deploy(dns): roll non-root GX10 images

php.iamworkin.lan returned 404 on every path: the GX10 GitOps capture grabbed
fc-php's deployment/service but NOT its IngressRoute (chicken-egg — php wasn't
routed at capture time), so Traefik matched no route. Pod is 1/1 Running 37h —
the 404 was pure missing-route, confirmed by diffing against the healthy sibling
mysql-web (which has its IngressRoute).

Mirrors the mysql-web / fc-network pattern: a cert-manager Certificate (step-ca-acme
ClusterIssuer) to mint php-web-tls + an IngressRoute Host(php.iamworkin.lan)->php-web:5400.
Additive only.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

.gitattributes

@@ -0,0 +1,4 @@
+/.gitattributes text eol=lf
+*.yaml text eol=lf
+*.yml text eol=lf
+*.sh text eol=lf

README.md

@@ -103,7 +103,6 @@ curl -sk -X DELETE https://dns.iamworkin.lan/api/v1/servers/<serverId>/zones/iam
 - **Public read-only hosts**: if a public host fronts a service that also exposes admin writes internally, add a Traefik route match like `Host(...) && (Method(GET) || Method(HEAD))` on the public edge instead of trusting the app to reject unsafe methods.
 - **Public read-write allowlist hosts**: if a public host accepts a tightly bounded write surface (e.g. bootstrap-JWT POST), pin the allowlist as `(Method(GET) || Method(HEAD) || Method(POST) || Method(OPTIONS))`. PUT/PATCH/DELETE must still 404 at the route. Track A's `updatecenter.iamworkin.lan` / `updates.iamworkin.lan` are the canonical example. The lint test enforces this invariant.
 - **Traefik VIP netpols**: when a `NetworkPolicy` allows `10.0.56.200`, also allow the post-DNAT backend ports (`8443` for TLS plus `8080` or `8000` for HTTP) or Calico will drop the rewritten flow.
-- **RemoteDesktop isolation**: `apps/fc-desktop/network-policies.yaml` intentionally keeps desktop pod egress to named CoreDNS, `intranet-web:5300/TCP`, and noc1 step-ca `10.0.56.10:9000/9443` only. Guacamole display egress is owned separately by `apps/guacamole/guacamole.yaml` through `guacd-desktop-egress` on `5901/TCP`.
 - **Auth-safe probes**: services behind API-key or global auth middleware should prefer `tcpSocket` probes unless `/health` is explicitly exempted before the middleware runs.
 - **ArgoCD must use internal Gitea URL**: `http://gitea-clusterip.gitea.svc.cluster.local:3000/bluejay/bluejay-infra.git`, not the external HTTPS URL (step-ca cert isn't trusted by ArgoCD). The `ApplicationSet` and any hand-created `Application` must both use the internal URL.
 
@@ -117,6 +116,16 @@ dotnet test tests/bluejay-infra-lint/BluejayInfraLint.Tests.csproj -c Release
 
 That test project sweeps `bluejay-infra/apps/**` plus the canonical sibling `FlowerCore.*\\k8s` manifests that share the same workspace. Matching `conftest.dev` policy files live under `tests/bluejay-infra-lint/conftest.dev/` for environments that also have `conftest` or `opa`.
 
+## Non-K8s Pi Artifacts
+
+Some `apps/*` directories are deployment artifact bundles consumed by Puppet
+instead of Kubernetes workloads. `apps/fc-signage-pi-player/` carries the
+Chromium signage Pi player, `apps/fc-divoom-dm-pi-device/` carries the additive
+edge2 Divoom-as-DeviceManagement-device profile/Hiera contract, and
+`apps/fc-divoom-tv-pi/` carries the Divoom TV Pi HDMI systemd/Puppet shape.
+These bundles intentionally avoid Deployment, IngressRoute, Certificate, and
+OnePasswordItem resources.
+
 ## References
 
 - OpenVox noc1 durability runbook: `docs/runbooks/openvoxserver-quadlet-durability.md`

apps-gx10/fc-aistation/certificate-aistation-web-tls.json

@@ -0,0 +1,18 @@
+{
+  "apiVersion": "cert-manager.io/v1",
+  "kind": "Certificate",
+  "metadata": {
+    "name": "aistation-web-tls",
+    "namespace": "fc-aistation"
+  },
+  "spec": {
+    "dnsNames": [
+      "aistation.iamworkin.lan"
+    ],
+    "issuerRef": {
+      "kind": "ClusterIssuer",
+      "name": "step-ca-acme"
+    },
+    "secretName": "aistation-web-tls"
+  }
+}

apps-gx10/fc-aistation/configmap-aistation-web-config.json

@@ -0,0 +1,29 @@
+{
+  "apiVersion": "v1",
+  "data": {
+    "ASPNETCORE_ENVIRONMENT": "Production",
+    "ASPNETCORE_FORWARDEDHEADERS_ENABLED": "true",
+    "ASPNETCORE_URLS": "http://+:5000",
+    "AiStation__Appliance__FallbackEdition": "gx10",
+    "FLOWERCORE_AISTATION_EDITION": "gx10",
+    "FlowerCore__AgentZero__Enabled": "false",
+    "FlowerCore__DataDirectory": "/data",
+    "FlowerCore__Database__ConnectionStrings__Sqlite": "Data Source=/data/aistation.db",
+    "FlowerCore__Database__Provider": "Sqlite",
+    "FlowerCore__Editions__ProfileDirectory": "/app/editions",
+    "FlowerCore__Ollama__BaseUrl": "http://10.0.57.201:11434",
+    "FlowerCore__Operator__Enabled": "true",
+    "OTEL_EXPORTER_OTLP_ENDPOINT": "http://otel-collector.monitoring.svc.cluster.local:4317",
+    "OTEL_EXPORTER_OTLP_PROTOCOL": "grpc",
+    "OTEL_SERVICE_NAME": "FlowerCore.AiStation"
+  },
+  "kind": "ConfigMap",
+  "metadata": {
+    "labels": {
+      "app.kubernetes.io/name": "aistation-web",
+      "app.kubernetes.io/part-of": "flowercore"
+    },
+    "name": "aistation-web-config",
+    "namespace": "fc-aistation"
+  }
+}

apps-gx10/fc-aistation/deployment-aistation-web.json

@@ -0,0 +1,111 @@
+{
+  "apiVersion": "apps/v1",
+  "kind": "Deployment",
+  "metadata": {
+    "labels": {
+      "app.kubernetes.io/name": "aistation-web",
+      "app.kubernetes.io/part-of": "flowercore"
+    },
+    "name": "aistation-web",
+    "namespace": "fc-aistation"
+  },
+  "spec": {
+    "progressDeadlineSeconds": 600,
+    "replicas": 1,
+    "revisionHistoryLimit": 3,
+    "selector": {
+      "matchLabels": {
+        "app.kubernetes.io/name": "aistation-web"
+      }
+    },
+    "strategy": {
+      "type": "Recreate"
+    },
+    "template": {
+      "metadata": {
+        "annotations": {
+          "kubectl.kubernetes.io/restartedAt": "2026-06-16T14:00:18-05:00",
+          "prometheus.io/path": "/metrics/prometheus",
+          "prometheus.io/port": "5000",
+          "prometheus.io/scrape": "true"
+        },
+        "labels": {
+          "app.kubernetes.io/name": "aistation-web",
+          "app.kubernetes.io/part-of": "flowercore"
+        }
+      },
+      "spec": {
+        "containers": [
+          {
+            "envFrom": [
+              {
+                "configMapRef": {
+                  "name": "aistation-web-config"
+                }
+              }
+            ],
+            "image": "localhost/fc-aistation-web:v20260616-ai6-gx10-websurface-a8a3e9d-2f9f89e",
+            "imagePullPolicy": "Never",
+            "livenessProbe": {
+              "failureThreshold": 3,
+              "httpGet": {
+                "path": "/healthz",
+                "port": 5000,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 30,
+              "periodSeconds": 30,
+              "successThreshold": 1,
+              "timeoutSeconds": 5
+            },
+            "name": "aistation-web",
+            "ports": [
+              {
+                "containerPort": 5000,
+                "name": "http",
+                "protocol": "TCP"
+              }
+            ],
+            "readinessProbe": {
+              "failureThreshold": 6,
+              "httpGet": {
+                "path": "/healthz",
+                "port": 5000,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 10,
+              "periodSeconds": 10,
+              "successThreshold": 1,
+              "timeoutSeconds": 5
+            },
+            "resources": {},
+            "terminationMessagePath": "/dev/termination-log",
+            "terminationMessagePolicy": "File",
+            "volumeMounts": [
+              {
+                "mountPath": "/data",
+                "name": "data"
+              }
+            ]
+          }
+        ],
+        "dnsPolicy": "ClusterFirst",
+        "nodeSelector": {
+          "kubernetes.io/arch": "arm64"
+        },
+        "restartPolicy": "Always",
+        "schedulerName": "default-scheduler",
+        "securityContext": {},
+        "terminationGracePeriodSeconds": 30,
+        "volumes": [
+          {
+            "name": "data",
+            "persistentVolumeClaim": {
+              "claimName": "aistation-web-data"
+            }
+          }
+        ]
+      }
+    }
+  }
+}

apps-gx10/fc-aistation/ingressroute-aistation-web.json

@@ -0,0 +1,28 @@
+{
+  "apiVersion": "traefik.io/v1alpha1",
+  "kind": "IngressRoute",
+  "metadata": {
+    "name": "aistation-web",
+    "namespace": "fc-aistation"
+  },
+  "spec": {
+    "entryPoints": [
+      "websecure"
+    ],
+    "routes": [
+      {
+        "kind": "Rule",
+        "match": "Host(`aistation.iamworkin.lan`)",
+        "services": [
+          {
+            "name": "aistation-web",
+            "port": 80
+          }
+        ]
+      }
+    ],
+    "tls": {
+      "secretName": "aistation-web-tls"
+    }
+  }
+}

apps-gx10/fc-aistation/service-aistation-web.json

@@ -0,0 +1,28 @@
+{
+  "apiVersion": "v1",
+  "kind": "Service",
+  "metadata": {
+    "labels": {
+      "app.kubernetes.io/name": "aistation-web",
+      "app.kubernetes.io/part-of": "flowercore"
+    },
+    "name": "aistation-web",
+    "namespace": "fc-aistation"
+  },
+  "spec": {
+    "internalTrafficPolicy": "Cluster",
+    "ports": [
+      {
+        "name": "http",
+        "port": 80,
+        "protocol": "TCP",
+        "targetPort": 5000
+      }
+    ],
+    "selector": {
+      "app.kubernetes.io/name": "aistation-web"
+    },
+    "sessionAffinity": "None",
+    "type": "ClusterIP"
+  }
+}

apps-gx10/fc-chat/configmap-chat-web-config.json

@@ -0,0 +1,54 @@
+{
+  "apiVersion": "v1",
+  "data": {
+    "ASPNETCORE_ENVIRONMENT": "Production",
+    "ASPNETCORE_FORWARDEDHEADERS_ENABLED": "true",
+    "ASPNETCORE_URLS": "http://+:8080",
+    "ChatOptions__BehaviorRuleEngine__FallbackOllamaBaseUrl": "http://10.0.57.201:11434",
+    "ChatOptions__BehaviorRuleEngine__ModelName": "gemma3:4b",
+    "ChatOptions__BehaviorRuleEngine__OllamaBaseUrl": "http://10.0.57.201:11434",
+    "FlowerCore__AI__DefaultModelName": "gemma3:12b",
+    "FlowerCore__AI__Helpdesk__SentimentEscalation__Enabled": "true",
+    "FlowerCore__AI__IrcBridge__AllowActionExecution": "false",
+    "FlowerCore__AI__IrcBridge__DefaultProfileSlug": "it-helpdesk",
+    "FlowerCore__AI__IrcBridge__Enabled": "true",
+    "FlowerCore__AI__IrcBridge__MentionProfileSlug": "it-helpdesk",
+    "FlowerCore__AI__IrcBridge__MentionReactiveMode": "mentions-only",
+    "FlowerCore__AI__Memory__EmbeddingModel": "nomic-embed-text",
+    "FlowerCore__AI__Memory__EnableSharedIndexingBackfill": "true",
+    "FlowerCore__AI__Memory__SharedIndexingDatabasePath": "/data/chat-memory-index.db",
+    "FlowerCore__AI__Memory__UseOllamaEmbeddings": "true",
+    "FlowerCore__AI__Memory__UseSharedIndexingAdapter": "true",
+    "FlowerCore__AI__OllamaBaseUrl": "http://10.0.57.201:11434",
+    "FlowerCore__AI__Skills__Intranet__IntranetBaseUrl": "http://intranet-web.intranet.svc.cluster.local",
+    "FlowerCore__AI__Skills__Intranet__PublicBaseUrl": "https://intranet.iamworkin.lan",
+    "FlowerCore__AI__Skills__Intranet__SearchBaseUrl": "https://intranet.iamworkin.lan",
+    "FlowerCore__AI__Skills__Library__LibraryApiUrl": "http://library-web.fc-library.svc.cluster.local",
+    "FlowerCore__AI__Skills__Print__PrintMcpBaseUrl": "http://10.0.57.16:5200",
+    "FlowerCore__AI__Skills__Retail__RetailApiUrl": "http://retail-web.fc-retail.svc.cluster.local",
+    "FlowerCore__AI__Voice__OutputRoot": "/data/audio",
+    "FlowerCore__AI__Voice__Piper__Host": "10.0.57.17",
+    "FlowerCore__AI__Voice__Piper__Port": "10400",
+    "FlowerCore__AI__Voice__RetentionDays": "30",
+    "FlowerCore__Anthropic__BaseUrl": "https://api.anthropic.com",
+    "FlowerCore__Anthropic__CheapModel": "claude-haiku-4-5-20251001",
+    "FlowerCore__Anthropic__DeepModel": "claude-opus-4-7",
+    "FlowerCore__Anthropic__DefaultModel": "claude-sonnet-4-6",
+    "FlowerCore__Anthropic__Enabled": "false",
+    "FlowerCore__Auth__Enabled": "false",
+    "FlowerCore__Auth__Oidc__Audience": "chat",
+    "FlowerCore__Auth__Oidc__Authority": "https://id.iamworkin.lan/application/o/chat/",
+    "FlowerCore__Auth__Oidc__ClientId": "chat",
+    "FlowerCore__Auth__Oidc__Enabled": "true",
+    "FlowerCore__Budget__ResponseCacheEnabled": "true",
+    "FlowerCore__Database__ConnectionStrings__Sqlite": "Data Source=/data/chat.db",
+    "OTEL_EXPORTER_OTLP_ENDPOINT": "http://otel-collector.monitoring.svc.cluster.local:4317",
+    "OTEL_EXPORTER_OTLP_PROTOCOL": "grpc",
+    "OTEL_SERVICE_NAME": "FlowerCore.Chat"
+  },
+  "kind": "ConfigMap",
+  "metadata": {
+    "name": "chat-web-config",
+    "namespace": "fc-chat"
+  }
+}

apps-gx10/fc-chat/deployment-chat-web.json

@@ -0,0 +1,159 @@
+{
+  "apiVersion": "apps/v1",
+  "kind": "Deployment",
+  "metadata": {
+    "labels": {
+      "app.kubernetes.io/name": "chat-web",
+      "app.kubernetes.io/part-of": "flowercore"
+    },
+    "name": "chat-web",
+    "namespace": "fc-chat"
+  },
+  "spec": {
+    "progressDeadlineSeconds": 600,
+    "replicas": 1,
+    "revisionHistoryLimit": 10,
+    "selector": {
+      "matchLabels": {
+        "app.kubernetes.io/name": "chat-web"
+      }
+    },
+    "strategy": {
+      "type": "Recreate"
+    },
+    "template": {
+      "metadata": {
+        "annotations": {
+          "fc.flowercore.io/healthz-anon": "true",
+          "fc.flowercore.io/probe-path": "/healthz",
+          "prometheus.io/path": "/metrics/prometheus",
+          "prometheus.io/port": "8080",
+          "prometheus.io/scrape": "true"
+        },
+        "labels": {
+          "app.kubernetes.io/name": "chat-web",
+          "app.kubernetes.io/part-of": "flowercore"
+        }
+      },
+      "spec": {
+        "containers": [
+          {
+            "env": [
+              {
+                "name": "FlowerCore__Auth__Oidc__Authority",
+                "valueFrom": {
+                  "secretKeyRef": {
+                    "key": "issuer_url",
+                    "name": "chat-oidc-client",
+                    "optional": true
+                  }
+                }
+              },
+              {
+                "name": "FlowerCore__Auth__Oidc__ClientId",
+                "valueFrom": {
+                  "secretKeyRef": {
+                    "key": "client_id",
+                    "name": "chat-oidc-client",
+                    "optional": true
+                  }
+                }
+              },
+              {
+                "name": "FlowerCore__Auth__Oidc__ClientSecret",
+                "valueFrom": {
+                  "secretKeyRef": {
+                    "key": "client_secret",
+                    "name": "chat-oidc-client",
+                    "optional": true
+                  }
+                }
+              }
+            ],
+            "envFrom": [
+              {
+                "configMapRef": {
+                  "name": "chat-web-config"
+                }
+              },
+              {
+                "secretRef": {
+                  "name": "chat-web-secret",
+                  "optional": true
+                }
+              }
+            ],
+            "image": "localhost/fc-chat-web:v20260616-chat-md-a812a81",
+            "imagePullPolicy": "Never",
+            "livenessProbe": {
+              "failureThreshold": 3,
+              "httpGet": {
+                "path": "/healthz",
+                "port": 8080,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 30,
+              "periodSeconds": 30,
+              "successThreshold": 1,
+              "timeoutSeconds": 5
+            },
+            "name": "chat-web",
+            "ports": [
+              {
+                "containerPort": 8080,
+                "name": "http",
+                "protocol": "TCP"
+              }
+            ],
+            "readinessProbe": {
+              "failureThreshold": 6,
+              "httpGet": {
+                "path": "/healthz",
+                "port": 8080,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 10,
+              "periodSeconds": 10,
+              "successThreshold": 1,
+              "timeoutSeconds": 5
+            },
+            "resources": {
+              "limits": {
+                "cpu": "500m",
+                "memory": "512Mi"
+              },
+              "requests": {
+                "cpu": "100m",
+                "memory": "128Mi"
+              }
+            },
+            "terminationMessagePath": "/dev/termination-log",
+            "terminationMessagePolicy": "File",
+            "volumeMounts": [
+              {
+                "mountPath": "/data",
+                "name": "data"
+              }
+            ]
+          }
+        ],
+        "dnsPolicy": "ClusterFirst",
+        "restartPolicy": "Always",
+        "schedulerName": "default-scheduler",
+        "securityContext": {
+          "fsGroup": 1654,
+          "fsGroupChangePolicy": "OnRootMismatch"
+        },
+        "terminationGracePeriodSeconds": 30,
+        "volumes": [
+          {
+            "name": "data",
+            "persistentVolumeClaim": {
+              "claimName": "chat-web-data"
+            }
+          }
+        ]
+      }
+    }
+  }
+}

apps-gx10/fc-chat/ingressroute-chat-web-public.json

@@ -0,0 +1,29 @@
+{
+  "apiVersion": "traefik.io/v1alpha1",
+  "kind": "IngressRoute",
+  "metadata": {
+    "name": "chat-web-public",
+    "namespace": "fc-chat"
+  },
+  "spec": {
+    "entryPoints": [
+      "websecure"
+    ],
+    "routes": [
+      {
+        "kind": "Rule",
+        "match": "Host(`chat.flowercore.io`) && (Path(`/`) || Path(`/chat`) || PathPrefix(`/_blazor`) || PathPrefix(`/_framework`) || PathPrefix(`/_content`) || PathPrefix(`/avatars`) || PathPrefix(`/css`) || PathPrefix(`/js`) || PathPrefix(`/favicon`) || PathPrefix(`/chathub`)) && (Method(`GET`) || Method(`HEAD`) || Method(`POST`) || Method(`OPTIONS`))",
+        "priority": 100,
+        "services": [
+          {
+            "name": "chat-web",
+            "port": 80
+          }
+        ]
+      }
+    ],
+    "tls": {
+      "secretName": "cf-origin-flowercore-io"
+    }
+  }
+}

apps-gx10/fc-chat/ingressroute-chat-web.json

@@ -0,0 +1,29 @@
+{
+  "apiVersion": "traefik.io/v1alpha1",
+  "kind": "IngressRoute",
+  "metadata": {
+    "name": "chat-web",
+    "namespace": "fc-chat"
+  },
+  "spec": {
+    "entryPoints": [
+      "websecure"
+    ],
+    "routes": [
+      {
+        "kind": "Rule",
+        "match": "Host(`chat.iamworkin.lan`)",
+        "priority": 100,
+        "services": [
+          {
+            "name": "chat-web",
+            "port": 80
+          }
+        ]
+      }
+    ],
+    "tls": {
+      "secretName": "chat-web-tls"
+    }
+  }
+}

apps-gx10/fc-chat/service-chat-web.json

@@ -0,0 +1,28 @@
+{
+  "apiVersion": "v1",
+  "kind": "Service",
+  "metadata": {
+    "labels": {
+      "app.kubernetes.io/name": "chat-web",
+      "app.kubernetes.io/part-of": "flowercore"
+    },
+    "name": "chat-web",
+    "namespace": "fc-chat"
+  },
+  "spec": {
+    "internalTrafficPolicy": "Cluster",
+    "ports": [
+      {
+        "name": "http",
+        "port": 80,
+        "protocol": "TCP",
+        "targetPort": 8080
+      }
+    ],
+    "selector": {
+      "app.kubernetes.io/name": "chat-web"
+    },
+    "sessionAffinity": "None",
+    "type": "ClusterIP"
+  }
+}

apps-gx10/fc-desktop/certificate-remotedesktop-tls.json

@@ -0,0 +1,18 @@
+{
+  "apiVersion": "cert-manager.io/v1",
+  "kind": "Certificate",
+  "metadata": {
+    "name": "remotedesktop-tls",
+    "namespace": "fc-desktop"
+  },
+  "spec": {
+    "dnsNames": [
+      "desktop.iamworkin.lan"
+    ],
+    "issuerRef": {
+      "kind": "ClusterIssuer",
+      "name": "step-ca-acme"
+    },
+    "secretName": "remotedesktop-tls"
+  }
+}

apps-gx10/fc-desktop/deployment-remotedesktop-operator.json

@@ -0,0 +1,93 @@
+{
+  "apiVersion": "apps/v1",
+  "kind": "Deployment",
+  "metadata": {
+    "labels": {
+      "app.kubernetes.io/name": "remotedesktop-operator",
+      "app.kubernetes.io/part-of": "flowercore-remotedesktop"
+    },
+    "name": "remotedesktop-operator",
+    "namespace": "fc-desktop"
+  },
+  "spec": {
+    "progressDeadlineSeconds": 600,
+    "replicas": 1,
+    "revisionHistoryLimit": 10,
+    "selector": {
+      "matchLabels": {
+        "app.kubernetes.io/name": "remotedesktop-operator"
+      }
+    },
+    "strategy": {
+      "rollingUpdate": {
+        "maxSurge": "25%",
+        "maxUnavailable": "25%"
+      },
+      "type": "RollingUpdate"
+    },
+    "template": {
+      "metadata": {
+        "labels": {
+          "app.kubernetes.io/name": "remotedesktop-operator",
+          "app.kubernetes.io/part-of": "flowercore-remotedesktop"
+        }
+      },
+      "spec": {
+        "containers": [
+          {
+            "env": [
+              {
+                "name": "RemoteDesktop__WebUrl",
+                "value": "http://remotedesktop-web.fc-desktop.svc.cluster.local.:8080"
+              }
+            ],
+            "image": "localhost/fc-remotedesktop-operator:gx10-v1",
+            "imagePullPolicy": "IfNotPresent",
+            "livenessProbe": {
+              "failureThreshold": 3,
+              "httpGet": {
+                "path": "/healthz",
+                "port": "http",
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 15,
+              "periodSeconds": 30,
+              "successThreshold": 1,
+              "timeoutSeconds": 1
+            },
+            "name": "operator",
+            "ports": [
+              {
+                "containerPort": 8080,
+                "name": "http",
+                "protocol": "TCP"
+              }
+            ],
+            "readinessProbe": {
+              "failureThreshold": 3,
+              "httpGet": {
+                "path": "/healthz",
+                "port": "http",
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 5,
+              "periodSeconds": 15,
+              "successThreshold": 1,
+              "timeoutSeconds": 1
+            },
+            "resources": {},
+            "terminationMessagePath": "/dev/termination-log",
+            "terminationMessagePolicy": "File"
+          }
+        ],
+        "dnsPolicy": "ClusterFirst",
+        "restartPolicy": "Always",
+        "schedulerName": "default-scheduler",
+        "securityContext": {},
+        "serviceAccount": "remotedesktop-operator",
+        "serviceAccountName": "remotedesktop-operator",
+        "terminationGracePeriodSeconds": 30
+      }
+    }
+  }
+}

