Update Helm release kyverno to v3.8.2

ci(prod): deploy atlantis v2.22.0
ci(prod): deploy codex v2.22.0
2026-07-26 00:03:49 +00:00 · 2026-07-24 16:23:26 +00:00 · 2026-07-24 16:22:47 +00:00 · 2026-07-24 16:22:30 +00:00 · 2026-07-24 16:21:29 +00:00 · 2026-07-24 15:25:25 +02:00
150 changed files with 2280 additions and 1261 deletions
@@ -13,7 +13,7 @@ applications:
      server: https://kubernetes.default.svc
    project: sys
    sources:
-      - repoURL: https://gitlab.com/oceanbox//manifests.git
+      - repoURL: https://git.oceanbox.io/platform/manifests.git
        targetRevision: HEAD
        path: helmfile.d
        plugin:
@@ -4,10 +4,10 @@ description: Atlantis map and simulation service
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v2.9.4
+version: v2.22.0
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v2.9.4
+appVersion: v2.22.0
 dependencies:
  - name: diagrid-dashboard
    version: "0.1.0"
@@ -4,7 +4,7 @@
 replicaCount: 1
 image:
  repository: git.oceanbox.io/oceanbox/poseidon/atlantis
-  tag: v2.9.4
+  tag: v2.22.0
  pullPolicy: IfNotPresent
 init:
  enabled: false
@@ -13,9 +13,9 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: v2.9.4
+version: v2.22.0
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "v2.9.4"
+appVersion: "v2.22.0"
@@ -10,7 +10,7 @@ image:
  # This sets the pull policy for images.
  pullPolicy: IfNotPresent
  # Overrides the image tag whose default is the chart appVersion.
-  tag: v2.9.4
+  tag: v2.22.0
 # This is for the secrets for pulling an image from a private repository more information can be found here: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
 imagePullSecrets:
  - name: gitlab-pull-secret
@@ -12,7 +12,7 @@ description: Oceanbox Documentation
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v0.1.0
+version: v0.0.2
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v0.1.0
+appVersion: v0.0.2
@@ -4,7 +4,7 @@
 replicaCount: 1
 image:
  repository: git.oceanbox.io/oceanbox/documentation/docs
-  tag: v0.1.0
+  tag: v0.0.2
  pullPolicy: IfNotPresent
 init:
  enabled: false
@@ -21,8 +21,9 @@ env:
    valueFrom:
      fieldRef:
        fieldPath: metadata.namespace
-# imagePullSecrets:
-  # - name: gitea-pull-secret
+        # imagePullSecrets:
+# - name: gitea-pull-secret
+
 nameOverride: ""
 fullnameOverride: ""
 serviceAccount:
@@ -1,6 +0,0 @@
-apiVersion: v2
-name: fapr
-description: A Helm chart for Fapr (F# Dapr workflow orchestrator)
-type: application
-version: v0.1.0
-appVersion: v0.1.0
@@ -1,61 +0,0 @@
-{{/* vim: set filetype=mustache: */}}
-{{/*
-Expand the name of the chart.
-*/}}
-{{- define "fapr.name" -}}
-{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-{{/*
-Create a default fully qualified app name.
-*/}}
-{{- define "fapr.fullname" -}}
-{{- if .Values.fullnameOverride }}
-{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
-{{- else }}
-{{- $name := default .Chart.Name .Values.nameOverride }}
-{{- if contains $name .Release.Name }}
-{{- .Release.Name | trunc 63 | trimSuffix "-" }}
-{{- else }}
-{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
-{{- end }}
-{{- end }}
-{{- end }}
-
-{{/*
-Create chart name and version as used by the chart label.
-*/}}
-{{- define "fapr.chart" -}}
-{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
-{{- end }}
-
-{{/*
-Common labels
-*/}}
-{{- define "fapr.labels" -}}
-helm.sh/chart: {{ include "fapr.chart" . }}
-{{ include "fapr.selectorLabels" . }}
-{{- if .Chart.AppVersion }}
-app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
-{{- end }}
-app.kubernetes.io/managed-by: {{ .Release.Service }}
-{{- end }}
-
-{{/*
-Selector labels
-*/}}
-{{- define "fapr.selectorLabels" -}}
-app.kubernetes.io/name: {{ include "fapr.name" . }}
-app.kubernetes.io/instance: {{ .Release.Name }}
-{{- end }}
-
-{{/*
-Create the name of the service account to use
-*/}}
-{{- define "fapr.serviceAccountName" -}}
-{{- if .Values.serviceAccount.create -}}
-    {{ default (include "fapr.fullname" .) .Values.serviceAccount.name }}
-{{- else -}}
-    {{ default "default" .Values.serviceAccount.name }}
-{{- end -}}
-{{- end -}}
@@ -1,85 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: {{ include "fapr.fullname" . }}
-  labels:
-    {{- include "fapr.labels" . | nindent 4 }}
-spec:
-  {{- if not .Values.autoscaling.enabled }}
-  replicas: {{ .Values.replicaCount }}
-  {{- end }}
-  selector:
-    matchLabels:
-      {{- include "fapr.selectorLabels" . | nindent 6 }}
-  template:
-    metadata:
-      {{- with .Values.podAnnotations }}
-      annotations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      labels:
-        {{- include "fapr.selectorLabels" . | nindent 8 }}
-    spec:
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      serviceAccountName: {{ include "fapr.serviceAccountName" . }}
-      securityContext:
-        {{- toYaml .Values.podSecurityContext | nindent 8 }}
-      containers:
-        - name: {{ .Chart.Name }}
-          securityContext:
-            {{- toYaml .Values.securityContext | nindent 12 }}
-          image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
-          imagePullPolicy: {{ .Values.image.pullPolicy }}
-          ports:
-            - name: http
-              containerPort: {{ .Values.service.port }}
-              protocol: TCP
-          env:
-            {{- toYaml .Values.env | nindent 12 }}
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              port: http
-            initialDelaySeconds: 5
-            periodSeconds: 15
-          readinessProbe:
-            httpGet:
-              path: /healthz
-              port: http
-            initialDelaySeconds: 3
-            periodSeconds: 10
-          resources:
-            {{- toYaml .Values.resources | nindent 12 }}
-          volumeMounts:
-            - name: data
-              mountPath: /data
-            - name: appsettings
-              mountPath: /app/appsettings.json
-              subPath: appsettings.json
-              readOnly: true
-      volumes:
-        - name: data
-        {{- if .Values.persistence.enabled }}
-          persistentVolumeClaim:
-            claimName: {{ .Values.persistence.existingClaim | default (include "fapr.fullname" .) }}
-        {{- else }}
-          emptyDir: {}
-        {{- end }}
-        - name: appsettings
-          configMap:
-            name: {{ include "fapr.fullname" . }}-appsettings
-      {{- with .Values.nodeSelector }}
-      nodeSelector:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.affinity }}
-      affinity:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.tolerations }}
-      tolerations:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
@@ -1,21 +0,0 @@
-{{- if and .Values.persistence.enabled (not .Values.persistence.existingClaim) }}
-kind: PersistentVolumeClaim
-apiVersion: v1
-metadata:
-  name: {{ include "fapr.fullname" . }}
-  labels:
-{{ include "fapr.labels" . | indent 4 }}
-spec:
-  accessModes:
-    - {{ .Values.persistence.accessMode | quote }}
-  resources:
-    requests:
-      storage: {{ .Values.persistence.size | quote }}
-{{- if .Values.persistence.storageClass }}
-{{- if (eq "-" .Values.persistence.storageClass) }}
-  storageClassName: ""
-{{- else }}
-  storageClassName: "{{ .Values.persistence.storageClass }}"
-{{- end }}
-{{- end }}
-{{- end }}
@@ -1,49 +0,0 @@
-{{- if .Values.redis.enabled -}}
-apiVersion: dragonflydb.io/v1alpha1
-kind: Dragonfly
-metadata:
-  name: {{ include "fapr.fullname" . }}-redis
-  namespace: {{ .Release.Namespace }}
-  annotations:
-    linkerd.io/inject: disabled
-  labels:
-    app.kubernetes.io/created-by: dragonfly-operator
-    {{- include "fapr.labels" . | nindent 4 }}
-spec:
-  args:
-    - --dbfilename=dump
-    - --maxmemory=$(MAX_MEMORY)Mi
-    - --proactor_threads=1
-    - --logtostderr
-    - --save_schedule=
-  env:
-    - name: MAX_MEMORY
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.memory
-          divisor: 1Mi
-  replicas: {{ .Values.redis.replicas | default "1" }}
-  resources:
-    requests:
-      cpu: {{ .Values.redis.resources.cpu | default "100m" }}
-      memory: {{ .Values.redis.resources.memory | default "128Mi" }}
-    limits:
-      memory: {{ .Values.redis.resources.memory | default "128Mi" }}
-  authentication:
-    passwordFromSecret:
-      name: {{ .Values.redis.secret.name | default (printf "%s-redis" (include "fapr.fullname" .)) | quote }}
-      key: {{ .Values.redis.secret.key | quote }}
-  {{- if .Values.redis.backup.enabled }}
-  snapshot:
-    dir: /data
-    cron: "0 3 * * *"
-    enableOnMasterOnly: false
-    persistentVolumeClaimSpec:
-      storageClassName: {{ .Values.redis.storageClass | default "managed-nfs-storage" }}
-      accessModes:
-        - ReadWriteOnce
-      resources:
-        requests:
-          storage: {{ .Values.redis.size | default "1Gi" }}
-  {{- end }}
-{{- end }}
@@ -1,15 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: {{ include "fapr.fullname" . }}
-  labels:
-    {{- include "fapr.labels" . | nindent 4 }}
-spec:
-  type: {{ .Values.service.type }}
-  ports:
-    - port: {{ .Values.service.port }}
-      targetPort: http
-      protocol: TCP
-      name: http
-  selector:
-    {{- include "fapr.selectorLabels" . | nindent 4 }}
@@ -1,12 +0,0 @@
-{{- if .Values.serviceAccount.create -}}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ include "fapr.serviceAccountName" . }}
-  labels:
-    {{- include "fapr.labels" . | nindent 4 }}
-  {{- with .Values.serviceAccount.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-{{- end }}
@@ -1,67 +0,0 @@
-# Default values for fapr.
-
-replicaCount: 1
-image:
-  repository: git.oceanbox.io/oceanbox/fapr/fapr
-  tag: v0.1.0
-  pullPolicy: IfNotPresent
-env:
-  - name: APP_NAME
-    valueFrom:
-      fieldRef:
-        fieldPath: metadata.name
-  - name: APP_NAMESPACE
-    valueFrom:
-      fieldRef:
-        fieldPath: metadata.namespace
-imagePullSecrets:
-  - name: gitlab-pull-secret
-nameOverride: ""
-fullnameOverride: ""
-serviceAccount:
-  create: true
-  annotations: {}
-  name: ""
-podAnnotations: {}
-podSecurityContext:
-  fsGroup: 0
-securityContext:
-  capabilities:
-    drop:
-      - ALL
-  readOnlyRootFilesystem: false
-  runAsNonRoot: false
-  runAsUser: 0
-service:
-  type: ClusterIP
-  port: 8080
-persistence:
-  enabled: true
-  existingClaim: ""
-  size: 1Gi
-  storageClass: "ceph-rbd"
-  accessMode: ReadWriteMany
-redis:
-  enabled: true
-  replicas: 1
-  backup:
-    enabled: false
-  size: 1Gi
-  storageClass: "ceph-rbd"
-  secret:
-    name: ""
-    key: "redis-password"
-  resources:
-    cpu: 100m
-    memory: 128Mi
-resources: {}
-autoscaling:
-  enabled: false
-  minReplicas: 1
-  maxReplicas: 3
-  targetCPUUtilizationPercentage: 80
-serviceMonitor:
-  enabled: false
-nodeSelector: {}
-tolerations: []
-affinity: {}
@@ -4,10 +4,10 @@ description: A Helm chart for Kubernetes
 type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
-version: v2.9.4
+version: v2.22.0
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application.
-appVersion: v2.9.4
+appVersion: v2.22.0
 dependencies:
  - name: diagrid-dashboard
    version: "0.1.0"
@@ -5,7 +5,7 @@
 replicaCount: 1
 image:
  repository: git.oceanbox.io/oceanbox/poseidon/sorcerer
-  tag: v2.9.4
+  tag: v2.22.0
  pullPolicy: IfNotPresent
 init:
  enabled: false
@@ -55,7 +55,7 @@ ingress:
      secretName: yolo-registry-tls
 persistence:
  enabled: true
-  size: 1G
+  size: 5G
  storageClass: ""
  accessMode: ReadWriteOnce
 cluster:
@@ -15,7 +15,7 @@ releases:
 - name: argocd
  namespace: argocd
  chart: argo/argo-cd
-  version: 9.5.15
+  version: 9.7.1
  condition: argo.enabled
  values:
  - ../values/argo/values/argocd.yaml.gotmpl
@@ -35,7 +35,7 @@ releases:
 - name: argo-rollouts
  namespace: argocd
  chart: argo/argo-rollouts
-  version: 2.40.9
+  version: 2.41.0
  condition: argo.rollouts.enabled
  values:
  - ../values/argo/values/rollouts.yaml.gotmpl
@@ -43,7 +43,7 @@ releases:
 - name: argo-workflows
  namespace: argocd
  chart: argo/argo-workflows
-  version: 1.0.14
+  version: 1.0.19
  condition: argo.workflows.enabled
  missingFileHandler: Info
 - name: manifests
@@ -0,0 +1,53 @@
+bases:
+ - ../envs/environments.yaml.gotmpl
+
+repositories:
+- name: clickhouse
+  url: ghcr.io/clickhouse
+  oci: true
+
+commonLabels:
+  tier: system
+
+releases:
+- name: clickhouse-operator
+  namespace: clickhouse
+  chart: clickhouse/clickhouse-operator-helm
+  version: 0.0.6
+  condition: clickhouse.enabled
+  values:
+  - ../values/clickhouse/values/operator.yaml.gotmpl
+  missingFileHandler: Info
+- name: clickhouse-cluster
+  namespace: clickhouse
+  chart: clickhouse/clickhouse-cluster-helm
+  version: 0.0.6
+  condition: clickhouse.enabled
+  needs:
+  - clickhouse/clickhouse-operator
+  values:
+  - ../values/clickhouse/values/cluster.yaml.gotmpl
+  postRenderer: ../bin/kustomizer
+  postRendererArgs:
+  - ../values/clickhouse/kustomize/{{ .Environment.Name }}
+  missingFileHandler: Info
+- name: manifests
+  namespace: clickhouse
+  chart: manifests
+  condition: clickhouse.enabled
+  missingFileHandler: Info
+  values:
+  - ../values/env.yaml
+  - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
+  - ../values/clickhouse/env.yaml.gotmpl
+  - ../values/clickhouse/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
+  hooks:
+  - events: [ prepare, cleanup ]
+    showlogs: true
+    command: ../bin/helmify
+    args:
+    - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
+    - '{{`{{ .Release.Chart }}`}}'
+    - '{{`{{ .Environment.Name }}`}}'
+    - ../values/clickhouse/manifests
+    - manifests
@@ -13,7 +13,7 @@ releases:
 - name: dragonfly
  namespace: dragonfly
  chart: dragonfly/dragonfly-operator
-  version: v1.5.0
+  version: v1.6.1
  condition: dragonfly.enabled
  values:
  - ../values/dragonfly/values/dragonfly.yaml.gotmpl
@@ -1,39 +0,0 @@
-bases:
- - ../envs/environments.yaml.gotmpl
-
-commonLabels:
-  tier: oceanbox
-
-releases:
- name: {{ .Environment.Name }}-fapr
-  namespace: {{ .Environment.Name }}-fapr
-  chart: ../charts/fapr
-  condition: fapr.enabled
-  values:
-  - ../values/fapr/values/values.yaml
-  - ../values/fapr/values/values-{{ .Environment.Name }}.yaml
-  - ../values/fapr/values/values-{{ .Environment.Name }}-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
-  postRenderer: ../bin/kustomizer
-  postRendererArgs:
-  - ../values/fapr/kustomize/{{ .Environment.Name }}-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}
-  missingFileHandler: Info
- name: manifests
-  namespace: {{ .Environment.Name }}-fapr
-  chart: manifests
-  condition: fapr.enabled
-  missingFileHandler: Info
-  values:
-  - ../values/env.yaml
-  - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
-  - ../values/fapr/env.yaml.gotmpl
-  - ../values/fapr/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
-  hooks:
-  - events: [ prepare, cleanup ]
-    showlogs: true
-    command: ../bin/helmify
-    args:
-    - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
-    - '{{`{{ .Release.Chart }}`}}'
-    - '{{`{{ .Environment.Name }}`}}'
-    - ../values/fapr/manifests
-    - manifests
@@ -2,8 +2,9 @@ bases:
 - ../envs/environments.yaml.gotmpl

