From fb24a6c4a3284ca6de2714008ec1cc7d01e50ce4 Mon Sep 17 00:00:00 2001
From: Eric Meehan <eric@eom.dev>
Date: Fri, 23 Oct 2026 11:16:16 -0400
Subject: [PATCH] Update

---
 defaults/main.yml   |   5 +
 tasks/.main.yml.swp | Bin 40960 -> 0 bytes
 tasks/main.yml      | 657 +++++++++-----------------------------------
 3 files changed, 133 insertions(+), 529 deletions(-)
 delete mode 100644 tasks/.main.yml.swp

diff --git a/defaults/main.yml b/defaults/main.yml
index d7a72b0..4dd5bc3 100644
--- a/defaults/main.yml
+++ b/defaults/main.yml
@@ -1,3 +1,8 @@
 #SPDX-License-Identifier: MIT-0
 ---
 # defaults file for ansible-role-ejabberd
+ejabberd_macro_admin: "admin@example.net"
+ejabberd_macro_password: "changeme"
+ejabberd_namespace: "ejabberd"
+ejabberd_pvc_size_data: 8Gi
+ejabberd_pvc_size_db: 8Gi
diff --git a/tasks/.main.yml.swp b/tasks/.main.yml.swp
deleted file mode 100644
index ccd587b6458a2156b0f89e8226062b02f760fd11..0000000000000000000000000000000000000000
GIT binary patch
literal 0
HcmV?d00001

literal 40960
zcmeI53A7wlna3N3U{ErGpaK$3v6<lT^7bW9VGK!>kkteTiyHfNSCUR%FX`_0vM2%v
z*@i`7;0&l_Tu=c)K}BUi3=AG&1d&Aya~OfaWx_UaTt)<Bez&Wt`(L-KyK0a#&TzWV
z`MrMctNXuI^?kM6@AlXA#(Iulu-KVBt2f1Kk5uaJ`Df+s*!j8C`F}qx<(6|9V~%@O
ziyPf?S805r(!S-#O^4m{+{*fDvDBR|RB~hEZdbX;4|iR9Y|JfZyQ}HS`bu{`oh!`R
zoF8xBUuS8@104?}^uR=Qb=SzWRDWM@k5L?a(1FfgZ#gcZxYMlTfsO|{9_V<W<AII`
zIv(hFpyPp#2VM^zsFtRtPGv`S_IGBb|Gty;{#X9r`}yyeTFZB_mQV3J2>RL8U%tqH
zztGZ8@&E4j-?v)J-{Aj!j{p8gYxz|FZ`XfcWvzcV-(K|Je{C)I&7HT72Ra_;c%b8f
zjt4p(=y;&xfsO|{9_V<W<AII`UY8z7XH%(elIt&;1e(wPgZ%%oH>XmMz>V-l_$-_Y
zn;{EJ;7E8Y><uY+;jdGvU%^9g16&U0!bVsCN5G-5C;VYrD)n=?3%&~H!A4jEOJNw^
z3De-k-BYPY;U2giu7ESZg)A(Gg)jm$VJ~?3O{vr~upO>}t#A^Y2=m|wco*ykQ{ag=
zrcw{UHn<qhf(@_|=0Oj<#3aIt@E`Cv{1|S9tKn?e2&-WP4u`kH%lP$4cnGcp<L3+E
z<FFA<hLd0v_JThWi(kU`;LETHPKG03KX{&rlyAX#uomXRPVfK|D7V5t!s(EM6X8gB
z7rYI2fv1?Lc@S=gufZ3f3Ll0gFboI5Ti{LbG!s8h!A<ZbxEMA;23Ephun$ayUonYv
zAKV6CgRj6PunFv!Q+uULx#Qh(C08tXf9uc2vQcN!Z|=X<RgEQeQ$&;AR7+#lU7aiB
zs=1=w!v1@-*)Zw#TkoPUnsS`=BbCuqm)F?wcA=%x@f(=^XHWd@BAQ2-dZTP9V~pIM
zLOSnyipX`=yx=WQ`){w(p+?<^oZVM_FGH>B*2qoQKJ@p%Yt6Q1i|<>rps{iF)i$?p
