chore(docker): bump vabene1111/recipes Docker tag to v2.6.15

2026-11-05 21:38:11 +00:00 · 2026-09-12 04:01:05 +00:00
83 changed files with 77 additions and 1659 deletions
@@ -12,14 +12,10 @@ jobs:
  update-records:
    name: octodns
    runs-on: ubuntu-latest
-    container: octodns/octodns:latest
+    container: octodns/cloudflare:latest
    steps:
      - uses: actions/checkout@v4
-      - name: Install DNS providers
-        run: pip install octodns-cloudflare octodns-porkbun
      - name: octodns-sync - production
        run: octodns-sync --config-file ./config/production.yaml --doit
        env:
          CLOUDFLARE_TOKEN: ${{ secrets.CLOUDFLARE_TOKEN }}
-          PORKBUN_API_KEY: ${{ secrets.PORKBUN_API_KEY }}
-          PORKBUN_SECRET_KEY: ${{ secrets.PORKBUN_SECRET_KEY }}
@@ -1,6 +1,6 @@
 creation_rules:
  - path_regex: .*values.yaml$
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml|token)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
    mac_only_encrypted: true
    pgp: DC6910268E657FF70BA7EC289974494E76938DDC
  - path_regex: .*.yaml
@@ -7,29 +7,10 @@ providers:
  cloudflare:
    class: octodns_cloudflare.CloudflareProvider
    token: env/CLOUDFLARE_TOKEN
-  porkbun:
-    class: octodns_porkbun.PorkbunProvider
-    api_key: env/PORKBUN_API_KEY
-    secret_key: env/PORKBUN_SECRET_KEY

 zones:
-  vhaudiquet.fr.:
+  '*':
    sources:
      - config
    targets:
      - cloudflare
-  buildpath.win.:
-    sources:
-      - config
-    targets:
-      - cloudflare
-  rhema.rs.:
-    sources:
-      - config
-    targets:
-      - cloudflare
-  saggar.dev.:
-    sources:
-      - config
-    targets:
-      - porkbun
@@ -1,33 +0,0 @@
---
-? ''
-: octodns:
-    cloudflare:
-      auto-ttl: true
-      proxied: false
-  ttl: 300
-  type: A
-  value: 82.64.154.58
-get:
-  octodns:
-    cloudflare:
-      auto-ttl: true
-      proxied: false
-  ttl: 300
-  type: A
-  value: 82.64.154.58
-s3:
-  octodns:
-    cloudflare:
-      auto-ttl: true
-      proxied: false
-  ttl: 300
-  type: A
-  value: 82.64.154.58
-www:
-  octodns:
-    cloudflare:
-      auto-ttl: true
-      proxied: false
-  ttl: 300
-  type: A
-  value: 82.64.154.58
@@ -1,17 +0,0 @@
---
-? ''
-: ttl: 600
-  type: A
-  value: 82.64.154.58
-api:
-  ttl: 600
-  type: A
-  value: 82.64.154.58
-docs:
-  ttl: 600
-  type: A
-  value: 82.64.154.58
-get:
-  ttl: 600
-  type: A
-  value: 82.64.154.58
@@ -383,13 +383,6 @@ photos:
  ttl: 300
  type: A
  value: 82.64.154.58
-pkgatlas:
-  octodns:
-    cloudflare:
-      auto-ttl: true
-  ttl: 300
-  type: A
-  value: 82.64.154.58
 sse-nook:
  octodns:
    cloudflare:
@@ -9,7 +9,7 @@ services:

  web_recipes:
    restart: always
-    image: vabene1111/recipes:2.6.13
+    image: vabene1111/recipes:2.6.15
    networks:
      - default
      - proxy
@@ -2,7 +2,7 @@ terraform {
  required_providers {
    docker = {
      source  = "kreuzwerker/docker"
-      version = "3.9.0"
+      version = "3.6.2"
    }
  }
 }
@@ -2,7 +2,7 @@ terraform {
  required_providers {
    proxmox = {
      source = "bpg/proxmox"
-      version = "0.116.1"
+      version = "0.81.0"
    }
  }
 }
@@ -17,7 +17,7 @@ valkey-cluster:
 # Use standalone Valkey (replaces 'redis' in chart 12.x)
 valkey:
    enabled: true
-    primary:
+    master:
        resources:
            requests:
                cpu: 100m
@@ -30,10 +30,10 @@ postgresql:
    global:
        postgresql:
            auth:
-                postgressPassword: ENC[AES256_GCM,data:4Kd4qz3DuJboaA==,iv:I9K1+j2tv7MKel9ej2/AED0JrxIfeb3D1xdDKCS+jTs=,tag:MpQ0NjglUvGZXzeOQjIj3Q==,type:str]
-                password: ENC[AES256_GCM,data:YX6VvEJWfkO0dg==,iv:ixQkW2q7Y9YRIGMIbqWclA5q9Ufw+lNS7Gc4Wd1toiY=,tag:krGDeY+E4+PUjowt8jKAmA==,type:str]
+                postgressPassword: ENC[AES256_GCM,data:PtWMsukqbrWiVg==,iv:iQtDckrih/3ZKopzD9eEViOMZrvSulmCI5tHCsJph1A=,tag:7S54w4ADG7+8QNiLDw2Q0A==,type:str]
+                password: ENC[AES256_GCM,data:jLC1oEl+ZAnpbw==,iv:PliGMmxHKn3eEt8uvsv9wL4syk91EC5OpA7AL5J0+4o=,tag:Oan4ek7m0Cxnl5bzOCGHXw==,type:str]
                database: gitea
-                username: ENC[AES256_GCM,data:KvdO0oE=,iv:vFYOVlo2kvOHOhASDlccTfcpsgAkS6YXOLCm5sDcxaQ=,tag:9J6Dmc3vYpHlFSggoGVmLQ==,type:str]
+                username: ENC[AES256_GCM,data:ricveNc=,iv:rPrHKhIzsNEQzoaX2cPDvVWjR7NIxsN1tBlzLB80IQ0=,tag:n64SpL6qM/IT9D7t85/Lvg==,type:str]
    volumePermissions:
        enabled: true
    primary:
@@ -63,7 +63,6 @@ postgresql-ha:
 persistence:
    enabled: true
    subPath: data
-    size: 30Gi
 extraVolumes:
    - name: git
      nfs:
@@ -77,8 +76,8 @@ gitea:
    oauth:
        - name: Authentik
          provider: openidConnect
-          key: ENC[AES256_GCM,data:F0AGCSAkU2ZWmS4jniL8k32ABwrjtURAPLa3RKOCpJoaMkKRlRrqwA==,iv:vQcD73C3itBqKFEiv8PhLD2G3exC0zc2NDE3LGYpvXA=,tag:24nO98pP7a00sTBDWEMsBA==,type:str]
-          secret: ENC[AES256_GCM,data:0/6XDvRXUnQXrJzivtDS6b+mmYjtOVcHhGmQJPFG1zDyO9BksHKau0D+hIsfM85761U7LAISct0HungGNeOQOULnmvVT8hEIgC21RHjArXztJY2964NS5XXfURc7pVxOJ7LSDFFd4azExwhrTktqmerG+F6SI5V/oq2iYYqJA7o=,iv:ShYcIgyccHvEFhVn++gBR7gmMOEKcBz9sj/Y+4pk/Hc=,tag:SkFM2d06O/zhpfVji4QDKA==,type:str]
+          key: ENC[AES256_GCM,data:9UuG23PYFiWrQKJX5xGxMgyWKLPFCxKjDUYJd59rMWcdAw619/v/Bw==,iv:AfHV1MzbYi5Z5Bb63/51Hmy9rM247b4quwKCzo7MpYw=,tag:pfpz7hhZyIUjIGGcxZVx/w==,type:str]
+          secret: ENC[AES256_GCM,data:PKFx/LhjwWJluC6/RHc1eMgw4TZXkXymNCrc7TQU6Bp5rGKHMvACC+G+MjXGylIMZVt65LHWq5YEHJNjO8HMsa4ejGukXDuU9sCgKaOOniCs3EQivfVsCCHtF/G48eULPkege7JRzTbmJSYJDnscsSikwvUDChy+zGlC2ZmBZjk=,iv:qsIaaeXepJ9ECilo+05+A0i2joxV0svBOjgL37DkimE=,tag:/3Xer7Yb6QyUtmPIOvSLQQ==,type:str]
          autoDiscoverUrl: https://authentik.vhaudiquet.fr/application/o/gitea/.well-known/openid-configuration
    config:
        APP_NAME: Gitea
@@ -104,39 +103,37 @@ gitea:
        indexer:
            ISSUE_INDEXER_TYPE: bleve
            REPO_INDEXER_ENABLED: true
-# Resource limits for Gitea container. Sized to receive a full linux
-# kernel tree: index-pack on ~12M objects needs several GiB and more
-# than half a core (the 1Gi limit OOMKilled the pod mid push).
+# Resource limits for Gitea container
 resources:
    requests:
+        cpu: 100m
+        memory: 512Mi
+    limits:
        cpu: 500m
        memory: 1Gi
-    limits:
-        cpu: "4"
-        memory: 6Gi
 replicaCount: 1
 sops:
-    lastmodified: "2026-09-30T21:03:47Z"
-    mac: ENC[AES256_GCM,data:eHMr2BqfWNI32S14XEivXtXSIRiCBCAQz06mwtbNyXc1dI6YgF4pKdyIbfRWQW0ZYcbvqKxtyugao+lhc24Ds/GgIbdwchlMyz/DyuOQtM5GMHcSoInQUQVGzrM8hSyztKzq10bH0DmKvT68+uaVx0hf6rzxEqLRb3GAk4q3310=,iv:5kJ6bYE/54EbDWctSXBcVTjJtc/J3mV664tFD1WTK90=,tag:AAbHK3njH0PCqw9yjSWevQ==,type:str]
+    lastmodified: "2026-09-09T21:39:30Z"
+    mac: ENC[AES256_GCM,data:ACBKJLGUfWw9T3fOhQMT251gcLzG3bUXjUqBxG1DuPl8c8bblaIpLOu0QsrfQziQY3jM0DFJ2W/I2vjkrhCuCaZhZCtRg2nzUk+7HelqjEdKLphSuIdlHIkz7Icu+khShrwTgmQiE00Gg1WUsLRkKBgNsOm3TMK4wB874iBvSYY=,iv:Idp0+UBXaRFkpOFKFoRrLKuN1mOmfM7pukC22KkNiCU=,tag:fL9DzAo8FSx4PblVlTHtaQ==,type:str]
    pgp:
-        - created_at: "2026-09-30T21:03:47Z"
+        - created_at: "2026-09-09T21:39:30Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQIMA7uy4qQr71wiAQ//Vf2Rdp8NG4AsbIIOiXabY3AzLyVbE9Pn52+FBF+NIfkS
-            XDqlgvMAWHtmV2LzvJPwPIUjCZkoRwmDsh9zi+W1XzHh9kKxzwvIxfjiqm8fwJh8
-            gb4a/y5mkkEqs+H0zE1H4D91dPbfOmDABJKaePmWTB+tc48bY6qX+LYs7hkPwsHU
-            sN64cidbIbzBoq0t1TWZFkl6MZYWX9IyqJE1XcqYDAvwxlJ4JMJH2pGQlY8+7U96
-            YQgbXhuAik5IzNQlmdpq0mt0j3KZgM7KbLJ2en6JAiO0EhD3xKbFnC0bPniUEX2c
-            Yv6Z/1NrmNImCwbOkrNF9sqto4d9VHFDH8udSHKCXcSbzJmkfF4XUOBuNxtprmQV
-            Wlcw5ZMFpnOgRn+V2gb0Cd3cm5rje0QAYCgIGUfduvMm9BReAQTvpUdKkqKs0mLr
-            XiRAG0HfjjGNcVqWA0H0L5UxlVwHJh6zSNHDzTPVlGenVcQSpiUORKxZqANpQchW
-            /wtFghatZFKbbzEz6Mo5C3hMKOXjl/VNWsmva8BoloDKPm9pWH5S4x0ExYiOWSOk
-            Yk9j+twTgJXMeptO55qMCJKl6CcRsbgVr5yJJXWC6I3tr2ssx1BnSAPYDviuhsC1
-            YAbgFlvdzE6n8FmTixVwzVZrTbZV7alz9PECViMP5evAphe3n1MvnLEvMM0WOm/S
-            XgG0Ty4hQ9ZD7gzhIrh06xVuh+MC/PaMYIZ7LBVHgQy8xbAgQH0qXkF39/9rCIws
-            A/D0FN29uXvfSWzlgSrGOj218eKHX9g+nZGIAHeejd/FJVnOKQpUboUlg/x3jqQ=
-            =943y
+            hQIMA7uy4qQr71wiAQ/+PK0/kUHlc+exa8slolUeTGjHzd/R1Dtux/+HJdC9Vpow
+            ImAQvIdkEjwL0FmoA7Z4val/Wzx/YzFJ5r6sADNaQ9EG7QO+I8WY3VrKj5aRi0Qz
+            +FgHAgng+wdRCCBoxv9Z+MTPSl4TwrKsbrulHAg7EayDKxwGzkyMrnxvukRqD8GB
+            iMQCUadudR458fzB04dkhljAbl/FqX5ppflzEoGVCiRSBcWNkaHgyYqopYGzMASy
+            KTzoV01adnOZY+xeZa5GasgCEbCU3BDesD9vBb+sFsRugVuRHzdyqp3nVBwudpeh
+            OcE9MOMyBN1SAdx9RCsB8aHWYndF1dim84ZWgQThkLlA+7CWJt/NyFYwmMdqqzSv
+            C7slojC6B8bb3863c5w3qe9TPPBwyTOcuNTMunr6wXidlPZWtsImhu/RX9fqzFjZ
+            9X1+wAjAfs7AASeNJLFYqiPrknSAA3JumQZtrFC5dejpTj9H2ns6DkiHSZy8FA8O
+            RuZ8hv/L8L8oilbubKnKFZLhR8lh8A1jXHUxzaEC/L4o4cd7/3TlEms/51yM9qYx
+            WJOz4H8lbphDYO4tFgsGAhL/yHbLHvww/X1hNldwI7mqYrFLSjIwxW2Oxo8c+QB6
+            yZ3VxTXuS9jEVpGTVhIOfepwS8rJQbTUeewqok3riw9GpSEFpOMWsBxlT6+HI8zS
+            XgHPVohxe93kk51O7WjBgq8PAwG7DtWrygqWYORz+pTYN8wTtC4pfotiJZ7hv7Gv
+            NICEZlirrTUdIol8jyM+yRv1gWuYwQJpjnrQVY2AoAQX6ta5/3st24cyuGwGHO0=
+            =Q6Pu
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
@@ -1,13 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: pkgatlas
-resources:
-  - namespace.yaml
-  - repository.yaml
-  - release.yaml
-secretGenerator:
-  - name: pkgatlas-values
-    files:
-      - values.yaml=values.yaml
-configurations:
-  - kustomizeconfig.yaml
@@ -1,6 +0,0 @@
-nameReference:
- kind: Secret
-  version: v1
-  fieldSpecs:
-  - path: spec/valuesFrom/name
-    kind: HelmRelease
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-    name: pkgatlas
@@ -1,22 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-    name: pkgatlas
-    namespace: pkgatlas
-spec:
-    interval: 1m
-    chart:
-        spec:
-            sourceRef:
-                kind: HelmRepository
-                name: pkgatlas
-                namespace: pkgatlas
-            chart: pkgatlas
-            # CI publishes a timestamped version on every main push and
-            # stamps appVersion with the commit SHA of the image it
-            # builds; this range always picks the latest one.
