chore(docker): bump docker.io/library/redis Docker tag to v8.10.3

Revert "revert: restore caddy values to the last working state (s3 mount pending rework)"
This reverts commit bdfc374f08.
2026-11-05 21:38:11 +00:00 · 2026-10-31 05:01:16 +00:00 · 2026-10-16 09:20:37 +02:00 · 2026-10-16 09:09:28 +02:00 · 2026-10-16 09:06:11 +02:00 · 2026-10-16 09:04:31 +02:00
83 changed files with 1659 additions and 77 deletions
@@ -12,10 +12,14 @@ jobs:
  update-records:
    name: octodns
    runs-on: ubuntu-latest
-    container: octodns/cloudflare:latest
+    container: octodns/octodns:latest
    steps:
      - uses: actions/checkout@v4
+      - name: Install DNS providers
+        run: pip install octodns-cloudflare octodns-porkbun
      - name: octodns-sync - production
        run: octodns-sync --config-file ./config/production.yaml --doit
        env:
          CLOUDFLARE_TOKEN: ${{ secrets.CLOUDFLARE_TOKEN }}
+          PORKBUN_API_KEY: ${{ secrets.PORKBUN_API_KEY }}
+          PORKBUN_SECRET_KEY: ${{ secrets.PORKBUN_SECRET_KEY }}
@@ -1,6 +1,6 @@
 creation_rules:
  - path_regex: .*values.yaml$
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml|token)$
    mac_only_encrypted: true
    pgp: DC6910268E657FF70BA7EC289974494E76938DDC
  - path_regex: .*.yaml
@@ -7,10 +7,29 @@ providers:
  cloudflare:
    class: octodns_cloudflare.CloudflareProvider
    token: env/CLOUDFLARE_TOKEN
+  porkbun:
+    class: octodns_porkbun.PorkbunProvider
+    api_key: env/PORKBUN_API_KEY
+    secret_key: env/PORKBUN_SECRET_KEY

 zones:
-  '*':
+  vhaudiquet.fr.:
    sources:
      - config
    targets:
      - cloudflare
+  buildpath.win.:
+    sources:
+      - config
+    targets:
+      - cloudflare
+  rhema.rs.:
+    sources:
+      - config
+    targets:
+      - cloudflare
+  saggar.dev.:
+    sources:
+      - config
+    targets:
+      - porkbun
@@ -0,0 +1,33 @@
+---
+? ''
+: octodns:
+    cloudflare:
+      auto-ttl: true
+      proxied: false
+  ttl: 300
+  type: A
+  value: 82.64.154.58
+get:
+  octodns:
+    cloudflare:
+      auto-ttl: true
+      proxied: false
+  ttl: 300
+  type: A
+  value: 82.64.154.58
+s3:
+  octodns:
+    cloudflare:
+      auto-ttl: true
+      proxied: false
+  ttl: 300
+  type: A
+  value: 82.64.154.58
+www:
+  octodns:
+    cloudflare:
+      auto-ttl: true
+      proxied: false
+  ttl: 300
+  type: A
+  value: 82.64.154.58
@@ -0,0 +1,17 @@
+---
+? ''
+: ttl: 600
+  type: A
+  value: 82.64.154.58
+api:
+  ttl: 600
+  type: A
+  value: 82.64.154.58
+docs:
+  ttl: 600
+  type: A
+  value: 82.64.154.58
+get:
+  ttl: 600
+  type: A
+  value: 82.64.154.58
@@ -383,6 +383,13 @@ photos:
  ttl: 300
  type: A
  value: 82.64.154.58
+pkgatlas:
+  octodns:
+    cloudflare:
+      auto-ttl: true
+  ttl: 300
+  type: A
+  value: 82.64.154.58
 sse-nook:
  octodns:
    cloudflare:
@@ -52,7 +52,7 @@ services:
    command: celery -A gramps_webapi.celery worker --loglevel=INFO --concurrency=2

  grampsweb_redis:
-    image: docker.io/library/redis:8.10.0-alpine
+    image: docker.io/library/redis:8.10.3-alpine
    container_name: grampsweb_redis
    restart: always

@@ -9,7 +9,7 @@ services:

  web_recipes:
    restart: always
-    image: vabene1111/recipes:2.6.15
+    image: vabene1111/recipes:2.6.13
    networks:
      - default
      - proxy
@@ -2,7 +2,7 @@ terraform {
  required_providers {
    docker = {
      source  = "kreuzwerker/docker"
-      version = "3.6.2"
+      version = "3.9.0"
    }
  }
 }
@@ -17,7 +17,7 @@ valkey-cluster:
 # Use standalone Valkey (replaces 'redis' in chart 12.x)
 valkey:
    enabled: true
-    master:
+    primary:
        resources:
            requests:
                cpu: 100m
@@ -30,10 +30,10 @@ postgresql:
    global:
        postgresql:
            auth:
-                postgressPassword: ENC[AES256_GCM,data:PtWMsukqbrWiVg==,iv:iQtDckrih/3ZKopzD9eEViOMZrvSulmCI5tHCsJph1A=,tag:7S54w4ADG7+8QNiLDw2Q0A==,type:str]
-                password: ENC[AES256_GCM,data:jLC1oEl+ZAnpbw==,iv:PliGMmxHKn3eEt8uvsv9wL4syk91EC5OpA7AL5J0+4o=,tag:Oan4ek7m0Cxnl5bzOCGHXw==,type:str]
+                postgressPassword: ENC[AES256_GCM,data:4Kd4qz3DuJboaA==,iv:I9K1+j2tv7MKel9ej2/AED0JrxIfeb3D1xdDKCS+jTs=,tag:MpQ0NjglUvGZXzeOQjIj3Q==,type:str]
+                password: ENC[AES256_GCM,data:YX6VvEJWfkO0dg==,iv:ixQkW2q7Y9YRIGMIbqWclA5q9Ufw+lNS7Gc4Wd1toiY=,tag:krGDeY+E4+PUjowt8jKAmA==,type:str]
                database: gitea
-                username: ENC[AES256_GCM,data:ricveNc=,iv:rPrHKhIzsNEQzoaX2cPDvVWjR7NIxsN1tBlzLB80IQ0=,tag:n64SpL6qM/IT9D7t85/Lvg==,type:str]
+                username: ENC[AES256_GCM,data:KvdO0oE=,iv:vFYOVlo2kvOHOhASDlccTfcpsgAkS6YXOLCm5sDcxaQ=,tag:9J6Dmc3vYpHlFSggoGVmLQ==,type:str]
    volumePermissions:
        enabled: true
    primary:
@@ -63,6 +63,7 @@ postgresql-ha:
 persistence:
    enabled: true
    subPath: data
+    size: 30Gi
 extraVolumes:
    - name: git
      nfs:
@@ -76,8 +77,8 @@ gitea:
    oauth:
        - name: Authentik
          provider: openidConnect
-          key: ENC[AES256_GCM,data:9UuG23PYFiWrQKJX5xGxMgyWKLPFCxKjDUYJd59rMWcdAw619/v/Bw==,iv:AfHV1MzbYi5Z5Bb63/51Hmy9rM247b4quwKCzo7MpYw=,tag:pfpz7hhZyIUjIGGcxZVx/w==,type:str]
-          secret: ENC[AES256_GCM,data:PKFx/LhjwWJluC6/RHc1eMgw4TZXkXymNCrc7TQU6Bp5rGKHMvACC+G+MjXGylIMZVt65LHWq5YEHJNjO8HMsa4ejGukXDuU9sCgKaOOniCs3EQivfVsCCHtF/G48eULPkege7JRzTbmJSYJDnscsSikwvUDChy+zGlC2ZmBZjk=,iv:qsIaaeXepJ9ECilo+05+A0i2joxV0svBOjgL37DkimE=,tag:/3Xer7Yb6QyUtmPIOvSLQQ==,type:str]
+          key: ENC[AES256_GCM,data:F0AGCSAkU2ZWmS4jniL8k32ABwrjtURAPLa3RKOCpJoaMkKRlRrqwA==,iv:vQcD73C3itBqKFEiv8PhLD2G3exC0zc2NDE3LGYpvXA=,tag:24nO98pP7a00sTBDWEMsBA==,type:str]
+          secret: ENC[AES256_GCM,data:0/6XDvRXUnQXrJzivtDS6b+mmYjtOVcHhGmQJPFG1zDyO9BksHKau0D+hIsfM85761U7LAISct0HungGNeOQOULnmvVT8hEIgC21RHjArXztJY2964NS5XXfURc7pVxOJ7LSDFFd4azExwhrTktqmerG+F6SI5V/oq2iYYqJA7o=,iv:ShYcIgyccHvEFhVn++gBR7gmMOEKcBz9sj/Y+4pk/Hc=,tag:SkFM2d06O/zhpfVji4QDKA==,type:str]
          autoDiscoverUrl: https://authentik.vhaudiquet.fr/application/o/gitea/.well-known/openid-configuration
    config:
        APP_NAME: Gitea
@@ -103,37 +104,39 @@ gitea:
        indexer:
            ISSUE_INDEXER_TYPE: bleve
            REPO_INDEXER_ENABLED: true
-# Resource limits for Gitea container
+# Resource limits for Gitea container. Sized to receive a full linux
+# kernel tree: index-pack on ~12M objects needs several GiB and more
+# than half a core (the 1Gi limit OOMKilled the pod mid push).
 resources:
    requests:
-        cpu: 100m
-        memory: 512Mi
-    limits:
        cpu: 500m
        memory: 1Gi
+    limits:
+        cpu: "4"
+        memory: 6Gi
 replicaCount: 1
 sops:
-    lastmodified: "2026-09-09T21:39:30Z"
-    mac: ENC[AES256_GCM,data:ACBKJLGUfWw9T3fOhQMT251gcLzG3bUXjUqBxG1DuPl8c8bblaIpLOu0QsrfQziQY3jM0DFJ2W/I2vjkrhCuCaZhZCtRg2nzUk+7HelqjEdKLphSuIdlHIkz7Icu+khShrwTgmQiE00Gg1WUsLRkKBgNsOm3TMK4wB874iBvSYY=,iv:Idp0+UBXaRFkpOFKFoRrLKuN1mOmfM7pukC22KkNiCU=,tag:fL9DzAo8FSx4PblVlTHtaQ==,type:str]
+    lastmodified: "2026-09-30T21:03:47Z"
+    mac: ENC[AES256_GCM,data:eHMr2BqfWNI32S14XEivXtXSIRiCBCAQz06mwtbNyXc1dI6YgF4pKdyIbfRWQW0ZYcbvqKxtyugao+lhc24Ds/GgIbdwchlMyz/DyuOQtM5GMHcSoInQUQVGzrM8hSyztKzq10bH0DmKvT68+uaVx0hf6rzxEqLRb3GAk4q3310=,iv:5kJ6bYE/54EbDWctSXBcVTjJtc/J3mV664tFD1WTK90=,tag:AAbHK3njH0PCqw9yjSWevQ==,type:str]
    pgp:
-        - created_at: "2026-09-09T21:39:30Z"
+        - created_at: "2026-09-30T21:03:47Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQIMA7uy4qQr71wiAQ/+PK0/kUHlc+exa8slolUeTGjHzd/R1Dtux/+HJdC9Vpow
-            ImAQvIdkEjwL0FmoA7Z4val/Wzx/YzFJ5r6sADNaQ9EG7QO+I8WY3VrKj5aRi0Qz
-            +FgHAgng+wdRCCBoxv9Z+MTPSl4TwrKsbrulHAg7EayDKxwGzkyMrnxvukRqD8GB
-            iMQCUadudR458fzB04dkhljAbl/FqX5ppflzEoGVCiRSBcWNkaHgyYqopYGzMASy
-            KTzoV01adnOZY+xeZa5GasgCEbCU3BDesD9vBb+sFsRugVuRHzdyqp3nVBwudpeh
-            OcE9MOMyBN1SAdx9RCsB8aHWYndF1dim84ZWgQThkLlA+7CWJt/NyFYwmMdqqzSv
-            C7slojC6B8bb3863c5w3qe9TPPBwyTOcuNTMunr6wXidlPZWtsImhu/RX9fqzFjZ
-            9X1+wAjAfs7AASeNJLFYqiPrknSAA3JumQZtrFC5dejpTj9H2ns6DkiHSZy8FA8O
-            RuZ8hv/L8L8oilbubKnKFZLhR8lh8A1jXHUxzaEC/L4o4cd7/3TlEms/51yM9qYx
-            WJOz4H8lbphDYO4tFgsGAhL/yHbLHvww/X1hNldwI7mqYrFLSjIwxW2Oxo8c+QB6
-            yZ3VxTXuS9jEVpGTVhIOfepwS8rJQbTUeewqok3riw9GpSEFpOMWsBxlT6+HI8zS
-            XgHPVohxe93kk51O7WjBgq8PAwG7DtWrygqWYORz+pTYN8wTtC4pfotiJZ7hv7Gv
-            NICEZlirrTUdIol8jyM+yRv1gWuYwQJpjnrQVY2AoAQX6ta5/3st24cyuGwGHO0=
-            =Q6Pu
+            hQIMA7uy4qQr71wiAQ//Vf2Rdp8NG4AsbIIOiXabY3AzLyVbE9Pn52+FBF+NIfkS
+            XDqlgvMAWHtmV2LzvJPwPIUjCZkoRwmDsh9zi+W1XzHh9kKxzwvIxfjiqm8fwJh8
+            gb4a/y5mkkEqs+H0zE1H4D91dPbfOmDABJKaePmWTB+tc48bY6qX+LYs7hkPwsHU
+            sN64cidbIbzBoq0t1TWZFkl6MZYWX9IyqJE1XcqYDAvwxlJ4JMJH2pGQlY8+7U96
+            YQgbXhuAik5IzNQlmdpq0mt0j3KZgM7KbLJ2en6JAiO0EhD3xKbFnC0bPniUEX2c
+            Yv6Z/1NrmNImCwbOkrNF9sqto4d9VHFDH8udSHKCXcSbzJmkfF4XUOBuNxtprmQV
+            Wlcw5ZMFpnOgRn+V2gb0Cd3cm5rje0QAYCgIGUfduvMm9BReAQTvpUdKkqKs0mLr
+            XiRAG0HfjjGNcVqWA0H0L5UxlVwHJh6zSNHDzTPVlGenVcQSpiUORKxZqANpQchW
+            /wtFghatZFKbbzEz6Mo5C3hMKOXjl/VNWsmva8BoloDKPm9pWH5S4x0ExYiOWSOk
+            Yk9j+twTgJXMeptO55qMCJKl6CcRsbgVr5yJJXWC6I3tr2ssx1BnSAPYDviuhsC1
+            YAbgFlvdzE6n8FmTixVwzVZrTbZV7alz9PECViMP5evAphe3n1MvnLEvMM0WOm/S
+            XgG0Ty4hQ9ZD7gzhIrh06xVuh+MC/PaMYIZ7LBVHgQy8xbAgQH0qXkF39/9rCIws
+            A/D0FN29uXvfSWzlgSrGOj218eKHX9g+nZGIAHeejd/FJVnOKQpUboUlg/x3jqQ=
+            =943y
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: pkgatlas
+resources:
+  - namespace.yaml
+  - repository.yaml
+  - release.yaml
+secretGenerator:
+  - name: pkgatlas-values
+    files:
+      - values.yaml=values.yaml
+configurations:
+  - kustomizeconfig.yaml
@@ -0,0 +1,6 @@
+nameReference:
+- kind: Secret
+  version: v1
+  fieldSpecs:
+  - path: spec/valuesFrom/name
+    kind: HelmRelease
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+    name: pkgatlas
@@ -0,0 +1,22 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+    name: pkgatlas
+    namespace: pkgatlas
+spec:
+    interval: 1m
+    chart:
+        spec:
+            sourceRef:
+                kind: HelmRepository
+                name: pkgatlas
+                namespace: pkgatlas
+            chart: pkgatlas
+            # CI publishes a timestamped version on every main push and
+            # stamps appVersion with the commit SHA of the image it
+            # builds; this range always picks the latest one.