 repositories:
- name: headscale
-  url: https://charts.gabe565.com
+- name: gabe565
+  oci: true
+  url: ghcr.io/gabe565/charts

 commonLabels:
  tier: system
@@ -11,7 +12,8 @@ commonLabels:
 releases:
 - name: headscale-router
  namespace: headscale
-  chart: headscale/headscale
+  chart: gabe565/headscale
+  version: 0.16.0
  condition: headscale.enabled
  values:
  - ../values/headscale-router/values/values.yaml
@@ -2,8 +2,9 @@ bases:
 - ../envs/environments.yaml.gotmpl

 repositories:
- name: headscale
-  url: https://charts.gabe565.com
+- name: gabe565
+  oci: true
+  url: ghcr.io/gabe565/charts

 commonLabels:
  tier: system
@@ -11,7 +12,8 @@ commonLabels:
 releases:
 - name: headscale
  namespace: headscale
-  chart: headscale/headscale
+  chart: gabe565/headscale
+  version: 0.16.0
  condition: headscale.enabled
  values:
  - ../values/headscale/values/values.yaml
@@ -0,0 +1,27 @@
+bases:
+ - ../envs/environments.yaml.gotmpl
+
+commonLabels:
+  tier: system
+
+releases:
+- name: manifests
+  namespace: ingest
+  chart: manifests
+  condition: ingest.enabled
+  missingFileHandler: Info
+  values:
+  - ../values/env.yaml
+  - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
+  - ../values/ingest/env.yaml.gotmpl
+  - ../values/ingest/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
+  hooks:
+  - events: [ prepare, cleanup ]
+    showlogs: true
+    command: ../bin/helmify
+    args:
+    - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
+    - '{{`{{ .Release.Chart }}`}}'
+    - '{{`{{ .Environment.Name }}`}}'
+    - ../values/ingest/manifests
+    - manifests
@@ -13,7 +13,7 @@ releases:
 - name: ingress-haproxy
  namespace: ingress-haproxy
  chart: haproxytech/kubernetes-ingress
-  version: 1.42.0
+  version: 1.52.1
  condition: haproxy.enabled
  values:
  - ../values/ingress-haproxy/values/ingress-haproxy.yaml.gotmpl
@@ -8,7 +8,7 @@ releases:
 - name: kueue
  namespace: kueue-system
  chart: oci://registry.k8s.io/kueue/charts/kueue
-  version: 0.17.1
+  version: 0.18.1
  condition: kueue.enabled
  values:
  - ../values/kueue/values/values.yaml
@@ -15,7 +15,7 @@ releases:
 - name: kyverno
  namespace: kyverno
  chart: kyverno/kyverno
-  version: 3.8.1
+  version: 3.8.2
  condition: kyverno.enabled
  values:
  - ../values/kyverno/values/kyverno.yaml.gotmpl
@@ -12,7 +12,7 @@ releases:
 - name: metrics-server
  namespace: kube-system
  chart: metrics-server/metrics-server
-  version: 3.13.0
+  version: 3.13.1
  condition: metrics_server.enabled
  values:
  - ../values/metrics-server/values/metrics-server.yaml.gotmpl
@@ -0,0 +1,27 @@
+bases:
+ - ../envs/environments.yaml.gotmpl
+
+commonLabels:
+  tier: system
+
+releases:
+- name: manifests
+  namespace: niks3
+  chart: manifests
+  condition: niks3.enabled
+  missingFileHandler: Info
+  values:
+  - ../values/env.yaml
+  - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
+  - ../values/niks3/env.yaml.gotmpl
+  - ../values/niks3/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
+  hooks:
+  - events: [ prepare, cleanup ]
+    showlogs: true
+    command: ../bin/helmify
+    args:
+    - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
+    - '{{`{{ .Release.Chart }}`}}'
+    - '{{`{{ .Environment.Name }}`}}'
+    - ../values/niks3/manifests
+    - manifests
@@ -16,7 +16,7 @@ releases:
  namespace: {{ .Environment.Name }}-openfga
  {{- end }}
  chart: openfga/openfga
-  version: 0.3.5
+  version: 0.3.10
  condition: openfga.enabled
  values:
  - ../values/openfga/values/values.yaml
@@ -12,10 +12,10 @@ releases:
 - name: opentelemetry-collector
  namespace: otel
  chart: open-telemetry/opentelemetry-collector
-  version: 0.156.2
+  version: 0.159.1
  condition: otel.enabled
  values:
-  - ../values/opentelemetry-collector/values/values.yaml
+  - ../values/opentelemetry-collector/values/values.yaml.gotmpl
  - ../values/opentelemetry-collector/values/values-{{ .Environment.Name }}.yaml
  postRenderer: ../bin/kustomizer
  postRendererArgs:
@@ -27,7 +27,7 @@ releases:
 - name: plugin-barman-cloud
  namespace: cnpg
  chart: cloudnative-pg/plugin-barman-cloud
-  version: 0.6.0
+  version: 0.7.0
  condition: postgres_operator.enabled
  values:
  - ../values/postgres-operator/values/plugin-barman-cloud.yaml.gotmpl
@@ -15,7 +15,7 @@ releases:
 - name: prometheus
  namespace: prometheus
  chart: prometheus/kube-prometheus-stack
-  version: 85.3.0
+  version: 86.3.2
  condition: prometheus.enabled
  values:
  - ../values/prometheus/values/prometheus.yaml.gotmpl
@@ -0,0 +1,28 @@
+bases:
+ - ../envs/environments.yaml.gotmpl
+
+commonLabels:
+  tier: system
+
+releases:
+- name: manifests
+  namespace: proteus
+  chart: manifests
+  condition: proteus.enabled
+  missingFileHandler: Info
+  values:
+  - ../values/env.yaml
+  - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
+  - ../values/proteus/env.yaml.gotmpl
+  - ../values/proteus/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
+  - ../values/proteus/values/values-staging.yaml
+  hooks:
+  - events: [ prepare, cleanup ]
+    showlogs: true
+    command: ../bin/helmify
+    args:
+    - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
+    - '{{`{{ .Release.Chart }}`}}'
+    - '{{`{{ .Environment.Name }}`}}'
+    - ../values/proteus/manifests
+    - manifests
@@ -13,7 +13,7 @@ releases:
 - name: spegel
  namespace: spegel
  chart: spegel/spegel
-  version: 0.6.0
+  version: 0.7.3
  condition: spegel.enabled
  values:
  - ../values/spegel/values/spegel.yaml.gotmpl
@@ -0,0 +1,39 @@
+bases:
+ - ../envs/environments.yaml.gotmpl
+
+repositories:
+- name: temporal
+  url: https://go.temporal.io/helm-charts
+
+commonLabels:
+  tier: system
+
+releases:
+- name: temporal
+  namespace: temporal
+  chart: temporal/temporal
+  version: 1.5.0
+  condition: temporal.enabled
+  missingFileHandler: Info
+  values:
+  - ../values/temporal/values/temporal.yaml
+- name: manifests
+  namespace: temporal
+  chart: manifests
+  condition: temporal.enabled
+  missingFileHandler: Info
+  values:
+  - ../values/env.yaml
+  - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
+  - ../values/temporal/env.yaml.gotmpl
+  - ../values/temporal/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
+  hooks:
+  - events: [ prepare, cleanup ]
+    showlogs: true
+    command: ../bin/helmify
+    args:
+    - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
+    - '{{`{{ .Release.Chart }}`}}'
+    - '{{`{{ .Environment.Name }}`}}'
+    - ../values/temporal/manifests
+    - manifests
@@ -14,7 +14,7 @@ releases:
 - name: umami
  namespace: analytics
  chart: umami/umami
-  version: 7.9.4
+  version: 7.10.10
  condition: umami.enabled
  values:
  - ../values/umami/values/values.yaml
@@ -0,0 +1,43 @@
+bases:
+ - ../envs/environments.yaml.gotmpl
+
+repositories:
+- name: upterm
+  url: https://upterm.dev
+
+commonLabels:
+  tier: system
+
+releases:
+- name: uptermd
+  namespace: uptermd
+  chart: upterm/uptermd
+  version: 0.2.0
+  condition: uptermd.enabled
+  values:
+  - ../values/uptermd/values/values.yaml
+  - ../values/uptermd/values/values-{{ .Environment.Name }}.yaml
+  postRenderer: ../bin/kustomizer
+  postRendererArgs:
+  - ../values/uptermd/kustomize/{{ .Environment.Name }}
+  missingFileHandler: Info
+- name: manifests
+  namespace: uptermd
+  chart: manifests
+  condition: uptermd.enabled
+  missingFileHandler: Info
+  values:
+  - ../values/env.yaml
+  - ../values/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml
+  - ../values/uptermd/env.yaml.gotmpl
+  - ../values/uptermd/env-{{ requiredEnv "ARGOCD_ENV_CLUSTER_NAME" }}.yaml.gotmpl
+  hooks:
+  - events: [ prepare, cleanup ]
+    showlogs: true
+    command: ../bin/helmify
+    args:
+    - '{{`{{ if eq .Event.Name "prepare" }}build{{ else }}clean{{ end }}`}}'
+    - '{{`{{ .Release.Chart }}`}}'
+    - '{{`{{ .Environment.Name }}`}}'
+    - ../values/uptermd/manifests
+    - manifests
@@ -15,7 +15,7 @@ releases:
 - name: velero
  namespace: velero
  chart: velero/velero
-  version: 12.0.1
+  version: 12.1.0
  condition: velero.enabled
  values:
  - ../values/velero/values/velero.yaml.gotmpl
@@ -27,5 +27,6 @@ argocd:
    image: "git.oceanbox.io/platform/manifests/helmfile-cmp:latest"
    imagePullSecrets:
      - gitlab-pull-secret
+  webhookSecret: ""
  additional_rbac_settings:
  - g, "eb17a659-4ce6-41bc-9153-d9b117c44479", role:org-admin
@@ -6,149 +6,163 @@ metadata:
  namespace: argocd
 spec:
  clusterResourceWhitelist:
-  - group: '*'
-    kind: '*'
+    - group: "*"
+      kind: "*"
  description: sys components project
  destinations:
-  - namespace: default
-    server: https://kubernetes.default.svc
-  - namespace: argocd
-    server: https://kubernetes.default.svc
-  - namespace: kube-system
-    server: https://kubernetes.default.svc
-  - namespace: ingress-nginx
-    server: https://kubernetes.default.svc
-  - namespace: prometheus
-    server: https://kubernetes.default.svc
-  - namespace: cnpg
-    server: https://kubernetes.default.svc
-  - namespace: cert-manager
-    server: https://kubernetes.default.svc
-  - namespace: kubernetes-dashboard
-    server: https://kubernetes.default.svc
-  - namespace: rabbitmq
-    server: https://kubernetes.default.svc
-  - namespace: sealed-secrets
-    server: https://kubernetes.default.svc
-  - namespace: gitlab
-    server: https://kubernetes.default.svc
-  - namespace: thanos
-    server: https://kubernetes.default.svc
-  - namespace: linkerd
-    server: https://kubernetes.default.svc
-  - namespace: linkerd-multicluster
-    server: https://kubernetes.default.svc
-  - namespace: observability
-    server: https://kubernetes.default.svc
-  - namespace: kyverno
-    server: https://kubernetes.default.svc
-  - namespace: velero
-    server: https://kubernetes.default.svc
-  - namespace: loki
-    server: https://kubernetes.default.svc
-  - namespace: tempo
-    server: https://kubernetes.default.svc
-  - namespace: x509-exporter
-    server: https://kubernetes.default.svc
-  - namespace: mariadb-operator
-    server: https://kubernetes.default.svc
-  - namespace: dragonfly
-    server: https://kubernetes.default.svc
-  - namespace: cilium-spire
-    server: https://kubernetes.default.svc
-  - namespace: cilium-test
-    server: https://kubernetes.default.svc
-  - namespace: cilium-secrets
-    server: https://kubernetes.default.svc
-  - namespace: openfga
-    server: https://kubernetes.default.svc
-  - namespace: staging-openfga
-    server: https://kubernetes.default.svc
-  - namespace: dapr-system
-    server: https://kubernetes.default.svc
-  - namespace: rook-ceph
-    server: https://kubernetes.default.svc
-  - namespace: csi-addon-manager
-    server: https://kubernetes.default.svc
