Merge remote-tracking branch 'origin/master' into wizard/gpu-vram-budget

.claude/reference/service-catalog.md

@@ -50,7 +50,6 @@
 | owntracks | Location tracking | owntracks |
 | nextcloud | File sync/share | nextcloud |
 | calibre | E-book management (may be merged into ebooks stack) | calibre |
-| onlyoffice | Document editing | onlyoffice |
 | f1-stream | F1 streaming (uses chrome-service for hmembeds verifier); canonical source in own repo `viktor/f1-stream` (Forgejo, extracted 2026-06-05); GHA-built → `ghcr.io/viktorbarzin/f1-stream` (private), Woodpecker deploy-only (ADR-0002) | f1-stream |
 | chrome-service | Headed Chromium over CDP (`http://chrome-service.chrome-service.svc:9222`, `connect_over_cdp`; legacy `:3000/<token>` WS pool removed 2026-06-04) for sibling services driving anti-bot pages — snapshot-harvester CronJob + tripit fare scrape | chrome-service |
 | rybbit | Analytics | rybbit |
@@ -139,7 +138,7 @@ travel, netbox, phpipam, tripit, t3, stem95su
 mail, wg, headscale, immich, calibre, vaultwarden,
 mailserver-antispam, mailserver-admin, webhook, uptime,
 owntracks, dawarich, tuya, meshcentral, nextcloud, actualbudget,
-onlyoffice, forgejo, freshrss, navidrome, ollama, openwebui,
+forgejo, freshrss, navidrome, ollama, openwebui,
 isponsorblocktv, speedtest, freedify, rybbit, paperless,
 servarr, prowlarr, bazarr, radarr, sonarr, flaresolverr,
 jellyfin, jellyseerr, tdarr, affine, health, family, openclaw

modules/create-template-vm/cloud_init.yaml

@@ -88,13 +88,12 @@ write_files:
 runcmd:
   # Enable weekly TRIM/discard to reclaim freed blocks in LVM thin pool
   - systemctl enable --now fstrim.timer
-  # Enable persistent journald logging for crash forensics, with size limits to reduce disk wear
+  # journald in RAM (volatile, capped) — node + pod journals already ship to
-  - mkdir -p /var/log/journal
+  # Loki via alloy (loki.source.journal), so on-disk journald is pure sdc
-  - sed -i 's/#Storage=auto/Storage=persistent/' /etc/systemd/journald.conf
+  # write-IOPS overhead on the IOPS-bound HDD. code-oflt 2026-06-30.
-  - sed -i 's/#SystemMaxUse=/SystemMaxUse=500M/' /etc/systemd/journald.conf
+  - mkdir -p /etc/systemd/journald.conf.d
-  - sed -i 's/#MaxRetentionSec=/MaxRetentionSec=7day/' /etc/systemd/journald.conf
+  - printf '[Journal]\nStorage=volatile\nRuntimeMaxUse=200M\nCompress=yes\n' > /etc/systemd/journald.conf.d/90-oflt-volatile.conf
-  - sed -i 's/#MaxFileSec=/MaxFileSec=1day/' /etc/systemd/journald.conf
+  - rm -rf /var/log/journal
-  - sed -i 's/#Compress=yes/Compress=yes/' /etc/systemd/journald.conf
   - systemctl restart systemd-journald
   %{if is_k8s_template}
   # Node DNS is intentionally STOCK — no resolved drop-ins, no /etc/hosts

stacks/broker-sync/main.tf

@@ -167,6 +167,12 @@ resource "kubernetes_cron_job_v1" "trading212" {
           }
           spec {
             restart_policy = "OnFailure"
+            # Pin every job that mounts the shared RWO data volume to one node:
+            # cross-node scheduling forced a nightly detach/attach cycle whose
+            # QMP hotplug intermittently ghost-attaches on disk-heavy VMs and
+            # wedges all broker-sync jobs in ContainerCreating (2026-07-01/02).
+            # One node = volume attaches once and stays put.
+            node_selector = { "kubernetes.io/hostname" = "k8s-node4" }
             # See imap cron — without fsGroup=10001 the broker user (uid=10001
             # gid=999) can't write the sqlite3 journal next to /data/sync.db
             # and the dedup.record() call after a successful WF import crashes
@@ -277,6 +283,12 @@ resource "kubernetes_cron_job_v1" "ibkr" {
           }
           spec {
             restart_policy = "OnFailure"
+            # Pin every job that mounts the shared RWO data volume to one node:
+            # cross-node scheduling forced a nightly detach/attach cycle whose
+            # QMP hotplug intermittently ghost-attaches on disk-heavy VMs and
+            # wedges all broker-sync jobs in ContainerCreating (2026-07-01/02).
+            # One node = volume attaches once and stays put.
+            node_selector = { "kubernetes.io/hostname" = "k8s-node4" }
             security_context {
               fs_group = 10001
             }
@@ -411,6 +423,12 @@ resource "kubernetes_cron_job_v1" "imap" {
           }
           spec {
             restart_policy = "OnFailure"
+            # Pin every job that mounts the shared RWO data volume to one node:
+            # cross-node scheduling forced a nightly detach/attach cycle whose
+            # QMP hotplug intermittently ghost-attaches on disk-heavy VMs and
+            # wedges all broker-sync jobs in ContainerCreating (2026-07-01/02).
+            # One node = volume attaches once and stays put.
+            node_selector = { "kubernetes.io/hostname" = "k8s-node4" }
             # The broker image's user is uid=10001 gid=999, but the shared
             # data PVC's /data root was created with gid=10001 (legacy from
             # an earlier image build). Without fsGroup the pod can't write
@@ -563,6 +581,12 @@ resource "kubernetes_cron_job_v1" "csv_drop" {
           }
           spec {
             restart_policy = "OnFailure"
+            # Pin every job that mounts the shared RWO data volume to one node:
+            # cross-node scheduling forced a nightly detach/attach cycle whose
+            # QMP hotplug intermittently ghost-attaches on disk-heavy VMs and
+            # wedges all broker-sync jobs in ContainerCreating (2026-07-01/02).
+            # One node = volume attaches once and stays put.
+            node_selector = { "kubernetes.io/hostname" = "k8s-node4" }
             container {
               name    = "broker-sync"
               image   = local.broker_sync_image
@@ -655,6 +679,12 @@ resource "kubernetes_cron_job_v1" "fx_reconcile" {
           }
           spec {
             restart_policy = "OnFailure"
+            # Pin every job that mounts the shared RWO data volume to one node:
+            # cross-node scheduling forced a nightly detach/attach cycle whose
+            # QMP hotplug intermittently ghost-attaches on disk-heavy VMs and
+            # wedges all broker-sync jobs in ContainerCreating (2026-07-01/02).
+            # One node = volume attaches once and stays put.
+            node_selector = { "kubernetes.io/hostname" = "k8s-node4" }
             container {
               name    = "broker-sync"
               image   = local.broker_sync_image
@@ -747,6 +777,12 @@ resource "kubernetes_cron_job_v1" "backup" {
           }
           spec {
             restart_policy = "OnFailure"
+            # Pin every job that mounts the shared RWO data volume to one node:
+            # cross-node scheduling forced a nightly detach/attach cycle whose
+            # QMP hotplug intermittently ghost-attaches on disk-heavy VMs and
+            # wedges all broker-sync jobs in ContainerCreating (2026-07-01/02).
+            # One node = volume attaches once and stays put.
+            node_selector = { "kubernetes.io/hostname" = "k8s-node4" }
             container {
               name  = "backup"
               image = "alpine:3.20"
@@ -850,6 +886,12 @@ resource "kubernetes_cron_job_v1" "fidelity" {
           }
           spec {
             restart_policy = "OnFailure"
+            # Pin every job that mounts the shared RWO data volume to one node:
+            # cross-node scheduling forced a nightly detach/attach cycle whose
+            # QMP hotplug intermittently ghost-attaches on disk-heavy VMs and
+            # wedges all broker-sync jobs in ContainerCreating (2026-07-01/02).
+            # One node = volume attaches once and stays put.
+            node_selector = { "kubernetes.io/hostname" = "k8s-node4" }
             # Materialise the JSON storage_state from the projected Secret
             # onto the PVC where Playwright expects to read it. Init container
             # runs as root; the main broker-sync container runs as uid 10001,