+            version: '>=0.4.0-0'
+            interval: 1m
+    valuesFrom:
+        - kind: Secret
+          name: pkgatlas-values
@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+    name: pkgatlas
+    namespace: pkgatlas
+spec:
+    interval: 1m
+    url: https://git.vhaudiquet.fr/api/packages/vhaudiquet/helm
@@ -0,0 +1,47 @@
+# Chart: https://git.vhaudiquet.fr/vhaudiquet/pkgatlas (chart/pkgatlas).
+# The image ships both binaries (build + serve) and runs as nonroot
+# (uid 65532, distroless). Everything else is chart default: discovery
+# first — build.enabled=false, the first refresh pass builds the whole
+# live rotation and /v1/readyz stays 503 until it lands; weekly
+# refresh after that.
+image:
+    repository: git.vhaudiquet.fr/vhaudiquet/pkgatlas
+ingress:
+    enabled: true
+    className: traefik
+    hosts:
+        - host: pkgatlas.vhaudiquet.fr
+          paths:
+            - path: /
+              pathType: Prefix
+    # TLS terminates at Caddy with the *.vhaudiquet.fr wildcard cert;
+    # Caddy proxies to Traefik by host, so no tls block here (same as
+    # gitea's ingress).
+    tls: []
+sops:
+    lastmodified: "2026-09-24T19:57:42Z"
+    mac: ENC[AES256_GCM,data:cidn6U0EFjuEx98GA8Jlppg3GobcGGrhs20dPoAnUXdpFogfsp3YOTPCKuKi0LrOw/fxBP84U4drx5lJcjL11Ft/Ozn6Z8tk3l8cdqK+BUm6yijtQ0PXHjPUJYNIeqxrQKJzFlVHS+tOARbhQ3DjoNt71WBMfSPUDcPxrbnwVAA=,iv:Yz85yh9jrLXf6DKeVmOLeiVCWcthKCPGCJJwR3RVikg=,tag:7Mdv4VZUpsjuysitx4b2DA==,type:str]
+    pgp:
+        - created_at: "2026-09-24T19:57:42Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ/+N+gGPOCbuxleT6xx0FduVN1vspYJlCyrtLsy632Yz17x
+            ucwqSuGciqUf2kF3GwnOzINEY0eLskbKHMX5wkbJg8+X6dXoRyiseX3fdNrpvMGR
+            P1ZC/C4O6BzQoPJOXDQZHuWPI0Imx61PlzDPzsJ44JBvwrkCKgoaWOvzMyTjZHiC
+            iplyHpzDR2sqfMe29aQICrEV6Z87eMWQ3wie6CzX2OYTj89BejsN2Ibg4n5cqdNO
+            c+mM7Ek2nSWMWYGbdL0W2N6WSIbGuQj/aVbS0s6585NUPJtmcznB7uosRroqfbd2
+            9SMP1gaUOr+00kykRxKtd/ZoW7S/21kGbZ8FwvtKZFrBwcoUuLehbSGAHRYLo6dI
+            5WGeky65IrvpKen8Q/B6o6EByTONt2h+XiyJyLwDLeFh13/ldkGqa1oW+4BTHuX9
+            2WvLOboHpr4MGQdO53Q8zm8VCGAltusII6ZVaoEyjilqZtC/Aa9XZIT/HshOGTQi
+            4CITE1BfGEApOcBbBQKdjYofdWcyuLSF/ertXvcvNiCoVe0wYiHSYUht+HulQ3t+
+            Z0K7C2sJ2bx8C+316b2MzCGVrVOuqDABpQJjIr4aiRG9v8BtYTaUc425CLm9TMtA
+            PmZR1Rqowy4ECekrbvk3lNjPoq13HLSqkm2ppL9WFub5zY2XY0npprSeUknTmSDS
+            XgGFDhcroUq0vTUlJbC015kpa6cpynwTmMuQrFaMPeKeBPkL4Le6QFJMjpIi3yg3
+            65bSBv5t7YXoHFJWVFYej005Lz1lxp1VtaMiA0bnKEnyh/SbfcUqD4d9P1WNx+4=
+            =ulvs
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
+    version: 3.10.2
@@ -79,3 +79,131 @@ spec:
    - buildpath.win
  duration: 2160h # 90 days
  renewBefore: 360h # 15 days before expiry
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: saggar-dev
+  namespace: caddy
+spec:
+  secretName: saggar-dev-tls
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: saggar.dev
+  dnsNames:
+    - saggar.dev
+  duration: 2160h # 90 days
+  renewBefore: 360h # 15 days before expiry
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: api-saggar-dev
+  namespace: caddy
+spec:
+  secretName: api-saggar-dev-tls
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: api.saggar.dev
+  dnsNames:
+    - api.saggar.dev
+  duration: 2160h # 90 days
+  renewBefore: 360h # 15 days before expiry
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: docs-saggar-dev
+  namespace: caddy
+spec:
+  secretName: docs-saggar-dev-tls
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: docs.saggar.dev
+  dnsNames:
+    - docs.saggar.dev
+  duration: 2160h # 90 days
+  renewBefore: 360h # 15 days before expiry
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: get-saggar-dev
+  namespace: caddy
+spec:
+  secretName: get-saggar-dev-tls
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: get.saggar.dev
+  dnsNames:
+    - get.saggar.dev
+  duration: 2160h # 90 days
+  renewBefore: 360h # 15 days before expiry
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: rhema-rs
+  namespace: caddy
+spec:
+  secretName: rhema-rs-tls
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: rhema.rs
+  dnsNames:
+    - rhema.rs
+  duration: 2160h # 90 days
+  renewBefore: 360h # 15 days before expiry
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: s3-rhema-rs
+  namespace: caddy
+spec:
+  secretName: s3-rhema-rs-tls
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: s3.rhema.rs
+  dnsNames:
+    - s3.rhema.rs
+  duration: 2160h # 90 days
+  renewBefore: 360h # 15 days before expiry
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: www-rhema-rs
+  namespace: caddy
+spec:
+  secretName: www-rhema-rs-tls
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: www.rhema.rs
+  dnsNames:
+    - www.rhema.rs
+  duration: 2160h # 90 days
+  renewBefore: 360h # 15 days before expiry
+---
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: get-rhema-rs
+  namespace: caddy
+spec:
+  secretName: get-rhema-rs-tls
+  issuerRef:
+    name: letsencrypt-production
+    kind: ClusterIssuer
+  commonName: get.rhema.rs
+  dnsNames:
+    - get.rhema.rs
+  duration: 2160h # 90 days
+  renewBefore: 360h # 15 days before expiry
@@ -40,6 +40,8 @@ data:

        @umami       host umami.vhaudiquet.fr

+        @pkgatlas    host pkgatlas.vhaudiquet.fr
+
        handle @authentik {
            reverse_proxy traefik.traefik.svc.cluster.local.:80
        }
@@ -70,6 +72,9 @@ data:
        handle @umami {
            reverse_proxy traefik.traefik.svc.cluster.local.:80
        }
+        handle @pkgatlas {
+            reverse_proxy traefik.traefik.svc.cluster.local.:80
+        }

        # Docker VM services (via Docker Traefik)
        @alexscript     host alexscript.vhaudiquet.fr
@@ -102,3 +107,43 @@ data:
      tls /etc/caddy/certs/buildpath-win/tls.crt /etc/caddy/certs/buildpath-win/tls.key
      reverse_proxy traefik.traefik.svc.cluster.local.:80
    }
+
+    saggar.dev {
+      tls /etc/caddy/certs/saggar-dev/tls.crt /etc/caddy/certs/saggar-dev/tls.key
+      reverse_proxy traefik.traefik.svc.cluster.local.:80
+    }
+
+    api.saggar.dev {
+      tls /etc/caddy/certs/api-saggar-dev/tls.crt /etc/caddy/certs/api-saggar-dev/tls.key
+      reverse_proxy traefik.traefik.svc.cluster.local.:80
+    }
+
+    docs.saggar.dev {
+      tls /etc/caddy/certs/docs-saggar-dev/tls.crt /etc/caddy/certs/docs-saggar-dev/tls.key
+      reverse_proxy traefik.traefik.svc.cluster.local.:80
+    }
+
+    get.saggar.dev {
+      tls /etc/caddy/certs/get-saggar-dev/tls.crt /etc/caddy/certs/get-saggar-dev/tls.key
+      reverse_proxy traefik.traefik.svc.cluster.local.:80
+    }
+
+    rhema.rs {
+      tls /etc/caddy/certs/rhema-rs/tls.crt /etc/caddy/certs/rhema-rs/tls.key
+      reverse_proxy traefik.traefik.svc.cluster.local.:80
+    }
+
+    www.rhema.rs {
+      tls /etc/caddy/certs/www-rhema-rs/tls.crt /etc/caddy/certs/www-rhema-rs/tls.key
+      reverse_proxy traefik.traefik.svc.cluster.local.:80
+    }
+
+    get.rhema.rs {
+      tls /etc/caddy/certs/get-rhema-rs/tls.crt /etc/caddy/certs/get-rhema-rs/tls.key
+      reverse_proxy traefik.traefik.svc.cluster.local.:80
+    }
+
+    s3.rhema.rs {
+      tls /etc/caddy/certs/s3-rhema-rs/tls.crt /etc/caddy/certs/s3-rhema-rs/tls.key
+      reverse_proxy traefik.traefik.svc.cluster.local.:80
+    }
@@ -10,7 +10,7 @@ image:
    repository: caddy
    pullPolicy: IfNotPresent
    tagSuffix: ""
-    tag: 2.11.4
+    tag: 2.11.7
 service:
    type: LoadBalancer
    # Cluster (not Local) so any node can forward to pods on any other node.
@@ -36,25 +36,61 @@ health:
 volumes:
    - name: vhaudiquet-fr-tls
      secret:
-        secretName: ENC[AES256_GCM,data:HYQb37rKxMqxFTsCz5kw6qY=,iv:dI9uqUVLLqPv3a5vwz1vowTvO9WduQaXqj7XZREd7oA=,tag:mz257AC3pvubgzOMxbHfrg==,type:str]
-        optional: ENC[AES256_GCM,data:k9FVxw==,iv:XMAGop2PvSGD1R1cy6qqE39bsIAOFIqGzTnwDmYRhHM=,tag:7zZAwSzRWWiT9Y2iMWkI6w==,type:bool]
+        secretName: vhaudiquet-fr-tls
+        optional: true
    - name: wildcard-vhaudiquet-fr-tls
      secret:
-        secretName: ENC[AES256_GCM,data:2OUkq/AMuv2wQyIlLPS3bSRrnV1mvDR6vd0=,iv:1e9HC8FFC4vo7GjCnJyNjF05R+Js41ONy2in5a+/doI=,tag:icKdtLhvQ40YI+KCE+6fXg==,type:str]
-        optional: ENC[AES256_GCM,data:b+zvMw==,iv:QyU+T1BGZenO/nO8wq6R+KkrT/I6ZXIIhAnf5npFhvw=,tag:4UPyop81BQu4zxhZmK2n+Q==,type:bool]
+        secretName: wildcard-vhaudiquet-fr-tls
+        optional: true
    # semery.fr certs from cert-manager (OVH DNS-01)
    - name: semery-fr-tls
      secret:
-        secretName: ENC[AES256_GCM,data:cLzhXgUhrwgIMACU1Q==,iv:DJ+6mjtjYmWxNcHl1gzeoifpcFCJsXiOXeyxEWnRU3g=,tag:7yc2bt6fBWwBuefPY48xyA==,type:str]
-        optional: ENC[AES256_GCM,data:DTfxaQ==,iv:K7TJjSI/vF3x34SWmwmivYo+mSsUAg9nB94Ui85nHCI=,tag:1/JRBMlb07+aHKEulIYpQQ==,type:bool]
+        secretName: semery-fr-tls
+        optional: true
    - name: wildcard-semery-fr-tls
      secret:
-        secretName: ENC[AES256_GCM,data:Qq+ybi1kSVdVn9RP/kTkTcw0lkao3Q==,iv:vFmV3YvSNhLizgJVBnq1ZERqDP70onuZDvy/I3joPtI=,tag:AiEW+yh51Dexz3Vha4MPgg==,type:str]
-        optional: ENC[AES256_GCM,data:0o4ODw==,iv:VwnCs2C1MVUJEfBvNJT1rkDV7m60sNZPdtERo9wWPJk=,tag:oo+liLatrjqEtlrKQyjhyg==,type:bool]
+        secretName: wildcard-semery-fr-tls
+        optional: true
    - name: buildpath-win-tls
      secret:
-        secretName: ENC[AES256_GCM,data:SejgJvZY/B7DDgf3YJcxcFA=,iv:bDZWhie17exL+9r9A7Ea/a8Rgpex7nuabVtW60LotJQ=,tag:WxqFbzulxxPgsynqfo5hzQ==,type:str]
-        optional: ENC[AES256_GCM,data:nBNRkw==,iv:JEvsFzMli7AzUj6GXJlHXOnANm45gnFE/kXrSbBotPQ=,tag:Puss6mCkoC7SGCb86guI2w==,type:bool]
+        secretName: buildpath-win-tls
+        optional: true
+    # saggar.dev cert from cert-manager (Porkbun DNS-01)
+    - name: saggar-dev-tls
+      secret:
+        secretName: saggar-dev-tls
+        optional: true
+    - name: api-saggar-dev-tls
+      secret:
+        secretName: api-saggar-dev-tls
+        optional: true
+    # docs.saggar.dev cert — the saggar book (static nginx)
+    - name: docs-saggar-dev-tls
+      secret:
+        secretName: docs-saggar-dev-tls
+        optional: true
+    # get.saggar.dev cert — the saggar distribution host (garage web)
+    - name: get-saggar-dev-tls
+      secret:
+        secretName: get-saggar-dev-tls
+        optional: true
+    # rhema.rs certs from cert-manager (Cloudflare DNS-01)
+    - name: rhema-rs-tls
+      secret:
+        secretName: rhema-rs-tls
+        optional: true
+    - name: www-rhema-rs-tls
+      secret:
+        secretName: www-rhema-rs-tls
+        optional: true
+    - name: get-rhema-rs-tls
+      secret:
+        secretName: get-rhema-rs-tls
+        optional: true
+    - name: s3-rhema-rs-tls
+      secret:
+        secretName: s3-rhema-rs-tls
+        optional: true
    - name: routes
      configMap:
        name: caddy-routes
@@ -75,6 +111,30 @@ volumeMounts:
    - name: buildpath-win-tls
      mountPath: /etc/caddy/certs/buildpath-win
      readOnly: true
+    - name: saggar-dev-tls
+      mountPath: /etc/caddy/certs/saggar-dev
+      readOnly: true
+    - name: api-saggar-dev-tls
+      mountPath: /etc/caddy/certs/api-saggar-dev
+      readOnly: true
+    - name: docs-saggar-dev-tls
+      mountPath: /etc/caddy/certs/docs-saggar-dev
+      readOnly: true
+    - name: get-saggar-dev-tls
+      mountPath: /etc/caddy/certs/get-saggar-dev
+      readOnly: true
+    - name: rhema-rs-tls
+      mountPath: /etc/caddy/certs/rhema-rs
+      readOnly: true
+    - name: www-rhema-rs-tls
+      mountPath: /etc/caddy/certs/www-rhema-rs
+      readOnly: true
+    - name: get-rhema-rs-tls
+      mountPath: /etc/caddy/certs/get-rhema-rs
+      readOnly: true
+    - name: s3-rhema-rs-tls
+      mountPath: /etc/caddy/certs/s3-rhema-rs
+      readOnly: true
    - name: routes
      mountPath: /etc/caddy/routes
      readOnly: true
@@ -99,7 +159,7 @@ affinity:
            - weight: 100
              preference:
                matchExpressions:
-                    - key: ENC[AES256_GCM,data:oCV218wXg+k2L/edhWv6qpiyiaY=,iv:Y+O2of2NCOvcjSwr0EenGns0BtpT+P6pjCzEZUIMpm0=,tag:kY/WyHJ4Jr5ZLMe6ZcT/Tw==,type:str]
+                    - key: ENC[AES256_GCM,data:AsOdq9OGQbAGV42W4d22EGVMi5E=,iv:U3sLu8pI7fqOPbvpfpVz21cUfwovKRFi8jY6laTyStY=,tag:EQVSFAzTYw2En2xdGTCF3Q==,type:str]
                      operator: NotIn
                      values:
                        - "true"
@@ -113,37 +173,36 @@ affinity:
                topologyKey: kubernetes.io/hostname
 tolerations:
    # Tolerate the failover taint so caddy CAN schedule on p330 (small-node-1).
-    - key: ENC[AES256_GCM,data:K6vJkO2dpKRi,iv:b7NIPKTMYOxNao6KcSJUhsxKNRJ2J3ksEtmXkI8b0So=,tag:pMRmz17upWMTEZjwBRNyZQ==,type:str]
+    - key: ENC[AES256_GCM,data:s3X0PmRJCCVh,iv:UYZl3EsmdSTdF9NoYsL+zbxLlkfO2GU80Sy3CpSXMBY=,tag:35UtC37ldCItR9fAtSXVVw==,type:str]
      operator: Equal
-      value: ENC[AES256_GCM,data:4ULPtEoUhgs=,iv:ikqWRqRR9ki35QQ6VnMEzOgT0/e+5DggGP8w60BhW/Q=,tag:MW9lX8miIWb9nnbc0woZTg==,type:str]
+      value: failover
      effect: NoSchedule
-    - key: ENC[AES256_GCM,data:l7abu6ywKFevJdJod2Af2bj7XSfBJATL7UnfiUHrRJoCjBsl9A==,iv:xnUvzVX8z4doC+mQs1r0rNCSqaZ8KlXxr5Ee9FOFPjI=,tag:mnqCx9NSMSyeYwz57QFQIQ==,type:str]
+    - key: ENC[AES256_GCM,data:NYCyZsj7wMxKUjaDu+rUOQYxDKvvEwSWuDAxQkSGTczXyApCbw==,iv:3AcvLXryeZ6dfmqanFpGOgEf1nGuEVbvUmZzruxzL98=,tag:Daa9AgXQZkkr7RIzljWOeQ==,type:str]
      operator: Exists
      effect: NoSchedule
 sops:
-    lastmodified: "2026-08-26T19:28:03Z"
-    mac: ENC[AES256_GCM,data:gn90e5Gjq5/CraT7Cl43DVMIQukD798faKGbVO5IJlbpAuTwDrhvqnnojFq4R7LEEETtedpR3MRyqcnbfSWVruHoysebycL7EZJkiy7H36JmzQAOWKusshMF9kOyZIV6+AFfz8As/Mu4pF1p5+3jmgy6oOJn7Ewm0C930Gpa3gs=,iv:cf1UC/2NGBHtQgx6h8vRpMjeJRaAvG7ZznhErn2b+cE=,tag:3Ule+pq7pZHWA7NqhlgfPg==,type:str]
+    lastmodified: "2026-10-16T07:06:11Z"
+    mac: ENC[AES256_GCM,data:kMIxep2WVIr8/uAiw12T1JXMbtpyijo1c1MOOUKuok2Z1zSrnFZovgIup3u8/2BhqJ2UUDm5hFJi41Tsq45ba5ELs4PX1whi6EXlHQJxNo7ScfepEi10es/wa+p+3w9V8Yv9cklIWk14zh0UABs8jRzOJXhn5XI3O644CJSULQA=,iv:3ssxqRNRvXbmn0HiQFdwoGVbsnzvtQxfpHPIUpplMK8=,tag:5VRyB/Hh4tZUWp6KCPNSQg==,type:str]
    pgp:
-        - created_at: "2026-08-26T19:28:03Z"
+        - created_at: "2026-10-16T07:06:11Z"
          enc: |-
            -----BEGIN PGP MESSAGE-----

-            hQIMA7uy4qQr71wiAQ/9FKZhqwE2RZcfsIeMOtAkOTf/4aEbrSzsHbEO8DP8V3Ct
-            rQBu/v8y1Hcu3fVU/OjVk/7QbEBjPNu1AJST55DBIWktnYUgSo4fIujvG54/hqwM
-            9u0iuA1EcqVzGDa+vLSqgmi4Oxbujs0Ytn7uQrefqkdAOjltKqvknebI9EBdSRUi
-            GjVFwysR6jHmIVf9S64vu4VsjfC7ju9MBYZniaKsJ1GOBhIjUZ6ogkYs5S2E5PJ/
-            zE8cn79x61YLX74H+BAqnFcxbprtsCwMJPgyerfgijV6d+JpwT/6mp1VUrLe9Zz7
-            WEd/lVMlIcwnYCtIDAvuURvMP2OebWplr95d5V1Vb5Yywnl3M0pwkqL4dRiJISvk
-            N2rBQYvDfXBtJA7yTAkJ3PymrECKoFs6nspEBie/kDJmdRGv8s2aajzTTQ1qLAkP
-            FeJe0TcowjCCWMxk4W5DEoCh+PUA1HVo+/KmHjnIVgzdgxaeqT90VXwN8H7MPPeu
-            LKE01+Guue821h7GykkIhe9sf3nMGbI5rOiCcsVtgu5bODkRk8jXpXh1qdRAliuq
-            uddjy1mWEfdUHNBj8YxvZ8WOU7h9FyZjsYZB96n9du1vqcuuP5eTJDVuvjjtDuTK
-            fbXYQbxwA5j4akyI4AKJYLA0Y/lcSXc84r6q8IA52nZz6uQZExbkoc7PPX7Q/ufS
-            XgE0CWRS+0tk2oVANMVU31UrCvitttezjR6sUSAINh122a5kcmOfJzLlB2OqVKc5
-            wMAyvOYccrQMrPDX1WJE7agDOaqGUQcwuFnvqpHhe8q9Yg1uOUU4sK1R8A1Qs0Q=
-            =wlYf
+            hQIMA7uy4qQr71wiARAAuN5nBauJiH5bFx80iF2W2XJDwMCFG+SPlqv2ErxVaYkD
+            kSt8pA0o4Bzqr6gP6cEgEhzQHAVVvsvTZJTY5lX6KWNRxhz/RXDhxAi9xdBHQ81f
+            dDWn7pgD8sv8cODM39yeukhGlHxZuk7FiUJ4fBnouojWUCxf2Ib5m5TEaWwmmv5n
+            EBBjjcbGZzyWBzCkLbEY/ML1FIx5j/jyZjpjMp2En1309ljIBckjLk5s9Kntp6oJ
+            /TkW/BhU96y8fyGM6u3FV54wORNlCT3P5cDT4rsQd+KgG0DDchAdUSb7hmBEn+iC
+            W/eUsp7nhObkZZBjTKYeS502Q+3RUEXoLnVLWougDxMSA1rJNS3nkgzK1cmKs97/
+            Ghnb5TUGPmoQMUltQzxInDq1mgeGfuFUffprYprYKGeVC/oQ6uPHE4jVZImlWRjv
+            w6YPHv/2XhWMN5vH/ybsrqxcFb5+1z8u8J58GAJ37hDXzkL8ENJUouonM3sywaBc
+            VbXHzJwYEuLhRfNpay6ovwPkhU25gV3atBiXloIWc0PivPjOAJqqs0vkMgRiA+3R
+            yUagVKdyavVUhqou2LOxSGSv77uFPWZwhqUILtqzTeSE6GHUxVqKQPa91klRRNI7
+            YWNtM7ZqSeANK99h5vgphhPZpuKkIzXHSLEXdplxvaRERfWMU3UGCDZOMVcDMlbS
+            XgGovkHZ9+NKVgZVpsRyQQutbSJqvHVZJx162gu3UKC1IgnDnhslOGKVWw/oKNb5
+            KyPf0CLk9BCAlSngr5D5pw4GJ9eq7RNFOqC32LPwXgNSD1AfLFHYGWh3RZM+81w=
+            =eA3w
            -----END PGP MESSAGE-----
          fp: DC6910268E657FF70BA7EC289974494E76938DDC
-    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
-    mac_only_encrypted: true
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
    version: 3.10.2
@@ -22,6 +22,7 @@ spec:
          dnsZones:
            - vhaudiquet.fr
            - buildpath.win
+            - rhema.rs
      # OVH solver for semery.fr (via cert-manager-webhook-ovh)
      - dns01:
          webhook:
@@ -42,3 +43,18 @@ spec:
        selector:
          dnsZones:
            - semery.fr
+      # Porkbun solver for saggar.dev (via cert-manager-webhook-porkbun)
+      - dns01:
+          webhook:
+            groupName: acme.saggar.dev
+            solverName: porkbun
+            config:
+              apiKey:
+                name: porkbun-api-credentials
+                key: api-key
+              secretApiKey:
+                name: porkbun-api-credentials
+                key: secret-key
+        selector:
+          dnsZones:
+            - saggar.dev
@@ -5,3 +5,4 @@ resources:
  - clusterissuer.yaml
  - ovh-credentials-secret.yaml
  - ovh-secret-reader-rbac.yaml
+  - porkbun-api-credentials-secret.yaml
@@ -0,0 +1,49 @@
+# Porkbun API Credentials for DNS-01 Challenges (saggar.dev)
+#
+# Create an API key at https://porkbun.com/account (API Access section), and
+# enable API access on the domain: Domain Management -> Details -> API Access
+# (disabled per domain by default; the API returns a generic error otherwise).
+#
+# The secret MUST live in the cert-manager namespace: for a ClusterIssuer,
+# cert-manager reads webhook credential secrets from its cluster resource
+# namespace, which the webhook chart's RBAC already covers.
+#
+# SOPS will encrypt the stringData fields on pre-commit.
