saggar.dev(kube): deploy

- cert-manager-webhook-porkbun via Flux (chart 2.0.7, octabits fork)
- porkbun DNS-01 solver on letsencrypt-production for saggar.dev
- porkbun API credentials secret (sops)
- saggar.dev apex Certificate + Caddy site block -> traefik

kubernetes/infrastructure/caddy-certificates/certificates.yaml

@@ -79,3 +79,19 @@ spec:
     - buildpath.win
   duration: 2160h # 90 days
   renewBefore: 360h # 15 days before expiry
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: saggar-dev
+  namespace: caddy
+spec:
+  secretName: saggar-dev-tls
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: saggar.dev
+  dnsNames:
+    - saggar.dev
+  duration: 2160h # 90 days
+  renewBefore: 360h # 15 days before expiry