flux: re-order certificates for right dependencies

kubernetes/infrastructure/caddy-certificates/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - certificates.yaml

kubernetes/infrastructure/caddy/kustomization.yaml

@@ -5,7 +5,6 @@ resources:
   - namespace.yaml
   - repository.yaml
   - release.yaml
-  - certificates.yaml
   - caddyfile.yaml
 secretGenerator:
   - name: caddy-values

kubernetes/infrastructure/mail/stalwart/kustomization.yaml

@@ -4,7 +4,6 @@ namespace: stalwart
 resources:
   - namespace.yaml
   - repository.yaml
-  - certificate.yaml
   - recovery-admin-secret.yaml
   - release.yaml
 secretGenerator:

kubernetes/infrastructure/stalwart-certificates/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - certificate.yaml

kubernetes/kustomization.yaml

@@ -1,7 +1,10 @@
 # Root Kustomization for Flux
-# Explicitly lists all components to exclude:
-# - cert-manager: managed by separate Flux Kustomization (CRD dependency)
-# - cert-manager-issuer: managed by separate Flux Kustomization (depends on cert-manager)
+# Components managed by separate Flux Kustomizations (CRD dependency ordering):
+# - cert-manager: managed by Flux Kustomization (CRDs must be installed first)
+# - cert-manager-webhook-ovh: managed by Flux Kustomization (depends on cert-manager)
+# - cert-manager-issuer: managed by Flux Kustomization (depends on cert-manager + webhook)
+# - caddy-certificates: managed by Flux Kustomization (Certificate CRDs need cert-manager)
+# - stalwart-certificates: managed by Flux Kustomization (Certificate CRDs need cert-manager)
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
@@ -18,9 +21,6 @@ resources:
   - infrastructure/observability
   - infrastructure/traefik
   - infrastructure/caddy
-  - infrastructure/cert-manager
-  - infrastructure/cert-manager-issuer
-  - infrastructure/cert-manager-webhook-ovh
   - infrastructure/network/blocky
   # Dev (developer platform)
   - dev/gitea

kubernetes/system/flux/caddy-certificates.yaml

@@ -0,0 +1,21 @@
+# Flux Kustomization for Caddy TLS certificates
+# Depends on cert-manager-issuer (CRDs + ClusterIssuer) and homeprod (caddy namespace)
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: caddy-certificates
+  namespace: flux-system
+spec:
+  interval: 10m
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: homeprod
+  path: ./kubernetes/infrastructure/caddy-certificates
+  dependsOn:
+    - name: homeprod
+    - name: cert-manager-issuer
+  decryption:
+    provider: sops
+    secretRef:
+      name: flux-sops

kubernetes/system/flux/kustomization.yaml

@@ -7,3 +7,5 @@ resources:
   - cert-manager.yaml
   - cert-manager-webhook-ovh.yaml
   - cert-manager-issuer.yaml
+  - caddy-certificates.yaml
+  - stalwart-certificates.yaml

kubernetes/system/flux/stalwart-certificates.yaml

@@ -0,0 +1,21 @@
+# Flux Kustomization for Stalwart mail TLS certificate
+# Depends on cert-manager-issuer (CRDs + ClusterIssuer) and homeprod (stalwart namespace)
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: stalwart-certificates
+  namespace: flux-system
+spec:
+  interval: 10m
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: homeprod
+  path: ./kubernetes/infrastructure/stalwart-certificates
+  dependsOn:
+    - name: homeprod
+    - name: cert-manager-issuer
+  decryption:
+    provider: sops
+    secretRef:
+      name: flux-sops