Add codimd app.

Default value created when wild-secret-set is run.
Backup env config setup. Add --check flag to wild-config and wild-set.
2025-08-16 07:54:06 -07:00 · 2025-08-15 03:32:55 -07:00 · 2025-08-15 03:32:18 -07:00 · 2025-08-08 09:57:07 -07:00 · 2025-08-08 09:56:36 -07:00 · 2025-08-08 09:30:31 -07:00
118 changed files with 3494 additions and 1094 deletions
--- a/.cspell/custom-dictionary-workspace.txt
+++ b/.cspell/custom-dictionary-workspace.txt
@@ -10,6 +10,7 @@ dnsmasq
 envsubst
 externaldns
 ftpd
+gitea
 glddns
 gomplate
 IMMICH
--- a/.gitignore
+++ b/.gitignore
@@ -7,9 +7,9 @@ secrets.yaml
 CLAUDE.md
 **/.claude/settings.local.json

-# Wild Cloud
-**/config/secrets.env
-**/config/config.env

-# Test directory - ignore temporary files
+
+# Test directory
 test/tmp
+test/test-cloud/*
+!test/test-cloud/README.md
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -0,0 +1,9 @@
+## Contributor License Agreement (CLA)
+
+By submitting a pull request, patch, or other contribution to this project, you agree to the following terms:
+
+- You license your contribution under the GNU Affero General Public License v3 or (at your option) any later version.
+- You grant [CSTF](https://civilsociety.dev) and its maintainers the perpetual, non-exclusive right to:
+  - Use, copy, distribute, and modify your contributions as part of the project.
+  - Relicense your contributions under any FSF-approved free software license in the future.
+- You affirm that your contribution is your own original work and that you have the right to submit it.
--- a/661
+++ b/661
@@ -0,0 +1,661 @@
+                    GNU AFFERO GENERAL PUBLIC LICENSE
+                       Version 3, 19 November 2007
+
+ Copyright (C) 2007 Free Software Foundation, Inc. <https://fsf.org/>
+ Everyone is permitted to copy and distribute verbatim copies
+ of this license document, but changing it is not allowed.
+
+                            Preamble
+
+  The GNU Affero General Public License is a free, copyleft license for
+software and other kinds of works, specifically designed to ensure
+cooperation with the community in the case of network server software.
+
+  The licenses for most software and other practical works are designed
+to take away your freedom to share and change the works.  By contrast,
+our General Public Licenses are intended to guarantee your freedom to
+share and change all versions of a program--to make sure it remains free
+software for all its users.
+
+  When we speak of free software, we are referring to freedom, not
+price.  Our General Public Licenses are designed to make sure that you
+have the freedom to distribute copies of free software (and charge for
+them if you wish), that you receive source code or can get it if you
+want it, that you can change the software or use pieces of it in new
+free programs, and that you know you can do these things.
+
+  Developers that use our General Public Licenses protect your rights
+with two steps: (1) assert copyright on the software, and (2) offer
+you this License which gives you legal permission to copy, distribute
+and/or modify the software.
+
+  A secondary benefit of defending all users' freedom is that
+improvements made in alternate versions of the program, if they
+receive widespread use, become available for other developers to
+incorporate.  Many developers of free software are heartened and
+encouraged by the resulting cooperation.  However, in the case of
+software used on network servers, this result may fail to come about.
+The GNU General Public License permits making a modified version and
+letting the public access it on a server without ever releasing its
+source code to the public.
+
+  The GNU Affero General Public License is designed specifically to
+ensure that, in such cases, the modified source code becomes available
+to the community.  It requires the operator of a network server to
+provide the source code of the modified version running there to the
+users of that server.  Therefore, public use of a modified version, on
+a publicly accessible server, gives the public access to the source
+code of the modified version.
+
+  An older license, called the Affero General Public License and
+published by Affero, was designed to accomplish similar goals.  This is
+a different license, not a version of the Affero GPL, but Affero has
+released a new version of the Affero GPL which permits relicensing under
+this license.
+
+  The precise terms and conditions for copying, distribution and
+modification follow.
+
+                       TERMS AND CONDITIONS
+
+  0. Definitions.
+
+  "This License" refers to version 3 of the GNU Affero General Public License.
+
+  "Copyright" also means copyright-like laws that apply to other kinds of
+works, such as semiconductor masks.
+
+  "The Program" refers to any copyrightable work licensed under this
+License.  Each licensee is addressed as "you".  "Licensees" and
+"recipients" may be individuals or organizations.
+
+  To "modify" a work means to copy from or adapt all or part of the work
+in a fashion requiring copyright permission, other than the making of an
+exact copy.  The resulting work is called a "modified version" of the
+earlier work or a work "based on" the earlier work.
+
+  A "covered work" means either the unmodified Program or a work based
+on the Program.
+
+  To "propagate" a work means to do anything with it that, without
+permission, would make you directly or secondarily liable for
+infringement under applicable copyright law, except executing it on a
+computer or modifying a private copy.  Propagation includes copying,
+distribution (with or without modification), making available to the
+public, and in some countries other activities as well.
+
+  To "convey" a work means any kind of propagation that enables other
+parties to make or receive copies.  Mere interaction with a user through
+a computer network, with no transfer of a copy, is not conveying.
+
+  An interactive user interface displays "Appropriate Legal Notices"
+to the extent that it includes a convenient and prominently visible
+feature that (1) displays an appropriate copyright notice, and (2)
+tells the user that there is no warranty for the work (except to the
+extent that warranties are provided), that licensees may convey the
+work under this License, and how to view a copy of this License.  If
+the interface presents a list of user commands or options, such as a
+menu, a prominent item in the list meets this criterion.
+
+  1. Source Code.
+
+  The "source code" for a work means the preferred form of the work
+for making modifications to it.  "Object code" means any non-source
+form of a work.
+
+  A "Standard Interface" means an interface that either is an official
+standard defined by a recognized standards body, or, in the case of
+interfaces specified for a particular programming language, one that
+is widely used among developers working in that language.
+
+  The "System Libraries" of an executable work include anything, other
+than the work as a whole, that (a) is included in the normal form of
+packaging a Major Component, but which is not part of that Major
+Component, and (b) serves only to enable use of the work with that
+Major Component, or to implement a Standard Interface for which an
+implementation is available to the public in source code form.  A
+"Major Component", in this context, means a major essential component
+(kernel, window system, and so on) of the specific operating system
+(if any) on which the executable work runs, or a compiler used to
+produce the work, or an object code interpreter used to run it.
+
+  The "Corresponding Source" for a work in object code form means all
+the source code needed to generate, install, and (for an executable
+work) run the object code and to modify the work, including scripts to
+control those activities.  However, it does not include the work's
+System Libraries, or general-purpose tools or generally available free
+programs which are used unmodified in performing those activities but
+which are not part of the work.  For example, Corresponding Source
+includes interface definition files associated with source files for
+the work, and the source code for shared libraries and dynamically
+linked subprograms that the work is specifically designed to require,
+such as by intimate data communication or control flow between those
+subprograms and other parts of the work.
+
+  The Corresponding Source need not include anything that users
+can regenerate automatically from other parts of the Corresponding
+Source.
+
+  The Corresponding Source for a work in source code form is that
+same work.
+
+  2. Basic Permissions.
+
+  All rights granted under this License are granted for the term of
+copyright on the Program, and are irrevocable provided the stated
+conditions are met.  This License explicitly affirms your unlimited
+permission to run the unmodified Program.  The output from running a
+covered work is covered by this License only if the output, given its
+content, constitutes a covered work.  This License acknowledges your
+rights of fair use or other equivalent, as provided by copyright law.
+
+  You may make, run and propagate covered works that you do not
+convey, without conditions so long as your license otherwise remains
+in force.  You may convey covered works to others for the sole purpose
+of having them make modifications exclusively for you, or provide you
+with facilities for running those works, provided that you comply with
+the terms of this License in conveying all material for which you do
+not control copyright.  Those thus making or running the covered works
+for you must do so exclusively on your behalf, under your direction
+and control, on terms that prohibit them from making any copies of
+your copyrighted material outside their relationship with you.
+
+  Conveying under any other circumstances is permitted solely under
+the conditions stated below.  Sublicensing is not allowed; section 10
+makes it unnecessary.
+
+  3. Protecting Users' Legal Rights From Anti-Circumvention Law.
+
+  No covered work shall be deemed part of an effective technological
+measure under any applicable law fulfilling obligations under article
+11 of the WIPO copyright treaty adopted on 20 December 1996, or
+similar laws prohibiting or restricting circumvention of such
+measures.
+
+  When you convey a covered work, you waive any legal power to forbid
+circumvention of technological measures to the extent such circumvention
+is effected by exercising rights under this License with respect to
+the covered work, and you disclaim any intention to limit operation or
+modification of the work as a means of enforcing, against the work's
+users, your or third parties' legal rights to forbid circumvention of
+technological measures.
+
+  4. Conveying Verbatim Copies.
+
+  You may convey verbatim copies of the Program's source code as you
+receive it, in any medium, provided that you conspicuously and
+appropriately publish on each copy an appropriate copyright notice;
+keep intact all notices stating that this License and any
+non-permissive terms added in accord with section 7 apply to the code;
+keep intact all notices of the absence of any warranty; and give all
+recipients a copy of this License along with the Program.
+
+  You may charge any price or no price for each copy that you convey,
+and you may offer support or warranty protection for a fee.
+
+  5. Conveying Modified Source Versions.
+
+  You may convey a work based on the Program, or the modifications to
+produce it from the Program, in the form of source code under the
+terms of section 4, provided that you also meet all of these conditions:
+
+    a) The work must carry prominent notices stating that you modified
+    it, and giving a relevant date.
+
+    b) The work must carry prominent notices stating that it is
+    released under this License and any conditions added under section
+    7.  This requirement modifies the requirement in section 4 to
+    "keep intact all notices".
+
+    c) You must license the entire work, as a whole, under this
+    License to anyone who comes into possession of a copy.  This
+    License will therefore apply, along with any applicable section 7
+    additional terms, to the whole of the work, and all its parts,
+    regardless of how they are packaged.  This License gives no
+    permission to license the work in any other way, but it does not
+    invalidate such permission if you have separately received it.
+
+    d) If the work has interactive user interfaces, each must display
+    Appropriate Legal Notices; however, if the Program has interactive
+    interfaces that do not display Appropriate Legal Notices, your
+    work need not make them do so.
+
+  A compilation of a covered work with other separate and independent
+works, which are not by their nature extensions of the covered work,
+and which are not combined with it such as to form a larger program,
+in or on a volume of a storage or distribution medium, is called an
+"aggregate" if the compilation and its resulting copyright are not
+used to limit the access or legal rights of the compilation's users
+beyond what the individual works permit.  Inclusion of a covered work
+in an aggregate does not cause this License to apply to the other
+parts of the aggregate.
+
+  6. Conveying Non-Source Forms.
+
+  You may convey a covered work in object code form under the terms
+of sections 4 and 5, provided that you also convey the
+machine-readable Corresponding Source under the terms of this License,
+in one of these ways:
+
+    a) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by the
+    Corresponding Source fixed on a durable physical medium
+    customarily used for software interchange.
+
+    b) Convey the object code in, or embodied in, a physical product
+    (including a physical distribution medium), accompanied by a
+    written offer, valid for at least three years and valid for as
+    long as you offer spare parts or customer support for that product
+    model, to give anyone who possesses the object code either (1) a
+    copy of the Corresponding Source for all the software in the
+    product that is covered by this License, on a durable physical
+    medium customarily used for software interchange, for a price no
+    more than your reasonable cost of physically performing this
+    conveying of source, or (2) access to copy the
+    Corresponding Source from a network server at no charge.
+
+    c) Convey individual copies of the object code with a copy of the
+    written offer to provide the Corresponding Source.  This
+    alternative is allowed only occasionally and noncommercially, and
+    only if you received the object code with such an offer, in accord
+    with subsection 6b.
+
+    d) Convey the object code by offering access from a designated
+    place (gratis or for a charge), and offer equivalent access to the
+    Corresponding Source in the same way through the same place at no
+    further charge.  You need not require recipients to copy the
+    Corresponding Source along with the object code.  If the place to
+    copy the object code is a network server, the Corresponding Source
+    may be on a different server (operated by you or a third party)
+    that supports equivalent copying facilities, provided you maintain
+    clear directions next to the object code saying where to find the
+    Corresponding Source.  Regardless of what server hosts the
+    Corresponding Source, you remain obligated to ensure that it is
+    available for as long as needed to satisfy these requirements.
+
+    e) Convey the object code using peer-to-peer transmission, provided
+    you inform other peers where the object code and Corresponding
+    Source of the work are being offered to the general public at no
+    charge under subsection 6d.
+
+  A separable portion of the object code, whose source code is excluded
+from the Corresponding Source as a System Library, need not be
+included in conveying the object code work.
+
+  A "User Product" is either (1) a "consumer product", which means any
+tangible personal property which is normally used for personal, family,
+or household purposes, or (2) anything designed or sold for incorporation
+into a dwelling.  In determining whether a product is a consumer product,
+doubtful cases shall be resolved in favor of coverage.  For a particular
+product received by a particular user, "normally used" refers to a
+typical or common use of that class of product, regardless of the status
+of the particular user or of the way in which the particular user
+actually uses, or expects or is expected to use, the product.  A product
+is a consumer product regardless of whether the product has substantial
+commercial, industrial or non-consumer uses, unless such uses represent
+the only significant mode of use of the product.
+
+  "Installation Information" for a User Product means any methods,
+procedures, authorization keys, or other information required to install
+and execute modified versions of a covered work in that User Product from
+a modified version of its Corresponding Source.  The information must
+suffice to ensure that the continued functioning of the modified object
+code is in no case prevented or interfered with solely because
+modification has been made.
+
+  If you convey an object code work under this section in, or with, or
+specifically for use in, a User Product, and the conveying occurs as
+part of a transaction in which the right of possession and use of the
+User Product is transferred to the recipient in perpetuity or for a
+fixed term (regardless of how the transaction is characterized), the
+Corresponding Source conveyed under this section must be accompanied
+by the Installation Information.  But this requirement does not apply
+if neither you nor any third party retains the ability to install
+modified object code on the User Product (for example, the work has
+been installed in ROM).
+
+  The requirement to provide Installation Information does not include a
+requirement to continue to provide support service, warranty, or updates
+for a work that has been modified or installed by the recipient, or for
+the User Product in which it has been modified or installed.  Access to a
+network may be denied when the modification itself materially and
+adversely affects the operation of the network or violates the rules and
+protocols for communication across the network.
+
+  Corresponding Source conveyed, and Installation Information provided,
+in accord with this section must be in a format that is publicly
+documented (and with an implementation available to the public in
+source code form), and must require no special password or key for
+unpacking, reading or copying.
+
+  7. Additional Terms.
+
+  "Additional permissions" are terms that supplement the terms of this
+License by making exceptions from one or more of its conditions.
+Additional permissions that are applicable to the entire Program shall
+be treated as though they were included in this License, to the extent
+that they are valid under applicable law.  If additional permissions
+apply only to part of the Program, that part may be used separately
+under those permissions, but the entire Program remains governed by
+this License without regard to the additional permissions.
+
+  When you convey a copy of a covered work, you may at your option
+remove any additional permissions from that copy, or from any part of
+it.  (Additional permissions may be written to require their own
+removal in certain cases when you modify the work.)  You may place
+additional permissions on material, added by you to a covered work,
+for which you have or can give appropriate copyright permission.
+
+  Notwithstanding any other provision of this License, for material you
+add to a covered work, you may (if authorized by the copyright holders of
+that material) supplement the terms of this License with terms:
+
+    a) Disclaiming warranty or limiting liability differently from the
+    terms of sections 15 and 16 of this License; or
+
+    b) Requiring preservation of specified reasonable legal notices or
+    author attributions in that material or in the Appropriate Legal
+    Notices displayed by works containing it; or
+
+    c) Prohibiting misrepresentation of the origin of that material, or
+    requiring that modified versions of such material be marked in
+    reasonable ways as different from the original version; or
+
+    d) Limiting the use for publicity purposes of names of licensors or
+    authors of the material; or
+
+    e) Declining to grant rights under trademark law for use of some
+    trade names, trademarks, or service marks; or
+
+    f) Requiring indemnification of licensors and authors of that
+    material by anyone who conveys the material (or modified versions of
+    it) with contractual assumptions of liability to the recipient, for
+    any liability that these contractual assumptions directly impose on
+    those licensors and authors.
+
+  All other non-permissive additional terms are considered "further
+restrictions" within the meaning of section 10.  If the Program as you
+received it, or any part of it, contains a notice stating that it is
+governed by this License along with a term that is a further
+restriction, you may remove that term.  If a license document contains
+a further restriction but permits relicensing or conveying under this
+License, you may add to a covered work material governed by the terms
+of that license document, provided that the further restriction does
+not survive such relicensing or conveying.
+
+  If you add terms to a covered work in accord with this section, you
+must place, in the relevant source files, a statement of the
+additional terms that apply to those files, or a notice indicating
+where to find the applicable terms.
+
+  Additional terms, permissive or non-permissive, may be stated in the
+form of a separately written license, or stated as exceptions;
+the above requirements apply either way.
+
+  8. Termination.
+
+  You may not propagate or modify a covered work except as expressly
+provided under this License.  Any attempt otherwise to propagate or
+modify it is void, and will automatically terminate your rights under
+this License (including any patent licenses granted under the third
+paragraph of section 11).
+
+  However, if you cease all violation of this License, then your
+license from a particular copyright holder is reinstated (a)
+provisionally, unless and until the copyright holder explicitly and
+finally terminates your license, and (b) permanently, if the copyright
+holder fails to notify you of the violation by some reasonable means
+prior to 60 days after the cessation.
+
+  Moreover, your license from a particular copyright holder is
+reinstated permanently if the copyright holder notifies you of the
+violation by some reasonable means, this is the first time you have
+received notice of violation of this License (for any work) from that
+copyright holder, and you cure the violation prior to 30 days after
+your receipt of the notice.
+
+  Termination of your rights under this section does not terminate the
+licenses of parties who have received copies or rights from you under
+this License.  If your rights have been terminated and not permanently
+reinstated, you do not qualify to receive new licenses for the same
+material under section 10.
+
+  9. Acceptance Not Required for Having Copies.
+
+  You are not required to accept this License in order to receive or
+run a copy of the Program.  Ancillary propagation of a covered work
+occurring solely as a consequence of using peer-to-peer transmission
+to receive a copy likewise does not require acceptance.  However,
+nothing other than this License grants you permission to propagate or
+modify any covered work.  These actions infringe copyright if you do
+not accept this License.  Therefore, by modifying or propagating a
+covered work, you indicate your acceptance of this License to do so.
+
+  10. Automatic Licensing of Downstream Recipients.
+
+  Each time you convey a covered work, the recipient automatically
+receives a license from the original licensors, to run, modify and
+propagate that work, subject to this License.  You are not responsible
+for enforcing compliance by third parties with this License.
+
+  An "entity transaction" is a transaction transferring control of an
+organization, or substantially all assets of one, or subdividing an
+organization, or merging organizations.  If propagation of a covered
+work results from an entity transaction, each party to that
+transaction who receives a copy of the work also receives whatever
+licenses to the work the party's predecessor in interest had or could
+give under the previous paragraph, plus a right to possession of the
+Corresponding Source of the work from the predecessor in interest, if
+the predecessor has it or can get it with reasonable efforts.
+
+  You may not impose any further restrictions on the exercise of the
+rights granted or affirmed under this License.  For example, you may
+not impose a license fee, royalty, or other charge for exercise of
+rights granted under this License, and you may not initiate litigation
+(including a cross-claim or counterclaim in a lawsuit) alleging that
+any patent claim is infringed by making, using, selling, offering for
+sale, or importing the Program or any portion of it.
+
+  11. Patents.
+
+  A "contributor" is a copyright holder who authorizes use under this
+License of the Program or a work on which the Program is based.  The
+work thus licensed is called the contributor's "contributor version".
+
+  A contributor's "essential patent claims" are all patent claims
+owned or controlled by the contributor, whether already acquired or
+hereafter acquired, that would be infringed by some manner, permitted
+by this License, of making, using, or selling its contributor version,
+but do not include claims that would be infringed only as a
+consequence of further modification of the contributor version.  For
+purposes of this definition, "control" includes the right to grant
+patent sublicenses in a manner consistent with the requirements of
+this License.
+
+  Each contributor grants you a non-exclusive, worldwide, royalty-free
+patent license under the contributor's essential patent claims, to
+make, use, sell, offer for sale, import and otherwise run, modify and
+propagate the contents of its contributor version.
+
+  In the following three paragraphs, a "patent license" is any express
+agreement or commitment, however denominated, not to enforce a patent
+(such as an express permission to practice a patent or covenant not to
+sue for patent infringement).  To "grant" such a patent license to a
+party means to make such an agreement or commitment not to enforce a
+patent against the party.
+
+  If you convey a covered work, knowingly relying on a patent license,
+and the Corresponding Source of the work is not available for anyone
+to copy, free of charge and under the terms of this License, through a
+publicly available network server or other readily accessible means,
+then you must either (1) cause the Corresponding Source to be so
+available, or (2) arrange to deprive yourself of the benefit of the
+patent license for this particular work, or (3) arrange, in a manner
+consistent with the requirements of this License, to extend the patent
+license to downstream recipients.  "Knowingly relying" means you have
+actual knowledge that, but for the patent license, your conveying the
+covered work in a country, or your recipient's use of the covered work
+in a country, would infringe one or more identifiable patents in that
+country that you have reason to believe are valid.
+
+  If, pursuant to or in connection with a single transaction or
+arrangement, you convey, or propagate by procuring conveyance of, a
+covered work, and grant a patent license to some of the parties
+receiving the covered work authorizing them to use, propagate, modify
+or convey a specific copy of the covered work, then the patent license
+you grant is automatically extended to all recipients of the covered
+work and works based on it.
+
+  A patent license is "discriminatory" if it does not include within
+the scope of its coverage, prohibits the exercise of, or is
+conditioned on the non-exercise of one or more of the rights that are
+specifically granted under this License.  You may not convey a covered
+work if you are a party to an arrangement with a third party that is
+in the business of distributing software, under which you make payment
+to the third party based on the extent of your activity of conveying
+the work, and under which the third party grants, to any of the
+parties who would receive the covered work from you, a discriminatory
+patent license (a) in connection with copies of the covered work
+conveyed by you (or copies made from those copies), or (b) primarily
+for and in connection with specific products or compilations that
+contain the covered work, unless you entered into that arrangement,
+or that patent license was granted, prior to 28 March 2007.
+
+  Nothing in this License shall be construed as excluding or limiting
+any implied license or other defenses to infringement that may
+otherwise be available to you under applicable patent law.
+
+  12. No Surrender of Others' Freedom.
