Import manifests reverse-engineered from live cluster

Captured 2026-07-26 from rpi-master (k3s v1.30.3) and cleaned of runtime
fields. Six apps as per-app kustomizations: vaultwarden, searxng,
home-assistant, nginx, pihole(+unbound), unified-streaming.

Intentional divergences from live state:
- pihole WEBPASSWORD and USP_LICENSE_KEY moved from inline plaintext env
  to secretKeyRef (secrets gitignored; templates in secret.example.yaml)
- HA ingress defaultBackend fixed (pointed at nonexistent service)
- unifiedstreaming-svc kept as ClusterIP (LoadBalancer could never bind
  port 80 behind svclb-traefik)

Validated against the live cluster with kubectl apply --dry-run=server:
no immutable-field conflicts; one-time kubectl replace procedure for the
two env->secretKeyRef migrations documented in README.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/nginx/deployment.yaml

@@ -0,0 +1,59 @@
+# Created via Rancher originally — the workload.user.cattle.io selector label
+# is immutable on the live object; do not change it.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: nginx
+  namespace: nginx
+  labels:
+    workload.user.cattle.io/workloadselector: apps.deployment-nginx-nginx
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      workload.user.cattle.io/workloadselector: apps.deployment-nginx-nginx
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+  template:
+    metadata:
+      labels:
+        workload.user.cattle.io/workloadselector: apps.deployment-nginx-nginx
+    spec:
+      affinity:
+        nodeAffinity:
+          requiredDuringSchedulingIgnoredDuringExecution:
+            nodeSelectorTerms:
+              - matchExpressions:
+                  - key: cpu
+                    operator: In
+                    values:
+                      - arm
+                  - key: controller
+                    operator: NotIn
+                    values:
+                      - "true"
+      containers:
+        - name: nginx
+          image: nginx:latest
+          imagePullPolicy: Always
+          ports:
+            - name: http
+              containerPort: 80
+              protocol: TCP
+          volumeMounts:
+            - name: vol-vnbxq
+              mountPath: /usr/share/nginx/html
+              subPath: www
+            - name: vol-vnbxq
+              mountPath: /etc/nginx/conf
+              subPath: conf
+            - name: vol-vnbxq
+              mountPath: /etc/nginx/conf.d
+              subPath: conf.d
+      volumes:
+        - name: vol-vnbxq
+          persistentVolumeClaim:
+            claimName: nginx

apps/nginx/ingress.yaml

@@ -0,0 +1,28 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: nginx
+  namespace: nginx
+spec:
+  ingressClassName: traefik
+  rules:
+    - host: www.wittyoneoff.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: nginx
+                port:
+                  number: 80
+    - host: www.ramonaajj.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: nginx
+                port:
+                  number: 80

apps/nginx/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - namespace.yaml
+  - storage.yaml
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml

apps/nginx/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: nginx

apps/nginx/service.yaml

@@ -0,0 +1,14 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: nginx
+  namespace: nginx
+spec:
+  type: ClusterIP
+  selector:
+    workload.user.cattle.io/workloadselector: apps.deployment-nginx-nginx
+  ports:
+    - name: http
+      port: 80
+      targetPort: 80
+      protocol: TCP

apps/nginx/storage.yaml

@@ -0,0 +1,35 @@
+# Static site content + nginx config live on GlusterFS:
+#   /mnt/gvolume0/nginx/www     → /usr/share/nginx/html
+#   /mnt/gvolume0/nginx/conf    → /etc/nginx/conf
+#   /mnt/gvolume0/nginx/conf.d  → /etc/nginx/conf.d
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: nginx-gvolume0
+spec:
+  capacity:
+    storage: 50Gi
+  accessModes:
+    - ReadWriteOnce
+    - ReadOnlyMany
+    - ReadWriteMany
+  persistentVolumeReclaimPolicy: Retain
+  volumeMode: Filesystem
+  hostPath:
+    path: /mnt/gvolume0/nginx
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: nginx
+  namespace: nginx
+spec:
+  accessModes:
+    - ReadWriteOnce
+    - ReadOnlyMany
+    - ReadWriteMany
+  resources:
+    requests:
+      storage: 50Gi
+  storageClassName: ""
+  volumeName: nginx-gvolume0