chore(docker): bump deluan/navidrome Docker tag to v0.64.2

.github/workflows/dns.yaml

@@ -12,14 +12,10 @@ jobs:
   update-records:
     name: octodns
     runs-on: ubuntu-latest
-    container: octodns/octodns:latest
+    container: octodns/cloudflare:latest
     steps:
       - uses: actions/checkout@v4
-      - name: Install DNS providers
-        run: pip install octodns-cloudflare octodns-porkbun
       - name: octodns-sync - production
         run: octodns-sync --config-file ./config/production.yaml --doit
         env:
           CLOUDFLARE_TOKEN: ${{ secrets.CLOUDFLARE_TOKEN }}
-          PORKBUN_API_KEY: ${{ secrets.PORKBUN_API_KEY }}
-          PORKBUN_SECRET_KEY: ${{ secrets.PORKBUN_SECRET_KEY }}

dns/config/production.yaml

@@ -7,24 +7,10 @@ providers:
   cloudflare:
     class: octodns_cloudflare.CloudflareProvider
     token: env/CLOUDFLARE_TOKEN
-  porkbun:
-    class: octodns_porkbun.PorkbunProvider
-    api_key: env/PORKBUN_API_KEY
-    secret_key: env/PORKBUN_SECRET_KEY
 
 zones:
-  vhaudiquet.fr.:
+  '*':
     sources:
       - config
     targets:
       - cloudflare
-  buildpath.win.:
-    sources:
-      - config
-    targets:
-      - cloudflare
-  saggar.dev.:
-    sources:
-      - config
-    targets:
-      - porkbun

dns/production/saggar.dev.yaml

@@ -1,13 +0,0 @@
----
-? ''
-: ttl: 600
-  type: A
-  value: 82.64.154.58
-api:
-  ttl: 600
-  type: A
-  value: 82.64.154.58
-docs:
-  ttl: 600
-  type: A
-  value: 82.64.154.58

docker/personal/media/films-series/wizarr/docker-compose.yml

@@ -1,7 +1,7 @@
 services:
   wizarr:
     container_name: wizarr
-    image: ghcr.io/wizarrrr/wizarr:v2026.9.1
+    image: ghcr.io/wizarrrr/wizarr:v2026.7.1
     networks:
       - default
       - proxy

docker/personal/media/music/navidrome/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   navidrome:
-    image: deluan/navidrome:0.63.2
+    image: deluan/navidrome:0.64.2
     user: 1000:1000 # should be owner of volumes
     ports:
       - "4533"

kubernetes/dev/gitea/values.yaml

@@ -30,10 +30,10 @@ postgresql:
     global:
         postgresql:
             auth:
-                postgressPassword: ENC[AES256_GCM,data:4Kd4qz3DuJboaA==,iv:I9K1+j2tv7MKel9ej2/AED0JrxIfeb3D1xdDKCS+jTs=,tag:MpQ0NjglUvGZXzeOQjIj3Q==,type:str]
+                postgressPassword: ENC[AES256_GCM,data:AGdZp0KNk6+v+w==,iv:dc7B8GYA1hlC6VgO1m3jdHimIVb4QeR1DTmh9kqRDa4=,tag:JEFWOgvgvUDJ+S9yS446cA==,type:str]
-                password: ENC[AES256_GCM,data:YX6VvEJWfkO0dg==,iv:ixQkW2q7Y9YRIGMIbqWclA5q9Ufw+lNS7Gc4Wd1toiY=,tag:krGDeY+E4+PUjowt8jKAmA==,type:str]
+                password: ENC[AES256_GCM,data:kuR59jqrN/YFmA==,iv:qAIwiTzi2Fr9R9fIc3sfPqhIHSPI8K3eNmed8DBm7PQ=,tag:hf7CMUissSbO4RVn+kRUJw==,type:str]
                 database: gitea
-                username: ENC[AES256_GCM,data:KvdO0oE=,iv:vFYOVlo2kvOHOhASDlccTfcpsgAkS6YXOLCm5sDcxaQ=,tag:9J6Dmc3vYpHlFSggoGVmLQ==,type:str]
+                username: ENC[AES256_GCM,data:rCEYTAA=,iv:zeWzB+vpMl+oGUfQRPYFneLwnXF7Dlg4XAYB4QynAyk=,tag:zqJDiBiKJJIDgNKdOtGlMg==,type:str]
     volumePermissions:
         enabled: true
     primary:
@@ -77,8 +77,8 @@ gitea:
     oauth:
         - name: Authentik
           provider: openidConnect
-          key: ENC[AES256_GCM,data:F0AGCSAkU2ZWmS4jniL8k32ABwrjtURAPLa3RKOCpJoaMkKRlRrqwA==,iv:vQcD73C3itBqKFEiv8PhLD2G3exC0zc2NDE3LGYpvXA=,tag:24nO98pP7a00sTBDWEMsBA==,type:str]
+          key: ENC[AES256_GCM,data:LekdKlJJX6AYZX2PgooenJtANvE8HNdzePN9yeljrnoKV7pbexDnAw==,iv:pZm4+Dj2uqprBRIgchq78nEzqkC/zVoiyRK0cj98WPo=,tag:iSiuwP8N6BBVeGWS54j+dw==,type:str]
-          secret: ENC[AES256_GCM,data:0/6XDvRXUnQXrJzivtDS6b+mmYjtOVcHhGmQJPFG1zDyO9BksHKau0D+hIsfM85761U7LAISct0HungGNeOQOULnmvVT8hEIgC21RHjArXztJY2964NS5XXfURc7pVxOJ7LSDFFd4azExwhrTktqmerG+F6SI5V/oq2iYYqJA7o=,iv:ShYcIgyccHvEFhVn++gBR7gmMOEKcBz9sj/Y+4pk/Hc=,tag:SkFM2d06O/zhpfVji4QDKA==,type:str]
+          secret: ENC[AES256_GCM,data:J7WJghH6Xp9Fg3Y+PO1lN1mEEJ0HbVSM1YP2d8//NX2xmYK/PK1y6xSVQ4+VSsYTZhIAM3ZXVrBE/5smuNLUZkoj2EKY275fXcN2kOkEwiftdsJHSKdevCtO57TQipJToh6mfLxz51LDxpz85rVNj4Rvra1d9UvC5x1nUBm8AR0=,iv:lMiMQGsKn4ZxFctakj5MyVlX+8Wu93d5wM9cIqEBhSc=,tag:CkuTAGJqg+dUzyP9z5gwzw==,type:str]
           autoDiscoverUrl: https://authentik.vhaudiquet.fr/application/o/gitea/.well-known/openid-configuration
     config:
         APP_NAME: Gitea
@@ -104,39 +104,37 @@ gitea:
         indexer:
             ISSUE_INDEXER_TYPE: bleve
             REPO_INDEXER_ENABLED: true
-# Resource limits for Gitea container. Sized to receive a full linux
+# Resource limits for Gitea container
-# kernel tree: index-pack on ~12M objects needs several GiB and more
-# than half a core (the 1Gi limit OOMKilled the pod mid push).
 resources:
     requests:
+        cpu: 100m
+        memory: 512Mi
+    limits:
         cpu: 500m
         memory: 1Gi
-    limits:
-        cpu: "4"
-        memory: 6Gi
 replicaCount: 1
 sops:
-    lastmodified: "2026-09-30T21:03:47Z"
+    lastmodified: "2026-09-22T20:35:36Z"
-    mac: ENC[AES256_GCM,data:eHMr2BqfWNI32S14XEivXtXSIRiCBCAQz06mwtbNyXc1dI6YgF4pKdyIbfRWQW0ZYcbvqKxtyugao+lhc24Ds/GgIbdwchlMyz/DyuOQtM5GMHcSoInQUQVGzrM8hSyztKzq10bH0DmKvT68+uaVx0hf6rzxEqLRb3GAk4q3310=,iv:5kJ6bYE/54EbDWctSXBcVTjJtc/J3mV664tFD1WTK90=,tag:AAbHK3njH0PCqw9yjSWevQ==,type:str]
+    mac: ENC[AES256_GCM,data:xGtSdlGuJL3qSbnfbh/ON1q3c+n6l991fCy9t9ZLnrvSrU15vkK/WVHh84V132C72pEakwRy8nFcUl7KT3C3J2l2uJHJyDWDqA8NTvHq7FAcomKGKpNOqAOFXVUKSr6O4BtQr9x6h4jzAZSlpaTx3GEiLRzygSkZmcEcaXZ6/hU=,iv:JfQ3W3UZV1m1SkapNmUpZ1lkxgTs5F0auXukupK/yAg=,tag:xCNpJUc5mPv2dBhS+ob+fA==,type:str]
     pgp:
-        - created_at: "2026-09-30T21:03:47Z"
+        - created_at: "2026-09-22T20:35:36Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ//Vf2Rdp8NG4AsbIIOiXabY3AzLyVbE9Pn52+FBF+NIfkS
+            hQIMA7uy4qQr71wiAQ/8DiM04ZZ18qFndWSlo+hHV05hlt7GmwG9dx/3xEXgpdEb
-            XDqlgvMAWHtmV2LzvJPwPIUjCZkoRwmDsh9zi+W1XzHh9kKxzwvIxfjiqm8fwJh8
+            TkA3HNi5rUMvA8j/mStmP4sZiqrxlPk9sdMtVsPAppT3qAihcF3DyyUFYkSoY3oF
-            gb4a/y5mkkEqs+H0zE1H4D91dPbfOmDABJKaePmWTB+tc48bY6qX+LYs7hkPwsHU
+            Et5qeeC6DP1aKdsgAQVVZyeLy7l/CbO5CYORm5+TuGmnr0HxN1qZimbF15pspvNN
-            sN64cidbIbzBoq0t1TWZFkl6MZYWX9IyqJE1XcqYDAvwxlJ4JMJH2pGQlY8+7U96
+            9pprI7XDKb6QEbXhADN9gafNwTIQgv3LGQVdoQgfyzZEcQR8O5bxUFTwdR9LO646
-            YQgbXhuAik5IzNQlmdpq0mt0j3KZgM7KbLJ2en6JAiO0EhD3xKbFnC0bPniUEX2c
+            zogHuQfPC70jpA2IRxdBHuSTjDkZimyehsKPzq7MpBso/85q3q1TlSQKJsjxZWrZ
-            Yv6Z/1NrmNImCwbOkrNF9sqto4d9VHFDH8udSHKCXcSbzJmkfF4XUOBuNxtprmQV
+            NBKmEhL/Q4M+8mj+N/aVFJldIUF2Juto5d2BUuIG/lBtNL2QHdiJN3Rxc1gL4qP2
-            Wlcw5ZMFpnOgRn+V2gb0Cd3cm5rje0QAYCgIGUfduvMm9BReAQTvpUdKkqKs0mLr
+            eZYESQ6IRXAycUXAQgMJf5p/lhgmVjv8b3lhKSFJq66hZyo5g6wdhLIEunPglNbP
-            XiRAG0HfjjGNcVqWA0H0L5UxlVwHJh6zSNHDzTPVlGenVcQSpiUORKxZqANpQchW
+            BcJXUbl5SScTgOAi9o/soezUuggvzgg3zwM38PAghve1/j0rL7EupYX+u2v7zbUH
-            /wtFghatZFKbbzEz6Mo5C3hMKOXjl/VNWsmva8BoloDKPm9pWH5S4x0ExYiOWSOk
+            BA7T30SnkvDCmTzW4+Sac1dg/w06u+4oSGTNnTuKOzmzfIjGlwkJeAtPVcvSFAgK
-            Yk9j+twTgJXMeptO55qMCJKl6CcRsbgVr5yJJXWC6I3tr2ssx1BnSAPYDviuhsC1
+            TCKDmvtkPWUxGrxjBbJZUwqCp4HEOwOp6HeGeNbWFZ2UU+JTvTizkxbReN37Q4+f
-            YAbgFlvdzE6n8FmTixVwzVZrTbZV7alz9PECViMP5evAphe3n1MvnLEvMM0WOm/S
+            8oIyQuyRpDHgDV5IrbDtCcqWsEFpUXyi8snIMDTCkKdLZv1WjYhjoNmvOoRagQvS
-            XgG0Ty4hQ9ZD7gzhIrh06xVuh+MC/PaMYIZ7LBVHgQy8xbAgQH0qXkF39/9rCIws
+            XgEQDrDBeC3HZvUuvqMqgmHI+IEjmpad1CNVGE2q7FnAhFYutjBGF78co2X9t+ib
-            A/D0FN29uXvfSWzlgSrGOj218eKHX9g+nZGIAHeejd/FJVnOKQpUboUlg/x3jqQ=
+            B9o6aIwPzS4ANsh47rupGDBt/x46RCorCYhCaJm4B3v0+tYSA7mSBoHQwp1p+AY=
-            =943y
+            =kRPK
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
     encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$

