chore: remove excalidraw deployment

.gitea/workflows/validate.yaml

@@ -1,58 +0,0 @@
-name: Validate Manifests
-
-on:
-  pull_request:
-    branches: [main]
-
-jobs:
-  validate:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v4
-
-      - name: Install kubeconform
-        run: |
-          curl -sL https://github.com/yannh/kubeconform/releases/download/v0.6.7/kubeconform-linux-amd64.tar.gz \
-            | tar xz -C /usr/local/bin
-          chmod +x /usr/local/bin/kubeconform
-
-      - name: Schema validation (kubeconform)
-        run: |
-          find . -name '*.yaml' -o -name '*.yml' \
-            | grep -v '\.gitea/' \
-            | sort \
-            | xargs kubeconform \
-                -strict \
-                -ignore-missing-schemas \
-                -kubernetes-version 1.30.0 \
-                -summary
-
-      - name: Install kubectl
-        run: |
-          K8S_VER=$(curl -sL https://dl.k8s.io/release/stable.txt)
-          curl -sLO "https://dl.k8s.io/release/${K8S_VER}/bin/linux/amd64/kubectl"
-          chmod +x kubectl && mv kubectl /usr/local/bin/kubectl
-
-      - name: Server-side dry-run (CRD existence check)
-        env:
-          KUBECONFIG_DATA: ${{ secrets.KUBECONFIG }}
-        run: |
-          echo "$KUBECONFIG_DATA" | base64 -d > /tmp/kube.yaml
-          # Apply all YAML files in sorted order — server-side dry-run rejects
-          # any apiVersion/Kind whose CRD is not installed in the cluster.
-          find . -name '*.yaml' -o -name '*.yml' \
-            | grep -v '\.gitea/' \
-            | sort \
-            | xargs -I{} kubectl apply \
-                --dry-run=server \
-                --kubeconfig /tmp/kube.yaml \
-                -f {} 2>&1 \
-            | tee /tmp/dryrun.log
-          rm -f /tmp/kube.yaml
-          # Fail if any "no kind is registered" or "no matches for kind" errors
-          if grep -qE "no kind is registered|no matches for kind|unknown field" /tmp/dryrun.log; then
-            echo "❌ Dry-run found unknown resources or fields — manifests reference CRDs not installed in the cluster"
-            exit 1
-          fi
-          echo "✅ All manifests passed server-side dry-run"

README.md

@@ -1,3 +1,3 @@
 # talos-cluster
 
-Managed by [ORION](https://github.com/richard-callis/orion-web). Do not edit manually — changes are proposed via PR.
+ORION-managed cluster: Talos Cluster

deployments/namespace.yaml

@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: apps
-  labels:
-    name: apps

deployments/tailscale/external-secret.yaml

@@ -1,18 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: tailscale-auth
-  namespace: tailscale
-spec:
-  refreshInterval: 1h
-  secretStoreRef:
-    name: orion-vault
-    kind: ClusterSecretStore
-  target:
-    name: tailscale-auth
-    creationPolicy: Owner
-  data:
-    - secretKey: TS_AUTH_KEY
-      remoteRef:
-        key: Talos Cluster/tailscale
-        property: TS_AUTH_KEY

deployments/tailscale/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: tailscale

deployments/tailscale/operator/clusterrole.yaml

@@ -1,17 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRole
-metadata:
-  name: tailscale-operator
-rules:
-  - apiGroups: [""]
-    resources: ["secrets", "configmaps", "services", "pods", "endpoints"]
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-  - apiGroups: ["apps"]
-    resources: ["deployments", "statefulsets", "daemonsets"]
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-  - apiGroups: ["networking.k8s.io"]
-    resources: ["ingresses"]
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
-  - apiGroups: ["tailscale.com"]
-    resources: ["*"]
-    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]

deployments/tailscale/operator/clusterrolebinding.yaml

@@ -1,12 +0,0 @@
-apiVersion: rbac.authorization.k8s.io/v1
-kind: ClusterRoleBinding
-metadata:
-  name: tailscale-operator
-roleRef:
-  apiGroup: rbac.authorization.k8s.io
-  kind: ClusterRole
-  name: tailscale-operator
-subjects:
-  - kind: ServiceAccount
-    name: tailscale-operator
-    namespace: tailscale

