Restore strategies.

refactor: update README for clarity and remove setup script
Reorganized for new stable/waypoint versioning design.
2026-05-25 23:10:03 +00:00 · 2026-05-24 20:04:12 +00:00 · 2026-05-24 18:28:47 +00:00 · 2026-05-24 04:00:07 +00:00 · 2026-05-23 20:42:45 +00:00 · 2026-05-23 19:51:33 +00:00
375 changed files with 25439 additions and 1212 deletions
--- a/ADDING-APPS.md
+++ b/ADDING-APPS.md
@@ -6,69 +6,442 @@ This guide is for contributors and maintainers who want to create or modify Wild
 Wild Cloud apps are Kubernetes applications packaged as Kustomize configurations with standardized conventions for configuration management, secrets handling, and deployment.
 ## Directory Structure
 Each app has a two-level structure: an `app.yaml` meta file at the root, and version-specific files inside `versions/`. Version directories are named by **slot** (typically the major version), not by the full version string. The actual version lives in `manifest.yaml` inside the slot.
 ```
 myapp/
 ├── app.yaml               # App identity, latest slot pointer, upgrade routing
 └── versions/
    ├── 2/                  # Current latest slot (manifest.yaml has version: 2.3.1)
    │   ├── manifest.yaml   # Version-specific config (requires, defaultConfig, etc.)
    │   ├── kustomization.yaml
    │   └── *.yaml          # Kubernetes resource templates
    └── 1/                  # Waypoint slot (only if upgrade routing needs it)
        ├── manifest.yaml
        ├── kustomization.yaml
        └── *.yaml
 ```
 Most apps have **one** version directory. A second appears only when a waypoint is needed for upgrade routing.
 ## Required Files
 Each app directory must contain:
-1. **`manifest.yaml`** - App metadata and configuration schema
+1. **`app.yaml`** - App identity, latest slot pointer, and upgrade routing rules
-2. **`kustomization.yaml`** - Kustomize configuration with Wild Cloud labels
+2. **`versions/{slot}/manifest.yaml`** - Version-specific configuration schema
-3. **Resource files** - Kubernetes manifests (deployments, services, ingresses, etc.)
+3. **`versions/{slot}/kustomization.yaml`** - Kustomize configuration with Wild Cloud labels
 4. **`versions/{slot}/*.yaml`** - Kubernetes resource templates
-## App Manifest (`manifest.yaml`)
+## App Meta (`app.yaml`)
-The manifest defines the app's metadata, dependencies, configuration schema, and secret requirements.
+The `app.yaml` file at the app root defines identity, display info, and upgrade routing. These fields are version-independent.
 This is the contents of an example `manifest.yaml` file for an app named "immich":
 ```yaml
 name: immich
 is: immich
 description: Immich is a self-hosted photo and video backup solution that allows you to store, manage, and share your media files securely.
 version: 1.0.0
 icon: https://immich.app/assets/images/logo.png
-requires:
+latest: "1"
  - name: pg
    alias: db        # Use a different reference name in templates
  - name: redis      # 'alias' and 'installedAs' default to 'name' value
 defaultConfig:
  serverImage: ghcr.io/immich-app/immich-server:release
  mlImage: ghcr.io/immich-app/immich-machine-learning:release
  timezone: UTC
  serverPort: 2283
  mlPort: 3003
  storage: 250Gi
  cacheStorage: 10Gi
  redisHostname: "{{ .apps.redis.host }}" # Can reference 'requires' app configurations
  dbHostname: "{{ .apps.pg.host }}"
  db: # Configuration can be nested
    name: immich
    user: immich
    host: "{{ .apps.pg.host }}"
    port: "{{ .apps.pg.port }}"
  domain: immich.{{ .cloud.domain }}
 defaultSecrets:
  - key: password      # Random value will be generated if empty
  - key: dbUrl
    default: "postgresql://{{ .app.db.user }}:{{ .secrets.dbPassword }}@{{ .app.db.host }}:{{ .app.db.port }}/{{ .app.db.name }}?pool=30" # Can reference secrets and config as long as they have been defined before this line. Reference config with {{ .app.? }} and secrets with {{ .secrets.? }}
 requiredSecrets:
  - db.password   # References postgres app via 'db' alias
  - redis.auth    # References redis app via 'redis' name (no alias)
 ```
-### Manifest Fields
+### App Meta Fields
 | Field | Required | Description |
 |-------|----------|-------------|
 | `name` | Yes | App identifier (must match directory name) |
 | `is` | Yes | Unique id for this app. Used for `requires` mapping |
 | `description` | Yes | Brief app description shown in listings |
 | `version` | Yes | App version (follow upstream versioning) |
 | `icon` | No | URL to app icon for UI display |
 | `category` | No | Category (e.g., `infrastructure`) |
 | `latest` | Yes | Slot name -- directory name under `versions/` (not a version string) |
 | `upgrade` | No | Upgrade routing rules (see Upgrade Metadata below) |
 ## Version Manifest (`versions/{slot}/manifest.yaml`)
 Each version slot contains a `manifest.yaml` with version-specific installation details: dependencies, configuration schema, and secret requirements.
 ```yaml
 version: 1.135.3-1
 requires:
  - name: pg
    alias: db        # Use a different reference name in templates
  - name: redis      # 'alias' and 'installedAs' default to 'name' value
 defaultConfig:
  namespace: immich
  externalDnsDomain: "{{ .cloud.domain }}"
  storage: 250Gi
  cacheStorage: 10Gi
  domain: immich.{{ .cloud.domain }}
  tlsSecretName: wildcard-wild-cloud-tls
  db: # Configuration can be nested
    host: "{{ .apps.pg.host }}" # Can reference 'requires' app configurations
    name: immich
    user: immich
  redis:
    host: "{{ .apps.redis.host }}"
 defaultSecrets:
  - key: password      # Random value will be generated if empty
  - key: dbUrl
    default: "postgresql://{{ .app.db.user }}:{{ .secrets.dbPassword }}@{{ .app.db.host }}:{{ .app.db.port }}/{{ .app.db.name }}?pool=30"
 requiredSecrets:
  - db.password   # References postgres app via 'db' alias
  - redis.auth    # References redis app via 'redis' name (no alias)
 ```
 ### Version Manifest Fields
 | Field | Required | Description |
 |-------|----------|-------------|
 | `version` | Yes | App version (see Versioning Convention below) |
 | `requires` | No | List of dependency apps with optional aliases |
 | `defaultConfig` | Yes | Default configuration values merged into operator's `config.yaml` |
 | `defaultSecrets` | No | This app's secrets (no 'default' = auto-generated) |
 | `requiredSecrets` | No | List of secrets from dependency apps (format: `<app-ref>.<key>`) |
 ### Versioning Convention
 Wild Cloud uses a two-part version scheme inspired by Debian packaging: `<upstream>-<revision>`.
 - **Upstream version** tracks the third-party software version (e.g., `v4.0.18`, `1.120.2`)
 - **Packaging revision** tracks Wild Cloud packaging changes (template fixes, manifest cleanup, config restructuring) that don't change the upstream software version
 **Examples:**
 - `v4.0.18` — initial packaging of upstream v4.0.18
 - `v4.0.18-1` — first packaging fix (no upstream change)
 - `v4.0.18-2` — second packaging fix
 - `v4.0.19` — upstream version bump, revision resets
 **When to bump the packaging revision:** Any change to the app package that doesn't correspond to an upstream software update — manifest field changes, template improvements, kustomize restructuring, security context fixes, label corrections, etc.
 **When to bump the upstream version:** When updating the container image tag or deploying a new version of the third-party software.
 The web UI uses version comparison to detect available updates. If the deployed version differs from the wild-directory version, operators see an update indicator and can apply it from the app detail panel.
 ### Slot Naming Convention
 Version directory names are **slot names**, not version strings. The slot is a stable label; the actual version lives in `manifest.yaml` inside the slot.
 **Rules:**
 - Use the **major version** as the slot name (e.g., `1`, `2`, `5`, `v3`)
 - Preserve the `v` prefix if the upstream project uses it (e.g., `v1` for cert-manager)
 - **Never** put packaging revisions (`-1`, `-2`) in directory names
 - **Never** put minor/patch versions in directory names unless creating a waypoint that needs to be distinct from another slot at the same major version
 **Examples:**
 | App | Slot name | Version in manifest |
 |-----|-----------|-------------------|
 | Ghost 5.118.1-2 | `5` | `5.118.1-2` |
 | cert-manager v1.17.2 | `v1` | `v1.17.2` |
 | Immich 1.135.3-1 | `1` | `1.135.3-1` |
 | Traefik v3.4 | `v3` | `v3.4` |
 When bumping versions (upstream or packaging), update files inside the existing slot. Only create a new directory when you need a new waypoint.
 ### Upgrade Metadata
 Most apps can upgrade from any version to any other version directly — no special metadata is needed. The `upgrade` field is **optional** and only required when an app has breaking changes that need controlled upgrade paths.
 **When you don't need `upgrade:`** Simple apps (Ghost, Redis, most stateless apps) where any version can safely replace any other version. This is the 90% case — just bump the version and the system handles it as a single-step update.
 **When you need `upgrade:`** Apps with breaking database schema changes, incompatible config formats, or upstream requirements for sequential version upgrades (e.g., Discourse requires stepping through major versions).
 #### The `upgrade` block in `app.yaml`
 Upgrade routing rules live in `app.yaml`, centralized for all versions. The system iteratively re-evaluates these rules after each waypoint step.
 ```yaml
 # app.yaml
 name: myapp
 latest: "3"
 upgrade:
  from:
    - version: ">=3.5.0"       # Can upgrade directly from 3.5.x
    - version: ">=3.4.0"
      via: "2"                  # Must pass through slot "2" first (a waypoint)
    - version: "<3.4.0"
      blocked: true
      notes: "Requires sequential major upgrades. See upstream docs."
  preUpgrade:
    backup: required            # "none", "recommended", or "required"
 ```
 Note: `latest` and `via` are **slot names** (directory names), not version strings. The system reads the actual version from the manifest inside each slot.
 Version-specific upgrade behavior (migrations, configMigrations) lives in the version's `manifest.yaml`:
 ```yaml
 # versions/3/manifest.yaml
 version: 3.6.0
 upgrade:
  migrations:
    pre:
      - migrations/pre-deploy.yaml   # K8s Job YAML paths relative to version dir
    post:
      - migrations/post-deploy.yaml
  configMigrations:
    oldKeyName: newKeyName      # Renames config keys automatically
 ```
 **`app.yaml` upgrade fields:**
 | Field | Description |
 |-------|-------------|
 | `from` | List of version constraint rules, evaluated in order (first match wins) |
 | `from[].version` | Version constraint: `>=`, `>`, `<=`, `<`, `=`, or `>0` (matches any) |
 | `from[].via` | Waypoint slot name in `versions/` — upgrade must pass through this slot first |
 | `from[].blocked` | If true, upgrade is blocked with an error message |
 | `from[].notes` | Human-readable message shown when blocked or as context |
 | `preUpgrade.backup` | Backup requirement: `"required"` blocks upgrade until backup is done, `"recommended"` shows a warning |
 **Version `manifest.yaml` upgrade fields:**
 | Field | Description |
 |-------|-------------|
 | `migrations.pre` | K8s Job YAMLs to run before deploying this version step |
 | `migrations.post` | K8s Job YAMLs to run after deploying this version step |
 | `configMigrations` | Map of old config key → new config key for automatic renaming |
 #### Waypoint versions
 When an upgrade requires passing through an intermediate version, add that version's files as a new slot in the `versions/` directory alongside the latest:
 ```
 myapp/
 ├── app.yaml               # Routing rules + latest pointer
 └── versions/
    ├── 3/                  # Latest slot (version: 3.6.0)
    │   ├── manifest.yaml
    │   ├── kustomization.yaml
    │   └── *.yaml
    └── 2/                  # Waypoint slot (version: 2.8.0)
        ├── manifest.yaml
        ├── kustomization.yaml
        └── *.yaml
 ```
 Each waypoint is a complete app package. The system computes a chain automatically — for example, upgrading from 2.3.0 to 3.6.0 might produce: `2.3.0 → 2.8.0 (slot "2") → 3.6.0 (slot "3")`.
 **Creating a waypoint:** The current latest slot becomes the waypoint (leave it in place), then create a new slot for the new major version:
 ```bash
 # Current slot "2" (with version 2.8.0) stays as a waypoint
 # Create the new slot for the next major version
 mkdir -p wild-directory/myapp/versions/3
 # ... add manifest.yaml, kustomization.yaml, *.yaml for 3.0.0 ...
 # Update app.yaml: set latest to "3", add upgrade routing rules with via: "2"
 ```
 #### Migration jobs
 Migration jobs are K8s Job manifests that run database migrations or other one-time tasks during an upgrade step. They must be **idempotent** (safe to re-run) since a failed upgrade might be retried.
 Place migration job files in the version slot directory and reference them from that version's `manifest.yaml`:
 ```yaml
 # versions/3/migrations/db-migrate.yaml
 apiVersion: batch/v1
 kind: Job
 metadata:
  name: myapp-db-migrate
 spec:
  template:
    spec:
      restartPolicy: OnFailure
      containers:
        - name: migrate
          image: myapp:3.6.0
          command: ["bundle", "exec", "rake", "db:migrate"]
 ```
 Each migration step belongs to the version that introduces the breaking change. If version 3.6.0 requires a schema migration, the migration lives in the slot `3/` directory.
 #### Example: simple app with waypoint
 ```yaml
 # myapp/app.yaml
 name: myapp
 latest: "2"
 upgrade:
  from:
    - version: ">=1.0.0"
      via: "1"
    - version: "<1.0.0"
      blocked: true
      notes: "Versions before 1.0.0 are not supported"
  preUpgrade:
    backup: recommended
 ```
 This creates a 2-step upgrade path: `1.x → slot "1" (e.g., version 1.0.0-1) → slot "2" (e.g., version 2.0.0)`. The waypoint at `versions/1/` is a complete app package used as an intermediate step.
 ### Adding a New Version
 When an upstream app releases a new version, you update the Wild Directory package to track it. The process depends on whether the new version has breaking changes.
 #### Simple version bump (no breaking changes)
 Most version updates are simple — update the container image tag, adjust any changed config, and update the version in `manifest.yaml`. No directory rename or `app.yaml` change needed.
 ```bash
 # 1. Update files inside the existing slot
 #    - Bump version in manifest.yaml (e.g., 1.2.0 → 1.3.0)
 #    - Update container image tags in deployment YAMLs
 #    - Adjust defaultConfig if the new version adds/changes config
 vi wild-directory/myapp/versions/1/manifest.yaml
 vi wild-directory/myapp/versions/1/deployment.yaml
 # 2. app.yaml doesn't change — latest still points to slot "1"
 # 3. Test
 wild app add myapp && wild app deploy myapp
 ```
 The directory structure stays the same:
 ```
 myapp/
 ├── app.yaml               # latest: "1" (unchanged)
 └── versions/
    └── 1/
        ├── manifest.yaml   # version: 1.3.0 (bumped)
        └── *.yaml
 ```
 #### Version bump with breaking changes (waypoint required)
 When the new version can't safely upgrade from all previous versions — e.g., a database schema change requires stepping through an intermediate version — create a new slot for the new major version, keep the old slot as a waypoint, and add routing rules.
