chore(docker): bump deluan/navidrome Docker tag to v0.64.2

.github/workflows/dns.yaml

@@ -12,14 +12,10 @@ jobs:
   update-records:
     name: octodns
     runs-on: ubuntu-latest
-    container: octodns/octodns:latest
+    container: octodns/cloudflare:latest
     steps:
       - uses: actions/checkout@v4
-      - name: Install DNS providers
-        run: pip install octodns-cloudflare octodns-porkbun
       - name: octodns-sync - production
         run: octodns-sync --config-file ./config/production.yaml --doit
         env:
           CLOUDFLARE_TOKEN: ${{ secrets.CLOUDFLARE_TOKEN }}
-          PORKBUN_API_KEY: ${{ secrets.PORKBUN_API_KEY }}
-          PORKBUN_SECRET_KEY: ${{ secrets.PORKBUN_SECRET_KEY }}

.sops.yaml

@@ -1,6 +1,6 @@
 creation_rules:
   - path_regex: .*values.yaml$
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml|token)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
     mac_only_encrypted: true
     pgp: DC6910268E657FF70BA7EC289974494E76938DDC
   - path_regex: .*.yaml

dns/config/production.yaml

@@ -7,29 +7,10 @@ providers:
   cloudflare:
     class: octodns_cloudflare.CloudflareProvider
     token: env/CLOUDFLARE_TOKEN
-  porkbun:
-    class: octodns_porkbun.PorkbunProvider
-    api_key: env/PORKBUN_API_KEY
-    secret_key: env/PORKBUN_SECRET_KEY
 
 zones:
-  vhaudiquet.fr.:
+  '*':
     sources:
       - config
     targets:
       - cloudflare
-  buildpath.win.:
-    sources:
-      - config
-    targets:
-      - cloudflare
-  rhema.rs.:
-    sources:
-      - config
-    targets:
-      - cloudflare
-  saggar.dev.:
-    sources:
-      - config
-    targets:
-      - porkbun

dns/production/rhema.rs.yaml

@@ -1,33 +0,0 @@
----
-? ''
-: octodns:
-    cloudflare:
-      auto-ttl: true
-      proxied: false
-  ttl: 300
-  type: A
-  value: 82.64.154.58
-get:
-  octodns:
-    cloudflare:
-      auto-ttl: true
-      proxied: false
-  ttl: 300
-  type: A
-  value: 82.64.154.58
-s3:
-  octodns:
-    cloudflare:
-      auto-ttl: true
-      proxied: false
-  ttl: 300
-  type: A
-  value: 82.64.154.58
-www:
-  octodns:
-    cloudflare:
-      auto-ttl: true
-      proxied: false
-  ttl: 300
-  type: A
-  value: 82.64.154.58

dns/production/saggar.dev.yaml

@@ -1,17 +0,0 @@
----
-? ''
-: ttl: 600
-  type: A
-  value: 82.64.154.58
-api:
-  ttl: 600
-  type: A
-  value: 82.64.154.58
-docs:
-  ttl: 600
-  type: A
-  value: 82.64.154.58
-get:
-  ttl: 600
-  type: A
-  value: 82.64.154.58

docker/personal/media/films-series/wizarr/docker-compose.yml

@@ -1,7 +1,7 @@
 services:
   wizarr:
     container_name: wizarr
-    image: ghcr.io/wizarrrr/wizarr:v2026.10.1
+    image: ghcr.io/wizarrrr/wizarr:v2026.7.1
     networks:
       - default
       - proxy

docker/personal/media/music/navidrome/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   navidrome:
-    image: deluan/navidrome:0.63.2
+    image: deluan/navidrome:0.64.2
     user: 1000:1000 # should be owner of volumes
     ports:
       - "4533"

kubernetes/dev/gitea/values.yaml

@@ -30,10 +30,10 @@ postgresql:
     global:
         postgresql:
             auth:
-                postgressPassword: ENC[AES256_GCM,data:4Kd4qz3DuJboaA==,iv:I9K1+j2tv7MKel9ej2/AED0JrxIfeb3D1xdDKCS+jTs=,tag:MpQ0NjglUvGZXzeOQjIj3Q==,type:str]
-                password: ENC[AES256_GCM,data:YX6VvEJWfkO0dg==,iv:ixQkW2q7Y9YRIGMIbqWclA5q9Ufw+lNS7Gc4Wd1toiY=,tag:krGDeY+E4+PUjowt8jKAmA==,type:str]
+                postgressPassword: ENC[AES256_GCM,data:AGdZp0KNk6+v+w==,iv:dc7B8GYA1hlC6VgO1m3jdHimIVb4QeR1DTmh9kqRDa4=,tag:JEFWOgvgvUDJ+S9yS446cA==,type:str]
+                password: ENC[AES256_GCM,data:kuR59jqrN/YFmA==,iv:qAIwiTzi2Fr9R9fIc3sfPqhIHSPI8K3eNmed8DBm7PQ=,tag:hf7CMUissSbO4RVn+kRUJw==,type:str]
                 database: gitea
-                username: ENC[AES256_GCM,data:KvdO0oE=,iv:vFYOVlo2kvOHOhASDlccTfcpsgAkS6YXOLCm5sDcxaQ=,tag:9J6Dmc3vYpHlFSggoGVmLQ==,type:str]
+                username: ENC[AES256_GCM,data:rCEYTAA=,iv:zeWzB+vpMl+oGUfQRPYFneLwnXF7Dlg4XAYB4QynAyk=,tag:zqJDiBiKJJIDgNKdOtGlMg==,type:str]
     volumePermissions:
         enabled: true
     primary:
@@ -77,8 +77,8 @@ gitea:
     oauth:
         - name: Authentik
           provider: openidConnect
-          key: ENC[AES256_GCM,data:F0AGCSAkU2ZWmS4jniL8k32ABwrjtURAPLa3RKOCpJoaMkKRlRrqwA==,iv:vQcD73C3itBqKFEiv8PhLD2G3exC0zc2NDE3LGYpvXA=,tag:24nO98pP7a00sTBDWEMsBA==,type:str]
-          secret: ENC[AES256_GCM,data:0/6XDvRXUnQXrJzivtDS6b+mmYjtOVcHhGmQJPFG1zDyO9BksHKau0D+hIsfM85761U7LAISct0HungGNeOQOULnmvVT8hEIgC21RHjArXztJY2964NS5XXfURc7pVxOJ7LSDFFd4azExwhrTktqmerG+F6SI5V/oq2iYYqJA7o=,iv:ShYcIgyccHvEFhVn++gBR7gmMOEKcBz9sj/Y+4pk/Hc=,tag:SkFM2d06O/zhpfVji4QDKA==,type:str]
+          key: ENC[AES256_GCM,data:LekdKlJJX6AYZX2PgooenJtANvE8HNdzePN9yeljrnoKV7pbexDnAw==,iv:pZm4+Dj2uqprBRIgchq78nEzqkC/zVoiyRK0cj98WPo=,tag:iSiuwP8N6BBVeGWS54j+dw==,type:str]
+          secret: ENC[AES256_GCM,data:J7WJghH6Xp9Fg3Y+PO1lN1mEEJ0HbVSM1YP2d8//NX2xmYK/PK1y6xSVQ4+VSsYTZhIAM3ZXVrBE/5smuNLUZkoj2EKY275fXcN2kOkEwiftdsJHSKdevCtO57TQipJToh6mfLxz51LDxpz85rVNj4Rvra1d9UvC5x1nUBm8AR0=,iv:lMiMQGsKn4ZxFctakj5MyVlX+8Wu93d5wM9cIqEBhSc=,tag:CkuTAGJqg+dUzyP9z5gwzw==,type:str]
           autoDiscoverUrl: https://authentik.vhaudiquet.fr/application/o/gitea/.well-known/openid-configuration
     config:
         APP_NAME: Gitea
@@ -104,39 +104,37 @@ gitea:
         indexer:
             ISSUE_INDEXER_TYPE: bleve
             REPO_INDEXER_ENABLED: true
-# Resource limits for Gitea container. Sized to receive a full linux
-# kernel tree: index-pack on ~12M objects needs several GiB and more
-# than half a core (the 1Gi limit OOMKilled the pod mid push).
+# Resource limits for Gitea container
 resources:
     requests:
+        cpu: 100m
+        memory: 512Mi
+    limits:
         cpu: 500m
         memory: 1Gi
-    limits:
-        cpu: "4"
-        memory: 6Gi
 replicaCount: 1
 sops:
-    lastmodified: "2026-09-30T21:03:47Z"
-    mac: ENC[AES256_GCM,data:eHMr2BqfWNI32S14XEivXtXSIRiCBCAQz06mwtbNyXc1dI6YgF4pKdyIbfRWQW0ZYcbvqKxtyugao+lhc24Ds/GgIbdwchlMyz/DyuOQtM5GMHcSoInQUQVGzrM8hSyztKzq10bH0DmKvT68+uaVx0hf6rzxEqLRb3GAk4q3310=,iv:5kJ6bYE/54EbDWctSXBcVTjJtc/J3mV664tFD1WTK90=,tag:AAbHK3njH0PCqw9yjSWevQ==,type:str]
+    lastmodified: "2026-09-22T20:35:36Z"
+    mac: ENC[AES256_GCM,data:xGtSdlGuJL3qSbnfbh/ON1q3c+n6l991fCy9t9ZLnrvSrU15vkK/WVHh84V132C72pEakwRy8nFcUl7KT3C3J2l2uJHJyDWDqA8NTvHq7FAcomKGKpNOqAOFXVUKSr6O4BtQr9x6h4jzAZSlpaTx3GEiLRzygSkZmcEcaXZ6/hU=,iv:JfQ3W3UZV1m1SkapNmUpZ1lkxgTs5F0auXukupK/yAg=,tag:xCNpJUc5mPv2dBhS+ob+fA==,type:str]
     pgp:
-        - created_at: "2026-09-30T21:03:47Z"
+        - created_at: "2026-09-22T20:35:36Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ//Vf2Rdp8NG4AsbIIOiXabY3AzLyVbE9Pn52+FBF+NIfkS
-            XDqlgvMAWHtmV2LzvJPwPIUjCZkoRwmDsh9zi+W1XzHh9kKxzwvIxfjiqm8fwJh8
-            gb4a/y5mkkEqs+H0zE1H4D91dPbfOmDABJKaePmWTB+tc48bY6qX+LYs7hkPwsHU
-            sN64cidbIbzBoq0t1TWZFkl6MZYWX9IyqJE1XcqYDAvwxlJ4JMJH2pGQlY8+7U96
-            YQgbXhuAik5IzNQlmdpq0mt0j3KZgM7KbLJ2en6JAiO0EhD3xKbFnC0bPniUEX2c
-            Yv6Z/1NrmNImCwbOkrNF9sqto4d9VHFDH8udSHKCXcSbzJmkfF4XUOBuNxtprmQV
-            Wlcw5ZMFpnOgRn+V2gb0Cd3cm5rje0QAYCgIGUfduvMm9BReAQTvpUdKkqKs0mLr
-            XiRAG0HfjjGNcVqWA0H0L5UxlVwHJh6zSNHDzTPVlGenVcQSpiUORKxZqANpQchW
-            /wtFghatZFKbbzEz6Mo5C3hMKOXjl/VNWsmva8BoloDKPm9pWH5S4x0ExYiOWSOk
-            Yk9j+twTgJXMeptO55qMCJKl6CcRsbgVr5yJJXWC6I3tr2ssx1BnSAPYDviuhsC1
-            YAbgFlvdzE6n8FmTixVwzVZrTbZV7alz9PECViMP5evAphe3n1MvnLEvMM0WOm/S
-            XgG0Ty4hQ9ZD7gzhIrh06xVuh+MC/PaMYIZ7LBVHgQy8xbAgQH0qXkF39/9rCIws
-            A/D0FN29uXvfSWzlgSrGOj218eKHX9g+nZGIAHeejd/FJVnOKQpUboUlg/x3jqQ=
-            =943y
+            hQIMA7uy4qQr71wiAQ/8DiM04ZZ18qFndWSlo+hHV05hlt7GmwG9dx/3xEXgpdEb
+            TkA3HNi5rUMvA8j/mStmP4sZiqrxlPk9sdMtVsPAppT3qAihcF3DyyUFYkSoY3oF
+            Et5qeeC6DP1aKdsgAQVVZyeLy7l/CbO5CYORm5+TuGmnr0HxN1qZimbF15pspvNN
+            9pprI7XDKb6QEbXhADN9gafNwTIQgv3LGQVdoQgfyzZEcQR8O5bxUFTwdR9LO646
+            zogHuQfPC70jpA2IRxdBHuSTjDkZimyehsKPzq7MpBso/85q3q1TlSQKJsjxZWrZ
+            NBKmEhL/Q4M+8mj+N/aVFJldIUF2Juto5d2BUuIG/lBtNL2QHdiJN3Rxc1gL4qP2
+            eZYESQ6IRXAycUXAQgMJf5p/lhgmVjv8b3lhKSFJq66hZyo5g6wdhLIEunPglNbP
+            BcJXUbl5SScTgOAi9o/soezUuggvzgg3zwM38PAghve1/j0rL7EupYX+u2v7zbUH
+            BA7T30SnkvDCmTzW4+Sac1dg/w06u+4oSGTNnTuKOzmzfIjGlwkJeAtPVcvSFAgK
+            TCKDmvtkPWUxGrxjBbJZUwqCp4HEOwOp6HeGeNbWFZ2UU+JTvTizkxbReN37Q4+f
+            8oIyQuyRpDHgDV5IrbDtCcqWsEFpUXyi8snIMDTCkKdLZv1WjYhjoNmvOoRagQvS
+            XgEQDrDBeC3HZvUuvqMqgmHI+IEjmpad1CNVGE2q7FnAhFYutjBGF78co2X9t+ib
+            B9o6aIwPzS4ANsh47rupGDBt/x46RCorCYhCaJm4B3v0+tYSA7mSBoHQwp1p+AY=
+            =kRPK
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
     encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$

