build(deps): bump caddy in /kubernetes/system/caddy

Bumps caddy from 2.11.2 to 2.11.4.

---
updated-dependencies:
- dependency-name: caddy
  dependency-version: 2.11.4
  dependency-type: direct:production
  update-type: version-update:semver-patch
...

Signed-off-by: dependabot[bot] <support@github.com>

.github/dependabot.yml

@@ -12,6 +12,7 @@ updates:
       - "/docker/home/node-red"
       - "/docker/home/zigbee2mqtt"
       - "/docker/infrastructure/mail/roundcube"
+      - "/docker/infrastructure/mail/stalwart"
       - "/docker/infrastructure/network/traefik"
       - "/docker/infrastructure/squid"
       - "/docker/infrastructure/sshportal"
@@ -55,11 +56,9 @@ updates:
       - "/kubernetes/system/blocky"
       - "/kubernetes/system/caddy"
       - "/kubernetes/system/cert-manager"
-      - "/kubernetes/system/cert-manager-webhook-ovh"
       - "/kubernetes/system/coredns"
       - "/kubernetes/system/csi-driver-nfs"
       - "/kubernetes/system/external-dns"
-      - "/kubernetes/system/longhorn"
       - "/kubernetes/system/traefik"
       - "/kubernetes/tools/dashy"
       - "/kubernetes/tools/glance"

.swarmcd/stacks.yaml

@@ -33,6 +33,11 @@ roundcube:
   branch: main
   compose_file: docker/infrastructure/mail/roundcube/docker-compose.yml
 
+stalwart:
+  repo: homeprod
+  branch: main
+  compose_file: docker/infrastructure/mail/stalwart/docker-compose.yml
+
 traefik:
   repo: homeprod
   branch: main

dns/production/vhaudiquet.fr.yaml

@@ -77,14 +77,70 @@ _25._tcp:
   ttl: 300
   type: TLSA
   values:
-    - certificate_association_data: CC6230E3A88A173D11C7F614ACFB4FE7B57A01F649ED1ADEE5F953213D4C6607
-      certificate_usage: 3
-      matching_type: 1
-      selector: 1
-    - certificate_association_data: 731B7CD6FA08C4A56060172BF8E30563919139F16265A38EC35B2A1F41CE2B6B
-      certificate_usage: 3
-      matching_type: 1
-      selector: 0
+  - certificate_association_data: 5dfdb3cf31b26f23d87c09f3a0cef642f64069a9fb7cfe29270bb5dc0f1e16bb
+    certificate_usage: 2
+    matching_type: 1
+    selector: 0
+  - certificate_association_data: 76e9e288aafc0e37f4390cbf946aad997d5c1c901b3ce513d3d8fadbabe2ab85
+    certificate_usage: 2
+    matching_type: 1
+    selector: 0
+  - certificate_association_data: 4e32b7ee52c9bd2a15b2df3cae5e3b060d737d71faaaac25336c5f193cbdb52ed2fdf38b29aea9fb97f59c8f86e75b5c364309a232623a99e638116ed66063fd
+    certificate_usage: 2
+    matching_type: 2
+    selector: 0
+  - certificate_association_data: afab698cbbbf892ebb555e09175056c1d4630fe7c350f44dcc6e71843d3b290df00d30ab4e356b630c69169d7633788338922fb637cf5b9f7be20a413eeaa518
+    certificate_usage: 2
+    matching_type: 2
+    selector: 0
+  - certificate_association_data: 3586d4ecf070578cbd27aedce20b964e48bc149faeb9dad72f46b857869172b8
+    certificate_usage: 2
+    matching_type: 1
+    selector: 1
+  - certificate_association_data: d016e1fe311948aca64f2de44ce86c9a51ca041df6103bb52a88eb3f761f57d7
+    certificate_usage: 2
+    matching_type: 1
+    selector: 1
+  - certificate_association_data: a1ef14fea3ca15a552d42665d2fe685672cfdd903de4b370b0d7d87c6d31b5df07142483f36e0e15e16b58f9ba1cbdeeebd4bcb8d74ab7ea32a087db2105f402
+    certificate_usage: 2
+    matching_type: 2
+    selector: 1
+  - certificate_association_data: f8a2b4e23e82a4494e9998fcc4242bef1277656a118beede55ddfadcb82e20c5dc036dcb3b6c48d2ce04e362a9f477c82ad5a557b06b6f33b45ca6662b37c1c9
+    certificate_usage: 2
+    matching_type: 2
+    selector: 1
+  - certificate_association_data: a69ec216999308f0ee575cdef98d6edabed8a6b4d2328e050ac9c7fa06404ad9
+    certificate_usage: 3
+    matching_type: 1
+    selector: 0
+  - certificate_association_data: ccae2719a01f7a6d17d939d8ec13324b7bdb0921ea55d5bfc2f226e54b8c15dd
+    certificate_usage: 3
+    matching_type: 1
+    selector: 0
+  - certificate_association_data: 7cd33aa6bafc850cc89d008fbd0a5cea942c6a573d605984f174fbe7360abbf71fc157ffe0324e380a8dfea62047b9aa140d5899188402ac677c29f96cc1118e
+    certificate_usage: 3
+    matching_type: 2
+    selector: 0
+  - certificate_association_data: 8149784990ba7e448295f9c4eb22abcaa4ecefa1b44f1a71ea13d6827d7068c6469cf5fb08a8ae772c1ef59cddbcfd84d744713c48e985136a234b494511fd03
+    certificate_usage: 3
+    matching_type: 2
+    selector: 0
+  - certificate_association_data: 08f3ffd1b6027093c136f6bb5bc1645a8db31cf2a4392b779c2a2045e152b8b8
+    certificate_usage: 3
+    matching_type: 1
+    selector: 1
+  - certificate_association_data: 12b3946513281ab20ebee4d38d2e139cac1688420015db90ee8e932fe153bc89
+    certificate_usage: 3
+    matching_type: 1
+    selector: 1
+  - certificate_association_data: 7b60aee1a230de2c32c0252540c606897ad66cbabc7331c2d40b7dd0e3249e0cc53e145605e610d8dc2f41dd16e12f51dca4641d13e748553bd0f596455dae77
+    certificate_usage: 3
+    matching_type: 2
+    selector: 1
+  - certificate_association_data: 8cee22274c3f828eda9d18c9954ed0a3ad5172e71b7852c780384bf3828ff1bb26fca899395e99e4d191c2d1e0a55404f97e76bb7d4ad8dff71c6c271d34de49
+    certificate_usage: 3
+    matching_type: 2
+    selector: 1
 _caldavs._tcp:
   octodns:
     cloudflare:

docker/home/esphome/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   esphome:
-    image: ghcr.io/esphome/esphome:2026.6.4
+    image: ghcr.io/esphome/esphome:2026.6.3
     ports:
       - "6052"
     networks:

docker/home/zigbee2mqtt/docker-compose.yml

@@ -2,7 +2,7 @@ services:
   zigbee2mqtt:
     container_name: zigbee2mqtt
     restart: unless-stopped
-    image: koenkk/zigbee2mqtt:2.12.1
+    image: koenkk/zigbee2mqtt:2.12.0
     networks:
       - default
       - proxy

docker/infrastructure/mail/roundcube/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   roundcube:
-    image: roundcube/roundcubemail:1.7.2-apache
+    image: roundcube/roundcubemail:1.7.1-apache
     container_name: roundcube
     networks:
       - default

docker/infrastructure/mail/stalwart/docker-compose.yml

@@ -0,0 +1,40 @@
+services:
+  stalwart:
+    image: stalwartlabs/stalwart:v0.15.5
+    container_name: stalwart
+    networks:
+      - default
+      - proxy
+    volumes:
+      - stalwart_data:/opt/stalwart
+    ports:
+      - target: 25
+        published: 25
+        mode: host
+      - target: 465
+        published: 465
+        mode: host
+      - target: 993
+        published: 993
+        mode: host
+      - target: 587
+        published: 587
+        mode: host
+      - "8080"
+    labels:
+      - "traefik.enable=true"
+      - "traefik.http.routers.stalwart.rule=Host(`mail.vhaudiquet.fr`)"
+      - "traefik.http.services.stalwart.loadbalancer.server.port=8080"
+
+volumes:
+  stalwart_data:
+    driver: local
+    driver_opts:
+      type: 'none'
+      o: 'bind'
+      device: '/app/stalwart/data'
+
+networks:
+  proxy:
+    name: proxy
+    external: true

docker/personal/media/films-series/jackett/docker-compose.yml

@@ -1,7 +1,7 @@
 services:
   jackett:
     container_name: jackett
-    image: ghcr.io/hotio/jackett:release-v0.24.2184
+    image: ghcr.io/hotio/jackett:release-v0.24.2142
     ports:
       - "9117"
     networks:

docker/personal/media/films-series/jellyfin/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   jellyfin:
-    image: jellyfin/jellyfin:2026070606
+    image: jellyfin/jellyfin:2026062906
     container_name: jellyfin
     networks:
       - default