stacks/dbaas/modules/dbaas/main.tf

@@ -111,7 +111,12 @@ resource "kubernetes_config_map" "mysql_standalone_cnf" {
       innodb_io_capacity=100
       innodb_io_capacity_max=200
       innodb_redo_log_capacity=1073741824
-      innodb_buffer_pool_size=1073741824
+      innodb_buffer_pool_size=2147483648
+      # DETECT_ONLY: stop writing full page content to the doublewrite buffer
+      # (~halves page-flush writes on the IOPS-bound sdc) while keeping torn-page
+      # DETECTION; recovery is restore-from-backup. OK with BBU+UPS+daily
+      # mysqldump. Dynamic (no restart). code-oflt 2026-06-30.
+      innodb_doublewrite=DETECT_ONLY
       innodb_flush_neighbors=1
       innodb_lru_scan_depth=256
       innodb_page_cleaners=1
@@ -228,11 +233,13 @@ resource "kubernetes_stateful_set_v1" "mysql_standalone" {
           resources {
             requests = {
               cpu    = "250m"
-              memory = "3Gi"
-            }
-            limits = {
               memory = "4Gi"
             }
+            # 6Gi (was 4Gi) — code-oflt 2026-06-30: headroom for the 2Gi InnoDB
+            # buffer pool (was 1Gi); the pod was already at ~3.7Gi/4Gi (near OOM).
+            limits = {
+              memory = "6Gi"
+            }
           }
 
           volume_mount {
@@ -298,7 +305,15 @@ resource "kubernetes_stateful_set_v1" "mysql_standalone" {
   }
 
   lifecycle {
-    ignore_changes = [spec[0].template[0].spec[0].dns_config] # KYVERNO_LIFECYCLE_V1
+    ignore_changes = [
+      spec[0].template[0].spec[0].dns_config, # KYVERNO_LIFECYCLE_V1
+      # StatefulSet volumeClaimTemplates are immutable post-creation, and the
+      # pvc-autoresizer rewrites their annotations on the live object
+      # (storage_limit/threshold), so TF's desired VCT can never apply and a
+      # broad `dbaas` apply errors out. The autoresizer owns PVC sizing; ignore
+      # the VCT so other STS changes (e.g. resources) apply cleanly. (code-oflt 2026-06-30)
+      spec[0].volume_claim_template,
+    ]
   }
 }
 

stacks/kyverno/modules/kyverno/security-policies.tf

@@ -353,7 +353,7 @@ resource "kubectl_manifest" "policy_require_trusted_registries" {
                   "lissy93/*", "louislam/*", "matrixdotorg/*", "mauriceboe/*",
                   "mendhak/*",
                   "mghee/*", "mindflavor/*", "mpepping/*", "netboxcommunity/*",
-                  "netsampler/*", "nousresearch/*", "nvidia/*", "onlyoffice/*",
+                  "netsampler/*", "nousresearch/*", "nvidia/*",
                   "openresty/*", "opentripplanner/*", "owntracks/*",
                   "phpipam/*", "phpmyadmin/*", "privatebin/*", "prom/*",
                   "prompve/*", "rancher/*", "rhasspy/*", "roundcube/*", "sclevine/*",

