saggar.dev(kube): deploy

- cert-manager-webhook-porkbun via Flux (chart 2.0.7, octabits fork)
- porkbun DNS-01 solver on letsencrypt-production for saggar.dev
- porkbun API credentials secret (sops)
- saggar.dev apex Certificate + Caddy site block -> traefik

kubernetes/infrastructure/caddy-certificates/certificates.yaml

@@ -79,3 +79,19 @@ spec:
     - buildpath.win
   duration: 2160h # 90 days
   renewBefore: 360h # 15 days before expiry
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: saggar-dev
+  namespace: caddy
+spec:
+  secretName: saggar-dev-tls
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: saggar.dev
+  dnsNames:
+    - saggar.dev
+  duration: 2160h # 90 days
+  renewBefore: 360h # 15 days before expiry

kubernetes/infrastructure/caddy/caddyfile.yaml

@@ -107,3 +107,8 @@ data:
       tls /etc/caddy/certs/buildpath-win/tls.crt /etc/caddy/certs/buildpath-win/tls.key
       reverse_proxy traefik.traefik.svc.cluster.local.:80
     }
+
+    saggar.dev {
+      tls /etc/caddy/certs/saggar-dev/tls.crt /etc/caddy/certs/saggar-dev/tls.key
+      reverse_proxy traefik.traefik.svc.cluster.local.:80
+    }