 ```bash
 # 1. The current slot (2/) becomes a waypoint — leave it in place
 # 2. Create a new slot for the new major version
 mkdir -p wild-directory/myapp/versions/3
 # ... add new version files (manifest.yaml, kustomization.yaml, *.yaml) ...
 # 3. Update app.yaml: point latest to new slot, add upgrade routing rules
 ```
 ```yaml
 # app.yaml
 name: myapp
 latest: "3"
 upgrade:
  from:
    - version: ">=2.5.0"            # 2.5.x can upgrade directly
    - version: ">=2.0.0"
      via: "2"                       # Older 2.x must pass through slot 2 first
    - version: "<2.0.0"
      blocked: true
      notes: "Upgrade to 2.x first. See upstream migration guide."
  preUpgrade:
    backup: recommended
 ```
 The resulting directory:
 ```
 myapp/
 ├── app.yaml               # latest: "3", upgrade routing rules
 └── versions/
    ├── 3/                  # New latest (manifest.yaml has version: 3.0.0)
    │   ├── manifest.yaml
    │   └── *.yaml
    └── 2/                  # Waypoint (manifest.yaml has version: 2.5.0)
        ├── manifest.yaml
        └── *.yaml
 ```
 #### Version bump with database migrations
 When the new version requires a schema migration (e.g., `ALTER TABLE`, new indexes, data transformations), add migration job files to the slot directory and reference them from the version's `manifest.yaml`. Since this is a minor/patch update within the same major version, update files in-place in the existing slot.
 ```bash
 # 1. Update files inside the existing slot
 #    - Bump version in manifest.yaml (e.g., 2.0.0 → 2.1.0)
 #    - Update container image tags in deployment YAMLs
 vi wild-directory/myapp/versions/2/manifest.yaml
 vi wild-directory/myapp/versions/2/deployment.yaml
 # 2. Add migration job files
 mkdir -p wild-directory/myapp/versions/2/migrations
 ```
 Create the migration job:
 ```yaml
 # versions/2/migrations/pre-deploy.yaml
 apiVersion: batch/v1
 kind: Job
 metadata:
  name: myapp-migrate-2-1-0
  namespace: myapp
 spec:
  backoffLimit: 3
  template:
    spec:
      restartPolicy: OnFailure
      securityContext:
        runAsNonRoot: true
        runAsUser: 999
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: migrate
          image: myapp:2.1.0
          command: ["bundle", "exec", "rake", "db:migrate"]
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop: [ALL]
          env:
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: myapp-secrets
                  key: dbUrl
 ```
 Reference the migration in the version manifest:
 ```yaml
 # versions/2/manifest.yaml
 version: 2.1.0
 upgrade:
  migrations:
    pre:
      - migrations/pre-deploy.yaml
 defaultConfig:
  # ...
 ```
 `app.yaml` doesn't change — `latest` still points to slot `"2"`.
 Migration jobs must be **idempotent** — safe to re-run if an upgrade is retried after a partial failure. Use `CREATE IF NOT EXISTS`, `ALTER TABLE IF NOT EXISTS`, etc.
 **Pre vs post migrations:**
 - `pre` — runs before deploying the new version's manifests (schema changes that the new code needs)
 - `post` — runs after deploying (data backfills, cleanup that the old code didn't need)
 #### Version bump with config key renames
 When a version renames config keys (e.g., `dbHost` → `db.host`), use `configMigrations` to automatically rename them during upgrade:
 ```yaml
 # versions/2/manifest.yaml
 version: 2.1.0
 upgrade:
  configMigrations:
    dbHost: db.host
    dbPort: db.port
    dbName: db.name
 defaultConfig:
  db:
    host: "{{ .apps.pg.host }}"
    port: "5432"
    name: myapp
 ```
 The system renames the keys in the instance's `config.yaml` before recompiling templates with the new version.
 ### Dependency Configuration
 - Each dependency in `requires` can have:
@@ -121,15 +494,6 @@ Here's a comprehensive rundown of all config variables that get set during clust
 - cloud.dockerRegistryHost - Docker registry hostname (e.g., "registry.internal.cloud2.payne.io")
 ##### SMTP Configuration (SMTP Service):
 - cloud.smtp.host - SMTP server hostname
 - cloud.smtp.port - SMTP port (typically "465" or "587")
 - cloud.smtp.user - SMTP username
 - cloud.smtp.from - Default 'from' email address
 - cloud.smtp.tls - Enable TLS (true/false)
 - cloud.smtp.startTls - Enable STARTTLS (true/false)
 ###### Backup Configuration:
 - cloud.backup.root - Root path for backups
@@ -214,8 +578,7 @@ Configuration Flow
   - ExternalDNS → cluster.externalDns.ownerId
   - NFS → cloud.nfs.*
   - Docker Registry → cloud.dockerRegistryHost, cluster.dockerRegistry.storage
-   - SMTP → cloud.smtp.*
+4. Apps: Each app adds its configuration under apps.<name>.* based on its manifest (including SMTP as an infrastructure app at apps.smtp.*)
 4. Apps: Each app adds its configuration under apps.<name>.* based on its manifest
 #### Manifest App Reference Resolution:
@@ -369,6 +732,44 @@ When apps need database URLs with embedded credentials, **always use a dedicated
 Add `apps.myapp.dbUrl` to your manifest's `defaultSecrets`, and the system will generate the complete URL with embedded credentials automatically when the app is added.
 ### Backup/Restore Database Name Conventions
 Wild Cloud's backup/restore system uses blue-green deployments. During restore, a standby copy of the app is created with a colored database name (e.g., `myapp_green`). The system automatically patches env vars in your Kubernetes resources to point to the standby database.
 **How it works:** The restore system compiles your kustomize resources, finds env vars whose values match the original database name, and generates kustomize JSON patches to replace them with the standby database name. It uses env var naming conventions to distinguish database name fields from username fields (since both often have the same value).
 **Env var naming guidelines for database-related fields:**
 - **Database name env vars** should contain one of: `DATABASE`, `DB_NAME`, `DBNAME`, or `__DATABASE` in the env var name (e.g., `LISTMONK_db__database`, `DB_NAME`, `POSTGRES_DB`)
 - **Database URL env vars** are detected by containing `://` in the value (e.g., `postgresql://user:pass@host/dbname`)
 - **Username env vars** should contain `USER` in the name (e.g., `DB_USER`, `LISTMONK_db__user`) — these will NOT be patched even if the value matches the database name
 - Avoid env var names that are ambiguous about whether they hold a database name or username
 **Example — correct naming:**
 ```yaml
 env:
  - name: DB_NAME           # Will be patched (contains "DB_NAME")
    value: myapp
  - name: DB_USER           # Will NOT be patched (contains "USER")
    value: myapp
  - name: DATABASE_URL      # Will be patched (contains "://")
    value: "postgresql://myapp:secret@postgres/myapp"
 ```
 ## Deployment Strategy
 Apps using `ReadWriteOnce` (RWO) persistent volumes **must** set `strategy: type: Recreate` on their Deployment. RWO volumes can only be attached to one pod at a time, so the default `RollingUpdate` strategy will cause Multi-Attach errors during updates (the new pod can't mount the volume while the old pod still holds it).
 ```yaml
 spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      component: web
 ```
 ## Security Requirements
 ### Security Contexts
@@ -510,9 +911,16 @@ labels:
 Before submitting a new or modified app, verify:
- [ ] **Manifest**
+- [ ] **App Meta (`app.yaml`)**
  - [ ] `name` matches directory name
-  - [ ] All required fields present (`name`, `description`, `version`, `defaultConfig`)
+  - [ ] `latest` points to a valid version in `versions/`
  - [ ] `description` present
  - [ ] `upgrade` rules correct (if applicable)
 - [ ] **Version Manifest (`versions/{slot}/manifest.yaml`)**
  - [ ] `version` field present with full version string (e.g., `1.135.3-1`)
  - [ ] Slot directory follows naming convention (major version, e.g., `1`, `v1`)
  - [ ] All required fields present (`version`, `defaultConfig`)
  - [ ] All template variables defined in `defaultConfig`
  - [ ] `defaultSecrets` uses maps with 'key' and 'default' attributes
  - [ ] `requiredSecrets` references use `<app-ref>.<key>` format
@@ -526,6 +934,7 @@ Before submitting a new or modified app, verify:
 - [ ] **Resources**
  - [ ] Security contexts on all pods (both pod-level and container-level)
  - [ ] `strategy: type: Recreate` on deployments with ReadWriteOnce PVCs
  - [ ] Simple component labels, no Helm-style labels
  - [ ] Ingresses include external-dns annotations
  - [ ] Database apps include init jobs (if applicable)
--- a/admin/docs/design.md
+++ b/admin/docs/design.md
@@ -0,0 +1,692 @@
 # Wild Directory Versioning and Upgrade System
 Design specification for how Wild Cloud packages its third-party applications,
 tracks versions, and manages upgrades between versions.
 ## Problem
 Wild Cloud packages third-party applications as Kustomize templates. Each
 application needs:
 1. **Identity** that doesn't change between versions (name, description, icon)
 2. **Version-specific files** (k8s manifests, config schema, secrets schema)
 3. **Upgrade routing** when breaking changes prevent direct version jumps
 4. A clear, low-friction workflow for maintainers bumping versions
 The system must handle both simple apps (any version replaces any other) and
 complex apps (database migrations, mandatory stepping stones between major
 versions).
 ## Design
 ### Two-level structure: `app.yaml` + `versions/`
 Each app in the Wild Directory has a root-level `app.yaml` for identity and a
 `versions/` directory containing one or more version slots:
 ```
 ghost/
 +-- app.yaml
 +-- versions/
    +-- 5/
        +-- manifest.yaml
        +-- kustomization.yaml
        +-- deployment.yaml
        +-- ...
 ```
 **`app.yaml`** holds version-independent fields: name, description, icon,
 category, the `latest` pointer, and upgrade routing rules. These are facts
 about the app itself, not about any particular release.
 **`versions/{slot}/manifest.yaml`** holds version-specific fields: the precise
 version string, dependency declarations, default config, default secrets,
 deploy configuration, and per-version migration jobs. These are facts about a
 particular release.
 When the API installs an app, it reads both files and merges them. The
 installed manifest in the instance data directory contains the complete picture
 (name, description, icon, version, config, etc.).
 ### Version slots vs version strings
 A version directory is a **slot**, not a precise version identifier.
 The directory name is a stable label chosen by the maintainer. The actual
 version string lives in `manifest.yaml` inside the directory. These are
 intentionally decoupled:
 | Concept | Where it lives | Example |
 |---------|---------------|---------|
 | Slot name | Directory name under `versions/` | `5` |
 | Actual version | `version` field in `manifest.yaml` | `5.118.1-2` |
 | Latest pointer | `latest` field in `app.yaml` | `5` |
 | Waypoint pointer | `via` field in upgrade rules | `2` |
 The slot name should be the simplest stable identifier that distinguishes it
 from other slots. For semver apps, use the major version (`1`, `2`, `3`). For
 apps with non-semver schemes, use whatever upstream version boundary makes
 sense (`5`, `v4`, etc.).
 **Packaging revisions** (`-1`, `-2`, etc.) never appear in directory names.
 They only appear in `manifest.yaml`'s `version` field. A packaging revision
 is a Wild Cloud-side fix (template improvement, security context change, config
 restructure) that doesn't change the upstream software.
 **Minor and patch versions** also don't require new directories unless they
 introduce a breaking change that requires a waypoint. Updating Ghost from
 5.118.1 to 5.119.0 means editing files inside `versions/5/` and bumping the
 `version` field. The directory stays the same.
 This follows how established package systems work:
 | System | Directory/file identity | Where version lives |
 |--------|------------------------|-------------------|
 | Debian source packages | Package name (stable) | `debian/changelog` |
 | Helm charts | Chart name directory | `Chart.yaml` |
 | Homebrew | Formula file per package | Version attribute in file |
 | Nix packages | Package name directory | Derivation attribute |
 | FreeBSD ports | Port name directory | `Makefile` variable |
 | **Wild Cloud** | **Slot directory** | **`manifest.yaml`** |
 Wild Directory is a source package collection (templates compiled at install
 time), not an artifact repository (pre-built binaries stored per version). The
 source package pattern is the right fit.
 ### When directories are created and destroyed
 **Most apps have exactly one version directory.** This is the common case for
 apps where any version can replace any other (Ghost, Redis, most stateless
 services).
 **A second directory appears only when a waypoint is needed** -- when a
 breaking change means some installed versions can't jump directly to the
 latest and must pass through an intermediate version first.
 **A directory is removed when it's no longer needed as a waypoint.** If
 version `2/` was a waypoint for upgrading from 1.x to 3.x, but you later
 decide to drop support for 1.x entirely, you can remove `2/` and update the
 routing rules to block `<2.0.0`.
 ### `app.yaml` specification
 ```yaml
 # Required
 name: ghost                    # Must match directory name
 is: ghost                      # Unique type id, used for `requires` matching
 description: "Ghost is a..."   # Shown in app listings
 latest: "5"                    # Slot name pointing to a directory in versions/
 # Optional
 icon: "https://..."            # URL to app icon
 category: infrastructure       # Category for filtering
 # Optional -- only needed for apps with breaking upgrade paths
 upgrade:
  from:
    - version: ">=3.0.0"       # Constraint against installed version
    - version: ">=2.0.0"
      via: "2"                 # Slot name of waypoint directory
    - version: "<2.0.0"
      blocked: true
      notes: "Upgrade to 2.x first"
  preUpgrade:
    backup: recommended        # "none", "recommended", or "required"
 ```
 Fields:
 | Field | Type | Required | Description |
 |-------|------|----------|-------------|
 | `name` | string | yes | App identifier, must match directory name |
 | `is` | string | yes | Type id for dependency matching |
 | `description` | string | yes | Human-readable description |
 | `latest` | string | yes | Slot name -- directory name under `versions/` |
 | `icon` | string | no | URL to icon image |
 | `category` | string | no | Grouping category (e.g. `infrastructure`) |
 | `upgrade` | object | no | Routing rules for version upgrades |
 | `upgrade.from` | list | no | Ordered list of version constraint rules |
 | `upgrade.from[].version` | string | yes | Version constraint: `>=`, `>`, `<=`, `<`, `=`, or `>0` |
 | `upgrade.from[].via` | string | no | Slot name of waypoint to pass through |
 | `upgrade.from[].blocked` | bool | no | If true, upgrade is blocked |
 | `upgrade.from[].notes` | string | no | Human-readable message |
 | `upgrade.preUpgrade` | object | no | Pre-upgrade requirements |
 | `upgrade.preUpgrade.backup` | string | no | `"none"`, `"recommended"`, or `"required"` |
 **`latest` is a slot name, not a version string.** It tells the API which
 directory to look in. The actual version is read from the manifest inside that
 directory.
