mirror of
https://github.com/vhaudiquet/homeprod.git
synced 2026-11-05 21:38:11 +00:00
Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 renovate[bot]
|
ca52d3d34e |
+1
-1
@@ -1,6 +1,6 @@
|
||||
creation_rules:
|
||||
- path_regex: .*values.yaml$
|
||||
encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml|token)$
|
||||
encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
|
||||
mac_only_encrypted: true
|
||||
pgp: DC6910268E657FF70BA7EC289974494E76938DDC
|
||||
- path_regex: .*.yaml
|
||||
|
||||
@@ -23,11 +23,6 @@ zones:
|
||||
- config
|
||||
targets:
|
||||
- cloudflare
|
||||
rhema.rs.:
|
||||
sources:
|
||||
- config
|
||||
targets:
|
||||
- cloudflare
|
||||
saggar.dev.:
|
||||
sources:
|
||||
- config
|
||||
|
||||
@@ -1,33 +0,0 @@
|
||||
---
|
||||
? ''
|
||||
: octodns:
|
||||
cloudflare:
|
||||
auto-ttl: true
|
||||
proxied: false
|
||||
ttl: 300
|
||||
type: A
|
||||
value: 82.64.154.58
|
||||
get:
|
||||
octodns:
|
||||
cloudflare:
|
||||
auto-ttl: true
|
||||
proxied: false
|
||||
ttl: 300
|
||||
type: A
|
||||
value: 82.64.154.58
|
||||
s3:
|
||||
octodns:
|
||||
cloudflare:
|
||||
auto-ttl: true
|
||||
proxied: false
|
||||
ttl: 300
|
||||
type: A
|
||||
value: 82.64.154.58
|
||||
www:
|
||||
octodns:
|
||||
cloudflare:
|
||||
auto-ttl: true
|
||||
proxied: false
|
||||
ttl: 300
|
||||
type: A
|
||||
value: 82.64.154.58
|
||||
@@ -1,6 +1,6 @@
|
||||
services:
|
||||
n8n:
|
||||
image: docker.n8n.io/n8nio/n8n:2.26.4
|
||||
image: docker.n8n.io/n8nio/n8n:2.43.3
|
||||
environment:
|
||||
- TZ=Europe/Paris
|
||||
- N8N_SECURE_COOKIE=false
|
||||
|
||||
@@ -2,7 +2,7 @@ terraform {
|
||||
required_providers {
|
||||
proxmox = {
|
||||
source = "bpg/proxmox"
|
||||
version = "0.119.0"
|
||||
version = "0.81.0"
|
||||
}
|
||||
}
|
||||
}
|
||||
|
||||
@@ -143,67 +143,3 @@ spec:
|
||||
- get.saggar.dev
|
||||
duration: 2160h # 90 days
|
||||
renewBefore: 360h # 15 days before expiry
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: rhema-rs
|
||||
namespace: caddy
|
||||
spec:
|
||||
secretName: rhema-rs-tls
|
||||
issuerRef:
|
||||
name: letsencrypt-production
|
||||
kind: ClusterIssuer
|
||||
commonName: rhema.rs
|
||||
dnsNames:
|
||||
- rhema.rs
|
||||
duration: 2160h # 90 days
|
||||
renewBefore: 360h # 15 days before expiry
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: s3-rhema-rs
|
||||
namespace: caddy
|
||||
spec:
|
||||
secretName: s3-rhema-rs-tls
|
||||
issuerRef:
|
||||
name: letsencrypt-production
|
||||
kind: ClusterIssuer
|
||||
commonName: s3.rhema.rs
|
||||
dnsNames:
|
||||
- s3.rhema.rs
|
||||
duration: 2160h # 90 days
|
||||
renewBefore: 360h # 15 days before expiry
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: www-rhema-rs
|
||||
namespace: caddy
|
||||
spec:
|
||||
secretName: www-rhema-rs-tls
|
||||
issuerRef:
|
||||
name: letsencrypt-production
|
||||
kind: ClusterIssuer
|
||||
commonName: www.rhema.rs
|
||||
dnsNames:
|
||||
- www.rhema.rs
|
||||
duration: 2160h # 90 days
|
||||
renewBefore: 360h # 15 days before expiry
|
||||
---
|
||||
apiVersion: cert-manager.io/v1
|
||||
kind: Certificate
|
||||
metadata:
|
||||
name: get-rhema-rs
|
||||
namespace: caddy
|
||||
spec:
|
||||
secretName: get-rhema-rs-tls
|
||||
issuerRef:
|
||||
name: letsencrypt-production
|
||||
kind: ClusterIssuer
|
||||
commonName: get.rhema.rs
|
||||
dnsNames:
|
||||
- get.rhema.rs
|
||||
duration: 2160h # 90 days
|
||||
renewBefore: 360h # 15 days before expiry
|
||||
|
||||
@@ -127,23 +127,3 @@ data:
|
||||
tls /etc/caddy/certs/get-saggar-dev/tls.crt /etc/caddy/certs/get-saggar-dev/tls.key
|
||||
reverse_proxy traefik.traefik.svc.cluster.local.:80
|
||||
}
|
||||
|
||||
rhema.rs {
|
||||
tls /etc/caddy/certs/rhema-rs/tls.crt /etc/caddy/certs/rhema-rs/tls.key
|
||||
reverse_proxy traefik.traefik.svc.cluster.local.:80
|
||||
}
|
||||
|
||||
www.rhema.rs {
|
||||
tls /etc/caddy/certs/www-rhema-rs/tls.crt /etc/caddy/certs/www-rhema-rs/tls.key
|
||||
reverse_proxy traefik.traefik.svc.cluster.local.:80
|
||||
}
|
||||
|
||||
get.rhema.rs {
|
||||
tls /etc/caddy/certs/get-rhema-rs/tls.crt /etc/caddy/certs/get-rhema-rs/tls.key
|
||||
reverse_proxy traefik.traefik.svc.cluster.local.:80
|
||||
}
|
||||
|
||||
s3.rhema.rs {
|
||||
tls /etc/caddy/certs/s3-rhema-rs/tls.crt /etc/caddy/certs/s3-rhema-rs/tls.key
|
||||
reverse_proxy traefik.traefik.svc.cluster.local.:80
|
||||
}
|
||||
|
||||
@@ -10,7 +10,7 @@ image:
|
||||
repository: caddy
|
||||
pullPolicy: IfNotPresent
|
||||
tagSuffix: ""
|
||||
tag: 2.11.7
|
||||
tag: 2.11.6
|
||||
service:
|
||||
type: LoadBalancer
|
||||
# Cluster (not Local) so any node can forward to pods on any other node.
|
||||
@@ -36,61 +36,44 @@ health:
|
||||
volumes:
|
||||
- name: vhaudiquet-fr-tls
|
||||
secret:
|
||||
secretName: vhaudiquet-fr-tls
|
||||
optional: true
|
||||
secretName: ENC[AES256_GCM,data:16xnpbPT5Q3QPhiOVW09rO4=,iv:rITfPR/pb9otdRXURijM9l4eOyjAm/LpMCVzDI1HdiQ=,tag:XTt5U79sfX4F7gL3pdfCIQ==,type:str]
|
||||
optional: ENC[AES256_GCM,data:ghlFPw==,iv:nZ6HKGVI7z0R7ZDnxdKCFdAtPrUCYTPc6C3ahLhi05o=,tag:zKbUifBUjU2haTMIldoKhA==,type:bool]
|
||||
- name: wildcard-vhaudiquet-fr-tls
|
||||
secret:
|
||||
secretName: wildcard-vhaudiquet-fr-tls
|
||||
optional: true
|
||||
secretName: ENC[AES256_GCM,data:HFV3Bw6giG42LsVv7NHQCNbsk0ewFftMuNE=,iv:lhlMGwLwaKTjXwqErw/bsSG6zRuc9lfwwF9Ru/WiFG0=,tag:gU4IW396EUuiZUdRIz5neA==,type:str]
|
||||
optional: ENC[AES256_GCM,data:NSoRKQ==,iv:0xYJ3X2fajkm+KuXLB67nzKJtlszZz/iLlpPBkPgsGc=,tag:pQ0P4pak230kfNvxILH7Hg==,type:bool]
|
||||
# semery.fr certs from cert-manager (OVH DNS-01)
|
||||
- name: semery-fr-tls
|
||||
secret:
|
||||
secretName: semery-fr-tls
|
||||
optional: true
|
||||
secretName: ENC[AES256_GCM,data:J7uLCquEggEP2naKHg==,iv:8RudvW7ki/DkWZwVHd1AXAt+6YrLrOpXotQDh9vwgp4=,tag:1PzTWbWEqKUdhlwRcctpGQ==,type:str]
|
||||
optional: ENC[AES256_GCM,data:1q/Bng==,iv:jEnPnyR3pCV0CL8hK+NfMxH1LDKSRyansf6GZDshzQE=,tag:TzOXcGF91InOrCdCCm/Bcg==,type:bool]
|
||||
- name: wildcard-semery-fr-tls
|
||||
secret:
|
||||
secretName: wildcard-semery-fr-tls
|
||||
optional: true
|
||||
secretName: ENC[AES256_GCM,data:5n5namMP+KepRLRQZgvzlr9hEzNmvQ==,iv:Xnh7FIAVaxQ1Mxd8+en8bM9ueFsG1ujxh472mQhqFFw=,tag:omVRURP2KbSEyHsUqUhfCg==,type:str]
|
||||
optional: ENC[AES256_GCM,data:0GArbg==,iv:1wW6BFk6Vs2y42iIniy4YbMFBOYdqwXop2WCEldwBBA=,tag:gmZlb7zIh3W/0L3qg8XQCQ==,type:bool]
|
||||
- name: buildpath-win-tls
|
||||
secret:
|
||||
secretName: buildpath-win-tls
|
||||
optional: true
|
||||
secretName: ENC[AES256_GCM,data:CTR7I92zQSaOKCcLPGnAs4Q=,iv:egtHKvBbs1dJsMgoIFK+gyOnC7ZX/3UfaAGIDkryd+c=,tag:vk3xGP8YeXhQSi6QLk+3Ww==,type:str]
|
||||
optional: ENC[AES256_GCM,data:nOml1Q==,iv:viRMNPrBLmm8IfJDqcfWOuyMx/y7eE0CTMYjWmK5/rE=,tag:VpAuffCx/VqP2X947l/p3A==,type:bool]
|
||||
# saggar.dev cert from cert-manager (Porkbun DNS-01)
|
||||
- name: saggar-dev-tls
|
||||
secret:
|
||||
secretName: saggar-dev-tls
|
||||
optional: true
|
||||
secretName: ENC[AES256_GCM,data:5eb4Fv9OJqjbPuxT1/8=,iv:ZsOSvoCc9+ZtTVboRKJBRR8FITk3gowa/uylv+mfA+k=,tag:hkoQ8QHt9evQfDUT4rq51Q==,type:str]
|
||||
optional: ENC[AES256_GCM,data:iac+qA==,iv:hf1rDOHE3frRL702sotOP8akjBi20mRTXQ6vlUb4Ac0=,tag:+G8rgN61c5agYmbJsldqrA==,type:bool]
|
||||
- name: api-saggar-dev-tls
|
||||
secret:
|
||||
secretName: api-saggar-dev-tls
|
||||
optional: true
|
||||
secretName: ENC[AES256_GCM,data:5NJaLtBQizRFNbF5IS2YbEmF,iv:lTJkrES8y7/QO73p7G8RG/CmxGedyXAvfrK3Q26OtU0=,tag:92P2+010Isgg3SQjYwPBCw==,type:str]
|
||||
optional: ENC[AES256_GCM,data:3ax/5A==,iv:CvLi5JqkXPfq9+jVA/Q+mpdEZJ7UosxzZAR1aArpDbk=,tag:yOsLJuqtCrvg8YneJRUeoA==,type:bool]
|
||||
# docs.saggar.dev cert — the saggar book (static nginx)
|
||||
- name: docs-saggar-dev-tls
|
||||
secret:
|
||||
secretName: docs-saggar-dev-tls
|
||||
optional: true
|
||||
secretName: ENC[AES256_GCM,data:xDf3adcsj6i0FJ2kAc5UxnVE3w==,iv:+qGMWJKoQo/MjibTR9mbgX3T6/xwr+vq1U+ef14xXfs=,tag:Y2jZHktvL8RKUacSv9JDJg==,type:str]
|
||||
