fix(postfix): use hash: transport_maps with postmap init container

- Splits hash-type map files into a separate postfix-maps ConfigMap - Adds postmap init container that builds .db files from all maps into a postfix-db emptyDir, which is then subPath-mounted per map in the main container - Updates transport_maps in main.cf to hash:/etc/postfix/transport
fix(postfix): use .unkin.net subdomain pattern in transport map
2026-05-24 20:38:27 +10:00 · 2026-05-24 20:35:19 +10:00 · 2026-05-24 19:54:08 +10:00 · 2026-05-24 19:52:16 +10:00 · 2026-05-24 12:46:28 +10:00 · 2026-05-23 23:47:24 +10:00
160 changed files with 4524 additions and 591 deletions
@@ -6,3 +6,13 @@ steps:
    image: git.unkin.net/unkin/almalinux9-kubetest:20260319
    commands:
      - make kubeconform
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 512Mi
+            cpu: 1
+          limits:
+            memory: 2Gi
+            cpu: 2
@@ -6,3 +6,13 @@ steps:
    image: git.unkin.net/unkin/almalinux9-base:20260308
    commands:
      - uvx pre-commit run --all-files
+    backend_options:
+      kubernetes:
+        serviceAccountName: default
+        resources:
+          requests:
+            memory: 256Mi
+            cpu: 250m
+          limits:
+            memory: 1Gi
+            cpu: 1
@@ -19,8 +19,8 @@ spec:
      automountServiceAccountToken: true
      containers:
        - name: artifactapi
-          image: git.unkin.net/unkin/almalinux9-artifactapi:latest
-          imagePullPolicy: Always
+          image: git.unkin.net/unkin/artifactapi:v2.7.2
+          imagePullPolicy: IfNotPresent
          ports:
            - containerPort: 8000
              name: http
@@ -60,10 +60,30 @@ spec:
              cpu: 100m
              memory: 256Mi
          volumeMounts:
-            - mountPath: /app/remotes.yaml
-              mountPropagation: None
+            - mountPath: /etc/artifactapi/conf.d/config.yaml
              name: remotes-config
-              subPath: remotes.yaml
+              subPath: config.yaml
+            - mountPath: /etc/artifactapi/conf.d/local-generic.yaml
+              name: remotes-config
+              subPath: local-generic.yaml
+            - mountPath: /etc/artifactapi/conf.d/remote-alpine.yaml
+              name: remotes-config
+              subPath: remote-alpine.yaml
+            - mountPath: /etc/artifactapi/conf.d/remote-docker.yaml
+              name: remotes-config
+              subPath: remote-docker.yaml
+            - mountPath: /etc/artifactapi/conf.d/remote-generic.yaml
+              name: remotes-config
+              subPath: remote-generic.yaml
+            - mountPath: /etc/artifactapi/conf.d/remote-helm.yaml
+              name: remotes-config
+              subPath: remote-helm.yaml
+            - mountPath: /etc/artifactapi/conf.d/remote-rpm.yaml
+              name: remotes-config
+              subPath: remote-rpm.yaml
+            - mountPath: /etc/artifactapi/conf.d/virtual-helm.yaml
+              name: remotes-config
+              subPath: virtual-helm.yaml
      restartPolicy: Always
      volumes:
        - configMap:
@@ -5,7 +5,7 @@ metadata:
  name: artifactapi-env
  namespace: artifactapi
 data:
-  CONFIG_PATH: /app/remotes.yaml
+  CONFIG_PATH: /etc/artifactapi/conf.d/
  DBHOST: postgres-service
  DBNAME: artifacts
  DBPORT: "5432"
@@ -0,0 +1,37 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: artifactapi.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: artifactapi.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  name: artifactapi
+  namespace: artifactapi
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: artifactapi.k8s.syd1.au.unkin.net
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: artifactapi.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: artifactapi-tls
+        mode: Terminate
@@ -0,0 +1,42 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: artifactapi-http-redirect
+  namespace: artifactapi
+spec:
+  hostnames:
+    - artifactapi.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: artifactapi
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: artifactapi
+  namespace: artifactapi
+spec:
+  hostnames:
+    - artifactapi.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: artifactapi
+      sectionName: https
+  rules:
+    - backendRefs:
+        - name: artifactapi-api
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -1,32 +0,0 @@
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: artifactapi.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: artifactapi.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.0
-    nginx.ingress.kubernetes.io/proxy-body-size: 10g
-    nginx.ingress.kubernetes.io/proxy-read-timeout: "600"
-    nginx.ingress.kubernetes.io/ssl-redirect: "false"
-  name: artifactapi-ingress
-  namespace: artifactapi
-spec:
-  ingressClassName: nginx
-  rules:
-    - host: artifactapi.k8s.syd1.au.unkin.net
-      http:
-        paths:
-          - backend:
-              service:
-                name: artifactapi-api
-                port:
-                  number: 80
-            path: /
-            pathType: Prefix
-  tls:
-    - hosts:
-        - artifactapi.k8s.syd1.au.unkin.net
-      secretName: artifactapi-tls
@@ -6,7 +6,8 @@ resources:
  - artifactapi-deployment.yaml
  - artifactapi-hpa.yaml
  - configmap.yaml
-  - ingress.yaml
+  - gateway.yaml
+  - httproute.yaml
  - namespace.yaml
  - postgres-deployment.yaml
  - pvc.yaml
@@ -18,6 +19,13 @@ resources:
 configMapGenerator:
  - name: remotes-config
    files:
-      - resources/remotes.yaml
+      - resources/conf.d/config.yaml
+      - resources/conf.d/local-generic.yaml
+      - resources/conf.d/remote-generic.yaml
+      - resources/conf.d/remote-alpine.yaml
+      - resources/conf.d/remote-rpm.yaml
+      - resources/conf.d/remote-docker.yaml
+      - resources/conf.d/remote-helm.yaml
+      - resources/conf.d/virtual-helm.yaml
    options:
      disableNameSuffixHash: true
@@ -0,0 +1,3 @@
+# Global artifactapi configuration.
+# S3, Redis, and database connection settings are injected via environment variables.
+# Add any top-level overrides here if needed.
@@ -0,0 +1,7 @@
+locals:
+  local-generic:
+    package: "generic"
+    description: "Local generic file repository"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 0
@@ -0,0 +1,10 @@
+remotes:
+  alpine:
+    base_url: "https://dl-cdn.alpinelinux.org"
+    package: "alpine"
+    description: "Alpine Linux APK package repository"
+    immutable_patterns:
+      - ".*/x86_64/.*\\.apk$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
@@ -0,0 +1,98 @@
+remotes:
+  ghcr:
+    base_url: "https://ghcr.io"
+    package: "docker"
+    description: "GitHub Container Registry"
+    immutable_patterns:
+      - "^cloudnative-pg/cloudnative-pg"
+      - "^emberstack/helm-charts"
+      - "^kanidm/"
+      - "^openvoxproject/"
+      - "^stakater/reloader"
+      - "^voxpupuli/puppetboard"
+      - "^woodpecker-ci/helm"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 300
+
+  dockerhub:
+    base_url: "https://registry-1.docker.io"
+    package: "docker"
+    description: "Docker Hub registry"
+    immutable_patterns:
+      - "^library/almalinux"
+      - "^library/busybox"
+      - "^library/debian"
+      - "^library/fedora"
+      - "^library/nginx"
+      - "^library/postgres"
+      - "^library/redis"
+      - "^beats/filebeat"
+      - "^bitnami/"
+      - "^curlimages/curl"
+      - "^emberstack/kubernetes-reflector"
+      - "^hashicorp/consul"
+      - "^hashicorp/vault"
+      - "^jfrog/"
+      - "^rancher/"
+      - "^traefik/"
+      - "^ubi9/ubi-minimal"
+      - "^victoriametrics/"
+      - "^woodpeckerci/"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 300
+
+  quay:
+    base_url: "https://quay.io"
+    package: "docker"
+    description: "Quay.io container registry"
+    immutable_patterns:
+      - "^brancz/kube-rbac-proxy"
+      - "^cephcsi/cephcsi"
+      - "^jetstack/cert-manager-"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 300
+
+  k8s-registry:
+    base_url: "https://registry.k8s.io"
+    package: "docker"
+    description: "Kubernetes container registry"
+    immutable_patterns:
+      - "^external-dns/external-dns"
+      - "^sig-storage/"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 300
+
+  gitlab:
+    base_url: "https://registry.gitlab.com"
+    package: "docker"
+    description: "GitLab container registry"
+    immutable_patterns:
+      - "^purelb/purelb"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 300
+
+  elastic:
+    base_url: "https://docker.elastic.co"
+    package: "docker"
+    description: "Elastic container registry"
+    immutable_patterns:
+      - "^eck/eck-operator"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 300
+
+  gcr:
+    base_url: "https://gcr.io"
+    package: "docker"
+    description: "Google Container Registry"
+    immutable_patterns:
+      - "^k8s-staging-nfd/charts"
+      - "^k8s-staging-nfd/node-feature-discovery"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 300
@@ -0,0 +1,130 @@
+remotes:
+  github:
+    base_url: "https://github.com"
+    package: "generic"
+    description: "GitHub releases and files"
+    mutable_patterns:
+      - ".*/archive/refs/heads/.*.tar.gz$"
+    immutable_patterns:
+      - ".*/archive/refs/tags/.*.tar.gz$"
+      - "ahmetb/kubectx/.*/kubectx_.*_linux_x86_64.tar.gz$"
+      - "ahmetb/kubectx/.*/kubens_.*_linux_x86_64.tar.gz$"
+      - "apple/foundationdb/.*/libfdb_c.x86_64.so$"
+      - "astral-sh/ruff/.*/ruff-x86_64-unknown-linux-gnu.tar.gz$"
+      - "astral-sh/uv/.*/uv-x86_64-unknown-linux-gnu.tar.gz$"
+      - "camptocamp/prometheus-puppetdb-exporter/.*/prometheus-puppetdb-exporter-.*.linux-amd64.tar.gz$"
+      - "coder/code-server/.*/code-server-.*-amd64.rpm$"
+      - "containernetworking/plugins/.*/cni-plugins-linux-amd64-.*.tgz"
+      - "dandavison/delta/.*/delta-.*-x86_64-unknown-linux-musl.tar.gz$"
+      - "ducaale/xh/.*/xh-.*-x86_64-unknown-linux-musl.tar.gz$"
+      - "etcd-io/etcd/.*/etcd-.*-linux-amd64.tar.gz$"
+      - "getsops/sops/.*/sops-v.*\\.linux\\.amd64$"
+      - "grafana/jsonnet-language-server/.*/jsonnet-language-server_.*_linux_amd64$"
+      - "gruntwork-io/boilerplate/.*/boilerplate_linux_amd64$"
+      - "gruntwork-io/terragrunt/.*terragrunt_linux_amd64.*"
+      - "hadolint/hadolint/.*/hadolint-linux-x86_64$"
+      - "helmfile/helmfile/.*/helmfile_.*_linux_amd64.tar.gz$"
+      - "helmfile/vals/.*/vals_.*_linux_amd64.tar.gz$"
+      - "jesseduffield/lazydocker/.*/lazydocker_.*_Linux_x86_64.tar.gz$"
+      - "kubecolor/kubecolor/.*/kubecolor_.*_linux_amd64.tar.gz$"
+      - "kubernetes-sigs/gateway-api/.*/standard-install.yaml$"
+      - "kubernetes-sigs/kustomize/.*/kustomize_.*_linux_amd64.tar.gz$"
+      - "lxc/incus/.*.tar.gz$"
+      - "mikefarah/yq/.*/yq_linux_amd64$"
+      - "neovim/neovim-releases/.*/nvim-linux-x86_64.tar.gz$"
+      - "neovim/neovim/.*/nvim-linux-x86_64.tar.gz$"
+      - "nzbgetcom/nzbget/.*/nzbget-.*.x86_64.rpm$"
+      - "onedr0p/exportarr/.*/exportarr_.*_linux_amd64.tar.gz$"
+      - "openbao/openbao-plugins/.*/openbao-plugin-secrets-consul_linux_amd64_.*.tar.gz$"
+      - "openbao/openbao-plugins/.*/openbao-plugin-secrets-nomad_linux_amd64_.*.tar.gz$"
+      - "prometheus-community/bind_exporter/.*/bind_exporter-.*.linux-amd64.tar.gz$"
+      - "prometheus-community/pgbouncer_exporter/.*/pgbouncer_exporter-.*.linux-amd64.tar.gz$"
+      - "prometheus-community/postgres_exporter/.*/postgres_exporter-.*.linux-amd64.tar.gz$"
+      - "prometheus/node_exporter/.*/node_exporter-.*.linux-amd64.tar.gz$"
+      - "rancher/rke2/.*/rke2-images.linux-amd64.tar.zst$"
+      - "stalwartlabs/stalwart/.*/stalwart-cli-x86_64-unknown-linux-gnu.tar.gz$"
+      - "stalwartlabs/stalwart/.*/stalwart-foundationdb-x86_64-unknown-linux-gnu.tar.gz$"
+      - "stalwartlabs/stalwart/.*/stalwart-x86_64-unknown-linux-gnu.tar.gz$"
+      - "starship/starship/.*/starship-x86_64-unknown-linux-musl.tar.gz$"
+      - "stern/stern/.*/stern_.*_linux_amd64.tar.gz$"