kubernetes/infrastructure/caddy/values.yaml

@@ -36,25 +36,30 @@ health:
 volumes:
     - name: vhaudiquet-fr-tls
       secret:
-        secretName: ENC[AES256_GCM,data:HYQb37rKxMqxFTsCz5kw6qY=,iv:dI9uqUVLLqPv3a5vwz1vowTvO9WduQaXqj7XZREd7oA=,tag:mz257AC3pvubgzOMxbHfrg==,type:str]
-        optional: ENC[AES256_GCM,data:k9FVxw==,iv:XMAGop2PvSGD1R1cy6qqE39bsIAOFIqGzTnwDmYRhHM=,tag:7zZAwSzRWWiT9Y2iMWkI6w==,type:bool]
+        secretName: ENC[AES256_GCM,data:6ExXcOxf85dmK/C/XpC5b+4=,iv:kKI31lrYZSMv5hy0i1l3dMYpflc3DklDJNugH2xUgvQ=,tag:rDKoIg5UFH2MTcbiW1XD1g==,type:str]
+        optional: ENC[AES256_GCM,data:nQnlHQ==,iv:ynqIN1n+zfflikGK85hqPvG7o3fjJo8GNxCswq3mPT0=,tag:Ur6Z7qckOiaS/BnXBM92zQ==,type:bool]
     - name: wildcard-vhaudiquet-fr-tls
       secret:
-        secretName: ENC[AES256_GCM,data:2OUkq/AMuv2wQyIlLPS3bSRrnV1mvDR6vd0=,iv:1e9HC8FFC4vo7GjCnJyNjF05R+Js41ONy2in5a+/doI=,tag:icKdtLhvQ40YI+KCE+6fXg==,type:str]
-        optional: ENC[AES256_GCM,data:b+zvMw==,iv:QyU+T1BGZenO/nO8wq6R+KkrT/I6ZXIIhAnf5npFhvw=,tag:4UPyop81BQu4zxhZmK2n+Q==,type:bool]
+        secretName: ENC[AES256_GCM,data:iBKGSWRrJJ9NxjHouxuuczbbEVokuH5Qybw=,iv:ekjWmEY5Vbm4P/TIms++eW+gKRZmgMyPD2k2VJls5qE=,tag:jkM9R92TVFkAQy6clybskg==,type:str]
+        optional: ENC[AES256_GCM,data:1PmH7Q==,iv:3S9tFfYXRAOSTxsetrEOvRjcqWAoizwXOtDOsmG63fY=,tag:GvxrXLSPXgk0/iHON1jrug==,type:bool]
     # semery.fr certs from cert-manager (OVH DNS-01)
     - name: semery-fr-tls
       secret:
-        secretName: ENC[AES256_GCM,data:cLzhXgUhrwgIMACU1Q==,iv:DJ+6mjtjYmWxNcHl1gzeoifpcFCJsXiOXeyxEWnRU3g=,tag:7yc2bt6fBWwBuefPY48xyA==,type:str]
-        optional: ENC[AES256_GCM,data:DTfxaQ==,iv:K7TJjSI/vF3x34SWmwmivYo+mSsUAg9nB94Ui85nHCI=,tag:1/JRBMlb07+aHKEulIYpQQ==,type:bool]
+        secretName: ENC[AES256_GCM,data:qL62XGDo5zW3HKGoVg==,iv:Prlm6MpAopNzTxHVDlpWBibvxLqXjdi/iOrEAuspVZM=,tag:/MtBt2IDhjKU+lN9VGlu5Q==,type:str]
+        optional: ENC[AES256_GCM,data:P0BhoQ==,iv:e4Gr6iIGt6bTCPvdD3U7nLVHVusbiLc9iC/tQUpedYg=,tag:ew8ogjPxBHK4pYCRjOCoAA==,type:bool]
     - name: wildcard-semery-fr-tls
       secret:
-        secretName: ENC[AES256_GCM,data:Qq+ybi1kSVdVn9RP/kTkTcw0lkao3Q==,iv:vFmV3YvSNhLizgJVBnq1ZERqDP70onuZDvy/I3joPtI=,tag:AiEW+yh51Dexz3Vha4MPgg==,type:str]
-        optional: ENC[AES256_GCM,data:0o4ODw==,iv:VwnCs2C1MVUJEfBvNJT1rkDV7m60sNZPdtERo9wWPJk=,tag:oo+liLatrjqEtlrKQyjhyg==,type:bool]
+        secretName: ENC[AES256_GCM,data:nSwdeBlhSUhujmssB3oJ2QEdSjI16w==,iv:5nBHIeK2RWSMrl1qdxiVuUhiaM2erGfo+Tbd+p0MEHw=,tag:0j3sz2CREpmrcku86+abbw==,type:str]
+        optional: ENC[AES256_GCM,data:PXvJhA==,iv:MEnwpLwfbhagQSrbjH8++GTUwxK++CPuciBNu6xqQ4E=,tag:QU6qR62HzQKF7fygOW2z/Q==,type:bool]
     - name: buildpath-win-tls
       secret:
-        secretName: ENC[AES256_GCM,data:SejgJvZY/B7DDgf3YJcxcFA=,iv:bDZWhie17exL+9r9A7Ea/a8Rgpex7nuabVtW60LotJQ=,tag:WxqFbzulxxPgsynqfo5hzQ==,type:str]
