OneLab Kubernetes GitOps (Argo CD)

- Helm charts: onelab app + observability (Loki/Promtail/Grafana) - Values under gitops/values/ with public-safe placeholders - Argo CD Application (spec.sources, 2.6+) Made-with: Cursor
2026-03-20 12:27:45 +01:00
commit 68f9745c06
44 changed files with 2466 additions and 0 deletions
--- a/gitops/README.md
+++ b/gitops/README.md
@@ -0,0 +1,223 @@
+# OneLab GitOps (Argo CD)
+
+This directory is the **declarative source** for OneLab on Kubernetes. [Argo CD](https://argo-cd.readthedocs.io/) applies **two Helm-based sources** from Git (Argo invokes Helm; you do not use Helm CLI as the primary install path for the cluster).
+
+This repository is **GitOps-only**: everything required to deploy OneLab on Kubernetes lives under **`gitops/`**.
+
+## What gets deployed
+
+| Helm release | Chart path | Namespace | Role |
+|--------------|------------|-----------|------|
+| `onelab` | [`charts/onelab`](charts/onelab) | `onelab` | Application workloads, Postgres, Redis, RabbitMQ, revproxy, ingress hooks |
+| `onelab-obs` | [`observability/`](observability/) | `onelab` | Loki, Promtail, Grafana (logs) |
+
+Both are wired by a single Argo CD [`Application`](argocd/application.yaml) using **`spec.sources`** (requires **Argo CD 2.6+**).
+
+## Architecture
+
+```mermaid
+flowchart LR
+  subgraph git [Git repository]
+    V[gitops/values]
+    C[charts/onelab]
+    O[observability]
+  end
+  subgraph argo [Argo CD]
+    App[Application onelab]
+  end
+  subgraph cluster [Kubernetes cluster]
+    NS[namespace onelab]
+  end
+  V --> App
+  C --> App
+  O --> App
+  App --> NS
+```
+
+1. You commit changes under **`gitops/values/`** (and optionally edit `repoURL` / `targetRevision` in the Application).
+2. Argo reconciles: Helm renders `onelab` + `onelab-obs` into namespace **`onelab`**.
+3. Sync waves order StatefulSets and app Deployments (Postgres → Redis/Rabbit/config → apps).
+
+## Layout
+
+| Path | Purpose |
+|------|---------|
+| [`charts/onelab`](charts/onelab) | OneLab Helm chart — **Argo source 1** |
+| [`values/`](values/) | **Operator entry point**: [`values/env-example.yaml`](values/env-example.yaml), [`values/observability.yaml`](values/observability.yaml), templates — see [`values/README.md`](values/README.md) |
+| [`observability/`](observability/) | Loki / Promtail / Grafana umbrella chart — **Argo source 2** (`releaseName: onelab-obs`) |
+| [`argocd/application.yaml`](argocd/application.yaml) | `Application` manifest (`spec.sources`, destination namespace `onelab`) |
+| [`argocd/jsonpatch-multisource.json`](argocd/jsonpatch-multisource.json) | One-time JSON patch if a live `Application` still has legacy `spec.source` only |
+
+## Prerequisites
+
+1. **Kubernetes** (e.g. k3s) with a default **StorageClass** for Postgres/Rabbit/Loki/Grafana PVCs (e.g. `local-path`).
+2. **Container images** from `hub.andrewalliance.com` (or your mirror): registry credentials via Helm values or a pre-created `docker-registry` Secret — see [Private registry credentials](#private-registry-credentials).
+3. **RabbitMQ TLS** before RabbitMQ starts: Kubernetes Secret `onelab-rabbit-tls`, or `rabbitmq.tls.embed` in private values — see [RabbitMQ TLS](#rabbitmq-tls).
+4. **Host paths** when using `persistence.mode: hostPath`: `/opt/onelab/data` and `/opt/onelab/logs` on nodes that run those pods (aligned with Promtail in [`values/observability.yaml`](values/observability.yaml)), or use RWX storage for multi-node.
+
+## Configuration (single place to edit)
+
+- **OneLab app / ingress / DB / tokens / registry**: [`values/env-example.yaml`](values/env-example.yaml) — copy patterns, replace **`REPLACE_*`** placeholders, or overlay a gitignored file; see [`values/secrets.example.yaml`](values/secrets.example.yaml) and [`values/README.md`](values/README.md).
+- **Observability**: [`values/observability.yaml`](values/observability.yaml) — Grafana password (**`REPLACE_GRAFANA_ADMIN_PASSWORD`**), ingress host, Promtail log hostPath.
+- **Argo Git coordinates**: [`argocd/application.yaml`](argocd/application.yaml) — set `repoURL`, `targetRevision`, and `helm.valueFiles` if you add e.g. `secrets.local.yaml`.
+
+The chart default [`charts/onelab/values.yaml`](charts/onelab/values.yaml) holds non-secret structure and safe placeholders only; **do not rely on it for production secrets**.
+
+## Bootstrap checklist
+
+1. Fork or clone this repository and push it to a Git remote your cluster can reach.
+2. Edit [`argocd/application.yaml`](argocd/application.yaml): **`repoURL`** → your remote, **`targetRevision`** → your branch/tag.
+3. Edit [`values/env-example.yaml`](values/env-example.yaml): DNS hostnames, TLS secret names, cert-manager issuer, and all **`REPLACE_*`** values (or use a gitignored overlay).
+4. Edit [`values/observability.yaml`](values/observability.yaml): Grafana host/password aligned with your DNS and TLS.
+5. If the Git repo is **private**, register it in Argo CD (see below).
+6. Ensure **RabbitMQ TLS** Secret exists (or use embedded TLS in private values).
+7. Apply the Application:
+
+   ```bash
+   kubectl apply -f gitops/argocd/application.yaml
+   ```
+
+8. In Argo UI or CLI, confirm sync to namespace **`onelab`** and fix any `ImagePullBackOff` / TLS issues using the sections below.
+
+**Single controller:** Use **only** this Argo CD `Application` for `onelab` / `onelab-obs`. Do not manage the same namespace with a parallel **Helm CLI** release.
+
+## Private registry credentials
+
+Set `registry.username` / `registry.password` in values (prefer a **gitignored** file merged last), or create the Secret manually:
+
+```bash
+kubectl create secret docker-registry hub-andrewalliance -n onelab \
+  --docker-server=hub.andrewalliance.com \
+  --docker-username='YOUR_USER' \
+  --docker-password='YOUR_PASSWORD'
+```
+
+…then set `registry.createPullSecret: false` and keep `imagePullSecrets: [{ name: hub-andrewalliance }]` in values.
+
+### StatefulSet pods still get `401 Unauthorized` / `ImagePullBackOff` after enabling registry auth
+
+If `db-0` / `rabbitmq-0` were created **before** `imagePullSecrets` existed, delete those pods once so they pick up the new Pod spec:
+
+```bash
+kubectl delete pod -n onelab db-0 rabbitmq-0
+```
+
+## Argo CD private Git repository
+
+If the Application shows `authentication required: Unauthorized`, register the repo (use a deploy token or PAT with read access):
+
+```bash
+argocd repo add https://github.com/YOUR_ORG/YOUR_REPO.git \
+  --username git \
+  --password YOUR_TOKEN
+```
+
+## RabbitMQ TLS
+
+Secret **`onelab-rabbit-tls`** must exist in namespace **`onelab`** before RabbitMQ starts (keys: typically `tls.crt`, `tls.key`, and optionally chain). **PEM material is not shipped in this GitOps tree** — generate certs or use your PKI, then:
+
+```bash
+kubectl create secret tls onelab-rabbit-tls -n onelab \
+  --cert=path/to/fullchain.pem \
+  --key=path/to/key.pem
+```
+
+Alternatively, set `rabbitmq.tls.embed: true` and supply `rabbitmq.tls.crt` / `rabbitmq.tls.key` / `rabbitmq.tls.fullchain` via a **private** values file (never commit real keys).
+
+## Deploy with Argo CD (details)
+
+**Requirements:** Argo CD **2.6+** (`spec.sources`).
+
+Each entry under `spec.sources` has its own `helm.releaseName` and `helm.valueFiles` (paths are **relative to that source’s `path`**):
+
+- Source `gitops/charts/onelab` → e.g. `../../values/env-example.yaml`, optionally `../../values/secrets.local.yaml`
+- Source `gitops/observability` → e.g. `../../values/observability.yaml`
+
+### Migrating `spec.source` → `spec.sources`
+
+If the `onelab` `Application` was created earlier with **`spec.source` only**, a plain `kubectl apply` may **not** remove `spec.source`, and Argo will not reconcile the observability chart.
+
+Check:
+
+```bash
+kubectl get application onelab -n argocd -o jsonpath='{.spec.source}{"\n"}{.spec.sources}{"\n"}'
+```
+
+If `source` is set and `sources` is empty, patch once (edit `repoURL` in the patch file to match your remote):
+
+```bash
+kubectl patch application onelab -n argocd --type json --patch-file gitops/argocd/jsonpatch-multisource.json
+```
+
+## Observability (Loki / Promtail / Grafana)
+
+The umbrella chart under [`observability/`](observability/) deploys:
+
+- **Loki** — log storage (SingleBinary, filesystem PVC; retention from [`values/observability.yaml`](values/observability.yaml)).
+- **Promtail** — DaemonSet: Kubernetes pod logs plus **OneLab file logs** from the host path configured in [`values/observability.yaml`](values/observability.yaml) (keep in sync with OneLab `persistence.hostPath.logs`).
+- **Grafana** — Explore; datasource points at this release’s Loki gateway.
+
+### First-time setup
+
+1. Set a strong **`grafana.adminPassword`** in [`values/observability.yaml`](values/observability.yaml) (or use `admin.existingSecret` per the upstream Grafana chart).
+2. Align **Grafana ingress host** with `grafana.ini.server.domain` / `root_url` in the same file.
+3. **Multi-node** — with `hostPath` logs, each node only sees its own files; Promtail runs on every node.
+
+### OneLab-only ingestion
+
+Promtail **`extraRelabelConfigs`** keep only pods in namespace **`onelab`**. Host file logs are tagged **`namespace: onelab`**, **`component: host-logs`**.
+
+### Dashboard: **OneLab logs**
+
+Grafana sidecar loads the dashboard from `observability/dashboards/onelab-logs.json` (`uid` `onelab-logs`).
+
+#### Grafana pod: `init-chown-data` CrashLoopBackOff
+
+This repo sets **`grafana.initChownData.enabled: false`** with **`fsGroup: 472`** for Pod Security–friendly clusters. If Grafana cannot write to the PVC, delete the Grafana PVC once after changing values or adjust Pod Security for namespace `onelab`.
+
+### Access Grafana
+
+Ingress **`grafana-onelab`** is defined in `observability/templates/ingress-grafana-onelab.yaml`. Defaults use example hosts in [`values/observability.yaml`](values/observability.yaml) (`grafana.onelab.example.com`); change to your DNS and TLS Secret name.
+
+```bash
+kubectl -n onelab port-forward svc/onelab-obs-grafana 3000:80
+```
+
+### Maintainers: vendored chart dependencies
+
+From `gitops/observability/`:
+
+```bash
+helm dependency update
+```
+
+Commit updated `Chart.lock` and `charts/*.tgz` so Argo can render without live Helm repo access at sync time.
+
+## Application configuration (`configurations.yml`)
+
+For Kubernetes you do **not** need a separate `configurations.yml` in Git. The OneLab chart renders it from [`charts/onelab/files/configurations.gotmpl`](charts/onelab/files/configurations.gotmpl) into Secret **`onelab-configurations`**.
+
+1. **Values (recommended)** — set `onelab.compliance`, `onelab.ldap`, etc. See [`values/instance-overrides.example.yaml`](values/instance-overrides.example.yaml) and add paths under **`spec.sources[].helm.valueFiles`** for the `gitops/charts/onelab` source.
+2. **Bring your own Secret** — set `configuration.existingSecretName`; the Secret must contain key **`configurations.yml`**.
+
+## Ingress (web UI)
+
+Set `ingress.enabled`, `ingress.host`, and optional TLS in [`values/env-example.yaml`](values/env-example.yaml). Traffic goes to Service **`revproxy`**. On k3s, `ingress.className: traefik` matches the default controller. For cert-manager, set `ingress.certManager.clusterIssuer` and TLS secret name; DNS for `ingress.host` must resolve before ACME completes.