+      - "terraform-linters/tflint/.*/tflint_linux_amd64.zip$"
+      - "tynany/frr_exporter/.*/frr_exporter-.*.linux-amd64.tar.gz$"
+      - "VictoriaMetrics/VictoriaLogs/.*/victoria-logs-linux-amd64-.*.tar.gz$"
+      - "VictoriaMetrics/VictoriaLogs/.*/vlutils-linux-amd64-.*.tar.gz$"
+      - "VictoriaMetrics/VictoriaMetrics/.*/victoria-logs-linux-amd64-.*.tar.gz$"
+      - "VictoriaMetrics/VictoriaMetrics/.*/victoria-metrics-linux-amd64-.*-cluster.tar.gz$"
+      - "VictoriaMetrics/VictoriaMetrics/.*/vlutils-linux-amd64-.*.tar.gz$"
+      - "VictoriaMetrics/VictoriaMetrics/.*/vmutils-linux-amd64-.*.tar.gz$"
+      - "xorpaul/g10k/.*/g10k-.*-linux-amd64.zip$"
+      - "yannh/kubeconform/.*/kubeconform-linux-amd64.tar.gz$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
+
+  github_user:
+    base_url: "https://raw.githubusercontent.com"
+    package: "generic"
+    description: "GitHub User Content"
+    immutable_patterns:
+      - "argoproj/argo-cd/.*.yaml$"
+      - "yannh/kubernetes-json-schema/master/.*.json$"
+      - "datreeio/CRDs-catalog/main/.*.json$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
+
+  gitea-dl:
+    base_url: "https://dl.gitea.com"
+    package: "generic"
+    description: "Gitea download site"
+    immutable_patterns:
+      - "act_runner/.*/act_runner-.*-linux-amd64$"
+      - "tea/.*/tea-.*-linux-amd64$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
+
+  hashicorp-releases:
+    base_url: "https://releases.hashicorp.com"
+    package: "generic"
+    description: "HashiCorp product releases"
+    immutable_patterns:
+      - "terraform/.*terraform_.*_linux_amd64\\.zip$"
+      - "terraform/.*terraform_.*_windows_amd64\\.zip$"
+      - "terraform/.*terraform_.*_darwin_amd64\\.zip$"
+      - "vault/.*vault_.*_linux_amd64\\.zip$"
+      - "vault/.*vault_.*_windows_amd64\\.zip$"
+      - "vault/.*vault_.*_darwin_amd64\\.zip$"
+      - "consul-cni/.*/consul-cni_.*_linux_amd64\\.zip$"
+      - "consul/.*/consul_.*_linux_amd64\\.zip$"
+      - "nomad-autoscaler/.*/nomad-autoscaler_.*_linux_amd64\\.zip$"
+      - "nomad/.*/nomad_.*_linux_amd64\\.zip$"
+      - "packer/.*/packer_.*_linux_amd64\\.zip$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
+
+  rarlab:
+    base_url: "https://www.rarlab.com"
+    package: "generic"
+    description: "RARLab"
+    immutable_patterns:
+      - "rar/rarlinux-x64-.*.tar.gz"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
+
+  claude-ai:
+    base_url: "https://downloads.claude.ai"
+    package: "generic"
+    description: "Anthropic Claude Code binary releases"
+    mutable_patterns:
+      - "claude-code-releases/.*/manifest.json$"
+    immutable_patterns:
+      - "claude-code-releases/.*/linux-x64/claude$"
+      - "claude-code-releases/.*/linux-arm64/claude$"
+      - "claude-code-releases/.*/linux-x64-musl/claude$"
+      - "claude-code-releases/.*/linux-arm64-musl/claude$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
@@ -0,0 +1,143 @@
+remotes:
+  ceph-csi:
+    base_url: "https://ceph.github.io/csi-charts"
+    package: "helm"
+    description: "Ceph CSI driver Helm charts"
+    check_mutable_updates: true
+    immutable_patterns:
+      - "\\.tgz$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 3600
+
+  cnpg:
+    base_url: "https://cloudnative-pg.github.io/charts"
+    package: "helm"
+    description: "CloudNativePG operator Helm charts"
+    check_mutable_updates: true
+    immutable_patterns:
+      - "\\.tgz$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 3600
+
+  elastic-helm:
+    base_url: "https://helm.elastic.co"
+    package: "helm"
+    description: "Elastic stack Helm charts"
+    check_mutable_updates: true
+    immutable_patterns:
+      - "\\.tgz$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 3600
+
+  external-dns:
+    base_url: "https://kubernetes-sigs.github.io/external-dns/"
+    package: "helm"
+    description: "ExternalDNS Helm charts"
+    check_mutable_updates: true
+    immutable_patterns:
+      - "\\.tgz$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 3600
+
+  hashicorp-helm:
+    base_url: "https://helm.releases.hashicorp.com"
+    package: "helm"
+    description: "HashiCorp Helm charts (Vault Secrets Operator, etc.)"
+    check_mutable_updates: true
+    immutable_patterns:
+      - "\\.tgz$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 3600
+
+  intel-helm:
+    base_url: "https://intel.github.io/helm-charts/"
+    package: "helm"
+    description: "Intel Helm charts (device plugins)"
+    check_mutable_updates: true
+    immutable_patterns:
+      - "\\.tgz$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 3600
+
+  jetstack:
+    base_url: "https://charts.jetstack.io"
+    package: "helm"
+    description: "Jetstack Helm charts (cert-manager)"
+    check_mutable_updates: true
+    immutable_patterns:
+      - "\\.tgz$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 3600
+
+  purelb:
+    base_url: "https://gitlab.com/api/v4/projects/20400619/packages/helm/stable"
+    package: "helm"
+    description: "PureLB load balancer Helm charts"
+    check_mutable_updates: true
+    immutable_patterns:
+      - "\\.tgz$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 3600
+
+  rancher-stable:
+    base_url: "https://releases.rancher.com/server-charts/stable"
+    package: "helm"
+    description: "Rancher stable Helm charts"
+    check_mutable_updates: true
+    immutable_patterns:
+      - "\\.tgz$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 3600
+
+  stakater:
+    base_url: "https://stakater.github.io/stakater-charts"
+    package: "helm"
+    description: "Stakater Helm charts (Reloader)"
+    check_mutable_updates: true
+    immutable_patterns:
+      - "\\.tgz$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 3600
+
+  traefik:
+    base_url: "https://traefik.github.io/charts"
+    package: "helm"
+    description: "Traefik Helm charts"
+    check_mutable_updates: true
+    immutable_patterns:
+      - "\\.tgz$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 3600
+
+  victoriametrics:
+    base_url: "https://victoriametrics.github.io/helm-charts/"
+    package: "helm"
+    description: "VictoriaMetrics observability Helm charts"
+    check_mutable_updates: true
+    immutable_patterns:
+      - "\\.tgz$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 3600
+
+  argo-helm:
+    base_url: "https://argoproj.github.io/argo-helm"
+    package: "helm"
+    description: "Argo Project Helm charts (ArgoCD, Image Updater, Rollouts, etc.)"
+    check_mutable_updates: true
+    immutable_patterns:
+      - "\\.tgz$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 3600
@@ -0,0 +1,154 @@
+remotes:
+  almalinux:
+    base_url: "https://gsl-syd.mm.fcix.net/almalinux"
+    package: "rpm"
+    description: "AlmaLinux RPM package repository"
+    immutable_patterns:
+      - ".*/x86_64/.*\\.rpm$"
+      - ".*/noarch/.*\\.rpm$"
+      - ".*/repodata/.*\\.sqlite.*$"
+      - ".*/repodata/.*\\.xml.*$"
+      - ".*/repodata/.*\\.yaml.*$"
+      - ".*/install.img"
+      - ".*/squashfs.img"
+      - ".*/updates.img"
+      - ".*/RPM-GPG-KEY-.*$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
+
+  ceph-reef:
+    base_url: "https://download.ceph.com/rpm-reef/"
+    package: "rpm"
+    description: "Ceph Reef 18"
+    immutable_patterns:
+      - ".*/x86_64/.*\\.rpm$"
+      - ".*/noarch/.*\\.rpm$"
+      - ".*/repodata/.*\\.xml.*$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
+
+  ceph-squid:
+    base_url: "https://download.ceph.com/rpm-squid/"
+    package: "rpm"
+    description: "Ceph Squid 19"
+    immutable_patterns:
+      - ".*/x86_64/.*\\.rpm$"
+      - ".*/noarch/.*\\.rpm$"
+      - ".*/repodata/.*\\.xml.*$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
+
+  ceph-tentacle:
+    base_url: "https://download.ceph.com/rpm-tentacle/"
+    package: "rpm"
+    description: "Ceph Tentacle 20"
+    immutable_patterns:
+      - ".*/x86_64/.*\\.rpm$"
+      - ".*/noarch/.*\\.rpm$"
+      - ".*/repodata/.*\\.xml.*$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
+
+  epel:
+    base_url: "https://gsl-syd.mm.fcix.net/epel"
+    package: "rpm"
+    description: "EPEL (Extra Packages for Enterprise Linux)"
+    immutable_patterns:
+      - ".*/Everything/x86_64/.*\\.rpm$"
+      - ".*/noarch/.*\\.rpm$"
+      - ".*/repodata/.*\\.sqlite.*$"
+      - ".*/repodata/.*\\.xml.*$"
+      - ".*/repodata/.*\\.yaml.*$"
+      - "RPM-GPG-KEY-.*$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
+
+  fedora:
+    base_url: "https://gsl-syd.mm.fcix.net/fedora/linux"
+    package: "rpm"
+    description: "Fedora Linux RPM package repository"
+    immutable_patterns:
+      - "releases/.*/Everything/x86_64/.*\\.rpm$"
+      - "updates/.*/Everything/x86_64/.*\\.rpm$"
+      - "development/.*/Everything/x86_64/.*\\.rpm$"
+      - ".*/noarch/.*\\.rpm$"
+      - ".*/repodata/.*\\.xml.*$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
+
+  frr:
+    base_url: "https://rpm.frrouting.org/repo"
+    package: "rpm"
+    description: "FRR RPM package repository"
+    immutable_patterns:
+      - ".*\\.rpm$"
+      - ".*/repodata/.*\\.xml.*$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
+
+  mariadb:
+    base_url: "http://mariadb.mirror.digitalpacific.com.au/yum"
+    package: "rpm"
+    description: "MariaDB RPM package repository"
+    immutable_patterns:
+      - ".*\\.rpm$"
+      - ".*/repodata/.*\\.xml.*$"
+      - ".*/RPM-GPG-KEY-.*$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
+
+  openvox:
+    base_url: "https://yum.voxpupuli.org"
+    package: "rpm"
+    description: "OpenVox RPM package repository"
+    immutable_patterns:
+      - ".*\\.rpm$"
+      - ".*/repodata/.*\\.xml.*$"
+      - "GPG-KEY-.*$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
+
+  postgresql:
+    base_url: "https://download.postgresql.org/pub/repos/yum"
+    package: "rpm"
+    description: "PostgreSQL RPM package repository"
+    immutable_patterns:
+      - ".*\\.rpm$"
+      - ".*/repodata/.*\\.xml.*$"
+      - ".*/RPM-GPG-KEY-.*$"
+      - ".*/PGDG-RPM-GPG-KEY-.*$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
+
+  rke2:
+    base_url: "https://rpm.rancher.io"
+    package: "rpm"
+    description: "RKE2 RPM package repository"
+    immutable_patterns:
+      - ".*\\.rpm$"
+      - ".*/repodata/.*\\.xml.*$"
+      - "public.key$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
+
+  zfs:
+    base_url: "http://download.zfsonlinux.org"
+    package: "rpm"
+    description: "ZFS RPM package repository"
+    immutable_patterns:
+      - ".*\\.rpm$"
+      - ".*/repodata/.*\\.xml.*$"
+    cache:
+      immutable_ttl: 0
+      mutable_ttl: 7200
@@ -0,0 +1,18 @@
+virtuals:
+  helm:
+    package: "helm"
+    description: "Virtual repository merging all helm remotes — member order is priority order for duplicate chart+version"
+    members:
+      - ceph-csi
+      - cnpg
+      - elastic-helm
+      - external-dns
+      - hashicorp-helm
+      - intel-helm
+      - jetstack
+      - purelb
+      - rancher-stable
+      - stakater
+      - traefik
+      - victoriametrics
+      - argo-helm
@@ -1,286 +0,0 @@
-remotes:
-  github:
-    base_url: "https://github.com"
-    type: "remote"
-    package: "generic"
-    description: "GitHub releases and files"
-    include_patterns:
-      - "apple/foundationdb/.*/libfdb_c.x86_64.so$"
-      - "astral-sh/ruff/.*/ruff-x86_64-unknown-linux-gnu.tar.gz$"
-      - "astral-sh/uv/.*/uv-x86_64-unknown-linux-gnu.tar.gz$"
-      - "camptocamp/prometheus-puppetdb-exporter/.*/prometheus-puppetdb-exporter-.*.linux-amd64.tar.gz$"
-      - "containernetworking/plugins/.*/cni-plugins-linux-amd64-.*.tgz"
-      - "ducaale/xh/.*/xh-.*-x86_64-unknown-linux-musl.tar.gz$"
-      - "etcd-io/etcd/.*/etcd-.*-linux-amd64.tar.gz$"
-      - "grafana/jsonnet-language-server/.*/jsonnet-language-server_.*_linux_amd64$"
-      - "gruntwork-io/boilerplate/.*/boilerplate_linux_amd64$"
-      - "gruntwork-io/terragrunt/.*terragrunt_linux_amd64.*"
-      - "helmfile/helmfile/.*/helmfile_.*_linux_amd64.tar.gz$"