stacks/monitoring/modules/monitoring/dashboards/wealth.json

@@ -1506,6 +1506,165 @@
         }
       ]
     },
+    {
+      "id": 9230,
+      "title": "Effective hourly rate \u2014 gross vs net (\u00a3/h, per year)",
+      "description": "Annual pay \u00f7 hours worked. Hours = 40h/week contractual (2,080h per full year, per offer letter: Mon\u2013Fri 09:00\u201318:00 less 1h lunch), prorated by months actually worked. Gross = gross_pay incl. notional RSU vest; Net = take-home. The latest still-accruing year is shown DASHED: it reads high because the full-year bonus (paid each March) and front-loaded quarterly RSU vests are divided by only the months worked so far, and settles lower as the year completes. Calendar year; last 10y.",
+      "type": "timeseries",
+      "datasource": {
+        "type": "grafana-postgresql-datasource",
+        "uid": "payslips-pg"
+      },
+      "gridPos": {
+        "h": 9,
+        "w": 24,
+        "x": 0,
+        "y": 77
+      },
+      "timeFrom": "10y",
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "palette-classic"
+          },
+          "unit": "currencyGBP",
+          "decimals": 1,
+          "custom": {
+            "drawStyle": "line",
+            "lineWidth": 2,
+            "fillOpacity": 10,
+            "gradientMode": "opacity",
+            "pointSize": 6,
+            "showPoints": "always",
+            "spanNulls": true,
+            "axisPlacement": "auto",
+            "axisLabel": "\u00a3 / hour",
+            "stacking": {
+              "group": "A",
+              "mode": "none"
+            }
+          }
+        },
+        "overrides": [
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Gross (incl. RSU)"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "mode": "fixed",
+                  "fixedColor": "#FF9830"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Net (take-home)"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "mode": "fixed",
+                  "fixedColor": "blue"
+                }
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Gross (current yr, partial)"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "mode": "fixed",
+                  "fixedColor": "#FF9830"
+                }
+              },
+              {
+                "id": "custom.lineStyle",
+                "value": {
+                  "fill": "dash",
+                  "dash": [
+                    10,
+                    10
+                  ]
+                }
+              },
+              {
+                "id": "custom.fillOpacity",
+                "value": 0
+              }
+            ]
+          },
+          {
+            "matcher": {
+              "id": "byName",
+              "options": "Net (current yr, partial)"
+            },
+            "properties": [
+              {
+                "id": "color",
+                "value": {
+                  "mode": "fixed",
+                  "fixedColor": "blue"
+                }
+              },
+              {
+                "id": "custom.lineStyle",
+                "value": {
+                  "fill": "dash",
+                  "dash": [
+                    10,
+                    10
+                  ]
+                }
+              },
+              {
+                "id": "custom.fillOpacity",
+                "value": 0
+              }
+            ]
+          }
+        ]
+      },
+      "options": {
+        "legend": {
+          "calcs": [
+            "last",
+            "max",
+            "min"
+          ],
+          "displayMode": "table",
+          "placement": "bottom"
+        },
+        "tooltip": {
+          "mode": "multi",
+          "sort": "desc"
+        }
+      },
+      "targets": [
+        {
+          "refId": "A",
+          "datasource": {
+            "type": "grafana-postgresql-datasource",
+            "uid": "payslips-pg"
+          },
+          "format": "time_series",
+          "editorMode": "code",
+          "rawQuery": true,
+          "rawSql": "WITH y AS (\n  SELECT date_trunc('year', pay_date) AS yr,\n         COUNT(DISTINCT date_trunc('month', pay_date)) AS months,\n         SUM(gross_pay) AS gross, SUM(net_pay) AS net\n  FROM payslip_ingest.payslip GROUP BY 1\n),\ncalc AS (\n  SELECT yr, months,\n         gross / (months * (40.0 * 52 / 12)) AS gross_h,\n         net   / (months * (40.0 * 52 / 12)) AS net_h\n  FROM y\n),\nflagged AS (\n  SELECT yr, gross_h, net_h, (yr = MAX(yr) OVER () AND months < 12) AS partial FROM calc\n),\nwithlead AS (\n  SELECT yr, gross_h, net_h, partial,\n         COALESCE(LEAD(partial) OVER (ORDER BY yr), false) AS next_partial FROM flagged\n)\nSELECT yr::timestamp AS \"time\",\n       CASE WHEN partial THEN NULL ELSE gross_h END AS \"Gross (incl. RSU)\",\n       CASE WHEN partial THEN NULL ELSE net_h   END AS \"Net (take-home)\",\n       CASE WHEN partial OR next_partial THEN gross_h ELSE NULL END AS \"Gross (current yr, partial)\",\n       CASE WHEN partial OR next_partial THEN net_h   ELSE NULL END AS \"Net (current yr, partial)\"\nFROM withlead ORDER BY yr"
+        }
+      ]
+    },
     {
       "type": "row",
       "title": "Holdings",
@@ -1515,7 +1674,7 @@
         "h": 1,
         "w": 24,
         "x": 0,
-        "y": 78
+        "y": 86
       },
       "panels": []
     },
@@ -1532,7 +1691,7 @@
         "h": 10,
         "w": 12,
         "x": 0,
-        "y": 79
+        "y": 87
       },
       "fieldConfig": {
         "defaults": {
@@ -1729,7 +1888,7 @@
         "h": 10,
         "w": 12,
         "x": 12,
-        "y": 79
+        "y": 87
       },
       "fieldConfig": {
         "defaults": {
@@ -1782,7 +1941,7 @@
         "h": 1,
         "w": 24,
         "x": 0,
-        "y": 90