zwoFDkJgQyF7_+{&8*6LXw6>tpuD(?@XS7s#u4=hBazA6;8@M!O`i*RDj-yeh;+7|K
z8P{1|EIaw8117u&=H#lK8K%!xyIE^w8pJg5&alJ{Yp0^M$%(}Y8n$oJc4^y%wJTDq
z%Sk9mrkl1-t$D2F$|A)rTZfN`xMtq+7F*|w?LO?kYll+GvwA-()nYllhGX!ckABn%
zss>k;CNrxlxh?Lh?3i=PDF=z7>~5HFD^-q!pqH{+DNd9#u9zIB%USNGvn$KFs=Kt1
zaqErK85&j=7qgA#m6Drj^k$B(N-3SOx2SFpZI5>>X2<;g^KLbrO;^)Fck6S7?5MNM
z+z~5Pw@^L4I6jeg=Z>dyd0!D5YsaZn(^a;n#D3BRI{%jBts76(PFuF2zLO5GIKQ%$
zp*?Y&|C63&GyUEAOZwJqg})h2{U9~<tlnWeUM#MkD9xNvb@Qchf;HoCXGU-+n^v>d
z_02d;ysd|b<J6BV>l~=tMd`I3buz`m>fD;Po|#)~vN&DxTm9Kbnzzn89oAjJu~<98
z=Ta(Mb;}DXl?k^jOT9xhlkUoemw10JcUK1|io>g`;aRtspOtkd>pf))l_lo9Y&6dl
z^Z8=I7)Kquwb$AFrHku&$0?TAqzkz%X>;?EZYmRF>)cGW(XZKz%y^Cy%}GyG*Gdmv
zwY#KS4%;UxT)d>iTxIT@QD=2}ywbSll-+{6@hF#@D;wKC)U(z(*y$b2*89#*lxy2H
z>h$$`OK0~qmU1d{A!J$4z(`%fQCP?nv$?_=E-wq`t_ViN4zKk1nj+V|wfRwJ`HDGp
zNvWKh<k(#3Zf@*t#m$u6s^`T@W!!K3=U)&TeMO(ObKP<^w>p<$d;E3k(V1asS3X_9
zv*lU2Vs|i*4u<yr=%f90(R325qV5ClcnsZXjH!0Lm$NK-qm7$tEh9GhRc&H@)v1G>
zTA94FIydeO!Xj(wQ(awMse@N6n|DIjB1UV4ircjy%aO`%y5&)4@q%N!dQv9;znOgb
z-Q?LO{|`RjH~Ig=a2I?Fu7C?*5{`!Vz)W}>yh1+zOLzdj4_}2(!l|$Zj)p_v&F~oO
zxe6x1taBH5i1mLFHpBa1f7n4z{(U$f#-JNao_;@h_*F0g3t=C4mOT4rxClNB1F#eP
zjC|VU+*{!NFdd#Ghu#JkKn8kXS9pLN`f8YjMKFf#NT|X*H~@Z&eJd1UUwDdq`XTrx
z`~#c{MK~Ugf?2RXOo3;~r5}Mi;TE_Mw!k`A0Y}0tm;rBu-Qan0>Yu?jxB)&5=fKBc
z35>u@*c(nE$6f>PhgtC2y_~kMuG;;`&yKZauwcQG70Xtw&?VmQW_h&LT%$eJ{N=|l
zm^**PswHz4&rdZscAUxd_yny(XK1nHmRFV1mCD9qIlF3Yy0TVIRqZ6Sg-e&sU%qPD
zoE0lpE?usTyx)U_zIjQ*@|x^Wqq~UTY8xD351U%F3idYK*!<-!X}0?dYQczD8f~Jp
z<^?S_$!-|s<zTZD9uU%HRBy7_|Fy-YwJ=BNliIwSNpow<;_a|y<j;m9+ATBZ8fQ&p
zlSpH2M3l_AjV<uk(*E4^Ru^@K<|9u0=yN%r&XkL*TAaVFB+dKTs%5A1i0fy^=aILS
zj$1lz>0G#490UJ<FS)f_K*Z)p-?vQbU}za3YImQh%fj=MK`+70b^bAPjyh`o@_DNk
z&zZY?X)q$4mkQeHd+TjXXY;v2i`!<4HO-l~c)^mU)wqSpM*1JDJD0D`zy?!R-EO90
z34?V6O+t&A7^?F9Ze}^P>+mdsx2klh#B`1S)$mXs<LNPXJfydiaK{Oz*K{pr!aKUp
ze7c%hyU6Oc;*K-jQ!F>SD7&R`CL$`MPB4cO-tc;oZe=BPdnhX2n9$lodr!PMvw5tz
zxH<1l=^FRw6iDQJLTKJMTbI|Sf9tC>`Tsid>L)?-|9>a1za1`y4bTTuVFx+<jc^%^
z!9q9~UL=oy0L*9kXTZtO2fM*z<n!Nw3&DJ5{~j=((VKPN1J}UWkcByL0K7<Eza4G_
z^Lcy`7Qtb#D?CAdzYVT{EwB<y-oGb2OP>EDxC+jMG5A~9A6_7je+a$_pMpFb12bS3
zc$~ccR`?8Tg5#hM-V9HZ$KM5ChBM$Ja0KiJ|3$uTK3Bg1Om4p(j)p^FXLytx{T8?!