-            version: '>=0.4.0-0'
-            interval: 1m
-    valuesFrom:
-        - kind: Secret
-          name: pkgatlas-values
@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-    name: pkgatlas
-    namespace: pkgatlas
-spec:
-    interval: 1m
-    url: https://git.vhaudiquet.fr/api/packages/vhaudiquet/helm
@@ -1,47 +0,0 @@
-# Chart: https://git.vhaudiquet.fr/vhaudiquet/pkgatlas (chart/pkgatlas).
-# The image ships both binaries (build + serve) and runs as nonroot
-# (uid 65532, distroless). Everything else is chart default: discovery
-# first — build.enabled=false, the first refresh pass builds the whole
-# live rotation and /v1/readyz stays 503 until it lands; weekly
-# refresh after that.
-image:
-    repository: git.vhaudiquet.fr/vhaudiquet/pkgatlas
-ingress:
-    enabled: true
-    className: traefik
-    hosts:
-        - host: pkgatlas.vhaudiquet.fr
-          paths:
-            - path: /
-              pathType: Prefix
-    # TLS terminates at Caddy with the *.vhaudiquet.fr wildcard cert;
-    # Caddy proxies to Traefik by host, so no tls block here (same as
-    # gitea's ingress).
-    tls: []
-sops:
-    lastmodified: "2026-09-24T19:57:42Z"
-    mac: ENC[AES256_GCM,data:cidn6U0EFjuEx98GA8Jlppg3GobcGGrhs20dPoAnUXdpFogfsp3YOTPCKuKi0LrOw/fxBP84U4drx5lJcjL11Ft/Ozn6Z8tk3l8cdqK+BUm6yijtQ0PXHjPUJYNIeqxrQKJzFlVHS+tOARbhQ3DjoNt71WBMfSPUDcPxrbnwVAA=,iv:Yz85yh9jrLXf6DKeVmOLeiVCWcthKCPGCJJwR3RVikg=,tag:7Mdv4VZUpsjuysitx4b2DA==,type:str]
-    pgp:
-        - created_at: "2026-09-24T19:57:42Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ/+N+gGPOCbuxleT6xx0FduVN1vspYJlCyrtLsy632Yz17x
-            ucwqSuGciqUf2kF3GwnOzINEY0eLskbKHMX5wkbJg8+X6dXoRyiseX3fdNrpvMGR
-            P1ZC/C4O6BzQoPJOXDQZHuWPI0Imx61PlzDPzsJ44JBvwrkCKgoaWOvzMyTjZHiC
-            iplyHpzDR2sqfMe29aQICrEV6Z87eMWQ3wie6CzX2OYTj89BejsN2Ibg4n5cqdNO
-            c+mM7Ek2nSWMWYGbdL0W2N6WSIbGuQj/aVbS0s6585NUPJtmcznB7uosRroqfbd2
-            9SMP1gaUOr+00kykRxKtd/ZoW7S/21kGbZ8FwvtKZFrBwcoUuLehbSGAHRYLo6dI
-            5WGeky65IrvpKen8Q/B6o6EByTONt2h+XiyJyLwDLeFh13/ldkGqa1oW+4BTHuX9
-            2WvLOboHpr4MGQdO53Q8zm8VCGAltusII6ZVaoEyjilqZtC/Aa9XZIT/HshOGTQi
-            4CITE1BfGEApOcBbBQKdjYofdWcyuLSF/ertXvcvNiCoVe0wYiHSYUht+HulQ3t+
-            Z0K7C2sJ2bx8C+316b2MzCGVrVOuqDABpQJjIr4aiRG9v8BtYTaUc425CLm9TMtA
-            PmZR1Rqowy4ECekrbvk3lNjPoq13HLSqkm2ppL9WFub5zY2XY0npprSeUknTmSDS
-            XgGFDhcroUq0vTUlJbC015kpa6cpynwTmMuQrFaMPeKeBPkL4Le6QFJMjpIi3yg3
-            65bSBv5t7YXoHFJWVFYej005Lz1lxp1VtaMiA0bnKEnyh/SbfcUqD4d9P1WNx+4=
-            =ulvs
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
-    mac_only_encrypted: true
-    version: 3.10.2
@@ -79,131 +79,3 @@ spec:
    - buildpath.win
  duration: 2160h # 90 days
  renewBefore: 360h # 15 days before expiry
---
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: saggar-dev
-  namespace: caddy
-spec:
-  secretName: saggar-dev-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: saggar.dev
-  dnsNames:
-    - saggar.dev
-  duration: 2160h # 90 days
-  renewBefore: 360h # 15 days before expiry
---
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: api-saggar-dev
-  namespace: caddy
-spec:
-  secretName: api-saggar-dev-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: api.saggar.dev
-  dnsNames:
-    - api.saggar.dev
-  duration: 2160h # 90 days
-  renewBefore: 360h # 15 days before expiry
---
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: docs-saggar-dev
-  namespace: caddy
-spec:
-  secretName: docs-saggar-dev-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: docs.saggar.dev
-  dnsNames:
-    - docs.saggar.dev
-  duration: 2160h # 90 days
-  renewBefore: 360h # 15 days before expiry
---
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: get-saggar-dev
-  namespace: caddy
-spec:
-  secretName: get-saggar-dev-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: get.saggar.dev
-  dnsNames:
-    - get.saggar.dev
-  duration: 2160h # 90 days
-  renewBefore: 360h # 15 days before expiry
---
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: rhema-rs
-  namespace: caddy
-spec:
-  secretName: rhema-rs-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: rhema.rs
-  dnsNames:
-    - rhema.rs
-  duration: 2160h # 90 days
-  renewBefore: 360h # 15 days before expiry
---
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: s3-rhema-rs
-  namespace: caddy
-spec:
-  secretName: s3-rhema-rs-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: s3.rhema.rs
-  dnsNames:
-    - s3.rhema.rs
-  duration: 2160h # 90 days
-  renewBefore: 360h # 15 days before expiry
---
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: www-rhema-rs
-  namespace: caddy
-spec:
-  secretName: www-rhema-rs-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: www.rhema.rs
-  dnsNames:
-    - www.rhema.rs
-  duration: 2160h # 90 days
-  renewBefore: 360h # 15 days before expiry
---
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: get-rhema-rs
-  namespace: caddy
-spec:
-  secretName: get-rhema-rs-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: get.rhema.rs
-  dnsNames:
-    - get.rhema.rs
-  duration: 2160h # 90 days
-  renewBefore: 360h # 15 days before expiry
@@ -40,8 +40,6 @@ data:

        @umami       host umami.vhaudiquet.fr

-        @pkgatlas    host pkgatlas.vhaudiquet.fr
-
        handle @authentik {
            reverse_proxy traefik.traefik.svc.cluster.local.:80
        }
@@ -72,9 +70,6 @@ data:
        handle @umami {
            reverse_proxy traefik.traefik.svc.cluster.local.:80
        }
-        handle @pkgatlas {
-            reverse_proxy traefik.traefik.svc.cluster.local.:80
-        }

        # Docker VM services (via Docker Traefik)
        @alexscript     host alexscript.vhaudiquet.fr
@@ -107,43 +102,3 @@ data:
      tls /etc/caddy/certs/buildpath-win/tls.crt /etc/caddy/certs/buildpath-win/tls.key
      reverse_proxy traefik.traefik.svc.cluster.local.:80
    }
-
-    saggar.dev {
-      tls /etc/caddy/certs/saggar-dev/tls.crt /etc/caddy/certs/saggar-dev/tls.key
-      reverse_proxy traefik.traefik.svc.cluster.local.:80
-    }
-
-    api.saggar.dev {
-      tls /etc/caddy/certs/api-saggar-dev/tls.crt /etc/caddy/certs/api-saggar-dev/tls.key
-      reverse_proxy traefik.traefik.svc.cluster.local.:80
-    }
-
-    docs.saggar.dev {
-      tls /etc/caddy/certs/docs-saggar-dev/tls.crt /etc/caddy/certs/docs-saggar-dev/tls.key
-      reverse_proxy traefik.traefik.svc.cluster.local.:80
-    }
-
-    get.saggar.dev {
-      tls /etc/caddy/certs/get-saggar-dev/tls.crt /etc/caddy/certs/get-saggar-dev/tls.key
-      reverse_proxy traefik.traefik.svc.cluster.local.:80
-    }
-
-    rhema.rs {
-      tls /etc/caddy/certs/rhema-rs/tls.crt /etc/caddy/certs/rhema-rs/tls.key
-      reverse_proxy traefik.traefik.svc.cluster.local.:80
-    }
-
-    www.rhema.rs {
-      tls /etc/caddy/certs/www-rhema-rs/tls.crt /etc/caddy/certs/www-rhema-rs/tls.key
-      reverse_proxy traefik.traefik.svc.cluster.local.:80
-    }
-
-    get.rhema.rs {
-      tls /etc/caddy/certs/get-rhema-rs/tls.crt /etc/caddy/certs/get-rhema-rs/tls.key
-      reverse_proxy traefik.traefik.svc.cluster.local.:80
-    }
-
-    s3.rhema.rs {
-      tls /etc/caddy/certs/s3-rhema-rs/tls.crt /etc/caddy/certs/s3-rhema-rs/tls.key
-      reverse_proxy traefik.traefik.svc.cluster.local.:80
-    }
@@ -10,7 +10,7 @@ image:
    repository: caddy
    pullPolicy: IfNotPresent
    tagSuffix: ""
-    tag: 2.11.7
+    tag: 2.11.4
 service:
    type: LoadBalancer
    # Cluster (not Local) so any node can forward to pods on any other node.
@@ -36,61 +36,25 @@ health:
 volumes:
    - name: vhaudiquet-fr-tls
      secret:
-        secretName: vhaudiquet-fr-tls
-        optional: true
+        secretName: ENC[AES256_GCM,data:HYQb37rKxMqxFTsCz5kw6qY=,iv:dI9uqUVLLqPv3a5vwz1vowTvO9WduQaXqj7XZREd7oA=,tag:mz257AC3pvubgzOMxbHfrg==,type:str]
+        optional: ENC[AES256_GCM,data:k9FVxw==,iv:XMAGop2PvSGD1R1cy6qqE39bsIAOFIqGzTnwDmYRhHM=,tag:7zZAwSzRWWiT9Y2iMWkI6w==,type:bool]
    - name: wildcard-vhaudiquet-fr-tls
      secret:
-        secretName: wildcard-vhaudiquet-fr-tls
-        optional: true
+        secretName: ENC[AES256_GCM,data:2OUkq/AMuv2wQyIlLPS3bSRrnV1mvDR6vd0=,iv:1e9HC8FFC4vo7GjCnJyNjF05R+Js41ONy2in5a+/doI=,tag:icKdtLhvQ40YI+KCE+6fXg==,type:str]
+        optional: ENC[AES256_GCM,data:b+zvMw==,iv:QyU+T1BGZenO/nO8wq6R+KkrT/I6ZXIIhAnf5npFhvw=,tag:4UPyop81BQu4zxhZmK2n+Q==,type:bool]
    # semery.fr certs from cert-manager (OVH DNS-01)
    - name: semery-fr-tls
      secret:
-        secretName: semery-fr-tls
-        optional: true
+        secretName: ENC[AES256_GCM,data:cLzhXgUhrwgIMACU1Q==,iv:DJ+6mjtjYmWxNcHl1gzeoifpcFCJsXiOXeyxEWnRU3g=,tag:7yc2bt6fBWwBuefPY48xyA==,type:str]
+        optional: ENC[AES256_GCM,data:DTfxaQ==,iv:K7TJjSI/vF3x34SWmwmivYo+mSsUAg9nB94Ui85nHCI=,tag:1/JRBMlb07+aHKEulIYpQQ==,type:bool]
    - name: wildcard-semery-fr-tls
      secret:
-        secretName: wildcard-semery-fr-tls
-        optional: true
+        secretName: ENC[AES256_GCM,data:Qq+ybi1kSVdVn9RP/kTkTcw0lkao3Q==,iv:vFmV3YvSNhLizgJVBnq1ZERqDP70onuZDvy/I3joPtI=,tag:AiEW+yh51Dexz3Vha4MPgg==,type:str]
+        optional: ENC[AES256_GCM,data:0o4ODw==,iv:VwnCs2C1MVUJEfBvNJT1rkDV7m60sNZPdtERo9wWPJk=,tag:oo+liLatrjqEtlrKQyjhyg==,type:bool]
    - name: buildpath-win-tls
      secret:
-        secretName: buildpath-win-tls
-        optional: true
-    # saggar.dev cert from cert-manager (Porkbun DNS-01)
-    - name: saggar-dev-tls
-      secret:
-        secretName: saggar-dev-tls
-        optional: true
-    - name: api-saggar-dev-tls
-      secret:
-        secretName: api-saggar-dev-tls
-        optional: true
-    # docs.saggar.dev cert — the saggar book (static nginx)
-    - name: docs-saggar-dev-tls
-      secret:
-        secretName: docs-saggar-dev-tls
-        optional: true
-    # get.saggar.dev cert — the saggar distribution host (garage web)
-    - name: get-saggar-dev-tls
-      secret:
-        secretName: get-saggar-dev-tls
-        optional: true
-    # rhema.rs certs from cert-manager (Cloudflare DNS-01)
-    - name: rhema-rs-tls
-      secret:
-        secretName: rhema-rs-tls
-        optional: true
-    - name: www-rhema-rs-tls
-      secret:
-        secretName: www-rhema-rs-tls
-        optional: true
-    - name: get-rhema-rs-tls
-      secret:
-        secretName: get-rhema-rs-tls
-        optional: true
-    - name: s3-rhema-rs-tls
-      secret:
-        secretName: s3-rhema-rs-tls
-        optional: true
+        secretName: ENC[AES256_GCM,data:SejgJvZY/B7DDgf3YJcxcFA=,iv:bDZWhie17exL+9r9A7Ea/a8Rgpex7nuabVtW60LotJQ=,tag:WxqFbzulxxPgsynqfo5hzQ==,type:str]
+        optional: ENC[AES256_GCM,data:nBNRkw==,iv:JEvsFzMli7AzUj6GXJlHXOnANm45gnFE/kXrSbBotPQ=,tag:Puss6mCkoC7SGCb86guI2w==,type:bool]
    - name: routes
      configMap:
        name: caddy-routes
@@ -111,30 +75,6 @@ volumeMounts:
    - name: buildpath-win-tls
      mountPath: /etc/caddy/certs/buildpath-win
      readOnly: true
-    - name: saggar-dev-tls
-      mountPath: /etc/caddy/certs/saggar-dev
-      readOnly: true
-    - name: api-saggar-dev-tls
-      mountPath: /etc/caddy/certs/api-saggar-dev
-      readOnly: true
-    - name: docs-saggar-dev-tls
-      mountPath: /etc/caddy/certs/docs-saggar-dev
-      readOnly: true
-    - name: get-saggar-dev-tls
-      mountPath: /etc/caddy/certs/get-saggar-dev
-      readOnly: true
-    - name: rhema-rs-tls
-      mountPath: /etc/caddy/certs/rhema-rs
-      readOnly: true
-    - name: www-rhema-rs-tls
-      mountPath: /etc/caddy/certs/www-rhema-rs
-      readOnly: true
-    - name: get-rhema-rs-tls
-      mountPath: /etc/caddy/certs/get-rhema-rs
-      readOnly: true
-    - name: s3-rhema-rs-tls
-      mountPath: /etc/caddy/certs/s3-rhema-rs
-      readOnly: true
    - name: routes
      mountPath: /etc/caddy/routes
      readOnly: true
@@ -159,7 +99,7 @@ affinity:
            - weight: 100
              preference:
                matchExpressions:
-                    - key: ENC[AES256_GCM,data:AsOdq9OGQbAGV42W4d22EGVMi5E=,iv:U3sLu8pI7fqOPbvpfpVz21cUfwovKRFi8jY6laTyStY=,tag:EQVSFAzTYw2En2xdGTCF3Q==,type:str]
+                    - key: ENC[AES256_GCM,data:oCV218wXg+k2L/edhWv6qpiyiaY=,iv:Y+O2of2NCOvcjSwr0EenGns0BtpT+P6pjCzEZUIMpm0=,tag:kY/WyHJ4Jr5ZLMe6ZcT/Tw==,type:str]
                      operator: NotIn
                      values:
                        - "true"
@@ -173,36 +113,37 @@ affinity:
                topologyKey: kubernetes.io/hostname
 tolerations:
    # Tolerate the failover taint so caddy CAN schedule on p330 (small-node-1).
-    - key: ENC[AES256_GCM,data:s3X0PmRJCCVh,iv:UYZl3EsmdSTdF9NoYsL+zbxLlkfO2GU80Sy3CpSXMBY=,tag:35UtC37ldCItR9fAtSXVVw==,type:str]
+    - key: ENC[AES256_GCM,data:K6vJkO2dpKRi,iv:b7NIPKTMYOxNao6KcSJUhsxKNRJ2J3ksEtmXkI8b0So=,tag:pMRmz17upWMTEZjwBRNyZQ==,type:str]
      operator: Equal
-      value: failover
+      value: ENC[AES256_GCM,data:4ULPtEoUhgs=,iv:ikqWRqRR9ki35QQ6VnMEzOgT0/e+5DggGP8w60BhW/Q=,tag:MW9lX8miIWb9nnbc0woZTg==,type:str]
      effect: NoSchedule
-    - key: ENC[AES256_GCM,data:NYCyZsj7wMxKUjaDu+rUOQYxDKvvEwSWuDAxQkSGTczXyApCbw==,iv:3AcvLXryeZ6dfmqanFpGOgEf1nGuEVbvUmZzruxzL98=,tag:Daa9AgXQZkkr7RIzljWOeQ==,type:str]
+    - key: ENC[AES256_GCM,data:l7abu6ywKFevJdJod2Af2bj7XSfBJATL7UnfiUHrRJoCjBsl9A==,iv:xnUvzVX8z4doC+mQs1r0rNCSqaZ8KlXxr5Ee9FOFPjI=,tag:mnqCx9NSMSyeYwz57QFQIQ==,type:str]
      operator: Exists
      effect: NoSchedule
 sops:
-    lastmodified: "2026-10-16T07:06:11Z"
-    mac: ENC[AES256_GCM,data:kMIxep2WVIr8/uAiw12T1JXMbtpyijo1c1MOOUKuok2Z1zSrnFZovgIup3u8/2BhqJ2UUDm5hFJi41Tsq45ba5ELs4PX1whi6EXlHQJxNo7ScfepEi10es/wa+p+3w9V8Yv9cklIWk14zh0UABs8jRzOJXhn5XI3O644CJSULQA=,iv:3ssxqRNRvXbmn0HiQFdwoGVbsnzvtQxfpHPIUpplMK8=,tag:5VRyB/Hh4tZUWp6KCPNSQg==,type:str]
+    lastmodified: "2026-08-26T19:28:03Z"
+    mac: ENC[AES256_GCM,data:gn90e5Gjq5/CraT7Cl43DVMIQukD798faKGbVO5IJlbpAuTwDrhvqnnojFq4R7LEEETtedpR3MRyqcnbfSWVruHoysebycL7EZJkiy7H36JmzQAOWKusshMF9kOyZIV6+AFfz8As/Mu4pF1p5+3jmgy6oOJn7Ewm0C930Gpa3gs=,iv:cf1UC/2NGBHtQgx6h8vRpMjeJRaAvG7ZznhErn2b+cE=,tag:3Ule+pq7pZHWA7NqhlgfPg==,type:str]
    pgp:
-        - created_at: "2026-10-16T07:06:11Z"
+        - created_at: "2026-08-26T19:28:03Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQIMA7uy4qQr71wiARAAuN5nBauJiH5bFx80iF2W2XJDwMCFG+SPlqv2ErxVaYkD
-            kSt8pA0o4Bzqr6gP6cEgEhzQHAVVvsvTZJTY5lX6KWNRxhz/RXDhxAi9xdBHQ81f
-            dDWn7pgD8sv8cODM39yeukhGlHxZuk7FiUJ4fBnouojWUCxf2Ib5m5TEaWwmmv5n
-            EBBjjcbGZzyWBzCkLbEY/ML1FIx5j/jyZjpjMp2En1309ljIBckjLk5s9Kntp6oJ
-            /TkW/BhU96y8fyGM6u3FV54wORNlCT3P5cDT4rsQd+KgG0DDchAdUSb7hmBEn+iC
-            W/eUsp7nhObkZZBjTKYeS502Q+3RUEXoLnVLWougDxMSA1rJNS3nkgzK1cmKs97/
-            Ghnb5TUGPmoQMUltQzxInDq1mgeGfuFUffprYprYKGeVC/oQ6uPHE4jVZImlWRjv
-            w6YPHv/2XhWMN5vH/ybsrqxcFb5+1z8u8J58GAJ37hDXzkL8ENJUouonM3sywaBc
-            VbXHzJwYEuLhRfNpay6ovwPkhU25gV3atBiXloIWc0PivPjOAJqqs0vkMgRiA+3R
-            yUagVKdyavVUhqou2LOxSGSv77uFPWZwhqUILtqzTeSE6GHUxVqKQPa91klRRNI7
-            YWNtM7ZqSeANK99h5vgphhPZpuKkIzXHSLEXdplxvaRERfWMU3UGCDZOMVcDMlbS
-            XgGovkHZ9+NKVgZVpsRyQQutbSJqvHVZJx162gu3UKC1IgnDnhslOGKVWw/oKNb5
-            KyPf0CLk9BCAlSngr5D5pw4GJ9eq7RNFOqC32LPwXgNSD1AfLFHYGWh3RZM+81w=
-            =eA3w
+            hQIMA7uy4qQr71wiAQ/9FKZhqwE2RZcfsIeMOtAkOTf/4aEbrSzsHbEO8DP8V3Ct
+            rQBu/v8y1Hcu3fVU/OjVk/7QbEBjPNu1AJST55DBIWktnYUgSo4fIujvG54/hqwM
+            9u0iuA1EcqVzGDa+vLSqgmi4Oxbujs0Ytn7uQrefqkdAOjltKqvknebI9EBdSRUi
+            GjVFwysR6jHmIVf9S64vu4VsjfC7ju9MBYZniaKsJ1GOBhIjUZ6ogkYs5S2E5PJ/
+            zE8cn79x61YLX74H+BAqnFcxbprtsCwMJPgyerfgijV6d+JpwT/6mp1VUrLe9Zz7
+            WEd/lVMlIcwnYCtIDAvuURvMP2OebWplr95d5V1Vb5Yywnl3M0pwkqL4dRiJISvk
+            N2rBQYvDfXBtJA7yTAkJ3PymrECKoFs6nspEBie/kDJmdRGv8s2aajzTTQ1qLAkP
+            FeJe0TcowjCCWMxk4W5DEoCh+PUA1HVo+/KmHjnIVgzdgxaeqT90VXwN8H7MPPeu
+            LKE01+Guue821h7GykkIhe9sf3nMGbI5rOiCcsVtgu5bODkRk8jXpXh1qdRAliuq
+            uddjy1mWEfdUHNBj8YxvZ8WOU7h9FyZjsYZB96n9du1vqcuuP5eTJDVuvjjtDuTK
+            fbXYQbxwA5j4akyI4AKJYLA0Y/lcSXc84r6q8IA52nZz6uQZExbkoc7PPX7Q/ufS
+            XgE0CWRS+0tk2oVANMVU31UrCvitttezjR6sUSAINh122a5kcmOfJzLlB2OqVKc5
+            wMAyvOYccrQMrPDX1WJE7agDOaqGUQcwuFnvqpHhe8q9Yg1uOUU4sK1R8A1Qs0Q=
+            =wlYf
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(data|stringData|.*key|.*crt)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
    version: 3.10.2
@@ -22,7 +22,6 @@ spec:
          dnsZones:
            - vhaudiquet.fr
            - buildpath.win
-            - rhema.rs
      # OVH solver for semery.fr (via cert-manager-webhook-ovh)
      - dns01:
          webhook:
@@ -43,18 +42,3 @@ spec:
        selector:
          dnsZones:
            - semery.fr
-      # Porkbun solver for saggar.dev (via cert-manager-webhook-porkbun)
-      - dns01:
-          webhook:
-            groupName: acme.saggar.dev
-            solverName: porkbun
-            config:
-              apiKey:
-                name: porkbun-api-credentials
-                key: api-key
-              secretApiKey:
-                name: porkbun-api-credentials
-                key: secret-key
-        selector:
-          dnsZones:
-            - saggar.dev
@@ -5,4 +5,3 @@ resources:
  - clusterissuer.yaml
  - ovh-credentials-secret.yaml
  - ovh-secret-reader-rbac.yaml
-  - porkbun-api-credentials-secret.yaml
@@ -1,49 +0,0 @@
-# Porkbun API Credentials for DNS-01 Challenges (saggar.dev)
-#
-# Create an API key at https://porkbun.com/account (API Access section), and
-# enable API access on the domain: Domain Management -> Details -> API Access
-# (disabled per domain by default; the API returns a generic error otherwise).
