saggar(kube): deploy

Flux HelmRelease of the saggar hub (chart saggar-hub >=0.2.0-0,
CI-published on the gitea saggar org, appVersion pinned to the image
commit) with the web UI. Engine on api.saggar.dev for the CLI and the
docker/apt registries, UI on saggar.dev — new cert, caddy route and
dns A record for the api host, TLS terminating at Caddy as usual.
Login via the home Gitea as an OIDC provider; private registry and
helm repo auth share one packages token.

kubernetes/production/saggar/gitea-oidc-secret.yaml

@@ -0,0 +1,40 @@
+# Gitea OIDC client credentials for the saggar login provider — the
+# OAuth2 application registered on git.vhaudiquet.fr (Profile →
+# Applications → OAuth2), with redirect URI
+#   https://saggar.dev/auth/callback/gitea
+#
+apiVersion: v1
+kind: Secret
+metadata:
+    name: saggar-gitea-oidc
+    namespace: saggar
+type: Opaque
+stringData:
+    client-id: ENC[AES256_GCM,data:8NHXVbeLNBbFfxtVDk8AtbBWnjpwMWlihjqoEFSJmCDH3Cjz,iv:3PqTABU6ZxNEm0jshvDEkKbSHpdqf2/7DzVVjx/cXVA=,tag:YYuNIQU4nsNxVWZA2WVVbw==,type:str]
+    client-secret: ENC[AES256_GCM,data:WiqVhGyNHyeVQY9bX2qkvcaiasejyUUyNXBN4kTKl+TfP8vsedex0U8Va5Ns+9KW/Uget3+kH/o=,iv:K1zLz8am7Vox5IZc5zSDSEeDu9t6R5swEeeqTRrnZdo=,tag:OEbZAqNBkgpX/RdvH5Tb8g==,type:str]
+sops:
+    lastmodified: "2026-09-30T20:30:47Z"
+    mac: ENC[AES256_GCM,data:MKm2CMBDtNL2GzO2pvmX7WLcTYNap9Xh/loBjZESkHbS65V2QpNU4+yTXcDewyDld9q2zKock1kPRQbhSyptlpxRQN6WZ+LhenS3f6p7rjPq+6gquNJ9j6ccgMFKvBKXoitYsbvfdpp6F6FN8vj24aH6OmTO2gUuvsdj7LIF1bI=,iv:20tkg9yg1kPeo2tbNbXNKNWXAbUqL352NV3+HOCqnqQ=,tag:35vyPxiRTUPuQkxy1/zD0Q==,type:str]
+    pgp:
+        - created_at: "2026-09-30T20:30:47Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ/+INz4B5GdyNfaR4b6DXha7chZN3Qh+nh8oRduzFGKak76
+            C3fANw2+HJ4/eV/j1ImNMbON0v7fbPpEe417nkRPESxnkEONi2Rrt0qoCVtnI64u
+            isewcMXEJCvTqAa460lE5AIC3tMjfYZd7h3tUe9N7HL3ufOB7hDVflGq954Zo+qu
+            rwGH5RZ5s4B5xnW6upVia+TRpu907ibpCKSfzm2uH6CRSIuuvIZrhu/qMnEUaa9F
+            9SEEr87orU7YhYltPmK6k3oFaZLbXNsIYCLl7AIeMA3ZlvKKwk4HkTxYU5BUsAK9
+            Zhv7yWIFyhTLVOv2k1dbOym3aRGe2KA/+LGHn0bi9ps2A5Vf6rSIQ1v2ya+OVCmw
+            Ibofs6/pfI1sZ56pOo1BGv0e6hBTe+jzimtBrTSAuCytDcTDmWusnH3HU8EefanN
+            96Dw1NMCVqYn+yl8CL9UPMOL4UT+CDJEbWVBjfVvsoeaER+ipPbspo9eRZypq7D7
+            aOWrP9Uiig/PeLt4ZMpsTWM27/tsVy2CPEFQ+XlgandVLQ6qTUQK42oAtepDSWuP
+            z8b12dkZ+xraI/wPqlrf6fXU+oKU2KteZxiMn89KqEgTbMp+BGycDHsKLA7VE+uz
+            Ni97MN8fbkT85VgwGE95xvUDGMMGyQuJrKbwc6gXzHQoCzZ/RfPBSUeXM4iyAa3S
+            XgGXEdIV02aQjl+kOqXu1VZLDVnb46fXTA5GDU51HKHeyT6YoE3rNljdFp2/hub/
+            rYX5lJ4j8XXo6s9xUQ3BEw3JMbrc0++SrIXGk3Hqid3Ez+cBm3Q/wqF3YpF5tIs=
+            =GpPh
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
+    version: 3.10.2