-  - namespace: headscale
-    server: https://kubernetes.default.svc
-  - namespace: drupal
-    server: https://kubernetes.default.svc
-  - namespace: otel
-    server: https://kubernetes.default.svc
-  - namespace: opentelemetry
-    server: https://kubernetes.default.svc
-  - namespace: ncps
-    server: https://kubernetes.default.svc
-  - namespace: slinky
-    server: https://kubernetes.default.svc
-  - namespace: slurm
-    server: https://kubernetes.default.svc
-  - namespace: spegel
-    server: https://kubernetes.default.svc
-  - namespace: uptime
-    server: https://kubernetes.default.svc
-  - namespace: gitea
-    server: https://kubernetes.default.svc
-  - namespace: postfix
-    server: https://kubernetes.default.svc
-  - namespace: jobset-system
-    server: https://kubernetes.default.svc
-  - namespace: ingress-haproxy
-    server: https://kubernetes.default.svc
-  - namespace: dex
-    server: https://kubernetes.default.svc
-  - namespace: cra-agent
-    server: https://kubernetes.default.svc
-  - namespace: catalyst
-    server: https://kubernetes.default.svc
+    - namespace: default
+      server: https://kubernetes.default.svc
+    - namespace: argocd
+      server: https://kubernetes.default.svc
+    - namespace: kube-system
+      server: https://kubernetes.default.svc
+    - namespace: ingress-nginx
+      server: https://kubernetes.default.svc
+    - namespace: prometheus
+      server: https://kubernetes.default.svc
+    - namespace: cnpg
+      server: https://kubernetes.default.svc
+    - namespace: cert-manager
+      server: https://kubernetes.default.svc
+    - namespace: kubernetes-dashboard
+      server: https://kubernetes.default.svc
+    - namespace: rabbitmq
+      server: https://kubernetes.default.svc
+    - namespace: sealed-secrets
+      server: https://kubernetes.default.svc
+    - namespace: gitlab
+      server: https://kubernetes.default.svc
+    - namespace: thanos
+      server: https://kubernetes.default.svc
+    - namespace: linkerd
+      server: https://kubernetes.default.svc
+    - namespace: linkerd-multicluster
+      server: https://kubernetes.default.svc
+    - namespace: observability
+      server: https://kubernetes.default.svc
+    - namespace: kyverno
+      server: https://kubernetes.default.svc
+    - namespace: velero
+      server: https://kubernetes.default.svc
+    - namespace: loki
+      server: https://kubernetes.default.svc
+    - namespace: tempo
+      server: https://kubernetes.default.svc
+    - namespace: x509-exporter
+      server: https://kubernetes.default.svc
+    - namespace: mariadb-operator
+      server: https://kubernetes.default.svc
+    - namespace: dragonfly
+      server: https://kubernetes.default.svc
+    - namespace: cilium-spire
+      server: https://kubernetes.default.svc
+    - namespace: cilium-test
+      server: https://kubernetes.default.svc
+    - namespace: cilium-secrets
+      server: https://kubernetes.default.svc
+    - namespace: openfga
+      server: https://kubernetes.default.svc
+    - namespace: staging-openfga
+      server: https://kubernetes.default.svc
+    - namespace: dapr-system
+      server: https://kubernetes.default.svc
+    - namespace: rook-ceph
+      server: https://kubernetes.default.svc
+    - namespace: csi-addon-manager
+      server: https://kubernetes.default.svc
+    - namespace: headscale
+      server: https://kubernetes.default.svc
+    - namespace: drupal
+      server: https://kubernetes.default.svc
+    - namespace: otel
+      server: https://kubernetes.default.svc
+    - namespace: opentelemetry
+      server: https://kubernetes.default.svc
+    - namespace: ncps
+      server: https://kubernetes.default.svc
+    - namespace: slinky
+      server: https://kubernetes.default.svc
+    - namespace: slurm
+      server: https://kubernetes.default.svc
+    - namespace: spegel
+      server: https://kubernetes.default.svc
+    - namespace: uptime
+      server: https://kubernetes.default.svc
+    - namespace: gitea
+      server: https://kubernetes.default.svc
+    - namespace: postfix
+      server: https://kubernetes.default.svc
+    - namespace: jobset-system
+      server: https://kubernetes.default.svc
+    - namespace: ingress-haproxy
+      server: https://kubernetes.default.svc
+    - namespace: dex
+      server: https://kubernetes.default.svc
+    - namespace: cra-agent
+      server: https://kubernetes.default.svc
+    - namespace: catalyst
+      server: https://kubernetes.default.svc
+    - namespace: niks3
+      server: https://kubernetes.default.svc
+    - namespace: temporal
+      server: https://kubernetes.default.svc
+    - namespace: ingest
+      server: https://kubernetes.default.svc
+    - namespace: proteus
+      server: https://kubernetes.default.svc
+    - namespace: clickhouse
+      server: https://kubernetes.default.svc
  sourceRepos:
-  - https://argoproj.github.io/argo-helm
-  - https://kubernetes-sigs.github.io/metrics-server/
-  - https://git.oceanbox.io/platform/manifests.git
-  - https://git.oceanbox.io/platform/manifests
-  - https://gitlab.com/oceanbox/manifests.git
-  - https://kubernetes.github.io/ingress-nginx
-  - https://cloudnative-pg.github.io/charts
-  - https://charts.jetstack.io
-  - https://kubernetes-sigs.github.io/nfs-subdir-external-provisioner/
-  - https://github.com/kubernetes/dashboard
-  - https://bitnami-labs.github.io/sealed-secrets
-  - https://prometheus-community.github.io/helm-charts
-  - https://github.com/prometheus-community/helm-charts.git
-  - https://charts.gitlab.io/
-  - https://charts.bitnami.com/bitnami
-  - https://helm.linkerd.io/stable
-  - https://github.com/jaegertracing/jaeger-operator
-  - https://kyverno.github.io/kyverno/
-  - https://vmware-tanzu.github.io/helm-charts
-  - https://grafana.github.io/helm-charts
-  - https://charts.enix.io
-  - https://helm.mariadb.com/mariadb-operator
-  - https://helm.mariadb.com/mariadb-operator-crds
-  - https://helm.mariadb.com
-  - https://helm.cilium.io
-  - https://chartmuseum.github.io/charts
-  - https://dapr.github.io/helm-charts
-  - https://charts.gabe565.com
-  - https://open-telemetry.github.io/opentelemetry-helm-charts
-  - https://ghcr.io/slinkyproject/charts/slurm-operator
-  - https://ghcr.io/slinkyproject/charts/slurm-operator-crds
-  - https://bokysan.github.io/docker-postfix/
-  - ghcr.io/slinkyproject/charts
-  - ghcr.io/slinkyproject/charts/slurm-operator
-  - ghcr.io/slinkyproject/charts/slurm-operator-crds
-  - ghcr.io/spegel-org/helm-charts
-  - quay.io/cilium/charts
-  - quay.io/jetstack/charts
-  - quay.io/enix/charts
-  - registry.k8s.io/jobset/charts/jobset
-  - ghcr.io/dragonflydb/dragonfly-operator/helm/dragonfly-operator
-  - docker.gitea.com
-  - https://operator.mariadb.com/mariadb-enterprise-operator
-  - https://ot-container-kit.github.io/helm-charts
-  - https://operator.mariadb.com
-  - https://twin.github.io/helm-charts
-  - https://charts.dexidp.io
-  - public.ecr.aws/diagrid/catalyst
-  - ghcr.io/haproxytech/helm-charts
+    - https://argoproj.github.io/argo-helm
+    - https://kubernetes-sigs.github.io/metrics-server/
+    - https://git.oceanbox.io/platform/manifests.git
+    - https://git.oceanbox.io/platform/manifests
+    - https://git.oceanbox.io/oceanbox/manifests.git
+    - https://kubernetes.github.io/ingress-nginx
+    - https://cloudnative-pg.github.io/charts
+    - https://charts.jetstack.io
+    - https://kubernetes-sigs.github.io/nfs-subdir-external-provisioner/
+    - https://github.com/kubernetes/dashboard
+    - https://bitnami-labs.github.io/sealed-secrets
+    - https://prometheus-community.github.io/helm-charts
+    - https://github.com/prometheus-community/helm-charts.git
+    - https://charts.gitlab.io/
+    - https://charts.bitnami.com/bitnami
+    - https://helm.linkerd.io/stable
+    - https://github.com/jaegertracing/jaeger-operator
+    - https://kyverno.github.io/kyverno/
+    - https://vmware-tanzu.github.io/helm-charts
+    - https://grafana.github.io/helm-charts
+    - https://charts.enix.io
+    - https://helm.mariadb.com/mariadb-operator
+    - https://helm.mariadb.com/mariadb-operator-crds
+    - https://helm.mariadb.com
+    - https://helm.cilium.io
+    - https://chartmuseum.github.io/charts
+    - https://dapr.github.io/helm-charts
+    - https://charts.gabe565.com
+    - ghcr.io/gabe565/charts
+    - https://open-telemetry.github.io/opentelemetry-helm-charts
+    - https://ghcr.io/slinkyproject/charts/slurm-operator
+    - https://ghcr.io/slinkyproject/charts/slurm-operator-crds
+    - https://bokysan.github.io/docker-postfix/
+    - ghcr.io/slinkyproject/charts
+    - ghcr.io/slinkyproject/charts/slurm-operator
+    - ghcr.io/slinkyproject/charts/slurm-operator-crds
+    - ghcr.io/spegel-org/helm-charts
+    - quay.io/cilium/charts
+    - quay.io/jetstack/charts
+    - quay.io/enix/charts
+    - registry.k8s.io/jobset/charts/jobset
+    - ghcr.io/dragonflydb/dragonfly-operator/helm/dragonfly-operator
+    - docker.gitea.com
+    - https://operator.mariadb.com/mariadb-enterprise-operator
+    - https://ot-container-kit.github.io/helm-charts
+    - https://operator.mariadb.com
+    - https://twin.github.io/helm-charts
+    - https://charts.dexidp.io
+    - public.ecr.aws/diagrid/catalyst
+    - ghcr.io/haproxytech/helm-charts
+    - https://go.temporal.io/helm-charts
+    - docker.io/temporalio
+    - ghcr.io/clickhouse
@@ -49,8 +49,8 @@ configs:
        name: {{ .name }}
        config:
          issuer: https://login.microsoftonline.com/{{ .tenant }}/v2.0
-          clientID: ${{ .name | replace "-" "_" }}_client_id
-          clientSecret: ${{ .name | replace "-" "_" }}_client_secret
+          clientID: ${{ .secret_ref.name }}:client_id
+          clientSecret: ${{ .secret_ref.name }}:client_secret
          insecureSkipEmailVerified: true
          requestedIDTokenClaims:
            groups:
@@ -62,7 +62,7 @@ configs:
            - email
            - groups
      staticClients:
-      - id: ${{ .name | replace "-" "_" }}_client_id
+      - id: ${{ .secret_ref.name }}:client_id
        name: Kubernetes
        # These are kubectl oidc plugin internal URLs
        redirectURIs:
@@ -99,6 +99,11 @@ configs:
    argo-helm:
      type: helm
      url: https://argoproj.github.io/argo-helm
+  {{- if .Values.argocd.webhookSecret }}
+  secret:
+    extra:
+      webhook.gitea.secret: {{ .Values.argocd.webhookSecret }}
+  {{- end }}
  # UI changes based on env
  styles: |
    /* blue, orange, red depending on env */
@@ -129,29 +134,11 @@ controller:
      cpu: {{ .Values.argocd.resources.controller.cpu  | default "250m" }}
      memory: {{ .Values.argocd.resources.controller.memory  | default "1000Mi" }}

