72 changed files with 355 additions and 834 deletions
--- a/.gitignore
+++ b/.gitignore
@ -1 +0,0 @@
-/.history
--- a/template/edfbuilder.yaml
+++ b/template/edfbuilder.yaml
@ -13,7 +13,7 @@ spec:
    namespace: argocd
  source:
    path: registry
-    repoURL: 'https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder'
+    repoURL: 'https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder'
    targetRevision: HEAD
  project: default
  syncPolicy:
--- a/template/registry/core.yaml
+++ b/template/registry/core.yaml
@ -13,7 +13,7 @@ spec:
    namespace: argocd
  source:
    path: stacks/core
-    repoURL: 'https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder'
+    repoURL: 'https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder'
    targetRevision: HEAD
  project: default
  syncPolicy:
--- a/template/registry/local-backup.yaml
+++ b/template/registry/local-backup.yaml
@ -13,7 +13,7 @@ spec:
    namespace: argocd
  source:
    path: stacks/local-backup
-    repoURL: 'https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder'
+    repoURL: 'https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder'
    targetRevision: HEAD
  project: default
  syncPolicy:
--- a/template/registry/monitoring.yaml
+++ b/template/registry/monitoring.yaml
@ -13,7 +13,7 @@ spec:
    namespace: argocd
  source:
    path: stacks/monitoring
-    repoURL: 'https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder'
+    repoURL: 'https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder'
    targetRevision: HEAD
  project: default
  syncPolicy:
--- a/template/registry/ref-implementation.yaml
+++ b/template/registry/ref-implementation.yaml
@ -13,7 +13,7 @@ spec:
    namespace: argocd
  source:
    path: stacks/ref-implementation
-    repoURL: 'https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder'
+    repoURL: 'https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder'
    targetRevision: HEAD
  project: default
  syncPolicy:
--- a/template/registry/second-cluster.yaml
+++ b/template/registry/second-cluster.yaml
@ -13,7 +13,7 @@ spec:
    namespace: argocd
  source:
    path: stacks/second-cluster
-    repoURL: 'https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder'
+    repoURL: 'https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder'
    targetRevision: HEAD
  project: default
  syncPolicy:
--- a/template/stacks/core/argocd-sso.yaml
+++ b/template/stacks/core/argocd-sso.yaml
@ -1,29 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: argocd-sso
-  namespace: argocd
-  labels:
-    env: dev
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-  source:
-    repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
-    targetRevision: HEAD
-    path: "stacks/core/argocd-sso"
-  destination:
-    server: "https://kubernetes.default.svc"
-    namespace: argocd
-  syncPolicy:
-    syncOptions:
-      - CreateNamespace=true
-    automated:
-      selfHeal: true
-    retry:
-      limit: -1
-      backoff:
-        duration: 15s
-        factor: 1
-        maxDuration: 15s
--- a/template/stacks/core/argocd-sso/argocd-secret.yaml
+++ b/template/stacks/core/argocd-sso/argocd-secret.yaml
@ -1,24 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: auth-generic-oauth-secret
-  namespace: argocd 
-spec:
-  secretStoreRef:
-    name: keycloak
-    kind: ClusterSecretStore
-  refreshInterval: "0"
-  target:
-    name: auth-generic-oauth-secret
-    template:
-      engineVersion: v2
-      data:
-        client_secret: "{{.ARGOCD_CLIENT_SECRET}}"
-      metadata:
-        labels:
-          app.kubernetes.io/part-of: argocd
-  data:
-    - secretKey: ARGOCD_CLIENT_SECRET
-      remoteRef:
-        key: keycloak-clients
-        property: ARGOCD_CLIENT_SECRET
--- a/template/stacks/core/argocd.yaml
+++ b/template/stacks/core/argocd.yaml
@ -16,15 +16,12 @@ spec:
    name: in-cluster
    namespace: argocd
  sources:
-    - repoURL: https://forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/DevFW-CICD/argocd-helm.git
+    - repoURL: https://github.com/argoproj/argo-helm
      path: charts/argo-cd
-      # TODO: RIRE Can be updated when https://github.com/argoproj/argo-cd/issues/20790 is fixed and merged
-      # As logout make problems, it is suggested to switch from path based routing to an own argocd domain,
-      # similar to the CNOE amazon reference implementation and in our case, Forgejo
-      targetRevision: argo-cd-7.8.14-depends
+      targetRevision: argo-cd-7.7.5
      helm:
        valueFiles:
          - $values/stacks/core/argocd/values.yaml
-    - repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    - repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
      targetRevision: HEAD
      ref: values
--- a/template/stacks/core/argocd/values.yaml
+++ b/template/stacks/core/argocd/values.yaml
@ -5,7 +5,6 @@ configs:
  params:
    server.insecure: true
    server.basehref: /argocd
-    server.rootpath: /argocd
  cm:
    application.resourceTrackingMethod: annotation
    timeout.reconciliation: 60s
@ -21,7 +20,6 @@ configs:
        clusters:
        - "*"
    accounts.provider-argocd: apiKey
-    url: https://{{{ .Env.DOMAIN }}}/argocd
  rbac:
    policy.csv: 'g, provider-argocd, role:admin'