docker/personal/media/films-series/wizarr/docker-compose.yml

@@ -1,7 +1,7 @@
 services:
   wizarr:
     container_name: wizarr
-    image: ghcr.io/wizarrrr/wizarr:v2026.7.1
+    image: ghcr.io/wizarrrr/wizarr:v2026.4.0
     networks:
       - default
       - proxy

docker/personal/media/youtube/tubearchivist/docker-compose.yml

@@ -31,7 +31,7 @@ services:
       - archivist-redis
     labels:
       - "traefik.enable=true"
-      - "traefik.http.routers.tubearchivist.rule=Host(`tubearchivist.lan`)"
+      - "traefik.http.routers.tubearchivist.rule=Host(`tubearchivist.local`)"
       - "traefik.http.routers.tubearchivist.middlewares=tubearchivist-headers"
       - "traefik.http.middlewares.tubearchivist-headers.headers.accesscontrolalloworiginlist=*"
       - "traefik.http.middlewares.tubearchivist-headers.headers.accesscontrolallowmethods=GET,OPTIONS,PUT"

docker/personal/radicale/docker-compose.yml

@@ -1,6 +1,6 @@
 services:
   radicale:
-    image: tomsquest/docker-radicale:3.7.6.0
+    image: tomsquest/docker-radicale:3.7.5.0
     container_name: radicale
     ports:
       - 5232

docker/personal/tandoor/docker-compose.yml

@@ -9,7 +9,7 @@ services:
 
   web_recipes:
     restart: always
-    image: vabene1111/recipes:2.6.13
+    image: vabene1111/recipes:2.6.12
     networks:
       - default
       - proxy

infra/r740/proxmox/kube.tf

@@ -1,9 +1,9 @@
 resource "proxmox_virtual_environment_download_file" "talos-cloudimg" {
   content_type = "iso"
   datastore_id = "local"
-  file_name = "talos-v1.13.6-nocloud-amd64.iso"
+  file_name = "talos-v1.11.1-nocloud-amd64.iso"
   node_name = var.proxmox_node_name
-  url = "https://factory.talos.dev/image/5a697fd6e91537a2c9c45929d004d82af180bb5d4e989dd8494e25fedca005bd/v1.13.6/nocloud-amd64.iso"
+  url = "https://factory.talos.dev/image/ce4c980550dd2ab1b17bbf2b08801c7eb59418eafe8f279833297925d67c7515/v1.11.5/nocloud-amd64.iso"
 }
 
 resource "proxmox_virtual_environment_vm" "kube" {
@@ -89,12 +89,6 @@ resource "proxmox_virtual_environment_vm" "kube" {
     vlan_id = 2
   }
 
-  network_device {
-    bridge = "vmbr0"
-    model = "virtio"
-    vlan_id = 2
-  }
-  
   network_device {
     bridge = "vmbr0"
     model = "virtio"

kubernetes/infrastructure/mail/stalwart/values.yaml

@@ -19,15 +19,15 @@ pushShard: ""
 # with these credentials on every cert-manager renewal.
 recoveryAdmin:
     enabled: true
-    username: ENC[AES256_GCM,data:83oORcE=,iv:X07gQXkAx2wdqEcOPi5mGTVoFkJjDHBKMCYUjpg3qv4=,tag:qvspLaPSsrld4UV/qXb0cw==,type:str]
+    username: ENC[AES256_GCM,data:N8MwV7g=,iv:ipHgAWJ6J1C7TrugLLeJrV/IVk9xfC8DvCMBfIDyJMk=,tag:OwbcThuQhS/aBLH0tyewnA==,type:str]
     password: ""
-    existingSecret: ENC[AES256_GCM,data:KuZYrQk+YQhciNRTHqOlZdqZWJ3o15I=,iv:x/cm4USFZqWE5xuuF7tUPm593NqX1kbmeKv0x2wzk8s=,tag:G9FRYYaJhWovN+LB/gLaoQ==,type:str]
+    existingSecret: ENC[AES256_GCM,data:tGvczUq1+EDNR8CAFgLTMd+/N3v7Vig=,iv:XYrfBXYGexxUXskRJDSYx02D+nIYUmNtSCScplBenZM=,tag:/MZ5H6yuJlD7D6TN8CwVuQ==,type:str]
     usernameKey: username
     passwordKey: password
 # Recovery mode suspends mail services and exposes only the management listener.
 # Ship production values with this OFF.
 recoveryMode:
-    enabled: false
+    enabled: true
     port: 8080
     logLevel: info
 extraEnv: {}
@@ -40,7 +40,7 @@ bootstrap:
 # certificate.yaml (letsencrypt-production, Cloudflare DNS-01).
 mailTls:
     enabled: true
-    existingSecret: ENC[AES256_GCM,data:Y+LfFx7nuCSMGqo2o3QoHG1Br+MYlQ==,iv:dLJDYmK2gEmNq5VnbpEJWFM1xLLT5jXqxB2WQQ4dr3E=,tag:Ya2cTf/ZpJdzFnwH53iZZQ==,type:str]
+    existingSecret: ENC[AES256_GCM,data:HkvfPP3KuHm5O81LrSA6Slq0iH88rg==,iv:nHnYsJ9uaRa+rKE20bVuxyruM7kepPX21Hhbl2uvuwo=,tag:YUxgSPhFyecT3ls2sEqEVA==,type:str]
     certKey: tls.crt
     privateKeyKey: tls.key
     mountPath: /etc/stalwart/tls/ingress
@@ -84,6 +84,7 @@ mailService:
 # No TLS block here.
 ingress:
     enabled: true
+    className: traefik
     annotations: {}
     hosts:
         - host: mail.vhaudiquet.fr
@@ -105,42 +106,32 @@ resources:
     limits:
         cpu: "1"
         memory: 1Gi
-# Override chart defaults to add fsGroupChangePolicy: OnRootMismatch.
-# Without this, kubelet recursively chowns every file in the NFS-backed PVC
-# on every pod start (15k+ RocksDB files), causing multi-minute delays.
-# OnRootMismatch skips the recursive chown if the volume root already
-# has the correct owner (UID 2000).
-podSecurityContext:
-    fsGroup: 2000
-    fsGroupChangePolicy: OnRootMismatch
-    runAsUser: 2000
-    runAsGroup: 2000
-    runAsNonRoot: true
-    seccompProfile:
-        type: RuntimeDefault
+# Inherit the chart's secure defaults (UID/GID 2000, non-root, RuntimeDefault
+# seccomp, drop ALL caps + add NET_BIND_SERVICE for privileged mail ports).
+podSecurityContext: {}
 containerSecurityContext: {}
 sops:
-    lastmodified: "2026-07-03T13:00:45Z"
-    mac: ENC[AES256_GCM,data:qoGDDt03xtJbPH+I3edSsFJagZSlCcMk4XoFc/I2QZEm+45DjsCWe9Q7e9zhn5kF3HBNBwNCgEzJmq2Fn/vemMWHwI4+QZW6nkk5cYTb3r8+WysSeUyt2+Y7EjyQGwI6+2LrCBlJIqmKfpPtT7Y8ZbwRBedoVqFtnNVH5441FMY=,iv:fvfnedCEGXyPw4yRLCtKoAnzz8h3jyJOwpqA33NNJOI=,tag:fPd7RJAMMounXVkIoKrptQ==,type:str]
+    lastmodified: "2026-07-02T20:57:39Z"
+    mac: ENC[AES256_GCM,data:8xnZW0A6hsysCDpfhfXnQ+NMc+VTSRwkMj4u2p2ERG8lj132dg5ErYG106jkQLXB3IkzxiAY9uyoquTpssVCOMemLRP9HgZmzqadI6kfpE2HZBHktgeY6MysF14RE4ep3naci0wVvpFiKv+sgr9QIbBmMnnN0pYwx5tASVFSgJc=,iv:KccW9I3LmxEmVfAnXjKz66FO1LgIO86zCFqp2/ulp4Q=,tag:xCNcgbHlttioSCvoZamwWw==,type:str]
     pgp:
-        - created_at: "2026-07-03T13:00:45Z"
+        - created_at: "2026-07-02T20:57:39Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ//WA7P2WeKV6QFKotw5UP1MXcdI9THypFFly4sweJ5MC+e
-            Lzy/zCidGCM3Cu+dJaaPJNKtfPfagQJ9FzHrnvRcHoCbKS7sTAqugdwt4uyplem9
-            l03kQWZfDj8R8MHQnAKWNmJDiJkjCoqHdR5f2JtS+n7MngI53SecY2fsFOXRbYJI
-            hfH1BR+agLjIHc+gOF340GJp4UT+Q6BZOKg8K5O4PYk1Xwj3pi6YFuhiedKHSybF
-            Ij9OWdTqpofeG3fhwd3jHLW+0WYiFNrVlchfClEDWMMc0UfS6Bfo96IL0JIoYlHD
-            4Zt8EEyjvAJ5478RTKTobMlsSUC5U51Wn6paapZ5zicCHDzdP2yTtwtSKK0Mdp3W
-            qt/pZoR4EyM+I2XCKp+z7N5FtH8cahtfZiUOBwQ4NK9Fz+2UBxtP2QzGj8YpJmWu
-            OkbGoSgwn+8bcNnRwnADTzdiTWf/a56WErp1NvuqF8VqdGzsJR9EgyYwENl+m+U8
-            fbTY58iAJDDpY5ipPL5v+lo0Fw5DrnQ0NPAm1ORi+rMJy0KUjgAzdS6lL5oWGfAC
-            rzbzThGpRt0E7O296pht8TCBFHqiKbiOdGEBXO3+w9NrvOgULno4+s88vu6KMvFL
-            s3MHz7oIgfwel7V6bVc/ZQvHYS3YHjG41fwn00cpKI/WRN8z5MnSwwkegD2Wv8fS
-            XgEqL6kQPgk97779c0jo9CJA8O6QaSvGyd1j680tN1NN9V64rJOaj/818SgwFLrA
-            XWaqrOnz8FIspqO836t6OaLq5WwzOtOR6zs7cUk6h1RHgwlFQ+0n1o6qYf6Q+CA=
-            =HnWo
+            hQIMA7uy4qQr71wiAQ//fdCucpqT55/e76AABnVcBvwM3s34HK33n+6bvEwE2jTr
+            IPU6UXEZZzMCuGnSWSSy07hSX/0rhw6ETLIJmEPQkqOnxk6T3rcz9+8fLPapfLjI
+            sxFayU+Dw/s2rycErhrPTxgwLp3FBlnyEf/Zk22emUYiXnxZPoh4oXA8bjrMzSXj
+            tD5SVhvbHAT4WqTgG1cYgZ6XaDJ1eODqPXExJf6EekPlLAC/ohzgtPV44WTFj2YU
+            nVKouOGsc6ZUXkEwOm0HZcfJ5PuEOtCQsvD7BSKuTMbP5CUA9iuuBIhC8PmbCqxa
+            630fP2rDyVyaRucrjUgO7/N0AfaymYysSoRlqGPR/fgt0iJ/jeOu8POQMvK51IQL
+            Gtvp663bJpooCh3ALfvQsGmkpsdQX6QttNYUFyO8yRNDhbYKfT5Ha27a/xUdOEFA
+            Z/imx8fjjH/Anj1n30cy5w/9sZY4lmmxmf/zQMhJMGsTy5efWxbg8DYVOan/bgP3
+            1ZMLYNwLxg0CPRPrJuZbI2Iz2d7GertI22acyAF7OCGljwg4lL/SYPIs02cKYuKO
+            x2M0fpTo7kWlb5CWwDkEfwU14ZmLw8buAvYeG7KblG11kZtgvbWB1LqoXU5TMv4y
+            gZA82VdTEUepOYavRMOaPScnyhCImdC/1xLH6gQCrk5qWZYVAy7GEvLRM19pWtHS
+            XgHxDIdiNeTVD5OuVsxpke02osFrfT8q4ybGJF8KH0ykebuegGtKZuCdncTc5Hnk
+            wnJjZaHHqWGei7pGHWeN6FPQ0jSj8nMosQEpxs1X1UZhUG03t141nCgduTiQZhE=
+            =63dW
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
     encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$