-# Mount azure ca as file for SAML auth
 dex:
  metrics:
    enabled: true
    serviceMonitor:
      enabled: true
-  {{- with .Values.clusterConfig.oidc }}
-  env:
-  {{- range . }}
-  {{- if eq .group "devel" }}
-  - name: {{ .name | replace "-" "_" }}_client_secret
-    valueFrom:
-      secretKeyRef:
-        name: {{ .secret_ref.name }}
-        key: client_secret
-  - name: {{ .name | replace "-" "_" }}_client_id
-    valueFrom:
-      secretKeyRef:
-        name: {{ .secret_ref.name }}
-        key: client_id
-  {{- end }}
-  {{- end }}
-  {{- end }}

 redis:
  metrics:
@@ -4,7 +4,7 @@ metadata:
  name: beta-atlantis-actor-config
 data:
  KUEUE_NAMESPACE: "prod-queue"
-  XTRACT_IMAGE: "git.oceanbox.io/oceanbox/katamari/excavator:v1.2.14"
+  XTRACT_IMAGE: "git.oceanbox.io/oceanbox/katamari/excavator:v1.5.3"
  XTRACT_QUEUE: "prod-queue"
-  PLUME_IMAGE: "git.oceanbox.io/oceanbox/katamari/plume:v1.2.14"
+  PLUME_IMAGE: "git.oceanbox.io/oceanbox/katamari/plume:v1.5.3"
  PLUME_QUEUE: "prod-queue"
@@ -46,7 +46,7 @@
      "storeId": "01JKTZXMP7ANN4GG2P5W8Y56M6",
      "modelId": "01JKTZYMCZZBVSBG66W27XMW0A"
    },
-    "sentryUrl": "https://b6e03cfc8e247297b89217b09341b4cb@o4509530141622272.ingest.de.sentry.io/4509530195492944",
+    "sentryUrl": "https://793f73e5a9278cb638c0acd175b9289d@o4509530141622272.ingest.de.sentry.io/4509530195492944",
    "plainAuthUsers": [
        {
            "username": "admin",
@@ -3,7 +3,6 @@ kind: ConfigMap
 metadata:
  name: staging-atlantis-actor-config
 data:
-  XTRACT_IMAGE: "git.oceanbox.io/oceanbox/katamari/excavator:v1.4.0"
-  XTRACT_QUEUE: "dev-queue"
-  PLUME_IMAGE: "git.oceanbox.io/oceanbox/katamari/plume:v1.4.0"
-  PLUME_QUEUE: "dev-queue"
+  TEMPORAL_ADDRESS: "temporal-grpc.ekman.oceanbox.io:443"
+  TEMPORAL_TLS: "true"
+  TEMPORAL_NAMESPACE: "staging-atlantis"
@@ -41,12 +41,12 @@
        }
    },
    "fga": {
-      "apiUrl": "http://prod-openfga.openfga.svc.cluster.local:8080",
+      "apiUrl": "http://staging-openfga.staging-openfga.svc.cluster.local:8080",
      "apiKey": "",
      "storeId": "01JKTZXMP7ANN4GG2P5W8Y56M6",
      "modelId": "01JKTZYMCZZBVSBG66W27XMW0A"
    },
-    "sentryUrl": "https://b6e03cfc8e247297b89217b09341b4cb@o4509530141622272.ingest.de.sentry.io/4509530195492944",
+    "sentryUrl": "https://793f73e5a9278cb638c0acd175b9289d@o4509530141622272.ingest.de.sentry.io/4509530195492944",
    "plainAuthUsers": [
        {
            "username": "admin",
@@ -0,0 +1,18 @@
+{{- if .Values.clusterConfig.cilium.enabled }}
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-temporal
+  namespace: {{ .Release.Namespace }}
+spec:
+  endpointSelector:
+    matchLabels:
+      app.kubernetes.io/name: atlantis
+  egress:
+  - toFQDNs:
+    - matchName: temporal-grpc.ekman.oceanbox.io
+    toPorts:
+    - ports:
+      - port: "443"
+        protocol: TCP
+{{- end }}
@@ -2,7 +2,7 @@ replicaCount: 1

 image:
  repository: git.oceanbox.io/oceanbox/poseidon/atlantis
-  tag: v2.9.4
+  tag: v2.17.0