+apiVersion: v1
+kind: Secret
+metadata:
+    name: porkbun-api-credentials
+    namespace: cert-manager
+    labels:
+        app.kubernetes.io/name: cert-manager-webhook-porkbun
+        app.kubernetes.io/component: porkbun-api-credentials
+type: Opaque
+stringData:
+    api-key: ENC[AES256_GCM,data:OLTDhFnbK70gAsvMR/4iKjKr9ckEkbXhYfG4xgTWP2gjruI9HaNAWzSBJcmDyRXRSz18XnvnSlUy/P5VXG5S6uH84wg=,iv:DrOWWf5h1FLNg+emJ/MMp80k8u+A/2HzC07EmjcWORg=,tag:2ep8o1zmXNPV54Byq2Dl7Q==,type:str]
+    secret-key: ENC[AES256_GCM,data:wtGiMCpU8PqTXvH27l+tUvJLivuK/zZp5KePFSeYfjb3ieFszbnjWFd3xQkgtFM3HrmjhRaGWUEFOIEvgTTMDBDyL+k=,iv:iVxMwt6UtpMAqdZj13YUzr3/gDUVTJecyc4ptYvHyNo=,tag:R/tn/BrARGvXjL1EIHBCRQ==,type:str]
+sops:
+    lastmodified: "2026-09-27T23:12:14Z"
+    mac: ENC[AES256_GCM,data:XWzKEL3qi4/KoKUZm1uEfj6GNW3ZLq71PDEyo7w2fHHmkgFMW/xwwXoBLRYFWVx3RvT82NwOCld/Savbs0qXY+Ws1AsgjklEim7MRyIjOKTT8Jkuh39WNCc+8C13yAHSrfPa3tEs10a8lk4nOaFxVn87zAnfnEt6LGt41+/HDxI=,iv:TxW4wJSqHVB9VH9pn/9lYsg8Og3JHTKRPHOrSjeAvuw=,tag:eKZkHptFhE95bPeNegTx8g==,type:str]
+    pgp:
+        - created_at: "2026-09-27T23:12:14Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ/7BAr8vmZ9i0Www7U8EkhPqOi1g0MVD8tVyhnTptBbS4MG
+            irer3UAy7ktovNUso1/wljKif/b2Q8EK6Sawgv4Sv2jN8ShWewginRQ7DeRGtwNE
+            TkNnnZoIMQmKwUZq0NnTmStg0wY/bRDYrovGhvPO8F/ZebU/cEXRFdHDzsKsTo6p
+            9LOu8DnTj9CwvhBLCyzqCeMwvL7DZryXuTS+aEVnrS0J4OUydK4VKYsvwXVsF6XT
+            4Jkpcf4yAiwxBsnZiszvL+L1BPzku1peU/p/d1fciVq54TmgrRwyC7GrlCLm/f09
+            xEPLnBMtmp1w5M2aONEYXXrk5fMWLIuSU7SmFzWduwLAMPTfHvGbpIS4U8eMCuIy
+            THKmeuyPL4/BW+PIc/L/UucOF0pjPDAPsdw3dEkB0+MlX3YDuTc37PpiX3pMRy1C
+            kxhwRVNPZqWMjkrAqg0BR9ZHEOQiv+HwHXZNG5CSHaYYC/mJUSVGaL7R0yOP3nIy
+            cWDA6Pyk5XWLspVh534xQODm1oArMdZ+xnD6NUqt+Bv6facrZkmT6r66LnCLb9fQ
+            rTS1aDm4gxuG5SX7lafDWL9Rh+z2DgFDde9cEAJZiBna4lTE7tJFPHF4OolqzrnN
+            MEhN8no5bLcMv1knE2nKkeKmOoXEKQ80mwgcVkdiRtQf2eZWAXAmpkGehuW/nIHS
+            XAHZXogqlqxbGDtIe2dM0qun1OA0HxsGw5J2EcFUt53wSg/YaZdEPN6aARPdRi8P
+            qGCEhZ43OokTCffCzf2Z52f7nx2NHIOoV3O3+80g6jw/Lrfe8WsZZZyXgjqm
+            =AViA
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
+    version: 3.10.2
@@ -12,7 +12,7 @@ spec:
        name: cert-manager-webhook-ovh
        namespace: cert-manager
      chart: cert-manager-webhook-ovh
-      version: "0.9.16"
+      version: "0.9.18"
      interval: 1m
  valuesFrom:
    - kind: Secret
@@ -0,0 +1,12 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: cert-manager
+resources:
+  - repository.yaml
+  - release.yaml
+secretGenerator:
+  - name: cert-manager-webhook-porkbun-values
+    files:
+      - values.yaml=values.yaml
+configurations:
+  - kustomizeconfig.yaml
@@ -0,0 +1,11 @@
+nameReference:
+  - kind: HelmRepository
+    version: v1
+    fieldSpecs:
+      - path: spec/chart/spec/sourceRef/name
+        kind: HelmRelease
+  - kind: Secret
+    version: v1
+    fieldSpecs:
+      - path: spec/valuesFrom/name
+        kind: HelmRelease
@@ -0,0 +1,19 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: cert-manager-webhook-porkbun
+  namespace: cert-manager
+spec:
+  interval: 1m
+  chart:
+    spec:
+      sourceRef:
+        kind: HelmRepository
+        name: cert-manager-webhook-porkbun
+        namespace: cert-manager
+      chart: cert-manager-webhook-porkbun
+      version: "2.0.7"
+      interval: 1m
+  valuesFrom:
+    - kind: Secret
+      name: cert-manager-webhook-porkbun-values
@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: cert-manager-webhook-porkbun
+  namespace: cert-manager
+spec:
+  interval: 1m
+  url: https://porkbun.octabits.io
@@ -0,0 +1,49 @@
+# cert-manager-webhook-porkbun Values
+# groupName must match the ClusterIssuer webhook stanza
+groupName: acme.saggar.dev
+# cert-manager deployment configuration for RBAC
+# The chart creates RoleBindings so cert-manager's service account can reach
+# the webhook and read the Porkbun credential Secret
+certManager:
+    namespace: cert-manager
+    serviceAccountName: cert-manager
+# Restrict the webhook's Secret read access to the Porkbun credentials only
+rbac:
+    secretAccess:
+        secretNames:
+            - ENC[AES256_GCM,data:WXGjM38wR7oKcvetV91WocOt48njb5Y=,iv:7UEsgh62qq/0fGfmjG96Kko/r2h9IOD7IqRnu7poGFo=,tag:qdb4+n9ZnQidlz5fnHq94g==,type:str]
+# Pod configuration
+replicaCount: 1
+resources:
+    requests:
+        cpu: 10m
+        memory: 32Mi
+    limits:
+        memory: 128Mi
+sops:
+    lastmodified: "2026-09-27T22:55:14Z"
+    mac: ENC[AES256_GCM,data:rSc+2n8PYZLdBJRWB3lgiH40+24/5v0vLRAkHV3vM3IyxZgBrjJxmWjAu5PJWHDobQiw7G7x7ZMotJx6TbJztbnBpB5GmdoFC0kVkxxdE8txCWlmcwed6oktCJQ0nR09DaqTk3OvRZgFsWwkVMhZwCjLS+gZBzTTcw84MKqQcGg=,iv:tJd2rGP0EzrjVSp5ESHf5BnFU7fFjMUgfZTgZeM2yRk=,tag:hxVTpxEjz1naTbrDTQUSYA==,type:str]
+    pgp:
+        - created_at: "2026-09-27T22:55:14Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ/5AVsqIJQvmzAAexGSmYjPrdmX7W7JaVHYpUCFbiU9RP32
+            S1ffbzV+YjmYkrLhnwhosNeheEVbEiWeyrea+B9wlTgUp1R9+oy8ooc30uDr/vhY
+            9K56DoEcUhi95mQD1U7e7LK6qUkMowS0HWXEEOb/r/bvL3lQNmc4rNJ8Dz+MDFh3
+            A59ZkrvspjccrLd9wJUb1QbwLKRw/QpE/bT17nj8bOwcAipdz2Q/GoX0LGp88fgS
+            Yy6G/zwVpY/mDylHZbunDVBEqAziR3TAbQsRQZou2oB69Q0jwVs8//vVhWSpniUr
+            an/XdNaEDR5LFJESJK9Kf3H2Qe/Cq8ynC3NFAwk+tHVLOW8MxQrDUvq3fTQq/Zl+
+            CEzMD7+5bQDLQX82QMZ0TdjcLCIEouqCHo9dnGQGUX7NQd1ePV3xda6750zr1maX
+            PVTmx12nS+fCwo1DVLSTVa907TLg3h/DoADzpzcmhTfE7xO2mNcfN+P1dnHT2+U4
+            FhUXqYgZSkgjlkkpVr8XmZg4Cb98lgpS6hDqXylrXhdsCvGgW9YKg0wdQqb6H4Sr
+            ycBsXmj4/j1EMB9yqfSpO/6NNDjTMms0nWsrGXI7NHpROj+AV7fWXC1yxhw6uTus
+            SYhve/6VvbCb3hw9gHb9lzQ9VvTq/0jOqIMBoLoD1Wd45tHczPx1xbVf3KyB1HTS
+            XgFYYLiLku1Jj87DtdbsAbN0tNQNets9TBVffkawgFNsei/H5ZazKFPOC5NrwnJ1
+            FWLWI1fwFZG18c29b8mrEUKqX8GD+YO0BKwmtL7n9out6YAA+hK780RytQDdD00=
+            =yh2A
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
+    version: 3.10.2
@@ -14,7 +14,7 @@ spec:
        name: stalwart-helm
        namespace: stalwart
      chart: stalwart
-      version: "0.7.16"
+      version: "0.7.21"
      interval: 1m
  valuesFrom:
    - kind: Secret
@@ -7,7 +7,7 @@
 # Container image
 image:
    repository: stalwartlabs/stalwart
-    tag: v0.16.20
+    tag: v0.16.25
    pullPolicy: IfNotPresent
 # Single-node RocksDB deployment.
 replicaCount: 1
@@ -9,6 +9,11 @@ ports:
            trustedIPs:
                - 127.0.0.1/32
                - 10.0.0.0/8
+        transport:
+            respondingTimeouts:
+                # v3 default is 60s, counted over the whole request body:
+                # large HTTP git pushes die with a 504 past one minute.
+                readTimeout: 5m
 # Tolerate failover node
 tolerations:
    - key: ENC[AES256_GCM,data:r4uAu1ni9/Z8,iv:aKgn6DgT9XnjzmotnaEIL+WzUiQ34CazfervJwrYsdM=,tag:EeOY1YZwNCOPgHwXpas3ew==,type:str]
@@ -29,12 +29,15 @@ resources:
  - dev/gitea
  - dev/harbor
  - dev/renovate
+  - dev/pkgatlas
  # Home (home automation)
  - home/home-assistant
  - home/zigbee2mqtt
  # Personal (apps storing my own content, grouped by content type)
  - personal/paperless
  - personal/radicale
+  - personal/rhema-claw
+  - personal/syncthing
  - personal/media/photoprism
  - personal/notes/notesnook
  - personal/notes/obsidian-livesync
@@ -44,6 +47,10 @@ resources:
  - utilities/open-webui
  # Production (public-facing websites/apps)
  - production/buildpath
+  - production/saggar
+  - production/get-saggar
+  - production/get-rhema
+  - production/rhema-site
  - production/semery-fr
  - production/umami
  - production/vhaudiquet-fr
@@ -12,7 +12,7 @@ spec:
        name: notesnook
        namespace: notesnook
      chart: notesnook
-      version: '1.0.32'
+      version: '1.0.38'
      interval: 1m
  valuesFrom:
    - kind: Secret
@@ -5,5 +5,6 @@ resources:
  - openclaw-instance.yaml
  - openclaw-secrets.yaml
  - networkpolicy.yaml
+  - networkpolicy-lan-egress.yaml
  - networkpolicy-mail-egress.yaml
  - networkpolicy-radicale-egress.yaml
@@ -0,0 +1,39 @@
+# Supplementary egress policy: the operator's managed default-deny NetworkPolicy
+# only allows DNS (53) and TCP 443 outbound, so any other port toward the local
+# network is dropped. That blocks the OpenClaw pod from reaching LAN services
+# that do not speak HTTPS on 443. Measured from inside the pod against
+# 10.4.1.222, 443 returns RST (admitted, nothing listening) while 7020 times
+# out, which shows LAN routing works and only the port is being refused.
+#
+# The egress rule below sets no `ports`, because the goal is arbitrary LAN
+# services rather than one known port. Cluster CIDRs are excluded so this does
+# not become a blanket "any pod, any port" grant; the LAN is what gets admitted.
+# Note this is additive to the operator's rules, so DNS and 443 everywhere still
+# hold.
+#
+# Written as a sidecar policy rather than via the CR fields
+# spec.security.networkPolicy.additionalEgress / allowedEgressCIDRs, matching
+# the existing networkpolicy-mail-egress / -radicale-egress pattern. Those CR
+# fields DO appear in the 0.39.0 CRD template, contrary to the comments on the
+# sibling policies, so they are worth retrying once the installed CRD version is
+# confirmed. Until then the sidecar route is the one known to take effect.
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: openclaw-lan-egress
+  namespace: openclaw
+spec:
+  podSelector:
+    matchLabels:
+      app.kubernetes.io/instance: openclaw
+      app.kubernetes.io/name: openclaw
+  policyTypes:
+    - Egress
+  egress:
+    - to:
+        - ipBlock:
+            cidr: 10.0.0.0/8
+            except:
+              # Service CIDR and pod CIDR (infra/kube/talconfig.yaml).
+              - 10.96.0.0/12
+              - 10.244.0.0/16
@@ -12,7 +12,7 @@ spec:
        name: cloudpirates
        namespace: paperless
      chart: postgres
-      version: "0.20.4"
+      version: "0.20.6"
      interval: 1m
  valuesFrom:
    - kind: Secret
@@ -12,7 +12,7 @@ spec:
        name: cloudpirates
        namespace: paperless
      chart: redis
-      version: "0.34.26"
+      version: "0.35.4"
      interval: 1m
  valuesFrom:
    - kind: Secret
@@ -12,7 +12,7 @@ spec:
        name: derwitt
        namespace: radicale
      chart: radicale
-      version: "2.1.0"
+      version: "2.1.4"
      interval: 1m
  valuesFrom:
    - kind: Secret
@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: rhema-claw
+resources:
+  - namespace.yaml
+  - repository.yaml
+  - release.yaml
+secretGenerator:
+  - name: rhema-claw-values
+    files:
+      - values.yaml=values.yaml
+configurations:
+  - kustomizeconfig.yaml
@@ -0,0 +1,6 @@
+nameReference:
+  - kind: Secret
+    version: v1
+    fieldSpecs:
+      - path: spec/valuesFrom/name
+        kind: HelmRelease
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: rhema-claw
+  labels:
+    app.kubernetes.io/name: rhema-claw
+    app.kubernetes.io/component: ai-agent
@@ -0,0 +1,24 @@
+# Tracks the rhema-claw chart as CI publishes it on main: the timestamp
+# pre-releases (0.1.0-YYYYMMDD-HHMMSS) all sort above 0.1.0-0, and the
+# chart's appVersion carries the commit SHA the image was tagged with —
+# values.image.tag stays empty to ride it. Same rolling scheme as the
+# saggar release.
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: rhema-claw
+  namespace: rhema-claw
+spec:
+  interval: 1m
+  chart:
+    spec:
+      sourceRef:
+        kind: HelmRepository
+        name: vhaudiquet
+        namespace: rhema-claw
+      chart: rhema-claw
+      version: ">=0.1.0-0"
+      interval: 1m
+  valuesFrom:
+    - kind: Secret
+      name: rhema-claw-values
@@ -0,0 +1,11 @@
+# The vhaudiquet package repository on the home Gitea — where the rhema
+# CI publishes the rhema-claw chart on every main push (base version +
+# timestamp, ordered by SemVer pre-release rules). Public: no auth.
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: vhaudiquet
+  namespace: rhema-claw
+spec:
+  interval: 1m
+  url: https://git.vhaudiquet.fr/api/packages/vhaudiquet/helm
@@ -0,0 +1,69 @@
+# The rhema claw — the resident agent daemon from ../rhema.
+# Single-node by design (one SQLite store, one dispatcher): the chart
+# fails the render past one replica.
+image:
+    repository: git.vhaudiquet.fr/vhaudiquet/rhema-claw
+    # Empty: follows the chart's appVersion — the commit SHA CI stamped on
+    # the pushed images.
+    tag: ""
+# Bearer token for the /v1 routes (/healthz stays open). The daemon
+# shells out through the coding agent, so the surface must not sit open
+# on the LAN. Encrypted at rest: the .sops.yaml creation rule scoped to
+# this file adds `token` to the values encrypted_regex.
+token: ENC[AES256_GCM,data:fZKJzLy8FjN+0ONrHn40Tgb1/uTtYdAWTJwY7BfFltsGCPnuMx1F8KIPfQbzliyH,iv:yzaHrdDrSBbnT01aJmv8537D1lVe4kwIDINiuOgXPKU=,tag:dT7Z5v3CUhJg/+BqcjAWIA==,type:str]
+# No provider, model, or credentials: the backend is selected
+# dynamically (nothing injected, nothing pinned) — when a dispatch or a
+# chat turn needs a key, the daemon resolves it through the rhema
+# config seam, not through this release. The nulls erase the chart's
+# built-in anthropic/claude defaults from the rendered claw.yaml.
+config:
+    provider: null
+    model: null
+    watches: null
+# The chart's own ingress, rendered from these values. Plain HTTP on
+# purpose: kosmos.lan is LAN-internal and token-auth-only, like every
+# other .lan surface here (no TLS story for .lan hosts).
