commit 8157b39ea4505596320abf59b8f4da428e6b7b7b
Author: Copybara <copybara@csbx.dev>
Date:   Tue Jan 20 13:24:59 2026 -0800

    Project import generated by Copybara.
    
    GitOrigin-RevId: 6370f6ea785709295b6abcf9c60717cacf3ac432

diff --git a/.forgejo/workflows/ci.yml b/.forgejo/workflows/ci.yml
new file mode 100644
index 0000000..4a9d881
--- /dev/null
+++ b/.forgejo/workflows/ci.yml
@@ -0,0 +1,33 @@
+name: CI
+
+on:
+  push: {}
+
+jobs:
+  build:
+    runs-on: "docker"
+    container:
+      image: forgejo.csbx.dev/acmcarther/coder-dev-base-image:4
+    
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Install bazelisk
+      run: |
+        curl -fLO "https://bin-cache.csbx.dev/bazelisk/v1.27.0/bazelisk-linux-amd64"
+        mkdir -p "${GITHUB_WORKSPACE}/bin/"
+        mv bazelisk-linux-amd64 "${GITHUB_WORKSPACE}/bin/bazel"
+        chmod +x "${GITHUB_WORKSPACE}/bin/bazel"
+
+    - name: Test
+      env:
+        BAZELISK_BASE_URL: "https://bin-cache.csbx.dev/bazel"
+      run: |
+        ${GITHUB_WORKSPACE}/bin/bazel test --config=ci --java_runtime_version=remotejdk_21 //...
+
+    - name: Upload test logs
+      if: always()
+      uses: actions/upload-artifact@v3
+      with:
+        name: bazel-test-logs
+        path: bazel-testlogs/
\ No newline at end of file
diff --git a/.forgejo/workflows/publish-container-images.yml b/.forgejo/workflows/publish-container-images.yml
new file mode 100644
index 0000000..07372dd
--- /dev/null
+++ b/.forgejo/workflows/publish-container-images.yml
@@ -0,0 +1,46 @@
+name: Publish Container Images
+on:
+  schedule:
+    - cron: '0 3 * * *' # Run at 3 AM
+  workflow_dispatch:
+
+permissions:
+  packages: write
+
+jobs:
+  publish:
+    runs-on: docker
+    container:
+      image: forgejo.csbx.dev/acmcarther/coder-dev-base-image:4
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install bazelisk
+        run: |
+          curl -fLO "http://bin-cache-http.dev.svc.cluster.local/bazelisk/v1.27.0/bazelisk-linux-amd64"
+          mkdir -p "${GITHUB_WORKSPACE}/bin/"
+          mv bazelisk-linux-amd64 "${GITHUB_WORKSPACE}/bin/bazel"
+          chmod +x "${GITHUB_WORKSPACE}/bin/bazel"
+          echo "${GITHUB_WORKSPACE}/bin" >> $GITHUB_PATH
+
+      - name: Login to Forgejo Registry
+        uses: docker/login-action@v3
+        with:
+          registry: forgejo.csbx.dev
+          username: ${{ github.actor }}
+          password: ${{ secrets.YESOD_PACKAGE_TOKEN }}
+
+      - name: Publish Coder Dev Base Image
+        env:
+          BAZELISK_BASE_URL: "http://bin-cache-http.dev.svc.cluster.local/bazel"
+          # rules_oci respects DOCKER_CONFIG or looks in ~/.docker/config.json
+          # The login action typically sets up ~/.docker/config.json
+        run: |
+          # Ensure DOCKER_CONFIG is set to where login-action writes (default home)
+          export DOCKER_CONFIG=$HOME/.docker
+          
+          SHORT_SHA=$(git rev-parse --short HEAD)
+          TAG="5-${SHORT_SHA}"
+          
+          echo "Pushing image with tag: ${TAG}"
+          bazel run --config=remote //k8s/container/coder-dev-base-image:push -- --tag ${TAG}
diff --git a/.forgejo/workflows/publish-homebrew-packages.yml b/.forgejo/workflows/publish-homebrew-packages.yml
new file mode 100644
index 0000000..510ffee
--- /dev/null
+++ b/.forgejo/workflows/publish-homebrew-packages.yml
@@ -0,0 +1,157 @@
+name: Publish Homebrew Packages
+on:
+  schedule:
+    - cron: '0 2 * * *' # Run at 2 AM
+  workflow_dispatch:
+
+permissions:
+  packages: write
+
+jobs:
+  build-and-publish:
+    runs-on: docker
+    container:
+      image: forgejo.csbx.dev/acmcarther/coder-dev-base-image:4
+    strategy:
+      matrix:
+        include:
+          - package: tts-client
+            target: //experimental/users/acmcarther/llm/tts_grpc:tts_client_go
+            binary_name: tts-client-darwin-arm64
+          - package: litellm-client
+            target: //experimental/users/acmcarther/llm/litellm_grpc:client_go
+            binary_name: litellm-client-darwin-arm64
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install bazelisk
+        run: |
+          curl -fLO "http://bin-cache-http.dev.svc.cluster.local/bazelisk/v1.27.0/bazelisk-linux-amd64"
+          mkdir -p "${GITHUB_WORKSPACE}/bin/"
+          mv bazelisk-linux-amd64 "${GITHUB_WORKSPACE}/bin/bazel"
+          chmod +x "${GITHUB_WORKSPACE}/bin/bazel"
+          echo "${GITHUB_WORKSPACE}/bin" >> $GITHUB_PATH
+
+      - name: Build Binary (Darwin ARM64)
+        env:
+          BAZELISK_BASE_URL: "http://bin-cache-http.dev.svc.cluster.local/bazel"
+        run: |
+          bazel build --config=remote --platforms=@rules_go//go/toolchain:darwin_arm64 ${{ matrix.target }}
+
+      - name: Publish Artifact
+        env:
+          YESOD_PACKAGE_TOKEN: ${{ secrets.YESOD_PACKAGE_TOKEN }}
+          PACKAGE_NAME: ${{ matrix.package }}
+          BINARY_NAME: ${{ matrix.binary_name }}
+          TARGET: ${{ matrix.target }}
+        run: |
+          # Calculate Version
+          SHORT_SHA=$(git rev-parse --short HEAD)
+          VERSION="0.0.2-${SHORT_SHA}"
+          PACKAGE_URL="https://forgejo.csbx.dev/api/packages/acmcarther/generic/${PACKAGE_NAME}/${VERSION}/${BINARY_NAME}"
+          
+          echo "Publishing ${PACKAGE_NAME} version ${VERSION}"
+          
+          # Locate the binary using cquery for precision
+          BINARY_PATH=$(bazel cquery --config=remote --platforms=@rules_go//go/toolchain:darwin_arm64 --output=files ${TARGET} 2>/dev/null)
+          
+          if [ -z "$BINARY_PATH" ]; then
+             echo "cquery failed to find the binary path for ${TARGET}"
+             exit 1
+          fi
+
+          # Upload
+          echo "Uploading to ${PACKAGE_URL}..."
+          curl -v --fail \
+            -H "Authorization: token $YESOD_PACKAGE_TOKEN" \
+            -X PUT \
+            "${PACKAGE_URL}" \
+            -T "$BINARY_PATH"
+
+  update-homebrew:
+    needs: build-and-publish
+    runs-on: docker
+    container:
+      image: forgejo.csbx.dev/acmcarther/coder-dev-base-image:4
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install bazelisk
+        run: |
+          curl -fLO "http://bin-cache-http.dev.svc.cluster.local/bazelisk/v1.27.0/bazelisk-linux-amd64"
+          mkdir -p "${GITHUB_WORKSPACE}/bin/"
+          mv bazelisk-linux-amd64 "${GITHUB_WORKSPACE}/bin/bazel"
+          chmod +x "${GITHUB_WORKSPACE}/bin/bazel"
+          echo "${GITHUB_WORKSPACE}/bin" >> $GITHUB_PATH
+
+      - name: Generate and Update Formulas
+        env:
+          BAZELISK_BASE_URL: "http://bin-cache-http.dev.svc.cluster.local/bazel"
+          PACKAGES: "tts-client litellm-client"
+        run: |
+          SHORT_SHA=$(git rev-parse --short HEAD)
+          VERSION="0.0.2-${SHORT_SHA}"
+          
+          for PACKAGE in $PACKAGES; do
+            echo "Processing $PACKAGE..."
+            
+            # Convert hyphen to underscore for bazel target name convention
+            TARGET_NAME="generate_${PACKAGE//-/_}_rb"
+            BAZEL_TARGET="//homebrew:${TARGET_NAME}"
+            BINARY_NAME="${PACKAGE}-darwin-arm64"
+            PACKAGE_URL="https://forgejo.csbx.dev/api/packages/acmcarther/generic/${PACKAGE}/${VERSION}/${BINARY_NAME}"
+            
+            echo "Building formula target: $BAZEL_TARGET"
+            bazel build --config=remote --platforms=@rules_go//go/toolchain:darwin_arm64 $BAZEL_TARGET
+            
+            FORMULA_PATH=$(bazel cquery --config=remote --platforms=@rules_go//go/toolchain:darwin_arm64 --output=files $BAZEL_TARGET 2>/dev/null)
+             
+            if [ -z "$FORMULA_PATH" ]; then
+                echo "Failed to find generated formula for $PACKAGE"
+                exit 1
+            fi
+            
+            echo "Generated formula at: $FORMULA_PATH"
+            
+            # Inject Version and URL
+            sed -e "s|{VERSION}|${VERSION}|g" \
+                -e "s|{URL}|${PACKAGE_URL}|g" \
+                "$FORMULA_PATH" > homebrew/${PACKAGE}.rb
+            
+            echo "Updated homebrew/${PACKAGE}.rb"
+          done
+
+      - name: Configure Git
+        run: |
+          git config --global user.name "Copybara"
+          git config --global user.email "copybara@csbx.dev"
+          git config --global url."https://acmcarther:${{ secrets.HOMEBREW_REPO_TOKEN }}@forgejo.csbx.dev/acmcarther/yesod-homebrew-tools.git".insteadOf "https://forgejo.csbx.dev/acmcarther/yesod-homebrew-tools.git"
+
+      - name: Run Copybara
+        env:
+          BAZELISK_BASE_URL: "http://bin-cache-http.dev.svc.cluster.local/bazel"
+        run: |
+          # Stage the new formulas
+          git add homebrew/*.rb
+          
+          # Check if there are changes
+          if git diff --cached --quiet; then
+            echo "No changes to commit."
+          else
+            SHORT_SHA=$(git rev-parse --short HEAD)
+            VERSION="0.0.2-${SHORT_SHA}"
+            git commit -m "Update homebrew formulas to ${VERSION} [skip ci]"
+          
+            # Patch copy.bara.sky to use local origin
+            sed -i "s|sourceUrl = .*|sourceUrl = \"file://${GITHUB_WORKSPACE}\"|" "${GITHUB_WORKSPACE}/tools/copybara/homebrew/copy.bara.sky"
+
+            # Run Copybara
+            bazel run //tools/copybara:copybara --config=remote --java_runtime_version=remotejdk_21 -- \
+              migrate \
+              "${GITHUB_WORKSPACE}/tools/copybara/homebrew/copy.bara.sky" \
+              --force
+          fi
diff --git a/.forgejo/workflows/publish-yesod-mirror.yml b/.forgejo/workflows/publish-yesod-mirror.yml
new file mode 100644
index 0000000..a875632
--- /dev/null
+++ b/.forgejo/workflows/publish-yesod-mirror.yml
@@ -0,0 +1,43 @@
+name: Publish Yesod Mirror
+on:
+  schedule:
+    - cron: '0 1 * * *' # Run at 1 AM
+  workflow_dispatch:
+
+permissions:
+  packages: write
+
+jobs:
+  update-yesod-mirror:
+    runs-on: docker
+    container:
+      image: forgejo.csbx.dev/acmcarther/coder-dev-base-image:4
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Install bazelisk
+        run: |
+          curl -fLO "http://bin-cache-http.dev.svc.cluster.local/bazelisk/v1.27.0/bazelisk-linux-amd64"
+          mkdir -p "${GITHUB_WORKSPACE}/bin/"
+          mv bazelisk-linux-amd64 "${GITHUB_WORKSPACE}/bin/bazel"
+          chmod +x "${GITHUB_WORKSPACE}/bin/bazel"
+          echo "${GITHUB_WORKSPACE}/bin" >> $GITHUB_PATH
+
+      - name: Configure Git
+        run: |
+          git config --global user.name "Copybara"
+          git config --global user.email "copybara@csbx.dev"
+          git config --global url."https://acmcarther:${{ secrets.YESOD_MIRROR_TOKEN }}@forgejo.csbx.dev/acmcarther/yesod-mirror.git".insteadOf "https://forgejo.csbx.dev/acmcarther/yesod-mirror.git"
+          git config --global url."https://acmcarther:${{ secrets.YESOD_MIRROR_TOKEN }}@forgejo.csbx.dev/acmcarther/yesod.git".insteadOf "https://forgejo.csbx.dev/acmcarther/yesod.git"
+
+      - name: Run Copybara
+        env:
+          BAZELISK_BASE_URL: "http://bin-cache-http.dev.svc.cluster.local/bazel"
+        run: |
+          # Run Copybara
+          bazel run //tools/copybara:copybara --config=remote --java_runtime_version=remotejdk_21 -- \
+            migrate \
+            "${GITHUB_WORKSPACE}/tools/copybara/yesod-mirror/copy.bara.sky" \
+            --force
diff --git a/.gemini/settings.json b/.gemini/settings.json
new file mode 100644
index 0000000..2f65e16
--- /dev/null
+++ b/.gemini/settings.json
@@ -0,0 +1,25 @@
+{
+  "context": {
+    "includeDirectories": [
+      "~/.gemini/tmp/",
+      "~/.cache/bazel/"
+    ]
+  },
+  "general": {
+    "preferredEditor": "vim"
+  },
+  "mcpServers": {
+    "playwright": {
+      "command": "npx",
+      "args": [
+        "@playwright/mcp@latest"
+      ]
+    }
+  },
+  "telemetry": {
+    "enabled": true,
+    "target": "local",
+    "otlpEndpoint": "",
+    "logPrompts": true
+  }
+}
diff --git a/.github/PULL_REQUEST_TEMPLATE.md b/.github/PULL_REQUEST_TEMPLATE.md
new file mode 100644
index 0000000..a594c21
--- /dev/null
+++ b/.github/PULL_REQUEST_TEMPLATE.md
@@ -0,0 +1,11 @@
+### Link to Task
+
+<!-- Provide a link to the project checkpoint or task file that initiated this work. -->
+
+### Summary of Changes
+
+<!-- Describe the modifications made in this pull request. -->
+
+### Verification Steps
+
+<!-- Outline the specific commands run and tests passed to validate the changes. -->
diff --git a/experimental/users/acmcarther/BUILD.bazel b/experimental/users/acmcarther/BUILD.bazel
new file mode 100644
index 0000000..e69de29
diff --git a/experimental/users/acmcarther/build_defs.bzl b/experimental/users/acmcarther/build_defs.bzl
new file mode 100644
index 0000000..f58f2cd
--- /dev/null
+++ b/experimental/users/acmcarther/build_defs.bzl
@@ -0,0 +1,23 @@
+
+load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
+
+# Old stuff moved out of scripts/ 
+def copy_to_dist(name):
+    native.genrule(
+        name = name + "_publish",
+        srcs = [":" + name],
+        outs = ["dist/scripts/" + name],
+        cmd = "cp $(execpath :" + name + ") $@",
+    )
+
+# Old stuff moved out of scripts/ 
+def package_script(name):
+    """Packages a py_binary script into a tarball.
+
+    Args:
+        name: The name of the py_binary rule.
+    """
+    pkg_tar(
+        name = name + "_tar",
+        srcs = [":" + name],
+    )
diff --git a/experimental/users/acmcarther/examples/grpc_example/BUILD b/experimental/users/acmcarther/examples/grpc_example/BUILD
new file mode 100644
index 0000000..3a8f6c8
--- /dev/null
+++ b/experimental/users/acmcarther/examples/grpc_example/BUILD
@@ -0,0 +1,106 @@
+load("@aspect_rules_py//py:defs.bzl", "py_binary", "py_library", "py_pex_binary", "py_unpacked_wheel")
+load("@build_stack_rules_proto//rules:proto_compile.bzl", "proto_compile")
+load("@build_stack_rules_proto//rules/py:grpc_py_library.bzl", "grpc_py_library")
+load("@build_stack_rules_proto//rules/py:proto_py_library.bzl", "proto_py_library")
+load("@pip_third_party//:requirements.bzl", "requirement")
+load("@rules_go//go:def.bzl", "go_library", "go_test")
+load("@rules_proto//proto:defs.bzl", "proto_library")
+
+# gazelle:resolve go forgejo.csbx.dev/acmcarther/yesod/experimental/users/acmcarther/examples/grpc_example //experimental/users/acmcarther/examples/grpc_example:example_go_proto
+
+py_binary(
+    name = "example_client",
+    srcs = ["example_client.py"],
+    deps = [
+        ":example_grpc_py_library",
+        ":example_py_library",
+        requirement("grpcio"),
+    ],
+)
+
+py_binary(
+    name = "example_server",
+    srcs = ["example_server.py"],
+    deps = [
+        ":example_grpc_py_library",
+        ":example_py_library",
+        requirement("grpcio"),
+    ],
+)
+
+proto_library(
+    name = "example_proto",
+    srcs = ["example.proto"],
+    visibility = ["//visibility:public"],
+)
+
+proto_compile(
+    name = "example_go_grpc_compile",
+    output_mappings = [
+        "example.pb.go=forgejo.csbx.dev/acmcarther/yesod/experimental/users/acmcarther/examples/grpc_example/example.pb.go",
+        "example_grpc.pb.go=forgejo.csbx.dev/acmcarther/yesod/experimental/users/acmcarther/examples/grpc_example/example_grpc.pb.go",
+    ],
+    outputs = [
+        "example.pb.go",
+        "example_grpc.pb.go",
+    ],
+    plugins = [
+        "@build_stack_rules_proto//plugin/golang/protobuf:protoc-gen-go",
+        "@build_stack_rules_proto//plugin/grpc/grpc-go:protoc-gen-go-grpc",
+    ],
+    proto = "example_proto",
+)
+
+grpc_py_library(
+    name = "example_grpc_py_library",
+    srcs = ["example_pb2_grpc.py"],
+    deps = [
+        ":example_py_library",
+        "@pip_third_party//grpcio:pkg",
+    ],
+)
+
+proto_compile(
+    name = "example_python_grpc_compile",
+    outputs = [
+        "example_pb2.py",
+        "example_pb2.pyi",
+        "example_pb2_grpc.py",
+    ],
+    plugins = [
+        "@build_stack_rules_proto//plugin/builtin:pyi",
+        "@build_stack_rules_proto//plugin/builtin:python",
+        "@build_stack_rules_proto//plugin/grpc/grpc:protoc-gen-grpc-python",
+    ],
+    proto = "example_proto",
+)
+
+proto_py_library(
+    name = "example_py_library",
+    srcs = ["example_pb2.py"],
+    deps = ["@com_google_protobuf//:protobuf_python"],
+)
+
+go_library(
+    name = "example_go_proto",
+    srcs = [":example_go_grpc_compile"],
+    importpath = "forgejo.csbx.dev/acmcarther/yesod/experimental/users/acmcarther/examples/grpc_example",
+    visibility = ["//visibility:public"],
+    deps = [
+        "@org_golang_google_grpc//:go_default_library",
+        "@org_golang_google_grpc//codes",
+        "@org_golang_google_grpc//status",
+        "@org_golang_google_protobuf//reflect/protoreflect",
+        "@org_golang_google_protobuf//runtime/protoimpl",
+    ],
+)
+
+go_test(
+    name = "grpc_example_test",
+    srcs = ["example_test.go"],
+    deps = [
+        ":example_go_proto",
+        "@org_golang_google_grpc//:grpc",
+        "@org_golang_google_grpc//credentials/insecure",
+    ],
+)
diff --git a/experimental/users/acmcarther/examples/grpc_example/client/BUILD.bazel b/experimental/users/acmcarther/examples/grpc_example/client/BUILD.bazel
new file mode 100644
index 0000000..fda7ace
--- /dev/null
+++ b/experimental/users/acmcarther/examples/grpc_example/client/BUILD.bazel
@@ -0,0 +1,19 @@
+load("@rules_go//go:def.bzl", "go_binary", "go_library")
+
+go_library(
+    name = "client_lib",
+    srcs = ["main.go"],
+    importpath = "forgejo.csbx.dev/acmcarther/yesod/experimental/users/acmcarther/grpc_example/client",
+    visibility = ["//visibility:private"],
+    deps = [
+        "//experimental/users/acmcarther/examples/grpc_example:example_go_proto",
+        "@org_golang_google_grpc//:grpc",
+        "@org_golang_google_grpc//credentials/insecure",
+    ],
+)
+
+go_binary(
+    name = "client",
+    embed = [":client_lib"],
+    visibility = ["//visibility:public"],
+)
diff --git a/experimental/users/acmcarther/examples/grpc_example/client/main.go b/experimental/users/acmcarther/examples/grpc_example/client/main.go
new file mode 100644
index 0000000..3b14d8c
--- /dev/null
+++ b/experimental/users/acmcarther/examples/grpc_example/client/main.go
@@ -0,0 +1,41 @@
+package main
+
+import (
+	"context"
+	"flag"
+	"log"
+	"time"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+	pb "forgejo.csbx.dev/acmcarther/yesod/experimental/users/acmcarther/examples/grpc_example"
+)
+
+const (
+	defaultName = "world"
+)
+
+var (
+	addr = flag.String("addr", "localhost:50051", "the address to connect to")
+	name = flag.String("name", defaultName, "Name to greet")
+)
+
+func main() {
+	flag.Parse()
+	// Set up a connection to the server.
+	conn, err := grpc.Dial(*addr, grpc.WithTransportCredentials(insecure.NewCredentials()))
+	if err != nil {
+		log.Fatalf("did not connect: %v", err)
+	}
+	defer conn.Close()
+	c := pb.NewExampleClient(conn)
+
+	// Contact the server and print out its response.
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	r, err := c.SayHello(ctx, &pb.HelloRequest{Name: name})
+	if err != nil {
+		log.Fatalf("could not greet: %v", err)
+	}
+	log.Printf("Greeting: %s", r.GetMessage())
+}
diff --git a/experimental/users/acmcarther/examples/grpc_example/example.proto b/experimental/users/acmcarther/examples/grpc_example/example.proto
new file mode 100644
index 0000000..f4f8387
--- /dev/null
+++ b/experimental/users/acmcarther/examples/grpc_example/example.proto
@@ -0,0 +1,17 @@
+package experimental.users.acmcarther.examples.grpc_example;
+
+option go_package = "forgejo.csbx.dev/acmcarther/yesod/experimental/users/acmcarther/examples/grpc_example";
+
+service Example {
+    rpc SayHello(HelloRequest) returns (HelloReply) {}
+}
+
+// The request message containing the user's name.
+message HelloRequest {
+    optional string name = 1;
+}
+
+// The response message containing the greetings
+message HelloReply {
+    optional string message = 1;
+}
\ No newline at end of file
diff --git a/experimental/users/acmcarther/examples/grpc_example/example_client.py b/experimental/users/acmcarther/examples/grpc_example/example_client.py
new file mode 100644
index 0000000..fa299e1
--- /dev/null
+++ b/experimental/users/acmcarther/examples/grpc_example/example_client.py
@@ -0,0 +1,15 @@
+from experimental.users.acmcarther.examples.grpc_example import example_pb2_grpc, example_pb2
+import grpc
+from concurrent import futures
+
+def main():
+    with grpc.insecure_channel("localhost:50051") as channel:
+        stub = example_pb2_grpc.ExampleStub(channel)
+        response = stub.SayHello(example_pb2.HelloRequest(name="you"))
+    print("Greeter client received: " + response.message)
+    pass
+
+if __name__ == "__main__":
+    main()
+
+
diff --git a/experimental/users/acmcarther/examples/grpc_example/example_server.py b/experimental/users/acmcarther/examples/grpc_example/example_server.py
new file mode 100644
index 0000000..480b8f9
--- /dev/null
+++ b/experimental/users/acmcarther/examples/grpc_example/example_server.py
@@ -0,0 +1,22 @@
+from experimental.users.acmcarther.examples.grpc_example import example_pb2_grpc, example_pb2
+import grpc
+from concurrent import futures
+
+class ExampleService(example_pb2_grpc.ExampleServicer):
+    def SayHello(self, request, context):
+        response_message = f"Hello, {request.name}!"
+        return example_pb2.HelloReply(message=response_message)
+
+
+def main():
+    port = 50051
+    server = grpc.server(futures.ThreadPoolExecutor(max_workers=10))
+    example_pb2_grpc.add_ExampleServicer_to_server(ExampleService(), server)
+    server.add_insecure_port(f'[::]:{port}')
+    server.start()
+    print(f"gRPC server is running on port {port}...")
+    server.wait_for_termination()
+
+
+if __name__ == "__main__":
+    main()
\ No newline at end of file
diff --git a/experimental/users/acmcarther/examples/grpc_example/example_test.go b/experimental/users/acmcarther/examples/grpc_example/example_test.go
new file mode 100644
index 0000000..61194ca
--- /dev/null
+++ b/experimental/users/acmcarther/examples/grpc_example/example_test.go
@@ -0,0 +1,61 @@
+package main_test
+
+import (
+	"context"
+	"log"
+	"net"
+	"testing"
+	"time"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+	pb "forgejo.csbx.dev/acmcarther/yesod/experimental/users/acmcarther/examples/grpc_example"
+)
+
+// server is used to implement helloworld.GreeterServer.
+type server struct {
+	pb.UnimplementedExampleServer
+}
+
+// SayHello implements helloworld.GreeterServer
+func (s *server) SayHello(ctx context.Context, in *pb.HelloRequest) (*pb.HelloReply, error) {
+	log.Printf("Received: %v", in.GetName())
+	msg := "Hello " + in.GetName()
+	return &pb.HelloReply{Message: &msg}, nil
+}
+
+func TestSayHello(t *testing.T) {
+	// Start server
+	lis, err := net.Listen("tcp", "localhost:0")
+	if err != nil {
+		t.Fatalf("failed to listen: %v", err)
+	}
+	s := grpc.NewServer()
+	pb.RegisterExampleServer(s, &server{})
+	go func() {
+		if err := s.Serve(lis); err != nil {
+			log.Printf("server exited with error: %v", err)
+		}
+	}()
+	defer s.Stop()
+
+	// Connect client
+	conn, err := grpc.NewClient(lis.Addr().String(), grpc.WithTransportCredentials(insecure.NewCredentials()))
+	if err != nil {
+		t.Fatalf("did not connect: %v", err)
+	}
+	defer conn.Close()
+	c := pb.NewExampleClient(conn)
+
+	// Call method
+	ctx, cancel := context.WithTimeout(context.Background(), time.Second)
+	defer cancel()
+	name := "TestUser"
+	r, err := c.SayHello(ctx, &pb.HelloRequest{Name: &name})
+	if err != nil {
+		t.Fatalf("could not greet: %v", err)
+	}
+	if r.GetMessage() != "Hello "+name {
+		t.Errorf("got %s, want Hello %s", r.GetMessage(), name)
+	}
+}
diff --git a/experimental/users/acmcarther/examples/grpc_example/server/BUILD.bazel b/experimental/users/acmcarther/examples/grpc_example/server/BUILD.bazel
new file mode 100644
index 0000000..1a72a3d
--- /dev/null
+++ b/experimental/users/acmcarther/examples/grpc_example/server/BUILD.bazel
@@ -0,0 +1,18 @@
+load("@rules_go//go:def.bzl", "go_binary", "go_library")
+
+go_library(
+    name = "server_lib",
+    srcs = ["main.go"],
+    importpath = "forgejo.csbx.dev/acmcarther/yesod/experimental/users/acmcarther/examples/grpc_example/server",
+    visibility = ["//visibility:private"],
+    deps = [
+        "//experimental/users/acmcarther/examples/grpc_example:example_go_proto",
+        "@org_golang_google_grpc//:grpc",
+    ],
+)
+
+go_binary(
+    name = "server",
+    embed = [":server_lib"],
+    visibility = ["//visibility:public"],
+)
diff --git a/experimental/users/acmcarther/examples/grpc_example/server/main.go b/experimental/users/acmcarther/examples/grpc_example/server/main.go
new file mode 100644
index 0000000..76f0398
--- /dev/null
+++ b/experimental/users/acmcarther/examples/grpc_example/server/main.go
@@ -0,0 +1,42 @@
+package main
+
+import (
+	"context"
+	"flag"
+	"fmt"
+	"log"
+	"net"
+
+	"google.golang.org/grpc"
+	pb "forgejo.csbx.dev/acmcarther/yesod/experimental/users/acmcarther/examples/grpc_example"
+)
+
+var (
+	port = flag.Int("port", 50051, "The server port")
+)
+
+// server is used to implement helloworld.GreeterServer.
+type server struct {
+	pb.UnimplementedExampleServer
+}
+
+// SayHello implements helloworld.GreeterServer
+func (s *server) SayHello(ctx context.Context, in *pb.HelloRequest) (*pb.HelloReply, error) {
+	log.Printf("Received: %v", in.GetName())
+	msg := "Hello " + in.GetName()
+	return &pb.HelloReply{Message: &msg}, nil
+}
+
+func main() {
+	flag.Parse()
+	lis, err := net.Listen("tcp", fmt.Sprintf(":%d", *port))
+	if err != nil {
+		log.Fatalf("failed to listen: %v", err)
+	}
+	s := grpc.NewServer()
+	pb.RegisterExampleServer(s, &server{})
+	log.Printf("server listening at %v", lis.Addr())
+	if err := s.Serve(lis); err != nil {
+		log.Fatalf("failed to serve: %v", err)
+	}
+}
diff --git a/experimental/users/acmcarther/examples/jsonnet/BUILD.bazel b/experimental/users/acmcarther/examples/jsonnet/BUILD.bazel
new file mode 100644
index 0000000..f400b81
--- /dev/null
+++ b/experimental/users/acmcarther/examples/jsonnet/BUILD.bazel
@@ -0,0 +1,25 @@
+load("@rules_jsonnet//jsonnet:jsonnet.bzl", "jsonnet_library", "jsonnet_to_json", "jsonnet_to_json_test")
+
+jsonnet_library(
+    name = "base_lib",
+    srcs = ["lib/base.libsonnet"],
+    visibility = ["//visibility:public"],
+    deps = [
+        "//third_party/jsonnet:k8s_libsonnet",
+    ],
+)
+
+jsonnet_library(
+    name = "dev_env_lib",
+    srcs = ["environments/dev/main.jsonnet"],
+    visibility = ["//visibility:public"],
+    deps = [":base_lib"],
+)
+
+jsonnet_to_json(
+    name = "dev_env",
+    src = "environments/dev/main.jsonnet",
+    outs = ["dev_env.json"],
+    visibility = ["//visibility:public"],
+    deps = [":base_lib"],
+)
diff --git a/experimental/users/acmcarther/examples/jsonnet/environments/dev/main.jsonnet b/experimental/users/acmcarther/examples/jsonnet/environments/dev/main.jsonnet
new file mode 100644
index 0000000..e5f9600
--- /dev/null
+++ b/experimental/users/acmcarther/examples/jsonnet/environments/dev/main.jsonnet
@@ -0,0 +1,5 @@
+local base = import "experimental/users/acmcarther/examples/jsonnet/lib/base.libsonnet";
+
+base {
+    other_field: 10,
+}
\ No newline at end of file
diff --git a/experimental/users/acmcarther/examples/jsonnet/lib/base.libsonnet b/experimental/users/acmcarther/examples/jsonnet/lib/base.libsonnet
new file mode 100644
index 0000000..a53710c
--- /dev/null
+++ b/experimental/users/acmcarther/examples/jsonnet/lib/base.libsonnet
@@ -0,0 +1,5 @@
+local k = import "external/+jsonnet_deps+github_com_jsonnet_libs_k8s_libsonnet_1_29/1.29/main.libsonnet";
+
+{
+  myNamespace: k.core.v1.namespace.new("example-namespace")
+}
\ No newline at end of file
diff --git a/experimental/users/acmcarther/examples/python_deps/BUILD.bazel b/experimental/users/acmcarther/examples/python_deps/BUILD.bazel
new file mode 100644
index 0000000..9ea2aac
--- /dev/null
+++ b/experimental/users/acmcarther/examples/python_deps/BUILD.bazel
@@ -0,0 +1,60 @@
+load("@aspect_rules_py//py:defs.bzl", "py_binary", "py_library", "py_pex_binary", "py_unpacked_wheel")
+load("@pip_third_party//:requirements.bzl", "requirement")
+
+py_binary(
+    name = "hello_fastapi",
+    srcs = ["hello_fastapi.py"],
+    deps = [
+        requirement("fastapi"),
+    ],
+)
+
+py_binary(
+    name = "hello_socketio",
+    srcs = ["hello_socketio.py"],
+    deps = [
+        requirement("python-socketio"),
+        requirement("asyncio"),
+        requirement("aiohttp"),
+    ],
+)
+
+py_binary(
+    name = "hello_requests",
+    srcs = ["hello_requests.py"],
+    deps = [
+        requirement("requests"),
+    ],
+)
+
+py_binary(
+    name = "hello_numpy",
+    srcs = ["hello_numpy.py"],
+    deps = [
+        requirement("numpy"),
+    ],
+)
+
+py_binary(
+    name = "hello_yaml",
+    srcs = ["hello_yaml.py"],
+    deps = [
+        requirement("pyyaml"),
+    ],
+)
+
+py_binary(
+    name = "hello_pandas",
+    srcs = ["hello_pandas.py"],
+    deps = [
+        requirement("pandas"),
+    ],
+)
+
+py_binary(
+    name = "hello_beautifulsoup",
+    srcs = ["hello_beautifulsoup.py"],
+    deps = [
+        requirement("beautifulsoup4"),
+    ],
+)
diff --git a/experimental/users/acmcarther/examples/python_deps/absl/BUILD.bazel b/experimental/users/acmcarther/examples/python_deps/absl/BUILD.bazel
new file mode 100644
index 0000000..52d1078
--- /dev/null
+++ b/experimental/users/acmcarther/examples/python_deps/absl/BUILD.bazel
@@ -0,0 +1,19 @@
+load("@aspect_rules_py//py:defs.bzl", "py_library", "py_test")
+load("@pip_third_party//:requirements.bzl", "requirement")
+
+py_library(
+    name = "example",
+    srcs = ["example.py"],
+    deps = [
+        requirement("absl-py"),
+    ],
+)
+
+py_test(
+    name = "example_test",
+    srcs = ["example_test.py"],
+    deps = [
+        ":example",
+        requirement("absl-py"),
+    ],
+)
diff --git a/experimental/users/acmcarther/examples/python_deps/absl/example.py b/experimental/users/acmcarther/examples/python_deps/absl/example.py
new file mode 100644
index 0000000..e69de29
diff --git a/experimental/users/acmcarther/examples/python_deps/absl/example_test.py b/experimental/users/acmcarther/examples/python_deps/absl/example_test.py
new file mode 100644
index 0000000..b3e94ce
--- /dev/null
+++ b/experimental/users/acmcarther/examples/python_deps/absl/example_test.py
@@ -0,0 +1,12 @@
+from absl.testing import absltest
+
+class SampleTest(absltest.TestCase):
+
+  def test_subtest(self):
+    for i in (1, 2):
+      with self.subTest(i=i):
+        self.assertEqual(i, i)
+        print('msg_for_test')
+
+if __name__ == '__main__':
+  absltest.main()
\ No newline at end of file
diff --git a/experimental/users/acmcarther/examples/python_deps/hello_beautifulsoup.py b/experimental/users/acmcarther/examples/python_deps/hello_beautifulsoup.py
new file mode 100644
index 0000000..0324282
--- /dev/null
+++ b/experimental/users/acmcarther/examples/python_deps/hello_beautifulsoup.py
@@ -0,0 +1,17 @@
+from bs4 import BeautifulSoup
+
+def main():
+    html_doc = """
+    <html><head><title>The Dormouse's story</title></head>
+    <body>
+    <p class="title"><b>The Dormouse's story</b></p>
+    <p class="story">Once upon a time...</p>
+    </body>
+    </html>
+    """
+    soup = BeautifulSoup(html_doc, 'html.parser')
+    print("Successfully parsed HTML:")
+    print(soup.title.string)
+
+if __name__ == "__main__":
+    main()
diff --git a/experimental/users/acmcarther/examples/python_deps/hello_fastapi.py b/experimental/users/acmcarther/examples/python_deps/hello_fastapi.py
new file mode 100644
index 0000000..9fb0155
--- /dev/null
+++ b/experimental/users/acmcarther/examples/python_deps/hello_fastapi.py
@@ -0,0 +1 @@
+print("hello fastapi")
diff --git a/experimental/users/acmcarther/examples/python_deps/hello_numpy.py b/experimental/users/acmcarther/examples/python_deps/hello_numpy.py
new file mode 100644
index 0000000..4f4b4bf
--- /dev/null
+++ b/experimental/users/acmcarther/examples/python_deps/hello_numpy.py
@@ -0,0 +1,8 @@
+import numpy as np
+
+def main():
+    arr = np.array([1, 2, 3])
+    print(f"Numpy array: {arr}")
+
+if __name__ == "__main__":
+    main()
diff --git a/experimental/users/acmcarther/examples/python_deps/hello_pandas.py b/experimental/users/acmcarther/examples/python_deps/hello_pandas.py
new file mode 100644
index 0000000..a213487
--- /dev/null
+++ b/experimental/users/acmcarther/examples/python_deps/hello_pandas.py
@@ -0,0 +1,10 @@
+import pandas as pd
+import numpy as np
+
+def main():
+    s = pd.Series([1, 3, 5, np.nan, 6, 8])
+    print("Successfully created pandas Series:")
+    print(s)
+
+if __name__ == "__main__":
+    main()
diff --git a/experimental/users/acmcarther/examples/python_deps/hello_requests.py b/experimental/users/acmcarther/examples/python_deps/hello_requests.py
new file mode 100644
index 0000000..c2cc10f
--- /dev/null
+++ b/experimental/users/acmcarther/examples/python_deps/hello_requests.py
@@ -0,0 +1,8 @@
+import requests
+
+def main():
+    response = requests.get("https://www.google.com")
+    print(f"Status Code: {response.status_code}")
+
+if __name__ == "__main__":
+    main()
diff --git a/experimental/users/acmcarther/examples/python_deps/hello_socketio.py b/experimental/users/acmcarther/examples/python_deps/hello_socketio.py
new file mode 100644
index 0000000..3bba3cf
--- /dev/null
+++ b/experimental/users/acmcarther/examples/python_deps/hello_socketio.py
@@ -0,0 +1,73 @@
+import asyncio
+import socketio
+from aiohttp import web
+
+# ---------------------------------------------------------------------------
+# Server setup
+# ---------------------------------------------------------------------------
+sio = socketio.AsyncServer(async_mode="aiohttp")
+app = web.Application()
+sio.attach(app)
+
+
+@sio.event
+async def connect(sid, environ):
+	print(f"Client connected: {sid}")
+	# Send a greeting to the newly connected client
+	await sio.emit("greeting", {"msg": "Hello from Socket.IO server!"}, to=sid)
+
+
+@sio.event
+async def disconnect(sid):
+	print(f"Client disconnected: {sid}")
+
+
+@sio.on("reply")
+async def on_reply(sid, data):
+	print(f"Received reply from client {sid}: {data}")
+
+
+async def start_server():
+	runner = web.AppRunner(app)
+	await runner.setup()
+	site = web.TCPSite(runner, "localhost", 5000)
+	await site.start()
+	print("Socket.IO server listening on http://localhost:5000")
+
+
+# ---------------------------------------------------------------------------
+# Client implementation (runs after a short delay to ensure the server is up)
+# ---------------------------------------------------------------------------
+async def start_client():
+	# Wait briefly for the server to be ready
+	await asyncio.sleep(1)
+	client = socketio.AsyncClient()
+
+	@client.event
+	async def connect():
+		print("Client connected to server")
+
+	@client.on("greeting")
+	async def on_greeting(data):
+		print(f"Server says: {data['msg']}")
+		# Slight delay before replying to ensure the namespace is fully ready
+		await asyncio.sleep(0.1)
+		await client.emit("reply", {"response": "Hello from client!"})
+
+	@client.event
+	async def disconnect():
+		print("Client disconnected")
+
+	await client.connect("http://localhost:5000")
+	# Keep the client alive for a short while to exchange messages
+	await asyncio.sleep(5)
+	await client.disconnect()
+
+
+async def main():
+	# Run server and client concurrently
+	await asyncio.gather(start_server(), start_client())
+
+
+if __name__ == "__main__":
+	asyncio.run(main())
diff --git a/experimental/users/acmcarther/examples/python_deps/hello_world.py b/experimental/users/acmcarther/examples/python_deps/hello_world.py
new file mode 100644
index 0000000..267f771
--- /dev/null
+++ b/experimental/users/acmcarther/examples/python_deps/hello_world.py
@@ -0,0 +1,5 @@
+def main():
+    print("Hello, Bazel!")
+
+if __name__ == "__main__":
+    main()
diff --git a/experimental/users/acmcarther/examples/python_deps/hello_yaml.py b/experimental/users/acmcarther/examples/python_deps/hello_yaml.py
new file mode 100644
index 0000000..8666a38
--- /dev/null
+++ b/experimental/users/acmcarther/examples/python_deps/hello_yaml.py
@@ -0,0 +1,15 @@
+import yaml
+
+def main():
+    doc = """
+    a: 1
+    b:
+      - c: 2
+      - d: 3
+    """
+    data = yaml.safe_load(doc)
+    print("Successfully loaded YAML:")
+    print(data)
+
+if __name__ == "__main__":
+    main()
diff --git a/experimental/users/acmcarther/examples/tanka/BUILD b/experimental/users/acmcarther/examples/tanka/BUILD
new file mode 100644
index 0000000..7c1b386
--- /dev/null
+++ b/experimental/users/acmcarther/examples/tanka/BUILD
@@ -0,0 +1,19 @@
+load("@rules_go//go:def.bzl", "go_binary", "go_library")
+
+go_binary(
+    name = "tanka",
+    embed = [":tanka_lib"],
+    visibility = ["//visibility:public"],
+)
+
+go_library(
+    name = "tanka_lib",
+    srcs = ["main.go"],
+    importpath = "forgejo.csbx.dev/acmcarther/yesod/experimental/users/acmcarther/examples/tanka",
+    visibility = ["//visibility:private"],
+    deps = [
+        "@com_github_grafana_tanka//pkg/kubernetes",
+        "@com_github_grafana_tanka//pkg/process",
+        "@com_github_grafana_tanka//pkg/spec/v1alpha1",
+    ],
+)
diff --git a/experimental/users/acmcarther/examples/tanka/dummy_spec.json b/experimental/users/acmcarther/examples/tanka/dummy_spec.json
new file mode 100644
index 0000000..f4e9744
--- /dev/null
+++ b/experimental/users/acmcarther/examples/tanka/dummy_spec.json
@@ -0,0 +1,14 @@
+{
+  "apiVersion": "tanka.dev/v1alpha1",
+  "kind": "Environment",
+  "metadata": {
+    "name": "experimental-env",
+    "namespace": "default"
+  },
+  "spec": {
+    "apiServer": "https://0.0.0.0:6443",
+    "namespace": "default",
+    "resourceDefaults": {},
+    "expectVersions": {}
+  }
+}
diff --git a/experimental/users/acmcarther/examples/tanka/main.go b/experimental/users/acmcarther/examples/tanka/main.go
new file mode 100644
index 0000000..1eb1118
--- /dev/null
+++ b/experimental/users/acmcarther/examples/tanka/main.go
@@ -0,0 +1,97 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"flag"
+	"fmt"
+	"os"
+
+	"github.com/grafana/tanka/pkg/kubernetes"
+	"github.com/grafana/tanka/pkg/process"
+	"github.com/grafana/tanka/pkg/spec/v1alpha1"
+)
+
+func main() {
+	specPath := flag.String("spec", "", "Path to spec.json")
+	mainPath := flag.String("main", "", "Path to main.json")
+	action := flag.String("action", "show", "Action to perform: show, diff, apply")
+	flag.Parse()
+
+	if *specPath == "" || *mainPath == "" {
+		fmt.Fprintln(os.Stderr, "Usage: tanka --spec <spec.json> --main <main.json> [--action <action>]")
+		os.Exit(1)
+	}
+
+	// 1. Load Spec
+	specData, err := os.ReadFile(*specPath)
+	if err != nil {
+		panic(fmt.Errorf("reading spec: %w", err))
+	}
+
+	var env v1alpha1.Environment
+	if err := json.Unmarshal(specData, &env); err != nil {
+		panic(fmt.Errorf("unmarshaling spec: %w", err))
+	}
+
+	// 2. Load Main (Data)
+	mainData, err := os.ReadFile(*mainPath)
+	if err != nil {
+		panic(fmt.Errorf("reading main: %w", err))
+	}
+
+	var rawData interface{}
+	if err := json.Unmarshal(mainData, &rawData); err != nil {
+		panic(fmt.Errorf("unmarshaling main: %w", err))
+	}
+	env.Data = rawData
+
+	// 3. Process (Extract, Label, Filter)
+	// We use empty matchers for now
+	list, err := process.Process(env, process.Matchers{})
+	if err != nil {
+		panic(fmt.Errorf("processing manifests: %w", err))
+	}
+
+	fmt.Printf("Processed %d manifests for env %s (namespace: %s)\n", len(list), env.Metadata.Name, env.Spec.Namespace)
+
+	if *action == "show" {
+		for _, m := range list {
+			fmt.Printf("- %s: %s\n", m.Kind(), m.Metadata().Name())
+		}
+		return
+	}
+
+	// 4. Initialize Kubernetes Client
+	// This will fail if no valid kubeconfig/context is found matching spec.json
+	kube, err := kubernetes.New(env)
+	if err != nil {
+		fmt.Printf("Warning: Failed to initialize Kubernetes client (expected if no cluster context): %v\n", err)
+		return
+	}
+	defer kube.Close()
+
+	// 5. Perform Action
+	switch *action {
+	case "diff":
+		fmt.Println("Running Diff...")
+		diff, err := kube.Diff(context.Background(), list, kubernetes.DiffOpts{})
+		if err != nil {
+			panic(err)
+		}
+		if diff != nil {
+			fmt.Println(*diff)
+		} else {
+			fmt.Println("No changes.")
+		}
+	case "apply":
+		fmt.Println("Running Apply...")
+		err := kube.Apply(list, kubernetes.ApplyOpts{})
+		if err != nil {
+			panic(err)
+		}
+		fmt.Println("Apply finished.")
+	default:
+		fmt.Printf("Unknown action: %s\n", *action)
+	}
+}
\ No newline at end of file
diff --git a/experimental/users/acmcarther/git-eradicate.sh b/experimental/users/acmcarther/git-eradicate.sh
new file mode 100755
index 0000000..5abc932
--- /dev/null
+++ b/experimental/users/acmcarther/git-eradicate.sh
@@ -0,0 +1,7 @@
+git filter-branch -f  --index-filter \
+    'git rm --force --cached --ignore-unmatch kubectl' \
+     -- --all
+rm -Rf .git/refs/original && \
+    git reflog expire --expire=now --all && \
+    git gc --aggressive && \
+    git prune
\ No newline at end of file
diff --git a/experimental/users/acmcarther/k8s/configs/environments/crossplane/BUILD.bazel b/experimental/users/acmcarther/k8s/configs/environments/crossplane/BUILD.bazel
new file mode 100644
index 0000000..c3f12b2
--- /dev/null
+++ b/experimental/users/acmcarther/k8s/configs/environments/crossplane/BUILD.bazel
@@ -0,0 +1,22 @@
+load("@rules_jsonnet//jsonnet:jsonnet.bzl", "jsonnet_to_json")
+load("//tools:tanka.bzl", "tanka_environment")
+
+jsonnet_to_json(
+    name = "main",
+    src = "main.jsonnet",
+    outs = ["main.json"],
+    data = [
+        "@helm_crossplane_crossplane//:chart",
+    ],
+    visibility = ["//visibility:public"],
+    deps = [
+        "//k8s/configs/templates",
+        "//experimental/users/acmcarther/k8s/configs/templates",
+    ],
+)
+
+tanka_environment(
+    name = "crossplane",
+    main = ":main",
+    spec = "spec.json",
+)
diff --git a/experimental/users/acmcarther/k8s/configs/environments/crossplane/main.jsonnet b/experimental/users/acmcarther/k8s/configs/environments/crossplane/main.jsonnet
new file mode 100644
index 0000000..0cc4ee6
--- /dev/null
+++ b/experimental/users/acmcarther/k8s/configs/environments/crossplane/main.jsonnet
@@ -0,0 +1,25 @@
+local base = import "k8s/configs/base.libsonnet";
+local crossplane = import "experimental/users/acmcarther/k8s/configs/templates/crossplane.libsonnet";
+
+local namespace = "crossplane-system";
+local ctx = base.NewContext(base.helm);
+
+{
+    namespace: {
+        apiVersion: "v1",
+        kind: "Namespace",
+        metadata: {
+            name: namespace,
+        },
+    },
+    apps: {
+        crossplane: crossplane.App(crossplane.Params {
+            namespace: namespace,
+            name: "crossplane",
+            context: ctx,
+            values: {
+                # Add any specific values here
+            },
+        }),
+    },
+}
diff --git a/experimental/users/acmcarther/k8s/configs/environments/crossplane/spec.json b/experimental/users/acmcarther/k8s/configs/environments/crossplane/spec.json
new file mode 100644
index 0000000..5eee3fa
--- /dev/null
+++ b/experimental/users/acmcarther/k8s/configs/environments/crossplane/spec.json
@@ -0,0 +1,15 @@
+{
+  "apiVersion": "tanka.dev/v1alpha1",
+  "kind": "Environment",
+  "metadata": {
+    "name": "environments/crossplane",
+    "namespace": "environments/crossplane/main.jsonnet"
+  },
+  "spec": {
+    "apiServer": "https://k8s.dominion.lan:6443",
+    "namespace": "crossplane-system",
+    "resourceDefaults": {},
+    "expectVersions": {},
+    "injectLabels": true
+  }
+}
diff --git a/experimental/users/acmcarther/k8s/configs/environments/dominion/BUILD.bazel b/experimental/users/acmcarther/k8s/configs/environments/dominion/BUILD.bazel
new file mode 100644
index 0000000..4c07776
--- /dev/null
+++ b/experimental/users/acmcarther/k8s/configs/environments/dominion/BUILD.bazel
@@ -0,0 +1,35 @@
+load("@rules_jsonnet//jsonnet:jsonnet.bzl", "jsonnet_library", "jsonnet_to_json", "jsonnet_to_json_test")
+load("//tools:tanka.bzl", "tanka_environment")
+load("//tools:sops.bzl", "sops_decrypt")
+
+sops_decrypt(
+    name = "secrets",
+    src = "secrets.sops.yaml",
+    out = "secrets.json",
+)
+
+jsonnet_library(
+    name = "secrets_lib",
+    srcs = [":secrets"],
+)
+
+jsonnet_to_json(
+    name = "main",
+    src = "main.jsonnet",
+    outs = ["main.json"],
+    data = [
+        "@helm_jetstack_cert_manager//:chart",
+    ],
+    visibility = ["//visibility:public"],
+    deps = [
+        ":secrets_lib",
+        "//k8s/configs/templates",
+        "//experimental/users/acmcarther/k8s/configs/templates",
+    ],
+)
+
+tanka_environment(
+    name = "dominion",
+    main = ":main",
+    spec = "spec.json",
+)
diff --git a/experimental/users/acmcarther/k8s/configs/environments/dominion/main.jsonnet b/experimental/users/acmcarther/k8s/configs/environments/dominion/main.jsonnet
new file mode 100644
index 0000000..a334df6
--- /dev/null
+++ b/experimental/users/acmcarther/k8s/configs/environments/dominion/main.jsonnet
@@ -0,0 +1,159 @@
+local base = import "k8s/configs/base.libsonnet";
+local secrets = import "experimental/users/acmcarther/k8s/configs/environments/dominion/secrets.json";
+
+local freshrss = import "k8s/configs/templates/personal/media/freshrss.libsonnet";
+local monica = import "k8s/configs/templates/personal/home/monica.libsonnet";
+local jellyfin = import "k8s/configs/templates/personal/media/jellyfin.libsonnet";
+local transmission = import "k8s/configs/templates/personal/media/transmission.libsonnet";
+
+local lanraragi = import "experimental/users/acmcarther/k8s/configs/templates/lanraragi.libsonnet";
+
+local nginxIngress = import "k8s/configs/templates/core/network/nginx-ingress.libsonnet";
+local mariadb = import "k8s/configs/templates/core/storage/mariadb.libsonnet";
+
+local namespace = "dominion";
+{
+    namespace: {
+        apiVersion: "v1",
+        kind: "Namespace",
+        metadata: {
+            name: namespace,
+        },
+    },
+    secrets: {
+        monica: mariadb.Secret(mariadb.SecretParams{
+            name: "monica",
+            namespace: "dominion",
+            rootPassword: secrets.monica_mariadb_root_db_pwd,
+            password: secrets.monica_mariadb_db_pwd,
+        }),
+    },
+    apps: {
+        /*
+        jellyfin: {
+            app: jellyfin.App(jellyfin.Params {
+                namespace: namespace,
+                name: "jellyfin",
+                filePath: std.thisFile,
+                // Defined in "dominion"
+                configClaimName: "jellyfin-config",
+                // Defined in "dominion"
+                serialClaimName: "serial-lake",
+                // Defined in "dominion"
+                filmClaimName: "film-lake",
+                // Defined in "dominion"
+                transcodeClaimName: "jellyfin-transcode",
+            }),
+            ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "jellyfin-ion",
+                hosts: [
+                    "ion.cheapassbox.com",
+                ],
+                serviceName: "jellyfin-vui",
+            }),
+            pvcs: {
+                pvcJellyfinConfig: kube.RecoverableSimpleManyPvc(namespace, "jellyfin-config", "nfs-client", "10Gi", {
+                    volumeName: "pvc-287055fe-b436-11e9-bad8-b8aeed7dc356",
+                    nfsPath: "/volume3/fs/dominion-jellyfin-config-pvc-287055fe-b436-11e9-bad8-b8aeed7dc356",
+                    nfsServer: "apollo1.dominion.lan",
+                }),
+                pvcJellyfinTranscode: kube.RecoverableSimpleManyPvc(namespace, "jellyfin-transcode", "nfs-client", "200Gi", {
+                    volumeName: "pvc-2871f840-b436-11e9-bad8-b8aeed7dc356",
+                    nfsPath: "/volume3/fs/dominion-jellyfin-transcode-pvc-2871f840-b436-11e9-bad8-b8aeed7dc356",
+                    nfsServer: "apollo1.dominion.lan",
+                }),
+                //  NOTE: These are different!
+                pvcSerialLake: kube.RecoverableSimpleManyPvc(namespace, "serial-lake", "nfs-bulk", "160Gi", {
+                    volumeName: "pvc-2873b76a-b436-11e9-bad8-b8aeed7dc356",
+                    nfsPath: "/volume4/fs-bulk/dominion-serial-lake-pvc-2873b76a-b436-11e9-bad8-b8aeed7dc356",
+                    nfsServer: "apollo2.dominion.lan",
+                }),
+                pvcFilmLake: kube.RecoverableSimpleManyPvc(namespace, "film-lake", "nfs-bulk", "80Gi", {
+                    volumeName: "pvc-286ce6ea-b436-11e9-bad8-b8aeed7dc356",
+                    nfsPath: "/volume4/fs-bulk/dominion-film-lake-pvc-286ce6ea-b436-11e9-bad8-b8aeed7dc356",
+                    nfsServer: "apollo2.dominion.lan",
+                }),
+            },
+        },
+        */
+        freshrss: {
+            configPvc: base.RecoverableSimplePvc(namespace, "freshrss-config", "nfs-client", "32Gi", {
+                volumeName: "pvc-26b893fc-c3bf-11e9-8ccb-b8aeed7dc356",
+                nfsPath: "/volume3/fs/dominion-freshrss-config-pvc-26b893fc-c3bf-11e9-8ccb-b8aeed7dc356",
+                nfsServer: "apollo1.dominion.lan",
+            }),
+            app: freshrss.App(freshrss.Params {
+                namespace: namespace,
+                name: "freshrss",
+                filePath: std.thisFile,
+                // Defined in "dominion"
+                configClaimName: "freshrss-config",
+            }),
+            ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "freshrss",
+                hosts: [
+                    "rss.cheapassbox.com",
+                ],
+                serviceName: "freshrss-ui",
+                annotations: nginxIngress.KubeOauthProxyAnnotations,
+            }),
+            ingress2: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "freshrss-csbx",
+                hosts: [
+                    "rss.csbx.dev",
+                ],
+                serviceName: "freshrss-ui",
+                annotations: nginxIngress.KubeCsbxOauthProxyAnnotations,
+            }),
+        },
+        transmission2: {
+            configPvc: base.RecoverableSimpleManyPvc(namespace, "transmission-config", "nfs-client", "50Mi", {
+                volumeName: "pvc-3d93c19b-c177-11e9-8ccb-b8aeed7dc356",
+                nfsPath: "/volume3/fs/dominion-transmission-config-pvc-3d93c19b-c177-11e9-8ccb-b8aeed7dc356",
+                nfsServer: "apollo1.dominion.lan",
+            }),
+            torrentFilesPvc: base.RecoverableSimpleManyPvc(namespace, "torrent-files", "nfs-client", "100Mi", {
+                volumeName: "pvc-73528d8b-c177-11e9-8ccb-b8aeed7dc356",
+                nfsPath: "/volume3/fs/dominion-torrent-files-pvc-73528d8b-c177-11e9-8ccb-b8aeed7dc356",
+                nfsServer: "apollo1.dominion.lan",
+            }),
+            incompleteDownloadsPvc: base.RecoverableSimpleManyPvc(namespace, "transmission-incomplete-downloads", "nfs-bulk", "100Gi", {
+                volumeName: "pvc-1c1a00ff-b9a8-4f92-b3a7-70f81752141d",
+                nfsPath: "/volume4/fs-bulk/dominion-transmission-incomplete-downloads-pvc-1c1a00ff-b9a8-4f92-b3a7-70f81752141d",
+                nfsServer: "apollo2.dominion.lan",
+            }),
+            app: transmission.App(transmission.Params {
+                namespace: namespace,
+                name: "transmission2",
+                filePath: std.thisFile,
+                configClaimName: "transmission-config",
+                incompleteDownloadsClaimName: "transmission-incomplete-downloads",
+                downloadsClaimName: "lanraragi-content",
+                torrentFilesClaimName: "torrent-files",
+                // TODO(acmcarther): Import from central location
+                dataNodePort: 32701,
+            }),
+            ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "transmission",
+                hosts: [
+                    "ex-transmission.cheapassbox.com",
+                ],
+                serviceName: "transmission2-ui",
+                annotations: nginxIngress.DominionOauthProxyAnnotations,
+            }),
+            ingress2: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "transmission-csbx",
+                hosts: [
+                    "ex-transmission.csbx.dev",
+                ],
+                serviceName: "transmission2-ui",
+                annotations: nginxIngress.DominionCsbxOauthProxyAnnotations,
+            }),
+        },
+    },
+}
\ No newline at end of file
diff --git a/experimental/users/acmcarther/k8s/configs/environments/dominion/spec.json b/experimental/users/acmcarther/k8s/configs/environments/dominion/spec.json
new file mode 100644
index 0000000..39be0d0
--- /dev/null
+++ b/experimental/users/acmcarther/k8s/configs/environments/dominion/spec.json
@@ -0,0 +1,15 @@
+{
+  "apiVersion": "tanka.dev/v1alpha1",
+  "kind": "Environment",
+  "metadata": {
+    "name": "environments/dominion",
+    "namespace": "environments/dominion/main.jsonnet"
+  },
+  "spec": {
+    "apiServer": "https://k8s.dominion.lan:6443",
+    "namespace": "dominion",
+    "resourceDefaults": {},
+    "expectVersions": {},
+    "injectLabels": true
+  }
+}
diff --git a/experimental/users/acmcarther/k8s/configs/environments/semantic-search/BUILD.bazel b/experimental/users/acmcarther/k8s/configs/environments/semantic-search/BUILD.bazel
new file mode 100644
index 0000000..0e23cb7
--- /dev/null
+++ b/experimental/users/acmcarther/k8s/configs/environments/semantic-search/BUILD.bazel
@@ -0,0 +1,21 @@
+load("@rules_jsonnet//jsonnet:jsonnet.bzl", "jsonnet_library", "jsonnet_to_json", "jsonnet_to_json_test")
+load("//tools:tanka.bzl", "tanka_environment")
+
+jsonnet_to_json(
+    name = "main",
+    src = "main.jsonnet",
+    outs = ["main.json"],
+    data = [
+    ],
+    visibility = ["//visibility:public"],
+    deps = [
+        "//k8s/configs/templates",
+        "//experimental/users/acmcarther/k8s/configs/templates",
+    ],
+)
+
+tanka_environment(
+    name = "semantic-search",
+    main = ":main",
+    spec = "spec.json",
+)
diff --git a/experimental/users/acmcarther/k8s/configs/environments/semantic-search/main.jsonnet b/experimental/users/acmcarther/k8s/configs/environments/semantic-search/main.jsonnet
new file mode 100644
index 0000000..15aeeba
--- /dev/null
+++ b/experimental/users/acmcarther/k8s/configs/environments/semantic-search/main.jsonnet
@@ -0,0 +1,37 @@
+local base = import "k8s/configs/base.libsonnet";
+local semanticSearch = import "experimental/users/acmcarther/k8s/configs/templates/semantic-search.libsonnet";
+local nginxIngress = import "k8s/configs/templates/core/network/nginx-ingress.libsonnet";
+
+local namespace = "semantic-search";
+local appName = "semantic-search-server";
+
+{
+    namespace: {
+        apiVersion: "v1",
+        kind: "Namespace",
+        metadata: {
+            name: namespace,
+        },
+    },
+    pvc: base.RecoverableSimpleManyPvc(namespace, appName + "-data", "nfs-client", "2Gi", {
+        volumeName: "pvc-a10eadb8-b2a3-45b2-a50b-83ab11ae7f39",
+        nfsPath: "/volume3/fs/semantic-search-semantic-search-server-data-pvc-a10eadb8-b2a3-45b2-a50b-83ab11ae7f39",
+        nfsServer: "apollo1.dominion.lan",
+    }),
+    apps: {
+        server: semanticSearch.App(semanticSearch.Params {
+            namespace: namespace,
+            name: appName,
+            filePath: std.thisFile,
+            dataClaimName: appName + "-data",
+        }),
+        ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+            namespace: namespace,
+            name: appName,
+            hosts: [
+                "search.csbx.dev",
+            ],
+            serviceName: appName + "-ui",
+        }),
+    },
+}
\ No newline at end of file
diff --git a/experimental/users/acmcarther/k8s/configs/environments/semantic-search/spec.json b/experimental/users/acmcarther/k8s/configs/environments/semantic-search/spec.json
new file mode 100644
index 0000000..e23c880
--- /dev/null
+++ b/experimental/users/acmcarther/k8s/configs/environments/semantic-search/spec.json
@@ -0,0 +1,14 @@
+{
+  "apiVersion": "tanka.dev/v1alpha1",
+  "kind": "Environment",
+  "metadata": {
+    "name": "environments/semantic-search"
+  },
+  "spec": {
+    "apiServer": "https://k8s.dominion.lan:6443",
+    "namespace": "semantic-search",
+    "resourceDefaults": {},
+    "expectVersions": {},
+    "injectLabels": true
+  }
+}
diff --git a/experimental/users/acmcarther/k8s/configs/environments/vault/BUILD.bazel b/experimental/users/acmcarther/k8s/configs/environments/vault/BUILD.bazel
new file mode 100644
index 0000000..10f401b
--- /dev/null
+++ b/experimental/users/acmcarther/k8s/configs/environments/vault/BUILD.bazel
@@ -0,0 +1,21 @@
+load("@rules_jsonnet//jsonnet:jsonnet.bzl", "jsonnet_library", "jsonnet_to_json", "jsonnet_to_json_test")
+load("//tools:tanka.bzl", "tanka_environment")
+
+jsonnet_to_json(
+    name = "main",
+    src = "main.jsonnet",
+    outs = ["main.json"],
+    data = [
+        "@helm_hashicorp_vault//:chart",
+    ],
+    visibility = ["//visibility:public"],
+    deps = [
+        "//k8s/configs/templates",
+    ],
+)
+
+tanka_environment(
+    name = "vault",
+    main = ":main",
+    spec = "spec.json",
+)
diff --git a/experimental/users/acmcarther/k8s/configs/environments/vault/main.jsonnet b/experimental/users/acmcarther/k8s/configs/environments/vault/main.jsonnet
new file mode 100644
index 0000000..082696c
--- /dev/null
+++ b/experimental/users/acmcarther/k8s/configs/environments/vault/main.jsonnet
@@ -0,0 +1,83 @@
+local base = import "k8s/configs/base.libsonnet";
+local nginxIngress = import "k8s/configs/templates/core/network/nginx-ingress.libsonnet";
+local vault = import "k8s/configs/templates/core/security/vault.libsonnet";
+
+local namespace = "vault";
+local ctx = base.NewContext(base.helm);
+{
+    namespace: {
+        apiVersion: "v1",
+        kind: "Namespace",
+        metadata: {
+            name: namespace,
+        },
+    },
+    apps: {
+        /*
+        consul: consul.App(consul.Params {
+            namespace: namespace,
+            context: ctx,
+            bootstrapTokenSecretName: "consul-bootstrap-acl-token",
+        }),
+        */
+        vault: vault.App(vault.Params {
+            namespace: namespace,
+            context: ctx,
+        }),
+        /*
+        vaultIngress1: nginxIngress.Ingress(nginxIngress.IngressParams {
+            namespace: namespace,
+            name: "vault",
+            hosts: [
+                "vault.cheapassbox.com",
+            ],
+            serviceName: "vault", # TODO
+            annotations: nginxIngress.KubeOauthProxyAnnotations,
+        }),
+        */
+        vaultIngress2: nginxIngress.Ingress(nginxIngress.IngressParams {
+            namespace: namespace,
+            name: "vault-csbx",
+            hosts: [
+                "vault.csbx.dev",
+            ],
+            serviceName: "vault-ui", # TODO
+            servicePort: 8200,
+            annotations: nginxIngress.KubeCsbxOauthProxyAnnotations,
+        }),
+    },
+    volumes: {
+        data0: base.RecoverableSimplePvc(namespace, "data-vault-0", "nfs-client", "10Gi", {
+            volumeName: "pvc-0aa9f845-baef-476b-971f-8cd30932b874",
+            nfsPath: "/volume3/fs/vault-data-vault-0-pvc-0aa9f845-baef-476b-971f-8cd30932b874",
+            nfsServer: "apollo1.dominion.lan",
+        }),
+        data1: base.RecoverableSimplePvc(namespace, "data-vault-1", "nfs-client", "10Gi", {
+            volumeName: "pvc-90241eff-1ed4-49e0-87bb-8485cd0f6aca",
+            nfsPath: "/volume3/fs/vault-data-vault-1-pvc-90241eff-1ed4-49e0-87bb-8485cd0f6aca",
+            nfsServer: "apollo1.dominion.lan",
+        }),
+        data2: base.RecoverableSimplePvc(namespace, "data-vault-2", "nfs-client", "10Gi", {
+            volumeName: "pvc-5c23b9b5-3fbf-4898-9784-83d9bbef185c",
+            nfsPath: "/volume3/fs/vault-data-vault-2-pvc-5c23b9b5-3fbf-4898-9784-83d9bbef185c",
+            nfsServer: "apollo1.dominion.lan",
+        }),
+        audit0: base.RecoverableSimplePvc(namespace, "audit-vault-0", "nfs-client", "10Gi", {
+            volumeName: "pvc-1d037ee0-836c-4079-a96f-f61ed13c9626",
+            nfsPath: "/volume3/fs/vault-audit-vault-0-pvc-1d037ee0-836c-4079-a96f-f61ed13c9626",
+            nfsServer: "apollo1.dominion.lan",
+        }),
+        audit1: base.RecoverableSimplePvc(namespace, "audit-vault-1", "nfs-client", "10Gi", {
+            volumeName: "pvc-6f63b89d-b007-440a-adea-b503b885b914",
+            nfsPath: "/volume3/fs/vault-audit-vault-1-pvc-6f63b89d-b007-440a-adea-b503b885b914",
+            nfsServer: "apollo1.dominion.lan",
+        }),
+        audit2: base.RecoverableSimplePvc(namespace, "audit-vault-2", "nfs-client", "10Gi", {
+            volumeName: "pvc-44121280-3a8c-4252-abe2-95e177e78efc",
+            nfsPath: "/volume3/fs/vault-audit-vault-2-pvc-44121280-3a8c-4252-abe2-95e177e78efc",
+            nfsServer: "apollo1.dominion.lan",
+        }),
+
+    },
+
+}
\ No newline at end of file
diff --git a/experimental/users/acmcarther/k8s/configs/environments/vault/spec.json b/experimental/users/acmcarther/k8s/configs/environments/vault/spec.json
new file mode 100644
index 0000000..bcae0ea
--- /dev/null
+++ b/experimental/users/acmcarther/k8s/configs/environments/vault/spec.json
@@ -0,0 +1,15 @@
+{
+  "apiVersion": "tanka.dev/v1alpha1",
+  "kind": "Environment",
+  "metadata": {
+    "name": "environments/vault",
+    "namespace": "environments/vault/main.jsonnet"
+  },
+  "spec": {
+    "apiServer": "https://k8s.dominion.lan:6443",
+    "namespace": "vault",
+    "resourceDefaults": {},
+    "expectVersions": {},
+    "injectLabels": true
+  }
+}
diff --git a/experimental/users/acmcarther/k8s/configs/templates/BUILD.bazel b/experimental/users/acmcarther/k8s/configs/templates/BUILD.bazel
new file mode 100644
index 0000000..c40f224
--- /dev/null
+++ b/experimental/users/acmcarther/k8s/configs/templates/BUILD.bazel
@@ -0,0 +1,12 @@
+load("@rules_jsonnet//jsonnet:jsonnet.bzl", "jsonnet_library", "jsonnet_to_json", "jsonnet_to_json_test")
+
+jsonnet_library(
+    name = "templates",
+    srcs = glob(include = ["**/*.libsonnet"]),
+    visibility = ["//visibility:public"],
+    deps = [
+        "//k8s/configs:base",
+        "//k8s/configs:images",
+        "//k8s/configs/templates",
+    ],
+)
diff --git a/experimental/users/acmcarther/k8s/configs/templates/crossplane.libsonnet b/experimental/users/acmcarther/k8s/configs/templates/crossplane.libsonnet
new file mode 100644
index 0000000..a2dafa1
--- /dev/null
+++ b/experimental/users/acmcarther/k8s/configs/templates/crossplane.libsonnet
@@ -0,0 +1,29 @@
+local base = import "k8s/configs/base.libsonnet";
+
+local Params = base.SimpleFieldStruct([
+    "namespace",
+    "name",
+    "context",
+    "values",
+]);
+
+local App(params) = {
+    # The chart is provided by the @helm_crossplane_crossplane repository.
+    # Note: The path construction might need adjustment depending on how helm_deps handles the repo name.
+    # In chartfile.yaml, repo name is 'crossplane'.
+    local chartPath = "../../external/+helm_deps+helm_crossplane_crossplane",
+    
+    app: params.context.helm.template(params.name, chartPath, {
+        namespace: params.namespace,
+        values: params.values,
+        # Crossplane often needs includeCRDs: true or similar if it's not default in values.
+        # But for helm template, it's usually handled by includeCRDs option in the helm function if supported
+        # or just let helm handle it. Tanka's helm.template usually passes args to `helm template`.
+        includeCRDs: true,
+    })
+};
+
+{
+    Params: Params,
+    App: App,
+}
diff --git a/experimental/users/acmcarther/k8s/configs/templates/lanraragi.libsonnet b/experimental/users/acmcarther/k8s/configs/templates/lanraragi.libsonnet
new file mode 100644
index 0000000..3ea74a2
--- /dev/null
+++ b/experimental/users/acmcarther/k8s/configs/templates/lanraragi.libsonnet
@@ -0,0 +1,113 @@
+local kube = import "k8s/configs/base.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+local templates = import "k8s/configs/templates/templates.libsonnet";
+
+local WebPort = 3000;
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "contentClaimName",
+  "databaseClaimName",
+  "thumbClaimName",
+  "filePath",
+]) {
+  image: images.Prod["difegue/lanraragi"],
+  webPort: WebPort,
+  gatekeeperSidecar: null,
+  resources: {
+    requests: {
+      cpu: "1000m",
+      memory: "1000Mi",
+    },
+    limits: {
+      cpu: "2000m",
+      memory: "2000Mi",
+    },
+  },
+};
+
+local App(params) = {
+  local nskube = kube.UsingNamespace(params.namespace),
+  local selector = {
+    name: params.name,
+    phase: "prod",
+  },
+  local selectorMixin = {
+    selector: selector
+  },
+  service: nskube.Service(params.name + '-ui') {
+    spec+: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort) {
+      selector: selector
+    }
+  },
+  deployment: nskube.Deployment(params.name) {
+    metadata+: {
+      annotations: templates.annotations(params.filePath, std.thisFile),
+    },
+    spec+: {
+      strategy: kube.DeployUtil.SimpleRollingUpdate(),
+      replicas: 1,
+      selector: {
+        matchLabels: selector,
+      },
+      template: {
+        metadata: {
+          labels: selector,
+          annotations: templates.annotations(params.filePath, std.thisFile),
+        },
+        spec+: {
+          imagePullSecrets: [
+            {
+              name: "docker-auth",
+            }
+          ],
+          containers: [
+            {
+              image: params.image,
+              name: "lanraragi",
+              ports: [
+                kube.DeployUtil.ContainerPort("http", params.webPort),
+              ],
+              resources: params.resources,
+              readinessProbe: {
+                httpGet: {
+                  path: "/",
+                  port: params.webPort,
+                },
+                initialDelaySeconds: 30,
+              },
+
+              livenessProbe: {
+                httpGet: {
+                  path: "/",
+                  port: params.webPort,
+                },
+                initialDelaySeconds: 30,
+                periodSeconds: 15,
+                failureThreshold: 10 
+              },
+              args: [],
+              volumeMounts: [
+                 kube.DeployUtil.VolumeMount("content", "/home/koyomi/lanraragi/content"),
+                 kube.DeployUtil.VolumeMount("database", "/home/koyomi/lanraragi/database"),
+                 kube.DeployUtil.VolumeMount("thumb", "/home/koyomi/lanraragi/thumb"),
+              ]
+            },
+          ],
+          volumes: [
+            kube.DeployUtil.VolumeClaimRef("content", params.contentClaimName),
+            kube.DeployUtil.VolumeClaimRef("database", params.databaseClaimName),
+            kube.DeployUtil.VolumeClaimRef("thumb", params.thumbClaimName),
+          ],
+        }
+      },
+    },
+  }
+};
+
+{
+  WebPort: WebPort,
+  Params: Params,
+  App(params): App(params),
+}
diff --git a/experimental/users/acmcarther/k8s/configs/templates/naifu2.libsonnet b/experimental/users/acmcarther/k8s/configs/templates/naifu2.libsonnet
new file mode 100644
index 0000000..502a9db
--- /dev/null
+++ b/experimental/users/acmcarther/k8s/configs/templates/naifu2.libsonnet
@@ -0,0 +1,126 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local probe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 20,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local WebPort = 7860;
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "storageClaimName",
+  "outputClaimName",
+  //"ingressHost",
+]) {
+  labels: {},
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "naifu",
+    imageName: "naifu2",
+    imagePullSecrets: ["regcred"],
+    labels+: $.labels,
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    isPrivileged: true,
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: {
+          type: "ClusterIP",
+          ports: [
+            kube.SvcUtil.TCPServicePort("http", 80) {
+              targetPort: WebPort
+            },
+          ],
+        },
+      },
+    ],
+    nodeSelector: {
+      "gpu": "nvidia"
+    },
+    ports: [ 
+      kube.DeployUtil.ContainerPort("http", WebPort), 
+    ],
+    env: linuxserver.Env {
+      others: [
+        kube.NameVal("CLI_ARGS", "--allow-code --ui-config-file /stable-diffusion-webui/models/Stable-diffusion/ui-config.json --styles-file /stable-diffusion-webui/models/Stable-diffusion/styles.csv --deepdanbooru"),
+        kube.NameVal("NVIDIA_VISIBLE_DEVICES", "all"),
+        //kube.NameVal("CLI_FLAGS", "--extra-models-cpu --optimized-turbo"),
+        //--precision full --no-half
+        //kube.NameVal("CLI_FLAGS", "--no-half"),
+        //kube.NameVal("CUDA_VISIBLE_DEVICES", "0"),
+        #kube.NameVal("TOKEN", "example-token"),
+      ]
+    },
+    args: [
+    ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "naifu-storage",
+        mountPath: "/data",
+        bindName: $.storageClaimName,
+      },
+      linuxserver.Pvc{
+        name: "naifu-output",
+        mountPath: "/output",
+        bindName: $.outputClaimName,
+      },
+
+    ],
+    hostPaths: [
+      linuxserver.HostPath{
+        name: "nvidia-nvidia-uvm",
+        hostPath: "/dev/nvidia-uvm",
+        mountPath: "/dev/nvidia-uvm",
+      },
+      linuxserver.HostPath{
+        name: "nvidia-nvidia0",
+        hostPath: "/dev/nvidia0",
+        mountPath: "/dev/nvidia0",
+      },
+      linuxserver.HostPath{
+        name: "nvidia-nvidiactrl",
+        hostPath: "/dev/nvidiactrl",
+        mountPath: "/dev/nvidiactrl",
+      },
+      linuxserver.HostPath{
+        name: "nvidia-drivers",
+        hostPath: "/opt/drivers/nvidia",
+        mountPath: "/usr/local/nvidia",
+      },
+
+    ],
+    resources: {
+      requests: {
+        cpu: "1000m",
+        memory: "12000Mi",
+      },
+      limits: {
+        cpu: "4000m",
+        memory: "24000Mi",
+      },
+    },
+    //livenessProbe: probe(/*delaySeconds=*/60),
+    //readinessProbe: probe(/*delaySeconds=*/60),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams) {
+};
+
+{
+  WebPort: WebPort,
+  Params: Params,
+  App(params): App(params),
+}
diff --git a/experimental/users/acmcarther/k8s/configs/templates/semantic-search.libsonnet b/experimental/users/acmcarther/k8s/configs/templates/semantic-search.libsonnet
new file mode 100644
index 0000000..44aed8f
--- /dev/null
+++ b/experimental/users/acmcarther/k8s/configs/templates/semantic-search.libsonnet
@@ -0,0 +1,89 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local searchProbe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 30,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local WebPort = 8000;
+local DataDir = "/app/ai/data/vectordb";
+local ModelCacheDir = DataDir + "/models";
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "dataClaimName",
+]) {
+  labels: {},
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "semantic-search",
+    imageName: "semantic-search-server",
+    labels+: $.labels,
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    env+: linuxserver.Env {
+        others: [
+            kube.NameVal("TRANSFORMERS_CACHE", ModelCacheDir),
+        ],
+    },
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+      },
+    ],
+    ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+    pvcs: [
+      linuxserver.Pvc {
+        name: "data",
+        mountPath: DataDir,
+        bindName: $.dataClaimName,
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "100m",
+        memory: "512Mi",
+      },
+      limits: {
+        cpu: "500m",
+        memory: "2Gi",
+      },
+    },
+    livenessProbe: searchProbe(/*delaySeconds=*/60),
+    readinessProbe: searchProbe(/*delaySeconds=*/60),
+  },
+};
+
+local App(params) =
+  local baseApp = linuxserver.App(params.lsParams);
+  baseApp {
+    deployment+: {
+      spec+: {
+        template+: {
+          spec+: {
+            containers: [
+              c { imagePullPolicy: "Always" }
+              for c in super.containers
+            ],
+          },
+        },
+      },
+    },
+  };
+
+{
+  Params: Params,
+  WebPort: WebPort,
+  App(params): App(params),
+}
diff --git a/experimental/users/acmcarther/k8s/configs/templates/static-site.libsonnet b/experimental/users/acmcarther/k8s/configs/templates/static-site.libsonnet
new file mode 100644
index 0000000..821450b
--- /dev/null
+++ b/experimental/users/acmcarther/k8s/configs/templates/static-site.libsonnet
@@ -0,0 +1,58 @@
+// A template for deploying a generic static website with Nginx.
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local WebPort = 80;
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "dataClaimName",
+]) {
+  labels: {},
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "static-site",
+    imageName: "nginx:1.29.1-alpine",
+    labels+: $.labels,
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+      },
+    ],
+    ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "static-content",
+        mountPath: "/usr/share/nginx/html",
+        bindName: $.dataClaimName,
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "10m",
+        memory: "32Mi",
+      },
+      limits: {
+        cpu: "50m",
+        memory: "64Mi",
+      },
+    },
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams);
+
+{
+  Params: Params,
+  WebPort: WebPort,
+  App(params): App(params),
+}
\ No newline at end of file
diff --git a/experimental/users/acmcarther/llm/litellm/BUILD.bazel b/experimental/users/acmcarther/llm/litellm/BUILD.bazel
new file mode 100644
index 0000000..de7cc25
--- /dev/null
+++ b/experimental/users/acmcarther/llm/litellm/BUILD.bazel
@@ -0,0 +1,97 @@
+load("@aspect_rules_py//py:defs.bzl", "py_binary", "py_library", "py_pex_binary")
+load("@pip_third_party//:requirements.bzl", "requirement")
+
+py_binary(
+    name = "litellm_agent",
+    srcs = ["litellm_agent.py"],
+    main = "litellm_agent.py",
+    visibility = ["//scripts:__pkg__"],
+    deps = [
+        requirement("litellm"),
+        requirement("python-dotenv"),
+        requirement("typer"),
+    ],
+)
+
+py_pex_binary(
+    name = "litellm_agent_pex",
+    binary = ":litellm_agent",
+    visibility = ["//scripts:__pkg__"],
+)
+
+py_binary(
+    name = "test_01_basic_connectivity",
+    srcs = ["test_01_basic_connectivity.py"],
+    main = "test_01_basic_connectivity.py",
+    visibility = ["//scripts:__pkg__"],
+    deps = [
+        requirement("litellm"),
+        requirement("python-dotenv"),
+    ],
+)
+
+py_binary(
+    name = "test_02_system_prompt",
+    srcs = ["test_02_system_prompt.py"],
+    main = "test_02_system_prompt.py",
+    visibility = ["//scripts:__pkg__"],
+    deps = [
+        requirement("litellm"),
+        requirement("python-dotenv"),
+    ],
+)
+
+py_binary(
+    name = "test_03_multi_turn",
+    srcs = ["test_03_multi_turn.py"],
+    main = "test_03_multi_turn.py",
+    visibility = ["//scripts:__pkg__"],
+    deps = [
+        requirement("litellm"),
+        requirement("python-dotenv"),
+    ],
+)
+
+py_binary(
+    name = "test_04_function_calling",
+    srcs = ["test_04_function_calling.py"],
+    main = "test_04_function_calling.py",
+    visibility = ["//scripts:__pkg__"],
+    deps = [
+        requirement("litellm"),
+        requirement("python-dotenv"),
+    ],
+)
+
+py_binary(
+    name = "test_04_debug_function_calling",
+    srcs = ["test_04_debug_function_calling.py"],
+    main = "test_04_debug_function_calling.py",
+    visibility = ["//scripts:__pkg__"],
+    deps = [
+        requirement("litellm"),
+        requirement("python-dotenv"),
+    ],
+)
+
+py_binary(
+    name = "test_05_error_handling",
+    srcs = ["test_05_error_handling.py"],
+    main = "test_05_error_handling.py",
+    visibility = ["//scripts:__pkg__"],
+    deps = [
+        requirement("litellm"),
+        requirement("python-dotenv"),
+    ],
+)
+
+py_binary(
+    name = "test_integration_comprehensive",
+    srcs = ["test_integration_comprehensive.py"],
+    main = "test_integration_comprehensive.py",
+    visibility = ["//scripts:__pkg__"],
+    deps = [
+        requirement("litellm"),
+        requirement("python-dotenv"),
+    ],
+)
diff --git a/experimental/users/acmcarther/llm/litellm/LITELOCAL_INTEGRATION_FINDINGS.md b/experimental/users/acmcarther/llm/litellm/LITELOCAL_INTEGRATION_FINDINGS.md
new file mode 100644
index 0000000..cf6d922
--- /dev/null
+++ b/experimental/users/acmcarther/llm/litellm/LITELOCAL_INTEGRATION_FINDINGS.md
@@ -0,0 +1,189 @@
+# Local Model Integration Findings & Requirements
+
+## Executive Summary
+
+This document summarizes the comprehensive testing of LiteLLM integration with local models (specifically Qwen3-Coder-30B) and provides requirements for retrofitting the agent harness to support local model execution.
+
+## Test Results Overview
+
+| Test | Status | Key Findings |
+|------|--------|--------------|
+| 1. Basic Connectivity | ✅ PASS | Stable connection, reliable responses |
+| 2. System Prompts | ✅ PASS | Excellent persona compliance and context adherence |
+| 3. Multi-Turn Conversation | ✅ PASS | Strong context retention and evolution capabilities |
+| 4. Function Calling | ⚠️ LIMITED | No native support, but manual JSON parsing works |
+| 5. Error Handling | ✅ PASS | Robust error recovery and graceful failure handling |
+
+## Critical Technical Findings
+
+### 1. Function Calling Limitation
+
+**Issue**: The local model does not support native OpenAI-style function calling via the `tools` parameter.
+
+**Impact**: This requires a fundamental change in how agent tools are invoked and processed.
+
+**Solution**: Implement manual tool parsing with explicit JSON instruction prompts.
+
+### 2. Response Quality
+
+**Strengths**: 
+- Excellent system prompt compliance
+- Strong conversational context management
+- High-quality code generation and analysis
+- Robust error handling
+
+**Considerations**:
+- Slightly slower response times compared to cloud APIs (expected)
+- No rate limiting issues observed
+- Consistent behavior across multiple test runs
+
+## Integration Requirements
+
+### A. Harness Retrofit Requirements
+
+#### 1. Tool System Redesign
+
+**Current Implementation**: 
+```python
+# Uses native function calling
+response = litellm.completion(
+    model=model,
+    messages=messages,
+    tools=tool_definitions  # Native OpenAI format
+)
+```
+
+**Required Implementation**:
+```python
+# Manual tool parsing
+tool_prompt = f"""
+Available tools: {json.dumps(tool_definitions)}
+When you need to use a tool, respond with JSON:
+{{"tool": "tool_name", "parameters": {{...}}}}
+"""
+
+messages.append({"role": "system", "content": tool_prompt})
+response = litellm.completion(model=model, messages=messages)
+
+# Manual parsing of tool calls
+if is_tool_call(response.content):
+    tool_call = json.loads(response.content)
+    result = execute_tool(tool_call)
+```
+
+#### 2. Session Management Updates
+
+**File**: `ai/harness/session.py`
+
+**Required Changes**:
+- Replace `qwen` CLI calls with LiteLLM direct API calls
+- Update environment variable handling for local model configuration
+- Implement tool call parsing and execution loop
+- Add retry logic for failed tool calls
+
+#### 3. Configuration Management
+
+**New Environment Variables Required**:
+```bash
+OPENAI_API_BASE=http://192.168.0.236:1234/v1
+OPENAI_API_KEY=lm-studio
+LOCAL_MODEL_NAME=openai/qwen3-coder-30b-a3b-instruct-mlx
+```
+
+### B. Agent Framework Updates
+
+#### 1. Tool Suite Integration
+
+**Current**: Direct function calls via multitool framework
+**Required**: JSON-based tool invocation with response parsing
+
+#### 2. Persona System
+
+**Status**: ✅ Fully compatible
+- No changes needed to persona files
+- System prompts work excellently
+- Agent behavior remains consistent
+
+#### 3. Context Management
+
+**Status**: ✅ Enhanced performance
+- Better context retention than some cloud models
+- Improved conversation flow
+- Strong memory across turns
+
+## Implementation Roadmap
+
+### Phase 1: Core Integration (High Priority)
+1. **Update SessionManager** to use LiteLLM instead of qwen CLI
+2. **Implement Tool Parser** for manual function call handling
+3. **Add Configuration Layer** for local model settings
+4. **Create Fallback Mechanism** to cloud models if local unavailable
+
+### Phase 2: Tool System Migration (High Priority)
+1. **Refactor Agent Multitool** to support JSON-based invocation
+2. **Update Tool Definitions** for consistent JSON schema
+3. **Implement Tool Response Processing** loop
+4. **Add Error Recovery** for failed tool executions
+
+### Phase 3: Optimization (Medium Priority)
+1. **Implement Response Caching** for common queries
+2. **Add Request Batching** for improved performance
+3. **Create Monitoring Dashboard** for local model health
+4. **Optimize Prompt Engineering** for local model characteristics
+
+### Phase 4: Advanced Features (Low Priority)
+1. **Model Switching** capabilities
+2. **Load Balancing** across multiple local instances
+3. **Performance Analytics** and optimization
+4. **Custom Tool Development** for local model strengths
+
+## Risk Assessment
+
+### High Risks
+1. **Tool Compatibility**: Manual parsing may not cover all edge cases
+2. **Performance**: Local model may be slower for complex queries
+3. **Maintenance**: Additional complexity in tool management
+
+### Medium Risks
+1. **Reliability**: Local model availability depends on local infrastructure
+2. **Consistency**: Response patterns may differ from cloud models
+3. **Debugging**: More complex error scenarios to handle
+
+### Low Risks
+1. **Quality**: Response quality is excellent and consistent
+2. **Integration**: LiteLLM provides stable abstraction layer
+3. **Scalability**: Can be scaled with additional hardware
+
+## Testing Recommendations
+
+### Continuous Testing
+1. **Automated Test Suite**: Run all 5 test scripts on each deployment
+2. **Performance Benchmarks**: Track response times and quality metrics
+3. **Load Testing**: Validate behavior under concurrent usage
+4. **Failover Testing**: Ensure fallback mechanisms work correctly
+
+### Monitoring Requirements
+1. **Response Time Monitoring**: Alert on performance degradation
+2. **Error Rate Tracking**: Monitor for increased failure rates
+3. **Resource Usage**: Track CPU/memory usage of local model
+4. **Quality Metrics**: Periodic evaluation of response quality
+
+## Conclusion
+
+The local model integration is **highly viable** with excellent response quality and robust error handling. The primary challenge is the lack of native function calling support, which requires a well-designed manual parsing system.
+
+**Recommendation**: Proceed with Phase 1 implementation immediately, as the core functionality is proven to work reliably. The tool system redesign (Phase 2) should be prioritized as it's critical for agent functionality.
+
+## Next Steps
+
+1. **Review and approve** this integration plan
+2. **Begin Phase 1 implementation** with SessionManager updates
+3. **Develop tool parsing prototype** based on test findings
+4. **Create integration test suite** combining all 5 test scenarios
+5. **Plan gradual migration** strategy for existing agents
+
+---
+
+*Document generated: 2025-10-22*
+*Test suite location: `scripts/test_*.py`*
+*Integration target: `ai/harness/` framework*
diff --git a/experimental/users/acmcarther/llm/litellm/TEMP_MEMORY.md b/experimental/users/acmcarther/llm/litellm/TEMP_MEMORY.md
new file mode 100644
index 0000000..f721d82
--- /dev/null
+++ b/experimental/users/acmcarther/llm/litellm/TEMP_MEMORY.md
@@ -0,0 +1,76 @@
+# Session Summary: LiteLLM Integration
+
+## Overview
+Successfully integrated LiteLLM as an alternative AI provider to Google GenAI in the agent_multitool, with LiteLLM now set as the default provider.
+
+## Key Changes Made
+
+### 1. Updated scripts/litellm_agent.py
+- **Purpose**: Standalone LiteLLM client for testing and direct usage
+- **Key Changes**:
+  - Updated default model to `openai/qwen3-coder-30b-a3b-instruct-mlx`
+  - Updated default API base to `http://192.168.0.236:1234/v1`
+  - Updated default API key to `lm-studio`
+  - Added `typer` dependency to BUILD.bazel
+- **Status**: Working and tested successfully
+- **Build Target**: `//scripts:litellm_agent` (py_binary) and `//scripts:litellm_agent_pex` (pex)
+
+### 2. Updated ai/harness/tool_suites/agent_multitool/
+- **Purpose**: Main agent multitool with provider selection
+- **Files Modified**:
+  - `BUILD.bazel`: Added `litellm` dependency
+  - `commands/microagent.py`: Added LiteLLM integration
+
+#### microagent.py Changes:
+- Added `import litellm`
+- Created `invoke_agent_with_litellm()` function (mirrors Google GenAI function)
+- Added CLI options:
+  - `--provider`: Choose between "google" or "litellm" (default: "litellm")
+  - `--api-base`: API base URL for LiteLLM (default: "http://192.168.0.236:1234/v1")
+  - `--api-key`: API key for LiteLLM (default: "lm-studio")
+- Updated default model to `openai/qwen3-coder-30b-a3b-instruct-mlx`
+- Updated default provider to `litellm`
+- Modified invoke command logic to route to appropriate provider
+
+## Build Targets
+- `//scripts:litellm_agent` - Standalone LiteLLM client (working)
+- `//scripts:litellm_agent_pex` - PEX version (has Python 3.12 constraint issues)
+- `//ai/harness/tool_suites/agent_multitool:main` - Main multitool with LiteLLM integration (working)
+
+## Testing Results
+- ✅ Standalone litellm_agent works: `./bazel-bin/scripts/litellm_agent noop "Please return OK"` → "OK"
+- ✅ Agent multitool with LiteLLM works: `./bazel-bin/ai/harness/tool_suites/agent_multitool/main microagent invoke noop "Please return OK"` → "OK"
+- ✅ Provider selection works: `--provider litellm` and `--provider google` options functional
+- ❌ Google provider needs API key (expected)
+- ❌ PEX version has Python 3.12 constraint vs system 3.13
+
+## Configuration Details
+- **LM Studio Server**: `http://192.168.0.236:1234/v1`
+- **Model**: `qwen3-coder-30b-a3b-instruct-mlx` (requires `openai/` prefix for LiteLLM)
+- **API Key**: `lm-studio`
+- **Default Provider**: LiteLLM (changed from Google)
+
+## Next Steps / Future Work
+1. Fix PEX Python version constraint or use alternative packaging
+2. Consider adding environment variable support for API configuration
+3. Potentially add more LiteLLM provider options (different models/endpoints)
+4. Test with actual Google API key when available
+5. Consider making LiteLLM the only provider if Google GenAI is deprecated
+
+## File Locations
+- Standalone script: `/Users/acmcarther/Projects/yesod/scripts/litellm_agent.py`
+- Multitool integration: `/Users/acmcarther/Projects/yesod/ai/harness/tool_suites/agent_multitool/commands/microagent.py`
+- BUILD files: Both locations have updated dependencies
+
+## Dependencies Added
+- `litellm` - Main LiteLLM library
+- `typer` - CLI framework (was missing from scripts BUILD.bazel)
+
+## Architecture Notes
+- Both implementations share similar function signatures for consistency
+- LiteLLM uses OpenAI-compatible message format (system/user roles)
+- Google GenAI uses concatenated prompt approach
+- Provider selection is handled at CLI level with routing logic
+
+---
+*Session completed successfully - LiteLLM integration is functional and default*
\ No newline at end of file
diff --git a/experimental/users/acmcarther/llm/litellm/litellm_agent.py b/experimental/users/acmcarther/llm/litellm/litellm_agent.py
new file mode 100644
index 0000000..3496d06
--- /dev/null
+++ b/experimental/users/acmcarther/llm/litellm/litellm_agent.py
@@ -0,0 +1,148 @@
+import typer
+from typing import List, Optional
+from pathlib import Path
+import os
+import litellm
+from dotenv import load_dotenv
+
+app = typer.Typer()
+
+# --- Configuration ---
+PROJECT_ROOT = Path(os.getcwd())
+MICROAGENTS_DIR = PROJECT_ROOT / "ai" / "process" / "microagents"
+
+def invoke_agent_with_litellm(
+    agent_name: str,
+    user_prompt: str,
+    context_files: list[str] = [],
+    model_name: str = "openai/gpt-3.5-turbo",
+    api_base: str | None = None,
+    api_key: str | None = None,
+    system_prompt_path: str | None = None,
+) -> str:
+    """
+    Invokes a microagent using the litellm library with OpenAI-compatible providers.
+    """
+    # 1. Load API Key and Base URL
+    dotenv_path = PROJECT_ROOT / '.env'
+    load_dotenv(dotenv_path=dotenv_path)
+    
+    # Use provided parameters or fall back to environment variables
+    api_key = api_key or os.getenv('OPENAI_API_KEY')
+    if not api_key:
+        raise ValueError("OPENAI_API_KEY not found in environment or .env file.")
+    
+    api_base = api_base or os.getenv('OPENAI_API_BASE')
+    if not api_base:
+        raise ValueError("OPENAI_API_BASE not found in environment or .env file.")
+
+    # 2. Load System Prompt
+    if system_prompt_path:
+        system_prompt_file = Path(system_prompt_path)
+    else:
+        system_prompt_file = MICROAGENTS_DIR / f"{agent_name.lower()}.md"
+    
+    if not system_prompt_file.exists():
+        raise FileNotFoundError(f"System prompt not found for agent '{agent_name}' at {system_prompt_file}")
+    system_prompt = system_prompt_file.read_text()
+
+    # 3. Construct Full User Prompt
+    full_user_prompt = ""
+    if context_files:
+        for file_path in context_files:
+            try:
+                p = Path(file_path)
+                if not p.is_absolute():
+                     p = PROJECT_ROOT / p
+                full_user_prompt += f"--- CONTEXT FILE: {p.name} ---\n"
+                try:
+                    full_user_prompt += p.read_text() + "\n\n"
+                except UnicodeDecodeError:
+                    full_user_prompt += "[Binary file - content not displayed]\n\n"
+            except FileNotFoundError:
+                raise FileNotFoundError(f"Context file not found: {file_path}")
+            except Exception as e:
+                raise IOError(f"Error reading context file {file_path}: {e}")
+
+    full_user_prompt += "--- USER PROMPT ---\n"
+    full_user_prompt += user_prompt
+
+    # 4. Construct Messages for litellm
+    messages = [
+        {"role": "system", "content": system_prompt},
+        {"role": "user", "content": full_user_prompt}
+    ]
+
+    # 5. Invoke Model using litellm
+    try:
+        response = litellm.completion(
+            model=model_name,
+            messages=messages,
+            api_key=api_key,
+            api_base=api_base
+        )
+        
+        # Extract the response content
+        if hasattr(response, 'choices') and len(response.choices) > 0:
+            return response.choices[0].message.content
+        else:
+            return f"Unexpected response format: {response}"
+            
+    except Exception as e:
+        return f"Error generating response: {e}\n\nFull response object:\n{response if 'response' in locals() else 'No response generated'}"
+
+
+@app.command()
+def invoke(
+    agent_name: str = typer.Argument(..., help="The name of the agent to invoke (e.g., 'librarian')."),
+    user_prompt: Optional[str] = typer.Argument(None, help="The user's prompt for the agent. Required if --prompt-file is not used."),
+    prompt_file: Optional[Path] = typer.Option(None, "--prompt-file", "-p", help="Path to a file containing the user's prompt."),
+    context_file: Optional[List[Path]] = typer.Option(None, "--context-file", "-c", help="Path to a context file to prepend to the prompt. Can be specified multiple times."),
+    # TODO: acmcarther@ - Disabled to test summarization performance.
+    #model: str = typer.Option("openai/qwen3-coder-30b-a3b-instruct-mlx", help="The name of the model to use (e.g., 'openai/gpt-4', 'openai/claude-3-sonnet')."),
+    model: str = typer.Option("openai/gpt-oss-120b", help="The name of the model to use (e.g., 'openai/gpt-4', 'openai/claude-3-sonnet')."),
+    api_base: Optional[str] = typer.Option("http://192.168.0.235:1234/v1", "--api-base", help="The API base URL for the OpenAI-compatible provider. Defaults to OPENAI_API_BASE env var."),
+    api_key: Optional[str] = typer.Option("lm-studio", "--api-key", help="The API key for the provider. Defaults to OPENAI_API_KEY env var."),
+):
+    """
+    Invokes a specialized, single-purpose 'microagent' using litellm with OpenAI-compatible providers.
+    """
+    if not user_prompt and not prompt_file:
+        print("Error: Either a user prompt or a prompt file must be provided.")
+        raise typer.Exit(code=1)
+
+    if prompt_file:
+        try:
+            prompt_text = prompt_file.read_text()
+        except FileNotFoundError:
+            print(f"Error: Prompt file not found at {prompt_file}")
+            raise typer.Exit(code=1)
+        except Exception as e:
+            print(f"Error reading prompt file: {e}")
+            raise typer.Exit(code=1)
+    elif user_prompt:
+        prompt_text = user_prompt
+    else:
+        return 
+
+    context_paths = [str(p) for p in context_file] if context_file else []
+
+    try:
+        response = invoke_agent_with_litellm(
+            agent_name=agent_name,
+            user_prompt=prompt_text,
+            context_files=context_paths,
+            model_name=model,
+            api_base=api_base,
+            api_key=api_key,
+        )
+        print(response)
+    except (ValueError, FileNotFoundError, IOError) as e:
+        print(f"Error: {e}")
+        raise typer.Exit(code=1)
+    except Exception as e:
+        print(f"An unexpected error occurred: {e}")
+        raise typer.Exit(code=1)
+
+if __name__ == "__main__":
+    app()
\ No newline at end of file
diff --git a/experimental/users/acmcarther/llm/litellm/test_01_basic_connectivity.py b/experimental/users/acmcarther/llm/litellm/test_01_basic_connectivity.py
new file mode 100644
index 0000000..6a08f65
--- /dev/null
+++ b/experimental/users/acmcarther/llm/litellm/test_01_basic_connectivity.py
@@ -0,0 +1,68 @@
+#!/usr/bin/env python3
+"""
+Test 1: Basic API Connectivity Test
+Validates that we can establish a connection to the local model and get a response.
+"""
+
+import os
+import sys
+from pathlib import Path
+import litellm
+from dotenv import load_dotenv
+
+def test_basic_connectivity():
+    """
+    Test basic connectivity to the local model using LiteLLM.
+    This is the simplest possible test - just send a ping and get a pong.
+    """
+    print("=== Test 1: Basic API Connectivity ===")
+    
+    # Load environment
+    project_root = Path(__file__).parent.parent
+    dotenv_path = project_root / '.env'
+    load_dotenv(dotenv_path=dotenv_path)
+    
+    # Configuration
+    api_base = os.getenv('OPENAI_API_BASE', 'http://192.168.0.235:1234/v1')
+    api_key = os.getenv('OPENAI_API_KEY', 'lm-studio')
+    model_name = "openai/qwen3-coder-30b-a3b-instruct-mlx"
+    
+    print(f"API Base: {api_base}")
+    print(f"Model: {model_name}")
+    
+    # Simple test message
+    try:
+        print("\nSending simple ping...")
+        
+        response = litellm.completion(
+            model=model_name,
+            messages=[
+                {"role": "user", "content": "Respond with exactly: 'Connection successful'"}
+            ],
+            api_key=api_key,
+            api_base=api_base,
+            max_tokens=50
+        )
+        
+        if hasattr(response, 'choices') and len(response.choices) > 0:
+            result = response.choices[0].message.content
+            print(f"Response: {result}")
+            
+            # Basic validation
+            if "successful" in result.lower():
+                print("✅ Basic connectivity test PASSED")
+                return True
+            else:
+                print("⚠️  Response received but unexpected content")
+                return False
+        else:
+            print(f"❌ Unexpected response format: {response}")
+            return False
+            
+    except Exception as e:
+        print(f"❌ Connection failed: {e}")
+        return False
+
+if __name__ == "__main__":
+    success = test_basic_connectivity()
+    sys.exit(0 if success else 1)
diff --git a/experimental/users/acmcarther/llm/litellm/test_02_system_prompt.py b/experimental/users/acmcarther/llm/litellm/test_02_system_prompt.py
new file mode 100644
index 0000000..ceec588
--- /dev/null
+++ b/experimental/users/acmcarther/llm/litellm/test_02_system_prompt.py
@@ -0,0 +1,158 @@
+#!/usr/bin/env python3
+"""
+Test 2: Single-Turn Conversation with System Prompt
+Validates that we can properly set system prompts and get contextually appropriate responses.
+"""
+
+import os
+import sys
+from pathlib import Path
+import litellm
+from dotenv import load_dotenv
+
+def test_system_prompt():
+    """
+    Test that system prompts are properly respected and the model responds
+    in character according to the system prompt.
+    """
+    print("=== Test 2: System Prompt Compliance ===")
+    
+    # Load environment
+    project_root = Path(__file__).parent.parent
+    dotenv_path = project_root / '.env'
+    load_dotenv(dotenv_path=dotenv_path)
+    
+    # Configuration
+    api_base = os.getenv('OPENAI_API_BASE', 'http://192.168.0.235:1234/v1')
+    api_key = os.getenv('OPENAI_API_KEY', 'lm-studio')
+    model_name = "openai/qwen3-coder-30b-a3b-instruct-mlx"
+    
+    print(f"API Base: {api_base}")
+    print(f"Model: {model_name}")
+    
+    # Test with a specific persona
+    system_prompt = """
+You are a medieval alchemist named Magnus. You always speak in a formal, archaic tone
+and refer to modern concepts as if they were mystical alchemical processes.
+You believe programming is a form of transmutation and code is the philosopher's stone.
+Keep responses brief but in character.
+"""
+    
+    user_prompt = "Explain what a function is in programming."
+    
+    try:
+        print("\nTesting system prompt compliance...")
+        print(f"System: {system_prompt.strip()}")
+        print(f"User: {user_prompt}")
+        
+        response = litellm.completion(
+            model=model_name,
+            messages=[
+                {"role": "system", "content": system_prompt},
+                {"role": "user", "content": user_prompt}
+            ],
+            api_key=api_key,
+            api_base=api_base,
+            max_tokens=200
+        )
+        
+        if hasattr(response, 'choices') and len(response.choices) > 0:
+            result = response.choices[0].message.content
+            print(f"\nMagnus: {result}")
+            
+            # Validate persona compliance
+            alchemy_keywords = ['transmut', 'philosoph', 'stone', 'mystic', 'arcane', 'alchem']
+            formal_keywords = ['indeed', 'verily', 'hark', 'pray', 'thus']
+            
+            has_alchemy = any(keyword in result.lower() for keyword in alchemy_keywords)
+            is_formal = len(result.split()) > 10 and not any(word in result.lower() for word in ['lol', 'yeah', 'ok'])
+            
+            if has_alchemy or is_formal:
+                print("✅ System prompt test PASSED - Model responded in character")
+                return True
+            else:
+                print("⚠️  Response received but may not fully comply with system prompt")
+                return False
+        else:
+            print(f"❌ Unexpected response format: {response}")
+            return False
+            
+    except Exception as e:
+        print(f"❌ System prompt test failed: {e}")
+        return False
+
+def test_agent_persona_simulation():
+    """
+    Test using an actual agent persona file from our microagents directory.
+    This simulates how we'd use the system in practice.
+    """
+    print("\n=== Test 2b: Agent Persona Simulation ===")
+    
+    # Load environment
+    project_root = Path(__file__).parent.parent
+    dotenv_path = project_root / '.env'
+    load_dotenv(dotenv_path=dotenv_path)
+    
+    # Configuration
+    api_base = os.getenv('OPENAI_API_BASE', 'http://192.168.0.235:1234/v1')
+    api_key = os.getenv('OPENAI_API_KEY', 'lm-studio')
+    model_name = "openai/qwen3-coder-30b-a3b-instruct-mlx"
+    
+    # Try to load an actual agent persona
+    microagents_dir = project_root / "ai" / "process" / "microagents"
+    persona_file = microagents_dir / "librarian.md"
+    
+    if not persona_file.exists():
+        print(f"⚠️  Persona file not found at {persona_file}, using fallback")
+        system_prompt = "You are a helpful librarian who organizes information and provides structured responses."
+    else:
+        system_prompt = persona_file.read_text()
+        print(f"Loaded persona from: {persona_file}")
+    
+    user_prompt = "How should I organize documentation for a software project?"
+    
+    try:
+        print("\nTesting agent persona simulation...")
+        print(f"User: {user_prompt}")
+        
+        response = litellm.completion(
+            model=model_name,
+            messages=[
+                {"role": "system", "content": system_prompt},
+                {"role": "user", "content": user_prompt}
+            ],
+            api_key=api_key,
+            api_base=api_base,
+            max_tokens=300
+        )
+        
+        if hasattr(response, 'choices') and len(response.choices) > 0:
+            result = response.choices[0].message.content
+            print(f"\nLibrarian: {result}")
+            
+            # Basic validation - should be structured and helpful
+            if len(result) > 50 and ('organiz' in result.lower() or 'document' in result.lower()):
+                print("✅ Agent persona simulation PASSED")
+                return True
+            else:
+                print("⚠️  Response received but may not be fully in character")
+                return False
+        else:
+            print(f"❌ Unexpected response format: {response}")
+            return False
+            
+    except Exception as e:
+        print(f"❌ Agent persona simulation failed: {e}")
+        return False
+
+if __name__ == "__main__":
+    success1 = test_system_prompt()
+    success2 = test_agent_persona_simulation()
+    
+    overall_success = success1 and success2
+    print(f"\n=== Test 2 Summary ===")
+    print(f"System Prompt Compliance: {'✅ PASS' if success1 else '❌ FAIL'}")
+    print(f"Agent Persona Simulation: {'✅ PASS' if success2 else '❌ FAIL'}")
+    print(f"Overall: {'✅ PASS' if overall_success else '❌ FAIL'}")
+    
+    sys.exit(0 if overall_success else 1)
diff --git a/experimental/users/acmcarther/llm/litellm/test_03_multi_turn.py b/experimental/users/acmcarther/llm/litellm/test_03_multi_turn.py
new file mode 100644
index 0000000..b47b5c1
--- /dev/null
+++ b/experimental/users/acmcarther/llm/litellm/test_03_multi_turn.py
@@ -0,0 +1,184 @@
+#!/usr/bin/env python3
+"""
+Test 3: Multi-Turn Conversation with Context Management
+Validates that the model can maintain context across multiple conversation turns.
+"""
+
+import os
+import sys
+from pathlib import Path
+import litellm
+from dotenv import load_dotenv
+
+def test_context_retention():
+    """
+    Test that the model can remember information from previous turns
+    and reference it appropriately in subsequent responses.
+    """
+    print("=== Test 3: Multi-Turn Context Management ===")
+    
+    # Load environment
+    project_root = Path(__file__).parent.parent
+    dotenv_path = project_root / '.env'
+    load_dotenv(dotenv_path=dotenv_path)
+    
+    # Configuration
+    api_base = os.getenv('OPENAI_API_BASE', 'http://192.168.0.235:1234/v1')
+    api_key = os.getenv('OPENAI_API_KEY', 'lm-studio')
+    model_name = "openai/qwen3-coder-30b-a3b-instruct-mlx"
+    
+    print(f"API Base: {api_base}")
+    print(f"Model: {model_name}")
+    
+    # Multi-turn conversation
+    system_prompt = "You are a helpful programming assistant. Remember details from our conversation and reference them when relevant."
+    
+    conversation = [
+        {
+            "role": "user", 
+            "content": "I'm working on a Python project called 'DataAnalyzer' that processes CSV files."
+        },
+        {
+            "role": "assistant", 
+            "content": "I understand you're working on a Python project called 'DataAnalyzer' for processing CSV files. That sounds like a data processing application. What specific features are you planning to implement?"
+        },
+        {
+            "role": "user", 
+            "content": "I need to add data validation and export functionality. Can you suggest the best approach?"
+        }
+    ]
+    
+    try:
+        print("\nTesting multi-turn context retention...")
+        
+        # Build the message list with system prompt
+        messages = [{"role": "system", "content": system_prompt}]
+        messages.extend(conversation)
+        
+        print("\nConversation so far:")
+        for i, msg in enumerate(conversation):
+            role = msg["role"].upper()
+            content = msg["content"][:100] + "..." if len(msg["content"]) > 100 else msg["content"]
+            print(f"{role}: {content}")
+        
+        response = litellm.completion(
+            model=model_name,
+            messages=messages,
+            api_key=api_key,
+            api_base=api_base,
+            max_tokens=300
+        )
+        
+        if hasattr(response, 'choices') and len(response.choices) > 0:
+            result = response.choices[0].message.content
+            print(f"\nAssistant: {result}")
+            
+            # Validate context retention
+            context_keywords = ['dataanalyzer', 'csv', 'python', 'validation', 'export']
+            context_retained = any(keyword.lower() in result.lower() for keyword in context_keywords)
+            
+            if context_retained:
+                print("✅ Context retention test PASSED - Model referenced previous conversation")
+                return True
+            else:
+                print("⚠️  Response received but may not fully retain context")
+                return False
+        else:
+            print(f"❌ Unexpected response format: {response}")
+            return False
+            
+    except Exception as e:
+        print(f"❌ Context retention test failed: {e}")
+        return False
+
+def test_context_evolution():
+    """
+    Test that the model can handle evolving context and update its understanding
+    as new information is provided.
+    """
+    print("\n=== Test 3b: Context Evolution ===")
+    
+    # Load environment
+    project_root = Path(__file__).parent.parent
+    dotenv_path = project_root / '.env'
+    load_dotenv(dotenv_path=dotenv_path)
+    
+    # Configuration
+    api_base = os.getenv('OPENAI_API_BASE', 'http://192.168.0.235:1234/v1')
+    api_key = os.getenv('OPENAI_API_KEY', 'lm-studio')
+    model_name = "openai/qwen3-coder-30b-a3b-instruct-mlx"
+    
+    system_prompt = "You are a software architect. Track project requirements and update your recommendations as the scope evolves."
+    
+    # Evolving conversation where requirements change
+    conversation = [
+        {
+            "role": "user", 
+            "content": "I need to build a simple todo list web app with basic CRUD operations."
+        },
+        {
+            "role": "assistant", 
+            "content": "For a simple todo list web app with CRUD operations, I'd recommend: 1) Frontend: React or Vue.js for the UI, 2) Backend: Node.js/Express or Python Flask, 3) Database: SQLite for simplicity. This gives you a clean separation of concerns and easy deployment options."
+        },
+        {
+            "role": "user", 
+            "content": "Actually, I need to scale this to support 10,000 concurrent users with real-time collaboration features."
+        },
+        {
+            "role": "assistant", 
+            "content": "That's a significant scale increase! For 10,000 concurrent users with real-time collaboration, we need to rethink the architecture: 1) Frontend: React with WebSocket connections, 2) Backend: Node.js with Socket.IO for real-time features, 3) Database: PostgreSQL with connection pooling, 4) Caching layer: Redis for session management and real-time data sync. We'll also need load balancing and horizontal scaling capabilities."
+        },
+        {
+            "role": "user", 
+            "content": "What's the most critical component I should implement first?"
+        }
+    ]
+    
+    try:
+        print("\nTesting context evolution...")
+        
+        # Build the message list with system prompt
+        messages = [{"role": "system", "content": system_prompt}]
+        messages.extend(conversation)
+        
+        response = litellm.completion(
+            model=model_name,
+            messages=messages,
+            api_key=api_key,
+            api_base=api_base,
+            max_tokens=250
+        )
+        
+        if hasattr(response, 'choices') and len(response.choices) > 0:
+            result = response.choices[0].message.content
+            print(f"\nArchitect: {result}")
+            
+            # Validate that the response considers the scaled requirements
+            scale_keywords = ['scal', 'concurrent', 'real-time', 'websocket', 'redis', 'load balanc']
+            evolution_context = any(keyword.lower() in result.lower() for keyword in scale_keywords)
+            
+            if evolution_context:
+                print("✅ Context evolution test PASSED - Model adapted to evolved requirements")
+                return True
+            else:
+                print("⚠️  Response received but may not fully account for evolved context")
+                return False
+        else:
+            print(f"❌ Unexpected response format: {response}")
+            return False
+            
+    except Exception as e:
+        print(f"❌ Context evolution test failed: {e}")
+        return False
+
+if __name__ == "__main__":
+    success1 = test_context_retention()
+    success2 = test_context_evolution()
+    
+    overall_success = success1 and success2
+    print(f"\n=== Test 3 Summary ===")
+    print(f"Context Retention: {'✅ PASS' if success1 else '❌ FAIL'}")
+    print(f"Context Evolution: {'✅ PASS' if success2 else '❌ FAIL'}")
+    print(f"Overall: {'✅ PASS' if overall_success else '❌ FAIL'}")
+    
+    sys.exit(0 if overall_success else 1)
diff --git a/experimental/users/acmcarther/llm/litellm/test_04_debug_function_calling.py b/experimental/users/acmcarther/llm/litellm/test_04_debug_function_calling.py
new file mode 100644
index 0000000..b94ce87
--- /dev/null
+++ b/experimental/users/acmcarther/llm/litellm/test_04_debug_function_calling.py
@@ -0,0 +1,133 @@
+#!/usr/bin/env python3
+"""
+Debug version to understand what the model actually returns for function calling prompts.
+"""
+
+import os
+import sys
+from pathlib import Path
+import litellm
+from dotenv import load_dotenv
+
+def debug_function_calling():
+    """
+    Debug what the model actually returns when prompted for function calls.
+    """
+    print("=== Debug: Function Calling Response Analysis ===")
+    
+    # Load environment
+    project_root = Path(__file__).parent.parent
+    dotenv_path = project_root / '.env'
+    load_dotenv(dotenv_path=dotenv_path)
+    
+    # Configuration
+    api_base = os.getenv('OPENAI_API_BASE', 'http://192.168.0.235:1234/v1')
+    api_key = os.getenv('OPENAI_API_KEY', 'lm-studio')
+    model_name = "openai/qwen3-coder-30b-a3b-instruct-mlx"
+    
+    tools = [
+        {
+            "type": "function",
+            "function": {
+                "name": "read_file",
+                "description": "Read the contents of a file",
+                "parameters": {
+                    "type": "object",
+                    "properties": {
+                        "file_path": {"type": "string", "description": "The absolute path to the file to read"}
+                    },
+                    "required": ["file_path"]
+                }
+            }
+        }
+    ]
+    
+    # Test 1: Standard function calling prompt
+    print("\n--- Test 1: Standard Function Calling ---")
+    system_prompt = """
+You are an AI assistant with access to tools. When you need to use a tool, respond with ONLY a JSON object 
+containing the function call. Do not include any explanatory text.
+"""
+    
+    user_prompt = "Please read the file at /Users/acmcarther/Projects/infra2/README.md"
+    
+    try:
+        response = litellm.completion(
+            model=model_name,
+            messages=[
+                {"role": "system", "content": system_prompt},
+                {"role": "user", "content": user_prompt}
+            ],
+            tools=tools,
+            api_key=api_key,
+            api_base=api_base,
+            max_tokens=200
+        )
+        
+        if hasattr(response, 'choices') and len(response.choices) > 0:
+            result = response.choices[0].message.content
+            print(f"Raw response: '{result}'")
+            print(f"Response type: {type(result)}")
+            print(f"Response length: {len(result) if result else 0}")
+        
+    except Exception as e:
+        print(f"Error: {e}")
+    
+    # Test 2: More explicit instruction
+    print("\n--- Test 2: Explicit JSON Instruction ---")
+    system_prompt2 = """
+You are an AI assistant. When asked to perform actions, respond with a JSON object in this exact format:
+{"tool": "tool_name", "parameters": {"param": "value"}}
+
+Available tools: read_file, list_directory
+    
+Example response: {"tool": "read_file", "parameters": {"file_path": "/path/to/file"}}
+    
+Do not include any text other than the JSON.
+"""
+    
+    try:
+        response2 = litellm.completion(
+            model=model_name,
+            messages=[
+                {"role": "system", "content": system_prompt2},
+                {"role": "user", "content": user_prompt}
+            ],
+            api_key=api_key,
+            api_base=api_base,
+            max_tokens=200
+        )
+        
+        if hasattr(response2, 'choices') and len(response2.choices) > 0:
+            result2 = response2.choices[0].message.content
+            print(f"Raw response: '{result2}'")
+    
+    except Exception as e:
+        print(f"Error: {e}")
+    
+    # Test 3: Check if model understands tools at all
+    print("\n--- Test 3: Tool Awareness Check ---")
+    user_prompt2 = "What tools do you have access to? Please list them."
+    
+    try:
+        response3 = litellm.completion(
+            model=model_name,
+            messages=[
+                {"role": "system", "content": "You are an AI assistant with access to tools."},
+                {"role": "user", "content": user_prompt2}
+            ],
+            tools=tools,
+            api_key=api_key,
+            api_base=api_base,
+            max_tokens=200
+        )
+        
+        if hasattr(response3, 'choices') and len(response3.choices) > 0:
+            result3 = response3.choices[0].message.content
+            print(f"Tool awareness response: '{result3}'")
+    
+    except Exception as e:
+        print(f"Error: {e}")
+
+if __name__ == "__main__":
+    debug_function_calling()
\ No newline at end of file
diff --git a/experimental/users/acmcarther/llm/litellm/test_04_function_calling.py b/experimental/users/acmcarther/llm/litellm/test_04_function_calling.py
new file mode 100644
index 0000000..a7fef64
--- /dev/null
+++ b/experimental/users/acmcarther/llm/litellm/test_04_function_calling.py
@@ -0,0 +1,329 @@
+#!/usr/bin/env python3
+"""
+Test 4: Function Calling / Tool Usage Simulation
+Validates that the model can understand and generate function calls in the expected format.
+This is critical for agent tool integration.
+"""
+
+import os
+import sys
+import json
+from pathlib import Path
+import litellm
+from dotenv import load_dotenv
+
+def test_function_calling_basic():
+    """
+    Test basic function calling capability - can the model generate proper
+    function call JSON when prompted with available tools.
+    """
+    print("=== Test 4: Function Calling / Tool Usage ===")
+    
+    # Load environment
+    project_root = Path(__file__).parent.parent
+    dotenv_path = project_root / '.env'
+    load_dotenv(dotenv_path=dotenv_path)
+    
+    # Configuration
+    api_base = os.getenv('OPENAI_API_BASE', 'http://192.168.0.235:1234/v1')
+    api_key = os.getenv('OPENAI_API_KEY', 'lm-studio')
+    model_name = "openai/qwen3-coder-30b-a3b-instruct-mlx"
+    
+    print(f"API Base: {api_base}")
+    print(f"Model: {model_name}")
+    
+    # Define available tools (similar to our agent framework)
+    tools = [
+        {
+            "type": "function",
+            "function": {
+                "name": "read_file",
+                "description": "Read the contents of a file",
+                "parameters": {
+                    "type": "object",
+                    "properties": {
+                        "file_path": {
+                            "type": "string",
+                            "description": "The absolute path to the file to read"
+                        }
+                    },
+                    "required": ["file_path"]
+                }
+            }
+        },
+        {
+            "type": "function",
+            "function": {
+                "name": "list_directory",
+                "description": "List the contents of a directory",
+                "parameters": {
+                    "type": "object",
+                    "properties": {
+                        "path": {
+                            "type": "string",
+                            "description": "The absolute path to the directory"
+                        }
+                    },
+                    "required": ["path"]
+                }
+            }
+        }
+    ]
+    
+    system_prompt = """
+You are an AI assistant with access to tools. When you need to use a tool, respond with ONLY a JSON object 
+containing the function call. Do not include any explanatory text. The format should be:
+{"name": "function_name", "arguments": {"param": "value"}}
+
+If you don't need to use a tool, respond normally.
