadata:
+  name: statestore
+spec:
+  type: state.redis
+  version: v1
+  metadata:
+    - name: redisHost
+      value: prod-fapr-redis:6379
+    - name: redisUsername
+      value: default
+    - name: redisPassword
+      secretKeyRef:
+        name: prod-fapr-redis
+        key: redis-password
+    - name: actorStateStore
+      value: "true"
+    - name: redisDB
+      value: "0"
+scopes:
+  - prod-fapr
--- a/Show More
+++ b/Show More