kubernetes/infrastructure/caddy-certificates/certificates.yaml

@@ -79,131 +79,3 @@ spec:
     - buildpath.win
   duration: 2160h # 90 days
   renewBefore: 360h # 15 days before expiry
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: saggar-dev
-  namespace: caddy
-spec:
-  secretName: saggar-dev-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: saggar.dev
-  dnsNames:
-    - saggar.dev
-  duration: 2160h # 90 days
-  renewBefore: 360h # 15 days before expiry
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: api-saggar-dev
-  namespace: caddy
-spec:
-  secretName: api-saggar-dev-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: api.saggar.dev
-  dnsNames:
-    - api.saggar.dev
-  duration: 2160h # 90 days
-  renewBefore: 360h # 15 days before expiry
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: docs-saggar-dev
-  namespace: caddy
-spec:
-  secretName: docs-saggar-dev-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: docs.saggar.dev
-  dnsNames:
-    - docs.saggar.dev
-  duration: 2160h # 90 days
-  renewBefore: 360h # 15 days before expiry
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: get-saggar-dev
-  namespace: caddy
-spec:
-  secretName: get-saggar-dev-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: get.saggar.dev
-  dnsNames:
-    - get.saggar.dev
-  duration: 2160h # 90 days
-  renewBefore: 360h # 15 days before expiry
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: rhema-rs
-  namespace: caddy
-spec:
-  secretName: rhema-rs-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: rhema.rs
-  dnsNames:
-    - rhema.rs
-  duration: 2160h # 90 days
-  renewBefore: 360h # 15 days before expiry
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: s3-rhema-rs
-  namespace: caddy
-spec:
-  secretName: s3-rhema-rs-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: s3.rhema.rs
-  dnsNames:
-    - s3.rhema.rs
-  duration: 2160h # 90 days
-  renewBefore: 360h # 15 days before expiry
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: www-rhema-rs
-  namespace: caddy
-spec:
-  secretName: www-rhema-rs-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: www.rhema.rs
-  dnsNames:
-    - www.rhema.rs
-  duration: 2160h # 90 days
-  renewBefore: 360h # 15 days before expiry
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: get-rhema-rs
-  namespace: caddy
-spec:
-  secretName: get-rhema-rs-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: get.rhema.rs
-  dnsNames:
-    - get.rhema.rs
-  duration: 2160h # 90 days
-  renewBefore: 360h # 15 days before expiry

kubernetes/infrastructure/caddy/caddyfile.yaml

@@ -107,43 +107,3 @@ data:
       tls /etc/caddy/certs/buildpath-win/tls.crt /etc/caddy/certs/buildpath-win/tls.key
       reverse_proxy traefik.traefik.svc.cluster.local.:80
     }
-
-    saggar.dev {
-      tls /etc/caddy/certs/saggar-dev/tls.crt /etc/caddy/certs/saggar-dev/tls.key
-      reverse_proxy traefik.traefik.svc.cluster.local.:80
-    }
-
-    api.saggar.dev {
-      tls /etc/caddy/certs/api-saggar-dev/tls.crt /etc/caddy/certs/api-saggar-dev/tls.key
-      reverse_proxy traefik.traefik.svc.cluster.local.:80
-    }
-
-    docs.saggar.dev {
-      tls /etc/caddy/certs/docs-saggar-dev/tls.crt /etc/caddy/certs/docs-saggar-dev/tls.key
-      reverse_proxy traefik.traefik.svc.cluster.local.:80
-    }
-
-    get.saggar.dev {
-      tls /etc/caddy/certs/get-saggar-dev/tls.crt /etc/caddy/certs/get-saggar-dev/tls.key
-      reverse_proxy traefik.traefik.svc.cluster.local.:80
-    }
-
-    rhema.rs {
-      tls /etc/caddy/certs/rhema-rs/tls.crt /etc/caddy/certs/rhema-rs/tls.key
-      reverse_proxy traefik.traefik.svc.cluster.local.:80
-    }
-
-    www.rhema.rs {
-      tls /etc/caddy/certs/www-rhema-rs/tls.crt /etc/caddy/certs/www-rhema-rs/tls.key
-      reverse_proxy traefik.traefik.svc.cluster.local.:80
-    }
-
-    get.rhema.rs {
-      tls /etc/caddy/certs/get-rhema-rs/tls.crt /etc/caddy/certs/get-rhema-rs/tls.key
-      reverse_proxy traefik.traefik.svc.cluster.local.:80
-    }
-
-    s3.rhema.rs {
-      tls /etc/caddy/certs/s3-rhema-rs/tls.crt /etc/caddy/certs/s3-rhema-rs/tls.key
-      reverse_proxy traefik.traefik.svc.cluster.local.:80
-    }