+ingress:
+    enabled: true
+    host: kosmos.lan
+    className: traefik
+    annotations:
+        external-dns.alpha.kubernetes.io/enabled: "true"
+persistence:
+    enabled: true
+    storageClass: longhorn
+    size: 5Gi
+resources:
+    requests:
+        cpu: 100m
+        memory: 256Mi
+    limits:
+        cpu: "1"
+        memory: 1Gi
+sops:
+    lastmodified: "2026-10-10T11:49:22Z"
+    mac: ENC[AES256_GCM,data:vz3cATCAOEoyXOJCz0u+GfIq06lV5sV3mUoOKa4lUOWnShGOnxxE+v60AslV4KYBfmSCVliTalM0Vm8isuqJSAd9ZdPaI0CZ9F0gkxza22eaESkapIcIYrAhJYcZnRBSyAXjdVHyIzlvVwyTEqWYvEW7F5MJUgc4igHFD1/gMIA=,iv:VxsYzAWGhOiLXCt68Mpu8N9xgjsXXgc2LnInv2BExV8=,tag:rICLpdj4D37QZtTNV91uWA==,type:str]
+    pgp:
+        - created_at: "2026-10-10T11:49:22Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ//WeO+shUgWwJAu2IdxVteea0IpFCyo93hWqxLWMytqF7+
+            3h2s7zXXsNvNCvqndHzNSrZt+OuSQDWSBVIzfxlztw7ga6BdI92OhpOZPCIyKwDT
+            LzzUCPrSAGOZVekOkFXKlVDjMFunAiEp/soGda7bbP+VrdHJmeRh8fioTOgd/4qL
+            /QmmJk3bMTlMoVcknOW2qI3n79YA9qnI0vjwBL63bDeZnxZ8CiZzd1SDr10K0rDf
+            f9ErcmeKAwm+HgehSA3xId0Cph4gnf3xNhNDe2gcZvoFlPIrZT0iU0fBzMRuJPxt
+            c9g+TqTAHBfx90H58/NF8Sfr3ScXNUHvHzgzrq4w+ogqmp8NYsdDbzG1C318dV2o
+            nITluENiYgR9Qs6gJda94aEc00IYEBp4lNGp5G1SyHiDB+jMMsiHX6w3x286dgNx
+            G6DcJ+TabCO+A+Fzq74I2ds+paoEgDegDMCIgK6uSKF0jT2ID579Bf2kRraneOqV
+            amgBI2CQZG5FAqdhbtpf4PHAK9YR3b42mgF9nBAc+f/oFeAZm8nFmG7LubwxqbgY
+            HLa7+ct38ygp/pwZ0FQcU5I3VwqYyU+JA3HMsL2yspHJAeQuXAvzkCQ8NaDOMpEY
+            JRY1pIHl3SwTkV3zh9co8r2Ho8fGYO6KzlNfEdRsx2C6DegM70kpPuYzcCDYAd3S
+            XAE6EX2dM+NxYqhHEIwKjFMJlROWwhhRhheFZnyYRMsn75NkeqRfPi2tJgMkIMk9
+            OJ1eekhgFbQr8vaWtrIOhjvQG9ieg2ujuyltVcC2XUFxQONCxbfoXC2oYu1Y
+            =gTTK
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml|token)$
+    mac_only_encrypted: true
+    version: 3.10.2
@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: syncthing
+resources:
+  - namespace.yaml
+  - repository.yaml
+  - release.yaml
+secretGenerator:
+  - name: syncthing-values
+    files:
+      - values.yaml=values.yaml
+configurations:
+  - kustomizeconfig.yaml
@@ -0,0 +1,6 @@
+nameReference:
+  - kind: Secret
+    version: v1
+    fieldSpecs:
+      - path: spec/valuesFrom/name
+        kind: HelmRelease
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: syncthing
+  labels:
+    app.kubernetes.io/name: syncthing
+    app.kubernetes.io/component: file-sync
@@ -0,0 +1,19 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: syncthing
+  namespace: syncthing
+spec:
+  interval: 1m
+  chart:
+    spec:
+      sourceRef:
+        kind: HelmRepository
+        name: k8s-home-lab
+        namespace: syncthing
+      chart: syncthing
+      version: "5.2.0"
+      interval: 1m
+  valuesFrom:
+    - kind: Secret
+      name: syncthing-values
@@ -0,0 +1,8 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: k8s-home-lab
+  namespace: syncthing
+spec:
+  interval: 1h
+  url: https://k8s-home-lab.github.io/helm-charts/
@@ -0,0 +1,152 @@
+# Syncthing continuous file synchronization
+#
+# Sync ports (22000 TCP+QUIC, 21027 UDP) are exposed through LoadBalancer
+# services on the dedicated Cilium pool IP 10.2.2.7 (appended to
+# kubernetes/system/cilium/pool.yaml). The GUI goes through Traefik like the
+# other *.lan services.
+controller:
+    replicas: 1
+image:
+    repository: syncthing/syncthing
+    tag: "2.1"
+env:
+    - name: TZ
+      value: Europe/Paris
+    - name: PUID
+      value: "1000"
+    - name: PGID
+      value: "1000"
+podSecurityContext:
+    fsGroup: 1000
+service:
+    main:
+        ports:
+            http:
+                port: 8384
+    # Sync protocol and QUIC share 22000 on the pooled IP; LAN discovery
+    # rides on UDP 21027. externalTrafficPolicy Local preserves client IPs.
+    listen:
+        enabled: true
+        type: LoadBalancer
+        externalTrafficPolicy: Local
+        loadBalancerIP: 10.2.2.7
+        ports:
+            listen:
+                enabled: true
+                port: 22000
+                protocol: TCP
+                targetPort: 22000
+            quic:
+                enabled: true
+                port: 22000
+                protocol: UDP
+                targetPort: 22000
+    discovery:
+        enabled: true
+        type: LoadBalancer
+        externalTrafficPolicy: Local
+        loadBalancerIP: 10.2.2.7
+        ports:
+            discovery:
+                enabled: true
+                port: 21027
+                protocol: UDP
+                targetPort: 21027
+probes:
+    liveness:
+        custom: true
+        spec:
+            httpGet:
+                path: /rest/noauth/health
+                port: http
+    readiness:
+        custom: true
+        spec:
+            httpGet:
+                path: /rest/noauth/health
+                port: http
+ingress:
+    main:
+        enabled: true
+        ingressClassName: traefik
+        annotations:
+            external-dns.alpha.kubernetes.io/enabled: "true"
+        hosts:
+            - host: syncthing.lan
+              paths:
+                - path: /
+                  pathType: Prefix
+persistence:
+    config:
+        enabled: true
+        mountPath: /var/syncthing/config
+        storageClass: longhorn
+        size: 5Gi
+    # Shares are recreated by hand in the GUI after cutover — the instance
+    # boots with a fresh config (see plans/syncthing-docker-to-kube-migration.md):
+    # valentin's folders at /data/valentin/… and sarah's at /data/sarah/…, all
+    # backed by the same TrueNAS exports as the docker stack. Photoprism
+    # already mounts the valentin Photos export concurrently.
+    valentin-documents:
+        enabled: true
+        type: custom
+        mountPath: /data/valentin/Documents
+        volumeSpec:
+            nfs:
+                server: truenas.lan
+                path: /mnt/main_storage/valentin/Documents
+    valentin-photos:
+        enabled: true
+        type: custom
+        mountPath: /data/valentin/Photos
+        volumeSpec:
+            nfs:
+                server: truenas.lan
+                path: /mnt/main_storage/valentin/Photos
+    sarah-documents:
+        enabled: true
+        type: custom
+        mountPath: /data/sarah/Documents
+        volumeSpec:
+            nfs:
+                server: truenas.lan
+                path: /mnt/main_storage/sarah/Documents
+    sarah-photos:
+        enabled: true
+        type: custom
+        mountPath: /data/sarah/Photos
+        volumeSpec:
+            nfs:
+                server: truenas.lan
+                path: /mnt/main_storage/sarah/Photos
+resources:
+    requests:
+        memory: 512Mi
+    limits:
+        memory: 2Gi
+sops:
+    lastmodified: "2026-09-21T22:28:39Z"
+    mac: ENC[AES256_GCM,data:BR4P4s4C9n4bEHryqfHpzzFHxAlKeujFBO2Qhsc4qdkcI5dftJ7jrknWtW0uv1E2Aljp50Mx1Rk4wglaWh3MS/ZnY/1dUxCfKuXOGkv9+mymQxDk6zJLsUNTH7sMr5kzlVWfv3yzXF50HWuiNl71BAv4mtlrtarXS1KVQrCKNaA=,iv:aG9OxDOhwk7xYNbvESNMFnXIjKhbYNO0gvDn1a9QQvc=,tag:QxM3EX8V2KJzosRz5damrw==,type:str]
+    pgp:
+        - created_at: "2026-09-21T22:28:39Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ//cvlMqPSaED2y5dsq8H/W/dqYVOeG7E/ZOuJGaYnImrrp
+            V2W6vPTzQ8QuYTKa1X4aOIlda04n7i2kDQCvpszmdpsU2y0SWtsgOBbyloIU3cAM
+            69HGd1SNqP/FayeZy/hHNvvEjmsgKX/9IV1YBGOcikmd7MqoxgGRgIxXORzY0dBG
+            7oREwV0HubdIBG6Fi6HUyN+Pugftpcumfwtl8ppPUYi1HGKzL5LzIT6gfqXtUcBg
+            8Wl2f0kMZsat1e05sZZah41dg+BAlyDgCRFo/ZQIhzHi28rJkZWG2aZxQfvAFMYJ
+            hUkjVyN7rAO01b2PsXK3bleFjD8iL8PhHY/Rio0/Uizjub7inako2SUd38D7X+ce
+            M1c2GoDVNmwZyXg7jBzb67JxLPn4Ic1kbjUi/JJL22rDzN0pBf6J7ExCpVGxrwK8
+            ++YDD1m/rY3YA8/ioM+pTu3ktEd1zu0T1yFySjgtvX8QVmOkrG1AA8E/N3+pzFWP
+            9wrJJ+yp5CYQl9d3j5LQcOzmvROi0EHjeZY75IHw8NwkyWdnRgWFIPsXxVoSUhSk
+            909RE//BuKSSRd1r9D/4w14Eb9KC74bIsUIflyK2Qs/N3rh9+/O8FS/5saryq7Er
+            GO3oAmFqC2F4Y6zFlmXkr43gBFjCPWl0DxI3uUK/gcw8kBpLSJex3j2sDaLViS/S
+            XgFsDLAjHnEo5DC+xyJQI5xMWsQzx/ASNZdBVLrnYPsRt+YG7qfu3lKNS9ujAG7K
+            ti58fACtT97K8IrUMNyEDGieFz65TYPcie4qILnDt2Hkr6QUEdBR8rvn/8z36D8=
+            =47Rw
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
+    version: 3.10.2
@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: get-rhema
+resources:
+  - namespace.yaml
+  - repository.yaml
+  - release.yaml
+secretGenerator:
+  - name: get-rhema-values
+    files:
+      - values.yaml=values.yaml
+configurations:
+  - kustomizeconfig.yaml
@@ -0,0 +1,6 @@
+nameReference:
+- kind: Secret
+  version: v1
+  fieldSpecs:
+  - path: spec/valuesFrom/name
+    kind: HelmRelease
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: get-rhema
@@ -0,0 +1,21 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: get-rhema
+  namespace: get-rhema
+spec:
+  interval: 1m
+  chart:
+    spec:
+      sourceRef:
+        kind: HelmRepository
+        name: rhema-dist
+        namespace: get-rhema
+      chart: rhema-dist
+      # Same CI scheme as the other vhaudiquet charts: timestamped
+      # versions on main pushes, exact versions on v* tags.
+      version: '>=0.1.0-0'
+      interval: 1m
+  valuesFrom:
+    - kind: Secret
+      name: get-rhema-values
@@ -0,0 +1,11 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: rhema-dist
+  namespace: get-rhema
+spec:
+  interval: 1m
+  # Public org-scoped chart repository, same one CI publishes the
+  # rhema-dist chart to (from git.vhaudiquet.fr/vhaudiquet/rhema.rs).
+  # No auth, unlike the saggar org repo: the vhaudiquet org is public.
+  url: https://git.vhaudiquet.fr/api/packages/vhaudiquet/helm
@@ -0,0 +1,58 @@
+# get.rhema.rs, the rhema distribution (chart rhema-dist, repo
+# vhaudiquet/rhema.rs). One single-node Garage, one bucket, the
+# saggar-dist shape: the S3 API stays cluster-internal (chart default,
+# s3.ingress.enabled=false — release uploads come from the in-cluster
+# runners) and the bucket serves as a public read-only website.
+# The host MUST be <bucket>.<root domain> — Garage resolves the bucket
+# from the Host's first label — so bucket `get` on get.rhema.rs.
+bucket: get
+garage:
+    # Single-node store: skip the hourly self-sync cycles — while a
+    # full sync runs, S3 auth lookups transiently answer
+    # InvalidAccessKeyId (see get-saggar). Weekly.
+    fullSyncInterval: 604800
+web:
+    ingress:
+        className: traefik
+        host: get.rhema.rs
+        # TLS terminates at Caddy with the cert-manager get.rhema.rs
+        # cert; Caddy proxies to Traefik by host, so no tls block here.
+        tls:
+            enabled: false
+# The write surface, public via Caddy: the release runners reach the
+# S3 API by host (the in-cluster Service name does not resolve from
+# them). TLS terminates at Caddy, like the web face.
+s3:
+    ingress:
+        enabled: true
+        className: traefik
+        host: s3.rhema.rs
+        tls:
+            enabled: false
+            secretName: ""
+sops:
+    lastmodified: "2026-10-16T06:56:14Z"
+    mac: ENC[AES256_GCM,data:XuFKJcXb2C22x1GaADmX+QwQNAeUiYsmSh4g0Z5CTyvIXSI5gksAVKNgF0RqRNDLDmDA1jGCS+a0Y//ExXZO1kKQj2jYdYcKU4IvOmniMiwut5ZtobFbuskv7boAxmNRT/Y/4RgyyT8+45b/2+u3i9u2cwSQQ0Itvh5PxpFlE+I=,iv:3qXS6rEkeodOwLt5AOx8atfr15fK1zpmkM8uKjxUB2w=,tag:1Y78Jq8E44IGukCpR99UwA==,type:str]
+    pgp:
+        - created_at: "2026-10-16T06:56:14Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ/+KleFpAm4wpwoyB8U15o27ys2KXyKNFUl0EeRhYBYjcqe
+            wgtiayZjGbM0Tz2x9+SFLQhezldMlH8N5l0BscuYBMAUgDXS9OMN+v/1nHk0pu43
+            FUYHEWbYmYgngzGKuQhdrGEEtNBH12oKcBVwIPG7zaTfAlhfZIq/xsh6QyfTZX36
+            mSzUsshYPmqUM+RymH/PrJjpWz15XBdFUiY59+hNa9kqjalyTg0gijuu6JkKbYTK
+            SnFd2i9Ud/meniC4oBlLyOc0PX1/uyeIY1SFbGHdwBcHCFdIzMow2fZWLzimsNyB
+            GIO31PbyhG3ZCb2cOzYC0XqJUdP6lHbAyDBDiGWu+dBupDb8d96XeaIF0cTgOjxJ
+            0FrDMk1OAc1HjnhGo4QrEPMT0vMJmRDcDWXp60pFycRIrjGyXItMqkW06Xlr5HvF
+            OM8q3gjz6s7/Yi80EHKyFEHsvLl8jw2OXYhSiUEy6mSfii5k4Hhs2PBJFKcxLqZA
+            tH0caDA4zJia8FdlaTHI9OE33TvP/9uxvY9kBJUaeMdLxCo4T0keOiam2b0K/H8N
+            owIhdVJmXtsAFiw+t7KKZku9kQtkav8hEn1G++VQXL/XUjxvv3CewDq9cbNW7aIU
+            byjUf4jPR+kI4TeyR01YMDP2+O5Ld0/NxlCKqF10w8KVs1OsWFBagC7I4iPy99XS
+            XAEWw3W3SSGkz+9t2cqmXTxCPIvU0ANjkz8PoNAfx9HC3UWk3So1MGht0FDR9QVZ
+            AOzPM4U43wnYrTp1sq4N9Xh7xU2m2e7iUt/g2dtRFvx0vv2qMt4ianqzYiB0
+            =1619
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
+    version: 3.10.2
@@ -0,0 +1,14 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: get-saggar
+resources:
+  - namespace.yaml
+  - packages-auth-secret.yaml
+  - repository.yaml
+  - release.yaml
+secretGenerator:
+  - name: get-saggar-values
+    files:
+      - values.yaml=values.yaml
+configurations:
+  - kustomizeconfig.yaml
@@ -0,0 +1,6 @@
+nameReference:
+- kind: Secret
+  version: v1
+  fieldSpecs:
+  - path: spec/valuesFrom/name
+    kind: HelmRelease
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+    name: get-saggar
@@ -0,0 +1,38 @@
+# Basic auth for the private Gitea Helm repository (org `saggar`) —
+# same token as the saggar release's packages-auth-secret.yaml. The
+# pre-commit sops hook encrypts this file (name matches *secret.yaml).