-        optional: ENC[AES256_GCM,data:nBNRkw==,iv:JEvsFzMli7AzUj6GXJlHXOnANm45gnFE/kXrSbBotPQ=,tag:Puss6mCkoC7SGCb86guI2w==,type:bool]
+        secretName: ENC[AES256_GCM,data:2FVJ/B+sflBrGetSsBOsogA=,iv:pCkqWiArPcCSGYjhcQUUiPeOkDVmv5OgPfeLnAaC92g=,tag:gIF4vlthAPZihlVbHSqAMQ==,type:str]
+        optional: ENC[AES256_GCM,data:6XQzuw==,iv:TrcOBBCls8UK+FyZbQSuAvBs5pa72RVR9u2mHn4jVoE=,tag:2qZKMLzdLgFti+KkEtSYvQ==,type:bool]
+    # saggar.dev cert from cert-manager (Porkbun DNS-01)
+    - name: saggar-dev-tls
+      secret:
+        secretName: ENC[AES256_GCM,data:E6zCT5mte8FFgkslRD8=,iv:GtlwHsG0X9pfNn1EscTA5YFd1wXTwKYXfW3mPKahQ60=,tag:ugJMzZb0sOVvmLtsOkuPrg==,type:str]
+        optional: ENC[AES256_GCM,data:RBTuXg==,iv:MYlyt3OiAVwIX/5jFW9mdnOQ/1HP2q6hwVtMz8f86qE=,tag:tKyyLTCWcnNxsafLyXZNgA==,type:bool]
     - name: routes
       configMap:
         name: caddy-routes
@@ -75,6 +80,9 @@ volumeMounts:
     - name: buildpath-win-tls
       mountPath: /etc/caddy/certs/buildpath-win
       readOnly: true
+    - name: saggar-dev-tls
+      mountPath: /etc/caddy/certs/saggar-dev
+      readOnly: true
     - name: routes
       mountPath: /etc/caddy/routes
       readOnly: true
@@ -99,7 +107,7 @@ affinity:
             - weight: 100
               preference:
                 matchExpressions:
-                    - key: ENC[AES256_GCM,data:oCV218wXg+k2L/edhWv6qpiyiaY=,iv:Y+O2of2NCOvcjSwr0EenGns0BtpT+P6pjCzEZUIMpm0=,tag:kY/WyHJ4Jr5ZLMe6ZcT/Tw==,type:str]
+                    - key: ENC[AES256_GCM,data:H7+ITzzjHDUEp0S1StQdhR8boM8=,iv:shPNxrM5kuzL0rM2ro8WT8RyVuz/CmbH9CyalmWT7Tg=,tag:VWumtU5IK8Bf62LEB2b3Nw==,type:str]
                       operator: NotIn
                       values:
                         - "true"
@@ -113,35 +121,35 @@ affinity:
                 topologyKey: kubernetes.io/hostname
 tolerations:
     # Tolerate the failover taint so caddy CAN schedule on p330 (small-node-1).
-    - key: ENC[AES256_GCM,data:K6vJkO2dpKRi,iv:b7NIPKTMYOxNao6KcSJUhsxKNRJ2J3ksEtmXkI8b0So=,tag:pMRmz17upWMTEZjwBRNyZQ==,type:str]
+    - key: ENC[AES256_GCM,data:9zHboRH5nBUO,iv:IO30csmF3Sz5YUmvVbhZj5t8FextWnHDh/jgpc65y1U=,tag:LOsqaxYbLlTADuhZSY8fNA==,type:str]
       operator: Equal
-      value: ENC[AES256_GCM,data:4ULPtEoUhgs=,iv:ikqWRqRR9ki35QQ6VnMEzOgT0/e+5DggGP8w60BhW/Q=,tag:MW9lX8miIWb9nnbc0woZTg==,type:str]
+      value: ENC[AES256_GCM,data:h8zjdogIMN4=,iv:iRAVuj9jfe4HHuJAoV9gN4zSU/eFzZaDMOfAujOxqr4=,tag:CCEYwHnLos+l1VvvIndtDg==,type:str]
       effect: NoSchedule
-    - key: ENC[AES256_GCM,data:l7abu6ywKFevJdJod2Af2bj7XSfBJATL7UnfiUHrRJoCjBsl9A==,iv:xnUvzVX8z4doC+mQs1r0rNCSqaZ8KlXxr5Ee9FOFPjI=,tag:mnqCx9NSMSyeYwz57QFQIQ==,type:str]
+    - key: ENC[AES256_GCM,data:rRW0TkG62zRAhbWBV2bWcfJKrm0dHs6N7WE4DhSiQMvExUkgpQ==,iv:CZYuuxH0rFdnCu/MzZpQAgQpI2ChfkAZyCPoUtpkm30=,tag:nmd1QopYn5pq64AX34lZNQ==,type:str]
       operator: Exists
       effect: NoSchedule
 sops:
-    lastmodified: "2026-08-26T19:28:03Z"