 **`via` is also a slot name.** It tells the upgrade planner which waypoint
 directory to route through.
 ### Version `manifest.yaml` specification
 ```yaml
 # Required
 version: 5.118.1-2
 # Optional
 requires:
  - name: pg
    alias: db
  - name: redis
 defaultConfig:
  namespace: ghost
  domain: ghost.{{ .cloud.domain }}
  # ...
 defaultSecrets:
  - key: password
  - key: dbUrl
    default: "postgresql://..."
 requiredSecrets:
  - db.password
 deploy:
  # ...
 scripts:
  # ...
 # Optional -- only when this version has step-specific upgrade behavior
 upgrade:
  migrations:
    pre:
      - migrations/pre-deploy.yaml
    post:
      - migrations/post-deploy.yaml
  configMigrations:
    oldKey: new.key
 ```
 Fields:
 | Field | Type | Required | Description |
 |-------|------|----------|-------------|
 | `version` | string | yes | Precise version string (e.g. `5.118.1-2`) |
 | `requires` | list | no | Dependencies with optional aliases |
 | `defaultConfig` | map | yes | Configuration schema merged into instance config |
 | `defaultSecrets` | list | no | App's own secrets |
 | `requiredSecrets` | list | no | Secrets needed from dependencies |
 | `deploy` | object | no | Deployment behavior (CRDs, phases, etc.) |
 | `scripts` | list | no | Operational scripts |
 | `upgrade.migrations.pre` | list | no | K8s Job YAMLs to run before deploying this version |
 | `upgrade.migrations.post` | list | no | K8s Job YAMLs to run after deploying this version |
 | `upgrade.configMigrations` | map | no | Old config key -> new config key renames |
 **Note the field split:** Identity and routing live in `app.yaml`. Installation
 details live here. The version manifest never contains `name`, `is`,
 `description`, `icon`, `category`, or `upgrade.from` routing rules.
 ### Versioning convention
 Wild Cloud uses a two-part version scheme: `<upstream>-<revision>`.
 - **Upstream** tracks the third-party software version: `5.118.1`, `v4.0.18`,
  `1.135.3`
 - **Revision** tracks Wild Cloud packaging changes: `-1`, `-2`, etc.
 A version without a revision suffix (e.g., `5.118.1`) is the initial
 packaging. Revision `-1` is the first packaging fix that doesn't change
 upstream software.
 This is the same convention Debian uses for its source packages.
 ## Upgrade system
 ### The 90% case: no routing rules needed
 Most apps can upgrade from any version to any other directly. The app has no
 `upgrade` block in `app.yaml`. When the API detects a version mismatch between
 installed and latest, it produces a single-step plan: install the latest
 version over the current one.
 ### The 10% case: routing rules in `app.yaml`
 Apps with breaking changes between versions need routing rules. These live in
 `app.yaml`, centralized for all versions. The rules are evaluated iteratively:
 1. Compare installed version against `upgrade.from` rules (first match wins)
 2. If the matching rule has `via`, step to that waypoint
 3. Re-evaluate the same rules with the waypoint's version as the new
   "installed" version
 4. Repeat until reaching latest or hitting a block
 This is iterative re-evaluation, not recursive descent into waypoint
 manifests. The routing logic lives in one place (`app.yaml`), not scattered
 across version manifests.
 ### Rule evaluation
 Rules are evaluated in order. First match wins. This means more-specific
 rules must come before less-specific ones:
 ```yaml
 upgrade:
  from:
    - version: ">=3.0.0"       # Already past the breaking change, direct
    - version: ">=2.0.0"
      via: "2"                  # Must step through 2.x waypoint first
    - version: "<2.0.0"
      blocked: true             # Too old, no supported path
 ```
 An installed version of `2.5.0` matches `>=2.0.0`, steps to waypoint `2/`
 (which contains, say, version `2.8.0`). Re-evaluation with `2.8.0` matches
 `>=2.0.0` again... but this time the waypoint IS the current version, so the
 visited-set check catches the cycle. 
 To avoid this, ensure a rule exists that matches post-waypoint versions
 and routes them directly:
 ```yaml
 upgrade:
  from:
    - version: ">=2.5.0"       # Post-waypoint versions go direct
    - version: ">=2.0.0"
      via: "2"                  # Pre-waypoint versions step through
    - version: "<2.0.0"
      blocked: true
 ```
 After stepping to waypoint `2/` (version `2.8.0`), re-evaluation matches
 `>=2.5.0` (no `via`), which means direct upgrade to latest.
 ### Version constraints
 Supported operators: `>=`, `>`, `<=`, `<`, `=`, and the special `>0` (matches
 any version). Constraints compare major.minor.patch numerically. The packaging
 revision is ignored in constraint matching so `>=5.118.0` matches `5.118.1-2`.
 ### Waypoints
 A waypoint is a version slot that exists solely as a stepping stone in an
 upgrade path. It contains a complete app package (manifest, kustomize, k8s
 resources) that can be installed and run.
 Waypoints are created when an upstream app has breaking changes that require
 sequential upgrades. For example, Discourse requires stepping through each
 major version. A database schema migration might require running version N
 before jumping to version N+2.
 Waypoint directories are referenced by slot name in `via` fields:
 ```yaml
 # app.yaml
 latest: "3"
 upgrade:
  from:
    - version: ">=2.5.0"
    - version: ">=2.0.0"
      via: "2"
 ```
 ```
 myapp/
 +-- app.yaml
 +-- versions/
    +-- 3/              # Latest (version: 3.0.0)
    +-- 2/              # Waypoint (version: 2.8.0)
 ```
 ### Per-version migrations
 Migration jobs (database schema changes, data transformations) are version-
 specific, not app-level. They live in the version's directory and are
 referenced from that version's `manifest.yaml`:
 ```yaml
 # versions/3/manifest.yaml
 version: 3.0.0
 upgrade:
  migrations:
    pre:
      - migrations/pre-deploy.yaml
    post:
      - migrations/post-deploy.yaml
 ```
 ```
 versions/3/
 +-- manifest.yaml
 +-- migrations/
 |   +-- pre-deploy.yaml     # K8s Job: runs before deploying 3.0.0
 |   +-- post-deploy.yaml    # K8s Job: runs after deploying 3.0.0
 +-- kustomization.yaml
 +-- deployment.yaml
 +-- ...
 ```
 Migration jobs must be idempotent (safe to re-run on retry). Use
 `CREATE IF NOT EXISTS`, `ALTER TABLE IF NOT EXISTS`, etc.
 **Pre-migrations** run before deploying the new version's manifests. Use for
 schema changes the new code depends on.
 **Post-migrations** run after deploying. Use for data backfills or cleanup
 the old code didn't need.
 ### Config migrations
 When a version renames config keys, `configMigrations` in the version manifest
 tells the system to rename them automatically in the instance's `config.yaml`
 before recompiling templates:
 ```yaml
 # versions/2/manifest.yaml
 version: 2.0.0
 upgrade:
  configMigrations:
    dbHost: db.host
    dbPort: db.port
 ```
 ## API path resolution
 The API resolves app paths through `resolveAppDir()`:
 1. Read `app.yaml` from the app root
 2. Use `latest` (or a specific requested slot) to find `versions/{slot}/`
 3. Verify `manifest.yaml` exists in that directory
 4. Return the directory path and parsed `AppMeta`
 For old-style apps (no `app.yaml`, `manifest.yaml` at root), the function
 falls back to the legacy path. This provides backward compatibility during
 migration.
 When installing, `applyMeta()` merges identity fields from `app.yaml` onto
 the version manifest:
 ```
 app.yaml          +  versions/5/manifest.yaml  =  installed manifest.yaml
 (name, is, desc,     (version, requires,          (complete picture)
 icon, category)      defaultConfig, ...)
 ```
 The installed manifest in the instance data directory always contains all
 fields because the instance needs the complete picture -- it doesn't have
 access to the Wild Directory's `app.yaml` at runtime.
 ## Drift detection
 The API detects when an installed app's version differs from the Wild
 Directory's latest. For new-style apps:
 1. Read `app.yaml` to get the `latest` slot name
 2. Read `versions/{latest}/manifest.yaml` to get the actual version string
 3. Compare against the installed manifest's version
 If they differ, the app is marked as having source drift with the available
 version noted. The upgrade planner then computes whether an upgrade path
 exists and how many steps it requires.
 ## Maintainer workflows
 ### Simple version bump
 The app upstream releases a new version with no breaking changes. Edit files
 in-place:
 ```bash
 # 1. Update files inside the existing slot
 vi wild-directory/ghost/versions/5/manifest.yaml   # bump version: 5.119.0
 vi wild-directory/ghost/versions/5/deployment.yaml  # update image tag
 # 2. app.yaml doesn't change -- latest still points to "5"
 # 3. Test
 wild app add ghost && wild app deploy ghost
 ```
 No directory created, renamed, or deleted. No `app.yaml` change.
 ### Packaging fix
 A Wild Cloud template fix, no upstream change:
 ```bash
 # 1. Bump packaging revision in manifest
 vi wild-directory/ghost/versions/5/manifest.yaml   # version: 5.118.1-3
 # 2. Fix whatever needs fixing
 vi wild-directory/ghost/versions/5/deployment.yaml
 # 3. app.yaml doesn't change
 ```
 ### Breaking upstream version (new waypoint)
 The app upstream releases a major version with schema changes:
 ```bash
 # 1. Current slot becomes a waypoint -- leave it in place
 #    versions/2/ stays, containing version 2.8.0
 # 2. Create the new slot
 mkdir -p wild-directory/myapp/versions/3
 # ... add manifest.yaml, kustomization.yaml, *.yaml for 3.0.0 ...
 # 3. Update app.yaml
 ```
 ```yaml
 # app.yaml
 name: myapp
 latest: "3"
 upgrade:
  from:
    - version: ">=2.5.0"         # Post-waypoint, direct
    - version: ">=2.0.0"
      via: "2"                    # Step through waypoint
    - version: "<2.0.0"
      blocked: true
 ```
 ### Adding a new app
 ```bash
 mkdir -p wild-directory/newapp/versions/1
 # Create app.yaml
 cat > wild-directory/newapp/app.yaml <<EOF
 name: newapp
 is: newapp
 description: My new application
 latest: "1"
 EOF
 # Create version manifest + k8s resources in versions/1/
 # ... manifest.yaml, kustomization.yaml, deployment.yaml, etc.
 ```
 ## Examples
 ### Ghost (simple app, one slot)
 ```
 ghost/
 +-- app.yaml
 |     name: ghost
 |     is: ghost
 |     description: Ghost is a powerful app for...
 |     icon: https://...
 |     latest: "5"
 +-- versions/
    +-- 5/
        +-- manifest.yaml    # version: 5.118.1-2
        +-- kustomization.yaml
        +-- deployment.yaml
        +-- service.yaml
        +-- ingress.yaml
        +-- namespace.yaml
        +-- pvc.yaml
        +-- db-init-job.yaml
 ```
 Upgrading from 5.100.0 to 5.118.1-2: single step, no routing rules needed.
 ### e2e-test-app (two slots, waypoint)
 ```
 e2e-test-app/
 +-- app.yaml
 |     name: e2e-test-app
 |     is: e2e-test-app
 |     description: End-to-end test application...
 |     latest: "2"
 |     upgrade:
 |       from:
 |         - version: ">=1.0.0"
 |           via: "1"
 |         - version: "<1.0.0"
 |           blocked: true
 |           notes: "Versions before 1.0.0 are not supported"
 |       preUpgrade:
 |         backup: recommended
 +-- versions/
    +-- 2/
    |   +-- manifest.yaml    # version: 2.0.0
    |   +-- kustomization.yaml
    |   +-- ...
    +-- 1/
        +-- manifest.yaml    # version: 1.0.0-1
        +-- kustomization.yaml
        +-- ...
 ```
 Upgrading from 0.5.0: blocked ("Versions before 1.0.0 are not supported").
 Upgrading from 1.2.0: two steps -- 1.2.0 -> 1.0.0-1 (waypoint) -> 2.0.0.
 ### SMTP (infrastructure service, one slot)
 ```
 smtp/
 +-- app.yaml
 |     name: smtp
 |     is: smtp
 |     description: SMTP relay service...
 |     category: infrastructure
 |     latest: "1"
 +-- versions/
    +-- 1/
        +-- manifest.yaml    # version: 1.0.0
 ```
 ### Complex app with migrations
 ```
 discourse/
 +-- app.yaml
 |     name: discourse
 |     is: discourse
 |     description: Discourse forum...
 |     latest: "3"
 |     upgrade:
 |       from:
 |         - version: ">=2.5.0"
 |         - version: ">=2.0.0"
 |           via: "2"
 |         - version: "<2.0.0"
 |           blocked: true
 |           notes: "See upstream migration guide"
 |       preUpgrade:
 |         backup: required
 +-- versions/
    +-- 3/
    |   +-- manifest.yaml    # version: 3.6.0
    |   +-- migrations/
    |   |   +-- pre-deploy.yaml
    |   +-- kustomization.yaml
    |   +-- ...
    +-- 2/
        +-- manifest.yaml    # version: 2.8.0
        +-- kustomization.yaml
        +-- ...
 ```
 ## Implementation notes
 ### Go types
 ```go
 // app.yaml
 type AppMeta struct {
    Name        string         `yaml:"name"`
    Is          string         `yaml:"is,omitempty"`
    Description string         `yaml:"description"`
    Icon        string         `yaml:"icon,omitempty"`
    Category    string         `yaml:"category,omitempty"`
    Latest      string         `yaml:"latest"`           // slot name
    Upgrade     *UpgradeConfig `yaml:"upgrade,omitempty"`
 }
 // version manifest.yaml (version-specific fields only)
 type AppManifest struct {
    Version         string                 `yaml:"version"`  // precise version string
    Requires        []AppDependency        `yaml:"requires,omitempty"`
    DefaultConfig   map[string]interface{} `yaml:"defaultConfig,omitempty"`
    DefaultSecrets  []SecretDefinition     `yaml:"defaultSecrets,omitempty"`
    RequiredSecrets []string               `yaml:"requiredSecrets,omitempty"`
    Deploy          *DeployConfig          `yaml:"deploy,omitempty"`
    Scripts         []Script               `yaml:"scripts,omitempty"`
    Upgrade         *UpgradeConfig         `yaml:"upgrade,omitempty"` // migrations only
    // Identity fields (Name, Is, Description, etc.) populated by applyMeta()
 }
 ```
 ### Backward compatibility
 The API supports both new-style (`app.yaml` + `versions/`) and old-style
 (`manifest.yaml` at root, `.versions/` for waypoints). `resolveAppDir()`
 checks for `app.yaml` first and falls back to the old layout.
 `ComputeUpgradePlan()` similarly checks for `app.yaml` before falling back
 to recursive manifest-based routing.
 Old-style support exists for migration purposes. New apps should always use
 the new-style layout.
 ### Source URI in installed manifests
 The `source` field in installed manifests points to the app root
 (`file:///wild-directory/ghost`), not the version directory. `Fetch()` and
 `Update()` resolve through `resolveAppDir()` from the root, which reads
 `app.yaml` to find the current latest slot.