+apiVersion: v1
+kind: Secret
+metadata:
+    name: saggar-packages-auth
+    namespace: get-saggar
+type: Opaque
+stringData:
+    username: ENC[AES256_GCM,data:bQ8HUwCqCEIWKQ==,iv:FFcNqBTrA2xJCD2EUf2k+8f1+8DZC9r7Z14Qns0TjH8=,tag:aKWUHSP+8yjbewr/vt3z8w==,type:str]
+    password: ENC[AES256_GCM,data:bfiHI6tHwtK1qYf9UdAplb5qNE7fceQDjUim3KlWU/sb4Q5mvqK6CQ==,iv:ZtRNqfWZLT1lSd/N9MGwKrRiTtKDBUBZUR1LUy00G40=,tag:f55oMGmPHQB8zMNWtChp+w==,type:str]
+sops:
+    lastmodified: "2026-10-04T21:14:09Z"
+    mac: ENC[AES256_GCM,data:pbOlIPfHMwbwyBHlwkTYwWSeWD2jxud2zlNYMDyYJmKRpUuf0/erqRUusTrVGUnOG1t7omu+hQycPC3im6v8mi0vECBlkVG3knQa46bnVH9m1qa7lVChuP53TLYZogrOA8Ol9omrLsUsdcPNJfwXTYS/HHkY+ujECnjCWiVoXUs=,iv:Al2lU2xt1Hvv1BokoOx5e1gOlJhxzMJNyyCosmlGDV0=,tag:OxMxotEvYI06Fjjwst++gA==,type:str]
+    pgp:
+        - created_at: "2026-10-04T21:14:09Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiARAAgsXy5zMBbREVADgr2VVGgev6fHJUXq6DKCRhQdH1nsrI
+            xbSN1HZ2UbQjCYCjZl8NdVo3KGhJJ1uQGABAq6ZE+C4ZaMWvfjEO0/CnHmui8LkL
+            YXvJWWKvP/DDcmLXYxgwP8u/EWtn1bgXN7HeHxYb9JtGEf7XBlS9a6InWDmreabF
+            lSGkl79NgWDIngNQwTvby76uVARSAj3TkIxO6f4cVx+2f/c7KvWvX9D5vjrz8dpk
+            tPFdIhsCHdQS2wf2G3fEp4Yb8WnTEgu/HQ/amYwBAplhv3aaFQ0WVxCB91amnJyw
+            4Hnkcim4e/ZTmlBms/iQMFo+NhcHebRYcganIid23U8j4RfptwbuxED/txDEAAbj
+            lrgpknUXDG9RRRFTZfViYVJ4KWNduuUmVX4URYtn9d42BEXlXwx+Cd7FV40mlM8F
+            aT87F8G3IVexcKqLV15RngswCaCNJOnIT1vNNz18hz6sz8qXCzDwKIsS02wzkchz
+            1E8pi4grh2UkJT/F+mHUnze3ADOIZu6c2+SUwswVi+zAQg566dgFMYfKWc7icbvz
+            AWJ0hatHKNC4utZ2C0sCrM/34M0J507UMjlGKY9FUQ7wnHubPMfrum/FBNH1X7jM
+            F+iWsZ4N+kBnpY1Vf64S+97/Nqg5NZ3IBHWyqaSsWmR/h9628XDAa7kUpIsPK2LS
+            XgEGwyBsqJOWaYa7pXhIuul+1iNTJJ5FhU9qFQci708gund3RSvGJLtUIGlwSLUn
+            qzSSfl8vWujLNj9Pb0FcegVTYAq4eA59rJFILjyRZ64TaIfPBYxdFSD8t4zcWQQ=
+            =oHWG
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
+    version: 3.10.2
@@ -0,0 +1,21 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+    name: get-saggar
+    namespace: get-saggar
+spec:
+    interval: 1m
+    chart:
+        spec:
+            sourceRef:
+                kind: HelmRepository
+                name: saggar
+                namespace: get-saggar
+            chart: saggar-dist
+            # Same CI scheme as the other saggar charts: timestamped
+            # versions on main pushes, exact versions on v* tags.
+            version: '>=0.1.0-0'
+            interval: 1m
+    valuesFrom:
+        - kind: Secret
+          name: get-saggar-values
@@ -0,0 +1,13 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+    name: saggar
+    namespace: get-saggar
+spec:
+    interval: 1m
+    # The org-scoped chart repository CI publishes to — namespace-
+    # scoped like every app, so this release carries its own copy of
+    # the repo and its auth secret.
+    url: https://git.vhaudiquet.fr/api/packages/saggar/helm
+    secretRef:
+        name: saggar-packages-auth
@@ -0,0 +1,50 @@
+# Chart: https://git.vhaudiquet.fr/saggar/saggar (chart/saggar-dist).
+# One single-node Garage, one bucket: the S3 API stays cluster-
+# internal (chart default — the publish workflow uploads from the
+# in-cluster runners, s3.ingress.enabled=false) and the bucket serves
+# as a public read-only website. The host MUST be <bucket>.<root
+# domain> — Garage resolves the bucket from the Host's first label —
+# so bucket `get` on get.saggar.dev.
+bucket: get
+garage:
+    # Single-node store: skip the hourly self-sync cycles — while a
+    # full sync runs, S3 auth lookups transiently answer
+    # InvalidAccessKeyId, which is what kept failing the edge job's
+    # prune step. Weekly.
+    fullSyncInterval: 604800
+web:
+    ingress:
+        className: traefik
+        host: get.saggar.dev
+        # TLS terminates at Caddy with the cert-manager saggar.dev
+        # certs; Caddy proxies to Traefik by host, so no tls block
+        # here (same as the other saggar hosts).
+        tls:
+            enabled: false
+sops:
+    lastmodified: "2026-10-06T04:20:10Z"
+    mac: ENC[AES256_GCM,data:ncXYOdUYTaYikkKWVUzWinakZVV7tjja31QIo/xhibZ8Jc9L/dl9U8//xJ95Hlb9uuMJvUHvk78KmH2mYVQhfhyNwkNZXvK3o3azx+WWQYaZebEudRbXdHO6gyywcoywlEFuaVWjVsTpggz2VtlNwP/tqLCf41uTUJB4NZi12uU=,iv:uj13/y/iGeoyqgnx74wh1Pzb01NupeLW55qBhCBNleM=,tag:PGmmMZCw49wt8RmpJH1CzQ==,type:str]
+    pgp:
+        - created_at: "2026-10-06T04:20:10Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ/+MH/izXRcAzwF1Dp5mgQBthTFYX01sUpjU9y5Z9jeRnny
+            UgtCuURwaI41nG+ZOrv3yy2dSsgABMgr8nZZEju/Tb+jZ/qzkPR8JWTpiieXefH4
+            Q5lEy6l1rLVOJudsgx7BG07h6gqr0Mu89gcpFThkXiCo5eAV/hlY9Y6eG6ZybWZ/
+            K2bUv8JB09S8ZsuFsTqp87lZMogWFcIjO8JMirjWRxgd+1NZFoGmSIb+6KkLTD2+
+            eMjbLnGZ3HyWLSzJBRkF5bGgODNGA8qaHmKKMTT8/H9zD1Z++nKCrx7SQpoStQxw
+            xluXAyefTiwCqhEVT42C68Lhz5pH6AyHgJGmls/NWv6bvj/3AQwXlkO87Xkd8x3L
+            aEDHIc5rEso18IZuNzlI193AEhipT8mcMi8IFA4YbnVnkK86PSXQ7qWrbbc4BmkN
+            cU/vUlpBM1HeiYdTFZf8Dvfw55bNn/pMhPhoLWpHjAnAEDJdrVh33OTurdmtYTRW
+            nRK3q2WVHa+UGlkKfdpKr1ivZ9O4ulSfyIYKVsLI5sYAbkJ4o6ytlcQlK6E/7AEK
+            Ux/KAnTb5nXOLN8Vbq0xGlyjYei0GY+IZWkkWL80k59NFfrDLXtG/zCxE74ANplm
+            qx+dCbggjT2lNsM+homldhYU0VhDnvrWM1/9bRI3DUVUxfGUCKMTqUj2b97vLGDS
+            XgHGOTHKKTQjpEg7DnnSS/romTxglHrAEa/3Cu4S4uUVIK7aL8JIoHXYaHho6Jp1
+            9RpCscjyeMfE/wnyTbeR1OZ6wnIMuLXzVzma0fy0fbYqGhJllULpMgsZGe6bhpI=
+            =MIya
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
+    version: 3.10.2
@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: rhema-site
+resources:
+  - namespace.yaml
+  - repository.yaml
+  - release.yaml
+secretGenerator:
+  - name: rhema-site-values
+    files:
+      - values.yaml=values.yaml
+configurations:
+  - kustomizeconfig.yaml
@@ -0,0 +1,6 @@
+nameReference:
+- kind: Secret
+  version: v1
+  fieldSpecs:
+  - path: spec/valuesFrom/name
+    kind: HelmRelease
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+  name: rhema-site
@@ -0,0 +1,21 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+  name: rhema-site
+  namespace: rhema-site
+spec:
+  interval: 1m
+  chart:
+    spec:
+      sourceRef:
+        kind: HelmRepository
+        name: rhema-site
+        namespace: rhema-site
+      chart: rhema-site
+      # Same CI scheme as the other vhaudiquet charts: timestamped
+      # versions on main pushes, exact versions on v* tags.
+      version: '>=0.1.0-0'
+      interval: 1m
+  valuesFrom:
+    - kind: Secret
+      name: rhema-site-values
@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+  name: rhema-site
+  namespace: rhema-site
+spec:
+  interval: 1m
+  # Public org-scoped chart repository, same one CI publishes the
+  # rhema-site chart to (from git.vhaudiquet.fr/vhaudiquet/rhema.rs).
+  url: https://git.vhaudiquet.fr/api/packages/vhaudiquet/helm
@@ -0,0 +1,42 @@
+# rhema.rs, the static landing/download site (chart rhema-site, repo
+# vhaudiquet/rhema.rs). One stateless nginx Deployment.
+# TLS terminates at Caddy with the cert-manager rhema.rs certs; Caddy
+# proxies to Traefik by host, so the ingress stays plain HTTP (same
+# shape as every other public site here).
+replicaCount: 1
+ingress:
+    enabled: true
+    className: traefik
+    siteHost: rhema.rs
+    # www redirects to the apex inside nginx, so it rides the same
+    # service; only the host name differs.