+"""
+    
+    user_prompt = "Please read the file at /Users/acmcarther/Projects/yesod/README.md"
+    
+    try:
+        print("\nTesting basic function calling...")
+        print(f"User: {user_prompt}")
+        
+        response = litellm.completion(
+            model=model_name,
+            messages=[
+                {"role": "system", "content": system_prompt},
+                {"role": "user", "content": user_prompt}
+            ],
+            tools=tools,
+            api_key=api_key,
+            api_base=api_base,
+            max_tokens=200
+        )
+        
+        if hasattr(response, 'choices') and len(response.choices) > 0:
+            result = response.choices[0].message.content
+            print(f"\nAssistant: {result}")
+            
+            # Try to parse as JSON function call
+            try:
+                function_call = json.loads(result)
+                if "name" in function_call and "arguments" in function_call:
+                    print(f"✅ Function call generated: {function_call['name']}")
+                    return True
+                else:
+                    print("⚠️  JSON response but not in expected function call format")
+                    return False
+            except json.JSONDecodeError:
+                print("⚠️  Response is not valid JSON - model may not support function calling")
+                return False
+        else:
+            print(f"❌ Unexpected response format: {response}")
+            return False
+            
+    except Exception as e:
+        print(f"❌ Function calling test failed: {e}")
+        return False
+
+def test_tool_selection():
+    """
+    Test that the model can select appropriate tools based on user requests.
+    """
+    print("\n=== Test 4b: Tool Selection ===")
+    
+    # Load environment
+    project_root = Path(__file__).parent.parent
+    dotenv_path = project_root / '.env'
+    load_dotenv(dotenv_path=dotenv_path)
+    
+    # Configuration
+    api_base = os.getenv('OPENAI_API_BASE', 'http://192.168.0.235:1234/v1')
+    api_key = os.getenv('OPENAI_API_KEY', 'lm-studio')
+    model_name = "openai/qwen3-coder-30b-a3b-instruct-mlx"
+    
+    tools = [
+        {
+            "type": "function",
+            "function": {
+                "name": "search_files",
+                "description": "Search for files matching a pattern",
+                "parameters": {
+                    "type": "object",
+                    "properties": {
+                        "pattern": {"type": "string", "description": "Search pattern"},
+                        "directory": {"type": "string", "description": "Directory to search in"}
+                    },
+                    "required": ["pattern"]
+                }
+            }
+        },
+        {
+            "type": "function",
+            "function": {
+                "name": "run_command",
+                "description": "Execute a shell command",
+                "parameters": {
+                    "type": "object",
+                    "properties": {
+                        "command": {"type": "string", "description": "Command to execute"},
+                        "directory": {"type": "string", "description": "Working directory"}
+                    },
+                    "required": ["command"]
+                }
+            }
+        }
+    ]
+    
+    system_prompt = """
+You are an AI assistant with access to tools. When you need to use a tool, respond with ONLY a JSON object 
+containing the function call. Do not include any explanatory text.
+"""
+    
+    user_prompt = "Find all Python files in the current directory and then run git status"
+    
+    try:
+        print("\nTesting tool selection...")
+        print(f"User: {user_prompt}")
+        
+        response = litellm.completion(
+            model=model_name,
+            messages=[
+                {"role": "system", "content": system_prompt},
+                {"role": "user", "content": user_prompt}
+            ],
+            tools=tools,
+            api_key=api_key,
+            api_base=api_base,
+            max_tokens=200
+        )
+        
+        if hasattr(response, 'choices') and len(response.choices) > 0:
+            result = response.choices[0].message.content
+            print(f"\nAssistant: {result}")
+            
+            # Check if it's trying to use the right tool
+            try:
+                function_call = json.loads(result)
+                if "name" in function_call:
+                    tool_name = function_call["name"]
+                    if tool_name in ["search_files", "run_command"]:
+                        print(f"✅ Appropriate tool selected: {tool_name}")
+                        return True
+                    else:
+                        print(f"⚠️  Tool selected but may not be optimal: {tool_name}")
+                        return False
+                else:
+                    print("⚠️  JSON response but missing 'name' field")
+                    return False
+            except json.JSONDecodeError:
+                print("⚠️  Response is not valid JSON")
+                return False
+        else:
+            print(f"❌ Unexpected response format: {response}")
+            return False
+            
+    except Exception as e:
+        print(f"❌ Tool selection test failed: {e}")
+        return False
+
+def test_function_calling_with_context():
+    """
+    Test function calling in a conversational context where the model
+    should use tools based on previous conversation context.
+    """
+    print("\n=== Test 4c: Function Calling with Context ===")
+    
+    # Load environment
+    project_root = Path(__file__).parent.parent
+    dotenv_path = project_root / '.env'
+    load_dotenv(dotenv_path=dotenv_path)
+    
+    # Configuration
+    api_base = os.getenv('OPENAI_API_BASE', 'http://192.168.0.235:1234/v1')
+    api_key = os.getenv('OPENAI_API_KEY', 'lm-studio')
+    model_name = "openai/qwen3-coder-30b-a3b-instruct-mlx"
+    
+    tools = [
+        {
+            "type": "function",
+            "function": {
+                "name": "write_file",
+                "description": "Write content to a file",
+                "parameters": {
+                    "type": "object",
+                    "properties": {
+                        "file_path": {"type": "string", "description": "Path to the file"},
+                        "content": {"type": "string", "description": "Content to write"}
+                    },
+                    "required": ["file_path", "content"]
+                }
+            }
+        }
+    ]
+    
+    system_prompt = """
+You are an AI assistant with access to tools. When you need to use a tool, respond with ONLY a JSON object 
+containing the function call. Do not include any explanatory text.
+"""
+    
+    conversation = [
+        {"role": "user", "content": "I need to create a simple Python script that prints 'Hello World'"},
+        {"role": "assistant", "content": "I'll help you create a Python script that prints 'Hello World'. Let me write it to a file for you."},
+        {"role": "user", "content": "Please save it as hello.py in the current directory"}
+    ]
+    
+    try:
+        print("\nTesting function calling with context...")
+        
+        messages = [{"role": "system", "content": system_prompt}]
+        messages.extend(conversation)
+        
+        response = litellm.completion(
+            model=model_name,
+            messages=messages,
+            tools=tools,
+            api_key=api_key,
+            api_base=api_base,
+            max_tokens=200
+        )
+        
+        if hasattr(response, 'choices') and len(response.choices) > 0:
+            result = response.choices[0].message.content
+            print(f"\nAssistant: {result}")
+            
+            try:
+                function_call = json.loads(result)
+                if "name" in function_call and function_call["name"] == "write_file":
+                    args = function_call.get("arguments", {})
+                    if "hello.py" in args.get("file_path", ""):
+                        print("✅ Context-aware function call generated correctly")
+                        return True
+                    else:
+                        print("⚠️  Function call generated but with incorrect arguments")
+                        return False
+                else:
+                    print("⚠️  Function call generated but not the expected tool")
+                    return False
+            except json.JSONDecodeError:
+                print("⚠️  Response is not valid JSON")
+                return False
+        else:
+            print(f"❌ Unexpected response format: {response}")
+            return False
+            
+    except Exception as e:
+        print(f"❌ Context-aware function calling test failed: {e}")
+        return False
+
+if __name__ == "__main__":
+    success1 = test_function_calling_basic()
+    success2 = test_tool_selection() 
+    success3 = test_function_calling_with_context()
+    
+    overall_success = success1 and success2 and success3
+    print(f"\n=== Test 4 Summary ===")
+    print(f"Basic Function Calling: {'✅ PASS' if success1 else '❌ FAIL'}")
+    print(f"Tool Selection: {'✅ PASS' if success2 else '❌ FAIL'}")
+    print(f"Context-Aware Function Calling: {'✅ PASS' if success3 else '❌ FAIL'}")
+    print(f"Overall: {'✅ PASS' if overall_success else '❌ FAIL'}")
+    
+    if not overall_success:
+        print("\n⚠️  NOTE: Function calling support may be limited in this model.")
+        print("This could impact agent tool integration capabilities.")
+    
+    sys.exit(0 if overall_success else 1)
diff --git a/experimental/users/acmcarther/llm/litellm/test_05_error_handling.py b/experimental/users/acmcarther/llm/litellm/test_05_error_handling.py
new file mode 100644
index 0000000..905e01c
--- /dev/null
+++ b/experimental/users/acmcarther/llm/litellm/test_05_error_handling.py
@@ -0,0 +1,240 @@
+#!/usr/bin/env python3
+"""
+Test 5: Error Handling and Recovery
+Validates that the integration can handle various error conditions gracefully
+and provides meaningful feedback for debugging.
+"""
+
+import os
+import sys
+import time
+from pathlib import Path
+import litellm
+from dotenv import load_dotenv
+
+def test_invalid_api_endpoint():
+    """
+    Test behavior when the API endpoint is unreachable.
+    """
+    print("=== Test 5: Error Handling and Recovery ===")
+    
+    # Load environment
+    project_root = Path(__file__).parent.parent
+    dotenv_path = project_root / '.env'
+    load_dotenv(dotenv_path=dotenv_path)
+    
+    print("\n--- Test 5a: Invalid API Endpoint ---")
+    
+    try:
+        response = litellm.completion(
+            model="openai/qwen3-coder-30b-a3b-instruct-mlx",
+            messages=[
+                {"role": "user", "content": "Hello"}
+            ],
+            api_key="test-key",
+            api_base="http://invalid-endpoint:1234/v1",
+            max_tokens=50
+        )
+        print("❌ Expected connection error but got response")
+        return False
+    except Exception as e:
+        print(f"✅ Correctly caught error: {type(e).__name__}: {str(e)[:100]}...")
+        return True
+
+def test_invalid_model_name():
+    """
+    Test behavior with an invalid model name.
+    """
+    print("\n--- Test 5b: Invalid Model Name ---")
+    
+    # Use valid endpoint but invalid model
+    api_base = os.getenv('OPENAI_API_BASE', 'http://192.168.0.235:1234/v1')
+    api_key = os.getenv('OPENAI_API_KEY', 'lm-studio')
+    
+    try:
+        response = litellm.completion(
+            model="invalid-model-name",
+            messages=[
+                {"role": "user", "content": "Hello"}
+            ],
+            api_key=api_key,
+            api_base=api_base,
+            max_tokens=50
+        )
+        print("❌ Expected model error but got response")
+        return False
+    except Exception as e:
+        print(f"✅ Correctly caught error: {type(e).__name__}: {str(e)[:100]}...")
+        return True
+
+def test_timeout_handling():
+    """
+    Test behavior with very short timeout.
+    """
+    print("\n--- Test 5c: Timeout Handling ---")
+    
+    api_base = os.getenv('OPENAI_API_BASE', 'http://192.168.0.235:1234/v1')
+    api_key = os.getenv('OPENAI_API_KEY', 'lm-studio')
+    
+    try:
+        start_time = time.time()
+        response = litellm.completion(
+            model="openai/qwen3-coder-30b-a3b-instruct-mlx",
+            messages=[
+                {"role": "user", "content": "Write a very long detailed story"}
+            ],
+            api_key=api_key,
+            api_base=api_base,
+            max_tokens=1000,
+            timeout=1  # Very short timeout
+        )
+        elapsed = time.time() - start_time
+        print(f"⚠️  Request completed in {elapsed:.2f}s (timeout may not be supported)")
+        return True  # Pass if timeout isn't supported
+    except Exception as e:
+        elapsed = time.time() - start_time
+        if "timeout" in str(e).lower():
+            print(f"✅ Correctly timed out after {elapsed:.2f}s")
+        else:
+            print(f"⚠️  Got different error (may be expected): {type(e).__name__}")
+        return True
+
+def test_malformed_request():
+    """
+    Test behavior with malformed request data.
+    """
+    print("\n--- Test 5d: Malformed Request ---")
+    
+    api_base = os.getenv('OPENAI_API_BASE', 'http://192.168.0.235:1234/v1')
+    api_key = os.getenv('OPENAI_API_KEY', 'lm-studio')
+    
+    try:
+        # Test with empty messages
+        response = litellm.completion(
+            model="openai/qwen3-coder-30b-a3b-instruct-mlx",
+            messages=[],  # Empty messages
+            api_key=api_key,
+            api_base=api_base,
+            max_tokens=50
+        )
+        print("❌ Expected validation error but got response")
+        return False
+    except Exception as e:
+        print(f"✅ Correctly caught error: {type(e).__name__}: {str(e)[:100]}...")
+        return True
+
+def test_recovery_after_error():
+    """
+    Test that the system can recover after an error and continue working.
+    """
+    print("\n--- Test 5e: Recovery After Error ---")
+    
+    api_base = os.getenv('OPENAI_API_BASE', 'http://192.168.0.235:1234/v1')
+    api_key = os.getenv('OPENAI_API_KEY', 'lm-studio')
+    
+    # First, make a request that will fail
+    try:
+        litellm.completion(
+            model="invalid-model",
+            messages=[{"role": "user", "content": "test"}],
+            api_key=api_key,
+            api_base=api_base
+        )
+    except:
+        pass  # Expected to fail
+    
+    # Now try a valid request
+    try:
+        response = litellm.completion(
+            model="openai/qwen3-coder-30b-a3b-instruct-mlx",
+            messages=[
+                {"role": "user", "content": "Respond with: 'Recovery successful'"}
+            ],
+            api_key=api_key,
+            api_base=api_base,
+            max_tokens=50
+        )
+        
+        if hasattr(response, 'choices') and len(response.choices) > 0:
+            result = response.choices[0].message.content
+            if "recovery" in result.lower() or "successful" in result.lower():
+                print("✅ Recovery test PASSED - System recovered after error")
+                return True
+            else:
+                print(f"⚠️  Got response but unexpected content: {result}")
+                return False
+        else:
+            print("❌ Unexpected response format")
+            return False
+    except Exception as e:
+        print(f"❌ Recovery failed: {e}")
+        return False
+
+def test_rate_limiting():
+    """
+    Test behavior with multiple rapid requests.
+    """
+    print("\n--- Test 5f: Rate Limiting ---")
+    
+    api_base = os.getenv('OPENAI_API_BASE', 'http://192.168.0.235:1234/v1')
+    api_key = os.getenv('OPENAI_API_KEY', 'lm-studio')
+    
+    success_count = 0
+    error_count = 0
+    
+    # Make 5 rapid requests
+    for i in range(5):
+        try:
+            response = litellm.completion(
+                model="openai/qwen3-coder-30b-a3b-instruct-mlx",
+                messages=[
+                    {"role": "user", "content": f"Request {i+1}: Respond with 'OK'"}
+                ],
+                api_key=api_key,
+                api_base=api_base,
+                max_tokens=10
+            )
+            success_count += 1
+        except Exception as e:
+            error_count += 1
+            print(f"Request {i+1} failed: {type(e).__name__}")
+    
+    print(f"Rapid requests: {success_count} successful, {error_count} failed")
+    
+    if success_count >= 3:  # At least some should succeed
+        print("✅ Rate limiting test PASSED - System handled rapid requests")
+        return True
+    else:
+        print("⚠️  Too many failures - may indicate rate limiting issues")
+        return False
+
+if __name__ == "__main__":
+    tests = [
+        test_invalid_api_endpoint,
+        test_invalid_model_name, 
+        test_timeout_handling,
+        test_malformed_request,
+        test_recovery_after_error,
+        test_rate_limiting
+    ]
+    
+    results = []
+    for test in tests:
+        try:
+            result = test()
+            results.append(result)
+        except Exception as e:
+            print(f"❌ Test {test.__name__} crashed: {e}")
+            results.append(False)
+    
+    overall_success = sum(results) >= len(results) * 0.7  # 70% pass rate
+    
+    print(f"\n=== Test 5 Summary ===")
+    for i, (test, result) in enumerate(zip(tests, results)):
+        status = "✅ PASS" if result else "❌ FAIL"
+        print(f"{test.__name__}: {status}")
+    
+    print(f"Overall: {'✅ PASS' if overall_success else '❌ FAIL'}")
+    print(f"Passed: {sum(results)}/{len(results)} tests")
+    
+    sys.exit(0 if overall_success else 1)
diff --git a/experimental/users/acmcarther/llm/litellm/test_integration_comprehensive.py b/experimental/users/acmcarther/llm/litellm/test_integration_comprehensive.py
new file mode 100644
index 0000000..2e7766b
--- /dev/null
+++ b/experimental/users/acmcarther/llm/litellm/test_integration_comprehensive.py
@@ -0,0 +1,228 @@
+#!/usr/bin/env python3
+"""
+Comprehensive Integration Test
+Combines all validated capabilities into a single end-to-end test that simulates
+real agent usage patterns with the local model.
+"""
+
+import os
+import sys
+import json
+from pathlib import Path
+import litellm
+from dotenv import load_dotenv
+
+class LocalModelAgent:
+    """
+    Simulates the proposed agent harness integration with local model.
+    This demonstrates how the retrofitted system would work.
+    """
+    
+    def __init__(self):
+        # Load environment
+        project_root = Path(__file__).parent.parent
+        dotenv_path = project_root / '.env'
+        load_dotenv(dotenv_path=dotenv_path)
+        
+        self.api_base = os.getenv('OPENAI_API_BASE', 'http://192.168.0.235:1234/v1')
+        self.api_key = os.getenv('OPENAI_API_KEY', 'lm-studio')
+        self.model_name = "openai/qwen3-coder-30b-a3b-instruct-mlx"
+        
+        # Define available tools (manual function calling)
+        self.tools = {
+            "read_file": {
+                "description": "Read the contents of a file",
+                "parameters": {"file_path": "string (absolute path)"}
+            },
+            "list_directory": {
+                "description": "List contents of a directory",
+                "parameters": {"path": "string (absolute path)"}
+            },
+            "write_file": {
+                "description": "Write content to a file",
+                "parameters": {"file_path": "string", "content": "string"}
+            }
+        }
+    
+    def _create_tool_prompt(self):
+        """
+        Creates the system prompt for manual tool usage.
+        """
+        tools_json = json.dumps(self.tools, indent=2)
+        return f"""
+You are an AI assistant with access to the following tools:
+
+{tools_json}
+
+When you need to use a tool, respond with ONLY a JSON object in this format:
+{{"tool": "tool_name", "parameters": {{"param_name": "value"}}}}
+
+Do not include any explanatory text. If you don't need to use a tool, respond normally.
+"""
+    
+    def _is_tool_call(self, response):
+        """
+        Checks if a response is a tool call.
+        """
+        try:
+            parsed = json.loads(response.strip())
+            return isinstance(parsed, dict) and "tool" in parsed
+        except json.JSONDecodeError:
+            return False
+    
+    def _execute_tool(self, tool_call):
+        """
+        Simulates tool execution (in real implementation, this would call actual tools).
+        """
+        tool_name = tool_call["tool"]
+        parameters = tool_call.get("parameters", {})
+        
+        if tool_name == "read_file":
+            file_path = parameters.get("file_path", "")
+            return f"[SIMULATED] Read file: {file_path} - Content would be displayed here"
+        
+        elif tool_name == "list_directory":
+            path = parameters.get("path", "")
+            return f"[SIMULATED] Directory listing for: {path} - Files would be listed here"
+        
+        elif tool_name == "write_file":
+            file_path = parameters.get("file_path", "")
+            content = parameters.get("content", "")[:50] + "..."
+            return f"[SIMULATED] Wrote to {file_path}: {content}"
+        
+        else:
+            return f"[ERROR] Unknown tool: {tool_name}"
+    
+    def converse(self, user_message, conversation_history=None):
+        """
+        Handles a conversation turn with manual tool calling support.
+        """
+        if conversation_history is None:
+            conversation_history = []
+        
+        # Build messages
+        messages = [
+            {"role": "system", "content": self._create_tool_prompt()},
+            *conversation_history,
+            {"role": "user", "content": user_message}
+        ]
+        
+        try:
+            response = litellm.completion(
+                model=self.model_name,
+                messages=messages,
+                api_key=self.api_key,
+                api_base=self.api_base,
+                max_tokens=300
+            )
+            
+            if hasattr(response, 'choices') and len(response.choices) > 0:
+                result = response.choices[0].message.content
+                
+                # Check if this is a tool call
+                if self._is_tool_call(result):
+                    tool_call = json.loads(result.strip())
+                    tool_result = self._execute_tool(tool_call)
+                    
+                    # Continue conversation with tool result
+                    messages.append({"role": "assistant", "content": result})
+                    messages.append({"role": "user", "content": f"Tool result: {tool_result}"})
+                    
+                    # Get final response
+                    final_response = litellm.completion(
+                        model=self.model_name,
+                        messages=messages,
+                        api_key=self.api_key,
+                        api_base=self.api_base,
+                        max_tokens=300
+                    )
+                    
+                    if hasattr(final_response, 'choices') and len(final_response.choices) > 0:
+                        return final_response.choices[0].message.content, True  # True = tool was used
+                
+                return result, False  # False = no tool used
+            
+        except Exception as e:
+            return f"Error: {e}", False
+
+def test_comprehensive_integration():
+    """
+    Runs a comprehensive integration test simulating real agent usage.
+    """
+    print("=== Comprehensive Integration Test ===")
+    print("Simulating retrofitted agent harness with local model...\n")
+    
+    agent = LocalModelAgent()
+    conversation_history = []
+    tools_used = 0
+    
+    # Test scenarios
+    test_scenarios = [
+        {
+            "name": "System Prompt Compliance",
+            "message": "Hi, I need help organizing my project documentation. Can you act as a documentation specialist and give me advice?"
+        },
+        {
+            "name": "Tool Usage - File Reading",
+            "message": "Please read the file at /Users/acmcarther/Projects/yesod/README.md to understand the project structure."
+        },
+        {
+            "name": "Context Retention",
+            "message": "Based on what you just read, what do you think the main purpose of this project is?"
+        },
+        {
+            "name": "Tool Usage - Directory Listing",
+            "message": "Now list the contents of the /Users/acmcarther/Projects/yesod/scripts directory to see what test files we have."
+        },
+        {
+            "name": "Complex Task with Multiple Tools",
+            "message": "Create a summary document called 'project_summary.md' that includes the project purpose and the test files available."
+        }
+    ]
+    
+    results = []
+    
+    for i, scenario in enumerate(test_scenarios, 1):
+        print(f"--- Test {i}: {scenario['name']} ---")
+        print(f"User: {scenario['message']}")
+        
+        response, used_tool = agent.converse(scenario['message'], conversation_history)
+        print(f"Agent: {response[:200]}{'...' if len(response) > 200 else ''}")
+        
+        if used_tool:
+            tools_used += 1
+            print("🔧 Tool was used in this response")
+        
+        # Add to conversation history
+        conversation_history.append({"role": "user", "content": scenario['message']})
+        conversation_history.append({"role": "assistant", "content": response})
+        
+        # Simple validation
+        if len(response) > 20 and not response.startswith("Error:"):
+            print("✅ Test passed")
+            results.append(True)
+        else:
+            print("❌ Test failed")
+            results.append(False)
+        
+        print()
+    
+    # Summary
+    success_rate = sum(results) / len(results)
+    print(f"=== Integration Test Summary ===")
+    print(f"Tests passed: {sum(results)}/{len(results)} ({success_rate:.1%})")
+    print(f"Tools used: {tools_used}")
+    print(f"Conversation turns: {len(conversation_history) // 2}")
+    
+    if success_rate >= 0.8:
+        print("✅ Comprehensive integration test PASSED")
+        print("\nThe local model integration is ready for production retrofitting.")
+        return True
+    else:
+        print("❌ Comprehensive integration test FAILED")
+        print("\nAdditional refinement needed before production deployment.")
+        return False
+
+if __name__ == "__main__":
+    success = test_comprehensive_integration()
+    sys.exit(0 if success else 1)
diff --git a/experimental/users/acmcarther/llm/litellm_grpc/BUILD.bazel b/experimental/users/acmcarther/llm/litellm_grpc/BUILD.bazel
new file mode 100644
index 0000000..920567c
--- /dev/null
+++ b/experimental/users/acmcarther/llm/litellm_grpc/BUILD.bazel
@@ -0,0 +1,99 @@
+load("@aspect_rules_py//py:defs.bzl", "py_binary")
+load("@rules_go//go:def.bzl", "go_binary", "go_library")
+load("@build_stack_rules_proto//rules:proto_compile.bzl", "proto_compile")
+load("@build_stack_rules_proto//rules/py:grpc_py_library.bzl", "grpc_py_library")
+load("@build_stack_rules_proto//rules/py:proto_py_library.bzl", "proto_py_library")
+load("@pip_third_party//:requirements.bzl", "requirement")
+load("@rules_proto//proto:defs.bzl", "proto_library")
+
+proto_library(
+    name = "litellm_proto",
+    srcs = ["litellm.proto"],
+    visibility = ["//visibility:public"],
+)
+
+proto_compile(
+    name = "litellm_python_compile",
+    outputs = [
+        "litellm_pb2.py",
+        "litellm_pb2.pyi",
+        "litellm_pb2_grpc.py",
+    ],
+    plugins = [
+        "@build_stack_rules_proto//plugin/builtin:pyi",
+        "@build_stack_rules_proto//plugin/builtin:python",
+        "@build_stack_rules_proto//plugin/grpc/grpc:protoc-gen-grpc-python",
+    ],
+    proto = ":litellm_proto",
+)
+
+proto_py_library(
+    name = "litellm_proto_py_lib",
+    srcs = ["litellm_pb2.py"],
+    deps = ["@com_google_protobuf//:protobuf_python"],
+)
+
+grpc_py_library(
+    name = "litellm_grpc_py_library",
+    srcs = ["litellm_pb2_grpc.py"],
+    deps = [
+        requirement("grpcio"),
+        ":litellm_proto_py_lib",
+    ],
+)
+
+py_binary(
+    name = "server_main",
+    srcs = ["server_main.py"],
+    target_compatible_with = ["@platforms//os:macos"],
+    deps = [
+        ":litellm_grpc_py_library",
+        ":litellm_proto_py_lib",
+        requirement("grpcio"),
+        requirement("litellm"),
+        requirement("python-dotenv"),
+        requirement("asyncio"),
+    ],
+)
+
+proto_compile(
+    name = "litellm_go_compile",
+    output_mappings = [
+        "litellm.pb.go=forgejo.csbx.dev/acmcarther/yesod/experimental/users/acmcarther/llm/litellm_grpc/litellm.pb.go",
+        "litellm_grpc.pb.go=forgejo.csbx.dev/acmcarther/yesod/experimental/users/acmcarther/llm/litellm_grpc/litellm_grpc.pb.go",
+    ],
+    outputs = [
+        "litellm.pb.go",
+        "litellm_grpc.pb.go",
+    ],
+    plugins = [
+        "@build_stack_rules_proto//plugin/golang/protobuf:protoc-gen-go",
+        "@build_stack_rules_proto//plugin/grpc/grpc-go:protoc-gen-go-grpc",
+    ],
+    proto = ":litellm_proto",
+)
+
+go_library(
+    name = "litellm_go_proto",
+    srcs = [":litellm_go_compile"],
+    importpath = "forgejo.csbx.dev/acmcarther/yesod/experimental/users/acmcarther/llm/litellm_grpc",
+    visibility = ["//visibility:public"],
+    deps = [
+        "@org_golang_google_grpc//:go_default_library",
+        "@org_golang_google_grpc//codes",
+        "@org_golang_google_grpc//status",
+        "@org_golang_google_protobuf//reflect/protoreflect",
+        "@org_golang_google_protobuf//runtime/protoimpl",
+    ],
+)
+
+go_binary(
+    name = "client_go",
+    srcs = ["main.go"],
+    visibility = ["//visibility:public"],
+    deps = [
+        ":litellm_go_proto",
+        "@org_golang_google_grpc//:go_default_library",
+        "@org_golang_google_grpc//credentials/insecure",
+    ],
+)
\ No newline at end of file
diff --git a/experimental/users/acmcarther/llm/litellm_grpc/README.md b/experimental/users/acmcarther/llm/litellm_grpc/README.md
new file mode 100644
index 0000000..a0d2415
--- /dev/null
+++ b/experimental/users/acmcarther/llm/litellm_grpc/README.md
@@ -0,0 +1,66 @@
+# LiteLLM gRPC Example
+
+This directory contains an example of wrapping [LiteLLM](https://github.com/BerriAI/litellm) in a gRPC service and consuming it with a Go client.
+
+## Components
+
+1.  **`litellm.proto`**: Defines the `LiteLLMService` with `Chat` and `StreamChat` methods.
+2.  **`server_main.py`**: A Python gRPC server that implements the service using `litellm`.
+3.  **`main.go`**: A Go client that calls the service.
+
+## Prerequisites
+
+-   Bazel
+-   A `.env` file with your LLM API keys/base (optional, but recommended if you aren't using default OpenAI).
+
+## Setup
+
+Create a `.env` file in this directory (or anywhere `python-dotenv` can find it, though running via Bazel requires care with file placement).
+Alternatively, you can export environment variables before running the server (but Bazel sanitizes envs).
+For local development, it's often easiest to run the python binary directly from `bazel-bin` or use `bazel run` with `--action_env`.
+
+Example `.env`:
+```
+OPENAI_API_KEY=your_key
+OPENAI_API_BASE=http://localhost:1234/v1
+```
+
+## Running the Server
+
+```bash
+bazel run //experimental/users/acmcarther/litellm_grpc:server_main
+```
+
+To pass environment variables:
+
+```bash
+bazel run --action_env=OPENAI_API_KEY=$OPENAI_API_KEY --action_env=OPENAI_API_BASE=$OPENAI_API_BASE //experimental/users/acmcarther/litellm_grpc:server_main
+```
+
+## Running the Client
+
+Open a new terminal.
+
+To run a basic chat:
+
+```bash
+bazel run //experimental/users/acmcarther/litellm_grpc:client_go -- --prompt "Tell me a joke" --model "gpt-3.5-turbo"
+```
+
+To run with streaming:
+
+```bash
+bazel run //experimental/users/acmcarther/litellm_grpc:client_go -- --prompt "Write a poem" --stream
+```
+
+To run embeddings:
+
+```bash
+bazel run //experimental/users/acmcarther/litellm_grpc:client_go -- --embedding_input "This is a test sentence." --model "openai/qwen3-embedding-8b-dwq"
+```
+
+## Customizing
+
+-   Edit `litellm.proto` to add more fields (e.g., `top_p`, `presence_penalty`).
+-   Update `server_main.py` to pass these fields to `litellm.completion`.
+-   Update `main.go` to support setting these fields via flags.
diff --git a/experimental/users/acmcarther/llm/litellm_grpc/litellm.proto b/experimental/users/acmcarther/llm/litellm_grpc/litellm.proto
new file mode 100644
index 0000000..3e77f03
--- /dev/null
+++ b/experimental/users/acmcarther/llm/litellm_grpc/litellm.proto
@@ -0,0 +1,48 @@
+syntax = "proto3";
+
+package experimental.users.acmcarther.llm.litellm_grpc;
+
+option go_package = "forgejo.csbx.dev/acmcarther/yesod/experimental/users/acmcarther/llm/litellm_grpc";
+
+message Message {
+  string role = 1;
+  string content = 2;
+}
+
+message ChatRequest {
+  string model = 1;
+  repeated Message messages = 2;
+  float temperature = 3;
+  int32 max_tokens = 4;
+}
+
+message ChatResponse {
+  string content = 1;
+  string role = 2;
+  string finish_reason = 3;
+}
+
+message EmbeddingRequest {
+  string model = 1;
+  repeated string inputs = 2;
+}
+
+message EmbeddingResponse {
+  message Embedding {
+    repeated float values = 1;
+    int32 index = 2;
+  }
+  repeated Embedding embeddings = 1;
+  string model = 2;
+  message Usage {
+    int32 prompt_tokens = 1;
+    int32 total_tokens = 2;
+  }
+  Usage usage = 3;
+}
+
+service LiteLLMService {
+  rpc Chat(ChatRequest) returns (ChatResponse) {}
+  rpc StreamChat(ChatRequest) returns (stream ChatResponse) {}
+  rpc Embed(EmbeddingRequest) returns (EmbeddingResponse) {}
+}
diff --git a/experimental/users/acmcarther/llm/litellm_grpc/main.go b/experimental/users/acmcarther/llm/litellm_grpc/main.go
new file mode 100644
index 0000000..f05fd16
--- /dev/null
+++ b/experimental/users/acmcarther/llm/litellm_grpc/main.go
@@ -0,0 +1,110 @@
+package main
+
+import (
+	"context"
+	"flag"
+	"fmt"
+	"io"
+	"log"
+	"time"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+	pb "forgejo.csbx.dev/acmcarther/yesod/experimental/users/acmcarther/llm/litellm_grpc"
+)
+
+var (
+	addr       = flag.String("addr", "localhost:50051", "the address to connect to")
+	prompt     = flag.String("prompt", "Hello, how are you?", "The prompt to send to the LLM")
+	model      = flag.String("model", "gpt-3.5-turbo", "The model to use")
+	stream     = flag.Bool("stream", false, "Use streaming API")
+	maxTokens  = flag.Int("max_tokens", 100, "Max tokens to generate")
+	temperature = flag.Float64("temperature", 0.7, "Temperature")
+	embeddingInput = flag.String("embedding_input", "", "Text to embed (if set, runs embedding instead of chat)")
+)
+
+func main() {
+	flag.Parse()
+
+	// Set up a connection to the server.
+	conn, err := grpc.Dial(*addr, grpc.WithTransportCredentials(insecure.NewCredentials()))
+	if err != nil {
+		log.Fatalf("did not connect: %v", err)
+	}
+	defer conn.Close()
+	c := pb.NewLiteLLMServiceClient(conn)
+
+	// Contact the server and print out its response.
+	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
+	defer cancel()
+
+	if *embeddingInput != "" {
+		runEmbedding(ctx, c)
+		return
+	}
+
+	req := &pb.ChatRequest{
+		Model: *model,
+		Messages: []*pb.Message{
+			{Role: "user", Content: *prompt},
+		},
+		MaxTokens:   int32(*maxTokens),
+		Temperature: float32(*temperature),
+	}
+
+	log.Printf("Sending request for model: %s, prompt: %q", *model, *prompt)
+
+	if *stream {
+		runStream(ctx, c, req)
+	} else {
+		runChat(ctx, c, req)
+	}
+}
+
+func runChat(ctx context.Context, c pb.LiteLLMServiceClient, req *pb.ChatRequest) {
+	resp, err := c.Chat(ctx, req)
+	if err != nil {
+		log.Fatalf("could not get chat response: %v", err)
+	}
+	log.Printf("Response: %s", resp.GetContent())
+}
+
+func runStream(ctx context.Context, c pb.LiteLLMServiceClient, req *pb.ChatRequest) {
+	stream, err := c.StreamChat(ctx, req)
+	if err != nil {
+		log.Fatalf("could not start stream: %v", err)
+	}
+
+	log.Println("Stream started:")
+	for {
+		resp, err := stream.Recv()
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			log.Fatalf("streaming error: %v", err)
+		}
+		// Print content as it comes
+		if content := resp.GetContent(); content != "" {
+			fmt.Print(content)
+		}
+	}
+	fmt.Println() // Ensure valid newline at the end
+	log.Println("Stream finished.")
+}
+
+func runEmbedding(ctx context.Context, c pb.LiteLLMServiceClient) {
+	log.Printf("Sending embedding request for model: %s, input: %q", *model, *embeddingInput)
+	resp, err := c.Embed(ctx, &pb.EmbeddingRequest{
+		Model:  *model,
+		Inputs: []string{*embeddingInput},
+	})
+	if err != nil {
+		log.Fatalf("could not get embedding response: %v", err)
+	}
+	
+	for _, emb := range resp.GetEmbeddings() {
+		log.Printf("Embedding %d (size: %d): [%.4f, %.4f, ...]", emb.GetIndex(), len(emb.GetValues()), emb.GetValues()[0], emb.GetValues()[1])
+	}
+	log.Printf("Usage: Prompt Tokens: %d, Total Tokens: %d", resp.GetUsage().GetPromptTokens(), resp.GetUsage().GetTotalTokens())
+}
diff --git a/experimental/users/acmcarther/llm/litellm_grpc/server_main.py b/experimental/users/acmcarther/llm/litellm_grpc/server_main.py
new file mode 100644
index 0000000..0341e9c
--- /dev/null
+++ b/experimental/users/acmcarther/llm/litellm_grpc/server_main.py
@@ -0,0 +1,146 @@
+import asyncio
+import os
+import logging
+from typing import AsyncIterable
+
+import grpc
+import litellm
+from dotenv import load_dotenv
+
+from experimental.users.acmcarther.llm.litellm_grpc import litellm_pb2, litellm_pb2_grpc
+
+# Configure logging
+logging.basicConfig(level=logging.INFO)
+logger = logging.getLogger(__name__)
+
+# Load environment variables
+load_dotenv()
+
+api_base = os.getenv('OPENAI_API_BASE', 'http://192.168.0.235:1234/v1')
+api_key = os.getenv('OPENAI_API_KEY', 'lm-studio')
+
+def get_safe(obj, attr, default=None):
+    """Safely get an attribute from an object or key from a dict."""
+    if isinstance(obj, dict):
+        return obj.get(attr, default)
+    return getattr(obj, attr, default)
+
+class LiteLLMService(litellm_pb2_grpc.LiteLLMServiceServicer):
+    def __init__(self):
+        # Optional: Set defaults from env if needed
+        pass
+
+    async def Chat(self, request, context):
+        logger.info(f"Received Chat request for model: {request.model}")
+        
+        messages = [{"role": m.role, "content": m.content} for m in request.messages]
+        
+        try:
+            response = await litellm.acompletion(
+                model=request.model,
+                messages=messages,
+                temperature=request.temperature if request.temperature else None,
+                max_tokens=request.max_tokens if request.max_tokens > 0 else None,
+                api_key=api_key,
+                api_base=api_base,
+            )
+            
+            choice = response.choices[0]
+            return litellm_pb2.ChatResponse(
+                content=choice.message.content,
+                role=choice.message.role,
+                finish_reason=choice.finish_reason if hasattr(choice, 'finish_reason') else ""
+            )
+            
+        except Exception as e:
+            logger.error(f"Error in Chat: {e}")
+            context.set_code(grpc.StatusCode.INTERNAL)
+            context.set_details(str(e))
+            return litellm_pb2.ChatResponse()
+
+    async def StreamChat(self, request, context):
+        logger.info(f"Received StreamChat request for model: {request.model}")
+        
+        messages = [{"role": m.role, "content": m.content} for m in request.messages]
+        
+        try:
+            response = await litellm.acompletion(
+                model=request.model,
+                messages=messages,
+                temperature=request.temperature if request.temperature else None,
+                max_tokens=request.max_tokens if request.max_tokens > 0 else None,
+                stream=True,
+                api_key=api_key,
+                api_base=api_base,
+            )
+            
+            async for chunk in response:
+                if len(chunk.choices) > 0:
+                    delta = chunk.choices[0].delta
+                    content = delta.content if hasattr(delta, 'content') and delta.content else ""
+                    role = delta.role if hasattr(delta, 'role') and delta.role else ""
+                    # finish_reason might be on the choice, not delta
+                    finish_reason = chunk.choices[0].finish_reason if hasattr(chunk.choices[0], 'finish_reason') else ""
+                    
+                    if content or role or finish_reason:
+                        yield litellm_pb2.ChatResponse(
+                            content=content,
+                            role=role,
+                            finish_reason=finish_reason or ""
+                        )
+
+        except Exception as e:
+            logger.error(f"Error in StreamChat: {e}")
+            context.set_code(grpc.StatusCode.INTERNAL)
+            context.set_details(str(e))
+
+    async def Embed(self, request, context):
+        logger.info(f"Received Embed request for model: {request.model}")
+        
+        try:
+            response = await litellm.aembedding(
+                model=request.model,
+                input=request.inputs,
+                api_key=api_key,
+                api_base=api_base,
+            )
+            
+            logger.debug(f"Embedding response: {response}")
+            
+            embeddings = []
+            for data in response.data:
+                embeddings.append(litellm_pb2.EmbeddingResponse.Embedding(
+                    values=get_safe(data, 'embedding'),
+                    index=get_safe(data, 'index')
+                ))
+            
+            usage_obj = get_safe(response, 'usage', {})
+            usage = litellm_pb2.EmbeddingResponse.Usage(
+                prompt_tokens=get_safe(usage_obj, 'prompt_tokens', 0),
+                total_tokens=get_safe(usage_obj, 'total_tokens', 0)
+            )
+            
+            return litellm_pb2.EmbeddingResponse(
+                embeddings=embeddings,
+                model=get_safe(response, 'model', ""),
+                usage=usage
+            )
+
+        except Exception as e:
+            logger.error(f"Error in Embed: {e}")
+            context.set_code(grpc.StatusCode.INTERNAL)
+            context.set_details(str(e))
+            return litellm_pb2.EmbeddingResponse()
+
+
+async def serve():
+    port = os.getenv("PORT", "50051")
+    server = grpc.aio.server()
+    litellm_pb2_grpc.add_LiteLLMServiceServicer_to_server(LiteLLMService(), server)
+    server.add_insecure_port(f"[::]:{port}")
+    logger.info(f"Starting gRPC server on port {port}...")
+    await server.start()
+    await server.wait_for_termination()
+
+if __name__ == "__main__":
+    asyncio.run(serve())
diff --git a/experimental/users/acmcarther/llm/mcp_server_prototype/BUILD.bazel b/experimental/users/acmcarther/llm/mcp_server_prototype/BUILD.bazel
new file mode 100644
index 0000000..b9c0d4a
--- /dev/null
+++ b/experimental/users/acmcarther/llm/mcp_server_prototype/BUILD.bazel
@@ -0,0 +1,27 @@
+load("@rules_go//go:def.bzl", "go_binary", "go_library", "go_test")
+
+go_library(
+    name = "mcp_server_prototype_lib",
+    srcs = ["main.go"],
+    importpath = "forgejo.csbx.dev/acmcarther/yesod/experimental/users/acmcarther/llm/mcp_server_prototype",
+    visibility = ["//visibility:private"],
+    deps = [
+        "@com_github_modelcontextprotocol_go_sdk//mcp",
+        "@in_gopkg_yaml_v3//:yaml_v3",
+    ],
+)
+
+go_binary(
+    name = "mcp_server_prototype",
+    embed = [":mcp_server_prototype_lib"],
+    visibility = ["//visibility:public"],
+)
+
+go_test(
+    name = "mcp_server_prototype_test",
+    srcs = ["main_test.go"],
+    data = [":mcp_server_prototype"],
+    embed = [":mcp_server_prototype_lib"],
+    tags = ["manual"],
+    deps = ["@com_github_modelcontextprotocol_go_sdk//mcp"],
+)
diff --git a/experimental/users/acmcarther/llm/mcp_server_prototype/main.go b/experimental/users/acmcarther/llm/mcp_server_prototype/main.go
new file mode 100644
index 0000000..977e261
--- /dev/null
+++ b/experimental/users/acmcarther/llm/mcp_server_prototype/main.go
@@ -0,0 +1,170 @@
+package main
+
+import (
+	"context"
+	"flag"
+	"fmt"
+	"log"
+	"net/http"
+	"os"
+	"os/exec"
+	"path/filepath"
+
+	"github.com/modelcontextprotocol/go-sdk/mcp"
+	"gopkg.in/yaml.v3"
+)
+
+var (
+	projectRoot = flag.String("project-root", ".", "The absolute path to the project root directory.")
+	listenAddr  = flag.String("listen-addr", "", "If non-empty, listen on this HTTP address instead of using stdio.")
+)
+
+// Arguments for the hello_world tool
+type HelloWorldArgs struct {
+	Name string `json:"name"`
+}
+
+// Handler for the hello_world tool
+func handleHelloWorld(ctx context.Context, session *mcp.ServerSession, req *mcp.CallToolParamsFor[HelloWorldArgs]) (*mcp.CallToolResultFor[any], error) {
+	log.Println("Executing handleHelloWorld")
+	return &mcp.CallToolResultFor[any]{
+		Content: []mcp.Content{
+			&mcp.TextContent{Text: "Hello, " + req.Arguments.Name},
+		},
+	}, nil
+}
+
+// Arguments for the invoke_agent tool
+type InvokeAgentArgs struct {
+	TaskFile string `json:"task_file"`
+}
+
+// TaskYAML defines the structure of the agent task file.
+type TaskYAML struct {
+	Agent        string   `yaml:"agent"`
+	Model        string   `yaml:"model"`
+	Prompt       string   `yaml:"prompt"`
+	ContextFiles []string `yaml:"context_files"`
+}
+
+// Handler for the invoke_agent tool
+func handleInvokeAgent(ctx context.Context, session *mcp.ServerSession, req *mcp.CallToolParamsFor[InvokeAgentArgs]) (*mcp.CallToolResultFor[any], error) {
+	log.Println("Executing handleInvokeAgent")
+	// Ensure the task file path is absolute
+	taskFile := req.Arguments.TaskFile
+	if !filepath.IsAbs(taskFile) {
+		taskFile = filepath.Join(*projectRoot, taskFile)
+	}
+	log.Printf("Invoking agent with task file: %s", taskFile)
+
+	// 1. Read and parse the task file
+	log.Println("Reading and parsing task file...")
+	yamlFile, err := os.ReadFile(taskFile)
+	if err != nil {
+		log.Printf("Error reading task file %s: %v", taskFile, err)
+		return &mcp.CallToolResultFor[any]{
+			Content: []mcp.Content{&mcp.TextContent{Text: "Error: " + err.Error()}},
+		}, nil
+	}
+
+	var task TaskYAML
+	err = yaml.Unmarshal(yamlFile, &task)
+	if err != nil {
+		log.Printf("Error unmarshaling YAML from %s: %v", taskFile, err)
+		return &mcp.CallToolResultFor[any]{
+			Content: []mcp.Content{&mcp.TextContent{Text: "Error: " + err.Error()}},
+		}, nil
+	}
+	log.Println("Task file parsed successfully.")
+
+	// 2. Construct the command to invoke the microagent, ensuring paths are absolute
+	log.Println("Constructing agent invocation command...")
+	scriptPath := filepath.Join(*projectRoot, "scripts/invoke_microagent.sh")
+	args := []string{
+		task.Agent,
+		task.Prompt,
+		"--model",
+		task.Model,
+	}
+	for _, file := range task.ContextFiles {
+		absFile := file
+		if !filepath.IsAbs(absFile) {
+			absFile = filepath.Join(*projectRoot, file)
+		}
+		args = append(args, "--context-file", absFile)
+	}
+
+	log.Printf("Executing command: %s %v", scriptPath, args)
+	cmd := exec.Command(scriptPath, args...)
+	output, err := cmd.CombinedOutput()
+	if err != nil {
+		log.Printf("Error invoking agent script: %v", err)
+		log.Printf("Agent script output: %s", string(output))
+		return &mcp.CallToolResultFor[any]{
+			Content: []mcp.Content{
+				&mcp.TextContent{Text: "Error invoking agent script: " + err.Error() + "\nOutput:\n" + string(output)},
+			},
+		}, nil
+	}
+
+	log.Printf("Agent script output: %s", string(output))
+
+	// 3. Wrap the output in a "context firewall" to prevent identity bleed.
+	firewalledOutput := fmt.Sprintf(
+		"--- BEGIN SUB-AGENT OUTPUT (%s) ---\n%s\n--- END SUB-AGENT OUTPUT ---",
+		task.Agent,
+		string(output),
+	)
+
+	return &mcp.CallToolResultFor[any]{
+		Content: []mcp.Content{
+			&mcp.TextContent{Text: firewalledOutput},
+		},
+	}, nil
+}
+
+func main() {
+	flag.Parse()
+	log.SetFlags(log.LstdFlags | log.Lshortfile)
+	log.Println("--- MCP Server Starting ---")
+	log.Printf("Project Root: %s", *projectRoot)
+
+	log.Println("Creating new MCP server implementation...")
+	serverImpl := &mcp.Implementation{Name: "prototype-server"}
+	log.Println("Server implementation created.")
+
+	log.Println("Creating new MCP server...")
+	server := mcp.NewServer(serverImpl, nil)
+	log.Println("MCP server created.")
+
+	log.Println("Adding 'hello_world' tool...")
+	mcp.AddTool(server, &mcp.Tool{
+		Name:        "hello_world",
+		Description: "A simple hello world tool for testing.",
+	}, handleHelloWorld)
+	log.Println("'hello_world' tool added.")
+
+	log.Println("Adding 'invoke_agent' tool...")
+	mcp.AddTool(server, &mcp.Tool{
+		Name:        "invoke_agent",
+		Description: "Invokes an asynchronous agent task.",
+	}, handleInvokeAgent)
+	log.Println("'invoke_agent' tool added.")
+
+	if *listenAddr != "" {
+		handler := mcp.NewStreamableHTTPHandler(func(*http.Request) *mcp.Server {
+			return server
+		}, nil)
+		log.Printf("MCP handler listening at %s", *listenAddr)
+		if err := http.ListenAndServe(*listenAddr, handler); err != nil {
+			log.Fatalf("HTTP server failed: %v", err)
+		}
+	} else {
+		log.Println("Starting MCP server with stdio transport...")
+		transport := mcp.NewLoggingTransport(mcp.NewStdioTransport(), os.Stderr)
+		if err := server.Run(context.Background(), transport); err != nil {
+			log.Fatalf("Server run loop failed: %v", err)
+		}
+		log.Println("Server run loop finished.")
+	}
+}
\ No newline at end of file
diff --git a/experimental/users/acmcarther/llm/mcp_server_prototype/main_test.go b/experimental/users/acmcarther/llm/mcp_server_prototype/main_test.go
new file mode 100644
index 0000000..d151799
--- /dev/null
+++ b/experimental/users/acmcarther/llm/mcp_server_prototype/main_test.go
@@ -0,0 +1,189 @@
+package main
+
+import (
+	"bufio"
+	"encoding/json"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"testing"
+
+	"github.com/modelcontextprotocol/go-sdk/mcp"
+)
+
+// Local definitions of MCP JSON-RPC structures for robust testing,
+// avoiding dependency on a specific SDK version which has proven unstable.
+
+type Request struct {
+	Version string `json:"jsonrpc"`
+	ID      string `json:"id"`
+	Method  string `json:"method"`
+	Params  any    `json:"params,omitempty"`
+}
+
+// Error defines the structure for a JSON-RPC error object.
+type Error struct {
+	Code    int    `json:"code"`
+	Message string `json:"message"`
+	Data    any    `json:"data,omitempty"`
+}
+
+type Response struct {
+	Version string          `json:"jsonrpc"`
+	ID      string          `json:"id"`
+	Result  json.RawMessage `json:"result,omitempty"`
+	Error   *Error          `json:"error,omitempty"`
+}
+
+type ListToolsResult struct {
+	Tools []*mcp.Tool `json:"tools"`
+}
+
+type CallToolResult struct {
+	Content []json.RawMessage `json:"content"`
+}
+
+type TextContent struct {
+	Text string `json:"text"`
+	Type string `json:"type"`
+}
+
+// startTestServer starts the compiled server binary as a subprocess for testing.
+func startTestServer(t *testing.T) (*exec.Cmd, *bufio.Writer, *bufio.Reader) {
+	t.Helper()
+	path, ok := os.LookupEnv("TEST_SRCDIR")
+	if !ok {
+		t.Fatal("TEST_SRCDIR not set")
+	}
+	cmdPath := filepath.Join(path, "_main/experimental/mcp_server_prototype/mcp_server_prototype_/mcp_server_prototype")
+	cmd := exec.Command(cmdPath)
+
+	stdinPipe, err := cmd.StdinPipe()
+	if err != nil {
+		t.Fatalf("Failed to get stdin pipe: %v", err)
+	}
+	stdoutPipe, err := cmd.StdoutPipe()
+	if err != nil {
+		t.Fatalf("Failed to get stdout pipe: %v", err)
+	}
+	if err := cmd.Start(); err != nil {
+		t.Fatalf("Failed to start command: %v", err)
+	}
+	return cmd, bufio.NewWriter(stdinPipe), bufio.NewReader(stdoutPipe)
+}
+
+// sendRequest marshals and sends a request object to the server's stdin.
+func sendRequest(t *testing.T, stdin *bufio.Writer, reqID, method string, params any) {
+	t.Helper()
+	req := Request{
+		Version: "2.0",
+		ID:      reqID,
+		Method:  method,
+		Params:  params,
+	}
+	reqBytes, err := json.Marshal(req)
+	if err != nil {
+		t.Fatalf("Failed to marshal request: %v", err)
+	}
+	if _, err := stdin.Write(append(reqBytes, '\n')); err != nil {
+		t.Fatalf("Failed to write to stdin: %v", err)
+	}
+	if err := stdin.Flush(); err != nil {
+		t.Fatalf("Failed to flush stdin: %v", err)
+	}
+}
+
+// readResponse reads and unmarshals a response object from the server's stdout.
+func readResponse(t *testing.T, stdout *bufio.Reader) *Response {
+	t.Helper()
+	line, err := stdout.ReadBytes('\n')
+	if err != nil {
+		t.Fatalf("Failed to read from stdout: %v", err)
+	}
+	var resp Response
+	if err := json.Unmarshal(line, &resp); err != nil {
+		t.Fatalf("Failed to unmarshal response: %s\nError: %v", string(line), err)
+	}
+	return &resp
+}
+
+func TestMCPWithSubprocess(t *testing.T) {
+	cmd, stdin, stdout := startTestServer(t)
+	defer cmd.Process.Kill()
+
+	// Step 1: Initialize the session
+	initID := "init-1"
+	sendRequest(t, stdin, initID, "mcp.initialize", &mcp.InitializeParams{})
+	initResp := readResponse(t, stdout)
+	if initResp.ID != initID {
+		t.Fatalf("Expected init response ID '%s', got '%s'", initID, initResp.ID)
+	}
+	if initResp.Error != nil {
+		t.Fatalf("Initialize failed: %v", initResp.Error)
+	}
+
+	// Step 2: ListTools
+	t.Run("ListTools", func(t *testing.T) {
+		reqID := "list-tools-1"
+		sendRequest(t, stdin, reqID, "mcp.listTools", &mcp.ListToolsParams{})
+
+		resp := readResponse(t, stdout)
+		if resp.ID != reqID {
+			t.Errorf("Expected response ID '%s', got '%s'", reqID, resp.ID)
+		}
+		if resp.Error != nil {
+			t.Fatalf("Received unexpected error: %v", resp.Error)
+		}
+
+		var result ListToolsResult
+		if err := json.Unmarshal(resp.Result, &result); err != nil {
+			t.Fatalf("Failed to unmarshal result: %v", err)
+		}
+
+		if len(result.Tools) != 2 {
+			t.Fatalf("Expected 2 tools, got %d", len(result.Tools))
+		}
+		if result.Tools[0].Name != "hello_world" {
+			t.Errorf("Expected tool 0 to be 'hello_world', got '%s'", result.Tools[0].Name)
+		}
+	})
+
+	// Step 3: CallTool 'invoke_agent'
+	t.Run("CallTool_InvokeAgent", func(t *testing.T) {
+		reqID := "call-tool-1"
+		taskFile := "/path/to/task.yaml"
+		args := InvokeAgentArgs{TaskFile: taskFile}
+
+		sendRequest(t, stdin, reqID, "mcp.callTool", &mcp.CallToolParams{
+			Name:      "invoke_agent",
+			Arguments: &args,
+		})
+
+		resp := readResponse(t, stdout)
+		if resp.ID != reqID {
+			t.Errorf("Expected response ID '%s', got '%s'", reqID, resp.ID)
+		}
+		if resp.Error != nil {
+			t.Fatalf("Received unexpected error: %v", resp.Error)
+		}
+
+		var result CallToolResult
+		if err := json.Unmarshal(resp.Result, &result); err != nil {
+			t.Fatalf("Failed to unmarshal result: %v", err)
+		}
+
+		if len(result.Content) != 1 {
+			t.Fatalf("Expected 1 content block, got %d", len(result.Content))
+		}
+
+		var textContent TextContent
+		if err := json.Unmarshal(result.Content[0], &textContent); err != nil {
+			t.Fatalf("Failed to unmarshal text content: %v", err)
+		}
+
+		expected := "Successfully received task_file: " + taskFile
+		if textContent.Text != expected {
+			t.Errorf("Expected output '%s', got '%s'", expected, textContent.Text)
+		}
+	})
+}
diff --git a/experimental/users/acmcarther/llm/mlx/BUILD.bazel b/experimental/users/acmcarther/llm/mlx/BUILD.bazel
new file mode 100644
index 0000000..633683b
--- /dev/null
+++ b/experimental/users/acmcarther/llm/mlx/BUILD.bazel
@@ -0,0 +1,33 @@
+load("@aspect_rules_py//py:defs.bzl", "py_binary", "py_library", "py_pex_binary", "py_unpacked_wheel")
+load("@pip_third_party//:requirements.bzl", "requirement")
+
+py_unpacked_wheel(
+    name = "en_core_web_sm",
+    src = "@spacy_en_core_web_sm//file",
+)
+
+py_binary(
+    name = "mlx_testing_main",
+    srcs = ["mlx_testing_main.py"],
+    target_compatible_with = ["@platforms//os:macos"],
+    deps = [
+        ":en_core_web_sm",
+        requirement("mlx-audio"),
+        requirement("mlx"),
+        # Transitive dep of mlx-audio?
+        requirement("soundfile"),
+        requirement("sounddevice"),
+        requirement("scipy"),
+        requirement("loguru"),
+        requirement("misaki"),
+        requirement("num2words"),
+        requirement("spacy"),
+        requirement("huggingface_hub"),
+    ],
+)
+
+py_pex_binary(
+    name = "mlx_testing",
+    binary = ":mlx_testing_main",
+    target_compatible_with = ["@platforms//os:macos"],
+)
diff --git a/experimental/users/acmcarther/llm/mlx/mlx_testing_main.py b/experimental/users/acmcarther/llm/mlx/mlx_testing_main.py
new file mode 100644
index 0000000..114ea9f
--- /dev/null
+++ b/experimental/users/acmcarther/llm/mlx/mlx_testing_main.py
@@ -0,0 +1,22 @@
+from mlx_audio.tts.generate import generate_audio
+
+def main():
+    generate_audio(
+        text=("White sparks cascaded onto the trembling wick. It was as if there were shooting stars in his hands, like the stars at the bottom of the grave to which Silk and Hyacinth had driven Orpine’s body in a dream he recalled with uncanny clarity. Here we dig holes in the ground for our dead, he thought, to bring them nearer the Outsider; and on Blue we do the same because we did it here, though it takes them away from him."),
+        model_path="prince-canuma/Kokoro-82M",
+        #voice="af_heart",
+        voice="am_santa",
+        #voice="am_echo",
+        speed=1.2,
+        lang_code="a", # Kokoro: (a)f_heart, or comment out for auto
+        file_prefix="audiobook_chapter1",
+        audio_format="wav",
+        sample_rate=24000,
+        join_audio=True,
+        verbose=True  # Set to False to disable print messages
+    )
+    print("Audiobook chapter successfully generated!")
+
+
+if __name__ == "__main__":
+    main()
\ No newline at end of file
diff --git a/experimental/users/acmcarther/llm/prompts/dependency_research.md b/experimental/users/acmcarther/llm/prompts/dependency_research.md
new file mode 100644
index 0000000..4329092
--- /dev/null
+++ b/experimental/users/acmcarther/llm/prompts/dependency_research.md
@@ -0,0 +1,155 @@
+# Dependency Research Agent Prompt
+
+## Task Overview
+You are tasked with analyzing the contents of a `package.json` file and conducting comprehensive research on each direct dependency and devDependency listed within it. Your goal is to produce a detailed report explaining what each package does, its purpose in web development/Node.js ecosystems, and provide credible references for all information presented.
+
+## Input Format
+You will be provided with a `package.json` file. Extract and analyze:
+- All dependencies listed under the `"dependencies"` field
+- All devDependencies listed under the `"devDependencies"` field
+
+## Research Requirements
+
+For each dependency, you must research and provide:
+
+### 1. Package Overview
+- **Name**: The exact package name from the manifest
+- **Version**: Current specified version (if provided)
+- **Primary Functionality**: What the package does in plain language
+- **Category**: Type of tool (e.g., build tool, testing framework, utility library, etc.)
+
+### 2. Technical Details
+- **Purpose**: What specific problem does this package solve?
+- **Key Features**: Main capabilities and functionalities
+- **Ecosystem Role**: How it fits into the Node.js/web development ecosystem
+- **Usage Contexts**: Common scenarios where this package is typically used
+
+### 3. Impact Assessment
+- **Industry Adoption**: How widely used is this package?
+- **Development Benefits**: What advantages does it provide to developers?
+- **Potential Concerns**: Any known issues, security considerations, or maintenance status
+- **Alternatives**: Brief mention of similar packages (if relevant)
+
+### 4. References and Verification
+- **Official Documentation**: Link to official docs, GitHub repository, or website
+- **NPM Registry Information**: Official npm page and statistics
+- **Author/Maintainer Information**: Who maintains the package
+- **Community Resources**: Stack Overflow discussions, tutorials, or articles that explain its usage
+
+## Output Format Requirements
+
+### Report Structure
+```
+# Dependency Research Report - [Project Name]
+
+## Executive Summary
+[Brief overview of the total dependencies analyzed, notable patterns, or key findings]
+
+## Detailed Dependency Analysis
+
+### Dependencies (Production)
+
+#### [Package Name 1]
+- **Version**: [version]
+- **Primary Functionality**: [clear description]
+- **Technical Purpose**: [detailed explanation of what it does technically]
+- **Key Features**: 
+  - Feature 1
+  - Feature 2
+  - Feature 3
+- **Ecosystem Role**: [how it fits into the ecosystem]
+- **Development Impact**: [benefits and considerations]
+- **References**:
+  - Official: [URL to docs/repo]
+  - NPM: [npm page URL]
+  - Additional: [relevant URLs]
+
+#### [Package Name 2]
+[Repeat structure for each dependency]
+
+### Dev Dependencies
+
+#### [Dev Package Name 1]
+[Same structure as above]
+
+## Summary Analysis
+- Total dependencies analyzed: [number]
+- Most common dependency types: [analysis of patterns]
+- Security considerations: [overall assessment]
+- Recommendations: [if applicable]
+```
+
+## Quality Standards
+
+### Research Depth
+1. **Minimum Viable Information**: Every package must have basic functionality explained clearly
+2. **Credible Sources Only**: Use official documentation, npm registry, GitHub repositories, established tech blogs
+3. **Technical Accuracy**: Ensure technical details are correct and up-to-date
+4. **Context Awareness**: Consider how the package fits into modern web development practices
+
+### Reference Requirements
+- At least 2 credible sources per package (official documentation counts as one)
+- Prefer primary sources (official docs, GitHub) over secondary sources
+- Include both official resources and community validation when possible
+- All claims should be verifiable through provided references
+
+### Writing Quality
+- Use clear, jargon-free language where possible
+- Maintain consistency in terminology throughout the report
+- Provide sufficient technical detail without being overwhelming
+- Include both high-level purpose and specific implementation details
+
+## Research Process Guidelines
+
+### Step 1: Initial Assessment
+- Start with the official npm page for basic information
+- Check the package's GitHub repository (if available) for documentation and README
+- Review recent commit activity to gauge maintenance status
+
+### Step 2: Deep Research
+- Explore official documentation thoroughly
+- Look for usage examples and real-world implementations
+- Check for any security advisories or known issues
+- Assess the package's reputation and community adoption
+
+### Step 3: Verification and Cross-referencing
+- Confirm information across multiple sources
+- Look for recent articles or discussions about the package's current relevance
+- Verify version compatibility and ecosystem position
+
+### Step 4: Analysis Synthesis
+- Synthesize findings into coherent explanations
+- Identify patterns across dependencies where relevant
+- Provide context for why certain types of packages are commonly used together
+
+## Special Considerations
+
+### Popular vs. Niche Packages
+- **Popular Packages**: Focus on real-world impact, ecosystem integration, and community adoption metrics
+- **Niche/Specialized Packages**: Emphasize specific use cases and technical capabilities
+- **Security-Critical Packages**: Pay special attention to maintenance status, security track record, and alternatives
+
+### Legacy vs. Modern Packages
+- **Legacy Packages**: Address maintenance status, deprecation risks, and modern alternatives
+- **Modern/Active Packages**: Emphasize current relevance and ongoing development
+
+### Framework-Specific vs. Utility Packages
+- **Framework-Specific**: Explain integration with specific frameworks (React, Vue, Angular, etc.)
+- **Utility Packages**: Focus on general-purpose functionality and cross-framework applicability
+
+## Completion Checklist
+Before finalizing your report, ensure:
+- [ ] Every dependency from both dependencies and devDependencies has been analyzed
+- [ ] All required sections are completed for each package
+- [ ] At least 2 credible references per dependency are provided
+- [ ] Technical explanations are accurate and up-to-date
+- [ ] Report structure follows the specified format exactly
+- [ ] Summary analysis provides overall insights about the dependency landscape
+- [ ] All links and references are functional and relevant
+
+## Expected Deliverables
+1. **Complete Dependency Report**: Structured report covering all specified elements
+2. **Reference Compilation**: Separate list of all sources cited for verification purposes (if requested)
+3. **Key Insights Summary**: High-level observations about the project's dependency ecosystem
+
+Remember: The goal is to provide actionable intelligence that helps developers understand not just what their dependencies are, but why they exist and what impact they have on the project
\ No newline at end of file
diff --git a/experimental/users/acmcarther/llm/stt/BUILD.bazel b/experimental/users/acmcarther/llm/stt/BUILD.bazel
new file mode 100644
index 0000000..1263b5c
--- /dev/null
+++ b/experimental/users/acmcarther/llm/stt/BUILD.bazel
@@ -0,0 +1,20 @@
+load("@aspect_rules_py//py:defs.bzl", "py_binary", "py_library", "py_pex_binary", "py_unpacked_wheel")
+load("@pip_third_party//:requirements.bzl", "requirement")
+
+py_binary(
+    name = "basic_recorder_main",
+    srcs = ["basic_recorder.py"],
+    deps = [
+        requirement("sounddevice"),
+        requirement("pyqt6"),
+        requirement("pyqt6-qt6"),
+        requirement("pyqt6-sip"),
+        requirement("numpy"),
+        requirement("scipy"),
+    ],
+)
+
+py_pex_binary(
+    name = "basic_recorder",
+    binary = ":basic_recorder_main",
+)
diff --git a/experimental/users/acmcarther/llm/stt/basic_recorder.py b/experimental/users/acmcarther/llm/stt/basic_recorder.py
new file mode 100644
index 0000000..b174843
--- /dev/null
+++ b/experimental/users/acmcarther/llm/stt/basic_recorder.py
@@ -0,0 +1,109 @@
+#!/usr/bin/env python3
+"""
+Simple PyQt6 microphone recorder with start/stop functionality.
+Requirements: pip install PyQt6 sounddevice numpy scipy
+"""
+
+import sys
+import threading
+from pathlib import Path
+
+import sounddevice as sd
+import numpy as np
+from PyQt6. QtWidgets import (
+    QApplication, QMainWindow, QVBoxLayout,
+    QWidget, QPushButton, QLabel
+)
+import scipy.io.wavfile as wavfile
+
+
+class MicrophoneRecorder(QMainWindow):
+    def __init__(self):
+        super().__init__()
+        self.setWindowTitle("Simple Mic Recorder")
+        self.setGeometry(100, 100, 400, 200)
+        
+        # Audio state
+        self.is_recording = False
+        self.audio_data = []
+        
+        # Setup UI  
+        self.setup_ui()
+        
+    def setup_ui(self):
+        central_widget = QWidget()
+        self.setCentralWidget(central_widget)
+        layout = QVBoxLayout(central_widget)
+        
+        # Status label
+        self.status_label = QLabel("Ready to record")
+        layout.addWidget(self.status_label)
+        
+        # Record button
+        self.record_button = QPushButton("Start Recording")
+        self.record_button.clicked.connect(self.toggle_recording)
+        layout.addWidget(self.record_button)
+        
+    def toggle_recording(self):
+        if not self.is_recording:
+            self.start_recording()
+        else: 
+            self.stop_recording()
+            
+    def start_recording(self):
+        """Start audio stream in background thread"""
+        self.is_recording = True
+        self.audio_data = []
+        
+        # Update UI
+        self.record_button.setText("Stop Recording")
+        self.status_label.setText("Recording... (click Stop when finished)")
+        
+        def record_audio():
+            with sd.InputStream(samplerate=44100, channels=1, callback=self.audio_callback):
+                while self.is_recording:
+                    sd.sleep(100)  # Keep thread alive
+                    
+        threading.Thread(target=record_audio, daemon=True).start()
+        
+    def stop_recording(self):
+        """Stop recording"""
+        self.is_recording = False
+        self.record_button.setText("Start Recording")
+        self.status_label.setText(f"Recording stopped ({len(self.audio_data)/44100:.1f}s)")
+        
+    def audio_callback(self, indata, frames, time, status):
+        """Called by sounddevice for each audio chunk"""
+        if self.is_recording:
+            self.audio_data.extend(indata[:, 0])  # Mono channel
+            
+    def save_recording(self):
+        """Save recorded audio to WAV file"""
+        if not self.audio_data:
+            return
+            
+        # Convert and save as 16-bit WAV
+        audio_array = np.array(self.audio_data, dtype=np.float32)
+        audio_16bit = (audio_array * 32767).astype(np.int16) 
+        
+        filename = f"recording_{len(self.audio_data)}.wav"
+        wavfile.write(filename, 44100, audio_16bit)
+        
+        self.status_label.setText(f"Saved: {filename}")
+
+
+def main():
+    app = QApplication(sys.argv)
+    
+    window = MicrophoneRecorder()
+    window.show()
+    
+    print("🎤 PyQt6 Mic Recorder")
+    print("- Click 'Start Recording' to begin")  
+    print("- Click 'Stop Recording' when finished")
+    
+    sys.exit(app.exec())
+
+
+if __name__ == "__main__":
+    main()
\ No newline at end of file
diff --git a/experimental/users/acmcarther/llm/tts/BUILD.bazel b/experimental/users/acmcarther/llm/tts/BUILD.bazel
new file mode 100644
index 0000000..2ab9e3b
--- /dev/null
+++ b/experimental/users/acmcarther/llm/tts/BUILD.bazel
@@ -0,0 +1,63 @@
+load("@aspect_rules_py//py:defs.bzl", "py_binary", "py_library", "py_pex_binary", "py_unpacked_wheel")
+load("@pip_third_party//:requirements.bzl", "requirement")
+
+py_binary(
+    name = "spacy_demo_main",
+    srcs = ["spacy_demo.py"],
+    deps = [
+        "//third_party/python/spacy:en_core_web_sm",
+        requirement("spacy"),
+    ],
+)
+
+py_binary(
+    name = "spacy_tts_pipeline_main",
+    srcs = ["spacy_tts_pipeline.py"],
+    target_compatible_with = ["@platforms//os:macos"],
+    deps = [
+        "//third_party/python/spacy:en_core_web_sm",
+        requirement("spacy"),
+        requirement("mlx"),
+        requirement("mlx-audio"),
+        # Transitive dep of mlx-audio?
+        requirement("soundfile"),
+        requirement("sounddevice"),
+        requirement("scipy"),
+        requirement("loguru"),
+        requirement("misaki"),
+        requirement("num2words"),
+        requirement("huggingface_hub"),
+    ],
+)
+
+py_pex_binary(
+    name = "spacy_tts_pipeline",
+    binary = ":spacy_tts_pipeline_main",
+    target_compatible_with = ["@platforms//os:macos"],
+)
+
+py_binary(
+    name = "enhanced_tts_pipeline_main",
+    srcs = ["enhanced_tts_pipeline.py"],
+    target_compatible_with = ["@platforms//os:macos"],
+    deps = [
+        "//third_party/python/spacy:en_core_web_sm",
+        requirement("spacy"),
+        requirement("mlx"),
+        requirement("mlx-audio"),
+        # Transitive dep of mlx-audio?
+        requirement("soundfile"),
+        requirement("sounddevice"),
+        requirement("scipy"),
+        requirement("loguru"),
+        requirement("misaki"),
+        requirement("num2words"),
+        requirement("huggingface_hub"),
+    ],
+)
+
+py_pex_binary(
+    name = "enhanced_tts_pipeline",
+    binary = ":enhanced_tts_pipeline_main",
+    target_compatible_with = ["@platforms//os:macos"],
+)
diff --git a/experimental/users/acmcarther/llm/tts/enhanced_tts_pipeline.py b/experimental/users/acmcarther/llm/tts/enhanced_tts_pipeline.py
new file mode 100644
index 0000000..3f041da
--- /dev/null
+++ b/experimental/users/acmcarther/llm/tts/enhanced_tts_pipeline.py
@@ -0,0 +1,297 @@
+"""
+Enhanced TTS Pipeline with SpaCy Emphasis Detection  
+Integration with your existing Kokoro TTS pipeline
+"""
+ 
+import spacy
+import re
+from typing import cast, List, Dict, Tuple
+from mlx_audio.tts.generate import generate_audio
+
+class EnhancedTTSPipeline:
+    """Enhanced TTS pipeline with automatic emphasis detection and annotation"""
+    
+    def __init__(self):
+        self.nlp = spacy.load("en_core_web_sm") 
+        
+    def enhance_text_with_emphasis(self, raw_text: str) -> str:
+        """Add emphasis annotations to text for improved TTS delivery"""
+        
+        # 1. Run your existing SpaCy preprocessing 
+        doc = self.nlp(raw_text)
+        
+        # 2. Detect emphasis points
+        emphasis_points = self._detect_emphasis_annotations(raw_text)
+        
+        # 3. Apply SSML emphasis annotations
+        enhanced_text = self._apply_emphasis_to_text(raw_text, emphasis_points)
+        
+        # 4. Return both versions for comparison
+        return enhanced_text
+        
+    def _detect_emphasis_annotations(self, text: str) -> List[Dict]:
+        """Detect all emphasis points in the text"""
+        
+        doc = self.nlp(text)  
+        annotations = []
+        
+        # KEY EMPHASIS PATTERNS FROM YOUR LITERARY TEXT:
+        
+        # Pattern 1: Sensory Imagery - High Priority
+        sensory_patterns = {
+            'white sparks cascaded': {'type': 'visual_emphasis', 'level': 0.9},
+            'trembling wick': {'type': 'tactile_emphasis', 'level': 0.8}, 
+            'shooting stars in his hands': {'type': 'visual_cosmic', 'level': 0.95}
+        }
+        
+        for pattern, config in sensory_patterns.items():
+            if self._pattern_exists_in_text(text.lower(), pattern):  
+                annotations.append({
+                    'text': pattern,
+                    'type': config['type'],
+                    'emphasis_level': config['level'], 
+                    'ssml_tag': self._get_ssml_emphasis_tag(cast(float, config['level'])),
+                    'reason': f"sensory imagery: {config['type']}"
+                })
+        
+        # Pattern 2: Spiritual/Religious Content - High Priority  
+        spiritual_terms = ['grave', 'dead', 'outsider']
+        
+        for token in doc:
+            if any(term.lower() == token.lemma_.lower() for term in spiritual_terms):
+                emphasis_level = 0.9 if token.text.lower().capitalize() == 'Outsider' else 0.8
+                
+                annotations.append({
+                    'text': token.text,
+                    'type': 'spiritual_content', 
+                    'emphasis_level': emphasis_level,
+                    'ssml_tag': self._get_ssml_emphasis_tag(emphasis_level),
+                    'reason': 'spiritual/metaphysical content requires emphasis'
+                })
+        
+        # Pattern 3: Metaphorical Language - High Priority
+        metaphor_patterns = [
+            'stars at the bottom of the grave',
+            'dream he recalled with uncanny clarity', 
+            'like the stars at the bottom of the grave'
+        ]
+        
+        for metaphor in metaphor_patterns: 
+            if self._pattern_exists_in_text(text.lower(), metaphor):
+                annotations.append({
+                    'text': metaphor,
+                    'type': 'metaphorical_emphasis',
+                    'emphasis_level': 0.85,
+                    'ssml_tag': '<emphasis level="strong">', 
+                    'reason': 'metaphorical/literary device'  
+                })
+        
+        # Pattern 4: Complex Syntax - Medium Priority
+        for sent in doc.sents:
+            # Detect complex relative clauses
+            has_relative_clause = any('which' in str(token) or 'that' in str(token) 
+                                   for token in sent if hasattr(token, '__str__'))
+            
+            if has_relative_clause and len(sent.text) > 100:
+                annotations.append({
+                    'text': sent.text.strip()[:50] + "...",
+                    'type': 'syntactic_emphasis',
+                    'emphasis_level': 0.7,
+                    'ssml_tag': '<pause time="500ms"/>', 
+                    'reason': 'complex syntax - relative clause pause needed'
+                })
+        
+        return annotations
+    
+    def _pattern_exists_in_text(self, text: str, pattern: str) -> bool:
+        """Check if pattern exists in text with some flexibility"""
+        
+        # Direct match
+        if pattern.lower() in text:
+            return True
+            
+        # Partial matches for complex patterns  
+        words = pattern.lower().split()
+        if len(words) >= 2:
+            return all(word in text for word in words[:2])  # First two words
+            
+        return False
+        
+    def _get_ssml_emphasis_tag(self, level: float) -> str:
+        """Convert emphasis level to SSML tag"""
+        
+        if level >= 0.9: 
+            return '<emphasis level="strong">'
+        elif level >= 0.8:
+            return '<emphasis>'
+        else:  
+            return '<!-- light emphasis -->'  # Don't mark very low priority
+            
+    def _apply_emphasis_to_text(self, original: str, annotations: List[Dict]) -> str:
+        """Apply emphasis annotations to create SSML-enhanced text"""
+        
+        # Start with original text
+        enhanced = original
+        
+        # Apply annotations in reverse order (avoid index shifting)
+        for ann in sorted(annotations, key=lambda x: original.lower().find(x['text'].lower()), reverse=True):
+            
+            text_to_replace = ann['text']
+            
+            if enhanced.lower().find(text_to_replace.lower()) != -1:
+                # Find the position (case-insensitive)
+                import re
+                
+                pattern = re.escape(text_to_replace)
+                match = re.search(pattern, enhanced, re.IGNORECASE)
+                
+                if match:
+                    start_idx = match.start()
+                    
+                    # Insert SSML tags around the matched text
+                    before_text = enhanced[:start_idx]
+                    highlighted_text = ann['ssml_tag'] + match.group() 
+                    
+                    # Close tag - need to find where text actually ends in enhanced
+                    if ann['emphasis_level'] >= 0.8:
+                        close_tag = '</emphasis>'
+                        
+                        # Add to highlighted text  
+                        highlighted_text += close_tag
+                    
+                    after_text = enhanced[start_idx + len(match.group()):]
+                    enhanced = before_text + highlighted_text + after_text
+        
+        return f"<speak>{enhanced}</speak>"
+    
+    def run_enhanced_pipeline(self, raw_text: str, output_prefix: str = "enhanced") -> None:
+        """Run complete enhanced TTS pipeline with emphasis detection"""
+        
+        print("🚀 **ENHANCED TTS PIPELINE**")
+        print(f"📝 Processing: {raw_text[:100]}...")
+        
+        # Create both versions for comparison  
+        original_processed = self._preprocess_for_tts(raw_text)
+        enhanced_with_emphasis = self.enhance_text_with_emphasis(original_processed)
+        
+        print("\n🔄 **PROCESSING RESULTS:**\n")
+        
+        # Show original (your existing pipeline)
+        print("**ORIGINAL TTS TEXT:**")
+        print(original_processed)
+        
+        # Generate audio for original
+        generate_audio(
+            text=original_processed,
+            model_path="prince-canuma/Kokoro-82M", 
+            voice="bm_george",
+            speed=1.0,
+            lang_code="b", 
+            file_prefix=f"{output_prefix}_original",
+            audio_format="wav",
+            sample_rate=24000,
+            join_audio=True, 
+            verbose=False
+        )
+        
+        print("\n**ENHANCED TTS WITH EMPHASIS:**")
+        # Remove SSML tags for display but keep them in audio
+        display_text = enhanced_with_emphasis.replace('<speak>', '').replace('</speak>', '')
+        print(display_text[:200] + "..." if len(display_text) > 200 else display_text)
+        
+        # Extract clean text for TTS (SSML tags might not be supported by Kokoro)
+        import re
+        clean_text = self._extract_clean_tts_text(enhanced_with_emphasis)
+        
+        # Generate audio for enhanced version  
+        generate_audio(
+            text=clean_text,
+            model_path="prince-canuma/Kokoro-82M",
+            voice="bm_george", 
+            speed=1.0,
+            lang_code="b",
+            file_prefix=f"{output_prefix}_enhanced", 
+            audio_format="wav",
+            sample=24000,
+            join_audio=True,
+            verbose=False
+        )
+        
+        print(f"\n✅ **AUDIO GENERATED:**")
+        print(f"   • Original: {output_prefix}_original.wav")  
+        print(f"   • Enhanced: {output_prefix}_enhanced.wav")
+        
+    def _extract_clean_tts_text(self, ssml_text: str) -> str:
+        """Extract clean text from SSML annotations for TTS generation"""
+        
+        # Remove SSML tags but preserve the emphasis context in punctuation
+        import re
+        
+        # Handle strong emphasis - add period for dramatic pause  
+        ssml_text = re.sub(r'<emphasis level="strong">(.*?)</emphasis>', 
+                          r'[\1](+2)', ssml_text)
+        
+        # Handle moderate emphasis - add comma for slight pause
+        ssml_text = re.sub(r'<emphasis>(.*?)</emphasis>', 
+                          r'[\1](+1)', ssml_text)  
+        
+        # Remove remaining SSML tags
+        clean = re.sub(r'<[^>]+>', '', ssml_text)
+        
+        # Clean up spacing
+        clean = re.sub(r'\.\s*\.\s*\.', '...', clean)  # ... patterns
+        clean = re.sub(r'\s+', ' ', clean).strip()     # Extra spaces
+        
+        return clean
+    
+    def _preprocess_for_tts(self, raw_text: str) -> str:
+        """Your existing preprocessing logic"""
+        
+        doc = self.nlp(raw_text)
+        
+        enhanced_paragraphs = []
+        for sentence in doc.sents:  
+            
+            # 1. Clean up common abbreviations
+            text = sentence.text.strip()
+            replacements = {
+                "Dr.": "Doctor", 
+                "Mr.": "Mister",
+                "Mrs.": "Misses"
+            }
+            
+            for abbrev, full_form in replacements.items():
+                text = text.replace(abbrev, full_form)
+            
+            # 2. Add natural pauses for better speech rhythm  
+            if "but" in text.lower() or "," in text:
+                # Pause before conjunctions/arguments
+                if "but" in text.lower():
+                    text = re.sub(r'\s+but\s+', ' ..., ... but ', text, flags=re.IGNORECASE)
+                elif "," in text:
+                    # Natural pause at commas for complex phrases
+                    if "which" in text.lower():
+                        parts = text.split(",") 
+                        if len(parts) >= 2:
+                            comma_enhanced = parts[0] + ",..." + "".join(parts[1:])
+                            text = comma_enhanced
+            
+            enhanced_paragraphs.append(text)
+        
+        return ". ".join(enhanced_paragraphs)
+
+
+# Usage example for your specific literary text
+if __name__ == "__main__":
+    # Your literary passage  
+    literary_text = """White sparks cascaded onto the trembling wick. It was as if there were shooting stars in his hands, like the stars at the bottom of the grave to which Silk and Hyacinth had driven Orpine's body in a dream he recalled with uncanny clarity. Here we dig holes in the ground for our dead, he thought, to bring them nearer the Outsider; and on Blue we do the same because we did it here, though it takes them away from him."""
+    literary_text_2 = """I had never seen war, or even talked of it at length with someone who had, but I was young and knew something of violence, and so believed that war would be no more than a new experience for me, as other things—the possession of authority in Thrax, say, or my escape from the House Absolute—had been new experiences. War is not a new experience; it is a new world. Its inhabitants are more different from human beings than [Famulimus](fa'mu'lie'mus) and her friends. Its laws are new, and even its geography is new, because it is a geography in which insignificant hills and hollows are lifted to the importance of cities. Just as our familiar Urth holds such monstrosities as Erebus, [Abaia](Ah-by-ya), and [Arioch](Ari-och), so the world of war is stalked by the monsters called battles, whose cells are individuals but who have a life and intelligence of their own, and whom one approaches through an ever-thickening array of portents."""
+    literary_text_3 = """The executions I have seen performed and have performed myself so often are no more than a trade, a butchery of human beings who are for the most part less innocent and less valuable than cattle."""
+    
+    # Initialize enhanced pipeline  
+    tts_pipeline = EnhancedTTSPipeline()
+    
+    # Run the complete enhanced TTS pipeline
+    tts_pipeline.run_enhanced_pipeline(literary_text, output_prefix="literary_passage")
+    tts_pipeline.run_enhanced_pipeline(literary_text_2, output_prefix="literary_passage_2")
+    tts_pipeline.run_enhanced_pipeline(literary_text_3, output_prefix="literary_passage_3")
\ No newline at end of file
diff --git a/experimental/users/acmcarther/llm/tts/spacy_demo.py b/experimental/users/acmcarther/llm/tts/spacy_demo.py
new file mode 100644
index 0000000..4c571af
--- /dev/null
+++ b/experimental/users/acmcarther/llm/tts/spacy_demo.py
@@ -0,0 +1,104 @@
+"""
+SpaCy Feature Demonstration for TTS Preparation
+Shows specific NLP features and their TTS applications
+"""
+
+import spacy
+
+def demonstrate_spacy_features(text):
+    """Show different SpaCy features for TTS preparation"""
+    
+    # Load the English model
+    nlp = spacy.load("en_core_web_sm")
+    doc = nlp(text)
+    
+    print(f"📝 **Original Text**: {text}\n")
+    
+    # 1. Tokenization - break text into manageable chunks
+    print("🔤 **Token Analysis**")
+    for i, token in enumerate(doc[:10]):  # First 10 tokens
+        print(f"   {token.text:<12} | POS: {token.pos_:<6} | Lemma: {token.lemma_}")
+    print()
+    
+    # 2. Named Entity Recognition - identify important information  
+    print("🏷️ **Named Entities**")
+    entities = [(ent.text, ent.label_, spacy.explain(ent.label_)) for ent in doc.ents]
+    if entities:
+        for text, label, description in entities[:5]:  # First 5 entities
+            print(f"   {text:<15} | {label}: {description}")
+    else:
+        print("   No named entities found")
+    print()
+    
+    # 3. Part-of-Speech tagging - understand word types for pronunciation
+    print("📊 **Part of Speech Tags**")
+    pos_summary = {}
+    for token in doc[:15]:  # First 15 tokens
+        tag_name = spacy.explain(token.pos_) or token.pos_
+        pos_summary[tag_name] = pos_summary.get(tag_name, 0) + 1
+    
+    for tag, count in list(pos_summary.items())[:5]:
+        print(f"   {tag}: {count} words")
+    print()
+    
+    # 4. Sentence boundary detection - natural pause points
+    print("📄 **Sentence Structure**")
+    for i, sent in enumerate(doc.sents):
+        if len(sent.text.strip()) > 10:  # Skip very short sentences
+            print(f"   Sentence {i+1}: {sent.text.strip()}")
+    print()
+
+def compare_preprocessing_approaches(text):
+    """Compare different TTS text preprocessing strategies"""
+    
+    nlp = spacy.load("en_core_web_sm")
+    doc = nlp(text)
+    
+    # Strategy 1: Abbreviation expansion only
+    abbreviations_expanded = text.replace("Dr.", "Doctor").replace("Mr.", "Mister")
+    
+    # Strategy 2: Sentence-based with pause optimization
+    processed_sentences = []
+    for sent in doc.sents:
+        # Add natural pauses at conjunction boundaries
+        processed_text = "".join([
+            token.text_with_ws if not (token.pos_ == "CCONJ" and len(str(sent).strip()) > 20) 
+            else f", ... {token.text_with_ws}"
+            for token in sent
+        ])
+        processed_sentences.append(processed_text)
+    
+    sentence_aware = "".join(processed_sentences)
+    
+    # Strategy 3: Full semantic enhancement
+    semantic_enhanced = text
+    doc_processed = nlp(text)
+    
+    # Identify potential pronunciation issues
+    tricky_words = ["colonel", "choir", "restaurant"]
+    enhanced_text = text
+    for word in tricky_words:
+        if word.lower() in text.lower():
+            enhanced_text = enhanced_text.replace(word, f"<proper_pronunciation>{word}</proper_pronunciation>")
+    
+    return {
+        "original": text,
+        "abbreviations_only": abbreviations_expanded, 
+        "sentence_aware": sentence_aware,
+        "semantic_enhanced": enhanced_text
+    }
+
+if __name__ == "__main__":
+    # Demo text with various TTS challenges
+    demo_text = "Dr. Smith, who is a colonel in the USA army, went to his favorite restaurant with Mr. Johnson."
+    
+    # Show detailed spaCy features
+    demonstrate_spacy_features(demo_text)
+    
+    # Compare different preprocessing strategies  
+    print("🔄 **Preprocessing Strategy Comparison**\n")
+    results = compare_preprocessing_approaches(demo_text)
+    
+    for approach, processed in results.items():
+        print(f"**{approach.replace('_', ' ').title()}:**")
+        print(f"{processed}\n")
\ No newline at end of file
diff --git a/experimental/users/acmcarther/llm/tts/spacy_tts_pipeline.py b/experimental/users/acmcarther/llm/tts/spacy_tts_pipeline.py
new file mode 100644
index 0000000..2f7dcc8
--- /dev/null
+++ b/experimental/users/acmcarther/llm/tts/spacy_tts_pipeline.py
@@ -0,0 +1,107 @@
+"""
+SpaCy + Kokoro TTS Integration Pipeline
+Example demonstrating how to use SpaCy for text preprocessing before TTS conversion
+"""
+
+import spacy
+from mlx_audio.tts.generate import generate_audio
+
+def complete_tts_pipeline(raw_text):
+    """
+    Complete pipeline: Raw text → SpaCy processing → Enhanced TTS-ready text
+    """
+    
+    # Load spaCy model (assuming en_core_web_sm is installed)
+    nlp = spacy.load("en_core_web_sm")
+    
+    # Process text with spaCy
+    doc = nlp(raw_text)
+    
+    enhanced_sentences = []
+    
+    for sentence in doc.sents:
+        # Process each sentence individually
+        processed_sentence = process_single_sentence(sentence.text_with_ws, nlp)
+        enhanced_sentences.append(processed_sentence)
+    
+    # Join sentences with appropriate pauses
+    final_text = ". ".join(enhanced_sentences)
+    
+    return final_text
+
+def process_single_sentence(sentence, nlp):
+    """Process a single sentence for TTS optimization"""
+    
+    # 1. Clean up common abbreviations
+    replacements = {
+        "Dr.": "Doctor",
+        "Mr.": "Mister", 
+        "Mrs.": "Misses",
+        "vs": "versus",
+        "&": "and"
+    }
+    
+    cleaned = sentence
+    for abbrev, full_form in replacements.items():
+        cleaned = cleaned.replace(abbrev, full_form)
+    
+    # 2. Add natural pauses for better speech rhythm
+    doc = nlp(cleaned)
+    
+    # Identify clause boundaries (relative pronouns, conjunctions)  
+    pause_indicators = ["but", "however", "although", "while", "when", "where"]
+    final_text = cleaned
+    
+    for token in doc:
+        if token.text.lower() in pause_indicators and token.pos_ == "CCONJ":
+            # Add slight pause before conjunctions
+            final_text = final_text.replace(f" {token.text} ", f",... {token.text} ")
+    
+    return final_text
+
+# Example usage
+if __name__ == "__main__":
+    # Sample raw text that might be challenging for TTS
+    sample_text = """
+    Dr. Smith went to the store but forgot his wallet.
+    The cat, which was sleeping on the mat, suddenly woke up.  
+    He vs his friend decided to go shopping & eat dinner.
+    """
+    
+    processed = complete_tts_pipeline(sample_text)
+    print("Original:")
+    print(sample_text)
+    print("\nProcessed for TTS:")  
+    print(processed)
+
+    generate_audio(
+        text=(sample_text),
+        model_path="prince-canuma/Kokoro-82M",
+        #voice="af_heart",
+        voice="am_santa",
+        #voice="am_echo",
+        speed=1.2,
+        lang_code="a", # Kokoro: (a)f_heart, or comment out for auto
+        file_prefix="original",
+        audio_format="wav",
+        sample_rate=24000,
+        join_audio=True,
+        verbose=True  # Set to False to disable print messages
+    )
+    print("Original audio generated")
+
+    generate_audio(
+        text=(processed),
+        model_path="prince-canuma/Kokoro-82M",
+        #voice="af_heart",
+        voice="am_santa",
+        #voice="am_echo",
+        speed=1.2,
+        lang_code="a", # Kokoro: (a)f_heart, or comment out for auto
+        file_prefix="processed",
+        audio_format="wav",
+        sample_rate=24000,
+        join_audio=True,
+        verbose=True  # Set to False to disable print messages
+    )
+    print("Original audio generated")
diff --git a/experimental/users/acmcarther/llm/tts_grpc/BUILD.bazel b/experimental/users/acmcarther/llm/tts_grpc/BUILD.bazel
new file mode 100644
index 0000000..13fe6a9
--- /dev/null
+++ b/experimental/users/acmcarther/llm/tts_grpc/BUILD.bazel
@@ -0,0 +1,141 @@
+load("@aspect_rules_py//py:defs.bzl", "py_binary", "py_library", "py_pex_binary", "py_unpacked_wheel")
+load("@rules_go//go:def.bzl", "go_binary", "go_library")
+
+# gazelle:proto disable
+load("@build_stack_rules_proto//rules:proto_compile.bzl", "proto_compile")
+load("@build_stack_rules_proto//rules/py:grpc_py_library.bzl", "grpc_py_library")
+load("@build_stack_rules_proto//rules/go:proto_go_library.bzl", "proto_go_library")
+load("@build_stack_rules_proto//rules/py:proto_py_library.bzl", "proto_py_library")
+load("@pip_third_party//:requirements.bzl", "requirement")
+load("@rules_proto//proto:defs.bzl", "proto_library")
+
+proto_library(
+    name = "tts_proto",
+    srcs = ["tts.proto"],
+    visibility = ["//visibility:public"],
+)
+
+proto_compile(
+    name = "tts_python_compile",
+    outputs = [
+        "tts_pb2.py",
+        "tts_pb2.pyi",
+        "tts_pb2_grpc.py",
+    ],
+    plugins = [
+        "@build_stack_rules_proto//plugin/builtin:pyi",
+        "@build_stack_rules_proto//plugin/builtin:python",
+        "@build_stack_rules_proto//plugin/grpc/grpc:protoc-gen-grpc-python",
+    ],
+    proto = ":tts_proto",
+)
+
+proto_py_library(
+    name = "tts_proto_py_lib",
+    srcs = ["tts_pb2.py"],
+    deps = ["@com_google_protobuf//:protobuf_python"],
+)
+
+grpc_py_library(
+    name = "tts_grpc_py_library",
+    srcs = ["tts_pb2_grpc.py"],
+    deps = [
+        ":tts_py_library",
+        "@pip_third_party//grpcio:pkg",
+    ],
+)
+
+py_binary(
+    name = "tts_server_main",
+    srcs = ["tts_server_main.py"],
+    target_compatible_with = ["@platforms//os:macos"],
+    deps = [
+        ":tts_grpc_py_library",
+        ":tts_proto_py_lib",
+        "//third_party/python/spacy:en_core_web_sm",
+        requirement("grpcio"),
+        requirement("spacy"),
+        requirement("asyncio"),
+        requirement("mlx-audio"),
+        # Transitive (mlx-audio tts)
+        requirement("soundfile"),
+        requirement("sounddevice"),
+        requirement("kokoro"),
+        requirement("num2words"),
+        requirement("misaki"),
+        requirement("espeakng-loader"),
+        requirement("phonemizer-fork"),
+        requirement("spacy-curated-transformers"),
+        requirement("scipy"),
+    ],
+)
+
+py_pex_binary(
+    name = "tts_server",
+    binary = ":tts_server_main",
+    target_compatible_with = ["@platforms//os:macos"],
+)
+
+py_binary(
+    name = "tts_client_main",
+    srcs = ["tts_client_main.py"],
+    target_compatible_with = ["@platforms//os:macos"],
+    deps = [
+        ":tts_grpc_py_library",
+        ":tts_proto_py_lib",
+        requirement("asyncio"),
+        requirement("sounddevice"),
+        requirement("soundfile"),
+        requirement("grpcio"),
+        requirement("absl-py"),
+        requirement("PyObjC"),
+    ],
+)
+
+proto_compile(
+    name = "tts_go_compile",
+    output_mappings = [
+        "tts.pb.go=forgejo.csbx.dev/acmcarther/yesod/experimental/users/acmcarther/llm/tts_grpc/tts.pb.go",
+        "tts_grpc.pb.go=forgejo.csbx.dev/acmcarther/yesod/experimental/users/acmcarther/llm/tts_grpc/tts_grpc.pb.go",
+    ],
+    outputs = [
+        "tts.pb.go",
+        "tts_grpc.pb.go",
+    ],
+    plugins = [
+        "@build_stack_rules_proto//plugin/golang/protobuf:protoc-gen-go",
+        "@build_stack_rules_proto//plugin/grpc/grpc-go:protoc-gen-go-grpc",
+    ],
+    proto = ":tts_proto",
+)
+
+go_library(
+    name = "tts_go_proto",
+    srcs = [":tts_go_compile"],
+    importpath = "forgejo.csbx.dev/acmcarther/yesod/experimental/users/acmcarther/llm/tts_grpc",
+    visibility = ["//visibility:public"],
+    deps = [
+        "@org_golang_google_grpc//:go_default_library",
+        "@org_golang_google_grpc//codes",
+        "@org_golang_google_grpc//status",
+        "@org_golang_google_protobuf//reflect/protoreflect",
+        "@org_golang_google_protobuf//runtime/protoimpl",
+    ],
+)
+
+go_binary(
+    name = "tts_client_go",
+    srcs = ["main.go"],
+    visibility = ["//visibility:public"],
+    deps = [
+        ":tts_go_proto",
+        "@org_golang_google_grpc//:go_default_library",
+        "@org_golang_google_grpc//credentials/insecure",
+    ],
+)
+
+proto_py_library(
+    name = "tts_py_library",
+    srcs = ["tts_pb2.py"],
+    deps = ["@com_google_protobuf//:protobuf_python"],
+)
diff --git a/experimental/users/acmcarther/llm/tts_grpc/main.go b/experimental/users/acmcarther/llm/tts_grpc/main.go
new file mode 100644
index 0000000..15abb1a
--- /dev/null
+++ b/experimental/users/acmcarther/llm/tts_grpc/main.go
@@ -0,0 +1,198 @@
+package main
+
+import (
+	"bytes"
+	"context"
+	"encoding/binary"
+	"flag"
+	"fmt"
+	"io"
+	"log"
+	"os"
+	"os/exec"
+	"time"
+
+	"google.golang.org/grpc"
+	"google.golang.org/grpc/credentials/insecure"
+	pb "forgejo.csbx.dev/acmcarther/yesod/experimental/users/acmcarther/llm/tts_grpc"
+)
+
+var (
+	addr         = flag.String("addr", "localhost:50051", "the address to connect to")
+	inputText    = flag.String("text", "Hello: This is a test of the TTS Client", "Text to convert to speech")
+	voiceModel   = flag.String("voice", "bm_george", "Voice model to use")
+	speakingRate = flag.Float64("rate", 1.0, "Speaking rate")
+	useBytes     = flag.Bool("use_bytes", false, "Use the bytes API (GenerateTTS) instead of local file API")
+	stream       = flag.Bool("stream", true, "Use the streaming API (GenerateTTSStream)")
+	play         = flag.Bool("play", true, "Play the generated audio using afplay")
+)
+
+func main() {
+	flag.Parse()
+	// Set up a connection to the server.
+	conn, err := grpc.Dial(*addr, grpc.WithTransportCredentials(insecure.NewCredentials()))
+	if err != nil {
+		log.Fatalf("did not connect: %v", err)
+	}
+	defer conn.Close()
+	c := pb.NewTTSServiceClient(conn)
+
+	// Contact the server and print out its response.
+	ctx, cancel := context.WithTimeout(context.Background(), 60*time.Second)
+	defer cancel()
+
+	log.Printf("Sending request: text=%q, voice=%q, rate=%f", *inputText, *voiceModel, *speakingRate)
+
+	var audioFile string
+
+	if *stream {
+		audioFile, err = handleStream(ctx, c)
+		if err != nil {
+			log.Fatalf("streaming error: %v", err)
+		}
+	} else if *useBytes {
+		resp, err := c.GenerateTTS(ctx, &pb.GenerateTTSRequest{
+			InputText:    inputText,
+			VoiceModel:   voiceModel,
+			SpeakingRate: getFloat32Pointer(*speakingRate),
+		})
+		if err != nil {
+			log.Fatalf("could not generate TTS (bytes): %v", err)
+		}
+		log.Printf("TTS bytes received. Sample rate: %d, Size: %d bytes", resp.GetAudioSampleRate(), len(resp.GetAudioContent()))
+
+		audioFile, err = saveWav(resp.GetAudioContent(), int(resp.GetAudioSampleRate()))
+		if err != nil {
+			log.Fatalf("could not save WAV file: %v", err)
+		}
+		log.Printf("Saved audio to: %s", audioFile)
+
+	} else {
+		r, err := c.GenerateTTSLocalFile(ctx, &pb.GenerateTTSLocalFileRequest{
+			InputText:    inputText,
+			VoiceModel:   voiceModel,
+			SpeakingRate: getFloat32Pointer(*speakingRate),
+		})
+		if err != nil {
+			log.Fatalf("could not generate TTS (local file): %v", err)
+		}
+		audioFile = r.GetLocalTtsFilePath()
+		log.Printf("TTS generated successfully. File path: %s", audioFile)
+	}
+
+	if *play {
+		log.Printf("Playing audio file: %s", audioFile)
+		if err := playAudio(audioFile); err != nil {
+			log.Printf("Failed to play audio: %v", err)
+		}
+	}
+}
+
+func handleStream(ctx context.Context, c pb.TTSServiceClient) (string, error) {
+	stream, err := c.GenerateTTSStream(ctx, &pb.GenerateTTSRequest{
+		InputText:    inputText,
+		VoiceModel:   voiceModel,
+		SpeakingRate: getFloat32Pointer(*speakingRate),
+	})
+	if err != nil {
+		return "", fmt.Errorf("calling GenerateTTSStream: %w", err)
+	}
+
+	var totalBytes []byte
+	var sampleRate int32 = -1
+
+	for {
+		resp, err := stream.Recv()
+		if err == io.EOF {
+			break
+		}
+		if err != nil {
+			return "", fmt.Errorf("receiving stream: %w", err)
+		}
+
+		if sampleRate == -1 {
+			sampleRate = resp.GetAudioSampleRate()
+		} else if sampleRate != resp.GetAudioSampleRate() {
+			log.Printf("Warning: Sample rate changed mid-stream from %d to %d", sampleRate, resp.GetAudioSampleRate())
+		}
+
+		chunk := resp.GetAudioContent()
+		log.Printf("Received chunk: size=%d", len(chunk))
+		totalBytes = append(totalBytes, chunk...)
+	}
+
+	if sampleRate == -1 {
+		return "", fmt.Errorf("received no data from stream")
+	}
+
+	log.Printf("Stream finished. Total size: %d bytes, Sample rate: %d", len(totalBytes), sampleRate)
+	return saveWav(totalBytes, int(sampleRate))
+}
+
+func getFloat32Pointer(v float64) *float32 {
+	f := float32(v)
+	return &f
+}
+
+func playAudio(filePath string) error {
+	cmd := exec.Command("afplay", filePath)
+	cmd.Stdout = os.Stdout
+	cmd.Stderr = os.Stderr
+	return cmd.Run()
+}
+
+// saveWav writes the raw float32 audio data to a WAV file with a temporary name.
+func saveWav(data []byte, sampleRate int) (string, error) {
+	// Create a temporary file
+	f, err := os.CreateTemp("", "tts_output_*.wav")
+	if err != nil {
+		return "", fmt.Errorf("creating temp file: %w", err)
+	}
+	defer f.Close()
+
+	// 1 channel, 32-bit float
+	numChannels := 1
+	bitsPerSample := 32
+	byteRate := sampleRate * numChannels * (bitsPerSample / 8)
+	blockAlign := numChannels * (bitsPerSample / 8)
+	audioFormat := 3 // IEEE Float
+
+	// Total data size
+	dataSize := uint32(len(data))
+	// File size - 8 bytes
+	fileSize := 36 + dataSize
+
+	// Write WAV Header
+	buf := new(bytes.Buffer)
+
+	// RIFF header
+	buf.WriteString("RIFF")
+	binary.Write(buf, binary.LittleEndian, fileSize)
+	buf.WriteString("WAVE")
+
+	// fmt subchunk
+	buf.WriteString("fmt ")
+	binary.Write(buf, binary.LittleEndian, uint32(16)) // Subchunk1Size
+	binary.Write(buf, binary.LittleEndian, uint16(audioFormat))
+	binary.Write(buf, binary.LittleEndian, uint16(numChannels))
+	binary.Write(buf, binary.LittleEndian, uint32(sampleRate))
+	binary.Write(buf, binary.LittleEndian, uint32(byteRate))
+	binary.Write(buf, binary.LittleEndian, uint16(blockAlign))
+	binary.Write(buf, binary.LittleEndian, uint16(bitsPerSample))
+
+	// data subchunk
+	buf.WriteString("data")
+	binary.Write(buf, binary.LittleEndian, dataSize)
+
+	// Write header to file
+	if _, err := f.Write(buf.Bytes()); err != nil {
+		return "", fmt.Errorf("writing header: %w", err)
+	}
+
+	// Write audio data
+	if _, err := f.Write(data); err != nil {
+		return "", fmt.Errorf("writing data: %w", err)
+	}
+
+	return f.Name(), nil
+}
diff --git a/experimental/users/acmcarther/llm/tts_grpc/tts.proto b/experimental/users/acmcarther/llm/tts_grpc/tts.proto
new file mode 100644
index 0000000..436c3fb
--- /dev/null
+++ b/experimental/users/acmcarther/llm/tts_grpc/tts.proto
@@ -0,0 +1,33 @@
+package experimental.users.acmcarther.llm.tts_grpc;
+
+option go_package = "forgejo.csbx.dev/acmcarther/yesod/experimental/users/acmcarther/llm/tts_grpc";
+
+// The request message for generating a TTS local file.
+message GenerateTTSLocalFileRequest {
+    optional string input_text = 1;
+    optional string voice_model = 2;
+    optional float speaking_rate = 3;
+}
+
+// The response message containing the TTS local file path and "enhanced" text.
+message GenerateTTSLocalFileResponse {
+    optional string local_tts_file_path = 1;
+}
+
+message GenerateTTSRequest {
+    optional string input_text = 1;
+    optional string voice_model = 2;
+    optional float speaking_rate = 3;
+}
+
+message GenerateTTSResponse {
+    optional bytes audio_content = 1;
+    optional int32 audio_sample_rate = 2;
+}
+
+// TTSService defines a gRPC service for Text-to-Speech generation.
+service TTSService {
+    rpc GenerateTTSLocalFile(GenerateTTSLocalFileRequest) returns (GenerateTTSLocalFileResponse) {}
+    rpc GenerateTTS(GenerateTTSRequest) returns (GenerateTTSResponse) {}
+    rpc GenerateTTSStream(GenerateTTSRequest) returns (stream GenerateTTSResponse) {}
+}
diff --git a/experimental/users/acmcarther/llm/tts_grpc/tts_client_main.py b/experimental/users/acmcarther/llm/tts_grpc/tts_client_main.py
new file mode 100644
index 0000000..d7d7c7c
--- /dev/null
+++ b/experimental/users/acmcarther/llm/tts_grpc/tts_client_main.py
@@ -0,0 +1,83 @@
+import asyncio
+from experimental.users.acmcarther.llm.tts_grpc import tts_pb2_grpc, tts_pb2
+import grpc
+from absl import app, flags, logging
+import soundfile  # type: ignore
+import sounddevice  # type: ignore
+import tempfile
+import os
+import io
+
+FLAGS = flags.FLAGS
+flags.DEFINE_string("text", None, "Input text to convert to speech.")
+flags.DEFINE_string("voice_model", "bm_george", "Voice model to use for TTS.")
+flags.DEFINE_float("speaking_rate", 1.0, "Speaking rate for TTS.")
+flags.DEFINE_bool("use_fileless_api", False, "Whether to use the fileless API.")
+
+
+def play_sound_from_bytes(audio_bytes: bytes, sample_rate: int):
+    """Play sound from bytes using sounddevice."""
+    wav_buf = io.BytesIO(audio_bytes)
+    wav_buf.name = "input.RAW"
+    data, sample_rate = soundfile.read(
+        wav_buf, channels=1, samplerate=sample_rate, subtype="FLOAT"
+    )
+    sounddevice.play(data, samplerate=sample_rate)
+    sounddevice.wait()
+
+
+def play_sound_from_file(file_path: str):
+    """Play sound from file using sounddevice."""
+    data, sample_rate = soundfile.read(file_path)
+    sounddevice.play(data, samplerate=sample_rate)
+    sounddevice.wait()
+
+
+async def run_tts_client():
+
+    async with grpc.aio.insecure_channel("localhost:50051") as channel:
+        stub = tts_pb2_grpc.TTSServiceStub(channel)
+        if FLAGS.use_fileless_api:
+            response = await stub.GenerateTTS(
+                tts_pb2.GenerateTTSRequest(
+                    input_text=FLAGS.text,
+                    voice_model=FLAGS.voice_model,
+                    speaking_rate=FLAGS.speaking_rate,
+                )
+            )
+            # Play the audio
+            loop = asyncio.get_running_loop()
+            await loop.run_in_executor(
+                None,
+                lambda: play_sound_from_bytes(
+                    response.audio_content, response.audio_sample_rate
+                ),
+            )
+        else:
+            response = await stub.GenerateTTSLocalFile(
+                tts_pb2.GenerateTTSLocalFileRequest(
+                    input_text=FLAGS.text,
+                    voice_model=FLAGS.voice_model,
+                    speaking_rate=FLAGS.speaking_rate,
+                )
+            )
+            print(
+                "TTS client received local file path: " + response.local_tts_file_path
+            )
+            # Play the audio
+            loop = asyncio.get_running_loop()
+            await loop.run_in_executor(
+                None, lambda: play_sound_from_file(response.local_tts_file_path)
+            )
+
+
+def main(argv):
+    del argv  # Unused
+    if not FLAGS.text:
+        logging.error("The --text flag is required.")
+        return
+    asyncio.run(run_tts_client())
+
+
+if __name__ == "__main__":
+    app.run(main)
diff --git a/experimental/users/acmcarther/llm/tts_grpc/tts_server_main.py b/experimental/users/acmcarther/llm/tts_grpc/tts_server_main.py
new file mode 100644
index 0000000..149f319
--- /dev/null
+++ b/experimental/users/acmcarther/llm/tts_grpc/tts_server_main.py
@@ -0,0 +1,150 @@
+from concurrent import futures
+from dataclasses import dataclass
+from experimental.users.acmcarther.llm.tts_grpc import tts_pb2_grpc, tts_pb2
+from mlx_audio.tts.generate import generate_audio
+from mlx_audio.tts.utils import load_model
+from typing import List, Dict, Tuple, AsyncGenerator
+import asyncio
+import grpc
+import re
+import spacy
+import uuid
+import soundfile  # type: ignore
+import mlx.nn as nn
+import mlx.core as mx
+
+
+@dataclass
+class PipelineParams:
+    text: str
+    voice: str | None = None
+    speaking_rate: float | None = None
+
+
+@dataclass
+class PipelineResult:
+    audio_bytes: mx.array
+    audio_sample_rate: int
+
+
+class TTSPipeline:
+    nlp: spacy.Language
+    tts_model: nn.Module
+
+    def __init__(self):
+        # TODO: acmcarther@ - Perform some post-processing on text during pipeline execution.
+        self.nlp = spacy.load("en_core_web_sm")
+        self.tts_model = load_model("prince-canuma/Kokoro-82M")
+
+    async def run_pipeline(self, params: PipelineParams) -> PipelineResult:
+        audio_list = []
+        sample_rate = 24000  # Default fallback
+        async for audio_chunk, sr in self.run_pipeline_stream(params):
+            audio_list.append(audio_chunk)
+            sample_rate = sr
+
+        if not audio_list:
+            return PipelineResult(
+                audio_bytes=mx.array([]), audio_sample_rate=sample_rate
+            )
+
+        audio = mx.concatenate(audio_list, axis=0)
+        return PipelineResult(audio_bytes=audio, audio_sample_rate=sample_rate)
+
+    async def run_pipeline_stream(
+        self, params: PipelineParams
+    ) -> AsyncGenerator[Tuple[mx.array, int], None]:
+        voice = params.voice or "bm_george"
+
+        # Note: self.tts_model.generate is a synchronous generator.
+        # We wrap it or iterate it. Since MLX ops might be heavy, running in a thread might be better,
+        # but for now we keep it simple.
+        results = self.tts_model.generate(
+            text=params.text,
+            voice=voice,
+            speed=params.speaking_rate or 1.0,
+            lang_code=voice[0],  # "am_santa" -> "a"
+            audio_format="wav",
+            sample=24000,
+        )
+
+        for result in results:
+            # Yield control to allow asyncio loop to run other tasks if needed,
+            # though this loop itself is sync.
+            # In a real heavy server, we'd run generation in an executor.
+            yield result.audio, self.tts_model.sample_rate
+            await asyncio.sleep(0)
+
+
+class TTSService(tts_pb2_grpc.TTSServiceServicer):
+    def __init__(self):
+        self.tts_pipeline = TTSPipeline()
+
+    async def GenerateTTSLocalFile(self, request, context):
+        params = PipelineParams(
+            text=request.input_text,
+            voice=request.voice_model,
+            speaking_rate=request.speaking_rate,
+        )
+        result = await self.tts_pipeline.run_pipeline(params)
+
+        output_prefix = "/tmp/tts_output_" + str(uuid.uuid4())
+        output_full_path = output_prefix + ".wav"
+        soundfile.write(output_full_path, result.audio_bytes, result.audio_sample_rate)
+        return tts_pb2.GenerateTTSLocalFileResponse(
+            local_tts_file_path=output_full_path
+        )
+
+    async def GenerateTTS(self, request, context):
+        params = PipelineParams(
+            text=request.input_text,
+            voice=request.voice_model,
+            speaking_rate=request.speaking_rate,
+        )
+        result = await self.tts_pipeline.run_pipeline(params)
+
+        return tts_pb2.GenerateTTSResponse(
+            audio_content=memoryview(result.audio_bytes).tobytes(),
+            audio_sample_rate=result.audio_sample_rate,
+        )
+
+    async def GenerateTTSStream(self, request, context):
+        params = PipelineParams(
+            text=request.input_text,
+            voice=request.voice_model,
+            speaking_rate=request.speaking_rate,
+        )
+
+        # 1MB Chunk size to safely stay under gRPC 4MB limit
+        CHUNK_SIZE = 1024 * 1024
+
+        async for audio_chunk, sample_rate in self.tts_pipeline.run_pipeline_stream(
+            params
+        ):
+            # Convert mlx array to bytes
+            audio_bytes = memoryview(audio_chunk).tobytes()
+
+            # Split into smaller chunks if necessary
+            for i in range(0, len(audio_bytes), CHUNK_SIZE):
+                chunk_data = audio_bytes[i : i + CHUNK_SIZE]
+                yield tts_pb2.GenerateTTSResponse(
+                    audio_content=chunk_data, audio_sample_rate=sample_rate
+                )
+
+
+async def serve():
+    port = 50051
+    server = grpc.aio.server()
+    tts_pb2_grpc.add_TTSServiceServicer_to_server(TTSService(), server)
+    server.add_insecure_port(f"[::]:{port}")
+    await server.start()
+    print(f"gRPC server is running on port {port}...")
+    await server.wait_for_termination()
+
+
+def main():
+    asyncio.run(serve())
+
+
+if __name__ == "__main__":
+    main()
diff --git a/experimental/users/acmcarther/temporal/BUILD.bazel b/experimental/users/acmcarther/temporal/BUILD.bazel
new file mode 100644
index 0000000..9415774
--- /dev/null
+++ b/experimental/users/acmcarther/temporal/BUILD.bazel
@@ -0,0 +1,36 @@
+load("@gazelle//:def.bzl", "gazelle")
+load("@rules_go//go:def.bzl", "go_binary", "go_library")
+
+gazelle(
+    name = "gazelle",
+)
+
+go_library(
+    name = "helloworld",
+    srcs = ["helloworld.go"],
+    importpath = "forgejo.csbx.dev/acmcarther/yesod/experimental/users/acmcarther/temporal",
+    visibility = ["//visibility:public"],
+    deps = [
+        "@io_temporal_go_sdk//activity",
+        "@io_temporal_go_sdk//workflow",
+    ],
+)
+
+go_binary(
+    name = "starter_main",
+    srcs = ["starter_main.go"],
+    deps = [
+        ":helloworld",
+        "@io_temporal_go_sdk//client",
+    ],
+)
+
+go_binary(
+    name = "worker_main",
+    srcs = ["worker_main.go"],
+    deps = [
+        ":helloworld",
+        "@io_temporal_go_sdk//client",
+        "@io_temporal_go_sdk//worker",
+    ],
+)
diff --git a/experimental/users/acmcarther/temporal/git_workflow/BUILD.bazel b/experimental/users/acmcarther/temporal/git_workflow/BUILD.bazel
new file mode 100644
index 0000000..4712952
--- /dev/null
+++ b/experimental/users/acmcarther/temporal/git_workflow/BUILD.bazel
@@ -0,0 +1,121 @@
+load("@aspect_rules_py//py:defs.bzl", "py_image_layer")
+load("@pip_third_party//:requirements.bzl", "requirement")
+load("@rules_oci//oci:defs.bzl", "oci_image", "oci_push")
+load("@rules_python//python:defs.bzl", "py_binary", "py_library", "py_test")
+
+py_library(
+    name = "briefing",
+    srcs = ["briefing.py"],
+    visibility = ["//visibility:public"],
+)
+
+py_library(
+    name = "workspace",
+    srcs = ["workspace.py"],
+    visibility = ["//visibility:public"],
+    deps = [requirement("requests")],
+)
+
+py_library(
+    name = "activities",
+    srcs = ["activities.py"],
+    visibility = ["//visibility:public"],
+    deps = [
+        ":briefing",
+        ":workspace",
+        requirement("temporalio"),
+    ],
+)
+
+py_library(
+    name = "workflow",
+    srcs = ["workflow.py"],
+    visibility = ["//visibility:public"],
+    deps = [
+        ":activities",
+        ":briefing",
+        requirement("temporalio"),
+    ],
+)
+
+py_binary(
+    name = "worker",
+    srcs = ["worker.py"],
+    visibility = ["//visibility:public"],
+    deps = [
+        ":activities",
+        ":workflow",
+        requirement("temporalio"),
+    ],
+)
+
+py_binary(
+    name = "trigger",
+    srcs = ["trigger.py"],
+    deps = [
+        ":briefing",
+        ":workflow",
+        requirement("temporalio"),
+    ],
+)
+
+py_test(
+    name = "workspace_test",
+    srcs = ["workspace_test.py"],
+    deps = [":workspace"],
+)
+
+py_test(
+    name = "activities_test",
+    srcs = ["activities_test.py"],
+    deps = [
+        ":activities",
+        ":briefing",
+    ],
+)
+
+py_test(
+    name = "workflow_test",
+    srcs = ["workflow_test.py"],
+    deps = [
+        ":briefing",
+        ":workflow",
+        requirement("pytest"),
+        requirement("pytest-mock"),
+        requirement("temporalio"),
+    ],
+)
+
+py_test(
+    name = "e2e_test",
+    srcs = ["e2e_test.py"],
+    tags = ["manual"],
+    deps = [
+        requirement("requests"),
+        requirement("temporalio"),
+    ],
+)
+
+py_image_layer(
+    name = "worker_binary_layer",
+    binary = ":worker",
+)
+
+oci_image(
+    name = "image",
+    base = "//k8s/container/coder-dev-base-image:noble",
+    entrypoint = [
+        "python3",
+        "/experimental/users/acmcarther/temporal/git_workflow/worker",
+    ],
+    tars = [
+        ":worker_binary_layer",
+    ],
+)
+
+oci_push(
+    name = "push",
+    image = ":image",
+    remote_tags = ["latest"],
+    repository = "forgejo.csbx.dev/acmcarther/temporal-worker-image",
+)
diff --git a/experimental/users/acmcarther/temporal/git_workflow/activities.py b/experimental/users/acmcarther/temporal/git_workflow/activities.py
new file mode 100644
index 0000000..5d5e5a6
--- /dev/null
+++ b/experimental/users/acmcarther/temporal/git_workflow/activities.py
@@ -0,0 +1,73 @@
+from temporalio import activity
+from experimental.users.acmcarther.temporal.git_workflow.workspace import Workspace
+from experimental.users.acmcarther.temporal.git_workflow.briefing import Briefing
+from pathlib import Path
+from typing import Dict
+
+@activity.defn(name="provision_workspace_activity")
+async def provision_workspace(briefing: Briefing) -> str:
+    """Provisions a workspace by cloning a repo and creating a branch."""
+    if not briefing.repo_url or not briefing.branch_name:
+        raise ValueError("repo_url and branch_name must be set in the briefing.")
+    
+    workspace = Workspace(repo_url=briefing.repo_url, branch_name=briefing.branch_name)
+    workspace_path = workspace.provision()
+    return workspace_path
+
+from typing import Dict
+
+@activity.defn(name="apply_changes_in_workspace_activity")
+async def apply_changes_in_workspace(briefing: Briefing, files_to_create: Dict[str, str]):
+    """Applies changes to the workspace."""
+    if not briefing.workspace_path or not briefing.branch_name:
+        raise ValueError("workspace_path and branch_name must be set in the briefing.")
+
+    workspace = Workspace(branch_name=briefing.branch_name, path=Path(briefing.workspace_path))
+    workspace.apply_changes(files_to_create)
+
+@activity.defn(name="commit_and_push_changes_activity")
+async def commit_and_push_changes(briefing: Briefing, commit_message: str):
+    """Commits and pushes changes."""
+    if not briefing.workspace_path or not briefing.branch_name:
+        raise ValueError("workspace_path and branch_name must be set in the briefing.")