-      - "helmfile/vals/.*/vals_.*_linux_amd64.tar.gz$"
-      - "lxc/incus/.*.tar.gz$"
-      - "nzbgetcom/nzbget/.*/nzbget-.*.x86_64.rpm$"
-      - "onedr0p/exportarr/.*/exportarr_.*_linux_amd64.tar.gz$"
-      - "openbao/openbao-plugins/.*/openbao-plugin-secrets-consul_linux_amd64_.*.tar.gz$"
-      - "openbao/openbao-plugins/.*/openbao-plugin-secrets-nomad_linux_amd64_.*.tar.gz$"
-      - "prometheus/node_exporter/.*/node_exporter-.*.linux-amd64.tar.gz$"
-      - "prometheus-community/bind_exporter/.*/bind_exporter-.*.linux-amd64.tar.gz$"
-      - "prometheus-community/pgbouncer_exporter/.*/pgbouncer_exporter-.*.linux-amd64.tar.gz$"
-      - "prometheus-community/postgres_exporter/.*/postgres_exporter-.*.linux-amd64.tar.gz$"
-      - "rancher/rke2/.*/rke2-images.linux-amd64.tar.zst$"
-      - "stalwartlabs/stalwart/.*/stalwart-cli-x86_64-unknown-linux-gnu.tar.gz$"
-      - "stalwartlabs/stalwart/.*/stalwart-foundationdb-x86_64-unknown-linux-gnu.tar.gz$"
-      - "stalwartlabs/stalwart/.*/stalwart-x86_64-unknown-linux-gnu.tar.gz$"
-      - "terraform-linters/tflint/.*/tflint_linux_amd64.zip$"
-      - "tynany/frr_exporter/.*/frr_exporter-.*.linux-amd64.tar.gz$"
-      - "VictoriaMetrics/VictoriaLogs/.*/victoria-logs-linux-amd64-.*.tar.gz$"
-      - "VictoriaMetrics/VictoriaLogs/.*/vlutils-linux-amd64-.*.tar.gz$"
-      - "VictoriaMetrics/VictoriaMetrics/.*/victoria-logs-linux-amd64-.*.tar.gz$"
-      - "VictoriaMetrics/VictoriaMetrics/.*/victoria-metrics-linux-amd64-.*-cluster.tar.gz$"
-      - "VictoriaMetrics/VictoriaMetrics/.*/vlutils-linux-amd64-.*.tar.gz$"
-      - "VictoriaMetrics/VictoriaMetrics/.*/vmutils-linux-amd64-.*.tar.gz$"
-      - "xorpaul/g10k/.*/g10k-.*-linux-amd64.zip$"
-    cache:
-      file_ttl: 0
-      index_ttl: 0
-
-  github_user:
-    base_url: "https://raw.githubusercontent.com"
-    type: "remote"
-    package: "generic"
-    description: "GitHub User Content"
-    include_patterns:
-      - "argoproj/argo-cd/.*.yaml$"
-      - "yannh/kubernetes-json-schema/master/.*.json$"
-      - "datreeio/CRDs-catalog/main/.*.json$"
-    cache:
-      file_ttl: 0
-      index_ttl: 0
-
-  gitea-dl:
-    base_url: "https://dl.gitea.com"
-    type: "remote"
-    package: "generic"
-    description: "Gitea download site"
-    include_patterns:
-      - "act_runner/.*/act_runner-.*-linux-amd64$"
-    cache:
-      file_ttl: 0
-      index_ttl: 0
-
-  hashicorp-releases:
-    base_url: "https://releases.hashicorp.com"
-    type: "remote"
-    package: "generic"
-    description: "HashiCorp product releases"
-    include_patterns:
-      - "terraform/.*terraform_.*_linux_amd64\\.zip$"
-      - "terraform/.*terraform_.*_windows_amd64\\.zip$"
-      - "terraform/.*terraform_.*_darwin_amd64\\.zip$"
-      - "vault/.*vault_.*_linux_amd64\\.zip$"
-      - "vault/.*vault_.*_windows_amd64\\.zip$"
-      - "vault/.*vault_.*_darwin_amd64\\.zip$"
-      - "consul-cni/.*/consul-cni_.*_linux_amd64\\.zip$"
-      - "consul/.*/consul_.*_linux_amd64\\.zip$"
-      - "nomad-autoscaler/.*/nomad-autoscaler_.*_linux_amd64\\.zip$"
-      - "nomad/.*/nomad_.*_linux_amd64\\.zip$"
-      - "packer/.*/packer_.*_linux_amd64\\.zip$"
-    cache:
-      file_ttl: 0
-      index_ttl: 0
-
-  rarlab:
-    base_url: "https://www.rarlab.com"
-    type: "remote"
-    package: "generic"
-    description: "RARLab"
-    include_patterns:
-      - "rar/rarlinux-x64-.*.tar.gz"
-    cache:
-      file_ttl: 0
-      index_ttl: 0
-
-  alpine:
-    base_url: "https://dl-cdn.alpinelinux.org"
-    type: "remote"
-    package: "alpine"
-    description: "Alpine Linux APK package repository"
-    include_patterns:
-      - ".*/x86_64/.*\\.apk$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-  almalinux:
-    base_url: "https://gsl-syd.mm.fcix.net/almalinux"
-    type: "remote"
-    package: "rpm"
-    description: "AlmaLinux RPM package repository"
-    include_patterns:
-      - ".*/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.sqlite.*$"
-      - ".*/repodata/.*\\.xml.*$"
-      - ".*/repodata/.*\\.yaml.*$"
-      - ".*/install.img"
-      - ".*/squashfs.img"
-      - ".*/updates.img"
-      - ".*/RPM-GPG-KEY-.*$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-  ceph-reef:
-    base_url: "https://download.ceph.com/rpm-reef/"
-    type: "remote"
-    package: "rpm"
-    description: "Ceph Reef 18"
-    include_patterns:
-      - ".*/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-  ceph-squid:
-    base_url: "https://download.ceph.com/rpm-squid/"
-    type: "remote"
-    package: "rpm"
-    description: "Ceph Squid 19"
-    include_patterns:
-      - ".*/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-  ceph-tentacle:
-    base_url: "https://download.ceph.com/rpm-tentacle/"
-    type: "remote"
-    package: "rpm"
-    description: "Ceph Tentacle 20"
-    include_patterns:
-      - ".*/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-  epel:
-    base_url: "https://gsl-syd.mm.fcix.net/epel"
-    type: "remote"
-    package: "rpm"
-    description: "EPEL (Extra Packages for Enterprise Linux)"
-    include_patterns:
-      - ".*/Everything/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.sqlite.*$"
-      - ".*/repodata/.*\\.xml.*$"
-      - ".*/repodata/.*\\.yaml.*$"
-      - "RPM-GPG-KEY-.*$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-  fedora:
-    base_url: "https://gsl-syd.mm.fcix.net/fedora/linux"
-    type: "remote"
-    package: "rpm"
-    description: "Fedora Linux RPM package repository"
-    include_patterns:
-      - "releases/.*/Everything/x86_64/.*\\.rpm$"
-      - "updates/.*/Everything/x86_64/.*\\.rpm$"
-      - "development/.*/Everything/x86_64/.*\\.rpm$"
-      - ".*/noarch/.*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-  frr:
-    base_url: "https://rpm.frrouting.org/repo"
-    type: "remote"
-    package: "rpm"
-    description: "FRR RPM package repository"
-    include_patterns:
-      - ".*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-  mariadb:
-    base_url: "http://mariadb.mirror.digitalpacific.com.au/yum"
-    type: "remote"
-    package: "rpm"
-    description: "MariaDB RPM package repository"
-    include_patterns:
-      - ".*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-      - ".*/RPM-GPG-KEY-.*$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-  openvox:
-    base_url: "https://yum.voxpupuli.org"
-    type: "remote"
-    package: "rpm"
-    description: "OpenVox RPM package repository"
-    include_patterns:
-      - ".*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-      - "GPG-KEY-.*$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-  postgresql:
-    base_url: "https://download.postgresql.org/pub/repos/yum"
-    type: "remote"
-    package: "rpm"
-    description: "PostgreSQL RPM package repository"
-    include_patterns:
-      - ".*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-      - ".*/RPM-GPG-KEY-.*$"
-      - ".*/PGDG-RPM-GPG-KEY-.*$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-  rke2:
-    base_url: "https://rpm.rancher.io"
-    type: "remote"
-    package: "rpm"
-    description: "RKE2 RPM package repository"
-    include_patterns:
-      - ".*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-      - "public.key$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-  zfs:
-    base_url: "http://download.zfsonlinux.org"
-    type: "remote"
-    package: "rpm"
-    description: "ZFS RPM package repository"
-    include_patterns:
-      - ".*\\.rpm$"
-      - ".*/repodata/.*\\.xml.*$"
-    cache:
-      file_ttl: 0
-      index_ttl: 7200
-
-
-  local-generic:
-    type: "local"
-    package: "generic"
-    description: "Local generic file repository"
-    cache:
-      file_ttl: 0
-      index_ttl: 0
@@ -0,0 +1,37 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: rancher.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: rancher.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: "198.18.200.4"
+  name: rancher
+  namespace: cattle-system
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: rancher.k8s.syd1.au.unkin.net
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: rancher.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: rancher-tls
+        mode: Terminate
@@ -0,0 +1,42 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: rancher-http-redirect
+  namespace: cattle-system
+spec:
+  hostnames:
+    - rancher.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: rancher
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: rancher
+  namespace: cattle-system
+spec:
+  hostnames:
+    - rancher.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: rancher
+      sectionName: https
+  rules:
+    - backendRefs:
+        - name: rancher
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -1,29 +0,0 @@
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: rancher
-  namespace: cattle-system
-  annotations:
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: rancher.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-    external-dns.alpha.kubernetes.io/hostname: rancher.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: "198.18.200.0"
-spec:
-  ingressClassName: nginx
-  tls:
-    - hosts:
-        - rancher.k8s.syd1.au.unkin.net
-      secretName: rancher-tls
-  rules:
-    - host: rancher.k8s.syd1.au.unkin.net
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: rancher
-                port:
-                  number: 80
@@ -6,4 +6,5 @@ resources:
  - namespace.yaml
  - vaultauth.yaml
  - vaultstaticsecret.yaml
-  - ingress.yaml
+  - gateway.yaml
+  - httproute.yaml
@@ -0,0 +1,53 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: consul
+  namespace: consul
+  labels:
+    app.kubernetes.io/name: consul
+    app.kubernetes.io/instance: consul
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: consul.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    cert-manager.io/alt-names: consul.service.consul
+    external-dns.alpha.kubernetes.io/hostname: consul.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - name: http
+      port: 80
+      protocol: HTTP
+      hostname: consul.k8s.syd1.au.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+    - name: https
+      port: 443
+      protocol: HTTPS
+      hostname: consul.k8s.syd1.au.unkin.net
+      allowedRoutes:
+        namespaces:
+          from: Same
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: consul-tls
+    - name: consul-svc
+      port: 443
+      protocol: HTTPS
+      hostname: consul.service.consul
+      allowedRoutes:
+        namespaces:
+          from: Same
+      tls:
+        mode: Terminate
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: consul-tls
@@ -0,0 +1,71 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: consul-http-redirect
+  namespace: consul
+  labels:
+    app.kubernetes.io/name: consul
+    app.kubernetes.io/instance: consul
+spec:
+  hostnames:
+    - consul.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: consul
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: consul
+  namespace: consul
+  labels:
+    app.kubernetes.io/name: consul
+    app.kubernetes.io/instance: consul
+spec:
+  hostnames:
+    - consul.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: consul
+      sectionName: https
+  rules:
+    - backendRefs:
+        - name: consul-ui
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: consul-svc
+  namespace: consul
+  labels:
+    app.kubernetes.io/name: consul
+    app.kubernetes.io/instance: consul
+spec:
+  hostnames:
+    - consul.service.consul
+  parentRefs:
+    - name: consul
+      sectionName: consul-svc
+  rules:
+    - backendRefs:
+        - name: consul-ui
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -0,0 +1,8 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - gateway.yaml
+  - httproute.yaml
@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: consul
@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    app.kubernetes.io/name: elastic-system
+  name: elastic-system
@@ -7,11 +7,12 @@ resources:

 helmCharts:
  - name: intel-device-plugins-operator