apps-gx10/fc-desktop/deployment-remotedesktop-web.json

@@ -0,0 +1,299 @@
+{
+  "apiVersion": "apps/v1",
+  "kind": "Deployment",
+  "metadata": {
+    "labels": {
+      "app.kubernetes.io/name": "remotedesktop-web",
+      "app.kubernetes.io/part-of": "flowercore"
+    },
+    "name": "remotedesktop-web",
+    "namespace": "fc-desktop"
+  },
+  "spec": {
+    "progressDeadlineSeconds": 600,
+    "replicas": 1,
+    "revisionHistoryLimit": 10,
+    "selector": {
+      "matchLabels": {
+        "app.kubernetes.io/name": "remotedesktop-web"
+      }
+    },
+    "strategy": {
+      "type": "Recreate"
+    },
+    "template": {
+      "metadata": {
+        "labels": {
+          "app.kubernetes.io/name": "remotedesktop-web",
+          "app.kubernetes.io/part-of": "flowercore"
+        }
+      },
+      "spec": {
+        "containers": [
+          {
+            "env": [
+              {
+                "name": "ASPNETCORE_URLS",
+                "value": "http://+:8080"
+              },
+              {
+                "name": "ASPNETCORE_ENVIRONMENT",
+                "value": "Production"
+              },
+              {
+                "name": "FlowerCore__Database__ConnectionStrings__Sqlite",
+                "value": "Data Source=/app/data/remotedesktop.db"
+              },
+              {
+                "name": "RemoteDesktop__Mode",
+                "value": "Remote"
+              },
+              {
+                "name": "RemoteDesktop__EnableApiDocs",
+                "value": "true"
+              },
+              {
+                "name": "RemoteDesktop__PoolWarmupEnabled",
+                "value": "false"
+              },
+              {
+                "name": "RemoteDesktop__PoolWarmupIntervalSeconds",
+                "value": "60"
+              },
+              {
+                "name": "RemoteDesktop__OrphanReconciler__Enabled",
+                "value": "true"
+              },
+              {
+                "name": "RemoteDesktop__OrphanReconciler__IntervalSeconds",
+                "value": "300"
+              },
+              {
+                "name": "RemoteDesktop__OrphanReconciler__GraceSeconds",
+                "value": "600"
+              },
+              {
+                "name": "RemoteDesktop__Audit__Enabled",
+                "value": "true"
+              },
+              {
+                "name": "RemoteDesktop__Audit__DualWrite",
+                "value": "true"
+              },
+              {
+                "name": "RemoteDesktop__UserVolumeClaimInitializer",
+                "value": "KubernetesExec"
+              },
+              {
+                "name": "RemoteDesktop__KubernetesNamespace",
+                "value": "fc-desktop"
+              },
+              {
+                "name": "RemoteDesktop__GuacamoleUrl",
+                "value": "http://guacamole.guacamole.svc.cluster.local.:8080/guacamole"
+              },
+              {
+                "name": "RemoteDesktop__GuacamolePublicUrl",
+                "value": "https://desktop.iamworkin.lan/guacamole"
+              },
+              {
+                "name": "RemoteDesktop__GuacamoleAdminUser",
+                "value": "guacadmin"
+              },
+              {
+                "name": "RemoteDesktop__GuacamoleJsonSecretKey",
+                "valueFrom": {
+                  "secretKeyRef": {
+                    "key": "password",
+                    "name": "remotedesktop-guacamole-json-auth"
+                  }
+                }
+              },
+              {
+                "name": "RemoteDesktop__TraefikClusterIp",
+                "value": "10.43.234.103"
+              },
+              {
+                "name": "RemoteDesktop__TraefikHostAliases__0",
+                "value": "chat.iamworkin.lan"
+              },
+              {
+                "name": "RemoteDesktop__TraefikHostAliases__1",
+                "value": "desktop.iamworkin.lan"
+              },
+              {
+                "name": "RemoteDesktop__TraefikHostAliases__2",
+                "value": "gitea.iamworkin.lan"
+              },
+              {
+                "name": "RemoteDesktop__TraefikHostAliases__3",
+                "value": "intranet.iamworkin.lan"
+              },
+              {
+                "name": "RemoteDesktop__TraefikHostAliases__4",
+                "value": "print.iamworkin.lan"
+              },
+              {
+                "name": "RemoteDesktop__TraefikHostAliases__5",
+                "value": "selenium.iamworkin.lan"
+              },
+              {
+                "name": "RemoteDesktop__NfsServer",
+                "value": "10.0.58.3"
+              },
+              {
+                "name": "RemoteDesktop__NfsBasePath",
+                "value": "/volume1/kubernetes/remotedesktop/users"
+              },
+              {
+                "name": "RemoteDesktop__SessionRecordingBasePath",
+                "value": "/var/lib/guacamole/recordings"
+              },
+              {
+                "name": "RemoteDesktop__MaxSessionsPerUser",
+                "value": "3"
+              },
+              {
+                "name": "FlowerCore__Auth__Oidc__Authority",
+                "valueFrom": {
+                  "secretKeyRef": {
+                    "key": "issuer_url",
+                    "name": "remotedesktop-oidc-client",
+                    "optional": true
+                  }
+                }
+              },
+              {
+                "name": "FlowerCore__Auth__Oidc__ClientId",
+                "valueFrom": {
+                  "secretKeyRef": {
+                    "key": "client_id",
+                    "name": "remotedesktop-oidc-client",
+                    "optional": true
+                  }
+                }
+              },
+              {
+                "name": "FlowerCore__Auth__Oidc__ClientSecret",
+                "valueFrom": {
+                  "secretKeyRef": {
+                    "key": "client_secret",
+                    "name": "remotedesktop-oidc-client",
+                    "optional": true
+                  }
+                }
+              },
+              {
+                "name": "FlowerCore__Auth__Enabled",
+                "value": "false"
+              },
+              {
+                "name": "FlowerCore__Auth__Oidc__Enabled",
+                "value": "false"
+              }
+            ],
+            "envFrom": [
+              {
+                "secretRef": {
+                  "name": "remotedesktop-secrets",
+                  "optional": true
+                }
+              }
+            ],
+            "image": "localhost/fc-remotedesktop-web:gx10-v1",
+            "imagePullPolicy": "IfNotPresent",
+            "livenessProbe": {
+              "failureThreshold": 3,
+              "httpGet": {
+                "path": "/health",
+                "port": 8080,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 15,
+              "periodSeconds": 30,
+              "successThreshold": 1,
+              "timeoutSeconds": 1
+            },
+            "name": "web",
+            "ports": [
+              {
+                "containerPort": 8080,
+                "name": "http",
+                "protocol": "TCP"
+              }
+            ],
+            "readinessProbe": {
+              "failureThreshold": 3,
+              "httpGet": {
+                "path": "/health",
+                "port": 8080,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 5,
+              "periodSeconds": 10,
+              "successThreshold": 1,
+              "timeoutSeconds": 1
+            },
+            "resources": {
+              "limits": {
+                "cpu": "500m",
+                "memory": "512Mi"
+              },
+              "requests": {
+                "cpu": "100m",
+                "memory": "256Mi"
+              }
+            },
+            "startupProbe": {
+              "failureThreshold": 60,
+              "httpGet": {
+                "path": "/health",
+                "port": 8080,
+                "scheme": "HTTP"
+              },
+              "periodSeconds": 10,
+              "successThreshold": 1,
+              "timeoutSeconds": 1
+            },
+            "terminationMessagePath": "/dev/termination-log",
+            "terminationMessagePolicy": "File",
+            "volumeMounts": [
+              {
+                "mountPath": "/app/data",
+                "name": "data"
+              },
+              {
+                "mountPath": "/var/lib/guacamole/recordings",
+                "name": "recordings",
+                "readOnly": true,
+                "subPath": "guacamole/recordings"
+              }
+            ]
+          }
+        ],
+        "dnsPolicy": "ClusterFirst",
+        "restartPolicy": "Always",
+        "schedulerName": "default-scheduler",
+        "securityContext": {},
+        "serviceAccount": "remotedesktop-web",
+        "serviceAccountName": "remotedesktop-web",
+        "terminationGracePeriodSeconds": 30,
+        "volumes": [
+          {
+            "name": "data",
+            "persistentVolumeClaim": {
+              "claimName": "remotedesktop-data"
+            }
+          },
+          {
+            "name": "recordings",
+            "nfs": {
+              "path": "/volume1/kubernetes",
+              "server": "10.0.58.3"
+            }
+          }
+        ]
+      }
+    }
+  }
+}

apps-gx10/fc-desktop/ingressroute-remotedesktop-web.json

@@ -0,0 +1,29 @@
+{
+  "apiVersion": "traefik.io/v1alpha1",
+  "kind": "IngressRoute",
+  "metadata": {
+    "name": "remotedesktop-web",
+    "namespace": "fc-desktop"
+  },
+  "spec": {
+    "entryPoints": [
+      "websecure"
+    ],
+    "routes": [
+      {
+        "kind": "Rule",
+        "match": "Host(`desktop.iamworkin.lan`)",
+        "priority": 100,
+        "services": [
+          {
+            "name": "remotedesktop-web",
+            "port": 8080
+          }
+        ]
+      }
+    ],
+    "tls": {
+      "secretName": "remotedesktop-tls"
+    }
+  }
+}

apps-gx10/fc-desktop/service-remotedesktop-web.json

@@ -0,0 +1,24 @@
+{
+  "apiVersion": "v1",
+  "kind": "Service",
+  "metadata": {
+    "name": "remotedesktop-web",
+    "namespace": "fc-desktop"
+  },
+  "spec": {
+    "internalTrafficPolicy": "Cluster",
+    "ports": [
+      {
+        "name": "http",
+        "port": 8080,
+        "protocol": "TCP",
+        "targetPort": 8080
+      }
+    ],
+    "selector": {
+      "app.kubernetes.io/name": "remotedesktop-web"
+    },
+    "sessionAffinity": "None",
+    "type": "ClusterIP"
+  }
+}

apps-gx10/fc-desktop/serviceaccount-remotedesktop-operator.json

@@ -0,0 +1,8 @@
+{
+  "apiVersion": "v1",
+  "kind": "ServiceAccount",
+  "metadata": {
+    "name": "remotedesktop-operator",
+    "namespace": "fc-desktop"
+  }
+}

apps-gx10/fc-desktop/serviceaccount-remotedesktop-web.json

@@ -0,0 +1,8 @@
+{
+  "apiVersion": "v1",
+  "kind": "ServiceAccount",
+  "metadata": {
+    "name": "remotedesktop-web",
+    "namespace": "fc-desktop"
+  }
+}

apps-gx10/fc-devicemgmt/deployment-fc-devicemgmt-operator.json

@@ -0,0 +1,183 @@
+{
+  "apiVersion": "apps/v1",
+  "kind": "Deployment",
+  "metadata": {
+    "labels": {
+      "app": "fc-devicemgmt-operator",
+      "app.kubernetes.io/component": "operator",
+      "app.kubernetes.io/managed-by": "argocd",
+      "app.kubernetes.io/name": "fc-devicemgmt-operator",
+      "app.kubernetes.io/part-of": "flowercore",
+      "flowercore.io/created-by": "bluejay-infra",
+      "flowercore.io/tenant-id": "system"
+    },
+    "name": "fc-devicemgmt-operator",
+    "namespace": "fc-devicemgmt"
+  },
+  "spec": {
+    "progressDeadlineSeconds": 600,
+    "replicas": 1,
+    "revisionHistoryLimit": 3,
+    "selector": {
+      "matchLabels": {
+        "app": "fc-devicemgmt-operator"
+      }
+    },
+    "strategy": {
+      "rollingUpdate": {
+        "maxSurge": "25%",
+        "maxUnavailable": "25%"
+      },
+      "type": "RollingUpdate"
+    },
+    "template": {
+      "metadata": {
+        "annotations": {
+          "flowercore.io/audit-trace-id": "runtime-activity-trace",
+          "prometheus.io/path": "/metrics",
+          "prometheus.io/port": "8080",
+          "prometheus.io/scrape": "true"
+        },
+        "labels": {
+          "app": "fc-devicemgmt-operator",
+          "app.kubernetes.io/component": "operator",
+          "app.kubernetes.io/managed-by": "argocd",
+          "app.kubernetes.io/name": "fc-devicemgmt-operator",
+          "app.kubernetes.io/part-of": "flowercore",
+          "flowercore.io/created-by": "bluejay-infra",
+          "flowercore.io/tenant-id": "system"
+        }
+      },
+      "spec": {
+        "containers": [
+          {
+            "env": [
+              {
+                "name": "ASPNETCORE_ENVIRONMENT",
+                "value": "Production"
+              },
+              {
+                "name": "DOTNET_SYSTEM_GLOBALIZATION_INVARIANT",
+                "value": "false"
+              },
+              {
+                "name": "POD_NAME",
+                "valueFrom": {
+                  "fieldRef": {
+                    "apiVersion": "v1",
+                    "fieldPath": "metadata.name"
+                  }
+                }
+              },
+              {
+                "name": "POD_NAMESPACE",
+                "valueFrom": {
+                  "fieldRef": {
+                    "apiVersion": "v1",
+                    "fieldPath": "metadata.namespace"
+                  }
+                }
+              },
+              {
+                "name": "FLOWERCORE_KUBERNETES_OWNER_DEPLOYMENT",
+                "value": "fc-devicemgmt-operator"
+              },
+              {
+                "name": "FlowerCore__Service__Name",
+                "value": "FlowerCore.DeviceManagement.Operator"
+              },
+              {
+                "name": "FlowerCore__DeviceManagement__DefaultTenantId",
+                "value": "system"
+              }
+            ],
+            "image": "localhost/fc-devicemgmt-operator:gx10-v1",
+            "imagePullPolicy": "IfNotPresent",
+            "livenessProbe": {
+              "failureThreshold": 3,
+              "initialDelaySeconds": 20,
+              "periodSeconds": 30,
+              "successThreshold": 1,
+              "tcpSocket": {
+                "port": 8080
+              },
+              "timeoutSeconds": 1
+            },
+            "name": "operator",
+            "ports": [
+              {
+                "containerPort": 8080,
+                "name": "metrics",
+                "protocol": "TCP"
+              }
+            ],
+            "readinessProbe": {
+              "failureThreshold": 3,
+              "initialDelaySeconds": 5,
+              "periodSeconds": 10,
+              "successThreshold": 1,
+              "tcpSocket": {
+                "port": 8080
+              },
+              "timeoutSeconds": 1
+            },
+            "resources": {
+              "limits": {
+                "cpu": "500m",
+                "memory": "512Mi"
+              },
+              "requests": {
+                "cpu": "50m",
+                "memory": "128Mi"
+              }
+            },
+            "securityContext": {
+              "allowPrivilegeEscalation": false,
+              "capabilities": {
+                "drop": [
+                  "ALL"
+                ]
+              },
+              "readOnlyRootFilesystem": true,
+              "runAsGroup": 1654,
+              "runAsNonRoot": true,
+              "runAsUser": 1654
+            },
+            "terminationMessagePath": "/dev/termination-log",
+            "terminationMessagePolicy": "File",
+            "volumeMounts": [
+              {
+                "mountPath": "/tmp",
+                "name": "tmp"
+              },
+              {
+                "mountPath": "/app/logs",
+                "name": "logs"
+              }
+            ]
+          }
+        ],
+        "dnsPolicy": "ClusterFirst",
+        "restartPolicy": "Always",
+        "schedulerName": "default-scheduler",
+        "securityContext": {
+          "fsGroup": 1654,
+          "fsGroupChangePolicy": "OnRootMismatch"
+        },
+        "serviceAccount": "fc-devicemgmt-operator",
+        "serviceAccountName": "fc-devicemgmt-operator",
+        "terminationGracePeriodSeconds": 30,
+        "volumes": [
+          {
+            "emptyDir": {},
+            "name": "tmp"
+          },
+          {
+            "emptyDir": {},
+            "name": "logs"
+          }
+        ]
+      }
+    }
+  }
+}

apps-gx10/fc-devicemgmt/deployment-fc-devicemgmt-web.json

@@ -0,0 +1,211 @@
+{
+  "apiVersion": "apps/v1",
+  "kind": "Deployment",
+  "metadata": {
+    "labels": {
+      "app": "fc-devicemgmt-web",
+      "app.kubernetes.io/component": "web",
+      "app.kubernetes.io/managed-by": "argocd",
+      "app.kubernetes.io/name": "fc-devicemgmt-web",
+      "app.kubernetes.io/part-of": "flowercore",
+      "flowercore.io/created-by": "bluejay-infra",
+      "flowercore.io/tenant-id": "system"
+    },
+    "name": "fc-devicemgmt-web",
+    "namespace": "fc-devicemgmt"
+  },
+  "spec": {
+    "progressDeadlineSeconds": 600,
+    "replicas": 1,
+    "revisionHistoryLimit": 3,
+    "selector": {
+      "matchLabels": {
+        "app": "fc-devicemgmt-web"
+      }
+    },
+    "strategy": {
+      "rollingUpdate": {
+        "maxSurge": 0,
+        "maxUnavailable": 1
+      },
+      "type": "RollingUpdate"
+    },
+    "template": {
+      "metadata": {
+        "annotations": {
+          "fc.flowercore.io/healthz-anon": "true",
+          "fc.flowercore.io/probe-path": "/healthz",
+          "flowercore.io/audit-trace-id": "runtime-activity-trace",
+          "kubectl.kubernetes.io/restartedAt": "2026-05-20T11:29:46-05:00",
+          "operator.1password.io/last-restarted": "2026-05-20T16:29:03Z",
+          "prometheus.io/path": "/metrics",
+          "prometheus.io/port": "8080",
+          "prometheus.io/scrape": "true"
+        },
+        "labels": {
+          "app": "fc-devicemgmt-web",
+          "app.kubernetes.io/component": "web",
+          "app.kubernetes.io/managed-by": "argocd",
+          "app.kubernetes.io/name": "fc-devicemgmt-web",
+          "app.kubernetes.io/part-of": "flowercore",
+          "flowercore.io/created-by": "bluejay-infra",
+          "flowercore.io/tenant-id": "system"
+        }
+      },
+      "spec": {
+        "containers": [
+          {
+            "env": [
+              {
+                "name": "ASPNETCORE_URLS",
+                "value": "http://+:8080"
+              },
+              {
+                "name": "ASPNETCORE_ENVIRONMENT",
+                "value": "Production"
+              },
+              {
+                "name": "DOTNET_SYSTEM_GLOBALIZATION_INVARIANT",
+                "value": "false"
+              },
+              {
+                "name": "HOME",
+                "value": "/data"
+              },
+              {
+                "name": "FlowerCore__Service__Name",
+                "value": "FlowerCore.DeviceManagement.Web"
+              },
+              {
+                "name": "FlowerCore__DeviceManagement__DefaultTenantId",
+                "value": "system"
+              },
+              {
+                "name": "FlowerCore__Database__Provider",
+                "value": "Sqlite"
+              },
+              {
+                "name": "FlowerCore__Database__ConnectionStrings__Sqlite",
+                "value": "Data Source=/data/devicemgmt.db"
+              },
+              {
+                "name": "FlowerCore__Database__Password",
+                "valueFrom": {
+                  "secretKeyRef": {
+                    "key": "DB-Password",
+                    "name": "fc-devicemgmt-runtime"
+                  }
+                }
+              },
+              {
+                "name": "FlowerCore__EventBus__Redis__Configuration",
+                "value": "redis.fc-redis.svc:6379"
+              }
+            ],
+            "image": "localhost/fc-devicemgmt-web:gx10-v1",
+            "imagePullPolicy": "Never",
+            "livenessProbe": {
+              "failureThreshold": 3,
+              "initialDelaySeconds": 30,
+              "periodSeconds": 30,
+              "successThreshold": 1,
+              "tcpSocket": {
+                "port": 8080
+              },
+              "timeoutSeconds": 1
+            },
+            "name": "web",
+            "ports": [
+              {
+                "containerPort": 8080,
+                "name": "http",
+                "protocol": "TCP"
+              }
+            ],
+            "readinessProbe": {
+              "failureThreshold": 3,
+              "periodSeconds": 10,
+              "successThreshold": 1,
+              "tcpSocket": {
+                "port": 8080
+              },
+              "timeoutSeconds": 1
+            },
+            "resources": {
+              "limits": {
+                "cpu": "1",
+                "memory": "768Mi"
+              },
+              "requests": {
+                "cpu": "100m",
+                "memory": "256Mi"
+              }
+            },
+            "securityContext": {
+              "allowPrivilegeEscalation": false,
+              "capabilities": {
+                "drop": [
+                  "ALL"
+                ]
+              },
+              "readOnlyRootFilesystem": true,
+              "runAsGroup": 1654,
+              "runAsNonRoot": true,
+              "runAsUser": 1654
+            },
+            "startupProbe": {
+              "failureThreshold": 30,
+              "initialDelaySeconds": 5,
+              "periodSeconds": 5,
+              "successThreshold": 1,
+              "tcpSocket": {
+                "port": 8080
+              },
+              "timeoutSeconds": 1
+            },
+            "terminationMessagePath": "/dev/termination-log",
+            "terminationMessagePolicy": "File",
+            "volumeMounts": [
+              {
+                "mountPath": "/data",
+                "name": "data"
+              },
+              {
+                "mountPath": "/tmp",
+                "name": "tmp"
+              },
+              {
+                "mountPath": "/app/logs",
+                "name": "logs"
+              }
+            ]
+          }
+        ],
+        "dnsPolicy": "ClusterFirst",
+        "restartPolicy": "Always",
+        "schedulerName": "default-scheduler",
+        "securityContext": {
+          "fsGroup": 1654,
+          "fsGroupChangePolicy": "OnRootMismatch"
+        },
+        "terminationGracePeriodSeconds": 30,
+        "volumes": [
+          {
+            "name": "data",
+            "persistentVolumeClaim": {
+              "claimName": "fc-devicemgmt-web-data"
+            }
+          },
+          {
+            "emptyDir": {},
+            "name": "tmp"
+          },
+          {
+            "emptyDir": {},
+            "name": "logs"
+          }
+        ]
+      }
+    }
+  }
+}

apps-gx10/fc-devicemgmt/ingressroute-devicemgmt.json

@@ -0,0 +1,28 @@
+{
+  "apiVersion": "traefik.io/v1alpha1",
+  "kind": "IngressRoute",
+  "metadata": {
+    "name": "devicemgmt",
+    "namespace": "fc-devicemgmt"
+  },
+  "spec": {
+    "entryPoints": [
+      "websecure"
+    ],
+    "routes": [
+      {
+        "kind": "Rule",
+        "match": "Host(`devices.iamworkin.lan`)",
+        "services": [
+          {
+            "name": "fc-devicemgmt-web",
+            "port": 80
+          }
+        ]
+      }
+    ],
+    "tls": {
+      "secretName": "fc-devicemgmt-web-tls"
+    }
+  }
+}

apps-gx10/fc-devicemgmt/service-fc-devicemgmt-web.json

@@ -0,0 +1,33 @@
+{
+  "apiVersion": "v1",
+  "kind": "Service",
+  "metadata": {
+    "labels": {
+      "app": "fc-devicemgmt-web",
+      "app.kubernetes.io/component": "web",
+      "app.kubernetes.io/managed-by": "argocd",
+      "app.kubernetes.io/name": "fc-devicemgmt-web",
+      "app.kubernetes.io/part-of": "flowercore",
+      "flowercore.io/created-by": "bluejay-infra",
+      "flowercore.io/tenant-id": "system"
+    },
+    "name": "fc-devicemgmt-web",
+    "namespace": "fc-devicemgmt"
+  },
+  "spec": {
+    "internalTrafficPolicy": "Cluster",
+    "ports": [
+      {
+        "name": "http",
+        "port": 80,
+        "protocol": "TCP",
+        "targetPort": 8080
+      }
+    ],
+    "selector": {
+      "app": "fc-devicemgmt-web"
+    },
+    "sessionAffinity": "None",
+    "type": "ClusterIP"
+  }
+}

apps-gx10/fc-devicemgmt/serviceaccount-fc-devicemgmt-operator.json

@@ -0,0 +1,16 @@
+{
+  "apiVersion": "v1",
+  "kind": "ServiceAccount",
+  "metadata": {
+    "labels": {
+      "app.kubernetes.io/component": "operator",
+      "app.kubernetes.io/managed-by": "argocd",
+      "app.kubernetes.io/name": "fc-devicemgmt-operator",
+      "app.kubernetes.io/part-of": "flowercore",
+      "flowercore.io/created-by": "bluejay-infra",
+      "flowercore.io/tenant-id": "system"
+    },
+    "name": "fc-devicemgmt-operator",
+    "namespace": "fc-devicemgmt"
+  }
+}

apps-gx10/fc-distribution/deployment-fc-distribution.json

@@ -0,0 +1,265 @@
+{
+  "apiVersion": "apps/v1",
+  "kind": "Deployment",
+  "metadata": {
+    "labels": {
+      "app.kubernetes.io/name": "fc-distribution",
+      "app.kubernetes.io/part-of": "flowercore"
+    },
+    "name": "fc-distribution",
+    "namespace": "fc-distribution"
+  },
+  "spec": {
+    "progressDeadlineSeconds": 600,
+    "replicas": 1,
+    "revisionHistoryLimit": 3,
+    "selector": {
+      "matchLabels": {
+        "app.kubernetes.io/name": "fc-distribution"
+      }
+    },
+    "strategy": {
+      "type": "Recreate"
+    },
+    "template": {
+      "metadata": {
+        "annotations": {
+          "flowercore.io/healthz-auth-policy": "allow-anonymous",
+          "prometheus.io/path": "/metrics",
+          "prometheus.io/port": "8080",
+          "prometheus.io/scrape": "true"
+        },
+        "labels": {
+          "app.kubernetes.io/name": "fc-distribution",
+          "app.kubernetes.io/part-of": "flowercore"
+        }
+      },
+      "spec": {
+        "containers": [
+          {
+            "env": [
+              {
+                "name": "ASPNETCORE_URLS",
+                "value": "http://+:8080"
+              },
+              {
+                "name": "ASPNETCORE_ENVIRONMENT",
+                "value": "Production"
+              },
+              {
+                "name": "DOTNET_SYSTEM_GLOBALIZATION_INVARIANT",
+                "value": "false"
+              },
+              {
+                "name": "FlowerCore__Auth__Enabled",
+                "value": "true"
+              },
+              {
+                "name": "FlowerCore__Auth__Oidc__Enabled",
+                "value": "true"
+              },
+              {
+                "name": "FlowerCore__Auth__Oidc__Authority",
+                "value": "https://id.iamworkin.lan/application/o/distribution/"
+              },
+              {
+                "name": "FlowerCore__Auth__Oidc__Audience",
+                "value": "distribution"
+              },
+              {
+                "name": "FlowerCore__Auth__Oidc__ClientId",
+                "value": "distribution"
+              },
+              {
+                "name": "FlowerCore__Auth__Oidc__ClientSecret",
+                "valueFrom": {
+                  "secretKeyRef": {
+                    "key": "client_secret",
+                    "name": "distribution-oidc-client",
+                    "optional": true
+                  }
+                }
+              },
+              {
+                "name": "FlowerCore__Database__Provider",
+                "value": "Sqlite"
+              },
+              {
+                "name": "FlowerCore__Database__ConnectionStrings__Sqlite",
+                "value": "Data Source=/data/distribution.db"
+              },
+              {
+                "name": "FlowerCore__Distribution__Blobs__Root",
+                "value": "/blobs"
+              },
+              {
+                "name": "FlowerCore__Distribution__Signing__EditionCerts__kiosk-standard__CertPath",
+                "value": "/signing/kiosk-standard/chain.pem"
+              },
+              {
+                "name": "FlowerCore__Distribution__Signing__EditionCerts__kiosk-standard__KeyPath",
+                "value": "/signing/kiosk-standard/private-key.pem"
+              },
+              {
+                "name": "FlowerCore__Distribution__Signing__EditionCerts__aistation-field__CertPath",
+                "value": "/signing/aistation-field/chain.pem"
+              },
+              {
+                "name": "FlowerCore__Distribution__Signing__EditionCerts__aistation-field__KeyPath",
+                "value": "/signing/aistation-field/private-key.pem"
+              },
+              {
+                "name": "FlowerCore__Distribution__EntitlementPublic__PublicEditions__0",
+                "value": "*"
+              }
+            ],
+            "image": "localhost/fc-distribution:gx10-v1",
+            "imagePullPolicy": "Never",
+            "livenessProbe": {
+              "failureThreshold": 3,
+              "initialDelaySeconds": 30,
+              "periodSeconds": 30,
+              "successThreshold": 1,
+              "tcpSocket": {
+                "port": 8080
+              },
+              "timeoutSeconds": 1
+            },
+            "name": "web",
+            "ports": [
+              {
+                "containerPort": 8080,
+                "name": "http",
+                "protocol": "TCP"
+              }
+            ],
+            "readinessProbe": {
+              "failureThreshold": 3,
+              "httpGet": {
+                "path": "/healthz",
+                "port": 8080,
+                "scheme": "HTTP"
+              },
+              "periodSeconds": 10,
+              "successThreshold": 1,
+              "timeoutSeconds": 1
+            },
+            "resources": {
+              "limits": {
+                "cpu": "500m",
+                "memory": "512Mi"
+              },
+              "requests": {
+                "cpu": "100m",
+                "memory": "256Mi"
+              }
+            },
+            "securityContext": {
+              "allowPrivilegeEscalation": false,
+              "capabilities": {
+                "drop": [
+                  "ALL"
+                ]
+              },
+              "readOnlyRootFilesystem": true,
+              "runAsGroup": 1654,
+              "runAsNonRoot": true,
+              "runAsUser": 1654
+            },
+            "startupProbe": {
+              "failureThreshold": 30,
+              "httpGet": {
+                "path": "/healthz",
+                "port": 8080,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 5,
+              "periodSeconds": 5,
+              "successThreshold": 1,
+              "timeoutSeconds": 1
+            },
+            "terminationMessagePath": "/dev/termination-log",
+            "terminationMessagePolicy": "File",
+            "volumeMounts": [
+              {
+                "mountPath": "/data",
+                "name": "sqlite",
+                "subPath": "distribution/data"
+              },
+              {
+                "mountPath": "/blobs",
+                "name": "blobs",
+                "subPath": "distribution/blobs"
+              },
+              {
+                "mountPath": "/tmp",
+                "name": "tmp"
+              },
+              {
+                "mountPath": "/app/logs",
+                "name": "logs"
+              },
+              {
+                "mountPath": "/signing/kiosk-standard",
+                "name": "kiosk-standard",
+                "readOnly": true
+              },
+              {
+                "mountPath": "/signing/aistation-field",
+                "name": "aistation-field",
+                "readOnly": true
+              }
+            ]
+          }
+        ],
+        "dnsPolicy": "ClusterFirst",
+        "restartPolicy": "Always",
+        "schedulerName": "default-scheduler",
+        "securityContext": {
+          "fsGroup": 1654,
+          "fsGroupChangePolicy": "OnRootMismatch",
+          "runAsNonRoot": true
+        },
+        "terminationGracePeriodSeconds": 30,
+        "volumes": [
+          {
+            "name": "sqlite",
+            "nfs": {
+              "path": "/volume1/kubernetes",
+              "server": "10.0.58.3"
+            }
+          },
+          {
+            "name": "blobs",
+            "nfs": {
+              "path": "/volume1/kubernetes",
+              "server": "10.0.58.3"
+            }
+          },
+          {
+            "emptyDir": {},
+            "name": "tmp"
+          },
+          {
+            "emptyDir": {},
+            "name": "logs"
+          },
+          {
+            "name": "kiosk-standard",
+            "secret": {
+              "defaultMode": 256,
+              "secretName": "edition-kiosk-standard"
+            }
+          },
+          {
+            "name": "aistation-field",
+            "secret": {
+              "defaultMode": 256,
+              "secretName": "edition-aistation-field"
+            }
+          }
+        ]
+      }
+    }
+  }
+}

