bkonicek · bkonicek · May 21, 2026 · May 20, 2026 · May 20, 2026 · May 20, 2026
diff --git a/applications/appset-applications.yaml b/applications/appset-applications.yaml
diff --git a/applications/appset-ops-tools.yaml b/applications/appset-ops-tools.yaml
@@ -13,8 +13,7 @@ spec:
         repoURL: https://github.com/bkonicek/gitops
         revision: HEAD
         files:
-          - path: environments/sandbox-oci/metrics-server/config.yaml
-          - path: environments/sandbox-oci/prometheus-operator/config.yaml
+          - path: environments/*/*/config.yaml
   template:
     metadata:
       name: "{{index .path.segments 1}}-{{.path.basenameNormalized}}"

diff --git a/base/sealed-secrets-controller.yaml b/base/sealed-secrets-controller.yaml
@@ -0,0 +1,8 @@
+metrics:
+  serviceMonitor:
+    enabled: true
+  dashboards:
+    create: true
+    namespace: monitoring
+    labels:
+      grafana_dashboard: "1"
diff --git a/...ments/sandbox-oci/cert-manager/Chart.yaml → charts/cert-manager/Chart.yaml b/...ments/sandbox-oci/cert-manager/Chart.yaml → charts/cert-manager/Chart.yaml
diff --git a/...templates/clusterissuer-http-staging.yaml → ...templates/clusterissuer-http-staging.yaml b/...templates/clusterissuer-http-staging.yaml → ...templates/clusterissuer-http-staging.yaml
diff --git a/...manager/templates/clusterissuer-http.yaml → ...manager/templates/clusterissuer-http.yaml b/...manager/templates/clusterissuer-http.yaml → ...manager/templates/clusterissuer-http.yaml
diff --git a/...ents/sandbox-oci/cert-manager/values.yaml → charts/cert-manager/values.yaml b/...ents/sandbox-oci/cert-manager/values.yaml → charts/cert-manager/values.yaml
diff --git a/...ments/sandbox-oci/external-dns/Chart.yaml → charts/external-dns/Chart.yaml b/...ments/sandbox-oci/external-dns/Chart.yaml → charts/external-dns/Chart.yaml
diff --git a/...s/templates/cloudflare-sealed-secret.yaml → ...s/templates/cloudflare-sealed-secret.yaml b/...s/templates/cloudflare-sealed-secret.yaml → ...s/templates/cloudflare-sealed-secret.yaml
diff --git a/...i/external-dns/templates/dnsendpoint.yaml → ...s/external-dns/templates/dnsendpoint.yaml b/...i/external-dns/templates/dnsendpoint.yaml → ...s/external-dns/templates/dnsendpoint.yaml
diff --git a/charts/external-dns/values.yaml b/charts/external-dns/values.yaml
@@ -0,0 +1,19 @@
+external-dns:
+  provider: cloudflare
+  policy: sync
+  sources:
+    - ingress
+    - crd
+  txtOwnerId: external-dns
+  env:
+    - name: CF_API_TOKEN
+      valueFrom:
+        secretKeyRef:
+          name: cf-dns
+          key: API_TOKEN
+
+  serviceMonitor:
+    enabled: true
+
+# DNS zone
+dnsZone: benkonicek.com
diff --git a/...s/sandbox-oci/external-secrets/Chart.yaml → charts/external-secrets/Chart.yaml b/...s/sandbox-oci/external-secrets/Chart.yaml → charts/external-secrets/Chart.yaml
diff --git a/...erator-service-account-sealed-secret.yaml → ...erator-service-account-sealed-secret.yaml b/...erator-service-account-sealed-secret.yaml → ...erator-service-account-sealed-secret.yaml
diff --git a/...lates/cluster-secret-store-1password.yaml → ...lates/cluster-secret-store-1password.yaml b/...lates/cluster-secret-store-1password.yaml → ...lates/cluster-secret-store-1password.yaml