-    repo: https://intel.github.io/helm-charts/
+    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
+    version: "0.35.0"
    releaseName: intel-device-plugins-operator
    namespace: inteldeviceplugins-system
  - name: intel-device-plugins-gpu
-    repo: https://intel.github.io/helm-charts/
+    repo: https://artifactapi.k8s.syd1.au.unkin.net/api/v1/virtual/helm
    version: "0.34.1"
    releaseName: intel-gpu-plugin
    namespace: inteldeviceplugins-system
@@ -0,0 +1,91 @@
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: litellm-postgres
+  namespace: litellm
+spec:
+  affinity:
+    podAntiAffinityType: preferred
+  bootstrap:
+    initdb:
+      database: litellm
+      encoding: UTF8
+      localeCType: C
+      localeCollate: C
+      owner: litellm
+      secret:
+        name: postgres-credentials
+  enablePDB: true
+  enableSuperuserAccess: false
+  failoverDelay: 0
+  imageName: ghcr.io/cloudnative-pg/postgresql:17-minimal-trixie
+  instances: 3
+  logLevel: info
+  maxSyncReplicas: 0
+  minSyncReplicas: 0
+  monitoring:
+    customQueriesConfigMap:
+      - key: queries
+        name: cnpg-default-monitoring
+    disableDefaultQueries: false
+    enablePodMonitor: false
+  postgresql:
+    parameters:
+      archive_mode: "on"
+      archive_timeout: 5min
+      dynamic_shared_memory_type: posix
+      effective_cache_size: 256MB
+      full_page_writes: "on"
+      log_destination: csvlog
+      log_directory: /controller/log
+      log_filename: postgres
+      log_rotation_age: "0"
+      log_rotation_size: "0"
+      log_truncate_on_rotation: "false"
+      logging_collector: "on"
+      max_connections: "200"
+      max_parallel_workers: "16"
+      max_replication_slots: "16"
+      max_worker_processes: "16"
+      shared_buffers: 128MB
+      shared_memory_type: mmap
+      ssl_max_protocol_version: TLSv1.3
+      ssl_min_protocol_version: TLSv1.3
+      wal_keep_size: 256MB
+      wal_level: logical
+      wal_log_hints: "on"
+      wal_receiver_timeout: 5s
+      wal_sender_timeout: 5s
+    syncReplicaElectionConstraint:
+      enabled: false
+  primaryUpdateMethod: restart
+  primaryUpdateStrategy: unsupervised
+  probes:
+    liveness:
+      isolationCheck:
+        connectionTimeout: 1000
+        enabled: true
+        requestTimeout: 1000
+  replicationSlots:
+    highAvailability:
+      enabled: true
+      slotPrefix: _cnpg_
+    synchronizeReplicas:
+      enabled: true
+    updateInterval: 30
+  resources:
+    limits:
+      cpu: 1
+      memory: 1024Mi
+    requests:
+      cpu: 250m
+      memory: 512Mi
+  smartShutdownTimeout: 180
+  startDelay: 3600
+  stopDelay: 1800
+  storage:
+    resizeInUseVolumes: true
+    size: 10Gi
+    storageClass: cephrbd-fast-delete
+  switchoverDelay: 3600
@@ -0,0 +1,33 @@
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Pooler
+metadata:
+  name: litellm-postgres-pooler
+  namespace: litellm
+spec:
+  cluster:
+    name: litellm-postgres
+  instances: 2
+  pgbouncer:
+    parameters:
+      default_pool_size: "100"
+      max_client_conn: "400"
+    paused: false
+    poolMode: session
+  template:
+    metadata:
+      labels:
+        app: pooler
+    spec:
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchExpressions:
+                  - key: app
+                    operator: In
+                    values:
+                      - pooler
+              topologyKey: kubernetes.io/hostname
+      containers: []
+  type: rw
@@ -0,0 +1,71 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: litellm
+  namespace: litellm
+spec:
+  selector:
+    matchLabels:
+      app: litellm
+  template:
+    metadata:
+      annotations:
+        reloader.stakater.com/auto: "true"
+      labels:
+        app: litellm
+    spec:
+      containers:
+        - name: litellm
+          image: docker.litellm.ai/berriai/litellm-database:main-stable
+          imagePullPolicy: Always
+          args:
+            - --config
+            - /app/config.yaml
+            - --port
+            - "4000"
+            - --num_workers
+            - "8"
+          ports:
+            - containerPort: 4000
+              name: http
+              protocol: TCP
+          envFrom:
+            - secretRef:
+                name: litellm-credentials
+            - configMapRef:
+                name: litellm-env
+          livenessProbe:
+            httpGet:
+              path: /health/liveliness
+              port: 4000
+            failureThreshold: 3
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            successThreshold: 1
+            timeoutSeconds: 5
+          readinessProbe:
+            httpGet:
+              path: /health/readiness
+              port: 4000
+            failureThreshold: 3
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 5
+          resources:
+            limits:
+              cpu: "2"
+              memory: 8Gi
+            requests:
+              cpu: 250m
+              memory: 6Gi
+          volumeMounts:
+            - mountPath: /app/config.yaml
+              name: config
+              subPath: config.yaml
+      restartPolicy: Always
+      volumes:
+        - name: config
+          configMap:
+            name: litellm-config
@@ -0,0 +1,37 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: litellm.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: litellm.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  name: litellm
+  namespace: litellm
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: litellm.k8s.syd1.au.unkin.net
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: litellm.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: litellm-tls
+        mode: Terminate
@@ -0,0 +1,41 @@
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: litellm-hpa
+  namespace: litellm
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: litellm
+  minReplicas: 2
+  maxReplicas: 4
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: 80
+  behavior:
+    scaleUp:
+      stabilizationWindowSeconds: 0
+      selectPolicy: Max
+      policies:
+        - type: Percent
+          value: 100
+          periodSeconds: 60
+        - type: Pods
+          value: 4
+          periodSeconds: 30
+    scaleDown:
+      stabilizationWindowSeconds: 300
+      selectPolicy: Min
+      policies:
+        - type: Percent
+          value: 30
+          periodSeconds: 60
+        - type: Pods
+          value: 2
+          periodSeconds: 60
@@ -0,0 +1,42 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: litellm-http-redirect
+  namespace: litellm
+spec:
+  hostnames:
+    - litellm.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: litellm
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: litellm
+  namespace: litellm
+spec:
+  hostnames:
+    - litellm.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: litellm
+      sectionName: https
+  rules:
+    - backendRefs:
+        - name: litellm
+          port: 4000
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -0,0 +1,29 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - cnpg_cluster.yaml
+  - cnpg_pooler.yaml
+  - deployment.yaml
+  - hpa.yaml
+  - gateway.yaml
+  - httproute.yaml
+  - namespace.yaml
+  - redis-deployment.yaml
+  - redis-pvc.yaml
+  - services.yaml
+  - vaultauth.yaml
+  - vaultstaticsecret.yaml
+
+configMapGenerator:
+  - name: litellm-config
+    files:
+      - config.yaml=resources/config.yaml
+    options:
+      disableNameSuffixHash: true
+  - name: litellm-env
+    literals:
+      - STORE_MODEL_IN_DB=True
+    options:
+      disableNameSuffixHash: true
@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: litellm
@@ -0,0 +1,67 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: redis
+  namespace: litellm
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: redis
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        app: redis
+    spec:
+      containers:
+        - name: redis
+          image: redis:7-alpine
+          imagePullPolicy: IfNotPresent
+          command:
+            - redis-server
+            - --save
+            - "20"
+            - "1"
+          ports:
+            - containerPort: 6379
+              name: redis
+              protocol: TCP
+          livenessProbe:
+            exec:
+              command:
+                - redis-cli
+                - ping
+            failureThreshold: 3
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            successThreshold: 1
+            timeoutSeconds: 5
+          readinessProbe:
+            exec:
+              command:
+                - redis-cli
+                - ping
+            failureThreshold: 3
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 5
+          resources:
+            limits:
+              cpu: 500m
+              memory: 512Mi
+            requests:
+              cpu: 50m
+              memory: 128Mi
+          volumeMounts:
+            - mountPath: /data
+              mountPropagation: None
+              name: data
+      restartPolicy: Always
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: litellm-redis-data
@@ -0,0 +1,14 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: litellm-redis-data
+  namespace: litellm
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 5Gi
+  storageClassName: cephrbd-fast-delete
+  volumeMode: Filesystem
@@ -0,0 +1,15 @@
+model_list: []
+
+router_settings:
+  redis_host: redis-service
+  redis_port: 6379
+
+general_settings:
+  use_redis_transaction_buffer: true
+
+litellm_settings:
+  cache: true
+  cache_params:
+    type: redis
+    host: redis-service
+    port: 6379
@@ -0,0 +1,34 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: litellm
+  namespace: litellm
+spec:
+  internalTrafficPolicy: Cluster
+  ports:
+    - name: http
+      port: 4000
+      protocol: TCP
+      targetPort: http
+  selector:
+    app: litellm
+  sessionAffinity: None
+  type: ClusterIP
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis-service
+  namespace: litellm
+spec:
+  internalTrafficPolicy: Cluster
+  ports:
+    - name: redis
+      port: 6379
+      protocol: TCP
+      targetPort: redis
+  selector:
+    app: redis
+  sessionAffinity: None
+  type: ClusterIP
@@ -0,0 +1,18 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: litellm
+spec:
+  allowedNamespaces:
+    - litellm
+  kubernetes:
+    audiences:
+      - vault
+    role: default
+    serviceAccount: default
+    tokenExpirationSeconds: 600
+  method: kubernetes
+  mount: k8s/au/syd1
+  vaultConnectionRef: vso-system/default
@@ -0,0 +1,34 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: postgres-credentials
+  namespace: litellm
+spec:
+  destination:
+    create: true
+    name: postgres-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/litellm/default/postgres-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: litellm-credentials
+  namespace: litellm
+spec:
+  destination:
+    create: true
+    name: litellm-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/litellm/default/litellm-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
@@ -0,0 +1,18 @@
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: postfix-smtp-tls
+  namespace: mailgateway
+spec:
+  secretName: postfix-smtp-tls
+  issuerRef:
+    name: vault-issuer
+    kind: ClusterIssuer
+  commonName: mail.main.unkin.net
+  dnsNames:
+    - mail.main.unkin.net
+    - smtp-in.main.unkin.net
+  privateKey:
+    size: 4096
+    algorithm: RSA
@@ -0,0 +1,37 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: rspamd.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: rspamd.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  name: rspamd
+  namespace: mailgateway
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: rspamd.k8s.syd1.au.unkin.net
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: rspamd.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: rspamd-tls
+        mode: Terminate
@@ -0,0 +1,16 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: rspamd
+  namespace: mailgateway
+spec:
+  parentRefs:
+    - name: rspamd