kubernetes/infrastructure/caddy/values.yaml

@@ -10,7 +10,7 @@ image:
     repository: caddy
     pullPolicy: IfNotPresent
     tagSuffix: ""
-    tag: 2.11.7
+    tag: 2.11.4
 service:
     type: LoadBalancer
     # Cluster (not Local) so any node can forward to pods on any other node.
@@ -36,61 +36,25 @@ health:
 volumes:
     - name: vhaudiquet-fr-tls
       secret:
-        secretName: vhaudiquet-fr-tls
-        optional: true
+        secretName: ENC[AES256_GCM,data:HYQb37rKxMqxFTsCz5kw6qY=,iv:dI9uqUVLLqPv3a5vwz1vowTvO9WduQaXqj7XZREd7oA=,tag:mz257AC3pvubgzOMxbHfrg==,type:str]
+        optional: ENC[AES256_GCM,data:k9FVxw==,iv:XMAGop2PvSGD1R1cy6qqE39bsIAOFIqGzTnwDmYRhHM=,tag:7zZAwSzRWWiT9Y2iMWkI6w==,type:bool]
     - name: wildcard-vhaudiquet-fr-tls
       secret:
-        secretName: wildcard-vhaudiquet-fr-tls
-        optional: true
+        secretName: ENC[AES256_GCM,data:2OUkq/AMuv2wQyIlLPS3bSRrnV1mvDR6vd0=,iv:1e9HC8FFC4vo7GjCnJyNjF05R+Js41ONy2in5a+/doI=,tag:icKdtLhvQ40YI+KCE+6fXg==,type:str]
+        optional: ENC[AES256_GCM,data:b+zvMw==,iv:QyU+T1BGZenO/nO8wq6R+KkrT/I6ZXIIhAnf5npFhvw=,tag:4UPyop81BQu4zxhZmK2n+Q==,type:bool]
     # semery.fr certs from cert-manager (OVH DNS-01)
     - name: semery-fr-tls
       secret:
-        secretName: semery-fr-tls
-        optional: true
+        secretName: ENC[AES256_GCM,data:cLzhXgUhrwgIMACU1Q==,iv:DJ+6mjtjYmWxNcHl1gzeoifpcFCJsXiOXeyxEWnRU3g=,tag:7yc2bt6fBWwBuefPY48xyA==,type:str]
+        optional: ENC[AES256_GCM,data:DTfxaQ==,iv:K7TJjSI/vF3x34SWmwmivYo+mSsUAg9nB94Ui85nHCI=,tag:1/JRBMlb07+aHKEulIYpQQ==,type:bool]
     - name: wildcard-semery-fr-tls
       secret:
-        secretName: wildcard-semery-fr-tls
-        optional: true
+        secretName: ENC[AES256_GCM,data:Qq+ybi1kSVdVn9RP/kTkTcw0lkao3Q==,iv:vFmV3YvSNhLizgJVBnq1ZERqDP70onuZDvy/I3joPtI=,tag:AiEW+yh51Dexz3Vha4MPgg==,type:str]
+        optional: ENC[AES256_GCM,data:0o4ODw==,iv:VwnCs2C1MVUJEfBvNJT1rkDV7m60sNZPdtERo9wWPJk=,tag:oo+liLatrjqEtlrKQyjhyg==,type:bool]
     - name: buildpath-win-tls
       secret:
-        secretName: buildpath-win-tls
-        optional: true
-    # saggar.dev cert from cert-manager (Porkbun DNS-01)
-    - name: saggar-dev-tls
-      secret:
-        secretName: saggar-dev-tls
-        optional: true
-    - name: api-saggar-dev-tls
-      secret:
-        secretName: api-saggar-dev-tls
-        optional: true
-    # docs.saggar.dev cert — the saggar book (static nginx)
-    - name: docs-saggar-dev-tls
-      secret:
-        secretName: docs-saggar-dev-tls
-        optional: true
-    # get.saggar.dev cert — the saggar distribution host (garage web)
-    - name: get-saggar-dev-tls
-      secret:
-        secretName: get-saggar-dev-tls
-        optional: true
-    # rhema.rs certs from cert-manager (Cloudflare DNS-01)
-    - name: rhema-rs-tls
-      secret:
-        secretName: rhema-rs-tls
-        optional: true
-    - name: www-rhema-rs-tls
-      secret:
-        secretName: www-rhema-rs-tls
-        optional: true
-    - name: get-rhema-rs-tls
-      secret:
-        secretName: get-rhema-rs-tls
-        optional: true
-    - name: s3-rhema-rs-tls
-      secret:
-        secretName: s3-rhema-rs-tls
-        optional: true
+        secretName: ENC[AES256_GCM,data:SejgJvZY/B7DDgf3YJcxcFA=,iv:bDZWhie17exL+9r9A7Ea/a8Rgpex7nuabVtW60LotJQ=,tag:WxqFbzulxxPgsynqfo5hzQ==,type:str]
+        optional: ENC[AES256_GCM,data:nBNRkw==,iv:JEvsFzMli7AzUj6GXJlHXOnANm45gnFE/kXrSbBotPQ=,tag:Puss6mCkoC7SGCb86guI2w==,type:bool]
     - name: routes
       configMap:
         name: caddy-routes
@@ -111,30 +75,6 @@ volumeMounts:
     - name: buildpath-win-tls
       mountPath: /etc/caddy/certs/buildpath-win
       readOnly: true
-    - name: saggar-dev-tls
-      mountPath: /etc/caddy/certs/saggar-dev
-      readOnly: true
-    - name: api-saggar-dev-tls
-      mountPath: /etc/caddy/certs/api-saggar-dev
-      readOnly: true
-    - name: docs-saggar-dev-tls
-      mountPath: /etc/caddy/certs/docs-saggar-dev
-      readOnly: true
-    - name: get-saggar-dev-tls
-      mountPath: /etc/caddy/certs/get-saggar-dev
-      readOnly: true
-    - name: rhema-rs-tls
-      mountPath: /etc/caddy/certs/rhema-rs
-      readOnly: true
-    - name: www-rhema-rs-tls
-      mountPath: /etc/caddy/certs/www-rhema-rs
-      readOnly: true
-    - name: get-rhema-rs-tls
-      mountPath: /etc/caddy/certs/get-rhema-rs
-      readOnly: true
-    - name: s3-rhema-rs-tls
-      mountPath: /etc/caddy/certs/s3-rhema-rs
-      readOnly: true
     - name: routes
       mountPath: /etc/caddy/routes
       readOnly: true
@@ -159,7 +99,7 @@ affinity:
             - weight: 100
               preference:
                 matchExpressions:
-                    - key: ENC[AES256_GCM,data:AsOdq9OGQbAGV42W4d22EGVMi5E=,iv:U3sLu8pI7fqOPbvpfpVz21cUfwovKRFi8jY6laTyStY=,tag:EQVSFAzTYw2En2xdGTCF3Q==,type:str]
+                    - key: ENC[AES256_GCM,data:oCV218wXg+k2L/edhWv6qpiyiaY=,iv:Y+O2of2NCOvcjSwr0EenGns0BtpT+P6pjCzEZUIMpm0=,tag:kY/WyHJ4Jr5ZLMe6ZcT/Tw==,type:str]
                       operator: NotIn
                       values:
                         - "true"
@@ -173,36 +113,37 @@ affinity:
                 topologyKey: kubernetes.io/hostname
 tolerations:
     # Tolerate the failover taint so caddy CAN schedule on p330 (small-node-1).
-    - key: ENC[AES256_GCM,data:s3X0PmRJCCVh,iv:UYZl3EsmdSTdF9NoYsL+zbxLlkfO2GU80Sy3CpSXMBY=,tag:35UtC37ldCItR9fAtSXVVw==,type:str]
+    - key: ENC[AES256_GCM,data:K6vJkO2dpKRi,iv:b7NIPKTMYOxNao6KcSJUhsxKNRJ2J3ksEtmXkI8b0So=,tag:pMRmz17upWMTEZjwBRNyZQ==,type:str]
       operator: Equal
-      value: failover
+      value: ENC[AES256_GCM,data:4ULPtEoUhgs=,iv:ikqWRqRR9ki35QQ6VnMEzOgT0/e+5DggGP8w60BhW/Q=,tag:MW9lX8miIWb9nnbc0woZTg==,type:str]
       effect: NoSchedule
-    - key: ENC[AES256_GCM,data:NYCyZsj7wMxKUjaDu+rUOQYxDKvvEwSWuDAxQkSGTczXyApCbw==,iv:3AcvLXryeZ6dfmqanFpGOgEf1nGuEVbvUmZzruxzL98=,tag:Daa9AgXQZkkr7RIzljWOeQ==,type:str]
+    - key: ENC[AES256_GCM,data:l7abu6ywKFevJdJod2Af2bj7XSfBJATL7UnfiUHrRJoCjBsl9A==,iv:xnUvzVX8z4doC+mQs1r0rNCSqaZ8KlXxr5Ee9FOFPjI=,tag:mnqCx9NSMSyeYwz57QFQIQ==,type:str]
       operator: Exists
       effect: NoSchedule
 sops:
-    lastmodified: "2026-10-16T07:06:11Z"
-    mac: ENC[AES256_GCM,data:kMIxep2WVIr8/uAiw12T1JXMbtpyijo1c1MOOUKuok2Z1zSrnFZovgIup3u8/2BhqJ2UUDm5hFJi41Tsq45ba5ELs4PX1whi6EXlHQJxNo7ScfepEi10es/wa+p+3w9V8Yv9cklIWk14zh0UABs8jRzOJXhn5XI3O644CJSULQA=,iv:3ssxqRNRvXbmn0HiQFdwoGVbsnzvtQxfpHPIUpplMK8=,tag:5VRyB/Hh4tZUWp6KCPNSQg==,type:str]
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:gn90e5Gjq5/CraT7Cl43DVMIQukD798faKGbVO5IJlbpAuTwDrhvqnnojFq4R7LEEETtedpR3MRyqcnbfSWVruHoysebycL7EZJkiy7H36JmzQAOWKusshMF9kOyZIV6+AFfz8As/Mu4pF1p5+3jmgy6oOJn7Ewm0C930Gpa3gs=,iv:cf1UC/2NGBHtQgx6h8vRpMjeJRaAvG7ZznhErn2b+cE=,tag:3Ule+pq7pZHWA7NqhlgfPg==,type:str]
     pgp:
-        - created_at: "2026-10-16T07:06:11Z"
+        - created_at: "2026-08-26T19:28:03Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiARAAuN5nBauJiH5bFx80iF2W2XJDwMCFG+SPlqv2ErxVaYkD
-            kSt8pA0o4Bzqr6gP6cEgEhzQHAVVvsvTZJTY5lX6KWNRxhz/RXDhxAi9xdBHQ81f
-            dDWn7pgD8sv8cODM39yeukhGlHxZuk7FiUJ4fBnouojWUCxf2Ib5m5TEaWwmmv5n
-            EBBjjcbGZzyWBzCkLbEY/ML1FIx5j/jyZjpjMp2En1309ljIBckjLk5s9Kntp6oJ
-            /TkW/BhU96y8fyGM6u3FV54wORNlCT3P5cDT4rsQd+KgG0DDchAdUSb7hmBEn+iC
-            W/eUsp7nhObkZZBjTKYeS502Q+3RUEXoLnVLWougDxMSA1rJNS3nkgzK1cmKs97/
-            Ghnb5TUGPmoQMUltQzxInDq1mgeGfuFUffprYprYKGeVC/oQ6uPHE4jVZImlWRjv
-            w6YPHv/2XhWMN5vH/ybsrqxcFb5+1z8u8J58GAJ37hDXzkL8ENJUouonM3sywaBc
-            VbXHzJwYEuLhRfNpay6ovwPkhU25gV3atBiXloIWc0PivPjOAJqqs0vkMgRiA+3R
-            yUagVKdyavVUhqou2LOxSGSv77uFPWZwhqUILtqzTeSE6GHUxVqKQPa91klRRNI7
-            YWNtM7ZqSeANK99h5vgphhPZpuKkIzXHSLEXdplxvaRERfWMU3UGCDZOMVcDMlbS
-            XgGovkHZ9+NKVgZVpsRyQQutbSJqvHVZJx162gu3UKC1IgnDnhslOGKVWw/oKNb5
-            KyPf0CLk9BCAlSngr5D5pw4GJ9eq7RNFOqC32LPwXgNSD1AfLFHYGWh3RZM+81w=
-            =eA3w
+            hQIMA7uy4qQr71wiAQ/9FKZhqwE2RZcfsIeMOtAkOTf/4aEbrSzsHbEO8DP8V3Ct
+            rQBu/v8y1Hcu3fVU/OjVk/7QbEBjPNu1AJST55DBIWktnYUgSo4fIujvG54/hqwM
+            9u0iuA1EcqVzGDa+vLSqgmi4Oxbujs0Ytn7uQrefqkdAOjltKqvknebI9EBdSRUi
+            GjVFwysR6jHmIVf9S64vu4VsjfC7ju9MBYZniaKsJ1GOBhIjUZ6ogkYs5S2E5PJ/
+            zE8cn79x61YLX74H+BAqnFcxbprtsCwMJPgyerfgijV6d+JpwT/6mp1VUrLe9Zz7
+            WEd/lVMlIcwnYCtIDAvuURvMP2OebWplr95d5V1Vb5Yywnl3M0pwkqL4dRiJISvk
+            N2rBQYvDfXBtJA7yTAkJ3PymrECKoFs6nspEBie/kDJmdRGv8s2aajzTTQ1qLAkP
+            FeJe0TcowjCCWMxk4W5DEoCh+PUA1HVo+/KmHjnIVgzdgxaeqT90VXwN8H7MPPeu
+            LKE01+Guue821h7GykkIhe9sf3nMGbI5rOiCcsVtgu5bODkRk8jXpXh1qdRAliuq
+            uddjy1mWEfdUHNBj8YxvZ8WOU7h9FyZjsYZB96n9du1vqcuuP5eTJDVuvjjtDuTK
+            fbXYQbxwA5j4akyI4AKJYLA0Y/lcSXc84r6q8IA52nZz6uQZExbkoc7PPX7Q/ufS
+            XgE0CWRS+0tk2oVANMVU31UrCvitttezjR6sUSAINh122a5kcmOfJzLlB2OqVKc5
+            wMAyvOYccrQMrPDX1WJE7agDOaqGUQcwuFnvqpHhe8q9Yg1uOUU4sK1R8A1Qs0Q=
+            =wlYf
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(data|stringData|.*key|.*crt)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
     version: 3.10.2

kubernetes/infrastructure/cert-manager-issuer/clusterissuer.yaml

@@ -22,7 +22,6 @@ spec:
           dnsZones:
             - vhaudiquet.fr
             - buildpath.win
-            - rhema.rs
       # OVH solver for semery.fr (via cert-manager-webhook-ovh)
       - dns01:
           webhook:
@@ -43,18 +42,3 @@ spec:
         selector:
           dnsZones:
             - semery.fr
-      # Porkbun solver for saggar.dev (via cert-manager-webhook-porkbun)
-      - dns01:
-          webhook:
-            groupName: acme.saggar.dev
-            solverName: porkbun
-            config:
-              apiKey:
-                name: porkbun-api-credentials
-                key: api-key
-              secretApiKey:
-                name: porkbun-api-credentials
-                key: secret-key
-        selector:
-          dnsZones:
-            - saggar.dev

kubernetes/infrastructure/cert-manager-issuer/kustomization.yaml

@@ -5,4 +5,3 @@ resources:
   - clusterissuer.yaml
   - ovh-credentials-secret.yaml
   - ovh-secret-reader-rbac.yaml
-  - porkbun-api-credentials-secret.yaml

kubernetes/infrastructure/cert-manager-issuer/porkbun-api-credentials-secret.yaml

