semery.fr: add OVH-specific webhook solver

.github/dependabot.yml

@@ -55,6 +55,7 @@ updates:
       - "/kubernetes/system/blocky"
       - "/kubernetes/system/caddy"
       - "/kubernetes/system/cert-manager"
+      - "/kubernetes/system/cert-manager-webhook-ovh"
       - "/kubernetes/system/coredns"
       - "/kubernetes/system/csi-driver-nfs"
       - "/kubernetes/system/external-dns"

kubernetes/system/caddy/kustomization.yaml

@@ -6,6 +6,7 @@ resources:
   - repository.yaml
   - release.yaml
   - certificates.yaml
+  - ovh-credentials-secret.yaml
   - caddyfile.yaml
 secretGenerator:
   - name: caddy-values

kubernetes/system/caddy/ovh-credentials-secret.yaml

@@ -0,0 +1,45 @@
+# OVH API Credentials for DNS-01 Challenges
+#
+# OVH API credentials with the following permissions:
+#   - GET, POST, PUT, DELETE on /domain/zone/*
+#
+# SOPS will encrypt them on pre-commit.
+apiVersion: v1
+kind: Secret
+metadata:
+    name: ovh-credentials
+    namespace: caddy
+    labels:
+        app.kubernetes.io/name: caddy
+        app.kubernetes.io/component: ovh-credentials
+type: Opaque
+stringData:
+    applicationKey: ENC[AES256_GCM,data:kBPCJRdm3VeoFKsmig+l8g==,iv:Y21zRzFpA7tqjNFruHCIIZV8hsSGhypZhcWgh7AcUus=,tag:8F0160EP0ELVFe4bp2AarA==,type:str]
+    applicationSecret: ENC[AES256_GCM,data:0r9bolcuWfbgQ993L+wPZaqfLB4TXcptCFw+/D9t9LI=,iv:j1pdJI4DrAzQxP8W/qJ0UBg/2rZQn/Z3aY0qZcqJqQ8=,tag:wNk8FxsUXBUiiYEayl3c1g==,type:str]
+    consumerKey: ENC[AES256_GCM,data:79prnqUwFgpc6peVWYtkp+L66HuB7bcXHNljSdVkpqU=,iv:sxNGszLobl7/uK6HpXhuUlA9BiURS9j9bLjeY+iwrxw=,tag:JoOKkvK+y5k45U9M6TC1cA==,type:str]
+sops:
+    lastmodified: "2026-07-09T22:12:21Z"
+    mac: ENC[AES256_GCM,data:xPUFPlXWHWY/c/EzhfQhWc0JsRZ6qvuB7amxksqkotSbIIYuw90YheKHNwj9ZEqlE2gSmZYI0Cog03KCZlijeX7qKOWDgiLSf4zFT/X0uxcUoOuWvrj2nISjqT+mUJFjzPPHwBgtObH+N0LEYGhURdeJgIvbKh15kZRNqxKlCQw=,iv:E9xOdeiX+lbLR8Lz3APEYudOeF5mQk0Nvq2byzXiSxg=,tag:shDwlpvDfzacKiPuqzQzrg==,type:str]
+    pgp:
+        - created_at: "2026-07-09T22:12:21Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ//b7KcKq2BXfSU8DynNDo/QlZ77lfCYHsPMutbNh5ckpCi
+            JPoy06kZ9JtwET86lnv8awUuztA1CPN6uarrGqokZW4zaATHmQ0M5qHHOXClnI+X
+            VIL3/mcCH/sTN+/RO0vmnPcah8XnETzy/51GDvoMAeFIndVz/t/uKbAErwch1+Ol
+            Ds51d0MrdZxCAXxYcWr9WcLK7rLCyFd0r+TFb4buHswNIRNQvzJti0rkPac7wFNE
+            vjb05wr3ejdes5P9drQF5sUhZXZHAWOoZUKGBm4hUBLaQqSfqFnskKeSuyVXR+di
+            xiqrkuvOydNSPVpO9M+qCyZqiiE+cPL1t8wwqXiNPUhibeKsdUKOibI/XGO4QvCr
+            wDZt/Dcj8JfVw6SFEUP/TVaP+SW4T8tEoxIScR17DEn/eKiFp/dFQZ9pokaKM2kd
+            uhxrO7/FbA5KDMK2IZncV40IioAG/caFswM944ShMbJ5IJlFQv7OASPjwtauGnuY
+            9O/7XMAZas7u+PhBuxqdQ/3YVrCVyYnvxsQ/+TbX6pIY1w9rgwh+XamVln083P+c
+            4gcBfL/1vv2RzVKhkAQ9k5++Af3Vn6JpkKu1FqUHVmOf3nH9vUxqQTwSwAu6Pi2W
+            6BZKq0UdbYi6v6Ozi06V1z4qa0t2IC+LOA5dILpReE7M2EM+b/tRRpp514NAmUzS
+            XAEAAY0b6IKDlwAqHQVAg2TuTDGHm7rHSpxtllsXx+902zYttisRZKjQgJuWLdST
+            kb4WPMRUq1y97BMJddXjf6L6ganzRSpDV/1cq832S8x+7Qe2aiQ6/nnLxP0I
+            =8mxw
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(data|stringData|.*.key|.*.crt)$
+    version: 3.10.2