-#
-# The secret MUST live in the cert-manager namespace: for a ClusterIssuer,
-# cert-manager reads webhook credential secrets from its cluster resource
-# namespace, which the webhook chart's RBAC already covers.
-#
-# SOPS will encrypt the stringData fields on pre-commit.
-apiVersion: v1
-kind: Secret
-metadata:
-    name: porkbun-api-credentials
-    namespace: cert-manager
-    labels:
-        app.kubernetes.io/name: cert-manager-webhook-porkbun
-        app.kubernetes.io/component: porkbun-api-credentials
-type: Opaque
-stringData:
-    api-key: ENC[AES256_GCM,data:OLTDhFnbK70gAsvMR/4iKjKr9ckEkbXhYfG4xgTWP2gjruI9HaNAWzSBJcmDyRXRSz18XnvnSlUy/P5VXG5S6uH84wg=,iv:DrOWWf5h1FLNg+emJ/MMp80k8u+A/2HzC07EmjcWORg=,tag:2ep8o1zmXNPV54Byq2Dl7Q==,type:str]
-    secret-key: ENC[AES256_GCM,data:wtGiMCpU8PqTXvH27l+tUvJLivuK/zZp5KePFSeYfjb3ieFszbnjWFd3xQkgtFM3HrmjhRaGWUEFOIEvgTTMDBDyL+k=,iv:iVxMwt6UtpMAqdZj13YUzr3/gDUVTJecyc4ptYvHyNo=,tag:R/tn/BrARGvXjL1EIHBCRQ==,type:str]
-sops:
-    lastmodified: "2026-09-27T23:12:14Z"
-    mac: ENC[AES256_GCM,data:XWzKEL3qi4/KoKUZm1uEfj6GNW3ZLq71PDEyo7w2fHHmkgFMW/xwwXoBLRYFWVx3RvT82NwOCld/Savbs0qXY+Ws1AsgjklEim7MRyIjOKTT8Jkuh39WNCc+8C13yAHSrfPa3tEs10a8lk4nOaFxVn87zAnfnEt6LGt41+/HDxI=,iv:TxW4wJSqHVB9VH9pn/9lYsg8Og3JHTKRPHOrSjeAvuw=,tag:eKZkHptFhE95bPeNegTx8g==,type:str]
-    pgp:
-        - created_at: "2026-09-27T23:12:14Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ/7BAr8vmZ9i0Www7U8EkhPqOi1g0MVD8tVyhnTptBbS4MG
-            irer3UAy7ktovNUso1/wljKif/b2Q8EK6Sawgv4Sv2jN8ShWewginRQ7DeRGtwNE
-            TkNnnZoIMQmKwUZq0NnTmStg0wY/bRDYrovGhvPO8F/ZebU/cEXRFdHDzsKsTo6p
-            9LOu8DnTj9CwvhBLCyzqCeMwvL7DZryXuTS+aEVnrS0J4OUydK4VKYsvwXVsF6XT
-            4Jkpcf4yAiwxBsnZiszvL+L1BPzku1peU/p/d1fciVq54TmgrRwyC7GrlCLm/f09
-            xEPLnBMtmp1w5M2aONEYXXrk5fMWLIuSU7SmFzWduwLAMPTfHvGbpIS4U8eMCuIy
-            THKmeuyPL4/BW+PIc/L/UucOF0pjPDAPsdw3dEkB0+MlX3YDuTc37PpiX3pMRy1C
-            kxhwRVNPZqWMjkrAqg0BR9ZHEOQiv+HwHXZNG5CSHaYYC/mJUSVGaL7R0yOP3nIy
-            cWDA6Pyk5XWLspVh534xQODm1oArMdZ+xnD6NUqt+Bv6facrZkmT6r66LnCLb9fQ
-            rTS1aDm4gxuG5SX7lafDWL9Rh+z2DgFDde9cEAJZiBna4lTE7tJFPHF4OolqzrnN
-            MEhN8no5bLcMv1knE2nKkeKmOoXEKQ80mwgcVkdiRtQf2eZWAXAmpkGehuW/nIHS
-            XAHZXogqlqxbGDtIe2dM0qun1OA0HxsGw5J2EcFUt53wSg/YaZdEPN6aARPdRi8P
-            qGCEhZ43OokTCffCzf2Z52f7nx2NHIOoV3O3+80g6jw/Lrfe8WsZZZyXgjqm
-            =AViA
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(data|stringData|.*key|.*crt)$
-    version: 3.10.2
@@ -12,7 +12,7 @@ spec:
        name: cert-manager-webhook-ovh
        namespace: cert-manager
      chart: cert-manager-webhook-ovh
-      version: "0.9.18"
+      version: "0.9.16"
      interval: 1m
  valuesFrom:
    - kind: Secret
@@ -1,12 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: cert-manager
-resources:
-  - repository.yaml
-  - release.yaml
-secretGenerator:
-  - name: cert-manager-webhook-porkbun-values
-    files:
-      - values.yaml=values.yaml
-configurations:
-  - kustomizeconfig.yaml
@@ -1,11 +0,0 @@
-nameReference:
-  - kind: HelmRepository
-    version: v1
-    fieldSpecs:
-      - path: spec/chart/spec/sourceRef/name
-        kind: HelmRelease
-  - kind: Secret
-    version: v1
-    fieldSpecs:
-      - path: spec/valuesFrom/name
-        kind: HelmRelease
@@ -1,19 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: cert-manager-webhook-porkbun
-  namespace: cert-manager
-spec:
-  interval: 1m
-  chart:
-    spec:
-      sourceRef:
-        kind: HelmRepository
-        name: cert-manager-webhook-porkbun
-        namespace: cert-manager
-      chart: cert-manager-webhook-porkbun
-      version: "2.0.7"
-      interval: 1m
-  valuesFrom:
-    - kind: Secret
-      name: cert-manager-webhook-porkbun-values
@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: cert-manager-webhook-porkbun
-  namespace: cert-manager
-spec:
-  interval: 1m
-  url: https://porkbun.octabits.io
@@ -1,49 +0,0 @@
-# cert-manager-webhook-porkbun Values
-# groupName must match the ClusterIssuer webhook stanza
-groupName: acme.saggar.dev
-# cert-manager deployment configuration for RBAC
-# The chart creates RoleBindings so cert-manager's service account can reach
-# the webhook and read the Porkbun credential Secret
-certManager:
-    namespace: cert-manager
-    serviceAccountName: cert-manager
-# Restrict the webhook's Secret read access to the Porkbun credentials only
-rbac:
-    secretAccess:
-        secretNames:
-            - ENC[AES256_GCM,data:WXGjM38wR7oKcvetV91WocOt48njb5Y=,iv:7UEsgh62qq/0fGfmjG96Kko/r2h9IOD7IqRnu7poGFo=,tag:qdb4+n9ZnQidlz5fnHq94g==,type:str]
-# Pod configuration
-replicaCount: 1
-resources:
-    requests:
-        cpu: 10m
-        memory: 32Mi
-    limits:
-        memory: 128Mi
-sops:
-    lastmodified: "2026-09-27T22:55:14Z"
-    mac: ENC[AES256_GCM,data:rSc+2n8PYZLdBJRWB3lgiH40+24/5v0vLRAkHV3vM3IyxZgBrjJxmWjAu5PJWHDobQiw7G7x7ZMotJx6TbJztbnBpB5GmdoFC0kVkxxdE8txCWlmcwed6oktCJQ0nR09DaqTk3OvRZgFsWwkVMhZwCjLS+gZBzTTcw84MKqQcGg=,iv:tJd2rGP0EzrjVSp5ESHf5BnFU7fFjMUgfZTgZeM2yRk=,tag:hxVTpxEjz1naTbrDTQUSYA==,type:str]
-    pgp:
-        - created_at: "2026-09-27T22:55:14Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ/5AVsqIJQvmzAAexGSmYjPrdmX7W7JaVHYpUCFbiU9RP32
-            S1ffbzV+YjmYkrLhnwhosNeheEVbEiWeyrea+B9wlTgUp1R9+oy8ooc30uDr/vhY
-            9K56DoEcUhi95mQD1U7e7LK6qUkMowS0HWXEEOb/r/bvL3lQNmc4rNJ8Dz+MDFh3
-            A59ZkrvspjccrLd9wJUb1QbwLKRw/QpE/bT17nj8bOwcAipdz2Q/GoX0LGp88fgS
-            Yy6G/zwVpY/mDylHZbunDVBEqAziR3TAbQsRQZou2oB69Q0jwVs8//vVhWSpniUr
-            an/XdNaEDR5LFJESJK9Kf3H2Qe/Cq8ynC3NFAwk+tHVLOW8MxQrDUvq3fTQq/Zl+
-            CEzMD7+5bQDLQX82QMZ0TdjcLCIEouqCHo9dnGQGUX7NQd1ePV3xda6750zr1maX
-            PVTmx12nS+fCwo1DVLSTVa907TLg3h/DoADzpzcmhTfE7xO2mNcfN+P1dnHT2+U4
-            FhUXqYgZSkgjlkkpVr8XmZg4Cb98lgpS6hDqXylrXhdsCvGgW9YKg0wdQqb6H4Sr
-            ycBsXmj4/j1EMB9yqfSpO/6NNDjTMms0nWsrGXI7NHpROj+AV7fWXC1yxhw6uTus
-            SYhve/6VvbCb3hw9gHb9lzQ9VvTq/0jOqIMBoLoD1Wd45tHczPx1xbVf3KyB1HTS
-            XgFYYLiLku1Jj87DtdbsAbN0tNQNets9TBVffkawgFNsei/H5ZazKFPOC5NrwnJ1
-            FWLWI1fwFZG18c29b8mrEUKqX8GD+YO0BKwmtL7n9out6YAA+hK780RytQDdD00=
-            =yh2A
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
-    mac_only_encrypted: true
-    version: 3.10.2
@@ -14,7 +14,7 @@ spec:
        name: stalwart-helm
        namespace: stalwart
      chart: stalwart
-      version: "0.7.21"
+      version: "0.7.16"
      interval: 1m
  valuesFrom:
    - kind: Secret
@@ -7,7 +7,7 @@
 # Container image
 image:
    repository: stalwartlabs/stalwart
-    tag: v0.16.25
+    tag: v0.16.20
    pullPolicy: IfNotPresent
 # Single-node RocksDB deployment.
 replicaCount: 1
@@ -9,11 +9,6 @@ ports:
            trustedIPs:
                - 127.0.0.1/32
                - 10.0.0.0/8
-        transport:
-            respondingTimeouts:
-                # v3 default is 60s, counted over the whole request body:
-                # large HTTP git pushes die with a 504 past one minute.
-                readTimeout: 5m
 # Tolerate failover node
 tolerations:
    - key: ENC[AES256_GCM,data:r4uAu1ni9/Z8,iv:aKgn6DgT9XnjzmotnaEIL+WzUiQ34CazfervJwrYsdM=,tag:EeOY1YZwNCOPgHwXpas3ew==,type:str]
@@ -29,15 +29,12 @@ resources:
  - dev/gitea
  - dev/harbor
  - dev/renovate
-  - dev/pkgatlas
  # Home (home automation)
  - home/home-assistant
  - home/zigbee2mqtt
  # Personal (apps storing my own content, grouped by content type)
  - personal/paperless
  - personal/radicale
-  - personal/rhema-claw
-  - personal/syncthing
  - personal/media/photoprism
  - personal/notes/notesnook
  - personal/notes/obsidian-livesync
@@ -47,10 +44,6 @@ resources:
  - utilities/open-webui
  # Production (public-facing websites/apps)
  - production/buildpath
-  - production/saggar
-  - production/get-saggar
-  - production/get-rhema
-  - production/rhema-site
  - production/semery-fr
  - production/umami
  - production/vhaudiquet-fr
@@ -12,7 +12,7 @@ spec:
        name: notesnook
        namespace: notesnook
      chart: notesnook
-      version: '1.0.38'
+      version: '1.0.32'
      interval: 1m
  valuesFrom:
    - kind: Secret
@@ -5,6 +5,5 @@ resources:
  - openclaw-instance.yaml
  - openclaw-secrets.yaml
  - networkpolicy.yaml
-  - networkpolicy-lan-egress.yaml
  - networkpolicy-mail-egress.yaml
  - networkpolicy-radicale-egress.yaml
@@ -1,39 +0,0 @@
-# Supplementary egress policy: the operator's managed default-deny NetworkPolicy
-# only allows DNS (53) and TCP 443 outbound, so any other port toward the local
-# network is dropped. That blocks the OpenClaw pod from reaching LAN services
-# that do not speak HTTPS on 443. Measured from inside the pod against
-# 10.4.1.222, 443 returns RST (admitted, nothing listening) while 7020 times
-# out, which shows LAN routing works and only the port is being refused.
-#
-# The egress rule below sets no `ports`, because the goal is arbitrary LAN
-# services rather than one known port. Cluster CIDRs are excluded so this does
-# not become a blanket "any pod, any port" grant; the LAN is what gets admitted.
-# Note this is additive to the operator's rules, so DNS and 443 everywhere still
-# hold.