@@ -1,49 +0,0 @@
-# Porkbun API Credentials for DNS-01 Challenges (saggar.dev)
-#
-# Create an API key at https://porkbun.com/account (API Access section), and
-# enable API access on the domain: Domain Management -> Details -> API Access
-# (disabled per domain by default; the API returns a generic error otherwise).
-#
-# The secret MUST live in the cert-manager namespace: for a ClusterIssuer,
-# cert-manager reads webhook credential secrets from its cluster resource
-# namespace, which the webhook chart's RBAC already covers.
-#
-# SOPS will encrypt the stringData fields on pre-commit.
-apiVersion: v1
-kind: Secret
-metadata:
-    name: porkbun-api-credentials
-    namespace: cert-manager
-    labels:
-        app.kubernetes.io/name: cert-manager-webhook-porkbun
-        app.kubernetes.io/component: porkbun-api-credentials
-type: Opaque
-stringData:
-    api-key: ENC[AES256_GCM,data:OLTDhFnbK70gAsvMR/4iKjKr9ckEkbXhYfG4xgTWP2gjruI9HaNAWzSBJcmDyRXRSz18XnvnSlUy/P5VXG5S6uH84wg=,iv:DrOWWf5h1FLNg+emJ/MMp80k8u+A/2HzC07EmjcWORg=,tag:2ep8o1zmXNPV54Byq2Dl7Q==,type:str]
-    secret-key: ENC[AES256_GCM,data:wtGiMCpU8PqTXvH27l+tUvJLivuK/zZp5KePFSeYfjb3ieFszbnjWFd3xQkgtFM3HrmjhRaGWUEFOIEvgTTMDBDyL+k=,iv:iVxMwt6UtpMAqdZj13YUzr3/gDUVTJecyc4ptYvHyNo=,tag:R/tn/BrARGvXjL1EIHBCRQ==,type:str]
-sops:
-    lastmodified: "2026-09-27T23:12:14Z"
-    mac: ENC[AES256_GCM,data:XWzKEL3qi4/KoKUZm1uEfj6GNW3ZLq71PDEyo7w2fHHmkgFMW/xwwXoBLRYFWVx3RvT82NwOCld/Savbs0qXY+Ws1AsgjklEim7MRyIjOKTT8Jkuh39WNCc+8C13yAHSrfPa3tEs10a8lk4nOaFxVn87zAnfnEt6LGt41+/HDxI=,iv:TxW4wJSqHVB9VH9pn/9lYsg8Og3JHTKRPHOrSjeAvuw=,tag:eKZkHptFhE95bPeNegTx8g==,type:str]
-    pgp:
-        - created_at: "2026-09-27T23:12:14Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ/7BAr8vmZ9i0Www7U8EkhPqOi1g0MVD8tVyhnTptBbS4MG
-            irer3UAy7ktovNUso1/wljKif/b2Q8EK6Sawgv4Sv2jN8ShWewginRQ7DeRGtwNE
-            TkNnnZoIMQmKwUZq0NnTmStg0wY/bRDYrovGhvPO8F/ZebU/cEXRFdHDzsKsTo6p
-            9LOu8DnTj9CwvhBLCyzqCeMwvL7DZryXuTS+aEVnrS0J4OUydK4VKYsvwXVsF6XT
-            4Jkpcf4yAiwxBsnZiszvL+L1BPzku1peU/p/d1fciVq54TmgrRwyC7GrlCLm/f09
-            xEPLnBMtmp1w5M2aONEYXXrk5fMWLIuSU7SmFzWduwLAMPTfHvGbpIS4U8eMCuIy
-            THKmeuyPL4/BW+PIc/L/UucOF0pjPDAPsdw3dEkB0+MlX3YDuTc37PpiX3pMRy1C
-            kxhwRVNPZqWMjkrAqg0BR9ZHEOQiv+HwHXZNG5CSHaYYC/mJUSVGaL7R0yOP3nIy
-            cWDA6Pyk5XWLspVh534xQODm1oArMdZ+xnD6NUqt+Bv6facrZkmT6r66LnCLb9fQ
-            rTS1aDm4gxuG5SX7lafDWL9Rh+z2DgFDde9cEAJZiBna4lTE7tJFPHF4OolqzrnN
-            MEhN8no5bLcMv1knE2nKkeKmOoXEKQ80mwgcVkdiRtQf2eZWAXAmpkGehuW/nIHS
-            XAHZXogqlqxbGDtIe2dM0qun1OA0HxsGw5J2EcFUt53wSg/YaZdEPN6aARPdRi8P
-            qGCEhZ43OokTCffCzf2Z52f7nx2NHIOoV3O3+80g6jw/Lrfe8WsZZZyXgjqm
-            =AViA
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(data|stringData|.*key|.*crt)$
-    version: 3.10.2

kubernetes/infrastructure/cert-manager-webhook-ovh/release.yaml

@@ -12,7 +12,7 @@ spec:
         name: cert-manager-webhook-ovh
         namespace: cert-manager
       chart: cert-manager-webhook-ovh
-      version: "0.9.18"
+      version: "0.9.16"
       interval: 1m
   valuesFrom:
     - kind: Secret

kubernetes/infrastructure/cert-manager-webhook-porkbun/kustomization.yaml

@@ -1,12 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: cert-manager
-resources:
-  - repository.yaml
-  - release.yaml
-secretGenerator:
-  - name: cert-manager-webhook-porkbun-values
-    files:
-      - values.yaml=values.yaml
-configurations:
-  - kustomizeconfig.yaml

kubernetes/infrastructure/cert-manager-webhook-porkbun/kustomizeconfig.yaml

@@ -1,11 +0,0 @@
-nameReference:
-  - kind: HelmRepository
-    version: v1
-    fieldSpecs:
-      - path: spec/chart/spec/sourceRef/name
-        kind: HelmRelease
-  - kind: Secret
-    version: v1
-    fieldSpecs:
-      - path: spec/valuesFrom/name
-        kind: HelmRelease

kubernetes/infrastructure/cert-manager-webhook-porkbun/release.yaml

@@ -1,19 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: cert-manager-webhook-porkbun
-  namespace: cert-manager
-spec:
-  interval: 1m
-  chart:
-    spec:
-      sourceRef:
-        kind: HelmRepository
-        name: cert-manager-webhook-porkbun
-        namespace: cert-manager
-      chart: cert-manager-webhook-porkbun
-      version: "2.0.7"
-      interval: 1m
-  valuesFrom:
-    - kind: Secret
-      name: cert-manager-webhook-porkbun-values

kubernetes/infrastructure/cert-manager-webhook-porkbun/repository.yaml

@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: cert-manager-webhook-porkbun
-  namespace: cert-manager
-spec:
-  interval: 1m
-  url: https://porkbun.octabits.io

kubernetes/infrastructure/cert-manager-webhook-porkbun/values.yaml

@@ -1,49 +0,0 @@
-# cert-manager-webhook-porkbun Values
-# groupName must match the ClusterIssuer webhook stanza
-groupName: acme.saggar.dev
-# cert-manager deployment configuration for RBAC
-# The chart creates RoleBindings so cert-manager's service account can reach
-# the webhook and read the Porkbun credential Secret
-certManager:
-    namespace: cert-manager
-    serviceAccountName: cert-manager
-# Restrict the webhook's Secret read access to the Porkbun credentials only
-rbac:
-    secretAccess:
-        secretNames:
-            - ENC[AES256_GCM,data:WXGjM38wR7oKcvetV91WocOt48njb5Y=,iv:7UEsgh62qq/0fGfmjG96Kko/r2h9IOD7IqRnu7poGFo=,tag:qdb4+n9ZnQidlz5fnHq94g==,type:str]
-# Pod configuration
-replicaCount: 1
-resources:
-    requests:
-        cpu: 10m
-        memory: 32Mi
-    limits:
-        memory: 128Mi
-sops:
-    lastmodified: "2026-09-27T22:55:14Z"
-    mac: ENC[AES256_GCM,data:rSc+2n8PYZLdBJRWB3lgiH40+24/5v0vLRAkHV3vM3IyxZgBrjJxmWjAu5PJWHDobQiw7G7x7ZMotJx6TbJztbnBpB5GmdoFC0kVkxxdE8txCWlmcwed6oktCJQ0nR09DaqTk3OvRZgFsWwkVMhZwCjLS+gZBzTTcw84MKqQcGg=,iv:tJd2rGP0EzrjVSp5ESHf5BnFU7fFjMUgfZTgZeM2yRk=,tag:hxVTpxEjz1naTbrDTQUSYA==,type:str]
-    pgp:
-        - created_at: "2026-09-27T22:55:14Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ/5AVsqIJQvmzAAexGSmYjPrdmX7W7JaVHYpUCFbiU9RP32
-            S1ffbzV+YjmYkrLhnwhosNeheEVbEiWeyrea+B9wlTgUp1R9+oy8ooc30uDr/vhY
-            9K56DoEcUhi95mQD1U7e7LK6qUkMowS0HWXEEOb/r/bvL3lQNmc4rNJ8Dz+MDFh3
-            A59ZkrvspjccrLd9wJUb1QbwLKRw/QpE/bT17nj8bOwcAipdz2Q/GoX0LGp88fgS
-            Yy6G/zwVpY/mDylHZbunDVBEqAziR3TAbQsRQZou2oB69Q0jwVs8//vVhWSpniUr
-            an/XdNaEDR5LFJESJK9Kf3H2Qe/Cq8ynC3NFAwk+tHVLOW8MxQrDUvq3fTQq/Zl+
-            CEzMD7+5bQDLQX82QMZ0TdjcLCIEouqCHo9dnGQGUX7NQd1ePV3xda6750zr1maX
-            PVTmx12nS+fCwo1DVLSTVa907TLg3h/DoADzpzcmhTfE7xO2mNcfN+P1dnHT2+U4
-            FhUXqYgZSkgjlkkpVr8XmZg4Cb98lgpS6hDqXylrXhdsCvGgW9YKg0wdQqb6H4Sr
-            ycBsXmj4/j1EMB9yqfSpO/6NNDjTMms0nWsrGXI7NHpROj+AV7fWXC1yxhw6uTus
-            SYhve/6VvbCb3hw9gHb9lzQ9VvTq/0jOqIMBoLoD1Wd45tHczPx1xbVf3KyB1HTS
-            XgFYYLiLku1Jj87DtdbsAbN0tNQNets9TBVffkawgFNsei/H5ZazKFPOC5NrwnJ1
-            FWLWI1fwFZG18c29b8mrEUKqX8GD+YO0BKwmtL7n9out6YAA+hK780RytQDdD00=
-            =yh2A
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
-    mac_only_encrypted: true
-    version: 3.10.2

kubernetes/infrastructure/mail/stalwart/release.yaml

@@ -14,7 +14,7 @@ spec:
         name: stalwart-helm
         namespace: stalwart
       chart: stalwart
-      version: "0.7.21"
+      version: "0.7.18"
       interval: 1m
   valuesFrom:
     - kind: Secret

kubernetes/infrastructure/mail/stalwart/values.yaml

@@ -7,7 +7,7 @@
 # Container image
 image:
     repository: stalwartlabs/stalwart
-    tag: v0.16.25
+    tag: v0.16.22
     pullPolicy: IfNotPresent
 # Single-node RocksDB deployment.
 replicaCount: 1

kubernetes/infrastructure/traefik/values.yaml

@@ -9,11 +9,6 @@ ports:
             trustedIPs:
                 - 127.0.0.1/32
                 - 10.0.0.0/8
-        transport:
-            respondingTimeouts:
-                # v3 default is 60s, counted over the whole request body:
-                # large HTTP git pushes die with a 504 past one minute.
-                readTimeout: 5m
 # Tolerate failover node
 tolerations:
     - key: ENC[AES256_GCM,data:r4uAu1ni9/Z8,iv:aKgn6DgT9XnjzmotnaEIL+WzUiQ34CazfervJwrYsdM=,tag:EeOY1YZwNCOPgHwXpas3ew==,type:str]

kubernetes/kustomization.yaml

@@ -36,7 +36,6 @@ resources:
   # Personal (apps storing my own content, grouped by content type)
   - personal/paperless
   - personal/radicale
-  - personal/rhema-claw
   - personal/syncthing
   - personal/media/photoprism
   - personal/notes/notesnook
@@ -47,10 +46,6 @@ resources:
   - utilities/open-webui
   # Production (public-facing websites/apps)
   - production/buildpath
-  - production/saggar
-  - production/get-saggar
-  - production/get-rhema
-  - production/rhema-site
   - production/semery-fr
   - production/umami
   - production/vhaudiquet-fr

kubernetes/personal/notes/notesnook/release.yaml

@@ -12,7 +12,7 @@ spec:
         name: notesnook
         namespace: notesnook
       chart: notesnook
-      version: '1.0.38'
+      version: '1.0.32'
       interval: 1m
   valuesFrom:
     - kind: Secret

