chore(docker): bump roundcube/roundcubemail Docker tag to v1.7.4

- Pin gateway image to immutable tag 2026.9.3: the stale node-cached
  'latest' (old build, state schema v1) crash-looped against the PVC's
  DB already migrated to schema v15/16.
- Add fix-data-owner init container: the operator mounts the PVC root
  at /home/openclaw/.openclaw with fsGroup only, leaving the mount root
  owned by root; OpenClaw >= 2026.9 fchmods its config dir on write and
  fails with EPERM (paperclipinc/openclaw-operator#607).
- Ran one-time 'openclaw doctor --fix --non-interactive' against the
  PVC to complete the 2.0 workspace-state migration.

.github/dependabot.yml

@@ -1,63 +0,0 @@
-version: 2
-updates:
-  - package-ecosystem: "docker-compose"
-    open-pull-requests-limit: 15
-    schedule:
-      interval: weekly
-    directories:
-      - "/docker/home/esphome"
-      - "/docker/home/matter-server"
-      - "/docker/home/mosquitto-mqtt"
-      - "/docker/home/n8n"
-      - "/docker/home/node-red"
-      - "/docker/home/zigbee2mqtt"
-      - "/docker/infrastructure/mail/roundcube"
-      - "/docker/infrastructure/mail/stalwart"
-      - "/docker/infrastructure/network/traefik"
-      - "/docker/infrastructure/squid"
-      - "/docker/infrastructure/sshportal"
-      - "/docker/personal/fireshare"
-      - "/docker/personal/gramps"
-      - "/docker/personal/media/films-series/jackett"
-      - "/docker/personal/media/films-series/jellyfin"
-      - "/docker/personal/media/films-series/jellyseerr"
-      - "/docker/personal/media/films-series/radarr"
-      - "/docker/personal/media/films-series/sonarr"
-      - "/docker/personal/media/films-series/transmission"
-      - "/docker/personal/media/films-series/wizarr"
-      - "/docker/personal/media/music/navidrome"
-      - "/docker/personal/media/youtube/tubearchivist"
-      - "/docker/personal/paperless"
-      - "/docker/personal/radicale"
-      - "/docker/personal/syncthing"
-      - "/docker/personal/tandoor"
-      - "/docker/production/alexscript"
-      - "/docker/production/buildpath"
-      - "/docker/production/semeryfr"
-      - "/docker/tools/excalidraw"
-      - "/docker/tools/obsidian-livesync"
-      - "/docker/tools/stirling-pdf"
-  - package-ecosystem: "helm"
-    open-pull-requests-limit: 15
-    schedule:
-      interval: weekly
-    directories:
-      - "/kubernetes/code/gitea"
-      - "/kubernetes/code/harbor"
-      - "/kubernetes/home/home-assisant"
-      - "/kubernetes/home/zigbee2mqtt"
-      - "/kubernetes/infrastructure/authentik"
-      - "/kubernetes/personal/linkwarden"
-      - "/kubernetes/personal/notesnook"
-      - "/kubernetes/personal/photoprism"
-      - "/kubernetes/production/umami"
-      - "/kubernetes/production/vhaudiquet-fr"
-      - "/kubernetes/system/blocky"
-      - "/kubernetes/system/caddy"
-      - "/kubernetes/system/cert-manager"
-      - "/kubernetes/system/coredns"
-      - "/kubernetes/system/csi-driver-nfs"
-      - "/kubernetes/system/external-dns"
-      - "/kubernetes/system/traefik"
-      - "/kubernetes/tools/dashy"
-      - "/kubernetes/tools/glance"

.gitignore

@@ -9,3 +9,6 @@ terraform.tfstate.backup
 kubeconfig
 talosconfig
 
+# Ignore rendered Talos machine configs (may contain cluster secrets)
+p330.yaml
+

.pre-commit-config.yaml

@@ -6,11 +6,6 @@ repos:
         entry: .pre-commit-sops.sh
         language: script
         pass_filenames: true
-      - id: generate-dependabot
-        name: generate dependabot
-        entry: generate-dependabot.sh
-        language: script
-        pass_filenames: false
       - id: generate-docker-swarmcd
         name: generate docker swarmcd
         entry: generate-docker-swarmcd.sh

.pre-commit-sops.sh

@@ -1,6 +1,13 @@
 #!/bin/bash
 for filename in "$@"; do
     if [[ "${filename}" =~ values.ya?ml$ ]] || [[ "${filename}" =~ secrets?.ya?ml$ ]] || [[ "${filename}" =~ .env$ ]]; then
+        # Skip files that are already SOPS-encrypted: sops -e -i refuses files
+        # containing a top-level 'sops' metadata block (YAML) or '#sops'
+        # comments (dotenv), and double-encrypting would corrupt them anyway.
+        # Makes the hook idempotent for encrypted-at-rest working trees.
+        if grep -qE '^(sops:|#sops)' "${filename}" 2>/dev/null; then
+            continue
+        fi
         sops -e -i "${filename}"
         git add "${filename}"
     fi

.sops.yaml

@@ -1,9 +1,10 @@
 creation_rules:
   - path_regex: .*values.yaml$
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     pgp: DC6910268E657FF70BA7EC289974494E76938DDC
   - path_regex: .*.yaml
-    encrypted_regex: ^(data|stringData|.*.key|.*.crt)$
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
     pgp: DC6910268E657FF70BA7EC289974494E76938DDC
   - path_regex: .*.env$
     input_type: dotenv

.swarmcd/stacks.yaml

@@ -3,11 +3,6 @@ esphome:
   branch: main
   compose_file: docker/home/esphome/docker-compose.yml
 
-matter-server:
-  repo: homeprod
-  branch: main
-  compose_file: docker/home/matter-server/docker-compose.yml
-
 mosquitto-mqtt:
   repo: homeprod
   branch: main
@@ -33,26 +28,21 @@ roundcube:
   branch: main
   compose_file: docker/infrastructure/mail/roundcube/docker-compose.yml
 
-stalwart:
-  repo: homeprod
-  branch: main
-  compose_file: docker/infrastructure/mail/stalwart/docker-compose.yml
-
 traefik:
   repo: homeprod
   branch: main
   compose_file: docker/infrastructure/network/traefik/docker-compose.yml
 
+observability:
+  repo: homeprod
+  branch: main
+  compose_file: docker/infrastructure/observability/docker-compose.yml
+
 squid:
   repo: homeprod
   branch: main
   compose_file: docker/infrastructure/squid/docker-compose.yml
 
-sshportal:
-  repo: homeprod
-  branch: main
-  compose_file: docker/infrastructure/sshportal/docker-compose.yml
-
 fireshare:
   repo: homeprod
   branch: main
@@ -112,13 +102,6 @@ tubearchivist:
   sops_files:
     - docker/personal/media/youtube/tubearchivist/.env
 
-paperless:
-  repo: homeprod
-  branch: main
-  compose_file: docker/personal/paperless/docker-compose.yml
-  sops_files:
-    - docker/personal/paperless/.env
-
 radicale:
   repo: homeprod
   branch: main
@@ -141,30 +124,11 @@ alexscript:
   branch: main
   compose_file: docker/production/alexscript/docker-compose.yml
 
-buildpath:
-  repo: homeprod
-  branch: main
-  compose_file: docker/production/buildpath/docker-compose.yml
-  sops_files:
-    - docker/production/buildpath/.env
-
-semeryfr:
-  repo: homeprod
-  branch: main
-  compose_file: docker/production/semeryfr/docker-compose.yml
-
 excalidraw:
   repo: homeprod
   branch: main
   compose_file: docker/tools/excalidraw/docker-compose.yml
 
-obsidian-livesync:
-  repo: homeprod
-  branch: main
-  compose_file: docker/tools/obsidian-livesync/docker-compose.yml
-  sops_files:
-    - docker/tools/obsidian-livesync/.env
-
 stirling-pdf:
   repo: homeprod
   branch: main