--- a/template/stacks/core/crossplane-compositions.yaml
+++ b/template/stacks/core/crossplane-compositions.yaml
@ -1,12 +1,10 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: forgejo-runner
+  name: crossplane-compositions
  namespace: argocd
  labels:
    env: dev
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
 spec:
  project: default
  syncPolicy:
@ -15,8 +13,11 @@ spec:
    syncOptions:
      - CreateNamespace=true
  destination:
-    server: "https://kubernetes.default.svc"
+    name: in-cluster
+    namespace: crossplane-system
  source:
-    repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    path: stacks/core/crossplane-compositions
+    repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
    targetRevision: HEAD
-    path: "stacks/core/forgejo-runner"
+    directory:
+      recurse: true
--- a/template/stacks/core/crossplane-compositions/edfbuilder/definition.yaml
+++ b/template/stacks/core/crossplane-compositions/edfbuilder/definition.yaml
@ -0,0 +1,30 @@
+apiVersion: apiextensions.crossplane.io/v1
+kind: CompositeResourceDefinition
+metadata:
+  name: edfbuilders.edfbuilder.crossplane.io
+spec:
+  connectionSecretKeys:
+    - kubeconfig
+  group: edfbuilder.crossplane.io
+  names:
+    kind: EDFBuilder
+    listKind: EDFBuilderList
+    plural: edfbuilders
+    singular: edfbuilders
+  versions:
+    - name: v1alpha1
+      served: true
+      referenceable: true
+      schema:
+        openAPIV3Schema:
+          description: A EDFBuilder is a composite resource that represents a K8S Cluster with edfbuilder Installed
+          type: object
+          properties:
+            spec:
+              type: object
+              properties:
+                repoURL:
+                  type: string
+                  description: URL to ArgoCD stack of stacks repo
+              required:
+                - repoURL
--- a/template/stacks/ref-implementation/mailhog.yaml
+++ b/template/stacks/ref-implementation/mailhog.yaml
@ -1,25 +1,23 @@
+{{{ if eq .Env.CLUSTER_TYPE "kind" }}}
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: mailhog
+  name: crossplane-providers
  namespace: argocd
  labels:
    env: dev
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
 spec:
  project: default
-  source:
-    repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
-    targetRevision: HEAD
-    path: "stacks/ref-implementation/mailhog"
-  destination:
-    server: "https://kubernetes.default.svc"
-    namespace: mailhog
  syncPolicy:
-    syncOptions:
-      - CreateNamespace=true
    automated:
      selfHeal: true
-    retry:
-      limit: -1
+    syncOptions:
+      - CreateNamespace=true
+  destination:
+    name: in-cluster
+    namespace: crossplane-system
+  source:
+    path: stacks/core/crossplane-providers
+    repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
+    targetRevision: HEAD
+{{{ end }}}
--- a/template/stacks/core/crossplane-providers/function-patch-and-transform.yaml
+++ b/template/stacks/core/crossplane-providers/function-patch-and-transform.yaml
@ -0,0 +1,9 @@
+apiVersion: pkg.crossplane.io/v1
+kind: Function
+metadata:
+  name: crossplane-contrib-function-patch-and-transform
+spec:
+  package: xpkg.upbound.io/crossplane-contrib/function-patch-and-transform:v0.7.0
+  packagePullPolicy: IfNotPresent # Only download the package if it isn’t in the cache.
+  revisionActivationPolicy: Automatic # Otherwise our Provider never gets activate & healthy
+  revisionHistoryLimit: 1
--- a/template/stacks/core/crossplane-providers/provider-argocd-config.yaml
+++ b/template/stacks/core/crossplane-providers/provider-argocd-config.yaml
@ -0,0 +1,14 @@
+apiVersion: argocd.crossplane.io/v1alpha1
+kind: ProviderConfig
+metadata:
+  name: argocd-provider
+spec:
+  serverAddr: argocd-server.argocd.svc.cluster.local:80
+  insecure: true
+  plainText: true
+  credentials:
+    source: Secret
+    secretRef:
+      namespace: crossplane-system
+      name: argocd-credentials
+      key: authToken
--- a/template/stacks/core/crossplane-providers/provider-argocd.yaml
+++ b/template/stacks/core/crossplane-providers/provider-argocd.yaml
@ -0,0 +1,9 @@
+apiVersion: pkg.crossplane.io/v1
+kind: Provider
+metadata:
+  name: provider-argocd
+spec:
+  package: xpkg.upbound.io/crossplane-contrib/provider-argocd:v0.9.1
+  packagePullPolicy: IfNotPresent # Only download the package if it isn’t in the cache.
+  revisionActivationPolicy: Automatic # Otherwise our Provider never gets activate & healthy
+  revisionHistoryLimit: 1
--- a/template/stacks/core/crossplane-providers/provider-kind-config.yaml
+++ b/template/stacks/core/crossplane-providers/provider-kind-config.yaml
@ -0,0 +1,14 @@
+apiVersion: kind.crossplane.io/v1alpha1
+kind: ProviderConfig
+metadata:
+  name: kind-provider
+spec:
+  credentials:
+    source: Secret
+    secretRef:
+      namespace: crossplane-system
+      name: kind-credentials
+      key: credentials
+  endpoint:
+    # the url is managed by crossplane-edfbuilder
+    url: https://DOCKER_HOST:SERVER_PORT/api/v1/kindserver
--- a/template/stacks/core/crossplane-providers/provider-kind.yaml
+++ b/template/stacks/core/crossplane-providers/provider-kind.yaml
@ -0,0 +1,9 @@
+apiVersion: pkg.crossplane.io/v1
+kind: Provider
+metadata:
+  name: provider-kind
+spec:
+  package: forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/devfw-cicd/provider-kind:v0.1.0
+  packagePullPolicy: IfNotPresent # Only download the package if it isn’t in the cache.
+  revisionActivationPolicy: Automatic # Otherwise our Provider never gets activate & healthy
+  revisionHistoryLimit: 1
--- a/template/stacks/core/crossplane-providers/provider-shell.yaml
+++ b/template/stacks/core/crossplane-providers/provider-shell.yaml
@ -0,0 +1,9 @@
+apiVersion: pkg.crossplane.io/v1
+kind: Provider
+metadata:
+  name: provider-shell
+spec:
+  package: forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/devfw-cicd/provider-shell:v0.1.1
+  packagePullPolicy: IfNotPresent # Only download the package if it isn’t in the cache.
+  revisionActivationPolicy: Automatic # Otherwise our Provider never gets activate & healthy
+  revisionHistoryLimit: 1
--- a/template/stacks/core/crossplane.yaml
+++ b/template/stacks/core/crossplane.yaml
@ -0,0 +1,23 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: crossplane
+  namespace: argocd
+  labels:
+    env: dev
+spec:
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+  destination:
+    name: in-cluster
+    namespace: crossplane-system
+  source:
+    chart: crossplane
+    repoURL: https://charts.crossplane.io/stable
+    targetRevision: 1.18.0
+    helm:
+      releaseName: crossplane
--- a/template/stacks/core/forgejo-runner/dind-docker.yaml
+++ b/template/stacks/core/forgejo-runner/dind-docker.yaml
@ -1,104 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  labels:
-    app: forgejo-runner
-  name: forgejo-runner
-  namespace: gitea
-spec:
-  # Two replicas means that if one is busy, the other can pick up jobs.
-  replicas: 1
-  selector:
-    matchLabels:
-      app: forgejo-runner
-  strategy: {}
-  template:
-    metadata:
-      creationTimestamp: null
-      labels:
-        app: forgejo-runner
-    spec:
-      restartPolicy: Always
-      volumes:
-      - name: docker-certs
-        emptyDir: {}
-      - name: runner-data
-        emptyDir: {}
-      # Initialise our configuration file using offline registration
-      # https://forgejo.org/docs/v1.21/admin/actions/#offline-registration
-      initContainers:
-        - name: runner-register
-          image: code.forgejo.org/forgejo/runner:6.3.1
-          command:
-          - "sh"
-          - "-c"
-          - |
-            forgejo-runner \
-              register \
-              --no-interactive \
-              --token ${RUNNER_SECRET} \
-              --name ${RUNNER_NAME} \
-              --instance ${FORGEJO_INSTANCE_URL} \
-              --labels docker:docker://node:20-bookworm,ubuntu-22.04:docker://forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/devfw-cicd/catthehackerubuntu:act-22.04,ubuntu-latest:docker://forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/devfw-cicd/catthehackerubuntu:act-22.04
-          env:
-            - name: RUNNER_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-            - name: RUNNER_SECRET
-              valueFrom:
-                secretKeyRef:
-                  name: forgejo-runner-token
-                  key: token
-            - name: FORGEJO_INSTANCE_URL
-              value: https://{{{ .Env.DOMAIN_GITEA }}}
-          volumeMounts:
-            - name: runner-data
-              mountPath: /data
-      containers:
-      - name: runner
-        image: code.forgejo.org/forgejo/runner:6.3.1
-        command: 
-          - "sh"
-          - "-c"
-          - |
-            while ! nc -z 127.0.0.1 2376 </dev/null; do
-              echo 'waiting for docker daemon...';
-              sleep 5;
-            done
-            forgejo-runner generate-config > config.yml ;
-            sed -i -e "s|privileged: .*|privileged: true|" config.yml
-            sed -i -e "s|network: .*|network: host|" config.yml ;
-            sed -i -e "s|^  envs:$$|  envs:\n    DOCKER_HOST: tcp://127.0.0.1:2376\n    DOCKER_TLS_VERIFY: 1\n    DOCKER_CERT_PATH: /certs/client|" config.yml ;
-            sed -i -e "s|^  options:|  options: -v /certs/client:/certs/client|" config.yml ;
-            sed -i -e "s|  valid_volumes: \[\]$$|  valid_volumes:\n    - /certs/client|" config.yml ;
-            /bin/forgejo-runner --config config.yml daemon
-        securityContext:
-          allowPrivilegeEscalation: true
-          privileged: true
-          readOnlyRootFilesystem: false
-          runAsGroup: 0
-          runAsNonRoot: false
-          runAsUser: 0
-        env:
-        - name: DOCKER_HOST
-          value: tcp://localhost:2376
-        - name: DOCKER_CERT_PATH
-          value: /certs/client
-        - name: DOCKER_TLS_VERIFY
-          value: "1"
-        volumeMounts:
-        - name: docker-certs
-          mountPath: /certs
-        - name: runner-data
-          mountPath: /data
-      - name: daemon
-        image: docker:28.0.4-dind
-        env:
-        - name: DOCKER_TLS_CERTDIR
-          value: /certs
-        securityContext:
-          privileged: true
-        volumeMounts:
-        - name: docker-certs
-          mountPath: /certs
--- a/template/stacks/core/forgejo-sso.yaml
+++ b/template/stacks/core/forgejo-sso.yaml
@ -1,29 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: forgejo-sso
-  namespace: argocd
-  labels:
-    env: dev
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-  source:
-    repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
-    targetRevision: HEAD
-    path: "stacks/core/forgejo-sso"
-  destination:
-    server: "https://kubernetes.default.svc"
-    namespace: gitea
-  syncPolicy:
-    syncOptions:
-      - CreateNamespace=true
-    automated:
-      selfHeal: true
-    retry:
-      limit: -1
-      backoff:
-        duration: 15s
-        factor: 1
-        maxDuration: 15s
--- a/template/stacks/core/forgejo-sso/secret-forgejo.yaml
+++ b/template/stacks/core/forgejo-sso/secret-forgejo.yaml
@ -1,26 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: auth-generic-oauth-secret
-  namespace: gitea 
-spec:
-  secretStoreRef:
-    name: keycloak
-    kind: ClusterSecretStore
-  refreshInterval: "0"
-  target:
-    name: auth-generic-oauth-secret
-    template:
-      engineVersion: v2
-      data:
-        key: "{{.FORGEJO_CLIENT_ID}}"
-        secret: "{{.FORGEJO_CLIENT_SECRET}}"
-  data:
-    - secretKey: FORGEJO_CLIENT_ID
-      remoteRef:
-        key: keycloak-clients
-        property: FORGEJO_CLIENT_ID
-    - secretKey: FORGEJO_CLIENT_SECRET
-      remoteRef:
-        key: keycloak-clients
-        property: FORGEJO_CLIENT_SECRET
--- a/template/stacks/core/forgejo.yaml
+++ b/template/stacks/core/forgejo.yaml
@ -16,12 +16,12 @@ spec:
    name: in-cluster
    namespace: gitea
  sources:
-    - repoURL: https://forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/DevFW-CICD/forgejo-helm.git
+    - repoURL: https://code.forgejo.org/forgejo-helm/forgejo-helm.git
      path: .
-      targetRevision: v11.0.5-depends
+      targetRevision: v10.1.1
      helm:
        valueFiles:
          - $values/stacks/core/forgejo/values.yaml
-    - repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    - repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
      targetRevision: HEAD
      ref: values
--- a/template/stacks/core/forgejo/values.yaml
+++ b/template/stacks/core/forgejo/values.yaml
@ -1,5 +1,5 @@
 redis-cluster:
-  enabled: true
+  enabled: false
 postgresql:
  enabled: false
 postgresql-ha:
@ -16,11 +16,6 @@ gitea:
  admin:
    existingSecret: gitea-credential
  config:
-    service:
-      DISABLE_REGISTRATION: true
-    other:
-      SHOW_FOOTER_VERSION: false
-      SHOW_FOOTER_TEMPLATE_LOAD_TIME: false
    database:
      DB_TYPE: sqlite3
    session:
@ -30,14 +25,8 @@ gitea:
    queue:
      TYPE: level
    server:
-      DOMAIN: '{{{ .Env.DOMAIN_GITEA }}}'
-      ROOT_URL: 'https://{{{ .Env.DOMAIN_GITEA }}}:443'
-    mailer:
-      ENABLED: true
-      FROM: forgejo@{{{ .Env.DOMAIN_GITEA }}}
-      PROTOCOL: smtp
-      SMTP_ADDR: mailhog.mailhog.svc.cluster.local
-      SMTP_PORT: 1025
+      DOMAIN: 'gitea.{{{ .Env.DOMAIN }}}'
+      ROOT_URL: 'https://gitea.{{{ .Env.DOMAIN }}}:443'