kubernetes/personal/paperless/postgres-release.yaml

@@ -12,7 +12,7 @@ spec:
         name: cloudpirates
         namespace: paperless
       chart: postgres
-      version: "0.20.6"
+      version: "0.20.5"
       interval: 1m
   valuesFrom:
     - kind: Secret

kubernetes/personal/paperless/redis-release.yaml

@@ -12,7 +12,7 @@ spec:
         name: cloudpirates
         namespace: paperless
       chart: redis
-      version: "0.35.4"
+      version: "0.35.1"
       interval: 1m
   valuesFrom:
     - kind: Secret

kubernetes/personal/radicale/release.yaml

@@ -12,7 +12,7 @@ spec:
         name: derwitt
         namespace: radicale
       chart: radicale
-      version: "2.1.4"
+      version: "2.1.1"
       interval: 1m
   valuesFrom:
     - kind: Secret

kubernetes/personal/rhema-claw/kustomization.yaml

@@ -1,13 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: rhema-claw
-resources:
-  - namespace.yaml
-  - repository.yaml
-  - release.yaml
-secretGenerator:
-  - name: rhema-claw-values
-    files:
-      - values.yaml=values.yaml
-configurations:
-  - kustomizeconfig.yaml

kubernetes/personal/rhema-claw/kustomizeconfig.yaml

@@ -1,6 +0,0 @@
-nameReference:
-  - kind: Secret
-    version: v1
-    fieldSpecs:
-      - path: spec/valuesFrom/name
-        kind: HelmRelease

kubernetes/personal/rhema-claw/namespace.yaml

@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: rhema-claw
-  labels:
-    app.kubernetes.io/name: rhema-claw
-    app.kubernetes.io/component: ai-agent

kubernetes/personal/rhema-claw/release.yaml

@@ -1,24 +0,0 @@
-# Tracks the rhema-claw chart as CI publishes it on main: the timestamp
-# pre-releases (0.1.0-YYYYMMDD-HHMMSS) all sort above 0.1.0-0, and the
-# chart's appVersion carries the commit SHA the image was tagged with —
-# values.image.tag stays empty to ride it. Same rolling scheme as the
-# saggar release.
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: rhema-claw
-  namespace: rhema-claw
-spec:
-  interval: 1m
-  chart:
-    spec:
-      sourceRef:
-        kind: HelmRepository
-        name: vhaudiquet
-        namespace: rhema-claw
-      chart: rhema-claw
-      version: ">=0.1.0-0"
-      interval: 1m
-  valuesFrom:
-    - kind: Secret
-      name: rhema-claw-values

kubernetes/personal/rhema-claw/repository.yaml

@@ -1,11 +0,0 @@
-# The vhaudiquet package repository on the home Gitea — where the rhema
-# CI publishes the rhema-claw chart on every main push (base version +
-# timestamp, ordered by SemVer pre-release rules). Public: no auth.
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: vhaudiquet
-  namespace: rhema-claw
-spec:
-  interval: 1m
-  url: https://git.vhaudiquet.fr/api/packages/vhaudiquet/helm

kubernetes/personal/rhema-claw/values.yaml

@@ -1,69 +0,0 @@
-# The rhema claw — the resident agent daemon from ../rhema.
-# Single-node by design (one SQLite store, one dispatcher): the chart
-# fails the render past one replica.
-image:
-    repository: git.vhaudiquet.fr/vhaudiquet/rhema-claw
-    # Empty: follows the chart's appVersion — the commit SHA CI stamped on
-    # the pushed images.
-    tag: ""
-# Bearer token for the /v1 routes (/healthz stays open). The daemon
-# shells out through the coding agent, so the surface must not sit open
-# on the LAN. Encrypted at rest: the .sops.yaml creation rule scoped to
-# this file adds `token` to the values encrypted_regex.
-token: ENC[AES256_GCM,data:fZKJzLy8FjN+0ONrHn40Tgb1/uTtYdAWTJwY7BfFltsGCPnuMx1F8KIPfQbzliyH,iv:yzaHrdDrSBbnT01aJmv8537D1lVe4kwIDINiuOgXPKU=,tag:dT7Z5v3CUhJg/+BqcjAWIA==,type:str]
-# No provider, model, or credentials: the backend is selected
-# dynamically (nothing injected, nothing pinned) — when a dispatch or a
-# chat turn needs a key, the daemon resolves it through the rhema
-# config seam, not through this release. The nulls erase the chart's
-# built-in anthropic/claude defaults from the rendered claw.yaml.
-config:
-    provider: null
-    model: null
-    watches: null
-# The chart's own ingress, rendered from these values. Plain HTTP on
-# purpose: kosmos.lan is LAN-internal and token-auth-only, like every
-# other .lan surface here (no TLS story for .lan hosts).
-ingress:
-    enabled: true
-    host: kosmos.lan
-    className: traefik
-    annotations:
-        external-dns.alpha.kubernetes.io/enabled: "true"
-persistence:
-    enabled: true
-    storageClass: longhorn
-    size: 5Gi
-resources:
-    requests:
-        cpu: 100m
-        memory: 256Mi
-    limits:
-        cpu: "1"
-        memory: 1Gi
-sops:
-    lastmodified: "2026-10-10T11:49:22Z"
-    mac: ENC[AES256_GCM,data:vz3cATCAOEoyXOJCz0u+GfIq06lV5sV3mUoOKa4lUOWnShGOnxxE+v60AslV4KYBfmSCVliTalM0Vm8isuqJSAd9ZdPaI0CZ9F0gkxza22eaESkapIcIYrAhJYcZnRBSyAXjdVHyIzlvVwyTEqWYvEW7F5MJUgc4igHFD1/gMIA=,iv:VxsYzAWGhOiLXCt68Mpu8N9xgjsXXgc2LnInv2BExV8=,tag:rICLpdj4D37QZtTNV91uWA==,type:str]
-    pgp:
-        - created_at: "2026-10-10T11:49:22Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ//WeO+shUgWwJAu2IdxVteea0IpFCyo93hWqxLWMytqF7+
-            3h2s7zXXsNvNCvqndHzNSrZt+OuSQDWSBVIzfxlztw7ga6BdI92OhpOZPCIyKwDT
-            LzzUCPrSAGOZVekOkFXKlVDjMFunAiEp/soGda7bbP+VrdHJmeRh8fioTOgd/4qL
-            /QmmJk3bMTlMoVcknOW2qI3n79YA9qnI0vjwBL63bDeZnxZ8CiZzd1SDr10K0rDf
-            f9ErcmeKAwm+HgehSA3xId0Cph4gnf3xNhNDe2gcZvoFlPIrZT0iU0fBzMRuJPxt
-            c9g+TqTAHBfx90H58/NF8Sfr3ScXNUHvHzgzrq4w+ogqmp8NYsdDbzG1C318dV2o
-            nITluENiYgR9Qs6gJda94aEc00IYEBp4lNGp5G1SyHiDB+jMMsiHX6w3x286dgNx
-            G6DcJ+TabCO+A+Fzq74I2ds+paoEgDegDMCIgK6uSKF0jT2ID579Bf2kRraneOqV
-            amgBI2CQZG5FAqdhbtpf4PHAK9YR3b42mgF9nBAc+f/oFeAZm8nFmG7LubwxqbgY
-            HLa7+ct38ygp/pwZ0FQcU5I3VwqYyU+JA3HMsL2yspHJAeQuXAvzkCQ8NaDOMpEY
-            JRY1pIHl3SwTkV3zh9co8r2Ho8fGYO6KzlNfEdRsx2C6DegM70kpPuYzcCDYAd3S
-            XAE6EX2dM+NxYqhHEIwKjFMJlROWwhhRhheFZnyYRMsn75NkeqRfPi2tJgMkIMk9
-            OJ1eekhgFbQr8vaWtrIOhjvQG9ieg2ujuyltVcC2XUFxQONCxbfoXC2oYu1Y
-            =gTTK
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml|token)$
-    mac_only_encrypted: true
-    version: 3.10.2

kubernetes/production/get-rhema/kustomization.yaml

@@ -1,13 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: get-rhema
-resources:
-  - namespace.yaml
-  - repository.yaml
-  - release.yaml
-secretGenerator:
-  - name: get-rhema-values
-    files:
-      - values.yaml=values.yaml
-configurations:
-  - kustomizeconfig.yaml

kubernetes/production/get-rhema/kustomizeconfig.yaml

@@ -1,6 +0,0 @@
-nameReference:
-- kind: Secret
-  version: v1
-  fieldSpecs:
-  - path: spec/valuesFrom/name
-    kind: HelmRelease

kubernetes/production/get-rhema/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: get-rhema

kubernetes/production/get-rhema/release.yaml

@@ -1,21 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: get-rhema
-  namespace: get-rhema
-spec:
-  interval: 1m
-  chart:
-    spec:
-      sourceRef:
-        kind: HelmRepository
-        name: rhema-dist
-        namespace: get-rhema
-      chart: rhema-dist
-      # Same CI scheme as the other vhaudiquet charts: timestamped
-      # versions on main pushes, exact versions on v* tags.
-      version: '>=0.1.0-0'
-      interval: 1m
-  valuesFrom:
-    - kind: Secret
-      name: get-rhema-values

kubernetes/production/get-rhema/repository.yaml

@@ -1,11 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: rhema-dist
-  namespace: get-rhema
-spec:
-  interval: 1m
-  # Public org-scoped chart repository, same one CI publishes the
-  # rhema-dist chart to (from git.vhaudiquet.fr/vhaudiquet/rhema.rs).
-  # No auth, unlike the saggar org repo: the vhaudiquet org is public.
-  url: https://git.vhaudiquet.fr/api/packages/vhaudiquet/helm