+      namespace: mailgateway
+  hostnames:
+    - rspamd.k8s.syd1.au.unkin.net
+  rules:
+    - backendRefs:
+        - name: rspamd
+          port: 11334
@@ -0,0 +1,36 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - certificate.yaml
+  - gateway.yaml
+  - httproute.yaml
+  - namespace.yaml
+  - postfix-deployment.yaml
+  - postfix-hpa.yaml
+  - rspamd-deployment.yaml
+  - rspamd-hpa.yaml
+  - services.yaml
+  - vaultauth.yaml
+  - vaultstaticsecret.yaml
+
+configMapGenerator:
+  - name: postfix-config
+    files:
+      - main.cf=resources/postfix/main.cf
+      - master.cf=resources/postfix/master.cf
+    options:
+      disableNameSuffixHash: true
+  - name: postfix-maps
+    files:
+      - transport=resources/postfix/transport
+    options:
+      disableNameSuffixHash: true
+  - name: rspamd-config
+    files:
+      - worker-proxy.inc=resources/rspamd/local.d/worker-proxy.inc
+      - dkim_signing.conf=resources/rspamd/local.d/dkim_signing.conf
+      - milter_headers.conf=resources/rspamd/local.d/milter_headers.conf
+    options:
+      disableNameSuffixHash: true
@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: mailgateway
@@ -0,0 +1,105 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: postfix
+  namespace: mailgateway
+spec:
+  selector:
+    matchLabels:
+      app: postfix
+  template:
+    metadata:
+      annotations:
+        reloader.stakater.com/auto: "true"
+      labels:
+        app: postfix
+    spec:
+      initContainers:
+        - name: postmap
+          image: tozd/postfix:alpine-322
+          command: ["/bin/sh", "-c"]
+          args:
+            - |
+              for f in /etc/postfix/maps/*; do
+                base=$(basename "$f")
+                cp "$f" /tmp/"$base"
+                postmap hash:/tmp/"$base"
+                cp /tmp/"${base}.db" /etc/postfix/db/
+              done
+          volumeMounts:
+            - name: postfix-maps
+              mountPath: /etc/postfix/maps
+              readOnly: true
+            - name: postfix-db
+              mountPath: /etc/postfix/db
+      containers:
+        - name: postfix
+          image: tozd/postfix:alpine-322
+          ports:
+            - containerPort: 25
+              name: smtp
+              protocol: TCP
+            - containerPort: 587
+              name: submission
+              protocol: TCP
+          env:
+            # Keep these in sync with main.cf so the tozd startup postconf calls are no-ops
+            - name: MAILNAME
+              value: "mail.main.unkin.net"
+            - name: MY_NETWORKS
+              value: "127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16"
+            - name: MY_DESTINATION
+              value: "localhost.localdomain, localhost"
+            - name: LOG_TO_STDOUT
+              value: "1"
+          livenessProbe:
+            tcpSocket:
+              port: 25
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            tcpSocket:
+              port: 25
+            initialDelaySeconds: 15
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: "1"
+              memory: 512Mi
+          volumeMounts:
+            - name: postfix-config
+              mountPath: /etc/postfix/main.cf
+              subPath: main.cf
+            - name: postfix-config
+              mountPath: /etc/postfix/master.cf
+              subPath: master.cf
+            - name: postfix-db
+              mountPath: /etc/postfix/transport.db
+              subPath: transport.db
+            - name: postfix-tls
+              mountPath: /etc/postfix/tls
+              readOnly: true
+            - name: spool
+              mountPath: /var/spool/postfix
+      volumes:
+        - name: postfix-config
+          configMap:
+            name: postfix-config
+        - name: postfix-maps
+          configMap:
+            name: postfix-maps
+        - name: postfix-db
+          emptyDir: {}
+        - name: postfix-tls
+          secret:
+            secretName: postfix-smtp-tls
+        - name: spool
+          emptyDir: {}
@@ -0,0 +1,38 @@
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: postfix-hpa
+  namespace: mailgateway
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: postfix
+  minReplicas: 2
+  maxReplicas: 6
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: 70
+  behavior:
+    scaleUp:
+      stabilizationWindowSeconds: 0
+      selectPolicy: Max
+      policies:
+        - type: Percent
+          value: 100
+          periodSeconds: 60
+        - type: Pods
+          value: 4
+          periodSeconds: 30
+    scaleDown:
+      stabilizationWindowSeconds: 300
+      selectPolicy: Min
+      policies:
+        - type: Percent
+          value: 30
+          periodSeconds: 60
@@ -0,0 +1,46 @@
+# Basic identity — kept in sync with MAILNAME/MY_NETWORKS/MY_DESTINATION env vars
+# so the tozd startup script's postconf calls are no-ops
+myhostname = mail.main.unkin.net
+myorigin = main.unkin.net
+mydestination = localhost.localdomain, localhost
+mynetworks = 127.0.0.0/8 10.0.0.0/8 172.16.0.0/12 192.168.0.0/16
+inet_protocols = ipv4
+inet_interfaces = all
+
+# No local delivery — we're a relay-only gateway
+local_transport = error:no local delivery
+alias_maps =
+alias_database =
+
+# Relay inbound mail for these domains to Stalwart
+relay_domains = main.unkin.net unkin.net
+transport_maps = hash:/etc/postfix/transport
+
+# rspamd milter (same namespace — short DNS name resolves)
+smtpd_milters = inet:rspamd:11332
+non_smtpd_milters = inet:rspamd:11332
+milter_default_action = accept
+milter_protocol = 6
+milter_mail_macros = i {mail_addr} {client_addr} {client_name} {auth_authen}
+
+# Inbound TLS (cert from cert-manager Certificate resource)
+smtpd_use_tls = yes
+smtpd_tls_security_level = may
+smtpd_tls_cert_file = /etc/postfix/tls/tls.crt
+smtpd_tls_key_file = /etc/postfix/tls/tls.key
+smtpd_tls_loglevel = 1
+
+# Outbound TLS (opportunistic)
+smtp_tls_security_level = may
+smtp_tls_loglevel = 1
+
+# Message size limit (50 MiB)
+message_size_limit = 52428800
+mailbox_size_limit = 0
+
+# Queue retention
+maximal_queue_lifetime = 5d
+bounce_queue_lifetime = 1d
+
+# Log to stdout for k8s log collection
+maillog_file = /dev/stdout
@@ -0,0 +1,42 @@
+# ==========================================================================
+# service type  private unpriv  chroot  wakeup  maxproc command + args
+#               (yes)   (yes)   (yes)   (never) (100)
+# ==========================================================================
+
+# SMTP inbound (port 25) — runs rspamd milter, relays to Stalwart via transport_maps
+smtp      inet  n       -       n       -       -       smtpd
+
+# Submission (port 587) — TLS required, relay from trusted mynetworks only
+submission inet n       -       n       -       -       smtpd
+  -o syslog_name=postfix/submission
+  -o smtpd_tls_security_level=encrypt
+  -o smtpd_sasl_auth_enable=no
+  -o smtpd_reject_unlisted_recipient=no
+  -o smtpd_relay_restrictions=permit_mynetworks,reject
+  -o milter_macro_daemon_name=ORIGINATING
+
+# Internal postfix processes
+pickup    unix  n       -       n       60      1       pickup
+cleanup   unix  n       -       n       -       0       cleanup
+qmgr      unix  n       -       n       300     1       qmgr
+tlsmgr    unix  -       -       n       1000?   1       tlsmgr
+rewrite   unix  -       -       n       -       -       trivial-rewrite
+bounce    unix  -       -       n       -       0       bounce
+defer     unix  -       -       n       -       0       bounce
+trace     unix  -       -       n       -       0       bounce
+verify    unix  -       -       n       -       1       verify
+flush     unix  n       -       n       1000?   0       flush
+proxymap  unix  -       -       n       -       -       proxymap
+proxywrite unix -       -       n       -       1       proxymap
+smtp      unix  -       -       n       -       -       smtp
+relay     unix  -       -       n       -       -       smtp
+showq     unix  n       -       n       -       -       showq
+error     unix  -       -       n       -       -       error
+retry     unix  -       -       n       -       -       error
+discard   unix  -       -       n       -       -       discard
+local     unix  -       n       n       -       -       local
+virtual   unix  -       n       n       -       -       virtual
+lmtp      unix  -       -       n       -       -       lmtp
+anvil     unix  -       -       n       -       1       anvil
+scache    unix  -       -       n       -       1       scache
+postlog   unix-dgram n  -       n       -       1       postlogd
@@ -0,0 +1,2 @@
+.unkin.net        smtp:[stalwart.stalwart.svc.cluster.local]:25
+unkin.net         smtp:[stalwart.stalwart.svc.cluster.local]:25
@@ -0,0 +1,13 @@
+enabled = true;
+selector = "mail";
+
+domain {
+    main.unkin.net {
+        privkey = "/etc/rspamd/dkim/private_key";
+        selector = "mail";
+    }
+    unkin.net {
+        privkey = "/etc/rspamd/dkim/private_key";
+        selector = "mail";
+    }
+}
@@ -0,0 +1,2 @@
+extended_spam_headers = true;
+use = ["x-spam-status", "x-spam-score", "authentication-results"];
@@ -0,0 +1,7 @@
+milter = yes;
+bind_socket = "*:11332";
+
+upstream "local" {
+    default = yes;
+    self_scan = yes;
+}
@@ -0,0 +1,75 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: rspamd
+  namespace: mailgateway
+spec:
+  selector:
+    matchLabels:
+      app: rspamd
+  template:
+    metadata:
+      annotations:
+        reloader.stakater.com/auto: "true"
+      labels:
+        app: rspamd
+    spec:
+      securityContext:
+        runAsUser: 11333
+        runAsGroup: 11333
+        fsGroup: 11333
+      containers:
+        - name: rspamd
+          image: rspamd/rspamd:4.0.1
+          ports:
+            - containerPort: 11332
+              name: milter
+              protocol: TCP
+            - containerPort: 11333
+              name: worker
+              protocol: TCP
+            - containerPort: 11334
+              name: controller
+              protocol: TCP
+          livenessProbe:
+            httpGet:
+              path: /ping
+              port: 11334
+            initialDelaySeconds: 15
+            periodSeconds: 30
+            timeoutSeconds: 5
+            failureThreshold: 3
+          readinessProbe:
+            httpGet:
+              path: /ping
+              port: 11334
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            timeoutSeconds: 3
+            failureThreshold: 3
+          resources:
+            requests:
+              cpu: 100m
+              memory: 256Mi
+            limits:
+              cpu: "1"
+              memory: 512Mi
+          volumeMounts:
+            - name: rspamd-config
+              mountPath: /etc/rspamd/local.d
+              readOnly: true
+            - name: dkim-keys
+              mountPath: /etc/rspamd/dkim
+              readOnly: true
+            - name: rspamd-data
+              mountPath: /var/lib/rspamd
+      volumes:
+        - name: rspamd-config
+          configMap:
+            name: rspamd-config
+        - name: dkim-keys
+          secret:
+            secretName: dkim-keys
+        - name: rspamd-data
+          emptyDir: {}
@@ -0,0 +1,38 @@
+---
+apiVersion: autoscaling/v2
+kind: HorizontalPodAutoscaler
+metadata:
+  name: rspamd-hpa
+  namespace: mailgateway
+spec:
+  scaleTargetRef:
+    apiVersion: apps/v1
+    kind: Deployment
+    name: rspamd
+  minReplicas: 2
+  maxReplicas: 6
+  metrics:
+    - type: Resource
+      resource:
+        name: cpu
+        target:
+          type: Utilization
+          averageUtilization: 70
+  behavior:
+    scaleUp:
+      stabilizationWindowSeconds: 0
+      selectPolicy: Max
+      policies:
+        - type: Percent
+          value: 100
+          periodSeconds: 30
+        - type: Pods
+          value: 4
+          periodSeconds: 30
+    scaleDown:
+      stabilizationWindowSeconds: 300
+      selectPolicy: Min
+      policies:
+        - type: Percent
+          value: 30
+          periodSeconds: 60
@@ -0,0 +1,64 @@
+---