diff --git a/.../sandbox-oci/external-secrets/values.yaml → charts/external-secrets/values.yaml b/.../sandbox-oci/external-secrets/values.yaml → charts/external-secrets/values.yaml
diff --git a/environments/sandbox-oci/pihole/Chart.yaml → charts/pihole/Chart.yaml b/environments/sandbox-oci/pihole/Chart.yaml → charts/pihole/Chart.yaml
diff --git a/...plates/externalsecret-admin-password.yaml → ...plates/externalsecret-admin-password.yaml b/...plates/externalsecret-admin-password.yaml → ...plates/externalsecret-admin-password.yaml
diff --git a/environments/sandbox-oci/pihole/values.yaml → charts/pihole/values.yaml b/environments/sandbox-oci/pihole/values.yaml → charts/pihole/values.yaml
diff --git a/...ronments/sandbox-oci/tailscale/Chart.yaml → charts/tailscale/Chart.yaml b/...ronments/sandbox-oci/tailscale/Chart.yaml → charts/tailscale/Chart.yaml
diff --git a/...ci/tailscale/templates/app-connector.yaml → ...ts/tailscale/templates/app-connector.yaml b/...ci/tailscale/templates/app-connector.yaml → ...ts/tailscale/templates/app-connector.yaml
diff --git a/...lscale/templates/connector-exit-node.yaml → ...lscale/templates/connector-exit-node.yaml b/...lscale/templates/connector-exit-node.yaml → ...lscale/templates/connector-exit-node.yaml
diff --git a/...ox-oci/tailscale/templates/namespace.yaml → charts/tailscale/templates/namespace.yaml b/...ox-oci/tailscale/templates/namespace.yaml → charts/tailscale/templates/namespace.yaml
diff --git a/...mplates/operator-oauth-sealed-secret.yaml → ...mplates/operator-oauth-sealed-secret.yaml b/...mplates/operator-oauth-sealed-secret.yaml → ...mplates/operator-oauth-sealed-secret.yaml
diff --git a/charts/tailscale/values.yaml b/charts/tailscale/values.yaml
@@ -0,0 +1,21 @@
+tailscale-operator:
+  operatorConfig:
+    resources:
+      requests:
+        cpu: 500m
+        memory: 100Mi
+      limits:
+        memory: 100Mi
+    image:
+      repository: docker.io/tailscale/k8s-operator
+  proxyConfig:
+    image:
+      repository: docker.io/tailscale/tailscale
+  apiServerProxyConfig:
+    mode: true
+
+appConnector:
+  enabled: false
+  image:
+    repository: docker.io/tailscale/tailscale
+    tag: v1.96.5
diff --git a/environments/sandbox-oci/traefik/Chart.yaml → charts/traefik/Chart.yaml b/environments/sandbox-oci/traefik/Chart.yaml → charts/traefik/Chart.yaml
diff --git a/charts/traefik/config.yaml b/charts/traefik/config.yaml
@@ -0,0 +1,2 @@
+namespace: traefik
+targetRevision: HEAD
diff --git a/...templates/middleware-default-headers.yaml → ...templates/middleware-default-headers.yaml b/...templates/middleware-default-headers.yaml → ...templates/middleware-default-headers.yaml
diff --git a/...raefik/templates/middleware-redirect.yaml → ...raefik/templates/middleware-redirect.yaml b/...raefik/templates/middleware-redirect.yaml → ...raefik/templates/middleware-redirect.yaml
diff --git a/...ox-oci/traefik/templates/tls-options.yaml → charts/traefik/templates/tls-options.yaml b/...ox-oci/traefik/templates/tls-options.yaml → charts/traefik/templates/tls-options.yaml
diff --git a/charts/traefik/values.yaml b/charts/traefik/values.yaml
@@ -0,0 +1,21 @@
+traefik:
+  providers:
+    kubernetesIngressNGINX:
+      enabled: true
+    kubernetesCRD:
+      allowCrossNamespace: true
+  service:
+    spec:
+      externalTrafficPolicy: Local
+  metrics:
+    prometheus:
+      disableAPICheck: true
+      serviceMonitor:
+        enabled: true
+  ingressClass:
+    name: traefik
+  logs:
+    access:
+      enabled: true
+  additionalArguments:
+    - "--entrypoints.websecure.http.middlewares=traefik-default-headers@kubernetescrd"
diff --git a/environments/sandbox-oci/external-dns/values.yaml b/environments/sandbox-oci/external-dns/values.yaml
@@ -1,38 +1,9 @@
 external-dns:
-  provider: cloudflare
-  policy: sync
-  sources:
-    - ingress
-    - crd
-  txtOwnerId: external-dns
-  env:
-    - name: CF_API_TOKEN
-      valueFrom:
-        secretKeyRef:
-          name: cf-dns
-          key: API_TOKEN
   extraArgs:
     - "--exclude-target-net=10.0.0.0/8"
-
-  serviceMonitor:
-    enabled: true
-
-# DNS zone
-dnsZone: benkonicek.com
-
+
 # Create DNSEndpoint resources
 dnsEndpoints:
-  # YAML map of DNSEndpoints to create
-  # www:
-  #   # DNS record type
-  #   type: CNAME
-  #   # List of targets to point the record to
-  #   targets:
-  #     - example.com
-  #     # Enable proxying the record through cloudflare
-  #   proxy: true
-  #   # TTL for the record
-  #   ttl: 180
   blog:
     type: CNAME
     targets:

diff --git a/environments/sandbox-oci/sealed-secrets-controller/.helmignore b/environments/sandbox-oci/sealed-secrets-controller/.helmignore
diff --git a/environments/sandbox-oci/sealed-secrets-controller/Chart.yaml b/environments/sandbox-oci/sealed-secrets-controller/Chart.yaml
diff --git a/environments/sandbox-oci/sealed-secrets-controller/config.yaml b/environments/sandbox-oci/sealed-secrets-controller/config.yaml
@@ -1,2 +1,4 @@
 namespace: kube-system
-targetRevision: HEAD
+targetRevision: 2.18.5
+repoURL: https://bitnami-labs.github.io/sealed-secrets
+chartName: sealed-secrets
diff --git a/environments/sandbox-oci/sealed-secrets-controller/values.yaml b/environments/sandbox-oci/sealed-secrets-controller/values.yaml
diff --git a/environments/sandbox-oci/tailscale/values.yaml b/environments/sandbox-oci/tailscale/values.yaml
@@ -1,22 +1,3 @@
 tailscale-operator:
   operatorConfig:
     hostname: sandbox-oci-cluster
-    resources:
-      requests:
-        cpu: 500m
-        memory: 100Mi
-      limits:
-        memory: 100Mi
-    image:
-      repository: docker.io/tailscale/k8s-operator
-  proxyConfig:
-    image:
-      repository: docker.io/tailscale/tailscale
-  apiServerProxyConfig:
-    mode: true
-
-appConnector:
-  enabled: false
-  image:
-    repository: docker.io/tailscale/tailscale
-    tag: v1.96.5
diff --git a/environments/sandbox-oci/traefik/values.yaml b/environments/sandbox-oci/traefik/values.yaml
@@ -1,23 +1,4 @@
 traefik:
-  providers:
-    kubernetesIngressNGINX:
-      enabled: true
-    kubernetesCRD:
-      allowCrossNamespace: true
   service:
     annotations:
       oci.oraclecloud.com/load-balancer-type: "nlb"
-    spec:
-      externalTrafficPolicy: Local
-  metrics:
-    prometheus:
-      disableAPICheck: true
-      serviceMonitor:
-        enabled: true
-  ingressClass:
-    name: traefik
-  logs:
-    access:
-      enabled: true
-  additionalArguments:
-    - "--entrypoints.websecure.http.middlewares=traefik-default-headers@kubernetescrd"