-    mac: ENC[AES256_GCM,data:gn90e5Gjq5/CraT7Cl43DVMIQukD798faKGbVO5IJlbpAuTwDrhvqnnojFq4R7LEEETtedpR3MRyqcnbfSWVruHoysebycL7EZJkiy7H36JmzQAOWKusshMF9kOyZIV6+AFfz8As/Mu4pF1p5+3jmgy6oOJn7Ewm0C930Gpa3gs=,iv:cf1UC/2NGBHtQgx6h8vRpMjeJRaAvG7ZznhErn2b+cE=,tag:3Ule+pq7pZHWA7NqhlgfPg==,type:str]
+    lastmodified: "2026-09-27T22:55:14Z"
+    mac: ENC[AES256_GCM,data:Ll/xUtd3OLEoeTIVHG3nzvi8hiTJuaTBSMPrWjBTxqma0KM5zE3FKUCEUDaiXesu/XXlSiA8gO7YwttmDPvUXoCNHXGQ0SvkO6m8Hj0hgaQgk74nM9esEsLv/SShl+uRVjZxfIhc0Ao43PJoZqZvHDUd0Kkebh/7/t5Sb3ggy7Q=,iv:uopg0kaXiFKjYz8jCC/395n9YzuQo54RWbHiwkgv+IU=,tag:F5O7vaKSxX4Gg7mSZ+3yLA==,type:str]
     pgp:
-        - created_at: "2026-08-26T19:28:03Z"
+        - created_at: "2026-09-27T22:55:14Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ/9FKZhqwE2RZcfsIeMOtAkOTf/4aEbrSzsHbEO8DP8V3Ct
-            rQBu/v8y1Hcu3fVU/OjVk/7QbEBjPNu1AJST55DBIWktnYUgSo4fIujvG54/hqwM
-            9u0iuA1EcqVzGDa+vLSqgmi4Oxbujs0Ytn7uQrefqkdAOjltKqvknebI9EBdSRUi
-            GjVFwysR6jHmIVf9S64vu4VsjfC7ju9MBYZniaKsJ1GOBhIjUZ6ogkYs5S2E5PJ/
-            zE8cn79x61YLX74H+BAqnFcxbprtsCwMJPgyerfgijV6d+JpwT/6mp1VUrLe9Zz7
-            WEd/lVMlIcwnYCtIDAvuURvMP2OebWplr95d5V1Vb5Yywnl3M0pwkqL4dRiJISvk
-            N2rBQYvDfXBtJA7yTAkJ3PymrECKoFs6nspEBie/kDJmdRGv8s2aajzTTQ1qLAkP
-            FeJe0TcowjCCWMxk4W5DEoCh+PUA1HVo+/KmHjnIVgzdgxaeqT90VXwN8H7MPPeu
-            LKE01+Guue821h7GykkIhe9sf3nMGbI5rOiCcsVtgu5bODkRk8jXpXh1qdRAliuq
-            uddjy1mWEfdUHNBj8YxvZ8WOU7h9FyZjsYZB96n9du1vqcuuP5eTJDVuvjjtDuTK
-            fbXYQbxwA5j4akyI4AKJYLA0Y/lcSXc84r6q8IA52nZz6uQZExbkoc7PPX7Q/ufS
-            XgE0CWRS+0tk2oVANMVU31UrCvitttezjR6sUSAINh122a5kcmOfJzLlB2OqVKc5
-            wMAyvOYccrQMrPDX1WJE7agDOaqGUQcwuFnvqpHhe8q9Yg1uOUU4sK1R8A1Qs0Q=
-            =wlYf
+            hQIMA7uy4qQr71wiAQ/8DpuQVg8C6MTbsbjCSdCqGBPB2eB0Vk7tnyRvxdpIRZ1E
+            fbQez6jSXrScJZGC5+IylEKyL50AIr3h9xiLsNsVveXe1v00Tl2+8ozc6oslCxib
+            u2ldEJOFEdmvzlSmg+r+Fxl/0Tos8ZHVirosMlXkpG6iY7zoXzxBJmA3/12oQnsm
+            gBqsBg/Tjd6PxlolT8M5CG8jg+17Fhupl4VSBZRaUH4SOLodmuwUSPJtUVdrloGf
+            dv6ZXjUxMHyejBbP5CrPhbwclh8Sf1MnZlAr6icxzTEVodbDG4qPVfY2nhW5i32S
+            8N815C6ElOGU4qrf9ArxZFI1hLarQFm1jPPw4esOS544QRiYeHCgfm/qt9v9NHDL
+            Y6P9YdFHfy3i1t1jlLdvjFDrjBn75snCv9OKbb0EQkNdFhelFNwNlAskC//fKz2f
+            EHtC9QbZ22oitCFtq3zyx0pcm9Z9KMki/u8aO8lMdXFVxa/HI3zz50ebdP/Yxlud
+            4TRiy3mZhij4zV9MA9AOBvrlUUw+Bde5xEG4BRFAHk5Ed0I/p08fcgPHu3SX/LTr
+            6V38ME0jBU6D6nem/Lg4tiKUOfaliEFzPjQUIvFCnmKK7WHQ8RP+u0UW1LtNhNBw
+            eZWLPcYFzYLwm0Ad1qiby//rL06L7pvJG6WJ5bX/j3qkXIFNFsn/IbgK9euOvvnS
+            XAG3dhDOoDhWqU9rKVbMgBHNV1quRBmrNPOXBOelvOWoruFlCxaUU5cUsTdgXH51
+            dej6Y8v//qHE8B9nV2r5dvGXUrCVYTF4FKC+6tY9eueB18bNoosPgykiG1Od
+            =6uqR
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
     encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$

