refactor: consolidate kubernetes categories

2026-09-13 04:31:14 +00:00 · 2026-08-09 19:58:18 +02:00
parent 434c1aa51e
commit 88146579c0
83 changed files with 37 additions and 34 deletions
@@ -1,13 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: blocky
-resources:
-  - namespace.yaml
-  - repository.yaml
-  - release.yaml
-secretGenerator:
-  - name: blocky-values
-    files:
-      - values.yaml=values.yaml
-configurations:
-  - kustomizeconfig.yaml
@@ -1,6 +0,0 @@
-nameReference:
-  - kind: HelmRepository
-    version: v1
-    fieldSpecs:
-      - path: spec/chart/spec/sourceRef/name
-        kind: HelmRelease
@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: blocky
-  labels:
-    app.kubernetes.io/name: blocky
-    app.kubernetes.io/component: dns
@@ -1,19 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: blocky
-  namespace: blocky
-spec:
-  interval: 1m
-  chart:
-    spec:
-      sourceRef:
-        kind: HelmRepository
-        name: blocky
-        namespace: blocky
-      chart: blocky
-      version: "11.2.1"
-      interval: 1m
-  valuesFrom:
-    - kind: Secret
-      name: blocky-values
@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: blocky
-  namespace: blocky
-spec:
-  interval: 1h
-  url: https://k8s-home-lab.github.io/helm-charts/
@@ -1,96 +0,0 @@
-# Default values for blocky (k8s-home-lab chart)
-image:
-    repository: ghcr.io/0xerr0r/blocky
-    tag: v0.24
-    pullPolicy: IfNotPresent
-controller:
-    replicas: 2
-    dnsPolicy: ClusterFirst
-    strategy: RollingUpdate
-    rollingUpdate:
-        maxUnavailable: 0
-        maxSurge: 1
-env:
-    TZ: Europe/Paris
-service:
-    main:
-        enabled: false
-    dns-tcp:
-        enabled: false
-    dns-udp:
-        enabled: true
-        type: LoadBalancer
-        loadBalancerIP: 10.1.2.148
-        # Cluster (not Local) so any node can forward to pods on any other node.
-        # Required for Cilium L2 announcement failover
-        externalTrafficPolicy: Cluster
-        ports:
-            dns:
-                port: 53
-                protocol: UDP
-probes:
-    liveness:
-        enabled: true
-        custom: true
-        spec:
-            tcpSocket:
-                port: 53
-            initialDelaySeconds: 10
-            periodSeconds: 10
-            timeoutSeconds: 5
-            failureThreshold: 3
-    readiness:
-        enabled: true
-        custom: true
-        spec:
-            tcpSocket:
-                port: 53
-            initialDelaySeconds: 5
-            periodSeconds: 5
-            timeoutSeconds: 3
-            failureThreshold: 3
-    startup:
-        enabled: true
-        custom: true
-        spec:
-            tcpSocket:
-                port: 53
-            initialDelaySeconds: 5
-            periodSeconds: 2
-            timeoutSeconds: 3
-            failureThreshold: 30
-resources:
-    limits:
-        cpu: 600m
-        memory: 768Mi
-    requests:
-        cpu: 200m
-        memory: 256Mi
-# Full list of options https://github.com/0xERR0R/blocky/blob/main/docs/config.yml
-config: "upstreams:\n    groups:\n        default:\n            - 1.1.1.1\n            - 1.0.0.1\n        lan:\n            - 10.101.207.1\n\nconditional:\n    mapping:\n        lan: 10.101.207.1\n        cluster.local: 10.96.0.10\n\nblocking:\n    allowlists:\n        ads:\n            - |\n                dealabs.digidip.net\n                s.click.aliexpress.com\n                fonts.googleapis.com\n                fonts.gstatic.com\n                wl.spotify.com\n                www.googleadservices.com\n    \n    denylists:\n        ads:\n            - https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts\n            - https://adaway.org/hosts.txt\n    \n    clientGroupsBlock:\n        default:\n            - ads\n    \n    blockType: zeroIp\n    blockTTL: 1m\n    loading:\n        refreshPeriod: 4h\n        downloads:\n            timeout: 60s\n\ncaching:\n    minTime: 5m\n    maxTime: 30m\n    # Disable negative caching (NXDOMAIN responses) for dynamic DNS\n    cacheTimeNegative: 0\n    prefetching: true\n    prefetchExpires: 2h\n    prefetchThreshold: 5\n\nprometheus:\n    enable: true\n    path: /metrics\n\nports:\n    dns: 53\n    http: 4000\n\nbootstrapDns: tcp+udp:1.1.1.1\n\nlog:\n    level: info\n    format: text\n    timestamp: true\n"
-sops:
-    lastmodified: "2026-06-05T16:01:30Z"
-    mac: ENC[AES256_GCM,data:zcrVjYr3g0fDVMLP6T2kEDph3WbGh6nTGkqYwgfKuBOMQ/am+VxXmUJUh1YL0vvFjrwocK7hXFfJ6q/G5SNY+8GVLNeKfl+svfDEssmY9o9XOkSgmCh1MPHCUa6bP/+F1xXq0rU9umvRnjKfhC037iKkCDjEVm6KZt8v2OSvqJA=,iv:MjZtMcEuf9hwVRXGKn3BZnHXMJSeOp453J8SGyh6PTU=,tag:N1IxsGmaJr703gsQ0XjYjg==,type:str]
-    pgp:
-        - created_at: "2026-06-05T16:01:29Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiARAAikW2TqLZeBx2ERR7HF15cvCNDqCoTHwVUuTyc0qPUyoM
-            Zy0X/wN3e0c4Ti0X4lUqJyICpH49sbKtygrRI4vVywr+4KgpKIwi/DTmPk358Cw2
-            4E8DAVMcQDbpSPDgnl2DrrcPBa551MZusXs89nh3Eay4MW/gbEPpQvcuiI8tMQW8
-            f8759mNQHGxKUhSvdbJJO13+I7e1vhJz/twWJPJlieBRQ46QQjOuGSAo6YWEH4R2
-            Hkrp+7p8tWjFbJEnBlAW5lpcnqjCmoKPuOPXwi6mXpZfEssUsWE99DriCIuRM1ZQ
-            FBTroMHlwVESE58yBqxs1ZIMHxyncyj0rHfDnrOH08OpW9brTaardHZMcO2Kkil7
-            uK5wTdTaNph1crLoWoiW6vuZv05OiHsuHe0miuhRakedmCcbC+dYGmBPDgo0mKYB
-            0CzzSRL7MTB9LhGSxH6xrlm1hyRmVzNnYc35VPWf48S/jZi7iOOth/mRaxmi94VZ
-            O4XiAuwh77eXDaYoOgYaVpCicXXg2uoq3MVjl32yUeuwpDSxVfRUJz39s1rP3UMT
-            CgFc+Yen7aUmcBYlid69Le2UR3JTGlr1LXyuXR4ju3x0k84qfGKAwjottB2snKu9
-            twcxDzDMkjV4Maz3CmBxVglpxe6gOzOSk9BZujxogFHncRxMBo5BJO4/926iaWHS
-            XgEPMREJARCGq+N+8vc7PQ1xlNEqcwL0c0PJjRVqQIAeuvF4QK9kH+P8aR0k1MXK
-            WnUHF/3afdgPwpp4ZZJoxfna2AroRh2+Dns4KM7QN2oyFWPNPJuRKyAtaKewPp0=
-            =DIqZ
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
-    version: 3.10.2
@@ -1,95 +0,0 @@
-# Caddy Routes - External ConfigMap
-# This file contains all route definitions, imported by the main Caddyfile.