 ## Design rationale
 ### Why decouple directory name from version string?
 Coupling them creates unnecessary churn. Every packaging fix requires creating
 a new directory and deleting the old one (`5.118.1/` -> `5.118.1-1/`). Every
 minor upstream release does the same. This churn has no benefit -- the files
 inside are what matter, not the directory name.
 Decoupling follows the source package pattern used by every major package
 system. The directory is a stable container. The version is metadata inside it.
 ### Why centralize routing rules in `app.yaml`?
 Scattering `upgrade.from` rules across version manifests means each waypoint
 must know how to route TO itself. Adding a new waypoint requires editing
 multiple manifests. Reading the upgrade path requires opening every version
 manifest in the chain.
 Centralizing in `app.yaml` means one file describes the complete routing
 topology. The upgrade planner reads one file and iteratively applies rules.
 Adding a new waypoint means editing one file.
 ### Why iterative re-evaluation instead of recursive descent?
 Recursive descent reads the target manifest, finds a `via`, recurses into the
 waypoint, which has its own `via`, and so on. This scatters routing logic
 across files and makes the path hard to reason about.
 Iterative re-evaluation reads `app.yaml` once, applies rules, steps to a
 waypoint, then applies the SAME rules again with the new version. The routing
 table is evaluated like firewall rules -- same table, different input. This
 is simpler to implement, debug, and maintain.
 ### Why not use a flat file for all versions?
 A single YAML file listing all versions and their configs would centralize
 everything but would grow unwieldy for apps with many k8s resource files.
 Each version slot needs its own `kustomization.yaml`, deployment specs,
 service definitions, etc. Directories are the natural unit.
--- a/cert-manager/app.yaml
+++ b/cert-manager/app.yaml
@@ -0,0 +1,5 @@
 name: cert-manager
 is: cert-manager
 description: X.509 certificate management for Kubernetes
 category: infrastructure
 latest: "v1"
--- a/cert-manager/versions/v1/README.md
+++ b/cert-manager/versions/v1/README.md
@@ -0,0 +1,20 @@
 # cert-manager
 X.509 certificate management for Kubernetes using Let's Encrypt.
 ## Upstream
 The `upstream/cert-manager.yaml` file is downloaded from the official cert-manager release:
 - Source: https://github.com/cert-manager/cert-manager/releases/download/v1.17.2/cert-manager.yaml
 - Version: v1.17.2
 To update, download the new version and replace the file.
 ## DNS Configuration
 The upstream cert-manager deployment is patched via kustomize overlay (`upstream/kustomization.yaml`) to use external DNS resolvers (1.1.1.1, 8.8.8.8) instead of cluster DNS. This is required for ACME DNS-01 challenge verification.
 ## Maintenance
 The `scripts/repair-certificates.sh` script can fix stuck certificates, orphaned ACME orders, and Cloudflare DNS cleanup errors. Run it manually when certificate issuance has issues.
--- a/cert-manager/versions/v1/internal-wildcard-certificate.yaml
+++ b/cert-manager/versions/v1/internal-wildcard-certificate.yaml
@@ -0,0 +1,19 @@
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: wildcard-internal-wild-cloud
  namespace: cert-manager
 spec:
  secretName: wildcard-internal-wild-cloud-tls
  dnsNames:
    - "*.{{ .internalDomain }}"
    - "{{ .internalDomain }}"
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  duration: 2160h # 90 days
  renewBefore: 360h # 15 days
  privateKey:
    algorithm: RSA
    size: 2048
--- a/cert-manager/versions/v1/kustomization.yaml
+++ b/cert-manager/versions/v1/kustomization.yaml
@@ -0,0 +1,9 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
 - namespace.yaml
 - letsencrypt-staging-dns01.yaml
 - letsencrypt-prod-dns01.yaml
 - internal-wildcard-certificate.yaml
 - wildcard-certificate.yaml
--- a/cert-manager/versions/v1/letsencrypt-prod-dns01.yaml
+++ b/cert-manager/versions/v1/letsencrypt-prod-dns01.yaml
@@ -0,0 +1,25 @@
 ---
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
 metadata:
  name: letsencrypt-prod
 spec:
  acme:
    email: {{ .email }}
    privateKeySecretRef:
      name: letsencrypt-prod
    server: https://acme-v02.api.letsencrypt.org/directory
    solvers:
    # DNS-01 solver for wildcard certificates
    - dns01:
        cloudflare:
          apiTokenSecretRef:
            name: cloudflare-api-token
            key: api-token
      selector:
        dnsZones:
        - "{{ .cloudflareDomain }}"
    # Keep the HTTP-01 solver for non-wildcard certificates
    - http01:
        ingress:
          class: traefik
--- a/cert-manager/versions/v1/letsencrypt-staging-dns01.yaml
+++ b/cert-manager/versions/v1/letsencrypt-staging-dns01.yaml
@@ -0,0 +1,25 @@
 ---
 apiVersion: cert-manager.io/v1
 kind: ClusterIssuer
 metadata:
  name: letsencrypt-staging
 spec:
  acme:
    email: {{ .email }}
    privateKeySecretRef:
      name: letsencrypt-staging
    server: https://acme-staging-v02.api.letsencrypt.org/directory
    solvers:
    # DNS-01 solver for wildcard certificates
    - dns01:
        cloudflare:
          apiTokenSecretRef:
            name: cloudflare-api-token
            key: api-token
      selector:
        dnsZones:
        - "{{ .cloudflareDomain }}"
    # Keep the HTTP-01 solver for non-wildcard certificates
    - http01:
        ingress:
          class: traefik
--- a/cert-manager/versions/v1/manifest.yaml
+++ b/cert-manager/versions/v1/manifest.yaml
@@ -0,0 +1,26 @@
 version: v1.17.2
 requires:
  - name: traefik
 defaultConfig:
  namespace: cert-manager
  cloudDomain: "{{ .cloud.domain }}"
  internalDomain: "{{ .cloud.internalDomain }}"
  email: "{{ .operator.email }}"
  cloudflareDomain: "{{ .cloud.baseDomain }}"
 scripts:
  - name: repair-certificates
    path: scripts/repair-certificates.sh
    description: Fix stuck certificates, orphaned ACME orders, and Cloudflare DNS cleanup errors
 defaultSecrets:
  - key: cloudflareToken
 deploy:
  phases:
    - path: upstream
      waitFor:
        name: cert-manager-webhook
        timeout: "120s"
    - path: .
  createSecrets:
    - name: cloudflare-api-token
      entries:
        api-token: cloudflareToken
--- a/cert-manager/versions/v1/namespace.yaml
+++ b/cert-manager/versions/v1/namespace.yaml
--- a/cert-manager/versions/v1/scripts/repair-certificates.sh
+++ b/cert-manager/versions/v1/scripts/repair-certificates.sh
@@ -0,0 +1,89 @@
 #!/bin/bash
 # Repair stuck certificates, orphaned ACME orders, and Cloudflare DNS errors.
 # This is an operational maintenance script, not part of deployment.
 # Run manually when cert-manager has issues with certificate issuance.
 #
 # Usage: KUBECONFIG=/path/to/kubeconfig ./repair-certificates.sh
 set -e
 set -o pipefail
 if [ -z "${KUBECONFIG}" ]; then
    echo "ERROR: KUBECONFIG is not set"
    exit 1
 fi
 needs_restart=false
 echo "=== cert-manager Certificate Repair ==="
 echo ""
 echo "Checking for certificates with failed issuance attempts..."
 stuck_certs=$(kubectl get certificates --all-namespaces -o json 2>/dev/null | \
    jq -r '.items[] | select(.status.conditions[]? | select(.type=="Issuing" and .status=="False" and (.message | contains("404")))) | "\(.metadata.namespace) \(.metadata.name)"')
 if [ -n "$stuck_certs" ]; then
    echo "WARNING: Found certificates stuck with non-existent orders, recreating them..."
    echo "$stuck_certs" | while read ns name; do
        echo "Recreating certificate $ns/$name..."
        cert_spec=$(kubectl get certificate "$name" -n "$ns" -o json | jq '.spec')
        kubectl delete certificate "$name" -n "$ns"
        echo "{\"apiVersion\":\"cert-manager.io/v1\",\"kind\":\"Certificate\",\"metadata\":{\"name\":\"$name\",\"namespace\":\"$ns\"},\"spec\":$cert_spec}" | kubectl apply -f -
    done
    needs_restart=true
    sleep 5
 else
    echo "No certificates stuck with failed orders"
 fi
 echo "Checking for orphaned ACME orders..."
 orphaned_orders=$(kubectl logs -n cert-manager deployment/cert-manager --tail=200 2>/dev/null | \
    grep -E "failed to retrieve the ACME order.*404" 2>/dev/null | \
    sed -n 's/.*resource_name="\([^"]*\)".*/\1/p' | \
    sort -u || true)
 if [ -n "$orphaned_orders" ]; then
    echo "WARNING: Found orphaned ACME orders from logs"
    for order in $orphaned_orders; do
        echo "Deleting orphaned order: $order"
        orders_found=$(kubectl get orders --all-namespaces 2>/dev/null | grep "$order" 2>/dev/null || true)
        if [ -n "$orders_found" ]; then
            echo "$orders_found" | while read ns name rest; do
                kubectl delete order "$name" -n "$ns" 2>/dev/null || true
            done
        fi
    done
    needs_restart=true
 else
    echo "No orphaned orders found in logs"
 fi
 echo "Checking for Cloudflare DNS cleanup errors..."
 cloudflare_errors=$(kubectl logs -n cert-manager deployment/cert-manager --tail=200 2>/dev/null | \
    grep -c "Error: 7003.*Could not route" 2>/dev/null || echo "0")
 if [ "$cloudflare_errors" -gt "0" ]; then
    echo "WARNING: Found $cloudflare_errors Cloudflare DNS cleanup errors (stale DNS record references)"
    echo "Deleting stuck challenges and orders to allow fresh start"
    kubectl delete challenges --all -n cert-manager 2>/dev/null || true
    kubectl delete orders --all -n cert-manager 2>/dev/null || true
    needs_restart=true
 else
    echo "No Cloudflare DNS cleanup errors"
 fi
 if [ "$needs_restart" = true ]; then
    echo "Restarting cert-manager to clear internal state..."
    kubectl rollout restart deployment cert-manager -n cert-manager
    kubectl rollout status deployment/cert-manager -n cert-manager --timeout=120s
    echo "Waiting for cert-manager to recreate fresh challenges..."
    sleep 15
 else
    echo "No restart needed - cert-manager state is clean"
 fi
 echo ""
 echo "Repair complete. Check certificate status with:"
 echo "  kubectl get certificates --all-namespaces"
 echo "  kubectl get clusterissuers"
--- a/cert-manager/versions/v1/upstream/cert-manager.yaml
+++ b/cert-manager/versions/v1/upstream/cert-manager.yaml
--- a/cert-manager/versions/v1/upstream/kustomization.yaml
+++ b/cert-manager/versions/v1/upstream/kustomization.yaml
@@ -0,0 +1,30 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - cert-manager.yaml
 patches:
  - target:
      kind: Deployment
      name: cert-manager
      namespace: cert-manager
    patch: |-
      apiVersion: apps/v1
      kind: Deployment
      metadata:
        name: cert-manager
        namespace: cert-manager
      spec:
        template:
          spec:
            dnsPolicy: None
            dnsConfig:
              nameservers:
                - "1.1.1.1"
                - "8.8.8.8"
              searches:
                - cert-manager.svc.cluster.local
                - svc.cluster.local
                - cluster.local
              options:
                - name: ndots
                  value: "5"
--- a/cert-manager/versions/v1/wildcard-certificate.yaml
+++ b/cert-manager/versions/v1/wildcard-certificate.yaml
@@ -0,0 +1,19 @@
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: wildcard-wild-cloud
  namespace: cert-manager
 spec:
  secretName: wildcard-wild-cloud-tls
  dnsNames:
    - "*.{{ .cloudDomain }}"
    - "{{ .cloudDomain }}"
  issuerRef:
    name: letsencrypt-prod
    kind: ClusterIssuer
  duration: 2160h # 90 days
  renewBefore: 360h # 15 days
  privateKey:
    algorithm: RSA
    size: 2048
--- a/communitarian/deployment-api.yaml
+++ b/communitarian/deployment-api.yaml
@@ -1,75 +0,0 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: communitarian-api
  namespace: "{{ .namespace }}"
 spec:
  replicas: 1
  selector:
    matchLabels:
      component: api
  template:
    metadata:
      labels:
        component: api
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        seccompProfile:
          type: RuntimeDefault
      initContainers:
      - name: fix-permissions
        image: busybox:1.36
        command: ['sh', '-c']
        args:
        - |
          mkdir -p /app/api/data/citizens /app/api/data/communities /app/api/data/content /app/api/data/memberships /app/api/data/reactions
          chmod -R 777 /app/api/data
          echo "Permissions fixed"
        volumeMounts:
        - name: data
          mountPath: /app/api/data
        securityContext:
          runAsUser: 0
          runAsNonRoot: false
      containers:
      - name: communitarian-api
        image: "{{ .apiImage }}"
        ports:
        - containerPort: {{ .apiPort }}
          name: http
        env:
        - name: TZ
          value: "{{ .timezone }}"
        - name: API_KEY
          valueFrom:
            secretKeyRef:
              name: communitarian-secrets
              key: apiKey
        - name: JWT_SECRET
          valueFrom:
            secretKeyRef:
              name: communitarian-secrets
              key: jwtSecret
        volumeMounts:
        - name: data
          mountPath: /app/api/data
        resources:
          requests:
            memory: "256Mi"
            cpu: "100m"
          limits:
            memory: "1Gi"
            cpu: "500m"
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop: [ALL]
          readOnlyRootFilesystem: false
      volumes:
      - name: data
        persistentVolumeClaim:
          claimName: communitarian-data
--- a/communitarian/deployment-app.yaml
+++ b/communitarian/deployment-app.yaml
@@ -1,47 +0,0 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: communitarian-app
  namespace: "{{ .namespace }}"
 spec:
  replicas: 1
  selector:
    matchLabels:
      component: app
  template:
    metadata:
      labels:
        component: app
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        seccompProfile:
          type: RuntimeDefault
      containers:
      - name: communitarian-app
        image: "{{ .appImage }}"
        ports:
        - containerPort: {{ .appPort }}
          name: http
        env:
        - name: TZ
          value: "{{ .timezone }}"
        - name: API_URL
          value: "http://communitarian-api:{{ .apiPort }}"
        - name: NEXT_PUBLIC_API_URL
          value: "/api"
        resources:
          requests:
            memory: "128Mi"
            cpu: "100m"
          limits:
            memory: "512Mi"
            cpu: "500m"
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop: [ALL]
          readOnlyRootFilesystem: false
--- a/communitarian/ingress.yaml
+++ b/communitarian/ingress.yaml
@@ -1,33 +0,0 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  name: communitarian
  namespace: "{{ .namespace }}"
  annotations:
    external-dns.alpha.kubernetes.io/target: "{{ .externalDnsDomain }}"
    external-dns.alpha.kubernetes.io/cloudflare-proxied: "false"
    traefik.ingress.kubernetes.io/router.middlewares: "{{ .namespace }}-strip-api@kubernetescrd"
 spec:
  ingressClassName: traefik
  tls:
  - hosts:
    - "{{ .domain }}"
    secretName: "{{ .tlsSecretName }}"
  rules:
  - host: "{{ .domain }}"
    http:
      paths:
      - path: /api
        pathType: Prefix
        backend:
          service:
            name: communitarian-api
            port:
              number: {{ .apiPort }}
      - path: /
        pathType: Prefix
        backend:
          service:
            name: communitarian-app
            port:
              number: {{ .appPort }}
--- a/communitarian/manifest.yaml
+++ b/communitarian/manifest.yaml
@@ -1,19 +0,0 @@
 name: communitarian
 is: communitarian
 description: Communitarian is a community-focused application with a web frontend and API backend for collaborative features.