+
+    workspace = Workspace(branch_name=briefing.branch_name, path=Path(briefing.workspace_path))
+    workspace.commit_and_push(commit_message)
+
+@activity.defn(name="run_tests_activity")
+async def run_tests(briefing: Briefing):
+    """Runs tests in the workspace."""
+    if not briefing.workspace_path or not briefing.branch_name or not briefing.tests_to_run:
+        raise ValueError("workspace_path, branch_name, and tests_to_run must be set in the briefing.")
+
+    workspace = Workspace(branch_name=briefing.branch_name, path=Path(briefing.workspace_path))
+    # For now, we assume a single test command. This could be extended to support multiple commands.
+    workspace.run_tests(briefing.tests_to_run[0])
+
+@activity.defn(name="create_pull_request_activity")
+async def create_pull_request(briefing: Briefing):
+    """Creates a pull request."""
+    if not briefing.repo_url or not briefing.branch_name or not briefing.pr_title or not briefing.pr_body or not briefing.forgejo_token:
+        raise ValueError("repo_url, branch_name, pr_title, pr_body, and forgejo_token must be set in the briefing.")
+
+    workspace = Workspace(repo_url=briefing.repo_url, branch_name=briefing.branch_name)
+    return workspace.create_pull_request(briefing.pr_title, briefing.pr_body, briefing.forgejo_token)
+
+@activity.defn(name="merge_pull_request_activity")
+async def merge_pull_request(briefing: Briefing, pr_number: int):
+    """Merges a pull request."""
+    if not briefing.repo_url or not briefing.forgejo_token:
+        raise ValueError("repo_url and forgejo_token must be set in the briefing.")
+
+    # We don't need the branch_name for this activity.
+    workspace = Workspace(repo_url=briefing.repo_url, branch_name="dummy_branch")
+    return workspace.merge_pull_request(pr_number, briefing.forgejo_token)
+
+@activity.defn(name="cleanup_workspace_activity")
+async def cleanup_workspace(briefing: Briefing):
+    """Cleans up the workspace."""
+    if not briefing.workspace_path or not briefing.branch_name:
+        raise ValueError("workspace_path and branch_name must be set in the briefing.")
+
+    workspace = Workspace(branch_name=briefing.branch_name, path=Path(briefing.workspace_path))
+    workspace.cleanup_workspace()
diff --git a/experimental/users/acmcarther/temporal/git_workflow/activities_test.py b/experimental/users/acmcarther/temporal/git_workflow/activities_test.py
new file mode 100644
index 0000000..55ecd85
--- /dev/null
+++ b/experimental/users/acmcarther/temporal/git_workflow/activities_test.py
@@ -0,0 +1,159 @@
+import asyncio
+import unittest
+from unittest.mock import patch, MagicMock, AsyncMock
+
+from experimental.users.acmcarther.temporal.git_workflow.briefing import Briefing
+from experimental.users.acmcarther.temporal.git_workflow.activities import (
+    provision_workspace,
+    apply_changes_in_workspace,
+    commit_and_push_changes,
+    run_tests,
+    create_pull_request,
+    merge_pull_request,
+    cleanup_workspace,
+)
+
+class ActivitiesTest(unittest.TestCase):
+
+    def test_provision_workspace_activity(self):
+        # Arrange
+        briefing = Briefing(
+            repo_url="https://test.com/repo.git",
+            branch_name="feature/test",
+            task_description="", pr_title="", pr_body="", forgejo_token="", tests_to_run=[], files_to_create={}
+        )
+        
+        with patch("experimental.users.acmcarther.temporal.git_workflow.activities.Workspace") as mock_workspace_class:
+            mock_workspace_instance = MagicMock()
+            mock_workspace_instance.provision.return_value = "/workspace/feature_test"
+            mock_workspace_class.return_value = mock_workspace_instance
+
+            # Act
+            result = asyncio.run(provision_workspace(briefing))
+
+            # Assert
+            mock_workspace_class.assert_called_once_with(repo_url="https://test.com/repo.git", branch_name="feature/test")
+            mock_workspace_instance.provision.assert_called_once()
+            self.assertEqual(result, "/workspace/feature_test")
+
+    def test_apply_changes_activity(self):
+        # Arrange
+        briefing = Briefing(
+            workspace_path="/workspace/feature_test",
+            branch_name="feature/test",
+            files_to_create={"hello.txt": "world"},
+            repo_url="", task_description="", pr_title="", pr_body="", forgejo_token="", tests_to_run=[]
+        )
+
+        with patch("experimental.users.acmcarther.temporal.git_workflow.activities.Workspace") as mock_workspace_class:
+            mock_workspace_instance = MagicMock()
+            mock_workspace_class.return_value = mock_workspace_instance
+
+            # Act
+            asyncio.run(apply_changes_in_workspace(briefing, briefing.files_to_create))
+
+            # Assert
+            mock_workspace_instance.apply_changes.assert_called_once_with({"hello.txt": "world"})
+
+    def test_commit_and_push_activity(self):
+        # Arrange
+        briefing = Briefing(
+            workspace_path="/workspace/feature_test",
+            branch_name="feature/test",
+            repo_url="", task_description="", pr_title="", pr_body="", forgejo_token="", tests_to_run=[], files_to_create={}
+        )
+        commit_message = "A test commit"
+
+        with patch("experimental.users.acmcarther.temporal.git_workflow.activities.Workspace") as mock_workspace_class:
+            mock_workspace_instance = MagicMock()
+            mock_workspace_class.return_value = mock_workspace_instance
+
+            # Act
+            asyncio.run(commit_and_push_changes(briefing, commit_message))
+
+            # Assert
+            mock_workspace_instance.commit_and_push.assert_called_once_with(commit_message)
+
+    def test_run_tests_activity(self):
+        # Arrange
+        briefing = Briefing(
+            workspace_path="/workspace/feature_test",
+            branch_name="feature/test",
+            tests_to_run=["pytest ."],
+            repo_url="", task_description="", pr_title="", pr_body="", forgejo_token="", files_to_create={}
+        )
+
+        with patch("experimental.users.acmcarther.temporal.git_workflow.activities.Workspace") as mock_workspace_class:
+            mock_workspace_instance = MagicMock()
+            mock_workspace_class.return_value = mock_workspace_instance
+
+            # Act
+            asyncio.run(run_tests(briefing))
+
+            # Assert
+            mock_workspace_instance.run_tests.assert_called_once_with("pytest .")
+
+    def test_create_pull_request_activity(self):
+        # Arrange
+        briefing = Briefing(
+            repo_url="https://test.com/repo.git",
+            branch_name="feature/test",
+            pr_title="Test PR",
+            pr_body="This is a test.",
+            forgejo_token="fake-token",
+            task_description="", tests_to_run=[], files_to_create={}
+        )
+
+        with patch("experimental.users.acmcarther.temporal.git_workflow.activities.Workspace") as mock_workspace_class:
+            mock_workspace_instance = MagicMock()
+            mock_workspace_instance.create_pull_request.return_value = {"html_url": "https://test.com/repo/pulls/1"}
+            mock_workspace_class.return_value = mock_workspace_instance
+
+            # Act
+            result = asyncio.run(create_pull_request(briefing))
+
+            # Assert
+            mock_workspace_instance.create_pull_request.assert_called_once_with("Test PR", "This is a test.", "fake-token")
+            self.assertEqual(result, {"html_url": "https://test.com/repo/pulls/1"})
+
+    def test_merge_pull_request_activity(self):
+        # Arrange
+        briefing = Briefing(
+            repo_url="https://test.com/repo.git",
+            forgejo_token="fake-token",
+            branch_name="", task_description="", pr_title="", pr_body="", tests_to_run=[], files_to_create={}
+        )
+        pr_number = 123
+
+        with patch("experimental.users.acmcarther.temporal.git_workflow.activities.Workspace") as mock_workspace_class:
+            mock_workspace_instance = MagicMock()
+            mock_workspace_instance.merge_pull_request.return_value = {"merged": True}
+            mock_workspace_class.return_value = mock_workspace_instance
+
+            # Act
+            result = asyncio.run(merge_pull_request(briefing, pr_number))
+
+            # Assert
+            mock_workspace_instance.merge_pull_request.assert_called_once_with(123, "fake-token")
+            self.assertEqual(result, {"merged": True})
+
+    def test_cleanup_workspace_activity(self):
+        # Arrange
+        briefing = Briefing(
+            workspace_path="/workspace/feature_test",
+            branch_name="feature/test",
+            repo_url="", task_description="", pr_title="", pr_body="", forgejo_token="", tests_to_run=[], files_to_create={}
+        )
+
+        with patch("experimental.users.acmcarther.temporal.git_workflow.activities.Workspace") as mock_workspace_class:
+            mock_workspace_instance = MagicMock()
+            mock_workspace_class.return_value = mock_workspace_instance
+
+            # Act
+            asyncio.run(cleanup_workspace(briefing))
+
+            # Assert
+            mock_workspace_instance.cleanup_workspace.assert_called_once()
+
+if __name__ == "__main__":
+    unittest.main()
\ No newline at end of file
diff --git a/experimental/users/acmcarther/temporal/git_workflow/briefing.py b/experimental/users/acmcarther/temporal/git_workflow/briefing.py
new file mode 100644
index 0000000..d32baf0
--- /dev/null
+++ b/experimental/users/acmcarther/temporal/git_workflow/briefing.py
@@ -0,0 +1,25 @@
+from dataclasses import dataclass, field
+from typing import Optional, List, Dict, Tuple
+
+@dataclass
+class Changeset:
+    commit_message: str
+    files_to_create: Dict[str, str]
+
+@dataclass
+class Briefing:
+    """
+    A dataclass to hold the state of the git workflow.
+    """
+    repo_url: str
+    branch_name: str
+    task_description: str
+    pr_title: str
+    pr_body: str
+    forgejo_token: str
+    tests_to_run: list[str]
+    # A list of changesets to be applied and committed.
+    changesets: List[Changeset] = field(default_factory=list)
+    # DEPRECATED: Use changesets instead.
+    files_to_create: dict[str, str] = field(default_factory=dict)
+    workspace_path: Optional[str] = None
diff --git a/experimental/users/acmcarther/temporal/git_workflow/e2e_test.py b/experimental/users/acmcarther/temporal/git_workflow/e2e_test.py
new file mode 100644
index 0000000..11d26a5
--- /dev/null
+++ b/experimental/users/acmcarther/temporal/git_workflow/e2e_test.py
@@ -0,0 +1,163 @@
+import asyncio
+import logging
+import os
+import uuid
+import json
+import requests
+import time
+
+from temporalio.client import Client
+
+# This is a placeholder for a more robust end-to-end test.
+# A full implementation would require a running Temporal worker and a way to
+# interact with the Forgejo API to verify the results of the workflow.
+
+FORGEJO_URL = "https://forgejo.csbx.dev"
+REPO_OWNER = "gemini-thinker"
+API_URL = f"{FORGEJO_URL}/api/v1"
+LOG_FILE = "/home/coder/yesod/logs/e2e_test.log"
+
+# Set up logging
+logging.basicConfig(
+    level=logging.INFO,
+    format='%(asctime)s - %(levelname)s - %(message)s',
+    handlers=[
+        logging.StreamHandler()
+    ]
+)
+
+def get_forgejo_token():
+    logging.info("Attempting to get Forgejo token for gemini-thinker...")
+    # The e2e test runs as the 'gemini-thinker' agent to have the correct permissions.
+    token_path = os.path.expanduser("/home/coder/yesod/ai/agents/gemini-thinker/.forgejo_token")
+    if not os.path.exists(token_path):
+        logging.error(f"Forgejo token not found at {token_path}")
+        raise FileNotFoundError(f"Forgejo token not found at {token_path}")
+    with open(token_path, "r") as f:
+        token = f.read().strip()
+    logging.info("Successfully retrieved Forgejo token.")
+    return token
+
+def create_test_repo(repo_name):
+    """Creates a new repository in Forgejo for testing."""
+    logging.info(f"Creating test repository: {repo_name}")
+    headers = {
+        "Authorization": f"token {get_forgejo_token()}",
+        "Content-Type": "application/json",
+    }
+    data = {
+        "name": repo_name,
+        "private": False,
+        "auto_init": True,
+        "default_branch": "main",
+    }
+    url = f"{API_URL}/user/repos"
+    response = requests.post(url, headers=headers, json=data)
+    response.raise_for_status()
+    logging.info("Test repository created.")
+    return response.json()
+
+def delete_test_repo(repo_name):
+    """Deletes a repository from Forgejo."""
+    logging.info(f"Deleting test repository: {repo_name}")
+    headers = {"Authorization": f"token {get_forgejo_token()}"}
+    url = f"{API_URL}/repos/{REPO_OWNER}/{repo_name}"
+    response = requests.delete(url, headers=headers)
+    if response.status_code != 204:
+        logging.warning(f"Failed to delete repository {repo_name}: {response.text}")
+    else:
+        logging.info("Test repository deleted.")
+
+async def test_git_workflow_end_to_end():
+    """
+    Tests the full end-to-end GitWorkflow.
+    """
+    repo_name = f"test-repo-e2e-{uuid.uuid4()}"
+    logging.info(f"--- Starting E2E Git Workflow Test for repo: {repo_name} ---")
+    
+    try:
+        create_test_repo(repo_name)
+
+        # 1. Connect to Temporal
+        logging.info("STEP 1: Connecting to Temporal...")
+        client = await Client.connect("temporal-frontend.temporal.svc.cluster.local:7233", namespace="temporal-system")
+        logging.info("STEP 1 COMPLETE: Connected to Temporal.")
+
+        # 2. Set up workflow parameters
+        token = get_forgejo_token()
+        remote_url_with_token = f"https://{REPO_OWNER}:{token}@{FORGEJO_URL.split('//')[1]}/{REPO_OWNER}/{repo_name}.git"
+        branch_name = f"feature/test-e2e-{uuid.uuid4()}"
+        pr_title = f"E2E Test PR {branch_name}"
+        pr_body = "This is an end-to-end test PR."
+        workflow_id = f"git-workflow-e2e-{uuid.uuid4()}"
+        changesets = [
+            {
+                "commit_message": "Add new_file.txt",
+                "files_to_create": {"new_file.txt": "Hello, World!"},
+            },
+            {
+                "commit_message": "Add another_file.txt",
+                "files_to_create": {"another_file.txt": "Hello, again!"},
+            },
+        ]
+        
+        briefing = {
+            "task_description": "E2E Test",
+            "repo_url": remote_url_with_token,
+            "branch_name": branch_name,
+            "pr_title": pr_title,
+            "pr_body": pr_body,
+            "forgejo_token": token,
+            "changesets": changesets,
+            "tests_to_run": [],
+        }
+
+        # 3. Start the workflow
+        logging.info(f"STEP 2: Starting workflow with ID: {workflow_id}")
+        handle = await client.start_workflow(
+            "GitWorkflow",
+            briefing,
+            id=workflow_id,
+            task_queue="git-workflow-queue",
+        )
+        logging.info(f"STEP 2 COMPLETE: Workflow '{handle.id}' started.")
+
+        # 4. Wait for the workflow to be ready for approval (this is an approximation)
+        logging.info("STEP 3: Waiting for workflow to create PR...")
+        time.sleep(15) # Give it some time to create the PR
+
+        # 5. Send the approval signal
+        logging.info(f"STEP 4: Sending 'approve' signal to workflow {handle.id}...")
+        await handle.signal("approve")
+        logging.info("STEP 4 COMPLETE: Signal sent.")
+
+        # 6. Wait for the workflow result
+        logging.info("STEP 5: Waiting for workflow to complete...")
+        result = await handle.result()
+        logging.info(f"STEP 5 COMPLETE: Workflow finished with result: {result}")
+
+        # 7. Verify the files were created
+        logging.info("STEP 6: Verifying file creation in the repository...")
+        
+        # Verify first file
+        file1_content_url = f"{FORGEJO_URL}/{REPO_OWNER}/{repo_name}/raw/branch/main/new_file.txt"
+        response1 = requests.get(file1_content_url, timeout=5)
+        response1.raise_for_status()
+        assert response1.text == "Hello, World!"
+        
+        # Verify second file
+        file2_content_url = f"{FORGEJO_URL}/{REPO_OWNER}/{repo_name}/raw/branch/main/another_file.txt"
+        response2 = requests.get(file2_content_url, timeout=5)
+        response2.raise_for_status()
+        assert response2.text == "Hello, again!"
+
+        logging.info("STEP 6 COMPLETE: Files verified.")
+
+        logging.info("--- E2E Test Completed Successfully ---")
+
+    finally:
+        delete_test_repo(repo_name)
+
+
+if __name__ == "__main__":
+    asyncio.run(test_git_workflow_end_to_end())
\ No newline at end of file
diff --git a/experimental/users/acmcarther/temporal/git_workflow/trigger.py b/experimental/users/acmcarther/temporal/git_workflow/trigger.py
new file mode 100644
index 0000000..cedd1ae
--- /dev/null
+++ b/experimental/users/acmcarther/temporal/git_workflow/trigger.py
@@ -0,0 +1,87 @@
+import argparse
+import asyncio
+import uuid
+import logging
+import json
+
+from temporalio.client import Client
+
+from experimental.users.acmcarther.temporal.git_workflow.briefing import Briefing, Changeset
+from experimental.users.acmcarther.temporal.git_workflow.workflow import GitWorkflow
+
+logging.basicConfig(level=logging.INFO)
+
+
+async def main():
+    """Connects to Temporal and starts the GitWorkflow."""
+    parser = argparse.ArgumentParser(description="Trigger the GitWorkflow.")
+    parser.add_argument("--task-description", required=True)
+    parser.add_argument("--repo-url", required=True)
+    parser.add_argument("--branch-name", required=True)
+    parser.add_argument("--pr-title", required=True)
+    parser.add_argument("--pr-body", required=True)
+    parser.add_argument("--forgejo-token", required=True)
+    parser.add_argument("--tests-to-run", nargs='*', default=[])
+    parser.add_argument("--workflow-id", default=f"git-workflow-{uuid.uuid4()}")
+    parser.add_argument("--changesets", type=str, default='[]', help='A JSON string of a list of changesets.')
+    parser.add_argument("--signal-feedback", action="store_true", help="Send a feedback signal instead of starting a workflow.")
+    parser.add_argument("--feedback-changeset", type=str, help="JSON string for the feedback changeset.")
+
+    args = parser.parse_args()
+
+    client = await Client.connect("temporal-frontend.temporal.svc.cluster.local:7233", namespace="temporal-system")
+
+    if args.signal_feedback:
+        if not args.workflow_id or not args.feedback_changeset:
+            logging.error("--workflow-id and --feedback-changeset are required for signaling feedback.")
+            return
+        try:
+            changeset_data = json.loads(args.feedback_changeset)
+            changeset = Changeset(**changeset_data)
+        except (json.JSONDecodeError, TypeError):
+            logging.error("Invalid JSON format for --feedback-changeset.")
+            return
+        
+        handle = client.get_workflow_handle(args.workflow_id)
+        logging.info(f"Sending feedback to workflow {args.workflow_id}...")
+        await handle.signal("incorporate_feedback", changeset)
+        logging.info("Feedback signal sent.")
+        return
+
+    logging.info(f"Workflow ID: {args.workflow_id}")
+
+    try:
+        changesets_data = json.loads(args.changesets)
+        changesets = [Changeset(**cs) for cs in changesets_data]
+    except (json.JSONDecodeError, TypeError):
+        logging.error("Invalid JSON format for --changesets.")
+        return
+
+    briefing = Briefing(
+        task_description=args.task_description,
+        repo_url=args.repo_url,
+        branch_name=args.branch_name,
+        pr_title=args.pr_title,
+        pr_body=args.pr_body,
+        forgejo_token=args.forgejo_token,
+        tests_to_run=args.tests_to_run,
+        changesets=changesets,
+    )
+
+    workflow_id = args.workflow_id
+    task_queue = "git-workflow-queue"
+
+    logging.info(f"Starting workflow {workflow_id} on task queue {task_queue}...")
+    handle = await client.start_workflow(
+        GitWorkflow.run,
+        briefing,
+        id=workflow_id,
+        task_queue=task_queue,
+    )
+    logging.info(f"Workflow started with ID: {handle.id}")
+    # Note: This script now only starts the workflow.
+    # You can use other tools or scripts to signal it.
+
+
+if __name__ == "__main__":
+    asyncio.run(main())
diff --git a/experimental/users/acmcarther/temporal/git_workflow/worker.py b/experimental/users/acmcarther/temporal/git_workflow/worker.py
new file mode 100644
index 0000000..bba8be6
--- /dev/null
+++ b/experimental/users/acmcarther/temporal/git_workflow/worker.py
@@ -0,0 +1,59 @@
+import asyncio
+import logging
+
+from temporalio.client import Client
+from temporalio.worker import Worker
+
+# Import the workflow and activities
+from experimental.users.acmcarther.temporal.git_workflow.workflow import GitWorkflow
+from experimental.users.acmcarther.temporal.git_workflow.activities import (
+    provision_workspace,
+    apply_changes_in_workspace,
+    commit_and_push_changes,
+    run_tests,
+    create_pull_request,
+    merge_pull_request,
+    cleanup_workspace,
+)
+
+# Configure logging
+logging.basicConfig(level=logging.INFO)
+
+
+async def main():
+    """Creates and runs a Temporal worker for the GitWorkflow."""
+    logging.info("Connecting to Temporal server...")
+    client = await Client.connect(
+        "temporal-frontend.temporal.svc.cluster.local:7233",
+        namespace="temporal-system"
+    )
+    logging.info("Successfully connected to Temporal server.")
+
+    task_queue = "git-workflow-queue"
+    logging.info(f"Creating worker for task queue: '{task_queue}'")
+
+    worker = Worker(
+        client,
+        task_queue=task_queue,
+        workflows=[GitWorkflow],
+        activities=[
+            provision_workspace,
+            apply_changes_in_workspace,
+            commit_and_push_changes,
+            run_tests,
+            create_pull_request,
+            merge_pull_request,
+            cleanup_workspace,
+        ],
+    )
+
+    logging.info(f"Worker created. Starting run...")
+    await worker.run()
+    logging.info("Worker stopped.")
+
+
+if __name__ == "__main__":
+    try:
+        asyncio.run(main())
+    except KeyboardInterrupt:
+        print("Worker shutting down.")
diff --git a/experimental/users/acmcarther/temporal/git_workflow/workflow.py b/experimental/users/acmcarther/temporal/git_workflow/workflow.py
new file mode 100644
index 0000000..07d0624
--- /dev/null
+++ b/experimental/users/acmcarther/temporal/git_workflow/workflow.py
@@ -0,0 +1,169 @@
+from datetime import timedelta
+from temporalio import workflow
+from temporalio.exceptions import ActivityError
+import asyncio
+
+# Import the activities
+from experimental.users.acmcarther.temporal.git_workflow.activities import (
+    provision_workspace,
+    apply_changes_in_workspace,
+    commit_and_push_changes,
+    run_tests,
+    create_pull_request,
+    merge_pull_request,
+    cleanup_workspace,
+)
+from experimental.users.acmcarther.temporal.git_workflow.briefing import Briefing, Changeset
+from typing import Optional
+
+@workflow.defn
+class GitWorkflow:
+    def __init__(self):
+        self._approved = False
+        self._retry_tests_flag = False
+        self._feedback_received = False
+        self._feedback_changeset: Optional[Changeset] = None
+        self._ready_for_approval = False
+
+    @workflow.signal
+    def approve(self):
+        self._approved = True
+
+    @workflow.signal
+    def retry_tests(self):
+        self._retry_tests_flag = True
+
+    @workflow.signal
+    def incorporate_feedback(self, changeset: Changeset):
+        self._feedback_received = True
+        self._feedback_changeset = changeset
+
+    @workflow.query
+    def is_ready_for_approval(self) -> bool:
+        return self._ready_for_approval
+
+    @workflow.run
+    async def run(self, briefing: Briefing) -> str:
+        """Executes the git workflow."""
+        
+        try:
+            # 1. Provision the workspace
+            workspace_path = await workflow.execute_activity(
+                provision_workspace,
+                briefing,
+                start_to_close_timeout=timedelta(minutes=15),
+            )
+            briefing.workspace_path = workspace_path
+
+            # 2. Apply changes and commit for each changeset
+            if briefing.changesets:
+                for changeset in briefing.changesets:
+                    await workflow.execute_activity(
+                        apply_changes_in_workspace,
+                        args=[briefing, changeset.files_to_create],
+                        start_to_close_timeout=timedelta(minutes=2),
+                    )
+                    await workflow.execute_activity(
+                        commit_and_push_changes,
+                        args=[briefing, changeset.commit_message],
+                        start_to_close_timeout=timedelta(minutes=2),
+                    )
+            # DEPRECATED: Handle old-style files_to_create
+            elif briefing.files_to_create:
+                 await workflow.execute_activity(
+                    apply_changes_in_workspace,
+                    args=[briefing, briefing.files_to_create],
+                    start_to_close_timeout=timedelta(minutes=2),
+                )
+                 commit_message = f"Apply changes for: {briefing.task_description}"
+                 await workflow.execute_activity(
+                    commit_and_push_changes,
+                    args=[briefing, commit_message],
+                    start_to_close_timeout=timedelta(minutes=2),
+                )
+
+            # 4. Run tests with retry logic
+            while True:
+                try:
+                    await workflow.execute_activity(
+                        run_tests,
+                        briefing,
+                        start_to_close_timeout=timedelta(minutes=10),
+                    )
+                    break  # Tests passed, exit the loop
+                except ActivityError as e:
+                    workflow.logger.warning(f"Tests failed: {e}. Waiting for retry signal.")
+                    await workflow.wait_condition(lambda: self._retry_tests_flag)
+                    self._retry_tests_flag = False # Reset for next potential failure
+
+            # 5. Create a pull request
+            pr = await workflow.execute_activity(
+                create_pull_request,
+                briefing,
+                start_to_close_timeout=timedelta(minutes=2),
+            )
+            pr_number = pr.get("number")
+            pr_url = pr.get("html_url")
+
+            self._ready_for_approval = True
+
+            # 6. Wait for feedback or approval
+            while True:
+                # Wait for either signal
+                await workflow.wait_condition(
+                    lambda: self._approved or self._feedback_received
+                )
+
+                if self._feedback_received and self._feedback_changeset:
+                    changeset = self._feedback_changeset
+                    self._feedback_received = False # Reset for the next feedback cycle
+                    self._feedback_changeset = None
+
+                    # Apply and commit the feedback
+                    await workflow.execute_activity(
+                        apply_changes_in_workspace,
+                        args=[briefing, changeset.files_to_create],
+                        start_to_close_timeout=timedelta(minutes=2),
+                    )
+                    await workflow.execute_activity(
+                        commit_and_push_changes,
+                        args=[briefing, changeset.commit_message],
+                        start_to_close_timeout=timedelta(minutes=2),
+                    )
+
+                    # Re-run tests after applying feedback
+                    while True:
+                        try:
+                            await workflow.execute_activity(
+                                run_tests,
+                                briefing,
+                                start_to_close_timeout=timedelta(minutes=10),
+                            )
+                            break # Tests passed
+                        except ActivityError as e:
+                            workflow.logger.warning(f"Tests failed after applying feedback: {e}. Waiting for retry signal.")
+                            await workflow.wait_condition(lambda: self._retry_tests_flag)
+                            self._retry_tests_flag = False
+                    
+                    # Continue the loop to wait for more feedback or approval
+                    continue
+
+                if self._approved:
+                    break # Exit the loop to merge
+            
+            # 7. Merge the pull request
+            await workflow.execute_activity(
+                merge_pull_request,
+                args=[briefing, pr_number],
+                start_to_close_timeout=timedelta(minutes=2),
+            )
+
+            return f"Pull request merged: {pr_url}"
+        finally:
+            # 8. Clean up the workspace
+            if briefing.workspace_path:
+                await workflow.execute_activity(
+                    cleanup_workspace,
+                    briefing,
+                    start_to_close_timeout=timedelta(minutes=2),
+                )
diff --git a/experimental/users/acmcarther/temporal/git_workflow/workflow_test.py b/experimental/users/acmcarther/temporal/git_workflow/workflow_test.py
new file mode 100644
index 0000000..d736baa
--- /dev/null
+++ b/experimental/users/acmcarther/temporal/git_workflow/workflow_test.py
@@ -0,0 +1,178 @@
+import pytest
+import asyncio
+from temporalio.testing import WorkflowEnvironment
+from temporalio.worker import Worker
+from temporalio.exceptions import ActivityError
+
+from experimental.users.acmcarther.temporal.git_workflow.workflow import GitWorkflow
+from experimental.users.acmcarther.temporal.git_workflow.briefing import Briefing, Changeset
+from experimental.users.acmcarther.temporal.git_workflow.activities import (
+    provision_workspace,
+    apply_changes_in_workspace,
+    commit_and_push_changes,
+    run_tests,
+    create_pull_request,
+    merge_pull_request,
+    cleanup_workspace,
+)
+
+@pytest.mark.asyncio
+async def test_git_workflow_success_path_single_commit(mocker):
+    """Tests the successful path of the GitWorkflow with a single commit."""
+    
+    briefing = Briefing(
+        repo_url="https://test.com/repo.git",
+        branch_name="feature/test",
+        task_description="Test the workflow",
+        pr_title="Test PR",
+        pr_body="This is a test.",
+        forgejo_token="fake-token",
+        tests_to_run=["pytest ."],
+        files_to_create={"test.txt": "hello"},
+    )
+
+    activities = [
+        mocker.patch("experimental.users.acmcarther.temporal.git_workflow.activities.provision_workspace", return_value="/mock/workspace/path"),
+        mocker.patch("experimental.users.acmcarther.temporal.git_workflow.activities.apply_changes_in_workspace"),
+        mocker.patch("experimental.users.acmcarther.temporal.git_workflow.activities.commit_and_push_changes"),
+        mocker.patch("experimental.users.acmcarther.temporal.git_workflow.activities.run_tests"),
+        mocker.patch("experimental.users.acmcarther.temporal.git_workflow.activities.create_pull_request", return_value={"number": 123, "html_url": "https://test.com/repo/pulls/1"}),
+        mocker.patch("experimental.users.acmcarther.temporal.git_workflow.activities.merge_pull_request", return_value={"merged": True}),
+        mocker.patch("experimental.users.acmcarther.temporal.git_workflow.activities.cleanup_workspace"),
+    ]
+
+    async with await WorkflowEnvironment.start_time_skipping() as env:
+        async with Worker(
+            env.client,
+            task_queue="test-git-workflow",
+            workflows=[GitWorkflow],
+            activities=activities,
+        ):
+            handle = await env.client.start_workflow(
+                GitWorkflow.run,
+                briefing,
+                id="test-git-workflow-id",
+                task_queue="test-git-workflow",
+            )
+            
+            await asyncio.sleep(0.1)
+            await handle.signal("approve")
+            result = await handle.result()
+            
+            assert result == "Pull request merged: https://test.com/repo/pulls/1"
+            activities[1].assert_called_once()
+            activities[2].assert_called_once()
+            activities[-1].assert_called_once() # Check that cleanup was called
+
+@pytest.mark.asyncio
+async def test_git_workflow_success_path_multiple_commits(mocker):
+    """Tests the successful path of the GitWorkflow with multiple commits."""
+    
+    changesets = [
+        Changeset(commit_message="First commit", files_to_create={"a.txt": "1"}),
+        Changeset(commit_message="Second commit", files_to_create={"b.txt": "2"}),
+    ]
+    briefing = Briefing(
+        repo_url="https://test.com/repo.git",
+        branch_name="feature/test",
+        task_description="Test the workflow",
+        pr_title="Test PR",
+        pr_body="This is a test.",
+        forgejo_token="fake-token",
+        tests_to_run=["pytest ."],
+        changesets=changesets,
+    )
+
+    activities = [
+        mocker.patch("experimental.users.acmcarther.temporal.git_workflow.activities.provision_workspace", return_value="/mock/workspace/path"),
+        mocker.patch("experimental.users.acmcarther.temporal.git_workflow.activities.apply_changes_in_workspace"),
+        mocker.patch("experimental.users.acmcarther.temporal.git_workflow.activities.commit_and_push_changes"),
+        mocker.patch("experimental.users.acmcarther.temporal.git_workflow.activities.run_tests"),
+        mocker.patch("experimental.users.acmcarther.temporal.git_workflow.activities.create_pull_request", return_value={"number": 123, "html_url": "https://test.com/repo/pulls/1"}),
+        mocker.patch("experimental.users.acmcarther.temporal.git_workflow.activities.merge_pull_request", return_value={"merged": True}),
+        mocker.patch("experimental.users.acmcarther.temporal.git_workflow.activities.cleanup_workspace"),
+    ]
+
+    async with await WorkflowEnvironment.start_time_skipping() as env:
+        async with Worker(
+            env.client,
+            task_queue="test-git-workflow",
+            workflows=[GitWorkflow],
+            activities=activities,
+        ):
+            handle = await env.client.start_workflow(
+                GitWorkflow.run,
+                briefing,
+                id="test-git-workflow-id",
+                task_queue="test-git-workflow",
+            )
+            
+            await asyncio.sleep(0.1)
+            await handle.signal("approve")
+            result = await handle.result()
+            
+            assert result == "Pull request merged: https://test.com/repo/pulls/1"
+            assert activities[1].call_count == 2
+            assert activities[2].call_count == 2
+            activities[-1].assert_called_once()
+
+@pytest.mark.asyncio
+async def test_git_workflow_feedback_loop(mocker):
+    """Tests the feedback loop of the GitWorkflow."""
+    
+    briefing = Briefing(
+        repo_url="https://test.com/repo.git",
+        branch_name="feature/test",
+        task_description="Test the workflow",
+        pr_title="Test PR",
+        pr_body="This is a test.",
+        forgejo_token="fake-token",
+        tests_to_run=["pytest ."],
+        files_to_create={"test.txt": "hello"},
+    )
+
+    feedback_changeset = Changeset(
+        commit_message="Incorporate feedback",
+        files_to_create={"test.txt": "hello world"},
+    )
+
+    run_tests_mock = mocker.patch("experimental.users.acmcarther.temporal.git_workflow.activities.run_tests")
+    
+    activities = [
+        mocker.patch("experimental.users.acmcarther.temporal.git_workflow.activities.provision_workspace", return_value="/mock/workspace/path"),
+        mocker.patch("experimental.users.acmcarther.temporal.git_workflow.activities.apply_changes_in_workspace"),
+        mocker.patch("experimental.users.acmcarther.temporal.git_workflow.activities.commit_and_push_changes"),
+        run_tests_mock,
+        mocker.patch("experimental.users.acmcarther.temporal.git_workflow.activities.create_pull_request", return_value={"number": 123, "html_url": "https://test.com/repo/pulls/1"}),
+        mocker.patch("experimental.users.acmcarther.temporal.git_workflow.activities.merge_pull_request", return_value={"merged": True}),
+        mocker.patch("experimental.users.acmcarther.temporal.git_workflow.activities.cleanup_workspace"),
+    ]
+
+    async with await WorkflowEnvironment.start_time_skipping() as env:
+        async with Worker(
+            env.client,
+            task_queue="test-git-workflow",
+            workflows=[GitWorkflow],
+            activities=activities,
+        ):
+            handle = await env.client.start_workflow(
+                GitWorkflow.run,
+                briefing,
+                id="test-git-workflow-id",
+                task_queue="test-git-workflow",
+            )
+            
+            await asyncio.sleep(0.1)
+            await handle.signal("incorporate_feedback", feedback_changeset)
+            await asyncio.sleep(0.1)
+            await handle.signal("approve")
+            
+            result = await handle.result()
+            
+            assert result == "Pull request merged: https://test.com/repo/pulls/1"
+            # apply_changes and commit_and_push are called once initially, and once for feedback
+            assert activities[1].call_count == 2
+            assert activities[2].call_count == 2
+            # run_tests is called once initially, and once after feedback
+            assert run_tests_mock.call_count == 2
+            activities[-1].assert_called_once()
diff --git a/experimental/users/acmcarther/temporal/git_workflow/workspace.py b/experimental/users/acmcarther/temporal/git_workflow/workspace.py
new file mode 100644
index 0000000..cfd324e
--- /dev/null
+++ b/experimental/users/acmcarther/temporal/git_workflow/workspace.py
@@ -0,0 +1,166 @@
+import subprocess
+from pathlib import Path
+import logging
+import os
+from typing import Optional
+import shutil
+
+# Set up logging
+logging.basicConfig(
+    level=logging.INFO,
+    format='%(asctime)s - %(levelname)s - %(message)s',
+)
+
+class Workspace:
+    """
+    A class to encapsulate git operations for a workspace.
+    """
+
+    def __init__(self, branch_name: str, repo_url: Optional[str] = None, path: Optional[Path] = None):
+        self.repo_url = repo_url
+        self.branch_name = branch_name
+        
+        if path:
+            self.path = path
+        else:
+            workspace_base = "/workspace"
+            # Sanitize branch name to be a valid directory name
+            sanitized_branch_name = "".join(c if c.isalnum() else '_' for c in branch_name)
+            self.path = Path(workspace_base) / sanitized_branch_name
+
+    def _run_command(self, *args, cwd=None):
+        """Runs a command and logs its output."""
+        cwd = cwd or self.path
+        logging.info(f"Running command: {' '.join(str(arg) for arg in args)}")
+        try:
+            result = subprocess.run(
+                args,
+                cwd=cwd,
+                check=True,
+                capture_output=True,
+                text=True,
+            )
+            logging.info(result.stdout)
+            return result.stdout.strip()
+        except subprocess.CalledProcessError as e:
+            logging.error(f"Command failed: {e.stderr}")
+            raise
+
+    def provision(self):
+        """
+        Clones a repository, creates a new branch, and pushes it to the remote.
+        """
+        if not self.repo_url:
+            raise ValueError("repo_url must be set to provision a workspace.")
+
+        logging.info(f"Provisioning workspace for branch '{self.branch_name}' from repo '{self.repo_url}'")
+
+        if self.path.exists():
+            logging.info(f"Workspace path {self.path} already exists, removing it.")
+            shutil.rmtree(self.path)
+
+        os.makedirs(self.path.parent, exist_ok=True)
+
+        # Clone the repository
+        self._run_command(
+            "git", "-c", "http.sslVerify=false", "clone", self.repo_url, str(self.path),
+            cwd=self.path.parent
+        )
+
+        # Create and check out the new branch
+        self._run_command("git", "checkout", "-b", self.branch_name)
+
+        # Configure git user
+        self._run_command("git", "config", "user.name", self.branch_name.split('/')[1])
+        self._run_command("git", "config", "user.email", "gemini-prime@localhost")
+
+        # Push the new branch to the remote
+        self._run_command("git", "-c", "http.sslVerify=false", "push", "-u", "origin", self.branch_name)
+        
+        logging.info(f"Workspace created successfully at: {self.path}")
+        return str(self.path)
+
+    def apply_changes(self, files_to_create: dict[str, str]):
+        """Creates or overwrites files in the workspace."""
+        for filename, content in files_to_create.items():
+            file_path = self.path / filename
+            file_path.parent.mkdir(parents=True, exist_ok=True)
+            with open(file_path, "w") as f:
+                f.write(content)
+            logging.info(f"Created/updated file: {filename}")
+
+    def commit_and_push(self, commit_message: str):
+        """Commits all changes and pushes the branch to the remote."""
+        self._run_command("git", "add", ".")
+        self._run_command("git", "commit", "-m", commit_message)
+        self._run_command("git", "-c", "http.sslVerify=false", "push", "origin", self.branch_name)
+        logging.info("Committed and pushed changes.")
+
+    def run_tests(self, test_command: str):
+        """Runs a test command in the workspace."""
+        logging.info(f"Running tests with command: {test_command}")
+        # The command is expected to be a single string, so we split it.
+        self._run_command(*test_command.split())
+        logging.info("Tests passed.")
+
+    def create_pull_request(self, title: str, body: str, forgejo_token: str):
+        """Creates a pull request on Forgejo."""
+        import requests
+        if not self.repo_url:
+            raise ValueError("repo_url must be set to create a pull request.")
+
+        # Extract owner and repo name from the repo_url
+        # Example: https://forgejo.csbx.dev/gemini-thinker/test-repo.git
+        parts = self.repo_url.split("/")
+        owner = parts[-2]
+        repo_name = parts[-1].replace(".git", "")
+        
+        api_url = f"https://forgejo.csbx.dev/api/v1/repos/{owner}/{repo_name}/pulls"
+        headers = {
+            "Authorization": f"token {forgejo_token}",
+            "Content-Type": "application/json",
+        }
+        data = {
+            "head": self.branch_name,
+            "base": "main",  # Assuming 'main' is the default branch
+            "title": title,
+            "body": body,
+        }
+
+        logging.info(f"Creating pull request: {title}")
+        response = requests.post(api_url, headers=headers, json=data)
+        response.raise_for_status()
+        logging.info("Pull request created successfully.")
+        return response.json()
+
+    def merge_pull_request(self, pr_number: int, forgejo_token: str):
+        """Merges a pull request on Forgejo."""
+        import requests
+        if not self.repo_url:
+            raise ValueError("repo_url must be set to merge a pull request.")
+
+        parts = self.repo_url.split("/")
+        owner = parts[-2]
+        repo_name = parts[-1].replace(".git", "")
+
+        api_url = f"https://forgejo.csbx.dev/api/v1/repos/{owner}/{repo_name}/pulls/{pr_number}/merge"
+        headers = {
+            "Authorization": f"token {forgejo_token}",
+            "Content-Type": "application/json",
+        }
+        data = {
+            "Do": "merge",
+        }
+
+        logging.info(f"Merging pull request #{pr_number}")
+        response = requests.post(api_url, headers=headers, json=data)
+        response.raise_for_status()
+        logging.info(f"Pull request #{pr_number} merged successfully.")
+        return response.json()
+
+    def cleanup_workspace(self):
+        """Deletes the local workspace directory."""
+        if self.path.exists():
+            logging.info(f"Cleaning up workspace at {self.path}")
+            shutil.rmtree(self.path)
+            logging.info("Workspace cleaned up successfully.")
\ No newline at end of file
diff --git a/experimental/users/acmcarther/temporal/git_workflow/workspace_test.py b/experimental/users/acmcarther/temporal/git_workflow/workspace_test.py
new file mode 100644
index 0000000..9a222ec
--- /dev/null
+++ b/experimental/users/acmcarther/temporal/git_workflow/workspace_test.py
@@ -0,0 +1,163 @@
+import unittest
+from unittest.mock import patch, MagicMock
+from pathlib import Path
+
+from experimental.users.acmcarther.temporal.git_workflow.workspace import Workspace
+
+class WorkspaceTest(unittest.TestCase):
+
+    @patch("subprocess.run")
+    @patch("os.makedirs")
+    def test_provision_success(self, mock_makedirs, mock_subprocess_run):
+        # Arrange
+        repo_url = "https://forgejo.csbx.dev/gemini-thinker/test-repo.git"
+        branch_name = "feature/new-thing"
+        
+        # Mock the subprocess result
+        mock_process = MagicMock()
+        mock_process.returncode = 0
+        mock_process.stdout = "Success"
+        mock_process.stderr = ""
+        mock_subprocess_run.return_value = mock_process
+
+        # Act
+        workspace = Workspace(branch_name=branch_name, repo_url=repo_url)
+        result_path = workspace.provision()
+
+        # Assert
+        self.assertEqual(result_path, str(workspace.path))
+        mock_makedirs.assert_called_once_with(workspace.path.parent, exist_ok=True)
+        
+        self.assertEqual(mock_subprocess_run.call_count, 5)
+        mock_subprocess_run.assert_any_call(
+            ("git", "-c", "http.sslVerify=false", "clone", repo_url, str(workspace.path)),
+            cwd=workspace.path.parent, check=True, capture_output=True, text=True
+        )
+        mock_subprocess_run.assert_any_call(
+            ("git", "checkout", "-b", branch_name),
+            cwd=workspace.path, check=True, capture_output=True, text=True
+        )
+        mock_subprocess_run.assert_any_call(
+            ("git", "config", "user.name", "new-thing"),
+            cwd=workspace.path, check=True, capture_output=True, text=True
+        )
+        mock_subprocess_run.assert_any_call(
+            ("git", "config", "user.email", "gemini-prime@localhost"),
+            cwd=workspace.path, check=True, capture_output=True, text=True
+        )
+        mock_subprocess_run.assert_any_call(
+            ("git", "-c", "http.sslVerify=false", "push", "-u", "origin", branch_name),
+            cwd=workspace.path, check=True, capture_output=True, text=True
+        )
+
+    @patch("pathlib.Path.mkdir")
+    @patch("builtins.open")
+    def test_apply_changes(self, mock_open, mock_mkdir):
+        # Arrange
+        workspace = Workspace(branch_name="branch")
+        files_to_create = {"test.txt": "hello"}
+
+        # Act
+        workspace.apply_changes(files_to_create)
+
+        # Assert
+        mock_mkdir.assert_called_once_with(parents=True, exist_ok=True)
+        mock_open.assert_called_once_with(workspace.path / "test.txt", "w")
+        mock_open.return_value.__enter__.return_value.write.assert_called_once_with("hello")
+
+    @patch("subprocess.run")
+    def test_commit_and_push(self, mock_subprocess_run):
+        # Arrange
+        workspace = Workspace(branch_name="branch")
+        commit_message = "Test commit"
+
+        # Act
+        workspace.commit_and_push(commit_message)
+
+        # Assert
+        self.assertEqual(mock_subprocess_run.call_count, 3)
+        mock_subprocess_run.assert_any_call(
+            ("git", "add", "."),
+            cwd=workspace.path, check=True, capture_output=True, text=True
+        )
+        mock_subprocess_run.assert_any_call(
+            ("git", "commit", "-m", commit_message),
+            cwd=workspace.path, check=True, capture_output=True, text=True
+        )
+        mock_subprocess_run.assert_any_call(
+            ("git", "-c", "http.sslVerify=false", "push", "origin", "branch"),
+            cwd=workspace.path, check=True, capture_output=True, text=True
+        )
+
+    @patch("subprocess.run")
+    def test_run_tests(self, mock_subprocess_run):
+        # Arrange
+        workspace = Workspace(branch_name="branch")
+        test_command = "pytest ."
+
+        # Act
+        workspace.run_tests(test_command)
+
+        # Assert
+        mock_subprocess_run.assert_called_once_with(
+            ("pytest", "."),
+            cwd=workspace.path, check=True, capture_output=True, text=True
+        )
+
+    @patch("requests.post")
+    def test_create_pull_request(self, mock_post):
+        # Arrange
+        repo_url = "https://forgejo.csbx.dev/gemini-thinker/test-repo.git"
+        workspace = Workspace(branch_name="feature/new-thing", repo_url=repo_url)
+        title = "Test PR"
+        body = "This is a test."
+        token = "fake-token"
+
+        mock_response = MagicMock()
+        mock_response.raise_for_status.return_value = None
+        mock_response.json.return_value = {"id": 123}
+        mock_post.return_value = mock_response
+
+        # Act
+        result = workspace.create_pull_request(title, body, token)
+
+        # Assert
+        self.assertEqual(result, {"id": 123})
+        mock_post.assert_called_once()
+
+    @patch("requests.post")
+    def test_merge_pull_request(self, mock_post):
+        # Arrange
+        repo_url = "https://forgejo.csbx.dev/gemini-thinker/test-repo.git"
+        workspace = Workspace(branch_name="feature/new-thing", repo_url=repo_url)
+        pr_number = 123
+        token = "fake-token"
+
+        mock_response = MagicMock()
+        mock_response.raise_for_status.return_value = None
+        mock_response.json.return_value = {"merged": True}
+        mock_post.return_value = mock_response
+
+        # Act
+        result = workspace.merge_pull_request(pr_number, token)
+
+        # Assert
+        self.assertEqual(result, {"merged": True})
+        mock_post.assert_called_once()
+
+    @patch("shutil.rmtree")
+    @patch("pathlib.Path.exists")
+    def test_cleanup_workspace(self, mock_exists, mock_rmtree):
+        # Arrange
+        mock_exists.return_value = True
+        workspace = Workspace(branch_name="branch")
+
+        # Act
+        workspace.cleanup_workspace()
+
+        # Assert
+        mock_exists.assert_called_once()
+        mock_rmtree.assert_called_once_with(workspace.path)
+
+if __name__ == "__main__":
+    unittest.main()
\ No newline at end of file
diff --git a/experimental/users/acmcarther/temporal/helloworld.go b/experimental/users/acmcarther/temporal/helloworld.go
new file mode 100644
index 0000000..7da4c2c
--- /dev/null
+++ b/experimental/users/acmcarther/temporal/helloworld.go
@@ -0,0 +1,37 @@
+package helloworld
+
+import (
+	"context"
+	"time"
+
+	"go.temporal.io/sdk/activity"
+	"go.temporal.io/sdk/workflow"
+)
+
+// Workflow is a Hello World workflow definition.
+func Workflow(ctx workflow.Context, name string) (string, error) {
+	ao := workflow.ActivityOptions{
+		StartToCloseTimeout: 10 * time.Second,
+	}
+	ctx = workflow.WithActivityOptions(ctx, ao)
+
+	logger := workflow.GetLogger(ctx)
+	logger.Info("HelloWorld workflow started", "name", name)
+
+	var result string
+	err := workflow.ExecuteActivity(ctx, Activity, name).Get(ctx, &result)
+	if err != nil {
+		logger.Error("Activity failed.", "Error", err)
+		return "", err
+	}
+
+	logger.Info("HelloWorld workflow completed.", "result", result)
+
+	return result, nil
+}
+
+func Activity(ctx context.Context, name string) (string, error) {
+	logger := activity.GetLogger(ctx)
+	logger.Info("Activity", "name", name)
+	return "Hello " + name + "!", nil
+}
diff --git a/experimental/users/acmcarther/temporal/starter_main.go b/experimental/users/acmcarther/temporal/starter_main.go
new file mode 100644
index 0000000..eee0ede
--- /dev/null
+++ b/experimental/users/acmcarther/temporal/starter_main.go
@@ -0,0 +1,39 @@
+package main
+
+import (
+	"context"
+	"log"
+
+	"go.temporal.io/sdk/client"
+
+	"forgejo.csbx.dev/acmcarther/yesod/experimental/users/acmcarther/temporal"
+)
+
+func main() {
+	// The client is a heavyweight object that should be created once per process.
+	c, err := client.Dial(client.Options{})
+	if err != nil {
+		log.Fatalln("Unable to create client", err)
+	}
+	defer c.Close()
+
+	workflowOptions := client.StartWorkflowOptions{
+		ID:        "hello_world_workflowID",
+		TaskQueue: "hello-world",
+	}
+
+	we, err := c.ExecuteWorkflow(context.Background(), workflowOptions, helloworld.Workflow, "Temporal")
+	if err != nil {
+		log.Fatalln("Unable to execute workflow", err)
+	}
+
+	log.Println("Started workflow", "WorkflowID", we.GetID(), "RunID", we.GetRunID())
+
+	// Synchronously wait for the workflow completion.
+	var result string
+	err = we.Get(context.Background(), &result)
+	if err != nil {
+		log.Fatalln("Unable get workflow result", err)
+	}
+	log.Println("Workflow result:", result)
+}
\ No newline at end of file
diff --git a/experimental/users/acmcarther/temporal/worker_main.go b/experimental/users/acmcarther/temporal/worker_main.go
new file mode 100644
index 0000000..a996b67
--- /dev/null
+++ b/experimental/users/acmcarther/temporal/worker_main.go
@@ -0,0 +1,29 @@
+package main
+
+import (
+	"log"
+
+	"go.temporal.io/sdk/client"
+	"go.temporal.io/sdk/worker"
+
+	"forgejo.csbx.dev/acmcarther/yesod/experimental/users/acmcarther/temporal"
+)
+
+func main() {
+	// The client and worker are heavyweight objects that should be created once per process.
+	c, err := client.Dial(client.Options{})
+	if err != nil {
+		log.Fatalln("Unable to create client", err)
+	}
+	defer c.Close()
+
+	w := worker.New(c, "hello-world", worker.Options{})
+
+	w.RegisterWorkflow(helloworld.Workflow)
+	w.RegisterActivity(helloworld.Activity)
+
+	err = w.Run(worker.InterruptCh())
+	if err != nil {
+		log.Fatalln("Unable to start worker", err)
+	}
+}
\ No newline at end of file
diff --git a/experimental/users/acmcarther/vscode_extension/.vscode/launch.json b/experimental/users/acmcarther/vscode_extension/.vscode/launch.json
new file mode 100644
index 0000000..07f235a
--- /dev/null
+++ b/experimental/users/acmcarther/vscode_extension/.vscode/launch.json
@@ -0,0 +1,17 @@
+{
+    "version": "0.2.0",
+    "configurations": [
+        {
+            "name": "Run Extension",
+            "type": "extensionHost",
+            "request": "launch",
+            "args": [
+                "--extensionDevelopmentPath=${workspaceFolder}"
+            ],
+            "outFiles": [
+                "${workspaceFolder}/out/**/*.js"
+            ],
+            "preLaunchTask": "${defaultBuildTask}"
+        }
+    ]
+}
diff --git a/experimental/users/acmcarther/vscode_extension/.vscode/tasks.json b/experimental/users/acmcarther/vscode_extension/.vscode/tasks.json
new file mode 100644
index 0000000..a631ee1
--- /dev/null
+++ b/experimental/users/acmcarther/vscode_extension/.vscode/tasks.json
@@ -0,0 +1,27 @@
+{
+    "version": "2.0.0",
+    "tasks": [
+        {
+            "label": "npm: compile",
+            "type": "shell",
+            "command": "npm run compile",
+            "group": {
+                "kind": "build",
+                "isDefault": true
+            },
+            "presentation": {
+                "reveal": "always",
+                "panel": "new"
+            }
+        },
+        {
+            "label": "bazel: build",
+            "type": "shell",
+            "command": "bazel build //experimental/users/acmcarther/vscode_extension:extension && mkdir -p out && cp -L ../../../../bazel-bin/experimental/users/acmcarther/vscode_extension/out/extension.js out/extension.js",
+            "group": "build",
+             "options": {
+                "cwd": "${workspaceFolder}"
+            }
+        }
+    ]
+}
diff --git a/experimental/users/acmcarther/vscode_extension/.vscodeignore b/experimental/users/acmcarther/vscode_extension/.vscodeignore
new file mode 100644
index 0000000..a06a3a1
--- /dev/null
+++ b/experimental/users/acmcarther/vscode_extension/.vscodeignore
@@ -0,0 +1,8 @@
+.vscode/**
+.vscode-test/**
+src/**
+node_modules/**
+bazel-*
+BUILD.bazel
+tsconfig.json
+.gitignore
diff --git a/experimental/users/acmcarther/vscode_extension/BUILD.bazel b/experimental/users/acmcarther/vscode_extension/BUILD.bazel
new file mode 100644
index 0000000..caee66a
--- /dev/null
+++ b/experimental/users/acmcarther/vscode_extension/BUILD.bazel
@@ -0,0 +1,31 @@
+load("@aspect_rules_esbuild//esbuild:defs.bzl", "esbuild")
+load("//tools/vscode:defs.bzl", "vsce_extension")
+
+package(default_visibility = ["//visibility:public"])
+
+esbuild(
+    name = "extension",
+    srcs = ["src/extension.ts"],
+    entry_point = "src/extension.ts",
+    output = "out/extension.js",
+    platform = "node",
+    target = "node18",
+    format = "cjs",
+    external = ["vscode"],
+    deps = [
+        "//:node_modules/@types/node",
+        "//:node_modules/@types/vscode",
+    ],
+)
+
+vsce_extension(
+    name = "vsix",
+    srcs = [
+        "package.json",
+        "README.md",
+        "tsconfig.json",
+        ".vscodeignore",
+    ],
+    extension_js = [":extension"],
+    out = "bazel-target-copier-0.0.2.vsix",
+)
diff --git a/experimental/users/acmcarther/vscode_extension/README.md b/experimental/users/acmcarther/vscode_extension/README.md
new file mode 100644
index 0000000..0206758
--- /dev/null
+++ b/experimental/users/acmcarther/vscode_extension/README.md
@@ -0,0 +1,3 @@
+# Bazel Target Copier
+
+A VSCode extension to copy Bazel target labels.
diff --git a/experimental/users/acmcarther/vscode_extension/package.json b/experimental/users/acmcarther/vscode_extension/package.json
new file mode 100644
index 0000000..d9ea690
--- /dev/null
+++ b/experimental/users/acmcarther/vscode_extension/package.json
@@ -0,0 +1,68 @@
+{
+  "name": "bazel-target-copier",
+  "displayName": "Bazel Target Copier",
+  "description": "Copy Bazel target labels for files",
+  "version": "0.0.1",
+  "engines": {
+    "vscode": "^1.85.0"
+  },
+  "categories": [
+    "Other"
+  ],
+  "activationEvents": [],
+  "main": "./out/extension.js",
+  "contributes": {
+    "commands": [
+      {
+        "command": "bazel-target-copier.copyTarget",
+        "title": "Copy Bazel Target"
+      },
+      {
+        "command": "bazel-target-copier.copyRuleTarget",
+        "title": "Copy Build Target"
+      },
+      {
+        "command": "bazel-target-copier.openInSourcebot",
+        "title": "Open in Sourcebot"
+      }
+    ],
+    "menus": {
+      "explorer/context": [
+        {
+          "command": "bazel-target-copier.copyTarget",
+          "group": "7_modification",
+          "when": "resourceScheme == file"
+        },
+        {
+          "command": "bazel-target-copier.openInSourcebot",
+          "group": "7_modification",
+          "when": "resourceScheme == file"
+        }
+      ],
+      "editor/context": [
+        {
+          "command": "bazel-target-copier.copyRuleTarget",
+          "group": "7_modification",
+          "when": "resourceFilename =~ /(BUILD|BUILD\\.bazel)$/"
+        }
+      ],
+      "editor/title/context": [
+        {
+          "command": "bazel-target-copier.copyTarget",
+          "group": "7_modification",
+          "when": "resourceScheme == file"
+        },
+        {
+          "command": "bazel-target-copier.openInSourcebot",
+          "group": "7_modification",
+          "when": "resourceScheme == file"
+        }
+      ]
+    }
+  },
+  "scripts": {
+    "vscode:prepublish": "echo 'Skipping prepublish (built with Bazel)'",
+    "compile": "tsc -p ./",
+    "watch": "tsc -watch -p ./"
+  }
+}
\ No newline at end of file
diff --git a/experimental/users/acmcarther/vscode_extension/src/extension.ts b/experimental/users/acmcarther/vscode_extension/src/extension.ts
new file mode 100644
index 0000000..a6f4646
--- /dev/null
+++ b/experimental/users/acmcarther/vscode_extension/src/extension.ts
@@ -0,0 +1,228 @@
+import * as vscode from 'vscode';
+import * as path from 'path';
+import * as fs from 'fs';
+import * as cp from 'child_process';
+import * as util from 'util';
+
+const exec = util.promisify(cp.exec);
+const MAX_BUFFER = 1024 * 1024; // 1MB buffer for bazel output
+
+export function activate(context: vscode.ExtensionContext) {
+    let copyTargetCmd = vscode.commands.registerCommand('bazel-target-copier.copyTarget', async (uri: vscode.Uri) => {
+        if (!uri || uri.scheme !== 'file') {
+            const editor = vscode.window.activeTextEditor;
+            if (editor) {
+                uri = editor.document.uri;
+            } else {
+                vscode.window.showErrorMessage('No file selected');
+                return;
+            }
+        }
+
+        try {
+            const label = await findBazelTarget(uri.fsPath);
+            if (label) {
+                await vscode.env.clipboard.writeText(label);
+                vscode.window.setStatusBarMessage(`Copied Bazel target: ${label}`, 3000);
+            } else {
+                vscode.window.showWarningMessage('Could not determine Bazel target');
+            }
+        } catch (err: unknown) {
+            vscode.window.showErrorMessage(`Error finding Bazel target: ${getErrorMessage(err)}`);
+        }
+    });
+
+    let copyRuleTargetCmd = vscode.commands.registerCommand('bazel-target-copier.copyRuleTarget', async () => {
+        const editor = vscode.window.activeTextEditor;
+        if (!editor) {
+            return;
+        }
+
+        const document = editor.document;
+        const position = editor.selection.active;
+        const lineText = document.lineAt(position.line).text;
+
+        // Regex to find 'name = "target_name"'
+        // Matches: name = "foo", name="foo"
+        const nameRegex = /name\s*=\s*"([^"]+)"/;
+        const match = nameRegex.exec(lineText);
+
+        if (!match) {
+            vscode.window.showWarningMessage('No build target name found on this line.');
+            return;
+        }
+
+        const targetName = match[1];
+        const filePath = document.uri.fsPath;
+
+        try {
+            const label = await getPackageLabel(filePath, targetName);
+            if (label) {
+                await vscode.env.clipboard.writeText(label);
+                vscode.window.setStatusBarMessage(`Copied Build target: ${label}`, 3000);
+            }
+        } catch (err: unknown) {
+             vscode.window.showErrorMessage(`Error determining package label: ${getErrorMessage(err)}`);
+        }
+    });
+
+    context.subscriptions.push(copyTargetCmd);
+    context.subscriptions.push(copyRuleTargetCmd);
+
+    let openInSourcebotCmd = vscode.commands.registerCommand('bazel-target-copier.openInSourcebot', async (uri: vscode.Uri) => {
+        if (!uri || uri.scheme !== 'file') {
+            const editor = vscode.window.activeTextEditor;
+            if (editor) {
+                uri = editor.document.uri;
+            } else {
+                vscode.window.showErrorMessage('No file selected');
+                return;
+            }
+        }
+
+        try {
+            await openInSourcebot(uri.fsPath);
+        } catch (err: unknown) {
+            vscode.window.showErrorMessage(`Error opening in Sourcebot: ${getErrorMessage(err)}`);
+        }
+    });
+    context.subscriptions.push(openInSourcebotCmd);
+}
+
+async function openInSourcebot(filePath: string): Promise<void> {
+    const workspaceRootDir = await findWorkspaceRoot(path.dirname(filePath));
+    if (!workspaceRootDir) {
+        throw new Error('Not in a Bazel workspace');
+    }
+
+    const relativePath = normalizePath(path.relative(workspaceRootDir, filePath));
+    const sourcebotUrl = `https://sourcebot.csbx.dev/~/browse/forgejo.csbx.dev/acmcarther/yesod@HEAD/-/blob/${relativePath}`;
+
+    await vscode.env.openExternal(vscode.Uri.parse(sourcebotUrl));
+}
+
+async function getPackageLabel(filePath: string, targetName: string): Promise<string> {
+    const workspaceRootDir = await findWorkspaceRoot(path.dirname(filePath));
+    if (!workspaceRootDir) {
+        throw new Error('Not in a Bazel workspace');
+    }
+    
+    // filePath is the BUILD file itself, so its directory is the package directory
+    const pkgDir = path.dirname(filePath);
+    const pkgRelPath = normalizePath(path.relative(workspaceRootDir, pkgDir));
+    
+    return `//${pkgRelPath}:${targetName}`;
+}
+
+async function findBazelTarget(filePath: string): Promise<string | null> {
+    const workspaceRootDir = await findWorkspaceRoot(path.dirname(filePath));
+    if (!workspaceRootDir) {
+        throw new Error('Not in a Bazel workspace');
+    }
+
+    const buildFileDir = await findBuildFileDir(path.dirname(filePath), workspaceRootDir);
+    if (!buildFileDir) {
+         throw new Error('No BUILD file found in parent directories');
+    }
+    
+    const pkgRelPath = normalizePath(path.relative(workspaceRootDir, buildFileDir));
+    const pkgLabelScope = `//${pkgRelPath}:all`;
+    
+    // The file label for the query.
+    // It can be identified by //pkg:rel/path/to/file (relative to the package BUILD file)
+    const fileRelToPkg = normalizePath(path.relative(buildFileDir, filePath));
+    const fileLabelForQuery = `//${pkgRelPath}:${fileRelToPkg}`;
+
+    // Query strategy:
+    // We want to find which target(s) include this file.
+    // 'rdeps(scope, file, 1)' finds rules in 'scope' that depend on 'file' with depth 1.
+    // This effectively finds the rule that consumes the file (e.g., in 'srcs').
+    const query = `rdeps(${pkgLabelScope}, ${fileLabelForQuery}, 1)`;
+    
+    try {
+        const { stdout } = await exec(`bazel query "${query}"`, { 
+            cwd: workspaceRootDir,
+            maxBuffer: MAX_BUFFER 
+        });
+        const lines = stdout.trim().split('\n');
+        
+        // The query result includes the file itself (as it depends on itself in graph terms).
+        // Filter it out to find the actual rule.
+        const targets = lines.filter(line => line.trim() !== fileLabelForQuery);
+        
+        if (targets.length > 0) {
+            return targets[0].trim();
+        }
+        
+        return null;
+    } catch (error: unknown) {
+        console.error('Bazel query failed:', error);
+        // Sometimes rdeps fails if the file is not part of the graph yet.
+        throw new Error(`Bazel query failed: ${getErrorMessage(error)}`);
+    }
+}
+
+async function findWorkspaceRoot(startDir: string): Promise<string | null> {
+    return findUpwards(startDir, async (dir) => {
+        return (await fileExists(path.join(dir, 'MODULE.bazel'))) || 
+               (await fileExists(path.join(dir, 'WORKSPACE'))) || 
+               (await fileExists(path.join(dir, 'WORKSPACE.bazel')));
+    });
+}
+
+async function findBuildFileDir(startDir: string, stopDir: string): Promise<string | null> {
+    return findUpwards(startDir, async (dir) => {
+        return (await fileExists(path.join(dir, 'BUILD'))) || 
+               (await fileExists(path.join(dir, 'BUILD.bazel')));
+    }, stopDir);
+}
+
+async function findUpwards(
+    startDir: string, 
+    predicate: (dir: string) => Promise<boolean>, 
+    stopDir?: string
+): Promise<string | null> {
+    let currentDir = startDir;
+    while (true) {
+        if (await predicate(currentDir)) {
+            return currentDir;
+        }
+        
+        if (stopDir && currentDir === stopDir) {
+            return null;
+        }
+
+        const parentDir = path.dirname(currentDir);
+        if (parentDir === currentDir) {
+            // Reached root
+            return null;
+        }
+        // If we somehow went past stopDir due to path shenanigans
+        if (stopDir && currentDir.length < stopDir.length) {
+             return null;
+        }
+        currentDir = parentDir;
+    }
+}
+
+function normalizePath(p: string): string {
+    return p.split(path.sep).join('/');
+}
+
+async function fileExists(p: string): Promise<boolean> {
+    try {
+        await fs.promises.access(p);
+        return true;
+    } catch {
+        return false;
+    }
+}
+
+function getErrorMessage(error: unknown): string {
+    if (error instanceof Error) {
+        return error.message;
+    }
+    return String(error);
+}
+
+export function deactivate() {}
\ No newline at end of file
diff --git a/experimental/users/acmcarther/vscode_extension/tsconfig.json b/experimental/users/acmcarther/vscode_extension/tsconfig.json
new file mode 100644
index 0000000..5b1c26d
--- /dev/null
+++ b/experimental/users/acmcarther/vscode_extension/tsconfig.json
@@ -0,0 +1,21 @@
+{
+  "compilerOptions": {
+    "module": "commonjs",
+    "target": "es2020",
+    "outDir": "out",
+    "lib": [
+      "es2020"
+    ],
+    "sourceMap": true,
+    "rootDir": "src",
+    "strict": true,
+    "typeRoots": [
+      "../../../../node_modules/@types",
+      "./node_modules/@types"
+    ]
+  },
+  "exclude": [
+    "node_modules",
+    ".vscode-test"
+  ]
+}
\ No newline at end of file
diff --git a/experimental/users/acmcarther/web_demo/BUILD.bazel b/experimental/users/acmcarther/web_demo/BUILD.bazel
new file mode 100644
index 0000000..e69de29
diff --git a/experimental/users/acmcarther/web_demo/backend/BUILD.bazel b/experimental/users/acmcarther/web_demo/backend/BUILD.bazel
new file mode 100644
index 0000000..24570b2
--- /dev/null
+++ b/experimental/users/acmcarther/web_demo/backend/BUILD.bazel
@@ -0,0 +1,41 @@
+load("@rules_go//go:def.bzl", "go_binary", "go_library", "go_test")
+load("@rules_pkg//:pkg.bzl", "pkg_tar")
+
+# Target to package the web assets into a tarball for deployment.
+# This ideally should be in the frontend/BUILD.bazel but
+# it seems hard to embed if it's not located here.
+pkg_tar(
+    name = "bundle_tar",
+    srcs = [
+        "//experimental/users/acmcarther/web_demo/frontend:bundle.css",
+        "//experimental/users/acmcarther/web_demo/frontend:bundle.js",
+        "//experimental/users/acmcarther/web_demo/frontend:src/index.html",
+    ],
+    out = "bundle_tar.tar",
+    package_dir = "dist",
+    visibility = ["//visibility:public"],
+)
+
+go_library(
+    name = "backend_lib",
+    embedsrcs = ["bundle_tar.tar"],
+    srcs = ["main.go"],
+    importpath = "forgejo.csbx.dev/acmcarther/yesod/experimental/users/acmcarther/web_demo/backend",
+    visibility = ["//visibility:private"],
+    deps = [
+        "@com_github_gorilla_mux//:mux",
+        "@com_github_mholt_archiver_v3//:archiver",
+    ],
+)
+
+go_binary(
+    name = "backend",
+    embed = [":backend_lib"],
+    visibility = ["//visibility:public"],
+)
+
+go_test(
+    name = "backend_test",
+    srcs = ["main_test.go"],
+    embed = [":backend_lib"],
+)
diff --git a/experimental/users/acmcarther/web_demo/backend/main.go b/experimental/users/acmcarther/web_demo/backend/main.go
new file mode 100644
index 0000000..5f3132d
--- /dev/null
+++ b/experimental/users/acmcarther/web_demo/backend/main.go
@@ -0,0 +1,192 @@
+package main
+
+import (
+	"embed"
+	"encoding/json"
+	"errors"
+	"fmt"
+	"io"
+	"log"
+	"net/http"
+	"os"
+	"path/filepath"
+	"strings"
+	"sync"
+	"time"
+
+	"github.com/gorilla/mux"
+	"github.com/mholt/archiver/v3"
+)
+
+//go:embed bundle_tar.tar
+var frontendBundle embed.FS
+
+var projectRoot = func() string {
+	wd, err := os.Getwd()
+	if err != nil {
+		log.Fatalf("Failed to get working directory: %v", err)
+	}
+	return wd
+}()
+
+// Todo represents a task in our list
+type Todo struct {
+	ID        string `json:"id"`
+	Text      string `json:"text"`
+	Completed bool   `json:"completed"`
+}
+
+// TodoStore manages a thread-safe list of todos
+type TodoStore struct {
+	mu    sync.Mutex
+	todos []Todo
+}
+
+func NewTodoStore() *TodoStore {
+	return &TodoStore{
+		todos: []Todo{},
+	}
+}
+
+func (s *TodoStore) List() []Todo {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	// Return a copy to avoid race conditions if caller modifies the slice
+	list := make([]Todo, len(s.todos))
+	copy(list, s.todos)
+	return list
+}
+
+func (s *TodoStore) Add(text string) Todo {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	t := Todo{
+		ID:        fmt.Sprintf("%d", time.Now().UnixNano()),
+		Text:      text,
+		Completed: false,
+	}
+	s.todos = append(s.todos, t)
+	return t
+}
+
+func (s *TodoStore) Update(id string, update Todo) (Todo, error) {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	for i, t := range s.todos {
+		if t.ID == id {
+			s.todos[i].Completed = update.Completed
+			s.todos[i].Text = update.Text
+			return s.todos[i], nil
+		}
+	}
+	return Todo{}, errors.New("not found")
+}
+
+func (s *TodoStore) Delete(id string) error {
+	s.mu.Lock()
+	defer s.mu.Unlock()
+	for i, t := range s.todos {
+		if t.ID == id {
+			s.todos = append(s.todos[:i], s.todos[i+1:]...)
+			return nil
+		}
+	}
+	return errors.New("not found")
+}
+
+func main() {
+	log.Println("Starting server...")
+
+	// Create a temporary directory to extract the frontend bundle
+	tmpDir, err := os.MkdirTemp("", "frontend")
+	if err != nil {
+		log.Fatal("Failed to create temp dir: ", err)
+	}
+	defer os.RemoveAll(tmpDir)
+
+	// Materialize the tarball from our binary for extraction
+	f, err := frontendBundle.Open("bundle_tar.tar")
+	if err != nil {
+		log.Fatal("Failed to open frontend bundle: ", err)
+	}
+	defer f.Close()
+	bundleFile := filepath.Join(tmpDir, "bundle.tar")
+	out, err := os.Create(bundleFile)
+	if err != nil {
+		log.Fatal("Failed to create bundle file: ", err)
+	}
+	defer out.Close()
+	if _, err := io.Copy(out, f); err != nil {
+		log.Fatal("Failed to copy frontend bundle: ", err)
+	}
+
+	// Extract the tarball
+	err = archiver.Unarchive(bundleFile, tmpDir)
+	if err != nil {
+		log.Printf("Failed to unarchive frontend bundle: %v", err)
+		os.Exit(1)
+	}
+
+	store := NewTodoStore()
+	r := mux.NewRouter()
+
+	// API routes
+	api := r.PathPrefix("/api").Subrouter()
+	api.HandleFunc("/todos", func(w http.ResponseWriter, r *http.Request) {
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(store.List())
+	}).Methods("GET")
+
+	api.HandleFunc("/todos", func(w http.ResponseWriter, r *http.Request) {
+		var req struct {
+			Text string `json:"text"`
+		}
+		if err := json.NewDecoder(r.Body).Decode(&req); err != nil {
+			http.Error(w, err.Error(), http.StatusBadRequest)
+			return
+		}
+		t := store.Add(req.Text)
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(t)
+	}).Methods("POST")
+
+	api.HandleFunc("/todos/{id}", func(w http.ResponseWriter, r *http.Request) {
+		vars := mux.Vars(r)
+		var update Todo
+		if err := json.NewDecoder(r.Body).Decode(&update); err != nil {
+			http.Error(w, err.Error(), http.StatusBadRequest)
+			return
+		}
+		updated, err := store.Update(vars["id"], update)
+		if err != nil {
+			http.Error(w, "Todo not found", http.StatusNotFound)
+			return
+		}
+		w.Header().Set("Content-Type", "application/json")
+		json.NewEncoder(w).Encode(updated)
+	}).Methods("PUT")
+
+	api.HandleFunc("/todos/{id}", func(w http.ResponseWriter, r *http.Request) {
+		vars := mux.Vars(r)
+		if err := store.Delete(vars["id"]); err != nil {
+			http.Error(w, "Todo not found", http.StatusNotFound)
+			return
+		}
+		w.WriteHeader(http.StatusNoContent)
+	}).Methods("DELETE")
+
+	// Serve frontend files
+	fs := http.FileServer(http.Dir(filepath.Join(tmpDir, "dist")))
+	r.PathPrefix("/").Handler(http.HandlerFunc(func(w http.ResponseWriter, r *http.Request) {
+		if strings.HasSuffix(r.URL.Path, ".js") {
+			w.Header().Set("Content-Type", "application/javascript")
+		}
+		fs.ServeHTTP(w, r)
+	}))
+
+	log.Println("http server started on :8080")
+	err = http.ListenAndServe(":8080", r)
+	if err != nil {
+		log.Fatal("ListenAndServe: ", err)
+	}
+}
diff --git a/experimental/users/acmcarther/web_demo/backend/main_test.go b/experimental/users/acmcarther/web_demo/backend/main_test.go
new file mode 100644
index 0000000..9f3273e
--- /dev/null
+++ b/experimental/users/acmcarther/web_demo/backend/main_test.go
@@ -0,0 +1,57 @@
+package main
+
+import (
+	"testing"
+)
+
+func TestTodoStore(t *testing.T) {
+	store := NewTodoStore()
+
+	// 1. Test List (Empty)
+	if len(store.List()) != 0 {
+		t.Errorf("Expected empty list, got %d items", len(store.List()))
+	}
+
+	// 2. Test Add
+	todo := store.Add("Buy milk")
+	if todo.Text != "Buy milk" {
+		t.Errorf("Expected text 'Buy milk', got '%s'", todo.Text)
+	}
+	if todo.ID == "" {
+		t.Error("Expected ID to be generated")
+	}
+
+	// 3. Test List (After Add)
+	list := store.List()
+	if len(list) != 1 {
+		t.Errorf("Expected 1 item, got %d", len(list))
+	}
+	if list[0].Text != "Buy milk" {
+		t.Errorf("Expected item text 'Buy milk', got '%s'", list[0].Text)
+	}
+
+	// 4. Test Update
+	update := Todo{
+		Text:      "Buy organic milk",
+		Completed: true,
+	}
+	updated, err := store.Update(todo.ID, update)
+	if err != nil {
+		t.Errorf("Update failed: %v", err)
+	}
+	if updated.Text != "Buy organic milk" {
+		t.Errorf("Expected updated text, got '%s'", updated.Text)
+	}
+	if !updated.Completed {
+		t.Error("Expected completed to be true")
+	}
+
+	// 5. Test Delete
+	err = store.Delete(todo.ID)
+	if err != nil {
+		t.Errorf("Delete failed: %v", err)
+	}
+	if len(store.List()) != 0 {
+		t.Errorf("Expected empty list after delete, got %d", len(store.List()))
+	}
+}
diff --git a/experimental/users/acmcarther/web_demo/frontend/BUILD.bazel b/experimental/users/acmcarther/web_demo/frontend/BUILD.bazel
new file mode 100644
index 0000000..d9f5252
--- /dev/null
+++ b/experimental/users/acmcarther/web_demo/frontend/BUILD.bazel
@@ -0,0 +1,65 @@
+load("@aspect_rules_esbuild//esbuild:defs.bzl", "esbuild")
+load("@aspect_rules_jest//jest:defs.bzl", "jest_test")
+load("@rules_pkg//pkg:tar.bzl", "pkg_tar")
+
+package(default_visibility = ["//experimental/users/acmcarther/web_demo:__subpackages__"])
+
+exports_files(["src/index.html"])
+
+# Target to bundle the JavaScript/TypeScript source files.
+esbuild(
+    name = "bundle",
+    # Explicitly list source files for robustness.
+    srcs = [
+        "src/App.tsx",
+        "src/components/AddTodoForm.tsx",
+        "src/components/TodoItem.tsx",
+        "src/hooks/useTodos.ts",
+        "src/index.tsx",
+        "src/theme.css",
+    ],
+    entry_point = "src/index.tsx",
+    output = "bundle.js",
+    output_css = "bundle.css",
+    deps = [
+        "//:node_modules/@types/react",
+        "//:node_modules/@types/react-dom",
+        "//:node_modules/bootstrap",
+        "//:node_modules/react",
+        "//:node_modules/react-dom",
+        "//:node_modules/react-markdown",
+    ],
+)
+
+pkg_tar(
+    name = "bundle_tar",
+    srcs = [
+        "src/index.html",
+        ":bundle.css",
+        ":bundle.js",
+    ],
+    package_dir = "dist",
+)
+
+jest_test(
+    name = "test",
+    config = "jest.config.js",
+    data = [
+        "src/App.tsx",
+        "src/components/AddTodoForm.tsx",
+        "src/components/TodoItem.test.tsx",
+        "src/components/TodoItem.tsx",
+        "src/hooks/useTodos.ts",
+        "//:node_modules/@testing-library/jest-dom",
+        "//:node_modules/@testing-library/react",
+        "//:node_modules/@testing-library/user-event",
+        "//:node_modules/@types/jest",
+        "//:node_modules/@types/react",
+        "//:node_modules/@types/react-dom",
+        "//:node_modules/jest-environment-jsdom",
+        "//:node_modules/react",
+        "//:node_modules/react-dom",
+        "//:node_modules/ts-jest",
+    ],
+    node_modules = "//:node_modules",
+)
diff --git a/experimental/users/acmcarther/web_demo/frontend/jest.config.js b/experimental/users/acmcarther/web_demo/frontend/jest.config.js
new file mode 100644
index 0000000..0d73e7b
--- /dev/null
+++ b/experimental/users/acmcarther/web_demo/frontend/jest.config.js
@@ -0,0 +1,12 @@
+module.exports = {
+  testEnvironment: 'jsdom',
+  transform: {
+    '^.+\.tsx?$': ['ts-jest', {
+      tsconfig: {
+        jsx: 'react-jsx',
+        esModuleInterop: true,
+      }
+    }],
+  },
+  moduleFileExtensions: ['ts', 'tsx', 'js', 'jsx', 'json', 'node'],
+};
\ No newline at end of file
diff --git a/experimental/users/acmcarther/web_demo/frontend/package.json b/experimental/users/acmcarther/web_demo/frontend/package.json
new file mode 100644
index 0000000..c64e5a0
--- /dev/null
+++ b/experimental/users/acmcarther/web_demo/frontend/package.json
@@ -0,0 +1,19 @@
+{
+  "name": "web-demo",
+  "version": "0.1.0",
+  "private": true,
+  "dependencies": {
+    "@types/node": "^20.11.24",
+    "@types/react": "^18.2.61",
+    "@types/react-dom": "^18.2.19",
+    "bootstrap": "^5.3.3",
+    "react": "^18.2.0",
+    "react-dom": "^18.2.0",
+    "react-markdown": "^9.0.1",
+    "typescript": "^5.3.3"
+  },
+  "devDependencies": {
+    "@bazel/typescript": "^5.8.1",
+    "esbuild": "^0.20.1"
+  }
+}
\ No newline at end of file
diff --git a/experimental/users/acmcarther/web_demo/frontend/src/App.tsx b/experimental/users/acmcarther/web_demo/frontend/src/App.tsx
new file mode 100644
index 0000000..36b24be
--- /dev/null
+++ b/experimental/users/acmcarther/web_demo/frontend/src/App.tsx
@@ -0,0 +1,42 @@
+import React from 'react';
+import { useTodos } from './hooks/useTodos';
+import { AddTodoForm } from './components/AddTodoForm';
+import { TodoItem } from './components/TodoItem';
+
+const App = () => {
+    const { todos, loading, addTodo, toggleTodo, deleteTodo } = useTodos();
+
+    return (
+        <div className="d-flex flex-column h-100 bg-light">
+            <div className="container py-5" style={{ maxWidth: "600px" }}>
+                <h1 className="mb-4 text-center">Todo App</h1>
+                
+                <div className="card shadow-sm mb-4">
+                    <div className="card-body">
+                        <AddTodoForm onAdd={addTodo} />
+                    </div>
+                </div>
+
+                <div className="card shadow-sm">
+                    <div className="list-group list-group-flush">
+                        {todos.length === 0 && !loading && (
+                            <div className="list-group-item text-center text-muted py-4">
+                                No todos yet. Add one above!
+                            </div>
+                        )}
+                        {todos.map(todo => (
+                            <TodoItem 
+                                key={todo.id} 
+                                todo={todo} 
+                                onToggle={toggleTodo} 
+                                onDelete={deleteTodo} 
+                            />
+                        ))}
+                    </div>
+                </div>
+            </div>
+        </div>
+    );
+};
+
+export default App;
diff --git a/experimental/users/acmcarther/web_demo/frontend/src/components/AddTodoForm.tsx b/experimental/users/acmcarther/web_demo/frontend/src/components/AddTodoForm.tsx
new file mode 100644
index 0000000..5b58ad4
--- /dev/null
+++ b/experimental/users/acmcarther/web_demo/frontend/src/components/AddTodoForm.tsx
@@ -0,0 +1,29 @@
+import React, { useState } from 'react';
+
+interface AddTodoFormProps {
+    onAdd: (text: string) => void;
+}
+
+export const AddTodoForm: React.FC<AddTodoFormProps> = ({ onAdd }) => {
+    const [text, setText] = useState("");
+
+    const handleSubmit = (e: React.FormEvent) => {
+        e.preventDefault();
+        if (!text.trim()) return;
+        onAdd(text);
+        setText("");
+    };
+
+    return (
+        <form onSubmit={handleSubmit} className="d-flex gap-2">
+            <input
+                type="text"
+                className="form-control"
+                placeholder="What needs to be done?"
+                value={text}
+                onChange={(e) => setText(e.target.value)}
+            />
+            <button type="submit" className="btn btn-primary">Add</button>
+        </form>
+    );
+};
diff --git a/experimental/users/acmcarther/web_demo/frontend/src/components/TodoItem.test.tsx b/experimental/users/acmcarther/web_demo/frontend/src/components/TodoItem.test.tsx
new file mode 100644
index 0000000..4e970bd
--- /dev/null
+++ b/experimental/users/acmcarther/web_demo/frontend/src/components/TodoItem.test.tsx
@@ -0,0 +1,68 @@
+import React from 'react';
+import { render, screen, fireEvent } from '@testing-library/react';
+import '@testing-library/jest-dom';
+import { TodoItem } from './TodoItem';
+
+// Mock Todo data
+const mockTodo = {
+    id: '123',
+    text: 'Test Todo',
+    completed: false,
+};
+
+describe('TodoItem', () => {
+    it('renders the todo text', () => {
+        render(
+            <TodoItem 
+                todo={mockTodo} 
+                onToggle={() => {}} 
+                onDelete={() => {}} 
+            />
+        );
+        expect(screen.getByText('Test Todo')).toBeInTheDocument();
+    });
+
+    it('calls onToggle when checkbox is clicked', () => {
+        const handleToggle = jest.fn();
+        render(
+            <TodoItem 
+                todo={mockTodo} 
+                onToggle={handleToggle} 
+                onDelete={() => {}} 
+            />
+        );
+        
+        const checkbox = screen.getByRole('checkbox');
+        fireEvent.click(checkbox);
+        expect(handleToggle).toHaveBeenCalledWith(mockTodo);
+    });
+
+    it('calls onDelete when delete button is clicked', () => {
+        const handleDelete = jest.fn();
+        render(
+            <TodoItem 
+                todo={mockTodo} 
+                onToggle={() => {}} 
+                onDelete={handleDelete} 
+            />
+        );
+        
+        const button = screen.getByText('Delete');
+        fireEvent.click(button);
+        expect(handleDelete).toHaveBeenCalledWith('123');
+    });
+
+    it('shows completed style when completed', () => {
+        const completedTodo = { ...mockTodo, completed: true };
+        render(
+            <TodoItem 
+                todo={completedTodo} 
+                onToggle={() => {}} 
+                onDelete={() => {}} 
+            />
+        );
+        
+        const textElement = screen.getByText('Test Todo');
+        expect(textElement).toHaveStyle('text-decoration: line-through');
+    });
+});
diff --git a/experimental/users/acmcarther/web_demo/frontend/src/components/TodoItem.tsx b/experimental/users/acmcarther/web_demo/frontend/src/components/TodoItem.tsx
new file mode 100644
index 0000000..46a80df
--- /dev/null
+++ b/experimental/users/acmcarther/web_demo/frontend/src/components/TodoItem.tsx
@@ -0,0 +1,36 @@
+import React from 'react';
+import { Todo } from '../hooks/useTodos';
+
+interface TodoItemProps {
+    todo: Todo;
+    onToggle: (todo: Todo) => void;
+    onDelete: (id: string) => void;
+}
+
+export const TodoItem: React.FC<TodoItemProps> = ({ todo, onToggle, onDelete }) => {
+    return (
+        <div className="list-group-item d-flex align-items-center justify-content-between">
+            <div className="d-flex align-items-center gap-3">
+                <input
+                    className="form-check-input mt-0"
+                    type="checkbox"
+                    checked={todo.completed}
+                    onChange={() => onToggle(todo)}
+                    style={{ cursor: "pointer", width: "1.25em", height: "1.25em" }}
+                />
+                <span style={{ 
+                    textDecoration: todo.completed ? 'line-through' : 'none',
+                    color: todo.completed ? '#6c757d' : 'inherit'
+                }}>
+                    {todo.text}
+                </span>
+            </div>
+            <button 
+                className="btn btn-outline-danger btn-sm"
+                onClick={() => onDelete(todo.id)}
+            >
+                Delete
+            </button>
+        </div>
+    );
+};
diff --git a/experimental/users/acmcarther/web_demo/frontend/src/hooks/useTodos.ts b/experimental/users/acmcarther/web_demo/frontend/src/hooks/useTodos.ts
new file mode 100644
index 0000000..ed435e2
--- /dev/null
+++ b/experimental/users/acmcarther/web_demo/frontend/src/hooks/useTodos.ts
@@ -0,0 +1,77 @@
+import { useState, useEffect } from 'react';
+
+export interface Todo {
+    id: string;
+    text: string;
+    completed: boolean;
+}
+
+export const useTodos = () => {
+    const [todos, setTodos] = useState<Todo[]>([]);
+    const [loading, setLoading] = useState(true);
+
+    useEffect(() => {
+        fetchTodos();
+    }, []);
+
+    const fetchTodos = async () => {
+        try {
+            const res = await fetch('/api/todos');
+            if (res.ok) {
+                const data = await res.json();
+                setTodos(data || []);
+            }
+        } catch (err) {
+            console.error("Failed to fetch todos", err);
+        } finally {
+            setLoading(false);
+        }
+    };
+
+    const addTodo = async (text: string) => {
+        try {
+            const res = await fetch('/api/todos', {
+                method: 'POST',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify({ text, completed: false }),
+            });
+            if (res.ok) {
+                const newTodo = await res.json();
+                setTodos(prev => [...prev, newTodo]);
+            }
+        } catch (err) {
+            console.error("Failed to add todo", err);
+        }
+    };
+
+    const toggleTodo = async (todo: Todo) => {
+        try {
+            const updated = { ...todo, completed: !todo.completed };
+            const res = await fetch(`/api/todos/${todo.id}`, {
+                method: 'PUT',
+                headers: { 'Content-Type': 'application/json' },
+                body: JSON.stringify(updated),
+            });
+            if (res.ok) {
+                setTodos(prev => prev.map(t => t.id === todo.id ? updated : t));
+            }
+        } catch (err) {
+            console.error("Failed to update todo", err);
+        }
+    };
+
+    const deleteTodo = async (id: string) => {
+        try {
+            const res = await fetch(`/api/todos/${id}`, {
+                method: 'DELETE',
+            });
+            if (res.ok) {
+                setTodos(prev => prev.filter(t => t.id !== id));
+            }
+        } catch (err) {
+            console.error("Failed to delete todo", err);
+        }
+    };
+
+    return { todos, loading, addTodo, toggleTodo, deleteTodo };
+};
diff --git a/experimental/users/acmcarther/web_demo/frontend/src/index.html b/experimental/users/acmcarther/web_demo/frontend/src/index.html
new file mode 100644
index 0000000..91bab68
--- /dev/null
+++ b/experimental/users/acmcarther/web_demo/frontend/src/index.html
@@ -0,0 +1,13 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <meta charset="utf-8" />
+  <title>Web Demo</title>
+  <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/bootstrap@5.3.3/dist/css/bootstrap.min.css">
+  <link rel="stylesheet" href="bundle.css">
+</head>
+<body>
+  <div id="root"></div>
+  <script src="bundle.js"></script>
+</body>
+</html>
\ No newline at end of file
diff --git a/experimental/users/acmcarther/web_demo/frontend/src/index.tsx b/experimental/users/acmcarther/web_demo/frontend/src/index.tsx
new file mode 100644
index 0000000..f52445e
--- /dev/null
+++ b/experimental/users/acmcarther/web_demo/frontend/src/index.tsx
@@ -0,0 +1,14 @@
+import React from 'react';
+import ReactDOM from 'react-dom/client';
+import App from './App';
+import 'bootstrap/dist/css/bootstrap.min.css';
+import './theme.css';
+
+const root = ReactDOM.createRoot(
+  document.getElementById('root') as HTMLElement
+);
+root.render(
+  <React.StrictMode>
+    <App />
+  </React.StrictMode>
+);
diff --git a/experimental/users/acmcarther/web_demo/frontend/src/theme.css b/experimental/users/acmcarther/web_demo/frontend/src/theme.css
new file mode 100644
index 0000000..43be5d1
--- /dev/null
+++ b/experimental/users/acmcarther/web_demo/frontend/src/theme.css
@@ -0,0 +1,22 @@
+:root {
+    --bs-body-bg: #f8f9fa;
+    --bs-body-color: #212529;
+    --bs-border-color: #dee2e6;
+    --bs-tertiary-bg: #e9ecef;
+}
+
+[data-bs-theme="dark"] {
+    --bs-body-bg: #212529;
+    --bs-body-color: #f8f9fa;
+    --bs-border-color: #495057;
+    --bs-tertiary-bg: #343a40;
+}
+
+body {
+    background-color: var(--bs-body-bg);
+    color: var(--bs-body-color);
+}
+
+main {
+    padding: 1rem;
+}
diff --git a/experimental/users/acmcarther/web_demo/frontend/tsconfig.json b/experimental/users/acmcarther/web_demo/frontend/tsconfig.json
new file mode 100644
index 0000000..c922694
--- /dev/null
+++ b/experimental/users/acmcarther/web_demo/frontend/tsconfig.json
@@ -0,0 +1,15 @@
+{
+  "compilerOptions": {
+    "target": "es2016",
+    "jsx": "react-jsx",
+    "module": "esnext",
+    "moduleResolution": "node",
+    "strict": true,
+    "esModuleInterop": true,
+    "skipLibCheck": true,
+    "forceConsistentCasingInFileNames": true,
+    "outDir": "./dist",
+    "rootDir": "./src"
+  },
+  "include": ["src"]
+}
\ No newline at end of file
diff --git a/homebrew/BUILD.bazel b/homebrew/BUILD.bazel
new file mode 100644
index 0000000..7cd74f0
--- /dev/null
+++ b/homebrew/BUILD.bazel
@@ -0,0 +1,17 @@
+load(":formula.bzl", "homebrew_formula")
+
+homebrew_formula(
+    name = "generate_tts_client_rb",
+    src = "tts-client.rb.tpl",
+    binary = "//experimental/users/acmcarther/llm/tts_grpc:tts_client_go",
+    out = "tts-client.rb",
+    visibility = ["//visibility:public"],
+)
+
+homebrew_formula(
+    name = "generate_litellm_client_rb",
+    src = "litellm-client.rb.tpl",
+    binary = "//experimental/users/acmcarther/llm/litellm_grpc:client_go",
+    out = "litellm-client.rb",
+    visibility = ["//visibility:public"],
+)
\ No newline at end of file
diff --git a/homebrew/README.md b/homebrew/README.md
new file mode 100644
index 0000000..538ac1b
--- /dev/null
+++ b/homebrew/README.md
@@ -0,0 +1,3 @@
+# Homebrew Formulas
+
+This directory contains homebrew formulas materialized from the main monorepo.
\ No newline at end of file
diff --git a/homebrew/formula.bzl b/homebrew/formula.bzl
new file mode 100644
index 0000000..75b8a86
--- /dev/null
+++ b/homebrew/formula.bzl
@@ -0,0 +1,31 @@
+def homebrew_formula(name, src, binary, out, visibility = None):
+    """
+    Generates a Homebrew formula with the SHA256 of the binary injected.
+    
+    Args:
+        name: The name of the rule.
+        src: The template file (.rb.tpl).
+        binary: The binary target to hash.
+        out: The output filename (.rb).
+        visibility: Visibility of the rule.
+    """
+    native.genrule(
+        name = name,
+        srcs = [src, binary],
+        outs = [out],
+        cmd = """
+            TEMPLATE=$(location %s)
+            BINARY=$(location %s)
+            
+            # Calculate SHA256
+            if command -v sha256sum >/dev/null 2>&1; then
+                HASH=$$(sha256sum $$BINARY | cut -d' ' -f1)
+            else
+                HASH=$$(shasum -a 256 $$BINARY | cut -d' ' -f1)
+            fi
+            
+            # Substitute into template
+            sed "s/{SHA256}/$$HASH/g" $$TEMPLATE > $@
+        """ % (src, binary),
+        visibility = visibility,
+    )
\ No newline at end of file
diff --git a/homebrew/litellm-client.rb.tpl b/homebrew/litellm-client.rb.tpl
new file mode 100644
index 0000000..80c303b
--- /dev/null
+++ b/homebrew/litellm-client.rb.tpl
@@ -0,0 +1,16 @@
+class LitellmClient < Formula
+  desc "Internal Litellm Client for CSBX"
+  homepage "https://forgejo.csbx.dev/acmcarther/yesod"
+  version "{VERSION}"
+
+  url "{URL}"
+  sha256 "{SHA256}"
+
+  def install
+    bin.install "litellm-client-darwin-arm64" => "litellm-client"
+  end
+
+  test do
+    system "#{bin}/litellm-client", "--help"
+  end
+end
diff --git a/homebrew/tts-client.rb.tpl b/homebrew/tts-client.rb.tpl
new file mode 100644
index 0000000..cba6c37
--- /dev/null
+++ b/homebrew/tts-client.rb.tpl
@@ -0,0 +1,17 @@
+class TtsClient < Formula
+  desc "Internal TTS Client for CSBX"
+  homepage "https://forgejo.csbx.dev/acmcarther/yesod"
+  version "{VERSION}"
+
+  url "{URL}"
+  sha256 "{SHA256}"
+
+  def install
+    # Rename to just 'tts-client' upon installation
+    bin.install "tts-client-darwin-arm64" => "tts-client"
+  end
+
+  test do
+    system "#{bin}/tts-client", "--help"
+  end
+end
\ No newline at end of file
diff --git a/k8s/README.md b/k8s/README.md
new file mode 100644
index 0000000..ee14679
--- /dev/null
+++ b/k8s/README.md
@@ -0,0 +1,19 @@
+# k8s
+
+This directory contains infrastructure for setting up and deploying software on Kubernetes.
+
+## bootstrap
+
+Contains the Matchbox-based Terraform configuration for setting up the physical machines for the Kubernetes cluster
+
+## container
+
+Contains BUILD rules and related assets for container images built to run on the Kubernetes cluster.
+
+## configs
+
+Contains the jsonnet-based configuration for deploying software on the cluster.
+
+## misc-secrets.sops.yaml
+Some secrets which aren't in k8s.
+
diff --git a/k8s/bootstrap/README.md b/k8s/bootstrap/README.md
new file mode 100644
index 0000000..d774985
--- /dev/null
+++ b/k8s/bootstrap/README.md
@@ -0,0 +1,6 @@
+# bootstrap/
+
+This directory contains bootstrap code for setting up the cluster. This
+primarily consists of configuring a live matchbox instance to serve the correct
+images to the correct MAC addresses such that each MAC address gets its
+corresponding role configured correctly.
\ No newline at end of file
diff --git a/k8s/bootstrap/cluster.tf b/k8s/bootstrap/cluster.tf
new file mode 100644
index 0000000..3b60aa1
--- /dev/null
+++ b/k8s/bootstrap/cluster.tf
@@ -0,0 +1,95 @@
+module "dominion" {
+  # kube: v1.32.3
+  source = "git::https://github.com/poseidon/typhoon//bare-metal/flatcar-linux/kubernetes?ref=4c2c6d5029a51ed6fa04f61e6c7bb0db2ac03679"
+  # bare-metal
+  cluster_name            = "dominion"
+  matchbox_http_endpoint = "http://matchbox.dominion.lan:8080"
+  os_channel              = "flatcar-stable"
+  #os_version              = "4081.2.1"
+  os_version              = "4152.2.2"
+
+  # configuration
+  k8s_domain_name    = "k8s.dominion.lan"
+  ssh_authorized_key = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCpnYmsUDSkhvy1imOLee/3qlySIRUn9kKkTGaet2wjNSQ4n8muFhjMtXI6+qWW0Vv6edY4MLEwegXGbaZA/7yAbSOpPmQ+Z4d0GE1Kns/1OoTt5XhXpr8OhgqPL3S/foqQlf5RXywlqzYJkJL0yk1jg2CguIYVMTE4aJwd0Mt2t25fwzEuDvSGJ41wVWrueKy6EELYXbQ5FMcN/bZLERNLGp4hTsdXdBtSX7vq0VC+qG+EmTTXOt5+DvWu6UkLq8Mb1540Mi3AK7+vsXUTPghIS7BLLrU8bb4QQ0z0IZjI39wXeSegoPRt6y2f0yrBR+S+vQ1qrGB1riYZ6f4ZUzQh acmcarther@gmail.com"
+  cached_install          = "false"
+
+  # machines
+  controllers = [
+    {
+      name = "controller1"
+      #mac    = "b8:ae:ed:7d:c3:56"
+      mac = "94:c6:91:19:c0:2a",
+      domain = "controller1.dominion.lan"
+    }
+  ]
+  workers = [
+    {
+      name = "worker1"
+      mac = "94:c6:91:19:8e:98"
+      domain = "worker1.dominion.lan"
+    },
+    {
+      name = "worker2",
+      #mac = "94:c6:91:19:c0:2a",
+      mac    = "b8:ae:ed:7d:c3:56"
+      domain = "worker2.dominion.lan",
+    },
+  ]
+
+  # set to http only if you cannot chainload to iPXE firmware with https support
+  # (I can't)
+  download_protocol = "http"
+}
+
+# Separate because it has a different install disk
+module "dominion-big-worker-1" {
+  source = "git::https://github.com/poseidon/typhoon//bare-metal/flatcar-linux/kubernetes/worker?ref=4c2c6d5029a51ed6fa04f61e6c7bb0db2ac03679"
+  
+  # bare metal
+  cluster_name            = "dominion"
+  matchbox_http_endpoint = "http://matchbox.dominion.lan:8080"
+  os_channel              = "flatcar-stable"
+  os_version              = "4152.2.1"
+ 
+  # configuration
+
+  name = "big-worker-1"
+  mac = "f4:6b:8c:90:1f:3f"
+  domain = "big-worker-1.dominion.lan"
+  kubeconfig = module.dominion.kubeconfig
+  ssh_authorized_key = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCpnYmsUDSkhvy1imOLee/3qlySIRUn9kKkTGaet2wjNSQ4n8muFhjMtXI6+qWW0Vv6edY4MLEwegXGbaZA/7yAbSOpPmQ+Z4d0GE1Kns/1OoTt5XhXpr8OhgqPL3S/foqQlf5RXywlqzYJkJL0yk1jg2CguIYVMTE4aJwd0Mt2t25fwzEuDvSGJ41wVWrueKy6EELYXbQ5FMcN/bZLERNLGp4hTsdXdBtSX7vq0VC+qG+EmTTXOt5+DvWu6UkLq8Mb1540Mi3AK7+vsXUTPghIS7BLLrU8bb4QQ0z0IZjI39wXeSegoPRt6y2f0yrBR+S+vQ1qrGB1riYZ6f4ZUzQh acmcarther@gmail.com"
+  cached_install          = "false"
+  install_disk = "/dev/nvme0n1"
+  
+  download_protocol = "http"
+}
+
+module "dominion-conscript-1" {
+  source = "git::https://github.com/poseidon/typhoon//bare-metal/flatcar-linux/kubernetes/worker?ref=4c2c6d5029a51ed6fa04f61e6c7bb0db2ac03679"
+
+  # bare metal
+  cluster_name            = "dominion"
+  matchbox_http_endpoint = "http://matchbox.dominion.lan:8080"
+  os_channel              = "flatcar-stable"
+  os_version              = "4152.2.1"
+
+  # configuration
+
+  name = "conscript-1"
+  // "Alex-PC"
+  mac = "08:62:66:7F:5C:8E"
+  domain = "conscript-1.dominion.lan"
+  kubeconfig = module.dominion.kubeconfig
+  ssh_authorized_key = "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCpnYmsUDSkhvy1imOLee/3qlySIRUn9kKkTGaet2wjNSQ4n8muFhjMtXI6+qWW0Vv6edY4MLEwegXGbaZA/7yAbSOpPmQ+Z4d0GE1Kns/1OoTt5XhXpr8OhgqPL3S/foqQlf5RXywlqzYJkJL0yk1jg2CguIYVMTE4aJwd0Mt2t25fwzEuDvSGJ41wVWrueKy6EELYXbQ5FMcN/bZLERNLGp4hTsdXdBtSX7vq0VC+qG+EmTTXOt5+DvWu6UkLq8Mb1540Mi3AK7+vsXUTPghIS7BLLrU8bb4QQ0z0IZjI39wXeSegoPRt6y2f0yrBR+S+vQ1qrGB1riYZ6f4ZUzQh acmcarther@gmail.com"
+  cached_install          = "false"
+  // TODO: Can we use the default?
+  //install_disk = "/dev/nvme0n1"
+
+  download_protocol = "http"
+}
+
+resource "local_file" "kubeconfig-dominion" {
+  content  = module.dominion.kubeconfig-admin
+  #filename = "/home/acmcarther/.kube/configs/dominion-config"
+  filename = "/Users/acmcarther/.kube/configs/dominion-config"
+}
diff --git a/k8s/bootstrap/providers.tf b/k8s/bootstrap/providers.tf
new file mode 100644
index 0000000..bcad6b2
--- /dev/null
+++ b/k8s/bootstrap/providers.tf
@@ -0,0 +1,21 @@
+provider "matchbox" {
+  endpoint    = "192.168.0.101:8081"
+  client_cert = file("~/.matchbox/client.crt")
+  client_key  = file("~/.matchbox/client.key")
+  ca          = file("~/.matchbox/ca.crt")
+}
+
+provider "ct" {}
+
+terraform {
+  required_providers {
+    ct = {
+      source  = "poseidon/ct"
+      version = "0.13.0"
+    }
+    matchbox = {
+      source = "poseidon/matchbox"
+      version = "0.5.2"
+    }
+  }
+}
diff --git a/k8s/configs/BUILD.bazel b/k8s/configs/BUILD.bazel
new file mode 100644
index 0000000..6e83820
--- /dev/null
+++ b/k8s/configs/BUILD.bazel
@@ -0,0 +1,26 @@
+load("@rules_jsonnet//jsonnet:jsonnet.bzl", "jsonnet_library", "jsonnet_to_json", "jsonnet_to_json_test")
+
+jsonnet_library(
+    name = "images",
+    srcs = ["images.libsonnet"],
+    visibility = ["//visibility:public"],
+    deps = [
+    ],
+)
+
+jsonnet_library(
+    name = "base",
+    srcs = ["base.libsonnet"],
+    visibility = ["//visibility:public"],
+    deps = [
+        "@github_com_grafana_jsonnet_libs_tanka_util//:lib",
+    ],
+)
+
+jsonnet_library(
+    name = "k",
+    srcs = ["k.libsonnet"],
+    deps = [
+        "@github_com_jsonnet_libs_k8s_libsonnet_1_29//:lib",
+    ],
+)
diff --git a/k8s/configs/README.md b/k8s/configs/README.md
new file mode 100644
index 0000000..953b3e3
--- /dev/null
+++ b/k8s/configs/README.md
@@ -0,0 +1,116 @@
+# k8s/configs
+
+WARNING: Provisional Readme
+
+This directory contains kubernetes configurations, which are defined in jsonnet and which can also depend upon loaded helm charts.
+
+Manifests are built using custom Tanka-like build rules, as in this example:
+
+```BUILD
+load("@rules_jsonnet//jsonnet:jsonnet.bzl", "jsonnet_to_json")
+load("//tools:tanka.bzl", "tanka_environment")
+
+# Generate a json manifest containing all of the manifests
+jsonnet_to_json(
+    name = "main",
+    src = "main.jsonnet",
+    outs = ["main.json"],
+    data = [
+        # Depend on a helm chart (transitively, in this case)
+        "@helm_coderv2_coder//:chart",
+    ],
+    visibility = ["//visibility:public"],
+    deps = [
+        "//k8s/configs/templates",
+    ],
+)
+
+# Defines three targets
+# - example.show: Prints the list of output entities
+# - example.diff: Diffs the list of entities against the live entities
+# - example.apply: Applies the changes to Kubernetes.
+tanka_environment(
+    name = "example",
+    main = ":main",
+    spec = "spec.json",
+)
+```
+
+## Secret Management with SOPS
+
+We use [SOPS](https://github.com/getsops/sops) to manage secrets in this repository. Encrypted files are checked into version control, and Bazel handles decryption during the build process, keeping secrets in memory or temporary build artifacts (which are not committed).
+
+### Prerequisites
+
+*   **SOPS**: The `sops` binary is automatically managed by Bazel (fetched via `MODULE.bazel`), so you don't strictly need it installed on your system to *build*, but you do need it to *edit* or *create* secrets.
+    *   Install: `brew install sops` (macOS) or download from [GitHub Releases](https://github.com/getsops/sops/releases).
+*   **Encryption Key**: You must have a configured Age key or PGP key that matches the `.sops.yaml` configuration (if one exists at the repo root) or pass the keys explicitly via command line.
+
+### Workflow
+
+1.  **Create/Edit Encrypted File**:
+    Create a file (e.g., `secrets.sops.yaml` or `secrets.sops.json`) and encrypt it.
+    ```bash
+    # Example: Encrypting a new file
+    sops --encrypt --age <your-age-public-key> secrets.json > secrets.sops.json
+    
+    # Example: Editing an existing encrypted file
+    SOPS_AGE_KEY_FILE="./key.txt" sops secrets.sops.json
+    ```
+
+2.  **Define Bazel Target**:
+    In the `BUILD.bazel` file of your environment (e.g., `k8s/configs/environments/media/BUILD.bazel`), use the `sops_decrypt` rule to decrypt the file at build time.
+
+    ```python
+    load("//tools:sops.bzl", "sops_decrypt")
+    load("@rules_jsonnet//jsonnet:jsonnet.bzl", "jsonnet_library")
+
+    # 1. Decrypt the secrets file
+    sops_decrypt(
+        name = "secrets",
+        src = "secrets.sops.yaml", # The encrypted source file
+        out = "secrets.json",      # The decrypted output filename
+    )
+
+    # 2. Wrap it in a jsonnet_library so it can be imported
+    jsonnet_library(
+        name = "secrets_lib",
+        srcs = [":secrets"],
+    )
+    ```
+
+3.  **Use in Jsonnet**:
+    Update your `jsonnet_to_json` target to depend on the library, and import the secrets in your Jsonnet code.
+
+    **BUILD.bazel**:
+    ```python
+    jsonnet_to_json(
+        name = "main",
+        src = "main.jsonnet",
+        deps = [
+            ":secrets_lib",
+            # ... other deps ...
+        ],
+        # ...
+    )
+    ```
+
+    **main.jsonnet**:
+    ```jsonnet
+    local secrets = import "k8s/.../secrets.json";
+
+    {
+        secrets: {
+            examplePostgres: postgres.Secret(postgres.SecretParams{
+                name: "example-postgres",
+                namespace: "example",
+                password: secrets.example_psql_db_pwd,
+            }), 
+        }
+    }
+    ```
+
+### Safety
+
+*   **Do not commit** decrypted files. The `sops_decrypt` rule places files in the `bazel-out` directory, which is ignored by git.
+*   Ensure your `.gitignore` includes `*.json` or specific secret patterns if you are working with them locally outside of Bazel.
diff --git a/k8s/configs/base.libsonnet b/k8s/configs/base.libsonnet
new file mode 100644
index 0000000..60ca160
--- /dev/null
+++ b/k8s/configs/base.libsonnet
@@ -0,0 +1,349 @@
+local baseKube = import "k8s/configs/k.libsonnet";
+
+local tanka = import "tanka-util/main.libsonnet";
+local helm = tanka.helm.new(std.thisFile);
+
+local baseKubeCompat = {
+  _Object(apiVersion, kind, name):: {
+    local this = self,
+    apiVersion: apiVersion,
+    kind: kind,
+    metadata: {
+      name: name,
+      labels: { name: std.join("-", std.split(this.metadata.name, ":")) },
+      annotations: {},
+    },
+  },
+};
+
+local splitThisFilePath = std.split(std.thisFile, "/");
+local workspaceRoot = std.join('/', splitThisFilePath[:std.length(splitThisFilePath)-3]);
+local workspaceRootLength = std.length(workspaceRoot);
+{
+  helm: helm,
+
+  // Returns array of values from given object.  Does not include hidden fields.
+  objectValues(o):: [o[field] for field in std.objectFields(o)],
+
+  asWorkspacePath(fullPath):
+    local isPrefixed = std.startsWith(fullPath,workspaceRoot);
+    if !isPrefixed then error fullPath + "is not prefixed by workspace root \"" + workspaceRoot + "\"" else
+    fullPath[workspaceRootLength+1 :],
+
+  errNeedField(name): error name + " must be defined",
+
+  SimpleFieldStruct(requiredFields): {
+    [requiredField]: $.errNeedField(requiredField)
+    for requiredField in requiredFields
+  },
+  simpleFieldStruct: $.SimpleFieldStruct,
+
+  Context: $.SimpleFieldStruct([
+    "helm"
+  ]),
+
+  NewContext(helm): $.Context {
+    helm: helm
+  },
+
+  List(): {
+    apiVersion: "v1",
+    kind: "List",
+    items_:: {},
+    items: $.objectValues(self.items_),
+  },
+
+  #################
+  # Support utils #
+  #################
+  # For use in SERVICE.metadata.annotations position
+  # TODO(acmcarther): move this into 
+  PrometheusScrapeable(port): {
+    "prometheus.io/scrape": "true",
+    "prometheus.io/port": std.toString(port),
+  },
+
+  NameVal(name, value): {
+    name: name,
+    value: value,
+  },
+
+  SvcUtil: {
+    # For use in SERVICE.spec.ports position
+    TCPServicePort(name, port): {
+      name: name,
+      port: port,
+      protocol: "TCP",
+    },
+
+    # For use in SERVICE.spec.ports position
+    UDPServicePort(name, port): {
+      name: name,
+      port: port,
+      protocol: "UDP",
+    },
+
+    # For use in SERVICE.spec
+    BasicHttpClusterIpSpec(internalPort): {
+      type: "ClusterIP",
+      ports: [
+        $.SvcUtil.TCPServicePort("http", 80) {
+          targetPort: internalPort
+        },
+      ],
+    },
+
+    # For use in SERVICE.spec
+    BasicNodePortSpec(internalPort, nodePort): {
+      type: "NodePort",
+      ports: [
+        $.SvcUtil.TCPServicePort("tcp", internalPort) {
+          targetPort: internalPort,
+          nodePort: nodePort,
+        },
+        $.SvcUtil.UDPServicePort("udp", internalPort) {
+          targetPort: internalPort,
+          nodePort: nodePort,
+        },
+      ],
+    }
+  },
+
+  DeployUtil: {
+    # For use in DEPLOYMENT.spec.template.spec.containers
+    VolumeMount(name, mountPath): {
+      name: name,
+      mountPath: mountPath,
+    },
+
+    # For use in DEPLOYMENT.spec.template.spec.volumes
+    VolumeClaimRef(name, claimName): {
+      name: name,
+      persistentVolumeClaim: {
+        claimName: claimName,
+      },
+    },
+
+    # For use in DEPLOYMENT.spec.template.spec.containers.ports
+    ContainerPort(name, port): {
+      name: name,
+      containerPort: port,
+    },
+    ContainerTCPPort(name, port): {
+      name: name,
+      containerPort: port,
+      protocol: "TCP",
+    },
+
+    # For use in DEPLOYMENT.spec.strategy
+    SimpleRollingUpdate(): {
+      type: "RollingUpdate",
+      rollingUpdate: {
+        maxUnavailable: 1,
+      },
+    },
+
+    # For use in DEPLOYMENT.spec.template.spec.*Probe
+    SimpleProbe(webPort, delaySeconds): {
+      httpGet: {
+        path: "/",
+        port: webPort,
+      },
+      initialDelaySeconds: delaySeconds,
+    },
+  },
+
+  ##########################
+  # Kube object definition #
+  ##########################
+  Namespace(name): baseKube.Namespace(name),
+
+  StorageClass(name): baseKubeCompat._Object("storage.k8s.io/v1", "StorageClass", name) {
+  },
+
+  RecoverableSimplePvc(namespace, name, storageClass, quantity, recoverySpec): {
+    pv: if recoverySpec == null then {} else $.SimplePv(namespace, storageClass, quantity, recoverySpec.volumeName) {
+      spec+: {
+        nfs: {
+          path: recoverySpec.nfsPath,
+          server: recoverySpec.nfsServer,
+        }
+      }
+    },
+    pvc: $.SimplePvc(namespace, name, storageClass, quantity) {
+      spec+: {
+        volumeName: if recoverySpec == null then null else recoverySpec.volumeName,
+      }
+    }
+  },
+
+  RecoverableSimpleManyPvc(namespace, name, storageClass, quantity, recoverySpec): {
+    pv: if recoverySpec == null then {} else $.SimpleManyPv(namespace, storageClass, quantity, recoverySpec.volumeName) {
+      spec+: {
+        nfs: {
+          path: recoverySpec.nfsPath,
+          server: recoverySpec.nfsServer,
+        }
+      }
+    },
+    pvc: $.SimpleManyPvc(namespace, name, storageClass, quantity) {
+      spec+: {
+        volumeName: if recoverySpec == null then null else recoverySpec.volumeName,
+      }
+    }
+  },
+
+  # N.B. Actual storage must still be defined.
+  SimplePv(namespace, storageClass, quantity, name): baseKubeCompat._Object("v1", "PersistentVolume", name) {
+    metadata+: {
+      namespace: namespace,
+    },
+    spec+: {
+      storageClassName: storageClass,
+      volumeMode: "Filesystem",
+      persistentVolumeReclaimPolicy: "Delete",
+      capacity: {
+        storage: quantity,
+      },
+      accessModes: ["ReadWriteOnce"],
+    },
+  },
+
+  SimpleManyPv(namespace, storageClass, quantity, name): $.SimplePv(namespace, storageClass, quantity, name) {
+    spec+: {
+      accessModes: ["ReadWriteMany"],
+    },
+  },
+
+  SimplePvc(namespace, name, storageClass, quantity): baseKubeCompat._Object("v1", "PersistentVolumeClaim", name) {
+    metadata+: {
+      namespace: namespace,
+    },
+    spec: {
+      storageClassName: storageClass,
+      resources: {
+        requests: {
+          storage: quantity,
+        },
+      },
+      accessModes: ["ReadWriteOnce"],
+    },
+  },
+
+  SimpleManyPvc(namespace, name, storageClass, quantity): $.SimplePvc(namespace, name, storageClass, quantity) {
+    spec+: {
+      accessModes: ["ReadWriteMany"],
+    },
+  },
+
+  Role(namespace, name):  baseKubeCompat._Object("rbac.authorization.k8s.io/v1", "Role", name) {
+    metadata+: {
+      namespace: namespace,
+    },
+  },
+
+  RoleBinding(namespace, name):  baseKubeCompat._Object("rbac.authorization.k8s.io/v1", "RoleBinding", name) {
+    metadata+: {
+      namespace: namespace,
+    },
+  },
+
+  ConfigMap(namespace, name): baseKubeCompat._Object("v1", "ConfigMap", name) {
+    metadata+: {
+      namespace: namespace,
+    },
+  },
+
+  ClusterRole(name): baseKubeCompat._Object("rbac.authorization.k8s.io/v1", "ClusterRole", name) {
+  },
+
+  ClusterRoleBinding(name): baseKubeCompat._Object("rbac.authorization.k8s.io/v1", "ClusterRoleBinding", name) {
+  },
+
+  DaemonSet(namespace, name): baseKubeCompat._Object("apps/v1", "DaemonSet", name) {
+    metadata+: {
+      namespace: namespace,
+    },
+  },
+
+  ServiceAccount(namespace, name): baseKubeCompat._Object("v1", "ServiceAccount", name) {
+    metadata+: {
+      namespace: namespace,
+    },
+  },
+
+  Service(namespace, name): baseKubeCompat._Object("v1", "Service", name) {
+    metadata+: {
+      namespace: namespace,
+    },
+    # TODO(acmcarther): Figure out how to make this more useful
+  },
+
+  Deployment(namespace, name): baseKubeCompat._Object("apps/v1", "Deployment", name) {
+    metadata+: {
+      namespace: namespace,
+    },
+  },
+
+  StatefulSet(namespace, name): baseKubeCompat._Object("apps/v1", "StatefulSet", name) {
+    metadata+: {
+      namespace: namespace,
+    },
+  },
+
+
+  Ingress(namespace, name): baseKubeCompat._Object("networking.k8s.io/v1", "Ingress", name) {
+    metadata+: {
+      namespace: namespace,
+    },
+  },
+
+  Secret(namespace, name): baseKubeCompat._Object("v1", "Secret", name) {
+    metadata+: {
+      namespace: namespace,
+    },
+  },
+
+  CronJob(namespace, name): baseKubeCompat._Object("batch/v1", "CronJob", name) {
+    metadata+: {
+      namespace: namespace,
+    },
+  },
+  Endpoints(namespace, name): baseKubeCompat._Object("v1", "Endpoints", name) {
+    metadata+: {
+      namespace: namespace,
+    },
+  },
+  EndpointSlice(namespace, name): baseKubeCompat._Object("discovery.k8s.io/v1", "EndpointSlice", name) {
+    metadata+: {
+      namespace: namespace,
+    },
+  },
+
+  ApiService(name): baseKubeCompat._Object("apiregistration.k8s.io/v1", "APIService", name) {},
+
+  IngressClass(name): baseKubeCompat._Object("networking.k8s.io/v1", "IngressClass", name) {},
+
+  ClusterIssuer(namespace, name): baseKubeCompat._Object("cert-manager.io/v1", "ClusterIssuer", name) {
+      metadata+: {
+          namespace: namespace,
+      },
+  },
+
+
+  # Provides "curried" functions with namespace pre-bound
+  UsingNamespace(namespace): {
+    Endpoints(name): $.Endpoints(namespace, name),
+    EndpointSlice(name): $.EndpointSlice(namespace, name),
+    SimplePvc(name, storageClass, quantity): $.SimplePvc(namespace, name, storageClass, quantity),
+    SimpleManyPvc(name, storageClass, quantity): $.SimpleManyPvc(namespace, name, storageClass, quantity),
+    ServiceAccount(name): $.ServiceAccount(namespace, name),
+    Service(name): $.Service(namespace, name),
+    Deployment(name): $.Deployment(namespace, name),
+    CronJob(name): $.CronJob(namespace, name),
+    StatefulSet(name): $.StatefulSet(namespace, name),
+    Ingress(name): $.Ingress(namespace, name),
+    ConfigMap(name): $.ConfigMap(namespace, name),
+  },
+}
+
diff --git a/k8s/configs/environments/authentication/BUILD.bazel b/k8s/configs/environments/authentication/BUILD.bazel
new file mode 100644
index 0000000..1000d90
--- /dev/null
+++ b/k8s/configs/environments/authentication/BUILD.bazel
@@ -0,0 +1,34 @@
+load("@rules_jsonnet//jsonnet:jsonnet.bzl", "jsonnet_library", "jsonnet_to_json", "jsonnet_to_json_test")
+load("//tools:tanka.bzl", "tanka_environment")
+load("//tools:sops.bzl", "sops_decrypt")
+
+sops_decrypt(
+    name = "secrets",
+    src = "secrets.sops.yaml",
+    out = "secrets.json",
+)
+
+jsonnet_library(
+    name = "secrets_lib",
+    srcs = [":secrets"],
+)
+
+jsonnet_to_json(
+    name = "main",
+    src = "main.jsonnet",
+    outs = ["main.json"],
+    data = [
+        "@helm_bitnami_keycloak//:chart",
+    ],
+    visibility = ["//visibility:public"],
+    deps = [
+        ":secrets_lib",
+        "//k8s/configs/templates",
+    ],
+)
+
+tanka_environment(
+    name = "authentication",
+    main = ":main",
+    spec = "spec.json",
+)
diff --git a/k8s/configs/environments/authentication/main.jsonnet b/k8s/configs/environments/authentication/main.jsonnet
new file mode 100644
index 0000000..8a37f63
--- /dev/null
+++ b/k8s/configs/environments/authentication/main.jsonnet
@@ -0,0 +1,145 @@
+local kube = import "k8s/configs/base.libsonnet";
+
+local keycloak = import "k8s/configs/templates/core/security/keycloak.libsonnet";
+local nginxIngress = import "k8s/configs/templates/core/network/nginx-ingress.libsonnet";
+local secrets = import "k8s/configs/environments/authentication/secrets.json";
+
+local ingressPaths = [
+  # TODO: remove
+  /*
+  {
+    path: "/",
+    pathType: "Prefix",
+    backend: {
+      service: {
+        name: 'keycloak',
+        port: { number: 80},
+      },
+    },
+  },
+  */
+  {
+    path: "/realms/kube",
+    pathType: "Prefix",
+    backend: {
+      service: {
+        name: 'keycloak',
+        port: { number: 80},
+      },
+    },
+  },
+  {
+    path: "/realms/dominion",
+    pathType: "Prefix",
+    backend: {
+      service: {
+        name: 'keycloak',
+        port: { number: 80 },
+      },
+    },
+  },
+  {
+    path: "/realms/docker-registry",
+    pathType: "Prefix",
+    backend: {
+      service: {
+        name: 'keycloak',
+        port: { number: 80 },
+      },
+    },
+  },
+  {
+    path: "/resources",
+    pathType: "Prefix",
+    backend: {
+      service: {
+        name: 'keycloak',
+        port: { number: 80 },
+      },
+    },
+  },
+];
+
+local namespace = "authentication";
+local ctx = kube.NewContext(kube.helm);
+{
+    namespace: {
+        apiVersion: "v1",
+        kind: "Namespace",
+        metadata: {
+            name: namespace,
+        },
+    },
+    apps: {
+        // TODO: Migrate postgres
+        keycloak: keycloak.App(keycloak.Params {
+            namespace: namespace,
+            context: ctx,
+            name: "keycloak",
+            filePath: std.thisFile,
+            postgresDbService: "keycloak-pg",
+            postgresDbNamespace: namespace,
+            postgresDbName: "keycloak-db",
+            postgresDbUser: "keycloak-user",
+            adminPassword: secrets.keycloak_admin_password,
+            authPassword: secrets.keycloak_auth_password,
+            dbPassword: secrets.keycloak_db_password,
+        }),
+        keycloakIngress: kube.Ingress(namespace, "keycloak") {
+          metadata+: {
+            annotations+: {
+              "cert-manager.io/cluster-issuer": "letsencrypt-production",
+            },
+          },
+          spec+: {
+            ingressClassName: "nginx",
+            tls: [
+              {
+                hosts: [
+                  "auth.cheapassbox.com",
+                  "authentication.cheapassbox.com",
+                  "auth.csbx.dev",
+                ],
+                secretName: "keycloak-cert",
+              },
+            ],
+            rules: [
+              {
+                host: 'auth.cheapassbox.com',
+                http: {
+                  // Specially disallow external connections to the `master` realm via ingress to protect security.