-# Edit this file to add/modify routes.
-#
-# Certificate files are mounted from cert-manager-managed TLS Secrets
-# at /etc/caddy/certs/
-
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: caddy-routes
-  namespace: caddy
-  labels:
-    app.kubernetes.io/name: caddy
-    app.kubernetes.io/component: routes
-data:
-  Caddyfile: |
-    vhaudiquet.fr {
-      tls /etc/caddy/certs/vhaudiquet-fr/tls.crt /etc/caddy/certs/vhaudiquet-fr/tls.key
-      reverse_proxy traefik.traefik.svc.cluster.local.:80
-    }
-
-    *.vhaudiquet.fr {
-        tls /etc/caddy/certs/wildcard-vhaudiquet-fr/tls.crt /etc/caddy/certs/wildcard-vhaudiquet-fr/tls.key
-
-        # Kubernetes services (via Traefik)
-        @authentik   host authentik.vhaudiquet.fr
-
-        @auth-nook   host auth-nook.vhaudiquet.fr
-        @nook-mg     host n.vhaudiquet.fr
-        @nook        host nook.vhaudiquet.fr
-        @sse-nook    host sse-nook.vhaudiquet.fr
-
-        @gitea       host git.vhaudiquet.fr
-
-        @flux-wh     host flux-webhook.vhaudiquet.fr
-
-        @umami       host umami.vhaudiquet.fr
-
-        handle @authentik {
-            reverse_proxy traefik.traefik.svc.cluster.local.:80
-        }
-        handle @auth-nook {
-            reverse_proxy traefik.traefik.svc.cluster.local.:80
-        }
-        handle @nook-mg {
-            reverse_proxy traefik.traefik.svc.cluster.local.:80
-        }
-        handle @nook {
-            reverse_proxy traefik.traefik.svc.cluster.local.:80
-        }
-        handle @sse-nook {
-            reverse_proxy traefik.traefik.svc.cluster.local.:80
-        }
-        handle @gitea {
-            reverse_proxy traefik.traefik.svc.cluster.local.:80
-        }
-        handle @flux-wh {
-            reverse_proxy traefik.traefik.svc.cluster.local.:80
-        }
-        handle @umami {
-            reverse_proxy traefik.traefik.svc.cluster.local.:80
-        }
-
-        # Docker VM services (via Docker Traefik)
-        @alexscript     host alexscript.vhaudiquet.fr
-        @clips          host clips.vhaudiquet.fr
-        @jellyfin       host flix.vhaudiquet.fr
-
-        handle @alexscript {
-            reverse_proxy 10.1.2.212:80
-        }
-        handle @clips {
-            reverse_proxy 10.1.2.212:80
-        }
-        handle @jellyfin {
-            reverse_proxy 10.1.2.212:80
-        }
-
-        # Stalwart WebUI (now in Kubernetes, via k8s Traefik)
-        @mail           host mail.vhaudiquet.fr
-        handle @mail {
-            reverse_proxy traefik.traefik.svc.cluster.local.:80
-        }
-    }
-
-    semery.fr {
-      tls /etc/caddy/certs/semery-fr/tls.crt /etc/caddy/certs/semery-fr/tls.key
-      reverse_proxy 10.1.2.212:80
-    }
-
-    buildpath.win {
-      tls /etc/caddy/certs/buildpath-win/tls.crt /etc/caddy/certs/buildpath-win/tls.key
-      reverse_proxy 10.1.2.212:80
-    }
@@ -1,81 +0,0 @@
-# Certificates managed by cert-manager
-# These will automatically renew before expiry
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: vhaudiquet-fr
-  namespace: caddy
-spec:
-  secretName: vhaudiquet-fr-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: vhaudiquet.fr
-  dnsNames:
-    - vhaudiquet.fr
-  duration: 2160h # 90 days
-  renewBefore: 360h # 15 days before expiry
---
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: wildcard-vhaudiquet-fr
-  namespace: caddy
-spec:
-  secretName: wildcard-vhaudiquet-fr-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: "*.vhaudiquet.fr"
-  dnsNames:
-    - "*.vhaudiquet.fr"
-  duration: 2160h # 90 days
-  renewBefore: 360h # 15 days before expiry
---
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: semery-fr
-  namespace: caddy
-spec:
-  secretName: semery-fr-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: semery.fr
-  dnsNames:
-    - semery.fr
-  duration: 2160h # 90 days
-  renewBefore: 360h # 15 days before expiry
---
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: wildcard-semery-fr
-  namespace: caddy
-spec:
-  secretName: wildcard-semery-fr-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: "*.semery.fr"
-  dnsNames:
-    - "*.semery.fr"
-  duration: 2160h # 90 days
-  renewBefore: 360h # 15 days before expiry
---
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: buildpath-win
-  namespace: caddy
-spec:
-  secretName: buildpath-win-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: buildpath.win
-  dnsNames:
-    - buildpath.win
-  duration: 2160h # 90 days
-  renewBefore: 360h # 15 days before expiry
@@ -1,15 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: caddy
-resources:
-  - namespace.yaml
-  - repository.yaml
-  - release.yaml
-  - certificates.yaml
-  - caddyfile.yaml
-secretGenerator:
-  - name: caddy-values
-    files:
-      - values.yaml=values.yaml
-configurations:
-  - kustomizeconfig.yaml
@@ -1,6 +0,0 @@
-nameReference:
- kind: Secret
-  version: v1
-  fieldSpecs:
-  - path: spec/valuesFrom/name
-    kind: HelmRelease
@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: caddy
-  labels:
-    app.kubernetes.io/name: caddy
-    app.kubernetes.io/component: edge-proxy
@@ -1,30 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: caddy
-  namespace: caddy
-spec:
-  interval: 1m
-  chart:
-    spec:
-      sourceRef:
-        kind: HelmRepository
-        name: caddy
-        namespace: caddy
-      chart: caddy
-      interval: 1m
-      version: "0.7.1"
-  valuesFrom:
-    - kind: Secret
-      name: caddy-values
-  # Patch the Service to add loadBalancerIP since the chart doesn't support it
-  postRenderers:
-    - kustomize:
-        patches:
-          - target:
-              kind: Service
-              name: caddy
-            patch: |
-              - op: add
-                path: /spec/loadBalancerIP
-                value: "10.1.2.152"
@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: caddy
-  namespace: caddy
-spec:
-  interval: 1m
-  url: https://charts.alekc.dev/
@@ -1,148 +0,0 @@
-# Caddy Edge Proxy
-replicaCount: 2
-# Listen on standard HTTP port
-listenPort: 80
-# Enable HTTPS
-https:
-    enabled: true
-    port: 443
-image:
-    repository: caddy
-    pullPolicy: IfNotPresent
-    tagSuffix: ""
-    tag: 2.11.2
-service:
-    type: LoadBalancer
-    # Cluster (not Local) so any node can forward to pods on any other node.
