diff --git a/deployments-old/ai/openweb.yaml b/deployments-old/ai/openweb.yaml
deleted file mode 100644
index e2c52ea..0000000
--- a/deployments-old/ai/openweb.yaml
+++ /dev/null
@@ -1,76 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: ai
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: openwebui
-  namespace: ai
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: openwebui
-  template:
-    metadata:
-      labels:
-        app: openwebui
-    spec:
-      containers:
-        - name: openwebui
-          image: ghcr.io/open-webui/open-webui:latest
-          ports:
-            - containerPort: 8080
-          env:
-            - name: OLLAMA_BASE_URL
-              value: http://ollama:11434
-          volumeMounts:
-            - name: ai-storage
-              mountPath: /app/backend/data
-      volumes:
-        - name: ai-storage
-          hostPath:
-            path: /dpool/files/ai/
-            type: Directory
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: openwebui
-  namespace: ai
-spec:
-  selector:
-    app: openwebui
-  ports:
-    - protocol: TCP
-      port: 80
-      targetPort: 8080
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: openwebui
-  namespace: ai
-  annotations:
-    kubernetes.io/ingress.class: "traefik" 
-    external-dns.alpha.kubernetes.io/hostname: nc.hxme.net
-spec:
-  rules:
-    - host: ai.hxme.net
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: openwebui
-                port:
-                  number: 80
-  tls:
-    - hosts:
-        - ai.hxme.net
-      secretName: openwebui-tls
-
diff --git a/deployments-old/auth/authentik.yaml b/deployments-old/auth/authentik.yaml
deleted file mode 100644
index ced40ed..0000000
--- a/deployments-old/auth/authentik.yaml
+++ /dev/null
@@ -1,54 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: authentik
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: authentik
-  namespace: flux-system
-spec:
-  url: https://charts.goauthentik.io/
-  interval: 1h
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: wildcard-hxme-net
-  namespace: authentik
-  annotations:
-    replicator.v1.mittwald.de/replicate-from: cert-manager/wildcard-hxme-net
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: authentik
-  namespace: authentik
-spec:
-  interval: 30m
-  chart:
-    spec:
-      chart: authentik
-      version: 2024.4.2
-      sourceRef:
-        kind: HelmRepository
-        name: authentik
-        namespace: flux-system
-  install:
-    createNamespace: true
-  upgrade:
-    disableWait: false
-  timeout: 10m
-  valuesFrom:
-    - kind: Secret
-      name: authentik-values
-  values:
-    ingress:
-      annotations:
-        external-dns.alpha.kubernetes.io/hostname: auth.hxme.net
-      tls:
-        - secretName: wildcard-hxme-net
-          hosts:
-            - auth.hxme.net
diff --git a/deployments-old/dns/bind.yaml b/deployments-old/dns/bind.yaml
deleted file mode 100644
index 23eab06..0000000
--- a/deployments-old/dns/bind.yaml
+++ /dev/null
@@ -1,138 +0,0 @@
----
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: bind-master-config
-  namespace: dns
-data:
-  named.conf: |
-    include "/etc/bind/externaldns-key.conf";
-
-    options {
-        directory "/var/cache/bind";
-
-        recursion yes;
-        allow-query { any; };
-
-        listen-on port 53 { any; };
-        listen-on-v6 port 53 { any; };
-
-        forwarders {
-            10.40.0.254;
-        };
-
-        dnssec-validation auto;
-    };
-
-    zone "." IN {
-        type hint;
-        file "/usr/share/dns/root.hints";
-    };
-
-    zone "hxme.net." IN {
-      type master;
-      file "/etc/bind/db.hxme.net";
-      allow-update { key "externaldns-key"; };
-    };
-  db.hxme.net: |
-    $TTL    3600
-    @       IN      SOA     ns1.hxme.net. admin.hxme.net. (
-                            1         ; Serial
-                            7200      ; Refresh
-                            1800      ; Retry
-                            1209600   ; Expire
-                            86400 )   ; Negative Cache TTL
-    ;
-    @       IN      NS      ns1.hxme.net.