 service:
  ssh:
@ -64,4 +53,3 @@ forgejo:
          - docker:docker://node:16-bullseye
          - self-hosted:docker://ghcr.io/catthehacker/ubuntu:act-22.04
          - ubuntu-22.04:docker://ghcr.io/catthehacker/ubuntu:act-22.04
-          - ubuntu-latest:docker://ghcr.io/catthehacker/ubuntu:act-22.04
--- a/template/stacks/core/ingress-apps.yaml
+++ b/template/stacks/core/ingress-apps.yaml
@ -11,7 +11,7 @@ spec:
  destination:
    server: "https://kubernetes.default.svc"
  source:
-    repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
    targetRevision: HEAD
    path: "stacks/core/ingress-apps"
  project: default
--- a/template/stacks/core/ingress-apps/alloy.yaml
+++ b/template/stacks/core/ingress-apps/alloy.yaml
@ -1,18 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: alloy
-  namespace: monitoring
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: {{{ .Env.DOMAIN }}}
-    http:
-      paths:
-      - backend:
-          service:
-            name: alloy
-            port:
-              number: 12345
-        path: /alloy
-        pathType: Prefix
--- a/template/stacks/core/ingress-apps/argocd-server.yaml
+++ b/template/stacks/core/ingress-apps/argocd-server.yaml
@ -4,6 +4,8 @@ metadata:
  annotations:
    nginx.ingress.kubernetes.io/backend-protocol: HTTP
    nginx.ingress.kubernetes.io/force-ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/rewrite-target: /$2
+    nginx.ingress.kubernetes.io/use-regex: "true"
 {{{ if eq .Env.CLUSTER_TYPE "osc" }}}
    dns.gardener.cloud/class: garden
    dns.gardener.cloud/dnsnames: {{{ .Env.DOMAIN }}}
@ -22,8 +24,8 @@ spec:
            name: argocd-server
            port:
              number: 80
-        path: /argocd
-        pathType: Prefix
+        path: /argocd(/|$)(.*)
+        pathType: ImplementationSpecific
  tls:
  - hosts:
    - {{{ .Env.DOMAIN }}}
--- a/template/stacks/core/ingress-apps/forgejo.yaml
+++ b/template/stacks/core/ingress-apps/forgejo.yaml
@ -6,7 +6,7 @@ metadata:
    nginx.ingress.kubernetes.io/proxy-body-size: 512m
 {{{ if eq .Env.CLUSTER_TYPE "osc" }}}
    dns.gardener.cloud/class: garden
-    dns.gardener.cloud/dnsnames: {{{ .Env.DOMAIN_GITEA }}}
+    dns.gardener.cloud/dnsnames: gitea.{{{ .Env.DOMAIN }}}
    dns.gardener.cloud/ttl: "600"
 {{{ end }}}
  name: forgejo
@ -14,7 +14,7 @@ metadata:
 spec:
  ingressClassName: nginx
  rules:
-  - host: {{{ .Env.DOMAIN_GITEA }}}
+  - host: gitea.{{{ .Env.DOMAIN }}}
    http:
      paths:
      - backend:
@ -26,5 +26,5 @@ spec:
        pathType: Prefix
  tls:
  - hosts:
-    - {{{ .Env.DOMAIN_GITEA }}}
+    - gitea.{{{ .Env.DOMAIN }}}
    secretName: forgejo-net-tls
--- a/template/stacks/core/ingress-apps/mailhog.yaml
+++ b/template/stacks/core/ingress-apps/mailhog.yaml
@ -1,18 +0,0 @@
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: mailhog
-  namespace: mailhog
-spec:
-  ingressClassName: nginx
-  rules:
-  - host: {{{ .Env.DOMAIN }}}
-    http:
-      paths:
-      - backend:
-          service:
-            name: mailhog
-            port:
-              number: 8025
-        path: /mailhog
-        pathType: Prefix
--- a/template/stacks/core/ingress-nginx.yaml
+++ b/template/stacks/core/ingress-nginx.yaml
@ -16,12 +16,12 @@ spec:
    name: in-cluster
    namespace: ingress-nginx
  sources:
-    - repoURL: https://forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/DevFW-CICD/ingress-nginx-helm.git
+    - repoURL: https://github.com/kubernetes/ingress-nginx
      path: charts/ingress-nginx
-      targetRevision: helm-chart-4.12.1-depends
+      targetRevision: helm-chart-4.11.3
      helm:
        valueFiles:
          - $values/stacks/core/ingress-nginx/values.yaml
-    - repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    - repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
      targetRevision: HEAD
      ref: values
--- a/template/stacks/local-backup/minio.yaml
+++ b/template/stacks/local-backup/minio.yaml
@ -17,10 +17,10 @@ spec:
        valueFiles:
          - $values/stacks/local-backup/minio/helm/values.yaml
      chart: minio
-    - repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    - repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
      targetRevision: HEAD
      ref: values
-    - repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    - repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
      targetRevision: HEAD
      path: "stacks/local-backup/minio/manifests"
  destination:
--- a/template/stacks/local-backup/velero.yaml
+++ b/template/stacks/local-backup/velero.yaml
@ -17,7 +17,7 @@ spec:
        valueFiles:
          - $values/stacks/local-backup/velero/helm/values.yaml
      chart: velero
-    - repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    - repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
      targetRevision: HEAD
      ref: values
  destination:
--- a/template/stacks/monitoring/alloy/values.yaml
+++ b/template/stacks/monitoring/alloy/values.yaml
@ -1,78 +0,0 @@
-alloy:
-  create: false
-  name: alloy-config
-  key: config.alloy
-
-  uiPathPrefix: "/alloy"
-
-  configMap:
-    content: |-
-
-      logging {
-        level  = "info"
-        format = "logfmt"
-      }
-
-      loki.write "local_loki" {
-          endpoint {
-              url = "http://loki-loki-distributed-gateway/loki/api/v1/push"
-          }
-      }
-
-      discovery.kubernetes "pod" {
-        role = "pod"
-      }
-
-      discovery.kubernetes "nodes" {
-        role = "node"
-      }
-
-      discovery.kubernetes "services" {
-        role = "service"
-      }
-
-      discovery.kubernetes "endpoints" {
-        role = "endpoints"
-      }
-
-      discovery.kubernetes "endpointslices" {
-        role = "endpointslice"
-      }
-
-      discovery.kubernetes "ingresses" {
-        role = "ingress"
-      }
-
-      discovery.relabel "pod_logs" {
-        targets = discovery.kubernetes.pod.targets
-
-        rule {
-          source_labels = ["__meta_kubernetes_namespace"]
-          action        = "replace"
-          target_label  = "namespace"
-        }
-
-        rule {
-          source_labels = ["__meta_kubernetes_pod_name"]
-          action        = "replace"
-          target_label  = "pod"
-        }
-
-        rule {
-          source_labels = ["__meta_kubernetes_pod_node_name"]
-          action        = "replace"
-          target_label  = "node"
-        }
-
-        rule {
-          source_labels = ["__meta_kubernetes_pod_container_name"]
-          action        = "replace"
-          target_label  = "container"
-        }
-
-      }
-
-      loki.source.kubernetes "all_pod_logs" {
-        targets    = discovery.relabel.pod_logs.output
-        forward_to = [loki.write.local_loki.receiver]
-      }
--- a/template/stacks/monitoring/grafana-dashboards.yaml
+++ b/template/stacks/monitoring/grafana-dashboards.yaml
@ -10,7 +10,7 @@ metadata:
 spec:
  project: default
  source:
-    repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
    targetRevision: HEAD
    path: "stacks/monitoring/kube-prometheus/dashboards"
  destination:
--- a/template/stacks/monitoring/kube-prometheus-sso.yaml
+++ b/template/stacks/monitoring/kube-prometheus-sso.yaml
@ -1,29 +0,0 @@
-apiVersion: argoproj.io/v1alpha1
-kind: Application
-metadata:
-  name: kube-prometheus-sso
-  namespace: argocd
-  labels:
-    env: dev
-  finalizers:
-    - resources-finalizer.argocd.argoproj.io
-spec:
-  project: default
-  source:
-    repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
-    targetRevision: HEAD
-    path: "stacks/monitoring/kube-prometheus-sso"
-  destination:
-    server: "https://kubernetes.default.svc"
-    namespace: monitoring
-  syncPolicy:
-    syncOptions:
-      - CreateNamespace=true
-    automated:
-      selfHeal: true
-    retry:
-      limit: -1
-      backoff:
-        duration: 15s
-        factor: 1
-        maxDuration: 15s
--- a/template/stacks/monitoring/kube-prometheus-sso/secret-grafana.yaml
+++ b/template/stacks/monitoring/kube-prometheus-sso/secret-grafana.yaml
@ -1,21 +0,0 @@
-apiVersion: external-secrets.io/v1beta1
-kind: ExternalSecret
-metadata:
-  name: auth-generic-oauth-secret
-  namespace: monitoring
-spec:
-  secretStoreRef:
-    name: keycloak
-    kind: ClusterSecretStore
-  refreshInterval: "0"
-  target:
-    name: auth-generic-oauth-secret
-    template:
-      engineVersion: v2
-      data:
-        client_secret: "{{.GRAFANA_CLIENT_SECRET}}"
-  data:
-    - secretKey: GRAFANA_CLIENT_SECRET
-      remoteRef:
-        key: keycloak-clients
-        property: GRAFANA_CLIENT_SECRET
--- a/template/stacks/monitoring/kube-prometheus.yaml
+++ b/template/stacks/monitoring/kube-prometheus.yaml
@ -15,12 +15,6 @@ spec:
    syncOptions:
      - CreateNamespace=true
      - ServerSideApply=true  # do not copy metdata, since (because of its large size) it can lead to sync failure
-    retry:
-      limit: -1
-      backoff:
-        duration: 15s
-        factor: 1
-        maxDuration: 15s
  destination:
    name: in-cluster
    namespace: monitoring
@ -31,6 +25,6 @@ spec:
      helm:
        valueFiles:
          - $values/stacks/monitoring/kube-prometheus/values.yaml
-    - repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    - repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
      targetRevision: HEAD
      ref: values
--- a/template/stacks/monitoring/kube-prometheus/dashboards/dashboard_loki_container.yaml
+++ b/template/stacks/monitoring/kube-prometheus/dashboards/dashboard_loki_container.yaml
@ -110,12 +110,12 @@ data:
                            "uid": "P8E80F9AEF21F6940"
                        },
                        "editorMode": "builder",
-                        "expr": "{container=\"alloy\"} |= ``",
+                        "expr": "{container=\"promtail\"} |= ``",
                        "queryType": "range",
                        "refId": "A"
                    }
                ],
-                "title": "Logs: Container alloy",
+                "title": "Logs: Container promtail",
                "type": "logs"
            },
            {
--- a/template/stacks/monitoring/kube-prometheus/values.yaml
+++ b/template/stacks/monitoring/kube-prometheus/values.yaml
@ -33,33 +33,7 @@ grafana:
      domain: {{{ .Env.DOMAIN }}}
      root_url: "%(protocol)s://%(domain)s/grafana"
      serve_from_sub_path: true
-    auth:
-      disable_login: true
-      disable_login_form: true
-    auth.generic_oauth:
-      enabled: true
-      name: Keycloak-OAuth
-      allow_sign_up: true
-      use_refresh_token: true
-      client_id: grafana
-      client_secret: $__file{/etc/secrets/auth_generic_oauth/client_secret}
-      scopes: openid email profile offline_access roles
-      email_attribute_path: email
-      login_attribute_path: username
-      name_attribute_path: full_name
-      auth_url: https://{{{ .Env.DOMAIN }}}/keycloak/realms/cnoe/protocol/openid-connect/auth
-      token_url: https://{{{ .Env.DOMAIN }}}/keycloak/realms/cnoe/protocol/openid-connect/token
-      api_url: https://{{{ .Env.DOMAIN }}}/keycloak/realms/cnoe/protocol/openid-connect/userinfo
-      redirect_uri: http://{{{ .Env.DOMAIN }}}/grafana/login/generic_oauth
-      role_attribute_path: "contains(groups[*], 'admin') && 'Admin' || contains(groups[*], 'editor') && 'Editor' || 'Viewer'"
      