kubernetes/production/saggar/kustomization.yaml

@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: saggar
+resources:
+  - namespace.yaml
+  - packages-auth-secret.yaml
+  - gitea-oidc-secret.yaml
+  - repository.yaml
+  - release.yaml
+secretGenerator:
+  - name: saggar-values
+    files:
+      - values.yaml=values.yaml
+configurations:
+  - kustomizeconfig.yaml

kubernetes/production/saggar/kustomizeconfig.yaml

@@ -0,0 +1,6 @@
+nameReference:
+- kind: Secret
+  version: v1
+  fieldSpecs:
+  - path: spec/valuesFrom/name
+    kind: HelmRelease

kubernetes/production/saggar/namespace.yaml

@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+    name: saggar

kubernetes/production/saggar/packages-auth-secret.yaml

@@ -0,0 +1,38 @@
+# Basic auth for the private Gitea Helm repository (org `saggar`) —
+# the same access token also goes into values.yaml's imageCredentials
+# for the container pulls (the chart renders the imagePullSecret).
+apiVersion: v1
+kind: Secret
+metadata:
+    name: saggar-packages-auth
+    namespace: saggar
+type: Opaque
+stringData:
+    username: ENC[AES256_GCM,data:gQXori8DR18jnw==,iv:X1rqJ3gTlIdY6qDYYDLjW+r+/PZVvVvZJaHuRflA50k=,tag:QOLVAuGO/deRAxwelHq3jA==,type:str]
+    password: ENC[AES256_GCM,data:aGrzZOtE7PeFXB8ybbAGgVdstb6De7ha/GARPyXP8nxP/tv542d3YQ==,iv:ngBYMmLVtG/5Au5txvzM25LOT2FswrAHP7LMRth2yek=,tag:+uKN2Zjl/ueYIHrXvWBTaA==,type:str]
+sops:
+    lastmodified: "2026-09-30T20:30:48Z"
+    mac: ENC[AES256_GCM,data:G5Z0s30VsnEsvCVQin/fNg8n2UamvhDv4TMOzvBWXXjW5b43aXdzbQ++x3AetBCgocuTkAXqoPmpYG5f0DVH3n+55lqeE3ChtUlkb0S3zJPZ1jna5rNqKHMFuI8nItyxowAVVKJ06tscRCPlvwRcYWuTGEep0Lq7fSgt6BR/7TQ=,iv:x0uJXcRo8CDjzd4msHMBwloATMryQxmo3eGpzBhzn80=,tag:AwI4lslApzy0wyJgRcYdLg==,type:str]
+    pgp:
+        - created_at: "2026-09-30T20:30:47Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiARAAsQDZ1Uan1oGs6/mBJ9RvdMWH7fhCJfIWXv9Ldljn9lFv
+            Cp7ygWA9xgmUW2emtybn28s6uNr4kEH5/x5+0BIIVAmb/LKWi40bQKhSuaWKEgZf
+            OmZMNRilgwKFODbfif7UzsjKmogJ5DBFZqiJXP9uFSbF8klH4HSbJcKHR9jCjiM8
+            cnWcpZ4xPaPxV7ARC8vKh3jvC7Eh6ivjEhJJSUQTt7w4ucs2e07n2WrCLAQDtu4m
+            xzVMDV6y2Far3Rv3Lk5O+FRprmpIKhGwU5nfEFighj7K8/ynZDUEsE5EUtuxDw1p
+            BBFFAsuNf4J+qVctfCFwEr2PTsT1VU0jKcB6t9lJZE3aT2xu9mu1Ezn9m/YGWzp2
+            airb4UVACWLXj9sqcv7YIG8aUHpm7qVm8AE5UF1OhNJbDCQbpUEklGNRV3N0R4nr
+            ehatG1fCLUmXj7CUHdLmfGkhahfUIl2SJAp42h9VdQN8NB8Plj4j+hzluZSqU8XS
+            KP7kdIbDheeqZvSxA4KAeXrvvUzOWp4VK6ClL9pVjEh5HTu38atFGQ99daILy95L
+            f2z4l1Gc73+zRCHWPKtz5SiPT/G4RlxL2lrgKnykfpOCbJ7wV+XC5kAi+Lj8BM7s
+            EB2bqYewal8k2+VVFGD8vzyB/0mV2i37AJFJ8uJTU09D0CKGpDlgrFw1D3YkwA/S
+            XgGxHYtmARZxCBEbCeizPE4nk+UZtvVtngPUKABPe5euwX40kOwy81dadjoIZsks
+            Vev3d9txiEO6QKcx5rTEp7uju9QO8meqWIM97f0dB1hj1l+tRwmo91XJVKBRgFQ=
+            =ZysC
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
+    version: 3.10.2