-    ns1     IN      A       10.40.0.110
-    @       IN      A       10.40.0.110
-    www     IN      A       10.40.0.110
----
-apiVersion: apps/v1
-kind: DaemonSet
-metadata:
-  name: bind-master
-  namespace: dns
-spec:
-  selector:
-    matchLabels:
-      app: bind-master
-  template:
-    metadata:
-      labels:
-        app: bind-master
-    spec:
-      hostNetwork: true
-      dnsPolicy: ClusterFirstWithHostNet
-      securityContext:
-        fsGroup: 999
-      initContainers:
-        - name: fetch-root-hints
-          image: debian:12
-          command:
-            - sh
-            - -c
-            - |
-              apt update && apt -y install curl
-              curl -sfSL https://www.internic.net/domain/named.cache -o /usr/share/dns/root.hints
-          volumeMounts:
-            - mountPath: /usr/share/dns
-              name: root-hints
-      containers:
-        - name: bind-master
-          image: internetsystemsconsortium/bind9:9.18
-          command: ["named", "-g", "-c", "/etc/bind/named.conf"]
-          ports:
-            - containerPort: 53
-              protocol: UDP
-            - containerPort: 53
-              protocol: TCP
-          volumeMounts:
-            - name: config
-              mountPath: /etc/bind/named.conf
-              subPath: named.conf
-            - name: config
-              mountPath: /etc/bind/db.hxme.net
-              subPath: db.hxme.net
-            - name: dns-secrets
-              mountPath: /etc/bind/externaldns-key.conf
-              subPath: externaldns-key.conf
-            - name: bind-cache
-              mountPath: /var/cache/bind
-            - name: bind-rundir
-              mountPath: /var/run/named
-            - name: root-hints
-              mountPath: /usr/share/dns
-      volumes:
-        - name: dns-secrets
-          secret:
-            secretName: dns-secrets
-        - name: config
-          configMap:
-            name: bind-master-config
-        - name: bind-cache
-          emptyDir: {}
-        - name: bind-rundir
-          emptyDir: {}
-        - name: root-hints
-          emptyDir: {}
-
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: bind-master
-  namespace: dns
-spec:
-  selector:
-    app: bind-master
-  ports:
-    - name: dns-udp
-      port: 53
-      protocol: UDP
-      targetPort: 53
-    - name: dns-tcp
-      port: 53
-      protocol: TCP
-      targetPort: 53
-
diff --git a/deployments-old/dns/externaldns.yaml b/deployments-old/dns/externaldns.yaml
deleted file mode 100644
index ed64c21..0000000
--- a/deployments-old/dns/externaldns.yaml
+++ /dev/null
@@ -1,75 +0,0 @@
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: external-dns
-rules:
-  - apiGroups: [""]
-    resources: ["services","endpoints","pods"]
-    verbs: ["get","watch","list"]
-  - apiGroups: ["extensions","networking.k8s.io"]
-    resources: ["ingresses"]
-    verbs: ["get","watch","list"]
-  - apiGroups: [""]
-    resources: ["nodes"]
-    verbs: ["list","watch"]
-  # Add DNS provider specific rules here if needed (e.g., for AWS IAM, GCP etc.)