optional: ENC[AES256_GCM,data:wEEiYQ==,iv:zNWY0N5935+biGIjIl+q5XPyLLX7/ABhnwHsp4FEZpM=,tag:v8trm6fiM5q/T6EOh1fxcQ==,type:bool]
|
||||
# get.saggar.dev cert — the saggar distribution host (garage web)
|
||||
- name: get-saggar-dev-tls
|
||||
secret:
|
||||
secretName: get-saggar-dev-tls
|
||||
optional: true
|
||||
# rhema.rs certs from cert-manager (Cloudflare DNS-01)
|
||||
- name: rhema-rs-tls
|
||||
secret:
|
||||
secretName: rhema-rs-tls
|
||||
optional: true
|
||||
- name: www-rhema-rs-tls
|
||||
secret:
|
||||
secretName: www-rhema-rs-tls
|
||||
optional: true
|
||||
- name: get-rhema-rs-tls
|
||||
secret:
|
||||
secretName: get-rhema-rs-tls
|
||||
optional: true
|
||||
- name: s3-rhema-rs-tls
|
||||
secret:
|
||||
secretName: s3-rhema-rs-tls
|
||||
optional: true
|
||||
secretName: ENC[AES256_GCM,data:iFG9+7bSIUgFZpm8h5Tc362g,iv:Wm6cW1+ehjoylvjwSE3oT0VcQFZONq9znpfi2w/wP9U=,tag:UoEXdJzWoVX6/g8UtbByzQ==,type:str]
|
||||
optional: ENC[AES256_GCM,data:t8VFbw==,iv:Imo0wBOb9ufS9YPqtTegEHQFnyhgSYmcg2FHEzBkW9I=,tag:19zicABMKqAR/nDr85WpCw==,type:bool]
|
||||
- name: routes
|
||||
configMap:
|
||||
name: caddy-routes
|
||||
@@ -123,18 +106,6 @@ volumeMounts:
|
||||
- name: get-saggar-dev-tls
|
||||
mountPath: /etc/caddy/certs/get-saggar-dev
|
||||
readOnly: true
|
||||
- name: rhema-rs-tls
|
||||
mountPath: /etc/caddy/certs/rhema-rs
|
||||
readOnly: true
|
||||
- name: www-rhema-rs-tls
|
||||
mountPath: /etc/caddy/certs/www-rhema-rs
|
||||
readOnly: true
|
||||
- name: get-rhema-rs-tls
|
||||
mountPath: /etc/caddy/certs/get-rhema-rs
|
||||
readOnly: true
|
||||
- name: s3-rhema-rs-tls
|
||||
mountPath: /etc/caddy/certs/s3-rhema-rs
|
||||
readOnly: true
|
||||
- name: routes
|
||||
mountPath: /etc/caddy/routes
|
||||
readOnly: true
|
||||
@@ -159,7 +130,7 @@ affinity:
|
||||
- weight: 100
|
||||
preference:
|
||||
matchExpressions:
|
||||
- key: ENC[AES256_GCM,data:AsOdq9OGQbAGV42W4d22EGVMi5E=,iv:U3sLu8pI7fqOPbvpfpVz21cUfwovKRFi8jY6laTyStY=,tag:EQVSFAzTYw2En2xdGTCF3Q==,type:str]
|
||||
- key: ENC[AES256_GCM,data:RTux56Pd/U6b6MLk5uRUC2YXP3w=,iv:K/9+Mh8dyp9DOumKFLmZFHXqjxzhhYEKKSnXRc/Pb2A=,tag:fk03mWjQEQPCdALb2gEMdQ==,type:str]
|
||||
operator: NotIn
|
||||
values:
|
||||
- "true"
|
||||
@@ -173,36 +144,37 @@ affinity:
|
||||
topologyKey: kubernetes.io/hostname
|
||||
tolerations:
|
||||
# Tolerate the failover taint so caddy CAN schedule on p330 (small-node-1).
|
||||
- key: ENC[AES256_GCM,data:s3X0PmRJCCVh,iv:UYZl3EsmdSTdF9NoYsL+zbxLlkfO2GU80Sy3CpSXMBY=,tag:35UtC37ldCItR9fAtSXVVw==,type:str]
|
||||
- key: ENC[AES256_GCM,data:JPKKj4UA7JWi,iv:0PNgCHVFO2bywVfcXrOrcTQpNjz2TUUM0RrBmF6godw=,tag:h27cJ4dd9C1iLKgffNLVfQ==,type:str]
|
||||
operator: Equal
|
||||
value: failover
|
||||
value: ENC[AES256_GCM,data:7dtvTUy+xUI=,iv:pQdnyz5X+gQB0DOFFxs5D+2RAPD8xl+hgJFwARcbBWo=,tag:A321CiM+q8tLJJyanRn/Ww==,type:str]
|
||||
effect: NoSchedule
|
||||
- key: ENC[AES256_GCM,data:NYCyZsj7wMxKUjaDu+rUOQYxDKvvEwSWuDAxQkSGTczXyApCbw==,iv:3AcvLXryeZ6dfmqanFpGOgEf1nGuEVbvUmZzruxzL98=,tag:Daa9AgXQZkkr7RIzljWOeQ==,type:str]
|
||||
- key: ENC[AES256_GCM,data:t71fVLGG7y2am6kXa3DcpGt76uZJ+cOuYZKiaRF2LljtRCxzpw==,iv:Fa0zVUsH/TbWBbL2foIsvq7UQ2kIcA3yNvG2qMuGnng=,tag:KchzYUpe4Z6JIZCvSM2ztw==,type:str]
|
||||
operator: Exists
|
||||
effect: NoSchedule
|
||||
sops:
|
||||
lastmodified: "2026-10-16T07:06:11Z"
|
||||