kubernetes/production/get-rhema/values.yaml

@@ -1,58 +0,0 @@
-# get.rhema.rs, the rhema distribution (chart rhema-dist, repo
-# vhaudiquet/rhema.rs). One single-node Garage, one bucket, the
-# saggar-dist shape: the S3 API stays cluster-internal (chart default,
-# s3.ingress.enabled=false — release uploads come from the in-cluster
-# runners) and the bucket serves as a public read-only website.
-# The host MUST be <bucket>.<root domain> — Garage resolves the bucket
-# from the Host's first label — so bucket `get` on get.rhema.rs.
-bucket: get
-garage:
-    # Single-node store: skip the hourly self-sync cycles — while a
-    # full sync runs, S3 auth lookups transiently answer
-    # InvalidAccessKeyId (see get-saggar). Weekly.
-    fullSyncInterval: 604800
-web:
-    ingress:
-        className: traefik
-        host: get.rhema.rs
-        # TLS terminates at Caddy with the cert-manager get.rhema.rs
-        # cert; Caddy proxies to Traefik by host, so no tls block here.
-        tls:
-            enabled: false
-# The write surface, public via Caddy: the release runners reach the
-# S3 API by host (the in-cluster Service name does not resolve from
-# them). TLS terminates at Caddy, like the web face.
-s3:
-    ingress:
-        enabled: true
-        className: traefik
-        host: s3.rhema.rs
-        tls:
-            enabled: false
-            secretName: ""
-sops:
-    lastmodified: "2026-10-16T06:56:14Z"
-    mac: ENC[AES256_GCM,data:XuFKJcXb2C22x1GaADmX+QwQNAeUiYsmSh4g0Z5CTyvIXSI5gksAVKNgF0RqRNDLDmDA1jGCS+a0Y//ExXZO1kKQj2jYdYcKU4IvOmniMiwut5ZtobFbuskv7boAxmNRT/Y/4RgyyT8+45b/2+u3i9u2cwSQQ0Itvh5PxpFlE+I=,iv:3qXS6rEkeodOwLt5AOx8atfr15fK1zpmkM8uKjxUB2w=,tag:1Y78Jq8E44IGukCpR99UwA==,type:str]
-    pgp:
-        - created_at: "2026-10-16T06:56:14Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ/+KleFpAm4wpwoyB8U15o27ys2KXyKNFUl0EeRhYBYjcqe
-            wgtiayZjGbM0Tz2x9+SFLQhezldMlH8N5l0BscuYBMAUgDXS9OMN+v/1nHk0pu43
-            FUYHEWbYmYgngzGKuQhdrGEEtNBH12oKcBVwIPG7zaTfAlhfZIq/xsh6QyfTZX36
-            mSzUsshYPmqUM+RymH/PrJjpWz15XBdFUiY59+hNa9kqjalyTg0gijuu6JkKbYTK
-            SnFd2i9Ud/meniC4oBlLyOc0PX1/uyeIY1SFbGHdwBcHCFdIzMow2fZWLzimsNyB
-            GIO31PbyhG3ZCb2cOzYC0XqJUdP6lHbAyDBDiGWu+dBupDb8d96XeaIF0cTgOjxJ
-            0FrDMk1OAc1HjnhGo4QrEPMT0vMJmRDcDWXp60pFycRIrjGyXItMqkW06Xlr5HvF
-            OM8q3gjz6s7/Yi80EHKyFEHsvLl8jw2OXYhSiUEy6mSfii5k4Hhs2PBJFKcxLqZA
-            tH0caDA4zJia8FdlaTHI9OE33TvP/9uxvY9kBJUaeMdLxCo4T0keOiam2b0K/H8N
-            owIhdVJmXtsAFiw+t7KKZku9kQtkav8hEn1G++VQXL/XUjxvv3CewDq9cbNW7aIU
-            byjUf4jPR+kI4TeyR01YMDP2+O5Ld0/NxlCKqF10w8KVs1OsWFBagC7I4iPy99XS
-            XAEWw3W3SSGkz+9t2cqmXTxCPIvU0ANjkz8PoNAfx9HC3UWk3So1MGht0FDR9QVZ
-            AOzPM4U43wnYrTp1sq4N9Xh7xU2m2e7iUt/g2dtRFvx0vv2qMt4ianqzYiB0
-            =1619
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(data|stringData|.*key|.*crt)$
-    version: 3.10.2

kubernetes/production/get-saggar/kustomization.yaml

@@ -1,14 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: get-saggar
-resources:
-  - namespace.yaml
-  - packages-auth-secret.yaml
-  - repository.yaml
-  - release.yaml
-secretGenerator:
-  - name: get-saggar-values
-    files:
-      - values.yaml=values.yaml
-configurations:
-  - kustomizeconfig.yaml

kubernetes/production/get-saggar/kustomizeconfig.yaml

@@ -1,6 +0,0 @@
-nameReference:
-- kind: Secret
-  version: v1
-  fieldSpecs:
-  - path: spec/valuesFrom/name
-    kind: HelmRelease

kubernetes/production/get-saggar/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-    name: get-saggar

kubernetes/production/get-saggar/packages-auth-secret.yaml

@@ -1,38 +0,0 @@
-# Basic auth for the private Gitea Helm repository (org `saggar`) —
-# same token as the saggar release's packages-auth-secret.yaml. The
-# pre-commit sops hook encrypts this file (name matches *secret.yaml).
-apiVersion: v1
-kind: Secret
-metadata:
-    name: saggar-packages-auth
-    namespace: get-saggar
-type: Opaque
-stringData:
-    username: ENC[AES256_GCM,data:bQ8HUwCqCEIWKQ==,iv:FFcNqBTrA2xJCD2EUf2k+8f1+8DZC9r7Z14Qns0TjH8=,tag:aKWUHSP+8yjbewr/vt3z8w==,type:str]
-    password: ENC[AES256_GCM,data:bfiHI6tHwtK1qYf9UdAplb5qNE7fceQDjUim3KlWU/sb4Q5mvqK6CQ==,iv:ZtRNqfWZLT1lSd/N9MGwKrRiTtKDBUBZUR1LUy00G40=,tag:f55oMGmPHQB8zMNWtChp+w==,type:str]
-sops:
-    lastmodified: "2026-10-04T21:14:09Z"
-    mac: ENC[AES256_GCM,data:pbOlIPfHMwbwyBHlwkTYwWSeWD2jxud2zlNYMDyYJmKRpUuf0/erqRUusTrVGUnOG1t7omu+hQycPC3im6v8mi0vECBlkVG3knQa46bnVH9m1qa7lVChuP53TLYZogrOA8Ol9omrLsUsdcPNJfwXTYS/HHkY+ujECnjCWiVoXUs=,iv:Al2lU2xt1Hvv1BokoOx5e1gOlJhxzMJNyyCosmlGDV0=,tag:OxMxotEvYI06Fjjwst++gA==,type:str]
-    pgp:
-        - created_at: "2026-10-04T21:14:09Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiARAAgsXy5zMBbREVADgr2VVGgev6fHJUXq6DKCRhQdH1nsrI
-            xbSN1HZ2UbQjCYCjZl8NdVo3KGhJJ1uQGABAq6ZE+C4ZaMWvfjEO0/CnHmui8LkL
-            YXvJWWKvP/DDcmLXYxgwP8u/EWtn1bgXN7HeHxYb9JtGEf7XBlS9a6InWDmreabF
-            lSGkl79NgWDIngNQwTvby76uVARSAj3TkIxO6f4cVx+2f/c7KvWvX9D5vjrz8dpk
-            tPFdIhsCHdQS2wf2G3fEp4Yb8WnTEgu/HQ/amYwBAplhv3aaFQ0WVxCB91amnJyw
-            4Hnkcim4e/ZTmlBms/iQMFo+NhcHebRYcganIid23U8j4RfptwbuxED/txDEAAbj
-            lrgpknUXDG9RRRFTZfViYVJ4KWNduuUmVX4URYtn9d42BEXlXwx+Cd7FV40mlM8F
-            aT87F8G3IVexcKqLV15RngswCaCNJOnIT1vNNz18hz6sz8qXCzDwKIsS02wzkchz
-            1E8pi4grh2UkJT/F+mHUnze3ADOIZu6c2+SUwswVi+zAQg566dgFMYfKWc7icbvz
-            AWJ0hatHKNC4utZ2C0sCrM/34M0J507UMjlGKY9FUQ7wnHubPMfrum/FBNH1X7jM
-            F+iWsZ4N+kBnpY1Vf64S+97/Nqg5NZ3IBHWyqaSsWmR/h9628XDAa7kUpIsPK2LS
-            XgEGwyBsqJOWaYa7pXhIuul+1iNTJJ5FhU9qFQci708gund3RSvGJLtUIGlwSLUn
-            qzSSfl8vWujLNj9Pb0FcegVTYAq4eA59rJFILjyRZ64TaIfPBYxdFSD8t4zcWQQ=
-            =oHWG
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(data|stringData|.*key|.*crt)$
-    version: 3.10.2

kubernetes/production/get-saggar/release.yaml

@@ -1,21 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-    name: get-saggar
-    namespace: get-saggar
-spec:
-    interval: 1m
-    chart:
-        spec:
-            sourceRef:
-                kind: HelmRepository
-                name: saggar
-                namespace: get-saggar
-            chart: saggar-dist
-            # Same CI scheme as the other saggar charts: timestamped
-            # versions on main pushes, exact versions on v* tags.
-            version: '>=0.1.0-0'
-            interval: 1m
-    valuesFrom:
-        - kind: Secret
-          name: get-saggar-values

kubernetes/production/get-saggar/repository.yaml

@@ -1,13 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-    name: saggar
-    namespace: get-saggar
-spec:
-    interval: 1m
-    # The org-scoped chart repository CI publishes to — namespace-
-    # scoped like every app, so this release carries its own copy of
-    # the repo and its auth secret.
-    url: https://git.vhaudiquet.fr/api/packages/saggar/helm
-    secretRef:
-        name: saggar-packages-auth

kubernetes/production/get-saggar/values.yaml

@@ -1,50 +0,0 @@
-# Chart: https://git.vhaudiquet.fr/saggar/saggar (chart/saggar-dist).
-# One single-node Garage, one bucket: the S3 API stays cluster-
-# internal (chart default — the publish workflow uploads from the
-# in-cluster runners, s3.ingress.enabled=false) and the bucket serves
-# as a public read-only website. The host MUST be <bucket>.<root
-# domain> — Garage resolves the bucket from the Host's first label —
-# so bucket `get` on get.saggar.dev.
-bucket: get
-garage:
-    # Single-node store: skip the hourly self-sync cycles — while a
-    # full sync runs, S3 auth lookups transiently answer
-    # InvalidAccessKeyId, which is what kept failing the edge job's
-    # prune step. Weekly.
-    fullSyncInterval: 604800
-web:
-    ingress:
-        className: traefik
-        host: get.saggar.dev
-        # TLS terminates at Caddy with the cert-manager saggar.dev
-        # certs; Caddy proxies to Traefik by host, so no tls block
-        # here (same as the other saggar hosts).
-        tls:
-            enabled: false
-sops:
-    lastmodified: "2026-10-06T04:20:10Z"
-    mac: ENC[AES256_GCM,data:ncXYOdUYTaYikkKWVUzWinakZVV7tjja31QIo/xhibZ8Jc9L/dl9U8//xJ95Hlb9uuMJvUHvk78KmH2mYVQhfhyNwkNZXvK3o3azx+WWQYaZebEudRbXdHO6gyywcoywlEFuaVWjVsTpggz2VtlNwP/tqLCf41uTUJB4NZi12uU=,iv:uj13/y/iGeoyqgnx74wh1Pzb01NupeLW55qBhCBNleM=,tag:PGmmMZCw49wt8RmpJH1CzQ==,type:str]
-    pgp:
-        - created_at: "2026-10-06T04:20:10Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ/+MH/izXRcAzwF1Dp5mgQBthTFYX01sUpjU9y5Z9jeRnny
-            UgtCuURwaI41nG+ZOrv3yy2dSsgABMgr8nZZEju/Tb+jZ/qzkPR8JWTpiieXefH4
-            Q5lEy6l1rLVOJudsgx7BG07h6gqr0Mu89gcpFThkXiCo5eAV/hlY9Y6eG6ZybWZ/
-            K2bUv8JB09S8ZsuFsTqp87lZMogWFcIjO8JMirjWRxgd+1NZFoGmSIb+6KkLTD2+
-            eMjbLnGZ3HyWLSzJBRkF5bGgODNGA8qaHmKKMTT8/H9zD1Z++nKCrx7SQpoStQxw
-            xluXAyefTiwCqhEVT42C68Lhz5pH6AyHgJGmls/NWv6bvj/3AQwXlkO87Xkd8x3L
-            aEDHIc5rEso18IZuNzlI193AEhipT8mcMi8IFA4YbnVnkK86PSXQ7qWrbbc4BmkN
-            cU/vUlpBM1HeiYdTFZf8Dvfw55bNn/pMhPhoLWpHjAnAEDJdrVh33OTurdmtYTRW
-            nRK3q2WVHa+UGlkKfdpKr1ivZ9O4ulSfyIYKVsLI5sYAbkJ4o6ytlcQlK6E/7AEK
-            Ux/KAnTb5nXOLN8Vbq0xGlyjYei0GY+IZWkkWL80k59NFfrDLXtG/zCxE74ANplm
-            qx+dCbggjT2lNsM+homldhYU0VhDnvrWM1/9bRI3DUVUxfGUCKMTqUj2b97vLGDS
-            XgHGOTHKKTQjpEg7DnnSS/romTxglHrAEa/3Cu4S4uUVIK7aL8JIoHXYaHho6Jp1
-            9RpCscjyeMfE/wnyTbeR1OZ6wnIMuLXzVzma0fy0fbYqGhJllULpMgsZGe6bhpI=
-            =MIya
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
-    mac_only_encrypted: true
-    version: 3.10.2