+
+  If conditions are imposed on you (whether by court order, agreement or
+otherwise) that contradict the conditions of this License, they do not
+excuse you from the conditions of this License.  If you cannot convey a
+covered work so as to satisfy simultaneously your obligations under this
+License and any other pertinent obligations, then as a consequence you may
+not convey it at all.  For example, if you agree to terms that obligate you
+to collect a royalty for further conveying from those to whom you convey
+the Program, the only way you could satisfy both those terms and this
+License would be to refrain entirely from conveying the Program.
+
+  13. Remote Network Interaction; Use with the GNU General Public License.
+
+  Notwithstanding any other provision of this License, if you modify the
+Program, your modified version must prominently offer all users
+interacting with it remotely through a computer network (if your version
+supports such interaction) an opportunity to receive the Corresponding
+Source of your version by providing access to the Corresponding Source
+from a network server at no charge, through some standard or customary
+means of facilitating copying of software.  This Corresponding Source
+shall include the Corresponding Source for any work covered by version 3
+of the GNU General Public License that is incorporated pursuant to the
+following paragraph.
+
+  Notwithstanding any other provision of this License, you have
+permission to link or combine any covered work with a work licensed
+under version 3 of the GNU General Public License into a single
+combined work, and to convey the resulting work.  The terms of this
+License will continue to apply to the part which is the covered work,
+but the work with which it is combined will remain governed by version
+3 of the GNU General Public License.
+
+  14. Revised Versions of this License.
+
+  The Free Software Foundation may publish revised and/or new versions of
+the GNU Affero General Public License from time to time.  Such new versions
+will be similar in spirit to the present version, but may differ in detail to
+address new problems or concerns.
+
+  Each version is given a distinguishing version number.  If the
+Program specifies that a certain numbered version of the GNU Affero General
+Public License "or any later version" applies to it, you have the
+option of following the terms and conditions either of that numbered
+version or of any later version published by the Free Software
+Foundation.  If the Program does not specify a version number of the
+GNU Affero General Public License, you may choose any version ever published
+by the Free Software Foundation.
+
+  If the Program specifies that a proxy can decide which future
+versions of the GNU Affero General Public License can be used, that proxy's
+public statement of acceptance of a version permanently authorizes you
+to choose that version for the Program.
+
+  Later license versions may give you additional or different
+permissions.  However, no additional obligations are imposed on any
+author or copyright holder as a result of your choosing to follow a
+later version.
+
+  15. Disclaimer of Warranty.
+
+  THERE IS NO WARRANTY FOR THE PROGRAM, TO THE EXTENT PERMITTED BY
+APPLICABLE LAW.  EXCEPT WHEN OTHERWISE STATED IN WRITING THE COPYRIGHT
+HOLDERS AND/OR OTHER PARTIES PROVIDE THE PROGRAM "AS IS" WITHOUT WARRANTY
+OF ANY KIND, EITHER EXPRESSED OR IMPLIED, INCLUDING, BUT NOT LIMITED TO,
+THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR
+PURPOSE.  THE ENTIRE RISK AS TO THE QUALITY AND PERFORMANCE OF THE PROGRAM
+IS WITH YOU.  SHOULD THE PROGRAM PROVE DEFECTIVE, YOU ASSUME THE COST OF
+ALL NECESSARY SERVICING, REPAIR OR CORRECTION.
+
+  16. Limitation of Liability.
+
+  IN NO EVENT UNLESS REQUIRED BY APPLICABLE LAW OR AGREED TO IN WRITING
+WILL ANY COPYRIGHT HOLDER, OR ANY OTHER PARTY WHO MODIFIES AND/OR CONVEYS
+THE PROGRAM AS PERMITTED ABOVE, BE LIABLE TO YOU FOR DAMAGES, INCLUDING ANY
+GENERAL, SPECIAL, INCIDENTAL OR CONSEQUENTIAL DAMAGES ARISING OUT OF THE
+USE OR INABILITY TO USE THE PROGRAM (INCLUDING BUT NOT LIMITED TO LOSS OF
+DATA OR DATA BEING RENDERED INACCURATE OR LOSSES SUSTAINED BY YOU OR THIRD
+PARTIES OR A FAILURE OF THE PROGRAM TO OPERATE WITH ANY OTHER PROGRAMS),
+EVEN IF SUCH HOLDER OR OTHER PARTY HAS BEEN ADVISED OF THE POSSIBILITY OF
+SUCH DAMAGES.
+
+  17. Interpretation of Sections 15 and 16.
+
+  If the disclaimer of warranty and limitation of liability provided
+above cannot be given local legal effect according to their terms,
+reviewing courts shall apply local law that most closely approximates
+an absolute waiver of all civil liability in connection with the
+Program, unless a warranty or assumption of liability accompanies a
+copy of the Program in return for a fee.
+
+                     END OF TERMS AND CONDITIONS
+
+            How to Apply These Terms to Your New Programs
+
+  If you develop a new program, and you want it to be of the greatest
+possible use to the public, the best way to achieve this is to make it
+free software which everyone can redistribute and change under these terms.
+
+  To do so, attach the following notices to the program.  It is safest
+to attach them to the start of each source file to most effectively
+state the exclusion of warranty; and each file should have at least
+the "copyright" line and a pointer to where the full notice is found.
+
+    <one line to give the program's name and a brief idea of what it does.>
+    Copyright (C) <year>  <name of author>
+
+    This program is free software: you can redistribute it and/or modify
+    it under the terms of the GNU Affero General Public License as published
+    by the Free Software Foundation, either version 3 of the License, or
+    (at your option) any later version.
+
+    This program is distributed in the hope that it will be useful,
+    but WITHOUT ANY WARRANTY; without even the implied warranty of
+    MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+    GNU Affero General Public License for more details.
+
+    You should have received a copy of the GNU Affero General Public License
+    along with this program.  If not, see <https://www.gnu.org/licenses/>.
+
+Also add information on how to contact you by electronic and paper mail.
+
+  If your software can interact with users remotely through a computer
+network, you should also make sure that it provides a way for users to
+get its source.  For example, if your program is a web application, its
+interface could display a "Source" link that leads users to an archive
+of the code.  There are many ways you could offer source, and different
+solutions will be better for different programs; see section 13 for the
+specific requirements.
+
+  You should also get your employer (if you work as a programmer) or school,
+if any, to sign a "copyright disclaimer" for the program, if necessary.
+For more information on this, and how to apply and follow the GNU AGPL, see
+<https://www.gnu.org/licenses/>.
--- a/0
+++ b/0
--- a/README.md
+++ b/README.md
@@ -34,4 +34,6 @@ Contributions are welcome! Please feel free to submit a Pull Request.

 ## License

-TBD
+This project is licensed under the terms of the [GNU General Public License version 3](./LICENSE) or (at your option) any later version.
+
+⚠️ By contributing to this project, you agree to the Contributor License Agreement described in [CONTRIBUTING.md](./CONTRIBUTING.md).
--- a/apps/README.md
+++ b/apps/README.md
@@ -130,9 +130,77 @@ To reference operator configuration in the configuration files, use gomplate var

 When `wild-app-add` is run, the app's Kustomize files will be compiled with the operator's Wild Cloud configuration and secrets resulting in standard Kustomize files being placed in the Wild Cloud home directory.

+#### External DNS Configuration
+
+Wild Cloud apps use external-dns annotations in their ingress resources to automatically manage DNS records:
+
+- `external-dns.alpha.kubernetes.io/target: {{ .cloud.domain }}` - Creates a CNAME record pointing the app subdomain to the main cluster domain (e.g., `ghost.cloud.payne.io` → `cloud.payne.io`)
+- `external-dns.alpha.kubernetes.io/cloudflare-proxied: "false"` - Disables Cloudflare proxy for direct DNS resolution
+
+#### Database Initialization Jobs
+
+Apps that rely on PostgreSQL or MySQL databases typically need a database initialization job to create the required database and user before the main application starts. These jobs:
+
+- Run as Kubernetes Jobs that execute once and complete
+- Create the application database if it doesn't exist
+- Create the application user with appropriate permissions
+- Should be included in the app's `kustomization.yaml` resources list
+- Use the same database connection settings as the main application
+
+Examples of apps with db-init jobs: `gitea`, `codimd`, `immich`, `openproject`
+
+##### Database URL Configuration
+
+**Important:** When apps require database URLs with embedded credentials, always use a separate `dbUrl` secret instead of trying to construct the URL with environment variable substitution in Kustomize templates.
+
+❌ **Wrong** (Kustomize cannot process runtime env var substitution):
+```yaml
+- name: DB_URL
+  value: "postgresql://user:$(DB_PASSWORD)@host/db"
+```
+
+✅ **Correct** (Use a dedicated secret):
+```yaml
+- name: DB_URL
+  valueFrom:
+    secretKeyRef:
+      name: app-secrets
+      key: apps.appname.dbUrl
+```
+
+Add `apps.appname.dbUrl` to the manifest's `requiredSecrets` and the `wild-app-add` script will generate the complete URL with embedded credentials.
+
+##### Security Context Requirements
+
+Pods must comply with Pod Security Standards. All pods should include proper security contexts to avoid deployment warnings:
+
+```yaml
+spec:
+  template:
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 999        # Use appropriate non-root user ID
+        runAsGroup: 999       # Use appropriate group ID
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+      - name: container-name
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: false  # Set to true when possible
+```
+
+For PostgreSQL init jobs, use `runAsUser: 999` (postgres user). For other database types, use the appropriate non-root user ID for that database container.
+
 #### Secrets

-Secrets are managed in the `secrets.yaml` file in the Wild Cloud home directory. The app's `manifest.yaml` should list any required secrets under `requiredSecrets`. When the app is added, default secret values will be generated and stored in the `secrets.yaml` file. Secrets are always stored and referenced in the `apps.<app-name>.<secret-name>` yaml path. When `wild-app-deploy` is run, a Secret resource will be created in the Kubernetes cluster with the name `<app-name>-secrets`, containing all secrets defined in the manifest's `requiredSecrets` key. These secrets can then be referenced in the app's Kustomize files using a `secretKeyRef`. For example, to mount a secret in an environment variable, you would use:
+Secrets are managed in the `secrets.yaml` file in the Wild Cloud home directory. The app's `manifest.yaml` should list any required secrets under `requiredSecrets`. When the app is added, default secret values will be generated and stored in the `secrets.yaml` file. Secrets are always stored and referenced in the `apps.<app-name>.<secret-name>` yaml path. When `wild-app-deploy` is run, a Secret resource will be created in the Kubernetes cluster with the name `<app-name>-secrets`, containing all secrets defined in the manifest's `requiredSecrets` key. These secrets can then be referenced in the app's Kustomize files using a `secretKeyRef`. 
+
+**Important:** Always use the full dotted path from the manifest as the secret key, not just the last segment. For example, to mount a secret in an environment variable, you would use:

 ```yaml
 env:
@@ -140,9 +208,11 @@ env:
        valueFrom:
        secretKeyRef:
            name: immich-secrets
-            key: dbPassword
+            key: apps.immich.dbPassword  # Use full dotted path, not just "dbPassword"
 ```

+This approach prevents naming conflicts between apps and makes secret keys more descriptive and consistent with the `secrets.yaml` structure.
+
 `secrets.yaml` files should not be checked in to a git repository and are ignored by default in Wild Cloud home directories. Checked in kustomize files should only reference secrets, not compile them.

 ## App Lifecycle
@@ -162,7 +232,11 @@ If you would like to contribute an app to the Wild Cloud, issue a pull request w

 ### Converting from Helm Charts

-Wild Cloud apps use Kustomize as kustomize files are simpler, more transparent, and easier to manage in a Git repository than Helm charts. If you have a Helm chart that you want to convert to a Wild Cloud app, the following example steps can simplify the process for you:
+Wild Cloud apps use Kustomize as kustomize files are simpler, more transparent, and easier to manage in a Git repository than Helm charts.
+
+IMPORTANT! If an official Helm chart is available for an app, it is recommended to convert that chart to a Wild Cloud app rather than creating a new app from scratch.
+
+If you have a Helm chart that you want to convert to a Wild Cloud app, the following example steps can simplify the process for you:

 ```bash
 helm fetch --untar --untardir charts nginx-stable/nginx-ingress
@@ -187,3 +261,15 @@ After running these commands against your own Helm chart, you will have a Kustom
  - Use `component: web`, `component: worker`, etc. in selectors and pod template labels
  - Let Kustomize handle the common labels (`app`, `managedBy`, `partOf`) automatically
 - remove any Helm-specific labels from the Kustomize files, as Wild Cloud apps do not use Helm labels.
+
+## Notice: Third-Party Software
+
+The Kubernetes manifests and Kustomize files in this directory are designed to deploy **third-party software**.
+
+Unless otherwise stated, the software deployed by these manifests **is not authored or maintained** by this project. All copyrights, licenses, and responsibilities for that software remain with the respective upstream authors.
+
+These files are provided solely for convenience and automation. Users are responsible for reviewing and complying with the licenses of the software they deploy.
+
+This project is licensed under the GNU AGPLv3 or later, but this license does **not apply** to the third-party software being deployed.
+
+See individual deployment directories for upstream project links and container sources.
--- a/apps/codimd/db-init-job.yaml
+++ b/apps/codimd/db-init-job.yaml
@@ -0,0 +1,51 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: codimd-db-init
+  labels:
+    component: db-init
+spec:
+  template:
+    metadata:
+      labels:
+        component: db-init
+    spec:
+      containers:
+        - name: db-init
+          image: {{ .apps.postgres.image }}
+          command: ["/bin/bash", "-c"]
+          args:
+            - |
+              PGPASSWORD=${POSTGRES_ADMIN_PASSWORD} psql -h ${DB_HOSTNAME} -U postgres <<EOF
+              DO \$\$
+              BEGIN
+                IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = '${DB_USERNAME}') THEN
+                  CREATE USER ${DB_USERNAME} WITH ENCRYPTED PASSWORD '${DB_PASSWORD}';
+                ELSE
+                  ALTER USER ${DB_USERNAME} WITH ENCRYPTED PASSWORD '${DB_PASSWORD}';
+                END IF;
+              END
+              \$\$;
+
+              SELECT 'CREATE DATABASE ${DB_DATABASE_NAME}' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = '${DB_DATABASE_NAME}')\gexec
+              ALTER DATABASE ${DB_DATABASE_NAME} OWNER TO ${DB_USERNAME};
+              GRANT ALL PRIVILEGES ON DATABASE ${DB_DATABASE_NAME} TO ${DB_USERNAME};
+              EOF
+          env:
+            - name: POSTGRES_ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: postgres-secrets
+                  key: apps.postgres.password
+            - name: DB_HOSTNAME
+              value: "{{ .apps.codimd.dbHost }}"
+            - name: DB_DATABASE_NAME
+              value: "{{ .apps.codimd.dbName }}"
+            - name: DB_USERNAME
+              value: "{{ .apps.codimd.dbUser }}"
+            - name: DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: codimd-secrets
+                  key: apps.codimd.dbPassword
+      restartPolicy: OnFailure
--- a/apps/codimd/deployment.yaml
+++ b/apps/codimd/deployment.yaml
@@ -0,0 +1,113 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: codimd
+  namespace: codimd
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      component: web
+  template:
+    metadata:
+      labels:
+        component: web
+    spec:
+      securityContext:
+        fsGroup: 1500
+        runAsGroup: 1500
+        runAsNonRoot: true
+        runAsUser: 1500
+      containers:
+        - name: codimd
+          image: "{{ .apps.codimd.image }}"
+          imagePullPolicy: IfNotPresent
+          env:
+            - name: CMD_DOMAIN
+              value: "{{ .apps.codimd.domain }}"
+            - name: CMD_URL_ADDPORT
+              value: "false"
+            - name: CMD_PROTOCOL_USESSL
+              value: "{{ .apps.codimd.useSSL }}"
+            - name: CMD_USECDN
+              value: "{{ .apps.codimd.useCDN }}"
+            - name: CMD_DB_URL
+              value: "postgres://{{ .apps.codimd.dbUser }}:$(CMD_DB_PASSWORD)@{{ .apps.codimd.dbHost }}:{{ .apps.codimd.dbPort }}/{{ .apps.codimd.dbName }}"
+            - name: CMD_DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: codimd-secrets
+                  key: apps.codimd.dbPassword
+            - name: CMD_SESSION_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: codimd-secrets
+                  key: apps.codimd.sessionSecret
+            - name: CMD_SESSION_LIFE
+              value: "{{ .apps.codimd.sessionLifeTime }}"
+            - name: CMD_HSTS_ENABLE
+              value: "{{ .apps.codimd.hstsEnable }}"
+            - name: CMD_HSTS_MAX_AGE
+              value: "{{ .apps.codimd.hstsMaxAge }}"
+            - name: CMD_HSTS_INCLUDE_SUBDOMAINS
+              value: "false"
+            - name: CMD_HSTS_PRELOAD
+              value: "true"
+            - name: CMD_CSP_ENABLE
+              value: "{{ .apps.codimd.cspEnable }}"
+            - name: CMD_ALLOW_GRAVATAR
+              value: "{{ .apps.codimd.allowGravatar }}"
+            - name: CMD_RESPONSE_MAX_LAG
+              value: "70"
+            - name: CMD_IMAGE_UPLOAD_TYPE
+              value: "{{ .apps.codimd.imageUploadType }}"
+            - name: CMD_ALLOW_FREEURL
+              value: "{{ .apps.codimd.allowFreeURL }}"
+            - name: CMD_FORBIDDEN_NOTE_IDS
+              value: "robots.txt,favicon.ico,api"
+            - name: CMD_DEFAULT_PERMISSION
+              value: "{{ .apps.codimd.defaultPermission }}"
+            - name: CMD_ALLOW_ANONYMOUS_EDITS
+              value: "{{ .apps.codimd.allowAnonymousEdits }}"
+            - name: CMD_ALLOW_ANONYMOUS_VIEWS
+              value: "{{ .apps.codimd.allowAnonymousViews }}"
+            - name: CMD_ALLOW_PDF_EXPORT
+              value: "{{ .apps.codimd.allowPdfExport }}"
+            - name: CMD_DEFAULT_USE_HARD_BREAK
+              value: "{{ .apps.codimd.useHardBreak }}"
+            - name: CMD_LINKIFY_HEADER_STYLE
+              value: "{{ .apps.codimd.linkifyHeaderStyle }}"
+            - name: CMD_AUTO_VERSION_CHECK
+              value: "{{ .apps.codimd.autoVersionCheck }}"
+          ports:
+            - name: http
+              containerPort: {{ .apps.codimd.port }}
+          volumeMounts:
+            - mountPath: /home/hackmd/app/public/uploads
+              name: uploads
+          readinessProbe:
+            httpGet:
+              port: {{ .apps.codimd.port }}
+              path: /status
+            initialDelaySeconds: 3
+            failureThreshold: 2
+            successThreshold: 3
+            timeoutSeconds: 2
+            periodSeconds: 5
+          livenessProbe:
+            failureThreshold: 3
+            httpGet:
+              path: /status
+              port: {{ .apps.codimd.port }}
+              scheme: HTTP
+            initialDelaySeconds: 3
+            periodSeconds: 5
+            successThreshold: 1
+            timeoutSeconds: 2
+      restartPolicy: Always
+      volumes:
+        - name: uploads
+          persistentVolumeClaim:
+            claimName: codimd-uploads
--- a/apps/codimd/ingress.yaml
+++ b/apps/codimd/ingress.yaml
@@ -0,0 +1,24 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: codimd-public
+  namespace: codimd
+  annotations:
+    external-dns.alpha.kubernetes.io/target: "{{ .apps.codimd.domain }}"
+    external-dns.alpha.kubernetes.io/cloudflare-proxied: "false"
+spec:
+  rules:
+    - host: "{{ .apps.codimd.domain }}"
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: codimd
+                port:
+                  number: 3000
+  tls:
+    - secretName: wildcard-wild-cloud-tls
+      hosts:
+        - "{{ .apps.codimd.domain }}"
--- a/apps/codimd/kustomization.yaml
+++ b/apps/codimd/kustomization.yaml
@@ -0,0 +1,16 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: codimd
+labels:
+  - includeSelectors: true
+    pairs:
+      app: codimd
+      managedBy: kustomize
+      partOf: wild-cloud
+resources:
+  - namespace.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml
+  - pvc.yaml
+  - db-init-job.yaml
--- a/apps/codimd/manifest.yaml
+++ b/apps/codimd/manifest.yaml
@@ -0,0 +1,37 @@
+name: codimd
+description: CodiMD is a realtime collaborative markdown notes editor
+version: 2.5.1
+icon: https://github.com/hackmdio/codimd/raw/master/public/logo.png
+requires:
+  - name: postgres
+defaultConfig:
+  image: nabo.codimd.dev/hackmdio/hackmd:2.5.1
+  domain: codimd.{{ .cloud.domain }}
+  port: 3000
+  storage: 10Gi
+  dbName: codimd
+  dbUser: codimd
+  dbHost: postgres.postgres.svc.cluster.local
+  dbPort: 5432
+  timezone: UTC
+  useSSL: false
+  useCDN: false
+  allowFreeURL: false
+  defaultPermission: editable
+  allowAnonymousEdits: true
+  allowAnonymousViews: true
+  allowPdfExport: false
+  allowGravatar: true
+  imageUploadType: filesystem
+  sessionLifeTime: 1209600000
+  hstsEnable: true
+  hstsMaxAge: 31536000
+  cspEnable: true
+  autoVersionCheck: true
+  useHardBreak: true
+  linkifyHeaderStyle: keep-case
+  tlsSecretName: wildcard-wild-cloud-tls
+requiredSecrets:
+  - apps.codimd.dbPassword
+  - apps.codimd.sessionSecret
+  - apps.codimd.dbUrl
--- a/apps/codimd/namespace.yaml
+++ b/apps/codimd/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: codimd
--- a/apps/codimd/pvc.yaml
+++ b/apps/codimd/pvc.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: codimd-uploads
+  namespace: codimd
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: "{{ .apps.codimd.storage }}"
--- a/apps/codimd/service.yaml
+++ b/apps/codimd/service.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: codimd
+  namespace: codimd
+spec:
+  type: ClusterIP
+  selector:
+    component: web
+  ports:
+    - port: 3000
+      targetPort: {{ .apps.codimd.port }}
--- a/apps/discourse/configmap.yaml
+++ b/apps/discourse/configmap.yaml
@@ -0,0 +1,43 @@
+---
+# Source: discourse/templates/configmaps.yaml
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: discourse
+  namespace: discourse
+data:
+  DISCOURSE_HOSTNAME: "{{ .apps.discourse.domain }}"
+  DISCOURSE_SKIP_INSTALL: "no"
+  DISCOURSE_SITE_NAME: "{{ .apps.discourse.siteName }}"
+  DISCOURSE_USERNAME: "{{ .apps.discourse.adminUsername }}"
+  DISCOURSE_EMAIL: "{{ .apps.discourse.adminEmail }}"
+  DISCOURSE_REDIS_HOST: "{{ .apps.discourse.redisHostname }}"
+  DISCOURSE_REDIS_PORT_NUMBER: "6379"
+  DISCOURSE_DATABASE_HOST: "{{ .apps.discourse.dbHostname }}"
+  DISCOURSE_DATABASE_PORT_NUMBER: "5432"
+  DISCOURSE_DATABASE_NAME: "{{ .apps.discourse.dbName }}"
+  DISCOURSE_DATABASE_USER: "{{ .apps.discourse.dbUsername }}"
+
+  # DISCOURSE_SMTP_ADDRESS: "{{ .apps.discourse.smtp.host }}"
+  # DISCOURSE_SMTP_PORT: "{{ .apps.discourse.smtp.port }}"
+  # DISCOURSE_SMTP_USER_NAME: "{{ .apps.discourse.smtp.user }}"
+  # DISCOURSE_SMTP_ENABLE_START_TLS: "{{ .apps.discourse.smtp.startTls }}"
+  # DISCOURSE_SMTP_AUTHENTICATION: "login"
+
+  # Bitnami specific environment variables (diverges from the original)
+  # https://techdocs.broadcom.com/us/en/vmware-tanzu/bitnami-secure-images/bitnami-secure-images/services/bsi-app-doc/apps-containers-discourse-index.html
+  DISCOURSE_SMTP_HOST: "{{ .apps.discourse.smtp.host }}"
+  DISCOURSE_SMTP_PORT_NUMBER: "{{ .apps.discourse.smtp.port }}"
+  DISCOURSE_SMTP_USER: "{{ .apps.discourse.smtp.user }}"
+  DISCOURSE_SMTP_ENABLE_START_TLS: "{{ .apps.discourse.smtp.startTls }}"
+  DISCOURSE_SMTP_AUTH: "login"
+  DISCOURSE_SMTP_PROTOCOL: "tls"
+
+  DISCOURSE_PRECOMPILE_ASSETS: "false"
+
+  # SMTP_HOST: "{{ .apps.discourse.smtp.host }}"
+  # SMTP_PORT: "{{ .apps.discourse.smtp.port }}"
+  # SMTP_USER_NAME: "{{ .apps.discourse.smtp.user }}"
+  # SMTP_TLS: "{{ .apps.discourse.smtp.tls }}"
+  # SMTP_ENABLE_START_TLS: "{{ .apps.discourse.smtp.startTls }}"
+  # SMTP_AUTHENTICATION: "login"
--- a/apps/discourse/db-init-job.yaml
+++ b/apps/discourse/db-init-job.yaml
@@ -0,0 +1,77 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: discourse-db-init
+  namespace: discourse
+spec:
+  template:
+    metadata:
+      labels:
+        component: db-init
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 999
+        runAsGroup: 999
+        seccompProfile:
+          type: RuntimeDefault
+      restartPolicy: OnFailure
+      containers:
+      - name: db-init
+        image: postgres:16-alpine
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: false
+        env:
+        - name: PGHOST
+          value: "{{ .apps.discourse.dbHostname }}"
+        - name: PGPORT
+          value: "5432"
+        - name: PGUSER
+          value: postgres
+        - name: PGPASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: discourse-secrets
+              key: apps.postgres.password
+        - name: DISCOURSE_DB_USER
+          value: "{{ .apps.discourse.dbUsername }}"
+        - name: DISCOURSE_DB_NAME
+          value: "{{ .apps.discourse.dbName }}"
+        - name: DISCOURSE_DB_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: discourse-secrets
+              key: apps.discourse.dbPassword
+        command:
+        - /bin/sh
+        - -c
+        - |
+          echo "Initializing Discourse database..."