zCSe8iz%+Q0eEo-TC7cc)hIhk0@H@Vza6fz<zP(fE9AM@#IFptY%hge5u%~BaAiha|
ze3QQTCc)wF)LxO>(i7Xu@a*^|I*VDGZf)A>;o<mRhT@wH#y5%g?r^+!hvU6F9Pi!X
zc<&Cydv_?_yF>Bb9g6qvP`r1C;=MZ*@7<wz?+(R#cPQSwgYn)SjQ8$fymtrVy*n81
z-NAV84#s<TFy6a^@!lPb_wGQvcSE0VL|+*O;=MZ%@7;lT?+(O!cOc%o1M%J+i1+S5
zym$NKz1tsu?Dofdw?E#y{qf%IkN0kWym$NKz1tt}-Trv*_QiX*FW$R-@!su=_ikUj
zcl+YK+ZXTMzIgBU#e26e-n+f=-tCR|Zg0GId*i*^8}HrTc<=Vcd$%{<yS*{qb(&sL
zgSMWq>pV?l!>|L}Gz`13O~bG=+cXTjv`xdXW7{+gySGilu#?*~3?IlX8upHiB-%vU
zCF*Z*z`Dz{Snpt8!v6ZKF=WgBtkd7LE0L6hQglyje&&l4h3c|&b?vCrT`X0*gLJgp
zl)8+ir5K{23FZ{2Txu8_zqRagg1nh5x6v~At=?gyXee0Zy;JSsZDX)`wMWv0+jxJq
zT)8QNsqbA2d9WQ`!AvTyf47?H9(Su0cV)_(OVx<>^$w|Ns5C8~tQD0lHW45?Cjb8d
zdGF=q#wP#o_CGlO8M*$~;7s@+^urtBadQ3dg86)ZHJF<Iz2PbH{M+Gj*Z>RQKzM;X
z|30`HPKOhr7j}ck$@6c5iy#Lk_um(uC%?Z7J`bDW17Pz0o#0{e`y1d~NW*L}IsXo}
z|28oDF%IitG4>&t3NP`usl&e?{u!=?OTpCPr{NgrgLl9#@C-hA5P~}VPx8B|#Xkw=
z!r`zNyu`e~6YxX09xjDT;8Za42c|}U2&Tg{_&sw4cfu`jHGCS*fjpc5bKoG@9iCy{
z;At>*13!h^;Tv!sY=kwi91egtz{AWX+ymFaR`@97;8^H|x5G=!DLe}Q1Y2P<jKhg=
zB<v5tOOHe?{mHx8TzX?}eJ*rtbvec~tGT+W%UN3tRbW=bGk3Zg3f3m_JP4A>jOa_0
zX>2YmjTt#h?v;2&%^3y_{p#hY9>&s{^)5A-si1A+z2sf3nwE4qX34ReOVlAOD^qi{
z$!cO2TbIGL)oMxC;d!Vr)!F34^2B(kYOJt^>dp#<p_N*p+o)4mlPd%(e$6K&jT20L
zlonZKyb?aYQjZG5rlP%cp-`k0RSW2%XEqmjd*i!Jr!@<1l_C!2KiAA+GV@i}cA+=!
z(mF)5OXk%$+FIPeG)%sv-4PafY_&M5TCAG`Ds+5Xv7hw5FGFQu%G;jTJlxSyT3R5I
zE4;#gf6W>yCdq3t;=NQZnj*<r)KF53mmV*zO?$(uaQ%2_db((O_np^>Q?+(hE#mfl
zRC+v3U3S@Dv$yB|?0G4#cX!`?&Orar?5=_S+2L%#mz3!(D2FwD1)@RobWE>v@2A(k
zQp~Kc=;$<PKg=tleRZN-5OdI)`PrVHE`COCRHZr*DH<3K56Qhv%5SLZtv^^r(}2=z
zUHd#p$GFlyYKP4QDryJp;idE*)jWI&mllryYDz4c0v5F7J!#{pc3~HKokq0_N3(Ui
zL^%yRqX$i}D^crBl+n;%aMA~TnfIvvG}b}esCJ3c8P*#<NW2~+`Wp$KZLQlSjK@gA
zc#I^B$4J6>SRbRb-j9Uw7)cn9k%aL`mc0%1Tc5AA+z;y#)4E;4cnl|u$8f@U3@1E4
ztWRHB??=LTSf9hR?l0l_ku;mO?m{ir+k7W!(=gE)XL?K&V$(2Dj7`HtK{gE&McFh=
zblRDQiQ;S;COYv<!$gs$VX{l1X_z!J$u5Sb$E1<ra%l4Z^U3)hBsVnq{~|y6`*ZUD
z5_$jo;Q;s@dH&sC>if6A2f%zs{}uB5hu}K+1e^?gup2x^p8p-V5L|c<>;+Gf$KM8*
zK@r{u)8V(|>*n+RFTiG41~cGK<mW$yYvBwqxqB~6g-6N7zYP~a7TyhSfgR-C+rZTG
z7hpb^8vfsqU;hhy9yY;JcqhD!-)g=KlIG5P#{++14|sP0{n<2BGgpbESKDM$)TYOz
zSKDO69Mfact8KD@4m~Ct>6nH|?}N$4I;O{@_rYYN9n)jd`=C{F(t4PXY`|kyois8D
zhdez!Rw+vBZL|tf+B8ghAGC^7+Vq(8oUsa3+Vq(8oUw{l+Vq$-GFAag>mIE#mNpHO
zo-<ZSOPd~(o-<Z?OPd~(o-<adOPd~(jvcMCm)1R6#V>6dCLKFkg)nV;OnS~(MKNu9
zOnS~F{OGc$$10O)v+AUgu}WrI_h=Q)v}u?$GFA~yn;w%!#ww_3(__-eSj9DMdQ5sX
zvkGn6^qBN&W)<DE?$Ii}Y11(2)yyixY13oUtC>}j)27FySF?zZHzH;Zxv^VCI&D^+
zG%{AfPU{}6vYj>!lSalW;c3%j(#TllJZ*YR8X2p!r%jJZuV#s7k9ua;^8W?oE2i$;
z<p1aRxyw_0*8dZ@8qS7wuoQaW?eH9*`Tqp&g>QiQ&i`lNEGR?p-GJ%*Zl3q|3UdL!