-  extraSecretMounts:
-    - name: auth-generic-oauth-secret-mount
-      secretName: auth-generic-oauth-secret
-      defaultMode: 0440
-      mountPath: /etc/secrets/auth_generic_oauth
-      readOnly: true
-
  serviceMonitor:
    # If true, a ServiceMonitor CRD is created for a prometheus operator https://github.com/coreos/prometheus-operator
    enabled: true
--- a/template/stacks/monitoring/loki.yaml
+++ b/template/stacks/monitoring/loki.yaml
@ -24,7 +24,7 @@ spec:
      helm:
        valueFiles:
          - $values/stacks/monitoring/loki/values.yaml
-    - repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    - repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
      targetRevision: HEAD
      ref: values

--- a/template/stacks/monitoring/promtail.yaml
+++ b/template/stacks/monitoring/promtail.yaml
@ -1,7 +1,7 @@
 apiVersion: argoproj.io/v1alpha1
 kind: Application
 metadata:
-  name: alloy
+  name: promtail
  namespace: argocd
  labels:
    env: dev
@ -18,12 +18,12 @@ spec:
    name: in-cluster
    namespace: monitoring
  sources:
-    - repoURL: https://github.com/grafana/alloy.git
-      path: operations/helm/charts/alloy   
+    - repoURL: https://github.com/grafana/helm-charts
+      path:     charts/promtail   
      targetRevision: HEAD      
      helm:
        valueFiles:
-          - $values/stacks/monitoring/alloy/values.yaml
-    - repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+          - $values/stacks/monitoring/promtail/values.yaml
+    - repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
      targetRevision: HEAD
      ref: values
--- a/template/stacks/monitoring/promtail/values.yaml
+++ b/template/stacks/monitoring/promtail/values.yaml
@ -0,0 +1,45 @@
+# -- Overrides the chart's name
+nameOverride: null
+
+# -- Overrides the chart's computed fullname
+fullnameOverride: null
+
+global:
+  # -- Allow parent charts to override registry hostname
+  imageRegistry: ""
+  # -- Allow parent charts to override registry credentials
+  imagePullSecrets: []
+
+daemonset:
+  # -- Deploys Promtail as a DaemonSet
+  enabled: true
+  autoscaling:
+    # -- Creates a VerticalPodAutoscaler for the daemonset
+    enabled: false
+
+deployment:
+  # -- Deploys Promtail as a Deployment
+  enabled: false    
+
+config:
+  enabled: true
+  logLevel: info
+  logFormat: logfmt
+  serverPort: 3101
+  clients:
+    - url: http://loki-loki-distributed-gateway/loki/api/v1/push
+  scrape_configs:
+  - job_name: authlog
+    static_configs:
+    - targets:
+        - authlog
+      labels:
+        job: authlog
+        __path__: /logs/auth.log
+  - job_name: syslog
+    static_configs:
+    - targets:
+        - syslog
+      labels:
+        job: syslog
+        __path__: /logs/syslog    
--- a/template/stacks/ref-implementation/argo-workflows.yaml
+++ b/template/stacks/ref-implementation/argo-workflows.yaml
@ -10,7 +10,7 @@ metadata:
 spec:
  project: default
  source:
-    repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
    targetRevision: HEAD
    path: "stacks/ref-implementation/argo-workflows/manifests/dev"
  destination:
@ -23,7 +23,3 @@ spec:
      selfHeal: true
    retry:
      limit: -1
-      backoff:
-        duration: 15s
-        factor: 1
-        maxDuration: 15s
--- a/template/stacks/ref-implementation/backstage-templates.yaml
+++ b/template/stacks/ref-implementation/backstage-templates.yaml
@ -10,7 +10,7 @@ metadata:
 spec:
  project: default
  source:
-    repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
    targetRevision: HEAD
    path: "stacks/ref-implementation/backstage-templates/entities"
    directory:
--- a/template/stacks/ref-implementation/backstage-templates/entities/app-with-bucket/skeleton/catalog-info.yaml
+++ b/template/stacks/ref-implementation/backstage-templates/entities/app-with-bucket/skeleton/catalog-info.yaml
@ -20,7 +20,7 @@ metadata:
    backstage.io/kubernetes-namespace: default
    argocd/app-name: ${{values.name | dump}}
  links:
-    - url: https://{{{ .Env.DOMAIN_GITEA }}}:443
+    - url: https://gitea.{{{ .Env.DOMAIN }}}:443
      title: Repo URL
      icon: github
 spec:
--- a/template/stacks/ref-implementation/backstage-templates/entities/app-with-bucket/template.yaml
+++ b/template/stacks/ref-implementation/backstage-templates/entities/app-with-bucket/template.yaml
@ -100,7 +100,7 @@ spec:
      input:
        description: This is an example app
        # Hard coded value for this demo purposes only.
-        repoUrl: {{{ .Env.DOMAIN_GITEA }}}:443/?repo=${{parameters.name}}
+        repoUrl: gitea.{{{ .Env.DOMAIN }}}:443/?repo=${{parameters.name}}
        defaultBranch: main
    - id: create-argocd-app
      name: Create ArgoCD App
@ -111,7 +111,7 @@ spec:
        argoInstance: in-cluster
        projectName: default
        # necessary until we generate our own cert
-        repoUrl: https://{{{ .Env.DOMAIN_GITEA }}}:443/giteaAdmin/${{parameters.name}}
+        repoUrl: https://gitea.{{{ .Env.DOMAIN }}}:443/giteaAdmin/${{parameters.name}}
        path: "kustomize/base"
    - id: register
      name: Register
--- a/template/stacks/ref-implementation/backstage-templates/entities/argo-workflows/skeleton/catalog-info.yaml
+++ b/template/stacks/ref-implementation/backstage-templates/entities/argo-workflows/skeleton/catalog-info.yaml
@ -14,7 +14,7 @@ metadata:
    apache-spark.cnoe.io/label-selector: env=dev,entity-id=${{values.name}}
    apache-spark.cnoe.io/cluster-name: local
  links:
-    - url: https://{{{ .Env.DOMAIN_GITEA }}}:443
+    - url: https://gitea.{{{ .Env.DOMAIN }}}:443
      title: Repo URL
      icon: github
 spec:
--- a/template/stacks/ref-implementation/backstage-templates/entities/argo-workflows/template.yaml
+++ b/template/stacks/ref-implementation/backstage-templates/entities/argo-workflows/template.yaml
@ -35,7 +35,7 @@ spec:
      input:
        description: This is an example app
        # Hard coded value for this demo purposes only.
-        repoUrl: {{{ .Env.DOMAIN_GITEA }}}:443/?repo=${{parameters.name}}
+        repoUrl: gitea.{{{ .Env.DOMAIN }}}:443/?repo=${{parameters.name}}
        defaultBranch: main
    - id: create-argocd-app
      name: Create ArgoCD App
@ -46,7 +46,7 @@ spec:
        argoInstance: in-cluster
        projectName: default
        # necessary until we generate our own cert
-        repoUrl: https://{{{ .Env.DOMAIN_GITEA }}}:443/giteaAdmin/${{parameters.name}}
+        repoUrl: https://gitea.{{{ .Env.DOMAIN }}}:443/giteaAdmin/${{parameters.name}}
        path: "manifests"
    - id: register
      name: Register
--- a/template/stacks/ref-implementation/backstage-templates/entities/basic/skeleton/catalog-info.yaml
+++ b/template/stacks/ref-implementation/backstage-templates/entities/basic/skeleton/catalog-info.yaml
@ -10,7 +10,7 @@ metadata:
    backstage.io/kubernetes-namespace: default
    argocd/app-name: ${{values.name | dump}}
  links:
-    - url: https://{{{ .Env.DOMAIN_GITEA }}}:443
+    - url: https://gitea.{{{ .Env.DOMAIN }}}:443
      title: Repo URL
      icon: github
 spec:
--- a/template/stacks/ref-implementation/backstage-templates/entities/basic/template.yaml
+++ b/template/stacks/ref-implementation/backstage-templates/entities/basic/template.yaml
@ -31,7 +31,7 @@ spec:
      input:
        description: This is an example app
        # Hard coded value for this demo purposes only.
-        repoUrl: {{{ .Env.DOMAIN_GITEA }}}:443/?repo=${{parameters.name}}
+        repoUrl: gitea.{{{ .Env.DOMAIN }}}:443/?repo=${{parameters.name}}