+          
+          # Create database if it doesn't exist
+          if ! psql -lqt | cut -d \| -f 1 | grep -qw "$DISCOURSE_DB_NAME"; then
+            echo "Creating database $DISCOURSE_DB_NAME..."
+            createdb "$DISCOURSE_DB_NAME"
+          else
+            echo "Database $DISCOURSE_DB_NAME already exists."
+          fi
+          
+          # Create user if it doesn't exist and grant permissions
+          psql -d "$DISCOURSE_DB_NAME" -c "
+            DO \$\$
+            BEGIN
+              IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = '$DISCOURSE_DB_USER') THEN
+                CREATE USER $DISCOURSE_DB_USER WITH PASSWORD '$DISCOURSE_DB_PASSWORD';
+              END IF;
+            END
+            \$\$;
+            GRANT ALL PRIVILEGES ON DATABASE $DISCOURSE_DB_NAME TO $DISCOURSE_DB_USER;
+            GRANT ALL ON SCHEMA public TO $DISCOURSE_DB_USER;
+            GRANT USAGE ON SCHEMA public TO $DISCOURSE_DB_USER;
+          "
+          
+          echo "Database initialization completed."
--- a/apps/discourse/deployment.yaml
+++ b/apps/discourse/deployment.yaml
@@ -0,0 +1,236 @@
+---
+# Source: discourse/templates/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: discourse
+  namespace: discourse
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      component: web
+  strategy:
+    type: Recreate
+  template:
+    metadata:
+      labels:
+        component: web
+    spec:
+      automountServiceAccountToken: false
+      affinity:
+        podAntiAffinity:
+          preferredDuringSchedulingIgnoredDuringExecution:
+            - podAffinityTerm:
+                labelSelector:
+                  matchLabels:
+                    component: web
+                topologyKey: kubernetes.io/hostname
+              weight: 1
+
+      serviceAccountName: discourse
+      securityContext:
+        fsGroup: 0
+        fsGroupChangePolicy: Always
+        supplementalGroups: []
+        sysctls: []
+      initContainers:
+      containers:
+        - name: discourse
+          image: { { .apps.discourse.image } }
+          imagePullPolicy: "IfNotPresent"
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              add:
+                - CHOWN
+                - SYS_CHROOT
+                - FOWNER
+                - SETGID
+                - SETUID
+                - DAC_OVERRIDE
+              drop:
+                - ALL
+            privileged: false
+            readOnlyRootFilesystem: false
+            runAsGroup: 0
+            runAsNonRoot: false
+            runAsUser: 0
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
+          env:
+            - name: BITNAMI_DEBUG
+              value: "false"
+            - name: DISCOURSE_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: discourse-secrets
+                  key: apps.discourse.adminPassword
+            - name: DISCOURSE_PORT_NUMBER
+              value: "8080"
+            - name: DISCOURSE_EXTERNAL_HTTP_PORT_NUMBER
+              value: "80"
+            - name: DISCOURSE_DATABASE_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: discourse-secrets
+                  key: apps.discourse.dbPassword
+            - name: POSTGRESQL_CLIENT_CREATE_DATABASE_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: discourse-secrets
+                  key: apps.discourse.dbPassword
+            - name: DISCOURSE_REDIS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: discourse-secrets
+                  key: apps.discourse.redisPassword
+            - name: DISCOURSE_SECRET_KEY_BASE
+              valueFrom:
+                secretKeyRef:
+                  name: discourse-secrets
+                  key: apps.discourse.secretKeyBase
+            - name: DISCOURSE_SMTP_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: discourse-secrets
+                  key: apps.discourse.smtpPassword
+            - name: SMTP_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: discourse-secrets
+                  key: apps.discourse.smtpPassword
+          envFrom:
+            - configMapRef:
+                name: discourse
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          livenessProbe:
+            tcpSocket:
+              port: http
+            initialDelaySeconds: 500
+            periodSeconds: 10
+            timeoutSeconds: 5
+            successThreshold: 1
+            failureThreshold: 6
+          readinessProbe:
+            httpGet:
+              path: /srv/status
+              port: http
+            initialDelaySeconds: 180
+            periodSeconds: 10
+            timeoutSeconds: 5
+            successThreshold: 1
+            failureThreshold: 6
+          resources:
+            limits:
+              cpu: 1
+              ephemeral-storage: 2Gi
+              memory: 8Gi # for precompiling assets!
+            requests:
+              cpu: 750m
+              ephemeral-storage: 50Mi
+              memory: 1Gi
+          volumeMounts:
+            - name: discourse-data
+              mountPath: /bitnami/discourse
+              subPath: discourse
+        - name: sidekiq
+          image: { { .apps.discourse.sidekiqImage } }
+          imagePullPolicy: "IfNotPresent"
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              add:
+                - CHOWN
+                - SYS_CHROOT
+                - FOWNER
+                - SETGID
+                - SETUID
+                - DAC_OVERRIDE
+              drop:
+                - ALL
+            privileged: false
+            readOnlyRootFilesystem: false
+            runAsGroup: 0
+            runAsNonRoot: false
+            runAsUser: 0
+            seLinuxOptions: {}
+            seccompProfile:
+              type: RuntimeDefault
+          command:
+            - /opt/bitnami/scripts/discourse/entrypoint.sh
+          args:
+            - /opt/bitnami/scripts/discourse-sidekiq/run.sh
+          env:
+            - name: BITNAMI_DEBUG
+              value: "false"
+            - name: DISCOURSE_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: discourse-secrets
+                  key: apps.discourse.adminPassword
+            - name: DISCOURSE_POSTGRESQL_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: discourse-secrets
+                  key: apps.discourse.dbPassword
+            - name: DISCOURSE_REDIS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: discourse-secrets
+                  key: apps.discourse.redisPassword
+            - name: DISCOURSE_SECRET_KEY_BASE
+              valueFrom:
+                secretKeyRef:
+                  name: discourse-secrets
+                  key: apps.discourse.secretKeyBase
+            - name: DISCOURSE_SMTP_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: discourse-secrets
+                  key: apps.discourse.smtpPassword
+            - name: SMTP_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: discourse-secrets
+                  key: apps.discourse.smtpPassword
+          envFrom:
+            - configMapRef:
+                name: discourse
+          livenessProbe:
+            exec:
+              command: ["/bin/sh", "-c", "pgrep -f ^sidekiq"]
+            initialDelaySeconds: 500
+            periodSeconds: 10
+            timeoutSeconds: 5
+            successThreshold: 1
+            failureThreshold: 6
+          readinessProbe:
+            exec:
+              command: ["/bin/sh", "-c", "pgrep -f ^sidekiq"]
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            timeoutSeconds: 5
+            successThreshold: 1
+            failureThreshold: 6
+          resources:
+            limits:
+              cpu: 500m
+              ephemeral-storage: 2Gi
+              memory: 768Mi
+            requests:
+              cpu: 375m
+              ephemeral-storage: 50Mi
+              memory: 512Mi
+          volumeMounts:
+            - name: discourse-data
+              mountPath: /bitnami/discourse
+              subPath: discourse
+      volumes:
+        - name: discourse-data
+          persistentVolumeClaim:
+            claimName: discourse
--- a/apps/discourse/ingress.yaml
+++ b/apps/discourse/ingress.yaml
@@ -0,0 +1,26 @@
+---
+# Source: discourse/templates/ingress.yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: discourse
+  namespace: "discourse"
+  annotations:
+    external-dns.alpha.kubernetes.io/cloudflare-proxied: "false"
+    external-dns.alpha.kubernetes.io/target: "{{ .cloud.domain }}"
+spec:
+  rules:
+    - host: "{{ .apps.discourse.domain }}"
+      http:
+        paths:
+          - path: /
+            pathType: ImplementationSpecific
+            backend:
+              service:
+                name: discourse
+                port:
+                  name: http
+  tls:
+    - hosts:
+        - "{{ .apps.discourse.domain }}"
+      secretName: wildcard-external-wild-cloud-tls
--- a/apps/discourse/kustomization.yaml
+++ b/apps/discourse/kustomization.yaml
@@ -0,0 +1,18 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: discourse
+labels:
+  - includeSelectors: true
+    pairs:
+      app: discourse
+      managedBy: kustomize
+      partOf: wild-cloud
+resources:
+  - namespace.yaml
+  - serviceaccount.yaml
+  - configmap.yaml
+  - pvc.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml
+  - db-init-job.yaml
--- a/apps/discourse/manifest.yaml
+++ b/apps/discourse/manifest.yaml
@@ -0,0 +1,38 @@
+name: discourse
+description: Discourse is a modern, open-source discussion platform designed for online communities and forums.
+version: 3.4.7
+icon: https://www.discourse.org/img/icon.png
+requires:
+  - name: postgres
+  - name: redis
+defaultConfig:
+  image: docker.io/bitnami/discourse:3.4.7-debian-12-r0
+  sidekiqImage: docker.io/bitnami/discourse:3.4.7-debian-12-r0
+  timezone: UTC
+  port: 8080
+  storage: 10Gi
+  adminEmail: admin@{{ .cloud.domain }}
+  adminUsername: admin
+  siteName: "Community"
+  domain: discourse.{{ .cloud.domain }}
+  dbHostname: postgres.postgres.svc.cluster.local
+  dbUsername: discourse
+  dbName: discourse
+  redisHostname: redis.redis.svc.cluster.local
+  tlsSecretName: wildcard-wild-cloud-tls
+  smtp:
+    enabled: false
+    host: "{{ .cloud.smtp.host }}"
+    port: "{{ .cloud.smtp.port }}"
+    user: "{{ .cloud.smtp.user }}"
+    from: "{{ .cloud.smtp.from }}"
+    tls: {{ .cloud.smtp.tls }}
+    startTls: {{ .cloud.smtp.startTls }}
+requiredSecrets:
+  - apps.discourse.adminPassword
+  - apps.discourse.dbPassword
+  - apps.discourse.dbUrl
+  - apps.discourse.redisPassword
+  - apps.discourse.secretKeyBase
+  - apps.discourse.smtpPassword
+  - apps.postgres.password
--- a/apps/discourse/namespace.yaml
+++ b/apps/discourse/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: discourse
--- a/apps/discourse/pvc.yaml
+++ b/apps/discourse/pvc.yaml
@@ -0,0 +1,13 @@
+---
+# Source: discourse/templates/pvc.yaml
+kind: PersistentVolumeClaim
+apiVersion: v1
+metadata:
+  name: discourse
+  namespace: discourse
+spec:
+  accessModes:
+    - "ReadWriteOnce"
+  resources:
+    requests:
+      storage: "{{ .apps.discourse.storage }}"
--- a/apps/discourse/service.yaml
+++ b/apps/discourse/service.yaml
@@ -0,0 +1,18 @@
+---
+# Source: discourse/templates/service.yaml
+apiVersion: v1
+kind: Service
+metadata:
+  name: discourse
+  namespace: discourse
+spec:
+  type: ClusterIP
+  sessionAffinity: None
+  ports:
+    - name: http
+      port: 80
+      protocol: TCP
+      targetPort: http
+      nodePort: null
+  selector:
+    component: web
--- a/apps/discourse/serviceaccount.yaml
+++ b/apps/discourse/serviceaccount.yaml
@@ -0,0 +1,8 @@
+---
+# Source: discourse/templates/serviceaccount.yaml
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: discourse
+  namespace: discourse
+automountServiceAccountToken: false
--- a/apps/example-admin/manifest.yaml
+++ b/apps/example-admin/manifest.yaml
@@ -2,3 +2,5 @@ name: example-admin
 install: true
 description: An example application that is deployed with internal-only access.
 version: 1.0.0
+defaultConfig:
+  tlsSecretName: wildcard-internal-wild-cloud-tls
--- a/apps/example-app/manifest.yaml
+++ b/apps/example-app/manifest.yaml
@@ -2,3 +2,5 @@ name: example-app
 install: true
 description: An example application that is deployed with public access.
 version: 1.0.0
+defaultConfig:
+  tlsSecretName: wildcard-wild-cloud-tls
--- a/apps/future-apps.md
+++ b/apps/future-apps.md
@@ -1,36 +0,0 @@
-# Future Apps to be added to Wild Cloud
-
-## Productivity
-
- [Affine](https://docs.affine.pro/self-host-affine): A collaborative document editor with a focus on real-time collaboration and rich media support.
- [Vaultwarden](https://github.com/dani-garcia/vaultwarden): A lightweight, self-hosted password manager that is compatible with Bitwarden clients.
-
-## Automation
-
- [Home Assistant](https://www.home-assistant.io/installation/linux): A powerful home automation platform that focuses on privacy and local control.
-
-## Social
-
- [Mastodon](https://docs.joinmastodon.org/admin/install/): A decentralized social network server that allows users to create their own instances.
-
-## Development
-
- [Gitea](https://docs.gitea.io/en-us/install-from-binary/): A self-hosted Git service that is lightweight and easy to set up.
-
-## Media
-
- [Jellyfin](https://jellyfin.org/downloads/server): A free software media system that allows you to organize, manage, and share your media files.
- [Glance](https://github.com/glanceapp/glance): RSS aggregator.
-
-## Collaboration
-
- [Discourse](https://github.com/discourse/discourse): A modern forum software that is designed for community engagement and discussion.
- [Mattermost](https://docs.mattermost.com/guides/install.html): An open-source messaging platform that provides team collaboration features similar to Slack.
- [Outline](https://docs.getoutline.com/install): A collaborative knowledge base and wiki platform that allows teams to create and share documentation.
- [Rocket.Chat](https://rocket.chat/docs/installation/manual-installation/): An open-source team communication platform that provides real-time messaging, video conferencing, and file sharing.
-
-## Infrastructure
-
- [Umami](https://umami.is/docs/installation): A self-hosted web analytics solution that provides insights into website traffic and user behavior.
- [Authelia](https://authelia.com/docs/): A self-hosted authentication and authorization server that provides two-factor authentication and single sign-on capabilities.