kubernetes/production/saggar/release.yaml

@@ -0,0 +1,19 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+    name: saggar
+    namespace: saggar
+spec:
+    interval: 1m
+    chart:
+        spec:
+            sourceRef:
+                kind: HelmRepository
+                name: saggar
+                namespace: saggar
+            chart: saggar-hub
+            version: '>=0.2.0-0'
+            interval: 1m
+    valuesFrom:
+        - kind: Secret
+          name: saggar-values

kubernetes/production/saggar/repository.yaml

@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+    name: saggar
+    namespace: saggar
+spec:
+    interval: 1m
+    url: https://git.vhaudiquet.fr/api/packages/saggar/helm
+    secretRef:
+        name: saggar-packages-auth

kubernetes/production/saggar/values.yaml

@@ -0,0 +1,88 @@
+# Hub mode (the chart default): intake + registries + web UI, with
+# artifacts in the release's embedded Garage store (chart default in
+# hub mode, longhorn-backed). Builds happen on runners from the
+# saggar-worker chart, to be paired against this hub once it is up.
+image:
+    repository: git.vhaudiquet.fr/saggar/saggar
+    # Empty: follows the chart's appVersion — the commit SHA CI stamped
+    # on the pushed images.
+    tag: ""
+# Private Gitea registry: the chart renders an imagePullSecret from
+# these. Same access token as packages-auth-secret.yaml (the
+# pre-commit sops hook encrypts this file).
+imageCredentials:
+    create: true
+    registry: git.vhaudiquet.fr
+    username: ENC[AES256_GCM,data:/BEuQFoDxyFVzQ==,iv:O4X+Q3DhkCItIHABBrHYRI842vI86NTmAx1jEtIrOrw=,tag:+H6KUFV4H+uDAyBxEbsj6g==,type:str]
+    password: ENC[AES256_GCM,data:S88PWTFhnBeDK+ofX9AOJLeuM+YN1tnd2IL453Mv4gk0Rbr4ttTgcQ==,iv:7UFDQn1VZG7e/z/Su1lOJeMgnNzWYevv9PoCOPSA810=,tag:eyFF74hIY4Tj6zoBpvhJ+w==,type:str]
+# Login via the home Gitea: the engine is the confidential client of
+# the provider and runs every code exchange, so its discovery drives
+# the endpoints (issuer verified live). Credentials live in
+# gitea-oidc-secret.yaml — both ride the Secret (clientIdKey opts the
+# id in too), so nothing sensitive renders into the ConfigMap. The UI
+# needs nothing: it discovers the provider from the engine's open
+# /auth/methods.
+auth:
+    providers:
+        - name: gitea
+          issuer: https://git.vhaudiquet.fr
+          existingSecret: ENC[AES256_GCM,data:QU4XxTO9yYTtAD1DIVrHeHs=,iv:R63SB9qZqCoI2VThliV1jobCMmGYJw+GKwfRp0CSMz0=,tag:TjFWZdjsfm0AgqPRbv5uBQ==,type:str]
+          clientIdKey: client-id
+          clientSecretKey: ENC[AES256_GCM,data:NCzGSzyzi1sK0L2AFA==,iv:t9JRUnHCEMedeW/+IXWKY4XDCweJIi7MDYI5EBtpvQE=,tag:uSX2qj8ZoQbW9Iww1Y3NNQ==,type:str]
+ingress:
+    enabled: true
+    className: traefik
+    # The engine host: CLI intake + the docker/apt registry front-ends.
+    host: api.saggar.dev
+    # The chart's default annotations are nginx-specific (SSE
+    # buffering); traefik streams unbuffered by default, so clear them.
+    annotations: {}
+    # TLS terminates at Caddy with the cert-manager saggar.dev certs;
+    # Caddy proxies to Traefik by host, so no tls block here (same as
+    # pkgatlas's ingress).
+    tls:
+        enabled: false
+ui:
+    # Sign-in redirect base — the UI's own public origin.
+    publicBaseUrl: https://saggar.dev
+    # The engine's public origin for the docker pull / apt usage lines.
+    # Set explicitly: the chart derives it from the hub ingress, whose
+    # tls is off here (Caddy terminates) — that would render http://.
+    apiPublicOrigin: https://api.saggar.dev
+    ingress:
+        enabled: true
+        className: traefik
+        # The UI lives on its own host: the engine mounts its API and
+        # registry surfaces at root (/v2, /apt, /nodes), paths the UI
+        # pages also use.
+        host: saggar.dev
+        annotations: {}
+        tls:
+            enabled: false
+sops:
+    lastmodified: "2026-09-30T20:30:47Z"
+    mac: ENC[AES256_GCM,data:jo02sAVCmt1qO+2DUOjWSAXo47OzviRvz/GEX7hU/g4U1CyhKP/zHxoAIeCAOVnL4DJ+w0ayYuU16Im/iFa2tVnvpRVhVpnUgDgin11EukeLizUodAbm9mmsdBqlivrRxjf7yj8Czg6VOHHtcUMLQcXIgwTZ2GoSotXN7EBp+FM=,iv:149oaU4BK7gjgb0mZPMrB62L4KxbeQyVtW0r8Ox7BKg=,tag:hnVG7Wg/zGiGl1KjO8olCA==,type:str]
+    pgp:
+        - created_at: "2026-09-30T20:30:47Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiARAAnlK3L9KylJuKOT8XrUI7L7ax+K2XEqQh3bXtByc1y1ns
+            ka5iGUuuMT00T88y0J1DuOiGj51WiZtKyr1pOVmqsS/uVYXE7FruR2A/KWrZEVG0
+            wb8UuPP/TWbo8vc3uvq/ivTv70CnfjGI43uv12r51EsIbCvnSikI6p5tAzX8bwoI
+            Ei/wQexFlz82Vc0qZ0Dmw6aa1pkDBrN5jIW47WPRUnFwpejdA5ZsvdeBxeeiPJXh
+            iXMbqp9R2A5615WdZaVoSzSTacRk4LU3zcDhGWkr7ja37+BYer9ZBbNrh/tA4GH5
+            EjmbNkmR6A5Ra3TII8/B4ycqwhShuyjSV6bj+TCV2J8VGCvI+20PIcDP8SGIBhLg
+            JHmpGTwc2pjRD4Ekgt6rrOoKYLpP16ooEbqdxHmzhWHfKCI8v6yinSaU3Lz9vXL5
+            TeRCZ9fIZB5zXE1nEeAFCGHfOV/HQCP9Z1/x8EsflH0SYosx/jjOUFSP8Q+AsJ/+
+            ompNtICXVliM1jsebhGNwBdadfe/8T1M/zwdof/XY+6myKGNxhxFNbq/B92Ppwo9
+            KYYCImMgLRUKjQLgBqJrzL6jkqWUwGpCfcgdsZQyFLzGzUIkbCITPCNLiMb195PS
+            ruJ2NJZA4YCZ8OapzBRI7KFAH+s00ipE25wK85zsS3f41RwZKHG0XE09l/bJFDTS
+            XAEA78VEJxsCtdMHtSX2cGvDOc5PGT8qDwvn5O8ubDjPN11u1rL24yYdzEsHEzbL
+            F0TT5R7s5FQk1YOCzXVaFOKFEnpU4STRm9uYKP7SUYJUyT/TzzNu5iYaachA
+            =Y1SN
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
+    version: 3.10.2