        defaultBranch: main
    - id: create-argocd-app
      name: Create ArgoCD App
@ -42,7 +42,7 @@ spec:
        argoInstance: in-cluster
        projectName: default
        # necessary until we generate our own cert
-        repoUrl: https://{{{ .Env.DOMAIN_GITEA }}}:443/giteaAdmin/${{parameters.name}}
+        repoUrl: https://gitea.{{{ .Env.DOMAIN }}}:443/giteaAdmin/${{parameters.name}}
        path: "manifests"
    - id: register
      name: Register
--- a/template/stacks/ref-implementation/backstage-templates/entities/demo-go-hello-world/skeleton/catalog-info.yaml
+++ b/template/stacks/ref-implementation/backstage-templates/entities/demo-go-hello-world/skeleton/catalog-info.yaml
@ -9,7 +9,7 @@ metadata:
    backstage.io/kubernetes-label-selector: 'entity-id=${{ values.name }}'
    backstage.io/kubernetes-namespace: gitea
  links:
-    - url: https://{{{ .Env.DOMAIN_GITEA }}}:443
+    - url: https://gitea.{{{ .Env.DOMAIN }}}:443
      title: Repo URL
      icon: git
 spec:
@ -26,7 +26,7 @@ metadata:
  annotations:
    backstage.io/techdocs-ref: dir:.
  links:
-    - url: https://{{{ .Env.DOMAIN_GITEA }}}:443
+    - url: https://gitea.{{{ .Env.DOMAIN }}}:443
      title: Gitea Repo
      icon: git
 spec:
--- a/template/stacks/ref-implementation/backstage-templates/entities/demo-go-hello-world/template.yaml
+++ b/template/stacks/ref-implementation/backstage-templates/entities/demo-go-hello-world/template.yaml
@ -33,7 +33,7 @@ spec:
      name: Publish to Gitea
      action: publish:gitea
      input:
-        repoUrl: {{{ .Env.DOMAIN_GITEA }}}:443/?repo=${{parameters.name}}
+        repoUrl: gitea.{{{ .Env.DOMAIN }}}:443/?repo=${{parameters.name}}
        description: This is the repository for ${{ parameters.name }}
        sourcePath: ./skeleton
        defaultBranch: main
--- a/template/stacks/ref-implementation/backstage-templates/entities/spring-petclinic/skeleton/.github/workflows/gradle-build.yml
+++ b/template/stacks/ref-implementation/backstage-templates/entities/spring-petclinic/skeleton/.github/workflows/gradle-build.yml
@ -0,0 +1,32 @@
+# This workflow will build a Java project with Gradle, and cache/restore any dependencies to improve the workflow execution time
+# For more information see: https://docs.github.com/en/actions/use-cases-and-examples/building-and-testing/building-and-testing-java-with-gradle
+
+name: Java CI with Gradle
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    branches: [ main ]
+
+jobs:
+  build:
+
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        java: [ '17' ]
+
+    steps:
+      - uses: actions/checkout@v4
+      - name: Set up JDK {% raw %}${{matrix.java}}{% endraw %}
+        uses: https://github.com/actions/setup-java@v4
+        with:
+          java-version: '{% raw %}${{matrix.java}}{% endraw %}'
+          distribution: 'adopt'
+          cache: maven
+      - name: Setup Gradle
+        uses: https://github.com/gradle/actions/setup-gradle@v4
+      - name: Build with Gradle
+        run: ./gradlew build
+
--- a/template/stacks/ref-implementation/backstage-templates/entities/spring-petclinic/skeleton/.github/workflows/maven-build.yml
+++ b/template/stacks/ref-implementation/backstage-templates/entities/spring-petclinic/skeleton/.github/workflows/maven-build.yml
@ -28,12 +28,12 @@ jobs:
          distribution: 'adopt'
          cache: maven
      - name: Build with Maven Wrapper
-        run: ./mvnw -B -DskipTests verify
+        run: ./mvnw -B verify
      - name: Build image
        #run: ./mvnw spring-boot:build-image # the original image build
        run: |
          export CONTAINER_REPO=$(echo {% raw %}${{ env.GITHUB_REPOSITORY }}{% endraw %} | tr '[:upper:]' '[:lower:]')
-          ./mvnw com.google.cloud.tools:jib-maven-plugin:3.4.4:build -Djib.allowInsecureRegistries=true -Dimage={{{ .Env.DOMAIN_GITEA }}}/${CONTAINER_REPO}:latest -Djib.to.auth.username={% raw %}${{ secrets.PACKAGES_USER }}{% endraw %} -Djib.to.auth.password={% raw %}${{ secrets.PACKAGES_TOKEN }}{% endraw %} -Djib.from.platforms=linux/arm64,linux/amd64
+          ./mvnw com.google.cloud.tools:jib-maven-plugin:3.4.4:build -Djib.allowInsecureRegistries=true -Dimage=gitea.{{{ .Env.DOMAIN }}}/${CONTAINER_REPO}:latest -Djib.to.auth.username={% raw %}${{ github.actor }}{% endraw %} -Djib.to.auth.password={% raw %}${{ secrets.PACKAGES_TOKEN }}{% endraw %}
      - name: Build image as tar
        run: |
          ./mvnw com.google.cloud.tools:jib-maven-plugin:3.4.4:buildTar -Djib.allowInsecureRegistries=true
@ -57,11 +57,7 @@ jobs:
          NODE_TLS_REJECT_UNAUTHORIZED: 0 # This is necessary due to self signed certs for forgejo, proper setups can skip this
      - name: install trivy from deb package
        run: |
-          if [[ "$(uname -m)" == "x86_64" ]]; then
-            wget -O trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.58.0/trivy_0.58.0_Linux-64bit.deb
-          else
-            wget -O trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.58.0/trivy_0.58.0_Linux-ARM64.deb
-          fi
+          wget -O trivy.deb https://github.com/aquasecurity/trivy/releases/download/v0.58.0/trivy_0.58.0_Linux-64bit.deb
          DEBIAN_FRONTEND=noninteractive dpkg -i trivy.deb
      - name: scan the image
        run: trivy image --input jib-image.tar
--- a/template/stacks/ref-implementation/backstage-templates/entities/spring-petclinic/skeleton/catalog-info.yaml
+++ b/template/stacks/ref-implementation/backstage-templates/entities/spring-petclinic/skeleton/catalog-info.yaml
@ -9,7 +9,7 @@ metadata:
    backstage.io/kubernetes-label-selector: 'entity-id=${{ values.name }}'
    backstage.io/kubernetes-namespace: gitea
  links:
-    - url: https://{{{ .Env.DOMAIN_GITEA }}}:443
+    - url: https://gitea.{{{ .Env.DOMAIN }}}:443
      title: Repo URL
      icon: git
 spec:
@ -26,7 +26,7 @@ metadata:
  annotations:
    backstage.io/techdocs-ref: dir:.
  links:
-    - url: https://{{{ .Env.DOMAIN_GITEA }}}:443
+    - url: https://gitea.{{{ .Env.DOMAIN }}}:443
      title: Gitea Repo
      icon: git
 spec:
--- a/template/stacks/ref-implementation/backstage-templates/entities/spring-petclinic/skeleton/k8s/petclinic.yml
+++ b/template/stacks/ref-implementation/backstage-templates/entities/spring-petclinic/skeleton/k8s/petclinic.yml
@ -58,7 +58,7 @@ spec:
    spec:
      containers:
        - name: workload
-          image: {{{ .Env.DOMAIN_GITEA }}}/giteaadmin/${{ values.name }}
+          image: gitea.{{{ .Env.DOMAIN }}}/giteaadmin/${{ values.name }}
          env:
            - name: SPRING_PROFILES_ACTIVE
              value: postgres
--- a/template/stacks/ref-implementation/backstage-templates/entities/spring-petclinic/template.yaml
+++ b/template/stacks/ref-implementation/backstage-templates/entities/spring-petclinic/template.yaml
@ -50,7 +50,7 @@ spec:
      name: Publish to Gitea
      action: publish:gitea
      input:
-        repoUrl: {{{ .Env.DOMAIN_GITEA }}}:443/?repo=${{parameters.name}}
+        repoUrl: gitea.{{{ .Env.DOMAIN }}}:443/?repo=${{parameters.name}}
        description: This is the repository for ${{ parameters.name }}
        sourcePath: ./
        defaultBranch: main
@ -64,7 +64,7 @@ spec:
        argoInstance: in-cluster
        projectName: default
        # necessary until we generate our own cert
-        repoUrl: https://{{{ .Env.DOMAIN_GITEA }}}:443/giteaAdmin/${{parameters.name}}
+        repoUrl: https://gitea.{{{ .Env.DOMAIN }}}:443/giteaAdmin/${{parameters.name}}
        path: "k8s"