kubernetes/infrastructure/caddy-certificates/certificates.yaml

@@ -79,51 +79,3 @@ spec:
     - buildpath.win
   duration: 2160h # 90 days
   renewBefore: 360h # 15 days before expiry
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: saggar-dev
-  namespace: caddy
-spec:
-  secretName: saggar-dev-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: saggar.dev
-  dnsNames:
-    - saggar.dev
-  duration: 2160h # 90 days
-  renewBefore: 360h # 15 days before expiry
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: api-saggar-dev
-  namespace: caddy
-spec:
-  secretName: api-saggar-dev-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: api.saggar.dev
-  dnsNames:
-    - api.saggar.dev
-  duration: 2160h # 90 days
-  renewBefore: 360h # 15 days before expiry
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: docs-saggar-dev
-  namespace: caddy
-spec:
-  secretName: docs-saggar-dev-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: docs.saggar.dev
-  dnsNames:
-    - docs.saggar.dev
-  duration: 2160h # 90 days
-  renewBefore: 360h # 15 days before expiry

kubernetes/infrastructure/caddy/caddyfile.yaml

@@ -107,18 +107,3 @@ data:
       tls /etc/caddy/certs/buildpath-win/tls.crt /etc/caddy/certs/buildpath-win/tls.key
       reverse_proxy traefik.traefik.svc.cluster.local.:80
     }
-
-    saggar.dev {
-      tls /etc/caddy/certs/saggar-dev/tls.crt /etc/caddy/certs/saggar-dev/tls.key
-      reverse_proxy traefik.traefik.svc.cluster.local.:80
-    }
-
-    api.saggar.dev {
-      tls /etc/caddy/certs/api-saggar-dev/tls.crt /etc/caddy/certs/api-saggar-dev/tls.key
-      reverse_proxy traefik.traefik.svc.cluster.local.:80
-    }
-
-    docs.saggar.dev {
-      tls /etc/caddy/certs/docs-saggar-dev/tls.crt /etc/caddy/certs/docs-saggar-dev/tls.key
-      reverse_proxy traefik.traefik.svc.cluster.local.:80
-    }