+                  paths: ingressPaths,
+                },
+              },
+              {
+                host: 'authentication.cheapassbox.com',
+                http: {
+                  // Specially disallow external connections to the `master` realm via ingress to protect security.
+                  paths: ingressPaths,
+                },
+              },
+              {
+                host: 'auth.csbx.dev',
+                http: {
+                  paths: ingressPaths,
+                },
+              }
+            ],
+          },
+        },
+
+    },
+    volumes: {
+        "keycloak-postgresql": kube.RecoverableSimplePvc(namespace, "data-keycloak-postgresql-0", "nfs-client", "8Gi", {
+            volumeName: "pvc-12905c59-07d9-4daf-b2c4-a59f1360ec50",
+            nfsPath: "/volume3/fs/authentication-data-keycloak-postgresql-0-pvc-12905c59-07d9-4daf-b2c4-a59f1360ec50",
+            nfsServer: "apollo1.dominion.lan",
+        }),
+        keycloak: kube.RecoverableSimplePvc(namespace, "keycloak-postgresql-data", "nfs-client", "24Gi", {
+            volumeName: "pvc-d984f2be-b437-11e9-bad8-b8aeed7dc356",
+            nfsPath: "/volume3/fs/authentication-keycloak-postgresql-data-pvc-d984f2be-b437-11e9-bad8-b8aeed7dc356",
+            nfsServer: "apollo1.dominion.lan",
+        }),
+    },
+    secrets: {},
+}
diff --git a/k8s/configs/environments/authentication/spec.json b/k8s/configs/environments/authentication/spec.json
new file mode 100644
index 0000000..a08d3a0
--- /dev/null
+++ b/k8s/configs/environments/authentication/spec.json
@@ -0,0 +1,15 @@
+{
+  "apiVersion": "tanka.dev/v1alpha1",
+  "kind": "Environment",
+  "metadata": {
+    "name": "environments/authentication",
+    "namespace": "environments/authentication/main.jsonnet"
+  },
+  "spec": {
+    "apiServer": "https://k8s.dominion.lan:6443",
+    "namespace": "authentication",
+    "resourceDefaults": {},
+    "expectVersions": {},
+    "injectLabels": true
+  }
+}
diff --git a/k8s/configs/environments/bazel-cache/BUILD.bazel b/k8s/configs/environments/bazel-cache/BUILD.bazel
new file mode 100644
index 0000000..871d429
--- /dev/null
+++ b/k8s/configs/environments/bazel-cache/BUILD.bazel
@@ -0,0 +1,19 @@
+load("@rules_jsonnet//jsonnet:jsonnet.bzl", "jsonnet_to_json")
+load("//tools:tanka.bzl", "tanka_environment")
+
+jsonnet_to_json(
+    name = "main",
+    src = "main.jsonnet",
+    outs = ["main.json"],
+    data = [],
+    visibility = ["//visibility:public"],
+    deps = [
+        "//k8s/configs/templates",
+    ],
+)
+
+tanka_environment(
+    name = "bazel-cache",
+    main = ":main",
+    spec = "spec.json",
+)
diff --git a/k8s/configs/environments/bazel-cache/main.jsonnet b/k8s/configs/environments/bazel-cache/main.jsonnet
new file mode 100644
index 0000000..fce2e4e
--- /dev/null
+++ b/k8s/configs/environments/bazel-cache/main.jsonnet
@@ -0,0 +1,71 @@
+local base = import 'k8s/configs/base.libsonnet';
+local bazelCache = import 'k8s/configs/templates/dev/ops/bazel-cache.libsonnet';
+local nginxIngress = import 'k8s/configs/templates/core/network/nginx-ingress.libsonnet';
+local linuxserver = import 'k8s/configs/templates/core/linuxserver.libsonnet';
+
+local namespace = 'bazel-cache';
+local appName = 'bazel-remote-cache';
+
+{
+  namespace: {
+    apiVersion: 'v1',
+    kind: 'Namespace',
+    metadata: {
+      name: namespace,
+      labels: {
+        'grpc-enabled': 'true',
+      },
+    },
+  },
+
+  pvc: base.RecoverableSimpleManyPvc(namespace, appName + '-data', 'nfs-client', '20Gi', {
+    volumeName: 'pvc-0316196b-3afd-4453-954e-3fe45c62ffc3',
+    nfsPath: '/volume3/fs/bazel-cache-bazel-remote-cache-data-pvc-0316196b-3afd-4453-954e-3fe45c62ffc3',
+    nfsServer: 'apollo1.dominion.lan',
+  }),
+
+  bazelCacheGrpcCert: {
+    apiVersion: 'cert-manager.io/v1',
+    kind: 'Certificate',
+    metadata: {
+      name: appName + '-grpc-cert',
+      namespace: namespace,
+    },
+    spec: {
+      secretName: appName + '-tls',
+      dnsNames: [
+        'bazel-cache.csbx.dev',
+      ],
+      issuerRef: {
+        name: 'letsencrypt-production',
+        kind: 'ClusterIssuer',
+      },
+    },
+  },
+
+  apps: bazelCache.App(bazelCache.Params {
+    namespace: namespace,
+    name: appName,
+    dataClaimName: appName + '-data',
+    secrets: [],
+    configMaps: [],
+    extraArgs: [],
+  }) + {
+    ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+      namespace: namespace,
+      name: appName,
+      hosts: [
+        'bazel-cache.csbx.dev',
+      ],
+      serviceName: appName + '-grpc',
+      servicePort: 9092,
+      tlsSecretName: appName + '-tls',
+      annotations: {
+        'nginx.ingress.kubernetes.io/backend-protocol': 'GRPC',
+        'nginx.ingress.kubernetes.io/proxy-body-size': '8g',
+        'nginx.ingress.kubernetes.io/proxy-read-timeout': '3600',
+        'nginx.ingress.kubernetes.io/proxy-send-timeout': '3600',
+      },
+    }),
+  },
+}
\ No newline at end of file
diff --git a/k8s/configs/environments/bazel-cache/spec.json b/k8s/configs/environments/bazel-cache/spec.json
new file mode 100644
index 0000000..8d02544
--- /dev/null
+++ b/k8s/configs/environments/bazel-cache/spec.json
@@ -0,0 +1,14 @@
+{
+  "apiVersion": "tanka.dev/v1alpha1",
+  "kind": "Environment",
+  "metadata": {
+    "name": "environments/bazel-cache"
+  },
+  "spec": {
+    "apiServer": "https://k8s.dominion.lan:6443",
+    "namespace": "bazel-cache",
+    "resourceDefaults": {},
+    "expectVersions": {},
+    "injectLabels": true
+  }
+}
diff --git a/k8s/configs/environments/cert-manager/BUILD.bazel b/k8s/configs/environments/cert-manager/BUILD.bazel
new file mode 100644
index 0000000..35a4b1d
--- /dev/null
+++ b/k8s/configs/environments/cert-manager/BUILD.bazel
@@ -0,0 +1,21 @@
+load("@rules_jsonnet//jsonnet:jsonnet.bzl", "jsonnet_to_json")
+load("//tools:tanka.bzl", "tanka_environment")
+
+jsonnet_to_json(
+    name = "main",
+    src = "main.jsonnet",
+    outs = ["main.json"],
+    data = [
+        "@helm_jetstack_cert_manager//:chart",
+    ],
+    visibility = ["//visibility:public"],
+    deps = [
+        "//k8s/configs/templates",
+    ],
+)
+
+tanka_environment(
+    name = "cert-manager",
+    main = ":main",
+    spec = "spec.json",
+)
diff --git a/k8s/configs/environments/cert-manager/main.jsonnet b/k8s/configs/environments/cert-manager/main.jsonnet
new file mode 100644
index 0000000..7990205
--- /dev/null
+++ b/k8s/configs/environments/cert-manager/main.jsonnet
@@ -0,0 +1,25 @@
+local base = import "k8s/configs/base.libsonnet";
+local certManager = import "k8s/configs/templates/core/security/cert-manager.libsonnet";
+
+local namespace = "cert-manager";
+local ctx = base.NewContext(base.helm);
+
+{
+    namespace: {
+        apiVersion: "v1",
+        kind: "Namespace",
+        metadata: {
+            name: namespace,
+        },
+    },
+    apps: {
+        certManager: certManager.App(certManager.Params {
+            namespace: namespace,
+            name: "cert-manager",
+            context: ctx,
+            values: {
+                # Add any specific values here
+            },
+        }),
+    },
+}
diff --git a/k8s/configs/environments/cert-manager/spec.json b/k8s/configs/environments/cert-manager/spec.json
new file mode 100644
index 0000000..142c053
--- /dev/null
+++ b/k8s/configs/environments/cert-manager/spec.json
@@ -0,0 +1,15 @@
+{
+  "apiVersion": "tanka.dev/v1alpha1",
+  "kind": "Environment",
+  "metadata": {
+    "name": "environments/cert-manager",
+    "namespace": "environments/cert-manager/main.jsonnet"
+  },
+  "spec": {
+    "apiServer": "https://k8s.dominion.lan:6443",
+    "namespace": "cert-manager",
+    "resourceDefaults": {},
+    "expectVersions": {},
+    "injectLabels": true
+  }
+}
diff --git a/k8s/configs/environments/container/BUILD.bazel b/k8s/configs/environments/container/BUILD.bazel
new file mode 100644
index 0000000..08bf76b
--- /dev/null
+++ b/k8s/configs/environments/container/BUILD.bazel
@@ -0,0 +1,33 @@
+load("@rules_jsonnet//jsonnet:jsonnet.bzl", "jsonnet_library", "jsonnet_to_json")
+load("//tools:tanka.bzl", "tanka_environment")
+load("//tools:sops.bzl", "sops_decrypt")
+
+sops_decrypt(
+    name = "secrets",
+    src = "secrets.sops.yaml",
+    out = "secrets.json",
+)
+
+jsonnet_library(
+    name = "secrets_lib",
+    srcs = [":secrets"],
+)
+
+jsonnet_to_json(
+    name = "main",
+    src = "main.jsonnet",
+    outs = ["main.json"],
+    data = [
+    ],
+    visibility = ["//visibility:public"],
+    deps = [
+        ":secrets_lib",
+        "//k8s/configs/templates",
+    ],
+)
+
+tanka_environment(
+    name = "container",
+    main = ":main",
+    spec = "spec.json",
+)
diff --git a/k8s/configs/environments/container/main.jsonnet b/k8s/configs/environments/container/main.jsonnet
new file mode 100644
index 0000000..9f13ec1
--- /dev/null
+++ b/k8s/configs/environments/container/main.jsonnet
@@ -0,0 +1,60 @@
+local base = import "k8s/configs/base.libsonnet";
+local dockerRegistry = import "k8s/configs/templates/dev/ops/docker-registry.libsonnet";
+local nginxIngress = import "k8s/configs/templates/core/network/nginx-ingress.libsonnet";
+local secrets = import "k8s/configs/environments/container/secrets.json";
+
+local namespace = "container";
+
+{
+  namespace: {
+    apiVersion: "v1",
+    kind: "Namespace",
+    metadata: {
+        name: namespace
+    },
+  },
+  apps: {
+    dockerRegistry: {
+      app: dockerRegistry.App(dockerRegistry.Params {
+          namespace: namespace,
+          name: "docker-registry",
+          filePath: std.thisFile,
+          storageClaimName: "docker-registry",
+          secretKeyName: "root_cert_bundle.pem",
+          secretName: "docker-registry",
+          authTokenRealm: "https://authentication.cheapassbox.com/realms/docker-registry/protocol/docker-v2/auth",
+          authTokenService: "docker",
+          authTokenIssuer: "https://authentication.cheapassbox.com/realms/docker-registry",
+      }),
+      volumes: {
+        dockerRegistryPvc: base.RecoverableSimpleManyPvc(namespace, "docker-registry", "nfs-client", "50Gi", {
+          volumeName: "pvc-ca47c5e3-b373-11e9-bad8-b8aeed7dc356",
+          nfsPath: "/volume3/fs/container-docker-registry-pvc-ca47c5e3-b373-11e9-bad8-b8aeed7dc356",
+          nfsServer: "apollo1.dominion.lan",
+        }),
+      },
+      secrets: {
+        keycloak: base.Secret("container", "docker-registry") {
+            type: "Opaque",
+            data: {
+                "root_cert_bundle.pem": secrets.auth_token_root_cert,
+            },
+        },
+      },
+      ingresses: {
+        dockerRegistryIngress: nginxIngress.Ingress(nginxIngress.IngressParams {
+            namespace: namespace,
+            name: "docker-registry",
+            hosts: [
+                "docker.cheapassbox.dev",
+                "docker.csbx.dev",
+            ],
+            serviceName: "docker-registry-http",
+            annotations: {
+                "nginx.ingress.kubernetes.io/proxy-body-size": "5000m"
+            },
+        }),
+      },
+    },
+  },
+}
\ No newline at end of file
diff --git a/k8s/configs/environments/container/spec.json b/k8s/configs/environments/container/spec.json
new file mode 100644
index 0000000..c0f5d1d
--- /dev/null
+++ b/k8s/configs/environments/container/spec.json
@@ -0,0 +1,15 @@
+{
+  "apiVersion": "tanka.dev/v1alpha1",
+  "kind": "Environment",
+  "metadata": {
+    "name": "environments/container",
+    "namespace": "environments/container/main.jsonnet"
+  },
+  "spec": {
+    "apiServer": "https://k8s.dominion.lan:6443",
+    "namespace": "container",
+    "resourceDefaults": {},
+    "expectVersions": {},
+    "injectLabels": true
+  }
+}
diff --git a/k8s/configs/environments/dev/BUILD.bazel b/k8s/configs/environments/dev/BUILD.bazel
new file mode 100644
index 0000000..85400b2
--- /dev/null
+++ b/k8s/configs/environments/dev/BUILD.bazel
@@ -0,0 +1,34 @@
+load("@rules_jsonnet//jsonnet:jsonnet.bzl", "jsonnet_library", "jsonnet_to_json", "jsonnet_to_json_test")
+load("//tools:tanka.bzl", "tanka_environment")
+load("//tools:sops.bzl", "sops_decrypt")
+
+sops_decrypt(
+    name = "secrets",
+    src = "secrets.sops.yaml",
+    out = "secrets.json",
+)
+
+jsonnet_library(
+    name = "secrets_lib",
+    srcs = [":secrets"],
+)
+
+jsonnet_to_json(
+    name = "main",
+    src = "main.jsonnet",
+    outs = ["main.json"],
+    data = [
+        "@helm_coderv2_coder//:chart",
+    ],
+    visibility = ["//visibility:public"],
+    deps = [
+        ":secrets_lib",
+        "//k8s/configs/templates",
+    ],
+)
+
+tanka_environment(
+    name = "dev",
+    main = ":main",
+    spec = "spec.json",
+)
diff --git a/k8s/configs/environments/dev/main.jsonnet b/k8s/configs/environments/dev/main.jsonnet
new file mode 100644
index 0000000..81f5c96
--- /dev/null
+++ b/k8s/configs/environments/dev/main.jsonnet
@@ -0,0 +1,718 @@
+local base = import "k8s/configs/base.libsonnet";
+local secrets = import "k8s/configs/environments/dev/secrets.json";
+
+local nginxIngress = import "k8s/configs/templates/core/network/nginx-ingress.libsonnet";
+local postgres = import "k8s/configs/templates/core/storage/postgres.libsonnet";
+local memcached = import "k8s/configs/templates/core/storage/memcached.libsonnet";
+
+local n8n = import "k8s/configs/templates/core/workflow/n8n.libsonnet";
+
+local codeServer = import "k8s/configs/templates/dev/ide/code-server.libsonnet";
+local coder = import "k8s/configs/templates/dev/ide/coder.libsonnet";
+
+local ollama = import "k8s/configs/templates/dev/ai/ollama.libsonnet";
+local openWebUi = import "k8s/configs/templates/dev/ai/open-webui.libsonnet";
+local openWebUiPipelines = import "k8s/configs/templates/dev/ai/open-webui-pipelines.libsonnet";
+local tabbyml = import "k8s/configs/templates/dev/ai/tabbyml.libsonnet";
+
+local openssh = import "k8s/configs/templates/dev/ops/openssh.libsonnet";
+local forgejo = import "k8s/configs/templates/dev/ops/forgejo.libsonnet";
+local forgejoRunner = import "k8s/configs/templates/dev/ops/forgejo-runner.libsonnet";
+local harbor = import "k8s/configs/templates/dev/ops/harbor.libsonnet";
+local binCache = import "k8s/configs/templates/dev/ops/bin-cache.libsonnet";
+
+local browserless = import "k8s/configs/templates/dev/tools/browserless.libsonnet";
+local hastebin = import "k8s/configs/templates/dev/tools/hastebin.libsonnet";
+local hugo = import "k8s/configs/templates/dev/tools/hugo.libsonnet";
+
+local whitebophir = import "k8s/configs/templates/dev/organization/whitebophir.libsonnet";
+local vikunja = import "k8s/configs/templates/dev/organization/vikunja.libsonnet";
+
+local lurker = import "k8s/configs/templates/personal/media/lurker.libsonnet";
+
+
+local namespace = "dev";
+local ctx = base.NewContext(base.helm);
+{
+    namespace: {
+        apiVersion: "v1",
+        kind: "Namespace",
+        metadata: {
+            name: namespace,
+        },
+    },
+    bazelClientCert: {
+      apiVersion: 'cert-manager.io/v1',
+      kind: 'Certificate',
+      metadata: {
+        name: 'bazel-client-cert',
+        namespace: namespace,
+      },
+      spec: {
+        secretName: 'bazel-client-tls',
+        commonName: 'bazel-client-dev',
+        isCA: false,
+        usages: [
+          'client auth',
+        ],
+        issuerRef: {
+          name: 'csbx-dev-grpc-ca-issuer',
+          kind: 'ClusterIssuer',
+        },
+      },
+    },
+    secrets: {
+        coderPostgres: postgres.Secret(postgres.SecretParams{
+            name: "coder-postgres",
+            namespace: "dev",
+            password: secrets.coder_psql_db_pwd,
+        }), 
+        coderDbUrl: base.Secret("dev", "coder-db-url") {
+            type: "Opaque",
+            data+: {
+                "url": secrets.coder_db_url,
+            },
+        },
+        vikunjaSecret: base.Secret("dev", "vikunja-secret") {
+            type: "Opaque",
+            data+: {
+                "vikunja-db-pwd": secrets.vikunja_db_pwd,
+                "vikunja-jwt-secret": secrets.vikunja_jwt_secret,
+            },
+        },
+        forgejoRunnerSecret: base.Secret("dev", "forgejo-runner-secret") {
+            type: "Opaque",
+            data+: {
+                "runner-token": secrets.forgejo_runner_token,
+            },
+        },
+        harbor: harbor.Secret(harbor.SecretParams{
+            name: "harbor-secret",
+            namespace: "dev",
+            adminPassword: secrets.harbor_admin_pwd,
+            secretKey: secrets.harbor_secret_key,
+            registryPassword: secrets.harbor_registry_pwd,
+            registryHtpassword: secrets.harbor_registry_htpasswd,
+            databasePassword: secrets.harbor_db_pwd,
+        }),
+        forgejoApp: forgejo.Secret(forgejo.SecretParams{
+            name: "forgejo-app",
+            namespace: "dev",
+            psql_password: secrets.forgejo_psql_db_pwd,
+        }), 
+        forgejoMemcached: memcached.Secret(memcached.SecretParams{
+            name: "forgejo-memcached",
+            namespace: "dev",
+            password: "",
+        }), 
+        forgejoPostgres: postgres.Secret(postgres.SecretParams{
+            name: "forgejo-postgres",
+            namespace: "dev",
+            password: secrets.forgejo_psql_db_pwd,
+        }), 
+    },
+    apps: {
+        binCache: {
+            pvc: base.RecoverableSimpleManyPvc(namespace, "bin-cache-data", "nfs-client", "50Gi", {
+                volumeName: "pvc-e37b19f1-9833-4b43-b43f-17781ce77dc8",
+                nfsPath: "/volume3/fs/dev-bin-cache-data-pvc-e37b19f1-9833-4b43-b43f-17781ce77dc8",
+                nfsServer: "apollo1.dominion.lan",
+            }),
+            
+            configMap: binCache.ConfigMap(binCache.Params {
+                namespace: namespace,
+                name: "bin-cache-config",
+                dataClaimName: "bin-cache-data",
+                configClaimName: "bin-cache-config",
+            }),
+            
+            app: binCache.App(binCache.Params {
+                namespace: namespace,
+                name: "bin-cache",
+                dataClaimName: "bin-cache-data",
+                configClaimName: "bin-cache-config",
+            }),
+            
+            ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "bin-cache",
+                hosts: [
+                    "bin-cache.csbx.dev",
+                ],
+                serviceName: "bin-cache-http",
+                servicePort: 80,
+                annotations: {
+                    "nginx.ingress.kubernetes.io/proxy-buffer-size": "32k",
+                    "nginx.ingress.kubernetes.io/proxy-buffers": "4 32k",
+                    "nginx.ingress.kubernetes.io/proxy-busy-buffers-size": "64k",
+                },
+            }),
+        },
+        coder: {
+            postgresPvc: base.RecoverableSimpleManyPvc(namespace, "coder-postgres-data", "nfs-client", "50Gi", {
+                volumeName: "pvc-e1475b7d-e320-4ec4-bdd2-f4af9bae8d9d",
+                nfsPath: "/volume3/fs/dev-coder-postgres-data-pvc-e1475b7d-e320-4ec4-bdd2-f4af9bae8d9d",
+                nfsServer: "apollo1.dominion.lan",
+            }),
+            // 2024-10-09
+            // Having issues with db initializatoon
+            // 2025-01-19
+            // In the process of upgrading postgres, I think I've root caused the failure to create
+            // The data claim will need to be cleaned up and then recreated as postgres 17.
+
+            dbApp: postgres.App(postgres.Params {
+                namespace: namespace,
+                name: "coder-pg",
+                filePath: std.thisFile,
+                dataClaimName: "coder-postgres-data",
+                dbName: "coder",
+                dbUser: "postgres",
+                // Defined in "//kube/cfg/secrets/auth.jsonnet"
+                dbPwdSecret: "coder-postgres",
+                dbPwdSecretKey: "password",
+            }),
+            coder: coder.App(coder.Params {
+                namespace: namespace,
+                name: "coder",
+                context: ctx,
+                filePath: std.thisFile,
+                coderPgUrlSecret: "coder-db-url",
+            }),
+            ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "coder-ui",
+                hosts: [
+                    "coder.csbx.dev",
+                ],
+                // TODO:
+                serviceName: "coder",
+                // Has it's own auth.
+                //annotations: nginxIngress.KubeCsbxOauthProxyAnnotations,
+            }),
+            toolsPvc: base.RecoverableSimpleManyPvc(namespace, "tools-pvc", "nfs-client", "10Gi", {
+                volumeName: "pvc-2c3aa050-1503-41a5-9389-4ac2bbce47a7",
+                nfsPath: "/volume3/fs/dev-tools-pvc-pvc-2c3aa050-1503-41a5-9389-4ac2bbce47a7",
+                nfsServer: "apollo1.dominion.lan",
+            }),
+        },
+        ollama: {
+            ollamaStoragePvc: base.RecoverableSimpleManyPvc(namespace, "ollama-storage", "nfs-bulk", "100Gi", {
+                volumeName: "pvc-4106e508-b04d-4d15-9b70-2a9c01d0d72c",
+                nfsPath: "/volume4/fs-bulk/dev-ollama-storage-pvc-4106e508-b04d-4d15-9b70-2a9c01d0d72c",
+                nfsServer: "apollo2.dominion.lan",
+            }),
+            ollamaFatStoragePvc: base.RecoverableSimpleManyPvc(namespace, "ollama-fat-storage", "nfs-bulk", "100Gi", {
+                volumeName: "pvc-34e9dec4-b2c2-4b32-85e8-a409b671087f",
+                nfsPath: "/volume4/fs-bulk/dev-ollama-fat-storage-pvc-34e9dec4-b2c2-4b32-85e8-a409b671087f",
+                nfsServer: "apollo2.dominion.lan",
+            }),
+            openWebUIStoragePvc: base.RecoverableSimpleManyPvc(namespace, "open-webui-storage", "nfs-client", "10Gi", {
+                volumeName: "pvc-6b420a30-2c60-486e-977d-baa8bcb17842",
+                nfsPath: "/volume3/fs/dev-open-webui-storage-pvc-6b420a30-2c60-486e-977d-baa8bcb17842",
+                nfsServer: "apollo1.dominion.lan",
+            }),
+            openWebUIPipelinesStoragePvc: base.RecoverableSimpleManyPvc(namespace, "open-webui-pipelines-storage", "nfs-client", "10Gi", {
+                volumeName: "pvc-4ebe8cab-1712-4292-8543-fd28e30409f7",
+                nfsPath: "/volume3/fs/dev-open-webui-pipelines-storage-pvc-4ebe8cab-1712-4292-8543-fd28e30409f7",
+                nfsServer: "apollo1.dominion.lan",
+            }),
+            /*
+            ollamaApp: ollama.App(ollama.Params {
+                namespace: namespace,
+                name: "ollama",
+                filePath: std.thisFile,
+                storageClaimName: "ollama-storage",
+            }),
+            */
+            /*
+            ollamaFatApp: ollama.App(ollama.Params {
+                namespace: namespace,
+                name: "ollama-fat",
+                filePath: std.thisFile,
+                storageClaimName: "ollama-fat-storage",
+                gpuNodeSelectorName: "nvidia-fat"
+            }),
+            */
+            // TODO:
+            // - Cron for ollama and ollama-fat to rsync ollama local to ollama remote
+            /*
+            openWebUIApp: openWebUi.App(openWebUi.Params {
+                namespace: namespace,
+                name: "ollama-open-ui",
+                filePath: std.thisFile,
+                ollamaHost: "http://ollama-ui." + namespace + ".svc.cluster.local:80",
+                storageClaimName: "open-webui-storage",
+            }),
+            openWebUIPipelinesApp: openWebUiPipelines.App(openWebUiPipelines.Params {
+                namespace: namespace,
+                name: "ollama-open-ui-pipelines",
+                filePath: std.thisFile,
+                storageClaimName: "open-webui-pipelines-storage",
+            }),
+            ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "ollama-open-ui",
+                hosts: [
+                    "llama.csbx.dev",
+                ],
+                serviceName: "ollama-open-ui-ui",
+                // Has it's own auth.
+                //annotations: nginxIngress.KubeCsbxOauthProxyAnnotations,
+            }),
+            */
+        },
+        tabbyml: {
+            storagePvc: base.RecoverableSimpleManyPvc(namespace, "tabbyml-storage", "nfs-client", "10Gi", {
+                volumeName: "pvc-c21eadff-2d8e-419e-bf2f-1fc6262b4dcd",
+                nfsPath: "/volume3/fs/dev-tabbyml-storage-pvc-c21eadff-2d8e-419e-bf2f-1fc6262b4dcd",
+                nfsServer: "apollo1.dominion.lan",
+            }),
+            // TODO: Not working -- not becoming available on the port.
+            /*
+            tabbyml: tabbyml.App(tabbyml.Params {
+                namespace: namespace,
+                name: "tabbyml",
+                filePath: std.thisFile,
+                storageClaimName: "tabbyml-storage",
+            }),
+            ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "tabbyml-ui",
+                hosts: [
+                    "tabbyml.csbx.dev",
+                ],
+                serviceName: "tabbyml-ui",
+            }),
+            */
+        },
+        lurker: {
+            dataPvc: base.RecoverableSimpleManyPvc(namespace, "lurker-data", "nfs-client", "100Gi", {
+                volumeName: "pvc-5f906263-252f-43cf-8298-7a61d58321b2",
+                nfsPath: "/volume3/fs/dev-lurker-data-pvc-5f906263-252f-43cf-8298-7a61d58321b2",
+                nfsServer: "apollo1.dominion.lan",
+            }),
+            app: lurker.App(lurker.Params {
+                namespace: namespace,
+                name: "lurker",
+                filePath: std.thisFile,
+                dataClaimName: "lurker-data",
+            }),
+            ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "lurker",
+                hosts: [
+                    "lurker.csbx.dev",
+                ],
+                serviceName: "lurker-ui",
+                #annotations: nginxIngress.KubeOauthProxyAnnotations,
+            }),
+        },
+        /*
+        browserless: {
+            browserlessApp: browserless.App(browserless.Params {
+                namespace: namespace,
+                name: "browserless",
+                filePath: std.thisFile,
+            }),
+            browserlessIngress: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "browserless",
+                hosts: [
+                    "browserless.csbx.dev",
+                ],
+                serviceName: "browserless-ui",
+                annotations: nginxIngress.KubeCsbxOauthProxyAnnotations,
+            }),
+        },
+        n8n: {
+            n8nPvc: base.RecoverableSimpleManyPvc(namespace, "n8n-data", "nfs-client", "10Gi", {
+                volumeName: "pvc-f9970c88-1b5f-4bbd-845a-3a1e685aa123",
+                nfsPath: "/volume3/fs/dev-n8n-data-pvc-f9970c88-1b5f-4bbd-845a-3a1e685aa123",
+                nfsServer: "apollo1.dominion.lan",
+            }),
+            n8nPostgresPvc: base.RecoverableSimpleManyPvc(namespace, "n8n-postgres-data", "nfs-client", "10Gi", {
+                volumeName: "pvc-4e48a218-d9e5-41b9-8e9f-8bb1a7d4def7",
+                nfsPath: "/volume3/fs/dev-n8n-postgres-data-pvc-4e48a218-d9e5-41b9-8e9f-8bb1a7d4def7",
+                nfsServer: "apollo1.dominion.lan",
+            }),
+            dbApp: postgres.App(postgres.Params {
+                namespace: namespace,
+                name: "n8n-pg",
+                filePath: std.thisFile,
+                // Defined in "//kube/cfg/secrets/dev.jsonnet"
+                dataClaimName: "n8n-postgres-data",
+                dbName: "n8n",
+                dbUser: "root",
+                // Defined in "//kube/cfg/secrets/dev.jsonnet"
+                dbPwdSecret: "n8n-secret",
+                dbPwdSecretKey: "n8n-db-pwd",
+            }),
+            app: n8n.App(n8n.Params {
+                namespace: namespace,
+                name: "n8n",
+                filePath: std.thisFile,
+                dataClaimName: "n8n-data",
+                ingressBaseUrl: "n8n.csbx.dev",
+                postgresHost: "n8n-pg.dev.svc.cluster.local",
+                dbPwdSecret: "n8n-secret",
+                dbPwdSecretKey: "n8n-db-pwd",
+            }),
+            ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "n8n",
+                hosts: [
+                    "n8n.csbx.dev",
+                ],
+                serviceName: "n8n-ui",
+                //annotations: nginxIngress.KubeCsbxOauthProxyAnnotations,
+            }),
+        },
+        */
+        codeServer: {
+            configPvc: base.RecoverableSimpleManyPvc(namespace, "code-server-config", "nfs-client", "100Gi", {
+                volumeName: "pvc-9f72afed-69ba-4009-ab6e-81cef350f886",
+                nfsPath: "/volume3/fs/dev-code-server-config-pvc-9f72afed-69ba-4009-ab6e-81cef350f886",
+                nfsServer: "apollo1.dominion.lan",
+            }),
+            app: codeServer.App(codeServer.Params {
+                namespace: namespace,
+                name: "code-server",
+                filePath: std.thisFile,
+                // Defined in "//kube/cfg/dominion/pvc.jsonnet"
+                configClaimName: "code-server-config",
+            }),
+            /*
+            hugoDocs: hugo.App(hugo.Params {
+                namespace: namespace,
+                name: "hugo-infra",
+                filePath: std.thisFile,
+                dataClaimName: "code-server-config",
+                mountSubPath: "workspace/infra2/dominion-notes/",
+            }),
+            */
+            ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "code-server",
+                hosts: [
+                    "cs.cheapassbox.com",
+                ],
+                serviceName: "code-server-ui",
+                annotations: nginxIngress.KubeOauthProxyAnnotations,
+            }),
+            ingress2: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "code-server-csbx",
+                hosts: [
+                    "cs.csbx.dev",
+                ],
+                serviceName: "code-server-ui",
+                annotations: nginxIngress.KubeCsbxOauthProxyAnnotations,
+            }),
+            /*
+            hugoIngress: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "hugo-infra",
+                hosts: [
+                    "infra-docs.csbx.dev",
+                ],
+                serviceName: "hugo-infra-ui",
+                annotations: nginxIngress.KubeCsbxOauthProxyAnnotations,
+            })
+            */
+        },
+        /*
+        vikunja: {
+            vikunjaPvc: base.RecoverableSimpleManyPvc(namespace, "vikunja-data", "nfs-client", "10Gi", {
+                volumeName: "pvc-87dd9045-276f-45b6-bda0-6a4c88289517",
+                nfsPath: "/volume3/fs/dev-vikunja-data-pvc-87dd9045-276f-45b6-bda0-6a4c88289517",
+                nfsServer: "apollo1.dominion.lan",
+            }),
+            vikunjaPostgresPvc: base.RecoverableSimpleManyPvc(namespace, "vikunja-postgres-data", "nfs-client", "10Gi", {
+                volumeName: "pvc-68d9b640-d4ea-447f-a6a3-bc3a1ea41c0a",
+                nfsPath: "/volume3/fs/dev-vikunja-postgres-data-pvc-68d9b640-d4ea-447f-a6a3-bc3a1ea41c0a",
+                nfsServer: "apollo1.dominion.lan",
+            }),
+            dbApp: postgres.App(postgres.Params {
+                namespace: namespace,
+                name: "vikunja-pg",
+                filePath: std.thisFile,
+                // Defined in "//kube/cfg/secrets/dev.jsonnet"
+                dataClaimName: "vikunja-postgres-data",
+                dbName: "vikunja",
+                dbUser: "vikunja",
+                // Defined in "//kube/cfg/secrets/dev.jsonnet"
+                dbPwdSecret: "vikunja-secret",
+                dbPwdSecretKey: "vikunja-db-pwd",
+            }),
+            vikunja: vikunja.App(vikunja.Params {
+                namespace: namespace,
+                name: "vikunja",
+                filePath: std.thisFile,
+                dataClaimName: "vikunja-data",
+                ingressBaseUrl: "https://vikunja.csbx.dev/",
+                postgresHost: "vikunja-pg.dev.svc.cluster.local",
+                secretName: "vikunja-secret",
+            },),
+            vikunja_ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "vikunja-csbx",
+                hosts: [
+                    "vikunja.csbx.dev",
+                ],
+                serviceName: "vikunja-ui",
+                annotations: nginxIngress.KubeCsbxOauthProxyAnnotations,
+            }),
+        },
+        */
+        forgejo: {
+            postgres17Pvc: base.RecoverableSimpleManyPvc(namespace, "forgejo-postgres-17-data", "nfs-client", "50Gi", {
+                volumeName: "pvc-18f8a0b8-7aef-4d07-ab45-59b99377c7f2",
+                nfsPath: "/volume3/fs/dev-forgejo-postgres-17-data-pvc-18f8a0b8-7aef-4d07-ab45-59b99377c7f2",
+                nfsServer: "apollo1.dominion.lan",
+            }),
+            dataPvc: base.RecoverableSimpleManyPvc(namespace, "forgejo-data", "nfs-bulk", "200Gi", {
+                volumeName: "pvc-d92af937-297d-4bee-981f-1b7f9a8530a0",
+                nfsPath: "/volume4/fs-bulk/dev-forgejo-data-pvc-d92af937-297d-4bee-981f-1b7f9a8530a0",
+                nfsServer: "apollo2.dominion.lan",
+            }),
+            memcachedApp: memcached.App(memcached.Params {
+                namespace: namespace,
+                name: "forgejo-memcached",
+                filePath: std.thisFile,
+                secretName: "forgejo-memcached",
+            }),
+            db17App: postgres.App(postgres.Params {
+                namespace: namespace,
+                name: "forgejo-pg-17",
+                // TODO:
+                image: "docker.io/bitnami/postgresql:17.2.0",
+                filePath: std.thisFile,
+                dataClaimName: "forgejo-postgres-17-data",
+                dbName: "forgejo",
+                dbUser: "forgejo",
+                // Defined in "//kube/cfg/secrets/auth.jsonnet"
+                dbPwdSecret: "forgejo-postgres",
+                dbPwdSecretKey: "password",
+            }),
+            forgejoConfig: forgejo.ConfigMap(forgejo.ConfigMapParams {
+                namespace: namespace,
+                name: "forgejo-config",
+                ingressHost: "forgejo.csbx.dev",
+                memcacheService: "forgejo-memcached",
+                postgresDbService: "forgejo-pg-17",
+            }),
+            forgejoApp: forgejo.App(forgejo.Params {
+                namespace: namespace,
+                name: "forgejo",
+                filePath: std.thisFile,
+                ingressHost: "forgejo.csbx.dev",
+                memcacheService: "forgejo-memcached",
+                postgresService: "forgejo-pg-17",
+                postgresUser: "forgejo",
+                postgresDatabase: "forgejo",
+                postgresNamespace: namespace,
+                secretName: "forgejo-app",
+                secretDbPwdKey: "psql-password",
+                configClaimName: "forgejo-config",
+                dataClaimName:  "forgejo-data",
+            }),
+            ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "forgejo",
+                hosts: [
+                    "forgejo.csbx.dev",
+                ],
+                serviceName: "forgejo-ui",
+                annotations: {
+                    "nginx.ingress.kubernetes.io/proxy-body-size": "4g"
+                },
+            }),
+        },
+        forgejoRunner: {
+            configMap: forgejoRunner.ConfigMap(forgejoRunner.ConfigMapParams {
+                name: "forgejo-runner-config",
+                namespace: namespace,
+            }),
+            pvc1: base.RecoverableSimpleManyPvc(namespace, "forgejo-runner-data", "nfs-client", "1Gi", {
+                volumeName: "pvc-479c2f6a-8d70-4597-9498-f945f2edd0f4",
+                nfsPath: "/volume3/fs/dev-forgejo-runner-data-pvc-479c2f6a-8d70-4597-9498-f945f2edd0f4",
+                nfsServer: "apollo1.dominion.lan",
+            }),
+            pvc2: base.RecoverableSimpleManyPvc(namespace, "forgejo-runner-2-data", "nfs-client", "1Gi", {
+                volumeName: "pvc-c38ebd42-ced7-4b48-91ca-2097ef581f4d",
+                nfsPath: "/volume3/fs/dev-forgejo-runner-2-data-pvc-c38ebd42-ced7-4b48-91ca-2097ef581f4d",
+                nfsServer: "apollo1.dominion.lan",
+            }),
+            runner1: forgejoRunner.App(forgejoRunner.Params {
+                name: "forgejo-runner",
+                namespace: namespace,
+                dataClaimName: "forgejo-runner-data",
+                configClaimName: "forgejo-runner-config",
+                runnerLabels: [
+                    "docker-builder",
+                ],
+                tokenSecretName: "forgejo-runner-secret",
+                tokenSecretKey: "runner-token",
+            }),
+            runner2: forgejoRunner.App(forgejoRunner.Params {
+                name: "forgejo-runner-2",
+                namespace: namespace,
+                dataClaimName: "forgejo-runner-2-data",
+                configClaimName: "forgejo-runner-config",
+                runnerLabels: [
+                    "docker-builder",
+                ],
+                tokenSecretName: "forgejo-runner-secret",
+                tokenSecretKey: "runner-token",
+            }),
+
+        },
+ 
+ /*
+        harbor: {
+            pvcs: {
+                registry: base.RecoverableSimpleManyPvc(namespace, "harbor-registry", "nfs-bulk", "200Gi",  {
+                    volumeName: "pvc-1111e99b-d549-47ff-849d-cdffcdeb481c",
+                    nfsPath: "/volume4/fs-bulk/dev-harbor-registry-pvc-1111e99b-d549-47ff-849d-cdffcdeb481c",
+                    nfsServer: "apollo2.dominion.lan",
+                }),
+                jobServiceJobLog: base.RecoverableSimpleManyPvc(namespace, "harbor-job-service-job-log", "nfs-client", "50Gi", {
+                    volumeName: "pvc-cfb8393f-fec8-4b00-86e7-32232d94a442",
+                    nfsPath: "/volume3/fs/dev-harbor-job-service-job-log-pvc-cfb8393f-fec8-4b00-86e7-32232d94a442",
+                    nfsServer: "apollo1.dominion.lan",
+                }),
+                redis: base.RecoverableSimpleManyPvc(namespace, "harbor-redis", "nfs-client", "50Gi", {
+                    volumeName: "pvc-3e2d7fd6-1eca-4066-b3e9-012da312ae4b",
+                    nfsPath: "/volume3/fs/dev-harbor-redis-pvc-3e2d7fd6-1eca-4066-b3e9-012da312ae4b",
+                    nfsServer: "apollo1.dominion.lan",
+                }),
+                trivy: base.RecoverableSimpleManyPvc(namespace, "harbor-trivy", "nfs-client", "50Gi", {
+                    volumeName: "pvc-91dde8a2-c681-4539-af04-2ceef00322f8",
+                    nfsPath: "/volume3/fs/dev-harbor-trivy-pvc-91dde8a2-c681-4539-af04-2ceef00322f8",
+                    nfsServer: "apollo1.dominion.lan",
+                }),
+                postgres: base.RecoverableSimpleManyPvc(namespace, "harbor-db-data", "nfs-client", "50Gi", {
+                    volumeName: "pvc-a76e6c48-f065-4359-9805-fe77a3443fd5",
+                    nfsPath: "/volume3/fs/dev-harbor-db-data-pvc-a76e6c48-f065-4359-9805-fe77a3443fd5",
+                    nfsServer: "apollo1.dominion.lan",
+                }),
+            },
+            database: postgres.App(postgres.Params {
+                namespace: namespace,
+                name: "harbor-pg",
+                filePath: std.thisFile,
+                dataClaimName: "harbor-db-data",
+                dbName: "harbor",
+                dbUser: "harbor",
+                // Defined in "//kube/cfg/secrets/auth.jsonnet"
+                dbPwdSecret: "harbor-secret",
+                dbPwdSecretKey: "password", // required by the harbor template...
+            }),
+            app: harbor.App(harbor.Params {
+                namespace: namespace, 
+                context: ctx,
+                filePath: std.thisFile,
+                // Ingress
+                ingressHost: "hrbr.csbx.dev",
+                ingressClassName: "nginx",
+                ingressAnnotations: nginxIngress.KubeCsbxOauthProxyAnnotations,
+                // Volume claims
+                registryExistingClaim: "harbor-registry",
+                jobServiceJobLogExistingClaim: "harbor-job-service-job-log",
+                redisExistingClaim: "harbor-redis",
+                trivyExistingClaim: "harbor-trivy",
+                // Credentials
+                existingSecretAdminPassword: "harbor-secret",
+                existingSecretSecretKey: "harbor-secret",
+                //coreSecretName: "harbor-secret",
+                registryCredentialsExistingSecret: "harbor-secret",
+                
+                // Database
+                databaseHost: "harbor-pg.dev.svc.cluster.local",
+                databasePort: 5432,
+                databaseExistingSecret: "harbor-secret",
+
+                // TODO:
+                coreSecret: "example-16-chara",
+                jobserviceSecret: "example-16-chara",
+                registrySecret: "example-16-chara",
+            }),
+        },
+        */
+        hastebin: {
+            pvc: base.RecoverableSimpleManyPvc(namespace, "hastebin-data", "nfs-client", "50Gi", {
+                volumeName: "pvc-67e8031c-97e3-11ea-8974-b8aeed7dc356",
+                nfsPath: "/volume3/fs/dev-hastebin-data-pvc-67e8031c-97e3-11ea-8974-b8aeed7dc356",
+                nfsServer: "apollo1.dominion.lan",
+            }),
+
+            app: hastebin.App(hastebin.Params {
+                namespace: namespace,
+                name: "hastebin",
+                filePath: std.thisFile,
+                // Defined in "//kube/cfg/dominion/pvc.jsonnet"
+                dataClaimName: "hastebin-data",
+                ingressHost: "hastebin.cheapassbox.com",
+                resources: {
+                requests: {
+                    cpu: "30m",
+                    memory: "128Mi",
+                },
+                limits: {
+                    cpu: "60m",
+
+                    memory: "256Mi",
+                },
+                },
+            }),
+            ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "hastebin",
+                hosts: [
+                    "hastebin.cheapassbox.com",
+                    "hastebin.csbx.dev",
+                ],
+                serviceName: "hastebin-ui",
+            }),
+        },
+        openssh: {
+            configPvc: base.RecoverableSimpleManyPvc(namespace, "openssh-config", "nfs-client", "1Gi", {
+                volumeName: "pvc-fc53f3fa-ed15-4ea7-9e7b-3c0c5cf0629c",
+                nfsPath: "/volume3/fs/dev-openssh-config-pvc-fc53f3fa-ed15-4ea7-9e7b-3c0c5cf0629c",
+                nfsServer: "apollo1.dominion.lan",
+            }),
+            app: openssh.App(openssh.Params {
+                namespace: namespace,
+                name: "openssh",
+                filePath: std.thisFile,
+                sshNodePort: 31500,
+                claimNames: ["code-server-config"],
+                username: "acmcarther",
+                configClaim: "openssh-config",
+                publicKey: "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQCpnYmsUDSkhvy1imOLee/3qlySIRUn9kKkTGaet2wjNSQ4n8muFhjMtXI6+qWW0Vv6edY4MLEwegXGbaZA/7yAbSOpPmQ+Z4d0GE1Kns/1OoTt5XhXpr8OhgqPL3S/foqQlf5RXywlqzYJkJL0yk1jg2CguIYVMTE4aJwd0Mt2t25fwzEuDvSGJ41wVWrueKy6EELYXbQ5FMcN/bZLERNLGp4hTsdXdBtSX7vq0VC+qG+EmTTXOt5+DvWu6UkLq8Mb1540Mi3AK7+vsXUTPghIS7BLLrU8bb4QQ0z0IZjI39wXeSegoPRt6y2f0yrBR+S+vQ1qrGB1riYZ6f4ZUzQh acmcarther@gmail.com"
+            }),
+        },
+        whitebophir: {
+            whitebophirDataPvc: base.RecoverableSimpleManyPvc(namespace, "whitebophir-data", "nfs-client", "10Gi", {
+                volumeName: "pvc-672040d0-9303-4194-b79c-1e1b25c4345d",
+                nfsPath: "/volume3/fs/dev-whitebophir-data-pvc-672040d0-9303-4194-b79c-1e1b25c4345d",
+                nfsServer: "apollo1.dominion.lan",
+            }),
+            app: whitebophir.App(whitebophir.Params {
+                namespace: namespace,
+                name: "whitebophir",
+                filePath: std.thisFile,
+                storageClaimName: "whitebophir-data",
+            }),
+            ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "whitebophir",
+                hosts: [
+                    "whiteboard.csbx.dev",
+                ],
+                serviceName: "whitebophir-ui",
+                annotations: nginxIngress.KubeCsbxOauthProxyAnnotations,
+            }),
+        },
+    },
+}
\ No newline at end of file
diff --git a/k8s/configs/environments/dev/spec.json b/k8s/configs/environments/dev/spec.json
new file mode 100644
index 0000000..1abf940
--- /dev/null
+++ b/k8s/configs/environments/dev/spec.json
@@ -0,0 +1,15 @@
+{
+  "apiVersion": "tanka.dev/v1alpha1",
+  "kind": "Environment",
+  "metadata": {
+    "name": "environments/dev",
+    "namespace": "environments/dev/main.jsonnet"
+  },
+  "spec": {
+    "apiServer": "https://k8s.dominion.lan:6443",
+    "namespace": "dev",
+    "resourceDefaults": {},
+    "expectVersions": {},
+    "injectLabels": true
+  }
+}
diff --git a/k8s/configs/environments/game/BUILD.bazel b/k8s/configs/environments/game/BUILD.bazel
new file mode 100644
index 0000000..bf1fb89
--- /dev/null
+++ b/k8s/configs/environments/game/BUILD.bazel
@@ -0,0 +1,21 @@
+load("@rules_jsonnet//jsonnet:jsonnet.bzl", "jsonnet_to_json")
+load("//tools:tanka.bzl", "tanka_environment")
+
+jsonnet_to_json(
+    name = "main",
+    src = "main.jsonnet",
+    outs = ["main.json"],
+    data = [
+        "@helm_jetstack_cert_manager//:chart",
+    ],
+    visibility = ["//visibility:public"],
+    deps = [
+        "//k8s/configs/templates",
+    ],
+)
+
+tanka_environment(
+    name = "game",
+    main = ":main",
+    spec = "spec.json",
+)
diff --git a/k8s/configs/environments/game/main.jsonnet b/k8s/configs/environments/game/main.jsonnet
new file mode 100644
index 0000000..6f40998
--- /dev/null
+++ b/k8s/configs/environments/game/main.jsonnet
@@ -0,0 +1,228 @@
+local base = import "k8s/configs/base.libsonnet";
+
+local minecraftServer = import "k8s/configs/templates/game/minecraft-server.libsonnet";
+local bluemap = import "k8s/configs/templates/game/bluemap.libsonnet";
+local palworld = import "k8s/configs/templates/game/palworld.libsonnet";
+local nginxIngress = import "k8s/configs/templates/nginx-ingress.libsonnet";
+
+local namespace = "game";
+{
+    namespace: {
+        apiVersion: "v1",
+        kind: "Namespace",
+        metadata: {
+            name: namespace,
+        },
+    },
+    /*
+    newMinecraftServer: {
+        bluemapConfig: base.RecoverableSimpleManyPvc(namespace, "bluemap-config", "nfs-client", "5Gi", {
+            volumeName: "pvc-3c0765a0-1f19-4491-ac68-73cbaea93226",
+            nfsPath: "/volume3/fs/game-bluemap-config-pvc-3c0765a0-1f19-4491-ac68-73cbaea93226",
+            nfsServer: "apollo1.dominion.lan",
+        }),
+        bluemapData: base.RecoverableSimpleManyPvc(namespace, "bluemap-data", "nfs-client", "5Gi", {
+            volumeName: "pvc-530578ec-1d16-43ae-abec-e46d6746cf04",
+            nfsPath: "/volume3/fs/game-bluemap-data-pvc-530578ec-1d16-43ae-abec-e46d6746cf04",
+            nfsServer: "apollo1.dominion.lan",
+        }),
+        bluemapWeb: base.RecoverableSimpleManyPvc(namespace, "bluemap-web", "nfs-client", "5Gi", {
+            volumeName: "pvc-c4556edc-0c44-492e-99e3-e7490cc216ee",
+            nfsPath: "/volume3/fs/game-bluemap-web-pvc-c4556edc-0c44-492e-99e3-e7490cc216ee",
+            nfsServer: "apollo1.dominion.lan",
+        }),
+
+        mc1Pvc: base.RecoverableSimpleManyPvc(namespace, "mc3-data", "nfs-client", "20Gi", {
+            volumeName: "pvc-5b790223-82e3-4836-a886-4b77b012d005",
+            nfsPath: "/volume3/fs/game-mc3-data-pvc-5b790223-82e3-4836-a886-4b77b012d005",
+            nfsServer: "apollo1.dominion.lan",
+        }),
+        bluemap: bluemap.App(bluemap.Params {
+            namespace: namespace,
+            name: "bluemap",
+            filePath: std.thisFile,
+            configClaimName: "bluemap-config",
+            dataClaimName: "bluemap-data",
+            worldClaimName: "mc3-data",
+            webClaimName: "bluemap-web",
+        }),
+        bluemapIngress: nginxIngress.Ingress(nginxIngress.IngressParams {
+            namespace: namespace,
+            name: "mc3-map",
+            hosts: [
+                "mc3-map.csbx.dev",
+            ],
+            serviceName: "bluemap-ui",
+        }),
+        app: minecraftServer.App(minecraftServer.Params {
+            namespace: namespace,
+            name: "mc3",
+            filePath: std.thisFile,
+            // Defined in "game"
+            dataClaimName: "mc3-data",
+        }),
+        nodeport: base.Service(namespace, "mc3-nodeports") {
+            spec+: {
+                type: "NodePort",
+                selector: {
+                    name: "mc3",
+                    phase: "prod",
+                },
+                ports: [
+                    {
+                        name: "minecraft-udp",
+                        port: 25565,
+                        protocol: "UDP",
+                        targetPort: 25565,
+                        nodePort: 32565,
+                    },
+                    {
+                        name: "minecraft-tcp",
+                        port: 25565,
+                        protocol: "TCP",
+                        targetPort: 25565,
+                        nodePort: 32565,
+                    },
+                ],
+            }
+        },
+        ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+            namespace: namespace,
+            name: "mc3",
+            hosts: [
+                "mc3.csbx.dev",
+                "mc3.cheapassbox.com",
+            ],
+            serviceName: "mc3-ui",
+        }),
+    },
+    */
+    /*
+    minecraftServer: {
+        mc1Pvc: kube.RecoverableSimpleManyPvc(namespace, "mc1-data", "nfs-client", "20Gi", {
+            volumeName: "pvc-b0e1c6d2-d796-4c0a-bef3-8239301e2b8a",
+            nfsPath: "/volume3/fs/game-mc1-data-pvc-b0e1c6d2-d796-4c0a-bef3-8239301e2b8a",
+            nfsServer: "apollo1.dominion.lan",
+        }),
+        app: minecraftServer.App(minecraftServer.Params {
+            namespace: namespace,
+            name: "mc1",
+            filePath: std.thisFile,
+            // Defined in "game"
+            dataClaimName: "mc1-data",
+        }),
+        nodeport: kube.Service(namespace, "mc1-nodeports") {
+            spec+: {
+            type: "NodePort",
+            selector: {
+                name: "mc1",
+                phase: "prod",
+            },
+            ports: [
+                {
+                    name: "minecraft-udp",
+                    port: 25565,
+                    protocol: "UDP",
+                    targetPort: 25565,
+                    nodePort: 32565,
+                },
+                {
+                    name: "minecraft-tcp",
+                    port: 25565,
+                    protocol: "TCP",
+                    targetPort: 25565,
+                    nodePort: 32565,
+                },
+            ],
+            }
+        },
+        ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+            namespace: namespace,
+            name: "mc1",
+            hosts: [
+                "mc1.csbx.dev",
+                "mc1.cheapassbox.com",
+            ],
+            serviceName: "mc1-ui",
+        }),
+        }
+    },
+    */
+    /*
+    palworld: {
+        pvcs: {
+            palworldPvc: kube.RecoverableSimpleManyPvc(namespace, "palworld-data", "nfs-client", "20Gi", {
+                volumeName: "pvc-66037b7e-7edd-46b0-b26e-821df8188dd2",
+                nfsPath: "/volume3/fs/game-palworld-data-pvc-66037b7e-7edd-46b0-b26e-821df8188dd2",
+                nfsServer: "apollo1.dominion.lan",
+            }),
+            palworld2Pvc: kube.RecoverableSimpleManyPvc(namespace, "palworld-second-data", "nfs-client", "20Gi", {
+                volumeName: "pvc-a4932e90-d0fa-4628-946c-7676aa6408dc",
+                nfsPath: "/volume3/fs/game-palworld-second-data-pvc-a4932e90-d0fa-4628-946c-7676aa6408dc",
+                nfsServer: "apollo1.dominion.lan",
+            }),
+            palworld3Pvc: kube.RecoverableSimpleManyPvc(namespace, "palworld-third-data", "nfs-client", "20Gi", {
+                volumeName: "pvc-15bc4437-be4b-4451-a778-e0fdb9ad9bc6",
+                nfsPath: "/volume3/fs/game-palworld-third-data-pvc-15bc4437-be4b-4451-a778-e0fdb9ad9bc6",
+                nfsServer: "apollo1.dominion.lan",
+            }),
+        },
+        world1: {
+            app: palworld.App(palworld.Params {
+                namespace: namespace,
+                name: "palworld",
+                configMapName: "palworld-config",
+                filePath: std.thisFile,
+                // Defined in "game"
+                //dataClaimName: "palworld-data",
+                dataClaimName: "palworld-third-data",
+                gameNodePort: 32520,
+                queryNodePort: 32521,
+            }),
+            ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "palworld",
+                hosts: [
+                    "palworld.csbx.dev",
+                    "pal.csbx.dev",
+                ],
+                serviceName: "palworld-game",
+            }),
+        },
+        world2: {
+            local _params = palworld.Params {
+                namespace: namespace,
+                name: "palworld2",
+                configMapName: "palworld2-config",
+                filePath: std.thisFile,
+                // Defined in "game"
+                dataClaimName: "palworld-data",
+                gameNodePort: 32522,
+                queryNodePort: 32523,
+                lsParams +: {
+                    resources: {
+                    requests: {
+                        cpu: "1000m",
+                        memory: "6Gi",
+                    },
+                    limits: {
+                        cpu: "2000m",
+                        memory: "11Gi",
+                    },
+                    },
+                },
+            },
+            configmap: palworld.ConfigMap($._params),
+            app: palworld.App($._params),
+            ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "palworld2",
+                hosts: [
+                    "pal2.csbx.dev",
+                ],
+                serviceName: "palworld2-game",
+            }),
+        },
+    },
+    */
+}
\ No newline at end of file
diff --git a/k8s/configs/environments/game/spec.json b/k8s/configs/environments/game/spec.json
new file mode 100644
index 0000000..4e305d8
--- /dev/null
+++ b/k8s/configs/environments/game/spec.json
@@ -0,0 +1,15 @@
+{
+  "apiVersion": "tanka.dev/v1alpha1",
+  "kind": "Environment",
+  "metadata": {
+    "name": "environments/game",
+    "namespace": "environments/game/main.jsonnet"
+  },
+  "spec": {
+    "apiServer": "https://k8s.dominion.lan:6443",
+    "namespace": "game",
+    "resourceDefaults": {},
+    "expectVersions": {},
+    "injectLabels": true
+  }
+}
diff --git a/k8s/configs/environments/home/BUILD.bazel b/k8s/configs/environments/home/BUILD.bazel
new file mode 100644
index 0000000..fa00173
--- /dev/null
+++ b/k8s/configs/environments/home/BUILD.bazel
@@ -0,0 +1,31 @@
+load("@rules_jsonnet//jsonnet:jsonnet.bzl", "jsonnet_library", "jsonnet_to_json", "jsonnet_to_json_test")
+load("//tools:tanka.bzl", "tanka_environment")
+load("//tools:sops.bzl", "sops_decrypt")
+
+sops_decrypt(
+    name = "secrets",
+    src = "secrets.sops.yaml",
+    out = "secrets.json",
+)
+
+jsonnet_library(
+    name = "secrets_lib",
+    srcs = [":secrets"],
+)
+
+jsonnet_to_json(
+    name = "main",
+    src = "main.jsonnet",
+    outs = ["main.json"],
+    visibility = ["//visibility:public"],
+    deps = [
+        ":secrets_lib",
+        "//k8s/configs/templates",
+    ],
+)
+
+tanka_environment(
+    name = "home",
+    main = ":main",
+    spec = "spec.json",
+)
diff --git a/k8s/configs/environments/home/main.jsonnet b/k8s/configs/environments/home/main.jsonnet
new file mode 100644
index 0000000..fed7d9e
--- /dev/null
+++ b/k8s/configs/environments/home/main.jsonnet
@@ -0,0 +1,269 @@
+local base = import "k8s/configs/base.libsonnet";
+local secrets = import "k8s/configs/environments/home/secrets.json";
+
+local images = import "k8s/configs/images.libsonnet";
+
+local mosquitto = import "k8s/configs/templates/core/pubsub/eclipse-mosquitto.libsonnet";
+local nginxIngress = import "k8s/configs/templates/core/network/nginx-ingress.libsonnet";
+
+local frigate = import "k8s/configs/templates/personal/home/frigate-nvr.libsonnet";
+local grocy = import "k8s/configs/templates/personal/home/grocy.libsonnet";
+local homeAssistant = import "k8s/configs/templates/personal/home/home-assistant.libsonnet";
+local paperlessNg = import "k8s/configs/templates/personal/home/paperless-ng.libsonnet";
+
+local kiwix = import "k8s/configs/templates/personal/media/kiwix.libsonnet";
+local bookstack = import "k8s/configs/templates/personal/media/bookstack.libsonnet";
+
+local rclone = import "k8s/configs/templates/dev/tools/rclone.libsonnet";
+local focalboard = import "k8s/configs/templates/dev/organization/focalboard.libsonnet";
+
+local nocodb = import "k8s/configs/templates/core/storage/nocodb.libsonnet";
+local postgres = import "k8s/configs/templates/core/storage/postgres.libsonnet";
+local mariadb = import "k8s/configs/templates/core/storage/mariadb.libsonnet";
+local redis = import "k8s/configs/templates/core/storage/redis.libsonnet";
+
+local namespace = "home";
+local ctx = base.NewContext(base.helm);
+{
+    namespace: {
+        apiVersion: "v1",
+        kind: "Namespace",
+        metadata: {
+            name: namespace,
+        },
+    },
+    secrets: {
+        bookstack: mariadb.Secret(mariadb.SecretParams{
+            name: "bookstack",
+            namespace: "home",
+            rootPassword: secrets.bookstack_mariadb_root_db_pwd,
+            password: secrets.bookstack_mariadb_db_pwd,
+        }) {
+            data+: {
+                "bookstack-app-key": secrets.bookstack_app_key,
+            },
+        },
+        nocodb: base.Secret("home", "nocodb-secret") {
+            type: "Opaque",
+            data: {
+                "nocodb-metadata-db-pwd": secrets.nocodb_pwd,
+                "nocodb-metadata-db-url": secrets.nocodb_db_url,
+            },
+        },
+        paperless: base.Secret("home", "paperless-secret") {
+            type: "Opaque",
+            data: {
+                "paperless-db-pwd": secrets.paperless_db_pwd,
+            },
+        },
+    },
+    apps: {
+        /*
+        focalboard: {
+            dataPvc: base.RecoverableSimpleManyPvc(namespace, "focalboard-data", "nfs-client", "20Gi", {
+                nfsServer: "apollo1.dominion.lan",
+                volumeName: "pvc-bbe88409-1751-4de1-a4a7-332f97a1273a",
+                nfsPath:      "/volume3/fs/home-focalboard-data-pvc-bbe88409-1751-4de1-a4a7-332f97a1273a",
+            }),
+            app: focalboard.App(focalboard.Params {
+                namespace: namespace,
+                name: "focalboard",
+                filePath: std.thisFile,
+                dataClaimName: "focalboard-data",
+            }),
+            ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "focalboard",
+                hosts: [
+                    "focal.csbx.dev",
+                ],
+                serviceName: "focalboard-ui",
+                annotations: nginxIngress.KubeCsbxOauthProxyAnnotations,
+            }),
+        },
+        */
+        frigate: {
+            dbPvc: base.RecoverableSimpleManyPvc(namespace, "frigate-db", "nfs-client", "50Gi", {
+                nfsServer: "apollo1.dominion.lan",
+                volumeName: "pvc-af5280f0-330e-496c-a125-35c8e834a107",
+                nfsPath:      "/volume3/fs/home-frigate-db-pvc-af5280f0-330e-496c-a125-35c8e834a107",
+            }),
+            configPvc: base.RecoverableSimpleManyPvc(namespace, "frigate-config", "nfs-client", "50Gi", {
+                nfsServer: "apollo1.dominion.lan",
+                volumeName: "pvc-92a06096-0cb3-4df5-abe4-d6c832e95e9f",
+                nfsPath:      "/volume3/fs/home-frigate-config-pvc-92a06096-0cb3-4df5-abe4-d6c832e95e9f",
+            }),
+            storagePvc: base.RecoverableSimpleManyPvc(namespace, "frigate-storage", "nfs-bulk", "500Gi", {
+                nfsServer: "apollo2.dominion.lan",
+                volumeName: "pvc-2afd5369-c177-4663-bd69-e8caa634650f",
+                nfsPath:      "/volume4/fs-bulk/home-frigate-storage-pvc-2afd5369-c177-4663-bd69-e8caa634650f",
+            }),
+            mosquittoPvc: base.RecoverableSimpleManyPvc(namespace, "mosquitto-frigate", "nfs-client", "5Gi", {
+                nfsServer: "apollo1.dominion.lan",
+                volumeName: "pvc-e616229c-3fe6-4db0-84c1-b8cf77256ff4",
+                nfsPath:      "/volume3/fs/home-mosquitto-frigate-pvc-e616229c-3fe6-4db0-84c1-b8cf77256ff4",
+            }),
+            mosquito: mosquitto.App(mosquitto.Params {
+                namespace: namespace,
+                name: "mosquitto-frigate",
+                filePath: std.thisFile,
+                mosquittoDataClaimName: "mosquitto-frigate",
+            }),
+            app: frigate.App(frigate.Params {
+                namespace: namespace,
+                name: "frigate",
+                filePath: std.thisFile,
+                // Defined in "home"
+                dbClaimName: "frigate-db",
+                storageClaimName: "frigate-storage",
+                configClaimName: "frigate-config",
+                mqttAddress: "mosquitto-frigate-api.home.svc.cluster.local",
+                rtspNodePort: 32702,
+                frigateRtspPwd: secrets.frigate_rtsp_pwd,
+                frigateGarageSourceRtsp: secrets.frigate_garage_source_rtsp,
+            }),
+            ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "frigate",
+                hosts: [
+                "frigate.cheapassbox.com",
+                ],
+                serviceName: "frigate-ui",
+                annotations: nginxIngress.KubeOauthProxyAnnotations,
+            }),
+            ingress2: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "frigate-csbx",
+                hosts: [
+                "frigate.csbx.dev",
+                ],
+                serviceName: "frigate-ui",
+                annotations: nginxIngress.KubeCsbxOauthProxyAnnotations,
+            }),
+        },
+        grocy: {
+            dataPvc: base.RecoverableSimpleManyPvc(namespace, "grocy-data", "nfs-client", "50Gi", {
+                nfsServer: "apollo1.dominion.lan",
+                volumeName: "pvc-a251012c-4ef7-4224-87dd-0e39d87c3491",
+                nfsPath: "/volume3/fs/home-grocy-data-pvc-a251012c-4ef7-4224-87dd-0e39d87c3491",
+            }),
+            app: grocy.App(grocy.Params {
+                namespace: namespace,
+                name: "grocy",
+                filePath: std.thisFile,
+                // Defined in "home"
+                dataClaimName: "grocy-data",
+                ingressHost: 'grocy.cheapassbox.com',
+            }),
+            ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "grocy-csbx",
+                hosts: [
+                    "grocy.csbx.dev",
+                ],
+                serviceName: "grocy-ui",
+                annotations: nginxIngress.KubeCsbxOauthProxyAnnotations,
+            }),
+        },
+        homeAssistant: {
+            pvc: base.RecoverableSimpleManyPvc(namespace, "home-assistant-files2", "nfs-client", "5Gi", {
+                nfsServer: "apollo1.dominion.lan",
+                volumeName: "pvc-99f5c928-499b-4206-b301-d25f5eb7279d",
+                nfsPath:      "/volume3/fs/home-home-assistant-files-pvc-99f5c928-499b-4206-b301-d25f5eb7279d",
+            }),
+            app: homeAssistant.App(homeAssistant.Params {
+                namespace: namespace,
+                name: "home-assistant",
+                filePath: std.thisFile,
+                filesClaimName: "home-assistant-files2",
+            }),
+            ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "home-assistant",
+                hosts: [
+                "ha.cheapassbox.com",
+                ],
+                serviceName: "home-assistant-ui",
+                annotations: nginxIngress.KubeOauthProxyAnnotations,
+            }),
+            ingress2: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "home-assistant-csbx",
+                hosts: [
+                "ha.csbx.dev",
+                ],
+                serviceName: "home-assistant-ui",
+                annotations: nginxIngress.KubeCsbxOauthProxyAnnotations,
+            }),
+        },
+        paperlessNg: {
+            configPvc: base.RecoverableSimpleManyPvc(namespace, "paperless-config", "nfs-client", "15Gi", {
+                nfsServer: "apollo1.dominion.lan",
+                volumeName: "pvc-919bde50-5063-4c7c-8684-4e0c1b70a266",
+                nfsPath:      "/volume3/fs/home-paperless-config-pvc-919bde50-5063-4c7c-8684-4e0c1b70a266",
+            }),
+            pg17Pvc: base.RecoverableSimpleManyPvc(namespace, "paperless-pg-17", "nfs-client", "16Gi", {
+                nfsServer: "apollo1.dominion.lan",
+                volumeName: "pvc-d05b4ff0-30d1-4891-830e-3ba1ddb83756",
+                nfsPath:      "/volume3/fs/home-paperless-pg-17-pvc-d05b4ff0-30d1-4891-830e-3ba1ddb83756",
+            }),
+            dataPvc: base.RecoverableSimpleManyPvc(namespace, "paperless-data", "nfs-bulk", "100Gi", {
+                nfsServer: "apollo2.dominion.lan",
+                volumeName: "pvc-1818cac4-34ec-470a-9c28-f13c96bf1f44",
+                nfsPath:      "/volume4/fs-bulk/home-paperless-data-pvc-1818cac4-34ec-470a-9c28-f13c96bf1f44",
+            }),
+            rclonePvc: base.RecoverableSimpleManyPvc(namespace, "rclone-paperless-config", "nfs-client", "1Gi", {
+                nfsServer: "apollo1.dominion.lan",
+                volumeName: "pvc-62035a35-84ba-4f3a-82bc-3bccd31b749a",
+                nfsPath:      "/volume3/fs/home-rclone-paperless-config-pvc-62035a35-84ba-4f3a-82bc-3bccd31b749a"
+            }),
+            db17App: postgres.App(postgres.Params {
+                namespace: namespace,
+                name: "paperless-pg-17",
+                filePath: std.thisFile,
+                // TODO:
+                image: "docker.io/bitnami/postgresql:17.2.0",
+                // Defined in "//kube/cfg/secrets/media.jsonnet"
+                dataClaimName: "paperless-pg-17",
+                dbName: "paperless",
+                dbUser: "paperless",
+                // Defined in "//kube/cfg/secrets/media.jsonnet"
+                dbPwdSecret: "paperless-secret",
+                dbPwdSecretKey: "paperless-db-pwd",
+            }),
+            redis: redis.App(redis.Params {
+                namespace: namespace,
+                name: "paperless-ng-redis",
+                filePath: std.thisFile,
+            }),
+            app: paperlessNg.App(paperlessNg.Params {
+                namespace: namespace,
+                name: "paperless-ng",
+                filePath: std.thisFile,
+                redisHost: "redis://paperless-ng-redis-ui.home.svc.cluster.local:80",
+                postgresHost: "paperless-pg-17.home.svc.cluster.local",
+                configClaimName: "paperless-config",
+                dataClaimName: "paperless-data",
+                postgresPwdSecret: "paperless-secret",
+                postgresPwdSecretKey: "paperless-db-pwd",
+            }),
+            rcloneCron: rclone.Cron(rclone.Params {
+                schedule: "0,20,40 * * * *",
+                namespace: namespace,
+                name: "rclone-paperless",
+                filePath: std.thisFile,
+                // Defined in "home"
+                configClaimName: "rclone-paperless-config",
+                dataClaimName: "paperless-data",
+            }),
+            ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "paperless-ng",
+                hosts: [
+                    "paperless.csbx.dev",
+                ],
+                serviceName: "paperless-ng-ui",
+            }),
+        },
+    },
+}
\ No newline at end of file
diff --git a/k8s/configs/environments/home/spec.json b/k8s/configs/environments/home/spec.json
new file mode 100644
index 0000000..1be8ae2
--- /dev/null
+++ b/k8s/configs/environments/home/spec.json
@@ -0,0 +1,15 @@
+{
+  "apiVersion": "tanka.dev/v1alpha1",
+  "kind": "Environment",
+  "metadata": {
+    "name": "environments/home",
+    "namespace": "environments/home/main.jsonnet"
+  },
+  "spec": {
+    "apiServer": "https://k8s.dominion.lan:6443",
+    "namespace": "home",
+    "resourceDefaults": {},
+    "expectVersions": {},
+    "injectLabels": true
+  }
+}
diff --git a/k8s/configs/environments/jupyter/BUILD.bazel b/k8s/configs/environments/jupyter/BUILD.bazel
new file mode 100644
index 0000000..536d03c
--- /dev/null
+++ b/k8s/configs/environments/jupyter/BUILD.bazel
@@ -0,0 +1,19 @@
+load("@rules_jsonnet//jsonnet:jsonnet.bzl", "jsonnet_library", "jsonnet_to_json")
+load("//tools:tanka.bzl", "tanka_environment")
+
+jsonnet_to_json(
+    name = "main",
+    src = "main.jsonnet",
+    outs = ["main.json"],
+    visibility = ["//visibility:public"],
+    deps = [
+        "//k8s/configs:base",
+        "//k8s/configs/templates",
+    ],
+)
+
+tanka_environment(
+    name = "jupyter",
+    main = ":main",
+    spec = "spec.json",
+)
diff --git a/k8s/configs/environments/jupyter/main.jsonnet b/k8s/configs/environments/jupyter/main.jsonnet
new file mode 100644
index 0000000..00659db
--- /dev/null
+++ b/k8s/configs/environments/jupyter/main.jsonnet
@@ -0,0 +1,36 @@
+local base = import "k8s/configs/base.libsonnet";
+local jupyter = import "k8s/configs/templates/dev/ide/jupyter.libsonnet";
+local nginxIngress = import "k8s/configs/templates/core/network/nginx-ingress.libsonnet";
+
+local namespace = "jupyter-env";
+
+{
+  namespace: {
+    apiVersion: "v1",
+    kind: "Namespace",
+    metadata: {
+      name: namespace,
+    },
+  },
+  
+  jupyterPvc: base.RecoverableSimpleManyPvc(namespace, "jupyter-data", "nfs-client", "10Gi", {
+      volumeName: "pvc-1f67b46e-3037-49ae-a861-adce21791f86",
+      nfsPath: "/volume3/fs/jupyter-env-jupyter-data-pvc-1f67b46e-3037-49ae-a861-adce21791f86",
+      nfsServer: "apollo1.dominion.lan",
+  }),
+
+  app: jupyter.App(jupyter.Params {
+    namespace: namespace,
+    name: "jupyter",
+    filePath: std.thisFile,
+    filesClaimName: "jupyter-data",
+  }),
+
+  ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+    namespace: namespace,
+    name: "jupyter-ui",
+    hosts: ["jupyter.csbx.dev"],
+    serviceName: "jupyter-ui",
+    annotations: nginxIngress.KubeCsbxOauthProxyAnnotations,
+  }),
+}
\ No newline at end of file
diff --git a/k8s/configs/environments/jupyter/spec.json b/k8s/configs/environments/jupyter/spec.json
new file mode 100644
index 0000000..051f13d
--- /dev/null
+++ b/k8s/configs/environments/jupyter/spec.json
@@ -0,0 +1,15 @@
+{
+  "apiVersion": "tanka.dev/v1alpha1",
+  "kind": "Environment",
+  "metadata": {
+    "name": "environments/jupyter",
+    "namespace": "environments/jupyter/main.jsonnet"
+  },
+  "spec": {
+    "apiServer": "https://k8s.dominion.lan:6443",
+    "namespace": "jupyter-env",
+    "resourceDefaults": {},
+    "expectVersions": {},
+    "injectLabels": true
+  }
+}
diff --git a/k8s/configs/environments/media/BUILD.bazel b/k8s/configs/environments/media/BUILD.bazel
new file mode 100644
index 0000000..915d8c9
--- /dev/null
+++ b/k8s/configs/environments/media/BUILD.bazel
@@ -0,0 +1,31 @@
+load("@rules_jsonnet//jsonnet:jsonnet.bzl", "jsonnet_library", "jsonnet_to_json")
+load("//tools:sops.bzl", "sops_decrypt")
+load("//tools:tanka.bzl", "tanka_environment")
+
+sops_decrypt(
+    name = "secrets",
+    src = "secrets.sops.yaml",
+    out = "secrets.json",
+)
+
+jsonnet_library(
+    name = "secrets_lib",
+    srcs = [":secrets"],
+)
+
+jsonnet_to_json(
+    name = "main",
+    src = "main.jsonnet",
+    outs = ["main.json"],
+    visibility = ["//visibility:public"],
+    deps = [
+        ":secrets_lib",
+        "//k8s/configs/templates",
+    ],
+)
+
+tanka_environment(
+    name = "media",
+    main = ":main",
+    spec = "spec.json",
+)
diff --git a/k8s/configs/environments/media/main.jsonnet b/k8s/configs/environments/media/main.jsonnet
new file mode 100644
index 0000000..a7432d0
--- /dev/null
+++ b/k8s/configs/environments/media/main.jsonnet
@@ -0,0 +1,473 @@
+local base = import "k8s/configs/base.libsonnet";
+local secrets = import "k8s/configs/environments/media/secrets.json";
+
+local audiobookshelf = import "k8s/configs/templates/personal/media/audiobookshelf.libsonnet";
+local jellyfin = import "k8s/configs/templates/personal/media/jellyfin.libsonnet";
+local medusa = import "k8s/configs/templates/personal/media/medusa.libsonnet";
+local overseerr = import "k8s/configs/templates/personal/media/overseerr.libsonnet";
+local radarr = import "k8s/configs/templates/personal/media/radarr.libsonnet";
+local readarr = import "k8s/configs/templates/personal/media/readarr.libsonnet";
+local sabnzbd = import "k8s/configs/templates/personal/media/sabnzbd.libsonnet";
+local sonarr = import "k8s/configs/templates/personal/media/sonarr.libsonnet";
+local transmission = import "k8s/configs/templates/personal/media/transmission.libsonnet";
+
+local nginxIngress = import "k8s/configs/templates/core/network/nginx-ingress.libsonnet";
+local postgres = import "k8s/configs/templates/core/storage/postgres.libsonnet";
+local namespace = "media";
+local ctx = base.NewContext(base.helm);
+{
+    namespace: {
+        apiVersion: "v1",
+        kind: "Namespace",
+        metadata: {
+            name: namespace,
+        },
+    },
+    secrets: {
+        sonarr: base.Secret("media", "sonarr") {
+            type: "Opaque",
+            data: {
+                sonarr_pwd: secrets.sonarr_pwd,
+                sonarr_db_pwd: secrets.sonarr_db_pwd,
+            },
+        },
+    },
+    apps: {
+        audiobookshelf: {
+            audiobookPvc: base.RecoverableSimpleManyPvc(namespace, "audiobookshelf-audiobooks", "nfs-bulk", "200Gi",{
+                nfsServer: "apollo2.dominion.lan",
+                volumeName: "pvc-37984a4e-9d89-4d5d-b348-bd5e25c81920",
+                nfsPath:      "/volume4/fs-bulk/home-audiobookshelf-audiobooks-pvc-37984a4e-9d89-4d5d-b348-bd5e25c81920",
+            }),
+            podcastPvc: base.RecoverableSimpleManyPvc(namespace, "audiobookshelf-podcasts", "nfs-bulk", "100Gi", {
+                nfsServer: "apollo2.dominion.lan",
+                volumeName: "pvc-553b981b-2cfb-4bdc-9ced-7e61e2444135",
+                nfsPath:      "/volume4/fs-bulk/home-audiobookshelf-podcasts-pvc-553b981b-2cfb-4bdc-9ced-7e61e2444135",
+            }),
+            configPvc: base.RecoverableSimpleManyPvc(namespace, "audiobookshelf-config", "nfs-client", "2Gi", {
+                nfsServer: "apollo1.dominion.lan",
+                volumeName: "pvc-fc159333-7d10-43d2-b5b7-9bf5c2a90756",
+                nfsPath:      "/volume3/fs/home-audiobookshelf-config-pvc-fc159333-7d10-43d2-b5b7-9bf5c2a90756",
+            }),
+            metadataPvc: base.RecoverableSimpleManyPvc(namespace, "audiobookshelf-metadata", "nfs-client", "20Gi", {
+                nfsServer: "apollo1.dominion.lan",
+                volumeName: "pvc-e5d188d0-a865-48d6-9b73-d52e51968b09",
+                nfsPath:      "/volume3/fs/home-audiobookshelf-metadata-pvc-e5d188d0-a865-48d6-9b73-d52e51968b09",
+            }),
+            app: audiobookshelf.App(audiobookshelf.Params {
+                namespace: namespace,
+                name: "audiobookshelf",
+                filePath: std.thisFile,
+                // Defined in "home"
+                audiobookClaimName: "audiobookshelf-audiobooks",
+                podcastClaimName: "audiobookshelf-podcasts",
+                configClaimName: "audiobookshelf-config",
+                metadataClaimName: "audiobookshelf-metadata",
+            }),
+            ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "audiobookshelf",
+                hosts: [
+                    "audiobook.csbx.dev",
+                ],
+                serviceName: "audiobookshelf-ui",
+            }),
+        },
+        jellyfin: {
+            seriesLakePvc: base.RecoverableSimpleManyPvc(namespace, "series-lake", "nfs-bulk", "1Ti", {
+                volumeName: "pvc-25d9b914-8f6b-11e9-b70e-b8aeed7dc356",
+                nfsPath: "/volume4/fs-bulk/media-series-lake-pvc-25d9b914-8f6b-11e9-b70e-b8aeed7dc356",
+                nfsServer: "apollo2.dominion.lan",
+            }),
+            embyMoviesPvc: base.RecoverableSimpleManyPvc(namespace, "emby-movies", "nfs-bulk", "200Gi", {
+                volumeName: "pvc-55dbf5e3-2b7d-11ea-9568-b8aeed7dc356",
+                nfsPath: "/volume4/fs-bulk/media-emby-movies-pvc-55dbf5e3-2b7d-11ea-9568-b8aeed7dc356",
+                nfsServer: "apollo2.dominion.lan",
+            }),
+            configPvc: base.RecoverableSimpleManyPvc(namespace, "jellyfin-config", "nfs-client", "10Gi", {
+                volumeName: "pvc-74dbcc56-ecb1-42a7-a58e-9f99812ade7b",
+                nfsPath: "/volume3/fs/media-jellyfin-config-pvc-74dbcc56-ecb1-42a7-a58e-9f99812ade7b",
+                nfsServer: "apollo1.dominion.lan",
+            }),
+            animeConfigPvc: base.RecoverableSimpleManyPvc(namespace, "jellyfin-anime-config", "nfs-client", "10Gi", {
+                volumeName: "pvc-080c47bf-d4ab-4c54-a5ea-004af6efafb9",
+                nfsPath: "/volume3/fs/media-jellyfin-anime-config-pvc-080c47bf-d4ab-4c54-a5ea-004af6efafb9",
+                nfsServer: "apollo1.dominion.lan",
+            }),
+            transcodePvc: base.RecoverableSimpleManyPvc(namespace, "jellyfin-transcode", "nfs-client", "200Gi", {
+                volumeName: "pvc-cad1fdcd-a5eb-4f18-b248-f10d2f3c7e49",
+                nfsPath: "/volume3/fs/media-jellyfin-transcode-pvc-cad1fdcd-a5eb-4f18-b248-f10d2f3c7e49",
+                nfsServer: "apollo1.dominion.lan",
+            }),
+            animeSeriesPvc: base.RecoverableSimpleManyPvc(namespace, "anime-series", "nfs-bulk", "1Ti", {
+                volumeName: "pvc-a80be844-bd62-4c27-842f-515e5d53da16",
+                nfsPath: "/volume4/fs-bulk/media-anime-series-pvc-a80be844-bd62-4c27-842f-515e5d53da16",
+                nfsServer: "apollo2.dominion.lan",
+            }),
+            animeMoviesPvc: base.RecoverableSimpleManyPvc(namespace, "anime-movies", "nfs-bulk", "200Gi", {
+                volumeName: "pvc-2b2be1de-3f07-405e-a6be-52e1ae887a2f",
+                nfsPath: "/volume4/fs-bulk/media-anime-movies-pvc-2b2be1de-3f07-405e-a6be-52e1ae887a2f",
+                nfsServer: "apollo2.dominion.lan",
+            }),
+            app: jellyfin.App(jellyfin.Params {
+                namespace: namespace,
+                name: "jellyfin",
+                filePath: std.thisFile,
+                // Defined in "media/pvc.jsonnet"
+                configClaimName: "jellyfin-config",
+                serialClaimName: "series-lake",
+                filmClaimName: "emby-movies",
+                animeSeriesClaimName: "anime-series",
+                animeMovieClaimName: "anime-movies",
+                transcodeClaimName: "jellyfin-transcode",
+                gpuNodeSelectorName: "nvidia"
+            }),
+            animeApp: jellyfin.App(jellyfin.Params {
+                namespace: namespace,
+                name: "jellyfin-anime",
+                filePath: std.thisFile,
+                configClaimName: "jellyfin-anime-config",
+                serialClaimName: "anime-series",
+                filmClaimName: "anime-movies",
+                transcodeClaimName: "jellyfin-transcode",
+                gpuNodeSelectorName: "nvidia",
+                lsParams+: {
+                    resources: {
+                        limits: {
+                            cpu: "1000m",
+                            memory: "3Gi",
+                        },
+                        requests: {
+                            cpu: "500m",
+                            memory: "1Gi",
+                        },
+                    },
+                },
+            }),
+            ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "jellyfin",
+                hosts: [
+                    "jellyfin.cheapassbox.com",
+                    "jellyfin.csbx.dev",
+                ],
+                serviceName: "jellyfin-ui",
+            }),
+            animeIngress: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "jellyfin-anime",
+                hosts: [
+                    "anime.cheapassbox.com",
+                    "anime.csbx.dev",
+                ],
+                serviceName: "jellyfin-anime-ui",
+            }),
+        },
+        /*
+        medusa: {
+            medusaConfig: base.RecoverableSimpleManyPvc(namespace, "medusa-config", "nfs-client", "50Gi", {
+                volumeName: "pvc-3e7f00bd-a03f-11e9-bad8-b8aeed7dc356",
+                nfsPath: "/volume3/fs/media-medusa-config-pvc-3e7f00bd-a03f-11e9-bad8-b8aeed7dc356",
+                nfsServer: "apollo1.dominion.lan",
+            }),
+            app: medusa.App(medusa.Params {
+                namespace: namespace,
+                name: "medusa",
+                filePath: std.thisFile,
+                // Defined in "media"
+                configClaimName: "medusa-config",
+                // Defined in "media"
+                downloadsClaimName: "sabnzbd-downloads",
+                // Defined in "media"
+                tvSeriesClaimName: "series-lake",
+                // Defined in "media"
+                torrentFilesClaimName: "torrent-files",
+            }),
+            ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "medusa",
+                hosts: [
+                    "medusa.csbx.dev",
+                ],
+                serviceName: "medusa-ui",
+                annotations: nginxIngress.KubeCsbxOauthProxyAnnotations,
+            }),
+        },
+        */
+        overseerr: {
+            configPvc: base.RecoverableSimpleManyPvc(namespace, "overseerr-config", "nfs-client", "1Gi", {
+                volumeName: "pvc-6127be61-cfc9-4368-8a26-033d6aded518",
+                nfsPath: "/volume3/fs/media-overseerr-config-pvc-6127be61-cfc9-4368-8a26-033d6aded518",
+                nfsServer: "apollo1.dominion.lan",
+            }),
+            app: overseerr.App(overseerr.Params {
+                namespace: namespace,
+                name: "overseerr",
+                filePath: std.thisFile,
+                // Defined in "media"
+                configClaimName: "overseerr-config",
+            }),
+            ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "overseerr-alt",
+                hosts: [
+                    "overseerr.cheapassbox.com",
+                    "jellyseerr.csbx.dev",
+                ],
+                serviceName: "overseerr-ui",
+            }),
+        },
+        radarr: {
+            configPvc: base.RecoverableSimplePvc(namespace, "radarr-config", "nfs-client", "200Mi", {
+                volumeName: "pvc-3498101c-2b74-11ea-9568-b8aeed7dc356",
+                nfsPath: "/volume3/fs/media-radarr-config-pvc-3498101c-2b74-11ea-9568-b8aeed7dc356",
+                nfsServer: "apollo1.dominion.lan",
+            }),
+            app: radarr.App(radarr.Params {
+                namespace: namespace,
+                name: "radarr",
+                filePath: std.thisFile,
+                // Defined in "media"
+                configClaimName: "radarr-config",
+                // Defined in "media"
+                downloadsClaimName: "sabnzbd-downloads",
+                downloadsSubdirectory: null,
+                // Defined in "media"
+                moviesClaimName: "emby-movies",
+            }),
+            ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "radarr",
+                hosts: [
+                    "radarr.cheapassbox.com",
+                ],
+                serviceName: "radarr-ui",
+                annotations: nginxIngress.KubeOauthProxyAnnotations,
+            }),
+            ingress2: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "radarr-csbx",
+                hosts: [
+                    "radarr.csbx.dev",
+                ],
+                serviceName: "radarr-ui",
+                annotations: nginxIngress.KubeCsbxOauthProxyAnnotations,
+            }),
+        },
+        sabnzbd: {
+            configPvc: base.RecoverableSimplePvc(namespace, "sabnzbd-config", "nfs-client", "500Mi", {
+                volumeName: "pvc-f623f46b-2b6f-11ea-9568-b8aeed7dc356",
+                nfsPath: "/volume3/fs/media-sabnzbd-config-pvc-f623f46b-2b6f-11ea-9568-b8aeed7dc356",
+                nfsServer: "apollo1.dominion.lan",
+            }),
+            downloadsLakePvc: base.RecoverableSimpleManyPvc(namespace, "downloads-lake", "nfs-bulk", "100Gi", {
+                volumeName: "pvc-25dc4b81-8f6b-11e9-b70e-b8aeed7dc356",
+                nfsPath: "/volume4/fs-bulk/media-downloads-lake-pvc-25dc4b81-8f6b-11e9-b70e-b8aeed7dc356",
+                nfsServer: "apollo2.dominion.lan",
+            }),
+            sabnzbdDownloadsPvc: base.RecoverableSimpleManyPvc(namespace, "sabnzbd-downloads", "nfs-bulk", "500Gi", {
+                volumeName: "pvc-34ed7806-2b74-11ea-9568-b8aeed7dc356",
+                nfsPath: "/volume4/fs-bulk/media-sabnzbd-downloads-pvc-34ed7806-2b74-11ea-9568-b8aeed7dc356",
+                nfsServer: "apollo2.dominion.lan",
+            }),
+            sabnzbdIncompleteDownloadsPvc: base.RecoverableSimpleManyPvc(namespace, "sabnzbd-incomplete-downloads", "nfs-bulk", "200Gi", {
+                volumeName: "pvc-352a82d2-2b74-11ea-9568-b8aeed7dc356",
+                nfsPath: "/volume4/fs-bulk/media-sabnzbd-incomplete-downloads-pvc-352a82d2-2b74-11ea-9568-b8aeed7dc356",
+                nfsServer: "apollo2.dominion.lan",
+            }),
+
+            app: sabnzbd.App(sabnzbd.Params {
+                namespace: namespace,
+                name: "sabnzbd",
+                filePath: std.thisFile,
+                // Defined in "media"
+                configClaimName: "sabnzbd-config",
+                // Defined in "media"
+                incompleteDownloadsClaimName: "sabnzbd-incomplete-downloads",
+                // Defined in "media"
+                downloadsClaimName: "sabnzbd-downloads",
+            }),
+            ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "sabnzbd",
+                hosts: [
+                    "sabnzbd.cheapassbox.com",
+                ],
+                serviceName: "sabnzbd-ui",
+                annotations: nginxIngress.KubeOauthProxyAnnotations,
+            }),
+            ingress2: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "sabnzbd-csbx",
+                hosts: [
+                    "sabnzbd.csbx.dev",
+                ],
+                serviceName: "sabnzbd-ui",
+                annotations: nginxIngress.KubeCsbxOauthProxyAnnotations,
+            }),
+        },
+        sonarr: {
+            regular: {
+                configPvc: base.RecoverableSimplePvc(namespace, "sonarr-config", "nfs-client", "200Mi", {
+                    volumeName: "pvc-358613d9-2b74-11ea-9568-b8aeed7dc356",
+                    nfsPath: "/volume3/fs/media-sonarr-config-pvc-358613d9-2b74-11ea-9568-b8aeed7dc356",
+                    nfsServer: "apollo1.dominion.lan",
+                }),
+                db17Pvc: base.RecoverableSimpleManyPvc(namespace, "sonarr-pg-17", "nfs-client", "50Gi", {
+                    volumeName: "pvc-6c49c704-c33b-4159-8ceb-b87470a4f323",
+                    nfsPath: "/volume3/fs/media-sonarr-pg-17-pvc-6c49c704-c33b-4159-8ceb-b87470a4f323",
+                    nfsServer: "apollo1.dominion.lan",
+                }),
+                db17App: postgres.App(postgres.Params {
+                    namespace: namespace,
+                    name: "sonarr-pg-17",
+                    // TODO:
+                    image: "docker.io/bitnami/postgresql:17.2.0",
+                    filePath: std.thisFile,
+                    // Defined in "//kube/cfg/secrets/media.jsonnet"
+                    dataClaimName: "sonarr-pg-17",
+                    dbName: "sonarr-not-used",
+                    dbUser: "postgres",
+                    // Defined in local secrets
+                    dbPwdSecret: "sonarr",
+                    dbPwdSecretKey: "sonarr_db_pwd",
+                }),
+                app: sonarr.App(sonarr.Params {
+                    namespace: namespace,
+                    name: "sonarr",
+                    filePath: std.thisFile,
+                    // Defined in "media"
+                    configClaimName: "sonarr-config",
+                    // Defined in "media"
+                    downloadsClaimName: "sabnzbd-downloads",
+                    downloadsSubdirectory: null,
+                    // Defined in "media"
+                    tvSeriesClaimName: "series-lake",
+                }),
+                ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+                    namespace: namespace,
+                    name: "sonarr",
+                    hosts: [
+                    "sonarr.cheapassbox.com",
+                    ],
+                    serviceName: "sonarr-ui",
+                    annotations: nginxIngress.KubeOauthProxyAnnotations,
+                }),
+                ingress2: nginxIngress.Ingress(nginxIngress.IngressParams {
+                    namespace: namespace,
+                    name: "sonarr-csbx",
+                    hosts: [
+                    "sonarr.csbx.dev",
+                    ],
+                    serviceName: "sonarr-ui",
+                    annotations: nginxIngress.KubeCsbxOauthProxyAnnotations,
+                }),
+            },
+            anime: {
+                configPvc: base.RecoverableSimplePvc(namespace, "sonarr-anime-config", "nfs-client", "200Mi", {
+                    volumeName: "pvc-ee075c1a-9fd0-4911-a0b0-926369d219e7",
+                    nfsPath: "/volume3/fs/media-sonarr-anime-config-pvc-ee075c1a-9fd0-4911-a0b0-926369d219e7",
+                    nfsServer: "apollo1.dominion.lan",
+                }),
+                db17Pvc: base.RecoverableSimpleManyPvc(namespace, "sonarr-anime-pg-17", "nfs-client", "50Gi", {
+                    volumeName: "pvc-5b7278af-e371-48da-a951-f28786b90b03",
+                    nfsPath: "/volume3/fs/media-sonarr-anime-pg-17-pvc-5b7278af-e371-48da-a951-f28786b90b03",
+                    nfsServer: "apollo1.dominion.lan",
+                }),
+                db17App: postgres.App(postgres.Params {
+                    namespace: namespace,
+                    name: "sonarr-anime-pg-17",
+                    filePath: std.thisFile,
+                    // TODO:
+                    image: "docker.io/bitnami/postgresql:17.2.0",
+                    // Defined in "//kube/cfg/secrets/media.jsonnet"
+                    dataClaimName: "sonarr-anime-pg-17",
+                    dbName: "sonarr-not-used",
+                    dbUser: "postgres",
+                    // Defined in local secrets
+                    dbPwdSecret: "sonarr",
+                    dbPwdSecretKey: "sonarr_db_pwd",
+                }),
+                app: sonarr.App(sonarr.Params {
+                    namespace: namespace,
+                    name: "sonarr-anime",
+                    filePath: std.thisFile,
+                    // Defined in "media"
+                    configClaimName: "sonarr-anime-config",
+                    // Defined in "media"
+                    downloadsClaimName: "sabnzbd-downloads",
+                    downloadsSubdirectory: null,
+                    // Defined in "media"
+                    tvSeriesClaimName: "anime-series",
+                }),
+                ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+                    namespace: namespace,
+                    name: "sonarr-anime",
+                    hosts: [
+                        "sonarr-anime.cheapassbox.com",
+                    ],
+                    serviceName: "sonarr-anime-ui",
+                    annotations: nginxIngress.KubeOauthProxyAnnotations,
+                }),
+                ingress2: nginxIngress.Ingress(nginxIngress.IngressParams {
+                    namespace: namespace,
+                    name: "sonarr-anime-csbx",
+                    hosts: [
+                        "sonarr-anime.csbx.dev",
+                    ],
+                    serviceName: "sonarr-anime-ui",
+                    annotations: nginxIngress.KubeCsbxOauthProxyAnnotations,
+                }),
+            },
+        },
+        transmission: {
+            torrentFilesPvc: base.RecoverableSimpleManyPvc(namespace, "torrent-files", "nfs-client", "50Mi", {
+                volumeName: "pvc-6ccda018-9e3a-11e9-bad8-b8aeed7dc356",
+                nfsPath: "/volume3/fs/media-torrent-files-pvc-6ccda018-9e3a-11e9-bad8-b8aeed7dc356",
+                nfsServer: "apollo1.dominion.lan",
+            }),
+            incompleteDownloadsPvc: base.RecoverableSimpleManyPvc(namespace, "transmission-incomplete-downloads", "nfs-bulk", "100Gi", {
+                volumeName: "pvc-449918e4-46a2-4a47-a096-6e45ab4e62b1",
+                nfsPath: "/volume4/fs-bulk/media-transmission-incomplete-downloads-pvc-449918e4-46a2-4a47-a096-6e45ab4e62b1",
+                nfsServer: "apollo2.dominion.lan",
+            }),
+            configPvc: base.RecoverableSimpleManyPvc(namespace, "transmission-config", "nfs-client", "50Mi", {
+                volumeName: "pvc-6c2b9097-9f8c-11e9-bad8-b8aeed7dc356",
+                nfsPath: "/volume3/fs/media-transmission-config-pvc-6c2b9097-9f8c-11e9-bad8-b8aeed7dc356",
+                nfsServer: "apollo1.dominion.lan",
+            }),
+            app: transmission.App(transmission.Params {
+                namespace: namespace,
+                name: "transmission",
+                filePath: std.thisFile,
+                // Defined in "media"
+                configClaimName: "transmission-config",
+                // Defined in "media"
+                incompleteDownloadsClaimName: "transmission-incomplete-downloads",
+                downloadsClaimName: "downloads-lake",
+                //Defined in "media"
+                torrentFilesClaimName: "torrent-files",
+                // TODO(acmcarther): Import from central location
+                dataNodePort: 32700,
+            }),
+            ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "transmission",
+                hosts: [
+                    "transmission.cheapassbox.com",
+                ],
+                serviceName: "transmission-ui",
+                annotations: nginxIngress.KubeOauthProxyAnnotations,
+            }),
+            ingress2: nginxIngress.Ingress(nginxIngress.IngressParams {
+                namespace: namespace,
+                name: "transmission-csbx",
+                hosts: [
+                    "transmission.csbx.dev",
+                ],
+                serviceName: "transmission-ui",
+                annotations: nginxIngress.KubeCsbxOauthProxyAnnotations,
+            }),
+        },
+    },
+}
\ No newline at end of file
diff --git a/k8s/configs/environments/media/spec.json b/k8s/configs/environments/media/spec.json
new file mode 100644
index 0000000..eadffea
--- /dev/null
+++ b/k8s/configs/environments/media/spec.json
@@ -0,0 +1,15 @@
+{
+  "apiVersion": "tanka.dev/v1alpha1",
+  "kind": "Environment",
+  "metadata": {
+    "name": "environments/media",
+    "namespace": "environments/media/main.jsonnet"
+  },
+  "spec": {
+    "apiServer": "https://k8s.dominion.lan:6443",
+    "namespace": "media",
+    "resourceDefaults": {},
+    "expectVersions": {},
+    "injectLabels": true
+  }
+}
diff --git a/k8s/configs/environments/monitoring/BUILD.bazel b/k8s/configs/environments/monitoring/BUILD.bazel
new file mode 100644
index 0000000..0e6d523
--- /dev/null
+++ b/k8s/configs/environments/monitoring/BUILD.bazel
@@ -0,0 +1,24 @@
+load("@rules_jsonnet//jsonnet:jsonnet.bzl", "jsonnet_library", "jsonnet_to_json", "jsonnet_to_json_test")
+load("//tools:tanka.bzl", "tanka_environment")
+
+jsonnet_to_json(
+    name = "main",
+    src = "main.jsonnet",
+    outs = ["main.json"],
+    data = [
+        "@helm_grafana_grafana//:chart",
+        "@helm_jaegertracing_jaeger_operator//:chart",
+        "@helm_prometheuscommunity_alertmanager//:chart",
+        "@helm_prometheuscommunity_prometheus//:chart",
+    ],
+    visibility = ["//visibility:public"],
+    deps = [
+        "//k8s/configs/templates",
+    ],
+)
+
+tanka_environment(
+    name = "monitoring",
+    main = ":main",
+    spec = "spec.json",
+)
diff --git a/k8s/configs/environments/monitoring/main.jsonnet b/k8s/configs/environments/monitoring/main.jsonnet
new file mode 100644
index 0000000..bb19776
--- /dev/null
+++ b/k8s/configs/environments/monitoring/main.jsonnet
@@ -0,0 +1,140 @@
+local kube = import "k8s/configs/base.libsonnet";
+
+local grafana = import "k8s/configs/templates/core/observability/grafana.libsonnet";
+local kubeOpsView = import "k8s/configs/templates/core/observability/kube-ops-view.libsonnet";
+local nginxIngress = import "k8s/configs/templates/core/network/nginx-ingress.libsonnet";
+local prometheus = import "k8s/configs/templates/core/observability/prometheus.libsonnet";
+local jaegerOperator = import "k8s/configs/templates/core/observability/jaeger-operator.libsonnet";
+
+local namespace = "monitoring";
+local ctx = kube.NewContext(kube.helm);
+{
+    namespace: {
+        apiVersion: "v1",
+        kind: "Namespace",
+        metadata: {
+            name: namespace,
+        },
+    },
+    apps: {
+        jaegerInstance: {
+            apiVersion: "jaegertracing.io/v1",
+            kind: "Jaeger",
+            metadata: {
+                name: "my-jaeger",
+            },
+            spec: {
+                strategy: "allInOne",
+                storage: {
+                    type: "badger",
+                    options: {
+                        badger: {
+                            ephemeral: false,
+                            "directory-key": "/badger/key",
+                            "directory-value": "/badger/data",
+                        },
+                    },
+                },
+                allInOne: {
+                    volumes: [
+                        {
+                            name: "data",
+                            persistentVolumeClaim: {
+                                claimName: "jaeger-pvc",
+                            },
+                        },
+                    ],
+                    volumeMounts: [
+                        {
+                            name: "data",
+                            mountPath: "/badger",
+                        },
+                    ],
+                },
+                ingress: {
+                    enabled: false,
+                    ingressClassName: "nginx",
+                    hosts: [
+                        "jaeger.csbx.dev",
+                    ],
+                    annotations: nginxIngress.KubeCsbxOauthProxyAnnotations + {
+                        "cert-manager.io/cluster-issuer": "letsencrypt-production",
+                    },
+                    tls: [
+                        {
+                            secretName: "jaeger-ui-cert",
+                            hosts: [
+                                "jaeger.csbx.dev",
+                            ],
+                        },
+                    ],
+                    pathType: "Prefix",
+                },
+            },
+        },
+        jaegerOperator: jaegerOperator.App(jaegerOperator.Params {
+            namespace: namespace,
+            context: ctx,
+        }),
+        kubeOpsView: kubeOpsView.App(kubeOpsView.Params {
+            namespace: namespace,
+            name: "kube-ops-view",
+            filePath: std.thisFile,
+            clusterRoleName: "kube-ops-view",
+            hosts: [
+                "kube.csbx.dev",
+            ],
+            ingressAnnotations: nginxIngress.KubeCsbxOauthProxyAnnotations,
+        }),
+        prometheus: prometheus.App(prometheus.Params {
+            context: ctx,
+            namespace: namespace,
+            existingClaim: "prometheus-server",
+        }),
+        grafana: grafana.App(grafana.Params {
+            context: ctx,
+            namespace: namespace,
+            hosts: [
+                "grafana.csbx.dev",
+            ],
+            ingressAnnotations: nginxIngress.KubeCsbxOauthProxyAnnotations,
+        }),
+        ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+            namespace: namespace,
+            name: "grafana-ui",
+            hosts: [
+                "grafana.csbx.dev",
+            ],
+            serviceName: "grafana",
+            annotations: nginxIngress.KubeCsbxOauthProxyAnnotations,
+        }),
+        jaegerIngress: nginxIngress.Ingress(nginxIngress.IngressParams {
+            namespace: namespace,
+            name: "jaeger-query",
+            hosts: [
+                "jaeger.csbx.dev",
+            ],
+            serviceName: "my-jaeger-query",
+            servicePort: 16686,
+            annotations: nginxIngress.KubeCsbxOauthProxyAnnotations,
+        }),
+    },
+    volumes: {
+        jaeger: kube.RecoverableSimplePvc(namespace, "jaeger-pvc", "nfs-client", "10Gi", {
+            volumeName: "pvc-d04e51b8-0233-4c4c-a32b-680bb6dce1df",
+            nfsPath: "/volume3/fs/monitoring-jaeger-pvc-pvc-d04e51b8-0233-4c4c-a32b-680bb6dce1df",
+            nfsServer: "apollo1.dominion.lan",
+        }),
+        prometheus: kube.RecoverableSimplePvc(namespace, "prometheus-server", "nfs-client", "8Gi", {
+            volumeName: "pvc-59ac268a-8f51-11e9-b70e-b8aeed7dc356",
+            nfsPath: "/volume3/fs/monitoring-prometheus-server-pvc-59ac268a-8f51-11e9-b70e-b8aeed7dc356",
+            nfsServer: "apollo1.dominion.lan",
+        }),
+        grafana: kube.RecoverableSimplePvc(namespace, "grafana", "nfs-client", "10Gi", {
+            volumeName: "pvc-632e71f0-54e1-45b3-b63a-5dd083b5e77f",
+            nfsPath: "/volume3/fs/monitoring-grafana-pvc-632e71f0-54e1-45b3-b63a-5dd083b5e77f",
+            nfsServer: "apollo1.dominion.lan",
+        }),
+    },
+    secrets: {},
+}
\ No newline at end of file
diff --git a/k8s/configs/environments/monitoring/spec.json b/k8s/configs/environments/monitoring/spec.json
new file mode 100644
index 0000000..2538b5f
--- /dev/null
+++ b/k8s/configs/environments/monitoring/spec.json
@@ -0,0 +1,15 @@
+{
+  "apiVersion": "tanka.dev/v1alpha1",
+  "kind": "Environment",
+  "metadata": {
+    "name": "environments/monitoring",
+    "namespace": "environments/monitoring/main.jsonnet"
+  },
+  "spec": {
+    "apiServer": "https://k8s.dominion.lan:6443",
+    "namespace": "monitoring",
+    "resourceDefaults": {},
+    "expectVersions": {},
+    "injectLabels": true
+  }
+}
diff --git a/k8s/configs/environments/network/BUILD.bazel b/k8s/configs/environments/network/BUILD.bazel
new file mode 100644
index 0000000..dbb661e
--- /dev/null
+++ b/k8s/configs/environments/network/BUILD.bazel
@@ -0,0 +1,33 @@
+load("@rules_jsonnet//jsonnet:jsonnet.bzl", "jsonnet_library", "jsonnet_to_json", "jsonnet_to_json_test")
+load("//tools:tanka.bzl", "tanka_environment")
+load("//tools:sops.bzl", "sops_decrypt")
+
+sops_decrypt(
+    name = "secrets",
+    src = "secrets.sops.yaml",
+    out = "secrets.json",
+)
+
+jsonnet_library(
+    name = "secrets_lib",
+    srcs = [":secrets"],
+)
+
+jsonnet_to_json(
+    name = "main",
+    src = "main.jsonnet",
+    outs = ["main.json"],
+    data = [
+    ],
+    visibility = ["//visibility:public"],
+    deps = [
+        ":secrets_lib",
+        "//k8s/configs/templates",
+    ],
+)
+
+tanka_environment(
+    name = "network",
+    main = ":main",
+    spec = "spec.json",
+)
diff --git a/k8s/configs/environments/network/main.jsonnet b/k8s/configs/environments/network/main.jsonnet
new file mode 100644
index 0000000..27ee6c1
--- /dev/null
+++ b/k8s/configs/environments/network/main.jsonnet
@@ -0,0 +1,147 @@
+local base = import "k8s/configs/base.libsonnet";
+local secrets = import "k8s/configs/environments/network/secrets.json";
+local ddclient = import "k8s/configs/templates/core/network/ddclient.libsonnet";
+local oauth2Proxy = import "k8s/configs/templates/core/security/oauth2-proxy.libsonnet";
+local nginx = import "k8s/configs/templates/core/network/nginx-ingress.libsonnet";
+
+local namespace = "network";
+local ctx = base.NewContext(base.helm);
+
+
+{
+    namespace: {
+        apiVersion: "v1",
+        kind: "Namespace",
+        metadata: {
+            name: namespace,
+        },
+    },
+    secrets: {
+        oauth2ProxyKubeDomain: oauth2Proxy.Secret(oauth2Proxy.SecretParams {
+            namespace: "network",
+            name: "oauth2-proxy-kube-domain",
+            cookieSecret: secrets.oauth2_kube_cookie_secret,
+            clientSecret: secrets.oauth2_kube_client_secret,
+            clientId: secrets.oauth2_kube_client_id,
+        }),
+        oauth2ProxyDominionDomain: oauth2Proxy.Secret(oauth2Proxy.SecretParams {
+            namespace: "network",
+            name: "oauth2-proxy-dominion-domain",
+            cookieSecret: secrets.oauth2_dominion_cookie_secret,
+            clientSecret: secrets.oauth2_dominion_client_secret,
+            clientId: secrets.oauth2_dominion_client_id,
+        })
+    },
+    apps: {
+        acmeStagingIssuer: base.ClusterIssuer(namespace, "letsencrypt-production") {
+            spec+: {
+                acme+: {
+                    email: "acmcarther+web@gmail.com",
+                    server: "https://acme-v02.api.letsencrypt.org/directory",
+                    privateKeySecretRef: {
+                    name: "letsencrypt-production",
+                    },
+                    solvers: [
+                    {
+                        http01: {
+                        ingress: {
+                            class: "nginx",
+                        },
+                        },
+                    },
+                    ],
+                },
+            },
+        },
+        acmeProdIssuer: base.ClusterIssuer(namespace, "letsencrypt-staging") {
+            spec+: {
+                acme+: {
+                    email: "acmcarther+web@gmail.com",
+                    server: "https://acme-staging-v02.api.letsencrypt.org/directory",
+                    privateKeySecretRef: {
+                    name: "letsencrypt-staging",
+                    },
+                    solvers: [
+                    {
+                        http01: {
+                        ingress: {
+                            class: "nginx",
+                        },
+                        },
+                    },
+                    ],
+                },
+            },
+        },
+        app: nginx.App(nginx.Params {
+            namespace: namespace,
+            name: "nginx-ingress",
+        }),
+
+        ddclientCheapassbox: ddclient.App(ddclient.Params {
+            namespace: namespace,
+            name: "ddclient",
+            filePath: std.thisFile,
+            configClaimName: "ddclient-config",
+            login: "cheapassbox.com",
+            password: secrets.ddclient_cheapassbox_password,
+        }),
+        ddclientCsbx: ddclient.App(ddclient.Params {
+            namespace: namespace,
+            name: "ddclient-csbx",
+            filePath: std.thisFile,
+            configClaimName: "ddclient-csbx-config",
+            login: "csbx.dev",
+            password: secrets.ddclient_csbx_password,
+        }),
+        /*
+        ddclientCsbx: ddclient.App(ddclient.Params {
+            namespace: namespace,
+            name: "ddclient-cheapassusercontent",
+            filePath: std.thisFile,
+            configClaimName: "ddclient-cheapassusercontent-config",
+            login: "cheapassusercontent.com",
+            password: "3c02309b5b794823b1dce8343a300566",
+        }),
+        */
+        oauth2ProxyCheapassboxCom: oauth2Proxy.App(oauth2Proxy.Params {
+            namespace: namespace,
+            name: "oauth2-proxy-default-cheapassbox-com",
+            filePath: std.thisFile,
+            ingressHost: "oauth.cheapassbox.com",
+            domains: ["cheapassbox.com"],
+            oicdIssuerURL: "https://authentication.cheapassbox.com/realms/kube",
+            secretName: "oauth2-proxy-kube-domain"
+        }),
+        oauth2ProxyCsbxDev: oauth2Proxy.App(oauth2Proxy.Params {
+            namespace: namespace,
+            name: "oauth2-proxy-default-csbx-dev",
+            filePath: std.thisFile,
+            ingressHost: "oauth.csbx.dev",
+            domains: ["csbx.dev"],
+            oicdIssuerURL: "https://auth.csbx.dev/realms/kube",
+            secretName: "oauth2-proxy-kube-domain"
+        }),
+        oauth2ProxyDominionCheapassboxCom: oauth2Proxy.App(oauth2Proxy.Params {
+            namespace: namespace,
+            name: "oauth2-proxy-dominion-cheapassbox-com",
+            filePath: std.thisFile,
+            ingressHost: "oauth-dominion.cheapassbox.com",
+            domains: ["cheapassbox.com"],
+            oicdIssuerURL: "https://authentication.cheapassbox.com/realms/dominion",
+            secretName: "oauth2-proxy-dominion-domain"
+        }),
+        oauth2ProxyDominionCsbxDev: oauth2Proxy.App(oauth2Proxy.Params {
+            namespace: namespace,
+            name: "oauth2-proxy-dominion-csbx-dev",
+            filePath: std.thisFile,
+            ingressHost: "oauth-dominion.csbx.dev",
+            domains: ["csbx.dev"],
+            oicdIssuerURL: "https://auth.csbx.dev/realms/dominion",
+            secretName: "oauth2-proxy-dominion-domain"
+        }),
+
+        // TODO: Oauth2 proxy
+        // TODO: nginx ingress
+    },
+}
\ No newline at end of file
diff --git a/k8s/configs/environments/network/spec.json b/k8s/configs/environments/network/spec.json
new file mode 100644
index 0000000..dbe503e
--- /dev/null
+++ b/k8s/configs/environments/network/spec.json
@@ -0,0 +1,15 @@
+{
+  "apiVersion": "tanka.dev/v1alpha1",
+  "kind": "Environment",
+  "metadata": {
+    "name": "environments/network",
+    "namespace": "environments/network/main.jsonnet"
+  },
+  "spec": {
+    "apiServer": "https://k8s.dominion.lan:6443",
+    "namespace": "network",
+    "resourceDefaults": {},
+    "expectVersions": {},
+    "injectLabels": true
+  }
+}
diff --git a/k8s/configs/environments/nvidia/BUILD.bazel b/k8s/configs/environments/nvidia/BUILD.bazel
new file mode 100644
index 0000000..b48a39b
--- /dev/null
+++ b/k8s/configs/environments/nvidia/BUILD.bazel
@@ -0,0 +1,21 @@
+load("@rules_jsonnet//jsonnet:jsonnet.bzl", "jsonnet_library", "jsonnet_to_json", "jsonnet_to_json_test")
+load("//tools:tanka.bzl", "tanka_environment")
+
+jsonnet_to_json(
+    name = "main",
+    src = "main.jsonnet",
+    outs = ["main.json"],
+    data = [
+        "@helm_nvidia_gpu_operator//:chart",
+    ],
+    visibility = ["//visibility:public"],
+    deps = [
+        "//k8s/configs/templates",
+    ],
+)
+
+tanka_environment(
+    name = "nvidia",
+    main = ":main",
+    spec = "spec.json",
+)
diff --git a/k8s/configs/environments/nvidia/main.jsonnet b/k8s/configs/environments/nvidia/main.jsonnet
new file mode 100644
index 0000000..cf7ea9b
--- /dev/null
+++ b/k8s/configs/environments/nvidia/main.jsonnet
@@ -0,0 +1,20 @@
+local base = import "k8s/configs/base.libsonnet";
+local nvidiaGpuOperator = import "k8s/configs/templates/core/nvidia-gpu-operator.libsonnet";
+
+local namespace = "nvidia";
+local ctx = base.NewContext(base.helm);
+{
+    namespace: {
+        apiVersion: "v1",
+        kind: "Namespace",
+        metadata: {
+            name: namespace,
+        },
+    },
+    apps: {
+        nvidiaGpuOperator: nvidiaGpuOperator.App(nvidiaGpuOperator.Params {
+            namespace: namespace,
+            context: ctx,
+        },)
+    },
+}
\ No newline at end of file
diff --git a/k8s/configs/environments/nvidia/spec.json b/k8s/configs/environments/nvidia/spec.json
new file mode 100644
index 0000000..9cf54e7
--- /dev/null
+++ b/k8s/configs/environments/nvidia/spec.json
@@ -0,0 +1,15 @@
+{
+  "apiVersion": "tanka.dev/v1alpha1",
+  "kind": "Environment",
+  "metadata": {
+    "name": "environments/nvidia",
+    "namespace": "environments/nvidia/main.jsonnet"
+  },
+  "spec": {
+    "apiServer": "https://k8s.dominion.lan:6443",
+    "namespace": "nvidia",
+    "resourceDefaults": {},
+    "expectVersions": {},
+    "injectLabels": true
+  }
+}
diff --git a/k8s/configs/environments/sourcebot/BUILD.bazel b/k8s/configs/environments/sourcebot/BUILD.bazel
new file mode 100644
index 0000000..14fd4bc
--- /dev/null
+++ b/k8s/configs/environments/sourcebot/BUILD.bazel
@@ -0,0 +1,20 @@
+load("@rules_jsonnet//jsonnet:jsonnet.bzl", "jsonnet_library", "jsonnet_to_json", "jsonnet_to_json_test")
+load("//tools:tanka.bzl", "tanka_environment")
+
+jsonnet_to_json(
+    name = "main",
+    src = "main.jsonnet",
+    outs = ["main.json"],
+    data = [
+    ],
+    visibility = ["//visibility:public"],
+    deps = [
+        "//k8s/configs/templates",
+    ],
+)
+
+tanka_environment(
+    name = "sourcebot",
+    main = ":main",
+    spec = "spec.json",
+)
diff --git a/k8s/configs/environments/sourcebot/main.jsonnet b/k8s/configs/environments/sourcebot/main.jsonnet
new file mode 100644
index 0000000..b894ed8
--- /dev/null
+++ b/k8s/configs/environments/sourcebot/main.jsonnet
@@ -0,0 +1,159 @@
+local base = import 'k8s/configs/base.libsonnet';
+
+local linuxserver = import 'k8s/configs/templates/core/linuxserver.libsonnet';
+local nginxIngress = import 'k8s/configs/templates/core/network/nginx-ingress.libsonnet';
+
+local namespaceName = 'sourcebot';
+local appName = 'sourcebot';
+local WebPort = 3000;
+
+local params = linuxserver.AppParams {
+  name: appName,
+  baseAppName: appName,
+  namespace: namespaceName,
+  imageName: 'sourcebot',
+  filePath: std.thisFile,
+  templatePath: std.thisFile,
+  authUrl: 'https://sourcebot.csbx.dev',
+  ports: [ base.DeployUtil.ContainerPort("http", WebPort), ],
+  services: [
+    linuxserver.Service {
+      suffix: "ui",
+      spec: base.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+    },
+  ],
+  pvcs: [
+    linuxserver.Pvc {
+      name: 'data',
+      bindName: appName + '-data',
+      mountPath: '/data',
+    },
+  ],
+  resources: {
+    requests: {
+      cpu: "1000m",
+      memory: "2Gi",
+    },
+    limits: {
+      cpu: "2000m",
+      memory: "4Gi",
+    },
+  },
+  configMaps: [
+    linuxserver.ConfigMap {
+      name: 'config',
+      bindName: appName,
+      mountPath: '/etc/sourcebot',
+    },
+  ],
+  env+: {
+    others+: [
+      base.NameVal('CONFIG_PATH', '/etc/sourcebot/config.json'),
+      base.NameVal('AUTH_URL', $.authUrl),
+      base.NameVal('SOURCEBOT_TELEMETRY_DISABLED', 'true'),
+      {
+        name: 'GITEA_TOKEN',
+        valueFrom: {
+          secretKeyRef: {
+            name: 'gitea-token',
+            key: 'token',
+          },
+        },
+      },
+    ],
+  },
+};
+
+{
+  namespace: {
+    apiVersion: 'v1',
+    kind: 'Namespace',
+    metadata: {
+      name: namespaceName,
+    },
+  },
+  pvc: base.RecoverableSimplePvc(namespaceName, appName + '-data', 'nfs-client', '10Gi', {
+    volumeName: "pvc-55405f2b-f253-4e3e-a45f-2a1a18f75c89",
+    nfsPath: "/volume3/fs/sourcebot-sourcebot-data-pvc-55405f2b-f253-4e3e-a45f-2a1a18f75c89",
+    nfsServer: "apollo1.dominion.lan",
+  }),
+  pvc2: base.RecoverableSimplePvc(namespaceName, appName + '-2-data', 'nfs-client', '10Gi', {
+    volumeName: "pvc-73d0ed19-562b-4bd9-a198-d8a5d21f0146",
+    nfsPath: "/volume3/fs/sourcebot-sourcebot-2-data-pvc-73d0ed19-562b-4bd9-a198-d8a5d21f0146",
+    nfsServer: "apollo1.dominion.lan",
+  }),
+  secret: base.Secret(namespaceName, 'gitea-token') {
+    stringData: {
+      token: '539779da7d1a922e1c1ba61e5ff25909b5bdca2d',
+    },
+  },
+  configmap: base.ConfigMap(namespaceName, appName) {
+    data: {
+      'config.json': |||
+        {
+          "$schema": "https://raw.githubusercontent.com/sourcebot-dev/sourcebot/main/schemas/v3/index.json",
+          "connections": {
+            "forgejo": {
+              "type": "gitea",
+              "url": "https://forgejo.csbx.dev",
+              "token": {
+                "env": "GITEA_TOKEN"
+              },
+              "repos": [
+                "acmcarther/infra2",
+                "acmcarther/yesod",
+                "acmcarther/sourcebot",
+                "acmcarther/qwen-code"
+              ]
+            }
+          }
+        }
+      |||
+    },
+  },
+  configmap2: base.ConfigMap(namespaceName, appName + '-2') {
+    data: {
+      'config.json': |||
+        {
+          "$schema": "https://raw.githubusercontent.com/sourcebot-dev/sourcebot/main/schemas/v3/index.json",
+          "connections": {
+            "forgejo": {
+              "type": "gitea",
+              "url": "https://forgejo.csbx.dev",
+              "token": {
+                "env": "GITEA_TOKEN"
+              },
+              "repos": [
+                "acmcarther/yesod-mirror",
+              ]
+            }
+          }
+        }
+      |||
+    },
+  },
+  app: linuxserver.App(params),
+  app2: linuxserver.App(params {
+    name: appName + '-2',
+    authUrl: 'https://source-mirror.csbx.dev',
+  }),
+  ingress1: nginxIngress.Ingress(nginxIngress.IngressParams {
+    namespace: namespaceName,
+    name: appName,
+    hosts: [
+      'sourcebot.csbx.dev',
+    ],
+    annotations: nginxIngress.KubeCsbxOauthProxyAnnotations,
+    serviceName: appName + '-ui',
+  }),
+  ingress2: nginxIngress.Ingress(nginxIngress.IngressParams {
+    namespace: namespaceName,
+    name: appName + '-2',
+    hosts: [
+      'source-mirror.csbx.dev',
+    ],
+    annotations: nginxIngress.KubeCsbxOauthProxyAnnotations,
+    serviceName: appName + '-2-ui',
+  }),
+
+}
\ No newline at end of file
diff --git a/k8s/configs/environments/sourcebot/spec.json b/k8s/configs/environments/sourcebot/spec.json
new file mode 100644
index 0000000..56c7c7a
--- /dev/null
+++ b/k8s/configs/environments/sourcebot/spec.json
@@ -0,0 +1,15 @@
+{
+  "apiVersion": "tanka.dev/v1alpha1",
+  "kind": "Environment",
+  "metadata": {
+    "name": "environments/sourcebot",
+    "namespace": "environments/sourcebot/main.jsonnet"
+  },
+  "spec": {
+    "apiServer": "https://k8s.dominion.lan:6443",
+    "namespace": "sourcebot",
+    "resourceDefaults": {},
+    "expectVersions": {},
+    "injectLabels": true
+  }
+}
diff --git a/k8s/configs/environments/storage/BUILD.bazel b/k8s/configs/environments/storage/BUILD.bazel
new file mode 100644
index 0000000..303d6cc
--- /dev/null
+++ b/k8s/configs/environments/storage/BUILD.bazel
@@ -0,0 +1,20 @@
+load("@rules_jsonnet//jsonnet:jsonnet.bzl", "jsonnet_library", "jsonnet_to_json", "jsonnet_to_json_test")
+load("//tools:tanka.bzl", "tanka_environment")
+
+jsonnet_to_json(
+    name = "main",
+    src = "main.jsonnet",
+    outs = ["main.json"],
+    data = [
+    ],
+    visibility = ["//visibility:public"],
+    deps = [
+        "//k8s/configs/templates",
+    ],
+)
+
+tanka_environment(
+    name = "storage",
+    main = ":main",
+    spec = "spec.json",
+)
diff --git a/k8s/configs/environments/storage/main.jsonnet b/k8s/configs/environments/storage/main.jsonnet
new file mode 100644
index 0000000..782cede
--- /dev/null
+++ b/k8s/configs/environments/storage/main.jsonnet
@@ -0,0 +1,61 @@
+local base = import "k8s/configs/base.libsonnet";
+local nfs = import "k8s/configs/templates/core/storage/nfs-client-provisioner.libsonnet";
+local consul = import "k8s/configs/templates/core/network/consul.libsonnet";
+
+local namespace = "storage";
+local ctx = base.NewContext(base.helm);
+{
+    namespace: {
+        apiVersion: "v1",
+        kind: "Namespace",
+        metadata: {
+            name: namespace,
+        },
+    },
+    clusterRoles: {
+        nfsProvisioner: nfs.ClusterRole("storage-nfs-provisioner"),
+    },
+    clusterRoleBindings: {
+        nfsClusterRoleBinding: nfs.ClusterRoleBinding("storage-nfs-provisioners", nfs.ClusterRoleBindingParams {
+            clusterRoleName: "storage-nfs-provisioner",
+            subjects: [
+                {
+                    kind: "ServiceAccount",
+                    name: "nfs-client-provisioner",
+                    namespace: namespace,
+                },
+                {
+                    kind: "ServiceAccount",
+                    name: "nfs-bulk-provisioner",
+                    namespace: namespace,
+                },
+                ],
+        }),
+    },
+    storageClasses: {
+        nfsClientStorageClass: nfs.StorageClass("nfs-client", nfs.StorageClassParams{
+            provisionerName: "cluster.local/nfs-client-provisioner",
+        }),
+        nfsBulkStorageClass: nfs.StorageClass("nfs-bulk", nfs.StorageClassParams{
+            provisionerName: "cluster.local/nfs-bulk-provisioner-nfs-client-provisioner",
+        }),
+    },
+    apps: {
+        nfsClientProvisioner: nfs.App(nfs.Params {
+            namespace: namespace,
+            name: "nfs-client-provisioner",
+            storageClassName: "nfs-client",
+            provisionerName: "cluster.local/nfs-client-provisioner",
+            nfsServerAddr: "apollo1.dominion.lan",
+            nfsServerPath: "/volume3/fs",
+        }),
+        nfsBulkProvisioner: nfs.App(nfs.Params {
+            namespace: namespace,
+            name: "nfs-bulk-provisioner",
+            storageClassName: "nfs-bulk",
+            provisionerName: "cluster.local/nfs-bulk-provisioner-nfs-client-provisioner",
+            nfsServerAddr: "apollo2.dominion.lan",
+            nfsServerPath: "/volume4/fs-bulk",
+        }),
+    },
+}
\ No newline at end of file
diff --git a/k8s/configs/environments/storage/spec.json b/k8s/configs/environments/storage/spec.json
new file mode 100644
index 0000000..69f6166
--- /dev/null
+++ b/k8s/configs/environments/storage/spec.json
@@ -0,0 +1,15 @@
+{
+  "apiVersion": "tanka.dev/v1alpha1",
+  "kind": "Environment",
+  "metadata": {
+    "name": "environments/storage",
+    "namespace": "environments/storage/main.jsonnet"
+  },
+  "spec": {
+    "apiServer": "https://k8s.dominion.lan:6443",
+    "namespace": "storage",
+    "resourceDefaults": {},
+    "expectVersions": {},
+    "injectLabels": true
+  }
+}
diff --git a/k8s/configs/images.libsonnet b/k8s/configs/images.libsonnet
new file mode 100644
index 0000000..11d751b
--- /dev/null
+++ b/k8s/configs/images.libsonnet
@@ -0,0 +1,102 @@
+local ghcr_proxy = "hrbr.csbx.dev/ghcr-proxy/";
+local dockerhub_proxy = "hrbr.csbx.dev/dockerhub-proxy/";
+
+local ProdImages() =  {
+  # 2025-08-29
+  "semantic-search-server": "forgejo.csbx.dev/acmcarther/semantic-search-server:latest",
+  # 2019-10-10
+  "linuxserver/ddclient": "linuxserver/ddclient:3.9.0-ls11",
+  "docker.io/bitnami/minideb": "docker.io/bitnami/minideb:latest",
+  "docker.io/wrouesnel/postgres_exporter": "docker.io/wrouesnel/postgres_exporter:v0.4.7",
+  "docker.io/bitnami/mysqld-exporter": "docker.io/bitnami/mysqld-exporter:0.12.1-debian-9-r29",
+  "docker.io/bitnami/mariadb": "docker.io/bitnami/mariadb:10.3.17-debian-9-r29",
+  # 2020-12-28
+  "bitnami/memcached": "bitnami/memcached:1.6.6-debian-10-r54",
+  # 2021-01-23
+  "eclipse-mosquitto": "eclipse-mosquitto:1.6",
+  # 2021-03-04
+  "quay.io/external_storage/nfs-client-provisioner": "gcr.io/k8s-staging-sig-storage/nfs-subdir-external-provisioner:v4.0.0", #"quay.io/external_storage/nfs-client-provisioner:v3.1.0-k8s1.11",
+  # 2022-06-12
+  "gitea/gitea": "gitea/gitea:1.16.8",
+  "linuxserver/openssh-server": "linuxserver/openssh-server:version-8.8_p1-r1",
+  "privatebin/nginx-fpm-alpine": "privatebin/nginx-fpm-alpine:1.4.0",
+  # 2022-11-23
+  "redis": "redis:7.0.5",
+  # 2022-12-28
+  "mattermost/focalboard": "mattermost/focalboard:7.5.2",
+  # 2023-10-13
+  # NOTE: Private trackers are finnicky about the version.