+
+## Security notes for public repositories
+
+- Never commit real passwords, tokens, or TLS private keys. Use **`REPLACE_*`** in tracked files and a **`*.local.yaml`** overlay (ignored at repo root) for secrets.
+- If this repo ever contained real credentials, **rotate** them after sanitizing Git history or publishing a clean fork.
+
+## kubectl / credentials
+
+If `kubectl` reports *You must be logged in*, refresh your kubeconfig before applying manifests.
+
+## Developer note (local render)
+
+Running **`helm template` on Windows** against some paths can return empty `.Files.Get` content; the OneLab chart uses `fromYaml (.Files.AsConfig)` where needed. **Argo CD runs on Linux** and renders the same charts in-cluster.
+
+## Not covered by this chart
+
+- **Edge proxy** in front of the cluster — use **Ingress** + `revproxy` and optional cert-manager.
+- **Non-Kubernetes** install paths — not included; use Kubernetes Secrets or external secret operators as needed.
--- a/gitops/argocd/application.yaml
+++ b/gitops/argocd/application.yaml
@@ -0,0 +1,38 @@
+# Syncs OneLab app + observability (Loki/Promtail/Grafana) into namespace onelab.
+# Requires Argo CD 2.6+ (spec.sources). Ensure repoURL matches your remote.
+#
+# If you already had this Application with spec.source only, kubectl apply may not drop
+# source — see gitops/README.md (Migrating spec.source → spec.sources) and jsonpatch-multisource.json.
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: onelab
+  namespace: argocd
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  sources:
+    - repoURL: https://github.com/YOUR_ORG/YOUR_REPO.git
+      targetRevision: main
+      path: gitops/charts/onelab
+      helm:
+        releaseName: onelab
+        valueFiles:
+          - ../../values/env-example.yaml
+    - repoURL: https://github.com/YOUR_ORG/YOUR_REPO.git
+      targetRevision: main
+      path: gitops/observability
+      helm:
+        releaseName: onelab-obs
+        valueFiles:
+          - ../../values/observability.yaml
+  destination:
+    server: https://kubernetes.default.svc
+    namespace: onelab
+  syncPolicy:
+    automated:
+      prune: true
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
--- a/gitops/argocd/jsonpatch-multisource.json
+++ b/gitops/argocd/jsonpatch-multisource.json
@@ -0,0 +1,23 @@
+[
+  {"op": "remove", "path": "/spec/source"},
+  {"op": "add", "path": "/spec/sources", "value": [
+    {
+      "repoURL": "https://github.com/YOUR_ORG/YOUR_REPO.git",
+      "targetRevision": "main",
+      "path": "gitops/charts/onelab",
+      "helm": {
+        "releaseName": "onelab",
+        "valueFiles": ["../../values/env-example.yaml"]
+      }
+    },
+    {
+      "repoURL": "https://github.com/YOUR_ORG/YOUR_REPO.git",
+      "targetRevision": "main",
+      "path": "gitops/observability",
+      "helm": {
+        "releaseName": "onelab-obs",
+        "valueFiles": ["../../values/observability.yaml"]
+      }
+    }
+  ]}
+]
--- a/gitops/charts/onelab/Chart.yaml
+++ b/gitops/charts/onelab/Chart.yaml
@@ -0,0 +1,6 @@
+apiVersion: v2
+name: onelab
+description: OneLab stack for Kubernetes (migrated from Docker Swarm compose)
+type: application
+version: 0.1.0
+appVersion: "1.27.0"
--- a/gitops/charts/onelab/files/advanced.conf
+++ b/gitops/charts/onelab/files/advanced.conf
@@ -0,0 +1,5 @@
+[
+ {rabbit, [
+  {tcp_listeners, []}
+  ]}
+].
--- a/gitops/charts/onelab/files/configurations.gotmpl
+++ b/gitops/charts/onelab/files/configurations.gotmpl
@@ -0,0 +1,133 @@
+---
+onelab:
+  domain: {{ .Values.onelab.domain | quote }}
+  logs:
+    path: "/logs"
+    level: info
+  assets:
+    purge: 1d
+  shared:
+    inputs:
+      path: "./data/shared/inputs"
+      archive_path: "./data/shared/archived"
+  security:
+    cors: '*'
+    auth:
+      token:
+        expiration: 5m
+        key: {{ .Values.onelab.secrets.authTokenKey | quote }}
+      password:
+        expiration: 90d
+        min_length: 8
+        prevent_reuse: 5
+      allow_list: []
+      block_list: []
+      authentifier: "email"
+    ratelimit:
+      ip:
+        max: 1000
+        duration: 1d
+      auth:
+        max: 5
+        duration: 5m
+        delay_after: 2
+        delay_ms: 1000
+    devices:
+        cors: '*'
+    monitoring:
+        token: {{ .Values.onelab.secrets.monitoringToken | quote }}
+  params:
+    session:
+      idle: 45m
+      remember_me: true
+    lab:
+      creation_policy: many
+{{- if .Values.onelab.compliance.enabled }}
+    compliance:
+      require_electronic_signature: {{ .Values.onelab.compliance.requireElectronicSignature }}
+      execution_operator_restriction_policy: {{ .Values.onelab.compliance.executionOperatorRestrictionPolicy | quote }}
+      execution_admin_expert_restriction_policy: {{ .Values.onelab.compliance.executionAdminExpertRestrictionPolicy | quote }}
+      prevent_csv_import: {{ .Values.onelab.compliance.preventCsvImport }}
+      prevent_manual_metadata_edit: {{ .Values.onelab.compliance.preventManualMetadataEdit }}
+      device_restart: {{ .Values.onelab.compliance.deviceRestart }}
+{{- end }}
+    signup: false
+{{- if .Values.onelab.intercom.appid }}
+    intercom:
+      appid: {{ .Values.onelab.intercom.appid | quote }}
+      secret: {{ .Values.onelab.intercom.secret | quote }}
+{{- end }}
+  mailer:
+    noreply: {{ .Values.onelab.mailer.noreply | quote }}
+    queue:
+      scheduling: 15
+      maxsize: 50
+    error:
+      maxtries: 3
+      timeout: 60
+  ldap:
+    enabled: {{ if or .Values.onelab.ldap.enabled .Values.features.ldapWorker }}true{{ else }}false{{ end }}
+{{- if or .Values.onelab.ldap.enabled .Values.features.ldapWorker }}
+    {{- if .Values.onelab.ldap.timeout }}
+    timeout: {{ .Values.onelab.ldap.timeout | int }}
+    {{- end }}
+    {{- if .Values.onelab.ldap.encryption }}
+    encryption: {{ .Values.onelab.ldap.encryption | quote }}
+    {{- end }}
+    {{- if .Values.onelab.ldap.policy }}
+    policy: {{ .Values.onelab.ldap.policy | quote }}
+    {{- end }}
+    {{- if kindIs "bool" .Values.onelab.ldap.verifyCertificates }}
+    verify_certificates: {{ .Values.onelab.ldap.verifyCertificates }}
+    {{- end }}
+    {{- if or .Values.onelab.ldap.tlsCaPath .Values.onelab.ldap.tlsCertPath .Values.onelab.ldap.tlsKeyPath .Values.onelab.ldap.tlsCiphers .Values.onelab.ldap.tlsSslVersion }}
+    tls:
+      {{- if .Values.onelab.ldap.tlsCaPath }}
+      ca: {{ .Values.onelab.ldap.tlsCaPath | quote }}
+      {{- end }}
+      {{- if .Values.onelab.ldap.tlsCertPath }}
+      cert: {{ .Values.onelab.ldap.tlsCertPath | quote }}
+      {{- end }}
+      {{- if .Values.onelab.ldap.tlsKeyPath }}
+      key: {{ .Values.onelab.ldap.tlsKeyPath | quote }}
+      {{- end }}
+      {{- if .Values.onelab.ldap.tlsCiphers }}
+      ciphers: {{ .Values.onelab.ldap.tlsCiphers | quote }}
+      {{- end }}
+      {{- if .Values.onelab.ldap.tlsSslVersion }}
+      ssl_version: {{ .Values.onelab.ldap.tlsSslVersion | quote }}
+      {{- end }}
+    {{- end }}
+{{- end }}
+  services:
+    db:
+      host: db
+      database: postgres
+      username: postgres
+      password: {{ .Values.postgresql.auth.password | quote }}
+      schema: onelab
+    redis:
+      host: redis
+      port: "6379"
+    rabbit:
+      url: rabbitmq
+      port: 5671
+      token: {{ .Values.onelab.secrets.rabbitToken | quote }}
+    api:
+      replicas: {{ .Values.replicas.api }}
+    apidevice:
+      replicas: {{ .Values.replicas.apidevice }}
+    apirabbit:
+      replicas: {{ .Values.replicas.apirabbit }}
+    devices:
+      replicas: {{ .Values.replicas.devices }}
+    experiments:
+      replicas: {{ .Values.replicas.experiments }}
+    images:
+      replicas: {{ .Values.replicas.images }}
+    manual:
+      replicas: {{ .Values.replicas.manual }}
+    website:
+      ssr: {{ .Values.website.ssr }}
+    ws:
+      replicas: {{ .Values.replicas.ws }}
--- a/gitops/charts/onelab/files/enable_plugins
+++ b/gitops/charts/onelab/files/enable_plugins
@@ -0,0 +1 @@
+[rabbitmq_auth_backend_http, rabbitmq_auth_backend_cache, rabbitmq_management, rabbitmq_event_exchange].