-
--- a/apps/ghost/config/example.env
+++ b/apps/ghost/config/example.env
@@ -1,13 +0,0 @@
-GHOST_NAMESPACE=ghost
-GHOST_HOST=blog.${DOMAIN}
-GHOST_TITLE="My Blog"
-GHOST_EMAIL=
-GHOST_STORAGE_SIZE=10Gi
-GHOST_MARIADB_STORAGE_SIZE=8Gi
-GHOST_DATABASE_HOST=mariadb.mariadb.svc.cluster.local
-GHOST_DATABASE_USER=ghost
-GHOST_DATABASE_NAME=ghost
-
-# Secrets
-GHOST_PASSWORD=
-GHOST_DATABASE_PASSWORD=
--- a/apps/ghost/db-init-job.yaml
+++ b/apps/ghost/db-init-job.yaml
@@ -0,0 +1,44 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: ghost-db-init
+  labels:
+    component: db-init
+spec:
+  template:
+    metadata:
+      labels:
+        component: db-init
+    spec:
+      containers:
+        - name: db-init
+          image: {{ .apps.mysql.image }}
+          command: ["/bin/bash", "-c"]
+          args:
+            - |
+              mysql -h ${DB_HOSTNAME} -P ${DB_PORT} -u root -p${MYSQL_ROOT_PASSWORD} <<EOF
+              CREATE DATABASE IF NOT EXISTS ${DB_DATABASE_NAME};
+              CREATE USER IF NOT EXISTS '${DB_USERNAME}'@'%' IDENTIFIED BY '${DB_PASSWORD}';
+              GRANT ALL PRIVILEGES ON ${DB_DATABASE_NAME}.* TO '${DB_USERNAME}'@'%';
+              FLUSH PRIVILEGES;
+              EOF
+          env:
+            - name: MYSQL_ROOT_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: mysql-secrets
+                  key: apps.mysql.rootPassword
+            - name: DB_HOSTNAME
+              value: "{{ .apps.ghost.dbHost }}"
+            - name: DB_PORT
+              value: "{{ .apps.ghost.dbPort }}"
+            - name: DB_DATABASE_NAME
+              value: "{{ .apps.ghost.dbName }}"
+            - name: DB_USERNAME
+              value: "{{ .apps.ghost.dbUser }}"
+            - name: DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: ghost-secrets
+                  key: apps.ghost.dbPassword
+      restartPolicy: OnFailure
--- a/apps/ghost/deployment.yaml
+++ b/apps/ghost/deployment.yaml
@@ -1,111 +1,26 @@
-kind: Deployment
 apiVersion: apps/v1
+kind: Deployment
 metadata:
  name: ghost
  namespace: ghost
-  uid: d01c62ff-68a6-456a-a630-77c730bffc9b
-  resourceVersion: "2772014"
-  generation: 1
-  creationTimestamp: "2025-04-27T02:01:30Z"
-  labels:
-    app.kubernetes.io/component: ghost
-    app.kubernetes.io/instance: ghost
-    app.kubernetes.io/managed-by: Wild
-    app.kubernetes.io/name: ghost
-    app.kubernetes.io/version: 5.118.1
-  annotations:
-    deployment.kubernetes.io/revision: "1"
-    meta.helm.sh/release-name: ghost
-    meta.helm.sh/release-namespace: ghost
 spec:
  replicas: 1
+  strategy:
+    type: Recreate
  selector:
    matchLabels:
-      app.kubernetes.io/instance: ghost
-      app.kubernetes.io/name: ghost
+      component: web
  template:
    metadata:
-      creationTimestamp: null
      labels:
-        app.kubernetes.io/component: ghost
-        app.kubernetes.io/instance: ghost
-        app.kubernetes.io/managed-by: Wild
-        app.kubernetes.io/name: ghost
-        app.kubernetes.io/version: 5.118.1
-      annotations:
-        checksum/secrets: b1cef92e7f73650dddfb455a7519d7b2bcf051c9cb9136b34f504ee120c63ae6
+        component: web
    spec:
-      volumes:
-        - name: empty-dir
-          emptyDir: {}
-        - name: ghost-secrets
-          projected:
-            sources:
-              - secret:
-                  name: ghost-mysql
-              - secret:
-                  name: ghost
-            defaultMode: 420
-        - name: ghost-data
-          persistentVolumeClaim:
-            claimName: ghost
-      initContainers:
-        - name: prepare-base-dir
-          image: docker.io/bitnami/ghost:5.118.1-debian-12-r0
-          command:
-            - /bin/bash
-          args:
-            - "-ec"
-            - >
-              #!/bin/bash
-
-
-              . /opt/bitnami/scripts/liblog.sh
-
-
-              info "Copying base dir to empty dir"
-
-              # In order to not break the application functionality (such as
-              upgrades or plugins) we need
-
-              # to make the base directory writable, so we need to copy it to an
-              empty dir volume
-
-              cp -r --preserve=mode /opt/bitnami/ghost /emptydir/app-base-dir
-          resources:
-            limits:
-              cpu: 375m
-              ephemeral-storage: 2Gi
-              memory: 384Mi
-            requests:
-              cpu: 250m
-              ephemeral-storage: 50Mi
-              memory: 256Mi
-          volumeMounts:
-            - name: empty-dir
-              mountPath: /emptydir
-          terminationMessagePath: /dev/termination-log
-          terminationMessagePolicy: File
-          imagePullPolicy: IfNotPresent
-          securityContext:
-            capabilities:
-              drop:
-                - ALL
-            privileged: false
-            seLinuxOptions: {}
-            runAsUser: 1001
-            runAsGroup: 1001
-            runAsNonRoot: true
-            readOnlyRootFilesystem: true
-            allowPrivilegeEscalation: false
-            seccompProfile:
-              type: RuntimeDefault
      containers:
        - name: ghost
-          image: docker.io/bitnami/ghost:5.118.1-debian-12-r0
+          image: {{ .apps.ghost.image }}
          ports:
-            - name: https
-              containerPort: 2368
+            - name: http
+              containerPort: {{ .apps.ghost.port }}
              protocol: TCP
          env:
            - name: BITNAMI_DEBUG
@@ -113,27 +28,33 @@ spec:
            - name: ALLOW_EMPTY_PASSWORD
              value: "yes"
            - name: GHOST_DATABASE_HOST
-              value: ghost-mysql
+              value: {{ .apps.ghost.dbHost }}
            - name: GHOST_DATABASE_PORT_NUMBER
-              value: "3306"
+              value: "{{ .apps.ghost.dbPort }}"
            - name: GHOST_DATABASE_NAME
-              value: ghost
+              value: {{ .apps.ghost.dbName }}
            - name: GHOST_DATABASE_USER
-              value: ghost
-            - name: GHOST_DATABASE_PASSWORD_FILE
-              value: /opt/bitnami/ghost/secrets/mysql-password
+              value: {{ .apps.ghost.dbUser }}
+            - name: GHOST_DATABASE_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: ghost-secrets
+                  key: apps.ghost.dbPassword
            - name: GHOST_HOST
-              value: blog.cloud.payne.io/
+              value: {{ .apps.ghost.domain }}
            - name: GHOST_PORT_NUMBER
-              value: "2368"
+              value: "{{ .apps.ghost.port }}"
            - name: GHOST_USERNAME
-              value: admin
-            - name: GHOST_PASSWORD_FILE
-              value: /opt/bitnami/ghost/secrets/ghost-password
+              value: {{ .apps.ghost.adminUser }}
+            - name: GHOST_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: ghost-secrets
+                  key: apps.ghost.adminPassword
            - name: GHOST_EMAIL
-              value: paul@payne.io
+              value: {{ .apps.ghost.adminEmail }}
            - name: GHOST_BLOG_TITLE
-              value: User's Blog
+              value: {{ .apps.ghost.blogTitle }}
            - name: GHOST_ENABLE_HTTPS
              value: "yes"
            - name: GHOST_EXTERNAL_HTTP_PORT_NUMBER
@@ -142,6 +63,21 @@ spec:
              value: "443"
            - name: GHOST_SKIP_BOOTSTRAP
              value: "no"
+            - name: GHOST_SMTP_SERVICE
+              value: SMTP
+            - name: GHOST_SMTP_HOST
+              value: {{ .apps.ghost.smtp.host }}
+            - name: GHOST_SMTP_PORT
+              value: "{{ .apps.ghost.smtp.port }}"
+            - name: GHOST_SMTP_USER
+              value: {{ .apps.ghost.smtp.user }}
+            - name: GHOST_SMTP_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: ghost-secrets
+                  key: apps.ghost.smtpPassword
+            - name: GHOST_SMTP_FROM_ADDRESS
+              value: {{ .apps.ghost.smtp.from }}
          resources:
            limits:
              cpu: 375m
@@ -152,22 +88,11 @@ spec:
              ephemeral-storage: 50Mi
              memory: 256Mi
          volumeMounts:
-            - name: empty-dir
-              mountPath: /opt/bitnami/ghost
-              subPath: app-base-dir
-            - name: empty-dir
-              mountPath: /.ghost
-              subPath: app-tmp-dir
-            - name: empty-dir
-              mountPath: /tmp
-              subPath: tmp-dir
            - name: ghost-data
              mountPath: /bitnami/ghost
-            - name: ghost-secrets
-              mountPath: /opt/bitnami/ghost/secrets
          livenessProbe:
            tcpSocket:
-              port: 2368
+              port: {{ .apps.ghost.port }}
            initialDelaySeconds: 120
            timeoutSeconds: 5
            periodSeconds: 10
@@ -176,7 +101,7 @@ spec:
          readinessProbe:
            httpGet:
              path: /
-              port: https
+              port: http
              scheme: HTTP
              httpHeaders:
                - name: x-forwarded-proto
@@ -186,64 +111,22 @@ spec:
            periodSeconds: 5
            successThreshold: 1
            failureThreshold: 6
-          terminationMessagePath: /dev/termination-log
-          terminationMessagePolicy: File
-          imagePullPolicy: IfNotPresent
          securityContext:
            capabilities:
              drop:
                - ALL
            privileged: false
-            seLinuxOptions: {}
            runAsUser: 1001
            runAsGroup: 1001
            runAsNonRoot: true
-            readOnlyRootFilesystem: true
+            readOnlyRootFilesystem: false
            allowPrivilegeEscalation: false
            seccompProfile:
              type: RuntimeDefault
+      volumes:
+        - name: ghost-data
+          persistentVolumeClaim:
+            claimName: ghost-data
      restartPolicy: Always
-      terminationGracePeriodSeconds: 30
-      dnsPolicy: ClusterFirst
-      serviceAccountName: ghost
-      serviceAccount: ghost
-      automountServiceAccountToken: false
      securityContext:
        fsGroup: 1001
-        fsGroupChangePolicy: Always
-      affinity:
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-            - weight: 1
-              podAffinityTerm:
-                labelSelector:
-                  matchLabels:
-                    app.kubernetes.io/instance: ghost
-                    app.kubernetes.io/name: ghost
-                topologyKey: kubernetes.io/hostname
-      schedulerName: default-scheduler
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: 25%
-      maxSurge: 25%
-  revisionHistoryLimit: 10
-  progressDeadlineSeconds: 600
-status:
-  observedGeneration: 1
-  replicas: 1
-  updatedReplicas: 1
-  unavailableReplicas: 1
-  conditions:
-    - type: Available
-      status: "False"
-      lastUpdateTime: "2025-04-27T02:01:30Z"
-      lastTransitionTime: "2025-04-27T02:01:30Z"
-      reason: MinimumReplicasUnavailable
-      message: Deployment does not have minimum availability.
-    - type: Progressing
-      status: "False"
-      lastUpdateTime: "2025-04-27T02:11:32Z"
-      lastTransitionTime: "2025-04-27T02:11:32Z"
-      reason: ProgressDeadlineExceeded
-      message: ReplicaSet "ghost-586bbc6ddd" has timed out progressing.
--- a/apps/ghost/ingress.yaml
+++ b/apps/ghost/ingress.yaml
@@ -1,19 +1,18 @@
---
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  name: ghost
-  namespace: {{ .Values.namespace }}
+  namespace: ghost
  annotations:
    kubernetes.io/ingress.class: "traefik"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    external-dns.alpha.kubernetes.io/cloudflare-proxied: "false"
-    external-dns.alpha.kubernetes.io/target: "cloud.payne.io"
+    external-dns.alpha.kubernetes.io/target: {{ .cloud.domain }}
    external-dns.alpha.kubernetes.io/ttl: "60"
    traefik.ingress.kubernetes.io/redirect-entry-point: https
 spec:
  rules:
-    - host: {{ .Values.ghost.host }}
+    - host: {{ .apps.ghost.domain }}
      http:
        paths:
          - path: /
@@ -25,5 +24,5 @@ spec:
                  number: 80
  tls:
    - hosts:
-        - {{ .Values.ghost.host }}
-      secretName: ghost-tls
+        - {{ .apps.ghost.domain }}
+      secretName: {{ .apps.ghost.tlsSecretName }}
--- a/apps/ghost/kustomization.yaml
+++ b/apps/ghost/kustomization.yaml
@@ -0,0 +1,16 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: ghost
+labels:
+  - includeSelectors: true
+    pairs:
+      app: ghost
+      managedBy: kustomize
+      partOf: wild-cloud
+resources:
+  - namespace.yaml
+  - db-init-job.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml
+  - pvc.yaml
--- a/apps/ghost/manifest.yaml
+++ b/apps/ghost/manifest.yaml
@@ -0,0 +1,30 @@
+name: ghost
+description: Ghost is a powerful app for new-media creators to publish, share, and grow a business around their content.
+version: 5.118.1
+icon: https://ghost.org/images/logos/ghost-logo-orb.png
+requires:
+  - name: mysql
+defaultConfig:
+  image: docker.io/bitnami/ghost:5.118.1-debian-12-r0
+  domain: ghost.{{ .cloud.domain }}
+  tlsSecretName: wildcard-wild-cloud-tls
+  port: 2368
+  storage: 10Gi
+  dbHost: mysql.mysql.svc.cluster.local
+  dbPort: 3306
+  dbName: ghost
+  dbUser: ghost
+  adminUser: admin
+  adminEmail: "admin@{{ .cloud.domain }}"
+  blogTitle: "My Blog"
+  timezone: UTC
+  tlsSecretName: wildcard-wild-cloud-tls
+  smtp:
+    host: "{{ .cloud.smtp.host }}"
+    port: "{{ .cloud.smtp.port }}"
+    from: "{{ .cloud.smtp.from }}"
+    user: "{{ .cloud.smtp.user }}"
+requiredSecrets:
+  - apps.ghost.adminPassword
+  - apps.ghost.dbPassword
+  - apps.ghost.smtpPassword
--- a/apps/ghost/namespace.yaml
+++ b/apps/ghost/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: ghost
--- a/apps/ghost/networkpolicy.yaml
+++ b/apps/ghost/networkpolicy.yaml
@@ -1,26 +0,0 @@
---
-# Source: ghost/templates/networkpolicy.yaml
-kind: NetworkPolicy
-apiVersion: networking.k8s.io/v1
-metadata:
-  name: ghost
-  namespace: "default"
-  labels:
-    app.kubernetes.io/instance: ghost
-    app.kubernetes.io/managed-by: Wild
-    app.kubernetes.io/name: ghost
-    app.kubernetes.io/version: 5.118.1
-spec:
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/instance: ghost
-      app.kubernetes.io/name: ghost
-  policyTypes:
-    - Ingress
-    - Egress
-  egress:
-    - {}
-  ingress:
-    - ports:
-        - port: 2368
-        - port: 2368
--- a/apps/ghost/pdb.yaml
+++ b/apps/ghost/pdb.yaml
@@ -1,20 +0,0 @@
---
-# Source: ghost/templates/pdb.yaml
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: ghost
-  namespace: "default"
-  labels:
-    app.kubernetes.io/instance: ghost
-    app.kubernetes.io/managed-by: Wild
-    app.kubernetes.io/name: ghost
-    app.kubernetes.io/version: 5.118.1
-    app.kubernetes.io/component: ghost
-spec:
-  maxUnavailable: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: ghost
-      app.kubernetes.io/name: ghost
-      app.kubernetes.io/component: ghost
--- a/apps/ghost/pvc.yaml
+++ b/apps/ghost/pvc.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: ghost-data
+  namespace: ghost
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .apps.ghost.storage }}
--- a/apps/ghost/service-account.yaml
+++ b/apps/ghost/service-account.yaml
@@ -1,14 +0,0 @@
---
-# Source: ghost/templates/service-account.yaml
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: ghost
-  namespace: "default"
-  labels:
-    app.kubernetes.io/instance: ghost
-    app.kubernetes.io/managed-by: Wild
-    app.kubernetes.io/name: ghost
-    app.kubernetes.io/version: 5.118.1
-    app.kubernetes.io/component: ghost
-automountServiceAccountToken: false
--- a/apps/ghost/service.yaml
+++ b/apps/ghost/service.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: ghost
+  namespace: ghost
+spec:
+  type: ClusterIP
+  ports:
+    - name: http
+      port: 80
+      protocol: TCP
+      targetPort: {{ .apps.ghost.port }}
+  selector:
+    component: web
--- a/apps/ghost/svc.yaml
+++ b/apps/ghost/svc.yaml
@@ -1,26 +0,0 @@
---
-# Source: ghost/templates/svc.yaml
-apiVersion: v1
-kind: Service
-metadata:
-  name: ghost
-  namespace: "default"
-  labels:
-    app.kubernetes.io/instance: ghost
-    app.kubernetes.io/managed-by: Wild
-    app.kubernetes.io/name: ghost
-    app.kubernetes.io/version: 5.118.1
-    app.kubernetes.io/component: ghost
-spec:
-  type: LoadBalancer
-  externalTrafficPolicy: "Cluster"
-  sessionAffinity: None
-  ports:
-    - name: http
-      port: 80
-      protocol: TCP
-      targetPort: http
-  selector:
-    app.kubernetes.io/instance: ghost
-    app.kubernetes.io/name: ghost
-    app.kubernetes.io/component: ghost
--- a/apps/gitea/README.md
+++ b/apps/gitea/README.md
@@ -0,0 +1,85 @@
+# Gitea Configuration
+
+This Gitea deployment uses a hybrid configuration approach combining environment variables with Gitea's self-managed configuration file.
+
+## Configuration Architecture
+
+### Environment Variables (gitea.env)
+Non-secret configuration is stored in `gitea.env` and automatically loaded via kustomize's `configMapGenerator`. This includes:
+- Server settings (domain, URLs, ports)
+- Database connection details (except password)
+- SMTP settings (except password)
+- Service settings (registration, notifications)
+- Repository and storage paths
+
+### Kubernetes Secrets (gitea-secrets)
+Sensitive configuration is stored in the `gitea-secrets` secret and managed by the wild-cloud deployment system:
+- `adminPassword` - Gitea admin user password
+- `secretKey` - Application secret key
+- `jwtSecret` - JWT signing secret
+- `dbPassword` - Database password
+- `smtpPassword` - SMTP authentication password
+
+Secrets are defined in `secrets.yaml` and listed in `manifest.yaml` under `requiredSecrets`. The `wild-app-deploy` command automatically ensures all required secrets exist in the `gitea-secrets` secret before deployment.
+
+### Persistent Configuration (app.ini)
+Gitea manages its own `app.ini` file on persistent storage for:
+- Generated security tokens
+- Runtime configuration changes made via web UI
+- Database migration state
+- User-modified settings
+
+## How It Works
+
+1. **Startup**: Kustomize generates a ConfigMap from `gitea.env`
+2. **Environment Loading**: Pod loads non-secret config from ConfigMap via `envFrom`
+3. **Secret Loading**: Pod loads sensitive config from Kubernetes secrets via `env`
+4. **Configuration Merge**: Gitea's environment-to-ini process merges environment variables into `app.ini`
+5. **Persistence**: Gitea writes the merged configuration plus generated tokens to persistent storage
+
+## Making Configuration Changes
+
+### Non-Secret Settings
+1. Edit `gitea.env` with your changes
+2. Run `wild-app-deploy gitea` to apply changes
+3. Pod will restart and pick up new configuration
+
+### Secret Settings
+1. Edit `secrets.yaml` with your secret values
+2. Ensure the secret key is listed in `manifest.yaml` under `requiredSecrets`
+3. Run `wild-app-deploy gitea` - this will automatically update the `gitea-secrets` secret and restart the pod
+
+### Web UI Changes
+Configuration changes made through Gitea's admin web interface are automatically persisted to the `app.ini` file on persistent storage and will survive pod restarts.
+
+## Configuration Precedence
+
+1. **Kubernetes Secrets** (highest priority)
+2. **Environment Variables** (from gitea.env)
+3. **Persistent app.ini** (lowest priority)
+
+Environment variables override file settings, and secrets override everything.
+
+## Troubleshooting
+
+### Check Current Configuration
+```bash
+# View environment variables
+kubectl describe pod -n gitea -l app=gitea | grep -A 20 "Environment"
+
+# View current app.ini
+kubectl exec -it deployment/gitea -n gitea -- cat /data/gitea/conf/app.ini
+```
+
+### Configuration Not Applied
+- Verify the ConfigMap was generated: `kubectl get configmap -n gitea`
+- Check pod restart: `kubectl get pods -n gitea`
+- Review startup logs: `kubectl logs -n gitea -l app=gitea`
+
+
+## External Dependencies
+
+- **Database**: PostgreSQL instance in `postgres` namespace
+- **Storage**: Longhorn distributed storage
+- **Ingress**: Traefik with Let's Encrypt certificates
+- **DNS**: External-DNS with Cloudflare integration
--- a/apps/gitea/db-init-job.yaml
+++ b/apps/gitea/db-init-job.yaml
@@ -0,0 +1,51 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: gitea-db-init
+  labels:
+    component: db-init
+spec:
+  template:
+    metadata:
+      labels:
+        component: db-init
+    spec:
+      containers:
+        - name: db-init
+          image: {{ .apps.postgres.image }}
+          command: ["/bin/bash", "-c"]
+          args:
+            - |
+              PGPASSWORD=${POSTGRES_ADMIN_PASSWORD} psql -h ${DB_HOSTNAME} -U postgres <<EOF
+              DO \$\$
+              BEGIN
+                IF NOT EXISTS (SELECT FROM pg_catalog.pg_roles WHERE rolname = '${DB_USERNAME}') THEN
+                  CREATE USER ${DB_USERNAME} WITH ENCRYPTED PASSWORD '${DB_PASSWORD}';
+                ELSE
+                  ALTER USER ${DB_USERNAME} WITH ENCRYPTED PASSWORD '${DB_PASSWORD}';
+                END IF;
+              END
+              \$\$;
+
+              SELECT 'CREATE DATABASE ${DB_DATABASE_NAME}' WHERE NOT EXISTS (SELECT FROM pg_database WHERE datname = '${DB_DATABASE_NAME}')\gexec
+              ALTER DATABASE ${DB_DATABASE_NAME} OWNER TO ${DB_USERNAME};
+              GRANT ALL PRIVILEGES ON DATABASE ${DB_DATABASE_NAME} TO ${DB_USERNAME};
+              EOF
+          env:
+            - name: POSTGRES_ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: postgres-secrets
+                  key: apps.postgres.password
+            - name: DB_HOSTNAME
+              value: "{{ .apps.gitea.dbHost }}"
+            - name: DB_DATABASE_NAME
+              value: "{{ .apps.gitea.dbName }}"
+            - name: DB_USERNAME
+              value: "{{ .apps.gitea.dbUser }}"
+            - name: DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-secrets
+                  key: apps.gitea.dbPassword
+      restartPolicy: OnFailure
--- a/apps/gitea/deployment.yaml
+++ b/apps/gitea/deployment.yaml
@@ -0,0 +1,92 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: gitea
+  namespace: gitea
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      component: web
+  template:
+    metadata:
+      labels:
+        app: gitea
+        component: web
+        managedBy: kustomize
+        partOf: wild-cloud
+    spec:
+      securityContext:
+        fsGroup: 1000
+      terminationGracePeriodSeconds: 60
+      containers:
+        - name: gitea
+          image: "{{ .apps.gitea.image }}"
+          imagePullPolicy: IfNotPresent
+          envFrom:
+            - configMapRef:
+                name: gitea-env
+          env:
+            - name: GITEA_ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-secrets
+                  key: apps.gitea.adminPassword
+            - name: GITEA__security__SECRET_KEY
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-secrets
+                  key: apps.gitea.secretKey
+            - name: GITEA__security__INTERNAL_TOKEN
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-secrets
+                  key: apps.gitea.jwtSecret
+            - name: GITEA__database__PASSWD
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-secrets
+                  key: apps.gitea.dbPassword