+    wwwHost: www.rhema.rs
+    tls:
+        enabled: false
+sops:
+    lastmodified: "2026-10-15T20:28:50Z"
+    mac: ENC[AES256_GCM,data:jDNsyWKl2WhofVTzlgevHuPoLZUrLTW87Wd+dLv3nWEFWfN3G8fy0IKGbns1NpFyhx/OfqDJjlmDeZyt4dfmRUPC3Y1MI3kd4KUGlKf0lPy94MTJog7DZtVGtS0RUCN7/NevqtopIivj38u1dXjdcRI+F8bL91blf+RHvvvGOe8=,iv:pmVYVtNhczWqk8CLrAP2McUTrn8uTE88LC9oKtYQzf4=,tag:s+TXQDFqipQtfkE/BN2ASA==,type:str]
+    pgp:
+        - created_at: "2026-10-15T20:28:50Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ//df2F/yV6AzsAeDXunqgf016/km+/O8b37+WSaoB7UHb0
+            f/3lqxoVD9EWaTLum1pwHbhauDrjsOyyqkmIbEeOdnMQjEhDvnjfkDbTDupwl7Qg
+            m95ozoUsprhlqEu61ANhAx5xOHfelV5hkL5+ef9o3o0Ist2T8uBv/v+KxnbCHwmQ
+            e2/rjZ9BF8JgnhYVN3VKnpCgz2k9DVAdIZ4saeaET71MCK2naaO8BcVOH86H2Kn6
+            croIE0V/RNPBL3V0PDF804jRIPwfwd0sQiSwwpo11a/9Zgfwj2PDft1FPFyRv7Yt
+            iy5RaJ8rY8C2AqxRj1V0QIp6SyT784yhW02//8zZOA3Mcs9RUJfBosbqQDb3KIPx
+            MMNNgA1/Fa+7VWI7UX6/24tg2m7MPSCRLvzZMWzriKvcKQj/A0fn4pgcQfQ5wqnm
+            v/VrdLL8PBfy2dkYAsBvx4mAt11sOPwoT0iFhxInLNGeGsteJ5/texgLmJ/uO6vx
+            jJLJT8izFKqZKJCK5Db/Qx8RuiuGysaS3NiWVKfdWrwlbNsMKeRFMEaEAfKjPOPG
+            +1WQcvi+jHfCWsjimxW2+Cs90ZIUY3lbGLuQWhFj8zynQt5rehCZzqjmtx6MbHRT
+            GdDZm62Ox1sdMq1ZwMVElWelyNSTtPNN53DcEEiTGqaSwJjdLz9WZhcjMl0vE5rS
+            XAGm3AzBcPNFtWEODV1AyXwOUPea5RJ7ZNOOPy7jTrV0sZwJ8TAc67VP9IW8n1CM
+            22ri2Xq2qDidxsCKiQeaF77DN2YhBYJnxhvfeplVcKGyqb/EElDznR/fprDR
+            =IpGk
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml|token)$
+    mac_only_encrypted: true
+    version: 3.10.2
@@ -0,0 +1,40 @@
+# Gitea OIDC client credentials for the saggar login provider — the
+# OAuth2 application registered on git.vhaudiquet.fr (Profile →
+# Applications → OAuth2), with redirect URI
+#   https://saggar.dev/auth/callback/gitea
+#
+apiVersion: v1
+kind: Secret
+metadata:
+    name: saggar-gitea-oidc
+    namespace: saggar
+type: Opaque
+stringData:
+    client-id: ENC[AES256_GCM,data:8NHXVbeLNBbFfxtVDk8AtbBWnjpwMWlihjqoEFSJmCDH3Cjz,iv:3PqTABU6ZxNEm0jshvDEkKbSHpdqf2/7DzVVjx/cXVA=,tag:YYuNIQU4nsNxVWZA2WVVbw==,type:str]
+    client-secret: ENC[AES256_GCM,data:WiqVhGyNHyeVQY9bX2qkvcaiasejyUUyNXBN4kTKl+TfP8vsedex0U8Va5Ns+9KW/Uget3+kH/o=,iv:K1zLz8am7Vox5IZc5zSDSEeDu9t6R5swEeeqTRrnZdo=,tag:OEbZAqNBkgpX/RdvH5Tb8g==,type:str]
+sops:
+    lastmodified: "2026-09-30T20:30:47Z"
+    mac: ENC[AES256_GCM,data:MKm2CMBDtNL2GzO2pvmX7WLcTYNap9Xh/loBjZESkHbS65V2QpNU4+yTXcDewyDld9q2zKock1kPRQbhSyptlpxRQN6WZ+LhenS3f6p7rjPq+6gquNJ9j6ccgMFKvBKXoitYsbvfdpp6F6FN8vj24aH6OmTO2gUuvsdj7LIF1bI=,iv:20tkg9yg1kPeo2tbNbXNKNWXAbUqL352NV3+HOCqnqQ=,tag:35vyPxiRTUPuQkxy1/zD0Q==,type:str]
+    pgp:
+        - created_at: "2026-09-30T20:30:47Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ/+INz4B5GdyNfaR4b6DXha7chZN3Qh+nh8oRduzFGKak76
+            C3fANw2+HJ4/eV/j1ImNMbON0v7fbPpEe417nkRPESxnkEONi2Rrt0qoCVtnI64u
+            isewcMXEJCvTqAa460lE5AIC3tMjfYZd7h3tUe9N7HL3ufOB7hDVflGq954Zo+qu
+            rwGH5RZ5s4B5xnW6upVia+TRpu907ibpCKSfzm2uH6CRSIuuvIZrhu/qMnEUaa9F
+            9SEEr87orU7YhYltPmK6k3oFaZLbXNsIYCLl7AIeMA3ZlvKKwk4HkTxYU5BUsAK9
+            Zhv7yWIFyhTLVOv2k1dbOym3aRGe2KA/+LGHn0bi9ps2A5Vf6rSIQ1v2ya+OVCmw
+            Ibofs6/pfI1sZ56pOo1BGv0e6hBTe+jzimtBrTSAuCytDcTDmWusnH3HU8EefanN
+            96Dw1NMCVqYn+yl8CL9UPMOL4UT+CDJEbWVBjfVvsoeaER+ipPbspo9eRZypq7D7
+            aOWrP9Uiig/PeLt4ZMpsTWM27/tsVy2CPEFQ+XlgandVLQ6qTUQK42oAtepDSWuP
+            z8b12dkZ+xraI/wPqlrf6fXU+oKU2KteZxiMn89KqEgTbMp+BGycDHsKLA7VE+uz
+            Ni97MN8fbkT85VgwGE95xvUDGMMGyQuJrKbwc6gXzHQoCzZ/RfPBSUeXM4iyAa3S
+            XgGXEdIV02aQjl+kOqXu1VZLDVnb46fXTA5GDU51HKHeyT6YoE3rNljdFp2/hub/
+            rYX5lJ4j8XXo6s9xUQ3BEw3JMbrc0++SrIXGk3Hqid3Ez+cBm3Q/wqF3YpF5tIs=
+            =GpPh
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
+    version: 3.10.2
@@ -0,0 +1,15 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: saggar
+resources:
+  - namespace.yaml
+  - packages-auth-secret.yaml
+  - gitea-oidc-secret.yaml
+  - repository.yaml
+  - release.yaml
+secretGenerator:
+  - name: saggar-values
+    files:
+      - values.yaml=values.yaml
+configurations:
+  - kustomizeconfig.yaml
@@ -0,0 +1,6 @@
+nameReference:
+- kind: Secret
+  version: v1
+  fieldSpecs:
+  - path: spec/valuesFrom/name
+    kind: HelmRelease
@@ -0,0 +1,4 @@
+apiVersion: v1
+kind: Namespace
+metadata:
+    name: saggar
@@ -0,0 +1,38 @@
+# Basic auth for the private Gitea Helm repository (org `saggar`) —
+# the same access token also goes into values.yaml's imageCredentials
+# for the container pulls (the chart renders the imagePullSecret).
+apiVersion: v1
+kind: Secret
+metadata:
+    name: saggar-packages-auth
+    namespace: saggar
+type: Opaque
+stringData:
+    username: ENC[AES256_GCM,data:gQXori8DR18jnw==,iv:X1rqJ3gTlIdY6qDYYDLjW+r+/PZVvVvZJaHuRflA50k=,tag:QOLVAuGO/deRAxwelHq3jA==,type:str]
+    password: ENC[AES256_GCM,data:aGrzZOtE7PeFXB8ybbAGgVdstb6De7ha/GARPyXP8nxP/tv542d3YQ==,iv:ngBYMmLVtG/5Au5txvzM25LOT2FswrAHP7LMRth2yek=,tag:+uKN2Zjl/ueYIHrXvWBTaA==,type:str]
+sops:
+    lastmodified: "2026-09-30T20:30:48Z"
+    mac: ENC[AES256_GCM,data:G5Z0s30VsnEsvCVQin/fNg8n2UamvhDv4TMOzvBWXXjW5b43aXdzbQ++x3AetBCgocuTkAXqoPmpYG5f0DVH3n+55lqeE3ChtUlkb0S3zJPZ1jna5rNqKHMFuI8nItyxowAVVKJ06tscRCPlvwRcYWuTGEep0Lq7fSgt6BR/7TQ=,iv:x0uJXcRo8CDjzd4msHMBwloATMryQxmo3eGpzBhzn80=,tag:AwI4lslApzy0wyJgRcYdLg==,type:str]
+    pgp:
+        - created_at: "2026-09-30T20:30:47Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiARAAsQDZ1Uan1oGs6/mBJ9RvdMWH7fhCJfIWXv9Ldljn9lFv
+            Cp7ygWA9xgmUW2emtybn28s6uNr4kEH5/x5+0BIIVAmb/LKWi40bQKhSuaWKEgZf
+            OmZMNRilgwKFODbfif7UzsjKmogJ5DBFZqiJXP9uFSbF8klH4HSbJcKHR9jCjiM8
+            cnWcpZ4xPaPxV7ARC8vKh3jvC7Eh6ivjEhJJSUQTt7w4ucs2e07n2WrCLAQDtu4m
+            xzVMDV6y2Far3Rv3Lk5O+FRprmpIKhGwU5nfEFighj7K8/ynZDUEsE5EUtuxDw1p
+            BBFFAsuNf4J+qVctfCFwEr2PTsT1VU0jKcB6t9lJZE3aT2xu9mu1Ezn9m/YGWzp2
+            airb4UVACWLXj9sqcv7YIG8aUHpm7qVm8AE5UF1OhNJbDCQbpUEklGNRV3N0R4nr
+            ehatG1fCLUmXj7CUHdLmfGkhahfUIl2SJAp42h9VdQN8NB8Plj4j+hzluZSqU8XS
+            KP7kdIbDheeqZvSxA4KAeXrvvUzOWp4VK6ClL9pVjEh5HTu38atFGQ99daILy95L
+            f2z4l1Gc73+zRCHWPKtz5SiPT/G4RlxL2lrgKnykfpOCbJ7wV+XC5kAi+Lj8BM7s
+            EB2bqYewal8k2+VVFGD8vzyB/0mV2i37AJFJ8uJTU09D0CKGpDlgrFw1D3YkwA/S
+            XgGxHYtmARZxCBEbCeizPE4nk+UZtvVtngPUKABPe5euwX40kOwy81dadjoIZsks
+            Vev3d9txiEO6QKcx5rTEp7uju9QO8meqWIM97f0dB1hj1l+tRwmo91XJVKBRgFQ=
+            =ZysC
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(data|stringData|.*key|.*crt)$
+    version: 3.10.2
@@ -0,0 +1,19 @@
+apiVersion: helm.toolkit.fluxcd.io/v2
+kind: HelmRelease
+metadata:
+    name: saggar
+    namespace: saggar
+spec:
+    interval: 1m
+    chart:
+        spec:
+            sourceRef:
+                kind: HelmRepository
+                name: saggar
+                namespace: saggar
+            chart: saggar-hub
+            version: '>=0.2.0-0'
+            interval: 1m
+    valuesFrom:
+        - kind: Secret
+          name: saggar-values
@@ -0,0 +1,10 @@
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: HelmRepository
+metadata:
+    name: saggar
+    namespace: saggar
+spec:
+    interval: 1m
+    url: https://git.vhaudiquet.fr/api/packages/saggar/helm
+    secretRef:
+        name: saggar-packages-auth
@@ -0,0 +1,105 @@
+# Hub mode (the chart default): intake + registries + web UI, with
+# artifacts in the release's embedded Garage store (chart default in
+# hub mode, longhorn-backed). Builds happen on runners from the
+# saggar-worker chart, to be paired against this hub once it is up.
+image:
+    repository: git.vhaudiquet.fr/saggar/saggar
+    # Empty: follows the chart's appVersion — the commit SHA CI stamped
+    # on the pushed images.
+    tag: ""
+# Private Gitea registry: the chart renders an imagePullSecret from
+# these. Same access token as packages-auth-secret.yaml (the
+# pre-commit sops hook encrypts this file).
+imageCredentials:
+    create: true
+    registry: git.vhaudiquet.fr
+    username: ENC[AES256_GCM,data:Kb01bICyN/BvDQ==,iv:o19woAl9Hqlouo3fgmj6fesiix1bo6fPRcZdE3W55bk=,tag:LzBjc/dOaFv1yUblzAmFBQ==,type:str]
+    password: ENC[AES256_GCM,data:Phft0J0kFY71+icAEP2OuwGOfkNwMv64Yd0mWJkgVXWEJRyczAorZg==,iv:SeM4FVIwAqXxT9P6uUyftehk/eL3Y2JY1beGbruO0mM=,tag:Dezoea9JnN49laU0q+H3Bg==,type:str]
+# Login via the home Gitea: the engine is the confidential client of
+# the provider and runs every code exchange, so its discovery drives
+# the endpoints (issuer verified live). Credentials live in
+# gitea-oidc-secret.yaml — both ride the Secret (clientIdKey opts the
+# id in too), so nothing sensitive renders into the ConfigMap. The UI
+# needs nothing: it discovers the provider from the engine's open
+# /auth/methods.
+auth:
+    # The web origin the device login names: `saggar login` prints the
+    # confirmation page under it (saggar.dev/device).
+    uiUrl: https://saggar.dev
+    providers:
+        - name: gitea
+          issuer: https://git.vhaudiquet.fr
+          existingSecret: ENC[AES256_GCM,data:hqjfc89icY+3fOSMzh0xJ0Q=,iv:K+g5gpi8vcBpw6buktSZlePj9p4TGRV6bxuvSrFx2i0=,tag:FljiBjxAFrQON4J4iqk50w==,type:str]
+          clientIdKey: client-id
+          clientSecretKey: ENC[AES256_GCM,data:b01cCxpLg9d8ECChUQ==,iv:IMU1G+3hEyqS6jU7eWpgvQE7/ndLbH5gkbydFisCQeM=,tag:xs0ehG08oU15/N1hN9AHug==,type:str]
+storage:
+    garage:
+        # Single-node store: skip the hourly self-sync cycles — while a
+        # full sync runs, S3 auth lookups transiently answer
+        # InvalidAccessKeyId. Weekly.
+        fullSyncInterval: 604800
+ingress:
+    enabled: true
+    className: traefik
+    # The engine host: CLI intake + the docker/apt registry front-ends.
+    host: api.saggar.dev
+    # The chart's default annotations are nginx-specific (SSE
+    # buffering); traefik streams unbuffered by default, so clear them.
+    annotations: {}
+    # TLS terminates at Caddy with the cert-manager saggar.dev certs;
+    # Caddy proxies to Traefik by host, so no tls block here (same as
+    # pkgatlas's ingress).
+    tls:
+        enabled: false
+ui:
+    # Sign-in redirect base — the UI's own public origin.
+    publicBaseUrl: https://saggar.dev
+    # The engine's public origin for the docker pull / apt usage lines.
+    # Set explicitly: the chart derives it from the hub ingress, whose
+    # tls is off here (Caddy terminates) — that would render http://.
+    apiPublicOrigin: https://api.saggar.dev
+    ingress:
+        enabled: true
+        className: traefik
+        # The UI lives on its own host: the engine mounts its API and
+        # registry surfaces at root (/v2, /apt, /nodes), paths the UI
+        # pages also use.
+        host: saggar.dev
+        annotations: {}
+        tls:
+            enabled: false
+docs:
+    # The chart deploys the book by default; the ingress renders as
+    # soon as a host is set (no enabled knob).