kubernetes/kustomization.yaml

@@ -11,7 +11,6 @@ resources:
   - system/caddy
   - system/coredns
   - system/csi-driver-nfs
-  - system/longhorn
   - system/external-dns
   - system/flux
   - system/traefik

kubernetes/personal/photoprism/values.yaml

@@ -23,7 +23,7 @@ persistence:
     originals:
         enabled: true
         type: nfs
-        server: truenas.lan
+        server: truenas.local
         path: /mnt/main_storage/valentin/Photos
         mountPath: /photoprism/originals/photos/valentin
 mariadb:
@@ -36,27 +36,27 @@ mariadb:
         repository: bitnamilegacy/mariadb
         tag: 12.0.2-debian-12-r0
 sops:
-    lastmodified: "2026-07-06T19:30:14Z"
-    mac: ENC[AES256_GCM,data:QgOnL1dsq2S78nRD+xe08w3u0+bRfNML/ea9P9v0TBCQq5EmKj6yPKJApvttyeGUDJDGo9Ds17a9XLDFtOl9ORoax6E50VqJSnc1ElE2l5EFogl3JPuMdQxEzXniaCjOSrfMNWNdo7fHN/qcX0Gzs7BL9pw+NyQLv4kFcDYQv78=,iv:buV08iLiLB5BJ5JYfn4blmFb/eu/EtpnWsxT5IfyXfQ=,tag:8egGKWNa7CEql9t6zWHlOQ==,type:str]
+    lastmodified: "2026-05-01T22:39:49Z"
+    mac: ENC[AES256_GCM,data:YGVQb50DrFv/ehU+dxsoP/e8ARKVPfr/6c2x1pQbZ7cNiNu7k1Zgt+bEHkkKm+FT44bltL374Jf2HqT/0gvmgMGp/8ukjZ5hRLwbqS1fOKR8SVQ8fp2EId0P7HcRl7Qqr6lF15hKXQ+SPl6KDPvDWKh0pq192W8dP76D7h5aKDw=,iv:c1xytratCfO8V4nkdvxeKT2kWOYHBkwoTc5Ic+yjpWQ=,tag:kdxAidCO1VLPxiwq3eCRxQ==,type:str]
     pgp:
-        - created_at: "2026-07-06T19:30:14Z"
+        - created_at: "2026-05-01T22:39:48Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ//Qg0OcwKr1mG40IoYmABD8b+/W+X5zTyyht9QCpNtRSVO
-            JzhtMl9YZHLqwkiwBqW+hvfIKXYtYBNl2TsAZ57xcE60lr72bHfqXkO24hf9+jvq
-            jmFwK1Mo/zf0/b3R8gFqEmg5mW97jdmEXHfRrzzyaAXhGk0rWfLGBSbaif71a/dj
-            jVu+Vf48LsEnUYH3oO2ASY3OlVwKAn5njfyIz2MWwY5iohOsiJwJu2WiotI+zCFI
-            VOfftPCYvJyVKGG5bE3GHOjAlbNqHtRCn9Bm/mXQVyLkAU9ik+i1PABGEU9nc09q
-            +IcO3Njo7MRtZU9pctMZLvRSbxvEx2bZOKSXe6nhVK324Qr0cETX+/GuDZn3SeVy
-            pyHR/BtpGXtqyWsaQyCvPUyOcU6IV/QP1P/8ovCK6Fek54xqrptTCYnov7U4VTBN
-            WhVxpTY19ZlxPxY+umhhg4bTf6oiRKGMXPe3MlYTGN4DTF3NE8g+Rld860GypHTt
-            yHYr2sdibLV34JZk8W/E1S5RTeTWjKxMUHZCYaNadQEQRwyRWmFTdHkPiOLHOBru
-            TBYAZJHP4DFegHL58+Z19vjdHtOHWMQWWKYNvKzV9m1lzbgT/MhrHqeGEWSQ9Tu0
-            kcvDK9iTfjgZyISPe8rpDM/6YZMSydSUgQ8TiE6YQFsJ3rkyRSEKSkH6CcqUD1jS
-            XAGv1EpFowmHVUXzMY1TciufOek51nEDfhbzpCX9QeyKIn7MVAZSWhn83vQUBNiH
-            Y1wrvUB2X3egY6jQVv7nalsNvU7CeEvzxi1YrM7YtoSO6yPY7z2A6e/4Ev0h
-            =krxN
+            hQIMA7uy4qQr71wiAQ/9F+u/hWM4smi4yqnU7vzRfWwjCuvdtWAR6N4MqiBLFfqr
+            tpzY8UCfaTlfEtwDZWUSN/gzZG56YcMTR6OOrCQ8rkiKYGwuj92Z8LgpcDRBAHeG
+            gYaNG9vRmmzyZpD6K6pSoG8lk7mzB1Tp80me9E7LJTDhAn70cDATLp1wADkD0KF1
+            pq44qPcRaem42kEx6Um1sAy5NiBBxvYqdKPRXLs0q1EyZByxKjlhZi0qasCfe4lJ
+            fsdduUgRi3Td7KvfhQ1e6jjNNMpyZIHbME3Hn18h5PxVd1B3FzzBzSHlaDKBQsYT
+            2cx6VMGVqM4dy+CHkpE+QlAA0EOhS0b/7FwppCgEhlEvbH7uCjq/13vZdKoUIwqt
+            AaHPaf/HX7PipQjoQf7vjfaMjPwCFwqoeK2cVNmgK0j0b2CyjLDDs5xh0SuFt/Ia
+            DviSBGNeIv9Vhm7jhlJH0odFzBmBOkiUyUFV1h/6u2qpjz+H+qAX+5xx/++cGkW6
+            4G69+7NP6JUksSbcvAl6Nk1sRsvTrcRdpmBO42/aUq7nlgOAxk9e0y7INYHe3Ycv
+            N7ZTm7VOuIVopQfl8F2/tOIdJIm6hJfmJ/hdhxbDZKSRiejenU7vgdQgTM+PQ0l7
+            0QVRP1mahh1EqsyqFrrVpv+o7XQsyldb8KCefWMEMGHrot944YTxzfwY3riaPXfS
+            XgESSHvPYIgLIj+6bvvopB5v2q+NwfBciOrZekmWYTkN6cFOizp36JKIOA4Dq6z5
+            0hwGgiPvYsu9WgbWYUY21qO9jvDmjT5Yym5ktbNogckXw3/TusVqPeAkdNIjZNU=
+            =PSUH
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
     encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$