+            - name: GITEA__mailer__PASSWD
+              valueFrom:
+                secretKeyRef:
+                  name: gitea-secrets
+                  key: apps.gitea.smtpPassword
+          ports:
+            - name: ssh
+              containerPort: 2222
+            - name: http
+              containerPort: 3000
+          livenessProbe:
+            failureThreshold: 10
+            initialDelaySeconds: 200
+            periodSeconds: 10
+            successThreshold: 1
+            tcpSocket:
+              port: http
+            timeoutSeconds: 1
+          readinessProbe:
+            failureThreshold: 3
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            successThreshold: 1
+            tcpSocket:
+              port: http
+            timeoutSeconds: 1
+          resources:
+            {}
+          securityContext:
+            {}
+          volumeMounts:
+            - name: temp
+              mountPath: /tmp
+            - name: data
+              mountPath: /data
+      volumes:
+        - name: temp
+          emptyDir: {}
+        - name: data
+          persistentVolumeClaim:
+            claimName: gitea-data
--- a/apps/gitea/gitea.env
+++ b/apps/gitea/gitea.env
@@ -0,0 +1,60 @@
+SSH_LISTEN_PORT=2222
+SSH_PORT=22
+GITEA_WORK_DIR=/data
+GITEA_TEMP=/tmp/gitea
+TMPDIR=/tmp/gitea
+GITEA_ADMIN_USERNAME={{ .apps.gitea.adminUser }}
+GITEA_ADMIN_PASSWORD_MODE=keepUpdated
+
+# Core app settings
+GITEA____APP_NAME={{ .apps.gitea.appName }}
+GITEA____RUN_MODE={{ .apps.gitea.runMode }}  
+GITEA____RUN_USER=git
+
+# Security settings
+GITEA__security__INSTALL_LOCK=true
+GITEA__security__PASSWORD_HASH_ALGO=pbkdf2
+
+# Database settings (except password which comes from secret)
+GITEA__database__DB_TYPE=postgres
+GITEA__database__HOST={{ .apps.gitea.dbHost }}:{{ .apps.gitea.dbPort }}
+GITEA__database__NAME={{ .apps.gitea.dbName }}
+GITEA__database__USER={{ .apps.gitea.dbUser }}
+GITEA__database__SSL_MODE=disable
+GITEA__database__LOG_SQL=false
+
+# Server settings
+GITEA__server__DOMAIN={{ .apps.gitea.domain }}
+GITEA__server__HTTP_PORT={{ .apps.gitea.port }}
+GITEA__server__ROOT_URL=https://{{ .apps.gitea.domain }}/
+GITEA__server__DISABLE_SSH=false
+GITEA__server__SSH_DOMAIN={{ .apps.gitea.domain }}
+GITEA__server__SSH_PORT={{ .apps.gitea.sshPort }}
+GITEA__server__SSH_LISTEN_PORT=2222
+GITEA__server__LFS_START_SERVER=true
+GITEA__server__OFFLINE_MODE=true
+
+# Service settings
+GITEA__service__REGISTER_EMAIL_CONFIRM=true
+GITEA__service__DISABLE_REGISTRATION=false
+GITEA__service__ALLOW_ONLY_EXTERNAL_REGISTRATION=false
+GITEA__service__ENABLE_NOTIFY_MAIL=true
+GITEA__service__ENABLE_BASIC_AUTHENTICATION=false
+GITEA__service__ENABLE_REVERSE_PROXY_AUTHENTICATION=false
+GITEA__service__ENABLE_CAPTCHA=false
+GITEA__service__REQUIRE_SIGNIN_VIEW=false
+GITEA__service__DEFAULT_KEEP_EMAIL_PRIVATE=false
+GITEA__service__DEFAULT_ALLOW_CREATE_ORGANIZATION=true
+GITEA__service__DEFAULT_ENABLE_TIMETRACKING=true
+GITEA__service__NO_REPLY_ADDRESS=noreply.localhost
+
+# Webhook settings
+GITEA__webhook__ALLOWED_HOST_LIST=*
+
+# Mailer settings (enabled via env vars, password from secret)
+GITEA__mailer__ENABLED=true
+GITEA__mailer__SMTP_ADDR={{ .apps.gitea.smtp.host }}
+GITEA__mailer__SMTP_PORT={{ .apps.gitea.smtp.port }}
+GITEA__mailer__FROM={{ .apps.gitea.smtp.from }}
+GITEA__mailer__USER={{ .apps.gitea.smtp.user }}
+
--- a/apps/gitea/ingress.yaml
+++ b/apps/gitea/ingress.yaml
@@ -0,0 +1,25 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: gitea-public
+  namespace: gitea
+  annotations:
+    external-dns.alpha.kubernetes.io/cloudflare-proxied: "false"
+    external-dns.alpha.kubernetes.io/target: "{{ .apps.gitea.domain }}"
+    external-dns.alpha.kubernetes.io/target: "{{ .cluster.externalDns.target}}"
+spec:
+  rules:
+    - host: "{{ .apps.gitea.domain }}"
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: gitea-http
+                port:
+                  number: 3000
+  tls:
+    - secretName: "{{ .apps.gitea.tlsSecretName }}"
+      hosts:
+        - "{{ .apps.gitea.domain }}"
--- a/apps/gitea/kustomization.yaml
+++ b/apps/gitea/kustomization.yaml
@@ -0,0 +1,20 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: gitea
+labels:
+  - includeSelectors: true
+    pairs:
+      app: gitea
+      managedBy: kustomize
+      partOf: wild-cloud
+resources:
+  - namespace.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml
+  - pvc.yaml
+  - db-init-job.yaml
+configMapGenerator:
+  - name: gitea-env
+    envs:
+      - gitea.env
--- a/apps/gitea/manifest.yaml
+++ b/apps/gitea/manifest.yaml
@@ -0,0 +1,33 @@
+name: gitea
+description: Gitea is a painless self-hosted Git service written in Go
+version: 1.24.3
+icon: https://github.com/go-gitea/gitea/raw/main/assets/logo.png
+requires:
+  - name: postgres
+defaultConfig:
+  image: gitea/gitea:1.24.3
+  appName: Gitea
+  domain: gitea.{{ .cloud.domain }}
+  tlsSecretName: wildcard-wild-cloud-tls
+  port: 3000
+  sshPort: 22
+  storage: 10Gi
+  dbName: gitea
+  dbUser: gitea
+  dbHost: postgres.postgres.svc.cluster.local
+  adminUser: admin
+  adminEmail: "admin@{{ .cloud.domain }}"
+  dbPort: 5432
+  timezone: UTC
+  runMode: prod
+  smtp:
+    host: TBD
+    port: 465
+    from: no-reply@{{ .cloud.domain }}
+    user: TBD
+requiredSecrets:
+  - apps.gitea.adminPassword
+  - apps.gitea.dbPassword
+  - apps.gitea.secretKey
+  - apps.gitea.jwtSecret
+  - apps.gitea.smtpPassword
--- a/apps/gitea/namespace.yaml
+++ b/apps/gitea/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: gitea
--- a/apps/gitea/pvc.yaml
+++ b/apps/gitea/pvc.yaml
@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: gitea-data
+  namespace: gitea
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: longhorn
+  resources:
+    requests:
+      storage: "{{ .apps.gitea.storage }}"
--- a/apps/gitea/service.yaml
+++ b/apps/gitea/service.yaml
@@ -0,0 +1,28 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitea-http
+  namespace: gitea
+spec:
+  type: ClusterIP
+  ports:
+  - name: http
+    port: 3000
+    targetPort: {{ .apps.gitea.port }}
+  selector:
+    component: web
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: gitea-ssh
+  namespace: gitea
+spec:
+  type: LoadBalancer
+  ports:
+  - name: ssh
+    port: {{ .apps.gitea.sshPort }}
+    targetPort: 2222
+    protocol: TCP
+  selector:
+    component: web
--- a/apps/immich/db-init-job.yaml
+++ b/apps/immich/db-init-job.yaml
@@ -53,7 +53,7 @@ spec:
              valueFrom:
                secretKeyRef:
                  name: postgres-secrets
-                  key: password
+                  key: apps.postgres.password
            - name: DB_HOSTNAME
              value: "{{ .apps.immich.dbHostname }}"
            - name: DB_DATABASE_NAME
@@ -64,5 +64,5 @@ spec:
              valueFrom:
                secretKeyRef:
                  name: immich-secrets
-                  key: dbPassword
+                  key: apps.immich.dbPassword
      restartPolicy: OnFailure
--- a/apps/immich/deployment-microservices.yaml
+++ b/apps/immich/deployment-microservices.yaml
@@ -25,6 +25,11 @@ spec:
          env:
            - name: REDIS_HOSTNAME
              value: "{{ .apps.immich.redisHostname }}"
+            - name: REDIS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: immich-secrets
+                  key: apps.redis.password
            - name: DB_HOSTNAME
              value: "{{ .apps.immich.dbHostname }}"
            - name: DB_USERNAME
@@ -33,7 +38,7 @@ spec:
              valueFrom:
                secretKeyRef:
                  name: immich-secrets
-                  key: dbPassword
+                  key: apps.immich.dbPassword
            - name: TZ
              value: "{{ .apps.immich.timezone }}"
            - name: IMMICH_WORKERS_EXCLUDE
@@ -46,3 +51,11 @@ spec:
        - name: immich-storage
          persistentVolumeClaim:
            claimName: immich-pvc
+      affinity:
+        podAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+          - labelSelector:
+              matchLabels:
+                app: immich
+                component: server
+            topologyKey: kubernetes.io/hostname
--- a/apps/immich/deployment-server.yaml
+++ b/apps/immich/deployment-server.yaml
@@ -28,6 +28,11 @@ spec:
          env:
            - name: REDIS_HOSTNAME
              value: "{{ .apps.immich.redisHostname }}"
+            - name: REDIS_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: immich-secrets
+                  key: apps.redis.password
            - name: DB_HOSTNAME
              value: "{{ .apps.immich.dbHostname }}"
            - name: DB_USERNAME
@@ -36,7 +41,7 @@ spec:
              valueFrom:
                secretKeyRef:
                  name: immich-secrets
-                  key: dbPassword
+                  key: apps.immich.dbPassword
            - name: TZ
              value: "{{ .apps.immich.timezone }}"
            - name: IMMICH_WORKERS_EXCLUDE
--- a/apps/immich/manifest.yaml
+++ b/apps/immich/manifest.yaml
@@ -18,6 +18,8 @@ defaultConfig:
  dbHostname: postgres.postgres.svc.cluster.local
  dbUsername: immich
  domain: immich.{{ .cloud.domain }}
+  tlsSecretName: wildcard-wild-cloud-tls
 requiredSecrets:
  - apps.immich.dbPassword
  - apps.postgres.password
+  - apps.redis.password
--- a/apps/keila/db-init-job.yaml
+++ b/apps/keila/db-init-job.yaml
@@ -0,0 +1,63 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: keila-db-init
+spec:
+  template:
+    metadata:
+      labels:
+        component: db-init
+    spec:
+      restartPolicy: OnFailure
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 999
+        runAsGroup: 999
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+      - name: postgres-init
+        image: postgres:15
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: false
+        env:
+        - name: PGHOST
+          value: {{ .apps.keila.dbHostname }}
+        - name: PGUSER
+          value: postgres
+        - name: PGPASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: keila-secrets
+              key: apps.postgres.password
+        - name: DB_NAME
+          value: {{ .apps.keila.dbName }}
+        - name: DB_USER
+          value: {{ .apps.keila.dbUsername }}
+        - name: DB_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: keila-secrets
+              key: apps.keila.dbPassword
+        command:
+        - /bin/bash
+        - -c
+        - |
+          set -e
+          echo "Waiting for PostgreSQL to be ready..."
+          until pg_isready; do
+            echo "PostgreSQL is not ready - sleeping"
+            sleep 2
+          done
+          echo "PostgreSQL is ready"
+          
+          echo "Creating database and user for Keila..."
+          psql -c "CREATE DATABASE ${DB_NAME};" || echo "Database ${DB_NAME} already exists"
+          psql -c "CREATE USER ${DB_USER} WITH PASSWORD '${DB_PASSWORD}';" || echo "User ${DB_USER} already exists"
+          psql -c "GRANT ALL PRIVILEGES ON DATABASE ${DB_NAME} TO ${DB_USER};"
+          psql -d ${DB_NAME} -c "GRANT ALL ON SCHEMA public TO ${DB_USER};"
+          echo "Database initialization complete"
--- a/apps/keila/deployment.yaml
+++ b/apps/keila/deployment.yaml
@@ -0,0 +1,85 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: keila
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      component: web
+  template:
+    metadata:
+      labels:
+        component: web
+    spec:
+      containers:
+      - name: keila
+        image: {{ .apps.keila.image }}
+        ports:
+        - containerPort: {{ .apps.keila.port }}
+        env:
+        - name: DB_URL
+          valueFrom:
+            secretKeyRef:
+              name: keila-secrets
+              key: apps.keila.dbUrl
+        - name: URL_HOST
+          value: {{ .apps.keila.domain }}
+        - name: URL_SCHEMA
+          value: https
+        - name: URL_PORT
+          value: "443"
+        - name: PORT
+          value: "{{ .apps.keila.port }}"
+        - name: SECRET_KEY_BASE
+          valueFrom:
+            secretKeyRef:
+              name: keila-secrets
+              key: apps.keila.secretKeyBase
+        - name: MAILER_SMTP_HOST
+          value: {{ .apps.keila.smtp.host }}
+        - name: MAILER_SMTP_PORT
+          value: "{{ .apps.keila.smtp.port }}"
+        - name: MAILER_ENABLE_SSL
+          value: "{{ .apps.keila.smtp.tls }}"
+        - name: MAILER_ENABLE_STARTTLS
+          value: "{{ .apps.keila.smtp.startTls }}"
+        - name: MAILER_SMTP_USER
+          value: {{ .apps.keila.smtp.user }}
+        - name: MAILER_SMTP_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: keila-secrets
+              key: apps.keila.smtpPassword
+        - name: MAILER_SMTP_FROM_EMAIL
+          value: {{ .apps.keila.smtp.from }}
+        - name: DISABLE_REGISTRATION
+          value: "{{ .apps.keila.disableRegistration }}"
+        - name: KEILA_USER
+          value: "{{ .apps.keila.adminUser }}"
+        - name: KEILA_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: keila-secrets
+              key: apps.keila.adminPassword
+        - name: USER_CONTENT_DIR
+          value: /var/lib/keila/uploads
+        volumeMounts:
+        - name: uploads
+          mountPath: /var/lib/keila/uploads
+        livenessProbe:
+          httpGet:
+            path: /
+            port: {{ .apps.keila.port }}
+          initialDelaySeconds: 30
+          periodSeconds: 10
+        readinessProbe:
+          httpGet:
+            path: /
+            port: {{ .apps.keila.port }}
+          initialDelaySeconds: 5
+          periodSeconds: 5
+      volumes:
+      - name: uploads
+        persistentVolumeClaim:
+          claimName: keila-uploads
--- a/apps/keila/ingress.yaml
+++ b/apps/keila/ingress.yaml
@@ -0,0 +1,26 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: keila
+  annotations:
+    traefik.ingress.kubernetes.io/router.tls: "true"
+    traefik.ingress.kubernetes.io/router.tls.certresolver: letsencrypt
+    external-dns.alpha.kubernetes.io/target: {{ .cloud.domain }}
+    external-dns.alpha.kubernetes.io/cloudflare-proxied: "false"
+    traefik.ingress.kubernetes.io/router.middlewares: keila-cors@kubernetescrd
+spec:
+  rules:
+  - host: {{ .apps.keila.domain }}
+    http:
+      paths:
+      - path: /
+        pathType: Prefix
+        backend:
+          service:
+            name: keila
+            port:
+              number: 80
+  tls:
+    - secretName: "wildcard-wild-cloud-tls"
+      hosts:
+        - "{{ .apps.keila.domain }}"
--- a/apps/keila/kustomization.yaml
+++ b/apps/keila/kustomization.yaml
@@ -0,0 +1,17 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: keila
+labels:
+  - includeSelectors: true
+    pairs:
+      app: keila
+      managedBy: kustomize
+      partOf: wild-cloud
+resources:
+  - namespace.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml
+  - pvc.yaml
+  - db-init-job.yaml
+  - middleware-cors.yaml
--- a/apps/keila/manifest.yaml
+++ b/apps/keila/manifest.yaml
@@ -0,0 +1,31 @@
+name: keila
+description: Keila is an open-source email marketing platform that allows you to send newsletters and manage mailing lists with privacy and control.
+version: 1.0.0
+icon: https://www.keila.io/images/logo.svg
+requires:
+  - name: postgres
+defaultConfig:
+  image: pentacent/keila:latest
+  port: 4000
+  storage: 1Gi
+  domain: keila.{{ .cloud.domain }}
+  dbHostname: postgres.postgres.svc.cluster.local
+  dbName: keila
+  dbUsername: keila
+  disableRegistration: "true"
+  adminUser: admin@{{ .cloud.domain }}
+  tlsSecretName: wildcard-wild-cloud-tls
+  smtp:
+    host: "{{ .cloud.smtp.host }}"
+    port: "{{ .cloud.smtp.port }}"
+    from: "{{ .cloud.smtp.from }}"
+    user: "{{ .cloud.smtp.user }}"
+    tls: {{ .cloud.smtp.tls }}
+    startTls: {{ .cloud.smtp.startTls }}
+requiredSecrets:
+  - apps.keila.secretKeyBase
+  - apps.keila.dbPassword
+  - apps.keila.dbUrl
+  - apps.keila.adminPassword
+  - apps.keila.smtpPassword
+  - apps.postgres.password
--- a/apps/keila/middleware-cors.yaml
+++ b/apps/keila/middleware-cors.yaml
@@ -0,0 +1,28 @@
+apiVersion: traefik.io/v1alpha1
+kind: Middleware
+metadata:
+  name: cors
+spec:
+  headers:
+    accessControlAllowCredentials: true
+    accessControlAllowHeaders:
+      - "Content-Type"
+      - "Authorization" 
+      - "X-Requested-With"
+      - "Accept"
+      - "Origin"
+      - "Cache-Control"
+      - "X-File-Name"
+    accessControlAllowMethods:
+      - "GET"
+      - "POST" 
+      - "PUT"
+      - "DELETE"
+      - "OPTIONS"
+    accessControlAllowOriginList:
+      - "http://localhost:1313"
+      - "https://*.{{ .cloud.domain }}"
+      - "https://{{ .cloud.domain }}"
+    accessControlExposeHeaders:
+      - "*"
+    accessControlMaxAge: 86400
--- a/apps/keila/namespace.yaml
+++ b/apps/keila/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: keila
--- a/apps/keila/pvc.yaml
+++ b/apps/keila/pvc.yaml
@@ -0,0 +1,10 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: keila-uploads
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .apps.keila.storage }}
--- a/apps/keila/service.yaml
+++ b/apps/keila/service.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: keila
+spec:
+  selector:
+    component: web
+  ports:
+  - port: 80
+    targetPort: {{ .apps.keila.port }}
+    protocol: TCP
--- a/apps/listmonk/db-init-job.yaml
+++ b/apps/listmonk/db-init-job.yaml
@@ -0,0 +1,65 @@
+apiVersion: batch/v1
+kind: Job
+metadata:
+  name: listmonk-db-init
+  labels:
+    component: db-init
+spec:
+  template:
+    metadata:
+      labels:
+        component: db-init
+    spec:
+      restartPolicy: OnFailure
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 999
+        runAsGroup: 999
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+      - name: postgres-init
+        image: postgres:15
+        securityContext:
+          allowPrivilegeEscalation: false
+          capabilities:
+            drop:
+            - ALL
+          readOnlyRootFilesystem: false
+        env:
+        - name: PGHOST
+          value: {{ .apps.listmonk.dbHost }}
+        - name: PGUSER
+          value: postgres
+        - name: PGPASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: listmonk-secrets
+              key: apps.postgres.password
+        - name: DB_NAME
+          value: {{ .apps.listmonk.dbName }}
+        - name: DB_USER
+          value: {{ .apps.listmonk.dbUser }}
+        - name: DB_PASSWORD
+          valueFrom:
+            secretKeyRef:
+              name: listmonk-secrets
+              key: apps.listmonk.dbPassword
+        command:
+        - /bin/bash
+        - -c
+        - |
+          set -e
+          echo "Waiting for PostgreSQL to be ready..."
+          until pg_isready; do
+            echo "PostgreSQL is not ready - sleeping"
+            sleep 2
+          done
+          echo "PostgreSQL is ready"
+          
+          echo "Creating database and user for Listmonk..."
+          psql -c "CREATE DATABASE ${DB_NAME};" || echo "Database ${DB_NAME} already exists"
+          psql -c "CREATE USER ${DB_USER} WITH PASSWORD '${DB_PASSWORD}';" || echo "User ${DB_USER} already exists"
+          psql -c "GRANT ALL PRIVILEGES ON DATABASE ${DB_NAME} TO ${DB_USER};"
+          psql -d ${DB_NAME} -c "GRANT ALL ON SCHEMA public TO ${DB_USER};"
+          echo "Database initialization complete"
--- a/apps/listmonk/deployment.yaml
+++ b/apps/listmonk/deployment.yaml
@@ -0,0 +1,86 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: listmonk
+  namespace: listmonk
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      component: web
+  template:
+    metadata:
+      labels:
+        component: web
+    spec:
+      securityContext:
+        seccompProfile:
+          type: RuntimeDefault
+      containers:
+        - name: listmonk
+          image: listmonk/listmonk:v5.0.3
+          command: ["/bin/sh"]
+          args: ["-c", "./listmonk --install --idempotent --yes && ./listmonk --upgrade --yes && ./listmonk"]
+          ports:
+            - name: http
+              containerPort: 9000
+              protocol: TCP
+          env:
+            - name: LISTMONK_app__address
+              value: "0.0.0.0:9000"
+            - name: LISTMONK_db__host
+              value: {{ .apps.listmonk.dbHost }}
+            - name: LISTMONK_db__port
+              value: "{{ .apps.listmonk.dbPort }}"
+            - name: LISTMONK_db__user
+              value: {{ .apps.listmonk.dbUser }}
+            - name: LISTMONK_db__database
+              value: {{ .apps.listmonk.dbName }}
+            - name: LISTMONK_db__ssl_mode
+              value: {{ .apps.listmonk.dbSSLMode }}
+            - name: LISTMONK_db__password
+              valueFrom:
+                secretKeyRef:
+                  name: listmonk-secrets
+                  key: apps.listmonk.dbPassword
+          resources:
+            limits:
+              cpu: 500m
+              ephemeral-storage: 1Gi
+              memory: 512Mi
+            requests:
+              cpu: 100m
+              ephemeral-storage: 50Mi
+              memory: 128Mi
+          volumeMounts:
+            - name: listmonk-data
+              mountPath: /listmonk/data
+          livenessProbe:
+            tcpSocket:
+              port: 9000
+            initialDelaySeconds: 30
+            timeoutSeconds: 5
+            periodSeconds: 10
+            successThreshold: 1
+            failureThreshold: 3
+          readinessProbe:
+            tcpSocket:
+              port: 9000
+            initialDelaySeconds: 10
+            timeoutSeconds: 3
+            periodSeconds: 5
+            successThreshold: 1
+            failureThreshold: 3
+          securityContext:
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+              - ALL
+            readOnlyRootFilesystem: false
+      volumes:
+        - name: listmonk-data
+          persistentVolumeClaim:
+            claimName: listmonk-data
+      restartPolicy: Always
--- a/apps/listmonk/ingress.yaml
+++ b/apps/listmonk/ingress.yaml
@@ -0,0 +1,27 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: listmonk
+  namespace: listmonk
+  annotations:
+    traefik.ingress.kubernetes.io/router.entrypoints: websecure
+    traefik.ingress.kubernetes.io/router.tls: "true"
+    external-dns.alpha.kubernetes.io/target: {{ .cloud.domain }}
+    external-dns.alpha.kubernetes.io/cloudflare-proxied: "false"
+spec:
+  ingressClassName: traefik
+  tls:
+    - hosts:
+        - {{ .apps.listmonk.domain }}
+      secretName: {{ .apps.listmonk.tlsSecretName }}
+  rules:
+    - host: {{ .apps.listmonk.domain }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: listmonk
+                port:
+                  number: 80
--- a/apps/listmonk/kustomization.yaml
+++ b/apps/listmonk/kustomization.yaml
@@ -0,0 +1,16 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: listmonk
+labels:
+  - includeSelectors: true
+    pairs:
+      app: listmonk
+      managedBy: kustomize
+      partOf: wild-cloud
+resources:
+  - namespace.yaml
+  - db-init-job.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml
+  - pvc.yaml
--- a/apps/listmonk/manifest.yaml
+++ b/apps/listmonk/manifest.yaml
@@ -0,0 +1,20 @@
+name: listmonk
+description: Listmonk is a standalone, self-hosted, newsletter and mailing list manager. It is fast, feature-rich, and packed into a single binary.