README.md

@@ -20,7 +20,15 @@ SAS9300-8E external SAS card
 NVIDIA RTX 3060 12G graphics card
 ```
 
-Running as single-node Proxmox
+Running as single-node Proxmox, with multiple VMs and LXC containers.
+
+#### Lenovo P330
+
+Running as a Talos/Kubernetes cluster node, for failover deployment.
+
+#### Raspberry Pi 4
+
+Running as a Talos/Kubernetes cluster node, for quorum only.
 
 ### Software stack(s)
 
@@ -50,7 +58,7 @@ Debian and docker / docker swarm are deployed by Terraform, which also deploys [
 | <img width=32 src="https://avatars.githubusercontent.com/u/12724356"><img width=32 src="https://avatars.githubusercontent.com/u/40275816"> | Repository applications | Gitea, Harbor to store code and images |
 | <img width=30 src="https://buildpath.win/_ipx/w_60&f_webp/buildpath-high-resolution-logo-transparent.png"> <img width=32 src="https://avatars.githubusercontent.com/u/13844975"> | Production applications | Personal applications running on the cluster |
 
-Talos Linux, Cilium and flux are deployed using Terraform ; then flux takes over and deploys the whole `kubernetes` folder of this repository.
+Talos Linux, Cilium and Flux are deployed using Terraform; then Flux takes over and deploys the whole `kubernetes` folder of this repository.
 
 ### Production/personal applications
 

dns/production/buildpath.win.yaml

@@ -6,7 +6,7 @@
         proxied: false
     ttl: 300
     type: A
-    value: 83.113.30.49
+    value: 82.64.154.58
   - type: TXT
     value: google-site-verification=BvFkK7orKeezgxGcdPiGa67PUm9RPI6ZjyyykhSJ24A
 _acme-challenge:
@@ -25,4 +25,4 @@ www:
       proxied: false
   ttl: 300
   type: A
-  value: 83.113.30.49
+  value: 82.64.154.58

dns/production/vhaudiquet.fr.yaml

@@ -5,7 +5,7 @@
         auto-ttl: true
     ttl: 300
     type: A
-    value: 83.113.30.49
+    value: 82.64.154.58
   - octodns:
       cloudflare:
         auto-ttl: true
@@ -77,70 +77,14 @@ _25._tcp:
   ttl: 300
   type: TLSA
   values:
-  - certificate_association_data: 5dfdb3cf31b26f23d87c09f3a0cef642f64069a9fb7cfe29270bb5dc0f1e16bb
+    - certificate_association_data: CC6230E3A88A173D11C7F614ACFB4FE7B57A01F649ED1ADEE5F953213D4C6607
-    certificate_usage: 2
-    matching_type: 1
-    selector: 0
-  - certificate_association_data: 76e9e288aafc0e37f4390cbf946aad997d5c1c901b3ce513d3d8fadbabe2ab85
-    certificate_usage: 2
-    matching_type: 1
-    selector: 0
-  - certificate_association_data: 4e32b7ee52c9bd2a15b2df3cae5e3b060d737d71faaaac25336c5f193cbdb52ed2fdf38b29aea9fb97f59c8f86e75b5c364309a232623a99e638116ed66063fd
-    certificate_usage: 2
-    matching_type: 2
-    selector: 0
-  - certificate_association_data: afab698cbbbf892ebb555e09175056c1d4630fe7c350f44dcc6e71843d3b290df00d30ab4e356b630c69169d7633788338922fb637cf5b9f7be20a413eeaa518
-    certificate_usage: 2
-    matching_type: 2
-    selector: 0
-  - certificate_association_data: 3586d4ecf070578cbd27aedce20b964e48bc149faeb9dad72f46b857869172b8
-    certificate_usage: 2
-    matching_type: 1
-    selector: 1
-  - certificate_association_data: d016e1fe311948aca64f2de44ce86c9a51ca041df6103bb52a88eb3f761f57d7
-    certificate_usage: 2
-    matching_type: 1
-    selector: 1
-  - certificate_association_data: a1ef14fea3ca15a552d42665d2fe685672cfdd903de4b370b0d7d87c6d31b5df07142483f36e0e15e16b58f9ba1cbdeeebd4bcb8d74ab7ea32a087db2105f402
-    certificate_usage: 2
-    matching_type: 2
-    selector: 1
-  - certificate_association_data: f8a2b4e23e82a4494e9998fcc4242bef1277656a118beede55ddfadcb82e20c5dc036dcb3b6c48d2ce04e362a9f477c82ad5a557b06b6f33b45ca6662b37c1c9
-    certificate_usage: 2
-    matching_type: 2
-    selector: 1
-  - certificate_association_data: a69ec216999308f0ee575cdef98d6edabed8a6b4d2328e050ac9c7fa06404ad9
-    certificate_usage: 3
-    matching_type: 1
-    selector: 0
-  - certificate_association_data: ccae2719a01f7a6d17d939d8ec13324b7bdb0921ea55d5bfc2f226e54b8c15dd
-    certificate_usage: 3
-    matching_type: 1
-    selector: 0
-  - certificate_association_data: 7cd33aa6bafc850cc89d008fbd0a5cea942c6a573d605984f174fbe7360abbf71fc157ffe0324e380a8dfea62047b9aa140d5899188402ac677c29f96cc1118e
-    certificate_usage: 3
-    matching_type: 2
-    selector: 0
-  - certificate_association_data: 8149784990ba7e448295f9c4eb22abcaa4ecefa1b44f1a71ea13d6827d7068c6469cf5fb08a8ae772c1ef59cddbcfd84d744713c48e985136a234b494511fd03
-    certificate_usage: 3
-    matching_type: 2
-    selector: 0
-  - certificate_association_data: 08f3ffd1b6027093c136f6bb5bc1645a8db31cf2a4392b779c2a2045e152b8b8
       certificate_usage: 3
       matching_type: 1
       selector: 1
-  - certificate_association_data: 12b3946513281ab20ebee4d38d2e139cac1688420015db90ee8e932fe153bc89
+    - certificate_association_data: 731B7CD6FA08C4A56060172BF8E30563919139F16265A38EC35B2A1F41CE2B6B
       certificate_usage: 3
       matching_type: 1
-    selector: 1
+      selector: 0
-  - certificate_association_data: 7b60aee1a230de2c32c0252540c606897ad66cbabc7331c2d40b7dd0e3249e0cc53e145605e610d8dc2f41dd16e12f51dca4641d13e748553bd0f596455dae77
-    certificate_usage: 3
-    matching_type: 2
-    selector: 1
-  - certificate_association_data: 8cee22274c3f828eda9d18c9954ed0a3ad5172e71b7852c780384bf3828ff1bb26fca899395e99e4d191c2d1e0a55404f97e76bb7d4ad8dff71c6c271d34de49
-    certificate_usage: 3
-    matching_type: 2
-    selector: 1
 _caldavs._tcp:
   octodns:
     cloudflare:
@@ -313,27 +257,20 @@ _submissions._tcp:
     priority: 0
     target: vhaudiquet.fr.
     weight: 1
-alexscript:
-  octodns:
-    cloudflare:
-      auto-ttl: true
-  ttl: 300
-  type: A
-  value: 83.113.30.49
 auth-nook:
   octodns:
     cloudflare:
       auto-ttl: true
   ttl: 300
   type: A
-  value: 83.113.30.49
+  value: 82.64.154.58
 authentik:
   octodns:
     cloudflare:
       auto-ttl: true
   ttl: 300
   type: A
-  value: 83.113.30.49
+  value: 82.64.154.58
 autoconfig:
   octodns:
     cloudflare:
@@ -348,13 +285,6 @@ autodiscover:
   ttl: 300
   type: CNAME
   value: mail.vhaudiquet.fr.
-canada:
-  octodns:
-    cloudflare:
-      auto-ttl: true
-  ttl: 300
-  type: A
-  value: 192.99.6.159
 clips:
   octodns:
     cloudflare:
@@ -375,29 +305,21 @@ flux-webhook:
       auto-ttl: true
   ttl: 300
   type: A
-  value: 83.113.30.49
+  value: 82.64.154.58
 git:
   octodns:
     cloudflare:
       auto-ttl: true
   ttl: 300
   type: A
-  value: 83.113.30.49
+  value: 82.64.154.58
-jupyter:
+inbox-nook:
   octodns:
     cloudflare:
       auto-ttl: true
   ttl: 300
   type: A
-  value: 83.113.30.49
+  value: 82.64.154.58
-kasm:
-  octodns:
-    cloudflare:
-      auto-ttl: true
-      proxied: true
-  ttl: 300
-  type: A
-  value: 83.113.30.49
 ligory:
 - octodns:
     cloudflare:
@@ -413,33 +335,19 @@ ligory:
   value:
     exchange: ligory.vhaudiquet.fr.
     preference: 20
-lol:
-  octodns:
-    cloudflare:
-      auto-ttl: true
-  ttl: 300
-  type: A
-  value: 83.113.30.49
 mail:
 - octodns:
     cloudflare:
       auto-ttl: true
   ttl: 300
   type: A
-  value: 83.113.30.49
+  value: 82.64.154.58
 - octodns:
     cloudflare:
       auto-ttl: true
   ttl: 300
   type: TXT
   value: v=spf1 a ra=postmaster -all
-md:
-  octodns:
-    cloudflare:
-      auto-ttl: true
-  ttl: 300
-  type: A
-  value: 83.113.30.49
 mta-sts:
   octodns:
     cloudflare:
@@ -453,46 +361,46 @@ n:
       auto-ttl: true
   ttl: 300
   type: A
-  value: 83.113.30.49
+  value: 82.64.154.58
 nook:
   octodns:
     cloudflare:
       auto-ttl: true
   ttl: 300
   type: A
-  value: 83.113.30.49
+  value: 82.64.154.58
 notesnook:
   octodns:
     cloudflare:
       auto-ttl: true
   ttl: 300
   type: A
-  value: 83.113.30.49
+  value: 82.64.154.58
-overleaf:
+photos:
   octodns:
     cloudflare:
       auto-ttl: true
   ttl: 300
   type: A
-  value: 83.113.30.49
+  value: 82.64.154.58
 sse-nook:
   octodns:
     cloudflare:
       auto-ttl: true
   ttl: 300
   type: A
-  value: 83.113.30.49
+  value: 82.64.154.58
 umami:
   octodns:
     cloudflare:
       auto-ttl: true
   ttl: 300
   type: A
-  value: 83.113.30.49
+  value: 82.64.154.58
 www:
   octodns:
     cloudflare:
       auto-ttl: true
   ttl: 300
   type: A
-  value: 83.113.30.49
+  value: 82.64.154.58

docker/home/esphome/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   esphome:
-    image: ghcr.io/esphome/esphome:2026.6.3
+    image: ghcr.io/esphome/esphome:2026.8.0
     ports:
       - "6052"
     networks:

docker/home/matter-server/docker-compose.yml

@@ -1,16 +0,0 @@
-services:
-  matter-server:
-    image: ghcr.io/matter-js/python-matter-server:8.1.2
-    container_name: matter-server
-    restart: unless-stopped
-    network_mode: host
-    volumes:
-      - data:/data/
-
-volumes:
-  data:
-    driver: local
-    driver_opts:
-      type: 'none'
-      o: 'bind'
-      device: '/app/matter-server/data'

docker/home/zigbee2mqtt/docker-compose.yml

@@ -2,7 +2,7 @@ services:
   zigbee2mqtt:
     container_name: zigbee2mqtt
     restart: unless-stopped
-    image: koenkk/zigbee2mqtt:2.12.0
+    image: koenkk/zigbee2mqtt:2.12.1
     networks:
       - default
       - proxy

docker/infrastructure/mail/roundcube/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   roundcube:
-    image: roundcube/roundcubemail:1.7.1-apache
+    image: roundcube/roundcubemail:1.7.4-apache
     container_name: roundcube
     networks:
       - default

docker/infrastructure/mail/stalwart/docker-compose.yml

@@ -1,40 +0,0 @@
-services:
-  stalwart:
-    image: stalwartlabs/stalwart:v0.16.10
-    container_name: stalwart
-    networks:
-      - default
-      - proxy
-    volumes:
-      - stalwart_data:/opt/stalwart
-    ports:
-      - target: 25
-        published: 25
-        mode: host
-      - target: 465
-        published: 465
-        mode: host
-      - target: 993
-        published: 993
-        mode: host
-      - target: 587
-        published: 587
-        mode: host
-      - "8080"
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.stalwart.rule=Host(`mail.vhaudiquet.fr`)"
-      - "traefik.http.services.stalwart.loadbalancer.server.port=8080"
-
-volumes:
-  stalwart_data:
-    driver: local
-    driver_opts:
-      type: 'none'
-      o: 'bind'
-      device: '/app/stalwart/data'
-
-networks:
-  proxy:
-    name: proxy
-    external: true

docker/infrastructure/observability/alloy.river

@@ -0,0 +1,71 @@
+// Grafana Alloy config for the docker host (replaces Promtail, EOL since
+// 2026-03-02). Tails Docker container logs via docker_sd discovery, attaches
+// container_name/compose_service/stream labels, and pushes them to the
+// in-cluster Loki at loki-internal.lan (LAN-only Traefik Ingress on port 80).
+// River config produced by `alloy convert -f promtail` from an equivalent
+// Promtail YAML (so component names and argument shapes are guaranteed
+// correct for Alloy v1.18).
+
+discovery.docker "docker" {
+  host             = "unix:///var/run/docker.sock"
+  refresh_interval = "5s"
+}
+
+loki.process "docker" {
+  forward_to = [loki.write.default.receiver]
+
+  // Parse docker json-file log lines
+  // ({"log":"...","stream":"stdout","time":"..."}).
+  stage.json {
+    expressions = {
+      log    = "log",
+      stream = "stream",
+    }
+  }
+  stage.labels {
+    values = {
+      stream = null,
+    }
+  }
+}
+
+discovery.relabel "docker" {
+  targets = []
+
+  // Strip leading / from container name.
+  rule {
+    source_labels = ["__meta_docker_container_name"]
+    regex         = "/(.*)"
+    target_label  = "container_name"
+  }
+  // Compose service name (if label is set).
+  rule {
+    source_labels = ["__meta_docker_container_label_com_docker_compose_service"]
+    target_label  = "compose_service"
+  }
+  // Log stream (stdout/stderr).
+  rule {
+    source_labels = ["__meta_docker_container_log_stream"]
+    target_label  = "stream"
+  }
+  // Mark the source so dashboards/alerts can distinguish the docker host.
+  rule {
+    target_label = "source"
+    replacement  = "docker-host"
+  }
+}
+
+loki.source.docker "docker" {
+  host             = "unix:///var/run/docker.sock"
+  targets          = discovery.docker.docker.targets
+  forward_to       = [loki.process.docker.receiver]
+  relabel_rules    = discovery.relabel.docker.rules
+  refresh_interval = "5s"
+}
+
+loki.write "default" {
+  endpoint {
+    url = "http://loki-internal.lan/loki/api/v1/push"
+  }
+  external_labels = {}
+}

docker/infrastructure/observability/docker-compose.yml

@@ -0,0 +1,81 @@
+# Docker-host collectors for the central observability stack on Kubernetes.
+# Managed by swarm-cd (see .swarmcd/stacks.yaml).
+#
+# node-exporter + cAdvisor run locally (scraped by vmagent below).
+# vmagent remote_writes metrics to vm-internal.lan (LAN-only Traefik Ingress) ->
+#   vmsingle-vm-victoria-metrics-k8s-stack.observability.svc.cluster.local:8428
+# alloy tails /var/lib/docker/containers + /var/log and pushes logs to
+#   loki-internal.lan -> loki.observability.svc.cluster.local:3100
+
+services:
+  node-exporter:
+    image: prom/node-exporter:v1.12.1
+    container_name: obs-node-exporter
+    network_mode: host
+    pid: host
+    command:
+      - "--path.rootfs=/host"
+    volumes:
+      - /:/host:ro,rslave
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=false"
+
+  cadvisor:
+    image: gcr.io/cadvisor/cadvisor:v0.55.1
+    container_name: obs-cadvisor
+    ports:
+      - "8080"
+    volumes:
+      - /:/rootfs:ro
+      - /var/run:/var/run:ro
+      - /sys:/sys:ro
+      - /dev/disk/:/dev/disk:ro
+      - /var/lib/docker/:/var/lib/docker:ro
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=false"
+
+  vmagent:
+    image: victoriametrics/vmagent:v1.149.0
+    container_name: obs-vmagent
+    # vmagent listens on 8429 (its own metrics), scrapes node-exporter:9100
+    # and cadvisor:8080, remote_writes to vm-internal.lan
+    command:
+      - "-promscrape.config=/etc/vmagent/vmagent.yml"
+      - "-remoteWrite.url=http://vm-internal.lan/api/v1/write"
+    volumes:
+      - type: bind
+        source: /root/homeprod/docker/infrastructure/observability/vmagent.yml
+        target: /etc/vmagent/vmagent.yml
+        read_only: true
+    depends_on:
+      - node-exporter
+      - cadvisor
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=false"
+
+  alloy:
+    image: grafana/alloy:v1.18.0
+    container_name: obs-alloy
+    command:
+      - "run"
+      - "/etc/alloy/config.river"
+      - "--server.http.listen-addr=0.0.0.0:12345"
+    volumes:
+      - type: bind
+        source: /root/homeprod/docker/infrastructure/observability/alloy.river
+        target: /etc/alloy/config.river
+        read_only: true
+      - /var/lib/docker/containers:/var/lib/docker/containers:ro
+      - /var/log:/var/log:ro
+      - /var/run/docker.sock:/var/run/docker.sock:ro
+    restart: unless-stopped
+    labels:
+      - "traefik.enable=false"
+
+networks:
+  default:
+    name: proxy
+    external: true

docker/infrastructure/observability/vmagent.yml

@@ -0,0 +1,22 @@
+# vmagent scrape config for the docker host.
+# Scrapes the two local collectors, forwards everything to the central
+# VictoriaMetrics via the LAN-only Caddy route vm-internal.lan (Caddy proxies
+# it to vmsingle-vm-victoria-metrics-k8s-stack.observability.svc.cluster.local:8428).
+
+scrape_configs:
+  - job_name: docker-host-node
+    static_configs:
+      - targets:
+          - localhost:9100
+        labels:
+          # Distinguishes the docker host from K8s nodes in dashboards/alerts.
+          instance_source: docker-host
+          host: docker-r740
+
+  - job_name: docker-host-cadvisor
+    static_configs:
+      - targets:
+          - localhost:8080
+        labels:
+          instance_source: docker-host
+          host: docker-r740

docker/infrastructure/sshportal/docker-compose.yml

@@ -1,11 +0,0 @@
-services:
-  sshportal:
-    image: moul/sshportal
-    container_name: sshportal
-    ports:
-      - "2222:2222"
-    volumes:
-      - "data:/root/"
-
-volumes:
-  data:

docker/personal/fireshare/docker-compose.yml

@@ -1,7 +1,7 @@
 services:
   fireshare:
     container_name: fireshare
-    image: shaneisrael/fireshare:1.7.3-lite
+    image: shaneisrael/fireshare:1.7.4-lite
     ports:
       - "80"
     volumes:

docker/personal/gramps/docker-compose.yml

@@ -1,7 +1,7 @@
 services:
   grampsweb:
     container_name: grampsweb
-    image: ghcr.io/gramps-project/grampsweb:26.6.2
+    image: ghcr.io/gramps-project/grampsweb:26.7.1
     restart: always
     networks:
       - default
@@ -31,7 +31,7 @@ services:
 
   grampsweb_celery:
     container_name: grampsweb_celery
-    image: ghcr.io/gramps-project/grampsweb:26.6.2
+    image: ghcr.io/gramps-project/grampsweb:26.7.1
     restart: always
     environment:
       - GRAMPSWEB_TREE="Gramps Web"  # will create a new tree if not exists
@@ -52,7 +52,7 @@ services:
     command: celery -A gramps_webapi.celery worker --loglevel=INFO --concurrency=2
 