+        "y": 98
       },
       "panels": []
     },
@@ -1799,7 +1958,7 @@
         "h": 9,
         "w": 12,
         "x": 0,
-        "y": 91
+        "y": 99
       },
       "fieldConfig": {
         "defaults": {
@@ -1916,7 +2075,7 @@
         "h": 12,
         "w": 12,
         "x": 12,
-        "y": 91
+        "y": 99
       },
       "fieldConfig": {
         "defaults": {
@@ -2135,7 +2294,7 @@
         "h": 1,
         "w": 24,
         "x": 0,
-        "y": 104
+        "y": 112
       },
       "panels": []
     },
@@ -2152,7 +2311,7 @@
         "h": 12,
         "w": 24,
         "x": 0,
-        "y": 105
+        "y": 113
       },
       "fieldConfig": {
         "defaults": {
@@ -2324,13 +2483,13 @@
       "title": "FC::intro",
       "gridPos": {
         "x": 0,
-        "y": 118,
+        "y": 126,
-        "w": 24,
+        "w": 18,
         "h": 4
       },
       "options": {
         "mode": "markdown",
-        "content": "## \ud83d\udd25 FIRE Countdown \u2014 **$country**\nTarget = smallest **liquid** net worth where Guyton-Klinger hits **99%** success (Monte-Carlo), in **today's money**. Spend is your real actualbudget \u00d7 **1.5**, cost-of-living re-scaled to the country. The \u00a3139k workplace pension is excluded from current NW and joins as a tranche at ~57. _Current NW = liquid bridge pot._"
+        "content": "## \ud83d\udd25 FIRE Countdown \u2014 **$country**\nTarget = smallest **liquid** net worth where Guyton-Klinger hits **99%** success (Monte-Carlo), in **today's money**. Spend is your real actualbudget \u00d7 **1.5**, cost-of-living re-scaled to the country. The workplace pension is excluded from current NW and joins as a separate tranche at ~57 (value at unlock shown in the Pension-tranche panel). _Current NW = liquid bridge pot._\n\n_Caveats: Household/Family include an **estimated** figure for Anca's spend (pending a live re-pull). Countries without a modelled tax regime fall back to a neutral **nomad** 1% assumption (see Tax-regime panel)._"
       }
     },
     {
@@ -2339,7 +2498,7 @@
       "title": "FC::solo header",
       "gridPos": {
         "x": 0,
-        "y": 122,
+        "y": 130,
         "w": 24,
         "h": 2
       },
@@ -2358,7 +2517,7 @@
       },
       "gridPos": {
         "x": 0,
-        "y": 124,
+        "y": 132,
         "w": 5,
         "h": 5
       },
@@ -2411,7 +2570,7 @@
       },
       "gridPos": {
         "x": 5,
-        "y": 124,
+        "y": 132,
         "w": 4,
         "h": 5
       },
@@ -2484,7 +2643,7 @@
       },
       "gridPos": {
         "x": 9,
-        "y": 124,
+        "y": 132,
         "w": 5,
         "h": 5
       },
@@ -2549,7 +2708,7 @@
       },
       "gridPos": {
         "x": 14,
-        "y": 124,
+        "y": 132,
         "w": 5,
         "h": 5
       },
@@ -2586,7 +2745,7 @@
             "uid": "fire-planner-pg"
           },
           "rawQuery": true,
-          "rawSql": "SELECT CASE WHEN ft.target_nw_gbp - liq.nw <= 0 THEN 'Reached' ELSE to_char(CURRENT_DATE + ((ft.target_nw_gbp - liq.nw)/NULLIF($savings_per_year,0)*365)::int, 'Mon YYYY') END AS fire_date FROM (SELECT * FROM fire_planner.fire_target WHERE \"case\"='solo' AND country_slug='$country' AND with_home=false AND bar=0.99 LIMIT 1) ft, (SELECT COALESCE(SUM(market_value_gbp),0) AS nw FROM fire_planner.account_snapshot WHERE snapshot_date=(SELECT MAX(snapshot_date) FROM fire_planner.account_snapshot) AND account_type<>'WORKPLACE_PENSION') liq",
+          "rawSql": "SELECT CASE WHEN ft.target_nw_gbp - liq.nw <= 0 THEN 'Reached' WHEN COALESCE(NULLIF('$savings_per_year','')::numeric, 0) <= 0 THEN 'Set savings \u00a3/yr' ELSE to_char(CURRENT_DATE + ((ft.target_nw_gbp - liq.nw)/NULLIF(NULLIF('$savings_per_year','')::numeric,0)*365)::int, 'Mon YYYY') END AS fire_date FROM (SELECT * FROM fire_planner.fire_target WHERE \"case\"='solo' AND country_slug='$country' AND with_home=false AND bar=0.99 LIMIT 1) ft, (SELECT COALESCE(SUM(market_value_gbp),0) AS nw FROM fire_planner.account_snapshot WHERE snapshot_date=(SELECT MAX(snapshot_date) FROM fire_planner.account_snapshot) AND account_type<>'WORKPLACE_PENSION') liq",
           "editorMode": "code",
           "format": "table"
         }
@@ -2602,7 +2761,7 @@
       },
       "gridPos": {
         "x": 19,
-        "y": 124,
+        "y": 132,
         "w": 5,
         "h": 5
       },
@@ -2651,7 +2810,7 @@
       "title": "FC::household header",
       "gridPos": {
         "x": 0,
-        "y": 129,
+        "y": 137,
         "w": 24,
         "h": 2
       },
@@ -2670,7 +2829,7 @@
       },
       "gridPos": {
         "x": 0,
-        "y": 131,
+        "y": 139,
         "w": 5,
         "h": 5
       },
@@ -2723,7 +2882,7 @@
       },
       "gridPos": {
         "x": 5,
-        "y": 131,
+        "y": 139,
         "w": 4,
         "h": 5
       },
@@ -2796,7 +2955,7 @@
       },
       "gridPos": {
         "x": 9,
-        "y": 131,
+        "y": 139,
         "w": 5,
         "h": 5
       },
@@ -2861,7 +3020,7 @@
       },
       "gridPos": {
         "x": 14,
-        "y": 131,
+        "y": 139,
         "w": 5,
         "h": 5
       },
@@ -2898,7 +3057,7 @@
             "uid": "fire-planner-pg"
           },
           "rawQuery": true,
-          "rawSql": "SELECT CASE WHEN ft.target_nw_gbp - liq.nw <= 0 THEN 'Reached' ELSE to_char(CURRENT_DATE + ((ft.target_nw_gbp - liq.nw)/NULLIF($savings_per_year,0)*365)::int, 'Mon YYYY') END AS fire_date FROM (SELECT * FROM fire_planner.fire_target WHERE \"case\"='household' AND country_slug='$country' AND with_home=false AND bar=0.99 LIMIT 1) ft, (SELECT COALESCE(SUM(market_value_gbp),0) AS nw FROM fire_planner.account_snapshot WHERE snapshot_date=(SELECT MAX(snapshot_date) FROM fire_planner.account_snapshot) AND account_type<>'WORKPLACE_PENSION') liq",
