build(deps): bump caddy in /kubernetes/system/caddy

Bumps caddy from 2.11.2 to 2.11.4.

---
updated-dependencies:
- dependency-name: caddy
  dependency-version: 2.11.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/dependabot.yml

@@ -55,7 +55,6 @@ updates:
       - "/kubernetes/system/blocky"
       - "/kubernetes/system/caddy"
       - "/kubernetes/system/cert-manager"
-      - "/kubernetes/system/cert-manager-webhook-ovh"
       - "/kubernetes/system/coredns"
       - "/kubernetes/system/csi-driver-nfs"
       - "/kubernetes/system/external-dns"

kubernetes/system/caddy/kustomization.yaml

@@ -6,7 +6,6 @@ resources:
   - repository.yaml
   - release.yaml
   - certificates.yaml
-  - ovh-credentials-secret.yaml
   - caddyfile.yaml
 secretGenerator:
   - name: caddy-values

kubernetes/system/caddy/ovh-credentials-secret.yaml

@@ -1,45 +0,0 @@
-# OVH API Credentials for DNS-01 Challenges
-#
-# OVH API credentials with the following permissions:
-#   - GET, POST, PUT, DELETE on /domain/zone/*
-#
-# SOPS will encrypt them on pre-commit.
-apiVersion: v1
-kind: Secret
-metadata:
-    name: ovh-credentials
-    namespace: caddy
-    labels:
-        app.kubernetes.io/name: caddy
-        app.kubernetes.io/component: ovh-credentials
-type: Opaque
-stringData:
-    applicationKey: ENC[AES256_GCM,data:kBPCJRdm3VeoFKsmig+l8g==,iv:Y21zRzFpA7tqjNFruHCIIZV8hsSGhypZhcWgh7AcUus=,tag:8F0160EP0ELVFe4bp2AarA==,type:str]
-    applicationSecret: ENC[AES256_GCM,data:0r9bolcuWfbgQ993L+wPZaqfLB4TXcptCFw+/D9t9LI=,iv:j1pdJI4DrAzQxP8W/qJ0UBg/2rZQn/Z3aY0qZcqJqQ8=,tag:wNk8FxsUXBUiiYEayl3c1g==,type:str]
-    consumerKey: ENC[AES256_GCM,data:79prnqUwFgpc6peVWYtkp+L66HuB7bcXHNljSdVkpqU=,iv:sxNGszLobl7/uK6HpXhuUlA9BiURS9j9bLjeY+iwrxw=,tag:JoOKkvK+y5k45U9M6TC1cA==,type:str]
-sops:
-    lastmodified: "2026-07-09T22:12:21Z"
-    mac: ENC[AES256_GCM,data:xPUFPlXWHWY/c/EzhfQhWc0JsRZ6qvuB7amxksqkotSbIIYuw90YheKHNwj9ZEqlE2gSmZYI0Cog03KCZlijeX7qKOWDgiLSf4zFT/X0uxcUoOuWvrj2nISjqT+mUJFjzPPHwBgtObH+N0LEYGhURdeJgIvbKh15kZRNqxKlCQw=,iv:E9xOdeiX+lbLR8Lz3APEYudOeF5mQk0Nvq2byzXiSxg=,tag:shDwlpvDfzacKiPuqzQzrg==,type:str]
-    pgp:
-        - created_at: "2026-07-09T22:12:21Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ//b7KcKq2BXfSU8DynNDo/QlZ77lfCYHsPMutbNh5ckpCi
-            JPoy06kZ9JtwET86lnv8awUuztA1CPN6uarrGqokZW4zaATHmQ0M5qHHOXClnI+X
-            VIL3/mcCH/sTN+/RO0vmnPcah8XnETzy/51GDvoMAeFIndVz/t/uKbAErwch1+Ol
-            Ds51d0MrdZxCAXxYcWr9WcLK7rLCyFd0r+TFb4buHswNIRNQvzJti0rkPac7wFNE
-            vjb05wr3ejdes5P9drQF5sUhZXZHAWOoZUKGBm4hUBLaQqSfqFnskKeSuyVXR+di
-            xiqrkuvOydNSPVpO9M+qCyZqiiE+cPL1t8wwqXiNPUhibeKsdUKOibI/XGO4QvCr
-            wDZt/Dcj8JfVw6SFEUP/TVaP+SW4T8tEoxIScR17DEn/eKiFp/dFQZ9pokaKM2kd
-            uhxrO7/FbA5KDMK2IZncV40IioAG/caFswM944ShMbJ5IJlFQv7OASPjwtauGnuY
-            9O/7XMAZas7u+PhBuxqdQ/3YVrCVyYnvxsQ/+TbX6pIY1w9rgwh+XamVln083P+c
-            4gcBfL/1vv2RzVKhkAQ9k5++Af3Vn6JpkKu1FqUHVmOf3nH9vUxqQTwSwAu6Pi2W
-            6BZKq0UdbYi6v6Ozi06V1z4qa0t2IC+LOA5dILpReE7M2EM+b/tRRpp514NAmUzS
-            XAEAAY0b6IKDlwAqHQVAg2TuTDGHm7rHSpxtllsXx+902zYttisRZKjQgJuWLdST
-            kb4WPMRUq1y97BMJddXjf6L6ganzRSpDV/1cq832S8x+7Qe2aiQ6/nnLxP0I
-            =8mxw
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(data|stringData|.*.key|.*.crt)$
-    version: 3.10.2