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: external-dns-viewer
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: external-dns
-subjects:
-  - kind: ServiceAccount
-    name: external-dns
-    namespace: dns
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: external-dns
-  namespace: dns
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: external-dns
-  namespace: dns
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: external-dns
-  template:
-    metadata:
-      labels:
-        app: external-dns
-    spec:
-      serviceAccountName: external-dns
-      containers:
-      - name: external-dns
-        image: bitnami/external-dns:latest
-        args:
-          - --source=service
-          - --source=ingress
-          - --provider=rfc2136
-          - --rfc2136-host=bind-master.dns.svc.cluster.local
-          - --rfc2136-port=53
-          - --rfc2136-zone=hxme.net
-          - --rfc2136-tsig-secret=$(RFC2136_TSIG_SECRET)
-          - --rfc2136-tsig-secret-alg=hmac-sha256
-          - --rfc2136-tsig-keyname=externaldns-key
-          - --policy=sync
-          - --registry=txt
-          - --txt-owner-id=my-cluster
-        env:
-            - name: RFC2136_TSIG_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: dns-secrets
-                  key: externaldns-secret
-
diff --git a/deployments-old/dns/namespace.yaml b/deployments-old/dns/namespace.yaml
deleted file mode 100644
index 52c7228..0000000
--- a/deployments-old/dns/namespace.yaml
+++ /dev/null
@@ -1,5 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: dns
diff --git a/deployments-old/files/nextcloud.yaml b/deployments-old/files/nextcloud.yaml
deleted file mode 100644
index 2ef2de0..0000000
--- a/deployments-old/files/nextcloud.yaml
+++ /dev/null
@@ -1,142 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: nextcloud
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: nextcloud-pv
-spec:
-  capacity:
-    storage: 10Gi
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  storageClassName: local-path
-  hostPath:
-    path: /dpool/temp/Nextcloud
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: nextcloud-pvc
-  namespace: nextcloud
-spec:
-  accessModes:
-    - ReadWriteOnce
-  storageClassName: local-path 
-  resources:
-    requests:
-      storage: 10Gi
-  volumeName: nextcloud-pv
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: nextcloud
-  namespace: nextcloud
-spec:
-  ports:
-    - port: 80
-  selector:
-    app: nextcloud
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: nextcloud
-  namespace: nextcloud
-spec:
-  securityContext:
-    runAsUser:  1000
-    runAsGroup: 1000
-    fsGroup:    1000
-  selector:
-    matchLabels:
-      app: nextcloud
-  template:
-    metadata:
-      labels:
-        app: nextcloud
-    spec:
-      containers:
-        - name: nextcloud
-          image: nextcloud:29
-          env:
-            - name: MYSQL_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: nextcloud-secrets
-                  key: MYSQL_PASSWORD
-            - name: MYSQL_DATABASE
-              value: nextcloud
-            - name: MYSQL_USER
-              value: nextcloud
-            - name: MYSQL_HOST
-              value: mariadb
-          ports:
-            - containerPort: 80
-          volumeMounts:
-            - name: nextcloud-data
-              mountPath: /var/www/html
-          securityContext:
-            runAsUser:  1000
-            runAsGroup: 1000
-            fsGroup:    1000
-      volumes:
-        - name: nextcloud-data
-          persistentVolumeClaim:
-            claimName: nextcloud-pvc
----
-apiVersion: k8s.mariadb.com/v1alpha1
-kind: MariaDB
-metadata:
-  name: nextcloud-db
-  namespace: nextcloud
-spec:
-  rootPasswordSecretKeyRef:
-    name: nextcloud-secrets
-    key: MYSQL_ROOT_PASSWORD
-  database: nextcloud
-  username: nextcloud
-  passwordSecretKeyRef:
-    name: nextcloud-secrets
-    key: MYSQL_PASSWORD