+version: 5.0.3
+icon: https://listmonk.app/static/images/logo.svg
+requires:
+  - name: postgres
+defaultConfig:
+  domain: listmonk.{{ .cloud.domain }}
+  tlsSecretName: wildcard-wild-cloud-tls
+  storage: 1Gi
+  dbHost: postgres.postgres.svc.cluster.local
+  dbPort: 5432
+  dbName: listmonk
+  dbUser: listmonk
+  dbSSLMode: disable
+  timezone: UTC
+requiredSecrets:
+  - apps.listmonk.dbPassword
+  - apps.listmonk.dbUrl
+  - apps.postgres.password
--- a/apps/listmonk/namespace.yaml
+++ b/apps/listmonk/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: listmonk
--- a/apps/listmonk/pvc.yaml
+++ b/apps/listmonk/pvc.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: listmonk-data
+  namespace: listmonk
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: {{ .apps.listmonk.storage }}
--- a/apps/listmonk/service.yaml
+++ b/apps/listmonk/service.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: listmonk
+  namespace: listmonk
+spec:
+  type: ClusterIP
+  ports:
+    - port: 80
+      targetPort: http
+      protocol: TCP
+      name: http
+  selector:
+    component: web
--- a/apps/mysql/config/example.env
+++ b/apps/mysql/config/example.env
@@ -1,11 +0,0 @@
-MARIADB_NAMESPACE=mariadb
-MARIADB_RELEASE_NAME=mariadb
-MARIADB_USER=app
-MARIADB_DATABASE=app_database
-MARIADB_STORAGE=8Gi
-MARIADB_TAG=11.4.5
-MARIADB_PORT=3306
-
-# Secrets
-MARIADB_PASSWORD=
-MARIADB_ROOT_PASSWORD=
--- a/apps/mysql/primary/configmap.yaml
+++ b/apps/mysql/primary/configmap.yaml
@@ -1,27 +1,17 @@
---
-# Source: ghost/charts/mysql/templates/primary/configmap.yaml
 apiVersion: v1
 kind: ConfigMap
 metadata:
-  name: ghost-mysql
-  namespace: "default"
-  labels:
-    app.kubernetes.io/instance: ghost
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: mysql
-    app.kubernetes.io/version: 8.4.5
-    helm.sh/chart: mysql-12.3.4
-    app.kubernetes.io/part-of: mysql
-    app.kubernetes.io/component: primary
+  name: mysql
+  namespace: mysql
 data:
-  my.cnf: |-
+  my.cnf: |
    [mysqld]
    authentication_policy='* ,,'
    skip-name-resolve
    explicit_defaults_for_timestamp
    basedir=/opt/bitnami/mysql
    plugin_dir=/opt/bitnami/mysql/lib/plugin
-    port=3306
+    port={{ .apps.mysql.port }}
    mysqlx=0
    mysqlx_port=33060
    socket=/opt/bitnami/mysql/tmp/mysql.sock
@@ -36,12 +26,12 @@ data:
    long_query_time=10.0
    
    [client]
-    port=3306
+    port={{ .apps.mysql.port }}
    socket=/opt/bitnami/mysql/tmp/mysql.sock
    default-character-set=UTF8
    plugin_dir=/opt/bitnami/mysql/lib/plugin
    
    [manager]
-    port=3306
+    port={{ .apps.mysql.port }}
    socket=/opt/bitnami/mysql/tmp/mysql.sock
    pid-file=/opt/bitnami/mysql/tmp/mysqld.pid
--- a/apps/mysql/kustomization.yaml
+++ b/apps/mysql/kustomization.yaml
@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: mysql
+labels:
+  - includeSelectors: true
+    pairs:
+      app: mysql
+      managedBy: kustomize
+      partOf: wild-cloud
+resources:
+  - namespace.yaml
+  - statefulset.yaml
+  - service.yaml
+  - service-headless.yaml
+  - configmap.yaml
--- a/apps/mysql/manifest.yaml
+++ b/apps/mysql/manifest.yaml
@@ -0,0 +1,17 @@
+name: mysql
+description: MySQL is an open-source relational database management system
+version: 8.4.5
+icon: https://www.mysql.com/common/logos/logo-mysql-170x115.png
+requires: []
+defaultConfig:
+  image: docker.io/bitnami/mysql:8.4.5-debian-12-r0
+  port: 3306
+  storage: 20Gi
+  dbName: mysql
+  rootUser: root
+  user: mysql
+  timezone: UTC
+  enableSSL: false
+requiredSecrets:
+  - apps.mysql.rootPassword
+  - apps.mysql.password
--- a/apps/mysql/namespace.yaml
+++ b/apps/mysql/namespace.yaml
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: mysql
--- a/apps/mysql/networkpolicy.yaml
+++ b/apps/mysql/networkpolicy.yaml
@@ -1,31 +0,0 @@
---
-# Source: ghost/charts/mysql/templates/networkpolicy.yaml
-kind: NetworkPolicy
-apiVersion: networking.k8s.io/v1
-metadata:
-  name: ghost-mysql
-  namespace: "default"
-  labels:
-    app.kubernetes.io/instance: ghost
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: mysql
-    app.kubernetes.io/version: 8.4.5
-    helm.sh/chart: mysql-12.3.4
-    app.kubernetes.io/part-of: mysql
-spec:
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/instance: ghost
-      app.kubernetes.io/managed-by: Helm
-      app.kubernetes.io/name: mysql
-      app.kubernetes.io/version: 8.4.5
-      helm.sh/chart: mysql-12.3.4
-  policyTypes:
-    - Ingress
-    - Egress
-  egress:
-    - {}
-  ingress:
-    # Allow connection from other cluster pods
-    - ports:
-        - port: 3306
--- a/apps/mysql/primary/pdb.yaml
+++ b/apps/mysql/primary/pdb.yaml
@@ -1,23 +0,0 @@
---
-# Source: ghost/charts/mysql/templates/primary/pdb.yaml
-apiVersion: policy/v1
-kind: PodDisruptionBudget
-metadata:
-  name: ghost-mysql
-  namespace: "default"
-  labels:
-    app.kubernetes.io/instance: ghost
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: mysql
-    app.kubernetes.io/version: 8.4.5
-    helm.sh/chart: mysql-12.3.4
-    app.kubernetes.io/part-of: mysql
-    app.kubernetes.io/component: primary
-spec:
-  maxUnavailable: 1
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: ghost
-      app.kubernetes.io/name: mysql
-      app.kubernetes.io/part-of: mysql
-      app.kubernetes.io/component: primary
--- a/apps/mysql/primary/svc-headless.yaml
+++ b/apps/mysql/primary/svc-headless.yaml
@@ -1,27 +0,0 @@
---
-# Source: ghost/charts/mysql/templates/primary/svc-headless.yaml
-apiVersion: v1
-kind: Service
-metadata:
-  name: ghost-mysql-headless
-  namespace: "default"
-  labels:
-    app.kubernetes.io/instance: ghost
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: mysql
-    app.kubernetes.io/version: 8.4.5
-    helm.sh/chart: mysql-12.3.4
-    app.kubernetes.io/part-of: mysql
-    app.kubernetes.io/component: primary
-spec:
-  type: ClusterIP
-  clusterIP: None
-  publishNotReadyAddresses: true
-  ports:
-    - name: mysql
-      port: 3306
-      targetPort: mysql
-  selector:
-    app.kubernetes.io/instance: ghost
-    app.kubernetes.io/name: mysql
-    app.kubernetes.io/component: primary
--- a/apps/mysql/primary/svc.yaml
+++ b/apps/mysql/primary/svc.yaml
@@ -1,29 +0,0 @@
---
-# Source: ghost/charts/mysql/templates/primary/svc.yaml
-apiVersion: v1
-kind: Service
-metadata:
-  name: ghost-mysql
-  namespace: "default"
-  labels:
-    app.kubernetes.io/instance: ghost
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: mysql
-    app.kubernetes.io/version: 8.4.5
-    helm.sh/chart: mysql-12.3.4
-    app.kubernetes.io/part-of: mysql
-    app.kubernetes.io/component: primary
-spec:
-  type: ClusterIP
-  sessionAffinity: None  
-  ports:
-    - name: mysql
-      port: 3306
-      protocol: TCP
-      targetPort: mysql
-      nodePort: null
-  selector:
-    app.kubernetes.io/instance: ghost
-    app.kubernetes.io/name: mysql
-    app.kubernetes.io/part-of: mysql
-    app.kubernetes.io/component: primary
--- a/apps/mysql/service-headless.yaml
+++ b/apps/mysql/service-headless.yaml
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: mysql-headless
+  namespace: mysql
+spec:
+  type: ClusterIP
+  clusterIP: None
+  publishNotReadyAddresses: true
+  ports:
+    - name: mysql
+      port: {{ .apps.mysql.port }}
+      protocol: TCP
+      targetPort: mysql
+  selector:
+    component: primary
--- a/apps/mysql/service.yaml
+++ b/apps/mysql/service.yaml
@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: mysql
+  namespace: mysql
+spec:
+  type: ClusterIP
+  ports:
+    - name: mysql
+      port: {{ .apps.mysql.port }}
+      protocol: TCP
+      targetPort: mysql
+  selector:
+    component: primary
--- a/apps/mysql/serviceaccount.yaml
+++ b/apps/mysql/serviceaccount.yaml
@@ -1,17 +0,0 @@
---
-# Source: ghost/charts/mysql/templates/serviceaccount.yaml
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: ghost-mysql
-  namespace: "default"
-  labels:
-    app.kubernetes.io/instance: ghost
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: mysql
-    app.kubernetes.io/version: 8.4.5
-    helm.sh/chart: mysql-12.3.4
-    app.kubernetes.io/part-of: mysql
-automountServiceAccountToken: false
-secrets:
-  - name: ghost-mysql
--- a/apps/mysql/primary/statefulset.yaml
+++ b/apps/mysql/primary/statefulset.yaml
@@ -1,69 +1,31 @@
---
-# Source: ghost/charts/mysql/templates/primary/statefulset.yaml
 apiVersion: apps/v1
 kind: StatefulSet
 metadata:
-  name: ghost-mysql
-  namespace: "default"
-  labels:
-    app.kubernetes.io/instance: ghost
-    app.kubernetes.io/managed-by: Helm
-    app.kubernetes.io/name: mysql
-    app.kubernetes.io/version: 8.4.5
-    helm.sh/chart: mysql-12.3.4
-    app.kubernetes.io/part-of: mysql
-    app.kubernetes.io/component: primary
+  name: mysql
+  namespace: mysql
 spec:
  replicas: 1
-  podManagementPolicy: ""
-  selector:
-    matchLabels:
-      app.kubernetes.io/instance: ghost
-      app.kubernetes.io/name: mysql
-      app.kubernetes.io/part-of: mysql
-      app.kubernetes.io/component: primary
-  serviceName: ghost-mysql-headless
+  podManagementPolicy: Parallel
+  serviceName: mysql-headless
  updateStrategy:
    type: RollingUpdate
+  selector:
+    matchLabels:
+      component: primary
  template:
    metadata:
-      annotations:
-        checksum/configuration: 959b0f76ba7e6be0aaaabf97932398c31b17bc9f86d3839a26a3bbbc48673cd9
      labels:
-        app.kubernetes.io/instance: ghost
-        app.kubernetes.io/managed-by: Helm
-        app.kubernetes.io/name: mysql
-        app.kubernetes.io/version: 8.4.5
-        helm.sh/chart: mysql-12.3.4
-        app.kubernetes.io/part-of: mysql
-        app.kubernetes.io/component: primary
+        component: primary
    spec:
-      serviceAccountName: ghost-mysql
-      
+      serviceAccountName: default
      automountServiceAccountToken: false
-      affinity:
-        podAffinity:
-          
-        podAntiAffinity:
-          preferredDuringSchedulingIgnoredDuringExecution:
-            - podAffinityTerm:
-                labelSelector:
-                  matchLabels:
-                    app.kubernetes.io/instance: ghost
-                    app.kubernetes.io/name: mysql
-                topologyKey: kubernetes.io/hostname
-              weight: 1
-        nodeAffinity:
-          
      securityContext:
        fsGroup: 1001
        fsGroupChangePolicy: Always
-        supplementalGroups: []
-        sysctls: []
      initContainers:
        - name: preserve-logs-symlinks
-          image: docker.io/bitnami/mysql:8.4.5-debian-12-r0
-          imagePullPolicy: "IfNotPresent"
+          image: {{ .apps.mysql.image }}
+          imagePullPolicy: IfNotPresent
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
@@ -73,25 +35,23 @@ spec:
            runAsGroup: 1001
            runAsNonRoot: true
            runAsUser: 1001
-            seLinuxOptions: {}
            seccompProfile:
              type: RuntimeDefault
          resources:
            limits:
-              cpu: 750m
-              ephemeral-storage: 2Gi
-              memory: 768Mi
+              cpu: 250m
+              ephemeral-storage: 1Gi
+              memory: 256Mi
            requests:
-              cpu: 500m
+              cpu: 100m
              ephemeral-storage: 50Mi
-              memory: 512Mi
+              memory: 128Mi
          command:
            - /bin/bash
          args:
            - -ec
            - |
              #!/bin/bash
-
              . /opt/bitnami/scripts/libfs.sh
              # We copy the logs folder because it has symlinks to stdout and stderr
              if ! is_dir_empty /opt/bitnami/mysql/logs; then
@@ -102,8 +62,8 @@ spec:
              mountPath: /emptydir
      containers:
        - name: mysql
-          image: docker.io/bitnami/mysql:8.4.5-debian-12-r0
-          imagePullPolicy: "IfNotPresent"
+          image: {{ .apps.mysql.image }}
+          imagePullPolicy: IfNotPresent
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
@@ -113,28 +73,30 @@ spec:
            runAsGroup: 1001
            runAsNonRoot: true
            runAsUser: 1001
-            seLinuxOptions: {}
            seccompProfile:
              type: RuntimeDefault
          env:
            - name: BITNAMI_DEBUG
              value: "false"
-            - name: MYSQL_ROOT_PASSWORD_FILE
-              value: /opt/bitnami/mysql/secrets/mysql-root-password
-            - name: MYSQL_ENABLE_SSL
-              value: "no"
+            - name: MYSQL_ROOT_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: mysql-secrets
+                  key: apps.mysql.rootPassword
            - name: MYSQL_USER
-              value: "bn_ghost"
-            - name: MYSQL_PASSWORD_FILE
-              value: /opt/bitnami/mysql/secrets/mysql-password
-            - name: MYSQL_PORT
-              value: "3306"
+              value: {{ .apps.mysql.user }}
+            - name: MYSQL_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: mysql-secrets
+                  key: apps.mysql.password
            - name: MYSQL_DATABASE
-              value: "bitnami_ghost"
-          envFrom:
+              value: {{ .apps.mysql.dbName }}
+            - name: MYSQL_PORT
+              value: "{{ .apps.mysql.port }}"
          ports:
            - name: mysql
-              containerPort: 3306
+              containerPort: {{ .apps.mysql.port }}
          livenessProbe:
            failureThreshold: 3
            initialDelaySeconds: 5
@@ -147,9 +109,6 @@ spec:
                - -ec
                - |
                  password_aux="${MYSQL_ROOT_PASSWORD:-}"
-                  if [[ -f "${MYSQL_ROOT_PASSWORD_FILE:-}" ]]; then
-                      password_aux=$(cat "$MYSQL_ROOT_PASSWORD_FILE")
-                  fi
                  mysqladmin status -uroot -p"${password_aux}"
          readinessProbe:
            failureThreshold: 3
@@ -163,9 +122,6 @@ spec:
                - -ec
                - |
                  password_aux="${MYSQL_ROOT_PASSWORD:-}"
-                  if [[ -f "${MYSQL_ROOT_PASSWORD_FILE:-}" ]]; then
-                      password_aux=$(cat "$MYSQL_ROOT_PASSWORD_FILE")
-                  fi
                  mysqladmin ping -uroot -p"${password_aux}" | grep "mysqld is alive"
          startupProbe:
            failureThreshold: 10
@@ -179,9 +135,6 @@ spec:
                - -ec
                - |
                  password_aux="${MYSQL_ROOT_PASSWORD:-}"
-                  if [[ -f "${MYSQL_ROOT_PASSWORD_FILE:-}" ]]; then
-                      password_aux=$(cat "$MYSQL_ROOT_PASSWORD_FILE")
-                  fi
                  mysqladmin ping -uroot -p"${password_aux}" | grep "mysqld is alive"
          resources:
            limits:
@@ -210,32 +163,18 @@ spec:
            - name: config
              mountPath: /opt/bitnami/mysql/conf/my.cnf
              subPath: my.cnf
-            - name: mysql-credentials
-              mountPath: /opt/bitnami/mysql/secrets/
      volumes:
        - name: config
          configMap:
-            name: ghost-mysql
-        - name: mysql-credentials
-          secret:
-            secretName: ghost-mysql
-            items:
-              - key: mysql-root-password
-                path: mysql-root-password
-              - key: mysql-password
-                path: mysql-password
+            name: mysql
        - name: empty-dir
          emptyDir: {}
  volumeClaimTemplates:
    - metadata:
        name: data
-        labels:
-          app.kubernetes.io/instance: ghost
-          app.kubernetes.io/name: mysql
-          app.kubernetes.io/component: primary
      spec:
        accessModes:
-          - "ReadWriteOnce"
+          - ReadWriteOnce
        resources:
          requests:
-            storage: "8Gi"
+            storage: {{ .apps.mysql.storage }}
--- a/apps/openproject/db-init-job.yaml
+++ b/apps/openproject/db-init-job.yaml
@@ -36,7 +36,7 @@ spec:
              valueFrom:
                secretKeyRef:
                  name: postgres-secrets
-                  key: password
+                  key: apps.postgres.password
            - name: DB_HOSTNAME
              value: "{{ .apps.openproject.dbHostname }}"
            - name: DB_DATABASE_NAME
@@ -47,5 +47,5 @@ spec:
              valueFrom:
                secretKeyRef:
                  name: openproject-secrets
-                  key: dbPassword
+                  key: apps.openproject.dbPassword
      restartPolicy: OnFailure
--- a/apps/openproject/manifest.yaml
+++ b/apps/openproject/manifest.yaml
@@ -20,10 +20,11 @@ defaultConfig:
  hsts: true
  seedLocale: en
  adminUserName: OpenProject Admin
-  adminUserEmail: '{{ .operator.email }}'
+  adminUserEmail: "{{ .operator.email }}"
  adminPasswordReset: true
  postgresStatementTimeout: 120s
  tmpVolumesStorage: 2Gi
+  tlsSecretName: wildcard-wild-cloud-tls
  cacheStore: memcache
  railsRelativeUrlRoot: ""
 requiredSecrets:
--- a/apps/openproject/seeder-job.yaml
+++ b/apps/openproject/seeder-job.yaml
@@ -62,12 +62,12 @@ spec:
              valueFrom:
                secretKeyRef:
                  name: openproject-secrets
-                  key: dbPassword
+                  key: apps.openproject.dbPassword
            - name: OPENPROJECT_SEED_ADMIN_USER_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: openproject-secrets
-                  key: adminPassword
+                  key: apps.openproject.adminPassword
          resources:
            limits:
              memory: 200Mi
@@ -106,12 +106,12 @@ spec:
              valueFrom:
                secretKeyRef:
                  name: openproject-secrets
-                  key: dbPassword
+                  key: apps.openproject.dbPassword
            - name: OPENPROJECT_SEED_ADMIN_USER_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: openproject-secrets
-                  key: adminPassword
+                  key: apps.openproject.adminPassword
          resources:
            limits:
              memory: 512Mi
--- a/apps/openproject/web-deployment.yaml
+++ b/apps/openproject/web-deployment.yaml
@@ -84,12 +84,12 @@ spec:
              valueFrom:
                secretKeyRef:
                  name: openproject-secrets
-                  key: dbPassword
+                  key: apps.openproject.dbPassword
            - name: OPENPROJECT_SEED_ADMIN_USER_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: openproject-secrets
-                  key: adminPassword
+                  key: apps.openproject.adminPassword
          args:
            - /app/docker/prod/wait-for-db
          resources:
@@ -127,12 +127,12 @@ spec:
              valueFrom:
                secretKeyRef:
                  name: openproject-secrets
-                  key: dbPassword
+                  key: apps.openproject.dbPassword
            - name: OPENPROJECT_SEED_ADMIN_USER_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: openproject-secrets
-                  key: adminPassword
+                  key: apps.openproject.adminPassword
          args:
            - /app/docker/prod/web
          volumeMounts:            
--- a/apps/openproject/worker-deployment.yaml
+++ b/apps/openproject/worker-deployment.yaml
@@ -84,12 +84,12 @@ spec:
              valueFrom:
                secretKeyRef:
                  name: openproject-secrets
-                  key: dbPassword
+                  key: apps.openproject.dbPassword
            - name: OPENPROJECT_SEED_ADMIN_USER_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: openproject-secrets
-                  key: adminPassword
+                  key: apps.openproject.adminPassword
          args:
            - bash
            - /app/docker/prod/wait-for-db
@@ -132,7 +132,7 @@ spec:
              valueFrom:
                secretKeyRef:
                  name: openproject-secrets
-                  key: dbPassword
+                  key: apps.openproject.dbPassword
            - name: "OPENPROJECT_GOOD_JOB_QUEUES"
              value: ""
          volumeMounts:            
--- a/apps/postgres/deployment.yaml
+++ b/apps/postgres/deployment.yaml
@@ -44,7 +44,7 @@ spec:
              valueFrom:
                secretKeyRef:
                  name: postgres-secrets
-                  key: password
+                  key: apps.postgres.password
          volumeMounts:
            - name: postgres-data
              mountPath: /var/lib/postgresql/data
--- a/apps/postgres/doctor/test-job.yaml
+++ b/apps/postgres/doctor/test-job.yaml
@@ -73,5 +73,5 @@ spec:
              valueFrom:
                secretKeyRef:
                  name: postgres-secrets
-                  key: password
+                  key: apps.postgres.password
      restartPolicy: Never
--- a/apps/redis/manifest.yaml
+++ b/apps/redis/manifest.yaml
@@ -7,3 +7,5 @@ defaultConfig:
  image: redis:alpine
  timezone: UTC
  port: 6379
+requiredSecrets:
+  - apps.redis.password
--- a/bin/wild-app-add
+++ b/bin/wild-app-add
@@ -56,7 +56,7 @@ fi

 CONFIG_FILE="${WC_HOME}/config.yaml"
 if [ ! -f "${CONFIG_FILE}" ]; then
-    echo "Creating config file at ${CONFIG_FILE}"
+    echo "Creating config file at '${CONFIG_FILE}'."
    echo "# Wild Cloud Configuration" > "${CONFIG_FILE}"
    echo "# This file contains app configurations and should be committed to git" >> "${CONFIG_FILE}"
    echo "" >> "${CONFIG_FILE}"
@@ -64,7 +64,7 @@ fi

 SECRETS_FILE="${WC_HOME}/secrets.yaml"
 if [ ! -f "${SECRETS_FILE}" ]; then
-    echo "Creating secrets file at ${SECRETS_FILE}"
+    echo "Creating secrets file at '${SECRETS_FILE}'."
    echo "# Wild Cloud Secrets Configuration" > "${SECRETS_FILE}"
    echo "# This file contains sensitive data and should NOT be committed to git" >> "${SECRETS_FILE}"
    echo "# Add this file to your .gitignore" >> "${SECRETS_FILE}"
@@ -74,8 +74,8 @@ fi
 # Check if app is cached, if not fetch it first
 CACHE_APP_DIR="${WC_HOME}/.wildcloud/cache/apps/${APP_NAME}"
 if [ ! -d "${CACHE_APP_DIR}" ]; then
-    echo "Cache directory for app '${APP_NAME}' not found at ${CACHE_APP_DIR}"
-    echo "Please fetch the app first using 'wild-app-fetch ${APP_NAME}'"
+    echo "Cache directory for app '${APP_NAME}' not found at '${CACHE_APP_DIR}'."
