From 9aeecee770981c65f22fb36b4ac62c5d0b3a4c0e Mon Sep 17 00:00:00 2001 From: Valentin Haudiquet Date: Fri, 16 Oct 2026 08:56:34 +0200 Subject: [PATCH] feat(get-rhema): expose the S3 API publicly for release uploads The release runners cannot resolve the in-cluster Service name, so the binary uploads died on DNS. s3.rhema.rs fronts the same Garage through Caddy and Traefik, with its own certificate, matching the web face's shape (Caddy terminates, Traefik routes, bucket by path). --- dns/production/rhema.rs.yaml | 8 ++++ .../caddy-certificates/certificates.yaml | 16 +++++++ .../infrastructure/caddy/caddyfile.yaml | 5 ++ kubernetes/production/get-rhema/values.yaml | 48 +++++++++++-------- 4 files changed, 58 insertions(+), 19 deletions(-) diff --git a/dns/production/rhema.rs.yaml b/dns/production/rhema.rs.yaml index 0139e28..a30d91c 100644 --- a/dns/production/rhema.rs.yaml +++ b/dns/production/rhema.rs.yaml @@ -15,6 +15,14 @@ get: ttl: 300 type: A value: 82.64.154.58 +s3: + octodns: + cloudflare: + auto-ttl: true + proxied: false + ttl: 300 + type: A + value: 82.64.154.58 www: octodns: cloudflare: diff --git a/kubernetes/infrastructure/caddy-certificates/certificates.yaml b/kubernetes/infrastructure/caddy-certificates/certificates.yaml index 578e9bc..55c5932 100644 --- a/kubernetes/infrastructure/caddy-certificates/certificates.yaml +++ b/kubernetes/infrastructure/caddy-certificates/certificates.yaml @@ -162,6 +162,22 @@ spec: --- apiVersion: cert-manager.io/v1 kind: Certificate +metadata: + name: s3-rhema-rs + namespace: caddy +spec: + secretName: s3-rhema-rs-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: s3.rhema.rs + dnsNames: + - s3.rhema.rs + duration: 2160h # 90 days + renewBefore: 360h # 15 days before expiry +--- +apiVersion: cert-manager.io/v1 +kind: Certificate metadata: name: www-rhema-rs namespace: caddy diff --git a/kubernetes/infrastructure/caddy/caddyfile.yaml b/kubernetes/infrastructure/caddy/caddyfile.yaml index 040144c..74500d7 100644 --- a/kubernetes/infrastructure/caddy/caddyfile.yaml +++ b/kubernetes/infrastructure/caddy/caddyfile.yaml @@ -142,3 +142,8 @@ data: tls /etc/caddy/certs/get-rhema-rs/tls.crt /etc/caddy/certs/get-rhema-rs/tls.key reverse_proxy traefik.traefik.svc.cluster.local.:80 } + + s3.rhema.rs { + tls /etc/caddy/certs/s3-rhema-rs/tls.crt /etc/caddy/certs/s3-rhema-rs/tls.key + reverse_proxy traefik.traefik.svc.cluster.local.:80 + } diff --git a/kubernetes/production/get-rhema/values.yaml b/kubernetes/production/get-rhema/values.yaml index b237683..e43fcdd 100644 --- a/kubernetes/production/get-rhema/values.yaml +++ b/kubernetes/production/get-rhema/values.yaml @@ -19,30 +19,40 @@ web: # cert; Caddy proxies to Traefik by host, so no tls block here. tls: enabled: false +# The write surface, public via Caddy: the release runners reach the +# S3 API by host (the in-cluster Service name does not resolve from +# them). TLS terminates