kubernetes/infrastructure/caddy/values.yaml

@@ -36,39 +36,25 @@ health:
 volumes:
     - name: vhaudiquet-fr-tls
       secret:
-        secretName: ENC[AES256_GCM,data:0Gno0HzWCXBsKXu7HrFFpuk=,iv:Ygz3WDWijXzF6U1OEqGu3F7fkBsa7Q77dyURlgpww98=,tag:R1TH/CfTQXrC8INNWPTEBQ==,type:str]
+        secretName: ENC[AES256_GCM,data:HYQb37rKxMqxFTsCz5kw6qY=,iv:dI9uqUVLLqPv3a5vwz1vowTvO9WduQaXqj7XZREd7oA=,tag:mz257AC3pvubgzOMxbHfrg==,type:str]
-        optional: ENC[AES256_GCM,data:lKaUaQ==,iv:ZD07ALdJ9QvLJZJvEANiHS+W9iusenyWsK4vO41fVqg=,tag:+5zgK51gMTwyCf+NuvdGOg==,type:bool]
+        optional: ENC[AES256_GCM,data:k9FVxw==,iv:XMAGop2PvSGD1R1cy6qqE39bsIAOFIqGzTnwDmYRhHM=,tag:7zZAwSzRWWiT9Y2iMWkI6w==,type:bool]
     - name: wildcard-vhaudiquet-fr-tls
       secret:
-        secretName: ENC[AES256_GCM,data:OgYNRxtElsKPLTxcHPAc8q1F8WsN+tdeo8A=,iv:3iflBURWgaOqa0fHp3J/ouxEyJD2AleHvANpumRSUFs=,tag:+WCVNo6P079P5WNmLRIsDQ==,type:str]
+        secretName: ENC[AES256_GCM,data:2OUkq/AMuv2wQyIlLPS3bSRrnV1mvDR6vd0=,iv:1e9HC8FFC4vo7GjCnJyNjF05R+Js41ONy2in5a+/doI=,tag:icKdtLhvQ40YI+KCE+6fXg==,type:str]
-        optional: ENC[AES256_GCM,data:uMCq9Q==,iv:rgEKryNgTq6m3VYYfImzQex7Fs5R+WIrMMX7+6zRJTo=,tag:ZtK824N7JkyQECslAsELUw==,type:bool]
+        optional: ENC[AES256_GCM,data:b+zvMw==,iv:QyU+T1BGZenO/nO8wq6R+KkrT/I6ZXIIhAnf5npFhvw=,tag:4UPyop81BQu4zxhZmK2n+Q==,type:bool]
     # semery.fr certs from cert-manager (OVH DNS-01)
     - name: semery-fr-tls
       secret:
-        secretName: ENC[AES256_GCM,data:BpYXgcOGKCfCkyWOPg==,iv:xEjs7L+74fCv2Lqh3gHL8Q5m64d9XkrO7QQjn1eNAdQ=,tag:M5TI2aFCl5Q+IFJv3fkczA==,type:str]
+        secretName: ENC[AES256_GCM,data:cLzhXgUhrwgIMACU1Q==,iv:DJ+6mjtjYmWxNcHl1gzeoifpcFCJsXiOXeyxEWnRU3g=,tag:7yc2bt6fBWwBuefPY48xyA==,type:str]
-        optional: ENC[AES256_GCM,data:6fbebg==,iv:aht7EEppRwKTYBnO4L/4VAlN2euvAVLPLuq7ekKWm0s=,tag:lHsPWL26QWbzAc32u9FYvw==,type:bool]
+        optional: ENC[AES256_GCM,data:DTfxaQ==,iv:K7TJjSI/vF3x34SWmwmivYo+mSsUAg9nB94Ui85nHCI=,tag:1/JRBMlb07+aHKEulIYpQQ==,type:bool]
     - name: wildcard-semery-fr-tls
       secret:
-        secretName: ENC[AES256_GCM,data:UGyQYSXVWGw0F2XOynpuKfcgTdFIeg==,iv:8uzadBqa8qdQYImy81Z49ef4hUoIAXEN1lcpF/zLzKE=,tag:UfN9BzxGabZfoIIctowVjw==,type:str]
+        secretName: ENC[AES256_GCM,data:Qq+ybi1kSVdVn9RP/kTkTcw0lkao3Q==,iv:vFmV3YvSNhLizgJVBnq1ZERqDP70onuZDvy/I3joPtI=,tag:AiEW+yh51Dexz3Vha4MPgg==,type:str]
-        optional: ENC[AES256_GCM,data:PxyWIg==,iv:0TxiU0ItTdtU7HQNbNhGjC2n1ECNQU9xB1EkDxDwwJY=,tag:XoiW8gIU9J3JGJ/bU68l+w==,type:bool]
+        optional: ENC[AES256_GCM,data:0o4ODw==,iv:VwnCs2C1MVUJEfBvNJT1rkDV7m60sNZPdtERo9wWPJk=,tag:oo+liLatrjqEtlrKQyjhyg==,type:bool]
     - name: buildpath-win-tls
       secret:
-        secretName: ENC[AES256_GCM,data:9hnCOPClLIGgPNnNPaJbNXw=,iv:px4ZrrTlmXyqGI0dsWFzXndUGVqlV83Kv4aDdG0S4Jo=,tag:wiK4rTqyQN8+fWQhZB1chQ==,type:str]
+        secretName: ENC[AES256_GCM,data:SejgJvZY/B7DDgf3YJcxcFA=,iv:bDZWhie17exL+9r9A7Ea/a8Rgpex7nuabVtW60LotJQ=,tag:WxqFbzulxxPgsynqfo5hzQ==,type:str]
-        optional: ENC[AES256_GCM,data:vC8okg==,iv:Pl81vGJ6Lt7jvFuOZAoDl2iV/F0IgOfKoeVUCOdNPC4=,tag:tUo1/Y1ZXqpM6hsu52l+ZQ==,type:bool]
+        optional: ENC[AES256_GCM,data:nBNRkw==,iv:JEvsFzMli7AzUj6GXJlHXOnANm45gnFE/kXrSbBotPQ=,tag:Puss6mCkoC7SGCb86guI2w==,type:bool]
-    # saggar.dev cert from cert-manager (Porkbun DNS-01)
-    - name: saggar-dev-tls
-      secret:
-        secretName: ENC[AES256_GCM,data:dL9l5pMrG/mYNQrqLYU=,iv:iuObGUhAFxovuZNglvbkf2Tm6Ska6TOKucnbB6sDhKo=,tag:SmCPAODV/Sy/dNuUQJ48Zw==,type:str]
-        optional: ENC[AES256_GCM,data:Ulw09Q==,iv:TKMN40lRkp+xmsAPDBVrVIe+h+6z5NlNZrpf7VvIah0=,tag:Cq3itFokCituCEJtrANeAA==,type:bool]
-    - name: api-saggar-dev-tls
-      secret:
-        secretName: ENC[AES256_GCM,data:FQm3BLurAD2EMCgsg/kMgWIH,iv:f6bv6YFL2ExmHS1QmdAyOcI/nnCIHL7xEX0/kZQ9rts=,tag:KQRXKValNB0oWYCCqZ8xdg==,type:str]
-        optional: ENC[AES256_GCM,data:+dUIjw==,iv:ztZ+5x76lpd2FqbZkgedeD2yneBKGicbW1MGTg4mUbo=,tag:ty4QRjVhbrB9WoOTenXcew==,type:bool]
-    # docs.saggar.dev cert — the saggar book (static nginx)
-    - name: docs-saggar-dev-tls
-      secret:
-        secretName: ENC[AES256_GCM,data:B/wTyuOSik2qea3FuCT2LpVqhA==,iv:Y8N5aQw4Yf2mPk1sEoeaxQEb3N1VVyyfiQy1cW1qdTI=,tag:Pn4k9TuMCJ5iAlWIVejb9Q==,type:str]
-        optional: ENC[AES256_GCM,data:Zt+j3g==,iv:AlxMaVpZMLKXDwP/xR9AiZS5p3Zm0/Kk0RXh7+s3/HA=,tag:6raJ2r1dw08NmP9GGbSysg==,type:bool]
     - name: routes
       configMap:
         name: caddy-routes
@@ -89,15 +75,6 @@ volumeMounts:
     - name: buildpath-win-tls
       mountPath: /etc/caddy/certs/buildpath-win
       readOnly: true
-    - name: saggar-dev-tls
-      mountPath: /etc/caddy/certs/saggar-dev
-      readOnly: true
-    - name: api-saggar-dev-tls
-      mountPath: /etc/caddy/certs/api-saggar-dev
-      readOnly: true
-    - name: docs-saggar-dev-tls