-    externalTrafficPolicy: Cluster
-# Disable ingress - Caddy IS the edge proxy
-ingress:
-    enabled: false
-resources:
-    requests:
-        cpu: 100m
-        memory: 128Mi
-    limits:
-        cpu: 500m
-        memory: 256Mi
-# Caddy needs root to bind to ports 80/443 and write runtime data
-# Using restrictive security context causes "operation not permitted"
-podSecurityContext: {}
-securityContext: {}
-health:
-    path: /
-    port: 9999
-# Extra volumes: TLS certificates from cert-manager + external routes ConfigMap
-volumes:
-    - name: vhaudiquet-fr-tls
-      secret:
-        secretName: ENC[AES256_GCM,data:91g6xGYke1FlteHJX17r6w4=,iv:uquY66VZIAPnFse/maIQUcdRVFXUfb/M9tFvNqdgSfE=,tag:P4/D7jpUgEhcOnoxk+QO9A==,type:str]
-        optional: ENC[AES256_GCM,data:KgTxuQ==,iv:KIxXxFGKVA07qMVYZIcBE2BnYTtLl9tFrOZE57xIHXk=,tag:lCyA/TXsxTUZSZDveQSDdg==,type:bool]
-    - name: wildcard-vhaudiquet-fr-tls
-      secret:
-        secretName: ENC[AES256_GCM,data:cZlwLn0jjz4GGX2z/w4ooeWBbyOAMZ9UHgc=,iv:Yh4wuMcyDekHzGUxCLldnAOaqLPS45YvybwhdZd5kGo=,tag:Z/jti3YF0/wdsrC9PxHVgw==,type:str]
-        optional: ENC[AES256_GCM,data:ZULOMg==,iv:qjb4nvvineVsTEp35JxPcMRDS5Ij4zIsc7PI+d6/M60=,tag:LcOjEqypcQLrBpXBrpRvOw==,type:bool]
-    # semery.fr certs from cert-manager (OVH DNS-01)
-    - name: semery-fr-tls
-      secret:
-        secretName: ENC[AES256_GCM,data:rxGGzrGRZPfzNjFIIQ==,iv:wvgWZIbAoBeJ/7/F4WeBuCHi1I4xHxwLtJZD7/SwV4Y=,tag:n8Zr+hwkD/Vm0LI/Se2TvQ==,type:str]
-        optional: ENC[AES256_GCM,data:5M+93g==,iv:KEMghZxEKvH+3vM/mtuVCIvzb2X19quX8Kd+oVJp+y4=,tag:mRqR+Fj86AWfGnvlTzRh2w==,type:bool]
-    - name: wildcard-semery-fr-tls
-      secret:
-        secretName: ENC[AES256_GCM,data:L6rjVVVtpOne6oog+Ru07ryaS2aVzg==,iv:Qg8wv1LUeaKKGzHpe2HHGR5GzJXYYog9HPJrcPhrMq4=,tag:8Z2yVeFv0mLZlQ9Yn3oRVg==,type:str]
-        optional: ENC[AES256_GCM,data:Na+sDg==,iv:3r1+mX+APihx5w5sU3/Rnyl4/ZjO8lO3jAcaBuG4B/8=,tag:WKYxuFraq8+659StfI79FA==,type:bool]
-    - name: buildpath-win-tls
-      secret:
-        secretName: ENC[AES256_GCM,data:cHgBMV3iWihTRS2h4Gu9CZY=,iv:IttOh8Ra68dwxlkT8hZ4vhg8uEwDvByjFv/pT5ae9jM=,tag:+7xH89jLUMfJB/mJzyuE3Q==,type:str]
-        optional: ENC[AES256_GCM,data:QVSy/Q==,iv:25ldKY94OaF5IMSHtCzNacsBKA3MHTOHQtGVe0fY9g4=,tag:3fl1RCkfEjF86fMsYv8W4g==,type:bool]
-    - name: routes
-      configMap:
-        name: caddy-routes
-# Extra volume mounts - each secret mounted as a directory with tls.crt/tls.key
-volumeMounts:
-    - name: vhaudiquet-fr-tls
-      mountPath: /etc/caddy/certs/vhaudiquet-fr
-      readOnly: true
-    - name: wildcard-vhaudiquet-fr-tls
-      mountPath: /etc/caddy/certs/wildcard-vhaudiquet-fr
-      readOnly: true
-    - name: semery-fr-tls
-      mountPath: /etc/caddy/certs/semery-fr
-      readOnly: true
-    - name: wildcard-semery-fr-tls
-      mountPath: /etc/caddy/certs/wildcard-semery-fr
-      readOnly: true
-    - name: buildpath-win-tls
-      mountPath: /etc/caddy/certs/buildpath-win
-      readOnly: true
-    - name: routes
-      mountPath: /etc/caddy/routes
-      readOnly: true
-# Caddy configuration
-config:
-    debug: false
-    # Global options (goes inside the global {} block)
-    global: |
-        auto_https off
-    # The main Caddyfile content - imports routes from external ConfigMap
-    # This keeps routes in a separate, easily editable file
-    caddyFile: |
-        :80 {
-            redir https://{host}{uri} permanent
-        }
-
-        import /etc/caddy/routes/Caddyfile
-affinity:
-    # Prefer non-failover nodes in normal operation
-    nodeAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-            - weight: 100
-              preference:
-                matchExpressions:
-                    - key: ENC[AES256_GCM,data:U5edeFnG3Eu+7hhCmkUZXTf1wrU=,iv:hczbYIbQAq1XSCughZdVa9ChQ7nv62elsMtrUzCVV6Y=,tag:/Uh3rsO43oSfyX4fFCEujQ==,type:str]
-                      operator: NotIn
-                      values:
-                        - "true"
-    podAntiAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-            - weight: 100
-              podAffinityTerm:
-                labelSelector:
-                    matchLabels:
-                        app.kubernetes.io/name: caddy
-                topologyKey: kubernetes.io/hostname
-tolerations:
-    # Tolerate the failover taint so caddy CAN schedule on p330 (small-node-1).