 version: 1.0.0
 icon: https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/community.svg
 defaultConfig:
  namespace: communitarian
  appImage: payneio/communitarian-app:latest
  apiImage: payneio/communitarian-api:latest
  appPort: 3000
  apiPort: 8000
  domain: communitarian.{{ .cloud.domain }}
  externalDnsDomain: "{{ .cloud.domain }}"
  tlsSecretName: wildcard-wild-cloud-tls
  storage: 10Gi
  timezone: UTC
 defaultSecrets:
  - key: apiKey
  - key: jwtSecret
--- a/communitarian/middleware.yaml
+++ b/communitarian/middleware.yaml
@@ -1,9 +0,0 @@
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
  name: strip-api
  namespace: "{{ .namespace }}"
 spec:
  stripPrefix:
    prefixes:
      - /api
--- a/communitarian/pvc.yaml
+++ b/communitarian/pvc.yaml
@@ -1,11 +0,0 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
  name: communitarian-data
  namespace: "{{ .namespace }}"
 spec:
  accessModes:
  - ReadWriteOnce
  resources:
    requests:
      storage: "{{ .storage }}"
--- a/communitarian/service-api.yaml
+++ b/communitarian/service-api.yaml
@@ -1,13 +0,0 @@
 apiVersion: v1
 kind: Service
 metadata:
  name: communitarian-api
  namespace: "{{ .namespace }}"
 spec:
  selector:
    component: api
  ports:
  - port: {{ .apiPort }}
    targetPort: {{ .apiPort }}
    protocol: TCP
    name: http
--- a/communitarian/service-app.yaml
+++ b/communitarian/service-app.yaml
@@ -1,13 +0,0 @@
 apiVersion: v1
 kind: Service
 metadata:
  name: communitarian-app
  namespace: "{{ .namespace }}"
 spec:
  selector:
    component: app
  ports:
  - port: {{ .appPort }}
    targetPort: {{ .appPort }}
    protocol: TCP
    name: http
--- a/coredns/app.yaml
+++ b/coredns/app.yaml
@@ -0,0 +1,5 @@
 name: coredns
 is: coredns
 description: DNS server for internal cluster DNS resolution
 category: infrastructure
 latest: "v1"
--- a/coredns/versions/v1/README.md
+++ b/coredns/versions/v1/README.md
@@ -0,0 +1,45 @@
 # CoreDNS
 - https://kubernetes.io/docs/concepts/services-networking/dns-pod-service/
 - https://github.com/kubernetes/dns/blob/master/docs/specification.md
 - https://coredns.io/
 CoreDNS has the `kubernetes` plugin, so it returns all k8s service endpoints in well-known format.
 All services and pods are registered in CoreDNS.
 - <service-name>.<namespace>.svc.cluster.local
 - <service-name>.<namespace>
 - <service-name> (if in the same namespace)
 - <pod-ipv4-address>.<namespace>.pod.cluster.local
 - <pod-ipv4-address>.<service-name>.<namespace>.svc.cluster.local
 Any query for a resource in the `internal.$DOMAIN` domain will be given the IP of the Traefik proxy. We expose the CoreDNS server in the LAN via MetalLB just for this capability.
 ## Default CoreDNS Configuration
 This is the default CoreDNS configuration, for reference:
 ```txt
 .:53 {
    errors
    health { lameduck 5s }
    ready
    log . { class error }
    prometheus :9153
    kubernetes cluster.local in-addr.arpa ip6.arpa {
        pods insecure
        fallthrough in-addr.arpa ip6.arpa
        ttl 30
    }
    forward . /etc/resolv.conf { max_concurrent 1000 }
    cache 30 {
        disable success cluster.local
        disable denial cluster.local
    }
    loop
    reload
    loadbalance
 }
 ```
--- a/coredns/versions/v1/coredns-custom-config.yaml
+++ b/coredns/versions/v1/coredns-custom-config.yaml
@@ -0,0 +1,28 @@
 ---
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: coredns-custom
  namespace: kube-system
 data:
  # Custom server block for internal domains. All internal domains should
  # resolve to the cluster proxy.
  internal.server: |
    {{ .internalDomain }} {
      errors
      cache 30
      reload
      template IN A {
        match (.*)\.{{ .internalDomain | strings.ReplaceAll "." "\\." }}\.
        answer "{{`{{ .Name }}`}} 60 IN A {{ .loadBalancerIp }}"
      }
      template IN AAAA {
        match (.*)\.{{ .internalDomain | strings.ReplaceAll "." "\\." }}\.
        rcode NXDOMAIN
      }
    }
  # Custom override to set external resolvers.
  external.override: |
    forward . {{ .externalResolver }} {
      max_concurrent 1000
    }
--- a/coredns/versions/v1/kustomization.yaml
+++ b/coredns/versions/v1/kustomization.yaml
@@ -0,0 +1,5 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
  - coredns-custom-config.yaml
--- a/coredns/versions/v1/manifest.yaml
+++ b/coredns/versions/v1/manifest.yaml
@@ -0,0 +1,13 @@
 version: v1.12.0
 requires:
  - name: metallb
 defaultConfig:
  namespace: kube-system
  internalDomain: "{{ .cloud.internalDomain }}"
  loadBalancerIp: "{{ .apps.metallb.loadBalancerIp }}"
  externalResolver: "8.8.8.8"
 deploy:
  restartDeployments:
    - coredns
  waitForRollout:
    name: coredns
--- a/crowdsec/app.yaml
+++ b/crowdsec/app.yaml
@@ -0,0 +1,5 @@
 name: crowdsec
 is: crowdsec
 description: CrowdSec security engine with Traefik bouncer for threat detection and rate limiting
 category: infrastructure
 latest: "v1"
--- a/crowdsec/versions/v1/README.md
+++ b/crowdsec/versions/v1/README.md
@@ -0,0 +1,118 @@
 # CrowdSec Security Service
 CrowdSec is an open-source security engine that analyzes traffic patterns and blocks malicious actors. This service integrates CrowdSec with Traefik to provide automatic threat detection and rate limiting for all Wild Cloud ingresses.
 ## Components
 - **CrowdSec Agent**: Analyzes traffic patterns, maintains decision lists, and connects to the CrowdSec threat intelligence network
 - **Traefik Bouncer**: Integrates with Traefik via ForwardAuth to enforce CrowdSec decisions
 - **Security Middlewares**: Traefik middleware for rate limiting and security headers
 ## Default Protection
 After installation, **all ingresses are automatically protected** with:
 - Threat detection (blocks known malicious IPs and attack patterns)
 - Rate limiting (100 requests per minute per IP)
 - Security headers (HSTS, XSS protection, content-type sniffing prevention)
 ## Configuration
 Configuration is stored in `config.yaml` under `apps.crowdsec`:
 ```yaml
 apps:
  crowdsec:
    rateLimitAverage: "100"
    rateLimitBurst: "100"
 ```
 ## Secrets
 Secrets are stored in `secrets.yaml` under `apps.crowdsec`:
 ```yaml
 apps:
  crowdsec:
    agentPassword: <auto-generated>
    bouncerApiKey: <auto-generated>
 ```
 ## Opting Out
 To disable CrowdSec protection for a specific ingress (e.g., webhooks, health checks):
 ```yaml
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  annotations:
    traefik.ingress.kubernetes.io/router.middlewares: ""
 ```
 ## Using Only Rate Limiting
 To use rate limiting without threat detection:
 ```yaml
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  annotations:
    traefik.ingress.kubernetes.io/router.middlewares: crowdsec-rate-limit@kubernetescrd
 ```
 ## Monitoring
 View active decisions (blocked IPs):
 ```bash
 kubectl exec -n crowdsec deploy/crowdsec -- cscli decisions list
 ```
 View registered bouncers:
 ```bash
 kubectl exec -n crowdsec deploy/crowdsec -- cscli bouncers list
 ```
 View alerts:
 ```bash
 kubectl exec -n crowdsec deploy/crowdsec -- cscli alerts list
 ```
 View metrics (Prometheus format):
 ```bash
 kubectl port-forward -n crowdsec svc/crowdsec-lapi 6060:6060
 curl http://localhost:6060/metrics
 ```
 ## Threat Intelligence
 CrowdSec includes these detection collections:
 - `crowdsecurity/traefik` - Traefik-specific detections
 - `crowdsecurity/http-cve` - Known HTTP CVE exploits
 - `crowdsecurity/whitelist-good-actors` - Whitelist for known good actors (search engines, etc.)
 Enabled scenarios:
 - HTTP probing and path traversal detection
 - Bad user agent detection
 - Sensitive file access attempts
 - HTTP crawling detection
 - SSH brute force (if exposed)
 ## Troubleshooting
 **Bouncer not connecting to agent:**
 ```bash
 kubectl logs -n crowdsec deploy/traefik-crowdsec-bouncer
 kubectl exec -n crowdsec deploy/crowdsec -- cscli bouncers list
 ```
 **Check if middleware is applied:**
 ```bash
 kubectl get middleware -n crowdsec
 kubectl describe ingressroute -n <app-namespace> <route-name>
 ```
 **View CrowdSec logs:**
 ```bash
 kubectl logs -n crowdsec deploy/crowdsec
 ```
--- a/crowdsec/versions/v1/configmap.yaml
+++ b/crowdsec/versions/v1/configmap.yaml
@@ -0,0 +1,43 @@
 apiVersion: v1
 kind: ConfigMap
 metadata:
  name: crowdsec-config
  namespace: crowdsec
  labels:
    app: crowdsec
    managedBy: kustomize
    partOf: wild-cloud
 data:
  acquis.yaml: |
    filenames:
      - /var/log/containers/traefik-*_traefik_*.log
    force_inotify: true
    poll_without_inotify: true
    labels:
      type: containerd
      program: traefik
  profiles.yaml: |
    name: default_ip_remediation
    debug: false
    filters:
    - Alert.Remediation == true && Alert.GetScope() == "Ip"
    decisions:
    - type: ban
      duration: 4h
    on_success: break
    ---
    name: default_range_remediation
    debug: false
    filters:
    - Alert.Remediation == true && Alert.GetScope() == "Range"
    decisions:
    - type: ban
      duration: 4h
      scope: Range
    on_success: break
  postoverflows.yaml: |
    # Post-overflow configuration for crowdsec
    name: "rdns"
    debug: false
    filter: "evt.Enriched.IsoCode != ''"
    # Add reverse DNS enrichment
--- a/crowdsec/versions/v1/crowdsec-deployment.yaml
+++ b/crowdsec/versions/v1/crowdsec-deployment.yaml
@@ -0,0 +1,134 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: crowdsec
  namespace: crowdsec
  labels:
    app: crowdsec
    managedBy: kustomize
    partOf: wild-cloud
 spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      app: crowdsec
      managedBy: kustomize
      partOf: wild-cloud
  template:
    metadata:
      labels:
        app: crowdsec
        managedBy: kustomize
        partOf: wild-cloud
    spec:
      serviceAccountName: crowdsec
      affinity:
        podAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              labelSelector:
                matchLabels:
                  app: traefik
              topologyKey: kubernetes.io/hostname
      securityContext:
        runAsUser: 0
        runAsNonRoot: false
        fsGroup: 0
        seccompProfile:
          type: RuntimeDefault
      containers:
      - name: crowdsec
        image: crowdsecurity/crowdsec:v1.7.8
        env:
        - name: COLLECTIONS
          value: "crowdsecurity/traefik crowdsecurity/http-cve crowdsecurity/whitelist-good-actors crowdsecurity/iptables crowdsecurity/linux"
        - name: PARSERS
          value: "crowdsecurity/traefik-logs crowdsecurity/http-logs crowdsecurity/nginx-logs"
        - name: SCENARIOS
          value: "crowdsecurity/http-crawl-non_statics crowdsecurity/http-probing crowdsecurity/http-sensitive-files crowdsecurity/http-bad-user-agent crowdsecurity/http-path-traversal-probing crowdsecurity/ssh-bf crowdsecurity/ssh-slow-bf"
        - name: POSTOVERFLOWS
          value: "crowdsecurity/rdns crowdsecurity/cdn-whitelist"
        - name: GID
          value: "1000"
        - name: LEVEL_TRACE
          value: "false"
        - name: LEVEL_DEBUG
          value: "false"
        - name: LEVEL_INFO
          value: "true"
        - name: AGENT_USERNAME
          value: "kubernetes-cluster"
        - name: AGENT_PASSWORD
          valueFrom:
            secretKeyRef:
              name: crowdsec-agent-secret
              key: password
        - name: BOUNCER_KEY_traefik
          valueFrom:
            secretKeyRef:
              name: crowdsec-secrets
              key: bouncerApiKey
              optional: true
        ports:
        - name: lapi
          containerPort: 8080
          protocol: TCP
        - name: prometheus
          containerPort: 6060
          protocol: TCP
        livenessProbe:
          httpGet:
            path: /health
            port: 8080
          initialDelaySeconds: 30
          periodSeconds: 30
        readinessProbe:
          httpGet:
            path: /health
            port: 8080
          initialDelaySeconds: 10
          periodSeconds: 10
        resources:
          requests:
            cpu: 100m
            memory: 200Mi
          limits:
            cpu: 500m
            memory: 512Mi
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          runAsNonRoot: false
        volumeMounts:
        - name: crowdsec-config
          mountPath: /etc/crowdsec/acquis.yaml
          subPath: acquis.yaml
          readOnly: true
        - name: crowdsec-config
          mountPath: /etc/crowdsec/profiles.yaml
          subPath: profiles.yaml
          readOnly: true
        - name: crowdsec-data
          mountPath: /var/lib/crowdsec/data
        - name: crowdsec-config-dir
          mountPath: /etc/crowdsec/config
        - name: varlog
          mountPath: /var/log
          readOnly: true
      volumes:
      - name: crowdsec-config
        configMap:
          name: crowdsec-config
      - name: crowdsec-data
        persistentVolumeClaim:
          claimName: crowdsec-data
      - name: crowdsec-config-dir
        emptyDir: {}
      - name: varlog
        hostPath:
          path: /var/log
--- a/crowdsec/versions/v1/crowdsec-service.yaml
+++ b/crowdsec/versions/v1/crowdsec-service.yaml
@@ -0,0 +1,24 @@
 apiVersion: v1
 kind: Service
 metadata:
  name: crowdsec-lapi
  namespace: crowdsec