-      mountPath: /etc/caddy/certs/docs-saggar-dev
-      readOnly: true
     - name: routes
       mountPath: /etc/caddy/routes
       readOnly: true
@@ -122,7 +99,7 @@ affinity:
             - weight: 100
               preference:
                 matchExpressions:
-                    - key: ENC[AES256_GCM,data:icR94wmhgXZjrKlEJhGCuCqwxfI=,iv:s4zhWsRFXy2rZnETpkhixCoFHykEt7z2cRjW3lXJZP0=,tag:ejJW4EqCxEyDCrvRtdg82Q==,type:str]
+                    - key: ENC[AES256_GCM,data:oCV218wXg+k2L/edhWv6qpiyiaY=,iv:Y+O2of2NCOvcjSwr0EenGns0BtpT+P6pjCzEZUIMpm0=,tag:kY/WyHJ4Jr5ZLMe6ZcT/Tw==,type:str]
                       operator: NotIn
                       values:
                         - "true"
@@ -136,35 +113,35 @@ affinity:
                 topologyKey: kubernetes.io/hostname
 tolerations:
     # Tolerate the failover taint so caddy CAN schedule on p330 (small-node-1).
-    - key: ENC[AES256_GCM,data:Nw/vagZB7oUw,iv:HcfljVdo6FMPkAduv4hug8AVoe+/VniXMBKrJ8VT/QM=,tag:fr3Fl3fdmez/83pnZ9cFLQ==,type:str]
+    - key: ENC[AES256_GCM,data:K6vJkO2dpKRi,iv:b7NIPKTMYOxNao6KcSJUhsxKNRJ2J3ksEtmXkI8b0So=,tag:pMRmz17upWMTEZjwBRNyZQ==,type:str]
       operator: Equal
-      value: ENC[AES256_GCM,data:647LykKfZZk=,iv:0Dz446WOcetIdS5x6ffugLgLJ7bqGk5DflIOajNxeJI=,tag:aGRWSC9aN8Jo0R8B96cYjw==,type:str]
+      value: ENC[AES256_GCM,data:4ULPtEoUhgs=,iv:ikqWRqRR9ki35QQ6VnMEzOgT0/e+5DggGP8w60BhW/Q=,tag:MW9lX8miIWb9nnbc0woZTg==,type:str]
       effect: NoSchedule
-    - key: ENC[AES256_GCM,data:i29MKq5p+vyIcWAKjOzfwLXJQ84MniWDAUbK9a+DyavBHi7v7Q==,iv:SaTj2YkCO40MT7l2VsH89/zi9y4COte3c1wnNcp1NRU=,tag:8VOtUPeDlg62Mbjg1/J5BQ==,type:str]
+    - key: ENC[AES256_GCM,data:l7abu6ywKFevJdJod2Af2bj7XSfBJATL7UnfiUHrRJoCjBsl9A==,iv:xnUvzVX8z4doC+mQs1r0rNCSqaZ8KlXxr5Ee9FOFPjI=,tag:mnqCx9NSMSyeYwz57QFQIQ==,type:str]
       operator: Exists
       effect: NoSchedule
 sops:
-    lastmodified: "2026-10-01T17:39:26Z"
+    lastmodified: "2026-08-26T19:28:03Z"
-    mac: ENC[AES256_GCM,data:SCcbYDaj1ERDedV1LqbeBQ3uDJjkmyWkU2PXfmZ5BO5FC8b1ZkJJ9Ckcb8IvzSj2/f839RRHWGk7isUpwUrJ6QwifzYC53VAobr/S40sKx7281sYC+OX20zxa0hAf0fts1PsWWaWQ8IEVd08481MxyZFUFpFqGyGuyUeuIJtWf4=,iv:/U7yj5ONy57kFGqZNUOuCagw5N7mKgxv7s7QlR+nZNE=,tag:qBYkZmR3n/YrnfT7T/VwXw==,type:str]
+    mac: ENC[AES256_GCM,data:gn90e5Gjq5/CraT7Cl43DVMIQukD798faKGbVO5IJlbpAuTwDrhvqnnojFq4R7LEEETtedpR3MRyqcnbfSWVruHoysebycL7EZJkiy7H36JmzQAOWKusshMF9kOyZIV6+AFfz8As/Mu4pF1p5+3jmgy6oOJn7Ewm0C930Gpa3gs=,iv:cf1UC/2NGBHtQgx6h8vRpMjeJRaAvG7ZznhErn2b+cE=,tag:3Ule+pq7pZHWA7NqhlgfPg==,type:str]
     pgp:
-        - created_at: "2026-10-01T17:39:26Z"
+        - created_at: "2026-08-26T19:28:03Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ//W/WNIqPCl5afTCLEJOUnvBj80zjZ0+cDI7W/dvipnAqx
+            hQIMA7uy4qQr71wiAQ/9FKZhqwE2RZcfsIeMOtAkOTf/4aEbrSzsHbEO8DP8V3Ct
-            LQZr9zPfG3zURJBzGRpUDvqUWt2tymikQPx5rSNGgHeLYRru3SwaD3M5AEgkjAmC
+            rQBu/v8y1Hcu3fVU/OjVk/7QbEBjPNu1AJST55DBIWktnYUgSo4fIujvG54/hqwM
-            Y02hH6fIsJ+k5NhOS0wAlkgXze3EXq+0JOE8ZYQnF0ggYfsK6vTD+q+fI7zxddfx
+            9u0iuA1EcqVzGDa+vLSqgmi4Oxbujs0Ytn7uQrefqkdAOjltKqvknebI9EBdSRUi
-            0KLi8Gec5GXjgO93Roi0GwVguvQ9IDxe/xkGxQQ+CdZ7X6w2vfzBz/of6QJAGvRr
+            GjVFwysR6jHmIVf9S64vu4VsjfC7ju9MBYZniaKsJ1GOBhIjUZ6ogkYs5S2E5PJ/
-            8XKWmuUDBOdvWNFqfmsLMZ03ssD/h/WmxwTUMCHcynXSyprL+QRNH+lMMSVCFwyo
+            zE8cn79x61YLX74H+BAqnFcxbprtsCwMJPgyerfgijV6d+JpwT/6mp1VUrLe9Zz7
-            yiagQVxDPx9zmp/fwnSYt99sN9Q+Ky75r0UdFJYzpk9ZfqHveEVIh7JUigwAawF+
+            WEd/lVMlIcwnYCtIDAvuURvMP2OebWplr95d5V1Vb5Yywnl3M0pwkqL4dRiJISvk
-            oX8amZoyG5Qm24ZwTA6pkuzw8yc9KNPEGi5UjGFW+Q2fDPjq3Zt0NrSyfGD48dzJ
+            N2rBQYvDfXBtJA7yTAkJ3PymrECKoFs6nspEBie/kDJmdRGv8s2aajzTTQ1qLAkP
-            NnlmwkMkWGxTeVwmzdxgg9sd5QvG+8/pwJE76epJdXRQLd8ylJGoUNgbO0tZGEdW
+            FeJe0TcowjCCWMxk4W5DEoCh+PUA1HVo+/KmHjnIVgzdgxaeqT90VXwN8H7MPPeu
-            99pFqcbTN1UfZ6CtuPKTtU3GHylprTB1qw0wM1Hl/y8UEo82iuJmDdZ1HWEA+9AS
+            LKE01+Guue821h7GykkIhe9sf3nMGbI5rOiCcsVtgu5bODkRk8jXpXh1qdRAliuq
-            rCaYe0ZnWmTQHpWHXMBVK0OPqamOGiMZX4c6AUEdU5kyBymGmN5tjov6d+vA+4ai
+            uddjy1mWEfdUHNBj8YxvZ8WOU7h9FyZjsYZB96n9du1vqcuuP5eTJDVuvjjtDuTK
-            0OQjcH2QKzNshGrxo+iLIDP70AeZCg0BoKyo41X8Af4cRi6ub6l1lIWMmTYTY/7S
+            fbXYQbxwA5j4akyI4AKJYLA0Y/lcSXc84r6q8IA52nZz6uQZExbkoc7PPX7Q/ufS
-            XgHrANxBUj67L7Qt8spnz5FsQQ7ikTSEb1sXPM6RQ/hzFXdOHQTzJjwlr0NUXDgy
+            XgE0CWRS+0tk2oVANMVU31UrCvitttezjR6sUSAINh122a5kcmOfJzLlB2OqVKc5
-            dwC2khracGn6F9cXSrD7SN1elORAKr+HFWqBrnDLrYSkhkVI3kmCoueP7cwNFR0=
+            wMAyvOYccrQMrPDX1WJE7agDOaqGUQcwuFnvqpHhe8q9Yg1uOUU4sK1R8A1Qs0Q=
-            =jpmk
+            =wlYf
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
     encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$