--- a/gitops/charts/onelab/files/error-404.html
+++ b/gitops/charts/onelab/files/error-404.html
@@ -0,0 +1,98 @@
+<!doctype html>
+<html lang="en">
+
+<head>
+  <meta charset="utf-8">
+  <title>OneLab - Page Not Found</title>
+  <meta name="description" content="The page you are looking for does not exist or has been moved.">
+  <meta name="robots" content="noindex, nofollow">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <link href="https://fonts.googleapis.com/css?family=Open+Sans&display=swap" rel="stylesheet">
+  <style>
+    body {
+      font-family: "Open Sans", sans-serif, -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, "Helvetica Neue", Arial, sans-serif;
+    }
+
+    .page {
+      position: absolute;
+      top: 0;
+      bottom: 0;
+      left: 0;
+      right: 0;
+      text-align: center;
+      padding: 128px;
+      display: flex;
+      flex-direction: column;
+      align-items: center;
+    }
+
+    .content {
+      width: 360px;
+      max-width: 90%;
+    }
+
+    .main {
+      font-size: 32px;
+      font-weight: 600;
+      margin-top: 64px;
+      font-stretch: normal;
+      font-style: normal;
+      line-height: normal;
+      letter-spacing: normal;
+      text-align: center;
+      color: #4a4a4a;
+    }
+
+    .code {
+      margin-top: 8px;
+      font-size: 13px;
+      letter-spacing: 2px;
+      color: #888;
+      text-transform: uppercase;
+    }
+
+    .sub {
+      margin-top: 24px;
+      font-size: 15px;
+      line-height: 1.47;
+      color: #4a4a4a;
+    }
+
+    a.login-btn {
+      display: inline-block;
+      margin-top: 32px;
+      padding: 12px 28px;
+      border-radius: 1000px;
+      background: #6cb644;
+      color: #fff;
+      text-decoration: none;
+      font-weight: 600;
+      box-shadow: 0 2px 4px rgba(0, 0, 0, .15);
+      font-size: 15px;
+    }
+
+    a.login-btn:hover,
+    a.login-btn:focus {
+      background: #3a8611;
+    }
+  </style>
+</head>
+
+<body>
+  <div class="page" role="main" aria-labelledby="title">
+    <div class="content">
+      <div class="img">
+        <img
+          src="data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAALsAAAAvCAQAAAARbnO0AAAABGdBTUEAALGPC/xhBQAAC7VJREFUeNrtW3l0FdUdHgIkCAiyb1ZEkH1TREQRBVzqgrIVkCMFpbREPEKAIgoRxIWlilatuIRzEMUcN5YgtYYeEFRA+b47bxKeiX0algAqYFDZpDVMzyx3Zt7+XhJSqLn3n7yZO3f57u/+7vdboii/suLrIgYZlZ3O2Ait2EuvoVQVb+Eb0M2adWb6xxSWQqemXpDUZ3oKrxJzkMUc/pPZfJZ3a00rHxz1RjxtVD58bsEeSOMpq3/OTHyxF2A+vren5VSexiZxXeXCjkx79KJzC3bUxi9W/2JOohMazyOhkHvA/7toUgV7Av0/bva+x988gcb+VL4UHXK7FvuurII9gSv1Mt5eeH4i+rwasz3wHuZLYrjvSq0rBjCDH3kk/qjvsirYK24qizx6fGGgXsjba/mFA/0BXBQTrsZqT7bz100A2Mais9Y1v5lerSJh9zf0dUGf/GYxxl0ZCru/oeiRdwlqVxianTiw+Lz4APThaXsqJ8UdEe/nesh1Nmad58sx+Nqo3KAoHMzNLLHblFLDQ9EoFLsji/ud/r7Da2rP8sMeqIdMao54/ISPOVJP4TP2DJ8Ih31XLTGBW/GD/fsXbhXTEoArThFzzFUF0Dje7myTks5R0dpodQhnSTc5Q0yynxzi1giX8H70Ce1nVy0uczbZy5VeDDYwkoUdQ3gwwgwCKLD/eiUM9q9xOML9dUC9tTygF5+H/9gjxqa+am9nkitiXhTtZYdYHwZ7NPZzRL3Y20deA3wWtfV6L/DJwS4mGSZKzJmEwx6tZSkeKDvsu2rh33ZPs2LL+hNS4oIhiiBRWXbLU/Ke9sLO0/RhJefyBXzsebrKc3FXx4fO881iNDuhLQcjy5H+BWWDHQMkV4bOEm7gEj7O91DgPVWRYWcpduJtzOez2Iif3JWIEeXQ7DPNcQv8DWM3s9UDP4/b4c1yYuKWUNi5w6tQ1FtxSC5Mu9BZ8ANO68lB5+16y7JjKTomD3sgDcUOkFmo7+n3aqgxYf/Ey8tEE77lvPmhoFE5WFhb9AukxWu0x57Y3+J1l9fAmdYfQmAv0lNCjv1Yp+0YqfX4nf3kqbA5PGTPYVnysPN+RxgmhRHj6pIKhMPOVeEcSs4DOhedafL4sz3UIwns47+DDV8H9i/DLQFnOxfb4wyW3D+cqqG+rZsPSSiSgF2e1g8izvjNUNhj8XY9xbFS9sRxo1yv3umuA/041DWQeBWHuSyOvcQI9+yIHvid6eNyfDAL44JeU2pLZsSDXVH4j2AJxnPSyaB1CK/40t7QzsnBXni+1OuRLehw2MN5exCc10h5Vy+Na3IVWhYOlpoj7LLA5WKLxYmW5rtHzF8H8y4x8ZpmEQ3RWaHfHujNBHSWPM6jE4BdOhvetr9eE9f5YCz2xuRgR0fJunfVKr+0m0TZ5kQcGJVMt/EqW9HEUUxTvd8jU1H0GjjpPfPSrsFShe/ZLw6G6uewJdzngNMzAdhfsPt91/69JRHYpeWQKOyir/3d7ihzTlLa3btODI+KQwuHI40xFKQ8b/yT4duSQGOGobSkMcZ5JgbSSHxawThHhkfE8cP7QpeYFOw5dtu93Bq9ikHJwc5OFSvtgTRpnYgbYow6zwCeG1DTHGOGKeGfWBYu0o0eCFsBjTNZWr6lgMQInDDQEi2Vgkbmn6ZNF8uX4iGLi8oCO160235Yka6wQD3nUPepCGnH5c4qYwb9fK3YyWVCaOHr4uoKranWVa/u+p7QzTUE8xqwu7VZCh5zhspxm4eAfp0TNSlxDYFkYBfDHbPs0or0QDp27/sVIe2OJ/ZAZBddBRatDvY62jU3knUlRssTAR33RTgBCcBeeL5zoeSHO8kwJNgXkgSBnOoIzT0R3q6NytuzI2zSGKev58tByW8W98bygXp9gj86Ax5khssz9Wq8ius8l96rERVPArB7jRF8hm5B3v6JPMVSPFQW2IvPwzeO33OJ14OodZAkNqK061zHdkH9LHS8Tics+lcm0C0G9308V4sF4A085vVVEFiNlcjFt0E8Y1WwnzA52P2p/NTjDVnJybiJQznbdddyfCjsLOHD0apWxx7pt673hfv4FmdzKl/mFscpFd0nc4qbsRRTOJvZHheDyUnKVvx1HdtmXmKhqC7SZIlC7U5zXqi+Sw52RfE39wRMIngJPZdUZnyy6R5kZoQ7k8vqgUzEcIxpUkrxnZJ4oGCBV+aDpr0tUu5AsrCbLDei2cSD4l7vpiYHu6KIu5xwhbcWoTAq7HsjrZXHxIRyhjnGmsx9U1LRKtFEPIhN3uOJYmS5gY3ywm75M7CGRz0KbTOm5DWIwmQShF0xiPBCBlz1AYFxeo1YBNLfUMzxqhbswVMJXYVxKUr+b8oaI2kr+opB7B477UCvodUxaqRQmD/VehfZBepPRUfRX/Rnu8hSgZrW17FqJIqnXaj2xgCtjSTCgTSrrT/VNYiCn/jrsjtuE/0tr0lVOUeLnsJRYprWpgqJSi2WEuNRrUMVFpVWAvUcTjW/Co3KUzHVHUZ1XxUalVg41MwkXeNe4lWlkiQ+NK8u/l7Ni5vNpOgpvvZn9aXW7Zw74DgeH1K1J44nf4Q4kj7kcVE013IFHvNR3PF/CLthciTbr3opDovOqMkPwtMqfrWwq735OrZzlRiOExbs6MM3uA0r2Uux0i+mYBO34U31TiOygnfsBd6Mt7Gd2RzMtYalymViBJZjO9dxaAgUt2ON6U6YEO7JRm3Mx0Z8iBnGSeBU/tn+5losN0J1HMhsbsNyJ6ugJjOwHhvFo8aYYpo7FlbnN+N4gke4lmvZXVFwEZbyU67isLPv7h3FI5iu9lZv5bvQDdjFcO7GEFwk7sDXor+icDI3oI+vi/g9Bxt+bJw0Fzkd33Aie6l3YiN04xrhPpAj2UtM4jGjpdfXgyI0zm/GHer1YY6InXxG66B1xWvGdhY0wlcYZ8bnvzHyCMQEfCluEa05EntEDzPauR3rcZOxKXzZME/kNikKS7U2ojUy+YXoK/qiPjriW6SrF6vXYHt5MhvPQPGnsgS3eZWMnoJv0c9eyGB8oihcwuddD4gFu785jhvypFj/82TDrl5jw/xoqAsMT6GIO2Qan+f5LJknqaeg0IiI+rrgkLgFOw3XqVYHP0op53jmmJknuU4SU81w2L1KBuudjJ6W+CF51XgmFUxPlgTrdrZjKV/nCqPiHRzXq+U3Qy6K+boYa0zdgh23UXP6CId9eLB+xXL6OJc+w8OHtt44EnP4uTUWV3CXxUHEHdCx3FJ2OOG8zeE+ReFHMr1PGuPRYWcJ18mvcdwb0fqfF197nPDEuY/72ouW+EUMUq+W1ZItf3NxF1ZT86dasIu+KI4OO4ZAeKDphx+NWJC4CzvRllu9iobZfMkdy9fKorE8ys8NvY5uPMZr5VvjLOB9/jFIRS5z0wjDYN+HdLfvhP6fqPI8ZigwUmkUywn6s6HboXK2LbWtvTFBPQWHzdS5k6aOLZRSK3rEhl0M4m5ra8VonpJZkfa7sfjK8rbr1Yx7xLDzcEBrY8ipmVdVhHRHQFqYmSf/skLg/rpGDgJncou8JSzYMURm8vAVrLaFpq5FDs4m0ng592M1ZnAxAzxtwK725H7mMINLjKvVlL43kC5GI4uaXkNeqVpXFBB4FeuNTCqTc0SB3Z/KLcgV9zIDecjCV8HeOa7gPvEoZvEjrgqkaV35nbjCAAoqppsn5RDf4lQ8x91W8hL+imI+gUz6jXilvyH3IRfTuchIKzRhb8FjeBHp2oV5DSC4gzPxGAqkIJ1NwNfnRC7iVF8rPmxlDeQ14EQs4HgrToLaHIZM/oUTDVVR0EguIZDGgbyHA3k7d5kAZsi4CjoGh4H16hyG+cww5FNcFxrDEYM4VzyIAZb0y+xDXysxxxhPa4p0LODdbshFXMGZnCvDjOoFvJ+Leb/WFI9Y50D0EE9iljGKXkOMFk9y8lml18tXRGsriR/dUFjlb6s8vn8PdqIIe6HKfzOoKomW/wIUYeDeIwVFgwAAAABJRU5ErkJggg=="
+          alt="OneLab logo">
+      </div>
+      <div class="main" id="title">Page not found</div>
+      <div class="code">Error 404</div>
+      <div class="sub">The page you requested doesn’t exist, was removed, or is temporarily unavailable. You can return
+        to the application by logging in again.</div>
+      <a href="/login" class="login-btn" aria-label="Go to login page">Go to Home page</a>
+    </div>
+  </div>
+</body>
+
+</html>
--- a/gitops/charts/onelab/files/nginx.conf.tpl
+++ b/gitops/charts/onelab/files/nginx.conf.tpl
@@ -0,0 +1,337 @@
+
+worker_processes 4;
+
+events { worker_connections 1024; }
+
+http {
+  include /etc/nginx/mime.types;
+  
+  client_max_body_size 2m;
+
+  # don't send the nginx version number in error pages and Server header
+  server_tokens off;
+
+  sendfile on;
+
+  upstream website {
+    server website:4000;
+  }
+
+  upstream main {
+    server main:80;
+  }
+
+  upstream api {
+    server api:3000;
+  }
+
+  upstream api-device {
+    server api-device:3000;
+  }
+
+  upstream api-rabbit {
+    server api-rabbit:3000;
+  }
+
+  upstream designer {
+    server designer:80;
+  }
+
+  upstream runner {
+    server runner:80;
+  }
+
+  upstream static {
+    server static:80;
+  }
+
+  upstream websocket-worker {
+    server websocket-worker:3030;
+  }
+
+  # Restore the real client IP from the upstream reverse proxy
+  # Trust all RFC 1918 private ranges (covers any Docker network config)
+  set_real_ip_from  10.0.0.0/8;
+  set_real_ip_from  172.16.0.0/12;
+  set_real_ip_from  192.168.0.0/16;
+  real_ip_header    X-Real-IP;
+
+  limit_req_zone $binary_remote_addr zone=auth:10m rate=1r/s;
+  limit_req_zone $binary_remote_addr zone=website:10m rate=5r/s;
+  limit_req_zone $binary_remote_addr zone=global:10m rate=10r/s;
+
+  # redirect all http traffic to https
+  server {
+    listen 80 default_server;
+{{- if .Values.revproxy.ipv6Listen }}
+    listen [::]:80 default_server;
+{{- end }}
+    server_name localhost;
+
+    gzip on;
+    gzip_vary on;
+    gzip_min_length 10240;
+    gzip_proxied expired no-cache no-store private auth;
+    gzip_types text/plain text/css application/json application/x-javascript application/javascript text/xml application/xml application/xml+rss text/javascript;
+    gzip_disable "MSIE [1-6]\.";
+
+    root /data/;
+
+    location ^~ /lab/ {
+      rewrite ^/lab/(.*?) /app/lab/$1 last;
+    }
+
+    location ^~ /assets/ {
+      location ~* \.(?:css|js|woff|woff2|jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc)$ {
+        expires 1M;
+        access_log off;
+        add_header Cache-Control "public";
+
+        try_files $uri $uri/ /error-404.html =404;
+      }
+      expires -1;
+      add_header 'Cache-Control' 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
+
+      try_files $uri $uri/ /error-404.html =404;
+    }
+
+    location ^~ /static/ {
+      location ~* \.(?:css|js|woff|woff2|jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc)$ {
+        expires 1M;
+        access_log off;
+        add_header Cache-Control "public";
+
+        proxy_pass  http://static;
+        proxy_redirect  off;
+        proxy_set_header  Host $host;
+        proxy_set_header  X-Real-IP $remote_addr;
+        proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header  X-Forwarded-Host $server_name;
+      }
+
+      expires -1;
+      add_header 'Cache-Control' 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
+
+      proxy_pass  http://static;
+      proxy_redirect  off;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+    }
+
+    location ^~ /sitemap.xml {
+      limit_req zone=global burst=10 nodelay;
+
+      proxy_pass  http://api;
+      proxy_redirect  off;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+    }
+
+    location ^~ /robots.txt {
+      limit_req zone=global burst=10 nodelay;
+
+      proxy_pass  http://api;
+      proxy_redirect  off;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+    }
+
+    location ^~ /api/ {
+      limit_req zone=global burst=10 nodelay;
+
+      proxy_pass  http://api;
+      proxy_redirect  off;
+      proxy_set_header  Cookie $http_cookie;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+    }
+
+    location ^~ /api/v1/auth/ {
+      # apply rate limiting
+      limit_req zone=auth burst=5 nodelay;
+  
+      proxy_pass http://api;
+      proxy_redirect  off;
+      proxy_set_header  Cookie $http_cookie;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+    }
+    
+    location ^~ /api/v1/firmwares {
+      limit_req zone=global burst=10 nodelay;
+    
+      client_max_body_size 600M;
+
+      proxy_pass  http://api;
+      proxy_redirect  off;
+      proxy_set_header  Cookie $http_cookie;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+    }
+
+    location ^~ /api/v1/rmq/ {
+      proxy_pass  http://api-rabbit;