kubernetes/production/rhema-site/kustomization.yaml

@@ -1,13 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: rhema-site
-resources:
-  - namespace.yaml
-  - repository.yaml
-  - release.yaml
-secretGenerator:
-  - name: rhema-site-values
-    files:
-      - values.yaml=values.yaml
-configurations:
-  - kustomizeconfig.yaml

kubernetes/production/rhema-site/kustomizeconfig.yaml

@@ -1,6 +0,0 @@
-nameReference:
-- kind: Secret
-  version: v1
-  fieldSpecs:
-  - path: spec/valuesFrom/name
-    kind: HelmRelease

kubernetes/production/rhema-site/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: rhema-site

kubernetes/production/rhema-site/release.yaml

@@ -1,21 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: rhema-site
-  namespace: rhema-site
-spec:
-  interval: 1m
-  chart:
-    spec:
-      sourceRef:
-        kind: HelmRepository
-        name: rhema-site
-        namespace: rhema-site
-      chart: rhema-site
-      # Same CI scheme as the other vhaudiquet charts: timestamped
-      # versions on main pushes, exact versions on v* tags.
-      version: '>=0.1.0-0'
-      interval: 1m
-  valuesFrom:
-    - kind: Secret
-      name: rhema-site-values

kubernetes/production/rhema-site/repository.yaml

@@ -1,10 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: rhema-site
-  namespace: rhema-site
-spec:
-  interval: 1m
-  # Public org-scoped chart repository, same one CI publishes the
-  # rhema-site chart to (from git.vhaudiquet.fr/vhaudiquet/rhema.rs).
-  url: https://git.vhaudiquet.fr/api/packages/vhaudiquet/helm

kubernetes/production/rhema-site/values.yaml

@@ -1,42 +0,0 @@
-# rhema.rs, the static landing/download site (chart rhema-site, repo
-# vhaudiquet/rhema.rs). One stateless nginx Deployment.
-# TLS terminates at Caddy with the cert-manager rhema.rs certs; Caddy
-# proxies to Traefik by host, so the ingress stays plain HTTP (same
-# shape as every other public site here).
-replicaCount: 1
-ingress:
-    enabled: true
-    className: traefik
-    siteHost: rhema.rs
-    # www redirects to the apex inside nginx, so it rides the same
-    # service; only the host name differs.
-    wwwHost: www.rhema.rs
-    tls:
-        enabled: false
-sops:
-    lastmodified: "2026-10-15T20:28:50Z"
-    mac: ENC[AES256_GCM,data:jDNsyWKl2WhofVTzlgevHuPoLZUrLTW87Wd+dLv3nWEFWfN3G8fy0IKGbns1NpFyhx/OfqDJjlmDeZyt4dfmRUPC3Y1MI3kd4KUGlKf0lPy94MTJog7DZtVGtS0RUCN7/NevqtopIivj38u1dXjdcRI+F8bL91blf+RHvvvGOe8=,iv:pmVYVtNhczWqk8CLrAP2McUTrn8uTE88LC9oKtYQzf4=,tag:s+TXQDFqipQtfkE/BN2ASA==,type:str]
-    pgp:
-        - created_at: "2026-10-15T20:28:50Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ//df2F/yV6AzsAeDXunqgf016/km+/O8b37+WSaoB7UHb0
-            f/3lqxoVD9EWaTLum1pwHbhauDrjsOyyqkmIbEeOdnMQjEhDvnjfkDbTDupwl7Qg
-            m95ozoUsprhlqEu61ANhAx5xOHfelV5hkL5+ef9o3o0Ist2T8uBv/v+KxnbCHwmQ
-            e2/rjZ9BF8JgnhYVN3VKnpCgz2k9DVAdIZ4saeaET71MCK2naaO8BcVOH86H2Kn6
-            croIE0V/RNPBL3V0PDF804jRIPwfwd0sQiSwwpo11a/9Zgfwj2PDft1FPFyRv7Yt
-            iy5RaJ8rY8C2AqxRj1V0QIp6SyT784yhW02//8zZOA3Mcs9RUJfBosbqQDb3KIPx
-            MMNNgA1/Fa+7VWI7UX6/24tg2m7MPSCRLvzZMWzriKvcKQj/A0fn4pgcQfQ5wqnm
-            v/VrdLL8PBfy2dkYAsBvx4mAt11sOPwoT0iFhxInLNGeGsteJ5/texgLmJ/uO6vx
-            jJLJT8izFKqZKJCK5Db/Qx8RuiuGysaS3NiWVKfdWrwlbNsMKeRFMEaEAfKjPOPG
-            +1WQcvi+jHfCWsjimxW2+Cs90ZIUY3lbGLuQWhFj8zynQt5rehCZzqjmtx6MbHRT
-            GdDZm62Ox1sdMq1ZwMVElWelyNSTtPNN53DcEEiTGqaSwJjdLz9WZhcjMl0vE5rS
-            XAGm3AzBcPNFtWEODV1AyXwOUPea5RJ7ZNOOPy7jTrV0sZwJ8TAc67VP9IW8n1CM
-            22ri2Xq2qDidxsCKiQeaF77DN2YhBYJnxhvfeplVcKGyqb/EElDznR/fprDR
-            =IpGk
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml|token)$
-    mac_only_encrypted: true
-    version: 3.10.2

kubernetes/production/saggar/gitea-oidc-secret.yaml

@@ -1,40 +0,0 @@
-# Gitea OIDC client credentials for the saggar login provider — the
-# OAuth2 application registered on git.vhaudiquet.fr (Profile →
-# Applications → OAuth2), with redirect URI
-#   https://saggar.dev/auth/callback/gitea
-#
-apiVersion: v1
-kind: Secret
-metadata:
-    name: saggar-gitea-oidc
-    namespace: saggar
-type: Opaque
-stringData:
-    client-id: ENC[AES256_GCM,data:8NHXVbeLNBbFfxtVDk8AtbBWnjpwMWlihjqoEFSJmCDH3Cjz,iv:3PqTABU6ZxNEm0jshvDEkKbSHpdqf2/7DzVVjx/cXVA=,tag:YYuNIQU4nsNxVWZA2WVVbw==,type:str]
-    client-secret: ENC[AES256_GCM,data:WiqVhGyNHyeVQY9bX2qkvcaiasejyUUyNXBN4kTKl+TfP8vsedex0U8Va5Ns+9KW/Uget3+kH/o=,iv:K1zLz8am7Vox5IZc5zSDSEeDu9t6R5swEeeqTRrnZdo=,tag:OEbZAqNBkgpX/RdvH5Tb8g==,type:str]
-sops:
-    lastmodified: "2026-09-30T20:30:47Z"
-    mac: ENC[AES256_GCM,data:MKm2CMBDtNL2GzO2pvmX7WLcTYNap9Xh/loBjZESkHbS65V2QpNU4+yTXcDewyDld9q2zKock1kPRQbhSyptlpxRQN6WZ+LhenS3f6p7rjPq+6gquNJ9j6ccgMFKvBKXoitYsbvfdpp6F6FN8vj24aH6OmTO2gUuvsdj7LIF1bI=,iv:20tkg9yg1kPeo2tbNbXNKNWXAbUqL352NV3+HOCqnqQ=,tag:35vyPxiRTUPuQkxy1/zD0Q==,type:str]
-    pgp:
-        - created_at: "2026-09-30T20:30:47Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ/+INz4B5GdyNfaR4b6DXha7chZN3Qh+nh8oRduzFGKak76
-            C3fANw2+HJ4/eV/j1ImNMbON0v7fbPpEe417nkRPESxnkEONi2Rrt0qoCVtnI64u
-            isewcMXEJCvTqAa460lE5AIC3tMjfYZd7h3tUe9N7HL3ufOB7hDVflGq954Zo+qu
-            rwGH5RZ5s4B5xnW6upVia+TRpu907ibpCKSfzm2uH6CRSIuuvIZrhu/qMnEUaa9F
-            9SEEr87orU7YhYltPmK6k3oFaZLbXNsIYCLl7AIeMA3ZlvKKwk4HkTxYU5BUsAK9
-            Zhv7yWIFyhTLVOv2k1dbOym3aRGe2KA/+LGHn0bi9ps2A5Vf6rSIQ1v2ya+OVCmw
-            Ibofs6/pfI1sZ56pOo1BGv0e6hBTe+jzimtBrTSAuCytDcTDmWusnH3HU8EefanN
-            96Dw1NMCVqYn+yl8CL9UPMOL4UT+CDJEbWVBjfVvsoeaER+ipPbspo9eRZypq7D7
-            aOWrP9Uiig/PeLt4ZMpsTWM27/tsVy2CPEFQ+XlgandVLQ6qTUQK42oAtepDSWuP
-            z8b12dkZ+xraI/wPqlrf6fXU+oKU2KteZxiMn89KqEgTbMp+BGycDHsKLA7VE+uz
-            Ni97MN8fbkT85VgwGE95xvUDGMMGyQuJrKbwc6gXzHQoCzZ/RfPBSUeXM4iyAa3S
-            XgGXEdIV02aQjl+kOqXu1VZLDVnb46fXTA5GDU51HKHeyT6YoE3rNljdFp2/hub/
-            rYX5lJ4j8XXo6s9xUQ3BEw3JMbrc0++SrIXGk3Hqid3Ez+cBm3Q/wqF3YpF5tIs=
-            =GpPh
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(data|stringData|.*key|.*crt)$
-    version: 3.10.2

kubernetes/production/saggar/kustomization.yaml

@@ -1,15 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: saggar
-resources:
-  - namespace.yaml
-  - packages-auth-secret.yaml
-  - gitea-oidc-secret.yaml
-  - repository.yaml
-  - release.yaml
-secretGenerator:
-  - name: saggar-values
-    files:
-      - values.yaml=values.yaml
-configurations:
-  - kustomizeconfig.yaml

kubernetes/production/saggar/kustomizeconfig.yaml

@@ -1,6 +0,0 @@
-nameReference:
-- kind: Secret
-  version: v1
-  fieldSpecs:
-  - path: spec/valuesFrom/name
-    kind: HelmRelease

kubernetes/production/saggar/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-    name: saggar