+    echo "Please fetch the app first using 'wild-app-fetch ${APP_NAME}'."
    exit 1
 fi
 if [ ! -d "${CACHE_APP_DIR}" ]; then
@@ -89,167 +89,116 @@ fi

 APPS_DIR="${WC_HOME}/apps"
 if [ ! -d "${APPS_DIR}" ]; then
-    echo "Creating apps directory at ${APPS_DIR}"
+    echo "Creating apps directory at '${APPS_DIR}'."
    mkdir -p "${APPS_DIR}"
 fi

 DEST_APP_DIR="${WC_HOME}/apps/${APP_NAME}"
 if [ -d "${DEST_APP_DIR}" ]; then
    if [ "${UPDATE}" = true ]; then
-        echo "Updating app '${APP_NAME}'"
+        echo "Updating app '${APP_NAME}'."
        rm -rf "${DEST_APP_DIR}"
    else
-        echo "Warning: Destination directory ${DEST_APP_DIR} already exists"
+        echo "Warning: Destination directory ${DEST_APP_DIR} already exists."
        read -p "Do you want to overwrite it? (y/N): " -n 1 -r
        echo
        if [[ ! $REPLY =~ ^[Yy]$ ]]; then
-            echo "Configuration cancelled"
+            echo "Configuration cancelled."
            exit 1
        fi
        rm -rf "${DEST_APP_DIR}"
    fi
+else
+    echo "Adding app '${APP_NAME}' to '${DEST_APP_DIR}'."
 fi
 mkdir -p "${DEST_APP_DIR}"

-echo "Adding app '${APP_NAME}' from cache to ${DEST_APP_DIR}"
-
 # Step 1: Copy only manifest.yaml from cache first
 MANIFEST_FILE="${CACHE_APP_DIR}/manifest.yaml"
 if [ -f "${MANIFEST_FILE}" ]; then
-    echo "Copying manifest.yaml from cache"
-    cp "${MANIFEST_FILE}" "${DEST_APP_DIR}/manifest.yaml"
+    # manifest.yaml is allowed to have gomplate variables in the defaultConfig and requiredSecrets sections.
+    # We need to use gomplate to process these variables before using yq.
+    echo "Copying app manifest from cache."
+    DEST_MANIFEST="${DEST_APP_DIR}/manifest.yaml"
+    if [ -f "${SECRETS_FILE}" ]; then
+        gomplate_cmd="gomplate -c .=${CONFIG_FILE} -c secrets=${SECRETS_FILE} -f ${MANIFEST_FILE} -o ${DEST_MANIFEST}"
+    else
+        gomplate_cmd="gomplate -c .=${CONFIG_FILE} -f ${MANIFEST_FILE} -o ${DEST_MANIFEST}"
+    fi
+    if ! eval "${gomplate_cmd}"; then
+        echo "Error processing manifest.yaml with gomplate"
+        exit 1
+    fi
 else
-    echo "Warning: manifest.yaml not found in cache for app '${APP_NAME}'"
+    echo "Warning: App manifest not found in cache."
    exit 1
 fi

-# Step 2: Add missing config and secret values based on manifest
-echo "Processing configuration and secrets from manifest.yaml"
-
 # Check if the app section exists in config.yaml, if not create it
 if ! yq eval ".apps.${APP_NAME}" "${CONFIG_FILE}" >/dev/null 2>&1; then
    yq eval ".apps.${APP_NAME} = {}" -i "${CONFIG_FILE}"
 fi

-# Extract defaultConfig from manifest.yaml and merge into config.yaml
-if yq eval '.defaultConfig' "${DEST_APP_DIR}/manifest.yaml" | grep -q -v '^null$'; then
-    echo "Merging defaultConfig from manifest.yaml into .wildcloud/config.yaml"
+# Check if apps section exists in the secrets.yaml, if not create it
+if ! yq eval ".apps" "${SECRETS_FILE}" >/dev/null 2>&1; then
+    yq eval ".apps = {}" -i "${SECRETS_FILE}"
+fi

-    # Check if the app config already exists
-    if yq eval ".apps.${APP_NAME}" "${CONFIG_FILE}" | grep -q '^null$'; then
-        yq eval ".apps.${APP_NAME} = {}" -i "${CONFIG_FILE}"
-    fi
+# Merge processed defaultConfig into the app config, preserving existing values
+# This preserves existing configuration values while adding missing defaults
+if yq eval '.defaultConfig' "${DEST_MANIFEST}" | grep -q -v '^null$'; then
    
-    # Merge defaultConfig into the app config, preserving nested structure
-    # This preserves the nested structure for objects like resources.requests.memory
-    temp_manifest=$(mktemp)
-    yq eval '.defaultConfig' "${DEST_APP_DIR}/manifest.yaml" > "$temp_manifest"
-    yq eval ".apps.${APP_NAME} = (.apps.${APP_NAME} // {}) * load(\"$temp_manifest\")" -i "${CONFIG_FILE}"
-    rm "$temp_manifest"
+    # Extract defaultConfig from the processed manifest and merge with existing app config
+    # The * operator merges objects, with the right side taking precedence for conflicting keys
+    # So (.apps.${APP_NAME} // {}) preserves existing values, defaultConfig adds missing ones
+    temp_default_config=$(mktemp)
+    yq eval '.defaultConfig' "${DEST_MANIFEST}" > "$temp_default_config"
+    yq eval ".apps.${APP_NAME} = load(\"$temp_default_config\") * (.apps.${APP_NAME} // {})" -i "${CONFIG_FILE}"
+    rm "$temp_default_config"
    
-    # Process template variables in the merged config
-    echo "Processing template variables in app config"
-    temp_config=$(mktemp)
-    
-    # Build gomplate command with config context
-    gomplate_cmd="gomplate -c .=${CONFIG_FILE}"
-    
-    # Add secrets context if secrets.yaml exists
-    if [ -f "${SECRETS_FILE}" ]; then
-        gomplate_cmd="${gomplate_cmd} -c secrets=${SECRETS_FILE}"
-    fi
-    
-    # Process the entire config file through gomplate to resolve template variables
-    ${gomplate_cmd} -f "${CONFIG_FILE}" > "$temp_config"
-    mv "$temp_config" "${CONFIG_FILE}"
-    
-    echo "Merged defaultConfig for app '${APP_NAME}'"
+    echo "Merged default configuration from app manifest into '${CONFIG_FILE}'."
+    # Remove defaultConfig from the copied manifest since it's now in config.yaml.
+    yq eval 'del(.defaultConfig)' -i "${DEST_MANIFEST}" 
 fi

 # Scaffold required secrets into .wildcloud/secrets.yaml if they don't exist
-if yq eval '.requiredSecrets' "${DEST_APP_DIR}/manifest.yaml" | grep -q -v '^null$'; then
-    echo "Scaffolding required secrets for app '${APP_NAME}'"
+if yq eval '.requiredSecrets' "${DEST_MANIFEST}" | grep -q -v '^null$'; then
    
    # Ensure .wildcloud/secrets.yaml exists
    if [ ! -f "${SECRETS_FILE}" ]; then
+        echo "Creating secrets file at '${SECRETS_FILE}'"
        echo "# Wild Cloud Secrets Configuration" > "${SECRETS_FILE}"
        echo "# This file contains sensitive data and should NOT be committed to git" >> "${SECRETS_FILE}"
        echo "# Add this file to your .gitignore" >> "${SECRETS_FILE}"
        echo "" >> "${SECRETS_FILE}"
    fi
    
-    # Check if apps section exists, if not create it
-    if ! yq eval ".apps" "${SECRETS_FILE}" >/dev/null 2>&1; then
-        yq eval ".apps = {}" -i "${SECRETS_FILE}"
-    fi
-    
-    # Check if app section exists, if not create it
-    if ! yq eval ".apps.${APP_NAME}" "${SECRETS_FILE}" >/dev/null 2>&1; then
-        yq eval ".apps.${APP_NAME} = {}" -i "${SECRETS_FILE}"
-    fi
-    
-    # Add dummy values for each required secret if not already present
-    yq eval '.requiredSecrets[]' "${DEST_APP_DIR}/manifest.yaml" | while read -r secret_path; do
+    # Add random values for each required secret if not already present
+    while read -r secret_path; do
        current_value=$(yq eval ".${secret_path} // \"null\"" "${SECRETS_FILE}")
        
        if [ "${current_value}" = "null" ]; then
-            echo "Adding dummy secret: ${secret_path}"
-            # Extract just the key name for the dummy value
-            secret_key=$(basename "${secret_path}")
-            yq eval ".${secret_path} = \"CHANGE_ME_${secret_key^^}\"" -i "${SECRETS_FILE}"
+            random_secret=$(openssl rand -base64 32 | tr -d "=+/" | cut -c1-32)
+            yq eval ".${secret_path} = \"${random_secret}\"" -i "${SECRETS_FILE}"
        fi
-    done
-    
-    echo "Required secrets scaffolded for app '${APP_NAME}'"
+    done < <(yq eval '.requiredSecrets[]' "${DEST_MANIFEST}")
+    echo "Required secrets declared in app manifest added to '${SECRETS_FILE}'."
 fi

 # Step 3: Copy and compile all other files from cache to app directory
-echo "Copying and compiling remaining files from cache"
+echo "Copying and compiling remaining files from cache."

-# Function to process a file with gomplate if it's a YAML file
-process_file() {
-    local src_file="$1"
-    local dest_file="$2"
+cp -r "${CACHE_APP_DIR}/." "${DEST_APP_DIR}/"
+find "${DEST_APP_DIR}" -type f | while read -r dest_file; do
+    rel_path="${dest_file#${DEST_APP_DIR}/}"
    
-    echo "Processing file: ${dest_file}"
-    
-    # Build gomplate command with config context (enables .config shorthand)
-    gomplate_cmd="gomplate -c .=${CONFIG_FILE}"
-    
-    # Add secrets context if secrets.yaml exists (enables .secrets shorthand)
-    if [ -f "${SECRETS_FILE}" ]; then
-        gomplate_cmd="${gomplate_cmd} -c secrets=${SECRETS_FILE}"
-    fi
-    
-    # Execute gomplate with the file
-    ${gomplate_cmd} -f "${src_file}" > "${dest_file}"
-}
-
-# Copy directory structure and process files (excluding manifest.yaml which was already copied)
-find "${CACHE_APP_DIR}" -type d | while read -r src_dir; do
-    rel_path="${src_dir#${CACHE_APP_DIR}}"
-    rel_path="${rel_path#/}"  # Remove leading slash if present
-    if [ -n "${rel_path}" ]; then
-        mkdir -p "${DEST_APP_DIR}/${rel_path}"
-    fi
-done
-
-find "${CACHE_APP_DIR}" -type f | while read -r src_file; do
-    rel_path="${src_file#${CACHE_APP_DIR}}"
-    rel_path="${rel_path#/}"  # Remove leading slash if present
-    
-    # Skip manifest.yaml since it was already copied in step 1
    if [ "${rel_path}" = "manifest.yaml" ]; then
        continue
    fi
    
-    dest_file="${DEST_APP_DIR}/${rel_path}"
-    
-    # Ensure destination directory exists
-    dest_dir=$(dirname "${dest_file}")
-    mkdir -p "${dest_dir}"
-    
-    process_file "${src_file}" "${dest_file}"
+    temp_file=$(mktemp)
+    gomplate -c .=${CONFIG_FILE} -c secrets=${SECRETS_FILE} -f "${dest_file}" > "${temp_file}"
+    mv "${temp_file}" "${dest_file}"
 done

-echo "Successfully added app '${APP_NAME}' with template processing"
+echo "Added '${APP_NAME}'."
--- a/bin/wild-app-deploy
+++ b/bin/wild-app-deploy
@@ -79,42 +79,35 @@ deploy_secrets() {
    
    echo "Deploying secrets for app '${app_name}' in namespace '${namespace}'"
    
-    # Create secret data
+    # Gather data for app secret
    local secret_data=""
    while IFS= read -r secret_path; do
-        # Get the secret value using full path
        secret_value=$(yq eval ".${secret_path} // \"\"" "${SECRETS_FILE}")
-        
-        # Extract just the key name for the Kubernetes secret (handle dotted paths)
-        secret_key="${secret_path##*.}"
-        
        if [ -n "${secret_value}" ] && [ "${secret_value}" != "null" ]; then
-            if [[ "${secret_value}" == CHANGE_ME_* ]]; then
-                echo "Warning: Secret '${secret_path}' for app '${app_name}' still has dummy value: ${secret_value}"
-            fi
-            secret_data="${secret_data} --from-literal=${secret_key}=${secret_value}"
+            secret_data="${secret_data} --from-literal=${secret_path}=${secret_value}"
        else
            echo "Error: Required secret '${secret_path}' not found in ${SECRETS_FILE} for app '${app_name}'"
            exit 1
        fi
    done < <(yq eval '.requiredSecrets[]' "${manifest_file}")
    
-    # Create the secret if we have data
+    # Create/update app secret in cluster
    if [ -n "${secret_data}" ]; then
        echo "Creating/updating secret '${app_name}-secrets' in namespace '${namespace}'"
        if [ "${DRY_RUN:-}" = "--dry-run=client" ]; then
            echo "DRY RUN: kubectl create secret generic ${app_name}-secrets ${secret_data} --namespace=${namespace} --dry-run=client -o yaml"
        else
-            # Delete existing secret if it exists, then create new one
            kubectl delete secret "${app_name}-secrets" --namespace="${namespace}" --ignore-not-found=true
            kubectl create secret generic "${app_name}-secrets" ${secret_data} --namespace="${namespace}"
        fi
    fi
 }

-# Step 1: Create namespaces first (dependencies and main app)
+# Step 1: Create namespaces first
 echo "Creating namespaces..."
 MANIFEST_FILE="apps/${APP_NAME}/manifest.yaml"
+
+# Create dependency namespaces.
 if [ -f "${MANIFEST_FILE}" ]; then
    if yq eval '.requires' "${MANIFEST_FILE}" | grep -q -v '^null$'; then
        yq eval '.requires[].name' "${MANIFEST_FILE}" | while read -r required_app; do
@@ -152,32 +145,6 @@ if [ -f "apps/${APP_NAME}/namespace.yaml" ]; then
    wild-cluster-secret-copy cert-manager:wildcard-wild-cloud-tls "$NAMESPACE" || echo "Warning: Failed to copy external wildcard certificate"
 fi

-# Step 2: Deploy secrets (dependencies and main app)
-echo "Deploying secrets..."
-if [ -f "${MANIFEST_FILE}" ]; then
-    if yq eval '.requires' "${MANIFEST_FILE}" | grep -q -v '^null$'; then
-        echo "Deploying secrets for required dependencies..."
-        yq eval '.requires[].name' "${MANIFEST_FILE}" | while read -r required_app; do
-            if [ -z "${required_app}" ] || [ "${required_app}" = "null" ]; then
-                echo "Warning: Empty or null dependency found, skipping"
-                continue
-            fi
-            
-            if [ ! -d "apps/${required_app}" ]; then
-                echo "Error: Required dependency '${required_app}' not found in apps/ directory"
-                exit 1
-            fi
-            
-            echo "Deploying secrets for dependency: ${required_app}"
-            # Deploy secrets in dependency's own namespace
-            deploy_secrets "${required_app}"
-            # Also deploy dependency secrets in consuming app's namespace
-            echo "Copying dependency secrets to app namespace: ${APP_NAME}"
-            deploy_secrets "${required_app}" "${APP_NAME}"
-        done
-    fi
-fi
-
 # Deploy secrets for this app
 deploy_secrets "${APP_NAME}"

--- a/bin/wild-cluster-config-generate
+++ b/bin/wild-cluster-config-generate
@@ -60,15 +60,16 @@ print_header "Talos Cluster Configuration Generation"

 # Ensure required directories exist
 NODE_SETUP_DIR="${WC_HOME}/setup/cluster-nodes"
-mkdir -p "${NODE_SETUP_DIR}/generated"

-# Generate cluster secrets
-
-if [ -f "${NODE_SETUP_DIR}/generated/secrets.yaml" ] && [ "$FORCE" = false ]; then
-    print_success "Cluster secrets already exists in ${NODE_SETUP_DIR}/generated/"
+# Check if generated directory already exists and has content
+if [ -d "${NODE_SETUP_DIR}/generated" ] && [ "$(ls -A "${NODE_SETUP_DIR}/generated" 2>/dev/null)" ] && [ "$FORCE" = false ]; then
+    print_success "Cluster configuration already exists in ${NODE_SETUP_DIR}/generated/"
+    print_info "Skipping cluster configuration generation"
    exit 0
 fi

+mkdir -p "${NODE_SETUP_DIR}/generated"
+
 # Prepare directory for generated secrets
 print_info "Generating new cluster secrets..."
 if [ -d "${NODE_SETUP_DIR}/generated" ]; then
--- a/bin/wild-cluster-node-boot-assets-download
+++ b/bin/wild-cluster-node-boot-assets-download
@@ -52,7 +52,7 @@ else
 fi

 # Check for required configuration
-if [ -z "$(get_current_config "cluster.nodes.talos.version")" ] || [ -z "$(get_current_config "cluster.nodes.talos.schematicId")" ]; then
+if [ -z "$(wild-config "cluster.nodes.talos.version")" ] || [ -z "$(wild-config "cluster.nodes.talos.schematicId")" ]; then
    print_header "Talos Configuration Required"
    print_error "Missing required Talos configuration"
    print_info "Please run 'wild-setup' first to configure your cluster"
@@ -69,8 +69,8 @@ fi
 print_header "Talos Installer Image Generation and Asset Download"

 # Get Talos version and schematic ID from config
-TALOS_VERSION=$(get_current_config cluster.nodes.talos.version)
-SCHEMATIC_ID=$(get_current_config cluster.nodes.talos.schematicId)
+TALOS_VERSION=$(wild-config cluster.nodes.talos.version)
+SCHEMATIC_ID=$(wild-config cluster.nodes.talos.schematicId)

 print_info "Creating custom Talos installer image..."
 print_info "Talos version: $TALOS_VERSION"
--- a/bin/wild-cluster-node-ip
+++ b/bin/wild-cluster-node-ip
@@ -0,0 +1,180 @@
+#!/bin/bash
+
+set -e
+set -o pipefail
+
+# Usage function
+usage() {
+    echo "Usage: wild-cluster-node-ip <node-name> [options]"
+    echo ""
+    echo "Get the current IP address of a cluster node by name."
+    echo ""
+    echo "Arguments:"
+    echo "  node-name           Name of the node to get IP for"
+    echo ""
+    echo "Options:"
+    echo "  --from-config       Get IP from local config.yaml"
+    echo "  --from-talosctl     Get IP from Talos API"
+    echo "                      Default: Query Kubernetes API (kubectl)"
+    echo "  -h, --help          Show this help message"
+    echo ""
+    echo "Examples:"
+    echo "  wild-cluster-node-ip control-1"
+    echo "  wild-cluster-node-ip worker-1"
+    echo "  wild-cluster-node-ip control-2 --from-config"
+    echo "  wild-cluster-node-ip worker-2 --from-talosctl"
+    echo ""
+    echo "This script will:"
+    echo "  - Query the specified source for the node's IP address"
+    echo "  - Return only the internal IP address or exit with error if not found"
+    echo ""
+    echo "Requirements:"
+    echo "  - Must be run from a Wild Cloud directory"
+    echo "  - kubectl and/or talosctl must be configured for cluster access"
+}
+
+# Parse arguments
+NODE_NAME=""
+SOURCE="kubectl"
+
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        --from-config)
+            SOURCE="config"
+            shift
+            ;;
+        --from-talosctl)
+            SOURCE="talosctl"
+            shift
+            ;;
+        -h|--help)
+            usage
+            exit 0
+            ;;
+        -*)
+            echo "Unknown option $1"
+            usage
+            exit 1
+            ;;
+        *)
+            if [ -z "$NODE_NAME" ]; then
+                NODE_NAME="$1"
+            else
+                echo "Unexpected argument: $1"
+                usage
+                exit 1
+            fi
+            shift
+            ;;
+    esac
+done
+
+# Check if node name was provided
+if [ -z "$NODE_NAME" ]; then
+    echo "Error: Node name is required"
+    usage
+    exit 1
+fi
+
+# Initialize Wild Cloud environment
+if [ -z "${WC_ROOT}" ]; then
+    echo "Error: WC_ROOT is not set" >&2
+    exit 1
+else
+    source "${WC_ROOT}/scripts/common.sh"
+    init_wild_env
+fi
+
+# Function to get IP from config.yaml
+get_ip_from_config() {
+    local node_name="$1"
+    local ip
+    
+    ip=$(yq eval ".cluster.nodes.active.\"${node_name}\".currentIp" "${WC_HOME}/config.yaml" 2>/dev/null || echo "")
+    
+    if [ -n "$ip" ] && [ "$ip" != "null" ]; then
+        echo "$ip"
+        return 0
+    else
+        return 1
+    fi
+}
+
+# Function to get IP from kubectl
+get_ip_from_kubectl() {
+    local node_name="$1"
+    local ip
+    
+    # Check if kubectl is available and configured
+    if ! command -v kubectl >/dev/null 2>&1; then
+        return 1
+    fi
+    
+    # Try to get node info from kubectl
+    if ! kubectl get nodes "$node_name" >/dev/null 2>&1; then
+        return 1
+    fi
+    
+    # Get internal IP address
+    ip=$(kubectl get node "$node_name" -o jsonpath='{.status.addresses[?(@.type=="InternalIP")].address}' 2>/dev/null || echo "")
+    
+    if [ -n "$ip" ]; then
+        echo "$ip"
+        return 0
+    else
+        return 1
+    fi
+}
+
+# Function to get IP from talosctl
+get_ip_from_talosctl() {
+    local node_name="$1"
+    local ip
+    
+    # Check if talosctl is available and configured
+    if ! command -v talosctl >/dev/null 2>&1; then
+        return 1
+    fi
+    
+    # Try to get node info from talosctl
+    if talosctl get members >/dev/null 2>&1; then
+        # Find the specific node and get its first IP address
+        ip=$(talosctl get members -o json 2>/dev/null | jq -r --arg hostname "$node_name" 'select(.spec.hostname == $hostname) | .spec.addresses[0]' 2>/dev/null | grep -v "null" | head -n1 || echo "")
+        
+        if [ -n "$ip" ]; then
+            echo "$ip"
+            return 0
+        fi
+    fi
+    
+    return 1
+}
+
+
+# Main logic
+case $SOURCE in
+    config)
+        if ip=$(get_ip_from_config "$NODE_NAME"); then
+            echo "$ip"
+        else
+            echo "Error: Node $NODE_NAME not found in config.yaml or no currentIp set" >&2
+            exit 1
+        fi
+        ;;
+    kubectl)
+        if ip=$(get_ip_from_kubectl "$NODE_NAME"); then
+            echo "$ip"
+        else
+            echo "Error: Could not get IP for node $NODE_NAME via kubectl" >&2
+            exit 1
+        fi
+        ;;
+    talosctl)
+        if ip=$(get_ip_from_talosctl "$NODE_NAME"); then
+            echo "$ip"
+        else
+            echo "Error: Could not get IP for node $NODE_NAME via talosctl" >&2
+            exit 1
+        fi
+        ;;
+esac
--- a/bin/wild-cluster-node-patch-generate
+++ b/bin/wild-cluster-node-patch-generate
@@ -5,19 +5,19 @@ set -o pipefail

 # Usage function
 usage() {
-    echo "Usage: wild-cluster-node-patch-generate <node-ip>"
+    echo "Usage: wild-cluster-node-patch-generate <node-name>"
    echo ""
    echo "Generate Talos machine configuration patches for a specific registered node."