+      proxy_redirect  off;
+      proxy_set_header  Cookie $http_cookie;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+    }
+
+    location ^~ /device-api/ {
+      limit_req zone=global burst=10 nodelay;
+      client_max_body_size 600m;
+
+      proxy_pass  http://api-device;
+      proxy_redirect  off;
+      proxy_set_header  Cookie $http_cookie;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+    }
+
+    location ^~ /app/designer/ {
+      location ~* \.(?:css|js|woff|woff2|jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc)$ {
+        expires 1M;
+        access_log off;
+        add_header Cache-Control "public";
+
+        proxy_pass  http://designer;
+        proxy_redirect  off;
+        proxy_set_header  Cookie $http_cookie;
+        proxy_set_header  Host $host;
+        proxy_set_header  X-Real-IP $remote_addr;
+        proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header  X-Forwarded-Host $server_name;
+      }
+
+      expires -1;
+      add_header 'Cache-Control' 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
+
+      proxy_pass  http://designer;
+      proxy_redirect  off;
+      proxy_set_header  Cookie $http_cookie;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+    }
+
+    location ^~ /app/runner/ {
+      location ~* \.(?:css|js|woff|woff2|jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc)$ {
+        expires 1M;
+        access_log off;
+        add_header Cache-Control "public";
+
+        proxy_pass  http://runner;
+        proxy_redirect  off;
+        proxy_set_header  Cookie $http_cookie;
+        proxy_set_header  Host $host;
+        proxy_set_header  X-Real-IP $remote_addr;
+        proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header  X-Forwarded-Host $server_name;
+      }
+      
+      expires -1;
+      add_header 'Cache-Control' 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
+
+      proxy_pass  http://runner;
+      proxy_redirect  off;
+      proxy_set_header  Cookie $http_cookie;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+    }
+
+    location ^~ /ws/ {
+      proxy_pass  http://websocket-worker;
+      proxy_redirect  off;
+      proxy_set_header  Cookie $http_cookie;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+      
+      proxy_set_header Upgrade $http_upgrade;
+      proxy_set_header Connection "upgrade";
+    }
+    
+    location ^~ /app/ {
+      location ~* \.(?:css|js|woff|woff2|jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc)$ {
+        expires 1M;
+        access_log off;
+        add_header Cache-Control "public";
+
+        proxy_pass  http://main;
+        proxy_redirect  off;
+        proxy_set_header  Cookie $http_cookie;
+        proxy_set_header  Host $host;
+        proxy_set_header  X-Real-IP $remote_addr;
+        proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header  X-Forwarded-Host $server_name;
+      }
+      
+      expires -1;
+      add_header 'Cache-Control' 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
+
+      proxy_pass  http://main;
+      proxy_redirect  off;
+      proxy_set_header  Cookie $http_cookie;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+    }
+    
+    # Static assets for website (including /media/ subdirectory)
+     location ~* ^/.+\.(?:css|js|woff|woff2|ttf|eot|jpg|jpeg|gif|png|ico|cur|gz|svg|svgz|mp4|ogg|ogv|webm|htc)$ {   
+        expires 1M;
+        access_log off;
+        add_header Cache-Control "public";
+
+        proxy_pass  http://website;
+        proxy_redirect  off;
+        proxy_set_header  Cookie $http_cookie;
+        proxy_set_header  Host $host;
+        proxy_set_header  X-Real-IP $remote_addr;
+        proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header  X-Forwarded-Host $server_name;
+    }
+
+    # Website SSR routes (rate limited)
+    location ~ ^/(library(/[^/]+)?|login(/(reset|change))?|signup)?$ {
+      limit_req zone=website burst=10 nodelay;
+
+      expires -1;
+      add_header 'Cache-Control' 'no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0';
+
+      proxy_pass  http://website;
+      proxy_redirect  off;
+      proxy_set_header  Cookie $http_cookie;
+      proxy_set_header  Host $host;
+      proxy_set_header  X-Real-IP $remote_addr;
+      proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+      proxy_set_header  X-Forwarded-Host $server_name;
+    }
+
+    # Catch-all for junk requests
+    location /  {
+      try_files $uri $uri/ /error-404.html =404;
+    }
+  }
+}
--- a/gitops/charts/onelab/files/rabbit-definitions.json
+++ b/gitops/charts/onelab/files/rabbit-definitions.json
@@ -0,0 +1,20 @@
+{
+    "rabbit_version": "3.6.5",
+    "users": [
+    ],
+    "vhosts": [
+        {
+            "name": "devices"
+        },
+        {
+            "name": "internal"
+        }
+    ],
+    "permissions": [
+      ],
+    "parameters": [],
+    "policies": [],
+    "queues": [],
+    "exchanges": [],
+    "bindings": []
+}
--- a/gitops/charts/onelab/files/rabbit.conf
+++ b/gitops/charts/onelab/files/rabbit.conf
@@ -0,0 +1,54 @@
+# Auth server config
+
+auth_backends.1             = cache
+
+auth_cache.cached_backend   = http
+auth_cache.cache_ttl        = 5000
+
+auth_http.user_path         = http://revproxy/api/v1/rmq/user
+auth_http.vhost_path        = http://revproxy/api/v1/rmq/vhost
+auth_http.resource_path     = http://revproxy/api/v1/rmq/resource
+auth_http.topic_path        = http://revproxy/api/v1/rmq/topic
+
+listeners.ssl.default = 5671
+
+# generated with "cat server.crt server.key > server.pem"
+# fullchain
+ssl_options.cacertfile = /etc/rabbitmq/ssl/rabbit.fullchain.pem 
+
+ssl_options.certfile   = /etc/rabbitmq/ssl/rabbit.crt
+ssl_options.keyfile    = /etc/rabbitmq/ssl/rabbit.key
+
+# not very secure
+ssl_options.verify     = verify_peer
+ssl_options.fail_if_no_peer_cert = false
+
+# for TLS version and cipher
+ssl_options.versions.1 = tlsv1.2
+
+# these MUST be disabled if TLSv1.3 is used
+ssl_options.honor_cipher_order   = true
+ssl_options.honor_ecc_order      = true
+
+# These are highly recommended for TLSv1.2 but cannot be used
+# with TLSv1.3. If TLSv1.3 is enabled, these lines MUST be removed.
+ssl_options.client_renegotiation = false
+ssl_options.secure_renegotiate   = true
+
+ssl_options.ciphers.1  = ECDHE-ECDSA-AES256-GCM-SHA384
+ssl_options.ciphers.2  = ECDHE-RSA-AES256-GCM-SHA384
+ssl_options.ciphers.3  = ECDH-ECDSA-AES256-GCM-SHA384
+ssl_options.ciphers.4  = ECDH-RSA-AES256-GCM-SHA384
+ssl_options.ciphers.5  = DHE-RSA-AES256-GCM-SHA384
+ssl_options.ciphers.6  = DHE-DSS-AES256-GCM-SHA384
+ssl_options.ciphers.7  = ECDHE-ECDSA-AES128-GCM-SHA256
+ssl_options.ciphers.8  = ECDHE-RSA-AES128-GCM-SHA256
+ssl_options.ciphers.9  = ECDH-ECDSA-AES128-GCM-SHA256
+ssl_options.ciphers.10 = ECDH-RSA-AES128-GCM-SHA256
+ssl_options.ciphers.11 = DHE-RSA-AES128-GCM-SHA256
+ssl_options.ciphers.12 = DHE-DSS-AES128-GCM-SHA256
+
+management.load_definitions = /opt/definitions.json
+
+# For connection events
+event_exchange.vhost = devices
--- a/gitops/charts/onelab/templates/_helpers.tpl
+++ b/gitops/charts/onelab/templates/_helpers.tpl
@@ -0,0 +1,37 @@
+{{- define "onelab.name" -}}
+{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
+{{- end }}
+
+{{- define "onelab.fullname" -}}
+{{- if .Values.fullnameOverride }}
+{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- $name := default .Chart.Name .Values.nameOverride }}
+{{- if contains $name .Release.Name }}
+{{- .Release.Name | trunc 63 | trimSuffix "-" }}
+{{- else }}
+{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
+{{- end }}
+{{- end }}
+{{- end }}
+
+{{- define "onelab.labels" -}}
+app.kubernetes.io/name: {{ include "onelab.name" . }}
+helm.sh/chart: {{ printf "%s-%s" .Chart.Name .Chart.Version | quote }}
+app.kubernetes.io/instance: {{ .Release.Name }}
+app.kubernetes.io/managed-by: {{ .Release.Service }}
+app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
+{{- end }}
+
+{{- define "onelab.dockerconfigjson" -}}
+{{- $server := .Values.registry.server -}}
+{{- $user := .Values.registry.username -}}
+{{- $pass := .Values.registry.password -}}
+{{- $auth := printf "%s:%s" $user $pass | b64enc -}}
+{{- $entry := dict "username" $user "password" $pass "auth" $auth -}}
+{{- dict "auths" (dict $server $entry) | toJson -}}
+{{- end }}
+
+{{- define "onelab.configurationSecretName" -}}
+{{- .Values.configuration.existingSecretName | default "onelab-configurations" }}
+{{- end }}
--- a/gitops/charts/onelab/templates/configmap-rabbit.yaml
+++ b/gitops/charts/onelab/templates/configmap-rabbit.yaml
@@ -0,0 +1,18 @@
+{{- $cfg := fromYaml (.Files.AsConfig) }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: onelab-rabbit-config
+  labels:
+    {{- include "onelab.labels" . | nindent 4 }}
+  annotations:
+    argocd.argoproj.io/sync-wave: {{ .Values.syncWaves.statefulDeps | quote }}
+data:
+  rabbit.conf: |
+{{ index $cfg "rabbit.conf" | nindent 4 }}
+  advanced.conf: |
+{{ index $cfg "advanced.conf" | nindent 4 }}
+  enable_plugins: |
+{{ index $cfg "enable_plugins" | nindent 4 }}
+  definitions.json: |
+{{ index $cfg "rabbit-definitions.json" | nindent 4 }}
--- a/gitops/charts/onelab/templates/configmap-revproxy.yaml
+++ b/gitops/charts/onelab/templates/configmap-revproxy.yaml
@@ -0,0 +1,14 @@
+{{- $cfg := fromYaml (.Files.AsConfig) }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: onelab-revproxy
+  labels:
+    {{- include "onelab.labels" . | nindent 4 }}
+  annotations:
+    argocd.argoproj.io/sync-wave: {{ .Values.syncWaves.apps | quote }}
+data:
+  nginx.conf: |
+{{ tpl (index $cfg "nginx.conf.tpl") . | nindent 4 }}
+  error-404.html: |
+{{ index $cfg "error-404.html" | nindent 4 }}
--- a/gitops/charts/onelab/templates/deployment-optional-workers.yaml
+++ b/gitops/charts/onelab/templates/deployment-optional-workers.yaml
@@ -0,0 +1,111 @@
+{{- $root := . }}
+{{- if or .Values.onelab.ldap.enabled .Values.features.ldapWorker }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: ldap-worker
+  labels:
+    app.kubernetes.io/component: ldap-worker
+    {{- include "onelab.labels" $root | nindent 4 }}
+  annotations:
+    argocd.argoproj.io/sync-wave: {{ $root.Values.syncWaves.apps | quote }}
+spec:
+  replicas: {{ $root.Values.replicas.ldap | default 1 }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: ldap-worker
+      app.kubernetes.io/name: {{ include "onelab.name" $root }}
+      app.kubernetes.io/instance: {{ $root.Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: ldap-worker
+        app.kubernetes.io/name: {{ include "onelab.name" $root }}
+        app.kubernetes.io/instance: {{ $root.Release.Name }}
+    spec:
+      {{- with $root.Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: ldap-worker
+          image: {{ printf "%s/%s:%s" $root.Values.images.registry "onelab-ldap-worker" $root.Values.images.tag | quote }}
+          volumeMounts:
+            - name: configurations
+              mountPath: /conf/configurations.yml
+              subPath: configurations.yml
+              readOnly: true
+            {{- if eq $root.Values.persistence.mode "hostPath" }}
