diff --git a/dns/production/saggar.dev.yaml b/dns/production/saggar.dev.yaml index 264b34e..609edeb 100644 --- a/dns/production/saggar.dev.yaml +++ b/dns/production/saggar.dev.yaml @@ -11,3 +11,7 @@ docs: ttl: 600 type: A value: 82.64.154.58 +get: + ttl: 600 + type: A + value: 82.64.154.58 diff --git a/kubernetes/infrastructure/caddy-certificates/certificates.yaml b/kubernetes/infrastructure/caddy-certificates/certificates.yaml index ecff4c9..f8247f4 100644 --- a/kubernetes/infrastructure/caddy-certificates/certificates.yaml +++ b/kubernetes/infrastructure/caddy-certificates/certificates.yaml @@ -127,3 +127,19 @@ spec: - docs.saggar.dev duration: 2160h # 90 days renewBefore: 360h # 15 days before expiry +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: get-saggar-dev + namespace: caddy +spec: + secretName: get-saggar-dev-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: get.saggar.dev + dnsNames: + - get.saggar.dev + duration: 2160h # 90 days + renewBefore: 360h # 15 days before expiry diff --git a/kubernetes/infrastructure/caddy/caddyfile.yaml b/kubernetes/infrastructure/caddy/caddyfile.yaml index 73decaa..d067d46 100644 --- a/kubernetes/infrastructure/caddy/caddyfile.yaml +++ b/kubernetes/infrastructure/caddy/caddyfile.yaml @@ -122,3 +122,8 @@ data: tls /etc/caddy/certs/docs-saggar-dev/tls.crt /etc/caddy/certs/docs-saggar-dev/tls.key reverse_proxy traefik.traefik.svc.cluster.local.:80 } + + get.saggar.dev { + tls /etc/caddy/certs/get-saggar-dev/tls.crt /etc/caddy/certs/get-saggar-dev/tls.key + reverse_proxy traefik.traefik.svc.cluster.local.:80 + } diff --git a/kubernetes/infrastructure/caddy/values.yaml b/kubernetes/infrastructure/caddy/values.yaml index 548a20e..755de7a 100644 --- a/kubernetes/infrastructure/caddy/values.yaml +++ b/kubernetes/infrastructure/caddy/values.yaml @@ -36,39 +36,44 @@ health: volumes: - name: vhaudiquet-fr-tls secret: - secretName: ENC[AES256_GCM,data:0Gno0HzWCXBsKXu7HrFFpuk=,iv:Ygz3WDWijXzF6U1OEqGu3F7fkBsa7Q77dyURlgpww98=,tag:R1TH/CfTQXrC8INNWPTEBQ==,type:str] - optional: ENC[AES256_GCM,data:lKaUaQ==,iv:ZD07ALdJ9QvLJZJvEANiHS+W9iusenyWsK4vO41fVqg=,tag:+5zgK51gMTwyCf+NuvdGOg==,type:bool] + secretName: ENC[AES256_GCM,data:16xnpbPT5Q3QPhiOVW09rO4=,iv:rITfPR/pb9otdRXURijM9l4eOyjAm/LpMCVzDI1HdiQ=,tag:XTt5U79sfX4F7gL3pdfCIQ==,type:str] + optional: ENC[AES256_GCM,data:ghlFPw==,iv:nZ6HKGVI7z0R7ZDnxdKCFdAtPrUCYTPc6C3ahLhi05o=,tag:zKbUifBUjU2haTMIldoKhA==,type:bool] - name: wildcard-vhaudiquet-fr-tls secret: - secretName: ENC[AES256_GCM,data:OgYNRxtElsKPLTxcHPAc8q1F8WsN+tdeo8A=,iv:3iflBURWgaOqa0fHp3J/ouxEyJD2AleHvANpumRSUFs=,tag:+WCVNo6P079P5WNmLRIsDQ==,type:str] - optional: ENC[AES256_GCM,data:uMCq9Q==,iv:rgEKryNgTq6m3VYYfImzQex7Fs5R+WIrMMX7+6zRJTo=,tag:ZtK824N7JkyQECslAsELUw==,type:bool] + secretName: ENC[AES256_GCM,data:HFV3Bw6giG42LsVv7NHQCNbsk0ewFftMuNE=,iv:lhlMGwLwaKTjXwqErw/bsSG6zRuc9lfwwF9Ru/WiFG0=,tag:gU4IW396EUuiZUdRIz5neA==,type:str] + optional: ENC[AES256_GCM,data:NSoRKQ==,iv:0xYJ3X2fajkm+KuXLB67nzKJtlszZz/iLlpPBkPgsGc=,tag:pQ0P4pak230kfNvxILH7Hg==,type:bool] # semery.fr certs from cert-manager (OVH DNS-01) - name: semery-fr-tls secret: - secretName: ENC[AES256_GCM,data:BpYXgcOGKCfCkyWOPg==,iv:xEjs7L+74fCv2Lqh3gHL8Q5m64d9XkrO7QQjn1eNAdQ=,tag:M5TI2aFCl5Q+IFJv3fkczA==,type:str] - optional: ENC[AES256_GCM,data:6fbebg==,iv:aht7EEppRwKTYBnO4L/4VAlN2euvAVLPLuq7ekKWm0s=,tag:lHsPWL26QWbzAc32u9FYvw==,type:bool] + secretName: ENC[AES256_GCM,data:J7uLCquEggEP2naKHg==,iv:8RudvW7ki/DkWZwVHd1AXAt+6YrLrOpXotQDh9vwgp4=,tag:1PzTWbWEqKUdhlwRcctpGQ==,type:str] + optional: ENC[AES256_GCM,data:1q/Bng==,iv:jEnPnyR3pCV0CL8hK+NfMxH1LDKSRyansf6GZDshzQE=,tag:TzOXcGF91InOrCdCCm/Bcg==,type:bool] - name: wildcard-semery-fr-tls secret: - secretName: ENC[AES256_GCM,data:UGyQYSXVWGw0F2XOynpuKfcgTdFIeg==,iv:8uzadBqa8qdQYImy81Z49ef4hUoIAXEN1lcpF/zLzKE=,tag:UfN9BzxGabZfoIIctowVjw==,type:str] - optional: ENC[AES256_GCM,data:PxyWIg==,iv:0TxiU0ItTdtU7HQNbNhGjC2n1ECNQU9xB1EkDxDwwJY=,tag:XoiW8gIU9J3JGJ/bU68l+w==,type:bool] + secretName: ENC[AES256_GCM,data:5n5namMP+KepRLRQZgvzlr9hEzNmvQ==,iv:Xnh7FIAVaxQ1Mxd8+en8bM9ueFsG1ujxh472mQhqFFw=,tag:omVRURP2KbSEyHsUqUhfCg==,type:str] + optional: ENC[AES256_GCM,data:0GArbg==,iv:1wW6BFk6Vs2y42iIniy4YbMFBOYdqwXop2WCEldwBBA=,tag:gmZlb7zIh3W/0L3qg8XQCQ==,type:bool] - name: buildpath-win-tls secret: - secretName: ENC[AES256_GCM,data:9hnCOPClLIGgPNnNPaJbNXw=,iv:px4ZrrTlmXyqGI0dsWFzXndUGVqlV83Kv4aDdG0S4Jo=,tag:wiK4rTqyQN8+fWQhZB1chQ==,type:str] - optional: ENC[AES256_GCM,data:vC8okg==,iv:Pl81vGJ6Lt7jvFuOZAoDl2iV/F0IgOfKoeVUCOdNPC4=,tag:tUo1/Y1ZXqpM6hsu52l+ZQ==,type:bool] + secretName: ENC[AES256_GCM,data:CTR7I92zQSaOKCcLPGnAs4Q=,iv:egtHKvBbs1dJsMgoIFK+gyOnC7ZX/3UfaAGIDkryd+c=,tag:vk3xGP8YeXhQSi6QLk+3Ww==,type:str] + optional: ENC[AES256_GCM,data:nOml1Q==,iv:viRMNPrBLmm8IfJDqcfWOuyMx/y7eE0CTMYjWmK5/rE=,tag:VpAuffCx/VqP2X947l/p3A==,type:bool] # saggar.dev cert from cert-manager (Porkbun DNS-01) - name: saggar-dev-tls secret: - secretName: ENC[AES256_GCM,data:dL9l5pMrG/mYNQrqLYU=,iv:iuObGUhAFxovuZNglvbkf2Tm6Ska6TOKucnbB6sDhKo=,tag:SmCPAODV/Sy/dNuUQJ48Zw==,type:str] - optional: ENC[AES256_GCM,data:Ulw09Q==,iv:TKMN40lRkp+xmsAPDBVrVIe+h+6z5NlNZrpf7VvIah0=,tag:Cq3itFokCituCEJtrANeAA==,type:bool] + secretName: ENC[AES256_GCM,data:5eb4Fv9OJqjbPuxT1/8=,iv:ZsOSvoCc9+ZtTVboRKJBRR8FITk3gowa/uylv+mfA+k=,tag:hkoQ8QHt9evQfDUT4rq51Q==,type:str] + optional: ENC[AES256_GCM,data:iac+qA==,iv:hf1rDOHE3frRL702sotOP8akjBi20mRTXQ6vlUb4Ac0=,tag:+G8rgN61c5agYmbJsldqrA==,type:bool] - name: api-saggar-dev-tls secret: - secretName: ENC[AES256_GCM,data:FQm3BLurAD2EMCgsg/kMgWIH,iv:f6bv6YFL2ExmHS1QmdAyOcI/nnCIHL7xEX0/kZQ9rts=,tag:KQRXKValNB0oWYCCqZ8xdg==,type:str] - optional: ENC[AES256_GCM,data:+dUIjw==,iv:ztZ+5x76lpd2FqbZkgedeD2yneBKGicbW1MGTg4mUbo=,tag:ty4QRjVhbrB9WoOTenXcew==,type:bool] + secretName: ENC[AES256_GCM,data:5NJaLtBQizRFNbF5IS2YbEmF,iv:lTJkrES8y7/QO73p7G8RG/CmxGedyXAvfrK3Q26OtU0=,tag:92P2+010Isgg3SQjYwPBCw==,type:str] + optional: ENC[AES256_GCM,data:3ax/5A==,iv:CvLi5JqkXPfq9+jVA/Q+mpdEZJ7UosxzZAR1aArpDbk=,tag:yOsLJuqtCrvg8YneJRUeoA==,type:bool] # docs.saggar.dev cert — the saggar book (static nginx) - name: docs-saggar-dev-tls secret: - secretName: ENC[AES256_GCM,data:B/wTyuOSik2qea3FuCT2LpVqhA==,iv:Y8N5aQw4Yf2mPk1sEoeaxQEb3N1VVyyfiQy1cW1qdTI=,tag:Pn4k9TuMCJ5iAlWIVejb9Q==,type:str] - optional: ENC[AES256_GCM,data:Zt+j3g==,iv:AlxMaVpZMLKXDwP/xR9AiZS5p3Zm0/Kk0RXh7+s3/HA=,tag:6raJ2r1dw08NmP9GGbSysg==,type:bool] + secretName: ENC[AES256_GCM,data:xDf3adcsj6i0FJ2kAc5UxnVE3w==,iv:+qGMWJKoQo/MjibTR9mbgX3T6/xwr+vq1U+ef14xXfs=,tag:Y2jZHktvL8RKUacSv9JDJg==,type:str] + optional: ENC[AES256_GCM,data:wEEiYQ==,iv:zNWY0N5935+biGIjIl+q5XPyLLX7/ABhnwHsp4FEZpM=,tag:v8trm6fiM5q/T6EOh1fxcQ==,type:bool] + # get.saggar.dev cert — the saggar distribution host (garage web) + - name: get-saggar-dev-tls + secret: + secretName: ENC[AES256_GCM,data:iFG9+7bSIUgFZpm8h5Tc362g,iv:Wm6cW1+ehjoylvjwSE3oT0VcQFZONq9znpfi2w/wP9U=,tag:UoEXdJzWoVX6/g8UtbByzQ==,type:str] + optional: ENC[AES256_GCM,data:t8VFbw==,iv:Imo0wBOb9ufS9YPqtTegEHQFnyhgSYmcg2FHEzBkW9I=,tag:19zicABMKqAR/nDr85WpCw==,type:bool] - name: routes configMap: name: caddy-routes @@ -98,6 +103,9 @@ volumeMounts: - name: docs-saggar-dev-tls mountPath: /etc/caddy/certs/docs-saggar-dev readOnly: true + - name: get-saggar-dev-tls + mountPath: /etc/caddy/certs/get-saggar-dev + readOnly: true - name: routes mountPath: /etc/caddy/routes readOnly: true @@ -122,7 +130,7 @@ affinity: - weight: 100 preference: matchExpressions: - - key: ENC[AES256_GCM,data:icR94wmhgXZjrKlEJhGCuCqwxfI=,iv:s4zhWsRFXy2rZnETpkhixCoFHykEt7z2cRjW3lXJZP0=,tag:ejJW4EqCxEyDCrvRtdg82Q==,type:str] + - key: ENC[AES256_GCM,data:RTux56Pd/U6b6MLk5uRUC2YXP3w=,iv:K/9+Mh8dyp9DOumKFLmZFHXqjxzhhYEKKSnXRc/Pb2A=,tag:fk03mWjQEQPCdALb2gEMdQ==,type:str] operator: NotIn values: - "true" @@ -136,35 +144,35 @@ affinity: topologyKey: kubernetes.io/hostname tolerations: # Tolerate the failover taint so caddy CAN schedule on p330 (small-node-1). - - key: ENC[AES256_GCM,data:Nw/vagZB7oUw,iv:HcfljVdo6FMPkAduv4hug8AVoe+/VniXMBKrJ8VT/QM=,tag:fr3Fl3fdmez/83pnZ9cFLQ==,type:str] + - key: ENC[AES256_GCM,data:JPKKj4UA7JWi,iv:0PNgCHVFO2bywVfcXrOrcTQpNjz2TUUM0RrBmF6godw=,tag:h27cJ4dd9C1iLKgffNLVfQ==,type:str] operator: Equal - value: ENC[AES256_GCM,data:647LykKfZZk=,iv:0Dz446WOcetIdS5x6ffugLgLJ7bqGk5DflIOajNxeJI=,tag:aGRWSC9aN8Jo0R8B96cYjw==,type:str] + value: ENC[AES256_GCM,data:7dtvTUy+xUI=,iv:pQdnyz5X+gQB0DOFFxs5D+2RAPD8xl+hgJFwARcbBWo=,tag:A321CiM+q8tLJJyanRn/Ww==,type:str] effect: NoSchedule - - key: ENC[AES256_GCM,data:i29MKq5p+vyIcWAKjOzfwLXJQ84MniWDAUbK9a+DyavBHi7v7Q==,iv:SaTj2YkCO40MT7l2VsH89/zi9y4COte3c1wnNcp1NRU=,tag:8VOtUPeDlg62Mbjg1/J5BQ==,type:str] + - key: ENC[AES256_GCM,data:t71fVLGG7y2am6kXa3DcpGt76uZJ+cOuYZKiaRF2LljtRCxzpw==,iv:Fa0zVUsH/TbWBbL2foIsvq7UQ2kIcA3yNvG2qMuGnng=,tag:KchzYUpe4Z6JIZCvSM2ztw==,type:str] operator: Exists effect: NoSchedule sops: - lastmodified: "2026-10-01T17:39:26Z" - mac: ENC[AES256_GCM,data:SCcbYDaj1ERDedV1LqbeBQ3uDJjkmyWkU2PXfmZ5BO5FC8b1ZkJJ9Ckcb8IvzSj2/f839RRHWGk7isUpwUrJ6QwifzYC53VAobr/S40sKx7281sYC+OX20zxa0hAf0fts1PsWWaWQ8IEVd08481MxyZFUFpFqGyGuyUeuIJtWf4=,iv:/U7yj5ONy57kFGqZNUOuCagw5N7mKgxv7s7QlR+nZNE=,tag:qBYkZmR3n/YrnfT7T/VwXw==,type:str] + lastmodified: "2026-10-04T21:14:10Z" + mac: ENC[AES256_GCM,data:vv4/zTp8LHusfYtM4xUwKHnesHu49VXfhRmKPo/nB7ItGYATsD5PtnXrGluOkwng/5pvRVs5WCtLt9fdZ9k7aKsfFHisi2OylEkx76xcAQ1f8GOCNkvfnjVuPEbaIZK1Mvdepbe1oZ0B4m5I2KqfvnUpXzmG82vNq0hj5vlQ1uM=,iv:7mKc4OBbPUYuLXer5f1OZcHggJBOu5rD/luh64in5lc=,tag:ch1Nvtyfa94AI9tAOm81hw==,type:str] pgp: - - created_at: "2026-10-01T17:39:26Z" + - created_at: "2026-10-04T21:14:09Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMA7uy4qQr71wiAQ//W/WNIqPCl5afTCLEJOUnvBj80zjZ0+cDI7W/dvipnAqx - LQZr9zPfG3zURJBzGRpUDvqUWt2tymikQPx5rSNGgHeLYRru3SwaD3M5AEgkjAmC - Y02hH6fIsJ+k5NhOS0wAlkgXze3EXq+0JOE8ZYQnF0ggYfsK6vTD+q+fI7zxddfx - 0KLi8Gec5GXjgO93Roi0GwVguvQ9IDxe/xkGxQQ+CdZ7X6w2vfzBz/of6QJAGvRr - 8XKWmuUDBOdvWNFqfmsLMZ03ssD/h/WmxwTUMCHcynXSyprL+QRNH+lMMSVCFwyo - yiagQVxDPx9zmp/fwnSYt99sN9Q+Ky75r0UdFJYzpk9ZfqHveEVIh7JUigwAawF+ - oX8amZoyG5Qm24ZwTA6pkuzw8yc9KNPEGi5UjGFW+Q2fDPjq3Zt0NrSyfGD48dzJ - NnlmwkMkWGxTeVwmzdxgg9sd5QvG+8/pwJE76epJdXRQLd8ylJGoUNgbO0tZGEdW - 99pFqcbTN1UfZ6CtuPKTtU3GHylprTB1qw0wM1Hl/y8UEo82iuJmDdZ1HWEA+9AS - rCaYe0ZnWmTQHpWHXMBVK0OPqamOGiMZX4c6AUEdU5kyBymGmN5tjov6d+vA+4ai - 0OQjcH2QKzNshGrxo+iLIDP70AeZCg0BoKyo41X8Af4cRi6ub6l1lIWMmTYTY/7S - XgHrANxBUj67L7Qt8spnz5FsQQ7ikTSEb1sXPM6RQ/hzFXdOHQTzJjwlr0NUXDgy - dwC2khracGn6F9cXSrD7SN1elORAKr+HFWqBrnDLrYSkhkVI3kmCoueP7cwNFR0= - =jpmk + hQIMA7uy4qQr71wiAQ/+Io9dFjaXDz2CSdPjMBiT8ISxnUxZ9F3VX+bqKg9nRusr + slx5VsHGCsfK4DyF4GXcqsyDPkz6v39ehhUFdseZewg1AbYTNy9RIEgeSo3fwcnO + bee48z1Nti+8F3h+4O2ao+nGx4wSS6MYO3oO5vV5a4oNKe6T59X7eGT30uohatO6 + jo6UuHu3/e7eyzK7/iSF3SemtkZ1ZiXOgKKeBXashrp+2vDdY+3ow/pRpFyohqWh + 4mBt8SyCWOsf0BUdNZfJPDO594hwTjrrRIsmBeXde97rFXKBDd5tPR9tjNlihWsw + lC0e4331jvwns+rlSOASBX/BVsqVGh8nw/5XWxqW3oMqjvolgofGhP8CtFQkUuoq + VoHcgQd79wo0Q107wcp3ftMak010/NweAER1CFtCDBE6DAS05qaaOwwM3erusaw2 + ZY/ezGULEmSgZ8RA3HHjtxo1ExLMZ+CpPb0mAAamql8O0uCpLl0TRkWvR4zwpo2K + ojOTW2dLjhJwJaodAMnKQm8mWtegC8Uektw1RdYCbCTD4sKv9vkxymnSLmE3dvWD + Htp/hCSTqDCc0sSBDdagIZWo8VtdduWqeGG7+Qs1wY+NizSlYRDmEsahbgPk9Bcu + W7vhpJFZ/98jxEmgaiUVJ3BVqZYiJBdDk4GvSw+/QmyNvd39xNLXIN3DcRTLmqvS + XgH/TZt96utCGDUjYFAFw4s4UL3EhttfDe+hSwzrAcslhjyeCORFhYrnwOncCr51 + tr+maBFPip6FgASJQjDVnxtw9zFDfurbx8W2wk9uh6w3qw4jbGDq9wsI0wvfous= + =C10g -----END PGP MESSAGE----- fp: DC6910268E657FF70BA7EC289974494E76938DDC encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$ diff --git a/kubernetes/kustomization.yaml b/kubernetes/kustomization.yaml index 5060538..2f80112 100644 --- a/kubernetes/kustomization.yaml +++ b/kubernetes/kustomization.yaml @@ -47,6 +47,7 @@ resources: # Production (public-facing websites/apps) - production/buildpath - production/saggar + - production/get-saggar - production/semery-fr - production/umami - production/vhaudiquet-fr diff --git