kubernetes/system/caddy/values.yaml

@@ -10,7 +10,7 @@ image:
     repository: caddy
     pullPolicy: IfNotPresent
     tagSuffix: ""
-    tag: 2.11.2
+    tag: 2.11.4
 service:
     type: LoadBalancer
     externalTrafficPolicy: Local
@@ -125,4 +125,4 @@ sops:
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
     encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
-    version: 3.10.2
+    version: 3.10.2

kubernetes/system/cert-manager-issuer/clusterissuer.yaml

@@ -22,22 +22,19 @@ spec:
           dnsZones:
             - vhaudiquet.fr
             - buildpath.win
-      # OVH solver for semery.fr (via cert-manager-webhook-ovh)
+      # OVH solver for semery.fr
       - dns01:
-          webhook:
+          ovh:
-            groupName: acme.aureq.com
+            endpoint: ovh-eu
-            solverName: ovh
+            applicationKeyRef:
-            config:
+              name: ovh-credentials
-              endpoint: ovh-eu
+              key: applicationKey
-              applicationKeyRef:
+            applicationSecretRef:
-                name: ovh-credentials
+              name: ovh-credentials
-                key: applicationKey
+              key: applicationSecret
-              applicationSecretRef:
+            consumerKeyRef:
-                name: ovh-credentials
+              name: ovh-credentials
-                key: applicationSecret
+              key: consumerKey
-              consumerKeyRef:
-                name: ovh-credentials
-                key: consumerKey
         selector:
           dnsZones:
             - semery.fr

kubernetes/system/cert-manager-webhook-ovh/kustomization.yaml

@@ -1,12 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: cert-manager
-resources:
-  - repository.yaml
-  - release.yaml
-secretGenerator:
-  - name: cert-manager-webhook-ovh-values
-    files:
-      - values.yaml=values.yaml
-configurations:
-  - kustomizeconfig.yaml

kubernetes/system/cert-manager-webhook-ovh/kustomizeconfig.yaml

@@ -1,11 +0,0 @@
-nameReference:
-  - kind: HelmRepository
-    version: v1
-    fieldSpecs:
-      - path: spec/chart/spec/sourceRef/name
-        kind: HelmRelease
-  - kind: Secret
-    version: v1
-    fieldSpecs:
-      - path: spec/valuesFrom/name
-        kind: HelmRelease

kubernetes/system/cert-manager-webhook-ovh/release.yaml

@@ -1,19 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: cert-manager-webhook-ovh
-  namespace: cert-manager
-spec:
-  interval: 1m
-  chart:
-    spec:
-      sourceRef:
-        kind: HelmRepository
-        name: cert-manager-webhook-ovh
-        namespace: cert-manager
-      chart: cert-manager-webhook-ovh
-      version: "v0.9.13"
-      interval: 1m
-  valuesFrom:
-    - kind: Secret
-      name: cert-manager-webhook-ovh-values

kubernetes/system/cert-manager-webhook-ovh/repository.yaml

@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: cert-manager-webhook-ovh
-  namespace: cert-manager
-spec:
-  interval: 1m
-  url: https://aureq.github.io/cert-manager-webhook-ovh