+# Internal service for rspamd - used by postfix pods in the same namespace
+apiVersion: v1
+kind: Service
+metadata:
+  name: rspamd
+  namespace: mailgateway
+spec:
+  selector:
+    app: rspamd
+  ports:
+    - name: milter
+      port: 11332
+      targetPort: 11332
+      protocol: TCP
+    - name: worker
+      port: 11333
+      targetPort: 11333
+      protocol: TCP
+    - name: controller
+      port: 11334
+      targetPort: 11334
+      protocol: TCP
+---
+# Internal ClusterIP for postfix - used by stalwart for outbound relay
+apiVersion: v1
+kind: Service
+metadata:
+  name: postfix
+  namespace: mailgateway
+spec:
+  selector:
+    app: postfix
+  ports:
+    - name: smtp
+      port: 25
+      targetPort: 25
+      protocol: TCP
+    - name: submission
+      port: 587
+      targetPort: 587
+      protocol: TCP
+---
+# External LoadBalancer for inbound MX (internet → postfix)
+apiVersion: v1
+kind: Service
+metadata:
+  name: postfix-external
+  namespace: mailgateway
+  annotations:
+    external-dns.alpha.kubernetes.io/hostname: smtp-in.main.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.199.1
+    purelb.io/service-group: dmz
+    purelb.io/addresses: 198.18.199.1
+spec:
+  type: LoadBalancer
+  externalTrafficPolicy: Local
+  selector:
+    app: postfix
+  ports:
+    - name: smtp
+      port: 25
+      targetPort: 25
+      protocol: TCP
@@ -0,0 +1,18 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: mailgateway
+spec:
+  allowedNamespaces:
+    - mailgateway
+  kubernetes:
+    audiences:
+      - vault
+    role: default
+    serviceAccount: default
+    tokenExpirationSeconds: 600
+  method: kubernetes
+  mount: k8s/au/syd1
+  vaultConnectionRef: vso-system/default
@@ -0,0 +1,17 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: dkim-keys
+  namespace: mailgateway
+spec:
+  destination:
+    create: true
+    name: dkim-keys
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/mailgateway/default/dkim-keys
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
@@ -0,0 +1,6 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    app.kubernetes.io/name: observability
+  name: observability
@@ -0,0 +1,91 @@
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Cluster
+metadata:
+  name: paperclip-postgres
+  namespace: paperclip
+spec:
+  affinity:
+    podAntiAffinityType: preferred
+  bootstrap:
+    initdb:
+      database: paperclip
+      encoding: UTF8
+      localeCType: C
+      localeCollate: C
+      owner: paperclip
+      secret:
+        name: postgres-credentials
+  enablePDB: true
+  enableSuperuserAccess: false
+  failoverDelay: 0
+  imageName: ghcr.io/cloudnative-pg/postgresql:17-minimal-trixie
+  instances: 3
+  logLevel: info
+  maxSyncReplicas: 0
+  minSyncReplicas: 0
+  monitoring:
+    customQueriesConfigMap:
+      - key: queries
+        name: cnpg-default-monitoring
+    disableDefaultQueries: false
+    enablePodMonitor: false
+  postgresql:
+    parameters:
+      archive_mode: "on"
+      archive_timeout: 5min
+      dynamic_shared_memory_type: posix
+      effective_cache_size: 256MB
+      full_page_writes: "on"
+      log_destination: csvlog
+      log_directory: /controller/log
+      log_filename: postgres
+      log_rotation_age: "0"
+      log_rotation_size: "0"
+      log_truncate_on_rotation: "false"
+      logging_collector: "on"
+      max_connections: "200"
+      max_parallel_workers: "16"
+      max_replication_slots: "16"
+      max_worker_processes: "16"
+      shared_buffers: 128MB
+      shared_memory_type: mmap
+      ssl_max_protocol_version: TLSv1.3
+      ssl_min_protocol_version: TLSv1.3
+      wal_keep_size: 256MB
+      wal_level: logical
+      wal_log_hints: "on"
+      wal_receiver_timeout: 5s
+      wal_sender_timeout: 5s
+    syncReplicaElectionConstraint:
+      enabled: false
+  primaryUpdateMethod: restart
+  primaryUpdateStrategy: unsupervised
+  probes:
+    liveness:
+      isolationCheck:
+        connectionTimeout: 1000
+        enabled: true
+        requestTimeout: 1000
+  replicationSlots:
+    highAvailability:
+      enabled: true
+      slotPrefix: _cnpg_
+    synchronizeReplicas:
+      enabled: true
+    updateInterval: 30
+  resources:
+    limits:
+      cpu: 500m
+      memory: 512Mi
+    requests:
+      cpu: 250m
+      memory: 256Mi
+  smartShutdownTimeout: 180
+  startDelay: 3600
+  stopDelay: 1800
+  storage:
+    resizeInUseVolumes: true
+    size: 10Gi
+    storageClass: cephrbd-fast-delete
+  switchoverDelay: 3600
@@ -0,0 +1,33 @@
+---
+apiVersion: postgresql.cnpg.io/v1
+kind: Pooler
+metadata:
+  name: paperclip-pooler-rw
+  namespace: paperclip
+spec:
+  cluster:
+    name: paperclip-postgres
+  instances: 2
+  pgbouncer:
+    parameters:
+      default_pool_size: "100"
+      max_client_conn: "400"
+    paused: false
+    poolMode: session
+  template:
+    metadata:
+      labels:
+        app: pooler
+    spec:
+      affinity:
+        podAntiAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            - labelSelector:
+                matchExpressions:
+                  - key: app
+                    operator: In
+                    values:
+                      - pooler
+              topologyKey: kubernetes.io/hostname
+      containers: []
+  type: rw
@@ -0,0 +1,108 @@
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: paperclip
+  namespace: paperclip
+spec:
+  selector:
+    matchLabels:
+      app: paperclip
+  template:
+    metadata:
+      labels:
+        app: paperclip
+    spec:
+      containers:
+        - name: paperclip
+          image: ghcr.io/paperclipai/paperclip:latest
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 3100
+              name: http
+              protocol: TCP
+          env:
+            - name: PORT
+              value: "3100"
+            - name: PAPERCLIP_BIND
+              value: custom
+            - name: PAPERCLIP_BIND_HOST
+              value: 0.0.0.0
+            - name: PAPERCLIP_API_URL
+              value: https://paperclip.k8s.syd1.au.unkin.net
+            - name: BETTER_AUTH_BASE_URL
+              value: https://paperclip.k8s.syd1.au.unkin.net
+            - name: PAPERCLIP_ALLOWED_HOSTNAMES
+              value: paperclip.k8s.syd1.au.unkin.net,localhost
+            - name: PAPERCLIP_HOME
+              value: /paperclip
+            - name: PAPERCLIP_INSTANCE_ID
+              value: default
+            - name: PAPERCLIP_DEPLOYMENT_MODE
+              value: authenticated
+            - name: PAPERCLIP_DEPLOYMENT_EXPOSURE
+              value: private
+            - name: SERVE_UI
+              value: "true"
+            - name: HEARTBEAT_SCHEDULER_ENABLED
+              value: "true"
+            - name: PAPERCLIP_MIGRATION_AUTO_APPLY
+              value: "true"
+            - name: PAPERCLIP_STORAGE_PROVIDER
+              value: s3
+            - name: PAPERCLIP_STORAGE_S3_BUCKET
+              value: paperclip
+            - name: PAPERCLIP_STORAGE_S3_REGION
+              value: us-east-1
+            - name: PAPERCLIP_STORAGE_S3_ENDPOINT
+              value: https://radosgw.service.consul
+            - name: PAPERCLIP_STORAGE_S3_FORCE_PATH_STYLE
+              value: "true"
+            - name: NODE_EXTRA_CA_CERTS
+              value: /etc/ssl/paperclip/ca.crt
+          envFrom:
+            - secretRef:
+                name: paperclip-credentials
+          volumeMounts:
+            - name: vault-ca-cert
+              mountPath: /etc/ssl/paperclip
+              readOnly: true
+          livenessProbe:
+            httpGet:
+              path: /api/health
+              port: 3100
+              httpHeaders:
+                - name: Host
+                  value: localhost
+            failureThreshold: 3
+            initialDelaySeconds: 30
+            periodSeconds: 30
+            successThreshold: 1
+            timeoutSeconds: 5
+          readinessProbe:
+            httpGet:
+              path: /api/health
+              port: 3100
+              httpHeaders:
+                - name: Host
+                  value: localhost
+            failureThreshold: 3
+            initialDelaySeconds: 10
+            periodSeconds: 10
+            successThreshold: 1
+            timeoutSeconds: 5
+          resources:
+            limits:
+              cpu: "1"
+              memory: 2Gi
+            requests:
+              cpu: 250m
+              memory: 512Mi
+      volumes:
+        - name: vault-ca-cert
+          secret:
+            secretName: vault-ca-cert
+            items:
+              - key: ca.crt
+                path: ca.crt
+      restartPolicy: Always
@@ -0,0 +1,37 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  labels:
+    traefik.io/instance: internal
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: paperclip.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: paperclip.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  name: paperclip
+  namespace: paperclip
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: paperclip.k8s.syd1.au.unkin.net
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: paperclip.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: paperclip-tls
+        mode: Terminate
@@ -0,0 +1,42 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: paperclip-http-redirect
+  namespace: paperclip
+spec:
+  hostnames:
+    - paperclip.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: paperclip
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: paperclip
+  namespace: paperclip
+spec:
+  hostnames:
+    - paperclip.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: paperclip
+      sectionName: https
+  rules:
+    - backendRefs:
+        - name: paperclip
+          port: 3100
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -0,0 +1,14 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - cnpg_cluster.yaml
+  - cnpg_pooler.yaml
+  - deployment.yaml
+  - gateway.yaml
+  - httproute.yaml
+  - namespace.yaml
+  - services.yaml
+  - vaultauth.yaml
+  - vaultstaticsecret.yaml
@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: paperclip
@@ -0,0 +1,17 @@
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: paperclip
+  namespace: paperclip
+spec:
+  internalTrafficPolicy: Cluster
+  ports:
+    - name: http
+      port: 3100
+      protocol: TCP
+      targetPort: http
+  selector:
+    app: paperclip
+  sessionAffinity: None
+  type: ClusterIP
@@ -0,0 +1,18 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultAuth
+metadata:
+  name: default
+  namespace: paperclip
+spec:
+  allowedNamespaces:
+    - paperclip
+  kubernetes:
+    audiences:
+      - vault
+    role: default
+    serviceAccount: default
+    tokenExpirationSeconds: 600
+  method: kubernetes
+  mount: k8s/au/syd1
+  vaultConnectionRef: vso-system/default
@@ -0,0 +1,34 @@
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: postgres-credentials
+  namespace: paperclip
+spec:
+  destination:
+    create: true
+    name: postgres-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/paperclip/default/postgres-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
+---
+apiVersion: secrets.hashicorp.com/v1beta1
+kind: VaultStaticSecret
+metadata:
+  name: paperclip-credentials
+  namespace: paperclip
+spec:
+  destination:
+    create: true
+    name: paperclip-credentials
+    overwrite: true
+  hmacSecretData: true
+  mount: kv
+  path: kubernetes/namespace/paperclip/default/paperclip-credentials
+  refreshAfter: 5m
+  type: kv-v2
+  vaultAuthRef: default
@@ -26,38 +26,6 @@ spec:
        spec:
          hostname: g10k-code
          imagePullSecrets: null
-          initContainers:
-            - name: fetch-config
-              image: alpine/git:latest
-              imagePullPolicy: IfNotPresent
-              resources:
-                requests:
-                  cpu: 50m
-                  memory: 64Mi
-                limits:
-                  cpu: 100m
-                  memory: 128Mi
-              args:
-                - |
-                  set -e
-                  echo "Cloning r10k config repository..."