-    - key: ENC[AES256_GCM,data:wGARNk8BSuSn,iv:K1uKmlmQYv0/Y2lXP6JvIi1kbx1VwIb2m3XK1o+OHSI=,tag:PETfq6sO58vkFZmJBWJvDA==,type:str]
-      operator: Equal
-      value: ENC[AES256_GCM,data:2Z/x7/cf6CQ=,iv:yuFeoo3LvfTL2yDpCbOEb994lGao7B/mQnFKrdxEtlk=,tag:xN7t4jD6wZV8e92959BFoQ==,type:str]
-      effect: NoSchedule
-    - key: ENC[AES256_GCM,data:4mk1b0YQAmUOZ+0k7PsilvYd/oXlCjS4HT8QzfyZpUNSjla5vA==,iv:GhJGcDRX25UsKH3B8ZKPLUJOoo4+EqnzlNuBfy8ggeU=,tag:pzY8xT1m++02YD8YRPFpog==,type:str]
-      operator: Exists
-      effect: NoSchedule
-sops:
-    lastmodified: "2026-07-25T12:06:27Z"
-    mac: ENC[AES256_GCM,data:uIOoHpLdiuIOF82w84PsziKyAglkY02OrGU0sigjnhyt+6S9ryy74oiJivzxtniTevsv2PKecN0uXABKzabp+ysY7/uDix/lE0KzoUs6sYA5kVfUj1JPoDQ6bQxoi0y8zKeOqMoqHwIAs+2N2VEriqtRxn+4L3kbTrbe9CFtxIg=,iv:5ZIt9yXKJo5pF9ghi+uVs7zxsdLtQ+pTlc37FKVz2iU=,tag:sTOq1pJh0KQ06soBcmcWRA==,type:str]
-    pgp:
-        - created_at: "2026-07-25T12:06:27Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiARAAvv+DByIWPPLBdqAB39jdZPkrWzVN/7TJ3DU8q380NNMI
-            2w2I28Ee3iXl4e/Qj66fx8U8NGwdYo/j+mUjIddBjiJB5xzu97k+nT4toDocutGT
-            bOI4KZP/J7vh+spb6TMJvH39IGLOYH6N2NagRD6r15kd37ddoRbV8OFTZXvXf524
-            d3+PbqQz9FoulLy+Yt8tWWXD1MpqRbIHL65dAhLF0vZRxUVcnRmg77ZX2Q1yD7Wq
-            i8c0Pe1dhqg6ig+njshiC7HkWOQoINYzk012hz+Cid5JZAIyxsqxkdoFUWHeWI0h
-            u3XUpjjxj+eg0YlnAqrnK16B6+pscZWjEgHJEmrGQo8AGFMdALoubv+8nGiywNZP
-            tqM9oT1ePa0pIJNzhNgFWGkwwuyH4jPXrRji9fpLASAihsM1WQIh3smd373C0Z/W
-            sQYFTS9B6FUCCdDPA/St0Rd/RHFW+eJPC6Jh4728Pqa67FjnuIVB5VJ33Dgpl8OE
-            kEyY3WvtoYOaw+6VqWetg79sCruibmlenDWSrT8VQ8ksk/YIj+iicPnI/BY5S2Wz
-            j2s1Lpvvhr/gZvF7z+vfhX1Fn28xIg5/gkcoYSKgFhqxG69IlPbZsr/D2oWyeygd
-            tIp/D1yHGFJ1Cb56qr400t9xF5BD605rf/Aczg8mdvI41jGvmECQrSKHsxI25xLS
-            XgEVhCAm6HDAKEhjnm1wAZG8DJRhcrSLqLq7SPKJaTPJpjeQwXOb6OIs9ugQx9ON
-            w96InR1VMsEUlh1EWBXUqBgQgyDIIEAa+wHBnY7U06fkazN6lcLkAp17yTitTEk=
-            =gULt
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
-    version: 3.10.2
@@ -1,44 +0,0 @@
-# Let's Encrypt ClusterIssuer
-# Supports multiple DNS providers via DNS-01 challenge
-
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: letsencrypt-production
-spec:
-  acme:
-    server: https://acme-v02.api.letsencrypt.org/directory
-    email: vhaudiquet343@hotmail.fr
-    privateKeySecretRef:
-      name: letsencrypt-production-account-key
-    solvers:
-      # Cloudflare solver for vhaudiquet.fr and buildpath.win
-      - dns01:
-          cloudflare:
-            apiTokenSecretRef:
-              name: cloudflare-api-token
-              key: api-token
-        selector:
-          dnsZones:
-            - vhaudiquet.fr
-            - buildpath.win
-      # OVH solver for semery.fr (via cert-manager-webhook-ovh)
-      - dns01:
-          webhook:
-            groupName: acme.aureq.com
-            solverName: ovh
-            config:
-              endpoint: ovh-eu
-              authenticationMethod: application
-              applicationKeyRef:
-                name: ovh-credentials
-                key: applicationKey
-              applicationSecretRef:
-                name: ovh-credentials
-                key: applicationSecret
-              applicationConsumerKeyRef:
-                name: ovh-credentials
-                key: consumerKey
-        selector:
-          dnsZones:
-            - semery.fr
@@ -1,7 +0,0 @@
-# ClusterIssuer resources for cert-manager
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-resources:
-  - clusterissuer.yaml
-  - ovh-credentials-secret.yaml
-  - ovh-secret-reader-rbac.yaml
@@ -1,50 +0,0 @@
-# OVH API Credentials for DNS-01 Challenges
-#
-# OVH API credentials with the following permissions:
-#   - GET, POST, PUT, DELETE on /domain/zone/*
-#
-# The secret MUST live in the cert-manager-webhook-ovh namespace (cert-manager),
-# because for a ClusterIssuer cert-manager sets the webhook's ResourceNamespace
-# to the webhook's own namespace, and the webhook looks up credential secrets
-# there (see ch.ResourceNamespace in the webhook's ovhClient() function).
-#
-# SOPS will encrypt the stringData fields on pre-commit.