+  # 2023-10-15
+  "hjacobs/kube-ops-view": "hjacobs/kube-ops-view:23.5.0",
+  "jupyter/datascience-notebook": "jupyter/datascience-notebook:latest",
+  "linuxserver/sonarr": "linuxserver/sonarr:develop-version-4.0.0.697",
+  "nodered/node-red": "nodered/node-red:3.1.0",
+  # 2023-11-03
+  "nginx-ingress-controller": "k8s.gcr.io/ingress-nginx/controller:v1.6.4",
+  # 2023-11-11
+  "prometheuscommunity/postgres-exporter": "quay.io/prometheuscommunity/postgres-exporter:v0.15.0",
+  # 2024-01-26
+  "thijsvanloef/palworld-server-docker": "thijsvanloef/palworld-server-docker:v0.24.2",
+  # 2024-07-02
+  "grafana/grafana": "grafana/grafana:9.5.20",
+  # 2024-12-19
+  "blakeblackshear/frigate": "ghcr.io/blakeblackshear/frigate:0.14.1",
+  "linuxserver/homeassistant": "quay.io/linuxserver.io/homeassistant:2024.12.4",
+  # 2025-01-19
+  "tabbyml/tabby": "tabbyml/tabby:0.24.0-rc.0",
+  "ghcr.io/oppiliappan/lurker": "ghcr.io/oppiliappan/lurker:latest",
+  "nocodb/nocodb": "nocodb/nocodb:0.260.2",
+  "ghcr.io/advplyr/audiobookshelf": "ghcr.io/advplyr/audiobookshelf:2.17.7",
+  "quay.io/oauth2-proxy/oauth2-proxy": "quay.io/oauth2-proxy/oauth2-proxy:v7.8.1",
+  "linuxserver/medusa": "linuxserver/medusa:version-v1.0.22",
+  "monicahq/monicahq": "monica:4.1.2-apache",
+  "registry": "registry:2.8.3",
+  "rclone/rclone": "rclone/rclone:1.69.0",
+  "linuxserver/paperless-ngx": "paperlessngx/paperless-ngx:2.14.4",
+  "linuxserver/grocy": "linuxserver/grocy:version-v4.3.0",
+  "linuxserver/overseerr": "fallenbagel/jellyseerr:2.3.0",
+  "lovasoa/wbo": "lovasoa/wbo:v1.20.1",
+  "linuxserver/readarr": "linuxserver/readarr:0.4.10-nightly",
+  "dgtlmoon/changedetection.io": "dgtlmoon/changedetection.io:0.48.06",
+  "docker.io/bitnami/postgresql": "docker.io/bitnami/postgresql:17.2.0",
+  "gristlabs/grist": "gristlabs/grist:1.3.2",
+  "docker.io/bitnami/mariadb11": "docker.io/bitnami/mariadb:11.4.4",
+  "linuxserver/bookstack": "ghcr.io/linuxserver/bookstack:version-v24.12.1",
+  # 2025-01-23
+  # 2025-01-26
+  "ghcr.io/open-webui/pipelines": "ghcr.io/open-webui/pipelines:git-db29eb2",
+  # 2025-02-13
+  "browserless/chrome": "ghcr.io/browserless/chromium:v2.24.3",
+  # 2025-02-14
+  "vikunja/vikunja": "vikunja/vikunja:0.24.6",
+  "hugomods/hugo": "hugomods/hugo:reg-dart-sass-go-0.144.0",
+  "nginx:1.29.1-alpine": "nginx:1.29.1-alpine",
+  "kiwix/kiwix-serve": "ghcr.io/kiwix/kiwix-serve:3.7.0",
+  # 2025-02-21
+  # 2025-02-22
+  "linuxserver/transmission": /*dockerhub_proxy +*/ "linuxserver/transmission:4.0.6-r3-ls283",
+  "linuxserver/freshrss": /*dockerhub_proxy +*/ "linuxserver/freshrss:1.25.0",
+  "n8nio/n8n": "n8nio/n8n:1.80.3",
+  "linuxserver/sabnzbd": /*dockerhub_proxy +*/ "linuxserver/sabnzbd:4.4.1",
+  "linuxserver/radarr": /*dockerhub_proxy +*/ "linuxserver/radarr:5.19.2-nightly",
+  //"itzg/minecraft-server": "itzg/minecraft-server:2023.8.1-java8-multiarch",
+  "itzg/minecraft-server": "itzg/minecraft-server:2025.2.1-java21",
+  "bluemap-minecraft/bluemap": "ghcr.io/bluemap-minecraft/bluemap:v5.5",
+  "codeberg.org/forgejo/forgejo": "codeberg.org/forgejo/forgejo:10",
+  # 2025-05-23
+  "linuxserver/code-server": "linuxserver/code-server:4.100.2-ls274",
+  "difegue/lanraragi": "difegue/lanraragi:v.0.9.41",
+  # 2025-06-26
+  "forgejo/runner": "data.forgejo.org/forgejo/runner:4.0.0",
+  # 2025-07-??
+  "ollama/ollama": "ollama/ollama:0.9.6",
+  "ghcr.io/open-webui/open-webui": "ghcr.io/open-webui/open-webui:v0.6.18",
+  #"sourcebot": "ghcr.io/sourcebot-dev/sourcebot:v4.10.12",
+  "sourcebot": "forgejo.csbx.dev/acmcarther/sourcebot:v4.10.12-patched",
+  # 2026-01-18
+  "linuxserver/jellyfin": "linuxserver/jellyfin:10.11.5",
+};
+
+{
+  Prod: ProdImages(),
+}
diff --git a/k8s/configs/k.libsonnet b/k8s/configs/k.libsonnet
new file mode 100644
index 0000000..b5d0001
--- /dev/null
+++ b/k8s/configs/k.libsonnet
@@ -0,0 +1 @@
+import "external/+jsonnet_deps+github_com_jsonnet_libs_k8s_libsonnet_1_29/1.29/main.libsonnet";
\ No newline at end of file
diff --git a/k8s/configs/templates/BUILD.bazel b/k8s/configs/templates/BUILD.bazel
new file mode 100644
index 0000000..0fec3bb
--- /dev/null
+++ b/k8s/configs/templates/BUILD.bazel
@@ -0,0 +1,11 @@
+load("@rules_jsonnet//jsonnet:jsonnet.bzl", "jsonnet_library", "jsonnet_to_json", "jsonnet_to_json_test")
+
+jsonnet_library(
+    name = "templates",
+    srcs = glob(include = ["**/*.libsonnet"]),
+    visibility = ["//visibility:public"],
+    deps = [
+        "//k8s/configs:base",
+        "//k8s/configs:images",
+    ],
+)
diff --git a/k8s/configs/templates/README.md b/k8s/configs/templates/README.md
new file mode 100644
index 0000000..4132b25
--- /dev/null
+++ b/k8s/configs/templates/README.md
@@ -0,0 +1,58 @@
+# Kubernetes Configuration Templates
+
+This directory contains Jsonnet templates that define reusable application configurations. Many of these templates wrap Helm charts.
+
+## Creating a Template for a Helm Chart
+
+To create a template that wraps a Helm chart:
+
+1.  **Ensure the Chart is Available:**
+    *   Add the chart to `third_party/helm/chartfile.yaml`.
+    *   Run `bazel run //tools:helm_sync` to update the lockfile.
+    *   Add the generated repository name (e.g., `helm_jetstack_cert_manager`) to `MODULE.bazel` in the `helm_deps` `use_repo` list.
+
+2.  **Create the Libsonnet File:**
+    *   Import `base.libsonnet`.
+    *   Define a `Params` struct.
+    *   Define an `App` function that calls `params.context.helm.template`.
+    *   **Path Resolution:** The `chartPath` passed to `helm.template` must be relative to the *caller* (this libsonnet file) and point to the external repository. In the Bazel sandbox, this usually looks like `../../external/+helm_deps+repo_name`.
+
+    ```jsonnet
+    local base = import "k8s/configs/base.libsonnet";
+
+    local Params = base.SimpleFieldStruct(["namespace", "name", "context", "values"]);
+
+    local App(params) = {
+        local chartPath = "../../external/+helm_deps+my_chart_repo",
+        app: params.context.helm.template(params.name, chartPath, {
+            namespace: params.namespace,
+            values: params.values,
+        })
+    };
+
+    { Params: Params, App: App }
+    ```
+
+3.  **Update `BUILD.bazel`:**
+    *   Ensure the `jsonnet_library` target in this directory includes the new file.
+    *   In the environment's `BUILD.bazel` (e.g., `k8s/configs/environments/my-app/BUILD.bazel`), add the chart's filegroup to the `data` attribute of `jsonnet_to_json`.
+
+    ```python
+    jsonnet_to_json(
+        name = "main",
+        ...
+        data = [
+            "@helm_deps_my_chart_repo//:chart",
+        ],
+    )
+    ```
+
+## Import Paths
+
+When importing `tanka-util` or other external libraries, use the path relative to the repository root. `rules_jsonnet` configured with `deps` adds the repository root to the import path.
+
+Example:
+```jsonnet
+local tanka = import "tanka-util/main.libsonnet";
+```
+(Assuming `tanka-util` directory is at the root of the dependency).
diff --git a/k8s/configs/templates/core/linuxserver.libsonnet b/k8s/configs/templates/core/linuxserver.libsonnet
new file mode 100644
index 0000000..41076ab
--- /dev/null
+++ b/k8s/configs/templates/core/linuxserver.libsonnet
@@ -0,0 +1,319 @@
+local kube = import "k8s/configs/base.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+local templates = import "k8s/configs/templates/templates.libsonnet";
+
+local Env = {
+  puid: 65534,
+  pgid: 65534,
+  tz: "America/Los_Angeles",
+  // Type: kube.NameVal
+  others: [],
+};
+
+local Service = kube.simpleFieldStruct([
+  "suffix",
+  // type: SERVICE.spec
+  "spec"
+]);
+
+local ServiceAccount = kube.simpleFieldStruct([
+  "suffix",
+  // type: SERVICE_ACCOUNT.spec
+  "spec"
+]);
+
+local Pvc = kube.simpleFieldStruct(["name", "bindName", "mountPath"]) {
+  mountSubPath: null,
+};
+
+local ConfigMap = kube.simpleFieldStruct(["name", "bindName", "mountPath"]) {
+  mountSubPath: null,
+  items: null,
+};
+
+local Secret = kube.simpleFieldStruct(["name", "secretName"]) {
+  mountPath: null
+};
+
+local HostPath = kube.simpleFieldStruct(["name", "hostPath", "mountPath"]) {};
+
+local EmptyDir = kube.simpleFieldStruct(["name", "medium", "mountPath"]) {};
+
+local AppParams = kube.simpleFieldStruct(["name", "baseAppName", "imageName", "schedule"]) {
+  namespace: "",
+  replicaCount: 1,
+  env: Env,
+  args: [],
+  gatekeeperSidecar: null,
+  imagePullSecrets: [],
+  nodeSelector: null,
+  command: null,
+  // type: [kube.DeployUtil.ContainerPort]
+  ports: [],
+  // type: [Pvc]
+  pvcs: [],
+  // type: [ConfigMap]
+  configMaps: [],
+  // type: [HostPath],
+  hostPaths: [],
+  // type: [EmptyDir],
+  emptyDirs: [],
+  // type: [Secret]
+  secrets: [],
+  // type: [Service]
+  services: [],
+  // type: [ServiceAccount],
+  serviceAccounts: [],
+  // type: DEPLOYMENT.spec.template.spec.containers.livenewssProbe
+  livenessProbe: null,
+  // type: DEPLOYMENT.spec.template.spec.containers.readinessProbe
+  readinessProbe: null,
+  filePath: null,
+  templatePath: null,
+  isPrivileged: false,
+  scCapabilities: {},
+  labels: {
+  },
+  resources: {
+    requests: {
+      cpu: "50m",
+      memory: "300Mi",
+    },
+    limits: {
+      cpu: "100m",
+      memory: "600Mi",
+    },
+  },
+};
+
+local selector(params) = {
+  name: params.name,
+  phase: "prod",
+};
+
+local linuxserverAnnotations(params) = templates.annotations(params.filePath, std.thisFile)
+{
+  "infra.linuxserver.templatePath": kube.asWorkspacePath(params.templatePath),
+};
+
+local linuxserverLabels(params) = {
+  "infra.linuxserver.appName": params.name,
+} + params.labels;
+
+local unpackServices(params) = {
+  local nskube = kube.UsingNamespace(params.namespace),
+  [service.suffix]: nskube.Service(params.name + "-" + service.suffix) {
+    metadata+: {
+      annotations+: linuxserverAnnotations(params),
+      labels+: linuxserverLabels(params),
+    },
+    spec+: service.spec {
+      selector: selector(params),
+    }
+  } for service in params.services
+};
+
+local unpackServiceAccounts(params) = {
+  local nskube = kube.UsingNamespace(params.namespace),
+  [serviceAccount.suffix]: nskube.ServiceAccount(if serviceAccount.suffix == "" then params.name else params.name + "-" + serviceAccount.suffix) {
+    metadata+: {
+      annotations+: linuxserverAnnotations(params),
+      labels+: linuxserverLabels(params),
+    },
+    # TODO: Does this need to be parameterizeable?
+    automountServiceAccountToken: true
+  } for serviceAccount in params.serviceAccounts
+};
+
+local sequenceEnv(env) = env.others + [
+  kube.NameVal("PUID", std.toString(env.puid)),
+  kube.NameVal("PGID", std.toString(env.pgid)),
+  kube.NameVal("TZ", env.tz),
+];
+
+local sequenceVolumeMounts(pvcs, secrets, configMaps, hostPaths, emptyDirs) = [kube.DeployUtil.VolumeMount(pvc.name, pvc.mountPath) {
+  subPath: pvc.mountSubPath,
+} for pvc in pvcs] + [kube.DeployUtil.VolumeMount(secret.name, secret.mountPath) {
+} for secret in secrets if secret.mountPath != null] + [kube.DeployUtil.VolumeMount(configMap.name, configMap.mountPath) {
+  subPath: configMap.mountSubPath,
+} for configMap in configMaps] + [kube.DeployUtil.VolumeMount(hostPath.name, hostPath.mountPath) {
+} for hostPath in hostPaths] + [kube.DeployUtil.VolumeMount(emptyDir.name, emptyDir.mountPath) {
+} for emptyDir in emptyDirs ];
+
+local sequenceVolumes(pvcs, secrets, configMaps, hostPaths, emptyDirs) = [kube.DeployUtil.VolumeClaimRef(pvc.name, pvc.bindName) for pvc in pvcs] + [{
+  name: secret.name,
+  secret: {
+    secretName: secret.secretName,
+  },
+} for secret in secrets] + [{
+  name: configMap.name,
+  configMap: {
+    name: configMap.bindName,
+    items: configMap.items,
+  },
+} for configMap in configMaps] + [{
+  name: hostPath.name,
+  hostPath: {
+    path: hostPath.hostPath,
+  },
+} for hostPath in hostPaths] + [{
+  name: emptyDir.name,
+  emptyDir: {
+    medium: emptyDir.medium,
+  },
+} for emptyDir in emptyDirs];
+
+local SidecarContainers(params) = if params.gatekeeperSidecar == null then [] else [
+  params.gatekeeperSidecar.SidecarSpec.Container(params, params.gatekeeperSidecar.params),
+];
+
+local SidecarVolumes(params) = if params.gatekeeperSidecar == null then [] else [
+  params.gatekeeperSidecar.SidecarSpec.Volume(params, params.gatekeeperSidecar.params),
+];
+
+local App(params) = unpackServiceAccounts(params) + unpackServices(params) + {
+  local nskube = kube.UsingNamespace(params.namespace),
+  gatekeeperService: if params.gatekeeperSidecar == null then {} else params.gatekeeperSidecar.SidecarSpec.Service(params, params.gatekeeperSidecar.params),
+  gatekeeperConfigMap: if params.gatekeeperSidecar == null then {} else params.gatekeeperSidecar.SidecarSpec.ConfigMap(params, params.gatekeeperSidecar.params),
+  gatekeeperIngresss: if params.gatekeeperSidecar == null then {} else params.gatekeeperSidecar.SidecarSpec.Ingress(params, params.gatekeeperSidecar.params),
+  deployment: nskube.Deployment(params.name) {
+    metadata+: {
+      annotations+: linuxserverAnnotations(params),
+      labels+: linuxserverLabels(params),
+    },
+    spec+: {
+      strategy: kube.DeployUtil.SimpleRollingUpdate(),
+      replicas: params.replicaCount,
+      selector: {
+        matchLabels: selector(params),
+      },
+      template: {
+        metadata: {
+          labels+: linuxserverLabels(params) + selector(params),
+          annotations+: linuxserverAnnotations(params) {
+            "seccomp.security.alpha.kubernetes.io/pod": 'docker/default',
+          },
+        },
+        spec+: {
+          hostAliases: [
+            {
+              ip: "192.168.0.120",
+              hostnames: [
+                "k8s.dominion.lan"
+              ],
+            },
+          ],
+          nodeSelector: params.nodeSelector,
+          imagePullSecrets: [
+            {
+              name: imagePullSecret,
+            },
+          for imagePullSecret in params.imagePullSecrets],
+          containers: [
+            {
+              name: params.baseAppName,
+              image: images.Prod[params.imageName],
+              securityContext: {
+                privileged: params.isPrivileged,
+                capabilities: params.scCapabilities,
+              },
+              env: sequenceEnv(params.env),
+              command: params.command,
+              //command: ["/bin/sh"],
+              //args: ["-c", "sleep 3600"],
+              args: params.args,
+              ports: params.ports,
+              livenessProbe: params.livenessProbe,
+              readinessProbe: params.readinessProbe,
+              resources: params.resources,
+              volumeMounts: sequenceVolumeMounts(params.pvcs, params.secrets, params.configMaps, params.hostPaths, params.emptyDirs)
+            },
+          ] + SidecarContainers(params),
+          volumes: sequenceVolumes(params.pvcs, params.secrets, params.configMaps, params.hostPaths, params.emptyDirs) + SidecarVolumes(params),
+        }
+      },
+    },
+  }
+};
+
+local Cron(params) = unpackServices(params) + {
+  local nskube = kube.UsingNamespace(params.namespace),
+  gatekeeperService: if params.gatekeeperSidecar == null then {} else params.gatekeeperSidecar.SidecarSpec.Service(params, params.gatekeeperSidecar.params),
+  gatekeeperConfigMap: if params.gatekeeperSidecar == null then {} else params.gatekeeperSidecar.SidecarSpec.ConfigMap(params, params.gatekeeperSidecar.params),
+  gatekeeperIngresss: if params.gatekeeperSidecar == null then {} else params.gatekeeperSidecar.SidecarSpec.Ingress(params, params.gatekeeperSidecar.params),
+  cron: nskube.CronJob(params.name) {
+    metadata+: {
+      annotations+: linuxserverAnnotations(params),
+      labels+: linuxserverLabels(params),
+    },
+    spec+: {
+      schedule: params.schedule,
+      jobTemplate: {
+        spec: {
+          //strategy: kube.DeployUtil.SimpleRollingUpdate(),
+          //replicas: params.replicaCount,
+          template: {
+            metadata: {
+              labels+: linuxserverLabels(params) + selector(params),
+              annotations+: linuxserverAnnotations(params) {
+                "seccomp.security.alpha.kubernetes.io/pod": 'docker/default',
+              },
+            },
+            spec+: {
+              restartPolicy: "OnFailure",
+              nodeSelector: params.nodeSelector,
+              imagePullSecrets: [
+                {
+                  name: imagePullSecret,
+                },
+              for imagePullSecret in params.imagePullSecrets],
+              containers: [
+                {
+                  name: params.baseAppName,
+                  image: images.Prod[params.imageName],
+                  securityContext: {
+                    privileged: params.isPrivileged,
+                    capabilities: params.scCapabilities,
+                  },
+                  env: sequenceEnv(params.env),
+                  command: params.command,
+                  //command: ["/bin/sh"],
+                  //args: ["-c", "sleep 3600"],
+                  args: params.args,
+                  ports: [
+                {
+                  name: port.name,
+                  containerPort: port.containerPort,
+                  protocol: "TCP",
+                }
+                for port in params.ports
+              ],
+                  livenessProbe: params.livenessProbe,
+                  readinessProbe: params.readinessProbe,
+                  resources: params.resources,
+                  volumeMounts: sequenceVolumeMounts(params.pvcs, params.secrets, params.configMaps, params.hostPaths, params.emptyDirs)
+                },
+              ] + SidecarContainers(params),
+              volumes: sequenceVolumes(params.pvcs, params.secrets, params.configMaps, params.hostPaths, params.emptyDirs) + SidecarVolumes(params),
+            }
+          },
+        },
+      },
+    },
+  },
+};
+
+
+{
+  AppParams: AppParams,
+  App(params): App(params),
+  Cron(params): Cron(params),
+  Pvc: Pvc,
+  ConfigMap: ConfigMap,
+  ServiceAccount: ServiceAccount,
+  HostPath: HostPath,
+  EmptyDir: EmptyDir,
+  Secret: Secret,
+  Service: Service,
+  Env: Env,
+}
diff --git a/k8s/configs/templates/core/network/consul.libsonnet b/k8s/configs/templates/core/network/consul.libsonnet
new file mode 100644
index 0000000..37b5ad6
--- /dev/null
+++ b/k8s/configs/templates/core/network/consul.libsonnet
@@ -0,0 +1,71 @@
+local images = import "k8s/configs/images.libsonnet";
+local base = import "k8s/configs/base.libsonnet";
+
+local SecretParams = base.SimpleFieldStruct([
+  "namespace",
+  "name",
+  "consulBootstrapAclToken"
+]);
+
+local Secret(params) = base.Secret(params.namespace, params.name) {
+  type: "Opaque",
+  data+: {
+    "token": params.consulBootstrapAclToken, 
+  }
+};
+
+local Params = base.SimpleFieldStruct([
+    "namespace",
+    "context",
+    "bootstrapTokenSecretName", # must contain "token"; set to null on first run and populate afterward.
+]) {};
+
+local App(params) = {
+  app: params.context.helm.template("consul", "./charts/consul", {
+    namespace: params.namespace,
+    values: {
+      global: {
+        enabled: true,
+        name: "consul",
+        datacenter: "dominion",
+        acls: {
+          manageSystemACLs: true,
+          bootstrapToken: {
+            secretName: params.bootstrapTokenSecretName,
+            secretKey: "token"
+          }
+        },
+        disruptionBudget: {
+          enabled: false,
+        },
+        argocd: {
+          // TODO:
+          enabled: false,
+        },
+        metrics: {
+          enabled: true,
+        },
+      },
+      connectInject: {
+        disruptionBudget: {
+          enabled: false,
+        },
+      },
+      server: {
+        storageClass: "nfs-client",
+        disruptionBudget: {
+          enabled: false,
+        },
+      },
+    },
+  })
+};
+
+{
+  SecretParams: SecretParams,
+  Secret: Secret,
+  Params: Params,
+  App: App,
+}
+
+
diff --git a/k8s/configs/templates/core/network/ddclient.libsonnet b/k8s/configs/templates/core/network/ddclient.libsonnet
new file mode 100644
index 0000000..20f7c9a
--- /dev/null
+++ b/k8s/configs/templates/core/network/ddclient.libsonnet
@@ -0,0 +1,76 @@
+local kube = import "k8s/configs/base.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "configClaimName",
+  "login",
+  "password"
+]) {
+  cronSchedule: "0 * * * *", # hourly
+  labels: {},
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "ddclient",
+    imageName: "linuxserver/ddclient",
+    labels+: $.labels,
+    configMaps: [
+      linuxserver.ConfigMap{
+        name: "config",
+        mountPath: "/config",
+        bindName: $.configClaimName,
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "50m",
+        memory: "100Mi",
+      },
+      limits: {
+        cpu: "100m",
+        memory: "200Mi",
+      },
+    },
+  },
+};
+
+// This needs to be secured properly.
+local ConfigMap(params) = kube.ConfigMap(params.namespace, params.name + "-config") {
+  data: {
+    "ddclient.conf": |||
+      ssl=yes
+      pid=/var/run/ddclient/ddclient.pid
+      debug=yes
+      daemon=300
+      verbose=yes
+
+      use=web, web=dynamicdns.park-your-domain.com/getip
+      server=dynamicdns.park-your-domain.com
+      protocol=namecheap
+      login=%(login)s
+      password=%(password)s
+      www
+    ||| % {
+      login: params.login,
+      password: params.password,
+    },
+  },
+};
+ 
+local App(params) = {
+  linuxServerApp: linuxserver.App(params.lsParams),
+  configMap: ConfigMap(params),
+};
+
+{
+  Params: Params,
+  ConfigMap: ConfigMap,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/core/network/network-policy.libsonnet b/k8s/configs/templates/core/network/network-policy.libsonnet
new file mode 100644
index 0000000..7a87b8a
--- /dev/null
+++ b/k8s/configs/templates/core/network/network-policy.libsonnet
@@ -0,0 +1,38 @@
+local base = import "k8s/configs/base.libsonnet";
+
+local Params = base.SimpleFieldStruct([
+    "namespace",
+    "name",
+    "podSelectorLabels",
+]) {};
+
+local App(params) = {
+    apiVersion: "networking.k8s.io/v1",
+    kind: "NetworkPolicy",
+    metadata: {
+        name: params.name,
+        namespace: params.namespace,
+    },
+    spec: {
+        podSelector: {
+            matchLabels: params.podSelectorLabels,
+        },
+        policyTypes: [
+            "Ingress",
+        ],
+        ingress: [
+            {
+                from: [
+                    {
+                        podSelector: {},
+                    },
+                ],
+            },
+        ],
+    },
+};
+
+{
+    Params: Params,
+    App: App,
+}
diff --git a/k8s/configs/templates/core/network/nginx-ingress.libsonnet b/k8s/configs/templates/core/network/nginx-ingress.libsonnet
new file mode 100644
index 0000000..6ed1eed
--- /dev/null
+++ b/k8s/configs/templates/core/network/nginx-ingress.libsonnet
@@ -0,0 +1,505 @@
+local kube = import "k8s/configs/base.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local OauthProxyAnnotations = {
+  "nginx.ingress.kubernetes.io/auth-response-headers": "x-auth-request-user, x-auth-request-email, x-auth-request-access-token",
+  "acme.cert-manager.io/http01-edit-in-place": "true",
+  "nginx.ingress.kubernetes.io/proxy-buffer-size": "16k"
+};
+
+local KubeOauthProxyAnnotations = OauthProxyAnnotations {
+  "nginx.ingress.kubernetes.io/auth-url": "https://oauth.cheapassbox.com/oauth2/auth",
+  "nginx.ingress.kubernetes.io/auth-signin": "https://oauth.cheapassbox.com/oauth2/start?rd=$scheme://$best_http_host$request_uri",
+
+};
+
+local KubeCsbxOauthProxyAnnotations = OauthProxyAnnotations {
+  "nginx.ingress.kubernetes.io/auth-url": "https://oauth.csbx.dev/oauth2/auth",
+  "nginx.ingress.kubernetes.io/auth-signin": "https://oauth.csbx.dev/oauth2/start?rd=$scheme://$best_http_host$request_uri",
+};
+
+local DominionOauthProxyAnnotations = OauthProxyAnnotations {
+  "nginx.ingress.kubernetes.io/auth-url": "https://oauth-dominion.cheapassbox.com/oauth2/auth",
+  "nginx.ingress.kubernetes.io/auth-signin": "https://oauth-dominion.cheapassbox.com/oauth2/start?rd=$scheme://$best_http_host$request_uri",
+};
+
+local DominionCsbxOauthProxyAnnotations = OauthProxyAnnotations {
+  "nginx.ingress.kubernetes.io/auth-url": "https://oauth-dominion.csbx.dev/oauth2/auth",
+  "nginx.ingress.kubernetes.io/auth-signin": "https://oauth-dominion.csbx.dev/oauth2/start?rd=$scheme://$best_http_host$request_uri",
+};
+
+local NginxPort = kube.simpleFieldStruct([
+  "port",
+  "toNamespace",
+  "toService",
+  "toPort",
+]) {};
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+]) {
+  image: images.Prod["nginx-ingress-controller"],
+  ingressClassName: "nginx",
+  clusterRoleName: "nginx-ingress",
+  httpNodePort: 32600,
+  httpsNodePort: 32601,
+  configMapName: "nginx-config",
+  # Type: NginxPort
+  otherUdpPorts : [NginxPort{
+    port: 31500, 
+    toNamespace: "dev", 
+    toService: "openssh-ssh-node", 
+    toPort: 31500
+  }],
+};
+
+
+local IngressClass(params) = kube.IngressClass(params.ingressClassName) {
+  metadata+: {
+    annotations+: {
+      "ingressclass.kubernetes.io/is-default-class": "true",
+    },
+  },
+  spec+: {
+    controller: "k8s.io/" + params.ingressClassName,
+  },
+};
+
+local ClusterRole(params) = kube.ClusterRole(params.clusterRoleName) {
+  rules: [
+    {
+      apiGroups: [""],
+      resources: ["configmaps", "endpoints", "nodes", "pods", "secrets"],
+      verbs: ["list", "watch"],
+    },
+    {
+      apiGroups: [""],
+      resources: ["nodes"],
+      verbs: ["get"],
+    },
+    {
+      apiGroups: [""],
+      resources: ["services"],
+      verbs: ["get", "list", "watch"],
+    },
+    {
+      apiGroups: [""],
+      resources: ["events"],
+      verbs: ["create", "patch"],
+    },
+    {
+      apiGroups: ["extensions", "networking.k8s.io"],
+      resources: ["ingresses"],
+      verbs: ["get", "list", "watch"],
+    },
+    {
+      apiGroups: ["extensions", "networking.k8s.io"],
+      resources: ["ingresses/status"],
+      verbs: ["update"],
+    },
+    {
+      apiGroups: ["networking.k8s.io"],
+      resources: ["ingressclasses"],
+      verbs: ["get", "list", "watch"],
+    },
+    {
+      apiGroups: ["discovery.k8s.io"],
+      resources: ["endpointslices"],
+      verbs: ["get", "list", "watch", "create", "patch", "update"],
+    },
+  ],
+};
+
+local ClusterRoleBinding(params) = kube.ClusterRoleBinding(params.clusterRoleName) {
+  roleRef: {
+    apiGroup: "rbac.authorization.k8s.io",
+    kind: "ClusterRole",
+    name: params.clusterRoleName,
+  },
+  subjects: [
+    {
+      kind: "ServiceAccount",
+      namespace: params.namespace,
+      name: "default",
+    },
+  ],
+};
+
+local ConfigMap(params) = kube.ConfigMap(params.namespace, params.configMapName) {
+  data: {
+    # Customizations for Emby, which would ideally be annotations.
+    # These settings don't seem to be supported as annotations though.
+    "use-gzip": "true",
+    "gzip-level": "6",
+    "gzip-min-length": "1100",
+    "gzip_types": std.join(" ", [
+      "text/plain",
+	    "text/css",
+	    "text/js",
+	    "text/xml",
+	    "text/javascript",
+	    "application/javascript",
+	    "application/x-javascript",
+	    "application/json",
+	    "application/xml",
+	    "application/rss+xml",
+	    "image/svg+xml",
+    ]),
+    "proxy-connect-timeout": "900",
+    "proxy-send-timeout": "900",
+    "proxy-read-timeout": "900",
+    #"enable-modsecurity": "true",
+    #"modescurity-snippet": |||
+      #SecRuleEngine On
+      #SecRequestBodyAccess On
+    #|||,
+    #"enable-owasp-modsecurity-crs": "true",
+  },
+};
+
+local OtherUdpPortConfigMap(params) = kube.ConfigMap(params.namespace, params.configMapName+"-other-udp") {
+  data: {
+    [std.toString(p.port)]: std.format("%s/%s:%d", [p.toNamespace, p.toService, p.toPort]) for p in params.otherUdpPorts
+  }
+};
+
+local Role(params) = kube.Role(params.namespace, params.name) {
+  rules: [
+    {
+      apiGroups: [""],
+      resources: ["configmaps", "pods", "secrets", "endpoints"],
+      verbs: ["get"],
+    },
+    {
+      apiGroups: [""],
+      resources: ["configmaps"],
+      resourceNames: [
+        "ingress-controller-leader-" + params.ingressClassName,
+        "ingress-controller-leader",
+      ],
+      verbs: ["get", "update"],
+    },
+    {
+      apiGroups: [""],
+      resources: ["configmaps"],
+      verbs: ["create"],
+    },
+    {
+      apiGroups: [""],
+      resources: ["endpoints"],
+      verbs: ["get"],
+    },
+    {
+      apiGroups: ["coordination.k8s.io"],
+      resources: ["leases"],
+      verbs: ["create", "get", "update"],
+    },
+
+  ]
+};
+
+local RoleBinding(params) = kube.RoleBinding(params.namespace, params.name) {
+  roleRef: {
+    apiGroup: "rbac.authorization.k8s.io",
+    kind: "Role",
+    name: params.name,
+  },
+  subjects: [
+    {
+      kind: "ServiceAccount",
+      namespace: params.namespace,
+      // TODO:
+      name: "default",
+    },
+  ],
+};
+
+
+local Service(params) = kube.Service(params.namespace, params.name) {
+  spec: {
+    type: "ClusterIP",
+    // TODO:
+    clusterIP: "10.3.0.12",
+    selector: {
+      name: params.name,
+      phase: "prod",
+    },
+    ports: [
+      {
+        name: "http",
+        protocol: "TCP",
+        port: 80,
+        targetPort: 80,
+      },
+      {
+        name: "https",
+        protocol: "TCP",
+        port: 443,
+        targetPort: 443,
+      },
+    ],
+  },
+};
+
+local HealthService(params) = kube.Service(params.namespace, params.name + "-health") {
+  spec: {
+    type: "ClusterIP",
+    selector: {
+      name: params.name,
+      phase: "prod",
+    },
+    ports: [
+      {
+        name: "health",
+        protocol: "TCP",
+        port: 10254,
+        targetPort: 10254,
+      },
+    ],
+  },
+};
+
+local NodeportService(params) = kube.Service(params.namespace, params.name + "-nodeports") {
+  // TODO(acmcarther): Revisit this nodeport-to-port-80
+  spec+: {
+    type: "NodePort",
+    selector: {
+      name: params.name,
+      phase: "prod",
+    },
+    ports: [
+      {
+        name: "http-node",
+        port: 80,
+        protocol: "TCP",
+        targetPort: 80,
+        nodePort: params.httpNodePort,
+      },
+      {
+        name: "https-node",
+        port: 443,
+        protocol: "TCP",
+        targetPort: 443,
+        nodePort: params.httpsNodePort,
+      },
+    ],
+  }
+};
+
+local Deployment(params) = kube.Deployment(params.namespace, params.name) {
+  // These probably don't work.
+  metadata+: {
+    annotations+: {
+      "prometheus.io/scrape": "true",
+      "prometheus.io/port": "10254",
+      #"prometheus.io/scheme": "http",
+    },
+  },
+  spec: {
+    replicas: 2,
+    strategy: {
+      rollingUpdate: {
+        maxUnavailable: 1,
+      },
+    },
+    selector: {
+      matchLabels: {
+        name: params.name,
+        phase: "prod"
+      },
+    },
+    template: {
+      metadata: {
+        labels: {
+          name: params.name,
+          phase: "prod"
+        },
+        annotations+: {
+          "prometheus.io/scrape": "true",
+          "prometheus.io/port": "10254",
+          #"prometheus.io/scheme": "http",
+        },
+      },
+      spec: {
+        securityContext: {
+          seccompProfile: {
+            type: "RuntimeDefault",
+          },
+        },
+        containers: [
+          {
+            name: "nginx-ingress-controller",
+            image: params.image,
+            args: [
+              "/nginx-ingress-controller",
+              #"--enable-prometheus-metrics",
+              "--controller-class=k8s.io/"+params.ingressClassName,
+              "--ingress-class="+params.ingressClassName,
+              "--configmap="+params.namespace+"/"+params.configMapName,
+              "--udp-services-configmap="+params.namespace+"/"+params.configMapName+"-other-udp",
+            ],
+            env: [
+              {
+                name: "POD_NAME",
+                valueFrom: {
+                  fieldRef: {
+                    fieldPath: "metadata.name",
+                  },
+                },
+              },
+              {
+                name: "POD_NAMESPACE",
+                valueFrom: {
+                  fieldRef: {
+                    fieldPath: "metadata.namespace",
+                  },
+                },
+              },
+            ],
+            ports: [
+              {
+                name: "http",
+                containerPort: 80
+              },
+              {
+                name: "https",
+                containerPort: 443
+              },
+              {
+                name: "prometheus",
+                containerPort: 9113
+              },
+              {
+                name: "health",
+                containerPort: 10254
+              },
+            ],
+            livenessProbe: {
+              httpGet: {
+                path: "/healthz",
+                port: 10254,
+                scheme: "HTTP",
+              },
+              initialDelaySeconds: 10,
+              periodSeconds: 10,
+              successThreshold: 1,
+              failureThreshold: 3,
+              timeoutSeconds: 5,
+            },
+            readinessProbe: {
+              httpGet: {
+                path: "/healthz",
+                port: 10254,
+                scheme: "HTTP",
+              },
+              periodSeconds: 10,
+              successThreshold: 1,
+              failureThreshold: 3,
+              timeoutSeconds: 5,
+            },
+            lifecycle: {
+              preStop: {
+                exec: {
+                  command: [
+                    "/wait-shutdown",
+                  ],
+                },
+              },
+            },
+            securityContext:  {
+              capabilities: {
+                add: [
+                  "NET_BIND_SERVICE",
+                ],
+                drop: [
+                  "ALL",
+                ],
+              },
+              runAsUser: 101 # www-data
+            },
+          },
+        ],
+        restartPolicy: "Always",
+        terminationGracePeriodSeconds: 300,
+      },
+    },
+  },
+};
+
+local App(params) = {
+  resources: kube.List() {
+    items_+: {
+      ingressClass: IngressClass(params),
+      clusterRole: ClusterRole(params),
+      clusterRoleBinding: ClusterRoleBinding(params),
+      configMap: ConfigMap(params),
+      otherUdpPortConfigMap: OtherUdpPortConfigMap(params),
+      role: Role(params),
+      roleBinding: RoleBinding(params),
+      service: Service(params),
+      healthService: HealthService(params),
+      nodeportService: NodeportService(params),
+      deployment: Deployment(params),
+    },
+  },
+};
+
+local IngressParams = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "hosts",
+  "serviceName",
+]) {
+  servicePort: 80,
+  tlsSecretName: $.name + "-cert",
+  annotations: {}
+};
+
+local Ingress(params) = kube.Ingress(params.namespace, params.name) {
+  metadata+: {
+    annotations+: {
+      "cert-manager.io/cluster-issuer": "letsencrypt-production",
+    } + params.annotations,
+  },
+  spec+: {
+    ingressClassName: "nginx",
+    tls: [
+      {
+        hosts: params.hosts, 
+        secretName: params.tlsSecretName,
+      },
+    ],
+    rules: [
+      {
+        host: host,
+        http: {
+          paths: [
+            {
+              path: "/",
+              pathType: "Prefix",
+              backend: {
+                service: {
+                  name: params.serviceName,
+                  port: { number: params.servicePort },
+                }
+              },
+            },
+          ],
+        },
+      },
+    for host in params.hosts],
+  }
+};
+
+{
+  KubeOauthProxyAnnotations: KubeOauthProxyAnnotations,
+  DominionOauthProxyAnnotations: DominionOauthProxyAnnotations,
+  KubeCsbxOauthProxyAnnotations: KubeCsbxOauthProxyAnnotations,
+  DominionCsbxOauthProxyAnnotations: DominionCsbxOauthProxyAnnotations,
+  IngressParams: IngressParams,
+  Ingress: Ingress,
+  Params: Params,
+  App(params): App(params),
+}
+
diff --git a/k8s/configs/templates/core/nvidia-gpu-operator.libsonnet b/k8s/configs/templates/core/nvidia-gpu-operator.libsonnet
new file mode 100644
index 0000000..ed0cfb5
--- /dev/null
+++ b/k8s/configs/templates/core/nvidia-gpu-operator.libsonnet
@@ -0,0 +1,32 @@
+local images = import "k8s/configs/images.libsonnet";
+local base = import "k8s/configs/base.libsonnet";
+
+local Params = base.SimpleFieldStruct([
+    "namespace",
+    "context",
+]) {};
+
+local App(params) = {
+    local chartPath = "../../external/+helm_deps+helm_nvidia_gpu_operator",
+    app: params.context.helm.template("nvidia-gpu-operator", chartPath, {
+        //local image = images.Prod["grafana/grafana"],
+        namespace: params.namespace,
+        values: {
+            driver: {
+                enabled: false
+            },
+            nvidiaDriverCRD: {
+                enabled: true
+            },
+            toolkit: {
+                # Disabled recently
+                enabled: true
+            },
+        },
+    })
+};
+
+{
+    Params: Params,
+    App: App,
+}
diff --git a/k8s/configs/templates/core/observability/grafana.libsonnet b/k8s/configs/templates/core/observability/grafana.libsonnet
new file mode 100644
index 0000000..56d6948
--- /dev/null
+++ b/k8s/configs/templates/core/observability/grafana.libsonnet
@@ -0,0 +1,71 @@
+local images = import "k8s/configs/images.libsonnet";
+local base = import "k8s/configs/base.libsonnet";
+
+local Params = base.SimpleFieldStruct([
+    "namespace",
+    "context",
+    "hosts",
+    "ingressAnnotations"
+]) {};
+
+local App(params) = {
+  local chartPath = "../../external/+helm_deps+helm_grafana_grafana",
+  app: params.context.helm.template("grafana", chartPath, {
+    local image = images.Prod["grafana/grafana"],
+    namespace: params.namespace,
+    values: {
+      adminUser: "admin",
+      // TODO:
+      adminPassword: "admin",
+      image: {
+        repository: std.split(image, ":")[0],
+        tag: std.split(image, ":")[1],
+      },
+      persistence: { 
+        enabled: true,
+        storageClassName: "nfs-client",
+        existingClaim: "grafana",
+      },
+      ingress: {
+        enabled: false,
+        ingressClassName: "nginx",
+        hosts: params.hosts,
+        tls: [
+            {
+                hosts: params.hosts,
+                secretName: "grafana-cert",
+            },
+        ],
+        annotations: params.ingressAnnotations
+      },
+      "datasources": {
+        "prometheus.yaml": {
+          apiVersion: 1,
+          datasources: [
+            {
+              name: "prometheus",
+              type: "prometheus",
+              access: "proxy",
+              url: "http://prometheus-server.monitoring.svc.cluster.local",
+              version: 1,
+              editable: false,
+            },
+          ],
+        },
+      },
+      "grafana.ini" +:: {
+        "auth.anonymous" +:: {
+          enabled: true,
+        },
+        server: {
+          domain: "grafana.csbx.dev",
+        },
+      },
+    },
+  })
+};
+
+{
+    Params: Params,
+    App: App,
+}
\ No newline at end of file
diff --git a/k8s/configs/templates/core/observability/jaeger-operator.libsonnet b/k8s/configs/templates/core/observability/jaeger-operator.libsonnet
new file mode 100644
index 0000000..15b2e28
--- /dev/null
+++ b/k8s/configs/templates/core/observability/jaeger-operator.libsonnet
@@ -0,0 +1,23 @@
+local base = import "k8s/configs/base.libsonnet";
+
+local Params = base.SimpleFieldStruct([
+    "namespace",
+    "context",
+]) {};
+
+local App(params) = {
+    local chartPath = "../../external/+helm_deps+helm_jaegertracing_jaeger_operator",
+    app: params.context.helm.template("jaeger-operator", chartPath, {
+        namespace: params.namespace,
+        values: {
+            rbac: {
+                clusterRole: true,
+            },
+        },
+    }),
+};
+
+{
+    Params: Params,
+    App: App,
+}
diff --git a/k8s/configs/templates/core/observability/kube-ops-view.libsonnet b/k8s/configs/templates/core/observability/kube-ops-view.libsonnet
new file mode 100644
index 0000000..8b2275f
--- /dev/null
+++ b/k8s/configs/templates/core/observability/kube-ops-view.libsonnet
@@ -0,0 +1,138 @@
+local kube = import "k8s/configs/base.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local nginxIngress = import "k8s/configs/templates/core/network/nginx-ingress.libsonnet";
+
+local WebPort = 8080;
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "clusterRoleName",
+  "hosts",
+]) {
+  image: images.Prod["hjacobs/kube-ops-view"],
+  resources: {
+    limits: {
+      cpu: "100m",
+      memory: "128Mi",
+    },
+    requests: {
+      cpu: "80m",
+      memory: "64Mi",
+    },
+  },
+};
+
+local Selector(params) = {
+  name: params.name,
+  phase: "prod",
+};
+
+local ClusterRole(params) = kube.ClusterRole(params.clusterRoleName) {
+  rules: [
+    {
+      apiGroups: [""],
+      resources: ["nodes", "pods"],
+      verbs: ["list"],
+    },
+    {
+      apiGroups: ["metrics.k8s.io"],
+      resources: ["nodes", "pods"],
+      verbs: ["get", "list"],
+    },
+  ],
+};
+
+local ServiceAccount(params) =  kube.ServiceAccount(params.namespace, params.name);
+
+local ClusterRoleBinding(params) = kube.ClusterRoleBinding(params.clusterRoleName + "-" + params.name) {
+  roleRef: {
+    apiGroup: "rbac.authorization.k8s.io",
+    kind: "ClusterRole",
+    name: params.clusterRoleName,
+  },
+  subjects: [
+    {
+      kind: "ServiceAccount",
+      name: params.name,
+      namespace: params.namespace,
+    },
+  ],
+};
+
+local Service(params) = kube.Service(params.namespace, params.name) {
+  spec+: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort) {
+    selector: Selector(params),
+  },
+};
+
+local Deployment(params) = kube.Deployment(params.namespace, params.name) {
+  spec+: {
+    replicas: 1,
+    strategy: kube.DeployUtil.SimpleRollingUpdate(),
+    selector: {
+      matchLabels: Selector(params),
+    },
+    template: {
+      metadata: {
+        labels: Selector(params),
+      },
+      spec: {
+        serviceAccountName: params.name,
+        containers: [
+          {
+            name: "kube-ops-view",
+            image: params.image,
+            imagePullPolicy: "IfNotPresent",
+            ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+            livenessProbe: {
+              initialDelaySeconds: 30,
+              httpGet: {
+                path: "/health",
+                port: 8080,
+              },
+            },
+            env: [
+              //kube.NameVal("CLUSTERS", "http://k8s.dominion.lan:6443/"),
+            ],
+            readinessProbe: {
+              initialDelaySeconds: 30,
+              httpGet: {
+                path: "/health",
+                port: 8080,
+              },
+            },
+            resources: params.resources,
+          },
+        ],
+      },
+    },
+  },
+};
+
+local App(params) = {
+  resources: kube.List() {
+    items_+: {
+      serviceAccount: ServiceAccount(params),
+      clusterRoleBinding: ClusterRoleBinding(params),
+      service: Service(params),
+      deployment: Deployment(params),
+      clusterRole: ClusterRole(params),
+      ingress: nginxIngress.Ingress(nginxIngress.IngressParams {
+          namespace: params.namespace,
+          name: params.name,
+          hosts: params.hosts,
+          serviceName: "kube-ops-view",
+          annotations: params.ingressAnnotations,
+      }),
+    },
+  },
+};
+
+{
+  WebPort: WebPort,
+  Params: Params,
+  ClusterRole(params): ClusterRole(params),
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/core/observability/prometheus.libsonnet b/k8s/configs/templates/core/observability/prometheus.libsonnet
new file mode 100644
index 0000000..3d584dd
--- /dev/null
+++ b/k8s/configs/templates/core/observability/prometheus.libsonnet
@@ -0,0 +1,34 @@
+local images = import "k8s/configs/images.libsonnet";
+local base = import "k8s/configs/base.libsonnet";
+
+local Params = base.SimpleFieldStruct([
+    "namespace",
+    "context",
+    "existingClaim"
+]) {};
+
+local App(params) = {
+    local chartPath = "../../external/+helm_deps+helm_prometheuscommunity_prometheus",
+    app: params.context.helm.template("prometheus", chartPath, {
+        //local image = images.Prod["grafana/grafana"],
+        namespace: params.namespace,
+        values: {
+            server: {
+                persistentVolume: {
+                    enabled: true,
+                    existingClaim: "prometheus-server",
+                    storageClass: "nfs-client",
+                    accessModes: [
+                        "ReadWriteOnce",
+                    ],
+                    size: "8Gi"
+                },
+            },
+        },
+    })
+};
+
+{
+    Params: Params,
+    App: App,
+}
\ No newline at end of file
diff --git a/k8s/configs/templates/core/pubsub/eclipse-mosquitto.libsonnet b/k8s/configs/templates/core/pubsub/eclipse-mosquitto.libsonnet
new file mode 100644
index 0000000..51167f4
--- /dev/null
+++ b/k8s/configs/templates/core/pubsub/eclipse-mosquitto.libsonnet
@@ -0,0 +1,90 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local probe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 15,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local WebPort = 1883;
+
+// This needs to be secured properly.
+local ConfigMap(params) = kube.ConfigMap(params.namespace, params.name + "-config") {
+  data: {
+    "mosquitto.conf": |||
+      persistence true
+      persistence_location /mosquitto/data/
+    ||| % {
+      login: params.login,
+      password: params.password,
+    },
+  },
+};
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "mosquittoDataClaimName",
+]) {
+  labels: {},
+  gatekeeperSidecar: null,
+  mosquittoConfigMapName: "mosquitto-frigate-config",
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "eclipse-mosquitto",
+    imageName: "eclipse-mosquitto",
+    labels+: $.labels,
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    services: [
+      linuxserver.Service {
+        suffix: "api",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+      },
+    ],
+    ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+    configMaps: [
+      linuxserver.ConfigMap {
+        name: "config",
+        mountPath: "/mosquitto/config",
+        bindName: $.mosquittoConfigMapName,
+      },
+    ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "mosquitto-data",
+        mountPath: "/mosquitto/data",
+        bindName: $.mosquittoDataClaimName,
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "100m",
+        memory: "300Mi",
+      },
+      limits: {
+        cpu: "200m",
+        memory: "600Mi",
+      },
+    },
+    livenessProbe: probe(/*delaySeconds=*/60),
+    readinessProbe: probe(/*delaySeconds=*/60),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams) {
+  configMap: ConfigMap(params)
+};
+
+{
+  WebPort: WebPort,
+  Params: Params,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/core/security/cert-manager.libsonnet b/k8s/configs/templates/core/security/cert-manager.libsonnet
new file mode 100644
index 0000000..d00cdf2
--- /dev/null
+++ b/k8s/configs/templates/core/security/cert-manager.libsonnet
@@ -0,0 +1,26 @@
+local base = import "k8s/configs/base.libsonnet";
+
+local Params = base.SimpleFieldStruct([
+    "namespace",
+    "name",
+    "context",
+    "values",
+]) {
+    installCRDs: true,
+};
+
+local App(params) = {
+    local chartPath = "../../external/+helm_deps+helm_jetstack_cert_manager",
+    
+    app: params.context.helm.template(params.name, chartPath, {
+        namespace: params.namespace,
+        values: params.values {
+            installCRDs: params.installCRDs,
+        },
+    })
+};
+
+{
+    Params: Params,
+    App: App,
+}
diff --git a/k8s/configs/templates/core/security/grpc-ca-setup.libsonnet b/k8s/configs/templates/core/security/grpc-ca-setup.libsonnet
new file mode 100644
index 0000000..f6ba29e
--- /dev/null
+++ b/k8s/configs/templates/core/security/grpc-ca-setup.libsonnet
@@ -0,0 +1,73 @@
+// This template creates the necessary resources for gRPC mTLS.
+// It creates a self-signed root CA, a ClusterIssuer that uses it,
+// and a trust-manager Bundle to distribute the CA.
+function(name, namespace, selector) [
+  {
+    apiVersion: 'cert-manager.io/v1',
+    kind: 'ClusterIssuer',
+    metadata: {
+      name: name + '-selfsigned-ca-issuer',
+    },
+    spec: {
+      selfSigned: {},
+    },
+  },
+  {
+    apiVersion: 'cert-manager.io/v1',
+    kind: 'Certificate',
+    metadata: {
+      name: name + '-root-ca',
+      namespace: namespace,
+    },
+    spec: {
+      isCA: true,
+      commonName: name + '-root-ca',
+      secretName: name + '-root-ca-secret',
+      privateKey: {
+        algorithm: 'ECDSA',
+        size: 256,
+      },
+      issuerRef: {
+        name: name + '-selfsigned-ca-issuer',
+        kind: 'ClusterIssuer',
+      },
+    },
+  },
+  {
+    apiVersion: 'cert-manager.io/v1',
+    kind: 'ClusterIssuer',
+    metadata: {
+      name: name + '-grpc-ca-issuer',
+    },
+    spec: {
+      ca: {
+        secretName: name + '-root-ca-secret',
+      },
+    },
+  },
+  {
+    apiVersion: 'trust.cert-manager.io/v1alpha1',
+    kind: 'Bundle',
+    metadata: {
+      name: name + '-grpc-trust-bundle',
+    },
+    spec: {
+      sources: [
+        {
+          secret: {
+            name: name + '-root-ca-secret',
+            key: 'ca.crt',
+          },
+        },
+      ],
+      target: {
+        configMap: {
+          key: 'ca.pem',
+        },
+        namespaceSelector: {
+          matchLabels: selector,
+        },
+      },
+    },
+  },
+]
\ No newline at end of file
diff --git a/k8s/configs/templates/core/security/keycloak.libsonnet b/k8s/configs/templates/core/security/keycloak.libsonnet
new file mode 100644
index 0000000..0f6062d
--- /dev/null
+++ b/k8s/configs/templates/core/security/keycloak.libsonnet
@@ -0,0 +1,52 @@
+local images = import "k8s/configs/images.libsonnet";
+local base = import "k8s/configs/base.libsonnet";
+
+local Params = base.SimpleFieldStruct([
+    "namespace",
+    "context",
+    //"hosts",
+    "postgresDbService",
+    "postgresDbNamespace",
+    "postgresDbUser",
+    //"ingressAnnotations"
+    "adminPassword",
+    "authPassword",
+    "dbPassword",
+]) {};
+
+local App(params) = {
+  local chartPath = "../../external/+helm_deps+helm_bitnami_keycloak",
+  app: params.context.helm.template("keycloak", chartPath, {
+    namespace: params.namespace,
+    values: {
+      global: {
+        storageClass: "nfs-client",
+      },
+      image: {
+        tag: "21.1.2-debian-11-r27",
+      },
+      auth: {
+        adminUser: "keycloak",
+        adminPassword: params.adminPassword,
+      },
+      extraStartupArgs: "-Dkeycloak.profile.feature.docker=enabled",
+      // Fails some validation.
+      production: true,
+      proxy: "edge",
+      postgresql: { 
+        enabled: true,
+        auth: {
+          postgresPassword: params.dbPassword,
+          password: params.dbPassword,
+        },
+      },
+    },
+  })
+};
+
+{
+    Params: Params,
+    App: App,
+}
+
+
diff --git a/k8s/configs/templates/core/security/oauth2-proxy.libsonnet b/k8s/configs/templates/core/security/oauth2-proxy.libsonnet
new file mode 100644
index 0000000..32b0d13
--- /dev/null
+++ b/k8s/configs/templates/core/security/oauth2-proxy.libsonnet
@@ -0,0 +1,246 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local WebPort = 4180;
+local MetricsPort = 44180;
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  // TODO: add back when redis support is added.
+  //"dbClaimName",
+  "ingressHost",
+  "domains",
+  "oicdIssuerURL",
+  "secretName",
+]) {
+  labels: {},
+  gatekeeperSidecar: null,
+  configMapName: $.name + "-config",
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "oauth2-proxy",
+    imageName: "quay.io/oauth2-proxy/oauth2-proxy",
+    labels+: $.labels,
+    args: [
+      "--http-address=0.0.0.0:4180",
+      "--metrics-address=0.0.0.0:44180",
+      "--config=/etc/oauth2_proxy/oauth2_proxy.cfg",
+    ] + [
+      "--cookie-domain=.%s" % domain for domain in $.domains
+    ] + [
+      "--whitelist-domain=.%s" % domain for domain in $.domains
+    ],
+    env: linuxserver.Env {
+      others: [
+        {
+          name: "OAUTH2_PROXY_CLIENT_ID",
+          valueFrom: {
+            secretKeyRef: {
+              name: $.secretName,
+              key: "client-id"
+            }
+          }
+        },
+        {
+          name: "OAUTH2_PROXY_CLIENT_SECRET",
+          valueFrom: {
+            secretKeyRef: {
+              name: $.secretName,
+              key: "client-secret"
+            }
+          }
+        },
+        {
+          name: "OAUTH2_PROXY_COOKIE_SECRET",
+          valueFrom: {
+            secretKeyRef: {
+              name: $.secretName,
+              key: "cookie-secret"
+            }
+          }
+        },
+      ],
+    }, 
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: {
+          type: "ClusterIP",
+          ports: [
+            kube.SvcUtil.TCPServicePort("http", 80) {
+              targetPort: WebPort
+            },
+          ],
+        },
+      },
+    ],
+    serviceAccounts: [
+      linuxserver.ServiceAccount {
+        suffix: "",
+        spec: {
+          automountServiceAccountToken: true
+        },
+      }, 
+    ],
+    ports: [ 
+      kube.DeployUtil.ContainerPort("http", WebPort), 
+      kube.DeployUtil.ContainerPort("metrics", MetricsPort), 
+    ],
+    configMaps: [
+      linuxserver.ConfigMap {
+        name: "config",
+        mountPath: "/etc/oauth2_proxy/oauth2_proxy.cfg",
+        mountSubPath: "oauth2_proxy.cfg",
+        bindName: $.configMapName,
+        items: [
+          {
+            key: "oauth2_proxy.cfg",
+            path: "oauth2_proxy.cfg",
+          },
+        ],
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "100m",
+        memory: "200Mi",
+      },
+      limits: {
+        cpu: "400m",
+        memory: "400Mi",
+      },
+    },
+    livenessProbe: {
+      httpGet: {
+        path: "/ping",
+        port: "http",
+        scheme: "HTTP",
+      },
+      initialDelaySeconds: 60,
+      timeoutSeconds: 1,
+    },
+    readinessProbe: {
+      httpGet: {
+        path: "/ready",
+        port: "http",
+        scheme: "HTTP",
+      },
+      initialDelaySeconds: 60,
+      timeoutSeconds: 5,
+      successThreshold: 1,
+      periodSeconds: 10,
+    },
+  },
+};
+
+local Ingress(params) = kube.Ingress(params.namespace, params.name) {
+  metadata+: {
+    annotations+: {
+      "cert-manager.io/cluster-issuer": "letsencrypt-production",
+      "nginx.ingress.kubernetes.io/proxy-buffer-size": "16k"
+    },
+  },
+  spec+: {
+    ingressClassName: "nginx",
+    tls: [
+      {
+        hosts: [
+          params.ingressHost,
+        ],
+        secretName: params.name + "-cert",
+      },
+    ],
+    rules: [
+      {
+        host: params.ingressHost,
+        http: {
+          paths: [
+            {
+              path: "/",
+              pathType: "Prefix",
+              backend: {
+                service: {
+                  name: params.name + '-ui',
+                  port: { number: 80 } ,
+                },
+              },
+            },
+          ],
+        },
+      },
+    ]
+  },
+};
+
+
+local ConfigMap(params) = kube.ConfigMap(params.namespace, params.name + "-config") {
+  data: {
+    "oauth2_proxy.cfg": |||
+      reverse_proxy = true 
+      
+      provider = "oidc"
+      provider_display_name = "Keycloak"
+      oidc_issuer_url = "%(oicdIssuerURL)s"
+      email_domains = [ "*" ]
+      scope = "openid profile email"
+      pass_authorization_header = true
+      pass_access_token = true
+      pass_user_headers = true
+      set_authorization_header = true
+      set_xauthrequest = true
+      cookie_refresh = "1m"
+      cookie_expire = "90m"
+
+      # we constrain the valid set of emails
+      insecure_oidc_allow_unverified_email="true"
+    ||| % {
+      oicdIssuerURL: params.oicdIssuerURL
+    },
+  },
+};
+
+local SecretParams = kube.simpleFieldStruct([
+  "name",
+  "namespace",
+  "cookieSecret",
+  "clientSecret",
+  "clientId"
+]);
+
+local Secret(params) = kube.Secret(params.namespace, params.name) {
+  type: "Opaque",
+  data+: {
+    "cookie-secret": params.cookieSecret, 
+    "client-secret": params.clientSecret, 
+    "client-id": params.clientId, 
+  }
+};
+
+local App(params) = linuxserver.App(params.lsParams) {
+  configMap: ConfigMap(params),
+  ingress: Ingress(params),
+  deployment+: {
+    spec+: {
+      template+: {
+        spec+: {
+          serviceAccountName: params.name, 
+          automountServiceAccountToken: true,
+        },
+      },
+    },
+  },
+};
+
+{
+  WebPort: WebPort,
+  SecretParams: SecretParams,
+  Secret: Secret,
+  Params: Params,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/core/security/trust-manager.libsonnet b/k8s/configs/templates/core/security/trust-manager.libsonnet
new file mode 100644
index 0000000..f7cff01
--- /dev/null
+++ b/k8s/configs/templates/core/security/trust-manager.libsonnet
@@ -0,0 +1,30 @@
+local images = import "k8s/configs/images.libsonnet";
+local base = import "k8s/configs/base.libsonnet";
+
+local Params = base.SimpleFieldStruct([
+    "namespace",
+    "context",
+]) {
+    trustNamespace: "cert-manager",
+};
+
+local App(params) = {
+    app: params.context.helm.template("trust-manager", "./charts/trust-manager", {
+        namespace: params.namespace,
+        values: {
+            app: {
+                trust: {
+                    namespace: params.trustNamespace,
+                },
+            },
+            secretTargets: {
+                enabled: true,
+            },
+        },
+    })
+};
+
+{
+    Params: Params,
+    App: App,
+}
diff --git a/k8s/configs/templates/core/security/vault.libsonnet b/k8s/configs/templates/core/security/vault.libsonnet
new file mode 100644
index 0000000..d0e3c2c
--- /dev/null
+++ b/k8s/configs/templates/core/security/vault.libsonnet
@@ -0,0 +1,58 @@
+local images = import "k8s/configs/images.libsonnet";
+local base = import "k8s/configs/base.libsonnet";
+
+local SecretParams = base.SimpleFieldStruct([
+  "namespace",
+  "name",
+]);
+
+local Secret(params) = base.Secret(params.namespace, params.name) {
+  type: "Opaque",
+  data+: {
+    // TODO:
+  }
+};
+
+local Params = base.SimpleFieldStruct([
+    "namespace",
+    "context",
+    // TODO:
+]) {};
+
+local App(params) = {
+    local chartPath = "../../external/+helm_deps+helm_hashicorp_vault",
+    app: params.context.helm.template("vault", chartPath, {
+        namespace: params.namespace,
+        values: {
+            server: {
+                ha: {
+                    enabled: true,
+                    replicas: 3,
+                    raft: {
+                        enabled: true,
+                        # TODO: Update config to enable metric access for Prometheus?
+                    }
+                },
+                dataStorage: {
+                    storageClass: "nfs-client",
+                },
+                auditStorage: {
+                    enabled: true,
+                    storageClass: "nfs-client",
+                },
+            },
+            ui: {
+                enabled: true,
+            }
+        },
+    })
+};
+
+{
+  SecretParams: SecretParams,
+  Secret: Secret,
+  Params: Params,
+  App: App,
+}
+
+
diff --git a/k8s/configs/templates/core/storage/chromadb.libsonnet b/k8s/configs/templates/core/storage/chromadb.libsonnet
new file mode 100644
index 0000000..233bf4c
--- /dev/null
+++ b/k8s/configs/templates/core/storage/chromadb.libsonnet
@@ -0,0 +1,59 @@
+local base = import "k8s/configs/base.libsonnet";
+
+local Params = base.SimpleFieldStruct([
+    "namespace",
+    "name",
+    "filePath",
+    "dataClaimName",
+]) {};
+
+local App(params) =
+    local rendered = base.helm.template(params.name, "./charts/chromadb", {
+        namespace: params.namespace,
+        values: {
+            chromadb: {
+                isPersistent: false,
+            },
+        }
+    });
+    {
+        // Find the StatefulSet and patch it.
+        [k]: if std.objectHas(rendered[k], "kind") && rendered[k].kind == "StatefulSet" then
+            local original_volumes = if std.objectHas(rendered[k].spec.template.spec, "volumes") then rendered[k].spec.template.spec.volumes else [];
+            rendered[k] + {
+                spec+: {
+                    template+: {
+                        spec+: {
+                            volumes: original_volumes + [
+                                {
+                                    name: "data",
+                                    persistentVolumeClaim: {
+                                        claimName: params.dataClaimName,
+                                    },
+                                },
+                            ],
+                            containers: [
+                                local original_mounts = if std.objectHas(c, "volumeMounts") then c.volumeMounts else [];
+                                c + {
+                                    volumeMounts: original_mounts + [
+                                        {
+                                            name: "data",
+                                            mountPath: "/data",
+                                        },
+                                    ]
+                                }
+                                for c in rendered[k].spec.template.spec.containers
+                                if c.name == "chromadb"
+                            ],
+                        },
+                    },
+                },
+            }
+        else rendered[k]
+        for k in std.objectFields(rendered)
+    };
+
+{
+    Params: Params,
+    App: App,
+}
\ No newline at end of file
diff --git a/k8s/configs/templates/core/storage/mariadb.libsonnet b/k8s/configs/templates/core/storage/mariadb.libsonnet
new file mode 100644
index 0000000..7bcb295
--- /dev/null
+++ b/k8s/configs/templates/core/storage/mariadb.libsonnet
@@ -0,0 +1,345 @@
+local kube = import "k8s/configs/base.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+local templates = import "k8s/configs/templates/templates.libsonnet";
+
+local SecretParams = kube.simpleFieldStruct([
+  "name",
+  "namespace",
+  "rootPassword",
+  "password",
+],) {};
+
+local Secret(params) = kube.Secret(params.namespace, params.name) {
+  type: "Opaque",
+  data+: {
+    "mariadb-root-password": params.rootPassword, 
+    "mariadb-password": params.password,
+  }
+};
+
+local Labels(params) = {
+  name: params.name,
+  phase: "prod",
+};
+
+local Selector(params) = {
+  name: params.name,
+  phase: "prod",
+};
+
+local Annotations(params) = templates.annotations(params.filePath, std.thisFile);
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "dataClaimName",
+  "secretName",
+  "dbName",
+  "dbUser",
+]) {
+  // "docker.io/bitnami/mysqld-exporter:0.12.1-debian-9-r29",
+  metricsImage: images.Prod["docker.io/bitnami/mysqld-exporter"],
+  // "docker.io/bitnami/mariadb:10.3.17-debian-9-r29"
+  image: images.Prod["docker.io/bitnami/mariadb"],
+  maxAllowedPacket: "16M",
+  sqlModeStrictAllTables: false,
+  resources: {
+    requests: {
+      cpu: "200m",
+      memory: "256Mi",
+    },
+    limits: {
+      cpu: "400m",
+      memory: "512Mi",
+    },
+  },
+};
+
+local ConfigMap(params) = kube.ConfigMap(params.namespace, params.name) {
+  data: {
+    "my.cnf": |||
+      [mysqld]
+      skip-name-resolve
+      explicit_defaults_for_timestamp
+      basedir=/opt/bitnami/mariadb
+      port=3306
+      socket=/opt/bitnami/mariadb/tmp/mysql.sock
+      tmpdir=/opt/bitnami/mariadb/tmp
+      max_allowed_packet=%(max_allowed_packet)s
+      bind-address=0.0.0.0
+      pid-file=/opt/bitnami/mariadb/tmp/mysqld.pid
+      log-error=/opt/bitnami/mariadb/logs/mysqld.log
+      character-set-server=UTF8
+      collation-server=utf8_general_ci
+      %(sql_mode_strict_all_tables_str)s
+      
+      [client]
+      port=3306
+      socket=/opt/bitnami/mariadb/tmp/mysql.sock
+      default-character-set=UTF8
+      
+      [manager]
+      port=3306
+      socket=/opt/bitnami/mariadb/tmp/mysql.sock
+      pid-file=/opt/bitnami/mariadb/tmp/mysqld.pid"
+    ||| % {
+      max_allowed_packet: params.maxAllowedPacket,
+      sql_mode_strict_all_tables_str: if params.sqlModeStrictAllTables then "sql_mode=STRICT_ALL_TABLES" else "",
+    },
+  },
+};
+
+local ServiceAccount(params) = kube.ServiceAccount(params.namespace, params.name);
+
+local Role(params) = kube.Role(params.namespace, params.name) {
+  rules: [
+    {
+      apiGroups: [""],
+      resources: ["endpoints"],
+      verbs: ["get"],
+    }
+  ],
+};
+
+local RoleBinding(params) = kube.RoleBinding(params.namespace, params.name) {
+  subjects: [
+    {
+      kind: "ServiceAccount",
+      name: params.name,
+      namespace: params.namespace,
+    },
+  ],
+  roleRef: {
+    kind: "Role",
+    name: params.name,
+    apiGroup: "rbac.authorization.k8s.io",
+  },
+};
+
+local Service(params) = kube.Service(params.namespace, params.name) {
+  metadata+: {
+    labels+: Labels(params),
+    annotations+: Annotations(params) + {
+      "prometheus.io/port": "9104",
+      "prometheus.io/scrape": "true",
+    },
+  },
+  spec+: {
+    type: "ClusterIP",
+    //clusterIP: "None",
+    ports: [
+      {
+        name: "mysql",
+        port: 3306,
+        targetPort: "mysql",
+      },
+      {
+        name: "metrics",
+        port: 9104,
+        targetPort: "metrics"
+      },
+    ],
+    selector: Selector(params)
+  },
+};
+
+local MariaDBContainer(params) = {
+  name: "mariadb",
+  image: params.image,
+  imagePullPolicy: "IfNotPresent",
+  env: [
+    {
+      name: "MARIADB_EXTRA_FLAGS",
+      value: "--local-infile=0"
+    },
+    {
+      name: "MARIADB_ROOT_PASSWORD",
+      valueFrom: {
+        secretKeyRef: {
+          name: params.secretName,
+          key: "mariadb-root-password",
+        }
+      }
+    },
+    {
+      name: "MARIADB_USER",
+      value: params.dbUser
+    },
+    {
+      name: "MARIADB_PASSWORD",
+      valueFrom: {
+        secretKeyRef: {
+          name: params.secretName,
+          key: "mariadb-password",
+        }
+      }
+    },
+    {
+      name: "MARIADB_DATABASE",
+      value: params.dbName,
+    }
+  ],
+  ports: [
+    {
+      name: "mysql",
+      containerPort: 3306
+    }
+  ],
+  livenessProbe: {
+    exec: {
+      command: [
+        "sh",
+        "-c",
+        "exec mysqladmin status -uroot -p$MARIADB_ROOT_PASSWORD"
+      ]
+    },
+    initialDelaySeconds: 120,
+    periodSeconds: 10,
+    timeoutSeconds: 1,
+    successThreshold: 1,
+    failureThreshold: 3
+  },
+  readinessProbe: {
+    exec: {
+      command: [
+        "sh",
+        "-c",
+        "exec mysqladmin status -uroot -p$MARIADB_ROOT_PASSWORD"
+      ]
+    },
+    initialDelaySeconds: 30,
+    periodSeconds: 10,
+    timeoutSeconds: 1,
+    successThreshold: 1,
+    failureThreshold: 3
+  },
+  resources: params.resources,
+  volumeMounts: [
+    {
+      name: "data",
+      mountPath: "/bitnami/mariadb"
+    },
+    {
+      name: "config",
+      mountPath: "/opt/bitnami/mariadb/conf/my.cnf",
+      subPath: "my.cnf"
+    }
+  ]
+};
+
+local MetricsContainer(params) = {
+  name: "metrics",
+  image: params.metricsImage,
+  imagePullPolicy: "IfNotPresent",
+  env: [
+    {
+      name: "MARIADB_ROOT_PASSWORD",
+      valueFrom: {
+        secretKeyRef: {
+          name: params.secretName,
+          key: "mariadb-root-password",
+        }
+      }
+    }
+  ],
+  command: [
+    "sh",
+    "-c",
+    "DATA_SOURCE_NAME=\"root:$MARIADB_ROOT_PASSWORD@(localhost:3306)/\" /bin/mysqld_exporter"
+  ],
+  ports: [
+    {
+      name: "metrics",
+      containerPort: 9104
+    }
+  ],
+  livenessProbe: {
+    httpGet: {
+      path: "/metrics",
+      port: "metrics"
+    },
+    initialDelaySeconds: 15,
+    timeoutSeconds: 5
+  },
+  readinessProbe: {
+    httpGet: {
+      path: "/metrics",
+      port: "metrics"
+    },
+    initialDelaySeconds: 5,
+    timeoutSeconds: 1
+  },
+  resources: {}
+};
+
+local StatefulSet(params) = kube.StatefulSet(params.namespace, params.name) {
+  metadata+: {
+    labels+: Labels(params),
+    annotations+: Annotations(params),
+  },
+  spec+: {
+    replicas: 1,
+    updateStrategy: {
+      type: "RollingUpdate"
+    },
+    selector: {
+      matchLabels: Selector(params),
+    },
+    serviceName: params.name,
+    template: {
+      metadata+: {
+        name: params.name,
+        labels+: Labels(params),
+        annotations+: Annotations(params),
+      },
+      spec+: {
+        securityContext: {
+          //enabled: true,
+          fsGroup: 1001,
+          runAsUser: 1001,
+        },
+        serviceAccountName: params.name,
+        initContainers: null,
+        containers: [
+          MariaDBContainer(params),
+          MetricsContainer(params),
+        ],
+        volumes: [
+          {
+            name: "config",
+            configMap: {
+              name: params.name
+            }
+          },
+          {
+            name: "data",
+            persistentVolumeClaim: {
+              claimName: params.dataClaimName,
+            },
+          }
+        ],
+      },
+    }
+  }
+};
+
+local App(params) = {
+  resources+: kube.List() {
+    items_: {
+      configMap: ConfigMap(params),
+      serviceAccount: ServiceAccount(params),
+      role: Role(params),
+      roleBinding: RoleBinding(params),
+      service: Service(params),
+      statefulSet: StatefulSet(params),
+    },
+  },
+};
+
+{
+  SecretParams: SecretParams,
+  Secret: Secret,
+  Params: Params,
+  App: App,
+}
diff --git a/k8s/configs/templates/core/storage/memcached.libsonnet b/k8s/configs/templates/core/storage/memcached.libsonnet
new file mode 100644
index 0000000..62bf05a
--- /dev/null
+++ b/k8s/configs/templates/core/storage/memcached.libsonnet
@@ -0,0 +1,169 @@
+local kube = import "k8s/configs/base.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+local templates = import "k8s/configs/templates/templates.libsonnet";
+
+local SecretParams = kube.simpleFieldStruct([
+  "name",
+  "namespace",
+  "password",
+],) {};
+
+local Secret(params) = kube.Secret(params.namespace, params.name) {
+  type: "Opaque",
+  data+: {
+    "memcached-password": params.password, 
+  }
+};
+
+local Labels(params) = {
+  name: params.name,
+  phase: "prod",
+};
+
+local Selector(params) = {
+  name: params.name,
+  phase: "prod",
+};
+
+local Annotations(params) = templates.annotations(params.filePath, std.thisFile);
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "secretName",
+]) {
+  //docker.io/bitnami/memcached:1.6.6-debian-10-r54
+  image: images.Prod["bitnami/memcached"],
+};
+
+local Service(params) = kube.Service(params.namespace, params.name) {
+  metadata+: {
+    labels+: Labels(params),
+    annotations+: Annotations(params),
+  },
+  spec+: {
+    type: "ClusterIP",
+    ports: [
+      {
+        name: "memcache",
+        port: 11211,
+        targetPort: "memcache",
+      },
+    ],
+  }
+};
+
+local Deployment(params) = kube.Deployment(params.namespace, params.name) {
+  metadata+: {
+    labels+: Labels(params),
+    annotations+: Annotations(params),
+  },
+  spec+: {
+    replicas: 1,
+    selector: {
+      matchLabels: Selector(params)
+    },
+    template: {
+      metadata: {
+        labels+: Labels(params),
+        annotations+: Annotations(params),
+      },
+      spec: {
+        securityContext: {
+          fsGroup: 1001,
+          runAsUser: 1001,
+        },
+        containers: [
+          {
+            name: "memcached",
+            image: params.image,
+            imagePullPolicy: "IfNotPresent",
+            args: [
+              "/run.sh"
+            ],
+            env: [
+              {
+                name: "BITNAMI_DEBUG",
+                value: "false",
+              },
+              {
+                name: "MEMCACHED_USERNAME",
+                value: "",
+              },
+              {
+                name: "MEMCACHED_PASSWORD",
+                valueFrom: {
+                  secretKeyRef: {
+                    name: params.secretName,
+                    key: "memcached-password",
+                  }
+                }
+              },
+            ],
+            ports: [
+              {
+                name: "memcache",
+                containerPort: 11211,
+              },
+            ],
+            livenessProbe: {
+              tcpSocket: {
+                port: "memcache"
+              },
+              initialDelaySeconds: 30,
+              timeoutSeconds: 5,
+              failureThreshold: 6,
+            },
+            readinessProbe: {
+              tcpSocket: {
+                port: "memcache",
+              },
+              initialDelaySeconds: 5,
+              timeoutSeconds: 3,
+              periodSeconds: 5,
+            },
+            resources: {
+              limits: {},
+              requests: {
+                cpu: "250m",
+                memory: "256Mi",
+              }
+            },
+            volumeMounts: [
+              {
+                name: "tmp",
+                mountPath: "/tmp",
+              },
+            ],
+            securityContext: {
+              readOnlyRootFilesystem: false,
+            },
+          },
+        ],
+        volumes: [
+          {
+            name: "tmp",
+            emptyDir: {},
+          },
+        ],
+      },
+    },
+  },
+};
+
+{
+  Params: Params,
+  SecretParams: SecretParams,
+  Secret: Secret,
+  Service: Service,
+  Deployment: Deployment,
+  App(params): {
+    resources+: kube.List() {
+      items_: {
+        service: Service(params),
+        deployment: Deployment(params),
+      },
+    },
+  },
+}
diff --git a/k8s/configs/templates/core/storage/nfs-client-provisioner.libsonnet b/k8s/configs/templates/core/storage/nfs-client-provisioner.libsonnet
new file mode 100644
index 0000000..168bc5f
--- /dev/null
+++ b/k8s/configs/templates/core/storage/nfs-client-provisioner.libsonnet
@@ -0,0 +1,186 @@
+local kube = import "k8s/configs/base.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local StorageClassParams = {
+  provisionerName: error "provisionerName must be specified",
+  allowVolumeExpansion: true,
+  reclaimPolicy: "Delete",
+  archiveOnDelete: true,
+};
+
+local StorageClass(name, params) = kube.StorageClass(name) {
+  provisioner: params.provisionerName,
+  allowVolumeExpansion: params.allowVolumeExpansion,
+  reclaimPolicy: params.reclaimPolicy,
+  parameters: {
+    archiveOnDelete: std.toString(params.archiveOnDelete),
+  }
+};
+
+local ClusterRole(name) = kube.ClusterRole(name) {
+  rules: [
+    {
+      apiGroups: [""],
+      resources: ["persistentvolumes"],
+      verbs: ["get", "list", "watch", "create", "delete"],
+    },
+    {
+      apiGroups: [""],
+      resources: ["persistentvolumeclaims"],
+      verbs: ["get", "list", "watch", "update"],
+    },
+    {
+      apiGroups: ["storage.k8s.io"],
+      resources: ["storageclasses"],
+      verbs: ["get", "list", "watch"],
+    },
+    {
+      apiGroups: [""],
+      resources: ["events"],
+      verbs: ["create", "update", "patch"],
+    },
+  ],
+};
+
+local ClusterRoleBindingParams = kube.simpleFieldStruct([
+  "clusterRoleName",
+  "subjects",
+]) {};
+
+local ClusterRoleBinding(name, params) = kube.ClusterRoleBinding(name) {
+  subjects: params.subjects,
+  roleRef: {
+    kind: "ClusterRole",
+    name: params.clusterRoleName,
+    apiGroup: "rbac.authorization.k8s.io",
+  }
+};
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "storageClassName",
+  "provisionerName",
+  "nfsServerAddr",
+  "nfsServerPath",
+]){
+  image: images.Prod["quay.io/external_storage/nfs-client-provisioner"],
+};
+
+local Role(params, roleName) = kube.Role(params.namespace, roleName) {
+  rules: [
+    {
+      apiGroups: [""],
+      resources: ["endpoints"],
+      verbs: ["get", "list", "watch", "create", "update", "patch"],
+    }
+  ],
+};
+
+local RoleBinding(params, roleName) = kube.RoleBinding(params.namespace, params.name) {
+  subjects: [
+    {
+      kind: "ServiceAccount",
+      name: params.name,
+      namespace: params.namespace,
+    },
+  ],
+  roleRef: {
+    kind: "Role",
+    name: roleName,
+    apiGroup: "rbac.authorization.k8s.io",
+  },
+};
+
+local DeploymentTemplateSpec(params) = {
+  local nfsVolumeName = std.join('-', [params.name, "root"]),
+  serviceAccountName: params.name,
+  containers: [
+    {
+      name: params.name,
+      image: params.image,
+      imagePullPolicy: "IfNotPresent",
+      volumeMounts: [
+        {
+          name: nfsVolumeName,
+          mountPath: "/persistentvolumes",
+        }
+      ],
+      env: [
+        kube.NameVal("PROVISIONER_NAME", params.provisionerName),
+        kube.NameVal("NFS_SERVER", params.nfsServerAddr),
+        kube.NameVal("NFS_PATH", params.nfsServerPath),
+      ],
+      resources: {
+        requests: {
+          cpu: "50m",
+          memory: "50Mi",
+        },
+        limits: {
+          cpu: "200m",
+          memory: "200Mi",
+        },
+      },
+    },
+  ],
+  volumes: [
+    {
+      name: nfsVolumeName,
+      nfs: {
+        server: params.nfsServerAddr,
+        path: params.nfsServerPath,
+      },
+    },
+  ],
+};
+
+
+local App(params) = {
+  // TODO(acmcarther): This "suboptimal" naming is inherited from helm. Update it once helm assets replaced.
+  //                   Add namespace name to this.
+  //                   Replace "run-*" with "*-runner-binding".
+  local roleName = std.join('-', ['leader-locking', params.name]),
+  local selector = {
+    name: params.name,
+    phase: "prod",
+  },
+  local selectorMixin = {
+    selector: selector
+  },
+
+  resources: kube.List() {
+    items_+: {
+      // If changed, the cluster role bindings in storage.jsonnet need to be changed as well.
+      serviceAccount: kube.ServiceAccount(params.namespace, params.name),
+      role: Role(params, roleName),
+      roleBinding: RoleBinding(params, roleName),
+      deployment: kube.Deployment(params.namespace, params.name) {
+        spec+: {
+          strategy: kube.DeployUtil.SimpleRollingUpdate(),
+          replicas: 1,
+          selector: {
+            matchLabels: selector,
+          },
+          template: {
+            metadata: {
+              labels: selector,
+            },
+            spec+: DeploymentTemplateSpec(params),
+          },
+        },
+      },
+    },
+  },
+};
+
+{
+  StorageClassParams: StorageClassParams,
+  ClusterRoleBindingParams: ClusterRoleBindingParams,
+
+  StorageClass(name, params): StorageClass(name, params),
+  ClusterRole(name): ClusterRole(name),
+  ClusterRoleBinding(name, params): ClusterRoleBinding(name, params),
+
+  Params: Params,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/core/storage/nocodb.libsonnet b/k8s/configs/templates/core/storage/nocodb.libsonnet
new file mode 100644
index 0000000..a67fbfb
--- /dev/null
+++ b/k8s/configs/templates/core/storage/nocodb.libsonnet
@@ -0,0 +1,79 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet"; 
+
+local probe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 15,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local WebPort = 8080;
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "nocodbSecret"
+]) {
+  nocoDbUrlSecretKey: "nocodb-metadata-db-url",
+  labels: {},
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "nocodb",
+    imageName: "nocodb/nocodb",
+    labels+: $.labels,
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+      },
+    ],
+    ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+    pvcs: [
+    ],
+    env: linuxserver.Env {
+      others: [
+        {
+          name: "NC_DISABLE_TELE",
+          value: "true"
+        },
+        {
+          name: "NC_DB",
+          valueFrom: {
+            secretKeyRef: {
+              name: $.nocodbSecret,
+              key: $.nocoDbUrlSecretKey ,
+            }
+          }
+        },
+      ]
+    },
+    resources: {
+      requests: {
+        cpu: "300m",
+        memory: "500Mi",
+      },
+      limits: {
+        cpu: "800m",
+        memory: "1500Mi",
+      },
+    },
+    livenessProbe: probe(/*delaySeconds=*/60),
+    readinessProbe: probe(/*delaySeconds=*/60),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams);
+
+{
+  WebPort: WebPort,
+  Params: Params,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/core/storage/postgres.libsonnet b/k8s/configs/templates/core/storage/postgres.libsonnet
new file mode 100644
index 0000000..be19206
--- /dev/null
+++ b/k8s/configs/templates/core/storage/postgres.libsonnet
@@ -0,0 +1,333 @@
+local kube = import "k8s/configs/base.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+local templates = import "k8s/configs/templates/templates.libsonnet";
+
+local SecretParams = kube.simpleFieldStruct([
+  "name",
+  "namespace",
+  "password",
+],) {};
+
+local Secret(params) = kube.Secret(params.namespace, params.name) {
+  type: "Opaque",
+  data+: {
+    "password": params.password,
+  }
+};
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "dataClaimName",
+  "dbName",
+  "dbUser",
+  "dbPwdSecret",
+]) {
+   initImage: images.Prod["docker.io/bitnami/minideb"],
+   #metricsImage: images.Prod["docker.io/wrouesnel/postgres_exporter"],
+   metricsImage: images.Prod["prometheuscommunity/postgres-exporter"],
+   image: images.Prod["docker.io/bitnami/postgresql"],
+   dbPwdSecretKey: "password",
+   resources: {
+     requests: {
+       cpu: "200m",
+       memory: "256Mi",
+     },
+     limits: {
+       cpu: "400m",
+       memory: "512Mi",
+     },
+   },
+};
+
+local Labels(params) = {
+  name: params.name,
+  phase: "prod",
+};
+
+local Selector(params) = {
+  name: params.name,
+  phase: "prod",
+};
+
+local Annotations(params) = templates.annotations(params.filePath, std.thisFile);
+
+local ServiceAccount(params) = kube.ServiceAccount(params.namespace, params.name);
+
+local MetricsService(params) = kube.Service(params.namespace, params.name + "-metrics") {
+  metadata+: {
+    labels+: Labels(params),
+    annotations+: Annotations(params) + {
+      "prometheus.io/port": "9187",
+      "prometheus.io/scrape": "true",
+    },
+  },
+  spec+: {
+    type: "ClusterIP",
+    ports: [
+      {
+        name: "metrics",
+        port: 9187,
+        targetPort: "metrics",
+      },
+    ],
+    selector: Selector(params)
+  },
+};
+
+local HeadlessService(params) = kube.Service(params.namespace, params.name + "-headless") {
+  metadata+: {
+    labels+: Labels(params),
+    annotations+: Annotations(params) + {
+      "prometheus.io/port": "9187",
+      "prometheus.io/scrape": "true",
+    },
+  },
+  spec+: {
+    type: "ClusterIP",
+    clusterIP: "None",
+    ports: [
+      {
+        name: "postgresql",
+        port: 5432,
+        targetPort: "postgresql",
+      },
+    ],
+    selector: Selector(params)
+  },
+};
+
+local Service(params) = kube.Service(params.namespace, params.name) {
+  metadata+: {
+    labels+: Labels(params),
+    annotations+: Annotations(params) + {
+      "prometheus.io/port": "9187",
+      "prometheus.io/scrape": "true",
+    },
+  },
+  spec+: {
+    type: "ClusterIP",
+    //clusterIP: "None",
+    ports: [
+      {
+        name: "postgresql",
+        port: 5432,
+        targetPort: "postgresql",
+      },
+    ],
+    // N.B. Helm has an additional selector here.
+    selector: Selector(params)
+  },
+};
+
+local StatefulSet(params) = kube.StatefulSet(params.namespace, params.name) {
+  metadata+: {
+    labels+: Labels(params),
+    annotations+: Annotations(params),
+  },
+  spec+: {
+    serviceName: params.name + "-headless",
+    replicas: 1,
+    updateStrategy: {
+      type: "RollingUpdate"
+    },
+    selector: {
+      matchLabels: Selector(params),
+    },
+    template: {
+      metadata+: {
+        name: params.name,
+        labels+: Labels(params),
+        annotations+: Annotations(params) {
+          "prometheus.io/port": "9187",
+          "prometheus.io/scrape": "true",
+        },
+      },
+      spec+: {
+        securityContext: {
+          //enabled: true,
+          fsGroup: 1001,
+          runAsUser: 1001,
+        },
+        serviceAccountName: params.name,
+        // TODO:
+        initContainers: [
+          {
+            name: "init-chmod-data",
+            image: params.initImage,
+            imagePullPolicy: "IfNotPresent",
+            resources: params.resources,
+            command: [
+              "sh",
+              "-c",
+              |||
+                mkdir -p /bitnami/postgresql/data
+                chmod 700 /bitnami/postgresql/data
+                find /bitnami/postgresql -mindepth 1 -maxdepth 1 -not -name ".snapshot" -not -name "lost+found" | \
+                  xargs chown -R 1001:1001
+              |||,
+            ],
+            securityContext: {
+              runAsUser: 0,
+            },
+            volumeMounts: [
+              {
+                name: "data",
+                mountPath: "/bitnami/postgresql"
+              },
+            ],
+          },
+        ],
+        containers: [
+          {
+            name: "postgres-postgresql",
+            image: params.image,
+            imagePullPolicy: "IfNotPresent",
+            resources: {
+              requests: {
+                cpu: "250m",
+                memory: "256Mi",
+              },
+            },
+            securityContext: {
+              runAsUser: 1001,
+            },
+            env: [
+              kube.NameVal("BITNAMI_DEBUG", "true"),
+              kube.NameVal("POSTGRESQL_PORT_NUMBER", "5432"),
+              kube.NameVal("PGDATA", "/bitnami/postgresql/data"),
+              kube.NameVal("POSTGRESQL_USERNAME", params.dbUser),
+              kube.NameVal("POSTGRESQL_DATABASE", params.dbName),
+              {
+                name: "POSTGRESQL_PASSWORD",
+                valueFrom: {
+                  secretKeyRef: {
+                    name: params.dbPwdSecret,
+                    key: params.dbPwdSecretKey,
+                  },
+                },
+              },
+            ],
+            ports: [
+              {
+                name: "postgresql",
+                containerPort: 5432,
+              },
+            ],
+            livenessProbe: {
+              exec: {
+                command: [
+                  "sh",
+                  "-c",
+                  "exec pg_isready -U \"" + params.dbUser + "\" -d \"" + params.dbName + "\" -h 127.0.0.1 -p 5432",
+                ],
+              },
+              initialDelaySeconds: 30,
+              periodSeconds: 10,
+              timeoutSeconds: 5,
+              successThreshold: 1,
+              failureThreshold: 180,
+            },
+            readinessProbe: {
+              exec: {
+                command: [
+                  "sh",
+                  "-c",
+                  "pg_isready -U \"" + params.dbUser + "\" -d \"" + params.dbName + "\" -h 127.0.0.1 -p 5432\n"
+                  + "[ -f /opt/bitnami/postgresql/tmp/.initialized ]",
+                ],
+              },
+              initialDelaySeconds: 30,
+              periodSeconds: 10,
+              timeoutSeconds: 5,
+              successThreshold: 1,
+              failureThreshold: 180,
+            },
+            volumeMounts: [
+              {
+                name: "data",
+                mountPath: "/bitnami/postgresql",
+              },
+            ],
+          },
+          {
+            name: "metrics",
+            image: params.metricsImage,
+            imagePullPolicy: "IfNotPresent",
+            env: [
+              kube.NameVal("DATA_SOURCE_URI", "127.0.0.1:5432/" + params.dbName + "?sslmode=disable"),
+              kube.NameVal("DATA_SOURCE_USER", params.dbUser),
+              {
+                name: "DATA_SOURCE_PASS",
+                valueFrom: {
+                  secretKeyRef: {
+                    name: params.dbPwdSecret,
+                    key: "password",
+                  },
+                },
+              },
+            ],
+            livenessProbe: {
+              httpGet: {
+                path: "/",
+                port: "metrics",
+              },
+              initialDelaySeconds: 5,
+              periodSeconds: 10,
+              timeoutSeconds: 5,
+              successThreshold: 1,
+              failureThreshold: 6,
+            },
+            readinessProbe: {
+              httpGet: {
+                path: "/",
+                port: "metrics",
+              },
+              initialDelaySeconds: 5,
+              periodSeconds: 10,
+              timeoutSeconds: 5,
+              successThreshold: 1,
+              failureThreshold: 6,
+            },
+            volumeMounts: [],
+            ports: [
+              {
+                name: "metrics",
+                containerPort: 9187,
+              },
+            ],
+            resources: null,
+          },
+        ],
+        volumes: [
+          {
+            name: "data",
+            persistentVolumeClaim: {
+              claimName: params.dataClaimName,
+            },
+          }
+        ],
+      },
+    },
+  },
+};
+
+local App(params) = {
+  resources+: kube.List() {
+    items_: {
+      serviceAccount: ServiceAccount(params),
+      metricsService: MetricsService(params),
+      headlessService: HeadlessService(params),
+      service: Service(params),
+      statefulSet: StatefulSet(params),
+    },
+  },
+};
+
+{
+  Params: Params,
+  Secret: Secret,
+  SecretParams: SecretParams,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/core/storage/redis.libsonnet b/k8s/configs/templates/core/storage/redis.libsonnet
new file mode 100644
index 0000000..f301cef
--- /dev/null
+++ b/k8s/configs/templates/core/storage/redis.libsonnet
@@ -0,0 +1,65 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local probe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 30,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local WebPort = 6379;
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+]) {
+  labels: {},
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "redis",
+    imageName: "redis",
+    labels+: $.labels,
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    env: linuxserver.Env {
+      others: [
+        kube.NameVal("ALLOW_EMPTY_PASSWORD", "yes"),
+      ]
+    },
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+      },
+    ],
+    ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+    pvcs: [
+    ],
+    resources: {
+      requests: {
+        cpu: "200m",
+        memory: "500Mi",
+      },
+      limits: {
+        cpu: "400m",
+        memory: "800Mi",
+      },
+    },
+    livenessProbe: probe(/*delaySeconds=*/60),
+    readinessProbe: probe(/*delaySeconds=*/60),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams);
+
+{
+  Params: Params,
+  WebPort: WebPort,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/core/workflow/n8n.libsonnet b/k8s/configs/templates/core/workflow/n8n.libsonnet
new file mode 100644
index 0000000..8f8d61e
--- /dev/null
+++ b/k8s/configs/templates/core/workflow/n8n.libsonnet
@@ -0,0 +1,114 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local SecretParams = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "n8n_db_password"
+]);
+
+local Secret(params) = kube.Secret(params.namespace, params.name) {
+  type: "Opaque",
+  data+: {
+    "n8n-db-pwd": params.n8n_db_password,
+  }
+};
+
+local probe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 30,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local WebPort = 5678;
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "dataClaimName",
+  "ingressBaseUrl", # something.com
+  "postgresHost",
+  "dbPwdSecret",
+  "dbPwdSecretKey",
+]) {
+  postgresDbUser: "root",
+  postgresDbName: "n8n",
+  postgresSchema: "public",
+  timezone: "US/Pacific",
+  labels: {},
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "n8n",
+    imageName: "n8nio/n8n",
+    labels+: $.labels,
+    ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+    env: linuxserver.Env {
+      others: [
+        kube.NameVal("N8N_HOST", $.ingressBaseUrl),
+        kube.NameVal("N8N_PROTOCOL", "https"),
+        kube.NameVal("N8N_PORT", std.toString(WebPort)),
+        kube.NameVal("NODE_ENV", "production"), # really?
+        kube.NameVal("GENERIC_TIMEZONE", $.timezone),
+        kube.NameVal("WEBHOOK_URL", "https://" + $.ingressBaseUrl + "/"),
+        # Postgres
+        kube.NameVal("DB_TYPE", "postgresdb"),
+        kube.NameVal("DB_POSTGRESDB_DATABASE", $.postgresDbName),
+        kube.NameVal("DB_POSTGRESDB_HOST", $.postgresHost),
+        kube.NameVal("DB_POSTGRESDB_USER", $.postgresDbUser),
+        kube.NameVal("DB_POSTGRESDB_PORT", "5432"),
+        kube.NameVal("DB_POSTGRESDB_SCHEMA", $.postgresSchema),
+        {
+            name: "DB_POSTGRESDB_PASSWORD", 
+            valueFrom: {
+                secretKeyRef: {
+                    name: $.dbPwdSecret,
+                    key: $.dbPwdSecretKey,
+                },
+            },
+        },
+      ],
+    },
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+      },
+    ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "data",
+        mountPath: "/home/node/.n8n",
+        bindName: $.dataClaimName,
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "250m",
+        memory: "512Mi",
+      },
+      limits: {
+        cpu: "500m",
+        memory: "1Gi",
+      },
+    },
+    livenessProbe: probe(/*delaySeconds=*/20),
+    readinessProbe: probe(/*delaySeconds=*/20),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams) {};
+
+{
+  Params: Params,
+  WebPort: WebPort,
+  App(params): App(params),
+  SecretParams: SecretParams,
+  Secret(params): Secret(params)
+}
diff --git a/k8s/configs/templates/core/workflow/nodered.libsonnet b/k8s/configs/templates/core/workflow/nodered.libsonnet
new file mode 100644
index 0000000..66b8d0c
--- /dev/null
+++ b/k8s/configs/templates/core/workflow/nodered.libsonnet
@@ -0,0 +1,74 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+
+local noderedProbe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 30,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local WebPort = 1880;
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "dataClaimName",
+]) {
+  labels: {},
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "nodered",
+    imageName: "nodered/node-red",
+    labels+: $.labels,
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    env: linuxserver.Env {
+      others: [
+        kube.NameVal("NODE_RED_ENABLE_PROJECTS", "true"),
+      ]
+    },
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+      },
+    ],
+    ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "data",
+        mountPath: "/data",
+        bindName: $.dataClaimName,
+        mountSubPath: "internal"
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "200m",
+        memory: "500Mi",
+      },
+      limits: {
+        cpu: "400m",
+        memory: "800Mi",
+      },
+    },
+    livenessProbe: noderedProbe(/*delaySeconds=*/10),
+    readinessProbe: noderedProbe(/*delaySeconds=*/10),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams);
+
+{
+  Params: Params,
+  WebPort: WebPort,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/core/workflow/temporal.libsonnet b/k8s/configs/templates/core/workflow/temporal.libsonnet
new file mode 100644
index 0000000..cc73e5d
--- /dev/null
+++ b/k8s/configs/templates/core/workflow/temporal.libsonnet
@@ -0,0 +1,20 @@
+local base = import "k8s/configs/base.libsonnet";
+
+local Params = base.SimpleFieldStruct([
+    "namespace",
+    "name",
+    "context",
+    "values",
+]) {};
+
+local App(params) = {
+    app: params.context.helm.template(params.name, "./charts/temporal", {
+        namespace: params.namespace,
+        values: params.values,
+    })
+};
+
+{
+    Params: Params,
+    App: App,
+}
diff --git a/k8s/configs/templates/dev/ai/ollama.libsonnet b/k8s/configs/templates/dev/ai/ollama.libsonnet
new file mode 100644
index 0000000..2d74029
--- /dev/null
+++ b/k8s/configs/templates/dev/ai/ollama.libsonnet
@@ -0,0 +1,85 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local probe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 30,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local WebPort = 11434;
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "storageClaimName",
+]) {
+  labels: {},
+  gatekeeperSidecar: null,
+  gpuNodeSelectorName: "nvidia",
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "ollama",
+    imageName: "ollama/ollama",
+    labels+: $.labels,
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    nodeSelector: {
+      "gpu": $.gpuNodeSelectorName,
+    },
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+      },
+    ],
+    env: linuxserver.Env {
+      others: [
+        kube.NameVal("NVIDIA_VISIBLE_DEVICES", "all"),
+        kube.NameVal("NVIDIA_DRIVER_CAPABILITIES", "all"),
+        kube.NameVal("OLLAMA_KEEP_ALIVE", "20m"),
+      ],
+    },
+    ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+    hostPaths: [
+      linuxserver.HostPath {
+        name: "storage-local",
+        hostPath: "/home/core/local_volumes/ollama",
+        mountPath: "/root/.ollama",
+      },
+    ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "storage",
+        mountPath: "/root/.ollama-remote",
+        bindName: $.storageClaimName,
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "500m",
+        memory: "1Gi",
+      },
+      limits: {
+        cpu: "1000m",
+        memory: "2Gi",
+      },
+    },
+    livenessProbe: probe(/*delaySeconds=*/120),
+    readinessProbe: probe(/*delaySeconds=*/120),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams);
+
+{
+  Params: Params,
+  WebPort: WebPort,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/dev/ai/open-webui-pipelines.libsonnet b/k8s/configs/templates/dev/ai/open-webui-pipelines.libsonnet
new file mode 100644
index 0000000..d3700f4
--- /dev/null
+++ b/k8s/configs/templates/dev/ai/open-webui-pipelines.libsonnet
@@ -0,0 +1,75 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local probe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 30,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local WebPort = 9099;
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "storageClaimName",
+]) {
+  labels: {},
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "open-webui-pipelines",
+    imageName: "ghcr.io/open-webui/pipelines",
+    labels+: $.labels,
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+      },
+    ],
+    env: linuxserver.Env {
+      others: [
+        /*
+        kube.NameVal("NVIDIA_VISIBLE_DEVICES", "all"),
+        kube.NameVal("NVIDIA_DRIVER_CAPABILITIES", "all"),
+        */
+      ],
+    },
+    ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "storage",
+        mountPath: "/app/pipelines",
+        bindName: $.storageClaimName,
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "500m",
+        memory: "1Gi",
+      },
+      limits: {
+        cpu: "1000m",
+        memory: "2Gi",
+      },
+    },
+    livenessProbe: probe(/*delaySeconds=*/30),
+    readinessProbe: probe(/*delaySeconds=*/20),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams);
+
+{
+  Params: Params,
+  WebPort: WebPort,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/dev/ai/open-webui.libsonnet b/k8s/configs/templates/dev/ai/open-webui.libsonnet
new file mode 100644
index 0000000..9b2b020
--- /dev/null
+++ b/k8s/configs/templates/dev/ai/open-webui.libsonnet
@@ -0,0 +1,81 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local probe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 30,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local WebPort = 8080;
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "storageClaimName",
+  "ollamaHost",
+]) {
+  labels: {},
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "open-webui",
+    imageName: "ghcr.io/open-webui/open-webui",
+    labels+: $.labels,
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    /*
+    nodeSelector: {
+      "gpu": "nvidia",
+    },*/
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+      },
+    ],
+    env: linuxserver.Env {
+      others: [
+        /*
+        kube.NameVal("NVIDIA_VISIBLE_DEVICES", "all"),
+        kube.NameVal("NVIDIA_DRIVER_CAPABILITIES", "all"),
+        */
+        kube.NameVal("OLLAMA_BASE_URL", $.ollamaHost)
+      ],
+    },
+    ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "storage",
+        mountPath: "/app/backend/data",
+        bindName: $.storageClaimName,
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "500m",
+        memory: "1Gi",
+      },
+      limits: {
+        cpu: "1000m",
+        memory: "2Gi",
+      },
+    },
+    livenessProbe: probe(/*delaySeconds=*/30),
+    readinessProbe: probe(/*delaySeconds=*/20),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams);
+
+{
+  Params: Params,
+  WebPort: WebPort,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/dev/ai/tabbyml.libsonnet b/k8s/configs/templates/dev/ai/tabbyml.libsonnet
new file mode 100644
index 0000000..173f00b
--- /dev/null
+++ b/k8s/configs/templates/dev/ai/tabbyml.libsonnet
@@ -0,0 +1,84 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local probe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 30,
+  httpGet: {
+    path: "/v1/health",
+    port: "http",
+  },
+};
+
+local WebPort = 8081;
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "storageClaimName",
+]) {
+  labels: {},
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "tabbyml",
+    imageName: "tabbyml/tabby",
+    labels+: $.labels,
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    nodeSelector: {
+      "gpu": "nvidia",
+    },
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+      },
+    ],
+    env: linuxserver.Env {
+      others: [
+        kube.NameVal("NVIDIA_VISIBLE_DEVICES", "all"),
+        kube.NameVal("NVIDIA_DRIVER_CAPABILITIES", "all"),
+      ],
+    },
+    args: [
+         "serve",
+         "--model", "StarCoder-1B",
+         "--chat-model", "Qwen2-1.5B-Instruct", 
+         "--device", "cuda",
+         "--port", "8081",
+    ],
+    ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "storage",
+        mountPath: "/data",
+        bindName: $.storageClaimName,
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "2000m",
+        memory: "4Gi",
+      },
+      limits: {
+        cpu: "5000m",
+        memory: "8Gi",
+      },
+    },
+    livenessProbe: probe(/*delaySeconds=*/240),
+    readinessProbe: probe(/*delaySeconds=*/240),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams);
+
+{
+  Params: Params,
+  WebPort: WebPort,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/dev/ide/code-server.libsonnet b/k8s/configs/templates/dev/ide/code-server.libsonnet
new file mode 100644
index 0000000..5eda705
--- /dev/null
+++ b/k8s/configs/templates/dev/ide/code-server.libsonnet
@@ -0,0 +1,73 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local probe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 30,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local WebPort = 8443;
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "configClaimName",
+]) {
+  labels: {},
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "code-server",
+    imageName: "linuxserver/code-server",
+    labels+: $.labels,
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    env: linuxserver.Env {
+      others+: [
+        kube.NameVal("SERVICE_URL", "https://marketplace.visualstudio.com/_apis/public/gallery"),
+        kube.NameVal("ITEM_URL", "https://marketplace.visualstudio.com/items"),
+      ],
+    },
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+      },
+    ],
+    ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "config",
+        mountPath: "/config",
+        bindName: $.configClaimName,
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "1500m",
+        memory: "1Gi",
+      },
+      limits: {
+        cpu: "2500m",
+        memory: "2Gi",
+      },
+    },
+    livenessProbe: probe(/*delaySeconds=*/120),
+    readinessProbe: probe(/*delaySeconds=*/120),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams);
+
+{
+  Params: Params,
+  WebPort: WebPort,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/dev/ide/coder.libsonnet b/k8s/configs/templates/dev/ide/coder.libsonnet
new file mode 100644
index 0000000..0372d21
--- /dev/null
+++ b/k8s/configs/templates/dev/ide/coder.libsonnet
@@ -0,0 +1,40 @@
+local images = import "k8s/configs/images.libsonnet";
+local base = import "k8s/configs/base.libsonnet";
+
+local Params = base.SimpleFieldStruct([
+    "namespace",
+    "context",
+    "coderPgUrlSecret",
+]) {};
+
+local App(params) = {
+    local chartPath = "../../external/+helm_deps+helm_coderv2_coder",
+    app: params.context.helm.template("coder", chartPath, {
+        //local image = images.Prod["grafana/grafana"],
+        namespace: params.namespace,
+        values: {
+            coder: {
+                env: [
+                    {
+                        name: "CODER_PG_CONNECTION_URL",
+                        valueFrom: {
+                            secretKeyRef: {
+                                name: params.coderPgUrlSecret,
+                                key: "url",
+                            },
+                        },
+                    },
+                    {
+                        name: "CODER_ACCESS_URL",
+                        value: "https://coder.csbx.dev",
+                    }
+                ]
+            }
+        }
+    })
+};
+
+{
+    Params: Params,
+    App: App,
+}
\ No newline at end of file
diff --git a/k8s/configs/templates/dev/ide/jupyter.libsonnet b/k8s/configs/templates/dev/ide/jupyter.libsonnet
new file mode 100644
index 0000000..6c57ebb
--- /dev/null
+++ b/k8s/configs/templates/dev/ide/jupyter.libsonnet
@@ -0,0 +1,65 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local jupyterProbe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 15,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "filesClaimName",
+]) {
+  local webPort = 8888,
+  labels: {},
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "jupyter",
+    imageName: "jupyter/datascience-notebook",
+    labels+: $.labels,
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(webPort)
+      },
+    ],
+    ports: [ kube.DeployUtil.ContainerPort("http", webPort), ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "files",
+        mountPath: "/home/joyvan/work",
+        bindName: $.filesClaimName,
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "500m",
+        memory: "1000Mi",
+      },
+      limits: {
+        cpu: "2000m",
+        memory: "4000Mi",
+      },
+    },
+    //livenessProbe: jupyterProbe(/*delaySeconds=*/120),
+    //readinessProbe: jupyterProbe(/*delaySeconds=*/120),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams);
+
+{
+  Params: Params,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/dev/ops/bazel-cache.libsonnet b/k8s/configs/templates/dev/ops/bazel-cache.libsonnet
new file mode 100644
index 0000000..c3ce376
--- /dev/null
+++ b/k8s/configs/templates/dev/ops/bazel-cache.libsonnet
@@ -0,0 +1,90 @@
+local kube = import 'k8s/configs/base.libsonnet';
+local linuxserver = import 'k8s/configs/templates/core/linuxserver.libsonnet';
+
+local Params = kube.simpleFieldStruct([
+  'namespace',
+  'name',
+  'dataClaimName',
+  'extraArgs',
+  'secrets',
+  'configMaps',
+]) {
+  maxSizeGb: 20,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: std.thisFile,
+    templatePath: std.thisFile,
+    baseAppName: 'bazel-remote-cache',
+    // TODO: Pin this to a specific version tag instead of latest.
+    imageName: 'buchgr/bazel-remote-cache:v2.6.1',
+    args: [
+      '--max_size=' + $.maxSizeGb,
+      #'--directory=/data',
+    ] + $.extraArgs,
+    secrets: $.secrets,
+    configMaps: $.configMaps,
+    extraVolumes: $.extraVolumes,
+    extraVolumeMounts: $.extraVolumeMounts,
+    ports: [
+      kube.DeployUtil.ContainerPort('grpc', 9092),
+      kube.DeployUtil.ContainerPort('http', 8080),
+    ],
+    pvcs: [
+      linuxserver.Pvc {
+        name: 'data',
+        mountPath: '/data',
+        bindName: $.dataClaimName,
+      },
+    ],
+    services: [
+      linuxserver.Service {
+        suffix: 'grpc',
+        spec: {
+          type: 'ClusterIP',
+          ports: [
+            kube.SvcUtil.TCPServicePort('grpc', 9092),
+          ],
+        },
+      },
+      linuxserver.Service {
+        suffix: 'http',
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(8080),
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: '500m',
+        memory: '512Mi',
+      },
+      limits: {
+        cpu: '2000m',
+        memory: '4Gi',
+      },
+    },
+  },
+};
+
+local App(params) =
+  local baseApp = linuxserver.App(params.lsParams);
+  baseApp {
+    // The buchgr/bazel-remote-cache image does not have a corresponding entry
+    // in our images.libsonnet, so we must override the image path directly.