    - id: register
--- a/template/stacks/ref-implementation/backstage.yaml
+++ b/template/stacks/ref-implementation/backstage.yaml
@ -10,7 +10,7 @@ metadata:
 spec:
  project: default
  source:
-    repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
    targetRevision: HEAD
    path: "stacks/ref-implementation/backstage/manifests"
  destination:
@ -23,7 +23,3 @@ spec:
      selfHeal: true
    retry:
      limit: -1
-      backoff:
-        duration: 15s
-        factor: 1
-        maxDuration: 15s
--- a/template/stacks/ref-implementation/backstage/manifests/install.yaml
+++ b/template/stacks/ref-implementation/backstage/manifests/install.yaml
@ -106,12 +106,12 @@ data:

    integrations:
      gitea:
-        - baseUrl: https://{{{ .Env.DOMAIN_GITEA }}}:443
-          host: {{{ .Env.DOMAIN_GITEA }}}:443
+        - baseUrl: https://gitea.{{{ .Env.DOMAIN }}}:443
+          host: gitea.{{{ .Env.DOMAIN }}}:443
          username: ${GITEA_USERNAME}
          password: ${GITEA_PASSWORD}
-        - baseUrl: https://{{{ .Env.DOMAIN_GITEA }}}
-          host: {{{ .Env.DOMAIN_GITEA }}}
+        - baseUrl: https://gitea.{{{ .Env.DOMAIN }}}
+          host: gitea.{{{ .Env.DOMAIN }}}
          username: ${GITEA_USERNAME}
          password: ${GITEA_PASSWORD}
        - baseUrl: https://forgejo.edf-bootstrap.cx.fg1.ffm.osc.live
@ -167,7 +167,7 @@ data:
      locations:
        # Examples from a public GitHub repository.
        - type: url
-          target: https://{{{ .Env.DOMAIN_GITEA }}}:443/giteaAdmin/edfbuilder/raw/branch/main/stacks/ref-implementation/backstage-templates/entities/catalog-info.yaml
+          target: https://gitea.{{{ .Env.DOMAIN }}}:443/giteaAdmin/edfbuilder/raw/branch/main/stacks/ref-implementation/backstage-templates/entities/catalog-info.yaml
          rules:
            - allow: [Component, System, API, Resource, Location, Template, User, Group]
    kubernetes:
@ -255,8 +255,6 @@ spec:
              value: debug
            - name: NODE_TLS_REJECT_UNAUTHORIZED
              value: "0"
-            - name: NODE_OPTIONS
-              value: "--no-node-snapshot"
          envFrom:
            - secretRef:
                name: backstage-env-vars
@ -264,8 +262,7 @@ spec:
                name: gitea-credentials
            - secretRef:
                name: argocd-credentials
-          image: forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/devfw-cicd/backstage-edp:1.1.0
-          imagePullPolicy: Always
+          image: ghcr.io/cnoe-io/backstage-app:9232d633b2698fffa6d0a73b715e06640d170162
          name: backstage
          ports:
            - containerPort: 7007
@ -389,7 +386,7 @@ spec:
        KEYCLOAK_NAME_METADATA: https://{{{ .Env.DOMAIN }}}:443/keycloak/realms/cnoe/.well-known/openid-configuration
        KEYCLOAK_CLIENT_SECRET: "{{.BACKSTAGE_CLIENT_SECRET}}"
        ARGOCD_AUTH_TOKEN: "argocd.token={{.ARGOCD_SESSION_TOKEN}}"
-        ARGO_CD_URL: 'https://{{{ .Env.DOMAIN }}}/argocd/api/v1/'
+        ARGO_CD_URL: 'https://argocd-server.argocd.svc.cluster.local/api/v1/'
  data:
    - secretKey: ARGOCD_SESSION_TOKEN
      remoteRef:
--- a/template/stacks/ref-implementation/external-secrets.yaml
+++ b/template/stacks/ref-implementation/external-secrets.yaml
@ -12,7 +12,7 @@ spec:
    namespace: external-secrets
    server: "https://kubernetes.default.svc"
  source:
-    repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
    targetRevision: HEAD
    path: "stacks/ref-implementation/external-secrets/manifests"
  project: default
--- a/template/stacks/ref-implementation/fibonacci-app.yaml
+++ b/template/stacks/ref-implementation/fibonacci-app.yaml
@ -10,7 +10,7 @@ metadata:
 spec:
  project: default
  source:
-    repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
    targetRevision: HEAD
    path: "stacks/ref-implementation/fibonacci-app"
  destination:
--- a/template/stacks/ref-implementation/forgejo-runner.yaml
+++ b/template/stacks/ref-implementation/forgejo-runner.yaml
@ -0,0 +1,29 @@
+apiVersion: argoproj.io/v1alpha1
+kind: Application
+metadata:
+  name: forgejo-runner
+  namespace: argocd
+  labels:
+    env: dev
+  finalizers:
+    - resources-finalizer.argocd.argoproj.io
+spec:
+  project: default
+  syncPolicy:
+    automated:
+      selfHeal: true
+    syncOptions:
+      - CreateNamespace=true
+  destination:
+    name: in-cluster
+    namespace: gitea
+  sources:
+    - repoURL: https://forgejo.edf-bootstrap.cx.fg1.ffm.osc.live/DevFW-CICD/forgejo-runner.git
+      path: forgejo-runner
+      targetRevision: HEAD
+      helm:
+        valueFiles:
+          - $values/stacks/ref-implementation/forgejo-runner/values.yaml
+    - repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
+      targetRevision: HEAD
+      ref: values
--- a/template/stacks/ref-implementation/forgejo-runner/values.yaml
+++ b/template/stacks/ref-implementation/forgejo-runner/values.yaml
@ -0,0 +1,14 @@
+replicaCount: 1
+
+image:
+  repository: code.forgejo.org/forgejo/runner
+  pullPolicy: IfNotPresent
+  tag: "3.5.1"
+
+resources:
+  limits:
+    memory: 2Gi
+  requests:
+    memory: 1Gi
+
+forgejoUrl: http://forgejo-http.gitea.svc.cluster.local:3000
--- a/template/stacks/ref-implementation/keycloak.yaml
+++ b/template/stacks/ref-implementation/keycloak.yaml
@ -12,7 +12,7 @@ spec:
    namespace: keycloak
    server: "https://kubernetes.default.svc"
  source:
-    repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
    targetRevision: HEAD
    path: "stacks/ref-implementation/keycloak/manifests"
  project: default
--- a/template/stacks/ref-implementation/keycloak/manifests/keycloak-config.yaml
+++ b/template/stacks/ref-implementation/keycloak/manifests/keycloak-config.yaml
@ -71,11 +71,11 @@ data:
      },
      "type": "default",
      "protocol": "openid-connect"
-    }    
+    }
  group-admin-payload.json: |
-    {"name":"admin"}    
+    {"name":"admin"}
  group-base-user-payload.json: |
-    {"name":"base-user"}    
+    {"name":"base-user"}
  group-mapper-payload.json: |
    {
        "protocol": "openid-connect",
@ -88,41 +88,41 @@ data:
          "access.token.claim": "true",
          "userinfo.token.claim": "true"
        }
-    }    
+    }
  realm-payload.json: |
-    {"realm":"cnoe","enabled":true}    
+    {"realm":"cnoe","enabled":true}
  user-password.json: |
    {
        "temporary": false,
        "type": "password",
        "value": "${USER1_PASSWORD}"
-    }    
+    }
  user-user1.json: |
    {
        "username": "user1",
-        "email": "user1@user.de",
+        "email": "",
        "firstName": "user",
        "lastName": "one",
        "requiredActions": [],
-        "emailVerified": true,
+        "emailVerified": false,
        "groups": [
          "/admin"
        ],
        "enabled": true
-    }    
+    }
  user-user2.json: |
    {
        "username": "user2",
-        "email": "user2@user.de",
+        "email": "",
        "firstName": "user",
        "lastName": "two",
        "requiredActions": [],
-        "emailVerified": true,
+        "emailVerified": false,
        "groups": [
          "/base-user"
        ],
        "enabled": true
-    }    
+    }
  argo-client-payload.json: |
    {
      "protocol": "openid-connect",
@ -150,7 +150,7 @@ data:
      "webOrigins": [
        "/*"
      ]
-    }    
+    }