zhV5`0Tm$@z!P;{GR`G7;3wmH**co;(M{qxwXA@ir7r+FV`hhucC`^OrnJ;)4z6W1|
zb72D<2j&@n2ZEVXc!v3dpTbRG>I%+;Jeb;o*)ScZzz*gU?t>e_e7E3q$bqRP7=(Sn
zJX_$G%rD#nH-M=*I0al-0KM>5c$s;I$Kfux4laewkcRot1$)8^%sc!W`~b`|2rhyN
z_z=v2!@$%I{Em5uhv7E(5?lZqz&z*Ad=KGJ*bSa%Uc%H1d=Jcg#kr7&<6t%%2vgu0
z<}U67^K8E>;7l;}0v~`um<~I^4vvj`;6}I{%(1c#7QsTe5Gvpuy5?u_@e<dQh_Os)
zX%dn5F_ZaJ&2*@DR_#jd!GmuCjb1QRqjp=P_gmGd-PY)3L^W!+HF_6TjoNLEUR+e8
zc3Y$OX4R<O*61ZiHEOptdS6hD+AU3JSS6Z}-PUNlRik!Wqw!Xa+HH--TQzF8H5zZ#
zsNL3Ryj7!iTchz-joNLE##=RNw>27X)u`RpXuMUUc1sf)#EB+kw>27X)u`RpXuMUU
zc3Y$IR*l+ijmBFwYPU5SZ`G*X)@Zy{qjp=P@m7u6ZH>lTHEOpt8gJF8-O_}HjG_tI
zZH>lTHEOpt8gJF8-PUNlRik!Wqw!Xa+HH--TQzF8H5zZ#sNL3Ryj7!iTchz-joNLE
z##=RNw=@h;BgY3JyRFf9%X+NJ_RyH3N8_y;wcG2_c&kS3wnpQv8nxRRjkjvlZfi8&
zs!_YG(Riyy?Y2hats1r48jZJV)E;PF_eD{`j;?mIuJ>5Ks3YDk!}ku}P5DwOvb7}p
zO-1<8-+#Bi=>ES{RM@(nF#a3uezjou>+Ir=;KGqHk564vE82|s>HrT5Ykt_OUGy0g
z)JN!p__ZkB_sl$1vsITZbQIjmW=DNN;eWQ_b`Rc{0Q~y@J;()3J-W&NT|fW-1v&oR
za6McG9|QB;fAj1=GY4Rv`Tr7m{bO(^Tnm@LCin=<gTrADFwgpb1nvOy?7vSz6+Q^>
zg_*EB{FZ!vJ8T1!^PdkTI04Kv0}g?y@ErO4gK!Ic4$gsbI2K00fnDHf^7)^@cj2?}
z30MouU;y@q6qx7v-wodaQ(JHvWML8Xz&>EUKky5<6Rw9#;A8L+I2sOzz2Oh!^N+zD
zVCoLcGX~7}20jSpIf64`4=~RXd<3?^Rd7C3;RJXu90I$;bHrsknE2cb{|Y~Xn_w%P
z3uRaVW)9#0m=4omS1@%8Pnh_^Rd5-c0j7Ro1kAGr|3r@ebGR3-1@oLiGZ!!hM?)9v
z0Z)<R-wW5k74UaZgvC&M1*e>O?|fmP^M!%V7Y59k;N7f)?~tX8sqymfV&U6EvM&sz
z8odN7@u#~&_2n|e3fXN<i(&I@wc8pU9_xD4ZfkUStQxi38XX?1M(wsnhsUZ>yRFgT
zv1-(AYjk+58nxRR9UiMj?Y2gT$Es1gr3uv_iY8>YH5zZ#sNL3Ryj7!iTchz-joNLE
z##=RNw>27X)u`RpXuMUUc3Y$IR*l+ijmBFwYPU5SZ`G*X(uAs`L=&>x8jZJV)NX4u
z-l|c%t<iX^M(wsn<E<LC+Zv6xYSeCPG~TLFyRFf9t48g%M&qp-wc8qvw`$aGX+pJF
zq6yh;jmBFwYPU5SZ`G*X)@Zy{qjp=P@m7u6ZH>lTHEOpt8gJF8-PUNlRik!Wqw!Xa
z+HH--TQzF8G@;5b(S+=_M&qp-wc8qvw`$aGYc$@fQM;|tc&kS3wnpQv8nxRRjkjvl
zZfi8&s!_YG(Riyy?Y2hats1pk8a|sf_5Wv++nr3VX!8G}pUUkZzc-)%-vpln^S}QJ
zuoBF({|^Q8Jb>Sj-*1Q8;LBj13s8j*!BOxxVCDc`Aip>N@9&3jEnEs)AOlB3FT4$2
zA;13xnE&<n4fqV4202&)!(jeDz!Wgg4}1W=3!jIxpa^Cjz<l<95WESVBgcOjZiTPF
z`C$Hkz)3I{X2PEEd-D88;SRVCE(Y^I{U*UYYv3d}2F!fGE9CnB3ESZs*b3)?nG;wC
zOTqk4zk|U%PvBW{{(Iraa4UQVu7pb<4=2I`7=RS)Aosr+z7C&+)4<dNEClmBfxX}b
zV)k<|^#GrR)4;@W6y5<-;YITMU&D{Ue1D<y>UiMw=>g4#n`WPMp+7UFCa0o*MKsXa
zEI*TvP_%n8K%;r%d;gJNZ!itRPXK60&2Md|6TGI8lM3FV7E=pmVdn`KohMw>4wAM<
zSmd$Q;;3pI>GFwGy*eyaTNyt(Pq>JG!iDu<gkXSYnd?^vo{7OC9h!?m&6Yw3=Auxu
zrO;uyDAa5zbWkn|HCqZDl8ZvkmO=;QqENG?(BZf!)NCnqFfIx;TM8YDi$cv|MQEa~
zp$M5Rg$7p?YPJ*_Tv4dmQfP2Rp=L{=!4-v?ErkYG6l%5<8eCDR*-~h5MWJR(p}`e}
znk|I}R}^XvD?*cU4MoUoDKxmEP_w1b;EF=cmO_Io3N>2_4X!BEY$-IjqENG?(BO(f
n&6YxgD+)DR3JtC()NCm<xS~*VSP`0lYbZkIy5co`c+r0YwKiRK

diff --git a/tasks/main.yml b/tasks/main.yml
index cfd6547..309fe85 100644
--- a/tasks/main.yml
+++ b/tasks/main.yml
@@ -8,68 +8,19 @@
       apiVersion: v1
       kind: Namespace
       metadata:
-        name: "{{ ejabberd_namespace }}"
+        name: ejabberd
 
-- name: certificate
-  k8s:
-    state: present
-    definition:
-      apiVersion: cert-manager.io/v1
-      kind: Certificate
-      metadata:
-        name: ssl
-        namespace: "{{ ejabberd_namespace }}"
-      spec:
-        secretName: ssl
-        privateKey:
-          algorithm: RSA
-          encoding: PKCS1
-          size: 2048
-        duration: 2160h # 90d
-        renewBefore: 360h # 15d
-        isCA: false
-        usages:
-          - server auth
-          - client auth
-        subject:
-          organizations:
-            - EOM
-        commonName: eom.dev
-        dnsNames:
-          - ejabberd.eom.dev
-        issuerRef:
-          name: ca-issuer
-          kind: ClusterIssuer
+- name: repo
+  kubernetes.core.helm_repository:
+    name: ejabberd
+    repo_url: https://sando38.github.io/helm-ejabberd
+  register: repo_update
 
-- name: configmap
-  k8s:
-    state: present
-    definition:
-      apiVersion: v1
-      kind: ConfigMap
-      metadata:
-        name: config
-        namespace: "{{ ejabberd_namespace }}"
-      data:
-        ejabberd.yml: "{{ lookup('template', 'ejabberd.yml.j2') }}"
+- name: update
+  command: helm repo update
+  when: repo_update.changed
 
-- name: pvc for data
-  k8s:
-    state: present
-    definition:
-      apiVersion: v1
-      kind: PersistentVolumeClaim
-      metadata:
-        name: data
-        namespace: "{{ ejabberd_namespace }}"
-      spec:
-        accessModes:
-          - ReadWriteOnce
-        resources:
-          requests:
-            storage: "{{ ejabberd_pvc_size_data }}"
-
-- name: pvc for db
+- name: pvc for mariadb
   k8s:
     state: present
     definition:
@@ -85,485 +36,157 @@
           requests:
             storage: "{{ ejabberd_pvc_size_db }}"
 
-- name: deployment for ejabberd
+- name: deployment for mariadb
   k8s:
     definition:
       apiVersion: v1
       kind: Deployment
       metadata:
-        name: ejabberd
+        name: mariadb