-  image: mariadb:10.11
-  storage:
-    size: 5Gi
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: wildcard-hxme-net
-  namespace: nextcloud
-  annotations:
-    replicator.v1.mittwald.de/replicate-from: cert-manager/wildcard-hxme-net
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: nextcloud
-  namespace: nextcloud
-  annotations:
-    external-dns.alpha.kubernetes.io/hostname: nc.hxme.net
-spec:
-  tls:
-    - hosts:
-        - nc.hxme.net
-      secretName: wildcard-hxme-net
-  rules:
-    - host: nc.hxme.net
-      http:
-        paths:
-          - path: /
-            pathType: Prefix
-            backend:
-              service:
-                name: nextcloud
-                port:
-                  number: 80
-
diff --git a/deployments-old/files/syncthing.yaml b/deployments-old/files/syncthing.yaml
deleted file mode 100644
index a7279b2..0000000
--- a/deployments-old/files/syncthing.yaml
+++ /dev/null
@@ -1,109 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: syncthing
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: syncthing-data
-  namespace: syncthing
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 5Gi
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: syncthing-share-pv
-spec:
-  capacity:
-    storage: 1000Gi
-  accessModes:
-    - ReadWriteOnce
-  persistentVolumeReclaimPolicy: Retain
-  hostPath:
-    path: /dpool/files
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: syncthing-share
-  namespace: syncthing
-spec:
-  accessModes:
-    - ReadWriteOnce
-  resources:
-    requests:
-      storage: 1000Gi
-  volumeName: syncthing-share-pv
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: syncthing
-  namespace: syncthing
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: syncthing
-  template:
-    metadata:
-      labels:
-        app: syncthing
-    spec:
-      containers:
-        - name: syncthing
-          image: syncthing/syncthing:latest
-          ports:
-            - containerPort: 8384 
-            - containerPort: 22000
-            - containerPort: 21027
-              protocol: UDP
-          volumeMounts:
-            - name: syncthing-data
-              mountPath: /var/syncthing
-            - name: syncthing-share
-              mountPath: /shared 
-          securityContext:
-            runAsUser:  1000
-            runAsGroup: 1000
-            fsGroup:    1000
-      volumes:
-        - name: syncthing-data
-          persistentVolumeClaim:
-            claimName: syncthing-data
-        - name: syncthing-share
-          persistentVolumeClaim:
-            claimName: syncthing-share
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: syncthing
-  namespace: syncthing
-spec:
-  selector:
-    app: syncthing
-  ports:
-    - name: web-ui
-      port: 8384
-      targetPort: 8384
-    - name: sync-tcp
-      port: 22000
-      targetPort: 22000
-    - name: sync-udp
-      port: 22000
-      protocol: UDP
-      targetPort: 22000
-    - name: discovery
-      port: 21027
-      protocol: UDP
-      targetPort: 21027
-  type: ClusterIP
-
diff --git a/deployments-old/kustomization.yaml b/deployments-old/kustomization.yaml
deleted file mode 100644
index 04b8189..0000000
--- a/deployments-old/kustomization.yaml
+++ /dev/null
@@ -1,17 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind:       Kustomization
-
-resources:
-  - monitoring/provider.yaml
-  - monitoring/grafana.yaml
-  - monitoring/loki.yaml
-  - monitoring/prometheus.yaml
-  - operators/mariadb.yaml
-  - operators/replicator.yaml
-  - dns/namespace.yaml
-  - dns/bind.yaml
-  - dns/externaldns.yaml
-  - ssl/certmanager.yaml
-  - auth/authentik.yaml
-  - files/nextcloud.yaml
-  - files/syncthing.yaml
diff --git a/deployments-old/monitoring/grafana.yaml b/deployments-old/monitoring/grafana.yaml
deleted file mode 100644
index 47ed5e0..0000000
--- a/deployments-old/monitoring/grafana.yaml
+++ /dev/null
@@ -1,37 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: grafana