apps-gx10/fc-distribution/ingressroute-fc-distribution-public.json

@@ -0,0 +1,29 @@
+{
+  "apiVersion": "traefik.io/v1alpha1",
+  "kind": "IngressRoute",
+  "metadata": {
+    "name": "fc-distribution-public",
+    "namespace": "fc-distribution"
+  },
+  "spec": {
+    "entryPoints": [
+      "websecure"
+    ],
+    "routes": [
+      {
+        "kind": "Rule",
+        "match": "Host(`dist.flowercore.io`) && (Method(`GET`) || Method(`HEAD`))",
+        "priority": 100,
+        "services": [
+          {
+            "name": "fc-distribution",
+            "port": 80
+          }
+        ]
+      }
+    ],
+    "tls": {
+      "secretName": "cf-origin-flowercore-io"
+    }
+  }
+}

apps-gx10/fc-distribution/ingressroute-fc-distribution.json

@@ -0,0 +1,29 @@
+{
+  "apiVersion": "traefik.io/v1alpha1",
+  "kind": "IngressRoute",
+  "metadata": {
+    "name": "fc-distribution",
+    "namespace": "fc-distribution"
+  },
+  "spec": {
+    "entryPoints": [
+      "websecure"
+    ],
+    "routes": [
+      {
+        "kind": "Rule",
+        "match": "Host(`dist.iamworkin.lan`)",
+        "priority": 100,
+        "services": [
+          {
+            "name": "fc-distribution",
+            "port": 80
+          }
+        ]
+      }
+    ],
+    "tls": {
+      "secretName": "fc-distribution-tls-secret"
+    }
+  }
+}

apps-gx10/fc-distribution/service-fc-distribution.json

@@ -0,0 +1,28 @@
+{
+  "apiVersion": "v1",
+  "kind": "Service",
+  "metadata": {
+    "labels": {
+      "app.kubernetes.io/name": "fc-distribution",
+      "app.kubernetes.io/part-of": "flowercore"
+    },
+    "name": "fc-distribution",
+    "namespace": "fc-distribution"
+  },
+  "spec": {
+    "internalTrafficPolicy": "Cluster",
+    "ports": [
+      {
+        "name": "http",
+        "port": 80,
+        "protocol": "TCP",
+        "targetPort": 8080
+      }
+    ],
+    "selector": {
+      "app.kubernetes.io/name": "fc-distribution"
+    },
+    "sessionAffinity": "None",
+    "type": "ClusterIP"
+  }
+}

apps-gx10/fc-dms/configmap-dms-web-config.json

@@ -0,0 +1,28 @@
+{
+  "apiVersion": "v1",
+  "data": {
+    "ASPNETCORE_ENVIRONMENT": "Production",
+    "ASPNETCORE_FORWARDEDHEADERS_ENABLED": "true",
+    "ASPNETCORE_URLS": "http://+:8080",
+    "Dms__AutoMessageDaemon__PollIntervalMinutes": "5",
+    "Dms__Weather__CacheFilePath": "/data/noaa-cache.json",
+    "Dms__Weather__State": "MN",
+    "FlowerCore__Auth__AcceptLegacyApiKey": "true",
+    "FlowerCore__Auth__AcceptLegacyJwt": "false",
+    "FlowerCore__Auth__Provider": "Oidc",
+    "FlowerCore__Auth__RoleClaimType": "fc:roles",
+    "FlowerCore__Database__ConnectionStrings__Sqlite": "Data Source=/data/dms.db",
+    "FlowerCore__Database__Provider": "Sqlite",
+    "FlowerCore__Tenant__DefaultTenantHosts__0": "dms.iamworkin.lan",
+    "FlowerCore__Tenant__JwtClaimsEnabled": "false",
+    "OTEL_EXPORTER_OTLP_ENDPOINT": "http://otel-collector.monitoring.svc.cluster.local:4317",
+    "OTEL_EXPORTER_OTLP_PROTOCOL": "grpc",
+    "OTEL_SERVICE_NAME": "FlowerCore.DMS",
+    "Security__AllowedOrigins__0": "https://dms.iamworkin.lan"
+  },
+  "kind": "ConfigMap",
+  "metadata": {
+    "name": "dms-web-config",
+    "namespace": "fc-dms"
+  }
+}

apps-gx10/fc-dms/deployment-dms-web.json

@@ -0,0 +1,169 @@
+{
+  "apiVersion": "apps/v1",
+  "kind": "Deployment",
+  "metadata": {
+    "labels": {
+      "app.kubernetes.io/name": "dms-web",
+      "app.kubernetes.io/part-of": "flowercore"
+    },
+    "name": "dms-web",
+    "namespace": "fc-dms"
+  },
+  "spec": {
+    "progressDeadlineSeconds": 600,
+    "replicas": 1,
+    "revisionHistoryLimit": 10,
+    "selector": {
+      "matchLabels": {
+        "app.kubernetes.io/name": "dms-web"
+      }
+    },
+    "strategy": {
+      "type": "Recreate"
+    },
+    "template": {
+      "metadata": {
+        "annotations": {
+          "kubectl.kubernetes.io/restartedAt": "2026-06-12T16:05:19-05:00",
+          "prometheus.io/path": "/metrics/prometheus",
+          "prometheus.io/port": "8080",
+          "prometheus.io/scrape": "true"
+        },
+        "labels": {
+          "app.kubernetes.io/name": "dms-web",
+          "app.kubernetes.io/part-of": "flowercore"
+        }
+      },
+      "spec": {
+        "containers": [
+          {
+            "env": [
+              {
+                "name": "Kestrel__Endpoints__Http__Url",
+                "value": "http://+:8080"
+              },
+              {
+                "name": "Kestrel__Endpoints__Http__Protocols",
+                "value": "Http1"
+              },
+              {
+                "name": "Kestrel__Endpoints__Grpc__Url",
+                "value": "http://+:8081"
+              },
+              {
+                "name": "Kestrel__Endpoints__Grpc__Protocols",
+                "value": "Http2"
+              },
+              {
+                "name": "FlowerCore__Auth__OidcClientId",
+                "valueFrom": {
+                  "secretKeyRef": {
+                    "key": "client_id",
+                    "name": "dms-oidc-client",
+                    "optional": true
+                  }
+                }
+              },
+              {
+                "name": "FlowerCore__Auth__OidcClientSecret",
+                "valueFrom": {
+                  "secretKeyRef": {
+                    "key": "client_secret",
+                    "name": "dms-oidc-client",
+                    "optional": true
+                  }
+                }
+              },
+              {
+                "name": "FlowerCore__Auth__OidcAuthority",
+                "valueFrom": {
+                  "secretKeyRef": {
+                    "key": "issuer_url",
+                    "name": "dms-oidc-client",
+                    "optional": true
+                  }
+                }
+              }
+            ],
+            "envFrom": [
+              {
+                "configMapRef": {
+                  "name": "dms-web-config"
+                }
+              },
+              {
+                "secretRef": {
+                  "name": "dms-web-secrets"
+                }
+              }
+            ],
+            "image": "localhost/fc-dms-web:gx10-v1",
+            "imagePullPolicy": "Never",
+            "livenessProbe": {
+              "failureThreshold": 3,
+              "httpGet": {
+                "path": "/health",
+                "port": 8080,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 180,
+              "periodSeconds": 30,
+              "successThreshold": 1,
+              "timeoutSeconds": 5
+            },
+            "name": "dms-web",
+            "ports": [
+              {
+                "containerPort": 8080,
+                "name": "http",
+                "protocol": "TCP"
+              },
+              {
+                "containerPort": 8081,
+                "name": "grpc",
+                "protocol": "TCP"
+              }
+            ],
+            "readinessProbe": {
+              "failureThreshold": 18,
+              "httpGet": {
+                "path": "/health",
+                "port": 8080,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 30,
+              "periodSeconds": 10,
+              "successThreshold": 1,
+              "timeoutSeconds": 5
+            },
+            "resources": {},
+            "terminationMessagePath": "/dev/termination-log",
+            "terminationMessagePolicy": "File",
+            "volumeMounts": [
+              {
+                "mountPath": "/data",
+                "name": "data"
+              }
+            ]
+          }
+        ],
+        "dnsPolicy": "ClusterFirst",
+        "restartPolicy": "Always",
+        "schedulerName": "default-scheduler",
+        "securityContext": {
+          "fsGroup": 1654,
+          "fsGroupChangePolicy": "OnRootMismatch"
+        },
+        "terminationGracePeriodSeconds": 30,
+        "volumes": [
+          {
+            "name": "data",
+            "persistentVolumeClaim": {
+              "claimName": "dms-web-data"
+            }
+          }
+        ]
+      }
+    }
+  }
+}

apps-gx10/fc-dms/ingressroute-dms-web.json

@@ -0,0 +1,29 @@
+{
+  "apiVersion": "traefik.io/v1alpha1",
+  "kind": "IngressRoute",
+  "metadata": {
+    "name": "dms-web",
+    "namespace": "fc-dms"
+  },
+  "spec": {
+    "entryPoints": [
+      "websecure"
+    ],
+    "routes": [
+      {
+        "kind": "Rule",
+        "match": "Host(`dms.iamworkin.lan`)",
+        "priority": 100,
+        "services": [
+          {
+            "name": "dms-web",
+            "port": 80
+          }
+        ]
+      }
+    ],
+    "tls": {
+      "secretName": "dms-web-tls"
+    }
+  }
+}

apps-gx10/fc-dms/service-dms-web.json

@@ -0,0 +1,34 @@
+{
+  "apiVersion": "v1",
+  "kind": "Service",
+  "metadata": {
+    "labels": {
+      "app.kubernetes.io/name": "dms-web",
+      "app.kubernetes.io/part-of": "flowercore"
+    },
+    "name": "dms-web",
+    "namespace": "fc-dms"
+  },
+  "spec": {
+    "internalTrafficPolicy": "Cluster",
+    "ports": [
+      {
+        "name": "http",
+        "port": 80,
+        "protocol": "TCP",
+        "targetPort": 8080
+      },
+      {
+        "name": "grpc",
+        "port": 8081,
+        "protocol": "TCP",
+        "targetPort": 8081
+      }
+    ],
+    "selector": {
+      "app.kubernetes.io/name": "dms-web"
+    },
+    "sessionAffinity": "None",
+    "type": "ClusterIP"
+  }
+}

apps-gx10/fc-dns/fc-dns.yaml

@@ -0,0 +1,542 @@
+---
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: fc-dns
+  labels:
+    app.kubernetes.io/part-of: flowercore
+---
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: dns-web-data
+  namespace: fc-dns
+spec:
+  accessModes:
+    - ReadWriteOnce
+  storageClassName: local-path
+  resources:
+    requests:
+      storage: 1Gi
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: dns-web-config
+  namespace: fc-dns
+data:
+  appsettings.Production.json: |
+    {
+      "FlowerCore": {
+        "Auth": {
+          "Enabled": true,
+          "Oidc": {
+            "Enabled": true,
+            "Audience": "dns",
+            "RequireHttpsMetadata": true
+          }
+        },
+        "Database": {
+          "Provider": "Sqlite",
+          "ConnectionStrings": {
+            "Sqlite": "Data Source=/data/dns.db"
+          }
+        },
+        "Tenant": {
+          "DefaultTenantId": "default",
+          "JwtClaimsEnabled": true,
+          "DefaultTenantHosts": [
+            "dns.iamworkin.lan"
+          ]
+        },
+        "Audit": {
+          "HashChain": {
+            "BridgeSensitivity": {
+              "Distribution": "Warn"
+            }
+          }
+        },
+        "Dns": {
+          "RateLimits": {
+            "PermitLimit": 60,
+            "WindowSeconds": 60,
+            "QueueLimit": 0
+          }
+        }
+      }
+    }
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: dns-web
+  namespace: fc-dns
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: dns-web
+rules:
+  - apiGroups:
+      - ""
+    resources:
+      - namespaces
+      - pods
+      - services
+      - secrets
+      - configmaps
+    verbs:
+      - get
+      - list
+      - watch
+  - apiGroups:
+      - cert-manager.io
+    resources:
+      - certificates
+    verbs:
+      - get
+      - list
+      - watch
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: dns-web
+subjects:
+  - kind: ServiceAccount
+    name: dns-web
+    namespace: fc-dns
+roleRef:
+  kind: ClusterRole
+  name: dns-web
+  apiGroup: rbac.authorization.k8s.io
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dns-web
+  namespace: fc-dns
+  labels:
+    app: dns-web
+    app.kubernetes.io/name: dns-web
+    app.kubernetes.io/part-of: flowercore
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: dns-web
+  template:
+    metadata:
+      labels:
+        app: dns-web
+        app.kubernetes.io/name: dns-web
+        app.kubernetes.io/part-of: flowercore
+      annotations:
+        prometheus.io/scrape: "true"
+        prometheus.io/port: "5320"
+        prometheus.io/path: "/metrics/prometheus"
+        flowercore.io/source-sha: "0cdea666a09dea526fb701d06c2ce17b90664a0f"
+    spec:
+      serviceAccountName: dns-web
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1654
+        runAsGroup: 1654
+        fsGroup: 1654
+        fsGroupChangePolicy: OnRootMismatch
+      containers:
+        - name: dns-web
+          image: localhost/fc-dns-web:v20260617-sec5-0cdea66
+          imagePullPolicy: Never
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          ports:
+            - containerPort: 5320
+              name: http
+          env:
+            - name: ASPNETCORE_URLS
+              value: http://+:5320
+            - name: ASPNETCORE_ENVIRONMENT
+              value: Production
+            - name: FlowerCore__Dns__Providers__PfSenseUnbound__FallbackPassword
+              valueFrom:
+                secretKeyRef:
+                  name: pfsense-admin
+                  key: password
+            - name: FlowerCore__Auth__Oidc__Authority
+              valueFrom:
+                secretKeyRef:
+                  name: dns-oidc-client
+                  key: issuer_url
+                  optional: true
+            - name: FlowerCore__Auth__Oidc__ClientId
+              valueFrom:
+                secretKeyRef:
+                  name: dns-oidc-client
+                  key: client_id
+                  optional: true
+            - name: FlowerCore__Auth__Oidc__ClientSecret
+              valueFrom:
+                secretKeyRef:
+                  name: dns-oidc-client
+                  key: client_secret
+                  optional: true
+            - name: FlowerCore__Auth__ApiKey
+              valueFrom:
+                secretKeyRef:
+                  name: dns-api-keys
+                  key: api_key
+                  optional: true
+            - name: FlowerCore__Mcp__ApiKey__Key
+              valueFrom:
+                secretKeyRef:
+                  name: dns-api-keys
+                  key: api_key
+                  optional: true
+            - name: FlowerCore__Mcp__ServiceName
+              value: flowercore.dns
+            - name: FlowerCore__Auth__Enabled
+              value: "true"
+            - name: FlowerCore__Auth__Oidc__Enabled
+              value: "true"
+            - name: FlowerCore__Auth__Oidc__Audience
+              value: dns
+          volumeMounts:
+            - name: data
+              mountPath: /data
+            - name: tmp
+              mountPath: /tmp
+            - name: logs
+              mountPath: /app/logs
+            - name: config
+              mountPath: /app/appsettings.Production.json
+              subPath: appsettings.Production.json
+              readOnly: true
+          resources:
+            requests:
+              cpu: 50m
+              memory: 96Mi
+            limits:
+              cpu: 300m
+              memory: 384Mi
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: 5320
+            initialDelaySeconds: 10
+            periodSeconds: 10
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: 5320
+            initialDelaySeconds: 20
+            periodSeconds: 30
+      volumes:
+        - name: data
+          persistentVolumeClaim:
+            claimName: dns-web-data
+        - name: tmp
+          emptyDir: {}
+        - name: logs
+          emptyDir: {}
+        - name: config
+          configMap:
+            name: dns-web-config
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: dns-web
+  namespace: fc-dns
+spec:
+  selector:
+    app: dns-web
+  ports:
+    - port: 5320
+      targetPort: 5320
+      name: http
+  type: ClusterIP
+---
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: dns-web-ingress-isolation
+  namespace: fc-dns
+spec:
+  podSelector:
+    matchLabels:
+      app: dns-web
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: traefik-system
+          podSelector:
+            matchLabels:
+              app.kubernetes.io/name: traefik
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: fc-dns
+        - ipBlock:
+            cidr: 10.42.0.0/16
+        - ipBlock:
+            cidr: 10.0.56.0/24
+        - ipBlock:
+            cidr: 10.0.57.0/24
+        - ipBlock:
+            cidr: 10.0.58.0/24
+        - ipBlock:
+            cidr: 10.0.68.0/27
+      ports:
+        - port: 5320
+          protocol: TCP
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: dns-web-cert
+  namespace: fc-dns
+spec:
+  secretName: dns-web-tls
+  issuerRef:
+    name: step-ca-acme
+    kind: ClusterIssuer
+  dnsNames:
+    - dns.iamworkin.lan
+---
+apiVersion: traefik.io/v1alpha1
+kind: IngressRoute
+metadata:
+  name: dns-web
+  namespace: fc-dns
+spec:
+  entryPoints:
+    - websecure
+  routes:
+    - match: Host(`dns.iamworkin.lan`)
+      kind: Rule
+      priority: 100
+      services:
+        - name: dns-web
+          port: 5320
+  tls:
+    secretName: dns-web-tls
+---
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: dns-acme-webhook
+  namespace: fc-dns
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: dns-acme-webhook
+  namespace: fc-dns
+  labels:
+    app: dns-acme-webhook
+    app.kubernetes.io/name: dns-acme-webhook
+    app.kubernetes.io/part-of: flowercore
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: dns-acme-webhook
+  template:
+    metadata:
+      labels:
+        app: dns-acme-webhook
+        app.kubernetes.io/name: dns-acme-webhook
+        app.kubernetes.io/part-of: flowercore
+      annotations:
+        flowercore.io/source-sha: "0cdea666a09dea526fb701d06c2ce17b90664a0f"
+    spec:
+      serviceAccountName: dns-acme-webhook
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1654
+        runAsGroup: 1654
+        fsGroup: 1654
+        fsGroupChangePolicy: OnRootMismatch
+      containers:
+        - name: dns-acme-webhook
+          image: localhost/fc-dns-acme-webhook:v20260617-sec5-0cdea66
+          imagePullPolicy: Never
+          securityContext:
+            readOnlyRootFilesystem: true
+            allowPrivilegeEscalation: false
+            capabilities:
+              drop:
+                - ALL
+          ports:
+            - containerPort: 9443
+              name: https
+          env:
+            - name: ASPNETCORE_URLS
+              value: https://+:9443
+            - name: ASPNETCORE_ENVIRONMENT
+              value: Production
+            - name: Kestrel__Certificates__Default__Path
+              value: /tls/tls.crt
+            - name: Kestrel__Certificates__Default__KeyPath
+              value: /tls/tls.key
+            - name: FlowerCore__Dns__AcmeWebhook__ServiceBaseUrl
+              value: http://dns-web:5320
+            - name: FlowerCore__Dns__AcmeWebhook__ApiKey
+              valueFrom:
+                secretKeyRef:
+                  name: dns-api-keys
+                  key: api_key
+                  optional: true
+            - name: FlowerCore__Dns__AcmeWebhook__GroupName
+              value: acme.flowercore.io
+            - name: FlowerCore__Dns__AcmeWebhook__SolverName
+              value: flowercore-dns
+            - name: FlowerCore__Dns__AcmeWebhook__Version
+              value: v1alpha1
+          volumeMounts:
+            - name: tls
+              mountPath: /tls
+              readOnly: true
+            - name: tmp
+              mountPath: /tmp
+            - name: logs
+              mountPath: /app/logs
+          resources:
+            requests:
+              cpu: 25m
+              memory: 64Mi
+            limits:
+              cpu: 200m
+              memory: 256Mi
+          readinessProbe:
+            httpGet:
+              scheme: HTTPS
+              path: /readyz
+              port: https
+            initialDelaySeconds: 5
+            periodSeconds: 10
+            timeoutSeconds: 5
+          livenessProbe:
+            httpGet:
+              scheme: HTTPS
+              path: /healthz
+              port: https
+            initialDelaySeconds: 10
+            periodSeconds: 20
+            timeoutSeconds: 5
+      volumes:
+        - name: tls
+          secret:
+            secretName: dns-acme-webhook-tls
+        - name: tmp
+          emptyDir: {}
+        - name: logs
+          emptyDir: {}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: dns-acme-webhook
+  namespace: fc-dns
+spec:
+  selector:
+    app: dns-acme-webhook
+  ports:
+    - port: 443
+      targetPort: https
+      name: https
+  type: ClusterIP
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: dns-acme-webhook-selfsigned
+  namespace: fc-dns
+spec:
+  selfSigned: {}
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: dns-acme-webhook-ca
+  namespace: fc-dns
+spec:
+  secretName: dns-acme-webhook-ca
+  duration: 43800h
+  issuerRef:
+    name: dns-acme-webhook-selfsigned
+  commonName: ca.dns-acme-webhook.fc-dns
+  isCA: true
+---
+apiVersion: cert-manager.io/v1
+kind: Issuer
+metadata:
+  name: dns-acme-webhook-ca-issuer
+  namespace: fc-dns
+spec:
+  ca:
+    secretName: dns-acme-webhook-ca
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: dns-acme-webhook-serving-cert
+  namespace: fc-dns
+spec:
+  secretName: dns-acme-webhook-tls
+  duration: 8760h
+  issuerRef:
+    name: dns-acme-webhook-ca-issuer
+  dnsNames:
+    - dns-acme-webhook
+    - dns-acme-webhook.fc-dns
+    - dns-acme-webhook.fc-dns.svc
+---
+apiVersion: apiregistration.k8s.io/v1
+kind: APIService
+metadata:
+  name: v1alpha1.acme.flowercore.io
+  annotations:
+    cert-manager.io/inject-ca-from: fc-dns/dns-acme-webhook-serving-cert
+spec:
+  group: acme.flowercore.io
+  groupPriorityMinimum: 1000
+  service:
+    name: dns-acme-webhook
+    namespace: fc-dns
+  version: v1alpha1
+  versionPriority: 15
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRole
+metadata:
+  name: dns-acme-webhook-solver
+rules:
+  - apiGroups:
+      - acme.flowercore.io
+    resources:
+      - flowercore-dns
+    verbs:
+      - create
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: ClusterRoleBinding
+metadata:
+  name: dns-acme-webhook-solver
+subjects:
+  - kind: ServiceAccount
+    name: cert-manager
+    namespace: cert-manager
+roleRef:
+  kind: ClusterRole
+  name: dns-acme-webhook-solver
+  apiGroup: rbac.authorization.k8s.io

apps-gx10/fc-library/configmap-library-web-config.json

@@ -0,0 +1,20 @@
+{
+  "apiVersion": "v1",
+  "data": {
+    "ASPNETCORE_ENVIRONMENT": "Production",
+    "ASPNETCORE_FORWARDEDHEADERS_ENABLED": "true",
+    "ASPNETCORE_URLS": "http://+:5000",
+    "FlowerCore__Database__ConnectionStrings__Sqlite": "Data Source=/data/library.db",
+    "FlowerCore__Database__Provider": "Sqlite",
+    "FlowerCore__Library__BaseUrl": "https://library.iamworkin.lan",
+    "OTEL_EXPORTER_OTLP_ENDPOINT": "http://otel-collector.monitoring.svc.cluster.local:4317",
+    "OTEL_EXPORTER_OTLP_PROTOCOL": "grpc",
+    "OTEL_SERVICE_NAME": "FlowerCore.Library",
+    "PrintService__BaseUrl": "http://print.iamworkin.lan:5200"
+  },
+  "kind": "ConfigMap",
+  "metadata": {
+    "name": "library-web-config",
+    "namespace": "fc-library"
+  }
+}