         namespace: "{{ ejabberd_namespace }}"
       spec:
         replicas: 1
         selector:
           matchLabels:
-            app: ejabberd
+            app: mariadb
         template:
           metadata:
             labels:
-              app: ejabberd
+              app: mariadb
           spec:
             containers:
-              - name: ejabberd
-                image: ejabberd/ecs
+              - name: mariadb
+                image: mariadb
                 env:
-                  - name: EJABBERD_MACRO_ADMIN
-                    value: "{{ ejabberd_macro_admin }}"
-                  - name: EJABBERD_MACRO_PASSWORD
-                    value: "{{ ejabberd_macro_password }}"
+                  - name: MYSQL_ROOT_PASSWORD
+                    value: "{{ ejabberd_mariadb_root_password }}"
+                  - name: MYSQL_USER
+                    value: "ejabberd"
+                  - name: MYSQL_PASSWORD
+                    value: "{{ ejabberd_mariadb_password }}"
+                  - name: MYSQL_DATABASE
+                    value: "ejabberd"
                 volumeMounts:
-                  - name: certs
-                    mountPath: /etc/letsencrypt
-                  - name: config
-                    mountPath: /opt/ejabberd/conf/ejabberd.yml
-                    subPath: ejabberd.yml
                   - name: data
-                    mountPath: /opt/ejabberd/upload
-                  - name: db
-                    mountPath: /opt/ejabberd/database
+                    mountPath: /var/lib/mysql
                 ports:
-                  - containerPort: 5222
-                  - containerPort: 5269
-                  - containerPort: 5280
-                  - containerPort: 5443
-                  - containerPort: 1880
-                  - containerPort: 1883
-                  - containerPort: 50000
-                  - containerPort: 50001
-                  - containerPort: 50002
-                  - containerPort: 50003
-                  - containerPort: 50004
-                  - containerPort: 50005
-                  - containerPort: 50006
-                  - containerPort: 50007
-                  - containerPort: 50008
-                  - containerPort: 50009
-                  - containerPort: 50010
-                  - containerPort: 50011
-                  - containerPort: 50012
-                  - containerPort: 50013
-                  - containerPort: 50014
-                  - containerPort: 50015
-                  - containerPort: 50016
-                  - containerPort: 50017
-                  - containerPort: 50018
-                  - containerPort: 50019
-                  - containerPort: 50020
-                  - containerPort: 50021
-                  - containerPort: 50022
-                  - containerPort: 50023
-                  - containerPort: 50024
-                  - containerPort: 50025
-                  - containerPort: 50026
-                  - containerPort: 50027
-                  - containerPort: 50028
-                  - containerPort: 50029
-                  - containerPort: 50030
-                  - containerPort: 50031
-                  - containerPort: 50032
-                  - containerPort: 50033
-                  - containerPort: 50034
-                  - containerPort: 50035
-                  - containerPort: 50036
-                  - containerPort: 50037
-                  - containerPort: 50038
-                  - containerPort: 50039
-                  - containerPort: 50040
-                  - containerPort: 50041
-                  - containerPort: 50042
-                  - containerPort: 50043
-                  - containerPort: 50044
-                  - containerPort: 50045
-                  - containerPort: 50046
-                  - containerPort: 50047
-                  - containerPort: 50048
-                  - containerPort: 50049
-                  - containerPort: 50050
-                  - containerPort: 50051
-                  - containerPort: 50052
-                  - containerPort: 50053
-                  - containerPort: 50054
-                  - containerPort: 50055
-                  - containerPort: 50056
-                  - containerPort: 50057
-                  - containerPort: 50058
-                  - containerPort: 50059
-                  - containerPort: 50060
-                  - containerPort: 50061
-                  - containerPort: 50062
-                  - containerPort: 50063
-                  - containerPort: 50064
-                  - containerPort: 50065
-                  - containerPort: 50066
-                  - containerPort: 50067
-                  - containerPort: 50068
-                  - containerPort: 50069
-                  - containerPort: 50070