-  namespace: monitoring
-spec:
-  interval: 30m
-  chart:
-    spec:
-      chart: grafana
-      version: 7.3.0
-      sourceRef:
-        kind: HelmRepository
-        name: grafana
-        namespace: flux-system
-  install:
-    createNamespace: true
-  values:
-    admin:
-      existingSecret: grafana-admin-secret
-      userKey: admin-user
-      passwordKey: admin-password
-    service:
-      type: LoadBalancer
-      annotations:
-        external-dns.alpha.kubernetes.io/hostname: "grafana.hxme.net"
-    datasources:
-      datasources.yaml:
-        apiVersion: 1
-        datasources:
-          - name: Loki
-            type: loki
-            access: proxy
-            url: http://loki:3100
-            isDefault: true
-
diff --git a/deployments-old/monitoring/loki.yaml b/deployments-old/monitoring/loki.yaml
deleted file mode 100644
index b327a8e..0000000
--- a/deployments-old/monitoring/loki.yaml
+++ /dev/null
@@ -1,33 +0,0 @@
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: loki
-  namespace: monitoring
-spec:
-  interval: 30m
-  chart:
-    spec:
-      chart: loki
-      version: 6.6.4
-      sourceRef:
-        kind: HelmRepository
-        name: grafana
-        namespace: flux-system
-  install:
-    createNamespace: true
-  values:
-    loki:
-      auth_enabled: false
-    singleBinary:
-      replicas: 1
-      service:
-        type: LoadBalancer
-        annotations:
-          external-dns.alpha.kubernetes.io/hostname: "loki.hxme.net"
-    write:
-      replicas: 1
-    read:
-      replicas: 1
-    backend:
-      replicas: 1
diff --git a/deployments-old/monitoring/prometheus.yaml b/deployments-old/monitoring/prometheus.yaml
deleted file mode 100644
index dd4d5a6..0000000
--- a/deployments-old/monitoring/prometheus.yaml
+++ /dev/null
@@ -1,40 +0,0 @@
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: prometheus-community
-  namespace: flux-system
-spec:
-  url: https://prometheus-community.github.io/helm-charts
-  interval: 1h
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: prometheus-operator
-  namespace: monitoring
-spec:
-  interval: 30m
-  chart:
-    spec:
-      chart: kube-prometheus-stack
-      version: 58.1.2
-      sourceRef:
-        kind: HelmRepository
-        name: prometheus-community
-        namespace: flux-system
-  install:
-    createNamespace: true
-  upgrade:
-    disableWait: true
-  timeout: 5m
-  values:
-    prometheus:
-      prometheusSpec:
-        serviceMonitorSelectorNilUsesHelmValues: false
-    # Optional: expose Prometheus/Grafana via NodePort, Ingress, etc.
-    grafana:
-      enabled: false
-    alertmanager:
-      enabled: true
-
diff --git a/deployments-old/monitoring/provider.yaml b/deployments-old/monitoring/provider.yaml
deleted file mode 100644
index 3af442a..0000000
--- a/deployments-old/monitoring/provider.yaml
+++ /dev/null
@@ -1,22 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: monitoring
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: grafana
-  namespace: flux-system
-spec:
-  url: https://grafana.github.io/helm-charts
-  interval: 1h
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: wildcard-hxme-net
-  namespace: monitoring
-  annotations:
-    replicator.v1.mittwald.de/replicate-from: cert-manager/wildcard-hxme-net
diff --git a/deployments-old/operators/mariadb.yaml b/deployments-old/operators/mariadb.yaml
deleted file mode 100644
index 04febe6..0000000
--- a/deployments-old/operators/mariadb.yaml
+++ /dev/null
@@ -1,60 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: mariadb-system
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: mariadb-operator
-  namespace: flux-system
-spec:
-  url: https://helm.mariadb.com/mariadb-operator
-  interval: 1h
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: mariadb-operator-crds
-  namespace: mariadb-system
-spec:
-  interval: 30m
-  chart:
-    spec:
-      chart: mariadb-operator-crds