   grampsweb_redis:
-    image: docker.io/library/redis:8.8.0-alpine
+    image: docker.io/library/redis:8.10.0-alpine
     container_name: grampsweb_redis
     restart: always
 

docker/personal/media/films-series/jackett/docker-compose.yml

@@ -1,7 +1,7 @@
 services:
   jackett:
     container_name: jackett
-    image: ghcr.io/hotio/jackett:release-v0.24.2142
+    image: ghcr.io/hotio/jackett:release-v0.24.2335
     ports:
       - "9117"
     networks:

docker/personal/media/films-series/jellyfin/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   jellyfin:
-    image: jellyfin/jellyfin:2026062906
+    image: jellyfin/jellyfin:2026080308
     container_name: jellyfin
     networks:
       - default

docker/personal/media/films-series/radarr/docker-compose.yml

@@ -1,7 +1,7 @@
 services:
   radarr:
     container_name: radarr
-    image: ghcr.io/hotio/radarr:release-6.2.1.10461
+    image: ghcr.io/hotio/radarr:release-6.3.0.10514
     ports:
       - "7878"
     networks:

docker/personal/media/films-series/wizarr/docker-compose.yml

@@ -1,7 +1,7 @@
 services:
   wizarr:
     container_name: wizarr
-    image: ghcr.io/wizarrrr/wizarr:v2026.4.0
+    image: ghcr.io/wizarrrr/wizarr:v2026.7.1
     networks:
       - default
       - proxy

docker/personal/media/music/navidrome/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   navidrome:
-    image: deluan/navidrome:0.62.0
+    image: deluan/navidrome:0.63.2
     user: 1000:1000 # should be owner of volumes
     ports:
       - "4533"

docker/personal/media/youtube/tubearchivist/docker-compose.yml

@@ -31,7 +31,7 @@ services:
       - archivist-redis
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.tubearchivist.rule=Host(`tubearchivist.local`)"
+      - "traefik.http.routers.tubearchivist.rule=Host(`tubearchivist.lan`)"
       - "traefik.http.routers.tubearchivist.middlewares=tubearchivist-headers"
       - "traefik.http.middlewares.tubearchivist-headers.headers.accesscontrolalloworiginlist=*"
       - "traefik.http.middlewares.tubearchivist-headers.headers.accesscontrolallowmethods=GET,OPTIONS,PUT"

docker/personal/paperless/.env

@@ -1,16 +0,0 @@
-PAPERLESS_URL=ENC[AES256_GCM,data:5Vt6SqefNzOKGzUaRukM7wKu7Nw=,iv:/x12Sv55XY1znKr2UFQB1Scp+T1cZBs5XlqxTNtBQck=,tag:xahglGfuW2wCkDMgX1nZGA==,type:str]
-PAPERLESS_SECRET_KEY=ENC[AES256_GCM,data:CoWplCZsHbgFPkkBDnzaPnXcq9Fv4OpXuJHs0YTLDi+MmJjK4Lpd+Q==,iv:vX3uYJ0S6lSyHW3comqum5ncXUHFj7LCdNSbRRgY3/M=,tag:gwSwk1lVmoQdgqQ38sFN0A==,type:str]
-PAPERLESS_TIME_ZONE=ENC[AES256_GCM,data:sDtE4GwXr9CScxyq,iv:7oGDO/5Dvj8/E4qzzIhncbboTRfJbTfT/FwUhF4tCNg=,tag:mEcg/i2TaCls+FgCTl6AlA==,type:str]
-PAPERLESS_OCR_LANGUAGE=ENC[AES256_GCM,data:ihFV,iv:+xRvsrymSIB4z5K03bU6N+pugafhvHph3epj1HTDPag=,tag:RhBA2b1q3jIhE9bmcwtYxQ==,type:str]
-PAPERLESS_OCR_LANGUAGES=ENC[AES256_GCM,data:0pbc/9WMlw==,iv:HRnX25U1CasIvdU0h0G0SYvRjzzpmyPpDrcN6sAk+Ck=,tag:Ym08zaK+LqSDEafnUVvGnQ==,type:str]
-PAPERLESS_OCR_USER_ARGS=ENC[AES256_GCM,data:DdpIIK0k5wsJWhcVNtq6w1mK2nsBlXKs/bB3kCxUe9tj7tyff2yH,iv:htcBkWENiugF1T2N0JfJOGfn2F15Ti6icf6JnzmLNjQ=,tag:EACbCMn4aZ7zCWxd1voawA==,type:str]
-PAPERLESS_SOCIALACCOUNT_PROVIDERS=ENC[AES256_GCM,data:vLWinFKXotVzhHqmwpJ6R93Ep44JL7D1P91DbbLcGawfl8Hx+cTtYX2zuBAzeqrlDd+pHVX9I/F/eq3sAFUJrHhwSiscPaw4lc0KWVj3yAbR6guu3ZGKLMZiltGi8adOt+ELvL4aJYNfsdcECaj71JXaqF08+DkLuG6k3BOp/5j+BRFTuAfyS8SXgSo9UTpfNqJWLA2YyNiEy1ht9sbNJYT5FbN9++ZFlJPVmJDyo/8kU2CdkowmLuFhij2hcCt/wvhQ5kjYIzr+LCuPGtF68CVChVguXxTj7w5Mqo9bkdIIUtjzubhbP7LiERE5vQdLve75ZE4mQFt/5H01qwqZkXw7DFn4sJXKQCpCyA+IanA1NO2ypd1plYiR8F+15LNtbfPuZo5hzpYdf3y1xgPrSHUMV0AvAbvJYXyDg2UprpGzxSwLmskZc+4Dqm8ZfTp8IdC9RvETets6fA6t1ucnYFbEB4t0RfF1wzI93m5acE0XvDe7PvnW9X10XDwAhKV6EY9V7OktiL1/swO7MxI5qV6NtxXMMg46V6l/63k5GDmM0FS4Sn9BeIQ=,iv:JwSeogftyoa4k0kQAf63nnoqbIiHWH0Iwa83Nhqlx9Y=,tag:9KrbSxSmN1CzqnVxcsvPgw==,type:str]
-POSTGRES_USER=ENC[AES256_GCM,data:2IkvrQgFYj0v,iv:YxKokHIOsRhgRx2XZsCYsjtJwW0yOx+S5HKKiFQBKlY=,tag:HI4aSRYp7GotOXeF8VBHQw==,type:str]
-POSTGRES_PASSWORD=ENC[AES256_GCM,data:8IiqLOi+Xoln,iv:9zLPLvSe+7FjjunVQvcn5YiejZj0wN1mQu++B2JPy9o=,tag:HRIHXlmYTPCSaZ5BzPA/aQ==,type:str]
-sops_lastmodified=2025-10-08T19:39:41Z
-sops_mac=ENC[AES256_GCM,data:bjQBttibD3m6mjiDtQ/RqfSc0rt3eV/ip+UUzwF45k/+akQCM+kAvSVFiICpRYLQd90hGDSJJytGze0YQBIYS58u/PXovqT+BmbJ5S9jEVwDUnAnFwoVmuGI6dkorCGgLZFxbj/Vwde5v2R3K7nMTyPC/5EJPd4R9gZLgT8/+Bw=,iv:tyyjQXpBEDb+KOEFRNPxUIcEcxYAM+qw2pCyvOltuFE=,tag:xPfaZTAi1Sd0RW5PN0iKog==,type:str]
-sops_pgp__list_0__map_created_at=2025-10-08T19:39:41Z
-sops_pgp__list_0__map_enc=-----BEGIN PGP MESSAGE-----\n\nhQIMA7uy4qQr71wiAQ//WBbj9C5n7tOL8HBWRiiwRHS8nE3XWg7rAROnvEaD5QuE\nEubGw+PnsX3nSiv07Th23dN24IqpgLqz9grq1s6WDgRgQAFqu2f2FTYmIvcU/mko\n9I69i1E8iSYIvfRmReOn3L2GlhQrADYbCYC+mMEAXJtTuJ44KP0JtGTFPP0+m4vb\nspuuebFeES8cVsk2RPuRUQJC6uSk0E78ZaxMWgZm6P/6bnRwDbn4OE3NrQbkvhvn\nKupR01MQ7HAZh5jVi73aVnY0wfxe4fDToef1bjiiZUJEwJ57oKhOmj5EYlTurX0m\nzraNkpDIWQNJnVlMgUEOclmrnL0uz3wkaqu8BoUkyaWAJS2f545amJNUBO23Mogp\ng9VgFeOyivM0xx5JZAN2LRkK5CrpKNpjXYtFzGkxKZxAAs4iyrUGDecJtfZJM48M\ntvgzbL4jqJu6rrOH27e3F74HyEmX+f1sIJMSnvanEiyYxIpdbvMc8+ULtGzpsdUd\n4hQ/yYKqEkecyKwjPEN4OlAI2LdokTxeYOszjJ7iBO1jE2D7e3hgzpjsGZmj1i+J\nzTUGUSAEgfd2w+/xfYzWttMysthrGa0MMwEeKYttuoZjIJ04IDB6JBQWNWxbfGpp\nXlNd5G2+xrGl2oaYzc4fAJRZoQZRWgX1Dy78cvRm8OIUGJucz0cZeBPiI3/Ny5/S\nXgFC/aC1TJBNvFC/60oOrerjzf5LVrx6O3zevs7LCrVVq0iL/xSSU+DnTxdczKPt\nKh9x1LMKUQK5cnMOdoWt78uUNmLkKiSkht43ozLcqvb3cxgRyoSlMP2lvk9YWx4=\n=gnXz\n-----END PGP MESSAGE-----
-sops_pgp__list_0__map_fp=DC6910268E657FF70BA7EC289974494E76938DDC
-sops_unencrypted_suffix=_unencrypted
-sops_version=3.10.2

docker/personal/paperless/docker-compose.yml

@@ -1,86 +0,0 @@
-services:
-  pplessbroker:
-    image: docker.io/library/redis:8
-    restart: unless-stopped
-    volumes:
-      - redisdata:/data
-
-  pplessdb:
-    image: docker.io/library/postgres:16
-    restart: unless-stopped
-    volumes:
-      - pgdata:/var/lib/postgresql/data
-    env_file:
-      - .env
-    environment:
-      POSTGRES_DB: paperless
-
-  paperless-webserver:
-    image: ghcr.io/paperless-ngx/paperless-ngx:2.20.15
-    restart: unless-stopped
-    networks:
-      - default
-      - proxy
-    depends_on:
-      - pplessdb
-      - pplessbroker
-    ports:
-      - "8000"
-    volumes:
-      - data:/usr/src/paperless/data
-      - media:/usr/src/paperless/media
-      - export:/usr/src/paperless/export
-      - consume:/usr/src/paperless/consume
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.paperless-webserver.rule=Host(`paperless.lan`)"
-    env_file: .env
-    environment:
-      PAPERLESS_REDIS: redis://pplessbroker:6379
-      PAPERLESS_DBHOST: pplessdb
-      PAPERLESS_APPS: allauth.socialaccount.providers.openid_connect
-      PAPERLESS_ACCOUNT_DEFAULT_HTTP_PROTOCOL: http
-
-volumes:
-  data:
-    driver: local
-    driver_opts:
-      type: 'none'
-      o: 'bind'
-      device: '/app/paperless/data'
-  media:
-    driver: local
-    driver_opts:
-      type: 'none'
-      o: 'bind'
-      device: '/app/paperless/media'
-  pgdata:
-    driver: local
-    driver_opts:
-      type: 'none'
-      o: 'bind'
-      device: '/app/paperless/db'
-  redisdata:
-    driver: local
-    driver_opts:
-      type: 'none'
-      o: 'bind'
-      device: '/app/paperless/redis'
-
-  export:
-    driver: local
-    driver_opts:
-      type: 'none'
-      o: 'bind'
-      device: '/app/paperless/export'
-  consume:
-    driver: local
-    driver_opts:
-      type: 'none'
-      o: 'bind'
-      device: '/app/paperless/consume'
-
-networks:
-  proxy:
-    external: true
-    name: proxy

docker/personal/radicale/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   radicale:
-    image: tomsquest/docker-radicale:3.7.5.0
+    image: tomsquest/docker-radicale:3.7.6.0
     container_name: radicale
     ports:
       - 5232

docker/personal/tandoor/docker-compose.yml

@@ -9,7 +9,7 @@ services:
 
   web_recipes:
     restart: always
-    image: vabene1111/recipes:2.6.12
+    image: vabene1111/recipes:2.6.13
     networks:
       - default
       - proxy

docker/production/buildpath/.env

@@ -1,18 +0,0 @@
-ME_CONFIG_MONGODB_ADMINUSERNAME=ENC[AES256_GCM,data:AHXIMA==,iv:trofFagJGNq5OyWDaN57vPpKwwG3SouiV5xLl5sJIBA=,tag:c1NUlmBouEb0Milri85QNw==,type:str]
-ME_CONFIG_MONGODB_ADMINPASSWORD=ENC[AES256_GCM,data:8X6+SphUNus=,iv:zwofVw03pToXHR6weckniT/fymFYeHZw6lVmrGUsnLc=,tag:lEWtnnqpwamNsCnkStsRfQ==,type:str]
-ME_CONFIG_MONGODB_URL=ENC[AES256_GCM,data:3xLFWhRYU/EfhRw+rOs9pOb+nzsbV9IvQydB4VGZGw/WLkQd,iv:T9T6ewB+05qzFDL7z2WESs6fIc9lTFdjVxy/71YzhXo=,tag:S3YsOokO4jzhJVWep/QTsQ==,type:str]
-ME_CONFIG_BASICAUTH=ENC[AES256_GCM,data:FnUichsnpQ==,iv:Ayw1Vqg5rj6P79vtERX2hRCttnol/4aNUG5Y0OhFVTo=,tag:JkTxro0kyYJLr9gdkY8A1Q==,type:str]
-MONGO_USER=ENC[AES256_GCM,data:2KFDcg==,iv:wdDxrQd07+hC5GEq1DS0DLVASiL9L4ds1V3TG1NA9EQ=,tag:gieiOLmOfLtUQjfjwZg6qQ==,type:str]
-MONGO_PASS=ENC[AES256_GCM,data:W80YLzp8G50=,iv:eFts3fhrB9PGEfC69d8btt4ko3gcOGrFZUy95hx2rCE=,tag:+1JFEiclNnjei8+2I42j6w==,type:str]
-MONGO_HOST=ENC[AES256_GCM,data:0RknYUM=,iv:8QyL4KHrSr9pv1kX+FD09N2ltVSZkEKqtFCS30ik1v0=,tag:bTXBMHqp5JU9VTD3soXEyQ==,type:str]
-MONGO_INITDB_ROOT_USERNAME=ENC[AES256_GCM,data:G6wekw==,iv:AH5qqxXOeEBVI2mXXPPrC1X8X/Vq5MHZBWdfNRNeK1c=,tag:nMkWql/aVHi2FGnJ5NGFBQ==,type:str]
-MONGO_INITDB_ROOT_PASSWORD=ENC[AES256_GCM,data:jzVSUjGSjOY=,iv:S/Ar0oYN2vSE7pK+/tfp9RyCThtDbk0gOUYDyzNYjVE=,tag:whWyBFHuXBcmF+WixjafOw==,type:str]
-RIOT_API_KEY=ENC[AES256_GCM,data:EzqWk1Y73htAXaUJhzByV6Aru/hxUNjHGK90ac1NGaz92Cwk9YEdmrb9,iv:KorIppEflVX2aDC8K3ndRzK1q6scNjdQfl38p/8fLGM=,tag:Ei2zLoiGOlOX8ocrO2wNMw==,type:str]
-CDRAGON_CACHE_DIR=ENC[AES256_GCM,data:uMogP1/K/pc=,iv:/0A8fs9HEuksSiKV1SZDoslHHGlJe+vFw0BQ5zQ9BBA=,tag:grwWPwMQarpmSAUIgKDZ5Q==,type:str]
-sops_lastmodified=2026-04-30T18:20:37Z
-sops_mac=ENC[AES256_GCM,data:7teYIGLLHBH8TJ/gr3lcbtfo4CVl0Gj2RWPSLgx4AyTvM+pZaSvUDaVUhWuprSCVqZcDWI2tNHUOHE4aYlJzyt9JfQrooKLPkKUq3WX3bucg3Rv5GpiP1tNHiPDE7UZCBp5bkHhYvwn+dPjhObEUdMUuwMBDA9JSpPlr3YQCg/E=,iv:6knBO6QNe33E2bJw5WZMzcDzeTW9mwgjQtftv0FZq8s=,tag:xuIKZl7szrUyX8/D9xxAmA==,type:str]
-sops_pgp__list_0__map_created_at=2026-04-30T18:20:33Z
-sops_pgp__list_0__map_enc=-----BEGIN PGP MESSAGE-----\n\nhQIMA7uy4qQr71wiARAAufkTVdCq2ARwMFuec9+0N1BzTo7WgGQhzKIJehe+uQ5I\nuPS5bafo5vrvxlCuxVmhup45CS3gm3X46hgHh/d3htaYzDnbyh/awbVGIhU9sa9T\n74i4jZAabzWjWAU8lAvxS6dJ6hf5U3MHOc1zYoCUfCJjgw+QRzR5PxZKFhpVklQU\nQJycdfRAl5oAqF7N6B7oCNTs7w1hbx2CJXBVGM8YoJySkThpXEY3dECxZ5nTSPmp\nXo3hmidO09uYsjWzcqynJHnh9RkMd1VAe6ULzhVIOv5KLXQLQV/paNAPdsxA5UmY\nE1imIFrqS25BVU9xbsGaPj6AHX6+Ux8bpO8TOVbpULe56Aq2c5GOjIZXb3p20K7N\nEk5rJ/K+8FxvytK3jDkhJI49wiDs9UDim02DSZmsWirIy/c02Ojy2d/Cxors1Lw/\nBCc4S6/ESH9u/LGlWs8WDqcDQqhHgeCvGOLAvOXs9eOCXNW2ROtNdfW808APbu1A\nzgYJwPtdfBhUv4KhZcEVMldWgX1OiYhcWMWYgJUXcfOwaRbzntZ/MczPNJ/a+57T\nPvH9GuTiwCXn0fOgcETTp9RPvXflL+4LPgh9drCOo4zwMvlqZs2+0Os2m8GDdDcL\nD45VMTsnNUXWuO7YUdtYX47bON2W6Z7NwzvkSr5odogzq1xw38SgRN7g3Jbl6+fS\nXAH/Rw8jWjpYztZ5HgDXisTxLEXqn5UNYKZBjzsLV5tE9GQp8ppck21igBiDCqoT\nsziZwFyRy/nKq076lZlRgSFr0pm4168u7Vn5x1TLQBHl+i0eKficgUQpwCFx\n=XUsx\n-----END PGP MESSAGE-----
-sops_pgp__list_0__map_fp=DC6910268E657FF70BA7EC289974494E76938DDC
-sops_unencrypted_suffix=_unencrypted
-sops_version=3.10.2

docker/production/buildpath/docker-compose.yml

@@ -1,57 +0,0 @@
-services:
-  mongo:
-    hostname: mongo
-    image: mongo:8.2.11
-    restart: always
-    user: root:root
-    command: mongod --wiredTigerCacheSizeGB 2
-    deploy:
-      resources:
-        limits:
-          memory: 6G
-        reservations:
-          memory: 3G
-    volumes:
-      - bpmongo_data:/data/db:Z
-      - bpmongo_config:/data/configdb:Z
-    env_file: .env
-
-  match_collector:
-    image: git.vhaudiquet.fr/vhaudiquet/lolstats-match_collector:d878af6d1a5cb633175515259e27a12c76c4609b
-    build: ./match_collector
-    volumes:
-      - bpcdragon_cache:/cdragon
-    restart: "no"
-    deploy:
-      restart_policy:
-        condition: any
-        delay: '0'
-        window: 20s
-    env_file: .env
-
-  frontend:
-    image: git.vhaudiquet.fr/vhaudiquet/lolstats-frontend:d878af6d1a5cb633175515259e27a12c76c4609b
-    build: ./frontend
-    restart: always
-    volumes:
-      - bpcdragon_cache:/cdragon
-    networks:
-      - default
-      - proxy
-    ports:
-      - "3000"
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.frontend.rule=Host(`buildpath.win`)"
-      - "traefik.http.services.frontend.loadbalancer.server.port=3000"
-    env_file: .env
-
-volumes:
-  bpmongo_data:
-  bpmongo_config:
-  bpcdragon_cache:
-
-networks:
-  proxy:
-    external: true
-    name: proxy

docker/production/semeryfr/docker-compose.yml

@@ -1,20 +0,0 @@
-services:
-  semeryfr:
-    container_name: semeryfr
-    image: git.vhaudiquet.fr/semerys/semery.fr:latest
-    networks:
-      - default
-      - proxy
-    ports:
-      - 80
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.semeryfr.rule=Host(`semery.fr`)"
-    environment:
-      - NGINX_HOST=semery.fr
-      - NGINX_PORT=80
-
-networks:
-  proxy:
-    external: true
-    name: proxy

docker/tools/obsidian-livesync/.env

@@ -1,9 +0,0 @@
-COUCHDB_USER=ENC[AES256_GCM,data:wMQJhlZFW30=,iv:OG3S+hZppJdP/PjDINGEEQZD8Qf4520mfzsyw+/QAx4=,tag:i1og4xc0N4Hf4UE0GKPtbg==,type:str]
-COUCHDB_PASSWORD=ENC[AES256_GCM,data:eud7WTnlZEzzBGciiwM=,iv:g8RCLIcO1ZxUn/SROHV/stl+whdzICMSX0jVLKXbTns=,tag:6gReHLd+97dqUoAlYL780Q==,type:str]
-sops_lastmodified=2025-11-21T23:00:14Z
-sops_mac=ENC[AES256_GCM,data:O+jtG9ojK8Md6NSaqfyykVdVG84Kafz3zoKb5hbj2alzvJgaLuzVu3ihM75ZU3/meu/nPl9wCc+J4RKepE7VTp5Il3HK09MVHYRHQKVlbyiZ5cTbU74JJuSL3PF1GiU7p/U5Ht9+Z9c8sDrqSN2IPSIfDr8zCdTwKZF71nYOqew=,iv:n33XCpiwVOGnrJyH3Q967u5uMknRfAwx9esJuOLl+9g=,tag:aKMwsOKXPRUaa+9/ZmnpfQ==,type:str]
-sops_pgp__list_0__map_created_at=2025-11-21T23:00:14Z
-sops_pgp__list_0__map_enc=-----BEGIN PGP MESSAGE-----\n\nhQIMA7uy4qQr71wiAQ/+Mt0/uXHnndDK7FLEM8rhWmX0NpJWtgBY3BBXMX7I2Ilg\n6hNZJxISOqcoJCPqb8gZ9pUulcGC5F8owoo/wUILyI/mK3kAzGCP+lfp6Dk03k+P\nwB6BcQTC8NJsApoygdm50h/jtnlK2KUCICFKXUxf527KLWdo8g0wnMIOBe8mBvVC\n8bI/1BOcJZeB4IhmFVrgED+Ct1dTTiuyLscJirCqHD0VTD4eavd6DVpN89m/mtY/\nhTRVT3omuV8JITLeWPdVVWyQznrq3/x8OGAs8L2c24gad5AsTLCr2WS20CvXP1uL\nUoLH9EH0IDvo36DbiMO+p3LdyEvlRe1PW+0dvOpO64CLNoH4szYDJ/dG+UUa3xWo\nRpOIT1F0puXRz3UHZv/IkAFah4Zzi8TxdZDD7Riz5pzMWqzWwdQHQUS1ZWibm1ve\nfC7strrMNybh+QUfMTXhTaW4OoRkY+rGo3d2x3eUjZpaqlKOBWaScZ0c1I7DY/CP\no4QoCoga1RNePXp/WWvWAbQf0w+hAxrsb6U3/ECKtcd4gYGE3shvH0MS6T4oAaIx\nB9ldqRbKIcEUYU7MWq3Wqt8c1k/MtJZh1q3YuZwy8C3U8cHiS5iqDWzAnjIkUwbC\nJpYVaIOvI0qOjE7v6Fc06ZnTBoh/DoTX4XfdIY39GMo3ZageBV0r7Fi0HUzbFxvS\nXAHnsiZZXFB/TJAVEZKDO0Yic3DhlYLL/glOJF0kNgUOoYGvTFaSuNhwhv4tqOrw\nSv7FLH+79LSrM/bPug3Zq9Ec7p/TSnsJ4amu6p7VSmSHRBGV0uZDxt5wkYnG\n=yY4C\n-----END PGP MESSAGE-----
-sops_pgp__list_0__map_fp=DC6910268E657FF70BA7EC289974494E76938DDC
-sops_unencrypted_suffix=_unencrypted
-sops_version=3.10.2

docker/tools/obsidian-livesync/docker-compose.yml

@@ -1,44 +0,0 @@
-services:
-  couchdb:
-    image: couchdb:3.5.2
-    container_name: couchdb
-    env_file: .env
-    volumes:
-      - couchdb-data:/opt/couchdb/data
-      - couchdb-etc:/opt/couchdb/etc/local.d
-    networks:
-      - default
-      - proxy
-    ports:
-      - 5984
-    labels:
-      - "traefik.enable=true"
-      - "traefik.http.routers.couchdb.rule=Host(`obsidian-livesync.lan`)"
-      - "traefik.http.services.couchdb.loadbalancer.server.port=5984"
-      - "traefik.http.routers.obsidian-livesync.middlewares=obsidiancors"
-      - "traefik.http.middlewares.obsidiancors.headers.accesscontrolallowmethods=GET,PUT,POST,HEAD,DELETE"
-      - "traefik.http.middlewares.obsidiancors.headers.accesscontrolallowheaders=accept,authorization,content-type,origin,referer"
-      - "traefik.http.middlewares.obsidiancors.headers.accesscontrolalloworiginlist=app://obsidian.md,capacitor://localhost,http://localhost"
-      - "traefik.http.middlewares.obsidiancors.headers.accesscontrolmaxage=3600"
-      - "traefik.http.middlewares.obsidiancors.headers.addvaryheader=true"
-      - "traefik.http.middlewares.obsidiancors.headers.accessControlAllowCredentials=true"
-    restart: unless-stopped
-
-networks:
-  proxy:
-    external: true
-    name: proxy
-
-volumes:
-  couchdb-data:
-    driver: local
-    driver_opts:
-      type: 'none'
-      o: 'bind'
-      device: '/app/obsidian-livesync/data'
-  couchdb-etc:
-    driver: local
-    driver_opts:
-      type: 'none'
-      o: 'bind'
-      device: '/app/obsidian-livesync/etc'

generate-dependabot.sh

@@ -1,58 +0,0 @@
-#!/bin/bash
-
-# Create .github directory if needed
-if [ ! -d .github ]; then
-    mkdir -p .github
-fi
-
-tmpfile=$(mktemp)
-
-# Make sure to cleanup our temp file on any kind of exit
-trap 'rm -f "$tmpfile"' EXIT
-
-# dependabot.yml docker header
-cat > "$tmpfile" <<'YAML'
-version: 2
-updates:
-  - package-ecosystem: "docker-compose"
-    open-pull-requests-limit: 15
-    schedule:
-      interval: weekly
-    directories:
-YAML
-