kubernetes/infrastructure/cert-manager-issuer/clusterissuer.yaml

@@ -42,3 +42,18 @@ spec:
         selector:
           dnsZones:
             - semery.fr
+      # Porkbun solver for saggar.dev (via cert-manager-webhook-porkbun)
+      - dns01:
+          webhook:
+            groupName: acme.saggar.dev
+            solverName: porkbun
+            config:
+              apiKey:
+                name: porkbun-api-credentials
+                key: api-key
+              secretApiKey:
+                name: porkbun-api-credentials
+                key: secret-key
+        selector:
+          dnsZones:
+            - saggar.dev

kubernetes/infrastructure/cert-manager-issuer/kustomization.yaml

@@ -5,3 +5,4 @@ resources:
   - clusterissuer.yaml
   - ovh-credentials-secret.yaml
   - ovh-secret-reader-rbac.yaml
+  - porkbun-api-credentials-secret.yaml

kubernetes/infrastructure/cert-manager-issuer/porkbun-api-credentials-secret.yaml

@@ -0,0 +1,49 @@
+# Porkbun API Credentials for DNS-01 Challenges (saggar.dev)
+#
+# Create an API key at https://porkbun.com/account (API Access section), and
+# enable API access on the domain: Domain Management -> Details -> API Access
+# (disabled per domain by default; the API returns a generic error otherwise).
+#
+# The secret MUST live in the cert-manager namespace: for a ClusterIssuer,
+# cert-manager reads webhook credential secrets from its cluster resource
+# namespace, which the webhook chart's RBAC already covers.
+#
+# SOPS will encrypt the stringData fields on pre-commit.
+apiVersion: v1
+kind: Secret
+metadata:
+    name: porkbun-api-credentials
+    namespace: cert-manager
+    labels:
+        app.kubernetes.io/name: cert-manager-webhook-porkbun
+        app.kubernetes.io/component: porkbun-api-credentials
+type: Opaque
+stringData:
+    api-key: ENC[AES256_GCM,data:OLTDhFnbK70gAsvMR/4iKjKr9ckEkbXhYfG4xgTWP2gjruI9HaNAWzSBJcmDyRXRSz18XnvnSlUy/P5VXG5S6uH84wg=,iv:DrOWWf5h1FLNg+emJ/MMp80k8u+A/2HzC07EmjcWORg=,tag:2ep8o1zmXNPV54Byq2Dl7Q==,type:str]
+    secret-key: ENC[AES256_GCM,data:wtGiMCpU8PqTXvH27l+tUvJLivuK/zZp5KePFSeYfjb3ieFszbnjWFd3xQkgtFM3HrmjhRaGWUEFOIEvgTTMDBDyL+k=,iv:iVxMwt6UtpMAqdZj13YUzr3/gDUVTJecyc4ptYvHyNo=,tag:R/tn/BrARGvXjL1EIHBCRQ==,type:str]
+sops:
+    lastmodified: "2026-09-27T23:12:14Z"
+    mac: ENC[AES256_GCM,data:XWzKEL3qi4/KoKUZm1uEfj6GNW3ZLq71PDEyo7w2fHHmkgFMW/xwwXoBLRYFWVx3RvT82NwOCld/Savbs0qXY+Ws1AsgjklEim7MRyIjOKTT8Jkuh39WNCc+8C13yAHSrfPa3tEs10a8lk4nOaFxVn87zAnfnEt6LGt41+/HDxI=,iv:TxW4wJSqHVB9VH9pn/9lYsg8Og3JHTKRPHOrSjeAvuw=,tag:eKZkHptFhE95bPeNegTx8g==,type:str]
+    pgp:
+        - created_at: "2026-09-27T23:12:14Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ/7BAr8vmZ9i0Www7U8EkhPqOi1g0MVD8tVyhnTptBbS4MG
+            irer3UAy7ktovNUso1/wljKif/b2Q8EK6Sawgv4Sv2jN8ShWewginRQ7DeRGtwNE
+            TkNnnZoIMQmKwUZq0NnTmStg0wY/bRDYrovGhvPO8F/ZebU/cEXRFdHDzsKsTo6p
+            9LOu8DnTj9CwvhBLCyzqCeMwvL7DZryXuTS+aEVnrS0J4OUydK4VKYsvwXVsF6XT
+            4Jkpcf4yAiwxBsnZiszvL+L1BPzku1peU/p/d1fciVq54TmgrRwyC7GrlCLm/f09
+            xEPLnBMtmp1w5M2aONEYXXrk5fMWLIuSU7SmFzWduwLAMPTfHvGbpIS4U8eMCuIy
+            THKmeuyPL4/BW+PIc/L/UucOF0pjPDAPsdw3dEkB0+MlX3YDuTc37PpiX3pMRy1C
+            kxhwRVNPZqWMjkrAqg0BR9ZHEOQiv+HwHXZNG5CSHaYYC/mJUSVGaL7R0yOP3nIy
+            cWDA6Pyk5XWLspVh534xQODm1oArMdZ+xnD6NUqt+Bv6facrZkmT6r66LnCLb9fQ
+            rTS1aDm4gxuG5SX7lafDWL9Rh+z2DgFDde9cEAJZiBna4lTE7tJFPHF4OolqzrnN
+            MEhN8no5bLcMv1knE2nKkeKmOoXEKQ80mwgcVkdiRtQf2eZWAXAmpkGehuW/nIHS
+            XAHZXogqlqxbGDtIe2dM0qun1OA0HxsGw5J2EcFUt53wSg/YaZdEPN6aARPdRi8P
+            qGCEhZ43OokTCffCzf2Z52f7nx2NHIOoV3O3+80g6jw/Lrfe8WsZZZyXgjqm
+            =AViA
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
+    version: 3.10.2