  labels:
    app: crowdsec
    managedBy: kustomize
    partOf: wild-cloud
 spec:
  type: ClusterIP
  selector:
    app: crowdsec
    managedBy: kustomize
    partOf: wild-cloud
  ports:
  - name: lapi
    port: 8080
    targetPort: 8080
    protocol: TCP
  - name: prometheus
    port: 6060
    targetPort: 6060
    protocol: TCP
--- a/crowdsec/versions/v1/kustomization.yaml
+++ b/crowdsec/versions/v1/kustomization.yaml
@@ -4,15 +4,14 @@ namespace: "{{ .namespace }}"
 labels:
  - includeSelectors: true
    pairs:
-      app: communitarian
+      app: crowdsec
      managedBy: kustomize
      partOf: wild-cloud
 resources:
-  - namespace.yaml
+- namespace.yaml
-  - deployment-app.yaml
+- serviceaccount.yaml
-  - deployment-api.yaml
+- configmap.yaml
-  - service-app.yaml
+- pvc.yaml
-  - service-api.yaml
+- crowdsec-deployment.yaml
-  - middleware.yaml
+- crowdsec-service.yaml
-  - ingress.yaml
+- middleware.yaml
  - pvc.yaml
--- a/crowdsec/versions/v1/manifest.yaml
+++ b/crowdsec/versions/v1/manifest.yaml
@@ -0,0 +1,26 @@
 version: v1.7.8
 requires:
  - name: longhorn
  - name: traefik
 defaultConfig:
  namespace: crowdsec
  rateLimitAverage: "100"
  rateLimitBurst: "100"
 defaultSecrets:
  - key: agentPassword
  - key: bouncerApiKey
 deploy:
  createSecrets:
    - name: crowdsec-agent-secret
      entries:
        password: agentPassword
    - name: crowdsec-bouncer-secret
      entries:
        api-key: bouncerApiKey
    - name: crowdsec-bouncer-secret
      namespace: traefik
      entries:
        api-key: bouncerApiKey
  waitForRollout:
    name: crowdsec
    timeout: "120s"
--- a/crowdsec/versions/v1/middleware.yaml
+++ b/crowdsec/versions/v1/middleware.yaml
@@ -0,0 +1,89 @@
 ---
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
  name: crowdsec-bouncer
  namespace: crowdsec
  labels:
    app: crowdsec
    managedBy: kustomize
    partOf: wild-cloud
 spec:
  plugin:
    bouncer:
      crowdsecLapiScheme: http
      crowdsecLapiHost: crowdsec-lapi.crowdsec.svc.cluster.local:8080
      crowdsecLapiKeyFile: /etc/traefik/crowdsec/api-key
      crowdsecMode: stream
      updateIntervalSeconds: 15
      defaultDecisionSeconds: 60
      crowdsecAppsecEnabled: false
 ---
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
  name: rate-limit
  namespace: crowdsec
  labels:
    app: crowdsec
    managedBy: kustomize
    partOf: wild-cloud
 spec:
  rateLimit:
    average: {{ .rateLimitAverage }}
    burst: {{ .rateLimitBurst }}
    period: 1m
 ---
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
  name: security-headers
  namespace: crowdsec
  labels:
    app: crowdsec
    managedBy: kustomize
    partOf: wild-cloud
 spec:
  headers:
    browserXssFilter: true
    contentTypeNosniff: true
    forceSTSHeader: true
    frameDeny: true
    sslRedirect: true
    stsIncludeSubdomains: true
    stsPreload: true
    stsSeconds: 31536000
    addVaryHeader: true
    accessControlAllowMethods:
    - GET
    - POST
    - PUT
    - DELETE
    - OPTIONS
    accessControlAllowOriginList:
    - "*"
    accessControlMaxAge: 100
    customRequestHeaders:
      X-Forwarded-Proto: https
    customResponseHeaders:
      Server: ""
      X-Robots-Tag: noindex,nofollow,nosnippet,noarchive,notranslate,noimageindex
 ---
 apiVersion: traefik.io/v1alpha1
 kind: Middleware
 metadata:
  name: security-chain
  namespace: crowdsec
  labels:
    app: crowdsec
    managedBy: kustomize
    partOf: wild-cloud
 spec:
  chain:
    middlewares:
    - name: security-headers
      namespace: crowdsec
    - name: rate-limit
      namespace: crowdsec
    - name: crowdsec-bouncer
      namespace: crowdsec
--- a/crowdsec/versions/v1/namespace.yaml
+++ b/crowdsec/versions/v1/namespace.yaml
@@ -0,0 +1,9 @@
 apiVersion: v1
 kind: Namespace
 metadata:
  name: "{{ .namespace }}"
  labels:
    app: crowdsec
    managedBy: kustomize
    partOf: wild-cloud
    pod-security.kubernetes.io/enforce: privileged
--- a/crowdsec/versions/v1/pvc.yaml
+++ b/crowdsec/versions/v1/pvc.yaml
@@ -0,0 +1,12 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
  name: crowdsec-data
 spec:
  storageClassName: longhorn
  accessModes:
    - ReadWriteOnce
  volumeMode: Filesystem
  resources:
    requests:
      storage: 512Mi
--- a/crowdsec/versions/v1/serviceaccount.yaml
+++ b/crowdsec/versions/v1/serviceaccount.yaml
@@ -0,0 +1,9 @@
 apiVersion: v1
 kind: ServiceAccount
 metadata:
  name: crowdsec
  namespace: crowdsec
  labels:
    app: crowdsec
    managedBy: kustomize
    partOf: wild-cloud
--- a/decidim/README.md
+++ b/decidim/README.md
@@ -1,35 +0,0 @@
 # Decidim
 Decidim is a participatory democracy framework for cities and organizations. Built in Ruby on Rails, it enables citizen participation through proposals, debates, and voting. Includes Sidekiq for background job processing.
 ## Dependencies
 - **PostgreSQL** - Database for storing participatory processes and user data
 - **Redis** - Used for Sidekiq background job processing
 ## Configuration
 Key settings configured through your instance's `config.yaml`:
 - **domain** - Where Decidim will be accessible (default: `decidim.{your-cloud-domain}`)
 - **siteName** - Display name for your platform (default: `Decidim`)
 - **systemAdminEmail** - System admin email (defaults to your operator email)
 - **storage** - Persistent volume size (default: `20Gi`)
 - **SMTP** - Email delivery settings inherited from your Wild Cloud instance
 ## Access
 After deployment, Decidim will be available at:
 - `https://decidim.{your-cloud-domain}`
 ## First-Time Setup
 1. Add and deploy the app:
   ```bash
   wild app add decidim
   wild app deploy decidim
   ```
 2. Log in with the system admin credentials configured during setup
 3. Create your first organization and configure participatory processes
--- a/decidim/app.yaml
+++ b/decidim/app.yaml
@@ -0,0 +1,5 @@
 name: decidim
 is: decidim
 description: Decidim is a participatory democracy framework for cities and organizations. Built in Ruby on Rails, it enables citizen participation through proposals, debates, and voting. Includes Sidekiq for background job processing.
 icon: https://raw.githubusercontent.com/decidim/decidim/develop/logo.svg
 latest: "0"
--- a/decidim/manifest.yaml
+++ b/decidim/manifest.yaml
@@ -1,44 +0,0 @@
 name: decidim
 is: decidim
 description: Decidim is a participatory democracy framework for cities and organizations. Built in Ruby on Rails, it enables citizen participation through proposals, debates, and voting. Includes Sidekiq for background job processing.
 version: 0.31.0
 icon: https://raw.githubusercontent.com/decidim/decidim/develop/logo.svg
 requires:
  - name: postgres
    installed_as: postgres
  - name: redis
    installed_as: redis
 defaultConfig:
  namespace: decidim
  externalDnsDomain: "{{ .cloud.domain }}"
  timezone: UTC
  port: 3000
  storage: 20Gi
  systemAdminEmail: "{{ .operator.email }}"
  siteName: "Decidim"
  domain: decidim.{{ .cloud.domain }}
  dbHostname: "{{ .apps.postgres.host }}"
  dbPort: "{{ .apps.postgres.port }}"
  dbUsername: decidim
  dbName: decidim
  redisHostname: "{{ .apps.redis.host }}"
  tlsSecretName: wildcard-wild-cloud-tls
  smtp:
    enabled: true
    host: "{{ .cloud.smtp.host }}"
    port: "{{ .cloud.smtp.port }}"
    user: "{{ .cloud.smtp.user }}"
    from: "{{ .cloud.smtp.from }}"
    tls: "{{ .cloud.smtp.tls }}"
    startTls: "{{ .cloud.smtp.startTls }}"
 defaultSecrets:
  - key: systemAdminPassword
  - key: secretKeyBase
    default: "{{ random.AlphaNum 128 }}"
  - key: smtpPassword
  - key: dbPassword
  - key: dbUrl
    default: "postgres://{{ .app.dbUsername }}:{{ .secrets.dbPassword }}@{{ .app.dbHostname }}:{{ .app.dbPort }}/{{ .app.dbName }}"
 requiredSecrets:
  - postgres.password
  - redis.password
--- a/decidim/versions/0/Dockerfile
+++ b/decidim/versions/0/Dockerfile
--- a/decidim/versions/0/README.md
+++ b/decidim/versions/0/README.md
@@ -0,0 +1,13 @@
 # Decidim
 Decidim is a participatory democracy framework for cities and organizations. It enables citizen participation through proposals, debates, and voting.
 ## Configuration
 Key settings configured through your instance's `config.yaml`:
 - **domain** - Where Decidim will be accessible (default: `decidim.{your-cloud-domain}`)
 - **siteName** - Display name for your platform (default: `Decidim`)
 - **systemAdminEmail** - System admin email (defaults to your operator email)
 - **storage** - Persistent volume size (default: `20Gi`)
 - **SMTP** - Email delivery settings inherited from your Wild Cloud instance
--- a/decidim/versions/0/db-init-job.yaml
+++ b/decidim/versions/0/db-init-job.yaml
@@ -54,7 +54,7 @@ spec:
              echo "Database initialization completed successfully"
          env:
            - name: POSTGRES_HOST
-              value: {{ .dbHostname }}
+              value: {{ .db.host }}
            - name: POSTGRES_ADMIN_USER
              value: postgres
            - name: POSTGRES_ADMIN_PASSWORD
@@ -63,9 +63,9 @@ spec:
                  name: decidim-secrets
                  key: postgres.password
            - name: DB_NAME
-              value: {{ .dbName }}
+              value: {{ .db.name }}
            - name: DB_USER
-              value: {{ .dbUsername }}
+              value: {{ .db.user }}
            - name: DB_PASSWORD
              valueFrom:
                secretKeyRef:
--- a/decidim/versions/0/deployment.yaml
+++ b/decidim/versions/0/deployment.yaml
@@ -55,7 +55,7 @@ spec:
            - name: RAILS_ENV
              value: "production"
            - name: PORT
-              value: "{{ .port }}"
+              value: "3000"
            - name: RAILS_LOG_TO_STDOUT
              value: "true"
            # Database configuration
@@ -66,7 +66,7 @@ spec:
                  key: dbUrl
            # Redis configuration
            - name: REDIS_HOSTNAME
-              value: {{ .redisHostname }}
+              value: {{ .redis.host }}
            - name: REDIS_PASSWORD
              valueFrom:
                secretKeyRef:
@@ -112,11 +112,11 @@ spec:
                  key: systemAdminPassword
          ports:
            - name: http
-              containerPort: {{ .port }}
+              containerPort: 3000
              protocol: TCP
          livenessProbe:
            tcpSocket:
-              port: {{ .port }}
+              port: 3000
            initialDelaySeconds: 300
            periodSeconds: 30
            timeoutSeconds: 10
@@ -124,7 +124,7 @@ spec:
            failureThreshold: 6
          readinessProbe:
            tcpSocket:
-              port: {{ .port }}
+              port: 3000
            initialDelaySeconds: 180
            periodSeconds: 30
            timeoutSeconds: 10
@@ -182,7 +182,7 @@ spec:
                  key: dbUrl
            # Redis configuration
            - name: REDIS_HOSTNAME
-              value: {{ .redisHostname }}
+              value: {{ .redis.host }}
            - name: REDIS_PASSWORD
              valueFrom:
                secretKeyRef:
--- a/decidim/versions/0/ingress.yaml
+++ b/decidim/versions/0/ingress.yaml
@@ -23,4 +23,4 @@ spec:
              service:
                name: decidim
                port:
-                  number: {{ .port }}
+                  number: 3000
--- a/decidim/versions/0/kustomization.yaml
+++ b/decidim/versions/0/kustomization.yaml
--- a/decidim/versions/0/manifest.yaml
+++ b/decidim/versions/0/manifest.yaml
@@ -0,0 +1,41 @@
 version: 0.31.0-1
 requires:
  - name: postgres
    installed_as: postgres
  - name: redis
    installed_as: redis
  - name: smtp
 defaultConfig:
  namespace: decidim
  externalDnsDomain: '{{ .cloud.domain }}'
  storage: 20Gi
  systemAdminEmail: '{{ .operator.email }}'
  siteName: 'Decidim'
  domain: decidim.{{ .cloud.domain }}
  tlsSecretName: wildcard-wild-cloud-tls
  db:
    host: '{{ .apps.postgres.host }}'
    port: '{{ .apps.postgres.port }}'
    name: decidim
    user: decidim
  redis:
    host: '{{ .apps.redis.host }}'
  smtp:
    enabled: true
    host: '{{ .apps.smtp.host }}'
    port: '{{ .apps.smtp.port }}'
    user: '{{ .apps.smtp.user }}'
    from: '{{ .apps.smtp.from }}'
    tls: '{{ .apps.smtp.tls }}'
    startTls: '{{ .apps.smtp.startTls }}'
 defaultSecrets:
  - key: systemAdminPassword
  - key: secretKeyBase
    default: "{{ random.AlphaNum 128 }}"
  - key: smtpPassword
  - key: dbPassword
  - key: dbUrl
    default: "postgres://{{ .app.db.user }}:{{ .secrets.dbPassword }}@{{ .app.db.host }}:{{ .app.db.port }}/{{ .app.db.name }}"
 requiredSecrets:
  - postgres.password
  - redis.password
--- a/decidim/versions/0/namespace.yaml
+++ b/decidim/versions/0/namespace.yaml
--- a/decidim/versions/0/pvc.yaml
+++ b/decidim/versions/0/pvc.yaml
--- a/decidim/versions/0/service.yaml
+++ b/decidim/versions/0/service.yaml
@@ -9,7 +9,7 @@ spec:
    component: web
  ports:
    - name: http
-      port: {{ .port }}
+      port: 3000
      targetPort: http
      protocol: TCP
  type: ClusterIP
--- a/decidim/versions/0/serviceaccount.yaml
+++ b/decidim/versions/0/serviceaccount.yaml
--- a/discourse/app.yaml
+++ b/discourse/app.yaml
@@ -0,0 +1,5 @@
 name: discourse
 is: discourse
 description: Discourse is a modern, open-source discussion platform designed for online communities and forums.