-#
-# Written as a sidecar policy rather than via the CR fields
-# spec.security.networkPolicy.additionalEgress / allowedEgressCIDRs, matching
-# the existing networkpolicy-mail-egress / -radicale-egress pattern. Those CR
-# fields DO appear in the 0.39.0 CRD template, contrary to the comments on the
-# sibling policies, so they are worth retrying once the installed CRD version is
-# confirmed. Until then the sidecar route is the one known to take effect.
-apiVersion: networking.k8s.io/v1
-kind: NetworkPolicy
-metadata:
-  name: openclaw-lan-egress
-  namespace: openclaw
-spec:
-  podSelector:
-    matchLabels:
-      app.kubernetes.io/instance: openclaw
-      app.kubernetes.io/name: openclaw
-  policyTypes:
-    - Egress
-  egress:
-    - to:
-        - ipBlock:
-            cidr: 10.0.0.0/8
-            except:
-              # Service CIDR and pod CIDR (infra/kube/talconfig.yaml).
-              - 10.96.0.0/12
-              - 10.244.0.0/16
@@ -12,7 +12,7 @@ spec:
        name: cloudpirates
        namespace: paperless
      chart: postgres
-      version: "0.20.6"
+      version: "0.20.4"
      interval: 1m
  valuesFrom:
    - kind: Secret
@@ -12,7 +12,7 @@ spec:
        name: cloudpirates
        namespace: paperless
      chart: redis
-      version: "0.35.4"
+      version: "0.34.26"
      interval: 1m
  valuesFrom:
    - kind: Secret
@@ -12,7 +12,7 @@ spec:
        name: derwitt
        namespace: radicale
      chart: radicale
-      version: "2.1.4"
+      version: "2.1.0"
      interval: 1m
  valuesFrom:
    - kind: Secret
@@ -1,13 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: rhema-claw
-resources:
-  - namespace.yaml
-  - repository.yaml
-  - release.yaml
-secretGenerator:
-  - name: rhema-claw-values
-    files:
-      - values.yaml=values.yaml
-configurations:
-  - kustomizeconfig.yaml
@@ -1,6 +0,0 @@
-nameReference:
-  - kind: Secret
-    version: v1
-    fieldSpecs:
-      - path: spec/valuesFrom/name
-        kind: HelmRelease
@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: rhema-claw
-  labels:
-    app.kubernetes.io/name: rhema-claw
-    app.kubernetes.io/component: ai-agent
@@ -1,24 +0,0 @@
-# Tracks the rhema-claw chart as CI publishes it on main: the timestamp
-# pre-releases (0.1.0-YYYYMMDD-HHMMSS) all sort above 0.1.0-0, and the
-# chart's appVersion carries the commit SHA the image was tagged with —
-# values.image.tag stays empty to ride it. Same rolling scheme as the
-# saggar release.
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: rhema-claw
-  namespace: rhema-claw
-spec:
-  interval: 1m
-  chart:
-    spec:
-      sourceRef:
-        kind: HelmRepository
-        name: vhaudiquet
-        namespace: rhema-claw
-      chart: rhema-claw
-      version: ">=0.1.0-0"
-      interval: 1m
-  valuesFrom:
-    - kind: Secret
-      name: rhema-claw-values
@@ -1,11 +0,0 @@
-# The vhaudiquet package repository on the home Gitea — where the rhema
-# CI publishes the rhema-claw chart on every main push (base version +
-# timestamp, ordered by SemVer pre-release rules). Public: no auth.
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: vhaudiquet
-  namespace: rhema-claw
-spec:
-  interval: 1m
-  url: https://git.vhaudiquet.fr/api/packages/vhaudiquet/helm
@@ -1,69 +0,0 @@
-# The rhema claw — the resident agent daemon from ../rhema.
-# Single-node by design (one SQLite store, one dispatcher): the chart
-# fails the render past one replica.
-image:
-    repository: git.vhaudiquet.fr/vhaudiquet/rhema-claw
-    # Empty: follows the chart's appVersion — the commit SHA CI stamped on
-    # the pushed images.
-    tag: ""
-# Bearer token for the /v1 routes (/healthz stays open). The daemon
-# shells out through the coding agent, so the surface must not sit open
-# on the LAN. Encrypted at rest: the .sops.yaml creation rule scoped to
-# this file adds `token` to the values encrypted_regex.
-token: ENC[AES256_GCM,data:fZKJzLy8FjN+0ONrHn40Tgb1/uTtYdAWTJwY7BfFltsGCPnuMx1F8KIPfQbzliyH,iv:yzaHrdDrSBbnT01aJmv8537D1lVe4kwIDINiuOgXPKU=,tag:dT7Z5v3CUhJg/+BqcjAWIA==,type:str]
-# No provider, model, or credentials: the backend is selected
-# dynamically (nothing injected, nothing pinned) — when a dispatch or a
-# chat turn needs a key, the daemon resolves it through the rhema
-# config seam, not through this release. The nulls erase the chart's
-# built-in anthropic/claude defaults from the rendered claw.yaml.
-config:
-    provider: null
-    model: null
-    watches: null
-# The chart's own ingress, rendered from these values. Plain HTTP on
-# purpose: kosmos.lan is LAN-internal and token-auth-only, like every
-# other .lan surface here (no TLS story for .lan hosts).
-ingress:
-    enabled: true
-    host: kosmos.lan
-    className: traefik
-    annotations:
-        external-dns.alpha.kubernetes.io/enabled: "true"
-persistence:
-    enabled: true
-    storageClass: longhorn
-    size: 5Gi
-resources:
-    requests:
-        cpu: 100m
-        memory: 256Mi
-    limits:
-        cpu: "1"
-        memory: 1Gi
-sops:
-    lastmodified: "2026-10-10T11:49:22Z"
-    mac: ENC[AES256_GCM,data:vz3cATCAOEoyXOJCz0u+GfIq06lV5sV3mUoOKa4lUOWnShGOnxxE+v60AslV4KYBfmSCVliTalM0Vm8isuqJSAd9ZdPaI0CZ9F0gkxza22eaESkapIcIYrAhJYcZnRBSyAXjdVHyIzlvVwyTEqWYvEW7F5MJUgc4igHFD1/gMIA=,iv:VxsYzAWGhOiLXCt68Mpu8N9xgjsXXgc2LnInv2BExV8=,tag:rICLpdj4D37QZtTNV91uWA==,type:str]
-    pgp:
-        - created_at: "2026-10-10T11:49:22Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ//WeO+shUgWwJAu2IdxVteea0IpFCyo93hWqxLWMytqF7+
-            3h2s7zXXsNvNCvqndHzNSrZt+OuSQDWSBVIzfxlztw7ga6BdI92OhpOZPCIyKwDT
-            LzzUCPrSAGOZVekOkFXKlVDjMFunAiEp/soGda7bbP+VrdHJmeRh8fioTOgd/4qL
-            /QmmJk3bMTlMoVcknOW2qI3n79YA9qnI0vjwBL63bDeZnxZ8CiZzd1SDr10K0rDf
-            f9ErcmeKAwm+HgehSA3xId0Cph4gnf3xNhNDe2gcZvoFlPIrZT0iU0fBzMRuJPxt
-            c9g+TqTAHBfx90H58/NF8Sfr3ScXNUHvHzgzrq4w+ogqmp8NYsdDbzG1C318dV2o
-            nITluENiYgR9Qs6gJda94aEc00IYEBp4lNGp5G1SyHiDB+jMMsiHX6w3x286dgNx
-            G6DcJ+TabCO+A+Fzq74I2ds+paoEgDegDMCIgK6uSKF0jT2ID579Bf2kRraneOqV
-            amgBI2CQZG5FAqdhbtpf4PHAK9YR3b42mgF9nBAc+f/oFeAZm8nFmG7LubwxqbgY
-            HLa7+ct38ygp/pwZ0FQcU5I3VwqYyU+JA3HMsL2yspHJAeQuXAvzkCQ8NaDOMpEY
-            JRY1pIHl3SwTkV3zh9co8r2Ho8fGYO6KzlNfEdRsx2C6DegM70kpPuYzcCDYAd3S
-            XAE6EX2dM+NxYqhHEIwKjFMJlROWwhhRhheFZnyYRMsn75NkeqRfPi2tJgMkIMk9
-            OJ1eekhgFbQr8vaWtrIOhjvQG9ieg2ujuyltVcC2XUFxQONCxbfoXC2oYu1Y
-            =gTTK
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml|token)$
-    mac_only_encrypted: true
-    version: 3.10.2
@@ -1,13 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: syncthing
-resources:
-  - namespace.yaml
-  - repository.yaml
-  - release.yaml
-secretGenerator:
-  - name: syncthing-values
-    files:
-      - values.yaml=values.yaml
-configurations:
-  - kustomizeconfig.yaml
@@ -1,6 +0,0 @@
-nameReference:
-  - kind: Secret
-    version: v1
-    fieldSpecs:
-      - path: spec/valuesFrom/name
-        kind: HelmRelease
@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: syncthing
-  labels:
-    app.kubernetes.io/name: syncthing
-    app.kubernetes.io/component: file-sync
@@ -1,19 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: syncthing
-  namespace: syncthing
-spec:
-  interval: 1m
-  chart:
-    spec:
-      sourceRef:
-        kind: HelmRepository
-        name: k8s-home-lab
-        namespace: syncthing
-      chart: syncthing
-      version: "5.2.0"
-      interval: 1m
-  valuesFrom:
-    - kind: Secret
-      name: syncthing-values
@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: k8s-home-lab
-  namespace: syncthing
-spec:
-  interval: 1h
-  url: https://k8s-home-lab.github.io/helm-charts/
@@ -1,152 +0,0 @@
-# Syncthing continuous file synchronization
-#
-# Sync ports (22000 TCP+QUIC, 21027 UDP) are exposed through LoadBalancer
-# services on the dedicated Cilium pool IP 10.2.2.7 (appended to
-# kubernetes/system/cilium/pool.yaml). The GUI goes through Traefik like the
-# other *.lan services.
-controller:
-    replicas: 1
-image:
-    repository: syncthing/syncthing
-    tag: "2.1"
-env:
-    - name: TZ
-      value: Europe/Paris
-    - name: PUID
-      value: "1000"
-    - name: PGID
-      value: "1000"
-podSecurityContext:
-    fsGroup: 1000
-service:
-    main:
-        ports:
-            http:
-                port: 8384
-    # Sync protocol and QUIC share 22000 on the pooled IP; LAN discovery
-    # rides on UDP 21027. externalTrafficPolicy Local preserves client IPs.
-    listen:
-        enabled: true
-        type: LoadBalancer
-        externalTrafficPolicy: Local
-        loadBalancerIP: 10.2.2.7
-        ports:
-            listen:
-                enabled: true
-                port: 22000
-                protocol: TCP
-                targetPort: 22000
-            quic:
-                enabled: true
-                port: 22000
-                protocol: UDP
-                targetPort: 22000
-    discovery:
-        enabled: true
-        type: LoadBalancer
-        externalTrafficPolicy: Local
-        loadBalancerIP: 10.2.2.7
-        ports:
-            discovery:
-                enabled: true
-                port: 21027
-                protocol: UDP
-                targetPort: 21027
-probes:
-    liveness:
-        custom: true
-        spec:
-            httpGet:
-                path: /rest/noauth/health
-                port: http
-    readiness:
-        custom: true
-        spec:
-            httpGet:
-                path: /rest/noauth/health
-                port: http
-ingress:
-    main:
-        enabled: true
-        ingressClassName: traefik
-        annotations:
-            external-dns.alpha.kubernetes.io/enabled: "true"
-        hosts:
-            - host: syncthing.lan
-              paths:
-                - path: /
-                  pathType: Prefix
-persistence:
-    config:
-        enabled: true
-        mountPath: /var/syncthing/config
-        storageClass: longhorn
-        size: 5Gi
-    # Shares are recreated by hand in the GUI after cutover — the instance
-    # boots with a fresh config (see plans/syncthing-docker-to-kube-migration.md):
-    # valentin's folders at /data/valentin/… and sarah's at /data/sarah/…, all
-    # backed by the same TrueNAS exports as the docker stack. Photoprism
-    # already mounts the valentin Photos export concurrently.