apps-gx10/fc-library/deployment-library-web.json

@@ -0,0 +1,110 @@
+{
+  "apiVersion": "apps/v1",
+  "kind": "Deployment",
+  "metadata": {
+    "labels": {
+      "app.kubernetes.io/managed-by": "argocd",
+      "app.kubernetes.io/name": "library-web",
+      "app.kubernetes.io/part-of": "flowercore"
+    },
+    "name": "library-web",
+    "namespace": "fc-library"
+  },
+  "spec": {
+    "progressDeadlineSeconds": 600,
+    "replicas": 1,
+    "revisionHistoryLimit": 3,
+    "selector": {
+      "matchLabels": {
+        "app.kubernetes.io/name": "library-web"
+      }
+    },
+    "strategy": {
+      "type": "Recreate"
+    },
+    "template": {
+      "metadata": {
+        "annotations": {
+          "fc.flowercore.io/healthz-anon": "true",
+          "fc.flowercore.io/probe-path": "/health",
+          "prometheus.io/path": "/metrics/prometheus",
+          "prometheus.io/port": "5000",
+          "prometheus.io/scrape": "true"
+        },
+        "labels": {
+          "app.kubernetes.io/name": "library-web",
+          "app.kubernetes.io/part-of": "flowercore"
+        }
+      },
+      "spec": {
+        "containers": [
+          {
+            "envFrom": [
+              {
+                "configMapRef": {
+                  "name": "library-web-config"
+                }
+              }
+            ],
+            "image": "localhost/fc-library-web:gx10-v1",
+            "imagePullPolicy": "Never",
+            "livenessProbe": {
+              "failureThreshold": 3,
+              "httpGet": {
+                "path": "/health",
+                "port": 5000,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 30,
+              "periodSeconds": 30,
+              "successThreshold": 1,
+              "timeoutSeconds": 5
+            },
+            "name": "library-web",
+            "ports": [
+              {
+                "containerPort": 5000,
+                "name": "http",
+                "protocol": "TCP"
+              }
+            ],
+            "readinessProbe": {
+              "failureThreshold": 6,
+              "httpGet": {
+                "path": "/health",
+                "port": 5000,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 10,
+              "periodSeconds": 10,
+              "successThreshold": 1,
+              "timeoutSeconds": 5
+            },
+            "resources": {},
+            "terminationMessagePath": "/dev/termination-log",
+            "terminationMessagePolicy": "File",
+            "volumeMounts": [
+              {
+                "mountPath": "/data",
+                "name": "data"
+              }
+            ]
+          }
+        ],
+        "dnsPolicy": "ClusterFirst",
+        "restartPolicy": "Always",
+        "schedulerName": "default-scheduler",
+        "securityContext": {},
+        "terminationGracePeriodSeconds": 30,
+        "volumes": [
+          {
+            "name": "data",
+            "persistentVolumeClaim": {
+              "claimName": "library-web-data"
+            }
+          }
+        ]
+      }
+    }
+  }
+}

apps-gx10/fc-library/ingressroute-library-web.json

@@ -0,0 +1,29 @@
+{
+  "apiVersion": "traefik.io/v1alpha1",
+  "kind": "IngressRoute",
+  "metadata": {
+    "name": "library-web",
+    "namespace": "fc-library"
+  },
+  "spec": {
+    "entryPoints": [
+      "websecure"
+    ],
+    "routes": [
+      {
+        "kind": "Rule",
+        "match": "Host(`library.iamworkin.lan`)",
+        "priority": 100,
+        "services": [
+          {
+            "name": "library-web",
+            "port": 80
+          }
+        ]
+      }
+    ],
+    "tls": {
+      "secretName": "library-web-tls"
+    }
+  }
+}

apps-gx10/fc-library/service-library-web.json

@@ -0,0 +1,29 @@
+{
+  "apiVersion": "v1",
+  "kind": "Service",
+  "metadata": {
+    "labels": {
+      "app.kubernetes.io/managed-by": "argocd",
+      "app.kubernetes.io/name": "library-web",
+      "app.kubernetes.io/part-of": "flowercore"
+    },
+    "name": "library-web",
+    "namespace": "fc-library"
+  },
+  "spec": {
+    "internalTrafficPolicy": "Cluster",
+    "ports": [
+      {
+        "name": "http",
+        "port": 80,
+        "protocol": "TCP",
+        "targetPort": 5000
+      }
+    ],
+    "selector": {
+      "app.kubernetes.io/name": "library-web"
+    },
+    "sessionAffinity": "None",
+    "type": "ClusterIP"
+  }
+}

apps-gx10/fc-llm-bridge/deployment-fc-llm-bridge.json

@@ -0,0 +1,292 @@
+{
+  "apiVersion": "apps/v1",
+  "kind": "Deployment",
+  "metadata": {
+    "labels": {
+      "app.kubernetes.io/name": "fc-llm-bridge",
+      "app.kubernetes.io/part-of": "flowercore"
+    },
+    "name": "fc-llm-bridge",
+    "namespace": "fc-llm-bridge"
+  },
+  "spec": {
+    "progressDeadlineSeconds": 600,
+    "replicas": 1,
+    "revisionHistoryLimit": 3,
+    "selector": {
+      "matchLabels": {
+        "app.kubernetes.io/name": "fc-llm-bridge"
+      }
+    },
+    "strategy": {
+      "type": "Recreate"
+    },
+    "template": {
+      "metadata": {
+        "annotations": {
+          "fc.flowercore.io/healthz-anon": "true",
+          "fc.flowercore.io/probe-path": "/healthz",
+          "kubectl.kubernetes.io/restartedAt": "2026-06-14T15:12:25-05:00",
+          "prometheus.io/path": "/metrics",
+          "prometheus.io/port": "8080",
+          "prometheus.io/scrape": "true"
+        },
+        "labels": {
+          "app.kubernetes.io/name": "fc-llm-bridge",
+          "app.kubernetes.io/part-of": "flowercore"
+        }
+      },
+      "spec": {
+        "containers": [
+          {
+            "env": [
+              {
+                "name": "ASPNETCORE_URLS",
+                "value": "http://+:8080"
+              },
+              {
+                "name": "ASPNETCORE_ENVIRONMENT",
+                "value": "Production"
+              },
+              {
+                "name": "DOTNET_SYSTEM_GLOBALIZATION_INVARIANT",
+                "value": "false"
+              },
+              {
+                "name": "FlowerCore__LlmBridge__SqliteConnectionString",
+                "value": "Data Source=/data/llm-bridge.db"
+              },
+              {
+                "name": "FlowerCore__LlmBridge__DefaultTenantId",
+                "value": "default"
+              },
+              {
+                "name": "FlowerCore__LlmBridge__DefaultAppName",
+                "value": "agent-zero"
+              },
+              {
+                "name": "FlowerCore__LlmBridge__UtilModel",
+                "value": "qwen2.5:1.5b"
+              },
+              {
+                "name": "FlowerCore__LlmBridge__EmbedModel",
+                "value": "nomic-embed-text"
+              },
+              {
+                "name": "FlowerCore__LlmBridge__ApiKeys__agent-zero-ws",
+                "valueFrom": {
+                  "secretKeyRef": {
+                    "key": "agent-zero-ws",
+                    "name": "fc-llm-bridge-api-keys",
+                    "optional": true
+                  }
+                }
+              },
+              {
+                "name": "FlowerCore__LlmBridge__ApiKeys__agent-zero-k8s",
+                "valueFrom": {
+                  "secretKeyRef": {
+                    "key": "agent-zero-k8s",
+                    "name": "fc-llm-bridge-api-keys",
+                    "optional": true
+                  }
+                }
+              },
+              {
+                "name": "FlowerCore__LlmBridge__ApiKeys__spare-1",
+                "valueFrom": {
+                  "secretKeyRef": {
+                    "key": "spare-1",
+                    "name": "fc-llm-bridge-api-keys",
+                    "optional": true
+                  }
+                }
+              },
+              {
+                "name": "FlowerCore__LlmBridge__ApiKeys__spare-2",
+                "valueFrom": {
+                  "secretKeyRef": {
+                    "key": "spare-2",
+                    "name": "fc-llm-bridge-api-keys",
+                    "optional": true
+                  }
+                }
+              },
+              {
+                "name": "FlowerCore__Chat__OllamaBaseUrl",
+                "value": "http://10.0.56.14:30976"
+              },
+              {
+                "name": "FlowerCore__Chat__HttpTimeout",
+                "value": "00:05:00"
+              },
+              {
+                "name": "FlowerCore__Chat__ModelRouter__DefaultRoutes__Balanced__Provider",
+                "value": "Ollama"
+              },
+              {
+                "name": "FlowerCore__Chat__ModelRouter__DefaultRoutes__Balanced__Model",
+                "value": "qwen2.5:14b"
+              },
+              {
+                "name": "FlowerCore__Chat__ModelRouter__DefaultRoutes__Cheap__Provider",
+                "value": "Ollama"
+              },
+              {
+                "name": "FlowerCore__Chat__ModelRouter__DefaultRoutes__Cheap__Model",
+                "value": "qwen2.5:7b"
+              },
+              {
+                "name": "FlowerCore__Chat__Anthropic__Enabled",
+                "value": "true"
+              },
+              {
+                "name": "FlowerCore__Chat__Anthropic__ApiKey",
+                "valueFrom": {
+                  "secretKeyRef": {
+                    "key": "password",
+                    "name": "anthropic-api-key"
+                  }
+                }
+              },
+              {
+                "name": "FlowerCore__Chat__Anthropic__OrganizationId",
+                "valueFrom": {
+                  "secretKeyRef": {
+                    "key": "organization_id",
+                    "name": "anthropic-api-key",
+                    "optional": true
+                  }
+                }
+              },
+              {
+                "name": "FlowerCore__Chat__Anthropic__BaseUrl",
+                "value": "https://api.anthropic.com"
+              },
+              {
+                "name": "FlowerCore__Chat__Anthropic__DefaultModel",
+                "value": "claude-sonnet-4-6"
+              },
+              {
+                "name": "FlowerCore__Chat__Anthropic__AnthropicVersion",
+                "value": "2023-06-01"
+              },
+              {
+                "name": "FlowerCore__Chat__Anthropic__Timeout",
+                "value": "00:05:00"
+              }
+            ],
+            "image": "localhost/fc-llm-bridge:gx10-v2",
+            "imagePullPolicy": "Never",
+            "livenessProbe": {
+              "failureThreshold": 3,
+              "initialDelaySeconds": 15,
+              "periodSeconds": 30,
+              "successThreshold": 1,
+              "tcpSocket": {
+                "port": 8080
+              },
+              "timeoutSeconds": 1
+            },
+            "name": "web",
+            "ports": [
+              {
+                "containerPort": 8080,
+                "name": "http",
+                "protocol": "TCP"
+              }
+            ],
+            "readinessProbe": {
+              "failureThreshold": 3,
+              "initialDelaySeconds": 5,
+              "periodSeconds": 10,
+              "successThreshold": 1,
+              "tcpSocket": {
+                "port": 8080
+              },
+              "timeoutSeconds": 1
+            },
+            "resources": {
+              "limits": {
+                "cpu": "1",
+                "memory": "768Mi"
+              },
+              "requests": {
+                "cpu": "100m",
+                "memory": "256Mi"
+              }
+            },
+            "securityContext": {
+              "allowPrivilegeEscalation": false,
+              "capabilities": {
+                "drop": [
+                  "ALL"
+                ]
+              },
+              "readOnlyRootFilesystem": true,
+              "runAsGroup": 1654,
+              "runAsNonRoot": true,
+              "runAsUser": 1654
+            },
+            "terminationMessagePath": "/dev/termination-log",
+            "terminationMessagePolicy": "File",
+            "volumeMounts": [
+              {
+                "mountPath": "/data",
+                "name": "data"
+              },
+              {
+                "mountPath": "/tmp",
+                "name": "tmp"
+              },
+              {
+                "mountPath": "/app/data",
+                "name": "app-data"
+              }
+            ]
+          }
+        ],
+        "dnsConfig": {
+          "nameservers": [
+            "10.43.0.10"
+          ],
+          "options": [
+            {
+              "name": "ndots",
+              "value": "2"
+            }
+          ],
+          "searches": [
+            "fc-llm-bridge.svc.cluster.local",
+            "svc.cluster.local",
+            "cluster.local"
+          ]
+        },
+        "dnsPolicy": "None",
+        "restartPolicy": "Always",
+        "schedulerName": "default-scheduler",
+        "securityContext": {
+          "fsGroup": 1654,
+          "fsGroupChangePolicy": "OnRootMismatch"
+        },
+        "terminationGracePeriodSeconds": 30,
+        "volumes": [
+          {
+            "name": "data",
+            "persistentVolumeClaim": {
+              "claimName": "fc-llm-bridge-data"
+            }
+          },
+          {
+            "emptyDir": {},
+            "name": "tmp"
+          },
+          {
+            "emptyDir": {},
+            "name": "app-data"
+          }
+        ]
+      }
+    }
+  }
+}

apps-gx10/fc-llm-bridge/ingressroute-fc-llm-bridge.json

@@ -0,0 +1,29 @@
+{
+  "apiVersion": "traefik.io/v1alpha1",
+  "kind": "IngressRoute",
+  "metadata": {
+    "name": "fc-llm-bridge",
+    "namespace": "fc-llm-bridge"
+  },
+  "spec": {
+    "entryPoints": [
+      "websecure"
+    ],
+    "routes": [
+      {
+        "kind": "Rule",
+        "match": "Host(`fc-llm-bridge.iamworkin.lan`)",
+        "priority": 100,
+        "services": [
+          {
+            "name": "fc-llm-bridge",
+            "port": 8080
+          }
+        ]
+      }
+    ],
+    "tls": {
+      "secretName": "fc-llm-bridge-tls"
+    }
+  }
+}

apps-gx10/fc-llm-bridge/service-fc-llm-bridge.json

@@ -0,0 +1,25 @@
+{
+  "apiVersion": "v1",
+  "kind": "Service",
+  "metadata": {
+    "labels": {},
+    "name": "fc-llm-bridge",
+    "namespace": "fc-llm-bridge"
+  },
+  "spec": {
+    "internalTrafficPolicy": "Cluster",
+    "ports": [
+      {
+        "name": "http",
+        "port": 8080,
+        "protocol": "TCP",
+        "targetPort": 8080
+      }
+    ],
+    "selector": {
+      "app.kubernetes.io/name": "fc-llm-bridge"
+    },
+    "sessionAffinity": "None",
+    "type": "ClusterIP"
+  }
+}

apps-gx10/fc-media/configmap-fc-media-config.json

@@ -0,0 +1,11 @@
+{
+  "apiVersion": "v1",
+  "data": {
+    "appsettings.Production.json": "{\n  \"DatabaseProvider\": \"Sqlite\",\n  \"ConnectionStrings\": {\n    \"Sqlite\": \"Data Source=/data/media.db\"\n  },\n  \"FlowerCore\": {\n    \"Auth\": {\n      \"Enabled\": true,\n      \"Oidc\": {\n        \"Authority\": \"https://id.iamworkin.lan/application/o/media/\",\n        \"ClientId\": \"media\",\n        \"ClientSecret\": \"\",\n        \"Audience\": \"media\",\n        \"RequireHttpsMetadata\": true\n      }\n    },\n    \"Tenant\": {\n      \"JwtClaimsEnabled\": false,\n      \"DefaultTenantHosts\": [ \"media.iamworkin.lan\" ]\n    }\n  },\n  \"Media\": {\n    \"LibraryRoot\": \"/media/library\",\n    \"Sources\": [\n      {\n        \"Name\": \"BlueJayNAS Video\",\n        \"Driver\": \"Nfs\",\n        \"MountedPath\": \"/media/library\",\n        \"RemotePath\": \"nfs://10.0.58.3/volume1/video\",\n        \"IsEnabled\": true,\n        \"IsDefault\": true,\n        \"Notes\": \"Synology NFS media share mounted read-only inside the cluster.\"\n      }\n    ],\n    \"GeneratedRoot\": \"/data/generated\",\n    \"TranscodeRoot\": \"/data/transcodes\",\n    \"InboxPath\": \"/media/inbox\",\n    \"InboxScanIntervalMinutes\": 5,\n    \"ScanOnStartup\": false,\n    \"ComputeChecksums\": false,\n    \"FfmpegCommand\": \"ffmpeg\",\n    \"FfprobeCommand\": \"ffprobe\",\n    \"Hls\": {\n      \"MaxConcurrentJobs\": 1\n    },\n    \"DefaultViewerName\": \"BlueJay\",\n    \"Dlna\": {\n      \"IsEnabled\": true,\n      \"MulticastAddress\": \"239.255.255.250\",\n      \"Port\": 1900,\n      \"DiscoveryTimeoutSeconds\": 2,\n      \"DescriptionFetchTimeoutSeconds\": 2,\n      \"MaxResponsesPerSearchTarget\": 32,\n      \"SearchTargets\": [\n        \"urn:schemas-upnp-org:device:MediaRenderer:1\",\n        \"urn:schemas-upnp-org:device:MediaServer:1\"\n      ]\n    }\n  }\n}\n"
+  },
+  "kind": "ConfigMap",
+  "metadata": {
+    "name": "fc-media-config",
+    "namespace": "fc-media"
+  }
+}

apps-gx10/fc-media/deployment-fc-media-web.json

@@ -0,0 +1,242 @@
+{
+  "apiVersion": "apps/v1",
+  "kind": "Deployment",
+  "metadata": {
+    "labels": {
+      "app": "fc-media-web",
+      "app.kubernetes.io/name": "fc-media-web",
+      "app.kubernetes.io/part-of": "flowercore"
+    },
+    "name": "fc-media-web",
+    "namespace": "fc-media"
+  },
+  "spec": {
+    "progressDeadlineSeconds": 600,
+    "replicas": 1,
+    "revisionHistoryLimit": 10,
+    "selector": {
+      "matchLabels": {
+        "app": "fc-media-web"
+      }
+    },
+    "strategy": {
+      "type": "Recreate"
+    },
+    "template": {
+      "metadata": {
+        "annotations": {
+          "flowercore.io/healthz-auth-policy": "allow-anonymous",
+          "kubectl.kubernetes.io/restartedAt": "2026-04-05T14:14:28-05:00",
+          "prometheus.io/path": "/metrics",
+          "prometheus.io/port": "5200",
+          "prometheus.io/scrape": "true"
+        },
+        "labels": {
+          "app": "fc-media-web",
+          "app.kubernetes.io/name": "fc-media-web",
+          "app.kubernetes.io/part-of": "flowercore"
+        }
+      },
+      "spec": {
+        "containers": [
+          {
+            "env": [
+              {
+                "name": "ASPNETCORE_ENVIRONMENT",
+                "value": "Production"
+              },
+              {
+                "name": "ASPNETCORE_URLS",
+                "value": "http://+:5200"
+              },
+              {
+                "name": "FlowerCore__Auth__Enabled",
+                "value": "true"
+              },
+              {
+                "name": "FlowerCore__Auth__Oidc__Enabled",
+                "value": "true"
+              },
+              {
+                "name": "FlowerCore__Auth__Oidc__Audience",
+                "value": "media"
+              },
+              {
+                "name": "FlowerCore__Auth__Oidc__ClientId",
+                "valueFrom": {
+                  "secretKeyRef": {
+                    "key": "client_id",
+                    "name": "media-oidc-client",
+                    "optional": true
+                  }
+                }
+              },
+              {
+                "name": "FlowerCore__Auth__Oidc__ClientSecret",
+                "valueFrom": {
+                  "secretKeyRef": {
+                    "key": "client_secret",
+                    "name": "media-oidc-client",
+                    "optional": true
+                  }
+                }
+              },
+              {
+                "name": "FlowerCore__Auth__Oidc__Authority",
+                "valueFrom": {
+                  "secretKeyRef": {
+                    "key": "issuer_url",
+                    "name": "media-oidc-client",
+                    "optional": true
+                  }
+                }
+              }
+            ],
+            "image": "localhost/fc-media-web:gx10-v1",
+            "imagePullPolicy": "Never",
+            "livenessProbe": {
+              "failureThreshold": 3,
+              "httpGet": {
+                "httpHeaders": [
+                  {
+                    "name": "X-Forwarded-Proto",
+                    "value": "https"
+                  }
+                ],
+                "path": "/healthz",
+                "port": 5200,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 30,
+              "periodSeconds": 30,
+              "successThreshold": 1,
+              "timeoutSeconds": 1
+            },
+            "name": "fc-media-web",
+            "ports": [
+              {
+                "containerPort": 5200,
+                "name": "http",
+                "protocol": "TCP"
+              }
+            ],
+            "readinessProbe": {
+              "failureThreshold": 3,
+              "httpGet": {
+                "httpHeaders": [
+                  {
+                    "name": "X-Forwarded-Proto",
+                    "value": "https"
+                  }
+                ],
+                "path": "/healthz",
+                "port": 5200,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 5,
+              "periodSeconds": 10,
+              "successThreshold": 1,
+              "timeoutSeconds": 1
+            },
+            "resources": {
+              "limits": {
+                "cpu": "4",
+                "memory": "4Gi"
+              },
+              "requests": {
+                "cpu": "500m",
+                "memory": "1Gi"
+              }
+            },
+            "startupProbe": {
+              "failureThreshold": 18,
+              "httpGet": {
+                "httpHeaders": [
+                  {
+                    "name": "X-Forwarded-Proto",
+                    "value": "https"
+                  }
+                ],
+                "path": "/healthz",
+                "port": 5200,
+                "scheme": "HTTP"
+              },
+              "periodSeconds": 10,
+              "successThreshold": 1,
+              "timeoutSeconds": 1
+            },
+            "terminationMessagePath": "/dev/termination-log",
+            "terminationMessagePolicy": "File",
+            "volumeMounts": [
+              {
+                "mountPath": "/app/appsettings.Production.json",
+                "name": "config",
+                "readOnly": true,
+                "subPath": "appsettings.Production.json"
+              },
+              {
+                "mountPath": "/data",
+                "name": "data"
+              },
+              {
+                "mountPath": "/data/transcodes",
+                "name": "transcodes"
+              },
+              {
+                "mountPath": "/media/library",
+                "name": "media-library",
+                "readOnly": true
+              },
+              {
+                "mountPath": "/media/inbox",
+                "name": "media-inbox"
+              }
+            ]
+          }
+        ],
+        "dnsPolicy": "ClusterFirst",
+        "restartPolicy": "Always",
+        "schedulerName": "default-scheduler",
+        "securityContext": {},
+        "terminationGracePeriodSeconds": 30,
+        "volumes": [
+          {
+            "configMap": {
+              "defaultMode": 420,
+              "name": "fc-media-config"
+            },
+            "name": "config"
+          },
+          {
+            "name": "data",
+            "persistentVolumeClaim": {
+              "claimName": "fc-media-data"
+            }
+          },
+          {
+            "name": "transcodes",
+            "nfs": {
+              "path": "/volume1/kubernetes/fc-media-transcodes",
+              "server": "10.0.58.3"
+            }
+          },
+          {
+            "name": "media-inbox",
+            "nfs": {
+              "path": "/volume1/kubernetes/fc-media-inbox",
+              "server": "10.0.58.3"
+            }
+          },
+          {
+            "name": "media-library",
+            "nfs": {
+              "path": "/volume1/video",
+              "readOnly": true,
+              "server": "10.0.58.3"
+            }
+          }
+        ]
+      }
+    }
+  }
+}

apps-gx10/fc-media/ingressroute-fc-media-web.json

@@ -0,0 +1,29 @@
+{
+  "apiVersion": "traefik.io/v1alpha1",
+  "kind": "IngressRoute",
+  "metadata": {
+    "name": "fc-media-web",
+    "namespace": "fc-media"
+  },
+  "spec": {
+    "entryPoints": [
+      "websecure"
+    ],
+    "routes": [
+      {
+        "kind": "Rule",
+        "match": "Host(`media.iamworkin.lan`)",
+        "priority": 100,
+        "services": [
+          {
+            "name": "fc-media-web",
+            "port": 5200
+          }
+        ]
+      }
+    ],
+    "tls": {
+      "secretName": "fc-media-tls"
+    }
+  }
+}

apps-gx10/fc-media/service-fc-media-web.json

@@ -0,0 +1,29 @@
+{
+  "apiVersion": "v1",
+  "kind": "Service",
+  "metadata": {
+    "labels": {
+      "app": "fc-media-web",
+      "app.kubernetes.io/name": "fc-media-web",
+      "app.kubernetes.io/part-of": "flowercore"
+    },
+    "name": "fc-media-web",
+    "namespace": "fc-media"
+  },
+  "spec": {
+    "internalTrafficPolicy": "Cluster",
+    "ports": [
+      {
+        "name": "http",
+        "port": 5200,
+        "protocol": "TCP",
+        "targetPort": 5200
+      }
+    ],
+    "selector": {
+      "app": "fc-media-web"
+    },
+    "sessionAffinity": "None",
+    "type": "ClusterIP"
+  }
+}

apps-gx10/fc-menuboard/configmap-menuboard-web-config.json

@@ -0,0 +1,18 @@
+{
+  "apiVersion": "v1",
+  "data": {
+    "ASPNETCORE_ENVIRONMENT": "Production",
+    "ASPNETCORE_FORWARDEDHEADERS_ENABLED": "true",
+    "ASPNETCORE_URLS": "http://+:5000",
+    "FlowerCore__Database__ConnectionStrings__Sqlite": "Data Source=/data/menuboard.db",
+    "OTEL_EXPORTER_OTLP_ENDPOINT": "http://otel-collector.monitoring.svc.cluster.local:4317",
+    "OTEL_EXPORTER_OTLP_PROTOCOL": "grpc",
+    "OTEL_SERVICE_NAME": "FlowerCore.MenuBoard",
+    "Security__AllowedOrigins__0": "https://menuboard.iamworkin.lan"
+  },
+  "kind": "ConfigMap",
+  "metadata": {
+    "name": "menuboard-web-config",
+    "namespace": "fc-menuboard"
+  }
+}

apps-gx10/fc-menuboard/deployment-menuboard-web.json

@@ -0,0 +1,112 @@
+{
+  "apiVersion": "apps/v1",
+  "kind": "Deployment",
+  "metadata": {
+    "labels": {
+      "app.kubernetes.io/name": "menuboard-web",
+      "app.kubernetes.io/part-of": "flowercore"
+    },
+    "name": "menuboard-web",
+    "namespace": "fc-menuboard"
+  },
+  "spec": {
+    "progressDeadlineSeconds": 600,
+    "replicas": 1,
+    "revisionHistoryLimit": 10,
+    "selector": {
+      "matchLabels": {
+        "app.kubernetes.io/name": "menuboard-web"
+      }
+    },
+    "strategy": {
+      "type": "Recreate"
+    },
+    "template": {
+      "metadata": {
+        "annotations": {
+          "prometheus.io/path": "/metrics/prometheus",
+          "prometheus.io/port": "5000",
+          "prometheus.io/scrape": "true"
+        },
+        "labels": {
+          "app.kubernetes.io/name": "menuboard-web",
+          "app.kubernetes.io/part-of": "flowercore"
+        }
+      },
+      "spec": {
+        "containers": [
+          {
+            "envFrom": [
+              {
+                "configMapRef": {
+                  "name": "menuboard-web-config"
+                }
+              },
+              {
+                "secretRef": {
+                  "name": "menuboard-web-secrets"
+                }
+              }
+            ],
+            "image": "localhost/fc-menuboard-web:gx10-v1",
+            "imagePullPolicy": "Never",
+            "livenessProbe": {
+              "failureThreshold": 3,
+              "httpGet": {
+                "path": "/health",
+                "port": 5000,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 30,
+              "periodSeconds": 30,
+              "successThreshold": 1,
+              "timeoutSeconds": 5
+            },
+            "name": "menuboard-web",
+            "ports": [
+              {
+                "containerPort": 5000,
+                "name": "http",
+                "protocol": "TCP"
+              }
+            ],
+            "readinessProbe": {
+              "failureThreshold": 6,
+              "httpGet": {
+                "path": "/health",
+                "port": 5000,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 10,
+              "periodSeconds": 10,
+              "successThreshold": 1,
+              "timeoutSeconds": 5
+            },
+            "resources": {},
+            "terminationMessagePath": "/dev/termination-log",
+            "terminationMessagePolicy": "File",
+            "volumeMounts": [
+              {
+                "mountPath": "/data",
+                "name": "data"
+              }
+            ]
+          }
+        ],
+        "dnsPolicy": "ClusterFirst",
+        "restartPolicy": "Always",
+        "schedulerName": "default-scheduler",
+        "securityContext": {},
+        "terminationGracePeriodSeconds": 30,
+        "volumes": [
+          {
+            "name": "data",
+            "persistentVolumeClaim": {
+              "claimName": "menuboard-web-data"
+            }
+          }
+        ]
+      }
+    }
+  }
+}