    echo ""
    echo "Arguments:"
-    echo "  node-ip             IP address of the registered node"
+    echo "  node-name           Name of the registered node"
    echo ""
    echo "Options:"
    echo "  -h, --help          Show this help message"
    echo ""
    echo "Examples:"
-    echo "  wild-cluster-node-patch-generate 192.168.1.91"
-    echo "  wild-cluster-node-patch-generate 192.168.1.100"
+    echo "  wild-cluster-node-patch-generate control-1"
+    echo "  wild-cluster-node-patch-generate worker-1"
    echo ""
    echo "This script will:"
    echo "  - Compile patch templates for the specified node"
@@ -32,7 +32,7 @@ usage() {
 }

 # Parse arguments
-NODE_IP=""
+NODE_NAME=""
 while [[ $# -gt 0 ]]; do
    case $1 in
        -h|--help)
@@ -45,8 +45,8 @@ while [[ $# -gt 0 ]]; do
            exit 1
            ;;
        *)
-            if [ -z "$NODE_IP" ]; then
-                NODE_IP="$1"
+            if [ -z "$NODE_NAME" ]; then
+                NODE_NAME="$1"
            else
                echo "Unexpected argument: $1"
                usage
@@ -57,9 +57,9 @@ while [[ $# -gt 0 ]]; do
    esac
 done

-# Check if node IP was provided
-if [ -z "$NODE_IP" ]; then
-    echo "Error: Node IP address is required"
+# Check if node name was provided
+if [ -z "$NODE_NAME" ]; then
+    echo "Error: Node name is required"
    usage
    exit 1
 fi
@@ -104,38 +104,46 @@ fi
 # Get cluster configuration from config.yaml
 CLUSTER_NAME=$(wild-config cluster.name)

-print_info "Generating patch for node: $NODE_IP"
+print_info "Generating patch for node: $NODE_NAME"
 print_info "Cluster: $CLUSTER_NAME"

 # Check if the specified node is registered
-NODE_INTERFACE=$(yq eval ".cluster.nodes.active.\"${NODE_IP}\".interface" "${WC_HOME}/config.yaml" 2>/dev/null)
-NODE_DISK=$(yq eval ".cluster.nodes.active.\"${NODE_IP}\".disk" "${WC_HOME}/config.yaml" 2>/dev/null)
-IS_CONTROL=$(yq eval ".cluster.nodes.active.\"${NODE_IP}\".control" "${WC_HOME}/config.yaml" 2>/dev/null)
+NODE_INTERFACE=$(yq eval ".cluster.nodes.active.\"${NODE_NAME}\".interface" "${WC_HOME}/config.yaml" 2>/dev/null)
+NODE_DISK=$(yq eval ".cluster.nodes.active.\"${NODE_NAME}\".disk" "${WC_HOME}/config.yaml" 2>/dev/null)
+NODE_ROLE=$(yq eval ".cluster.nodes.active.\"${NODE_NAME}\".role" "${WC_HOME}/config.yaml" 2>/dev/null)
+NODE_CURRENT_IP=$(yq eval ".cluster.nodes.active.\"${NODE_NAME}\".currentIp" "${WC_HOME}/config.yaml" 2>/dev/null)

 if [ -z "$NODE_INTERFACE" ] || [ "$NODE_INTERFACE" = "null" ]; then
-    print_error "Node $NODE_IP is not registered in config.yaml"
-    print_info "Please register the node first by running node hardware detection:"
-    print_info "  wild-node-detect $NODE_IP"
-    print_info "Or run 'wild-setup' to register nodes interactively"
+    print_error "Node $NODE_NAME is not registered in config.yaml"
+    print_info "Please register the node first by running node hardware detection"
+    print_info "Or run 'wild-setup-cluster' to register nodes interactively"
+    exit 1
+fi
+
+# Get current IP for the node
+if [ -z "$NODE_CURRENT_IP" ] || [ "$NODE_CURRENT_IP" = "null" ]; then
+    print_error "Node $NODE_NAME has no current IP address set"
    exit 1
 fi

 # Determine node type
-if [ "$IS_CONTROL" = "true" ]; then
+if [ "$NODE_ROLE" = "controlplane" ]; then
    NODE_TYPE="control"
-    print_success "Registered control plane node: $NODE_IP"
+    print_success "Registered control plane node: $NODE_NAME"
 else
    NODE_TYPE="worker" 
-    print_success "Registered worker node: $NODE_IP"
+    print_success "Registered worker node: $NODE_NAME"
 fi

 print_info "Node details:"
+print_info "  - Name: $NODE_NAME"
+print_info "  - Current IP: $NODE_CURRENT_IP"
 print_info "  - Interface: $NODE_INTERFACE"
 print_info "  - Disk: $NODE_DISK"
 print_info "  - Type: $NODE_TYPE"

 # Compile patch template for the specified node
-print_info "Compiling patch template for $NODE_TYPE node $NODE_IP..."
+print_info "Compiling patch template for $NODE_TYPE node $NODE_NAME..."

 if [ "$NODE_TYPE" = "control" ]; then
    TEMPLATE_FILE="${TEMPLATE_SOURCE_DIR}/patch.templates/controlplane.yaml"
@@ -143,12 +151,12 @@ else
    TEMPLATE_FILE="${TEMPLATE_SOURCE_DIR}/patch.templates/worker.yaml" 
 fi

-# Use IP as the patch name
-PATCH_FILE="${NODE_SETUP_DIR}/patch/${NODE_IP}.yaml"
+# Use node name as the patch name
+PATCH_FILE="${NODE_SETUP_DIR}/patch/${NODE_NAME}.yaml"

-# Create a temporary template with the node IP for gomplate processing
-TEMP_TEMPLATE="/tmp/${NODE_IP//\//_}-$(date +%s).yaml"
-sed "s/{{NODE_IP}}/${NODE_IP}/g" "$TEMPLATE_FILE" > "$TEMP_TEMPLATE"
+# Create a temporary template with the node name and IP for gomplate processing
+TEMP_TEMPLATE="/tmp/${NODE_NAME//\//_}-$(date +%s).yaml"
+sed -e "s/{{NODE_NAME}}/${NODE_NAME}/g" -e "s/{{NODE_IP}}/${NODE_CURRENT_IP}/g" "$TEMPLATE_FILE" > "$TEMP_TEMPLATE"
 cat "$TEMP_TEMPLATE" | wild-compile-template > "$PATCH_FILE"
 rm -f "$TEMP_TEMPLATE"

--- a/bin/wild-cluster-node-up
+++ b/bin/wild-cluster-node-up
@@ -5,24 +5,25 @@ set -o pipefail

 # Usage function
 usage() {
-    echo "Usage: wild-cluster-node-up <node-ip> [options]"
+    echo "Usage: wild-cluster-node-up <node-name> [options]"
    echo ""
    echo "Apply Talos machine configuration to a registered node."
    echo ""
    echo "Arguments:"
-    echo "  node-ip             IP address of the registered node"
+    echo "  node-name           Name of the registered node"
    echo ""
    echo "Options:"
    echo "  -i, --insecure      Apply configuration in insecure mode (for maintenance mode nodes)"
-    echo "  --skip-patch        Skip automatic patch generation and use existing final config"
+    echo "  --force             Force regeneration of final config even if it exists"
    echo "  --dry-run           Show the command that would be executed without running it"
    echo "  -h, --help          Show this help message"
    echo ""
    echo "Examples:"
-    echo "  wild-cluster-node-up 192.168.1.91"
-    echo "  wild-cluster-node-up 192.168.1.100 --insecure"
-    echo "  wild-cluster-node-up 192.168.1.100 --skip-patch"
-    echo "  wild-cluster-node-up 192.168.1.100 --dry-run"
+    echo "  wild-cluster-node-up control-1"
+    echo "  wild-cluster-node-up worker-1 --insecure"
+    echo "  wild-cluster-node-up worker-2 --skip-patch"
+    echo "  wild-cluster-node-up control-2 --force"
+    echo "  wild-cluster-node-up control-1 --dry-run"
    echo ""
    echo "This script will:"
    echo "  - Verify the node is registered in config.yaml"
@@ -37,10 +38,11 @@ usage() {
 }

 # Parse arguments
-NODE_IP=""
+NODE_NAME=""
 INSECURE_MODE=false
 DRY_RUN=false
 SKIP_PATCH=false
+FORCE_REGENERATE=false

 while [[ $# -gt 0 ]]; do
    case $1 in
@@ -48,8 +50,8 @@ while [[ $# -gt 0 ]]; do
            INSECURE_MODE=true
            shift
            ;;
-        --skip-patch)
-            SKIP_PATCH=true
+        --force)
+            FORCE_REGENERATE=true
            shift
            ;;
        --dry-run)
@@ -66,8 +68,8 @@ while [[ $# -gt 0 ]]; do
            exit 1
            ;;
        *)
-            if [ -z "$NODE_IP" ]; then
-                NODE_IP="$1"
+            if [ -z "$NODE_NAME" ]; then
+                NODE_NAME="$1"
            else
                echo "Unexpected argument: $1"
                usage
@@ -78,9 +80,9 @@ while [[ $# -gt 0 ]]; do
    esac
 done

-# Check if node IP was provided
-if [ -z "$NODE_IP" ]; then
-    echo "Error: Node IP address is required"
+# Check if node name was provided
+if [ -z "$NODE_NAME" ]; then
+    echo "Error: Node name is required"
    usage
    exit 1
 fi
@@ -94,31 +96,30 @@ else
    init_wild_env
 fi

-# Check required configuration  
-if [ -z "$(get_current_config "cluster.name")" ]; then
-    print_error "Basic cluster configuration is missing"
-    print_info "Run 'wild-setup' or 'wild-init' first to configure your cluster"
-    exit 1
-fi
-
 print_header "Talos Node Configuration Application"

 # Check if the specified node is registered
-NODE_INTERFACE=$(yq eval ".cluster.nodes.active.\"${NODE_IP}\".interface" "${WC_HOME}/config.yaml" 2>/dev/null)
-NODE_DISK=$(yq eval ".cluster.nodes.active.\"${NODE_IP}\".disk" "${WC_HOME}/config.yaml" 2>/dev/null)
-IS_CONTROL=$(yq eval ".cluster.nodes.active.\"${NODE_IP}\".control" "${WC_HOME}/config.yaml" 2>/dev/null)
-MAINTENANCE_IP=$(yq eval ".cluster.nodes.active.\"${NODE_IP}\".maintenanceIp" "${WC_HOME}/config.yaml" 2>/dev/null)
+NODE_INTERFACE=$(yq eval ".cluster.nodes.active.\"${NODE_NAME}\".interface" "${WC_HOME}/config.yaml" 2>/dev/null)
+NODE_DISK=$(yq eval ".cluster.nodes.active.\"${NODE_NAME}\".disk" "${WC_HOME}/config.yaml" 2>/dev/null)
+NODE_ROLE=$(yq eval ".cluster.nodes.active.\"${NODE_NAME}\".role" "${WC_HOME}/config.yaml" 2>/dev/null)
+NODE_CURRENT_IP=$(yq eval ".cluster.nodes.active.\"${NODE_NAME}\".currentIp" "${WC_HOME}/config.yaml" 2>/dev/null)
+MAINTENANCE_IP=$(yq eval ".cluster.nodes.active.\"${NODE_NAME}\".maintenanceIp" "${WC_HOME}/config.yaml" 2>/dev/null)

 if [ -z "$NODE_INTERFACE" ] || [ "$NODE_INTERFACE" = "null" ]; then
-    print_error "Node $NODE_IP is not registered in config.yaml"
+    print_error "Node $NODE_NAME is not registered in config.yaml"
    print_info "Please register the node first by running:"
-    print_info "  wild-node-detect $NODE_IP"
-    print_info "Or run 'wild-setup' to register nodes interactively"
+    print_info "Or run 'wild-setup-cluster' to register nodes interactively"
+    exit 1
+fi
+
+# Get current IP for the node
+if [ -z "$NODE_CURRENT_IP" ] || [ "$NODE_CURRENT_IP" = "null" ]; then
+    print_error "Node $NODE_NAME has no current IP address set"
    exit 1
 fi

 # Determine node type
-if [ "$IS_CONTROL" = "true" ]; then
+if [ "$NODE_ROLE" = "controlplane" ]; then
    NODE_TYPE="control plane"
 else
    NODE_TYPE="worker"
@@ -127,18 +128,20 @@ fi
 # Determine the target IP for applying configuration
 if [ -n "$MAINTENANCE_IP" ] && [ "$MAINTENANCE_IP" != "null" ]; then
    TARGET_IP="$MAINTENANCE_IP"
-    print_info "Applying configuration to $NODE_TYPE node: $NODE_IP (via maintenance IP: $MAINTENANCE_IP)"
+    print_info "Applying configuration to $NODE_TYPE node: $NODE_NAME ($NODE_CURRENT_IP) via maintenance IP: $MAINTENANCE_IP"
    # Auto-enable insecure mode when using maintenance IP (unless explicitly overridden)
    if [ "$INSECURE_MODE" = false ]; then
        INSECURE_MODE=true
        print_info "Auto-enabling insecure mode for maintenance IP"
    fi
 else
-    TARGET_IP="$NODE_IP"
-    print_info "Applying configuration to $NODE_TYPE node: $NODE_IP"
+    TARGET_IP="$NODE_CURRENT_IP"
+    print_info "Applying configuration to $NODE_TYPE node: $NODE_NAME ($NODE_CURRENT_IP)"
 fi

 print_info "Node details:"
+print_info "  - Name: $NODE_NAME"
+print_info "  - Current IP: $NODE_CURRENT_IP"
 print_info "  - Interface: $NODE_INTERFACE"
 print_info "  - Disk: $NODE_DISK"
 print_info "  - Type: $NODE_TYPE"
@@ -148,42 +151,40 @@ fi

 # Check if machine config exists, generate if needed
 NODE_SETUP_DIR="${WC_HOME}/setup/cluster-nodes"
-CONFIG_FILE="${NODE_SETUP_DIR}/final/${NODE_IP}.yaml"
-PATCH_FILE="${NODE_SETUP_DIR}/patch/${NODE_IP}.yaml"
+CONFIG_FILE="${NODE_SETUP_DIR}/final/${NODE_NAME}.yaml"
+PATCH_FILE="${NODE_SETUP_DIR}/patch/${NODE_NAME}.yaml"

-if [ ! -f "$CONFIG_FILE" ]; then
-    if [ "$SKIP_PATCH" = true ]; then
-        print_error "Machine configuration not found: $CONFIG_FILE"
-        print_info "--skip-patch was specified but no existing config found"
-        print_info "Either generate the configuration first or remove --skip-patch:"
-        print_info "  wild-cluster-node-machine-config-generate $NODE_IP"
-        exit 1
-    fi
-    
-    print_info "Machine configuration not found: $CONFIG_FILE"
-    print_info "Generating final machine configuration..."
-    
-    # Check if patch file exists
-    if [ ! -f "$PATCH_FILE" ]; then
+# Check if patch file exists
+if [ ! -f "$PATCH_FILE" ]; then
    print_error "Patch file not found: $PATCH_FILE"
    print_info "Generate the patch file first:"
-        print_info "  wild-cluster-node-patch-generate $NODE_IP"
+    print_info "  wild-cluster-node-patch-generate $NODE_NAME"
    exit 1
-    fi
+fi

-    # Determine base config file
-    if [ "$IS_CONTROL" = "true" ]; then
+# Determine base config file
+if [ "$NODE_ROLE" = "controlplane" ]; then
    BASE_CONFIG="${NODE_SETUP_DIR}/generated/controlplane.yaml"
-    else
+else
    BASE_CONFIG="${NODE_SETUP_DIR}/generated/worker.yaml"
-    fi
+fi

-    # Check if base config exists
-    if [ ! -f "$BASE_CONFIG" ]; then
+# Check if base config exists
+if [ ! -f "$BASE_CONFIG" ]; then
    print_error "Base configuration not found: $BASE_CONFIG"
    print_info "Generate base cluster configuration first:"
    print_info "  wild-cluster-config-generate"
    exit 1
+fi
+
+# Check if we should skip regeneration
+if [ ! -f "$CONFIG_FILE" ] || [ "$FORCE_REGENERATE" = true ]; then
+    # Need to generate/regenerate the final config
+    if [ "$FORCE_REGENERATE" = true ]; then
+        print_info "Force regeneration requested: regenerating machine configuration..."
+    else
+        print_info "Machine configuration not found: $CONFIG_FILE"
+        print_info "Generating final machine configuration..."
    fi
        
    # Create final config directory if it doesn't exist
@@ -195,9 +196,6 @@ if [ ! -f "$CONFIG_FILE" ]; then
    print_success "Generated machine configuration: $CONFIG_FILE"
 else
    print_success "Found existing machine configuration: $CONFIG_FILE"
-    if [ "$SKIP_PATCH" = true ]; then
-        print_info "--skip-patch specified: using existing configuration without regeneration"
-    fi
 fi

 # Build talosctl command
@@ -230,15 +228,15 @@ if eval "$TALOSCTL_CMD"; then
    
    # Update talosctl context to this node
    print_info "Updating talosctl context..."
-    talosctl config node "$NODE_IP"
-    print_success "Updated talosctl context to node $NODE_IP"
+    talosctl config node "$NODE_CURRENT_IP"
+    print_success "Updated talosctl context to node $NODE_NAME ($NODE_CURRENT_IP)"
    echo ""
    
-    if [ "$IS_CONTROL" = "true" ]; then
+    if [ "$NODE_ROLE" = "controlplane" ]; then
        print_info "Next steps for control plane node:"
        echo "  1. Wait for the node to reboot and come up with the new configuration"
        echo "  2. If this is your first control plane node, bootstrap it:"
-        echo "     talosctl bootstrap --nodes $NODE_IP"
+        echo "     talosctl bootstrap --nodes $NODE_CURRENT_IP"
        echo "  3. Get kubeconfig when cluster is ready:"
        echo "     talosctl kubeconfig"
    else
@@ -251,8 +249,8 @@ if eval "$TALOSCTL_CMD"; then
    
    echo ""
    print_info "Monitor node status with:"
-    echo "  talosctl --nodes $NODE_IP dmesg"
-    echo "  talosctl --nodes $NODE_IP get members"
+    echo "  talosctl --nodes $NODE_CURRENT_IP dmesg"
+    echo "  talosctl --nodes $NODE_CURRENT_IP get members"
    
 else
    print_error "Failed to apply machine configuration"
@@ -261,7 +259,7 @@ else
    if [ -n "$MAINTENANCE_IP" ] && [ "$MAINTENANCE_IP" != "null" ]; then
        echo "  - Ensure the node is accessible at maintenance IP $MAINTENANCE_IP"
    else
-        echo "  - Ensure the node is accessible at $NODE_IP"
+        echo "  - Ensure the node is accessible at $NODE_CURRENT_IP"
    fi
    echo "  - For nodes in maintenance mode, use --insecure flag"
    echo "  - Check network connectivity and firewall settings"
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Paul Payne	10c67169b5	Add codimd app.	2025-08-16 07:54:06 -07:00
Paul Payne	c2f8f7e6a0	Default value created when `wild-secret-set` is run.	2025-08-15 03:32:55 -07:00
Paul Payne	22d4dc15ce	Backup env config setup. Add `--check` flag to wild-config and wild-set.	2025-08-15 03:32:18 -07:00
Paul Payne	4966bd05f2	Add backup config to wild-setup-scaffold	2025-08-08 09:57:07 -07:00
Paul Payne	6be0260673	Remove config wrappers.	2025-08-08 09:56:36 -07:00
Paul Payne	97e25a5f08	Update `wild-app-add` to copy all template files. Clean up script output.	2025-08-08 09:30:31 -07:00
Paul Payne	360069a8e8	Adds redis password. Adds tlsSecretName config to manifests.	2025-08-08 09:27:48 -07:00
Paul Payne	33dce80116	Adds discourse app.	2025-08-08 09:26:02 -07:00
Paul Payne	9ae248d5f7	Updates secret handling in wild-app-deploy.	2025-08-05 17:40:56 -07:00
Paul Payne	333e215b3b	Add note about using helm charts in apps/README.md.	2025-08-05 17:39:31 -07:00
Paul Payne	b69344fae6	Updates keila app with new tls smtp config.	2025-08-05 17:39:03 -07:00
Paul Payne	03c631d67f	Adds listmonk app.	2025-08-05 17:38:28 -07:00
Paul Payne	f4f2bfae1c	Remove defaultConfig from manifest when adding an app.	2025-08-04 16:02:37 -07:00
Paul Payne	fef238db6d	Get SMTP connection sercurity config during service setup.	2025-08-04 16:01:32 -07:00
Paul Payne	b1b14d8d80	Fix manifest templating in wild-cloud-add	2025-08-04 16:00:53 -07:00
Paul Payne	4c14744a32	Adds keila app.	2025-08-04 13:58:05 -07:00
Paul Payne	5ca8c010e5	Use full secret paths.	2025-08-04 13:57:52 -07:00
Paul Payne	22537da98e	Update spelling dictionary.	2025-08-03 12:34:27 -07:00
Paul Payne	f652a82319	Add db details to app README.	2025-08-03 12:34:08 -07:00
Paul Payne	c7c71a203f	SMTP service setup.	2025-08-03 12:27:02 -07:00
Paul Payne	7bbc4cc52d	Remove test artifact.	2025-08-03 12:26:14 -07:00
Paul Payne	d3260d352a	Fix wild-app-add secret generation.	2025-08-03 12:24:21 -07:00
Paul Payne	800f6da0d9	Updates mysql app to follow new wild-app patterns.	2025-08-03 12:23:55 -07:00
Paul Payne	39b174e857	Simplify environment in gitea app.	2025-08-03 12:23:33 -07:00
Paul Payne	23f1cb7b32	Updates ghost app to follow new wild-app patterns.	2025-08-03 12:23:04 -07:00
Paul Payne	bfc5582996	License updates.	2025-07-23 21:12:54 -07:00
Paul Payne	52cf28c486	Gitea app updates.	2025-07-23 21:12:21 -07:00
Paul Payne	ad324f19a0	Adds license.	2025-07-23 09:06:44 -07:00
Paul Payne	47f3520063	Clean up longhorn setup files.	2025-07-23 07:47:32 -07:00
Paul Payne	0bf18ba50f	Replace dummy secret generation with random secret for improved security	2025-07-23 07:47:06 -07:00
Paul Payne	ba065e8d2c	Refactor Gitea deployment: remove init containers and streamline configuration	2025-07-21 17:35:49 -07:00
Paul Payne	c0b1d60e7b	Cluster nodes by name instead of (mutable) ip.	2025-07-21 17:32:21 -07:00
Paul Payne	9d1ad5950b	Add `wild-cluster-node-ip` script.	2025-07-21 17:30:35 -07:00
Paul Payne	ceec84b655	Fix wild-setup-cluster: continue if secrets already generated; fix talos context detection command.	2025-07-18 08:12:16 -07:00
Paul Payne	a92d427fc4	Adds gitea app.	2025-07-17 14:02:22 -07:00