-                  git clone https://git.unkin.net/unkin/puppet-r10k.git /tmp/config
-                  cp /tmp/config/r10k.yaml /shared/r10k.yaml
-                  echo "r10k.yaml fetched successfully"
-              command:
-                - /bin/sh
-                - -c
-              securityContext:
-                allowPrivilegeEscalation: false
-                capabilities:
-                  drop:
-                    - all
-                runAsGroup: 999
-                runAsNonRoot: true
-                runAsUser: 999
-              volumeMounts:
-                - mountPath: /shared
-                  name: shared-config
          containers:
            - name: g10k-code
              image: git.unkin.net/unkin/almalinux9-g10k:20260308
@@ -69,11 +37,16 @@ spec:
                limits:
                  cpu: 200m
                  memory: 256Mi
-              args:
-                - -config
-                - /shared/r10k.yaml
              command:
-                - /usr/bin/g10k
+                - /bin/sh
+                - -c
+              args:
+                - |
+                  set -e
+                  echo "Cloning r10k config repository..."
+                  git clone https://git.unkin.net/unkin/puppet-r10k.git /tmp/r10k-config
+                  echo "Running g10k..."
+                  /usr/bin/g10k -config /tmp/r10k-config/r10k.yaml
              envFrom: null
              env: []
              securityContext:
@@ -87,8 +60,6 @@ spec:
              volumeMounts:
                - mountPath: /etc/puppetlabs/code/
                  name: puppet-code-volume
-                - mountPath: /shared
-                  name: shared-config
          restartPolicy: OnFailure
          securityContext:
            fsGroup: 999
@@ -96,6 +67,3 @@ spec:
            - name: puppet-code-volume
              persistentVolumeClaim:
                claimName: puppetserver-code-shared
-            - name: shared-config
-              persistentVolumeClaim:
-                claimName: puppetserver-shared-config
@@ -35,21 +35,20 @@ spec:
                - -c
              args:
                - |
+                  /opt/puppetlabs/puppet/bin/gem install deep_merge ipaddr hiera-eyaml toml
                  find /etc/puppetlabs/code/environments -mindepth 1 -maxdepth 1 -type d | while read -r envdir; do
                    env="$(basename "$envdir")"
                    echo "Generating types for $env"
                    puppet generate types --environment "$env"
                  done
-              env:
-                - name: PUPPETSERVER_JAVA_ARGS
-                  value: -Xms1024m -Xmx3072m -Dcom.sun.management.jmxremote.port=31000 -Dcom.sun.management.jmxremote.authenticate=false -Dcom.sun.management.jmxremote.ssl=false
+              env: []
              resources:
                limits:
                  cpu: 300m
-                  memory: 256Mi
+                  memory: 1Gi
                requests:
                  cpu: 200m
-                  memory: 128Mi
+                  memory: 512Mi
              securityContext:
                runAsUser: 0
                runAsNonRoot: false
@@ -0,0 +1,41 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: puppetboard.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: puppetboard.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  labels:
+    traefik.io/instance: internal
+    app.kubernetes.io/component: puppetboard
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetboard
+  namespace: puppet
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: puppetboard.k8s.syd1.au.unkin.net
+      name: http
+      port: 80
+      protocol: HTTP
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: puppetboard.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: puppetboard-tls
+        mode: Terminate
@@ -0,0 +1,34 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  annotations:
+    cert-manager.io/cluster-issuer: vault-issuer
+    cert-manager.io/common-name: puppetdb.k8s.syd1.au.unkin.net
+    cert-manager.io/private-key-size: "4096"
+    external-dns.alpha.kubernetes.io/hostname: puppetdb.k8s.syd1.au.unkin.net
+    external-dns.alpha.kubernetes.io/target: 198.18.200.4
+  labels:
+    traefik.io/instance: internal
+    app.kubernetes.io/component: puppetdb
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetdb
+  namespace: puppet
+spec:
+  gatewayClassName: traefik-internal
+  listeners:
+    - allowedRoutes:
+        namespaces:
+          from: Same
+      hostname: puppetdb.k8s.syd1.au.unkin.net
+      name: https
+      port: 443
+      protocol: HTTPS
+      tls:
+        certificateRefs:
+          - group: ""
+            kind: Secret
+            name: puppetdb-tls
+        mode: Terminate
@@ -0,0 +1,52 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  labels:
+    app.kubernetes.io/component: puppetboard
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetboard-http-redirect
+  namespace: puppet
+spec:
+  hostnames:
+    - puppetboard.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: puppetboard
+      sectionName: http
+  rules:
+    - filters:
+        - type: RequestRedirect
+          requestRedirect:
+            scheme: https
+            statusCode: 301
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  labels:
+    app.kubernetes.io/component: puppetboard
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetboard
+  namespace: puppet
+spec:
+  hostnames:
+    - puppetboard.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: puppetboard
+      sectionName: https
+  rules:
+    - backendRefs:
+        - name: puppetboard
+          port: 80
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -0,0 +1,25 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  labels:
+    app.kubernetes.io/component: puppetdb
+    app.kubernetes.io/instance: puppetserver
+    app.kubernetes.io/name: puppetserver
+    app.kubernetes.io/version: 8.8.0
+  name: puppetdb
+  namespace: puppet
+spec:
+  hostnames:
+    - puppetdb.k8s.syd1.au.unkin.net
+  parentRefs:
+    - name: puppetdb
+      sectionName: https
+  rules:
+    - backendRefs:
+        - name: puppetdb
+          port: 8080
+      matches:
+        - path:
+            type: PathPrefix
+            value: /
@@ -1,34 +0,0 @@
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    kubernetes.io/ingress.class: nginx
-    external-dns.alpha.kubernetes.io/hostname: puppetboard.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.0
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: puppetboard.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-  labels:
-    app.kubernetes.io/component: puppetboard
-    app.kubernetes.io/instance: puppetserver
-    app.kubernetes.io/name: puppetserver
-    app.kubernetes.io/version: 8.8.0
-  name: puppetboard
-  namespace: puppet
-spec:
-  rules:
-    - host: puppetboard.k8s.syd1.au.unkin.net
-      http:
-        paths:
-          - backend:
-              service:
-                name: puppetboard
-                port:
-                  number: 80
-            path: /
-            pathType: Prefix
-  tls:
-    - hosts:
-        - puppetboard.k8s.syd1.au.unkin.net
-      secretName: puppetboard-tls
@@ -1,34 +0,0 @@
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  annotations:
-    kubernetes.io/ingress.class: nginx
-    external-dns.alpha.kubernetes.io/hostname: puppetdb.k8s.syd1.au.unkin.net
-    external-dns.alpha.kubernetes.io/target: 198.18.200.0
-    cert-manager.io/cluster-issuer: vault-issuer
-    cert-manager.io/common-name: puppetdb.k8s.syd1.au.unkin.net
-    cert-manager.io/private-key-size: "4096"
-  labels:
-    app.kubernetes.io/component: puppetdb
-    app.kubernetes.io/instance: puppetserver
-    app.kubernetes.io/name: puppetserver
-    app.kubernetes.io/version: 8.8.0
-  name: puppetdb
-  namespace: puppet
-spec:
-  rules:
-    - host: puppetdb.k8s.syd1.au.unkin.net
-      http:
-        paths:
-          - backend:
-              service:
-                name: puppetdb
-                port:
-                  number: 8080
-            path: /
-            pathType: Prefix
-  tls:
-    - hosts:
-        - puppetdb.k8s.syd1.au.unkin.net
-      secretName: puppetdb-tls
@@ -25,8 +25,10 @@ resources:
  - horizontalpodautoscaler_puppetserver-masters-autoscaler.yaml
  - horizontalpodautoscaler_puppetserver-puppetboard-autoscaler.yaml
  - horizontalpodautoscaler_puppetserver-puppetdb-autoscaler.yaml
-  - ingress_puppetboard.yaml
-  - ingress_puppetdb.yaml
+  - gateway_puppetboard.yaml
+  - httproute_puppetboard.yaml
+  - gateway_puppetdb.yaml
+  - httproute_puppetdb.yaml
  - service_puppetserver-agents-to-puppet.yaml
  - service_puppet-headless.yaml
  - service_puppet.yaml
@@ -73,24 +73,6 @@ spec:
 ---
 apiVersion: v1
 kind: PersistentVolumeClaim
-metadata:
-  labels:
-    app.kubernetes.io/component: r10k-shared-config
-    app.kubernetes.io/instance: puppetserver
-    app.kubernetes.io/name: puppetserver
-    app.kubernetes.io/version: 8.8.0
-  name: puppetserver-shared-config
-  namespace: puppet
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1Gi
-  storageClassName: cephrbd-fast-delete
---
-apiVersion: v1
-kind: PersistentVolumeClaim
 metadata:
  labels:
    app.kubernetes.io/component: puppetboard
@@ -2,5 +2,8 @@
 set -e

 echo "Installing additional Ruby gems..."