 podAnnotations:
  dapr.io/app-id: "beta-atlantis"
@@ -11,7 +11,7 @@ env:
  - name: APP_NAMESPACE
    value: beta-atlantis
  - name: APP_VERSION
-    value: "2.9.4-beta"
+    value: "2.17.0-beta"
  - name: LOG_LEVEL
    value: "1"
  - name: ANALYTICS_WEB_ID
@@ -1,7 +1,7 @@
 replicaCount: 1
 image:
  repository: git.oceanbox.io/oceanbox/poseidon/atlantis
-  tag: d7525aed-debug
+  tag: 29de0c67-debug
 podAnnotations:
  dapr.io/app-id: "staging-atlantis"
 env:
@@ -1,2 +0,0 @@
-attic:
-  enabled: false
@@ -1,27 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: attic
-  namespace: argocd
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-spec:
-  destination:
-    namespace: attic
-    server: "https://kubernetes.default.svc"
-  sources:
-    - repoURL: https://git.oceanbox.io/oceanbox/manifests.git
-      targetRevision: HEAD
-      path: values/attic/manifests
-  project: aux
-  syncPolicy:
-    managedNamespaceMetadata:
-      labels:
-        component: aux
-    syncOptions:
-      - CreateNamespace=true
-      - ApplyOutOfSyncOnly=true
-      # - ServerSideApply=true
-    automated:
-      prune: true
-      # selfHeal: false
@@ -1,167 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  labels:
-    app.kubernetes.io/name: attic
-  name: attic-config
-  namespace: attic
-data:
-  config.toml: |
-    # src: https://github.com/zhaofengli/attic/blob/main/server/src/config-template.toml
-
-    # Socket address to listen on
-    listen = "[::]:8080"
-
-    # Allowed `Host` headers
-    #
-    # This _must_ be configured for production use. If unconfigured or the
-    # list is empty, all `Host` headers are allowed.
-    allowed-hosts = []
-
-    # The canonical API endpoint of this server
-    #
-    # This is the endpoint exposed to clients in `cache-config` responses.
-    #
-    # This _must_ be configured for production use. If not configured, the
-    # API endpoint is synthesized from the client's `Host` header which may
-    # be insecure.
-    #
-    # The API endpoint _must_ end with a slash (e.g., `https://domain.tld/attic/`
-    # not `https://domain.tld/attic`).
-    api-endpoint = "https://attic.srv.oceanbox.io/"
-
-    # Whether to soft-delete caches
-    #
-    # If this is enabled, caches are soft-deleted instead of actually
-    # removed from the database. Note that soft-deleted caches cannot
-    # have their names reused as long as the original database records
-    # are there.
-    #soft-delete-caches = false
-
-    # Whether to require fully uploading a NAR if it exists in the global cache.
-    #
-    # If set to false, simply knowing the NAR hash is enough for
-    # an uploader to gain access to an existing NAR in the global
-    # cache.
-    #require-proof-of-possession = true
-
-    # Database connection
-    [database]
-    # Connection URL
-    #
-    # For production use it's recommended to use PostgreSQL.
-    url = "postgresql://app:mZP1BnmnpDU33B7UZvomYKOSS1laRJ4bvUR7jNDZ1AJqPdNxH2rLXykghczg7Bgy@attic-db-rw:5432/app"
-
-    # Whether to enable sending on periodic heartbeat queries
-    #
-    # If enabled, a heartbeat query will be sent every minute
-    #heartbeat = false
-
-    # File storage configuration
-    [storage]
-    # Storage type
-    #
-    # Can be "local" or "s3".
-    type = "local"
-
-    # ## Local storage
-
-    # The directory to store all files under
-    path = "/attic"
-
-    # ## S3 Storage (set type to "s3" and uncomment below)
-
-    # The AWS region
-    #region = "us-east-1"
-
-    # The name of the bucket
-    #bucket = "some-bucket"
-
-    # Custom S3 endpoint
-    #
-    # Set this if you are using an S3-compatible object storage (e.g., Minio).
-    #endpoint = "https://xxx.r2.cloudflarestorage.com"
-
-    # Credentials
-    #
-    # If unset, the credentials are read from the `AWS_ACCESS_KEY_ID` and
-    # `AWS_SECRET_ACCESS_KEY` environment variables.
-    #[storage.credentials]
-    #  access_key_id = ""
-    #  secret_access_key = ""
-
-    # Data chunking
-    #
-    # Warning: If you change any of the values here, it will be
-    # difficult to reuse existing chunks for newly-uploaded NARs
-    # since the cutpoints will be different. As a result, the
-    # deduplication ratio will suffer for a while after the change.
-    [chunking]
-    # The minimum NAR size to trigger chunking
-    #
-    # If 0, chunking is disabled entirely for newly-uploaded NARs.
-    # If 1, all NARs are chunked.
-    nar-size-threshold = 65536 # chunk files that are 64 KiB or larger
-
-    # The preferred minimum size of a chunk, in bytes
-    min-size = 16384            # 16 KiB
-
-    # The preferred average size of a chunk, in bytes
-    avg-size = 65536            # 64 KiB
-
-    # The preferred maximum size of a chunk, in bytes
-    max-size = 262144           # 256 KiB
-
-    # Compression
-    [compression]
-    # Compression type
-    #
-    # Can be "none", "brotli", "zstd", or "xz"
-    type = "zstd"
-
-    # Compression level
-    #level = 8
-
-    # Garbage collection
-    [garbage-collection]
-    # The frequency to run garbage collection at
-    #
-    # By default it's 12 hours. You can use natural language
-    # to specify the interval, like "1 day".
-    #
-    # If zero, automatic garbage collection is disabled, but
-    # it can still be run manually with `atticd --mode garbage-collector-once`.
-    interval = "1 week"
-
-    # Default retention period
-    #
-    # Zero (default) means time-based garbage-collection is
-    # disabled by default. You can enable it on a per-cache basis.
-    default-retention-period = "6 months"
-
-    [jwt]
-    # WARNING: Changing _anything_ in this section will break any existing
-    # tokens. If you need to regenerate them, ensure that you use the the
-    # correct secret and include the `iss` and `aud` claims.
-
-    # JWT `iss` claim
-    #
-    # Set this to the JWT issuer that you want to validate.
-    # If this is set, all received JWTs will validate that the `iss` claim
-    # matches this value.
-    #token-bound-issuer = "some-issuer"
-
-    # JWT `aud` claim
-    #
-    # Set this to the JWT audience(s) that you want to validate.
-    # If this is set, all received JWTs will validate that the `aud` claim
-    # contains at least one of these values.
-    #token-bound-audiences = ["some-audience1", "some-audience2"]
-
-    [jwt.signing]
-    # JWT RS256 secret key
-    #
-    # Set this to the base64-encoded private half of an RSA PEM PKCS1 key.
-    # You can also set it via the `ATTIC_SERVER_TOKEN_RS256_SECRET_BASE64`
-    # environment variable.
-    token-rs256-secret-base64 = "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS2dJQkFBS0NBZ0VBdlZrMHQyZUtvdjhpV3prVFFtQzJtRklvd0gxc2liNlVpUFhUaGVwcURiWHMyaERFCnFYa1pKUXRjTnY0T2RtcldmZ2tsbjVyblJNQk5yL1B5dE05OFFMVVJnbzFSU2VTeUVjcmxSU1N4MElVRlhkM3YKV0U0aTJJTktsSzgxblJoY0o4czRUM09iYUpvSUQweEpqS2IzMkhxZmpOSU1vcVdBRk1ES2YyMUM5OWxQeTRXSgpVUUVnYTRzbHo5RzZHVi8wZW5qbFNMa2RRNjEvdEwyRE1ISHgvV2VRUEtpWkF4c2Fwczd3ZVJiNVBrS3J0MVlGClRxa1lJSjY3eDFiNDR1N0NmdWdVbHhMM2JCQ1lqVXVXNnoxdGU3T2ZQUUhoM1FPU2lFZTczQ3I4dU1lSkplV0wKN2VKc1hWSG9uVzBMZWl0aDk5WmJTUTF3YlhieDVPZzNTQ3ZWYnkyZE90Y3Rud2Y2aDN5YlJ3SUNoc24xbk4zMwowRkMyOXlFY0ExQ2VFVzRsMVVHNmxoMGw5cEpiWEhRNlFJS1paempaTlgxZTRGRW5TdytGNGhXd3R1Z2JtKzZnCnVPdEE5QVJxYndJOTFLeEtoT204Q0RJQlRwWThSZG1SaElicWUrc3czT3p3dGk0eTVkU3FMREsrT3Y5b05ucngKQW9TN21TaXNQeDVJS3JwaFhMT3JvVmI2L1puSmNOK3ljaExuenptMDY2Zk5RaTBLNHhzaitvWkphaXVjZnBacAphSElHZGpaY1U3aE5FUzdJNVliVEFqUDdkaDRzdXJnMk1xTUtxbUxsa2ZPcGFoRTlMQTZVVFZRZHZLVFVGNWZwCkdYSnhaT1RKWlpiOGNQTFYxZFdXbnBMaEZNV2h2OUZQTCtDVGZQVUFvQmtmOTE3TzFLdkE3bGsvcTJzQ0F3RUEKQVFLQ0FnQU9WZ3k1dmlzdkFDWTN4ZkNCWEJVM0h6RmFzYVJnSVgvWmh0TkhGbUtGT3pyOW43dGtJWGtYNXU1SwpjNTNndFdJY0ZORTJibUlJUUk4aFBWVW8vM1NtNlk2ejFjTkwxdmJzaGZJcDlBZEtoR2ZOblpvYmszN3I2YlRoCjRRb3NKTVlGZFV1RUtIcWh4dGZKWUx0STNQTnkvb1hLQWJWWE16U3BYWmQzWW14cG01aUJEbEZCUXRhVGpldUUKK3BvZWhiZGE5b0JWcXo1ZCsycnA0bGRtZVpvYTE1YUNJVG5FbEc3R0puRHFtaVN3NUJkZ1FERVNyWmJZRVd5aQpRU0dDL1JUWXl2V1VJcWw5RXh5WnhobGRJaitCMkMyOFRzSXRHN0lpZzF2ajVaVlE0RHF3RmRzc1hiSmF0bkxvClNITlFBcXplT09xY2Mxb0p6N0dzNVRBYVZNZEtEQXZCZm1JMFBMcDNqNmVFOFFIYlduMHk2NzVYbnlqWllLUUcKaWx5R0pUNVRzMWZHWHlPSXBrNG4yQjM1V3dHcjIyTkxnYUd5cnZjRkgxN3JoZGVnaGlrZFJRd1FOcXRsZjBIZApMWDVRQWVwcUt3SE9uR1BGVy9XU2xGU0lEdkt1VFZSVGtvQmFSMTA3OFpiS2JXckZBbEdqYTFvbnNXQUh1YW5UClh5dFE4dWoxUEFFeWFMZUJEaUJxRVJ2am1VVFQ1ZktCOTdaVnRJenVBZ0lyWWZ6YjIyVEk2VFJ6OVZiQ2VyWG8KdTc0cnoxMjM2TXMrbmg5Y2xYd3VtQlBOU1d1eE9OdldOWEZ6VWdIOURzdlFRMWRsMFRJWEFQMGhFYkRHRkNBQwowUlg2M0lpcXFzUG1ZZUZNTGR5K2tVWjViNzI1TlhXWFRHbDRnQ1Y3NFVRU01ya0xrUUtDQVFFQStobXIwYjdnClVYcWRKaGtLRXVsa29IVzVuYzZ4QmhobCtuTkFucVFSTm5tQWpiaDlCeDVpLzQ2WUwxcHFYQUY5cTNIRlowSDIKZEJRZXN2Q0pxbmtSTHVwTi95VE1KSlo0ZE5kMHZqRzZ0UGhMUjZuRmRabHU0TFBRMXRKcU5XZkhZeCtwQ3N2SQo4Wkx3VG8rRGFxSjArZDk3WWF0b0dWNUZHOWtUSjhBYWFXb0Q1R1AyOGtOd0djKzI0b2VNYnJtU0ppQ2I2UlJoCjA5WWJaMGpXdkFHaXJyMzFOTW5nR0dtVmRPMThoOXVMUStLNzFUQWt1eFEzZEhpUzh6UVd6YythRnM1THgyUnIKeXppcEJhR3VySmFJQ05XNklFQm5ndFcvZEZaYXpMbjhQcDVrQlJzQ1NyN1JpQkNFSFZmeHBYVFNoS3cwVWp4NQo2a0gwc01YZnFoOFpMUUtDQVFFQXdkQ3BPUXBRa1RhK0t6Z0VrWGdMVnk2QmZJKzRWdC9BYjRtK2pFSm85aUIzCnN4dEtKNU5tNXltNldXcmFWS25zekxNZy85Mi9vSVZreUlNSklrOWNYdEpuaEU5ak1aVzc2ZjhYbW5CUnJIMnAKVHVmNWtYWWdVUHZLQ2g1U1g5Q2w0UHJENHNSb3cwNHJjbHVxSE1MT2g1MncxUmJPalRrb05tNXBHWlFoVkhxeApaUzh3aVk3bzhLNFZJQXZOVlZOdGlIZFNOY2Y0cDMxL0F6SU5aQjJWdlczeWJHTWNIdDByekQ5TkpZLzhTekc3CktEME5mRTgzeng2OWxHTlhUcURGSnBTV2ZNVlFwSGVCM0FTRTV1YVhVM1c5S3EwN2NDOEJWSHRaK3B5a1B0RTYKOHgrZE9NYWh6UElaMjRqbkIzZkVsaWc0Rk5zd01LZm9aeDdKYUJLRjl3S0NBUUVBdWJUTUgwOWpVenovYVdXWQpWRmlYVG9wN3pGRElvNlVFUEFiT1NiMjd4ajVNRlcrUzd2RkNRMDZIZEVubnhlK1pkKzlmeS85djE5dUV2QXZkCnZRWnVtdTZDQWQwNTlFVUNwb2ZCZU9TR0paQmtuWTdUUHpJeDRZbkRuVy9hUzFPRyt2UnNXY2JkcTNzWEVzNS8KbjNPSDltNWFPRGpGY0dqT1doSkNwZlovNWh4QlRacG9xSlVvclJIT1U4Q2dweXNGK1dlblBWZlVHQzdZWkVYeQpwT0YyQWRpdE5ZaGM3T09oaFpRK0xzYjNUdTRSMlFnSmpoeEIzU3NXdXAzSC9RU1UvekFwbHFIYlpLZnE0WEtmCnVDbUNVMFVZRXBDZ0M4ZFpoVElGOUJSNTE2bFd6Vyt6c1BxbHJTbk9YOWVJWi9vcHd6ZjNGY1V3SmFEWjUxVFcKY29UcTlRS0NBUUVBckhtVTdpYkl0Y0Zpa0RGa2wxT2R1L0t0MW54TFRqd0dFdndnYnM3MmV2ay9yRXEvdmVKRgpzN2NGbDJjb2JpbGRpbmhxQ0doOGpFdkkrVXJxeVBhWXUrVS9xNVcrTHpVUnFkV1JXcVZUZVUzR2FtcXpSQWc4CkQvVlJ3WmxrTXRJSm0rRnNpcFBBcXZVWVlzZEI1aUJTREl0Ky90SXg4NmtHcVJHdVE4MzNyeWNVVUhnakdIYnQKd3FrWU1aRnZJOXgvWCs3WFlQYll4Nnc5YUVtVmN4K0V6ck5XQmJCWktQb25iTFowWDlYM2JhOE8zMnNkWWg5WgpDZDlRVkFubmV4aEUrZVZHMmpmNVlMTGRCRCtkU2FHd3p0dTdBSXh5bFkydkFGQlpMVlZTTUhpZm5oWG5Jc3hZCjFub29HcDZGQWJkS1lWbmZObWdzUlZCVzE5V2s1QkYvMXdLQ0FRRUFqVnR1RXdYZzU5NERIaVN4UjlWbGRBaHYKcXF5dlpieVhPT2pnNHNKZjFLUlpxZkkzV28yL05IQWN0MlZlREE1bnlEM001YndHWEwrdVZGaUlMVk1ZMUp0WQp6MmlHWHgwZVdlbFJya2tRZHFncTI1TE9BQ2dxYTFMNW9tQS9tMGcwQWljWVdYa1FYSXpXRkhwb0ZqcU9KZHpTCnZ0MHhLV2lpWHUxVk5YeDJibFR1dXBCa1JUZUlQNTVxdWdyOUh0ZmY1MHc5MHhwTllaMFR3d0lDMG1neVVMMWEKRkdVdHlPUTlqVFBUUUdGM3h6REJCQ2U2MW5uZUV0TThRMEJ1MXh3Rm90aWFYSE9NaGhiMFBndVkzNHhiekNHYgpHcTlsWjVaN2lRVXByUWNNYjhrUzZ1WFk3VHBDTmUzaDBiTTM5dVlKeHNYNXUzcmVNRWsyZlBNT3dnTlFjdz09Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg=="