mac: ENC[AES256_GCM,data:kMIxep2WVIr8/uAiw12T1JXMbtpyijo1c1MOOUKuok2Z1zSrnFZovgIup3u8/2BhqJ2UUDm5hFJi41Tsq45ba5ELs4PX1whi6EXlHQJxNo7ScfepEi10es/wa+p+3w9V8Yv9cklIWk14zh0UABs8jRzOJXhn5XI3O644CJSULQA=,iv:3ssxqRNRvXbmn0HiQFdwoGVbsnzvtQxfpHPIUpplMK8=,tag:5VRyB/Hh4tZUWp6KCPNSQg==,type:str]
|
||||
lastmodified: "2026-10-04T21:14:10Z"
|
||||
mac: ENC[AES256_GCM,data:vv4/zTp8LHusfYtM4xUwKHnesHu49VXfhRmKPo/nB7ItGYATsD5PtnXrGluOkwng/5pvRVs5WCtLt9fdZ9k7aKsfFHisi2OylEkx76xcAQ1f8GOCNkvfnjVuPEbaIZK1Mvdepbe1oZ0B4m5I2KqfvnUpXzmG82vNq0hj5vlQ1uM=,iv:7mKc4OBbPUYuLXer5f1OZcHggJBOu5rD/luh64in5lc=,tag:ch1Nvtyfa94AI9tAOm81hw==,type:str]
|
||||
pgp:
|
||||
- created_at: "2026-10-16T07:06:11Z"
|
||||
- created_at: "2026-10-04T21:14:09Z"
|
||||
enc: |-
|
||||
-----BEGIN PGP MESSAGE-----
|
||||
|
||||
hQIMA7uy4qQr71wiARAAuN5nBauJiH5bFx80iF2W2XJDwMCFG+SPlqv2ErxVaYkD
|
||||
kSt8pA0o4Bzqr6gP6cEgEhzQHAVVvsvTZJTY5lX6KWNRxhz/RXDhxAi9xdBHQ81f
|
||||
dDWn7pgD8sv8cODM39yeukhGlHxZuk7FiUJ4fBnouojWUCxf2Ib5m5TEaWwmmv5n
|
||||
EBBjjcbGZzyWBzCkLbEY/ML1FIx5j/jyZjpjMp2En1309ljIBckjLk5s9Kntp6oJ
|
||||
/TkW/BhU96y8fyGM6u3FV54wORNlCT3P5cDT4rsQd+KgG0DDchAdUSb7hmBEn+iC
|
||||
W/eUsp7nhObkZZBjTKYeS502Q+3RUEXoLnVLWougDxMSA1rJNS3nkgzK1cmKs97/
|
||||
Ghnb5TUGPmoQMUltQzxInDq1mgeGfuFUffprYprYKGeVC/oQ6uPHE4jVZImlWRjv
|
||||
w6YPHv/2XhWMN5vH/ybsrqxcFb5+1z8u8J58GAJ37hDXzkL8ENJUouonM3sywaBc
|
||||
VbXHzJwYEuLhRfNpay6ovwPkhU25gV3atBiXloIWc0PivPjOAJqqs0vkMgRiA+3R
|
||||
yUagVKdyavVUhqou2LOxSGSv77uFPWZwhqUILtqzTeSE6GHUxVqKQPa91klRRNI7
|
||||
YWNtM7ZqSeANK99h5vgphhPZpuKkIzXHSLEXdplxvaRERfWMU3UGCDZOMVcDMlbS
|
||||
XgGovkHZ9+NKVgZVpsRyQQutbSJqvHVZJx162gu3UKC1IgnDnhslOGKVWw/oKNb5
|
||||
KyPf0CLk9BCAlSngr5D5pw4GJ9eq7RNFOqC32LPwXgNSD1AfLFHYGWh3RZM+81w=
|
||||
=eA3w
|
||||
hQIMA7uy4qQr71wiAQ/+Io9dFjaXDz2CSdPjMBiT8ISxnUxZ9F3VX+bqKg9nRusr
|
||||
slx5VsHGCsfK4DyF4GXcqsyDPkz6v39ehhUFdseZewg1AbYTNy9RIEgeSo3fwcnO
|
||||
bee48z1Nti+8F3h+4O2ao+nGx4wSS6MYO3oO5vV5a4oNKe6T59X7eGT30uohatO6
|
||||
jo6UuHu3/e7eyzK7/iSF3SemtkZ1ZiXOgKKeBXashrp+2vDdY+3ow/pRpFyohqWh
|
||||
4mBt8SyCWOsf0BUdNZfJPDO594hwTjrrRIsmBeXde97rFXKBDd5tPR9tjNlihWsw
|
||||
lC0e4331jvwns+rlSOASBX/BVsqVGh8nw/5XWxqW3oMqjvolgofGhP8CtFQkUuoq
|
||||
VoHcgQd79wo0Q107wcp3ftMak010/NweAER1CFtCDBE6DAS05qaaOwwM3erusaw2
|
||||
ZY/ezGULEmSgZ8RA3HHjtxo1ExLMZ+CpPb0mAAamql8O0uCpLl0TRkWvR4zwpo2K
|
||||
ojOTW2dLjhJwJaodAMnKQm8mWtegC8Uektw1RdYCbCTD4sKv9vkxymnSLmE3dvWD
|
||||
Htp/hCSTqDCc0sSBDdagIZWo8VtdduWqeGG7+Qs1wY+NizSlYRDmEsahbgPk9Bcu
|
||||
W7vhpJFZ/98jxEmgaiUVJ3BVqZYiJBdDk4GvSw+/QmyNvd39xNLXIN3DcRTLmqvS
|
||||
XgH/TZt96utCGDUjYFAFw4s4UL3EhttfDe+hSwzrAcslhjyeCORFhYrnwOncCr51
|
||||
tr+maBFPip6FgASJQjDVnxtw9zFDfurbx8W2wk9uh6w3qw4jbGDq9wsI0wvfous=
|
||||
=C10g
|
||||
-----END PGP MESSAGE-----
|
||||
fp: DC6910268E657FF70BA7EC289974494E76938DDC
|
||||
encrypted_regex: ^(data|stringData|.*key|.*crt)$
|
||||
encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
|
||||
mac_only_encrypted: true
|
||||
version: 3.10.2
|
||||
|
||||
@@ -22,7 +22,6 @@ spec:
|
||||
dnsZones:
|
||||
- vhaudiquet.fr
|
||||
- buildpath.win
|
||||
- rhema.rs
|
||||
# OVH solver for semery.fr (via cert-manager-webhook-ovh)
|
||||
- dns01:
|
||||
webhook:
|
||||
|
||||
@@ -12,7 +12,7 @@ spec:
|
||||
name: cert-manager-webhook-ovh
|
||||
namespace: cert-manager
|
||||
chart: cert-manager-webhook-ovh
|
||||
version: "0.9.18"
|
||||
version: "0.9.17"
|
||||
interval: 1m
|
||||
valuesFrom:
|
||||
- kind: Secret
|
||||
|
||||
@@ -7,7 +7,7 @@
|
||||
# Container image
|
||||
image:
|
||||
repository: stalwartlabs/stalwart
|
||||
tag: v0.16.25
|
||||
tag: v0.16.24
|
||||
pullPolicy: IfNotPresent
|
||||
# Single-node RocksDB deployment.
|
||||
replicaCount: 1
|
||||
|
||||
@@ -36,7 +36,6 @@ resources:
|
||||
# Personal (apps storing my own content, grouped by content type)
|
||||
- personal/paperless
|
||||
- personal/radicale
|
||||
- personal/rhema-claw
|
||||
- personal/syncthing
|
||||
- personal/media/photoprism
|
||||
- personal/notes/notesnook
|
||||
@@ -49,8 +48,6 @@ resources:
|
||||
- production/buildpath
|
||||
- production/saggar
|
||||
- production/get-saggar
|
||||
- production/get-rhema
|
||||
- production/rhema-site
|
||||
- production/semery-fr
|
||||
- production/umami
|
||||
- production/vhaudiquet-fr
|
||||
|
||||
@@ -12,7 +12,7 @@ spec:
|
||||
name: derwitt
|
||||
namespace: radicale
|
||||
chart: radicale
|
||||
version: "2.1.4"
|
||||
version: "2.1.2"
|
||||
interval: 1m
|
||||
valuesFrom:
|
||||
- kind: Secret
|
||||
|
||||
@@ -1,13 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: rhema-claw
|
||||
resources:
|
||||
- namespace.yaml
|
||||
- repository.yaml
|
||||
- release.yaml
|
||||
secretGenerator:
|
||||
- name: rhema-claw-values
|
||||
files:
|
||||
- values.yaml=values.yaml
|
||||
configurations:
|
||||
- kustomizeconfig.yaml
|
||||
@@ -1,6 +0,0 @@
|
||||
nameReference:
|
||||
- kind: Secret
|
||||
version: v1
|
||||
fieldSpecs:
|
||||
- path: spec/valuesFrom/name
|
||||
kind: HelmRelease
|
||||
@@ -1,7 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: rhema-claw
|
||||
labels:
|
||||
app.kubernetes.io/name: rhema-claw
|
||||
app.kubernetes.io/component: ai-agent
|
||||
@@ -1,24 +0,0 @@
|
||||
# Tracks the rhema-claw chart as CI publishes it on main: the timestamp
|
||||
# pre-releases (0.1.0-YYYYMMDD-HHMMSS) all sort above 0.1.0-0, and the
|
||||
# chart's appVersion carries the commit SHA the image was tagged with —
|
||||
# values.image.tag stays empty to ride it. Same rolling scheme as the
|
||||
# saggar release.
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: rhema-claw
|
||||
namespace: rhema-claw
|
||||
spec:
|
||||
interval: 1m
|
||||
chart:
|
||||
spec:
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: vhaudiquet
|
||||
namespace: rhema-claw
|
||||
chart: rhema-claw
|
||||
version: ">=0.1.0-0"
|
||||
interval: 1m
|
||||
valuesFrom:
|
||||
- kind: Secret
|
||||
name: rhema-claw-values
|
||||
@@ -1,11 +0,0 @@
|
||||
# The vhaudiquet package repository on the home Gitea — where the rhema
|
||||
# CI publishes the rhema-claw chart on every main push (base version +
|
||||
# timestamp, ordered by SemVer pre-release rules). Public: no auth.
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: vhaudiquet
|
||||
namespace: rhema-claw
|
||||
spec:
|
||||
interval: 1m
|
||||
url: https://git.vhaudiquet.fr/api/packages/vhaudiquet/helm
|
||||
@@ -1,69 +0,0 @@
|
||||
# The rhema claw — the resident agent daemon from ../rhema.
|
||||
# Single-node by design (one SQLite store, one dispatcher): the chart
|
||||
# fails the render past one replica.
|
||||
image:
|
||||
repository: git.vhaudiquet.fr/vhaudiquet/rhema-claw
|
||||
# Empty: follows the chart's appVersion — the commit SHA CI stamped on
|
||||
# the pushed images.
|
||||
tag: ""
|
||||
# Bearer token for the /v1 routes (/healthz stays open). The daemon
|
||||
# shells out through the coding agent, so the surface must not sit open
|
||||
# on the LAN. Encrypted at rest: the .sops.yaml creation rule scoped to
|
||||
# this file adds `token` to the values encrypted_regex.
|
||||
token: ENC[AES256_GCM,data:fZKJzLy8FjN+0ONrHn40Tgb1/uTtYdAWTJwY7BfFltsGCPnuMx1F8KIPfQbzliyH,iv:yzaHrdDrSBbnT01aJmv8537D1lVe4kwIDINiuOgXPKU=,tag:dT7Z5v3CUhJg/+BqcjAWIA==,type:str]