-# Find and sort all docker-compose.yml directories
-find docker -name 'docker-compose.yml' -print0 \
-  | xargs -0 -n1 dirname \
-  | sed 's|^\./||' \
-  | sort \
-  | while read -r dir; do
-      echo "      - \"/$dir\"" >> "$tmpfile"
-    done
-  
-# dependabot.yml helm header
-cat >> "$tmpfile" <<'YAML'
-  - package-ecosystem: "helm"
-    open-pull-requests-limit: 15
-    schedule:
-      interval: weekly
-    directories:
-YAML
-
-# Find and sort all release.yaml directories
-find kubernetes -name 'release.yaml' -print0 \
-  | xargs -0 -n1 dirname \
-  | sed 's|^\./||' \
-  | sort \
-  | while read -r dir; do
-      echo "      - \"/$dir\"" >> "$tmpfile"
-    done
-
-# Overwrite file on change
-if ! [ -f .github/dependabot.yml ] || ! cmp -s "$tmpfile" .github/dependabot.yml; then
-  mv "$tmpfile" .github/dependabot.yml
-  echo "Updated .github/dependabot.yml!"
-  git add ".github/dependabot.yml"
-else
-  echo "No changes to .github/dependabot.yml."
-fi

infra/kube/.gitignore

@@ -0,0 +1,3 @@
+clusterconfig/
+manifests/cilium.yaml
+talconfig.json

infra/kube/manifests/cilium/values.yaml

@@ -0,0 +1,73 @@
+ipam:
+    mode: kubernetes
+kubeProxyReplacement: true
+securityContext:
+    capabilities:
+        ciliumAgent:
+            - CHOWN
+            - KILL
+            - NET_ADMIN
+            - NET_RAW
+            - IPC_LOCK
+            - SYS_ADMIN
+            - SYS_RESOURCE
+            - DAC_OVERRIDE
+            - FOWNER
+            - SETGID
+            - SETUID
+        cleanCiliumState:
+            - NET_ADMIN
+            - SYS_ADMIN
+            - SYS_RESOURCE
+cgroup:
+    autoMount:
+        enabled: false
+    hostRoot: /sys/fs/cgroup
+k8sServiceHost: localhost
+k8sServicePort: 7445
+etcd:
+    clusterDomain: cluster.local
+l2announcements:
+    enabled: true
+externalIPs:
+    enabled: true
+# Single-node cluster: the operator defaults to 2 replicas, but both
+# bind the same host ports, so the second replica can never schedule ("node(s)
+# didn't have free ports for the requested pod ports") and sits Pending forever.
+operator:
+    replicas: 1
+ingressController:
+    enabled: false
+    loadbalancerMode: shared
+    default: false
+    service:
+        externalTrafficPolicy: Cluster
+envoy:
+    xffNumTrustedHopsL7PolicyIngress: 1
+sops:
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:2aioHoSXw5UOFKj5z5PJmtPC4rGl9DYY0gWgevHIxXbKdjLrTfyyoRfBPCl3+NPWAZllieMr4VKsGy53YUqq5xFgRg0BaqG+gqMFX/YjHPqhF0/WT0YI3GdTWhl/YY0wma+CEN0kE5SsljpKh7vBgY8l2WlFhpMdlbAKEeyONRs=,iv:EY7Vdlj/VpqY34KmrVUSQutLiD8DEAB0OqIXnN40ERA=,tag:XOZNdUoeWAV4cD111ciBzw==,type:str]
+    pgp:
+        - created_at: "2026-08-26T19:28:02Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiARAAp9OoebtSeHrGp/3bQz93JMbp78C9xnHuumz7exhd9Ky6
+            zrJUm+bL8tNMWTL72Q+GUTCo7lEVltYciXZZVYSvD3Uee8stAeOdhCrY6jsH2IxZ
+            yCVZktlnsAbsPDwmEt+/HRoiqwy4hkbIx99J5W18cJD4eSw8MlJYjDVfSh2UWGIi
+            rd+7ameKbHR8PCduWu1T5SY0EFWaVr3WJDW//lD/FUT1KXJDrB0ExVtsuL0l8GgW
+            ue+noYGAn5l9PRgjgqTLSbHoQQDaMO9KalR+Gz6jmYpUdkJEuCT1amQiH+dE8i85
+            Rs0KXHWLnW59xY4pqdNzJzOysKEsM/oPes36JFvuIOIpB0KDSK/hcFKkYogk96Rw
+            VZ131NNOYMbKunORjmKfei7SWE975zzB/OFCWRDkAwGceqm+hdWaKhKV+rZlBSHR
+            ClbWTZt9+EEI3Er1f/J8qsfhvxJswWTDIOs7+I7YgbFgPAHMh/kcNU+xJJmWtDOq
+            Fq3uBi/oowR6mwTvUwswFFkuaDePcjHrvWaQLTzOw/wv5JU59nUTstSr+zMQzm4Y
+            ZTjKoz62hz5gntyjRFG58w7tyLR8D48CFPA6BFGLBkBpsykhyc42F4woCUqEg6YJ
+            5QBuCFsBXxjSeRHTLRyaWdI5BmppmLZ5axzdMVt0X+rXy/7LhGPY40bGuWBbsgPS
+            XgEL/HGgfFafvsfgJU5x71E4n+Ak7EPLCxin1uTW/CM0cJszT1/zdwIdQ+T5JDiY
+            JlZZTK9C49sF3OngtmRTtf1JesnOYdfhdOVCpDO9EgcUiF769X0JPhdFNemkOeY=
+            =8NLP
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
+    version: 3.10.2

infra/kube/manifests/flux-system/flux-instance.yaml

@@ -1,4 +1,18 @@
-instance:
+apiVersion: fluxcd.controlplane.io/v1
+kind: FluxInstance
+metadata:
+  name: flux
+  namespace: flux-system
+spec:
+  distribution:
+    version: "2.x"
+    registry: ghcr.io/fluxcd
+  sync:
+    name: homeprod
+    kind: GitRepository
+    url: https://github.com/vhaudiquet/homeprod
+    path: kubernetes/
+    ref: refs/heads/main
   components:
     - source-controller
     - kustomize-controller

infra/kube/reconcile.sh

@@ -0,0 +1,55 @@
+#!/bin/sh
+# Reconcile Talos cluster infrastructure
+# Environment needed:
+# - SOPS_KEY: sops private key
+set -euo pipefail
+
+if [ -z "${SOPS_KEY:-}" ]; then
+  echo "Error: SOPS_KEY environment variable is not set" >&2
+  exit 1
+fi
+
+# Render the Cilium chart for manifest deployment
+helm repo add cilium https://helm.cilium.io/
+helm repo update
+helm template cilium cilium/cilium \
+  --version 1.20.1 \
+  --namespace kube-system \
+  -f manifests/cilium/values.yaml \
+  > manifests/cilium.yaml
+
+# Escape shell variables that must be resolved at container runtime, not by talhelper.
+# talhelper expands ${VAR} statically; prefixing with $$ (i.e. $${VAR}) tells it to
+# preserve the literal ${VAR} in the output so bash can expand it inside the container.
+sed -i 's/\${BIN_PATH}/$${BIN_PATH}/g' manifests/cilium.yaml
+
+# Generate Talos machine config
+talhelper genconfig
+
+# Apply generated machine config to the nodes, without reboot.
+# If it fails, it is safer for reconcile to be done manually:
+# the reboot is needed and that might disrupt the node
+talhelper gencommand apply --extra-flags="-m no-reboot" | bash
+
+# Obtain kubeconfig and export it for kubectl
+talosctl --talosconfig ./clusterconfig/talosconfig kubeconfig -f ./clusterconfig/kubeconfig
+export KUBECONFIG=./clusterconfig/kubeconfig
+
+# Show nodes
+kubectl get nodes
+
+# Create Flux namespace if it does not already exists
+kubectl get ns "flux-system" || kubectl create ns "flux-system"
+
+# Create SOPS secret in the cluster
+kubectl create secret generic flux-sops \
+  --namespace "flux-system" \
+  --from-literal=sops.asc="$SOPS_KEY" \
+  --dry-run=client -o yaml | kubectl apply -f -
+
+# Install the Flux operator if not installed already
+kubectl get deployment -n flux-system flux-operator || helm install flux-operator oci://ghcr.io/controlplaneio-fluxcd/charts/flux-operator \
+  --namespace "flux-system" \
+  --wait
+
+kubectl apply -f manifests/flux-system/flux-instance.yaml

infra/kube/talconfig.yaml

@@ -0,0 +1,46 @@
+---
+clusterName: kube
+talosVersion: v1.13.8
+kubernetesVersion: v1.36.0
+endpoint: https://10.2.2.138:6443
+domain: cluster.local
+allowSchedulingOnMasters: true
+clusterPodNets:
+  - 10.244.0.0/16
+clusterSvcNets:
+  - 10.96.0.0/12
+cniConfig:
+  name: none
+nodes:
+  - hostname: p330
+    ipAddress: 10.2.2.138
+    filenameTmpl: "{{.ClusterName}}-{{.Hostname}}.yaml"
+    extensionServices: []
+    controlPlane: true
+    machineSpec:
+      mode: metal
+      arch: amd64
+      secureboot: false
+      useUKI: false
+      bootMethod: iso
+    installDisk: /dev/nvme0n1
+    schematic:
+      customization:
+        systemExtensions:
+          officialExtensions:
+            - siderolabs/intel-ucode
+            - siderolabs/iscsi-tools
+    kernelModules:
+      - name: iscsi_tcp
+      - name: libiscsi
+      - name: scsi_transport_iscsi
+      - name: ext4
+      - name: ixgbe
+        parameters:
+          - allow_unsupported_sfp=1
+    networkInterfaces:
+      - interface: eno1
+        dhcp: true
+inlineManifests:
+  - name: cilium
+    contents: "@./manifests/cilium.yaml"

infra/r740/kube/main.tf

@@ -1,314 +0,0 @@
-terraform {
-  required_providers {
-    talos = {
-      source  = "siderolabs/talos"
-      version = "0.9.0"
-    }
-    kubernetes = {
-      source = "hashicorp/kubernetes"
-      version = "2.36.0"
-    }
-    helm = {
-      source = "hashicorp/helm"
-      version = "2.17.0"
-    }
-  }
-}
-
-# Talos configuration
-provider "talos" {}
-
-# Kubernetes configuration
-provider "kubernetes" {
-  config_path = "${path.module}/kubeconfig"
-}
-# Helm configuration
-provider "helm" {
-  kubernetes {
-    config_path = "${path.module}/kubeconfig"
-  }
-}
-
-resource "talos_machine_secrets" "kube" {}
-
-data "talos_machine_configuration" "kube" {
-  cluster_name = "kube-${var.physical_hostname}"
-  machine_type = "controlplane"
-  cluster_endpoint = "https://${var.kube_host}:6443"
-  machine_secrets = talos_machine_secrets.kube.machine_secrets
-  config_patches = [
-    yamlencode({
-      machine = {
-        install = {
-          image = "factory.talos.dev/installer/ce4c980550dd2ab1b17bbf2b08801c7eb59418eafe8f279833297925d67c7515:v1.11.5"
-        }
-        network = {
-          nameservers = [
-            # We need a set of nameservers that can work independently of kube
-            # to bootstrap. 
-            "10.1.2.148",
-            "1.1.1.1"
-          ]
-        }
-        certSANs = [
-          "${var.kube_host}", "${var.kube_hostname}"
-        ]
-      }
-      cluster = {
-        clusterName = "kube-${var.physical_hostname}"
-        allowSchedulingOnControlPlanes = true
-        apiServer = {
-          certSANs = [
-            "${var.kube_host}", "${var.kube_hostname}"
-          ]
-        }
-        network = {
-          dnsDomain = "cluster.local"
-          cni = {
-            name: "none"
-          }
-        }
-        proxy = {
-          disabled = true
-        }
-      }
-    })
-  ]
-}
-
-data "talos_client_configuration" "kube" {
-  cluster_name = "kube-${var.physical_hostname}"
-  client_configuration = talos_machine_secrets.kube.client_configuration
-  nodes = ["${var.kube_host}"]
-}
-
-resource "talos_machine_configuration_apply" "kube" {
-  client_configuration = talos_machine_secrets.kube.client_configuration
-  machine_configuration_input = data.talos_machine_configuration.kube.machine_configuration
-  node = var.kube_host
-  depends_on = [ talos_machine_secrets.kube ]
-}
-
-resource "talos_machine_bootstrap" "kube" {
-  node = var.kube_host
-  client_configuration = talos_machine_secrets.kube.client_configuration
-  depends_on = [ talos_machine_configuration_apply.kube, talos_machine_secrets.kube ]
-}
-
-resource "talos_cluster_kubeconfig" "kube" {
-  node = var.kube_host
-  depends_on = [ talos_machine_bootstrap.kube ]
-  client_configuration = talos_machine_secrets.kube.client_configuration
-}
-
-output "kubeconfig" {
-  sensitive = true
-  value = talos_cluster_kubeconfig.kube.kubeconfig_raw
-}
-
-resource "local_file" "kubeconfig" {
-    content     = "${talos_cluster_kubeconfig.kube.kubeconfig_raw}"
-    filename = "${path.module}/kubeconfig"
-    depends_on = [ talos_cluster_kubeconfig.kube ]
-}
-
-data "talos_client_configuration" "talosconfig" {
-  cluster_name = "kube-${var.physical_hostname}"
-  client_configuration = talos_machine_secrets.kube.client_configuration
-  nodes = [var.kube_host]
-}
-
-resource "local_file" "talosconfig" {
-    content     = "${data.talos_client_configuration.talosconfig.talos_config}"
-    filename = "${path.module}/talosconfig"
-    depends_on = [ data.talos_client_configuration.talosconfig ]
-}
-
-# TODO : Wait for talos_cluster_kubeconfig...
-resource "helm_release" "cilium" {
-  name = "cilium"
-  namespace = "kube-system"
-  repository = "https://helm.cilium.io/"
-  chart = "cilium"
-  wait = false
-  depends_on = [ local_file.kubeconfig, talos_cluster_kubeconfig.kube ]
-
-  set {
-    name = "ipam.mode"
-    value = "kubernetes"
-  }
-  set {
-    name = "kubeProxyReplacement"
-    value = true
-  }
-  set {
-    name = "securityContext.capabilities.ciliumAgent"
-    value = "{CHOWN,KILL,NET_ADMIN,NET_RAW,IPC_LOCK,SYS_ADMIN,SYS_RESOURCE,DAC_OVERRIDE,FOWNER,SETGID,SETUID}"
-  }
-  set {
-    name = "securityContext.capabilities.cleanCiliumState"
-    value = "{NET_ADMIN,SYS_ADMIN,SYS_RESOURCE}"
-  }
-  set {
-    name = "cgroup.autoMount.enabled"
-    value = false
-  }
-  set {
-    name = "cgroup.hostRoot"
-    value = "/sys/fs/cgroup"
-  }
-  set {
-    name = "k8sServiceHost"
-    value = "localhost"
-  }
-  set {
-    name = "k8sServicePort"
-    value = 7445
-  }
-  set {
-    name = "etcd.clusterDomain"
-    value = "cluster.local"
-  }
-  set {
-    name = "hubble.relay.enabled"
-    value = true
-  }
-  # Enable hubble ui
-  set {
-    name = "hubble.ui.enabled"
-    value = true
-  }
-  # Gateway API support
-  set {
-    name = "gatewayAPI.enabled"
-    value = true
-  }
-  set {
-    name = "gatewayAPI.enableAlpn"
-    value = true
-  }
-  set {
-    name = "gatewayAPI.enableAppProtocol"
-    value = true
-  }
-  # Gateway API trusted hops : for reverse proxy
-  set {
-    name = "gatewayAPI.xffNumTrustedHops"
-    value = 1
-  }
-  # Single-node cluster, so 1 operator only
-  set {
-    name = "operator.replicas"
-    value = 1
-  }
-  # L2 announcements
-  set {
-    name = "l2announcements.enabled"
-    value = true
-  }
-  set {
-    name = "externalIPs.enabled"
-    value = true
-  }
-  # Disable ingress controller (traefik will be used for now)
-  set {
-    name = "ingressController.enabled"
-    value = false
-  }
-  set {
-    name = "ingressController.loadbalancerMode"
-    value = "shared"
-  }
-  # Ingress controller for external : behind reverse proxy, trust 1 hop
-  set {
-    name = "envoy.xffNumTrustedHopsL7PolicyIngress"
-    value = 1
-  }
-  # Set cilium as default ingress controller
-  set {
-    name = "ingressController.default"
-    value = true
-  }
-  set {
-    name = "ingressController.service.externalTrafficPolicy"
-    value = "Local"
-  }
-}
-
-resource "kubernetes_namespace" "flux-system" {
-  metadata {
-    name = "flux-system"
-  }
-
-  lifecycle {
-    ignore_changes = [ metadata[0].annotations, metadata[0].labels ]
-  }
-
-  depends_on = [ talos_cluster_kubeconfig.kube, local_file.kubeconfig, helm_release.cilium ]
-}
-
-resource "kubernetes_secret" "flux-sops" {
-  metadata {
-    name = "flux-sops"
-    namespace = "flux-system"
-  }
-
-  type = "generic"
-
-  data = {
-    "sops.asc"=var.sops_private_key
-  }
-
-  depends_on = [ kubernetes_namespace.flux-system ]
-}
-
-resource "helm_release" "flux-operator" {
-  name = "flux-operator"
-  namespace = "flux-system"
-  repository = "oci://ghcr.io/controlplaneio-fluxcd/charts"
-  chart = "flux-operator"
-  wait = true
-  depends_on = [ kubernetes_secret.flux-sops ]
-}
-
-resource "helm_release" "flux-instance" {
-  name = "flux"
-  namespace = "flux-system"
-  repository = "oci://ghcr.io/controlplaneio-fluxcd/charts"
-  chart = "flux-instance"
-
-  values = [
-    file("values/components.yaml")
-  ]
-  set {
-    name = "instance.distribution.version"
-    value = "2.x"
-  }
-  set {
-    name = "instance.distribution.registry"
-    value = "ghcr.io/fluxcd"
-  }
-  set {
-    name = "instance.sync.name"
-    value = "homeprod"
-  }
-  set {
-    name = "instance.sync.kind"
-    value = "GitRepository"
-  }
-  set {
-    name = "instance.sync.url"
-    value = "https://github.com/vhaudiquet/homeprod"
-  }
-  set {
-    name = "instance.sync.path"
-    value = "kubernetes/"
-  }
-  set {
-    name = "instance.sync.ref"
-    value = "refs/heads/main"
-  }
-
-
-  depends_on = [ helm_release.flux-operator ]
-}

infra/r740/kube/variables.tf

@@ -1,16 +0,0 @@
-variable "sops_private_key" {
-  description = "Private SOPS GPG key for flux/kubernetes to decrypt secrets"
-  type = string
-}
-variable "kube_hostname" {
-  description = "Kubernetes cluster hostname"
-  type = string
-}
-variable "kube_host" {
-  description = "Kubernetes cluster host"
-  type = string
-}
-variable "physical_hostname" {
-  description = "Host name of the physical host for the kubernetes VM"
-  type = string
-}

infra/r740/proxmox/kube.tf

@@ -1,9 +1,9 @@
 resource "proxmox_virtual_environment_download_file" "talos-cloudimg" {
   content_type = "iso"
   datastore_id = "local"
-  file_name = "talos-v1.11.1-nocloud-amd64.iso"
+  file_name = "talos-v1.13.6-nocloud-amd64.iso"
   node_name = var.proxmox_node_name
-  url = "https://factory.talos.dev/image/ce4c980550dd2ab1b17bbf2b08801c7eb59418eafe8f279833297925d67c7515/v1.11.5/nocloud-amd64.iso"
+  url = "https://factory.talos.dev/image/5a697fd6e91537a2c9c45929d004d82af180bb5d4e989dd8494e25fedca005bd/v1.13.6/nocloud-amd64.iso"
 }
 
 resource "proxmox_virtual_environment_vm" "kube" {
@@ -29,7 +29,6 @@ resource "proxmox_virtual_environment_vm" "kube" {
 
   memory {
     dedicated = 32768
-    floating = 22222
   }
 
   boot_order = ["scsi0", "ide0"]
@@ -95,6 +94,12 @@ resource "proxmox_virtual_environment_vm" "kube" {
     vlan_id = 2
   }
   
+  network_device {
+    bridge = "vmbr0"
+    model = "virtio"
+    vlan_id = 2
+  }
+
   operating_system {
     type = "l26"
   }

kubernetes/code/harbor/values.yaml

@@ -1,37 +0,0 @@
-externalURL: http://harbor.lan
-expose:
-    type: ingress
-    ingress:
-        hosts:
-            core: harbor.lan
-core:
-    extraEnvVars:
-        - name: ENC[AES256_GCM,data:Y1D+lAT57F4HpiwnKJuhN3cqr/17,iv:ZARBNcGuiD5U7TnlBuQJLaWCMkQIELpj195aeKaBGZU=,tag:exBNWO/o2CXyNMLr2Y6bTw==,type:str]
-          value: ENC[AES256_GCM,data:EDMjB9DVCG3FiXdWrQmE4LhXTtTPLebKkBaQZ05tooakENXWQ2jm4YNRgBKWibHSM2gAL/z9POEi5BkiD0zK+NQV8DJKFLa8sxg9HR2OfeCqk3gMbq1uwurqrl6+OVX75E0Vqd9xN2CUtvfNVvPktMYn8UBU1nKuiRaHm3Tbt4QpcSQ6Oh1q2t7uqLDxt6DcAVb71gjpUXCZ96gg8/XsWlZXyzwJsfOEi33KlkBQhXYPFPEqq4wkXGqE1G+rT9MNOWc+WUdyY8FbP5zko+4F0Fcprj6iKlw8UB8PCtF7yAwFnxO7Bb0QGXxDGdKx93SbmGwxsYKe9muQZFfdp9rNW4R4L7K/O/ymiV+KEmwuwWoIBKZTHEwgOpD/B94MfEsPOlrmD438Ae3aifBQEOo3Ln6qu7I9md8tv2co4rmY4Wt3bBI8xXIPC1dzKI2YyQ540QtN5L22UZpabLLez0wNiVuDtCG2vg0ncI0flouQ1KjQp8DJ0Wz5i2WABwNg5X4sLU66nquD5hlf2YoNPw8EuY+E5lM0T0xBiv9AJHtQK5rN4AUopQWsi1FTSdFtCOlykBxnoYsLDyEa/73LA8e7m5Hi82IUl/5xR6LOEblEm+6jgcxY5UGaB7hsgh4K2qizmC+TWg0ua8YD4SIJZxqsNk4yz1l9DQAhZBnt/j2/I8K8PObD/7+6ObOfLM8A9UiwyIGUeQ/SCaN5DNMAHwFyELuXgTzdbdTgguJcJDgypCLUgvuVfx8dAOoj6cvHm7c=,iv:PEenzkk4lUyFBPx6e8Ah9LW7M5N7o93aueSE+pQozuU=,tag:rUeeXqEtHUQ3RYn1Pt4rBA==,type:str]
-sops:
-    lastmodified: "2025-08-27T10:07:49Z"
-    mac: ENC[AES256_GCM,data:tp6aHDIfLuBDRBYPmNDn1ZWEq0ZT/WH7GYCJNp52tO1tNldi+kK2avluY0QBbC6/5V8LfxpokN3Je6uBveRVzleituxlK7dvsZ4piITTmR0T79PtUqxa4Jh+7PYp0uTofjme1M2L2MU1sOWrCdRdiKWEpDVIJCCCsZ2oDCCoMTs=,iv:O65a/alrwX4cNJH1tYh4kQPaprmulyAitg9jFhOJqnE=,tag:ewAqx7h1e12bMYGrFC9PTQ==,type:str]
-    pgp:
-        - created_at: "2025-08-27T10:07:49Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ//VDjjaWIsqY0nUFINvzxnt+dullI/+lHYQTfWvZ7LqH4d
-            TN2p2VZRGRkupYUYxt4iucYl6qViGey4iaQopsYrV19kJ+eEJuI+depXYsKBAccs
-            24rNJuTLHYi7r353u48qUVoQcE6uK0mYB8/4+w5J6uANvwmjXUtDMEHUoiBCh56+
-            F7olPPSPUjXv7BpTNq5EC8YjGRjUjQNf1NOyHHz1eTsyDbPszIs6eT1q98AMo3GZ
-            boh7T6Z2yLI7Bj5guEn5OfwyFtB9DzcpaHajDgF309CsUsxfvhoVH85rx58vce3h
-            QW2zy7KPvNEr84ZsTBQwLqi318JiSD1egx4m+CPvbFvV1s7DFDgQQifLRzlqR9/d
-            PZc3DAZ81QzXhZV9Wh4nxG26SQtsbVxAjdfLrpvpDLV3l0wIU8bzP/UsskjGa8zR
-            VBriJ6qGeeDeXVVuxcLMlAhd8R8ipEvLrId3TzvAPRClk4+fU7wzTfqR8Cl9hu29
-            csLtPW4Fu6iZshf3UJJ8KEhjYo6060TlfEZX9hzypJFf+kwJopSrS7KCPFheNBkN
-            P2cuyBgpG8OANQ0vYx68mgkDqqWVWNXAjUHxcp98IjZxwcSfMR+HwZi6xbK97GKS
-            ltqUSxYixLQUelHJX9YHkheXDwfH+q+CaG76IznvMrFi+bB4laU+DmmVnfPZT1LU
-            aAEJAhDJ8KQkP2yRHCV2qycNpY0qBHN6pk6FXQq7O7dl3Z1oQXkS88KopCwan36k
-            Hf4vvXRGLR4fm0uFYhN9aApnDFQuWm4NjEGiNyg6p6WN0XMBNARWfmTyDNc8xceA
-            Q5I2AHdBk7Nu
-            =+11i
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
-    version: 3.10.2

kubernetes/dev/gitea/actions-token-secret.yaml

@@ -0,0 +1,35 @@
+# Registration token for the Gitea Actions runner.
+apiVersion: v1
+kind: Secret
+metadata:
+    name: gitea-actions-runner-token
+    namespace: gitea
+type: Opaque
+stringData:
+    token: ENC[AES256_GCM,data:IOVPnopbQKY7HBT9tlnfuwvakgegLuK+PdTTwg+eRWdMz+dAoIxhug==,iv:QhfgyXNuZnYTXV1X16bdR+Axhfbe7buoRjXV8IdSbZU=,tag:r5By6+E45B04vgZrBoPSsw==,type:str]
+sops:
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:o3gyJNXJIBE1zSV4vWKFQWfmwZvz5Ek8ie/SjU6cF6kOqaLae2y9WBqYCQphCpasgN32qP0RM/bzzV3AZlIYqGEzI6lf0ha7aDPdVJKMy3ieie0F/UW6fJcTfidEFZYFKereRQwCWTzOESIZmsc+fqisyVxW3wL2yyYuh1a1HPs=,iv:RsG3AoqpMqR19DPQdqzfjbKNV5FZPxEsTbIZzzJtXq8=,tag:XzsmRc58Q+cNmBZXtygV3Q==,type:str]
+    pgp:
+        - created_at: "2026-08-26T19:28:03Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiARAAwpBrBeb3ywJTc54HNC7s/3+tqCvlozNym8E13jqHREOY
+            e6bfDO2hN2/JvbdGfMaWspLa8mU9ten6yFfUtoPADfccmbWwRAgS2mJuLyh5tksV
+            p+9m5vjyRQBH35pfTJ4F6Ksf7/2V8M4b2PxzBzTVQseqhOC2notYdvQeWED0gH1S
+            6cQvPClv/X214I9FfaHNig8SB7DV8uJ6ttj+IG9RL+NZ8lkT5GObSrphR6QH25Ne
+            65VMJmjcQLIWfZxR+zYVAxTsSeeDMFUY28WBUfjRei+WZ3ggmFRVERZzG6oSXfoA
+            nlqSQU16TyqadubPV2LcapqR/IwoSKdWO1/RmxH1NAFNvMg9nYLHzffAwPGL5wzT
+            GQZci20IlRQ5CLsaREyI1SNqYfjZ6esjUw8iKr5/bsr9XuI3FnWgqnKoAMs8O7d0
+            ZSGAohsUNrRki+ohhXtZFTelzufM1Hrt3Yz1TYQWtvoD7j87hq45BEZOU1ifiwre
+            Re0IhzcOdiBbCd3Lm9WSNmZzKHZoy9PJR/zaaitzZasIzsCH/7KjLBO0h1Bz+Osf
+            9Yxl5BMrUDFLlCIT0ORKZFtugwvS7Ez0IISMuRnSGjcutVsZGP1a6fN5K7oaSeAv
+            J9+9u5BuqRUs6ZYkC6TVqX7S8tAJkCOFIOFqxzb/oI2SBdRQmPP6Ix3FmN8NFu7S
+            XgGr3gKAnEDyuXwdZY7guYdVIteiLKUpvqk6F0yQD7b/rDGQoBD/g1twbx21ZDcI
+            UJ9aijLLe4JDcP02LNb64y8LaDb8VdFqlAIzV+MsYTwHAY3dB7LQtMGSmVlSZNI=
+            =lc7+
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
+    version: 3.10.2

kubernetes/dev/gitea/kustomization.yaml

@@ -0,0 +1,20 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: gitea
+resources:
+  - namespace.yaml
+  - repository.yaml
+  - release.yaml
+  # Gitea Actions runners (gitea/helm-actions "actions" chart, same HelmRepository)
+  - priorityclass-actions.yaml
+  - actions-token-secret.yaml
+  - release-actions.yaml
+secretGenerator:
+  - name: gitea-values
+    files:
+      - values.yaml=values.yaml
+  - name: gitea-actions-values
+    files:
+      - values.yaml=values-actions.yaml
+configurations:
+  - kustomizeconfig.yaml

kubernetes/dev/gitea/namespace.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: gitea
+  labels:
+    # The Gitea Actions runner uses a privileged Docker-in-Docker sidecar,
+    # which PodSecurity "baseline" forbids
+    pod-security.kubernetes.io/enforce: privileged
+    pod-security.kubernetes.io/enforce-version: latest
+    pod-security.kubernetes.io/audit: privileged
+    pod-security.kubernetes.io/warn: privileged

kubernetes/dev/gitea/priorityclass-actions.yaml

@@ -0,0 +1,17 @@
+# Low priority class for Gitea Actions runners.
+#
+# Negative value + Never preemption policy means runner pods never displace
+# other workloads, and are always the first candidates for kubelet eviction
+# and the kernel OOM killer when a node runs out of resources. Combined with
+# the hard resource limits on the runner pod, an intensive CI job can only
+# ever fail itself — it cannot take the node down with it.
+apiVersion: scheduling.k8s.io/v1
+kind: PriorityClass
+metadata:
+  name: gitea-actions-runner-low
+value: -1000
+preemptionPolicy: Never
+globalDefault: false
+description: >-
+  Low priority for Gitea Actions runner pods. Under node pressure these pods
+  are evicted (and OOM-killed) first, protecting system and app workloads.

kubernetes/dev/gitea/release-actions.yaml

@@ -0,0 +1,34 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: gitea-actions-runner
+  namespace: gitea
+spec:
+  interval: 1m
+  dependsOn:
+    - name: gitea
+  chart:
+    spec:
+      sourceRef:
+        kind: HelmRepository
+        name: gitea
+        namespace: gitea
+      chart: actions
+      version: '0.1.2'
+      interval: 1m
+  valuesFrom:
+    - kind: Secret
+      name: gitea-actions-values
+  # The chart has no priorityClassName support: inject a low-priority class so
+  # runner pods are the first to be evicted/OOM-killed under node pressure,
+  # instead of starving system or application workloads.
+  postRenderers:
+    - kustomize:
+        patches:
+          - target:
+              kind: StatefulSet
+              name: gitea-actions-runner-runner
+            patch: |
+              - op: add
+                path: /spec/template/spec/priorityClassName
+                value: gitea-actions-runner-low

kubernetes/dev/gitea/release.yaml

@@ -12,7 +12,7 @@ spec:
         name: gitea
         namespace: gitea
       chart: gitea
-      version: '12.6.0'
+      version: '12.7.0'
       interval: 1m
   valuesFrom:
     - kind: Secret

kubernetes/dev/gitea/values-actions.yaml

@@ -0,0 +1,99 @@
+# Values for the gitea-actions (Actions runner) chart.
+#
+# Hard resource caps: CI jobs can be very intensive, so every layer is capped
+# so that a runaway job gets OOM-killed/throttled inside the runner pod instead
+# of exhausting the node and taking it (and everything running on it) down.
+#
+# Layers of protection:
+#   1. dind container limits  -> hard cap for the Docker daemon and ALL job
+#      containers it spawns (they run inside the dind cgroup).
+#   2. Per-job docker options -> each job container additionally capped below
+#      the dind limit, keeping headroom for the daemon + image cache.
+#   3. Low PriorityClass (injected via postRenderers in release-actions.yaml)
+#      -> under node pressure the runner is evicted/OOM-killed first.
+enabled: true
+# Register against the in-cluster Gitea service (chart "gitea" release).
+giteaRootURL: http://gitea-http.gitea.svc.cluster.local:3000
+existingSecret: gitea-actions-runner-token
+existingSecretKey: token
+statefulset:
+    # Single-node cluster, no point in more replicas
+    replicas: 1
+    timezone: Europe/Paris
+    runner:
+        resources:
+            requests:
+                cpu: 100m
+                memory: 128Mi
+            limits:
+                cpu: 500m
+                memory: 512Mi
+        config: |
+            log:
+                level: info
+            cache:
+                enabled: false
+            runner:
+                # One job at a time keeps resource usage predictable
+                capacity: 1
+                # Raise if jobs need longer than 3h (Gitea server-side job
+                # timeout applies as well)
+                #timeout: 3h
+            container:
+                require_docker: true
+                docker_timeout: 300s
+                # Hard per-job caps (docker create args). Slightly below the
+                # dind limits so the daemon and image cache keep headroom.
+                options: --memory=7g --cpus=1
+    dind:
+        resources:
+            requests:
+                cpu: 250m
+                memory: 512Mi
+            limits:
+                cpu: 1500m
+                memory: 8Gi
+    tolerations:
+        - key: ENC[AES256_GCM,data:wLfr0r+e9KYm,iv:BGZnWKQUlOje9RhAs7tBDzNcDt5LcfTnqRSqrdFc/A4=,tag:bb1f7NwEwmEzrf5k9ivFPg==,type:str]
+          operator: Equal
+          value: failover
+          effect: NoSchedule
+        - key: ENC[AES256_GCM,data:1kBsMuUlpluDmpVddyZCI/ylRbluHmQ62F88Q9LEoiZkgdpm5g==,iv:IlggVbY7s/xaSM2ljMkiTDwvIjf12g3SQzfL2fWWf78=,tag:2aNlCFumidKSbnoUV1IBzw==,type:str]
+          operator: Exists
+          effect: NoSchedule
+    affinity:
+        nodeAffinity:
+            preferredDuringSchedulingIgnoredDuringExecution:
+                - weight: 100
+                  preference:
+                    matchExpressions:
+                        - key: ENC[AES256_GCM,data:JuejrbDWeF+d/+d2Hq+q4V9vihk=,iv:VPgkBuv2hqJbTNFXpv3SzRGtFA6iVq1kFR8hfANg0cQ=,tag:D/wrkytnO8oZ3/+4yicq7Q==,type:str]
+                          operator: NotIn
+                          values:
+                            - "true"
+sops:
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:srIJjIgWx1OGgGwz71wQgT8c1gg64iV2VHrrb11SYXpaYg0VMp9d0maJHCaKt5rDVtWw/+Ft4WbR0z2FJBLEmr64/cFX8/SgrOR7pAc/vAgPKfxiSHg6iJoVCGHssGHm4NzvSUC2fkMqc8WUiZDR5hztUKSlp9oNPO2bKZmw7Zo=,iv:tgSmO28JZiGK9xO4uIH35zlRzJcW8lKxaggtqXlFq/w=,tag:+mIagmS+Z5RSFdSo/yDhjg==,type:str]
+    pgp:
+        - created_at: "2026-08-26T19:28:03Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ//X9NxtKUDFkdKDmWQh3wRSriiq25U7gkL0Q7SE45Tz5V6
+            03i6QmzCyBpI81TQQBRRzfdkuuqocBgplTRRRvFsNQNcwc5KCq1zHIDVYE+XlcmI
+            /bwA0GpBZwDN6Mv+G8+6UwhSp+YgsiGFTVAIctfz90cRYPpABX4wRcDYInTlifHk
+            weBq30iS6Nl9TajpgyyAUct6EBQ8u1YmxsII9RYWjdoTS/SAuAxNM2px7fwOPAoL
+            fq6/AxXj1n+uKjxl1calL95768RmLUerdxDmac53/73Pj271hmbwrWqe+JzkSriu
+            YMHYNOVLglf7nS3AQSqAa9PljBv7xHw9jOUqkJH14W7/NpSRvc4PICyIWA3Yfpfq
+            ymMI/OOYosyl3ZYhfLGUIAIYLkA1StgGVfpmeOmUCPEn2FIInBmguzDRMrdnUkoz
+            KYh/06Ug6YsgCTsy8Ffhzy724ITRADzqYlTU060tTwFN7cgFVHiIfZdYIFxDxNSL
+            NELw8Nl7+9jkWjlnmPvtxfrN90L7nBm4s3mZrYeyZ1/ElcxDkJKb4r+PJuc6rCpM
+            tuD9BXxjl5qa/trl/1+fVToDMMm5vws0MLl4DBkbNUNkD7wWko0I4rDSZ+X4SihM
+            /V7XgzeQ41KMnDdZYwTKdIVhCpZOIBwZlLuZSYCn8uhqO0YMkkpB1x1EOb2fy3zS
+            XgFdP2zpsUHWsy/iENHCgnMkQ+l2XwZZ2bgZGqwpRbLO0fDNX0kRZ45NzKl2+t79
+            npggZ12JFTPPbQG+o0hY0p7LjnjbfBsp7m9ykvymizZXlzP9efoOq6kjD/CRBu0=
+            =WgiB
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
+    version: 3.10.2

kubernetes/dev/gitea/values.yaml

@@ -1,5 +1,6 @@
 image:
-    tag: 1.26.2
+    tag: 1.27.1
+    rootless: true
 ingress:
     enabled: true
     hosts:
@@ -20,28 +21,28 @@ valkey:
         resources:
             requests:
                 cpu: 100m
-                memory: 128Mi
+                memory: 256Mi
             limits:
                 cpu: 500m
-                memory: 256Mi
+                memory: 1Gi
 postgresql:
     enabled: true
     global:
         postgresql:
             auth:
-                postgressPassword: ENC[AES256_GCM,data:5SoftEfh4w8hmA==,iv:QbbOmVM3Jp3gxAxL1OvnB6WKFX+OTHFENz1roMnPqyc=,tag:Gtn7H7d3O7Hweg5q6P6xUg==,type:str]
+                postgressPassword: ENC[AES256_GCM,data:PtWMsukqbrWiVg==,iv:iQtDckrih/3ZKopzD9eEViOMZrvSulmCI5tHCsJph1A=,tag:7S54w4ADG7+8QNiLDw2Q0A==,type:str]
-                password: ENC[AES256_GCM,data:0BMgFdvPvhB9oQ==,iv:Z0mkQBfhpc7y1nSLY6MOucxwuKZ8TfOk6NlQE9RwVQw=,tag:yGDAOH6TCJDCfhxNlC/eCg==,type:str]
+                password: ENC[AES256_GCM,data:jLC1oEl+ZAnpbw==,iv:PliGMmxHKn3eEt8uvsv9wL4syk91EC5OpA7AL5J0+4o=,tag:Oan4ek7m0Cxnl5bzOCGHXw==,type:str]
                 database: gitea
-                username: ENC[AES256_GCM,data:F7+91aE=,iv:tEGgJ6GoXVkNoD6D4ZnyClrOQLGlqzFIUqqwDrVjd9U=,tag:H1+f/EKf/KptooRf8g0qcQ==,type:str]
+                username: ENC[AES256_GCM,data:ricveNc=,iv:rPrHKhIzsNEQzoaX2cPDvVWjR7NIxsN1tBlzLB80IQ0=,tag:n64SpL6qM/IT9D7t85/Lvg==,type:str]
     volumePermissions:
         enabled: true
     primary:
         resources:
             requests:
-                cpu: 250m
+                cpu: 100m
                 memory: 256Mi
             limits:
-                cpu: 1000m
+                cpu: 500m
                 memory: 1Gi
         livenessProbe:
             enabled: true
@@ -75,8 +76,8 @@ gitea:
     oauth:
         - name: Authentik
           provider: openidConnect
-          key: ENC[AES256_GCM,data:oq+UsuiNEGWphxXbwtbBs3d27bB2cVPoR617TWhcPOk67D7XWUPkmg==,iv:hODOA45FFex/b5ghHScnDoc5osu1d8bzD969oFVH3wE=,tag:67TMl55I6zgJWNGMqco6fg==,type:str]
+          key: ENC[AES256_GCM,data:9UuG23PYFiWrQKJX5xGxMgyWKLPFCxKjDUYJd59rMWcdAw619/v/Bw==,iv:AfHV1MzbYi5Z5Bb63/51Hmy9rM247b4quwKCzo7MpYw=,tag:pfpz7hhZyIUjIGGcxZVx/w==,type:str]
-          secret: ENC[AES256_GCM,data:o9BZSzy61ouycNgtgRg/Jn8Wz+hLBBqgX46iHbaYtPbUVPVFc9tpdCsTdHCpfSGfiS1B8kWcoSzIDIAIIofRSCS/QqEQeuTwsyakkXhgn/LtLn+TH7bdLLS8qqusy5MZ9U18IJ/UBPGZ5+16Y/glbhpfHu9NNv0AI07nPciTq1w=,iv:7dn7eW2oEK/EU4xIETwVSekZUmktrs7U9KTJC486nHs=,tag:Otl2KuySu9bI/cZfCyjiKA==,type:str]
+          secret: ENC[AES256_GCM,data:PKFx/LhjwWJluC6/RHc1eMgw4TZXkXymNCrc7TQU6Bp5rGKHMvACC+G+MjXGylIMZVt65LHWq5YEHJNjO8HMsa4ejGukXDuU9sCgKaOOniCs3EQivfVsCCHtF/G48eULPkege7JRzTbmJSYJDnscsSikwvUDChy+zGlC2ZmBZjk=,iv:qsIaaeXepJ9ECilo+05+A0i2joxV0svBOjgL37DkimE=,tag:/3Xer7Yb6QyUtmPIOvSLQQ==,type:str]
           autoDiscoverUrl: https://authentik.vhaudiquet.fr/application/o/gitea/.well-known/openid-configuration
     config:
         APP_NAME: Gitea
@@ -105,36 +106,36 @@ gitea:
 # Resource limits for Gitea container
 resources:
     requests:
-        cpu: 250m
+        cpu: 100m
         memory: 512Mi
     limits:
-        cpu: 1000m
+        cpu: 500m
         memory: 1Gi
-# Increase replica count is not useful for 1-node cluster
 replicaCount: 1
 sops:
-    lastmodified: "2026-06-27T10:20:08Z"
+    lastmodified: "2026-09-09T21:39:30Z"
-    mac: ENC[AES256_GCM,data:VZY4oK2PCMBJd4VozL5qS7jlZtOu1JNsOn7aqJgPZ8uQR7kG939By7oVELMH9us0Sb8AZIYmzx7nLwnlp6IUNnacOffhKNl4stTFrb5Vry/5zem0CNp08eEDEt9VoxNudfQYC2axuGSwbAIahMzZsOYVRqOGgF1gEG17+hgd7ww=,iv:MiHKGUfzaSAppXLLxJSQD5loGkToFLzVQetWoRHq074=,tag:FduCPbHmy6A0mYdCrnRxDw==,type:str]
+    mac: ENC[AES256_GCM,data:ACBKJLGUfWw9T3fOhQMT251gcLzG3bUXjUqBxG1DuPl8c8bblaIpLOu0QsrfQziQY3jM0DFJ2W/I2vjkrhCuCaZhZCtRg2nzUk+7HelqjEdKLphSuIdlHIkz7Icu+khShrwTgmQiE00Gg1WUsLRkKBgNsOm3TMK4wB874iBvSYY=,iv:Idp0+UBXaRFkpOFKFoRrLKuN1mOmfM7pukC22KkNiCU=,tag:fL9DzAo8FSx4PblVlTHtaQ==,type:str]
     pgp:
-        - created_at: "2026-06-27T10:20:08Z"
+        - created_at: "2026-09-09T21:39:30Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ//VDYGwZupOfefdEtJkD9SPOW3tHcOy2XR6ULhVQjXTGGh
+            hQIMA7uy4qQr71wiAQ/+PK0/kUHlc+exa8slolUeTGjHzd/R1Dtux/+HJdC9Vpow
-            APuONtgUZKFCViUqYZB7l6fazM8U/fv3cHsIpZfALFGE9wSZ+4So6D5dmBj13egh
+            ImAQvIdkEjwL0FmoA7Z4val/Wzx/YzFJ5r6sADNaQ9EG7QO+I8WY3VrKj5aRi0Qz
-            yznV55xjinoaKPzaYYZoVmlt1ZO22SxmC0vld3yfAs89KD1Aow5wNZGTBELzyAWF
+            +FgHAgng+wdRCCBoxv9Z+MTPSl4TwrKsbrulHAg7EayDKxwGzkyMrnxvukRqD8GB
-            gMYGMkCsLlH3gqBaJTV1m5LKHHQAtoyzvJbKcpiynNRySfN/ogNX67GmgEMH9+u8
+            iMQCUadudR458fzB04dkhljAbl/FqX5ppflzEoGVCiRSBcWNkaHgyYqopYGzMASy