kubernetes/infrastructure/cert-manager-issuer/clusterissuer.yaml

@@ -42,18 +42,3 @@ spec:
         selector:
           dnsZones:
             - semery.fr
-      # Porkbun solver for saggar.dev (via cert-manager-webhook-porkbun)
-      - dns01:
-          webhook:
-            groupName: acme.saggar.dev
-            solverName: porkbun
-            config:
-              apiKey:
-                name: porkbun-api-credentials
-                key: api-key
-              secretApiKey:
-                name: porkbun-api-credentials
-                key: secret-key
-        selector:
-          dnsZones:
-            - saggar.dev

kubernetes/infrastructure/cert-manager-issuer/kustomization.yaml

@@ -5,4 +5,3 @@ resources:
   - clusterissuer.yaml
   - ovh-credentials-secret.yaml
   - ovh-secret-reader-rbac.yaml
-  - porkbun-api-credentials-secret.yaml

kubernetes/infrastructure/cert-manager-issuer/porkbun-api-credentials-secret.yaml

@@ -1,49 +0,0 @@
-# Porkbun API Credentials for DNS-01 Challenges (saggar.dev)
-#
-# Create an API key at https://porkbun.com/account (API Access section), and
-# enable API access on the domain: Domain Management -> Details -> API Access
-# (disabled per domain by default; the API returns a generic error otherwise).
-#
-# The secret MUST live in the cert-manager namespace: for a ClusterIssuer,
-# cert-manager reads webhook credential secrets from its cluster resource
-# namespace, which the webhook chart's RBAC already covers.
-#
-# SOPS will encrypt the stringData fields on pre-commit.
-apiVersion: v1
-kind: Secret
-metadata:
-    name: porkbun-api-credentials
-    namespace: cert-manager
-    labels:
-        app.kubernetes.io/name: cert-manager-webhook-porkbun
-        app.kubernetes.io/component: porkbun-api-credentials
-type: Opaque
-stringData:
-    api-key: ENC[AES256_GCM,data:OLTDhFnbK70gAsvMR/4iKjKr9ckEkbXhYfG4xgTWP2gjruI9HaNAWzSBJcmDyRXRSz18XnvnSlUy/P5VXG5S6uH84wg=,iv:DrOWWf5h1FLNg+emJ/MMp80k8u+A/2HzC07EmjcWORg=,tag:2ep8o1zmXNPV54Byq2Dl7Q==,type:str]
-    secret-key: ENC[AES256_GCM,data:wtGiMCpU8PqTXvH27l+tUvJLivuK/zZp5KePFSeYfjb3ieFszbnjWFd3xQkgtFM3HrmjhRaGWUEFOIEvgTTMDBDyL+k=,iv:iVxMwt6UtpMAqdZj13YUzr3/gDUVTJecyc4ptYvHyNo=,tag:R/tn/BrARGvXjL1EIHBCRQ==,type:str]
-sops:
-    lastmodified: "2026-09-27T23:12:14Z"
-    mac: ENC[AES256_GCM,data:XWzKEL3qi4/KoKUZm1uEfj6GNW3ZLq71PDEyo7w2fHHmkgFMW/xwwXoBLRYFWVx3RvT82NwOCld/Savbs0qXY+Ws1AsgjklEim7MRyIjOKTT8Jkuh39WNCc+8C13yAHSrfPa3tEs10a8lk4nOaFxVn87zAnfnEt6LGt41+/HDxI=,iv:TxW4wJSqHVB9VH9pn/9lYsg8Og3JHTKRPHOrSjeAvuw=,tag:eKZkHptFhE95bPeNegTx8g==,type:str]
-    pgp:
-        - created_at: "2026-09-27T23:12:14Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ/7BAr8vmZ9i0Www7U8EkhPqOi1g0MVD8tVyhnTptBbS4MG
-            irer3UAy7ktovNUso1/wljKif/b2Q8EK6Sawgv4Sv2jN8ShWewginRQ7DeRGtwNE
-            TkNnnZoIMQmKwUZq0NnTmStg0wY/bRDYrovGhvPO8F/ZebU/cEXRFdHDzsKsTo6p
-            9LOu8DnTj9CwvhBLCyzqCeMwvL7DZryXuTS+aEVnrS0J4OUydK4VKYsvwXVsF6XT
-            4Jkpcf4yAiwxBsnZiszvL+L1BPzku1peU/p/d1fciVq54TmgrRwyC7GrlCLm/f09
-            xEPLnBMtmp1w5M2aONEYXXrk5fMWLIuSU7SmFzWduwLAMPTfHvGbpIS4U8eMCuIy
-            THKmeuyPL4/BW+PIc/L/UucOF0pjPDAPsdw3dEkB0+MlX3YDuTc37PpiX3pMRy1C
-            kxhwRVNPZqWMjkrAqg0BR9ZHEOQiv+HwHXZNG5CSHaYYC/mJUSVGaL7R0yOP3nIy
-            cWDA6Pyk5XWLspVh534xQODm1oArMdZ+xnD6NUqt+Bv6facrZkmT6r66LnCLb9fQ
-            rTS1aDm4gxuG5SX7lafDWL9Rh+z2DgFDde9cEAJZiBna4lTE7tJFPHF4OolqzrnN
-            MEhN8no5bLcMv1knE2nKkeKmOoXEKQ80mwgcVkdiRtQf2eZWAXAmpkGehuW/nIHS
-            XAHZXogqlqxbGDtIe2dM0qun1OA0HxsGw5J2EcFUt53wSg/YaZdEPN6aARPdRi8P
-            qGCEhZ43OokTCffCzf2Z52f7nx2NHIOoV3O3+80g6jw/Lrfe8WsZZZyXgjqm
-            =AViA
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(data|stringData|.*key|.*crt)$
-    version: 3.10.2

kubernetes/infrastructure/cert-manager-webhook-ovh/release.yaml

@@ -12,7 +12,7 @@ spec:
         name: cert-manager-webhook-ovh
         namespace: cert-manager
       chart: cert-manager-webhook-ovh
-      version: "0.9.17"
+      version: "0.9.16"
       interval: 1m
   valuesFrom:
     - kind: Secret

kubernetes/infrastructure/cert-manager-webhook-porkbun/kustomization.yaml

@@ -1,12 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: cert-manager
-resources:
-  - repository.yaml
-  - release.yaml
-secretGenerator:
-  - name: cert-manager-webhook-porkbun-values
-    files:
-      - values.yaml=values.yaml
-configurations:
-  - kustomizeconfig.yaml

kubernetes/infrastructure/cert-manager-webhook-porkbun/kustomizeconfig.yaml

@@ -1,11 +0,0 @@
-nameReference:
-  - kind: HelmRepository
-    version: v1
-    fieldSpecs:
-      - path: spec/chart/spec/sourceRef/name
-        kind: HelmRelease
-  - kind: Secret
-    version: v1
-    fieldSpecs:
-      - path: spec/valuesFrom/name
-        kind: HelmRelease

kubernetes/infrastructure/cert-manager-webhook-porkbun/release.yaml

@@ -1,19 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: cert-manager-webhook-porkbun
-  namespace: cert-manager
-spec:
-  interval: 1m
-  chart:
-    spec:
-      sourceRef:
-        kind: HelmRepository
-        name: cert-manager-webhook-porkbun
-        namespace: cert-manager
-      chart: cert-manager-webhook-porkbun
-      version: "2.0.7"
-      interval: 1m
-  valuesFrom:
-    - kind: Secret
-      name: cert-manager-webhook-porkbun-values

kubernetes/infrastructure/cert-manager-webhook-porkbun/repository.yaml

@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: cert-manager-webhook-porkbun
-  namespace: cert-manager
-spec:
-  interval: 1m
-  url: https://porkbun.octabits.io