+          "rawSql": "SELECT CASE WHEN ft.target_nw_gbp - liq.nw <= 0 THEN 'Reached' WHEN COALESCE(NULLIF('$savings_per_year','')::numeric, 0) <= 0 THEN 'Set savings \u00a3/yr' ELSE to_char(CURRENT_DATE + ((ft.target_nw_gbp - liq.nw)/NULLIF(NULLIF('$savings_per_year','')::numeric,0)*365)::int, 'Mon YYYY') END AS fire_date FROM (SELECT * FROM fire_planner.fire_target WHERE \"case\"='household' AND country_slug='$country' AND with_home=false AND bar=0.99 LIMIT 1) ft, (SELECT COALESCE(SUM(market_value_gbp),0) AS nw FROM fire_planner.account_snapshot WHERE snapshot_date=(SELECT MAX(snapshot_date) FROM fire_planner.account_snapshot) AND account_type<>'WORKPLACE_PENSION') liq",
           "editorMode": "code",
           "format": "table"
         }
@@ -2914,7 +3073,7 @@
       },
       "gridPos": {
         "x": 19,
-        "y": 131,
+        "y": 139,
         "w": 5,
         "h": 5
       },
@@ -2963,7 +3122,7 @@
       "title": "FC::family header",
       "gridPos": {
         "x": 0,
-        "y": 136,
+        "y": 144,
         "w": 24,
         "h": 2
       },
@@ -2982,7 +3141,7 @@
       },
       "gridPos": {
         "x": 0,
-        "y": 138,
+        "y": 146,
         "w": 5,
         "h": 5
       },
@@ -3035,7 +3194,7 @@
       },
       "gridPos": {
         "x": 5,
-        "y": 138,
+        "y": 146,
         "w": 4,
         "h": 5
       },
@@ -3108,7 +3267,7 @@
       },
       "gridPos": {
         "x": 9,
-        "y": 138,
+        "y": 146,
         "w": 5,
         "h": 5
       },
@@ -3173,7 +3332,7 @@
       },
       "gridPos": {
         "x": 14,
-        "y": 138,
+        "y": 146,
         "w": 5,
         "h": 5
       },
@@ -3210,7 +3369,7 @@
             "uid": "fire-planner-pg"
           },
           "rawQuery": true,
-          "rawSql": "SELECT CASE WHEN ft.target_nw_gbp - liq.nw <= 0 THEN 'Reached' ELSE to_char(CURRENT_DATE + ((ft.target_nw_gbp - liq.nw)/NULLIF($savings_per_year,0)*365)::int, 'Mon YYYY') END AS fire_date FROM (SELECT * FROM fire_planner.fire_target WHERE \"case\"='family' AND country_slug='$country' AND with_home=$with_home AND bar=0.99 LIMIT 1) ft, (SELECT COALESCE(SUM(market_value_gbp),0) AS nw FROM fire_planner.account_snapshot WHERE snapshot_date=(SELECT MAX(snapshot_date) FROM fire_planner.account_snapshot) AND account_type<>'WORKPLACE_PENSION') liq",
+          "rawSql": "SELECT CASE WHEN ft.target_nw_gbp - liq.nw <= 0 THEN 'Reached' WHEN COALESCE(NULLIF('$savings_per_year','')::numeric, 0) <= 0 THEN 'Set savings \u00a3/yr' ELSE to_char(CURRENT_DATE + ((ft.target_nw_gbp - liq.nw)/NULLIF(NULLIF('$savings_per_year','')::numeric,0)*365)::int, 'Mon YYYY') END AS fire_date FROM (SELECT * FROM fire_planner.fire_target WHERE \"case\"='family' AND country_slug='$country' AND with_home=$with_home AND bar=0.99 LIMIT 1) ft, (SELECT COALESCE(SUM(market_value_gbp),0) AS nw FROM fire_planner.account_snapshot WHERE snapshot_date=(SELECT MAX(snapshot_date) FROM fire_planner.account_snapshot) AND account_type<>'WORKPLACE_PENSION') liq",
           "editorMode": "code",
           "format": "table"
         }
@@ -3226,7 +3385,7 @@
       },
       "gridPos": {
         "x": 19,
-        "y": 138,
+        "y": 146,
         "w": 5,
         "h": 5
       },
@@ -3275,7 +3434,7 @@
       "title": "FC::safety header",
       "gridPos": {
         "x": 0,
-        "y": 143,
+        "y": 151,
         "w": 24,
         "h": 2
       },
@@ -3294,7 +3453,7 @@
       },
       "gridPos": {
         "x": 0,
-        "y": 145,
+        "y": 153,
         "w": 6,
         "h": 5
       },
@@ -3359,7 +3518,7 @@
       },
       "gridPos": {
         "x": 6,
-        "y": 145,
+        "y": 153,
         "w": 6,
         "h": 5
       },
@@ -3412,7 +3571,7 @@
       },
       "gridPos": {
         "x": 12,
-        "y": 145,
+        "y": 153,
         "w": 6,
         "h": 5
       },
@@ -3461,7 +3620,7 @@
       "title": "FC::Anca bridge",
       "gridPos": {
         "x": 18,
-        "y": 145,
+        "y": 153,
         "w": 6,
         "h": 5
       },
@@ -3469,6 +3628,57 @@
         "mode": "markdown",
         "content": "**Anca's bridge**\n\nAnca's continued income covers the early sequence-risk years \u2014 the household never draws the full plan from day one. Plus the written **re-entry trigger**: take a contract if the portfolio is < \u00a31.0M for two quarters."
       }
+    },
+    {
+      "id": 90099,
+      "type": "stat",
+      "title": "FC::Tax regime ($country)",
+      "datasource": {
+        "type": "grafana-postgresql-datasource",
+        "uid": "fire-planner-pg"
+      },
+      "gridPos": {
+        "x": 18,
+        "y": 126,
+        "w": 6,
+        "h": 4
+      },
+      "fieldConfig": {
+        "defaults": {
+          "color": {
+            "mode": "fixed",
+            "fixedColor": "text"
+          }
+        },
+        "overrides": []
+      },
+      "options": {
+        "colorMode": "value",
+        "graphMode": "none",
+        "justifyMode": "center",
+        "textMode": "value",
+        "orientation": "auto",
+        "reduceOptions": {
+          "calcs": [
+            "lastNotNull"
+          ],
+          "fields": "",
+          "values": false
+        }
+      },
+      "targets": [
+        {
+          "refId": "A",
+          "datasource": {
+            "type": "grafana-postgresql-datasource",
+            "uid": "fire-planner-pg"
+          },
+          "rawQuery": true,
+          "editorMode": "code",
+          "format": "table",
+          "rawSql": "SELECT jurisdiction FROM fire_planner.fire_target WHERE country_slug='$country' ORDER BY id LIMIT 1"
+        }
+      ]
     }
   ],
   "refresh": "5m",