-apiVersion: v1
-kind: Secret
-metadata:
-    name: ovh-credentials
-    namespace: cert-manager
-    labels:
-        app.kubernetes.io/name: cert-manager-webhook-ovh
-        app.kubernetes.io/component: ovh-credentials
-type: Opaque
-stringData:
-    applicationKey: ENC[AES256_GCM,data:0+y+m8n/eup5lY/vGW5ASQ==,iv:VSIhfNAvSNOLq92TVcaW54ygU1wgAv+u35HZ0cbP6UU=,tag:KD+cyIesTQgqEzGMro8xyA==,type:str]
-    applicationSecret: ENC[AES256_GCM,data:sP0febHRFF/atAFlRM6sYXoM+Lp6Rnf7d0IQKcsa0vY=,iv:nHYMHSsOclkZmQJSjcz2oXMHsDTct5hTmJz1L7xgvpA=,tag:oCGoRP7R0W+PTNRCeLFvyg==,type:str]
-    consumerKey: ENC[AES256_GCM,data:vw/Q39CpSc5o1ntPDMT3844aLbTHQrSYH8RhoZFFZrQ=,iv:6B0F9Zq56inpW7AS8okbpqJkRK3WkBjX6sIqclOP9Hs=,tag:nnbgwBMBM4JZg/IEYzRvVw==,type:str]
-sops:
-    lastmodified: "2026-07-10T05:06:52Z"
-    mac: ENC[AES256_GCM,data:0/VEDE1ZuIyzkaleosS/KHYX44762TbScrJGJylwV21d7U6YgpwRMOXvU9xn3rHsDXnh5IAmAtrXQTYJFN1vcF1DNw5O9+TQKVoO6B5rsel/YyKRU4s7aYcfDgbW9dO1wn33K65KFtM+0Qv187DzEn1by449TgWIWP/M5U40PE4=,iv:hIGzMwsas8VxC4941ABeoocYWSlVSz9KW7a5tTAoRXI=,tag:n/EJEkEBL20carqVesMBsw==,type:str]
-    pgp:
-        - created_at: "2026-07-10T05:06:52Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiARAAu0va03SPYOU23iUjoTMiXJ6+nMhIX8lsurvmCvi+wIqk
-            c7qu0lTfXv62IjkY6fIKtOE7TN9TiipjzXG2QJaK94QeiFpe9M90qNo09qEIje9m
-            DepTrLfyINFT0SY2eihl+nXhBXuEDSiD5K60OsXGPN92hJMwCad5jJuB7xpmrX0m
-            X0A1Bl9orce/do/YJoy5hq0persB/VSeCKlptNzqpmpRIA3J6AdCDKXQOMqAymXN
-            FXAxbjEQNcXhfU12Y/cVpa1hS7ap5OJCnWOPkFEA8y1ESVnPpryuTIfVlFUhW3/Z
-            Dhpb9OXKdi2IVYdbaY8+3UfSsXxTVOge7jCMbJq3aa7ZvGt5fTjXG4zc9A6RqSGh
-            ASOPSkRRSZB0d97NhUQJGgfcaWFvsfkaTAUVB2Ip/+Udnt/tGIE99RGJizxSVO9N
-            2aVJIukqng8aNPfth8mgWYJpCETMb4piLmVg2ptDqelCqXlUAskxWzMWtAhyzOgw
-            lZ2dcAn7aj9YtLaKAW9rjV8EqHEqQg0ychRNMeyRiN/CnNJp6Q2wl1/EyQUpzb0a
-            1I/ifFAW8FbWTVIbZv6njkl1XNaoav54qEn1qSABcljM0h1Ulb9WKMJiXH4368jf
-            Yhl38JDAn5NZBEzxpuaih1XK5yVri0/1ascpuMvfOxLKniUR9tla8+WEL97+aejS
-            XgGsrH+/uzRVSAT+44rExi43MWCAwNRUaVrX8UiGjA/z8qPVdwBVih4CMKgfQ8VW
-            1KewStOY217BXuVrDbvHEAkuOotEP0Jnan0epoWs47DSasNgzAcWrBgom0l/avI=
-            =Gdou
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(data|stringData|.*.key|.*.crt)$
-    version: 3.10.2
@@ -1,41 +0,0 @@
-# RBAC granting the cert-manager-webhook-ovh service account read access to the
-# OVH credentials secret.
-#
-# The cert-manager-webhook-ovh chart only auto-creates this secret-reader Role
-# when using its built-in `issuers[]` mechanism. Since we manage the
-# ClusterIssuer and the credentials secret manually, we declare the RBAC here.
-#
-# The webhook runs in the cert-manager namespace under the
-# `cert-manager-webhook-ovh` service account (created by the Helm release).
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-    name: cert-manager-webhook-ovh:ovh-secret-reader
-    namespace: cert-manager
-    labels:
-        app.kubernetes.io/name: cert-manager-webhook-ovh
-        app.kubernetes.io/component: ovh-secret-reader
-rules:
-    - apiGroups: [""]
-      resources: ["secrets"]
-      verbs: ["get", "watch"]
-      resourceNames:
-          - ovh-credentials
---
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-    name: cert-manager-webhook-ovh:ovh-secret-reader
-    namespace: cert-manager
-    labels:
-        app.kubernetes.io/name: cert-manager-webhook-ovh
-        app.kubernetes.io/component: ovh-secret-reader
-roleRef:
-    apiGroup: rbac.authorization.k8s.io
-    kind: Role
-    name: cert-manager-webhook-ovh:ovh-secret-reader
-subjects:
-    - apiGroup: ""
-      kind: ServiceAccount
-      name: cert-manager-webhook-ovh
-      namespace: cert-manager
@@ -1,12 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: cert-manager
-resources:
-  - repository.yaml
-  - release.yaml
-secretGenerator:
-  - name: cert-manager-webhook-ovh-values
-    files:
-      - values.yaml=values.yaml
-configurations:
-  - kustomizeconfig.yaml
@@ -1,11 +0,0 @@
-nameReference:
-  - kind: HelmRepository
-    version: v1
-    fieldSpecs:
-      - path: spec/chart/spec/sourceRef/name
-        kind: HelmRelease
-  - kind: Secret
-    version: v1
-    fieldSpecs:
-      - path: spec/valuesFrom/name
-        kind: HelmRelease
@@ -1,19 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: cert-manager-webhook-ovh
-  namespace: cert-manager
-spec:
-  interval: 1m
-  chart:
-    spec:
-      sourceRef:
-        kind: HelmRepository
-        name: cert-manager-webhook-ovh
-        namespace: cert-manager
-      chart: cert-manager-webhook-ovh
-      version: "v0.9.13"
-      interval: 1m
-  valuesFrom:
-    - kind: Secret
-      name: cert-manager-webhook-ovh-values
@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: cert-manager-webhook-ovh
-  namespace: cert-manager
-spec:
-  interval: 1m
