diff --git a/dns/production/saggar.dev.yaml b/dns/production/saggar.dev.yaml index 47fda57..47a2b0e 100644 --- a/dns/production/saggar.dev.yaml +++ b/dns/production/saggar.dev.yaml @@ -3,3 +3,7 @@ : ttl: 600 type: A value: 82.64.154.58 +api: + ttl: 600 + type: A + value: 82.64.154.58 diff --git a/kubernetes/infrastructure/caddy-certificates/certificates.yaml b/kubernetes/infrastructure/caddy-certificates/certificates.yaml index 45ee769..acfc85d 100644 --- a/kubernetes/infrastructure/caddy-certificates/certificates.yaml +++ b/kubernetes/infrastructure/caddy-certificates/certificates.yaml @@ -95,3 +95,19 @@ spec: - saggar.dev duration: 2160h # 90 days renewBefore: 360h # 15 days before expiry +--- +apiVersion: cert-manager.io/v1 +kind: Certificate +metadata: + name: api-saggar-dev + namespace: caddy +spec: + secretName: api-saggar-dev-tls + issuerRef: + name: letsencrypt-production + kind: ClusterIssuer + commonName: api.saggar.dev + dnsNames: + - api.saggar.dev + duration: 2160h # 90 days + renewBefore: 360h # 15 days before expiry diff --git a/kubernetes/infrastructure/caddy/caddyfile.yaml b/kubernetes/infrastructure/caddy/caddyfile.yaml index 7918476..a52cbd6 100644 --- a/kubernetes/infrastructure/caddy/caddyfile.yaml +++ b/kubernetes/infrastructure/caddy/caddyfile.yaml @@ -112,3 +112,8 @@ data: tls /etc/caddy/certs/saggar-dev/tls.crt /etc/caddy/certs/saggar-dev/tls.key reverse_proxy traefik.traefik.svc.cluster.local.:80 } + + api.saggar.dev { + tls /etc/caddy/certs/api-saggar-dev/tls.crt /etc/caddy/certs/api-saggar-dev/tls.key + reverse_proxy traefik.traefik.svc.cluster.local.:80 + } diff --git a/kubernetes/infrastructure/caddy/values.yaml b/kubernetes/infrastructure/caddy/values.yaml index 70155bc..6f545b6 100644 --- a/kubernetes/infrastructure/caddy/values.yaml +++ b/kubernetes/infrastructure/caddy/values.yaml @@ -36,30 +36,34 @@ health: volumes: - name: vhaudiquet-fr-tls secret: - secretName: ENC[AES256_GCM,data:6ExXcOxf85dmK/C/XpC5b+4=,iv:kKI31lrYZSMv5hy0i1l3dMYpflc3DklDJNugH2xUgvQ=,tag:rDKoIg5UFH2MTcbiW1XD1g==,type:str] - optional: ENC[AES256_GCM,data:nQnlHQ==,iv:ynqIN1n+zfflikGK85hqPvG7o3fjJo8GNxCswq3mPT0=,tag:Ur6Z7qckOiaS/BnXBM92zQ==,type:bool] + secretName: ENC[AES256_GCM,data:SpOriUboZlbUXYJmQGnNOPk=,iv:QrqYhqd84W2qpSxqDRV4IkBS+8VjQI/IV+3EjreakL0=,tag:aZe2IOK2rZrE8vUH1XvhHg==,type:str] + optional: ENC[AES256_GCM,data:HDGdlQ==,iv:Iu/fSqxv5uWPGesWB9JE8LI6PaI3zeTkCC7AKbIEFGA=,tag:jIsbpSdjsFIj6LzYPzVxow==,type:bool] - name: wildcard-vhaudiquet-fr-tls secret: - secretName: ENC[AES256_GCM,data:iBKGSWRrJJ9NxjHouxuuczbbEVokuH5Qybw=,iv:ekjWmEY5Vbm4P/TIms++eW+gKRZmgMyPD2k2VJls5qE=,tag:jkM9R92TVFkAQy6clybskg==,type:str] - optional: ENC[AES256_GCM,data:1PmH7Q==,iv:3S9tFfYXRAOSTxsetrEOvRjcqWAoizwXOtDOsmG63fY=,tag:GvxrXLSPXgk0/iHON1jrug==,type:bool] + secretName: ENC[AES256_GCM,data:OOpMJ2GZWXpH9GSPlGxPRkHLO+uIyANsdEw=,iv:ceeKNMsu3vNthfVRvF9dx+07QeweHU5ljyskpFMSwb0=,tag:i3b7ppoW2ALoY/bp28Q44g==,type:str] + optional: ENC[AES256_GCM,data:XaMKEw==,iv:pq//askiMe+iqmkCB/LYd0Jme8pEpU6EYHvYRkoE0z0=,tag:Gk9LvLUPDkAXIOIPp026uA==,type:bool] # semery.fr certs from cert-manager (OVH DNS-01) - name: semery-fr-tls secret: - secretName: ENC[AES256_GCM,data:qL62XGDo5zW3HKGoVg==,iv:Prlm6MpAopNzTxHVDlpWBibvxLqXjdi/iOrEAuspVZM=,tag:/MtBt2IDhjKU+lN9VGlu5Q==,type:str] - optional: ENC[AES256_GCM,data:P0BhoQ==,iv:e4Gr6iIGt6bTCPvdD3U7nLVHVusbiLc9iC/tQUpedYg=,tag:ew8ogjPxBHK4pYCRjOCoAA==,type:bool] + secretName: ENC[AES256_GCM,data:Qrw/Klx4eH7P2Dm7eQ==,iv:QviJIz+HklUwywWbwAdYL5sLEiHw/cX03sumVsi02d0=,tag:gDoVFTF8rAX+H2gLImRgLg==,type:str] + optional: ENC[AES256_GCM,data:lE0q7w==,iv:CdivcpbYUN9vhCeZx5LowREOzdD+eXDjGiyO1bWupQE=,tag:/pd7XLRJtFVKPxtxVEPB0g==,type:bool] - name: wildcard-semery-fr-tls secret: - secretName: ENC[AES256_GCM,data:nSwdeBlhSUhujmssB3oJ2QEdSjI16w==,iv:5nBHIeK2RWSMrl1qdxiVuUhiaM2erGfo+Tbd+p0MEHw=,tag:0j3sz2CREpmrcku86+abbw==,type:str] - optional: ENC[AES256_GCM,data:PXvJhA==,iv:MEnwpLwfbhagQSrbjH8++GTUwxK++CPuciBNu6xqQ4E=,tag:QU6qR62HzQKF7fygOW2z/Q==,type:bool] + secretName: ENC[AES256_GCM,data:b1C11W0r1MCOg7D5L7mVK73X02J4jA==,iv:5pJknW4W3owYzo5ScMJL0FR9phdKEYf9lLNm1tOxAAw=,tag:A+dUs8Fr1tRkODuRZ104sg==,type:str] + optional: ENC[AES256_GCM,data:gUa/9Q==,iv:WfLWFM/54xeAb0OlV89BP7oQ9bwO3Nc4FLaqGYOe8Ms=,tag:6SjdQdTHwEH6hZkEExbJ7Q==,type:bool] - name: buildpath-win-tls secret: - secretName: ENC[AES256_GCM,data:2FVJ/B+sflBrGetSsBOsogA=,iv:pCkqWiArPcCSGYjhcQUUiPeOkDVmv5OgPfeLnAaC92g=,tag:gIF4vlthAPZihlVbHSqAMQ==,type:str] - optional: ENC[AES256_GCM,data:6XQzuw==,iv:TrcOBBCls8UK+FyZbQSuAvBs5pa72RVR9u2mHn4jVoE=,tag:2qZKMLzdLgFti+KkEtSYvQ==,type:bool] + secretName: ENC[AES256_GCM,data:4yTNA5uUqJSpR7OZNTwAMiI=,iv:lEsnUetc5jJPsK7ElPLwpEUpL4/2jgRE7qe2HcrZ30Y=,tag:OPoXY3oNFzKfXztY8NoUtQ==,type:str] + optional: ENC[AES256_GCM,data:ZTDwVw==,iv:/FoV+Q/zJF2yV7Yi3WVR7BiGtzHGA6Hp0vfe5vyiZnA=,tag:Ot6IkJqyyrSxql9C8riHAA==,type:bool] # saggar.dev cert from cert-manager (Porkbun DNS-01) - name: saggar-dev-tls secret: - secretName: ENC[AES256_GCM,data:E6zCT5mte8FFgkslRD8=,iv:GtlwHsG0X9pfNn1EscTA5YFd1wXTwKYXfW3mPKahQ60=,tag:ugJMzZb0sOVvmLtsOkuPrg==,type:str] - optional: ENC[AES256_GCM,data:RBTuXg==,iv:MYlyt3OiAVwIX/5jFW9mdnOQ/1HP2q6hwVtMz8f86qE=,tag:tKyyLTCWcnNxsafLyXZNgA==,type:bool] + secretName: ENC[AES256_GCM,data:DwW0dJwcrOnikkkjchk=,iv:FN3RN4DKafzbU4UgyQmBLUxxQ4qtUnCX3wrl1MFAaoc=,tag:Imk5YlfwRSvVSBJQYjKqjQ==,type:str] + optional: ENC[AES256_GCM,data:tGW91Q==,iv:IZ+zz8YZVg0W7aUSyPDbC6fsRHbAPdUQ7ZtI1hrpf10=,tag:lPjurgxAojAiad7zkX/KUg==,type:bool] + - name: api-saggar-dev-tls + secret: + secretName: ENC[AES256_GCM,data:Ezt7Hql26w4qxjhBYnjLX7eo,iv:scYe4oHntsROQIRP8uv6ia0AJ1PCR9eDX4Wm6e0X2Bw=,tag:ysTY4RliaRx590P4ffNqjQ==,type:str] + optional: ENC[AES256_GCM,data:mdt9xw==,iv:QEVjHZU76rPJVXUacHjdrxnHQo/8cdKv4aZugvKagNQ=,tag:p1uQl03c8s37C45AyfexqA==,type:bool] - name: routes configMap: name: caddy-routes @@ -83,6 +87,9 @@ volumeMounts: - name: saggar-dev-tls mountPath: /etc/caddy/certs/saggar-dev readOnly: true + - name: api-saggar-dev-tls + mountPath: /etc/caddy/certs/api-saggar-dev + readOnly: true - name: routes mountPath: /etc/caddy/routes readOnly: true @@ -107,7 +114,7 @@ affinity: - weight: 100 preference: matchExpressions: - - key: ENC[AES256_GCM,data:H7+ITzzjHDUEp0S1StQdhR8boM8=,iv:shPNxrM5kuzL0rM2ro8WT8RyVuz/CmbH9CyalmWT7Tg=,tag:VWumtU5IK8Bf62LEB2b3Nw==,type:str] + - key: ENC[AES256_GCM,data:KNq9PvmPwNMneNpmmNW/ysyP3X4=,iv:gNa5O/D0ubMw0X4ru7orn36j2RrQ7iQEn77AzXonknk=,tag:9xC0JIqzIanslqpTbSLgfw==,type:str] operator: NotIn values: - "true" @@ -121,35 +128,35 @@ affinity: topologyKey: kubernetes.io/hostname tolerations: # Tolerate the failover taint so caddy CAN schedule on p330 (small-node-1). - - key: ENC[AES256_GCM,data:9zHboRH5nBUO,iv:IO30csmF3Sz5YUmvVbhZj5t8FextWnHDh/jgpc65y1U=,tag:LOsqaxYbLlTADuhZSY8fNA==,type:str] + - key: ENC[AES256_GCM,data:CfmLliVoJpWg,iv:hXn2virDViCTsig3KTpG92bIiR67J8Q1znv7EGddAPM=,tag:cmX5RIuQ52MLwsVD3fchfw==,type:str] operator: Equal - value: ENC[AES256_GCM,data:h8zjdogIMN4=,iv:iRAVuj9jfe4HHuJAoV9gN4zSU/eFzZaDMOfAujOxqr4=,tag:CCEYwHnLos+l1VvvIndtDg==,type:str] + value: ENC[AES256_GCM,data:kHylg1crZpY=,iv:BAFhKQr6MmqgwQ5sCkPjBc3E1zQwF0muukclRRctQIo=,tag:5MOgTEPhPJCYQl/fn/g9lQ==,type:str] effect: NoSchedule - - key: ENC[AES256_GCM,data:rRW0TkG62zRAhbWBV2bWcfJKrm0dHs6N7WE4DhSiQMvExUkgpQ==,iv:CZYuuxH0rFdnCu/MzZpQAgQpI2ChfkAZyCPoUtpkm30=,tag:nmd1QopYn5pq64AX34lZNQ==,type:str] + - key: ENC[AES256_GCM,data:R7iJZh/6vOXnZfJ9UFSX8fc780oWv2Lkk2APf0LFBmyYMY6JOw==,iv:6DaA3d3BQMMOUh+N5+ptOgAwwg2QZen59J2nOyyswts=,tag:WWMsIea8vT+w4nuPHA2HGw==,type:str] operator: Exists effect: NoSchedule sops: - lastmodified: "2026-09-27T22:55:14Z" - mac: ENC[AES256_GCM,data:Ll/xUtd3OLEoeTIVHG3nzvi8hiTJuaTBSMPrWjBTxqma0KM5zE3FKUCEUDaiXesu/XXlSiA8gO7YwttmDPvUXoCNHXGQ0SvkO6m8Hj0hgaQgk74nM9esEsLv/SShl+uRVjZxfIhc0Ao43PJoZqZvHDUd0Kkebh/7/t5Sb3ggy7Q=,iv:uopg0kaXiFKjYz8jCC/395n9YzuQo54RWbHiwkgv+IU=,tag:F5O7vaKSxX4Gg7mSZ+3yLA==,type:str] + lastmodified: "2026-09-30T20:30:47Z" + mac: ENC[AES256_GCM,data:ATt+bgh+jbmu4qSP7ymZjhXBv64tKxvKXArf/CsNms95uo+5qcPnShZfH86V1FjHelIHXKxhdMaaaPlUnzzYSQmejhJKlC9t83eav0Ue1v1/vD9W07B2wI3driwfFOPKYv67wvSydBcQmOUuYp1VDuvsvfllgEgzmzJsNx+q2mI=,iv:prVWlmCM32Nu2qY3BeegEFo9IAhy2I5BU6lY9D0t84M=,tag:IsEkero8o9D1U5E2e+bdDA==,type:str] pgp: - - created_at: "2026-09-27T22:55:14Z" + - created_at: "2026-09-30T20:30:47Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMA7uy4qQr71wiAQ/8DpuQVg8C6MTbsbjCSdCqGBPB2eB0Vk7tnyRvxdpIRZ1E - fbQez6jSXrScJZGC5+IylEKyL50AIr3h9xiLsNsVveXe1v00Tl2+8ozc6oslCxib - u2ldEJOFEdmvzlSmg+r+Fxl/0Tos8ZHVirosMlXkpG6iY7zoXzxBJmA3/12oQnsm - gBqsBg/Tjd6PxlolT8M5CG8jg+17Fhupl4VSBZRaUH4SOLodmuwUSPJtUVdrloGf - dv6ZXjUxMHyejBbP5CrPhbwclh8Sf1MnZlAr6icxzTEVodbDG4qPVfY2nhW5i32S - 8N815C6ElOGU4qrf9ArxZFI1hLarQFm1jPPw4esOS544QRiYeHCgfm/qt9v9NHDL - Y6P9YdFHfy3i1t1jlLdvjFDrjBn75snCv9OKbb0EQkNdFhelFNwNlAskC//fKz2f - EHtC9QbZ22oitCFtq3zyx0pcm9Z9KMki/u8aO8lMdXFVxa/HI3zz50ebdP/Yxlud - 4TRiy3mZhij4zV9MA9AOBvrlUUw+Bde5xEG4BRFAHk5Ed0I/p08fcgPHu3SX/LTr - 6V38ME0jBU6D6nem/Lg4tiKUOfaliEFzPjQUIvFCnmKK7WHQ8RP+u0UW1LtNhNBw - eZWLPcYFzYLwm0Ad1qiby//rL06L7pvJG6WJ5bX/j3qkXIFNFsn/IbgK9euOvvnS - XAG3dhDOoDhWqU9rKVbMgBHNV1quRBmrNPOXBOelvOWoruFlCxaUU5cUsTdgXH51 - dej6Y8v//qHE8B9nV2r5dvGXUrCVYTF4FKC+6tY9eueB18bNoosPgykiG1Od - =6uqR + hQIMA7uy4qQr71wiAQ/+K1pDoq5wQ34ZdW1mh1R7ltdyvV01Y3+f9Rw7jC50LhQf + 3XyJnjsWIi5/BzcmEMkunIEvFvZdDgq/6md+rNces0Efheei5AvnNxhgi/OThx33 + Gwuhs6jqDUzDnKEMth0kpj0dAKVxJ0NtJRiu5VF+l4zQWQmjGCAy69yHdTcF6HqB + fSicOeTmZ0O1JrlT9BF/gnwDtfAX7WwXehTvF2v03oS/KhIeNCryVzMXJ9Sda0Yv + W3V+Ds6JhDCuV7/zCY4h7PYvicibb7fDUI8Qm1pe/Bu4A/m40gjdTGUdudGVE5UB + aQGF3xusdxouv80FLfNLVjjNr+fVrAjG2L4HNqHNiUbd36KlOo7Lssicu8yKi9BL + CctICAnrSoZzX1cv7BhTb+ww0sOKazR/sDLgdNx+4w4U51BH1gwyZTt1fZTtk5gM + 12meU0t2CZguy8GIBqe54SPYgHWBhR61HhZX/6M5rO4+LQL41K77Sp4ApWtfZvLZ + sbaVA3vwUKCl+YLBwog3T5OSj7cJisiCkHj4vQtZad7MafRr2pAYXdSInjvGsPtf + BTTYMzAcy4m1ctSi+LdNFr5vRn2M8d1GHaeAIEaKyFMaCuJDGOjx5pBmZzGLEEHt + 08HeZjxmkPvYFWlHypvDcj+kbleXS0eWQ2muKSavk7fmFYN1UQhBdFYln81WJkHS + XgFnwZo7Rb9lQRc5ACIR/6x30kiXDcB5AB7EeHIJsGEbD7aE5DpvMh4T2mS7uObk + Ow+SMwe4Ny5D81neGMcBgJdHLRnIqtif4Lb4nYntrhLw0l7Dr6hkvCKGWWE83fE= + =r3HN -----END PGP MESSAGE----- fp: DC6910268E657FF70BA7EC289974494E76938DDC encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$ diff --git a/kubernetes/kustomization.yaml b/kubernetes/kustomization.yaml index d15481c..5060538 100644 --- a/kubernetes/kustomization.yaml +++ b/kubernetes/kustomization.yaml @@ -46,6 +46,7 @@ resources: - utilities/open-webui # Production (public-facing websites/apps) - production/buildpath + - production/saggar - production/semery-fr - production/umami - production/vhaudiquet-fr diff --git a/kubernetes/production/saggar/gitea-oidc-secret.yaml b/kubernetes/production/saggar/gitea-oidc-secret.yaml new file mode 100644 index 0000000..c2634f4 --- /dev/null +++ b/kubernetes/production/saggar/gitea-oidc-secret.yaml @@ -0,0 +1,40 @@ +# Gitea OIDC client credentials for the saggar login provider — the +# OAuth2 application registered on git.vhaudiquet.fr (Profile → +# Applications → OAuth2), with redirect URI +# https://saggar.dev/auth/callback/gitea +# +apiVersion: v1 +kind: Secret +metadata: + name: saggar-gitea-oidc + namespace: saggar +type: Opaque +stringData: + client-id: ENC[AES256_GCM,data:8NHXVbeLNBbFfxtVDk8AtbBWnjpwMWlihjqoEFSJmCDH3Cjz,iv:3PqTABU6ZxNEm0jshvDEkKbSHpdqf2/7DzVVjx/cXVA=,tag:YYuNIQU4nsNxVWZA2WVVbw==,type:str] + client-secret: ENC[AES256_GCM,data:WiqVhGyNHyeVQY9bX2qkvcaiasejyUUyNXBN4kTKl+TfP8vsedex0U8Va5Ns+9KW/Uget3+kH/o=,iv:K1zLz8am7Vox5IZc5zSDSEeDu9t6R5swEeeqTRrnZdo=,tag:OEbZAqNBkgpX/RdvH5Tb8g==,type:str] +sops: + lastmodified: "2026-09-30T20:30:47Z" + mac: ENC[AES256_GCM,data:MKm2CMBDtNL2GzO2pvmX7WLcTYNap9Xh/loBjZESkHbS65V2QpNU4+yTXcDewyDld9q2zKock1kPRQbhSyptlpxRQN6WZ+LhenS3f6p7rjPq+6gquNJ9j6ccgMFKvBKXoitYsbvfdpp6F6FN8vj24aH6OmTO2gUuvsdj7LIF1bI=,iv:20tkg9yg1kPeo2tbNbXNKNWXAbUqL352NV3+HOCqnqQ=,tag:35vyPxiRTUPuQkxy1/zD0Q==,type:str] + pgp: + - created_at: "2026-09-30T20:30:47Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA7uy4qQr71wiAQ/+INz4B5GdyNfaR4b6DXha7chZN3Qh+nh8oRduzFGKak76 + C3fANw2+HJ4/eV/j1ImNMbON0v7fbPpEe417nkRPESxnkEONi2Rrt0qoCVtnI64u + isewcMXEJCvTqAa460lE5AIC3tMjfYZd7h3tUe9N7HL3ufOB7hDVflGq954Zo+qu + rwGH5RZ5s4B5xnW6upVia+TRpu907ibpCKSfzm2uH6CRSIuuvIZrhu/qMnEUaa9F + 9SEEr87orU7YhYltPmK6k3oFaZLbXNsIYCLl7AIeMA3ZlvKKwk4HkTxYU5BUsAK9 + Zhv7yWIFyhTLVOv2k1dbOym3aRGe2KA/+LGHn0bi9ps2A5Vf6rSIQ1v2ya+OVCmw + Ibofs6/pfI1sZ56pOo1BGv0e6hBTe+jzimtBrTSAuCytDcTDmWusnH3HU8EefanN + 96Dw1NMCVqYn+yl8CL9UPMOL4UT+CDJEbWVBjfVvsoeaER+ipPbspo9eRZypq7D7 + aOWrP9Uiig/PeLt4ZMpsTWM27/tsVy2CPEFQ+XlgandVLQ6qTUQK42oAtepDSWuP + z8b12dkZ+xraI/wPqlrf6fXU+oKU2KteZxiMn89KqEgTbMp+BGycDHsKLA7VE+uz + Ni97MN8fbkT85VgwGE95xvUDGMMGyQuJrKbwc6gXzHQoCzZ/RfPBSUeXM4iyAa3S + XgGXEdIV02aQjl+kOqXu1VZLDVnb46fXTA5GDU51HKHeyT6YoE3rNljdFp2/hub/ + rYX5lJ4j8XXo6s9xUQ3BEw3JMbrc0++SrIXGk3Hqid3Ez+cBm3Q/wqF3YpF5tIs= + =GpPh + -----END PGP MESSAGE----- + fp: DC6910268E657FF70BA7EC289974494E76938DDC + encrypted_regex: ^(data|stringData|.*key|.*crt)$ + version: 3.10.2 diff --git a/kubernetes/production/saggar/kustomization.yaml b/kubernetes/production/saggar/kustomization.yaml new file mode 100644 index 0000000..ba63a80 --- /dev/null +++ b/kubernetes/production/saggar/kustomization.yaml @@ -0,0 +1,15 @@ +apiVersion: kustomize.config.k8s.io/v1beta1 +kind: Kustomization +namespace: saggar +resources: + - namespace.yaml + - packages-auth-secret.yaml + - gitea-oidc-secret.yaml + - repository.yaml + - release.yaml +secretGenerator: + - name: saggar-values + files: + - values.yaml=values.yaml +configurations: + - kustomizeconfig.yaml diff --git a/kubernetes/production/saggar/kustomizeconfig.yaml b/kubernetes/production/saggar/kustomizeconfig.yaml new file mode 100644 index 0000000..3365acc --- /dev/null +++ b/kubernetes/production/saggar/kustomizeconfig.yaml @@ -0,0 +1,6 @@ +nameReference: +- kind: Secret + version: v1 + fieldSpecs: + - path: spec/valuesFrom/name + kind: HelmRelease diff --git a/kubernetes/production/saggar/namespace.yaml b/kubernetes/production/saggar/namespace.yaml new file mode 100644 index 0000000..829f9f5 --- /dev/null +++ b/kubernetes/production/saggar/namespace.yaml @@ -0,0 +1,4 @@ +apiVersion: v1 +kind: Namespace +metadata: + name: saggar diff --git a/kubernetes/production/saggar/packages-auth-secret.yaml b/kubernetes/production/saggar/packages-auth-secret.yaml new file mode 100644 index 0000000..6b8267a --- /dev/null +++ b/kubernetes/production/saggar/packages-auth-secret.yaml @@ -0,0 +1,38 @@ +# Basic auth for the private Gitea Helm repository (org `saggar`) — +# the same access token also goes into values.yaml's imageCredentials +# for the container pulls (the chart renders the imagePullSecret). +apiVersion: v1 +kind: Secret +metadata: + name: saggar-packages-auth + namespace: saggar +type: Opaque +stringData: + username: ENC[AES256_GCM,data:gQXori8DR18jnw==,iv:X1rqJ3gTlIdY6qDYYDLjW+r+/PZVvVvZJaHuRflA50k=,tag:QOLVAuGO/deRAxwelHq3jA==,type:str] + password: ENC[AES256_GCM,data:aGrzZOtE7PeFXB8ybbAGgVdstb6De7ha/GARPyXP8nxP/tv542d3YQ==,iv:ngBYMmLVtG/5Au5txvzM25LOT2FswrAHP7LMRth2yek=,tag:+uKN2Zjl/ueYIHrXvWBTaA==,type:str] +sops: + lastmodified: "2026-09-30T20:30:48Z" + mac: ENC[AES256_GCM,data:G5Z0s30VsnEsvCVQin/fNg8n2UamvhDv4TMOzvBWXXjW5b43aXdzbQ++x3AetBCgocuTkAXqoPmpYG5f0DVH3n+55lqeE3ChtUlkb0S3zJPZ1jna5rNqKHMFuI8nItyxowAVVKJ06tscRCPlvwRcYWuTGEep0Lq7fSgt6BR/7TQ=,iv:x0uJXcRo8CDjzd4msHMBwloATMryQxmo3eGpzBhzn80=,tag:AwI4lslApzy0wyJgRcYdLg==,type:str] + pgp: + - created_at: "2026-09-30T20:30:47Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA7uy4qQr71wiARAAsQDZ1Uan1oGs6/mBJ9RvdMWH7fhCJfIWXv9Ldljn9lFv + Cp7ygWA9xgmUW2emtybn28s6uNr4kEH5/x5+0BIIVAmb/LKWi40bQKhSuaWKEgZf + OmZMNRilgwKFODbfif7UzsjKmogJ5DBFZqiJXP9uFSbF8klH4HSbJcKHR9jCjiM8 + cnWcpZ4xPaPxV7ARC8vKh3jvC7Eh6ivjEhJJSUQTt7w4ucs2e07n2WrCLAQDtu4m + xzVMDV6y2Far3Rv3Lk5O+FRprmpIKhGwU5nfEFighj7K8/ynZDUEsE5EUtuxDw1p + BBFFAsuNf4J+qVctfCFwEr2PTsT1VU0jKcB6t9lJZE3aT2xu9mu1Ezn9m/YGWzp2 + airb4UVACWLXj9sqcv7YIG8aUHpm7qVm8AE5UF1OhNJbDCQbpUEklGNRV3N0R4nr + ehatG1fCLUmXj7CUHdLmfGkhahfUIl2SJAp42h9VdQN8NB8Plj4j+hzluZSqU8XS + KP7kdIbDheeqZvSxA4KAeXrvvUzOWp4VK6ClL9pVjEh5HTu38atFGQ99daILy95L + f2z4l1Gc73+zRCHWPKtz5SiPT/G4RlxL2lrgKnykfpOCbJ7wV+XC5kAi+Lj8BM7s + EB2bqYewal8k2+VVFGD8vzyB/0mV2i37AJFJ8uJTU09D0CKGpDlgrFw1D3YkwA/S + XgGxHYtmARZxCBEbCeizPE4nk+UZtvVtngPUKABPe5euwX40kOwy81dadjoIZsks + Vev3d9txiEO6QKcx5rTEp7uju9QO8meqWIM97f0dB1hj1l+tRwmo91XJVKBRgFQ= + =ZysC + -----END PGP MESSAGE----- + fp: DC6910268E657FF70BA7EC289974494E76938DDC + encrypted_regex: ^(data|stringData|.*key|.