apps-gx10/fc-menuboard/ingressroute-menuboard-web.json

@@ -0,0 +1,29 @@
+{
+  "apiVersion": "traefik.io/v1alpha1",
+  "kind": "IngressRoute",
+  "metadata": {
+    "name": "menuboard-web",
+    "namespace": "fc-menuboard"
+  },
+  "spec": {
+    "entryPoints": [
+      "websecure"
+    ],
+    "routes": [
+      {
+        "kind": "Rule",
+        "match": "Host(`menuboard.iamworkin.lan`)",
+        "priority": 100,
+        "services": [
+          {
+            "name": "menuboard-web",
+            "port": 80
+          }
+        ]
+      }
+    ],
+    "tls": {
+      "secretName": "menuboard-web-tls"
+    }
+  }
+}

apps-gx10/fc-menuboard/service-menuboard-web.json

@@ -0,0 +1,28 @@
+{
+  "apiVersion": "v1",
+  "kind": "Service",
+  "metadata": {
+    "labels": {
+      "app.kubernetes.io/name": "menuboard-web",
+      "app.kubernetes.io/part-of": "flowercore"
+    },
+    "name": "menuboard-web",
+    "namespace": "fc-menuboard"
+  },
+  "spec": {
+    "internalTrafficPolicy": "Cluster",
+    "ports": [
+      {
+        "name": "http",
+        "port": 80,
+        "protocol": "TCP",
+        "targetPort": 5000
+      }
+    ],
+    "selector": {
+      "app.kubernetes.io/name": "menuboard-web"
+    },
+    "sessionAffinity": "None",
+    "type": "ClusterIP"
+  }
+}

apps-gx10/fc-messageboard/configmap-messageboard-web-config.json

@@ -0,0 +1,18 @@
+{
+  "apiVersion": "v1",
+  "data": {
+    "ASPNETCORE_ENVIRONMENT": "Production",
+    "ASPNETCORE_FORWARDEDHEADERS_ENABLED": "true",
+    "ASPNETCORE_URLS": "http://+:8080",
+    "FlowerCore__Database__ConnectionStrings__Sqlite": "Data Source=/data/messageboard.db",
+    "OTEL_EXPORTER_OTLP_ENDPOINT": "http://otel-collector.monitoring.svc.cluster.local:4317",
+    "OTEL_EXPORTER_OTLP_PROTOCOL": "grpc",
+    "OTEL_SERVICE_NAME": "FlowerCore.MessageBoard",
+    "Security__AllowedOrigins__0": "https://messageboard.iamworkin.lan"
+  },
+  "kind": "ConfigMap",
+  "metadata": {
+    "name": "messageboard-web-config",
+    "namespace": "fc-messageboard"
+  }
+}

apps-gx10/fc-messageboard/deployment-messageboard-web.json

@@ -0,0 +1,118 @@
+{
+  "apiVersion": "apps/v1",
+  "kind": "Deployment",
+  "metadata": {
+    "labels": {
+      "app": "messageboard-web"
+    },
+    "name": "messageboard-web",
+    "namespace": "fc-messageboard"
+  },
+  "spec": {
+    "progressDeadlineSeconds": 600,
+    "replicas": 1,
+    "revisionHistoryLimit": 10,
+    "selector": {
+      "matchLabels": {
+        "app": "messageboard-web"
+      }
+    },
+    "strategy": {
+      "type": "Recreate"
+    },
+    "template": {
+      "metadata": {
+        "annotations": {
+          "fc.flowercore.io/healthz-anon": "true",
+          "fc.flowercore.io/probe-path": "/health",
+          "prometheus.io/path": "/metrics/prometheus",
+          "prometheus.io/port": "8080",
+          "prometheus.io/scrape": "true"
+        },
+        "labels": {
+          "app": "messageboard-web"
+        }
+      },
+      "spec": {
+        "containers": [
+          {
+            "envFrom": [
+              {
+                "configMapRef": {
+                  "name": "messageboard-web-config"
+                }
+              },
+              {
+                "secretRef": {
+                  "name": "messageboard-web-secrets",
+                  "optional": true
+                }
+              }
+            ],
+            "image": "localhost/fc-messageboard-web:gx10-v1",
+            "imagePullPolicy": "Never",
+            "livenessProbe": {
+              "failureThreshold": 3,
+              "initialDelaySeconds": 10,
+              "periodSeconds": 30,
+              "successThreshold": 1,
+              "tcpSocket": {
+                "port": 8080
+              },
+              "timeoutSeconds": 5
+            },
+            "name": "messageboard-web",
+            "ports": [
+              {
+                "containerPort": 8080,
+                "name": "http",
+                "protocol": "TCP"
+              }
+            ],
+            "readinessProbe": {
+              "failureThreshold": 6,
+              "initialDelaySeconds": 10,
+              "periodSeconds": 10,
+              "successThreshold": 1,
+              "tcpSocket": {
+                "port": 8080
+              },
+              "timeoutSeconds": 5
+            },
+            "resources": {
+              "limits": {
+                "cpu": "500m",
+                "memory": "512Mi"
+              },
+              "requests": {
+                "cpu": "100m",
+                "memory": "128Mi"
+              }
+            },
+            "terminationMessagePath": "/dev/termination-log",
+            "terminationMessagePolicy": "File",
+            "volumeMounts": [
+              {
+                "mountPath": "/data",
+                "name": "data"
+              }
+            ]
+          }
+        ],
+        "dnsPolicy": "ClusterFirst",
+        "restartPolicy": "Always",
+        "schedulerName": "default-scheduler",
+        "securityContext": {},
+        "terminationGracePeriodSeconds": 30,
+        "volumes": [
+          {
+            "name": "data",
+            "persistentVolumeClaim": {
+              "claimName": "messageboard-web-data"
+            }
+          }
+        ]
+      }
+    }
+  }
+}

apps-gx10/fc-messageboard/ingressroute-messageboard-web.json

@@ -0,0 +1,29 @@
+{
+  "apiVersion": "traefik.io/v1alpha1",
+  "kind": "IngressRoute",
+  "metadata": {
+    "name": "messageboard-web",
+    "namespace": "fc-messageboard"
+  },
+  "spec": {
+    "entryPoints": [
+      "websecure"
+    ],
+    "routes": [
+      {
+        "kind": "Rule",
+        "match": "Host(`messageboard.iamworkin.lan`)",
+        "priority": 100,
+        "services": [
+          {
+            "name": "messageboard-web",
+            "port": 80
+          }
+        ]
+      }
+    ],
+    "tls": {
+      "secretName": "messageboard-web-tls"
+    }
+  }
+}

apps-gx10/fc-messageboard/service-messageboard-web.json

@@ -0,0 +1,25 @@
+{
+  "apiVersion": "v1",
+  "kind": "Service",
+  "metadata": {
+    "labels": {},
+    "name": "messageboard-web",
+    "namespace": "fc-messageboard"
+  },
+  "spec": {
+    "internalTrafficPolicy": "Cluster",
+    "ports": [
+      {
+        "name": "http",
+        "port": 80,
+        "protocol": "TCP",
+        "targetPort": 8080
+      }
+    ],
+    "selector": {
+      "app": "messageboard-web"
+    },
+    "sessionAffinity": "None",
+    "type": "ClusterIP"
+  }
+}

apps-gx10/fc-mysql/configmap-mysql-web-config.json

@@ -0,0 +1,11 @@
+{
+  "apiVersion": "v1",
+  "data": {
+    "appsettings.Production.json": "{\n  \"MySqlManager\": {\n    \"CrdNamespace\": \"fc-tenant-default\",\n    \"MySqlImage\": \"iwrk-nexus.iamworkin.lan:8444/iwrk-ubuntu-mysql:master\",\n    \"PhpMyAdminImage\": \"phpmyadmin/phpmyadmin:latest\",\n    \"PhpMyAdminDomain\": \"iamworkin.lan\",\n    \"Advisor\": {\n      \"DefaultPreset\": \"medium\",\n      \"AutoDetectPreset\": true,\n      \"MaxAutoPreset\": \"medium\",\n      \"PresetOverride\": null\n    }\n  },\n  \"ContainerBackend\": {\n    \"Default\": \"Kubernetes\"\n  },\n  \"FlowerCore\": {\n    \"Auth\": {\n      \"Provider\": \"Oidc\",\n      \"Enabled\": false,\n      \"Oidc\": {\n        \"Enabled\": true,\n        \"Authority\": \"https://id.iamworkin.lan/application/o/mysql/\",\n        \"Audience\": \"mysql\",\n        \"ClientId\": \"mysql\",\n        \"ClientSecret\": \"\"\n      }\n    },\n    \"Tenant\": {\n      \"JwtClaimsEnabled\": false,\n      \"TenantClaimType\": \"fc:tenant\",\n      \"ActorIdClaimType\": \"flowercore_actor_id\"\n    },\n    \"Database\": {\n      \"Provider\": \"Sqlite\",\n      \"ConnectionStrings\": {\n        \"Sqlite\": \"Data Source=/data/mysql-manager.db\"\n      }\n    }\n  }\n}\n"
+  },
+  "kind": "ConfigMap",
+  "metadata": {
+    "name": "mysql-web-config",
+    "namespace": "fc-mysql"
+  }
+}

apps-gx10/fc-mysql/deployment-mysql-web.json

@@ -0,0 +1,210 @@
+{
+  "apiVersion": "apps/v1",
+  "kind": "Deployment",
+  "metadata": {
+    "labels": {
+      "app.kubernetes.io/managed-by": "flowercore",
+      "app.kubernetes.io/name": "mysql-web"
+    },
+    "name": "mysql-web",
+    "namespace": "fc-mysql"
+  },
+  "spec": {
+    "progressDeadlineSeconds": 600,
+    "replicas": 1,
+    "revisionHistoryLimit": 10,
+    "selector": {
+      "matchLabels": {
+        "app.kubernetes.io/name": "mysql-web"
+      }
+    },
+    "strategy": {
+      "type": "Recreate"
+    },
+    "template": {
+      "metadata": {
+        "annotations": {
+          "kubectl.kubernetes.io/restartedAt": "2026-04-17T19:52:14-05:00",
+          "prometheus.io/path": "/metrics/prometheus",
+          "prometheus.io/port": "5300",
+          "prometheus.io/scrape": "true"
+        },
+        "labels": {
+          "app.kubernetes.io/name": "mysql-web"
+        }
+      },
+      "spec": {
+        "containers": [
+          {
+            "env": [
+              {
+                "name": "FlowerCore__Auth__Enabled",
+                "value": "false"
+              },
+              {
+                "name": "FlowerCore__Auth__Oidc__Authority",
+                "valueFrom": {
+                  "secretKeyRef": {
+                    "key": "issuer_url",
+                    "name": "mysql-oidc-client",
+                    "optional": true
+                  }
+                }
+              },
+              {
+                "name": "FlowerCore__Auth__Oidc__ClientId",
+                "valueFrom": {
+                  "secretKeyRef": {
+                    "key": "client_id",
+                    "name": "mysql-oidc-client",
+                    "optional": true
+                  }
+                }
+              },
+              {
+                "name": "FlowerCore__Auth__Oidc__ClientSecret",
+                "valueFrom": {
+                  "secretKeyRef": {
+                    "key": "client_secret",
+                    "name": "mysql-oidc-client",
+                    "optional": true
+                  }
+                }
+              },
+              {
+                "name": "FlowerCore__Auth__Oidc__Audience",
+                "value": "mysql"
+              }
+            ],
+            "image": "localhost/fc-mysql-web:v20260617-sec5-1148fd0",
+            "imagePullPolicy": "Never",
+            "livenessProbe": {
+              "failureThreshold": 3,
+              "httpGet": {
+                "path": "/metrics/prometheus",
+                "port": 5300,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 20,
+              "periodSeconds": 30,
+              "successThreshold": 1,
+              "timeoutSeconds": 1
+            },
+            "name": "mysql-web",
+            "ports": [
+              {
+                "containerPort": 5300,
+                "protocol": "TCP"
+              }
+            ],
+            "readinessProbe": {
+              "failureThreshold": 3,
+              "httpGet": {
+                "path": "/metrics/prometheus",
+                "port": 5300,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 10,
+              "periodSeconds": 10,
+              "successThreshold": 1,
+              "timeoutSeconds": 1
+            },
+            "resources": {
+              "limits": {
+                "cpu": "500m",
+                "memory": "512Mi"
+              },
+              "requests": {
+                "cpu": "100m",
+                "memory": "128Mi"
+              }
+            },
+            "securityContext": {
+              "allowPrivilegeEscalation": false,
+              "capabilities": {
+                "drop": [
+                  "ALL"
+                ]
+              },
+              "readOnlyRootFilesystem": true
+            },
+            "terminationMessagePath": "/dev/termination-log",
+            "terminationMessagePolicy": "File",
+            "volumeMounts": [
+              {
+                "mountPath": "/data",
+                "name": "data"
+              },
+              {
+                "mountPath": "/tmp",
+                "name": "tmp"
+              },
+              {
+                "mountPath": "/app/logs",
+                "name": "logs"
+              },
+              {
+                "mountPath": "/app/appsettings.Production.json",
+                "name": "config",
+                "readOnly": true,
+                "subPath": "appsettings.Production.json"
+              }
+            ]
+          }
+        ],
+        "dnsConfig": {
+          "nameservers": [
+            "10.43.0.10"
+          ],
+          "options": [
+            {
+              "name": "ndots",
+              "value": "2"
+            }
+          ],
+          "searches": [
+            "fc-mysql.svc.cluster.local",
+            "svc.cluster.local",
+            "cluster.local"
+          ]
+        },
+        "dnsPolicy": "None",
+        "restartPolicy": "Always",
+        "schedulerName": "default-scheduler",
+        "securityContext": {
+          "fsGroup": 1654,
+          "fsGroupChangePolicy": "OnRootMismatch",
+          "runAsGroup": 1654,
+          "runAsNonRoot": true,
+          "runAsUser": 1654
+        },
+        "serviceAccount": "mysql-web",
+        "serviceAccountName": "mysql-web",
+        "terminationGracePeriodSeconds": 30,
+        "volumes": [
+          {
+            "name": "data",
+            "persistentVolumeClaim": {
+              "claimName": "mysql-web-data"
+            }
+          },
+          {
+            "emptyDir": {},
+            "name": "tmp"
+          },
+          {
+            "emptyDir": {},
+            "name": "logs"
+          },
+          {
+            "configMap": {
+              "defaultMode": 420,
+              "name": "mysql-web-config"
+            },
+            "name": "config"
+          }
+        ]
+      }
+    }
+  }
+}

apps-gx10/fc-mysql/ingressroute-mysql-web.json

@@ -0,0 +1,29 @@
+{
+  "apiVersion": "traefik.io/v1alpha1",
+  "kind": "IngressRoute",
+  "metadata": {
+    "name": "mysql-web",
+    "namespace": "fc-mysql"
+  },
+  "spec": {
+    "entryPoints": [
+      "websecure"
+    ],
+    "routes": [
+      {
+        "kind": "Rule",
+        "match": "Host(`mysql.iamworkin.lan`)",
+        "priority": 100,
+        "services": [
+          {
+            "name": "mysql-web",
+            "port": 5300
+          }
+        ]
+      }
+    ],
+    "tls": {
+      "secretName": "mysql-web-tls"
+    }
+  }
+}

apps-gx10/fc-mysql/service-mysql-web.json

@@ -0,0 +1,23 @@
+{
+  "apiVersion": "v1",
+  "kind": "Service",
+  "metadata": {
+    "name": "mysql-web",
+    "namespace": "fc-mysql"
+  },
+  "spec": {
+    "internalTrafficPolicy": "Cluster",
+    "ports": [
+      {
+        "port": 5300,
+        "protocol": "TCP",
+        "targetPort": 5300
+      }
+    ],
+    "selector": {
+      "app.kubernetes.io/name": "mysql-web"
+    },
+    "sessionAffinity": "None",
+    "type": "ClusterIP"
+  }
+}

apps-gx10/fc-mysql/serviceaccount-mysql-web.json

@@ -0,0 +1,8 @@
+{
+  "apiVersion": "v1",
+  "kind": "ServiceAccount",
+  "metadata": {
+    "name": "mysql-web",
+    "namespace": "fc-mysql"
+  }
+}

apps-gx10/fc-network/certificate-fc-network-web-tls.json

@@ -0,0 +1,18 @@
+{
+  "apiVersion": "cert-manager.io/v1",
+  "kind": "Certificate",
+  "metadata": {
+    "name": "fc-network-web-tls",
+    "namespace": "fc-network"
+  },
+  "spec": {
+    "dnsNames": [
+      "network.iamworkin.lan"
+    ],
+    "issuerRef": {
+      "kind": "ClusterIssuer",
+      "name": "step-ca-acme"
+    },
+    "secretName": "fc-network-web-tls"
+  }
+}

apps-gx10/fc-network/deployment-fc-network-web.json

@@ -0,0 +1,210 @@
+{
+  "apiVersion": "apps/v1",
+  "kind": "Deployment",
+  "metadata": {
+    "labels": {
+      "app": "fc-network-web",
+      "app.kubernetes.io/component": "web",
+      "app.kubernetes.io/managed-by": "argocd",
+      "app.kubernetes.io/name": "fc-network-web",
+      "app.kubernetes.io/part-of": "flowercore",
+      "flowercore.io/created-by": "bluejay-infra",
+      "flowercore.io/tenant-id": "system"
+    },
+    "name": "fc-network-web",
+    "namespace": "fc-network"
+  },
+  "spec": {
+    "progressDeadlineSeconds": 600,
+    "replicas": 1,
+    "revisionHistoryLimit": 3,
+    "selector": {
+      "matchLabels": {
+        "app": "fc-network-web"
+      }
+    },
+    "strategy": {
+      "rollingUpdate": {
+        "maxSurge": 0,
+        "maxUnavailable": 1
+      },
+      "type": "RollingUpdate"
+    },
+    "template": {
+      "metadata": {
+        "annotations": {
+          "fc.flowercore.io/healthz-anon": "true",
+          "fc.flowercore.io/probe-path": "/healthz",
+          "flowercore.io/audit-trace-id": "runtime-activity-trace",
+          "prometheus.io/path": "/metrics/prometheus",
+          "prometheus.io/port": "5340",
+          "prometheus.io/scrape": "true"
+        },
+        "labels": {
+          "app": "fc-network-web",
+          "app.kubernetes.io/component": "web",
+          "app.kubernetes.io/managed-by": "argocd",
+          "app.kubernetes.io/name": "fc-network-web",
+          "app.kubernetes.io/part-of": "flowercore",
+          "flowercore.io/created-by": "bluejay-infra",
+          "flowercore.io/tenant-id": "system"
+        }
+      },
+      "spec": {
+        "containers": [
+          {
+            "env": [
+              {
+                "name": "ASPNETCORE_URLS",
+                "value": "http://+:5340"
+              },
+              {
+                "name": "ASPNETCORE_ENVIRONMENT",
+                "value": "Production"
+              },
+              {
+                "name": "DOTNET_SYSTEM_GLOBALIZATION_INVARIANT",
+                "value": "false"
+              },
+              {
+                "name": "HOME",
+                "value": "/data"
+              },
+              {
+                "name": "FlowerCore__Auth__Enabled",
+                "value": "false"
+              },
+              {
+                "name": "FlowerCore__Database__Provider",
+                "value": "Sqlite"
+              },
+              {
+                "name": "FlowerCore__Database__ConnectionStrings__Sqlite",
+                "value": "Data Source=/data/network.db"
+              },
+              {
+                "name": "FlowerCore__Network__SnapshotStore__RootDirectory",
+                "value": "/data/snapshots"
+              },
+              {
+                "name": "FlowerCore__Network__SnapshotStore__UseGitHistory",
+                "value": "true"
+              },
+              {
+                "name": "FlowerCore__Network__IntendedModel__FilePath",
+                "value": "/data/intended.json"
+              }
+            ],
+            "image": "localhost/fc-network-web:gx10-v1",
+            "imagePullPolicy": "Never",
+            "livenessProbe": {
+              "failureThreshold": 3,
+              "httpGet": {
+                "path": "/healthz",
+                "port": 5340,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 30,
+              "periodSeconds": 30,
+              "successThreshold": 1,
+              "timeoutSeconds": 1
+            },
+            "name": "web",
+            "ports": [
+              {
+                "containerPort": 5340,
+                "name": "http",
+                "protocol": "TCP"
+              }
+            ],
+            "readinessProbe": {
+              "failureThreshold": 3,
+              "httpGet": {
+                "path": "/healthz",
+                "port": 5340,
+                "scheme": "HTTP"
+              },
+              "periodSeconds": 10,
+              "successThreshold": 1,
+              "timeoutSeconds": 1
+            },
+            "resources": {
+              "limits": {
+                "cpu": "500m",
+                "memory": "512Mi"
+              },
+              "requests": {
+                "cpu": "50m",
+                "memory": "128Mi"
+              }
+            },
+            "securityContext": {
+              "allowPrivilegeEscalation": false,
+              "capabilities": {
+                "drop": [
+                  "ALL"
+                ]
+              },
+              "readOnlyRootFilesystem": true,
+              "runAsGroup": 1654,
+              "runAsNonRoot": true,
+              "runAsUser": 1654
+            },
+            "startupProbe": {
+              "failureThreshold": 30,
+              "httpGet": {
+                "path": "/healthz",
+                "port": 5340,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 5,
+              "periodSeconds": 5,
+              "successThreshold": 1,
+              "timeoutSeconds": 1
+            },
+            "terminationMessagePath": "/dev/termination-log",
+            "terminationMessagePolicy": "File",
+            "volumeMounts": [
+              {
+                "mountPath": "/data",
+                "name": "data"
+              },
+              {
+                "mountPath": "/tmp",
+                "name": "tmp"
+              },
+              {
+                "mountPath": "/app/logs",
+                "name": "logs"
+              }
+            ]
+          }
+        ],
+        "dnsPolicy": "ClusterFirst",
+        "restartPolicy": "Always",
+        "schedulerName": "default-scheduler",
+        "securityContext": {
+          "fsGroup": 1654,
+          "fsGroupChangePolicy": "OnRootMismatch"
+        },
+        "terminationGracePeriodSeconds": 30,
+        "volumes": [
+          {
+            "name": "data",
+            "persistentVolumeClaim": {
+              "claimName": "fc-network-web-data"
+            }
+          },
+          {
+            "emptyDir": {},
+            "name": "tmp"
+          },
+          {
+            "emptyDir": {},
+            "name": "logs"
+          }
+        ]
+      }
+    }
+  }
+}

apps-gx10/fc-network/ingressroute-fc-network-web.json

@@ -0,0 +1,29 @@
+{
+  "apiVersion": "traefik.io/v1alpha1",
+  "kind": "IngressRoute",
+  "metadata": {
+    "name": "fc-network-web",
+    "namespace": "fc-network"
+  },
+  "spec": {
+    "entryPoints": [
+      "websecure"
+    ],
+    "routes": [
+      {
+        "kind": "Rule",
+        "match": "Host(`network.iamworkin.lan`)",
+        "priority": 100,
+        "services": [
+          {
+            "name": "fc-network-web",
+            "port": 80
+          }
+        ]
+      }
+    ],
+    "tls": {
+      "secretName": "fc-network-web-tls"
+    }
+  }
+}

apps-gx10/fc-network/service-fc-network-web.json

@@ -0,0 +1,33 @@
+{
+  "apiVersion": "v1",
+  "kind": "Service",
+  "metadata": {
+    "labels": {
+      "app": "fc-network-web",
+      "app.kubernetes.io/component": "web",
+      "app.kubernetes.io/managed-by": "argocd",
+      "app.kubernetes.io/name": "fc-network-web",
+      "app.kubernetes.io/part-of": "flowercore",
+      "flowercore.io/created-by": "bluejay-infra",
+      "flowercore.io/tenant-id": "system"
+    },
+    "name": "fc-network-web",
+    "namespace": "fc-network"
+  },
+  "spec": {
+    "internalTrafficPolicy": "Cluster",
+    "ports": [
+      {
+        "name": "http",
+        "port": 80,
+        "protocol": "TCP",
+        "targetPort": 5340
+      }
+    ],
+    "selector": {
+      "app": "fc-network-web"
+    },
+    "sessionAffinity": "None",
+    "type": "ClusterIP"
+  }
+}

apps-gx10/fc-php/certificate-php-web-tls.json

@@ -0,0 +1,18 @@
+{
+  "apiVersion": "cert-manager.io/v1",
+  "kind": "Certificate",
+  "metadata": {
+    "name": "php-web-tls",
+    "namespace": "fc-php"
+  },
+  "spec": {
+    "dnsNames": [
+      "php.iamworkin.lan"
+    ],
+    "issuerRef": {
+      "kind": "ClusterIssuer",
+      "name": "step-ca-acme"
+    },
+    "secretName": "php-web-tls"
+  }
+}

