Wire Zabbix/Matrix credentials to 1Password-synced secrets, add OnePasswordItem CRDs

- Zabbix: Remove hardcoded zabbix-db-secret and zabbix-admin-secret, reference
  zabbix-credentials (1Password) for DB-User, DB-Password, and admin password
- Matrix: Remove hardcoded matrix-db-secret, reference matrix-credentials for
  Postgres user/password. Convert ConfigMap homeserver.yaml to template with
  __DB_PASSWORD__/__DB_USER__ placeholders, inject via busybox init container
- Guacamole: Add OnePasswordItem CRD for future use. MySQL DB creds remain in
  guac-db-secret (1Password item lacks DB-specific fields — gap documented)
- All three services now include OnePasswordItem CRD manifests for ArgoCD mgmt

apps/zabbix/zabbix.yaml

@@ -1,320 +1,315 @@
-# Zabbix 7.2 Monitoring Stack
-# PostgreSQL 16 + Zabbix Server + Zabbix Web (nginx)
-# ArgoCD managed - BlueJay Lab
----
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: zabbix
-  labels:
-    app.kubernetes.io/part-of: bluejay-infra
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: zabbix-db-secret
-  namespace: zabbix
-type: Opaque
-stringData:
-  POSTGRES_USER: zabbix
-  POSTGRES_PASSWORD: BlueJay-ZabbixDB-2026
-  POSTGRES_DB: zabbix
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: zabbix-admin-secret
-  namespace: zabbix
-type: Opaque
-stringData:
-  ZBX_ADMIN_PASSWORD: BlueJay-NOC-2026
----
-# PostgreSQL 16 StatefulSet
-apiVersion: apps/v1
-kind: StatefulSet
-metadata:
-  name: zabbix-postgres
-  namespace: zabbix
-  labels:
-    app: zabbix-postgres
-spec:
-  serviceName: zabbix-postgres
-  replicas: 1
-  selector:
-    matchLabels:
-      app: zabbix-postgres
-  template:
-    metadata:
-      labels:
-        app: zabbix-postgres
-    spec:
-      containers:
-        - name: postgres
-          image: postgres:16-alpine
-          ports:
-            - containerPort: 5432
-              name: postgres
-          envFrom:
-            - secretRef:
-                name: zabbix-db-secret
-          volumeMounts:
-            - name: zabbix-postgres-data
-              mountPath: /var/lib/postgresql/data
-              subPath: pgdata
-          resources:
-            requests:
-              memory: 256Mi
-              cpu: 100m
-            limits:
-              memory: 512Mi
-              cpu: 500m
-          livenessProbe:
-            exec:
-              command:
-                - pg_isready
-                - -U
-                - zabbix
-            initialDelaySeconds: 30
-            periodSeconds: 10
-          readinessProbe:
-            exec:
-              command:
-                - pg_isready
-                - -U
-                - zabbix
-            initialDelaySeconds: 5
-            periodSeconds: 5
-  volumeClaimTemplates:
-    - metadata:
-        name: zabbix-postgres-data
-      spec:
-        accessModes: [ReadWriteOnce]
-        resources:
-          requests:
-            storage: 10Gi
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: zabbix-postgres
-  namespace: zabbix
-spec:
-  selector:
-    app: zabbix-postgres
-  ports:
-    - port: 5432
-      targetPort: 5432
-      name: postgres
-  clusterIP: None
----
-# Zabbix Server
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: zabbix-server
-  namespace: zabbix
-  labels:
-    app: zabbix-server
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: zabbix-server
-  template:
-    metadata:
-      labels:
-        app: zabbix-server
-    spec:
-      containers:
-        - name: zabbix-server
-          image: zabbix/zabbix-server-pgsql:7.2-alpine-latest
-          ports:
-            - containerPort: 10051
-              name: trapper
-          env:
-            - name: DB_SERVER_HOST
-              value: zabbix-postgres
-            - name: DB_SERVER_PORT
-              value: "5432"
-            - name: POSTGRES_USER
-              valueFrom:
-                secretKeyRef:
-                  name: zabbix-db-secret
-                  key: POSTGRES_USER
-            - name: POSTGRES_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: zabbix-db-secret
-                  key: POSTGRES_PASSWORD
-            - name: POSTGRES_DB
-              valueFrom:
-                secretKeyRef:
-                  name: zabbix-db-secret
-                  key: POSTGRES_DB
-          resources:
-            requests:
-              memory: 256Mi
-              cpu: 100m
-            limits:
-              memory: 1Gi
-              cpu: "1"
-          livenessProbe:
-            tcpSocket:
-              port: 10051
-            initialDelaySeconds: 60
-            periodSeconds: 10
-          readinessProbe:
-            tcpSocket:
-              port: 10051
-            initialDelaySeconds: 30
-            periodSeconds: 5
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: zabbix-server
-  namespace: zabbix
-spec:
-  selector:
-    app: zabbix-server
-  ports:
-    - port: 10051
-      targetPort: 10051
-      name: trapper
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: zabbix-trapper
-  namespace: zabbix
-  annotations:
-    metallb.universe.tf/loadBalancerIPs: 10.0.56.203
-spec:
-  type: LoadBalancer
-  selector:
-    app: zabbix-server
-  ports:
-    - port: 10051
-      targetPort: 10051
-      name: trapper
-      protocol: TCP
----
-# Zabbix Web (nginx + PostgreSQL)
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: zabbix-web
-  namespace: zabbix
-  labels:
-    app: zabbix-web
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: zabbix-web
-  template:
-    metadata:
-      labels:
-        app: zabbix-web
-    spec:
-      containers:
-        - name: zabbix-web
-          image: zabbix/zabbix-web-nginx-pgsql:7.2-alpine-latest
-          ports:
-            - containerPort: 8080
-              name: http
-          env:
-            - name: ZBX_SERVER_HOST
-              value: zabbix-server
-            - name: ZBX_SERVER_NAME
-              value: "BlueJay NOC"
-            - name: PHP_TZ
-              value: America/Chicago
-            - name: DB_SERVER_HOST
-              value: zabbix-postgres
-            - name: DB_SERVER_PORT
-              value: "5432"
-            - name: POSTGRES_USER
-              valueFrom:
-                secretKeyRef:
-                  name: zabbix-db-secret
-                  key: POSTGRES_USER
-            - name: POSTGRES_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: zabbix-db-secret
-                  key: POSTGRES_PASSWORD
-            - name: POSTGRES_DB
-              valueFrom:
-                secretKeyRef:
-                  name: zabbix-db-secret
-                  key: POSTGRES_DB
-            - name: ZBX_ADMIN_PASSWORD
-              valueFrom:
-                secretKeyRef:
-                  name: zabbix-admin-secret
-                  key: ZBX_ADMIN_PASSWORD
-          resources:
-            requests:
-              memory: 128Mi
-              cpu: 50m
-            limits:
-              memory: 512Mi
-              cpu: 500m
-          livenessProbe:
-            httpGet:
-              path: /
-              port: 8080
-            initialDelaySeconds: 60
-            periodSeconds: 10
-          readinessProbe:
-            httpGet:
-              path: /
-              port: 8080
-            initialDelaySeconds: 30
-            periodSeconds: 5
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: zabbix-web
-  namespace: zabbix
-spec:
-  selector:
-    app: zabbix-web
-  ports:
-    - port: 8080
-      targetPort: 8080
-      name: http
----
-# TLS Certificate via cert-manager
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: zabbix-tls
-  namespace: zabbix
-spec:
-  secretName: zabbix-tls
-  issuerRef:
-    name: step-ca-acme
-    kind: ClusterIssuer
-  dnsNames:
-    - zabbix.iamworkin.lan
----
-# Traefik IngressRoute
-apiVersion: traefik.io/v1alpha1
-kind: IngressRoute
-metadata:
-  name: zabbix-web
-  namespace: zabbix
-spec:
-  entryPoints:
-    - websecure
-  routes:
-    - match: Host(`zabbix.iamworkin.lan`)
-      kind: Rule
-      services:
-        - name: zabbix-web
-          port: 8080
-  tls:
-    secretName: zabbix-tls
+# Zabbix 7.2 Monitoring Stack
+# PostgreSQL 16 + Zabbix Server + Zabbix Web (nginx)
+# ArgoCD managed - BlueJay Lab
+# Credentials sourced from 1Password via OnePasswordItem CRD (zabbix-credentials)
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: zabbix
+  labels:
+    app.kubernetes.io/part-of: bluejay-infra
+---
+# PostgreSQL 16 StatefulSet
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: zabbix-postgres
+  namespace: zabbix
+  labels:
+    app: zabbix-postgres
+spec:
+  serviceName: zabbix-postgres
+  replicas: 1
+  selector:
+    matchLabels:
+      app: zabbix-postgres
+  template:
+    metadata:
+      labels:
+        app: zabbix-postgres
+    spec:
+      containers:
+        - name: postgres
+          image: postgres:16-alpine
+          ports:
+            - containerPort: 5432
+              name: postgres
+          env:
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: zabbix-credentials
+                  key: DB-User
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: zabbix-credentials
+                  key: DB-Password
+            - name: POSTGRES_DB
+              value: zabbix
+          volumeMounts:
+            - name: zabbix-postgres-data
+              mountPath: /var/lib/postgresql/data
+              subPath: pgdata
+          resources:
+            requests:
+              memory: 256Mi
+              cpu: 100m
+            limits:
+              memory: 512Mi
+              cpu: 500m
+          livenessProbe:
+            exec:
+              command:
+                - pg_isready
+                - -U
+                - zabbix
+            initialDelaySeconds: 30
+            periodSeconds: 10
+          readinessProbe:
+            exec:
+              command:
+                - pg_isready
+                - -U
+                - zabbix
+            initialDelaySeconds: 5
+            periodSeconds: 5
+  volumeClaimTemplates:
+    - metadata:
+        name: zabbix-postgres-data
+      spec:
+        accessModes: [ReadWriteOnce]
+        resources:
+          requests:
+            storage: 10Gi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: zabbix-postgres
+  namespace: zabbix
+spec:
+  selector:
+    app: zabbix-postgres
+  ports:
+    - port: 5432
+      targetPort: 5432
+      name: postgres
+  clusterIP: None
+---
+# Zabbix Server
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: zabbix-server
+  namespace: zabbix
+  labels:
+    app: zabbix-server
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: zabbix-server
+  template:
+    metadata:
+      labels:
+        app: zabbix-server
+    spec:
+      containers:
+        - name: zabbix-server
+          image: zabbix/zabbix-server-pgsql:7.2-alpine-latest
+          ports:
+            - containerPort: 10051
+              name: trapper
+          env:
+            - name: DB_SERVER_HOST
+              value: zabbix-postgres
+            - name: DB_SERVER_PORT
+              value: "5432"
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: zabbix-credentials
+                  key: DB-User
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: zabbix-credentials
+                  key: DB-Password
+            - name: POSTGRES_DB
+              value: zabbix
+          resources:
+            requests:
+              memory: 256Mi
+              cpu: 100m
+            limits:
+              memory: 1Gi
+              cpu: "1"
+          livenessProbe:
+            tcpSocket:
+              port: 10051
+            initialDelaySeconds: 60
+            periodSeconds: 10
+          readinessProbe:
+            tcpSocket:
+              port: 10051
+            initialDelaySeconds: 30
+            periodSeconds: 5
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: zabbix-server
+  namespace: zabbix
+spec:
+  selector:
+    app: zabbix-server
+  ports:
+    - port: 10051
+      targetPort: 10051
+      name: trapper
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: zabbix-trapper
+  namespace: zabbix
+  annotations:
+    metallb.universe.tf/loadBalancerIPs: 10.0.56.203
+spec:
+  type: LoadBalancer
+  selector:
+    app: zabbix-server
+  ports:
+    - port: 10051
+      targetPort: 10051
+      name: trapper
+      protocol: TCP
+---
+# Zabbix Web (nginx + PostgreSQL)
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: zabbix-web
+  namespace: zabbix
+  labels:
+    app: zabbix-web
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: zabbix-web
+  template:
+    metadata:
+      labels:
+        app: zabbix-web
+    spec:
+      containers:
+        - name: zabbix-web
+          image: zabbix/zabbix-web-nginx-pgsql:7.2-alpine-latest
+          ports:
+            - containerPort: 8080
+              name: http
+          env:
+            - name: ZBX_SERVER_HOST
+              value: zabbix-server
+            - name: ZBX_SERVER_NAME
+              value: "BlueJay NOC"
+            - name: PHP_TZ
+              value: America/Chicago
+            - name: DB_SERVER_HOST
+              value: zabbix-postgres
+            - name: DB_SERVER_PORT
+              value: "5432"
+            - name: POSTGRES_USER
+              valueFrom:
+                secretKeyRef:
+                  name: zabbix-credentials
+                  key: DB-User
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: zabbix-credentials
+                  key: DB-Password
+            - name: POSTGRES_DB
+              value: zabbix
+            - name: ZBX_ADMIN_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: zabbix-credentials
+                  key: password
+          resources:
+            requests:
+              memory: 128Mi
+              cpu: 50m
+            limits:
+              memory: 512Mi
+              cpu: 500m
+          livenessProbe:
+            httpGet:
+              path: /
+              port: 8080
+            initialDelaySeconds: 60
+            periodSeconds: 10
+          readinessProbe:
+            httpGet:
+              path: /
+              port: 8080
+            initialDelaySeconds: 30
+            periodSeconds: 5
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: zabbix-web
+  namespace: zabbix
+spec:
+  selector:
+    app: zabbix-web
+  ports:
+    - port: 8080
+      targetPort: 8080
+      name: http
+---
+# TLS Certificate via cert-manager
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: zabbix-tls
+  namespace: zabbix
+spec:
+  secretName: zabbix-tls
+  issuerRef:
+    name: step-ca-acme
+    kind: ClusterIssuer
+  dnsNames:
+    - zabbix.iamworkin.lan
+---
+# Traefik IngressRoute
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: zabbix-web
+  namespace: zabbix
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`zabbix.iamworkin.lan`)
+      kind: Rule
+      services:
+        - name: zabbix-web
+          port: 8080
+  tls:
+    secretName: zabbix-tls
+---
+# 1Password secret sync — creates zabbix-credentials K8s Secret
+# Fields: DB-User, DB-Password, username, password, URL
+apiVersion: onepassword.com/v1
+kind: OnePasswordItem
+metadata:
+  name: zabbix-credentials
+  namespace: zabbix
+spec:
+  itemPath: vaults/IAmWorkin/items/Zabbix Admin