@@ -1,63 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: attic
-spec:
-  selector:
-    matchLabels:
-      app: attic
-  strategy:
-    type: Recreate
-  template:
-    metadata:
-      labels:
-        app: attic
-    spec:
-      containers:
-        - name: attic
-          image: ghcr.io/zhaofengli/attic:latest
-          args:
-           - -f
-           - /config.toml
-          ports:
-            - name: http
-              containerPort: 8080
-              protocol: TCP
-          livenessProbe:
-            httpGet:
-              path: /
-              port: http
-          readinessProbe:
-            httpGet:
-              path: /
-              port: http
-          env:
-            - name: ATTIC_SERVER_TOKEN_HS256_SECRET_BASE64
-              value: "LS0tLS1CRUdJTiBSU0EgUFJJVkFURSBLRVktLS0tLQpNSUlKS2dJQkFBS0NBZ0VBdlZrMHQyZUtvdjhpV3prVFFtQzJtRklvd0gxc2liNlVpUFhUaGVwcURiWHMyaERFCnFYa1pKUXRjTnY0T2RtcldmZ2tsbjVyblJNQk5yL1B5dE05OFFMVVJnbzFSU2VTeUVjcmxSU1N4MElVRlhkM3YKV0U0aTJJTktsSzgxblJoY0o4czRUM09iYUpvSUQweEpqS2IzMkhxZmpOSU1vcVdBRk1ES2YyMUM5OWxQeTRXSgpVUUVnYTRzbHo5RzZHVi8wZW5qbFNMa2RRNjEvdEwyRE1ISHgvV2VRUEtpWkF4c2Fwczd3ZVJiNVBrS3J0MVlGClRxa1lJSjY3eDFiNDR1N0NmdWdVbHhMM2JCQ1lqVXVXNnoxdGU3T2ZQUUhoM1FPU2lFZTczQ3I4dU1lSkplV0wKN2VKc1hWSG9uVzBMZWl0aDk5WmJTUTF3YlhieDVPZzNTQ3ZWYnkyZE90Y3Rud2Y2aDN5YlJ3SUNoc24xbk4zMwowRkMyOXlFY0ExQ2VFVzRsMVVHNmxoMGw5cEpiWEhRNlFJS1paempaTlgxZTRGRW5TdytGNGhXd3R1Z2JtKzZnCnVPdEE5QVJxYndJOTFLeEtoT204Q0RJQlRwWThSZG1SaElicWUrc3czT3p3dGk0eTVkU3FMREsrT3Y5b05ucngKQW9TN21TaXNQeDVJS3JwaFhMT3JvVmI2L1puSmNOK3ljaExuenptMDY2Zk5RaTBLNHhzaitvWkphaXVjZnBacAphSElHZGpaY1U3aE5FUzdJNVliVEFqUDdkaDRzdXJnMk1xTUtxbUxsa2ZPcGFoRTlMQTZVVFZRZHZLVFVGNWZwCkdYSnhaT1RKWlpiOGNQTFYxZFdXbnBMaEZNV2h2OUZQTCtDVGZQVUFvQmtmOTE3TzFLdkE3bGsvcTJzQ0F3RUEKQVFLQ0FnQU9WZ3k1dmlzdkFDWTN4ZkNCWEJVM0h6RmFzYVJnSVgvWmh0TkhGbUtGT3pyOW43dGtJWGtYNXU1SwpjNTNndFdJY0ZORTJibUlJUUk4aFBWVW8vM1NtNlk2ejFjTkwxdmJzaGZJcDlBZEtoR2ZOblpvYmszN3I2YlRoCjRRb3NKTVlGZFV1RUtIcWh4dGZKWUx0STNQTnkvb1hLQWJWWE16U3BYWmQzWW14cG01aUJEbEZCUXRhVGpldUUKK3BvZWhiZGE5b0JWcXo1ZCsycnA0bGRtZVpvYTE1YUNJVG5FbEc3R0puRHFtaVN3NUJkZ1FERVNyWmJZRVd5aQpRU0dDL1JUWXl2V1VJcWw5RXh5WnhobGRJaitCMkMyOFRzSXRHN0lpZzF2ajVaVlE0RHF3RmRzc1hiSmF0bkxvClNITlFBcXplT09xY2Mxb0p6N0dzNVRBYVZNZEtEQXZCZm1JMFBMcDNqNmVFOFFIYlduMHk2NzVYbnlqWllLUUcKaWx5R0pUNVRzMWZHWHlPSXBrNG4yQjM1V3dHcjIyTkxnYUd5cnZjRkgxN3JoZGVnaGlrZFJRd1FOcXRsZjBIZApMWDVRQWVwcUt3SE9uR1BGVy9XU2xGU0lEdkt1VFZSVGtvQmFSMTA3OFpiS2JXckZBbEdqYTFvbnNXQUh1YW5UClh5dFE4dWoxUEFFeWFMZUJEaUJxRVJ2am1VVFQ1ZktCOTdaVnRJenVBZ0lyWWZ6YjIyVEk2VFJ6OVZiQ2VyWG8KdTc0cnoxMjM2TXMrbmg5Y2xYd3VtQlBOU1d1eE9OdldOWEZ6VWdIOURzdlFRMWRsMFRJWEFQMGhFYkRHRkNBQwowUlg2M0lpcXFzUG1ZZUZNTGR5K2tVWjViNzI1TlhXWFRHbDRnQ1Y3NFVRU01ya0xrUUtDQVFFQStobXIwYjdnClVYcWRKaGtLRXVsa29IVzVuYzZ4QmhobCtuTkFucVFSTm5tQWpiaDlCeDVpLzQ2WUwxcHFYQUY5cTNIRlowSDIKZEJRZXN2Q0pxbmtSTHVwTi95VE1KSlo0ZE5kMHZqRzZ0UGhMUjZuRmRabHU0TFBRMXRKcU5XZkhZeCtwQ3N2SQo4Wkx3VG8rRGFxSjArZDk3WWF0b0dWNUZHOWtUSjhBYWFXb0Q1R1AyOGtOd0djKzI0b2VNYnJtU0ppQ2I2UlJoCjA5WWJaMGpXdkFHaXJyMzFOTW5nR0dtVmRPMThoOXVMUStLNzFUQWt1eFEzZEhpUzh6UVd6YythRnM1THgyUnIKeXppcEJhR3VySmFJQ05XNklFQm5ndFcvZEZaYXpMbjhQcDVrQlJzQ1NyN1JpQkNFSFZmeHBYVFNoS3cwVWp4NQo2a0gwc01YZnFoOFpMUUtDQVFFQXdkQ3BPUXBRa1RhK0t6Z0VrWGdMVnk2QmZJKzRWdC9BYjRtK2pFSm85aUIzCnN4dEtKNU5tNXltNldXcmFWS25zekxNZy85Mi9vSVZreUlNSklrOWNYdEpuaEU5ak1aVzc2ZjhYbW5CUnJIMnAKVHVmNWtYWWdVUHZLQ2g1U1g5Q2w0UHJENHNSb3cwNHJjbHVxSE1MT2g1MncxUmJPalRrb05tNXBHWlFoVkhxeApaUzh3aVk3bzhLNFZJQXZOVlZOdGlIZFNOY2Y0cDMxL0F6SU5aQjJWdlczeWJHTWNIdDByekQ5TkpZLzhTekc3CktEME5mRTgzeng2OWxHTlhUcURGSnBTV2ZNVlFwSGVCM0FTRTV1YVhVM1c5S3EwN2NDOEJWSHRaK3B5a1B0RTYKOHgrZE9NYWh6UElaMjRqbkIzZkVsaWc0Rk5zd01LZm9aeDdKYUJLRjl3S0NBUUVBdWJUTUgwOWpVenovYVdXWQpWRmlYVG9wN3pGRElvNlVFUEFiT1NiMjd4ajVNRlcrUzd2RkNRMDZIZEVubnhlK1pkKzlmeS85djE5dUV2QXZkCnZRWnVtdTZDQWQwNTlFVUNwb2ZCZU9TR0paQmtuWTdUUHpJeDRZbkRuVy9hUzFPRyt2UnNXY2JkcTNzWEVzNS8KbjNPSDltNWFPRGpGY0dqT1doSkNwZlovNWh4QlRacG9xSlVvclJIT1U4Q2dweXNGK1dlblBWZlVHQzdZWkVYeQpwT0YyQWRpdE5ZaGM3T09oaFpRK0xzYjNUdTRSMlFnSmpoeEIzU3NXdXAzSC9RU1UvekFwbHFIYlpLZnE0WEtmCnVDbUNVMFVZRXBDZ0M4ZFpoVElGOUJSNTE2bFd6Vyt6c1BxbHJTbk9YOWVJWi9vcHd6ZjNGY1V3SmFEWjUxVFcKY29UcTlRS0NBUUVBckhtVTdpYkl0Y0Zpa0RGa2wxT2R1L0t0MW54TFRqd0dFdndnYnM3MmV2ay9yRXEvdmVKRgpzN2NGbDJjb2JpbGRpbmhxQ0doOGpFdkkrVXJxeVBhWXUrVS9xNVcrTHpVUnFkV1JXcVZUZVUzR2FtcXpSQWc4CkQvVlJ3WmxrTXRJSm0rRnNpcFBBcXZVWVlzZEI1aUJTREl0Ky90SXg4NmtHcVJHdVE4MzNyeWNVVUhnakdIYnQKd3FrWU1aRnZJOXgvWCs3WFlQYll4Nnc5YUVtVmN4K0V6ck5XQmJCWktQb25iTFowWDlYM2JhOE8zMnNkWWg5WgpDZDlRVkFubmV4aEUrZVZHMmpmNVlMTGRCRCtkU2FHd3p0dTdBSXh5bFkydkFGQlpMVlZTTUhpZm5oWG5Jc3hZCjFub29HcDZGQWJkS1lWbmZObWdzUlZCVzE5V2s1QkYvMXdLQ0FRRUFqVnR1RXdYZzU5NERIaVN4UjlWbGRBaHYKcXF5dlpieVhPT2pnNHNKZjFLUlpxZkkzV28yL05IQWN0MlZlREE1bnlEM001YndHWEwrdVZGaUlMVk1ZMUp0WQp6MmlHWHgwZVdlbFJya2tRZHFncTI1TE9BQ2dxYTFMNW9tQS9tMGcwQWljWVdYa1FYSXpXRkhwb0ZqcU9KZHpTCnZ0MHhLV2lpWHUxVk5YeDJibFR1dXBCa1JUZUlQNTVxdWdyOUh0ZmY1MHc5MHhwTllaMFR3d0lDMG1neVVMMWEKRkdVdHlPUTlqVFBUUUdGM3h6REJCQ2U2MW5uZUV0TThRMEJ1MXh3Rm90aWFYSE9NaGhiMFBndVkzNHhiekNHYgpHcTlsWjVaN2lRVXByUWNNYjhrUzZ1WFk3VHBDTmUzaDBiTTM5dVlKeHNYNXUzcmVNRWsyZlBNT3dnTlFjdz09Ci0tLS0tRU5EIFJTQSBQUklWQVRFIEtFWS0tLS0tCg=="
-              # valueFrom:
-              #   secretKeyRef:
-              #     name: server
-              #     key: token
-            - name: ATTIC_SERVER_DATABASE_URL
-              value: "postgresql://app:mZP1BnmnpDU33B7UZvomYKOSS1laRJ4bvUR7jNDZ1AJqPdNxH2rLXykghczg7Bgy@attic-db-rw:5432/app"
-              # valueFrom:
-                # secretKeyRef:
-                  # name: database
-                  # key: url
-          volumeMounts:
-          - name: data
-            mountPath: /attic
-          - name: attic-config
-            mountPath: /config.toml
-            subPath: config.toml
-      volumes:
-        - name: server
-          secret:
-            secretName: server
-        - name: attic-config
-          configMap:
-            defaultMode: 420
-            name: attic-config
-        - name: data
-          persistentVolumeClaim:
-            claimName: attic
@@ -1,28 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production
-    haproxy.org/backend-protocol: h1
-    haproxy.org/timeout-server: 600s
-  labels:
-    app.kubernetes.io/component: attic
-  name: attic
-  namespace: attic
-spec:
-  ingressClassName: haproxy
-  rules:
-  - host: attic.srv.oceanbox.io
-    http:
-      paths:
-      - backend:
-          service:
-            name: attic
-            port:
-              name: http
-        path: /
-        pathType: Prefix
-  tls:
-  - hosts:
-    - attic.srv.oceanbox.io
-    secretName: attic.srv.oceanbox.io-tls
@@ -1,13 +0,0 @@
-apiVersion: cilium.io/v2
-kind: CiliumNetworkPolicy
-metadata:
-  name: allow-cache-nixos
-  namespace: ncps
-spec:
-  egress:
-    - toFQDNs:
-        - matchPattern: 'cache.nixos.org'
-        - matchPattern: 'nix-community.cachix.org'
-  endpointSelector:
-    matchLabels:
-      app: nix-cache
@@ -1,12 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: attic
-  labels:
-    app: attic
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 20Gi
@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: server
-stringData:
-  token: "ref+sops://secrets.yml#attic/jwtToken"
@@ -1,3 +1,3 @@
 catalyst:
-  enabled: true
+  enabled: false
  autosync: false
@@ -0,0 +1,4 @@
+clickhouse:
+  enabled: true
+  s3:
+    enabled: true
@@ -0,0 +1,27 @@
+clickhouse:
+  enabled: false
+  autosync: true
+  clusterName: clickhouse
+  keeperName: clickhouse-keeper
+  serviceName: clickhouse-clickhouse-headless
+  storageClass: managed-nfs-storage
+  storage: 50Gi
+  keeperStorage: 5Gi
+  keeperReplicas: 3
+  resources:
+    cpuRequest: "1"
+    memoryRequest: 4Gi
+    memoryLimit: 8Gi
+  database: otel
+  user: default
+  credentialsSecret: clickhouse-credentials
+  credentialsKey: password
+  s3:
+    enabled: false
+    endpoint: "http://10.255.241.30:30080"
+    bucket: clickhouse
+    secret: clickhouse-s3
+    moveFactor: 0.2
+  ttl:
+    logs: 720h
+    traces: 336h
@@ -0,0 +1,42 @@
+{{- if .Values.clusterConfig.argo.enabled }}
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: clickhouse
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  destination:
+    namespace: clickhouse
+    server: 'https://kubernetes.default.svc'
+  sources:
+  - repoURL: {{ .Values.clusterConfig.manifests }}
+    targetRevision: HEAD
+    path: helmfile.d
+    plugin:
+      name: helmfile-cmp
+      env:
+      - name: CLUSTER_NAME
+        value: {{ .Values.clusterConfig.cluster }}
+      - name: HELMFILE_ENVIRONMENT
+        value: default
+      - name: HELMFILE_FILE_PATH
+        value: clickhouse.yaml.gotmpl
+  project: sys
+  syncPolicy:
+    managedNamespaceMetadata:
+      labels:
+        component: sys
+    syncOptions:
+      - CreateNamespace=true
+      - ApplyOutOfSyncOnly=true
+      - ServerSideApply=true
+    {{- if .Values.clickhouse.autosync }}
+    automated:
+      prune: true
+      # selfHeal: false
+    {{- end }}
+{{- end }}
@@ -0,0 +1,25 @@
+{{- if .Values.clusterConfig.cilium.enabled }}
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-prometheus
+  namespace: clickhouse
+spec:
+  description: Allow Grafana queries and Prometheus metric scraping
+  endpointSelector:
+    matchLabels: {}
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: prometheus
+      toPorts:
+        - ports:
+            - port: "9000"
+              protocol: TCP
+            - port: "8123"
+              protocol: TCP
+            - port: "8080"
+              protocol: TCP
+            - port: "9363"
+              protocol: TCP
+{{- end }}
@@ -0,0 +1,15 @@
+{{- if .Values.clusterConfig.cilium.enabled }}
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-intra
+  namespace: clickhouse
+spec:
+  description: Allow all intra-namespace traffic (operator, ClickHouse servers, Keeper)
+  endpointSelector:
+    matchLabels: {}
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: clickhouse
+{{- end }}
@@ -0,0 +1,21 @@
+{{- if .Values.clusterConfig.cilium.enabled }}
+apiVersion: cilium.io/v2
+kind: CiliumNetworkPolicy
+metadata:
+  name: allow-otel-write
+  namespace: clickhouse
+spec:
+  description: Allow the opentelemetry collector to write to ClickHouse
+  endpointSelector:
+    matchLabels: {}
+  ingress:
+    - fromEndpoints:
+        - matchLabels:
+            io.kubernetes.pod.namespace: otel
+      toPorts:
+        - ports:
+            - port: "9000"
+              protocol: TCP
+            - port: "8123"
+              protocol: TCP
+{{- end }}
@@ -0,0 +1,83 @@
+imageTag: "24.8"
+
+clickhouse:
+  enabled: true
+  meta:
+    name: {{ .Values.clickhouse.clusterName }}
+  spec:
+    shards: 1
+    replicas: 1
+    podTemplate:
+      nodeHostnameKey: kubernetes.io/hostname
+    settings:
+      defaultUserPassword:
+        secret:
+          name: {{ .Values.clickhouse.credentialsSecret }}
+          key: {{ .Values.clickhouse.credentialsKey }}