-            UexPwUHL6skIzHLmugYcrs4FAABot4WzoJsR794wOq/DEqHBE4SfQg48y/DROu2O
+            KTzoV01adnOZY+xeZa5GasgCEbCU3BDesD9vBb+sFsRugVuRHzdyqp3nVBwudpeh
-            mgo6KqiXXe8qPGCIvjLiudb7MdSLpoLqgZ0vpExzdS/wMXAXczodrRRJmzEQyeDE
+            OcE9MOMyBN1SAdx9RCsB8aHWYndF1dim84ZWgQThkLlA+7CWJt/NyFYwmMdqqzSv
-            j08pquhfUzQ1SA/9VRQkgl4r0dj0CTuc+EhvHD4M9nj3JIjvuJ0AdyKye5S8rdNM
+            C7slojC6B8bb3863c5w3qe9TPPBwyTOcuNTMunr6wXidlPZWtsImhu/RX9fqzFjZ
-            rm9eyX8V+o6X811qUM8bobKEi36tdnSMiB1yVHTtdW7hKctQwRMNQ8A9QEtOxS2F
+            9X1+wAjAfs7AASeNJLFYqiPrknSAA3JumQZtrFC5dejpTj9H2ns6DkiHSZy8FA8O
-            +9Owub4LXZwBejSLgh9jaKEnilJQKVYN5Aw2lNAmZZZKtJ+iGHHkq9H6k+k5oEoG
+            RuZ8hv/L8L8oilbubKnKFZLhR8lh8A1jXHUxzaEC/L4o4cd7/3TlEms/51yM9qYx
-            xkQ/IYIEGLhfjH0PDZ9m2G3Ren3EkEkNjYvhwENhuUcyuW5Abl62v9FMY8c9NYyK
+            WJOz4H8lbphDYO4tFgsGAhL/yHbLHvww/X1hNldwI7mqYrFLSjIwxW2Oxo8c+QB6
-            +uf5VS1ceHOBcelQcdSx9Kuox5UuyUtbwUcv+HbTmymZtmYdw+dnOTtRHR5CNY7S
+            yZ3VxTXuS9jEVpGTVhIOfepwS8rJQbTUeewqok3riw9GpSEFpOMWsBxlT6+HI8zS
-            XgEvPWAEagJpsmqC2n7Vc9d7b7TVp+SLSiL/w0v9JD6ko54Rwj0x21Odx3FLe7P6
+            XgHPVohxe93kk51O7WjBgq8PAwG7DtWrygqWYORz+pTYN8wTtC4pfotiJZ7hv7Gv
-            obKU6XNNX9PPThJw2W0E295i2+DmOTH0AFio3rsg5wM3JFUokY/t8590sWnFR8g=
+            NICEZlirrTUdIol8jyM+yRv1gWuYwQJpjnrQVY2AoAQX6ta5/3st24cyuGwGHO0=
-            =Gypa
+            =Q6Pu
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

kubernetes/dev/harbor/values.yaml

@@ -0,0 +1,37 @@
+externalURL: http://harbor.lan
+expose:
+    type: ingress
+    ingress:
+        hosts:
+            core: harbor.lan
+core:
+    extraEnvVars:
+        - name: ENC[AES256_GCM,data:lr90LLYoAKXh8PqT0QEmELOWBxKm,iv:y9mIMG3ND6l4rBnhW6f5FoU5BX5m4vi4WW87bv1XOB8=,tag:gtoyqreaGqG50Of69Pfqlg==,type:str]
+          value: ENC[AES256_GCM,data:qSCBq39+RSf1KGLyZ9TUKgVXtrXhvOhtR791n1hWKSUWho3YxM2LfTRJwcmAcLyIu8numioNlKEWQKDvOEefURzFy05RXkUYWa+ZebRp9c2y0d5ZrSiRDHM2cuxHRjeg/g4QKoX6IVhIcAEIqfHIs1NGxoqeaopAZcB6lGqspZZhzduUYJUWZGULylYdTpyF41F3RKv3xMnNBAQX2FCP3wOeb0DM8s4JMcgJ2eZwRDYecjotTC0pWL7LAZiZaLJR97O8/4cjofc9cGKEcyy0Yf05kSMxeZDWqrEplXNu2y30szafzC0SqkRwDPlifRUanNU2FaT/TIz4Ixklws7iaY0Db9yW+a+SvaWpNTY3pecbo01+4RG0eIDW4sRJFBp3/70vZ2FjCDDzaw6OEJYxrDf1fJ/UGGur2/rzDwLMhQgiRzIKoqq4n87hg1zwZ9ki63tKc+2Mp9oZ8GlvaCuNLMoG8QjXrxCkz/rcEL5Gkb11XwVAnsFdCCZVNfLstqQKpdnO8d4vvLHyRlw7lkf3ggX/b2l7Va/EkpHYONrwIdigd9ambMlHDRRhox3onZsgVaNqDdf5E8oeZJABqKV/1BT7oQn5Jx06kQhN7KvI07y21bQM2Gtvbv8LyhJHPdU3gZwtKEglp9+bU1UvFbQv9lEFm+1crQKBcgySCD8iLS+D2Tp4Y45qWjwD9Nsa2U9eGiHA1o3JZ5s3ltc2ZZVUvTpswRAfok66YqmL+XdbUkk6OtkSLS8FZVARHYbZ4bU=,iv:uxPwCWlMTEgtfGB93ywnMZLEBdNan+K7Bm0xuprYsPk=,tag:oLVwtUcrbERt9GExKo3tLg==,type:str]
+sops:
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:UVtitK0Ct6M7scvv1qsP+QeQL7S89+856IozBcQgnLZJzeZ5cquzKvrYZ+q7DeL1rk6EWvsxxFAFnSUDLfqCItEAMs4QQhORqplv6ot6BeW0LYUf5i1646Kl7x7Mg0RkJJ4OLsfqCwNPDT0opBQBhbYwTl3HCta8McCjSg96xNs=,iv:ebt36qndBjaThOJfAVJ7ACN06NrRSJnFlFmXIH2l4gM=,tag:TArRCiiM0xdMvOcZDqBrCQ==,type:str]
+    pgp:
+        - created_at: "2026-08-26T19:28:03Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ/+JkaqlVRJtypgMHl1jg9Dv1XqgeEW/5tv52YgxvNYk5kS
+            MJBeuku6/tVGb7i3eArj19My4hQLTXPWv/SK2cBiq3dKnjEs77Nfc1ffRJF/J03W
+            Ur/zy3o9lhVaWOTYVPTH1QIOehJS749ApadN7zB30g4RiOwJfTWiivEx67TzalDv
+            nvRMaotbAWxyD0PNpWV27i93FK8SIUy9HufpZucoN0BQ0moAj9BhbneumB+dUwRe
+            gh+C6LzbRuehFvegIh8DlWIKeMH1L0xW100cwuXyf6FOK/FM/pSsWX1IdlXD5Hfv
+            OSt4QHJESepTmEukfEgyywBMxk1iKdhW9/xa5lkEGxfGv6LnomzFWuKKOqiOF8GG
+            ZTt3NIj3Hr0S0USehbyQwQNOB/EvWTSWcoeaEVUmdphil8rZySZ6B2kkHWaj60YQ
+            cxb+vv9wgrjJitAhwds/xI5HYk0VSXdwtxZPTB4wqzNak5jHFKEY6/s0meQHk3Y4
+            UF9JIZsxLgPGGpAxzYka+Rlibv1FlPpyWQJZet6NGD/VbinhosIVv9vSZA3PqbyB
+            1x31PxGbKac/b7yeo2AfncpKPm0A33VENv1btRbbBGc2LRkYyLnlTDGmHbBrFE0s
+            HNnh4Gfc5EU6+GQo9UO7WIex5AQLvje91js895StVeh52ziyCBdjUwy6hhlSERPS
+            XAHgjHq0JXu8+cZrgjWyPlLcDYbMelW8RWsiGvvyZqUJn5YfVLBkMpSYVRanC0ib
+            3jBdLOaHKZvi9na0Tuf6QcWHep8J4hj1u80yUmIIzk0Xyv5WFYcypJ+g7KqC
+            =MmP5
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
+    version: 3.10.2

kubernetes/dev/renovate/kustomization.yaml

@@ -0,0 +1,14 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: renovate
+resources:
+  - namespace.yaml
+  - repository.yaml
+  - release.yaml
+  - token-secret.yaml
+secretGenerator:
+  - name: renovate-values
+    files:
+      - values.yaml=values.yaml
+configurations:
+  - kustomizeconfig.yaml

kubernetes/dev/renovate/kustomizeconfig.yaml

@@ -0,0 +1,6 @@
+nameReference:
+  - kind: Secret
+    version: v1
+    fieldSpecs:
+      - path: spec/valuesFrom/name
+        kind: HelmRelease

kubernetes/dev/renovate/namespace.yaml

@@ -1,4 +1,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
-  name: gitea
+  name: renovate

kubernetes/dev/renovate/release.yaml

@@ -1,19 +1,19 @@
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
-  name: linkwarden
+  name: renovate
-  namespace: linkwarden
+  namespace: renovate
 spec:
   interval: 1m
   chart:
     spec:
       sourceRef:
         kind: HelmRepository
-        name: linkwarden
+        name: renovate
-        namespace: linkwarden
+        namespace: renovate
-      chart: linkwarden
+      chart: renovate
-      version: '1.0.1'
+      version: "46.260.4"
       interval: 1m
   valuesFrom:
     - kind: Secret
-      name: linkwarden-values
+      name: renovate-values

kubernetes/dev/renovate/repository.yaml

@@ -0,0 +1,11 @@
+# Upstream publishes the chart to OCI only; the legacy HTTP repo
+# (docs.renovatebot.com/helm-charts) is stale and lags behind releases.
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: renovate
+  namespace: renovate
+spec:
+  interval: 1h
+  type: oci
+  url: oci://ghcr.io/renovatebot/charts

kubernetes/dev/renovate/token-secret.yaml

@@ -0,0 +1,43 @@
+# GitHub Personal Access Token used by the Renovate CronJob.
+# The chart injects this Secret's keys as container env vars (envFrom), and
+# Renovate picks up RENOVATE_TOKEN automatically.
+#
+# Required scopes (fine-grained PAT, restricted to vhaudiquet/homeprod):
+#   - Contents: Read & write   (push update branches)
+#   - Pull requests: Read & write
+#   - Workflows: Read & write  (repo has .github/, lets Renovate manage
+#                               action-related files if configured later)
+apiVersion: v1
+kind: Secret
+metadata:
+    name: renovate-token
+    namespace: renovate
+type: Opaque
+stringData:
+    RENOVATE_TOKEN: ENC[AES256_GCM,data:XgCD6ppqguo6MMv0OScXUkqhn07Mo31F8o4yf9Hd51wHjpmh/DHBSREqBzYpETrB4vDjec9AVyylOTz5qEITFdme+K8qg4L6Ti/JPIm5WOPNsXD84k3ZFIr6PWvQ,iv:ovQhFt2XlyHYzadYlQnQQ/X/NFV+9CeacZ40B1WYjqw=,tag:NTWOBN0ceJ7evKGq+y+cFg==,type:str]
+sops:
+    lastmodified: "2026-08-26T19:31:53Z"
+    mac: ENC[AES256_GCM,data:1EsEQ1JmB0pTgoA062k48hKAa4IUNKm55E/9bbmHPRcI5CUC7IBC2npT2yn0+6eQ7gTSqdrbqZw+xu0LAF5IrEjIIscKE7yZizkFAIy5VuCdZdAOBlvLtc1GXg7PE6ACXn8wHDcWBcAoq12HEAtpdXS1dNhdZBFxkB27RD7UvYw=,iv:hPeTFZlrqXyVNuy3D00VeLqecKDEKKGe/AhuFwSxPYs=,tag:O6+OYfJU3QeL58f5/tUQkg==,type:str]
+    pgp:
+        - created_at: "2026-08-26T19:31:53Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiARAAvkrhQ3QLbfF4xTCjmLnY4BzudBMrx4j1+zjG7S8MZ/oL
+            Vx4ji8gAxRIvv6DZ/eSwybeTijtY4ROUQRAm+2Ut5r2yKVGZiokTUE3js/SgQ4Nx
+            uSMcEdn5GOilgM/c30GXsWzCo3yiGWWCNISwxOLvdRC2FEw0OYxTRSEvtBnck22q
+            FExVE6fvH/ks7nak3ry9Bo4OEVZZrLmr8MR/RL/l6Z8AyOLCp7yss+a0OvTb+NRq
+            PVQXmoLlRYqEdbkW8lbyt32oJ451ukMH3l6yscC0ZxHIC6XvKUwUa9uhcUPLZq97
+            o73fmYqCSKmfLc8CMTDX97d9yuApOepZZtVaJGxLhxd/pNIZNwbojoo6pCKh8bdY
+            2CdSf/FA+EqjG1B6CtzHCE35FgiYuDxFsOM7WbPROvT8n7QYVnZGI/QoFawWAFsw
+            heFi9sDGBcqM+bZDo7NTV0Nd25Q/+GfCHpK1BAug4n3K61OuJhJfHw1kadbH81y0
+            vWN9AAQTYfu5FjqMjSbyASbTYNX28a776ojYrR6HGgD2A5PyC1vBAR+VZwSernfm
+            N+wJ8YAK/2hPKVReEhYFcJiSm/MuNW9QD49/gbj7Y/NFs5NEJlV33cAEo6hyduR+
+            Z+Aw2M9xOsz+qFop86oRGSXNCZh/TG/G5/7rjS2zNG0vQAsgQ+xVXmDJPsmZnPnS
+            XgFuPLMkIN+DFl3PaX9LwkqgROXA3KGG4jZsZ4qzQ0+fZOCAvoU7FNXKnyQ/i2qv
+            NPSRW2WLDAAbqwjj3jNxdd3JFRbDq6XQ+V175fYN8sTFuOYLq59d8YD7Z8e9+aU=
+            =xVRA
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
+    version: 3.10.2

kubernetes/dev/renovate/values.yaml

@@ -0,0 +1,70 @@
+# Official Renovate chart (https://github.com/renovatebot/helm-charts).
+# Runs Renovate as a CronJob against github.com/vhaudiquet/homeprod.
+#
+# The GitHub token is NOT stored here: it lives in token-secret.yaml and is
+# injected as env (top-level existingSecret -> envFrom), picked up by Renovate
+# as RENOVATE_TOKEN.
+cronjob:
+    # Aligns with the "every weekend" schedule in the repo's renovate.json:
+    # one run every Saturday morning is enough to open the weekly PRs.
+    schedule: 0 6 * * 6
+    timeZone: Europe/Paris
+    concurrencyPolicy: Forbid
+    successfulJobsHistoryLimit: 1
+    failedJobsHistoryLimit: 2
+# Top-level chart key: wires the `renovate-token` Secret's keys as container
+# env vars via envFrom.
+existingSecret: ENC[AES256_GCM,data:tt9OJ41wHayCWgQYd+Y=,iv:jBqe+K1hL36ViFntV4cU3qh9jdnG6W8e4LiE99rIFIA=,tag:Kj8/qKd689iIatQgUc+9iA==,type:str]
+renovate:
+    # Self-hosted config (https://docs.renovatebot.com/self-hosted-configuration).
+    # Repo-level update policy lives in renovate.json at the repo root; this only
+    # tells the bot WHERE to run and WHO to authenticate as.
+    config: |
+        {
+          "platform": "github",
+          "repositories": ["vhaudiquet/homeprod"],
+          "gitAuthor": "renovate[bot] <29139614+renovate[bot]@users.noreply.github.com>",
+          "onboarding": false,
+          "persistRepoData": true
+        }
+    persistence:
+        cache:
+            # Persist the repo cache + SQLite between runs: much faster clones and
+            # fewer GitHub API calls on a weekly schedule.
+            enabled: true
+            storageClass: longhorn
+            storageSize: 1Gi
+resources:
+    requests:
+        cpu: 50m
+        memory: 512Mi
+    limits:
+        cpu: "1"
+        memory: 2Gi
+sops:
+    lastmodified: "2026-08-26T19:31:53Z"
+    mac: ENC[AES256_GCM,data:fA2nukiGOWK5UVQRbBagOLdqSBjYYG2VysxXfQ3TuRtFYhN8bd16j5xIfy2aDrlLEVw19uhInggQMu2vJg7xT6V6Z9w5YsHwcSQWSGCMjTk764/ChT3QGA0nhVG2ktgsZgaiU/MrCAPN/XQP3dG6Y25vkcptFcXnn7Ig5D+V2eQ=,iv:3fKfVaDJ7RjjAI0n4I+6na9pKLB07yGgjvRXjh7I3Iw=,tag:cyclZ/i2rfKeAof15J4ufA==,type:str]
+    pgp:
+        - created_at: "2026-08-26T19:31:53Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiARAAi9efDDL8A1RFxx50RBFjLi3G2OG8XQfo/UF3O7gd65vH
+            tu+3b9KtiRvWurOVqapAxUwapiiwx4Gsem5F1Q9FoX+5HfQ3APQ91kxfGjQTjx00
+            2lt+pl4JyeKj0+ilGMP5xaUyOvZGNB33v4ls14Uljzg3tqQQPGUvYMJ6f5svXXOo
+            ugagStCSx9jh0j++Y9gCFZXYSn3C1IblGeUxkh7fUJQjveqp8R5Ofntdg7sbV5Au
+            Xeah95zdQxdJ/zb6GW7t0dWY5KEYi4Tg1gNybvMIKDdWZ8NND7kaFOSx5Bg8aGJa
+            +6nh21MHs7oNmzpxLXNa9rTk1ncE2HcLcTIXl+NHf10dPcR6R32w8Bc5e1UtBKI9
+            mUeHgH2zphG4Xihcchbeeb6RAxBvl2EWLglxB/HKKw8ouC3EmlOj63QS7o8ES8CZ
+            z+/uq4uOP65Q9k0xa9YHl4nGVXlOYqxFkiB71UYIqwUxyw/Th0IEZhBrd2GFf2wl
+            CUj9DDDejWBvGyIwp1MIRLhQkMrL4KczHLAdMEC/OcvylZHxESOpMEIq+CUXi0wr
+            GyjnwLS3F1ZPB0+Xbpy8OfTKAT1jI6Z65G6138p6c8xJsh+lBwBd4QFTJ0VfR+fd
+            /edCwMKalySDK0Li9OIphj1or90l/ZURdlZpIrgnYrYeBg7HibuN2E0u0cMur/DS
+            XgExhwYtGznQThvIySwqAa2YMLm5tz5PJ1mUGkJ2AUaJuQX9SfhFYJSCGjpv8Fbf
+            04FCKZ7B8eG9j9ae0Wfn07SeN9xSZEMuCtE0KLjAR0v5ACAF5Lb6Ee5tc+5K2sk=
+            =zZdk
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
+    version: 3.10.2

kubernetes/home/home-assisant/values.yaml

@@ -1,42 +0,0 @@
-persistence:
-    enabled: true
-ingress:
-    enabled: true
-    external: false
-    hosts:
-        - host: homeassistant.lan
-          paths:
-            - path: /
-              pathType: Prefix
-configurations:
-    trusted_proxies:
-        - 10.0.0.0/8
-        - 172.16.0.0/12
-        - 192.168.0.0/16
-        - 127.0.0.0/8
-sops:
-    lastmodified: "2025-12-04T18:23:43Z"
-    mac: ENC[AES256_GCM,data:JSaTCBXqpiP0R3rIEa/EZaDPbBInY2a6UMhFD9Gcw/mJVq/wF72KsFRfJl2hZ3d1FtsQ6Z0l3GrbiV41348jxzWM4XnE0e0hywdc2Ryqw0B3GS0EoNk1IoPR8ieZtxWNtFvglR2gVWWUnN7caYf/acE04NnzIDxl0tPEFckS+Nc=,iv:C784uqYb7KGhn2wGWZnCA7rhGocJWP6mfBhjNLWbimE=,tag:A7JLOmSVJ+ZrNA36DJfRCw==,type:str]
-    pgp:
-        - created_at: "2025-12-04T18:23:43Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ/+J1e3KfHaAkFS+lYz9jKzPAffkiDVCeecEf31Lk9DJxFd
-            7agtTWvcXtIsiJwF4sv4NzxY3pQrNRKwiq8pd3iXWHSqflIaQ2M9+dUGHykkjA5W
-            R+y/wgM+K0MBaFMxQU/xC0lM7YFwypV1JBp4jmpNn3McGba2yZAoKo1uAQ9LMP4L
-            Fd5wqNUrLNfwbh5Ts1rBVAGwStVlkRUvdUVCXjngdWVmE5xB3IBypdrFX2oclkl8
-            0zSNJwknC4bi4FeKBxWC90HT0n8zSMybdZOltcl8J3YVCL6l0F9hw6Ub5j1ej7qN
-            Igyll2/T4FEOExdo9oRXbEjC6GSZZBD6NMlrgJqVVUWoqDm4WQlKc7JRYAjtRgbS
-            Us8qCD8CMb57E6AZHD+GRZDK48OeevM21YxRvpSQlQfyeGbMrxF05zzw5InHSMhw
-            VslHQRmUMQqEzTsSeFbNxTeqy1YGGDYlnBpEjl8TPIZXE+mjwHm9QJbKwQFUK4Rh
-            YuEZDlUONdaKQpNX9OS6kwiV493sSruC2yWNwYIlgERrkcjBggKYPiV7lDiFnl1W
-            RVcsqOGnsrrwFHT7m6/MTIzH0k4fDt6Vv/FCToaoadvLPYNZb7xoKMahzT1z3SP9
-            FMuGus2r8h6ShEZVyLAt6o+BuuYyzOrVo10k1yTKDqEDD662rbRvTrBZlOk1vUPS
-            XgEtw6w6fFkESJKetHiN6TxG2+WyJw5PILm2sjak5AcR3qWiux/ENPb8kE0BIB0S
-            1Z/YTHYNP2mtEegDsp1DoT9tOSTWfrllL+p3kccvizEB5hq9+oMEzPGBstjWRjg=
-            =5PDx
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
-    version: 3.10.2

kubernetes/home/home-assistant/values.yaml

@@ -0,0 +1,62 @@
+persistence:
+    enabled: true
+ingress:
+    enabled: true
+    external: false
+    hosts:
+        - host: homeassistant.lan
+          paths:
+            - path: /
+              pathType: Prefix
+configurations:
+    trusted_proxies:
+        - 10.0.0.0/8
+        - 172.16.0.0/12
+        - 192.168.0.0/16
+        - 127.0.0.0/8
+# Failover tolerations + affinity — allow scheduling on p330 during r740 outage
+tolerations:
+    - key: ENC[AES256_GCM,data:5+QTI95qM5mc,iv:FS4FVgDoOOpaDSArV8o/RkpkpJxx+VHJhuExKZn1Vgo=,tag:f/7b4p2Yzc2fQpZrJNB0EA==,type:str]
+      operator: Equal
+      value: ENC[AES256_GCM,data:p9l+vJ81qoA=,iv:x44SAzdRxMGCGdnS1EQxU5rG/7BQ0gWJAqZHohii8W4=,tag:wzVAvTzbcJFD0Rl+8uS4Sw==,type:str]
+      effect: NoSchedule
+    - key: ENC[AES256_GCM,data:2RIXb5x6dsNEV241NTXFGYL030lRupkjWcPUHsueK4a6bn8DBg==,iv:2RVpm3L1RXXc6nN3L4UqkBxuNe/pfeNBzprwLDp6ank=,tag:jgyvyNdcurQVuih3YvaBiQ==,type:str]
+      operator: Exists
+      effect: NoSchedule
+affinity:
+    nodeAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                    - key: ENC[AES256_GCM,data:I6Z6SR2x8z6grjUUv3PBHLDc58E=,iv:smfPq81TGWdkPyao+pJCoZidgUFhPTdFdXBRMPeJ+p0=,tag:035Zf3xHRZL0wmbt9e7pUw==,type:str]
+                      operator: NotIn
+                      values:
+                        - "true"
+sops:
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:qQWuHn260xF3a0+H06TZD5fdVkj7/yff2W+klPjFFPTq9x+roBXQsHaulnSVO966djEvprPJQHIHUN5pgx2Re1rgyQ6MSI8J8H+iO010Gw+k7w6Ya/gMN157qxusY9gwyKG56eciE/4FTocfAsjxcOkTuk+nX+N/MkSjbv1mAIM=,iv:ddhMEsQIHNqWJB2gMOMd6N5WZneeeFNOAnFoPfVUE/s=,tag:QziO35kTfqj7JOFPqC431A==,type:str]
+    pgp:
+        - created_at: "2026-08-26T19:28:03Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiARAAmUXgE37uXgmjh0BbCsX+hqX0yLGtzWm0LfAF72lhU74X
+            899VsY3OsCGAOndSH0T4vH27/ayoNE5wTZMahfxa02IdWZXMo3nD6F4k6nai6Dkn
+            7m52RRBqNM66NhF4TAaTKg/j60XJKw0aoVSlgkUq/JVvs4JSyZPpwCp2TVz4/TwD
+            Dn8jC6Wfs9YQKWa7FWKW8d4vz9SNOpPSsiT5hIF93XVs9GdcsCtCsPB4Cr71whZj
+            q0RYWi21dnFzf5qCEH/5Mmz235JudMYESwJ79yrIM9r1Cj3QPPc1oEy2qjbBpN78
+            ulobKXMdclkCpNNgqaNr86v6weT0HpjqR/lleUO1EMzyTOKaIZ1uGS5xPYHlqF4M
+            8u6Gj8S6kGCLDsAQlnUbt+cycg1NOPNPJq5E/htio+sdoUeEmO+Y3+y54ccqR622
+            eyIZhp4RJukNLnq1y+6LiIUmimTSRlApwLbBouY24D/JPaO1oWL+Q2dcvm2qpZ9w
+            /o2bdXyr0vNUnpq4Yc1uU8rBSeElOIRHcTZVdtsUZuJp72tXo7/oJqJmsnrAih4i
+            /7+rsOpRRQDQPIyEveBXcwEp/baSVsYdeINufmXiM57ie+B135+5tsYYucF3pXzc
+            elJLdKSif1Kt8w6Ch+O2M3NqsCp+yp6IihUOt9vyZ7pYLZvWLo/e5JUmvy9S5snS
+            XAFFVhnrgNL+dBuzZXa6vfglwvBNl9iEogYWtcX4/Sr7X30Dv2RfkcNYi55sq7ji
+            A9Y8/cyL7d0m/ksgpcFcmRQvPCOpM/KPKZ2KbLLdeuXOhP/WXG+2auhJtwzF
+            =BS4A
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
+    version: 3.10.2

kubernetes/home/zigbee2mqtt/values.yaml

@@ -35,8 +35,8 @@ zigbee2mqtt:
     external_converters: []
     mqtt:
         server: mqtt://mqtt.lan:1883
-        user: ENC[AES256_GCM,data:8chGUA==,iv:SOAuBYShpWbza3idtyqFoVIFstZFM34OPDN4uhAer0Y=,tag:WPoH80VcUGLy5Uq/z8EtaQ==,type:str]