+            - name: logs
+              mountPath: /logs
+            {{- end }}
+      volumes:
+        - name: configurations
+          secret:
+            secretName: {{ include "onelab.configurationSecretName" $root }}
+        {{- if eq $root.Values.persistence.mode "hostPath" }}
+        - name: logs
+          hostPath:
+            path: {{ $root.Values.persistence.hostPath.logs }}
+            type: DirectoryOrCreate
+        {{- else }}
+        - name: logs
+          emptyDir: {}
+        {{- end }}
+{{- end }}
+{{- if .Values.features.mailerWorker }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: mailer-worker
+  labels:
+    app.kubernetes.io/component: mailer-worker
+    {{- include "onelab.labels" $root | nindent 4 }}
+  annotations:
+    argocd.argoproj.io/sync-wave: {{ $root.Values.syncWaves.apps | quote }}
+spec:
+  replicas: {{ $root.Values.replicas.mailer | default 1 }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: mailer-worker
+      app.kubernetes.io/name: {{ include "onelab.name" $root }}
+      app.kubernetes.io/instance: {{ $root.Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: mailer-worker
+        app.kubernetes.io/name: {{ include "onelab.name" $root }}
+        app.kubernetes.io/instance: {{ $root.Release.Name }}
+    spec:
+      {{- with $root.Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: mailer-worker
+          image: {{ printf "%s/%s:%s" $root.Values.images.registry "onelab-mailer-worker" $root.Values.images.tag | quote }}
+          volumeMounts:
+            - name: configurations
+              mountPath: /conf/configurations.yml
+              subPath: configurations.yml
+              readOnly: true
+            {{- if eq $root.Values.persistence.mode "hostPath" }}
+            - name: logs
+              mountPath: /logs
+            {{- end }}
+      volumes:
+        - name: configurations
+          secret:
+            secretName: {{ include "onelab.configurationSecretName" $root }}
+        {{- if eq $root.Values.persistence.mode "hostPath" }}
+        - name: logs
+          hostPath:
+            path: {{ $root.Values.persistence.hostPath.logs }}
+            type: DirectoryOrCreate
+        {{- else }}
+        - name: logs
+          emptyDir: {}
+        {{- end }}
+{{- end }}
--- a/gitops/charts/onelab/templates/deployment-redis.yaml
+++ b/gitops/charts/onelab/templates/deployment-redis.yaml
@@ -0,0 +1,53 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: redis
+  labels:
+    {{- include "onelab.labels" . | nindent 4 }}
+  annotations:
+    argocd.argoproj.io/sync-wave: {{ .Values.syncWaves.statefulDeps | quote }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: redis
+      app.kubernetes.io/name: {{ include "onelab.name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: redis
+        app.kubernetes.io/name: {{ include "onelab.name" . }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: redis
+          image: {{ printf "%s/%s:%s" .Values.images.registry .Values.images.redis .Values.images.redisTag | quote }}
+          ports:
+            - containerPort: 6379
+              name: redis
+          {{- with .Values.redis.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: redis
+  labels:
+    {{- include "onelab.labels" . | nindent 4 }}
+spec:
+  type: ClusterIP
+  ports:
+    - port: 6379
+      targetPort: redis
+      name: redis
+  selector:
+    app.kubernetes.io/component: redis
+    app.kubernetes.io/name: {{ include "onelab.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
--- a/gitops/charts/onelab/templates/deployment-revproxy.yaml
+++ b/gitops/charts/onelab/templates/deployment-revproxy.yaml
@@ -0,0 +1,73 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: revproxy
+  labels:
+    {{- include "onelab.labels" . | nindent 4 }}
+  annotations:
+    argocd.argoproj.io/sync-wave: {{ .Values.syncWaves.apps | quote }}
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: revproxy
+      app.kubernetes.io/name: {{ include "onelab.name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: revproxy
+        app.kubernetes.io/name: {{ include "onelab.name" . }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: nginx
+          image: {{ printf "%s/%s:%s" .Values.images.registry .Values.images.nginx .Values.images.nginxTag | quote }}
+          ports:
+            - containerPort: 80
+              name: http
+          volumeMounts:
+            - name: nginx
+              mountPath: /etc/nginx/nginx.conf
+              subPath: nginx.conf
+            - name: nginx
+              mountPath: /data/error-404.html
+              subPath: error-404.html
+            - name: data
+              mountPath: /data
+      volumes:
+        - name: nginx
+          configMap:
+            name: onelab-revproxy
+        - name: data
+          {{- if eq .Values.persistence.mode "hostPath" }}
+          hostPath:
+            path: {{ .Values.persistence.hostPath.data }}
+            type: DirectoryOrCreate
+          {{- else }}
+          emptyDir: {}
+          {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: revproxy
+  labels:
+    {{- include "onelab.labels" . | nindent 4 }}
+spec:
+  type: {{ .Values.revproxy.serviceType }}
+  ports:
+    - port: 80
+      targetPort: http
+      name: http
+      {{- if and (eq .Values.revproxy.serviceType "NodePort") .Values.revproxy.nodePort }}
+      nodePort: {{ .Values.revproxy.nodePort }}
+      {{- end }}
+  selector:
+    app.kubernetes.io/component: revproxy
+    app.kubernetes.io/name: {{ include "onelab.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
--- a/gitops/charts/onelab/templates/ingress.yaml
+++ b/gitops/charts/onelab/templates/ingress.yaml
@@ -0,0 +1,37 @@
+{{- if .Values.ingress.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: onelab-revproxy
+  labels:
+    {{- include "onelab.labels" . | nindent 4 }}
+  annotations:
+    argocd.argoproj.io/sync-wave: {{ .Values.syncWaves.apps | quote }}
+    {{- if .Values.ingress.certManager.clusterIssuer }}
+    cert-manager.io/cluster-issuer: {{ .Values.ingress.certManager.clusterIssuer | quote }}
+    {{- end }}
+    {{- with .Values.ingress.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  {{- if .Values.ingress.className }}
+  ingressClassName: {{ .Values.ingress.className | quote }}
+  {{- end }}
+  {{- if .Values.ingress.tls }}
+  tls:
+    - hosts:
+        - {{ .Values.ingress.host | quote }}
+      secretName: {{ if .Values.ingress.tlsSecretName }}{{ .Values.ingress.tlsSecretName | quote }}{{ else }}{{ printf "%s-tls" .Release.Name | quote }}{{ end }}
+  {{- end }}
+  rules:
+    - host: {{ .Values.ingress.host | quote }}
+      http:
+        paths:
+          - path: {{ .Values.ingress.path | quote }}
+            pathType: {{ .Values.ingress.pathType | quote }}
+            backend:
+              service:
+                name: revproxy
+                port:
+                  name: http
+{{- end }}
--- a/gitops/charts/onelab/templates/secret-configurations.yaml
+++ b/gitops/charts/onelab/templates/secret-configurations.yaml
@@ -0,0 +1,15 @@
+{{- if not .Values.configuration.existingSecretName }}
+{{- $cfg := fromYaml (.Files.AsConfig) }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: onelab-configurations
+  labels:
+    {{- include "onelab.labels" . | nindent 4 }}
+  annotations:
+    argocd.argoproj.io/sync-wave: {{ .Values.syncWaves.statefulDeps | quote }}
+type: Opaque
+stringData:
+  configurations.yml: |
+{{- tpl (index $cfg "configurations.gotmpl") . | nindent 4 }}
+{{- end }}
--- a/gitops/charts/onelab/templates/secret-postgres.yaml
+++ b/gitops/charts/onelab/templates/secret-postgres.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: onelab-postgres
+  labels:
+    {{- include "onelab.labels" . | nindent 4 }}
+  annotations:
+    argocd.argoproj.io/sync-wave: {{ .Values.syncWaves.postgres | quote }}
+type: Opaque
+stringData:
+  postgres-password: {{ .Values.postgresql.auth.password | quote }}
--- a/gitops/charts/onelab/templates/secret-rabbit-tls.yaml
+++ b/gitops/charts/onelab/templates/secret-rabbit-tls.yaml
@@ -0,0 +1,18 @@
+{{- if .Values.rabbitmq.tls.embed }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Values.rabbitmq.tls.secretName }}
+  labels:
+    {{- include "onelab.labels" . | nindent 4 }}
+  annotations:
+    argocd.argoproj.io/sync-wave: {{ .Values.syncWaves.statefulDeps | quote }}
+type: Opaque
+stringData:
+  rabbit.crt: |
+{{ .Values.rabbitmq.tls.crt | nindent 4 }}
+  rabbit.key: |
+{{ .Values.rabbitmq.tls.key | nindent 4 }}
+  rabbit.fullchain.pem: |
+{{ .Values.rabbitmq.tls.fullchain | nindent 4 }}
+{{- end }}
--- a/gitops/charts/onelab/templates/secret-registry.yaml
+++ b/gitops/charts/onelab/templates/secret-registry.yaml
@@ -0,0 +1,13 @@
+{{- if .Values.registry.createPullSecret }}
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ .Values.registry.pullSecretName }}
+  labels:
+    {{- include "onelab.labels" . | nindent 4 }}
+  annotations:
+    argocd.argoproj.io/sync-wave: {{ .Values.syncWaves.registry | quote }}
+type: kubernetes.io/dockerconfigjson
+data:
+  .dockerconfigjson: {{ include "onelab.dockerconfigjson" . | b64enc }}
+{{- end }}
--- a/gitops/charts/onelab/templates/service-db.yaml
+++ b/gitops/charts/onelab/templates/service-db.yaml
@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: db
+  labels:
+    {{- include "onelab.labels" . | nindent 4 }}
+  annotations:
+    argocd.argoproj.io/sync-wave: {{ .Values.syncWaves.postgres | quote }}
+spec:
+  type: ClusterIP
+  ports:
+    - port: 5432
+      targetPort: postgres
+      name: postgres
+  selector:
+    app.kubernetes.io/component: postgres
+    app.kubernetes.io/name: {{ include "onelab.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
--- a/gitops/charts/onelab/templates/service-rabbitmq.yaml
+++ b/gitops/charts/onelab/templates/service-rabbitmq.yaml
@@ -0,0 +1,16 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: rabbitmq
+  labels:
+    {{- include "onelab.labels" . | nindent 4 }}
+spec:
+  type: ClusterIP
+  ports:
+    - port: 5671
+      targetPort: amqps
+      name: amqps
+  selector:
+    app.kubernetes.io/component: rabbitmq
+    app.kubernetes.io/name: {{ include "onelab.name" . }}
+    app.kubernetes.io/instance: {{ .Release.Name }}
--- a/gitops/charts/onelab/templates/statefulset-postgres.yaml
+++ b/gitops/charts/onelab/templates/statefulset-postgres.yaml
@@ -0,0 +1,67 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: db
+  labels:
+    {{- include "onelab.labels" . | nindent 4 }}
+  annotations:
+    argocd.argoproj.io/sync-wave: {{ .Values.syncWaves.postgres | quote }}
+spec:
+  replicas: 1
+  serviceName: db
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: postgres
+      app.kubernetes.io/name: {{ include "onelab.name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: postgres
+        app.kubernetes.io/name: {{ include "onelab.name" . }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+      annotations:
+        {{- if .Values.registry.createPullSecret }}
+        checksum/docker-registry: {{ include "onelab.dockerconfigjson" . | sha256sum | quote }}