+    ingress:
+        className: traefik
+        host: docs.saggar.dev
+        tls:
+            enabled: false
+sops:
+    lastmodified: "2026-10-06T04:20:10Z"
+    mac: ENC[AES256_GCM,data:ztx2M4srmnZs9S86xWOYSkePbi9Gm1n0FIB9oBmiaEn5fzSmPLbbn8IPcRsU+zOjkg5DRZ4LbuNdtmxynTC20yCHpb2vZbIUFiQarxPizI9lcKZyyOXFjoECXYZ5oDEOkAPrvYWTduqvK5o9dsUmebtKCSh9EMVMD47nF76yr68=,iv:Y2DjchwTfIjWMDGfQNwXCxM7MG6iNwU6LHf276osNjM=,tag:oviToaqWMdl1/cDgYX9M7g==,type:str]
+    pgp:
+        - created_at: "2026-10-06T04:20:10Z"
+          enc: |-
+            -----BEGIN PGP MESSAGE-----
+
+            hQIMA7uy4qQr71wiAQ//Sgir+7MRZYnuxGArDmyeP57A3xL6F77pLZbNIOjQ6KcK
+            3Giga+m3n2BodCDVzL6bUOtUbtgBVyqD7SSBY4qQ2a9c/H4xBAO0HciDth4O1Wer
+            z8fKSphk7tt1yBtzuB1tm0F9Ye53tLaetACXRGGo83jCGse8J0d4+vimra45fjyn
+            9JEnCl0+A2AMMl9/hcfCj8iSj+VeiCJz35Zmo+BWl0KrY0DHAeEyBEtI7O+z8bFF
+            9oGZY/xhTVD4IkbOqXs1fatTmybyzxrTBz/I7d9QOnPx7N08rb/g3KspkCPDSptH
+            h/AnDGg0PDVs7WK0eMwFMsZ8gvEYI76ecf6mAO5x6TbpxVHCPXpbbBTC7ro7usB0
+            4jVLrALMtsMn8k45JWFGR3OsujPr1D+yGmsJ2Mqde4AtjE6zTs8TurwuDEY0ivYg
+            HvAKk6C+ZOmdQEMep2kznSovMx0m6FP8Muv0ORX+pMNOIRhUFbEAXT+s7J7YoLlf
+            Rza/lf4VgsWtTUyUZRTH3G2NTwEgBo4GsV6bM07OhN0GEgMH1hOuGo61C+e2d6PR
+            NqeRgvlzfmeoTUBwgNv023739hyB2xDVesr5jo/yomikxFiz0wGUBQ4eRZmRZSjD
+            ZCLoiv+2ymROgWzGqgutRiRD150P45biMs3zW/x3qGP/SiTj35OYyCzMjQb/ZRjS
+            XgGHEtiiRWv954k5eXRF3DOHxrZ/oxtjyc4+EjlS3VsgtOCjePSzKg/WQa8Zx3ns
+            MT2BKgtlFwM2eG5V7jHfHOmAuVIuH249iyER5AJDzot/0kAO7ekH/y72kfloDKk=
+            =3vCq
+            -----END PGP MESSAGE-----
+          fp: DC6910268E657FF70BA7EC289974494E76938DDC
+    encrypted_regex: ^(password|value|ssh-key|api-key|user|username|privateKey|clientSecret|clientId|apiKey|extraArgs.*|.*Secret.*|extraEnvVars|.*SECRET.*|.*secret.*|key|.*Password|.*PASS|.*SOCIALACCOUNT_PROVIDERS|.*\.ya?ml)$
+    mac_only_encrypted: true
+    version: 3.10.2
@@ -8,3 +8,4 @@ spec:
  - cidr: "10.2.2.4/32"
  - cidr: "10.2.2.5/32"
  - cidr: "10.2.2.6/32"
+  - cidr: "10.2.2.7/32"
@@ -15,6 +15,7 @@ spec:
  dependsOn:
    - name: cert-manager
    - name: cert-manager-webhook-ovh
+    - name: cert-manager-webhook-porkbun
  decryption:
    provider: sops
    secretRef:
@@ -0,0 +1,20 @@
+# Flux Kustomization for cert-manager-webhook-porkbun
+# Depends on cert-manager being fully operational (CRDs installed)
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: cert-manager-webhook-porkbun
+  namespace: flux-system
+spec:
+  interval: 10m
+  prune: true
+  sourceRef:
+    kind: GitRepository
+    name: homeprod
+  path: ./kubernetes/infrastructure/cert-manager-webhook-porkbun
+  dependsOn:
+    - name: cert-manager
+  decryption:
+    provider: sops
+    secretRef:
+      name: flux-sops
@@ -6,6 +6,7 @@ resources:
  - webhook.yaml
  - cert-manager.yaml
  - cert-manager-webhook-ovh.yaml
+  - cert-manager-webhook-porkbun.yaml
  - cert-manager-issuer.yaml
  - caddy-certificates.yaml
  - stalwart-certificates.yaml
@@ -80,13 +80,13 @@ spec:
                - longhorn-system
              selector:
                matchLabels:
-                  app: instance-manager
+                  longhorn.io/component: instance-manager
          - resources:
              namespaces:
                - longhorn-system
              selector:
                matchLabels:
-                  app: engine-image
+                  longhorn.io/component: engine-image
      mutate:
        # `request.object` is available in BOTH admission and background modes:
        # the backgroundController synthesizes an admission-like request for
@@ -12,7 +12,7 @@ spec:
        name: kyverno
        namespace: kyverno
      chart: kyverno
-      version: '3.9.0'
+      version: '3.9.1'
      interval: 5m
  # Minimal footprint for a single-node cluster:
  #  - admissionReports disabled (no extra Redis/Postgres)
Author	SHA1	Message	Date
renovate[bot]	d09c7d7531	chore(docker): bump docker.io/library/redis Docker tag to v8.10.3	2026-10-31 05:01:16 +00:00
vhaudiquet	f44a4e7d76	Revert "revert: restore caddy values to the last working state (s3 mount pending rework)" This reverts commit `bdfc374f08`.	2026-10-16 09:20:37 +02:00
vhaudiquet	bdfc374f08	revert: restore caddy values to the last working state (s3 mount pending rework)	2026-10-16 09:09:28 +02:00
vhaudiquet	bd3143065c	feat(caddy): mount the s3.rhema.rs certificate	2026-10-16 09:06:11 +02:00
vhaudiquet	e33b82671a	revert: restore the caddy values gutted by a bad s3 volume edit	2026-10-16 09:04:31 +02:00
vhaudiquet	844c8f8abe	fix(caddy): the s3 certificate volume references its secret	2026-10-16 09:03:55 +02:00
vhaudiquet	93054f962a	feat(caddy): mount the s3.rhema.rs certificate	2026-10-16 09:01:46 +02:00
vhaudiquet	9aeecee770	feat(get-rhema): expose the S3 API publicly for release uploads The release runners cannot resolve the in-cluster Service name, so the binary uploads died on DNS. s3.rhema.rs fronts the same Garage through Caddy and Traefik, with its own certificate, matching the web face's shape (Caddy terminates, Traefik routes, bucket by path).	2026-10-16 08:56:34 +02:00
vhaudiquet	9d53dd0fc6	rhema(kube): deploy rhema.rs and get.rhema.rs	2026-10-15 22:32:14 +02:00
vhaudiquet	5058982605	dns: manage rhema.rs via cloudflare	2026-10-15 22:28:50 +02:00
vhaudiquet	bb443f3311	kyverno-policies(kube): exclude longhorn instance-manager pods from cpu stripping The longhorn instance-manager and engine-image pods carry longhorn.io/component labels, not app, so the exclusions never matched. Kyverno stripped their cpu requests at admission, longhorn-manager saw a spec mismatch and deleted the pod in a loop, and after any node reboot all longhorn volumes stayed detached with every workload stuck in ContainerCreating. Match the real labels instead.	2026-10-14 17:43:14 +02:00
renovate[bot]andvhaudiquet	7ac3b46b3c	chore(kube): bump caddy Docker tag to v2.11.7	2026-10-11 00:03:43 +02:00
renovate[bot]andvhaudiquet	bc905c78bc	chore(kube): bump chart Helm release cert-manager-webhook-ovh to v0.9.18	2026-10-11 00:03:34 +02:00
renovate[bot]andvhaudiquet	d97180783a	chore(kube): bump chart Helm release radicale to v2.1.4	2026-10-11 00:03:23 +02:00
renovate[bot]andvhaudiquet	60759d4e4a	chore(kube): bump stalwartlabs/stalwart Docker tag to v0.16.25	2026-10-11 00:03:05 +02:00
vhaudiquet	a1ce8d3880	rhema-claw(kube): deploy	2026-10-10 13:49:22 +02:00
vhaudiquet	8c7a905d39	saggar(kube): weekly full syncs on the embedded garages Garage's hourly full-sync cycles were the InvalidAccessKeyId source: while a key-table sync runs, auth lookups transiently fail, and the edge job's prune step kept landing inside the window (one sync ran 87 minutes). Both embedded stores get a weekly interval.	2026-10-06 06:20:19 +02:00
renovate[bot]andvhaudiquet	d72a76e416	chore(kube): bump chart Helm release radicale to v2.1.2	2026-10-04 23:39:30 +02:00
renovate[bot]andvhaudiquet	992415e4f1	chore(kube): bump caddy Docker tag to v2.11.6	2026-10-04 23:39:17 +02:00
renovate[bot]andvhaudiquet	d21f92eb4b	chore(kube): bump chart Helm release stalwart to v0.7.21	2026-10-04 23:39:03 +02:00
renovate[bot]andvhaudiquet	a8ff5d1b10	chore(kube): bump stalwartlabs/stalwart Docker tag to v0.16.24	2026-10-04 23:38:53 +02:00
vhaudiquet	9629597703	get-saggar(kube): deploy The saggar-dist chart: a single-node Garage hosting the distribution bucket — public read-only website on get.saggar.dev (the host label is what Garage's vhost routing resolves the bucket from), S3 write surface staying cluster-internal for the publish workflow. Same edge path as the other saggar hosts: dns A record, cert-manager certificate, caddy route. Chart repo and packages auth carry over from the saggar release.	2026-10-04 23:14:09 +02:00
vhaudiquet	89420bae2f	saggar(kube): set the device login's web origin (auth.uiUrl)	2026-10-01 21:25:56 +02:00
vhaudiquet	b8879b2025	saggar(kube): expose docs.saggar.dev The chart's docs book (static nginx) was up in-cluster only: give its ingress a host, with the same edge path as the api host — dns A record, cert-manager certificate and caddy route.	2026-10-01 19:39:26 +02:00
vhaudiquet	32207635fe	gitea(kube): raise limits to receive a kernel tree index-pack on ~12M objects OOMKilled the 1Gi container mid push, and 500m of CPU stretched the receive for many minutes before that. Bump to 6Gi / 4 cores; the node has ~40Gi free.	2026-09-30 23:03:47 +02:00
vhaudiquet	e6ab21317a	traefik(kube): raise web entrypoint read timeout to 5m Traefik v3 defaults respondingTimeouts.readTimeout to 60s counted over the whole request body, so large HTTP git pushes get a 504 the moment they pass one minute. writeTimeout stays unset: a cap there would cut long-lived SSE streams mid-flight.	2026-09-30 23:03:42 +02:00
vhaudiquet	ae8a4ddb27	saggar(kube): deploy Flux HelmRelease of the saggar hub (chart saggar-hub >=0.2.0-0, CI-published on the gitea saggar org, appVersion pinned to the image commit) with the web UI. Engine on api.saggar.dev for the CLI and the docker/apt registries, UI on saggar.dev — new cert, caddy route and dns A record for the api host, TLS terminating at Caddy as usual. Login via the home Gitea as an OIDC provider; private registry and helm repo auth share one packages token.	2026-09-30 22:30:47 +02:00
vhaudiquet	c83b4550ed	Merge branch 'main' of https://github.com/vhaudiquet/homeprod * 'main' of https://github.com/vhaudiquet/homeprod: chore(kube): bump chart Helm release cert-manager-webhook-ovh to v0.9.17 chore(kube): bump chart Helm release notesnook to v1.0.38 chore(kube): bump chart Helm release stalwart to v0.7.19 chore(kube): bump chart postgres Docker tag to v0.20.6 chore(kube): bump chart redis Docker tag to v0.35.4 chore(kube): bump stalwartlabs/stalwart Docker tag to v0.16.23	2026-09-28 01:24:28 +02:00
vhaudiquet	50d992b727	saggar.dev(kube): deploy - cert-manager-webhook-porkbun via Flux (chart 2.0.7, octabits fork) - porkbun DNS-01 solver on letsencrypt-production for saggar.dev - porkbun API credentials secret (sops) - saggar.dev apex Certificate + Caddy site block -> traefik	2026-09-28 01:14:58 +02:00
vhaudiquet	fc6db118d3	dns: manage saggar.dev via porkbun provider - new saggar.dev zone (apex A -> 82.64.154.58) targeting porkbun - replace '*' zone glob with explicit per-zone targets (cloudflare for vhaudiquet.fr/buildpath.win, porkbun for saggar.dev) - CI: switch to octodns/octodns image + install cloudflare/porkbun provider modules	2026-09-28 01:05:00 +02:00
renovate[bot]andvhaudiquet	7e5fa8a5b5	chore(kube): bump chart Helm release cert-manager-webhook-ovh to v0.9.17	2026-09-26 19:34:36 +02:00
renovate[bot]andvhaudiquet	30845bb249	chore(kube): bump chart Helm release notesnook to v1.0.38	2026-09-26 19:34:25 +02:00
renovate[bot]andvhaudiquet	52ac77a74e	chore(kube): bump chart Helm release stalwart to v0.7.19	2026-09-26 19:34:04 +02:00
renovate[bot]andvhaudiquet	e189bc66ea	chore(kube): bump chart postgres Docker tag to v0.20.6	2026-09-26 19:33:47 +02:00
renovate[bot]andvhaudiquet	008238922b	chore(kube): bump chart redis Docker tag to v0.35.4	2026-09-26 19:31:12 +02:00
renovate[bot]andvhaudiquet	82d646d399	chore(kube): bump stalwartlabs/stalwart Docker tag to v0.16.23	2026-09-26 14:19:15 +02:00
vhaudiquet	818ed232e4	dns: add pkgatlas.vhaudiquet.fr A record Caddy's wildcard *.vhaudiquet.fr vhost already routes the host to the in-cluster Traefik and on to the pkgatlas ingress.	2026-09-24 22:00:21 +02:00
vhaudiquet	b2f656c757	pkgatlas(kube): deploy Flux HelmRelease tracking the CI-published chart (>=0.4.0-0, timestamped versions, appVersion pinned to the image commit). Ingress host pkgatlas.vhaudiquet.fr via traefik; TLS terminates at Caddy with the *.vhaudiquet.fr wildcard, so the new @pkgatlas route proxies to Traefik like the other public vhosts.	2026-09-24 21:57:42 +02:00
vhaudiquet	3f986b65ab	gitea(kube): fix valkey memory limits	2026-09-22 22:35:36 +02:00
vhaudiquet	e354a56e15	gitea(kube): bump pvc storage to 30Gi	2026-09-22 21:58:25 +02:00
vhaudiquet	bd5fab7419	syncthing(kube): deploy	2026-09-22 00:30:42 +02:00
kosmosandvhaudiquet	e242b2ddce	openclaw: allow LAN egress on all ports The operator's managed policy is default-deny with egress limited to DNS and TCP 443, so reaching a LAN service on any other port is dropped. Measured against 10.4.1.222 from inside the pod: 443 returns RST while 7020 times out, so routing is fine and the port is what gets refused. Add a supplementary egress policy admitting 10.0.0.0/8, excluding the service (10.96.0.0/12) and pod (10.244.0.0/16) CIDRs so this does not grant every pod a path out. No port list: the point is arbitrary LAN services. Registered in the directory kustomization alongside the existing mail and radicale egress policies.	2026-09-20 17:33:35 +02:00
renovate[bot]andvhaudiquet	0d81f4a5d2	chore(kube): bump chart postgres Docker tag to v0.20.5	2026-09-19 20:56:00 +02:00
renovate[bot]andvhaudiquet	56e5992536	chore(kube): bump chart Helm release radicale to v2.1.1	2026-09-19 20:55:45 +02:00
renovate[bot]andvhaudiquet	77a5225358	chore(kube): bump chart Helm release kyverno to v3.9.1	2026-09-19 20:55:33 +02:00
renovate[bot]andvhaudiquet	7fd1a5e52f	chore(deps): update terraform docker to v3.9.0	2026-09-19 20:54:58 +02:00
renovate[bot]andvhaudiquet	23748ee4fc	chore(kube): bump chart Helm release stalwart to v0.7.18	2026-09-19 20:54:40 +02:00
renovate[bot]andvhaudiquet	45c3970a27	chore(kube): bump chart redis Docker tag to v0.35.1	2026-09-19 20:54:25 +02:00
renovate[bot]andvhaudiquet	fdb2634a46	chore(kube): bump stalwartlabs/stalwart Docker tag to v0.16.22	2026-09-19 20:54:03 +02:00