a/kubernetes/production/get-saggar/kustomization.yaml b/kubernetes/production/get-saggar/kustomization.yaml new file mode 100644 index 0000000..99a87e8 --- /dev/null +++ b/kubernetes/production/get-saggar/kustomization.yaml @@ -0,0 +1,14 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: get-saggar +resources: + - namespace.yaml + - packages-auth-secret.yaml + - repository.yaml + - release.yaml +secretGenerator: + - name: get-saggar-values + files: + - values.yaml=values.yaml +configurations: + - kustomizeconfig.yaml diff --git a/kubernetes/production/get-saggar/kustomizeconfig.yaml b/kubernetes/production/get-saggar/kustomizeconfig.yaml new file mode 100644 index 0000000..3365acc --- /dev/null +++ b/kubernetes/production/get-saggar/kustomizeconfig.yaml @@ -0,0 +1,6 @@ +nameReference: +- kind: Secret + version: v1 + fieldSpecs: + - path: spec/valuesFrom/name + kind: HelmRelease diff --git a/kubernetes/production/get-saggar/namespace.yaml b/kubernetes/production/get-saggar/namespace.yaml new file mode 100644 index 0000000..8052dcc --- /dev/null +++ b/kubernetes/production/get-saggar/namespace.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: get-saggar diff --git a/kubernetes/production/get-saggar/packages-auth-secret.yaml b/kubernetes/production/get-saggar/packages-auth-secret.yaml new file mode 100644 index 0000000..fd0fa4c --- /dev/null +++ b/kubernetes/production/get-saggar/packages-auth-secret.yaml @@ -0,0 +1,38 @@ +# Basic auth for the private Gitea Helm repository (org `saggar`) — +# same token as the saggar release's packages-auth-secret.yaml. The +# pre-commit sops hook encrypts this file (name matches *secret.yaml). +apiVersion: v1 +kind: Secret +metadata: + name: saggar-packages-auth + namespace: get-saggar +type: Opaque +stringData: + username: ENC[AES256_GCM,data:bQ8HUwCqCEIWKQ==,iv:FFcNqBTrA2xJCD2EUf2k+8f1+8DZC9r7Z14Qns0TjH8=,tag:aKWUHSP+8yjbewr/vt3z8w==,type:str] + password: ENC[AES256_GCM,data:bfiHI6tHwtK1qYf9UdAplb5qNE7fceQDjUim3KlWU/sb4Q5mvqK6CQ==,iv:ZtRNqfWZLT1lSd/N9MGwKrRiTtKDBUBZUR1LUy00G40=,tag:f55oMGmPHQB8zMNWtChp+w==,type:str] +sops: + lastmodified: "2026-10-04T21:14:09Z" + mac: ENC[AES256_GCM,data:pbOlIPfHMwbwyBHlwkTYwWSeWD2jxud2zlNYMDyYJmKRpUuf0/erqRUusTrVGUnOG1t7omu+hQycPC3im6v8mi0vECBlkVG3knQa46bnVH9m1qa7lVChuP53TLYZogrOA8Ol9omrLsUsdcPNJfwXTYS/HHkY+ujECnjCWiVoXUs=,iv:Al2lU2xt1Hvv1BokoOx5e1gOlJhxzMJNyyCosmlGDV0=,tag:OxMxotEvYI06Fjjwst++gA==,type:str] + pgp: + - created_at: "2026-10-04T21:14:09Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA7uy4qQr71wiARAAgsXy5zMBbREVADgr2VVGgev6fHJUXq6DKCRhQdH1nsrI + xbSN1HZ2UbQjCYCjZl8NdVo3KGhJJ1uQGABAq6ZE+C4ZaMWvfjEO0/CnHmui8LkL + YXvJWWKvP/DDcmLXYxgwP8u/EWtn1bgXN7HeHxYb9JtGEf7XBlS9a6InWDmreabF + lSGkl79NgWDIngNQwTvby76uVARSAj3TkIxO6f4cVx+2f/c7KvWvX9D5vjrz8dpk + tPFdIhsCHdQS2wf2G3fEp4Yb8WnTEgu/HQ/amYwBAplhv3aaFQ0WVxCB91amnJyw + 4Hnkcim4e/ZTmlBms/iQMFo+NhcHebRYcganIid23U8j4RfptwbuxED/txDEAAbj + lrgpknUXDG9RRRFTZfViYVJ4KWNduuUmVX4URYtn9d42BEXlXwx+Cd7FV40mlM8F + aT87F8G3IVexcKqLV15RngswCaCNJOnIT1vNNz18hz6sz8qXCzDwKIsS02wzkchz + 1E8pi4grh2UkJT/F+mHUnze3ADOIZu6c2+SUwswVi+zAQg566dgFMYfKWc7icbvz + AWJ0hatHKNC4utZ2C0sCrM/34M0J507UMjlGKY9FUQ7wnHubPMfrum/FBNH1X7jM + F+iWsZ4N+kBnpY1Vf64S+97/Nqg5NZ3IBHWyqaSsWmR/h9628XDAa7kUpIsPK2LS + XgEGwyBsqJOWaYa7pXhIuul+1iNTJJ5FhU9qFQci708gund3RSvGJLtUIGlwSLUn + qzSSfl8vWujLNj9Pb0FcegVTYAq4eA59rJFILjyRZ64TaIfPBYxdFSD8t4zcWQQ= + =oHWG + -----END PGP MESSAGE----- + fp: DC6910268E657FF70BA7EC289974494E76938DDC + encrypted_regex: ^(data|stringData|.*key|.*crt)$ + version: 3.10.2 diff --git a/kubernetes/production/get-saggar/release.yaml b/kubernetes/production/get-saggar/release.yaml new file mode 100644 index 0000000..5f185be --- /dev/null +++ b/kubernetes/production/get-saggar/release.yaml @@ -0,0 +1,21 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: get-saggar + namespace: get-saggar +spec: + interval: 1m + chart: + spec: + sourceRef: + kind: HelmRepository + name: saggar + namespace: get-saggar + chart: saggar-dist + # Same CI scheme as the other saggar charts: timestamped + # versions on main pushes, exact versions on v* tags. + version: '>=0.1.0-0' + interval: 1m + valuesFrom: + - kind: Secret + name: get-saggar-values diff --git a/kubernetes/production/get-saggar/repository.yaml b/kubernetes/production/get-saggar/repository.yaml new file mode 100644 index 0000000..7f7a428 --- /dev/null +++ b/kubernetes/production/get-saggar/repository.yaml @@ -0,0 +1,13 @@ +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: saggar + namespace: get-saggar +spec: + interval: 1m + # The org-scoped chart repository CI publishes to — namespace- + # scoped like every app, so this release carries its own copy of + # the repo and its auth secret. + url: https://git.vhaudiquet.fr/api/packages/saggar/helm + secretRef: + name: saggar-packages-auth