stacks/nextcloud/chart_values.yaml

@@ -172,7 +172,7 @@ securityContext:
   fsGroupChangePolicy: OnRootMismatch
 
 collabora:
-  enabled: false # Using onlyoffice instead
+  enabled: false # No document server (onlyoffice decommissioned 2026-07-01)
 
 resources:
   limits:

stacks/onlyoffice/.terraform.lock.hcl

@@ -1,84 +0,0 @@
-# This file is maintained automatically by "terraform init".
-# Manual edits may be lost in future updates.
-
-provider "registry.terraform.io/cloudflare/cloudflare" {
-  version     = "4.52.7"
-  constraints = "~> 4.0"
-  hashes = [
-    "h1:pPItIWii5oymR+geZB219ROSPuSODPLTlM4S/u8xLvM=",
-    "zh:0c904ce31a4c6c4a5b3bf7ff1560e77c0cc7e2450c8553ded8e8c90398e1418b",
-    "zh:36183d310c36373fe4cb936b83c595c6fd3b0a94bc7827f28e5789ccbf59752e",
-    "zh:556a568a6f0235e8f41647de9e4d3a1e7b1d6502df8b19b54ec441f1c653ea10",
-    "zh:633ebbd5b0245e75e500ef9be4d9e62288f97e8da3baaa51323892a786d90285",
-    "zh:6acfe60cf52a65ba8f044f748548d2119e7f4fd7f8ebcb14698960d87c68f529",
-    "zh:890df766e9b839623b1f0437355032a3c006226a6c200cd911e15ee1a9014e9f",
-    "zh:904acc31ebb9d6ef68c792074b30532ee61bf515f19e0a3c75b46f126cca1f13",
-    "zh:a1d0a81246afc8750286d3f6fe7a8fbe6460dd2662407b28dbfbabb612e5fa9d",
-    "zh:a41a36fe253fc365fe2b7ffc749624688b2693b4634862fda161179ab100029f",
-    "zh:a7ef269e77ffa8715c8945a2c14322c7ff159ea44c15f62505f3cbb2cae3b32d",
-    "zh:b01aa3bed30610633b762df64332b26f8844a68c3960cebcb30f04918efc67fe",
-    "zh:b069cc2cd18cae10757df3ae030508eac8d55de7e49eda7a5e3e11f2f7fe6455",
-    "zh:b2d2c6313729ebb7465dceece374049e2d08bda34473901be9ff46a8836d42b2",
-    "zh:db0e114edaf4bc2f3d4769958807c83022bfbc619a00bdf4c4bd17faa4ab2d8b",
-    "zh:ecc0aa8b9044f664fd2aaf8fa992d976578f78478980555b4b8f6148e8d1a5fe",
-  ]
-}
-
-provider "registry.terraform.io/gavinbunney/kubectl" {
-  version     = "1.19.0"
-  constraints = "~> 1.14"
-  hashes = [
-    "h1:9QkxPjp0x5FZFfJbE+B7hBOoads9gmdfj9aYu5N4Sfc=",
-  ]
-}
-
-provider "registry.terraform.io/goauthentik/authentik" {
-  version     = "2024.12.1"
-  constraints = "~> 2024.10"
-  hashes = [
-    "h1:roBMd+gi+TGgikH/bMzEI8JfvJiMAQWt+8FmokCrQIs=",
-  ]
-}
-
-provider "registry.terraform.io/hashicorp/helm" {
-  version = "3.2.0"
-  hashes = [
-    "h1:CTWVDQxyq1cQJR/9RJSkXii/gz5zMjxszSw9LmptDh4=",
-  ]
-}
-
-provider "registry.terraform.io/hashicorp/kubernetes" {
-  version = "3.2.0"
-  hashes = [
-    "h1:OjMar8kVp0LcDtwgRs877g/K/KPAEDVhFewpE3Tp7l8=",
-  ]
-}
-
-provider "registry.terraform.io/hashicorp/vault" {
-  version     = "4.8.0"
-  constraints = "~> 4.0"
-  hashes = [
-    "h1:GPfhH6dr1LY0foPBDYv9bEGifx7eSwYqFcEAOWOUxLk=",
-    "h1:aHqgWQhDBMeZO9iUKwJYMlh4q+xNMUlMIcjRbF4d02Y=",
-    "zh:269ab13433f67684012ae7e15876532b0312f5d0d2002a9cf9febb1279ce5ea6",
-    "zh:4babc95bf0c40eb85005db1dc2ca403c46be4a71dd3e409db3711a56f7a5ca0e",
-    "zh:78d5eefdd9e494defcb3c68d282b8f96630502cac21d1ea161f53cfe9bb483b3",
-    "zh:86e27c1c625ecc24446a11eeffc3ac319b36c2b4e51251db8579256a0dbcf136",
-    "zh:a32f31da94824009e26b077374440b52098aecb93c92ff55dc3d31dd37c4ea25",
-    "zh:be0a18c6c0425518bab4fbffd82078b82036a88503b5d76064de551c9f646cbf",
-    "zh:be5a77fdfd36863ebeec79cd12b1d13322ffad6821d157a0b279789fa06b5937",
-    "zh:be8317d142a3caad74c7d936039ae27076a1b2b8312ef5208e2871a5f525977c",
-    "zh:c94a84895a3d9954b80e983eed4603330a5cdbbd8eef5b3c99278c2d1402ef3c",
-    "zh:de1fb712784dd8415f011ca5346a34f87fab6046c730557615247e511dbc7d98",
-    "zh:e3eafae7da550f86cae395d6660b2a0e93ec8d2b0e0e5ef982ec762e961fc952",
-    "zh:ff35fb1ab6add288f0f368981e56f780b50405accd1937131cba1137999c8d83",
-  ]
-}
-
-provider "registry.terraform.io/telmate/proxmox" {
-  version     = "3.0.2-rc07"
-  constraints = "3.0.2-rc07"
-  hashes = [
-    "h1:zp5hpQJQ4t4zROSLqdltVpBO+Riy9VugtfFbpyTw1aM=",
-  ]
-}