-    valentin-documents:
-        enabled: true
-        type: custom
-        mountPath: /data/valentin/Documents
-        volumeSpec:
-            nfs:
-                server: truenas.lan
-                path: /mnt/main_storage/valentin/Documents
-    valentin-photos:
-        enabled: true
-        type: custom
-        mountPath: /data/valentin/Photos
-        volumeSpec:
-            nfs:
-                server: truenas.lan
-                path: /mnt/main_storage/valentin/Photos
-    sarah-documents:
-        enabled: true
-        type: custom
-        mountPath: /data/sarah/Documents
-        volumeSpec:
-            nfs:
-                server: truenas.lan
-                path: /mnt/main_storage/sarah/Documents
-    sarah-photos:
-        enabled: true
-        type: custom
-        mountPath: /data/sarah/Photos
-        volumeSpec:
-            nfs:
-                server: truenas.lan
-                path: /mnt/main_storage/sarah/Photos
-resources:
-    requests:
-        memory: 512Mi
-    limits:
-        memory: 2Gi
-sops:
-    lastmodified: "2026-09-21T22:28:39Z"
-    mac: ENC[AES256_GCM,data:BR4P4s4C9n4bEHryqfHpzzFHxAlKeujFBO2Qhsc4qdkcI5dftJ7jrknWtW0uv1E2Aljp50Mx1Rk4wglaWh3MS/ZnY/1dUxCfKuXOGkv9+mymQxDk6zJLsUNTH7sMr5kzlVWfv3yzXF50HWuiNl71BAv4mtlrtarXS1KVQrCKNaA=,iv:aG9OxDOhwk7xYNbvESNMFnXIjKhbYNO0gvDn1a9QQvc=,tag:QxM3EX8V2KJzosRz5damrw==,type:str]
-    pgp:
-        - created_at: "2026-09-21T22:28:39Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ//cvlMqPSaED2y5dsq8H/W/dqYVOeG7E/ZOuJGaYnImrrp
-            V2W6vPTzQ8QuYTKa1X4aOIlda04n7i2kDQCvpszmdpsU2y0SWtsgOBbyloIU3cAM
-            69HGd1SNqP/FayeZy/hHNvvEjmsgKX/9IV1YBGOcikmd7MqoxgGRgIxXORzY0dBG
-            7oREwV0HubdIBG6Fi6HUyN+Pugftpcumfwtl8ppPUYi1HGKzL5LzIT6gfqXtUcBg
-            8Wl2f0kMZsat1e05sZZah41dg+BAlyDgCRFo/ZQIhzHi28rJkZWG2aZxQfvAFMYJ
-            hUkjVyN7rAO01b2PsXK3bleFjD8iL8PhHY/Rio0/Uizjub7inako2SUd38D7X+ce
-            M1c2GoDVNmwZyXg7jBzb67JxLPn4Ic1kbjUi/JJL22rDzN0pBf6J7ExCpVGxrwK8
-            ++YDD1m/rY3YA8/ioM+pTu3ktEd1zu0T1yFySjgtvX8QVmOkrG1AA8E/N3+pzFWP
-            9wrJJ+yp5CYQl9d3j5LQcOzmvROi0EHjeZY75IHw8NwkyWdnRgWFIPsXxVoSUhSk
-            909RE//BuKSSRd1r9D/4w14Eb9KC74bIsUIflyK2Qs/N3rh9+/O8FS/5saryq7Er
-            GO3oAmFqC2F4Y6zFlmXkr43gBFjCPWl0DxI3uUK/gcw8kBpLSJex3j2sDaLViS/S
-            XgFsDLAjHnEo5DC+xyJQI5xMWsQzx/ASNZdBVLrnYPsRt+YG7qfu3lKNS9ujAG7K
-            ti58fACtT97K8IrUMNyEDGieFz65TYPcie4qILnDt2Hkr6QUEdBR8rvn/8z36D8=
-            =47Rw
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(data|stringData|.*key|.*crt)$
-    version: 3.10.2
@@ -1,13 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: get-rhema
-resources:
-  - namespace.yaml
-  - repository.yaml
-  - release.yaml
-secretGenerator:
-  - name: get-rhema-values
-    files:
-      - values.yaml=values.yaml
-configurations:
-  - kustomizeconfig.yaml
@@ -1,6 +0,0 @@
-nameReference:
- kind: Secret
-  version: v1
-  fieldSpecs:
-  - path: spec/valuesFrom/name
-    kind: HelmRelease
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: get-rhema
@@ -1,21 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: get-rhema
-  namespace: get-rhema
-spec:
-  interval: 1m
-  chart:
-    spec:
-      sourceRef:
-        kind: HelmRepository
-        name: rhema-dist
-        namespace: get-rhema
-      chart: rhema-dist
-      # Same CI scheme as the other vhaudiquet charts: timestamped
-      # versions on main pushes, exact versions on v* tags.
-      version: '>=0.1.0-0'
-      interval: 1m
-  valuesFrom:
-    - kind: Secret
-      name: get-rhema-values
@@ -1,11 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: rhema-dist
-  namespace: get-rhema
-spec:
-  interval: 1m
-  # Public org-scoped chart repository, same one CI publishes the
-  # rhema-dist chart to (from git.vhaudiquet.fr/vhaudiquet/rhema.rs).
-  # No auth, unlike the saggar org repo: the vhaudiquet org is public.
-  url: https://git.vhaudiquet.fr/api/packages/vhaudiquet/helm
@@ -1,58 +0,0 @@
-# get.rhema.rs, the rhema distribution (chart rhema-dist, repo
-# vhaudiquet/rhema.rs). One single-node Garage, one bucket, the
-# saggar-dist shape: the S3 API stays cluster-internal (chart default,
-# s3.ingress.enabled=false — release uploads come from the in-cluster
-# runners) and the bucket serves as a public read-only website.
-# The host MUST be <bucket>.<root domain> — Garage resolves the bucket
-# from the Host's first label — so bucket `get` on get.rhema.rs.
-bucket: get
-garage:
-    # Single-node store: skip the hourly self-sync cycles — while a
-    # full sync runs, S3 auth lookups transiently answer
-    # InvalidAccessKeyId (see get-saggar). Weekly.
-    fullSyncInterval: 604800
-web:
-    ingress:
-        className: traefik
-        host: get.rhema.rs
-        # TLS terminates at Caddy with the cert-manager get.rhema.rs
-        # cert; Caddy proxies to Traefik by host, so no tls block here.
-        tls:
-            enabled: false
-# The write surface, public via Caddy: the release runners reach the
-# S3 API by host (the in-cluster Service name does not resolve from
-# them). TLS terminates at Caddy, like the web face.
-s3:
-    ingress:
-        enabled: true
-        className: traefik
-        host: s3.rhema.rs
-        tls:
-            enabled: false
-            secretName: ""
-sops:
-    lastmodified: "2026-10-16T06:56:14Z"
-    mac: ENC[AES256_GCM,data:XuFKJcXb2C22x1GaADmX+QwQNAeUiYsmSh4g0Z5CTyvIXSI5gksAVKNgF0RqRNDLDmDA1jGCS+a0Y//ExXZO1kKQj2jYdYcKU4IvOmniMiwut5ZtobFbuskv7boAxmNRT/Y/4RgyyT8+45b/2+u3i9u2cwSQQ0Itvh5PxpFlE+I=,iv:3qXS6rEkeodOwLt5AOx8atfr15fK1zpmkM8uKjxUB2w=,tag:1Y78Jq8E44IGukCpR99UwA==,type:str]
-    pgp:
-        - created_at: "2026-10-16T06:56:14Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ/+KleFpAm4wpwoyB8U15o27ys2KXyKNFUl0EeRhYBYjcqe
-            wgtiayZjGbM0Tz2x9+SFLQhezldMlH8N5l0BscuYBMAUgDXS9OMN+v/1nHk0pu43
-            FUYHEWbYmYgngzGKuQhdrGEEtNBH12oKcBVwIPG7zaTfAlhfZIq/xsh6QyfTZX36
-            mSzUsshYPmqUM+RymH/PrJjpWz15XBdFUiY59+hNa9kqjalyTg0gijuu6JkKbYTK
-            SnFd2i9Ud/meniC4oBlLyOc0PX1/uyeIY1SFbGHdwBcHCFdIzMow2fZWLzimsNyB
-            GIO31PbyhG3ZCb2cOzYC0XqJUdP6lHbAyDBDiGWu+dBupDb8d96XeaIF0cTgOjxJ
-            0FrDMk1OAc1HjnhGo4QrEPMT0vMJmRDcDWXp60pFycRIrjGyXItMqkW06Xlr5HvF
-            OM8q3gjz6s7/Yi80EHKyFEHsvLl8jw2OXYhSiUEy6mSfii5k4Hhs2PBJFKcxLqZA
-            tH0caDA4zJia8FdlaTHI9OE33TvP/9uxvY9kBJUaeMdLxCo4T0keOiam2b0K/H8N
-            owIhdVJmXtsAFiw+t7KKZku9kQtkav8hEn1G++VQXL/XUjxvv3CewDq9cbNW7aIU
-            byjUf4jPR+kI4TeyR01YMDP2+O5Ld0/NxlCKqF10w8KVs1OsWFBagC7I4iPy99XS
-            XAEWw3W3SSGkz+9t2cqmXTxCPIvU0ANjkz8PoNAfx9HC3UWk3So1MGht0FDR9QVZ
-            AOzPM4U43wnYrTp1sq4N9Xh7xU2m2e7iUt/g2dtRFvx0vv2qMt4ianqzYiB0
-            =1619
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(data|stringData|.*key|.*crt)$
-    version: 3.10.2
@@ -1,14 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: get-saggar
-resources:
-  - namespace.yaml
-  - packages-auth-secret.yaml
-  - repository.yaml
-  - release.yaml
-secretGenerator:
-  - name: get-saggar-values
-    files:
-      - values.yaml=values.yaml
-configurations:
-  - kustomizeconfig.yaml
@@ -1,6 +0,0 @@
-nameReference:
- kind: Secret
-  version: v1
-  fieldSpecs:
-  - path: spec/valuesFrom/name
-    kind: HelmRelease
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-    name: get-saggar
@@ -1,38 +0,0 @@
-# Basic auth for the private Gitea Helm repository (org `saggar`) —
-# same token as the saggar release's packages-auth-secret.yaml. The
-# pre-commit sops hook encrypts this file (name matches *secret.yaml).
-apiVersion: v1
-kind: Secret
-metadata:
-    name: saggar-packages-auth
-    namespace: get-saggar
-type: Opaque
-stringData:
-    username: ENC[AES256_GCM,data:bQ8HUwCqCEIWKQ==,iv:FFcNqBTrA2xJCD2EUf2k+8f1+8DZC9r7Z14Qns0TjH8=,tag:aKWUHSP+8yjbewr/vt3z8w==,type:str]
-    password: ENC[AES256_GCM,data:bfiHI6tHwtK1qYf9UdAplb5qNE7fceQDjUim3KlWU/sb4Q5mvqK6CQ==,iv:ZtRNqfWZLT1lSd/N9MGwKrRiTtKDBUBZUR1LUy00G40=,tag:f55oMGmPHQB8zMNWtChp+w==,type:str]
-sops:
-    lastmodified: "2026-10-04T21:14:09Z"
-    mac: ENC[AES256_GCM,data:pbOlIPfHMwbwyBHlwkTYwWSeWD2jxud2zlNYMDyYJmKRpUuf0/erqRUusTrVGUnOG1t7omu+hQycPC3im6v8mi0vECBlkVG3knQa46bnVH9m1qa7lVChuP53TLYZogrOA8Ol9omrLsUsdcPNJfwXTYS/HHkY+ujECnjCWiVoXUs=,iv:Al2lU2xt1Hvv1BokoOx5e1gOlJhxzMJNyyCosmlGDV0=,tag:OxMxotEvYI06Fjjwst++gA==,type:str]
-    pgp:
-        - created_at: "2026-10-04T21:14:09Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiARAAgsXy5zMBbREVADgr2VVGgev6fHJUXq6DKCRhQdH1nsrI
-            xbSN1HZ2UbQjCYCjZl8NdVo3KGhJJ1uQGABAq6ZE+C4ZaMWvfjEO0/CnHmui8LkL
-            YXvJWWKvP/DDcmLXYxgwP8u/EWtn1bgXN7HeHxYb9JtGEf7XBlS9a6InWDmreabF
-            lSGkl79NgWDIngNQwTvby76uVARSAj3TkIxO6f4cVx+2f/c7KvWvX9D5vjrz8dpk
-            tPFdIhsCHdQS2wf2G3fEp4Yb8WnTEgu/HQ/amYwBAplhv3aaFQ0WVxCB91amnJyw
-            4Hnkcim4e/ZTmlBms/iQMFo+NhcHebRYcganIid23U8j4RfptwbuxED/txDEAAbj
-            lrgpknUXDG9RRRFTZfViYVJ4KWNduuUmVX4URYtn9d42BEXlXwx+Cd7FV40mlM8F
-            aT87F8G3IVexcKqLV15RngswCaCNJOnIT1vNNz18hz6sz8qXCzDwKIsS02wzkchz
-            1E8pi4grh2UkJT/F+mHUnze3ADOIZu6c2+SUwswVi+zAQg566dgFMYfKWc7icbvz
-            AWJ0hatHKNC4utZ2C0sCrM/34M0J507UMjlGKY9FUQ7wnHubPMfrum/FBNH1X7jM
-            F+iWsZ4N+kBnpY1Vf64S+97/Nqg5NZ3IBHWyqaSsWmR/h9628XDAa7kUpIsPK2LS
-            XgEGwyBsqJOWaYa7pXhIuul+1iNTJJ5FhU9qFQci708gund3RSvGJLtUIGlwSLUn
-            qzSSfl8vWujLNj9Pb0FcegVTYAq4eA59rJFILjyRZ64TaIfPBYxdFSD8t4zcWQQ=
-            =oHWG
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(data|stringData|.*key|.*crt)$
-    version: 3.10.2
@@ -1,21 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-    name: get-saggar
-    namespace: get-saggar
-spec:
-    interval: 1m
-    chart:
-        spec:
-            sourceRef:
-                kind: HelmRepository
-                name: saggar
-                namespace: get-saggar
-            chart: saggar-dist
-            # Same CI scheme as the other saggar charts: timestamped
-            # versions on main pushes, exact versions on v* tags.
-            version: '>=0.1.0-0'
-            interval: 1m
-    valuesFrom:
-        - kind: Secret
-          name: get-saggar-values
@@ -1,13 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-    name: saggar
-    namespace: get-saggar
-spec:
-    interval: 1m
-    # The org-scoped chart repository CI publishes to — namespace-
-    # scoped like every app, so this release carries its own copy of
-    # the repo and its auth secret.
-    url: https://git.vhaudiquet.fr/api/packages/saggar/helm
-    secretRef:
-        name: saggar-packages-auth
@@ -1,50 +0,0 @@
-# Chart: https://git.vhaudiquet.fr/saggar/saggar (chart/saggar-dist).