kubernetes/production/vhaudiquet-fr/namespace.yaml

@@ -2,7 +2,3 @@ apiVersion: v1
 kind: Namespace
 metadata:
   name: vhaudiquet-fr
-  labels:
-    pod-security.kubernetes.io/enforce: privileged
-    pod-security.kubernetes.io/audit: privileged
-    pod-security.kubernetes.io/warn: privileged

kubernetes/production/vhaudiquet-fr/values.yaml

@@ -39,30 +39,28 @@ nfs:
     storageSize: 10Gi
     # Storage class name (leave empty for default)
     storageClassName: ""
-    # Allow the pod to start even when NFS is unreachable (uses emptyDir + initContainer)
-    softFail: true
 sops:
-    lastmodified: "2026-07-09T14:38:39Z"
-    mac: ENC[AES256_GCM,data:CTnqJl6YPYCt3E0A4QAyt5guqgqiNfFk1xJPAvNM1/kv4HbEVeQxG349AaRSc8bQXcMBIVMf022L4+r0DnTEnyy71vMJwWAJTpnEKBQNaDZNCBraGcznSpOP3t7xibjsQ+pqx6d8xXUm9mDfIJU8Nmqvq+iGEUM1PYsKYfDwhQc=,iv:yBZlb8SujF8nv796elcBMQWbyBg+CQ388UzjVqUUyt4=,tag:P9rW9vl5vkuVFv/RM3gGcA==,type:str]
+    lastmodified: "2026-05-14T09:33:46Z"
+    mac: ENC[AES256_GCM,data:R5ular4bAyV0cFPGUGYg4NWCGI64rWTax6ObBnCadORwSTh5/VQN3bsDDPFC3dep/7nKzY71d2X4qAcVU3RkWa9eMP+e9dhaGV9/8gvY/qDXZiNEuAXsmpaSATgUo6mUwqrwl5tn4ono4ID8gr7FRVpneTbYX/HpiWDbBa9l1Xk=,iv:wQ552gswkX5aOy/Cht1zY56camnb8EhEwy711osyf4c=,tag:t+U/1wRD7/z39KY9zjNcMQ==,type:str]
     pgp:
-        - created_at: "2026-07-09T14:38:39Z"
+        - created_at: "2026-05-14T09:33:46Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ/+PV8hvPHvkmAg1BLaMWbpkMD0Y5/+uQbnnEfIaJdiE4VG
-            bxtqfBeB/f5kfLDoeVZOCO64tuLtljiZhGjFMA7qESLw0qAvRaDJhXZ9qD1cWSgG
-            DgVhp/4lb+yo37lLUYaqfeRDD5GTXOpKSZOf5WFPr5tsiL9YcfWVVWaf6uSjUl7I
-            OZkDwi3sDfypuen12I9BM580QRamQzsp6gCynQdE/4PjzND9vAvhEBtftZPLmd2/
-            5O4XgjaiJXo2PstAD3VD7c7vGbtEUfvn0vmd79yHz1YBtHRYtDfmnWwHJjeOpxP5
-            ooFW3uJuwL3N9/IaFTmgGHynjhQAqVdC79PL4XSVkSMoqdW8YDHBgErH9WI4Lsbz
-            vl2Wp9eIeopiyIzGXHsUvv/nP3ayp9pS16fV9xJGVczSi5c5YqFRYGtX7QIyXtqA
-            syQlnzoVr4MeT2A2MNdJEWKtfBRQoQR1Qc7ZX/XwfR4b5/58ci9HwBL2eLu0GzRg
-            e8LDnZsGQCozI7h7x332+Wu/9Mbs0wJ1TslQbXt2vRhbve0IvPjNSi54RKI4r8uV
-            /iFnRqPp2ow030nvW+LYt5jcqyKK9poC9nVoytUU57Pc3VmyppOJxc8/AfIezo95
-            LFFWj2CjWr47UspHcqgk84cBP13LmUhK7IeHNBzoWl6LPztuVCczoy7wxn8fGCfS
-            XgFm8RoiId9S5XLhCZ7qV70HhWOZemd0PksBP054xuWvlDMe/HqxvxUmqDbH/vGv
-            49o6a/FJyF2ncU01j72KMyn/ZbYevniX+QG+U7vWuhVRH9tRYYQUrgC0QnPqFKc=
-            =duXn
+            hQIMA7uy4qQr71wiAQ/+JAzu9u2Dgn+lA58pIhRbM1064juEOvebtBK0FdJCi7AG
+            /Up2oooBmLMxybk16q0800kZHgOAcqTWkRcDq3QhC7nK+xcs03plTLLAlqfnh2x0
+            XyqQVk4du9caRdgvgN96tG+oWUJcuUJ/uFunXAzRvPnNysS5sGXVKJmbVVKfTjqk
+            UPyA5sBbCIxW10kPZJjprR1HaRl2dkgz7jZI/q2RXhFjCOhthMErBFr4f6xD3LnN
+            H5XVtixNcVmIinsGUIgvPW+qknjrf17ammgEtOqjtuu4PUevQFt4zkVyjU0Y/ASj
+            HAyYgSNIAXanb3u9ulL6CCg/CXJSofTrexw5RPM9eTQQ7S1KqHm/Ns6jjl/jXtEW
+            cIQZ5bQJPTJu7W9gxGpgaLmWwGfoDWvmT2rIFYC9tf+61F4EbRvY6KepKET9NYTJ
+            EnyDoxRsfVgxwQjyqpIpmNewWpgWwcLbD8INoJUVx/Yr284F9pBCgKqKRmeNH/Sy
+            kEt3QD1ElohuwTx7XLkYf6LuDFy8kA5wFUPKUgxmoFsGZhMhmi8ysUkUxtYPPMD8
+            YLVOK8UX3sYUDdY7tQjlgz6nhMqGL7ekqxyA5PSCGlhg5siKIhltz1CzadNOrsqF
+            jHkiUCrDNu1ToRPllOw4WMwSzII/sf2oP3FJyE+/Rsl49rVjELLfC8eWPhG0yhXS
+            XgGHbmvrm1QPl70dF+896QE/XtSydiqLUynCeIAvh61//ipS9lSZXpdDKEP5Q7ZD
+            /lTbPRH7Y7EZUgarjBtc2wYg3iaBkELtS5lnQeJawHQ8/M3TxdWmgEeBim/qr+A=
+            =K+50
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
     encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$

kubernetes/system/caddy/caddyfile.yaml

@@ -2,7 +2,7 @@
 # This file contains all route definitions, imported by the main Caddyfile.
 # Edit this file to add/modify routes.
 #
-# Certificate files are mounted from cert-manager-managed TLS Secrets
+# Certificate files are mounted from the caddy-certificates Secret
 # at /etc/caddy/certs/
 
 apiVersion: v1

kubernetes/system/caddy/certificates.yaml

@@ -32,37 +32,8 @@ spec:
   duration: 2160h # 90 days
   renewBefore: 360h # 15 days before expiry
 ---
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: semery-fr
-  namespace: caddy
-spec:
-  secretName: semery-fr-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: semery.fr
-  dnsNames:
-    - semery.fr
-  duration: 2160h # 90 days
-  renewBefore: 360h # 15 days before expiry
----
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: wildcard-semery-fr
-  namespace: caddy
-spec:
-  secretName: wildcard-semery-fr-tls
-  issuerRef:
-    name: letsencrypt-production
-    kind: ClusterIssuer
-  commonName: "*.semery.fr"
-  dnsNames:
-    - "*.semery.fr"
-  duration: 2160h # 90 days
-  renewBefore: 360h # 15 days before expiry
+# semery.fr certificates are managed manually in certificates-secret.yaml
+# until OVH DNS API credentials are added for DNS-01 challenges
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate

kubernetes/system/caddy/kustomization.yaml

@@ -6,6 +6,7 @@ resources:
   - repository.yaml
   - release.yaml
   - certificates.yaml
+  - certificates-secret.yaml
   - caddyfile.yaml
 secretGenerator:
   - name: caddy-values