kubernetes/infrastructure/cert-manager-webhook-porkbun/values.yaml

@@ -1,49 +0,0 @@
-# cert-manager-webhook-porkbun Values
-# groupName must match the ClusterIssuer webhook stanza
-groupName: acme.saggar.dev
-# cert-manager deployment configuration for RBAC
-# The chart creates RoleBindings so cert-manager's service account can reach
-# the webhook and read the Porkbun credential Secret
-certManager:
-    namespace: cert-manager
-    serviceAccountName: cert-manager
-# Restrict the webhook's Secret read access to the Porkbun credentials only
-rbac:
-    secretAccess:
-        secretNames:
-            - ENC[AES256_GCM,data:WXGjM38wR7oKcvetV91WocOt48njb5Y=,iv:7UEsgh62qq/0fGfmjG96Kko/r2h9IOD7IqRnu7poGFo=,tag:qdb4+n9ZnQidlz5fnHq94g==,type:str]
-# Pod configuration
-replicaCount: 1
-resources:
-    requests:
-        cpu: 10m
-        memory: 32Mi
-    limits:
-        memory: 128Mi
-sops:
-    lastmodified: "2026-09-27T22:55:14Z"
-    mac: ENC[AES256_GCM,data:rSc+2n8PYZLdBJRWB3lgiH40+24/5v0vLRAkHV3vM3IyxZgBrjJxmWjAu5PJWHDobQiw7G7x7ZMotJx6TbJztbnBpB5GmdoFC0kVkxxdE8txCWlmcwed6oktCJQ0nR09DaqTk3OvRZgFsWwkVMhZwCjLS+gZBzTTcw84MKqQcGg=,iv:tJd2rGP0EzrjVSp5ESHf5BnFU7fFjMUgfZTgZeM2yRk=,tag:hxVTpxEjz1naTbrDTQUSYA==,type:str]
-    pgp:
-        - created_at: "2026-09-27T22:55:14Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ/5AVsqIJQvmzAAexGSmYjPrdmX7W7JaVHYpUCFbiU9RP32
-            S1ffbzV+YjmYkrLhnwhosNeheEVbEiWeyrea+B9wlTgUp1R9+oy8ooc30uDr/vhY
-            9K56DoEcUhi95mQD1U7e7LK6qUkMowS0HWXEEOb/r/bvL3lQNmc4rNJ8Dz+MDFh3
-            A59ZkrvspjccrLd9wJUb1QbwLKRw/QpE/bT17nj8bOwcAipdz2Q/GoX0LGp88fgS
-            Yy6G/zwVpY/mDylHZbunDVBEqAziR3TAbQsRQZou2oB69Q0jwVs8//vVhWSpniUr
-            an/XdNaEDR5LFJESJK9Kf3H2Qe/Cq8ynC3NFAwk+tHVLOW8MxQrDUvq3fTQq/Zl+
-            CEzMD7+5bQDLQX82QMZ0TdjcLCIEouqCHo9dnGQGUX7NQd1ePV3xda6750zr1maX
-            PVTmx12nS+fCwo1DVLSTVa907TLg3h/DoADzpzcmhTfE7xO2mNcfN+P1dnHT2+U4
-            FhUXqYgZSkgjlkkpVr8XmZg4Cb98lgpS6hDqXylrXhdsCvGgW9YKg0wdQqb6H4Sr
-            ycBsXmj4/j1EMB9yqfSpO/6NNDjTMms0nWsrGXI7NHpROj+AV7fWXC1yxhw6uTus
-            SYhve/6VvbCb3hw9gHb9lzQ9VvTq/0jOqIMBoLoD1Wd45tHczPx1xbVf3KyB1HTS
-            XgFYYLiLku1Jj87DtdbsAbN0tNQNets9TBVffkawgFNsei/H5ZazKFPOC5NrwnJ1
-            FWLWI1fwFZG18c29b8mrEUKqX8GD+YO0BKwmtL7n9out6YAA+hK780RytQDdD00=
-            =yh2A
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
-    mac_only_encrypted: true
-    version: 3.10.2

kubernetes/infrastructure/mail/stalwart/release.yaml

@@ -14,7 +14,7 @@ spec:
         name: stalwart-helm
         namespace: stalwart
       chart: stalwart
-      version: "0.7.19"
+      version: "0.7.18"
       interval: 1m
   valuesFrom:
     - kind: Secret

kubernetes/infrastructure/mail/stalwart/values.yaml

@@ -7,7 +7,7 @@
 # Container image
 image:
     repository: stalwartlabs/stalwart
-    tag: v0.16.23
+    tag: v0.16.22
     pullPolicy: IfNotPresent
 # Single-node RocksDB deployment.
 replicaCount: 1

kubernetes/infrastructure/traefik/values.yaml

@@ -9,11 +9,6 @@ ports:
             trustedIPs:
                 - 127.0.0.1/32
                 - 10.0.0.0/8
-        transport:
-            respondingTimeouts:
-                # v3 default is 60s, counted over the whole request body:
-                # large HTTP git pushes die with a 504 past one minute.
-                readTimeout: 5m
 # Tolerate failover node
 tolerations:
     - key: ENC[AES256_GCM,data:r4uAu1ni9/Z8,iv:aKgn6DgT9XnjzmotnaEIL+WzUiQ34CazfervJwrYsdM=,tag:EeOY1YZwNCOPgHwXpas3ew==,type:str]

kubernetes/kustomization.yaml

@@ -46,7 +46,6 @@ resources:
   - utilities/open-webui
   # Production (public-facing websites/apps)
   - production/buildpath
-  - production/saggar
   - production/semery-fr
   - production/umami
   - production/vhaudiquet-fr

kubernetes/personal/notes/notesnook/release.yaml

@@ -12,7 +12,7 @@ spec:
         name: notesnook
         namespace: notesnook
       chart: notesnook
-      version: '1.0.38'
+      version: '1.0.32'
       interval: 1m
   valuesFrom:
     - kind: Secret

kubernetes/personal/paperless/postgres-release.yaml

@@ -12,7 +12,7 @@ spec:
         name: cloudpirates
         namespace: paperless
       chart: postgres
-      version: "0.20.6"
+      version: "0.20.5"
       interval: 1m
   valuesFrom:
     - kind: Secret

kubernetes/personal/paperless/redis-release.yaml

@@ -12,7 +12,7 @@ spec:
         name: cloudpirates
         namespace: paperless
       chart: redis
-      version: "0.35.4"
+      version: "0.35.1"
       interval: 1m
   valuesFrom:
     - kind: Secret