apps-gx10/fc-php/configmap-php-web-config.json

@@ -0,0 +1,11 @@
+{
+  "apiVersion": "v1",
+  "data": {
+    "appsettings.Production.json": "{\n  \"PhpManager\": {\n    \"Namespace\": \"fc-php\",\n    \"Slowlog\": {\n      \"Path\": \"/var/log/apache2/php-fpm-slow.log\",\n      \"Sidecar\": {\n        \"Enabled\": true,\n        \"Image\": \"\"\n      }\n    },\n    \"PoolConfig\": {\n      \"StartServers\": null,\n      \"MinSpareServers\": null,\n      \"MaxSpareServers\": null,\n      \"ProcessIdleTimeoutSeconds\": 10,\n      \"RequestTerminateTimeoutSeconds\": 30\n    },\n    \"Certificates\": {\n      \"TlsInspector\": {\n        \"LogGracefulDegradeWarnings\": false\n      }\n    },\n    \"Backups\": {\n      \"StoragePath\": \"/data/backups\"\n    }\n  },\n  \"ApplicationArchives\": {\n    \"WordPressCoreUrl\": \"http://php-web.fc-php.svc.cluster.local.:5400/api/v1/application-archives/wordpress/latest.tar.gz\",\n    \"WordPressProxySourceUrl\": \"https://wordpress.org/latest.tar.gz\",\n    \"WordPressLocalArchivePath\": \"/data/application-archives/latest.tar.gz\",\n    \"MyBbCoreUrl\": \"http://php-web.fc-php.svc.cluster.local.:5400/api/v1/application-archives/mybb/latest.zip\",\n    \"MyBbProxySourceUrl\": \"https://mybb.com/download/\",\n    \"MyBbLocalArchivePath\": \"/data/application-archives/mybb-latest.zip\",\n    \"MediaWikiCoreUrl\": \"http://php-web.fc-php.svc.cluster.local.:5400/api/v1/application-archives/mediawiki/latest.tar.gz\",\n    \"MediaWikiProxySourceUrl\": \"https://releases.wikimedia.org/mediawiki/1.45/mediawiki-1.45.3.tar.gz\",\n    \"MediaWikiLocalArchivePath\": \"/data/application-archives/mediawiki-latest.tar.gz\",\n    \"DrupalCoreUrl\": \"http://php-web.fc-php.svc.cluster.local.:5400/api/v1/application-archives/drupal/latest.tar.gz\",\n    \"DrupalProxySourceUrl\": \"https://ftp.drupal.org/files/projects/drupal-11.3.8.tar.gz\",\n    \"DrupalLocalArchivePath\": \"/data/application-archives/drupal-latest.tar.gz\",\n    \"BypassUpstreamTls\": true\n  },\n  \"ContainerBackend\": {\n    \"Default\": \"Kubernetes\"\n  },\n  \"FlowerCore\": {\n    \"Auth\": {\n      \"Provider\": \"Oidc\",\n      \"Enabled\": false,\n      \"Oidc\": {\n        \"Enabled\": true,\n        \"Authority\": \"https://id.iamworkin.lan/application/o/php/\",\n        \"Audience\": \"php\",\n        \"ClientId\": \"php\",\n        \"ClientSecret\": \"\"\n      },\n      \"Impersonation\": {\n        \"Enabled\": false,\n        \"DebugMode\": false\n      }\n    },\n    \"Tenant\": {\n      \"StrictMode\": false,\n      \"JwtClaimsEnabled\": false,\n      \"TenantClaimType\": \"fc:tenant\",\n      \"ActorIdClaimType\": \"flowercore_actor_id\"\n    },\n    \"Account\": {\n      \"AppId\": \"php\",\n      \"DefaultTenantId\": \"default\",\n      \"Impersonation\": {\n        \"Enabled\": false,\n        \"StrictMode\": false,\n        \"TechSupportRoles\": [ \"tech-support\" ],\n        \"Targets\": []\n      }\n    },\n    \"Hosting\": {\n      \"AutoDns\": {\n        \"Enabled\": true,\n        \"DnsManagerBaseUrl\": \"https://dns.iamworkin.lan/\",\n        \"ZoneName\": \"iamworkin.lan\",\n        \"RecordType\": \"A\",\n        \"TargetAddress\": \"10.0.56.200\",\n        \"Ttl\": 300,\n        \"BypassTls\": true\n      }\n    },\n    \"Database\": {\n      \"Provider\": \"Sqlite\",\n      \"ConnectionStrings\": {\n        \"Sqlite\": \"Data Source=/data/php-manager.db\"\n      }\n    }\n  }\n}\n"
+  },
+  "kind": "ConfigMap",
+  "metadata": {
+    "name": "php-web-config",
+    "namespace": "fc-php"
+  }
+}

apps-gx10/fc-php/deployment-php-web.json

@@ -0,0 +1,209 @@
+{
+  "apiVersion": "apps/v1",
+  "kind": "Deployment",
+  "metadata": {
+    "labels": {
+      "app.kubernetes.io/managed-by": "flowercore",
+      "app.kubernetes.io/name": "php-web"
+    },
+    "name": "php-web",
+    "namespace": "fc-php"
+  },
+  "spec": {
+    "progressDeadlineSeconds": 600,
+    "replicas": 1,
+    "revisionHistoryLimit": 10,
+    "selector": {
+      "matchLabels": {
+        "app.kubernetes.io/name": "php-web"
+      }
+    },
+    "strategy": {
+      "type": "Recreate"
+    },
+    "template": {
+      "metadata": {
+        "annotations": {
+          "kubectl.kubernetes.io/restartedAt": "2026-06-13T01:59:27-05:00",
+          "prometheus.io/path": "/metrics/prometheus",
+          "prometheus.io/port": "5400",
+          "prometheus.io/scrape": "true"
+        },
+        "labels": {
+          "app.kubernetes.io/name": "php-web"
+        }
+      },
+      "spec": {
+        "containers": [
+          {
+            "env": [
+              {
+                "name": "FlowerCore__Auth__Enabled",
+                "value": "false"
+              },
+              {
+                "name": "FlowerCore__Auth__Oidc__Authority",
+                "valueFrom": {
+                  "secretKeyRef": {
+                    "key": "issuer_url",
+                    "name": "php-oidc-client",
+                    "optional": true
+                  }
+                }
+              },
+              {
+                "name": "FlowerCore__Auth__Oidc__ClientId",
+                "valueFrom": {
+                  "secretKeyRef": {
+                    "key": "client_id",
+                    "name": "php-oidc-client",
+                    "optional": true
+                  }
+                }
+              },
+              {
+                "name": "FlowerCore__Auth__Oidc__ClientSecret",
+                "valueFrom": {
+                  "secretKeyRef": {
+                    "key": "client_secret",
+                    "name": "php-oidc-client",
+                    "optional": true
+                  }
+                }
+              },
+              {
+                "name": "FlowerCore__Auth__Oidc__Audience",
+                "value": "php"
+              }
+            ],
+            "image": "localhost/fc-php-web:v20260617-sec5-c26a1bf",
+            "imagePullPolicy": "Never",
+            "livenessProbe": {
+              "failureThreshold": 3,
+              "httpGet": {
+                "path": "/metrics/prometheus",
+                "port": 5400,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 20,
+              "periodSeconds": 30,
+              "successThreshold": 1,
+              "timeoutSeconds": 1
+            },
+            "name": "php-web",
+            "ports": [
+              {
+                "containerPort": 5400,
+                "protocol": "TCP"
+              }
+            ],
+            "readinessProbe": {
+              "failureThreshold": 3,
+              "httpGet": {
+                "path": "/metrics/prometheus",
+                "port": 5400,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 10,
+              "periodSeconds": 10,
+              "successThreshold": 1,
+              "timeoutSeconds": 1
+            },
+            "resources": {
+              "limits": {
+                "cpu": "500m",
+                "memory": "512Mi"
+              },
+              "requests": {
+                "cpu": "100m",
+                "memory": "128Mi"
+              }
+            },
+            "securityContext": {
+              "allowPrivilegeEscalation": false,
+              "capabilities": {
+                "drop": [
+                  "ALL"
+                ]
+              },
+              "readOnlyRootFilesystem": true
+            },
+            "terminationMessagePath": "/dev/termination-log",
+            "terminationMessagePolicy": "File",
+            "volumeMounts": [
+              {
+                "mountPath": "/data",
+                "name": "data"
+              },
+              {
+                "mountPath": "/tmp",
+                "name": "tmp"
+              },
+              {
+                "mountPath": "/app/logs",
+                "name": "logs"
+              },
+              {
+                "mountPath": "/app/appsettings.Production.json",
+                "name": "config",
+                "readOnly": true,
+                "subPath": "appsettings.Production.json"
+              }
+            ]
+          }
+        ],
+        "dnsConfig": {
+          "nameservers": [
+            "10.43.0.10"
+          ],
+          "options": [
+            {
+              "name": "ndots",
+              "value": "2"
+            }
+          ],
+          "searches": [
+            "fc-php.svc.cluster.local",
+            "svc.cluster.local",
+            "cluster.local"
+          ]
+        },
+        "dnsPolicy": "None",
+        "restartPolicy": "Always",
+        "schedulerName": "default-scheduler",
+        "securityContext": {
+          "fsGroup": 1654,
+          "runAsGroup": 1654,
+          "runAsNonRoot": true,
+          "runAsUser": 1654
+        },
+        "serviceAccount": "php-web",
+        "serviceAccountName": "php-web",
+        "terminationGracePeriodSeconds": 30,
+        "volumes": [
+          {
+            "name": "data",
+            "persistentVolumeClaim": {
+              "claimName": "php-web-data"
+            }
+          },
+          {
+            "emptyDir": {},
+            "name": "tmp"
+          },
+          {
+            "emptyDir": {},
+            "name": "logs"
+          },
+          {
+            "configMap": {
+              "defaultMode": 420,
+              "name": "php-web-config"
+            },
+            "name": "config"
+          }
+        ]
+      }
+    }
+  }
+}

apps-gx10/fc-php/ingressroute-php-web.json

@@ -0,0 +1,29 @@
+{
+  "apiVersion": "traefik.io/v1alpha1",
+  "kind": "IngressRoute",
+  "metadata": {
+    "name": "php-web",
+    "namespace": "fc-php"
+  },
+  "spec": {
+    "entryPoints": [
+      "websecure"
+    ],
+    "routes": [
+      {
+        "kind": "Rule",
+        "match": "Host(`php.iamworkin.lan`)",
+        "priority": 100,
+        "services": [
+          {
+            "name": "php-web",
+            "port": 5400
+          }
+        ]
+      }
+    ],
+    "tls": {
+      "secretName": "php-web-tls"
+    }
+  }
+}

apps-gx10/fc-php/service-php-web.json

@@ -0,0 +1,23 @@
+{
+  "apiVersion": "v1",
+  "kind": "Service",
+  "metadata": {
+    "name": "php-web",
+    "namespace": "fc-php"
+  },
+  "spec": {
+    "internalTrafficPolicy": "Cluster",
+    "ports": [
+      {
+        "port": 5400,
+        "protocol": "TCP",
+        "targetPort": 5400
+      }
+    ],
+    "selector": {
+      "app.kubernetes.io/name": "php-web"
+    },
+    "sessionAffinity": "None",
+    "type": "ClusterIP"
+  }
+}

apps-gx10/fc-php/serviceaccount-php-web.json

@@ -0,0 +1,8 @@
+{
+  "apiVersion": "v1",
+  "kind": "ServiceAccount",
+  "metadata": {
+    "name": "php-web",
+    "namespace": "fc-php"
+  }
+}

apps-gx10/fc-presentations/configmap-presentations-web-config.json

@@ -0,0 +1,22 @@
+{
+  "apiVersion": "v1",
+  "data": {
+    "ASPNETCORE_ENVIRONMENT": "Production",
+    "ASPNETCORE_FORWARDEDHEADERS_ENABLED": "true",
+    "ASPNETCORE_URLS": "http://+:8080",
+    "FlowerCore__Database__ConnectionStrings__Sqlite": "Data Source=/data/presentations.db",
+    "FlowerCore__Database__Provider": "Sqlite",
+    "OTEL_EXPORTER_OTLP_ENDPOINT": "http://otel-collector.monitoring.svc.cluster.local:4317",
+    "OTEL_EXPORTER_OTLP_PROTOCOL": "grpc",
+    "OTEL_SERVICE_NAME": "FlowerCore.Presentations",
+    "PresentationStorage__HtmlBundlesRelativePath": "uploads/html-bundles",
+    "PresentationStorage__ImportsRelativePath": "uploads/imports",
+    "PresentationStorage__SlidesRelativePath": "uploads/slides",
+    "Security__AllowedOrigins__0": "https://presentations.iamworkin.lan"
+  },
+  "kind": "ConfigMap",
+  "metadata": {
+    "name": "presentations-web-config",
+    "namespace": "fc-presentations"
+  }
+}

apps-gx10/fc-presentations/deployment-presentations-web.json

@@ -0,0 +1,143 @@
+{
+  "apiVersion": "apps/v1",
+  "kind": "Deployment",
+  "metadata": {
+    "labels": {
+      "app.kubernetes.io/name": "presentations-web",
+      "app.kubernetes.io/part-of": "flowercore"
+    },
+    "name": "presentations-web",
+    "namespace": "fc-presentations"
+  },
+  "spec": {
+    "progressDeadlineSeconds": 600,
+    "replicas": 1,
+    "revisionHistoryLimit": 10,
+    "selector": {
+      "matchLabels": {
+        "app.kubernetes.io/name": "presentations-web"
+      }
+    },
+    "strategy": {
+      "type": "Recreate"
+    },
+    "template": {
+      "metadata": {
+        "annotations": {
+          "kubectl.kubernetes.io/restartedAt": "2026-04-23T14:47:39-05:00",
+          "prometheus.io/path": "/metrics/prometheus",
+          "prometheus.io/port": "8080",
+          "prometheus.io/scrape": "true"
+        },
+        "labels": {
+          "app.kubernetes.io/name": "presentations-web",
+          "app.kubernetes.io/part-of": "flowercore"
+        }
+      },
+      "spec": {
+        "containers": [
+          {
+            "envFrom": [
+              {
+                "configMapRef": {
+                  "name": "presentations-web-config"
+                }
+              },
+              {
+                "secretRef": {
+                  "name": "presentations-web-secrets"
+                }
+              }
+            ],
+            "image": "localhost/fc-presentations:gx10-v1",
+            "imagePullPolicy": "Never",
+            "livenessProbe": {
+              "failureThreshold": 3,
+              "httpGet": {
+                "path": "/health",
+                "port": 8080,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 30,
+              "periodSeconds": 30,
+              "successThreshold": 1,
+              "timeoutSeconds": 5
+            },
+            "name": "presentations-web",
+            "ports": [
+              {
+                "containerPort": 8080,
+                "name": "http",
+                "protocol": "TCP"
+              }
+            ],
+            "readinessProbe": {
+              "failureThreshold": 6,
+              "httpGet": {
+                "path": "/health",
+                "port": 8080,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 10,
+              "periodSeconds": 10,
+              "successThreshold": 1,
+              "timeoutSeconds": 5
+            },
+            "resources": {},
+            "terminationMessagePath": "/dev/termination-log",
+            "terminationMessagePolicy": "File",
+            "volumeMounts": [
+              {
+                "mountPath": "/data",
+                "name": "data",
+                "subPath": "data"
+              },
+              {
+                "mountPath": "/home/app/wwwroot/uploads",
+                "name": "data",
+                "subPath": "uploads"
+              }
+            ]
+          }
+        ],
+        "dnsPolicy": "ClusterFirst",
+        "initContainers": [
+          {
+            "command": [
+              "/bin/sh",
+              "-lc",
+              "set -eu\nmkdir -p /mnt/pvc/data /mnt/pvc/uploads\n\nfor file in presentations.db presentations.db-shm presentations.db-wal; do\n  if [ -f \"/mnt/pvc/${file}\" ] && [ ! -f \"/mnt/pvc/data/${file}\" ]; then\n    mv \"/mnt/pvc/${file}\" \"/mnt/pvc/data/${file}\"\n  fi\ndone\n\nif [ -d /mnt/pvc/dp-keys ] && [ ! -d /mnt/pvc/data/dp-keys ]; then\n  mv /mnt/pvc/dp-keys /mnt/pvc/data/dp-keys\nfi\n\nfor directory in imports slides html-bundles; do\n  if [ -d \"/mnt/pvc/${directory}\" ] && [ ! -d \"/mnt/pvc/uploads/${directory}\" ]; then\n    mv \"/mnt/pvc/${directory}\" \"/mnt/pvc/uploads/${directory}\"\n  fi\ndone\n\nmkdir -p \\\n  /mnt/pvc/data/dp-keys \\\n  /mnt/pvc/uploads/imports \\\n  /mnt/pvc/uploads/slides \\\n  /mnt/pvc/uploads/html-bundles\n"
+            ],
+            "image": "localhost/fc-presentations:gx10-v1",
+            "imagePullPolicy": "Never",
+            "name": "storage-init",
+            "resources": {},
+            "terminationMessagePath": "/dev/termination-log",
+            "terminationMessagePolicy": "File",
+            "volumeMounts": [
+              {
+                "mountPath": "/mnt/pvc",
+                "name": "data"
+              }
+            ]
+          }
+        ],
+        "restartPolicy": "Always",
+        "schedulerName": "default-scheduler",
+        "securityContext": {
+          "fsGroup": 1654,
+          "fsGroupChangePolicy": "OnRootMismatch"
+        },
+        "terminationGracePeriodSeconds": 30,
+        "volumes": [
+          {
+            "name": "data",
+            "persistentVolumeClaim": {
+              "claimName": "presentations-web-data"
+            }
+          }
+        ]
+      }
+    }
+  }
+}

apps-gx10/fc-presentations/ingressroute-presentations-web.json

@@ -0,0 +1,29 @@
+{
+  "apiVersion": "traefik.io/v1alpha1",
+  "kind": "IngressRoute",
+  "metadata": {
+    "name": "presentations-web",
+    "namespace": "fc-presentations"
+  },
+  "spec": {
+    "entryPoints": [
+      "websecure"
+    ],
+    "routes": [
+      {
+        "kind": "Rule",
+        "match": "Host(`presentations.iamworkin.lan`)",
+        "priority": 100,
+        "services": [
+          {
+            "name": "presentations-web",
+            "port": 80
+          }
+        ]
+      }
+    ],
+    "tls": {
+      "secretName": "presentations-web-tls"
+    }
+  }
+}

apps-gx10/fc-presentations/service-presentations-web.json

@@ -0,0 +1,28 @@
+{
+  "apiVersion": "v1",
+  "kind": "Service",
+  "metadata": {
+    "labels": {
+      "app.kubernetes.io/name": "presentations-web",
+      "app.kubernetes.io/part-of": "flowercore"
+    },
+    "name": "presentations-web",
+    "namespace": "fc-presentations"
+  },
+  "spec": {
+    "internalTrafficPolicy": "Cluster",
+    "ports": [
+      {
+        "name": "http",
+        "port": 80,
+        "protocol": "TCP",
+        "targetPort": 8080
+      }
+    ],
+    "selector": {
+      "app.kubernetes.io/name": "presentations-web"
+    },
+    "sessionAffinity": "None",
+    "type": "ClusterIP"
+  }
+}

apps-gx10/fc-retail/configmap-retail-web-config.json

@@ -0,0 +1,20 @@
+{
+  "apiVersion": "v1",
+  "data": {
+    "ASPNETCORE_ENVIRONMENT": "Production",
+    "ASPNETCORE_FORWARDEDHEADERS_ENABLED": "true",
+    "ASPNETCORE_URLS": "http://+:5000",
+    "FlowerCore__Database__ConnectionStrings__Sqlite": "Data Source=/data/retail.db",
+    "FlowerCore__Database__Provider": "Sqlite",
+    "FlowerCore__Retail__BaseUrl": "https://retail.iamworkin.lan",
+    "OTEL_EXPORTER_OTLP_ENDPOINT": "http://otel-collector.monitoring.svc.cluster.local:4317",
+    "OTEL_EXPORTER_OTLP_PROTOCOL": "grpc",
+    "OTEL_SERVICE_NAME": "FlowerCore.Retail",
+    "PrintService__BaseUrl": "http://print.iamworkin.lan:5200"
+  },
+  "kind": "ConfigMap",
+  "metadata": {
+    "name": "retail-web-config",
+    "namespace": "fc-retail"
+  }
+}

apps-gx10/fc-retail/deployment-retail-web.json

@@ -0,0 +1,111 @@
+{
+  "apiVersion": "apps/v1",
+  "kind": "Deployment",
+  "metadata": {
+    "labels": {
+      "app.kubernetes.io/managed-by": "argocd",
+      "app.kubernetes.io/name": "retail-web",
+      "app.kubernetes.io/part-of": "flowercore"
+    },
+    "name": "retail-web",
+    "namespace": "fc-retail"
+  },
+  "spec": {
+    "progressDeadlineSeconds": 600,
+    "replicas": 1,
+    "revisionHistoryLimit": 3,
+    "selector": {
+      "matchLabels": {
+        "app.kubernetes.io/name": "retail-web"
+      }
+    },
+    "strategy": {
+      "type": "Recreate"
+    },
+    "template": {
+      "metadata": {
+        "annotations": {
+          "fc.flowercore.io/healthz-anon": "true",
+          "fc.flowercore.io/probe-path": "/healthz",
+          "kubectl.kubernetes.io/restartedAt": "2026-06-02T01:34:08-05:00",
+          "prometheus.io/path": "/metrics/prometheus",
+          "prometheus.io/port": "5000",
+          "prometheus.io/scrape": "true"
+        },
+        "labels": {
+          "app.kubernetes.io/name": "retail-web",
+          "app.kubernetes.io/part-of": "flowercore"
+        }
+      },
+      "spec": {
+        "containers": [
+          {
+            "envFrom": [
+              {
+                "configMapRef": {
+                  "name": "retail-web-config"
+                }
+              }
+            ],
+            "image": "localhost/fc-retail-web:gx10-v1",
+            "imagePullPolicy": "Never",
+            "livenessProbe": {
+              "failureThreshold": 3,
+              "httpGet": {
+                "path": "/health",
+                "port": 5000,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 30,
+              "periodSeconds": 30,
+              "successThreshold": 1,
+              "timeoutSeconds": 5
+            },
+            "name": "retail-web",
+            "ports": [
+              {
+                "containerPort": 5000,
+                "name": "http",
+                "protocol": "TCP"
+              }
+            ],
+            "readinessProbe": {
+              "failureThreshold": 6,
+              "httpGet": {
+                "path": "/health",
+                "port": 5000,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 10,
+              "periodSeconds": 10,
+              "successThreshold": 1,
+              "timeoutSeconds": 5
+            },
+            "resources": {},
+            "terminationMessagePath": "/dev/termination-log",
+            "terminationMessagePolicy": "File",
+            "volumeMounts": [
+              {
+                "mountPath": "/data",
+                "name": "data"
+              }
+            ]
+          }
+        ],
+        "dnsPolicy": "ClusterFirst",
+        "restartPolicy": "Always",
+        "schedulerName": "default-scheduler",
+        "securityContext": {},
+        "terminationGracePeriodSeconds": 30,
+        "volumes": [
+          {
+            "name": "data",
+            "persistentVolumeClaim": {
+              "claimName": "retail-web-data"
+            }
+          }
+        ]
+      }
+    }
+  }
+}

apps-gx10/fc-retail/ingressroute-retail-web.json

@@ -0,0 +1,29 @@
+{
+  "apiVersion": "traefik.io/v1alpha1",
+  "kind": "IngressRoute",
+  "metadata": {
+    "name": "retail-web",
+    "namespace": "fc-retail"
+  },
+  "spec": {
+    "entryPoints": [
+      "websecure"
+    ],
+    "routes": [
+      {
+        "kind": "Rule",
+        "match": "Host(`retail.iamworkin.lan`)",
+        "priority": 100,
+        "services": [
+          {
+            "name": "retail-web",
+            "port": 80
+          }
+        ]
+      }
+    ],
+    "tls": {
+      "secretName": "retail-web-tls"
+    }
+  }
+}

apps-gx10/fc-retail/service-retail-web.json

@@ -0,0 +1,29 @@
+{
+  "apiVersion": "v1",
+  "kind": "Service",
+  "metadata": {
+    "labels": {
+      "app.kubernetes.io/managed-by": "argocd",
+      "app.kubernetes.io/name": "retail-web",
+      "app.kubernetes.io/part-of": "flowercore"
+    },
+    "name": "retail-web",
+    "namespace": "fc-retail"
+  },
+  "spec": {
+    "internalTrafficPolicy": "Cluster",
+    "ports": [
+      {
+        "name": "http",
+        "port": 80,
+        "protocol": "TCP",
+        "targetPort": 5000
+      }
+    ],
+    "selector": {
+      "app.kubernetes.io/name": "retail-web"
+    },
+    "sessionAffinity": "None",
+    "type": "ClusterIP"
+  }
+}

apps-gx10/fc-scoreboard/configmap-scoreboard-web-config.json

@@ -0,0 +1,21 @@
+{
+  "apiVersion": "v1",
+  "data": {
+    "ASPNETCORE_ENVIRONMENT": "Production",
+    "ASPNETCORE_FORWARDEDHEADERS_ENABLED": "true",
+    "ASPNETCORE_URLS": "http://+:8080",
+    "Auth__ApiKey": "change-me",
+    "FlowerCore__Database__ConnectionStrings__Sqlite": "Data Source=/data/scoreboard.db",
+    "FlowerCore__Database__Provider": "Sqlite",
+    "OTEL_EXPORTER_OTLP_ENDPOINT": "http://otel-collector.monitoring.svc.cluster.local:4317",
+    "OTEL_EXPORTER_OTLP_PROTOCOL": "grpc",
+    "OTEL_SERVICE_NAME": "FlowerCore.Scoreboard",
+    "Security__AllowedOrigins__0": "https://scoreboard.iamworkin.lan",
+    "Security__ApiKey": "change-me"
+  },
+  "kind": "ConfigMap",
+  "metadata": {
+    "name": "scoreboard-web-config",
+    "namespace": "fc-scoreboard"
+  }
+}

apps-gx10/fc-scoreboard/deployment-scoreboard-web.json

@@ -0,0 +1,132 @@
+{
+  "apiVersion": "apps/v1",
+  "kind": "Deployment",
+  "metadata": {
+    "labels": {
+      "app.kubernetes.io/name": "scoreboard-web",
+      "app.kubernetes.io/part-of": "flowercore"
+    },
+    "name": "scoreboard-web",
+    "namespace": "fc-scoreboard"
+  },
+  "spec": {
+    "progressDeadlineSeconds": 600,
+    "replicas": 1,
+    "revisionHistoryLimit": 10,
+    "selector": {
+      "matchLabels": {
+        "app.kubernetes.io/name": "scoreboard-web"
+      }
+    },
+    "strategy": {
+      "type": "Recreate"
+    },
+    "template": {
+      "metadata": {
+        "annotations": {
+          "kubectl.kubernetes.io/restartedAt": "2026-06-12T16:43:22-05:00",
+          "prometheus.io/path": "/metrics/prometheus",
+          "prometheus.io/port": "8080",
+          "prometheus.io/scrape": "true"
+        },
+        "labels": {
+          "app.kubernetes.io/name": "scoreboard-web",
+          "app.kubernetes.io/part-of": "flowercore"
+        }
+      },
+      "spec": {
+        "containers": [
+          {
+            "envFrom": [
+              {
+                "configMapRef": {
+                  "name": "scoreboard-web-config"
+                }
+              }
+            ],
+            "image": "localhost/fc-scoreboard-web:gx10-v1",
+            "imagePullPolicy": "Never",
+            "livenessProbe": {
+              "failureThreshold": 3,
+              "initialDelaySeconds": 30,
+              "periodSeconds": 30,
+              "successThreshold": 1,
+              "tcpSocket": {
+                "port": 8080
+              },
+              "timeoutSeconds": 5
+            },
+            "name": "scoreboard-web",
+            "ports": [
+              {
+                "containerPort": 8080,
+                "name": "http",
+                "protocol": "TCP"
+              }
+            ],
+            "readinessProbe": {
+              "failureThreshold": 6,
+              "initialDelaySeconds": 10,
+              "periodSeconds": 10,
+              "successThreshold": 1,
+              "tcpSocket": {
+                "port": 8080
+              },
+              "timeoutSeconds": 5
+            },
+            "resources": {},
+            "terminationMessagePath": "/dev/termination-log",
+            "terminationMessagePolicy": "File",
+            "volumeMounts": [
+              {
+                "mountPath": "/data",
+                "name": "data"
+              }
+            ]
+          }
+        ],
+        "dnsPolicy": "ClusterFirst",
+        "initContainers": [
+          {
+            "command": [
+              "/bin/sh",
+              "-c",
+              "chown -R 1654:1654 /data && chmod -R u+rwX,g+rwX /data"
+            ],
+            "image": "localhost/fc-scoreboard-web:gx10-v1",
+            "imagePullPolicy": "Never",
+            "name": "scoreboard-data-permissions",
+            "resources": {},
+            "securityContext": {
+              "runAsGroup": 0,
+              "runAsUser": 0
+            },
+            "terminationMessagePath": "/dev/termination-log",
+            "terminationMessagePolicy": "File",
+            "volumeMounts": [
+              {
+                "mountPath": "/data",
+                "name": "data"
+              }
+            ]
+          }
+        ],
+        "restartPolicy": "Always",
+        "schedulerName": "default-scheduler",
+        "securityContext": {
+          "fsGroup": 1654,
+          "fsGroupChangePolicy": "OnRootMismatch"
+        },
+        "terminationGracePeriodSeconds": 30,
+        "volumes": [
+          {
+            "name": "data",
+            "persistentVolumeClaim": {
+              "claimName": "scoreboard-web-data"
+            }
+          }
+        ]
+      }
+    }
+  }
+}