stacks/onlyoffice/main.tf

@@ -1,278 +0,0 @@
-variable "tls_secret_name" {
-  type      = string
-  sensitive = true
-}
-variable "nfs_server" { type = string }
-variable "redis_host" { type = string }
-variable "mysql_host" { type = string }
-
-resource "kubernetes_namespace" "onlyoffice" {
-  metadata {
-    name = "onlyoffice"
-    labels = {
-      "istio-injection" : "disabled"
-      tier                                    = local.tiers.edge
-      "resource-governance/custom-limitrange" = "true"
-      "resource-governance/custom-quota"      = "true"
-      "keel.sh/enrolled" = "true"
-    }
-  }
-  lifecycle {
-    # KYVERNO_LIFECYCLE_V1: goldilocks-vpa-auto-mode ClusterPolicy stamps this label on every namespace
-    ignore_changes = [metadata[0].labels["goldilocks.fairwinds.com/vpa-update-mode"]]
-  }
-}
-
-resource "kubernetes_manifest" "external_secret" {
-  field_manager {
-    force_conflicts = true
-  }
-  manifest = {
-    apiVersion = "external-secrets.io/v1"
-    kind       = "ExternalSecret"
-    metadata = {
-      name      = "onlyoffice-secrets"
-      namespace = "onlyoffice"
-    }
-    spec = {
-      refreshInterval = "15m"
-      secretStoreRef = {
-        name = "vault-kv"
-        kind = "ClusterSecretStore"
-      }
-      target = {
-        name = "onlyoffice-secrets"
-      }
-      dataFrom = [{
-        extract = {
-          key = "onlyoffice"
-        }
-      }]
-    }
-  }
-  depends_on = [kubernetes_namespace.onlyoffice]
-}
-
-resource "kubernetes_limit_range" "onlyoffice" {
-  metadata {
-    name      = "onlyoffice-limits"
-    namespace = kubernetes_namespace.onlyoffice.metadata[0].name
-  }
-  spec {
-    limit {
-      type = "Container"
-      default = {
-        memory = "256Mi"
-      }
-      default_request = {
-        cpu    = "25m"
-        memory = "64Mi"
-      }
-      max = {
-        memory = "8Gi"
-      }
-    }
-  }
-}
-
-resource "kubernetes_resource_quota" "onlyoffice" {
-  metadata {
-    name      = "onlyoffice-quota"
-    namespace = kubernetes_namespace.onlyoffice.metadata[0].name
-  }
-  spec {
-    hard = {
-      "requests.cpu"    = "4"
-      "requests.memory" = "4Gi"
-      "limits.memory"   = "16Gi"
-      pods              = "10"
-    }
-  }
-}
-
-module "tls_secret" {
-  source          = "../../modules/kubernetes/setup_tls_secret"
-  namespace       = kubernetes_namespace.onlyoffice.metadata[0].name
-  tls_secret_name = var.tls_secret_name
-}
-
-module "nfs_data_host" {
-  source       = "../../modules/kubernetes/nfs_volume"
-  name         = "onlyoffice-data-host"
-  namespace    = kubernetes_namespace.onlyoffice.metadata[0].name
-  nfs_server   = var.nfs_server
-  nfs_path     = "/srv/nfs/onlyoffice"
-  storage      = "1Gi"
-  access_modes = ["ReadWriteOnce"]
-}
-
-resource "kubernetes_deployment" "onlyoffice-document-server" {
-  metadata {
-    name      = "onlyoffice-document-server"
-    namespace = kubernetes_namespace.onlyoffice.metadata[0].name
-    labels = {
-      app  = "onlyoffice-document-server"
-      tier = local.tiers.edge
-    }
-    annotations = {
-      "reloader.stakater.com/auto" = "true"
-    }
-  }
-  spec {
-    replicas = 1
-    strategy {
-      type = "Recreate"
-    }
-    selector {
-      match_labels = {
-        app = "onlyoffice-document-server"
-      }
-    }
-    template {
-      metadata {
-        labels = {
-          app = "onlyoffice-document-server"
-        }
-        annotations = {
-          "dependency.kyverno.io/wait-for" = "mysql.dbaas:3306,redis-master.redis:6379"
-        }
-      }
-      spec {
-        container {
-          name  = "onlyoffice-document-server"
-          image = "onlyoffice/documentserver:9.3.1"
-          resources {
-            requests = {
-              cpu    = "100m"
-              memory = "1536Mi"
-            }
-            limits = {
-              memory = "1536Mi"
-            }
-          }
-          port {
-            name           = "http"
-            container_port = 80
-            protocol       = "TCP"
-          }
-          env {
-            name  = "DB_TYPE"
-            value = "mariadb"
-          }
-          env {
-            name  = "DB_HOST"
-            value = var.mysql_host
-          }
-          env {
-            name  = "DB_PORT"
-            value = 3306
-          }
-          env {
-            name  = "DB_NAME"
-            value = "onlyoffice"
-          }
-          env {
-            name  = "DB_USER"
-            value = "onlyoffice"
-          }
-          env {
-            name = "DB_PWD"
-            value_from {
-              secret_key_ref {
-                name = "onlyoffice-secrets"
-                key  = "db_password"
-              }
-            }
-          }
-          env {
-            name  = "REDIS_SERVER_HOST"
-            value = var.redis_host
-          }
-          env {
-            name  = "REDIS_SERVER_PORT"
-            value = 6379
-          }
-          env {
-            name = "JWT_SECRET"
-            value_from {
-              secret_key_ref {
-                name = "onlyoffice-secrets"
-                key  = "jwt_token"
-              }
-            }
-          }
-
-          volume_mount {
-            name       = "data"
-            mount_path = "/var/www/onlyoffice/Data"
-          }
-        }
-        volume {
-          name = "data"
-          persistent_volume_claim {
-            claim_name = module.nfs_data_host.claim_name
-          }
-        }
-      }
-    }
-  }
-  lifecycle {
-    ignore_changes = [
-      spec[0].template[0].spec[0].dns_config, # KYVERNO_LIFECYCLE_V1
-      metadata[0].annotations["keel.sh/policy"],
-      metadata[0].annotations["keel.sh/trigger"],
-      metadata[0].annotations["keel.sh/pollSchedule"], # KYVERNO_LIFECYCLE_V2
-      metadata[0].annotations["keel.sh/match-tag"],
-      spec[0].template[0].spec[0].container[0].image, # KEEL_IGNORE_IMAGE — Keel manages tag updates
-      metadata[0].annotations["kubernetes.io/change-cause"],
-      metadata[0].annotations["deployment.kubernetes.io/revision"],
-      spec[0].template[0].metadata[0].annotations["keel.sh/update-time"], # KEEL_LIFECYCLE_V1
-    ]
-  }
-}
-
-resource "kubernetes_service" "onlyoffice" {
-  metadata {
-    name      = "onlyoffice-document-server"
-    namespace = kubernetes_namespace.onlyoffice.metadata[0].name
-    labels = {
-      "app" = "onlyoffice-document-server"
-    }
-  }
-
-  spec {
-    selector = {
-      app = "onlyoffice-document-server"
-    }
-    port {
-      port = "80"
-    }
-  }
-}
-module "ingress" {
-  source = "../../modules/kubernetes/ingress_factory"
-  # Iframe-loaded by Nextcloud with JWT-signed session tokens; OnlyOffice
-  # validates the JWT itself. Authentik forward-auth would 302 the iframe
-  # load if the browser doesn't already have an Authentik cookie, AND
-  # OnlyOffice's server-to-server callback URLs (Nextcloud → OnlyOffice
-  # for save events, etc.) run outside any browser session entirely.
-  # The JWT is the auth gate.
-  # auth = "none": Iframe loaded by Nextcloud with JWT-signed tokens; JWT is the auth gate; forward-auth breaks iframe + server-to-server callbacks.
-  auth            = "none"
-  dns_type        = "proxied"
-  namespace       = kubernetes_namespace.onlyoffice.metadata[0].name
-  name            = "onlyoffice"
-  service_name    = "onlyoffice-document-server"
-  tls_secret_name = var.tls_secret_name
-  extra_annotations = {
-    "gethomepage.dev/enabled"      = "true"
-    "gethomepage.dev/name"         = "OnlyOffice"
-    "gethomepage.dev/description"  = "Document editor"
-    "gethomepage.dev/icon"         = "onlyoffice.png"
-    "gethomepage.dev/group"        = "Other"
-    "gethomepage.dev/pod-selector" = ""
-  }
-}
-
-# CI retrigger 2026-05-16T13:42:57+00:00 — bulk enrollment apply (pipeline #689 killed)
-# CI retrigger v2 2026-05-16T13:46:35+00:00

stacks/onlyoffice/providers.tf

@@ -1,53 +0,0 @@
-# Generated by Terragrunt. Sig: nIlQXj57tbuaRZEa
-terraform {
-  required_providers {
-    vault = {
-      source  = "hashicorp/vault"
-      version = "~> 4.0"
-    }
-    cloudflare = {
-      source  = "cloudflare/cloudflare"
-      version = "~> 4"
-    }
-    authentik = {
-      source  = "goauthentik/authentik"
-      version = "~> 2024.10"
-    }
-    # kubectl (gavinbunney) — workaround for hashicorp/kubernetes
-    # `kubernetes_manifest` panics on Kyverno CRDs. See beads code-e2dp.
-    # Declared for all stacks but only used where opted-in.
-    kubectl = {
-      source  = "gavinbunney/kubectl"
-      version = "~> 1.14"
-    }
-    proxmox = {
-      source  = "telmate/proxmox"
-      version = "3.0.2-rc07"
-    }
-  }
-}
-
-variable "kube_config_path" {
-  type    = string
-  default = "~/.kube/config"
-}
-
-provider "kubernetes" {
-  config_path = var.kube_config_path
-}
-
-provider "helm" {
-  kubernetes = {
-    config_path = var.kube_config_path
-  }
-}
-
-provider "vault" {
-  address          = "https://vault.viktorbarzin.me"
-  skip_child_token = true
-}
-
-provider "kubectl" {
-  config_path      = var.kube_config_path
-  load_config_file = true
-}