kubernetes/production/saggar/gitea-oidc-secret.yaml

@@ -1,40 +0,0 @@
-# Gitea OIDC client credentials for the saggar login provider — the
-# OAuth2 application registered on git.vhaudiquet.fr (Profile →
-# Applications → OAuth2), with redirect URI
-#   https://saggar.dev/auth/callback/gitea
-#
-apiVersion: v1
-kind: Secret
-metadata:
-    name: saggar-gitea-oidc
-    namespace: saggar
-type: Opaque
-stringData:
-    client-id: ENC[AES256_GCM,data:8NHXVbeLNBbFfxtVDk8AtbBWnjpwMWlihjqoEFSJmCDH3Cjz,iv:3PqTABU6ZxNEm0jshvDEkKbSHpdqf2/7DzVVjx/cXVA=,tag:YYuNIQU4nsNxVWZA2WVVbw==,type:str]
-    client-secret: ENC[AES256_GCM,data:WiqVhGyNHyeVQY9bX2qkvcaiasejyUUyNXBN4kTKl+TfP8vsedex0U8Va5Ns+9KW/Uget3+kH/o=,iv:K1zLz8am7Vox5IZc5zSDSEeDu9t6R5swEeeqTRrnZdo=,tag:OEbZAqNBkgpX/RdvH5Tb8g==,type:str]
-sops:
-    lastmodified: "2026-09-30T20:30:47Z"
-    mac: ENC[AES256_GCM,data:MKm2CMBDtNL2GzO2pvmX7WLcTYNap9Xh/loBjZESkHbS65V2QpNU4+yTXcDewyDld9q2zKock1kPRQbhSyptlpxRQN6WZ+LhenS3f6p7rjPq+6gquNJ9j6ccgMFKvBKXoitYsbvfdpp6F6FN8vj24aH6OmTO2gUuvsdj7LIF1bI=,iv:20tkg9yg1kPeo2tbNbXNKNWXAbUqL352NV3+HOCqnqQ=,tag:35vyPxiRTUPuQkxy1/zD0Q==,type:str]
-    pgp:
-        - created_at: "2026-09-30T20:30:47Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ/+INz4B5GdyNfaR4b6DXha7chZN3Qh+nh8oRduzFGKak76
-            C3fANw2+HJ4/eV/j1ImNMbON0v7fbPpEe417nkRPESxnkEONi2Rrt0qoCVtnI64u
-            isewcMXEJCvTqAa460lE5AIC3tMjfYZd7h3tUe9N7HL3ufOB7hDVflGq954Zo+qu
-            rwGH5RZ5s4B5xnW6upVia+TRpu907ibpCKSfzm2uH6CRSIuuvIZrhu/qMnEUaa9F
-            9SEEr87orU7YhYltPmK6k3oFaZLbXNsIYCLl7AIeMA3ZlvKKwk4HkTxYU5BUsAK9
-            Zhv7yWIFyhTLVOv2k1dbOym3aRGe2KA/+LGHn0bi9ps2A5Vf6rSIQ1v2ya+OVCmw
-            Ibofs6/pfI1sZ56pOo1BGv0e6hBTe+jzimtBrTSAuCytDcTDmWusnH3HU8EefanN
-            96Dw1NMCVqYn+yl8CL9UPMOL4UT+CDJEbWVBjfVvsoeaER+ipPbspo9eRZypq7D7
-            aOWrP9Uiig/PeLt4ZMpsTWM27/tsVy2CPEFQ+XlgandVLQ6qTUQK42oAtepDSWuP
-            z8b12dkZ+xraI/wPqlrf6fXU+oKU2KteZxiMn89KqEgTbMp+BGycDHsKLA7VE+uz
-            Ni97MN8fbkT85VgwGE95xvUDGMMGyQuJrKbwc6gXzHQoCzZ/RfPBSUeXM4iyAa3S
-            XgGXEdIV02aQjl+kOqXu1VZLDVnb46fXTA5GDU51HKHeyT6YoE3rNljdFp2/hub/
-            rYX5lJ4j8XXo6s9xUQ3BEw3JMbrc0++SrIXGk3Hqid3Ez+cBm3Q/wqF3YpF5tIs=
-            =GpPh
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(data|stringData|.*key|.*crt)$
-    version: 3.10.2

kubernetes/production/saggar/kustomization.yaml

@@ -1,15 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: saggar
-resources:
-  - namespace.yaml
-  - packages-auth-secret.yaml
-  - gitea-oidc-secret.yaml
-  - repository.yaml
-  - release.yaml
-secretGenerator:
-  - name: saggar-values
-    files:
-      - values.yaml=values.yaml
-configurations:
-  - kustomizeconfig.yaml

kubernetes/production/saggar/kustomizeconfig.yaml

@@ -1,6 +0,0 @@
-nameReference:
-- kind: Secret
-  version: v1
-  fieldSpecs:
-  - path: spec/valuesFrom/name
-    kind: HelmRelease

kubernetes/production/saggar/namespace.yaml

@@ -1,4 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-    name: saggar

kubernetes/production/saggar/packages-auth-secret.yaml

@@ -1,38 +0,0 @@
-# Basic auth for the private Gitea Helm repository (org `saggar`) —
-# the same access token also goes into values.yaml's imageCredentials
-# for the container pulls (the chart renders the imagePullSecret).
-apiVersion: v1
-kind: Secret
-metadata:
-    name: saggar-packages-auth
-    namespace: saggar
-type: Opaque
-stringData:
-    username: ENC[AES256_GCM,data:gQXori8DR18jnw==,iv:X1rqJ3gTlIdY6qDYYDLjW+r+/PZVvVvZJaHuRflA50k=,tag:QOLVAuGO/deRAxwelHq3jA==,type:str]
-    password: ENC[AES256_GCM,data:aGrzZOtE7PeFXB8ybbAGgVdstb6De7ha/GARPyXP8nxP/tv542d3YQ==,iv:ngBYMmLVtG/5Au5txvzM25LOT2FswrAHP7LMRth2yek=,tag:+uKN2Zjl/ueYIHrXvWBTaA==,type:str]
-sops:
-    lastmodified: "2026-09-30T20:30:48Z"
-    mac: ENC[AES256_GCM,data:G5Z0s30VsnEsvCVQin/fNg8n2UamvhDv4TMOzvBWXXjW5b43aXdzbQ++x3AetBCgocuTkAXqoPmpYG5f0DVH3n+55lqeE3ChtUlkb0S3zJPZ1jna5rNqKHMFuI8nItyxowAVVKJ06tscRCPlvwRcYWuTGEep0Lq7fSgt6BR/7TQ=,iv:x0uJXcRo8CDjzd4msHMBwloATMryQxmo3eGpzBhzn80=,tag:AwI4lslApzy0wyJgRcYdLg==,type:str]
-    pgp:
-        - created_at: "2026-09-30T20:30:47Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiARAAsQDZ1Uan1oGs6/mBJ9RvdMWH7fhCJfIWXv9Ldljn9lFv
-            Cp7ygWA9xgmUW2emtybn28s6uNr4kEH5/x5+0BIIVAmb/LKWi40bQKhSuaWKEgZf
-            OmZMNRilgwKFODbfif7UzsjKmogJ5DBFZqiJXP9uFSbF8klH4HSbJcKHR9jCjiM8
-            cnWcpZ4xPaPxV7ARC8vKh3jvC7Eh6ivjEhJJSUQTt7w4ucs2e07n2WrCLAQDtu4m
-            xzVMDV6y2Far3Rv3Lk5O+FRprmpIKhGwU5nfEFighj7K8/ynZDUEsE5EUtuxDw1p
-            BBFFAsuNf4J+qVctfCFwEr2PTsT1VU0jKcB6t9lJZE3aT2xu9mu1Ezn9m/YGWzp2
-            airb4UVACWLXj9sqcv7YIG8aUHpm7qVm8AE5UF1OhNJbDCQbpUEklGNRV3N0R4nr
-            ehatG1fCLUmXj7CUHdLmfGkhahfUIl2SJAp42h9VdQN8NB8Plj4j+hzluZSqU8XS
-            KP7kdIbDheeqZvSxA4KAeXrvvUzOWp4VK6ClL9pVjEh5HTu38atFGQ99daILy95L
-            f2z4l1Gc73+zRCHWPKtz5SiPT/G4RlxL2lrgKnykfpOCbJ7wV+XC5kAi+Lj8BM7s
-            EB2bqYewal8k2+VVFGD8vzyB/0mV2i37AJFJ8uJTU09D0CKGpDlgrFw1D3YkwA/S
-            XgGxHYtmARZxCBEbCeizPE4nk+UZtvVtngPUKABPe5euwX40kOwy81dadjoIZsks
-            Vev3d9txiEO6QKcx5rTEp7uju9QO8meqWIM97f0dB1hj1l+tRwmo91XJVKBRgFQ=
-            =ZysC
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(data|stringData|.*key|.*crt)$
-    version: 3.10.2

kubernetes/production/saggar/release.yaml

@@ -1,19 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-    name: saggar
-    namespace: saggar
-spec:
-    interval: 1m
-    chart:
-        spec:
-            sourceRef:
-                kind: HelmRepository
-                name: saggar
-                namespace: saggar
-            chart: saggar-hub
-            version: '>=0.2.0-0'
-            interval: 1m
-    valuesFrom:
-        - kind: Secret
-          name: saggar-values

kubernetes/production/saggar/repository.yaml

@@ -1,10 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-    name: saggar
-    namespace: saggar
-spec:
-    interval: 1m
-    url: https://git.vhaudiquet.fr/api/packages/saggar/helm
-    secretRef:
-        name: saggar-packages-auth