 icon: https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/discourse.svg
 latest: "3"
--- a/discourse/manifest.yaml
+++ b/discourse/manifest.yaml
@@ -1,43 +0,0 @@
 name: discourse
 is: discourse
 description: Discourse is a modern, open-source discussion platform designed for online communities and forums.
 version: 3.5.3
 icon: https://cdn.jsdelivr.net/gh/homarr-labs/dashboard-icons/svg/discourse.svg
 requires:
  - name: postgres
  - name: redis
 defaultConfig:
  namespace: discourse
  externalDnsDomain: "{{ .cloud.domain }}"
  timezone: UTC
  port: 3000
  storage: 10Gi
  adminEmail: "{{ .operator.email }}"
  adminUsername: admin
  siteName: "Community"
  domain: discourse.{{ .cloud.domain }}
  dbHostname: "{{ .apps.postgres.host }}"
  dbPort: "{{ .apps.postgres.port }}"
  dbUsername: discourse
  dbName: discourse
  redisHostname: "{{ .apps.redis.host }}"
  tlsSecretName: wildcard-wild-cloud-tls
  smtp:
    enabled: false
    host: "{{ .cloud.smtp.host }}"
    port: "{{ .cloud.smtp.port }}"
    user: "{{ .cloud.smtp.user }}"
    from: "{{ .cloud.smtp.from }}"
    tls: "{{ .cloud.smtp.tls }}"
    startTls: "{{ .cloud.smtp.startTls }}"
 defaultSecrets:
  - key: adminPassword
  - key: secretKeyBase
    default: "{{ random.AlphaNum 64 }}"
  - key: smtpPassword
  - key: dbPassword
  - key: dbUrl
    default: "postgres://{{ .app.dbUsername }}:{{ .secrets.dbPassword }}@{{ .app.dbHostname }}:{{ .app.dbPort }}/{{ .app.dbName }}?sslmode=disable"
 requiredSecrets:
  - postgres.password
  - redis.password
--- a/discourse/versions/3/README.md
+++ b/discourse/versions/3/README.md
--- a/discourse/versions/3/db-init-job.yaml
+++ b/discourse/versions/3/db-init-job.yaml
@@ -27,7 +27,7 @@ spec:
          readOnlyRootFilesystem: false
        env:
        - name: PGHOST
-          value: "{{ .dbHostname }}"
+          value: "{{ .db.host }}"
        - name: PGPORT
          value: "5432"
        - name: PGUSER
@@ -38,9 +38,9 @@ spec:
              name: discourse-secrets
              key: postgres.password
        - name: DISCOURSE_DB_USER
-          value: "{{ .dbUsername }}"
+          value: "{{ .db.user }}"
        - name: DISCOURSE_DB_NAME
-          value: "{{ .dbName }}"
+          value: "{{ .db.name }}"
        - name: DISCOURSE_DB_PASSWORD
          valueFrom:
            secretKeyRef:
--- a/discourse/versions/3/deployment.yaml
+++ b/discourse/versions/3/deployment.yaml
@@ -56,20 +56,20 @@ spec:
            - name: RAILS_ENV
              value: "production"
            - name: DISCOURSE_DB_HOST
-              value: {{ .dbHostname }}
+              value: {{ .db.host }}
            - name: DISCOURSE_DB_PORT
-              value: "{{ .dbPort }}"
+              value: "{{ .db.port }}"
            - name: DISCOURSE_DB_NAME
-              value: {{ .dbName }}
+              value: {{ .db.name }}
            - name: DISCOURSE_DB_USERNAME
-              value: {{ .dbUsername }}
+              value: {{ .db.user }}
            - name: DISCOURSE_DB_PASSWORD
              valueFrom:
                secretKeyRef:
                  name: discourse-secrets
                  key: dbPassword
            - name: DISCOURSE_REDIS_HOST
-              value: {{ .redisHostname }}
+              value: {{ .redis.host }}
            - name: DISCOURSE_REDIS_PASSWORD
              valueFrom:
                secretKeyRef:
@@ -113,13 +113,13 @@ spec:
              value: "production"
            # Discourse database configuration
            - name: DISCOURSE_DB_HOST
-              value: {{ .dbHostname }}
+              value: {{ .db.host }}
            - name: DISCOURSE_DB_PORT
-              value: "{{ .dbPort }}"
+              value: "{{ .db.port }}"
            - name: DISCOURSE_DB_NAME
-              value: {{ .dbName }}
+              value: {{ .db.name }}
            - name: DISCOURSE_DB_USERNAME
-              value: {{ .dbUsername }}
+              value: {{ .db.user }}
            - name: DISCOURSE_DB_PASSWORD
              valueFrom:
                secretKeyRef:
@@ -127,7 +127,7 @@ spec:
                  key: dbPassword
            # Redis configuration
            - name: DISCOURSE_REDIS_HOST
-              value: {{ .redisHostname }}
+              value: {{ .redis.host }}
            - name: DISCOURSE_REDIS_PASSWORD
              valueFrom:
                secretKeyRef:
@@ -220,13 +220,13 @@ spec:
              value: "production"
            # Discourse database configuration
            - name: DISCOURSE_DB_HOST
-              value: {{ .dbHostname }}
+              value: {{ .db.host }}
            - name: DISCOURSE_DB_PORT
-              value: "{{ .dbPort }}"
+              value: "{{ .db.port }}"
            - name: DISCOURSE_DB_NAME
-              value: {{ .dbName }}
+              value: {{ .db.name }}
            - name: DISCOURSE_DB_USERNAME
-              value: {{ .dbUsername }}
+              value: {{ .db.user }}
            - name: DISCOURSE_DB_PASSWORD
              valueFrom:
                secretKeyRef:
@@ -234,7 +234,7 @@ spec:
                  key: dbPassword
            # Redis configuration
            - name: DISCOURSE_REDIS_HOST
-              value: {{ .redisHostname }}
+              value: {{ .redis.host }}
            - name: DISCOURSE_REDIS_PASSWORD
              valueFrom:
                secretKeyRef:
--- a/discourse/versions/3/ingress.yaml
+++ b/discourse/versions/3/ingress.yaml
--- a/discourse/versions/3/kustomization.yaml
+++ b/discourse/versions/3/kustomization.yaml
--- a/discourse/versions/3/manifest.yaml
+++ b/discourse/versions/3/manifest.yaml
@@ -0,0 +1,40 @@
 version: 3.5.3-1
 requires:
  - name: postgres
  - name: redis
  - name: smtp
 defaultConfig:
  namespace: discourse
  externalDnsDomain: '{{ .cloud.domain }}'
  storage: 10Gi
  adminEmail: '{{ .operator.email }}'
  adminUsername: admin
  siteName: 'Community'
  domain: discourse.{{ .cloud.domain }}
  tlsSecretName: wildcard-wild-cloud-tls
  db:
    host: '{{ .apps.postgres.host }}'
    port: '{{ .apps.postgres.port }}'
    name: discourse
    user: discourse
  redis:
    host: '{{ .apps.redis.host }}'
  smtp:
    enabled: false
    host: '{{ .apps.smtp.host }}'
    port: '{{ .apps.smtp.port }}'
    user: '{{ .apps.smtp.user }}'
    from: '{{ .apps.smtp.from }}'
    tls: '{{ .apps.smtp.tls }}'
    startTls: '{{ .apps.smtp.startTls }}'
 defaultSecrets:
  - key: adminPassword
  - key: secretKeyBase
    default: "{{ random.AlphaNum 64 }}"
  - key: smtpPassword
  - key: dbPassword
  - key: dbUrl
    default: "postgres://{{ .app.db.user }}:{{ .secrets.dbPassword }}@{{ .app.db.host }}:{{ .app.db.port }}/{{ .app.db.name }}?sslmode=disable"
 requiredSecrets:
  - postgres.password
  - redis.password
--- a/discourse/versions/3/namespace.yaml
+++ b/discourse/versions/3/namespace.yaml
--- a/discourse/versions/3/pvc.yaml
+++ b/discourse/versions/3/pvc.yaml
--- a/discourse/versions/3/service.yaml
+++ b/discourse/versions/3/service.yaml
--- a/discourse/versions/3/serviceaccount.yaml
+++ b/discourse/versions/3/serviceaccount.yaml
--- a/docker-registry/app.yaml
+++ b/docker-registry/app.yaml
@@ -0,0 +1,5 @@
 name: docker-registry
 is: docker-registry
 description: Private Docker image registry for cluster
 category: infrastructure
 latest: "3"
--- a/docker-registry/versions/3/deployment.yaml
+++ b/docker-registry/versions/3/deployment.yaml
@@ -0,0 +1,48 @@
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: docker-registry
  labels:
    app: docker-registry
 spec:
  replicas: 1
  selector:
    matchLabels:
      app: docker-registry
  strategy:
    rollingUpdate:
      maxSurge: 0
      maxUnavailable: 1
    type: RollingUpdate
  template:
    metadata:
      labels:
        app: docker-registry
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        runAsGroup: 1000
        fsGroup: 1000
        seccompProfile:
          type: RuntimeDefault
      containers:
        - image: registry:3.0.0
          name: docker-registry
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
          ports:
            - containerPort: 5000
              protocol: TCP
          volumeMounts:
            - mountPath: /var/lib/registry
              name: docker-registry-storage
              readOnly: false
      volumes:
        - name: docker-registry-storage
          persistentVolumeClaim:
            claimName: docker-registry-pvc
--- a/docker-registry/versions/3/ingress.yaml
+++ b/docker-registry/versions/3/ingress.yaml
@@ -0,0 +1,20 @@
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
  name: docker-registry
 spec:
  rules:
    - host: {{ .host }}
      http:
        paths:
          - path: /
            pathType: Prefix
            backend:
              service:
                name: docker-registry
                port:
                  number: 5000
  tls:
    - hosts:
        - {{ .host }}
      secretName: wildcard-internal-wild-cloud-tls
--- a/docker-registry/versions/3/kustomization.yaml
+++ b/docker-registry/versions/3/kustomization.yaml
@@ -0,0 +1,14 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: "{{ .namespace }}"
 labels:
  - includeSelectors: true
    pairs:
      app: docker-registry
      managedBy: wild-cloud
 resources:
  - deployment.yaml
  - ingress.yaml
  - service.yaml
  - namespace.yaml
  - pvc.yaml
--- a/docker-registry/versions/3/manifest.yaml
+++ b/docker-registry/versions/3/manifest.yaml
@@ -0,0 +1,8 @@
 version: "3.0.0"
 requires:
  - name: traefik
  - name: cert-manager
 defaultConfig:
  namespace: docker-registry
  host: "registry.{{ .cloud.internalDomain }}"
  storage: "100Gi"
--- a/docker-registry/versions/3/namespace.yaml
+++ b/docker-registry/versions/3/namespace.yaml
--- a/docker-registry/versions/3/pvc.yaml
+++ b/docker-registry/versions/3/pvc.yaml
@@ -0,0 +1,12 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
  name: docker-registry-pvc
 spec:
  storageClassName: longhorn
  accessModes:
    - ReadWriteOnce
  volumeMode: Filesystem
  resources:
    requests:
      storage: {{ .storage }}
--- a/docker-registry/versions/3/service.yaml
+++ b/docker-registry/versions/3/service.yaml
@@ -0,0 +1,13 @@
 ---
 apiVersion: v1
 kind: Service
 metadata:
  name: docker-registry
  labels:
    app: docker-registry
 spec:
  ports:
    - port: 5000
      targetPort: 5000
  selector:
    app: docker-registry
--- a/e2e-test-app/app.yaml
+++ b/e2e-test-app/app.yaml
@@ -0,0 +1,13 @@
 name: e2e-test-app
 is: e2e-test-app
 description: End-to-end test application for automated integration testing. Includes PVC and PostgreSQL dependency to exercise all backup strategies.
 latest: "2"
 upgrade:
  from:
    - version: ">=1.0.0"
      via: "1"
    - version: "<1.0.0"
      blocked: true
      notes: "Versions before 1.0.0 are not supported for upgrade"
  preUpgrade:
    backup: recommended
--- a/e2e-test-app/versions/1/db-init-job.yaml
+++ b/e2e-test-app/versions/1/db-init-job.yaml
@@ -0,0 +1,72 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
  name: e2e-test-app-db-init
  labels:
    component: db-init
 spec:
  template:
    metadata:
      labels:
        component: db-init
    spec:
      restartPolicy: OnFailure
      securityContext:
        runAsNonRoot: true
        runAsUser: 999
        runAsGroup: 999
        seccompProfile:
          type: RuntimeDefault
      containers:
      - name: postgres-init
        image: postgres:15
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: false
        env:
        - name: PGHOST
          value: {{ .db.host }}
        - name: PGUSER
          value: postgres
        - name: PGPASSWORD
          valueFrom:
            secretKeyRef:
              name: e2e-test-app-secrets
              key: postgres.password
        - name: DB_NAME
          value: {{ .db.name }}
        - name: DB_USER
          value: {{ .db.user }}
        - name: DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: e2e-test-app-secrets
              key: dbPassword
        command:
        - /bin/bash
        - -c
        - |
          set -e
          echo "Waiting for PostgreSQL to be ready..."
          until pg_isready; do
            echo "PostgreSQL is not ready - sleeping"
            sleep 2
          done
          echo "PostgreSQL is ready"
          echo "Creating database and user..."
          psql -c "CREATE DATABASE ${DB_NAME};" || echo "Database ${DB_NAME} already exists"
          psql -c "CREATE USER ${DB_USER} WITH PASSWORD '${DB_PASSWORD}';" || echo "User ${DB_USER} already exists"
          psql -c "ALTER USER ${DB_USER} WITH PASSWORD '${DB_PASSWORD}';"
          psql -c "GRANT ALL PRIVILEGES ON DATABASE ${DB_NAME} TO ${DB_USER};"
          psql -d ${DB_NAME} -c "GRANT ALL ON SCHEMA public TO ${DB_USER};"
          echo "Creating test data table..."