kubernetes/infrastructure/cert-manager-webhook-porkbun/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: cert-manager
+resources:
+  - repository.yaml
+  - release.yaml
+secretGenerator:
+  - name: cert-manager-webhook-porkbun-values
+    files:
+      - values.yaml=values.yaml
+configurations:
+  - kustomizeconfig.yaml

kubernetes/infrastructure/cert-manager-webhook-porkbun/kustomizeconfig.yaml

@@ -0,0 +1,11 @@
+nameReference:
+  - kind: HelmRepository
+    version: v1
+    fieldSpecs:
+      - path: spec/chart/spec/sourceRef/name
+        kind: HelmRelease
+  - kind: Secret
+    version: v1
+    fieldSpecs:
+      - path: spec/valuesFrom/name
+        kind: HelmRelease

kubernetes/infrastructure/cert-manager-webhook-porkbun/release.yaml

@@ -0,0 +1,19 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cert-manager-webhook-porkbun
+  namespace: cert-manager
+spec:
+  interval: 1m
+  chart:
+    spec:
+      sourceRef:
+        kind: HelmRepository
+        name: cert-manager-webhook-porkbun
+        namespace: cert-manager
+      chart: cert-manager-webhook-porkbun
+      version: "2.0.7"
+      interval: 1m
+  valuesFrom:
+    - kind: Secret
+      name: cert-manager-webhook-porkbun-values

kubernetes/infrastructure/cert-manager-webhook-porkbun/repository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: cert-manager-webhook-porkbun
+  namespace: cert-manager
+spec:
+  interval: 1m
+  url: https://porkbun.octabits.io