at Caddy, like the web face. +s3: + ingress: + enabled: true + className: traefik + host: s3.rhema.rs + tls: + enabled: false + secretName: "" sops: - lastmodified: "2026-10-15T20:28:51Z" - mac: ENC[AES256_GCM,data:+lYkUZ+5erultYuI0ejlAUiVnPhwZ7wwlB3IqDP2M5YAXln7kqu7xMptvrgWGEHPavdmZwBvbBLf3FC1i1Zkio04iFpZ/zLTb/msomSjf7e2lQhk5VLHgqzS/Cd/ZvEvlXfuVPTKrWDdlKKdozY+Ge+WspGSL26Hf7/9rMqKvpM=,iv:6Rh6Ues/OHxDkgOkGIylz490m3kNX1TGQP5bH/UFjRg=,tag:w2oXRK2twjXN3IhnKf0uow==,type:str] + lastmodified: "2026-10-16T06:56:14Z" + mac: ENC[AES256_GCM,data:XuFKJcXb2C22x1GaADmX+QwQNAeUiYsmSh4g0Z5CTyvIXSI5gksAVKNgF0RqRNDLDmDA1jGCS+a0Y//ExXZO1kKQj2jYdYcKU4IvOmniMiwut5ZtobFbuskv7boAxmNRT/Y/4RgyyT8+45b/2+u3i9u2cwSQQ0Itvh5PxpFlE+I=,iv:3qXS6rEkeodOwLt5AOx8atfr15fK1zpmkM8uKjxUB2w=,tag:1Y78Jq8E44IGukCpR99UwA==,type:str] pgp: - - created_at: "2026-10-15T20:28:50Z" + - created_at: "2026-10-16T06:56:14Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMA7uy4qQr71wiARAAgirAbNH6NDN+dAcsGAR48/S2Vt3gLLjsL/pHSC0hb7S4 - oDF/FMLTyUQMG+KTZBEas3KhO/Y1weay9wQEx1M4Jk809fbARjXl2gJFcdtlO28f - MVh9kBq5xY4YtFlRm1bKffTNaxFwNh0Exjl6yAKrUsPwH9eFEBlehK/prDXjmyAv - tHwW4GuPRBFMlZAtxvkTNZfnBKfimIirjDHurgHxmaNmH7B+UKGIb3NHI2f5QQug - VtDZoEuGovGcegIQfWorq1pzSX0PF2pOn+bgn/DZ7BWbeLRArD6prnlzbrAL3NeL - V+fofYig1SNCuqBKxzfsPYnhLe7Ylg3oYzGqn7N6G9ub0xF3FVpRksoluHtMTECf - 2Oiab48jHrQCHA0+Br6OxO8TQK3sWHGQuUhBbE7tugeGg+v8lfyHPghmNrPBFL2n - fpOnLCid+FZII7d4LFVQr3kE/+DMGVzGYBIPgBlPovTME6MJeox2Tq3+qh2QUCzF - Chue14+oHuzw2lnqltG62t52LRLKrNlI/1+D0mWz4VWU4O/3wiJwUYxA9dVni05J - d8DW6Q8600cJLRtvVvh+r+7DmVPeg8h/yBfsSbtiPPLpTkL93JNhHfx7pD1++e7x - oagv9f2DQ0Vc6EGhnk96T6bvPQqgeZJMJtdDl4/nyxA9Y4DpBFzue+qzZxkgldnS - XgF3M4q96nyp5d9JwcYvUlF9XWxSCyc3IMRDV3QQo7BJKH/EBXiMSFg23LBBbdRH - Rwtt2sPE1u0d2wRZEIS5YU6dmQ55lhK0NBLyTVqm0IACQS67GeQrPpAvD1QOjng= - =zBGK + hQIMA7uy4qQr71wiAQ/+KleFpAm4wpwoyB8U15o27ys2KXyKNFUl0EeRhYBYjcqe + wgtiayZjGbM0Tz2x9+SFLQhezldMlH8N5l0BscuYBMAUgDXS9OMN+v/1nHk0pu43 + FUYHEWbYmYgngzGKuQhdrGEEtNBH12oKcBVwIPG7zaTfAlhfZIq/xsh6QyfTZX36 + mSzUsshYPmqUM+RymH/PrJjpWz15XBdFUiY59+hNa9kqjalyTg0gijuu6JkKbYTK + SnFd2i9Ud/meniC4oBlLyOc0PX1/uyeIY1SFbGHdwBcHCFdIzMow2fZWLzimsNyB + GIO31PbyhG3ZCb2cOzYC0XqJUdP6lHbAyDBDiGWu+dBupDb8d96XeaIF0cTgOjxJ + 0FrDMk1OAc1HjnhGo4QrEPMT0vMJmRDcDWXp60pFycRIrjGyXItMqkW06Xlr5HvF + OM8q3gjz6s7/Yi80EHKyFEHsvLl8jw2OXYhSiUEy6mSfii5k4Hhs2PBJFKcxLqZA + tH0caDA4zJia8FdlaTHI9OE33TvP/9uxvY9kBJUaeMdLxCo4T0keOiam2b0K/H8N + owIhdVJmXtsAFiw+t7KKZku9kQtkav8hEn1G++VQXL/XUjxvv3CewDq9cbNW7aIU + byjUf4jPR+kI4TeyR01YMDP2+O5Ld0/NxlCKqF10w8KVs1OsWFBagC7I4iPy99XS + XAEWw3W3SSGkz+9t2cqmXTxCPIvU0ANjkz8PoNAfx9HC3UWk3So1MGht0FDR9QVZ + AOzPM4U43wnYrTp1sq4N9Xh7xU2m2e7iUt/g2dtRFvx0vv2qMt4ianqzYiB0 + =1619 -----END PGP MESSAGE----- fp: DC6910268E657FF70BA7EC289974494E76938DDC - encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml|token)$ - mac_only_encrypted: true + encrypted_regex: ^(data|stringData|.*key|.*crt)$ version: 3.10.2