-  url: https://aureq.github.io/cert-manager-webhook-ovh
@@ -1,45 +0,0 @@
-# cert-manager-webhook-ovh Values
-# groupName must match the ClusterIssuer webhook stanza
-groupName: acme.aureq.com
-# cert-manager deployment configuration for RBAC
-# The webhook creates ClusterRole/RoleBinding so cert-manager's
-# service account can create the "ovh" ChallengePayload resources
-certManager:
-    namespace: cert-manager
-    serviceAccountName: cert-manager
-# Pod configuration
-pod:
-    replicas: 1
-    resources:
-        requests:
-            cpu: 10m
-            memory: 32Mi
-        limits:
-            cpu: 100m
-            memory: 128Mi
-sops:
-    lastmodified: "2026-07-09T22:31:08Z"
-    mac: ENC[AES256_GCM,data:QjrNj355tJVZRsYQdkM73Ld7X8EvMM7O/1vF3QnTYJ9vWbh78irLocbtnyBeaR9o3g0mxO6Ugjlukj+S0HhIX/WS1XHEfs/3n3rE0zS/fxGJ0D3Alam/n/WPOsYHUiCBD86JtU83AjgncISY4yp/VheV3kRgSdl+ye4AGAjhq7A=,iv:p8yqNCcskTfDfEGbM5Qyb60C4pFv4BOuLpEApEzHLFY=,tag:KntExeQwJbBREaz2nY+1uQ==,type:str]
-    pgp:
-        - created_at: "2026-07-09T22:31:08Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ/8Dn4nEIbQXuETxE6RUBkNTO/eN5pHh47lqSwBBbYDSi8C
-            8rcJmdq8P+v00geLdMlM35OcjHFb9UCVeHFsAEYt6Q2jL4QNa2aOEDOqGnhKP+zx
-            KKtW2Ngx76Ow9N2C5JN9DXk9n+PC/qWdPLNJY+GiW/KbPmVxAulJpmYlJHfs1EOh
-            0mSRSS+7sgGLHWmgU362zC508lkKxh8HKxmq1+1lf+fWIe8N7Sl0fx55kq168hae
-            NcdogRpoVT555hRils7eqzj0C/KTVOi7CR4pS7VJyiNy2fu2OASmmcM6UEqCyJfV
-            NTUdMpnjb05UwfbuUnIg6j/FoqS49ufGxKPrM9t7JrFSuyGqduF7P/ifv5zwMuIZ
-            SNeR/X8xUksK6R4/uTmUx5sgF+Jv7tCRvcp+DhsDe1mMmO8czXC5Mt3cR+uwYoms
-            hN+9/oYEZr13qn5Ek0dy9NESkZIzYPCXYXZrx8GLqaHCJEQbpIZCAN+llOyQaQzU
-            jcvPAYbTewBw4ewKUS0KcvLd1pfzvYyvtzwHuMIVJwrf7x5bzhzxAgVOGkEVlVq/
-            7pGO9TYXGl3kD7tf25oCGzAerVC+EVcL11sq4zawvL4PovEZFP9mzhR7EfY3t/3C
-            vGVu6vPmCJOwdis9+Kdr3PKubnMqWGn5KCCX1x13qhsHc239N7cVKkyx3dTBaArS
-            XAG6KxKe/cQicIVC8/N1Cna9uQnTF5ZnFVfJNW1nkYyF1E+ofW6kKDr3ITotKLDP
-            hXXPT+vsB2fL3faBG4xb6owrMuQ1S0DmB3mqjSCXtpS7q0FDg22Tq9BtaEni
-            =x1th
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
-    version: 3.10.2
@@ -1,47 +0,0 @@
-# Cloudflare API Token for DNS-01 Challenges
-#
-# A Cloudflare API token with the following permissions:
-#   - Zone > DNS > Edit
-#   - Zone > Zone > Read
-#
-# Base64-encoded:
-#   echo -n "api-token" | base64
-#
-# This file will be SOPS-encrypted on pre-commit
-apiVersion: v1
-kind: Secret
-metadata:
-    name: cloudflare-api-token
-    namespace: cert-manager
-    labels:
-        app.kubernetes.io/name: cert-manager
-        app.kubernetes.io/component: cloudflare-api-token
-type: Opaque
-data:
-    api-token: ENC[AES256_GCM,data:QZEgQdatWsC/vpboMlPDPyY5nVK/bKkBZ9Mjtt4VOfao8uN5zi0Bdu/OPtLKQarKGTR2srMmiRuuH1BGQunBwXAb4beDIT41,iv:sHoJ86a9qNsyIJ83YgPGWerxcvp3okbXE3pX+OYTbwk=,tag:lV8OWepMdI4foSlwXnb5Ng==,type:str]
-sops:
-    lastmodified: "2026-06-16T10:24:36Z"
-    mac: ENC[AES256_GCM,data:vDjNGtGfQgNBJKxIYloBd/eAkx6U+Xh/4laJ31qyAyy8/2R+0NTL/2g6yc6vqf7m47qflfSOYmU4kC7IpNlUbl/WHznaWJky8d/MU2zCmcsqmt44XOf1ppD7wkoiIyTjVh+QDNFLmmg9SDquVDvmMYYGAUypCY/Rh9QAVp/Cwtk=,iv:EMS6tgMml6bMGO3qoPkf71ROjeu/WXR1fLTki/672xw=,tag:jP89nlDi8wNV9f0DJQZljA==,type:str]
-    pgp:
-        - created_at: "2026-06-16T10:24:36Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiARAAgJ19fZrQeD25vjz9wWx+3MYjWj2vq4HWGJ9nG06zc/Rl
-            PeR/LbdMSowAyjvTAdnsqaFnofpz9P7fGbzbIPFiulcsoqC2UQtBO833XWc8RoyY
-            7nP/+fc0UyriIudoblgHV+aEoHuSuJGn7y3lAZWx4fj98Rat1Ip7/gyfN8SgmYM0
-            dS68s2WdXMtV3w6vFcSr/HpQFdwFAvzB4+cEjwJo35axIWKAp4wzLlckv+MG7lLS
-            dqZzYeGjaUyJuIc3GxBNw8ixTcEvIKdxGcRPVCCH2KLphCd+sL2b3qRUHfJXPmNb
-            8Eq3iiLTbh3DZ+MB4UCkVHCNf9wwVERdpjvv1hBBGxckfmgqqB9Jo1MpuQNHJdXY
-            gLATxuR6FSwuNNw4FslBSW0TkjMHhsP1Skfl/R4usTCsIPkN+ogC0QPCwAyH6Jir
-            RoQQLRGnCKgFhSgRyAO+fEOcxHeJIcphcF4RtUDU1rtYIaCRRxjTJrSx9Niz02Sc
-            hC2BsG0gvCMYxC7hV6EE+4Ck/93AD+4ah5nsZBQ0R9OY75RnnHs9qbZDTjnI71OO
-            G6bTLE1rE5KZfvN9tUKfZ8edeUDQEgY4u5IeXZgXtTEE/DqkkKnIg5nNzCs9saWU
-            8/+irtiX3GiXbZsXrsRR37jXzpQu+QoEDydDIZdgEg3P/97R40db6yjh/tmh0pjS
-            XgEZOOAjGdL742K8kMfG4JhFfRw506JH6LLE080VX8yqU3IHQTovILwXtgzcNTyj
-            EF+FIAvT8RR+g0VtbSMPLwCiBFeknxxvKBNmhyzvov7dFnp0zE27/VHN0ZGY6to=
-            =YUJS
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(data|stringData|.*.key|.*.crt)$
-    version: 3.10.2
@@ -1,14 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: cert-manager
-resources:
-  - namespace.yaml
-  - repository.yaml
-  - release.yaml
-  - cloudflare-api-token-secret.yaml
-secretGenerator:
-  - name: cert-manager-values
-    files:
-      - values.yaml=values.yaml
-configurations:
-  - kustomizeconfig.yaml
@@ -1,11 +0,0 @@
-nameReference:
-  - kind: HelmRepository
-    version: v1
-    fieldSpecs:
-      - path: spec/chart/spec/sourceRef/name
-        kind: HelmRelease
-  - kind: Secret
-    version: v1
-    fieldSpecs:
-      - path: spec/valuesFrom/name
-        kind: HelmRelease
@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: cert-manager
-  labels:
-    app.kubernetes.io/name: cert-manager
@@ -1,19 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: cert-manager
-  namespace: cert-manager
-spec:
-  interval: 1m
-  chart:
-    spec:
-      sourceRef:
-        kind: HelmRepository
-        name: cert-manager
-        namespace: cert-manager
-      chart: cert-manager
-      version: "v1.20.2"
-      interval: 1m
-  valuesFrom:
-    - kind: Secret
-      name: cert-manager-values
@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: cert-manager
-  namespace: cert-manager
-spec:
-  interval: 1h
-  url: https://charts.jetstack.io
@@ -1,91 +0,0 @@
-# Cert-Manager Values
-# Install CRDs as part of the Helm release
-crds:
-    enabled: true
-    keep: true
-# Enable DNS01 challenge providers
-extraArgs:
-    - ENC[AES256_GCM,data:RcKzGzDSFXAw32vBKyvMTzMx5u0AmXKpXEY9/YRxUI0SNVy68/uUSpFhdmcB0RvmzG7y,iv:AraIcgoVYO1IVAmN3dd6pXr3v2BXaizbK8HefwsDRqE=,tag:QlOBuyxbddyk++nYLhMl6Q==,type:str]
-# Resource settings
-resources:
-    requests:
-        cpu: 10m
-        memory: 32Mi
-    limits:
-        cpu: 100m
-        memory: 128Mi
-# Tolerate failover nodes
-tolerations:
-    - key: ENC[AES256_GCM,data:WXIPFO1nBe+6,iv:t8RP3KL6niOVe84Qqu9+JKp2qNR87qnMzJOh7pUsudg=,tag:uT7gWSdOz86PPi2NZIxZeA==,type:str]
-      operator: Equal
-      value: ENC[AES256_GCM,data:N1IHrGvrobA=,iv:QiKeIiSBFThw05b5gkU41koci4CDZ0ZxdLX1r1DD7Dc=,tag:QGWcNIYqUdEy0f0bEYC91Q==,type:str]
-      effect: NoSchedule
-    - key: ENC[AES256_GCM,data:QMtUDj9EDXWbsUBLlQJ5yFEsQ3fksIRUqIk7tKyts1aHqNQ56A==,iv:GVEl1AcWNLAqdXqyJTMoYBPRqqvhSHGBN7fuMLWtjoY=,tag:bmCK8yCiVCXci2JJFvw/GA==,type:str]
-      operator: Exists
-      effect: NoSchedule
-webhook:
-    resources:
-        requests:
-            cpu: 10m
-            memory: 32Mi
-        limits:
-            cpu: 100m
-            memory: 128Mi
-    tolerations:
-        - key: ENC[AES256_GCM,data:QZjbo0u9rqht,iv:H3mZnC4a2abmOiW0RhoFAiAvVfaRFpGU2+XKYy8uBUQ=,tag:xwp+rkiYrSo1q+CsLdup7Q==,type:str]
-          operator: Equal
-          value: ENC[AES256_GCM,data:UsVMCFtyl0c=,iv:ImpKIQtC1jX2NLNTSDhq4a9nq3I2HlpSr7QLUOw5gd0=,tag:xM/vf2MhasBNWbLqxkUrQg==,type:str]
-          effect: NoSchedule
-        - key: ENC[AES256_GCM,data:31pC3NOA0AH2d0V/N10xX1U8E1OD4YL/27+xFLxElfYb1xWSDA==,iv:aaaci0Eu3Mb9og3Za0beB9js3wSjcNE7BOS5iAko3aU=,tag:h40mrm+gPTf9jCP7ax1ihQ==,type:str]
-          operator: Exists
-          effect: NoSchedule
-cainjector:
-    resources:
-        requests:
-            cpu: 10m
-            memory: 32Mi
-        limits:
-            cpu: 100m
-            memory: 128Mi
-    tolerations:
-        - key: ENC[AES256_GCM,data:rqZTE8j9xDAy,iv:EvztWg01VbvJhdhkrVz7M0mA0EUhVW2Ty/de0D3pgmw=,tag:rGUZky1bUhewhKDp3Vo8Eg==,type:str]
-          operator: Equal
-          value: ENC[AES256_GCM,data:fPt+n+ftbGI=,iv:xHy9IUIBgkHDQcVZ4MyA3tXPvMAy14gHhkxe2AYthR0=,tag:szam+dyODZSjfX6oxsFdSg==,type:str]
-          effect: NoSchedule
-        - key: ENC[AES256_GCM,data:As98cp+6SvVwxRtdxx7TT+HGzejgWiacf0TYm2JU9kPqEA7ljA==,iv:dd+TS9T57NrpgyZjYgPi/aCiInfnVxh3VbO7gddkw8k=,tag:KQMA0Kn0YgE/HpAJk83pTw==,type:str]
-          operator: Exists
-          effect: NoSchedule
-startupapicheck:
-    resources:
-        requests:
-            cpu: 10m
-            memory: 32Mi
-        limits:
-            cpu: 100m
-            memory: 128Mi
-sops:
-    lastmodified: "2026-07-25T08:12:52Z"
-    mac: ENC[AES256_GCM,data:yFXZxbhJi5PPVXl4j73FfOO5hurvD7ZXgWr5eZS8poE7IEg6IgZKBjwq1ITMUP5DyS6K2onR/mgZVzgj5X5I7hEwj13DAPW7wWthZql+De7oGxe5Nv74fDFEwCoqh2sTbdrQS2KyPY+rrb0ZMZD5qpdZzyw1AVGzVKeJJj9DdBY=,iv:SW7sb6mmJulekZn1Eh2pfYml1PwJ5v6z/PBdV3TL29A=,tag:5HzpRnH2G8J//J2fZhrxrQ==,type:str]
-    pgp:
-        - created_at: "2026-07-25T08:12:52Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiARAArV5QxST5xu2jG+X9Fo6F4o3uxMS/Kw56ey1MMTfgkTlM
-            HdV1n6lityMGXB278GiYhmZYRdZl0kAT+Dj9Y0RdaiI8BszocD7IbBKmE1tVseCr
-            Xa4y7nWE58xz2Ca26KVf/I64QPHsKKus4wECGOgZrh7Hzb+KdeTJBpuMMIgnJe3l
-            1C6VdfTgNlYPW+zAmX3i39ZwYO7wcz5UZ1aXozAtoOjWyjdcArEdoCH9iD2GXTOe
-            0EsvgdUD1U2n4ffy+Z8mga6V8URkJQ86XTuFD6PhFF1bhBwa36MCUXAdlD9ONB6d
-            jaKSAPAeia4C+0vCXTv9OYEHizSe11iwsUyPq+bmMrYCUslaiOCC+QfGtJEcCJj/
-            ZeAjXMoyi5Fnmwj+y5ED+O1DKp/sDyUdvix83L1UWVfTrgNVfXFCGzHJUkcZhfUk
-            Ye9KcbH+7+mj3p/lAgbQjBjVemnW6GFzGJYcL/rWwRBxw2ElLxKPnR9NQK9VY5w/
-            wCmWzG4Cjr2gfLlR05A72/i68fRM9eAy4CFL5y4xTN1eYe+MCz2ZedZDd3uYTKUC
-            TMPGXfjhy64W/cV8MWa/aYCyNguVlKbmUl7kZwb+8DAxrSyPqQal11DJtcsv3zFO
-            BUf8GQFn4jXXYqd1LojLM7bUjAkXWZUIUbg1+jWfPGsgsTGn4R0tshtY9JOfQpfS