+        {{- else if not (empty .Values.imagePullSecrets) }}
+        checksum/image-pull-secrets: {{ .Values.imagePullSecrets | toJson | sha256sum | quote }}
+        {{- end }}
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: postgres
+          image: {{ printf "%s/%s:%s" .Values.images.registry .Values.images.postgres .Values.images.postgresTag | quote }}
+          ports:
+            - containerPort: 5432
+              name: postgres
+          env:
+            - name: POSTGRES_USER
+              value: postgres
+            - name: POSTGRES_DB
+              value: postgres
+            - name: POSTGRES_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: onelab-postgres
+                  key: postgres-password
+          volumeMounts:
+            - name: data
+              mountPath: /var/lib/postgresql/data
+          {{- with .Values.postgresql.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+  volumeClaimTemplates:
+    - metadata:
+        name: data
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        {{- if .Values.persistence.storageClass }}
+        storageClassName: {{ .Values.persistence.storageClass | quote }}
+        {{- end }}
+        resources:
+          requests:
+            storage: {{ .Values.persistence.postgres.size | quote }}
--- a/gitops/charts/onelab/templates/statefulset-rabbitmq.yaml
+++ b/gitops/charts/onelab/templates/statefulset-rabbitmq.yaml
@@ -0,0 +1,86 @@
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: rabbitmq
+  labels:
+    {{- include "onelab.labels" . | nindent 4 }}
+  annotations:
+    argocd.argoproj.io/sync-wave: {{ .Values.syncWaves.statefulDeps | quote }}
+spec:
+  replicas: 1
+  serviceName: rabbitmq
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: rabbitmq
+      app.kubernetes.io/name: {{ include "onelab.name" . }}
+      app.kubernetes.io/instance: {{ .Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: rabbitmq
+        app.kubernetes.io/name: {{ include "onelab.name" . }}
+        app.kubernetes.io/instance: {{ .Release.Name }}
+      annotations:
+        {{- if .Values.registry.createPullSecret }}
+        checksum/docker-registry: {{ include "onelab.dockerconfigjson" . | sha256sum | quote }}
+        {{- else if not (empty .Values.imagePullSecrets) }}
+        checksum/image-pull-secrets: {{ .Values.imagePullSecrets | toJson | sha256sum | quote }}
+        {{- end }}
+    spec:
+      hostname: onelab
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: rabbitmq
+          image: {{ printf "%s/%s:%s" .Values.images.registry .Values.images.rabbitmq .Values.images.rabbitmqTag | quote }}
+          ports:
+            - containerPort: 5671
+              name: amqps
+          volumeMounts:
+            - name: rabbit-data
+              mountPath: /var/lib/rabbitmq/mnesia
+            - name: rabbit-config
+              mountPath: /etc/rabbitmq/rabbitmq.conf
+              subPath: rabbit.conf
+            - name: rabbit-config
+              mountPath: /etc/rabbitmq/advanced.conf
+              subPath: advanced.conf
+            - name: rabbit-config
+              mountPath: /etc/rabbitmq/enabled_plugins
+              subPath: enable_plugins
+            - name: rabbit-config
+              mountPath: /opt/definitions.json
+              subPath: definitions.json
+            - name: rabbit-tls
+              mountPath: /etc/rabbitmq/ssl/rabbit.crt
+              subPath: rabbit.crt
+            - name: rabbit-tls
+              mountPath: /etc/rabbitmq/ssl/rabbit.key
+              subPath: rabbit.key
+            - name: rabbit-tls
+              mountPath: /etc/rabbitmq/ssl/rabbit.fullchain.pem
+              subPath: rabbit.fullchain.pem
+          {{- with .Values.rabbitmq.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+      volumes:
+        - name: rabbit-config
+          configMap:
+            name: onelab-rabbit-config
+        - name: rabbit-tls
+          secret:
+            secretName: {{ .Values.rabbitmq.tls.secretName }}
+  volumeClaimTemplates:
+    - metadata:
+        name: rabbit-data
+      spec:
+        accessModes: ["ReadWriteOnce"]
+        {{- if .Values.persistence.storageClass }}
+        storageClassName: {{ .Values.persistence.storageClass | quote }}
+        {{- end }}
+        resources:
+          requests:
+            storage: {{ .Values.persistence.rabbitmq.size | quote }}
--- a/gitops/charts/onelab/templates/workloads.yaml
+++ b/gitops/charts/onelab/templates/workloads.yaml
@@ -0,0 +1,116 @@
+{{- $root := . }}
+{{- range .Values.workloads }}
+{{- $n := .replicas | default 1 | int }}
+{{- if and .replicaKey (hasKey $root.Values.replicas .replicaKey) }}
+{{- $n = index $root.Values.replicas .replicaKey | int }}
+{{- end }}
+{{- $vols := or .config (not (empty .mounts)) }}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: {{ .name }}
+  labels:
+    app.kubernetes.io/component: {{ .name }}
+    {{- include "onelab.labels" $root | nindent 4 }}
+  annotations:
+    argocd.argoproj.io/sync-wave: {{ $root.Values.syncWaves.apps | quote }}
+spec:
+  replicas: {{ $n }}
+  selector:
+    matchLabels:
+      app.kubernetes.io/component: {{ .name }}
+      app.kubernetes.io/name: {{ include "onelab.name" $root }}
+      app.kubernetes.io/instance: {{ $root.Release.Name }}
+  template:
+    metadata:
+      labels:
+        app.kubernetes.io/component: {{ .name }}
+        app.kubernetes.io/name: {{ include "onelab.name" $root }}
+        app.kubernetes.io/instance: {{ $root.Release.Name }}
+    spec:
+      {{- with $root.Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: {{ .name }}
+          image: {{ printf "%s/%s:%s" $root.Values.images.registry .image $root.Values.images.tag | quote }}
+          {{- if .port }}
+          ports:
+            - containerPort: {{ .port }}
+              name: http
+          {{- end }}
+          {{- if and .website (not $root.Values.website.ssr) }}
+          env:
+            - name: RENDERING_MODE
+              value: "no-ssr"
+          {{- end }}
+          {{- if $vols }}
+          volumeMounts:
+            {{- if .config }}
+            - name: configurations
+              mountPath: /conf/configurations.yml
+              subPath: configurations.yml
+              readOnly: true
+            {{- end }}
+            {{- if has "logs" .mounts }}
+            - name: logs
+              mountPath: /logs
+            {{- end }}
+            {{- if has "data" .mounts }}
+            - name: data
+              mountPath: /data
+            {{- end }}
+            {{- if has "shared" .mounts }}
+            - name: data
+              mountPath: /shared-inputs
+              subPath: shared/inputs
+            - name: data
+              mountPath: /shared-archived
+              subPath: shared/archived
+            {{- end }}
+          {{- end }}
+      {{- if $vols }}
+      volumes:
+        {{- if .config }}
+        - name: configurations
+          secret:
+            secretName: {{ include "onelab.configurationSecretName" $root }}
+        {{- end }}
+        {{- if eq $root.Values.persistence.mode "hostPath" }}
+        {{- if has "logs" .mounts }}
+        - name: logs
+          hostPath:
+            path: {{ $root.Values.persistence.hostPath.logs }}
+            type: DirectoryOrCreate
+        {{- end }}
+        {{- if or (has "data" .mounts) (has "shared" .mounts) }}
+        - name: data
+          hostPath:
+            path: {{ $root.Values.persistence.hostPath.data }}
+            type: DirectoryOrCreate
+        {{- end }}
+        {{- end }}
+      {{- end }}
+{{- if and .port (gt (int .port) 0) }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: {{ .name }}
+  labels:
+    app.kubernetes.io/component: {{ .name }}
+    {{- include "onelab.labels" $root | nindent 4 }}
+spec:
+  type: ClusterIP
+  ports:
+    - port: {{ .port }}
+      targetPort: http
+      name: http
+  selector:
+    app.kubernetes.io/component: {{ .name }}
+    app.kubernetes.io/name: {{ include "onelab.name" $root }}
+    app.kubernetes.io/instance: {{ $root.Release.Name }}
+{{- end }}
+{{- end }}
--- a/gitops/charts/onelab/values.yaml
+++ b/gitops/charts/onelab/values.yaml
@@ -0,0 +1,236 @@
+# Default values for onelab — override per environment (see gitops/values/).
+
+nameOverride: ""
+fullnameOverride: ""
+
+# If non-empty, workloads mount this Secret instead of chart-generated onelab-configurations.
+# Secret must contain key `configurations.yml`. Chart will NOT create onelab-configurations.
+configuration:
+  existingSecretName: ""
+
+images:
+  registry: hub.andrewalliance.com/releases
+  tag: "1.27.0"
+  nginx: nginx
+  nginxTag: "1.29.5-alpine"
+  postgres: postgres
+  postgresTag: "17.8"
+  redis: redis
+  redisTag: "7.4.7-alpine"
+  rabbitmq: rabbitmq
+  rabbitmqTag: "3.13.7"
+
+imagePullSecrets: []
+# - name: hub-andrewalliance
+
+# Override registry credentials in gitops/values/ (see gitops/values/secrets.example.yaml).
+registry:
+  createPullSecret: false
+  pullSecretName: hub-andrewalliance
+  server: hub.andrewalliance.com
+  username: public
+  password: "REPLACE_REGISTRY_PASSWORD"
+
+# hostPath: matches typical single-node Swarm-style install (shared /data and /logs).
+# Use persistence.mode: pvc + a ReadWriteMany class for multi-node shared storage.
+persistence:
+  mode: hostPath
+  storageClass: ""
+  hostPath:
+    data: /opt/onelab/data
+    logs: /opt/onelab/logs
+  postgres:
+    size: 20Gi
+  rabbitmq:
+    size: 5Gi
+
+postgresql:
+  auth:
+    password: "DBPasswordPlaceholder"
+  resources: {}
+
+redis:
+  resources: {}
+
+rabbitmq:
+  resources: {}
+  # TLS: create Secret `onelab-rabbit-tls` in the release namespace (see README), or set embed: true.
+  tls:
+    secretName: onelab-rabbit-tls
+    embed: false
+    crt: ""
+    key: ""
+    fullchain: ""
+
+syncWaves:
+  registry: "-5"
+  postgres: "-3"
+  statefulDeps: "-2"
+  apps: "0"
+
+onelab:
+  domain: "https://localhost"
+  mailer:
+    noreply: "no-reply@example.com"
+  secrets:
+    authTokenKey: "TokenAuthPlaceholder"
+    monitoringToken: "TokenMonitoringPlaceholder"
+    rabbitToken: "TokenRabbitPlaceholder"
+  # Mirrors legacy OneLab configurations.yml params.compliance (templated from charts/onelab/files/configurations.gotmpl).
+  compliance:
+    enabled: false
+    requireElectronicSignature: true
+    executionOperatorRestrictionPolicy: "reviewed"
+    executionAdminExpertRestrictionPolicy: "reviewed"
+    preventCsvImport: true
+    preventManualMetadataEdit: true
+    deviceRestart: true
+  # Set enabled: true to turn on LDAP in configurations.yml and deploy ldap-worker (or use features.ldapWorker).
+  ldap:
+    enabled: false
+    timeout: ""
+    encryption: ""
+    policy: ""
+    tlsCaPath: ""
+    tlsCertPath: ""
+    tlsKeyPath: ""
+    tlsCiphers: ""
+    tlsSslVersion: ""
+  intercom:
+    appid: "REPLACE_INTERCOM_APP_ID"
+    secret: "REPLACE_INTERCOM_SECRET"
+
+features:
+  # Deprecated for LDAP: prefer onelab.ldap.enabled (either enables ldap-worker + ldap.enabled in config).