-                  - containerPort: 50071
-                  - containerPort: 50072
-                  - containerPort: 50073
-                  - containerPort: 50074
-                  - containerPort: 50075
-                  - containerPort: 50076
-                  - containerPort: 50077
-                  - containerPort: 50078
-                  - containerPort: 50079
-                  - containerPort: 50080
-                  - containerPort: 50081
-                  - containerPort: 50082
-                  - containerPort: 50083
-                  - containerPort: 50084
-                  - containerPort: 50085
-                  - containerPort: 50086
-                  - containerPort: 50087
-                  - containerPort: 50088
-                  - containerPort: 50089
-                  - containerPort: 50090
-                  - containerPort: 50091
-                  - containerPort: 50092
-                  - containerPort: 50093
-                  - containerPort: 50094
-                  - containerPort: 50095
-                  - containerPort: 50096
-                  - containerPort: 50097
-                  - containerPort: 50098
-                  - containerPort: 50099
-                  - containerPort: 5210
-                  - containerPort: 4369
-                  - containerPort: 4370
-                  - containerPort: 4371
-                  - containerPort: 4372
-                  - containerPort: 4373
-                  - containerPort: 4374
-                  - containerPort: 4375
-                  - containerPort: 4376
-                  - containerPort: 4377
-                  - containerPort: 4378
-                  - containerPort: 4379
-                  - containerPort: 4380
-                  - containerPort: 4381
-                  - containerPort: 4382
-                  - containerPort: 4383
-                  - containerPort: 4384
-                  - containerPort: 4385
-                  - containerPort: 4386
-                  - containerPort: 4387
-                  - containerPort: 4388
-                  - containerPort: 4389
-                  - containerPort: 4390
-                  - containerPort: 4391
-                  - containerPort: 4392
-                  - containerPort: 4393
-                  - containerPort: 4394
-                  - containerPort: 4395
-                  - containerPort: 4396
-                  - containerPort: 4397
-                  - containerPort: 4398
-                  - containerPort: 4399
+                  - containerPort: 3306
             volumes:
               - name: data
-                persistentVolumeClaim:
-                  claimName: data
-              - name: config
-                configMap:
-                  name: config
-              - name: db
                 persistentVolumeClaim:
                   claimName: db
 
-- name: service for ejabberd
+- name: service for mariadb
   k8s:
     definition:
       apiVersion: v1
       kind: Service
       metadata:
-        name: ejabberd
+        name: mariadb
         namespace: "{{ ejabberd_namespace }}"
       spec:
         selector:
-          app: ejabberd
+          app: mariadb
         ports:
-          - port: 5222
-            name: xmpp
-          - port: 5269
-            name: federation
-          - port: 5280
-            name: admin
-          - port: 5443
-            name: http
-          - port: 1880
-            name: admin2
-          - port: 1883
-            name: mqtt
-          - port: 5478
-            name: stun
-          - port: 50000
-            name: turn50000
-          - port: 50001
-            name: turn50001
-          - port: 50002
-            name: turn50002
-          - port: 50003
-            name: turn50003
-          - port: 50004
-            name: turn50004
-          - port: 50005
-            name: turn50005
-          - port: 50006
-            name: turn50006
-          - port: 50007
-            name: turn50007
-          - port: 50008
-            name: turn50008
-          - port: 50009
-            name: turn50009
-          - port: 50010
-            name: turn50010
-          - port: 50011
-            name: turn50011
-          - port: 50012
-            name: turn50012
-          - port: 50013
-            name: turn50013
-          - port: 50014
-            name: turn50014
-          - port: 50015
-            name: turn50015
-          - port: 50016
-            name: turn50016
-          - port: 50017
-            name: turn50017
-          - port: 50018
-            name: turn50018
-          - port: 50019
-            name: turn50019
-          - port: 50020
-            name: turn50020
-          - port: 50021
-            name: turn50021
