bucket-sync
A Kubernetes controller that automates periodic synchronization between object storage buckets using scheduled or on-demand rclone-based sync jobs. It manages the complete lifecycle of each sync operation — distributed locking to prevent concurrent runs, Kubernetes Job creation and monitoring, and resource cleanup — allowing bucket syncs to be managed declaratively alongside other cluster infrastructure.
dynamic-dns
Periodically detects your public IP address and updates Cloudflare DNS A records to keep them in sync with your dynamic IP. Designed to run in a restricted Kubernetes pod security context — no root access, no filesystem writes, minimal capabilities — making it a safe drop-in replacement for traditional dynamic DNS tools like ddclient.
home-assistant
A Docker image extending the official Home Assistant container with the Frigate NVR integration pre-installed, providing smart home automation with built-in camera and object detection capabilities in a single image. Configured through Home Assistant's native YAML files and UI; no additional runtime environment variables are required beyond those supported by the upstream Home Assistant image.
linstor-provision-disk
An init container for LINSTOR satellite pods that automatically detects when a satellite's ID has changed and reinitializes the storage layer accordingly — cleaning up stale LVM physical volumes, volume groups, and logical volumes before provisioning fresh storage. This makes cluster resets on satellite nodes fully hands-off.
lvm2
A minimal Docker image providing the lvm2 suite of tools (pvcreate, vgcreate, lvcreate, lvextend, etc.), built from source at a pinned version. Used as a dependency image for linstor-provision-disk; not intended to be run standalone.
mdns-reflector
A Docker image that runs Avahi configured as a bidirectional mDNS reflector, enabling service discovery across network segments that would otherwise be isolated. On startup, the container scans /sys/class/net and automatically selects interfaces to participate in reflection — any interface backed by real hardware (indicated by the presence of a /sys/class/net//device symlink). Additional interfaces can be included via the EXTRA_INTERFACES environment variable (comma-separated interface names), which is useful for bridge interfaces such as one that connects to a VLAN carrying mDNS traffic. The detected interface list is logged at startup and written into Avahi's configuration before the daemon is started; no other configuration is required.
music-assistant
A Docker image extending the official Music Assistant server with a patch that allows the stream endpoint's base URL to be overridden via an environment variable. This is useful when Music Assistant is running behind a reverse proxy or in a network where the auto-detected publish IP would produce an unreachable stream URL for players — for example, when the server is only accessible to players via a hostname rather than a bare IP address.
pvc-restore
A Kubernetes controller that automates PVC restoration from volsync backups. Annotate a PVC with a snapshot selector and the controller handles everything: scaling down workloads that use the PVC, syncing backup data via a temporary ReplicationDestination, scaling workloads back up, and cleaning up temporary resources.
toolbox
A minimal Docker image based on debian:trixie-slim that bundles a small set of commonly needed tools. Intended as a lightweight debug or init container where you need basic network and archive utilities without pulling in a full general-purpose base image.
vault-push-secrets
Periodically exports Vault secrets, roles, and policies to a Bitwarden Secrets Manager secret. Its purpose is enabling rapid cluster recovery: a single Bitwarden secret contains everything needed to restore Vault to its previous state.
vault-unseal
A sidecar container that automatically unseals Vault whenever its pod starts, eliminating the need for manual vault unseal commands after pod restarts, node maintenance, or cluster failures. It polls until Vault is reachable, checks the seal status, and unseals using a key file provisioned by an init container, Kubernetes Secret, or persistent volume.