+        user: ENC[AES256_GCM,data:Sl/k+A==,iv:d1LIy5ny5jS5yEWtWfVntN4R8uQCoRwSiYkUb1JG/yo=,tag:dkNv+GqyD8geimnuJHgAFg==,type:str]
-        password: ENC[AES256_GCM,data:XVcTzQ3pDvPKbw==,iv:TK5qHq2yMTWgzcOPvj0GO7tOOD4PHvKMWfd3p4T8LuM=,tag:GJpKQWpVhwrewX4+9NITfQ==,type:str]
+        password: ENC[AES256_GCM,data:vwap+JwtgOpLAA==,iv:PC2f6Lg0EpmaJKd9M2yeQGejvXTNmhRPjAkFw1M4zwc=,tag:zp0sgA2uzLmOBNNH6yY95Q==,type:str]
         base_topic: z2m
     serial:
         port: tcp://10.1.1.159:6638
@@ -44,28 +44,29 @@ zigbee2mqtt:
         rtscts: false
         adapter: ember
 sops:
-    lastmodified: "2026-05-02T10:26:20Z"
+    lastmodified: "2026-08-26T19:28:03Z"
-    mac: ENC[AES256_GCM,data:32zZ0bYrgn+zTz8DEOU1N8MgDrihzWyMsV9q2m5RhFHRvXFuq3Z2GTORlUTeuK5qZIUrZt22VskigGAQiKC2CdzsJTcO3cGPshu5E6gWGBRNob02bXXsMu3TfCKxic/Ek7jE2p9R++a5AKczFZY8SxL7Sv1BZDxozkginDdYR4Q=,iv:VcDKwoPgYxZc8KXYv9oEH2GBqDRAJJxphj6MFLLI8ok=,tag:vPWqcEHoBVvfCoKoN5UiLA==,type:str]
+    mac: ENC[AES256_GCM,data:RUcA16mUHxIwToAQBR5UCbi/cEcDXms5r1cXYS7drYfvcPI1r84oX9/PHsXrRHcMsqIwyQbiK72CDLhQFXDW/YIugpy9OEFPAP88oqkfXrZFA5NfoU/9U0bfI5U8GmJEHx56DJtsqfSy1VMotC8sd0wj21YBcnmRhYIMoXLl/G8=,iv:tcjXHh0DvXheMlQIifVVY2TJryFmgZchbVfLKFpnLf8=,tag:KjpEK92QTFtzl6ml/Yw/VA==,type:str]
     pgp:
-        - created_at: "2026-05-02T10:26:20Z"
+        - created_at: "2026-08-26T19:28:03Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ//fl1m3T6TnQvQ+yG0plOZaRXIGRI/YHiyP9KsK6I6l4c9
+            hQIMA7uy4qQr71wiARAAptsMCNyzKNo3EtUeF1rdkRPPPg3yfjd4UjZD6ZkIFExw
-            Y7lUjVcgADbjZYAMv08LFOEyN0/dtTFx2kV1vC5sF4CjxXKfddazKrQFjZQygc56
+            IhqPSUqQl9tdjqNQaY3Amyo5rwvk62Reep6Zqz3+ig2DulwQN1lyJj+CPdNNAZ7O
-            Yn3wiYX2ZMTsc3AnOoUF/evXyDHYMu0l8FwZEupi0cjmgKjVZZsLYScMjLi6h9oO
+            81n1E1NcIoQWjVkDoh5MN9UEZkCfsr+2zE7fTiR2Zt5WOQm/p6eGB/WxFytirN6N
-            agDUxqZX8d3ikj3LPF1dk/XGP75fHBg7Jfim1RMMrOcpAbRi0H3XU82cr2s9fTS8
+            cgOt7ZNDZi2UW4ffyqt9ayU1s5C8o9epQecfhtGWxchM1GeBz/vyT/FHJsh6Jq3I
-            UtylTk1x3F253YTC0JdvU0UskvzCvVl0Sf8TlkVb2tTJgwf/XnXMTmMeCvbhIj5u
+            K2a/wz5vQAq1GMMAybzB2xNnM882YuclyfTLOJaAAYBovY9bzEV5SXOxpyUq5gXk
-            bgqIs0y6F0xm8NjhPGV2CtsQuQtLMLb5SxVFj7P4ad/Ekf9TizAJlcPt2u1/25zu
+            hJVN1xtzjBJOHySY2Nk8blX4md49W0CTmQptsKsIBQZ2+RtZg6MK5R4UeCrO8u1X
-            x9v/kFnI5XMDIr3eWBJlFUwtImQJ+bO3GTauqwpULIHSa+y3Ux2XMNarKfN1jH3Y
+            UkBYS4tbfBQtijoUMAlqUpSdvYGWEHg72dX1u7LQRW5adKCB+JHtIXYHQ4f5DSjA
-            RG86rLQSioSA+HdZuZdEvo2ACc5DotC835cnMGMeIuO1Ad/RjvUaptN/p5hvTFMf
+            HBHwZmMjf4yEMOmbV/E8cvGCCDHX3pOPx3F2I5RYcp+mES5SvkX/6SQUMVmypeyf
-            5t6SoE8gLXH7FZF7IomY0Xs/feztPOvPK76zpKV1Tqqgb7i0GaTFcKKBUxMPklZw
+            wp2zcx1JMh44HDd63vIEntQ4FALNHB7INqSytZjiV2DBphUimPMAOKSz6GLQ8Ye8
-            XwqOQl36HWz1BSvtYtYYX6/HyuknH4T6tk//J6MrNttnTQ/ZqjrBvl4FEVxTgf1h
+            NLTkZOFVmyCLNRj/Z8iy1m74LHL4a58arZ+D5OrXlhRlE6SyK95QzRs0xyvPS58A
-            pFc8fTzNak+VB4MSdALg6Eo5xR57eGHhKgdUMgDAv1JMEP9ikk4/p8/1WHKhpTvS
+            PudcPKf0BrXCKWJfd87Kqurf7r64F22UYge7nyM2U/jhRLWtcBmG+tIy5U+U65vS
-            XAG3QSahHWoc9L5A73xFmD66TRUhm8CVKRCAQebB7rXjsxaqgEOl70taQpucrckD
+            UQFbkLECKQZUbk9FJW9nR6dXbFuK0dhZFsR2c0lsEGSsl9N5exosNbuH/43jjzXo
-            624SYxJwG9Uuk4odCQJ6g7T2KCKxsS/NKy6jOqgprkerR6pCfuXg8LDxBkHP
+            LEn+CGVci15x7+2yBtA59ZMzohu78K8riLGbtlDUaeouSQ==
-            =cZ3t
+            =Zbi6
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

kubernetes/infrastructure/authentik/values.yaml

@@ -1,14 +1,14 @@
 authentik:
-    secret_key: ENC[AES256_GCM,data:wnDvn9EdX2SYDoWn9tTrbKvBx11fGfGlTk+9MSz8cBzwMDaY5W1bCwjtH7TmAnwYhbUQxXdVIxgPpj7k0FVqM5fuMHZwcb2AgtDMGbxRXtM=,iv:jwUq7dbl+V1t+Ek7vyBEfwX1B/fVmE0TIFMVGj40kVI=,tag:G1bDdR9OUqOtZQmvUcAfRA==,type:str]
+    secret_key: ENC[AES256_GCM,data:QjhY+442U44K3EJuXqSb42eyWt2znf1KAG0DeQ7JQw2qGA4tMaZKVaBKP9jHkF0yR2G8gZpYIofxBJFfl82kYsqvrixcxgH11H+ctZxVI6Q=,iv:HjPjBzFkmBYahpKjSXA8qUS1a6c4/solENAB7noaIxE=,tag:qpW50kV2bVoduM92UNKVxA==,type:str]
     postgresql:
-        password: ENC[AES256_GCM,data:G0KPHz7zZ5ivtA==,iv:w4m21LqGEtvEGAp7NlsoV9bwRkE/Mga4Nxp5mqBIJHs=,tag:kKHC3yXqJKZX9jiYuYXt9Q==,type:str]
+        password: ENC[AES256_GCM,data:Prv+e2pcLAyVyA==,iv:y36fhvpI2qm4nRnJzPXvLi1Sopn1g4YhdFVs+5fVeaI=,tag:z+HhXLN57qryvLdqtByO9g==,type:str]
     email:
         from: webbot@vhaudiquet.fr
         host: mail.vhaudiquet.fr
         port: 587
-        username: ENC[AES256_GCM,data:s0L1fCp8aObv5j6jlBiGDfj0aIM=,iv:cbvXxI3DIjnhnfHmUpeDF5KKRxUC2+YdvwU5FPcEe0s=,tag:rR8HpXUEabNZ36xabVkSIA==,type:str]
+        username: ENC[AES256_GCM,data:iZeZ2IgJH0iJWLYWCh22ogOuEzE=,iv:Un1P3ra/ziVZdPJFVnHBGs6zZwTA1elODRuKHaMEHYA=,tag:KdFfmfF553e9BeG4Ypt0tA==,type:str]
         use_tls: true
-        password: ENC[AES256_GCM,data:rb6o5MGQWK7LIT7gass=,iv:NjI0iqRk2usrqcH6kSo72T337y6avHz5whg9bLfAYDA=,tag:DnRJaixjmNY31V1h9Et5PA==,type:str]
+        password: ENC[AES256_GCM,data:Vvs0ibOmTCo5f5P8JQ8=,iv:uiT2+qK+KxS0TQqw4Tda+CA2h9mlhcf62WjKH61LP4U=,tag:6tRDtEWmHpiSjZz1xchHxQ==,type:str]
 postgresql:
     enabled: true
     volumePermissions:
@@ -17,12 +17,30 @@ postgresql:
             repository: bitnamilegacy/os-shell
             tag: 12-debian-12-r51
     auth:
-        password: ENC[AES256_GCM,data:9PI//cgxRlmjNw==,iv:q0SLpmaTIC3OUulPDxiDWie0+oI7w17V2fPmJ52o8ao=,tag:2lwG95Remzqt1dj8H4CG0w==,type:str]
+        password: ENC[AES256_GCM,data:eQj7A0VNaObUag==,iv:19JuGpdcwc+aJRiINaIu8015gODcDZO4pMO/uc3n+Yk=,tag:WUJAw2X6NLLDmqlIydyuoA==,type:str]
     image:
         repository: bitnamilegacy/postgresql
         tag: 15.9.0
     primary:
         args: []
+        tolerations:
+            - key: ENC[AES256_GCM,data:NZUuKYSOkot6,iv:wwDpZ18Q2OAj6Va5nWWKyrYK6/DqxjMKnvTRNMDkLCA=,tag:I8Na3EpJfAgCzUVSxFn8JQ==,type:str]
+              operator: Equal
+              value: ENC[AES256_GCM,data:XJw93s+tOis=,iv:svIxr795xD/Hz3yaHc4aiZ14hExVgmEDGfCOJoAK7Do=,tag:jdb0UgIOyXVmegHq3TvOJA==,type:str]
+              effect: NoSchedule
+            - key: ENC[AES256_GCM,data:kzg1pA8p8cBUgcKw6VfQuVPPmUmXR8uMAgxklAcJB/hVjGuxHQ==,iv:sFvOylmUNsfC9+XwwGPsFiua+/OMEDXlb/ICSQ6KNVk=,tag:ybJIKFMS3wtk/ESidcbEeA==,type:str]
+              operator: Exists
+              effect: NoSchedule
+        affinity:
+            nodeAffinity:
+                preferredDuringSchedulingIgnoredDuringExecution:
+                    - weight: 100
+                      preference:
+                        matchExpressions:
+                            - key: ENC[AES256_GCM,data:A7lJZoDqSfcwF+W3aweIxGmiVIE=,iv:ZFC9gAM0wVhGpFsfzHfBI3fUPNwGo2/stpZk9FTlu4k=,tag:8HzGLiqZ/Fp8AvGjDLeBVQ==,type:str]
+                              operator: NotIn
+                              values:
+                                - "true"
         livenessProbe:
             enabled: true
             initialDelaySeconds: 30
@@ -44,29 +62,51 @@ server:
         enabled: true
         hosts:
             - authentik.vhaudiquet.fr
+# Failover tolerations + affinity — allow scheduling on p330 during r740 outage.
+# The authentik chart reads global.tolerations (applied to server + worker)
+# and global.affinity.nodeAffinity (preset system with type + matchExpressions).
+global:
+    tolerations:
+        - key: ENC[AES256_GCM,data:FR3QHEd6FFk9,iv:fmWDfiL122FdaZT9SpwqCCiJDXtFRLR31+SjbI7+HbI=,tag:++WE+3RwdDbXTyV2xu2UIA==,type:str]
+          operator: Equal
+          value: ENC[AES256_GCM,data:/BSFTcoWqMk=,iv:gNvCYESHtDwF/2ZeUwFj2h3LjpHbCaO97YK/HvYl9t0=,tag:HAZPhDedb5E0D5SlHEoZwg==,type:str]
+          effect: NoSchedule
+        - key: ENC[AES256_GCM,data:/Qrec35ekNu97Vt5uezNfI+siytofle4uTm/YXt5KihmcTerPQ==,iv:/+hLpM20CFSVjG4KEpjv7vvem4XlAYt5RM2mAykaG1g=,tag:GfXvuHlBsWGAlpvSjaHMWQ==,type:str]
+          operator: Exists
+          effect: NoSchedule
+    affinity:
+        nodeAffinity:
+            type: soft
+            matchExpressions:
+                - key: ENC[AES256_GCM,data:8IL59mlYJP3mmE7F9MoKdztW/Vo=,iv:e6rBLp5lXnktdY9wHN7sMTteDQcUZoPuKW2rx7fuSlM=,tag:u7McVTzQIfW6oXILHuhFvw==,type:str]
+                  operator: NotIn
+                  values:
+                    - "true"
+# (postgresql tolerations are set in the postgresql block above)
 sops:
-    lastmodified: "2026-06-05T20:13:55Z"
+    lastmodified: "2026-08-26T19:28:03Z"
-    mac: ENC[AES256_GCM,data:rtrnY4XXaovFr/oXuZWJQa17Ihlgb9W7WMKYeN10qqx8REf6a3zqlUUGGSndYhjAZwpUjo3qixqAjW6kItBDgeF3DLpQ2T6acyOgXmbYNN+dWK4zb7jE0yZz69XIkUirabBWTkLqDACvw3iW5x4EAjg6/VYRVt4g5eugET5F/IU=,iv:eM+Z4SEJ6/y6gHzlYjLxcbqRn4dP4gbkaQqN2EGL4BY=,tag:EXklnS8lNeQErKcdP0XD6Q==,type:str]
+    mac: ENC[AES256_GCM,data:XucjlNYeRTBXcSqA8Tmnl/Oy7MtdVM6ZrYnv50S5nytSx2wjKxdoJtGzvVIrRTNPdt86J+jNhIJKRAlBoEamDWy2+qh38suXx0JSzpoePuqd6mGxvXLXtVje7OynAq742q7rrHiJqffpD8ck+U3xN8Y1rNrAwnEoucFTlreCN/c=,iv:DBY6fMt6cSfvoOrOmFoYWN5DUUMV+I+3zCltZPcGF44=,tag:iz9TMhxLLBsTmwgDYfnIvA==,type:str]
     pgp:
-        - created_at: "2026-06-05T20:13:55Z"
+        - created_at: "2026-08-26T19:28:03Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiARAAsreeLsc0Qhc/RDFP3GmusT0PCFq0XTnin9THWE+7YC/5
+            hQIMA7uy4qQr71wiAQ/9GZ0NMlA2Vyh4RtFbvJvZBZkSHg0L5w7K9txYAcyKr017
-            +kPcfKfyQGQGImzkl6niBxzl4jjxiyOyhdDWzwFw34Ets+1wXLlur9mo0v8GLfZG
+            uZm/UCgp9ohQK5DKg472EzevniIdGmA907ypV5BAtsXJt6KIkmA7RLTdIw8FwTeL
-            DEO+1VEzFheZzjM6pVNOWCJdGKR8WEuadjmMMCsux463JiEPtatRJgcAim3ux6uV
+            kJaN0jvijShaV5c1Wt5HlRHl/zVjil7Hokq6Q8fp4iz+MJ7H3U+5c6ElT2xE7YWf
-            TbtDNNF9yc9yp7GN8p0/kF3tnD40zaszM8+UznrWbDIFJOrixyVTZ3O9tKcjl55S
+            H2FYKsQlgHAjd3KlQvECsn4fOO7wKhIs9qNhvA5c503gyOtRq2cR5IiFQiwzKJLq
-            m5upCrrbc4rcp+uRiYrsiMZoEg3KvlqtxUw9mHoeVce83l7bziobixzBhnGRtAar
+            5tzN4SROfWUrO7FfqXlkqsFNSn51SAOtkzqc2osbXmZH6s84ZJzgAow3SVZ7/ZQb
-            zYUKsuu5PPpljV+ghDSIkcTrwLGQnInhlbOxKwDNVb0LiL/1c6dP4zPfZNh+Nvne
+            NqK1CfLauhL/RBb3sgKZBOX8zhC0gdRb0NKlothMx4sjo0Ao1fMlzgc/FpDlnf8U
-            XhUDx90WnGCFOI2t5tXelAymCBDgak2qCX4IxkxddBhL9lONwYIM8zmszjPQf7r1
+            CSVbE2u3K2Q4tUKEKCmIOdLzT+uthnQSvumXbt5d7Hj73wBM56P2sZGs244+SF11
-            Gx4vFrUTqceEXI+JLiPog4/+gGHX1qzifdHBZR0ZtTi/XJfnhdH3fkJndLA65Pkg
+            SStk9yiYkQSwoCDS/0MHS9cP7p2Jx0dtcqrM1g94ACGJFLbplOuqQh/UYDofi7XA
-            K4vY6KfomQLEmHurMVzEkoeXH95qSWmfmai4SJmKWqm33VFPZRFoVonnx4dP27SM
+            8UOePz6KRevU7tJZ0bV44j3BMPiSHLwJA8Xlld38pTVxx4hbWeffW3DcjZpLXJqW
-            vZGmfgjOl5eeRk/jdrApJNTkCi/dkGUfNRDffwcYQgjCJaWOs1agchBSC/RLZVWN
+            Dyz3EtGv9mHB0MoGzj1Djlhb01wNj1g/VHqDonugp0h8DDx4uwZHXiiF8c5qOdTy
-            3FPmohgmGa/MBOX3qS1r/5G3XBdKuUxd/NJ2Bw8L0wodteGSEClEiMEXGGZLkOzS
+            z/q7lljNT3FxiwYEmAs3yo+RmxbVSLMzSUu/p37VtCOJigB0+1WPbg1wFWwd67HS
-            XAFSk/qmO3tJGViwOVtnb0ZXyTRritW9uR13N+LcaKJhC0PB/m/lXR6IlrfLJXnu
+            XAF1CpLZiCr1ZaCRbNBT6CXuyUwjYeSd+OXq3MTOGZD81xvYKxbs4mRdzSlpxCQ9
-            AMD7w42wKMeBgGuQQ/Xm/iOVlS2H0kvbm1b1WEZMQUJlEleKSyQKbmQPujoi
+            tObUsjTWMf/0q3zPU0mN74hNLrz7Z5ywol/j1IMKpy1B4Q8CuQmfL0zjyMY6
-            =KjtC
+            =3su6
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

kubernetes/infrastructure/caddy-certificates/certificates.yaml

@@ -32,8 +32,37 @@ spec:
   duration: 2160h # 90 days
   renewBefore: 360h # 15 days before expiry
 ---
-# semery.fr certificates are managed manually in certificates-secret.yaml
+apiVersion: cert-manager.io/v1
-# until OVH DNS API credentials are added for DNS-01 challenges
+kind: Certificate
+metadata:
+  name: semery-fr
+  namespace: caddy
+spec:
+  secretName: semery-fr-tls
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: semery.fr
+  dnsNames:
+    - semery.fr
+  duration: 2160h # 90 days
+  renewBefore: 360h # 15 days before expiry
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: wildcard-semery-fr
+  namespace: caddy
+spec:
+  secretName: wildcard-semery-fr-tls
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: "*.semery.fr"
+  dnsNames:
+    - "*.semery.fr"
+  duration: 2160h # 90 days
+  renewBefore: 360h # 15 days before expiry
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate

kubernetes/infrastructure/caddy-certificates/kustomization.yaml

@@ -0,0 +1,4 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+resources:
+  - certificates.yaml

kubernetes/infrastructure/caddy/caddyfile.yaml

@@ -2,7 +2,7 @@
 # This file contains all route definitions, imported by the main Caddyfile.
 # Edit this file to add/modify routes.
 #
-# Certificate files are mounted from the caddy-certificates Secret
+# Certificate files are mounted from cert-manager-managed TLS Secrets
 # at /etc/caddy/certs/
 
 apiVersion: v1
@@ -17,7 +17,7 @@ data:
   Caddyfile: |
     vhaudiquet.fr {
       tls /etc/caddy/certs/vhaudiquet-fr/tls.crt /etc/caddy/certs/vhaudiquet-fr/tls.key
-      reverse_proxy 10.1.2.171:80
+      reverse_proxy traefik.traefik.svc.cluster.local.:80
     }
 
     *.vhaudiquet.fr {
@@ -30,11 +30,14 @@ data:
         @nook-mg     host n.vhaudiquet.fr
         @nook        host nook.vhaudiquet.fr
         @sse-nook    host sse-nook.vhaudiquet.fr
+        @inbox-nook  host inbox-nook.vhaudiquet.fr
 
         @gitea       host git.vhaudiquet.fr
 
         @flux-wh     host flux-webhook.vhaudiquet.fr
 
+        @photos      host photos.vhaudiquet.fr
+
         @umami       host umami.vhaudiquet.fr
 
         handle @authentik {
@@ -52,21 +55,26 @@ data:
         handle @sse-nook {
             reverse_proxy traefik.traefik.svc.cluster.local.:80
         }
+        handle @inbox-nook {
+            reverse_proxy traefik.traefik.svc.cluster.local.:80
+        }
         handle @gitea {
             reverse_proxy traefik.traefik.svc.cluster.local.:80
         }
         handle @flux-wh {
             reverse_proxy traefik.traefik.svc.cluster.local.:80
         }
+        handle @photos {
+            reverse_proxy traefik.traefik.svc.cluster.local.:80
+        }
         handle @umami {
             reverse_proxy traefik.traefik.svc.cluster.local.:80
         }
 
-        # Docker VM services (via Traefik)
+        # Docker VM services (via Docker Traefik)
         @alexscript     host alexscript.vhaudiquet.fr
         @clips          host clips.vhaudiquet.fr
         @jellyfin       host flix.vhaudiquet.fr
-        @mail           host mail.vhaudiquet.fr
 
         handle @alexscript {
             reverse_proxy 10.1.2.212:80
@@ -77,17 +85,20 @@ data:
         handle @jellyfin {
             reverse_proxy 10.1.2.212:80
         }
+
+        # Stalwart WebUI (now in Kubernetes, via k8s Traefik)
+        @mail           host mail.vhaudiquet.fr
         handle @mail {
-            reverse_proxy 10.1.2.212:80
+            reverse_proxy traefik.traefik.svc.cluster.local.:80
         }
     }
 
     semery.fr {
       tls /etc/caddy/certs/semery-fr/tls.crt /etc/caddy/certs/semery-fr/tls.key
-      reverse_proxy 10.1.2.212:80
+      reverse_proxy traefik.traefik.svc.cluster.local.:80
     }
 
     buildpath.win {
       tls /etc/caddy/certs/buildpath-win/tls.crt /etc/caddy/certs/buildpath-win/tls.key
-      reverse_proxy 10.1.2.212:80
+      reverse_proxy traefik.traefik.svc.cluster.local.:80
     }

kubernetes/infrastructure/caddy/kustomization.yaml

@@ -5,8 +5,6 @@ resources:
   - namespace.yaml
   - repository.yaml
   - release.yaml
-  - certificates.yaml
-  - certificates-secret.yaml
   - caddyfile.yaml
 secretGenerator:
   - name: caddy-values

kubernetes/infrastructure/caddy/release.yaml

@@ -27,4 +27,4 @@ spec:
             patch: |
               - op: add
                 path: /spec/loadBalancerIP
-                value: "10.1.2.152"
+                value: "10.2.2.4"

kubernetes/infrastructure/caddy/values.yaml

@@ -0,0 +1,149 @@
+# Caddy Edge Proxy
+replicaCount: 2
+# Listen on standard HTTP port
+listenPort: 80
+# Enable HTTPS
+https:
+    enabled: true
+    port: 443
+image:
+    repository: caddy
+    pullPolicy: IfNotPresent
+    tagSuffix: ""
+    tag: 2.11.4
+service:
+    type: LoadBalancer
+    # Cluster (not Local) so any node can forward to pods on any other node.
+    externalTrafficPolicy: Cluster
+# Disable ingress - Caddy IS the edge proxy
+ingress:
+    enabled: false
+resources:
+    requests:
+        cpu: 100m
+        memory: 128Mi
+    limits:
+        cpu: 500m
+        memory: 256Mi
+# Caddy needs root to bind to ports 80/443 and write runtime data
+# Using restrictive security context causes "operation not permitted"
+podSecurityContext: {}
+securityContext: {}
+health:
+    path: /
+    port: 9999
+# Extra volumes: TLS certificates from cert-manager + external routes ConfigMap
+volumes:
+    - name: vhaudiquet-fr-tls
+      secret:
+        secretName: ENC[AES256_GCM,data:HYQb37rKxMqxFTsCz5kw6qY=,iv:dI9uqUVLLqPv3a5vwz1vowTvO9WduQaXqj7XZREd7oA=,tag:mz257AC3pvubgzOMxbHfrg==,type:str]
+        optional: ENC[AES256_GCM,data:k9FVxw==,iv:XMAGop2PvSGD1R1cy6qqE39bsIAOFIqGzTnwDmYRhHM=,tag:7zZAwSzRWWiT9Y2iMWkI6w==,type:bool]
+    - name: wildcard-vhaudiquet-fr-tls