kubernetes/system/cert-manager-webhook-ovh/values.yaml

@@ -1,45 +0,0 @@
-# cert-manager-webhook-ovh Values
-# groupName must match the ClusterIssuer webhook stanza
-groupName: acme.aureq.com
-# cert-manager deployment configuration for RBAC
-# The webhook creates ClusterRole/RoleBinding so cert-manager's
-# service account can create the "ovh" ChallengePayload resources
-certManager:
-    namespace: cert-manager
-    serviceAccountName: cert-manager
-# Pod configuration
-pod:
-    replicas: 1
-    resources:
-        requests:
-            cpu: 10m
-            memory: 32Mi
-        limits:
-            cpu: 100m
-            memory: 128Mi
-sops:
-    lastmodified: "2026-07-09T22:31:08Z"
-    mac: ENC[AES256_GCM,data:QjrNj355tJVZRsYQdkM73Ld7X8EvMM7O/1vF3QnTYJ9vWbh78irLocbtnyBeaR9o3g0mxO6Ugjlukj+S0HhIX/WS1XHEfs/3n3rE0zS/fxGJ0D3Alam/n/WPOsYHUiCBD86JtU83AjgncISY4yp/VheV3kRgSdl+ye4AGAjhq7A=,iv:p8yqNCcskTfDfEGbM5Qyb60C4pFv4BOuLpEApEzHLFY=,tag:KntExeQwJbBREaz2nY+1uQ==,type:str]
-    pgp:
-        - created_at: "2026-07-09T22:31:08Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ/8Dn4nEIbQXuETxE6RUBkNTO/eN5pHh47lqSwBBbYDSi8C
-            8rcJmdq8P+v00geLdMlM35OcjHFb9UCVeHFsAEYt6Q2jL4QNa2aOEDOqGnhKP+zx
-            KKtW2Ngx76Ow9N2C5JN9DXk9n+PC/qWdPLNJY+GiW/KbPmVxAulJpmYlJHfs1EOh
-            0mSRSS+7sgGLHWmgU362zC508lkKxh8HKxmq1+1lf+fWIe8N7Sl0fx55kq168hae
-            NcdogRpoVT555hRils7eqzj0C/KTVOi7CR4pS7VJyiNy2fu2OASmmcM6UEqCyJfV
-            NTUdMpnjb05UwfbuUnIg6j/FoqS49ufGxKPrM9t7JrFSuyGqduF7P/ifv5zwMuIZ
-            SNeR/X8xUksK6R4/uTmUx5sgF+Jv7tCRvcp+DhsDe1mMmO8czXC5Mt3cR+uwYoms
-            hN+9/oYEZr13qn5Ek0dy9NESkZIzYPCXYXZrx8GLqaHCJEQbpIZCAN+llOyQaQzU
-            jcvPAYbTewBw4ewKUS0KcvLd1pfzvYyvtzwHuMIVJwrf7x5bzhzxAgVOGkEVlVq/
-            7pGO9TYXGl3kD7tf25oCGzAerVC+EVcL11sq4zawvL4PovEZFP9mzhR7EfY3t/3C
-            vGVu6vPmCJOwdis9+Kdr3PKubnMqWGn5KCCX1x13qhsHc239N7cVKkyx3dTBaArS
-            XAG6KxKe/cQicIVC8/N1Cna9uQnTF5ZnFVfJNW1nkYyF1E+ofW6kKDr3ITotKLDP
-            hXXPT+vsB2fL3faBG4xb6owrMuQ1S0DmB3mqjSCXtpS7q0FDg22Tq9BtaEni
-            =x1th
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
-    version: 3.10.2

kubernetes/system/cert-manager/kustomization.yaml

@@ -6,6 +6,7 @@ resources:
   - repository.yaml
   - release.yaml
   - cloudflare-api-token-secret.yaml
+  - ovh-credentials-secret.yaml
 secretGenerator:
   - name: cert-manager-values
     files:

kubernetes/system/cert-manager/ovh-credentials-secret.yaml

@@ -0,0 +1,45 @@
+# OVH API Credentials for DNS-01 Challenges
+#
+# OVH API credentials with the following permissions:
+#   - GET, POST, PUT, DELETE on /domain/zone/*
+#
+# SOPS will encrypt them on pre-commit.
+apiVersion: v1
+kind: Secret
+metadata:
+    name: ovh-credentials
+    namespace: cert-manager
+    labels:
+        app.kubernetes.io/name: cert-manager
+        app.kubernetes.io/component: ovh-credentials
+type: Opaque
+stringData:
+    applicationKey: ENC[AES256_GCM,data:YhH6Ty+JJOelaq7G975wLw==,iv:zbwPRv1tdsyoN+rFoOIItzYC7wmv20zMX/ij6RnC8cI=,tag:n+NIrIp9IgunK9ZD15cULA==,type:str]
+    applicationSecret: ENC[AES256_GCM,data:5jxfV5a0jyCtXQKZJjxNmNTiyZ71nLoP0A/KYm+oQ9k=,iv:77SewJ13vouMbEey2oZav32bHsi/cvyKgE1VQapdzhw=,tag:Be58t/rpZrbHun3mMzrWww==,type:str]
+    consumerKey: ENC[AES256_GCM,data:zYTI4cHz36Is5pwUObL9XPDi6XEftonrjz+32jsNkEM=,iv:saNZrLThBa0b+D7S37IO2WpUmnm7ixshMbJaryZzYuE=,tag:v/BhwdJVlxDaeBi570b3Ig==,type:str]
+sops:
+    lastmodified: "2026-07-09T21:17:10Z"
+    mac: ENC[AES256_GCM,data:pakPqwigSb9Q1nuAcT4w4VumqQ1f1AGGx3WqNASs04eN/RxhWE+LQbY8BgNQ/YUx6HveypU6UH+ppMgPDwCZS7tUwTR/tXpDp/r3WIlhoQghtNGVp/eCpj9Tu91rnjc9Prv9wH8AWaJESeuK5dhZm+LAIvUczP3a+mUhQkXTtok=,iv:WQPfvLOODtvv88+vcTHMfiYcskS394mw+xBPacgCEgw=,tag:l5VMpNnInaeTXWWfkVonrw==,type:str]
+    pgp:
+        - created_at: "2026-07-09T21:17:10Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiARAAn1Wjcdq7Asc920TamGFdlQiDJa4T5iZKJohtXWbJXMSK
+            fqdDgMGWb5OdiCFprRkysckxsY0sWBzc/lOXlj2rw0UV2q66Rxrq19esvUDTfGfK
+            K1cKJ/tegcQ4heQsC+QUgC9SBZlqiA88yDGSO9j9hyBcaSWgkeTUWvrEBFeyLHDn
+            Yha0gxJibNSqmv+B6d5HepkwW6tpESXNX1NFJbYCx46nA6nrttbZCOxzQbS/oBKC
+            pmG4NzU6rQE57zcGpZOGYX8sQWjas0mhPiSAgFOdCdINuWFnONC1jUj5EnBM4LZH
+            +pkZtVmEl7D2SpPNtslTqJKCUbyIHGabblM76p2NKVL8vrTR3k2AM+aL5jS4536d
+            fRRWiWZihsn9PUHsSVLGZPkFe2ceHtM1JjGaX/M+0ZDag3gDUSCR8GdVbDd/95Xs
+            GeGGcVzmuTP16bYsTkXOMixvx7/q3yqAWP2FDvgJqJ3oataRlYwpVZBWDQo50eSb
+            w1fzARbMRz+OWNd+uFgWiHddFR12Xow1tfCSog9WAFjZQ++yjrRsqMH/x8NgWb0l
+            oq/vkHAg4WDqlKUa47vW56c8pZqsiWP8d8V/7b8avhHDdCb+SNOSe5QxO2AA8EAr
+            bjdwSpsErZNFWasYKqfs5ye4ct2tpCI5llRoR6WwnmM3mJflZAt983TPiZC8QLLS
+            XAHLR9ap5zx2shcdyyGOV5+7VmkDaSeB1baxeiORaQKK7CvVblhuIz0ZS097KUI5
+            HBTYvvIdEdXMn3hRalYzyuayKCiC6WEl/UKzXLiCiu94ijbaKqlOtW07anP/
+            =B+/W
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(data|stringData|.*.key|.*.crt)$
+    version: 3.10.2

kubernetes/system/flux/cert-manager-issuer.yaml

@@ -14,7 +14,6 @@ spec:
   path: ./kubernetes/system/cert-manager-issuer
   dependsOn:
     - name: cert-manager
-    - name: cert-manager-webhook-ovh
   decryption:
     provider: sops
     secretRef:

kubernetes/system/flux/cert-manager-webhook-ovh.yaml

@@ -1,20 +0,0 @@
-# Flux Kustomization for cert-manager-webhook-ovh
-# Depends on cert-manager being fully operational (CRDs installed)
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: cert-manager-webhook-ovh
-  namespace: flux-system
-spec:
-  interval: 10m
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: homeprod
-  path: ./kubernetes/system/cert-manager-webhook-ovh
-  dependsOn:
-    - name: cert-manager
-  decryption:
-    provider: sops
-    secretRef:
-      name: flux-sops

kubernetes/system/flux/kustomization.yaml

@@ -5,5 +5,4 @@ kind: Kustomization
 resources:
   - webhook.yaml
   - cert-manager.yaml
-  - cert-manager-webhook-ovh.yaml
   - cert-manager-issuer.yaml