-      version: 0.38.1
-      sourceRef:
-        kind: HelmRepository
-        name: mariadb-operator
-        namespace: flux-system
-  install:
-    createNamespace: true
-  upgrade:
-    disableWait: true
-  timeout: 5m
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: mariadb-operator
-  namespace: mariadb-system
-spec:
-  interval: 30m
-  chart:
-    spec:
-      chart: mariadb-operator
-      version: 0.38.1
-      sourceRef:
-        kind: HelmRepository
-        name: mariadb-operator
-        namespace: flux-system
-  install:
-    createNamespace: true
-  dependsOn:
-    - name: mariadb-operator-crds
-      namespace: mariadb-system
-  values:
-    metrics:
-      enabled: true
-
diff --git a/deployments-old/operators/replicator.yaml b/deployments-old/operators/replicator.yaml
deleted file mode 100644
index e8ec276..0000000
--- a/deployments-old/operators/replicator.yaml
+++ /dev/null
@@ -1,98 +0,0 @@
----
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: kubernetes-replicator
-  namespace: kube-system
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: kubernetes-replicator
-rules:
-  - apiGroups: ["", "apps", "extensions"]
-    resources:
-      - secrets
-      - configmaps
-      - roles
-      - rolebindings
-      - cronjobs
-      - deployments
-      - events
-      - ingresses
-      - jobs
-      - pods
-      - pods/attach
-      - pods/exec
-      - pods/log
-      - pods/portforward
-      - services
-      - namespaces
-      - serviceaccounts
-    verbs: ["*"]
-  - apiGroups: ["batch"]
-    resources:
-      - configmaps
-      - cronjobs
-      - deployments
-      - events
-      - ingresses
-      - jobs
-      - pods
-      - pods/attach
-      - pods/exec
-      - pods/log
-      - pods/portforward
-      - services
-    verbs: ["*"]
-  - apiGroups: ["rbac.authorization.k8s.io"]
-    resources:
-      - roles
-      - rolebindings
-      - clusterrolebindings
-    verbs: ["get", "list", "watch"]
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: kubernetes-replicator
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: kubernetes-replicator
-subjects:
-  - kind: ServiceAccount
-    name: kubernetes-replicator
-    namespace: kube-system
----
-apiVersion: source.toolkit.fluxcd.io/v1beta2
-kind: HelmRepository
-metadata:
-  name: mittwald
-  namespace: flux-system
-spec:
-  url: https://helm.mittwald.de
-  interval: 1h
----
-apiVersion: helm.toolkit.fluxcd.io/v2beta1
-kind: HelmRelease
-metadata:
-  name: kubernetes-replicator
-  namespace: kube-system
-spec:
-  interval: 5m
-  chart:
-    spec:
-      chart: kubernetes-replicator
-      sourceRef:
-        kind: HelmRepository
-        name: mittwald
-        namespace: flux-system
-  install:
-    createNamespace: false
-  upgrade:
-    disableWait: false
-  values:
-    serviceAccount:
-      create: false
-      name: kubernetes-replicator
diff --git a/deployments-old/remote-access/rustdesk.yaml b/deployments-old/remote-access/rustdesk.yaml
deleted file mode 100644
index 47ec81d..0000000
--- a/deployments-old/remote-access/rustdesk.yaml
+++ /dev/null
@@ -1,77 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: rustdesk
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: rustdesk-charts
-  namespace: flux-system
-spec:
-  url: https://charts.rustdesk.com
-  interval: 1h
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: rustdesk-server
-  namespace: rustdesk
-spec:
-  interval: 30m
-  chart:
-    spec:
-      chart: rustdesk-server
-      version: 0.5.0
-      sourceRef:
-        kind: HelmRepository
-        name: rustdesk-charts
-        namespace: flux-system
-  install:
-    createNamespace: true
-  values:
-    hbbs:
-      enabled: true
-      service:
-        type: ClusterIP
-        ports:
-          - name: tcp
-            port: 21115
-            targetPort: 21115
-          - name: tcp-hbbs
-            port: 21116
-            targetPort: 21116
-          - name: udp