+      secret:
+        secretName: ENC[AES256_GCM,data:2OUkq/AMuv2wQyIlLPS3bSRrnV1mvDR6vd0=,iv:1e9HC8FFC4vo7GjCnJyNjF05R+Js41ONy2in5a+/doI=,tag:icKdtLhvQ40YI+KCE+6fXg==,type:str]
+        optional: ENC[AES256_GCM,data:b+zvMw==,iv:QyU+T1BGZenO/nO8wq6R+KkrT/I6ZXIIhAnf5npFhvw=,tag:4UPyop81BQu4zxhZmK2n+Q==,type:bool]
+    # semery.fr certs from cert-manager (OVH DNS-01)
+    - name: semery-fr-tls
+      secret:
+        secretName: ENC[AES256_GCM,data:cLzhXgUhrwgIMACU1Q==,iv:DJ+6mjtjYmWxNcHl1gzeoifpcFCJsXiOXeyxEWnRU3g=,tag:7yc2bt6fBWwBuefPY48xyA==,type:str]
+        optional: ENC[AES256_GCM,data:DTfxaQ==,iv:K7TJjSI/vF3x34SWmwmivYo+mSsUAg9nB94Ui85nHCI=,tag:1/JRBMlb07+aHKEulIYpQQ==,type:bool]
+    - name: wildcard-semery-fr-tls
+      secret:
+        secretName: ENC[AES256_GCM,data:Qq+ybi1kSVdVn9RP/kTkTcw0lkao3Q==,iv:vFmV3YvSNhLizgJVBnq1ZERqDP70onuZDvy/I3joPtI=,tag:AiEW+yh51Dexz3Vha4MPgg==,type:str]
+        optional: ENC[AES256_GCM,data:0o4ODw==,iv:VwnCs2C1MVUJEfBvNJT1rkDV7m60sNZPdtERo9wWPJk=,tag:oo+liLatrjqEtlrKQyjhyg==,type:bool]
+    - name: buildpath-win-tls
+      secret:
+        secretName: ENC[AES256_GCM,data:SejgJvZY/B7DDgf3YJcxcFA=,iv:bDZWhie17exL+9r9A7Ea/a8Rgpex7nuabVtW60LotJQ=,tag:WxqFbzulxxPgsynqfo5hzQ==,type:str]
+        optional: ENC[AES256_GCM,data:nBNRkw==,iv:JEvsFzMli7AzUj6GXJlHXOnANm45gnFE/kXrSbBotPQ=,tag:Puss6mCkoC7SGCb86guI2w==,type:bool]
+    - name: routes
+      configMap:
+        name: caddy-routes
+# Extra volume mounts - each secret mounted as a directory with tls.crt/tls.key
+volumeMounts:
+    - name: vhaudiquet-fr-tls
+      mountPath: /etc/caddy/certs/vhaudiquet-fr
+      readOnly: true
+    - name: wildcard-vhaudiquet-fr-tls
+      mountPath: /etc/caddy/certs/wildcard-vhaudiquet-fr
+      readOnly: true
+    - name: semery-fr-tls
+      mountPath: /etc/caddy/certs/semery-fr
+      readOnly: true
+    - name: wildcard-semery-fr-tls
+      mountPath: /etc/caddy/certs/wildcard-semery-fr
+      readOnly: true
+    - name: buildpath-win-tls
+      mountPath: /etc/caddy/certs/buildpath-win
+      readOnly: true
+    - name: routes
+      mountPath: /etc/caddy/routes
+      readOnly: true
+# Caddy configuration
+config:
+    debug: false
+    # Global options (goes inside the global {} block)
+    global: |
+        auto_https off
+    # The main Caddyfile content - imports routes from external ConfigMap
+    # This keeps routes in a separate, easily editable file
+    caddyFile: |
+        :80 {
+            redir https://{host}{uri} permanent
+        }
+
+        import /etc/caddy/routes/Caddyfile
+affinity:
+    # Prefer non-failover nodes in normal operation
+    nodeAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              preference:
+                matchExpressions:
+                    - key: ENC[AES256_GCM,data:oCV218wXg+k2L/edhWv6qpiyiaY=,iv:Y+O2of2NCOvcjSwr0EenGns0BtpT+P6pjCzEZUIMpm0=,tag:kY/WyHJ4Jr5ZLMe6ZcT/Tw==,type:str]
+                      operator: NotIn
+                      values:
+                        - "true"
+    podAntiAffinity:
+        preferredDuringSchedulingIgnoredDuringExecution:
+            - weight: 100
+              podAffinityTerm:
+                labelSelector:
+                    matchLabels:
+                        app.kubernetes.io/name: caddy
+                topologyKey: kubernetes.io/hostname
+tolerations:
+    # Tolerate the failover taint so caddy CAN schedule on p330 (small-node-1).
+    - key: ENC[AES256_GCM,data:K6vJkO2dpKRi,iv:b7NIPKTMYOxNao6KcSJUhsxKNRJ2J3ksEtmXkI8b0So=,tag:pMRmz17upWMTEZjwBRNyZQ==,type:str]
+      operator: Equal
+      value: ENC[AES256_GCM,data:4ULPtEoUhgs=,iv:ikqWRqRR9ki35QQ6VnMEzOgT0/e+5DggGP8w60BhW/Q=,tag:MW9lX8miIWb9nnbc0woZTg==,type:str]
+      effect: NoSchedule
+    - key: ENC[AES256_GCM,data:l7abu6ywKFevJdJod2Af2bj7XSfBJATL7UnfiUHrRJoCjBsl9A==,iv:xnUvzVX8z4doC+mQs1r0rNCSqaZ8KlXxr5Ee9FOFPjI=,tag:mnqCx9NSMSyeYwz57QFQIQ==,type:str]
+      operator: Exists
+      effect: NoSchedule
+sops:
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:gn90e5Gjq5/CraT7Cl43DVMIQukD798faKGbVO5IJlbpAuTwDrhvqnnojFq4R7LEEETtedpR3MRyqcnbfSWVruHoysebycL7EZJkiy7H36JmzQAOWKusshMF9kOyZIV6+AFfz8As/Mu4pF1p5+3jmgy6oOJn7Ewm0C930Gpa3gs=,iv:cf1UC/2NGBHtQgx6h8vRpMjeJRaAvG7ZznhErn2b+cE=,tag:3Ule+pq7pZHWA7NqhlgfPg==,type:str]
+    pgp:
+        - created_at: "2026-08-26T19:28:03Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ/9FKZhqwE2RZcfsIeMOtAkOTf/4aEbrSzsHbEO8DP8V3Ct
+            rQBu/v8y1Hcu3fVU/OjVk/7QbEBjPNu1AJST55DBIWktnYUgSo4fIujvG54/hqwM
+            9u0iuA1EcqVzGDa+vLSqgmi4Oxbujs0Ytn7uQrefqkdAOjltKqvknebI9EBdSRUi
+            GjVFwysR6jHmIVf9S64vu4VsjfC7ju9MBYZniaKsJ1GOBhIjUZ6ogkYs5S2E5PJ/
+            zE8cn79x61YLX74H+BAqnFcxbprtsCwMJPgyerfgijV6d+JpwT/6mp1VUrLe9Zz7
+            WEd/lVMlIcwnYCtIDAvuURvMP2OebWplr95d5V1Vb5Yywnl3M0pwkqL4dRiJISvk
+            N2rBQYvDfXBtJA7yTAkJ3PymrECKoFs6nspEBie/kDJmdRGv8s2aajzTTQ1qLAkP
+            FeJe0TcowjCCWMxk4W5DEoCh+PUA1HVo+/KmHjnIVgzdgxaeqT90VXwN8H7MPPeu
+            LKE01+Guue821h7GykkIhe9sf3nMGbI5rOiCcsVtgu5bODkRk8jXpXh1qdRAliuq
+            uddjy1mWEfdUHNBj8YxvZ8WOU7h9FyZjsYZB96n9du1vqcuuP5eTJDVuvjjtDuTK
+            fbXYQbxwA5j4akyI4AKJYLA0Y/lcSXc84r6q8IA52nZz6uQZExbkoc7PPX7Q/ufS
+            XgE0CWRS+0tk2oVANMVU31UrCvitttezjR6sUSAINh122a5kcmOfJzLlB2OqVKc5
+            wMAyvOYccrQMrPDX1WJE7agDOaqGUQcwuFnvqpHhe8q9Yg1uOUU4sK1R8A1Qs0Q=
+            =wlYf
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
+    version: 3.10.2

kubernetes/infrastructure/cert-manager-issuer/clusterissuer.yaml

@@ -22,3 +22,23 @@ spec:
           dnsZones:
             - vhaudiquet.fr
             - buildpath.win
+      # OVH solver for semery.fr (via cert-manager-webhook-ovh)
+      - dns01:
+          webhook:
+            groupName: acme.aureq.com
+            solverName: ovh
+            config:
+              endpoint: ovh-eu
+              authenticationMethod: application
+              applicationKeyRef:
+                name: ovh-credentials
+                key: applicationKey
+              applicationSecretRef:
+                name: ovh-credentials
+                key: applicationSecret
+              applicationConsumerKeyRef:
+                name: ovh-credentials
+                key: consumerKey
+        selector:
+          dnsZones:
+            - semery.fr

kubernetes/infrastructure/cert-manager-issuer/kustomization.yaml

@@ -3,3 +3,5 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - clusterissuer.yaml
+  - ovh-credentials-secret.yaml
+  - ovh-secret-reader-rbac.yaml

kubernetes/infrastructure/cert-manager-issuer/ovh-credentials-secret.yaml

@@ -0,0 +1,50 @@
+# OVH API Credentials for DNS-01 Challenges
+#
+# OVH API credentials with the following permissions:
+#   - GET, POST, PUT, DELETE on /domain/zone/*
+#
+# The secret MUST live in the cert-manager-webhook-ovh namespace (cert-manager),
+# because for a ClusterIssuer cert-manager sets the webhook's ResourceNamespace
+# to the webhook's own namespace, and the webhook looks up credential secrets
+# there (see ch.ResourceNamespace in the webhook's ovhClient() function).
+#
+# SOPS will encrypt the stringData fields on pre-commit.
+apiVersion: v1
+kind: Secret
+metadata:
+    name: ovh-credentials
+    namespace: cert-manager
+    labels:
+        app.kubernetes.io/name: cert-manager-webhook-ovh
+        app.kubernetes.io/component: ovh-credentials
+type: Opaque
+stringData:
+    applicationKey: ENC[AES256_GCM,data:qOGxuFHguxe7e7pVfd1eiw==,iv:CC5CMc+VTL8aW4injRN2GxQvWf4nobGuQYhuUytHDfQ=,tag:3l8srdCgAtnz/fWqn+VrdA==,type:str]
+    applicationSecret: ENC[AES256_GCM,data:tvj/Km80zHBLA+gLqjCA0wKh9y/+g20O+kE2zZzEDVM=,iv:SKfeoThkwFbNGjNdQQByqAk/+dbyCLyzft1eXVh3a3o=,tag:qHoR2ZqEkfulKzdE/GvZrw==,type:str]
+    consumerKey: ENC[AES256_GCM,data:gGTsvDEy0DZvTiHP2mdghBrDbwE5hmkNDJtDf4CJEPc=,iv:EgvG8TmZuY4hWs3YD4y9zpJv/Ndu5tnGLs+hIMWvZU4=,tag:R4tSbVvJjkyXe/N93CRSSw==,type:str]
+sops:
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:xNUZ8stxMx7Y2ggmjBaF5FX0NtC18JJcaDgU52V4b+pnG72t8+P83DkYY3Xr6gWJfmS9wFNs3vZ8TJ+nvVP0C62zoN9cmC0BolJrTOyQ2rpoUu/0Xj+Tbfiwnmbm76yZ+SdQJLYg3n7fNG/g6fh88/BUERi0NAVil228ExFFliE=,iv:2Nu2LaqVYqM5WchoPqoHkCJcXypGHskDjLHFYRC4eTk=,tag:2H9FSAQ3UNGSxSx3WhUD1Q==,type:str]
+    pgp:
+        - created_at: "2026-08-26T19:28:03Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ//XxGw3gzr7UtuMakZqWGp6uZ5mZ42KscvHpQCZchh0wZb
+            01Dq6HLl6EMwu+fpnfkOU05SxozkaKvLw+xzTX4TExbfE3GBTjpJ5R4e/aj5B24M
+            iw32oy+y2jCIzMS0PKxIkhIJrClv5hRSZt5dVDzln5sOapXapE5iLpM/glerIwXk
+            i4EfntjzNhOUFCbwnH2F/s1ZKmwZWw88GNff26aAIDOhNiEyB7kz0s6Gr575cKvw
+            CdZrHDtfl7ZoP4JiozNXzXF65+YnIiG5kli1A0GVF/9XUeqgXTUHYJKvdGcHFAqs
+            NysLbdsoppDJUUpqWvU1gS0X6PifZWkd3Sv0LDaoV7TIa8UWHZMbyV9W/1NiGSjt
+            VVBO+ezQgpSFbEVixz1WEDyD9MPBAvWq+PS2QQcUc0aep8xRqoWAe1pojjs2k0DJ
+            2vcFkWmdj0RVngNvw3rBAxrYY8DtqrNOjc0B9s+2ZqIN9TT+9IWaS65Xh0wRMZoy
+            Ntxr7oyG3wicA8YFRH3WxLJiTqOOeYYgc+Qltds7fb79hJScdXNxbC8mFjo9zOUV
+            bnHSQrjj/Se6tzSpZt7yF/+3aBTAUsOfOXHO1md/ydjCBpO6eUYU+T6m+buIJ6F8
+            M7kov+/x5on8k9dcNjkwdVuOztIuIXGUaJ41idrGKOSvtAjW0CGO3VU67e76NwnS
+            XgGVAwNds2Bfs8mQfmKdhvCrJnPxqtN29z5fguTMGTPqMncsx62mhdwI6tgAgEdD
+            qEX+tRkjpgoa8yO3gkvu7J3+oQ2HQ5mOZaSyl/Xz4ALP4+MOEHEiMNWcDmotq/Q=
+            =BT71
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
+    version: 3.10.2

kubernetes/infrastructure/cert-manager-issuer/ovh-secret-reader-rbac.yaml

@@ -0,0 +1,41 @@
+# RBAC granting the cert-manager-webhook-ovh service account read access to the
+# OVH credentials secret.
+#
+# The cert-manager-webhook-ovh chart only auto-creates this secret-reader Role
+# when using its built-in `issuers[]` mechanism. Since we manage the
+# ClusterIssuer and the credentials secret manually, we declare the RBAC here.
+#
+# The webhook runs in the cert-manager namespace under the
+# `cert-manager-webhook-ovh` service account (created by the Helm release).
+apiVersion: rbac.authorization.k8s.io/v1
+kind: Role
+metadata:
+    name: cert-manager-webhook-ovh:ovh-secret-reader
+    namespace: cert-manager
+    labels:
+        app.kubernetes.io/name: cert-manager-webhook-ovh
+        app.kubernetes.io/component: ovh-secret-reader
+rules:
+    - apiGroups: [""]
+      resources: ["secrets"]
+      verbs: ["get", "watch"]
+      resourceNames:
+          - ovh-credentials
+---
+apiVersion: rbac.authorization.k8s.io/v1
+kind: RoleBinding
+metadata:
+    name: cert-manager-webhook-ovh:ovh-secret-reader
+    namespace: cert-manager
+    labels:
+        app.kubernetes.io/name: cert-manager-webhook-ovh
+        app.kubernetes.io/component: ovh-secret-reader
+roleRef:
+    apiGroup: rbac.authorization.k8s.io
+    kind: Role
+    name: cert-manager-webhook-ovh:ovh-secret-reader
+subjects:
+    - apiGroup: ""
+      kind: ServiceAccount
+      name: cert-manager-webhook-ovh
+      namespace: cert-manager

kubernetes/infrastructure/cert-manager-webhook-ovh/kustomization.yaml

@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: cert-manager
+resources:
+  - repository.yaml
+  - release.yaml
+secretGenerator:
+  - name: cert-manager-webhook-ovh-values
+    files:
+      - values.yaml=values.yaml
+configurations:
+  - kustomizeconfig.yaml

kubernetes/infrastructure/cert-manager-webhook-ovh/release.yaml

@@ -0,0 +1,19 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cert-manager-webhook-ovh
+  namespace: cert-manager
+spec:
+  interval: 1m
+  chart:
+    spec:
+      sourceRef:
+        kind: HelmRepository
+        name: cert-manager-webhook-ovh
+        namespace: cert-manager
+      chart: cert-manager-webhook-ovh
+      version: "0.9.16"
+      interval: 1m
+  valuesFrom:
+    - kind: Secret
+      name: cert-manager-webhook-ovh-values

kubernetes/infrastructure/cert-manager-webhook-ovh/repository.yaml

@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: cert-manager-webhook-ovh
+  namespace: cert-manager
+spec:
+  interval: 1m
+  url: https://aureq.github.io/cert-manager-webhook-ovh

kubernetes/infrastructure/cert-manager-webhook-ovh/values.yaml

@@ -0,0 +1,46 @@
+# cert-manager-webhook-ovh Values
+# groupName must match the ClusterIssuer webhook stanza
+groupName: acme.aureq.com
+# cert-manager deployment configuration for RBAC
+# The webhook creates ClusterRole/RoleBinding so cert-manager's
+# service account can create the "ovh" ChallengePayload resources
+certManager:
+    namespace: cert-manager
+    serviceAccountName: cert-manager
+# Pod configuration
+pod:
+    replicas: 1
+    resources:
+        requests:
+            cpu: 10m
+            memory: 32Mi
+        limits:
+            cpu: 100m
+            memory: 128Mi
+sops:
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:jzaxMCQB6eTssTai71HIAzLwCktDSllQagk6dnz6KI509kZeM1mUyL/Mti25R1XpsTZv2aGWzG968CivR2q35wiP7CoRptHx2xPku63ljLihojp2Z2aklcM5uwcZRJIkSsZeVk2m2rWHE1hz6SiLIGbtmY8HMz7fBeLryni8SgI=,iv:yglyVdWx6Zy+GiD/guAWexolRwQXTAkKslI6zn0RUcA=,tag:6XvZb4RJCY+UtZGvOPxzNw==,type:str]
+    pgp:
+        - created_at: "2026-08-26T19:28:03Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiARAAl7HETp1m0KX0RwxpIW1kBIjhWCpDp2ynTTC1+Q/95A8t
+            JHYNTaeymQQLubEl1lB3EzgAnrvFIOlOW6aX9Vbrv9UPhnoEabVH0W6VWF7JFFcf
+            ZvKnkYJrPtlAu5dyN606ifXlZw5ZE1wP7hASgano96H8Irfxi+8JE5k0gwTNFlUu
+            cLDhjhwcnlxCIxf/akQpw4ic+aHvj2bp2ilaxBuo8YtVZUX21My55rjZpWxf4ekn
+            oq7kh7UD/dt3lZ8qWi9Lk7aGXrzjdErqIt3ESefKUQtqQEGVrOeZ4mnkU4KONa6R
+            FcLGTjuXl5Mily4U6cQJwkkyxJZyZLAVp2Phw86LeytZtFgtj/YsEk5NiTSl2a+3
+            qzbMySigD8q6lVAu/WO6r+KXitZaMNodekJh54xgxer2ZUBekOpzafHawbAXO47e
+            ZVKnNW/aYs51Vt8NeDGqF0KiUIGPqLN2ffT1t0SfNqZF9MYPc5rKX18/cfom0Lo2
+            80Qwb1l47DiZbht6AQ0oMzFdK3SJp1jnXPMd6ZNOSMj3TfRq9WZydNlEeBPiFG+i
+            0ASkPHuERyiogaZlsGgi8gKA4iM55wULCBXIsPdVc4cIbU7MpNpP0icsQN5WRV8L
+            vOUKjAntXik2ZHY4bhHd3Ty7/FVVIgi2M0Wi5/6mTn4ftb2DMyoqVKBYHwm5iqfS
+            XgEt7iRIfcYwAy9WKnHayTfk3Is/dnBTaMp/PKSCUwEELqnAgmpbLcZ/8lNm6wEi
+            Azo8CgLer0P7YHU+GbbONeQV29VrkjqHkA0imPFCHaAWxfSNE+55IctMgk+oclk=
+            =Ko1N
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
+    version: 3.10.2

kubernetes/infrastructure/cert-manager/cloudflare-api-token-secret.yaml

@@ -0,0 +1,47 @@
+# Cloudflare API Token for DNS-01 Challenges
+#
+# A Cloudflare API token with the following permissions:
+#   - Zone > DNS > Edit
+#   - Zone > Zone > Read
+#
+# Base64-encoded:
+#   echo -n "api-token" | base64
+#
+# This file will be SOPS-encrypted on pre-commit
+apiVersion: v1
+kind: Secret
+metadata:
+    name: cloudflare-api-token
+    namespace: cert-manager
+    labels:
+        app.kubernetes.io/name: cert-manager
+        app.kubernetes.io/component: cloudflare-api-token
+type: Opaque
+data:
+    api-token: ENC[AES256_GCM,data:YdjAxeCqpOuRapujdleSZ4mcqWtnIDOiT4ttohorOX4/pzI1DdytmXSYpISiTpnh73i/+CEr5OpWXeHr5yOZ5lJMf0gN9usR,iv:pNZNxVnWvvMfcOxo0fXyefiI6vW6nIjdFsP/0+el0p0=,tag:V4Zc6zW0PGP5YX8Edd407g==,type:str]
+sops:
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:ovnp+gcpIuMHG3MC4Y9SWpZtj4ilWM3XvJOyuyoecm4DIytQgSAW+lUrqREeOh6MleKF1dT2u3cO8pnqjqn4YaMeHD8dXAV57iBM1d070ySDP8EG+O/eLEjzd/NINglf3PEaBSK9yzemhPkTUlUqVdBn+kHNLX1y+WC+GU0tcaI=,iv:RQUcZ7RU75itmhuZW1NmpH17MHhtd0HI8isSRIKqzCA=,tag:qEm0euMGQOvRjtBS9Sra1A==,type:str]
+    pgp:
+        - created_at: "2026-08-26T19:28:03Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiARAAi83x7L6cxjIV0HETlf3e9oXOQErINQ+VQPJ8Q3VrdoLR
+            Q5t2CVMRRKz6dF+D2NvV4+dxCi4NNNf8qRteSmUeQpfhsonSlOW4ArpgzgFjc5M+
+            HO1jD61C++8ISSTssd6HaifLUeCmvIBJyAtr8BWuXDFuVyRCB2EEQ2wcs9X+HGLz
+            5ertIJQe/rvn3HQVojNwpjVmHR68hiFrF4b4yxNHz7kTY9JRKBzeqflQ4OCz5mdD
+            uXOxR2RukPoxTwjWLcxm791J3iTo9TQxMjI3JaJcmNXiPCy161a3ZDUGVBA1bY+w
+            apa7K8wKobjhVYjZ9ScxA6qS4dQ2Iktchxw/BUZLI8Vv2LT8UrJcUqQS2MoRZCa6
+            XpN7gKAnSDE0RoPJxHlX/2kV3bsVABLlaTS0Fx399iYvHJt3MyNLBIQfr2nMUzLJ
+            0pP/3nBqEo1iUMGfKJhOWIQK8lG0dieVkxInXrM8K75dNqm/gBsPGLwJIdT4GVaX
+            +vkzud5uZNExq1ajXHi1JMG4oCRdXDINoUVLsU2RWHzm41M1vU1UQDUGxPuc4lkb
+            OUl/4yCJ9UQ0wqLdw0O/q2ooay48sH08nNRMsfVIKL+us+ymrBC55VoHIDBwluUd
+            ztVPDJ6He1oNTcKnF2cxaCTrbWPODVTYnAy58DprjXxSRF+3bcb2Ky8loG3ESzDS
+            XAGUpWuWTvFtdvfTe1fmM5jeCtjZNpw6B79akcQuCbnQkKsqg9JRGwIfV048pYTR
+            BWN6UY+oFVUp4arpHbVdi283VsNtFIKr8ibs9t089Q0Yd/K4F9GPU5vTI6q4
+            =emCy
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
+    version: 3.10.2

kubernetes/infrastructure/cert-manager/kustomizeconfig.yaml

@@ -0,0 +1,11 @@
+nameReference:
+  - kind: HelmRepository
+    version: v1
+    fieldSpecs:
+      - path: spec/chart/spec/sourceRef/name
+        kind: HelmRelease
+  - kind: Secret
+    version: v1
+    fieldSpecs:
+      - path: spec/valuesFrom/name
+        kind: HelmRelease