+    deployment+: {
+      spec+: {
+        template+: {
+          spec+: {
+            containers: [
+              c { image: params.lsParams.imageName }
+              for c in super.containers
+            ],
+          },
+        },
+      },
+    },
+  };
+
+{
+  Params: Params,
+  App(params): App(params),
+}
\ No newline at end of file
diff --git a/k8s/configs/templates/dev/ops/bin-cache.libsonnet b/k8s/configs/templates/dev/ops/bin-cache.libsonnet
new file mode 100644
index 0000000..033794f
--- /dev/null
+++ b/k8s/configs/templates/dev/ops/bin-cache.libsonnet
@@ -0,0 +1,186 @@
+local kube = import 'k8s/configs/base.libsonnet';
+local linuxserver = import 'k8s/configs/templates/core/linuxserver.libsonnet';
+
+local nginxConf = |||
+  user nginx;
+  worker_processes auto;
+  error_log /var/log/nginx/error.log notice;
+  pid /var/run/nginx.pid;
+
+  events {
+    worker_connections 1024;
+  }
+
+  http {
+    include /etc/nginx/mime.types;
+    default_type application/octet-stream;
+
+    log_format main '$remote_addr - $remote_user [$time_local] "$request" '
+                    '$status $body_bytes_sent "$http_referer" '
+                    '"$http_user_agent" "$http_x_forwarded_for"';
+
+    access_log /var/log/nginx/access.log main;
+
+    sendfile on;
+    keepalive_timeout 65;
+
+    proxy_cache_path /data/cache_v2 levels=1:2 keys_zone=bin_cache:100m max_size=50g inactive=365d use_temp_path=off;
+
+    server {
+      listen 80;
+      server_name localhost;
+
+      resolver 8.8.8.8;
+      recursive_error_pages on;
+      proxy_cache_revalidate on;
+
+      # Allow large downloads
+      client_max_body_size 0;
+      proxy_max_temp_file_size 0;
+      
+      # Handle large headers from upstream (e.g. GitHub/S3)
+      proxy_buffer_size 16k;
+      proxy_buffers 4 16k;
+      proxy_busy_buffers_size 24k;
+
+      # Internal location to follow redirects
+      location @handle_redirect {
+        resolver 8.8.8.8;
+        set $saved_redirect_location '$upstream_http_location';
+        proxy_pass $saved_redirect_location;
+        
+        proxy_cache bin_cache;
+        proxy_cache_valid 200 301 302 365d;
+        proxy_cache_key "$scheme$request_method$host$request_uri";
+        
+        proxy_ssl_server_name on;
+        # Do NOT set Host header here, let Nginx set it based on the URL
+      }
+
+      # Bazel binary cache
+      location /bazel/ {
+        proxy_pass https://github.com;
+        rewrite ^/bazel/(.*) /bazelbuild/bazel/releases/download/$1 break;
+        
+        proxy_http_version 1.1;
+        proxy_set_header Connection "";
+
+        proxy_intercept_errors on;
+        error_page 301 302 307 = @handle_redirect;
+        
+        # We don't cache the initial redirect, we follow it
+        proxy_cache off;
+        
+        proxy_ssl_server_name on;
+        proxy_set_header Host github.com;
+      }
+
+      # Bazelisk binary cache
+      location /bazelisk/ {
+        proxy_pass https://github.com;
+        rewrite ^/bazelisk/(.*) /bazelbuild/bazelisk/releases/download/$1 break;
+        
+        proxy_http_version 1.1;
+        proxy_set_header Connection "";
+
+        proxy_intercept_errors on;
+        error_page 301 302 307 = @handle_redirect;
+        
+        # We don't cache the initial redirect, we follow it
+        proxy_cache off;
+        
+        proxy_ssl_server_name on;
+        proxy_set_header Host github.com;
+      }
+      
+      # Health check
+      location /healthz {
+        return 200 'OK';
+        add_header Content-Type text/plain;
+      }
+    }
+  }
+|||;
+
+local Params = kube.simpleFieldStruct([
+  'namespace',
+  'name',
+  'dataClaimName',
+  'configClaimName',
+]);
+
+local ConfigMap(params) = kube.ConfigMap(params.namespace, params.name) {
+  data: {
+    "nginx.conf": nginxConf,
+  },
+};
+
+local App(params) =
+  local baseApp = linuxserver.App(linuxserver.AppParams {
+    name: params.name,
+    namespace: params.namespace,
+    filePath: std.thisFile,
+    templatePath: std.thisFile,
+    baseAppName: 'nginx',
+    imageName: 'nginx:alpine', // We need to ensure this image is in images.libsonnet or use a direct string if linuxserver supports it
+    ports: [
+      kube.DeployUtil.ContainerPort('http', 80),
+    ],
+    pvcs: [
+      linuxserver.Pvc {
+        name: 'data',
+        mountPath: '/data',
+        bindName: params.dataClaimName,
+      },
+    ],
+    configMaps: [
+      linuxserver.ConfigMap {
+        name: 'config',
+        bindName: params.configClaimName,
+        mountPath: '/etc/nginx/nginx.conf',
+        mountSubPath: 'nginx.conf',
+      },
+    ],
+    services: [
+      linuxserver.Service {
+        suffix: 'http',
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(80),
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: '300m',
+        memory: '256Mi',
+      },
+      limits: {
+        cpu: '500m',
+        memory: '512Mi',
+      },
+    },
+  });
+  
+  // Override the image lookup if linuxserver.libsonnet expects a key in images.libsonnet
+  // but we want to use a raw string. 
+  // However, linuxserver.libsonnet does: image: images.Prod[params.imageName]
+  // So we MUST have the image in images.libsonnet.
+  // Alternatively, we can patch the deployment after generation.
+  baseApp {
+    deployment+: {
+      spec+: {
+        template+: {
+          spec+: {
+            containers: [
+              c { image: 'nginx:1.26.2-alpine' }
+              for c in super.containers
+            ],
+          },
+        },
+      },
+    },
+  };
+
+{
+  Params: Params,
+  ConfigMap: ConfigMap,
+  App: App,
+}
diff --git a/k8s/configs/templates/dev/ops/docker-registry.libsonnet b/k8s/configs/templates/dev/ops/docker-registry.libsonnet
new file mode 100644
index 0000000..e40baab
--- /dev/null
+++ b/k8s/configs/templates/dev/ops/docker-registry.libsonnet
@@ -0,0 +1,90 @@
+local kube = import "k8s/configs/base.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+
+local dockerRegistryProbe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 10,
+  tcpSocket: {
+    port: "docker",
+  },
+};
+
+local DefaultPort = 5000;
+
+local Params = kube.SimpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "storageClaimName",
+  "secretName",
+  "secretKeyName",
+  "authTokenRealm",
+  "authTokenService",
+  "authTokenIssuer",
+]) {
+  labels: {},
+  gatekeeperSidecar: null,
+  envOthers: [],
+  webPort: DefaultPort,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "docker-registry",
+    imageName: "registry",
+    labels+: $.labels,
+    env: linuxserver.Env {
+      others: [
+        kube.NameVal("REGISTRY_AUTH", "token"),
+        kube.NameVal("REGISTRY_AUTH_TOKEN_REALM", $.authTokenRealm),
+        kube.NameVal("REGISTRY_AUTH_TOKEN_SERVICE", $.authTokenService),
+        kube.NameVal("REGISTRY_AUTH_TOKEN_ISSUER", $.authTokenIssuer),
+        kube.NameVal("REGISTRY_AUTH_TOKEN_ROOTCERTBUNDLE", "/opt/certs/" + $.secretKeyName),
+      ],
+    },
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    ports: [ kube.DeployUtil.ContainerTCPPort("docker", DefaultPort), ],
+    services: [
+      linuxserver.Service {
+        suffix: "http",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec($.webPort),
+      },
+    ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "storage",
+        mountPath: "/var/lib/registry",
+        bindName: $.storageClaimName,
+      },
+    ],
+    secrets: [
+      linuxserver.Secret{
+        name: "certs",
+        mountPath: "/opt/certs",
+        secretName: $.secretName,
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "20m",
+        memory: "64Mi",
+      },
+      limits: {
+        cpu: "50m",
+        memory: "128Mi",
+      },
+    },
+    livenessProbe: dockerRegistryProbe(/*delaySeconds=*/20),
+    readinessProbe: dockerRegistryProbe(/*delaySeconds=*/20),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams);
+
+{
+  Params: Params,
+  DefaultPort: DefaultPort,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/dev/ops/forgejo-runner.libsonnet b/k8s/configs/templates/dev/ops/forgejo-runner.libsonnet
new file mode 100644
index 0000000..4059391
--- /dev/null
+++ b/k8s/configs/templates/dev/ops/forgejo-runner.libsonnet
@@ -0,0 +1,127 @@
+local kube = import 'k8s/configs/base.libsonnet';
+local linuxserver = import 'k8s/configs/templates/core/linuxserver.libsonnet';
+
+local ConfigMapParams = kube.simpleFieldStruct([
+  'namespace',
+  'name',
+]);
+
+local ConfigMap(params) = kube.ConfigMap(params.namespace, params.name) {
+  data: {
+    'config.yml': |||
+      container:
+        docker_host: tcp://localhost:2375
+        privileged: true
+    |||,
+  },
+};
+
+local Params = kube.simpleFieldStruct([
+  'namespace',
+  'name',
+  'token',
+  'dataClaimName',
+  'configClaimName',
+  'tokenSecretName',
+  'tokenSecretKey',
+]) {
+  labels: {},
+  runnerLabels: [],
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: std.thisFile,
+    templatePath: std.thisFile,
+    baseAppName: 'forgejo-runner',
+    imageName: 'code.forgejo.org/forgejo/runner:9',
+    command: ['/bin/sh', '-c'],
+    args: ['sleep 10 && /bin/forgejo-runner register --no-interactive --config /etc/forgejo-runner/config.yml --instance https://forgejo.csbx.dev/ --token $FORGEJO_RUNNER_REGISTRATION_TOKEN; /bin/forgejo-runner daemon --config /etc/forgejo-runner/config.yml'],
+    labels+: $.labels,
+    isPrivileged: false,
+    configMaps: [
+      linuxserver.ConfigMap {
+        name: 'forgejo-runner-config',
+        bindName: $.configClaimName,
+        mountPath: '/etc/forgejo-runner',
+      },
+    ],
+    pvcs: [
+      linuxserver.Pvc {
+        name: 'data',
+        mountPath: '/data/runner',
+        bindName: $.dataClaimName,
+      },
+    ],
+    env: linuxserver.Env {
+      others: [
+        {
+          name: "FORGEJO_RUNNER_REGISTRATION_TOKEN",
+          valueFrom: {
+            secretKeyRef: {
+              name: $.tokenSecretName,
+              key: $.tokenSecretKey,
+            }
+          }
+        },
+        kube.NameVal('FORGEJO_INSTANCE_URL', 'https://forgejo.csbx.dev/'),
+        kube.NameVal('FORGEJO_RUNNER_NAME', $.name),
+        kube.NameVal('FORGEJO_RUNNER_LABELS', std.join(',', $.runnerLabels)),
+      ],
+    },
+    resources: {
+      requests: {
+        cpu: '100m',
+        memory: '256Mi',
+      },
+      limits: {
+        cpu: '1000m',
+        memory: '2Gi',
+      },
+    },
+  },
+};
+
+local App(params) =
+  local baseApp = linuxserver.App(params.lsParams);
+  baseApp {
+    deployment+: {
+      spec+: {
+        template+: {
+          spec+: {
+            containers: [
+              c { image: params.lsParams.imageName }
+              for c in super.containers
+            ] + [
+              {
+                name: 'dind-sidecar',
+                image: 'docker:24.0-dind',
+                securityContext: {
+                  privileged: true,
+                },
+                env: [
+                  kube.NameVal('DOCKER_TLS_CERTDIR', ''),
+                ],
+                resources: {
+                  requests: {
+                    cpu: '250m',
+                    memory: '512Mi',
+                  },
+                  limits: {
+                    cpu: '1',
+                    memory: '2Gi',
+                  },
+                },
+              },
+            ],
+          },
+        },
+      },
+    },
+  };
+
+{
+  Params: Params,
+  App(params): App(params),
+  ConfigMapParams: ConfigMapParams,
+  ConfigMap: ConfigMap,
+}
diff --git a/k8s/configs/templates/dev/ops/forgejo.libsonnet b/k8s/configs/templates/dev/ops/forgejo.libsonnet
new file mode 100644
index 0000000..ac5e4f2
--- /dev/null
+++ b/k8s/configs/templates/dev/ops/forgejo.libsonnet
@@ -0,0 +1,201 @@
+local kube = import "k8s/configs/base.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+local templates = import "k8s/configs/templates/templates.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+
+local WebPort = 3000;
+
+local probe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 30,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+// N.B. Memcached password is not currently configurable
+// because I don't know if it can be configured via environment variable.
+local SecretParams = kube.simpleFieldStruct([
+  "name",
+  "namespace",
+  "psql_password",
+]) {
+  // "gitea"
+  #psql_name: "Z2l0ZWE=",
+  #psql_user: "Z2l0ZWE=",
+  // "forgejo"
+  psql_name: "Zm9yZ2Vqbw==",
+  psql_user: "Zm9yZ2Vqbw==",
+};
+
+local Secret(params) = kube.Secret(params.namespace, params.name) {
+  type: "Opaque",
+  data+: {
+    "psql-password": params.psql_password, 
+  }
+};
+
+local ConfigMapParams = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "ingressHost",
+  "memcacheService",
+  "postgresDbService",
+  "postgresDbNamespace",
+]) {
+  image: images.Prod["codeberg.org/forgejo/forgejo"],
+  memcachePort: 11211,
+};
+
+local ConfigMap(params) = kube.ConfigMap(params.namespace, params.name) {
+  data: {
+    "app.ini": |||
+    [cache]
+    ADAPTER = memcache
+    ENABLED = false
+    HOST = %(memcacheService)s.%(namespace)s.default.svc.cluster.local:%(memcachePort)d
+
+    [database]
+    DB_TYPE = postgres
+
+    [security]
+    INSTALL_LOCK = true
+
+    [service]
+    DISABLE_REGISTRATION = true
+
+    [server]
+    APP_DATA_PATH = /data
+    DOMAIN = %(ingressHost)s
+    HTTP_PORT = %(webPort)d
+    PROTOCOL = http
+    ROOT_URL = https://%(ingressHost)s
+  ||| % { 
+    webPort: WebPort,
+    memcacheService: params.memcacheService,
+    namespace: params.namespace,
+    memcachePort: params.memcachePort,
+    ingressHost: params.ingressHost,
+  },
+
+    // SSH disabled because cluster port configuration is difficult.
+    //SSH_DOMAIN = gitea.cheapassbox.com
+    //SSH_LISTEN_PORT = 22
+    //SSH_PORT = 22
+  }
+};
+
+// Not used for now.
+/*
+local SshService(params) = kube.Service(params.namespace, params.name) {
+  metadata+: {
+    labels+: Labels(params),
+    annotations+: Annotations(params),
+  },
+  spec+: {
+    type: "ClusterIP",
+    ports: [
+      {
+        name: "ssh",
+        port: 22,
+        targetPort: 22,
+        protocol: "TCP",
+      },
+    ],
+  }
+};
+*/
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "postgresUser",
+  "postgresService",
+  "postgresDatabase",
+  "postgresNamespace",
+  "secretName",
+  "secretDbPwdKey",
+  // TODO: is this needed?
+  //"ingressHost",
+  "configClaimName",
+  "dataClaimName",
+]) {
+  labels: {},
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "forgejo",
+    imageName: "codeberg.org/forgejo/forgejo",
+    labels+: $.labels,
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    env: linuxserver.Env {
+      others: [
+        kube.NameVal("FORGEJO__database__DB_TYPE", "postgres"),
+        kube.NameVal("FORGEJO__database__HOST",
+          $.postgresService + "." + $.postgresNamespace + ".svc.cluster.local"),
+        kube.NameVal("FORGEJO__database__NAME", $.postgresDatabase),
+        kube.NameVal("FORGEJO__database__USER", $.postgresUser),
+        {
+          name: "FORGEJO__database__PASSWD",
+          valueFrom: {
+            secretKeyRef: {
+              name: $.secretName,
+              key: $.secretDbPwdKey,
+            }
+          }
+        },
+      ]
+    },
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+      },
+    ],
+    ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+    configMaps: [
+      linuxserver.ConfigMap {
+        name: "forgejo-config",
+        bindName: $.configClaimName,
+        // TODO: Double check this.
+        mountPath: "/etc/forgejo/conf",
+      },
+    ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "forgejo-data",
+        mountPath: "/data",
+        bindName: $.dataClaimName,
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "300m",
+        memory: "1500Mi",
+      },
+      limits: {
+        cpu: "600m",
+        memory: "3000Mi",
+      },
+    },
+
+    livenessProbe: probe(/*delaySeconds=*/60),
+    readinessProbe: probe(/*delaySeconds=*/60),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams);
+
+{
+  WebPort: WebPort,
+  ConfigMapParams: ConfigMapParams,
+  ConfigMap: ConfigMap,
+  SecretParams: SecretParams,
+  Secret: Secret,
+  Params: Params,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/dev/ops/gitea.libsonnet b/k8s/configs/templates/dev/ops/gitea.libsonnet
new file mode 100644
index 0000000..5ae4227
--- /dev/null
+++ b/k8s/configs/templates/dev/ops/gitea.libsonnet
@@ -0,0 +1,383 @@
+local kube = import "k8s/configs/base.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+local templates = import "k8s/configs/templates/templates.libsonnet";
+
+// N.B. Memcached password is not currently configurable
+// because I don't know if it can be configured via environment variable.
+local SecretParams = kube.simpleFieldStruct([
+  "name",
+  "namespace",
+  "admin_password",
+  "psql_password",
+]) {
+  // "gitea"
+  psql_name: "Z2l0ZWE=",
+  psql_user: "Z2l0ZWE=",
+};
+
+local InitSecret(params) = kube.Secret(params.namespace, params.name) {
+  type: "Opaque",
+  stringData+: {
+    "init_gitea.sh": |||
+    #!/bin/bash
+    mkdir -p /data/git/.ssh
+    chmod -R 700 /data/git/.ssh
+    mkdir -p /data/gitea/conf
+    cp /etc/gitea/conf/app.ini /data/gitea/conf/app.ini
+    chmod a+rwx /data/gitea/conf/app.ini
+    echo '[database]' >> /data/gitea/conf/app.ini
+    echo "DB_TYPE = $DB_TYPE" >> /data/gitea/conf/app.ini
+    echo "HOST = $DB_HOST" >> /data/gitea/conf/app.ini
+    echo "NAME = $DB_NAME" >> /data/gitea/conf/app.ini
+    echo "PASSWD = $DB_PASSWD" >> /data/gitea/conf/app.ini
+    echo "USER = $DB_USER" >> /data/gitea/conf/app.ini
+    nc -v -w2 -z gitea-pg 5432 && \
+    su git -c ' \
+    set -x; \
+    gitea migrate; \
+    gitea admin user create --username  gitea_admin --password "$(echo %(admin_password)s | base64 -d)" --email gitea@local.domain --admin --must-change-password=false \
+    || \
+    gitea admin user change-password --username gitea_admin --password "$(echo %(admin_password)s | base64 -d)"; \
+    '
+  ||| % {admin_password: params.admin_password},
+  }
+};
+
+local Secret(params) = kube.Secret(params.namespace, params.name) {
+  type: "Opaque",
+  data+: {
+    "psql-name": params.psql_name, 
+    "psql-user": params.psql_user, 
+    "psql-password": params.psql_password, 
+  }
+};
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "ingressHost",
+  "memcacheService",
+  "postgresDbService",
+  "postgresDbNamespace",
+  "secretName",
+  "initSecretName",
+  "dataClaimName",
+]) {
+  image: images.Prod["gitea/gitea"],
+  memcachePort: 11211,
+  postgresDbPort: 5432,
+  resources: {
+    requests: {
+      cpu: "300m",
+      memory: "1500Mi",
+    },
+    limits: {
+      cpu: "600m",
+      memory: "3000Mi",
+    },
+  },
+};
+
+local ConfigMap(params) = kube.ConfigMap(params.namespace, params.name) {
+  data: {
+    "app.ini": |||
+    [cache]
+    ADAPTER = memcache
+    ENABLED = false
+    HOST = %(memcacheService)s.%(namespace)s.default.svc.cluster.local:%(memcachePort)d
+
+    [database]
+    DB_TYPE = postgres
+
+    [security]
+    INSTALL_LOCK = true
+
+    [service]
+    DISABLE_REGISTRATION = true
+
+    [server]
+    APP_DATA_PATH = /data
+    DOMAIN = %(ingressHost)s
+    HTTP_PORT = 3000
+    PROTOCOL = http
+    ROOT_URL = https://%(ingressHost)s
+  ||| % { 
+    memcacheService: params.memcacheService,
+    namespace: params.namespace,
+    memcachePort: params.memcachePort,
+    ingressHost: params.ingressHost,
+  },
+
+    // SSH disabled because cluster port configuration is difficult.
+    //SSH_DOMAIN = gitea.cheapassbox.com
+    //SSH_LISTEN_PORT = 22
+    //SSH_PORT = 22
+  }
+};
+
+local Labels(params) = {
+  name: params.name,
+  phase: "prod",
+};
+
+local Selector(params) = {
+  name: params.name,
+  phase: "prod",
+};
+
+local Annotations(params) = templates.annotations(params.filePath, std.thisFile);
+
+local Service(params) = kube.Service(params.namespace, params.name) {
+  metadata+: {
+    labels+: Labels(params),
+    annotations+: Annotations(params),
+  },
+  spec+: {
+    selector: Selector(params),
+    type: "ClusterIP",
+    ports: [
+      {
+        name: "http",
+        port: 80,
+        targetPort: 3000,
+      },
+    ],
+  }
+};
+
+// Not used for now.
+local SshService(params) = kube.Service(params.namespace, params.name) {
+  metadata+: {
+    labels+: Labels(params),
+    annotations+: Annotations(params),
+  },
+  spec+: {
+    type: "ClusterIP",
+    ports: [
+      {
+        name: "ssh",
+        port: 22,
+        targetPort: 22,
+        protocol: "TCP",
+      },
+    ],
+  }
+};
+
+local StatefulSet(params) = kube.StatefulSet(params.namespace, params.name) {
+  metadata+: {
+    labels+: Labels(params),
+    annotations+: Annotations(params),
+  },
+  spec+: {
+    replicas: 1,
+    selector: {
+      matchLabels: Selector(params)
+    },
+    serviceName: params.name,
+    template: {
+      metadata: {
+        labels+: Labels(params),
+        annotations+: Annotations(params),
+      },
+      spec+: {
+        securityContext: {
+          fsGroup: 1000
+        },
+        initContainers: [
+          {
+            name: "init",
+            image: params.image,
+            command: ["/usr/sbin/init_gitea.sh"],
+            env: [
+              {
+                name: "DB_TYPE",
+                value: "postgres",
+              },
+              {
+                name: "DB_HOST",
+                value: params.postgresDbService + "." + params.postgresDbNamespace + ".svc.cluster.local:" + params.postgresDbPort,
+              },
+              {
+                name: "DB_NAME",
+                valueFrom: {
+                  secretKeyRef: {
+                    name: params.secretName,
+                    key: "psql-name"
+                  },
+                },
+              },
+              {
+                name: "DB_USER",
+                valueFrom: {
+                  secretKeyRef: {
+                    name: params.secretName,
+                    key: "psql-user"
+                  },
+                },
+              },
+              {
+                name: "DB_PASSWD",
+                valueFrom: {
+                  secretKeyRef: {
+                    name: params.secretName,
+                    key: "psql-password"
+                  },
+                },
+              },
+            ],
+            volumeMounts: [
+              {
+                name: "init",
+                mountPath: "/usr/sbin",
+              },
+              {
+                name: "config",
+                mountPath: "/etc/gitea/conf",
+              },
+              {
+                name: "data",
+                mountPath: "/data",
+              }
+            ]
+          },
+        ],
+        terminationGracePeriodSeconds: 120,
+        containers: [
+          {
+            name: "gitea",
+            image: params.image,
+            imagePullPolicy: "IfNotPresent",
+            env: [
+              /*
+              {
+                name: "SSH_LISTEN_PORT"
+                value: "22"
+              },
+              {
+                name: "SSH_PORT"
+                value: "22"
+              },
+              */
+              {
+                name: "DB_TYPE",
+                value: "postgres",
+              },
+              {
+                name: "DB_HOST",
+                value: params.postgresDbService + "." + params.postgresDbNamespace + ".svc.cluster.local:" + params.postgresDbPort,
+              },
+              {
+                name: "DB_NAME",
+                valueFrom: {
+                  secretKeyRef: {
+                    name: params.secretName,
+                    key: "psql-name"
+                  },
+                },
+              },
+              {
+                name: "DB_USER",
+                valueFrom: {
+                  secretKeyRef: {
+                    name: params.secretName,
+                    key: "psql-user"
+                  },
+                },
+              },
+              {
+                name: "DB_PASSWD",
+                valueFrom: {
+                  secretKeyRef: {
+                    name: params.secretName,
+                    key: "psql-password"
+                  },
+                },
+              },
+            ],
+            ports: [
+              /*
+              {
+                name: "ssh",
+                containerPort: 22
+              },
+              */
+              {
+                name: "http",
+                containerPort: 3000
+              }
+            ],
+            livenessProbe: {
+              tcpSocket: {
+                port: "http"
+              },
+              initialDelaySeconds: 200,
+              timeoutSeconds: 1,
+              periodSeconds: 10,
+              successThreshold: 1,
+              failureThreshold: 10,
+            },
+            readinessProbe: {
+              tcpSocket: {
+                port: "http",
+              },
+              initialDelaySeconds: 5,
+              periodSeconds: 10,
+              successThreshold: 1,
+              failureThreshold: 3,
+            },
+            resources: params.resources,
+            volumeMounts: [
+              {
+                name: "data",
+                mountPath: "/data",
+              },
+            ],
+          },
+        ],
+        volumes: [
+          {
+            name: "init",
+            secret: {
+              secretName: params.initSecretName,
+              defaultMode: 511,
+            },
+          },
+          {
+            name: "config",
+            configMap: {
+              name: params.name,
+            }
+          },
+          {
+            name: "data",
+            persistentVolumeClaim: {
+              claimName: params.dataClaimName,
+            },
+          }
+
+        ],
+      },
+    },
+  },
+};
+
+{
+  SecretParams: SecretParams,
+  InitSecret: InitSecret,
+  Secret: Secret,
+  Params: Params,
+  ConfigMap: ConfigMap,
+  Service: Service,
+  StatefulSet: StatefulSet,
+  App(params): {
+    resources+: kube.List() {
+      items_: {
+        configMap: ConfigMap(params),
+        service: Service(params),
+        statefulSet: StatefulSet(params),
+      },
+    },
+  },
+
+}
diff --git a/k8s/configs/templates/dev/ops/harbor.libsonnet b/k8s/configs/templates/dev/ops/harbor.libsonnet
new file mode 100644
index 0000000..05739f8
--- /dev/null
+++ b/k8s/configs/templates/dev/ops/harbor.libsonnet
@@ -0,0 +1,148 @@
+local images = import "k8s/configs/images.libsonnet";
+local base = import "k8s/configs/base.libsonnet";
+
+local SecretParams = base.SimpleFieldStruct([
+    "namespace",
+    "name",
+    "adminPassword",
+    "secretKey",
+    "registryPassword",
+    "registryHtpassword",
+    "databasePassword",
+]);
+
+local Secret(params) = base.Secret(params.namespace, params.name) {
+    data: {
+        adminPassword: params.adminPassword,
+        secretKey: params.secretKey,
+        // TODO:
+        passwd: params.registryPassword,
+        REGISTRY_PASSWD: params.registryPassword,
+        REGISTRY_HTPASSWD: params.registryHtpassword,
+        // Database password
+        password: params.databasePassword,
+    },
+};
+
+local Params = base.SimpleFieldStruct([
+    "namespace",
+    "context",
+    // Ingress
+    "ingressHost",
+    "ingressClassName",
+    "ingressAnnotations",
+    // Volume claims
+    "registryExistingClaim",
+    "jobServiceJobLogExistingClaim",
+    "redisExistingClaim",
+    "trivyExistingClaim",
+    // Credentials
+    "existingSecretAdminPassword",
+    "existingSecretSecretKey", // key is "secretKey"?
+    //"coreSecretName", // keys are "tls.crt" and "tls.key"
+    "registryCredentialsExistingSecret",  // key must be "REGISTRY_PASSWD"
+    // Database
+    "databaseHost",
+    "databasePort",
+    "databaseExistingSecret", // key must be "password"
+
+    // I hope these are optional if "secretKey" is provided.
+    "coreSecret",     // "must be a string of 16 characters"
+    "jobserviceSecret",  // string of 16 characters?
+    "registrySecret",  // Also string of 16 characters?
+]) {
+    storageClass: null,
+    // Not actually used (external db)
+    databaseExistingClaim: null,
+    databaseName: "harbor",
+    existingSecretAdminPasswordKey: "adminPassword",
+};
+
+local App(params) = {
+    app: params.context.helm.template("harbor", "./charts/harbor", {
+        namespace: params.namespace,
+        values: {
+            externalURL: "https://" + params.ingressHost,
+            existingSecretAdminPassword: params.existingSecretAdminPassword,
+            existingSecretAdminPasswordKey: params.existingSecretAdminPasswordKey,
+            existingSecretSecretKey: params.existingSecretSecretKey,
+            core: {
+                secret: params.coreSecret,
+                //secretName: params.coreSecretName,
+            },
+            jobService: {
+                secret: params.jobserviceSecret,
+            },
+            registry: {
+                secret: params.registrySecret,
+                credentials: {
+                    existingSecret: params.registryCredentialsExistingSecret,
+                },
+            },
+            expose: {
+                type: "ingress",
+                tls: {
+                    certSource: "secret",
+                    secret: {
+                        secretName: "harbor-ingress-cert"
+                    },
+                },
+                ingress: {
+                    hosts: {
+                        core: params.ingressHost,
+                    },
+                    className: params.ingressClassName,
+                    annotations: params.ingressAnnotations
+                },
+            },
+            database: {
+                type: "external",
+                external: {
+                    host: params.databaseHost,
+                    username: "harbor",
+                    coreDatabase: params.databaseName,
+                    port: params.databasePort,
+                    existingSecret: params.databaseExistingSecret,
+                },
+            },
+            persistence: {
+                enabled: true,
+                resourcePolicy: "keep",
+                imageChartStorage: {
+                    type: "filesystem",
+                },
+                persistentVolumeClaim: {
+                    registry: {
+                        existingClaim: params.registryExistingClaim,
+                        storageClass: params.storageClass,
+                    },
+                    jobservice: {
+                        jobLog: {
+                            existingClaim: params.jobServiceJobLogExistingClaim,
+                            storageClass: params.storageClass,
+                        },
+                    },
+                    database: {
+                        existingClaim: params.databaseExistingClaim,
+                        storageClass: params.storageClass,
+                    },
+                    redis: {
+                        existingClaim: params.redisExistingClaim,
+                        storageClass: params.storageClass,
+                    },
+                    trivy: {
+                        existingClaim: params.trivyExistingClaim,
+                        storageClass: params.storageClass,
+                    },
+                },
+            },
+        },
+    })
+};
+
+{
+    SecretParams: SecretParams,
+    Secret: Secret,
+    Params: Params,
+    App: App,
+}
\ No newline at end of file
diff --git a/k8s/configs/templates/dev/ops/openssh.libsonnet b/k8s/configs/templates/dev/ops/openssh.libsonnet
new file mode 100644
index 0000000..65ae40b
--- /dev/null
+++ b/k8s/configs/templates/dev/ops/openssh.libsonnet
@@ -0,0 +1,71 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "claimNames",
+  "sshNodePort",
+  "publicKey",
+  "username",
+]) {
+  local inPodPort = 2222,
+  labels: {},
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "openssh-server",
+    imageName: "linuxserver/openssh-server",
+    labels+: $.labels,
+    nodeSelector: {
+      #"nvidia.com/gpu.present": "true",
+    },
+    services: [
+      linuxserver.Service {
+        suffix: "ssh-node",
+        spec: kube.SvcUtil.BasicNodePortSpec(inPodPort, $.sshNodePort),
+      },
+    ],
+    ports: [ kube.DeployUtil.ContainerPort("ssh", inPodPort), ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "config-claim",
+        mountPath: "/config",
+        bindName: $.configClaim,
+      },
+    ] + [
+      linuxserver.Pvc{
+        name: claimName,
+        mountPath: "/kubemnt/" + claimName,
+        bindName: claimName,
+      } for claimName in $.claimNames
+    ],
+    env: linuxserver.Env {
+      others: [
+        kube.NameVal("PUBLIC_KEY", $.publicKey),
+        kube.NameVal("USER_NAME", $.username),
+      ],
+    },
+    resources: {
+      requests: {
+        cpu: "50m",
+        memory: "100Mi",
+      },
+      limits: {
+        cpu: "100m",
+        memory: "400Mi",
+      },
+    },
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams);
+
+{
+  Params: Params,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/dev/organization/focalboard.libsonnet b/k8s/configs/templates/dev/organization/focalboard.libsonnet
new file mode 100644
index 0000000..6c651cb
--- /dev/null
+++ b/k8s/configs/templates/dev/organization/focalboard.libsonnet
@@ -0,0 +1,126 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local probe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 30,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local ConfigMap(params) = kube.ConfigMap(params.namespace, params.name + "-config") {
+  data: {
+    "config.json": "",
+    /*
+    |||
+      {
+        "serverRoot": "http://localhost:8000",
+        "port": 8000,
+        "dbtype": "sqlite3",
+        "dbconfig": "./focalboard.db?_busy_timeout=5000",
+        "dbtableprefix": "",
+        "postgres_dbconfig": "dbname=focalboard sslmode=disable",
+        "useSSL": false,
+        "webpath": "./webapp/pack",
+        "filesdriver": "local",
+        "filespath": "./files",
+        "telemetry": true,
+        "prometheusaddress": ":9092",
+        "webhook_update": [],
+        "session_expire_time": 2592000,
+        "session_refresh_time": 18000,
+        "localOnly": false,
+        "enableLocalMode": true,
+        "localModeSocketLocation": "/var/tmp/focalboard_local.socket",
+        "authMode": "native",
+        "logging_cfg_file": "",
+        "audit_cfg_file": "",
+        "enablePublicSharedBoards": false
+      } 
+    |||,
+    */
+  },
+};
+ 
+local WebPort = 8000;
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "dataClaimName",
+]) {
+  labels: {},
+  gatekeeperSidecar: null,
+  configMapName: $.name + "-config",
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "focalboard",
+    imageName: "mattermost/focalboard",
+    labels+: $.labels,
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+    env: linuxserver.Env {
+      others: [
+        kube.NameVal("VIRTUAL_HOST", "localhost"),
+        kube.NameVal("VIRTUAL_PORT", "8000"),
+        kube.NameVal("VIRTUAL_PROTO", "http"),
+      ]
+    },
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+      },
+    ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "data",
+        mountPath: "/opt/focalboard/data",
+        bindName: $.dataClaimName,
+      },
+    ],
+    /*
+    configMaps: [
+      linuxserver.ConfigMap {
+        name: "config",
+        mountPath: "/opt/focalboard/config.json",
+        bindName: $.configMapName,
+        mountSubPath: "config.json",
+        items: [
+          {
+            key: "config.json",
+            path: "config.json",
+          },
+        ],
+      },
+    ],
+    */
+    resources: {
+      requests: {
+        cpu: "10m",
+        memory: "128Mi",
+      },
+      limits: {
+        cpu: "50m",
+        memory: "256Mi",
+      },
+    },
+    livenessProbe: probe(/*delaySeconds=*/60),
+    readinessProbe: probe(/*delaySeconds=*/60),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams) {
+  configMap: ConfigMap(params),
+};
+
+{
+  Params: Params,
+  WebPort: WebPort,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/dev/organization/vikunja.libsonnet b/k8s/configs/templates/dev/organization/vikunja.libsonnet
new file mode 100644
index 0000000..48db16f
--- /dev/null
+++ b/k8s/configs/templates/dev/organization/vikunja.libsonnet
@@ -0,0 +1,118 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local SecretParams = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "vikunja_db_password",
+  "vikunja_jwt_secret",
+]);
+
+local Secret(params) = kube.Secret(params.namespace, params.name) {
+  type: "Opaque",
+  data+: {
+    "vikunja-db-pwd": params.vikunja_db_password,
+    "vikunja-jwt-secret": params.vikunja_jwt_secret,
+  }
+};
+
+local probe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 30,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local WebPort = 3456;
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "dataClaimName",
+  "ingressBaseUrl", # something.com/
+  "postgresHost",
+  "secretName",
+]) {
+  jwtSecretKey: "vikunja-jwt-secret",
+  dbPwdSecretKey: "vikunja-db-pwd",
+  postgresDbUser: "vikunja",
+  postgresDbName: "vikunja",
+  //postgresSchema: "public",
+  timezone: "US/Pacific",
+  labels: {},
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "vikunja",
+    imageName: "vikunja/vikunja",
+    labels+: $.labels,
+    ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+    env: linuxserver.Env {
+      others: [
+        kube.NameVal("VIKUNJA_SERVICE_PUBLICURL", $.ingressBaseUrl),
+        kube.NameVal("VIKUNJA_DATABASE_HOST", $.postgresHost),
+        kube.NameVal("VIKUNJA_DATABASE_TYPE", "postgres"),
+        kube.NameVal("VIKUNJA_DATABASE_USER", $.postgresDbUser),
+        kube.NameVal("VIKUNJA_DATABASE_DATABASE", $.postgresDbName),
+        {
+            name: "VIKUNJA_SERVICE_JWTSECRET", 
+            valueFrom: {
+                secretKeyRef: {
+                    name: $.secretName,
+                    key: $.jwtSecretKey,
+                },
+            },
+        },
+        {
+            name: "VIKUNJA_DATABASE_PASSWORD", 
+            valueFrom: {
+                secretKeyRef: {
+                    name: $.secretName,
+                    key: $.dbPwdSecretKey,
+                },
+            },
+        },
+      ],
+    },
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+      },
+    ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "files",
+        mountPath: "/app/vikunja/files",
+        bindName: $.dataClaimName,
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "250m",
+        memory: "512Mi",
+      },
+      limits: {
+        cpu: "500m",
+        memory: "1Gi",
+      },
+    },
+    livenessProbe: probe(/*delaySeconds=*/20),
+    readinessProbe: probe(/*delaySeconds=*/20),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams) {};
+
+{
+  Params: Params,
+  WebPort: WebPort,
+  App(params): App(params),
+  SecretParams: SecretParams,
+  Secret(params): Secret(params)
+}
diff --git a/k8s/configs/templates/dev/organization/whitebophir.libsonnet b/k8s/configs/templates/dev/organization/whitebophir.libsonnet
new file mode 100644
index 0000000..49fed0a
--- /dev/null
+++ b/k8s/configs/templates/dev/organization/whitebophir.libsonnet
@@ -0,0 +1,72 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local probe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 30,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local WebPort = 5001;
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "storageClaimMode",
+]) {
+  labels: {},
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "whitebophir",
+    imageName: "lovasoa/wbo",
+    labels+: $.labels,
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+    env: linuxserver.Env {
+      others: [
+        kube.NameVal("PORT", std.toString(WebPort)),
+        #kube.NameVal("HOST", "127.0.0.1"),
+      ]
+    },
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+      },
+    ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "storage",
+        mountPath: "/opt/app/server-data",
+        bindName: $.storageClaimName,
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "400m",
+        memory: "256Mi",
+      },
+      limits: {
+        cpu: "1500m",
+        memory: "512Mi",
+      },
+    },
+    livenessProbe: probe(/*delaySeconds=*/60),
+    readinessProbe: probe(/*delaySeconds=*/60),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams) {};
+
+{
+  Params: Params,
+  WebPort: WebPort,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/dev/tools/browserless.libsonnet b/k8s/configs/templates/dev/tools/browserless.libsonnet
new file mode 100644
index 0000000..1164202
--- /dev/null
+++ b/k8s/configs/templates/dev/tools/browserless.libsonnet
@@ -0,0 +1,66 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local probe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 30,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local WebPort = 3000;
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+]) {
+  labels: {},
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "browserless",
+    imageName: "browserless/chrome",
+    labels+: $.labels,
+    ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+    env: linuxserver.Env {
+      others: [
+        kube.NameVal("MAX_CONCURRENT_SESSIONS", "10"),
+        kube.NameVal("TOKEN", "example-token"),
+        #https://www.browserless.io/docs/docker#securing-your-instance
+      ]
+    },
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+      },
+    ],
+    pvcs: [
+    ],
+    resources: {
+      requests: {
+        cpu: "500m",
+        memory: "1Gi",
+      },
+      limits: {
+        cpu: "1000m",
+        memory: "2Gi",
+      },
+    },
+    livenessProbe: probe(/*delaySeconds=*/20),
+    readinessProbe: probe(/*delaySeconds=*/20),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams) {};
+
+{
+  Params: Params,
+  WebPort: WebPort,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/dev/tools/changedetection.libsonnet b/k8s/configs/templates/dev/tools/changedetection.libsonnet
new file mode 100644
index 0000000..3f57816
--- /dev/null
+++ b/k8s/configs/templates/dev/tools/changedetection.libsonnet
@@ -0,0 +1,72 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local probe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 30,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local WebPort = 5000;
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "playwrightDriverUrl",
+  "datastoreClaimName",
+]) {
+  labels: {},
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "changedetection",
+    imageName: "dgtlmoon/changedetection.io",
+    labels+: $.labels,
+    ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+    env: linuxserver.Env {
+      others: [
+        kube.NameVal("PLAYWRIGHT_DRIVER_URL", $.playwrightDriverUrl),
+        #https://www.browserless.io/docs/docker#securing-your-instance
+      ]
+    },
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+      },
+    ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "datastore",
+        mountPath: "/datastore",
+        bindName: $.datastoreClaimName,
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "250m",
+        memory: "512Mi",
+      },
+      limits: {
+        cpu: "500m",
+        memory: "1Gi",
+      },
+    },
+    livenessProbe: probe(/*delaySeconds=*/20),
+    readinessProbe: probe(/*delaySeconds=*/20),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams) {};
+
+{
+  Params: Params,
+  WebPort: WebPort,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/dev/tools/hastebin.libsonnet b/k8s/configs/templates/dev/tools/hastebin.libsonnet
new file mode 100644
index 0000000..46927d4
--- /dev/null
+++ b/k8s/configs/templates/dev/tools/hastebin.libsonnet
@@ -0,0 +1,73 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+
+local hastebinProbe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 30,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local WebPort = 8080;
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "dataClaimName",
+]) {
+  labels: {},
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "hastebin",
+    imageName: "privatebin/nginx-fpm-alpine",
+    labels+: $.labels,
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    env: linuxserver.Env {
+      others: [
+        kube.NameVal("NODE_RED_ENABLE_PROJECTS", "true"),
+      ]
+    },
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+      },
+    ],
+    ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "data",
+        mountPath: "/srv/data",
+        bindName: $.dataClaimName,
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "20m",
+        memory: "128Mi",
+      },
+      limits: {
+        cpu: "50m",
+        memory: "256Mi",
+      },
+    },
+    livenessProbe: hastebinProbe(/*delaySeconds=*/60),
+    readinessProbe: hastebinProbe(/*delaySeconds=*/60),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams);
+
+{
+  Params: Params,
+  WebPort: WebPort,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/dev/tools/hugo.libsonnet b/k8s/configs/templates/dev/tools/hugo.libsonnet
new file mode 100644
index 0000000..4172623
--- /dev/null
+++ b/k8s/configs/templates/dev/tools/hugo.libsonnet
@@ -0,0 +1,77 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local probe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 30,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local WebPort = 1313;
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "dataClaimName",
+]) {
+  labels: {},
+  mountSubPath: null,
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "hugo",
+    imageName: "hugomods/hugo",
+    labels+: $.labels,
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    env: linuxserver.Env {
+      others+: [
+      ],
+    },
+    args: [
+        "server",
+        "--disableFastRender"
+    ],
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+      },
+    ],
+    ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "data",
+        mountPath: "/src",
+        bindName: $.dataClaimName,
+        mountSubPath: $.mountSubPath,
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "150m",
+        memory: "512Mi",
+      },
+      limits: {
+        cpu: "250m",
+        memory: "1Gi",
+      },
+    },
+    livenessProbe: probe(/*delaySeconds=*/20),
+    readinessProbe: probe(/*delaySeconds=*/20),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams);
+
+{
+  Params: Params,
+  WebPort: WebPort,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/dev/tools/rclone.libsonnet b/k8s/configs/templates/dev/tools/rclone.libsonnet
new file mode 100644
index 0000000..00ce5b0
--- /dev/null
+++ b/k8s/configs/templates/dev/tools/rclone.libsonnet
@@ -0,0 +1,102 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local probe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 15,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local WebPort = 5572;
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "configClaimName",
+  "dataClaimName",
+  "redisHost",
+  "schedule",
+]) {
+  labels: {},
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "rclone",
+    imageName: "rclone/rclone",
+    labels+: $.labels,
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    isPrivileged: true,
+    schedule: $.schedule,
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+      },
+    ],
+    command: [
+        "rclone"
+    ],
+    args: [
+        "move",
+        "box-paperless:paperless-ng/",
+        "/data/consume",
+        //"--rc-web-gui",
+        //"--rc-baseurl http://rclone-paperless.csbx.dev"
+        //"--rc-addr=:5572",
+        //"--rc-no-auth",
+        //"--rc-web-gui-no-open-browser",
+    ],
+    ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+    env: linuxserver.Env {
+      others: [
+        //kube.NameVal("REDIS_URL", $.redisHost),
+      ]
+    },
+    pvcs: [
+      linuxserver.Pvc{
+        name: "config",
+        mountPath: "/config",
+        bindName: $.configClaimName,
+      },
+      linuxserver.Pvc{
+        name: "data",
+        mountPath: "/data",
+        bindName: $.dataClaimName,
+      },
+    ],
+    hostPaths: [
+      linuxserver.HostPath{
+        name: "fuse",
+        hostPath: "/dev/fuse",
+        mountPath: "/dev/fuse",
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "500m",
+        memory: "500Mi",
+      },
+      limits: {
+        cpu: "600m",
+        memory: "600Mi",
+      },
+    },
+    livenessProbe: probe(/*delaySeconds=*/20),
+    readinessProbe: probe(/*delaySeconds=*/20),
+  },
+};
+
+local Cron(params) = linuxserver.Cron(params.lsParams);
+
+{
+  WebPort: WebPort,
+  Params: Params,
+  Cron(params): Cron(params),
+}
diff --git a/k8s/configs/templates/personal/game/bluemap.libsonnet b/k8s/configs/templates/personal/game/bluemap.libsonnet
new file mode 100644
index 0000000..4575dd9
--- /dev/null
+++ b/k8s/configs/templates/personal/game/bluemap.libsonnet
@@ -0,0 +1,99 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local probe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 30,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local WebPort = 8100;
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "configClaimName",
+  "dataClaimName",
+  "webClaimName",
+  "worldClaimName",
+]) {
+  labels: {},
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "bluemap",
+    imageName: "bluemap-minecraft/bluemap",
+    labels+: $.labels,
+    args: [
+        "-r",
+        "-u",
+        "-w",
+    ],
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: {
+          type: "ClusterIP",
+          ports: [
+              kube.SvcUtil.TCPServicePort("http", 80) {
+                targetPort: WebPort
+              },
+          ],
+        },
+      },
+    ],
+    ports: [ 
+        kube.DeployUtil.ContainerPort("http", WebPort), 
+    ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "config",
+        mountPath: "/app/config",
+        bindName: $.configClaimName,
+      },
+      linuxserver.Pvc{
+        name: "data",
+        mountPath: "/app/data",
+        bindName: $.dataClaimName,
+      },
+      linuxserver.Pvc{
+        name: "world",
+        mountPath: "/app/world",
+        bindName: $.worldClaimName,
+        mountSubPath: "world"
+      },
+      linuxserver.Pvc{
+        name: "web",
+        mountPath: "/app/web",
+        bindName: $.webClaimName,
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "500m",
+        memory: "2000Mi",
+      },
+      limits: {
+        cpu: "1000m",
+        memory: "4000Mi",
+      },
+    },
+    livenessProbe: probe(/*delaySeconds=*/30),
+    readinessProbe: probe(/*delaySeconds=*/90),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams);
+
+{
+  Params: Params,
+  WebPort: WebPort,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/personal/game/minecraft-server.libsonnet b/k8s/configs/templates/personal/game/minecraft-server.libsonnet
new file mode 100644
index 0000000..e0dd55f
--- /dev/null
+++ b/k8s/configs/templates/personal/game/minecraft-server.libsonnet
@@ -0,0 +1,107 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local probe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 30,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local WebPort = 25565;
+local RconPort = 25575;
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "dataClaimName",
+]) {
+  labels: {},
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "minecraft-server",
+    imageName: "itzg/minecraft-server",
+    labels+: $.labels,
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    env: linuxserver.Env {
+      others: [
+        kube.NameVal("TYPE", "AUTO_CURSEFORGE"),
+        //kube.NameVal("CF_PAGE_URL", "https://www.curseforge.com/minecraft/modpacks/sevtech-ages"),
+        //kube.NameVal("CF_PAGE_URL", "https://www.curseforge.com/minecraft/modpacks/enigmatica6"),
+        //kube.NameVal("CF_PAGE_URL", "https://www.curseforge.com/minecraft/modpacks/skyfactory-4"),
+        kube.NameVal("CF_PAGE_URL", "https://www.curseforge.com/minecraft/modpacks/all-the-mods-10"),
+        
+        kube.NameVal("EULA", "true"),
+        //kube.NameVal("VERSION", "1.16.5"),
+        //kube.NameVal("VERSION", "1.12.2"),
+        kube.NameVal("VERSION", "1.21.1"),
+        kube.NameVal("CF_API_KEY", "$2a$10$HVmLnTPrGzIYVFvmIKY92.qqeZcwzVk7lfNmoJjDuCSBivw5dO4Fq"),
+        kube.NameVal("MOTD", "Welcome!"),
+        kube.NameVal("DIFFICULTY", "easy"),
+        kube.NameVal("VIEW_DISTANCE", "20"),
+        kube.NameVal("OPS", "LIMIT_ACM"),
+        kube.NameVal("MEMORY", "8G"),
+        kube.NameVal("ALLOW_FLIGHT", "TRUE"),
+        kube.NameVal("ENABLE_RCON", "true"),
+        kube.NameVal("RCON_PASSWORD", "example-password"),
+        kube.NameVal("SNOOPER_ENABLED", "false"),
+        kube.NameVal("MAX_BUILD_HEIGHT", "512"),
+      ]
+    },
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: {
+          type: "ClusterIP",
+          ports: [
+              kube.SvcUtil.TCPServicePort("http", 80) {
+                targetPort: WebPort
+              },
+          ],
+        },
+      },
+      linuxserver.Service {
+        suffix: "rcon",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(RconPort)
+      },
+    ],
+    ports: [ 
+        kube.DeployUtil.ContainerPort("http", WebPort), 
+        kube.DeployUtil.ContainerPort("http-rcon", RconPort), 
+    ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "data",
+        mountPath: "/data",
+        bindName: $.dataClaimName,
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "2000m",
+        memory: "8000Mi",
+      },
+      limits: {
+        cpu: "3000m",
+        memory: "10000Mi",
+      },
+    },
+    livenessProbe: probe(/*delaySeconds=*/250),
+    readinessProbe: probe(/*delaySeconds=*/250),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams);
+
+{
+  Params: Params,
+  WebPort: WebPort,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/personal/game/palworld.libsonnet b/k8s/configs/templates/personal/game/palworld.libsonnet
new file mode 100644
index 0000000..a8575b8
--- /dev/null
+++ b/k8s/configs/templates/personal/game/palworld.libsonnet
@@ -0,0 +1,108 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local probe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 30,
+  udpSocket: {
+    port: "query",
+  },
+};
+
+local GamePort =  8211;
+local QueryPort = 27015;
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "dataClaimName",
+  "gameNodePort",
+  "queryNodePort",
+]) {
+  labels: {},
+  gatekeeperSidecar: null,
+  configMapName: $.name + "-config",
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "palworld",
+    imageName: "thijsvanloef/palworld-server-docker",
+    labels+: $.labels,
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    ports: [ 
+        kube.DeployUtil.ContainerPort("game", GamePort) {
+          protocol: "UDP",
+        },
+        kube.DeployUtil.ContainerPort("query", QueryPort) {
+          protocol: "UDP",
+        },
+    ],
+    env: linuxserver.Env {
+      others: [
+        //kube.NameVal("PUID","1000"),
+        //kube.NameVal("PGID","1000"),
+        kube.NameVal("PORT", std.toString(GamePort)),
+        kube.NameVal("PLAYERS", "6"),
+        kube.NameVal("MULTITHREADING", "TRUE"),
+        kube.NameVal("COMMUNITY", "FALSE"),
+        //kube.NameVal("PUBLIC_IP", "23.139.112.166"),
+        kube.NameVal("SERVER_NAME", "Sanders Pal Server"),
+        //kube.NameVal("SERVER_PASSWORD", "example-password"),
+        #kube.NameVal("PUBLIC_IP", "FALSE"),
+        #kube.NameVal("PUBLIC_PORT", std.toString($.gameNodePort)),
+        kube.NameVal("ADMIN_PASSWORD", "example-password"),
+        kube.NameVal("EXP_RATE", "2.0"),
+        kube.NameVal("PAL_CAPTURE_RATE", "2.0"),
+        kube.NameVal("BUILD_OBJECT_DETERIORATION_DAMAGE_RATE", "0.0"),
+        kube.NameVal("AUTO_RESET_GUILD_TIME_NO_ONLINE_PLAYERS", "7000.0"),
+        kube.NameVal("DEATH_PENALTY", "ITEM"),
+        kube.NameVal("PAL_EGG_DEFAULT_HATCHING_TIME", "1.0"),
+        kube.NameVal("WORK_SPEED_RATE", "2.0"),
+        kube.NameVal("ENABLE_NON_LOGIN_PENALTY", "FALSE"),
+      ]
+    },
+    services: [
+      linuxserver.Service {
+        suffix: "game",
+        spec: kube.SvcUtil.BasicNodePortSpec(GamePort, $.gameNodePort),
+      },
+      linuxserver.Service {
+        suffix: "query",
+        spec: kube.SvcUtil.BasicNodePortSpec(QueryPort, $.queryNodePort),
+      },
+    ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "data",
+        mountPath: "/palworld",
+        bindName: $.dataClaimName,
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "2000m",
+        memory: "16Gi",
+      },
+      limits: {
+        cpu: "4000m",
+        memory: "24Gi",
+      },
+    },
+    //livenessProbe: probe(/*delaySeconds=*/60),
+    //readinessProbe: probe(/*delaySeconds=*/60),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams) {
+};
+
+{
+  Params: Params,
+  GamePort: GamePort,
+  QueryPort: QueryPort,
+  //ConfigMap(params): ConfigMap(params),
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/personal/home/frigate-nvr.libsonnet b/k8s/configs/templates/personal/home/frigate-nvr.libsonnet
new file mode 100644
index 0000000..9028d52
--- /dev/null
+++ b/k8s/configs/templates/personal/home/frigate-nvr.libsonnet
@@ -0,0 +1,227 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local probe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 20,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local WebPort = 5000;
+local RtspPort = 8554;
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "dbClaimName",
+  "configClaimName",
+  "storageClaimName",
+  "mqttAddress",
+  "rtspNodePort",
+  //"ingressHost",
+  "frigateRtspPwd",
+  "frigateGarageSourceRtsp",
+]) {
+  local rtmpPort = 1935,
+  labels: {},
+  gatekeeperSidecar: null,
+  configMapName: $.name + "-config",
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "frigate",
+    imageName: "blakeblackshear/frigate",
+    labels+: $.labels,
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    isPrivileged: true,
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: {
+          type: "ClusterIP",
+          ports: [
+            kube.SvcUtil.TCPServicePort("http", 80) {
+              targetPort: WebPort
+            },
+            kube.SvcUtil.TCPServicePort("rtmp", rtmpPort) {
+              targetPort: rtmpPort
+            },
+          ],
+        },
+      },
+      linuxserver.Service {
+        suffix: "rtsp",
+        spec: kube.SvcUtil.BasicNodePortSpec(RtspPort, $.rtspNodePort),
+      },
+    ],
+    nodeSelector: {
+      "has_coral": "true"
+    },
+    ports: [ 
+      kube.DeployUtil.ContainerPort("http", WebPort), 
+      kube.DeployUtil.ContainerPort("rtmp", rtmpPort), 
+      kube.DeployUtil.ContainerPort("rtsp", RtspPort), 
+    ],
+    env: linuxserver.Env {
+      others: [
+        kube.NameVal("FRIGATE_RTSP_PASSWORD", "acmcarther"),
+      ]
+    },
+    pvcs: [
+      linuxserver.Pvc{
+        name: "frigate-db",
+        mountPath: "/db",
+        bindName: $.dbClaimName,
+      },
+      linuxserver.Pvc{
+        name: "frigate-config",
+        mountPath: "/config",
+        bindName: $.configClaimName,
+      },
+      linuxserver.Pvc{
+        name: "frigate-storage",
+        mountPath: "/media",
+        bindName: $.storageClaimName,
+      },
+    ],
+    // This was removed 2024-10-05
+    /*
+    configMaps: [
+      linuxserver.ConfigMap {
+        name: "config",
+        mountPath: "/config",
+        bindName: $.configMapName,
+      },
+    ],
+    */
+    hostPaths: [
+      linuxserver.HostPath{
+        name: "usb",
+        hostPath: "/dev/bus/usb",
+        mountPath: "/dev/bus/usb",
+      },
+    ],
+    emptyDirs: [
+      linuxserver.EmptyDir {
+        name: "dshm",
+        mountPath: "/dev/shm",
+        medium: "Memory",
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "400m",
+        memory: "2028Mi",
+      },
+      limits: {
+        cpu: "1500m",
+        memory: "4096Mi",
+      },
+    },
+    livenessProbe: probe(/*delaySeconds=*/60),
+    readinessProbe: probe(/*delaySeconds=*/60),
+  },
+};
+
+local ConfigMap(params) = kube.ConfigMap(params.namespace, params.name + "-config") {
+  data: {
+    "config.yml": |||
+      database:
+        path: "/db/frigate.db"
+      mqtt:
+        host: %(mqttAddress)s
+        port: 80
+      detectors:
+        coral:
+          type: edgetpu
+          device: usb
+      objects:
+        track:
+          - person
+          - bear
+          - cat 
+          - mouse
+          - dog
+      ffmpeg:
+        output_args:
+          record: preset-record-generic-audio-aac
+      go2rtc:
+        rtsp:
+          username: "acmcarther"
+          password: "%(frigateRtspPwd)s"
+        streams:
+          garage_rtsp_cam_live:
+            # subtype=0 is main stream with audio
+            - "%(frigateGarageSourceRtsp)s&subtype=0"
+            - "ffmpeg:garage_rtsp_cam_live#audio=opus"
+      cameras:
+        garage:
+          live:
+            stream_name: garage_rtsp_cam_live
+          ffmpeg:
+            # Configure output for restream
+            output_args:
+              record: preset-record-generic-audio-copy
+            inputs: 
+              - path: rtsp://127.0.0.1:8554/garage_rtsp_cam_live
+                input_args: preset-rtsp-restream
+                roles:
+                  - record
+              # subtype 1 is substream without audio
+              - path: "%(frigateGarageSourceRtsp)s&subtype=1"
+                roles:
+                  - restream
+              # subtype 2 is substream for detection
+              - path: "%(frigateGarageSourceRtsp)s&subtype=2"
+                roles:
+                  - detect
+          detect:
+            width: 1280
+            height: 720
+          zones:
+            street:
+              coordinates: 1280,0,1280,316,1130,316,824,270,631,196,503,0
+              objects:
+                - bear
+            driveway:
+              coordinates: 0,720,1280,720,1280,414,752,257,577,154,0,144
+              objects:
+                - person
+                - cat
+                - bear
+                - mouse
+          record:
+            enabled: True
+            events:
+              retain:
+                default: 7 
+                mode: active_objects
+          snapshots:
+            enabled: True
+            timestamp: True
+    ||| % {
+      mqttAddress: params.mqttAddress,
+      frigateRtspPwd: params.frigateRtspPwd,
+      frigateGarageSourceRtsp: params.frigateGarageSourceRtsp,
+    },
+  },
+};
+ 
+
+local App(params) = linuxserver.App(params.lsParams) {
+  configMap: ConfigMap(params),
+};
+
+
+{
+  WebPort: WebPort,
+  RtspPort: RtspPort,
+  Params: Params,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/personal/home/grocy.libsonnet b/k8s/configs/templates/personal/home/grocy.libsonnet
new file mode 100644
index 0000000..8f7b223
--- /dev/null
+++ b/k8s/configs/templates/personal/home/grocy.libsonnet
@@ -0,0 +1,107 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local probe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 30,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local WebPort = 80;
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "dataClaimName",
+  "ingressHost",
+]) {
+  labels: {},
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "grocy",
+    imageName: "linuxserver/grocy",
+    labels+: $.labels,
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+      },
+    ],
+    ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "data",
+        mountPath: "/config",
+        bindName: $.dataClaimName,
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "50m",
+        memory: "128Mi",
+      },
+      limits: {
+        cpu: "100m",
+        memory: "256Mi",
+      },
+    },
+    livenessProbe: probe(/*delaySeconds=*/20),
+    readinessProbe: probe(/*delaySeconds=*/20),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams) {
+  ingress: kube.Ingress(params.namespace, "grocy") {
+    metadata+: {
+      annotations+: {
+        "cert-manager.io/cluster-issuer": "letsencrypt-production",
+      },
+    },
+    spec+: {
+      ingressClassName: "nginx",
+      tls: [
+        {
+          hosts: [
+            params.ingressHost,
+          ],
+          secretName: "grocy-cert",
+        },
+      ],
+      rules: [
+        {
+          host: params.ingressHost,
+          http: {
+            paths: [
+              {
+                path: "/",
+                pathType: "Prefix",
+                backend: {
+                  service: {
+                    name: 'grocy-ui',
+                    port: { number: 80},
+                  },
+                },
+              },
+            ],
+          },
+        },
+      ],
+    },
+  },
+};
+
+
+{
+  Params: Params,
+  WebPort: WebPort,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/personal/home/home-assistant.libsonnet b/k8s/configs/templates/personal/home/home-assistant.libsonnet
new file mode 100644
index 0000000..ea33005
--- /dev/null
+++ b/k8s/configs/templates/personal/home/home-assistant.libsonnet
@@ -0,0 +1,66 @@
+
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local homeAssistantProbe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 15,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "filesClaimName",
+]) {
+  local webPort = 8123,
+  labels: {},
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "home-assistant",
+    imageName: "linuxserver/homeassistant",
+    labels+: $.labels,
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(webPort)
+      },
+    ],
+    ports: [ kube.DeployUtil.ContainerPort("http", webPort), ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "files",
+        mountPath: "/config",
+        bindName: $.filesClaimName,
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "500m",
+        memory: "500Mi",
+      },
+      limits: {
+        cpu: "1000m",
+        memory: "1000Mi",
+      },
+    },
+    livenessProbe: homeAssistantProbe(/*delaySeconds=*/30),
+    readinessProbe: homeAssistantProbe(/*delaySeconds=*/30),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams);
+
+{
+  Params: Params,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/personal/home/monica.libsonnet b/k8s/configs/templates/personal/home/monica.libsonnet
new file mode 100644
index 0000000..3eb2063
--- /dev/null
+++ b/k8s/configs/templates/personal/home/monica.libsonnet
@@ -0,0 +1,91 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local WebPort = 80;
+
+local monicaProbe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 30,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "mariaDbService",
+  "mariaDbNamespace",
+  "secretName",
+  "secretDbPwdKey",
+  "ingressHost",
+  "storageClaimName",
+]) {
+  labels: {},
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "monica",
+    imageName: "monicahq/monicahq",
+    labels+: $.labels,
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    env: linuxserver.Env {
+      others: [
+        kube.NameVal("APP_URL", "https://" + $.ingressHost),
+        kube.NameVal("APP_ENV", "production"),
+        kube.NameVal("APP_TRUSTED_PROXIES", "*"),
+        kube.NameVal("DB_HOST",
+          $.mariaDbService + "." + $.mariaDbNamespace + ".svc.cluster.local"),
+        {
+          name: "DB_PASSWORD",
+          valueFrom: {
+            secretKeyRef: {
+              name: $.secretName,
+              key: $.secretDbPwdKey,
+            }
+          }
+ 
+        }
+      ]
+    },
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+      },
+    ],
+    ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "data",
+        mountPath: "/var/www/monica/storage",
+        bindName: $.storageClaimName,
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "50m",
+        memory: "500Mi",
+      },
+      limits: {
+        cpu: "100m",
+        memory: "800Mi",
+      },
+    },
+    livenessProbe: monicaProbe(/*delaySeconds=*/60),
+    readinessProbe: monicaProbe(/*delaySeconds=*/60),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams);
+
+{
+  WebPort: WebPort,
+  Params: Params,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/personal/home/paperless-ng.libsonnet b/k8s/configs/templates/personal/home/paperless-ng.libsonnet
new file mode 100644
index 0000000..26f55cd
--- /dev/null
+++ b/k8s/configs/templates/personal/home/paperless-ng.libsonnet
@@ -0,0 +1,100 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local probe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 15,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local WebPort = 8000;
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "configClaimName",
+  "dataClaimName",
+  "redisHost",
+  "postgresHost",
+  "postgresPwdSecret",
+  "postgresPwdSecretKey",
+]) {
+  postgresDbName: "paperless",
+  postgresDbUser: "paperless",
+  labels: {},
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "paperless-ngx",
+    imageName: "linuxserver/paperless-ngx",
+    labels+: $.labels,
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+      },
+    ],
+    ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+    env: linuxserver.Env {
+      others: [
+        // For NFS
+        kube.NameVal("PAPERLESS_CONSUMER_POLLING", "10"),
+        kube.NameVal("PAPERLESS_REDIS", $.redisHost),
+        kube.NameVal("PAPERLESS_CONSUMPTION_DIR", "/data/consume"),
+        kube.NameVal("PAPERLESS_URL", "https://paperless.csbx.dev"),
+        kube.NameVal("PAPERLESS_DBENGINE", "postgresql"),
+        kube.NameVal("PAPERLESS_DBHOST", $.postgresHost),
+        {
+          name: "PAPERLESS_DBPASS",
+          valueFrom: {
+            secretKeyRef: {
+              name: $.postgresPwdSecret,
+              key: $.postgresPwdSecretKey ,
+            }
+          }
+        },
+
+      ]
+    },
+    pvcs: [
+      linuxserver.Pvc{
+        name: "config",
+        mountPath: "/config",
+        bindName: $.configClaimName,
+      },
+      linuxserver.Pvc{
+        name: "data",
+        mountPath: "/data",
+        bindName: $.dataClaimName,
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "200m",
+        memory: "500Mi",
+      },
+      limits: {
+        cpu: "800m",
+        memory: "1500Mi",
+      },
+    },
+    livenessProbe: probe(/*delaySeconds=*/40),
+    readinessProbe: probe(/*delaySeconds=*/40),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams);
+
+{
+  WebPort: WebPort,
+  Params: Params,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/personal/media/audiobookshelf.libsonnet b/k8s/configs/templates/personal/media/audiobookshelf.libsonnet
new file mode 100644
index 0000000..5380724
--- /dev/null
+++ b/k8s/configs/templates/personal/media/audiobookshelf.libsonnet
@@ -0,0 +1,90 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local probe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 30,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local WebPort = 80;
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "audiobookClaimName",
+  "podcastClaimName",
+  "configClaimName",
+  "metadataClaimName",
+]) {
+  labels: {},
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "audiobookshelf",
+    imageName: "ghcr.io/advplyr/audiobookshelf",
+    labels+: $.labels,
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+    env: linuxserver.Env {
+      others: [
+        #kube.NameVal("AUDIOBOOKSHELF_UID", "99"),
+        #kube.NameVal("AUDIOBOOKSHELF_GID", "0"),
+      ]
+    },
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+      },
+    ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "audiobooks",
+        mountPath: "/audiobooks",
+        bindName: $.audiobookClaimName,
+      },
+      linuxserver.Pvc{
+        name: "podcasts",
+        mountPath: "/podcasts",
+        bindName: $.podcastClaimName,
+      },
+      linuxserver.Pvc{
+        name: "config",
+        mountPath: "/config",
+        bindName: $.configClaimName,
+      },
+      linuxserver.Pvc{
+        name: "metadata",
+        mountPath: "/metadata",
+        bindName: $.metadataClaimName,
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "400m",
+        memory: "256Mi",
+      },
+      limits: {
+        cpu: "1500m",
+        memory: "512Mi",
+      },
+    },
+    livenessProbe: probe(/*delaySeconds=*/60),
+    readinessProbe: probe(/*delaySeconds=*/60),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams) {};
+
+{
+  Params: Params,
+  WebPort: WebPort,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/personal/media/bookstack.libsonnet b/k8s/configs/templates/personal/media/bookstack.libsonnet
new file mode 100644
index 0000000..a0d28fc
--- /dev/null
+++ b/k8s/configs/templates/personal/media/bookstack.libsonnet
@@ -0,0 +1,103 @@
+local kube = import "k8s/configs/base.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+
+local WebPort = 80;
+
+local bookstackProbe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 20,
+  httpGet: {
+    path: "/",
+    port: WebPort,
+  },
+};
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "mariaDbUser",
+  "mariaDbDatabase",
+  "mariaDbService",
+  "mariaDbNamespace",
+  "secretName",
+  "secretDbPwdKey",
+  "ingressHost",
+  "configClaimName",
+]) {
+  labels: {},
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "bookstack",
+    imageName: "linuxserver/bookstack",
+    labels+: $.labels,
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    env: linuxserver.Env {
+      others: [
+        kube.NameVal("DB_HOST",
+          $.mariaDbService + "." + $.mariaDbNamespace + ".svc.cluster.local"),
+        kube.NameVal("DB_USERNAME", $.mariaDbUser),
+        kube.NameVal("DB_DATABASE", $.mariaDbDatabase),
+        kube.NameVal("APP_URL", "https://" + $.ingressHost),
+        {
+          name: "DB_PASSWORD",
+          valueFrom: {
+            secretKeyRef: {
+              name: $.secretName,
+              key: $.secretDbPwdKey,
+            }
+          }
+        },
+        {
+          name: "APP_KEY",
+          valueFrom: {
+            secretKeyRef: {
+              name: $.secretName,
+              key: "bookstack-app-key",
+            }
+          }
+        }
+
+      ]
+    },
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+      },
+    ],
+    ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "bookstack-config",
+        mountPath: "/config",
+        bindName: $.configClaimName,
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "100m",
+        memory: "200Mi",
+      },
+      limits: {
+        cpu: "200m",
+        memory: "400Mi",
+      },
+    },
+    livenessProbe: bookstackProbe(/*delaySeconds=*/120),
+    readinessProbe: bookstackProbe(/*delaySeconds=*/120),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams);
+
+{
+  WebPort: WebPort,
+  Params: Params,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/personal/media/freshrss.libsonnet b/k8s/configs/templates/personal/media/freshrss.libsonnet
new file mode 100644
index 0000000..73bd723
--- /dev/null
+++ b/k8s/configs/templates/personal/media/freshrss.libsonnet
@@ -0,0 +1,66 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local probe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 20,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "configClaimName",
+]) {
+  local webPort = 80,
+  labels: {},
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "freshrss",
+    imageName: "linuxserver/freshrss",
+    labels+: $.labels,
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(webPort)
+      },
+    ],
+    ports: [ kube.DeployUtil.ContainerPort("http", webPort), ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "freshrss-config",
+        mountPath: "/config",
+        bindName: $.configClaimName,
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "10m",
+        memory: "500Mi",
+      },
+      limits: {
+        cpu: "400m",
+        memory: "1000Mi",
+      },
+    },
+    livenessProbe: probe(/*delaySeconds=*/60),
+    readinessProbe: probe(/*delaySeconds=*/60),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams) {
+};
+
+{
+  Params: Params,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/personal/media/jellyfin.libsonnet b/k8s/configs/templates/personal/media/jellyfin.libsonnet
new file mode 100644
index 0000000..96260b8
--- /dev/null
+++ b/k8s/configs/templates/personal/media/jellyfin.libsonnet
@@ -0,0 +1,137 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local jellyfinProbe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 5,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local WebPort = 8096;
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "configClaimName",
+  "serialClaimName",
+  "filmClaimName",
+  "transcodeClaimName",
+]) {
+  labels: {},
+  gpuNodeSelectorName: "nvidia",
+  gatekeeperSidecar: null,
+  animeSeriesClaimName: null,
+  animeMovieClaimName: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "jellyfin",
+    imageName: "linuxserver/jellyfin",
+    imagePullSecrets: ["regcred5"],
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    labels+: $.labels,
+    isPrivileged: true,
+    nodeSelector: {
+      "gpu": $.gpuNodeSelectorName,
+    },
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+      },
+    ],
+    env: linuxserver.Env {
+      others: [
+        kube.NameVal("LD_LIBRARY_PATH", "/usr/local/nvidia/lib:/usr/local/nvidia/lib64"),
+        kube.NameVal("NVIDIA_VISIBLE_DEVICES", "all"),
+        kube.NameVal("NVIDIA_DRIVER_CAPABILITIES", "all"),
+        kube.NameVal("JELLYFIN_FFmpeg__probesize", "500000000"),
+        kube.NameVal("JELLYFIN_FFmpeg__analyzeduration", "2000000000"),
+      ]
+    },
+    ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "jellyfin-config",
+        mountPath: "/config",
+        bindName: $.configClaimName,
+      },
+      linuxserver.Pvc{
+        name: "serial-pool",
+        mountPath: "/data/tvshows",
+        bindName: $.serialClaimName,
+      },
+      linuxserver.Pvc{
+        name: "film-pool",
+        mountPath: "/data/movies",
+        bindName: $.filmClaimName,
+      },
+      linuxserver.Pvc{
+        name: "jellyfin-transcode",
+        mountPath: "/transcode",
+        bindName: $.transcodeClaimName,
+      },
+    ] + if $.animeSeriesClaimName == null then [] else [
+      linuxserver.Pvc{
+        name: "anime-series",
+        mountPath: "/data/anime-series",
+        bindName: $.animeSeriesClaimName,
+      },
+    ] + if $.animeMovieClaimName == null then [] else [
+      linuxserver.Pvc{
+        name: "anime-movies",
+        mountPath: "/data/anime-movies",
+        bindName: $.animeMovieClaimName,
+      },
+    ],
+    hostPaths: [
+      linuxserver.HostPath{
+        name: "nvidia-nvidia-uvm",
+        hostPath: "/dev/nvidia-uvm",
+        mountPath: "/dev/nvidia-uvm",
+      },
+      linuxserver.HostPath{
+        name: "nvidia-nvidia0",
+        hostPath: "/dev/nvidia0",
+        mountPath: "/dev/nvidia0",
+      },
+      linuxserver.HostPath{
+        name: "nvidia-nvidiactl",
+        hostPath: "/dev/nvidiactl",
+        mountPath: "/dev/nvidiactl",
+      },
+      linuxserver.HostPath{
+        name: "nvidia-drivers",
+        hostPath: "/opt/nvidia/current/usr",
+        mountPath: "/usr/local/nvidia",
+        readOnly: true,
+      },
+    ],
+    resources: {
+        limits: {
+            cpu: "1000m",
+            memory: "3Gi",
+        },
+        requests: {
+            cpu: "500m",
+            memory: "1Gi",
+        },
+    },
+    livenessProbe: jellyfinProbe(/*delaySeconds=*/60),
+    readinessProbe: jellyfinProbe(/*delaySeconds=*/60),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams);
+
+{
+  WebPort: WebPort,
+  Params: Params,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/personal/media/kiwix.libsonnet b/k8s/configs/templates/personal/media/kiwix.libsonnet
new file mode 100644
index 0000000..73bb957
--- /dev/null
+++ b/k8s/configs/templates/personal/media/kiwix.libsonnet
@@ -0,0 +1,76 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local probe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 30,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local WebPort = 8080;
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "dataClaimName",
+]) {
+  labels: {},
+  mountSubPath: null,
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "kiwix",
+    imageName: "kiwix/kiwix-serve",
+    labels+: $.labels,
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    env: linuxserver.Env {
+      others+: [
+      ],
+    },
+    args: [
+        "*.zim",
+    ],
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+      },
+    ],
+    ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "data",
+        mountPath: "/data",
+        bindName: $.dataClaimName,
+        mountSubPath: $.mountSubPath,
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "150m",
+        memory: "512Mi",
+      },
+      limits: {
+        cpu: "250m",
+        memory: "1Gi",
+      },
+    },
+    livenessProbe: probe(/*delaySeconds=*/20),
+    readinessProbe: probe(/*delaySeconds=*/20),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams);
+
+{
+  Params: Params,
+  WebPort: WebPort,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/personal/media/lurker.libsonnet b/k8s/configs/templates/personal/media/lurker.libsonnet
new file mode 100644
index 0000000..b00c560
--- /dev/null
+++ b/k8s/configs/templates/personal/media/lurker.libsonnet
@@ -0,0 +1,69 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local probe(delaySeconds) = {
+    initialDelaySeconds: delaySeconds,
+    periodSeconds: 30,
+    tcpSocket: {
+        port: "http",
+    },
+};
+
+local WebPort = 3000;
+
+local Params = kube.simpleFieldStruct([
+    "namespace",
+    "name",
+    "filePath",
+    "dataClaimName",
+]) {
+    labels: {},
+    gatekeeperSidecar: null,
+    lsParams: linuxserver.AppParams {
+        name: $.name,
+        namespace: $.namespace,
+        filePath: $.filePath,
+        templatePath: std.thisFile,
+        baseAppName: "lurker",
+        imageName: "ghcr.io/oppiliappan/lurker",
+        labels+: $.labels,
+        gatekeeperSidecar: $.gatekeeperSidecar,
+        env: linuxserver.Env {
+        },
+        services: [
+            linuxserver.Service {
+                suffix: "ui",
+                spec: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+            },
+        ],
+        ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+        pvcs: [
+            linuxserver.Pvc{
+                name: "data",
+                mountPath: "/data",
+                bindName: $.dataClaimName,
+            },
+        ],
+        resources: {
+            requests: {
+                cpu: "500m",
+                memory: "500Mi",
+            },
+            limits: {
+                cpu: "1000m",
+                memory: "1000Mi",
+            },
+        },
+        livenessProbe: probe(/*delaySeconds=*/10),
+        readinessProbe: probe(/*delaySeconds=*/10),
+    },
+};
+
+local App(params) = linuxserver.App(params.lsParams);
+
+{
+    Params: Params,
+    WebPort: WebPort,
+    App(params): App(params),
+}
diff --git a/k8s/configs/templates/personal/media/medusa.libsonnet b/k8s/configs/templates/personal/media/medusa.libsonnet
new file mode 100644
index 0000000..a28f75b
--- /dev/null
+++ b/k8s/configs/templates/personal/media/medusa.libsonnet
@@ -0,0 +1,88 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local medusaProbe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 20,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local WebPort = 8081;
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "configClaimName",
+  "downloadsClaimName",
+  "tvSeriesClaimName",
+  "torrentFilesClaimName",
+]) {
+  labels: {},
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "medusa",
+    imageName: "linuxserver/medusa",
+    labels+: $.labels,
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+      },
+    ],
+    ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "medusa-config",
+        mountPath: "/config",
+        mountSubPath: "medusa",
+        bindName: $.configClaimName,
+      },
+      linuxserver.Pvc{
+        name: "downloads",
+        mountPath: "/downloads",
+        mountSubPath: "out",
+        bindName: $.downloadsClaimName,
+      },
+      linuxserver.Pvc{
+        name: "tv-series",
+        mountPath: "/tv",
+        bindName: $.tvSeriesClaimName,
+      },
+      // NOTE: This needs manual configuration in the UI
+      linuxserver.Pvc{
+        name: "torrent-files",
+        mountPath: "/torrent-files",
+        bindName: $.torrentFilesClaimName,
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "10m",
+        memory: "500Mi",
+      },
+      limits: {
+        cpu: "400m",
+        memory: "1000Mi",
+      },
+    },
+    livenessProbe: medusaProbe(/*delaySeconds=*/60),
+    readinessProbe: medusaProbe(/*delaySeconds=*/60),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams);
+
+{
+  WebPort: WebPort,
+  Params: Params,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/personal/media/overseerr.libsonnet b/k8s/configs/templates/personal/media/overseerr.libsonnet
new file mode 100644
index 0000000..9db8b2d
--- /dev/null
+++ b/k8s/configs/templates/personal/media/overseerr.libsonnet
@@ -0,0 +1,69 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local probe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 30,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local WebPort = 5055;
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "configClaimName",
+]) {
+  labels: {},
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "overseerr",
+    imageName: "linuxserver/overseerr",
+    labels+: $.labels,
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+      },
+    ],
+    ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "config",
+        mountPath: "/app/config",
+        bindName: $.configClaimName,
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "50m",
+        memory: "256Mi",
+      },
+      limits: {
+        cpu: "200m",
+        memory: "512Mi",
+      },
+    },
+    livenessProbe: probe(/*delaySeconds=*/20),
+    readinessProbe: probe(/*delaySeconds=*/20),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams) {
+};
+
+
+{
+  Params: Params,
+  WebPort: WebPort,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/personal/media/radarr.libsonnet b/k8s/configs/templates/personal/media/radarr.libsonnet
new file mode 100644
index 0000000..89cf833
--- /dev/null
+++ b/k8s/configs/templates/personal/media/radarr.libsonnet
@@ -0,0 +1,82 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local probe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 15,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local WebPort = 7878;
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "configClaimName",
+  "moviesClaimName",
+  "downloadsClaimName",
+  "downloadsSubdirectory",
+]) {
+  labels: {},
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "radarr",
+    imageName: "linuxserver/radarr",
+    labels+: $.labels,
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+      },
+    ],
+    ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "config",
+        mountPath: "/config",
+        bindName: $.configClaimName,
+      },
+      linuxserver.Pvc{
+        name: "movies",
+        mountPath: "/movies",
+        bindName: $.moviesClaimName,
+      },
+      // NOTE: This needs manual configuration in the UI
+      linuxserver.Pvc{
+        name: "downloads",
+        mountPath: "/downloads",
+        bindName: $.downloadsClaimName,
+        mountSubPath: $.downloadsSubdirectory
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "50m",
+        memory: "500Mi",
+      },
+      limits: {
+        cpu: "100m",
+        memory: "1000Mi",
+      },
+    },
+    livenessProbe: probe(/*delaySeconds=*/120),
+    readinessProbe: probe(/*delaySeconds=*/120),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams);
+
+{
+  WebPort: WebPort,
+  Params: Params,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/personal/media/readarr.libsonnet b/k8s/configs/templates/personal/media/readarr.libsonnet
new file mode 100644
index 0000000..c59f3bf
--- /dev/null
+++ b/k8s/configs/templates/personal/media/readarr.libsonnet
@@ -0,0 +1,82 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet"; 
+
+local probe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 15,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local WebPort = 8787;
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "configClaimName",
+  "booksClaimName",
+  "downloadsClaimName",
+  "downloadsSubdirectory",
+]) {
+  labels: {},
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "readarr",
+    imageName: "linuxserver/readarr",
+    labels+: $.labels,
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+      },
+    ],
+    ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "config",
+        mountPath: "/config",
+        bindName: $.configClaimName,
+      },
+      linuxserver.Pvc{
+        name: "books",
+        mountPath: "/books",
+        bindName: $.booksClaimName,
+      },
+      // NOTE: This needs manual configuration in the UI
+      linuxserver.Pvc{
+        name: "downloads",
+        mountPath: "/downloads",
+        bindName: $.downloadsClaimName,
+        mountSubPath: $.downloadsSubdirectory
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "300m",
+        memory: "500Mi",
+      },
+      limits: {
+        cpu: "800m",
+        memory: "1500Mi",
+      },
+    },
+    livenessProbe: probe(/*delaySeconds=*/60),
+    readinessProbe: probe(/*delaySeconds=*/60),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams);
+
+{
+  WebPort: WebPort,
+  Params: Params,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/personal/media/sabnzbd.libsonnet b/k8s/configs/templates/personal/media/sabnzbd.libsonnet
new file mode 100644
index 0000000..b59aba5
--- /dev/null
+++ b/k8s/configs/templates/personal/media/sabnzbd.libsonnet
@@ -0,0 +1,80 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet";
+
+local probe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 15,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local WebPort = 8080;
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "configClaimName",
+  "incompleteDownloadsClaimName",
+  "downloadsClaimName",
+]) {
+  #local httpsWebPort = 9090,
+  labels: {},
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "sabnzbd",
+    imageName: "linuxserver/sabnzbd",
+    labels+: $.labels,
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+      },
+    ],
+    ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "config",
+        mountPath: "/config",
+        bindName: $.configClaimName,
+      },
+      linuxserver.Pvc{
+        name: "incomplete-downloads",
+        mountPath: "/incomplete-downloads",
+        bindName: $.incompleteDownloadsClaimName,
+      },
+      linuxserver.Pvc{
+        name: "downloads",
+        mountPath: "/downloads",
+        bindName: $.downloadsClaimName,
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "100m",
+        memory: "1024Mi",
+      },
+      limits: {
+        cpu: "400m",
+        memory: "2024Mi",
+      },
+    },
+    livenessProbe: probe(/*delaySeconds=*/120),
+    readinessProbe: probe(/*delaySeconds=*/120),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams);
+
+{
+  WebPort: WebPort,
+  Params: Params,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/personal/media/sonarr.libsonnet b/k8s/configs/templates/personal/media/sonarr.libsonnet
new file mode 100644
index 0000000..0604008
--- /dev/null
+++ b/k8s/configs/templates/personal/media/sonarr.libsonnet
@@ -0,0 +1,82 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+local images = import "k8s/configs/images.libsonnet"; 
+
+local probe(delaySeconds) = {
+  initialDelaySeconds: delaySeconds,
+  periodSeconds: 15,
+  tcpSocket: {
+    port: "http",
+  },
+};
+
+local WebPort = 8989;
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "configClaimName",
+  "tvSeriesClaimName",
+  "downloadsClaimName",
+  "downloadsSubdirectory",
+]) {
+  labels: {},
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "sonarr",
+    imageName: "linuxserver/sonarr",
+    labels+: $.labels,
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+      },
+    ],
+    ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "config",
+        mountPath: "/config",
+        bindName: $.configClaimName,
+      },
+      linuxserver.Pvc{
+        name: "tv-series",
+        mountPath: "/tv",
+        bindName: $.tvSeriesClaimName,
+      },
+      // NOTE: This needs manual configuration in the UI
+      linuxserver.Pvc{
+        name: "downloads",
+        mountPath: "/downloads",
+        bindName: $.downloadsClaimName,
+        mountSubPath: $.downloadsSubdirectory
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "300m",
+        memory: "500Mi",
+      },
+      limits: {
+        cpu: "800m",
+        memory: "1500Mi",
+      },
+    },
+    livenessProbe: probe(/*delaySeconds=*/60),
+    readinessProbe: probe(/*delaySeconds=*/60),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams);
+
+{
+  WebPort: WebPort,
+  Params: Params,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/personal/media/transmission.libsonnet b/k8s/configs/templates/personal/media/transmission.libsonnet
new file mode 100644
index 0000000..738eff9
--- /dev/null
+++ b/k8s/configs/templates/personal/media/transmission.libsonnet
@@ -0,0 +1,95 @@
+local kube = import "k8s/configs/base.libsonnet";
+local linuxserver = import "k8s/configs/templates/core/linuxserver.libsonnet";
+
+local WebPort = 9091;
+
+local transmissionProbe(delaySeconds) = {
+  httpGet: {
+    path: "/",
+    port: WebPort,
+  },
+  initialDelaySeconds: delaySeconds,
+};
+
+local Params = kube.simpleFieldStruct([
+  "namespace",
+  "name",
+  "filePath",
+  "configClaimName",
+  "torrentFilesClaimName",
+  "incompleteDownloadsClaimName",
+  "downloadsClaimName",
+  "dataNodePort",
+]) {
+  local dataInternalPort = 51413,
+  labels: {},
+  gatekeeperSidecar: null,
+  lsParams: linuxserver.AppParams {
+    name: $.name,
+    namespace: $.namespace,
+    filePath: $.filePath,
+    templatePath: std.thisFile,
+    baseAppName: "transmission",
+    imageName: "linuxserver/transmission",
+    gatekeeperSidecar: $.gatekeeperSidecar,
+    labels+: $.labels,
+    env: linuxserver.Env {
+      others: [
+        kube.NameVal("S6_KILL_FINISH_MAXTIME", "100000"),
+      ]
+    },
+    services: [
+      linuxserver.Service {
+        suffix: "ui",
+        spec: kube.SvcUtil.BasicHttpClusterIpSpec(WebPort)
+      },
+      linuxserver.Service {
+        suffix: "data",
+        spec: kube.SvcUtil.BasicNodePortSpec(dataInternalPort, $.dataNodePort),
+      },
+    ],
+    ports: [ kube.DeployUtil.ContainerPort("http", WebPort), ],
+    pvcs: [
+      linuxserver.Pvc{
+        name: "config",
+        mountPath: "/config",
+        bindName: $.configClaimName
+      },
+      linuxserver.Pvc{
+        name: "incomplete",
+        mountPath: "/downloads/incomplete",
+        bindName: $.incompleteDownloadsClaimName,
+      },
+      linuxserver.Pvc{
+        name: "downloads",
+        mountPath: "/downloads/complete",
+        bindName: $.downloadsClaimName,
+      },
+      linuxserver.Pvc{
+        name: "torrent-files",
+        mountPath: "/watch",
+        bindName: $.torrentFilesClaimName
+      },
+    ],
+    resources: {
+      requests: {
+        cpu: "250m",
+        memory: "1000Mi",
+      },
+      limits: {
+        cpu: "500m",
+        memory: "2000Mi",
+      },
+    },
+    livenessProbe: transmissionProbe(/*delaySeconds=*/360),
+    readinessProbe: transmissionProbe(/*delaySeconds=*/120),
+  },
+};
+
+local App(params) = linuxserver.App(params.lsParams);
+
+{
+  WebPort: WebPort,
+  Params: Params,
+  App(params): App(params),
+}
diff --git a/k8s/configs/templates/templates.libsonnet b/k8s/configs/templates/templates.libsonnet
new file mode 100644
index 0000000..6cb1c52
--- /dev/null
+++ b/k8s/configs/templates/templates.libsonnet
@@ -0,0 +1,8 @@
+local kube = import "k8s/configs/base.libsonnet";
+
+{
+  annotations(filePath, templatePath): {
+    "infra.workspacePath": kube.asWorkspacePath(filePath),
+    "infra.templates.workspacePath": kube.asWorkspacePath(templatePath),
+  },
+}
diff --git a/k8s/container/BUILD.bazel b/k8s/container/BUILD.bazel
new file mode 100644
index 0000000..33a3b98
--- /dev/null
+++ b/k8s/container/BUILD.bazel
@@ -0,0 +1,41 @@
+package(default_visibility = ["//container:__subpackages__"])
+
+platform(
+    name = "linux_arm64",
+    constraint_values = [
+        "@platforms//os:linux",
+        "@platforms//cpu:arm64",
+    ],
+)
+
+platform(
+    name = "linux_amd64",
+    constraint_values = [
+        "@platforms//os:linux",
+        "@platforms//cpu:x86_64",
+    ],
+)
+
+config_setting(
+    name = "platform_darwin_arm64",
+    constraint_values = [
+        "@platforms//os:macos",
+        "@platforms//cpu:arm64",
+    ],
+)
+
+config_setting(
+    name = "platform_darwin_amd64",
+    constraint_values = [
+        "@platforms//os:macos",
+        "@platforms//cpu:x86_64",
+    ],
+)
+
+config_setting(
+    name = "platform_linux_amd64",
+    constraint_values = [
+        "@platforms//os:linux",
+        "@platforms//cpu:x86_64",
+    ],
+)
diff --git a/k8s/container/README.md b/k8s/container/README.md
new file mode 100644
index 0000000..2f79b07
--- /dev/null
+++ b/k8s/container/README.md
@@ -0,0 +1,3 @@
+# container
+
+This directory contains build rules and related assets for building container images to run on the Kubernetes cluster.
\ No newline at end of file
diff --git a/k8s/container/coder-dev-base-image/BUILD.bazel b/k8s/container/coder-dev-base-image/BUILD.bazel
new file mode 100644
index 0000000..ccf97d8
--- /dev/null
+++ b/k8s/container/coder-dev-base-image/BUILD.bazel
@@ -0,0 +1,124 @@
+load("@aspect_bazel_lib//lib:tar.bzl", "tar")
+load("@container_structure_test//:defs.bzl", "container_structure_test")
+load("@rules_distroless//distroless:defs.bzl", "group", "passwd")
+load("@rules_oci//oci:defs.bzl", "oci_image", "oci_load", "oci_push")
+load("@rules_pkg//:pkg.bzl", "pkg_tar")
+
+COMPATIBLE_WITH = select({
+    "@platforms//cpu:x86_64": ["@platforms//cpu:x86_64"],
+    "@platforms//cpu:arm64": ["@platforms//cpu:arm64"],
+}) + [
+    "@platforms//os:linux",
+]
+
+genrule(
+    name = "copy_bazelisk",
+    srcs = select({
+        "@platforms//cpu:arm64": ["@bazelisk_linux_arm64//file"],
+        "//conditions:default": ["@bazelisk_linux_amd64//file"],
+    }),
+    outs = ["bazel"],
+    cmd = "cp $(SRCS) $(OUTS)",
+)
+
+pkg_tar(
+    name = "bazelisk_tar",
+    srcs = [":copy_bazelisk"],
+    mode = "0755",
+    package_dir = "/usr/bin",
+)
+
+passwd(
+    name = "passwd",
+    entries = [
+        {
+            "uid": 0,
+            "gid": 0,
+            "home": "/root",
+            "shell": "/bin/bash",
+            "username": "r00t",
+        },
+        {
+            "uid": 100,
+            "gid": 65534,
+            "home": "/home/_apt",
+            "shell": "/usr/sbin/nologin",
+            "username": "_apt",
+        },
+    ],
+)
+
+group(
+    name = "group",
+    entries = [
+        {
+            "name": "root",
+            "gid": 0,
+        },
+        {
+            "name": "_apt",
+            "gid": 65534,
+        },
+    ],
+)
+
+tar(
+    name = "sh",
+    mtree = [
+        # needed as dpkg assumes sh is installed in a typical debian installation.
+        "./bin/sh type=link link=/bin/bash",
+    ],
+)
+
+oci_image(
+    name = "noble",
+    architecture = select({
+        "@platforms//cpu:arm64": "arm64",
+        "@platforms//cpu:x86_64": "amd64",
+    }),
+    os = "linux",
+    tags = ["manual"],
+    # NOTE: this is needed because, otherwise, bazel test //... fails, even
+    # when container_structure_test already has target_compatible_with.
+    # See 136
+    target_compatible_with = COMPATIBLE_WITH,
+    tars = [
+        "@noble//:noble",
+        ":sh",
+        ":passwd",
+        ":group",
+        ":bazelisk_tar",
+    ],
+    visibility = ["//visibility:public"],
+)
+
+oci_load(
+    name = "tarball",
+    image = ":noble",
+    repo_tags = [
+        "distroless/noble:latest",
+    ],
+    tags = ["manual"],
+    # NOTE: this is needed because, otherwise, bazel test //... fails, even
+    # when container_structure_test already has target_compatible_with.