-# One single-node Garage, one bucket: the S3 API stays cluster-
-# internal (chart default — the publish workflow uploads from the
-# in-cluster runners, s3.ingress.enabled=false) and the bucket serves
-# as a public read-only website. The host MUST be <bucket>.<root
-# domain> — Garage resolves the bucket from the Host's first label —
-# so bucket `get` on get.saggar.dev.
-bucket: get
-garage:
-    # Single-node store: skip the hourly self-sync cycles — while a
-    # full sync runs, S3 auth lookups transiently answer
-    # InvalidAccessKeyId, which is what kept failing the edge job's
-    # prune step. Weekly.
-    fullSyncInterval: 604800
-web:
-    ingress:
-        className: traefik
-        host: get.saggar.dev
-        # TLS terminates at Caddy with the cert-manager saggar.dev
-        # certs; Caddy proxies to Traefik by host, so no tls block
-        # here (same as the other saggar hosts).
-        tls:
-            enabled: false
-sops:
-    lastmodified: "2026-10-06T04:20:10Z"
-    mac: ENC[AES256_GCM,data:ncXYOdUYTaYikkKWVUzWinakZVV7tjja31QIo/xhibZ8Jc9L/dl9U8//xJ95Hlb9uuMJvUHvk78KmH2mYVQhfhyNwkNZXvK3o3azx+WWQYaZebEudRbXdHO6gyywcoywlEFuaVWjVsTpggz2VtlNwP/tqLCf41uTUJB4NZi12uU=,iv:uj13/y/iGeoyqgnx74wh1Pzb01NupeLW55qBhCBNleM=,tag:PGmmMZCw49wt8RmpJH1CzQ==,type:str]
-    pgp:
-        - created_at: "2026-10-06T04:20:10Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ/+MH/izXRcAzwF1Dp5mgQBthTFYX01sUpjU9y5Z9jeRnny
-            UgtCuURwaI41nG+ZOrv3yy2dSsgABMgr8nZZEju/Tb+jZ/qzkPR8JWTpiieXefH4
-            Q5lEy6l1rLVOJudsgx7BG07h6gqr0Mu89gcpFThkXiCo5eAV/hlY9Y6eG6ZybWZ/
-            K2bUv8JB09S8ZsuFsTqp87lZMogWFcIjO8JMirjWRxgd+1NZFoGmSIb+6KkLTD2+
-            eMjbLnGZ3HyWLSzJBRkF5bGgODNGA8qaHmKKMTT8/H9zD1Z++nKCrx7SQpoStQxw
-            xluXAyefTiwCqhEVT42C68Lhz5pH6AyHgJGmls/NWv6bvj/3AQwXlkO87Xkd8x3L
-            aEDHIc5rEso18IZuNzlI193AEhipT8mcMi8IFA4YbnVnkK86PSXQ7qWrbbc4BmkN
-            cU/vUlpBM1HeiYdTFZf8Dvfw55bNn/pMhPhoLWpHjAnAEDJdrVh33OTurdmtYTRW
-            nRK3q2WVHa+UGlkKfdpKr1ivZ9O4ulSfyIYKVsLI5sYAbkJ4o6ytlcQlK6E/7AEK
-            Ux/KAnTb5nXOLN8Vbq0xGlyjYei0GY+IZWkkWL80k59NFfrDLXtG/zCxE74ANplm
-            qx+dCbggjT2lNsM+homldhYU0VhDnvrWM1/9bRI3DUVUxfGUCKMTqUj2b97vLGDS
-            XgHGOTHKKTQjpEg7DnnSS/romTxglHrAEa/3Cu4S4uUVIK7aL8JIoHXYaHho6Jp1
-            9RpCscjyeMfE/wnyTbeR1OZ6wnIMuLXzVzma0fy0fbYqGhJllULpMgsZGe6bhpI=
-            =MIya
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
-    mac_only_encrypted: true
-    version: 3.10.2
@@ -1,13 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: rhema-site
-resources:
-  - namespace.yaml
-  - repository.yaml
-  - release.yaml
-secretGenerator:
-  - name: rhema-site-values
-    files:
-      - values.yaml=values.yaml
-configurations:
-  - kustomizeconfig.yaml
@@ -1,6 +0,0 @@
-nameReference:
- kind: Secret
-  version: v1
-  fieldSpecs:
-  - path: spec/valuesFrom/name
-    kind: HelmRelease
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: rhema-site
@@ -1,21 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: rhema-site
-  namespace: rhema-site
-spec:
-  interval: 1m
-  chart:
-    spec:
-      sourceRef:
-        kind: HelmRepository
-        name: rhema-site
-        namespace: rhema-site
-      chart: rhema-site
-      # Same CI scheme as the other vhaudiquet charts: timestamped
-      # versions on main pushes, exact versions on v* tags.
-      version: '>=0.1.0-0'
-      interval: 1m
-  valuesFrom:
-    - kind: Secret
-      name: rhema-site-values
@@ -1,10 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: rhema-site
-  namespace: rhema-site
-spec:
-  interval: 1m
-  # Public org-scoped chart repository, same one CI publishes the
-  # rhema-site chart to (from git.vhaudiquet.fr/vhaudiquet/rhema.rs).
-  url: https://git.vhaudiquet.fr/api/packages/vhaudiquet/helm
@@ -1,42 +0,0 @@
-# rhema.rs, the static landing/download site (chart rhema-site, repo
-# vhaudiquet/rhema.rs). One stateless nginx Deployment.
-# TLS terminates at Caddy with the cert-manager rhema.rs certs; Caddy
-# proxies to Traefik by host, so the ingress stays plain HTTP (same
-# shape as every other public site here).
-replicaCount: 1
-ingress:
-    enabled: true
-    className: traefik
-    siteHost: rhema.rs
-    # www redirects to the apex inside nginx, so it rides the same
-    # service; only the host name differs.
-    wwwHost: www.rhema.rs
-    tls:
-        enabled: false
-sops:
-    lastmodified: "2026-10-15T20:28:50Z"
-    mac: ENC[AES256_GCM,data:jDNsyWKl2WhofVTzlgevHuPoLZUrLTW87Wd+dLv3nWEFWfN3G8fy0IKGbns1NpFyhx/OfqDJjlmDeZyt4dfmRUPC3Y1MI3kd4KUGlKf0lPy94MTJog7DZtVGtS0RUCN7/NevqtopIivj38u1dXjdcRI+F8bL91blf+RHvvvGOe8=,iv:pmVYVtNhczWqk8CLrAP2McUTrn8uTE88LC9oKtYQzf4=,tag:s+TXQDFqipQtfkE/BN2ASA==,type:str]
-    pgp:
-        - created_at: "2026-10-15T20:28:50Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ//df2F/yV6AzsAeDXunqgf016/km+/O8b37+WSaoB7UHb0
-            f/3lqxoVD9EWaTLum1pwHbhauDrjsOyyqkmIbEeOdnMQjEhDvnjfkDbTDupwl7Qg
-            m95ozoUsprhlqEu61ANhAx5xOHfelV5hkL5+ef9o3o0Ist2T8uBv/v+KxnbCHwmQ
-            e2/rjZ9BF8JgnhYVN3VKnpCgz2k9DVAdIZ4saeaET71MCK2naaO8BcVOH86H2Kn6
-            croIE0V/RNPBL3V0PDF804jRIPwfwd0sQiSwwpo11a/9Zgfwj2PDft1FPFyRv7Yt
-            iy5RaJ8rY8C2AqxRj1V0QIp6SyT784yhW02//8zZOA3Mcs9RUJfBosbqQDb3KIPx
-            MMNNgA1/Fa+7VWI7UX6/24tg2m7MPSCRLvzZMWzriKvcKQj/A0fn4pgcQfQ5wqnm
-            v/VrdLL8PBfy2dkYAsBvx4mAt11sOPwoT0iFhxInLNGeGsteJ5/texgLmJ/uO6vx
-            jJLJT8izFKqZKJCK5Db/Qx8RuiuGysaS3NiWVKfdWrwlbNsMKeRFMEaEAfKjPOPG
-            +1WQcvi+jHfCWsjimxW2+Cs90ZIUY3lbGLuQWhFj8zynQt5rehCZzqjmtx6MbHRT
-            GdDZm62Ox1sdMq1ZwMVElWelyNSTtPNN53DcEEiTGqaSwJjdLz9WZhcjMl0vE5rS
-            XAGm3AzBcPNFtWEODV1AyXwOUPea5RJ7ZNOOPy7jTrV0sZwJ8TAc67VP9IW8n1CM
-            22ri2Xq2qDidxsCKiQeaF77DN2YhBYJnxhvfeplVcKGyqb/EElDznR/fprDR
-            =IpGk
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml|token)$
-    mac_only_encrypted: true
-    version: 3.10.2
@@ -1,40 +0,0 @@
-# Gitea OIDC client credentials for the saggar login provider — the
-# OAuth2 application registered on git.vhaudiquet.fr (Profile →
-# Applications → OAuth2), with redirect URI
-#   https://saggar.dev/auth/callback/gitea
-#
-apiVersion: v1
-kind: Secret
-metadata:
-    name: saggar-gitea-oidc
-    namespace: saggar
-type: Opaque
-stringData:
-    client-id: ENC[AES256_GCM,data:8NHXVbeLNBbFfxtVDk8AtbBWnjpwMWlihjqoEFSJmCDH3Cjz,iv:3PqTABU6ZxNEm0jshvDEkKbSHpdqf2/7DzVVjx/cXVA=,tag:YYuNIQU4nsNxVWZA2WVVbw==,type:str]
-    client-secret: ENC[AES256_GCM,data:WiqVhGyNHyeVQY9bX2qkvcaiasejyUUyNXBN4kTKl+TfP8vsedex0U8Va5Ns+9KW/Uget3+kH/o=,iv:K1zLz8am7Vox5IZc5zSDSEeDu9t6R5swEeeqTRrnZdo=,tag:OEbZAqNBkgpX/RdvH5Tb8g==,type:str]
-sops:
-    lastmodified: "2026-09-30T20:30:47Z"
-    mac: ENC[AES256_GCM,data:MKm2CMBDtNL2GzO2pvmX7WLcTYNap9Xh/loBjZESkHbS65V2QpNU4+yTXcDewyDld9q2zKock1kPRQbhSyptlpxRQN6WZ+LhenS3f6p7rjPq+6gquNJ9j6ccgMFKvBKXoitYsbvfdpp6F6FN8vj24aH6OmTO2gUuvsdj7LIF1bI=,iv:20tkg9yg1kPeo2tbNbXNKNWXAbUqL352NV3+HOCqnqQ=,tag:35vyPxiRTUPuQkxy1/zD0Q==,type:str]
-    pgp:
-        - created_at: "2026-09-30T20:30:47Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ/+INz4B5GdyNfaR4b6DXha7chZN3Qh+nh8oRduzFGKak76
-            C3fANw2+HJ4/eV/j1ImNMbON0v7fbPpEe417nkRPESxnkEONi2Rrt0qoCVtnI64u
-            isewcMXEJCvTqAa460lE5AIC3tMjfYZd7h3tUe9N7HL3ufOB7hDVflGq954Zo+qu
-            rwGH5RZ5s4B5xnW6upVia+TRpu907ibpCKSfzm2uH6CRSIuuvIZrhu/qMnEUaa9F
-            9SEEr87orU7YhYltPmK6k3oFaZLbXNsIYCLl7AIeMA3ZlvKKwk4HkTxYU5BUsAK9
-            Zhv7yWIFyhTLVOv2k1dbOym3aRGe2KA/+LGHn0bi9ps2A5Vf6rSIQ1v2ya+OVCmw
-            Ibofs6/pfI1sZ56pOo1BGv0e6hBTe+jzimtBrTSAuCytDcTDmWusnH3HU8EefanN
-            96Dw1NMCVqYn+yl8CL9UPMOL4UT+CDJEbWVBjfVvsoeaER+ipPbspo9eRZypq7D7
-            aOWrP9Uiig/PeLt4ZMpsTWM27/tsVy2CPEFQ+XlgandVLQ6qTUQK42oAtepDSWuP
-            z8b12dkZ+xraI/wPqlrf6fXU+oKU2KteZxiMn89KqEgTbMp+BGycDHsKLA7VE+uz
-            Ni97MN8fbkT85VgwGE95xvUDGMMGyQuJrKbwc6gXzHQoCzZ/RfPBSUeXM4iyAa3S
-            XgGXEdIV02aQjl+kOqXu1VZLDVnb46fXTA5GDU51HKHeyT6YoE3rNljdFp2/hub/
-            rYX5lJ4j8XXo6s9xUQ3BEw3JMbrc0++SrIXGk3Hqid3Ez+cBm3Q/wqF3YpF5tIs=
-            =GpPh
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(data|stringData|.*key|.*crt)$
-    version: 3.10.2
@@ -1,15 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: saggar
-resources:
-  - namespace.yaml
-  - packages-auth-secret.yaml
-  - gitea-oidc-secret.yaml
-  - repository.yaml
-  - release.yaml
-secretGenerator:
-  - name: saggar-values
-    files:
-      - values.yaml=values.yaml
-configurations:
-  - kustomizeconfig.yaml
@@ -1,6 +0,0 @@
-nameReference:
- kind: Secret
-  version: v1
-  fieldSpecs:
-  - path: spec/valuesFrom/name
-    kind: HelmRelease
@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-    name: saggar
@@ -1,38 +0,0 @@
-# Basic auth for the private Gitea Helm repository (org `saggar`) —
-# the same access token also goes into values.yaml's imageCredentials
-# for the container pulls (the chart renders the imagePullSecret).