stacks/onlyoffice/secrets

@@ -1 +0,0 @@
-../../secrets

stacks/onlyoffice/terragrunt.hcl

@@ -1,13 +0,0 @@
-include "root" {
-  path = find_in_parent_folders()
-}
-
-dependency "platform" {
-  config_path  = "../platform"
-  skip_outputs = true
-}
-
-dependency "vault" {
-  config_path  = "../vault"
-  skip_outputs = true
-}

stacks/portal-stt/main.tf

@@ -336,13 +336,9 @@ resource "kubernetes_service" "portal_stt" {
     name      = "portal-stt"
     namespace = kubernetes_namespace.portal_stt.metadata[0].name
     labels    = local.labels
-    annotations = {
+    # No scrape annotations: the deployed Speaches build 404s /metrics, so the
-      # Speaches exposes Prometheus metrics at /metrics — wire annotation-based
+    # annotation-based scrape only produced a permanently firing
-      # scrape (Ready-endpoint relabeling already filters non-Ready pods).
+    # ScrapeTargetDown. Re-add when the app actually serves Prometheus metrics.
-      "prometheus.io/scrape" = "true"
-      "prometheus.io/path"   = "/metrics"
-      "prometheus.io/port"   = "8000"
-    }
   }
   spec {
     type     = "ClusterIP"

stacks/portal-tts/main.tf

@@ -184,14 +184,9 @@ resource "kubernetes_service" "portal_tts" {
     name      = "portal-tts"
     namespace = kubernetes_namespace.portal_tts.metadata[0].name
     labels    = local.labels
-    annotations = {
+    # No scrape annotations: openai-edge-tts exposes no Prometheus metrics, and
-      # openai-edge-tts has no /metrics; annotation-based scrape kept on a live
+    # scraping a JSON endpoint (/v1/models) fails exposition parsing anyway ->
-      # path so the Service stays in the scrape set (Ready-endpoint relabeling
+    # up=0 -> a permanently firing ScrapeTargetDown.
-      # filters non-Ready pods). /v1/models is the OpenAI model list.
-      "prometheus.io/scrape" = "true"
-      "prometheus.io/path"   = "/v1/models"
-      "prometheus.io/port"   = "8000"
-    }
   }
   spec {
     type     = "ClusterIP"

stacks/postiz/modules/postiz/main.tf

@@ -493,109 +493,3 @@ resource "kubernetes_service" "temporal" {
     }
   }
 }
-
-# ──────────────────────────────────────────────────────────────────────────────
-# Backup CronJob — nightly pg_dump of the bundled postiz-postgresql to NFS.
-#
-# The bundled PostgreSQL StatefulSet uses local-path storage on the K8s node
-# OS disk (chart default), which is NOT covered by Layer 1 (LVM thin
-# snapshots) or Layer 2 (sda file backup) of the 3-2-1 pipeline. A pg_dump
-# CronJob writing to /srv/nfs/postiz-backup/ closes the gap: dumps land on
-# Proxmox host NFS → covered by inotify-driven offsite sync to Synology.
-# Three databases are dumped: postiz (app data), temporal (workflow engine),
-# temporal_visibility (workflow search). Bitnami chart-default credentials
-# are used — same creds the Postiz pod itself uses, scoped to the postiz
-# namespace via ClusterIP-only Services.
-# ──────────────────────────────────────────────────────────────────────────────
-
-module "nfs_backup_host" {
-  source     = "../../../../modules/kubernetes/nfs_volume"
-  name       = "postiz-backup-host"
-  namespace  = kubernetes_namespace.postiz.metadata[0].name
-  nfs_server = "192.168.1.127"
-  nfs_path   = "/srv/nfs/postiz-backup"
-}
-
-resource "kubernetes_cron_job_v1" "postgres_backup" {
-  metadata {
-    name      = "postiz-postgres-backup"
-    namespace = kubernetes_namespace.postiz.metadata[0].name
-    labels    = { app = "postiz", component = "backup" }
-  }
-  spec {
-    schedule                      = "0 3 * * *"
-    concurrency_policy            = "Forbid"
-    successful_jobs_history_limit = 3
-    failed_jobs_history_limit     = 5
-    job_template {
-      metadata {}
-      spec {
-        backoff_limit              = 1
-        ttl_seconds_after_finished = 86400
-        template {
-          metadata {
-            labels = { app = "postiz", component = "backup" }
-          }
-          spec {
-            restart_policy = "OnFailure"
-            container {
-              name = "backup"
-              # Same image/pattern as dbaas/postgresql-backup: official postgres
-              # client tools + apt-installed curl for the Pushgateway push. The
-              # bitnamilegacy/postgresql variant is stripped (no curl/wget/python),
-              # so the metric push silently failed there.
-              image   = "docker.io/library/postgres:16.4-bullseye"
-              command = ["/bin/bash", "-c"]
-              args = [
-                <<-EOT
-                set -uo pipefail
-                apt-get update -qq && apt-get install -yqq curl >/dev/null 2>&1 || true
-                TIMESTAMP=$(date +%Y%m%d_%H%M)
-                BACKUP_DIR=/backup
-                STATUS=0
-                for db in postiz; do
-                  echo "Dumping $db..."
-                  if PGPASSWORD=postiz-password pg_dump -h postiz-postgresql -U postiz \
-                       --format=custom --compress=6 \
-                       --file="$BACKUP_DIR/$db-$TIMESTAMP.dump" \
-                       "$db"; then
-                    echo "  OK: $db ($(du -h "$BACKUP_DIR/$db-$TIMESTAMP.dump" | cut -f1))"
-                  else
-                    echo "  FAIL: $db" >&2
-                    STATUS=1
-                  fi
-                done
-                find "$BACKUP_DIR" -name '*.dump' -mtime +30 -delete 2>/dev/null || true
-                {
-                  echo "backup_last_run_timestamp $(date +%s)"
-                  echo "backup_last_status $STATUS"
-                  [ "$STATUS" -eq 0 ] && echo "backup_last_success_timestamp $(date +%s)"
-                } | curl -sf --connect-timeout 5 --max-time 10 --data-binary @- \
-                  "http://prometheus-prometheus-pushgateway.monitoring:9091/metrics/job/postiz-postgres-backup" || true
-                exit $STATUS
-                EOT
-              ]
-              volume_mount {
-                name       = "backup"
-                mount_path = "/backup"
-              }
-              resources {
-                requests = { cpu = "10m", memory = "64Mi" }
-                limits   = { memory = "256Mi" }
-              }
-            }
-            volume {
-              name = "backup"
-              persistent_volume_claim {
-                claim_name = module.nfs_backup_host.claim_name
-              }
-            }
-          }
-        }
-      }
-    }
-  }
-  lifecycle {
-    ignore_changes = [spec[0].job_template[0].spec[0].template[0].spec[0].dns_config] # KYVERNO_LIFECYCLE_V1
-  }
-}