apps-gx10/fc-scoreboard/ingressroute-scoreboard-web.json

@@ -0,0 +1,29 @@
+{
+  "apiVersion": "traefik.io/v1alpha1",
+  "kind": "IngressRoute",
+  "metadata": {
+    "name": "scoreboard-web",
+    "namespace": "fc-scoreboard"
+  },
+  "spec": {
+    "entryPoints": [
+      "websecure"
+    ],
+    "routes": [
+      {
+        "kind": "Rule",
+        "match": "Host(`scoreboard.iamworkin.lan`)",
+        "priority": 100,
+        "services": [
+          {
+            "name": "scoreboard-web",
+            "port": 80
+          }
+        ]
+      }
+    ],
+    "tls": {
+      "secretName": "scoreboard-web-tls"
+    }
+  }
+}

apps-gx10/fc-scoreboard/service-scoreboard-web.json

@@ -0,0 +1,28 @@
+{
+  "apiVersion": "v1",
+  "kind": "Service",
+  "metadata": {
+    "labels": {
+      "app.kubernetes.io/name": "scoreboard-web",
+      "app.kubernetes.io/part-of": "flowercore"
+    },
+    "name": "scoreboard-web",
+    "namespace": "fc-scoreboard"
+  },
+  "spec": {
+    "internalTrafficPolicy": "Cluster",
+    "ports": [
+      {
+        "name": "http",
+        "port": 80,
+        "protocol": "TCP",
+        "targetPort": 8080
+      }
+    ],
+    "selector": {
+      "app.kubernetes.io/name": "scoreboard-web"
+    },
+    "sessionAffinity": "None",
+    "type": "ClusterIP"
+  }
+}

apps-gx10/fc-segmentdisplay/configmap-segmentdisplay-web-config.json

@@ -0,0 +1,19 @@
+{
+  "apiVersion": "v1",
+  "data": {
+    "ASPNETCORE_ENVIRONMENT": "Production",
+    "ASPNETCORE_FORWARDEDHEADERS_ENABLED": "true",
+    "ASPNETCORE_URLS": "http://+:8080",
+    "FlowerCore__Database__ConnectionStrings__Sqlite": "Data Source=/data/segmentdisplay.db",
+    "FlowerCore__Database__Provider": "Sqlite",
+    "OTEL_EXPORTER_OTLP_ENDPOINT": "http://otel-collector.monitoring.svc.cluster.local:4317",
+    "OTEL_EXPORTER_OTLP_PROTOCOL": "grpc",
+    "OTEL_SERVICE_NAME": "FlowerCore.SegmentDisplay",
+    "Security__AllowedOrigins__0": "https://segmentdisplay.iamworkin.lan"
+  },
+  "kind": "ConfigMap",
+  "metadata": {
+    "name": "segmentdisplay-web-config",
+    "namespace": "fc-segmentdisplay"
+  }
+}

apps-gx10/fc-segmentdisplay/deployment-segmentdisplay-web.json

@@ -0,0 +1,113 @@
+{
+  "apiVersion": "apps/v1",
+  "kind": "Deployment",
+  "metadata": {
+    "labels": {
+      "app.kubernetes.io/name": "segmentdisplay-web",
+      "app.kubernetes.io/part-of": "flowercore"
+    },
+    "name": "segmentdisplay-web",
+    "namespace": "fc-segmentdisplay"
+  },
+  "spec": {
+    "progressDeadlineSeconds": 600,
+    "replicas": 1,
+    "revisionHistoryLimit": 10,
+    "selector": {
+      "matchLabels": {
+        "app.kubernetes.io/name": "segmentdisplay-web"
+      }
+    },
+    "strategy": {
+      "type": "Recreate"
+    },
+    "template": {
+      "metadata": {
+        "annotations": {
+          "prometheus.io/path": "/metrics/prometheus",
+          "prometheus.io/port": "8080",
+          "prometheus.io/scrape": "true"
+        },
+        "labels": {
+          "app.kubernetes.io/name": "segmentdisplay-web",
+          "app.kubernetes.io/part-of": "flowercore"
+        }
+      },
+      "spec": {
+        "containers": [
+          {
+            "envFrom": [
+              {
+                "configMapRef": {
+                  "name": "segmentdisplay-web-config"
+                }
+              },
+              {
+                "secretRef": {
+                  "name": "segmentdisplay-web-secrets",
+                  "optional": true
+                }
+              }
+            ],
+            "image": "localhost/fc-segmentdisplay-web:gx10-v1",
+            "imagePullPolicy": "Never",
+            "livenessProbe": {
+              "failureThreshold": 3,
+              "httpGet": {
+                "path": "/health",
+                "port": 8080,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 30,
+              "periodSeconds": 30,
+              "successThreshold": 1,
+              "timeoutSeconds": 5
+            },
+            "name": "segmentdisplay-web",
+            "ports": [
+              {
+                "containerPort": 8080,
+                "name": "http",
+                "protocol": "TCP"
+              }
+            ],
+            "readinessProbe": {
+              "failureThreshold": 6,
+              "httpGet": {
+                "path": "/health",
+                "port": 8080,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 10,
+              "periodSeconds": 10,
+              "successThreshold": 1,
+              "timeoutSeconds": 5
+            },
+            "resources": {},
+            "terminationMessagePath": "/dev/termination-log",
+            "terminationMessagePolicy": "File",
+            "volumeMounts": [
+              {
+                "mountPath": "/data",
+                "name": "data"
+              }
+            ]
+          }
+        ],
+        "dnsPolicy": "ClusterFirst",
+        "restartPolicy": "Always",
+        "schedulerName": "default-scheduler",
+        "securityContext": {},
+        "terminationGracePeriodSeconds": 30,
+        "volumes": [
+          {
+            "name": "data",
+            "persistentVolumeClaim": {
+              "claimName": "segmentdisplay-web-data"
+            }
+          }
+        ]
+      }
+    }
+  }
+}

apps-gx10/fc-segmentdisplay/ingressroute-segmentdisplay-web.json

@@ -0,0 +1,29 @@
+{
+  "apiVersion": "traefik.io/v1alpha1",
+  "kind": "IngressRoute",
+  "metadata": {
+    "name": "segmentdisplay-web",
+    "namespace": "fc-segmentdisplay"
+  },
+  "spec": {
+    "entryPoints": [
+      "websecure"
+    ],
+    "routes": [
+      {
+        "kind": "Rule",
+        "match": "Host(`segmentdisplay.iamworkin.lan`)",
+        "priority": 100,
+        "services": [
+          {
+            "name": "segmentdisplay-web",
+            "port": 80
+          }
+        ]
+      }
+    ],
+    "tls": {
+      "secretName": "segmentdisplay-web-tls"
+    }
+  }
+}

apps-gx10/fc-segmentdisplay/service-segmentdisplay-web.json

@@ -0,0 +1,28 @@
+{
+  "apiVersion": "v1",
+  "kind": "Service",
+  "metadata": {
+    "labels": {
+      "app.kubernetes.io/name": "segmentdisplay-web",
+      "app.kubernetes.io/part-of": "flowercore"
+    },
+    "name": "segmentdisplay-web",
+    "namespace": "fc-segmentdisplay"
+  },
+  "spec": {
+    "internalTrafficPolicy": "Cluster",
+    "ports": [
+      {
+        "name": "http",
+        "port": 80,
+        "protocol": "TCP",
+        "targetPort": 8080
+      }
+    ],
+    "selector": {
+      "app.kubernetes.io/name": "segmentdisplay-web"
+    },
+    "sessionAffinity": "None",
+    "type": "ClusterIP"
+  }
+}

apps-gx10/fc-signage/deployment-signage-replay-web.json

@@ -0,0 +1,151 @@
+{
+  "apiVersion": "apps/v1",
+  "kind": "Deployment",
+  "metadata": {
+    "labels": {
+      "app": "signage-replay-web"
+    },
+    "name": "signage-replay-web",
+    "namespace": "fc-signage"
+  },
+  "spec": {
+    "progressDeadlineSeconds": 600,
+    "replicas": 1,
+    "revisionHistoryLimit": 10,
+    "selector": {
+      "matchLabels": {
+        "app": "signage-replay-web"
+      }
+    },
+    "strategy": {
+      "type": "Recreate"
+    },
+    "template": {
+      "metadata": {
+        "annotations": {
+          "kubectl.kubernetes.io/restartedAt": "2026-05-04T13:50:05-05:00"
+        },
+        "labels": {
+          "app": "signage-replay-web"
+        }
+      },
+      "spec": {
+        "containers": [
+          {
+            "env": [
+              {
+                "name": "ASPNETCORE_URLS",
+                "value": "http://+:5280"
+              },
+              {
+                "name": "ASPNETCORE_ENVIRONMENT",
+                "value": "Production"
+              },
+              {
+                "name": "ReplayFederation__Signage__Enabled",
+                "value": "true"
+              },
+              {
+                "name": "ReplayFederation__Signage__BaseUrl",
+                "value": "http://signage-web.fc-signage.svc.cluster.local.:5190"
+              },
+              {
+                "name": "ReplayFederation__Dms__Enabled",
+                "value": "true"
+              },
+              {
+                "name": "ReplayFederation__Dms__BaseUrl",
+                "value": "http://dms-web.fc-dms.svc.cluster.local.:8081"
+              }
+            ],
+            "image": "localhost/fc-signage-replay-web:gx10-v1",
+            "imagePullPolicy": "Never",
+            "livenessProbe": {
+              "failureThreshold": 3,
+              "httpGet": {
+                "path": "/healthz",
+                "port": 5280,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 20,
+              "periodSeconds": 20,
+              "successThreshold": 1,
+              "timeoutSeconds": 1
+            },
+            "name": "signage-replay-web",
+            "ports": [
+              {
+                "containerPort": 5280,
+                "name": "http",
+                "protocol": "TCP"
+              }
+            ],
+            "readinessProbe": {
+              "failureThreshold": 3,
+              "httpGet": {
+                "path": "/healthz",
+                "port": 5280,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 10,
+              "periodSeconds": 10,
+              "successThreshold": 1,
+              "timeoutSeconds": 1
+            },
+            "resources": {
+              "limits": {
+                "cpu": "500m",
+                "memory": "256Mi"
+              },
+              "requests": {
+                "cpu": "100m",
+                "memory": "128Mi"
+              }
+            },
+            "securityContext": {
+              "allowPrivilegeEscalation": false,
+              "capabilities": {
+                "drop": [
+                  "ALL"
+                ]
+              },
+              "readOnlyRootFilesystem": true
+            },
+            "terminationMessagePath": "/dev/termination-log",
+            "terminationMessagePolicy": "File",
+            "volumeMounts": [
+              {
+                "mountPath": "/tmp",
+                "name": "tmp"
+              },
+              {
+                "mountPath": "/home/app/logs",
+                "name": "logs"
+              }
+            ]
+          }
+        ],
+        "dnsPolicy": "ClusterFirst",
+        "restartPolicy": "Always",
+        "schedulerName": "default-scheduler",
+        "securityContext": {
+          "fsGroup": 1654,
+          "runAsGroup": 1654,
+          "runAsNonRoot": true,
+          "runAsUser": 1654
+        },
+        "terminationGracePeriodSeconds": 30,
+        "volumes": [
+          {
+            "emptyDir": {},
+            "name": "tmp"
+          },
+          {
+            "emptyDir": {},
+            "name": "logs"
+          }
+        ]
+      }
+    }
+  }
+}

apps-gx10/fc-signage/deployment-signage-web.json

@@ -0,0 +1,230 @@
+{
+  "apiVersion": "apps/v1",
+  "kind": "Deployment",
+  "metadata": {
+    "labels": {
+      "app": "signage-web"
+    },
+    "name": "signage-web",
+    "namespace": "fc-signage"
+  },
+  "spec": {
+    "progressDeadlineSeconds": 600,
+    "replicas": 1,
+    "revisionHistoryLimit": 10,
+    "selector": {
+      "matchLabels": {
+        "app": "signage-web"
+      }
+    },
+    "strategy": {
+      "type": "Recreate"
+    },
+    "template": {
+      "metadata": {
+        "annotations": {
+          "kubectl.kubernetes.io/restartedAt": "2026-05-04T13:50:05-05:00"
+        },
+        "labels": {
+          "app": "signage-web"
+        }
+      },
+      "spec": {
+        "containers": [
+          {
+            "env": [
+              {
+                "name": "ASPNETCORE_URLS",
+                "value": "http://+:5190"
+              },
+              {
+                "name": "ASPNETCORE_ENVIRONMENT",
+                "value": "Production"
+              },
+              {
+                "name": "TrafficSignal__RelayBridge__Enabled",
+                "value": "true"
+              },
+              {
+                "name": "TrafficSignal__RelayBridge__BaseUrl",
+                "value": "http://pirelay.iamworkin.lan:5100"
+              },
+              {
+                "name": "DatabaseProvider",
+                "value": "Sqlite"
+              },
+              {
+                "name": "ConnectionStrings__DefaultConnection",
+                "value": "Data Source=/data/signage.db"
+              },
+              {
+                "name": "Serilog__MinimumLevel__Default",
+                "value": "Information"
+              },
+              {
+                "name": "Serilog__WriteTo__0__Name",
+                "value": "Console"
+              },
+              {
+                "name": "Kestrel__Endpoints__Http__Url",
+                "value": "http://+:5190"
+              },
+              {
+                "name": "Kestrel__Endpoints__Grpc__Url",
+                "value": "http://+:5191"
+              },
+              {
+                "name": "FlowerCore__DefaultTenantId",
+                "value": "default"
+              },
+              {
+                "name": "FlowerCore__Signage__Announcements__AudibleEnabled",
+                "value": "true"
+              },
+              {
+                "name": "FlowerCore__Signage__Announcements__DefaultVoiceName",
+                "value": "en_US-amy-low"
+              },
+              {
+                "name": "FlowerCore__Signage__Announcements__Piper__Host",
+                "value": "10.0.57.17"
+              },
+              {
+                "name": "FlowerCore__Signage__Announcements__Piper__Port",
+                "value": "10400"
+              },
+              {
+                "name": "FlowerCore__Signage__Announcements__Piper__TimeoutSeconds",
+                "value": "120"
+              }
+            ],
+            "image": "localhost/fc-signage-web:v20260617-gx10-f2-4da0983",
+            "imagePullPolicy": "Never",
+            "livenessProbe": {
+              "failureThreshold": 3,
+              "httpGet": {
+                "path": "/healthz",
+                "port": 5190,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 30,
+              "periodSeconds": 30,
+              "successThreshold": 1,
+              "timeoutSeconds": 1
+            },
+            "name": "signage-web",
+            "ports": [
+              {
+                "containerPort": 5190,
+                "name": "http",
+                "protocol": "TCP"
+              }
+            ],
+            "readinessProbe": {
+              "failureThreshold": 3,
+              "httpGet": {
+                "path": "/healthz",
+                "port": 5190,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 15,
+              "periodSeconds": 10,
+              "successThreshold": 1,
+              "timeoutSeconds": 1
+            },
+            "resources": {
+              "limits": {
+                "cpu": "500m",
+                "memory": "512Mi"
+              },
+              "requests": {
+                "cpu": "10m",
+                "memory": "256Mi"
+              }
+            },
+            "securityContext": {
+              "allowPrivilegeEscalation": false,
+              "capabilities": {
+                "drop": [
+                  "ALL"
+                ]
+              },
+              "readOnlyRootFilesystem": true
+            },
+            "startupProbe": {
+              "failureThreshold": 30,
+              "periodSeconds": 5,
+              "successThreshold": 1,
+              "tcpSocket": {
+                "port": 5190
+              },
+              "timeoutSeconds": 1
+            },
+            "terminationMessagePath": "/dev/termination-log",
+            "terminationMessagePolicy": "File",
+            "volumeMounts": [
+              {
+                "mountPath": "/data",
+                "name": "data"
+              },
+              {
+                "mountPath": "/app/data",
+                "name": "data"
+              },
+              {
+                "mountPath": "/app/Cache",
+                "name": "data"
+              },
+              {
+                "mountPath": "/app/storage",
+                "name": "data"
+              },
+              {
+                "mountPath": "/app/wwwroot/uploads",
+                "name": "data"
+              },
+              {
+                "mountPath": "/tmp",
+                "name": "tmp"
+              },
+              {
+                "mountPath": "/app/logs",
+                "name": "logs"
+              },
+              {
+                "mountPath": "/app/wwwroot/announcement-audio",
+                "name": "data"
+              }
+            ]
+          }
+        ],
+        "dnsPolicy": "ClusterFirst",
+        "restartPolicy": "Always",
+        "schedulerName": "default-scheduler",
+        "securityContext": {
+          "fsGroup": 1654,
+          "runAsGroup": 1654,
+          "runAsNonRoot": true,
+          "runAsUser": 1654
+        },
+        "terminationGracePeriodSeconds": 30,
+        "volumes": [
+          {
+            "name": "data",
+            "persistentVolumeClaim": {
+              "claimName": "signage-data"
+            }
+          },
+          {
+            "emptyDir": {},
+            "name": "tmp"
+          },
+          {
+            "emptyDir": {},
+            "name": "logs"
+          }
+        ]
+      }
+    }
+  }
+}

apps-gx10/fc-signage/ingressroute-signage-replay-web.json

@@ -0,0 +1,29 @@
+{
+  "apiVersion": "traefik.io/v1alpha1",
+  "kind": "IngressRoute",
+  "metadata": {
+    "name": "signage-replay-web",
+    "namespace": "fc-signage"
+  },
+  "spec": {
+    "entryPoints": [
+      "websecure"
+    ],
+    "routes": [
+      {
+        "kind": "Rule",
+        "match": "Host(`replay.iamworkin.lan`)",
+        "priority": 100,
+        "services": [
+          {
+            "name": "signage-replay-web",
+            "port": 5280
+          }
+        ]
+      }
+    ],
+    "tls": {
+      "secretName": "signage-replay-web-tls"
+    }
+  }
+}

apps-gx10/fc-signage/ingressroute-signage-web.json

@@ -0,0 +1,29 @@
+{
+  "apiVersion": "traefik.io/v1alpha1",
+  "kind": "IngressRoute",
+  "metadata": {
+    "name": "signage-web",
+    "namespace": "fc-signage"
+  },
+  "spec": {
+    "entryPoints": [
+      "websecure"
+    ],
+    "routes": [
+      {
+        "kind": "Rule",
+        "match": "Host(`signage.iamworkin.lan`)",
+        "priority": 100,
+        "services": [
+          {
+            "name": "signage-web",
+            "port": 5190
+          }
+        ]
+      }
+    ],
+    "tls": {
+      "secretName": "signage-web-tls"
+    }
+  }
+}

apps-gx10/fc-signage/service-signage-replay-web.json

@@ -0,0 +1,24 @@
+{
+  "apiVersion": "v1",
+  "kind": "Service",
+  "metadata": {
+    "name": "signage-replay-web",
+    "namespace": "fc-signage"
+  },
+  "spec": {
+    "internalTrafficPolicy": "Cluster",
+    "ports": [
+      {
+        "name": "http",
+        "port": 5280,
+        "protocol": "TCP",
+        "targetPort": 5280
+      }
+    ],
+    "selector": {
+      "app": "signage-replay-web"
+    },
+    "sessionAffinity": "None",
+    "type": "ClusterIP"
+  }
+}

apps-gx10/fc-signage/service-signage-web.json

@@ -0,0 +1,24 @@
+{
+  "apiVersion": "v1",
+  "kind": "Service",
+  "metadata": {
+    "name": "signage-web",
+    "namespace": "fc-signage"
+  },
+  "spec": {
+    "internalTrafficPolicy": "Cluster",
+    "ports": [
+      {
+        "name": "http",
+        "port": 5190,
+        "protocol": "TCP",
+        "targetPort": 5190
+      }
+    ],
+    "selector": {
+      "app": "signage-web"
+    },
+    "sessionAffinity": "None",
+    "type": "ClusterIP"
+  }
+}

apps-gx10/fc-signalcontrol/deployment-signalcontrol-web.json

@@ -0,0 +1,133 @@
+{
+  "apiVersion": "apps/v1",
+  "kind": "Deployment",
+  "metadata": {
+    "labels": {
+      "app.kubernetes.io/name": "signalcontrol-web",
+      "app.kubernetes.io/part-of": "flowercore"
+    },
+    "name": "signalcontrol-web",
+    "namespace": "fc-signalcontrol"
+  },
+  "spec": {
+    "progressDeadlineSeconds": 600,
+    "replicas": 1,
+    "revisionHistoryLimit": 10,
+    "selector": {
+      "matchLabels": {
+        "app.kubernetes.io/name": "signalcontrol-web"
+      }
+    },
+    "strategy": {
+      "type": "Recreate"
+    },
+    "template": {
+      "metadata": {
+        "annotations": {
+          "kubectl.kubernetes.io/restartedAt": "2026-04-22T23:55:51-05:00"
+        },
+        "labels": {
+          "app.kubernetes.io/name": "signalcontrol-web",
+          "app.kubernetes.io/part-of": "flowercore"
+        }
+      },
+      "spec": {
+        "containers": [
+          {
+            "env": [
+              {
+                "name": "ASPNETCORE_ENVIRONMENT",
+                "value": "Production"
+              },
+              {
+                "name": "ASPNETCORE_URLS",
+                "value": "http://+:5000"
+              },
+              {
+                "name": "ConnectionStrings__Default",
+                "value": "Data Source=/data/signalcontrol.db"
+              },
+              {
+                "name": "Logging__LogLevel__Default",
+                "value": "Information"
+              },
+              {
+                "name": "Auth__ApiKey",
+                "valueFrom": {
+                  "secretKeyRef": {
+                    "key": "Auth__ApiKey",
+                    "name": "signalcontrol-auth"
+                  }
+                }
+              }
+            ],
+            "image": "localhost/fc-signalcontrol-web:gx10-v1",
+            "imagePullPolicy": "Never",
+            "livenessProbe": {
+              "failureThreshold": 3,
+              "initialDelaySeconds": 30,
+              "periodSeconds": 30,
+              "successThreshold": 1,
+              "tcpSocket": {
+                "port": "http"
+              },
+              "timeoutSeconds": 5
+            },
+            "name": "signalcontrol-web",
+            "ports": [
+              {
+                "containerPort": 5000,
+                "name": "http",
+                "protocol": "TCP"
+              }
+            ],
+            "readinessProbe": {
+              "failureThreshold": 6,
+              "initialDelaySeconds": 10,
+              "periodSeconds": 10,
+              "successThreshold": 1,
+              "tcpSocket": {
+                "port": "http"
+              },
+              "timeoutSeconds": 5
+            },
+            "resources": {
+              "limits": {
+                "cpu": "500m",
+                "memory": "512Mi"
+              },
+              "requests": {
+                "cpu": "100m",
+                "memory": "128Mi"
+              }
+            },
+            "terminationMessagePath": "/dev/termination-log",
+            "terminationMessagePolicy": "File",
+            "volumeMounts": [
+              {
+                "mountPath": "/data",
+                "name": "data"
+              }
+            ]
+          }
+        ],
+        "dnsPolicy": "ClusterFirst",
+        "restartPolicy": "Always",
+        "schedulerName": "default-scheduler",
+        "securityContext": {
+          "fsGroup": 4200,
+          "fsGroupChangePolicy": "OnRootMismatch"
+        },
+        "terminationGracePeriodSeconds": 30,
+        "volumes": [
+          {
+            "name": "data",
+            "persistentVolumeClaim": {
+              "claimName": "signalcontrol-data"
+            }
+          }
+        ]
+      }
+    }
+  }
+}

apps-gx10/fc-signalcontrol/ingressroute-signalcontrol-web.json

@@ -0,0 +1,29 @@
+{
+  "apiVersion": "traefik.io/v1alpha1",
+  "kind": "IngressRoute",
+  "metadata": {
+    "name": "signalcontrol-web",
+    "namespace": "fc-signalcontrol"
+  },
+  "spec": {
+    "entryPoints": [
+      "websecure"
+    ],
+    "routes": [
+      {
+        "kind": "Rule",
+        "match": "Host(`signalcontrol.iamworkin.lan`)",
+        "priority": 100,
+        "services": [
+          {
+            "name": "signalcontrol-web",
+            "port": 80
+          }
+        ]
+      }
+    ],
+    "tls": {
+      "secretName": "signalcontrol-web-tls"
+    }
+  }
+}

apps-gx10/fc-signalcontrol/service-signalcontrol-web.json

@@ -0,0 +1,28 @@
+{
+  "apiVersion": "v1",
+  "kind": "Service",
+  "metadata": {
+    "labels": {
+      "app.kubernetes.io/name": "signalcontrol-web",
+      "app.kubernetes.io/part-of": "flowercore"
+    },
+    "name": "signalcontrol-web",
+    "namespace": "fc-signalcontrol"
+  },
+  "spec": {
+    "internalTrafficPolicy": "Cluster",
+    "ports": [
+      {
+        "name": "http",
+        "port": 80,
+        "protocol": "TCP",
+        "targetPort": "http"
+      }
+    ],
+    "selector": {
+      "app.kubernetes.io/name": "signalcontrol-web"
+    },
+    "sessionAffinity": "None",
+    "type": "ClusterIP"
+  }
+}