-            XAGL6+0+DQf8wY7yzbds4DSDMNTlOH7iWoX77okayY3L5Jqc3jB0glMJbRwdmgnj
-            d5JzAoqDhi1F+MQdTYGu7RQpawKr6ndWqwkT5ef5BQ86TQq3/+jZ5uuC3qnE
-            =uS2O
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
-    version: 3.10.2
@@ -11,7 +11,7 @@ spec:
  sourceRef:
    kind: GitRepository
    name: homeprod
-  path: ./kubernetes/system/cert-manager-issuer
+  path: ./kubernetes/infrastructure/cert-manager-issuer
  dependsOn:
    - name: cert-manager
    - name: cert-manager-webhook-ovh
@@ -11,7 +11,7 @@ spec:
  sourceRef:
    kind: GitRepository
    name: homeprod
-  path: ./kubernetes/system/cert-manager-webhook-ovh
+  path: ./kubernetes/infrastructure/cert-manager-webhook-ovh
  dependsOn:
    - name: cert-manager
  decryption:
@@ -12,7 +12,7 @@ spec:
  sourceRef:
    kind: GitRepository
    name: homeprod
-  path: ./kubernetes/system/cert-manager
+  path: ./kubernetes/infrastructure/cert-manager
  decryption:
    provider: sops
    secretRef:
@@ -1,13 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: traefik
-resources:
-  - namespace.yaml
-  - repository.yaml
-  - release.yaml
-secretGenerator:
-  - name: traefik-values
-    files:
-      - values.yaml=values.yaml
-configurations:
-  - kustomizeconfig.yaml
@@ -1,6 +0,0 @@
-nameReference:
- kind: Secret
-  version: v1
-  fieldSpecs:
-  - path: spec/valuesFrom/name
-    kind: HelmRelease
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: traefik
@@ -1,18 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: traefik
-  namespace: traefik
-spec:
-  interval: 1m
-  chart:
-    spec:
-      sourceRef:
-        kind: HelmRepository
-        name: traefik
-        namespace: traefik
-      chart: traefik
-      interval: 1m
-  valuesFrom:
-    - kind: Secret
-      name: traefik-values
@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: traefik
-  namespace: traefik
-spec:
-  interval: 1m
-  url: https://traefik.github.io/charts
@@ -1,59 +0,0 @@
-ingressClass:
-    enabled: true
-    isDefaultClass: true
-ports:
-    web:
-        forwardedHeaders:
-            trustedIPs:
-                - 127.0.0.1/32
-                # nginx-proxy
-                - 10.1.2.11/32
-                # caddy
-                - 10.1.2.152/32
-                - 10.0.0.0/8
-# Tolerate failover node
-tolerations:
-    - key: ENC[AES256_GCM,data:730ZJScF+2rP,iv:n1QgsKA3w6rv1d2tQddG8FkmADp6tI1gj+p7FnD1uA8=,tag:wtlI+476AdFHSp8I68Qs4Q==,type:str]
-      operator: Equal
-      value: ENC[AES256_GCM,data:uSBDyP1NASA=,iv:wFwuuUWxQKqmb8HMVvbBmMEwuWfxrCVE+soDvM0co6s=,tag:1OZ1KaTKMfMhSZhA1+/zXg==,type:str]
-      effect: NoSchedule
-    - key: ENC[AES256_GCM,data:eWiYi/AytLLefqvh2WeoC557WVtWH7c5wYFZYHH0oaIPHd/UyQ==,iv:zreUmSRjGCYywVO1w7+axPmt1E6WON9k63EWhzN6L5c=,tag:zS/rA1dTwp8QMzdi8g8uLg==,type:str]
-      operator: Exists
-      effect: NoSchedule
-# Prefer non-failover nodes in normal operation
-affinity:
-    nodeAffinity:
-        preferredDuringSchedulingIgnoredDuringExecution:
-            - weight: 100
-              preference:
-                matchExpressions:
-                    - key: ENC[AES256_GCM,data:1eMq19wPgLa5uYzYlrrN783Ps5U=,iv:WU2PcuCN9YsT3k86TN9347iErqH7s5JiOKlPfiBK2oU=,tag:BWEdA34tVe8FYUjaztPTqw==,type:str]
-                      operator: NotIn
-                      values:
-                        - "true"
-sops:
-    lastmodified: "2026-07-25T08:22:16Z"
-    mac: ENC[AES256_GCM,data:3L2sGcpCY1DbFib+13cTJ382EB3DgDJyT5nrE6Pz2gJEqDoF867vDYFvl7qxmT0VXaX6a9g/Q0j97EBbq+oiko0t+sYU0dCRRvcnmgbZaY6TA6WhwMzB6STqZW0XhUc6o5mgvIh7YCgCpPl1yFI4Oeffkrd7EQnx66FPxZYtNzg=,iv:PBZSXeYx8ywDR3wsahldquUfUDTNgC+znYdVcV9SDuw=,tag:d48/XYEaIC5I6cZXCRW/kg==,type:str]
-    pgp:
-        - created_at: "2026-07-25T08:22:16Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiARAAxFUgi7EmKbvClLsuCBT3H40QeXdnEoTYmpVJHhoUp9ex
-            vw8K49rg1UueJ7E3jenOhsFw7XiuH3JfCu/CjRW4kMdhBm9G7vGQLdoUub0gvW6Q
-            OgJLJcpoYaIkTowZLHxyQOVYv23FFHCfoEWHUEidHnDswy6ngtljS9U3aQFq67oR
-            REbqMcaotkAUg921ZA60BrctJFvm5DKt33LbgrI6NQ7ku4cDHnRsJLxW0X5F0srl
-            vuHfez7wTk/az7H07aPGlNcBc3MiXmpC9EpRj3ZCgi8RsWm58MFO4ErNAF1DGd1A
-            flfpDRyoDxichpKGnNs1vrWOI3ceXj5241HsQne7dqBPO2sn0QhY0tN9imjKteab
-            bn3C3QSh/jePSJYoBE1tIr0b3+7NIUKeEHBZuS250KL3nZGAGHmYRGZubvrLag9u
-            pnEWZw1yGI2glR/aXFgOk4eHqGfNkBSCQTN/7vErYe1FmUbsaiiJBLpzmNDPrWGy
-            d77Zv/GVCQ5Tod0sD714IyEj5j2ZH9nBGXW60VY/indmMoFpWlUzvii5x3g8Ig6G
-            R0cG20g/x/Q2IgEQuisVfZBq28hJ9SDQNequ+XjARWeO4Bg6VbQvYSiPMamEd1U4
-            IBBWy+Q/MWMaMXN/igfEptvC89ttqK4ckPjgiN8dQyG97jy+xs0kll7JGvydyK/S
-            XAGFitVH3lGXSmsDfijXKVP9/dUixM4Z38lxOwlb6cUyyREH6rRjWyqJcM9tTUVo
-            ArLybrpWYkZ/eVWi2/EXQ7I9nWLoivzrilf80Gh4VPBesuisZdATZUwUY0EG
-            =L8ob
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
-    version: 3.10.2