+/opt/puppetlabs/puppet/bin/gem install deep_merge
+/opt/puppetlabs/puppet/bin/gem install ipaddr
+/opt/puppetlabs/puppet/bin/gem install hiera-eyaml
 /opt/puppetlabs/puppet/bin/gem install toml
 echo "Additional Ruby gems installed successfully"
@@ -0,0 +1,8 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - lbnodeagents.yaml
+  - servicegroups.yaml
@@ -0,0 +1,28 @@
+---
+apiVersion: purelb.io/v1
+kind: LBNodeAgent
+metadata:
+  labels:
+    app.kubernetes.io/component: lbnodeagent
+    app.kubernetes.io/name: purelb
+  name: common
+  namespace: purelb
+spec:
+  local:
+    extlbint: kube-lb0
+    localint: default
+    sendgarp: false
+---
+apiVersion: purelb.io/v1
+kind: LBNodeAgent
+metadata:
+  labels:
+    app.kubernetes.io/component: lbnodeagent
+    app.kubernetes.io/name: purelb
+  name: dmz
+  namespace: purelb
+spec:
+  local:
+    extlbint: kube-lb0
+    localint: default
+    sendgarp: false
@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    app.kubernetes.io/name: purelb
+  name: purelb
@@ -0,0 +1,30 @@
+---
+apiVersion: purelb.io/v1
+kind: ServiceGroup
+metadata:
+  labels:
+    app.kubernetes.io/component: servicegroup
+    app.kubernetes.io/name: purelb
+  name: common
+  namespace: purelb
+spec:
+  local:
+    v4pools:
+      - aggregation: /32
+        pool: 198.18.200.0/24
+        subnet: 198.18.200.0/24
+---
+apiVersion: purelb.io/v1
+kind: ServiceGroup
+metadata:
+  labels:
+    app.kubernetes.io/component: servicegroup
+    app.kubernetes.io/name: purelb
+  name: dmz
+  namespace: purelb
+spec:
+  local:
+    v4pools:
+      - aggregation: /32
+        pool: 198.18.199.0/24
+        subnet: 198.18.199.0/24
@@ -0,0 +1,18 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  labels:
+    app.kubernetes.io/component: reposync
+    app.kubernetes.io/name: reposync
+  name: dnf-conf
+  namespace: reposync
+data:
+  dnf.conf: |
+    [main]
+    gpgcheck=1
+    installonly_limit=3
+    clean_requirements_on_remove=True
+    best=True
+    skip_if_unavailable=False
+    max_parallel_downloads=6
@@ -0,0 +1,17 @@
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  labels:
+    app.kubernetes.io/component: reposync-openvox7
+    app.kubernetes.io/name: reposync
+  name: openvox7-openvox-repo
+  namespace: reposync
+data:
+  openvox.repo: |
+    [openvox]
+    name=openvox repository
+    baseurl=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/openvox/openvox7/el/9/x86_64/
+    gpgkey=https://artifactapi.k8s.syd1.au.unkin.net/api/v1/remote/openvox/GPG-KEY-openvox.pub
+    enabled=1
+    gpgcheck=1
@@ -0,0 +1,72 @@
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  labels:
+    app.kubernetes.io/component: reposync-almalinux9-appstream
+    app.kubernetes.io/name: reposync
+  name: reposync-almalinux9-appstream
+  namespace: reposync
+spec:
+  schedule: "10 2 * * *"
+  timeZone: "Australia/Sydney"
+  concurrencyPolicy: Forbid
+  suspend: false
+  successfulJobsHistoryLimit: 10
+  failedJobsHistoryLimit: 5
+  jobTemplate:
+    spec:
+      completions: 1
+      parallelism: 1
+      backoffLimit: 3
+      ttlSecondsAfterFinished: 3600
+      template:
+        spec:
+          restartPolicy: Never
+          containers:
+            - name: reposync
+              image: git.unkin.net/unkin/almalinux9-base:latest
+              imagePullPolicy: Always
+              command: ["/bin/bash", "-c"]
+              args:
+                - |
+                  set -euo pipefail
+                  echo "Starting AlmaLinux $REPO_TYPE repository sync..."
+
+                  # Install reposync
+                  dnf install -y dnf-plugins-core
+
+                  # Sync repository
+                  dnf reposync \
+                    --repoid=$REPO_TYPE \
+                    --destdir=/data \
+                    --download-metadata \
+                    --newest-only \
+                    --delete
+
+                  echo "AlmaLinux $REPO_TYPE repository sync completed successfully"
+              env:
+                - name: REPO_TYPE
+                  value: "appstream"
+              resources:
+                requests:
+                  cpu: 500m
+                  memory: 1Gi
+                limits:
+                  cpu: 2000m
+                  memory: 4Gi
+              volumeMounts:
+                - name: repodata
+                  mountPath: /data
+                  readOnly: false
+                - name: dnf-conf
+                  mountPath: /etc/dnf/dnf.conf
+                  subPath: dnf.conf
+                  readOnly: true
+          volumes:
+            - name: repodata
+              persistentVolumeClaim:
+                claimName: reposync-almalinux9-appstream-repodata
+            - name: dnf-conf
+              configMap:
+                name: dnf-conf
@@ -0,0 +1,75 @@
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  labels:
+    app.kubernetes.io/component: reposync-almalinux9-baseos
+    app.kubernetes.io/name: reposync
+  name: reposync-almalinux9-baseos
+  namespace: reposync
+spec:
+  schedule: "0 2 * * *"
+  timeZone: "Australia/Sydney"
+  concurrencyPolicy: Forbid
+  suspend: false
+  successfulJobsHistoryLimit: 10
+  failedJobsHistoryLimit: 5
+  jobTemplate:
+    spec:
+      completions: 1
+      parallelism: 1
+      backoffLimit: 3
+      ttlSecondsAfterFinished: 3600
+      template:
+        spec:
+          restartPolicy: Never
+          containers:
+            - name: reposync
+              image: git.unkin.net/unkin/almalinux9-base:latest
+              imagePullPolicy: Always
+              command: ["/bin/bash", "-c"]
+              args:
+                - |
+                  set -euo pipefail
+                  echo "Starting AlmaLinux $REPO_TYPE repository sync..."
+
+                  # Install reposync
+                  dnf install -y dnf-plugins-core
+
+                  # Create repo directory
+                  mkdir -p /data/almalinux/$REPO_TYPE
+
+                  # Sync repository
+                  dnf reposync \
+                    --repoid=$REPO_TYPE \
+                    --destdir=/data/almalinux/$REPO_TYPE \
+                    --download-metadata \
+                    --newest-only \
+                    --delete
+
+                  echo "AlmaLinux $REPO_TYPE repository sync completed successfully"
+              env:
+                - name: REPO_TYPE
+                  value: "baseos"
+              resources:
+                requests:
+                  cpu: 500m
+                  memory: 1Gi
+                limits:
+                  cpu: 2000m
+                  memory: 4Gi
+              volumeMounts:
+                - name: repodata
+                  mountPath: /data
+                  readOnly: false
+                - name: dnf-conf
+                  mountPath: /etc/dnf/dnf.conf
+                  subPath: dnf.conf
+                  readOnly: true
+          volumes:
+            - name: repodata
+              persistentVolumeClaim:
+                claimName: reposync-almalinux9-baseos-repodata
+            - name: dnf-conf
+              configMap:
+                name: dnf-conf
@@ -0,0 +1,72 @@
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  labels:
+    app.kubernetes.io/component: reposync-epel9
+    app.kubernetes.io/name: reposync
+  name: reposync-epel9
+  namespace: reposync
+spec:
+  schedule: "20 2 * * *"
+  timeZone: "Australia/Sydney"
+  concurrencyPolicy: Forbid
+  suspend: false
+  successfulJobsHistoryLimit: 10
+  failedJobsHistoryLimit: 5
+  jobTemplate:
+    spec:
+      completions: 1
+      parallelism: 1
+      backoffLimit: 3
+      ttlSecondsAfterFinished: 3600
+      template:
+        spec:
+          restartPolicy: Never
+          containers:
+            - name: reposync
+              image: git.unkin.net/unkin/almalinux9-base:latest
+              imagePullPolicy: Always
+              command: ["/bin/bash", "-c"]
+              args:
+                - |
+                  set -euo pipefail
+                  echo "Starting AlmaLinux $REPO_TYPE repository sync..."
+
+                  # Install reposync
+                  dnf install -y dnf-plugins-core
+
+                  # Sync repository
+                  dnf reposync \
+                    --repoid=$REPO_TYPE \
+                    --destdir=/data \
+                    --download-metadata \
+                    --newest-only \
+                    --delete
+
+                  echo "AlmaLinux $REPO_TYPE repository sync completed successfully"
+              env:
+                - name: REPO_TYPE
+                  value: "epel"
+              resources:
+                requests:
+                  cpu: 500m
+                  memory: 1Gi
+                limits:
+                  cpu: 2000m
+                  memory: 4Gi
+              volumeMounts:
+                - name: repodata
+                  mountPath: /data
+                  readOnly: false
+                - name: dnf-conf
+                  mountPath: /etc/dnf/dnf.conf
+                  subPath: dnf.conf
+                  readOnly: true
+          volumes:
+            - name: repodata
+              persistentVolumeClaim:
+                claimName: reposync-epel9-repodata
+            - name: dnf-conf
+              configMap:
+                name: dnf-conf
@@ -0,0 +1,78 @@
+---
+apiVersion: batch/v1
+kind: CronJob
+metadata:
+  labels:
+    app.kubernetes.io/component: reposync-openvox7
+    app.kubernetes.io/name: reposync
+  name: reposync-openvox7
+  namespace: reposync
+spec:
+  schedule: "30 2 * * *"
+  timeZone: "Australia/Sydney"
+  concurrencyPolicy: Forbid
+  suspend: false
+  successfulJobsHistoryLimit: 10
+  failedJobsHistoryLimit: 5
+  jobTemplate:
+    spec:
+      completions: 1
+      parallelism: 1
+      backoffLimit: 3
+      ttlSecondsAfterFinished: 3600
+      template:
+        spec:
+          restartPolicy: Never
+          containers:
+            - name: reposync
+              image: git.unkin.net/unkin/almalinux9-base:latest
+              imagePullPolicy: Always
+              command: ["/bin/bash", "-c"]
+              args:
+                - |
+                  set -euo pipefail
+                  echo "Starting AlmaLinux $REPO_TYPE repository sync..."
+
+                  # Install reposync
+                  dnf install -y dnf-plugins-core
+
+                  # Sync repository
+                  dnf reposync \
+                    --repoid=$REPO_TYPE \
+                    --destdir=/data \
+                    --download-metadata \
+                    --delete
+
+                  echo "AlmaLinux $REPO_TYPE repository sync completed successfully"
+              env:
+                - name: REPO_TYPE
+                  value: "openvox"
+              resources:
+                requests:
+                  cpu: 500m
+                  memory: 1Gi
+                limits:
+                  cpu: 2000m
+                  memory: 4Gi
+              volumeMounts:
+                - name: repodata
+                  mountPath: /data
+                  readOnly: false
+                - name: dnf-conf
+                  mountPath: /etc/dnf/dnf.conf
+                  subPath: dnf.conf
+                  readOnly: true
+                - name: openvox-repo
+                  mountPath: /etc/yum.repos.d/openvox.repo
+                  subPath: openvox.repo
+                  readOnly: true
+          volumes:
+            - name: repodata
+              persistentVolumeClaim:
+                claimName: reposync-openvox7-repodata
+            - name: dnf-conf
+              configMap:
+                name: dnf-conf
+            - name: openvox-repo
+              configMap:
+                name: openvox7-openvox-repo
@@ -0,0 +1,13 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - configmap_dnf-conf.yaml
+  - configmap_openvox-repo.yaml
+  - persistentvolumeclaims.yaml
+  - cronjob_reposync-almalinux9-baseos.yaml
+  - cronjob_reposync-almalinux9-appstream.yaml
+  - cronjob_reposync-epel9.yaml
+  - cronjob_reposync-openvox7.yaml
@@ -0,0 +1,7 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  labels:
+    app.kubernetes.io/name: reposync
+  name: reposync
@@ -0,0 +1,64 @@
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  labels:
+    app.kubernetes.io/component: reposync-almalinux9-baseos
+    app.kubernetes.io/name: reposync
+  name: reposync-almalinux9-baseos-repodata
+  namespace: reposync
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
+  storageClassName: cephrbd-fast-delete
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  labels:
+    app.kubernetes.io/component: reposync-almalinux9-appstream
+    app.kubernetes.io/name: reposync
+  name: reposync-almalinux9-appstream-repodata
+  namespace: reposync
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 20Gi
+  storageClassName: cephrbd-fast-delete
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  labels:
+    app.kubernetes.io/component: reposync-epel9
+    app.kubernetes.io/name: reposync
+  name: reposync-epel9-repodata
+  namespace: reposync
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 30Gi
+  storageClassName: cephrbd-fast-delete
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  labels:
+    app.kubernetes.io/component: reposync-openvox7
+    app.kubernetes.io/name: reposync
+  name: reposync-openvox7-repodata
+  namespace: reposync
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 10Gi
+  storageClassName: cephrbd-fast-delete
@@ -0,0 +1,9 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  labels:
+    traefik.io/instance: external
+  name: traefik-external
+spec:
+  controllerName: traefik.io/gateway-controller
@@ -0,0 +1,9 @@
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  labels:
+    traefik.io/instance: internal
+  name: traefik-internal
+spec:
+  controllerName: traefik.io/gateway-controller
@@ -0,0 +1,8 @@
+---
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - namespace.yaml
+  - gatewayclass-internal.yaml
+  - gatewayclass-external.yaml
@@ -0,0 +1,5 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: traefik-system
--- a/Show More
+++ b/Show More