          psql -d ${DB_NAME} -c "CREATE TABLE IF NOT EXISTS e2e_test_data (id SERIAL PRIMARY KEY, key TEXT UNIQUE NOT NULL, value TEXT NOT NULL, created_at TIMESTAMP DEFAULT NOW());"
          psql -d ${DB_NAME} -c "GRANT ALL ON TABLE e2e_test_data TO ${DB_USER};"
          psql -d ${DB_NAME} -c "GRANT USAGE, SELECT ON SEQUENCE e2e_test_data_id_seq TO ${DB_USER};"
          echo "Database initialization complete"
--- a/e2e-test-app/versions/1/deployment.yaml
+++ b/e2e-test-app/versions/1/deployment.yaml
@@ -0,0 +1,55 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: e2e-test-app
 spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      component: web
  template:
    metadata:
      labels:
        component: web
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 101
        runAsGroup: 101
        fsGroup: 101
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: nginx
          image: nginxinc/nginx-unprivileged:alpine
          ports:
            - containerPort: 8080
              name: http
          volumeMounts:
            - name: app-data
              mountPath: /data
          resources:
            limits:
              cpu: 100m
              memory: 64Mi
            requests:
              cpu: 50m
              memory: 32Mi
          readinessProbe:
            httpGet:
              path: /
              port: 8080
            initialDelaySeconds: 3
            periodSeconds: 5
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            readOnlyRootFilesystem: false
      volumes:
        - name: app-data
          persistentVolumeClaim:
            claimName: e2e-test-app-data
--- a/e2e-test-app/versions/1/kustomization.yaml
+++ b/e2e-test-app/versions/1/kustomization.yaml
@@ -0,0 +1,15 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: e2e-test-app
 labels:
  - includeSelectors: true
    pairs:
      app: e2e-test-app
      managedBy: kustomize
      partOf: wild-cloud
 resources:
  - namespace.yaml
  - deployment.yaml
  - service.yaml
  - pvc.yaml
  - db-init-job.yaml
--- a/e2e-test-app/versions/1/manifest.yaml
+++ b/e2e-test-app/versions/1/manifest.yaml
@@ -0,0 +1,20 @@
 version: 1.0.0-1
 requires:
  - name: postgres
 defaultConfig:
  namespace: e2e-test-app
  domain: e2e-test-app.{{ .cloud.domain }}
  externalDnsDomain: '{{ .cloud.domain }}'
  tlsSecretName: wildcard-wild-cloud-tls
  storage: 1Gi
  db:
    host: '{{ .apps.postgres.host }}'
    port: '{{ .apps.postgres.port }}'
    name: e2e_test_app
    user: e2e_test_app
 defaultSecrets:
  - key: dbPassword
  - key: dbUrl
    default: "postgres://{{ .app.db.user }}:{{ .secrets.dbPassword }}@{{ .app.db.host }}:{{ .app.db.port }}/{{ .app.db.name }}?sslmode=disable"
 requiredSecrets:
  - postgres.password
--- a/e2e-test-app/versions/1/namespace.yaml
+++ b/e2e-test-app/versions/1/namespace.yaml
--- a/e2e-test-app/versions/1/pvc.yaml
+++ b/e2e-test-app/versions/1/pvc.yaml
@@ -0,0 +1,11 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
  name: e2e-test-app-data
 spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: longhorn
  resources:
    requests:
      storage: {{ .storage }}
--- a/e2e-test-app/versions/1/service.yaml
+++ b/e2e-test-app/versions/1/service.yaml
@@ -0,0 +1,11 @@
 apiVersion: v1
 kind: Service
 metadata:
  name: e2e-test-app
 spec:
  selector:
    component: web
  ports:
    - port: 80
      targetPort: 8080
      name: http
--- a/e2e-test-app/versions/2/db-init-job.yaml
+++ b/e2e-test-app/versions/2/db-init-job.yaml
@@ -0,0 +1,72 @@
 apiVersion: batch/v1
 kind: Job
 metadata:
  name: e2e-test-app-db-init
  labels:
    component: db-init
 spec:
  template:
    metadata:
      labels:
        component: db-init
    spec:
      restartPolicy: OnFailure
      securityContext:
        runAsNonRoot: true
        runAsUser: 999
        runAsGroup: 999
        seccompProfile:
          type: RuntimeDefault
      containers:
      - name: postgres-init
        image: postgres:15
        securityContext:
          allowPrivilegeEscalation: false
          capabilities:
            drop:
            - ALL
          readOnlyRootFilesystem: false
        env:
        - name: PGHOST
          value: {{ .db.host }}
        - name: PGUSER
          value: postgres
        - name: PGPASSWORD
          valueFrom:
            secretKeyRef:
              name: e2e-test-app-secrets
              key: postgres.password
        - name: DB_NAME
          value: {{ .db.name }}
        - name: DB_USER
          value: {{ .db.user }}
        - name: DB_PASSWORD
          valueFrom:
            secretKeyRef:
              name: e2e-test-app-secrets
              key: dbPassword
        command:
        - /bin/bash
        - -c
        - |
          set -e
          echo "Waiting for PostgreSQL to be ready..."
          until pg_isready; do
            echo "PostgreSQL is not ready - sleeping"
            sleep 2
          done
          echo "PostgreSQL is ready"
          echo "Creating database and user..."
          psql -c "CREATE DATABASE ${DB_NAME};" || echo "Database ${DB_NAME} already exists"
          psql -c "CREATE USER ${DB_USER} WITH PASSWORD '${DB_PASSWORD}';" || echo "User ${DB_USER} already exists"
          psql -c "ALTER USER ${DB_USER} WITH PASSWORD '${DB_PASSWORD}';"
          psql -c "GRANT ALL PRIVILEGES ON DATABASE ${DB_NAME} TO ${DB_USER};"
          psql -d ${DB_NAME} -c "GRANT ALL ON SCHEMA public TO ${DB_USER};"
          echo "Creating test data table..."
          psql -d ${DB_NAME} -c "CREATE TABLE IF NOT EXISTS e2e_test_data (id SERIAL PRIMARY KEY, key TEXT UNIQUE NOT NULL, value TEXT NOT NULL, created_at TIMESTAMP DEFAULT NOW());"
          psql -d ${DB_NAME} -c "GRANT ALL ON TABLE e2e_test_data TO ${DB_USER};"
          psql -d ${DB_NAME} -c "GRANT USAGE, SELECT ON SEQUENCE e2e_test_data_id_seq TO ${DB_USER};"
          echo "Database initialization complete"
--- a/e2e-test-app/versions/2/deployment.yaml
+++ b/e2e-test-app/versions/2/deployment.yaml
@@ -0,0 +1,55 @@
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: e2e-test-app
 spec:
  replicas: 1
  strategy:
    type: Recreate
  selector:
    matchLabels:
      component: web
  template:
    metadata:
      labels:
        component: web
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 101
        runAsGroup: 101
        fsGroup: 101
        seccompProfile:
          type: RuntimeDefault
      containers:
        - name: nginx
          image: nginxinc/nginx-unprivileged:alpine
          ports:
            - containerPort: 8080
              name: http
          volumeMounts:
            - name: app-data
              mountPath: /data
          resources:
            limits:
              cpu: 100m
              memory: 64Mi
            requests:
              cpu: 50m
              memory: 32Mi
          readinessProbe:
            httpGet:
              path: /
              port: 8080
            initialDelaySeconds: 3
            periodSeconds: 5
          securityContext:
            allowPrivilegeEscalation: false
            capabilities:
              drop:
                - ALL
            readOnlyRootFilesystem: false
      volumes:
        - name: app-data
          persistentVolumeClaim:
            claimName: e2e-test-app-data
--- a/e2e-test-app/versions/2/kustomization.yaml
+++ b/e2e-test-app/versions/2/kustomization.yaml
@@ -0,0 +1,15 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: e2e-test-app
 labels:
  - includeSelectors: true
    pairs:
      app: e2e-test-app
      managedBy: kustomize
      partOf: wild-cloud
 resources:
  - namespace.yaml
  - deployment.yaml
  - service.yaml
  - pvc.yaml
  - db-init-job.yaml
--- a/e2e-test-app/versions/2/manifest.yaml
+++ b/e2e-test-app/versions/2/manifest.yaml
@@ -0,0 +1,20 @@
 version: 2.0.0
 requires:
  - name: postgres
 defaultConfig:
  namespace: e2e-test-app
  domain: e2e-test-app.{{ .cloud.domain }}
  externalDnsDomain: '{{ .cloud.domain }}'
  tlsSecretName: wildcard-wild-cloud-tls
  storage: 1Gi
  db:
    host: '{{ .apps.postgres.host }}'
    port: '{{ .apps.postgres.port }}'
    name: e2e_test_app
    user: e2e_test_app
 defaultSecrets:
  - key: dbPassword
  - key: dbUrl
    default: "postgres://{{ .app.db.user }}:{{ .secrets.dbPassword }}@{{ .app.db.host }}:{{ .app.db.port }}/{{ .app.db.name }}?sslmode=disable"
 requiredSecrets:
  - postgres.password
--- a/e2e-test-app/versions/2/namespace.yaml
+++ b/e2e-test-app/versions/2/namespace.yaml
--- a/e2e-test-app/versions/2/pvc.yaml
+++ b/e2e-test-app/versions/2/pvc.yaml
@@ -0,0 +1,11 @@
 apiVersion: v1
 kind: PersistentVolumeClaim
 metadata:
  name: e2e-test-app-data
 spec:
  accessModes:
    - ReadWriteOnce
  storageClassName: longhorn
  resources:
    requests:
      storage: {{ .storage }}
--- a/e2e-test-app/versions/2/service.yaml
+++ b/e2e-test-app/versions/2/service.yaml
@@ -0,0 +1,11 @@
 apiVersion: v1
 kind: Service
 metadata:
  name: e2e-test-app
 spec:
  selector:
    component: web
  ports:
    - port: 80
      targetPort: 8080
      name: http
--- a/example-admin/app.yaml
+++ b/example-admin/app.yaml
@@ -0,0 +1,4 @@
 name: example-admin
 is: example
 description: An example application that is deployed with internal-only access.
 latest: "1"
--- a/example-admin/versions/1/README.md
+++ b/example-admin/versions/1/README.md
--- a/example-admin/versions/1/deployment.yaml
+++ b/example-admin/versions/1/deployment.yaml
--- a/example-admin/versions/1/ingress.yaml
+++ b/example-admin/versions/1/ingress.yaml
--- a/example-admin/versions/1/kustomization.yaml
+++ b/example-admin/versions/1/kustomization.yaml
--- a/example-admin/versions/1/manifest.yaml
+++ b/example-admin/versions/1/manifest.yaml
@@ -1,7 +1,3 @@
 name: example-admin
 is: example
 install: true
 description: An example application that is deployed with internal-only access.
 version: 1.0.0
 defaultConfig:
  namespace: example-admin
--- a/example-admin/versions/1/namespace.yaml
+++ b/example-admin/versions/1/namespace.yaml
@@ -0,0 +1,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
  name: "{{ .namespace }}"
--- a/example-admin/versions/1/service.yaml
+++ b/example-admin/versions/1/service.yaml
--- a/example-app/app.yaml
+++ b/example-app/app.yaml
@@ -0,0 +1,4 @@
 name: example-app
 is: example
 description: An example application that is deployed with public access.
 latest: "1"
--- a/example-app/versions/1/README.md
+++ b/example-app/versions/1/README.md
--- a/example-app/versions/1/deployment.yaml
+++ b/example-app/versions/1/deployment.yaml
--- a/example-app/versions/1/ingress.yaml
+++ b/example-app/versions/1/ingress.yaml
--- a/example-app/versions/1/kustomization.yaml
+++ b/example-app/versions/1/kustomization.yaml
--- a/Show More
+++ b/Show More
Author	SHA1	Message	Date
Paul Payne	8117fb8175	Restore strategies.	2026-05-25 23:10:03 +00:00
Paul Payne	189fdab0bc	refactor: update README for clarity and remove setup script	2026-05-24 20:04:12 +00:00
Paul Payne	bc7a168851	Reorganized for new stable/waypoint versioning design.	2026-05-24 18:28:47 +00:00
Paul Payne	945d2225a2	First version of app upgrade.	2026-05-24 04:00:07 +00:00
Paul Payne	6e1c676c09	feat: update versioning in longhorn and snapshot-controller manifests	2026-05-23 20:42:45 +00:00
Paul Payne	6b5325c6f3	Standardize config.	2026-05-23 19:51:33 +00:00
Paul Payne	e2e3f730a5	fix: remove unnecessary namespace from default configuration in README and manifest	2026-05-23 11:36:51 +00:00
Paul Payne	46002ff273	feat: update NFS documentation and manifest version for improved clarity and configuration	2026-05-23 11:25:50 +00:00
Paul Payne	acec744df8	feat: update NFS configuration and add check-nfs script for server validation	2026-05-23 11:24:21 +00:00
Paul Payne	12e87635c6	docs: Update ADDING-APPS.md to remove cloud.smtp references SMTP config is now at apps.smtp.* via the SMTP infrastructure app, not cloud.smtp.*. Remove the old variable listing and update the configuration flow documentation. Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-05-22 23:31:14 +00:00
Paul Payne	351dff14d4	feat: add BackupTarget configuration and update kustomization to include it	2026-05-21 04:22:13 +00:00
Paul Payne	0645624ded	feat: update Immich version and image tags to 1.135.3 in manifest.yaml	2026-05-21 04:21:40 +00:00
Paul Payne	afa21ef650	feat: add initial Kubernetes manifests for e2e-test-app including deployment, service, PVC, and database initialization job	2026-05-21 04:20:56 +00:00
Paul Payne	5733c20098	feat: add repair-certificates script for managing stuck certificates and ACME orders	2026-05-18 04:24:21 +00:00
Paul Payne	54abfdd469	Add kustomization.yaml for cert-manager with custom DNS settings - Introduced a new kustomization.yaml file for cert-manager. - Configured a patch to modify the cert-manager Deployment to use a custom DNS policy and settings. - Set dnsPolicy to None and specified custom nameservers and search options.	2026-05-18 03:39:21 +00:00
Paul Payne	e4c24d4a8c	feat: update CrowdSec and Traefik manifests; remove installation scripts and add secret management	2026-05-18 03:33:37 +00:00
Paul Payne	b52e76eeeb	feat: remove installation scripts for CoreDNS, ExternalDNS, Headlamp, MetalLB, and NVIDIA Device Plugin; update manifests for deployment configurations	2026-05-18 02:46:00 +00:00
Paul Payne	872a804aa7	feat: update manifests and namespaces to use templated namespace variables	2026-05-17 23:26:20 +00:00
Paul Payne	edff518815	chore: remove deprecated deployment and service configurations for communitarian	2026-05-17 22:35:03 +00:00
Paul Payne	27747bb2a5	docs: Update deployment strategy for apps using ReadWriteOnce PVCs	2026-05-17 22:31:41 +00:00
Paul Payne	326cca5870	docs: Add backup/restore database naming conventions to ADDING-APPS.md Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-05-17 19:24:52 +00:00
Paul Payne	9687fad812	feat: Move cluster services to wild-directory as unified packages Convert all 15 cluster services from embedded API format to wild-directory packages using the unified manifest format: - metallb, traefik, cert-manager, longhorn, snapshot-controller - nfs, smtp, coredns, node-feature-discovery, nvidia-device-plugin - externaldns, docker-registry, headlamp, crowdsec, utils Changes: - wild-manifest.yaml → manifest.yaml with is, defaultConfig, requires - Eliminated configReferences and serviceConfig fields - Flattened kustomize.template/ to package root - Template vars use flat defaultConfig keys - install.sh paths updated for apps/ layout - Updated 9 app manifests: cloud.smtp.* → apps.smtp.* with requires - Removed dead install: true field from 6 app manifests Co-Authored-By: Claude Opus 4.6 <noreply@anthropic.com>	2026-05-17 02:26:46 +00:00