+      # Single replica: no cross-replica database sync needed. The operator's sync also
+      # breaks on the OTel-created (non-replicated) `otel` database. Revisit for multi-replica HA.
+      enableDatabaseSync: false
+      {{- if .Values.clickhouse.s3.enabled }}
+      extraConfig:
+        storage_configuration:
+          disks:
+            s3:
+              type: s3
+              endpoint: {{ .Values.clickhouse.s3.endpoint }}/{{ .Values.clickhouse.s3.bucket }}/data/
+              use_environment_credentials: true
+          policies:
+            tiered:
+              volumes:
+                hot:
+                  disk: default
+                cold:
+                  disk: s3
+              move_factor: {{ .Values.clickhouse.s3.moveFactor }}
+        merge_tree:
+          storage_policy: tiered
+      {{- end }}
+    containerTemplate:
+      resources:
+        requests:
+          cpu: {{ .Values.clickhouse.resources.cpuRequest }}
+          memory: {{ .Values.clickhouse.resources.memoryRequest }}
+        limits:
+          memory: {{ .Values.clickhouse.resources.memoryLimit }}
+      {{- if .Values.clickhouse.s3.enabled }}
+      env:
+      - name: AWS_ACCESS_KEY_ID
+        valueFrom:
+          secretKeyRef:
+            name: {{ .Values.clickhouse.s3.secret }}
+            key: AWS_ACCESS_KEY_ID
+      - name: AWS_SECRET_ACCESS_KEY
+        valueFrom:
+          secretKeyRef:
+            name: {{ .Values.clickhouse.s3.secret }}
+            key: AWS_SECRET_ACCESS_KEY
+      {{- end }}
+    dataVolumeClaimSpec:
+      accessModes:
+        - ReadWriteOnce
+      storageClassName: {{ .Values.clickhouse.storageClass }}
+      resources:
+        requests:
+          storage: {{ .Values.clickhouse.storage }}
+
+keeper:
+  enabled: true
+  meta:
+    name: {{ .Values.clickhouse.keeperName }}
+  spec:
+    replicas: {{ .Values.clickhouse.keeperReplicas }}
+    podTemplate:
+      nodeHostnameKey: kubernetes.io/hostname
+    podDisruptionBudget:
+      maxUnavailable: 1
+    dataVolumeClaimSpec:
+      accessModes:
+        - ReadWriteOnce
+      storageClassName: {{ .Values.clickhouse.storageClass }}
+      resources:
+        requests:
+          storage: {{ .Values.clickhouse.keeperStorage }}
@@ -0,0 +1 @@
+# clickhouse-operator-helm values (chart defaults)
@@ -38,4 +38,4 @@ volumeMounts:
    readOnly: true
    subPath: appsettings.json
 image:
-  tag: 32f66b86-debug
+  tag: 9138d67d-debug
@@ -1,8 +1,8 @@
-{{ if .Values.clusterConfig.argo.enabled }}
+{{- if .Values.clusterConfig.argo.enabled }}
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: docs
+  name: {{ .Values.docs.env }}-docs
  namespace: argocd
  annotations:
    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
@@ -11,7 +11,11 @@ metadata:
  - resources-finalizer.argocd.argoproj.io
 spec:
  destination:
+    {{- if eq .Values.docs.env "prod" }}
    namespace: docs
+    {{- else }}
+    namespace: {{ .Values.docs.env }}-docs
+    {{- end }}
    server: https://kubernetes.default.svc
  project: default
  sources:
@@ -24,7 +28,7 @@ spec:
      - name: CLUSTER_NAME
        value: {{ .Values.clusterConfig.cluster }}
      - name: HELMFILE_ENVIRONMENT
-        value: default
+        value: {{ .Values.docs.env }}
      - name: HELMFILE_FILE_PATH
        value: docs.yaml.gotmpl
  syncPolicy:
@@ -0,0 +1,20 @@
+fullnameOverride: staging-docs
+image:
+  tag: "511c128c-debug"
+ingress:
+  enabled: true
+  className: "haproxy"
+  annotations:
+    cert-manager.io/cluster-issuer: letsencrypt-production
+    haproxy.org/backend-protocol: h1
+    haproxy.org/cors-enable: "true"
+    oceanbox.io/expose: internal
+  hosts:
+    - host: docs.oceanbox.io
+      paths:
+        - path: /
+          pathType: ImplementationSpecific
+  tls:
+    - hosts:
+        - docs.oceanbox.io
+      secretName: default-docs-tls
@@ -1,25 +1,6 @@
 replicaCount: 1
-image:
-  tag: "1c160398-debug"
 env:
  - name: APP_VERSION
    value: "0.0.0"
  - name: LOG_LEVEL
    value: "1"
-ingress:
-  enabled: true
-  className: "haproxy"
-  annotations:
-    cert-manager.io/cluster-issuer: letsencrypt-production
-    haproxy.org/backend-protocol: h1
-    haproxy.org/cors-enable: "true"
-    oceanbox.io/expose: internal
-  hosts:
-    - host: docs.oceanbox.io
-      paths:
-        - path: /
-          pathType: ImplementationSpecific
-  tls:
-    - hosts:
-        - docs.oceanbox.io
-      secretName: docs-tls
@@ -1,5 +1,5 @@
 clusterConfig:
-  manifests: https://gitlab.com/oceanbox/manifests.git
+  manifests: https://git.oceanbox.io/platform/manifests.git
  env: "" #[dev, test, staging, prod]
  initca: ""
  domain: ".local"
@@ -1,4 +0,0 @@
-fapr:
-  enabled: true
-  autosync: {{ if or (eq .Environment.Name "prod") (eq .Environment.Name "beta") }}false{{ else }}true{{ end }}
-  env: {{ .Environment.Name }}
@@ -1,20 +0,0 @@
-{
-  "appName": "fapr",
-  "appEnv": "prod",
-  "logLevel": "Information",
-  "aromeOutputDir": "/data/hdd/data/AROME",
-  "aromeStartDate": "2026-04-24",
-  "nveOutputDir": "/data/hdd/data/river-data/Data",
-  "nveNdays": 5000,
-  "nveApiUrl": "https://chartserver.nve.no/ShowData.aspx?req=getchart&ver=1.0",
-  "riverrunBinary": "/app/riverrun",
-  "norshelfOutputDir": "/data/hdd/data/norshelf/sea_norshelf_files",
-  "norshelfStartDate": "2026-03-01",
-  "nemoOutputDir": "/data/hdd/data/NEMO",
-  "copernicusmarineBinary": "/usr/local/bin/copernicusmarine",
-  "copernicusUsername": "",
-  "copernicusPassword": "",
-  "murOutputDir": "/data/hdd/data/river-data/MUR/MUR_SST_nc",
-  "netrcPath": "/root/.netrc",
-  "norkystOutputDir": "/data/hdd/data/norkyst"
-}
@@ -1,77 +0,0 @@
-apiVersion: dapr.io/v1alpha1
-kind: Component
-metadata:
-  name: cron-arome
-spec:
-  type: bindings.cron
-  version: v1
-  metadata:
-    - name: schedule
-      value: "0 6 * * *"
-scopes:
-  - prod-fapr
---
-apiVersion: dapr.io/v1alpha1
-kind: Component
-metadata:
-  name: cron-nve
-spec:
-  type: bindings.cron
-  version: v1
-  metadata:
-    - name: schedule
-      value: "0 8 * * *"
-scopes:
-  - prod-fapr
---
-apiVersion: dapr.io/v1alpha1
-kind: Component
-metadata:
-  name: cron-norshelf
-spec:
-  type: bindings.cron
-  version: v1
-  metadata:
-    - name: schedule
-      value: "0 13 * * *"
-scopes:
-  - prod-fapr
---
-apiVersion: dapr.io/v1alpha1
-kind: Component
-metadata:
-  name: cron-nemo
-spec:
-  type: bindings.cron
-  version: v1
-  metadata:
-    - name: schedule
-      value: "0 13 * * *"
-scopes:
-  - prod-fapr
---
-apiVersion: dapr.io/v1alpha1
-kind: Component
-metadata:
-  name: cron-mur
-spec:
-  type: bindings.cron
-  version: v1
-  metadata:
-    - name: schedule
-      value: "0 6 * * *"
-scopes:
-  - prod-fapr
---
-apiVersion: dapr.io/v1alpha1
-kind: Component
-metadata:
-  name: cron-norkyst
-spec:
-  type: bindings.cron
-  version: v1
-  metadata:
-    - name: schedule
-      value: "0 13 * * *"
-scopes:
-  - prod-fapr
@@ -1,3 +0,0 @@
- op: add
-  path: /spec/template/spec/containers/0/envFrom
-  value: []
@@ -1,21 +0,0 @@
-generatorOptions:
-  disableNameSuffixHash: true
-configMapGenerator:
-  - name: prod-fapr-appsettings
-    files:
-      - appsettings.json
-patches:
-  - target:
-      group: apps
-      version: v1
-      kind: Deployment
-    path: deployment_patch.yaml
-resources:
-  - ../base
-  - pv.yaml
-  - pvc.yaml
-  - secrets.yaml
-  - secretstore.yaml
-  - statestore.yaml
-  - tracing.yaml
-  - cron-bindings.yaml
@@ -1,13 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: prod-fapr-ceph-data
-spec:
-  accessModes:
-    - ReadWriteMany
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: ""
-  volumeMode: Filesystem
-  volumeName: pv-prod-fapr-ceph-data
@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: prod-fapr-redis
-type: Opaque
-data:
@@ -1,12 +0,0 @@
-apiVersion: dapr.io/v1alpha1
-kind: Component
-metadata:
-  name: secretstore
-spec:
-  type: secretstores.kubernetes
-  version: v1
-  metadata:
-    - name: defaultNamespace
-      value: prod-fapr
-scopes:
-  - prod-fapr
@@ -1,22 +0,0 @@
-apiVersion: dapr.io/v1alpha1
-kind: Component
-metadata:
-  name: statestore
-spec:
-  type: state.redis
-  version: v1
-  metadata:
-    - name: redisHost
-      value: prod-fapr-redis:6379
-    - name: redisUsername
-      value: default
-    - name: redisPassword
-      secretKeyRef:
-        name: prod-fapr-redis
-        key: redis-password
-    - name: actorStateStore
-      value: "true"
-    - name: redisDB
-      value: "0"
-scopes:
-  - prod-fapr
@@ -1,11 +0,0 @@
-apiVersion: dapr.io/v1alpha1
-kind: Configuration
-metadata:
-  name: tracing
-spec:
-  tracing:
-    samplingRate: "1"
-    otel:
-      endpointAddress: "10.255.241.12:4317"
-      protocol: grpc
-      isSecure: false
@@ -1,55 +0,0 @@
-replicaCount: 1
-
-podAnnotations:
-  dapr.io/enabled: "true"
-  dapr.io/app-id: "prod-fapr"
-  dapr.io/app-port: "8080"
-  dapr.io/api-token-secret: "dapr-api-token"
-  dapr.io/config: "tracing"
-  dapr.io/app-protocol: "http"
-  dapr.io/log-as-json: "true"
-  dapr.io/sidecar-cpu-request: "10m"
-  dapr.io/sidecar-memory-request: "50Mi"
-
-env:
-  - name: APP_NAME
-    valueFrom:
-      fieldRef:
-        fieldPath: metadata.name
-  - name: APP_NAMESPACE
-    valueFrom:
-      fieldRef:
-        fieldPath: metadata.namespace
-  - name: DAPR_API_TOKEN
-    valueFrom:
-      secretKeyRef:
-        name: dapr-api-token
-        key: token
-
-persistence:
-  enabled: true
-  existingClaim: prod-fapr-ceph-data
-
-redis:
-  enabled: true
-  replicas: 1
-  backup:
-    enabled: true
-  size: 2Gi
-  storageClass: "ceph-rbd"
-  secret:
-    name: "prod-fapr-redis"
-    key: "redis-password"
-  resources:
-    cpu: 100m
-    memory: 128Mi
-
-affinity:
-  nodeAffinity:
-    requiredDuringSchedulingIgnoredDuringExecution:
-      nodeSelectorTerms:
-        - matchExpressions:
-            - key: "topology.kubernetes.io/group"
-              operator: In
-              values:
-                - srv
@@ -1 +0,0 @@
-# Base values for fapr - overridden per environment
@@ -8,18 +8,13 @@ spec:
  resources:
    requests:
      cpu: 150m
-      memory: 256Mi
+      memory: 1Gi
    limits:
-      memory: 256Mi
+      memory: 1Gi
  args:
-    - --dbfilename=dump           # Static filename prevents disk exhaustion
-    - --maxmemory=$(MAX_MEMORY)Mi # Graceful memory management (90% of limit)
+    - --dbfilename=dump               # Static filename prevents disk exhaustion
+    - --maxmemory=920Mi # ~90% of the 1Gi limit, leaving headroom
+    - --cache_mode=true # evict near maxmemory instead of rejecting writes (graceful degradation)
    - --proactor_threads=1 # Auto-detect CPU cores (optimal threading)
    - --cluster_mode=emulated
    - --logtostderr
-  env:
-    - name: MAX_MEMORY
-      valueFrom:
-        resourceFieldRef:
-          resource: limits.memory
-          divisor: 1Mi
@@ -3,11 +3,11 @@ replicaCount: 1
 image:
  registry: "docker.gitea.com"
  repository: gitea
-  tag: "1.26.2"
+  tag: "1.26.4"