kubernetes/production/saggar/values.yaml

@@ -1,99 +0,0 @@
-# Hub mode (the chart default): intake + registries + web UI, with
-# artifacts in the release's embedded Garage store (chart default in
-# hub mode, longhorn-backed). Builds happen on runners from the
-# saggar-worker chart, to be paired against this hub once it is up.
-image:
-    repository: git.vhaudiquet.fr/saggar/saggar
-    # Empty: follows the chart's appVersion — the commit SHA CI stamped
-    # on the pushed images.
-    tag: ""
-# Private Gitea registry: the chart renders an imagePullSecret from
-# these. Same access token as packages-auth-secret.yaml (the
-# pre-commit sops hook encrypts this file).
-imageCredentials:
-    create: true
-    registry: git.vhaudiquet.fr
-    username: ENC[AES256_GCM,data:QijNVgCz8hF0Kg==,iv:eredumkfDLZ6AKM8nCcZwl14EyRRnBvXLL52Yaau0d0=,tag:P/miR7dyjGaMxqM/g7r0ow==,type:str]
-    password: ENC[AES256_GCM,data:SY3i9j6rBFh5RfehxBQX+ljVe11cGL1cRNkiFqcNbBlNkF9uqMC9hQ==,iv:qpHKDwzQDr8uTJN9e7OgUr/JN2O+EGJylbH/R+EU9tc=,tag:2DbOvUUTsrNfhIzhjirz/Q==,type:str]
-# Login via the home Gitea: the engine is the confidential client of
-# the provider and runs every code exchange, so its discovery drives
-# the endpoints (issuer verified live). Credentials live in
-# gitea-oidc-secret.yaml — both ride the Secret (clientIdKey opts the
-# id in too), so nothing sensitive renders into the ConfigMap. The UI
-# needs nothing: it discovers the provider from the engine's open
-# /auth/methods.
-auth:
-    # The web origin the device login names: `saggar login` prints the
-    # confirmation page under it (saggar.dev/device).
-    uiUrl: https://saggar.dev
-    providers:
-        - name: gitea
-          issuer: https://git.vhaudiquet.fr
-          existingSecret: ENC[AES256_GCM,data:lvGugwt7hGbPGF9JSn88B1c=,iv:1Zqze/jXv8kuVNdGdJB9PwvMFHWBihIsEX9jJo7DQvg=,tag:gSgFdyI7HfAj8dwoGd2kbg==,type:str]
-          clientIdKey: client-id
-          clientSecretKey: ENC[AES256_GCM,data:6vvWWtiomj1TpNJ41g==,iv:xb9HfW2MQNs9vLmPxujUV8us8Tce08L3si1Qd/CCwWk=,tag:LQdV0f79n9NqKBOrh6DDTg==,type:str]
-ingress:
-    enabled: true
-    className: traefik
-    # The engine host: CLI intake + the docker/apt registry front-ends.
-    host: api.saggar.dev
-    # The chart's default annotations are nginx-specific (SSE
-    # buffering); traefik streams unbuffered by default, so clear them.
-    annotations: {}
-    # TLS terminates at Caddy with the cert-manager saggar.dev certs;
-    # Caddy proxies to Traefik by host, so no tls block here (same as
-    # pkgatlas's ingress).
-    tls:
-        enabled: false
-ui:
-    # Sign-in redirect base — the UI's own public origin.
-    publicBaseUrl: https://saggar.dev
-    # The engine's public origin for the docker pull / apt usage lines.
-    # Set explicitly: the chart derives it from the hub ingress, whose
-    # tls is off here (Caddy terminates) — that would render http://.
-    apiPublicOrigin: https://api.saggar.dev
-    ingress:
-        enabled: true
-        className: traefik
-        # The UI lives on its own host: the engine mounts its API and
-        # registry surfaces at root (/v2, /apt, /nodes), paths the UI
-        # pages also use.
-        host: saggar.dev
-        annotations: {}
-        tls:
-            enabled: false
-docs:
-    # The chart deploys the book by default; the ingress renders as
-    # soon as a host is set (no enabled knob).
-    ingress:
-        className: traefik
-        host: docs.saggar.dev
-        tls:
-            enabled: false
-sops:
-    lastmodified: "2026-10-01T17:39:26Z"
-    mac: ENC[AES256_GCM,data:1pn1rHaCx8eYYR6NPt6hgUEwDxRYQQtgkklSu6FroH92gUq2jhX3420lzboTMvvpuBF/vqjbuw1sIR60YfZZ8R5ahw7CCcv8L5sfz9DhUU/vMBYF6r3HDY70AnXkPK3+rPw6ZofB8h+Y/DQEBpPe/LeDEPCOGQjIml349yAvMIk=,iv:A6/PeL8JuFtzS0hMAiP2/dvbXq7Ob3o9VaA0pE2IWEU=,tag:GV2pspKqmaQjafkp4HUwSw==,type:str]
-    pgp:
-        - created_at: "2026-10-01T17:39:26Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ/+PFcuCPKb5Mpej7uym38cwwVgjaJoaeLrKpfWBw4CEy3v
-            PbJgTS7kNKyjHqoeHQcLZZwmms1//b7XQfX2kPnNJIo/06cAgYv5AJ4etMNJ3hys
-            ShuiTMmMayKg2U8TdMhzwKFgymhQ5PUzGU1Xg2D9J1hUgW/rRVOb5wHKsBgYkOIx
-            ufuQpPhNm9j1xOqWtnf6xCRbZ1HRlE6mAX+4TvRJk/x3U1YW1gI2neyEtFiuCsCj
-            PSO9W+5WovDLQlCmGRmCweUwODShpdVqBEoXSS3wjGihz9xKH3lS+NnPZVMoeurE
-            kzHjTxQgv4ZLDo9OuXcZz5mlXju9tmvkpLpqP1oHnN+es6Ks0jIpZcvXaZvvF4W5
-            CLsC9dDplvAA3IpiF6+vpdDL0/QHpxo61V4jLLqO6o84x2jD1odR+zSkmxUxaQ94
-            hxlPY+DGTrvHV0qOWlWLLZO6ddwOqeUC6ntBiZu3FG3UwTwPv9YXvi+ApP4Lylov
-            BNKaCxKLalD37BKcPrpaJBwucME56Ny9p0WbHUaBNv74UGIKqPl6BI+9z7oObsrT
-            YfmcB0Wlpz8N6SHntYJDhLJktJ27csy6BTPjQsFEK/dHbGyR5X4CiBSehqGd400s
-            bomyLdR7m3g4fFG7Qq9Wzh8MA2WC6Fx+ExUXz91xrsejEJhckUl9N0sQDdCO3trS
-            UQFWjDQEh9LAJ3U/nQ0SWjaNnJ25U0qJ9qMZYyDDR2aiMqRAwcOZc315S+S/FrGE
-            lMkMngLiKqznm9GSsgcBgRIcqovbJr1gCJS/b2+4abjQtw==
-            =gAn1
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
-    mac_only_encrypted: true
-    version: 3.10.2

kubernetes/system/flux/cert-manager-issuer.yaml

@@ -15,7 +15,6 @@ spec:
   dependsOn:
     - name: cert-manager
     - name: cert-manager-webhook-ovh
-    - name: cert-manager-webhook-porkbun
   decryption:
     provider: sops
     secretRef:

kubernetes/system/flux/cert-manager-webhook-porkbun.yaml

@@ -1,20 +0,0 @@
-# Flux Kustomization for cert-manager-webhook-porkbun
-# Depends on cert-manager being fully operational (CRDs installed)
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: cert-manager-webhook-porkbun
-  namespace: flux-system
-spec:
-  interval: 10m
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: homeprod
-  path: ./kubernetes/infrastructure/cert-manager-webhook-porkbun
-  dependsOn:
-    - name: cert-manager
-  decryption:
-    provider: sops
-    secretRef:
-      name: flux-sops

kubernetes/system/flux/kustomization.yaml

@@ -6,7 +6,6 @@ resources:
   - webhook.yaml
   - cert-manager.yaml
   - cert-manager-webhook-ovh.yaml
-  - cert-manager-webhook-porkbun.yaml
   - cert-manager-issuer.yaml
   - caddy-certificates.yaml
   - stalwart-certificates.yaml