kubernetes/infrastructure/cert-manager-webhook-porkbun/values.yaml

@@ -0,0 +1,49 @@
+# cert-manager-webhook-porkbun Values
+# groupName must match the ClusterIssuer webhook stanza
+groupName: acme.saggar.dev
+# cert-manager deployment configuration for RBAC
+# The chart creates RoleBindings so cert-manager's service account can reach
+# the webhook and read the Porkbun credential Secret
+certManager:
+    namespace: cert-manager
+    serviceAccountName: cert-manager
+# Restrict the webhook's Secret read access to the Porkbun credentials only
+rbac:
+    secretAccess:
+        secretNames:
+            - ENC[AES256_GCM,data:WXGjM38wR7oKcvetV91WocOt48njb5Y=,iv:7UEsgh62qq/0fGfmjG96Kko/r2h9IOD7IqRnu7poGFo=,tag:qdb4+n9ZnQidlz5fnHq94g==,type:str]
+# Pod configuration
+replicaCount: 1
+resources:
+    requests:
+        cpu: 10m
+        memory: 32Mi
+    limits:
+        memory: 128Mi
+sops:
+    lastmodified: "2026-09-27T22:55:14Z"
+    mac: ENC[AES256_GCM,data:rSc+2n8PYZLdBJRWB3lgiH40+24/5v0vLRAkHV3vM3IyxZgBrjJxmWjAu5PJWHDobQiw7G7x7ZMotJx6TbJztbnBpB5GmdoFC0kVkxxdE8txCWlmcwed6oktCJQ0nR09DaqTk3OvRZgFsWwkVMhZwCjLS+gZBzTTcw84MKqQcGg=,iv:tJd2rGP0EzrjVSp5ESHf5BnFU7fFjMUgfZTgZeM2yRk=,tag:hxVTpxEjz1naTbrDTQUSYA==,type:str]
+    pgp:
+        - created_at: "2026-09-27T22:55:14Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ/5AVsqIJQvmzAAexGSmYjPrdmX7W7JaVHYpUCFbiU9RP32
+            S1ffbzV+YjmYkrLhnwhosNeheEVbEiWeyrea+B9wlTgUp1R9+oy8ooc30uDr/vhY
+            9K56DoEcUhi95mQD1U7e7LK6qUkMowS0HWXEEOb/r/bvL3lQNmc4rNJ8Dz+MDFh3
+            A59ZkrvspjccrLd9wJUb1QbwLKRw/QpE/bT17nj8bOwcAipdz2Q/GoX0LGp88fgS
+            Yy6G/zwVpY/mDylHZbunDVBEqAziR3TAbQsRQZou2oB69Q0jwVs8//vVhWSpniUr
+            an/XdNaEDR5LFJESJK9Kf3H2Qe/Cq8ynC3NFAwk+tHVLOW8MxQrDUvq3fTQq/Zl+
+            CEzMD7+5bQDLQX82QMZ0TdjcLCIEouqCHo9dnGQGUX7NQd1ePV3xda6750zr1maX
+            PVTmx12nS+fCwo1DVLSTVa907TLg3h/DoADzpzcmhTfE7xO2mNcfN+P1dnHT2+U4
+            FhUXqYgZSkgjlkkpVr8XmZg4Cb98lgpS6hDqXylrXhdsCvGgW9YKg0wdQqb6H4Sr
+            ycBsXmj4/j1EMB9yqfSpO/6NNDjTMms0nWsrGXI7NHpROj+AV7fWXC1yxhw6uTus
+            SYhve/6VvbCb3hw9gHb9lzQ9VvTq/0jOqIMBoLoD1Wd45tHczPx1xbVf3KyB1HTS
+            XgFYYLiLku1Jj87DtdbsAbN0tNQNets9TBVffkawgFNsei/H5ZazKFPOC5NrwnJ1
+            FWLWI1fwFZG18c29b8mrEUKqX8GD+YO0BKwmtL7n9out6YAA+hK780RytQDdD00=
+            =yh2A
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
+    version: 3.10.2

kubernetes/system/flux/cert-manager-issuer.yaml

@@ -15,6 +15,7 @@ spec:
   dependsOn:
     - name: cert-manager
     - name: cert-manager-webhook-ovh
+    - name: cert-manager-webhook-porkbun
   decryption:
     provider: sops
     secretRef:

kubernetes/system/flux/cert-manager-webhook-porkbun.yaml

@@ -0,0 +1,20 @@
+# Flux Kustomization for cert-manager-webhook-porkbun
+# Depends on cert-manager being fully operational (CRDs installed)
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cert-manager-webhook-porkbun
+  namespace: flux-system
+spec:
+  interval: 10m
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: homeprod
+  path: ./kubernetes/infrastructure/cert-manager-webhook-porkbun
+  dependsOn:
+    - name: cert-manager
+  decryption:
+    provider: sops
+    secretRef:
+      name: flux-sops

kubernetes/system/flux/kustomization.yaml

@@ -6,6 +6,7 @@ resources:
   - webhook.yaml
   - cert-manager.yaml
   - cert-manager-webhook-ovh.yaml
+  - cert-manager-webhook-porkbun.yaml
   - cert-manager-issuer.yaml
   - caddy-certificates.yaml
   - stalwart-certificates.yaml