kubernetes/system/cert-manager-issuer/clusterissuer.yaml

@@ -22,19 +22,22 @@ spec:
           dnsZones:
             - vhaudiquet.fr
             - buildpath.win
-      # OVH solver for semery.fr
+      # OVH solver for semery.fr (via cert-manager-webhook-ovh)
       - dns01:
-          ovh:
+          webhook:
-            endpoint: ovh-eu
+            groupName: acme.aureq.com
-            applicationKeyRef:
+            solverName: ovh
-              name: ovh-credentials
+            config:
-              key: applicationKey
+              endpoint: ovh-eu
-            applicationSecretRef:
+              applicationKeyRef:
-              name: ovh-credentials
+                name: ovh-credentials
-              key: applicationSecret
+                key: applicationKey
-            consumerKeyRef:
+              applicationSecretRef:
-              name: ovh-credentials
+                name: ovh-credentials
-              key: consumerKey
+                key: applicationSecret
+              consumerKeyRef:
+                name: ovh-credentials
+                key: consumerKey
         selector:
           dnsZones:
             - semery.fr

kubernetes/system/cert-manager-webhook-ovh/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: cert-manager
+resources:
+  - repository.yaml
+  - release.yaml
+secretGenerator:
+  - name: cert-manager-webhook-ovh-values
+    files:
+      - values.yaml=values.yaml
+configurations:
+  - kustomizeconfig.yaml

kubernetes/system/cert-manager-webhook-ovh/kustomizeconfig.yaml

@@ -0,0 +1,11 @@
+nameReference:
+  - kind: HelmRepository
+    version: v1
+    fieldSpecs:
+      - path: spec/chart/spec/sourceRef/name
+        kind: HelmRelease
+  - kind: Secret
+    version: v1
+    fieldSpecs:
+      - path: spec/valuesFrom/name
+        kind: HelmRelease

kubernetes/system/cert-manager-webhook-ovh/release.yaml

@@ -0,0 +1,19 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cert-manager-webhook-ovh
+  namespace: cert-manager
+spec:
+  interval: 1m
+  chart:
+    spec:
+      sourceRef:
+        kind: HelmRepository
+        name: cert-manager-webhook-ovh
+        namespace: cert-manager
+      chart: cert-manager-webhook-ovh
+      version: "v0.9.13"
+      interval: 1m
+  valuesFrom:
+    - kind: Secret
+      name: cert-manager-webhook-ovh-values

kubernetes/system/cert-manager-webhook-ovh/repository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: cert-manager-webhook-ovh
+  namespace: cert-manager
+spec:
+  interval: 1m
+  url: https://aureq.github.io/cert-manager-webhook-ovh