kubernetes/system/caddy/values.yaml

@@ -10,7 +10,7 @@ image:
     repository: caddy
     pullPolicy: IfNotPresent
     tagSuffix: ""
-    tag: 2.11.2
+    tag: 2.11.4
 service:
     type: LoadBalancer
     externalTrafficPolicy: Local
@@ -35,25 +35,35 @@ health:
 volumes:
     - name: vhaudiquet-fr-tls
       secret:
-        secretName: ENC[AES256_GCM,data:mdTS+RBfbQiY0c5aezbTURE=,iv:gQRWoRmGujhptSXm16JhX6VSHbB4yMdC3T7tPH1vfJs=,tag:DViHZOwOIPmHJQWTPUO8cw==,type:str]
-        optional: ENC[AES256_GCM,data:apLSVg==,iv:4ZZa85zmTuYb7D/p4mLZO++esFrPQyQ5xHCtT+aghS4=,tag:wWAEf3XWYKvsjwpfpyCb7w==,type:bool]
+        secretName: ENC[AES256_GCM,data:vc6kDDdxbluL/BmJb4w9TKs=,iv:FLsFMqUQWs3vzuH6fO64qikNpSx/RGneZyow8WYXlo0=,tag:TVsfs/pUmiA6mYYwHgxDLw==,type:str]
+        optional: ENC[AES256_GCM,data:I1ftGg==,iv:P/KwiMPHM+YYUPJ+M5GBcgZGRTrIskbCir4fQH1XUug=,tag:hbqOTv6BrmkkQ/kE3bCx+A==,type:bool]
     - name: wildcard-vhaudiquet-fr-tls
       secret:
-        secretName: ENC[AES256_GCM,data:Ww5/viWqr5mI51FqHizTRerAZnEyQONqdEg=,iv:VAMLvZ9yJxUCh7Kjf43J+M+ellkm5Xi3ZD5AlO95Rm4=,tag:F6H8LBi9kL9rrXJgVSbAmA==,type:str]
-        optional: ENC[AES256_GCM,data:LQEFAA==,iv:JkudOsHgn8qLEwqWhsuWnXjpCLJ3XrEexXtzjmOD+/Y=,tag:amUBIkXQIZnGQtxAAQ5mcw==,type:bool]
-    # semery.fr certs from cert-manager (OVH DNS-01)
+        secretName: ENC[AES256_GCM,data:KSaPirEmnfOHqtwNr3SoK1IsCZ6HalzH2tw=,iv:TL9/VqSq2fW+2se9GK+bopfbcHu/lgpjlD4dHLKf7s0=,tag:SKgvfnPvca9o3bXxILLX9A==,type:str]
+        optional: ENC[AES256_GCM,data:65Ht9Q==,iv:EM0rH3i8MVVDXXrARxL6djISin8ScCEdZ/J43WL7A0I=,tag:rOcLiIOaDAqW4C5j6Zv+tA==,type:bool]
+    # semery.fr certs from manual secret (until OVH DNS API is configured)
     - name: semery-fr-tls
       secret:
-        secretName: ENC[AES256_GCM,data:dmLfoVbH9QKPMXPZZw==,iv:l9BKz66sdl9SssNzaz8yWoQ84ewDQprMv3rcHJQZhRA=,tag:NudQDM8eKC5aF6vX2ZQVVg==,type:str]
-        optional: ENC[AES256_GCM,data:Xc2tmw==,iv:xSa/xz/WibDqExKXjKSwLm5w8DOw9aZY44O1TZalfO8=,tag:Mpqi2ipn82+eWv8T2YvSng==,type:bool]
+        secretName: ENC[AES256_GCM,data:kDiP6Hg4nLMM4FY6/C21YnFn,iv:bFgsIMkgHfSy8ZsK3NLc9cZ/5TRV3B2WzWkCFBGl5uc=,tag:atz2qInNTSX3u9b5N4fPnQ==,type:str]
+        optional: ENC[AES256_GCM,data:vfjgpQ==,iv:XZBZyekKMQQzrFE05vG2w6Pwd2ZQ+RerjF/T8FKbuc4=,tag:SVRfxbOLG7z8fWyxclrvzQ==,type:bool]
+        items:
+            - key: ENC[AES256_GCM,data:UumzQqzt/iy7oS7P+Q==,iv:3zV2rTEpHclFVRYRACzrs4+IXLOIw8HMSgWLyQ6fLp0=,tag:rOlhuN2qIN0vtwgahtvKvQ==,type:str]
+              path: ENC[AES256_GCM,data:QfXoPe/t8Q==,iv:Cj/4ngLtDha5fd5d7gn6OONGNdAjoEwq1zJc+xxYJTM=,tag:9q1DbomT9p4DonVsu3OBEw==,type:str]
+            - key: ENC[AES256_GCM,data:m72H1Se5snCNyNpe9w==,iv:ybvgDs1PNalk3i50mkIbph5KWEUefaDyoVUvKjqoJP0=,tag:+0c/3vDxjbOp6qn5VXvPxg==,type:str]
+              path: ENC[AES256_GCM,data:DJT6fW8uZQ==,iv:ImJQ19fJ2PBwil64M/vUu2TAhVjTYK14rfiTojK2E7A=,tag:2OkaIF6u7hCqsS2Bkp9v9w==,type:str]
     - name: wildcard-semery-fr-tls
       secret:
-        secretName: ENC[AES256_GCM,data:jwwNceE6ZAD0bdUFceBBG+HQPjmLSQ==,iv:15rvS8NjtKszT8LFS9Z3DLCVMBwQ0GnY+o3DSr+G3jA=,tag:GMZ68i+1XmcvIJrOZxBo1w==,type:str]
-        optional: ENC[AES256_GCM,data:8p7hYQ==,iv:a3Al2ph6xuJCXkLaFW6K7WSJss51/d9kVrX3Xuh/5e4=,tag:JYUYRsmEN7brNrENFPe/DA==,type:bool]
+        secretName: ENC[AES256_GCM,data:AZVY6PS2tzVnU5mSVlbH621e,iv:HToh6ymWjFGK+xw1+MKAP2RGKJd+PuFC4My7erFeAOc=,tag:W2pksdZFrEFKzPrGwJ+d8g==,type:str]
+        optional: ENC[AES256_GCM,data:LbarYQ==,iv:FUiIoSlbc/5Tj1t2LIxEPC6Ey7DgSaezrr2+lTr8roY=,tag:dlqb5SFpm1JDwn9qwaTP8A==,type:bool]
+        items:
+            - key: ENC[AES256_GCM,data:8xY5dDL5KSNDAk1mTB58WtriIRNeFw==,iv:Ng7twP5cr/TfKpENug7kgZ1Pa24vhV0/wFtxCelRLZU=,tag:powPtyjVogU/NO4LSyT2pA==,type:str]
+              path: ENC[AES256_GCM,data:AIvmIcXtDQ==,iv:JshIK8HzTkMlZsDcdX0AIsrkyLST3qUdtLkEP29E/O8=,tag:njYcODU/bWN7XXDwsHV9Uw==,type:str]
+            - key: ENC[AES256_GCM,data:NqW+4UFJx3AjfS9BFoG3dhOsbHoy4g==,iv:TMMd96OebuBwBT80BzXDYHD/38l+cSDQ9q067/Dqkk0=,tag:IOL89DD3vDjbNm/qYbSUig==,type:str]
+              path: ENC[AES256_GCM,data:f5PVx/WfxQ==,iv:4aFgPWiyp0lnQFboQCprI9lAGCkSfrO03TlD/Pvx0do=,tag:aIvncQKaqtNu15jnpVSSww==,type:str]
     - name: buildpath-win-tls
       secret:
-        secretName: ENC[AES256_GCM,data:kTI0dBzdTAYXuvSZwZC9REg=,iv:xf4pQABQGiuv3IJtiZhNMsLeDPVef2awVW1DmDThOHI=,tag:74IqPca8TuCFuIpJ8RpQ2Q==,type:str]
-        optional: ENC[AES256_GCM,data:mxxqOA==,iv:p1omSzhLh4yYs303OZCE5DfCNrzjAxEo+TOfezw/oCo=,tag:4ye1QalWmtW98B37DtkcuQ==,type:bool]
+        secretName: ENC[AES256_GCM,data:nUF53gg1cNg5fEWLsXmEh1Q=,iv:XUxXBDMrddGey7eoIebW/myOD0P/UDhY6bX4QSzT3X0=,tag:foE8OG/JcknTRzsxiKKzuA==,type:str]
+        optional: ENC[AES256_GCM,data:tCGcgw==,iv:LxIjr/EsHifL36wFkc1rb1irfk9fyWAoBxGaf+ksu1U=,tag:A96i+w6cTAk7NTxumcXzGw==,type:bool]
     - name: routes
       configMap:
         name: caddy-routes
@@ -101,28 +111,28 @@ affinity:
                         app.kubernetes.io/name: caddy
                 topologyKey: kubernetes.io/hostname
 sops:
-    lastmodified: "2026-07-09T21:17:10Z"
-    mac: ENC[AES256_GCM,data:5APgoOMa+m5xjn+wurqyOtBoohpV271AnW1Ic4Thcg88bXryhr4Xn86Yo7fMbE+N3YqJMCaeaH6hm4iY8IIhCHgO2ybgMq50Bo8AqWxr6MKEpTJDQS5vSSWPq/Y5qr7B3f5/gOyxwIGslF4isVRaQzlcjoKzfvHsZX8SPdFhXT8=,iv:ZuareabZmxIyhh8kZs+eHGeUI7NZhzxER6KJE1/EiWE=,tag:zQuTYSrU76YEf1u2312ruw==,type:str]
+    lastmodified: "2026-06-16T10:08:07Z"
+    mac: ENC[AES256_GCM,data:HeWRLHO8x7tJ3fGpSW0Pz6tkuYgQh6QJHF3q9KZD8EgCyuxxrnRh74sEOF9e/KjtmaNKF2ak6QkR2Taa9qD3yblMJp9Zjc3ivC2aMEKxtdJN8B3bxRr1Ln1Na2kSny3+X/c1nC1swWyNNgeQJvKQlvhXjK5S56Y5NG/n/PBT3Q4=,iv:HyiLtk4ueORKezmpmY/I4vXPBwEudqkwNpk4fgDheeY=,tag:2W46a3geF4Fi8jDsSCPNjA==,type:str]
     pgp:
-        - created_at: "2026-07-09T21:17:10Z"
+        - created_at: "2026-06-16T10:08:07Z"
           enc: |-
             -----BEGIN PGP MESSAGE-----
 