  backstage-client-payload.json: |
    {
@ -179,104 +179,8 @@ data:
      "webOrigins": [
        "/*"
      ]
-    }    
-
-  grafana-client-payload.json: |
-    {
-      "clientId": "grafana",
-      "name": "Grafana Client",
-      "description": "Used for Grafana SSO",
-      "rootUrl": "https://{{{ .Env.DOMAIN }}}/grafana",
-      "adminUrl": "https://{{{ .Env.DOMAIN }}}/grafana",
-      "baseUrl": "https://{{{ .Env.DOMAIN }}}/grafana",
-      "alwaysDisplayInConsole": false,
-      "redirectUris": [
-        "http://{{{ .Env.DOMAIN }}}/grafana/*"
-      ],
-      "webOrigins": [
-        "https://{{{ .Env.DOMAIN }}}/grafana"
-      ],
-      "standardFlowEnabled": true,
-      "implicitFlowEnabled": false,
-      "directAccessGrantsEnabled": true,
-      "serviceAccountsEnabled": false,
-      "publicClient": false,
-      "frontchannelLogout": true,
-      "protocol": "openid-connect",
-      "attributes": {
-        "saml_idp_initiated_sso_url_name": "",
-        "oidc.ciba.grant.enabled": "false",
-        "oauth2.device.authorization.grant.enabled": "false"
-      },
-      "defaultClientScopes": [
-        "web-origins",
-        "acr",
-        "offline_access",
-        "roles",
-        "profile",
-        "groups",
-        "email"
-      ]
    }

-  argocd-client-payload.json: |
-    {
-      "protocol": "openid-connect",
-      "clientId": "argocd",
-      "name": "ArgoCD Client",
-      "description": "Used for ArgoCD SSO",
-      "publicClient": false,
-      "authorizationServicesEnabled": false,
-      "serviceAccountsEnabled": false,
-      "implicitFlowEnabled": false,
-      "directAccessGrantsEnabled": true,
-      "standardFlowEnabled": true,
-      "frontchannelLogout": true,
-      "attributes": {
-        "saml_idp_initiated_sso_url_name": "",
-        "oauth2.device.authorization.grant.enabled": false,
-        "oidc.ciba.grant.enabled": false
-      },
-      "alwaysDisplayInConsole": false,
-      "rootUrl": "",
-      "baseUrl": "",
-      "redirectUris": [
-        "https://{{{ .Env.DOMAIN }}}/*"
-      ],
-      "webOrigins": [
-        "/*"
-      ]
-    }      
-
-  forgejo-client-payload.json: |
-    {
-      "protocol": "openid-connect",
-      "clientId": "forgejo",
-      "name": "Forgejo Client",
-      "description": "Used for Forgejo SSO",
-      "publicClient": false,
-      "authorizationServicesEnabled": false,
-      "serviceAccountsEnabled": false,
-      "implicitFlowEnabled": false,
-      "directAccessGrantsEnabled": true,
-      "standardFlowEnabled": true,
-      "frontchannelLogout": true,
-      "attributes": {
-        "saml_idp_initiated_sso_url_name": "",
-        "oauth2.device.authorization.grant.enabled": false,
-        "oidc.ciba.grant.enabled": false
-      },
-      "alwaysDisplayInConsole": false,
-      "rootUrl": "",
-      "baseUrl": "",
-      "redirectUris": [
-        "https://{{{ .Env.DOMAIN_GITEA }}}/*"
-      ],
-      "webOrigins": [
-        "/*"
-      ]
-    }      
-
 ---
 apiVersion: batch/v1
 kind: Job
@ -312,7 +216,7 @@ spec:
          command: ["/bin/bash", "-c"]
          args:
            - |
-              #! /bin/bash              
+              #! /bin/bash
  
              set -ex -o pipefail
              
@ -343,11 +247,7 @@ spec:
              fi
              set -e
              
-              if [[ "$(uname -m)" == "x86_64" ]]; then
-                curl -sS -LO "https://dl.k8s.io/release/v1.28.3//bin/linux/amd64/kubectl"
-              else
-                curl -sS -LO "https://dl.k8s.io/release/v1.28.3//bin/linux/arm64/kubectl"
-              fi
+              curl -sS -LO "https://dl.k8s.io/release/v1.28.3//bin/linux/amd64/kubectl"
              chmod +x kubectl
              
              echo "creating cnoe realm and groups"
@ -373,7 +273,7 @@ spec:
                ${KEYCLOAK_URL}/admin/realms/cnoe/groups
              
              # Create scope mapper
-              echo 'adding group claim to tokens'
+                echo 'adding group claim to tokens'
              CLIENT_SCOPE_GROUPS_ID=$(curl -sS -H "Content-Type: application/json" -H "Authorization: bearer ${KEYCLOAK_TOKEN}" -X GET  ${KEYCLOAK_URL}/admin/realms/cnoe/client-scopes | jq -e -r  '.[] | select(.name == "groups") | .id')
              
              curl -sS -H "Content-Type: application/json" \
@ -413,8 +313,8 @@ spec:
              echo "creating Argo Workflows client"
              curl -sS -H "Content-Type: application/json" \
                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
-                -X POST --data @/var/config/argo-client-payload.json \
-                ${KEYCLOAK_URL}/admin/realms/cnoe/clients
+                  -X POST --data @/var/config/argo-client-payload.json \
+                  ${KEYCLOAK_URL}/admin/realms/cnoe/clients
              
              CLIENT_ID=$(curl -sS -H "Content-Type: application/json" \
                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
@ -428,100 +328,29 @@ spec:
                -X PUT  ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID}/default-client-scopes/${CLIENT_SCOPE_GROUPS_ID}
              
              ARGO_WORKFLOWS_CLIENT_SECRET=$(curl -sS -H "Content-Type: application/json" \
-                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
-                -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID} | jq -e -r '.secret')
-
-              echo "creating Grafana client"
-              curl -sS -H "Content-Type: application/json" \
-                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
-                -X POST --data @/var/config/grafana-client-payload.json \
-                ${KEYCLOAK_URL}/admin/realms/cnoe/clients
+              -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
+              -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID} | jq -e -r '.secret')
              
-              CLIENT_ID=$(curl -sS -H "Content-Type: application/json" \
-                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
-                -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/clients | jq -e -r  '.[] | select(.clientId == "grafana") | .id')
-              
-              CLIENT_SCOPE_GROUPS_ID=$(curl -sS -H "Content-Type: application/json" \
-                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
-                -X GET  ${KEYCLOAK_URL}/admin/realms/cnoe/client-scopes | jq -e -r  '.[] | select(.name == "groups") | .id')
-              
-              curl -sS -H "Content-Type: application/json" \
-                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
-                -X PUT  ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID}/default-client-scopes/${CLIENT_SCOPE_GROUPS_ID}
-              
-              GRAFANA_CLIENT_SECRET=$(curl -sS -H "Content-Type: application/json" \
-                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
-                -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID} | jq -e -r '.secret')
-
              echo "creating Backstage client"
              curl -sS -H "Content-Type: application/json" \
                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
                -X POST --data @/var/config/backstage-client-payload.json \
-                ${KEYCLOAK_URL}/admin/realms/cnoe/clients
+                  ${KEYCLOAK_URL}/admin/realms/cnoe/clients
              
              CLIENT_ID=$(curl -sS -H "Content-Type: application/json" \
                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
                -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/clients | jq -e -r  '.[] | select(.clientId == "backstage") | .id')
              