-          - port: 50022
-            name: turn50022
-          - port: 50023
-            name: turn50023
-          - port: 50024
-            name: turn50024
-          - port: 50025
-            name: turn50025
-          - port: 50026
-            name: turn50026
-          - port: 50027
-            name: turn50027
-          - port: 50028
-            name: turn50028
-          - port: 50029
-            name: turn50029
-          - port: 50030
-            name: turn50030
-          - port: 50031
-            name: turn50031
-          - port: 50032
-            name: turn50032
-          - port: 50033
-            name: turn50033
-          - port: 50034
-            name: turn50034
-          - port: 50035
-            name: turn50035
-          - port: 50036
-            name: turn50036
-          - port: 50037
-            name: turn50037
-          - port: 50038
-            name: turn50038
-          - port: 50039
-            name: turn50039
-          - port: 50040
-            name: turn50040
-          - port: 50041
-            name: turn50041
-          - port: 50042
-            name: turn50042
-          - port: 50043
-            name: turn50043
-          - port: 50044
-            name: turn50044
-          - port: 50045
-            name: turn50045
-          - port: 50046
-            name: turn50046
-          - port: 50047
-            name: turn50047
-          - port: 50048
-            name: turn50048
-          - port: 50049
-            name: turn50049
-          - port: 50050
-            name: turn50050
-          - port: 50051
-            name: turn50051
-          - port: 50052
-            name: turn50052
-          - port: 50053
-            name: turn50053
-          - port: 50054
-            name: turn50054
-          - port: 50055
-            name: turn50055
-          - port: 50056
-            name: turn50056
-          - port: 50057
-            name: turn50057
-          - port: 50058
-            name: turn50058
-          - port: 50059
-            name: turn50059
-          - port: 50060
-            name: turn50060
-          - port: 50061
-            name: turn50061
-          - port: 50062
-            name: turn50062
-          - port: 50063
-            name: turn50063
-          - port: 50064
-            name: turn50064
-          - port: 50065
-            name: turn50065
-          - port: 50066
-            name: turn50066
-          - port: 50067
-            name: turn50067
-          - port: 50068
-            name: turn50068
-          - port: 50069
-            name: turn50069
-          - port: 50070
-            name: turn50070
-          - port: 50071
-            name: turn50071
-          - port: 50072
-            name: turn50072
-          - port: 50073
-            name: turn50073
-          - port: 50074
-            name: turn50074
-          - port: 50075
-            name: turn50075
-          - port: 50076
-            name: turn50076
-          - port: 50077
-            name: turn50077
-          - port: 50078
-            name: turn50078
-          - port: 50079
-            name: turn50079
-          - port: 50080
-            name: turn50080
-          - port: 50081
-            name: turn50081
-          - port: 50082
-            name: turn50082
-          - port: 50083
-            name: turn50083
-          - port: 50084
-            name: turn50084
-          - port: 50085
-            name: turn50085
-          - port: 50086
-            name: turn50086
-          - port: 50087
-            name: turn50087
-          - port: 50088
-            name: turn50088
-          - port: 50089
-            name: turn50089
-          - port: 50090
-            name: turn50090
-          - port: 50091
-            name: turn50091
-          - port: 50092
-            name: turn50092
-          - port: 50093
-            name: turn50093
-          - port: 50094
-            name: turn50094
-          - port: 50095
-            name: turn50095
-          - port: 50096
-            name: turn50096
-          - port: 50097
-            name: turn50097
-          - port: 50098
-            name: turn50098
-          - port: 50099
-            name: turn50099
-          - port: 7777
-            name: socks5
-          - port: 5210
-            name: erlang
-          - port: 4369
-            name: epmd4369
-          - port: 4370
-            name: epmd4370
-          - port: 4371
-            name: epmd4371
-          - port: 4372
-            name: epmd4372
-          - port: 4373
-            name: epmd4373
-          - port: 4374
-            name: epmd4374
-          - port: 4375
-            name: epmd4375
-          - port: 4376
-            name: epmd4376
-          - port: 4377
-            name: epmd4377