-            hQIMA7uy4qQr71wiAQ//eR5eIclcLkl8wtERUoVHXL5KGKzEaxyVv9D5gHz51C31
-            kmAfrAnjT9G5UeeoJlW8XLkh1IWNhArNBMtoiCNUPAtfVDxszs5IwPWul+s3wJhc
-            X7sDq7EnIgaJr2IszIOTJ4PYxZ/uhyMdqmvRTZXMaz43F96cuDLctV4CFaiig4aJ
-            IcNlPIyYyS4tuaGB+ScLtbcDDhNc/8VRWn09SRtpTop+PV4KRX6AqLmhGOc9Jf9l
-            Dg3Gqdkaxl3OuqIvcrTmEPBe3sjnjIIdtJeG4SAbMUzj1xoKupXeDBZDnfmS5nku
-            42WR5H4RInzusj5NXP50C7AeLD4qavB9hl5CaxzA6TVG1X7LcpmcqBsVVuFcSjZj
-            T80iKklV6Ct0MLlmbxlKFTJm8fSKevhS/hdfrkUNcqc4N6eBb8tx93x+FcDn0A6P
-            c1zPSKj1vs326nJSHw87wvooQWn/f9j+Om1KLOR/MiUWmoEAbgkIHi3+k2wpzFb/
-            faKpshye0/XA/CZHFePv/U7sw8nKhfPhJCuO/IRrHKYzx0u/aqgOtPCURh5hS/fU
-            8dPQkbywgN67IRRKVz70cxn367cP1vn7L1AmzJfBd56NnViXXlS/DuitpnyTQpnP
-            tLG6qelq3Ul2A1J3BB1pfHR27IpKzd1UPD7HMhvvgSA7ErLq/VhF/kT1dx6s1fXS
-            XgFZ5XcyJQRc4Uxh2eFeEPOdWMAFRps6scfBsQuWR8m3cQvLatzcku1S/YDp56Kn
-            oUZmfvdQGpUuxsumVYCqk1+mQn02lkA1p2Y4ztrpLDCbhZXZ/fIT6Y1uYX+c0ew=
-            =0kw6
+            hQIMA7uy4qQr71wiARAAhoTczAWaCpuZbHq+NrssLQG4Ys0yYNYM9nflFEOkD1Sa
+            rTEAhJACKNFYKJ6P2V4rBQtKHRdqMdVfrtaumgSvuKBX4wJW+nG/LUSXENJV/UD9
+            VqxiujfWKgps4XfNfuM/a7w9IbU7rk+mh+LBwwRpQeqEs7j1eZnJjQCBW4zGFeav
+            XWYx2VmqfwQ/XhVaiSCvJjeJJk/U54Dot9W2ZoKCX+5zyZ+dWsX2ggXQWsoQCfOK
+            uSTjjVKw80VvrDMX/TfbvNQDHNsljOSSeScA+lx6HElbDcAyUHxE99UAi6RVQazm
+            EjEHsVHvyR0Y/7hvVlo8FY7XS/81pXGLN22AcWbd1fIZlitRa9YbHZH1YWzWRzr5
+            JB2S+UMEOigw8WPg/1BAiFj3bCRn8aDyAMdUEKlbcXCYwoLynG6zVbgeuntYq0Zl
+            Y4zAi4+G+fHvdAqQz44p+AyP9hgS/qMBQwsUnAxGfltfVBEew2I/Vz5OugtDyLIW
+            UYrk+5LR+7cfJNCyCHQEyJL/YPsL1GDR1SP5YCrsDnuXPCEgwyRRLHFW8j2KCtLu
+            YX59FbVLqo2xzT5nEaIYbLLhEq3+5KaVIBqzGWAwSBbu7bXru6jIG6prVwofJQxx
+            HCz2leboRZ3ZrC4Y4itHHuMfmSCtiildRhgPtVnvUdiQz0dS+RLNesH4hRvvxBPS
+            XgF9gp+9JE/5XMxUmNNf0yUC1mlQuUHbC7JqLLpLBNAtQwljDLMIgPG0y5n2r0C3
+            zokdaebVj2XV9r7X25SQMyLzTdoXYqgGsoPBFnqQNpycg2HpmBX9isvqjbZ6x/g=
+            =AqxW
             -----END PGP MESSAGE-----
           fp: DC6910268E657FF70BA7EC289974494E76938DDC
     encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
-    version: 3.10.2
+    version: 3.10.2

kubernetes/system/cert-manager-issuer/clusterissuer.yaml

@@ -22,23 +22,3 @@ spec:
           dnsZones:
             - vhaudiquet.fr
             - buildpath.win
-      # OVH solver for semery.fr (via cert-manager-webhook-ovh)
-      - dns01:
-          webhook:
-            groupName: acme.aureq.com
-            solverName: ovh
-            config:
-              endpoint: ovh-eu
-              authenticationMethod: application
-              applicationKeyRef:
-                name: ovh-credentials
-                key: applicationKey
-              applicationSecretRef:
-                name: ovh-credentials
-                key: applicationSecret
-              applicationConsumerKeyRef:
-                name: ovh-credentials
-                key: consumerKey
-        selector:
-          dnsZones:
-            - semery.fr

kubernetes/system/cert-manager-issuer/kustomization.yaml

@@ -3,5 +3,3 @@ apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 resources:
   - clusterissuer.yaml
-  - ovh-credentials-secret.yaml
-  - ovh-secret-reader-rbac.yaml

kubernetes/system/cert-manager-issuer/ovh-credentials-secret.yaml

@@ -1,50 +0,0 @@
-# OVH API Credentials for DNS-01 Challenges
-#
-# OVH API credentials with the following permissions:
-#   - GET, POST, PUT, DELETE on /domain/zone/*
-#
-# The secret MUST live in the cert-manager-webhook-ovh namespace (cert-manager),
-# because for a ClusterIssuer cert-manager sets the webhook's ResourceNamespace
-# to the webhook's own namespace, and the webhook looks up credential secrets
-# there (see ch.ResourceNamespace in the webhook's ovhClient() function).
-#
-# SOPS will encrypt the stringData fields on pre-commit.
-apiVersion: v1
-kind: Secret
-metadata:
-    name: ovh-credentials
-    namespace: cert-manager
-    labels:
-        app.kubernetes.io/name: cert-manager-webhook-ovh
-        app.kubernetes.io/component: ovh-credentials
-type: Opaque
-stringData:
-    applicationKey: ENC[AES256_GCM,data:0+y+m8n/eup5lY/vGW5ASQ==,iv:VSIhfNAvSNOLq92TVcaW54ygU1wgAv+u35HZ0cbP6UU=,tag:KD+cyIesTQgqEzGMro8xyA==,type:str]
-    applicationSecret: ENC[AES256_GCM,data:sP0febHRFF/atAFlRM6sYXoM+Lp6Rnf7d0IQKcsa0vY=,iv:nHYMHSsOclkZmQJSjcz2oXMHsDTct5hTmJz1L7xgvpA=,tag:oCGoRP7R0W+PTNRCeLFvyg==,type:str]
-    consumerKey: ENC[AES256_GCM,data:vw/Q39CpSc5o1ntPDMT3844aLbTHQrSYH8RhoZFFZrQ=,iv:6B0F9Zq56inpW7AS8okbpqJkRK3WkBjX6sIqclOP9Hs=,tag:nnbgwBMBM4JZg/IEYzRvVw==,type:str]
-sops:
-    lastmodified: "2026-07-10T05:06:52Z"
-    mac: ENC[AES256_GCM,data:0/VEDE1ZuIyzkaleosS/KHYX44762TbScrJGJylwV21d7U6YgpwRMOXvU9xn3rHsDXnh5IAmAtrXQTYJFN1vcF1DNw5O9+TQKVoO6B5rsel/YyKRU4s7aYcfDgbW9dO1wn33K65KFtM+0Qv187DzEn1by449TgWIWP/M5U40PE4=,iv:hIGzMwsas8VxC4941ABeoocYWSlVSz9KW7a5tTAoRXI=,tag:n/EJEkEBL20carqVesMBsw==,type:str]
-    pgp:
-        - created_at: "2026-07-10T05:06:52Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiARAAu0va03SPYOU23iUjoTMiXJ6+nMhIX8lsurvmCvi+wIqk
-            c7qu0lTfXv62IjkY6fIKtOE7TN9TiipjzXG2QJaK94QeiFpe9M90qNo09qEIje9m
-            DepTrLfyINFT0SY2eihl+nXhBXuEDSiD5K60OsXGPN92hJMwCad5jJuB7xpmrX0m
-            X0A1Bl9orce/do/YJoy5hq0persB/VSeCKlptNzqpmpRIA3J6AdCDKXQOMqAymXN
-            FXAxbjEQNcXhfU12Y/cVpa1hS7ap5OJCnWOPkFEA8y1ESVnPpryuTIfVlFUhW3/Z
-            Dhpb9OXKdi2IVYdbaY8+3UfSsXxTVOge7jCMbJq3aa7ZvGt5fTjXG4zc9A6RqSGh
-            ASOPSkRRSZB0d97NhUQJGgfcaWFvsfkaTAUVB2Ip/+Udnt/tGIE99RGJizxSVO9N
-            2aVJIukqng8aNPfth8mgWYJpCETMb4piLmVg2ptDqelCqXlUAskxWzMWtAhyzOgw
-            lZ2dcAn7aj9YtLaKAW9rjV8EqHEqQg0ychRNMeyRiN/CnNJp6Q2wl1/EyQUpzb0a
-            1I/ifFAW8FbWTVIbZv6njkl1XNaoav54qEn1qSABcljM0h1Ulb9WKMJiXH4368jf
-            Yhl38JDAn5NZBEzxpuaih1XK5yVri0/1ascpuMvfOxLKniUR9tla8+WEL97+aejS
-            XgGsrH+/uzRVSAT+44rExi43MWCAwNRUaVrX8UiGjA/z8qPVdwBVih4CMKgfQ8VW
-            1KewStOY217BXuVrDbvHEAkuOotEP0Jnan0epoWs47DSasNgzAcWrBgom0l/avI=
-            =Gdou
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(data|stringData|.*.key|.*.crt)$
-    version: 3.10.2

