diff --git a/dns/production/buildpath.win.yaml b/dns/production/buildpath.win.yaml index a5c1f60..eada04d 100644 --- a/dns/production/buildpath.win.yaml +++ b/dns/production/buildpath.win.yaml @@ -6,7 +6,7 @@ proxied: false ttl: 300 type: A - value: 83.113.30.49 + value: 82.64.154.58 - type: TXT value: google-site-verification=BvFkK7orKeezgxGcdPiGa67PUm9RPI6ZjyyykhSJ24A _acme-challenge: @@ -25,4 +25,4 @@ www: proxied: false ttl: 300 type: A - value: 83.113.30.49 + value: 82.64.154.58 diff --git a/dns/production/vhaudiquet.fr.yaml b/dns/production/vhaudiquet.fr.yaml index 0589429..f3bfaff 100644 --- a/dns/production/vhaudiquet.fr.yaml +++ b/dns/production/vhaudiquet.fr.yaml @@ -5,7 +5,7 @@ auto-ttl: true ttl: 300 type: A - value: 83.113.30.49 + value: 82.64.154.58 - octodns: cloudflare: auto-ttl: true @@ -257,27 +257,20 @@ _submissions._tcp: priority: 0 target: vhaudiquet.fr. weight: 1 -alexscript: - octodns: - cloudflare: - auto-ttl: true - ttl: 300 - type: A - value: 83.113.30.49 auth-nook: octodns: cloudflare: auto-ttl: true ttl: 300 type: A - value: 83.113.30.49 + value: 82.64.154.58 authentik: octodns: cloudflare: auto-ttl: true ttl: 300 type: A - value: 83.113.30.49 + value: 82.64.154.58 autoconfig: octodns: cloudflare: @@ -292,13 +285,6 @@ autodiscover: ttl: 300 type: CNAME value: mail.vhaudiquet.fr. -canada: - octodns: - cloudflare: - auto-ttl: true - ttl: 300 - type: A - value: 192.99.6.159 clips: octodns: cloudflare: @@ -319,36 +305,21 @@ flux-webhook: auto-ttl: true ttl: 300 type: A - value: 83.113.30.49 + value: 82.64.154.58 git: octodns: cloudflare: auto-ttl: true ttl: 300 type: A - value: 83.113.30.49 + value: 82.64.154.58 inbox-nook: octodns: cloudflare: auto-ttl: true ttl: 300 type: A - value: 83.113.30.49 -jupyter: - octodns: - cloudflare: - auto-ttl: true - ttl: 300 - type: A - value: 83.113.30.49 -kasm: - octodns: - cloudflare: - auto-ttl: true - proxied: true - ttl: 300 - type: A - value: 83.113.30.49 + value: 82.64.154.58 ligory: - octodns: cloudflare: @@ -364,33 +335,19 @@ ligory: value: exchange: ligory.vhaudiquet.fr. preference: 20 -lol: - octodns: - cloudflare: - auto-ttl: true - ttl: 300 - type: A - value: 83.113.30.49 mail: - octodns: cloudflare: auto-ttl: true ttl: 300 type: A - value: 83.113.30.49 + value: 82.64.154.58 - octodns: cloudflare: auto-ttl: true ttl: 300 type: TXT value: v=spf1 a ra=postmaster -all -md: - octodns: - cloudflare: - auto-ttl: true - ttl: 300 - type: A - value: 83.113.30.49 mta-sts: octodns: cloudflare: @@ -404,53 +361,46 @@ n: auto-ttl: true ttl: 300 type: A - value: 83.113.30.49 + value: 82.64.154.58 nook: octodns: cloudflare: auto-ttl: true ttl: 300 