+  ldapWorker: false
+  mailerWorker: false
+
+website:
+  ssr: true
+
+revproxy:
+  serviceType: NodePort
+  nodePort: 30080
+  ipv6Listen: true
+
+# HTTP routing to internal nginx (revproxy). On k3s, set className: traefik (default controller).
+ingress:
+  enabled: false
+  className: ""
+  host: onelab.local
+  path: /
+  pathType: Prefix
+  annotations: {}
+  tls: false
+  tlsSecretName: ""
+  certManager:
+    # When set, adds cert-manager.io/cluster-issuer annotation (TLS secret is created automatically).
+    clusterIssuer: ""
+
+# Replica counts (api.apidevice etc. override defaults in templates/workloads.yaml via this map)
+replicas:
+  api: 2
+  apidevice: 1
+  apirabbit: 1
+  devices: 1
+  experiments: 1
+  images: 1
+  manual: 1
+  ws: 1
+  ldap: 1
+  mailer: 1
+
+resources: {}
+
+workloads:
+  - name: supervisor
+    image: onelab-supervisor-worker
+    replicas: 1
+    port: 0
+    config: true
+    mounts: [logs, data]
+  - name: file-worker
+    image: onelab-file-worker
+    replicas: 1
+    port: 0
+    config: true
+    mounts: [logs, data, shared]
+  - name: api
+    image: onelab-api
+    replicaKey: api
+    port: 3000
+    config: true
+    mounts: [logs, data]
+  - name: api-device
+    image: onelab-api-device
+    replicaKey: apidevice
+    port: 3000
+    config: true
+    mounts: [logs, data]
+  - name: api-rabbit
+    image: onelab-api-rabbit
+    replicaKey: apirabbit
+    port: 3000
+    config: true
+    mounts: [logs, data]
+  - name: devices-worker
+    image: onelab-devices-worker
+    replicaKey: devices
+    port: 0
+    config: true
+    mounts: [logs, data]
+  - name: experiments-worker
+    image: onelab-experiments-worker
+    replicaKey: experiments
+    port: 0
+    config: true
+    mounts: [logs]
+  - name: images-worker
+    image: onelab-images-worker
+    replicaKey: images
+    port: 0
+    config: true
+    mounts: [logs, data]
+  - name: manual-worker
+    image: onelab-manual-worker
+    replicaKey: manual
+    port: 0
+    config: true
+    mounts: [logs]
+  - name: websocket-worker
+    image: onelab-websocket-worker
+    replicaKey: ws
+    port: 3030
+    config: true
+    mounts: [logs]
+  - name: static
+    image: onelab-static
+    replicas: 1
+    port: 80
+    config: false
+    mounts: []
+  - name: main
+    image: onelab-main
+    replicas: 1
+    port: 80
+    config: false
+    mounts: []
+  - name: designer
+    image: onelab-designer
+    replicas: 1
+    port: 80
+    config: false
+    mounts: []
+  - name: runner
+    image: onelab-runner
+    replicas: 1
+    port: 80
+    config: false
+    mounts: []
+  - name: website
+    image: onelab-website
+    replicas: 1
+    port: 4000
+    config: false
+    mounts: []
+    website: true
--- a/gitops/observability/Chart.lock
+++ b/gitops/observability/Chart.lock
@@ -0,0 +1,12 @@
+dependencies:
+- name: loki
+  repository: https://grafana.github.io/helm-charts
+  version: 6.55.0
+- name: promtail
+  repository: https://grafana.github.io/helm-charts
+  version: 6.17.1
+- name: grafana
+  repository: https://grafana.github.io/helm-charts
+  version: 10.5.15
+digest: sha256:5b34192a8db9d940587777fbc62a13503c21217da814308654ce73fca2ed5d56
+generated: "2026-03-20T11:06:47.9376325+01:00"
--- a/gitops/observability/Chart.yaml
+++ b/gitops/observability/Chart.yaml
@@ -0,0 +1,16 @@
+apiVersion: v2
+name: onelab-observability
+description: Loki + Promtail + Grafana for OneLab (same Argo Application as app chart via multi-source).
+type: application
+version: 0.1.0
+appVersion: "1.0"
+dependencies:
+  - name: loki
+    version: 6.55.0
+    repository: https://grafana.github.io/helm-charts
+  - name: promtail
+    version: 6.17.1
+    repository: https://grafana.github.io/helm-charts
+  - name: grafana
+    version: 10.5.15
+    repository: https://grafana.github.io/helm-charts
--- a/gitops/observability/charts/grafana-10.5.15.tgz
+++ b/gitops/observability/charts/grafana-10.5.15.tgz
--- a/gitops/observability/charts/loki-6.55.0.tgz
+++ b/gitops/observability/charts/loki-6.55.0.tgz
--- a/gitops/observability/charts/promtail-6.17.1.tgz
+++ b/gitops/observability/charts/promtail-6.17.1.tgz
--- a/gitops/observability/dashboards/onelab-logs.json
+++ b/gitops/observability/dashboards/onelab-logs.json
@@ -0,0 +1,205 @@
+{
+  "annotations": {
+    "list": [
+      {
+        "builtIn": 1,
+        "datasource": {"type": "grafana", "uid": "-- Grafana --"},
+        "enable": true,
+        "hide": true,
+        "iconColor": "rgba(0, 211, 255, 1)",
+        "name": "Annotations & Alerts",
+        "type": "dashboard"
+      }
+    ]
+  },
+  "editable": true,
+  "fiscalYearStartMonth": 0,
+  "graphTooltip": 0,
+  "id": null,
+  "links": [],
+  "liveNow": false,
+  "panels": [
+    {
+      "datasource": {"type": "loki", "uid": "loki"},
+      "fieldConfig": {
+        "defaults": {
+          "color": {"mode": "thresholds"},
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [{"color": "blue", "value": null}]
+          },
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "gridPos": {"h": 5, "w": 8, "x": 0, "y": 0},
+      "id": 1,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "none",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "reduceOptions": {"calcs": ["lastNotNull"], "fields": "", "values": false},
+        "textMode": "auto"
+      },
+      "targets": [
+        {
+          "datasource": {"type": "loki", "uid": "loki"},
+          "editorMode": "code",
+          "expr": "sum(count_over_time({namespace=\"onelab\", component=~\"$component\"} |~ \"$filter\" [$__range]))",
+          "queryType": "instant",
+          "refId": "A"
+        }
+      ],
+      "title": "Total lines (namespace onelab, matches line filter)",
+      "type": "stat"
+    },
+    {
+      "datasource": {"type": "loki", "uid": "loki"},
+      "fieldConfig": {
+        "defaults": {
+          "color": {"mode": "thresholds"},
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {"color": "green", "value": null},
+              {"color": "orange", "value": 1}
+            ]
+          },
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "gridPos": {"h": 5, "w": 8, "x": 8, "y": 0},
+      "id": 2,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "none",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "reduceOptions": {"calcs": ["lastNotNull"], "fields": "", "values": false},
+        "textMode": "auto"
+      },
+      "targets": [
+        {
+          "datasource": {"type": "loki", "uid": "loki"},
+          "editorMode": "code",
+          "expr": "sum(count_over_time({namespace=\"onelab\", component=~\"$component\"} |~ \"$filter\" |~ \"(?i)(\\\\[ERROR\\\\]|\\\\berror\\\\b|\\\\sERROR\\\\s)\" [$__range]))",
+          "queryType": "instant",
+          "refId": "A"
+        }
+      ],
+      "title": "~ Error-like lines (heuristic)",
+      "type": "stat"
+    },
+    {
+      "datasource": {"type": "loki", "uid": "loki"},
+      "fieldConfig": {
+        "defaults": {
+          "color": {"mode": "thresholds"},
+          "mappings": [],
+          "thresholds": {
+            "mode": "absolute",
+            "steps": [
+              {"color": "green", "value": null},
+              {"color": "yellow", "value": 1}
+            ]
+          },
+          "unit": "short"
+        },
+        "overrides": []
+      },
+      "gridPos": {"h": 5, "w": 8, "x": 16, "y": 0},
+      "id": 3,
+      "options": {
+        "colorMode": "value",
+        "graphMode": "none",
+        "justifyMode": "auto",
+        "orientation": "auto",
+        "reduceOptions": {"calcs": ["lastNotNull"], "fields": "", "values": false},
+        "textMode": "auto"
+      },
+      "targets": [
+        {
+          "datasource": {"type": "loki", "uid": "loki"},
+          "editorMode": "code",
+          "expr": "sum(count_over_time({namespace=\"onelab\", component=~\"$component\"} |~ \"$filter\" |~ \"(?i)(\\\\[WARN\\\\]|\\\\bwarn(ing)?\\\\b|\\\\sWARN\\\\s)\" [$__range]))",
+          "queryType": "instant",
+          "refId": "A"
+        }
+      ],
+      "title": "~ Warning-like lines (heuristic)",
+      "type": "stat"
+    },
+    {
+      "datasource": {"type": "loki", "uid": "loki"},
+      "gridPos": {"h": 16, "w": 24, "x": 0, "y": 5},
+      "id": 4,
+      "options": {
+        "dedupStrategy": "none",
+        "enableLogDetails": true,
+        "prettifyLogMessage": false,
+        "showCommonLabels": false,
+        "showLabels": true,
+        "showTime": true,
+        "sortOrder": "Descending",
+        "wrapLogMessage": true
+      },
+      "targets": [
+        {
+          "datasource": {"type": "loki", "uid": "loki"},
+          "editorMode": "code",
+          "expr": "{namespace=\"onelab\", component=~\"$component\"} |~ \"$filter\"",
+          "queryType": "range",
+          "refId": "A"
+        }
+      ],
+      "title": "OneLab logs — use Component + Line filter (regex)",
+      "type": "logs"
+    }
+  ],
+  "refresh": "30s",
+  "schemaVersion": 39,
+  "tags": ["onelab", "loki"],
+  "templating": {
+    "list": [
+      {
+        "allValue": ".*",
+        "current": {"selected": true, "text": "All", "value": "$__all"},
+        "datasource": {"type": "loki", "uid": "loki"},
+        "definition": "label_values({namespace=\"onelab\"}, component)",
+        "hide": 0,
+        "includeAll": true,
+        "label": "Component",
+        "multi": true,
+        "name": "component",
+        "options": [],
+        "query": "label_values({namespace=\"onelab\"}, component)",
+        "refresh": 2,
+        "regex": "",
+        "sort": 1,
+        "type": "query"
+      },
+      {
+        "current": {"selected": true, "text": ".*", "value": ".*"},
+        "hide": 0,
+        "label": "Line filter (regex)",
+        "name": "filter",
+        "options": [
+          {"selected": true, "text": ".*", "value": ".*"}
+        ],
+        "query": ".*",
+        "type": "textbox"
+      }
+    ]
+  },
+  "time": {"from": "now-1h", "to": "now"},
+  "timepicker": {},
+  "timezone": "browser",
+  "title": "OneLab logs",
+  "uid": "onelab-logs",
+  "version": 1,
+  "weekStart": ""
+}
--- a/gitops/observability/templates/configmap-dashboard-onelab-logs.yaml
+++ b/gitops/observability/templates/configmap-dashboard-onelab-logs.yaml
@@ -0,0 +1,14 @@
+{{- if .Values.grafana.sidecar.dashboards.enabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ printf "%s-dashboard-onelab-logs" .Release.Name | trunc 63 | trimSuffix "-" }}
+  namespace: {{ .Release.Namespace }}
+  labels:
+    grafana_dashboard: "1"
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+data:
+  onelab-logs.json: |-
+{{ .Files.Get "dashboards/onelab-logs.json" | nindent 4 }}
+{{- end }}
--- a/gitops/observability/templates/ingress-grafana-onelab.yaml
+++ b/gitops/observability/templates/ingress-grafana-onelab.yaml
@@ -0,0 +1,36 @@
+{{- if .Values.grafanaOnelabIngress.enabled }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: grafana-onelab
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app.kubernetes.io/name: grafana-onelab
+    app.kubernetes.io/instance: {{ .Release.Name }}
+    app.kubernetes.io/component: observability
+  annotations:
+    argocd.argoproj.io/sync-wave: "0"
+    cert-manager.io/cluster-issuer: {{ .Values.grafanaOnelabIngress.clusterIssuer | quote }}
+    {{- with .Values.grafanaOnelabIngress.annotations }}
+    {{- toYaml . | nindent 4 }}
+    {{- end }}
+spec:
+  ingressClassName: {{ .Values.grafanaOnelabIngress.className | quote }}
+  {{- if .Values.grafanaOnelabIngress.tls }}
+  tls:
+    - hosts:
+        - {{ .Values.grafanaOnelabIngress.host | quote }}
+      secretName: {{ .Values.grafanaOnelabIngress.tlsSecretName | quote }}
+  {{- end }}
+  rules:
+    - host: {{ .Values.grafanaOnelabIngress.host | quote }}
+      http:
+        paths:
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: {{ printf "%s-grafana" .Release.Name }}
+                port:
+                  number: {{ .Values.grafanaOnelabIngress.servicePort }}
+{{- end }}
--- a/gitops/observability/values.yaml
+++ b/gitops/observability/values.yaml
@@ -0,0 +1,3 @@
+# Operator-facing overrides live in gitops/values/observability.yaml (see gitops/argocd/application.yaml helm.valueFiles).
