diff --git a/kubernetes/infrastructure/caddy-certificates/certificates.yaml b/kubernetes/infrastructure/caddy-certificates/certificates.yaml index 1d66aff..45ee769 100644 --- a/kubernetes/infrastructure/caddy-certificates/certificates.yaml +++ b/kubernetes/infrastructure/caddy-certificates/certificates.yaml @@ -79,3 +79,19 @@ spec: - buildpath.win duration: 2160h # 90 days renewBefore: 360h # 15 days before expiry +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: saggar-dev + namespace: caddy +spec: + secretName: saggar-dev-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: saggar.dev + dnsNames: + - saggar.dev + duration: 2160h # 90 days + renewBefore: 360h # 15 days before expiry diff --git a/kubernetes/infrastructure/caddy/caddyfile.yaml b/kubernetes/infrastructure/caddy/caddyfile.yaml index e8708b9..7918476 100644 --- a/kubernetes/infrastructure/caddy/caddyfile.yaml +++ b/kubernetes/infrastructure/caddy/caddyfile.yaml @@ -107,3 +107,8 @@ data: tls /etc/caddy/certs/buildpath-win/tls.crt /etc/caddy/certs/buildpath-win/tls.key reverse_proxy traefik.traefik.svc.cluster.local.:80 } + + saggar.dev { + tls /etc/caddy/certs/saggar-dev/tls.crt /etc/caddy/certs/saggar-dev/tls.key + reverse_proxy traefik.traefik.svc.cluster.local.:80 + } diff --git a/kubernetes/infrastructure/caddy/values.yaml b/kubernetes/infrastructure/caddy/values.yaml index 63e205a..70155bc 100644 --- a/kubernetes/infrastructure/caddy/values.yaml +++ b/kubernetes/infrastructure/caddy/values.yaml @@ -36,25 +36,30 @@ health: volumes: - name: vhaudiquet-fr-tls secret: - secretName: ENC[AES256_GCM,data:HYQb37rKxMqxFTsCz5kw6qY=,iv:dI9uqUVLLqPv3a5vwz1vowTvO9WduQaXqj7XZREd7oA=,tag:mz257AC3pvubgzOMxbHfrg==,type:str] - optional: ENC[AES256_GCM,data:k9FVxw==,iv:XMAGop2PvSGD1R1cy6qqE39bsIAOFIqGzTnwDmYRhHM=,tag:7zZAwSzRWWiT9Y2iMWkI6w==,type:bool] + secretName: ENC[AES256_GCM,data:6ExXcOxf85dmK/C/XpC5b+4=,iv:kKI31lrYZSMv5hy0i1l3dMYpflc3DklDJNugH2xUgvQ=,tag:rDKoIg5UFH2MTcbiW1XD1g==,type:str] + optional: ENC[AES256_GCM,data:nQnlHQ==,iv:ynqIN1n+zfflikGK85hqPvG7o3fjJo8GNxCswq3mPT0=,tag:Ur6Z7qckOiaS/BnXBM92zQ==,type:bool] - name: wildcard-vhaudiquet-fr-tls secret: - secretName: ENC[AES256_GCM,data:2OUkq/AMuv2wQyIlLPS3bSRrnV1mvDR6vd0=,iv:1e9HC8FFC4vo7GjCnJyNjF05R+Js41ONy2in5a+/doI=,tag:icKdtLhvQ40YI+KCE+6fXg==,type:str] - optional: ENC[AES256_GCM,data:b+zvMw==,iv:QyU+T1BGZenO/nO8wq6R+KkrT/I6ZXIIhAnf5npFhvw=,tag:4UPyop81BQu4zxhZmK2n+Q==,type:bool] + secretName: ENC[AES256_GCM,data:iBKGSWRrJJ9NxjHouxuuczbbEVokuH5Qybw=,iv:ekjWmEY5Vbm4P/TIms++eW+gKRZmgMyPD2k2VJls5qE=,tag:jkM9R92TVFkAQy6clybskg==,type:str] + optional: ENC[AES256_GCM,data:1PmH7Q==,iv:3S9tFfYXRAOSTxsetrEOvRjcqWAoizwXOtDOsmG63fY=,tag:GvxrXLSPXgk0/iHON1jrug==,type:bool] # semery.fr certs from cert-manager (OVH DNS-01) - name: semery-fr-tls secret: - secretName: ENC[AES256_GCM,data:cLzhXgUhrwgIMACU1Q==,iv:DJ+6mjtjYmWxNcHl1gzeoifpcFCJsXiOXeyxEWnRU3g=,tag:7yc2bt6fBWwBuefPY48xyA==,type:str] - optional: ENC[AES256_GCM,data:DTfxaQ==,iv:K7TJjSI/vF3x34SWmwmivYo+mSsUAg9nB94Ui85nHCI=,tag:1/JRBMlb07+aHKEulIYpQQ==,type:bool] + secretName: ENC[AES256_GCM,data:qL62XGDo5zW3HKGoVg==,iv:Prlm6MpAopNzTxHVDlpWBibvxLqXjdi/iOrEAuspVZM=,tag:/MtBt2IDhjKU+lN9VGlu5Q==,type:str] + optional: ENC[AES256_GCM,data:P0BhoQ==,iv:e4Gr6iIGt6bTCPvdD3U7nLVHVusbiLc9iC/tQUpedYg=,tag:ew8ogjPxBHK4pYCRjOCoAA==,type:bool] - name: wildcard-semery-fr-tls secret: - secretName: ENC[AES256_GCM,data:Qq+ybi1kSVdVn9RP/kTkTcw0lkao3Q==,iv:vFmV3YvSNhLizgJVBnq1ZERqDP70onuZDvy/I3joPtI=,tag:AiEW+yh51Dexz3Vha4MPgg==,type:str] - optional: ENC[AES256_GCM,data:0o4ODw==,iv:VwnCs2C1MVUJEfBvNJT1rkDV7m60sNZPdtERo9wWPJk=,tag:oo+liLatrjqEtlrKQyjhyg==,type:bool] + secretName: ENC[AES256_GCM,data:nSwdeBlhSUhujmssB3oJ2QEdSjI16w==,iv:5nBHIeK2RWSMrl1qdxiVuUhiaM2erGfo+Tbd+p0MEHw=,tag:0j3sz2CREpmrcku86+abbw==,type:str] + optional: ENC[AES256_GCM,data:PXvJhA==,iv:MEnwpLwfbhagQSrbjH8++GTUwxK++CPuciBNu6xqQ4E=,tag:QU6qR62HzQKF7fygOW2z/Q==,type:bool] - name: buildpath-win-tls secret: - secretName: ENC[AES256_GCM,data:SejgJvZY/B7DDgf3YJcxcFA=,iv:bDZWhie17exL+9r9A7Ea/a8Rgpex7nuabVtW60LotJQ=,tag:WxqFbzulxxPgsynqfo5hzQ==,type:str] - optional: ENC[AES256_GCM,data:nBNRkw==,iv:JEvsFzMli7AzUj6GXJlHXOnANm45gnFE/kXrSbBotPQ=,tag:Puss6mCkoC7SGCb86guI2w==,type:bool] + secretName: ENC[AES256_GCM,data:2FVJ/B+sflBrGetSsBOsogA=,iv:pCkqWiArPcCSGYjhcQUUiPeOkDVmv5OgPfeLnAaC92g=,tag:gIF4vlthAPZihlVbHSqAMQ==,type:str] + optional: ENC[AES256_GCM,data:6XQzuw==,iv:TrcOBBCls8UK+FyZbQSuAvBs5pa72RVR9u2mHn4jVoE=,tag:2qZKMLzdLgFti+KkEtSYvQ==,type:bool] + # saggar.dev cert from cert-manager (Porkbun DNS-01) + - name: saggar-dev-tls + secret: + secretName: ENC[AES256_GCM,data:E6zCT5mte8FFgkslRD8=,iv:GtlwHsG0X9pfNn1EscTA5YFd1wXTwKYXfW3mPKahQ60=,tag:ugJMzZb0sOVvmLtsOkuPrg==,type:str] + optional: ENC[AES256_GCM,data:RBTuXg==,iv:MYlyt3OiAVwIX/5jFW9mdnOQ/1HP2q6hwVtMz8f86qE=,tag:tKyyLTCWcnNxsafLyXZNgA==,type:bool] - name: routes configMap: name: caddy-routes @@ -75,6 +80,9 @@ volumeMounts: - name: buildpath-win-tls