kubernetes/system/cert-manager-issuer/ovh-secret-reader-rbac.yaml

@@ -1,41 +0,0 @@
-# RBAC granting the cert-manager-webhook-ovh service account read access to the
-# OVH credentials secret.
-#
-# The cert-manager-webhook-ovh chart only auto-creates this secret-reader Role
-# when using its built-in `issuers[]` mechanism. Since we manage the
-# ClusterIssuer and the credentials secret manually, we declare the RBAC here.
-#
-# The webhook runs in the cert-manager namespace under the
-# `cert-manager-webhook-ovh` service account (created by the Helm release).
-apiVersion: rbac.authorization.k8s.io/v1
-kind: Role
-metadata:
-    name: cert-manager-webhook-ovh:ovh-secret-reader
-    namespace: cert-manager
-    labels:
-        app.kubernetes.io/name: cert-manager-webhook-ovh
-        app.kubernetes.io/component: ovh-secret-reader
-rules:
-    - apiGroups: [""]
-      resources: ["secrets"]
-      verbs: ["get", "watch"]
-      resourceNames:
-          - ovh-credentials
----
-apiVersion: rbac.authorization.k8s.io/v1
-kind: RoleBinding
-metadata:
-    name: cert-manager-webhook-ovh:ovh-secret-reader
-    namespace: cert-manager
-    labels:
-        app.kubernetes.io/name: cert-manager-webhook-ovh
-        app.kubernetes.io/component: ovh-secret-reader
-roleRef:
-    apiGroup: rbac.authorization.k8s.io
-    kind: Role
-    name: cert-manager-webhook-ovh:ovh-secret-reader
-subjects:
-    - apiGroup: ""
-      kind: ServiceAccount
-      name: cert-manager-webhook-ovh
-      namespace: cert-manager

kubernetes/system/cert-manager-webhook-ovh/kustomization.yaml

@@ -1,12 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: cert-manager
-resources:
-  - repository.yaml
-  - release.yaml
-secretGenerator:
-  - name: cert-manager-webhook-ovh-values
-    files:
-      - values.yaml=values.yaml
-configurations:
-  - kustomizeconfig.yaml

kubernetes/system/cert-manager-webhook-ovh/kustomizeconfig.yaml

@@ -1,11 +0,0 @@
-nameReference:
-  - kind: HelmRepository
-    version: v1
-    fieldSpecs:
-      - path: spec/chart/spec/sourceRef/name
-        kind: HelmRelease
-  - kind: Secret
-    version: v1
-    fieldSpecs:
-      - path: spec/valuesFrom/name
-        kind: HelmRelease

kubernetes/system/cert-manager-webhook-ovh/release.yaml

@@ -1,19 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: cert-manager-webhook-ovh
-  namespace: cert-manager
-spec:
-  interval: 1m
-  chart:
-    spec:
-      sourceRef:
-        kind: HelmRepository
-        name: cert-manager-webhook-ovh
-        namespace: cert-manager
-      chart: cert-manager-webhook-ovh
-      version: "v0.9.13"
-      interval: 1m
-  valuesFrom:
-    - kind: Secret
-      name: cert-manager-webhook-ovh-values

kubernetes/system/cert-manager-webhook-ovh/repository.yaml

@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: cert-manager-webhook-ovh
-  namespace: cert-manager
-spec:
-  interval: 1m
-  url: https://aureq.github.io/cert-manager-webhook-ovh

kubernetes/system/cert-manager-webhook-ovh/values.yaml

@@ -1,45 +0,0 @@
-# cert-manager-webhook-ovh Values
-# groupName must match the ClusterIssuer webhook stanza
-groupName: acme.aureq.com
-# cert-manager deployment configuration for RBAC
-# The webhook creates ClusterRole/RoleBinding so cert-manager's
-# service account can create the "ovh" ChallengePayload resources
-certManager:
-    namespace: cert-manager
-    serviceAccountName: cert-manager
-# Pod configuration
-pod:
-    replicas: 1
-    resources:
-        requests:
-            cpu: 10m
-            memory: 32Mi
-        limits:
-            cpu: 100m
-            memory: 128Mi
-sops:
-    lastmodified: "2026-07-09T22:31:08Z"
-    mac: ENC[AES256_GCM,data:QjrNj355tJVZRsYQdkM73Ld7X8EvMM7O/1vF3QnTYJ9vWbh78irLocbtnyBeaR9o3g0mxO6Ugjlukj+S0HhIX/WS1XHEfs/3n3rE0zS/fxGJ0D3Alam/n/WPOsYHUiCBD86JtU83AjgncISY4yp/VheV3kRgSdl+ye4AGAjhq7A=,iv:p8yqNCcskTfDfEGbM5Qyb60C4pFv4BOuLpEApEzHLFY=,tag:KntExeQwJbBREaz2nY+1uQ==,type:str]
-    pgp:
-        - created_at: "2026-07-09T22:31:08Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ/8Dn4nEIbQXuETxE6RUBkNTO/eN5pHh47lqSwBBbYDSi8C
-            8rcJmdq8P+v00geLdMlM35OcjHFb9UCVeHFsAEYt6Q2jL4QNa2aOEDOqGnhKP+zx
-            KKtW2Ngx76Ow9N2C5JN9DXk9n+PC/qWdPLNJY+GiW/KbPmVxAulJpmYlJHfs1EOh
-            0mSRSS+7sgGLHWmgU362zC508lkKxh8HKxmq1+1lf+fWIe8N7Sl0fx55kq168hae
-            NcdogRpoVT555hRils7eqzj0C/KTVOi7CR4pS7VJyiNy2fu2OASmmcM6UEqCyJfV
-            NTUdMpnjb05UwfbuUnIg6j/FoqS49ufGxKPrM9t7JrFSuyGqduF7P/ifv5zwMuIZ
-            SNeR/X8xUksK6R4/uTmUx5sgF+Jv7tCRvcp+DhsDe1mMmO8czXC5Mt3cR+uwYoms
-            hN+9/oYEZr13qn5Ek0dy9NESkZIzYPCXYXZrx8GLqaHCJEQbpIZCAN+llOyQaQzU
-            jcvPAYbTewBw4ewKUS0KcvLd1pfzvYyvtzwHuMIVJwrf7x5bzhzxAgVOGkEVlVq/
-            7pGO9TYXGl3kD7tf25oCGzAerVC+EVcL11sq4zawvL4PovEZFP9mzhR7EfY3t/3C
-            vGVu6vPmCJOwdis9+Kdr3PKubnMqWGn5KCCX1x13qhsHc239N7cVKkyx3dTBaArS
-            XAG6KxKe/cQicIVC8/N1Cna9uQnTF5ZnFVfJNW1nkYyF1E+ofW6kKDr3ITotKLDP
-            hXXPT+vsB2fL3faBG4xb6owrMuQ1S0DmB3mqjSCXtpS7q0FDg22Tq9BtaEni
-            =x1th
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
-    version: 3.10.2