-apiVersion: v1
-kind: Secret
-metadata:
-    name: saggar-packages-auth
-    namespace: saggar
-type: Opaque
-stringData:
-    username: ENC[AES256_GCM,data:gQXori8DR18jnw==,iv:X1rqJ3gTlIdY6qDYYDLjW+r+/PZVvVvZJaHuRflA50k=,tag:QOLVAuGO/deRAxwelHq3jA==,type:str]
-    password: ENC[AES256_GCM,data:aGrzZOtE7PeFXB8ybbAGgVdstb6De7ha/GARPyXP8nxP/tv542d3YQ==,iv:ngBYMmLVtG/5Au5txvzM25LOT2FswrAHP7LMRth2yek=,tag:+uKN2Zjl/ueYIHrXvWBTaA==,type:str]
-sops:
-    lastmodified: "2026-09-30T20:30:48Z"
-    mac: ENC[AES256_GCM,data:G5Z0s30VsnEsvCVQin/fNg8n2UamvhDv4TMOzvBWXXjW5b43aXdzbQ++x3AetBCgocuTkAXqoPmpYG5f0DVH3n+55lqeE3ChtUlkb0S3zJPZ1jna5rNqKHMFuI8nItyxowAVVKJ06tscRCPlvwRcYWuTGEep0Lq7fSgt6BR/7TQ=,iv:x0uJXcRo8CDjzd4msHMBwloATMryQxmo3eGpzBhzn80=,tag:AwI4lslApzy0wyJgRcYdLg==,type:str]
-    pgp:
-        - created_at: "2026-09-30T20:30:47Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiARAAsQDZ1Uan1oGs6/mBJ9RvdMWH7fhCJfIWXv9Ldljn9lFv
-            Cp7ygWA9xgmUW2emtybn28s6uNr4kEH5/x5+0BIIVAmb/LKWi40bQKhSuaWKEgZf
-            OmZMNRilgwKFODbfif7UzsjKmogJ5DBFZqiJXP9uFSbF8klH4HSbJcKHR9jCjiM8
-            cnWcpZ4xPaPxV7ARC8vKh3jvC7Eh6ivjEhJJSUQTt7w4ucs2e07n2WrCLAQDtu4m
-            xzVMDV6y2Far3Rv3Lk5O+FRprmpIKhGwU5nfEFighj7K8/ynZDUEsE5EUtuxDw1p
-            BBFFAsuNf4J+qVctfCFwEr2PTsT1VU0jKcB6t9lJZE3aT2xu9mu1Ezn9m/YGWzp2
-            airb4UVACWLXj9sqcv7YIG8aUHpm7qVm8AE5UF1OhNJbDCQbpUEklGNRV3N0R4nr
-            ehatG1fCLUmXj7CUHdLmfGkhahfUIl2SJAp42h9VdQN8NB8Plj4j+hzluZSqU8XS
-            KP7kdIbDheeqZvSxA4KAeXrvvUzOWp4VK6ClL9pVjEh5HTu38atFGQ99daILy95L
-            f2z4l1Gc73+zRCHWPKtz5SiPT/G4RlxL2lrgKnykfpOCbJ7wV+XC5kAi+Lj8BM7s
-            EB2bqYewal8k2+VVFGD8vzyB/0mV2i37AJFJ8uJTU09D0CKGpDlgrFw1D3YkwA/S
-            XgGxHYtmARZxCBEbCeizPE4nk+UZtvVtngPUKABPe5euwX40kOwy81dadjoIZsks
-            Vev3d9txiEO6QKcx5rTEp7uju9QO8meqWIM97f0dB1hj1l+tRwmo91XJVKBRgFQ=
-            =ZysC
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(data|stringData|.*key|.*crt)$
-    version: 3.10.2
@@ -1,19 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-    name: saggar
-    namespace: saggar
-spec:
-    interval: 1m
-    chart:
-        spec:
-            sourceRef:
-                kind: HelmRepository
-                name: saggar
-                namespace: saggar
-            chart: saggar-hub
-            version: '>=0.2.0-0'
-            interval: 1m
-    valuesFrom:
-        - kind: Secret
-          name: saggar-values
@@ -1,10 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-    name: saggar
-    namespace: saggar
-spec:
-    interval: 1m
-    url: https://git.vhaudiquet.fr/api/packages/saggar/helm
-    secretRef:
-        name: saggar-packages-auth
@@ -1,105 +0,0 @@
-# Hub mode (the chart default): intake + registries + web UI, with
-# artifacts in the release's embedded Garage store (chart default in
-# hub mode, longhorn-backed). Builds happen on runners from the
-# saggar-worker chart, to be paired against this hub once it is up.
-image:
-    repository: git.vhaudiquet.fr/saggar/saggar
-    # Empty: follows the chart's appVersion — the commit SHA CI stamped
-    # on the pushed images.
-    tag: ""
-# Private Gitea registry: the chart renders an imagePullSecret from
-# these. Same access token as packages-auth-secret.yaml (the
-# pre-commit sops hook encrypts this file).
-imageCredentials:
-    create: true
-    registry: git.vhaudiquet.fr
-    username: ENC[AES256_GCM,data:Kb01bICyN/BvDQ==,iv:o19woAl9Hqlouo3fgmj6fesiix1bo6fPRcZdE3W55bk=,tag:LzBjc/dOaFv1yUblzAmFBQ==,type:str]
-    password: ENC[AES256_GCM,data:Phft0J0kFY71+icAEP2OuwGOfkNwMv64Yd0mWJkgVXWEJRyczAorZg==,iv:SeM4FVIwAqXxT9P6uUyftehk/eL3Y2JY1beGbruO0mM=,tag:Dezoea9JnN49laU0q+H3Bg==,type:str]
-# Login via the home Gitea: the engine is the confidential client of
-# the provider and runs every code exchange, so its discovery drives
-# the endpoints (issuer verified live). Credentials live in
-# gitea-oidc-secret.yaml — both ride the Secret (clientIdKey opts the
-# id in too), so nothing sensitive renders into the ConfigMap. The UI
-# needs nothing: it discovers the provider from the engine's open
-# /auth/methods.
-auth:
-    # The web origin the device login names: `saggar login` prints the
-    # confirmation page under it (saggar.dev/device).
-    uiUrl: https://saggar.dev
-    providers:
-        - name: gitea
-          issuer: https://git.vhaudiquet.fr
-          existingSecret: ENC[AES256_GCM,data:hqjfc89icY+3fOSMzh0xJ0Q=,iv:K+g5gpi8vcBpw6buktSZlePj9p4TGRV6bxuvSrFx2i0=,tag:FljiBjxAFrQON4J4iqk50w==,type:str]
-          clientIdKey: client-id
-          clientSecretKey: ENC[AES256_GCM,data:b01cCxpLg9d8ECChUQ==,iv:IMU1G+3hEyqS6jU7eWpgvQE7/ndLbH5gkbydFisCQeM=,tag:xs0ehG08oU15/N1hN9AHug==,type:str]
-storage:
-    garage:
-        # Single-node store: skip the hourly self-sync cycles — while a
-        # full sync runs, S3 auth lookups transiently answer
-        # InvalidAccessKeyId. Weekly.
-        fullSyncInterval: 604800
-ingress:
-    enabled: true
-    className: traefik
-    # The engine host: CLI intake + the docker/apt registry front-ends.
-    host: api.saggar.dev
-    # The chart's default annotations are nginx-specific (SSE
-    # buffering); traefik streams unbuffered by default, so clear them.
-    annotations: {}
-    # TLS terminates at Caddy with the cert-manager saggar.dev certs;
-    # Caddy proxies to Traefik by host, so no tls block here (same as
-    # pkgatlas's ingress).
-    tls:
-        enabled: false
-ui:
-    # Sign-in redirect base — the UI's own public origin.
-    publicBaseUrl: https://saggar.dev
-    # The engine's public origin for the docker pull / apt usage lines.
-    # Set explicitly: the chart derives it from the hub ingress, whose
-    # tls is off here (Caddy terminates) — that would render http://.
-    apiPublicOrigin: https://api.saggar.dev
-    ingress:
-        enabled: true
-        className: traefik
-        # The UI lives on its own host: the engine mounts its API and
-        # registry surfaces at root (/v2, /apt, /nodes), paths the UI
-        # pages also use.
-        host: saggar.dev
-        annotations: {}
-        tls:
-            enabled: false
-docs:
-    # The chart deploys the book by default; the ingress renders as
-    # soon as a host is set (no enabled knob).
-    ingress:
-        className: traefik
-        host: docs.saggar.dev
-        tls:
-            enabled: false
-sops:
-    lastmodified: "2026-10-06T04:20:10Z"
-    mac: ENC[AES256_GCM,data:ztx2M4srmnZs9S86xWOYSkePbi9Gm1n0FIB9oBmiaEn5fzSmPLbbn8IPcRsU+zOjkg5DRZ4LbuNdtmxynTC20yCHpb2vZbIUFiQarxPizI9lcKZyyOXFjoECXYZ5oDEOkAPrvYWTduqvK5o9dsUmebtKCSh9EMVMD47nF76yr68=,iv:Y2DjchwTfIjWMDGfQNwXCxM7MG6iNwU6LHf276osNjM=,tag:oviToaqWMdl1/cDgYX9M7g==,type:str]
-    pgp:
-        - created_at: "2026-10-06T04:20:10Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ//Sgir+7MRZYnuxGArDmyeP57A3xL6F77pLZbNIOjQ6KcK
-            3Giga+m3n2BodCDVzL6bUOtUbtgBVyqD7SSBY4qQ2a9c/H4xBAO0HciDth4O1Wer
-            z8fKSphk7tt1yBtzuB1tm0F9Ye53tLaetACXRGGo83jCGse8J0d4+vimra45fjyn
-            9JEnCl0+A2AMMl9/hcfCj8iSj+VeiCJz35Zmo+BWl0KrY0DHAeEyBEtI7O+z8bFF
-            9oGZY/xhTVD4IkbOqXs1fatTmybyzxrTBz/I7d9QOnPx7N08rb/g3KspkCPDSptH
-            h/AnDGg0PDVs7WK0eMwFMsZ8gvEYI76ecf6mAO5x6TbpxVHCPXpbbBTC7ro7usB0
-            4jVLrALMtsMn8k45JWFGR3OsujPr1D+yGmsJ2Mqde4AtjE6zTs8TurwuDEY0ivYg
-            HvAKk6C+ZOmdQEMep2kznSovMx0m6FP8Muv0ORX+pMNOIRhUFbEAXT+s7J7YoLlf
-            Rza/lf4VgsWtTUyUZRTH3G2NTwEgBo4GsV6bM07OhN0GEgMH1hOuGo61C+e2d6PR
-            NqeRgvlzfmeoTUBwgNv023739hyB2xDVesr5jo/yomikxFiz0wGUBQ4eRZmRZSjD
-            ZCLoiv+2ymROgWzGqgutRiRD150P45biMs3zW/x3qGP/SiTj35OYyCzMjQb/ZRjS
-            XgGHEtiiRWv954k5eXRF3DOHxrZ/oxtjyc4+EjlS3VsgtOCjePSzKg/WQa8Zx3ns
-            MT2BKgtlFwM2eG5V7jHfHOmAuVIuH249iyER5AJDzot/0kAO7ekH/y72kfloDKk=
-            =3vCq
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
-    mac_only_encrypted: true
-    version: 3.10.2
@@ -8,4 +8,3 @@ spec:
  - cidr: "10.2.2.4/32"
  - cidr: "10.2.2.5/32"
  - cidr: "10.2.2.6/32"
-  - cidr: "10.2.2.7/32"
@@ -15,7 +15,6 @@ spec:
  dependsOn:
    - name: cert-manager
    - name: cert-manager-webhook-ovh
-    - name: cert-manager-webhook-porkbun
  decryption:
    provider: sops
    secretRef:
@@ -1,20 +0,0 @@
-# Flux Kustomization for cert-manager-webhook-porkbun
-# Depends on cert-manager being fully operational (CRDs installed)
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: cert-manager-webhook-porkbun
-  namespace: flux-system
-spec:
-  interval: 10m
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: homeprod
-  path: ./kubernetes/infrastructure/cert-manager-webhook-porkbun
-  dependsOn:
-    - name: cert-manager
-  decryption:
-    provider: sops
-    secretRef:
-      name: flux-sops
@@ -6,7 +6,6 @@ resources:
  - webhook.yaml
  - cert-manager.yaml
  - cert-manager-webhook-ovh.yaml
-  - cert-manager-webhook-porkbun.yaml
  - cert-manager-issuer.yaml
  - caddy-certificates.yaml
  - stalwart-certificates.yaml
@@ -80,13 +80,13 @@ spec:
                - longhorn-system
              selector:
                matchLabels:
-                  longhorn.io/component: instance-manager
+                  app: instance-manager
          - resources:
              namespaces:
                - longhorn-system
              selector:
                matchLabels:
-                  longhorn.io/component: engine-image
+                  app: engine-image
      mutate:
        # `request.object` is available in BOTH admission and background modes:
        # the backgroundController synthesizes an admission-like request for
@@ -12,7 +12,7 @@ spec:
        name: kyverno
        namespace: kyverno
      chart: kyverno
-      version: '3.9.1'
+      version: '3.9.0'
      interval: 5m
  # Minimal footprint for a single-node cluster:
  #  - admissionReports disabled (no extra Redis/Postgres)