Import manifests reverse-engineered from live cluster

Captured 2026-07-26 from rpi-master (k3s v1.30.3) and cleaned of runtime
fields. Six apps as per-app kustomizations: vaultwarden, searxng,
home-assistant, nginx, pihole(+unbound), unified-streaming.

Intentional divergences from live state:
- pihole WEBPASSWORD and USP_LICENSE_KEY moved from inline plaintext env
  to secretKeyRef (secrets gitignored; templates in secret.example.yaml)
- HA ingress defaultBackend fixed (pointed at nonexistent service)
- unifiedstreaming-svc kept as ClusterIP (LoadBalancer could never bind
  port 80 behind svclb-traefik)

Validated against the live cluster with kubectl apply --dry-run=server:
no immutable-field conflicts; one-time kubectl replace procedure for the
two env->secretKeyRef migrations documented in README.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

apps/searxng/deployment.yaml

@@ -0,0 +1,78 @@
+# Helm release searxng-1723974683 (chart searxng-1.0.0) in the *default*
+# namespace — the release is still recorded in the cluster, so if you ever
+# `helm upgrade` it, helm and this manifest will fight. Prefer retiring the
+# helm release (helm delete --no-hooks would delete resources; instead just
+# treat this repo as the source of truth and never run helm against it).
+# Names keep the timestamped release suffix because selectors are immutable.
+# NOTE (faithful to live state): TZ value "America/Los Angeles" is missing the
+# underscore — an invalid tzdata name, so searxng falls back to UTC. Kept as-is;
+# fix to America/Los_Angeles when convenient.
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: searxng-1723974683
+  namespace: default
+  labels:
+    app.kubernetes.io/instance: searxng-1723974683
+    app.kubernetes.io/name: searxng
+spec:
+  replicas: 1
+  revisionHistoryLimit: 3
+  selector:
+    matchLabels:
+      app.kubernetes.io/instance: searxng-1723974683
+      app.kubernetes.io/name: searxng
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxSurge: 25%
+      maxUnavailable: 25%
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/instance: searxng-1723974683
+        app.kubernetes.io/name: searxng
+    spec:
+      containers:
+        - name: searxng-1723974683
+          image: searxng/searxng:latest
+          imagePullPolicy: Always
+          env:
+            - name: AUTOCOMPLETE
+              value: google
+            - name: BASE_URL
+              value: http://searxng.wittyoneoff.com/
+            - name: INSTANCE_NAME
+              value: witty-one-off-searxng
+            - name: TZ
+              value: America/Los Angeles
+          ports:
+            - name: http
+              containerPort: 8080
+              protocol: TCP
+          startupProbe:
+            httpGet:
+              path: /healthz
+              port: 8080
+            failureThreshold: 30
+            periodSeconds: 5
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 8080
+            failureThreshold: 3
+            periodSeconds: 10
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: 8080
+            failureThreshold: 3
+            periodSeconds: 10
+          volumeMounts:
+            - name: searxng-config
+              mountPath: /etc/searxng/settings.yml
+              subPath: settings.yml
+      volumes:
+        - name: searxng-config
+          secret:
+            secretName: searxng-1723974683-config

apps/searxng/ingress.yaml

@@ -0,0 +1,33 @@
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: searxng-ingress
+  namespace: default
+spec:
+  ingressClassName: traefik
+  defaultBackend:
+    service:
+      name: searxng-1723974683
+      port:
+        number: 8080
+  rules:
+    - host: searxng.wittyoneoff.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: searxng-1723974683
+                port:
+                  number: 8080
+    - host: origin-searxng.wittyoneoff.com
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: searxng-1723974683
+                port:
+                  number: 8080

apps/searxng/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+# secret.example.yaml is intentionally NOT listed — copy it to secret.yaml
+# (gitignored) and apply manually once per cluster.
+resources:
+  - deployment.yaml
+  - service.yaml
+  - ingress.yaml

apps/searxng/secret.example.yaml

@@ -0,0 +1,14 @@
+# Copy to secret.yaml (gitignored), set a real secret_key, and apply once:
+#   kubectl apply -f secret.yaml
+# The secret already exists in the cluster; this file only documents its shape.
+apiVersion: v1
+kind: Secret
+metadata:
+  name: searxng-1723974683-config
+  namespace: default
+type: Opaque
+stringData:
+  settings.yml: |
+    server:
+      secret_key: CHANGE-ME
+    use_default_settings: true

apps/searxng/service.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: searxng-1723974683
+  namespace: default
+  labels:
+    app.kubernetes.io/instance: searxng-1723974683
+    app.kubernetes.io/name: searxng
+spec:
+  type: ClusterIP
+  selector:
+    app.kubernetes.io/instance: searxng-1723974683
+    app.kubernetes.io/name: searxng
+  ports:
+    - name: http
+      port: 8080
+      targetPort: http
+      protocol: TCP