chore(renovate): add SOPS round-trip postUpgradeTasks + self-hosted runner

mirror of https://github.com/vhaudiquet/homeprod.git synced 2026-09-21 16:36:05 +00:00

Address review feedback on SOPS handling for encrypted values.yaml.

- renovate.json: Renovate has NO preUpgradeTasks option (verified against
  the renovate-schema). Decrypt must therefore happen inside postUpgradeTasks
  (which run after the tag bump, before the commit): decrypt the values.yaml,
  then re-encrypt. Encrypting an already-encrypted file would double-encrypt
  the existing ENC secret values. Only **/values.yaml is re-encrypted; the
  docker-compose and Chart.yaml files are not SOPS-encrypted here.
- kubernetes/code/renovate: self-hosted Renovate runner as a Flux CronJob
  running the renovatebot/renovate image, with sops allowed as a
  postUpgradeTask command and the SOPS PGP key loaded to re-encrypt
  values.yaml. Secrets come from SOPS-encrypted dotenv/env file sources.
- Wire code/renovate into the root kubernetes kustomization.

This commit is contained in:

kosmos

2026-08-26 19:58:55 +02:00

committed by

vhaudiquet

parent e71d4be59f

commit 5bf07a2fff

8 changed files with 147 additions and 0 deletions

									
										kubernetes/kustomization.yaml
									
		+2
		
												View File
												
				@@ -25,6 +25,8 @@ resources:

				  - infrastructure/traefik

				  - infrastructure/caddy

				  - infrastructure/network/blocky

				  # Code (self-hosted dev tooling)

				  - code/renovate

				  # Dev (developer platform)

				  - dev/gitea

				  - dev/harbor