mountPath: /etc/caddy/certs/buildpath-win readOnly: true + - name: saggar-dev-tls + mountPath: /etc/caddy/certs/saggar-dev + readOnly: true - name: routes mountPath: /etc/caddy/routes readOnly: true @@ -99,7 +107,7 @@ affinity: - weight: 100 preference: matchExpressions: - - key: ENC[AES256_GCM,data:oCV218wXg+k2L/edhWv6qpiyiaY=,iv:Y+O2of2NCOvcjSwr0EenGns0BtpT+P6pjCzEZUIMpm0=,tag:kY/WyHJ4Jr5ZLMe6ZcT/Tw==,type:str] + - key: ENC[AES256_GCM,data:H7+ITzzjHDUEp0S1StQdhR8boM8=,iv:shPNxrM5kuzL0rM2ro8WT8RyVuz/CmbH9CyalmWT7Tg=,tag:VWumtU5IK8Bf62LEB2b3Nw==,type:str] operator: NotIn values: - "true" @@ -113,35 +121,35 @@ affinity: topologyKey: kubernetes.io/hostname tolerations: # Tolerate the failover taint so caddy CAN schedule on p330 (small-node-1). - - key: ENC[AES256_GCM,data:K6vJkO2dpKRi,iv:b7NIPKTMYOxNao6KcSJUhsxKNRJ2J3ksEtmXkI8b0So=,tag:pMRmz17upWMTEZjwBRNyZQ==,type:str] + - key: ENC[AES256_GCM,data:9zHboRH5nBUO,iv:IO30csmF3Sz5YUmvVbhZj5t8FextWnHDh/jgpc65y1U=,tag:LOsqaxYbLlTADuhZSY8fNA==,type:str] operator: Equal - value: ENC[AES256_GCM,data:4ULPtEoUhgs=,iv:ikqWRqRR9ki35QQ6VnMEzOgT0/e+5DggGP8w60BhW/Q=,tag:MW9lX8miIWb9nnbc0woZTg==,type:str] + value: ENC[AES256_GCM,data:h8zjdogIMN4=,iv:iRAVuj9jfe4HHuJAoV9gN4zSU/eFzZaDMOfAujOxqr4=,tag:CCEYwHnLos+l1VvvIndtDg==,type:str] effect: NoSchedule - - key: ENC[AES256_GCM,data:l7abu6ywKFevJdJod2Af2bj7XSfBJATL7UnfiUHrRJoCjBsl9A==,iv:xnUvzVX8z4doC+mQs1r0rNCSqaZ8KlXxr5Ee9FOFPjI=,tag:mnqCx9NSMSyeYwz57QFQIQ==,type:str] + - key: ENC[AES256_GCM,data:rRW0TkG62zRAhbWBV2bWcfJKrm0dHs6N7WE4DhSiQMvExUkgpQ==,iv:CZYuuxH0rFdnCu/MzZpQAgQpI2ChfkAZyCPoUtpkm30=,tag:nmd1QopYn5pq64AX34lZNQ==,type:str] operator: Exists effect: NoSchedule sops: - lastmodified: "2026-08-26T19:28:03Z" - mac: ENC[AES256_GCM,data:gn90e5Gjq5/CraT7Cl43DVMIQukD798faKGbVO5IJlbpAuTwDrhvqnnojFq4R7LEEETtedpR3MRyqcnbfSWVruHoysebycL7EZJkiy7H36JmzQAOWKusshMF9kOyZIV6+AFfz8As/Mu4pF1p5+3jmgy6oOJn7Ewm0C930Gpa3gs=,iv:cf1UC/2NGBHtQgx6h8vRpMjeJRaAvG7ZznhErn2b+cE=,tag:3Ule+pq7pZHWA7NqhlgfPg==,type:str] + lastmodified: "2026-09-27T22:55:14Z" + mac: ENC[AES256_GCM,data:Ll/xUtd3OLEoeTIVHG3nzvi8hiTJuaTBSMPrWjBTxqma0KM5zE3FKUCEUDaiXesu/XXlSiA8gO7YwttmDPvUXoCNHXGQ0SvkO6m8Hj0hgaQgk74nM9esEsLv/SShl+uRVjZxfIhc0Ao43PJoZqZvHDUd0Kkebh/7/t5Sb3ggy7Q=,iv:uopg0kaXiFKjYz8jCC/395n9YzuQo54RWbHiwkgv+IU=,tag:F5O7vaKSxX4Gg7mSZ+3yLA==,type:str] pgp: - - created_at: "2026-08-26T19:28:03Z" + - created_at: "2026-09-27T22:55:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMA7uy4qQr71wiAQ/9FKZhqwE2RZcfsIeMOtAkOTf/4aEbrSzsHbEO8DP8V3Ct - rQBu/v8y1Hcu3fVU/OjVk/7QbEBjPNu1AJST55DBIWktnYUgSo4fIujvG54/hqwM - 9u0iuA1EcqVzGDa+vLSqgmi4Oxbujs0Ytn7uQrefqkdAOjltKqvknebI9EBdSRUi - GjVFwysR6jHmIVf9S64vu4VsjfC7ju9MBYZniaKsJ1GOBhIjUZ6ogkYs5S2E5PJ/ - zE8cn79x61YLX74H+BAqnFcxbprtsCwMJPgyerfgijV6d+JpwT/6mp1VUrLe9Zz7 - WEd/lVMlIcwnYCtIDAvuURvMP2OebWplr95d5V1Vb5Yywnl3M0pwkqL4dRiJISvk - N2rBQYvDfXBtJA7yTAkJ3PymrECKoFs6nspEBie/kDJmdRGv8s2aajzTTQ1qLAkP - FeJe0TcowjCCWMxk4W5DEoCh+PUA1HVo+/KmHjnIVgzdgxaeqT90VXwN8H7MPPeu - LKE01+Guue821h7GykkIhe9sf3nMGbI5rOiCcsVtgu5bODkRk8jXpXh1qdRAliuq - uddjy1mWEfdUHNBj8YxvZ8WOU7h9FyZjsYZB96n9du1vqcuuP5eTJDVuvjjtDuTK - fbXYQbxwA5j4akyI4AKJYLA0Y/lcSXc84r6q8IA52nZz6uQZExbkoc7PPX7Q/ufS - XgE0CWRS+0tk2oVANMVU31UrCvitttezjR6sUSAINh122a5kcmOfJzLlB2OqVKc5 - wMAyvOYccrQMrPDX1WJE7agDOaqGUQcwuFnvqpHhe8q9Yg1uOUU4sK1R8A1Qs0Q= - =wlYf + hQIMA7uy4qQr71wiAQ/8DpuQVg8C6MTbsbjCSdCqGBPB2eB0Vk7tnyRvxdpIRZ1E + fbQez6jSXrScJZGC5+IylEKyL50AIr3h9xiLsNsVveXe1v00Tl2+8ozc6oslCxib + u2ldEJOFEdmvzlSmg+r+Fxl/0Tos8ZHVirosMlXkpG6iY7zoXzxBJmA3/12oQnsm + gBqsBg/Tjd6PxlolT8M5CG8jg+17Fhupl4VSBZRaUH4SOLodmuwUSPJtUVdrloGf + dv6ZXjUxMHyejBbP5CrPhbwclh8Sf1MnZlAr6icxzTEVodbDG4qPVfY2nhW5i32S + 8N815C6ElOGU4qrf9ArxZFI1hLarQFm1jPPw4esOS544QRiYeHCgfm/qt9v9NHDL + Y6P9YdFHfy3i1t1jlLdvjFDrjBn75snCv9OKbb0EQkNdFhelFNwNlAskC//fKz2f + EHtC9QbZ22oitCFtq3zyx0pcm9Z9KMki/u8aO8lMdXFVxa/HI3zz50ebdP/Yxlud + 4TRiy3mZhij4zV9MA9AOBvrlUUw+Bde5xEG4BRFAHk5Ed0I/p08fcgPHu3SX/LTr + 6V38ME0jBU6D6nem/Lg4tiKUOfaliEFzPjQUIvFCnmKK7WHQ8RP+u0UW1LtNhNBw + eZWLPcYFzYLwm0Ad1qiby//rL06L7pvJG6WJ5bX/j3qkXIFNFsn/IbgK9euOvvnS + XAG3dhDOoDhWqU9rKVbMgBHNV1quRBmrNPOXBOelvOWoruFlCxaUU5cUsTdgXH51 + dej6Y8v//qHE8B9nV2r5dvGXUrCVYTF4FKC+6tY9eueB18bNoosPgykiG1Od + =6uqR -----END PGP MESSAGE----- fp: DC6910268E657FF70BA7EC289974494E76938DDC encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$ diff --git a/kubernetes/infrastructure/cert-manager-issuer/clusterissuer.yaml b/kubernetes/infrastructure/cert-manager-issuer/clusterissuer.yaml index c538ff9..7793748 100644 --- a/kubernetes/infrastructure/cert-manager-issuer/clusterissuer.yaml +++ b/kubernetes/infrastructure/cert-manager-issuer/clusterissuer.yaml @@ -42,3 +42,18 @@ spec: selector: dnsZones: - semery.fr + # Porkbun solver for saggar.dev (via cert-manager-webhook-porkbun) + - dns01: + webhook: + groupName: acme.saggar.dev + solverName: porkbun + config: + apiKey: + name: porkbun-api-credentials + key: api-key + secretApiKey: + name: porkbun-api-credentials + key: secret-key + selector: + dnsZones: + - saggar.dev diff --git a/kubernetes/infrastructure/cert-manager-issuer/kustomization.yaml b/kubernetes/infrastructure/cert-manager-issuer/kustomization.yaml index d92a3f6..23274dc 100644 --- a/kubernetes/infrastructure/cert-manager-issuer/kustomization.yaml +++ b/kubernetes/infrastructure/cert-manager-issuer/kustomization.yaml @@ -5,3 +5,4 @@ resources: - clusterissuer.yaml - ovh-credentials-secret.yaml - ovh-secret-reader-rbac.yaml + - porkbun-api-credentials-secret.yaml diff --git a/kubernetes/infrastructure/cert-manager-issuer/porkbun-api-credentials-secret.yaml b/kubernetes/infrastructure/cert-manager-issuer/porkbun-api-credentials-secret.yaml new file mode 100644 index 0000000..a2d15f3 --- /dev/null +++ b/kubernetes/infrastructure/cert-manager-issuer/porkbun-api-credentials-secret.yaml @@ -0,0 +1,49 @@ +# Porkbun API Credentials for DNS-01 Challenges (saggar.dev) +# +# Create an API key at https://porkbun.com/account (API Access section), and +# enable API access on the domain: Domain Management -> Details -> API Access +# (disabled per domain by default; the API returns a generic error otherwise). +# +# The secret MUST live in the cert-manager namespace: for a ClusterIssuer, +# cert-manager reads webhook credential secrets from its cluster resource +# namespace, which the webhook chart's RBAC already covers. +# +# SOPS will encrypt the stringData fields on pre-commit. +apiVersion: v1 +kind: Secret +metadata: + name: porkbun-api-credentials + namespace: cert-manager + labels: + app.kubernetes.io/name: cert-manager-webhook-porkbun + app.kubernetes.io/component: porkbun-api-credentials +type: Opaque +stringData: + api-key: ENC[AES256_GCM,data:OLTDhFnbK70gAsvMR/4iKjKr9ckEkbXhYfG4xgTWP2gjruI9HaNAWzSBJcmDyRXRSz18XnvnSlUy/P5VXG5S6uH84wg=,iv:DrOWWf5h1FLNg+emJ/MMp80k8u+A/2HzC07EmjcWORg=,tag:2ep8o1zmXNPV54Byq2Dl7Q==,type:str] + secret-key: ENC[AES256_GCM,data:wtGiMCpU8PqTXvH27l+tUvJLivuK/zZp5KePFSeYfjb3ieFszbnjWFd3xQkgtFM3HrmjhRaGWUEFOIEvgTTMDBDyL+k=,iv:iVxMwt6UtpMAqdZj13YUzr3/gDUVTJecyc4ptYvHyNo=,tag:R/tn/BrARGvXjL1EIHBCRQ==,type:str] +sops: + lastmodified: "2026-09-27T23:12:14Z" + mac: ENC[AES256_GCM,data:XWzKEL3qi4/KoKUZm1uEfj6GNW3ZLq71PDEyo7w2fHHmkgFMW/xwwXoBLRYFWVx3RvT82NwOCld/Savbs0qXY+Ws1AsgjklEim7MRyIjOKTT8Jkuh39WNCc+8C13yAHSrfPa3tEs10a8lk4nOaFxVn87zAnfnEt6LGt41+/HDxI=,iv:TxW4wJSqHVB9VH9pn/9lYsg8Og3JHTKRPHOrSjeAvuw=,tag:eKZkHptFhE95bPeNegTx8g==,type:str] + pgp: + - created_at: "2026-09-27T23:12:14Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA7uy4qQr71wiAQ/7BAr8vmZ9i0Www7U8EkhPqOi1g0MVD8tVyhnTptBbS4MG + irer3UAy7ktovNUso1/wljKif/b2Q8EK6Sawgv4Sv2jN8ShWewginRQ7DeRGtwNE + TkNnnZoIMQmKwUZq0NnTmStg0wY/bRDYrovGhvPO8F/ZebU/cEXRFdHDzsKsTo6p + 9LOu8DnTj9CwvhBLCyzqCeMwvL7DZryXuTS+aEVnrS0J4OUydK4VKYsvwXVsF6XT + 4Jkpcf4yAiwxBsnZiszvL+L1BPzku1peU/p/d1fciVq54TmgrRwyC7GrlCLm/f09 + xEPLnBMtmp1w5M2aONEYXXrk5fMWLIuSU7SmFzWduwLAMPTfHvGbpIS4U8eMCuIy + THKmeuyPL4/BW+PIc/L/UucOF0pjPDAPsdw3dEkB0+MlX3YDuTc37PpiX3pMRy1C + kxhwRVNPZqWMjkrAqg0BR9ZHEOQiv+HwHXZNG5CSHaYYC/mJUSVGaL7R0yOP3nIy + cWDA6Pyk5XWLspVh534xQODm1oArMdZ+xnD6NUqt+Bv6facrZkmT6r66LnCLb9fQ + rTS1aDm4gxuG5SX7lafDWL9Rh+z2DgFDde9cEAJZiBna4lTE7tJFPHF4OolqzrnN + MEhN8no5bLcMv1knE2nKkeKmOoXEKQ80mwgcVkdiRtQf2eZWAXAmpkGehuW/nIHS + XAHZXogqlqxbGDtIe2dM0qun1OA0HxsGw5J2EcFUt53wSg/YaZdEPN6aARPdRi8P + qGCEhZ43OokTCffCzf2Z52f7nx2NHIOoV3O3+80g6jw/Lrfe8WsZZZyXgjqm + =AViA + -----END PGP MESSAGE----- + fp: DC6910268E657FF70BA7EC289974494E76938DDC + encrypted_regex: ^(data|stringData|.*key|.*crt)$ + version: 3.10.2 diff --git a/kubernetes/infrastructure/cert-manager-webhook-porkbun/kustomization.yaml b/kubernetes/infrastructure/cert-manager-webhook-porkbun/kustomization.yaml new file mode 100644 index 0000000..e876e16 --- /dev/null +++ b/kubernetes/infrastructure/cert-manager-webhook-porkbun/kustomization.yaml @@ -0,0 +1,12 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: cert-manager +resources: + - repository.yaml + - release.yaml +secretGenerator: + - name: cert-manager-webhook-porkbun-values + files: + - values.yaml=values.yaml +configurations: + - kustomizeconfig.yaml diff --git a/kubernetes/infrastructure/cert-manager-webhook-porkbun/kustomizeconfig.yaml b/kubernetes/infrastructure/cert-manager-webhook-porkbun/kustomizeconfig.yaml new file mode 100644 index 0000000..5b4399c --- /dev/null +++ b/kubernetes/infrastructure/cert-manager-webhook-porkbun/kustomizeconfig.yaml @@ -0,0 +1,11 @@ +nameReference: + - kind: HelmRepository + version: v1 + fieldSpecs: + - path: spec/chart/spec/sourceRef/name + kind: HelmRelease + - kind: Secret + version: v1 + fieldSpecs: + - path: spec/valuesFrom/name + kind: HelmRelease diff --git a/kubernetes/infrastructure/cert-manager-webhook-porkbun/release.yaml b/kubernetes/infrastructure/cert-manager-webhook-porkbun/release.yaml new file mode 100644 index 0000000..7aad89d --- /dev/null +++ b/kubernetes/infrastructure/cert-manager-webhook-porkbun/release.yaml @@ -0,0 +1,19 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: cert-manager-webhook-porkbun + namespace: cert-manager +spec: + interval: 1m + chart: + spec: + sourceRef: + kind: HelmRepository + name: cert-manager-webhook-porkbun + namespace: cert-manager + chart: cert-manager-webhook-porkbun + version: "2.0.7" + interval: 1m + valuesFrom: + - kind: Secret + name: cert-manager-webhook-porkbun-values diff --git a/kubernetes/infrastructure/cert-manager-webhook-porkbun/repository.yaml b/kubernetes/infrastructure/cert-manager-webhook-porkbun/repository.yaml new file mode 100644 index 0000000..38e4b47 --- /dev/null +++ b/kubernetes/infrastructure/cert-manager-webhook-porkbun/repository.yaml @@ -0,0 +1,8 @@ +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: cert-manager-webhook-porkbun + namespace: cert-manager +spec: + interval: 1m + url: https://porkbun.octabits.io diff --git a/kubernetes/infrastructure/cert-manager-webhook-porkbun/values.yaml b/kubernetes/infrastructure/cert-manager-webhook-porkbun/values.yaml new file mode 100644 index 0000000..9050714 --- /dev/null +++ b/kubernetes/infrastructure/cert-manager-webhook-porkbun/values.yaml @@ -0,0 +1,49 @@ +# cert-manager-webhook-porkbun Values +# groupName must match the ClusterIssuer webhook stanza +groupName: acme.saggar.dev +# cert-manager deployment configuration for RBAC +# The chart creates RoleBindings so cert-manager's service account can reach +# the webhook and read the Porkbun credential Secret +certManager: + namespace: cert-manager + serviceAccountName: cert-manager +# Restrict the webhook's Secret read access to the Porkbun credentials only +rbac: + secretAccess: + secretNames: + - ENC[AES256_GCM,data:WXGjM38wR7oKcvetV91WocOt48njb5Y=,iv:7UEsgh62qq/0fGfmjG96Kko/r2h9IOD7IqRnu7poGFo=,tag:qdb4+n9ZnQidlz5fnHq94g==,type:str] +# Pod configuration +replicaCount: 1 +resources: + requests: + cpu: 10m + memory: 32Mi + limits: + memory: 128Mi +sops: + lastmodified: "2026-09-27T22:55:14Z" + mac: ENC[AES256_GCM,data:rSc+2n8PYZLdBJRWB3lgiH40+24/5v0vLRAkHV3vM3IyxZgBrjJxmWjAu5PJWHDobQiw7G7x7ZMotJx6TbJztbnBpB5GmdoFC0kVkxxdE8txCWlmcwed6oktCJQ0nR09DaqTk3OvRZgFsWwkVMhZwCjLS+gZBzTTcw84MKqQcGg=,iv:tJd2rGP0EzrjVSp5ESHf5BnFU7fFjMUgfZTgZeM2yRk=,tag:hxVTpxEjz1naTbrDTQUSYA==,type:str] + pgp: + - created_at: "2026-09-27T22:55:14Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA7uy4qQr71wiAQ/5AVsqIJQvmzAAexGSmYjPrdmX7W7JaVHYpUCFbiU9RP32 + S1ffbzV+YjmYkrLhnwhosNeheEVbEiWeyrea+B9wlTgUp1R9+oy8ooc30uDr/vhY + 9K56DoEcUhi95mQD1U7e7LK6qUkMowS0HWXEEOb/r/bvL3lQNmc4rNJ8Dz+MDFh3 + A59ZkrvspjccrLd9wJUb1QbwLKRw/QpE/bT17nj8bOwcAipdz2Q/GoX0LGp88fgS + Yy6G/zwVpY/mDylHZbunDVBEqAziR3TAbQsRQZou2oB69Q0jwVs8//vVhWSpniUr + an/XdNaEDR5LFJESJK9Kf3H2Qe/Cq8ynC3NFAwk+tHVLOW8MxQrDUvq3fTQq/Zl+ + CEzMD7+5bQDLQX82QMZ0TdjcLCIEouqCHo9dnGQGUX7NQd1ePV3xda6750zr1maX + PVTmx12nS+fCwo1DVLSTVa907TLg3h/DoADzpzcmhTfE7xO2mNcfN+P1dnHT2+U4 + FhUXqYgZSkgjlkkpVr8XmZg4Cb98lgpS6hDqXylrXhdsCvGgW9YKg0wdQqb6H4Sr + ycBsXmj4/j1EMB9yqfSpO/6NNDjTMms0nWsrGXI7NHpROj+AV7fWXC1yxhw6uTus + SYhve/6VvbCb3hw9gHb9lzQ9VvTq/0jOqIMBoLoD1Wd45tHczPx1xbVf3KyB1HTS + XgFYYLiLku1Jj87DtdbsAbN0tNQNets9TBVffkawgFNsei/H5ZazKFPOC5NrwnJ1 + FWLWI1fwFZG18c29b8mrEUKqX8GD+YO0BKwmtL7n9out6YAA+hK780RytQDdD00= + =yh2A + -----END PGP MESSAGE----- + fp: DC6910268E657FF70BA7EC289974494E76938DDC + encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$ + mac_only_encrypted: true + version: 3.10.2 diff --git a/kubernetes/system/flux/cert-manager-issuer.yaml b/kubernetes/system/flux/cert-manager-issuer.yaml index 4793d80..f431392 100644 --- a/kubernetes/system/flux/cert-manager-issuer.yaml +++ b/kubernetes/system/flux/cert-manager-issuer.yaml @@ -15,6 +15,7 @@ spec: dependsOn: - name: cert-manager - name: cert-manager-webhook-ovh + - name: cert-manager-webhook-porkbun decryption: provider: sops secretRef: diff --git a/kubernetes/system/flux/cert-manager-webhook-porkbun.yaml b/kubernetes/system/flux/cert-manager-webhook-porkbun.yaml new file mode 100644 index 0000000..e9b06b4 --- /dev/null +++ b/kubernetes/system/flux/cert-manager-webhook-porkbun.yaml @@ -0,0 +1,20 @@ +# Flux Kustomization for cert-manager-webhook-porkbun +# Depends on cert-manager being fully operational (CRDs installed) +apiVersion: kustomize.toolkit.fluxcd.io/v1 +kind: Kustomization +metadata: + name: cert-manager-webhook-porkbun + namespace: flux-system +spec: + interval: 10m + prune: true + sourceRef: + kind: GitRepository + name: homeprod + path: ./kubernetes/infrastructure/cert-manager-webhook-porkbun + dependsOn: + - name: cert-manager + decryption: + provider: sops + secretRef: + name: flux-sops diff --git a/kubernetes/system/flux/kustomization.yaml b/kubernetes/system/flux/kustomization.yaml index 368472f..529e6c7 100644 --- a/kubernetes/system/flux/kustomization.yaml +++ b/kubernetes/system/flux/kustomization.yaml @@ -6,6 +6,7 @@ resources: - webhook.yaml - cert-manager.yaml - cert-manager-webhook-ovh.yaml + - cert-manager-webhook-porkbun.yaml - cert-manager-issuer.yaml - caddy-certificates.yaml - stalwart-certificates.yaml