diff --git a/kubernetes/production/get-saggar/values.yaml b/kubernetes/production/get-saggar/values.yaml new file mode 100644 index 0000000..3f4c91b --- /dev/null +++ b/kubernetes/production/get-saggar/values.yaml @@ -0,0 +1,44 @@ +# Chart: https://git.vhaudiquet.fr/saggar/saggar (chart/saggar-dist). +# One single-node Garage, one bucket: the S3 API stays cluster- +# internal (chart default — the publish workflow uploads from the +# in-cluster runners, s3.ingress.enabled=false) and the bucket serves +# as a public read-only website. The host MUST be . — Garage resolves the bucket from the Host's first label — +# so bucket `get` on get.saggar.dev. +bucket: get +web: + ingress: + className: traefik + host: get.saggar.dev + # TLS terminates at Caddy with the cert-manager saggar.dev + # certs; Caddy proxies to Traefik by host, so no tls block + # here (same as the other saggar hosts). + tls: + enabled: false +sops: + lastmodified: "2026-10-04T21:14:10Z" + mac: ENC[AES256_GCM,data:eiYi01TPIHeaCxGblY8k5RuBXacex96leJdmI0Ii3PI6GElJnmZ4elE8PYCBs+XsjwlixLQEEIEN7kTzf2mm2rmoa/2HXhgZW1xPGOW1k6Oh3T6b9fhIwHYVpFTcKikTJo5mcZHlIF8wjNf3AxysWLa94O5G11XVoZnquzoP2to=,iv:nn8jSbwgf75AuOQci2pB56dxB3QFUVdDrMLMqMUXD7U=,tag:jwAS38pKBYrD92KSFei4ew==,type:str] + pgp: + - created_at: "2026-10-04T21:14:10Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA7uy4qQr71wiAQ//aSdSsLiq0QPPhi7RxG87wsS4Q6yTW4htlkCBfAIJR+ky + rNXO5ADj3Hhl3n9R90Cci0Txc2XJE7w3hWs/P70Q4Fu8LLDHEN/jvCUIn7ARywhQ + NZUezluFFTeZVitwpiK+lSws7Nzy4eduPd3VDx02W9Ej2IXa9e41vWb7JMODBzSz + p5wntTjPZJfcrscijPM5Q1rvv6SWtp4b5DZJzDTZWAYVuPhgW/JF0HZhh+EXcKSv + Ea0UDXCXE+Qy3NUlFGNVKk+vXhzAUp+qrRi0Eno0uTfZ+9xNRdqARusdwLCO/uqm + wwEZn+TiRt/Uc+qcXSjWUcgOHckLk1sXCLTh0TA3DrCWdEfMp+eMDXaA1eN6V2XU + tSCK6Tx3eDvWKmm23CHPRgQB4cookcHbiPScjZicjp3w2iTQ6GZ7LsgDNE0IsdHg + Ha1Cl2QNfxhHWPNPFFRedcLbAjj94CNLMRfBctf+sB7PZydeTUFGYKwTScFBsL0k + 8ll5qhEl/6qFWGOVrynF2dccYBXYSK6fs2A8pwBVqNvh7mtejd7D2/S2Mpc/lLCq + VNdUlkAKpsCMyzIVqlgJ0TB1SdwR02jKBgOr9XOvA8tCb835On/tHlelz9uOq040 + OrQlLmiJwom2J7lP6WzJE28t3uVALZo4tIiiNivOFpdh91LLC3GAUVGaH3uT3ufS + XgFFkDQToe1sS4pv/RdbjHEB1tSHqIgsKuTTnlsxwYF7ZzxwfxETwVlU1yMaEIIH + enA5z0XVyRwoLqT36U54SZo0Rq0SHs6W0w6qr+sIDmoMP9Cxw0a5jJ1P0zb2PbM= + =uIr+ + -----END PGP MESSAGE----- + fp: DC6910268E657FF70BA7EC289974494E76938DDC + encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$ + mac_only_encrypted: true + version: 3.10.2