kubernetes/system/flux/cert-manager-issuer.yaml

@@ -14,7 +14,6 @@ spec:
   path: ./kubernetes/system/cert-manager-issuer
   dependsOn:
     - name: cert-manager
-    - name: cert-manager-webhook-ovh
   decryption:
     provider: sops
     secretRef:

kubernetes/system/flux/cert-manager-webhook-ovh.yaml

@@ -1,20 +0,0 @@
-# Flux Kustomization for cert-manager-webhook-ovh
-# Depends on cert-manager being fully operational (CRDs installed)
-apiVersion: kustomize.toolkit.fluxcd.io/v1
-kind: Kustomization
-metadata:
-  name: cert-manager-webhook-ovh
-  namespace: flux-system
-spec:
-  interval: 10m
-  prune: true
-  sourceRef:
-    kind: GitRepository
-    name: homeprod
-  path: ./kubernetes/system/cert-manager-webhook-ovh
-  dependsOn:
-    - name: cert-manager
-  decryption:
-    provider: sops
-    secretRef:
-      name: flux-sops

kubernetes/system/flux/kustomization.yaml

@@ -5,5 +5,4 @@ kind: Kustomization
 resources:
   - webhook.yaml
   - cert-manager.yaml
-  - cert-manager-webhook-ovh.yaml
   - cert-manager-issuer.yaml

kubernetes/system/longhorn/kustomization.yaml

@@ -1,13 +0,0 @@
-apiVersion: kustomize.config.k8s.io/v1beta1
-kind: Kustomization
-namespace: longhorn-system
-resources:
-  - namespace.yaml
-  - repository.yaml
-  - release.yaml
-secretGenerator:
-  - name: longhorn-values
-    files:
-      - values.yaml=values.yaml
-configurations:
-  - kustomizeconfig.yaml

kubernetes/system/longhorn/kustomizeconfig.yaml

@@ -1,6 +0,0 @@
-nameReference:
-- kind: Secret
-  version: v1
-  fieldSpecs:
-  - path: spec/valuesFrom/name
-    kind: HelmRelease

kubernetes/system/longhorn/namespace.yaml

@@ -1,6 +0,0 @@
-apiVersion: v1
-kind: Namespace
-metadata:
-  name: longhorn-system
-  labels:
-    pod-security.kubernetes.io/enforce: privileged

kubernetes/system/longhorn/release.yaml

@@ -1,19 +0,0 @@
-apiVersion: helm.toolkit.fluxcd.io/v2
-kind: HelmRelease
-metadata:
-  name: longhorn
-  namespace: longhorn-system
-spec:
-  interval: 1m
-  chart:
-    spec:
-      sourceRef:
-        kind: HelmRepository
-        name: longhorn
-        namespace: longhorn-system
-      chart: longhorn
-      version: '1.12.0'
-      interval: 1m
-  valuesFrom:
-    - kind: Secret
-      name: longhorn-values

kubernetes/system/longhorn/repository.yaml

@@ -1,8 +0,0 @@
-apiVersion: source.toolkit.fluxcd.io/v1
-kind: HelmRepository
-metadata:
-  name: longhorn
-  namespace: longhorn-system
-spec:
-  interval: 1m
-  url: https://charts.longhorn.io

kubernetes/system/longhorn/values.yaml

@@ -1,83 +0,0 @@
-# Longhorn Helm Values
-# Single-node R740 cluster, backup target on TrueNAS NFS
-defaultSettings:
-    # Single node — only 1 replica needed
-    defaultReplicaCount: 1
-    # NFS backup target on TrueNAS
-    backupTarget: nfs://truenas.lan:/mnt/fast_app_data/longhorn-backup
-    # Allow full disk usage on single-node
-    storageOverProvisioningPercentage: 100
-    storageMinimalAvailablePercentage: 10
-    # Auto-salvage on node reboot (single-node)
-    autoSalvage: true
-    # Disable strict flushing for better single-node performance
-    strictSyncReplicas: false
-persistence:
-    # Not default yet — nfs-csi stays default until migration begins
-    defaultClass: false
-    defaultClassReplicaCount: 1
-    # Retain volumes on PVC delete — safer during migration
-    reclaimPolicy: Retain
-    # Mount options for ext4
-    fstype: ext4
-longhorn-ui:
-    replicas: 1
-longhorn-manager:
-    tolerations:
-        - key: ENC[AES256_GCM,data:c2J2DGZmaM/ix/q/qEh6GP9Uvq+e9ZLTqkfcslLfFgurUiMXpg==,iv:b2X+xaoFsUM7OTIarVVridMUTRRecDXGWHDKc0C7WjM=,tag:AerEyuAxoP2iIM2rcS2TPg==,type:str]
-          operator: Exists
-          effect: NoSchedule
-longhorn-driver-deployer:
-    tolerations:
-        - key: ENC[AES256_GCM,data:RVYMPUMyRKXBPqJdPy3X48uT4CVxRhpNcmEHEAEesuu2+SBREQ==,iv:zt6aCBfSwAKOnRtwI2Fwm8nJmzyTT5QOV+CSNHAq8nE=,tag:oKnu/3yBjz3EO77DsD8WiQ==,type:str]
-          operator: Exists
-          effect: NoSchedule
-# Disable ingress for now
-ingress:
-    enabled: false
-# Recurring backup and snapshot schedules
-# - Daily snapshots: fast local recovery from accidental deletes
-# - Daily NFS backups: DR if node is lost
-recurringJobs:
-    enable: true
-    jobs:
-        - name: daily-snapshot
-          task: snapshot
-          cron: 0 2 * * *
-          retain: 7
-          concurrency: 2
-          labels:
-            type: snapshot
-        - name: daily-backup
-          task: backup
-          cron: 0 3 * * *
-          retain: 7
-          concurrency: 2
-          labels:
-            type: backup
-sops:
-    lastmodified: "2026-07-10T22:54:09Z"
-    mac: ENC[AES256_GCM,data:G2EsREFL55kWR/J2iDyj4ri0W6Yj1hwlg9LOr6Z6GMV3iaXXf1TwN9yJqPsWRXhwxeg3b2XBfmrRFEA4HXntTRdGmh+9odLJh0C6EEuVUj+vZcwOsgppQ/xI3f7vZ1zCmSzOMUTpLKxWV3um+/uvathICUfWvjxpQuA7+SJbZ/0=,iv:dbcV7A/VU6Le8cTeUEuFcOSBvj74X3pPZH/i3Df4rAg=,tag:czw/g1Xk+qxUM7b4PQerFw==,type:str]
-    pgp:
-        - created_at: "2026-07-10T22:54:09Z"
-          enc: |-
-            -----BEGIN PGP MESSAGE-----
-
-            hQIMA7uy4qQr71wiAQ//bfvnH8G5BtfRtcAvEDR8I/7c7mnKgPJaI5ZfulgVJOfT
-            6wApzIoLCBEfNLAwCDEWWRPeFicQHv7Aq5BDK9EJ3EioupfERPbDNKNiBfWPNlNU
-            dYqFR7jaxp+uPLm5PaydsoNL4TxtGS8pw12JJJCTaEz9ybOi40aOr4TRdLtRqUAP
-            XU/BHArIKoORiEKhYunfgfgZjAHI6732v1KnAYRcSVv5vccRpSn3hTMS3oPgcEu+
-            VHHpoiOrJaFVtbIxwNEx1TVS9K0denx9m/VEZjE5BaFJ1b45v3aUAlwMYjj0+//R
-            MFNoMaCQQ+D8WYOG8Hu5/bCVtvVr7xu0q6jrno42LgPiPt5MVgTbu8+Sp9hUzgbS
-            D1p2ajy+i9/kMPC9qQDbZT/MbudvaVKStsfmCuefDz29epaClXyNygyNA5P57hur
-            4h9/tQX5pylLOoCSH/pDN9bXy/RhTkWemJllXjPX4K5BgWnG+YpyWRAizBi47nV5
-            VzzWL/wLLhB38VrK2d0c5WQPsRzd7PQrqEwNBy9IGM5E8k1oJ33dCyIL9b6TnN51
-            5rm00D3k8AFKWqu2kJ51mXEAA9tUv2dq3w9r0XSwSnccRRwnSbSOvgZhp8qjqVNB
-            BG858obUUSCO45JFMKlhrHc8UWbSTAvYHi5vv/lKj5/jc9w2zEA+vNxEfEXPquzS
-            XAF5BKlXDxPPxw5aTsRIekZSj1irS2THDzeQqpZS+dASOP/S+a0KxlWsMCUBE2ai
-            3rIi6kBQtAFRKBjr8wF5w0DdRPqM0jx7nOEdZNm80VGKdbkI/q+y/ChxLp2X
-            =dVVu
-            -----END PGP MESSAGE-----
-          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*\.ya?ml)$
-    version: 3.10.2