-            port: 21116
-            targetPort: 21116
-            protocol: UDP
-
-    hbbr:
-      enabled: true
-      service:
-        type: ClusterIP
-        ports:
-          - name: tcp-hbbr
-            port: 21117
-            targetPort: 21117
-
-    ingress:
-      enabled: true
-      className: "traefik" # or nginx or your ingress class
-      annotations: {}
-      hosts:
-        - host: rd.hxme.net
-          paths:
-            - path: /
-              pathType: Prefix
-      tls:
-        - hosts:
-            - rd.hxme.net
-          secretName: rustdesk-tls
-
-    # Optional admin password – change this in production
-    env:
-      ENCRYPTED_ONLY: "false"
-      ENABLE_LOG: "true"
-
diff --git a/deployments-old/ssl/certmanager.yaml b/deployments-old/ssl/certmanager.yaml
deleted file mode 100644
index f238e14..0000000
--- a/deployments-old/ssl/certmanager.yaml
+++ /dev/null
@@ -1,72 +0,0 @@
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: jetstack
-  namespace: flux-system
-spec:
-  url: https://charts.jetstack.io
-  interval: 1h
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: cert-manager
-  namespace: cert-manager
-spec:
-  interval: 30m
-  chart:
-    spec:
-      chart: cert-manager
-      version: v1.18.2
-      sourceRef:
-        kind: HelmRepository
-        name: jetstack
-        namespace: flux-system
-  install:
-    crds: CreateReplace
-    createNamespace: true
-  values:
-    installCRDs: true
-    extraArgs:
-      - --dns01-recursive-nameservers-only
-      - --dns01-recursive-nameservers=8.8.8.8:53,1.1.1.1:53
----
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: letsencrypt-rfc2136
-spec:
-  acme:
-    email: admin@hxme.net
-    server: https://acme-v02.api.letsencrypt.org/directory
-    privateKeySecretRef:
-      name: letsencrypt-rfc2136
-    solvers:
-    - dns01:
-        rfc2136:
-          nameserver: hawke.hxst.com.au:53
-          tsigKeyName: "hxme-update-key"
-          tsigAlgorithm: HMACSHA512
-          tsigSecretSecretRef:
-            name: hxme-update-key
-            key:  hxme-update-key
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: wildcard-hxme-net
-  namespace: cert-manager
-spec:
-  secretName: wildcard-hxme-net
-  secretTemplate:
-    annotations:
-      replicator.v1.mittwald.de/replication-allowed: "true"
-      replicator.v1.mittwald.de/replicate-to: "monitoring,authentik,nextcloud"
-  issuerRef:
-    name: letsencrypt-rfc2136
-    kind: ClusterIssuer
-  commonName: "hxme.net"
-  dnsNames:
-    - "hxme.net"
-    - "*.hxme.net"
diff --git a/deployments-old/synctools/vaultwarden.yaml b/deployments-old/synctools/vaultwarden.yaml
deleted file mode 100644
index 93c3475..0000000
--- a/deployments-old/synctools/vaultwarden.yaml
+++ /dev/null
@@ -1,79 +0,0 @@
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: bitwarden
----
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: bjw-s-charts
-  namespace: flux-system
-spec:
-  url: https://bjw-s.github.io/helm-charts/
-  interval: 1h
----
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: vaultwarden
-  namespace: bitwarden
-spec:
-  interval: 30m
-  chart:
-    spec:
-      chart: app-template
-      version: 2.4.0
-      sourceRef:
-        kind: HelmRepository
-        name: bjw-s-charts
-        namespace: flux-system
-  install:
-    createNamespace: true
-  values:
-    # Basic container config
-    image:
-      repository: vaultwarden/server
-      tag: 1.30.5
-      pullPolicy: IfNotPresent
-
-    env:
-      WEBSOCKET_ENABLED: "true"
-      SIGNUPS_ALLOWED: "false"
-      DOMAIN: "https://vw.hxme.net"
-      ADMIN_TOKEN: "CHANGEME_SUPER_SECRET"
-
-    service:
-      main:
-        ports:
-          http:
-            port: 80
-
-    ingress:
-      main:
-        enabled: true
-        annotations:
-          kubernetes.io/ingress.class: "traefik" # Or nginx or your ingress class
-        hosts:
-          - host: vw.hxme.net
-            paths:
-              - path: /
-                pathType: Prefix
-        tls:
-          - hosts:
-              - vw.hxme.net
-            secretName: bitwarden-tls
-
-    persistence:
-      data:
-        enabled: true
-        existingClaim: bitwarden-data # You must create a PVC or a StorageClass dynamic claim
-
-    resources:
-      requests:
-        cpu: 50m
-        memory: 128Mi
-      limits:
-        cpu: 250m
-        memory: 512Mi
-
diff --git a/deployments/home-server/dovecot.yaml b/deployments/home-server/dovecot.yaml
index facd31c..0f49048 100644
--- a/deployments/home-server/dovecot.yaml
+++ b/deployments/home-server/dovecot.yaml
@@ -39,14 +39,6 @@ data:
         ssl = yes
       }
     }
-  ldap.conf: |
-    hosts = ldap://auth.hxme.net
-    auth_bind = yes
-    base = dc=ldap,dc=goauthentik,dc=io
-    dn = cn=binduser,ou=service-accounts,dc=ldap,dc=goauthentik,dc=io
-    dnpass = FtaJpthRpKyhEEy69H5qxPymtSeSeuCT9SQCdXmWDeAe7cgTCnk6HXpSzTNS
-    user_attrs = =home=/data/%u
-    user_filter = (&(objectClass=person)(uid=%u))
 
 ---
 apiVersion: apps/v1
@@ -73,6 +65,10 @@ spec:
           volumeMounts:
             - name: config
               mountPath: /config/
+            - name: ldap-config
+              mountPath: /config/ldap.conf
+              subPath: ldap.conf
+              readOnly: true
             - name: certs
               mountPath: /etc/ssl/hxme
               readOnly: true
@@ -81,8 +77,8 @@ spec:
           configMap:
             name: dovecot-config
         - name: ldap
-          configMap:
-            name: dovecot-ldap
+          secret:
+            secretName: dovecot-ldap
         - name: tls
           secret:
             secretName: wildcard-hxme-net
diff --git a/deployments/home-server/samba.yaml b/deployments/home-server/samba.yaml
deleted file mode 100644
index e409445..0000000
--- a/deployments/home-server/samba.yaml
+++ /dev/null
@@ -1,94 +0,0 @@
----
-apiVersion: v1
-kind: PersistentVolume
-metadata:
-  name: smb-share-pv
-spec:
-  capacity:
-    storage: 10Gi
-  accessModes:
-    - ReadWriteMany
-  storageClassName: local-path
-  persistentVolumeReclaimPolicy: Retain
-  hostPath:
-    path: /dpool/
----
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: smb-share-pvc
-  namespace: home-server
-spec:
-  accessModes:
-    - ReadWriteMany
-  storageClassName: local-path
-  resources:
-    requests:
-      storage: 10Gi
-  volumeName: smb-share-pv
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: smb-server
-  namespace: home-server
-spec:
-  selector:
-    app: smb-server
-  ports:
-    - name: smb
-      port: 445
-      targetPort: 445
-    - name: netbios
-      port: 139
-      targetPort: 139
-  type: NodePort # Use ClusterIP or LoadBalancer depending on access requirements
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: smb-server
-  namespace: home-server
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: smb-server
-  template:
-    metadata:
-      labels:
-        app: smb-server
-    spec:
-      containers:
-        - name: samba
-          image: dperson/samba
-          env:
-            - name: SMB_USER
-              valueFrom:
-                secretKeyRef:
-                  name: smb-credentials
-                  key: username
-            - name: SMB_PASS
-              valueFrom:
-                secretKeyRef:
-                  name: smb-credentials
-                  key: password
-          args:
-            - -u
-            - "$(SMB_USER);$(SMB_PASS)"
-            - -s
-            - "share;/mount;yes;no;no;$(SMB_USER)"
-          ports:
-            - containerPort: 139
-            - containerPort: 445
-          securityContext:
-            capabilities:
-              add: ["NET_ADMIN"]
-          volumeMounts:
-            - name: share
-              mountPath: /mount
-      volumes:
-        - name: share
-          persistentVolumeClaim:
-            claimName: smb-share-pvc
-