+# This file is kept minimal on purpose.
+{}
--- a/gitops/values/README.md
+++ b/gitops/values/README.md
@@ -0,0 +1,31 @@
+# GitOps values (operator entry point)
+
+All environment-specific Helm input for the Argo CD `Application` should live here (plus `repoURL` / `targetRevision` in [`../argocd/application.yaml`](../argocd/application.yaml)).
+
+## Files
+
+| File | Purpose |
+|------|---------|
+| [`env-example.yaml`](env-example.yaml) | Tracked example for OneLab chart: ingress, persistence, registry pull secret wiring, **placeholder** secrets. Fork and edit hostnames/TLS names, then replace placeholders or overlay `secrets.local.yaml`. |
+| [`observability.yaml`](observability.yaml) | Loki / Promtail / Grafana: retention, Promtail host paths, Grafana ingress host, **placeholder** admin password. Edit hosts/TLS together with `grafana.ini.server`. |
+| [`secrets.example.yaml`](secrets.example.yaml) | Template of secret-shaped keys only — copy to `*.local.yaml` (gitignored) and reference from Argo. |
+| [`instance-overrides.example.yaml`](instance-overrides.example.yaml) | Optional features (compliance, LDAP) — merge or add as another value file. |
+
+## Argo `helm.valueFiles` (path rules)
+
+Paths are **relative to each source’s `path`** in the Application:
+
+- Source `gitops/charts/onelab` → e.g. `../../values/env-example.yaml`, then optionally `../../values/secrets.local.yaml`.
+- Source `gitops/observability` → e.g. `../../values/observability.yaml`, then optionally `../../values/observability.local.yaml`.
+
+Later files in the list **override** earlier ones.
+
+## Private secrets without committing them
+
+1. Copy `secrets.example.yaml` to `secrets.local.yaml` (ignored by `*.local.yaml` at repo root).
+2. Fill in real registry password, Postgres password, app tokens, Intercom, etc.
+3. Add `- ../../values/secrets.local.yaml` under the onelab source’s `helm.valueFiles` in your **local** Application manifest or a private overlay — or keep that change only on a private branch.
+
+For Grafana, set `grafana.adminPassword` in a gitignored file merged with [`observability.yaml`](observability.yaml), or edit `observability.yaml` in a private fork.
+
+See the full bootstrap narrative in [`../README.md`](../README.md).
--- a/gitops/values/env-example.yaml
+++ b/gitops/values/env-example.yaml
@@ -0,0 +1,48 @@
+# Example environment overrides — copy patterns to a gitignored file (e.g. secrets.local.yaml)
+# and add it to Argo helm.valueFiles after this file so secrets stay out of Git.
+# See gitops/values/README.md and gitops/values/secrets.example.yaml.
+
+registry:
+  createPullSecret: true
+  pullSecretName: hub-andrewalliance
+  server: hub.andrewalliance.com
+  username: public
+  password: "REPLACE_REGISTRY_PASSWORD"
+
+imagePullSecrets:
+  - name: hub-andrewalliance
+
+persistence:
+  mode: hostPath
+  hostPath:
+    data: /opt/onelab/data
+    logs: /opt/onelab/logs
+
+postgresql:
+  auth:
+    password: "REPLACE_POSTGRES_PASSWORD"
+
+onelab:
+  domain: "https://onelab.example.com"
+  secrets:
+    authTokenKey: "REPLACE_AUTH_TOKEN_KEY"
+    monitoringToken: "REPLACE_MONITORING_TOKEN"
+    rabbitToken: "REPLACE_RABBIT_TOKEN"
+  intercom:
+    appid: "REPLACE_INTERCOM_APP_ID"
+    secret: "REPLACE_INTERCOM_SECRET"
+
+revproxy:
+  serviceType: ClusterIP
+
+ingress:
+  enabled: true
+  className: traefik
+  host: onelab.example.com
+  path: /
+  pathType: Prefix
+  tls: true
+  tlsSecretName: onelab-tls
+  certManager:
+    clusterIssuer: letsencrypt-prod
+  annotations: {}
--- a/gitops/values/instance-overrides.example.yaml
+++ b/gitops/values/instance-overrides.example.yaml
@@ -0,0 +1,38 @@
+# Copy to a private file (e.g. gitops/values/overrides.local.yaml, gitignored) or merge into gitops/values/env-example.yaml.
+#
+# Argo CD: under spec.sources, for the source with path gitops/charts/onelab, add another path to helm.valueFiles
+# (paths are relative to that chart directory), e.g.:
+#   - ../../values/env-example.yaml
+#   - ../../values/secrets.local.yaml
+#   - ../../values/overrides.local.yaml
+
+onelab:
+  compliance:
+    enabled: true
+    # Optional tweaks (defaults match chart values.yaml):
+    # requireElectronicSignature: true
+    # executionOperatorRestrictionPolicy: "reviewed"
+    # executionAdminExpertRestrictionPolicy: "reviewed"
+    # preventCsvImport: true
+    # preventManualMetadataEdit: true
+    # deviceRestart: true
+
+  ldap:
+    enabled: true
+    # timeout: 30
+    # encryption: "start_tls"
+    # policy: "your-policy"
+    # verifyCertificates: true
+    # Paths inside the ldap-worker container (mount certs via extraVolumes if needed):
+    # tlsCaPath: "/ldap/ca.crt"
+    # tlsCertPath: "/ldap/client.crt"
+    # tlsKeyPath: "/ldap/client.key"
+    # tlsCiphers: ""
+    # tlsSslVersion: ""
+
+# Alternative: supply the full YAML yourself (bypasses chart templates in configurations.gotmpl for those keys).
+# 1. kubectl create secret generic onelab-configurations-custom -n onelab \
+#      --from-file=configurations.yml=./my-configurations.yml
+# 2. Set in values:
+# configuration:
+#   existingSecretName: onelab-configurations-custom
--- a/gitops/values/observability.yaml
+++ b/gitops/values/observability.yaml
@@ -0,0 +1,144 @@
+# Umbrella chart: Loki (SingleBinary + filesystem) + Promtail + Grafana.
+# Keep promtail hostPath below in sync with persistence.hostPath.logs in gitops/values/env-example.yaml.
+
+loki:
+  deploymentMode: SingleBinary
+  loki:
+    auth_enabled: false
+    commonConfig:
+      replication_factor: 1
+    storage:
+      type: filesystem
+    schemaConfig:
+      configs:
+        - from: "2024-04-01"
+          store: tsdb
+          object_store: filesystem
+          schema: v13
+          index:
+            prefix: loki_index_
+            period: 24h
+    limits_config:
+      retention_period: 168h
+      ingestion_rate_mb: 16
+      ingestion_burst_size_mb: 32
+  singleBinary:
+    replicas: 1
+    persistence:
+      enabled: true
+      size: 10Gi
+  backend:
+    replicas: 0
+  read:
+    replicas: 0
+  write:
+    replicas: 0
+  ingester:
+    replicas: 0
+  querier:
+    replicas: 0
+  queryFrontend:
+    replicas: 0
+  queryScheduler:
+    replicas: 0
+  distributor:
+    replicas: 0
+  compactor:
+    replicas: 0
+  indexGateway:
+    replicas: 0
+  bloomCompactor:
+    replicas: 0
+  bloomGateway:
+    replicas: 0
+  ruler:
+    replicas: 0
+  minio:
+    enabled: false
+  lokiCanary:
+    enabled: false
+  test:
+    enabled: false
+  chunksCache:
+    enabled: false
+  resultsCache:
+    enabled: false
+
+promtail:
+  config:
+    clients:
+      - url: http://{{ .Release.Name }}-loki-gateway.{{ .Release.Namespace }}.svc.cluster.local/loki/api/v1/push
+    snippets:
+      extraRelabelConfigs:
+        - action: keep
+          source_labels:
+            - __meta_kubernetes_namespace
+          regex: onelab
+      extraScrapeConfigs: |
+        - job_name: onelab-host-log-files
+          static_configs:
+            - targets:
+                - localhost
+              labels:
+                job: onelab-files
+                namespace: onelab
+                component: host-logs
+                __path__: /onelab-host-logs/**/*
+  extraVolumes:
+    - name: onelab-host-logs
+      hostPath:
+        path: /opt/onelab/logs
+        type: DirectoryOrCreate
+  extraVolumeMounts:
+    - name: onelab-host-logs
+      mountPath: /onelab-host-logs
+      readOnly: true
+
+grafanaOnelabIngress:
+  enabled: true
+  className: traefik
+  host: grafana.onelab.example.com
+  tls: true
+  tlsSecretName: grafana-onelab-tls
+  clusterIssuer: letsencrypt-prod
+  servicePort: 80
+  annotations: {}
+
+grafana:
+  adminUser: admin
+  adminPassword: "REPLACE_GRAFANA_ADMIN_PASSWORD"
+  initChownData:
+    enabled: false
+  sidecar:
+    dashboards:
+      enabled: true
+      label: grafana_dashboard
+      folder: /tmp/dashboards
+      provider:
+        foldersFromFilesStructure: false
+        allowUiUpdates: true
+    datasources:
+      enabled: false
+  persistence:
+    enabled: true
+    size: 2Gi
+  service:
+    type: ClusterIP
+  grafana.ini:
+    server:
+      domain: grafana.onelab.example.com
+      root_url: https://grafana.onelab.example.com/
+  ingress:
+    enabled: false
+  datasources:
+    datasources.yaml:
+      apiVersion: 1
+      datasources:
+        - name: Loki
+          type: loki
+          uid: loki
+          url: http://{{ .Release.Name }}-loki-gateway.{{ .Release.Namespace }}.svc.cluster.local
+          access: proxy
+          isDefault: true
+          jsonData:
+            maxLines: 1000
--- a/gitops/values/secrets.example.yaml
+++ b/gitops/values/secrets.example.yaml
@@ -0,0 +1,26 @@
+# Copy to a gitignored file (e.g. gitops/values/secrets.local.yaml — match *.local.yaml in repo .gitignore).
+# Add it as the LAST entry in spec.sources[].helm.valueFiles for the onelab chart so these values win.
+#
+# Do not commit real values.
+
+registry:
+  username: public
+  password: "YOUR_REGISTRY_PASSWORD"
+
+postgresql:
+  auth:
+    password: "YOUR_POSTGRES_PASSWORD"
+
+onelab:
+  secrets:
+    authTokenKey: "YOUR_AUTH_TOKEN_KEY"
+    monitoringToken: "YOUR_MONITORING_TOKEN"
+    rabbitToken: "YOUR_RABBIT_TOKEN"
+  intercom:
+    appid: "YOUR_INTERCOM_APP_ID"
+    secret: "YOUR_INTERCOM_SECRET"
+
+# Optional: Grafana admin password is normally set in gitops/values/observability.yaml;
+# override there or add a second gitignored value file for the observability source.
+# grafana:
+#   adminPassword: "YOUR_GRAFANA_PASSWORD"
				`@@ -0,0 +1 @@`
				`[rabbitmq_auth_backend_http, rabbitmq_auth_backend_cache, rabbitmq_management, rabbitmq_event_exchange].`