-              CLIENT_SCOPE_GROUPS_ID=$(curl -sS -H "Content-Type: application/json" \
-                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
-                -X GET  ${KEYCLOAK_URL}/admin/realms/cnoe/client-scopes | jq -e -r  '.[] | select(.name == "groups") | .id')
-              
-              curl -sS -H "Content-Type: application/json" \
-                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
-                -X PUT  ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID}/default-client-scopes/${CLIENT_SCOPE_GROUPS_ID}
+              CLIENT_SCOPE_GROUPS_ID=$(curl -sS -H "Content-Type: application/json" -H "Authorization: bearer ${KEYCLOAK_TOKEN}" -X GET  ${KEYCLOAK_URL}/admin/realms/cnoe/client-scopes | jq -e -r  '.[] | select(.name == "groups") | .id')
+              curl -sS -H "Content-Type: application/json" -H "Authorization: bearer ${KEYCLOAK_TOKEN}" -X PUT  ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID}/default-client-scopes/${CLIENT_SCOPE_GROUPS_ID}
              
              BACKSTAGE_CLIENT_SECRET=$(curl -sS -H "Content-Type: application/json" \
                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
                -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID} | jq -e -r '.secret')
-
-              echo "creating ArgoCD client"
-              curl -sS -H "Content-Type: application/json" \
-                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
-                -X POST --data @/var/config/argocd-client-payload.json \
-                ${KEYCLOAK_URL}/admin/realms/cnoe/clients
              
-              CLIENT_ID=$(curl -sS -H "Content-Type: application/json" \
-                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
-                -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/clients | jq -e -r  '.[] | select(.clientId == "argocd") | .id')
-              
-              CLIENT_SCOPE_GROUPS_ID=$(curl -sS -H "Content-Type: application/json" \
-                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
-                -X GET  ${KEYCLOAK_URL}/admin/realms/cnoe/client-scopes | jq -e -r  '.[] | select(.name == "groups") | .id')
-              
-              curl -sS -H "Content-Type: application/json" \
-                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
-                -X PUT  ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID}/default-client-scopes/${CLIENT_SCOPE_GROUPS_ID}
-              
-              ARGOCD_CLIENT_SECRET=$(curl -sS -H "Content-Type: application/json" \
-                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
-                -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID} | jq -e -r '.secret')  
-              
-              echo "creating Forgejo client"
-              curl -sS -H "Content-Type: application/json" \
-                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
-                -X POST --data @/var/config/forgejo-client-payload.json \
-                ${KEYCLOAK_URL}/admin/realms/cnoe/clients
-              
-              CLIENT_ID=$(curl -sS -H "Content-Type: application/json" \
-                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
-                -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/clients | jq -e -r  '.[] | select(.clientId == "forgejo") | .id')
-              
-              CLIENT_SCOPE_GROUPS_ID=$(curl -sS -H "Content-Type: application/json" \
-                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
-                -X GET  ${KEYCLOAK_URL}/admin/realms/cnoe/client-scopes | jq -e -r  '.[] | select(.name == "groups") | .id')
-              
-              curl -sS -H "Content-Type: application/json" \
-                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
-                -X PUT  ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID}/default-client-scopes/${CLIENT_SCOPE_GROUPS_ID}
-              
-              FORGEJO_CLIENT_SECRET=$(curl -sS -H "Content-Type: application/json" \
-                -H "Authorization: bearer ${KEYCLOAK_TOKEN}" \
-                -X GET ${KEYCLOAK_URL}/admin/realms/cnoe/clients/${CLIENT_ID} | jq -e -r '.secret')  
-
              ARGOCD_PASSWORD=$(./kubectl -n argocd get secret argocd-initial-admin-secret -o go-template='{{.data.password | base64decode }}')
              
-              ARGOCD_SESSION_TOKEN=$(curl -sS https://{{{ .Env.DOMAIN }}}/argocd/api/v1/session -H 'Content-Type: application/json' -d "{\"username\":\"admin\",\"password\":\"${ARGOCD_PASSWORD}\"}" | jq -r .token)
+              ARGOCD_SESSION_TOKEN=$(curl -k -sS http://argocd-server.argocd.svc.cluster.local:443/api/v1/session -H 'Content-Type: application/json' -d "{\"username\":\"admin\",\"password\":\"${ARGOCD_PASSWORD}\"}" | jq -r .token)
              
              echo \
              "apiVersion: v1
@ -536,12 +365,7 @@ spec:
                ARGOCD_SESSION_TOKEN: ${ARGOCD_SESSION_TOKEN}
                BACKSTAGE_CLIENT_SECRET: ${BACKSTAGE_CLIENT_SECRET}
                BACKSTAGE_CLIENT_ID: backstage
-                GRAFANA_CLIENT_SECRET: ${GRAFANA_CLIENT_SECRET}
-                GRAFANA_CLIENT_ID: grafana
-                ARGOCD_CLIENT_SECRET: ${ARGOCD_CLIENT_SECRET}
-                ARGOCD_CLIENT_ID: argocd
-                FORGEJO_CLIENT_SECRET: ${FORGEJO_CLIENT_SECRET}
-                FORGEJO_CLIENT_ID: forgejo
              " > /tmp/secret.yaml
              
              ./kubectl apply -f /tmp/secret.yaml
+              
--- a/template/stacks/ref-implementation/mailhog/README.md
+++ b/template/stacks/ref-implementation/mailhog/README.md
@ -1,54 +0,0 @@
-# Mailhog
-
-[MailHog is an email testing tool for developers](https://github.com/mailhog/MailHog).
-
-## In cluster SMTP service
-
-Ypu can send ESMTP emails in the cluster to `mailhog.mailhog.svc.cluster.local`, standard port `1025`, as defined in the service manifest:
-
-```yaml
-apiVersion: v1
-kind: Service
-metadata:
-  name: mailhog
-spec:
-  ports:
-    - name: smtp
-      port: 1025
-```
-
-## Ingress
-
-Mailhog offers both WebUi and API at `https://{{{ .Env.DOMAIN }}}/mailhog`.
-
-The ingress definition is in `stacks/core/ingress-apps/mailhog.yaml` (BTW, why isn't this ingress file here in this folder ??) routing to the mailhog' service
-
-```yaml
-spec:
-  rules:
-  - host: {{{ .Env.DOMAIN }}}
-    http:
-      paths:
-      - backend:
-        ...
-        path: /mailhog
-```
-
-## API
-
-For usage of the API see https://github.com/mailhog/MailHog/blob/master/docs/APIv2.md
-
-## Tests
-
-```bash
-kubectl run busybox --rm -it --image=busybox -- /bin/sh
-
-# inside bsybox
-wget -O- http://mailhog.mailhog.svc.cluster.local:8025/mailhog
-
-# check smtp port
-nc -zv mailhog.mailhog.svc.cluster.local 1025
-
-# send esmtp, first install swaks
-swaks --to test@example.com --from test@example.com --server mailhog:1025 --data "Subject: Test-Mail\n\nDies ist eine Test-Mail."
-```
--- a/template/stacks/ref-implementation/mailhog/deployment.yaml
+++ b/template/stacks/ref-implementation/mailhog/deployment.yaml
@ -1,33 +0,0 @@
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: mailhog-deployment
-  namespace: mailhog
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: mailhog
-  template:
-    metadata:
-      labels:
-        app: mailhog
-    spec:
-      containers:
-      - name: mailhog
-        image: mailhog/mailhog
-        env:
-        - name: MH_UI_WEB_PATH # set this to same value as in ingress stacks/core/ingress-apps/mailhog.yaml
-          value: mailhog
-        ports:
-          - containerPort: 1025
-            name: smtp
-          - containerPort: 8025
-            name: http
-        resources:
-          requests:
-            memory: "64Mi"
-            cpu: "50m"
-          limits:
-            memory: "128Mi"
-            cpu: "100m"            
--- a/template/stacks/ref-implementation/mailhog/service.yaml
+++ b/template/stacks/ref-implementation/mailhog/service.yaml
@ -1,13 +0,0 @@
-apiVersion: v1
-kind: Service
-metadata:
-  name: mailhog
-spec:
-  selector:
-    app: mailhog
-  ports:
-    - name: smtp
-      port: 1025
-    - name: http
-      port: 8025
-  type: ClusterIP
--- a/template/stacks/ref-implementation/openbao.yaml
+++ b/template/stacks/ref-implementation/openbao.yaml
@ -24,7 +24,7 @@ spec:
      helm:
        valueFiles:
          - $values/stacks/ref-implementation/openbao/values.yaml
-    - repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    - repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
      targetRevision: HEAD
      ref: values
  ignoreDifferences:
--- a/template/stacks/second-cluster/create-new-cluster-guestbook.yaml
+++ b/template/stacks/second-cluster/create-new-cluster-guestbook.yaml
@ -19,5 +19,5 @@ spec:
    namespace: crossplane-system
  source:
    path: stacks/second-cluster/create-new-cluster-guestbook
-    repoURL: https://{{{ .Env.DOMAIN_GITEA }}}/giteaAdmin/edfbuilder
+    repoURL: https://gitea.{{{ .Env.DOMAIN }}}/giteaAdmin/edfbuilder
    targetRevision: HEAD