*crt)$ + version: 3.10.2 diff --git a/kubernetes/production/saggar/release.yaml b/kubernetes/production/saggar/release.yaml new file mode 100644 index 0000000..11ab095 --- /dev/null +++ b/kubernetes/production/saggar/release.yaml @@ -0,0 +1,19 @@ +apiVersion: helm.toolkit.fluxcd.io/v2 +kind: HelmRelease +metadata: + name: saggar + namespace: saggar +spec: + interval: 1m + chart: + spec: + sourceRef: + kind: HelmRepository + name: saggar + namespace: saggar + chart: saggar-hub + version: '>=0.2.0-0' + interval: 1m + valuesFrom: + - kind: Secret + name: saggar-values diff --git a/kubernetes/production/saggar/repository.yaml b/kubernetes/production/saggar/repository.yaml new file mode 100644 index 0000000..3de4a7a --- /dev/null +++ b/kubernetes/production/saggar/repository.yaml @@ -0,0 +1,10 @@ +apiVersion: source.toolkit.fluxcd.io/v1 +kind: HelmRepository +metadata: + name: saggar + namespace: saggar +spec: + interval: 1m + url: https://git.vhaudiquet.fr/api/packages/saggar/helm + secretRef: + name: saggar-packages-auth diff --git a/kubernetes/production/saggar/values.yaml b/kubernetes/production/saggar/values.yaml new file mode 100644 index 0000000..1abb36a --- /dev/null +++ b/kubernetes/production/saggar/values.yaml @@ -0,0 +1,88 @@ +# Hub mode (the chart default): intake + registries + web UI, with +# artifacts in the release's embedded Garage store (chart default in +# hub mode, longhorn-backed). Builds happen on runners from the +# saggar-worker chart, to be paired against this hub once it is up. +image: + repository: git.vhaudiquet.fr/saggar/saggar + # Empty: follows the chart's appVersion — the commit SHA CI stamped + # on the pushed images. + tag: "" +# Private Gitea registry: the chart renders an imagePullSecret from +# these. Same access token as packages-auth-secret.yaml (the +# pre-commit sops hook encrypts this file). +imageCredentials: + create: true + registry: git.vhaudiquet.fr + username: ENC[AES256_GCM,data:/BEuQFoDxyFVzQ==,iv:O4X+Q3DhkCItIHABBrHYRI842vI86NTmAx1jEtIrOrw=,tag:+H6KUFV4H+uDAyBxEbsj6g==,type:str] + password: ENC[AES256_GCM,data:S88PWTFhnBeDK+ofX9AOJLeuM+YN1tnd2IL453Mv4gk0Rbr4ttTgcQ==,iv:7UFDQn1VZG7e/z/Su1lOJeMgnNzWYevv9PoCOPSA810=,tag:eyFF74hIY4Tj6zoBpvhJ+w==,type:str] +# Login via the home Gitea: the engine is the confidential client of +# the provider and runs every code exchange, so its discovery drives +# the endpoints (issuer verified live). Credentials live in +# gitea-oidc-secret.yaml — both ride the Secret (clientIdKey opts the +# id in too), so nothing sensitive renders into the ConfigMap. The UI +# needs nothing: it discovers the provider from the engine's open +# /auth/methods. +auth: + providers: + - name: gitea + issuer: https://git.vhaudiquet.fr + existingSecret: ENC[AES256_GCM,data:QU4XxTO9yYTtAD1DIVrHeHs=,iv:R63SB9qZqCoI2VThliV1jobCMmGYJw+GKwfRp0CSMz0=,tag:TjFWZdjsfm0AgqPRbv5uBQ==,type:str] + clientIdKey: client-id + clientSecretKey: ENC[AES256_GCM,data:NCzGSzyzi1sK0L2AFA==,iv:t9JRUnHCEMedeW/+IXWKY4XDCweJIi7MDYI5EBtpvQE=,tag:uSX2qj8ZoQbW9Iww1Y3NNQ==,type:str] +ingress: + enabled: true + className: traefik + # The engine host: CLI intake + the docker/apt registry front-ends. + host: api.saggar.dev + # The chart's default annotations are nginx-specific (SSE + # buffering); traefik streams unbuffered by default, so clear them. + annotations: {} + # TLS terminates at Caddy with the cert-manager saggar.dev certs; + # Caddy proxies to Traefik by host, so no tls block here (same as + # pkgatlas's ingress). + tls: + enabled: false +ui: + # Sign-in redirect base — the UI's own public origin. + publicBaseUrl: https://saggar.dev + # The engine's public origin for the docker pull / apt usage lines. + # Set explicitly: the chart derives it from the hub ingress, whose + # tls is off here (Caddy terminates) — that would render http://. + apiPublicOrigin: https://api.saggar.dev + ingress: + enabled: true + className: traefik + # The UI lives on its own host: the engine mounts its API and + # registry surfaces at root (/v2, /apt, /nodes), paths the UI + # pages also use. + host: saggar.dev + annotations: {} + tls: + enabled: false +sops: + lastmodified: "2026-09-30T20:30:47Z" + mac: ENC[AES256_GCM,data:jo02sAVCmt1qO+2DUOjWSAXo47OzviRvz/GEX7hU/g4U1CyhKP/zHxoAIeCAOVnL4DJ+w0ayYuU16Im/iFa2tVnvpRVhVpnUgDgin11EukeLizUodAbm9mmsdBqlivrRxjf7yj8Czg6VOHHtcUMLQcXIgwTZ2GoSotXN7EBp+FM=,iv:149oaU4BK7gjgb0mZPMrB62L4KxbeQyVtW0r8Ox7BKg=,tag:hnVG7Wg/zGiGl1KjO8olCA==,type:str] + pgp: + - created_at: "2026-09-30T20:30:47Z" + enc: |- + -----BEGIN PGP MESSAGE----- + + hQIMA7uy4qQr71wiARAAnlK3L9KylJuKOT8XrUI7L7ax+K2XEqQh3bXtByc1y1ns + ka5iGUuuMT00T88y0J1DuOiGj51WiZtKyr1pOVmqsS/uVYXE7FruR2A/KWrZEVG0 + wb8UuPP/TWbo8vc3uvq/ivTv70CnfjGI43uv12r51EsIbCvnSikI6p5tAzX8bwoI + Ei/wQexFlz82Vc0qZ0Dmw6aa1pkDBrN5jIW47WPRUnFwpejdA5ZsvdeBxeeiPJXh + iXMbqp9R2A5615WdZaVoSzSTacRk4LU3zcDhGWkr7ja37+BYer9ZBbNrh/tA4GH5 + EjmbNkmR6A5Ra3TII8/B4ycqwhShuyjSV6bj+TCV2J8VGCvI+20PIcDP8SGIBhLg + JHmpGTwc2pjRD4Ekgt6rrOoKYLpP16ooEbqdxHmzhWHfKCI8v6yinSaU3Lz9vXL5 + TeRCZ9fIZB5zXE1nEeAFCGHfOV/HQCP9Z1/x8EsflH0SYosx/jjOUFSP8Q+AsJ/+ + ompNtICXVliM1jsebhGNwBdadfe/8T1M/zwdof/XY+6myKGNxhxFNbq/B92Ppwo9 + KYYCImMgLRUKjQLgBqJrzL6jkqWUwGpCfcgdsZQyFLzGzUIkbCITPCNLiMb195PS + ruJ2NJZA4YCZ8OapzBRI7KFAH+s00ipE25wK85zsS3f41RwZKHG0XE09l/bJFDTS + XAEA78VEJxsCtdMHtSX2cGvDOc5PGT8qDwvn5O8ubDjPN11u1rL24yYdzEsHEzbL + F0TT5R7s5FQk1YOCzXVaFOKFEnpU4STRm9uYKP7SUYJUyT/TzzNu5iYaachA + =Y1SN + -----END PGP MESSAGE----- + fp: DC6910268E657FF70BA7EC289974494E76938DDC + encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$ + mac_only_encrypted: true + version: 3.10.2