+    # See 136
+    target_compatible_with = COMPATIBLE_WITH,
+)
+
+container_structure_test(
+    name = "test",
+    configs = select({
+        "@platforms//cpu:arm64": ["test_linux_arm64.yaml"],
+        "@platforms//cpu:x86_64": ["test_linux_amd64.yaml"],
+    }),
+    image = ":noble",
+    tags = ["manual"],
+    target_compatible_with = COMPATIBLE_WITH,
+)
+
+oci_push(
+    name = "push",
+    image = ":noble",
+    remote_tags = ["5"],
+    repository = "forgejo.csbx.dev/acmcarther/coder-dev-base-image",
+)
diff --git a/k8s/container/coder-dev-base-image/noble.lock.json b/k8s/container/coder-dev-base-image/noble.lock.json
new file mode 100644
index 0000000..466ecc1
--- /dev/null
+++ b/k8s/container/coder-dev-base-image/noble.lock.json
@@ -0,0 +1,4078 @@
+{
+	"packages": [
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "ncurses-base_6.4-p-20240113-1ubuntu1_amd64",
+			"name": "ncurses-base",
+			"sha256": "1ea2be0cadf1299e5ed2967269c01e1935ddf5a733a496893b4334994aea2755",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/n/ncurses/ncurses-base_6.4+20240113-1ubuntu1_all.deb"
+			],
+			"version": "6.4+20240113-1ubuntu1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [
+				{
+					"key": "libc6_2.39-0ubuntu2_amd64",
+					"name": "libc6",
+					"version": "2.39-0ubuntu2"
+				},
+				{
+					"key": "libgcc-s1_14-20240221-2.1ubuntu1_amd64",
+					"name": "libgcc-s1",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "gcc-14-base_14-20240221-2.1ubuntu1_amd64",
+					"name": "gcc-14-base",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "libtinfo6_6.4-p-20240113-1ubuntu1_amd64",
+					"name": "libtinfo6",
+					"version": "6.4+20240113-1ubuntu1"
+				}
+			],
+			"key": "libncurses6_6.4-p-20240113-1ubuntu1_amd64",
+			"name": "libncurses6",
+			"sha256": "b5669082396328597c62e51caeb2ee258015e92bd87f6670acee9f396a30b978",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/n/ncurses/libncurses6_6.4+20240113-1ubuntu1_amd64.deb"
+			],
+			"version": "6.4+20240113-1ubuntu1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libc6_2.39-0ubuntu2_amd64",
+			"name": "libc6",
+			"sha256": "4bd128b75db38b7e9147c0333908e2c7fbc41631f284360f95118fe1c6c162f3",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/g/glibc/libc6_2.39-0ubuntu2_amd64.deb"
+			],
+			"version": "2.39-0ubuntu2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libgcc-s1_14-20240221-2.1ubuntu1_amd64",
+			"name": "libgcc-s1",
+			"sha256": "ffc195df7e897aaec468e8f62b08660cc711c7449113102491fdd6baa6901f6d",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/g/gcc-14/libgcc-s1_14-20240221-2.1ubuntu1_amd64.deb"
+			],
+			"version": "14-20240221-2.1ubuntu1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "gcc-14-base_14-20240221-2.1ubuntu1_amd64",
+			"name": "gcc-14-base",
+			"sha256": "2e1ae2c2ccf2d1b6d09c657af1492a8b7a348e899f9ad25d4925b170571a0887",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/g/gcc-14/gcc-14-base_14-20240221-2.1ubuntu1_amd64.deb"
+			],
+			"version": "14-20240221-2.1ubuntu1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libtinfo6_6.4-p-20240113-1ubuntu1_amd64",
+			"name": "libtinfo6",
+			"sha256": "80378382ba4f672f8d5579cb953fc43edfe246eb96ee4d453af1ac3d7768c8aa",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/n/ncurses/libtinfo6_6.4+20240113-1ubuntu1_amd64.deb"
+			],
+			"version": "6.4+20240113-1ubuntu1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [
+				{
+					"key": "debconf_1.5.86_amd64",
+					"name": "debconf",
+					"version": "1.5.86"
+				}
+			],
+			"key": "tzdata_2024a-1ubuntu1_amd64",
+			"name": "tzdata",
+			"sha256": "26cdb43f541d5b7d089d2c1cf7d50b4c5e630c79a6d4d6ce34e20dcace4f0d29",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/t/tzdata/tzdata_2024a-1ubuntu1_all.deb"
+			],
+			"version": "2024a-1ubuntu1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "debconf_1.5.86_amd64",
+			"name": "debconf",
+			"sha256": "725da1e474ff8ce916e7954ed262273a02e4f74ee1f6cd342b19ff283617d91b",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/d/debconf/debconf_1.5.86_all.deb"
+			],
+			"version": "1.5.86"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [
+				{
+					"key": "debianutils_5.16_amd64",
+					"name": "debianutils",
+					"version": "5.16"
+				},
+				{
+					"key": "libc6_2.39-0ubuntu2_amd64",
+					"name": "libc6",
+					"version": "2.39-0ubuntu2"
+				},
+				{
+					"key": "libgcc-s1_14-20240221-2.1ubuntu1_amd64",
+					"name": "libgcc-s1",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "gcc-14-base_14-20240221-2.1ubuntu1_amd64",
+					"name": "gcc-14-base",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "base-files_13ubuntu7_amd64",
+					"name": "base-files",
+					"version": "13ubuntu7"
+				},
+				{
+					"key": "libcrypt1_1-4.4.36-4_amd64",
+					"name": "libcrypt1",
+					"version": "1:4.4.36-4"
+				},
+				{
+					"key": "mawk_1.3.4.20240123-1_amd64",
+					"name": "mawk",
+					"version": "1.3.4.20240123-1"
+				},
+				{
+					"key": "libtinfo6_6.4-p-20240113-1ubuntu1_amd64",
+					"name": "libtinfo6",
+					"version": "6.4+20240113-1ubuntu1"
+				}
+			],
+			"key": "bash_5.2.21-2ubuntu2_amd64",
+			"name": "bash",
+			"sha256": "ad21b2dbc6991a08c62e519d920a326f23f3ee2a0ac91c6c448978595d5ae685",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/b/bash/bash_5.2.21-2ubuntu2_amd64.deb"
+			],
+			"version": "5.2.21-2ubuntu2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "debianutils_5.16_amd64",
+			"name": "debianutils",
+			"sha256": "b1c3597e81831cf3d37cf84f06afaf05d90a55d717f643cead55fe4b223cc04a",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/d/debianutils/debianutils_5.16_amd64.deb"
+			],
+			"version": "5.16"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "base-files_13ubuntu7_amd64",
+			"name": "base-files",
+			"sha256": "d2fe9680dea0b8f6d6d675eceaf2bf00da8d1b3da1604f0e3b47ee26866feadd",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/b/base-files/base-files_13ubuntu7_amd64.deb"
+			],
+			"version": "13ubuntu7"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libcrypt1_1-4.4.36-4_amd64",
+			"name": "libcrypt1",
+			"sha256": "51ad101808e6a9d6b9c21bcf0b6f27c8ab34f6af53184fc6305f96770cc3a8d9",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libx/libxcrypt/libcrypt1_4.4.36-4_amd64.deb"
+			],
+			"version": "1:4.4.36-4"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "mawk_1.3.4.20240123-1_amd64",
+			"name": "mawk",
+			"sha256": "53512ca310cc01f4a462753a29dd7a1180f2e584941f9d8477c77802b1cff1f8",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/m/mawk/mawk_1.3.4.20240123-1_amd64.deb"
+			],
+			"version": "1.3.4.20240123-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [
+				{
+					"key": "libssl3_3.0.10-1ubuntu4_amd64",
+					"name": "libssl3",
+					"version": "3.0.10-1ubuntu4"
+				},
+				{
+					"key": "libc6_2.39-0ubuntu2_amd64",
+					"name": "libc6",
+					"version": "2.39-0ubuntu2"
+				},
+				{
+					"key": "libgcc-s1_14-20240221-2.1ubuntu1_amd64",
+					"name": "libgcc-s1",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "gcc-14-base_14-20240221-2.1ubuntu1_amd64",
+					"name": "gcc-14-base",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "libselinux1_3.5-2build1_amd64",
+					"name": "libselinux1",
+					"version": "3.5-2build1"
+				},
+				{
+					"key": "libpcre2-8-0_10.42-4ubuntu1_amd64",
+					"name": "libpcre2-8-0",
+					"version": "10.42-4ubuntu1"
+				},
+				{
+					"key": "libgmp10_2-6.3.0-p-dfsg-2ubuntu4_amd64",
+					"name": "libgmp10",
+					"version": "2:6.3.0+dfsg-2ubuntu4"
+				},
+				{
+					"key": "libattr1_1-2.5.2-1_amd64",
+					"name": "libattr1",
+					"version": "1:2.5.2-1"
+				},
+				{
+					"key": "libacl1_2.3.2-1_amd64",
+					"name": "libacl1",
+					"version": "2.3.2-1"
+				}
+			],
+			"key": "coreutils_9.4-2ubuntu4_amd64",
+			"name": "coreutils",
+			"sha256": "12f958744332b290cb5d577cb5304c09f5fceddc776a2ea29329c1cca2628567",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/c/coreutils/coreutils_9.4-2ubuntu4_amd64.deb"
+			],
+			"version": "9.4-2ubuntu4"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libssl3_3.0.10-1ubuntu4_amd64",
+			"name": "libssl3",
+			"sha256": "8228c52b80fc7c39619b4d2246a0fd9beb838272c848fc9718062af7102324a6",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/o/openssl/libssl3_3.0.10-1ubuntu4_amd64.deb"
+			],
+			"version": "3.0.10-1ubuntu4"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libselinux1_3.5-2build1_amd64",
+			"name": "libselinux1",
+			"sha256": "139f29430e3d265fc8d9b9da7dd3f704ee3f1838c37a5d512cf265ec0b4eba28",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libs/libselinux/libselinux1_3.5-2build1_amd64.deb"
+			],
+			"version": "3.5-2build1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libpcre2-8-0_10.42-4ubuntu1_amd64",
+			"name": "libpcre2-8-0",
+			"sha256": "3fbf30adf862c4e510a9260c7666a1a5326bc5fed8021090bc75a4ecbaa52fa4",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/p/pcre2/libpcre2-8-0_10.42-4ubuntu1_amd64.deb"
+			],
+			"version": "10.42-4ubuntu1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libgmp10_2-6.3.0-p-dfsg-2ubuntu4_amd64",
+			"name": "libgmp10",
+			"sha256": "b0ede0faa0154c946ad5602e0d613b3266ff6ade089b0e939f23ad6e43964872",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/g/gmp/libgmp10_6.3.0+dfsg-2ubuntu4_amd64.deb"
+			],
+			"version": "2:6.3.0+dfsg-2ubuntu4"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libattr1_1-2.5.2-1_amd64",
+			"name": "libattr1",
+			"sha256": "38dbd3d90e88529f6f6e97f5564f333e38db8d20a704c7e8f484ed8705767382",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/a/attr/libattr1_2.5.2-1_amd64.deb"
+			],
+			"version": "1:2.5.2-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libacl1_2.3.2-1_amd64",
+			"name": "libacl1",
+			"sha256": "275cc58e50e49b8226f1ca705ac79bea3997b6e15b59e76cd2ade7d753a9298f",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/a/acl/libacl1_2.3.2-1_amd64.deb"
+			],
+			"version": "2.3.2-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [
+				{
+					"key": "libpcre2-8-0_10.42-4ubuntu1_amd64",
+					"name": "libpcre2-8-0",
+					"version": "10.42-4ubuntu1"
+				},
+				{
+					"key": "libc6_2.39-0ubuntu2_amd64",
+					"name": "libc6",
+					"version": "2.39-0ubuntu2"
+				},
+				{
+					"key": "libgcc-s1_14-20240221-2.1ubuntu1_amd64",
+					"name": "libgcc-s1",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "gcc-14-base_14-20240221-2.1ubuntu1_amd64",
+					"name": "gcc-14-base",
+					"version": "14-20240221-2.1ubuntu1"
+				}
+			],
+			"key": "grep_3.11-4_amd64",
+			"name": "grep",
+			"sha256": "300247caf38c19f88f8ddf27abb2111cbd39a7364e9706fa0d53b15dc7dae866",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/g/grep/grep_3.11-4_amd64.deb"
+			],
+			"version": "3.11-4"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [
+				{
+					"key": "tar_1.35-p-dfsg-3_amd64",
+					"name": "tar",
+					"version": "1.35+dfsg-3"
+				},
+				{
+					"key": "libselinux1_3.5-2build1_amd64",
+					"name": "libselinux1",
+					"version": "3.5-2build1"
+				},
+				{
+					"key": "libpcre2-8-0_10.42-4ubuntu1_amd64",
+					"name": "libpcre2-8-0",
+					"version": "10.42-4ubuntu1"
+				},
+				{
+					"key": "libc6_2.39-0ubuntu2_amd64",
+					"name": "libc6",
+					"version": "2.39-0ubuntu2"
+				},
+				{
+					"key": "libgcc-s1_14-20240221-2.1ubuntu1_amd64",
+					"name": "libgcc-s1",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "gcc-14-base_14-20240221-2.1ubuntu1_amd64",
+					"name": "gcc-14-base",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "libacl1_2.3.2-1_amd64",
+					"name": "libacl1",
+					"version": "2.3.2-1"
+				},
+				{
+					"key": "zlib1g_1-1.3.dfsg-3ubuntu1_amd64",
+					"name": "zlib1g",
+					"version": "1:1.3.dfsg-3ubuntu1"
+				},
+				{
+					"key": "libzstd1_1.5.5-p-dfsg2-2_amd64",
+					"name": "libzstd1",
+					"version": "1.5.5+dfsg2-2"
+				},
+				{
+					"key": "libmd0_1.1.0-2_amd64",
+					"name": "libmd0",
+					"version": "1.1.0-2"
+				},
+				{
+					"key": "liblzma5_5.4.5-0.3_amd64",
+					"name": "liblzma5",
+					"version": "5.4.5-0.3"
+				},
+				{
+					"key": "libbz2-1.0_1.0.8-5ubuntu1_amd64",
+					"name": "libbz2-1.0",
+					"version": "1.0.8-5ubuntu1"
+				}
+			],
+			"key": "dpkg_1.22.4ubuntu5_amd64",
+			"name": "dpkg",
+			"sha256": "15b3fa045cb0ab82682aa581219d24a6dd7e74dd0dd5c03b35a5278eab1ec2fa",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/d/dpkg/dpkg_1.22.4ubuntu5_amd64.deb"
+			],
+			"version": "1.22.4ubuntu5"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "tar_1.35-p-dfsg-3_amd64",
+			"name": "tar",
+			"sha256": "2fa676173c0076f59e423bd82d2ac00eba7c51fa1ae8903f09b88270b1c560ba",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/t/tar/tar_1.35+dfsg-3_amd64.deb"
+			],
+			"version": "1.35+dfsg-3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "zlib1g_1-1.3.dfsg-3ubuntu1_amd64",
+			"name": "zlib1g",
+			"sha256": "35cfe44912765862374112e83c178c095448f247785772147c42c0c843b67c97",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/z/zlib/zlib1g_1.3.dfsg-3ubuntu1_amd64.deb"
+			],
+			"version": "1:1.3.dfsg-3ubuntu1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libzstd1_1.5.5-p-dfsg2-2_amd64",
+			"name": "libzstd1",
+			"sha256": "7926bb8267652dd7df2c78c5e7541df6e62dbc10ed2efd4c2b869c75538b2ff1",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libz/libzstd/libzstd1_1.5.5+dfsg2-2_amd64.deb"
+			],
+			"version": "1.5.5+dfsg2-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libmd0_1.1.0-2_amd64",
+			"name": "libmd0",
+			"sha256": "128be9909c4ce8f2126e5f3d1a04fc11510c519409d64d324d724aae8347cd13",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libm/libmd/libmd0_1.1.0-2_amd64.deb"
+			],
+			"version": "1.1.0-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "liblzma5_5.4.5-0.3_amd64",
+			"name": "liblzma5",
+			"sha256": "02bb3148ccfa7408b3f12833aa483c2dd4e3a6ee647fe8bbc3bc60ef50761ead",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/x/xz-utils/liblzma5_5.4.5-0.3_amd64.deb"
+			],
+			"version": "5.4.5-0.3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libbz2-1.0_1.0.8-5ubuntu1_amd64",
+			"name": "libbz2-1.0",
+			"sha256": "8925b88fac7e8162a5c9dfcb078bb33932cb8aee51bb33db209ca97840f65369",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/b/bzip2/libbz2-1.0_1.0.8-5ubuntu1_amd64.deb"
+			],
+			"version": "1.0.8-5ubuntu1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [
+				{
+					"key": "libsystemd0_255.2-3ubuntu2_amd64",
+					"name": "libsystemd0",
+					"version": "255.2-3ubuntu2"
+				},
+				{
+					"key": "libzstd1_1.5.5-p-dfsg2-2_amd64",
+					"name": "libzstd1",
+					"version": "1.5.5+dfsg2-2"
+				},
+				{
+					"key": "libc6_2.39-0ubuntu2_amd64",
+					"name": "libc6",
+					"version": "2.39-0ubuntu2"
+				},
+				{
+					"key": "libgcc-s1_14-20240221-2.1ubuntu1_amd64",
+					"name": "libgcc-s1",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "gcc-14-base_14-20240221-2.1ubuntu1_amd64",
+					"name": "gcc-14-base",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "liblzma5_5.4.5-0.3_amd64",
+					"name": "liblzma5",
+					"version": "5.4.5-0.3"
+				},
+				{
+					"key": "liblz4-1_1.9.4-1_amd64",
+					"name": "liblz4-1",
+					"version": "1.9.4-1"
+				},
+				{
+					"key": "libgcrypt20_1.10.3-2_amd64",
+					"name": "libgcrypt20",
+					"version": "1.10.3-2"
+				},
+				{
+					"key": "libgpg-error0_1.47-3build1_amd64",
+					"name": "libgpg-error0",
+					"version": "1.47-3build1"
+				},
+				{
+					"key": "libcap2_1-2.66-5ubuntu1_amd64",
+					"name": "libcap2",
+					"version": "1:2.66-5ubuntu1"
+				},
+				{
+					"key": "libstdc-p--p-6_14-20240221-2.1ubuntu1_amd64",
+					"name": "libstdc++6",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "libseccomp2_2.5.5-1ubuntu1_amd64",
+					"name": "libseccomp2",
+					"version": "2.5.5-1ubuntu1"
+				},
+				{
+					"key": "libgnutls30_3.8.3-1ubuntu1_amd64",
+					"name": "libgnutls30",
+					"version": "3.8.3-1ubuntu1"
+				},
+				{
+					"key": "libunistring5_1.1-2_amd64",
+					"name": "libunistring5",
+					"version": "1.1-2"
+				},
+				{
+					"key": "libtasn1-6_4.19.0-3_amd64",
+					"name": "libtasn1-6",
+					"version": "4.19.0-3"
+				},
+				{
+					"key": "libp11-kit0_0.25.3-4ubuntu1_amd64",
+					"name": "libp11-kit0",
+					"version": "0.25.3-4ubuntu1"
+				},
+				{
+					"key": "libffi8_3.4.6-1_amd64",
+					"name": "libffi8",
+					"version": "3.4.6-1"
+				},
+				{
+					"key": "libnettle8_3.9.1-2_amd64",
+					"name": "libnettle8",
+					"version": "3.9.1-2"
+				},
+				{
+					"key": "libidn2-0_2.3.7-2_amd64",
+					"name": "libidn2-0",
+					"version": "2.3.7-2"
+				},
+				{
+					"key": "libhogweed6_3.9.1-2_amd64",
+					"name": "libhogweed6",
+					"version": "3.9.1-2"
+				},
+				{
+					"key": "libgmp10_2-6.3.0-p-dfsg-2ubuntu4_amd64",
+					"name": "libgmp10",
+					"version": "2:6.3.0+dfsg-2ubuntu4"
+				},
+				{
+					"key": "ubuntu-keyring_2023.11.28.1_amd64",
+					"name": "ubuntu-keyring",
+					"version": "2023.11.28.1"
+				},
+				{
+					"key": "libapt-pkg6.0_2.7.12_amd64",
+					"name": "libapt-pkg6.0",
+					"version": "2.7.12"
+				},
+				{
+					"key": "zlib1g_1-1.3.dfsg-3ubuntu1_amd64",
+					"name": "zlib1g",
+					"version": "1:1.3.dfsg-3ubuntu1"
+				},
+				{
+					"key": "libxxhash0_0.8.2-2_amd64",
+					"name": "libxxhash0",
+					"version": "0.8.2-2"
+				},
+				{
+					"key": "libudev1_255.2-3ubuntu2_amd64",
+					"name": "libudev1",
+					"version": "255.2-3ubuntu2"
+				},
+				{
+					"key": "libbz2-1.0_1.0.8-5ubuntu1_amd64",
+					"name": "libbz2-1.0",
+					"version": "1.0.8-5ubuntu1"
+				},
+				{
+					"key": "gpgv_2.4.4-2ubuntu7_amd64",
+					"name": "gpgv",
+					"version": "2.4.4-2ubuntu7"
+				},
+				{
+					"key": "libnpth0_1.6-3build2_amd64",
+					"name": "libnpth0",
+					"version": "1.6-3build2"
+				},
+				{
+					"key": "libassuan0_2.5.6-1_amd64",
+					"name": "libassuan0",
+					"version": "2.5.6-1"
+				},
+				{
+					"key": "base-passwd_3.6.3_amd64",
+					"name": "base-passwd",
+					"version": "3.6.3"
+				},
+				{
+					"key": "libselinux1_3.5-2build1_amd64",
+					"name": "libselinux1",
+					"version": "3.5-2build1"
+				},
+				{
+					"key": "libpcre2-8-0_10.42-4ubuntu1_amd64",
+					"name": "libpcre2-8-0",
+					"version": "10.42-4ubuntu1"
+				},
+				{
+					"key": "libdebconfclient0_0.271ubuntu1_amd64",
+					"name": "libdebconfclient0",
+					"version": "0.271ubuntu1"
+				}
+			],
+			"key": "apt_2.7.12_amd64",
+			"name": "apt",
+			"sha256": "ffde38ea5a2d42045732a83633737741259cc517a8c52e3c2776b0b4ea75843d",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/a/apt/apt_2.7.12_amd64.deb"
+			],
+			"version": "2.7.12"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libsystemd0_255.2-3ubuntu2_amd64",
+			"name": "libsystemd0",
+			"sha256": "2b795ada9003c3d43fea41ede816fe9ffeac9e283c2cdc627ea41a123b110f4f",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/s/systemd/libsystemd0_255.2-3ubuntu2_amd64.deb"
+			],
+			"version": "255.2-3ubuntu2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "liblz4-1_1.9.4-1_amd64",
+			"name": "liblz4-1",
+			"sha256": "8c2ac2844f58875ebd1c78cc397ef3889d58050b40299f5dc267d7a77957dc48",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/l/lz4/liblz4-1_1.9.4-1_amd64.deb"
+			],
+			"version": "1.9.4-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libgcrypt20_1.10.3-2_amd64",
+			"name": "libgcrypt20",
+			"sha256": "ad2547e30a16c475e1eb4ac6ba77d06a261fdeb5af4407c4b1655ce1ad38dff4",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libg/libgcrypt20/libgcrypt20_1.10.3-2_amd64.deb"
+			],
+			"version": "1.10.3-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libgpg-error0_1.47-3build1_amd64",
+			"name": "libgpg-error0",
+			"sha256": "2d033b832a3b537538c9bd13c35ecafc7b78aa8c4d7b28859e65d1a6528e2d92",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libg/libgpg-error/libgpg-error0_1.47-3build1_amd64.deb"
+			],
+			"version": "1.47-3build1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libcap2_1-2.66-5ubuntu1_amd64",
+			"name": "libcap2",
+			"sha256": "ac02d261cf8fe7be4cef3e43ff67906da85de4e359ed5c4199b707bdeff0ab62",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libc/libcap2/libcap2_2.66-5ubuntu1_amd64.deb"
+			],
+			"version": "1:2.66-5ubuntu1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libstdc-p--p-6_14-20240221-2.1ubuntu1_amd64",
+			"name": "libstdc++6",
+			"sha256": "3311c13f2e26c20369e937051c78f07c495f6112a0d6c32d3285b47021457ec2",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/g/gcc-14/libstdc++6_14-20240221-2.1ubuntu1_amd64.deb"
+			],
+			"version": "14-20240221-2.1ubuntu1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libseccomp2_2.5.5-1ubuntu1_amd64",
+			"name": "libseccomp2",
+			"sha256": "23b58d5dbae7f6875955a61afd782aade21869015a2a710bf3deef6894a691fb",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libs/libseccomp/libseccomp2_2.5.5-1ubuntu1_amd64.deb"
+			],
+			"version": "2.5.5-1ubuntu1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libgnutls30_3.8.3-1ubuntu1_amd64",
+			"name": "libgnutls30",
+			"sha256": "9638b9847ba94bbf3a81ddd491911aa29e6c8eb2cd9f998b38f4599fbbf76c99",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/g/gnutls28/libgnutls30_3.8.3-1ubuntu1_amd64.deb"
+			],
+			"version": "3.8.3-1ubuntu1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libunistring5_1.1-2_amd64",
+			"name": "libunistring5",
+			"sha256": "cbdbbbf7552e953e3b58c512eb99891fa3ea8b2847a1a8194c5fb9abdb7066b5",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libu/libunistring/libunistring5_1.1-2_amd64.deb"
+			],
+			"version": "1.1-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libtasn1-6_4.19.0-3_amd64",
+			"name": "libtasn1-6",
+			"sha256": "84f16110976e40a7aaa11eb0a291bd85f4002fb8b87f6355ff2f8340d9cf4a62",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libt/libtasn1-6/libtasn1-6_4.19.0-3_amd64.deb"
+			],
+			"version": "4.19.0-3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libp11-kit0_0.25.3-4ubuntu1_amd64",
+			"name": "libp11-kit0",
+			"sha256": "55e257759c223816b23af975d792519c738db9b0e0687c071429db74e1912aa3",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/p/p11-kit/libp11-kit0_0.25.3-4ubuntu1_amd64.deb"
+			],
+			"version": "0.25.3-4ubuntu1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libffi8_3.4.6-1_amd64",
+			"name": "libffi8",
+			"sha256": "bd30f638a82381979c4c07b3acabb7fccaeed7f9b094e27c9a676d2e94572b14",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libf/libffi/libffi8_3.4.6-1_amd64.deb"
+			],
+			"version": "3.4.6-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libnettle8_3.9.1-2_amd64",
+			"name": "libnettle8",
+			"sha256": "c38dd77f817639a2d524956a391393f7d3cdca38724e92ed6d04768fa0a282e9",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/n/nettle/libnettle8_3.9.1-2_amd64.deb"
+			],
+			"version": "3.9.1-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libidn2-0_2.3.7-2_amd64",
+			"name": "libidn2-0",
+			"sha256": "6a00f2cbdfd1e628556bcbc4c1edab07066f6c47f4e75657d8e8b6900704312c",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libi/libidn2/libidn2-0_2.3.7-2_amd64.deb"
+			],
+			"version": "2.3.7-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libhogweed6_3.9.1-2_amd64",
+			"name": "libhogweed6",
+			"sha256": "9644344e343eea3d82f35c4d70e33cfc9b36e139f109a78aaf7a6feb9a3126f2",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/n/nettle/libhogweed6_3.9.1-2_amd64.deb"
+			],
+			"version": "3.9.1-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "ubuntu-keyring_2023.11.28.1_amd64",
+			"name": "ubuntu-keyring",
+			"sha256": "36de43b15853ccae0028e9a767613770c704833f82586f28eb262f0311adb8a8",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/u/ubuntu-keyring/ubuntu-keyring_2023.11.28.1_all.deb"
+			],
+			"version": "2023.11.28.1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libapt-pkg6.0_2.7.12_amd64",
+			"name": "libapt-pkg6.0",
+			"sha256": "6eafb79a865ba21b3e33fc9e49e6c3d09e336dd403d87647bcbe0cd3a614871a",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/a/apt/libapt-pkg6.0_2.7.12_amd64.deb"
+			],
+			"version": "2.7.12"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libxxhash0_0.8.2-2_amd64",
+			"name": "libxxhash0",
+			"sha256": "fbee58694f740de786455ceb5b34550c3ceb067df59fddf0e9d7d713528eb9cb",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/x/xxhash/libxxhash0_0.8.2-2_amd64.deb"
+			],
+			"version": "0.8.2-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libudev1_255.2-3ubuntu2_amd64",
+			"name": "libudev1",
+			"sha256": "c84b059e2c070796cd0a92f5645801a12be726860b4f52153bede2819bbaa980",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/s/systemd/libudev1_255.2-3ubuntu2_amd64.deb"
+			],
+			"version": "255.2-3ubuntu2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "gpgv_2.4.4-2ubuntu7_amd64",
+			"name": "gpgv",
+			"sha256": "5e34a3132f9ecff5276e2d443f85f1fbfc8fe8aa3964dc6bd089123b137676e0",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/g/gnupg2/gpgv_2.4.4-2ubuntu7_amd64.deb"
+			],
+			"version": "2.4.4-2ubuntu7"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libnpth0_1.6-3build2_amd64",
+			"name": "libnpth0",
+			"sha256": "e6e05ed1c4ccfbdc4ca3af2696dadbd0313b5287221ecafa306911da6fbbf89a",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/n/npth/libnpth0_1.6-3build2_amd64.deb"
+			],
+			"version": "1.6-3build2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libassuan0_2.5.6-1_amd64",
+			"name": "libassuan0",
+			"sha256": "c976b785f81b23888bc39a16f9f3cfaf031536ff23f0b6fb24d4812019f20138",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/liba/libassuan/libassuan0_2.5.6-1_amd64.deb"
+			],
+			"version": "2.5.6-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "base-passwd_3.6.3_amd64",
+			"name": "base-passwd",
+			"sha256": "d87e67a303f130fd2e401299fad9be2663d63109d78344827e48ce051410babe",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/b/base-passwd/base-passwd_3.6.3_amd64.deb"
+			],
+			"version": "3.6.3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libdebconfclient0_0.271ubuntu1_amd64",
+			"name": "libdebconfclient0",
+			"sha256": "d5fee4d87bec00beb59b052569ce91134478f26eb48a0aaa48caf421ac206526",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/c/cdebconf/libdebconfclient0_0.271ubuntu1_amd64.deb"
+			],
+			"version": "0.271ubuntu1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [
+				{
+					"key": "libperl5.38_5.38.2-3_amd64",
+					"name": "libperl5.38",
+					"version": "5.38.2-3"
+				},
+				{
+					"key": "perl-modules-5.38_5.38.2-3_amd64",
+					"name": "perl-modules-5.38",
+					"version": "5.38.2-3"
+				},
+				{
+					"key": "perl-base_5.38.2-3_amd64",
+					"name": "perl-base",
+					"version": "5.38.2-3"
+				},
+				{
+					"key": "dpkg_1.22.4ubuntu5_amd64",
+					"name": "dpkg",
+					"version": "1.22.4ubuntu5"
+				},
+				{
+					"key": "tar_1.35-p-dfsg-3_amd64",
+					"name": "tar",
+					"version": "1.35+dfsg-3"
+				},
+				{
+					"key": "libselinux1_3.5-2build1_amd64",
+					"name": "libselinux1",
+					"version": "3.5-2build1"
+				},
+				{
+					"key": "libpcre2-8-0_10.42-4ubuntu1_amd64",
+					"name": "libpcre2-8-0",
+					"version": "10.42-4ubuntu1"
+				},
+				{
+					"key": "libc6_2.39-0ubuntu2_amd64",
+					"name": "libc6",
+					"version": "2.39-0ubuntu2"
+				},
+				{
+					"key": "libgcc-s1_14-20240221-2.1ubuntu1_amd64",
+					"name": "libgcc-s1",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "gcc-14-base_14-20240221-2.1ubuntu1_amd64",
+					"name": "gcc-14-base",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "libacl1_2.3.2-1_amd64",
+					"name": "libacl1",
+					"version": "2.3.2-1"
+				},
+				{
+					"key": "zlib1g_1-1.3.dfsg-3ubuntu1_amd64",
+					"name": "zlib1g",
+					"version": "1:1.3.dfsg-3ubuntu1"
+				},
+				{
+					"key": "libzstd1_1.5.5-p-dfsg2-2_amd64",
+					"name": "libzstd1",
+					"version": "1.5.5+dfsg2-2"
+				},
+				{
+					"key": "libmd0_1.1.0-2_amd64",
+					"name": "libmd0",
+					"version": "1.1.0-2"
+				},
+				{
+					"key": "liblzma5_5.4.5-0.3_amd64",
+					"name": "liblzma5",
+					"version": "5.4.5-0.3"
+				},
+				{
+					"key": "libbz2-1.0_1.0.8-5ubuntu1_amd64",
+					"name": "libbz2-1.0",
+					"version": "1.0.8-5ubuntu1"
+				},
+				{
+					"key": "libcrypt1_1-4.4.36-4_amd64",
+					"name": "libcrypt1",
+					"version": "1:4.4.36-4"
+				},
+				{
+					"key": "libgdbm6_1.23-5_amd64",
+					"name": "libgdbm6",
+					"version": "1.23-5"
+				},
+				{
+					"key": "libgdbm-compat4_1.23-5_amd64",
+					"name": "libgdbm-compat4",
+					"version": "1.23-5"
+				},
+				{
+					"key": "libdb5.3_5.3.28-p-dfsg2-4_amd64",
+					"name": "libdb5.3",
+					"version": "5.3.28+dfsg2-4"
+				}
+			],
+			"key": "perl_5.38.2-3_amd64",
+			"name": "perl",
+			"sha256": "af6657fcbd23694120410423ad59bdf8d0ad5139e5e80cc10599b1a44706fdf6",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/p/perl/perl_5.38.2-3_amd64.deb"
+			],
+			"version": "5.38.2-3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libperl5.38_5.38.2-3_amd64",
+			"name": "libperl5.38",
+			"sha256": "62a161cb99621bb3e69b51bd1ff00ff4ad77cbd357d525182830571d52656cf3",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/p/perl/libperl5.38_5.38.2-3_amd64.deb"
+			],
+			"version": "5.38.2-3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "perl-modules-5.38_5.38.2-3_amd64",
+			"name": "perl-modules-5.38",
+			"sha256": "127dd76635d1d3d135caa5bbc4d5ae96a1c88a36c21313602c4c416270040849",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/p/perl/perl-modules-5.38_5.38.2-3_all.deb"
+			],
+			"version": "5.38.2-3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "perl-base_5.38.2-3_amd64",
+			"name": "perl-base",
+			"sha256": "bd0c5e1b72bdc400005330094101d83628604af5b132df4ea4132eb58e349aa0",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/p/perl/perl-base_5.38.2-3_amd64.deb"
+			],
+			"version": "5.38.2-3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libgdbm6_1.23-5_amd64",
+			"name": "libgdbm6",
+			"sha256": "c3f20aaeeb16d33907b08bd5ca8d179e3d03cfd90d48a631954011179e19225a",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/g/gdbm/libgdbm6_1.23-5_amd64.deb"
+			],
+			"version": "1.23-5"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libgdbm-compat4_1.23-5_amd64",
+			"name": "libgdbm-compat4",
+			"sha256": "788b045f2ed29aad67e3e4dec448c71ec12c1e5f653a1b36422b3fb2082409dc",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/g/gdbm/libgdbm-compat4_1.23-5_amd64.deb"
+			],
+			"version": "1.23-5"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libdb5.3_5.3.28-p-dfsg2-4_amd64",
+			"name": "libdb5.3",
+			"sha256": "439d822a4d19edb3ea466b3ad085d1783d2319611061090df4bef2c562bc625e",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/d/db5.3/libdb5.3_5.3.28+dfsg2-4_amd64.deb"
+			],
+			"version": "5.3.28+dfsg2-4"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [
+				{
+					"key": "git-man_1-2.43.0-1ubuntu1_amd64",
+					"name": "git-man",
+					"version": "1:2.43.0-1ubuntu1"
+				},
+				{
+					"key": "liberror-perl_0.17029-2_amd64",
+					"name": "liberror-perl",
+					"version": "0.17029-2"
+				},
+				{
+					"key": "perl_5.38.2-3_amd64",
+					"name": "perl",
+					"version": "5.38.2-3"
+				},
+				{
+					"key": "libperl5.38_5.38.2-3_amd64",
+					"name": "libperl5.38",
+					"version": "5.38.2-3"
+				},
+				{
+					"key": "perl-modules-5.38_5.38.2-3_amd64",
+					"name": "perl-modules-5.38",
+					"version": "5.38.2-3"
+				},
+				{
+					"key": "perl-base_5.38.2-3_amd64",
+					"name": "perl-base",
+					"version": "5.38.2-3"
+				},
+				{
+					"key": "dpkg_1.22.4ubuntu5_amd64",
+					"name": "dpkg",
+					"version": "1.22.4ubuntu5"
+				},
+				{
+					"key": "tar_1.35-p-dfsg-3_amd64",
+					"name": "tar",
+					"version": "1.35+dfsg-3"
+				},
+				{
+					"key": "libselinux1_3.5-2build1_amd64",
+					"name": "libselinux1",
+					"version": "3.5-2build1"
+				},
+				{
+					"key": "libpcre2-8-0_10.42-4ubuntu1_amd64",
+					"name": "libpcre2-8-0",
+					"version": "10.42-4ubuntu1"
+				},
+				{
+					"key": "libc6_2.39-0ubuntu2_amd64",
+					"name": "libc6",
+					"version": "2.39-0ubuntu2"
+				},
+				{
+					"key": "libgcc-s1_14-20240221-2.1ubuntu1_amd64",
+					"name": "libgcc-s1",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "gcc-14-base_14-20240221-2.1ubuntu1_amd64",
+					"name": "gcc-14-base",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "libacl1_2.3.2-1_amd64",
+					"name": "libacl1",
+					"version": "2.3.2-1"
+				},
+				{
+					"key": "zlib1g_1-1.3.dfsg-3ubuntu1_amd64",
+					"name": "zlib1g",
+					"version": "1:1.3.dfsg-3ubuntu1"
+				},
+				{
+					"key": "libzstd1_1.5.5-p-dfsg2-2_amd64",
+					"name": "libzstd1",
+					"version": "1.5.5+dfsg2-2"
+				},
+				{
+					"key": "libmd0_1.1.0-2_amd64",
+					"name": "libmd0",
+					"version": "1.1.0-2"
+				},
+				{
+					"key": "liblzma5_5.4.5-0.3_amd64",
+					"name": "liblzma5",
+					"version": "5.4.5-0.3"
+				},
+				{
+					"key": "libbz2-1.0_1.0.8-5ubuntu1_amd64",
+					"name": "libbz2-1.0",
+					"version": "1.0.8-5ubuntu1"
+				},
+				{
+					"key": "libcrypt1_1-4.4.36-4_amd64",
+					"name": "libcrypt1",
+					"version": "1:4.4.36-4"
+				},
+				{
+					"key": "libgdbm6_1.23-5_amd64",
+					"name": "libgdbm6",
+					"version": "1.23-5"
+				},
+				{
+					"key": "libgdbm-compat4_1.23-5_amd64",
+					"name": "libgdbm-compat4",
+					"version": "1.23-5"
+				},
+				{
+					"key": "libdb5.3_5.3.28-p-dfsg2-4_amd64",
+					"name": "libdb5.3",
+					"version": "5.3.28+dfsg2-4"
+				},
+				{
+					"key": "libexpat1_2.6.0-1_amd64",
+					"name": "libexpat1",
+					"version": "2.6.0-1"
+				},
+				{
+					"key": "libcurl3-gnutls_8.5.0-2ubuntu2_amd64",
+					"name": "libcurl3-gnutls",
+					"version": "8.5.0-2ubuntu2"
+				},
+				{
+					"key": "libssh-4_0.10.6-2_amd64",
+					"name": "libssh-4",
+					"version": "0.10.6-2"
+				},
+				{
+					"key": "libssl3_3.0.10-1ubuntu4_amd64",
+					"name": "libssl3",
+					"version": "3.0.10-1ubuntu4"
+				},
+				{
+					"key": "libgssapi-krb5-2_1.20.1-5build1_amd64",
+					"name": "libgssapi-krb5-2",
+					"version": "1.20.1-5build1"
+				},
+				{
+					"key": "libkrb5support0_1.20.1-5build1_amd64",
+					"name": "libkrb5support0",
+					"version": "1.20.1-5build1"
+				},
+				{
+					"key": "libk5crypto3_1.20.1-5build1_amd64",
+					"name": "libk5crypto3",
+					"version": "1.20.1-5build1"
+				},
+				{
+					"key": "libcom-err2_1.47.0-2ubuntu1_amd64",
+					"name": "libcom-err2",
+					"version": "1.47.0-2ubuntu1"
+				},
+				{
+					"key": "libkrb5-3_1.20.1-5build1_amd64",
+					"name": "libkrb5-3",
+					"version": "1.20.1-5build1"
+				},
+				{
+					"key": "libkeyutils1_1.6.3-3_amd64",
+					"name": "libkeyutils1",
+					"version": "1.6.3-3"
+				},
+				{
+					"key": "librtmp1_2.4-p-20151223.gitfa8646d.1-2build4_amd64",
+					"name": "librtmp1",
+					"version": "2.4+20151223.gitfa8646d.1-2build4"
+				},
+				{
+					"key": "libnettle8_3.9.1-2_amd64",
+					"name": "libnettle8",
+					"version": "3.9.1-2"
+				},
+				{
+					"key": "libhogweed6_3.9.1-2_amd64",
+					"name": "libhogweed6",
+					"version": "3.9.1-2"
+				},
+				{
+					"key": "libgmp10_2-6.3.0-p-dfsg-2ubuntu4_amd64",
+					"name": "libgmp10",
+					"version": "2:6.3.0+dfsg-2ubuntu4"
+				},
+				{
+					"key": "libgnutls30_3.8.3-1ubuntu1_amd64",
+					"name": "libgnutls30",
+					"version": "3.8.3-1ubuntu1"
+				},
+				{
+					"key": "libunistring5_1.1-2_amd64",
+					"name": "libunistring5",
+					"version": "1.1-2"
+				},
+				{
+					"key": "libtasn1-6_4.19.0-3_amd64",
+					"name": "libtasn1-6",
+					"version": "4.19.0-3"
+				},
+				{
+					"key": "libp11-kit0_0.25.3-4ubuntu1_amd64",
+					"name": "libp11-kit0",
+					"version": "0.25.3-4ubuntu1"
+				},
+				{
+					"key": "libffi8_3.4.6-1_amd64",
+					"name": "libffi8",
+					"version": "3.4.6-1"
+				},
+				{
+					"key": "libidn2-0_2.3.7-2_amd64",
+					"name": "libidn2-0",
+					"version": "2.3.7-2"
+				},
+				{
+					"key": "libpsl5_0.21.2-1build1_amd64",
+					"name": "libpsl5",
+					"version": "0.21.2-1build1"
+				},
+				{
+					"key": "libnghttp2-14_1.59.0-1_amd64",
+					"name": "libnghttp2-14",
+					"version": "1.59.0-1"
+				},
+				{
+					"key": "libldap2_2.6.7-p-dfsg-1_exp1ubuntu1_amd64",
+					"name": "libldap2",
+					"version": "2.6.7+dfsg-1~exp1ubuntu1"
+				},
+				{
+					"key": "libsasl2-2_2.1.28-p-dfsg1-4_amd64",
+					"name": "libsasl2-2",
+					"version": "2.1.28+dfsg1-4"
+				},
+				{
+					"key": "libsasl2-modules-db_2.1.28-p-dfsg1-4_amd64",
+					"name": "libsasl2-modules-db",
+					"version": "2.1.28+dfsg1-4"
+				},
+				{
+					"key": "libbrotli1_1.1.0-2_amd64",
+					"name": "libbrotli1",
+					"version": "1.1.0-2"
+				}
+			],
+			"key": "git_1-2.43.0-1ubuntu1_amd64",
+			"name": "git",
+			"sha256": "59f769ac3a1750cb8ec21148b526d84bcc0cf1628c3de483c81b3b3d02ef4f1a",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/g/git/git_2.43.0-1ubuntu1_amd64.deb"
+			],
+			"version": "1:2.43.0-1ubuntu1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "git-man_1-2.43.0-1ubuntu1_amd64",
+			"name": "git-man",
+			"sha256": "0761c69017927d6621ba6a50b7f0beb48bc717a43a20e0be523ba802c5e82bbf",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/g/git/git-man_2.43.0-1ubuntu1_all.deb"
+			],
+			"version": "1:2.43.0-1ubuntu1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "liberror-perl_0.17029-2_amd64",
+			"name": "liberror-perl",
+			"sha256": "1907af6bf33dd8684447c09f216c675d2b8559fadd8ddace29fbf83c6fb2a636",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libe/liberror-perl/liberror-perl_0.17029-2_all.deb"
+			],
+			"version": "0.17029-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libexpat1_2.6.0-1_amd64",
+			"name": "libexpat1",
+			"sha256": "3951af935e90fd2148c05c727c0b014f59af70c8ab534b8270d73fa4e6f7136c",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/e/expat/libexpat1_2.6.0-1_amd64.deb"
+			],
+			"version": "2.6.0-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libcurl3-gnutls_8.5.0-2ubuntu2_amd64",
+			"name": "libcurl3-gnutls",
+			"sha256": "9a02d2fc71d47ab35da209e8b0be873fa2435ea29bcf7d12080103ceba84fca7",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/c/curl/libcurl3-gnutls_8.5.0-2ubuntu2_amd64.deb"
+			],
+			"version": "8.5.0-2ubuntu2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libssh-4_0.10.6-2_amd64",
+			"name": "libssh-4",
+			"sha256": "06fff1cb6e8c003a6737edec50ffaf9dfdcfe102a929f1524c67885302d3340f",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libs/libssh/libssh-4_0.10.6-2_amd64.deb"
+			],
+			"version": "0.10.6-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libgssapi-krb5-2_1.20.1-5build1_amd64",
+			"name": "libgssapi-krb5-2",
+			"sha256": "78749bbf4bee4321cd1dd437525297680f5efe14e76e1b56d3b051b57a286260",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/k/krb5/libgssapi-krb5-2_1.20.1-5build1_amd64.deb"
+			],
+			"version": "1.20.1-5build1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libkrb5support0_1.20.1-5build1_amd64",
+			"name": "libkrb5support0",
+			"sha256": "f9e7583fbc35dc7f95e468e40626db258203cc99a3eaa5959bdc7492d068cc5c",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/k/krb5/libkrb5support0_1.20.1-5build1_amd64.deb"
+			],
+			"version": "1.20.1-5build1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libk5crypto3_1.20.1-5build1_amd64",
+			"name": "libk5crypto3",
+			"sha256": "4b4a9ab4f16731994088ac38cad33b79c34478fee4f3dbd31069c20e6de65d81",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/k/krb5/libk5crypto3_1.20.1-5build1_amd64.deb"
+			],
+			"version": "1.20.1-5build1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libcom-err2_1.47.0-2ubuntu1_amd64",
+			"name": "libcom-err2",
+			"sha256": "c428814f2f425cc43672869c3b4fc87eaa0664e19bb7e1799c126d05f35b467f",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/e/e2fsprogs/libcom-err2_1.47.0-2ubuntu1_amd64.deb"
+			],
+			"version": "1.47.0-2ubuntu1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libkrb5-3_1.20.1-5build1_amd64",
+			"name": "libkrb5-3",
+			"sha256": "62fa66b5e715ea941d145316c6b298b0b6b9d1ed8dddd7b10b40f4577eb76f4b",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/k/krb5/libkrb5-3_1.20.1-5build1_amd64.deb"
+			],
+			"version": "1.20.1-5build1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libkeyutils1_1.6.3-3_amd64",
+			"name": "libkeyutils1",
+			"sha256": "4459c655f4670b1c1863b5fc1ac78811bf4ff4e50de4043d47686688a05e2333",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/k/keyutils/libkeyutils1_1.6.3-3_amd64.deb"
+			],
+			"version": "1.6.3-3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "librtmp1_2.4-p-20151223.gitfa8646d.1-2build4_amd64",
+			"name": "librtmp1",
+			"sha256": "c8bdaa1e777d08888914e922f8f76441c26ee36438d3aa59161ecccc2421f77e",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/r/rtmpdump/librtmp1_2.4+20151223.gitfa8646d.1-2build4_amd64.deb"
+			],
+			"version": "2.4+20151223.gitfa8646d.1-2build4"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libpsl5_0.21.2-1build1_amd64",
+			"name": "libpsl5",
+			"sha256": "d72e57989d99982c7983b773c347ce40f6594647f05a96d713b7708ae82502dd",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libp/libpsl/libpsl5_0.21.2-1build1_amd64.deb"
+			],
+			"version": "0.21.2-1build1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libnghttp2-14_1.59.0-1_amd64",
+			"name": "libnghttp2-14",
+			"sha256": "c056322f820ea88aa3a540d6d9510d9d53529fd6ecc90b9b0b8081ba78f3367c",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/n/nghttp2/libnghttp2-14_1.59.0-1_amd64.deb"
+			],
+			"version": "1.59.0-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libldap2_2.6.7-p-dfsg-1_exp1ubuntu1_amd64",
+			"name": "libldap2",
+			"sha256": "35bcdd824dfe098b7f7ba8e92a79242e7d49b6cca19ece05b4bc544de9329d0a",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/o/openldap/libldap2_2.6.7+dfsg-1~exp1ubuntu1_amd64.deb"
+			],
+			"version": "2.6.7+dfsg-1~exp1ubuntu1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libsasl2-2_2.1.28-p-dfsg1-4_amd64",
+			"name": "libsasl2-2",
+			"sha256": "f9f21b31c125ff0c261685edb066d9abf4c85d2496f726a9d9b43b9460dfe3cf",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/c/cyrus-sasl2/libsasl2-2_2.1.28+dfsg1-4_amd64.deb"
+			],
+			"version": "2.1.28+dfsg1-4"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libsasl2-modules-db_2.1.28-p-dfsg1-4_amd64",
+			"name": "libsasl2-modules-db",
+			"sha256": "0af253867810f24c5b0051db4175e132e3fc7b0d40f93539beb8a62cb9893520",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/c/cyrus-sasl2/libsasl2-modules-db_2.1.28+dfsg1-4_amd64.deb"
+			],
+			"version": "2.1.28+dfsg1-4"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libbrotli1_1.1.0-2_amd64",
+			"name": "libbrotli1",
+			"sha256": "a46004c3521a4ee502a6bc2d48e1e71d0f1bb0e0eac57538da323a271b0feb23",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/b/brotli/libbrotli1_1.1.0-2_amd64.deb"
+			],
+			"version": "1.1.0-2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [
+				{
+					"key": "libpython3-stdlib_3.12.1-0ubuntu1_amd64",
+					"name": "libpython3-stdlib",
+					"version": "3.12.1-0ubuntu1"
+				},
+				{
+					"key": "libpython3.12-stdlib_3.12.2-1_amd64",
+					"name": "libpython3.12-stdlib",
+					"version": "3.12.2-1"
+				},
+				{
+					"key": "libuuid1_2.39.3-6ubuntu2_amd64",
+					"name": "libuuid1",
+					"version": "2.39.3-6ubuntu2"
+				},
+				{
+					"key": "libc6_2.39-0ubuntu2_amd64",
+					"name": "libc6",
+					"version": "2.39-0ubuntu2"
+				},
+				{
+					"key": "libgcc-s1_14-20240221-2.1ubuntu1_amd64",
+					"name": "libgcc-s1",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "gcc-14-base_14-20240221-2.1ubuntu1_amd64",
+					"name": "gcc-14-base",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "libtirpc3_1.3.4-p-ds-1build1_amd64",
+					"name": "libtirpc3",
+					"version": "1.3.4+ds-1build1"
+				},
+				{
+					"key": "libtirpc-common_1.3.4-p-ds-1build1_amd64",
+					"name": "libtirpc-common",
+					"version": "1.3.4+ds-1build1"
+				},
+				{
+					"key": "libgssapi-krb5-2_1.20.1-5build1_amd64",
+					"name": "libgssapi-krb5-2",
+					"version": "1.20.1-5build1"
+				},
+				{
+					"key": "libkrb5support0_1.20.1-5build1_amd64",
+					"name": "libkrb5support0",
+					"version": "1.20.1-5build1"
+				},
+				{
+					"key": "libk5crypto3_1.20.1-5build1_amd64",
+					"name": "libk5crypto3",
+					"version": "1.20.1-5build1"
+				},
+				{
+					"key": "libcom-err2_1.47.0-2ubuntu1_amd64",
+					"name": "libcom-err2",
+					"version": "1.47.0-2ubuntu1"
+				},
+				{
+					"key": "libkrb5-3_1.20.1-5build1_amd64",
+					"name": "libkrb5-3",
+					"version": "1.20.1-5build1"
+				},
+				{
+					"key": "libssl3_3.0.10-1ubuntu4_amd64",
+					"name": "libssl3",
+					"version": "3.0.10-1ubuntu4"
+				},
+				{
+					"key": "libkeyutils1_1.6.3-3_amd64",
+					"name": "libkeyutils1",
+					"version": "1.6.3-3"
+				},
+				{
+					"key": "libtinfo6_6.4-p-20240113-1ubuntu1_amd64",
+					"name": "libtinfo6",
+					"version": "6.4+20240113-1ubuntu1"
+				},
+				{
+					"key": "libsqlite3-0_3.45.1-1_amd64",
+					"name": "libsqlite3-0",
+					"version": "3.45.1-1"
+				},
+				{
+					"key": "libreadline8_8.2-3_amd64",
+					"name": "libreadline8",
+					"version": "8.2-3"
+				},
+				{
+					"key": "readline-common_8.2-3_amd64",
+					"name": "readline-common",
+					"version": "8.2-3"
+				},
+				{
+					"key": "libnsl2_1.3.0-3_amd64",
+					"name": "libnsl2",
+					"version": "1.3.0-3"
+				},
+				{
+					"key": "libncursesw6_6.4-p-20240113-1ubuntu1_amd64",
+					"name": "libncursesw6",
+					"version": "6.4+20240113-1ubuntu1"
+				},
+				{
+					"key": "liblzma5_5.4.5-0.3_amd64",
+					"name": "liblzma5",
+					"version": "5.4.5-0.3"
+				},
+				{
+					"key": "libffi8_3.4.6-1_amd64",
+					"name": "libffi8",
+					"version": "3.4.6-1"
+				},
+				{
+					"key": "libdb5.3_5.3.28-p-dfsg2-4_amd64",
+					"name": "libdb5.3",
+					"version": "5.3.28+dfsg2-4"
+				},
+				{
+					"key": "libcrypt1_1-4.4.36-4_amd64",
+					"name": "libcrypt1",
+					"version": "1:4.4.36-4"
+				},
+				{
+					"key": "libbz2-1.0_1.0.8-5ubuntu1_amd64",
+					"name": "libbz2-1.0",
+					"version": "1.0.8-5ubuntu1"
+				},
+				{
+					"key": "tzdata_2024a-1ubuntu1_amd64",
+					"name": "tzdata",
+					"version": "2024a-1ubuntu1"
+				},
+				{
+					"key": "debconf_1.5.86_amd64",
+					"name": "debconf",
+					"version": "1.5.86"
+				},
+				{
+					"key": "netbase_6.4_amd64",
+					"name": "netbase",
+					"version": "6.4"
+				},
+				{
+					"key": "media-types_10.1.0_amd64",
+					"name": "media-types",
+					"version": "10.1.0"
+				},
+				{
+					"key": "libpython3.12-minimal_3.12.2-1_amd64",
+					"name": "libpython3.12-minimal",
+					"version": "3.12.2-1"
+				},
+				{
+					"key": "python3.12_3.12.2-1_amd64",
+					"name": "python3.12",
+					"version": "3.12.2-1"
+				},
+				{
+					"key": "python3.12-minimal_3.12.2-1_amd64",
+					"name": "python3.12-minimal",
+					"version": "3.12.2-1"
+				},
+				{
+					"key": "zlib1g_1-1.3.dfsg-3ubuntu1_amd64",
+					"name": "zlib1g",
+					"version": "1:1.3.dfsg-3ubuntu1"
+				},
+				{
+					"key": "libexpat1_2.6.0-1_amd64",
+					"name": "libexpat1",
+					"version": "2.6.0-1"
+				},
+				{
+					"key": "python3-minimal_3.12.1-0ubuntu1_amd64",
+					"name": "python3-minimal",
+					"version": "3.12.1-0ubuntu1"
+				},
+				{
+					"key": "dpkg_1.22.4ubuntu5_amd64",
+					"name": "dpkg",
+					"version": "1.22.4ubuntu5"
+				},
+				{
+					"key": "tar_1.35-p-dfsg-3_amd64",
+					"name": "tar",
+					"version": "1.35+dfsg-3"
+				},
+				{
+					"key": "libselinux1_3.5-2build1_amd64",
+					"name": "libselinux1",
+					"version": "3.5-2build1"
+				},
+				{
+					"key": "libpcre2-8-0_10.42-4ubuntu1_amd64",
+					"name": "libpcre2-8-0",
+					"version": "10.42-4ubuntu1"
+				},
+				{
+					"key": "libacl1_2.3.2-1_amd64",
+					"name": "libacl1",
+					"version": "2.3.2-1"
+				},
+				{
+					"key": "libzstd1_1.5.5-p-dfsg2-2_amd64",
+					"name": "libzstd1",
+					"version": "1.5.5+dfsg2-2"
+				},
+				{
+					"key": "libmd0_1.1.0-2_amd64",
+					"name": "libmd0",
+					"version": "1.1.0-2"
+				}
+			],
+			"key": "python3_3.12.1-0ubuntu1_amd64",
+			"name": "python3",
+			"sha256": "b55c2687e009340f38f4c56f0259499df4de9fd1d80ff96b18950512defb49f5",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/p/python3-defaults/python3_3.12.1-0ubuntu1_amd64.deb"
+			],
+			"version": "3.12.1-0ubuntu1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libpython3-stdlib_3.12.1-0ubuntu1_amd64",
+			"name": "libpython3-stdlib",
+			"sha256": "2ddb8b7410c60d883b0bd2e81ae8c3e3b9f597fe86f45275af968b3f5c2caafa",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/p/python3-defaults/libpython3-stdlib_3.12.1-0ubuntu1_amd64.deb"
+			],
+			"version": "3.12.1-0ubuntu1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libpython3.12-stdlib_3.12.2-1_amd64",
+			"name": "libpython3.12-stdlib",
+			"sha256": "d9a7aaf513a7fe7edeeddb7bc6253ddb5fad5364105c9014ce48d2dc835a1286",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/p/python3.12/libpython3.12-stdlib_3.12.2-1_amd64.deb"
+			],
+			"version": "3.12.2-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libuuid1_2.39.3-6ubuntu2_amd64",
+			"name": "libuuid1",
+			"sha256": "eec85f07cf7a65483d953b4dbdd857b9b34d33f69b317580d18b8a6c90f628dc",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/u/util-linux/libuuid1_2.39.3-6ubuntu2_amd64.deb"
+			],
+			"version": "2.39.3-6ubuntu2"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libtirpc3_1.3.4-p-ds-1build1_amd64",
+			"name": "libtirpc3",
+			"sha256": "7ccd1ba3287a127351d74c70e1d797e6f33298f36d192fdfe08301e72207de06",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libt/libtirpc/libtirpc3_1.3.4+ds-1build1_amd64.deb"
+			],
+			"version": "1.3.4+ds-1build1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libtirpc-common_1.3.4-p-ds-1build1_amd64",
+			"name": "libtirpc-common",
+			"sha256": "083fd9df1073a97028e757d7a0c6826bd1d573bbfb16279a592cc3527f896ef7",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libt/libtirpc/libtirpc-common_1.3.4+ds-1build1_all.deb"
+			],
+			"version": "1.3.4+ds-1build1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libsqlite3-0_3.45.1-1_amd64",
+			"name": "libsqlite3-0",
+			"sha256": "8fac820c6c166fac59cb358d48c9917ffa49f40440776d8d3b4abb65d89593dd",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/s/sqlite3/libsqlite3-0_3.45.1-1_amd64.deb"
+			],
+			"version": "3.45.1-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libreadline8_8.2-3_amd64",
+			"name": "libreadline8",
+			"sha256": "16db9ee9f6dde59e831afbe94e1a87c4a008e1468bb94d92ab732121c4707347",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/r/readline/libreadline8_8.2-3_amd64.deb"
+			],
+			"version": "8.2-3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "readline-common_8.2-3_amd64",
+			"name": "readline-common",
+			"sha256": "c1d35ee9016c974eea546063ffa567f98e18c13d40d7542e58730ff1dcdf4c8d",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/r/readline/readline-common_8.2-3_all.deb"
+			],
+			"version": "8.2-3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libnsl2_1.3.0-3_amd64",
+			"name": "libnsl2",
+			"sha256": "281ae0d8a0e7ae7d4f2f906d186368c37fba9af882bec98c5282826063d19427",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libn/libnsl/libnsl2_1.3.0-3_amd64.deb"
+			],
+			"version": "1.3.0-3"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libncursesw6_6.4-p-20240113-1ubuntu1_amd64",
+			"name": "libncursesw6",
+			"sha256": "161aa336e4ff2105d37237505629227859ccc526b28e23299bbeabf87bb878f0",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/n/ncurses/libncursesw6_6.4+20240113-1ubuntu1_amd64.deb"
+			],
+			"version": "6.4+20240113-1ubuntu1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "netbase_6.4_amd64",
+			"name": "netbase",
+			"sha256": "8cdbc9c3dca01e660759bf9d840f72e45ac72faf5d19ca1faecacaf6a60c1a87",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/n/netbase/netbase_6.4_all.deb"
+			],
+			"version": "6.4"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "media-types_10.1.0_amd64",
+			"name": "media-types",
+			"sha256": "31bfb7eec55ab6d34a50ba995150e1498d4cb897714085d8025e330d3b529747",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/m/media-types/media-types_10.1.0_all.deb"
+			],
+			"version": "10.1.0"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "libpython3.12-minimal_3.12.2-1_amd64",
+			"name": "libpython3.12-minimal",
+			"sha256": "b5f037e75d86b468928490cc52250be44d69eaf6cb689c751c4c498436051827",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/p/python3.12/libpython3.12-minimal_3.12.2-1_amd64.deb"
+			],
+			"version": "3.12.2-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "python3.12_3.12.2-1_amd64",
+			"name": "python3.12",
+			"sha256": "e1029d14518c4f6bbc0bc2f98e7789238146be47d0df6b0c2b5c4fc7d5347283",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/p/python3.12/python3.12_3.12.2-1_amd64.deb"
+			],
+			"version": "3.12.2-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "python3.12-minimal_3.12.2-1_amd64",
+			"name": "python3.12-minimal",
+			"sha256": "2580837b8b663bfc3b6317f199e37c650507b9c351e604809f79fd1176f8bc01",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/p/python3.12/python3.12-minimal_3.12.2-1_amd64.deb"
+			],
+			"version": "3.12.2-1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "python3-minimal_3.12.1-0ubuntu1_amd64",
+			"name": "python3-minimal",
+			"sha256": "6216cb44dfe70df5cc8021479eba66db7ff1fde26008ad024a7caf6534e2e7f8",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/p/python3-defaults/python3-minimal_3.12.1-0ubuntu1_amd64.deb"
+			],
+			"version": "3.12.1-0ubuntu1"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [
+				{
+					"key": "debconf_1.5.86_amd64",
+					"name": "debconf",
+					"version": "1.5.86"
+				},
+				{
+					"key": "openssl_3.0.10-1ubuntu4_amd64",
+					"name": "openssl",
+					"version": "3.0.10-1ubuntu4"
+				},
+				{
+					"key": "libssl3_3.0.10-1ubuntu4_amd64",
+					"name": "libssl3",
+					"version": "3.0.10-1ubuntu4"
+				},
+				{
+					"key": "libc6_2.39-0ubuntu2_amd64",
+					"name": "libc6",
+					"version": "2.39-0ubuntu2"
+				},
+				{
+					"key": "libgcc-s1_14-20240221-2.1ubuntu1_amd64",
+					"name": "libgcc-s1",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "gcc-14-base_14-20240221-2.1ubuntu1_amd64",
+					"name": "gcc-14-base",
+					"version": "14-20240221-2.1ubuntu1"
+				}
+			],
+			"key": "ca-certificates_20240203_amd64",
+			"name": "ca-certificates",
+			"sha256": "641de77d8f142cfd62a1a6f964ba67b20754d3337c480efb529d086075a06c9a",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/c/ca-certificates/ca-certificates_20240203_all.deb"
+			],
+			"version": "20240203"
+		},
+		{
+			"arch": "amd64",
+			"dependencies": [],
+			"key": "openssl_3.0.10-1ubuntu4_amd64",
+			"name": "openssl",
+			"sha256": "a298c0e5cf8b54a2796055d2a64337377f62cd908ac1e7738ba271128dfa8b62",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/o/openssl/openssl_3.0.10-1ubuntu4_amd64.deb"
+			],
+			"version": "3.0.10-1ubuntu4"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "ncurses-base_6.4-p-20240113-1ubuntu1_arm64",
+			"name": "ncurses-base",
+			"sha256": "1ea2be0cadf1299e5ed2967269c01e1935ddf5a733a496893b4334994aea2755",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/n/ncurses/ncurses-base_6.4+20240113-1ubuntu1_all.deb"
+			],
+			"version": "6.4+20240113-1ubuntu1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [
+				{
+					"key": "libc6_2.39-0ubuntu2_arm64",
+					"name": "libc6",
+					"version": "2.39-0ubuntu2"
+				},
+				{
+					"key": "libgcc-s1_14-20240221-2.1ubuntu1_arm64",
+					"name": "libgcc-s1",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "gcc-14-base_14-20240221-2.1ubuntu1_arm64",
+					"name": "gcc-14-base",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "libtinfo6_6.4-p-20240113-1ubuntu1_arm64",
+					"name": "libtinfo6",
+					"version": "6.4+20240113-1ubuntu1"
+				}
+			],
+			"key": "libncurses6_6.4-p-20240113-1ubuntu1_arm64",
+			"name": "libncurses6",
+			"sha256": "5cb643f9a938f783a72b85c2c102b977e7e2d137c0d3564ff1df6652de89296f",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/n/ncurses/libncurses6_6.4+20240113-1ubuntu1_arm64.deb"
+			],
+			"version": "6.4+20240113-1ubuntu1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libc6_2.39-0ubuntu2_arm64",
+			"name": "libc6",
+			"sha256": "522238223618b52aae530256dfaea19e746649c382983d99c9e79d1f7e6afeef",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/g/glibc/libc6_2.39-0ubuntu2_arm64.deb"
+			],
+			"version": "2.39-0ubuntu2"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libgcc-s1_14-20240221-2.1ubuntu1_arm64",
+			"name": "libgcc-s1",
+			"sha256": "d3aec36dbcea7dcf910f7ece43d3e31260bb0cd0a2b58808efaa999af1798511",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/g/gcc-14/libgcc-s1_14-20240221-2.1ubuntu1_arm64.deb"
+			],
+			"version": "14-20240221-2.1ubuntu1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "gcc-14-base_14-20240221-2.1ubuntu1_arm64",
+			"name": "gcc-14-base",
+			"sha256": "9886cc5eec6df002429338e26ce1670ada931f9b91fe147eee483ae11cc9cdda",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/g/gcc-14/gcc-14-base_14-20240221-2.1ubuntu1_arm64.deb"
+			],
+			"version": "14-20240221-2.1ubuntu1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libtinfo6_6.4-p-20240113-1ubuntu1_arm64",
+			"name": "libtinfo6",
+			"sha256": "4a190c05ea7e919e4e796e1321f7923158048e1bdc58c71c11692628f6064bcb",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/n/ncurses/libtinfo6_6.4+20240113-1ubuntu1_arm64.deb"
+			],
+			"version": "6.4+20240113-1ubuntu1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [
+				{
+					"key": "debconf_1.5.86_arm64",
+					"name": "debconf",
+					"version": "1.5.86"
+				}
+			],
+			"key": "tzdata_2024a-1ubuntu1_arm64",
+			"name": "tzdata",
+			"sha256": "26cdb43f541d5b7d089d2c1cf7d50b4c5e630c79a6d4d6ce34e20dcace4f0d29",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/t/tzdata/tzdata_2024a-1ubuntu1_all.deb"
+			],
+			"version": "2024a-1ubuntu1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "debconf_1.5.86_arm64",
+			"name": "debconf",
+			"sha256": "725da1e474ff8ce916e7954ed262273a02e4f74ee1f6cd342b19ff283617d91b",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/d/debconf/debconf_1.5.86_all.deb"
+			],
+			"version": "1.5.86"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [
+				{
+					"key": "debianutils_5.16_arm64",
+					"name": "debianutils",
+					"version": "5.16"
+				},
+				{
+					"key": "libc6_2.39-0ubuntu2_arm64",
+					"name": "libc6",
+					"version": "2.39-0ubuntu2"
+				},
+				{
+					"key": "libgcc-s1_14-20240221-2.1ubuntu1_arm64",
+					"name": "libgcc-s1",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "gcc-14-base_14-20240221-2.1ubuntu1_arm64",
+					"name": "gcc-14-base",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "base-files_13ubuntu7_arm64",
+					"name": "base-files",
+					"version": "13ubuntu7"
+				},
+				{
+					"key": "libcrypt1_1-4.4.36-4_arm64",
+					"name": "libcrypt1",
+					"version": "1:4.4.36-4"
+				},
+				{
+					"key": "mawk_1.3.4.20240123-1_arm64",
+					"name": "mawk",
+					"version": "1.3.4.20240123-1"
+				},
+				{
+					"key": "libtinfo6_6.4-p-20240113-1ubuntu1_arm64",
+					"name": "libtinfo6",
+					"version": "6.4+20240113-1ubuntu1"
+				}
+			],
+			"key": "bash_5.2.21-2ubuntu2_arm64",
+			"name": "bash",
+			"sha256": "f6e49a0e27e9f73a10a95cfce04f5449834cf5c2f0f12caffa273297385a0f46",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/b/bash/bash_5.2.21-2ubuntu2_arm64.deb"
+			],
+			"version": "5.2.21-2ubuntu2"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "debianutils_5.16_arm64",
+			"name": "debianutils",
+			"sha256": "59efa8456b8f2dd76860ba306dbc397673170d9dfa969f58fba8891329a7d5b5",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/d/debianutils/debianutils_5.16_arm64.deb"
+			],
+			"version": "5.16"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "base-files_13ubuntu7_arm64",
+			"name": "base-files",
+			"sha256": "fca1f68e39dca654190f4a3bd4879659f90781d3d509c3882db0e75c1ce2ebc6",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/b/base-files/base-files_13ubuntu7_arm64.deb"
+			],
+			"version": "13ubuntu7"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libcrypt1_1-4.4.36-4_arm64",
+			"name": "libcrypt1",
+			"sha256": "3dd680dd15a31e7a023f47008b99b1aceed3104a01afacb775fa888a8fdb9f90",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libx/libxcrypt/libcrypt1_4.4.36-4_arm64.deb"
+			],
+			"version": "1:4.4.36-4"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "mawk_1.3.4.20240123-1_arm64",
+			"name": "mawk",
+			"sha256": "2e1e712aaa8aa0daea67ee2a9ea10b91049f2de7274e3e4da55e15c78b559aef",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/m/mawk/mawk_1.3.4.20240123-1_arm64.deb"
+			],
+			"version": "1.3.4.20240123-1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [
+				{
+					"key": "libselinux1_3.5-2build1_arm64",
+					"name": "libselinux1",
+					"version": "3.5-2build1"
+				},
+				{
+					"key": "libpcre2-8-0_10.42-4ubuntu1_arm64",
+					"name": "libpcre2-8-0",
+					"version": "10.42-4ubuntu1"
+				},
+				{
+					"key": "libc6_2.39-0ubuntu2_arm64",
+					"name": "libc6",
+					"version": "2.39-0ubuntu2"
+				},
+				{
+					"key": "libgcc-s1_14-20240221-2.1ubuntu1_arm64",
+					"name": "libgcc-s1",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "gcc-14-base_14-20240221-2.1ubuntu1_arm64",
+					"name": "gcc-14-base",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "libgmp10_2-6.3.0-p-dfsg-2ubuntu4_arm64",
+					"name": "libgmp10",
+					"version": "2:6.3.0+dfsg-2ubuntu4"
+				},
+				{
+					"key": "libattr1_1-2.5.2-1_arm64",
+					"name": "libattr1",
+					"version": "1:2.5.2-1"
+				},
+				{
+					"key": "libacl1_2.3.2-1_arm64",
+					"name": "libacl1",
+					"version": "2.3.2-1"
+				}
+			],
+			"key": "coreutils_9.4-2ubuntu4_arm64",
+			"name": "coreutils",
+			"sha256": "a73b6f3b14c2578c12ba8ed8c7e55df8b94aa60088713b85ecaa56149f704788",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/c/coreutils/coreutils_9.4-2ubuntu4_arm64.deb"
+			],
+			"version": "9.4-2ubuntu4"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libselinux1_3.5-2build1_arm64",
+			"name": "libselinux1",
+			"sha256": "9d22b9775025031775c8cf77568b427e7f7bff49d097b5c9885657edfaf71193",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libs/libselinux/libselinux1_3.5-2build1_arm64.deb"
+			],
+			"version": "3.5-2build1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libpcre2-8-0_10.42-4ubuntu1_arm64",
+			"name": "libpcre2-8-0",
+			"sha256": "14214893ef06c573ad2e6d99ab6cebbaf26c204818cf898ea7abc8b0339f1791",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/p/pcre2/libpcre2-8-0_10.42-4ubuntu1_arm64.deb"
+			],
+			"version": "10.42-4ubuntu1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libgmp10_2-6.3.0-p-dfsg-2ubuntu4_arm64",
+			"name": "libgmp10",
+			"sha256": "8f35d6d5564801218d19c864361726bf9ba8a171896e1c183dd7ecb70973592b",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/g/gmp/libgmp10_6.3.0+dfsg-2ubuntu4_arm64.deb"
+			],
+			"version": "2:6.3.0+dfsg-2ubuntu4"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libattr1_1-2.5.2-1_arm64",
+			"name": "libattr1",
+			"sha256": "0cfd6967c0ca25b16db868d819f47ffcca5d43aa22e3227c7be08626dc73d7cb",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/a/attr/libattr1_2.5.2-1_arm64.deb"
+			],
+			"version": "1:2.5.2-1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libacl1_2.3.2-1_arm64",
+			"name": "libacl1",
+			"sha256": "1e683ce20074199ed9dd9c4ffdbb5bf30f5e494d9c9452512f8709a9fbe76562",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/a/acl/libacl1_2.3.2-1_arm64.deb"
+			],
+			"version": "2.3.2-1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [
+				{
+					"key": "libpcre2-8-0_10.42-4ubuntu1_arm64",
+					"name": "libpcre2-8-0",
+					"version": "10.42-4ubuntu1"
+				},
+				{
+					"key": "libc6_2.39-0ubuntu2_arm64",
+					"name": "libc6",
+					"version": "2.39-0ubuntu2"
+				},
+				{
+					"key": "libgcc-s1_14-20240221-2.1ubuntu1_arm64",
+					"name": "libgcc-s1",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "gcc-14-base_14-20240221-2.1ubuntu1_arm64",
+					"name": "gcc-14-base",
+					"version": "14-20240221-2.1ubuntu1"
+				}
+			],
+			"key": "grep_3.11-4_arm64",
+			"name": "grep",
+			"sha256": "52060ea1c0776bf7ccf5e23650ba7a0990e4ba675b03d3129c690759c6a7d6d0",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/g/grep/grep_3.11-4_arm64.deb"
+			],
+			"version": "3.11-4"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [
+				{
+					"key": "tar_1.35-p-dfsg-3_arm64",
+					"name": "tar",
+					"version": "1.35+dfsg-3"
+				},
+				{
+					"key": "libselinux1_3.5-2build1_arm64",
+					"name": "libselinux1",
+					"version": "3.5-2build1"
+				},
+				{
+					"key": "libpcre2-8-0_10.42-4ubuntu1_arm64",
+					"name": "libpcre2-8-0",
+					"version": "10.42-4ubuntu1"
+				},
+				{
+					"key": "libc6_2.39-0ubuntu2_arm64",
+					"name": "libc6",
+					"version": "2.39-0ubuntu2"
+				},
+				{
+					"key": "libgcc-s1_14-20240221-2.1ubuntu1_arm64",
+					"name": "libgcc-s1",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "gcc-14-base_14-20240221-2.1ubuntu1_arm64",
+					"name": "gcc-14-base",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "libacl1_2.3.2-1_arm64",
+					"name": "libacl1",
+					"version": "2.3.2-1"
+				},
+				{
+					"key": "zlib1g_1-1.3.dfsg-3ubuntu1_arm64",
+					"name": "zlib1g",
+					"version": "1:1.3.dfsg-3ubuntu1"
+				},
+				{
+					"key": "libzstd1_1.5.5-p-dfsg2-2_arm64",
+					"name": "libzstd1",
+					"version": "1.5.5+dfsg2-2"
+				},
+				{
+					"key": "libmd0_1.1.0-2_arm64",
+					"name": "libmd0",
+					"version": "1.1.0-2"
+				},
+				{
+					"key": "liblzma5_5.4.5-0.3_arm64",
+					"name": "liblzma5",
+					"version": "5.4.5-0.3"
+				},
+				{
+					"key": "libbz2-1.0_1.0.8-5ubuntu1_arm64",
+					"name": "libbz2-1.0",
+					"version": "1.0.8-5ubuntu1"
+				}
+			],
+			"key": "dpkg_1.22.4ubuntu5_arm64",
+			"name": "dpkg",
+			"sha256": "352d489b2b457728a2cfd253172080729ce3ac635bc8cf9809acb9c92e2dd149",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/d/dpkg/dpkg_1.22.4ubuntu5_arm64.deb"
+			],
+			"version": "1.22.4ubuntu5"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "tar_1.35-p-dfsg-3_arm64",
+			"name": "tar",
+			"sha256": "15ed5677151c6f224799e82f90515c77e744a68d99d2ea3d8bf2877e9effd575",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/t/tar/tar_1.35+dfsg-3_arm64.deb"
+			],
+			"version": "1.35+dfsg-3"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "zlib1g_1-1.3.dfsg-3ubuntu1_arm64",
+			"name": "zlib1g",
+			"sha256": "bb947ff78e0aee7477aeea1bc82a5db2e80f5b1322f460ecc06710200a16326f",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/z/zlib/zlib1g_1.3.dfsg-3ubuntu1_arm64.deb"
+			],
+			"version": "1:1.3.dfsg-3ubuntu1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libzstd1_1.5.5-p-dfsg2-2_arm64",
+			"name": "libzstd1",
+			"sha256": "a6c2bcacff770685b3ef262943bbb3ce2060b9de83e1698590f5b576d5e7827e",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libz/libzstd/libzstd1_1.5.5+dfsg2-2_arm64.deb"
+			],
+			"version": "1.5.5+dfsg2-2"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libmd0_1.1.0-2_arm64",
+			"name": "libmd0",
+			"sha256": "884597eb942118b246a79e68aa619e3b6d22125e5cd7948557b542b6e70bdb54",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libm/libmd/libmd0_1.1.0-2_arm64.deb"
+			],
+			"version": "1.1.0-2"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "liblzma5_5.4.5-0.3_arm64",
+			"name": "liblzma5",
+			"sha256": "d0e936978175a45bb317a5ca17c29f0d610126e21f5ce6900f107244a6e333b6",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/x/xz-utils/liblzma5_5.4.5-0.3_arm64.deb"
+			],
+			"version": "5.4.5-0.3"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libbz2-1.0_1.0.8-5ubuntu1_arm64",
+			"name": "libbz2-1.0",
+			"sha256": "0c479f94c97d2ab5641bf7b967d37daad61c5e8c4ea998ebd710d2125d4eb027",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/b/bzip2/libbz2-1.0_1.0.8-5ubuntu1_arm64.deb"
+			],
+			"version": "1.0.8-5ubuntu1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [
+				{
+					"key": "libsystemd0_255.2-3ubuntu2_arm64",
+					"name": "libsystemd0",
+					"version": "255.2-3ubuntu2"
+				},
+				{
+					"key": "libzstd1_1.5.5-p-dfsg2-2_arm64",
+					"name": "libzstd1",
+					"version": "1.5.5+dfsg2-2"
+				},
+				{
+					"key": "libc6_2.39-0ubuntu2_arm64",
+					"name": "libc6",
+					"version": "2.39-0ubuntu2"
+				},
+				{
+					"key": "libgcc-s1_14-20240221-2.1ubuntu1_arm64",
+					"name": "libgcc-s1",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "gcc-14-base_14-20240221-2.1ubuntu1_arm64",
+					"name": "gcc-14-base",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "liblzma5_5.4.5-0.3_arm64",
+					"name": "liblzma5",
+					"version": "5.4.5-0.3"
+				},
+				{
+					"key": "liblz4-1_1.9.4-1_arm64",
+					"name": "liblz4-1",
+					"version": "1.9.4-1"
+				},
+				{
+					"key": "libgcrypt20_1.10.3-2_arm64",
+					"name": "libgcrypt20",
+					"version": "1.10.3-2"
+				},
+				{
+					"key": "libgpg-error0_1.47-3build1_arm64",
+					"name": "libgpg-error0",
+					"version": "1.47-3build1"
+				},
+				{
+					"key": "libcap2_1-2.66-5ubuntu1_arm64",
+					"name": "libcap2",
+					"version": "1:2.66-5ubuntu1"
+				},
+				{
+					"key": "libstdc-p--p-6_14-20240221-2.1ubuntu1_arm64",
+					"name": "libstdc++6",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "libseccomp2_2.5.5-1ubuntu1_arm64",
+					"name": "libseccomp2",
+					"version": "2.5.5-1ubuntu1"
+				},
+				{
+					"key": "libgnutls30_3.8.3-1ubuntu1_arm64",
+					"name": "libgnutls30",
+					"version": "3.8.3-1ubuntu1"
+				},
+				{
+					"key": "libunistring5_1.1-2_arm64",
+					"name": "libunistring5",
+					"version": "1.1-2"
+				},
+				{
+					"key": "libtasn1-6_4.19.0-3_arm64",
+					"name": "libtasn1-6",
+					"version": "4.19.0-3"
+				},
+				{
+					"key": "libp11-kit0_0.25.3-4ubuntu1_arm64",
+					"name": "libp11-kit0",
+					"version": "0.25.3-4ubuntu1"
+				},
+				{
+					"key": "libffi8_3.4.6-1_arm64",
+					"name": "libffi8",
+					"version": "3.4.6-1"
+				},
+				{
+					"key": "libnettle8_3.9.1-2_arm64",
+					"name": "libnettle8",
+					"version": "3.9.1-2"
+				},
+				{
+					"key": "libidn2-0_2.3.7-2_arm64",
+					"name": "libidn2-0",
+					"version": "2.3.7-2"
+				},
+				{
+					"key": "libhogweed6_3.9.1-2_arm64",
+					"name": "libhogweed6",
+					"version": "3.9.1-2"
+				},
+				{
+					"key": "libgmp10_2-6.3.0-p-dfsg-2ubuntu4_arm64",
+					"name": "libgmp10",
+					"version": "2:6.3.0+dfsg-2ubuntu4"
+				},
+				{
+					"key": "ubuntu-keyring_2023.11.28.1_arm64",
+					"name": "ubuntu-keyring",
+					"version": "2023.11.28.1"
+				},
+				{
+					"key": "libapt-pkg6.0_2.7.12_arm64",
+					"name": "libapt-pkg6.0",
+					"version": "2.7.12"
+				},
+				{
+					"key": "zlib1g_1-1.3.dfsg-3ubuntu1_arm64",
+					"name": "zlib1g",
+					"version": "1:1.3.dfsg-3ubuntu1"
+				},
+				{
+					"key": "libxxhash0_0.8.2-2_arm64",
+					"name": "libxxhash0",
+					"version": "0.8.2-2"
+				},
+				{
+					"key": "libudev1_255.2-3ubuntu2_arm64",
+					"name": "libudev1",
+					"version": "255.2-3ubuntu2"
+				},
+				{
+					"key": "libbz2-1.0_1.0.8-5ubuntu1_arm64",
+					"name": "libbz2-1.0",
+					"version": "1.0.8-5ubuntu1"
+				},
+				{
+					"key": "gpgv_2.4.4-2ubuntu7_arm64",
+					"name": "gpgv",
+					"version": "2.4.4-2ubuntu7"
+				},
+				{
+					"key": "libnpth0_1.6-3build2_arm64",
+					"name": "libnpth0",
+					"version": "1.6-3build2"
+				},
+				{
+					"key": "libassuan0_2.5.6-1_arm64",
+					"name": "libassuan0",
+					"version": "2.5.6-1"
+				},
+				{
+					"key": "base-passwd_3.6.3_arm64",
+					"name": "base-passwd",
+					"version": "3.6.3"
+				},
+				{
+					"key": "libselinux1_3.5-2build1_arm64",
+					"name": "libselinux1",
+					"version": "3.5-2build1"
+				},
+				{
+					"key": "libpcre2-8-0_10.42-4ubuntu1_arm64",
+					"name": "libpcre2-8-0",
+					"version": "10.42-4ubuntu1"
+				},
+				{
+					"key": "libdebconfclient0_0.271ubuntu1_arm64",
+					"name": "libdebconfclient0",
+					"version": "0.271ubuntu1"
+				}
+			],
+			"key": "apt_2.7.12_arm64",
+			"name": "apt",
+			"sha256": "a0f922f9133bff9b87f5887757434ab94c04efe9fb3f96ecb0a9acca845f5b28",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/a/apt/apt_2.7.12_arm64.deb"
+			],
+			"version": "2.7.12"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libsystemd0_255.2-3ubuntu2_arm64",
+			"name": "libsystemd0",
+			"sha256": "7cccc1271839ac53030490b84de797239db5bf53bb623a87e8762385b17136a1",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/s/systemd/libsystemd0_255.2-3ubuntu2_arm64.deb"
+			],
+			"version": "255.2-3ubuntu2"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "liblz4-1_1.9.4-1_arm64",
+			"name": "liblz4-1",
+			"sha256": "3ca249f3f32308f8465b9c7447517b1e860539609e590d98b45c1878fad83c55",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/l/lz4/liblz4-1_1.9.4-1_arm64.deb"
+			],
+			"version": "1.9.4-1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libgcrypt20_1.10.3-2_arm64",
+			"name": "libgcrypt20",
+			"sha256": "fc9bf9dc690198d52aab5cbd325ce9b7f6ff2060cea320e35e5be741bcdbd863",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libg/libgcrypt20/libgcrypt20_1.10.3-2_arm64.deb"
+			],
+			"version": "1.10.3-2"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libgpg-error0_1.47-3build1_arm64",
+			"name": "libgpg-error0",
+			"sha256": "431841c82321886700592874b5042f64908e53bb9560eff351664a9c38a22eaf",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libg/libgpg-error/libgpg-error0_1.47-3build1_arm64.deb"
+			],
+			"version": "1.47-3build1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libcap2_1-2.66-5ubuntu1_arm64",
+			"name": "libcap2",
+			"sha256": "f9e54bda3c9b38cdd95dccfaca37ba2a46220414116506f256e235307d5b7209",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libc/libcap2/libcap2_2.66-5ubuntu1_arm64.deb"
+			],
+			"version": "1:2.66-5ubuntu1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libstdc-p--p-6_14-20240221-2.1ubuntu1_arm64",
+			"name": "libstdc++6",
+			"sha256": "538f5a9f9b7bfdff1e0317b6d1e21a7b6fdef8d82d07036c89716e35266a4cbf",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/g/gcc-14/libstdc++6_14-20240221-2.1ubuntu1_arm64.deb"
+			],
+			"version": "14-20240221-2.1ubuntu1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libseccomp2_2.5.5-1ubuntu1_arm64",
+			"name": "libseccomp2",
+			"sha256": "b11084b3907453470014cc95d30e3217c0c655b2c4a29891a3ab27ebfeaa9674",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libs/libseccomp/libseccomp2_2.5.5-1ubuntu1_arm64.deb"
+			],
+			"version": "2.5.5-1ubuntu1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libgnutls30_3.8.3-1ubuntu1_arm64",
+			"name": "libgnutls30",
+			"sha256": "5cd70f6fa56513bb91144bb3877d20315cd01ab57d1ff862762983b4dae3e9ed",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/g/gnutls28/libgnutls30_3.8.3-1ubuntu1_arm64.deb"
+			],
+			"version": "3.8.3-1ubuntu1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libunistring5_1.1-2_arm64",
+			"name": "libunistring5",
+			"sha256": "caf4c2c543f9204ff05308966440030d0878ab639ffbbbd667d160b64e1ee645",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libu/libunistring/libunistring5_1.1-2_arm64.deb"
+			],
+			"version": "1.1-2"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libtasn1-6_4.19.0-3_arm64",
+			"name": "libtasn1-6",
+			"sha256": "6ee67d52a802f55d419b52125796407d36a6e731f21f8f5d29101a2086d521bd",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libt/libtasn1-6/libtasn1-6_4.19.0-3_arm64.deb"
+			],
+			"version": "4.19.0-3"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libp11-kit0_0.25.3-4ubuntu1_arm64",
+			"name": "libp11-kit0",
+			"sha256": "1d2e7b8b7755f3a0fccec3d5ef0248a98f17cef0e352f2ff4a2f00a8fe30561e",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/p/p11-kit/libp11-kit0_0.25.3-4ubuntu1_arm64.deb"
+			],
+			"version": "0.25.3-4ubuntu1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libffi8_3.4.6-1_arm64",
+			"name": "libffi8",
+			"sha256": "420c53c1715064d8dd8c04805d43e9ed422455d09185aecc77ec45295d326bcc",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libf/libffi/libffi8_3.4.6-1_arm64.deb"
+			],
+			"version": "3.4.6-1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libnettle8_3.9.1-2_arm64",
+			"name": "libnettle8",
+			"sha256": "0d8860e05b6d440b34edbf46e88db2bfc6298063285b3f9eab567f8aa1af7983",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/n/nettle/libnettle8_3.9.1-2_arm64.deb"
+			],
+			"version": "3.9.1-2"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libidn2-0_2.3.7-2_arm64",
+			"name": "libidn2-0",
+			"sha256": "68e9d51078a345540829cd4ae4d95912f1c3ec3aaf454984e3393081d8d92e6f",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libi/libidn2/libidn2-0_2.3.7-2_arm64.deb"
+			],
+			"version": "2.3.7-2"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libhogweed6_3.9.1-2_arm64",
+			"name": "libhogweed6",
+			"sha256": "6b378b847a96dd187789c02a314ea6aa02a9894f53fcbcf166b1f4a7383d596a",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/n/nettle/libhogweed6_3.9.1-2_arm64.deb"
+			],
+			"version": "3.9.1-2"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "ubuntu-keyring_2023.11.28.1_arm64",
+			"name": "ubuntu-keyring",
+			"sha256": "36de43b15853ccae0028e9a767613770c704833f82586f28eb262f0311adb8a8",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/u/ubuntu-keyring/ubuntu-keyring_2023.11.28.1_all.deb"
+			],
+			"version": "2023.11.28.1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libapt-pkg6.0_2.7.12_arm64",
+			"name": "libapt-pkg6.0",
+			"sha256": "74a6337693c313bb4b563fcf829b06b5e209827bf91ed202e5407490e0ec5d26",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/a/apt/libapt-pkg6.0_2.7.12_arm64.deb"
+			],
+			"version": "2.7.12"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libxxhash0_0.8.2-2_arm64",
+			"name": "libxxhash0",
+			"sha256": "24c2da6d81871201d5a1e0bf5e718314438cad697d5f445bf579c37120331896",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/x/xxhash/libxxhash0_0.8.2-2_arm64.deb"
+			],
+			"version": "0.8.2-2"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libudev1_255.2-3ubuntu2_arm64",
+			"name": "libudev1",
+			"sha256": "db9af267ca5e6148c9b6328dcb98643e0e7729f208e95916042aa87f363c2078",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/s/systemd/libudev1_255.2-3ubuntu2_arm64.deb"
+			],
+			"version": "255.2-3ubuntu2"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "gpgv_2.4.4-2ubuntu7_arm64",
+			"name": "gpgv",
+			"sha256": "0b536711c2b86f7f793626df517eae887c9ac4c0582f3f50966ac5fa3ac62fb5",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/g/gnupg2/gpgv_2.4.4-2ubuntu7_arm64.deb"
+			],
+			"version": "2.4.4-2ubuntu7"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libnpth0_1.6-3build2_arm64",
+			"name": "libnpth0",
+			"sha256": "433259a1f7ef32e9dcc83c5e2c596cae5571eefd0131e3c44c52fb58f81d6b7c",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/n/npth/libnpth0_1.6-3build2_arm64.deb"
+			],
+			"version": "1.6-3build2"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libassuan0_2.5.6-1_arm64",
+			"name": "libassuan0",
+			"sha256": "b93a9d3e3351269fb4e612e5a4b42b14f068514be40897e484170ac82bb6d7b7",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/liba/libassuan/libassuan0_2.5.6-1_arm64.deb"
+			],
+			"version": "2.5.6-1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "base-passwd_3.6.3_arm64",
+			"name": "base-passwd",
+			"sha256": "95e5977995a220037c910d26148b2241df579ff5c15c888b85afbd28f4606ac8",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/b/base-passwd/base-passwd_3.6.3_arm64.deb"
+			],
+			"version": "3.6.3"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libdebconfclient0_0.271ubuntu1_arm64",
+			"name": "libdebconfclient0",
+			"sha256": "302606395d557b178dae0b83b78e4af8ec2de6935db51dcd447bda868691f91a",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/c/cdebconf/libdebconfclient0_0.271ubuntu1_arm64.deb"
+			],
+			"version": "0.271ubuntu1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [
+				{
+					"key": "libperl5.38_5.38.2-3_arm64",
+					"name": "libperl5.38",
+					"version": "5.38.2-3"
+				},
+				{
+					"key": "perl-modules-5.38_5.38.2-3_arm64",
+					"name": "perl-modules-5.38",
+					"version": "5.38.2-3"
+				},
+				{
+					"key": "perl-base_5.38.2-3_arm64",
+					"name": "perl-base",
+					"version": "5.38.2-3"
+				},
+				{
+					"key": "dpkg_1.22.4ubuntu5_arm64",
+					"name": "dpkg",
+					"version": "1.22.4ubuntu5"
+				},
+				{
+					"key": "tar_1.35-p-dfsg-3_arm64",
+					"name": "tar",
+					"version": "1.35+dfsg-3"
+				},
+				{
+					"key": "libselinux1_3.5-2build1_arm64",
+					"name": "libselinux1",
+					"version": "3.5-2build1"
+				},
+				{
+					"key": "libpcre2-8-0_10.42-4ubuntu1_arm64",
+					"name": "libpcre2-8-0",
+					"version": "10.42-4ubuntu1"
+				},
+				{
+					"key": "libc6_2.39-0ubuntu2_arm64",
+					"name": "libc6",
+					"version": "2.39-0ubuntu2"
+				},
+				{
+					"key": "libgcc-s1_14-20240221-2.1ubuntu1_arm64",
+					"name": "libgcc-s1",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "gcc-14-base_14-20240221-2.1ubuntu1_arm64",
+					"name": "gcc-14-base",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "libacl1_2.3.2-1_arm64",
+					"name": "libacl1",
+					"version": "2.3.2-1"
+				},
+				{
+					"key": "zlib1g_1-1.3.dfsg-3ubuntu1_arm64",
+					"name": "zlib1g",
+					"version": "1:1.3.dfsg-3ubuntu1"
+				},
+				{
+					"key": "libzstd1_1.5.5-p-dfsg2-2_arm64",
+					"name": "libzstd1",
+					"version": "1.5.5+dfsg2-2"
+				},
+				{
+					"key": "libmd0_1.1.0-2_arm64",
+					"name": "libmd0",
+					"version": "1.1.0-2"
+				},
+				{
+					"key": "liblzma5_5.4.5-0.3_arm64",
+					"name": "liblzma5",
+					"version": "5.4.5-0.3"
+				},
+				{
+					"key": "libbz2-1.0_1.0.8-5ubuntu1_arm64",
+					"name": "libbz2-1.0",
+					"version": "1.0.8-5ubuntu1"
+				},
+				{
+					"key": "libcrypt1_1-4.4.36-4_arm64",
+					"name": "libcrypt1",
+					"version": "1:4.4.36-4"
+				},
+				{
+					"key": "libgdbm6_1.23-5_arm64",
+					"name": "libgdbm6",
+					"version": "1.23-5"
+				},
+				{
+					"key": "libgdbm-compat4_1.23-5_arm64",
+					"name": "libgdbm-compat4",
+					"version": "1.23-5"
+				},
+				{
+					"key": "libdb5.3_5.3.28-p-dfsg2-4_arm64",
+					"name": "libdb5.3",
+					"version": "5.3.28+dfsg2-4"
+				}
+			],
+			"key": "perl_5.38.2-3_arm64",
+			"name": "perl",
+			"sha256": "649812e92fd35d1cd3d8b71233a7fda8e56fb7da761376904607d8233a37cbac",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/p/perl/perl_5.38.2-3_arm64.deb"
+			],
+			"version": "5.38.2-3"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libperl5.38_5.38.2-3_arm64",
+			"name": "libperl5.38",
+			"sha256": "c6256802c884974ed62e3e11bbee7c36cc0075679c5f7b6289692a7ed036476a",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/p/perl/libperl5.38_5.38.2-3_arm64.deb"
+			],
+			"version": "5.38.2-3"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "perl-modules-5.38_5.38.2-3_arm64",
+			"name": "perl-modules-5.38",
+			"sha256": "127dd76635d1d3d135caa5bbc4d5ae96a1c88a36c21313602c4c416270040849",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/p/perl/perl-modules-5.38_5.38.2-3_all.deb"
+			],
+			"version": "5.38.2-3"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "perl-base_5.38.2-3_arm64",
+			"name": "perl-base",
+			"sha256": "b502331d6d9198caec0df1230980cbb2a0ee8b08edbf1a73f776d87f2377c293",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/p/perl/perl-base_5.38.2-3_arm64.deb"
+			],
+			"version": "5.38.2-3"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libgdbm6_1.23-5_arm64",
+			"name": "libgdbm6",
+			"sha256": "ef9cecd3ce774b709a226f234eaf11b66a9a1aeae96f5d14600882192aab304a",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/g/gdbm/libgdbm6_1.23-5_arm64.deb"
+			],
+			"version": "1.23-5"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libgdbm-compat4_1.23-5_arm64",
+			"name": "libgdbm-compat4",
+			"sha256": "eb0ada72e019ce958cc01c09419a61215f6c9ffb468eed59944dce21060f6354",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/g/gdbm/libgdbm-compat4_1.23-5_arm64.deb"
+			],
+			"version": "1.23-5"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libdb5.3_5.3.28-p-dfsg2-4_arm64",
+			"name": "libdb5.3",
+			"sha256": "522c7f6719d3e950eb6e7809af4c072a137c2c29927a0167745a997582ea7cde",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/d/db5.3/libdb5.3_5.3.28+dfsg2-4_arm64.deb"
+			],
+			"version": "5.3.28+dfsg2-4"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [
+				{
+					"key": "git-man_1-2.43.0-1ubuntu1_arm64",
+					"name": "git-man",
+					"version": "1:2.43.0-1ubuntu1"
+				},
+				{
+					"key": "liberror-perl_0.17029-2_arm64",
+					"name": "liberror-perl",
+					"version": "0.17029-2"
+				},
+				{
+					"key": "perl_5.38.2-3_arm64",
+					"name": "perl",
+					"version": "5.38.2-3"
+				},
+				{
+					"key": "libperl5.38_5.38.2-3_arm64",
+					"name": "libperl5.38",
+					"version": "5.38.2-3"
+				},
+				{
+					"key": "perl-modules-5.38_5.38.2-3_arm64",
+					"name": "perl-modules-5.38",
+					"version": "5.38.2-3"
+				},
+				{
+					"key": "perl-base_5.38.2-3_arm64",
+					"name": "perl-base",
+					"version": "5.38.2-3"
+				},
+				{
+					"key": "dpkg_1.22.4ubuntu5_arm64",
+					"name": "dpkg",
+					"version": "1.22.4ubuntu5"
+				},
+				{
+					"key": "tar_1.35-p-dfsg-3_arm64",
+					"name": "tar",
+					"version": "1.35+dfsg-3"
+				},
+				{
+					"key": "libselinux1_3.5-2build1_arm64",
+					"name": "libselinux1",
+					"version": "3.5-2build1"
+				},
+				{
+					"key": "libpcre2-8-0_10.42-4ubuntu1_arm64",
+					"name": "libpcre2-8-0",
+					"version": "10.42-4ubuntu1"
+				},
+				{
+					"key": "libc6_2.39-0ubuntu2_arm64",
+					"name": "libc6",
+					"version": "2.39-0ubuntu2"
+				},
+				{
+					"key": "libgcc-s1_14-20240221-2.1ubuntu1_arm64",
+					"name": "libgcc-s1",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "gcc-14-base_14-20240221-2.1ubuntu1_arm64",
+					"name": "gcc-14-base",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "libacl1_2.3.2-1_arm64",
+					"name": "libacl1",
+					"version": "2.3.2-1"
+				},
+				{
+					"key": "zlib1g_1-1.3.dfsg-3ubuntu1_arm64",
+					"name": "zlib1g",
+					"version": "1:1.3.dfsg-3ubuntu1"
+				},
+				{
+					"key": "libzstd1_1.5.5-p-dfsg2-2_arm64",
+					"name": "libzstd1",
+					"version": "1.5.5+dfsg2-2"
+				},
+				{
+					"key": "libmd0_1.1.0-2_arm64",
+					"name": "libmd0",
+					"version": "1.1.0-2"
+				},
+				{
+					"key": "liblzma5_5.4.5-0.3_arm64",
+					"name": "liblzma5",
+					"version": "5.4.5-0.3"
+				},
+				{
+					"key": "libbz2-1.0_1.0.8-5ubuntu1_arm64",
+					"name": "libbz2-1.0",
+					"version": "1.0.8-5ubuntu1"
+				},
+				{
+					"key": "libcrypt1_1-4.4.36-4_arm64",
+					"name": "libcrypt1",
+					"version": "1:4.4.36-4"
+				},
+				{
+					"key": "libgdbm6_1.23-5_arm64",
+					"name": "libgdbm6",
+					"version": "1.23-5"
+				},
+				{
+					"key": "libgdbm-compat4_1.23-5_arm64",
+					"name": "libgdbm-compat4",
+					"version": "1.23-5"
+				},
+				{
+					"key": "libdb5.3_5.3.28-p-dfsg2-4_arm64",
+					"name": "libdb5.3",
+					"version": "5.3.28+dfsg2-4"
+				},
+				{
+					"key": "libexpat1_2.6.0-1_arm64",
+					"name": "libexpat1",
+					"version": "2.6.0-1"
+				},
+				{
+					"key": "libcurl3-gnutls_8.5.0-2ubuntu2_arm64",
+					"name": "libcurl3-gnutls",
+					"version": "8.5.0-2ubuntu2"
+				},
+				{
+					"key": "libssh-4_0.10.6-2_arm64",
+					"name": "libssh-4",
+					"version": "0.10.6-2"
+				},
+				{
+					"key": "libssl3_3.0.10-1ubuntu4_arm64",
+					"name": "libssl3",
+					"version": "3.0.10-1ubuntu4"
+				},
+				{
+					"key": "libgssapi-krb5-2_1.20.1-5build1_arm64",
+					"name": "libgssapi-krb5-2",
+					"version": "1.20.1-5build1"
+				},
+				{
+					"key": "libkrb5support0_1.20.1-5build1_arm64",
+					"name": "libkrb5support0",
+					"version": "1.20.1-5build1"
+				},
+				{
+					"key": "libk5crypto3_1.20.1-5build1_arm64",
+					"name": "libk5crypto3",
+					"version": "1.20.1-5build1"
+				},
+				{
+					"key": "libcom-err2_1.47.0-2ubuntu1_arm64",
+					"name": "libcom-err2",
+					"version": "1.47.0-2ubuntu1"
+				},
+				{
+					"key": "libkrb5-3_1.20.1-5build1_arm64",
+					"name": "libkrb5-3",
+					"version": "1.20.1-5build1"
+				},
+				{
+					"key": "libkeyutils1_1.6.3-3_arm64",
+					"name": "libkeyutils1",
+					"version": "1.6.3-3"
+				},
+				{
+					"key": "librtmp1_2.4-p-20151223.gitfa8646d.1-2build4_arm64",
+					"name": "librtmp1",
+					"version": "2.4+20151223.gitfa8646d.1-2build4"
+				},
+				{
+					"key": "libnettle8_3.9.1-2_arm64",
+					"name": "libnettle8",
+					"version": "3.9.1-2"
+				},
+				{
+					"key": "libhogweed6_3.9.1-2_arm64",
+					"name": "libhogweed6",
+					"version": "3.9.1-2"
+				},
+				{
+					"key": "libgmp10_2-6.3.0-p-dfsg-2ubuntu4_arm64",
+					"name": "libgmp10",
+					"version": "2:6.3.0+dfsg-2ubuntu4"
+				},
+				{
+					"key": "libgnutls30_3.8.3-1ubuntu1_arm64",
+					"name": "libgnutls30",
+					"version": "3.8.3-1ubuntu1"
+				},
+				{
+					"key": "libunistring5_1.1-2_arm64",
+					"name": "libunistring5",
+					"version": "1.1-2"
+				},
+				{
+					"key": "libtasn1-6_4.19.0-3_arm64",
+					"name": "libtasn1-6",
+					"version": "4.19.0-3"
+				},
+				{
+					"key": "libp11-kit0_0.25.3-4ubuntu1_arm64",
+					"name": "libp11-kit0",
+					"version": "0.25.3-4ubuntu1"
+				},
+				{
+					"key": "libffi8_3.4.6-1_arm64",
+					"name": "libffi8",
+					"version": "3.4.6-1"
+				},
+				{
+					"key": "libidn2-0_2.3.7-2_arm64",
+					"name": "libidn2-0",
+					"version": "2.3.7-2"
+				},
+				{
+					"key": "libpsl5_0.21.2-1build1_arm64",
+					"name": "libpsl5",
+					"version": "0.21.2-1build1"
+				},
+				{
+					"key": "libnghttp2-14_1.59.0-1_arm64",
+					"name": "libnghttp2-14",
+					"version": "1.59.0-1"
+				},
+				{
+					"key": "libldap2_2.6.7-p-dfsg-1_exp1ubuntu1_arm64",
+					"name": "libldap2",
+					"version": "2.6.7+dfsg-1~exp1ubuntu1"
+				},
+				{
+					"key": "libsasl2-2_2.1.28-p-dfsg1-4_arm64",
+					"name": "libsasl2-2",
+					"version": "2.1.28+dfsg1-4"
+				},
+				{
+					"key": "libsasl2-modules-db_2.1.28-p-dfsg1-4_arm64",
+					"name": "libsasl2-modules-db",
+					"version": "2.1.28+dfsg1-4"
+				},
+				{
+					"key": "libbrotli1_1.1.0-2_arm64",
+					"name": "libbrotli1",
+					"version": "1.1.0-2"
+				}
+			],
+			"key": "git_1-2.43.0-1ubuntu1_arm64",
+			"name": "git",
+			"sha256": "d976905603733da8af5c9b545f8dfa9b934205d03ada67bd0f1afdee75099114",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/g/git/git_2.43.0-1ubuntu1_arm64.deb"
+			],
+			"version": "1:2.43.0-1ubuntu1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "git-man_1-2.43.0-1ubuntu1_arm64",
+			"name": "git-man",
+			"sha256": "0761c69017927d6621ba6a50b7f0beb48bc717a43a20e0be523ba802c5e82bbf",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/g/git/git-man_2.43.0-1ubuntu1_all.deb"
+			],
+			"version": "1:2.43.0-1ubuntu1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "liberror-perl_0.17029-2_arm64",
+			"name": "liberror-perl",
+			"sha256": "1907af6bf33dd8684447c09f216c675d2b8559fadd8ddace29fbf83c6fb2a636",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libe/liberror-perl/liberror-perl_0.17029-2_all.deb"
+			],
+			"version": "0.17029-2"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libexpat1_2.6.0-1_arm64",
+			"name": "libexpat1",
+			"sha256": "2579f83240dcc6d8b74519f7eed7f358ed7afe67b1c14328561043dd1032e38b",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/e/expat/libexpat1_2.6.0-1_arm64.deb"
+			],
+			"version": "2.6.0-1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libcurl3-gnutls_8.5.0-2ubuntu2_arm64",
+			"name": "libcurl3-gnutls",
+			"sha256": "6dc8de4c26aeee5efdbb4d82bba29326a644954489ecd8756e2ee78e493be813",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/c/curl/libcurl3-gnutls_8.5.0-2ubuntu2_arm64.deb"
+			],
+			"version": "8.5.0-2ubuntu2"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libssh-4_0.10.6-2_arm64",
+			"name": "libssh-4",
+			"sha256": "47fbeae1add62d03f9cbb87b0f5f3b1fbee44a2ced7705c6d993296ebb963ef9",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libs/libssh/libssh-4_0.10.6-2_arm64.deb"
+			],
+			"version": "0.10.6-2"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libssl3_3.0.10-1ubuntu4_arm64",
+			"name": "libssl3",
+			"sha256": "099edcd61836211215ca53d42aab16789a062e6e743ae759632ae8f44e18ff88",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/o/openssl/libssl3_3.0.10-1ubuntu4_arm64.deb"
+			],
+			"version": "3.0.10-1ubuntu4"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libgssapi-krb5-2_1.20.1-5build1_arm64",
+			"name": "libgssapi-krb5-2",
+			"sha256": "619c3c5ec698dee8b6132eb110c237e46f72b8582e76a8ad129e2b3a4b7f9b88",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/k/krb5/libgssapi-krb5-2_1.20.1-5build1_arm64.deb"
+			],
+			"version": "1.20.1-5build1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libkrb5support0_1.20.1-5build1_arm64",
+			"name": "libkrb5support0",
+			"sha256": "59a22fd52382e9e0107f81ad6b17336349a63284b38b50b39db1e3d8de50620e",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/k/krb5/libkrb5support0_1.20.1-5build1_arm64.deb"
+			],
+			"version": "1.20.1-5build1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libk5crypto3_1.20.1-5build1_arm64",
+			"name": "libk5crypto3",
+			"sha256": "dd396f659c201f86a9c890acf1294ea316bd58df748e64c4d28b81dcf80880fb",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/k/krb5/libk5crypto3_1.20.1-5build1_arm64.deb"
+			],
+			"version": "1.20.1-5build1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libcom-err2_1.47.0-2ubuntu1_arm64",
+			"name": "libcom-err2",
+			"sha256": "23d581613e369725991077bf80e1a9aaa9a0df619b9142124b4f186e74688a1e",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/e/e2fsprogs/libcom-err2_1.47.0-2ubuntu1_arm64.deb"
+			],
+			"version": "1.47.0-2ubuntu1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libkrb5-3_1.20.1-5build1_arm64",
+			"name": "libkrb5-3",
+			"sha256": "80c00be3b8635be65352ec5c667311a280557ed33a73869bf362eeac72de47bb",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/k/krb5/libkrb5-3_1.20.1-5build1_arm64.deb"
+			],
+			"version": "1.20.1-5build1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libkeyutils1_1.6.3-3_arm64",
+			"name": "libkeyutils1",
+			"sha256": "3045b37fe2ce908b3f7094de119fc106ba255b49a8137dc81f06e6cd211e54f1",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/k/keyutils/libkeyutils1_1.6.3-3_arm64.deb"
+			],
+			"version": "1.6.3-3"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "librtmp1_2.4-p-20151223.gitfa8646d.1-2build4_arm64",
+			"name": "librtmp1",
+			"sha256": "f3b867a5a81382f8edcabfd3415465158eb952f018f960090141b5e188b8b28c",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/r/rtmpdump/librtmp1_2.4+20151223.gitfa8646d.1-2build4_arm64.deb"
+			],
+			"version": "2.4+20151223.gitfa8646d.1-2build4"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libpsl5_0.21.2-1build1_arm64",
+			"name": "libpsl5",
+			"sha256": "ef2d5e96e6c1f51e699b934e9010f4e725dc83ca626c23bd44510396fc4c2fb3",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libp/libpsl/libpsl5_0.21.2-1build1_arm64.deb"
+			],
+			"version": "0.21.2-1build1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libnghttp2-14_1.59.0-1_arm64",
+			"name": "libnghttp2-14",
+			"sha256": "687e934fd7894015430ea6472b6437440552b1adb0f02bb0e24502cd9829c1e1",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/n/nghttp2/libnghttp2-14_1.59.0-1_arm64.deb"
+			],
+			"version": "1.59.0-1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libldap2_2.6.7-p-dfsg-1_exp1ubuntu1_arm64",
+			"name": "libldap2",
+			"sha256": "7949f578cedd16f22c47b238984584bec5ce950254cac134e4bb5579de65dcd6",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/o/openldap/libldap2_2.6.7+dfsg-1~exp1ubuntu1_arm64.deb"
+			],
+			"version": "2.6.7+dfsg-1~exp1ubuntu1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libsasl2-2_2.1.28-p-dfsg1-4_arm64",
+			"name": "libsasl2-2",
+			"sha256": "4f7a6314b3d158b0ea958022bb235f6f9ab5edc3db657577bff78abc7f182667",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/c/cyrus-sasl2/libsasl2-2_2.1.28+dfsg1-4_arm64.deb"
+			],
+			"version": "2.1.28+dfsg1-4"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libsasl2-modules-db_2.1.28-p-dfsg1-4_arm64",
+			"name": "libsasl2-modules-db",
+			"sha256": "83feca5a6ea1b3a2515a5032c42d0c7eeed15cdf7deeca0c6098a19eb049f4d0",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/c/cyrus-sasl2/libsasl2-modules-db_2.1.28+dfsg1-4_arm64.deb"
+			],
+			"version": "2.1.28+dfsg1-4"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libbrotli1_1.1.0-2_arm64",
+			"name": "libbrotli1",
+			"sha256": "498d061e62f4fba151e77403a860232a2b265dfbbd84f1fe6b54981c1a759d33",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/b/brotli/libbrotli1_1.1.0-2_arm64.deb"
+			],
+			"version": "1.1.0-2"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [
+				{
+					"key": "libpython3-stdlib_3.12.1-0ubuntu1_arm64",
+					"name": "libpython3-stdlib",
+					"version": "3.12.1-0ubuntu1"
+				},
+				{
+					"key": "libpython3.12-stdlib_3.12.2-1_arm64",
+					"name": "libpython3.12-stdlib",
+					"version": "3.12.2-1"
+				},
+				{
+					"key": "libuuid1_2.39.3-6ubuntu2_arm64",
+					"name": "libuuid1",
+					"version": "2.39.3-6ubuntu2"
+				},
+				{
+					"key": "libc6_2.39-0ubuntu2_arm64",
+					"name": "libc6",
+					"version": "2.39-0ubuntu2"
+				},
+				{
+					"key": "libgcc-s1_14-20240221-2.1ubuntu1_arm64",
+					"name": "libgcc-s1",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "gcc-14-base_14-20240221-2.1ubuntu1_arm64",
+					"name": "gcc-14-base",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "libtirpc3_1.3.4-p-ds-1build1_arm64",
+					"name": "libtirpc3",
+					"version": "1.3.4+ds-1build1"
+				},
+				{
+					"key": "libtirpc-common_1.3.4-p-ds-1build1_arm64",
+					"name": "libtirpc-common",
+					"version": "1.3.4+ds-1build1"
+				},
+				{
+					"key": "libgssapi-krb5-2_1.20.1-5build1_arm64",
+					"name": "libgssapi-krb5-2",
+					"version": "1.20.1-5build1"
+				},
+				{
+					"key": "libkrb5support0_1.20.1-5build1_arm64",
+					"name": "libkrb5support0",
+					"version": "1.20.1-5build1"
+				},
+				{
+					"key": "libk5crypto3_1.20.1-5build1_arm64",
+					"name": "libk5crypto3",
+					"version": "1.20.1-5build1"
+				},
+				{
+					"key": "libcom-err2_1.47.0-2ubuntu1_arm64",
+					"name": "libcom-err2",
+					"version": "1.47.0-2ubuntu1"
+				},
+				{
+					"key": "libkrb5-3_1.20.1-5build1_arm64",
+					"name": "libkrb5-3",
+					"version": "1.20.1-5build1"
+				},
+				{
+					"key": "libssl3_3.0.10-1ubuntu4_arm64",
+					"name": "libssl3",
+					"version": "3.0.10-1ubuntu4"
+				},
+				{
+					"key": "libkeyutils1_1.6.3-3_arm64",
+					"name": "libkeyutils1",
+					"version": "1.6.3-3"
+				},
+				{
+					"key": "libtinfo6_6.4-p-20240113-1ubuntu1_arm64",
+					"name": "libtinfo6",
+					"version": "6.4+20240113-1ubuntu1"
+				},
+				{
+					"key": "libsqlite3-0_3.45.1-1_arm64",
+					"name": "libsqlite3-0",
+					"version": "3.45.1-1"
+				},
+				{
+					"key": "libreadline8_8.2-3_arm64",
+					"name": "libreadline8",
+					"version": "8.2-3"
+				},
+				{
+					"key": "readline-common_8.2-3_arm64",
+					"name": "readline-common",
+					"version": "8.2-3"
+				},
+				{
+					"key": "libnsl2_1.3.0-3_arm64",
+					"name": "libnsl2",
+					"version": "1.3.0-3"
+				},
+				{
+					"key": "libncursesw6_6.4-p-20240113-1ubuntu1_arm64",
+					"name": "libncursesw6",
+					"version": "6.4+20240113-1ubuntu1"
+				},
+				{
+					"key": "liblzma5_5.4.5-0.3_arm64",
+					"name": "liblzma5",
+					"version": "5.4.5-0.3"
+				},
+				{
+					"key": "libffi8_3.4.6-1_arm64",
+					"name": "libffi8",
+					"version": "3.4.6-1"
+				},
+				{
+					"key": "libdb5.3_5.3.28-p-dfsg2-4_arm64",
+					"name": "libdb5.3",
+					"version": "5.3.28+dfsg2-4"
+				},
+				{
+					"key": "libcrypt1_1-4.4.36-4_arm64",
+					"name": "libcrypt1",
+					"version": "1:4.4.36-4"
+				},
+				{
+					"key": "libbz2-1.0_1.0.8-5ubuntu1_arm64",
+					"name": "libbz2-1.0",
+					"version": "1.0.8-5ubuntu1"
+				},
+				{
+					"key": "tzdata_2024a-1ubuntu1_arm64",
+					"name": "tzdata",
+					"version": "2024a-1ubuntu1"
+				},
+				{
+					"key": "debconf_1.5.86_arm64",
+					"name": "debconf",
+					"version": "1.5.86"
+				},
+				{
+					"key": "netbase_6.4_arm64",
+					"name": "netbase",
+					"version": "6.4"
+				},
+				{
+					"key": "media-types_10.1.0_arm64",
+					"name": "media-types",
+					"version": "10.1.0"
+				},
+				{
+					"key": "libpython3.12-minimal_3.12.2-1_arm64",
+					"name": "libpython3.12-minimal",
+					"version": "3.12.2-1"
+				},
+				{
+					"key": "python3.12_3.12.2-1_arm64",
+					"name": "python3.12",
+					"version": "3.12.2-1"
+				},
+				{
+					"key": "python3.12-minimal_3.12.2-1_arm64",
+					"name": "python3.12-minimal",
+					"version": "3.12.2-1"
+				},
+				{
+					"key": "zlib1g_1-1.3.dfsg-3ubuntu1_arm64",
+					"name": "zlib1g",
+					"version": "1:1.3.dfsg-3ubuntu1"
+				},
+				{
+					"key": "libexpat1_2.6.0-1_arm64",
+					"name": "libexpat1",
+					"version": "2.6.0-1"
+				},
+				{
+					"key": "python3-minimal_3.12.1-0ubuntu1_arm64",
+					"name": "python3-minimal",
+					"version": "3.12.1-0ubuntu1"
+				},
+				{
+					"key": "dpkg_1.22.4ubuntu5_arm64",
+					"name": "dpkg",
+					"version": "1.22.4ubuntu5"
+				},
+				{
+					"key": "tar_1.35-p-dfsg-3_arm64",
+					"name": "tar",
+					"version": "1.35+dfsg-3"
+				},
+				{
+					"key": "libselinux1_3.5-2build1_arm64",
+					"name": "libselinux1",
+					"version": "3.5-2build1"
+				},
+				{
+					"key": "libpcre2-8-0_10.42-4ubuntu1_arm64",
+					"name": "libpcre2-8-0",
+					"version": "10.42-4ubuntu1"
+				},
+				{
+					"key": "libacl1_2.3.2-1_arm64",
+					"name": "libacl1",
+					"version": "2.3.2-1"
+				},
+				{
+					"key": "libzstd1_1.5.5-p-dfsg2-2_arm64",
+					"name": "libzstd1",
+					"version": "1.5.5+dfsg2-2"
+				},
+				{
+					"key": "libmd0_1.1.0-2_arm64",
+					"name": "libmd0",
+					"version": "1.1.0-2"
+				}
+			],
+			"key": "python3_3.12.1-0ubuntu1_arm64",
+			"name": "python3",
+			"sha256": "84a9ed520846a4c25850845a120795a0c985bf01327d41bb8492573e2c56a429",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/p/python3-defaults/python3_3.12.1-0ubuntu1_arm64.deb"
+			],
+			"version": "3.12.1-0ubuntu1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libpython3-stdlib_3.12.1-0ubuntu1_arm64",
+			"name": "libpython3-stdlib",
+			"sha256": "17e14207b1f9ef881ce6286ec7844d20f75fd09e902c80d798f9ada2d4ba7ba9",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/p/python3-defaults/libpython3-stdlib_3.12.1-0ubuntu1_arm64.deb"
+			],
+			"version": "3.12.1-0ubuntu1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libpython3.12-stdlib_3.12.2-1_arm64",
+			"name": "libpython3.12-stdlib",
+			"sha256": "deda21fecfc279fdd151b863aff38d4a649f79bb028ebfd2f4c3edb761fea208",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/p/python3.12/libpython3.12-stdlib_3.12.2-1_arm64.deb"
+			],
+			"version": "3.12.2-1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libuuid1_2.39.3-6ubuntu2_arm64",
+			"name": "libuuid1",
+			"sha256": "709eeec136f36388b37afe7c34648c940612acd30c6d7dd4c52d3d44185aac52",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/u/util-linux/libuuid1_2.39.3-6ubuntu2_arm64.deb"
+			],
+			"version": "2.39.3-6ubuntu2"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libtirpc3_1.3.4-p-ds-1build1_arm64",
+			"name": "libtirpc3",
+			"sha256": "6adf3febf78cd746d4e90bf52cf0291a166be1e1e8614cc4188c66016b42d252",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libt/libtirpc/libtirpc3_1.3.4+ds-1build1_arm64.deb"
+			],
+			"version": "1.3.4+ds-1build1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libtirpc-common_1.3.4-p-ds-1build1_arm64",
+			"name": "libtirpc-common",
+			"sha256": "083fd9df1073a97028e757d7a0c6826bd1d573bbfb16279a592cc3527f896ef7",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libt/libtirpc/libtirpc-common_1.3.4+ds-1build1_all.deb"
+			],
+			"version": "1.3.4+ds-1build1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libsqlite3-0_3.45.1-1_arm64",
+			"name": "libsqlite3-0",
+			"sha256": "b3db499a3decca86d9ca25f3cb1433d3a31bd91282c1d5da59c01a2e34bc0b62",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/s/sqlite3/libsqlite3-0_3.45.1-1_arm64.deb"
+			],
+			"version": "3.45.1-1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libreadline8_8.2-3_arm64",
+			"name": "libreadline8",
+			"sha256": "d9eea8cb591a8c88f421705a19052930846e898ff249d6cd6b63cc8d32175c34",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/r/readline/libreadline8_8.2-3_arm64.deb"
+			],
+			"version": "8.2-3"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "readline-common_8.2-3_arm64",
+			"name": "readline-common",
+			"sha256": "c1d35ee9016c974eea546063ffa567f98e18c13d40d7542e58730ff1dcdf4c8d",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/r/readline/readline-common_8.2-3_all.deb"
+			],
+			"version": "8.2-3"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libnsl2_1.3.0-3_arm64",
+			"name": "libnsl2",
+			"sha256": "078cd3bc6b6c5d08dc178d6b7037f635580c5e86d193c7c38544d95e063ac600",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/libn/libnsl/libnsl2_1.3.0-3_arm64.deb"
+			],
+			"version": "1.3.0-3"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libncursesw6_6.4-p-20240113-1ubuntu1_arm64",
+			"name": "libncursesw6",
+			"sha256": "23c9c42db272751a5f4cf3bc3aed99d75d86a0601858ad71a4829f18b3e4123a",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/n/ncurses/libncursesw6_6.4+20240113-1ubuntu1_arm64.deb"
+			],
+			"version": "6.4+20240113-1ubuntu1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "netbase_6.4_arm64",
+			"name": "netbase",
+			"sha256": "8cdbc9c3dca01e660759bf9d840f72e45ac72faf5d19ca1faecacaf6a60c1a87",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/n/netbase/netbase_6.4_all.deb"
+			],
+			"version": "6.4"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "media-types_10.1.0_arm64",
+			"name": "media-types",
+			"sha256": "31bfb7eec55ab6d34a50ba995150e1498d4cb897714085d8025e330d3b529747",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/m/media-types/media-types_10.1.0_all.deb"
+			],
+			"version": "10.1.0"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "libpython3.12-minimal_3.12.2-1_arm64",
+			"name": "libpython3.12-minimal",
+			"sha256": "2103927f56a1fdc3cb9b3308343e4779951443a0f023ad57a6c7aca0109f6487",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/p/python3.12/libpython3.12-minimal_3.12.2-1_arm64.deb"
+			],
+			"version": "3.12.2-1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "python3.12_3.12.2-1_arm64",
+			"name": "python3.12",
+			"sha256": "8eec8cb4da6c746ce73489d55798fbc1adeea57d4d388bbc8096a3e2a420fbff",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/p/python3.12/python3.12_3.12.2-1_arm64.deb"
+			],
+			"version": "3.12.2-1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "python3.12-minimal_3.12.2-1_arm64",
+			"name": "python3.12-minimal",
+			"sha256": "8dd01328fb71adeb08854e152723e3ed70c62aadb08ca6d82a73af4428f8f391",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/p/python3.12/python3.12-minimal_3.12.2-1_arm64.deb"
+			],
+			"version": "3.12.2-1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "python3-minimal_3.12.1-0ubuntu1_arm64",
+			"name": "python3-minimal",
+			"sha256": "91d180208d7edc35e4cd869016493cc069f3d52a8342711741ef86055a7daa5f",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/p/python3-defaults/python3-minimal_3.12.1-0ubuntu1_arm64.deb"
+			],
+			"version": "3.12.1-0ubuntu1"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [
+				{
+					"key": "debconf_1.5.86_arm64",
+					"name": "debconf",
+					"version": "1.5.86"
+				},
+				{
+					"key": "openssl_3.0.10-1ubuntu4_arm64",
+					"name": "openssl",
+					"version": "3.0.10-1ubuntu4"
+				},
+				{
+					"key": "libssl3_3.0.10-1ubuntu4_arm64",
+					"name": "libssl3",
+					"version": "3.0.10-1ubuntu4"
+				},
+				{
+					"key": "libc6_2.39-0ubuntu2_arm64",
+					"name": "libc6",
+					"version": "2.39-0ubuntu2"
+				},
+				{
+					"key": "libgcc-s1_14-20240221-2.1ubuntu1_arm64",
+					"name": "libgcc-s1",
+					"version": "14-20240221-2.1ubuntu1"
+				},
+				{
+					"key": "gcc-14-base_14-20240221-2.1ubuntu1_arm64",
+					"name": "gcc-14-base",
+					"version": "14-20240221-2.1ubuntu1"
+				}
+			],
+			"key": "ca-certificates_20240203_arm64",
+			"name": "ca-certificates",
+			"sha256": "641de77d8f142cfd62a1a6f964ba67b20754d3337c480efb529d086075a06c9a",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/c/ca-certificates/ca-certificates_20240203_all.deb"
+			],
+			"version": "20240203"
+		},
+		{
+			"arch": "arm64",
+			"dependencies": [],
+			"key": "openssl_3.0.10-1ubuntu4_arm64",
+			"name": "openssl",
+			"sha256": "ed8ed46e98e2e0e54b6a9acd4f5fa6a4d126b13490d0e19de27812c80a7d36a4",
+			"urls": [
+				"https://snapshot.ubuntu.com/ubuntu/20240301T030400Z/pool/main/o/openssl/openssl_3.0.10-1ubuntu4_arm64.deb"
+			],
+			"version": "3.0.10-1ubuntu4"
+		}
+	],
+	"version": 1
+}
\ No newline at end of file
diff --git a/k8s/container/coder-dev-base-image/noble.yaml b/k8s/container/coder-dev-base-image/noble.yaml
new file mode 100644
index 0000000..1791d54
--- /dev/null
+++ b/k8s/container/coder-dev-base-image/noble.yaml
@@ -0,0 +1,37 @@
+# Packages for examples/ubuntu_snapshot.
+#
+#  Anytime this file is changed, the lockfile needs to be regenerated.
+#
+#  To generate the noble.lock.json run the following command
+#
+#     bazel run @noble//:lock
+#
+# See debian_package_index at WORKSPACE.bazel
+version: 1
+
+sources:
+  - channel: noble main
+    url: https://snapshot.ubuntu.com/ubuntu/20240301T030400Z
+  - channel: noble-security main
+    url: https://snapshot.ubuntu.com/ubuntu/20240301T030400Z
+  - channel: noble-updates main
+    url: https://snapshot.ubuntu.com/ubuntu/20240301T030400Z
+
+archs:
+  - "amd64"
+  - "arm64"
+
+packages:
+  - "ncurses-base"
+  - "libncurses6"
+  - "tzdata"
+  - "bash"
+  - "coreutils" # for commands like `ls`
+  - "grep"
+  # for apt list --installed
+  - "dpkg"
+  - "apt"
+  - "perl"
+  - "git"
+  - "python3"
+  - "ca-certificates"
\ No newline at end of file
diff --git a/k8s/container/coder-dev-base-image/test_linux_amd64.yaml b/k8s/container/coder-dev-base-image/test_linux_amd64.yaml
new file mode 100644
index 0000000..4d1631b
--- /dev/null
+++ b/k8s/container/coder-dev-base-image/test_linux_amd64.yaml
@@ -0,0 +1,29 @@
+schemaVersion: "2.0.0"
+
+commandTests:
+  - name: "echo hello"
+    command: "/bin/bash"
+    args: ["-c", "echo hello world!"]
+    expectedOutput: ["hello world!"]
+  - name: "apt list --installed"
+    command: "apt"
+    args: ["list", "--installed"]
+    expectedOutput:
+      - Listing\.\.\.
+      - apt/now 2\.7\.12 amd64 \[installed,local\]
+      - bash/now 5\.2\.21\-2ubuntu2 amd64 \[installed,local\]
+      - coreutils/now 9\.4\-2ubuntu4 amd64 \[installed,local\]
+      - dpkg/now 1\.22\.4ubuntu5 amd64 \[installed,local\]
+      - grep/now 3\.11-4 amd64 \[installed,local\]
+      - libssl3/now 3\.0\.10-1ubuntu4 amd64 \[installed,local\]
+      - libncurses6/now 6\.4\+20240113\-1ubuntu1 amd64 \[installed,local\]
+      - ncurses-base/now 6\.4\+20240113\-1ubuntu1 all \[installed,local\]
+      - perl/now 5\.38\.2\-3 amd64 \[installed,local\]
+      - tzdata/now 2024a\-1ubuntu1 all \[installed,local\]
+  - name: "coreutils depends on libssl3 on amd64"
+    command: "/bin/bash"
+    args: ["-c", "apt list --installed | grep -Eo libssl3"]
+    expectedOutput: ["libssl3"]
+  - name: "whoami"
+    command: "whoami"
+    expectedOutput: [r00t]
\ No newline at end of file
diff --git a/k8s/container/coder-dev-base-image/test_linux_arm64.yaml b/k8s/container/coder-dev-base-image/test_linux_arm64.yaml
new file mode 100644
index 0000000..6b93496
--- /dev/null
+++ b/k8s/container/coder-dev-base-image/test_linux_arm64.yaml
@@ -0,0 +1,28 @@
+schemaVersion: "2.0.0"
+
+commandTests:
+  - name: "echo hello"
+    command: "/bin/bash"
+    args: ["-c", "echo hello world!"]
+    expectedOutput: ["hello world!"]
+  - name: "apt list --installed"
+    command: "apt"
+    args: ["list", "--installed"]
+    expectedOutput:
+      - Listing\.\.\.
+      - apt/now 2\.7\.12 arm64 \[installed,local\]
+      - bash/now 5\.2\.21\-2ubuntu2 arm64 \[installed,local\]
+      - coreutils/now 9\.4\-2ubuntu4 arm64 \[installed,local\]
+      - dpkg/now 1\.22\.4ubuntu5 arm64 \[installed,local\]
+      - grep/now 3\.11-4 arm64 \[installed,local\]
+      - libncurses6/now 6\.4\+20240113\-1ubuntu1 arm64 \[installed,local\]
+      - ncurses-base/now 6\.4\+20240113\-1ubuntu1 all \[installed,local\]
+      - perl/now 5\.38\.2\-3 arm64 \[installed,local\]
+      - tzdata/now 2024a\-1ubuntu1 all \[installed,local\]
+  - name: "coreutils doesn't have libssl3 dependency (it's only in amd64)"
+    command: "/bin/bash"
+    args: ["-c", "apt list --installed | grep -vq libssl3"]
+    expectedOutput: []
+  - name: "whoami"
+    command: "whoami"
+    expectedOutput: [r00t]
\ No newline at end of file
diff --git a/k8s/nodeports.txt b/k8s/nodeports.txt
new file mode 100644
index 0000000..a7072c2
--- /dev/null
+++ b/k8s/nodeports.txt
@@ -0,0 +1,12 @@
+31500: openssh-dev
+32650: lanraragi
+32550: lanraragi-manga
+32700: transmision-data
+32600: traefik-data
+32601: traefik-data-https
+32605: docker-registry
+32525: phabricator-git-ssh
+32527: phabricator
+32529: openvpn
+32500: emby-ui-node
+32565: mc1
diff --git a/third_party/BUILD.bazel b/third_party/BUILD.bazel
new file mode 100644
index 0000000..55b6647
--- /dev/null
+++ b/third_party/BUILD.bazel
@@ -0,0 +1,28 @@
+load("@rules_go//go:def.bzl", "go_binary", "go_library")
+
+go_binary(
+    name = "force_go_deps",
+    embed = [":third_party_lib"],
+    visibility = ["//visibility:public"],
+)
+
+go_library(
+    name = "third_party_lib",
+    srcs = ["force_go_deps.go"],
+    data = [
+        "@com_github_steveyegge_gastown//cmd/gt",
+    ],
+    importpath = "forgejo.csbx.dev/acmcarther/yesod/third_party",
+    visibility = ["//visibility:private"],
+    deps = [
+        "@com_github_amikos_tech_chroma_go//:chroma-go",
+        "@com_github_gofrs_flock//:flock",
+        "@com_github_google_uuid//:uuid",
+        "@com_github_gorilla_mux//:mux",
+        "@com_github_gorilla_websocket//:websocket",
+        "@com_github_mholt_archiver_v3//:archiver",
+        "@com_github_stretchr_testify//:testify",
+        "@io_nhooyr_websocket//:websocket",
+        "@org_golang_google_api//:api",
+    ],
+)
diff --git a/third_party/force_go_deps.go b/third_party/force_go_deps.go
new file mode 100644
index 0000000..767e380
--- /dev/null
+++ b/third_party/force_go_deps.go
@@ -0,0 +1,18 @@
+// Package main contains dummy imports to force certain dependencies to be direct in go.mod.
+// This is necessary for Bazel's go_deps extension to correctly pick them up.
+package main
+
+import (
+	_ "github.com/amikos-tech/chroma-go"
+	_ "github.com/gofrs/flock"
+	_ "github.com/google/uuid"
+	_ "github.com/gorilla/mux"
+	_ "github.com/gorilla/websocket"
+	_ "github.com/mholt/archiver/v3"
+	_ "github.com/stretchr/testify"
+	//_ "github.com/steveyegge/gastown/internal/beads"
+	_ "google.golang.org/api"
+	_ "nhooyr.io/websocket"
+)
+
+func main() {}
\ No newline at end of file
diff --git a/third_party/helm/BUILD b/third_party/helm/BUILD
new file mode 100644
index 0000000..e69de29
diff --git a/third_party/helm/README.md b/third_party/helm/README.md
new file mode 100644
index 0000000..b3fe99f
--- /dev/null
+++ b/third_party/helm/README.md
@@ -0,0 +1,57 @@
+# Helm Charts Management
+
+This directory contains the definition of third-party Helm charts used in the repository.
+
+## Adding or Updating a Chart
+
+The process to add or update a Helm chart involves three main steps: editing the definition, syncing the lockfile, and registering the repository in Bazel.
+
+### 1. Edit `chartfile.yaml`
+
+Add the chart repository (if not already present) and the chart dependency to `third_party/helm/chartfile.yaml`.
+
+```yaml
+repositories:
+- name: crossplane
+  url: https://charts.crossplane.io/master/
+
+requires:
+- chart: crossplane/crossplane
+  version: 1.10.0
+```
+
+### 2. Sync the Lockfile
+
+Run the `helm_sync` tool via Bazel to resolve the chart versions and update `chartfile.lock.json`.
+
+**Note:** Currently, the script requires absolute paths to the files.
+
+```bash
+bazel run //tools:helm_sync -- $(pwd)/third_party/helm/chartfile.yaml $(pwd)/third_party/helm/chartfile.lock.json
+```
+
+This will fetch the indices, resolve the specific version/digest, and write to `chartfile.lock.json`.
+
+### 3. Register in `MODULE.bazel`
+
+**Crucial Step:** The new chart repository is not automatically visible to the build system. You must explicitly register it.
+
+1.  Open `MODULE.bazel` in the workspace root.
+2.  Find the `helm_deps` extension usage block.
+3.  Add the generated repository name to the `use_repo` list. The name is constructed as `helm_<repo_name>_<chart_name>` (replacing hyphens with underscores).
+
+Example:
+```python
+helm_deps = use_extension("//tools:helm_deps.bzl", "helm_deps")
+use_repo(
+    helm_deps,
+    "helm_jetstack_cert_manager",
+    "helm_crossplane_crossplane", # Added this line
+)
+```
+
+## Using the Chart
+
+Once the chart is added and registered, you can wrap it in a Jsonnet template.