kubernetes/production/saggar/packages-auth-secret.yaml

@@ -1,38 +0,0 @@
-# Basic auth for the private Gitea Helm repository (org `saggar`) —
-# the same access token also goes into values.yaml's imageCredentials
-# for the container pulls (the chart renders the imagePullSecret).
-apiVersion: v1
-kind: Secret
-metadata:
-    name: saggar-packages-auth
-    namespace: saggar
-type: Opaque
-stringData:
-    username: ENC[AES256_GCM,data:gQXori8DR18jnw==,iv:X1rqJ3gTlIdY6qDYYDLjW+r+/PZVvVvZJaHuRflA50k=,tag:QOLVAuGO/deRAxwelHq3jA==,type:str]
-    password: ENC[AES256_GCM,data:aGrzZOtE7PeFXB8ybbAGgVdstb6De7ha/GARPyXP8nxP/tv542d3YQ==,iv:ngBYMmLVtG/5Au5txvzM25LOT2FswrAHP7LMRth2yek=,tag:+uKN2Zjl/ueYIHrXvWBTaA==,type:str]
-sops:
-    lastmodified: "2026-09-30T20:30:48Z"
-    mac: ENC[AES256_GCM,data:G5Z0s30VsnEsvCVQin/fNg8n2UamvhDv4TMOzvBWXXjW5b43aXdzbQ++x3AetBCgocuTkAXqoPmpYG5f0DVH3n+55lqeE3ChtUlkb0S3zJPZ1jna5rNqKHMFuI8nItyxowAVVKJ06tscRCPlvwRcYWuTGEep0Lq7fSgt6BR/7TQ=,iv:x0uJXcRo8CDjzd4msHMBwloATMryQxmo3eGpzBhzn80=,tag:AwI4lslApzy0wyJgRcYdLg==,type:str]
-    pgp:
-        - created_at: "2026-09-30T20:30:47Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiARAAsQDZ1Uan1oGs6/mBJ9RvdMWH7fhCJfIWXv9Ldljn9lFv
-            Cp7ygWA9xgmUW2emtybn28s6uNr4kEH5/x5+0BIIVAmb/LKWi40bQKhSuaWKEgZf
-            OmZMNRilgwKFODbfif7UzsjKmogJ5DBFZqiJXP9uFSbF8klH4HSbJcKHR9jCjiM8
-            cnWcpZ4xPaPxV7ARC8vKh3jvC7Eh6ivjEhJJSUQTt7w4ucs2e07n2WrCLAQDtu4m
-            xzVMDV6y2Far3Rv3Lk5O+FRprmpIKhGwU5nfEFighj7K8/ynZDUEsE5EUtuxDw1p
-            BBFFAsuNf4J+qVctfCFwEr2PTsT1VU0jKcB6t9lJZE3aT2xu9mu1Ezn9m/YGWzp2
-            airb4UVACWLXj9sqcv7YIG8aUHpm7qVm8AE5UF1OhNJbDCQbpUEklGNRV3N0R4nr
-            ehatG1fCLUmXj7CUHdLmfGkhahfUIl2SJAp42h9VdQN8NB8Plj4j+hzluZSqU8XS
-            KP7kdIbDheeqZvSxA4KAeXrvvUzOWp4VK6ClL9pVjEh5HTu38atFGQ99daILy95L
-            f2z4l1Gc73+zRCHWPKtz5SiPT/G4RlxL2lrgKnykfpOCbJ7wV+XC5kAi+Lj8BM7s
-            EB2bqYewal8k2+VVFGD8vzyB/0mV2i37AJFJ8uJTU09D0CKGpDlgrFw1D3YkwA/S
-            XgGxHYtmARZxCBEbCeizPE4nk+UZtvVtngPUKABPe5euwX40kOwy81dadjoIZsks
-            Vev3d9txiEO6QKcx5rTEp7uju9QO8meqWIM97f0dB1hj1l+tRwmo91XJVKBRgFQ=
-            =ZysC
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(data|stringData|.*key|.*crt)$
-    version: 3.10.2

kubernetes/production/saggar/release.yaml

@@ -1,19 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-    name: saggar
-    namespace: saggar
-spec:
-    interval: 1m
-    chart:
-        spec:
-            sourceRef:
-                kind: HelmRepository
-                name: saggar
-                namespace: saggar
-            chart: saggar-hub
-            version: '>=0.2.0-0'
-            interval: 1m
-    valuesFrom:
-        - kind: Secret
-          name: saggar-values

kubernetes/production/saggar/repository.yaml

@@ -1,10 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-    name: saggar
-    namespace: saggar
-spec:
-    interval: 1m
-    url: https://git.vhaudiquet.fr/api/packages/saggar/helm
-    secretRef:
-        name: saggar-packages-auth

kubernetes/production/saggar/values.yaml

@@ -1,105 +0,0 @@
-# Hub mode (the chart default): intake + registries + web UI, with
-# artifacts in the release's embedded Garage store (chart default in
-# hub mode, longhorn-backed). Builds happen on runners from the
-# saggar-worker chart, to be paired against this hub once it is up.
-image:
-    repository: git.vhaudiquet.fr/saggar/saggar
-    # Empty: follows the chart's appVersion — the commit SHA CI stamped
-    # on the pushed images.
-    tag: ""
-# Private Gitea registry: the chart renders an imagePullSecret from
-# these. Same access token as packages-auth-secret.yaml (the
-# pre-commit sops hook encrypts this file).
-imageCredentials:
-    create: true
-    registry: git.vhaudiquet.fr
-    username: ENC[AES256_GCM,data:Kb01bICyN/BvDQ==,iv:o19woAl9Hqlouo3fgmj6fesiix1bo6fPRcZdE3W55bk=,tag:LzBjc/dOaFv1yUblzAmFBQ==,type:str]
-    password: ENC[AES256_GCM,data:Phft0J0kFY71+icAEP2OuwGOfkNwMv64Yd0mWJkgVXWEJRyczAorZg==,iv:SeM4FVIwAqXxT9P6uUyftehk/eL3Y2JY1beGbruO0mM=,tag:Dezoea9JnN49laU0q+H3Bg==,type:str]
-# Login via the home Gitea: the engine is the confidential client of
-# the provider and runs every code exchange, so its discovery drives
-# the endpoints (issuer verified live). Credentials live in
-# gitea-oidc-secret.yaml — both ride the Secret (clientIdKey opts the
-# id in too), so nothing sensitive renders into the ConfigMap. The UI
-# needs nothing: it discovers the provider from the engine's open
-# /auth/methods.
-auth:
-    # The web origin the device login names: `saggar login` prints the
-    # confirmation page under it (saggar.dev/device).
-    uiUrl: https://saggar.dev
-    providers:
-        - name: gitea
-          issuer: https://git.vhaudiquet.fr
-          existingSecret: ENC[AES256_GCM,data:hqjfc89icY+3fOSMzh0xJ0Q=,iv:K+g5gpi8vcBpw6buktSZlePj9p4TGRV6bxuvSrFx2i0=,tag:FljiBjxAFrQON4J4iqk50w==,type:str]
-          clientIdKey: client-id
-          clientSecretKey: ENC[AES256_GCM,data:b01cCxpLg9d8ECChUQ==,iv:IMU1G+3hEyqS6jU7eWpgvQE7/ndLbH5gkbydFisCQeM=,tag:xs0ehG08oU15/N1hN9AHug==,type:str]
-storage:
-    garage:
-        # Single-node store: skip the hourly self-sync cycles — while a
-        # full sync runs, S3 auth lookups transiently answer
-        # InvalidAccessKeyId. Weekly.
-        fullSyncInterval: 604800
-ingress:
-    enabled: true
-    className: traefik
-    # The engine host: CLI intake + the docker/apt registry front-ends.
-    host: api.saggar.dev
-    # The chart's default annotations are nginx-specific (SSE
-    # buffering); traefik streams unbuffered by default, so clear them.
-    annotations: {}
-    # TLS terminates at Caddy with the cert-manager saggar.dev certs;
-    # Caddy proxies to Traefik by host, so no tls block here (same as
-    # pkgatlas's ingress).
-    tls:
-        enabled: false
-ui:
-    # Sign-in redirect base — the UI's own public origin.
-    publicBaseUrl: https://saggar.dev
-    # The engine's public origin for the docker pull / apt usage lines.
-    # Set explicitly: the chart derives it from the hub ingress, whose
-    # tls is off here (Caddy terminates) — that would render http://.
-    apiPublicOrigin: https://api.saggar.dev
-    ingress:
-        enabled: true
-        className: traefik
-        # The UI lives on its own host: the engine mounts its API and
-        # registry surfaces at root (/v2, /apt, /nodes), paths the UI
-        # pages also use.
-        host: saggar.dev
-        annotations: {}
-        tls:
-            enabled: false
-docs:
-    # The chart deploys the book by default; the ingress renders as
-    # soon as a host is set (no enabled knob).
-    ingress:
-        className: traefik
-        host: docs.saggar.dev
-        tls:
-            enabled: false
-sops:
-    lastmodified: "2026-10-06T04:20:10Z"
-    mac: ENC[AES256_GCM,data:ztx2M4srmnZs9S86xWOYSkePbi9Gm1n0FIB9oBmiaEn5fzSmPLbbn8IPcRsU+zOjkg5DRZ4LbuNdtmxynTC20yCHpb2vZbIUFiQarxPizI9lcKZyyOXFjoECXYZ5oDEOkAPrvYWTduqvK5o9dsUmebtKCSh9EMVMD47nF76yr68=,iv:Y2DjchwTfIjWMDGfQNwXCxM7MG6iNwU6LHf276osNjM=,tag:oviToaqWMdl1/cDgYX9M7g==,type:str]
-    pgp:
-        - created_at: "2026-10-06T04:20:10Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ//Sgir+7MRZYnuxGArDmyeP57A3xL6F77pLZbNIOjQ6KcK
-            3Giga+m3n2BodCDVzL6bUOtUbtgBVyqD7SSBY4qQ2a9c/H4xBAO0HciDth4O1Wer
-            z8fKSphk7tt1yBtzuB1tm0F9Ye53tLaetACXRGGo83jCGse8J0d4+vimra45fjyn
-            9JEnCl0+A2AMMl9/hcfCj8iSj+VeiCJz35Zmo+BWl0KrY0DHAeEyBEtI7O+z8bFF
-            9oGZY/xhTVD4IkbOqXs1fatTmybyzxrTBz/I7d9QOnPx7N08rb/g3KspkCPDSptH
-            h/AnDGg0PDVs7WK0eMwFMsZ8gvEYI76ecf6mAO5x6TbpxVHCPXpbbBTC7ro7usB0
-            4jVLrALMtsMn8k45JWFGR3OsujPr1D+yGmsJ2Mqde4AtjE6zTs8TurwuDEY0ivYg
-            HvAKk6C+ZOmdQEMep2kznSovMx0m6FP8Muv0ORX+pMNOIRhUFbEAXT+s7J7YoLlf
-            Rza/lf4VgsWtTUyUZRTH3G2NTwEgBo4GsV6bM07OhN0GEgMH1hOuGo61C+e2d6PR
-            NqeRgvlzfmeoTUBwgNv023739hyB2xDVesr5jo/yomikxFiz0wGUBQ4eRZmRZSjD
-            ZCLoiv+2ymROgWzGqgutRiRD150P45biMs3zW/x3qGP/SiTj35OYyCzMjQb/ZRjS
-            XgGHEtiiRWv954k5eXRF3DOHxrZ/oxtjyc4+EjlS3VsgtOCjePSzKg/WQa8Zx3ns
-            MT2BKgtlFwM2eG5V7jHfHOmAuVIuH249iyER5AJDzot/0kAO7ekH/y72kfloDKk=
-            =3vCq
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
-    mac_only_encrypted: true
-    version: 3.10.2

kubernetes/system/flux/cert-manager-issuer.yaml

@@ -15,7 +15,6 @@ spec:
   dependsOn:
     - name: cert-manager
     - name: cert-manager-webhook-ovh
-    - name: cert-manager-webhook-porkbun
   decryption:
     provider: sops
     secretRef:

kubernetes/system/flux/cert-manager-webhook-porkbun.yaml

@@ -1,20 +0,0 @@
-# Flux Kustomization for cert-manager-webhook-porkbun
-# Depends on cert-manager being fully operational (CRDs installed)
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: cert-manager-webhook-porkbun
-  namespace: flux-system
-spec:
-  interval: 10m
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: homeprod
-  path: ./kubernetes/infrastructure/cert-manager-webhook-porkbun
-  dependsOn:
-    - name: cert-manager
-  decryption:
-    provider: sops
-    secretRef:
-      name: flux-sops

kubernetes/system/flux/kustomization.yaml

@@ -6,7 +6,6 @@ resources:
   - webhook.yaml
   - cert-manager.yaml
   - cert-manager-webhook-ovh.yaml
-  - cert-manager-webhook-porkbun.yaml
   - cert-manager-issuer.yaml
   - caddy-certificates.yaml
   - stalwart-certificates.yaml

kubernetes/system/kyverno-policies/policy-strip-cpu-requests.yaml

@@ -80,13 +80,13 @@ spec:
                 - longhorn-system
               selector:
                 matchLabels:
-                  longhorn.io/component: instance-manager
+                  app: instance-manager
           - resources:
               namespaces:
                 - longhorn-system
               selector:
                 matchLabels:
-                  longhorn.io/component: engine-image
+                  app: engine-image
       mutate:
         # `request.object` is available in BOTH admission and background modes:
         # the backgroundController synthesizes an admission-like request for