-          - port: 4378
-            name: epmd4378
-          - port: 4379
-            name: epmd4379
-          - port: 4380
-            name: epmd4380
-          - port: 4381
-            name: epmd4381
-          - port: 4382
-            name: epmd4382
-          - port: 4383
-            name: epmd4383
-          - port: 4384
-            name: epmd4384
-          - port: 4385
-            name: epmd4385
-          - port: 4386
-            name: epmd4386
-          - port: 4387
-            name: epmd4387
-          - port: 4388
-            name: epmd4388
-          - port: 4389
-            name: epmd4389
-          - port: 4390
-            name: epmd4390
-          - port: 4391
-            name: epmd4391
-          - port: 4392
-            name: epmd4392
-          - port: 4393
-            name: epmd4393
-          - port: 4394
-            name: epmd4394
-          - port: 4395
-            name: epmd4395
-          - port: 4396
-            name: epmd4396
-          - port: 4397
-            name: epmd4397
-          - port: 4398
-            name: epmd4398
-          - port: 4399
-            name: epmd4399
-        type: LoadBalancer
+          - port: 3306
+            name: mariadb
+        type: ClusterIP
+
+- name: certificate
+  k8s:
+    state: present
+    definition:
+      apiVersion: cert-manager.io/v1
+      kind: Certificate
+      metadata:
+        name: le-cert-eomdev
+        namespace: ejabberd
+      spec:
+        secretName: le-cert-eomdev
+        privateKey:
+          rotationPolicy: Always
+        commonName: "eom.dev"
+        dnsNames:
+        - "eom.dev"
+        - "conference.eom.dev"
+        - "proxy.eom.dev"
+        - "upload.eom.dev"
+        - "vjud.eom.dev"
+        additionalOutputFormats:
+        - type: CombinedPEM
+        - type: DER
+        secretTemplate:
+          annotations:
+            k8s-sidecar-target-directory: "certs/le-cert-eomdev"
+          labels:
+            helm-ejabberd/watcher: "true"
+        issuerRef:
+          name: ca-issuer
+          kind: ClusterIssuer
+
+- name: deploy
+  kubernetes.core.helm:
+    name: ejabberd
+    chart_ref: ejabberd/ejabberd
+    release_namespace: ejabberd
+    create_namespace: true
+    values:
+      hosts:
+        - eom.dev
+      certFiles:
+        secretName:
+          - le-cert-eomdev
+        sideCar:
+          enabled: true
+      listen:
+        c2s:
+          options:
+            tls: true
+      modules:
+        mod_vcard:
+          db_type: ldap
+          ldap_rootdn: "cn=readonly,dc=eom,dc=dev"
+          ldap_password: "{{ openldap_readonly_password }}"
+          ldap_base: "ou=People,dc=eom,dc=dev"
+          ldap_uids:
+            uid: "%u@eom.dev"
+          ldap_filter: "(&(objectClass=posixAccount)(memberOf=cn=ejabberd users,ou=ejabberd,ou=Services,dc=eom,dc=dev))"
+          ldap_vcard_map:
+           NICKNAME: {"%u": [uid]}
+           GIVEN: {"%s": [givenName]}
+           FAMILY: {"%s": [sn]}
+           FN: {"%s, %s": [sn, givenName]}
+           EMAIL: {"%s": [mail]}
+           BDAY: {"%s": [birthDay]}
+          ldap_search_fields:
+            User: "%u"
+            Name: givenName
+            "Family Name": sn
+            Email: mail
+            Birthday: birthDay
+          ldap_search_reported:
+            "Full Name": FN
+            Nickname: NICKNAME
+            Birthday: BDAY
+            authentification:
+              - ldap
+      ldap:
+        ldap_servers:
+          - openldap.openldap.svc.cluster.local
+        ldap_port: 389
+        ldap_rootdn: "cn=readonly,dc=eom,dc=dev"
+        ldap_base: "dc=eom,dc=dev"
+        ldap_password: "{{ openldap_readonly_password }}"
+        ldap_filter: "(&(objectClass=posixAccount)(memberOf=cn=ejabberd Users,ou=ejabberd,ou=Services,dc=eom,dc=dev))"
+        ldap_uids: 
+          uid: "%u@eom.dev"
+      sqlDatabase:
+        enabled: false
+      redis:
+        enabled: false
+      persistence:
+        enabled: true
+        size: 2Ti
 
 - name: onionservice
   k8s:
@@ -584,27 +207,3 @@
                 port:
                   number: 5222
 
-- name: ingress
-  k8s:
-    state: present
-    definition:
-      apiVersion: networking.k8s.io/v1
-      kind: Ingress
-      metadata:
-        annotations:
-          cert-manager.io/cluster-issuer: ca-issuer
-        name: ejabberd
-        namespace: "{{ ejabberd_namespace }}"
-      spec:
-        ingressClassName: nginx
-        rules:
-          - host: ejabberd.eom.dev
-            http:
-              paths:
-                - pathType: Prefix
-                  path: /
-                  backend:
-                    service:
-                      name: ejabberd
-                      port:
-                        number: 5280