type: A - value: 83.113.30.49 + value: 82.64.154.58 notesnook: octodns: cloudflare: auto-ttl: true ttl: 300 type: A - value: 83.113.30.49 -overleaf: - octodns: - cloudflare: - auto-ttl: true - ttl: 300 - type: A - value: 83.113.30.49 + value: 82.64.154.58 photos: octodns: cloudflare: auto-ttl: true ttl: 300 type: A - value: 83.113.30.49 + value: 82.64.154.58 sse-nook: octodns: cloudflare: auto-ttl: true ttl: 300 type: A - value: 83.113.30.49 + value: 82.64.154.58 umami: octodns: cloudflare: auto-ttl: true ttl: 300 type: A - value: 83.113.30.49 + value: 82.64.154.58 www: octodns: cloudflare: auto-ttl: true ttl: 300 type: A - value: 83.113.30.49 + value: 82.64.154.58 diff --git a/kubernetes/infrastructure/caddy/release.yaml b/kubernetes/infrastructure/caddy/release.yaml index 44a6103..ca504d7 100644 --- a/kubernetes/infrastructure/caddy/release.yaml +++ b/kubernetes/infrastructure/caddy/release.yaml @@ -27,4 +27,4 @@ spec: patch: | - op: add path: /spec/loadBalancerIP - value: "10.1.2.152" + value: "10.2.1.211" diff --git a/kubernetes/infrastructure/mail/stalwart/values.yaml b/kubernetes/infrastructure/mail/stalwart/values.yaml index efc8202..3f848d3 100644 --- a/kubernetes/infrastructure/mail/stalwart/values.yaml +++ b/kubernetes/infrastructure/mail/stalwart/values.yaml @@ -19,9 +19,9 @@ pushShard: "" # with these credentials on every cert-manager renewal. recoveryAdmin: enabled: true - username: ENC[AES256_GCM,data:kpf88Vc=,iv:k2kGcGlH0jQkLmb35V4+IIrBpDM93PaG6atcO/SLDB4=,tag:qZIR2LZlv1g0XBkEh0y8qA==,type:str] + username: ENC[AES256_GCM,data:XUlqQoM=,iv:WFaWS6MjuQ+jTAj15NCpnFjr1B5XwJexwc4k9qU0n5g=,tag:mcO8w9Ud9j1HbHgoLIJBoA==,type:str] password: "" - existingSecret: ENC[AES256_GCM,data:DnjFoj8VNeqHmwM/KVebjOOHvYHPgZQ=,iv:JWBs6OeZzsa+8uJt/FjptI6t+tf+CRQDKA7149rBg1o=,tag:M4CXA2k8M65mbSUF0mnGvQ==,type:str] + existingSecret: ENC[AES256_GCM,data:XPR9CS3tqLkbjyunmZjLE4pq/Z5ldRo=,iv:B0Dh9vktXOpYCOVVWS31fqw1+OtsaST8dzXbygd4HxA=,tag:F4d0JVfaut8NvJY/HXPurA==,type:str] usernameKey: username passwordKey: password # Recovery mode suspends mail services and exposes only the management listener. @@ -40,7 +40,7 @@ bootstrap: # certificate.yaml (letsencrypt-production, Cloudflare DNS-01). mailTls: enabled: true - existingSecret: ENC[AES256_GCM,data:e8rzv2mvlpoZR/vMfd5sgNuYLDvptQ==,iv:qIQfpHxAOameSdDzOHh89n+RIOd9CcJcl0oRumSHAQQ=,tag:xwbQR5Jabvz+lEju5zuW2g==,type:str] + existingSecret: ENC[AES256_GCM,data:tKhTXL1MFZni+gTTbDMpbZugg7HJ6w==,iv:ye0/5M51TWI2m+YfnwJoQPBCBmb/iWiWZv+aDQGE4hM=,tag:EEbcAagl8UOMR0iW8UvIDA==,type:str] certKey: tls.crt privateKeyKey: tls.key mountPath: /etc/stalwart/tls/ingress @@ -77,7 +77,7 @@ mailService: enabled: true name: stalwart-mail type: LoadBalancer - loadBalancerIP: 10.1.2.143 + loadBalancerIP: 10.2.1.212 annotations: {} # WebUI ingress. TLS is terminated by Caddy at the edge (wildcard cert), so the # path is: public -> Caddy (TLS) -> Traefik (HTTP) -> this Ingress -> mgmt:8080. @@ -120,28 +120,28 @@ podSecurityContext: type: RuntimeDefault containerSecurityContext: {} sops: - lastmodified: "2026-07-18T14:22:17Z" - mac: ENC[AES256_GCM,data:JjN4ziOnd65U8AzI9ZnMiPUBiYFGqjGjM3HJ7XoSJuJ+fgYjOH+WX/U2IAfSeqEIMkzvP435BxKGoylrwEVM1k5v07slul5zEclPZglphDjiX+md403lVDtYEXdCSo0+3nqv1DFEQDkKItEEEz882sZBbhMotBHhgcd41RSA1aY=,iv:MaSmisJoj3aobpMw1HGgEOktegX2LtOaXLh3601xgvc=,tag:acWtTiu4ub7GDNp8nM/yVA==,type:str] + lastmodified: "2026-08-17T18:27:09Z" + mac: ENC[AES256_GCM,data:haYZBrQ0FMB6yc8FjeP2gRxr1FUmlnxFUdPU3itqATqBGopPCE2Nbpesx9wvlDCYn+GrtTiFTMXHuc6IhtRV5ujnEs6sjRgGgON18OIpJ6A6RiWU7u58zz4/JKBmR0EMIJ6dJGpt0aHL9Bogoola2O6TNZ85N720CTvOjoS2/HU=,iv:Gb5s52EB4gX2njF/aRxFwrzL3xmOaPmMW0zAmZgdyY8=,tag:+3oyVoQ+yL99/T+YFuHIIA==,type:str] pgp: - - created_at: "2026-07-18T14:22:17Z" + - created_at: "2026-08-17T18:27:09Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMA7uy4qQr71wiAQ/9G7UtHO7Ux0YNAPlnkVmU5BI+crzwbWPhdaUZFf5dmCkg - r67EAi/DjqFHR9Ew1Dhpn0InTA/Ld+mGZAAbWeP7xhIEQ+AqACmm/Oxgf3IkHKzE - P7dvco6lQO50W/m3fiU0Pv4A7w3Oq+AdFHcPr3UBi8YGYLgkCbzLs2r9JNviCJsl - uuvz438g92aXfa5JcyUjzxtxKFjzHrZ8seDx38X4fveS/mROpRqiw+G8aQ0BlXDM - 9wfiQtiM9CcuahPUWopv4RCOjuqrSc14sxv9xRGsYt1YZFxZ/4Q7rqM+HXBsFp4u - 8r4MgE+EflrhKp1aWPGnSn2kalDy3o+yFuk7IhWsrSKsNIU4j1J5xCfhliey+kNJ - 387cVf7Bjw+iqoy+qiV7Q7XGip6NgF8WwSudZhznv/pS6LL5H5yHaKxjz5rny/TQ - 0upK///2YGuiE66sBb8h2sqzIgr6hZecvb2VdY7BQX4FCo2uAmxTEh+h1fHlervc - i/03B9kNSjP5fSufhE9lsLl0oZgaFIKSpkzLlPdy6z0X5vDEXJGSL+qFudo9RKtf - aaEwaQ+I+snmhWyBeeywxpdyRE5g3xhRwuwaxp7zzVt5ykCnyrZIPvzaSxu/QjaF - jCUmvPp0ZLzAB2xY9AMwOHIrym9lPmcBEEqCiHywCauOQzsGJE3vLF8x3/nzZnvS - XgEE9z1NxK8o0ntL+JZO3+GYvm28Hyw0eXgDJbjJ+tlBYeWH8lfBUOsk2V485OJZ - 4SDNvxzxpyF/4RJY4P4KR7HgwDC8gOCsDgqcyn1s4KzECXyQlqmrXxOrL8cFRhY= - =aeJw + hQIMA7uy4qQr71wiAQ/9GXV5Z9zMj5q6Zn/Ria1dU/1WrUKl48ruJhFLwUH0owt5 + PezZ4Kz2PS9hdgfHJfXwPn1/dywxjrLibnLPNOf9hYxVzxJgtgobFdt4EDPC1Ki4 + bj8Sw9EwWCE8ki0YCqXTDrkcWlgFhatZHLSE+MSEWaIB/i4dujQbRXI3g6CI5Shr + qLo6prhLS2zrZIfWVlwFfibXIjSnX+WGeor57D4ilBqP8qRAO++7dC3jKyYiwY4W + kyO+eb5I5VLfepSGyKGD1WljMEEjPi2LMmTlPfPJp2/gV+aWxO8eRJLjJ4PVyjs6 + 1iFmLFnxNiI3lOLrWU0wX11LhOvaUFCOafJ4kFyECquAYLjcjFCFqAYhrzj4yNPi + UXCg2nv5eyZ5ohDgTU6/q3FPPvKrY60VPV8H1H6u0zOKPjlzko/1UPM9bRBRkJHj + n6/MQEMpsVAijBD8L2JNewj1DxCmmekTqev4g1M/VymciTPLRRLt1tU2IEZ2cCOw + O9EA26LnKnCU8h/grkihp3ScCLeiY++y3neh8umkpsnqF2yBlWr9/s26ZW54hybo + OuoohRSwYTVb4Lu+g98czNp01riv8dAMdYEaPSRS68RqaBdpDnxGDEYcNiaXpHwn + 7pYfnGV9oNQSN9Zo1EfolLc+XWzJbkBA8Sltma8eZtWKffpAAqt5BKz97k6JX8XS + UQEM021guipXzgmhgpYOdWrOM4KDgsLhzIlsu3gGRZjegjg/1UYfv63zh3kWTAPp + wS25gS1e619KJuTyvBv7hHUWC6HwEJ6JrkT+0bX7nNBq/w== + =kkTl -----END PGP MESSAGE----- fp: DC6910268E657FF70BA7EC289974494E76938DDC - encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$ + encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$ version: 3.10.2 diff --git a/kubernetes/infrastructure/network/blocky/values.yaml b/kubernetes/infrastructure/network/blocky/values.yaml index 42e1dc7..c821abd 100644 --- a/kubernetes/infrastructure/network/blocky/values.yaml +++ b/kubernetes/infrastructure/network/blocky/values.yaml @@ -20,7 +20,7 @@ service: dns-udp: enabled: true type: LoadBalancer - loadBalancerIP: 10.1.2.148 + loadBalancerIP: 10.2.1.210 # Cluster (not Local) so any node can forward to pods on any other node. # Required for Cilium L2 announcement failover externalTrafficPolicy: Cluster @@ -69,28 +69,28 @@ resources: # Full list of options https://github.com/0xERR0R/blocky/blob/main/docs/config.yml config: "upstreams:\n groups:\n default:\n - 1.1.1.1\n - 1.0.0.1\n lan:\n - 10.101.207.1\n\nconditional:\n mapping:\n lan: 10.101.207.1\n cluster.local: 10.96.0.10\n\nblocking:\n allowlists:\n ads:\n - |\n dealabs.digidip.net\n s.click.aliexpress.com\n fonts.googleapis.com\n fonts.gstatic.com\n wl.spotify.com\n www.googleadservices.com\n \n denylists:\n ads:\n - https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts\n - https://adaway.org/hosts.txt\n \n clientGroupsBlock:\n default:\n - ads\n \n blockType: zeroIp\n blockTTL: 1m\n loading:\n refreshPeriod: 4h\n downloads:\n timeout: 60s\n\ncaching:\n minTime: 5m\n maxTime: 30m\n # Disable negative caching (NXDOMAIN responses) for dynamic DNS\n cacheTimeNegative: 0\n prefetching: true\n prefetchExpires: 2h\n prefetchThreshold: 5\n\nprometheus:\n enable: true\n path: /metrics\n\nports:\n dns: 53\n http: 4000\n\nbootstrapDns: tcp+udp:1.1.1.1\n\nlog:\n level: info\n format: text\n timestamp: true\n" sops: - lastmodified: "2026-06-05T16:01:30Z" - mac: ENC[AES256_GCM,data:zcrVjYr3g0fDVMLP6T2kEDph3WbGh6nTGkqYwgfKuBOMQ/am+VxXmUJUh1YL0vvFjrwocK7hXFfJ6q/G5SNY+8GVLNeKfl+svfDEssmY9o9XOkSgmCh1MPHCUa6bP/+F1xXq0rU9umvRnjKfhC037iKkCDjEVm6KZt8v2OSvqJA=,iv:MjZtMcEuf9hwVRXGKn3BZnHXMJSeOp453J8SGyh6PTU=,tag:N1IxsGmaJr703gsQ0XjYjg==,type:str] + lastmodified: "2026-08-17T18:27:09Z" + mac: ENC[AES256_GCM,data:IiJLNZlcsOrMpV3Sv9488k+Vmcin0AKV2L6wbTQDHyMmtJK5a8nt4ZTjmrbpD3xlgSNLSPt1EWAGetl0Z8MiLNkpOkv1AQQJdV3SZy+31nzqBXWn8kPP0p9AS7fcRNKR2sDPUNuXdh7GuKm/+j01y7Wetc8aC2MVdMS3fxf719U=,iv:qmigYfzVeraHiAkMGg7T29WhUDDfEur6yphAXsz0JqE=,tag:v7dbMfHVIA+pk0q4jGA9Cg==,type:str] pgp: - - created_at: "2026-06-05T16:01:29Z" + - created_at: "2026-08-17T18:27:09Z" enc: |- -----BEGIN PGP MESSAGE----- - hQIMA7uy4qQr71wiARAAikW2TqLZeBx2ERR7HF15cvCNDqCoTHwVUuTyc0qPUyoM - Zy0X/wN3e0c4Ti0X4lUqJyICpH49sbKtygrRI4vVywr+4KgpKIwi/DTmPk358Cw2 - 4E8DAVMcQDbpSPDgnl2DrrcPBa551MZusXs89nh3Eay4MW/gbEPpQvcuiI8tMQW8 - f8759mNQHGxKUhSvdbJJO13+I7e1vhJz/twWJPJlieBRQ46QQjOuGSAo6YWEH4R2 - Hkrp+7p8tWjFbJEnBlAW5lpcnqjCmoKPuOPXwi6mXpZfEssUsWE99DriCIuRM1ZQ - FBTroMHlwVESE58yBqxs1ZIMHxyncyj0rHfDnrOH08OpW9brTaardHZMcO2Kkil7 - uK5wTdTaNph1crLoWoiW6vuZv05OiHsuHe0miuhRakedmCcbC+dYGmBPDgo0mKYB - 0CzzSRL7MTB9LhGSxH6xrlm1hyRmVzNnYc35VPWf48S/jZi7iOOth/mRaxmi94VZ - O4XiAuwh77eXDaYoOgYaVpCicXXg2uoq3MVjl32yUeuwpDSxVfRUJz39s1rP3UMT - CgFc+Yen7aUmcBYlid69Le2UR3JTGlr1LXyuXR4ju3x0k84qfGKAwjottB2snKu9 - twcxDzDMkjV4Maz3CmBxVglpxe6gOzOSk9BZujxogFHncRxMBo5BJO4/926iaWHS - XgEPMREJARCGq+N+8vc7PQ1xlNEqcwL0c0PJjRVqQIAeuvF4QK9kH+P8aR0k1MXK - WnUHF/3afdgPwpp4ZZJoxfna2AroRh2+Dns4KM7QN2oyFWPNPJuRKyAtaKewPp0= - =DIqZ + hQIMA7uy4qQr71wiAQ//VZ3zkweb4y8UwdjKJVFYT6DSfacL32lzfF+inY6B8IJ3 + ogi5afk8MzPK1PoUTVfpeAzwm+3q5vS4D+XQn5XTVS3+RTaVjryHHuX3Bbwe1ZKa + Ovi03BwxjKH8qyCmqKpBqqVkbqIoNRk7i1JMbOFRTjc+5fw5EmQSEjIy4SR96Qx6 + Df0Ul3ahdbd761EMvTOeZb2JvQBLMY+rHOEg6pkL4Tlpdd6pmMUTwGRUzUZ6QLXA + RQ/qO2gecBbAJb7wjSnJrS8WQXXVuj9YK5+6HZNzWoFhyUpTMfyzT4CiONaMuwPv + OYCHXJ+o1317zuna91ch1y8A2/+p84HvlhWCPBlzF7YzTYU/eUaH+JvG/SA+irw8 + QuNKZYOaNYEQq7vVaheeanD2/w09l6wpA5piXSa7QdoESeYkRfZRVigh93jeRoG8 + XdjIuQD06TV4JHIW/+MMOUuxzp/TzChrYqEO5BJ6gttZXnUjN7IZVA73i+/PhPz9 + RIRx/CYECTFEce64Haw+utCQRAvKielnyWf07ka1ERvvptdYOQWrIb6jIB60VCIf + YfIy4GiPF8T5aPuSpFjNjDGiJWDusq8Jd3fL9qWPQeKZBUufxVhlFFJSeCOYolE0 + AJajQP5PIipUiHbuRQIZ6MbFbauB0Vy+SBAOe0UkqVUZ40y/D/muTpWK4w2UZhvS + XAGmFHhh7f6qm/223unREbK9oBxyoTAEAa4HR4dn8mUnl3WGEMOwkySAbUPZKcyK + Pi8s+SHzvQ5Lbzv+NbgM90ljuUE9ekcsUsqsUT9cmDs4XiH3IGd8feSoyM8I + =j9Pp -----END PGP MESSAGE----- fp: DC6910268E657FF70BA7EC289974494E76938DDC - encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$ + encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$ version: 3.10.2 diff --git a/kubernetes/system/cilium/pool.yaml b/kubernetes/system/cilium/pool.yaml index 062d380..5ab53dd 100644 --- a/kubernetes/system/cilium/pool.yaml +++ b/kubernetes/system/cilium/pool.yaml @@ -4,7 +4,7 @@ metadata: name: "local-pool" spec: blocks: - - cidr: "10.1.2.171/32" - - cidr: "10.1.2.148/32" - - cidr: "10.1.2.152/32" - - cidr: "10.1.2.143/32" + - cidr: "10.2.1.210/32" + - cidr: "10.2.1.211/32" + - cidr: "10.2.1.212/32" + - cidr: "10.2.1.213/32"