apps-gx10/fc-system/configmap-fc-landing-html.json

@@ -0,0 +1,11 @@
+{
+  "apiVersion": "v1",
+  "data": {
+    "index.html": "<!DOCTYPE html>\n<html lang=\"en\">\n<head>\n    <meta charset=\"utf-8\">\n    <meta name=\"viewport\" content=\"width=device-width, initial-scale=1\">\n    <title>FlowerCore</title>\n    <style>\n        * { margin: 0; padding: 0; box-sizing: border-box; }\n        body {\n            font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif;\n            background: linear-gradient(135deg, #0a1628 0%, #1a2744 50%, #0d1f3c 100%);\n            color: #e0e8f0;\n            min-height: 100vh;\n            display: flex;\n            flex-direction: column;\n            align-items: center;\n            justify-content: center;\n        }\n        .hero {\n            text-align: center;\n            padding: 3rem;\n            max-width: 800px;\n        }\n        .logo {\n            font-size: 5rem;\n            margin-bottom: 1.5rem;\n            filter: drop-shadow(0 0 20px rgba(74, 158, 255, 0.3));\n        }\n        h1 {\n            font-size: 3rem;\n            background: linear-gradient(135deg, #4a9eff, #7ab3ff);\n            -webkit-background-clip: text;\n            -webkit-text-fill-color: transparent;\n            background-clip: text;\n            margin-bottom: 0.5rem;\n        }\n        .subtitle {\n            font-size: 1.3rem;\n            color: #7ab3ff;\n            font-weight: 300;\n            margin-bottom: 1rem;\n        }\n        .description {\n            font-size: 1rem;\n            color: #8aa8c4;\n            line-height: 1.6;\n            margin-bottom: 3rem;\n            max-width: 600px;\n        }\n        .services {\n            display: grid;\n            grid-template-columns: repeat(auto-fit, minmax(200px, 1fr));\n            gap: 1rem;\n            width: 100%;\n            max-width: 700px;\n            padding: 0 1rem;\n        }\n        .service {\n            background: rgba(74, 158, 255, 0.08);\n            border: 1px solid rgba(74, 158, 255, 0.2);\n            border-radius: 8px;\n            padding: 1.2rem;\n            text-decoration: none;\n            color: inherit;\n            transition: all 0.2s;\n        }\n        .service:hover {\n            background: rgba(74, 158, 255, 0.15);\n            border-color: rgba(74, 158, 255, 0.5);\n            transform: translateY(-2px);\n        }\n        .service h3 { color: #4a9eff; font-size: 0.95rem; margin-bottom: 0.3rem; }\n        .service p { color: #8aa8c4; font-size: 0.8rem; }\n        .status-bar {\n            display: flex;\n            gap: 2rem;\n            margin-top: 2rem;\n            padding: 1rem 2rem;\n            background: rgba(74, 158, 255, 0.05);\n            border-radius: 8px;\n            border: 1px solid rgba(74, 158, 255, 0.1);\n        }\n        .status-item { text-align: center; }\n        .status-item .value { color: #4a9eff; font-size: 1.5rem; font-weight: 700; }\n        .status-item .label { color: #6a8ca4; font-size: 0.7rem; text-transform: uppercase; letter-spacing: 1px; }\n        .footer {\n            margin-top: 3rem;\n            color: #4a6580;\n            font-size: 0.8rem;\n        }\n        .footer a { color: #4a6580; text-decoration: none; }\n        .footer a:hover { color: #7ab3ff; }\n    </style>\n</head>\n<body>\n    <div class=\"hero\">\n        <div class=\"logo\">&#x1F33B;</div>\n        <h1>FlowerCore</h1>\n        <p class=\"subtitle\">Blue Jay Lab</p>\n        <p class=\"description\">\n            Multi-tenant service management platform built on .NET 10,\n            Kubernetes, and GitOps. Digital signage, telephony IVR,\n            MySQL/PHP hosting, and infrastructure automation.\n        </p>\n    </div>\n    <div class=\"services\">\n        <a class=\"service\" href=\"https://gitea.flowercore.io\">\n            <h3>Source</h3>\n            <p>Gitea repositories</p>\n        </a>\n        <a class=\"service\" href=\"https://webmail.flowercore.io\">\n            <h3>Mail</h3>\n            <p>Webmail access</p>\n        </a>\n        <a class=\"service\" href=\"https://element.flowercore.io\">\n            <h3>Chat</h3>\n            <p>Matrix messaging</p>\n        </a>\n        <a class=\"service\" href=\"https://github.com/FlowerCoreIO\">\n            <h3>GitHub</h3>\n            <p>Open source</p>\n        </a>\n    </div>\n    <div class=\"status-bar\">\n        <div class=\"status-item\">\n            <div class=\"value\">17</div>\n            <div class=\"label\">Services</div>\n        </div>\n        <div class=\"status-item\">\n            <div class=\"value\">13</div>\n            <div class=\"label\">VLANs</div>\n        </div>\n        <div class=\"status-item\">\n            <div class=\"value\">12k+</div>\n            <div class=\"label\">Tests</div>\n        </div>\n    </div>\n    <p class=\"footer\">\n        FlowerCore &middot; Bare-metal RKE2 &middot; ArgoCD managed\n        &middot; <a href=\"mailto:admin@flowercore.io\">Contact</a>\n    </p>\n</body>\n</html>\n"
+  },
+  "kind": "ConfigMap",
+  "metadata": {
+    "name": "fc-landing-html",
+    "namespace": "fc-system"
+  }
+}

apps-gx10/fc-system/configmap-fc-landing-nginx-conf.json

@@ -0,0 +1,11 @@
+{
+  "apiVersion": "v1",
+  "data": {
+    "default.conf": "server {\n    listen 80;\n    server_name _;\n    root /usr/share/nginx/html;\n    index index.html;\n\n    location / {\n        try_files $uri $uri/ =404;\n    }\n\n    location /healthz {\n        access_log off;\n        return 200 \"ok\";\n        add_header Content-Type text/plain;\n    }\n}\n"
+  },
+  "kind": "ConfigMap",
+  "metadata": {
+    "name": "fc-landing-nginx-conf",
+    "namespace": "fc-system"
+  }
+}

apps-gx10/fc-system/configmap-kiosk-web-config.json

@@ -0,0 +1,11 @@
+{
+  "apiVersion": "v1",
+  "data": {
+    "appsettings.Production.json": "{\n  \"FlowerCore\": {\n    \"Database\": {\n      \"Provider\": \"Sqlite\",\n      \"ConnectionStrings\": {\n        \"Sqlite\": \"Data Source=/app/data/kiosk.db\"\n      }\n    },\n    \"Kiosk\": {\n      \"Profiles\": {\n        \"Backend\": \"K8s\",\n        \"LonghornRoot\": \"/var/lib/flowercore/kiosk/profiles/data\"\n      }\n    },\n    \"PrintWeb\": {\n      \"Url\": \"http://10.0.57.16:5200\"\n    }\n  },\n  \"Serilog\": {\n    \"MinimumLevel\": {\n      \"Default\": \"Information\",\n      \"Override\": {\n        \"Microsoft\": \"Warning\",\n        \"Microsoft.EntityFrameworkCore\": \"Warning\"\n      }\n    },\n    \"WriteTo\": [\n      {\n        \"Name\": \"Console\",\n        \"Args\": {\n          \"formatter\": \"Serilog.Formatting.Compact.CompactJsonFormatter, Serilog.Formatting.Compact\"\n        }\n      }\n    ],\n    \"Enrich\": [\n      \"FromLogContext\",\n      \"WithProperty\"\n    ],\n    \"Properties\": {\n      \"Service\": \"Kiosk.Web\",\n      \"Environment\": \"Production\"\n    }\n  },\n  \"LibraryWeb\": {\n    \"Url\": \"http://library.iamworkin.lan:5100\"\n  },\n  \"Security\": {\n    \"Mode\": \"apikey\",\n    \"ApiKeys\": [],\n    \"AdminApiKeys\": [],\n    \"AgentApiKeys\": [],\n    \"ExemptPaths\": [ \"/health\", \"/metrics\", \"/_blazor\", \"/_framework\", \"/css\", \"/hubs\" ]\n  },\n  \"Logging\": {\n    \"LogLevel\": {\n      \"Default\": \"Information\",\n      \"Microsoft\": \"Warning\"\n    }\n  },\n  \"AllowedHosts\": \"*\"\n}\n"
+  },
+  "kind": "ConfigMap",
+  "metadata": {
+    "name": "kiosk-web-config",
+    "namespace": "fc-system"
+  }
+}

apps-gx10/fc-system/deployment-fc-landing.json

@@ -0,0 +1,119 @@
+{
+  "apiVersion": "apps/v1",
+  "kind": "Deployment",
+  "metadata": {
+    "labels": {
+      "app": "fc-landing"
+    },
+    "name": "fc-landing",
+    "namespace": "fc-system"
+  },
+  "spec": {
+    "progressDeadlineSeconds": 600,
+    "replicas": 1,
+    "revisionHistoryLimit": 10,
+    "selector": {
+      "matchLabels": {
+        "app": "fc-landing"
+      }
+    },
+    "strategy": {
+      "rollingUpdate": {
+        "maxSurge": "25%",
+        "maxUnavailable": "25%"
+      },
+      "type": "RollingUpdate"
+    },
+    "template": {
+      "metadata": {
+        "labels": {
+          "app": "fc-landing"
+        }
+      },
+      "spec": {
+        "containers": [
+          {
+            "image": "nginx:alpine",
+            "imagePullPolicy": "IfNotPresent",
+            "livenessProbe": {
+              "failureThreshold": 3,
+              "httpGet": {
+                "path": "/healthz",
+                "port": 80,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 5,
+              "periodSeconds": 10,
+              "successThreshold": 1,
+              "timeoutSeconds": 1
+            },
+            "name": "nginx",
+            "ports": [
+              {
+                "containerPort": 80,
+                "name": "http",
+                "protocol": "TCP"
+              }
+            ],
+            "readinessProbe": {
+              "failureThreshold": 3,
+              "httpGet": {
+                "path": "/healthz",
+                "port": 80,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 3,
+              "periodSeconds": 5,
+              "successThreshold": 1,
+              "timeoutSeconds": 1
+            },
+            "resources": {
+              "limits": {
+                "cpu": "50m",
+                "memory": "64Mi"
+              },
+              "requests": {
+                "cpu": "5m",
+                "memory": "16Mi"
+              }
+            },
+            "terminationMessagePath": "/dev/termination-log",
+            "terminationMessagePolicy": "File",
+            "volumeMounts": [
+              {
+                "mountPath": "/etc/nginx/conf.d/default.conf",
+                "name": "nginx-conf",
+                "subPath": "default.conf"
+              },
+              {
+                "mountPath": "/usr/share/nginx/html",
+                "name": "html"
+              }
+            ]
+          }
+        ],
+        "dnsPolicy": "ClusterFirst",
+        "restartPolicy": "Always",
+        "schedulerName": "default-scheduler",
+        "securityContext": {},
+        "terminationGracePeriodSeconds": 30,
+        "volumes": [
+          {
+            "configMap": {
+              "defaultMode": 420,
+              "name": "fc-landing-nginx-conf"
+            },
+            "name": "nginx-conf"
+          },
+          {
+            "configMap": {
+              "defaultMode": 420,
+              "name": "fc-landing-html"
+            },
+            "name": "html"
+          }
+        ]
+      }
+    }
+  }
+}

apps-gx10/fc-system/deployment-kiosk-web.json

@@ -0,0 +1,275 @@
+{
+  "apiVersion": "apps/v1",
+  "kind": "Deployment",
+  "metadata": {
+    "labels": {
+      "app": "kiosk-web",
+      "app.kubernetes.io/component": "web",
+      "app.kubernetes.io/instance": "kiosk-web",
+      "app.kubernetes.io/managed-by": "flowercore-kiosk",
+      "app.kubernetes.io/name": "kiosk-web",
+      "component": "web",
+      "flowercore.io/created-by": "kiosk-fleshing-out-phase-2",
+      "flowercore.io/tenant-id": "default",
+      "project": "flowercore-kiosk"
+    },
+    "name": "kiosk-web",
+    "namespace": "fc-system"
+  },
+  "spec": {
+    "progressDeadlineSeconds": 600,
+    "replicas": 1,
+    "revisionHistoryLimit": 10,
+    "selector": {
+      "matchLabels": {
+        "app": "kiosk-web"
+      }
+    },
+    "strategy": {
+      "type": "Recreate"
+    },
+    "template": {
+      "metadata": {
+        "annotations": {
+          "kubectl.kubernetes.io/restartedAt": "2026-05-06T21:21:19-05:00"
+        },
+        "labels": {
+          "app": "kiosk-web",
+          "app.kubernetes.io/component": "web",
+          "app.kubernetes.io/instance": "kiosk-web",
+          "app.kubernetes.io/managed-by": "flowercore-kiosk",
+          "app.kubernetes.io/name": "kiosk-web",
+          "component": "web",
+          "flowercore.io/created-by": "kiosk-fleshing-out-phase-2",
+          "flowercore.io/tenant-id": "default",
+          "project": "flowercore-kiosk"
+        }
+      },
+      "spec": {
+        "containers": [
+          {
+            "env": [
+              {
+                "name": "ASPNETCORE_URLS",
+                "value": "http://+:8080"
+              },
+              {
+                "name": "ASPNETCORE_ENVIRONMENT",
+                "value": "Production"
+              },
+              {
+                "name": "Security__ApiKeys__0",
+                "valueFrom": {
+                  "secretKeyRef": {
+                    "key": "BrowserBypassApiKey",
+                    "name": "kiosk-web-api-keys"
+                  }
+                }
+              },
+              {
+                "name": "Security__AdminApiKeys__0",
+                "valueFrom": {
+                  "secretKeyRef": {
+                    "key": "AdminApiKey",
+                    "name": "kiosk-web-api-keys"
+                  }
+                }
+              },
+              {
+                "name": "Security__AgentApiKeys__0",
+                "valueFrom": {
+                  "secretKeyRef": {
+                    "key": "AgentApiKey",
+                    "name": "kiosk-web-api-keys"
+                  }
+                }
+              },
+              {
+                "name": "FlowerCore__Kiosk__Profiles__Backend",
+                "value": "K8s"
+              },
+              {
+                "name": "FlowerCore__Kiosk__Profiles__LonghornRoot",
+                "value": "/var/lib/flowercore/kiosk/profiles/data"
+              },
+              {
+                "name": "FlowerCore__PrintWeb__Url",
+                "value": "http://10.0.57.16:5200"
+              },
+              {
+                "name": "FlowerCore__PrintWeb__ApiKey",
+                "valueFrom": {
+                  "secretKeyRef": {
+                    "key": "PrintWebApiKey",
+                    "name": "kiosk-web-api-keys"
+                  }
+                }
+              }
+            ],
+            "image": "localhost/fc-kiosk-web:gx10-v1",
+            "imagePullPolicy": "Never",
+            "livenessProbe": {
+              "failureThreshold": 6,
+              "httpGet": {
+                "path": "/health",
+                "port": 8080,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 120,
+              "periodSeconds": 20,
+              "successThreshold": 1,
+              "timeoutSeconds": 5
+            },
+            "name": "kiosk-web",
+            "ports": [
+              {
+                "containerPort": 8080,
+                "name": "http",
+                "protocol": "TCP"
+              }
+            ],
+            "readinessProbe": {
+              "failureThreshold": 3,
+              "httpGet": {
+                "path": "/health",
+                "port": 8080,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 45,
+              "periodSeconds": 10,
+              "successThreshold": 1,
+              "timeoutSeconds": 5
+            },
+            "resources": {
+              "limits": {
+                "cpu": "1",
+                "memory": "512Mi"
+              },
+              "requests": {
+                "cpu": "250m",
+                "memory": "256Mi"
+              }
+            },
+            "securityContext": {
+              "allowPrivilegeEscalation": false,
+              "capabilities": {
+                "drop": [
+                  "ALL"
+                ]
+              },
+              "readOnlyRootFilesystem": true
+            },
+            "terminationMessagePath": "/dev/termination-log",
+            "terminationMessagePolicy": "File",
+            "volumeMounts": [
+              {
+                "mountPath": "/app/data",
+                "name": "data"
+              },
+              {
+                "mountPath": "/tmp",
+                "name": "tmp"
+              },
+              {
+                "mountPath": "/app/logs",
+                "name": "logs"
+              },
+              {
+                "mountPath": "/var/lib/flowercore/kiosk/profiles",
+                "name": "user-profiles"
+              },
+              {
+                "mountPath": "/app/appsettings.Production.json",
+                "name": "appsettings-production",
+                "readOnly": true,
+                "subPath": "appsettings.Production.json"
+              }
+            ]
+          }
+        ],
+        "dnsPolicy": "ClusterFirst",
+        "initContainers": [
+          {
+            "command": [
+              "sh",
+              "-c",
+              "mkdir -p /profiles/data && chown -R 1654:1654 /profiles/data && chmod -R u+rwX,g+rwX /profiles/data"
+            ],
+            "image": "localhost/fc-kiosk-web:gx10-v1",
+            "imagePullPolicy": "Never",
+            "name": "fix-profile-perms",
+            "resources": {},
+            "securityContext": {
+              "allowPrivilegeEscalation": false,
+              "capabilities": {
+                "add": [
+                  "CHOWN",
+                  "FOWNER"
+                ],
+                "drop": [
+                  "ALL"
+                ]
+              },
+              "runAsGroup": 0,
+              "runAsNonRoot": false,
+              "runAsUser": 0
+            },
+            "terminationMessagePath": "/dev/termination-log",
+            "terminationMessagePolicy": "File",
+            "volumeMounts": [
+              {
+                "mountPath": "/profiles",
+                "name": "user-profiles"
+              }
+            ]
+          }
+        ],
+        "restartPolicy": "Always",
+        "schedulerName": "default-scheduler",
+        "securityContext": {
+          "fsGroup": 1654,
+          "fsGroupChangePolicy": "OnRootMismatch",
+          "runAsGroup": 1654,
+          "runAsNonRoot": true,
+          "runAsUser": 1654
+        },
+        "terminationGracePeriodSeconds": 30,
+        "volumes": [
+          {
+            "name": "data",
+            "persistentVolumeClaim": {
+              "claimName": "kiosk-web-data"
+            }
+          },
+          {
+            "emptyDir": {},
+            "name": "tmp"
+          },
+          {
+            "emptyDir": {},
+            "name": "logs"
+          },
+          {
+            "name": "user-profiles",
+            "persistentVolumeClaim": {
+              "claimName": "kiosk-user-profiles"
+            }
+          },
+          {
+            "configMap": {
+              "defaultMode": 420,
+              "items": [
+                {
+                  "key": "appsettings.Production.json",
+                  "path": "appsettings.Production.json"
+                }
+              ],
+              "name": "kiosk-web-config"
+            },
+            "name": "appsettings-production"
+          }
+        ]
+      }
+    }
+  }
+}

apps-gx10/fc-system/deployment-mysql-operator.json

@@ -0,0 +1,147 @@
+{
+  "apiVersion": "apps/v1",
+  "kind": "Deployment",
+  "metadata": {
+    "labels": {
+      "app.kubernetes.io/component": "operator",
+      "app.kubernetes.io/instance": "mysql-operator",
+      "app.kubernetes.io/managed-by": "flowercore",
+      "app.kubernetes.io/name": "mysql-operator",
+      "app.kubernetes.io/part-of": "flowercore-mysql"
+    },
+    "name": "mysql-operator",
+    "namespace": "fc-system"
+  },
+  "spec": {
+    "progressDeadlineSeconds": 600,
+    "replicas": 1,
+    "revisionHistoryLimit": 10,
+    "selector": {
+      "matchLabels": {
+        "app.kubernetes.io/instance": "mysql-operator",
+        "app.kubernetes.io/name": "mysql-operator"
+      }
+    },
+    "strategy": {
+      "rollingUpdate": {
+        "maxSurge": "25%",
+        "maxUnavailable": "25%"
+      },
+      "type": "RollingUpdate"
+    },
+    "template": {
+      "metadata": {
+        "annotations": {
+          "kubectl.kubernetes.io/restartedAt": "2026-04-17T09:34:39-05:00"
+        },
+        "labels": {
+          "app.kubernetes.io/component": "operator",
+          "app.kubernetes.io/instance": "mysql-operator",
+          "app.kubernetes.io/managed-by": "flowercore",
+          "app.kubernetes.io/name": "mysql-operator",
+          "app.kubernetes.io/part-of": "flowercore-mysql"
+        }
+      },
+      "spec": {
+        "automountServiceAccountToken": true,
+        "containers": [
+          {
+            "env": [
+              {
+                "name": "ASPNETCORE_ENVIRONMENT",
+                "value": "Production"
+              },
+              {
+                "name": "ASPNETCORE_URLS",
+                "value": "http://+:8080"
+              }
+            ],
+            "image": "localhost/fc-mysql-operator:v20260617-sec5-3c6649c",
+            "imagePullPolicy": "Never",
+            "livenessProbe": {
+              "failureThreshold": 3,
+              "httpGet": {
+                "path": "/healthz",
+                "port": 8080,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 15,
+              "periodSeconds": 20,
+              "successThreshold": 1,
+              "timeoutSeconds": 3
+            },
+            "name": "mysql-operator",
+            "ports": [
+              {
+                "containerPort": 8080,
+                "name": "http",
+                "protocol": "TCP"
+              }
+            ],
+            "readinessProbe": {
+              "failureThreshold": 3,
+              "httpGet": {
+                "path": "/healthz",
+                "port": 8080,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 5,
+              "periodSeconds": 10,
+              "successThreshold": 1,
+              "timeoutSeconds": 3
+            },
+            "resources": {
+              "limits": {
+                "cpu": "500m",
+                "memory": "512Mi"
+              },
+              "requests": {
+                "cpu": "250m",
+                "memory": "256Mi"
+              }
+            },
+            "securityContext": {
+              "allowPrivilegeEscalation": false,
+              "capabilities": {
+                "drop": [
+                  "ALL"
+                ]
+              },
+              "readOnlyRootFilesystem": true
+            },
+            "terminationMessagePath": "/dev/termination-log",
+            "terminationMessagePolicy": "File",
+            "volumeMounts": [
+              {
+                "mountPath": "/tmp",
+                "name": "tmp"
+              }
+            ]
+          }
+        ],
+        "dnsPolicy": "ClusterFirst",
+        "restartPolicy": "Always",
+        "schedulerName": "default-scheduler",
+        "securityContext": {
+          "fsGroup": 1654,
+          "fsGroupChangePolicy": "OnRootMismatch",
+          "runAsGroup": 1654,
+          "runAsNonRoot": true,
+          "runAsUser": 1654,
+          "seccompProfile": {
+            "type": "RuntimeDefault"
+          }
+        },
+        "serviceAccount": "mysql-operator",
+        "serviceAccountName": "mysql-operator",
+        "terminationGracePeriodSeconds": 30,
+        "volumes": [
+          {
+            "emptyDir": {},
+            "name": "tmp"
+          }
+        ]
+      }
+    }
+  }
+}

apps-gx10/fc-system/deployment-php-operator.json

@@ -0,0 +1,164 @@
+{
+  "apiVersion": "apps/v1",
+  "kind": "Deployment",
+  "metadata": {
+    "labels": {
+      "app.kubernetes.io/component": "operator",
+      "app.kubernetes.io/instance": "php-operator",
+      "app.kubernetes.io/managed-by": "flowercore",
+      "app.kubernetes.io/name": "php-operator",
+      "app.kubernetes.io/part-of": "flowercore-php"
+    },
+    "name": "php-operator",
+    "namespace": "fc-system"
+  },
+  "spec": {
+    "progressDeadlineSeconds": 600,
+    "replicas": 1,
+    "revisionHistoryLimit": 10,
+    "selector": {
+      "matchLabels": {
+        "app.kubernetes.io/instance": "php-operator",
+        "app.kubernetes.io/name": "php-operator",
+        "app.kubernetes.io/part-of": "flowercore-php"
+      }
+    },
+    "strategy": {
+      "rollingUpdate": {
+        "maxSurge": "25%",
+        "maxUnavailable": "25%"
+      },
+      "type": "RollingUpdate"
+    },
+    "template": {
+      "metadata": {
+        "annotations": {
+          "kubectl.kubernetes.io/restartedAt": "2026-04-17T10:09:10-05:00"
+        },
+        "labels": {
+          "app.kubernetes.io/component": "operator",
+          "app.kubernetes.io/instance": "php-operator",
+          "app.kubernetes.io/managed-by": "flowercore",
+          "app.kubernetes.io/name": "php-operator",
+          "app.kubernetes.io/part-of": "flowercore-php"
+        }
+      },
+      "spec": {
+        "automountServiceAccountToken": true,
+        "containers": [
+          {
+            "env": [
+              {
+                "name": "ASPNETCORE_ENVIRONMENT",
+                "value": "Production"
+              },
+              {
+                "name": "ASPNETCORE_URLS",
+                "value": "http://+:8080"
+              },
+              {
+                "name": "MySqlManager__BaseUrl",
+                "value": "https://mysql.iamworkin.lan/"
+              },
+              {
+                "name": "MySqlManager__BypassTls",
+                "value": "true"
+              },
+              {
+                "name": "PhpManager__BaseUrl",
+                "value": "https://php.iamworkin.lan/"
+              },
+              {
+                "name": "PhpManager__BypassTls",
+                "value": "true"
+              }
+            ],
+            "image": "localhost/fc-php-operator:v20260617-sec5-0bfbf42",
+            "imagePullPolicy": "Never",
+            "livenessProbe": {
+              "failureThreshold": 3,
+              "httpGet": {
+                "path": "/healthz",
+                "port": 8080,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 15,
+              "periodSeconds": 20,
+              "successThreshold": 1,
+              "timeoutSeconds": 3
+            },
+            "name": "php-operator",
+            "ports": [
+              {
+                "containerPort": 8080,
+                "name": "http",
+                "protocol": "TCP"
+              }
+            ],
+            "readinessProbe": {
+              "failureThreshold": 3,
+              "httpGet": {
+                "path": "/healthz",
+                "port": 8080,
+                "scheme": "HTTP"
+              },
+              "initialDelaySeconds": 5,
+              "periodSeconds": 10,
+              "successThreshold": 1,
+              "timeoutSeconds": 3
+            },
+            "resources": {
+              "limits": {
+                "cpu": "500m",
+                "memory": "512Mi"
+              },
+              "requests": {
+                "cpu": "250m",
+                "memory": "256Mi"
+              }
+            },
+            "securityContext": {
+              "allowPrivilegeEscalation": false,
+              "capabilities": {
+                "drop": [
+                  "ALL"
+                ]
+              },
+              "readOnlyRootFilesystem": true
+            },
+            "terminationMessagePath": "/dev/termination-log",
+            "terminationMessagePolicy": "File",
+            "volumeMounts": [
+              {
+                "mountPath": "/tmp",
+                "name": "tmp"
+              }
+            ]
+          }
+        ],
+        "dnsPolicy": "ClusterFirst",
+        "restartPolicy": "Always",
+        "schedulerName": "default-scheduler",
+        "securityContext": {
+          "fsGroup": 1654,
+          "fsGroupChangePolicy": "OnRootMismatch",
+          "runAsGroup": 1654,
+          "runAsNonRoot": true,
+          "runAsUser": 1654,
+          "seccompProfile": {
+            "type": "RuntimeDefault"
+          }
+        },
+        "serviceAccount": "php-operator",
+        "serviceAccountName": "php-operator",
+        "terminationGracePeriodSeconds": 30,
+        "volumes": [
+          {
+            "emptyDir": {},
+            "name": "tmp"
+          }
+        ]
+      }
+    }
+  }
+}

apps-gx10/fc-system/ingressroute-fc-landing-public.json

@@ -0,0 +1,29 @@
+{
+  "apiVersion": "traefik.io/v1alpha1",
+  "kind": "IngressRoute",
+  "metadata": {
+    "name": "fc-landing-public",
+    "namespace": "fc-system"
+  },
+  "spec": {
+    "entryPoints": [
+      "websecure"
+    ],
+    "routes": [
+      {
+        "kind": "Rule",
+        "match": "Host(`flowercore.io`) || Host(`www.flowercore.io`)",
+        "priority": 100,
+        "services": [
+          {
+            "name": "fc-landing",
+            "port": 80
+          }
+        ]
+      }
+    ],
+    "tls": {
+      "secretName": "cf-origin-flowercore-io"
+    }
+  }
+}