|
||||
# No provider, model, or credentials: the backend is selected
|
||||
# dynamically (nothing injected, nothing pinned) — when a dispatch or a
|
||||
# chat turn needs a key, the daemon resolves it through the rhema
|
||||
# config seam, not through this release. The nulls erase the chart's
|
||||
# built-in anthropic/claude defaults from the rendered claw.yaml.
|
||||
config:
|
||||
provider: null
|
||||
model: null
|
||||
watches: null
|
||||
# The chart's own ingress, rendered from these values. Plain HTTP on
|
||||
# purpose: kosmos.lan is LAN-internal and token-auth-only, like every
|
||||
# other .lan surface here (no TLS story for .lan hosts).
|
||||
ingress:
|
||||
enabled: true
|
||||
host: kosmos.lan
|
||||
className: traefik
|
||||
annotations:
|
||||
external-dns.alpha.kubernetes.io/enabled: "true"
|
||||
persistence:
|
||||
enabled: true
|
||||
storageClass: longhorn
|
||||
size: 5Gi
|
||||
resources:
|
||||
requests:
|
||||
cpu: 100m
|
||||
memory: 256Mi
|
||||
limits:
|
||||
cpu: "1"
|
||||
memory: 1Gi
|
||||
sops:
|
||||
lastmodified: "2026-10-10T11:49:22Z"
|
||||
mac: ENC[AES256_GCM,data:vz3cATCAOEoyXOJCz0u+GfIq06lV5sV3mUoOKa4lUOWnShGOnxxE+v60AslV4KYBfmSCVliTalM0Vm8isuqJSAd9ZdPaI0CZ9F0gkxza22eaESkapIcIYrAhJYcZnRBSyAXjdVHyIzlvVwyTEqWYvEW7F5MJUgc4igHFD1/gMIA=,iv:VxsYzAWGhOiLXCt68Mpu8N9xgjsXXgc2LnInv2BExV8=,tag:rICLpdj4D37QZtTNV91uWA==,type:str]
|
||||
pgp:
|
||||
- created_at: "2026-10-10T11:49:22Z"
|
||||
enc: |-
|
||||
-----BEGIN PGP MESSAGE-----
|
||||
|
||||
hQIMA7uy4qQr71wiAQ//WeO+shUgWwJAu2IdxVteea0IpFCyo93hWqxLWMytqF7+
|
||||
3h2s7zXXsNvNCvqndHzNSrZt+OuSQDWSBVIzfxlztw7ga6BdI92OhpOZPCIyKwDT
|
||||
LzzUCPrSAGOZVekOkFXKlVDjMFunAiEp/soGda7bbP+VrdHJmeRh8fioTOgd/4qL
|
||||
/QmmJk3bMTlMoVcknOW2qI3n79YA9qnI0vjwBL63bDeZnxZ8CiZzd1SDr10K0rDf
|
||||
f9ErcmeKAwm+HgehSA3xId0Cph4gnf3xNhNDe2gcZvoFlPIrZT0iU0fBzMRuJPxt
|
||||
c9g+TqTAHBfx90H58/NF8Sfr3ScXNUHvHzgzrq4w+ogqmp8NYsdDbzG1C318dV2o
|
||||
nITluENiYgR9Qs6gJda94aEc00IYEBp4lNGp5G1SyHiDB+jMMsiHX6w3x286dgNx
|
||||
G6DcJ+TabCO+A+Fzq74I2ds+paoEgDegDMCIgK6uSKF0jT2ID579Bf2kRraneOqV
|
||||
amgBI2CQZG5FAqdhbtpf4PHAK9YR3b42mgF9nBAc+f/oFeAZm8nFmG7LubwxqbgY
|
||||
HLa7+ct38ygp/pwZ0FQcU5I3VwqYyU+JA3HMsL2yspHJAeQuXAvzkCQ8NaDOMpEY
|
||||
JRY1pIHl3SwTkV3zh9co8r2Ho8fGYO6KzlNfEdRsx2C6DegM70kpPuYzcCDYAd3S
|
||||
XAE6EX2dM+NxYqhHEIwKjFMJlROWwhhRhheFZnyYRMsn75NkeqRfPi2tJgMkIMk9
|
||||
OJ1eekhgFbQr8vaWtrIOhjvQG9ieg2ujuyltVcC2XUFxQONCxbfoXC2oYu1Y
|
||||
=gTTK
|
||||
-----END PGP MESSAGE-----
|
||||
fp: DC6910268E657FF70BA7EC289974494E76938DDC
|
||||
encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml|token)$
|
||||
mac_only_encrypted: true
|
||||
version: 3.10.2
|
||||
@@ -1,13 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: get-rhema
|
||||
resources:
|
||||
- namespace.yaml
|
||||
- repository.yaml
|
||||
- release.yaml
|
||||
secretGenerator:
|
||||
- name: get-rhema-values
|
||||
files:
|
||||
- values.yaml=values.yaml
|
||||
configurations:
|
||||
- kustomizeconfig.yaml
|
||||
@@ -1,6 +0,0 @@
|
||||
nameReference:
|
||||
- kind: Secret
|
||||
version: v1
|
||||
fieldSpecs:
|
||||
- path: spec/valuesFrom/name
|
||||
kind: HelmRelease
|
||||
@@ -1,4 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: get-rhema
|
||||
@@ -1,21 +0,0 @@
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: get-rhema
|
||||
namespace: get-rhema
|
||||
spec:
|
||||
interval: 1m
|
||||
chart:
|
||||
spec:
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: rhema-dist
|
||||
namespace: get-rhema
|
||||
chart: rhema-dist
|
||||
# Same CI scheme as the other vhaudiquet charts: timestamped
|
||||
# versions on main pushes, exact versions on v* tags.
|
||||
version: '>=0.1.0-0'
|
||||
interval: 1m
|
||||
valuesFrom:
|
||||
- kind: Secret
|
||||
name: get-rhema-values
|
||||
@@ -1,11 +0,0 @@
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: rhema-dist
|
||||
namespace: get-rhema
|
||||
spec:
|
||||
interval: 1m
|
||||
# Public org-scoped chart repository, same one CI publishes the
|
||||
# rhema-dist chart to (from git.vhaudiquet.fr/vhaudiquet/rhema.rs).
|
||||
# No auth, unlike the saggar org repo: the vhaudiquet org is public.
|
||||
url: https://git.vhaudiquet.fr/api/packages/vhaudiquet/helm
|
||||
@@ -1,58 +0,0 @@
|
||||
# get.rhema.rs, the rhema distribution (chart rhema-dist, repo
|
||||
# vhaudiquet/rhema.rs). One single-node Garage, one bucket, the
|
||||
# saggar-dist shape: the S3 API stays cluster-internal (chart default,
|
||||
# s3.ingress.enabled=false — release uploads come from the in-cluster
|
||||
# runners) and the bucket serves as a public read-only website.
|
||||
# The host MUST be <bucket>.<root domain> — Garage resolves the bucket
|
||||
# from the Host's first label — so bucket `get` on get.rhema.rs.
|
||||
bucket: get
|
||||
garage:
|
||||
# Single-node store: skip the hourly self-sync cycles — while a
|
||||
# full sync runs, S3 auth lookups transiently answer
|
||||
# InvalidAccessKeyId (see get-saggar). Weekly.
|
||||
fullSyncInterval: 604800
|
||||
web:
|
||||
ingress:
|
||||
className: traefik
|
||||
host: get.rhema.rs
|
||||
# TLS terminates at Caddy with the cert-manager get.rhema.rs
|
||||
# cert; Caddy proxies to Traefik by host, so no tls block here.
|
||||
tls:
|
||||
enabled: false
|
||||
# The write surface, public via Caddy: the release runners reach the
|
||||
# S3 API by host (the in-cluster Service name does not resolve from
|
||||
# them). TLS terminates at Caddy, like the web face.
|
||||
s3:
|
||||
ingress:
|
||||
enabled: true
|
||||
className: traefik
|
||||
host: s3.rhema.rs
|
||||
tls:
|
||||
enabled: false
|
||||
secretName: ""
|
||||
sops:
|
||||
lastmodified: "2026-10-16T06:56:14Z"
|
||||
mac: ENC[AES256_GCM,data:XuFKJcXb2C22x1GaADmX+QwQNAeUiYsmSh4g0Z5CTyvIXSI5gksAVKNgF0RqRNDLDmDA1jGCS+a0Y//ExXZO1kKQj2jYdYcKU4IvOmniMiwut5ZtobFbuskv7boAxmNRT/Y/4RgyyT8+45b/2+u3i9u2cwSQQ0Itvh5PxpFlE+I=,iv:3qXS6rEkeodOwLt5AOx8atfr15fK1zpmkM8uKjxUB2w=,tag:1Y78Jq8E44IGukCpR99UwA==,type:str]
|
||||
pgp:
|
||||
- created_at: "2026-10-16T06:56:14Z"
|
||||
enc: |-
|
||||
-----BEGIN PGP MESSAGE-----
|
||||
|
||||
hQIMA7uy4qQr71wiAQ/+KleFpAm4wpwoyB8U15o27ys2KXyKNFUl0EeRhYBYjcqe
|
||||
wgtiayZjGbM0Tz2x9+SFLQhezldMlH8N5l0BscuYBMAUgDXS9OMN+v/1nHk0pu43
|
||||
FUYHEWbYmYgngzGKuQhdrGEEtNBH12oKcBVwIPG7zaTfAlhfZIq/xsh6QyfTZX36
|
||||
mSzUsshYPmqUM+RymH/PrJjpWz15XBdFUiY59+hNa9kqjalyTg0gijuu6JkKbYTK
|
||||
SnFd2i9Ud/meniC4oBlLyOc0PX1/uyeIY1SFbGHdwBcHCFdIzMow2fZWLzimsNyB
|
||||
GIO31PbyhG3ZCb2cOzYC0XqJUdP6lHbAyDBDiGWu+dBupDb8d96XeaIF0cTgOjxJ
|
||||
0FrDMk1OAc1HjnhGo4QrEPMT0vMJmRDcDWXp60pFycRIrjGyXItMqkW06Xlr5HvF
|
||||
OM8q3gjz6s7/Yi80EHKyFEHsvLl8jw2OXYhSiUEy6mSfii5k4Hhs2PBJFKcxLqZA
|
||||
tH0caDA4zJia8FdlaTHI9OE33TvP/9uxvY9kBJUaeMdLxCo4T0keOiam2b0K/H8N
|
||||
owIhdVJmXtsAFiw+t7KKZku9kQtkav8hEn1G++VQXL/XUjxvv3CewDq9cbNW7aIU
|
||||
byjUf4jPR+kI4TeyR01YMDP2+O5Ld0/NxlCKqF10w8KVs1OsWFBagC7I4iPy99XS
|
||||
XAEWw3W3SSGkz+9t2cqmXTxCPIvU0ANjkz8PoNAfx9HC3UWk3So1MGht0FDR9QVZ
|
||||
AOzPM4U43wnYrTp1sq4N9Xh7xU2m2e7iUt/g2dtRFvx0vv2qMt4ianqzYiB0
|
||||
=1619
|
||||
-----END PGP MESSAGE-----
|
||||
fp: DC6910268E657FF70BA7EC289974494E76938DDC
|
||||
encrypted_regex: ^(data|stringData|.*key|.*crt)$
|
||||
version: 3.10.2
|
||||
@@ -1,13 +0,0 @@
|
||||
apiVersion: kustomize.config.k8s.io/v1beta1
|
||||
kind: Kustomization
|
||||
namespace: rhema-site
|
||||
resources:
|
||||
- namespace.yaml
|
||||
- repository.yaml
|
||||
- release.yaml
|
||||
secretGenerator:
|
||||
- name: rhema-site-values
|
||||
files:
|
||||
- values.yaml=values.yaml
|
||||
configurations:
|
||||
- kustomizeconfig.yaml
|
||||
@@ -1,6 +0,0 @@
|
||||
nameReference:
|
||||
- kind: Secret
|
||||
version: v1
|
||||
fieldSpecs:
|
||||
- path: spec/valuesFrom/name
|
||||
kind: HelmRelease
|
||||
@@ -1,4 +0,0 @@
|
||||
apiVersion: v1
|
||||
kind: Namespace
|
||||
metadata:
|
||||
name: rhema-site
|
||||
@@ -1,21 +0,0 @@
|
||||
apiVersion: helm.toolkit.fluxcd.io/v2
|
||||
kind: HelmRelease
|
||||
metadata:
|
||||
name: rhema-site
|
||||
namespace: rhema-site
|
||||
spec:
|
||||
interval: 1m
|
||||
chart:
|
||||
spec:
|
||||
sourceRef:
|
||||
kind: HelmRepository
|
||||
name: rhema-site
|
||||
namespace: rhema-site
|
||||
chart: rhema-site
|
||||
# Same CI scheme as the other vhaudiquet charts: timestamped
|
||||
# versions on main pushes, exact versions on v* tags.
|
||||
version: '>=0.1.0-0'
|
||||
interval: 1m
|
||||
valuesFrom:
|
||||
- kind: Secret
|
||||
name: rhema-site-values
|
||||
@@ -1,10 +0,0 @@
|
||||
apiVersion: source.toolkit.fluxcd.io/v1
|
||||
kind: HelmRepository
|
||||
metadata:
|
||||
name: rhema-site
|
||||
namespace: rhema-site
|
||||
spec:
|
||||
interval: 1m
|
||||
# Public org-scoped chart repository, same one CI publishes the
|
||||
# rhema-site chart to (from git.vhaudiquet.fr/vhaudiquet/rhema.rs).
|
||||
url: https://git.vhaudiquet.fr/api/packages/vhaudiquet/helm
|
||||
@@ -1,42 +0,0 @@
|
||||
# rhema.rs, the static landing/download site (chart rhema-site, repo
|
||||
# vhaudiquet/rhema.rs). One stateless nginx Deployment.
|
||||
# TLS terminates at Caddy with the cert-manager rhema.rs certs; Caddy
|
||||
# proxies to Traefik by host, so the ingress stays plain HTTP (same
|
||||
# shape as every other public site here).
|
||||
replicaCount: 1
|
||||
ingress:
|
||||
enabled: true
|
||||
className: traefik
|
||||
siteHost: rhema.rs
|
||||
# www redirects to the apex inside nginx, so it rides the same
|
||||
# service; only the host name differs.
|
||||
wwwHost: www.rhema.rs
|
||||
tls:
|
||||
enabled: false
|
||||
sops:
|
||||
lastmodified: "2026-10-15T20:28:50Z"
|
||||
mac: ENC[AES256_GCM,data:jDNsyWKl2WhofVTzlgevHuPoLZUrLTW87Wd+dLv3nWEFWfN3G8fy0IKGbns1NpFyhx/OfqDJjlmDeZyt4dfmRUPC3Y1MI3kd4KUGlKf0lPy94MTJog7DZtVGtS0RUCN7/NevqtopIivj38u1dXjdcRI+F8bL91blf+RHvvvGOe8=,iv:pmVYVtNhczWqk8CLrAP2McUTrn8uTE88LC9oKtYQzf4=,tag:s+TXQDFqipQtfkE/BN2ASA==,type:str]
|
||||
pgp:
|
||||
- created_at: "2026-10-15T20:28:50Z"
|
||||
enc: |-
|
||||
-----BEGIN PGP MESSAGE-----
|
||||
|
||||
hQIMA7uy4qQr71wiAQ//df2F/yV6AzsAeDXunqgf016/km+/O8b37+WSaoB7UHb0
|
||||
f/3lqxoVD9EWaTLum1pwHbhauDrjsOyyqkmIbEeOdnMQjEhDvnjfkDbTDupwl7Qg
|
||||
m95ozoUsprhlqEu61ANhAx5xOHfelV5hkL5+ef9o3o0Ist2T8uBv/v+KxnbCHwmQ
|
||||
e2/rjZ9BF8JgnhYVN3VKnpCgz2k9DVAdIZ4saeaET71MCK2naaO8BcVOH86H2Kn6
|
||||
croIE0V/RNPBL3V0PDF804jRIPwfwd0sQiSwwpo11a/9Zgfwj2PDft1FPFyRv7Yt
|
||||
iy5RaJ8rY8C2AqxRj1V0QIp6SyT784yhW02//8zZOA3Mcs9RUJfBosbqQDb3KIPx
|
||||
MMNNgA1/Fa+7VWI7UX6/24tg2m7MPSCRLvzZMWzriKvcKQj/A0fn4pgcQfQ5wqnm
|
||||
v/VrdLL8PBfy2dkYAsBvx4mAt11sOPwoT0iFhxInLNGeGsteJ5/texgLmJ/uO6vx
|
||||
jJLJT8izFKqZKJCK5Db/Qx8RuiuGysaS3NiWVKfdWrwlbNsMKeRFMEaEAfKjPOPG
|
||||
+1WQcvi+jHfCWsjimxW2+Cs90ZIUY3lbGLuQWhFj8zynQt5rehCZzqjmtx6MbHRT
|
||||
GdDZm62Ox1sdMq1ZwMVElWelyNSTtPNN53DcEEiTGqaSwJjdLz9WZhcjMl0vE5rS
|
||||
XAGm3AzBcPNFtWEODV1AyXwOUPea5RJ7ZNOOPy7jTrV0sZwJ8TAc67VP9IW8n1CM
|
||||
22ri2Xq2qDidxsCKiQeaF77DN2YhBYJnxhvfeplVcKGyqb/EElDznR/fprDR
|
||||
=IpGk
|
||||
-----END PGP MESSAGE-----
|
||||
fp: DC6910268E657FF70BA7EC289974494E76938DDC
|
||||
encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml|token)$
|
||||
mac_only_encrypted: true
|
||||
version: 3.10.2
|
||||
@@ -80,13 +80,13 @@ spec:
|
||||
- longhorn-system
|
||||
selector:
|
||||
matchLabels:
|
||||
longhorn.io/component: instance-manager
|
||||
app: instance-manager
|
||||
- resources:
|
||||
namespaces:
|
||||
- longhorn-system
|
||||
selector:
|
||||
matchLabels:
|
||||
longhorn.io/component: engine-image
|
||||
app: engine-image
|
||||
mutate:
|
||||
# `request.object` is available in BOTH admission and background modes:
|
||||
# the backgroundController synthesizes an admission-like request for
|
||||
|
||||
Reference in New Issue
Block a user