chore(docker): bump bbilly1/tubearchivist Docker tag to v0.6.0

Revert "revert: restore caddy values to the last working state (s3 mount pending rework)"
This reverts commit bdfc374f08.
2026-11-05 21:38:11 +00:00 · 2026-10-31 05:01:50 +00:00 · 2026-10-16 09:20:37 +02:00 · 2026-10-16 09:09:28 +02:00 · 2026-10-16 09:06:11 +02:00 · 2026-10-16 09:04:31 +02:00
83 changed files with 1659 additions and 77 deletions
@@ -12,10 +12,14 @@ jobs:
  update-records:
    name: octodns
    runs-on: ubuntu-latest
-    container: octodns/cloudflare:latest
+    container: octodns/octodns:latest
    steps:
      - uses: actions/checkout@v4
      - name: Install DNS providers
        run: pip install octodns-cloudflare octodns-porkbun
      - name: octodns-sync - production
        run: octodns-sync --config-file ./config/production.yaml --doit
        env:
          CLOUDFLARE_TOKEN: ${{ secrets.CLOUDFLARE_TOKEN }}
          PORKBUN_API_KEY: ${{ secrets.PORKBUN_API_KEY }}
          PORKBUN_SECRET_KEY: ${{ secrets.PORKBUN_SECRET_KEY }}
@@ -1,6 +1,6 @@
 creation_rules:
  - path_regex: .*values.yaml$
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml|token)$
    mac_only_encrypted: true
    pgp: DC6910268E657FF70BA7EC289974494E76938DDC
  - path_regex: .*.yaml
@@ -7,10 +7,29 @@ providers:
  cloudflare:
    class: octodns_cloudflare.CloudflareProvider
    token: env/CLOUDFLARE_TOKEN
  porkbun:
    class: octodns_porkbun.PorkbunProvider
    api_key: env/PORKBUN_API_KEY
    secret_key: env/PORKBUN_SECRET_KEY
 zones:
-  '*':
+  vhaudiquet.fr.:
    sources:
      - config
    targets:
      - cloudflare
  buildpath.win.:
    sources:
      - config
    targets:
      - cloudflare
  rhema.rs.:
    sources:
      - config
    targets:
      - cloudflare
  saggar.dev.:
    sources:
      - config
    targets:
      - porkbun
@@ -0,0 +1,33 @@
 ---
 ? ''
 : octodns:
    cloudflare:
      auto-ttl: true
      proxied: false
  ttl: 300
  type: A
  value: 82.64.154.58
 get:
  octodns:
    cloudflare:
      auto-ttl: true
      proxied: false
  ttl: 300
  type: A
  value: 82.64.154.58
 s3:
  octodns:
    cloudflare:
      auto-ttl: true
      proxied: false
  ttl: 300
  type: A
  value: 82.64.154.58
 www:
  octodns:
    cloudflare:
      auto-ttl: true
      proxied: false
  ttl: 300
  type: A
  value: 82.64.154.58
@@ -0,0 +1,17 @@
 ---
 ? ''
 : ttl: 600
  type: A
  value: 82.64.154.58
 api:
  ttl: 600
  type: A
  value: 82.64.154.58
 docs:
  ttl: 600
  type: A
  value: 82.64.154.58
 get:
  ttl: 600
  type: A
  value: 82.64.154.58
@@ -383,6 +383,13 @@ photos:
  ttl: 300
  type: A
  value: 82.64.154.58
 pkgatlas:
  octodns:
    cloudflare:
      auto-ttl: true
  ttl: 300
  type: A
  value: 82.64.154.58
 sse-nook:
  octodns:
    cloudflare:
@@ -2,7 +2,7 @@ services:
  tubearchivist:
    container_name: tubearchivist
    restart: unless-stopped
-    image: bbilly1/tubearchivist:v0.5.10
+    image: bbilly1/tubearchivist:v0.6.0
    ports:
      - "8000"
    networks:
@@ -9,7 +9,7 @@ services:
  web_recipes:
    restart: always
-    image: vabene1111/recipes:2.6.15
+    image: vabene1111/recipes:2.6.13
    networks:
      - default
      - proxy
@@ -2,7 +2,7 @@ terraform {
  required_providers {
    docker = {
      source  = "kreuzwerker/docker"
-      version = "3.6.2"
+      version = "3.9.0"
    }
  }
 }
@@ -17,7 +17,7 @@ valkey-cluster:
 # Use standalone Valkey (replaces 'redis' in chart 12.x)
 valkey:
    enabled: true
-    master:
+    primary:
        resources:
            requests:
                cpu: 100m
@@ -30,10 +30,10 @@ postgresql:
    global:
        postgresql:
            auth:
-                postgressPassword: ENC[AES256_GCM,data:PtWMsukqbrWiVg==,iv:iQtDckrih/3ZKopzD9eEViOMZrvSulmCI5tHCsJph1A=,tag:7S54w4ADG7+8QNiLDw2Q0A==,type:str]
+                postgressPassword: ENC[AES256_GCM,data:4Kd4qz3DuJboaA==,iv:I9K1+j2tv7MKel9ej2/AED0JrxIfeb3D1xdDKCS+jTs=,tag:MpQ0NjglUvGZXzeOQjIj3Q==,type:str]
-                password: ENC[AES256_GCM,data:jLC1oEl+ZAnpbw==,iv:PliGMmxHKn3eEt8uvsv9wL4syk91EC5OpA7AL5J0+4o=,tag:Oan4ek7m0Cxnl5bzOCGHXw==,type:str]
+                password: ENC[AES256_GCM,data:YX6VvEJWfkO0dg==,iv:ixQkW2q7Y9YRIGMIbqWclA5q9Ufw+lNS7Gc4Wd1toiY=,tag:krGDeY+E4+PUjowt8jKAmA==,type:str]
                database: gitea
-                username: ENC[AES256_GCM,data:ricveNc=,iv:rPrHKhIzsNEQzoaX2cPDvVWjR7NIxsN1tBlzLB80IQ0=,tag:n64SpL6qM/IT9D7t85/Lvg==,type:str]
+                username: ENC[AES256_GCM,data:KvdO0oE=,iv:vFYOVlo2kvOHOhASDlccTfcpsgAkS6YXOLCm5sDcxaQ=,tag:9J6Dmc3vYpHlFSggoGVmLQ==,type:str]
    volumePermissions:
        enabled: true
    primary:
@@ -63,6 +63,7 @@ postgresql-ha:
 persistence:
    enabled: true
    subPath: data
    size: 30Gi
 extraVolumes:
    - name: git
      nfs:
@@ -76,8 +77,8 @@ gitea:
    oauth:
        - name: Authentik
          provider: openidConnect
-          key: ENC[AES256_GCM,data:9UuG23PYFiWrQKJX5xGxMgyWKLPFCxKjDUYJd59rMWcdAw619/v/Bw==,iv:AfHV1MzbYi5Z5Bb63/51Hmy9rM247b4quwKCzo7MpYw=,tag:pfpz7hhZyIUjIGGcxZVx/w==,type:str]
+          key: ENC[AES256_GCM,data:F0AGCSAkU2ZWmS4jniL8k32ABwrjtURAPLa3RKOCpJoaMkKRlRrqwA==,iv:vQcD73C3itBqKFEiv8PhLD2G3exC0zc2NDE3LGYpvXA=,tag:24nO98pP7a00sTBDWEMsBA==,type:str]
-          secret: ENC[AES256_GCM,data:PKFx/LhjwWJluC6/RHc1eMgw4TZXkXymNCrc7TQU6Bp5rGKHMvACC+G+MjXGylIMZVt65LHWq5YEHJNjO8HMsa4ejGukXDuU9sCgKaOOniCs3EQivfVsCCHtF/G48eULPkege7JRzTbmJSYJDnscsSikwvUDChy+zGlC2ZmBZjk=,iv:qsIaaeXepJ9ECilo+05+A0i2joxV0svBOjgL37DkimE=,tag:/3Xer7Yb6QyUtmPIOvSLQQ==,type:str]
+          secret: ENC[AES256_GCM,data:0/6XDvRXUnQXrJzivtDS6b+mmYjtOVcHhGmQJPFG1zDyO9BksHKau0D+hIsfM85761U7LAISct0HungGNeOQOULnmvVT8hEIgC21RHjArXztJY2964NS5XXfURc7pVxOJ7LSDFFd4azExwhrTktqmerG+F6SI5V/oq2iYYqJA7o=,iv:ShYcIgyccHvEFhVn++gBR7gmMOEKcBz9sj/Y+4pk/Hc=,tag:SkFM2d06O/zhpfVji4QDKA==,type:str]
          autoDiscoverUrl: https://authentik.vhaudiquet.fr/application/o/gitea/.well-known/openid-configuration
    config:
        APP_NAME: Gitea
@@ -103,37 +104,39 @@ gitea:
        indexer:
            ISSUE_INDEXER_TYPE: bleve
            REPO_INDEXER_ENABLED: true
-# Resource limits for Gitea container
+# Resource limits for Gitea container. Sized to receive a full linux
 # kernel tree: index-pack on ~12M objects needs several GiB and more
 # than half a core (the 1Gi limit OOMKilled the pod mid push).
 resources:
    requests:
        cpu: 100m
        memory: 512Mi
    limits:
        cpu: 500m
        memory: 1Gi
    limits:
        cpu: "4"
        memory: 6Gi
 replicaCount: 1
 sops:
-    lastmodified: "2026-09-09T21:39:30Z"
+    lastmodified: "2026-09-30T21:03:47Z"
-    mac: ENC[AES256_GCM,data:ACBKJLGUfWw9T3fOhQMT251gcLzG3bUXjUqBxG1DuPl8c8bblaIpLOu0QsrfQziQY3jM0DFJ2W/I2vjkrhCuCaZhZCtRg2nzUk+7HelqjEdKLphSuIdlHIkz7Icu+khShrwTgmQiE00Gg1WUsLRkKBgNsOm3TMK4wB874iBvSYY=,iv:Idp0+UBXaRFkpOFKFoRrLKuN1mOmfM7pukC22KkNiCU=,tag:fL9DzAo8FSx4PblVlTHtaQ==,type:str]
+    mac: ENC[AES256_GCM,data:eHMr2BqfWNI32S14XEivXtXSIRiCBCAQz06mwtbNyXc1dI6YgF4pKdyIbfRWQW0ZYcbvqKxtyugao+lhc24Ds/GgIbdwchlMyz/DyuOQtM5GMHcSoInQUQVGzrM8hSyztKzq10bH0DmKvT68+uaVx0hf6rzxEqLRb3GAk4q3310=,iv:5kJ6bYE/54EbDWctSXBcVTjJtc/J3mV664tFD1WTK90=,tag:AAbHK3njH0PCqw9yjSWevQ==,type:str]
    pgp:
-        - created_at: "2026-09-09T21:39:30Z"
+        - created_at: "2026-09-30T21:03:47Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----
-            hQIMA7uy4qQr71wiAQ/+PK0/kUHlc+exa8slolUeTGjHzd/R1Dtux/+HJdC9Vpow
+            hQIMA7uy4qQr71wiAQ//Vf2Rdp8NG4AsbIIOiXabY3AzLyVbE9Pn52+FBF+NIfkS
-            ImAQvIdkEjwL0FmoA7Z4val/Wzx/YzFJ5r6sADNaQ9EG7QO+I8WY3VrKj5aRi0Qz
+            XDqlgvMAWHtmV2LzvJPwPIUjCZkoRwmDsh9zi+W1XzHh9kKxzwvIxfjiqm8fwJh8
-            +FgHAgng+wdRCCBoxv9Z+MTPSl4TwrKsbrulHAg7EayDKxwGzkyMrnxvukRqD8GB
+            gb4a/y5mkkEqs+H0zE1H4D91dPbfOmDABJKaePmWTB+tc48bY6qX+LYs7hkPwsHU
-            iMQCUadudR458fzB04dkhljAbl/FqX5ppflzEoGVCiRSBcWNkaHgyYqopYGzMASy
+            sN64cidbIbzBoq0t1TWZFkl6MZYWX9IyqJE1XcqYDAvwxlJ4JMJH2pGQlY8+7U96
-            KTzoV01adnOZY+xeZa5GasgCEbCU3BDesD9vBb+sFsRugVuRHzdyqp3nVBwudpeh
+            YQgbXhuAik5IzNQlmdpq0mt0j3KZgM7KbLJ2en6JAiO0EhD3xKbFnC0bPniUEX2c
-            OcE9MOMyBN1SAdx9RCsB8aHWYndF1dim84ZWgQThkLlA+7CWJt/NyFYwmMdqqzSv
+            Yv6Z/1NrmNImCwbOkrNF9sqto4d9VHFDH8udSHKCXcSbzJmkfF4XUOBuNxtprmQV
-            C7slojC6B8bb3863c5w3qe9TPPBwyTOcuNTMunr6wXidlPZWtsImhu/RX9fqzFjZ
+            Wlcw5ZMFpnOgRn+V2gb0Cd3cm5rje0QAYCgIGUfduvMm9BReAQTvpUdKkqKs0mLr
-            9X1+wAjAfs7AASeNJLFYqiPrknSAA3JumQZtrFC5dejpTj9H2ns6DkiHSZy8FA8O
+            XiRAG0HfjjGNcVqWA0H0L5UxlVwHJh6zSNHDzTPVlGenVcQSpiUORKxZqANpQchW
-            RuZ8hv/L8L8oilbubKnKFZLhR8lh8A1jXHUxzaEC/L4o4cd7/3TlEms/51yM9qYx
+            /wtFghatZFKbbzEz6Mo5C3hMKOXjl/VNWsmva8BoloDKPm9pWH5S4x0ExYiOWSOk
-            WJOz4H8lbphDYO4tFgsGAhL/yHbLHvww/X1hNldwI7mqYrFLSjIwxW2Oxo8c+QB6
+            Yk9j+twTgJXMeptO55qMCJKl6CcRsbgVr5yJJXWC6I3tr2ssx1BnSAPYDviuhsC1
-            yZ3VxTXuS9jEVpGTVhIOfepwS8rJQbTUeewqok3riw9GpSEFpOMWsBxlT6+HI8zS
+            YAbgFlvdzE6n8FmTixVwzVZrTbZV7alz9PECViMP5evAphe3n1MvnLEvMM0WOm/S
-            XgHPVohxe93kk51O7WjBgq8PAwG7DtWrygqWYORz+pTYN8wTtC4pfotiJZ7hv7Gv
+            XgG0Ty4hQ9ZD7gzhIrh06xVuh+MC/PaMYIZ7LBVHgQy8xbAgQH0qXkF39/9rCIws
-            NICEZlirrTUdIol8jyM+yRv1gWuYwQJpjnrQVY2AoAQX6ta5/3st24cyuGwGHO0=
+            A/D0FN29uXvfSWzlgSrGOj218eKHX9g+nZGIAHeejd/FJVnOKQpUboUlg/x3jqQ=
-            =Q6Pu
+            =943y
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
@@ -0,0 +1,13 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: pkgatlas
 resources:
  - namespace.yaml
  - repository.yaml
  - release.yaml
 secretGenerator:
  - name: pkgatlas-values
    files:
      - values.yaml=values.yaml
 configurations:
  - kustomizeconfig.yaml
@@ -0,0 +1,6 @@
 nameReference:
 - kind: Secret
  version: v1
  fieldSpecs:
  - path: spec/valuesFrom/name
    kind: HelmRelease
@@ -0,0 +1,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
    name: pkgatlas
@@ -0,0 +1,22 @@
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
    name: pkgatlas
    namespace: pkgatlas
 spec:
    interval: 1m
    chart:
        spec:
            sourceRef:
                kind: HelmRepository
                name: pkgatlas
                namespace: pkgatlas
            chart: pkgatlas
            # CI publishes a timestamped version on every main push and
            # stamps appVersion with the commit SHA of the image it
            # builds; this range always picks the latest one.
            version: '>=0.4.0-0'
            interval: 1m
    valuesFrom:
        - kind: Secret
          name: pkgatlas-values
@@ -0,0 +1,8 @@
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:
    name: pkgatlas
    namespace: pkgatlas
 spec:
    interval: 1m
    url: https://git.vhaudiquet.fr/api/packages/vhaudiquet/helm
@@ -0,0 +1,47 @@
 # Chart: https://git.vhaudiquet.fr/vhaudiquet/pkgatlas (chart/pkgatlas).
 # The image ships both binaries (build + serve) and runs as nonroot
 # (uid 65532, distroless). Everything else is chart default: discovery
 # first — build.enabled=false, the first refresh pass builds the whole
 # live rotation and /v1/readyz stays 503 until it lands; weekly
 # refresh after that.
 image:
    repository: git.vhaudiquet.fr/vhaudiquet/pkgatlas
 ingress:
    enabled: true
    className: traefik
    hosts:
        - host: pkgatlas.vhaudiquet.fr
          paths:
            - path: /
              pathType: Prefix
    # TLS terminates at Caddy with the *.vhaudiquet.fr wildcard cert;
    # Caddy proxies to Traefik by host, so no tls block here (same as
    # gitea's ingress).
    tls: []
 sops:
    lastmodified: "2026-09-24T19:57:42Z"
    mac: ENC[AES256_GCM,data:cidn6U0EFjuEx98GA8Jlppg3GobcGGrhs20dPoAnUXdpFogfsp3YOTPCKuKi0LrOw/fxBP84U4drx5lJcjL11Ft/Ozn6Z8tk3l8cdqK+BUm6yijtQ0PXHjPUJYNIeqxrQKJzFlVHS+tOARbhQ3DjoNt71WBMfSPUDcPxrbnwVAA=,iv:Yz85yh9jrLXf6DKeVmOLeiVCWcthKCPGCJJwR3RVikg=,tag:7Mdv4VZUpsjuysitx4b2DA==,type:str]
    pgp:
        - created_at: "2026-09-24T19:57:42Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----
            hQIMA7uy4qQr71wiAQ/+N+gGPOCbuxleT6xx0FduVN1vspYJlCyrtLsy632Yz17x
            ucwqSuGciqUf2kF3GwnOzINEY0eLskbKHMX5wkbJg8+X6dXoRyiseX3fdNrpvMGR
            P1ZC/C4O6BzQoPJOXDQZHuWPI0Imx61PlzDPzsJ44JBvwrkCKgoaWOvzMyTjZHiC
            iplyHpzDR2sqfMe29aQICrEV6Z87eMWQ3wie6CzX2OYTj89BejsN2Ibg4n5cqdNO
            c+mM7Ek2nSWMWYGbdL0W2N6WSIbGuQj/aVbS0s6585NUPJtmcznB7uosRroqfbd2
            9SMP1gaUOr+00kykRxKtd/ZoW7S/21kGbZ8FwvtKZFrBwcoUuLehbSGAHRYLo6dI
            5WGeky65IrvpKen8Q/B6o6EByTONt2h+XiyJyLwDLeFh13/ldkGqa1oW+4BTHuX9
            2WvLOboHpr4MGQdO53Q8zm8VCGAltusII6ZVaoEyjilqZtC/Aa9XZIT/HshOGTQi
            4CITE1BfGEApOcBbBQKdjYofdWcyuLSF/ertXvcvNiCoVe0wYiHSYUht+HulQ3t+
            Z0K7C2sJ2bx8C+316b2MzCGVrVOuqDABpQJjIr4aiRG9v8BtYTaUc425CLm9TMtA
            PmZR1Rqowy4ECekrbvk3lNjPoq13HLSqkm2ppL9WFub5zY2XY0npprSeUknTmSDS
            XgGFDhcroUq0vTUlJbC015kpa6cpynwTmMuQrFaMPeKeBPkL4Le6QFJMjpIi3yg3
            65bSBv5t7YXoHFJWVFYej005Lz1lxp1VtaMiA0bnKEnyh/SbfcUqD4d9P1WNx+4=
            =ulvs
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
    mac_only_encrypted: true
    version: 3.10.2
@@ -79,3 +79,131 @@ spec:
    - buildpath.win
  duration: 2160h # 90 days
  renewBefore: 360h # 15 days before expiry
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: saggar-dev
  namespace: caddy
 spec:
  secretName: saggar-dev-tls
  issuerRef:
    name: letsencrypt-production
    kind: ClusterIssuer
  commonName: saggar.dev
  dnsNames:
    - saggar.dev
  duration: 2160h # 90 days
  renewBefore: 360h # 15 days before expiry
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: api-saggar-dev
  namespace: caddy
 spec:
  secretName: api-saggar-dev-tls
  issuerRef:
    name: letsencrypt-production
    kind: ClusterIssuer
  commonName: api.saggar.dev
  dnsNames:
    - api.saggar.dev
  duration: 2160h # 90 days
  renewBefore: 360h # 15 days before expiry
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: docs-saggar-dev
  namespace: caddy
 spec:
  secretName: docs-saggar-dev-tls
  issuerRef:
    name: letsencrypt-production
    kind: ClusterIssuer
  commonName: docs.saggar.dev
  dnsNames:
    - docs.saggar.dev
  duration: 2160h # 90 days
  renewBefore: 360h # 15 days before expiry
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: get-saggar-dev
  namespace: caddy
 spec:
  secretName: get-saggar-dev-tls
  issuerRef:
    name: letsencrypt-production
    kind: ClusterIssuer
  commonName: get.saggar.dev
  dnsNames:
    - get.saggar.dev
  duration: 2160h # 90 days
  renewBefore: 360h # 15 days before expiry
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: rhema-rs
  namespace: caddy
 spec:
  secretName: rhema-rs-tls
  issuerRef:
    name: letsencrypt-production
    kind: ClusterIssuer
  commonName: rhema.rs
  dnsNames:
    - rhema.rs
  duration: 2160h # 90 days
  renewBefore: 360h # 15 days before expiry
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: s3-rhema-rs
  namespace: caddy
 spec:
  secretName: s3-rhema-rs-tls
  issuerRef:
    name: letsencrypt-production
    kind: ClusterIssuer
  commonName: s3.rhema.rs
  dnsNames:
    - s3.rhema.rs
  duration: 2160h # 90 days
  renewBefore: 360h # 15 days before expiry
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: www-rhema-rs
  namespace: caddy
 spec:
  secretName: www-rhema-rs-tls
  issuerRef:
    name: letsencrypt-production
    kind: ClusterIssuer
  commonName: www.rhema.rs
  dnsNames:
    - www.rhema.rs
  duration: 2160h # 90 days
  renewBefore: 360h # 15 days before expiry
 ---
 apiVersion: cert-manager.io/v1
 kind: Certificate
 metadata:
  name: get-rhema-rs
  namespace: caddy
 spec:
  secretName: get-rhema-rs-tls
  issuerRef:
    name: letsencrypt-production
    kind: ClusterIssuer
  commonName: get.rhema.rs
  dnsNames:
    - get.rhema.rs
  duration: 2160h # 90 days
  renewBefore: 360h # 15 days before expiry
@@ -40,6 +40,8 @@ data:
        @umami       host umami.vhaudiquet.fr
        @pkgatlas    host pkgatlas.vhaudiquet.fr
        handle @authentik {
            reverse_proxy traefik.traefik.svc.cluster.local.:80
        }
@@ -70,6 +72,9 @@ data:
        handle @umami {
            reverse_proxy traefik.traefik.svc.cluster.local.:80
        }
        handle @pkgatlas {
            reverse_proxy traefik.traefik.svc.cluster.local.:80
        }
        # Docker VM services (via Docker Traefik)
        @alexscript     host alexscript.vhaudiquet.fr
@@ -102,3 +107,43 @@ data:
      tls /etc/caddy/certs/buildpath-win/tls.crt /etc/caddy/certs/buildpath-win/tls.key
      reverse_proxy traefik.traefik.svc.cluster.local.:80
    }
    saggar.dev {
      tls /etc/caddy/certs/saggar-dev/tls.crt /etc/caddy/certs/saggar-dev/tls.key
      reverse_proxy traefik.traefik.svc.cluster.local.:80
    }
    api.saggar.dev {
      tls /etc/caddy/certs/api-saggar-dev/tls.crt /etc/caddy/certs/api-saggar-dev/tls.key
      reverse_proxy traefik.traefik.svc.cluster.local.:80
    }
    docs.saggar.dev {
      tls /etc/caddy/certs/docs-saggar-dev/tls.crt /etc/caddy/certs/docs-saggar-dev/tls.key
      reverse_proxy traefik.traefik.svc.cluster.local.:80
    }
    get.saggar.dev {
      tls /etc/caddy/certs/get-saggar-dev/tls.crt /etc/caddy/certs/get-saggar-dev/tls.key
      reverse_proxy traefik.traefik.svc.cluster.local.:80
    }
    rhema.rs {
      tls /etc/caddy/certs/rhema-rs/tls.crt /etc/caddy/certs/rhema-rs/tls.key
      reverse_proxy traefik.traefik.svc.cluster.local.:80
    }
    www.rhema.rs {
      tls /etc/caddy/certs/www-rhema-rs/tls.crt /etc/caddy/certs/www-rhema-rs/tls.key
      reverse_proxy traefik.traefik.svc.cluster.local.:80
    }
    get.rhema.rs {
      tls /etc/caddy/certs/get-rhema-rs/tls.crt /etc/caddy/certs/get-rhema-rs/tls.key
      reverse_proxy traefik.traefik.svc.cluster.local.:80
    }
    s3.rhema.rs {
      tls /etc/caddy/certs/s3-rhema-rs/tls.crt /etc/caddy/certs/s3-rhema-rs/tls.key
      reverse_proxy traefik.traefik.svc.cluster.local.:80
    }
@@ -10,7 +10,7 @@ image:
    repository: caddy
    pullPolicy: IfNotPresent
    tagSuffix: ""
-    tag: 2.11.4
+    tag: 2.11.7
 service:
    type: LoadBalancer
    # Cluster (not Local) so any node can forward to pods on any other node.
@@ -36,25 +36,61 @@ health:
 volumes:
    - name: vhaudiquet-fr-tls
      secret:
-        secretName: ENC[AES256_GCM,data:HYQb37rKxMqxFTsCz5kw6qY=,iv:dI9uqUVLLqPv3a5vwz1vowTvO9WduQaXqj7XZREd7oA=,tag:mz257AC3pvubgzOMxbHfrg==,type:str]
+        secretName: vhaudiquet-fr-tls
-        optional: ENC[AES256_GCM,data:k9FVxw==,iv:XMAGop2PvSGD1R1cy6qqE39bsIAOFIqGzTnwDmYRhHM=,tag:7zZAwSzRWWiT9Y2iMWkI6w==,type:bool]
+        optional: true
    - name: wildcard-vhaudiquet-fr-tls
      secret:
-        secretName: ENC[AES256_GCM,data:2OUkq/AMuv2wQyIlLPS3bSRrnV1mvDR6vd0=,iv:1e9HC8FFC4vo7GjCnJyNjF05R+Js41ONy2in5a+/doI=,tag:icKdtLhvQ40YI+KCE+6fXg==,type:str]
+        secretName: wildcard-vhaudiquet-fr-tls
-        optional: ENC[AES256_GCM,data:b+zvMw==,iv:QyU+T1BGZenO/nO8wq6R+KkrT/I6ZXIIhAnf5npFhvw=,tag:4UPyop81BQu4zxhZmK2n+Q==,type:bool]
+        optional: true
    # semery.fr certs from cert-manager (OVH DNS-01)
    - name: semery-fr-tls
      secret:
-        secretName: ENC[AES256_GCM,data:cLzhXgUhrwgIMACU1Q==,iv:DJ+6mjtjYmWxNcHl1gzeoifpcFCJsXiOXeyxEWnRU3g=,tag:7yc2bt6fBWwBuefPY48xyA==,type:str]
+        secretName: semery-fr-tls
-        optional: ENC[AES256_GCM,data:DTfxaQ==,iv:K7TJjSI/vF3x34SWmwmivYo+mSsUAg9nB94Ui85nHCI=,tag:1/JRBMlb07+aHKEulIYpQQ==,type:bool]
+        optional: true
    - name: wildcard-semery-fr-tls
      secret:
-        secretName: ENC[AES256_GCM,data:Qq+ybi1kSVdVn9RP/kTkTcw0lkao3Q==,iv:vFmV3YvSNhLizgJVBnq1ZERqDP70onuZDvy/I3joPtI=,tag:AiEW+yh51Dexz3Vha4MPgg==,type:str]
+        secretName: wildcard-semery-fr-tls
-        optional: ENC[AES256_GCM,data:0o4ODw==,iv:VwnCs2C1MVUJEfBvNJT1rkDV7m60sNZPdtERo9wWPJk=,tag:oo+liLatrjqEtlrKQyjhyg==,type:bool]
+        optional: true
    - name: buildpath-win-tls
      secret:
-        secretName: ENC[AES256_GCM,data:SejgJvZY/B7DDgf3YJcxcFA=,iv:bDZWhie17exL+9r9A7Ea/a8Rgpex7nuabVtW60LotJQ=,tag:WxqFbzulxxPgsynqfo5hzQ==,type:str]
+        secretName: buildpath-win-tls
-        optional: ENC[AES256_GCM,data:nBNRkw==,iv:JEvsFzMli7AzUj6GXJlHXOnANm45gnFE/kXrSbBotPQ=,tag:Puss6mCkoC7SGCb86guI2w==,type:bool]
+        optional: true
    # saggar.dev cert from cert-manager (Porkbun DNS-01)
    - name: saggar-dev-tls
      secret:
        secretName: saggar-dev-tls
        optional: true
    - name: api-saggar-dev-tls
      secret:
        secretName: api-saggar-dev-tls
        optional: true
    # docs.saggar.dev cert — the saggar book (static nginx)
    - name: docs-saggar-dev-tls
      secret:
        secretName: docs-saggar-dev-tls
        optional: true
    # get.saggar.dev cert — the saggar distribution host (garage web)
    - name: get-saggar-dev-tls
      secret:
        secretName: get-saggar-dev-tls
        optional: true
    # rhema.rs certs from cert-manager (Cloudflare DNS-01)
    - name: rhema-rs-tls
      secret:
        secretName: rhema-rs-tls
        optional: true
    - name: www-rhema-rs-tls
      secret:
        secretName: www-rhema-rs-tls
        optional: true
    - name: get-rhema-rs-tls
      secret:
        secretName: get-rhema-rs-tls
        optional: true
    - name: s3-rhema-rs-tls
      secret:
        secretName: s3-rhema-rs-tls
        optional: true
    - name: routes
      configMap:
        name: caddy-routes
@@ -75,6 +111,30 @@ volumeMounts:
    - name: buildpath-win-tls
      mountPath: /etc/caddy/certs/buildpath-win
      readOnly: true
    - name: saggar-dev-tls
      mountPath: /etc/caddy/certs/saggar-dev
      readOnly: true
    - name: api-saggar-dev-tls
      mountPath: /etc/caddy/certs/api-saggar-dev
      readOnly: true
    - name: docs-saggar-dev-tls
      mountPath: /etc/caddy/certs/docs-saggar-dev
      readOnly: true
    - name: get-saggar-dev-tls
      mountPath: /etc/caddy/certs/get-saggar-dev
      readOnly: true
    - name: rhema-rs-tls
      mountPath: /etc/caddy/certs/rhema-rs
      readOnly: true
    - name: www-rhema-rs-tls
      mountPath: /etc/caddy/certs/www-rhema-rs
      readOnly: true
    - name: get-rhema-rs-tls
      mountPath: /etc/caddy/certs/get-rhema-rs
      readOnly: true
    - name: s3-rhema-rs-tls
      mountPath: /etc/caddy/certs/s3-rhema-rs
      readOnly: true
    - name: routes
      mountPath: /etc/caddy/routes
      readOnly: true
@@ -99,7 +159,7 @@ affinity:
            - weight: 100
              preference:
                matchExpressions:
-                    - key: ENC[AES256_GCM,data:oCV218wXg+k2L/edhWv6qpiyiaY=,iv:Y+O2of2NCOvcjSwr0EenGns0BtpT+P6pjCzEZUIMpm0=,tag:kY/WyHJ4Jr5ZLMe6ZcT/Tw==,type:str]
+                    - key: ENC[AES256_GCM,data:AsOdq9OGQbAGV42W4d22EGVMi5E=,iv:U3sLu8pI7fqOPbvpfpVz21cUfwovKRFi8jY6laTyStY=,tag:EQVSFAzTYw2En2xdGTCF3Q==,type:str]
                      operator: NotIn
                      values:
                        - "true"
@@ -113,37 +173,36 @@ affinity:
                topologyKey: kubernetes.io/hostname
 tolerations:
    # Tolerate the failover taint so caddy CAN schedule on p330 (small-node-1).
-    - key: ENC[AES256_GCM,data:K6vJkO2dpKRi,iv:b7NIPKTMYOxNao6KcSJUhsxKNRJ2J3ksEtmXkI8b0So=,tag:pMRmz17upWMTEZjwBRNyZQ==,type:str]
+    - key: ENC[AES256_GCM,data:s3X0PmRJCCVh,iv:UYZl3EsmdSTdF9NoYsL+zbxLlkfO2GU80Sy3CpSXMBY=,tag:35UtC37ldCItR9fAtSXVVw==,type:str]
      operator: Equal
-      value: ENC[AES256_GCM,data:4ULPtEoUhgs=,iv:ikqWRqRR9ki35QQ6VnMEzOgT0/e+5DggGP8w60BhW/Q=,tag:MW9lX8miIWb9nnbc0woZTg==,type:str]
+      value: failover
      effect: NoSchedule
-    - key: ENC[AES256_GCM,data:l7abu6ywKFevJdJod2Af2bj7XSfBJATL7UnfiUHrRJoCjBsl9A==,iv:xnUvzVX8z4doC+mQs1r0rNCSqaZ8KlXxr5Ee9FOFPjI=,tag:mnqCx9NSMSyeYwz57QFQIQ==,type:str]
+    - key: ENC[AES256_GCM,data:NYCyZsj7wMxKUjaDu+rUOQYxDKvvEwSWuDAxQkSGTczXyApCbw==,iv:3AcvLXryeZ6dfmqanFpGOgEf1nGuEVbvUmZzruxzL98=,tag:Daa9AgXQZkkr7RIzljWOeQ==,type:str]
      operator: Exists
      effect: NoSchedule
 sops:
-    lastmodified: "2026-08-26T19:28:03Z"
+    lastmodified: "2026-10-16T07:06:11Z"
-    mac: ENC[AES256_GCM,data:gn90e5Gjq5/CraT7Cl43DVMIQukD798faKGbVO5IJlbpAuTwDrhvqnnojFq4R7LEEETtedpR3MRyqcnbfSWVruHoysebycL7EZJkiy7H36JmzQAOWKusshMF9kOyZIV6+AFfz8As/Mu4pF1p5+3jmgy6oOJn7Ewm0C930Gpa3gs=,iv:cf1UC/2NGBHtQgx6h8vRpMjeJRaAvG7ZznhErn2b+cE=,tag:3Ule+pq7pZHWA7NqhlgfPg==,type:str]
+    mac: ENC[AES256_GCM,data:kMIxep2WVIr8/uAiw12T1JXMbtpyijo1c1MOOUKuok2Z1zSrnFZovgIup3u8/2BhqJ2UUDm5hFJi41Tsq45ba5ELs4PX1whi6EXlHQJxNo7ScfepEi10es/wa+p+3w9V8Yv9cklIWk14zh0UABs8jRzOJXhn5XI3O644CJSULQA=,iv:3ssxqRNRvXbmn0HiQFdwoGVbsnzvtQxfpHPIUpplMK8=,tag:5VRyB/Hh4tZUWp6KCPNSQg==,type:str]
    pgp:
-        - created_at: "2026-08-26T19:28:03Z"
+        - created_at: "2026-10-16T07:06:11Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----
-            hQIMA7uy4qQr71wiAQ/9FKZhqwE2RZcfsIeMOtAkOTf/4aEbrSzsHbEO8DP8V3Ct
+            hQIMA7uy4qQr71wiARAAuN5nBauJiH5bFx80iF2W2XJDwMCFG+SPlqv2ErxVaYkD
-            rQBu/v8y1Hcu3fVU/OjVk/7QbEBjPNu1AJST55DBIWktnYUgSo4fIujvG54/hqwM
+            kSt8pA0o4Bzqr6gP6cEgEhzQHAVVvsvTZJTY5lX6KWNRxhz/RXDhxAi9xdBHQ81f
-            9u0iuA1EcqVzGDa+vLSqgmi4Oxbujs0Ytn7uQrefqkdAOjltKqvknebI9EBdSRUi
+            dDWn7pgD8sv8cODM39yeukhGlHxZuk7FiUJ4fBnouojWUCxf2Ib5m5TEaWwmmv5n
-            GjVFwysR6jHmIVf9S64vu4VsjfC7ju9MBYZniaKsJ1GOBhIjUZ6ogkYs5S2E5PJ/
+            EBBjjcbGZzyWBzCkLbEY/ML1FIx5j/jyZjpjMp2En1309ljIBckjLk5s9Kntp6oJ
-            zE8cn79x61YLX74H+BAqnFcxbprtsCwMJPgyerfgijV6d+JpwT/6mp1VUrLe9Zz7
+            /TkW/BhU96y8fyGM6u3FV54wORNlCT3P5cDT4rsQd+KgG0DDchAdUSb7hmBEn+iC
-            WEd/lVMlIcwnYCtIDAvuURvMP2OebWplr95d5V1Vb5Yywnl3M0pwkqL4dRiJISvk
+            W/eUsp7nhObkZZBjTKYeS502Q+3RUEXoLnVLWougDxMSA1rJNS3nkgzK1cmKs97/
-            N2rBQYvDfXBtJA7yTAkJ3PymrECKoFs6nspEBie/kDJmdRGv8s2aajzTTQ1qLAkP
+            Ghnb5TUGPmoQMUltQzxInDq1mgeGfuFUffprYprYKGeVC/oQ6uPHE4jVZImlWRjv
-            FeJe0TcowjCCWMxk4W5DEoCh+PUA1HVo+/KmHjnIVgzdgxaeqT90VXwN8H7MPPeu
+            w6YPHv/2XhWMN5vH/ybsrqxcFb5+1z8u8J58GAJ37hDXzkL8ENJUouonM3sywaBc
-            LKE01+Guue821h7GykkIhe9sf3nMGbI5rOiCcsVtgu5bODkRk8jXpXh1qdRAliuq
+            VbXHzJwYEuLhRfNpay6ovwPkhU25gV3atBiXloIWc0PivPjOAJqqs0vkMgRiA+3R
-            uddjy1mWEfdUHNBj8YxvZ8WOU7h9FyZjsYZB96n9du1vqcuuP5eTJDVuvjjtDuTK
+            yUagVKdyavVUhqou2LOxSGSv77uFPWZwhqUILtqzTeSE6GHUxVqKQPa91klRRNI7
-            fbXYQbxwA5j4akyI4AKJYLA0Y/lcSXc84r6q8IA52nZz6uQZExbkoc7PPX7Q/ufS
+            YWNtM7ZqSeANK99h5vgphhPZpuKkIzXHSLEXdplxvaRERfWMU3UGCDZOMVcDMlbS
-            XgE0CWRS+0tk2oVANMVU31UrCvitttezjR6sUSAINh122a5kcmOfJzLlB2OqVKc5
+            XgGovkHZ9+NKVgZVpsRyQQutbSJqvHVZJx162gu3UKC1IgnDnhslOGKVWw/oKNb5
-            wMAyvOYccrQMrPDX1WJE7agDOaqGUQcwuFnvqpHhe8q9Yg1uOUU4sK1R8A1Qs0Q=
+            KyPf0CLk9BCAlSngr5D5pw4GJ9eq7RNFOqC32LPwXgNSD1AfLFHYGWh3RZM+81w=
-            =wlYf
+            =eA3w
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
    mac_only_encrypted: true
    version: 3.10.2
@@ -22,6 +22,7 @@ spec:
          dnsZones:
            - vhaudiquet.fr
            - buildpath.win
            - rhema.rs
      # OVH solver for semery.fr (via cert-manager-webhook-ovh)
      - dns01:
          webhook:
@@ -42,3 +43,18 @@ spec:
        selector:
          dnsZones:
            - semery.fr
      # Porkbun solver for saggar.dev (via cert-manager-webhook-porkbun)
      - dns01:
          webhook:
            groupName: acme.saggar.dev
            solverName: porkbun
            config:
              apiKey:
                name: porkbun-api-credentials
                key: api-key
              secretApiKey:
                name: porkbun-api-credentials
                key: secret-key
        selector:
          dnsZones:
            - saggar.dev
@@ -5,3 +5,4 @@ resources:
  - clusterissuer.yaml
  - ovh-credentials-secret.yaml
  - ovh-secret-reader-rbac.yaml
  - porkbun-api-credentials-secret.yaml
@@ -0,0 +1,49 @@
 # Porkbun API Credentials for DNS-01 Challenges (saggar.dev)
 #
 # Create an API key at https://porkbun.com/account (API Access section), and
 # enable API access on the domain: Domain Management -> Details -> API Access
 # (disabled per domain by default; the API returns a generic error otherwise).
 #
 # The secret MUST live in the cert-manager namespace: for a ClusterIssuer,
 # cert-manager reads webhook credential secrets from its cluster resource
 # namespace, which the webhook chart's RBAC already covers.
 #
 # SOPS will encrypt the stringData fields on pre-commit.
 apiVersion: v1
 kind: Secret
 metadata:
    name: porkbun-api-credentials
    namespace: cert-manager
    labels:
        app.kubernetes.io/name: cert-manager-webhook-porkbun
        app.kubernetes.io/component: porkbun-api-credentials
 type: Opaque
 stringData:
    api-key: ENC[AES256_GCM,data:OLTDhFnbK70gAsvMR/4iKjKr9ckEkbXhYfG4xgTWP2gjruI9HaNAWzSBJcmDyRXRSz18XnvnSlUy/P5VXG5S6uH84wg=,iv:DrOWWf5h1FLNg+emJ/MMp80k8u+A/2HzC07EmjcWORg=,tag:2ep8o1zmXNPV54Byq2Dl7Q==,type:str]
    secret-key: ENC[AES256_GCM,data:wtGiMCpU8PqTXvH27l+tUvJLivuK/zZp5KePFSeYfjb3ieFszbnjWFd3xQkgtFM3HrmjhRaGWUEFOIEvgTTMDBDyL+k=,iv:iVxMwt6UtpMAqdZj13YUzr3/gDUVTJecyc4ptYvHyNo=,tag:R/tn/BrARGvXjL1EIHBCRQ==,type:str]
 sops:
    lastmodified: "2026-09-27T23:12:14Z"
    mac: ENC[AES256_GCM,data:XWzKEL3qi4/KoKUZm1uEfj6GNW3ZLq71PDEyo7w2fHHmkgFMW/xwwXoBLRYFWVx3RvT82NwOCld/Savbs0qXY+Ws1AsgjklEim7MRyIjOKTT8Jkuh39WNCc+8C13yAHSrfPa3tEs10a8lk4nOaFxVn87zAnfnEt6LGt41+/HDxI=,iv:TxW4wJSqHVB9VH9pn/9lYsg8Og3JHTKRPHOrSjeAvuw=,tag:eKZkHptFhE95bPeNegTx8g==,type:str]
    pgp:
        - created_at: "2026-09-27T23:12:14Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----
            hQIMA7uy4qQr71wiAQ/7BAr8vmZ9i0Www7U8EkhPqOi1g0MVD8tVyhnTptBbS4MG
            irer3UAy7ktovNUso1/wljKif/b2Q8EK6Sawgv4Sv2jN8ShWewginRQ7DeRGtwNE
            TkNnnZoIMQmKwUZq0NnTmStg0wY/bRDYrovGhvPO8F/ZebU/cEXRFdHDzsKsTo6p
            9LOu8DnTj9CwvhBLCyzqCeMwvL7DZryXuTS+aEVnrS0J4OUydK4VKYsvwXVsF6XT
            4Jkpcf4yAiwxBsnZiszvL+L1BPzku1peU/p/d1fciVq54TmgrRwyC7GrlCLm/f09
            xEPLnBMtmp1w5M2aONEYXXrk5fMWLIuSU7SmFzWduwLAMPTfHvGbpIS4U8eMCuIy
            THKmeuyPL4/BW+PIc/L/UucOF0pjPDAPsdw3dEkB0+MlX3YDuTc37PpiX3pMRy1C
            kxhwRVNPZqWMjkrAqg0BR9ZHEOQiv+HwHXZNG5CSHaYYC/mJUSVGaL7R0yOP3nIy
            cWDA6Pyk5XWLspVh534xQODm1oArMdZ+xnD6NUqt+Bv6facrZkmT6r66LnCLb9fQ
            rTS1aDm4gxuG5SX7lafDWL9Rh+z2DgFDde9cEAJZiBna4lTE7tJFPHF4OolqzrnN
            MEhN8no5bLcMv1knE2nKkeKmOoXEKQ80mwgcVkdiRtQf2eZWAXAmpkGehuW/nIHS
            XAHZXogqlqxbGDtIe2dM0qun1OA0HxsGw5J2EcFUt53wSg/YaZdEPN6aARPdRi8P
            qGCEhZ43OokTCffCzf2Z52f7nx2NHIOoV3O3+80g6jw/Lrfe8WsZZZyXgjqm
            =AViA
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(data|stringData|.*key|.*crt)$
    version: 3.10.2
@@ -12,7 +12,7 @@ spec:
        name: cert-manager-webhook-ovh
        namespace: cert-manager
      chart: cert-manager-webhook-ovh
-      version: "0.9.16"
+      version: "0.9.18"
      interval: 1m
  valuesFrom:
    - kind: Secret
@@ -0,0 +1,12 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: cert-manager
 resources:
  - repository.yaml
  - release.yaml
 secretGenerator:
  - name: cert-manager-webhook-porkbun-values
    files:
      - values.yaml=values.yaml
 configurations:
  - kustomizeconfig.yaml
@@ -0,0 +1,11 @@
 nameReference:
  - kind: HelmRepository
    version: v1
    fieldSpecs:
      - path: spec/chart/spec/sourceRef/name
        kind: HelmRelease
  - kind: Secret
    version: v1
    fieldSpecs:
      - path: spec/valuesFrom/name
        kind: HelmRelease
@@ -0,0 +1,19 @@
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
  name: cert-manager-webhook-porkbun
  namespace: cert-manager
 spec:
  interval: 1m
  chart:
    spec:
      sourceRef:
        kind: HelmRepository
        name: cert-manager-webhook-porkbun
        namespace: cert-manager
      chart: cert-manager-webhook-porkbun
      version: "2.0.7"
      interval: 1m
  valuesFrom:
    - kind: Secret
      name: cert-manager-webhook-porkbun-values
@@ -0,0 +1,8 @@
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:
  name: cert-manager-webhook-porkbun
  namespace: cert-manager
 spec:
  interval: 1m
  url: https://porkbun.octabits.io
@@ -0,0 +1,49 @@
 # cert-manager-webhook-porkbun Values
 # groupName must match the ClusterIssuer webhook stanza
 groupName: acme.saggar.dev
 # cert-manager deployment configuration for RBAC
 # The chart creates RoleBindings so cert-manager's service account can reach
 # the webhook and read the Porkbun credential Secret
 certManager:
    namespace: cert-manager
    serviceAccountName: cert-manager
 # Restrict the webhook's Secret read access to the Porkbun credentials only
 rbac:
    secretAccess:
        secretNames:
            - ENC[AES256_GCM,data:WXGjM38wR7oKcvetV91WocOt48njb5Y=,iv:7UEsgh62qq/0fGfmjG96Kko/r2h9IOD7IqRnu7poGFo=,tag:qdb4+n9ZnQidlz5fnHq94g==,type:str]
 # Pod configuration
 replicaCount: 1
 resources:
    requests:
        cpu: 10m
        memory: 32Mi
    limits:
        memory: 128Mi
 sops:
    lastmodified: "2026-09-27T22:55:14Z"
    mac: ENC[AES256_GCM,data:rSc+2n8PYZLdBJRWB3lgiH40+24/5v0vLRAkHV3vM3IyxZgBrjJxmWjAu5PJWHDobQiw7G7x7ZMotJx6TbJztbnBpB5GmdoFC0kVkxxdE8txCWlmcwed6oktCJQ0nR09DaqTk3OvRZgFsWwkVMhZwCjLS+gZBzTTcw84MKqQcGg=,iv:tJd2rGP0EzrjVSp5ESHf5BnFU7fFjMUgfZTgZeM2yRk=,tag:hxVTpxEjz1naTbrDTQUSYA==,type:str]
    pgp:
        - created_at: "2026-09-27T22:55:14Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----
            hQIMA7uy4qQr71wiAQ/5AVsqIJQvmzAAexGSmYjPrdmX7W7JaVHYpUCFbiU9RP32
            S1ffbzV+YjmYkrLhnwhosNeheEVbEiWeyrea+B9wlTgUp1R9+oy8ooc30uDr/vhY
            9K56DoEcUhi95mQD1U7e7LK6qUkMowS0HWXEEOb/r/bvL3lQNmc4rNJ8Dz+MDFh3
            A59ZkrvspjccrLd9wJUb1QbwLKRw/QpE/bT17nj8bOwcAipdz2Q/GoX0LGp88fgS
            Yy6G/zwVpY/mDylHZbunDVBEqAziR3TAbQsRQZou2oB69Q0jwVs8//vVhWSpniUr
            an/XdNaEDR5LFJESJK9Kf3H2Qe/Cq8ynC3NFAwk+tHVLOW8MxQrDUvq3fTQq/Zl+
            CEzMD7+5bQDLQX82QMZ0TdjcLCIEouqCHo9dnGQGUX7NQd1ePV3xda6750zr1maX
            PVTmx12nS+fCwo1DVLSTVa907TLg3h/DoADzpzcmhTfE7xO2mNcfN+P1dnHT2+U4
            FhUXqYgZSkgjlkkpVr8XmZg4Cb98lgpS6hDqXylrXhdsCvGgW9YKg0wdQqb6H4Sr
            ycBsXmj4/j1EMB9yqfSpO/6NNDjTMms0nWsrGXI7NHpROj+AV7fWXC1yxhw6uTus
            SYhve/6VvbCb3hw9gHb9lzQ9VvTq/0jOqIMBoLoD1Wd45tHczPx1xbVf3KyB1HTS
            XgFYYLiLku1Jj87DtdbsAbN0tNQNets9TBVffkawgFNsei/H5ZazKFPOC5NrwnJ1
            FWLWI1fwFZG18c29b8mrEUKqX8GD+YO0BKwmtL7n9out6YAA+hK780RytQDdD00=
            =yh2A
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
    mac_only_encrypted: true
    version: 3.10.2
@@ -14,7 +14,7 @@ spec:
        name: stalwart-helm
        namespace: stalwart
      chart: stalwart
-      version: "0.7.16"
+      version: "0.7.21"
      interval: 1m
  valuesFrom:
    - kind: Secret
@@ -7,7 +7,7 @@
 # Container image
 image:
    repository: stalwartlabs/stalwart
-    tag: v0.16.20
+    tag: v0.16.25
    pullPolicy: IfNotPresent
 # Single-node RocksDB deployment.
 replicaCount: 1
@@ -9,6 +9,11 @@ ports:
            trustedIPs:
                - 127.0.0.1/32
                - 10.0.0.0/8
        transport:
            respondingTimeouts:
                # v3 default is 60s, counted over the whole request body:
                # large HTTP git pushes die with a 504 past one minute.
                readTimeout: 5m
 # Tolerate failover node
 tolerations:
    - key: ENC[AES256_GCM,data:r4uAu1ni9/Z8,iv:aKgn6DgT9XnjzmotnaEIL+WzUiQ34CazfervJwrYsdM=,tag:EeOY1YZwNCOPgHwXpas3ew==,type:str]
@@ -29,12 +29,15 @@ resources:
  - dev/gitea
  - dev/harbor
  - dev/renovate
  - dev/pkgatlas
  # Home (home automation)
  - home/home-assistant
  - home/zigbee2mqtt
  # Personal (apps storing my own content, grouped by content type)
  - personal/paperless
  - personal/radicale
  - personal/rhema-claw
  - personal/syncthing
  - personal/media/photoprism
  - personal/notes/notesnook
  - personal/notes/obsidian-livesync
@@ -44,6 +47,10 @@ resources:
  - utilities/open-webui
  # Production (public-facing websites/apps)
  - production/buildpath
  - production/saggar
  - production/get-saggar
  - production/get-rhema
  - production/rhema-site
  - production/semery-fr
  - production/umami
  - production/vhaudiquet-fr
@@ -12,7 +12,7 @@ spec:
        name: notesnook
        namespace: notesnook
      chart: notesnook
-      version: '1.0.32'
+      version: '1.0.38'
      interval: 1m
  valuesFrom:
    - kind: Secret
@@ -5,5 +5,6 @@ resources:
  - openclaw-instance.yaml
  - openclaw-secrets.yaml
  - networkpolicy.yaml
  - networkpolicy-lan-egress.yaml
  - networkpolicy-mail-egress.yaml
  - networkpolicy-radicale-egress.yaml
@@ -0,0 +1,39 @@
 # Supplementary egress policy: the operator's managed default-deny NetworkPolicy
 # only allows DNS (53) and TCP 443 outbound, so any other port toward the local
 # network is dropped. That blocks the OpenClaw pod from reaching LAN services
 # that do not speak HTTPS on 443. Measured from inside the pod against
 # 10.4.1.222, 443 returns RST (admitted, nothing listening) while 7020 times
 # out, which shows LAN routing works and only the port is being refused.
 #
 # The egress rule below sets no `ports`, because the goal is arbitrary LAN
 # services rather than one known port. Cluster CIDRs are excluded so this does
 # not become a blanket "any pod, any port" grant; the LAN is what gets admitted.
 # Note this is additive to the operator's rules, so DNS and 443 everywhere still
 # hold.
 #
 # Written as a sidecar policy rather than via the CR fields
 # spec.security.networkPolicy.additionalEgress / allowedEgressCIDRs, matching
 # the existing networkpolicy-mail-egress / -radicale-egress pattern. Those CR
 # fields DO appear in the 0.39.0 CRD template, contrary to the comments on the
 # sibling policies, so they are worth retrying once the installed CRD version is
 # confirmed. Until then the sidecar route is the one known to take effect.
 apiVersion: networking.k8s.io/v1
 kind: NetworkPolicy
 metadata:
  name: openclaw-lan-egress
  namespace: openclaw
 spec:
  podSelector:
    matchLabels:
      app.kubernetes.io/instance: openclaw
      app.kubernetes.io/name: openclaw
  policyTypes:
    - Egress
  egress:
    - to:
        - ipBlock:
            cidr: 10.0.0.0/8
            except:
              # Service CIDR and pod CIDR (infra/kube/talconfig.yaml).
              - 10.96.0.0/12
              - 10.244.0.0/16
@@ -12,7 +12,7 @@ spec:
        name: cloudpirates
        namespace: paperless
      chart: postgres
-      version: "0.20.4"
+      version: "0.20.6"
      interval: 1m
  valuesFrom:
    - kind: Secret
@@ -12,7 +12,7 @@ spec:
        name: cloudpirates
        namespace: paperless
      chart: redis
-      version: "0.34.26"
+      version: "0.35.4"
      interval: 1m
  valuesFrom:
    - kind: Secret
@@ -12,7 +12,7 @@ spec:
        name: derwitt
        namespace: radicale
      chart: radicale
-      version: "2.1.0"
+      version: "2.1.4"
      interval: 1m
  valuesFrom:
    - kind: Secret
@@ -0,0 +1,13 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: rhema-claw
 resources:
  - namespace.yaml
  - repository.yaml
  - release.yaml
 secretGenerator:
  - name: rhema-claw-values
    files:
      - values.yaml=values.yaml
 configurations:
  - kustomizeconfig.yaml
@@ -0,0 +1,6 @@
 nameReference:
  - kind: Secret
    version: v1
    fieldSpecs:
      - path: spec/valuesFrom/name
        kind: HelmRelease
@@ -0,0 +1,7 @@
 apiVersion: v1
 kind: Namespace
 metadata:
  name: rhema-claw
  labels:
    app.kubernetes.io/name: rhema-claw
    app.kubernetes.io/component: ai-agent
@@ -0,0 +1,24 @@
 # Tracks the rhema-claw chart as CI publishes it on main: the timestamp
 # pre-releases (0.1.0-YYYYMMDD-HHMMSS) all sort above 0.1.0-0, and the
 # chart's appVersion carries the commit SHA the image was tagged with —
 # values.image.tag stays empty to ride it. Same rolling scheme as the
 # saggar release.
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
  name: rhema-claw
  namespace: rhema-claw
 spec:
  interval: 1m
  chart:
    spec:
      sourceRef:
        kind: HelmRepository
        name: vhaudiquet
        namespace: rhema-claw
      chart: rhema-claw
      version: ">=0.1.0-0"
      interval: 1m
  valuesFrom:
    - kind: Secret
      name: rhema-claw-values
@@ -0,0 +1,11 @@
 # The vhaudiquet package repository on the home Gitea — where the rhema
 # CI publishes the rhema-claw chart on every main push (base version +
 # timestamp, ordered by SemVer pre-release rules). Public: no auth.
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:
  name: vhaudiquet
  namespace: rhema-claw
 spec:
  interval: 1m
  url: https://git.vhaudiquet.fr/api/packages/vhaudiquet/helm
@@ -0,0 +1,69 @@
 # The rhema claw — the resident agent daemon from ../rhema.
 # Single-node by design (one SQLite store, one dispatcher): the chart
 # fails the render past one replica.
 image:
    repository: git.vhaudiquet.fr/vhaudiquet/rhema-claw
    # Empty: follows the chart's appVersion — the commit SHA CI stamped on
    # the pushed images.
    tag: ""
 # Bearer token for the /v1 routes (/healthz stays open). The daemon
 # shells out through the coding agent, so the surface must not sit open
 # on the LAN. Encrypted at rest: the .sops.yaml creation rule scoped to
 # this file adds `token` to the values encrypted_regex.
 token: ENC[AES256_GCM,data:fZKJzLy8FjN+0ONrHn40Tgb1/uTtYdAWTJwY7BfFltsGCPnuMx1F8KIPfQbzliyH,iv:yzaHrdDrSBbnT01aJmv8537D1lVe4kwIDINiuOgXPKU=,tag:dT7Z5v3CUhJg/+BqcjAWIA==,type:str]
 # No provider, model, or credentials: the backend is selected
 # dynamically (nothing injected, nothing pinned) — when a dispatch or a
 # chat turn needs a key, the daemon resolves it through the rhema
 # config seam, not through this release. The nulls erase the chart's
 # built-in anthropic/claude defaults from the rendered claw.yaml.
 config:
    provider: null
    model: null
    watches: null
 # The chart's own ingress, rendered from these values. Plain HTTP on
 # purpose: kosmos.lan is LAN-internal and token-auth-only, like every
 # other .lan surface here (no TLS story for .lan hosts).
 ingress:
    enabled: true
    host: kosmos.lan
    className: traefik
    annotations:
        external-dns.alpha.kubernetes.io/enabled: "true"
 persistence:
    enabled: true
    storageClass: longhorn
    size: 5Gi
 resources:
    requests:
        cpu: 100m
        memory: 256Mi
    limits:
        cpu: "1"
        memory: 1Gi
 sops:
    lastmodified: "2026-10-10T11:49:22Z"
    mac: ENC[AES256_GCM,data:vz3cATCAOEoyXOJCz0u+GfIq06lV5sV3mUoOKa4lUOWnShGOnxxE+v60AslV4KYBfmSCVliTalM0Vm8isuqJSAd9ZdPaI0CZ9F0gkxza22eaESkapIcIYrAhJYcZnRBSyAXjdVHyIzlvVwyTEqWYvEW7F5MJUgc4igHFD1/gMIA=,iv:VxsYzAWGhOiLXCt68Mpu8N9xgjsXXgc2LnInv2BExV8=,tag:rICLpdj4D37QZtTNV91uWA==,type:str]
    pgp:
        - created_at: "2026-10-10T11:49:22Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----
            hQIMA7uy4qQr71wiAQ//WeO+shUgWwJAu2IdxVteea0IpFCyo93hWqxLWMytqF7+
            3h2s7zXXsNvNCvqndHzNSrZt+OuSQDWSBVIzfxlztw7ga6BdI92OhpOZPCIyKwDT
            LzzUCPrSAGOZVekOkFXKlVDjMFunAiEp/soGda7bbP+VrdHJmeRh8fioTOgd/4qL
            /QmmJk3bMTlMoVcknOW2qI3n79YA9qnI0vjwBL63bDeZnxZ8CiZzd1SDr10K0rDf
            f9ErcmeKAwm+HgehSA3xId0Cph4gnf3xNhNDe2gcZvoFlPIrZT0iU0fBzMRuJPxt
            c9g+TqTAHBfx90H58/NF8Sfr3ScXNUHvHzgzrq4w+ogqmp8NYsdDbzG1C318dV2o
            nITluENiYgR9Qs6gJda94aEc00IYEBp4lNGp5G1SyHiDB+jMMsiHX6w3x286dgNx
            G6DcJ+TabCO+A+Fzq74I2ds+paoEgDegDMCIgK6uSKF0jT2ID579Bf2kRraneOqV
            amgBI2CQZG5FAqdhbtpf4PHAK9YR3b42mgF9nBAc+f/oFeAZm8nFmG7LubwxqbgY
            HLa7+ct38ygp/pwZ0FQcU5I3VwqYyU+JA3HMsL2yspHJAeQuXAvzkCQ8NaDOMpEY
            JRY1pIHl3SwTkV3zh9co8r2Ho8fGYO6KzlNfEdRsx2C6DegM70kpPuYzcCDYAd3S
            XAE6EX2dM+NxYqhHEIwKjFMJlROWwhhRhheFZnyYRMsn75NkeqRfPi2tJgMkIMk9
            OJ1eekhgFbQr8vaWtrIOhjvQG9ieg2ujuyltVcC2XUFxQONCxbfoXC2oYu1Y
            =gTTK
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml|token)$
    mac_only_encrypted: true
    version: 3.10.2
@@ -0,0 +1,13 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: syncthing
 resources:
  - namespace.yaml
  - repository.yaml
  - release.yaml
 secretGenerator:
  - name: syncthing-values
    files:
      - values.yaml=values.yaml
 configurations:
  - kustomizeconfig.yaml
@@ -0,0 +1,6 @@
 nameReference:
  - kind: Secret
    version: v1
    fieldSpecs:
      - path: spec/valuesFrom/name
        kind: HelmRelease
@@ -0,0 +1,7 @@
 apiVersion: v1
 kind: Namespace
 metadata:
  name: syncthing
  labels:
    app.kubernetes.io/name: syncthing
    app.kubernetes.io/component: file-sync
@@ -0,0 +1,19 @@
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
  name: syncthing
  namespace: syncthing
 spec:
  interval: 1m
  chart:
    spec:
      sourceRef:
        kind: HelmRepository
        name: k8s-home-lab
        namespace: syncthing
      chart: syncthing
      version: "5.2.0"
      interval: 1m
  valuesFrom:
    - kind: Secret
      name: syncthing-values
@@ -0,0 +1,8 @@
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:
  name: k8s-home-lab
  namespace: syncthing
 spec:
  interval: 1h
  url: https://k8s-home-lab.github.io/helm-charts/
@@ -0,0 +1,152 @@
 # Syncthing continuous file synchronization
 #
 # Sync ports (22000 TCP+QUIC, 21027 UDP) are exposed through LoadBalancer
 # services on the dedicated Cilium pool IP 10.2.2.7 (appended to
 # kubernetes/system/cilium/pool.yaml). The GUI goes through Traefik like the
 # other *.lan services.
 controller:
    replicas: 1
 image:
    repository: syncthing/syncthing
    tag: "2.1"
 env:
    - name: TZ
      value: Europe/Paris
    - name: PUID
      value: "1000"
    - name: PGID
      value: "1000"
 podSecurityContext:
    fsGroup: 1000
 service:
    main:
        ports:
            http:
                port: 8384
    # Sync protocol and QUIC share 22000 on the pooled IP; LAN discovery
    # rides on UDP 21027. externalTrafficPolicy Local preserves client IPs.
    listen:
        enabled: true
        type: LoadBalancer
        externalTrafficPolicy: Local
        loadBalancerIP: 10.2.2.7
        ports:
            listen:
                enabled: true
                port: 22000
                protocol: TCP
                targetPort: 22000
            quic:
                enabled: true
                port: 22000
                protocol: UDP
                targetPort: 22000
    discovery:
        enabled: true
        type: LoadBalancer
        externalTrafficPolicy: Local
        loadBalancerIP: 10.2.2.7
        ports:
            discovery:
                enabled: true
                port: 21027
                protocol: UDP
                targetPort: 21027
 probes:
    liveness:
        custom: true
        spec:
            httpGet:
                path: /rest/noauth/health
                port: http
    readiness:
        custom: true
        spec:
            httpGet:
                path: /rest/noauth/health
                port: http
 ingress:
    main:
        enabled: true
        ingressClassName: traefik
        annotations:
            external-dns.alpha.kubernetes.io/enabled: "true"
        hosts:
            - host: syncthing.lan
              paths:
                - path: /
                  pathType: Prefix
 persistence:
    config:
        enabled: true
        mountPath: /var/syncthing/config
        storageClass: longhorn
        size: 5Gi
    # Shares are recreated by hand in the GUI after cutover — the instance
    # boots with a fresh config (see plans/syncthing-docker-to-kube-migration.md):
    # valentin's folders at /data/valentin/… and sarah's at /data/sarah/…, all
    # backed by the same TrueNAS exports as the docker stack. Photoprism
    # already mounts the valentin Photos export concurrently.
    valentin-documents:
        enabled: true
        type: custom
        mountPath: /data/valentin/Documents
        volumeSpec:
            nfs:
                server: truenas.lan
                path: /mnt/main_storage/valentin/Documents
    valentin-photos:
        enabled: true
        type: custom
        mountPath: /data/valentin/Photos
        volumeSpec:
            nfs:
                server: truenas.lan
                path: /mnt/main_storage/valentin/Photos
    sarah-documents:
        enabled: true
        type: custom
        mountPath: /data/sarah/Documents
        volumeSpec:
            nfs:
                server: truenas.lan
                path: /mnt/main_storage/sarah/Documents
    sarah-photos:
        enabled: true
        type: custom
        mountPath: /data/sarah/Photos
        volumeSpec:
            nfs:
                server: truenas.lan
                path: /mnt/main_storage/sarah/Photos
 resources:
    requests:
        memory: 512Mi
    limits:
        memory: 2Gi
 sops:
    lastmodified: "2026-09-21T22:28:39Z"
    mac: ENC[AES256_GCM,data:BR4P4s4C9n4bEHryqfHpzzFHxAlKeujFBO2Qhsc4qdkcI5dftJ7jrknWtW0uv1E2Aljp50Mx1Rk4wglaWh3MS/ZnY/1dUxCfKuXOGkv9+mymQxDk6zJLsUNTH7sMr5kzlVWfv3yzXF50HWuiNl71BAv4mtlrtarXS1KVQrCKNaA=,iv:aG9OxDOhwk7xYNbvESNMFnXIjKhbYNO0gvDn1a9QQvc=,tag:QxM3EX8V2KJzosRz5damrw==,type:str]
    pgp:
        - created_at: "2026-09-21T22:28:39Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----
            hQIMA7uy4qQr71wiAQ//cvlMqPSaED2y5dsq8H/W/dqYVOeG7E/ZOuJGaYnImrrp
            V2W6vPTzQ8QuYTKa1X4aOIlda04n7i2kDQCvpszmdpsU2y0SWtsgOBbyloIU3cAM
            69HGd1SNqP/FayeZy/hHNvvEjmsgKX/9IV1YBGOcikmd7MqoxgGRgIxXORzY0dBG
            7oREwV0HubdIBG6Fi6HUyN+Pugftpcumfwtl8ppPUYi1HGKzL5LzIT6gfqXtUcBg
            8Wl2f0kMZsat1e05sZZah41dg+BAlyDgCRFo/ZQIhzHi28rJkZWG2aZxQfvAFMYJ
            hUkjVyN7rAO01b2PsXK3bleFjD8iL8PhHY/Rio0/Uizjub7inako2SUd38D7X+ce
            M1c2GoDVNmwZyXg7jBzb67JxLPn4Ic1kbjUi/JJL22rDzN0pBf6J7ExCpVGxrwK8
            ++YDD1m/rY3YA8/ioM+pTu3ktEd1zu0T1yFySjgtvX8QVmOkrG1AA8E/N3+pzFWP
            9wrJJ+yp5CYQl9d3j5LQcOzmvROi0EHjeZY75IHw8NwkyWdnRgWFIPsXxVoSUhSk
            909RE//BuKSSRd1r9D/4w14Eb9KC74bIsUIflyK2Qs/N3rh9+/O8FS/5saryq7Er
            GO3oAmFqC2F4Y6zFlmXkr43gBFjCPWl0DxI3uUK/gcw8kBpLSJex3j2sDaLViS/S
            XgFsDLAjHnEo5DC+xyJQI5xMWsQzx/ASNZdBVLrnYPsRt+YG7qfu3lKNS9ujAG7K
            ti58fACtT97K8IrUMNyEDGieFz65TYPcie4qILnDt2Hkr6QUEdBR8rvn/8z36D8=
            =47Rw
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(data|stringData|.*key|.*crt)$
    version: 3.10.2
@@ -0,0 +1,13 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: get-rhema
 resources:
  - namespace.yaml
  - repository.yaml
  - release.yaml
 secretGenerator:
  - name: get-rhema-values
    files:
      - values.yaml=values.yaml
 configurations:
  - kustomizeconfig.yaml
@@ -0,0 +1,6 @@
 nameReference:
 - kind: Secret
  version: v1
  fieldSpecs:
  - path: spec/valuesFrom/name
    kind: HelmRelease
@@ -0,0 +1,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
  name: get-rhema
@@ -0,0 +1,21 @@
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
  name: get-rhema
  namespace: get-rhema
 spec:
  interval: 1m
  chart:
    spec:
      sourceRef:
        kind: HelmRepository
        name: rhema-dist
        namespace: get-rhema
      chart: rhema-dist
      # Same CI scheme as the other vhaudiquet charts: timestamped
      # versions on main pushes, exact versions on v* tags.
      version: '>=0.1.0-0'
      interval: 1m
  valuesFrom:
    - kind: Secret
      name: get-rhema-values
@@ -0,0 +1,11 @@
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:
  name: rhema-dist
  namespace: get-rhema
 spec:
  interval: 1m
  # Public org-scoped chart repository, same one CI publishes the
  # rhema-dist chart to (from git.vhaudiquet.fr/vhaudiquet/rhema.rs).
  # No auth, unlike the saggar org repo: the vhaudiquet org is public.
  url: https://git.vhaudiquet.fr/api/packages/vhaudiquet/helm
@@ -0,0 +1,58 @@
 # get.rhema.rs, the rhema distribution (chart rhema-dist, repo
 # vhaudiquet/rhema.rs). One single-node Garage, one bucket, the
 # saggar-dist shape: the S3 API stays cluster-internal (chart default,
 # s3.ingress.enabled=false — release uploads come from the in-cluster
 # runners) and the bucket serves as a public read-only website.
 # The host MUST be <bucket>.<root domain> — Garage resolves the bucket
 # from the Host's first label — so bucket `get` on get.rhema.rs.
 bucket: get
 garage:
    # Single-node store: skip the hourly self-sync cycles — while a
    # full sync runs, S3 auth lookups transiently answer
    # InvalidAccessKeyId (see get-saggar). Weekly.
    fullSyncInterval: 604800
 web:
    ingress:
        className: traefik
        host: get.rhema.rs
        # TLS terminates at Caddy with the cert-manager get.rhema.rs
        # cert; Caddy proxies to Traefik by host, so no tls block here.
        tls:
            enabled: false
 # The write surface, public via Caddy: the release runners reach the
 # S3 API by host (the in-cluster Service name does not resolve from
 # them). TLS terminates at Caddy, like the web face.
 s3:
    ingress:
        enabled: true
        className: traefik
        host: s3.rhema.rs
        tls:
            enabled: false
            secretName: ""
 sops:
    lastmodified: "2026-10-16T06:56:14Z"
    mac: ENC[AES256_GCM,data:XuFKJcXb2C22x1GaADmX+QwQNAeUiYsmSh4g0Z5CTyvIXSI5gksAVKNgF0RqRNDLDmDA1jGCS+a0Y//ExXZO1kKQj2jYdYcKU4IvOmniMiwut5ZtobFbuskv7boAxmNRT/Y/4RgyyT8+45b/2+u3i9u2cwSQQ0Itvh5PxpFlE+I=,iv:3qXS6rEkeodOwLt5AOx8atfr15fK1zpmkM8uKjxUB2w=,tag:1Y78Jq8E44IGukCpR99UwA==,type:str]
    pgp:
        - created_at: "2026-10-16T06:56:14Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----
            hQIMA7uy4qQr71wiAQ/+KleFpAm4wpwoyB8U15o27ys2KXyKNFUl0EeRhYBYjcqe
            wgtiayZjGbM0Tz2x9+SFLQhezldMlH8N5l0BscuYBMAUgDXS9OMN+v/1nHk0pu43
            FUYHEWbYmYgngzGKuQhdrGEEtNBH12oKcBVwIPG7zaTfAlhfZIq/xsh6QyfTZX36
            mSzUsshYPmqUM+RymH/PrJjpWz15XBdFUiY59+hNa9kqjalyTg0gijuu6JkKbYTK
            SnFd2i9Ud/meniC4oBlLyOc0PX1/uyeIY1SFbGHdwBcHCFdIzMow2fZWLzimsNyB
            GIO31PbyhG3ZCb2cOzYC0XqJUdP6lHbAyDBDiGWu+dBupDb8d96XeaIF0cTgOjxJ
            0FrDMk1OAc1HjnhGo4QrEPMT0vMJmRDcDWXp60pFycRIrjGyXItMqkW06Xlr5HvF
            OM8q3gjz6s7/Yi80EHKyFEHsvLl8jw2OXYhSiUEy6mSfii5k4Hhs2PBJFKcxLqZA
            tH0caDA4zJia8FdlaTHI9OE33TvP/9uxvY9kBJUaeMdLxCo4T0keOiam2b0K/H8N
            owIhdVJmXtsAFiw+t7KKZku9kQtkav8hEn1G++VQXL/XUjxvv3CewDq9cbNW7aIU
            byjUf4jPR+kI4TeyR01YMDP2+O5Ld0/NxlCKqF10w8KVs1OsWFBagC7I4iPy99XS
            XAEWw3W3SSGkz+9t2cqmXTxCPIvU0ANjkz8PoNAfx9HC3UWk3So1MGht0FDR9QVZ
            AOzPM4U43wnYrTp1sq4N9Xh7xU2m2e7iUt/g2dtRFvx0vv2qMt4ianqzYiB0
            =1619
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(data|stringData|.*key|.*crt)$
    version: 3.10.2
@@ -0,0 +1,14 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: get-saggar
 resources:
  - namespace.yaml
  - packages-auth-secret.yaml
  - repository.yaml
  - release.yaml
 secretGenerator:
  - name: get-saggar-values
    files:
      - values.yaml=values.yaml
 configurations:
  - kustomizeconfig.yaml
@@ -0,0 +1,6 @@
 nameReference:
 - kind: Secret
  version: v1
  fieldSpecs:
  - path: spec/valuesFrom/name
    kind: HelmRelease
@@ -0,0 +1,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
    name: get-saggar
@@ -0,0 +1,38 @@
 # Basic auth for the private Gitea Helm repository (org `saggar`) —
 # same token as the saggar release's packages-auth-secret.yaml. The
 # pre-commit sops hook encrypts this file (name matches *secret.yaml).
 apiVersion: v1
 kind: Secret
 metadata:
    name: saggar-packages-auth
    namespace: get-saggar
 type: Opaque
 stringData:
    username: ENC[AES256_GCM,data:bQ8HUwCqCEIWKQ==,iv:FFcNqBTrA2xJCD2EUf2k+8f1+8DZC9r7Z14Qns0TjH8=,tag:aKWUHSP+8yjbewr/vt3z8w==,type:str]
    password: ENC[AES256_GCM,data:bfiHI6tHwtK1qYf9UdAplb5qNE7fceQDjUim3KlWU/sb4Q5mvqK6CQ==,iv:ZtRNqfWZLT1lSd/N9MGwKrRiTtKDBUBZUR1LUy00G40=,tag:f55oMGmPHQB8zMNWtChp+w==,type:str]
 sops:
    lastmodified: "2026-10-04T21:14:09Z"
    mac: ENC[AES256_GCM,data:pbOlIPfHMwbwyBHlwkTYwWSeWD2jxud2zlNYMDyYJmKRpUuf0/erqRUusTrVGUnOG1t7omu+hQycPC3im6v8mi0vECBlkVG3knQa46bnVH9m1qa7lVChuP53TLYZogrOA8Ol9omrLsUsdcPNJfwXTYS/HHkY+ujECnjCWiVoXUs=,iv:Al2lU2xt1Hvv1BokoOx5e1gOlJhxzMJNyyCosmlGDV0=,tag:OxMxotEvYI06Fjjwst++gA==,type:str]
    pgp:
        - created_at: "2026-10-04T21:14:09Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----
            hQIMA7uy4qQr71wiARAAgsXy5zMBbREVADgr2VVGgev6fHJUXq6DKCRhQdH1nsrI
            xbSN1HZ2UbQjCYCjZl8NdVo3KGhJJ1uQGABAq6ZE+C4ZaMWvfjEO0/CnHmui8LkL
            YXvJWWKvP/DDcmLXYxgwP8u/EWtn1bgXN7HeHxYb9JtGEf7XBlS9a6InWDmreabF
            lSGkl79NgWDIngNQwTvby76uVARSAj3TkIxO6f4cVx+2f/c7KvWvX9D5vjrz8dpk
            tPFdIhsCHdQS2wf2G3fEp4Yb8WnTEgu/HQ/amYwBAplhv3aaFQ0WVxCB91amnJyw
            4Hnkcim4e/ZTmlBms/iQMFo+NhcHebRYcganIid23U8j4RfptwbuxED/txDEAAbj
            lrgpknUXDG9RRRFTZfViYVJ4KWNduuUmVX4URYtn9d42BEXlXwx+Cd7FV40mlM8F
            aT87F8G3IVexcKqLV15RngswCaCNJOnIT1vNNz18hz6sz8qXCzDwKIsS02wzkchz
            1E8pi4grh2UkJT/F+mHUnze3ADOIZu6c2+SUwswVi+zAQg566dgFMYfKWc7icbvz
            AWJ0hatHKNC4utZ2C0sCrM/34M0J507UMjlGKY9FUQ7wnHubPMfrum/FBNH1X7jM
            F+iWsZ4N+kBnpY1Vf64S+97/Nqg5NZ3IBHWyqaSsWmR/h9628XDAa7kUpIsPK2LS
            XgEGwyBsqJOWaYa7pXhIuul+1iNTJJ5FhU9qFQci708gund3RSvGJLtUIGlwSLUn
            qzSSfl8vWujLNj9Pb0FcegVTYAq4eA59rJFILjyRZ64TaIfPBYxdFSD8t4zcWQQ=
            =oHWG
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(data|stringData|.*key|.*crt)$
    version: 3.10.2
@@ -0,0 +1,21 @@
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
    name: get-saggar
    namespace: get-saggar
 spec:
    interval: 1m
    chart:
        spec:
            sourceRef:
                kind: HelmRepository
                name: saggar
                namespace: get-saggar
            chart: saggar-dist
            # Same CI scheme as the other saggar charts: timestamped
            # versions on main pushes, exact versions on v* tags.
            version: '>=0.1.0-0'
            interval: 1m
    valuesFrom:
        - kind: Secret
          name: get-saggar-values
@@ -0,0 +1,13 @@
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:
    name: saggar
    namespace: get-saggar
 spec:
    interval: 1m
    # The org-scoped chart repository CI publishes to — namespace-
    # scoped like every app, so this release carries its own copy of
    # the repo and its auth secret.
    url: https://git.vhaudiquet.fr/api/packages/saggar/helm
    secretRef:
        name: saggar-packages-auth
@@ -0,0 +1,50 @@
 # Chart: https://git.vhaudiquet.fr/saggar/saggar (chart/saggar-dist).
 # One single-node Garage, one bucket: the S3 API stays cluster-
 # internal (chart default — the publish workflow uploads from the
 # in-cluster runners, s3.ingress.enabled=false) and the bucket serves
 # as a public read-only website. The host MUST be <bucket>.<root
 # domain> — Garage resolves the bucket from the Host's first label —
 # so bucket `get` on get.saggar.dev.
 bucket: get
 garage:
    # Single-node store: skip the hourly self-sync cycles — while a
    # full sync runs, S3 auth lookups transiently answer
    # InvalidAccessKeyId, which is what kept failing the edge job's
    # prune step. Weekly.
    fullSyncInterval: 604800
 web:
    ingress:
        className: traefik
        host: get.saggar.dev
        # TLS terminates at Caddy with the cert-manager saggar.dev
        # certs; Caddy proxies to Traefik by host, so no tls block
        # here (same as the other saggar hosts).
        tls:
            enabled: false
 sops:
    lastmodified: "2026-10-06T04:20:10Z"
    mac: ENC[AES256_GCM,data:ncXYOdUYTaYikkKWVUzWinakZVV7tjja31QIo/xhibZ8Jc9L/dl9U8//xJ95Hlb9uuMJvUHvk78KmH2mYVQhfhyNwkNZXvK3o3azx+WWQYaZebEudRbXdHO6gyywcoywlEFuaVWjVsTpggz2VtlNwP/tqLCf41uTUJB4NZi12uU=,iv:uj13/y/iGeoyqgnx74wh1Pzb01NupeLW55qBhCBNleM=,tag:PGmmMZCw49wt8RmpJH1CzQ==,type:str]
    pgp:
        - created_at: "2026-10-06T04:20:10Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----
            hQIMA7uy4qQr71wiAQ/+MH/izXRcAzwF1Dp5mgQBthTFYX01sUpjU9y5Z9jeRnny
            UgtCuURwaI41nG+ZOrv3yy2dSsgABMgr8nZZEju/Tb+jZ/qzkPR8JWTpiieXefH4
            Q5lEy6l1rLVOJudsgx7BG07h6gqr0Mu89gcpFThkXiCo5eAV/hlY9Y6eG6ZybWZ/
            K2bUv8JB09S8ZsuFsTqp87lZMogWFcIjO8JMirjWRxgd+1NZFoGmSIb+6KkLTD2+
            eMjbLnGZ3HyWLSzJBRkF5bGgODNGA8qaHmKKMTT8/H9zD1Z++nKCrx7SQpoStQxw
            xluXAyefTiwCqhEVT42C68Lhz5pH6AyHgJGmls/NWv6bvj/3AQwXlkO87Xkd8x3L
            aEDHIc5rEso18IZuNzlI193AEhipT8mcMi8IFA4YbnVnkK86PSXQ7qWrbbc4BmkN
            cU/vUlpBM1HeiYdTFZf8Dvfw55bNn/pMhPhoLWpHjAnAEDJdrVh33OTurdmtYTRW
            nRK3q2WVHa+UGlkKfdpKr1ivZ9O4ulSfyIYKVsLI5sYAbkJ4o6ytlcQlK6E/7AEK
            Ux/KAnTb5nXOLN8Vbq0xGlyjYei0GY+IZWkkWL80k59NFfrDLXtG/zCxE74ANplm
            qx+dCbggjT2lNsM+homldhYU0VhDnvrWM1/9bRI3DUVUxfGUCKMTqUj2b97vLGDS
            XgHGOTHKKTQjpEg7DnnSS/romTxglHrAEa/3Cu4S4uUVIK7aL8JIoHXYaHho6Jp1
            9RpCscjyeMfE/wnyTbeR1OZ6wnIMuLXzVzma0fy0fbYqGhJllULpMgsZGe6bhpI=
            =MIya
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
    mac_only_encrypted: true
    version: 3.10.2
@@ -0,0 +1,13 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: rhema-site
 resources:
  - namespace.yaml
  - repository.yaml
  - release.yaml
 secretGenerator:
  - name: rhema-site-values
    files:
      - values.yaml=values.yaml
 configurations:
  - kustomizeconfig.yaml
@@ -0,0 +1,6 @@
 nameReference:
 - kind: Secret
  version: v1
  fieldSpecs:
  - path: spec/valuesFrom/name
    kind: HelmRelease
@@ -0,0 +1,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
  name: rhema-site
@@ -0,0 +1,21 @@
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
  name: rhema-site
  namespace: rhema-site
 spec:
  interval: 1m
  chart:
    spec:
      sourceRef:
        kind: HelmRepository
        name: rhema-site
        namespace: rhema-site
      chart: rhema-site
      # Same CI scheme as the other vhaudiquet charts: timestamped
      # versions on main pushes, exact versions on v* tags.
      version: '>=0.1.0-0'
      interval: 1m
  valuesFrom:
    - kind: Secret
      name: rhema-site-values
@@ -0,0 +1,10 @@
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:
  name: rhema-site
  namespace: rhema-site
 spec:
  interval: 1m
  # Public org-scoped chart repository, same one CI publishes the
  # rhema-site chart to (from git.vhaudiquet.fr/vhaudiquet/rhema.rs).
  url: https://git.vhaudiquet.fr/api/packages/vhaudiquet/helm
@@ -0,0 +1,42 @@
 # rhema.rs, the static landing/download site (chart rhema-site, repo
 # vhaudiquet/rhema.rs). One stateless nginx Deployment.
 # TLS terminates at Caddy with the cert-manager rhema.rs certs; Caddy
 # proxies to Traefik by host, so the ingress stays plain HTTP (same
 # shape as every other public site here).
 replicaCount: 1
 ingress:
    enabled: true
    className: traefik
    siteHost: rhema.rs
    # www redirects to the apex inside nginx, so it rides the same
    # service; only the host name differs.
    wwwHost: www.rhema.rs
    tls:
        enabled: false
 sops:
    lastmodified: "2026-10-15T20:28:50Z"
    mac: ENC[AES256_GCM,data:jDNsyWKl2WhofVTzlgevHuPoLZUrLTW87Wd+dLv3nWEFWfN3G8fy0IKGbns1NpFyhx/OfqDJjlmDeZyt4dfmRUPC3Y1MI3kd4KUGlKf0lPy94MTJog7DZtVGtS0RUCN7/NevqtopIivj38u1dXjdcRI+F8bL91blf+RHvvvGOe8=,iv:pmVYVtNhczWqk8CLrAP2McUTrn8uTE88LC9oKtYQzf4=,tag:s+TXQDFqipQtfkE/BN2ASA==,type:str]
    pgp:
        - created_at: "2026-10-15T20:28:50Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----
            hQIMA7uy4qQr71wiAQ//df2F/yV6AzsAeDXunqgf016/km+/O8b37+WSaoB7UHb0
            f/3lqxoVD9EWaTLum1pwHbhauDrjsOyyqkmIbEeOdnMQjEhDvnjfkDbTDupwl7Qg
            m95ozoUsprhlqEu61ANhAx5xOHfelV5hkL5+ef9o3o0Ist2T8uBv/v+KxnbCHwmQ
            e2/rjZ9BF8JgnhYVN3VKnpCgz2k9DVAdIZ4saeaET71MCK2naaO8BcVOH86H2Kn6
            croIE0V/RNPBL3V0PDF804jRIPwfwd0sQiSwwpo11a/9Zgfwj2PDft1FPFyRv7Yt
            iy5RaJ8rY8C2AqxRj1V0QIp6SyT784yhW02//8zZOA3Mcs9RUJfBosbqQDb3KIPx
            MMNNgA1/Fa+7VWI7UX6/24tg2m7MPSCRLvzZMWzriKvcKQj/A0fn4pgcQfQ5wqnm
            v/VrdLL8PBfy2dkYAsBvx4mAt11sOPwoT0iFhxInLNGeGsteJ5/texgLmJ/uO6vx
            jJLJT8izFKqZKJCK5Db/Qx8RuiuGysaS3NiWVKfdWrwlbNsMKeRFMEaEAfKjPOPG
            +1WQcvi+jHfCWsjimxW2+Cs90ZIUY3lbGLuQWhFj8zynQt5rehCZzqjmtx6MbHRT
            GdDZm62Ox1sdMq1ZwMVElWelyNSTtPNN53DcEEiTGqaSwJjdLz9WZhcjMl0vE5rS
            XAGm3AzBcPNFtWEODV1AyXwOUPea5RJ7ZNOOPy7jTrV0sZwJ8TAc67VP9IW8n1CM
            22ri2Xq2qDidxsCKiQeaF77DN2YhBYJnxhvfeplVcKGyqb/EElDznR/fprDR
            =IpGk
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml|token)$
    mac_only_encrypted: true
    version: 3.10.2
@@ -0,0 +1,40 @@
 # Gitea OIDC client credentials for the saggar login provider — the
 # OAuth2 application registered on git.vhaudiquet.fr (Profile →
 # Applications → OAuth2), with redirect URI
 #   https://saggar.dev/auth/callback/gitea
 #
 apiVersion: v1
 kind: Secret
 metadata:
    name: saggar-gitea-oidc
    namespace: saggar
 type: Opaque
 stringData:
    client-id: ENC[AES256_GCM,data:8NHXVbeLNBbFfxtVDk8AtbBWnjpwMWlihjqoEFSJmCDH3Cjz,iv:3PqTABU6ZxNEm0jshvDEkKbSHpdqf2/7DzVVjx/cXVA=,tag:YYuNIQU4nsNxVWZA2WVVbw==,type:str]
    client-secret: ENC[AES256_GCM,data:WiqVhGyNHyeVQY9bX2qkvcaiasejyUUyNXBN4kTKl+TfP8vsedex0U8Va5Ns+9KW/Uget3+kH/o=,iv:K1zLz8am7Vox5IZc5zSDSEeDu9t6R5swEeeqTRrnZdo=,tag:OEbZAqNBkgpX/RdvH5Tb8g==,type:str]
 sops:
    lastmodified: "2026-09-30T20:30:47Z"
    mac: ENC[AES256_GCM,data:MKm2CMBDtNL2GzO2pvmX7WLcTYNap9Xh/loBjZESkHbS65V2QpNU4+yTXcDewyDld9q2zKock1kPRQbhSyptlpxRQN6WZ+LhenS3f6p7rjPq+6gquNJ9j6ccgMFKvBKXoitYsbvfdpp6F6FN8vj24aH6OmTO2gUuvsdj7LIF1bI=,iv:20tkg9yg1kPeo2tbNbXNKNWXAbUqL352NV3+HOCqnqQ=,tag:35vyPxiRTUPuQkxy1/zD0Q==,type:str]
    pgp:
        - created_at: "2026-09-30T20:30:47Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----
            hQIMA7uy4qQr71wiAQ/+INz4B5GdyNfaR4b6DXha7chZN3Qh+nh8oRduzFGKak76
            C3fANw2+HJ4/eV/j1ImNMbON0v7fbPpEe417nkRPESxnkEONi2Rrt0qoCVtnI64u
            isewcMXEJCvTqAa460lE5AIC3tMjfYZd7h3tUe9N7HL3ufOB7hDVflGq954Zo+qu
            rwGH5RZ5s4B5xnW6upVia+TRpu907ibpCKSfzm2uH6CRSIuuvIZrhu/qMnEUaa9F
            9SEEr87orU7YhYltPmK6k3oFaZLbXNsIYCLl7AIeMA3ZlvKKwk4HkTxYU5BUsAK9
            Zhv7yWIFyhTLVOv2k1dbOym3aRGe2KA/+LGHn0bi9ps2A5Vf6rSIQ1v2ya+OVCmw
            Ibofs6/pfI1sZ56pOo1BGv0e6hBTe+jzimtBrTSAuCytDcTDmWusnH3HU8EefanN
            96Dw1NMCVqYn+yl8CL9UPMOL4UT+CDJEbWVBjfVvsoeaER+ipPbspo9eRZypq7D7
            aOWrP9Uiig/PeLt4ZMpsTWM27/tsVy2CPEFQ+XlgandVLQ6qTUQK42oAtepDSWuP
            z8b12dkZ+xraI/wPqlrf6fXU+oKU2KteZxiMn89KqEgTbMp+BGycDHsKLA7VE+uz
            Ni97MN8fbkT85VgwGE95xvUDGMMGyQuJrKbwc6gXzHQoCzZ/RfPBSUeXM4iyAa3S
            XgGXEdIV02aQjl+kOqXu1VZLDVnb46fXTA5GDU51HKHeyT6YoE3rNljdFp2/hub/
            rYX5lJ4j8XXo6s9xUQ3BEw3JMbrc0++SrIXGk3Hqid3Ez+cBm3Q/wqF3YpF5tIs=
            =GpPh
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(data|stringData|.*key|.*crt)$
    version: 3.10.2
@@ -0,0 +1,15 @@
 apiVersion: kustomize.config.k8s.io/v1beta1
 kind: Kustomization
 namespace: saggar
 resources:
  - namespace.yaml
  - packages-auth-secret.yaml
  - gitea-oidc-secret.yaml
  - repository.yaml
  - release.yaml
 secretGenerator:
  - name: saggar-values
    files:
      - values.yaml=values.yaml
 configurations:
  - kustomizeconfig.yaml
@@ -0,0 +1,6 @@
 nameReference:
 - kind: Secret
  version: v1
  fieldSpecs:
  - path: spec/valuesFrom/name
    kind: HelmRelease
@@ -0,0 +1,4 @@
 apiVersion: v1
 kind: Namespace
 metadata:
    name: saggar
@@ -0,0 +1,38 @@
 # Basic auth for the private Gitea Helm repository (org `saggar`) —
 # the same access token also goes into values.yaml's imageCredentials
 # for the container pulls (the chart renders the imagePullSecret).
 apiVersion: v1
 kind: Secret
 metadata:
    name: saggar-packages-auth
    namespace: saggar
 type: Opaque
 stringData:
    username: ENC[AES256_GCM,data:gQXori8DR18jnw==,iv:X1rqJ3gTlIdY6qDYYDLjW+r+/PZVvVvZJaHuRflA50k=,tag:QOLVAuGO/deRAxwelHq3jA==,type:str]
    password: ENC[AES256_GCM,data:aGrzZOtE7PeFXB8ybbAGgVdstb6De7ha/GARPyXP8nxP/tv542d3YQ==,iv:ngBYMmLVtG/5Au5txvzM25LOT2FswrAHP7LMRth2yek=,tag:+uKN2Zjl/ueYIHrXvWBTaA==,type:str]
 sops:
    lastmodified: "2026-09-30T20:30:48Z"
    mac: ENC[AES256_GCM,data:G5Z0s30VsnEsvCVQin/fNg8n2UamvhDv4TMOzvBWXXjW5b43aXdzbQ++x3AetBCgocuTkAXqoPmpYG5f0DVH3n+55lqeE3ChtUlkb0S3zJPZ1jna5rNqKHMFuI8nItyxowAVVKJ06tscRCPlvwRcYWuTGEep0Lq7fSgt6BR/7TQ=,iv:x0uJXcRo8CDjzd4msHMBwloATMryQxmo3eGpzBhzn80=,tag:AwI4lslApzy0wyJgRcYdLg==,type:str]
    pgp:
        - created_at: "2026-09-30T20:30:47Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----
            hQIMA7uy4qQr71wiARAAsQDZ1Uan1oGs6/mBJ9RvdMWH7fhCJfIWXv9Ldljn9lFv
            Cp7ygWA9xgmUW2emtybn28s6uNr4kEH5/x5+0BIIVAmb/LKWi40bQKhSuaWKEgZf
            OmZMNRilgwKFODbfif7UzsjKmogJ5DBFZqiJXP9uFSbF8klH4HSbJcKHR9jCjiM8
            cnWcpZ4xPaPxV7ARC8vKh3jvC7Eh6ivjEhJJSUQTt7w4ucs2e07n2WrCLAQDtu4m
            xzVMDV6y2Far3Rv3Lk5O+FRprmpIKhGwU5nfEFighj7K8/ynZDUEsE5EUtuxDw1p
            BBFFAsuNf4J+qVctfCFwEr2PTsT1VU0jKcB6t9lJZE3aT2xu9mu1Ezn9m/YGWzp2
            airb4UVACWLXj9sqcv7YIG8aUHpm7qVm8AE5UF1OhNJbDCQbpUEklGNRV3N0R4nr
            ehatG1fCLUmXj7CUHdLmfGkhahfUIl2SJAp42h9VdQN8NB8Plj4j+hzluZSqU8XS
            KP7kdIbDheeqZvSxA4KAeXrvvUzOWp4VK6ClL9pVjEh5HTu38atFGQ99daILy95L
            f2z4l1Gc73+zRCHWPKtz5SiPT/G4RlxL2lrgKnykfpOCbJ7wV+XC5kAi+Lj8BM7s
            EB2bqYewal8k2+VVFGD8vzyB/0mV2i37AJFJ8uJTU09D0CKGpDlgrFw1D3YkwA/S
            XgGxHYtmARZxCBEbCeizPE4nk+UZtvVtngPUKABPe5euwX40kOwy81dadjoIZsks
            Vev3d9txiEO6QKcx5rTEp7uju9QO8meqWIM97f0dB1hj1l+tRwmo91XJVKBRgFQ=
            =ZysC
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(data|stringData|.*key|.*crt)$
    version: 3.10.2
@@ -0,0 +1,19 @@
 apiVersion: helm.toolkit.fluxcd.io/v2
 kind: HelmRelease
 metadata:
    name: saggar
    namespace: saggar
 spec:
    interval: 1m
    chart:
        spec:
            sourceRef:
                kind: HelmRepository
                name: saggar
                namespace: saggar
            chart: saggar-hub
            version: '>=0.2.0-0'
            interval: 1m
    valuesFrom:
        - kind: Secret
          name: saggar-values
@@ -0,0 +1,10 @@
 apiVersion: source.toolkit.fluxcd.io/v1
 kind: HelmRepository
 metadata:
    name: saggar
    namespace: saggar
 spec:
    interval: 1m
    url: https://git.vhaudiquet.fr/api/packages/saggar/helm
    secretRef:
        name: saggar-packages-auth
@@ -0,0 +1,105 @@
 # Hub mode (the chart default): intake + registries + web UI, with
 # artifacts in the release's embedded Garage store (chart default in
 # hub mode, longhorn-backed). Builds happen on runners from the
 # saggar-worker chart, to be paired against this hub once it is up.
 image:
    repository: git.vhaudiquet.fr/saggar/saggar
    # Empty: follows the chart's appVersion — the commit SHA CI stamped
    # on the pushed images.
    tag: ""
 # Private Gitea registry: the chart renders an imagePullSecret from
 # these. Same access token as packages-auth-secret.yaml (the
 # pre-commit sops hook encrypts this file).
 imageCredentials:
    create: true
    registry: git.vhaudiquet.fr
    username: ENC[AES256_GCM,data:Kb01bICyN/BvDQ==,iv:o19woAl9Hqlouo3fgmj6fesiix1bo6fPRcZdE3W55bk=,tag:LzBjc/dOaFv1yUblzAmFBQ==,type:str]
    password: ENC[AES256_GCM,data:Phft0J0kFY71+icAEP2OuwGOfkNwMv64Yd0mWJkgVXWEJRyczAorZg==,iv:SeM4FVIwAqXxT9P6uUyftehk/eL3Y2JY1beGbruO0mM=,tag:Dezoea9JnN49laU0q+H3Bg==,type:str]
 # Login via the home Gitea: the engine is the confidential client of
 # the provider and runs every code exchange, so its discovery drives
 # the endpoints (issuer verified live). Credentials live in
 # gitea-oidc-secret.yaml — both ride the Secret (clientIdKey opts the
 # id in too), so nothing sensitive renders into the ConfigMap. The UI
 # needs nothing: it discovers the provider from the engine's open
 # /auth/methods.
 auth:
    # The web origin the device login names: `saggar login` prints the
    # confirmation page under it (saggar.dev/device).
    uiUrl: https://saggar.dev
    providers:
        - name: gitea
          issuer: https://git.vhaudiquet.fr
          existingSecret: ENC[AES256_GCM,data:hqjfc89icY+3fOSMzh0xJ0Q=,iv:K+g5gpi8vcBpw6buktSZlePj9p4TGRV6bxuvSrFx2i0=,tag:FljiBjxAFrQON4J4iqk50w==,type:str]
          clientIdKey: client-id
          clientSecretKey: ENC[AES256_GCM,data:b01cCxpLg9d8ECChUQ==,iv:IMU1G+3hEyqS6jU7eWpgvQE7/ndLbH5gkbydFisCQeM=,tag:xs0ehG08oU15/N1hN9AHug==,type:str]
 storage:
    garage:
        # Single-node store: skip the hourly self-sync cycles — while a
        # full sync runs, S3 auth lookups transiently answer
        # InvalidAccessKeyId. Weekly.
        fullSyncInterval: 604800
 ingress:
    enabled: true
    className: traefik
    # The engine host: CLI intake + the docker/apt registry front-ends.
    host: api.saggar.dev
    # The chart's default annotations are nginx-specific (SSE
    # buffering); traefik streams unbuffered by default, so clear them.
    annotations: {}
    # TLS terminates at Caddy with the cert-manager saggar.dev certs;
    # Caddy proxies to Traefik by host, so no tls block here (same as
    # pkgatlas's ingress).
    tls:
        enabled: false
 ui:
    # Sign-in redirect base — the UI's own public origin.
    publicBaseUrl: https://saggar.dev
    # The engine's public origin for the docker pull / apt usage lines.
    # Set explicitly: the chart derives it from the hub ingress, whose
    # tls is off here (Caddy terminates) — that would render http://.
    apiPublicOrigin: https://api.saggar.dev
    ingress:
        enabled: true
        className: traefik
        # The UI lives on its own host: the engine mounts its API and
        # registry surfaces at root (/v2, /apt, /nodes), paths the UI
        # pages also use.
        host: saggar.dev
        annotations: {}
        tls:
            enabled: false
 docs:
    # The chart deploys the book by default; the ingress renders as
    # soon as a host is set (no enabled knob).
    ingress:
        className: traefik
        host: docs.saggar.dev
        tls:
            enabled: false
 sops:
    lastmodified: "2026-10-06T04:20:10Z"
    mac: ENC[AES256_GCM,data:ztx2M4srmnZs9S86xWOYSkePbi9Gm1n0FIB9oBmiaEn5fzSmPLbbn8IPcRsU+zOjkg5DRZ4LbuNdtmxynTC20yCHpb2vZbIUFiQarxPizI9lcKZyyOXFjoECXYZ5oDEOkAPrvYWTduqvK5o9dsUmebtKCSh9EMVMD47nF76yr68=,iv:Y2DjchwTfIjWMDGfQNwXCxM7MG6iNwU6LHf276osNjM=,tag:oviToaqWMdl1/cDgYX9M7g==,type:str]
    pgp:
        - created_at: "2026-10-06T04:20:10Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----
            hQIMA7uy4qQr71wiAQ//Sgir+7MRZYnuxGArDmyeP57A3xL6F77pLZbNIOjQ6KcK
            3Giga+m3n2BodCDVzL6bUOtUbtgBVyqD7SSBY4qQ2a9c/H4xBAO0HciDth4O1Wer
            z8fKSphk7tt1yBtzuB1tm0F9Ye53tLaetACXRGGo83jCGse8J0d4+vimra45fjyn
            9JEnCl0+A2AMMl9/hcfCj8iSj+VeiCJz35Zmo+BWl0KrY0DHAeEyBEtI7O+z8bFF
            9oGZY/xhTVD4IkbOqXs1fatTmybyzxrTBz/I7d9QOnPx7N08rb/g3KspkCPDSptH
            h/AnDGg0PDVs7WK0eMwFMsZ8gvEYI76ecf6mAO5x6TbpxVHCPXpbbBTC7ro7usB0
            4jVLrALMtsMn8k45JWFGR3OsujPr1D+yGmsJ2Mqde4AtjE6zTs8TurwuDEY0ivYg
            HvAKk6C+ZOmdQEMep2kznSovMx0m6FP8Muv0ORX+pMNOIRhUFbEAXT+s7J7YoLlf
            Rza/lf4VgsWtTUyUZRTH3G2NTwEgBo4GsV6bM07OhN0GEgMH1hOuGo61C+e2d6PR
            NqeRgvlzfmeoTUBwgNv023739hyB2xDVesr5jo/yomikxFiz0wGUBQ4eRZmRZSjD
            ZCLoiv+2ymROgWzGqgutRiRD150P45biMs3zW/x3qGP/SiTj35OYyCzMjQb/ZRjS
            XgGHEtiiRWv954k5eXRF3DOHxrZ/oxtjyc4+EjlS3VsgtOCjePSzKg/WQa8Zx3ns
            MT2BKgtlFwM2eG5V7jHfHOmAuVIuH249iyER5AJDzot/0kAO7ekH/y72kfloDKk=
            =3vCq
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
    mac_only_encrypted: true
    version: 3.10.2
@@ -8,3 +8,4 @@ spec:
  - cidr: "10.2.2.4/32"
  - cidr: "10.2.2.5/32"
  - cidr: "10.2.2.6/32"
  - cidr: "10.2.2.7/32"
@@ -15,6 +15,7 @@ spec:
  dependsOn:
    - name: cert-manager
    - name: cert-manager-webhook-ovh
    - name: cert-manager-webhook-porkbun
  decryption:
    provider: sops
    secretRef:
@@ -0,0 +1,20 @@
 # Flux Kustomization for cert-manager-webhook-porkbun
 # Depends on cert-manager being fully operational (CRDs installed)
 apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
  name: cert-manager-webhook-porkbun
  namespace: flux-system
 spec:
  interval: 10m
  prune: true
  sourceRef:
    kind: GitRepository
    name: homeprod
  path: ./kubernetes/infrastructure/cert-manager-webhook-porkbun
  dependsOn:
    - name: cert-manager
  decryption:
    provider: sops
    secretRef:
      name: flux-sops
@@ -6,6 +6,7 @@ resources:
  - webhook.yaml
  - cert-manager.yaml
  - cert-manager-webhook-ovh.yaml
  - cert-manager-webhook-porkbun.yaml
  - cert-manager-issuer.yaml
  - caddy-certificates.yaml
  - stalwart-certificates.yaml
@@ -80,13 +80,13 @@ spec:
                - longhorn-system
              selector:
                matchLabels:
-                  app: instance-manager
+                  longhorn.io/component: instance-manager
          - resources:
              namespaces:
                - longhorn-system
              selector:
                matchLabels:
-                  app: engine-image
+                  longhorn.io/component: engine-image
      mutate:
        # `request.object` is available in BOTH admission and background modes:
        # the backgroundController synthesizes an admission-like request for
@@ -12,7 +12,7 @@ spec:
        name: kyverno
        namespace: kyverno
      chart: kyverno
-      version: '3.9.0'
+      version: '3.9.1'
      interval: 5m
  # Minimal footprint for a single-node cluster:
  #  - admissionReports disabled (no extra Redis/Postgres)
Author	SHA1	Message	Date
renovate[bot]	8b9c57f5e9	chore(docker): bump bbilly1/tubearchivist Docker tag to v0.6.0	2026-10-31 05:01:50 +00:00
vhaudiquet	f44a4e7d76	Revert "revert: restore caddy values to the last working state (s3 mount pending rework)" This reverts commit `bdfc374f08`.	2026-10-16 09:20:37 +02:00
vhaudiquet	bdfc374f08	revert: restore caddy values to the last working state (s3 mount pending rework)	2026-10-16 09:09:28 +02:00
vhaudiquet	bd3143065c	feat(caddy): mount the s3.rhema.rs certificate	2026-10-16 09:06:11 +02:00
vhaudiquet	e33b82671a	revert: restore the caddy values gutted by a bad s3 volume edit	2026-10-16 09:04:31 +02:00
vhaudiquet	844c8f8abe	fix(caddy): the s3 certificate volume references its secret	2026-10-16 09:03:55 +02:00
vhaudiquet	93054f962a	feat(caddy): mount the s3.rhema.rs certificate	2026-10-16 09:01:46 +02:00
vhaudiquet	9aeecee770	feat(get-rhema): expose the S3 API publicly for release uploads The release runners cannot resolve the in-cluster Service name, so the binary uploads died on DNS. s3.rhema.rs fronts the same Garage through Caddy and Traefik, with its own certificate, matching the web face's shape (Caddy terminates, Traefik routes, bucket by path).	2026-10-16 08:56:34 +02:00
vhaudiquet	9d53dd0fc6	rhema(kube): deploy rhema.rs and get.rhema.rs	2026-10-15 22:32:14 +02:00
vhaudiquet	5058982605	dns: manage rhema.rs via cloudflare	2026-10-15 22:28:50 +02:00
vhaudiquet	bb443f3311	kyverno-policies(kube): exclude longhorn instance-manager pods from cpu stripping The longhorn instance-manager and engine-image pods carry longhorn.io/component labels, not app, so the exclusions never matched. Kyverno stripped their cpu requests at admission, longhorn-manager saw a spec mismatch and deleted the pod in a loop, and after any node reboot all longhorn volumes stayed detached with every workload stuck in ContainerCreating. Match the real labels instead.	2026-10-14 17:43:14 +02:00
renovate[bot]andvhaudiquet	7ac3b46b3c	chore(kube): bump caddy Docker tag to v2.11.7	2026-10-11 00:03:43 +02:00
renovate[bot]andvhaudiquet	bc905c78bc	chore(kube): bump chart Helm release cert-manager-webhook-ovh to v0.9.18	2026-10-11 00:03:34 +02:00
renovate[bot]andvhaudiquet	d97180783a	chore(kube): bump chart Helm release radicale to v2.1.4	2026-10-11 00:03:23 +02:00
renovate[bot]andvhaudiquet	60759d4e4a	chore(kube): bump stalwartlabs/stalwart Docker tag to v0.16.25	2026-10-11 00:03:05 +02:00
vhaudiquet	a1ce8d3880	rhema-claw(kube): deploy	2026-10-10 13:49:22 +02:00
vhaudiquet	8c7a905d39	saggar(kube): weekly full syncs on the embedded garages Garage's hourly full-sync cycles were the InvalidAccessKeyId source: while a key-table sync runs, auth lookups transiently fail, and the edge job's prune step kept landing inside the window (one sync ran 87 minutes). Both embedded stores get a weekly interval.	2026-10-06 06:20:19 +02:00
renovate[bot]andvhaudiquet	d72a76e416	chore(kube): bump chart Helm release radicale to v2.1.2	2026-10-04 23:39:30 +02:00
renovate[bot]andvhaudiquet	992415e4f1	chore(kube): bump caddy Docker tag to v2.11.6	2026-10-04 23:39:17 +02:00
renovate[bot]andvhaudiquet	d21f92eb4b	chore(kube): bump chart Helm release stalwart to v0.7.21	2026-10-04 23:39:03 +02:00
renovate[bot]andvhaudiquet	a8ff5d1b10	chore(kube): bump stalwartlabs/stalwart Docker tag to v0.16.24	2026-10-04 23:38:53 +02:00
vhaudiquet	9629597703	get-saggar(kube): deploy The saggar-dist chart: a single-node Garage hosting the distribution bucket — public read-only website on get.saggar.dev (the host label is what Garage's vhost routing resolves the bucket from), S3 write surface staying cluster-internal for the publish workflow. Same edge path as the other saggar hosts: dns A record, cert-manager certificate, caddy route. Chart repo and packages auth carry over from the saggar release.	2026-10-04 23:14:09 +02:00
vhaudiquet	89420bae2f	saggar(kube): set the device login's web origin (auth.uiUrl)	2026-10-01 21:25:56 +02:00
vhaudiquet	b8879b2025	saggar(kube): expose docs.saggar.dev The chart's docs book (static nginx) was up in-cluster only: give its ingress a host, with the same edge path as the api host — dns A record, cert-manager certificate and caddy route.	2026-10-01 19:39:26 +02:00
vhaudiquet	32207635fe	gitea(kube): raise limits to receive a kernel tree index-pack on ~12M objects OOMKilled the 1Gi container mid push, and 500m of CPU stretched the receive for many minutes before that. Bump to 6Gi / 4 cores; the node has ~40Gi free.	2026-09-30 23:03:47 +02:00
vhaudiquet	e6ab21317a	traefik(kube): raise web entrypoint read timeout to 5m Traefik v3 defaults respondingTimeouts.readTimeout to 60s counted over the whole request body, so large HTTP git pushes get a 504 the moment they pass one minute. writeTimeout stays unset: a cap there would cut long-lived SSE streams mid-flight.	2026-09-30 23:03:42 +02:00
vhaudiquet	ae8a4ddb27	saggar(kube): deploy Flux HelmRelease of the saggar hub (chart saggar-hub >=0.2.0-0, CI-published on the gitea saggar org, appVersion pinned to the image commit) with the web UI. Engine on api.saggar.dev for the CLI and the docker/apt registries, UI on saggar.dev — new cert, caddy route and dns A record for the api host, TLS terminating at Caddy as usual. Login via the home Gitea as an OIDC provider; private registry and helm repo auth share one packages token.	2026-09-30 22:30:47 +02:00
vhaudiquet	c83b4550ed	Merge branch 'main' of https://github.com/vhaudiquet/homeprod * 'main' of https://github.com/vhaudiquet/homeprod: chore(kube): bump chart Helm release cert-manager-webhook-ovh to v0.9.17 chore(kube): bump chart Helm release notesnook to v1.0.38 chore(kube): bump chart Helm release stalwart to v0.7.19 chore(kube): bump chart postgres Docker tag to v0.20.6 chore(kube): bump chart redis Docker tag to v0.35.4 chore(kube): bump stalwartlabs/stalwart Docker tag to v0.16.23	2026-09-28 01:24:28 +02:00
vhaudiquet	50d992b727	saggar.dev(kube): deploy - cert-manager-webhook-porkbun via Flux (chart 2.0.7, octabits fork) - porkbun DNS-01 solver on letsencrypt-production for saggar.dev - porkbun API credentials secret (sops) - saggar.dev apex Certificate + Caddy site block -> traefik	2026-09-28 01:14:58 +02:00
vhaudiquet	fc6db118d3	dns: manage saggar.dev via porkbun provider - new saggar.dev zone (apex A -> 82.64.154.58) targeting porkbun - replace '*' zone glob with explicit per-zone targets (cloudflare for vhaudiquet.fr/buildpath.win, porkbun for saggar.dev) - CI: switch to octodns/octodns image + install cloudflare/porkbun provider modules	2026-09-28 01:05:00 +02:00
renovate[bot]andvhaudiquet	7e5fa8a5b5	chore(kube): bump chart Helm release cert-manager-webhook-ovh to v0.9.17	2026-09-26 19:34:36 +02:00
renovate[bot]andvhaudiquet	30845bb249	chore(kube): bump chart Helm release notesnook to v1.0.38	2026-09-26 19:34:25 +02:00
renovate[bot]andvhaudiquet	52ac77a74e	chore(kube): bump chart Helm release stalwart to v0.7.19	2026-09-26 19:34:04 +02:00
renovate[bot]andvhaudiquet	e189bc66ea	chore(kube): bump chart postgres Docker tag to v0.20.6	2026-09-26 19:33:47 +02:00
renovate[bot]andvhaudiquet	008238922b	chore(kube): bump chart redis Docker tag to v0.35.4	2026-09-26 19:31:12 +02:00
renovate[bot]andvhaudiquet	82d646d399	chore(kube): bump stalwartlabs/stalwart Docker tag to v0.16.23	2026-09-26 14:19:15 +02:00
vhaudiquet	818ed232e4	dns: add pkgatlas.vhaudiquet.fr A record Caddy's wildcard *.vhaudiquet.fr vhost already routes the host to the in-cluster Traefik and on to the pkgatlas ingress.	2026-09-24 22:00:21 +02:00
vhaudiquet	b2f656c757	pkgatlas(kube): deploy Flux HelmRelease tracking the CI-published chart (>=0.4.0-0, timestamped versions, appVersion pinned to the image commit). Ingress host pkgatlas.vhaudiquet.fr via traefik; TLS terminates at Caddy with the *.vhaudiquet.fr wildcard, so the new @pkgatlas route proxies to Traefik like the other public vhosts.	2026-09-24 21:57:42 +02:00
vhaudiquet	3f986b65ab	gitea(kube): fix valkey memory limits	2026-09-22 22:35:36 +02:00
vhaudiquet	e354a56e15	gitea(kube): bump pvc storage to 30Gi	2026-09-22 21:58:25 +02:00
vhaudiquet	bd5fab7419	syncthing(kube): deploy	2026-09-22 00:30:42 +02:00
kosmosandvhaudiquet	e242b2ddce	openclaw: allow LAN egress on all ports The operator's managed policy is default-deny with egress limited to DNS and TCP 443, so reaching a LAN service on any other port is dropped. Measured against 10.4.1.222 from inside the pod: 443 returns RST while 7020 times out, so routing is fine and the port is what gets refused. Add a supplementary egress policy admitting 10.0.0.0/8, excluding the service (10.96.0.0/12) and pod (10.244.0.0/16) CIDRs so this does not grant every pod a path out. No port list: the point is arbitrary LAN services. Registered in the directory kustomization alongside the existing mail and radicale egress policies.	2026-09-20 17:33:35 +02:00
renovate[bot]andvhaudiquet	0d81f4a5d2	chore(kube): bump chart postgres Docker tag to v0.20.5	2026-09-19 20:56:00 +02:00
renovate[bot]andvhaudiquet	56e5992536	chore(kube): bump chart Helm release radicale to v2.1.1	2026-09-19 20:55:45 +02:00
renovate[bot]andvhaudiquet	77a5225358	chore(kube): bump chart Helm release kyverno to v3.9.1	2026-09-19 20:55:33 +02:00
renovate[bot]andvhaudiquet	7fd1a5e52f	chore(deps): update terraform docker to v3.9.0	2026-09-19 20:54:58 +02:00
renovate[bot]andvhaudiquet	23748ee4fc	chore(kube): bump chart Helm release stalwart to v0.7.18	2026-09-19 20:54:40 +02:00
renovate[bot]andvhaudiquet	45c3970a27	chore(kube): bump chart redis Docker tag to v0.35.1	2026-09-19 20:54:25 +02:00
renovate[bot]andvhaudiquet	fdb2634a46	chore(kube): bump stalwartlabs/stalwart Docker tag to v0.16.22	2026-09-19 20:54:03 +02:00