 resources:
  requests:
-    cpu: 200m
+    cpu: 500m
    memory: 512Mi

 strategy:
@@ -75,13 +75,16 @@ gitea:
      USERNAME: "nickname"
    mailer:
      ENABLED: true
-      FROM: "gitea@oceanbox.io"
-      PROTOCOL: "smtp"
-      SMTP_ADDR: "postfix-mail.postfix.svc.cluster.local"
+      FROM: "\"Oceanbox Gitea\" <no-reply@oceanbox.io>"
+      PROTOCOL: "smtp+starttls"
+      SMTP_ADDR: "mx.itpartner.no"
      SMTP_PORT: 587
+      USER: "no-reply@oceanbox.io"
    database:
      DB_TYPE: postgres
      MAX_OPEN_CONNS: 90
+      MAX_IDLE_CONNS: 20
+      CONN_MAX_LIFETIME: 3h
    openid:
      ENABLE_OPENID_SIGNIN: false
      ENABLE_OPENID_SIGNUP: false
@@ -102,6 +105,11 @@ gitea:
        secretKeyRef:
          name: gitea-s3
          key: secret_key
+    - name: GITEA__mailer__PASSWD
+      valueFrom:
+        secretKeyRef:
+          name: gitea-smtp
+          key: password
    - name: GITEA__DATABASE__PASSWD
      valueFrom:
        secretKeyRef:
@@ -140,7 +148,7 @@ ingress:
    cert-manager.io/cluster-issuer: letsencrypt-production
    haproxy.org/backend-protocol: h1
    haproxy.org/timeout-server: 600s
-    haproxy.org/allow-list: 10.0.0.0/8,172.16.0.0/12,192.168.0.0/16,172.19.255.0/24,100.64.0.0/12,185.125.160.4/32,37.27.203.38/32
+    oceanbox.io/expose: internal
  hosts:
    - host: git.oceanbox.io
      paths:
@@ -118,6 +118,7 @@ configMaps:
              "elianne.ersdal@oceanbox.io",
              "hanskristian.djuve@oceanbox.io",
              "erlend.mundal@oceanbox.io",
+              "hanna.fagrell@oceanbox.io",
            ],
            "group:manager": [
              "svenn.hanssen@oceanbox.io",
@@ -129,6 +130,7 @@ configMaps:
            "group:dev": [],
            "group:intern": [
              "haavahak@stud.ntnu.no",
+              "haavahak@ntnu.no",
            ],
            "group:ceph": [
              "jonas.juselius@oceanbox.io",
@@ -270,6 +272,7 @@ configMaps:
            { "action": "accept", "src": [ "elianne.ersdal@oceanbox.io" ], "dst": [  "elianne.ersdal@oceanbox.io:*" ] },
            { "action": "accept", "src": [ "hanskristian.djuve@oceanbox.io" ], "dst": [ "hanskristian.djuve@oceanbox.io:*" ] },
            { "action": "accept", "src": [ "erlend.mundal@oceanbox.io" ], "dst": [ "erlend.mundal@oceanbox.io:*" ] },
+            { "action": "accept", "src": [ "hanna.fagrell@oceanbox.io" ], "dst": [ "hanna.fagrell@oceanbox.io:*" ] },
            // s/"\([^"]*\)"/{ "action": "accept", "src": [ "\1" ], "dst": [ "\1:*" ] },
          ]
        }
@@ -293,6 +296,7 @@ configMaps:
           { "name": "argocd.adm.oceanbox.io", "type": "A", "value": "10.255.241.11" },
           { "name": "hubble.adm.oceanbox.io", "type": "A", "value": "10.255.241.11" },
           { "name": "dapr.adm.oceanbox.io", "type": "A", "value": "10.255.241.11" },
+           { "name": "temporal.adm.oceanbox.io", "type": "A", "value": "10.255.241.11" },

           { "name": "umami.srv.oceanbox.io", "type": "A", "value": "10.255.241.11" },
           { "name": "rabbitmq.srv.oceanbox.io", "type": "A", "value": "10.255.241.11" },
@@ -302,13 +306,13 @@ configMaps:
           { "name": "cache.srv.oceanbox.io", "type": "A", "value": "10.255.241.11" },
           { "name": "makai.srv.oceanbox.io", "type": "A", "value": "10.255.241.11" },
           { "name": "makai.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
-           { "name": "docs.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },

           { "name": "slurm.adm.oceanbox.io", "type": "A", "value": "10.255.241.11" },
           { "name": "slurm-gateway.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
           { "name": "yolo-registry.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },

           { "name": "argocd.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
+           { "name": "cache.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
           { "name": "prometheus.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
           { "name": "alertmanager.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
           { "name": "grafana.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
@@ -316,11 +320,14 @@ configMaps:
           { "name": "sorcrerer.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
           { "name": "plume.data.oceanbox.io", "type": "A", "value": "10.255.241.99" },
           { "name": "slurm-agent.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
+           { "name": "temporal.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
+           { "name": "temporal-grpc.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },

           { "name": "git.obx", "type": "A", "value": "10.0.1.9" },
           { "name": "git.oceanbox.io", "type": "A", "value": "10.0.1.3" },
           { "name": "makai.oceanbox.io", "type": "A", "value": "10.0.1.3" },
           { "name": "docs.oceanbox.io", "type": "A", "value": "10.0.1.3" },
+           { "name": "docs.dev.oceanbox.io", "type": "A", "value": "10.0.1.3" },

           { "name": "kueue.dev.tos.obx", "type": "A", "value": "10.255.241.99" },
           { "name": "slurm-agent.rossby.oceanbox.io", "type": "A", "value": "172.16.239.222" },
@@ -357,25 +364,21 @@ configMaps:

           { "name": "jonas-atlantis.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
           { "name": "jonas-sorcerer.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
-           { "name": "jonas-plume.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
           { "name": "stig-atlantis.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
           { "name": "stig-sorcerer.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
-           { "name": "stig-sorcerer.dev.vtn.obx", "type": "A", "value": "172.16.239.221" },
-           { "name": "stig-plume.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
           { "name": "radovan-atlantis.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
           { "name": "radovan-sorcerer.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
           { "name": "mrtz-atlantis.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
+           { "name": "mrtz-maps.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
           { "name": "mrtz-sorcerer.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
-           { "name": "mrtz-sorcerer.dev.vtn.obx", "type": "A", "value": "172.16.239.221" },
-           { "name": "mrtz-plume.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
+           { "name": "mrtz-codex.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
           { "name": "mrtz-diadash.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
           { "name": "simkir-atlantis.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
           { "name": "simkir-maps.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
           { "name": "simkir-codex.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
           { "name": "simkir-sorcerer.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
-           { "name": "simkir-sorcerer.dev.vtn.obx", "type": "A", "value": "172.16.239.221" },
-           { "name": "simkir-plume.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
           { "name": "ole-atlantis.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
+           { "name": "ole-maps.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" },
           { "name": "ole-sorcerer.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" },
-           { "name": "ole-plume.ekman.oceanbox.io", "type": "A", "value": "10.255.241.99" }
+           { "name": "ole-codex.dev.oceanbox.io", "type": "A", "value": "10.255.241.11" }
        ]
@@ -0,0 +1,2 @@
+ingest:
+  enabled: true
@@ -0,0 +1,3 @@
+ingest:
+  enabled: false
+  autosync: false
@@ -0,0 +1,7 @@
+apiVersion: temporal.io/v1alpha1
+kind: Connection
+metadata:
+  name: temporal
+  namespace: ingest
+spec:
+  hostPort: temporal-frontend.temporal:7233
@@ -0,0 +1,40 @@
+{{- if .Values.clusterConfig.argo.enabled }}
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: ingest
+  namespace: argocd
+  annotations:
+    argocd.argoproj.io/sync-options: SkipDryRunOnMissingResource=true
+  finalizers:
+  - resources-finalizer.argocd.argoproj.io
+spec:
+  destination:
+    namespace: ingest
+    server: 'https://kubernetes.default.svc'
+  sources:
+  - repoURL: {{ .Values.clusterConfig.manifests }}
+    targetRevision: HEAD
+    path: helmfile.d
+    plugin:
+      name: helmfile-cmp
+      env:
+      - name: CLUSTER_NAME
+        value: {{ .Values.clusterConfig.cluster }}
+      - name: HELMFILE_ENVIRONMENT
+        value: default
+      - name: HELMFILE_FILE_PATH
+        value: ingest.yaml.gotmpl
+  project: sys
+  syncPolicy:
+    managedNamespaceMetadata:
+      labels:
+        component: sys
+    syncOptions:
+      - CreateNamespace=true
+      - ApplyOutOfSyncOnly=true
+    {{- if .Values.ingest.autosync }}
+    automated:
+      prune: true
+    {{- end }}
+{{- end }}
@@ -0,0 +1,42 @@
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: pv-ingest-data
+spec:
+  accessModes:
+  - ReadWriteMany
+  capacity:
+    storage: 1Gi
+  claimRef:
+    apiVersion: v1
+    kind: PersistentVolumeClaim
+    name: ekman-data
+    namespace: ingest
+  csi:
+    driver: rook-ceph.cephfs.csi.ceph.com
+    nodeStageSecretRef:
+      name: rook-csi-cephfs-node
+      namespace: rook-ceph
+    volumeAttributes:
+      clusterID: rook-ceph
+      fsName: data
+      rootPath: /
+      staticVolume: "true"
+    volumeHandle: pv-ingest-data
+  persistentVolumeReclaimPolicy: Retain
+  volumeMode: Filesystem
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: ekman-data
+  namespace: ingest
+spec:
+  accessModes:
+  - ReadWriteMany
+  resources:
+    requests:
+      storage: 1Gi
+  storageClassName: ""
+  volumeMode: Filesystem
+  volumeName: pv-ingest-data
@@ -0,0 +1,57 @@
+apiVersion: temporal.io/v1alpha1
+kind: WorkerDeployment
+metadata:
+  name: ingest-py
+  namespace: ingest
+spec:
+  replicas: 1
+  workerOptions:
+    temporalNamespace: prod-ingest
+    connectionRef:
+      name: temporal
+  rollout:
+    strategy: AllAtOnce
+  sunset: {}
+  template:
+    spec:
+      securityContext:
+        runAsUser: 0
+        runAsGroup: 0
+      containers:
+        - name: ingest-py
+          image: git.oceanbox.io/oceanbox/churn/ingest-py:v0.1.6
+          resources:
+            requests:
+              memory: 512Mi
+            limits:
+              memory: 15Gi
+          env:
+            - name: DATA_ROOT
+              value: /data/hdd/data
+            # NOTE: NASA Earthdata auth for mur (requests reads $NETRC).
+            - name: NETRC
+              value: /secrets/.netrc
+            - name: COPERNICUSMARINE_SERVICE_USERNAME
+              valueFrom:
+                secretKeyRef:
+                  name: nemo-credentials
+                  key: username
+            - name: COPERNICUSMARINE_SERVICE_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: nemo-credentials
+                  key: password
+          volumeMounts:
+            - name: data
+              mountPath: /data
+            - name: netrc
+              mountPath: /secrets/.netrc
+              subPath: .netrc
+              readOnly: true
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: ekman-data
+        - name: netrc
+          secret:
+            secretName: mur-netrc
@@ -0,0 +1,37 @@
+apiVersion: temporal.io/v1alpha1
+kind: WorkerDeployment
+metadata:
+  name: ingest
+  namespace: ingest
+spec:
+  replicas: 1
+  workerOptions:
+    temporalNamespace: prod-ingest
+    connectionRef:
+      name: temporal
+  rollout:
+    strategy: AllAtOnce
+  sunset: {}
+  template:
+    spec:
+      securityContext:
+        runAsUser: 0
+        runAsGroup: 0
+      containers:
+        - name: ingest
+          image: git.oceanbox.io/oceanbox/churn/ingest:v0.1.6
+          resources:
+            requests:
+              memory: 512Mi
+            limits:
+              memory: 15Gi
+          env:
+            - name: DATA_ROOT
+              value: /data/hdd/data
+          volumeMounts:
+            - name: data
+              mountPath: /data
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: ekman-data
@@ -19,6 +19,10 @@ controller:
    ssl-redirect: "true"
    forwarded-for: "true"

+    # NOTE: Emit HAProxy access logs (real client IP + request line)
+    # to the controller's stdout so `kubectl logs` can see them.
+    syslog-server: "address:stdout, format: raw, facility: daemon"
+
    # Disable QUIC ar Hetzner LB doesn't support UDP
    quic-enabled: "false"

@@ -1,4 +1,4 @@
 loki:
-  enabled: true
+  enabled: false
  autosync: false

@@ -1,5 +1,5 @@
 loki:
-  enabled: true
+  enabled: false
  autosync: true
  compactor: true
  s3:
@@ -1,6 +1,6 @@
 replicaCount: 1
 image:
-  tag: "fd47bfc5-debug"
+  tag: "e926ae4b-debug"
 env:
  - name: APP_VERSION
    value: "0.0.0"
@@ -1,2 +1,2 @@
-fapr:
+niks3:
  enabled: true
@@ -1,3 +1,3 @@
-attic:
+niks3:
  enabled: false
  autosync: false
--- a/Show More
+++ b/Show More
				`@@ -0,0 +1 @@`
				`# clickhouse-operator-helm values (chart defaults)`
				`@@ -1 +0,0 @@`
				`# Base values for fapr - overridden per environment`