kubernetes/system/cert-manager-webhook-ovh/values.yaml

@@ -0,0 +1,37 @@
+# cert-manager-webhook-ovh Values
+# Replicas
+replicaCount: 1
+# Resource settings
+resources:
+    requests:
+        cpu: 10m
+        memory: 32Mi
+    limits:
+        cpu: 100m
+        memory: 128Mi
+sops:
+    lastmodified: "2026-07-09T22:12:21Z"
+    mac: ENC[AES256_GCM,data:WC6VezA/Ks5BxalXRBWIGwBt9k0pTUY8etW33aBT7PrWFqQVC6XlHs4z6KHU0ka6uMc1JSaprw5QdvrOr1kKQUqgIJn9v/qELT8alOd9qzJkyLImEyH7NdI8N5hzgeEpFT1O0B+tFJ4IVxcQAQusr30dZo1AUE8JV2EUEE0OaJI=,iv:KuzSPwYaYm6cf0FBRKRXlK6m9lNVKtdhxnQryGRGtlw=,tag:ES71sI0rUctXhHXtFJ0nQg==,type:str]
+    pgp:
+        - created_at: "2026-07-09T22:12:21Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ//bXWkHjGoQhrI1yEwJSAi3j68wFOdO/GdGhX3ADZw8njM
+            b0fQdk+3WI7IDXV9l+Ii2PHP2gMZs8S+ejKXdhMrd28xefxwuJ5dtuOjhxdAPA7M
+            2jc8gitEpQW/TKHlyDfgaWIqLeJ/O/kuhYRfl0hQ3gYMjoHwZl/rrYlbSTT6jRLH
+            pbjILIIo3BAXQQJgthd+y7YL6G4QjVB96wgmPEoD7FBjarNZPlPpG7EzcPj6WB9a
+            rs3o7uudhjWZIKrJm0qbABxnkd1IPwwNvc/bvVMeXFPP3w8ZAD6spvBMPzrfGfSb
+            45SWw4lhwR57hrsK/cGVlQSwkJxhopndvk/apb2oE4q6dUbHSX21bRmjR+HO6E5A
+            eZgb8mcWFLgWmjrrAgZWvOSABV18s2d3EF6Vi8gAn8iLr6FjJcb3cfptbNOp26bT
+            2nGW5Ws3UZQEzcDveUJACJRhz7pir0Cn8kZ2xsdYX0KThJ62q9b13X05nisnPVVy
+            Q/NFPDTOBWIjh/TxaaOe2CXJxnKHSnxmLbfIFFOimc/P8HyBwFRT2L7MRKosTqI/
+            9zKyppxoi0Cu0KPG/0hF6FN7sQ32oPQwuzuaxhuIYIzyXoohrZ1QvlV7ZsFneHcl
+            0izl8HdM6+1CBy4Oiok6dWr1tGKuQVucWUUUDyvUg4h19LLNMT5eJe0/w1wsis/S
+            XgEE7DsaGavusuoEfkfx2y11mMHl6qnMNQgcRBLfq2vEpPgA4U3FB0lNrgMc5oHe
+            PdiBa789boiYQ13+XJIfgDkUrF9Isznkak7PYiCRgpp3LhlKVSqLasTdSKYm93g=
+            =0cB0
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    version: 3.10.2

kubernetes/system/cert-manager/kustomization.yaml

@@ -6,7 +6,6 @@ resources:
   - repository.yaml
   - release.yaml
   - cloudflare-api-token-secret.yaml
-  - ovh-credentials-secret.yaml
 secretGenerator:
   - name: cert-manager-values
     files:

kubernetes/system/cert-manager/ovh-credentials-secret.yaml

@@ -1,45 +0,0 @@
-# OVH API Credentials for DNS-01 Challenges
-#
-# OVH API credentials with the following permissions:
-#   - GET, POST, PUT, DELETE on /domain/zone/*
-#
-# SOPS will encrypt them on pre-commit.
-apiVersion: v1
-kind: Secret
-metadata:
-    name: ovh-credentials
-    namespace: cert-manager
-    labels:
-        app.kubernetes.io/name: cert-manager
-        app.kubernetes.io/component: ovh-credentials
-type: Opaque
-stringData:
-    applicationKey: ENC[AES256_GCM,data:YhH6Ty+JJOelaq7G975wLw==,iv:zbwPRv1tdsyoN+rFoOIItzYC7wmv20zMX/ij6RnC8cI=,tag:n+NIrIp9IgunK9ZD15cULA==,type:str]
-    applicationSecret: ENC[AES256_GCM,data:5jxfV5a0jyCtXQKZJjxNmNTiyZ71nLoP0A/KYm+oQ9k=,iv:77SewJ13vouMbEey2oZav32bHsi/cvyKgE1VQapdzhw=,tag:Be58t/rpZrbHun3mMzrWww==,type:str]
-    consumerKey: ENC[AES256_GCM,data:zYTI4cHz36Is5pwUObL9XPDi6XEftonrjz+32jsNkEM=,iv:saNZrLThBa0b+D7S37IO2WpUmnm7ixshMbJaryZzYuE=,tag:v/BhwdJVlxDaeBi570b3Ig==,type:str]
-sops:
-    lastmodified: "2026-07-09T21:17:10Z"
-    mac: ENC[AES256_GCM,data:pakPqwigSb9Q1nuAcT4w4VumqQ1f1AGGx3WqNASs04eN/RxhWE+LQbY8BgNQ/YUx6HveypU6UH+ppMgPDwCZS7tUwTR/tXpDp/r3WIlhoQghtNGVp/eCpj9Tu91rnjc9Prv9wH8AWaJESeuK5dhZm+LAIvUczP3a+mUhQkXTtok=,iv:WQPfvLOODtvv88+vcTHMfiYcskS394mw+xBPacgCEgw=,tag:l5VMpNnInaeTXWWfkVonrw==,type:str]
-    pgp:
-        - created_at: "2026-07-09T21:17:10Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiARAAn1Wjcdq7Asc920TamGFdlQiDJa4T5iZKJohtXWbJXMSK
-            fqdDgMGWb5OdiCFprRkysckxsY0sWBzc/lOXlj2rw0UV2q66Rxrq19esvUDTfGfK
-            K1cKJ/tegcQ4heQsC+QUgC9SBZlqiA88yDGSO9j9hyBcaSWgkeTUWvrEBFeyLHDn
-            Yha0gxJibNSqmv+B6d5HepkwW6tpESXNX1NFJbYCx46nA6nrttbZCOxzQbS/oBKC
-            pmG4NzU6rQE57zcGpZOGYX8sQWjas0mhPiSAgFOdCdINuWFnONC1jUj5EnBM4LZH
-            +pkZtVmEl7D2SpPNtslTqJKCUbyIHGabblM76p2NKVL8vrTR3k2AM+aL5jS4536d
-            fRRWiWZihsn9PUHsSVLGZPkFe2ceHtM1JjGaX/M+0ZDag3gDUSCR8GdVbDd/95Xs
-            GeGGcVzmuTP16bYsTkXOMixvx7/q3yqAWP2FDvgJqJ3oataRlYwpVZBWDQo50eSb
-            w1fzARbMRz+OWNd+uFgWiHddFR12Xow1tfCSog9WAFjZQ++yjrRsqMH/x8NgWb0l
-            oq/vkHAg4WDqlKUa47vW56c8pZqsiWP8d8V/7b8avhHDdCb+SNOSe5QxO2AA8EAr
-            bjdwSpsErZNFWasYKqfs5ye4ct2tpCI5llRoR6WwnmM3mJflZAt983TPiZC8QLLS
-            XAHLR9ap5zx2shcdyyGOV5+7VmkDaSeB1baxeiORaQKK7CvVblhuIz0ZS097KUI5
-            HBTYvvIdEdXMn3hRalYzyuayKCiC6WEl/UKzXLiCiu94ijbaKqlOtW07anP/
-            =B+/W
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(data|stringData|.*.key|.*.crt)$
-    version: 3.10.2

kubernetes/system/flux/cert-manager-webhook-ovh.yaml

@@ -0,0 +1,20 @@
+# Flux Kustomization for cert-manager-webhook-ovh
+# Depends on cert-manager being fully operational (CRDs installed)
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cert-manager-webhook-ovh
+  namespace: flux-system
+spec:
+  interval: 10m
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: homeprod
+  path: ./kubernetes/system/cert-manager-webhook-ovh
+  dependsOn:
+    - name: cert-manager
+  decryption:
+    provider: sops
+    secretRef:
+      name: flux-sops