deployments/tailscale/operator/deployment.yaml

@@ -1,43 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: tailscale-operator
-  namespace: tailscale
-  labels:
-    app: tailscale-operator
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: tailscale-operator
-  template:
-    metadata:
-      labels:
-        app: tailscale-operator
-    spec:
-      serviceAccountName: tailscale-operator
-      containers:
-      - name: operator
-        image: ghcr.io/tailscale/k8s-operator:v1.78.3
-        imagePullPolicy: IfNotPresent
-        env:
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: CLIENT_ID_FILE
-          value: /etc/tailscale/oauth/client-id
-        - name: CLIENT_SECRET_FILE
-          value: /etc/tailscale/oauth/client-secret
-        volumeMounts:
-        - name: oauth-secret
-          mountPath: /etc/tailscale/oauth
-          readOnly: true
-      volumes:
-      - name: oauth-secret
-        secret:
-          secretName: tailscale-operator-secret

deployments/tailscale/operator/external-secret.yaml

@@ -1,22 +0,0 @@
-apiVersion: external-secrets.io/v1
-kind: ExternalSecret
-metadata:
-  name: tailscale-operator-secret
-  namespace: tailscale
-spec:
-  refreshInterval: 1h
-  secretStoreRef:
-    name: orion-vault
-    kind: ClusterSecretStore
-  target:
-    name: tailscale-operator-secret
-    creationPolicy: Owner
-  data:
-    - secretKey: client-id
-      remoteRef:
-        key: tailscale/operator
-        property: CLIENT_ID_FILE
-    - secretKey: client-secret
-      remoteRef:
-        key: tailscale/operator
-        property: CLIENT_SECRET_FILE

deployments/tailscale/operator/serviceaccount.yaml

@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: tailscale-operator
-  namespace: tailscale
-  labels:
-    app: tailscale-operator

tailscale/deployment.yaml

@@ -1,43 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: tailscale-operator
-  namespace: tailscale
-  labels:
-    app: tailscale-operator
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: tailscale-operator
-  template:
-    metadata:
-      labels:
-        app: tailscale-operator
-    spec:
-      serviceAccountName: tailscale-operator
-      containers:
-        - name: operator
-          image: ghcr.io/tailscale/k8s-operator:v1.78.3
-          env:
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-            - name: POD_NAMESPACE
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.namespace
-            - name: CLIENT_ID_FILE
-              value: /etc/tailscale/operator/client-id
-            - name: CLIENT_SECRET_FILE
-              value: /etc/tailscale/operator/client-secret
-          volumeMounts:
-            - name: operator-secret
-              mountPath: /etc/tailscale/operator
-              readOnly: true
-          resources: {}
-      volumes:
-        - name: operator-secret
-          secret:
-            secretName: tailscale-operator-secret

tailscale/operator/deployment.yaml

@@ -1,42 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: tailscale-operator
-  namespace: tailscale
-  labels:
-    app: tailscale-operator
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: tailscale-operator
-  template:
-    metadata:
-      labels:
-        app: tailscale-operator
-    spec:
-      serviceAccountName: tailscale-operator
-      containers:
-      - name: operator
-        image: ghcr.io/tailscale/k8s-operator:v1.78.3
-        env:
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: TS_CLIENT_ID_FILE
-          value: /etc/tailscale/oauth/client-id
-        - name: TS_CLIENT_SECRET_FILE
-          value: /etc/tailscale/oauth/client-secret
-        volumeMounts:
-        - name: oauth-secret
-          mountPath: /etc/tailscale/oauth
-          readOnly: true
-      volumes:
-      - name: oauth-secret
-        secret:
-          secretName: tailscale-operator-secret

tailscale/tailscale-operator/deployment.yaml

@@ -1,42 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: tailscale-operator
-  namespace: tailscale
-  labels:
-    app: tailscale-operator
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: tailscale-operator
-  template:
-    metadata:
-      labels:
-        app: tailscale-operator
-    spec:
-      serviceAccountName: tailscale-operator
-      containers:
-      - name: operator
-        image: ghcr.io/tailscale/k8s-operator:v1.78.3
-        env:
-        - name: POD_NAME
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.name
-        - name: POD_NAMESPACE
-          valueFrom:
-            fieldRef:
-              fieldPath: metadata.namespace
-        - name: TS_CLIENT_ID_FILE
-          value: /etc/tailscale/oauth/client-id
-        - name: TS_CLIENT_SECRET_FILE
-          value: /etc/tailscale/oauth/client-secret
-        volumeMounts:
-        - name: oauth-secret
-          mountPath: /etc/tailscale/oauth
-          readOnly: true
-      volumes:
-      - name: oauth-secret
-        secret:
-          secretName: tailscale-operator-secret