+
+See [k8s/configs/templates/README.md](../../k8s/configs/templates/README.md) for detailed instructions on creating the template and configuring path resolution.
diff --git a/third_party/helm/chartfile.lock.json b/third_party/helm/chartfile.lock.json
new file mode 100644
index 0000000..06601ba
--- /dev/null
+++ b/third_party/helm/chartfile.lock.json
@@ -0,0 +1,84 @@
+{
+  "charts": {
+    "bitnami/keycloak": {
+      "digest": "93ef250911f8d8b04cfd9de45a1492e3c8b164ecdb8f4bc59b01023727a7550a",
+      "url": "https://charts.bitnami.com/bitnami/keycloak-21.4.5.tgz",
+      "version": "21.4.5"
+    },
+    "bitnami/wordpress": {
+      "digest": "59bc321bc885c9643400f2669c1bfe5e0f86d559226d5f53d09717449a51aecf",
+      "url": "https://charts.bitnami.com/bitnami/wordpress-22.4.18.tgz",
+      "version": "22.4.18"
+    },
+    "chroma/chromadb": {
+      "digest": "42259bc9d8a1a9a866b730f673b9444a8ca349ba80630a7388e7530b8fab9684",
+      "url": "https://github.com/amikos-tech/chromadb-chart/releases/download/chromadb-0.1.24/chromadb-0.1.24.tgz",
+      "version": "0.1.24"
+    },
+    "coderv2/coder": {
+      "digest": "0edd66b6c3dec72110f7998a0e1e71f14291f4be88127cd0fc92d63906cf9864",
+      "url": "https://helm.coder.com/v2/coder_helm_2.25.2.tgz",
+      "version": "2.25.2"
+    },
+    "crossplane/crossplane": {
+      "digest": "1059cc4b87167ba7e1b837a8e6bd787691bc9f84c5a29a7e91dbd0122086c682",
+      "url": "https://charts.crossplane.io/stable/crossplane-2.1.3.tgz",
+      "version": "2.1.3"
+    },
+    "grafana/grafana": {
+      "digest": "cda64dbf87f680e845888771fe34dd2d9b7e88b9db6fa290079cde8994a5677d",
+      "url": "https://github.com/grafana/helm-charts/releases/download/grafana-8.2.0/grafana-8.2.0.tgz",
+      "version": "8.2.0"
+    },
+    "harbor/harbor": {
+      "digest": "952c6f5d42a17018b0ed52fa5e9d25ec3441b0b2b918d47d538d402ae9280be0",
+      "url": "http://helm.goharbor.io/harbor-1.16.2.tgz",
+      "version": "1.16.2"
+    },
+    "hashicorp/consul": {
+      "digest": "c2136a54e391d8dffe92c2c0c8b482b133fb5f2c72a5cc944331d5980efb5577",
+      "url": "https://helm.releases.hashicorp.com/consul-1.7.1.tgz",
+      "version": "1.7.1"
+    },
+    "hashicorp/vault": {
+      "digest": "a29bbe10a6c9caf9b298a83f4cb95fc1180c7af66ffacbbc54a666ec029a9cfd",
+      "url": "https://helm.releases.hashicorp.com/vault-0.30.0.tgz",
+      "version": "0.30.0"
+    },
+    "jaegertracing/jaeger-operator": {
+      "digest": "623409b5b32ba53a26e02b36974e2c7fe38614440ecb6623c42b484629344fc3",
+      "url": "https://github.com/jaegertracing/helm-charts/releases/download/jaeger-operator-2.57.0/jaeger-operator-2.57.0.tgz",
+      "version": "2.57.0"
+    },
+    "jetstack/cert-manager": {
+      "digest": "b0c179e643bf90d6f74d1c4a8c3e8bede1944ef7828b71419f6384c0157cf8cb",
+      "url": "https://charts.jetstack.io/charts/cert-manager-v1.15.1.tgz",
+      "version": "v1.15.1"
+    },
+    "jetstack/trust-manager": {
+      "digest": "e85dcfe71c00c816488a5d42b9a952fc817277e596e0f22eac97a8b43f84faca",
+      "url": "https://charts.jetstack.io/charts/trust-manager-v0.19.0.tgz",
+      "version": "v0.19.0"
+    },
+    "nvidia/gpu-operator": {
+      "digest": "9532cc4dd59248e0eb2a0cd4baa6a7e8ed4258b5d7588ae9c13f5c839482efe5",
+      "url": "https://helm.ngc.nvidia.com/nvidia/charts/gpu-operator-v25.10.1.tgz",
+      "version": "v25.10.1"
+    },
+    "prometheuscommunity/alertmanager": {
+      "digest": "e58b8ab41229d0ae29ad2de34a2d5aeb0e211a3f1f564a7817866e576b903f0d",
+      "url": "https://github.com/prometheus-community/helm-charts/releases/download/alertmanager-1.11.0/alertmanager-1.11.0.tgz",
+      "version": "1.11.0"
+    },
+    "prometheuscommunity/prometheus": {
+      "digest": "8e9598c1f3b4e0bc316a4bf630855881766329a977469c762af7229a80363a49",
+      "url": "https://github.com/prometheus-community/helm-charts/releases/download/prometheus-25.22.0/prometheus-25.22.0.tgz",
+      "version": "25.22.0"
+    },
+    "temporal/temporal": {
+      "digest": "7782313718df4caffb8bb7adfc18dcea69c904a2a9c8f573953cf7786e151e23",
+      "url": "https://github.com/temporalio/helm-charts/releases/download/temporal-0.65.0/temporal-0.65.0.tgz",
+      "version": "0.65.0"
+    }
+  }
+}
diff --git a/third_party/helm/chartfile.yaml b/third_party/helm/chartfile.yaml
new file mode 100644
index 0000000..3cf3593
--- /dev/null
+++ b/third_party/helm/chartfile.yaml
@@ -0,0 +1,72 @@
+directory: charts
+repositories:
+- name: stable
+  url: https://charts.helm.sh/stable
+- name: grafana
+  url: https://grafana.github.io/helm-charts
+- name: artifacthub
+  url: https://artifacthub.github.io/helm-charts
+- name: prometheuscommunity
+  url: https://prometheus-community.github.io/helm-charts
+- name: minio
+  url: https://charts.min.io/
+- name: jetstack
+  url: https://charts.jetstack.io
+- name: bitnami
+  url: https://charts.bitnami.com/bitnami
+- name: nvidia
+  url: https://helm.ngc.nvidia.com/nvidia
+- name: certmanager
+  url: http://github.com/cert-manager/cert-manager
+- name: ingress_nginx
+  url: https://kubernetes.github.io/ingress-nginx
+- name: coderv2
+  url: https://helm.coder.com/v2
+- name: harbor
+  url: http://helm.goharbor.io
+- name: argo
+  url: https://argoproj.github.io/argo-helm
+- name: hashicorp
+  url: https://helm.releases.hashicorp.com
+- name: jaegertracing
+  url: https://jaegertracing.github.io/helm-charts
+- name: temporal
+  url: https://go.temporal.io/helm-charts/
+- name: chroma
+  url: https://amikos-tech.github.io/chromadb-chart/
+- name: crossplane
+  url: https://charts.crossplane.io/stable/
+requires:
+- chart: grafana/grafana
+  version: 8.2.0
+- chart: prometheuscommunity/prometheus
+  version: 25.22.0
+- chart: prometheuscommunity/alertmanager
+  version: 1.11.0
+- chart: jetstack/cert-manager
+  version: v1.15.1
+- chart: bitnami/keycloak
+  version: 21.4.5
+- chart: bitnami/wordpress
+  version: 22.4.18
+- chart: nvidia/gpu-operator
+  version: v25.10.1
+- chart: coderv2/coder
+  version: 2.25.2
+- chart: harbor/harbor
+  version: 1.16.2
+- chart: hashicorp/consul
+  version: 1.7.1
+- chart: hashicorp/vault
+  version: 0.30.0
+- chart: jaegertracing/jaeger-operator
+  version: 2.57.0
+- chart: temporal/temporal
+  version: 0.65.0
+- chart: chroma/chromadb
+  version: 0.1.24
+- chart: jetstack/trust-manager
+  version: v0.19.0
+- chart: crossplane/crossplane
+  version: 2.1.3
+version: 1
diff --git a/third_party/jsonnet/BUILD.bazel b/third_party/jsonnet/BUILD.bazel
new file mode 100644
index 0000000..53753b3
--- /dev/null
+++ b/third_party/jsonnet/BUILD.bazel
@@ -0,0 +1,39 @@
+load("@rules_jsonnet//jsonnet:jsonnet.bzl", "jsonnet_library")
+
+exports_files(["jsonnetfile.lock.json"])
+
+jsonnet_library(
+    name = "k8s_libsonnet",
+    visibility = ["//visibility:public"],
+    deps = ["@github_com_jsonnet_libs_k8s_libsonnet_1_29//:lib"],
+)
+
+jsonnet_library(
+    name = "cert_manager",
+    visibility = ["//visibility:public"],
+    deps = ["@github_com_cert_manager_cert_manager//:lib"],
+)
+
+jsonnet_library(
+    name = "flatcar_linux_update_operator",
+    visibility = ["//visibility:public"],
+    deps = ["@github_com_flatcar_flatcar_linux_update_operator//:lib"],
+)
+
+jsonnet_library(
+    name = "grafana_ksonnet_util",
+    visibility = ["//visibility:public"],
+    deps = ["@github_com_grafana_jsonnet_libs_ksonnet_util//:lib"],
+)
+
+jsonnet_library(
+    name = "grafana_tanka_util",
+    visibility = ["//visibility:public"],
+    deps = ["@github_com_grafana_jsonnet_libs_tanka_util//:lib"],
+)
+
+jsonnet_library(
+    name = "docsonnet",
+    visibility = ["//visibility:public"],
+    deps = ["@github_com_jsonnet_libs_docsonnet_doc_util//:lib"],
+)
diff --git a/third_party/jsonnet/README.md b/third_party/jsonnet/README.md
new file mode 100644
index 0000000..c0fa3fc
--- /dev/null
+++ b/third_party/jsonnet/README.md
@@ -0,0 +1,10 @@
+# Jsonnet Dependencies (jsonnet-bundler)
+
+This directory contains jsonnet dependencies, brought in via Jsonnet Bundler
+
+Example commands:
+
+```
+$ cd third_party/jsonnet
+$ jb install github.com/jsonnet-libs/k8s-libsonnet/1.21@main github.com/grafana/jsonnet-libs/ksonnet-util
+```
\ No newline at end of file
diff --git a/third_party/jsonnet/jsonnetfile.json b/third_party/jsonnet/jsonnetfile.json
new file mode 100644
index 0000000..18d5cce
--- /dev/null
+++ b/third_party/jsonnet/jsonnetfile.json
@@ -0,0 +1,60 @@
+{
+  "version": 1,
+  "dependencies": [
+    {
+      "source": {
+        "git": {
+          "remote": "https://github.com/cert-manager/cert-manager.git",
+          "subdir": ""
+        }
+      },
+      "version": "master"
+    },
+    {
+      "source": {
+        "git": {
+          "remote": "https://github.com/flatcar/flatcar-linux-update-operator.git",
+          "subdir": ""
+        }
+      },
+      "version": "master"
+    },
+    {
+      "source": {
+        "git": {
+          "remote": "https://github.com/grafana/jsonnet-libs.git",
+          "subdir": "ksonnet-util"
+        }
+      },
+      "version": "master"
+    },
+    {
+      "source": {
+        "git": {
+          "remote": "https://github.com/grafana/jsonnet-libs.git",
+          "subdir": "tanka-util"
+        }
+      },
+      "version": "master"
+    },
+    {
+      "source": {
+        "git": {
+          "remote": "https://github.com/jsonnet-libs/docsonnet.git",
+          "subdir": "doc-util"
+        }
+      },
+      "version": "master"
+    },
+    {
+      "source": {
+        "git": {
+          "remote": "https://github.com/jsonnet-libs/k8s-libsonnet.git",
+          "subdir": "1.29"
+        }
+      },
+      "version": "main"
+    }
+  ],
+  "legacyImports": true
+}
diff --git a/third_party/jsonnet/jsonnetfile.lock.json b/third_party/jsonnet/jsonnetfile.lock.json
new file mode 100644
index 0000000..757eadd
--- /dev/null
+++ b/third_party/jsonnet/jsonnetfile.lock.json
@@ -0,0 +1,66 @@
+{
+  "version": 1,
+  "dependencies": [
+    {
+      "source": {
+        "git": {
+          "remote": "https://github.com/cert-manager/cert-manager.git",
+          "subdir": ""
+        }
+      },
+      "version": "6f7989d7d444772ac6d7a46475f913c6b9e0a7fe",
+      "sum": "RhPjISCyILAcbSyWZgP/cm9pmofKomWUzu442Rktqaw="
+    },
+    {
+      "source": {
+        "git": {
+          "remote": "https://github.com/flatcar/flatcar-linux-update-operator.git",
+          "subdir": ""
+        }
+      },
+      "version": "030e43574c229eeb5a8858f03bdcc997f38131d9",
+      "sum": "QpxRKQwFM+x7WwmP3bVz/9cU079uhEQcc/3/lWDZcSU="
+    },
+    {
+      "source": {
+        "git": {
+          "remote": "https://github.com/grafana/jsonnet-libs.git",
+          "subdir": "ksonnet-util"
+        }
+      },
+      "version": "0c35fcfb35658ed16fb73d5b5546a36cbdf73f7a",
+      "sum": "0y3AFX9LQSpfWTxWKSwoLgbt0Wc9nnCwhMH2szKzHv0="
+    },
+    {
+      "source": {
+        "git": {
+          "remote": "https://github.com/grafana/jsonnet-libs.git",
+          "subdir": "tanka-util"
+        }
+      },
+      "version": "0c35fcfb35658ed16fb73d5b5546a36cbdf73f7a",
+      "sum": "ShSIissXdvCy1izTCDZX6tY7qxCoepE5L+WJ52Hw7ZQ="
+    },
+    {
+      "source": {
+        "git": {
+          "remote": "https://github.com/jsonnet-libs/docsonnet.git",
+          "subdir": "doc-util"
+        }
+      },
+      "version": "6ac6c69685b8c29c54515448eaca583da2d88150",
+      "sum": "BrAL/k23jq+xy9oA7TWIhUx07dsA/QLm3g7ktCwe//U="
+    },
+    {
+      "source": {
+        "git": {
+          "remote": "https://github.com/jsonnet-libs/k8s-libsonnet.git",
+          "subdir": "1.29"
+        }
+      },
+      "version": "6ecbb7709baf27f44b2e48f3529741ae6754ae6a",
+      "sum": "i2w3hGbgQmaB73t5LJHSioPOVdYv8ZBvivHiDwZJVyI="
+    }
+  ],
+  "legacyImports": false
+}
diff --git a/third_party/patches/BUILD.bazel b/third_party/patches/BUILD.bazel
new file mode 100644
index 0000000..26637b9
--- /dev/null
+++ b/third_party/patches/BUILD.bazel
@@ -0,0 +1 @@
+exports_files(["rules_jsonnet_visibility.patch"])
diff --git a/third_party/patches/rules_jsonnet_visibility.patch b/third_party/patches/rules_jsonnet_visibility.patch
new file mode 100644
index 0000000..ff406b8
--- /dev/null
+++ b/third_party/patches/rules_jsonnet_visibility.patch
@@ -0,0 +1,13 @@
+diff --git a/jsonnet/BUILD b/jsonnet/BUILD
+index 1234567..89abcdef 100644
+--- a/jsonnet/BUILD
++++ b/jsonnet/BUILD
+@@ -4,6 +4,8 @@ load("@bazel_skylib//:bzl_library.bzl", "bzl_library")
+ 
+ exports_files(["docs.bzl", "jsonnet.bzl", "toolchain.bzl"])
+ 
++package(default_visibility = ["//visibility:public"])
++
+ bzl_library(
+     name = "bzl_srcs",
+     srcs = ["@bazel_tools//tools:bzl_srcs"],
diff --git a/third_party/python/BUILD.bazel b/third_party/python/BUILD.bazel
new file mode 100644
index 0000000..dfd6910
--- /dev/null
+++ b/third_party/python/BUILD.bazel
@@ -0,0 +1,35 @@
+load("@aspect_rules_py//py:defs.bzl", "py_binary", "py_library")
+
+# BUILD.bazel
+load("@pip_third_party//:requirements.bzl", "all_requirements", "requirement")
+load("@rules_python//python/entry_points:py_console_script_binary.bzl", "py_console_script_binary")
+
+py_library(
+    name = "requirements",
+    visibility = ["//visibility:public"],
+    deps = all_requirements,
+)
+
+py_console_script_binary(
+    name = "pip-compile",
+    pkg = requirement("pip-tools"),
+    script = "pip-compile",
+    deps = [
+        requirement("docopt"),
+    ],
+)
+
+py_console_script_binary(
+    name = "pip",
+    pkg = requirement("pip"),
+    script = "pip",
+)
+
+sh_binary(
+    name = "uv_compile",
+    srcs = ["uv_compile_wrapper.sh"],
+    data = select({
+        "@platforms//os:macos": ["@uv_macos_aarch64//:uv"],
+        "@platforms//os:linux": ["@uv_linux_x86_64//:uv"],
+    }),
+)
diff --git a/third_party/python/pip_compile.sh b/third_party/python/pip_compile.sh
new file mode 100755
index 0000000..5ee6714
--- /dev/null
+++ b/third_party/python/pip_compile.sh
@@ -0,0 +1,10 @@
+#!/bin/bash
+LOCKFILE=/Users/acmcarther/projects/yesod/third_party/python/requirements.lock
+REQUIREMENTS=/Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+
+# Run uv via Bazel
+bazel run //third_party/python:uv_compile -- "$REQUIREMENTS" --universal --python-version 3.12 --output-file="$LOCKFILE"
+
+# Sanitize requirements.lock using python helper
+# This ensures cross-platform compatibility and robust regex
+python3 third_party/python/sanitize_lockfile.py "$LOCKFILE"
\ No newline at end of file
diff --git a/third_party/python/requirements.lock b/third_party/python/requirements.lock
new file mode 100644
index 0000000..c79a328
--- /dev/null
+++ b/third_party/python/requirements.lock
@@ -0,0 +1,2035 @@
+# This file was autogenerated by uv via the following command:
+#    uv pip compile /Users/acmcarther/projects/yesod/third_party/python/requirements.txt --universal --python-version 3.12 --output-file=/Users/acmcarther/projects/yesod/third_party/python/requirements.lock
+absl-py==2.3.1
+    # via -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+addict==2.4.0
+    # via misaki
+aiofiles==24.1.0 ; sys_platform == 'darwin'
+    # via gradio
+aiohappyeyeballs==2.6.1
+    # via aiohttp
+aiohttp==3.13.0
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   fsspec
+    #   litellm
+aiosignal==1.4.0
+    # via aiohttp
+annotated-types==0.7.0
+    # via pydantic
+antlr4-python3-runtime==4.9.3
+    # via omegaconf
+anyio==4.10.0
+    # via
+    #   google-genai
+    #   gradio
+    #   httpx
+    #   openai
+    #   starlette
+    #   watchfiles
+asyncio==4.0.0
+    # via -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+attrs==25.3.0
+    # via
+    #   aiohttp
+    #   csvw
+    #   jsonschema
+    #   phonemizer-fork
+    #   referencing
+audioop-lts==0.2.2 ; sys_platform == 'darwin'
+    # via gradio
+babel==2.17.0
+    # via csvw
+backoff==2.2.1
+    # via posthog
+bcrypt==4.3.0
+    # via chromadb
+beautifulsoup4==4.13.5
+    # via -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+bidict==0.23.1
+    # via python-socketio
+blis==1.3.3
+    # via thinc
+brotli==1.2.0 ; sys_platform == 'darwin'
+    # via gradio
+build==1.3.0
+    # via
+    #   chromadb
+    #   pip-tools
+cachetools==5.5.2
+    # via google-auth
+catalogue==2.0.10
+    # via
+    #   spacy
+    #   srsly
+    #   thinc
+certifi==2025.8.3
+    # via
+    #   httpcore
+    #   httpx
+    #   kubernetes
+    #   requests
+cffi==2.0.0
+    # via
+    #   sounddevice
+    #   soundfile
+charset-normalizer==3.4.3
+    # via requests
+chromadb==1.0.20
+    # via -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+click==8.2.1
+    # via
+    #   litellm
+    #   pip-tools
+    #   typer
+    #   typer-slim
+    #   uvicorn
+cloudpathlib==0.23.0
+    # via weasel
+colorama==0.4.6 ; sys_platform == 'win32'
+    # via
+    #   build
+    #   click
+    #   loguru
+    #   pytest
+    #   tqdm
+    #   uvicorn
+    #   wasabi
+coloredlogs==15.0.1
+    # via onnxruntime
+confection==0.1.5
+    # via
+    #   thinc
+    #   weasel
+csvw==3.7.0
+    # via segments
+curated-tokenizers==0.0.9
+    # via spacy-curated-transformers
+curated-transformers==0.1.1
+    # via spacy-curated-transformers
+cymem==2.0.13
+    # via
+    #   preshed
+    #   spacy
+    #   thinc
+dacite==1.9.2
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   mlx-audio
+datasets==4.4.2 ; sys_platform == 'darwin'
+    # via mlx-vlm
+deepdiff==8.6.0
+    # via -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+dill==0.4.0 ; sys_platform == 'darwin'
+    # via
+    #   datasets
+    #   multiprocess
+distro==1.9.0
+    # via
+    #   openai
+    #   posthog
+dlinfo==2.0.0
+    # via phonemizer-fork
+docopt==0.6.2
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   num2words
+durationpy==0.10
+    # via kubernetes
+einops==0.8.1
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   mlx-audio
+einx==0.3.0
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   mlx-audio
+espeakng-loader==0.2.4
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   misaki
+    #   mlx-audio
+fakeredis==2.31.1
+    # via -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+fastapi==0.116.1
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   gradio
+    #   mlx-vlm
+fastuuid==0.13.5
+    # via litellm
+ffmpy==1.0.0 ; sys_platform == 'darwin'
+    # via gradio
+filelock==3.19.1
+    # via
+    #   datasets
+    #   huggingface-hub
+    #   torch
+    #   transformers
+flatbuffers==25.2.10
+    # via onnxruntime
+frozendict==2.4.7
+    # via einx
+frozenlist==1.8.0
+    # via
+    #   aiohttp
+    #   aiosignal
+fsspec==2025.7.0
+    # via
+    #   datasets
+    #   gradio-client
+    #   huggingface-hub
+    #   torch
+future==1.0.0
+    # via pyloudnorm
+git-filter-repo==2.47.0
+    # via -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+gitdb==4.0.12
+    # via gitpython
+gitpython==3.1.45
+    # via -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+google-ai-generativelanguage==0.6.15
+    # via google-generativeai
+google-api-core==2.25.1
+    # via
+    #   google-ai-generativelanguage
+    #   google-api-python-client
+    #   google-generativeai
+google-api-python-client==2.179.0
+    # via google-generativeai
+google-auth==2.40.3
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   google-ai-generativelanguage
+    #   google-api-core
+    #   google-api-python-client
+    #   google-auth-httplib2
+    #   google-genai
+    #   google-generativeai
+    #   kubernetes
+google-auth-httplib2==0.2.0
+    # via google-api-python-client
+google-genai==1.32.0
+    # via -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+google-generativeai==0.8.5
+    # via -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+googleapis-common-protos==1.70.0
+    # via
+    #   google-api-core
+    #   grpcio-status
+    #   opentelemetry-exporter-otlp-proto-grpc
+gradio==6.2.0 ; sys_platform == 'darwin'
+    # via mlx-vlm
+gradio-client==2.0.2 ; sys_platform == 'darwin'
+    # via gradio
+groovy==0.1.2 ; sys_platform == 'darwin'
+    # via gradio
+grpcio==1.74.0
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   chromadb
+    #   google-api-core
+    #   grpcio-status
+    #   grpcio-tools
+    #   opentelemetry-exporter-otlp-proto-grpc
+    #   pymilvus
+grpcio-status==1.71.2
+    # via google-api-core
+grpcio-tools==1.71.2
+    # via -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+h11==0.16.0
+    # via
+    #   httpcore
+    #   uvicorn
+    #   wsproto
+hf-transfer==0.1.9
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   mlx-audio
+hf-xet==1.1.9 ; platform_machine == 'aarch64' or platform_machine == 'amd64' or platform_machine == 'arm64' or platform_machine == 'x86_64'
+    # via huggingface-hub
+httpcore==1.0.9
+    # via httpx
+httplib2==0.30.0
+    # via
+    #   google-api-python-client
+    #   google-auth-httplib2
+httptools==0.6.4
+    # via uvicorn
+httpx==0.28.1
+    # via
+    #   chromadb
+    #   datasets
+    #   google-genai
+    #   gradio
+    #   gradio-client
+    #   litellm
+    #   openai
+    #   safehttpx
+huggingface-hub==0.34.4
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   datasets
+    #   gradio
+    #   gradio-client
+    #   kokoro
+    #   mlx-audio
+    #   mlx-whisper
+    #   sentence-transformers
+    #   tokenizers
+    #   transformers
+humanfriendly==10.0
+    # via coloredlogs
+idna==3.10
+    # via
+    #   anyio
+    #   httpx
+    #   requests
+    #   yarl
+importlib-metadata==8.7.0
+    # via
+    #   litellm
+    #   opentelemetry-api
+importlib-resources==6.5.2
+    # via chromadb
+iniconfig==2.1.0
+    # via pytest
+isodate==0.7.2
+    # via csvw
+jinja2==3.1.6
+    # via
+    #   gradio
+    #   litellm
+    #   mlx-lm
+    #   spacy
+    #   torch
+jiter==0.11.0
+    # via openai
+joblib==1.5.2
+    # via
+    #   phonemizer-fork
+    #   scikit-learn
+jsonschema==4.25.1
+    # via
+    #   chromadb
+    #   csvw
+    #   litellm
+    #   mistral-common
+jsonschema-specifications==2025.4.1
+    # via jsonschema
+kokoro==0.9.4
+    # via -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+kubernetes==33.1.0
+    # via chromadb
+language-tags==1.2.0
+    # via csvw
+litellm==1.78.2
+    # via -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+llvmlite==0.46.0 ; sys_platform == 'darwin'
+    # via numba
+loguru==0.7.3
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   kokoro
+    #   mlx-audio
+markdown-it-py==4.0.0
+    # via rich
+markupsafe==3.0.2
+    # via
+    #   gradio
+    #   jinja2
+mdurl==0.1.2
+    # via markdown-it-py
+milvus-lite==2.5.1 ; sys_platform != 'win32'
+    # via pymilvus
+misaki==0.9.4
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   kokoro
+    #   mlx-audio
+mistral-common==1.8.8
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   mlx-audio
+mlx==0.30.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   mlx-audio
+    #   mlx-lm
+    #   mlx-vlm
+    #   mlx-whisper
+mlx-audio==0.2.8 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   mlx-vlm
+mlx-lm==0.29.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   mlx-vlm
+mlx-metal==0.30.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   mlx
+mlx-vlm==0.3.1 ; sys_platform == 'darwin'
+    # via -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+mlx-whisper==0.4.3 ; sys_platform == 'darwin'
+    # via -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+mmh3==5.2.0
+    # via chromadb
+more-itertools==10.8.0 ; sys_platform == 'darwin'
+    # via mlx-whisper
+mpmath==1.3.0
+    # via sympy
+multidict==6.7.0
+    # via
+    #   aiohttp
+    #   yarl
+multiprocess==0.70.18 ; sys_platform == 'darwin'
+    # via datasets
+murmurhash==1.0.15
+    # via
+    #   preshed
+    #   spacy
+    #   thinc
+networkx==3.5
+    # via torch
+nexus-rpc==1.1.0
+    # via temporalio
+num2words==0.5.14
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   misaki
+    #   mlx-audio
+numba==0.63.1 ; sys_platform == 'darwin'
+    # via mlx-whisper
+numpy==2.3.2
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   blis
+    #   chromadb
+    #   datasets
+    #   einx
+    #   gradio
+    #   kokoro
+    #   mistral-common
+    #   mlx-audio
+    #   mlx-lm
+    #   mlx-vlm
+    #   mlx-whisper
+    #   numba
+    #   onnxruntime
+    #   opencv-python
+    #   pandas
+    #   pyloudnorm
+    #   scikit-learn
+    #   scipy
+    #   soundfile
+    #   soxr
+    #   spacy
+    #   thinc
+    #   transformers
+nvidia-cublas-cu12==12.8.4.1 ; platform_machine != 'aarch64' and sys_platform == 'linux'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   nvidia-cudnn-cu12
+    #   nvidia-cusolver-cu12
+    #   torch
+nvidia-cublas-cu12==12.9.1.4 ; platform_machine == 'aarch64' and sys_platform == 'linux'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   nvidia-cudnn-cu12
+    #   nvidia-cusolver-cu12
+nvidia-cuda-cupti-cu12==12.8.90 ; platform_machine == 'x86_64' and sys_platform == 'linux'
+    # via torch
+nvidia-cuda-nvrtc-cu12==12.8.93 ; platform_machine != 'aarch64' and sys_platform == 'linux'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   torch
+nvidia-cuda-nvrtc-cu12==12.9.86 ; platform_machine == 'aarch64' and sys_platform == 'linux'
+    # via -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+nvidia-cuda-runtime-cu12==12.8.90 ; platform_machine != 'aarch64' and sys_platform == 'linux'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   torch
+nvidia-cuda-runtime-cu12==12.9.79 ; platform_machine == 'aarch64' and sys_platform == 'linux'
+    # via -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+nvidia-cudnn-cu12==9.10.2.21 ; platform_machine != 'aarch64' and sys_platform == 'linux'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   torch
+nvidia-cudnn-cu12==9.17.1.4 ; platform_machine == 'aarch64' and sys_platform == 'linux'
+    # via -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+nvidia-cufft-cu12==11.3.3.83 ; platform_machine != 'aarch64' and sys_platform == 'linux'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   torch
+nvidia-cufft-cu12==11.4.1.4 ; platform_machine == 'aarch64' and sys_platform == 'linux'
+    # via -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+nvidia-cufile-cu12==1.13.1.3 ; platform_machine == 'x86_64' and sys_platform == 'linux'
+    # via torch
+nvidia-curand-cu12==10.3.9.90 ; platform_machine != 'aarch64' and sys_platform == 'linux'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   torch
+nvidia-curand-cu12==10.3.10.19 ; platform_machine == 'aarch64' and sys_platform == 'linux'
+    # via -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+nvidia-cusolver-cu12==11.7.3.90 ; platform_machine != 'aarch64' and sys_platform == 'linux'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   torch
+nvidia-cusolver-cu12==11.7.5.82 ; platform_machine == 'aarch64' and sys_platform == 'linux'
+    # via -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+nvidia-cusparse-cu12==12.5.8.93 ; platform_machine != 'aarch64' and sys_platform == 'linux'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   nvidia-cusolver-cu12
+    #   torch
+nvidia-cusparse-cu12==12.5.10.65 ; platform_machine == 'aarch64' and sys_platform == 'linux'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   nvidia-cusolver-cu12
+nvidia-cusparselt-cu12==0.7.1 ; platform_machine == 'x86_64' and sys_platform == 'linux'
+    # via torch
+nvidia-nccl-cu12==2.27.5 ; platform_machine != 'aarch64' and sys_platform == 'linux'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   torch
+nvidia-nccl-cu12==2.29.2 ; platform_machine == 'aarch64' and sys_platform == 'linux'
+    # via -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+nvidia-nvjitlink-cu12==12.8.93 ; platform_machine != 'aarch64' and sys_platform == 'linux'
+    # via
+    #   nvidia-cufft-cu12
+    #   nvidia-cusolver-cu12
+    #   nvidia-cusparse-cu12
+    #   torch
+nvidia-nvjitlink-cu12==12.9.86 ; platform_machine == 'aarch64' and sys_platform == 'linux'
+    # via
+    #   nvidia-cufft-cu12
+    #   nvidia-cusolver-cu12
+    #   nvidia-cusparse-cu12
+nvidia-nvshmem-cu12==3.3.20 ; platform_machine == 'x86_64' and sys_platform == 'linux'
+    # via torch
+nvidia-nvtx-cu12==12.8.90 ; platform_machine != 'aarch64' and sys_platform == 'linux'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   torch
+nvidia-nvtx-cu12==12.9.79 ; platform_machine == 'aarch64' and sys_platform == 'linux'
+    # via -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+oauthlib==3.3.1
+    # via
+    #   kubernetes
+    #   requests-oauthlib
+omegaconf==2.3.0
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   mlx-audio
+onnxruntime==1.22.1
+    # via chromadb
+openai==2.4.0
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   litellm
+opencv-python==4.10.0.84 ; sys_platform == 'darwin'
+    # via mlx-vlm
+opentelemetry-api==1.36.0
+    # via
+    #   chromadb
+    #   opentelemetry-exporter-otlp-proto-grpc
+    #   opentelemetry-sdk
+    #   opentelemetry-semantic-conventions
+opentelemetry-exporter-otlp-proto-common==1.36.0
+    # via opentelemetry-exporter-otlp-proto-grpc
+opentelemetry-exporter-otlp-proto-grpc==1.36.0
+    # via chromadb
+opentelemetry-proto==1.36.0
+    # via
+    #   opentelemetry-exporter-otlp-proto-common
+    #   opentelemetry-exporter-otlp-proto-grpc
+opentelemetry-sdk==1.36.0
+    # via
+    #   chromadb
+    #   opentelemetry-exporter-otlp-proto-grpc
+opentelemetry-semantic-conventions==0.57b0
+    # via opentelemetry-sdk
+orderly-set==5.5.0
+    # via deepdiff
+orjson==3.11.3
+    # via
+    #   chromadb
+    #   gradio
+overrides==7.7.0
+    # via chromadb
+packaging==25.0
+    # via
+    #   build
+    #   datasets
+    #   gradio
+    #   gradio-client
+    #   huggingface-hub
+    #   onnxruntime
+    #   pytest
+    #   spacy
+    #   thinc
+    #   transformers
+    #   weasel
+pandas==2.3.2
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   datasets
+    #   gradio
+    #   pymilvus
+phonemizer-fork==3.3.2
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   misaki
+    #   mlx-audio
+pillow==11.3.0
+    # via
+    #   gradio
+    #   mistral-common
+    #   mlx-vlm
+    #   sentence-transformers
+pip==25.2
+    # via pip-tools
+pip-tools==7.5.0
+    # via -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+pluggy==1.6.0
+    # via pytest
+posthog==5.4.0
+    # via chromadb
+preshed==3.0.12
+    # via
+    #   spacy
+    #   thinc
+propcache==0.4.1
+    # via
+    #   aiohttp
+    #   yarl
+proto-plus==1.26.1
+    # via
+    #   google-ai-generativelanguage
+    #   google-api-core
+protobuf==5.29.5
+    # via
+    #   google-ai-generativelanguage
+    #   google-api-core
+    #   google-generativeai
+    #   googleapis-common-protos
+    #   grpcio-status
+    #   grpcio-tools
+    #   mlx-lm
+    #   onnxruntime
+    #   opentelemetry-proto
+    #   proto-plus
+    #   pymilvus
+    #   temporalio
+pyarrow==22.0.0 ; sys_platform == 'darwin'
+    # via datasets
+pyasn1==0.6.1
+    # via
+    #   pyasn1-modules
+    #   rsa
+pyasn1-modules==0.4.2
+    # via google-auth
+pybase64==1.4.2
+    # via chromadb
+pycountry==24.6.1
+    # via pydantic-extra-types
+pycparser==2.23 ; implementation_name != 'PyPy'
+    # via cffi
+pydantic==2.11.7
+    # via
+    #   chromadb
+    #   confection
+    #   fastapi
+    #   google-genai
+    #   google-generativeai
+    #   gradio
+    #   litellm
+    #   mistral-common
+    #   openai
+    #   pydantic-extra-types
+    #   spacy
+    #   thinc
+    #   weasel
+pydantic-core==2.33.2
+    # via pydantic
+pydantic-extra-types==2.10.6
+    # via mistral-common
+pydub==0.25.1 ; sys_platform == 'darwin'
+    # via gradio
+pyfiglet==1.0.4
+    # via -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+pygments==2.19.2
+    # via
+    #   pytest
+    #   rich
+pyloudnorm==0.1.1
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   mlx-audio
+pymilvus==2.6.1
+    # via -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+pyobjc==12.1 ; sys_platform == 'darwin'
+    # via -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+pyobjc-core==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+    #   pyobjc-framework-accessibility
+    #   pyobjc-framework-accounts
+    #   pyobjc-framework-addressbook
+    #   pyobjc-framework-adservices
+    #   pyobjc-framework-adsupport
+    #   pyobjc-framework-applescriptkit
+    #   pyobjc-framework-applescriptobjc
+    #   pyobjc-framework-applicationservices
+    #   pyobjc-framework-apptrackingtransparency
+    #   pyobjc-framework-arkit
+    #   pyobjc-framework-audiovideobridging
+    #   pyobjc-framework-authenticationservices
+    #   pyobjc-framework-automaticassessmentconfiguration
+    #   pyobjc-framework-automator
+    #   pyobjc-framework-avfoundation
+    #   pyobjc-framework-avkit
+    #   pyobjc-framework-avrouting
+    #   pyobjc-framework-backgroundassets
+    #   pyobjc-framework-browserenginekit
+    #   pyobjc-framework-businesschat
+    #   pyobjc-framework-calendarstore
+    #   pyobjc-framework-callkit
+    #   pyobjc-framework-carbon
+    #   pyobjc-framework-cfnetwork
+    #   pyobjc-framework-cinematic
+    #   pyobjc-framework-classkit
+    #   pyobjc-framework-cloudkit
+    #   pyobjc-framework-cocoa
+    #   pyobjc-framework-collaboration
+    #   pyobjc-framework-colorsync
+    #   pyobjc-framework-compositorservices
+    #   pyobjc-framework-contacts
+    #   pyobjc-framework-contactsui
+    #   pyobjc-framework-coreaudio
+    #   pyobjc-framework-coreaudiokit
+    #   pyobjc-framework-corebluetooth
+    #   pyobjc-framework-coredata
+    #   pyobjc-framework-corehaptics
+    #   pyobjc-framework-corelocation
+    #   pyobjc-framework-coremedia
+    #   pyobjc-framework-coremediaio
+    #   pyobjc-framework-coremidi
+    #   pyobjc-framework-coreml
+    #   pyobjc-framework-coremotion
+    #   pyobjc-framework-coreservices
+    #   pyobjc-framework-corespotlight
+    #   pyobjc-framework-coretext
+    #   pyobjc-framework-corewlan
+    #   pyobjc-framework-cryptotokenkit
+    #   pyobjc-framework-datadetection
+    #   pyobjc-framework-devicecheck
+    #   pyobjc-framework-devicediscoveryextension
+    #   pyobjc-framework-dictionaryservices
+    #   pyobjc-framework-discrecording
+    #   pyobjc-framework-discrecordingui
+    #   pyobjc-framework-diskarbitration
+    #   pyobjc-framework-dvdplayback
+    #   pyobjc-framework-eventkit
+    #   pyobjc-framework-exceptionhandling
+    #   pyobjc-framework-executionpolicy
+    #   pyobjc-framework-extensionkit
+    #   pyobjc-framework-externalaccessory
+    #   pyobjc-framework-fileprovider
+    #   pyobjc-framework-fileproviderui
+    #   pyobjc-framework-findersync
+    #   pyobjc-framework-fsevents
+    #   pyobjc-framework-fskit
+    #   pyobjc-framework-gamecenter
+    #   pyobjc-framework-gamecontroller
+    #   pyobjc-framework-gamekit
+    #   pyobjc-framework-gameplaykit
+    #   pyobjc-framework-gamesave
+    #   pyobjc-framework-healthkit
+    #   pyobjc-framework-imagecapturecore
+    #   pyobjc-framework-inputmethodkit
+    #   pyobjc-framework-installerplugins
+    #   pyobjc-framework-instantmessage
+    #   pyobjc-framework-intents
+    #   pyobjc-framework-intentsui
+    #   pyobjc-framework-iobluetooth
+    #   pyobjc-framework-iobluetoothui
+    #   pyobjc-framework-iosurface
+    #   pyobjc-framework-ituneslibrary
+    #   pyobjc-framework-kernelmanagement
+    #   pyobjc-framework-latentsemanticmapping
+    #   pyobjc-framework-launchservices
+    #   pyobjc-framework-libdispatch
+    #   pyobjc-framework-libxpc
+    #   pyobjc-framework-linkpresentation
+    #   pyobjc-framework-localauthentication
+    #   pyobjc-framework-localauthenticationembeddedui
+    #   pyobjc-framework-mailkit
+    #   pyobjc-framework-mapkit
+    #   pyobjc-framework-mediaaccessibility
+    #   pyobjc-framework-mediaextension
+    #   pyobjc-framework-medialibrary
+    #   pyobjc-framework-mediaplayer
+    #   pyobjc-framework-mediatoolbox
+    #   pyobjc-framework-metal
+    #   pyobjc-framework-metalfx
+    #   pyobjc-framework-metalkit
+    #   pyobjc-framework-metalperformanceshaders
+    #   pyobjc-framework-metalperformanceshadersgraph
+    #   pyobjc-framework-metrickit
+    #   pyobjc-framework-mlcompute
+    #   pyobjc-framework-modelio
+    #   pyobjc-framework-multipeerconnectivity
+    #   pyobjc-framework-naturallanguage
+    #   pyobjc-framework-netfs
+    #   pyobjc-framework-network
+    #   pyobjc-framework-networkextension
+    #   pyobjc-framework-notificationcenter
+    #   pyobjc-framework-opendirectory
+    #   pyobjc-framework-osakit
+    #   pyobjc-framework-oslog
+    #   pyobjc-framework-passkit
+    #   pyobjc-framework-pencilkit
+    #   pyobjc-framework-phase
+    #   pyobjc-framework-photos
+    #   pyobjc-framework-photosui
+    #   pyobjc-framework-preferencepanes
+    #   pyobjc-framework-pushkit
+    #   pyobjc-framework-quartz
+    #   pyobjc-framework-quicklookthumbnailing
+    #   pyobjc-framework-replaykit
+    #   pyobjc-framework-safariservices
+    #   pyobjc-framework-safetykit
+    #   pyobjc-framework-scenekit
+    #   pyobjc-framework-screencapturekit
+    #   pyobjc-framework-screensaver
+    #   pyobjc-framework-screentime
+    #   pyobjc-framework-scriptingbridge
+    #   pyobjc-framework-searchkit
+    #   pyobjc-framework-security
+    #   pyobjc-framework-securityfoundation
+    #   pyobjc-framework-securityinterface
+    #   pyobjc-framework-securityui
+    #   pyobjc-framework-sensitivecontentanalysis
+    #   pyobjc-framework-servicemanagement
+    #   pyobjc-framework-sharedwithyou
+    #   pyobjc-framework-sharedwithyoucore
+    #   pyobjc-framework-shazamkit
+    #   pyobjc-framework-social
+    #   pyobjc-framework-soundanalysis
+    #   pyobjc-framework-speech
+    #   pyobjc-framework-spritekit
+    #   pyobjc-framework-storekit
+    #   pyobjc-framework-symbols
+    #   pyobjc-framework-syncservices
+    #   pyobjc-framework-systemconfiguration
+    #   pyobjc-framework-systemextensions
+    #   pyobjc-framework-threadnetwork
+    #   pyobjc-framework-uniformtypeidentifiers
+    #   pyobjc-framework-usernotifications
+    #   pyobjc-framework-usernotificationsui
+    #   pyobjc-framework-videosubscriberaccount
+    #   pyobjc-framework-videotoolbox
+    #   pyobjc-framework-virtualization
+    #   pyobjc-framework-vision
+    #   pyobjc-framework-webkit
+pyobjc-framework-accessibility==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-accounts==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+    #   pyobjc-framework-cloudkit
+pyobjc-framework-addressbook==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-adservices==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-adsupport==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-applescriptkit==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-applescriptobjc==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-applicationservices==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-apptrackingtransparency==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-arkit==12.1 ; sys_platform == 'darwin'
+    # via pyobjc
+pyobjc-framework-audiovideobridging==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-authenticationservices==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-automaticassessmentconfiguration==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-automator==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-avfoundation==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+    #   pyobjc-framework-cinematic
+    #   pyobjc-framework-mediaextension
+    #   pyobjc-framework-mediaplayer
+    #   pyobjc-framework-phase
+pyobjc-framework-avkit==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-avrouting==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-backgroundassets==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-browserenginekit==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-businesschat==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-calendarstore==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-callkit==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-carbon==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-cfnetwork==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-cinematic==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-classkit==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-cloudkit==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-cocoa==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+    #   pyobjc-framework-accessibility
+    #   pyobjc-framework-accounts
+    #   pyobjc-framework-addressbook
+    #   pyobjc-framework-adservices
+    #   pyobjc-framework-adsupport
+    #   pyobjc-framework-applescriptkit
+    #   pyobjc-framework-applescriptobjc
+    #   pyobjc-framework-applicationservices
+    #   pyobjc-framework-apptrackingtransparency
+    #   pyobjc-framework-arkit
+    #   pyobjc-framework-audiovideobridging
+    #   pyobjc-framework-authenticationservices
+    #   pyobjc-framework-automaticassessmentconfiguration
+    #   pyobjc-framework-automator
+    #   pyobjc-framework-avfoundation
+    #   pyobjc-framework-avkit
+    #   pyobjc-framework-avrouting
+    #   pyobjc-framework-backgroundassets
+    #   pyobjc-framework-browserenginekit
+    #   pyobjc-framework-businesschat
+    #   pyobjc-framework-calendarstore
+    #   pyobjc-framework-callkit
+    #   pyobjc-framework-carbon
+    #   pyobjc-framework-cfnetwork
+    #   pyobjc-framework-cinematic
+    #   pyobjc-framework-classkit
+    #   pyobjc-framework-cloudkit
+    #   pyobjc-framework-collaboration
+    #   pyobjc-framework-colorsync
+    #   pyobjc-framework-compositorservices
+    #   pyobjc-framework-contacts
+    #   pyobjc-framework-contactsui
+    #   pyobjc-framework-coreaudio
+    #   pyobjc-framework-coreaudiokit
+    #   pyobjc-framework-corebluetooth
+    #   pyobjc-framework-coredata
+    #   pyobjc-framework-corehaptics
+    #   pyobjc-framework-corelocation
+    #   pyobjc-framework-coremedia
+    #   pyobjc-framework-coremediaio
+    #   pyobjc-framework-coremidi
+    #   pyobjc-framework-coreml
+    #   pyobjc-framework-coremotion
+    #   pyobjc-framework-coreservices
+    #   pyobjc-framework-corespotlight
+    #   pyobjc-framework-coretext
+    #   pyobjc-framework-corewlan
+    #   pyobjc-framework-cryptotokenkit
+    #   pyobjc-framework-datadetection
+    #   pyobjc-framework-devicecheck
+    #   pyobjc-framework-devicediscoveryextension
+    #   pyobjc-framework-discrecording
+    #   pyobjc-framework-discrecordingui
+    #   pyobjc-framework-diskarbitration
+    #   pyobjc-framework-dvdplayback
+    #   pyobjc-framework-eventkit
+    #   pyobjc-framework-exceptionhandling
+    #   pyobjc-framework-executionpolicy
+    #   pyobjc-framework-extensionkit
+    #   pyobjc-framework-externalaccessory
+    #   pyobjc-framework-fileprovider
+    #   pyobjc-framework-findersync
+    #   pyobjc-framework-fsevents
+    #   pyobjc-framework-fskit
+    #   pyobjc-framework-gamecenter
+    #   pyobjc-framework-gamecontroller
+    #   pyobjc-framework-gamekit
+    #   pyobjc-framework-gameplaykit
+    #   pyobjc-framework-gamesave
+    #   pyobjc-framework-healthkit
+    #   pyobjc-framework-imagecapturecore
+    #   pyobjc-framework-inputmethodkit
+    #   pyobjc-framework-installerplugins
+    #   pyobjc-framework-instantmessage
+    #   pyobjc-framework-intents
+    #   pyobjc-framework-iobluetooth
+    #   pyobjc-framework-iosurface
+    #   pyobjc-framework-ituneslibrary
+    #   pyobjc-framework-kernelmanagement
+    #   pyobjc-framework-latentsemanticmapping
+    #   pyobjc-framework-libdispatch
+    #   pyobjc-framework-libxpc
+    #   pyobjc-framework-linkpresentation
+    #   pyobjc-framework-localauthentication
+    #   pyobjc-framework-localauthenticationembeddedui
+    #   pyobjc-framework-mailkit
+    #   pyobjc-framework-mapkit
+    #   pyobjc-framework-mediaaccessibility
+    #   pyobjc-framework-mediaextension
+    #   pyobjc-framework-medialibrary
+    #   pyobjc-framework-mediatoolbox
+    #   pyobjc-framework-metal
+    #   pyobjc-framework-metalkit
+    #   pyobjc-framework-metrickit
+    #   pyobjc-framework-mlcompute
+    #   pyobjc-framework-modelio
+    #   pyobjc-framework-multipeerconnectivity
+    #   pyobjc-framework-naturallanguage
+    #   pyobjc-framework-netfs
+    #   pyobjc-framework-network
+    #   pyobjc-framework-networkextension
+    #   pyobjc-framework-notificationcenter
+    #   pyobjc-framework-opendirectory
+    #   pyobjc-framework-osakit
+    #   pyobjc-framework-oslog
+    #   pyobjc-framework-passkit
+    #   pyobjc-framework-pencilkit
+    #   pyobjc-framework-photos
+    #   pyobjc-framework-photosui
+    #   pyobjc-framework-preferencepanes
+    #   pyobjc-framework-pushkit
+    #   pyobjc-framework-quartz
+    #   pyobjc-framework-quicklookthumbnailing
+    #   pyobjc-framework-replaykit
+    #   pyobjc-framework-safariservices
+    #   pyobjc-framework-safetykit
+    #   pyobjc-framework-scenekit
+    #   pyobjc-framework-screencapturekit
+    #   pyobjc-framework-screensaver
+    #   pyobjc-framework-screentime
+    #   pyobjc-framework-scriptingbridge
+    #   pyobjc-framework-security
+    #   pyobjc-framework-securityfoundation
+    #   pyobjc-framework-securityinterface
+    #   pyobjc-framework-securityui
+    #   pyobjc-framework-sensitivecontentanalysis
+    #   pyobjc-framework-servicemanagement
+    #   pyobjc-framework-sharedwithyoucore
+    #   pyobjc-framework-shazamkit
+    #   pyobjc-framework-social
+    #   pyobjc-framework-soundanalysis
+    #   pyobjc-framework-speech
+    #   pyobjc-framework-spritekit
+    #   pyobjc-framework-storekit
+    #   pyobjc-framework-symbols
+    #   pyobjc-framework-syncservices
+    #   pyobjc-framework-systemconfiguration
+    #   pyobjc-framework-systemextensions
+    #   pyobjc-framework-threadnetwork
+    #   pyobjc-framework-uniformtypeidentifiers
+    #   pyobjc-framework-usernotifications
+    #   pyobjc-framework-usernotificationsui
+    #   pyobjc-framework-videosubscriberaccount
+    #   pyobjc-framework-videotoolbox
+    #   pyobjc-framework-virtualization
+    #   pyobjc-framework-vision
+    #   pyobjc-framework-webkit
+pyobjc-framework-collaboration==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-colorsync==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-compositorservices==12.1 ; sys_platform == 'darwin'
+    # via pyobjc
+pyobjc-framework-contacts==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+    #   pyobjc-framework-contactsui
+pyobjc-framework-contactsui==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-coreaudio==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+    #   pyobjc-framework-avfoundation
+    #   pyobjc-framework-browserenginekit
+    #   pyobjc-framework-coreaudiokit
+pyobjc-framework-coreaudiokit==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-corebluetooth==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-coredata==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+    #   pyobjc-framework-cloudkit
+    #   pyobjc-framework-syncservices
+pyobjc-framework-corehaptics==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-corelocation==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+    #   pyobjc-framework-cloudkit
+    #   pyobjc-framework-mapkit
+pyobjc-framework-coremedia==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+    #   pyobjc-framework-avfoundation
+    #   pyobjc-framework-browserenginekit
+    #   pyobjc-framework-cinematic
+    #   pyobjc-framework-mediaextension
+    #   pyobjc-framework-oslog
+    #   pyobjc-framework-screencapturekit
+    #   pyobjc-framework-videotoolbox
+pyobjc-framework-coremediaio==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-coremidi==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-coreml==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+    #   pyobjc-framework-vision
+pyobjc-framework-coremotion==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-coreservices==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+    #   pyobjc-framework-dictionaryservices
+    #   pyobjc-framework-launchservices
+    #   pyobjc-framework-searchkit
+pyobjc-framework-corespotlight==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-coretext==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+    #   pyobjc-framework-applicationservices
+pyobjc-framework-corewlan==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-cryptotokenkit==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-datadetection==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-devicecheck==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-devicediscoveryextension==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-dictionaryservices==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-discrecording==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+    #   pyobjc-framework-discrecordingui
+pyobjc-framework-discrecordingui==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-diskarbitration==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-dvdplayback==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-eventkit==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-exceptionhandling==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-executionpolicy==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-extensionkit==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-externalaccessory==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-fileprovider==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+    #   pyobjc-framework-fileproviderui
+pyobjc-framework-fileproviderui==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-findersync==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-fsevents==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+    #   pyobjc-framework-coreservices
+pyobjc-framework-fskit==12.1 ; sys_platform == 'darwin'
+    # via pyobjc
+pyobjc-framework-gamecenter==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-gamecontroller==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-gamekit==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-gameplaykit==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-gamesave==12.1 ; sys_platform == 'darwin'
+    # via pyobjc
+pyobjc-framework-healthkit==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-imagecapturecore==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-inputmethodkit==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-installerplugins==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-instantmessage==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-intents==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+    #   pyobjc-framework-intentsui
+pyobjc-framework-intentsui==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-iobluetooth==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+    #   pyobjc-framework-iobluetoothui
+pyobjc-framework-iobluetoothui==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-iosurface==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-ituneslibrary==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-kernelmanagement==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-latentsemanticmapping==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-launchservices==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-libdispatch==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-libxpc==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-linkpresentation==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-localauthentication==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+    #   pyobjc-framework-localauthenticationembeddedui
+pyobjc-framework-localauthenticationembeddedui==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-mailkit==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-mapkit==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-mediaaccessibility==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-mediaextension==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-medialibrary==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-mediaplayer==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-mediatoolbox==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-metal==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+    #   pyobjc-framework-cinematic
+    #   pyobjc-framework-compositorservices
+    #   pyobjc-framework-metalfx
+    #   pyobjc-framework-metalkit
+    #   pyobjc-framework-metalperformanceshaders
+pyobjc-framework-metalfx==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-metalkit==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-metalperformanceshaders==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+    #   pyobjc-framework-metalperformanceshadersgraph
+pyobjc-framework-metalperformanceshadersgraph==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-metrickit==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-mlcompute==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-modelio==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-multipeerconnectivity==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-naturallanguage==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-netfs==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-network==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-networkextension==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-notificationcenter==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-opendirectory==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-osakit==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-oslog==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-passkit==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-pencilkit==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-phase==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-photos==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-photosui==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-preferencepanes==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-pushkit==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-quartz==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+    #   pyobjc-framework-accessibility
+    #   pyobjc-framework-applicationservices
+    #   pyobjc-framework-avfoundation
+    #   pyobjc-framework-avkit
+    #   pyobjc-framework-browserenginekit
+    #   pyobjc-framework-coretext
+    #   pyobjc-framework-gamekit
+    #   pyobjc-framework-instantmessage
+    #   pyobjc-framework-linkpresentation
+    #   pyobjc-framework-mapkit
+    #   pyobjc-framework-medialibrary
+    #   pyobjc-framework-modelio
+    #   pyobjc-framework-oslog
+    #   pyobjc-framework-quicklookthumbnailing
+    #   pyobjc-framework-safetykit
+    #   pyobjc-framework-scenekit
+    #   pyobjc-framework-sensitivecontentanalysis
+    #   pyobjc-framework-spritekit
+    #   pyobjc-framework-videotoolbox
+    #   pyobjc-framework-vision
+pyobjc-framework-quicklookthumbnailing==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-replaykit==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-safariservices==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-safetykit==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-scenekit==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-screencapturekit==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-screensaver==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-screentime==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-scriptingbridge==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-searchkit==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-security==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+    #   pyobjc-framework-localauthentication
+    #   pyobjc-framework-securityfoundation
+    #   pyobjc-framework-securityinterface
+    #   pyobjc-framework-securityui
+pyobjc-framework-securityfoundation==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-securityinterface==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-securityui==12.1 ; sys_platform == 'darwin'
+    # via pyobjc
+pyobjc-framework-sensitivecontentanalysis==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-servicemanagement==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-sharedwithyou==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-sharedwithyoucore==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+    #   pyobjc-framework-sharedwithyou
+pyobjc-framework-shazamkit==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-social==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-soundanalysis==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-speech==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-spritekit==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+    #   pyobjc-framework-gameplaykit
+pyobjc-framework-storekit==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-symbols==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-syncservices==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-systemconfiguration==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-systemextensions==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-threadnetwork==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-uniformtypeidentifiers==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-usernotifications==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+    #   pyobjc-framework-usernotificationsui
+pyobjc-framework-usernotificationsui==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-videosubscriberaccount==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-videotoolbox==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-virtualization==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-vision==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyobjc-framework-webkit==12.1 ; sys_platform == 'darwin'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pyobjc
+pyparsing==3.2.3
+    # via
+    #   httplib2
+    #   rdflib
+pypika==0.48.9
+    # via chromadb
+pyproject-hooks==1.2.0
+    # via
+    #   build
+    #   pip-tools
+pyqt6==6.10.1
+    # via -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+pyqt6-qt6==6.10.1
+    # via pyqt6
+pyqt6-sip==13.10.3
+    # via pyqt6
+pyreadline3==3.5.4 ; sys_platform == 'win32'
+    # via humanfriendly
+pytest==8.4.1
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   pytest-asyncio
+    #   pytest-mock
+pytest-asyncio==1.1.0
+    # via -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+pytest-mock==3.14.1
+    # via -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+python-dateutil==2.9.0.post0
+    # via
+    #   csvw
+    #   kubernetes
+    #   pandas
+    #   posthog
+python-dotenv==1.1.1
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   litellm
+    #   pymilvus
+    #   uvicorn
+python-engineio==4.12.2
+    # via python-socketio
+python-frontmatter==1.1.0
+    # via -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+python-multipart==0.0.21 ; sys_platform == 'darwin'
+    # via gradio
+python-socketio==5.13.0
+    # via -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+pytz==2025.2
+    # via pandas
+pyyaml==6.0.2
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   chromadb
+    #   datasets
+    #   gradio
+    #   huggingface-hub
+    #   kubernetes
+    #   mlx-lm
+    #   omegaconf
+    #   python-frontmatter
+    #   transformers
+    #   uvicorn
+rdflib==7.5.0
+    # via csvw
+redis==6.4.0
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   fakeredis
+referencing==0.36.2
+    # via
+    #   jsonschema
+    #   jsonschema-specifications
+regex==2025.9.1
+    # via
+    #   curated-tokenizers
+    #   misaki
+    #   segments
+    #   tiktoken
+    #   transformers
+requests==2.32.5
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   csvw
+    #   datasets
+    #   google-api-core
+    #   google-genai
+    #   huggingface-hub
+    #   kubernetes
+    #   mistral-common
+    #   mlx-vlm
+    #   posthog
+    #   requests-oauthlib
+    #   spacy
+    #   tiktoken
+    #   transformers
+    #   weasel
+requests-oauthlib==2.0.0
+    # via kubernetes
+rfc3986==1.5.0
+    # via csvw
+rich==14.1.0
+    # via
+    #   chromadb
+    #   typer
+rpds-py==0.27.1
+    # via
+    #   jsonschema
+    #   referencing
+rsa==4.9.1
+    # via google-auth
+safehttpx==0.1.7 ; sys_platform == 'darwin'
+    # via gradio
+safetensors==0.6.2
+    # via transformers
+scikit-learn==1.7.1
+    # via sentence-transformers
+scipy==1.16.1
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   mlx-vlm
+    #   mlx-whisper
+    #   pyloudnorm
+    #   scikit-learn
+    #   sentence-transformers
+segments==2.3.0
+    # via phonemizer-fork
+semantic-version==2.10.0 ; sys_platform == 'darwin'
+    # via gradio
+sentence-transformers==5.1.0
+    # via -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+sentencepiece==0.2.1
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   mlx-audio
+    #   mlx-lm
+setuptools==80.9.0
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   grpcio-tools
+    #   pip-tools
+    #   pymilvus
+    #   spacy
+    #   thinc
+    #   torch
+shellingham==1.5.4
+    # via typer
+simple-websocket==1.1.0
+    # via python-engineio
+six==1.17.0
+    # via
+    #   kubernetes
+    #   posthog
+    #   python-dateutil
+smart-open==7.5.0
+    # via weasel
+smmap==5.0.2
+    # via gitdb
+sniffio==1.3.1
+    # via
+    #   anyio
+    #   openai
+sortedcontainers==2.4.0
+    # via fakeredis
+sounddevice==0.5.3
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   mlx-audio
+soundfile==0.13.1
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   mistral-common
+    #   mlx-audio
+    #   mlx-vlm
+soupsieve==2.8
+    # via beautifulsoup4
+soxr==1.0.0
+    # via mistral-common
+spacy==3.8.11
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   misaki
+    #   mlx-audio
+spacy-curated-transformers==0.3.1
+    # via misaki
+spacy-legacy==3.0.12
+    # via spacy
+spacy-loggers==1.0.5
+    # via spacy
+srsly==2.5.2
+    # via
+    #   confection
+    #   spacy
+    #   thinc
+    #   weasel
+starlette==0.47.3
+    # via
+    #   fastapi
+    #   gradio
+sympy==1.14.0
+    # via
+    #   einx
+    #   onnxruntime
+    #   torch
+temporalio==1.16.0
+    # via -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+tenacity==9.1.2
+    # via
+    #   chromadb
+    #   google-genai
+termcolor==3.2.0
+    # via csvw
+thinc==8.3.10
+    # via spacy
+threadpoolctl==3.6.0
+    # via scikit-learn
+tiktoken==0.12.0
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   litellm
+    #   mistral-common
+    #   mlx-whisper
+tokenizers==0.22.0
+    # via
+    #   chromadb
+    #   litellm
+    #   transformers
+tomlkit==0.13.3 ; sys_platform == 'darwin'
+    # via gradio
+torch==2.9.1
+    # via
+    #   curated-transformers
+    #   kokoro
+    #   mlx-whisper
+    #   sentence-transformers
+    #   spacy-curated-transformers
+tqdm==4.67.1
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   chromadb
+    #   datasets
+    #   google-generativeai
+    #   huggingface-hub
+    #   milvus-lite
+    #   mlx-audio
+    #   mlx-vlm
+    #   mlx-whisper
+    #   openai
+    #   sentence-transformers
+    #   spacy
+    #   transformers
+transformers==4.56.0
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   kokoro
+    #   mlx-audio
+    #   mlx-lm
+    #   mlx-vlm
+    #   sentence-transformers
+triton==3.5.1 ; sys_platform == 'linux'
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   torch
+typer==0.17.3
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   chromadb
+    #   gradio
+typer-slim==0.21.0
+    # via
+    #   spacy
+    #   weasel
+types-protobuf==6.30.2.20250822
+    # via temporalio
+typing-extensions==4.15.0
+    # via
+    #   aiosignal
+    #   anyio
+    #   beautifulsoup4
+    #   chromadb
+    #   fastapi
+    #   google-genai
+    #   google-generativeai
+    #   gradio
+    #   gradio-client
+    #   huggingface-hub
+    #   mistral-common
+    #   nexus-rpc
+    #   openai
+    #   opentelemetry-api
+    #   opentelemetry-exporter-otlp-proto-grpc
+    #   opentelemetry-sdk
+    #   opentelemetry-semantic-conventions
+    #   phonemizer-fork
+    #   pydantic
+    #   pydantic-core
+    #   pydantic-extra-types
+    #   referencing
+    #   sentence-transformers
+    #   starlette
+    #   temporalio
+    #   torch
+    #   typer
+    #   typer-slim
+    #   typing-inspection
+typing-inspection==0.4.1
+    # via pydantic
+tzdata==2025.2
+    # via pandas
+ujson==5.11.0
+    # via pymilvus
+uritemplate==4.2.0
+    # via
+    #   csvw
+    #   google-api-python-client
+urllib3==2.5.0
+    # via
+    #   kubernetes
+    #   requests
+uvicorn==0.35.0
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   chromadb
+    #   gradio
+uvloop==0.21.0 ; platform_python_implementation != 'PyPy' and sys_platform != 'cygwin' and sys_platform != 'win32'
+    # via uvicorn
+wasabi==1.1.3
+    # via
+    #   spacy
+    #   thinc
+    #   weasel
+watchfiles==1.1.0
+    # via uvicorn
+weasel==0.4.3
+    # via spacy
+websocket-client==1.8.0
+    # via
+    #   -r /Users/acmcarther/projects/yesod/third_party/python/requirements.txt
+    #   kubernetes
+websockets==15.0.1
+    # via
+    #   google-genai
+    #   uvicorn
+wheel==0.45.1
+    # via pip-tools
+win32-setctime==1.2.0 ; sys_platform == 'win32'
+    # via loguru
+wrapt==2.0.1
+    # via smart-open
+wsproto==1.2.0
+    # via simple-websocket
+xxhash==3.6.0 ; sys_platform == 'darwin'
+    # via datasets
+yarl==1.22.0
+    # via aiohttp
+zipp==3.23.0
+    # via importlib-metadata
diff --git a/third_party/python/requirements.txt b/third_party/python/requirements.txt
new file mode 100644
index 0000000..1300515
--- /dev/null
+++ b/third_party/python/requirements.txt
@@ -0,0 +1,237 @@
+beautifulsoup4
+deepdiff
+fakeredis
+fastapi
+google-generativeai
+google-genai
+google-auth
+numpy
+pandas
+pyfiglet
+pytest
+pytest-asyncio
+python-dotenv
+python-frontmatter
+python-socketio
+pyyaml
+redis
+requests
+temporalio
+uvicorn
+websocket-client
+gitpython
+pytest-mock
+typer
+chromadb
+sentence-transformers
+setuptools
+pymilvus
+pip-tools
+git-filter-repo
+openai
+litellm
+mlx; sys_platform == 'darwin'
+mlx-lm; sys_platform == 'darwin'
+mlx-audio[tts]; sys_platform == 'darwin'
+mlx-vlm; sys_platform == 'darwin'
+mlx-metal; sys_platform == 'darwin'
+scipy
+sounddevice
+loguru
+misaki[en]
+docopt
+num2words
+spacy
+kokoro
+huggingface_hub
+phonemizer-fork
+espeakng-loader
+sentencepiece
+einops
+tqdm
+pyloudnorm
+omegaconf
+einx
+dacite
+mistral-common[audio]
+tiktoken
+transformers
+hf_transfer
+mlx_whisper; sys_platform == 'darwin'
+sounddevice
+pyqt6
+python-socketio
+asyncio
+aiohttp
+grpcio-tools
+grpcio
+absl-py
+pyobjc; sys_platform == 'darwin'
+pyobjc-core; sys_platform == 'darwin'
+pyobjc-framework-accessibility; sys_platform == 'darwin'
+pyobjc-framework-accounts; sys_platform == 'darwin'
+pyobjc-framework-addressbook; sys_platform == 'darwin'
+pyobjc-framework-adservices; sys_platform == 'darwin'
+pyobjc-framework-adsupport; sys_platform == 'darwin'
+pyobjc-framework-applescriptkit; sys_platform == 'darwin'
+pyobjc-framework-applescriptobjc; sys_platform == 'darwin'
+pyobjc-framework-applicationservices; sys_platform == 'darwin'
+pyobjc-framework-apptrackingtransparency; sys_platform == 'darwin'
+pyobjc-framework-audiovideobridging; sys_platform == 'darwin'
+pyobjc-framework-authenticationservices; sys_platform == 'darwin'
+pyobjc-framework-automaticassessmentconfiguration; sys_platform == 'darwin'
+pyobjc-framework-automator; sys_platform == 'darwin'
+pyobjc-framework-avfoundation; sys_platform == 'darwin'
+pyobjc-framework-avkit; sys_platform == 'darwin'
+pyobjc-framework-avrouting; sys_platform == 'darwin'
+pyobjc-framework-backgroundassets; sys_platform == 'darwin'
+pyobjc-framework-browserenginekit; sys_platform == 'darwin'
+pyobjc-framework-businesschat; sys_platform == 'darwin'
+pyobjc-framework-calendarstore; sys_platform == 'darwin'
+pyobjc-framework-callkit; sys_platform == 'darwin'
+pyobjc-framework-carbon; sys_platform == 'darwin'
+pyobjc-framework-cfnetwork; sys_platform == 'darwin'
+pyobjc-framework-cinematic; sys_platform == 'darwin'
+pyobjc-framework-classkit; sys_platform == 'darwin'
+pyobjc-framework-cloudkit; sys_platform == 'darwin'
+pyobjc-framework-cocoa; sys_platform == 'darwin'
+pyobjc-framework-collaboration; sys_platform == 'darwin'
+pyobjc-framework-colorsync; sys_platform == 'darwin'
+pyobjc-framework-contacts; sys_platform == 'darwin'
+pyobjc-framework-contactsui; sys_platform == 'darwin'
+pyobjc-framework-coreaudio; sys_platform == 'darwin'
+pyobjc-framework-coreaudiokit; sys_platform == 'darwin'
+pyobjc-framework-corebluetooth; sys_platform == 'darwin'
+pyobjc-framework-coredata; sys_platform == 'darwin'
+pyobjc-framework-corehaptics; sys_platform == 'darwin'
+pyobjc-framework-corelocation; sys_platform == 'darwin'
+pyobjc-framework-coremedia; sys_platform == 'darwin'
+pyobjc-framework-coremediaio; sys_platform == 'darwin'
+pyobjc-framework-coremidi; sys_platform == 'darwin'
+pyobjc-framework-coreml; sys_platform == 'darwin'
+pyobjc-framework-coremotion; sys_platform == 'darwin'
+pyobjc-framework-coreservices; sys_platform == 'darwin'
+pyobjc-framework-corespotlight; sys_platform == 'darwin'
+pyobjc-framework-coretext; sys_platform == 'darwin'
+pyobjc-framework-corewlan; sys_platform == 'darwin'
+pyobjc-framework-cryptotokenkit; sys_platform == 'darwin'
+pyobjc-framework-datadetection; sys_platform == 'darwin'
+pyobjc-framework-devicecheck; sys_platform == 'darwin'
+pyobjc-framework-devicediscoveryextension; sys_platform == 'darwin'
+pyobjc-framework-dictionaryservices; sys_platform == 'darwin'
+pyobjc-framework-discrecording; sys_platform == 'darwin'
+pyobjc-framework-discrecordingui; sys_platform == 'darwin'
+pyobjc-framework-diskarbitration; sys_platform == 'darwin'
+pyobjc-framework-dvdplayback; sys_platform == 'darwin'
+pyobjc-framework-eventkit; sys_platform == 'darwin'
+pyobjc-framework-exceptionhandling; sys_platform == 'darwin'
+pyobjc-framework-executionpolicy; sys_platform == 'darwin'
+pyobjc-framework-extensionkit; sys_platform == 'darwin'
+pyobjc-framework-externalaccessory; sys_platform == 'darwin'
+pyobjc-framework-fileprovider; sys_platform == 'darwin'
+pyobjc-framework-fileproviderui; sys_platform == 'darwin'
+pyobjc-framework-findersync; sys_platform == 'darwin'
+pyobjc-framework-fsevents; sys_platform == 'darwin'
+pyobjc-framework-gamecenter; sys_platform == 'darwin'
+pyobjc-framework-gamecontroller; sys_platform == 'darwin'
+pyobjc-framework-gamekit; sys_platform == 'darwin'
+pyobjc-framework-gameplaykit; sys_platform == 'darwin'
+pyobjc-framework-healthkit; sys_platform == 'darwin'
+pyobjc-framework-imagecapturecore; sys_platform == 'darwin'
+pyobjc-framework-inputmethodkit; sys_platform == 'darwin'
+pyobjc-framework-installerplugins; sys_platform == 'darwin'
+pyobjc-framework-instantmessage; sys_platform == 'darwin'
+pyobjc-framework-intents; sys_platform == 'darwin'
+pyobjc-framework-intentsui; sys_platform == 'darwin'
+pyobjc-framework-iobluetooth; sys_platform == 'darwin'
+pyobjc-framework-iobluetoothui; sys_platform == 'darwin'
+pyobjc-framework-iosurface; sys_platform == 'darwin'
+pyobjc-framework-ituneslibrary; sys_platform == 'darwin'
+pyobjc-framework-kernelmanagement; sys_platform == 'darwin'
+pyobjc-framework-latentsemanticmapping; sys_platform == 'darwin'
+pyobjc-framework-launchservices; sys_platform == 'darwin'
+pyobjc-framework-libdispatch; sys_platform == 'darwin'
+pyobjc-framework-libxpc; sys_platform == 'darwin'
+pyobjc-framework-linkpresentation; sys_platform == 'darwin'
+pyobjc-framework-localauthentication; sys_platform == 'darwin'
+pyobjc-framework-localauthenticationembeddedui; sys_platform == 'darwin'
+pyobjc-framework-mailkit; sys_platform == 'darwin'
+pyobjc-framework-mapkit; sys_platform == 'darwin'
+pyobjc-framework-mediaaccessibility; sys_platform == 'darwin'
+pyobjc-framework-mediaextension; sys_platform == 'darwin'
+pyobjc-framework-medialibrary; sys_platform == 'darwin'
+pyobjc-framework-mediaplayer; sys_platform == 'darwin'
+pyobjc-framework-mediatoolbox; sys_platform == 'darwin'
+pyobjc-framework-metal; sys_platform == 'darwin'
+pyobjc-framework-metalfx; sys_platform == 'darwin'
+pyobjc-framework-metalkit; sys_platform == 'darwin'
+pyobjc-framework-metalperformanceshaders; sys_platform == 'darwin'
+pyobjc-framework-metalperformanceshadersgraph; sys_platform == 'darwin'
+pyobjc-framework-metrickit; sys_platform == 'darwin'
+pyobjc-framework-mlcompute; sys_platform == 'darwin'
+pyobjc-framework-modelio; sys_platform == 'darwin'
+pyobjc-framework-multipeerconnectivity; sys_platform == 'darwin'
+pyobjc-framework-naturallanguage; sys_platform == 'darwin'
+pyobjc-framework-netfs; sys_platform == 'darwin'
+pyobjc-framework-network; sys_platform == 'darwin'
+pyobjc-framework-networkextension; sys_platform == 'darwin'
+pyobjc-framework-notificationcenter; sys_platform == 'darwin'
+pyobjc-framework-opendirectory; sys_platform == 'darwin'
+pyobjc-framework-osakit; sys_platform == 'darwin'
+pyobjc-framework-oslog; sys_platform == 'darwin'
+pyobjc-framework-passkit; sys_platform == 'darwin'
+pyobjc-framework-pencilkit; sys_platform == 'darwin'
+pyobjc-framework-phase; sys_platform == 'darwin'
+pyobjc-framework-photos; sys_platform == 'darwin'
+pyobjc-framework-photosui; sys_platform == 'darwin'
+pyobjc-framework-preferencepanes; sys_platform == 'darwin'
+pyobjc-framework-pushkit; sys_platform == 'darwin'
+pyobjc-framework-quartz; sys_platform == 'darwin'
+pyobjc-framework-quicklookthumbnailing; sys_platform == 'darwin'
+pyobjc-framework-replaykit; sys_platform == 'darwin'
+pyobjc-framework-safariservices; sys_platform == 'darwin'
+pyobjc-framework-safetykit; sys_platform == 'darwin'
+pyobjc-framework-scenekit; sys_platform == 'darwin'
+pyobjc-framework-screencapturekit; sys_platform == 'darwin'
+pyobjc-framework-screensaver; sys_platform == 'darwin'
+pyobjc-framework-screentime; sys_platform == 'darwin'
+pyobjc-framework-scriptingbridge; sys_platform == 'darwin'
+pyobjc-framework-searchkit; sys_platform == 'darwin'
+pyobjc-framework-security; sys_platform == 'darwin'
+pyobjc-framework-securityfoundation; sys_platform == 'darwin'
+pyobjc-framework-securityinterface; sys_platform == 'darwin'
+pyobjc-framework-sensitivecontentanalysis; sys_platform == 'darwin'
+pyobjc-framework-servicemanagement; sys_platform == 'darwin'
+pyobjc-framework-sharedwithyou; sys_platform == 'darwin'
+pyobjc-framework-sharedwithyoucore; sys_platform == 'darwin'
+pyobjc-framework-shazamkit; sys_platform == 'darwin'
+pyobjc-framework-social; sys_platform == 'darwin'
+pyobjc-framework-soundanalysis; sys_platform == 'darwin'
+pyobjc-framework-speech; sys_platform == 'darwin'
+pyobjc-framework-spritekit; sys_platform == 'darwin'
+pyobjc-framework-storekit; sys_platform == 'darwin'
+pyobjc-framework-symbols; sys_platform == 'darwin'
+pyobjc-framework-syncservices; sys_platform == 'darwin'
+pyobjc-framework-systemconfiguration; sys_platform == 'darwin'
+pyobjc-framework-systemextensions; sys_platform == 'darwin'
+pyobjc-framework-threadnetwork; sys_platform == 'darwin'
+pyobjc-framework-uniformtypeidentifiers; sys_platform == 'darwin'
+pyobjc-framework-usernotifications; sys_platform == 'darwin'
+pyobjc-framework-usernotificationsui; sys_platform == 'darwin'
+pyobjc-framework-videosubscriberaccount; sys_platform == 'darwin'
+pyobjc-framework-videotoolbox; sys_platform == 'darwin'
+pyobjc-framework-virtualization; sys_platform == 'darwin'
+pyobjc-framework-vision; sys_platform == 'darwin'
+pyobjc-framework-webkit; sys_platform == 'darwin'
+nvidia-cuda-nvrtc-cu12; sys_platform == 'linux'
+nvidia-cuda-runtime-cu12; sys_platform == 'linux'
+nvidia-cudnn-cu12; sys_platform == 'linux'
+nvidia-cublas-cu12; sys_platform == 'linux'
+nvidia-cufft-cu12; sys_platform == 'linux'
+nvidia-curand-cu12; sys_platform == 'linux'
+nvidia-cusolver-cu12; sys_platform == 'linux'
+nvidia-cusparse-cu12; sys_platform == 'linux'
+nvidia-nccl-cu12; sys_platform == 'linux'
+nvidia-nvtx-cu12; sys_platform == 'linux'
+triton; sys_platform == 'linux'
+soundfile
\ No newline at end of file
diff --git a/third_party/python/sanitize_lockfile.py b/third_party/python/sanitize_lockfile.py
new file mode 100644
index 0000000..b72e730
--- /dev/null
+++ b/third_party/python/sanitize_lockfile.py
@@ -0,0 +1,31 @@
+import sys
+import re
+
+if len(sys.argv) < 2:
+    print("Usage: sanitize_lockfile.py <path_to_lockfile>")
+    sys.exit(1)
+
+path = sys.argv[1]
+
+try:
+    with open(path, 'r') as f:
+        content = f.read()
+
+    # Remove platform_release checks (e.g. platform_release >= '25.0' and ...)
+    # Matches: platform_release <op> 'version' [and]
+    content = re.sub(r"platform_release\s*[<>=!]+\s*'[^']*'\s*(and\s*)?", "", content)
+    
+    # Remove python_full_version checks
+    content = re.sub(r"python_full_version\s*[<>=!]+\s*'[^']*'\s*(and\s*)?", "", content)
+
+    # Fix colorama complex marker
+    content = re.sub(r"colorama==0.4.6 ; .*", "colorama==0.4.6 ; sys_platform == 'win32'", content)
+
+    with open(path, 'w') as f:
+        f.write(content)
+    
+    print(f"Sanitized {path}")
+
+except Exception as e:
+    print(f"Error sanitizing lockfile: {e}")
+    sys.exit(1)
diff --git a/third_party/python/spacy/BUILD.bazel b/third_party/python/spacy/BUILD.bazel
new file mode 100644
index 0000000..e485a0c
--- /dev/null
+++ b/third_party/python/spacy/BUILD.bazel
@@ -0,0 +1,7 @@
+load("@aspect_rules_py//py:defs.bzl", "py_unpacked_wheel")
+
+py_unpacked_wheel(
+    name = "en_core_web_sm",
+    src = "@spacy_en_core_web_sm//file",
+    visibility = ["//visibility:public"],
+)
diff --git a/third_party/python/uv_compile_wrapper.sh b/third_party/python/uv_compile_wrapper.sh
new file mode 100755
index 0000000..cad990d
--- /dev/null
+++ b/third_party/python/uv_compile_wrapper.sh
@@ -0,0 +1,27 @@
+#!/bin/bash
+set -e
+
+if [[ "$OSTYPE" == "darwin"* ]]; then
+  SEARCH_PATTERN="uv_macos_aarch64"
+else
+  SEARCH_PATTERN="uv_linux_x86_64"
+fi
+
+# Locate the directory containing the uv binary
+# We search for a directory in '..' that contains the search pattern in its name
+REPO_DIR=$(find .. -type d -name "*${SEARCH_PATTERN}*" | head -n 1)
+
+if [[ -z "$REPO_DIR" ]]; then
+  echo "Error: Could not find uv repository directory matching *$SEARCH_PATTERN*"
+  exit 1
+fi
+
+UV_PATH="$REPO_DIR/uv"
+
+if [[ ! -f "$UV_PATH" ]]; then
+  echo "Error: uv binary not found at $UV_PATH"
+  exit 1
+fi
+
+echo "Found uv at: $UV_PATH"
+"$UV_PATH" pip compile "$@"
diff --git a/tools/BUILD.bazel b/tools/BUILD.bazel
new file mode 100644
index 0000000..1d15547
--- /dev/null
+++ b/tools/BUILD.bazel
@@ -0,0 +1,49 @@
+load("@pip_third_party//:requirements.bzl", "requirement")
+load("@rules_python//python:defs.bzl", "py_binary")
+
+exports_files([
+    "mypy.ini",
+    "tanka_runner.sh",
+])
+
+py_binary(
+    name = "helm_sync",
+    srcs = ["helm_sync.py"],
+    deps = [
+        requirement("requests"),
+        requirement("pyyaml"),
+    ],
+)
+
+sh_binary(
+    name = "pnpm",
+    srcs = ["pnpm_runner.sh"],
+    data = select({
+        "@platforms//os:linux": ["@pnpm_linux_amd64//file"],
+        "@platforms//os:macos": ["@pnpm_macos_arm64//file"],
+    }),
+)
+
+genrule(
+    name = "sops_bin",
+    srcs = select({
+        "@platforms//os:linux": ["@sops_linux_amd64//file:sops"],
+        "@platforms//os:macos": ["@sops_darwin_arm64//file:sops"],
+        "//conditions:default": ["@sops_linux_amd64//file:sops"],
+    }),
+    outs = ["sops"],
+    cmd = "cp $< $@",
+    executable = True,
+    visibility = ["//visibility:public"],
+)
+
+py_binary(
+    name = "fake_sops",
+    srcs = ["fake_sops.py"],
+    main = "fake_sops.py",
+    visibility = ["//visibility:public"],
+    deps = [
+        requirement("pyyaml"),
+    ],
+)
+    
\ No newline at end of file
diff --git a/tools/aspects.bzl b/tools/aspects.bzl
new file mode 100644
index 0000000..21321b5
--- /dev/null
+++ b/tools/aspects.bzl
@@ -0,0 +1,7 @@
+load("@pip_types//:types.bzl", "types")
+load("@rules_mypy//mypy:mypy.bzl", "mypy")
+
+mypy_aspect = mypy(
+    mypy_ini = "@@//tools:mypy.ini",
+    types = types
+)
\ No newline at end of file
diff --git a/tools/copybara/BUILD.bazel b/tools/copybara/BUILD.bazel
new file mode 100644
index 0000000..c442c15
--- /dev/null
+++ b/tools/copybara/BUILD.bazel
@@ -0,0 +1,13 @@
+load("@rules_java//java:defs.bzl", "java_binary", "java_import")
+
+java_import(
+    name = "copybara_import",
+    jars = ["@copybara_jar//file"],
+)
+
+java_binary(
+    name = "copybara",
+    main_class = "com.google.copybara.Main",
+    runtime_deps = [":copybara_import"],
+    visibility = ["//visibility:public"],
+)
diff --git a/tools/copybara/homebrew/copy.bara.sky b/tools/copybara/homebrew/copy.bara.sky
new file mode 100644
index 0000000..435e282
--- /dev/null
+++ b/tools/copybara/homebrew/copy.bara.sky
@@ -0,0 +1,28 @@
+# tools/homebrew/copy.bara.sky
+
+# Source: Your Monorepo
+sourceUrl = "https://forgejo.csbx.dev/acmcarther/yesod.git"
+# Destination: The Public Homebrew Tap
+destinationUrl = "https://forgejo.csbx.dev/acmcarther/yesod-homebrew-tools.git"
+
+core.workflow(
+    name = "default",
+    origin = git.origin(
+        url = sourceUrl,
+        ref = "main",
+    ),
+    destination = git.destination(
+        url = destinationUrl,
+        fetch = "main",
+        push = "main",
+    ),
+    # Only look at the homebrew directory
+    origin_files = glob(["homebrew/*.rb"]),
+    
+    authoring = authoring.pass_thru("Copybara <copybara@csbx.dev>"),
+    
+    # Move homebrew/<file> -> <file> in the destination
+    transformations = [
+        core.move("homebrew", ""),
+    ],
+)
\ No newline at end of file
diff --git a/tools/copybara/yesod-mirror/copy.bara.sky b/tools/copybara/yesod-mirror/copy.bara.sky
new file mode 100644
index 0000000..3764e0d
--- /dev/null
+++ b/tools/copybara/yesod-mirror/copy.bara.sky
@@ -0,0 +1,28 @@
+# tools/homebrew/copy.bara.sky
+
+# Source: Monorepo
+sourceUrl = "https://forgejo.csbx.dev/acmcarther/yesod.git"
+# Destination: Monorepo (partial) mirror
+destinationUrl = "https://forgejo.csbx.dev/acmcarther/yesod-mirror.git"
+
+core.workflow(
+    name = "default",
+    origin = git.origin(
+        url = sourceUrl,
+        ref = "main",
+    ),
+    destination = git.destination(
+        url = destinationUrl,
+        fetch = "main",
+        push = "main",
+    ),
+    # Exclude notes and anything that looks secret-like for now.
+    # The secrets are encrypted, but we don't need them in the mirror anyway.
+    origin_files = glob(["**/*"], exclude=["notes/**", "**/*.sops.yaml"]),
+    
+    authoring = authoring.pass_thru("Copybara <copybara@csbx.dev>"),
+    
+    # No path changes in this mirror
+    transformations = [
+    ],
+)
\ No newline at end of file
diff --git a/tools/fake_sops.py b/tools/fake_sops.py
new file mode 100644
index 0000000..f1a946b
--- /dev/null
+++ b/tools/fake_sops.py
@@ -0,0 +1,45 @@
+import json
+import sys
+import yaml
+
+def deeply_obfuscate(data):
+    if isinstance(data, dict):
+        return {k: deeply_obfuscate(v) for k, v in data.items()}
+    elif isinstance(data, list):
+        return [deeply_obfuscate(v) for v in data]
+    elif isinstance(data, str) and data.startswith("ENC["):
+        return "fake-secret"
+    else:
+        return data
+
+def main():
+    if len(sys.argv) != 3:
+        print("Usage: fake_sops.py <input_file> <output_file>", file=sys.stderr)
+        sys.exit(1)
+
+    input_file = sys.argv[1]
+    output_file = sys.argv[2]
+
+    with open(input_file, 'r') as f:
+        content = f.read()
+    
+    try:
+        data = json.loads(content)
+    except json.JSONDecodeError:
+        try:
+            data = yaml.safe_load(content)
+        except yaml.YAMLError as e:
+            print(f"Error parsing input file as JSON or YAML: {e}", file=sys.stderr)
+            sys.exit(1)
+
+    obfuscated_data = deeply_obfuscate(data)
+
+    # Remove sops metadata
+    if "sops" in obfuscated_data:
+        del obfuscated_data["sops"]
+
+    with open(output_file, 'w') as f:
+        json.dump(obfuscated_data, f, indent=2)
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/helm_deps.bzl b/tools/helm_deps.bzl
new file mode 100644
index 0000000..d39ae66
--- /dev/null
+++ b/tools/helm_deps.bzl
@@ -0,0 +1,31 @@
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+def _helm_deps_impl(ctx):
+    # 1. Read the lockfile
+    lockfile_content = ctx.read(ctx.path(Label("//third_party/helm:chartfile.lock.json")))
+    lock = json.decode(lockfile_content)
+
+    # 2. Iterate over charts
+    for name, info in lock.get("charts", {}).items():
+        # name is like "grafana/grafana"
+        # repo_name will be "helm_grafana_grafana"
+        repo_name = "helm_" + name.replace("/", "_").replace("-", "_")
+        chart_name = name.split("/")[1]
+        
+        http_archive(
+            name = repo_name,
+            url = info["url"],
+            sha256 = info["digest"],
+            strip_prefix = chart_name, 
+            build_file_content = """
+filegroup(
+    name = "chart",
+    srcs = glob(["**"]),
+    visibility = ["//visibility:public"],
+)
+""",
+        )
+
+helm_deps = module_extension(
+    implementation = _helm_deps_impl,
+)
diff --git a/tools/helm_sync.py b/tools/helm_sync.py
new file mode 100644
index 0000000..86af6f7
--- /dev/null
+++ b/tools/helm_sync.py
@@ -0,0 +1,103 @@
+import yaml
+import json
+import requests
+import sys
+import os
+from urllib.parse import urljoin
+
+def load_yaml(path):
+    with open(path, 'r') as f:
+        return yaml.safe_load(f)
+
+def fetch_index(repo_url):
+    index_url = urljoin(repo_url + '/', 'index.yaml')
+    print(f"Fetching index from {index_url}...")
+    try:
+        r = requests.get(index_url)
+        r.raise_for_status()
+        return yaml.safe_load(r.text)
+    except Exception as e:
+        print(f"Error fetching {index_url}: {e}")
+        return None
+
+def main():
+    if len(sys.argv) < 2:
+        print("Usage: python helm_sync.py <path_to_chartfile.yaml> [output_lock_file]")
+        sys.exit(1)
+
+    chartfile_path = sys.argv[1]
+    lockfile_path = sys.argv[2] if len(sys.argv) > 2 else chartfile_path.replace('.yaml', '.lock.json')
+
+    print(f"Reading {chartfile_path}...")
+    chartfile = load_yaml(chartfile_path)
+
+    repos = {r['name']: r['url'] for r in chartfile.get('repositories', [])}
+    indices = {}
+
+    lock_data = {"charts": {}}
+
+    for req in chartfile.get('requires', []):
+        chart_ref = req['chart']
+        version = req['version']
+        
+        if '/' not in chart_ref:
+            print(f"Invalid chart reference: {chart_ref}. Expected repo/name.")
+            continue
+            
+        repo_name, chart_name = chart_ref.split('/', 1)
+        
+        if repo_name not in repos:
+            print(f"Repository '{repo_name}' not found for chart {chart_ref}")
+            continue
+            
+        repo_url = repos[repo_name]
+        
+        if repo_name not in indices:
+            indices[repo_name] = fetch_index(repo_url)
+            
+        index = indices[repo_name]
+        if not index:
+            print(f"Skipping {chart_ref} due to missing index.")
+            continue
+            
+        entries = index.get('entries', {}).get(chart_name, [])
+        
+        # Find exact version
+        matched_entry = None
+        for entry in entries:
+            if entry['version'] == version:
+                matched_entry = entry
+                break
+        
+        if not matched_entry:
+            print(f"Version {version} not found for chart {chart_ref}")
+            continue
+            
+        # Resolve URL
+        urls = matched_entry.get('urls', [])
+        if not urls:
+            print(f"No URLs found for {chart_ref} version {version}")
+            continue
+            
+        # URL can be relative or absolute
+        chart_url = urls[0]
+        if not chart_url.startswith('http'):
+            chart_url = urljoin(repo_url + '/', chart_url)
+            
+        digest = matched_entry.get('digest')
+        
+        print(f"Resolved {chart_ref} {version} -> {chart_url}")
+        
+        lock_data["charts"][chart_ref] = {
+            "version": version,
+            "url": chart_url,
+            "digest": digest
+        }
+
+    print(f"Writing lockfile to {lockfile_path}...")
+    with open(lockfile_path, 'w') as f:
+        json.dump(lock_data, f, indent=2, sort_keys=True)
+        f.write('\n')
+
+if __name__ == "__main__":
+    main()
diff --git a/tools/jsonnet_compiler/BUILD.bazel b/tools/jsonnet_compiler/BUILD.bazel
new file mode 100644
index 0000000..2c8e7e9
--- /dev/null
+++ b/tools/jsonnet_compiler/BUILD.bazel
@@ -0,0 +1,33 @@
+load("@rules_go//go:def.bzl", "go_binary", "go_library")
+load("@rules_jsonnet//jsonnet:toolchain.bzl", "jsonnet_toolchain")
+
+go_binary(
+    name = "jsonnet_compiler",
+    embed = [":jsonnet_compiler_lib"],
+    visibility = ["//visibility:public"],
+)
+
+go_library(
+    name = "jsonnet_compiler_lib",
+    srcs = ["main.go"],
+    importpath = "forgejo.csbx.dev/acmcarther/yesod/tools/jsonnet_compiler",
+    visibility = ["//visibility:private"],
+    deps = [
+        "//tools/jsonnet_compiler/helm_support",
+        "@jsonnet_go//:go_default_library",
+    ],
+)
+
+jsonnet_toolchain(
+    name = "helm_jsonnet",
+    compiler = ":jsonnet_compiler",
+    create_directory_flags = ["-c"],
+    manifest_file_support = True,
+)
+
+toolchain(
+    name = "helm_jsonnet_toolchain",
+    toolchain = ":helm_jsonnet",
+    toolchain_type = "@rules_jsonnet//jsonnet:toolchain_type",
+    visibility = ["//visibility:public"],
+)
diff --git a/tools/jsonnet_compiler/README.md b/tools/jsonnet_compiler/README.md
new file mode 100644
index 0000000..4c1447b
--- /dev/null
+++ b/tools/jsonnet_compiler/README.md
@@ -0,0 +1,48 @@
+# Custom Jsonnet Compiler
+
+This directory contains a custom Jsonnet compiler built with Go. It wraps the standard `go-jsonnet` library and adds a native function `helmTemplate` to support rendering Helm charts directly within Jsonnet.
+
+## `helmTemplate` Native Function
+
+The `helmTemplate` function allows you to render a Helm chart located on the filesystem.
+
+### Signature
+
+```jsonnet
+native("helmTemplate")(name, chartPath, opts)
+```
+
+- `name`: The release name.
+- `chartPath`: The path to the Helm chart directory (containing `Chart.yaml`). **Crucial:** This path must be relative to the directory containing the file that calls `helmTemplate`. When using Bazel external repositories, this often means navigating up to the execution root (e.g., `../../external/repo_name`).
+- `opts`: A configuration object.
+    - `calledFrom`: (Required) The path of the file calling the function. Usually `std.thisFile`. The compiler uses this to resolve relative paths.
+    - `nameFormat`: (Optional) Format string for resource names.
+    - `values`: (Optional) Values to pass to the Helm chart.
+    - `includeCRDs`: (Optional) Boolean, default `true`.
+    - `namespace`: (Optional) Namespace for the release.
+
+### Usage Example
+
+```jsonnet
+local helm = std.native("helmTemplate");
+
+helm("my-release", "../../external/my_chart_repo", {
+  calledFrom: std.thisFile,
+  namespace: "default",
+  values: {
+    replicaCount: 2,
+  },
+})
+```
+
+## Bazel Integration
+
+This compiler is registered as a custom toolchain in `//tools/jsonnet_compiler:helm_jsonnet_toolchain` and used by `rules_jsonnet`.
+
+### Imports and JPaths
+
+When using `rules_jsonnet`, the `imports` attribute adds directories to the Jsonnet search path (`-J`).
+- `imports = ["."]` adds the package directory.
+- `deps` on `jsonnet_library` targets adds their roots to the search path.
+
+When importing files from external repositories (like `tanka-util`), ensure the import path matches the structure within that repository. For example, if `tanka-util` library is at the root of the `@github_com_grafana_jsonnet_libs_tanka_util` repo, you can import it as `import "tanka-util/main.libsonnet"` provided the repo root is in the search path (which `deps` handles).
diff --git a/tools/jsonnet_compiler/helm_support/BUILD.bazel b/tools/jsonnet_compiler/helm_support/BUILD.bazel
new file mode 100644
index 0000000..d5ca498
--- /dev/null
+++ b/tools/jsonnet_compiler/helm_support/BUILD.bazel
@@ -0,0 +1,26 @@
+load("@bazel_skylib//rules:copy_file.bzl", "copy_file")
+load("@rules_go//go:def.bzl", "go_library")
+
+copy_file(
+    name = "copy_helm",
+    src = select({
+        "@platforms//os:macos": "@helm_macos_aarch64//:helm",
+        "@platforms//os:linux": "@helm_linux_x86_64//:helm",
+    }),
+    out = "helm",
+    is_executable = True,
+)
+
+go_library(
+    name = "helm_support",
+    srcs = ["helm_support.go"],
+    embedsrcs = ["helm"],
+    importpath = "forgejo.csbx.dev/acmcarther/yesod/tools/jsonnet_compiler/helm_support",
+    visibility = ["//visibility:public"],
+    deps = [
+        "@com_github_grafana_tanka//pkg/kubernetes/manifest",
+        "@in_gopkg_yaml_v3//:yaml_v3",
+        "@jsonnet_go//:go_default_library",
+        "@jsonnet_go//ast:go_default_library",
+    ],
+)
diff --git a/tools/jsonnet_compiler/helm_support/helm_support.go b/tools/jsonnet_compiler/helm_support/helm_support.go
new file mode 100644
index 0000000..13949f9
--- /dev/null
+++ b/tools/jsonnet_compiler/helm_support/helm_support.go
@@ -0,0 +1,299 @@
+package helm_support
+
+import (
+	"bytes"
+	"crypto/sha256"
+	_ "embed"
+	"encoding/base64"
+	"encoding/json"
+	"fmt"
+	"io"
+	"os"
+	"os/exec"
+	"path/filepath"
+	"sync"
+
+	"github.com/google/go-jsonnet"
+	"github.com/google/go-jsonnet/ast"
+	"github.com/grafana/tanka/pkg/kubernetes/manifest"
+	yaml "gopkg.in/yaml.v3"
+)
+
+//go:embed helm
+var helmBinary []byte
+
+// DefaultNameFormat to use when no nameFormat is supplied
+const DefaultNameFormat = `{{ print .kind "_" .metadata.name | snakecase }}`
+
+// helmTemplateCache caches the inline environments' rendered helm templates.
+var helmTemplateCache sync.Map
+
+// JsonnetOpts are additional properties the consumer of the native func might
+// pass.
+type JsonnetOpts struct {
+	TemplateOpts
+
+	// CalledFrom is the file that calls helmTemplate. This is used to find the
+	// vendored chart relative to this file
+	CalledFrom string `json:"calledFrom"`
+	// NameTemplate is used to create the keys in the resulting map
+	NameFormat string `json:"nameFormat"`
+}
+
+// ExecHelm is a Helm implementation powered by the `helm` command line utility
+type ExecHelm struct{}
+
+// NativeFunc returns a jsonnet native function that provides the same
+// functionality as `Helm.Template` of this package. Charts are required to be
+// present on the local filesystem, at a relative location to the file that
+// calls `helm.template()` / `std.native('helmTemplate')`. This guarantees
+// hermeticity
+func NativeFunc() *jsonnet.NativeFunction {
+	h := ExecHelm{}
+	return &jsonnet.NativeFunction{
+		Name: "helmTemplate",
+		// Similar to `helm template [NAME] [CHART] [flags]` except 'conf' is a
+		// bit more elaborate and chart is a local path
+		Params: ast.Identifiers{"name", "chart", "opts"},
+		Func: func(data []interface{}) (interface{}, error) {
+			name, ok := data[0].(string)
+			if !ok {
+				return nil, fmt.Errorf("first argument 'name' must be of 'string' type, got '%T' instead", data[0])
+			}
+
+			chartpath, ok := data[1].(string)
+			if !ok {
+				return nil, fmt.Errorf("second argument 'chart' must be of 'string' type, got '%T' instead", data[1])
+			}
+
+			// TODO: validate data[2] actually follows the struct scheme
+			opts, err := parseOpts(data[2])
+			if err != nil {
+				return "", err
+			}
+
+			chart, err := h.ChartExists(chartpath, opts)
+			if err != nil {
+				return nil, fmt.Errorf("helmTemplate: Failed to find a chart at '%s': %s. See https://tanka.dev/helm#failed-to-find-chart", chart, err)
+			}
+
+			// check if resources exist in cache
+			helmKey, err := templateKey(name, chartpath, opts.TemplateOpts)
+			if err != nil {
+				return nil, err
+			}
+			if entry, ok := helmTemplateCache.Load(helmKey); ok {
+				return entry, nil
+			}
+
+			// render resources
+			list, err := h.Template(name, chart, opts.TemplateOpts)
+			if err != nil {
+				return nil, err
+			}
+
+			// convert list to map
+			out, err := manifest.ListAsMap(list, opts.NameFormat)
+			if err != nil {
+				return nil, err
+			}
+
+			helmTemplateCache.Store(helmKey, out)
+			return out, nil
+		},
+	}
+}
+
+// templateKey returns the key identifier used in the template cache for the given helm chart.
+func templateKey(chartName string, chartPath string, opts TemplateOpts) (string, error) {
+	hasher := sha256.New()
+	hasher.Write([]byte(chartName))
+	hasher.Write([]byte(chartPath))
+	valuesBytes, err := json.Marshal(opts)
+	if err != nil {
+		return "", err
+	}
+	hasher.Write(valuesBytes)
+	return base64.URLEncoding.EncodeToString(hasher.Sum(nil)), nil
+}
+
+func parseOpts(data interface{}) (*JsonnetOpts, error) {
+	c, err := json.Marshal(data)
+	if err != nil {
+		return nil, err
+	}
+
+	// default IncludeCRDs to true, as this is the default in the `helm install`
+	// command. Needs to be specified here because the zero value of bool is
+	// false.
+	opts := JsonnetOpts{
+		TemplateOpts: TemplateOpts{
+			IncludeCRDs: true,
+		},
+	}
+
+	if err := json.Unmarshal(c, &opts); err != nil {
+		return nil, err
+	}
+
+	// Charts are only allowed at relative paths. Use conf.CalledFrom to find the callers directory
+	if opts.CalledFrom == "" {
+		return nil, fmt.Errorf("helmTemplate: 'opts.calledFrom' is unset or empty.\nTanka needs this to find your charts. See https://tanka.dev/helm#optscalledfrom-unset")
+	}
+
+	return &opts, nil
+}
+
+// TemplateOpts are additional, non-required options for Helm.Template
+type TemplateOpts struct {
+	// Values to pass to Helm using --values
+	Values map[string]interface{}`json:"values,omitempty"`
+
+	// Kubernetes api versions used for Capabilities.APIVersions
+	APIVersions []string
+	// IncludeCRDs specifies whether CustomResourceDefinitions are included in
+	// the template output
+	IncludeCRDs bool
+	// skip tests from templated output
+	SkipTests bool
+	// Kubernetes version used for Capabilities.KubeVersion
+	KubeVersion string
+	// Namespace scope for this request
+	Namespace string
+	// NoHooks specifies whether hooks should be excluded from the template output
+	NoHooks bool
+}
+
+// Flags returns all options apart from Values as their respective `helm
+// template` flag equivalent
+func (t TemplateOpts) Flags() []string {
+	var flags []string
+
+	for _, value := range t.APIVersions {
+		flags = append(flags, "--api-versions="+value)
+	}
+
+	if t.IncludeCRDs {
+		flags = append(flags, "--include-crds")
+	}
+
+	if t.SkipTests {
+		flags = append(flags, "--skip-tests")
+	}
+
+	if t.KubeVersion != "" {
+		flags = append(flags, "--kube-version="+t.KubeVersion)
+	}
+
+	if t.NoHooks {
+		flags = append(flags, "--no-hooks")
+	}
+
+	if t.Namespace != "" {
+		flags = append(flags, "--namespace="+t.Namespace)
+	}
+
+	return flags
+}
+
+func (e ExecHelm) templateCommandArgs(name, chart string, opts TemplateOpts) []string {
+	args := []string{name, chart,
+		"--values", "-", // values from stdin
+	}
+	args = append(args, opts.Flags()...)
+	return args
+}
+
+// Template expands a Helm Chart into a regular manifest.List using the `helm
+// template` command
+func (e ExecHelm) Template(name, chart string, opts TemplateOpts) (manifest.List, error) {
+	args := e.templateCommandArgs(name, chart, opts)
+
+	cmd := e.cmd("template", args...)
+	var buf bytes.Buffer
+	cmd.Stdout = &buf
+	cmd.Stderr = os.Stderr
+
+	data, err := yaml.Marshal(opts.Values)
+	if err != nil {
+		return nil, fmt.Errorf("converting Helm values to YAML: %w", err)
+	}
+	cmd.Stdin = bytes.NewReader(data)
+
+	if err := cmd.Run(); err != nil {
+		return nil, fmt.Errorf("expanding Helm Chart: %w", err)
+	}
+
+	var list manifest.List
+	d := yaml.NewDecoder(&buf)
+	for {
+		var m manifest.Manifest
+		if err := d.Decode(&m); err != nil {
+			if err == io.EOF {
+				break
+			}
+			return nil, fmt.Errorf("parsing Helm output: %w", err)
+		}
+
+		// Helm might return "empty" elements in the YAML stream that consist
+		// only of comments. Ignore these
+		if len(m) == 0 {
+			continue
+		}
+
+		list = append(list, m)
+	}
+
+	return list, nil
+}
+
+func (e ExecHelm) ChartExists(chart string, opts *JsonnetOpts) (string, error) {
+	// resolve the Chart relative to the caller
+	callerDir := filepath.Dir(opts.CalledFrom)
+	chart = filepath.Join(callerDir, chart)
+	if _, err := os.Stat(chart); err != nil {
+		return "", fmt.Errorf("helmTemplate: Failed to find a chart at '%s': %s. See https://tanka.dev/helm#failed-to-find-chart", chart, err)
+	}
+
+	return chart, nil
+}
+
+// cmd returns a prepared exec.Cmd to use the `helm` binary
+func (e ExecHelm) cmd(action string, args ...string) *exec.Cmd {
+	argv := []string{action}
+	argv = append(argv, args...)
+
+	cmd := helmCmd(argv...)
+	cmd.Stderr = os.Stderr
+
+	return cmd
+}
+
+func ensureHelm() (string, error) {
+	path := filepath.Join(os.TempDir(), "bazel-helm-embedded")
+	// Check if exists and has correct size
+	if info, err := os.Stat(path); err == nil && info.Size() == int64(len(helmBinary)) {
+		return path, nil
+	}
+	// Write
+	if err := os.WriteFile(path, helmBinary, 0755); err != nil {
+		return "", err
+	}
+	return path, nil
+}
+
+// helmCmd returns a bare exec.Cmd pointed at the local helm binary
+func helmCmd(args ...string) *exec.Cmd {
+	bin := "helm"
+	if env := os.Getenv("TANKA_HELM_PATH"); env != "" {
+		bin = env
+	} else {
+		if path, err := ensureHelm(); err == nil {
+			bin = path
+		} else {
+			fmt.Fprintf(os.Stderr, "DEBUG: Failed to write embedded helm: %v\n", err)
+		}
+	}
+
+	return exec.Command(bin, args...)
+}
diff --git a/tools/jsonnet_compiler/main.go b/tools/jsonnet_compiler/main.go
new file mode 100644
index 0000000..b647f7c
--- /dev/null
+++ b/tools/jsonnet_compiler/main.go
@@ -0,0 +1,134 @@
+package main
+
+import (
+	"flag"
+	"fmt"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/google/go-jsonnet"
+	"forgejo.csbx.dev/acmcarther/yesod/tools/jsonnet_compiler/helm_support"
+)
+
+// stringList handles repeated string flags (e.g. -J)
+type stringList []string
+
+func (s *stringList) String() string {
+	return strings.Join(*s, ",")
+}
+
+func (s *stringList) Set(value string) error {
+	*s = append(*s, value)
+	return nil
+}
+
+// keyValueMap handles repeated key=value flags (e.g. --ext-str)
+type keyValueMap map[string]string
+
+func (m *keyValueMap) String() string {
+	return fmt.Sprintf("%v", *m)
+}
+
+func (m *keyValueMap) Set(value string) error {
+	parts := strings.SplitN(value, "=", 2)
+	if len(parts) != 2 {
+		return fmt.Errorf("expected key=value, got %s", value)
+	}
+	(*m)[parts[0]] = parts[1]
+	return nil
+}
+
+func main() {
+	vm := jsonnet.MakeVM()
+	vm.NativeFunction(helm_support.NativeFunc())
+
+	// Flags compatible with rules_jsonnet
+	var (
+		importPaths stringList
+		extStr      = make(keyValueMap)
+		extCode     = make(keyValueMap)
+		tlaStr      = make(keyValueMap)
+		tlaCode     = make(keyValueMap)
+		outputFile  string
+	)
+
+	fs := flag.NewFlagSet("jsonnet", flag.ExitOnError)
+	fs.Var(&importPaths, "J", "Add to the library search path")
+	fs.Var(&importPaths, "jpath", "Add to the library search path")
+	fs.Var(&extStr, "ext-str", "Provide external variable as string")
+	fs.Var(&extStr, "V", "Provide external variable as string")
+	fs.Var(&extCode, "ext-code", "Provide external variable as code")
+	fs.Var(&tlaStr, "tla-str", "Provide top-level argument as string")
+	fs.Var(&tlaStr, "A", "Provide top-level argument as string")
+	fs.Var(&tlaCode, "tla-code", "Provide top-level argument as code")
+	fs.StringVar(&outputFile, "o", "", "Output to the named file")
+	fs.StringVar(&outputFile, "output-file", "", "Output to the named file")
+
+	// Parse flags
+	if err := fs.Parse(os.Args[1:]); err != nil {
+		fmt.Fprintf(os.Stderr, "Error parsing flags: %v\n", err)
+		os.Exit(1)
+	}
+
+	// Apply configuration to VM
+	vm.Importer(&jsonnet.FileImporter{
+		JPaths: importPaths,
+	})
+
+	for k, v := range extStr {
+		vm.ExtVar(k, v)
+	}
+	for k, v := range extCode {
+		vm.ExtCode(k, v)
+	}
+	for k, v := range tlaStr {
+		vm.TLAVar(k, v)
+	}
+	for k, v := range tlaCode {
+		vm.TLACode(k, v)
+	}
+
+	// Get input file and handle remaining flags (like -o after input file)
+	args := fs.Args()
+	var inputFile string
+	for i := 0; i < len(args); i++ {
+		arg := args[i]
+		if arg == "-o" || arg == "--output-file" || arg == "-output-file" {
+			if i+1 < len(args) {
+				outputFile = args[i+1]
+				i++
+				continue
+			}
+		}
+		if inputFile == "" && !strings.HasPrefix(arg, "-") {
+			inputFile = arg
+		}
+	}
+
+	if inputFile == "" {
+		fmt.Fprintln(os.Stderr, "Usage: jsonnet_compiler [options] <filename>")
+		os.Exit(1)
+	}
+
+	// Evaluate
+	jsonOutput, err := vm.EvaluateFile(inputFile)
+	if err != nil {
+		fmt.Fprintf(os.Stderr, "Error evaluating snippet: %v\n", err)
+		os.Exit(1)
+	}
+
+	// Write output
+	if outputFile != "" {
+		if err := os.MkdirAll(filepath.Dir(outputFile), 0755); err != nil {
+            fmt.Fprintf(os.Stderr, "Error creating output directory: %v\n", err)
+			os.Exit(1)
+        }
+		if err := os.WriteFile(outputFile, []byte(jsonOutput), 0644); err != nil {
+			fmt.Fprintf(os.Stderr, "Error writing output file: %v\n", err)
+			os.Exit(1)
+		}
+	} else {
+		fmt.Println(jsonOutput)
+	}
+}
diff --git a/tools/jsonnet_deps.bzl b/tools/jsonnet_deps.bzl
new file mode 100644
index 0000000..c9628bf
--- /dev/null
+++ b/tools/jsonnet_deps.bzl
@@ -0,0 +1,70 @@
+load("@bazel_tools//tools/build_defs/repo:git.bzl", "git_repository")
+load("@bazel_tools//tools/build_defs/repo:http.bzl", "http_archive")
+
+def _jsonnet_deps_impl(ctx):
+    # 1. Read the lockfile
+    # We assume the lockfile is at //third_party/jsonnet/jsonnetfile.lock.json
+    # relative to the module root.
+    lockfile_content = ctx.read(ctx.path(Label("//third_party/jsonnet:jsonnetfile.lock.json")))
+    lockfile = json.decode(lockfile_content)
+
+    # 2. Iterate over dependencies
+    for dep in lockfile.get("dependencies", []):
+        source = dep.get("source", {})
+        git_source = source.get("git", {})
+        
+        remote = git_source.get("remote")
+        commit = dep.get("version")
+        subdir = git_source.get("subdir", "")
+        
+        # Construct a unique name for the repository
+        # e.g., https://github.com/grafana/jsonnet-libs.git (subdir: tanka-util) -> github_com_grafana_jsonnet_libs_tanka_util
+        name_part = remote.removeprefix("https://").removeprefix("http://").removesuffix(".git")
+        repo_name = name_part.replace("/", "_").replace("-", "_").replace(".", "_")
+        if subdir:
+            repo_name += "_" + subdir.replace("/", "_").replace("-", "_").replace(".", "_")
+            subdir += "/"
+        
+        # Optional: Use http_archive for GitHub to avoid git overhead
+        if "github.com" in remote:
+            # https://github.com/user/repo.git -> https://github.com/user/repo/archive/<commit>.zip
+            url = remote.removesuffix(".git") + "/archive/" + commit + ".zip"
+            http_archive(
+                name = repo_name,
+                url = url,
+                # We interpret "subdir" by generating a BUILD file that exposes files in that subdir.
+                # Because the archive unzips to "repo-commit", we usually strip_prefix.
+                # However, predicting strip_prefix is hard without knowing the repo name in the zip.
+                # GitHub usually uses "repo-name-commit" or "repo-name-tag".
+                # For safety in this prototype, we'll strip the first component.
+                strip_prefix = remote.split("/")[-1].removesuffix(".git") + "-" + commit,
+                build_file_content = """
+load("@rules_jsonnet//jsonnet:jsonnet.bzl", "jsonnet_library")
+
+jsonnet_library(
+    name = "lib",
+    srcs = glob(["{subdir}**/*.libsonnet", "{subdir}**/*.jsonnet", "{subdir}**/*.json"], allow_empty = True),
+    visibility = ["//visibility:public"],
+)
+""".format(subdir = subdir)
+            )
+        else:
+            # Fallback to git_repository for non-GitHub
+            git_repository(
+                name = repo_name,
+                remote = remote,
+                commit = commit,
+                build_file_content = """
+load("@rules_jsonnet//jsonnet:jsonnet.bzl", "jsonnet_library")
+
+jsonnet_library(
+    name = "lib",
+    srcs = glob(["{subdir}**/*.libsonnet", "{subdir}**/*.jsonnet", "{subdir}**/*.json"], allow_empty = True),
+    visibility = ["//visibility:public"],
+)
+""".format(subdir = subdir)
+            )
+
+jsonnet_deps = module_extension(
+    implementation = _jsonnet_deps_impl,
+)
diff --git a/tools/mypy.ini b/tools/mypy.ini
new file mode 100644
index 0000000..c9cef5f
--- /dev/null
+++ b/tools/mypy.ini
@@ -0,0 +1,3 @@
+[mypy]
+follow_imports = silent
+follow_imports_for_stubs = True
\ No newline at end of file
diff --git a/tools/pnpm_runner.sh b/tools/pnpm_runner.sh
new file mode 100755
index 0000000..baa4197
--- /dev/null
+++ b/tools/pnpm_runner.sh
@@ -0,0 +1,20 @@
+#!/bin/bash
+set -e
+
+# Find the pnpm binary in the runfiles.
+# Use -L to follow symlinks.
+PNPM=$(find -L "$0.runfiles" -type f -path "*/file/pnpm" | head -n 1)
+
+if [ -z "$PNPM" ]; then
+    echo "Error: Could not find pnpm binary in runfiles."
+    exit 1
+fi
+
+chmod +x "$PNPM"
+
+# If running via 'bazel run', switch to the workspace directory to modify source files.
+if [ -n "$BUILD_WORKSPACE_DIRECTORY" ]; then
+    cd "$BUILD_WORKSPACE_DIRECTORY"
+fi
+
+exec "$PNPM" "$@"
\ No newline at end of file
diff --git a/tools/sops.bzl b/tools/sops.bzl
new file mode 100644
index 0000000..2833bb9
--- /dev/null
+++ b/tools/sops.bzl
@@ -0,0 +1,71 @@
+def _sops_decrypt_impl(ctx):
+    output_file = ctx.actions.declare_file(ctx.attr.out)
+    
+    inputs = [ctx.file.src]
+    tools = [ctx.executable.sops_tool]
+    env = {}
+
+    if ctx.file.age_key_file:
+        inputs.append(ctx.file.age_key_file)
+        env["SOPS_AGE_KEY_FILE"] = ctx.file.age_key_file.path
+
+    command = ctx.attr.command.format(
+        sops = ctx.executable.sops_tool.path,
+        src = ctx.file.src.path,
+        out = output_file.path,
+    )
+
+    ctx.actions.run_shell(
+        outputs = [output_file],
+        inputs = inputs,
+        tools = tools,
+        env = env,
+        command = command,
+        mnemonic = "SopsDecrypt",
+        progress_message = "Processing %s" % ctx.file.src.short_path,
+    )
+
+    return [DefaultInfo(files = depset([output_file]))]
+
+_sops_decrypt = rule(
+    implementation = _sops_decrypt_impl,
+    attrs = {
+        "src": attr.label(allow_single_file = True, mandatory = True),
+        "out": attr.string(mandatory = True),
+        "sops_tool": attr.label(
+            executable = True,
+            cfg = "exec",
+        ),
+        "command": attr.string(mandatory = True),
+        "age_key_file": attr.label(allow_single_file = True),
+    },
+)
+
+def sops_decrypt(name, src, out, **kwargs):
+    """
+    Decrypts a SOPS encrypted file.
+
+    Args:
+        name: The name of the target.
+        src: The source SOPS encrypted file.
+        out: The output decrypted file (usually JSON).
+        **kwargs: Additional arguments to pass to the rule.
+    """
+    _sops_decrypt(
+        name = name,
+        src = src,
+        out = out,
+        age_key_file = select({
+            "//:ci": None,
+            "//conditions:default": "//:key.txt",
+        }),
+        sops_tool = select({
+            "//:ci": "//tools:fake_sops",
+            "//conditions:default": "//tools:sops_bin",
+        }),
+        command = select({
+            "//:ci": "{sops} {src} {out}",
+            "//conditions:default": "{sops} -d --output-type json {src} > {out}",
+        }),
+        **kwargs
+    )
diff --git a/tools/tanka.bzl b/tools/tanka.bzl
new file mode 100644
index 0000000..52ba53a
--- /dev/null
+++ b/tools/tanka.bzl
@@ -0,0 +1,62 @@
+load("@rules_shell//shell:sh_binary.bzl", "sh_binary")
+ 
+def tanka_environment(name, spec, main):
+    """
+    Creates diff and apply targets for a Tanka environment.
+
+    Args:
+        name: Name of the environment (e.g., 'example')
+        spec: Label for the spec.json file
+        main: Label for the main.json file (generated by jsonnet_to_json)
+    """
+
+    # Target to show manifests
+    sh_binary(
+        name = name + ".show",
+        srcs = ["//tools:tanka_runner.sh"],
+        args = [
+            "$(location //tools/tanka_shim)",
+            "$(location " + spec + ")",
+            "$(location " + main + ")",
+            "show",
+        ],
+        data = [
+            "//tools/tanka_shim",
+            spec,
+            main,
+        ],
+    )
+
+    # Target to diff manifests
+    sh_binary(
+        name = name + ".diff",
+        srcs = ["//tools:tanka_runner.sh"],
+        args = [
+            "$(location //tools/tanka_shim)",
+            "$(location " + spec + ")",
+            "$(location " + main + ")",
+            "diff",
+        ],
+        data = [
+            "//tools/tanka_shim",
+            spec,
+            main,
+        ],
+    )
+
+    # Target to apply manifests
+    sh_binary(
+        name = name + ".apply",
+        srcs = ["//tools:tanka_runner.sh"],
+        args = [
+            "$(location //tools/tanka_shim)",
+            "$(location " + spec + ")",
+            "$(location " + main + ")",
+            "apply",
+        ],
+        data = [
+            "//tools/tanka_shim",
+            spec,
+            main,
+        ],
+    )
diff --git a/tools/tanka_runner.sh b/tools/tanka_runner.sh
new file mode 100755
index 0000000..5022637
--- /dev/null
+++ b/tools/tanka_runner.sh
@@ -0,0 +1,20 @@
+#!/bin/bash
+# Generic runner for the tanka_shim
+
+SHIM_PATH="$1"
+SPEC_PATH="$2"
+MAIN_PATH="$3"
+ACTION="$4"
+
+# Handle relative paths from Bazel run
+if [[ "$SHIM_PATH" != /* ]]; then
+  SHIM_PATH="$PWD/$SHIM_PATH"
+fi
+if [[ "$SPEC_PATH" != /* ]]; then
+  SPEC_PATH="$PWD/$SPEC_PATH"
+fi
+if [[ "$MAIN_PATH" != /* ]]; then
+  MAIN_PATH="$PWD/$MAIN_PATH"
+fi
+
+exec "$SHIM_PATH" --spec "$SPEC_PATH" --main "$MAIN_PATH" --action "$ACTION"
diff --git a/tools/tanka_shim/BUILD.bazel b/tools/tanka_shim/BUILD.bazel
new file mode 100644
index 0000000..2d47dda
--- /dev/null
+++ b/tools/tanka_shim/BUILD.bazel
@@ -0,0 +1,19 @@
+load("@rules_go//go:def.bzl", "go_binary", "go_library")
+
+go_binary(
+    name = "tanka_shim",
+    embed = [":tanka_shim_lib"],
+    visibility = ["//visibility:public"],
+)
+
+go_library(
+    name = "tanka_shim_lib",
+    srcs = ["main.go"],
+    importpath = "forgejo.csbx.dev/acmcarther/yesod/tools/tanka_shim",
+    visibility = ["//visibility:private"],
+    deps = [
+        "@com_github_grafana_tanka//pkg/kubernetes",
+        "@com_github_grafana_tanka//pkg/process",
+        "@com_github_grafana_tanka//pkg/spec/v1alpha1",
+    ],
+)
diff --git a/tools/tanka_shim/main.go b/tools/tanka_shim/main.go
new file mode 100644
index 0000000..1eb1118
--- /dev/null
+++ b/tools/tanka_shim/main.go
@@ -0,0 +1,97 @@
+package main
+
+import (
+	"context"
+	"encoding/json"
+	"flag"
+	"fmt"
+	"os"
+
+	"github.com/grafana/tanka/pkg/kubernetes"
+	"github.com/grafana/tanka/pkg/process"
+	"github.com/grafana/tanka/pkg/spec/v1alpha1"
+)
+
+func main() {
+	specPath := flag.String("spec", "", "Path to spec.json")
+	mainPath := flag.String("main", "", "Path to main.json")
+	action := flag.String("action", "show", "Action to perform: show, diff, apply")
+	flag.Parse()
+
+	if *specPath == "" || *mainPath == "" {
+		fmt.Fprintln(os.Stderr, "Usage: tanka --spec <spec.json> --main <main.json> [--action <action>]")
+		os.Exit(1)
+	}
+
+	// 1. Load Spec
+	specData, err := os.ReadFile(*specPath)
+	if err != nil {
+		panic(fmt.Errorf("reading spec: %w", err))
+	}
+
+	var env v1alpha1.Environment
+	if err := json.Unmarshal(specData, &env); err != nil {
+		panic(fmt.Errorf("unmarshaling spec: %w", err))
+	}
+
+	// 2. Load Main (Data)
+	mainData, err := os.ReadFile(*mainPath)
+	if err != nil {
+		panic(fmt.Errorf("reading main: %w", err))
+	}
+
+	var rawData interface{}
+	if err := json.Unmarshal(mainData, &rawData); err != nil {
+		panic(fmt.Errorf("unmarshaling main: %w", err))
+	}
+	env.Data = rawData
+
+	// 3. Process (Extract, Label, Filter)
+	// We use empty matchers for now
+	list, err := process.Process(env, process.Matchers{})
+	if err != nil {
+		panic(fmt.Errorf("processing manifests: %w", err))
+	}
+
+	fmt.Printf("Processed %d manifests for env %s (namespace: %s)\n", len(list), env.Metadata.Name, env.Spec.Namespace)
+
+	if *action == "show" {
+		for _, m := range list {
+			fmt.Printf("- %s: %s\n", m.Kind(), m.Metadata().Name())
+		}
+		return
+	}
+
+	// 4. Initialize Kubernetes Client
+	// This will fail if no valid kubeconfig/context is found matching spec.json
+	kube, err := kubernetes.New(env)
+	if err != nil {
+		fmt.Printf("Warning: Failed to initialize Kubernetes client (expected if no cluster context): %v\n", err)
+		return
+	}
+	defer kube.Close()
+
+	// 5. Perform Action
+	switch *action {
+	case "diff":
+		fmt.Println("Running Diff...")
+		diff, err := kube.Diff(context.Background(), list, kubernetes.DiffOpts{})
+		if err != nil {
+			panic(err)
+		}
+		if diff != nil {
+			fmt.Println(*diff)
+		} else {
+			fmt.Println("No changes.")
+		}
+	case "apply":
+		fmt.Println("Running Apply...")
+		err := kube.Apply(list, kubernetes.ApplyOpts{})
+		if err != nil {
+			panic(err)
+		}
+		fmt.Println("Apply finished.")
+	default:
+		fmt.Printf("Unknown action: %s\n", *action)
+	}
+}
\ No newline at end of file
diff --git a/tools/vscode/BUILD.bazel b/tools/vscode/BUILD.bazel
new file mode 100644
index 0000000..2070dc2
--- /dev/null
+++ b/tools/vscode/BUILD.bazel
@@ -0,0 +1,12 @@
+load("@aspect_rules_js//js:defs.bzl", "js_binary")
+
+package(default_visibility = ["//visibility:public"])
+
+# Wrapper to invoke vsce via node resolution with polyfills
+js_binary(
+    name = "vsce_tool",
+    entry_point = "vsce_wrapper.js",
+    data = [
+        "//:node_modules/@vscode/vsce",
+    ],
+)
diff --git a/tools/vscode/README.md b/tools/vscode/README.md
new file mode 100644
index 0000000..50d6180
--- /dev/null
+++ b/tools/vscode/README.md
@@ -0,0 +1,35 @@
+# VSCode Extension Build Tools
+
+This directory contains Bazel rules and utilities for packaging VSCode extensions.
+
+## Contents
+
+- `defs.bzl`: Provides the `vsce_extension` rule, which handles the staging and packaging of VSCode extensions using `vsce`.
+- `vsce_wrapper.js`: A Node.js wrapper for `@vscode/vsce` that handles runfiles resolution and polyfills necessary for running within a Bazel sandbox.
+- `BUILD.bazel`: Defines the shared `vsce_tool` binary.
+
+## Usage
+
+Load the `vsce_extension` rule in your extension's `BUILD.bazel` file:
+
+```python
+load("//tools/vscode:defs.bzl", "vsce_extension")
+
+vsce_extension(
+    name = "my_extension_vsix",
+    srcs = [
+        "package.json",
+        "README.md",
+        # ... other config files
+    ],
+    extension_js = [":my_extension_bundle"], # Usually an esbuild target
+    out = "my-extension-0.0.1.vsix",
+)
+```
+
+## Why this exists
+
+Packaging VSCode extensions via `vsce` typically requires a standard `node_modules` structure and often tries to run prepublish scripts. This tooling provides a way to:
+1.  Package extensions without a local `node_modules`.
+2.  Bypass mandatory `npm` dependency checks and prepublish scripts by staging files manually.
+3.  Ensure the environment is correctly set up for `vsce` to run inside a hermetic Bazel sandbox.
diff --git a/tools/vscode/defs.bzl b/tools/vscode/defs.bzl
new file mode 100644
index 0000000..b45bc36
--- /dev/null
+++ b/tools/vscode/defs.bzl
@@ -0,0 +1,102 @@
+def _vsce_extension_impl(ctx):
+    out_file = ctx.outputs.out
+    tool = ctx.executable.tool
+    
+    # Runfiles
+    # We need to make sure the tool's runfiles are available.
+    # ctx.actions.run_shell tools arg handles this.
+
+    # Shell script using environment variables to avoid python format issues
+    script = """
+set -e
+
+# Setup staging directory
+mkdir -p staging/out
+
+# Copy source files
+for src in $SRCS; do
+    cp "$src" "staging/$(basename "$src")"
+done
+
+# Copy extension artifacts
+for ext in $EXT_JS; do
+    cp "$ext" "staging/out/"
+done
+
+# Disable vscode:prepublish
+sed -i.bak 's/"vscode:prepublish"/"vscode:ignore"/g' staging/package.json
+rm staging/package.json.bak
+
+# Create dummy secretlint modules
+DUMMY_CONTENT='
+const creator = {
+  meta: {
+    id: "dummy",
+    recommended: true,
+    type: "scanner",
+    supportedContentTypes: []
+  },
+  create(context) { return {}; }
+};
+module.exports = { creator };
+'
+
+mkdir -p staging/node_modules/@secretlint/secretlint-rule-preset-recommend
+echo "$DUMMY_CONTENT" > staging/node_modules/@secretlint/secretlint-rule-preset-recommend/index.js
+echo '{"main": "index.js", "name": "@secretlint/secretlint-rule-preset-recommend", "version": "1.0.0"}' > staging/node_modules/@secretlint/secretlint-rule-preset-recommend/package.json
+
+mkdir -p staging/node_modules/@secretlint/secretlint-rule-no-dotenv
+echo "$DUMMY_CONTENT" > staging/node_modules/@secretlint/secretlint-rule-no-dotenv/index.js
+echo '{"main": "index.js", "name": "@secretlint/secretlint-rule-no-dotenv", "version": "1.0.0"}' > staging/node_modules/@secretlint/secretlint-rule-no-dotenv/package.json
+
+# Create dummy formatter
+mkdir -p staging/node_modules/@secretlint/secretlint-formatter-sarif
+echo "module.exports = function(results){return JSON.stringify({version: '2.1.0', runs: []});}" > staging/node_modules/@secretlint/secretlint-formatter-sarif/index.js
+echo '{"main": "index.js", "name": "@secretlint/secretlint-formatter-sarif", "version": "1.0.0"}' > staging/node_modules/@secretlint/secretlint-formatter-sarif/package.json
+
+# Tool path (execroot relative)
+# We need absolute path or correctly relative path when we cd into staging.
+# $VSCE_TOOL is relative to execroot.
+# $PWD is execroot.
+TOOL_PATH="$PWD/$VSCE_TOOL"
+
+# Setup environment
+export NODE_PATH="$PWD/staging/node_modules:${NODE_PATH:-}"
+export BAZEL_BINDIR=.
+
+# Execute vsce
+cd staging
+"$TOOL_PATH" package --out "../$OUT_PATH" --no-dependencies --skip-license --allow-missing-repository
+"""
+
+    ctx.actions.run_shell(
+        outputs = [out_file],
+        inputs = ctx.files.srcs + ctx.files.extension_js + ctx.files.data,
+        tools = [tool],
+        command = script,
+        mnemonic = "VscePackage",
+        progress_message = "Packaging VSCode extension...",
+        env = {
+            "SRCS": " ".join([f.path for f in ctx.files.srcs]),
+            "EXT_JS": " ".join([f.path for f in ctx.files.extension_js]),
+            "VSCE_TOOL": tool.path,
+            "OUT_PATH": out_file.path,
+        },
+    )
+
+    return [DefaultInfo(files = depset([out_file]))]
+
+vsce_extension = rule(
+    implementation = _vsce_extension_impl,
+    attrs = {
+        "srcs": attr.label_list(allow_files = True),
+        "extension_js": attr.label_list(allow_files = True),
+        "data": attr.label_list(allow_files = True),
+        "out": attr.output(mandatory = True),
+        "tool": attr.label(
+            executable = True,
+            cfg = "exec",
+            default = Label("//tools/vscode:vsce_tool"),
+        ),
+    },
+)
\ No newline at end of file
diff --git a/tools/vscode/vsce_wrapper.js b/tools/vscode/vsce_wrapper.js
new file mode 100755
index 0000000..fdce0b9
--- /dev/null
+++ b/tools/vscode/vsce_wrapper.js
@@ -0,0 +1,41 @@
+#!/usr/bin/env node
+const fs = require('fs');
+const path = require('path');
+
+// Polyfill File if missing (Node 18)
+if (typeof File === 'undefined') {
+  const { Blob } = require('buffer');
+  class File extends Blob {
+    constructor(fileBits, fileName, options) {
+      super(fileBits, options);
+      this.name = fileName;
+      this.lastModified = options?.lastModified || Date.now();
+    }
+  }
+  global.File = File;
+}
+
+// Try to find node_modules in runfiles
+// We traverse up to find the root of the workspace/runfiles
+let current = __dirname;
+let nodeModulesPath = null;
+// Safety break after 10 levels
+for (let i = 0; i < 10; i++) {
+    const candidate = path.join(current, 'node_modules');
+    if (fs.existsSync(candidate)) {
+        nodeModulesPath = candidate;
+        break;
+    }
+    const parent = path.dirname(current);
+    if (parent === current) break;
+    current = parent;
+}
+
+if (nodeModulesPath) {
+    // Add to module.paths to allow require() to find modules there
+    module.paths.push(nodeModulesPath);
+    // Also set NODE_PATH env var for subprocesses
+    process.env.NODE_PATH = (process.env.NODE_PATH || '') + path.delimiter + nodeModulesPath;
+}
+
+require('@vscode/vsce/vsce');